@gajae-code/coding-agent 0.12.21 → 0.13.0

package/dist/types/session/session-manager.d.ts

@@ -86,6 +86,54 @@ export interface SessionManagerObservabilityStats {
     materializedCacheDemotedCount: number;
     pathOnlyContextBuildCount: number;
 }
+export type SessionMemoryMode = "off" | "shadow" | "enabled" | "auto";
+export type SessionMemoryGcStrategy = "current" | "none" | "async" | "pressure";
+export type SessionMemorySecondaryArtifactMode = "auto" | "enabled" | "disabled";
+export interface SessionMemoryPhaseTelemetry {
+    wallMs: number;
+    cpuMs: number | null;
+}
+export interface SessionMemoryFirstOpenTelemetry {
+    /** True when a bounded first-open attempt was started for this manager. */
+    attempted: boolean;
+    /** True only after the bounded sidecar set and context were committed. */
+    succeeded: boolean;
+    strategy: SessionMemoryGcStrategy;
+    secondaryArtifactMode: SessionMemorySecondaryArtifactMode;
+    wallMs: number;
+    cpuMs: number;
+    gcRequests: number;
+    gcRequestCount: number;
+    gcElapsedMs: number;
+    bytesRead: number;
+    transcriptBytesRead: number;
+    bytesWritten: number;
+    sidecarBytesWritten: number;
+    sidecarFileBytes: number;
+    recordsParsed: number;
+    semanticRecordsParsed: number;
+    suffixRecordsParsed: number;
+    lineAssemblyCopyCount: number;
+    lineCopyCount: number;
+    lineAssemblyCopyBytes: number;
+    indexWriteCalls: number;
+    indexWriteBytes: number;
+    fsyncCount: number;
+    fsyncElapsedMs: number;
+    /** Phase names are stable internal keys; missing phases remain zero-valued. */
+    phaseTelemetry: Record<string, SessionMemoryPhaseTelemetry>;
+    /** Alias retained for benchmark/report consumers. */
+    phaseEvidence: Readonly<Record<string, SessionMemoryPhaseTelemetry>>;
+    /** Alias retained for benchmark/report consumers. */
+    phaseTimings: Readonly<Record<string, SessionMemoryPhaseTelemetry>>;
+    /** Internal pressure-mode baseline; not persisted. */
+    pressureBaselineBytes?: number;
+    dictionaryArtifactEnabled: boolean;
+    parentArtifactEnabled: boolean;
+    dictionaryBuildElapsedMs: number;
+    parentBuildElapsedMs: number;
+    flatIndexElapsedMs: number;
+}
 export interface SessionMemoryStats {
     sidecarEnabled: boolean;
     coldRetirementActive: boolean;
@@ -93,6 +141,18 @@ export interface SessionMemoryStats {
     hotRegionBytes: number;
     metaDescriptorBytes: number;
     totalAccountedBytes: number;
+    /** Fixed cache/reducer reservation charged for enforcement, distinct from live residency. */
+    reservedBudgetBytes: number;
+    /** Bytes currently allocated in bounded block/entry/tail caches. */
+    allocatedCacheBytes: number;
+    /** Resident hot suffix object bytes, excluding reserved budgets. */
+    hotResidentBytes: number;
+    /** Resident reducer/labels/metadata-delta descriptor bytes. */
+    metadataResidentBytes: number;
+    /** Bytes currently present in disposable sidecar files. */
+    sidecarFileBytes: number;
+    /** Latest bounded first-open telemetry; zero-valued when no attempt ran. */
+    firstOpen: SessionMemoryFirstOpenTelemetry;
     lastReopenTransition: ReopenClassification | undefined;
     currentCommitTransition: ReopenClassification | undefined;
     lazyReopenAttempted: boolean;
@@ -155,6 +215,8 @@ export interface ModelChangeEntry extends SessionEntryBase {
     model: string;
     /** Role: "default" or an agent role. Undefined treated as "default" */
     role?: string;
+    /** Clears the role's previously recorded model when replaying session context. */
+    cleared?: boolean;
     /** Requested model before a runtime substitution/fallback, in "provider/modelId" format. */
     previousModel?: string;
     /** Machine-readable reason for runtime model substitution/fallback. */
@@ -330,6 +392,8 @@ export interface SessionMemorySidecarRuntime {
     sidecarIneligible: boolean;
     base: BaseAnchor;
     tail: CommittedTail;
+    /** Next non-header ordinal, proven while building or validating the flat index. */
+    nextOrdinal: number;
     /** Bounded hot index cache; authoritative lookup falls back to the disk index. */
     coldEntries: Map<string, ColdEntryIndex>;
     indexPath: string;
@@ -346,6 +410,12 @@ export interface SessionMemorySidecarRuntime {
     retirementFirstKeptEntryId: string | undefined;
     /** Hot-suffix byte total (accountant-bounded to ≤ 16 MiB). */
     hotSuffixBytes: number;
+    /** Resident hot suffix object bytes charged separately from the raw hot-region byte count. */
+    hotResidentBytes: number;
+    /** Fixed reservation used for accounting split telemetry. */
+    reservedBudgetBytes: number;
+    /** Disposable sidecar file byte total captured after first-open publication. */
+    sidecarFileBytes: number;
     accountant: SessionMemoryAccountant;
     reducer: ReducerState;
     /** Resident inline provider-affecting entries (merged order minus demoted slots). */
@@ -377,7 +447,7 @@ export interface SessionMemorySidecarRuntime {
     dictionary?: DictionaryArtifactRuntimeState;
     /** Persistent metadata-delta section state; absent = no demoted provider values. */
     metadataDelta?: MetadataDeltaArtifactRuntimeState;
-    /** Lazily built 24-bit fingerprints for O(1) fail-closed ID generation when no persistent dictionary exists. */
+    /** Fixed-size false-positive-only cache used solely for generated-ID collision avoidance. */
     coldIdHashes?: BoundedColdIdHashSet;
     coldIdHashesDescriptor?: SessionStorageStat;
     /** Live observability counters (P7 live-only contract). */
@@ -452,11 +522,18 @@ interface MetadataDeltaArtifactRuntimeState {
     /** Descriptor of the exact delta bytes whose digest was validated. */
     validatedDescriptor?: SessionStorageStat;
 }
+/**
+ * Bounded first-open transcript scan limits. The eager authoritative path handles
+ * anything outside these bounds; the bounded path only ever fails closed to it.
+ */
+export declare const BOUNDED_FIRST_OPEN_MAX_LINE_BYTES: number;
+/** Fixed-size collision cache for generated IDs. False positives only cause regeneration. */
 declare class BoundedColdIdHashSet {
     #private;
+    constructor(maxEntries?: number);
+    get atCapacity(): boolean;
     has(value: string): boolean;
     add(value: string): boolean;
-    addUnique(value: string): boolean;
 }
 export type DefaultModelSelectionStage = {
     readonly entryRevision: number;
@@ -562,6 +639,12 @@ export type SessionDirectoryMigrationPolicy = ManagedMigrationPolicy;
 export type SessionAppendPersistenceFailurePhase = "current_append" | "prior_failure";
 /** Safety bound for eager resume compatibility and managed per-file artifacts. */
 export declare const RESUME_TRANSCRIPT_MAX_BYTES: number;
+/**
+ * Explicit cold-session admission limit. Two-GiB transcripts remain streamable;
+ * the extra MiB covers bounded fork header replacement without rejecting a
+ * source exactly at the advertised limit.
+ */
+export declare const BOUNDED_RESUME_TRANSCRIPT_MAX_BYTES: number;
 export declare const SESSION_OVERSIZED_RECOVERY_MESSAGE = "The selected session transcript is too large to resume safely. Use `gjc export <session-file>` to export its content into a new session, or remove/archive it after confirming its content is no longer needed.";
 export declare class SessionAppendPersistenceError extends Error {
     readonly phase: SessionAppendPersistenceFailurePhase;
@@ -586,6 +669,19 @@ export declare class SessionTranscriptOversizedError extends Error {
     readonly size: number;
     constructor(size: number);
 }
+/** Default synchronous session-context materialization budget (512 MiB). */
+export declare const SESSION_CONTEXT_MATERIALIZATION_BUDGET_BYTES_DEFAULT: number;
+/** Ceiling for a `GJC_SESSION_CONTEXT_BUDGET_BYTES` override (8 GiB) so the memory guard stays meaningful. */
+export declare const SESSION_CONTEXT_MATERIALIZATION_BUDGET_BYTES_MAX: number;
+/**
+ * Resolve the operation-peak session-context materialization budget from the
+ * `GJC_SESSION_CONTEXT_BUDGET_BYTES` override. Parsing is fail-closed: only a
+ * canonical positive-integer decimal value is honored; anything else (empty,
+ * non-numeric, negative, zero, overflowing a safe integer, or above the
+ * documented ceiling) falls back to the 512 MiB default and is surfaced as a
+ * warning so a dropped override is never silent.
+ */
+export declare function resolveSessionContextBudgetBytes(override: string | undefined): number;
 /** Operation-peak budget for one synchronous session-context materialization. */
 export declare const SESSION_CONTEXT_MATERIALIZATION_BUDGET_BYTES: number;
 /**
@@ -872,6 +968,7 @@ interface SessionManagerStateSnapshot {
     fileEntries: FileEntry[];
     materializedFileEntries: FileEntry[];
     adoptedArtifactManager: ArtifactManager | null;
+    coldRestoreFile?: string;
 }
 /** Benchmark-derived cap for strong materialized session snapshots. */
 export declare const MATERIALIZED_CACHE_MAX_BYTES: number;
@@ -883,6 +980,22 @@ export declare const SessionManagerTestHooks: {
     afterForkTranscriptPublished?: () => void | Promise<void>;
     beforeEphemeralArtifactManagerInstall?: (dir: string) => void | Promise<void>;
     beforePersistPatchFence?: (attempt: number) => void;
+    /** Internal first-open GC strategy override; omitted means current. */
+    firstOpenGcStrategy?: SessionMemoryGcStrategy;
+    /** Internal first-open secondary-artifact mode override; omitted means auto. */
+    secondaryArtifactMode?: SessionMemorySecondaryArtifactMode;
+    /** Test-only transcript threshold override for automatic routing. */
+    autoModeMinTranscriptBytesOverride?: number;
+    /** Test-only eager hydration ceiling override. */
+    eagerHydrationMaxBytesOverride?: number;
+    /** Test-only rolling-tail buffer override for tail-overflow coverage. */
+    sidecarTailBufferBytesOverride?: number;
+    /** Test-only counter proving complete-index allocation was not used. */
+    readAllColdEntryIndexesCalls?: number;
+    /** Test-only exact-reopen exception diagnostic. */
+    lastSidecarInitError?: string;
+    /** Test-only generated-ID cache capacity override. */
+    coldIdHashMaxEntriesOverride?: number;
 };
 /**
  * Freshness snapshot captured with every async whole-session persistence
@@ -908,7 +1021,6 @@ export declare class SessionManager {
     private cwd;
     private sessionDir;
     private readonly persist;
-    private readonly storage;
     private destination;
     private constructor();
     /**
@@ -919,6 +1031,10 @@ export declare class SessionManager {
     revisionSnapshot(): SessionManagerRevisionSnapshot;
     /** Puts a binary blob into the blob store and returns the blob reference */
     putBlob(data: Buffer): Promise<BlobPutResult>;
+    /** Capture rollback authority without materializing an active cold transcript. @internal */
+    captureRollbackState(): Promise<SessionManagerStateSnapshot>;
+    /** Restore a rollback snapshot, reopening cold authority instead of hydrating it. @internal */
+    restoreRollbackState(snapshot: SessionManagerStateSnapshot): Promise<void>;
     captureState(): SessionManagerStateSnapshot;
     restoreState(snapshot: SessionManagerStateSnapshot): void;
     /** Switch to a different session file (used for resume and branching). */
@@ -1015,7 +1131,7 @@ export declare class SessionManager {
     getSessionId(): string;
     getSessionFile(): string | undefined;
     getSessionMemoryStats(): SessionMemoryStats;
-    setSessionMemoryMode(mode: "off" | "shadow" | "enabled"): void;
+    setSessionMemoryMode(mode: SessionMemoryMode): void;
     acquireMemoryGuardParticipantIngressLease(): MemoryGuardParticipantIngressLease;
     createMemoryGuardCheckpoint(input: MemoryGuardCreateCheckpointInput): Promise<MemoryGuardSessionManagerCheckpointV1>;
     /**
@@ -1027,6 +1143,8 @@ export declare class SessionManager {
      */
     getArtifactsDir(): string | null;
     isManagedDestination(): boolean;
+    /** Retain the verified destination contract for bounded forks. @internal */
+    getDestinationForFork(): SessionDestination;
     /** Supplies opaque retained authority for mandatory managed legacy local migration. */
     getManagedLegacyLocalMigrationSource(): ManagedLegacyLocalMigrationSource | null;
     /**
@@ -1125,6 +1243,8 @@ export declare class SessionManager {
         reason?: string;
         thinkingLevel?: string | null;
     }): string;
+    /** Append an explicit role-model clear marker, preserving absence during replay. */
+    clearModelRole(role: string): string;
     /** Append session init metadata (for subagent debugging/replay). Returns entry id. */
     appendSessionInit(init: {
         systemPrompt: string;
@@ -1212,6 +1332,13 @@ export declare class SessionManager {
     getLastModelChangeRole(): string | undefined;
     evictCompactedContent(firstKeptEntryId: string, compactionEntryId: string): EvictCompactedContentResult;
     getObservabilityStatsForTests(): SessionManagerObservabilityStats;
+    /**
+     * Directory backing the resident *text* blob store, or undefined when the
+     * store is in-memory. The resident-cache root also holds the managed sidecar
+     * cache instance, so callers must not infer the text store from directory
+     * counts.
+     */
+    residentTextCacheDirForTests(): string | undefined;
     setSidecarHotSuffixBudgetForTests(bytes: number): void;
     parentChildrenCacheKeysForTests(): string[];
     parentArtifactEnabledForTests(): boolean;
@@ -1263,6 +1390,8 @@ export declare class SessionManager {
      * Get session header.
      */
     getHeader(): SessionHeader | null;
+    /** Whether this manager contains persisted history without forcing cold hydration. */
+    hasHistoryEntries(): boolean;
     getEntries(): SessionEntry[];
     /**
      * Get the session as a tree structure. Returns defensive copies of all entries.
@@ -1321,14 +1450,14 @@ export declare class SessionManager {
      * Fork a session into the current project directory.
      * Copies history from another session file while creating a new session file in the current sessionDir.
      */
-    static forkFrom(sourcePath: string, cwd: string, destinationInput?: SessionDestinationInput, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy, sessionMemoryMode?: "off" | "shadow" | "enabled"): Promise<SessionManager>;
+    static forkFrom(sourcePath: string, cwd: string, destinationInput?: SessionDestinationInput, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy, sessionMemoryMode?: SessionMemoryMode): Promise<SessionManager>;
     /**
      * Open a specific session file.
      * @param path Path to session file
      * @param sessionDir Optional session directory for /new or /branch. If omitted, derives from file's parent.
      */
-    static open(filePath: string, destinationInput?: SessionDestinationInput, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy, sessionMemoryMode?: "off" | "shadow" | "enabled"): Promise<SessionManager>;
-    static openNestedManaged(filePath: string, destination: SessionDestination, store: ManagedSessionDescendantStore, storage?: SessionStorage, cwdOverride?: string, sessionMemoryMode?: "off" | "shadow" | "enabled"): Promise<SessionManager>;
+    static open(filePath: string, destinationInput?: SessionDestinationInput, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy, sessionMemoryMode?: SessionMemoryMode): Promise<SessionManager>;
+    static openNestedManaged(filePath: string, destination: SessionDestination, store: ManagedSessionDescendantStore, storage?: SessionStorage, cwdOverride?: string, sessionMemoryMode?: SessionMemoryMode): Promise<SessionManager>;
     /**
      * List default-managed sessions for the resume picker without recovery or other
      * maintenance writes. This is the only picker inventory that includes legacy
@@ -1350,7 +1479,7 @@ export declare class SessionManager {
      * revalidate captured authority before destination initialization and transcript
      * persistence; destination history always comes from the captured bytes.
      */
-    static forkFromCaptured(snapshot: CapturedSessionTranscriptSnapshot, cwd: string, destinationInput?: SessionDestinationInput, _migrationPolicy?: SessionDirectoryMigrationPolicy, sessionMemoryMode?: "off" | "shadow" | "enabled"): Promise<StrictSessionForkResult>;
+    static forkFromCaptured(snapshot: CapturedSessionTranscriptSnapshot, cwd: string, destinationInput?: SessionDestinationInput, _migrationPolicy?: SessionDirectoryMigrationPolicy, sessionMemoryMode?: SessionMemoryMode): Promise<StrictSessionForkResult>;
     static restoreMemoryGuardCheckpoint(input: MemoryGuardRestoreInput): Promise<MemoryGuardRestoreResult>;
     /** Inspect a selected session without acquiring write-capable ownership. */
     static inspectSessionTailReadOnly(filePath: string, storage?: SessionStorage): Promise<ResumeTailInspection>;
@@ -1371,13 +1500,13 @@ export declare class SessionManager {
      * the returned discriminant; an error result never creates, rewrites, or adopts
      * the selected path. Breadcrumb ownership begins only after `kind: "opened"`.
      */
-    static openExistingStrict(identity: ResumeSessionIdentity, destinationInput?: SessionDestinationInput, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy, sessionMemoryMode?: "off" | "shadow" | "enabled"): Promise<StrictSessionOpenResult>;
+    static openExistingStrict(identity: ResumeSessionIdentity, destinationInput?: SessionDestinationInput, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy, sessionMemoryMode?: SessionMemoryMode): Promise<StrictSessionOpenResult>;
     /**
      * Continue the most recent session, or create new if none.
      * @param cwd Working directory
      * @param sessionDir Optional session directory. If omitted, uses default (~/.gjc/agent/sessions/<encoded-cwd>/).
      */
-    static continueRecent(cwd: string, destinationInput?: SessionDestinationInput, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy, sessionMemoryMode?: "off" | "shadow" | "enabled"): Promise<SessionManager>;
+    static continueRecent(cwd: string, destinationInput?: SessionDestinationInput, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy, sessionMemoryMode?: SessionMemoryMode): Promise<SessionManager>;
     /** Create an in-memory session (no file persistence) */
     static inMemory(cwd?: string, storage?: SessionStorage): SessionManager;
     /**

package/dist/types/session/session-storage.d.ts

@@ -62,6 +62,22 @@ export declare class SessionStorageWriterRetryableCloseError extends Error {
 export interface SessionStorageWriterCloseAdapter {
     close(fd: number): void;
 }
+/** Bounded buffered-writer capacity limits. */
+export declare const SESSION_STORAGE_BUFFERED_WRITER_MIN_BYTES: number;
+export declare const SESSION_STORAGE_BUFFERED_WRITER_MAX_BYTES: number;
+export declare const SESSION_STORAGE_BUFFERED_WRITER_DEFAULT_BYTES: number;
+/**
+ * Counters for a synchronous buffered sidecar writer. `bytesWritten` and
+ * `writeCalls` count operations against the backend, not calls accepted into
+ * the in-process buffer.
+ */
+export interface SessionStorageBufferedWriterInstrumentation {
+    readonly bytesSubmitted: number;
+    readonly bytesWritten: number;
+    readonly writeCalls: number;
+    readonly flushCalls: number;
+    readonly bufferedBytes: number;
+}
 /** Options for opening a {@link SessionStorageWriter}. */
 export interface SessionStorageWriterOpenOptions {
     flags?: "a" | "w";
@@ -70,6 +86,8 @@ export interface SessionStorageWriterOpenOptions {
     closeAdapter?: SessionStorageWriterCloseAdapter;
     /** Opaque authority for default-computed managed destinations only. */
     securityContext?: SessionStorageSecurityContext;
+    /** Enable bounded synchronous buffering for disposable sidecar writes. */
+    bufferSize?: number;
 }
 /**
  * Immutable authority attached only to a computed managed session destination.
@@ -127,6 +145,19 @@ export interface SessionStorageWriter {
     /** Stored error for non-success close states (`close_failed_retryable`/`close_unknown`). */
     getCloseError(): Error | undefined;
 }
+/** Synchronous byte-oriented writer with bounded buffering for disposable sidecars. */
+export interface SessionStorageBufferedWriter extends SessionStorageWriter {
+    /** Append already-serialized bytes; the caller's view may be reused on return. */
+    writeBytesSync(bytes: Uint8Array): void;
+    /** Flush pending bytes to the backend without synchronizing them to stable storage. */
+    flushSync(): void;
+    /** Flush pending bytes, then synchronize the backend. */
+    fsyncSync(): void;
+    /** Flush pending bytes, then close the backend descriptor. */
+    closeSync(): void;
+    /** Snapshot backend-write counters and current pending capacity. */
+    getInstrumentation(): SessionStorageBufferedWriterInstrumentation;
+}
 /** Upper bound for one staged line (excluding the trailing newline). */
 export declare const STAGED_WRITER_LINE_MAX_BYTES: number;
 /** Upper bound for aggregated different-length patches buffered for the publish-time overlay pass. */
@@ -166,6 +197,9 @@ export interface StagedStreamingWriter {
     /** Atomically publish the staged file at the destination only while it is absent. */
     publishNoReplace(): void;
 }
+export interface SessionStorageExclusiveLock {
+    releaseSync(): void;
+}
 export interface SessionStorage {
     ensureDirSync(dir: string): void;
     existsSync(path: string): boolean;
@@ -206,12 +240,18 @@ export interface SessionStorage {
      */
     deleteSessionVerified?(target: VerifiedSessionDeleteTarget): Promise<VerifiedSessionDeleteResult>;
     openWriter(path: string, options?: SessionStorageWriterOpenOptions): SessionStorageWriter;
+    /** Open a bounded synchronous byte-oriented writer for disposable sidecars. */
+    openBufferedWriter?(path: string, options?: SessionStorageWriterOpenOptions): SessionStorageBufferedWriter;
     /** Bounded recorded-length read with descriptor identity validation (additive). */
     readRangeSync?(path: string, start: number, length: number): SessionStorageRangeSnapshot;
     /** Async bounded recorded-length read with descriptor identity validation (additive). */
     readRange?(path: string, start: number, length: number): Promise<SessionStorageRangeSnapshot>;
     /** Open a staged streaming writer for one immutable one-shot destination (additive). */
     openStagedWriter?(path: string, options?: SessionStorageWriterOpenOptions): StagedStreamingWriter;
+    /** Acquire an owner-bound exclusive lock; returns undefined while another owner holds it. */
+    acquireExclusiveLockSync?(path: string, options?: {
+        securityContext?: SessionStorageSecurityContext;
+    }): SessionStorageExclusiveLock | undefined;
 }
 /** Exact authorization evidence for a transcript or artifact path. */
 export interface SessionStorageFileIdentity {
@@ -382,6 +422,9 @@ export declare function replaceSessionCommitMarkerCheckedSync(storage: SessionSt
 }): void;
 export declare class FileSessionStorage implements SessionStorage {
     #private;
+    acquireExclusiveLockSync(lockPath: string, options?: {
+        securityContext?: SessionStorageSecurityContext;
+    }): SessionStorageExclusiveLock | undefined;
     ensureDirSync(dir: string): void;
     existsSync(path: string): boolean;
     writeTextSync(fpath: string, content: string): void;
@@ -414,6 +457,7 @@ export declare class FileSessionStorage implements SessionStorage {
     unlink(path: string): Promise<void>;
     unlinkSync(path: string): void;
     openWriter(path: string, options?: SessionStorageWriterOpenOptions): SessionStorageWriter;
+    openBufferedWriter(path: string, options?: SessionStorageWriterOpenOptions): SessionStorageBufferedWriter;
     openStagedWriter(path: string, options?: SessionStorageWriterOpenOptions): StagedStreamingWriter;
     /**
      * Delete a session and sibling artifacts in an operator-selected explicit directory.
@@ -429,6 +473,9 @@ export declare class FileSessionStorage implements SessionStorage {
 }
 export declare class MemorySessionStorage implements SessionStorage {
     #private;
+    acquireExclusiveLockSync(lockPath: string, _options?: {
+        securityContext?: SessionStorageSecurityContext;
+    }): SessionStorageExclusiveLock | undefined;
     ensureDirSync(_dir: string): void;
     existsSync(path: string): boolean;
     writeBytesOwnedSync(path: string, content: Buffer): void;
@@ -462,6 +509,7 @@ export declare class MemorySessionStorage implements SessionStorage {
     deleteSessionWithArtifacts(sessionPath: string): Promise<void>;
     deleteSessionVerified(target: VerifiedSessionDeleteTarget): Promise<VerifiedSessionDeleteResult>;
     openWriter(path: string, options?: SessionStorageWriterOpenOptions): SessionStorageWriter;
+    openBufferedWriter(path: string, options?: SessionStorageWriterOpenOptions): SessionStorageBufferedWriter;
     openStagedWriter(path: string): StagedStreamingWriter;
 }
 /**

package/dist/types/setup/provider-onboarding.d.ts

@@ -34,12 +34,18 @@ interface ProviderPreset {
     compatibility: ProviderCompatibility;
     api: ProviderSetupApi;
     providerId: string;
-    baseUrl: string;
+    baseUrl?: string;
     apiKeyEnv: string;
     models?: readonly string[];
     modelApi?: Readonly<Record<string, ProviderSetupApi>>;
     compat?: ProviderCompatConfig;
     discovery?: ProviderDiscovery;
+    /**
+     * Parameterized presets (proxy gateways) do not hardcode a base URL or an
+     * unoverridable apiKeyEnv: the caller must supply `--base-url` and may
+     * override `--api-key-env`. `baseUrl` is absent for these presets.
+     */
+    parameterized?: boolean;
 }
 export declare const PROVIDER_PRESETS: readonly ProviderPreset[];
 export declare function getDefaultModelsPath(): string;

package/dist/types/slash-commands/builtin-registry.d.ts

@@ -5,6 +5,20 @@ export type { BuiltinSlashCommand, SubcommandDef } from "./types";
 export type BuiltinSlashCommandRuntime = TuiSlashCommandRuntime & {
     composer?: ComposerSubmissionOptions;
 };
+/**
+ * Resolve a `/model <selector>` argument against the merged model-profile
+ * registry. Returns the canonical profile name when `selector` is either a
+ * bare preset name (`codex-medium`) or a namespaced one
+ * (`gajae-code/codex-medium`); returns `undefined` otherwise so the caller
+ * falls through to ordinary model resolution.
+ *
+ * Only selectors that do NOT look like `provider/model` references are
+ * considered, so `/model anthropic/claude-...` is never hijacked by a preset.
+ */
+export declare function resolvePresetSelector(selector: string, modelRegistry: {
+    getModelProfile?: (name: string) => unknown;
+    getError?: () => unknown;
+}): string | undefined;
 export declare function formatUnknownBuiltinSlashCommandDiagnostic(commandName: string): string | undefined;
 /** Builtin command metadata used for slash-command autocomplete and help text. */
 export declare const BUILTIN_SLASH_COMMAND_DEFS: ReadonlyArray<BuiltinSlashCommand>;

package/dist/types/stt/setup.d.ts

@@ -1,3 +1,5 @@
+export declare function getRecorderInstallHint(platform?: NodeJS.Platform): string;
+export declare function formatSTTUsage(platform?: NodeJS.Platform, terminalProgram?: string | undefined): string;
 export interface STTDependencyStatus {
     recorder: {
         available: boolean;

package/dist/types/task/executor.d.ts

@@ -15,7 +15,7 @@ import { AgentRegistry } from "../registry/agent-registry";
 import type { ForkContextSeed } from "../session/agent-session";
 import type { ArtifactManager } from "../session/artifacts";
 import type { AuthStorage } from "../session/auth-storage";
-import { SessionManager } from "../session/session-manager";
+import { SessionManager, type SessionMemoryMode } from "../session/session-manager";
 import "../tools/yield";
 import type { ContextFileEntry } from "../tools";
 import type { EventBus } from "../utils/event-bus";
@@ -48,7 +48,15 @@ export interface ExecutorOptions {
      * if the resolved subagent model has no working credentials. See #985.
      */
     parentActiveModelPattern?: string;
+    /**
+     * Whether the live parent session has an active model profile. When set,
+     * persisted `task.agentModelOverrides` may resolve through preset-equivalent
+     * aliases (bare profile aliases re-resolve to an equivalent provider variant).
+     * Manual/direct parents (no active profile) keep exact resolution.
+     */
+    parentActiveModelProfile?: string;
     parentSessionId?: string;
+    parentCredentialSessionId?: string;
     thinkingLevel?: ThinkingLevel;
     outputSchema?: unknown;
     /** Parent task recursion depth (0 = top-level, 1 = first child, etc.) */
@@ -113,7 +121,7 @@ export interface ExecutorOptions {
 export declare class ManagedTaskPersistence {
     #private;
     constructor(artifacts: ArtifactManager, taskId: string);
-    openSession(cwd: string, sessionMemoryMode?: "off" | "shadow" | "enabled"): Promise<SessionManager>;
+    openSession(cwd: string, sessionMemoryMode?: SessionMemoryMode): Promise<SessionManager>;
     publishOutput(rawOutput: string, metadata: Uint8Array): Promise<void>;
 }
 export declare function createManagedTaskPersistence(artifacts: ArtifactManager, taskId: string): ManagedTaskPersistence;

package/dist/types/tools/browser/runtime-diagnostics.d.ts

@@ -0,0 +1,65 @@
+import type { CDPSession, Page } from "puppeteer-core";
+export interface BrowserRuntimeDiagnostic {
+    kind: "pageerror" | "console-error";
+    at: string;
+    url: string;
+    line?: number;
+    column?: number;
+    class?: string;
+}
+interface ExceptionThrownEvent {
+    exceptionDetails?: {
+        url?: string;
+        lineNumber?: number;
+        columnNumber?: number;
+        exception?: {
+            className?: string;
+        };
+    };
+}
+interface ConsoleCalledEvent {
+    type?: string;
+    stackTrace?: {
+        callFrames?: Array<{
+            url?: string;
+            lineNumber?: number;
+            columnNumber?: number;
+        }>;
+    };
+}
+/**
+ * Reduce a runtime-event URL to a persisted-safe location.
+ *
+ * http(s) URLs are emitted origin-only: path segments routinely carry tokens (signed
+ * URLs, invite/reset links, per-tenant identifiers), and diagnostics end up in tool
+ * results that are persisted and shareable. Non-parseable values are never echoed
+ * verbatim — known engine literals pass through, everything else becomes an
+ * irreversible bounded hash so entries stay correlatable without leaking.
+ */
+export declare function maskBrowserRuntimeUrl(value: string): string;
+export declare function pageErrorDiagnostic(event: ExceptionThrownEvent, fallbackUrl: string): BrowserRuntimeDiagnostic;
+export declare function consoleErrorDiagnostic(event: ConsoleCalledEvent, fallbackUrl: string): BrowserRuntimeDiagnostic | undefined;
+/**
+ * Serialize a drained mailbox into the tool-result text block.
+ *
+ * - Per-field: `url` is capped with a visible `…` marker; every other field is
+ *   structurally bounded (ISO timestamp, finite integers, allowlisted class).
+ * - Total: the serialized block is capped at `MAX_RUNTIME_DIAGNOSTICS_BLOCK_BYTES`.
+ *   When the budget is tight the oldest entries are shed (newest survive) and the
+ *   block carries an explicit `runtimeDiagnosticsTruncated: true` — truncation is
+ *   never silent.
+ */
+export declare function serializeRuntimeDiagnostics(drained: {
+    runtimeDiagnostics: BrowserRuntimeDiagnostic[];
+    runtimeDiagnosticsDropped: number;
+}): string;
+export declare class BrowserRuntimeDiagnosticsMailbox {
+    #private;
+    push(entry: BrowserRuntimeDiagnostic): void;
+    drain(): {
+        runtimeDiagnostics: BrowserRuntimeDiagnostic[];
+        runtimeDiagnosticsDropped: number;
+    };
+}
+export declare function instrumentBrowserRuntimeDiagnostics(page: Page, mailbox: BrowserRuntimeDiagnosticsMailbox): Promise<CDPSession>;
+export {};

package/dist/types/tools/browser/tab-protocol.d.ts

@@ -55,12 +55,16 @@ export type WorkerInitPayload = {
     url?: string;
     waitUntil?: "load" | "domcontentloaded" | "networkidle0" | "networkidle2";
     timeoutMs: number;
+    /** Opt-in bounded page runtime diagnostics (extra CDP session + Runtime events). */
+    runtimeDiagnostics?: boolean;
 } | {
     mode: "attach";
     browserWSEndpoint: string;
     safeDir: string;
     targetId: string;
     dialogs?: "accept" | "dismiss";
+    /** Opt-in bounded page runtime diagnostics (extra CDP session + Runtime events). */
+    runtimeDiagnostics?: boolean;
 };
 export type ToolReply = {
     ok: true;

package/dist/types/tools/browser/tab-supervisor.d.ts

@@ -49,6 +49,8 @@ export interface AcquireTabOptions {
     dialogs?: DialogPolicy;
     /** Owning session id so dispose can release only this session's tabs (F13). */
     ownerId?: string;
+    /** Opt-in bounded page runtime diagnostics (extra CDP session + Runtime events per tab). */
+    runtimeDiagnostics?: boolean;
     /** Internal recovery-only target id; makes a headless replacement attach, not open a page. */
     recoveryTargetId?: string;
     /** Recovery fence: replacement must not overwrite a tab installed after dead teardown. */

package/dist/types/tools/browser/tab-worker.d.ts

@@ -1,5 +1,6 @@
 import type { HTMLElement } from "linkedom";
 import type { ElementHandle } from "puppeteer-core";
+import { loadPuppeteerInWorker } from "./launch";
 import type { Transport } from "./tab-protocol";
 declare global {
     interface Element extends HTMLElement {
@@ -11,6 +12,7 @@ declare global {
         elementFromPoint(x: number, y: number): Element | null;
     };
 }
+export declare function __setLoadPuppeteerInWorkerForTest(loader: typeof loadPuppeteerInWorker | undefined): void;
 export declare class WorkerCore {
     #private;
     constructor(transport: Transport);

package/dist/types/tools/browser.d.ts

@@ -44,6 +44,7 @@ declare const browserSchema: z.ZodObject<{
         accept: "accept";
         dismiss: "dismiss";
     }>>;
+    diagnostics: z.ZodOptional<z.ZodBoolean>;
     code: z.ZodOptional<z.ZodString>;
     actions: z.ZodOptional<z.ZodArray<z.ZodObject<{
         verb: z.ZodEnum<{
@@ -158,6 +159,7 @@ export declare class BrowserTool implements AgentTool<typeof browserSchema, Brow
             accept: "accept";
             dismiss: "dismiss";
         }>>;
+        diagnostics: z.ZodOptional<z.ZodBoolean>;
         code: z.ZodOptional<z.ZodString>;
         actions: z.ZodOptional<z.ZodArray<z.ZodObject<{
             verb: z.ZodEnum<{