@gajae-code/coding-agent 0.11.1 → 0.11.3

package/dist/types/modes/utils/ui-helpers.d.ts

@@ -1,7 +1,7 @@
 import type { AgentMessage } from "@gajae-code/agent-core";
 import type { AssistantMessage, Message } from "@gajae-code/ai";
 import { type Component, type TUI } from "@gajae-code/tui";
-import type { InteractiveModeContext, IrcArrivalSnapshot, TranscriptRebuildPolicy } from "../../modes/types";
+import { type ComposerSubmissionOptions, type InteractiveModeContext, type IrcArrivalSnapshot, type TranscriptRebuildPolicy } from "../../modes/types";
 import { type SessionContext } from "../../session/session-manager";
 import { type ParsedIrcMessage } from "./irc-message";
 export type { TranscriptRebuildPolicy } from "../../modes/types";
@@ -63,7 +63,7 @@ export declare class UiHelpers {
     showWarning(warningMessage: string): void;
     showNewVersionNotification(newVersion: string): void;
     updatePendingMessagesDisplay(): void;
-    queueCompactionMessage(text: string, mode: "steer" | "followUp"): void;
+    queueCompactionMessage(text: string, mode: "steer" | "followUp", options?: ComposerSubmissionOptions): void;
     isKnownSlashCommand(text: string): boolean;
     flushCompactionQueue(options?: {
         willRetry?: boolean;

package/dist/types/runtime-mcp/manager.d.ts

@@ -181,7 +181,7 @@ export declare class MCPManager {
      */
     executePrompt(name: string, promptName: string, args?: Record<string, string>, options?: MCPRequestOptions): Promise<MCPGetPromptResult | undefined>;
     /**
-     * Get all server instructions (for system prompt injection).
+     * Get connected-server instructions for request-scoped untrusted user-role context.
      */
     getServerInstructions(): Map<string, string>;
     /**

package/dist/types/sdk/broker/broker.d.ts

@@ -1,4 +1,6 @@
-import { type BrokerDiscovery, redactBrokerDiscovery } from "./discovery";
+import type { NativeDirectoryTreeSnapshot } from "@gajae-code/natives";
+import { type DirectoryMigrationPolicy } from "../session-directory";
+import { type BrokerDiscovery, type RedactedBrokerDiscovery } from "./discovery";
 import { type LifecycleDurableEffectsReceipt, LifecycleLedger, type LifecycleStartupFailureReceipt } from "./lifecycle-ledger";
 import { SessionIndex } from "./session-index";
 export interface BrokerSettings {
@@ -6,18 +8,81 @@ export interface BrokerSettings {
     packageGeneration?: string;
     port?: number;
     heartbeatTtlMs?: number;
+    /** Broker-owned migration policy. Client lifecycle frames cannot select it. */
+    resolveDirectoryMigration?: (_cwd: string) => Promise<DirectoryMigrationPolicy>;
 }
+type ResolvedBrokerSettings = {
+    agentDir: string;
+    packageGeneration: string;
+    port: number;
+    heartbeatTtlMs: number;
+    resolveDirectoryMigration: (_cwd: string) => Promise<DirectoryMigrationPolicy>;
+};
 export type BrokerErrorCode = "idempotency_conflict" | "terminal_uncertain" | "broker_restarting" | "unavailable" | "endpoint_stale" | "resource_gone" | "invalid_input" | "spawn_failed" | "readiness_timeout" | "close_refused" | "not_found" | "live_session" | "cleanup_pending" | (string & {});
+export type BrokerCleanupIdentity = {
+    dev: string;
+    ino: string;
+    size: number;
+    mtimeNs: string;
+    sha256: string;
+};
+/** Exact retry evidence; detached paths are managed-receipt references, never caller authority. */
+export type BrokerLifecycleCleanupFile = {
+    /** Original lifecycle-owned path, retained only for exact identity validation. */
+    path: string;
+    identity: BrokerCleanupIdentity;
+    /** Monotonic append-only cleanup attempt. */
+    attempt?: number;
+    /** Immutable no-replace quarantine destination persisted before native detach. */
+    plannedPath: string;
+    /** Native-returned detached path, persisted after a failed post-detach cleanup. */
+    detachedPath?: string;
+    /** Append-only terminal proof for this exact artifact; completed entries are never retried. */
+    completed?: true;
+};
+/** Durable root-tree authority for broker artifact cleanup. */
+export type BrokerArtifactTree = {
+    identity: BrokerCleanupIdentity;
+    snapshot: NativeDirectoryTreeSnapshot;
+    plannedPath: string;
+    detachedPath?: string;
+    completed?: true;
+};
 export type BrokerCleanupEvidence = {
-    phase: "artifacts" | "transcript" | "metadata";
-    artifactsIdentity?: {
-        dev: string;
-        ino: string;
-    };
-    transcriptIdentity?: {
-        dev: string;
-        ino: string;
-    };
+    phase: "artifacts" | "transcript" | "metadata" | "lifecycle";
+    /** Ledger-bound deletion target; never reconstructed from a retry request. */
+    sessionsRoot?: string;
+    transcriptPath?: string;
+    cwd?: string;
+    metadataRoot?: string;
+    sessionId?: string;
+    artifactsIdentity?: BrokerCleanupIdentity;
+    transcriptIdentity?: BrokerCleanupIdentity;
+    /** Identity-bound lifecycle metadata marker retained when exact cleanup is deferred. */
+    metadataIdentity?: BrokerCleanupIdentity;
+    metadataPath?: string;
+    /** Monotonic append-only cleanup attempt. */
+    metadataAttempt?: number;
+    /** No-replace quarantine destination persisted before lifecycle metadata detach. */
+    plannedMetadataPath?: string;
+    /** Native-returned metadata quarantine path retained until identity-bound reconciliation succeeds. */
+    detachedMetadataPath?: string;
+    /** Append-only terminal proof for lifecycle metadata cleanup. */
+    metadataCompleted?: true;
+    detachedArtifactsPath?: string;
+    detachedTranscriptPath?: string;
+    /** Durable proof that artifact cleanup completed before transcript mutation. */
+    artifactsRemoved?: boolean;
+    /** Preauthorized no-replace artifact quarantine path persisted before detach. */
+    plannedArtifactsPath?: string;
+    /** Identity-bound artifact tree authority persisted before broker detach and replayed exactly. */
+    artifactTree?: BrokerArtifactTree;
+    /** Preauthorized no-replace transcript quarantine path persisted before detach. */
+    plannedTranscriptPath?: string;
+    /** Fully identity-bound startup-failure cleanup plan, persisted before any detach. */
+    lifecycleFiles?: BrokerLifecycleCleanupFile[];
+    /** Delete metadata receipts authorize only the canonical marker/ready sibling pair. */
+    lifecycleDeleteMetadata?: true;
 };
 export type BrokerResponse = {
     ok: true;
@@ -37,17 +102,18 @@ export type BrokerResponse = {
 };
 export declare class Broker {
     #private;
-    readonly settings: Required<BrokerSettings>;
+    readonly settings: ResolvedBrokerSettings;
     readonly index: SessionIndex;
     readonly ledger: LifecycleLedger;
     discovery: BrokerDiscovery | null;
     constructor(settings: BrokerSettings);
     start(): Promise<BrokerDiscovery>;
     get ownsDiscovery(): boolean;
-    status(): ReturnType<typeof redactBrokerDiscovery> | null;
+    status(): RedactedBrokerDiscovery | null;
     heartbeat(): Promise<void>;
     stop(): Promise<void>;
     handleRequest(operation: string, input: Record<string, unknown>, idempotencyKey?: string): Promise<BrokerResponse>;
 }
 /** Test-only hook for simulating a process crash after terminal persistence verification. */
 export declare function setTerminalPersistenceHookForTest(broker: Broker, hook: (() => void) | undefined): void;
+export {};

package/dist/types/sdk/broker/lifecycle-codec.d.ts

@@ -0,0 +1,4 @@
+/** Decodes persisted lifecycle bytes without replacement characters before JSON parsing. */
+export declare function decodeLifecycleUtf8(bytes: Uint8Array): string;
+/** Parses persisted lifecycle JSON only after fatal UTF-8 decoding. */
+export declare function parseLifecycleJson(bytes: Uint8Array): unknown;

package/dist/types/sdk/broker/lifecycle-ledger.d.ts

@@ -83,10 +83,24 @@ export type BeginResult = {
     kind: "in_progress";
     entry: LifecycleLedgerEntry;
 };
+export interface LifecycleLedgerLimits {
+    maxBytes?: number;
+    maxLineBytes?: number;
+    maxRows?: number;
+}
 export declare class LifecycleLedger {
     #private;
-    constructor(agentDir: string);
+    constructor(agentDir: string, limits?: LifecycleLedgerLimits);
     open(): Promise<this>;
+    /**
+     * Reads terminal proof for one request without recovering or changing the ledger.
+     *
+     * This intentionally accepts an unrelated unterminated final write: concurrent
+     * appenders may have started a different row after this request's synced terminal
+     * row. Complete rows are still decoded and validated strictly, and any incomplete
+     * tail that identifies this request withholds proof.
+     */
+    readTerminal(identity: string, requestHash: string): Promise<LifecycleLedgerEntry | undefined>;
     get warnings(): readonly string[];
     begin(identity: string, requestHash: string): Promise<BeginResult>;
     transition(identity: string, state: LifecycleState, fields?: Omit<Partial<LifecycleLedgerEntry>, "identity" | "requestHash" | "state" | "ts">): Promise<LifecycleLedgerEntry>;

package/dist/types/sdk/broker/lifecycle.d.ts

@@ -1,5 +1,5 @@
 import type { SdkStartupFailure, SdkStartupRollbackResult } from "../startup-capability";
-import type { Broker, BrokerResponse } from "./broker";
+import type { Broker, BrokerCleanupEvidence, BrokerResponse } from "./broker";
 import type { LifecycleDurableEffectsReceipt, LifecycleStartupFailureReceipt } from "./lifecycle-ledger";
 import { type ProcessIncarnationCommandRunner, type ProcessIncarnationOptions, parseDarwinProcessIncarnation, processIncarnation } from "./process-incarnation";
 import { type SdkInternalSpawnCommand } from "./runtime";
@@ -21,6 +21,8 @@ type LifecycleCommand = SdkInternalSpawnCommand | {
     args: string[];
 };
 type LifecycleCommandResolver = () => LifecycleCommand;
+/** Test-only hook for simulating a crash immediately after one exact lifecycle detach. */
+export declare function setLifecycleCleanupHookForTest(broker: Broker, hook: (() => void) | undefined): void;
 export declare function setLifecycleCommandResolverForTest(broker: Broker, resolver: LifecycleCommandResolver | undefined): void;
 export declare function setLifecycleTimingForTest(broker: Broker, timing: LifecycleTiming | undefined): void;
 export declare function hasValidLifecycleDeadlines(value: LifecycleDeadlines, now?: number): boolean;
@@ -43,6 +45,7 @@ export interface SessionLifecycleTranscriptIdentity {
     size: number;
     mtimeMs: number;
     mtimeNs: string;
+    sha256: string;
 }
 export interface SessionLifecycleLaunchRequest {
     operation: "session.create" | "session.fork" | "session.resume";
@@ -66,6 +69,7 @@ export interface SessionLifecycleLaunchRequest {
     lifecycleCleanupDeadlineAt: number;
 }
 export declare function readSessionLifecycleLaunchRequest(value: string | undefined, now?: number): SessionLifecycleLaunchRequest;
+type CleanupEvidence = BrokerCleanupEvidence;
 export declare function setProcessIncarnationForTest(broker: Broker, value: ((pid: number) => string | undefined) | undefined): void;
 /** The child writes this only after its endpoint and semantic ready event are both live. */
 export declare function writeSessionLifecycleReady(root: string, id: string, effectMarker: string): Promise<void>;
@@ -82,4 +86,4 @@ export interface LifecycleExecutionOutcome {
     deferredArtifactCleanup?: () => Promise<void>;
 }
 /** Returns the response together with every durable lifecycle fact needed for truthful replay. */
-export declare function executeLifecycle(broker: Broker, operation: string, input: Input, identity: string): Promise<LifecycleExecutionOutcome>;
+export declare function executeLifecycle(broker: Broker, operation: string, input: Input, identity: string, cleanup?: CleanupEvidence): Promise<LifecycleExecutionOutcome>;

package/dist/types/sdk/broker/process-incarnation.d.ts

@@ -9,6 +9,8 @@ export interface ProcessIncarnationOptions {
 }
 /** Parse the microsecond-resolution start timestamp returned by Darwin proc_pidinfo. */
 export declare function parseDarwinProcessIncarnation(info: Uint8Array): string | undefined;
+/** Whether `value` is a canonical process-incarnation string (`linux:`/`darwin:`/`windows:`). */
+export declare function isProcessIncarnation(value: unknown): value is string;
 /** A PID is reusable; bind it to the strongest OS-provided process start incarnation available. */
 export declare function processIncarnation(pid: number, options?: ProcessIncarnationOptions): string | undefined;
 export {};

package/dist/types/sdk/broker/session-index.d.ts

@@ -46,7 +46,6 @@ export declare class SessionIndex {
     get indexSeq(): number;
     append(input: Omit<SessionIndexEvent, "version" | "indexSeq" | "checksum" | "ts"> & Partial<Pick<SessionIndexEvent, "ts">>): Promise<SessionIndexEvent>;
     snapshot(): Promise<void>;
-    assertSupportedStateVersions(): Promise<void>;
     listSessions(): SessionList;
     hostUnregisteredAfter(registration: Pick<IndexedSession, "sessionId" | "endpointGeneration" | "pid" | "indexSeq" | "lifecycleRequestId">): {
         indexSeq: number;

package/dist/types/sdk/broker/state-version.d.ts

@@ -1,4 +1,5 @@
 export declare const SDK_STATE_VERSION = 1;
+export declare const SESSION_INDEX_SNAPSHOT_VERSION = 2;
 export declare class UnsupportedStateVersionError extends Error {
     readonly file: string;
     readonly version: number;
@@ -6,3 +7,4 @@ export declare class UnsupportedStateVersionError extends Error {
     constructor(file: string, version: number);
 }
 export declare function assertSupportedStateVersion(file: string, value: unknown): void;
+export declare function assertSupportedSnapshotVersion(file: string, value: unknown): void;

package/dist/types/sdk/bus/chat-effect-journal.d.ts

@@ -62,6 +62,7 @@ export declare class ChatEffectJournal {
         pidIncarnation?: (pid: number) => string | undefined;
         sleep?: (ms: number) => Promise<void>;
         lockTimeoutMs?: number;
+        maxTerminalEffects?: number;
     });
     get filePath(): string;
     read<TPayload = unknown>(id: string): Promise<ChatEffect<TPayload> | undefined>;

package/dist/types/sdk/bus/config-commands.d.ts

@@ -5,7 +5,7 @@
  * removed), but the user can still adjust per-surface behaviour from inside a
  * session thread with small slash commands:
  *
- * - `/verbose`            switch the mirror to verbose (full tool output + reasoning)
+ * - `/verbose`            switch the mirror to bounded tool-owned summaries + provider-displayable reasoning summaries
  * - `/lean`               switch back to lean (assistant text + tool names)
  * - `/verbosity lean|verbose`
  * - `/redact on|off`      toggle redaction of streamed content

package/dist/types/sdk/bus/config.d.ts

@@ -28,6 +28,9 @@ export interface NotificationSettingsSnapshot {
         botToken?: string;
         chatId?: string;
         activation?: Record<string, unknown>;
+        btw: {
+            enabled: boolean;
+        };
         rich: {
             enabled: boolean;
         };
@@ -65,6 +68,11 @@ export interface NotificationSettingsReader {
     getNotificationSettingsSnapshot(): NotificationSettingsSnapshot;
     getAgentDir(): string;
 }
+/**
+ * Validate and snapshot the raw global notification configuration used by both
+ * the interactive host and the lightweight daemon process.
+ */
+export declare function parseNotificationSettingsSnapshot(rawConfig?: unknown): NotificationSettingsSnapshot;
 export interface NotificationConfig {
     enabled: boolean;
     botToken?: string;
@@ -92,6 +100,9 @@ export interface NotificationConfig {
      */
     sessionScope: "all" | "primary";
     idleTimeoutMs: number;
+    btw: {
+        enabled: boolean;
+    };
     rich: {
         enabled: boolean;
     };

package/dist/types/sdk/bus/daemon-paths.d.ts

@@ -9,6 +9,7 @@ export interface DaemonPaths {
     dir: string;
     lock: string;
     state: string;
+    ownership: string;
     roots: string;
     steal: string;
     aliases: string;

package/dist/types/sdk/bus/html-format.d.ts

@@ -26,8 +26,9 @@ export declare function code(raw: string): string;
 export declare function pre(raw: string): string;
 /**
  * Convert a bounded markdown subset into Telegram HTML. Supported: fenced code,
- * inline code, `**bold**`, `*italic*`, `[text](url)` (safe schemes only),
- * `#` headers, `>` blockquotes, and GFM tables (rendered as a monospace block).
+ * inline code, `**bold**`, `*italic*`, `~~strikethrough~~`, `[text](url)`
+ * (safe schemes only), `#` headers, `>` blockquotes, and GFM tables (rendered
+ * as a monospace block).
  * Unsupported or malformed markdown is left as escaped literal text — never
  * emitted as unbalanced tags.
  */

package/dist/types/sdk/bus/index.d.ts

@@ -17,6 +17,7 @@
  * Enable with Settings notifications config, `GJC_NOTIFICATIONS=1` (a token is
  * generated), or `GJC_NOTIFICATIONS_TOKEN`.
  */
+import type { Tool } from "@gajae-code/ai";
 import { NotificationServer } from "@gajae-code/natives";
 import { Settings } from "../../config/settings";
 import type { ExtensionAPI, ExtensionContext } from "../../extensibility/extensions";
@@ -259,6 +260,9 @@ export declare class PresentationArbiter {
     cancel(gateId: string, reason: string): void;
     dispose(): void;
 }
+/** Stable projection of the tool-owned safe-display seam (never the full Tool surface). */
+type SafeSummaryTool = Pick<Tool, "safeSummary" | "safeSummaryFields">;
+export declare function projectToolSummary(tool: SafeSummaryTool | undefined, kind: "args" | "result", value: unknown): string | undefined;
 export declare function notificationsEnabled(): boolean;
 /** Workflow-gate answer shape. */
 interface GateAnswer {
@@ -304,6 +308,26 @@ export interface NotificationControlCommandResult {
     }>;
 }
 export declare function executeNotificationControlCommand(command: NotificationControlCommandPayload | undefined, ctx: ExtensionContext, api: ExtensionAPI, expectedSessionId?: string): Promise<NotificationControlCommandResult>;
+interface EphemeralTurnAuthority {
+    sessionId: string;
+    endpointDigest: string;
+    eventGeneration: number;
+}
+/** Host-owned, bounded idempotency and cancellation lifecycle for v3 side turns. */
+export declare class EphemeralTurnHost {
+    #private;
+    constructor(sendTo: (connectionId: string, frame: Record<string, unknown>) => void, execute: (question: string, signal: AbortSignal) => Promise<{
+        replyText: string;
+    }>, now?: () => number);
+    configureAuthority(authority: EphemeralTurnAuthority): void;
+    disable(): void;
+    enable(): void;
+    dispose(): void;
+    handle(connectionId: string, frame: Record<string, unknown>): boolean;
+    sessionUnavailable(sessionId: string): void;
+    /** Testable event-ring eviction boundary; tombstones remain idempotency authority. */
+    evictTerminalEvents(): void;
+}
 export declare function createNotificationsExtension(api: ExtensionAPI, options?: {
     settings?: Settings;
     ensureTelegramDaemon?: (input: {
@@ -314,6 +338,11 @@ export declare function createNotificationsExtension(api: ExtensionAPI, options?
     /** Suppress auto-delivery for a GJC-spawned child under `sessionScope=primary`. */
     spawnedByGjc?: boolean;
     controller?: NotificationSessionController;
+    /** Whether this host mode can own the root SDK endpoint. Default: true. */
+    sdkHostModeSupported?: boolean;
     onSdkRequest?: (kind: "control" | "query", connectionId: string, frame: Record<string, unknown>) => void;
+    runEphemeralTurn?: (promptText: string, signal: AbortSignal) => Promise<{
+        replyText: string;
+    }>;
 }): void;
 export {};

package/dist/types/sdk/bus/lifecycle-control-runtime.d.ts

@@ -68,6 +68,8 @@ export declare function daemonCloseSession(env?: NodeJS.ProcessEnv, deps?: {
  *  prefix against saved history and fail closed (`ambiguous`/`notFound`) before
  *  cold-restarting exactly one resolved session via the daemon-safe launcher. */
 export declare function daemonResumeSession(env?: NodeJS.ProcessEnv, opts?: {
+    agentDir?: string;
+    /** Explicit managed root for isolated tests. */
     sessionsRoot?: string;
     listSessions?: (env: NodeJS.ProcessEnv) => GjcTmuxSessionStatus[];
     ownerIsolationProbe?: OwnerIsolationProbe;
@@ -100,6 +102,8 @@ export declare function buildOrchestratorDeps(input: {
     auditRedactionKey: Uint8Array;
     /** Root of saved session histories (`<agentDir>/sessions`), for resume resolution. */
     sessionsRoot?: string;
+    /** Agent directory used for readonly managed-session resume resolution. */
+    agentDir?: string;
     env?: NodeJS.ProcessEnv;
 }): OrchestratorDeps;
 /**

package/dist/types/sdk/bus/notification-service.d.ts

@@ -5,10 +5,29 @@ import type { Settings } from "../../config/settings";
  * can never leak a credential regardless of where the string originated.
  */
 export declare function sanitizeDiagnostic(text: string, token?: string): string;
+/** Identity evidence required to remove precisely the endpoint that was inspected. */
+export interface NotificationEndpointFileIdentity {
+    dev: bigint;
+    ino: bigint;
+    size: bigint;
+    mtimeNs: bigint;
+    sha256: string;
+}
+export interface NotificationEndpointFile {
+    bytes: Buffer;
+    identity: NotificationEndpointFileIdentity;
+}
+export interface NotificationExactUnlinkResult {
+    ok: boolean;
+    code?: string;
+    detachedPath?: string;
+}
 /** Minimal filesystem surface the service needs; injectable for tests. */
 export interface NotificationServiceFs {
     readdir(dir: string): Promise<string[]>;
     readFile(file: string, encoding: "utf8"): Promise<string>;
+    readEndpointFile(file: string): Promise<NotificationEndpointFile>;
+    exactUnlink(file: string, identity: NotificationEndpointFileIdentity): Promise<NotificationExactUnlinkResult>;
     unlink(file: string): Promise<void>;
     /**
      * Atomically create `file` with O_EXCL semantics: resolves `true` when this
@@ -123,6 +142,7 @@ export interface NotificationRecoveryReport {
     endpointsRemoved: RecoveredEndpoint[];
     endpointsKept: number;
     endpointsUnreadable: number;
+    endpointsDetached?: string[];
     daemon: {
         action: DaemonRecoveryAction;
         detail: string;

package/dist/types/sdk/bus/rate-limit-pool.d.ts

@@ -41,6 +41,11 @@ export interface RateLimitItem<T = unknown> {
     /** Opaque payload the caller maps to an actual Telegram send. */
     payload: T;
 }
+export type RateLimitDisposition = "queued" | "sending" | "accepted" | "rejected" | "ambiguous" | "removed" | "expired";
+export interface RateLimitHandle {
+    itemId: string;
+    settled: Promise<Exclude<RateLimitDisposition, "queued" | "sending">>;
+}
 /** Options for {@link RateLimitPool}. */
 export interface RateLimitPoolOptions {
     /** Burst capacity (max tokens). Default 20 (Telegram per-chat burst). */
@@ -74,6 +79,7 @@ export declare class RateLimitPool<T = unknown> {
     private readonly laneCursor;
     private tokens;
     private lastRefill;
+    private readonly settlements;
     private seqCounter;
     constructor(options?: RateLimitPoolOptions);
     /** Number of items currently queued across all lanes. */
@@ -85,7 +91,12 @@ export declare class RateLimitPool<T = unknown> {
      * item in the same `(sessionId, lane)` replace its payload (latest wins)
      * while preserving FIFO position; identified items are always appended.
      */
-    submit(item: RateLimitItem<T>): void;
+    submit(item: RateLimitItem<T>): RateLimitHandle;
+    /** Settle a stable item after its external transport effect has a known outcome. */
+    settle(itemId: string, disposition: Exclude<RateLimitDisposition, "queued" | "sending">): void;
+    /** Mark a granted item as owned by an external transport effect. */
+    markSending(itemId: string): void;
+    private handle;
     /**
      * Grant as many queued items as tokens allow at `nowMs`. This compatibility
      * wrapper discards items that expired during the drain.
@@ -98,7 +109,7 @@ export declare class RateLimitPool<T = unknown> {
      */
     drainWithExpired(nowMs?: number): RateLimitDrainResult<T>;
     /** Remove queued items matching `predicate` without consuming tokens. Returns removed items in lane/FIFO order. */
-    removeWhere(predicate: (item: RateLimitItem<T>) => boolean): RateLimitItem<T>[];
+    removeWhere(predicate: (item: RateLimitItem<T>) => boolean, disposition?: Exclude<RateLimitDisposition, "queued" | "sending">): RateLimitItem<T>[];
     /** Remove exactly one queued item by its stable id without consuming a token. */
     removeById(itemId: string): RateLimitItem<T> | undefined;
     private refill;

package/dist/types/sdk/bus/recent-activity.d.ts

@@ -1,8 +1,8 @@
 /** One ranked recent-session entry surfaced to the picker. */
 export interface RecentSessionEntry {
-    /** Session id (the `.jsonl` file stem). */
+    /** Session id from the validated managed candidate header. */
     sessionId: string;
-    /** Working directory / repo path, when recoverable from the header. */
+    /** Validated workspace path recorded by the managed candidate. */
     path?: string;
     /** Branch, when recoverable from the header. */
     branch?: string;
@@ -18,22 +18,31 @@ export interface RecentSessionEntry {
     internal?: boolean;
 }
 export interface RecentActivityDeps {
-    /** Root holding `<encoded-cwd>/<sessionId>.jsonl` history files. */
-    sessionsRoot: string;
+    /** Workspace whose managed sessions will be listed readonly. */
+    cwd: string;
+    /** Agent directory used to resolve the managed session scope. */
+    agentDir?: string;
+    /** Explicit managed root for isolated tests. */
+    sessionsRoot?: string;
     /** Optional breadcrumb session-file paths (current terminals). */
     breadcrumbPaths?: string[];
     /** Max entries to return (default 20). */
     limit?: number;
     /** Include internal helper/sub-agent sessions (default true). */
     includeInternal?: boolean;
+    /** Search every validated v2 workspace scope below the session root (default false). */
+    allWorkspaces?: boolean;
     /** Injection seam for tests. */
     readInitialLines?: (file: string, maxLines: number) => string[];
 }
-/**
- * List recent sessions ranked by history-file mtime (newest first).
- *
- * Scans `<sessionsRoot>/<encoded-cwd>/<sessionId>.jsonl`, stats each file, and
- * returns up to `limit` entries enriched with header metadata and a
- * `currentTerminal` flag for any breadcrumb-referenced session file.
- */
-export declare function listRecentSessions(deps: RecentActivityDeps): RecentSessionEntry[];
+/** Lists readonly managed candidates, optionally across every validated v2 workspace scope, ranked by history-file mtime. */
+export type ListRecentSessionsResult = {
+    kind: "complete";
+    entries: RecentSessionEntry[];
+    warnings: readonly string[];
+} | {
+    kind: "error";
+    code: "scope_unavailable" | "managed_scan_failed";
+    message: string;
+};
+export declare function listRecentSessions(deps: RecentActivityDeps): Promise<ListRecentSessionsResult>;

package/dist/types/sdk/bus/rich-document.d.ts

@@ -0,0 +1,7 @@
+export type RichEligibility = {
+    kind: "eligible";
+} | {
+    kind: "ineligible";
+};
+/** Conservatively recognize `/btw` Markdown that can be represented as rich content. */
+export declare function parseRichEligibility(markdown: string): RichEligibility;

package/dist/types/sdk/bus/rich-render.d.ts

@@ -2,26 +2,17 @@
  * Rich-message promotion for stable non-editable Telegram text sends.
  *
  * When enabled, the daemon promotes eligible finalized `sendMessage` payloads
- * carrying raw markdown to the Bot API `sendRichMessage` method. On any miss or
- * failure the daemon keeps the unchanged HTML `sendMessage` path, so the
- * off-state request bodies are byte-identical.
+ * carrying raw markdown to Bot API `sendRichMessage`. Only an explicit
+ * `{ ok: false }` response selects the unchanged HTML path; ambiguous transport
+ * outcomes remain single-attempt and never fall back.
  */
 import type { BotApi } from "./telegram-daemon";
 import type { ThreadedSend } from "./threaded-render";
 /**
- * Telegram's hard per-message character ceiling (4096). Surfaced here purely as
- * documentation and a marker for a future native rich-message splitter — it is
- * intentionally NON-BEHAVIORAL and MUST stay that way: nothing in the rich path
- * branches on this value.
- *
- * Overflow is already safe without it. The production final-answer text is capped
- * at 3500 chars upstream (`summaryFromMessage(..., 3500)`), so a promoted
- * `sendRichMessage` never approaches this ceiling; and if the Bot API ever rejects
- * an oversized rich payload it returns `{ ok: false }`, which
- * `deliverRichWithFallback` (below) turns into the chunked HTML `splitTelegramHtml`
- * fallback (each chunk ≤ TELEGRAM_MESSAGE_LIMIT). This constant only marks where a
- * future rich splitter would read its ceiling; wiring it into a branch would change
- * byte-for-byte behavior and is out of scope.
+ * Telegram's hard per-message character ceiling (4096). Final-answer promotion
+ * uses this value to keep oversized Markdown on the existing chunked HTML path.
+ * `/btw` eligibility has its own 32,768-scalar route guard; only a definite
+ * rich rejection may select the correlated HTML path.
  */
 export declare const RICH_MESSAGE_LIMIT = 4096;
 /** Wrap raw markdown in the `sendRichMessage` request payload shape. */
@@ -30,9 +21,12 @@ export declare function buildRichMessage(raw: string, extras?: {
 }): {
     rich_message: {
         markdown: string;
+        skip_entity_detection: true;
     };
     reply_markup?: unknown;
 };
+/** Whether `/btw` Markdown may use Bot API 10.1 rich delivery. */
+export declare function isBtwRichEligible(markdown: string): boolean;
 /**
  * Whether a granted send should be promoted to `sendRichMessage`. Fail-closed
  * and class-aware: every clause must hold, otherwise the daemon keeps the HTML path.
@@ -42,37 +36,21 @@ export declare function shouldPromoteRich(input: {
     send: ThreadedSend;
 }): boolean;
 /**
- * Deliver the promoted rich message, falling back to `fallbackDeliver` (the
- * unchanged HTML `sendMessage` loop) on any failure. A failure is either a
- * thrown transport error or a `{ ok: false }` JSON response (the transport
- * returns `res.json()` for JSON methods, so `ok:false` does not throw). On
- * failure exactly one diagnostic is logged before the fallback runs; on success
- * the fallback never runs.
- *
- * Returns the sent message's `message_id` on success (when the response carries
- * one), otherwise `undefined` — including every failure/fallback path and a
- * success whose response omits `result.message_id`. Callers that ignore the
- * return value are unaffected.
+ * Deliver the promoted rich message, falling back to `fallbackDeliver` only
+ * after an explicit `{ ok: false }` response. Transport errors and malformed or
+ * ambiguous responses are logged but never retried or sent again through HTML.
  */
 export declare function deliverRichWithFallback(botApi: BotApi, base: {
     chat_id: string | number;
     message_thread_id?: number;
-}, send: ThreadedSend, fallbackDeliver: () => Promise<void>, log?: {
+}, send: ThreadedSend, signal: AbortSignal, fallbackDeliver: () => Promise<void>, log?: {
     warn(msg: string): void;
 }): Promise<number | undefined>;
 /**
  * Deliver an action-needed (ask/idle) message via `sendRichMessage`, falling
- * back to the unchanged HTML chunk loop on any failure. Mirrors
- * {@link deliverRichWithFallback} but takes an explicit markdown body plus an
- * optional top-level `reply_markup` (probe-confirmed: `sendRichMessage` accepts
- * `reply_markup` alongside `rich_message`), and surfaces a structured outcome so
- * the daemon can route inbound replies to the resulting message id.
- *
- * On rich success: returns `{ messageId, usedRich: true, usedFallback: false }`
- * where `messageId` is `res.result.message_id` when present. On a `{ ok:false }`
- * response or a thrown transport error: warns exactly once, runs `htmlFallback`,
- * and returns `{ messageId, usedRich: false, usedFallback: true }` where
- * `messageId` is the fallback's return value (the last HTML chunk's id).
+ * back to the unchanged HTML chunk loop only after an explicit `{ ok:false }`
+ * response. Other outcomes are ambiguous, are logged, and preserve the single
+ * physical rich delivery.
  */
 export declare function deliverRichActionWithFallback(botApi: BotApi, base: {
     chat_id: string | number;
@@ -80,8 +58,7 @@ export declare function deliverRichActionWithFallback(botApi: BotApi, base: {
 }, opts: {
     markdown: string;
     replyMarkup?: unknown;
-    requireMessageId?: boolean;
-}, htmlFallback: () => Promise<number | undefined>, log?: {
+}, signal: AbortSignal, htmlFallback: () => Promise<number | undefined>, log?: {
     warn(msg: string): void;
 }): Promise<{
     messageId?: number;