@gajae-code/coding-agent 0.11.10 → 0.11.11

package/dist/types/runtime/memory-guard.d.ts

@@ -0,0 +1,39 @@
+import type { Settings } from "../config/settings";
+import type { MemoryGuardDecision, MemoryGuardDomainSnapshot, MemoryGuardPolicy, MemoryGuardSchedulerState } from "./memory-guard-contract";
+type WorkOwner = {
+    generation: number;
+    source: "timer" | "external";
+};
+export interface MemoryGuardHostRegistration {
+    ownerId: string;
+    intervalMs: number;
+}
+export interface MemoryGuardHostOptions {
+    run: () => Promise<void>;
+    logDebug?: (message: string, meta?: Record<string, unknown>) => void;
+    schedulerNow?: () => number;
+}
+export declare function resolveMemoryGuardPolicy(settings: Settings): MemoryGuardPolicy;
+export declare function chooseMemoryGuardAction(input: {
+    domain: MemoryGuardDomainSnapshot;
+    hostSupported: boolean;
+    workerSupported: (workerId: string) => boolean;
+}): MemoryGuardDecision;
+export declare function revalidateMemoryGuardAction(previous: Extract<MemoryGuardDecision, {
+    kind: "execute";
+}>, revalidated: MemoryGuardDecision): MemoryGuardDecision;
+export declare class MemoryGuardHost {
+    #private;
+    constructor(options: MemoryGuardHostOptions);
+    register(registration: MemoryGuardHostRegistration): () => void;
+    updateInterval(ownerId: string, intervalMs: number): void;
+    runTick(generation?: number, source?: WorkOwner["source"]): Promise<void>;
+    runTimerCallbackForTest(owner: {
+        generation: number;
+        token: number;
+    }, deadline: number): Promise<void>;
+    setSchedulerNowForTest(now: () => number): void;
+    getStateForTest(): MemoryGuardSchedulerState;
+    resetForTest(): void;
+}
+export {};

package/dist/types/runtime/memory-limit.d.ts

@@ -0,0 +1,11 @@
+export interface EffectiveMemoryLimitInput {
+    hardCapBytes?: number | null;
+    policyLimitBytes?: number | null;
+}
+export interface EffectiveMemoryLimit {
+    hardCapBytes: number | null;
+    policyLimitBytes: number | null;
+    effectiveBytes: number | null;
+    source: "none" | "hard_cap" | "policy_limit" | "hard_cap_and_policy_limit";
+}
+export declare function resolveEffectiveMemoryLimit(input: EffectiveMemoryLimitInput): EffectiveMemoryLimit;

package/dist/types/runtime-mcp/manager.d.ts

@@ -5,6 +5,7 @@ import type { AuthStorage } from "../session/auth-storage";
 import type { MCPToolDetails } from "./tool-bridge";
 import type { MCPToolCache } from "./tool-cache";
 import type { MCPGetPromptResult, MCPPrompt, MCPRequestOptions, MCPResource, MCPResourceReadResult, MCPResourceTemplate, MCPServerConfig, MCPServerConnection } from "./types";
+export declare function resolveStartupTimeoutMs(configs: MCPServerConfig[], maxStartupTimeoutMs?: number): number;
 /**
  * Stable, total ordering on MCP tools by name.
  *
@@ -48,6 +49,13 @@ export interface MCPDiscoverOptions {
 export interface MCPManagerOptions {
     /** Restrict this instance to tools from an explicit MCP config. */
     toolsOnly?: boolean;
+    /**
+     * Ceiling for the startup wait, in milliseconds. Only ACP lifecycle launches
+     * set this, so a slow ACP MCP handshake gets the readiness budget while every
+     * other consumer keeps the short default. Non-positive or non-finite values
+     * are ignored and the default applies.
+     */
+    maxStartupTimeoutMs?: number;
 }
 /**
  * MCP Server Manager.

package/dist/types/sdk/acp/final-text.d.ts

@@ -0,0 +1,19 @@
+export declare const ACP_FINAL_TEXT_LIMIT = 100000;
+export interface BoundedAcpFinalText {
+    text: string;
+    truncated: boolean;
+}
+export type AcpFinalTextResolution = {
+    kind: "none";
+    final: BoundedAcpFinalText;
+} | {
+    kind: "emit";
+    final: BoundedAcpFinalText;
+    text: string;
+} | {
+    kind: "divergent";
+    final: BoundedAcpFinalText;
+};
+export declare function boundAcpFinalText(value: string): BoundedAcpFinalText;
+export declare function acpFinalTextFromMessage(message: unknown): BoundedAcpFinalText;
+export declare function resolveAcpFinalText(streamed: string, finalText: string): AcpFinalTextResolution;

package/dist/types/sdk/acp/mcp.d.ts

@@ -0,0 +1,23 @@
+export declare const ACP_MCP_REQUEST_TIMEOUT_MS = 30000;
+export declare const ACP_MCP_LIFECYCLE_TIMEOUT_MS: number;
+/**
+ * Slice of the readiness budget reserved for the work that follows MCP startup
+ * (session wiring, marker publication). The ACP MCP startup ceiling is the
+ * remaining time to `semanticReadyDeadlineAt` minus this headroom, so a slow
+ * MCP handshake cannot consume the whole readiness window.
+ */
+export declare const ACP_MCP_STARTUP_HEADROOM_MS = 250;
+export interface SessionLifecycleMcpStdioServer {
+    type?: "stdio";
+    name: string;
+    command: string;
+    args: string[];
+    env?: Record<string, string>;
+}
+export interface SessionLifecycleMcpRemoteServer {
+    type: "http" | "sse";
+    name: string;
+    url: string;
+    headers?: Record<string, string>;
+}
+export type SessionLifecycleMcpServer = SessionLifecycleMcpStdioServer | SessionLifecycleMcpRemoteServer;

package/dist/types/sdk/broker/lifecycle.d.ts

@@ -1,3 +1,4 @@
+import type { SessionLifecycleMcpServer } from "../acp/mcp";
 import type { SdkStartupFailure, SdkStartupRollbackResult } from "../startup-capability";
 import type { Broker, BrokerCleanupEvidence, BrokerResponse } from "./broker";
 import type { LifecycleDurableEffectsReceipt, LifecycleStartupFailureReceipt } from "./lifecycle-ledger";
@@ -61,6 +62,7 @@ export interface SessionLifecycleLaunchRequest {
     /** Broker-issued effect marker which the child echoes only after host readiness. */
     effectMarker?: string;
     modelPreset?: string;
+    mcpServers?: SessionLifecycleMcpServer[];
     worktree?: SessionLifecycleWorktreeTarget;
     receivedAt: number;
     requestedReadinessTimeoutMs: number;

package/dist/types/sdk/bus/chat-daemon-control.d.ts

@@ -15,7 +15,8 @@ export type ChatDaemonAction = "stop" | "reload";
  * concrete detached quarantine plus a proven-absent canonical lock pathname —
  * when deleting an observed owner-lock lease. Generation 12 refreshes retained
  * native path and process authority semantics. Generation 13 rejects special
- * files before retained native authority opens.
+ * files before retained native authority opens. Generation 14 reloads shared
+ * chat daemons after notification configuration parsing changes.
  */
 export declare const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>>;
 export declare function chatDaemonGeneration(kind: ChatDaemonKind): number;

package/dist/types/sdk/bus/index.d.ts

@@ -374,6 +374,7 @@ interface SessionRuntime {
         sessionId: string;
         commandId?: string;
         turnId?: string;
+        finalText?: string;
     } | {
         type: "agent_failed";
         sessionId: string;
@@ -423,7 +424,8 @@ interface SessionRuntime {
     /** Started tool calls awaiting a terminal activity frame, keyed by tool call id. */
     inFlightTools: Map<string, {
         toolName: string;
-        args: unknown;
+        args?: unknown;
+        pendingPhase?: "completed" | "failed" | "cancelled";
     }>;
     /** Cancels the postmortem cleanup that emits `session_closed` on process teardown. */
     cancelPostmortemCleanup: () => void;

package/dist/types/sdk/bus/rate-limit-pool.d.ts

@@ -84,6 +84,8 @@ export declare class RateLimitPool<T = unknown> {
     constructor(options?: RateLimitPoolOptions);
     /** Number of items currently queued across all lanes. */
     get pending(): number;
+    /** Whether any queued item currently matches the predicate. */
+    someQueued(predicate: (item: RateLimitItem<T>) => boolean): boolean;
     /** Current available token count (after refill at `now`). */
     availableTokens(nowMs?: number): number;
     /**

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -37,11 +37,13 @@ export declare const NOTIFICATION_PROTOCOL_VERSION = 3;
  * Generation 28 rejects special files before retained native authority opens.
  * Generation 29 adds serving-epoch compatibility, sidecar heartbeat, root GC,
  * and Bot API cooldown structural fixes (#2956, #2960, #3048).
+ * Generation 30 adds opt-in tool activity delivery, closed lifecycle phases,
+ * and capability-versioned mixed-host compatibility.
  */
-export declare const DAEMON_GENERATION = 29;
+export declare const DAEMON_GENERATION = 30;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 1 covers
- * all builds published before this field existed; bump this to force serving
- * convergence and reload of compatible live predecessors.
+ * all builds published before this field existed; epoch 2 covered generation 29;
+ * bump this to force serving convergence and reload of compatible live predecessors.
  */
-export declare const SERVING_EPOCH = 2;
+export declare const SERVING_EPOCH = 3;

package/dist/types/sdk/bus/telegram-daemon.d.ts

@@ -107,8 +107,10 @@ export declare const CLIENT_PING_PONG_CAPABILITY = "client_ping_pong";
 /** Capability required for typed controls and semantic Selected acknowledgement frames. */
 export declare const ASK_SELECTED_ACK_CAPABILITY = "ask_selected_ack_v1";
 export declare const ASK_CONTROLS_CAPABILITY = "ask_controls_v1";
-/** Capability required for tool lifecycle and reasoning-summary frames. */
-export declare const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v1";
+/** Capability for the closed tool phase set: started, completed, failed, and cancelled. */
+export declare const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v2";
+/** Receive-only compatibility capability for pre-v2 hosts. */
+export declare const LEGACY_TOOL_ACTIVITY_CAPABILITY = "tool_activity_v1";
 /**
  * File-lock options whose acquisition budget covers the full reload-reservation
  * critical section: the in-lock freshness poll plus the controller's
@@ -752,7 +754,7 @@ export interface TelegramDaemonOptions {
     richDraft?: {
         enabled: boolean;
     };
-    /** Tool start/completion messages (enabled by default). */
+    /** Tool start/completion messages (off by default; explicit opt-in only). */
     toolActivity?: {
         enabled: boolean;
     };
@@ -786,6 +788,8 @@ interface SessionSocket {
     /** True once the server advertised the `client_ping_pong` capability. */
     capable: boolean;
     ephemeralCapable: boolean;
+    /** Tool activity contract advertised by the connected host. */
+    toolActivityCapability?: "v1" | "v2";
     /** Timestamp (via opts.now) of the last received pong; seeds the TTL window. */
     lastPongAt: number;
     /** Nonce of the most recent in-flight ping, if any. */
@@ -815,6 +819,9 @@ export declare class TelegramNotificationDaemon {
     /** Endpoint-bound ownership for visible or dispatching tool bubbles. */
     private readonly toolActivityOwners;
     private readonly revokedToolEndpoints;
+    /** Exact settlement of each admitted legacy-v1 start; retained only while visible. */
+    private readonly legacyToolStarts;
+    private nextLegacyToolStartId;
     private readonly unresolvedToolTerminalizations;
     private toolTerminalizationChain;
     private toolActivityPolicyEpoch;
@@ -986,8 +993,21 @@ export declare class TelegramNotificationDaemon {
     private topicIdentityKey;
     private topicIdentityBase;
     private topicOwnerForIdentity;
+    private admitLegacyToolStart;
+    private legacyToolStartForTerminal;
+    private settleLegacyToolStart;
+    private cancelUnsentLegacyToolStart;
+    private failLegacyToolStart;
+    private settleRejectedLegacyToolSubmission;
+    private cancelLegacyToolStartsForSession;
+    private cleanLegacyToolStartsForCapabilityUpgrade;
+    private cancelLegacyToolStartsForPolicyTransition;
     private toolActivityOwner;
+    private renderThreadedFrame;
+    private toolActivityFrameWithoutSummaries;
+    private toolActivitySummariesAreCurrent;
     private toolActivityAuthorityIsCurrent;
+    private toolActivityDeliveryIsCurrent;
     private submitThreadedFrame;
     private existingTopicForPrivateChat;
     private topicAuthorityLease;

package/dist/types/sdk/host/control/operations.d.ts

@@ -18,6 +18,7 @@ export interface ControlSurface {
     operateGoal(op: string, objective?: string): Promise<ControlValue> | ControlValue;
     replaceTodo(items: ControlValue): Promise<ControlValue> | ControlValue;
     setModel(id: string, thinkingLevel?: ControlValue): Promise<ControlValue> | ControlValue;
+    setModelProfile(id: string): Promise<ControlValue> | ControlValue;
     cycleModel(): Promise<ControlValue> | ControlValue;
     setThinking(level: ControlValue): Promise<ControlValue> | ControlValue;
     cycleThinking(): Promise<ControlValue> | ControlValue;

package/dist/types/sdk/lifecycle-session.d.ts

@@ -10,5 +10,14 @@ export type CreateLifecycleAgentSessionResult = {
     rollback: SdkStartupRollbackTracker;
     failure: SdkStartupFailure;
 };
+/** Options accepted by lifecycle-only session construction. */
+export type CreateLifecycleAgentSessionOptions = CreateAgentSessionOptions & {
+    /**
+     * Startup budget for ACP lifecycle MCP launches, in milliseconds. Set only
+     * when the lifecycle request supplies `mcpServers`; ordinary consumers keep
+     * the manager's short default ceiling.
+     */
+    mcpStartupTimeoutMs?: number;
+};
 /** Internal lifecycle-only session construction with an owner-bound SDK startup result. */
-export declare function createLifecycleAgentSession(options?: CreateAgentSessionOptions): Promise<CreateLifecycleAgentSessionResult>;
+export declare function createLifecycleAgentSession(options?: CreateLifecycleAgentSessionOptions): Promise<CreateLifecycleAgentSessionResult>;

package/dist/types/sdk/startup-capability.d.ts

@@ -16,6 +16,12 @@ export type SdkStartupResult = {
 };
 /** Internal symbols for lifecycle-only SDK startup construction and bus wiring. */
 export declare const lifecycleStartupCapabilityOption: unique symbol;
+/**
+ * Internal option carrying the startup budget for ACP lifecycle MCP launches.
+ * Only set when the lifecycle request actually supplies `mcpServers`, so the
+ * longer ceiling never leaks to ordinary CLI/SDK `mcpConfigPath` consumers.
+ */
+export declare const lifecycleMcpStartupTimeoutOption: unique symbol;
 export declare function attachLifecycleStartupCapability(api: object, capability: SdkStartupCapability): void;
 export declare function lifecycleStartupCapabilityForApi(api: object): SdkStartupCapability | undefined;
 export interface SdkStartupRollbackResult {

package/dist/types/session/agent-session.d.ts

@@ -80,7 +80,7 @@ import type { TtsrManager } from "../export/ttsr";
 import type { LoadedCustomCommand } from "../extensibility/custom-commands";
 import type { CustomTool } from "../extensibility/custom-tools/types";
 import type { ExtensionRunner } from "../extensibility/extensions";
-import type { CompactOptions, ContextUsage } from "../extensibility/extensions/types";
+import type { CompactOptions, ContextUsage, ExtensionTranscriptEntry } from "../extensibility/extensions/types";
 import { type Skill, type SkillWarning } from "../extensibility/skills";
 import { type FileSlashCommand } from "../extensibility/slash-commands";
 import { GoalRuntime } from "../goals/runtime";
@@ -102,7 +102,7 @@ export { DefaultModelSelectionRecoveryError } from "./default-model-selection";
 import type { ClientBridge, ClientBridgePermissionOption, ClientBridgePermissionOutcome, ClientBridgePermissionToolCall } from "./client-bridge";
 import { type ContributionPrepOptions, type ContributionPrepResult } from "./contribution-prep";
 import { type CustomMessage } from "./messages";
-import type { BranchSummaryEntry, CompactionEntry, NewSessionOptions, RecoveryHydrationContext, RecoveryHydrationPromotionFence, SessionContext, SessionManager, SessionManagerCloseOutcome } from "./session-manager";
+import type { BranchSummaryEntry, CompactionEntry, NewSessionOptions, PreparedNewSession, RecoveryHydrationContext, RecoveryHydrationPromotionFence, SessionContext, SessionManager, SessionManagerCloseOutcome } from "./session-manager";
 import { ToolChoiceQueue } from "./tool-choice-queue";
 import { YieldQueue } from "./yield-queue";
 /** Session-specific events that extend the core AgentEvent */
@@ -762,6 +762,8 @@ export declare class AgentSession {
     /** Main startup calls this exactly once, after a strict open returned `kind: "opened"`. */
     continuePersistedHistory(): Promise<void>;
     buildDisplaySessionContext(): SessionContext;
+    /** Build display context from an unpublished successor without changing active session state. @internal */
+    buildPreparedDisplaySessionContext(prepared: PreparedNewSession): SessionContext;
     /** Convert session messages using the same pre-LLM pipeline as the active session. */
     convertMessagesToLlm(messages: AgentMessage[], signal?: AbortSignal): Promise<Message[]>;
     /** Apply session-level stream hooks to a direct side request. */
@@ -785,7 +787,7 @@ export declare class AgentSession {
     /** Live SDK configuration values exposed through the session query surface. */
     getSdkConfigItems(): Record<string, string>;
     setPlanModeState(state: PlanModeState | undefined): void;
-    invokeSkill(name: string, args?: string): Promise<{
+    invokeSkill(name: string, args?: string, options?: Pick<PromptOptions, "onPreflightAccepted">): Promise<{
         name: string;
         path: string;
         args?: string;
@@ -793,13 +795,7 @@ export declare class AgentSession {
     }>;
     setSdkPlanMode(on: boolean): Promise<PlanModeState | undefined>;
     operateGoal(op: "create" | "get" | "resume" | "pause" | "complete" | "drop", objective?: string): Promise<unknown>;
-    getTranscript(): Array<{
-        id: string;
-        role: string;
-        textSummary: string;
-        ts: string;
-        body: string;
-    }>;
+    getTranscript(): ExtensionTranscriptEntry[];
     getTranscriptBody(entryId: string): string | undefined;
     getGoalModeState(): GoalModeState | undefined;
     setGoalModeState(state: GoalModeState | undefined): void;
@@ -846,7 +842,7 @@ export declare class AgentSession {
      * @throws Error if no model selected or no API key available (when not streaming)
      */
     prompt(text: string, options?: PromptOptions): Promise<void>;
-    promptCustomMessage<T = unknown>(message: Pick<CustomMessage<T>, "customType" | "content" | "display" | "details" | "attribution">, options?: Pick<PromptOptions, "streamingBehavior" | "toolChoice" | "followUpQueuePolicy">): Promise<void>;
+    promptCustomMessage<T = unknown>(message: Pick<CustomMessage<T>, "customType" | "content" | "display" | "details" | "attribution">, options?: Pick<PromptOptions, "streamingBehavior" | "toolChoice" | "followUpQueuePolicy" | "onPreflightAccepted">): Promise<void>;
     /**
      * Queue a steering message to interrupt the agent mid-run.
      */
@@ -988,6 +984,8 @@ export declare class AgentSession {
     }): Promise<void>;
     setActiveModelProfile(name: string | undefined): void;
     getActiveModelProfile(): string | undefined;
+    /** Activate a complete model profile through a nonvisual session control. */
+    activateModelProfileForControl(profileName: string): Promise<boolean>;
     /** Return the persisted configured fallback selectors for a model role. */
     getConfiguredModelChain(role: string): readonly string[] | undefined;
     /** Persist the configured fallback selectors for a model role. */

package/dist/types/session/fallback-chain-controller.d.ts

@@ -47,8 +47,9 @@ export declare class FallbackChainController {
     onAttemptFailure(triggerClass: FallbackTriggerClass, reason: string): FallbackFailureResult;
     advance(): boolean;
     /**
-     * Restore the entry that just advanced when credential rotation permits a retry.
-     * The chain-wide budget and failure history remain charged.
+     * Restore the entry that just advanced for one attempt with a rotated credential.
+     * Each non-terminal entry may be restored once, so credential rotation remains
+     * bounded and cannot consume the attempts reserved for downstream entries.
      */
     restorePreviousEntryForRetry(): boolean;
     isExhausted(): boolean;
@@ -56,5 +57,20 @@ export declare class FallbackChainController {
     resetSticky(): void;
 }
 export declare function cappedExponentialWithFullJitter(baseDelayMs: number, maxDelayMs: number, attemptK: number, random?: () => number): number;
+/**
+ * Legacy auto-compaction retry delay.
+ *
+ * Deliberately the mirror image of `effectiveFallbackDelay`: this path recovers
+ * Retry-After by regex over provider error prose (`#parseRetryAfterMsFromError`),
+ * so it follows the documented legacy rule — `retry.maxDelayMs` caps every
+ * legacy session retry delay, including provider retry-after hints. Managed
+ * fallback stays uncapped because it retries within its own per-entry budget;
+ * compaction has no such budget, so the final candidate would otherwise sleep
+ * for the full server-suggested duration.
+ *
+ * `maxDelayMs <= 0` means "no cap", matching `cappedExponentialWithFullJitter`.
+ * A missing, NaN, or infinite hint collapses to "no usable hint".
+ */
+export declare function compactionRetryDelay(baseDelayMs: number, maxDelayMs: number, attempt: number, retryAfterMs: number | undefined): number;
 /** Retry-After is intentionally uncapped. */
 export declare function effectiveFallbackDelay(baseDelayMs: number, maxDelayMs: number, attemptK: number, retryAfterMs: number | undefined, random?: () => number): number;

package/dist/types/session/internal/managed-session-scope.d.ts

@@ -121,12 +121,39 @@ export declare function ensureManagedScope(scope: ManagedScope, policy?: Managed
 /** Synchronously create and validate the v2 binding before a default session writer exists. */
 export declare function prepareManagedSessionScopeForWriteSync(scope: ManagedScope, policy?: ManagedSessionSecurityPolicy, authority?: ManagedCandidateWriteAuthority): ManagedScopeResolution;
 export declare function listManagedCandidates(scope: ManagedScope): ManagedCandidateListing;
+type DetachedArtifactRoot = {
+    originalPath: string;
+    detachedPath: string;
+    identity: {
+        dev: bigint;
+        ino: bigint;
+        size: bigint;
+        mtimeNs: bigint;
+    };
+    tree: NativeDirectoryTreeSnapshot;
+};
 export declare function matchesMigrationArtifactRoot(pathname: string, identity: {
     dev: bigint;
     ino: bigint;
     size: bigint;
     mtimeNs: bigint;
 }, expectedTree: NativeDirectoryTreeSnapshot, platform?: NodeJS.Platform): boolean;
+type SourceArtifactCleanup = {
+    state: "cleanup_pending";
+    role: "exchange_placeholder";
+    retainedPath: string;
+    identity: DetachedArtifactRoot["identity"];
+    tree: NativeDirectoryTreeSnapshot;
+};
+export declare function cleanupAuthorityMatches(cleanup: SourceArtifactCleanup, parent: string, platform?: NodeJS.Platform): boolean;
+export declare function detachArtifactRootForMigration(plan: DetachedArtifactRoot, platform?: NodeJS.Platform): {
+    detached: DetachedArtifactRoot;
+    detachOutcome: "clean";
+} | {
+    detached: DetachedArtifactRoot;
+    detachOutcome: "cleanup_pending";
+    cleanup: SourceArtifactCleanup;
+};
 export declare function restorePreparedArtifactRoot(scope: ManagedScope, source: ManagedCandidate, lock?: ManagedStorageLock): void;
 /** Resume tombstoned cleanup under its original operation lease without restoring retired candidates. */
 export declare function reconcileManagedTombstones(scope: ManagedScope, expectedCandidate?: ManagedCandidate): Promise<void>;

package/dist/types/session/session-manager.d.ts

@@ -27,6 +27,13 @@ export interface NewSessionOptions {
     /** Skip flushing the current session and delete it instead of saving. */
     drop?: boolean;
 }
+/** Internal successor prepared without changing the manager's visible identity. */
+export interface PreparedNewSession {
+    readonly sessionId: string;
+    readonly sessionFile: string | undefined;
+    readonly artifactsDir: string | null;
+    readonly managedLegacyLocalMigrationSource: ManagedLegacyLocalMigrationSource | null;
+}
 export interface SessionEntryBase {
     type: string;
     id: string;
@@ -597,6 +604,33 @@ export declare class SessionManager {
     setSessionFile(sessionFile: string): Promise<void>;
     /** Start a new session. Closes any existing writer first. */
     newSession(options?: NewSessionOptions): Promise<string | undefined>;
+    /**
+     * Allocate a fresh successor without publishing it through the manager's public
+     * getters. The returned authority is deliberately immutable so readiness work
+     * can resolve local:// against the successor while the predecessor stays live.
+     * @internal
+     */
+    prepareNewSession(options?: NewSessionOptions): Promise<PreparedNewSession>;
+    /** Append a model selection to an unpublished successor. @internal */
+    appendPreparedModelChange(prepared: PreparedNewSession, model: string): string;
+    /** Append a thinking-level selection to an unpublished successor. @internal */
+    appendPreparedThinkingLevelChange(prepared: PreparedNewSession, thinkingLevel?: string): string;
+    /** Append a service-tier selection to an unpublished successor. @internal */
+    appendPreparedServiceTierChange(prepared: PreparedNewSession, serviceTier: ServiceTier | null): string;
+    /** Append a displayable custom message to an unpublished successor. @internal */
+    appendPreparedCustomMessageEntry<T = unknown>(prepared: PreparedNewSession, customType: string, content: string | (TextContent | ImageContent)[], display: boolean, details?: T, attribution?: MessageAttribution): string;
+    /** Persist an unpublished successor without adopting it. @internal */
+    ensurePreparedNewSessionOnDisk(prepared: PreparedNewSession): Promise<void>;
+    /** Build context from an unpublished successor without reading active manager state. @internal */
+    buildPreparedNewSessionContext(prepared: PreparedNewSession): SessionContext;
+    /** Prepare a forked successor without publishing it through public manager state. @internal */
+    prepareFork(): Promise<PreparedNewSession | undefined>;
+    /** Prepare a path-only branch successor without publishing it through public manager state. @internal */
+    prepareBranchedSession(leafId: string): Promise<PreparedNewSession>;
+    /** Publish a prepared successor synchronously after all readiness awaits succeed. @internal */
+    commitPreparedNewSession(prepared: PreparedNewSession): void;
+    /** Exact-discard only an uncommitted successor prepared by this manager. @internal */
+    discardPreparedNewSession(prepared: PreparedNewSession): Promise<void>;
     /** Tombstone and exact-delete managed transcripts, detaching the active transcript first. */
     dropSession(sessionPath: string): Promise<void>;
     /**

package/dist/types/task/executor.d.ts

@@ -20,6 +20,7 @@ import type { ContextFileEntry } from "../tools";
 import type { EventBus } from "../utils/event-bus";
 import type { WorkspaceTree } from "../workspace-tree";
 import { type AgentDefinition, type AgentProgress, type ReviewFinding, type SingleResult } from "./types";
+import { type ExecutorExecutionMode } from "./ultragoal-redteam-activation";
 export declare function trimForkContextSeedForModel(seed: ForkContextSeed, model: Model | undefined): ForkContextSeed;
 /** Options for subagent execution */
 export interface ExecutorOptions {
@@ -28,6 +29,11 @@ export interface ExecutorOptions {
     agent: AgentDefinition;
     task: string;
     assignment?: string;
+    /**
+     * Typed executor execution mode. When set, overrides assignment-text heuristics
+     * for ultragoal red-team prompt injection (#2698 / #2456).
+     */
+    executionMode?: ExecutorExecutionMode;
     context?: string;
     description?: string;
     index: number;

package/dist/types/task/types.d.ts

@@ -45,6 +45,10 @@ export declare const taskItemSchema: z.ZodObject<{
     id: z.ZodString;
     description: z.ZodString;
     assignment: z.ZodString;
+    executionMode: z.ZodOptional<z.ZodEnum<{
+        default: "default";
+        "ultragoal-red-team": "ultragoal-red-team";
+    }>>;
     inheritContext: z.ZodOptional<z.ZodEnum<{
         bounded: "bounded";
         full: "full";
@@ -69,6 +73,10 @@ export declare const taskSchema: z.ZodObject<{
         id: z.ZodString;
         description: z.ZodString;
         assignment: z.ZodString;
+        executionMode: z.ZodOptional<z.ZodEnum<{
+            default: "default";
+            "ultragoal-red-team": "ultragoal-red-team";
+        }>>;
         inheritContext: z.ZodOptional<z.ZodEnum<{
             bounded: "bounded";
             full: "full";
@@ -100,6 +108,10 @@ export declare const taskSchemaNoIsolation: z.ZodObject<{
         id: z.ZodString;
         description: z.ZodString;
         assignment: z.ZodString;
+        executionMode: z.ZodOptional<z.ZodEnum<{
+            default: "default";
+            "ultragoal-red-team": "ultragoal-red-team";
+        }>>;
         inheritContext: z.ZodOptional<z.ZodEnum<{
             bounded: "bounded";
             full: "full";
@@ -131,6 +143,10 @@ declare const ALL_TASK_SCHEMAS: readonly [z.ZodObject<{
         id: z.ZodString;
         description: z.ZodString;
         assignment: z.ZodString;
+        executionMode: z.ZodOptional<z.ZodEnum<{
+            default: "default";
+            "ultragoal-red-team": "ultragoal-red-team";
+        }>>;
         inheritContext: z.ZodOptional<z.ZodEnum<{
             bounded: "bounded";
             full: "full";
@@ -161,6 +177,10 @@ declare const ALL_TASK_SCHEMAS: readonly [z.ZodObject<{
         id: z.ZodString;
         description: z.ZodString;
         assignment: z.ZodString;
+        executionMode: z.ZodOptional<z.ZodEnum<{
+            default: "default";
+            "ultragoal-red-team": "ultragoal-red-team";
+        }>>;
         inheritContext: z.ZodOptional<z.ZodEnum<{
             bounded: "bounded";
             full: "full";
@@ -191,6 +211,10 @@ declare const ALL_TASK_SCHEMAS: readonly [z.ZodObject<{
         id: z.ZodString;
         description: z.ZodString;
         assignment: z.ZodString;
+        executionMode: z.ZodOptional<z.ZodEnum<{
+            default: "default";
+            "ultragoal-red-team": "ultragoal-red-team";
+        }>>;
         inheritContext: z.ZodOptional<z.ZodEnum<{
             bounded: "bounded";
             full: "full";
@@ -221,6 +245,10 @@ declare const ALL_TASK_SCHEMAS: readonly [z.ZodObject<{
         id: z.ZodString;
         description: z.ZodString;
         assignment: z.ZodString;
+        executionMode: z.ZodOptional<z.ZodEnum<{
+            default: "default";
+            "ultragoal-red-team": "ultragoal-red-team";
+        }>>;
         inheritContext: z.ZodOptional<z.ZodEnum<{
             bounded: "bounded";
             full: "full";
@@ -251,6 +279,10 @@ declare const ALL_TASK_SCHEMAS: readonly [z.ZodObject<{
         id: z.ZodString;
         description: z.ZodString;
         assignment: z.ZodString;
+        executionMode: z.ZodOptional<z.ZodEnum<{
+            default: "default";
+            "ultragoal-red-team": "ultragoal-red-team";
+        }>>;
         inheritContext: z.ZodOptional<z.ZodEnum<{
             bounded: "bounded";
             full: "full";
@@ -281,6 +313,10 @@ declare const ALL_TASK_SCHEMAS: readonly [z.ZodObject<{
         id: z.ZodString;
         description: z.ZodString;
         assignment: z.ZodString;
+        executionMode: z.ZodOptional<z.ZodEnum<{
+            default: "default";
+            "ultragoal-red-team": "ultragoal-red-team";
+        }>>;
         inheritContext: z.ZodOptional<z.ZodEnum<{
             bounded: "bounded";
             full: "full";

package/dist/types/task/ultragoal-redteam-activation.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Decide whether an executor assignment should inject the ultragoal red-team
+ * prompt fragment.
+ *
+ * Preference order (parse, don't re-validate later):
+ * 1. Explicit typed `executionMode` on the task / ExecutorOptions — authoritative.
+ * 2. Assignment text heuristics — only explicit Ultragoal QA/red-team phrasing.
+ *
+ * Bare mentions of `executorQa` (docs, quality-gate field names, negative
+ * instructions) must not flip the mode (#2698 / #2456).
+ *
+ * Mirrors `executor.md`:
+ * "activates only when the assignment explicitly labels Executor as Ultragoal
+ * completion QA/red-team or asks for `executorQa` red-team evidence."
+ */
+export declare const EXECUTOR_EXECUTION_MODES: readonly ["default", "ultragoal-red-team"];
+export type ExecutorExecutionMode = (typeof EXECUTOR_EXECUTION_MODES)[number];
+export declare function isExecutorExecutionMode(value: unknown): value is ExecutorExecutionMode;
+/**
+ * Parse a caller-supplied mode. Unknown values fail closed to `undefined`
+ * so the assignment heuristic (or default off) still applies — never invent on.
+ */
+export declare function parseExecutorExecutionMode(value: unknown): ExecutorExecutionMode | undefined;
+export declare function assignmentRequestsUltragoalRedTeam(assignment: string | undefined): boolean;
+export interface ResolveUltragoalRedTeamArgs {
+    readonly executionMode?: unknown;
+    readonly assignment?: string;
+}
+/**
+ * Final activation decision for the executor prompt fragment.
+ * Typed mode wins; assignment text is a compatibility fallback only.
+ */
+export declare function resolveUltragoalRedTeamActivation(args: ResolveUltragoalRedTeamArgs): boolean;