@gajae-code/coding-agent 0.12.0 → 0.12.1

package/dist/types/extensibility/gjc-plugins/lifecycle.d.ts

@@ -0,0 +1,64 @@
+import type { GjcBundleIdentity, GjcBundleSummary, GjcInstallResult, GjcLifecycleResult, GjcPluginRegistryEntry, GjcPluginRegistrySource, GjcPluginScope, GjcReviewedUpdateToken, GjcToggleResult, GjcUpdateApplyResult, GjcUpdatePreview } from "./types";
+/**
+ * GJC bundle lifecycle service.
+ *
+ * This module is the ONLY policy and persistence writer for GJC bundles: fresh
+ * install, update preview/apply, bundle enable/disable, and surface
+ * enable/disable. Callers (CLI, Settings) never touch the registry writers or
+ * the installer transaction directly.
+ */
+export interface GjcLifecycleContext {
+    cwd: string;
+}
+export declare function redactSourceLocator(source: GjcPluginRegistrySource): string;
+/** Safe, redacted DTO for one installed bundle. */
+export declare function toBundleSummary(entry: GjcPluginRegistryEntry): GjcBundleSummary;
+/**
+ * Rebuild the exact locator an update must re-resolve from. A git ref is stored
+ * separately from the URI, so re-resolving the bare URI would silently drop the
+ * reviewed branch or tag and update from the default branch instead.
+ */
+declare function storedSourceLocator(source: GjcPluginRegistrySource): string;
+/** Exposed for locator-reconstruction tests; not part of the lifecycle API. */
+export declare const storedSourceLocatorForTest: typeof storedSourceLocator;
+/** Exposed so a test can pin parity with the installer's source predicates. */
+export declare const isLocalDirectorySourceForTest: typeof isLocalDirectorySource;
+/** All installed bundles across both scopes, deterministically ordered. */
+export declare function listGjcBundles(ctx: GjcLifecycleContext): Promise<GjcBundleSummary[]>;
+/** One bundle by exact (scope, name) identity. Opposite scope never matches. */
+export declare function getGjcBundle(ctx: GjcLifecycleContext, identity: GjcBundleIdentity): Promise<GjcLifecycleResult<GjcBundleSummary>>;
+/**
+ * True only for strings the installer would treat as a local path rather than
+ * a remote locator. This deliberately mirrors the installer's own `looksLikeGit`
+ * predicate: if the two ever disagreed, a remote locator could be read as a
+ * relative path and shadowed by a local directory of the same shape.
+ */
+declare function isLocalDirectorySource(source: string): boolean;
+/**
+ * Fresh install only. An existing target in the same scope is create-only and
+ * is refused identically with or without force; upgrading is a separate,
+ * scope-qualified operation.
+ */
+export declare function installGjcBundle(ctx: GjcLifecycleContext, scope: GjcPluginScope, source: string): Promise<GjcLifecycleResult<GjcInstallResult>>;
+/**
+ * Re-resolve the stored source descriptor and describe what an update would do.
+ * The returned token binds the candidate, the exact installed baseline, and the
+ * deterministic decision context; apply is a compare-and-swap on all three.
+ */
+export declare function previewGjcBundleUpdate(ctx: GjcLifecycleContext, identity: GjcBundleIdentity): Promise<GjcLifecycleResult<GjcUpdatePreview>>;
+/**
+ * Apply a previously reviewed update. Any drift in the candidate bytes, the
+ * installed baseline, or the decision context returns a typed stale error with
+ * zero mutation.
+ */
+export declare function applyGjcBundleUpdate(ctx: GjcLifecycleContext, token: GjcReviewedUpdateToken): Promise<GjcLifecycleResult<GjcUpdateApplyResult>>;
+/**
+ * Enable or disable a whole bundle. Deterministic quarantine blocks enabling;
+ * disabling is always allowed so operators can always de-escalate.
+ */
+export declare function setGjcBundleEnabled(ctx: GjcLifecycleContext, identity: GjcBundleIdentity, enabled: boolean): Promise<GjcLifecycleResult<GjcToggleResult>>;
+/** Enable or disable one surface of a bundle by its stable extension ID. */
+export declare function setGjcBundleSurfaceEnabled(ctx: GjcLifecycleContext, identity: GjcBundleIdentity, surfaceId: string, enabled: boolean): Promise<GjcLifecycleResult<GjcToggleResult>>;
+/** Deterministic activation generation for the current persisted state. */
+export declare function currentActivationFingerprint(ctx: GjcLifecycleContext): Promise<string>;
+export {};

package/dist/types/extensibility/gjc-plugins/runtime-quarantine.d.ts

@@ -0,0 +1,67 @@
+import type { GjcBundleIdentity, GjcRuntimeFinding, GjcRuntimeSnapshot, GjcRuntimeSnapshotState } from "./types";
+/**
+ * Deterministic numeric activation generation for an activation fingerprint.
+ *
+ * Equal activation inputs yield an equal generation, so a consumer holding a
+ * snapshot can tell whether it still describes the state it is rendering.
+ * Derived from the fingerprint's leading hex so it stays inside the safe
+ * integer range.
+ */
+export declare function gjcActivationGenerationFor(activationFingerprint: string): number;
+/**
+ * Caller-owned accumulator for scope-qualified runtime evidence.
+ *
+ * Producers (loaders, adapters, validators) hand findings to an accumulator
+ * they were given; they never publish. Exactly one coordinator publishes a
+ * complete generation snapshot, and consumers merge it only when the identity
+ * and generation match.
+ */
+export declare class GjcRuntimeFindingAccumulator {
+    readonly generation: number;
+    private readonly findings;
+    constructor(generation: number);
+    add(finding: GjcRuntimeFinding): void;
+    addAll(findings: readonly GjcRuntimeFinding[]): void;
+    /** Sorted, de-duplicated snapshot for the generation this accumulator owns. */
+    snapshot(): GjcRuntimeSnapshot;
+}
+/** Read-only view of the most recently published complete generation. */
+export interface GjcRuntimeSnapshotProvider {
+    current(): GjcRuntimeSnapshotState;
+}
+/**
+ * Single-writer publisher for runtime evidence.
+ *
+ * Passes can overlap: the session's prompt rebuild is re-entrant, so a second
+ * pass may start while a first is still awaiting its producers. Publication is
+ * therefore fenced by a monotonic epoch. A pass reserves an epoch when it
+ * begins, which immediately retires whatever was published before, and its
+ * later publish is accepted only if no newer pass has reserved since. A slow or
+ * failed older pass can never overwrite a newer one, and an incomplete pass
+ * simply never publishes, leaving consumers at `unavailable`.
+ */
+export declare class GjcRuntimeSnapshotStore implements GjcRuntimeSnapshotProvider {
+    private state;
+    private epoch;
+    /**
+     * Begin a pass. Retires the current snapshot and returns the epoch token the
+     * caller must present to publish.
+     */
+    beginPass(): number;
+    /** Publish only if `epoch` is still the newest reserved pass. */
+    publish(snapshot: GjcRuntimeSnapshot, epoch?: number): void;
+    invalidate(): void;
+    current(): GjcRuntimeSnapshotState;
+}
+/**
+ * Findings for one bundle, but only when the snapshot is current AND describes
+ * the exact generation the consumer is rendering. Missing provider, mismatched
+ * generation, or unavailable state resolve to `unavailable` — never to a
+ * silently empty "clear" result.
+ */
+export declare function findingsForBundle(provider: GjcRuntimeSnapshotProvider | undefined, identity: GjcBundleIdentity, expectedGeneration: number): {
+    status: "unavailable";
+} | {
+    status: "current";
+    findings: GjcRuntimeFinding[];
+};

package/dist/types/extensibility/gjc-plugins/session-validation.d.ts

@@ -1,4 +1,4 @@
-import type { GjcPluginLoadErrorCode, GjcPluginRegistryEntry } from "./types";
+import type { GjcBundleIdentity, GjcPluginLoadErrorCode, GjcPluginRegistryEntry } from "./types";
 /**
  * Session-start validation: the registry is the collision authority. Capability
  * provider output is supplied as EVIDENCE only; plugin surfaces are never
@@ -16,6 +16,8 @@ export interface SessionCapabilityEvidence {
     appendixIds?: Iterable<string>;
 }
 export interface SessionQuarantine {
+    /** Scope-qualified canonical target this finding belongs to. */
+    identity: GjcBundleIdentity;
     plugin: string;
     surfaceId: string;
     code: GjcPluginLoadErrorCode;

package/dist/types/extensibility/gjc-plugins/types.d.ts

@@ -218,3 +218,127 @@ export interface GjcPluginRegistry {
  * disabledSurfaceIds, and quarantine bookkeeping.
  */
 export type GjcPluginSurfaceExtensionId = string;
+/** Canonical GJC bundle identity: kind is fixed, target is (scope, name). */
+export declare const GJC_BUNDLE_KIND = "gjc-bundle";
+export interface GjcBundleIdentity {
+    kind: typeof GJC_BUNDLE_KIND;
+    scope: GjcPluginScope;
+    name: string;
+}
+/** Source descriptor exposed to CLI/Settings: never carries raw locator secrets. */
+export interface GjcBundleSafeSource {
+    kind: GjcPluginSourceKind;
+    /** Redacted display locator (host + path only; no userinfo/query/fragment). */
+    display: string;
+    /** Conservative safe git ref, omitted when the stored value is unsafe. */
+    ref?: string;
+    /** Hex-only revision identifier, omitted when the stored value is unsafe. */
+    sha?: string;
+    resolvedAt: string;
+    /** True when this source kind supports re-resolution during update. */
+    updatable: boolean;
+    /** Present only when updatable is false. */
+    unsupportedReason?: string;
+}
+export interface GjcBundleSurfaceSummary {
+    extensionId: string;
+    kind: "tool" | "hook" | "mcp" | "system-appendix" | "agent-appendix" | "subskill";
+    name: string;
+    /** Persisted user intent (registry disabledSurfaceIds). */
+    enabled: boolean;
+    /** Deterministic quarantine derived from persisted registry state only. */
+    quarantined: boolean;
+    quarantineCode?: GjcPluginLoadErrorCode;
+}
+/** Installed-bundle DTO shared by CLI and Settings. Contains no raw locators. */
+export interface GjcBundleSummary {
+    identity: GjcBundleIdentity;
+    version: string;
+    description?: string;
+    enabled: boolean;
+    source: GjcBundleSafeSource;
+    installedAt: string;
+    updatedAt: string;
+    manifestHash: string;
+    /** Deterministic fingerprint of the exact installed target. */
+    targetFingerprint: string;
+    surfaces: GjcBundleSurfaceSummary[];
+    /** True when any deterministic quarantine blocks enablement. */
+    quarantined: boolean;
+}
+/**
+ * Host-derived token binding an update preview to the exact candidate, the
+ * exact installed baseline, and the deterministic decision context. Apply is a
+ * compare-and-swap against all three fingerprints.
+ */
+export interface GjcReviewedUpdateToken {
+    identity: GjcBundleIdentity;
+    candidateFingerprint: string;
+    baselineFingerprint: string;
+    decisionContextFingerprint: string;
+    reviewedAt: string;
+}
+export type GjcLifecycleErrorCode = "already_installed_use_upgrade" | "not_installed" | "identity_mismatch" | "stale_candidate" | "stale_baseline" | "stale_decision_context" | "source_unsupported" | "source_unavailable" | "quarantined" | "surface_unknown" | "invalid_target";
+export interface GjcLifecycleError {
+    code: GjcLifecycleErrorCode;
+    /** Sanitized operator-facing message; never contains raw locators or causes. */
+    message: string;
+    /** Safe scoped recovery hint (e.g. the exact command to run instead). */
+    recovery?: string;
+}
+export type GjcLifecycleResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: GjcLifecycleError;
+};
+export interface GjcUpdatePreview {
+    identity: GjcBundleIdentity;
+    current: GjcBundleSummary;
+    candidateVersion: string;
+    candidateManifestHash: string;
+    /** Surface IDs added, removed, or retained by this candidate. */
+    addedSurfaceIds: string[];
+    removedSurfaceIds: string[];
+    retainedSurfaceIds: string[];
+    changed: boolean;
+    token: GjcReviewedUpdateToken;
+}
+export type GjcUpdateApplyStatus = "updated" | "unchanged";
+export interface GjcUpdateApplyResult {
+    status: GjcUpdateApplyStatus;
+    summary: GjcBundleSummary;
+    /** Number of filesystem remnants that could not be removed after a successful swap. */
+    remnantCount: number;
+}
+export interface GjcInstallResult {
+    status: "installed";
+    summary: GjcBundleSummary;
+}
+export interface GjcToggleResult {
+    summary: GjcBundleSummary;
+    /** False when the requested state already matched (no persisted mutation). */
+    mutated: boolean;
+}
+/**
+ * Scope-qualified runtime evidence emitted by producers. Producers never
+ * publish; the session coordinator accumulates one complete generation.
+ */
+export interface GjcRuntimeFinding {
+    identity: GjcBundleIdentity;
+    surfaceId: string;
+    code: GjcPluginLoadErrorCode;
+    message: string;
+}
+export interface GjcRuntimeSnapshot {
+    /** Monotonic activation generation this snapshot describes. */
+    generation: number;
+    findings: GjcRuntimeFinding[];
+}
+export type GjcRuntimeSnapshotState = {
+    status: "unavailable";
+} | {
+    status: "current";
+    snapshot: GjcRuntimeSnapshot;
+};

package/dist/types/gjc-runtime/launch-tmux.d.ts

@@ -87,6 +87,7 @@ export interface TmuxLaunchPlan {
     createdServerIdentity?: {
         pid: number;
         startTime: string;
+        pidProven?: boolean;
     };
     isPsmux: boolean;
     platform: NodeJS.Platform;

package/dist/types/gjc-runtime/ralplan-runtime.d.ts

@@ -33,6 +33,13 @@ export declare const PLANNING_STUCK_MARKER = "PLANNING-STUCK";
 export declare const RALPLAN_DEFAULT_MAX_REVIEW_PASSES_PER_LANE = 1;
 /** Inclusive upper bound for `gjc.ralplan.maxReviewPassesPerLane` settings overrides. */
 export declare const RALPLAN_MAX_REVIEW_PASSES_PER_LANE_LIMIT = 10;
+export type RalplanAutoHandoffTarget = "off" | "ultragoal" | "team";
+export interface RalplanAutoHandoffResolution {
+    configuredTarget: RalplanAutoHandoffTarget;
+    effectiveTarget: RalplanAutoHandoffTarget;
+    degradationReason: string | null;
+    source: string;
+}
 export type RalplanIterationCapDecision = {
     allowed: true;
     currentIterations: number;
@@ -128,6 +135,16 @@ export declare function resolveRalplanMaxIterations(cwd: string): Promise<{
     maxIterations: number;
     source: string;
 }>;
+type RalplanAutoHandoffOptions = {
+    planningStuck?: boolean;
+    teamAvailabilityProbe?: () => {
+        available: true;
+    } | {
+        available: false;
+        reason: string;
+    };
+};
+export declare function resolveRalplanAutoHandoff(cwd: string, options?: RalplanAutoHandoffOptions): Promise<RalplanAutoHandoffResolution>;
 /** Resolve the per-lane review-pass budget with project-over-user precedence. */
 export declare function resolveRalplanMaxReviewPassesPerLane(cwd: string): Promise<{
     maxReviewPassesPerLane: number;
@@ -135,3 +152,4 @@ export declare function resolveRalplanMaxReviewPassesPerLane(cwd: string): Promi
 }>;
 export declare function isRalplanArtifactWriteInvocation(args: readonly string[]): boolean;
 export declare function runNativeRalplanCommand(args: string[], cwd?: string): Promise<RalplanCommandResult>;
+export {};

package/dist/types/gjc-runtime/team-launch.d.ts

@@ -2,7 +2,7 @@ import type { GjcTeamConfig, GjcTeamSnapshot, GjcTeamStartOptions, GjcTeamTask,
 /** Launch-specific option wiring kept separate from runtime dispatch. */
 export declare function withTeamLaunchTransport(options: GjcTeamStartOptions, mailboxDeliveryTransport: GjcTeamStartOptions["mailboxDeliveryTransport"]): GjcTeamStartOptions;
 /** @internal Exported for unit tests. */
-export declare function buildWorkerCommand(config: GjcTeamConfig, worker: GjcTeamWorker, platform?: NodeJS.Platform, promptOverride?: string): string;
+export declare function buildWorkerCommand(config: GjcTeamConfig, worker: GjcTeamWorker, platform?: NodeJS.Platform, promptOverride?: string, env?: NodeJS.ProcessEnv): string;
 interface GjcTmuxBinary {
     command: string;
     isPsmux: boolean;

package/dist/types/gjc-runtime/team-runtime.d.ts

@@ -201,6 +201,13 @@ export interface GjcWorkerIntegrationAttemptOptions {
     signal?: AbortSignal;
 }
 export declare const GJC_TEAM_API_OPERATIONS: readonly ["send-message", "broadcast", "mailbox-list", "mailbox-mark-delivered", "mailbox-mark-notified", "notification-list", "notification-read", "notification-replay", "notification-mark-pane-attempt", "worker-startup-ack", "create-task", "read-task", "list-tasks", "update-task", "claim-task", "transition-task-status", "transition-task", "release-task-claim", "read-config", "read-manifest", "read-worker-status", "update-worker-status", "read-worker-heartbeat", "recover-stale-claims", "update-worker-heartbeat", "read-worker-memory-guard", "update-worker-memory-guard", "apply-worker-memory-guard", "write-worker-inbox", "write-worker-identity", "append-event", "read-events", "read-traces", "await-event", "write-shutdown-request", "read-shutdown-ack", "read-monitor-snapshot", "write-monitor-snapshot", "read-task-approval", "write-task-approval"];
+export type GjcTeamApiOperation = (typeof GJC_TEAM_API_OPERATIONS)[number];
+export declare class UnknownGjcTeamApiOperationError extends Error {
+    readonly code = "unknown_team_api_operation";
+    readonly operation: string;
+    readonly suggestions: readonly string[];
+    constructor(operation: string, suggestions: readonly string[]);
+}
 export interface GjcTeamRuntimeTestSeams {
     nowMs?: () => number;
     continuationTmuxDispatch?: (command: string, args: readonly string[]) => {
@@ -225,6 +232,16 @@ export declare function resolveWorkerWorktreePath(input: {
     platform: NodeJS.Platform;
     isPsmux: boolean;
 }): string;
+/**
+ * Check whether the current process can launch a team without changing tmux state.
+ * Unlike the launch path, this never adopts or tags an unmanaged tmux session.
+ */
+export declare function probeGjcTeamAvailability(env?: NodeJS.ProcessEnv): {
+    available: true;
+} | {
+    available: false;
+    reason: string;
+};
 export declare function resolveGjcWorkerCommand(cwd?: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, argv?: string[], execPath?: string): string;
 export { buildWorkerCommand } from "./team-launch";
 export type GjcWorkerCheckpointClassification = {
@@ -257,6 +274,8 @@ export declare function requestGjcWorkerIntegrationAttempt(cwd?: string, env?: N
 export declare function buildTeamHudSummary(snapshot: GjcTeamSnapshot, latestEvent?: GjcTeamEvent, latestMessage?: GjcTeamMailboxMessage): Promise<WorkflowHudSummary>;
 export declare function monitorGjcTeam(teamName: string, cwd?: string, env?: NodeJS.ProcessEnv): Promise<GjcTeamSnapshot>;
 export declare function listGjcTeams(cwd?: string, env?: NodeJS.ProcessEnv): Promise<GjcTeamSnapshot[]>;
+/** Positive stale windows are clamped so a worker can publish strictly before expiry. */
+export declare function parseHeartbeatStaleMs(env: NodeJS.ProcessEnv): number;
 export declare function shutdownGjcTeam(teamName: string, cwd?: string, env?: NodeJS.ProcessEnv): Promise<GjcTeamSnapshot>;
 export declare function listGjcTeamTasks(teamName: string, cwd?: string, env?: NodeJS.ProcessEnv): Promise<GjcTeamTask[]>;
 export declare function readGjcTeamTask(teamName: string, taskId: string, cwd?: string, env?: NodeJS.ProcessEnv): Promise<GjcTeamTask>;
@@ -278,6 +297,12 @@ export declare const readGjcWorkerStatus: (teamName: string, worker: string, cwd
 export declare function updateGjcWorkerStatus(teamName: string, worker: string, status: GjcWorkerStatusState, cwd?: string, env?: NodeJS.ProcessEnv, currentTaskId?: string, reason?: string): Promise<WorkerStatusFile>;
 export declare const readGjcWorkerHeartbeat: (teamName: string, worker: string, cwd?: string, env?: NodeJS.ProcessEnv) => Promise<WorkerHeartbeatFile | null>;
 export declare function updateGjcWorkerHeartbeat(teamName: string, worker: string, heartbeat: WorkerHeartbeatFile, cwd?: string, env?: NodeJS.ProcessEnv): Promise<WorkerHeartbeatFile>;
+/**
+ * Refresh liveness without discarding metadata written by other heartbeat
+ * producers. The read/merge/write sequence shares the team mutation fence with
+ * CLI heartbeat updates, so a runtime tick cannot overwrite a newer turn count.
+ */
+export declare function refreshGjcWorkerHeartbeat(teamName: string, worker: string, pid: number, cwd?: string, env?: NodeJS.ProcessEnv): Promise<WorkerHeartbeatFile>;
 export declare function writeGjcWorkerInbox(teamName: string, worker: string, content: string, cwd?: string, env?: NodeJS.ProcessEnv): Promise<{
     path: string;
 }>;

package/dist/types/gjc-runtime/team-worker-heartbeat.d.ts

@@ -0,0 +1,43 @@
+import { type WorkerHeartbeatFile } from "./team-runtime";
+export interface GjcTeamWorkerIdentity {
+    teamName: string;
+    workerId: string;
+}
+/** Resolves the team identity injected into a worker pane by `gjc team` startup. */
+export declare function resolveGjcTeamWorkerIdentity(env?: NodeJS.ProcessEnv): GjcTeamWorkerIdentity | undefined;
+/** Refresh cadence derived from the leader's stale window; `0` disables publishing. */
+export declare function resolveGjcTeamWorkerHeartbeatIntervalMs(env?: NodeJS.ProcessEnv): number;
+/**
+ * Publish one runtime-owned heartbeat for the worker this process is running as.
+ * Returns `undefined` when the process is not a team worker.
+ *
+ * `turn_count` and process-incarnation metadata are merged under the same
+ * mutation fence used by CLI heartbeat updates.
+ */
+export declare function writeGjcTeamWorkerRuntimeHeartbeat(cwd?: string, env?: NodeJS.ProcessEnv): Promise<WorkerHeartbeatFile | undefined>;
+export interface GjcTeamWorkerHeartbeatReporterOptions {
+    write: () => Promise<void>;
+    intervalMs: number;
+}
+/**
+ * Publishes a worker heartbeat while a turn is in flight.
+ *
+ * Writes never overlap; a slow or failing write is logged and skipped rather
+ * than queued, because only the most recent record matters. The timer is
+ * unreferenced so it can never hold the process open.
+ */
+export declare class GjcTeamWorkerHeartbeatReporter {
+    #private;
+    constructor(options: GjcTeamWorkerHeartbeatReporterOptions);
+    /** Reporter for the current process, or `undefined` when it is not a team worker. */
+    static forProcess(cwd: () => string, env?: NodeJS.ProcessEnv): GjcTeamWorkerHeartbeatReporter | undefined;
+    get isRunning(): boolean;
+    /** Publish immediately, then keep publishing until {@link stop} or {@link dispose}. */
+    start(): void;
+    /** Stop periodic publishing after one final record, so the idle stamp is fresh. */
+    stop(): void;
+    /** Await the write in flight, if any. */
+    flush(): Promise<void>;
+    /** Permanently stop publishing. Idempotent. */
+    dispose(): void;
+}

package/dist/types/gjc-runtime/tmux-owner-isolation.d.ts

@@ -31,6 +31,16 @@ export interface TmuxServerProof {
     startTime?: string;
     cgroup?: CgroupInfo;
     sessionNames?: string[];
+    /**
+     * Whether `pid` is kernel-proved evidence about the live tmux server.
+     *
+     * Only Linux can prove a server PID (`/proc` + cgroup classification), so
+     * probes on other platforms may report a placeholder PID with this flag set
+     * to `false`. Guards must not build a `#{pid}` predicate from an unproven
+     * PID: no live tmux server can ever satisfy it. Omitted means proven, which
+     * keeps every probe that reads a real `#{pid}` unchanged.
+     */
+    pidProven?: boolean;
 }
 export interface PlanRequest {
     schema_version: 1;

package/dist/types/gjc-runtime/ultragoal-runtime.d.ts

@@ -5,37 +5,6 @@ export { CRITIC_GATE_HARD_STOP_EVENT, CRITIC_GATE_OVERRIDE_EVENT, CRITIC_VERDICT
 export { captureUltragoalRecoverySnapshot, parseStrictTerminalTranscript, persistUltragoalRecoveryDecision, planUltragoalOwnerLossRecovery, type UltragoalOwnerLossReceipt, type UltragoalRecoveryBinding, type UltragoalRecoveryDecision, type UltragoalRecoverySnapshot, validateOwnerLossBinding, validateRawUltragoalEvidence, validateRecoveryAdmission, validateRecoveryPath, } from "./ultragoal-owner-loss-recovery";
 export type UltragoalGjcGoalMode = "aggregate" | "per-story";
 export type UltragoalGoalStatus = "pending" | "active" | "complete" | "failed" | "blocked" | "review_blocked" | "superseded";
-export type UltragoalPipelineMetadataSource = "original_plan_graph" | "legacy_brief_only" | "steering";
-export type UltragoalPipelineOverlapState = "none" | "open" | "joined_clean" | "blocked_disjoint_continue" | "quarantine_required" | "rebaseline_complete";
-export interface UltragoalPipelineTargets extends JsonObject {
-    files: string[];
-    surfaces: string[];
-}
-export interface UltragoalPipelineMetadata extends JsonObject {
-    schemaVersion: 1;
-    goalId: string;
-    source: UltragoalPipelineMetadataSource;
-    eligible: boolean;
-    dependsOn: string[];
-    independentOf: string[];
-    targets: UltragoalPipelineTargets;
-    metadataHash: string;
-    overlap: UltragoalPipelineOverlapState;
-    overlapId?: string;
-    priorGoalId?: string;
-    nextGoalId?: string;
-    blockerFootprints?: UltragoalPipelineTargets[];
-    invalidationReason?: string;
-    invalidatedAt?: string;
-}
-export interface UltragoalGoalMetadataInput {
-    schemaVersion: 1;
-    goalId: string;
-    source: UltragoalPipelineMetadataSource;
-    dependsOn?: string[];
-    independentOf?: string[];
-    targets?: Partial<UltragoalPipelineTargets>;
-}
 export interface UltragoalValidationBatchMetadata extends JsonObject {
     schemaVersion: 1;
     batchId: string;
@@ -50,31 +19,6 @@ export interface UltragoalValidationBatchInput {
     memberIds: string[];
     finalGoalId: string;
 }
-export interface UltragoalPipelineOverlapHandles extends JsonObject {
-    review: JsonObject;
-    qa: JsonObject;
-    implementation: JsonObject;
-}
-export interface UltragoalPipelineOverlapReceipt extends JsonObject {
-    ok: true;
-    event: string;
-    overlap_id: string;
-    prior_goal_id: string;
-    next_goal_id?: string;
-    goal_id?: string;
-    status?: UltragoalPipelineOverlapState;
-    next_goal_status?: UltragoalGoalStatus;
-    goals_path: string;
-    ledger_path: string;
-}
-export type UltragoalPipelineLedgerEventName = "pipeline_overlap_started" | "pipeline_overlap_joined" | "pipeline_overlap_blocked" | "pipeline_overlap_quarantined" | "pipeline_overlap_rebaselined";
-export interface UltragoalPipelineLedgerEvent extends UltragoalLedgerEvent {
-    event: UltragoalPipelineLedgerEventName;
-    schemaVersion: 1;
-    overlapId: string;
-    priorGoalId: string;
-    nextGoalId: string;
-}
 export interface UltragoalGoal {
     id: string;
     title: string;
@@ -87,7 +31,6 @@ export interface UltragoalGoal {
     evidence?: string;
     steering?: Record<string, unknown>;
     completionVerification?: UltragoalCompletionVerification;
-    pipelineMetadata?: UltragoalPipelineMetadata;
     validationBatch?: UltragoalValidationBatchMetadata;
 }
 export interface UltragoalPlan {
@@ -204,7 +147,6 @@ export interface UltragoalStatusSummary {
     nudgeRemaining?: number;
     nudgeGoalId?: string;
     nudgeTargetKind?: UltragoalNudgeTargetKind;
-    pipelineOverlap?: JsonObject;
 }
 export interface UltragoalCommandResult {
     reviewBlockerGoalIds?: string[];
@@ -267,22 +209,6 @@ export declare function recordUltragoalNudgeIfBudgetRemaining(input: {
 export declare function writePlan(cwd: string, plan: UltragoalPlan, sessionId?: string | null): Promise<void>;
 export declare function nonEmptyString(value: unknown): string | null;
 export declare function stringArray(value: unknown): string[] | null;
-export declare function hashPipelineMetadata(metadata: Omit<UltragoalPipelineMetadata, "metadataHash">): string;
-export declare function validateValidationBatchPipelineExclusion(goal: UltragoalGoal): void;
-export declare function targetsAreDisjoint(left: UltragoalPipelineTargets, right: UltragoalPipelineTargets): boolean;
-export declare function targetsOverlap(left: UltragoalPipelineTargets, right: UltragoalPipelineTargets): boolean;
-export declare function requireNonEmptyPipelineTargets(value: unknown, fieldName: string): UltragoalPipelineTargets;
-export declare function collectPipelineBlockerFootprints(result: JsonObject, fieldName: string): UltragoalPipelineTargets[];
-export declare function pipelinePeer(plan: UltragoalPlan, metadata: UltragoalPipelineMetadata): UltragoalGoal | undefined;
-export declare function handleIdsFromValue(value: JsonObject | JsonObject[], fieldName: string): string[];
-export declare function resultHandleIds(value: JsonObject, fieldName: string): string[];
-export declare function requireCoveredHandles(expected: readonly string[], actual: readonly string[], fieldName: string): void;
-export declare function requireFreshPipelineMetadata(goal: UltragoalGoal): UltragoalPipelineMetadata;
-export declare function openPipelineOverlap(plan: UltragoalPlan): {
-    prior: UltragoalGoal;
-    next: UltragoalGoal;
-    overlapId: string;
-} | null;
 export declare function readUltragoalPlan(cwd: string, sessionId?: string | null): Promise<UltragoalPlan | null>;
 export declare function getUltragoalStatus(cwd: string, sessionId?: string | null): Promise<UltragoalStatusSummary>;
 export declare function buildUltragoalHudSummary(summary: UltragoalStatusSummary, latestLedger?: UltragoalLedgerEvent): WorkflowHudSummary;
@@ -291,8 +217,6 @@ export declare function createUltragoalPlan(input: {
     brief: string;
     gjcGoalMode?: UltragoalGjcGoalMode;
     sessionId?: string | null;
-    goalMetadata?: UltragoalGoalMetadataInput[];
-    goalMetadataJson?: string;
     validationBatches?: UltragoalValidationBatchInput[];
     validationBatchJson?: string;
 }): Promise<UltragoalPlan>;
@@ -304,10 +228,6 @@ export interface UltragoalRunCompletionState {
     hasBlockers: boolean;
     needsFinalAggregateReceipt: boolean;
 }
-export declare function requireJsonObjectValue(value: unknown, fieldName: string): JsonObject;
-export declare function requireJsonObjectOrArrayValue(value: unknown, fieldName: string): JsonObject | JsonObject[];
-import { joinUltragoalPipelineOverlap, rebaselineUltragoalPipelineOverlap, startUltragoalPipelineOverlap } from "./ultragoal-pipeline";
-export { joinUltragoalPipelineOverlap, rebaselineUltragoalPipelineOverlap, startUltragoalPipelineOverlap };
 export declare function getUltragoalRunCompletionState(plan: UltragoalPlan, options?: {
     retryFailed?: boolean;
 }): UltragoalRunCompletionState;
@@ -343,6 +263,22 @@ export declare function startNextUltragoalGoal(input: {
 }>;
 export declare function qualityGateObject(value: unknown): JsonObject | null;
 export declare function nonEmptyStringArray(value: unknown): string[] | null;
+export interface UltragoalQualityGateDiagnostic {
+    path: string;
+    code: string;
+    message: string;
+}
+/**
+ * Collects every quality-gate defect in one pass instead of throwing on the first.
+ * Authoring a valid gate is otherwise an edit/retry loop at the most expensive phase
+ * of a run (#3474). The aggregate error message keeps each individual message verbatim
+ * so existing callers and assertions that match on a single message still work, and
+ * `diagnostics` carries the machine-readable stable `path` + `code` pairs.
+ */
+export declare class UltragoalQualityGateError extends Error {
+    readonly diagnostics: readonly UltragoalQualityGateDiagnostic[];
+    constructor(diagnostics: readonly UltragoalQualityGateDiagnostic[]);
+}
 export declare function requireQualityGateObject(value: unknown, fieldName: string): JsonObject;
 export declare function requireObjectArray(value: unknown, fieldName: string): JsonObject[];
 export declare function requiredStringField(row: JsonObject, key: string, fieldName: string): string;
@@ -386,6 +322,21 @@ export declare function validateExecutorQaRedTeamEvidenceForReview(cwd: string,
     mode?: "review";
     changeSet?: UltragoalChangeSet;
 }): Promise<void>;
+/**
+ * Read-only quality-gate validation (#3474). Applies exactly the same rules as
+ * `checkpoint --status complete` — including deferred-vs-boundary gate selection and
+ * artifact existence checks — but never touches `goals.json`, `ledger.jsonl`, or goal
+ * state, and reports every diagnostic in one run instead of the first failure.
+ */
+export declare function validateUltragoalQualityGateReadOnly(input: {
+    cwd: string;
+    qualityGateJson: string;
+    goalId?: string;
+    sessionId?: string | null;
+}): Promise<{
+    valid: boolean;
+    errors: readonly UltragoalQualityGateDiagnostic[];
+}>;
 export declare function checkpointUltragoalGoal(input: {
     cwd: string;
     goalId: string;

package/dist/types/modes/acp/acp-agent.d.ts

@@ -1,5 +1,5 @@
 import { type Agent, type AgentSideConnection, type AuthenticateRequest, type AuthenticateResponse, type AvailableCommand, type ClientCapabilities, type CloseSessionRequest, type CloseSessionResponse, type DeleteSessionRequest, type DeleteSessionResponse, type ForkSessionRequest, type ForkSessionResponse, type InitializeRequest, type InitializeResponse, type ListSessionsRequest, type ListSessionsResponse, type LoadSessionRequest, type LoadSessionResponse, type NewSessionRequest, type NewSessionResponse, type PromptRequest, type PromptResponse, type ResumeSessionRequest, type ResumeSessionResponse, type SetSessionConfigOptionRequest, type SetSessionConfigOptionResponse, type SetSessionModeRequest, type SetSessionModeResponse } from "@agentclientprotocol/sdk";
-import { type AcpProviderRegistration, AcpSdkAdapter } from "../../sdk/acp";
+import { type AcpProviderRegistration, type AcpReverseConnection, AcpSdkAdapter } from "../../sdk/acp";
 import type { AcpStartupOptions } from "./startup-options";
 export declare const ACP_BOOTSTRAP_RACE_GUARD_MS = 50;
 type JsonObject = Record<string, unknown>;
@@ -205,28 +205,11 @@ export declare function acpPromptPayload(blocks: PromptRequest["prompt"]): {
 export declare function acpRequestFailure(error: unknown): unknown;
 /** Registers a permission provider only when the ACP client requires prompts. */
 export declare function acpProviderRegistrations(capabilities: ClientCapabilities | undefined, env?: NodeJS.ProcessEnv): AcpProviderRegistration[];
+export declare function createAcpReverseConnection(connection: AgentSideConnection, sessionId: string): AcpReverseConnection;
 /** Maps ACP permission handling to the session's canonical SDK policy. */
 export declare function applyAcpPermissionMode(adapter: Pick<AcpSdkAdapter, "control">, capabilities: ClientCapabilities | undefined, env?: NodeJS.ProcessEnv): Promise<void>;
 /** Applies CLI-provided ACP startup settings through SDK controls before session exposure. */
 export declare function applyAcpStartupOptions(adapter: Pick<AcpSdkAdapter, "setModel" | "control">, options: AcpStartupOptions | undefined): Promise<void>;
-/** ACP form elicitation uses the client-facing reverse surface without owning a session runtime. */
-export declare function createAcpExtensionUiContext(connection: AgentSideConnection, getSessionId: () => string, capabilities: ClientCapabilities | undefined): {
-    select: (message: string, options: string[], dialog?: {
-        signal?: AbortSignal;
-        timeout?: number;
-        onTimeout?: () => void;
-    }) => Promise<string | undefined>;
-    confirm: (message: string, detail?: string, dialog?: {
-        signal?: AbortSignal;
-        timeout?: number;
-        onTimeout?: () => void;
-    }) => Promise<boolean>;
-    input: (message: string, placeholder?: string, dialog?: {
-        signal?: AbortSignal;
-        timeout?: number;
-        onTimeout?: () => void;
-    }) => Promise<string | undefined>;
-};
 /**
  * ACP is a pure SDK client. Session processes are created and resumed by the
  * broker, while all per-session operations use that session's authenticated SDK