@gajae-code/coding-agent 0.12.18 → 0.12.20

package/dist/types/sdk/broker/lifecycle-ledger.d.ts

@@ -92,18 +92,27 @@ export interface LifecycleLedgerLimits {
     maxBytes?: number;
     maxLineBytes?: number;
     maxRows?: number;
+    /**
+     * Cap for the `.corrupt` quarantine sidecar. Reaching it rotates one
+     * generation aside instead of appending forever.
+     */
+    maxCorruptBytes?: number;
 }
 export declare class LifecycleLedger {
     #private;
     constructor(agentDir: string, limits?: LifecycleLedgerLimits);
     open(): Promise<this>;
     /**
-     * Reads terminal proof for one request without recovering or changing the ledger.
+     * Reads the durable terminal record for one request without recovering or changing the ledger.
      *
      * This intentionally accepts an unrelated unterminated final write: concurrent
      * appenders may have started a different row after this request's synced terminal
      * row. Complete rows are still decoded and validated strictly, and any incomplete
      * tail that identifies this request withholds proof.
+     *
+     * `terminal_uncertain` is a durable terminal record too: an operation that concluded
+     * uncertainly persists that conclusion, and refusing to read it back would report a
+     * synced row as unpersisted and replace its true reason with a generic one.
      */
     readTerminal(identity: string, requestHash: string): Promise<LifecycleLedgerEntry | undefined>;
     get warnings(): readonly string[];

package/dist/types/sdk/broker/lifecycle.d.ts

@@ -1,5 +1,5 @@
 import type { SessionLifecycleMcpServer } from "../acp/mcp";
-import type { SdkStartupFailure, SdkStartupRollbackResult } from "../startup-capability";
+import { type SdkStartupFailure, type SdkStartupRollbackResult } from "../startup-capability";
 import type { Broker, BrokerCleanupEvidence, BrokerResponse } from "./broker";
 import type { LifecycleDurableEffectsReceipt, LifecycleStartupFailureReceipt } from "./lifecycle-ledger";
 import { type ProcessIncarnationCommandRunner, type ProcessIncarnationOptions, parseDarwinProcessIncarnation, processIncarnation } from "./process-incarnation";
@@ -15,7 +15,7 @@ export interface LifecycleDeadlines {
 export declare function deriveLifecycleDeadlines(receivedAt: number, requestedReadinessTimeoutMs: number): LifecycleDeadlines;
 export interface LifecycleTiming {
     now(): number;
-    sleep(ms: number): Promise<void>;
+    sleep(ms: number, signal?: AbortSignal): Promise<void>;
 }
 type LifecycleCommand = SdkInternalSpawnCommand | {
     file: string;
@@ -117,3 +117,82 @@ export interface LifecycleExecutionOutcome {
 }
 /** Returns the response together with every durable lifecycle fact needed for truthful replay. */
 export declare function executeLifecycle(broker: Broker, operation: string, input: Input, identity: string, cleanup?: CleanupEvidence): Promise<LifecycleExecutionOutcome>;
+/**
+ * The live client/socket subscription count of the SDK session endpoint this
+ * process serves, or `undefined` while this process serves no endpoint.
+ *
+ * Only the SDK session runtime owns the real socket table, so it publishes a
+ * reader here instead of every consumer re-deriving attachment from the OS.
+ * Consumers must treat `undefined` as "no evidence" and never as "detached".
+ */
+export type SessionHostAttachmentReader = () => number;
+/** What one serving runtime reports about itself while its transport is up. */
+export interface SessionHostRuntimeEvidence {
+    /** This runtime's own live SDK client/socket subscription count. */
+    attachedClients: SessionHostAttachmentReader;
+    /** Whether this runtime currently has agent work in flight. */
+    workInFlight: () => boolean;
+}
+/** One runtime's live publication, retractable only by its owner. */
+export interface SessionHostRuntimePublication {
+    /**
+     * Withdraws the evidence this handle published. Idempotent, and never able
+     * to touch a sibling runtime's evidence.
+     */
+    retract(): void;
+}
+/**
+ * Publishes this runtime's own liveness evidence for the lifetime of its
+ * transport. Retraction goes through the returned handle, so a runtime can only
+ * ever withdraw evidence it owns.
+ */
+export declare function publishSessionHostRuntimeEvidence(evidence: SessionHostRuntimeEvidence): SessionHostRuntimePublication;
+/**
+ * This process's currently attached SDK client count, summed across every
+ * serving runtime, or `undefined` when no runtime publishes a readable count
+ * (before startup, after teardown, or when every reader itself fails). Never
+ * guesses: absence of a reader is absence of evidence.
+ */
+export declare function sessionHostAttachedClients(): number | undefined;
+/**
+ * Whether any runtime in this process has agent work in flight right now.
+ *
+ * Positive evidence only: a runtime that publishes nothing, or whose reader
+ * fails, reports no work, so this can never keep an abandoned host alive.
+ */
+export declare function sessionHostWorkInFlight(): boolean;
+/**
+ * How often a live broker re-checks its own session registrations against OS
+ * process liveness.
+ *
+ * This sweep can never disturb healthy work: a registration is only dropped
+ * when `process.kill(pid, 0)` proves the exact published pid is gone, and a
+ * working host answers that probe for its entire life no matter how long a turn
+ * runs. One minute keeps `gjc_sessions`/`session.get_endpoint` from advertising
+ * a corpse for longer than a single poll while costing one index refresh per
+ * minute on an otherwise idle broker.
+ */
+export declare const BROKER_DEAD_REGISTRATION_SWEEP_MS = 60000;
+/** One reaped registration, as recorded by {@link reapDeadSessionRegistrations}. */
+export interface ReapedSessionRegistration {
+    sessionId: string;
+    pid: number;
+    endpointGeneration: number;
+}
+/**
+ * Drops every indexed session registration whose host process is provably gone.
+ *
+ * Liveness is the session index's own `alive(pid)` probe (`listSessions().live`),
+ * which reports live for both a running pid and an EPERM pid, so an alien or
+ * unreadable process is never mistaken for a dead one. Registrations already
+ * marked `terminalUncertain` are left alone: their disposition belongs to the
+ * terminal-uncertainty reconciliation path, and silently dropping them would
+ * turn a fail-closed `session.close`/`session.delete` refusal into `not_found`.
+ */
+export declare function reapDeadSessionRegistrations(broker: Pick<Broker, "index">): Promise<ReapedSessionRegistration[]>;
+/**
+ * Runs {@link reapDeadSessionRegistrations} on {@link BROKER_DEAD_REGISTRATION_SWEEP_MS}.
+ * The timer is unref'd, so it never keeps an otherwise idle broker process alive.
+ * Returns a disposer.
+ */
+export declare function startBrokerDeadRegistrationSweep(broker: Pick<Broker, "index">, intervalMs?: number): () => void;

package/dist/types/sdk/broker/startup-budget.d.ts

@@ -0,0 +1,44 @@
+/** Readiness budget the broker grants a lifecycle request that does not size one itself. */
+export declare const DEFAULT_READINESS_TIMEOUT_MS = 10000;
+export declare const MIN_READINESS_TIMEOUT_MS = 4000;
+export declare const MAX_READINESS_TIMEOUT_MS = 60000;
+export declare function isValidReadinessTimeoutMs(value: unknown): value is number;
+export declare const READINESS_TIMEOUT_INVALID_MESSAGE = "readinessTimeoutMs must be an integer between 4000 and 60000.";
+/**
+ * Sleep until the duration elapses or the caller cancels the wait. Queue admission
+ * uses this so a granted or refused waiter does not retain its cutoff timer for the
+ * rest of the readiness budget.
+ */
+export declare function cancellableSleep(ms: number, signal?: AbortSignal): Promise<void>;
+/**
+ * Whether a broker operation waits in the host-startup admission queue before it runs.
+ * Only these spawn a host, so only these can be parked behind a full queue; the other
+ * lifecycle operations start their readiness clock as soon as they are received.
+ */
+export declare function isStartupLifecycleOperation(operation: string): boolean;
+/**
+ * Bounded time a lifecycle startup may wait for a host-startup admission slot. It
+ * is the readiness budget itself: a startup still queued after that long has spent
+ * the whole window the request was sized for, so refusing it beats launching a host
+ * that is already late.
+ */
+export declare function startupQueueWaitMs(requestedReadinessTimeoutMs: number): number;
+/**
+ * Broker-side wall clock a lifecycle startup may consume: the admission wait plus
+ * the readiness budget, which is granted fresh at admission and so is never shortened
+ * by queueing. Callers MUST size their own request deadline against this rather than
+ * `readinessTimeoutMs` alone, or a request admitted late fails client-side while the
+ * broker keeps running it to a durably persisted terminal result.
+ */
+export declare function lifecycleStartupBudgetMs(requestedReadinessTimeoutMs: number): number;
+/**
+ * Request deadline a caller MUST grant a broker operation, or `undefined` when the
+ * operation carries no readiness budget of its own and the client default already
+ * covers it.
+ *
+ * A request that omits `readinessTimeoutMs` is sized against the broker's default
+ * rather than left unextended: the broker queues it for exactly as long as one that
+ * asked, so the common path would otherwise fail client-side while the broker runs
+ * the startup to a durably persisted terminal result.
+ */
+export declare function lifecycleRequestTimeoutMs(operation: string, input: Record<string, unknown>): number | undefined;

package/dist/types/sdk/bus/chat-daemon-control.d.ts

@@ -38,7 +38,13 @@ export type ChatDaemonAction = "stop" | "reload";
  * them against an exact owner tuple, so an owner at an earlier generation may
  * not serve or answer a request captured against this contract. Discord
  * generation 27 / slack generation 26 move shared exact unlink and process-
- * incarnation authority behind lazy native bindings.
+ * incarnation authority behind lazy native bindings. Discord generation 28 /
+ * slack generation 27 dial attached-session clients on the long-lived session
+ * reconnect budget, so an owner at an earlier generation gives up reconnecting
+ * before the host heartbeat TTL expires and permanently loses its attachment. Discord
+ * generation 29 / slack generation 28 advance the replay cursor only after a frame is
+ * published, so an owner at an earlier generation acknowledges an event before delivering
+ * it and loses that event for good the first time a surface refuses it.
  */
 export declare const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>>;
 export declare function chatDaemonGeneration(kind: ChatDaemonKind): number;

package/dist/types/sdk/bus/chat-daemon-runtime.d.ts

@@ -28,7 +28,17 @@ export interface ChatDaemonRuntimeConfig {
 }
 export interface ChatDaemonSdkClient {
     onFrame(handler: (frame: Record<string, unknown>) => void): () => void;
-    request(frame: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /**
+     * Announces that a replacement socket is live. Optional because command-scoped
+     * clients (the broker client, one-shot doubles) never outlive one socket, while
+     * every long-lived attachment's client carries it.
+     */
+    onReconnect?(handler: () => void): () => void;
+    /** Re-dials a retired socket; a no-op on a live one. */
+    connect?(): Promise<void>;
+    request(frame: Record<string, unknown>, options?: {
+        timeoutMs?: number;
+    }): Promise<Record<string, unknown>>;
     close(): Promise<void>;
     send(frame: Record<string, unknown>): void;
 }

package/dist/types/sdk/bus/discord-daemon.d.ts

@@ -31,6 +31,7 @@ export interface DiscordNotificationInput {
     threadName?: string;
     actionId?: string;
     options?: string[];
+    publicationId?: string;
 }
 /** SDK-only Discord threaded notification daemon. It owns no AgentSession and never retains endpoint credentials. */
 export declare class DiscordNotificationDaemon {

package/dist/types/sdk/bus/index.d.ts

@@ -26,6 +26,7 @@ import type { ExtensionAPI, ExtensionContext } from "../../extensibility/extensi
 import { type WorkflowGateEmitter, type WorkflowGateTerminalProof } from "../../modes/shared/agent-wire/workflow-gate-broker";
 import type { AgentSessionEvent } from "../../session/agent-session";
 import type { AskAnswerSource, AskAnswerSourceResult, AskRemoteControl } from "../../tools";
+import { type SessionHostRuntimePublication } from "../broker/lifecycle";
 import { type SessionSdkHost } from "../host";
 import { CursorRegistry, RevisionStore } from "../host/query";
 import { type SdkPromptTerminalOutcome } from "../prompt-status";
@@ -35,6 +36,22 @@ import { NotificationSessionController } from "./session-control";
 import { type EnsureDaemonResult, type RegisterNotificationRootResult } from "./telegram-daemon";
 export type { IdentityControlSuccessPathInput, IdentityControlTerminalPathInput, TerminalSendOutcome, } from "./control-drain-lease";
 export { isNativeControlDrainAvailable, runIdentityControlSuccessPath, runIdentityControlTerminalPath, } from "./control-drain-lease";
+type PromptTerminalDiagnostic = {
+    reason?: unknown;
+    loopStopReason?: string;
+    assistantStopReason?: string;
+    errorKind?: string;
+    intentionalCancellation?: boolean;
+};
+type PromptTerminalExtra = {
+    finalText?: string;
+    error?: {
+        code: string;
+        message: string;
+    };
+    diagnostic?: PromptTerminalDiagnostic;
+    diagnosticAlreadyLogged?: boolean;
+};
 export declare function formatPromptSettlementDiagnostic(proof: Extract<RunSettlementProof, {
     status: "unfenced";
 }>, now?: number): string;
@@ -357,6 +374,8 @@ interface SessionRuntime {
     /** Terminal cleanup proof retained across retries; each owner is released at most once after proof. */
     hostStopped: boolean;
     serverStopped: boolean;
+    /** This runtime's own host-liveness publication; only its teardown may retract it. */
+    evidencePublication?: SessionHostRuntimePublication;
     brokerRegistrationReleased: boolean;
     /** Managed Telegram root registration released during terminal teardown. */
     notificationRootRegistration?: {
@@ -392,15 +411,7 @@ interface SessionRuntime {
     terminalizePrompt: (correlation: {
         commandId: string;
         turnId: string;
-    }, outcome: SdkPromptTerminalOutcome, extra?: {
-        finalText?: string;
-    }) => Promise<void>;
-    /** Records a correlated prompt terminal boundary after agent unwind. */
-    /** Atomically claims a correlated prompt terminal boundary after agent unwind. */
-    recordPromptTerminal: (correlation: {
-        commandId: string;
-        turnId: string;
-    } | undefined) => boolean;
+    }, outcome: SdkPromptTerminalOutcome, extra?: PromptTerminalExtra) => Promise<void>;
     /** Transitions the authoritative reconciliation record at lifecycle ingress; terminal outcomes settle once. */
     notePromptReconciliation: (correlation: {
         commandId: string;

package/dist/types/sdk/bus/prompt-reconciliation.d.ts

@@ -18,10 +18,11 @@
  *   retained and must never be reused as a retry mechanism.
  * - Terminal transitions settle once: the first terminal outcome wins.
  */
+import { PROMPT_FAILURE_CODE_MAX, sanitizePromptFailure } from "../prompt-failure";
+export { PROMPT_FAILURE_CODE_MAX, sanitizePromptFailure };
 export declare const PROMPT_RECONCILIATION_ACTIVE_CAPACITY = 128;
 export declare const PROMPT_RECONCILIATION_TERMINAL_CAPACITY = 256;
 export declare const PROMPT_RECONCILIATION_TERMINAL_TTL_MS: number;
-export declare const PROMPT_FAILURE_CODE_MAX = 64;
 export type PromptReconciliationStatus = "accepted" | "in_flight" | "terminal_ok" | "failed";
 export interface PromptCorrelation {
     commandId: string;
@@ -96,11 +97,6 @@ export interface PromptReconciliation {
     cleanup(): void;
     activeCount(): number;
 }
-/** Safe-token code capped at 64; arbitrary failure text is never retained. */
-export declare function sanitizePromptFailure(error: unknown): {
-    code: string;
-    message: string;
-};
 export declare function createPromptReconciliation(options?: {
     now?: () => number;
 }): PromptReconciliation;

package/dist/types/sdk/bus/slack-daemon.d.ts

@@ -74,12 +74,12 @@ export declare class SlackNotificationDaemon {
      */
     bindExistingRoot(sessionId: string, rootTs: string, commitAuthority?: () => Promise<boolean>): Promise<SlackConversation>;
     /** Deliver a notification into the mapped root thread, creating that root once. */
-    notify(sessionId: string, body: string, actionId?: string, endpointGeneration?: number): Promise<SlackConversation>;
+    notify(sessionId: string, body: string, actionId?: string, endpointGeneration?: number, publicationId?: string): Promise<SlackConversation>;
     /** Posts a safe command outcome to the active mapped root thread. */
     postCommandResult(sessionId: string, content: string): Promise<boolean>;
     resolveAction(sessionId: string, actionId: string): Promise<void>;
     close(sessionId: string, marker?: string): Promise<boolean>;
-    resume(sessionId: string, body: string, endpointGeneration?: number): Promise<SlackConversation>;
+    resume(sessionId: string, body: string, endpointGeneration?: number, publicationId?: string): Promise<SlackConversation>;
     findSession(sessionId: string, includeInactive: boolean): Promise<{
         key: string;
         record: SlackConversation;

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -88,9 +88,11 @@ export declare const NOTIFICATION_PROTOCOL_VERSION = 3;
  * lazy native bindings for the startup-cost cut (#3846). Generation 57 clears
  * disconnect-grace-only fields whenever a topic enters an archive state, so
  * one stale session cannot make the shared registry unreadable and block every
- * later session from creating a topic or replaying notifications.
+ * later session from creating a topic or replaying notifications. Generation
+ * 58 preserves that invariant during durable-fence load promotion and restores
+ * the exact grace deadline when a failed archive publication rolls back.
  */
-export declare const DAEMON_GENERATION = 57;
+export declare const DAEMON_GENERATION = 58;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 5
  * requires the complete generation-36 topic authority contract, so older

package/dist/types/sdk/host/query/revision-store.d.ts

@@ -40,6 +40,11 @@ export declare class RevisionStore {
         complete: boolean;
         offset: number;
     } | undefined>;
+    readIndexedFieldRange(resourceKind: string, resourceId: string, id: string, itemId: string, field: string, offset: number, length: number): Promise<{
+        body: string;
+        complete: boolean;
+        offset: number;
+    } | undefined>;
     describeIndexedItem(resourceKind: string, resourceId: string, id: string, offset: number): Promise<{
         itemId?: string;
         fields: string[];

package/dist/types/sdk/host/session-runtime.d.ts

@@ -90,6 +90,10 @@ export interface InvocationReconciliation {
     }): unknown;
     hydrate(): Promise<void>;
 }
+export declare function createInvocationReconciliation(options?: {
+    stateRoot?: string;
+    sessionId?: string;
+}): InvocationReconciliation;
 export interface SdkSurfaceFactoryOptions {
     ctx: ExtensionContext;
     id: string;

package/dist/types/sdk/lifecycle-session.d.ts

@@ -5,13 +5,24 @@ export type CreateLifecycleAgentSessionResult = {
     session: AgentSession;
     capability: SdkStartupCapability;
     rollback: SdkStartupRollbackTracker;
+    /**
+     * Starts the memory backend that construction deliberately skipped. The
+     * caller MUST run it only after readiness is published.
+     */
+    startDeferredMemoryBackend: () => Promise<void>;
 } | {
     capability: SdkStartupCapability;
     rollback: SdkStartupRollbackTracker;
     failure: SdkStartupFailure;
 };
-/** Options accepted by lifecycle-only session construction. */
-export type CreateLifecycleAgentSessionOptions = CreateAgentSessionOptions & {
+/**
+ * Options accepted by lifecycle-only session construction.
+ *
+ * `deferMemoryBackendStartup` is not accepted: lifecycle sessions are launched
+ * by the broker under a fixed readiness deadline, and memory startup runs
+ * unbounded LLM work, so deferral is an invariant rather than a caller choice.
+ */
+export type CreateLifecycleAgentSessionOptions = Omit<CreateAgentSessionOptions, "deferMemoryBackendStartup"> & {
     /**
      * Startup budget for ACP lifecycle MCP launches, in milliseconds. Set only
      * when the lifecycle request supplies `mcpServers`; ordinary consumers keep

package/dist/types/sdk/prompt-failure.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Safe failure shaping shared by SDK transports and reconciliation stores.
+ * Provider error text is retained only in the local diagnostic log; wire and
+ * persisted reconciliation details expose a fixed redacted message.
+ */
+export declare const PROMPT_FAILURE_CODE_MAX = 64;
+/** Safe-token code capped at 64; arbitrary failure text is never retained. */
+export declare function sanitizePromptFailure(error: unknown): {
+    code: string;
+    message: string;
+};
+/** Best-effort local diagnostic text that never crosses the SDK boundary. */
+export declare function formatPromptFailureForLocalLog(error: unknown): string;

package/dist/types/sdk/prompt-watchdog.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Inactivity bound for a prompt whose session host has no tool call in flight: after
+ * this much silence the host is treated as having stopped producing, so the prompt is
+ * settled instead of hanging the client forever.
+ *
+ * Every step of a live turn emits a frame (`agent_start`, message events, tool events,
+ * `agent_end`), so this bound only has to exceed the longest frame-free gap a healthy
+ * turn can produce *with nothing executing*: one model round trip, from the request
+ * leaving the host to the first streamed event coming back, possibly straddling a
+ * transport reconnect.
+ *
+ * `TOOL_TIMEOUTS` is this runtime's own statement of how long a single unattended step
+ * may block before it is declared stuck, and its slowest **default**
+ * ({@link DEFAULT_TOOL_RUNTIME_MS}) is the longest such wait nobody explicitly opted
+ * into. That is well above the agent's own model-stream watchdog (120s idle / 100s
+ * first event in `packages/ai/src/utils/idle-iterator.ts`), which aborts a stalled
+ * provider stream and republishes it as an error frame — itself a frame — long before
+ * this bound. {@link SDK_RECONNECT_BUDGET_MS} is added on top so a reconnect landing
+ * inside that gap cannot trip it either. Two providers widen their first-event
+ * fallback past this bound (alibaba-token-plan 600s, kimi-code 300s); a turn that
+ * emits nothing at all for this long on those is reported as abandoned rather than
+ * left `running`, and the session still accepts the next prompt.
+ *
+ * {@link MAX_TOOL_RUNTIME_MS} is deliberately *not* used here. `max` is what a caller
+ * may request, not what tools take, so sizing every gap for it produced a 63min bound
+ * that could never act as a safety net. Turns that legitimately reach that ceiling are
+ * covered by {@link ACP_PROMPT_TOOL_ACTIVITY_TIMEOUT_MS} instead, which is gated on
+ * evidence that a tool is actually executing.
+ */
+export declare const ACP_PROMPT_INACTIVITY_TIMEOUT_MS: number;
+/**
+ * Inactivity bound that applies only while the session host has an unfinished tool
+ * call — a `tool_execution_start`/`tool_execution_update` with no matching
+ * `tool_execution_end`.
+ *
+ * A long `bash` is protected by the evidence that it is running, not by a constant
+ * sized for the worst case, so this wide bound stands only for as long as that
+ * evidence does. It still terminates: no tool call may outlive
+ * {@link MAX_TOOL_RUNTIME_MS}, after which the host must publish `tool_execution_end`,
+ * so a host that dies mid-tool is still reported (one reconnect budget later).
+ */
+export declare const ACP_PROMPT_TOOL_ACTIVITY_TIMEOUT_MS: number;
+/**
+ * Inactivity bound that applies while a prompt is awaiting the model: a provider call is in
+ * flight and has not produced the first frame of its response yet.
+ *
+ * Tool execution had evidence and model inference did not, so a turn thinking after
+ * `agent_start` looked exactly like a dead producer and was killed at
+ * {@link ACP_PROMPT_INACTIVITY_TIMEOUT_MS}. Inference gets the same evidence-based
+ * tolerance: the wide bound stands only as long as a model call is observably unanswered.
+ *
+ * It still terminates. A provider stream that yields nothing within
+ * {@link MAX_PROVIDER_FIRST_EVENT_TIMEOUT_MS} is aborted by the agent's own stream watchdog,
+ * which republishes as an error/retry frame, so a host that dies mid-inference is still
+ * reported one reconnect budget later.
+ */
+export declare const ACP_PROMPT_INFERENCE_TIMEOUT_MS: number;
+/**
+ * Per-prompt view of what the session host is observably doing: which tool calls it has
+ * started but not finished, and whether it is waiting on a model call. Inbound frames are
+ * the only evidence the ACP side has, so "a tool is running" means exactly "a start was
+ * observed and its end was not", and "awaiting the model" means exactly "a model call was
+ * dispatched and nothing from its response has been observed".
+ */
+export declare class PromptActivity {
+    #private;
+    /** Folds one inbound frame's lifecycle event into the in-flight tool and model state. */
+    observe(eventType: string | undefined, toolCallId: string | undefined, messageRole: string | undefined): void;
+    /** True while at least one started tool call has not reported an end. */
+    get running(): boolean;
+    /** True while a dispatched model call has not produced the first frame of its response. */
+    get awaitingModel(): boolean;
+    /** Bound that applies to the next frame-free gap, given what is observably executing. */
+    get inactivityBoundMs(): number;
+}
+/** Timer surface behind the prompt watchdog; tests substitute a virtual clock. */
+export interface PromptWatchdogClock {
+    now(): number;
+    /** Runs `handler` after `delayMs`; the returned callback cancels the pending run. */
+    schedule(handler: () => void, delayMs: number): () => void;
+}
+export declare const systemPromptWatchdogClock: PromptWatchdogClock;

package/dist/types/sdk/session-reconnect.d.ts

@@ -0,0 +1,20 @@
+import type { SdkClientOptions } from "./client";
+type SessionReconnectOptions = Required<Pick<SdkClientOptions, "reconnectAttempts" | "reconnectBackoffMs" | "reconnectMaxBackoffMs">>;
+/**
+ * Reconnect budget for every long-lived SDK session client: ACP sessions and the
+ * chat daemon's attached sessions alike. Named for the ACP session that first
+ * needed it; it lives here because both live under the same host reaper and the
+ * bus layer must not import the ACP layer to reach it.
+ *
+ * Invariant: the client's total reconnect budget must outlive the host heartbeat
+ * TTL ({@link HEARTBEAT_TTL_MS}). The SDK host drops a session whose client has
+ * not ponged within that TTL, so a client that gives up reconnecting sooner turns
+ * every stall the host reaps into a permanently lost session ("SDK WebSocket
+ * reconnect attempts exhausted"). The transport defaults (3 attempts at 25ms base
+ * = 175ms total) are correct only for one-shot request clients.
+ *
+ * Backoff ramps 250 -> 500 -> 1000 and then holds at the 2s cap, so individual
+ * sleeps stay short and recovery is prompt once the host answers again.
+ */
+export declare const ACP_SESSION_RECONNECT: SessionReconnectOptions;
+export {};

package/dist/types/sdk/startup-capability.d.ts

@@ -1,6 +1,6 @@
 import { type ModelProfileErrorCode, type ModelProfileErrorDetails } from "../config/model-profile-contract";
 export type SdkStartupPhase = "registration" | "startup";
-export type SdkStartupReason = "disabled" | "ineligible" | "factory_absent" | "runner_absent" | "pending" | "failed";
+export type SdkStartupReason = "disabled" | "ineligible" | "factory_absent" | "runner_absent" | "admission_timeout" | "pending" | "failed";
 export interface SdkStartupFailure {
     phase: SdkStartupPhase;
     reason: SdkStartupReason;

package/dist/types/session/agent-session.d.ts

@@ -110,7 +110,8 @@ import type { ClientBridge, ClientBridgePermissionOption, ClientBridgePermission
 import { type ContributionPrepOptions, type ContributionPrepResult } from "./contribution-prep";
 import type { MemoryGuardRestoreResult } from "./memory-guard-checkpoint-participant";
 import { type CustomMessage } from "./messages";
-import type { BranchSummaryEntry, CompactionEntry, NewSessionOptions, PreparedNewSession, RecoveryHydrationContext, RecoveryHydrationPromotionFence, SessionContext, SessionManager, SessionManagerCloseOutcome } from "./session-manager";
+import type { BranchSummaryEntry, CompactionEntry, NewSessionOptions, PreparedNewSession, RecoveryHydrationContext, RecoveryHydrationPromotionFence, SessionContext, SessionManagerCloseOutcome, SessionMemoryStats } from "./session-manager";
+import { SessionManager } from "./session-manager";
 import { ToolChoiceQueue } from "./tool-choice-queue";
 import { YieldQueue } from "./yield-queue";
 /** Session-specific events that extend the core AgentEvent */
@@ -385,8 +386,8 @@ export interface PromptOptions {
      */
     onPreflightAccepted?: () => void;
     /**
-     * Awaitable durable-accept fence. Called after preflight and before queue mutation
-     * or `#promptAgentWithIdleRetry`. SDK bus installs a closure that fsyncs acceptance.
+     * Awaitable durable-accept fence. Called after preflight and immediately before
+     * agent execution begins. SDK bus installs a closure that fsyncs acceptance.
      */
     onPreflightAcceptCommit?: () => void | Promise<void>;
     /** Skill-only: prepared metadata before the durable fence (path/lineCount/cleanedArgs). */
@@ -444,6 +445,7 @@ export interface SessionStats {
     premiumRequests: number;
     cost: number;
     costBreakdown?: Usage["cost"];
+    sessionMemory: SessionMemoryStats;
 }
 export type EphemeralTurnPurpose = "btw" | "background";
 interface EphemeralTurnBaseArgs {
@@ -560,7 +562,7 @@ export declare class StreamingEditFileCache {
 export declare class AgentSession {
     #private;
     readonly agent: Agent;
-    readonly sessionManager: SessionManager;
+    sessionManager: SessionManager;
     readonly settings: Settings;
     readonly memoryBackend: LazyService<MemoryBackend>;
     readonly notificationSessionController: NotificationSessionController | undefined;
@@ -1363,9 +1365,12 @@ export declare class AgentSession {
      * @param command The bash command to execute
      * @param onChunk Optional streaming callback for output
      * @param options.excludeFromContext If true, command output won't be sent to LLM (!! prefix)
+     * @param options.onPersisted Called once the execution's message is in session state
+     *   (immediately when idle, at the post-turn flush while streaming)
      */
     executeBash(command: string, onChunk?: (chunk: string) => void, options?: {
         excludeFromContext?: boolean;
+        onPersisted?: () => void;
     }): Promise<BashResult>;
     /**
      * Record a bash execution result in session history.
@@ -1373,6 +1378,7 @@ export declare class AgentSession {
      */
     recordBashResult(command: string, result: BashResult, options?: {
         excludeFromContext?: boolean;
+        onPersisted?: () => void;
     }): void;
     /**
      * Cancel running bash command.
@@ -1388,9 +1394,12 @@ export declare class AgentSession {
      * @param code The Python code to execute
      * @param onChunk Optional streaming callback for output
      * @param options.excludeFromContext If true, execution won't be sent to LLM ($$ prefix)
+     * @param options.onPersisted Called once the execution's message is in session state
+     *   (immediately when idle, at the post-turn flush while streaming)
      */
     executePython(code: string, onChunk?: (chunk: string) => void, options?: {
         excludeFromContext?: boolean;
+        onPersisted?: () => void;
     }): Promise<PythonResult>;
     assertEvalExecutionAllowed(): void;
     /**
@@ -1402,6 +1411,7 @@ export declare class AgentSession {
      */
     recordPythonResult(code: string, result: PythonResult, options?: {
         excludeFromContext?: boolean;
+        onPersisted?: () => void;
     }): void;
     /**
      * Cancel running Python execution.

package/dist/types/session/blob-store.d.ts

@@ -210,4 +210,36 @@ export declare function resolveResidentImageDataSync(blobStore: BlobStore, data:
     sessionId?: string;
     sessionFile?: string;
 }): string;
+/** One canonical blob file (`<blobsDir>/<sha256-hex>`) observed on disk. */
+export interface CanonicalBlobEntry {
+    readonly hash: string;
+    readonly path: string;
+    readonly bytes: number;
+    readonly mtimeMs: number;
+}
+/** Longest possible `blob:sha256:<hash>` reference, used to bound chunked scans. */
+export declare const BLOB_REFERENCE_MAX_LENGTH: number;
+/** Collect every `blob:sha256:<hash>` reference that appears in `text`. */
+export declare function collectBlobReferences(text: string, into: Set<string>): void;
+/**
+ * List canonical blob files. Anything that is not a plain, owner-visible regular
+ * file named after its own hash (temp files, symlinks, subdirectories) is
+ * skipped: a sweep must never reason about entries it cannot classify.
+ */
+export declare function listCanonicalBlobs(dir: string): Promise<CanonicalBlobEntry[]>;
+/**
+ * Remove one canonical blob, fail-closed on identity drift. The entry captured
+ * at scan time must still describe the file at unlink time (same inode, size and
+ * mtime, still a single-link regular file), otherwise the blob is left in place.
+ *
+ * `failed` distinguishes an actual IO failure (which a caller should surface as
+ * a failed reclaim) from a revalidation refusal (which is an ordinary KEEP).
+ */
+export declare function removeCanonicalBlob(entry: CanonicalBlobEntry): Promise<{
+    removed: true;
+} | {
+    removed: false;
+    reason: string;
+    failed?: true;
+}>;
 export {};