@gajae-code/coding-agent 0.11.3 → 0.11.5

package/dist/types/gjc-runtime/deep-interview-state.d.ts

@@ -127,6 +127,34 @@ export declare function mergeDeepInterviewEnvelope(existing: unknown, incoming:
 }): DeepInterviewStateEnvelope;
 export declare const DEEP_INTERVIEW_INTENT_CATEGORIES: readonly ["artifact", "surface", "integration", "constraint"];
 export type DeepInterviewIntentCategory = (typeof DEEP_INTERVIEW_INTENT_CATEGORIES)[number];
+/**
+ * User-input fields that legitimately carry prose (goals, prompts, descriptions,
+ * answers). Shell metacharacters (`;`, `|`, `&`, backticks, `$()`) are valid prose
+ * here and must NOT be rejected as structural injection. Structural fields (ids,
+ * categories, hashes) stay strictly validated by their own guards.
+ */
+export declare const DEEP_INTERVIEW_FREETEXT_FIELDS: ReadonlySet<string>;
+/** DoS-prevention character-count caps, matching ask-schema string-length semantics. */
+export declare const MAX_INITIAL_CONTEXT_LENGTH = 50000;
+export declare const MAX_USER_RESPONSE_LENGTH = 10000;
+/** Maximum serialized JavaScript-string length for one LLM-produced structured response. */
+export declare const MAX_DEEP_INTERVIEW_STRUCTURED_RESPONSE_LENGTH = 100000;
+/** Count Unicode code points without allocating an intermediate character array. */
+export declare function deepInterviewCharacterCount(value: string): number;
+export declare function isDeepInterviewFreeTextField(name: string): boolean;
+/**
+ * Assert that one structured deep-interview response is JSON-serializable and
+ * bounded by JavaScript string length. This deliberately does not measure or
+ * cap accumulated persisted interview state.
+ */
+export declare function assertDeepInterviewStructuredResponseWithinLimit(value: unknown): void;
+/**
+ * Assert a free-text input is within its size cap. Never inspects content for shell
+ * metacharacters — free-text fields accept prose verbatim; this only bounds length.
+ */
+export declare function assertDeepInterviewInputWithinLimit(value: string, max: number, fieldName?: string): void;
+/** Validate user-supplied deep-interview prose before an envelope is persisted. */
+export declare function assertDeepInterviewEnvelopeInputLimits(envelope: Record<string, unknown>): void;
 export interface DeepInterviewIntentItem {
     id: string;
     category: DeepInterviewIntentCategory;

package/dist/types/gjc-runtime/gc-runtime.d.ts

@@ -95,11 +95,20 @@ export interface GcCounts {
         failed: number;
     }>;
 }
+export interface GcSessionIndexHealth {
+    status: "healthy" | "corrupt" | "repaired" | "unsupported" | "repair_failed";
+    valid_prefix_seq: number;
+    snapshot_seq?: number;
+    reason?: string;
+    quarantine_path?: string;
+}
 export interface GcReport {
     dry_run: boolean;
+    operation?: "dry_run" | "prune" | "repair_session_index";
     stores: Record<GcStore, GcRecord[]>;
     counts: GcCounts;
     errors: GcError[];
+    session_index?: GcSessionIndexHealth;
 }
 export interface GcRunResult {
     stdout: string;

package/dist/types/gjc-runtime/launch-tmux.d.ts

@@ -76,6 +76,9 @@ export interface TmuxLaunchPlan {
     sessionStateFile?: string | null;
     /** Immutable Linux-managed owner provenance, assigned immediately before creation. */
     ownerGeneration?: string;
+    /** Immutable run and endpoint identities bound into the supervised command. */
+    ownerRunId?: string;
+    ownerIncarnation?: string;
     /** Generation state captured before owner-isolation planning; required for publication CAS. */
     ownerGenerationBaseline?: import("./tmux-owner-isolation").OwnerGenerationBaseline;
     /** Native tmux session identity emitted atomically by `new-session -P -F`. */

package/dist/types/gjc-runtime/managed-owner-admission.d.ts

@@ -0,0 +1,42 @@
+import { type ManagedOwnerBinding, type ManagedOwnerSigabrtReceipt } from "./managed-owner-supervisor";
+import { type UltragoalRecoveryDecision } from "./ultragoal-owner-loss-recovery";
+export declare const MANAGED_OWNER_PREDECESSOR_TOKEN_ENV = "GJC_MANAGED_OWNER_PREDECESSOR_TOKEN";
+export declare const MANAGED_OWNER_PREDECESSOR_GENERATION_ENV = "GJC_MANAGED_OWNER_PREDECESSOR_GENERATION";
+export declare const MANAGED_OWNER_PREDECESSOR_RUN_ID_ENV = "GJC_MANAGED_OWNER_PREDECESSOR_RUN_ID";
+export declare const MANAGED_OWNER_PREDECESSOR_INCARNATION_ENV = "GJC_MANAGED_OWNER_PREDECESSOR_INCARNATION";
+export declare const MANAGED_OWNER_TRANSCRIPT_PATH_ENV = "GJC_MANAGED_OWNER_TRANSCRIPT_PATH";
+export interface ManagedOwnerRecoveryContext {
+    root: string;
+    binding: ManagedOwnerBinding;
+    receipt: ManagedOwnerSigabrtReceipt;
+    admission: {
+        session_id: string;
+        endpoint_incarnation: string;
+        owner_generation: string;
+        admitted: true;
+    };
+    decision: UltragoalRecoveryDecision;
+}
+export type ManagedOwnerAdmission = {
+    kind: "fresh" | "supervised";
+} | {
+    kind: "recovery";
+    context: ManagedOwnerRecoveryContext;
+} | {
+    kind: "blocked";
+};
+/**
+ * This is the pre-CLI barrier. A replacement is identified only by the exact
+ * predecessor token supplied by its launch binding; directory enumeration is
+ * deliberately never an authority source.
+ */
+export declare function admitManagedOwnerBeforeCli(): Promise<ManagedOwnerAdmission>;
+/**
+ * The ordinary CLI factory has no recovery-owned writer-lease or exact-child
+ * reconciliation capability.  Do not route a recovered owner through it: first
+ * revalidate the immutable evidence and B0, then publish a terminal handoff.
+ */
+export declare function completeManagedOwnerRecovery(context: ManagedOwnerRecoveryContext): Promise<{
+    kind: "handoff";
+    exitCode: 75;
+}>;

package/dist/types/gjc-runtime/managed-owner-supervisor.d.ts

@@ -0,0 +1,41 @@
+export declare const MANAGED_OWNER_SUPERVISOR_ARG = "--internal-managed-owner-supervisor";
+export declare const MANAGED_OWNER_CHILD_TOKEN_ENV = "GJC_MANAGED_OWNER_CHILD_TOKEN";
+export declare const MANAGED_OWNER_COMMAND_ENV = "GJC_MANAGED_OWNER_COMMAND_JSON";
+export declare const MANAGED_OWNER_SESSION_ID_ENV = "GJC_COORDINATOR_SESSION_ID";
+export declare const MANAGED_OWNER_GENERATION_ENV = "GJC_TMUX_OWNER_GENERATION";
+export declare const MANAGED_OWNER_STATE_DIR_ENV = "GJC_TMUX_OWNER_STATE_DIR";
+export declare const MANAGED_OWNER_RUN_ID_ENV = "GJC_MANAGED_OWNER_RUN_ID";
+export declare const MANAGED_OWNER_INCARNATION_ENV = "GJC_MANAGED_OWNER_INCARNATION";
+export interface ManagedOwnerBinding {
+    schema_version: 2;
+    generation: string;
+    session_id: string;
+    run_id: string;
+    endpoint_incarnation: string;
+    child_token: string;
+    command: string[];
+    command_sha256: string;
+    supervisor_pid: number;
+    supervisor_start_time: string;
+    created_at: string;
+}
+export interface ManagedOwnerSigabrtReceipt {
+    schema_version: 2;
+    generation: string;
+    session_id: string;
+    run_id: string;
+    endpoint_incarnation: string;
+    child_token: string;
+    command_sha256: string;
+    supervisor_pid: number;
+    supervisor_start_time: string;
+    child_pid: number;
+    child_start_time: string;
+    signal: "SIGABRT";
+    signal_number: 6;
+    exit_code: number | null;
+    received_at: string;
+}
+export declare function isManagedOwnerSupervisorArgv(args: readonly string[]): boolean;
+/** Runs one exact child and publishes authority only for a directly observed Linux signal 6. */
+export declare function runManagedOwnerSupervisor(): Promise<void>;

package/dist/types/gjc-runtime/state-argv.d.ts

@@ -0,0 +1,38 @@
+export type StateAction = "read" | "write" | "clear" | "contract" | "handoff" | "graph" | "prune" | "gc" | "migrate" | "status" | "doctor";
+export declare const STATE_ACTION_NAMES: ReadonlySet<StateAction>;
+export declare const STATE_FLAGS_WITH_VALUES: ReadonlySet<string>;
+export declare const STATE_BOOLEAN_FLAGS: ReadonlySet<string>;
+export interface StateFlagOccurrence {
+    name: string;
+    index: number;
+    value?: string;
+    arity: "boolean" | "value";
+    form: "separate" | "attached";
+    malformed: boolean;
+}
+export interface StateSelectorCandidate {
+    source: "mode" | "positional" | "input.mode" | "input.skill";
+    value: string | undefined;
+    index: number;
+}
+export type StateInputKind = "empty" | "inline" | "file" | "invalid";
+export interface StateInputClassification {
+    index: number;
+    raw: string;
+    kind: StateInputKind;
+    selectors: StateSelectorCandidate[];
+}
+export interface StateArgvClassification {
+    argv: readonly string[];
+    action: StateAction;
+    effectiveAction: StateAction;
+    positionalSkill?: string;
+    positionals: readonly string[];
+    flags: readonly StateFlagOccurrence[];
+    unknownFlags: readonly string[];
+    inputs: readonly StateInputClassification[];
+    runtimeSelectorCandidates: readonly StateSelectorCandidate[];
+    selectorCandidates: readonly StateSelectorCandidate[];
+}
+export declare function firstStateFlagValue(classification: StateArgvClassification, name: string): string | undefined;
+export declare function classifyStateArgv(argv: readonly string[]): StateArgvClassification;

package/dist/types/gjc-runtime/tmux-owner-isolation.d.ts

@@ -277,6 +277,15 @@ export type OwnerGenerationBaseline = {
     session_id: string;
     published_at: string;
 };
+export interface ManagedOwnerPredecessorEvidence {
+    generation: string;
+    sessionId: string;
+    runId: string;
+    incarnation: string;
+    predecessorToken: string;
+}
+/** Resolve one SIGABRT predecessor from the retained exact prior-generation root. */
+export declare function resolveManagedOwnerPredecessorSync(stateDir: string, sessionId: string, baseline: OwnerGenerationBaseline): ManagedOwnerPredecessorEvidence | undefined;
 export declare function captureOwnerGenerationBaseline(stateDir: string, sessionId: string): Promise<OwnerGenerationBaseline>;
 /** Captures the full immutable generation record for a planned owner launch. */
 export declare function captureOwnerGenerationBaselineSync(stateDir: string, sessionId: string): OwnerGenerationBaseline;

package/dist/types/gjc-runtime/ultragoal-owner-loss-recovery.d.ts

@@ -0,0 +1,94 @@
+import type { ManagedOwnerSigabrtReceipt } from "./managed-owner-supervisor";
+/** Immutable identity supplied by the owner-loss monitor and coordinator admission. */
+export interface UltragoalRecoveryBinding {
+    sessionId: string;
+    endpointIncarnation: string;
+    ownerGeneration: string;
+    cwd: string;
+}
+export interface UltragoalOwnerLossReceipt {
+    schema_version: 1;
+    session_id: string;
+    generation: string;
+    classification: "unexpected_owner_loss";
+    result: "signal" | "exit" | "unknown_terminal";
+    observed_at: string;
+}
+export type AuthoritativeOwnerLossReceipt = UltragoalOwnerLossReceipt | ManagedOwnerSigabrtReceipt;
+export interface UltragoalRecoverySnapshot {
+    /** B0 is captured once before recovery writes. P is protected and never rewritten. */
+    b0: {
+        planSha256: string;
+        ledgerSha256: string;
+        capturedAt: string;
+    };
+    protectedPaths: string[];
+    /** Exact sanctioned deltas, never inferred from a worktree scan. */
+    sanctionedDeltas: string[];
+    /** Durable baseline-absent artifacts. */
+    absentArtifacts: string[];
+    /** Transient paths deliberately excluded from provenance. */
+    transientHistory: string[];
+}
+export type UltragoalRecoveryDisposition = "resume" | "handoff";
+export interface UltragoalRecoveryDecision {
+    disposition: UltragoalRecoveryDisposition;
+    reason: string;
+    snapshot?: UltragoalRecoverySnapshot;
+    terminal?: {
+        yieldId: string;
+        result: Record<string, unknown>;
+    };
+}
+interface TranscriptYield {
+    type: "yield";
+    id: string;
+    parentId: string | null;
+    result: Record<string, unknown>;
+}
+/**
+ * Parse the complete transcript; partial rows, alternate terminal spellings, and
+ * duplicate/conflicting yields are intentionally invalid authority.
+ */
+export declare function parseStrictTerminalTranscript(content: string): TranscriptYield | null;
+/** Validate a path through a retained native root descriptor; path strings alone are never authority. */
+export declare function validateRecoveryPath(root: string, candidate: string): Promise<string | null>;
+export declare function validateOwnerLossBinding(binding: UltragoalRecoveryBinding, receipt: unknown): receipt is AuthoritativeOwnerLossReceipt;
+/** Admission is valid only for this immutable coordinator endpoint incarnation. */
+export declare function validateRecoveryAdmission(binding: UltragoalRecoveryBinding, admission: unknown): boolean;
+/** Raw plan and ledger evidence must be complete before their B0 hashes are trusted. */
+export declare function validateRawUltragoalEvidence(plan: Uint8Array, ledger: Uint8Array): boolean;
+/** Build a B0 snapshot without consulting unrelated paths or mutable sidecars. */
+export declare function captureUltragoalRecoverySnapshot(input: {
+    cwd: string;
+    sessionId: string;
+    protectedPaths: readonly string[];
+    sanctionedDeltas: readonly string[];
+    absentArtifacts: readonly string[];
+    transientHistory: readonly string[];
+}): Promise<UltragoalRecoverySnapshot | null>;
+/**
+ * Decide only from direct owner evidence plus a complete terminal transcript.
+ * All ambiguity maps to durable handoff; callers never guess a resume.
+ */
+export declare function planUltragoalOwnerLossRecovery(input: {
+    binding: UltragoalRecoveryBinding;
+    receipt: unknown;
+    admission: unknown;
+    transcriptPath: string;
+    protectedPaths?: readonly string[];
+    sanctionedDeltas?: readonly string[];
+    absentArtifacts?: readonly string[];
+    transientHistory?: readonly string[];
+}): Promise<UltragoalRecoveryDecision>;
+/** Persist a monotonic replay journal and fail-closed handoff through sanctioned state writers. */
+export declare function persistUltragoalRecoveryDecision(input: {
+    cwd: string;
+    sessionId: string;
+    binding: UltragoalRecoveryBinding;
+    decision: UltragoalRecoveryDecision;
+}): Promise<{
+    handoffPath: string;
+    journalPath: string;
+}>;
+export {};

package/dist/types/gjc-runtime/ultragoal-runtime.d.ts

@@ -1,5 +1,6 @@
 import type { WorkflowHudSummary } from "../skill-state/active-state";
 export { computeUltragoalPlanGeneration, receiptRelevantGoals } from "./ultragoal-receipt-freshness";
+export { captureUltragoalRecoverySnapshot, parseStrictTerminalTranscript, persistUltragoalRecoveryDecision, planUltragoalOwnerLossRecovery, type UltragoalOwnerLossReceipt, type UltragoalRecoveryBinding, type UltragoalRecoveryDecision, type UltragoalRecoverySnapshot, validateOwnerLossBinding, validateRawUltragoalEvidence, validateRecoveryAdmission, validateRecoveryPath, } from "./ultragoal-owner-loss-recovery";
 export type UltragoalGjcGoalMode = "aggregate" | "per-story";
 export type UltragoalGoalStatus = "pending" | "active" | "complete" | "failed" | "blocked" | "review_blocked" | "superseded";
 export type UltragoalPipelineMetadataSource = "original_plan_graph" | "legacy_brief_only" | "steering";

package/dist/types/harness-control-plane/owner.d.ts

@@ -12,7 +12,7 @@
  */
 import { ControlServer, type EndpointHandler } from "./control-endpoint";
 import { type FinalizeChecks, type ValidationCommandSpec } from "./finalize";
-import { releaseLease, type SessionLease } from "./session-lease";
+import { heartbeat, releaseLease, type SessionLease } from "./session-lease";
 import { type HarnessSessionTransport } from "./session-transport";
 import { appendEvent, writeSessionState } from "./storage";
 export interface OwnerOptions {
@@ -30,6 +30,8 @@ export interface OwnerOptions {
     controlServerFactory?: (socketPath: string, handler: EndpointHandler) => ControlServer;
     /** Test seam for deterministic lease-release teardown failures. */
     leaseRelease?: typeof releaseLease;
+    /** Test seam for deterministic lease-heartbeat behavior (e.g. renewal barriers). */
+    leaseHeartbeat?: typeof heartbeat;
     /** Test seams for frame persistence failures. */
     framePersistence?: {
         appendEvent?: typeof appendEvent;

package/dist/types/internal-urls/local-protocol.d.ts

@@ -1,8 +1,26 @@
+import { type NativeDirectoryTreeSnapshot } from "@gajae-code/natives";
 import type { InternalResource, InternalUrl, ProtocolHandler } from "./types";
+export interface ManagedLegacyLocalMigrationEntry {
+    readonly relativePath: string;
+    readonly kind: "directory" | "file";
+    readonly bytes?: Uint8Array;
+    readonly sha256?: string;
+}
+/** Opaque authority for a managed session's legacy `local` artifact tree. */
+export interface ManagedLegacyLocalMigrationSource {
+    capture(): Promise<{
+        readonly snapshot: NativeDirectoryTreeSnapshot;
+        readonly entries: readonly ManagedLegacyLocalMigrationEntry[];
+    } | null>;
+    retire(snapshot: NativeDirectoryTreeSnapshot): void;
+}
 export interface LocalProtocolOptions {
     getArtifactsDir?: () => string | null;
+    isManagedDestination?: () => boolean;
+    getManagedLegacyLocalMigrationSource?: () => ManagedLegacyLocalMigrationSource | null;
     getSessionId?: () => string | null;
 }
+export declare function initializeLocalRoot(options: LocalProtocolOptions): Promise<string>;
 export declare function resolveLocalRoot(options: LocalProtocolOptions): string;
 export declare function resolveLocalUrlToPath(input: string | InternalUrl, options: LocalProtocolOptions): string;
 /**

package/dist/types/main.d.ts

@@ -18,7 +18,7 @@ import type { SubmittedUserInput } from "./modes/types";
 import type { MCPManager } from "./runtime-mcp";
 import { type CreateAgentSessionOptions, createAgentSession, discoverAuthStorage } from "./sdk";
 import type { AgentSession } from "./session/agent-session";
-import { type ResumeSessionIdentity, type SessionDirectoryMigrationPolicy, type SessionInfo, SessionManager, type StrictSessionOpenResult } from "./session/session-manager";
+import { type ResumeSessionIdentity, type SessionDestination, type SessionDirectoryMigrationPolicy, type SessionInfo, SessionManager, type StrictSessionOpenResult } from "./session/session-manager";
 import { runStartupCredentialAutoImportIfNeeded } from "./setup/credential-auto-import";
 import type { LspStartupServerInfo } from "./tools";
 import type { EventBus } from "./utils/event-bus";
@@ -87,7 +87,7 @@ type CreateInteractiveMode = (options: InteractiveModeFactoryOptions) => Interac
 type ResumePickerTerminalCheck = () => boolean;
 type ListForResumePickerReadOnly = (cwd: string, sessionDir?: string) => Promise<SessionInfo[]>;
 type SelectResumeSession = (sessions: SessionInfo[]) => Promise<SessionSelectionResult>;
-type OpenExistingSessionStrict = (identity: ResumeSessionIdentity, sessionDir?: string, migrationPolicy?: SessionDirectoryMigrationPolicy) => Promise<StrictSessionOpenResult>;
+type OpenExistingSessionStrict = (identity: ResumeSessionIdentity, destination: SessionDestination, storage?: undefined, migrationPolicy?: SessionDirectoryMigrationPolicy) => Promise<StrictSessionOpenResult>;
 export declare const BARE_RESUME_CONFLICT_ERROR = "--resume without a session cannot be combined with --continue, --fork, or --no-session.";
 export declare const BARE_RESUME_INTERACTIVE_ERROR = "--resume requires an interactive terminal; use --resume <id>.";
 export declare const BARE_RESUME_OPEN_ERROR = "Could not open the selected session. Use --resume <id>.";

package/dist/types/modes/components/ansi-display-validator.d.ts

@@ -0,0 +1,2 @@
+/** Removes every terminal control sequence except bounded SGR parameters (0-255). */
+export declare function validateDisplayLine(line: string): string;

package/dist/types/modes/components/custom-editor.d.ts

@@ -2,6 +2,11 @@ import { Editor, type KeyId } from "@gajae-code/tui";
 import { type AppKeybinding } from "../../config/keybindings";
 type ConfigurableEditorAction = Extract<AppKeybinding, "app.interrupt" | "app.clear" | "app.exit" | "app.suspend" | "app.thinking.cycle" | "app.commandPalette.open" | "app.model.cycleForward" | "app.model.cycleBackward" | "app.model.select" | "app.model.selectTemporary" | "app.tools.expand" | "app.thinking.toggle" | "app.editor.external" | "app.history.search" | "app.message.dequeue" | "app.message.followUp" | "app.message.queue" | "app.clipboard.pasteImage" | "app.clipboard.copyPrompt">;
 type PastePendingClearReason = "timeout" | "queue-limit";
+export interface PasteTextContext {
+    readonly signal: AbortSignal;
+    /** Run one synchronous composer mutation only while this paste transaction is current. */
+    commit(commit: () => boolean): boolean;
+}
 /**
  * Custom editor that handles configurable app-level shortcuts for coding-agent.
  */
@@ -35,9 +40,9 @@ export declare class CustomEditor extends Editor {
     /** Called when the configured image-paste shortcut is pressed. */
     onPasteImage?: () => Promise<boolean>;
     /** Called before bracketed paste content is inserted. Return true to consume it. */
-    onPasteText?: (text: string) => boolean | Promise<boolean>;
-    /** Called when async paste handling drops queued input instead of replaying it. */
-    onPastePendingInputCleared?: (reason: PastePendingClearReason, droppedInputCount: number) => void;
+    onPasteText?: (text: string, context: PasteTextContext) => boolean | Promise<boolean>;
+    /** Called when pending paste handling is cancelled after restoring queued input. */
+    onPastePendingInputCleared?: (reason: PastePendingClearReason, restoredInputCount: number) => void;
     /** Called when the configured dequeue shortcut is pressed. */
     onDequeue?: () => void;
     /** Called when the configured queue shortcut is pressed. */

package/dist/types/modes/components/notifications-settings-editor.d.ts

@@ -10,6 +10,8 @@ export interface NotificationsEditorPreferences {
     sessionScope: "all" | "primary";
     richEnabled: boolean;
     richDraftEnabled: boolean;
+    toolActivityEnabled: boolean;
+    streamingEnabled: boolean;
 }
 /** Secret-safe snapshot used to render the Notifications tab. */
 export interface NotificationsEditorState {
@@ -28,6 +30,7 @@ export interface NotificationsEditorSetupInput {
     chatId?: string;
     richEnabled: boolean;
     richDraftEnabled: boolean;
+    streamingEnabled: boolean;
 }
 /**
  * Secret-safe setup draft. The adapter may retain its private credential while
@@ -39,6 +42,7 @@ export interface PreparedTelegramConfiguration {
     tokenFingerprint?: string;
     richEnabled: boolean;
     richDraftEnabled: boolean;
+    streamingEnabled: boolean;
 }
 export interface NotificationsPreflightResult {
     status: "ready" | "aborted" | "cancelled" | "error";

package/dist/types/modes/components/session-observer-overlay.d.ts

@@ -1,6 +1,7 @@
 import type { KeyId } from "../../config/keybindings";
+import type { SessionMessageEntry } from "../../session/session-manager";
 import type { SessionObserverRegistry } from "../session-observer-registry";
-import { TranscriptViewerOverlay } from "./transcript-viewer-overlay";
+import { type TranscriptViewerEntry, TranscriptViewerOverlay } from "./transcript-viewer-overlay";
 /** Session-observer adapter. The shared viewer owns navigation and fold state. */
 export declare class SessionObserverOverlayComponent extends TranscriptViewerOverlay {
     #private;
@@ -8,3 +9,4 @@ export declare class SessionObserverOverlayComponent extends TranscriptViewerOve
     refreshFromRegistry(): void;
     handleInput(keyData: string): void;
 }
+export declare function entriesFromMessages(entries: readonly SessionMessageEntry[]): TranscriptViewerEntry[];

package/dist/types/modes/components/settings-selector.d.ts

@@ -22,6 +22,8 @@ export interface SettingsRuntimeContext {
     cwd: string;
     /** Whether this terminal can render the pet overlay. */
     petAvailable?: boolean;
+    /** Terminal environment used to select unavailable-pet guidance. Omitted in production to use Bun.env. */
+    terminalEnv?: NodeJS.ProcessEnv;
 }
 /** Status line settings subset for preview */
 export interface StatusLinePreviewSettings {

package/dist/types/modes/components/tool-transcript-format.d.ts

@@ -0,0 +1,77 @@
+import type { Theme } from "../theme/theme";
+export declare const MAX_TOOL_ARGS_CHARS = 500;
+export declare const TOOL_RESULT_MAX_EXPANDED_LINES = 100;
+export declare const INPUT_MAX_SOURCE_BYTES = 1048576;
+export declare const INPUT_MAX_SOURCE_LINES = 50000;
+export declare const INPUT_MAX_SCALAR_LEN = 8192;
+export declare const INPUT_MAX_JSON_DEPTH = 32;
+export declare const INPUT_MAX_JSON_NODES = 20000;
+export type ToolDisplaySections = {
+    callLines: string[];
+    statusLines: string[];
+    resultText: string;
+};
+/**
+ * Produces final, terminal-safe rich display lines for an expanded tool entry.
+ * It owns validation, width-aware wrapping, and the result-only visible cap.
+ */
+export declare function renderToolDisplayLines(descriptor: ToolTranscriptRenderDescriptor, contentWidth: number, theme: Theme): string[];
+export type ToolTranscriptRenderDescriptor = Readonly<{
+    name: string;
+    args: Record<string, unknown>;
+    intent?: string;
+    resultContent: string;
+    details?: string;
+    detailsData?: unknown;
+    isError: boolean;
+    isPartial: boolean;
+    hasResult: boolean;
+    inputTruncated: boolean;
+}>;
+export type BuildToolTranscriptEntryInput = {
+    canonicalPayload: import("../transcript-item-registry").TranscriptSourcePayload;
+    renderDescriptor: ToolTranscriptRenderDescriptor;
+    capabilities: import("../transcript-item-registry").TranscriptItemCapabilities;
+    identity: {
+        id: string;
+        label: string;
+        display?: "full";
+    };
+};
+/**
+ * Shared tool projection for the main transcript and session observer.
+ * `payload` is canonical/copyable source; display is derived only from the
+ * sanitized, frozen descriptor. The observer's whole-entry 100-line cap and
+ * the main view's tool-only result cap intentionally remain surface-specific.
+ */
+export declare function buildToolTranscriptEntry(input: BuildToolTranscriptEntryInput): import("./transcript-viewer-overlay").TranscriptViewerEntry;
+/** Sanitizes and freezes all display-only values before tool formatting. */
+export declare function createToolTranscriptRenderDescriptor(input: {
+    name: unknown;
+    args: unknown;
+    intent?: unknown;
+    resultContent: unknown;
+    details?: unknown;
+    detailsData?: unknown;
+    isError?: unknown;
+    isPartial?: unknown;
+    hasResult?: unknown;
+    inputTruncated?: unknown;
+}): ToolTranscriptRenderDescriptor;
+type ToolCallFields = {
+    name: string;
+    args: Record<string, unknown>;
+    intent?: string;
+};
+type ToolResultFields = {
+    resultText: string;
+    isError: boolean;
+    hasResult: boolean;
+};
+export type ToolTranscriptFields = ToolCallFields & ToolResultFields;
+export declare function formatToolArgs(name: string, args: Record<string, unknown>): string;
+export declare function composeToolCall({ name, args, intent }: ToolCallFields): string;
+export declare function composeToolResult({ resultText, isError, hasResult }: ToolResultFields): string;
+export declare function composeToolText(fields: ToolTranscriptFields): string;
+export declare function toolDisplayText(fields: ToolTranscriptFields, expanded: boolean): string;
+export {};

package/dist/types/modes/components/transcript-viewer-overlay.d.ts

@@ -1,5 +1,6 @@
 import { Container, type MouseEvent } from "@gajae-code/tui";
 import type { TranscriptItemRegistry, TranscriptSourcePayload } from "../transcript-item-registry";
+import { type ToolTranscriptRenderDescriptor } from "./tool-transcript-format";
 export type TranscriptViewerEntry = {
     id: string;
     kind: string;
@@ -9,6 +10,8 @@ export type TranscriptViewerEntry = {
     foldable?: boolean;
     rawViewable?: boolean;
     getDisplayText?: (expanded: boolean) => string;
+    renderDescriptor?: ToolTranscriptRenderDescriptor;
+    richRenderEligible?: boolean;
 };
 export type TranscriptViewerOverlayOptions = {
     title?: string;

package/dist/types/modes/controllers/goal-mode-controller.d.ts

@@ -45,7 +45,14 @@ export declare class GoalModeController {
     onPendingSubmissionFinished(customType?: string): void;
     onUserSubmission(): void;
     handleSessionEvent(event: AgentSessionEvent): Promise<void>;
-    restoreFromSession(sessionContext: SessionContext): Promise<boolean>;
+    /**
+     * Restore durable goal state. Recovery hydration deliberately performs only
+     * in-memory restoration: it neither consumes a pending request nor repairs
+     * invalid persisted state by writing a fallback mode entry.
+     */
+    restoreFromSession(sessionContext: SessionContext, options?: {
+        recoveryHydration?: boolean;
+    }): Promise<boolean>;
     handleCommand(rest?: string): Promise<void>;
     enter(options: {
         objective?: string;

package/dist/types/modes/controllers/input-controller.d.ts

@@ -1,13 +1,18 @@
 import { type AutocompleteProvider, type SlashCommand } from "@gajae-code/tui";
 import { type ComposerSubmissionOptions, type InteractiveModeContext } from "../../modes/types";
+import { loadPastedImageBatch } from "../../utils/pasted-image-loading";
 import { ActionRegistry } from "../action-registry";
+import type { PasteTextContext } from "../components/custom-editor";
 export declare const INTERACTIVE_ABORT_CLEANUP_TIMEOUT_MS = 5000;
 export declare const BACKGROUND_FOLD_DOUBLE_PRESS_MS = 750;
+interface InputControllerDependencies {
+    loadPastedImageBatch?: typeof loadPastedImageBatch;
+}
 export declare class InputController {
     #private;
     private ctx;
     readonly actionRegistry: ActionRegistry<void>;
-    constructor(ctx: InteractiveModeContext);
+    constructor(ctx: InteractiveModeContext, dependencies?: InputControllerDependencies);
     setupKeyHandlers(): void;
     setupEditorSubmitHandler(): void;
     submitText(text: string, composer: ComposerSubmissionOptions): Promise<void>;
@@ -28,7 +33,7 @@ export declare class InputController {
     }): number;
     handleBackgroundCommand(): void;
     handleForegroundToolBackgroundFold(): boolean;
-    handleTextPaste(text: string): boolean | Promise<boolean>;
+    handleTextPaste(text: string, context: PasteTextContext): boolean | Promise<boolean>;
     handleImagePaste(): Promise<boolean>;
     createAutocompleteProvider(commands: SlashCommand[], basePath: string): AutocompleteProvider;
     /** Copy the current editor line to the system clipboard. */
@@ -47,3 +52,4 @@ export declare class InputController {
     openExternalEditor(): Promise<void>;
     registerExtensionShortcuts(): void;
 }
+export {};

package/dist/types/modes/controllers/selector-controller.d.ts

@@ -43,6 +43,21 @@ export interface NotificationsEditorOperationDependencies {
     saveTelegramInactive: typeof saveTelegramInactive;
     removeTelegramConfiguration: typeof removeTelegramConfiguration;
     unregisterNotificationRoot: typeof unregisterNotificationRoot;
+    reloadTelegramDaemon(settings: Settings): Promise<{
+        ok: boolean;
+        message: string;
+    }>;
+    restartTelegramDaemon(settings: Settings): Promise<{
+        ok: boolean;
+        message: string;
+    }>;
+    stopTelegramDaemon(settings: Settings): Promise<{
+        ok: boolean;
+        message: string;
+        before?: {
+            health?: string;
+        };
+    }>;
 }
 /**
  * Concrete service adapter for the direct Notifications settings tab. Secrets remain in this closure's

package/dist/types/modes/shared/agent-wire/workflow-gate-broker.d.ts

@@ -45,6 +45,9 @@ export interface NotificationGateResolutionOptions {
     resolveClaim(): void;
     closeClaimInvalid(reason: string): void;
 }
+export declare class NotificationGatePolicyChangedError extends Error {
+    constructor();
+}
 export interface AskSelectedAckRecoveryParticipant {
     requestRecoveredAskSelectedAck(input: {
         sessionId: string;