@gajae-code/coding-agent 0.11.4 → 0.11.5

package/dist/types/sdk/bus/chat-daemon-control.d.ts

@@ -2,6 +2,13 @@ import type { Settings } from "../../config/settings";
 import type { BuiltInDaemonController, DaemonOperationOptions, DaemonOperationResult, DaemonRuntimeInfo, DaemonStatus } from "../../daemon/control-types";
 export type ChatDaemonKind = "discord" | "slack";
 export type ChatDaemonAction = "stop" | "reload";
+/**
+ * Operational generations of the Discord/Slack daemon lifecycle contracts.
+ * These are intentionally separate from per-session endpoint generations.
+ * Generation 6 carries the retained managed filesystem authority boundary.
+ */
+export declare const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>>;
+export declare function chatDaemonGeneration(kind: ChatDaemonKind): number;
 export interface ChatDaemonState {
     version: 1;
     kind: ChatDaemonKind;
@@ -12,8 +19,16 @@ export interface ChatDaemonState {
     startedAt: number;
     heartbeatAt: number;
     transportHealthy: boolean;
+    generation: number;
     stoppedAt?: number;
 }
+/**
+ * State files are untrusted persisted input. A record must be completely valid
+ * before its PID can be treated as an owner, stopped, or safe to replace.
+ */
+/** A legacy owner is recognized only when the sole missing field is generation. */
+export declare function isRecognizedLegacyGeneration(value: unknown): value is undefined;
+export declare function hasSafeChatDaemonStateShape(value: unknown): value is ChatDaemonState;
 export interface ChatDaemonControlRequest {
     version: 1;
     requestId: string;
@@ -23,9 +38,13 @@ export interface ChatDaemonControlRequest {
     createdAt: number;
     incarnation: string;
 }
+export interface ChatDaemonProcessReference {
+    incarnation: string;
+    signalRoot(signal: NodeJS.Signals): void;
+}
 export interface ChatDaemonControlDeps {
     pidAlive?: (pid: number) => boolean;
-    sendSignal?: (pid: number, signal: NodeJS.Signals) => void;
+    processReference?: (pid: number) => ChatDaemonProcessReference | undefined;
     spawn?: (command: string, args: string[], opts: {
         detached: boolean;
         stdio: "ignore";
@@ -36,7 +55,10 @@ export interface ChatDaemonControlDeps {
     ownerPid?: number;
     randomId?: () => string;
     pidIncarnation?: (pid: number) => string | undefined;
+    /** Test seam for platform-specific default stable-process authority. */
+    platform?: NodeJS.Platform;
     sleep?: (ms: number) => Promise<void>;
+    spawnReadyTimeoutMs?: number;
 }
 export declare function chatDaemonPaths(agentDir: string, kind: ChatDaemonKind): {
     dir: string;
@@ -71,7 +93,15 @@ export declare class ChatDaemonController implements BuiltInDaemonController {
     ensure(): Promise<EnsureChatDaemonResult>;
     private operate;
     private incarnation;
-    private isLiveState;
+    private processReference;
+    private isDefinitelyStoppedState;
+    private stateHealth;
+    private isSignalableMatchingOwner;
+    /** A live PID with an invalid ownership record is never safe to overwrite. */
+    private isAmbiguouslyLiveState;
+    private isHealthyFreshState;
+    private classify;
+    private isCurrentCompatibleState;
     private stopForReplacement;
     private ownsCapturedState;
     private signalIfOwner;
@@ -80,6 +110,7 @@ export declare class ChatDaemonController implements BuiltInDaemonController {
     private waitForDeath;
     private sleep;
     private spawn;
+    private waitForOwnership;
 }
 export type EnsureChatDaemonResult = "disabled" | "owner_spawned" | "attached";
 export declare function ensureDiscordDaemon(settings: Settings, deps?: ChatDaemonControlDeps): Promise<EnsureChatDaemonResult>;
@@ -101,11 +132,15 @@ export declare function renewChatDaemonHeartbeat(input: {
     pid?: number;
     incarnation?: string;
     transportHealthy: boolean;
+    pidAlive?: (pid: number) => boolean;
+    pidIncarnation?: (pid: number) => string | undefined;
 }): Promise<boolean>;
 export declare function releaseChatDaemonOwnership(input: {
     agentDir: string;
     kind: ChatDaemonKind;
     ownerId: string;
-    pid?: number;
-    incarnation?: string;
+    pid: number;
+    incarnation: string;
+    pidAlive?: (pid: number) => boolean;
+    pidIncarnation?: (pid: number) => string | undefined;
 }): Promise<void>;

package/dist/types/sdk/bus/config-commands.d.ts

@@ -67,3 +67,11 @@ export declare function parseInThreadConfigCommand(text: string): ConfigCommandC
  * daemon-locally, so it never becomes a `config_command` frame or a user turn.
  */
 export declare function parseRichToggleCommand(text: string): boolean | undefined;
+/**
+ * Parse a `/toolactivity on|off` toggle for Telegram tool-activity delivery.
+ *
+ * This is daemon-local delivery policy rather than a host-session config
+ * command, so it works without a connected session and persists globally.
+ * Addressed commands are accepted only for the exact current bot username.
+ */
+export declare function parseToolActivityToggleCommand(text: string, botUsername?: string): boolean | undefined;

package/dist/types/sdk/bus/config.d.ts

@@ -37,6 +37,12 @@ export interface NotificationSettingsSnapshot {
         richDraft: {
             enabled: boolean;
         };
+        toolActivity: {
+            enabled: boolean;
+        };
+        streaming: {
+            enabled: boolean;
+        };
         topics: {
             nameTemplate?: string;
         };
@@ -109,6 +115,12 @@ export interface NotificationConfig {
     richDraft: {
         enabled: boolean;
     };
+    toolActivity: {
+        enabled: boolean;
+    };
+    streaming: {
+        enabled: boolean;
+    };
     topics: {
         /**
          * Optional Telegram forum-topic name template with `{repo}`, `{branch}`,
@@ -149,6 +161,16 @@ type NotificationConfigFile = z.infer<typeof notificationConfigSchema>;
 export declare function loadNotificationConfigFile(agentDir: string): LoadResult<NotificationConfigFile>;
 export declare function notificationConfigFromFile(value: NotificationConfigFile): Pick<NotificationConfig, "enabled" | "discord" | "slack" | "redact" | "verbosity">;
 export declare function hasNonBlankValue(value: string | undefined): boolean;
+/**
+ * Resolve live assistant streaming independently of generic notification
+ * lifecycle enablement. Explicit environment values override the durable
+ * Telegram preference; otherwise streaming is available only to an active
+ * configured Telegram identity.
+ */
+export declare function isNotificationStreamingEnabled(input: {
+    cfg: NotificationConfig;
+    env: NodeJS.ProcessEnv;
+}): boolean;
 /** Is Telegram configured with usable non-blank boundary credentials? */
 export declare function isTelegramConfigured(cfg: NotificationConfig): cfg is NotificationConfig & {
     botToken: string;

package/dist/types/sdk/bus/index.d.ts

@@ -21,8 +21,13 @@ import type { Tool } from "@gajae-code/ai";
 import { NotificationServer } from "@gajae-code/natives";
 import { Settings } from "../../config/settings";
 import type { ExtensionAPI, ExtensionContext } from "../../extensibility/extensions";
-import type { WorkflowGateTerminalProof } from "../../modes/shared/agent-wire/workflow-gate-broker";
-import type { AskRemoteControl } from "../../tools";
+import { type WorkflowGateEmitter, type WorkflowGateTerminalProof } from "../../modes/shared/agent-wire/workflow-gate-broker";
+import type { AgentSessionEvent } from "../../session/agent-session";
+import type { AskAnswerSourceResult, AskRemoteControl } from "../../tools";
+import { SessionSdkHost } from "../host";
+import { CursorRegistry, RevisionStore } from "../host/query";
+import { type SdkStartupFailure } from "../startup-capability";
+import { type NotificationConfig } from "./config";
 import { NotificationSessionController } from "./session-control";
 import { type EnsureDaemonResult } from "./telegram-daemon";
 /** Where a `session_create` should run. Discriminated by `kind`. */
@@ -182,6 +187,17 @@ export interface SessionReadyFrame {
  * instead of the worktree directory (e.g. `feat-foo-01047f11`).
  */
 export declare function readGitRepoName(cwd: string): string | undefined;
+interface PendingInteractiveAsk {
+    resolve: (result: AskAnswerSourceResult) => void;
+    options: string[];
+    controls: readonly AskRemoteControl[];
+    actionId?: string;
+    retireForDirectControl: () => RetireStatus;
+    reissue: () => boolean;
+    complete: (actionId: string) => void;
+    completeDirect: () => void;
+    fail: (actionId: string) => void;
+}
 interface UnattendedGatePresentation {
     gateId: string;
     sessionId: string;
@@ -260,9 +276,139 @@ export declare class PresentationArbiter {
     cancel(gateId: string, reason: string): void;
     dispose(): void;
 }
+interface SessionRuntime {
+    server: NotificationServer;
+    host: SessionSdkHost;
+    /** Owns stateRoot-backed revisions and removes their spills on terminal shutdown. */
+    revisions: RevisionStore;
+    /** Releases all snapshot pins before the revision store is closed. */
+    cursors: CursorRegistry;
+    /** Current endpoint session identity; never re-key an existing host across a switch. */
+    id: string;
+    idleSeq: number;
+    /** Interactive asks awaiting a remote answer, by action id. */
+    pendingInteractive: Map<string, PendingInteractiveAsk>;
+    /** Deregisters this session's ask answer source. */
+    disposeAnswerSource: () => void;
+    /** Deregisters this session's Telegram file sink. */
+    disposeFileSink: () => void;
+    /** Deregisters this session's workflow-gate listener. */
+    disposeGateListener: () => void;
+    /** Whether notification-only delivery and answer resources are active. */
+    notificationsActive: boolean;
+    /** Set as soon as terminal teardown is requested, before startup settles. */
+    stopping: boolean;
+    /** Recreates notification-only resources after `/notify on`. */
+    enableNotifications: () => void;
+    /** Deregisters canonical workflow-gate terminal cleanup. */
+    disposeGateTerminalController: () => void;
+    disposeAckRecoveryParticipant: () => void;
+    disposeGateEmitterListener: () => void;
+    /** Aborts and fences side turns while notification delivery is disabled. */
+    disableEphemeralTurns: () => void;
+    waitForGateResolutionQuiescence: () => Promise<void>;
+    trackGateResolution: <T>(resolution: Promise<T>) => Promise<T>;
+    workflowGate?: WorkflowGateEmitter;
+    gatePresentations?: PresentationArbiter;
+    redact: boolean;
+    /** Last stable policy's redaction state, retained while provisional policy is held. */
+    committedRedact: boolean;
+    /** Provisional policy suppresses delivery without changing committed-side effects. */
+    policySuspended: boolean;
+    /** Monotonic policy epoch fences asynchronous notification delivery. */
+    policyGeneration: number;
+    /** True only after the exact host generation was registered with the broker index. */
+    brokerRegistrationActive: boolean;
+    /** Terminal cleanup proof retained across retries; each owner is released at most once after proof. */
+    hostStopped: boolean;
+    serverStopped: boolean;
+    brokerRegistrationReleased: boolean;
+    verbosity: "lean" | "verbose";
+    sessionTag: string;
+    /** Whether the agent loop is currently running (drives the typing indicator). */
+    busy: boolean;
+    /** Prompt command/turn identities awaiting their corresponding agent_start. */
+    pendingPromptCorrelations: Array<{
+        commandId: string;
+        turnId: string;
+    }>;
+    /** Identity bound to the agent lifecycle currently in flight. */
+    activePromptCorrelation?: {
+        commandId: string;
+        turnId: string;
+    };
+    /** Records a correlated prompt terminal boundary after agent unwind. */
+    /** Atomically claims a correlated prompt terminal boundary after agent unwind. */
+    recordPromptTerminal: (correlation: {
+        commandId: string;
+        turnId: string;
+    } | undefined) => boolean;
+    /** Records correlated lifecycle frames for replay and delivers them only to the accepted requester after acknowledgement. */
+    emitPromptLifecycle: (correlation: {
+        commandId: string;
+        turnId: string;
+    } | undefined, frame: {
+        type: "agent_start" | "agent_end";
+        sessionId: string;
+        commandId?: string;
+        turnId?: string;
+    } | {
+        type: "agent_failed";
+        sessionId: string;
+        commandId: string;
+        turnId: string;
+        error: {
+            code: string;
+            message: string;
+        };
+    }) => void;
+    /** Publishes one canonical agent-wire event to the client that owns the active prompt. */
+    emitPromptEvent: (event: AgentSessionEvent) => void;
+    /** Inbound Telegram update ids injected but not yet consumed by a turn. */
+    pendingInbound: Set<number>;
+    /** Latest assistant text of the in-flight turn (from message_update). */
+    currentTurnText?: string;
+    /** Assistant text already flushed before an ask this turn (turn-scoped dedupe
+     * so turn_end does not re-emit the pre-ask lead-in). Reset each turn. */
+    preAskFlushedText?: string;
+    /** Live streaming: opt-in flag, monotonic per-turn ref, and emit throttle state. */
+    stream: boolean;
+    turnSeq?: number;
+    liveRef?: string;
+    lastLiveAt?: number;
+    lastLiveText?: string;
+    /** True between turn_end and the next turn_start: drops late async message_update
+     * frames so a stale live edit can never be emitted after the finalized turn. */
+    turnClosed?: boolean;
+    /** Finalized while provisional policy was held; flush exactly once on stable activation. */
+    pendingFinal?: {
+        text?: string;
+        messageRef?: string;
+    };
+    /** Durable gates emitted while ownership is provisional; presented only after stable activation. */
+    deferredGatePresentations: Array<() => void>;
+    /** SDK control frames received during provisional ownership; replayed only after stable activation. */
+    deferredInboundControls: Array<() => void>;
+    /** Started tool calls awaiting a terminal activity frame, keyed by tool call id. */
+    inFlightTools: Map<string, {
+        toolName: string;
+        args: unknown;
+    }>;
+    /** Cancels the postmortem cleanup that emits `session_closed` on process teardown. */
+    cancelPostmortemCleanup: () => void;
+    /** Disposes side-turn resources when their owning logical session becomes unavailable. */
+    abortEphemeralTurns: () => void;
+}
 /** Stable projection of the tool-owned safe-display seam (never the full Tool surface). */
 type SafeSummaryTool = Pick<Tool, "safeSummary" | "safeSummaryFields">;
 export declare function projectToolSummary(tool: SafeSummaryTool | undefined, kind: "args" | "result", value: unknown): string | undefined;
+type SessionStartStatus = "started" | "already" | "disabled" | "failed";
+type SessionStartResult = {
+    status: SessionStartStatus;
+    runtime?: SessionRuntime;
+    failure?: SdkStartupFailure;
+    suppressExtensionError?: boolean;
+};
 export declare function notificationsEnabled(): boolean;
 /** Workflow-gate answer shape. */
 interface GateAnswer {
@@ -328,6 +474,12 @@ export declare class EphemeralTurnHost {
     /** Testable event-ring eviction boundary; tombstones remain idempotency authority. */
     evictTerminalEvents(): void;
 }
+/**
+ * Ensures every configured chat-provider daemon is ready before the SDK
+ * publishes session identity. A rejected ensure is startup-fatal: presenting
+ * an identity for a transport that never became available is false success.
+ */
+export declare function ensureConfiguredProviderDaemons(settings: Settings, cfg: NotificationConfig, ensureProviderDaemon?: (provider: "discord" | "slack", settings: Settings) => Promise<unknown>): Promise<void>;
 export declare function createNotificationsExtension(api: ExtensionAPI, options?: {
     settings?: Settings;
     ensureTelegramDaemon?: (input: {
@@ -335,6 +487,7 @@ export declare function createNotificationsExtension(api: ExtensionAPI, options?
         cwd: string;
         sessionId: string;
     }) => Promise<EnsureDaemonResult>;
+    ensureProviderDaemon?: (provider: "discord" | "slack", settings: Settings) => Promise<unknown>;
     /** Suppress auto-delivery for a GJC-spawned child under `sessionScope=primary`. */
     spawnedByGjc?: boolean;
     controller?: NotificationSessionController;
@@ -344,5 +497,12 @@ export declare function createNotificationsExtension(api: ExtensionAPI, options?
     runEphemeralTurn?: (promptText: string, signal: AbortSignal) => Promise<{
         replyText: string;
     }>;
+    /** Observes settlement of optional session-branch startup after reconciliation completes. */
+    onBranchStartupSettled?: (receipt: {
+        sessionId: string;
+        status: SessionStartResult["status"];
+    }) => void;
+    readNotificationFile?: (path: string) => Promise<Buffer>;
+    readNotificationDiffStat?: (cwd: string) => Promise<string | undefined>;
 }): void;
 export {};

package/dist/types/sdk/bus/notification-service.d.ts

@@ -1,3 +1,4 @@
+import type { WriteFileOptions } from "node:fs";
 import type { Settings } from "../../config/settings";
 /**
  * Strip secrets from a human-facing diagnostic string. Redacts the configured
@@ -21,7 +22,18 @@ export interface NotificationExactUnlinkResult {
     ok: boolean;
     code?: string;
     detachedPath?: string;
-}
+    /** A live publisher successor retained after an exact-unlink race. */
+    retainedSuccessorPath?: string;
+    /** An internal exchange placeholder whose verified cleanup failed. */
+    retainedPlaceholderPath?: string;
+    /** A cleanup entry whose identity could not be verified after a race. */
+    retainedUnknownPath?: string;
+}
+/** Read one regular file together with the identity required for exact removal. */
+export declare function readNotificationEndpointFile(file: string): Promise<NotificationEndpointFile>;
+/** Bump when the native exact-deletion identity contract changes. */
+export declare const NATIVE_PATH_IDENTITY_CONTRACT_VERSION = 1;
+export declare function exactUnlinkNotificationFile(file: string, identity: NotificationEndpointFileIdentity, quarantineName: string): NotificationExactUnlinkResult;
 /** Minimal filesystem surface the service needs; injectable for tests. */
 export interface NotificationServiceFs {
     readdir(dir: string): Promise<string[]>;
@@ -29,13 +41,10 @@ export interface NotificationServiceFs {
     readEndpointFile(file: string): Promise<NotificationEndpointFile>;
     exactUnlink(file: string, identity: NotificationEndpointFileIdentity): Promise<NotificationExactUnlinkResult>;
     unlink(file: string): Promise<void>;
-    /**
-     * Atomically create `file` with O_EXCL semantics: resolves `true` when this
-     * call created it, `false` when it already existed. Used to hold the daemon
-     * steal-mutex ({@link DaemonPaths.steal}) during owner-bound lock removal so
-     * recovery and a concurrent daemon takeover are mutually exclusive.
-     */
-    createExclusive(file: string): Promise<boolean>;
+    writeFile?(file: string, data: string, opts?: WriteFileOptions): Promise<void>;
+    stat?(file: string): Promise<{
+        mtimeMs: number;
+    }>;
 }
 /** Injectable dependencies shared across service operations. */
 export interface NotificationServiceDeps {
@@ -143,6 +152,12 @@ export interface NotificationRecoveryReport {
     endpointsKept: number;
     endpointsUnreadable: number;
     endpointsDetached?: string[];
+    /** Successor paths retained after an exact-unlink race, distinct from stale quarantines. */
+    endpointsRetainedSuccessors?: string[];
+    /** Internal exchange placeholders retained after verified cleanup failure. */
+    endpointsRetainedPlaceholders?: string[];
+    /** Cleanup entries retained with unverified or mismatching identity. */
+    endpointsRetainedUnknown?: string[];
     daemon: {
         action: DaemonRecoveryAction;
         detail: string;
@@ -155,6 +170,53 @@ export interface RecoveryOptions {
     stateRoot?: string;
     deps?: NotificationServiceDeps;
 }
+export interface DaemonTransitionLock {
+    pid: number;
+    incarnation: string;
+    createdAt: number;
+    /** Unique fencing generation for this particular transition acquisition. */
+    token: string;
+}
+type TransitionMarkerFs = {
+    readFile(file: string, encoding: "utf8"): Promise<string>;
+    writeFile?(file: string, data: string, opts?: WriteFileOptions): Promise<void>;
+    readEndpointFile?(file: string): Promise<NotificationEndpointFile>;
+    exactUnlink?(file: string, identity: NotificationEndpointFileIdentity): Promise<NotificationExactUnlinkResult>;
+};
+/** True only while the exact transition acquisition still occupies the marker path. */
+export declare function daemonTransitionLockIsHeld(input: {
+    fs: Pick<TransitionMarkerFs, "readFile" | "readEndpointFile">;
+    path: string;
+    lock: DaemonTransitionLock;
+}): Promise<boolean>;
+/** Removes only the caller's exact marker through the identity-bound detach primitive. */
+export declare function releaseDaemonTransitionLock(input: {
+    fs: TransitionMarkerFs;
+    path: string;
+    lock: DaemonTransitionLock;
+}): Promise<boolean>;
+/**
+ * Acquire the daemon lifecycle transition lock using durable owner metadata.
+ * The full marker is published in the single O_EXCL write which reserves it;
+ * canonical markers are detached only through their captured filesystem identity.
+ *
+ * Malformed and empty markers deliberately remain blocked regardless of age. They
+ * have no owner provenance, so reclaiming them could detach a generation-6 empty
+ * reservation while its paused legacy writer can still resume. Operators must
+ * manually clean up such legacy debris after confirming no legacy process remains.
+ */
+export declare function acquireDaemonTransitionLock(input: {
+    fs: TransitionMarkerFs;
+    path: string;
+    pid: number;
+    pidAlive: (pid: number) => boolean;
+    pidIncarnation: (pid: number) => string | undefined;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+    retries?: number;
+    retryDelayMs?: number;
+    randomToken?: () => string;
+}): Promise<DaemonTransitionLock | undefined>;
 /**
  * Ownership-protected cleanup. Removes only DEAD-owner artifacts:
  * per-session endpoint files with positive proof of death (a stale tombstone or
@@ -168,3 +230,4 @@ export interface RecoveryOptions {
 export declare function recoverNotifications(opts: RecoveryOptions): Promise<NotificationRecoveryReport>;
 /** Render a recovery report as human-readable lines (no secrets). */
 export declare function formatNotificationRecoveryReport(report: NotificationRecoveryReport): string;
+export {};

package/dist/types/sdk/bus/session-control.d.ts

@@ -14,7 +14,7 @@ export interface BoundNotificationSession<Context extends NotificationSessionCon
     unbind(): void;
 }
 export type NotificationEndpointStartResult = "started" | "already" | "disabled" | "failed";
-export type TelegramDaemonPreflightResult = "ready" | "blocked_identity";
+export type TelegramDaemonPreflightResult = "ready" | "blocked_identity" | "failed";
 /**
  * The endpoint implementation is deliberately injected. The controller owns
  * policy and session-local state while the extension continues to own its
@@ -29,6 +29,10 @@ export interface NotificationSessionRuntime<Context extends NotificationSessionC
      * emit a frame. `blocked_identity` is fail-closed and starts nothing.
      */
     ensureTelegramDaemon?(binding: BoundNotificationSession<Context>): Promise<TelegramDaemonPreflightResult>;
+    /** Refresh mutable delivery policy from the same configuration snapshot used for reconciliation. */
+    refreshPolicy?(binding: BoundNotificationSession<Context>, policy: NotificationRuntimePolicy): void;
+    /** Enables delivery only after the controller has committed a stable policy. */
+    activate?(binding: BoundNotificationSession<Context>): void;
 }
 export interface NotificationSessionStatus {
     eligible: boolean;
@@ -41,6 +45,12 @@ export interface NotificationSessionReconcileResult {
     outcome: NotificationEndpointStartResult | "stopped";
     status: NotificationSessionStatus;
 }
+export interface NotificationRuntimePolicy {
+    redact: boolean;
+    verbosity: NotificationConfig["verbosity"];
+    stream: boolean;
+    mode: "provisional" | "committed";
+}
 export interface NotificationSessionControllerOptions {
     /** Gate A result, resolved once by the SDK from the canonical host predicate. */
     eligible: boolean;
@@ -49,13 +59,6 @@ export interface NotificationSessionControllerOptions {
     /** Kept as a reference so test and embedding hosts can supply their own environment. */
     env?: NodeJS.ProcessEnv;
 }
-/**
- * Shared owner of notification session policy.
- *
- * Gate A is captured at creation. Gate B is evaluated for each session
- * operation with `isSessionNotificationsEnabled`. Gate C verifies complete
- * Telegram ownership before a generic endpoint is allowed to start.
- */
 export declare class NotificationSessionController {
     #private;
     constructor(options: NotificationSessionControllerOptions);

package/dist/types/sdk/bus/telegram-daemon-cli.d.ts

@@ -30,6 +30,11 @@ export declare function createLightweightDaemonSettings(input: {
 }): LightweightDaemonSettings;
 export declare function loadLightweightDaemonSettings(agentDir: string): Promise<LightweightDaemonSettings>;
 export declare function ownerPidFromOwnerId(ownerId: string): number | undefined;
+/** Creates owner-fenced daemon control hooks for the CLI lifecycle boundary. */
+export declare function createDaemonControlHooks(settings: Settings): {
+    shouldStop: (owner: string) => Promise<boolean>;
+    clear: (owner: string) => Promise<void>;
+};
 export declare function runDaemonSmoke(opts?: {
     agentDir?: string;
 }): Promise<void>;

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -11,7 +11,10 @@ export declare const NOTIFICATION_PROTOCOL_VERSION = 3;
  * freshly-upgraded host must still recognize an older, still-live daemon that
  * predates capability-gated frame enforcement and trigger a reload. Bump this
  * on every daemon-behavior change independent of the wire version.
- * The current development baseline already includes #2299's generation 4;
- * this behavior change therefore advances the operational generation to 5.
+ * The current development baseline already includes #2299's generation 4,
+ * incarnation fencing in generation 5, owner-lock authority in generation 6,
+ * identity-atomic transition markers in generation 7, stable signaling plus
+ * tri-state foreign-owner provenance in generation 8, and retained managed
+ * filesystem authority changes in generation 9.
  */
-export declare const DAEMON_GENERATION = 5;
+export declare const DAEMON_GENERATION = 9;

package/dist/types/sdk/bus/telegram-daemon-control.d.ts

@@ -22,11 +22,18 @@ export declare function telegramControlRequestPath(agentDir: string): string;
 export declare function readTelegramControlRequest(settings: Settings, fsImpl?: TelegramDaemonFs): Promise<TelegramDaemonControlRequest | undefined>;
 export declare function writeTelegramControlRequest(settings: Settings, request: TelegramDaemonControlRequest, fsImpl?: TelegramDaemonFs): Promise<void>;
 export declare function clearTelegramControlRequest(settings: Settings, requestId?: string, fsImpl?: TelegramDaemonFs): Promise<void>;
+export interface DaemonProcessReference {
+    incarnation: string;
+    signalRoot(signal: NodeJS.Signals): void;
+}
 export interface TelegramDaemonControlDeps {
     fs?: TelegramDaemonFs;
     now?: () => number;
     pidAlive?: (pid: number) => boolean;
-    sendSignal?: (pid: number, signal: NodeJS.Signals) => void;
+    processReference?: (pid: number) => DaemonProcessReference | undefined;
+    pidIncarnation?: (pid: number) => string | undefined;
+    /** Test seam for platform-specific default stable-process authority. */
+    platform?: NodeJS.Platform;
     spawn?: TelegramDaemonDeps["spawn"];
     execPath?: string;
     /**
@@ -40,20 +47,30 @@ export interface TelegramDaemonControlDeps {
     randomId?: () => string;
     sleep?: (ms: number) => Promise<void>;
     waitStepMs?: number;
+    /** Bounded startup-readiness timeout; injectable for deterministic controller tests. */
+    readinessTimeoutMs?: number;
 }
+export type TelegramGenerationReloadResult = {
+    outcome: "ready";
+    operation: DaemonOperationResult;
+} | {
+    outcome: "failed";
+    operation: DaemonOperationResult;
+};
 export declare class TelegramDaemonController implements BuiltInDaemonController {
     private readonly settings;
     private readonly deps;
     readonly kind: "telegram";
     private readonly fsImpl;
-    private readonly now;
     private readonly pidAlive;
-    private readonly sendSignal;
+    private readonly now;
+    private readonly processReference;
     private readonly waitStepMs;
     constructor(settings: Settings, deps?: TelegramDaemonControlDeps);
     private runtimeInfo;
     status(): Promise<DaemonStatus>;
     private spawnDeps;
+    private spawnAndWait;
     private sleep;
     /**
      * Wait until the captured pid is dead. Ownership-file movement is NOT treated
@@ -61,10 +78,12 @@ export declare class TelegramDaemonController implements BuiltInDaemonController
      * which is what the no-409 invariant requires before spawning a fresh poller.
      */
     private waitForPidDeath;
+    private signalCapturedOwner;
     private result;
     reload(opts?: DaemonOperationOptions): Promise<DaemonOperationResult>;
+    reloadForGenerationUpgrade(opts?: DaemonOperationOptions): Promise<TelegramGenerationReloadResult>;
     stop(opts?: DaemonOperationOptions): Promise<DaemonOperationResult>;
     private stopOrReload;
-    /** Clear our own control request unless a newer owner-scoped request replaced it. */
+    /** Clear only our exact control request; a successor request must survive. */
     private clearOwnRequest;
 }