@gajae-code/coding-agent 0.11.7 → 0.11.8

package/dist/types/sdk/bus/telegram-daemon.d.ts

@@ -4,6 +4,7 @@ import type { DaemonRuntimeInfo } from "../../daemon/control-types";
 import { HEARTBEAT_TTL_MS } from "./daemon-paths";
 import { type DaemonTransitionLock, type NotificationEndpointFile, type NotificationEndpointFileIdentity, type NotificationExactUnlinkResult } from "./notification-service";
 import { type DaemonProcessReference } from "./telegram-daemon-control";
+import { type TelegramSetupPreflight } from "./telegram-setup";
 export { DAEMON_GENERATION, NOTIFICATION_PROTOCOL_VERSION } from "./telegram-daemon-contract";
 import { type ControlServerLike, type LifecycleControlServerFactory } from "./lifecycle-control-runtime";
 import type { OrchestratorDeps } from "./lifecycle-orchestrator";
@@ -55,6 +56,10 @@ export interface TelegramDaemonFs {
     chmod(path: string, mode: number): Promise<void>;
     stat?(path: string): Promise<{
         mtimeMs: number;
+        size?: number;
+        dev?: number;
+        ino?: number;
+        ctimeMs?: number;
     }>;
     readEndpointFile?(path: string): Promise<NotificationEndpointFile>;
     exactUnlink?(path: string, identity: NotificationEndpointFileIdentity): Promise<NotificationExactUnlinkResult>;
@@ -102,6 +107,21 @@ export declare const ASK_SELECTED_ACK_CAPABILITY = "ask_selected_ack_v1";
 export declare const ASK_CONTROLS_CAPABILITY = "ask_controls_v1";
 /** Capability required for tool lifecycle and reasoning-summary frames. */
 export declare const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v1";
+/**
+ * File-lock options whose acquisition budget covers the full reload-reservation
+ * critical section: the in-lock freshness poll plus the controller's
+ * graceful+kill+readiness sequence, with headroom. A contender must be able to
+ * wait out a legitimate slow reload and then attach, never fail startup.
+ */
+export declare function reloadReservationLockOptions(input: {
+    freshnessWaitMs: number;
+    readinessTimeoutMs: number;
+    retryDelayMs?: number;
+}): {
+    staleMs: number;
+    retries: number;
+    retryDelayMs: number;
+};
 export declare const BTW_QUESTION_MAX_UNICODE_SCALARS = 4096;
 export declare const BTW_QUESTION_MAX_UTF8_BYTES = 16384;
 export declare function endpointAuthorityDigest(url: string, token: string, connectionIdentity?: string): string;
@@ -137,12 +157,22 @@ type LegacyOwnershipLockMetadata = {
     incarnation?: string;
     startedAt: number;
 };
+type V010OwnershipLockMetadata = {
+    size: 0;
+    mtimeMs?: number;
+    dev?: number;
+    ino?: number;
+    ctimeMs?: number;
+};
 type OwnershipLockRead = {
     kind: "missing";
 } | {
     kind: "malformed";
     raw: string;
     mtimeMs?: number;
+} | {
+    kind: "v010";
+    metadata: V010OwnershipLockMetadata;
 } | {
     kind: "legacy";
     metadata: LegacyOwnershipLockMetadata;
@@ -188,7 +218,84 @@ export declare function unregisterNotificationRoot(input: {
     sessionId: string;
     fs?: TelegramDaemonFs;
 }): Promise<UnregisterNotificationRootResult>;
+/**
+ * Leak artifact prefixes left when native exact-unlink cleanup is retained
+ * (#2956). Nothing previously reaped these; they accumulate in the notifications
+ * directory across ownership transitions.
+ */
+export declare const NOTIFICATION_LEAK_ARTIFACT_PREFIXES: readonly [".gjc-delete-daemon-transition-", ".gjc-exact-unlink-placeholder-", ".gjc-delete-notification-endpoint-"];
+/** Grace window before a leak artifact is reaped (covers in-flight unlinks). */
+export declare const NOTIFICATION_LEAK_ARTIFACT_GRACE_MS: number;
+/** True when a path is permanently gone (not a transient I/O blip). */
+export declare function isPermanentMissingPathError(error: unknown): boolean;
+export declare function isNotificationLeakArtifactName(name: string): boolean;
+/**
+ * Drop permanently missing scan roots from the durable registry under the roots
+ * lock. Session map entries that pointed only at those roots are removed too.
+ */
+export declare function pruneMissingNotificationRoots(input: {
+    settings: Settings;
+    fs?: TelegramDaemonFs;
+    /** When set, only these roots are considered; otherwise every registered root is probed. */
+    candidates?: readonly string[];
+}): Promise<{
+    pruned: string[];
+    remaining: number;
+}>;
+/**
+ * Reap retained exact-unlink / ownership-transition quarantine files older than
+ * the grace window from the notifications directory.
+ */
+export declare function reapStaleNotificationArtifacts(input: {
+    settings: Settings;
+    fs?: TelegramDaemonFs;
+    now?: () => number;
+    graceMs?: number;
+}): Promise<{
+    removed: string[];
+    skipped: number;
+}>;
+/**
+ * Startup / ownership self-heal: prune dead roots and reap leak artifacts so
+ * `gjc daemon reload` recovers a degraded install without manual surgery (#2956).
+ */
+export declare function healTelegramDaemonNotificationState(input: {
+    settings: Settings;
+    fs?: TelegramDaemonFs;
+    now?: () => number;
+    graceMs?: number;
+}): Promise<{
+    prunedRoots: string[];
+    removedArtifacts: string[];
+}>;
 export declare function hasSafeDaemonStateShape(state: unknown): state is DaemonState;
+type ParentDaemonStateBase = Omit<DaemonState, "incarnation" | "acquisitionId" | "ownershipPhase" | "generation" | "launcherPid"> & {
+    incarnation?: undefined;
+    acquisitionId?: undefined;
+    ownershipPhase?: undefined;
+    generation?: unknown;
+    launcherPid?: undefined;
+};
+type GenerationAbsentParentDaemonState = Omit<ParentDaemonStateBase, "generation"> & {
+    generation?: undefined;
+};
+type Generation3ReleaseDaemonState = Omit<ParentDaemonStateBase, "generation"> & {
+    generation: 3;
+};
+export type LegacyParentDaemonState = GenerationAbsentParentDaemonState | Generation3ReleaseDaemonState;
+export interface AttestedLegacyDaemonOwner {
+    state: LegacyParentDaemonState;
+    incarnation: string;
+}
+/** Revalidate the exact two-observation legacy proof immediately before signaling. */
+export declare function readAttestedLegacyDaemonOwner(input: {
+    settings: Settings;
+    fs?: TelegramDaemonFs;
+    now?: () => number;
+    pidIncarnation?: (pid: number) => string | undefined;
+    tokenFingerprint: string;
+    chatId: string;
+}): Promise<AttestedLegacyDaemonOwner | undefined>;
 /** True for a physically live owner with this configuration, including legacy generations. */
 export declare function isPhysicalMatchingOwner(input: {
     state: DaemonState | undefined;
@@ -197,7 +304,7 @@ export declare function isPhysicalMatchingOwner(input: {
     pidAlive: (pid: number) => boolean;
     pidIncarnation?: (pid: number) => string | undefined;
 }): boolean;
-/** True only for a signalable legacy owner or this generation's ready bound child. */
+/** True only for a fully-provenanced modern owner outside the generation-3 parent schema. */
 export declare function isSignalableMatchingOwner(input: {
     state: DaemonState | undefined;
     tokenFingerprint: string;
@@ -246,6 +353,7 @@ export declare function acquireDaemonOwnership(input: {
     provisional?: boolean;
     reason?: "identity_mismatch";
     reloadRequired?: boolean;
+    legacyReloadRequired?: boolean;
 }>;
 export declare function renewDaemonHeartbeat(input: {
     settings: Settings;
@@ -322,6 +430,8 @@ export declare function confirmTelegramDaemonSpawn(input: {
     sleep?: (ms: number) => Promise<void>;
     waitStepMs?: number;
     timeoutMs?: number;
+    /** Retain an unproven no-PID child lease during a successor handoff. */
+    preserveOnUnprovenChildExit?: boolean;
 }): Promise<boolean>;
 export declare function releaseDaemonOwnership(input: {
     settings: Settings;
@@ -339,6 +449,22 @@ export declare function releaseDaemonOwnership(input: {
 export declare function readDaemonState(settings: Pick<Settings, "getAgentDir">, fs?: TelegramDaemonFs): Promise<DaemonState | undefined>;
 /** Read the persisted notification roots list. */
 export declare function readDaemonRoots(settings: Pick<Settings, "getAgentDir">, fs?: TelegramDaemonFs): Promise<string[]>;
+/** Injectable readers for {@link resolveTelegramSetupPreflight}, defaulting to the real OS/state probes. */
+export interface ResolveTelegramSetupPreflightDeps {
+    readDaemonState?: (settings: Settings) => Promise<DaemonState | undefined>;
+    pidAlive?: (pid: number) => boolean;
+    pidIncarnation?: (pid: number) => string | undefined;
+}
+/**
+ * Build the Telegram setup preflight from persisted daemon state. The daemon is
+ * reported live ONLY when its PID is alive AND its current process incarnation
+ * still matches the persisted incarnation. Skipping the incarnation check makes
+ * a stale state file whose PID has been recycled by an unrelated process
+ * masquerade as a live owner, which wrongly blocks discovery pairing. Both the
+ * `notify setup` CLI and the /settings Notifications tab share this resolver so
+ * pairing behaves identically on both surfaces.
+ */
+export declare function resolveTelegramSetupPreflight(settings: Settings, deps?: ResolveTelegramSetupPreflightDeps): Promise<TelegramSetupPreflight>;
 export interface TelegramSpawnOwnerInput {
     settings: Settings;
     roots?: string[];
@@ -363,6 +489,7 @@ export type TelegramSpawnOwnerResult = {
     runtime: DaemonRuntimeInfo;
     warnings: string[];
     reloadRequired?: boolean;
+    legacyReloadRequired?: boolean;
 } | {
     result: "blocked";
     runtime: DaemonRuntimeInfo;

package/dist/types/sdk/bus/telegram-reference.d.ts

@@ -73,6 +73,7 @@ export declare function buildActionMessage(action: {
     id: string;
     question?: string;
     options?: string[];
+    recommendedIndex?: unknown;
     controls?: readonly TelegramActionControl[];
     summary?: string;
 }): RenderedMessage;
@@ -81,6 +82,7 @@ export declare function buildActionMarkdown(action: {
     kind: "ask" | "idle";
     question?: string;
     options?: string[];
+    recommendedIndex?: unknown;
     summary?: string;
 }): string;
 /** Send Telegram HTML text chunks sequentially so long messages preserve order. */

package/dist/types/sdk/host/control/operations.d.ts

@@ -5,7 +5,7 @@ export type ControlInput = Record<string, unknown>;
  * AgentSession and its controllers without exposing those concrete types here.
  */
 export interface ControlSurface {
-    prompt(text: string, images?: ControlValue): Promise<ControlValue> | ControlValue;
+    prompt(text: string, images?: ControlValue, clientRef?: string): Promise<ControlValue> | ControlValue;
     steer(text: string): Promise<ControlValue> | ControlValue;
     followUp(text: string): Promise<ControlValue> | ControlValue;
     abort(): Promise<ControlValue> | ControlValue;

package/dist/types/sdk/host/host.d.ts

@@ -13,7 +13,7 @@ export interface SessionSdkHostOptions extends HostEndpointAdapters {
     onProviderDefinitionsRemoved?: (capability: string) => void;
     onReverseCancel?: (requestId: string, reason: "provider_disconnected" | "lease_released") => void;
     /** Best-effort capabilities mirrored from the native transport for out-of-band consumers. */
-    connectionCapabilities?: (connectionId: string) => ReadonlySet<string>;
+    connectionCapabilities?: (connectionId: string) => ReadonlySet<string> | undefined;
 }
 /** SDK hosting is independent of notification configuration. Only root sessions host an endpoint. */
 export declare function shouldHostSdk(_settings: unknown, isTopLevel: boolean, env?: NodeJS.ProcessEnv): boolean;

package/dist/types/sdk/host/query/handlers.d.ts

@@ -31,6 +31,14 @@ export interface SessionSurface {
         totalBytes: number;
     } | undefined>;
     getJobs(): unknown | Promise<unknown>;
+    /** Q26 keyed lookup of a submitted prompt's authoritative reconciliation status. */
+    getPromptStatus?(selector: {
+        commandId?: string;
+        turnId?: string;
+        clientRef?: string;
+    }): unknown | Promise<unknown>;
+    /** Q27 effective model-profile catalog from the live session registry. */
+    getModelProfiles?(): unknown[] | Promise<unknown[]>;
     /** Query rows backed by the session's installed binding map. */
     installedQueries?: ReadonlySet<string>;
 }
@@ -57,6 +65,7 @@ export interface QueryResponse {
         code: string;
         message: string;
         restartQuery?: boolean;
+        details?: unknown;
     };
 }
 export declare class QueryHandlers {

package/dist/types/sdk/index.d.ts

@@ -1,7 +1,9 @@
+export { MODEL_PROFILE_DISCOVERY_QUERY, MODEL_PROFILE_ERROR_DETAIL_MAX_BYTES, type ModelProfileCatalogItem, type ModelProfileErrorCode, type ModelProfileErrorDetails, ModelProfileRegistryError, type ModelProfileRegistryErrorDetails, type UnknownModelProfileDetails, UnknownModelProfileError, } from "../config/model-profile-contract";
 export * as bus from "./bus";
 export * from "./client";
 export * as host from "./host";
 export * as mcp from "./mcp";
 export type { Q10CurrentThinkingLevel, Q10Model, Q10SettableThinkingLevel, Q10ThinkingCapabilities, Q10ThinkingEffort, Q10ThinkingMode, } from "./models";
+export * from "./prompt-status";
 export * from "./session";
 export * from "./session-directory";

package/dist/types/sdk/prompt-status.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Public DTO contract for Q26 `turn.prompt_status` and the `clientRef`
+ * correlation field on `turn.prompt`.
+ *
+ * Semantics:
+ * - `turn.prompt` remains ordered and non-idempotent. An envelope
+ *   `idempotencyKey` is ignored for replay/conflict purposes on ordered
+ *   operations (no replay cache, no `idempotency_conflict`).
+ * - `clientRef` is a caller-chosen correlation key (trimmed, non-empty,
+ *   1..PROMPT_CLIENT_REF_MAX_LENGTH chars; one fresh value per logical prompt)
+ *   mapped to the generated commandId/turnId at preflight acceptance so a
+ *   caller can reconcile after a lost acknowledgement frame.
+ * - The clientRef index is scoped to one live session runtime: identical refs
+ *   may coexist in different sessions, lookups never cross sessions, a ref
+ *   conflicts only while its record is retained (`client_ref_conflict`), and
+ *   after terminal TTL/capacity eviction a ref may be admitted again with the
+ *   prior outcome unknown — callers MUST NOT reuse a clientRef as a retry
+ *   mechanism and MUST treat `unknown` as uncertainty, not proof of
+ *   non-execution.
+ * - The durability floor is the live session process: after restart or
+ *   retained-record eviction, a lookup honestly reports `unknown`.
+ * - Q26 tracks prompts accepted through the SDK control surface (which always
+ *   carries a requesting connection); submissions without a delivery owner are
+ *   outside the reconciliation contract and hold no reservation.
+ */
+export declare const PROMPT_CLIENT_REF_MAX_LENGTH = 128;
+export interface TurnPromptImageInput {
+    data: string;
+    mimeType?: string;
+}
+/** Public input contract for ordered `turn.prompt`. */
+export interface TurnPromptInput {
+    text: string;
+    images?: TurnPromptImageInput[];
+    clientRef?: string;
+}
+/** Terminal outcome is preserved exactly; active records never age into terminal. */
+export type PromptReconciliationStatus = "accepted" | "in_flight" | "terminal_ok" | "failed";
+/** Exactly one selector per lookup. */
+export type TurnPromptStatusSelector = {
+    clientRef: string;
+} | {
+    commandId: string;
+    turnId: string;
+};
+interface TurnPromptReconciliationIdentity {
+    commandId: string;
+    turnId: string;
+    clientRef?: string;
+    /** Epoch milliseconds of preflight acceptance. */
+    acceptedAt: number;
+}
+export interface TurnPromptReconciliationAccepted extends TurnPromptReconciliationIdentity {
+    status: "accepted";
+}
+export interface TurnPromptReconciliationInFlight extends TurnPromptReconciliationIdentity {
+    status: "in_flight";
+    /** Epoch milliseconds of the agent_start transition. */
+    startedAt: number;
+}
+export interface TurnPromptReconciliationTerminalOk extends TurnPromptReconciliationIdentity {
+    status: "terminal_ok";
+    startedAt?: number;
+    /** Epoch milliseconds of the terminal transition. */
+    terminalAt: number;
+}
+export interface TurnPromptReconciliationFailed extends TurnPromptReconciliationIdentity {
+    status: "failed";
+    startedAt?: number;
+    terminalAt: number;
+    /** Bounded, sanitized failure detail (code safe-token ≤64, message ≤512). */
+    error: {
+        code: string;
+        message: string;
+    };
+}
+export interface TurnPromptReconciliationUnknown {
+    status: "unknown";
+}
+export type TurnPromptReconciliation = TurnPromptReconciliationAccepted | TurnPromptReconciliationInFlight | TurnPromptReconciliationTerminalOk | TurnPromptReconciliationFailed | TurnPromptReconciliationUnknown;
+/** Result of a successful `turn.prompt` preflight acknowledgement. */
+export interface TurnPromptAcceptedResult {
+    commandId: string;
+    turnId: string;
+    accepted: true;
+    clientRef?: string;
+}
+export {};

package/dist/types/sdk/session-directory.d.ts

@@ -20,7 +20,7 @@ export type ResolveManagedSessionScopeResult = {
     scope: ManagedSessionScope;
 } | {
     kind: "error";
-    code: "cwd_missing" | "cwd_not_directory" | "identity_unavailable" | "network_unsupported" | "sessions_root_unavailable" | "binding_conflict" | "binding_invalid";
+    code: "cwd_missing" | "cwd_not_directory" | "identity_unavailable" | "network_unsupported" | "sessions_root_unavailable" | "binding_conflict" | "binding_invalid" | "atomic_unavailable" | "durability_not_provable" | "durability_failed" | "invalid_request";
     message: string;
 };
 export interface LogicalSessionCandidate {

package/dist/types/sdk/startup-capability.d.ts

@@ -1,9 +1,12 @@
+import { type ModelProfileErrorCode, type ModelProfileErrorDetails } from "../config/model-profile-contract";
 export type SdkStartupPhase = "registration" | "startup";
 export type SdkStartupReason = "disabled" | "ineligible" | "factory_absent" | "runner_absent" | "pending" | "failed";
 export interface SdkStartupFailure {
     phase: SdkStartupPhase;
     reason: SdkStartupReason;
     message: string;
+    code?: ModelProfileErrorCode;
+    details?: ModelProfileErrorDetails;
 }
 export type SdkStartupResult = {
     status: "started";

package/dist/types/session/agent-session.d.ts

@@ -542,6 +542,8 @@ export declare class AgentSession {
      *  recorded or the mode-state file is missing/unreadable; callers should
      *  treat undefined as a non-terminal phase (refuses to chain). */
     getActiveSkillPhase(): string | undefined;
+    /** Provider-facing ask metadata must expose only the active deep-interview phase. */
+    getDeepInterviewAskStage(): "topology" | "post-topology" | undefined;
     /** Peek the in-flight directive's invocation handler for use by the resolve tool. */
     peekQueueInvoker(): ((input: unknown) => Promise<unknown> | unknown) | undefined;
     peekStandingResolveHandler(): ((input: unknown) => Promise<unknown> | unknown) | undefined;

package/dist/types/session/internal/managed-session-scope.d.ts

@@ -33,7 +33,7 @@ export declare function managedDirectoryIdentityForScope(scope: ManagedScope): {
 };
 export declare function managedRootForScope(scope: ManagedScope): ManagedDirectoryRoot;
 export type ManagedMigrationPolicy = "copy-retain" | "disabled";
-export type ManagedScopeErrorCode = "cwd_missing" | "cwd_not_directory" | "identity_unavailable" | "network_unsupported" | "sessions_root_unavailable" | "binding_conflict" | "binding_invalid";
+export type ManagedScopeErrorCode = "cwd_missing" | "cwd_not_directory" | "identity_unavailable" | "network_unsupported" | "sessions_root_unavailable" | "binding_conflict" | "binding_invalid" | "atomic_unavailable" | "invalid_request" | "durability_failed" | "durability_not_provable";
 export type ManagedScopeResolution = {
     kind: "resolved";
     scope: ManagedScope;
@@ -41,6 +41,10 @@ export type ManagedScopeResolution = {
     kind: "error";
     code: ManagedScopeErrorCode;
     message: string;
+    cause?: {
+        readonly classification: string;
+        readonly diagnostic?: string;
+    };
 };
 export interface ManagedCandidate {
     sessionId: string;
@@ -63,7 +67,7 @@ export type ManagedCandidateListing = {
     code: "scan_failed" | "unsafe_root" | "invalid_candidate";
     message: string;
 };
-export type ManagedOpenFailure = "migration_busy" | "binding_conflict" | "binding_invalid" | "destination_conflict" | "source_changed" | "unsafe_artifacts" | "durability_failed" | "migration_retired" | "legacy_migration_disabled" | "managed_storage_unsupported";
+export type ManagedOpenFailure = "migration_busy" | "binding_conflict" | "binding_invalid" | "destination_conflict" | "source_changed" | "unsafe_artifacts" | "durability_failed" | "atomic_unavailable" | "invalid_request" | "durability_not_provable" | "migration_retired" | "legacy_migration_disabled" | "managed_storage_unsupported";
 export type ManagedOpenCandidateResult = {
     kind: "opened";
     path: string;
@@ -80,6 +84,11 @@ export type ManagedDeleteCandidateResult = {
 } | {
     kind: "already_deleted";
     tombstonePath: string;
+} | {
+    kind: "cleanup_pending";
+    tombstonePath: string;
+    phase: "artifacts" | "transcript";
+    message: string;
 } | {
     kind: "error";
     code: ManagedOpenFailure;

package/dist/types/session/internal/managed-session-storage.d.ts

@@ -1,10 +1,18 @@
 import { type NativeDirectoryTreeSnapshot, type NativeOwnerOnlySecurityResult, type RecoveryFsRoot } from "@gajae-code/natives";
+import { type NativePublishOutcome } from "./native-publish-outcome";
 export declare const MANAGED_ARTIFACT_MAX_DEPTH = 32;
 export declare const MANAGED_ARTIFACT_MAX_FILES = 10000;
 export declare const MANAGED_ARTIFACT_MAX_FILE_BYTES: number;
 export declare const MANAGED_ARTIFACT_MAX_TOTAL_BYTES: number;
+export declare class ManagedPublishError extends Error {
+    readonly classification: "destination_conflict" | "atomic_unavailable" | "invalid_request" | "durability_not_provable" | "identity_mismatch" | "io_error" | "durability_failed";
+    readonly diagnostic: string;
+    constructor(classification: ManagedPublishError["classification"], outcome: NativePublishOutcome);
+}
+/** Cleanup is safe only when the native move reports that it did not commit. */
+export declare function mayCleanManagedTreeStaging(error: unknown): boolean;
 export type ManagedSessionSecurityPolicy = "default" | "windows-existing-verify-first";
-export type ManagedStorageFailure = "migration_busy" | "binding_conflict" | "binding_invalid" | "destination_conflict" | "source_changed" | "unsafe_artifacts" | "durability_failed" | "migration_retired" | "managed_storage_unsupported";
+export type ManagedStorageFailure = "migration_busy" | "binding_conflict" | "binding_invalid" | "destination_conflict" | "source_changed" | "unsafe_artifacts" | "durability_failed" | "atomic_unavailable" | "durability_not_provable" | "migration_retired" | "managed_storage_unsupported";
 export interface ManagedStorageLock {
     path: string;
     attemptId: string;
@@ -29,6 +37,13 @@ export interface ManagedDirectoryRoot {
     readonly dev: bigint;
     readonly ino: bigint;
 }
+/**
+ * Establish the first managed directory beneath a potentially shared ancestor.
+ * The ancestor is used only to create the managed chain; every component from
+ * `configuredRoot` downward is independently type, symlink, owner, mode, and
+ * ACL checked. This deliberately does not impose owner-only policy on `/tmp`.
+ */
+export declare function prepareManagedDirectoryRoot(configuredRoot: string, policy?: ManagedSessionSecurityPolicy): ManagedDirectoryRoot;
 export declare function managedDirectoryRoot(configuredRoot: string): ManagedDirectoryRoot;
 export declare function retainManagedDirectoryAuthority(root: ManagedDirectoryRoot, directory: string, expected?: {
     dev: bigint;
@@ -68,7 +83,7 @@ export declare class ManagedSessionDescendantStore {
     captureTree(relativePath: string): NativeDirectoryTreeSnapshot;
     /** Copy an exact captured tree into an absent managed destination. */
     importTree(sourceRelativePath: string, destinationRelativePath: string, snapshot: NativeDirectoryTreeSnapshot): Promise<void>;
-    moveTreeNoReplace(sourceRelativePath: string, destinationRelativePath: string, expected: NativeDirectoryTreeSnapshot): void;
+    moveTreeNoReplace(sourceRelativePath: string, destinationRelativePath: string, expected: NativeDirectoryTreeSnapshot): NativeDirectoryTreeSnapshot;
     removeTreeExpected(relativePath: string, expected: NativeDirectoryTreeSnapshot): void;
     fsyncTree(): NativeDirectoryTreeSnapshot;
 }

package/dist/types/session/internal/native-publish-outcome.d.ts

@@ -0,0 +1,48 @@
+export type NativePublishMutationState = "not_committed" | "committed" | "unknown";
+export type NativePublishDurabilityState = "not_attempted" | "proven" | "not_provable";
+export type NativePublishReason = "none" | "destination_exists" | "atomic_unavailable" | "cross_device" | "permission_denied" | "io_failure" | "interrupted" | "invalid_request" | "identity_violation" | "durability_not_provable" | "unknown";
+export type NativePublishOperation = "direct_rename" | "retained_file" | "retained_tree";
+export type NativePublishPrimitive = "renameat2_noreplace" | "renameatx_np_excl" | "windows_rename_noreplace" | "unsupported" | "unknown";
+export type NativePublishPhase = "preflight" | "file_sync" | "rename" | "source_parent_sync" | "destination_parent_sync" | "terminal_identity" | "complete" | "unknown";
+type SyncFailure = {
+    phase: Exclude<NativePublishPhase, "preflight" | "file_sync" | "rename" | "complete" | "unknown">;
+    parentRole: "source" | "destination" | "shared" | "staged_file";
+    osCode?: number;
+    kind: "unsupported" | "io" | "permission" | "other";
+};
+type PublishDiagnostic = {
+    schemaVersion: 1;
+    collectionState: "complete" | "partial" | "unavailable";
+    osCode?: number;
+    syncFailures?: readonly SyncFailure[];
+};
+export type NativePublishIdentity = {
+    readonly dev: string;
+    readonly ino: string;
+    readonly size: string;
+    readonly mtimeNs: string;
+    readonly ctimeNs: string;
+    readonly sha256?: string;
+};
+export type NativePublishOutcome = {
+    readonly ok: boolean;
+    readonly code?: string;
+    readonly identity?: NativePublishIdentity;
+    readonly mutationState: NativePublishMutationState;
+    readonly durabilityState: NativePublishDurabilityState;
+    readonly reason: NativePublishReason;
+    readonly primitive: NativePublishPrimitive;
+    readonly phase: NativePublishPhase;
+    readonly diagnostic: PublishDiagnostic;
+};
+/**
+ * Treat incompatible native results as an unknown mutation; never infer safety from legacy fields.
+ * Retained descriptor operations have a stricter contract than direct rename: a reported success
+ * includes the terminal identity and all required durability evidence.
+ */
+export declare function classifyNativePublishOutcome(value: unknown, operation?: NativePublishOperation): NativePublishOutcome;
+/** Only a fully validated pre-mutation result permits exact cleanup of current staging. */
+export declare function mayCleanCurrentStaging(outcome: NativePublishOutcome): boolean;
+/** Stable, bounded text for startup errors. Native paths and messages are intentionally excluded. */
+export declare function formatNativePublishDiagnostic(outcome: NativePublishOutcome): string;
+export {};

package/dist/types/session/session-storage.d.ts

@@ -184,6 +184,18 @@ export interface VerifiedSessionDeleteTarget {
     detachedArtifactsPath?: string;
     /** Identity-bound quarantine path retained when transcript unlink deferred cleanup. */
     detachedTranscriptPath?: string;
+    /** Native-retained publisher successor observed during transcript cleanup. */
+    retainedTranscriptSuccessorPath?: string;
+    /** Native-retained exchange placeholder observed during transcript cleanup. */
+    retainedTranscriptPlaceholderPath?: string;
+    /** Native-retained transcript entry whose identity could not be verified. */
+    retainedTranscriptUnknownPath?: string;
+    /** Native-retained publisher successor observed during cleanup. */
+    retainedArtifactsSuccessorPath?: string;
+    /** Native-retained exchange placeholder observed during cleanup. */
+    retainedArtifactsPlaceholderPath?: string;
+    /** Native-retained entry whose identity could not be verified. */
+    retainedArtifactsUnknownPath?: string;
     /** Caller-published, no-replace quarantine pathname for the next artifact detach. */
     plannedArtifactsPath?: string;
     /** Caller-published, no-replace quarantine pathname for the next transcript detach. */
@@ -215,6 +227,9 @@ export type VerifiedSessionDeleteResult = {
     artifactsTree: NativeDirectoryTreeSnapshot;
     /** Transcript identity (unchanged) for retry binding. */
     transcriptIdentity: SessionStorageFileIdentity;
+    retainedSuccessorPath?: string;
+    retainedPlaceholderPath?: string;
+    retainedUnknownPath?: string;
 } | {
     kind: "cleanup_pending";
     phase: "transcript";
@@ -223,6 +238,9 @@ export type VerifiedSessionDeleteResult = {
     transcriptIdentity: SessionStorageFileIdentity;
     /** Optional identity-bound transcript quarantine path for restart cleanup. */
     detachedTranscriptPath?: string;
+    retainedSuccessorPath?: string;
+    retainedPlaceholderPath?: string;
+    retainedUnknownPath?: string;
 };
 type NativeDirectoryTreeEntry = {
     relativePath: string;

package/dist/types/task/index.d.ts

@@ -36,7 +36,9 @@ export declare class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskT
     get description(): string;
     private constructor();
     /**
-     * Create a TaskTool instance with async agent discovery.
+     * Create a TaskTool instance.
+     * Repository authority is captured from session cwd *before* agent discovery so
+     * multi-repo workspaces fail closed prior to context/discovery (#2901).
      */
     static create(session: ToolSession): Promise<TaskTool>;
     execute(_toolCallId: string, rawParams: unknown, signal?: AbortSignal, onUpdate?: AgentToolUpdateCallback<TaskToolDetails>): Promise<AgentToolResult<TaskToolDetails>>;

package/dist/types/task/receipt.d.ts

@@ -59,6 +59,8 @@ export interface TaskResultReceipt {
     extractedToolCounts?: Record<string, number>;
     forkContext?: SingleResult["forkContext"];
     forkContextAdvisory?: SingleResult["forkContextAdvisory"];
+    /** Resolved repository identity for this delegated lane (#2901). */
+    repositoryBinding?: SingleResult["repositoryBinding"];
     roi?: TaskRoi;
 }
 /**