@gajae-code/coding-agent 0.12.11 → 0.12.13

package/dist/types/main.d.ts

@@ -16,7 +16,7 @@ import type { PrintModeOptions } from "./modes/print-mode";
 import { initTheme } from "./modes/theme/theme";
 import type { SubmittedUserInput } from "./modes/types";
 import type { MCPManager } from "./runtime-mcp";
-import { type CreateAgentSessionOptions, createAgentSession, discoverAuthStorage } from "./sdk";
+import { type CreateAgentSessionOptions, type CreateAgentSessionResult, createAgentSession, discoverAuthStorage } from "./sdk";
 import type { AgentSession } from "./session/agent-session";
 import { type ResumeSessionIdentity, type SessionDestination, type SessionDirectoryMigrationPolicy, type SessionInfo, SessionManager, type StrictSessionOpenResult } from "./session/session-manager";
 import { runStartupCredentialAutoImportIfNeeded } from "./setup/credential-auto-import";
@@ -55,6 +55,7 @@ type StartupModelProfileArgs = {
     parsedArgs: Pick<Args, "default" | "model" | "mpreset" | "thinking">;
     startupModel?: CreateAgentSessionOptions["model"];
     startupThinkingLevel?: CreateAgentSessionOptions["thinkingLevel"];
+    preferCachedModels?: boolean;
 };
 export declare function applyStartupModelProfiles(args: StartupModelProfileArgs): Promise<void>;
 export declare function applyStartupModelProfilesOrExit(args: StartupModelProfileArgs): Promise<void>;
@@ -74,6 +75,9 @@ export declare function applyStartupModelProfilesForRoot(args: StartupModelProfi
 }): Promise<{
     recoverableErrors: string[];
 }>;
+type DeferredModelProfileStartup = () => Promise<{
+    recoverableErrors: string[];
+}>;
 interface InteractiveModeFactoryOptions {
     session: AgentSession;
     version: string;
@@ -95,7 +99,7 @@ export declare const BARE_RESUME_INTERACTIVE_ERROR = "--resume requires an inter
 /** Resolves only the managed agent root needed for pre-consent picker inventory. */
 export declare function resolveManagedAgentDirForScope(_cwd: string): string;
 export declare const BARE_RESUME_OPEN_ERROR = "Could not open the selected session. Use --resume <id>.";
-export declare function runInteractiveMode(session: AgentSession, version: string, changelogMarkdown: string | undefined, notifs: (InteractiveModeNotify | null)[], startupUpdate: StartupUpdateOrchestrator, initialMessages: string[], setExtensionUIContext: (uiContext: ExtensionUIContext, hasUI: boolean) => void, lspServers: LspStartupServerInfo[] | undefined, mcpManager: MCPManager | undefined, eventBus?: EventBus, initialMessage?: string, initialImages?: ImageContent[], createInteractiveMode?: CreateInteractiveMode, resumeAction?: "continue-tail" | "open-idle"): Promise<void>;
+export declare function runInteractiveMode(session: AgentSession, version: string, changelogMarkdown: string | undefined, notifs: (InteractiveModeNotify | null)[], startupUpdate: StartupUpdateOrchestrator, initialMessages: string[], setExtensionUIContext: (uiContext: ExtensionUIContext, hasUI: boolean) => void, lspServers: LspStartupServerInfo[] | undefined, mcpManager: MCPManager | undefined, eventBus?: EventBus, initialMessage?: string, initialImages?: ImageContent[], createInteractiveMode?: CreateInteractiveMode, resumeAction?: "continue-tail" | "open-idle", startDeferredMcpConfig?: CreateAgentSessionResult["startDeferredMcpConfig"], startDeferredModelProfiles?: DeferredModelProfileStartup): Promise<void>;
 export declare function getChangelogForDisplay(parsed: Args): Promise<string | undefined>;
 export declare function createSessionManager(parsed: Args, cwd: string, activeSettings?: Settings): Promise<SessionManager | undefined>;
 /**

package/dist/types/modes/acp/acp-agent.d.ts

@@ -32,11 +32,32 @@ export interface TranscriptReplayContent {
     };
 }
 export declare function transcriptReplayContent(entry: unknown): TranscriptReplayContent;
+/**
+ * Collect every page of `providers.list/active` (Q29, GJC >= 0.12.8) and
+ * return the providers with usable stored credentials or credentialless
+ * connection kinds, mirroring the TUI model picker's
+ * `modelRegistry.getAvailable()`. The openwebui-gjc-adapter applies the same
+ * filter to `/v1/models`. Q29 pages are byte-bounded and can span multiple
+ * pages when custom provider ids inflate the payload, so all pages are
+ * consumed before the provider set is built. Returns undefined only when the
+ * session host rejects the query with `operation_not_session_owned`; any
+ * other query failure or malformed page is thrown.
+ */
+export declare function collectActiveProviderIds(adapter: Pick<AcpSdkAdapter, "query">): Promise<ReadonlySet<string> | undefined>;
+/**
+ * Collect every page of `models.list/current` (Q10) into one catalog so the
+ * active-provider filter never drops models that only appear on later pages.
+ * The SDK pages Q10 at a fixed byte target (256 KiB), which a fully
+ * configured catalog can exceed. Returns the same
+ * `{ result: { page: { items } } }` envelope `pageItems` consumes.
+ */
+export declare function collectModelCatalog(adapter: Pick<AcpSdkAdapter, "query">): Promise<unknown>;
 /** Maps live canonical SDK config and the selected model catalog into the ACP 1.2.1 session state surface. */
-export declare function acpSessionStateFromConfig(query: unknown, modelCatalogQuery?: unknown, modelPreset?: string): {
+export declare function acpSessionStateFromConfig(query: unknown, modelCatalogQuery?: unknown, modelPreset?: string, activeProviders?: ReadonlySet<string>): {
     configOptions: ({
         id: string;
         name: string;
+        category: "mode";
         type: "select";
         currentValue: string;
         options: {
@@ -46,6 +67,7 @@ export declare function acpSessionStateFromConfig(query: unknown, modelCatalogQu
     } | {
         id: "model";
         name: string;
+        category: "model";
         type: "select";
         currentValue: string;
         options: {
@@ -73,6 +95,7 @@ export declare function acpSessionStateFromConfig(query: unknown, modelCatalogQu
     } | {
         id: "thinking";
         name: string;
+        category: "thought_level";
         type: "select";
         currentValue: string;
         options: {

package/dist/types/modes/components/session-selector.d.ts

@@ -35,7 +35,7 @@ export declare class SessionSelectorComponent extends Container {
     private readonly onDelete?;
     private readonly inspector?;
     private readonly onSelection?;
-    constructor(sessions: SessionInfo[], onSelect: (sessionPath: string) => void, onCancel: () => void, onExit: () => void, onDelete?: ((session: SessionInfo) => Promise<boolean>) | undefined, inspector?: SessionInspector | undefined, onSelection?: ((selection: SessionSelectionResult) => void) | undefined);
+    constructor(sessions: SessionInfo[], onSelect: (sessionPath: string) => void | Promise<void>, onCancel: () => void, onExit: () => void, onDelete?: ((session: SessionInfo) => Promise<boolean>) | undefined, inspector?: SessionInspector | undefined, onSelection?: ((selection: SessionSelectionResult) => void) | undefined);
     setOnRequestRender(callback: () => void): void;
     handleInput(keyData: string): void;
     getSessionList(): SessionList;

package/dist/types/modes/utils/host-status.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Host-terminal agent status markers.
+ *
+ * Interactive turns announce their state as an OSC 777 sequence:
+ *
+ *     ESC ] 777 ; notify;Terax;gjc;<event> BEL
+ *
+ * A terminal that understands the sequence (Terax reads it to drive its per-tab
+ * agent status and header bell) reacts; every other terminal discards the OSC
+ * as unknown, exactly like the OSC 133 prompt marks and OSC 7 cwd reports that
+ * shells emit unconditionally. So there is no host sniffing and no env gate:
+ * any host that wants agent status can parse the stream without gjc knowing it
+ * exists.
+ *
+ * `notify;Terax;` is the wire identifier of the only protocol that currently
+ * carries per-turn agent state, not a host check - the payload names gjc as the
+ * reporting agent.
+ *
+ * Interactive TUI only. Print and RPC mode stdout stays byte-for-byte parseable
+ * because they never reach these controllers.
+ */
+export type HostStatusEvent = "working" | "attention" | "finished";
+export declare function emitHostStatus(event: HostStatusEvent, output?: Pick<NodeJS.WriteStream, "write">): void;

package/dist/types/runtime-mcp/types.d.ts

@@ -186,6 +186,8 @@ export type MCPContent = MCPTextContent | MCPImageContent | MCPResourceContent;
 export interface MCPToolCallResult {
     content: MCPContent[];
     isError?: boolean;
+    /** MCP result metadata, encoded as `_meta` on the wire. */
+    _meta?: Record<string, unknown>;
 }
 /** Expected configured-server transport or protocol failure. */
 export declare class MCPExpectedFailure extends Error {

package/dist/types/sdk/broker/lifecycle.d.ts

@@ -48,6 +48,16 @@ export interface SessionLifecycleTranscriptIdentity {
     mtimeNs: string;
     sha256: string;
 }
+/**
+ * When a lifecycle-managed session publishes its replayable readiness signal.
+ *
+ * `immediate` is the stock contract. `deferred` prepares the session instead:
+ * the child publishes a distinct prepared signal, keeps `session_ready`
+ * withheld, and stays unusable for input until it is explicitly activated. It
+ * is broker-issued and session-scoped precisely so a prepared session can never
+ * be produced by an inherited process-global flag.
+ */
+export type SessionLifecycleReadiness = "immediate" | "deferred";
 export interface SessionLifecycleLaunchRequest {
     operation: "session.create" | "session.fork" | "session.resume";
     sessionId: string;
@@ -64,6 +74,8 @@ export interface SessionLifecycleLaunchRequest {
     modelPreset?: string;
     mcpServers?: SessionLifecycleMcpServer[];
     worktree?: SessionLifecycleWorktreeTarget;
+    /** Absent means the stock immediate contract; `deferred` prepares the session. */
+    readiness?: SessionLifecycleReadiness;
     receivedAt: number;
     requestedReadinessTimeoutMs: number;
     semanticReadyDeadlineAt: number;

package/dist/types/sdk/bus/chat-daemon-cli.d.ts

@@ -1,9 +1,12 @@
+import { type ChatDaemonCommandBindInput, type ChatDaemonCommandOutcome } from "./chat-daemon-command-channel";
 import { type ChatDaemonKind, renewChatDaemonHeartbeat } from "./chat-daemon-control";
 import { type ChatDaemonRuntimeConfig } from "./chat-daemon-runtime";
 export interface ChatDaemonRuntimeHandle {
     start(): Promise<void>;
     stop(): Promise<void>;
     transportHealthy?(): boolean;
+    /** Executes operator commands that must run inside the owning daemon. */
+    bindExistingRoot?(request: ChatDaemonCommandBindInput): Promise<ChatDaemonCommandOutcome>;
 }
 export interface RunChatDaemonInternalDeps {
     processPid?: number;

package/dist/types/sdk/bus/chat-daemon-command-channel.d.ts

@@ -0,0 +1,244 @@
+/**
+ * Request/response control channel for chat-daemon commands that must be
+ * executed *by* the running owner instead of terminating it.
+ *
+ * `control.json` is the lifecycle channel: every request the owner recognizes
+ * there ends its serving loop (stop/reload). Adopting an existing Slack root
+ * must not stop a healthy daemon, so operator commands travel on this separate
+ * per-request channel and are answered in place.
+ *
+ * Invariants:
+ * - Every request is addressed to an exact owner (`ownerId`, `pid`,
+ *   `incarnation`, daemon `generation`). A daemon that is not that exact owner
+ *   answers `owner_changed` and performs no work, so a replaced or restarted
+ *   owner can never satisfy a request captured against its predecessor. The
+ *   same tuple is re-proven inside the commit fence and echoed in the answer,
+ *   so the submitter can verify who actually acted.
+ * - `<id>.response.json` is a single-winner arbitration object created with
+ *   `O_CREAT|O_EXCL`. The serving daemon must win it *before* it commits, and a
+ *   submitter that has given up must win it before reporting failure. Whoever
+ *   loses learns so definitively, which removes the commit-vs-timeout race
+ *   without any sleep: a definitive `cancelled` answer proves no dispatch can
+ *   follow within this submission's race, and a lost cancellation is reported
+ *   as `unknown` rather than as a failure the caller could act on. The
+ *   arbitration is scoped to that race under the trust boundary below; it is
+ *   not durable settlement across a crashed and resurrected daemon.
+ * - Documents live in an owner-only (`0700`) directory below the agent
+ *   directory, are bounded, and are rejected unless they are ordinary regular
+ *   files. This matches the product's existing same-UID local trust boundary;
+ *   it is not a defence against a hostile process running as the same user.
+ * - Only identifiers travel through the channel. Tokens, message bodies, and
+ *   control secrets are never written here.
+ *
+ * The channel proves *correlation*, never authorship: every field a response
+ * echoes is copied verbatim out of the plaintext request published beside it,
+ * so a definitive answer is only actionable once the caller corroborates the
+ * mutation against an authority outside this directory.
+ */
+import { type ChatDaemonKind } from "./chat-daemon-control";
+export declare const CHAT_DAEMON_COMMAND_VERSION = 1;
+export declare const DEFAULT_CHAT_DAEMON_COMMAND_TIMEOUT_MS = 15000;
+export type ChatDaemonCommandName = "bind-thread";
+export type ChatDaemonCommandStatus = "ok" | "rejected" | "owner_changed" | "expired" | "outcome_unknown";
+/** Exact owner authority a request is addressed to. */
+export interface ChatDaemonCommandOwner {
+    ownerId: string;
+    pid: number;
+    incarnation: string;
+    generation: number;
+}
+export interface ChatDaemonCommandRequest extends ChatDaemonCommandOwner {
+    version: typeof CHAT_DAEMON_COMMAND_VERSION;
+    requestId: string;
+    kind: ChatDaemonKind;
+    command: ChatDaemonCommandName;
+    sessionId: string;
+    rootTs: string;
+    createdAt: number;
+    expiresAt: number;
+}
+/**
+ * The answer to exactly one request.
+ *
+ * The owner tuple, session, and root are the *addressed* request's, echoed
+ * verbatim. A response therefore carries the complete request envelope, and a
+ * submitter can prove that the document in front of it is correlated with its
+ * own request rather than with a replayed or concurrent one.
+ *
+ * That is correlation, not authentication. Every echoed field is public: it is
+ * copied out of the plaintext request published in the same command directory,
+ * so a stale or planted document can satisfy the envelope without the addressed
+ * daemon ever running. A caller that needs a definitive outcome must corroborate
+ * it against an authority outside this directory (the durable mutation itself).
+ */
+export interface ChatDaemonCommandResponse extends ChatDaemonCommandOwner {
+    version: typeof CHAT_DAEMON_COMMAND_VERSION;
+    requestId: string;
+    kind: ChatDaemonKind;
+    command: ChatDaemonCommandName;
+    sessionId: string;
+    rootTs: string;
+    status: ChatDaemonCommandStatus;
+    /** Machine-readable rejection category; never a message body or credential. */
+    code?: string;
+    endpointGeneration?: number;
+    teamId?: string;
+    channelId?: string;
+    completedAt: number;
+}
+/**
+ * Result of one handler dispatch, carrying explicit commit certainty.
+ *
+ * A failure is never just a code. `rejected` asserts that no mapping changed, so
+ * the caller may be told the binding definitively failed. `unknown` asserts the
+ * opposite: commit authority was exercised and the mapping may already be
+ * applied, so no definitive rejection may be reported for it. Handlers state
+ * this directly instead of leaving the channel to infer it from error text.
+ */
+export type ChatDaemonCommandOutcome = {
+    ok: true;
+    sessionId: string;
+    endpointGeneration: number;
+    teamId: string;
+    channelId: string;
+    rootTs: string;
+} | {
+    ok: false;
+    certainty: "rejected";
+    code: string;
+} | {
+    ok: false;
+    certainty: "unknown";
+    code: string;
+};
+export interface ChatDaemonCommandBindInput {
+    sessionId: string;
+    rootTs: string;
+    /**
+     * Terminal authority for this exact request. It must be awaited inside the
+     * store fence, immediately before the commit, and the commit must be
+     * abandoned when it answers `false`. It re-proves the exact daemon owner
+     * tuple, that the request is still published and unexpired, and takes the
+     * single-winner response claim, after which no cancellation can succeed.
+     */
+    commitAuthority?: () => Promise<boolean>;
+}
+/** Daemon-side executor. Implemented by the runtime that owns the live transports. */
+export interface ChatDaemonCommandHandler {
+    bindExistingRoot(input: ChatDaemonCommandBindInput): Promise<ChatDaemonCommandOutcome>;
+}
+export declare function isChatDaemonCommandRequest(value: unknown): value is ChatDaemonCommandRequest;
+export declare function isChatDaemonCommandResponse(value: unknown): value is ChatDaemonCommandResponse;
+/**
+ * The owner-only directory the channel exchanges its documents in.
+ *
+ * `directory` is a plain pathname: this codebase already trusts same-UID local
+ * processes, and every document below it is bounded and validated, so the
+ * channel does not attempt hostile-filesystem hardening it cannot honestly
+ * provide from TypeScript.
+ */
+export interface ChatDaemonCommandScope {
+    readonly directory: string;
+}
+export interface OpenChatDaemonCommandScopeInput {
+    agentDir: string;
+    kind: ChatDaemonKind;
+    /** Creates the daemon and command directories owner-only when absent. */
+    create?: boolean;
+}
+/** Capture the command directory, or report the channel unusable. */
+export declare function openChatDaemonCommandScope(input: OpenChatDaemonCommandScopeInput): Promise<ChatDaemonCommandScope | undefined>;
+/** Build a request addressed to one exact owner. */
+export declare function buildChatDaemonCommandRequest(input: {
+    kind: ChatDaemonKind;
+    command: ChatDaemonCommandName;
+    owner: ChatDaemonCommandOwner;
+    sessionId: string;
+    rootTs: string;
+    now?: number;
+    ttlMs?: number;
+    requestId?: string;
+}): ChatDaemonCommandRequest;
+export interface SubmitChatDaemonCommandInput {
+    agentDir: string;
+    kind: ChatDaemonKind;
+    owner: ChatDaemonCommandOwner;
+    command: ChatDaemonCommandName;
+    sessionId: string;
+    rootTs: string;
+    timeoutMs?: number;
+    pollIntervalMs?: number;
+    /** Bounded wait after a lost cancellation, before the outcome is reported unknown. */
+    settleGraceMs?: number;
+    ttlMs?: number;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+    requestId?: string;
+}
+/**
+ * Terminal result of one submission.
+ *
+ * `cancelled` is the only definitive failure: the submitter won the response
+ * claim, so the addressed owner cannot dispatch this request from here on within
+ * this submission's race. `unknown` means the daemon won that claim first and its
+ * answer was not observed; the caller must not report a definitive failure,
+ * because a commit may already be applied.
+ *
+ * `untrusted` means the response object under this identifier is a complete,
+ * well-formed document that does not carry this request's envelope. It is
+ * channel corruption — stale or planted — so it may not be read as an answer of
+ * any status, and because the identifier is now occupied the real outcome is
+ * unknowable from here; the caller must treat it exactly like `unknown`.
+ */
+export type ChatDaemonCommandSubmission = {
+    outcome: "answered";
+    response: ChatDaemonCommandResponse;
+} | {
+    outcome: "cancelled";
+} | {
+    outcome: "unknown";
+} | {
+    outcome: "untrusted";
+    code: "response_envelope_mismatch";
+} | {
+    outcome: "unavailable";
+    code: "command_channel_unavailable" | "request_id_unavailable";
+};
+/**
+ * Publish a command for the addressed owner and wait for its answer.
+ *
+ * The wait ends in exactly one of four states, and the commit-vs-timeout race is
+ * arbitrated by the exclusive creation of the response object rather than by any
+ * timing assumption.
+ */
+export declare function submitChatDaemonCommand(input: SubmitChatDaemonCommandInput): Promise<ChatDaemonCommandSubmission>;
+export interface ServeChatDaemonCommandsInput {
+    agentDir: string;
+    kind: ChatDaemonKind;
+    /** The serving daemon's own proven authority. */
+    ownerId: string;
+    pid: number;
+    incarnation: string;
+    generation: number;
+    handler: ChatDaemonCommandHandler;
+    /**
+     * Re-proves that this process still holds the persisted owner record. It is
+     * checked before any work is dispatched *and again* inside the commit fence,
+     * so a daemon that lost ownership after dispatch mutates nothing.
+     */
+    verifyOwnership?: () => Promise<boolean>;
+    now?: () => number;
+}
+/**
+ * Answer every pending request addressed to this exact owner. Requests aimed at
+ * any other owner identity are answered `owner_changed` without doing work, and
+ * expired requests are answered `expired`; neither performs a mutation.
+ */
+export declare function serveChatDaemonCommandsOnce(input: ServeChatDaemonCommandsInput): Promise<number>;
+/**
+ * Answer every pending request against an already-captured command scope.
+ *
+ * Exposed so a caller that already holds the directory authority drives exactly
+ * the production path.
+ */
+export declare function serveChatDaemonCommandsAgainstScope(scope: ChatDaemonCommandScope, input: ServeChatDaemonCommandsInput): Promise<number>;

package/dist/types/sdk/bus/chat-daemon-control.d.ts

@@ -32,7 +32,11 @@ export type ChatDaemonAction = "stop" | "reload";
  * Discord generation 24 / slack generation 23 apply provider-completeness and
  * effective-enable admission to chat daemon lifecycle controls. Discord
  * generation 25 / slack generation 24 apply identity-bound exact replacement
- * cleanup shared by managed-session and daemon filesystem authority.
+ * cleanup shared by managed-session and daemon filesystem authority. Discord
+ * generation 26 / slack generation 25 add the in-place operator command channel:
+ * an owner serves per-request commands inside its own serving loop and answers
+ * them against an exact owner tuple, so an owner at an earlier generation may
+ * not serve or answer a request captured against this contract.
  */
 export declare const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>>;
 export declare function chatDaemonGeneration(kind: ChatDaemonKind): number;
@@ -93,6 +97,12 @@ export declare function chatDaemonPaths(agentDir: string, kind: ChatDaemonKind):
     state: string;
     control: string;
 };
+/**
+ * Configuration fingerprint that identifies which settings a daemon owner was
+ * started for. `undefined` means the current settings cannot configure that
+ * transport at all, so no owner can be authorized against them.
+ */
+export declare function chatDaemonIdentity(settings: Settings, kind: ChatDaemonKind): string | undefined;
 export declare function readChatDaemonState(agentDir: string, kind: ChatDaemonKind): Promise<ChatDaemonState | undefined>;
 export declare function readChatDaemonControlRequest(agentDir: string, kind: ChatDaemonKind): Promise<ChatDaemonControlRequest | undefined>;
 export declare function writeChatDaemonControlRequest(agentDir: string, kind: ChatDaemonKind, request: ChatDaemonControlRequest): Promise<void>;

package/dist/types/sdk/bus/chat-daemon-runtime.d.ts

@@ -1,5 +1,6 @@
 import { SessionIndex } from "../broker/session-index";
 import { type SdkSessionEndpoint } from "../client/discovery";
+import type { ChatDaemonCommandBindInput, ChatDaemonCommandOutcome } from "./chat-daemon-command-channel";
 import type { ChatDaemonKind } from "./chat-daemon-control";
 import type { DiscordProvider } from "./discord-provider";
 import { type SlackProviderClient } from "./slack-provider";
@@ -69,6 +70,12 @@ export declare class ChatDaemonRuntime {
     private reconcile;
     private attach;
     private resolveEndpoint;
+    /**
+     * Adopt an operator-supplied Slack root for one attached session. Returns a
+     * machine-readable rejection instead of throwing so the daemon control plane
+     * can answer without exposing internal failure detail.
+     */
+    bindExistingRoot(request: ChatDaemonCommandBindInput): Promise<ChatDaemonCommandOutcome>;
     private schedule;
     private enqueueFrame;
     private handleFrame;

package/dist/types/sdk/bus/control-plane-frames.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Typed control-plane discriminants that must never reach chat presentation.
+ *
+ * A chat daemon observes one session socket for user-visible events, but that
+ * socket also carries the SDK's own request/response traffic: `SdkClient`
+ * settles a pending request from an inbound frame and still forwards the very
+ * same frame to every `onFrame` observer. A runtime that projects unknown frame
+ * types into a generic notification therefore renders protocol answers — most
+ * visibly `GJC event replay result` — as chat content, and a chat transport
+ * with no mapping for that session publishes it as a brand-new root.
+ *
+ * Membership is exact, typed, and closed. It is never inferred from a `_result`
+ * or `_response` suffix: ordinary public frames are free to be named anything,
+ * and a fuzzy rule would silently swallow real user content. Every entry below
+ * names the source authority that emits it and the code path that proves it can
+ * be delivered to a chat daemon's frame observer.
+ *
+ * In scope (proven reachable at the chat-daemon session-client seam):
+ * - `event_replay_result` — `SessionSdkHost` (`sdk/host/host.ts`) answers the
+ *   `event_replay` request that `ChatDaemonRuntime.attach()` issues on every
+ *   attachment, so every attached session receives exactly this frame.
+ * - `control_response` — the same host's answer to the `control_request` that
+ *   `ChatDaemonRuntime` sends for an authorized `/sdk control …` command, and
+ *   the endpoint-stale refusal the session runtime writes for a fenced
+ *   connection.
+ * - `query_response` — the host's answer to the matching `query_request`, and
+ *   the same endpoint-stale refusal path.
+ * - `hello` — `ServerMessage::Hello` from the native session server
+ *   (`crates/gjc-sdk/src/protocol.rs`), sent to every connection at accept time
+ *   and re-observed by frame handlers whenever the client reconnects and
+ *   adopts a new connection id.
+ *
+ * Deliberately out of scope — typed server→client frames that exist but are
+ * unicast only to a connection that issued a request a chat daemon never
+ * sends, so no source path delivers them here: `session_activate_result`,
+ * `register_provider_result`, `lease_state`, `reverse_response`,
+ * `reverse_request`, `reverse_cancel`, `global_response`, `pong`, and
+ * `transport_error`. Add one only together with the source path that proves it
+ * reaches this seam.
+ */
+export declare const CONTROL_PLANE_FRAME_TYPES: ReadonlySet<string>;
+/** Whether an exact frame/event discriminant is protocol-only control plane. */
+export declare function isControlPlaneFrameType(name: string | undefined): boolean;

package/dist/types/sdk/bus/conversation-store.d.ts

@@ -70,4 +70,22 @@ export declare class ConversationStore<T extends ConversationRecord> {
     delete(key: string, expectedGeneration: number): Promise<boolean>;
     /** Apply a synchronous update under the mapping lock, retrying no stale state. */
     transact(key: string, update: (current: T | undefined) => T | undefined): Promise<T | undefined>;
+    /**
+     * Apply one key update while atomically observing every mapping in the same
+     * store snapshot. The observation and the write share the cross-process file
+     * lock, so a caller can enforce uniqueness constraints that span keys.
+     *
+     * The update may be asynchronous so a caller can re-prove local authority
+     * (process, endpoint, or session state) inside the lock, immediately before
+     * its commit; returning `current` unchanged aborts without any mutation. It
+     * must never perform a remote/network call while holding the lock: the lock
+     * is a short fence, not a place to wait on a provider.
+     *
+     * Authority proven by the update is the last proof before the atomic
+     * replacement. Authority that rolls after it is an ordinary lifecycle event:
+     * the mapping records the endpoint generation it was proven under, so a newer
+     * generation fences it through the same monotonic compare-and-swap every
+     * other writer uses.
+     */
+    transactWithSnapshot(key: string, update: (current: T | undefined, conversations: Readonly<Record<string, T>>) => T | undefined | Promise<T | undefined>): Promise<T | undefined>;
 }

package/dist/types/sdk/bus/existing-thread-readiness.d.ts

@@ -0,0 +1,71 @@
+/**
+ * The prepare → bind → activate lifecycle for adopting an existing chat root.
+ *
+ * Stock startup publishes a session's readiness immediately, so the running
+ * chat daemon surfaces the session and creates its own root before an operator
+ * could ever name an existing one. A session that opts in is *prepared*
+ * instead: its id, endpoint, and broker registration are discoverable authority
+ * while readiness stays withheld, which leaves exactly one root claim for
+ * `gjc notify bind-thread` to fill. Activation then publishes readiness once,
+ * and the daemon adopts the bound root instead of replacing it.
+ *
+ * Nothing here mutates a mapping. The gate only reads the daemon-owned store to
+ * prove a binding exists, and the activation client only asks the session's own
+ * host to publish the readiness it withheld.
+ */
+import type { SessionIndex } from "../broker/session-index";
+import type { SdkSessionEndpoint, SdkSessionEndpointScope } from "../client/discovery";
+import type { SessionActivationGate } from "../host";
+import { type ActivatedPreparedSession, type PreparedSessionActivationClient } from "../session-activation";
+import type { ConversationStore } from "./conversation-store";
+import type { SlackConversation } from "./slack-conversation";
+/** Explicit, session-scoped opt-in for withholding readiness until a root is bound. */
+export declare const EXISTING_THREAD_BIND_ENV = "GJC_NOTIFY_BIND_EXISTING_THREAD";
+/**
+ * Existing-thread binding is opt-in, and only the exact value `1` opts in.
+ *
+ * Every other value — absent, empty, `0`, or anything truthy-looking — keeps
+ * the stock immediate-readiness contract, so no session silently loses its
+ * root publication because of an ambiguous environment.
+ */
+export declare function isExistingThreadBindingRequested(env?: NodeJS.ProcessEnv): boolean;
+export interface SlackBindingActivationInput {
+    store: ConversationStore<SlackConversation>;
+    teamId: string;
+    channelId: string;
+}
+/**
+ * Authorize activation only against an applied binding for this exact session.
+ *
+ * The proof is the daemon-owned mapping itself: an active record for this
+ * session, in the configured workspace and channel, carrying a root and the
+ * exact endpoint generation being activated. A missing, foreign, or
+ * stale-generation mapping is a refusal, and an unreadable store raises so the
+ * caller reports unavailable authority instead of an authorization.
+ */
+export declare function createSlackBindingActivationGate(input: SlackBindingActivationInput): SessionActivationGate;
+export type { ActivatedPreparedSession, PreparedSessionActivationClient, SessionActivationErrorCode, } from "../session-activation";
+export { requestPreparedSessionActivation, SessionActivationError } from "../session-activation";
+export interface PreparedSessionActivationInput {
+    sessionIndex: SessionIndex;
+    sessionId: string;
+}
+export interface PreparedSessionActivationDeps {
+    readEndpoint?: (repo: string, sessionId: string, scope?: SdkSessionEndpointScope) => Promise<SdkSessionEndpoint | null>;
+    connect?: (endpoint: {
+        url: string;
+        token: string;
+    }) => Promise<PreparedSessionActivationClient>;
+}
+/**
+ * Ask a prepared session to publish the readiness it withheld.
+ *
+ * The same discovery authority the binding requires is resolved first, so an
+ * unindexed, terminated, or endpoint-rolled session is refused before any
+ * connection is opened. The request names the exact session and endpoint
+ * generation, and the answer is accepted only when it proves both, so a
+ * replacement session can never be activated in place of the requested one.
+ * Activation is idempotent: an exact retry answers `already` without a second
+ * readiness signal.
+ */
+export declare function activatePreparedSession(input: PreparedSessionActivationInput, deps?: PreparedSessionActivationDeps): Promise<ActivatedPreparedSession>;

package/dist/types/sdk/bus/html-format.d.ts

@@ -43,6 +43,16 @@ export declare function truncateTelegramHtml(message: string, max?: number, mark
 export declare function splitTelegramHtml(message: string, max?: number): string[];
 /** Finalize an optional message: undefined passthrough, else safe-truncate. */
 export declare function finalizeTelegramHtml(message?: string): string | undefined;
+/** Multi-select state marker a transport may prepend to an option label. */
+export declare const SELECTION_MARK_CHECKED = "\u2611";
+export declare const SELECTION_MARK_UNCHECKED = "\u2610";
+/**
+ * Drop a leading `N.`/`N)` index already embedded in an option label (e.g.
+ * deep-interview options pre-numbered by the ask tool) so the canonical
+ * one-based index can be applied instead. A selection marker stays in front of
+ * the text: the label is renumbered, not un-marked.
+ */
+export declare function renumberableOptionText(label: string): string;
 /**
  * One-based, plain-text button label (Telegram does not parse HTML in labels).
  *

package/dist/types/sdk/bus/notification-service.d.ts

@@ -51,6 +51,16 @@ export interface NotificationExactUnlinkResult {
 export declare function readNotificationEndpointFile(file: string): Promise<NotificationEndpointFile>;
 /** Bump when the native exact-deletion identity contract changes. */
 export declare const NATIVE_PATH_IDENTITY_CONTRACT_VERSION = 1;
+/**
+ * Remove exactly the inspected regular file.
+ *
+ * Intermediate directory symlinks (e.g. multi-account layouts that share
+ * `notifications/` via a directory symlink) are resolved before the native
+ * no-follow unlink. Only the parent path is canonicalized; the final basename
+ * is rejoined so native exact_unlink still applies AT_SYMLINK_NOFOLLOW to the
+ * final path component at mutation time. A final-component file symlink stays
+ * `reparse_point` (including TOCTOU replacement after JS preflight).
+ */
 export declare function exactUnlinkNotificationFile(file: string, identity: NotificationEndpointFileIdentity, quarantineName: string): NotificationExactUnlinkResult;
 /** Minimal filesystem surface the service needs; injectable for tests. */
 export interface NotificationServiceFs {