@gajae-code/coding-agent 0.14.2 → 0.15.0

package/dist/types/sdk/bus/kind-aware-reconciliation.d.ts

@@ -67,6 +67,8 @@ export interface KindAwareReconciliation {
     activeCount(kind: ReconciliationKind): number;
     /** Hydrate from durable store (call once at session host start). */
     hydrateFromStore(): Promise<void>;
+    /** Await quiescence of every admitted mutation and the durable store (#4743). */
+    drain(): Promise<void>;
 }
 export declare function createKindAwareReconciliation(options?: {
     now?: () => number;

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -268,8 +268,15 @@ export declare const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * reaction settlement for Telegram notification delivery (#4528).
  * Generation 169 delivers every ring-positioned session event live through the
  * bounded, capability-gated directed subscriber leg used by replay.
+ * Generation 172 fences the SessionRouter idle-poll/change-stamp rollout (#4689).
+ * The daemon constructs a SessionRouter, and the router's idle tick no longer
+ * re-acquires the machine-global session-index lock on every 2s pass: unchanged
+ * polls are stat-only and staleness retirement moved to a 30s sweep. A daemon
+ * still running the pre-#4689 router keeps the old hot polling loop and its
+ * lock contention, so an already-running owner must be replaced rather than
+ * retained across this upgrade.
  */
-export declare const DAEMON_GENERATION = 171;
+export declare const DAEMON_GENERATION = 172;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7
  * requires durable publication receipts and acknowledged attachment dispatch,
@@ -354,5 +361,8 @@ export declare const DAEMON_GENERATION = 171;
  * Epoch 85 removes direct relay attachment and prohibits lifecycle controls on every adapter.
  * Epoch 86 removes public discovery/client exports and retires cross-process raw transports.
  * Epoch 87 preserves accepted Telegram delivery ambiguity and advances poisoned poll cursors.
+ * Epoch 88 requires the #4689 SessionRouter idle-poll contract: generation alone
+ * does not force replacement, so the serving boundary advances to guarantee a
+ * pre-#4689 daemon cannot keep serving with the old per-tick locked rescan.
  */
-export declare const SERVING_EPOCH = 87;
+export declare const SERVING_EPOCH = 88;

package/dist/types/sdk/client/client.d.ts

@@ -50,8 +50,46 @@ export interface SdkRequestOptions {
     timeoutMs?: number;
     idempotencyKey?: string;
     confirm?: boolean;
+    /**
+     * Synchronous pre-send observer for one request. Called after the
+     * connection is live and validated, immediately before the frame is written
+     * to the socket. Throwing aborts the dispatch: nothing is written, no sent
+     * record is retained, and the request rejects with the thrown error, so the
+     * caller may safely retry (pre-send semantics).
+     */
+    beforeDispatch?: SdkBeforeDispatchHandler;
+    /**
+     * Synchronous dispatch-boundary observer for one request. Called immediately
+     * after the frame was handed to the socket — never before — and before any
+     * other client work. From this point a transport close before the response
+     * settles the request as `uncertain_after_send`; observer exceptions cannot
+     * alter that settlement.
+     */
+    onDispatch?: SdkDispatchHandler;
 }
 export type SdkFrame = Record<string, unknown>;
+/**
+ * Synchronous by contract. Returning a thenable (e.g. an `async` function) is a
+ * contract violation: pre-send the dispatch aborts retryably and the eventual
+ * rejection is sunk, never escaping to the process unhandled-rejection channel.
+ */
+export type SdkBeforeDispatchHandler = (request: SdkDispatchContext) => void;
+/**
+ * Synchronous by contract. A returned thenable's rejection is sunk; it can
+ * neither displace request settlement nor escape to the process
+ * unhandled-rejection channel.
+ */
+export type SdkDispatchHandler = (request: SdkDispatchContext) => void;
+/**
+ * Facts about one request at its dispatch boundary. `frame.id` is the exact
+ * correlated identity a response frame must carry to settle this request.
+ */
+export interface SdkDispatchContext {
+    readonly frame: SdkFrame;
+    /** Transport generation this request was written to. */
+    readonly connectionId: string | undefined;
+    readonly generation: number;
+}
 /** Request identity retained after an uncertain send for lifecycle reconciliation. */
 export interface SdkSentRecord {
     readonly id: string;
@@ -84,10 +122,7 @@ export declare class SdkClient {
     onReconnect(handler: SdkReconnectHandler): () => void;
     onReconnectFailed(handler: SdkReconnectFailedHandler): () => void;
     send(frame: SdkFrame): void;
-    request(frame: SdkFrame, timeout?: number | {
-        timeoutMs?: number;
-        idempotencyKey?: string;
-    }): Promise<SdkFrame>;
+    request(frame: SdkFrame, options?: number | SdkRequestOptions): Promise<SdkFrame>;
     close(): Promise<void>;
     control(operation: string, input?: Record<string, unknown>, options?: SdkRequestOptions): Promise<unknown>;
     query(query: string, input?: Record<string, unknown>, cursor?: string, options?: SdkRequestOptions): Promise<unknown>;

package/dist/types/sdk/host/host.d.ts

@@ -90,6 +90,7 @@ export declare class SessionSdkHost {
     handleMalformedFrame(connectionId: string, message: string): void;
     /** Adds an event to the resumable event ring. Transport delivery is owned by bus wiring. */
     emitEvent(frame: SdkFrame): EventFrame;
+    emitAutoroutingInactiveNotice(): EventFrame;
     start(): Promise<"started" | "already">;
     /**
      * Publish the readiness signal a prepared session withheld.

package/dist/types/sdk/host/internal-autorouting-state.d.ts

@@ -0,0 +1,3 @@
+export declare function markAutoroutingInactive(target: object): void;
+export declare function clearAutoroutingInactive(target: object): void;
+export declare function isAutoroutingInactive(target: unknown): boolean;

package/dist/types/sdk/host/model-pin.d.ts

@@ -0,0 +1,29 @@
+import type { AuthStorage } from "@gajae-code/ai/core";
+import { ModelRegistry } from "../../config/model-registry";
+import { Settings } from "../../config/settings";
+export interface SdkHostModelResolveContext {
+    cwd?: string;
+}
+/** Registry loader owned by the SDK host, not by machine-facing adapters. */
+export type SdkHostModelRegistryLoader = (context?: SdkHostModelResolveContext) => ModelRegistry | Promise<ModelRegistry>;
+/**
+ * Builds an offline model resolver for a single SDK host process.
+ *
+ * The registry is reused, but refreshed for every validation so additions and
+ * removals made while the broker is alive are observed without network I/O.
+ */
+export declare function createSdkHostModelRegistryLoader(discoverStorage: () => Promise<AuthStorage>, modelsPath?: string, loadSettings?: (context?: SdkHostModelResolveContext) => Promise<Pick<Settings, "get" | "getGlobal">>): SdkHostModelRegistryLoader;
+export type SdkHostModelResolution = {
+    ok: true;
+    model: string | null;
+} | {
+    ok: false;
+    reason: "unknown_model";
+    model: string;
+    error: string;
+};
+export type SdkHostModelResolver = (raw: unknown, context?: SdkHostModelResolveContext) => Promise<SdkHostModelResolution>;
+/** Resolve the explicit model pin at the SDK host boundary. */
+export declare function resolveSdkHostModel(raw: unknown, loadRegistry: SdkHostModelRegistryLoader, context?: SdkHostModelResolveContext): Promise<SdkHostModelResolution>;
+/** Default resolver used by the SDK broker host. */
+export declare function createDefaultSdkHostModelResolver(agentDir: string): SdkHostModelResolver;

package/dist/types/sdk/host/session-runtime.d.ts

@@ -165,9 +165,10 @@ export interface CreateSdkSessionRuntimeOptions {
         stateRoot: string;
         token: string;
     }): SessionSdkTransport | Promise<SessionSdkTransport>;
-    onSdkRequest?: SessionSdkHostOptions["onRequest"];
     /** Session settings; enables `config.patch` application on this runtime. */
     settings?: Settings;
+    /** Callback for diagnostics and lifecycle request observation. */
+    onSdkRequest?: SessionSdkHostOptions["onRequest"];
     /** Mutable shadow of patched config values merged into query readback. */
     configOverrides?: Map<string, unknown>;
     /** Private session-owned terminal-abort capabilities; never exposed on ExtensionContext. */

package/dist/types/sdk/lifecycle-session.d.ts

@@ -23,6 +23,19 @@ export type CreateLifecycleAgentSessionResult = {
  * unbounded LLM work, so deferral is an invariant rather than a caller choice.
  */
 export type CreateLifecycleAgentSessionOptions = Omit<CreateAgentSessionOptions, "deferMemoryBackendStartup"> & {
+    /**
+     * Explicit model pin (#4707): the coordinator-resolved `provider/model`
+     * selector, forwarded as {@link CreateAgentSessionOptions.modelPattern} so
+     * the session resolves it through the same staged selector resolver the CLI
+     * `--model` flag uses (after extension providers register).
+     *
+     * Resolution is strict: if this child's registry cannot resolve the pin to
+     * exactly this model, construction fails and the partial session is
+     * disposed instead of continuing into startup profile application, which
+     * would otherwise activate `modelProfile.default`/`mpreset` while the
+     * coordinator reports the requested pin.
+     */
+    modelId?: string;
     /**
      * Startup budget for ACP lifecycle MCP launches, in milliseconds. Set only
      * when the lifecycle request supplies `mcpServers`; ordinary consumers keep

package/dist/types/sdk/router/session-router.d.ts

@@ -1,4 +1,5 @@
 import { type SessionIndex } from "../broker/session-index";
+import { type SdkDispatchContext, type SdkDispatchHandler } from "../client/client";
 import { type ActivatedPreparedSession } from "../session-activation";
 /**
  * Exact identity of one attached SDK session endpoint. Providers persist it next to
@@ -23,6 +24,19 @@ export interface SessionAttachment {
     readonly generation: number;
     isCurrent(): boolean;
     send(frame: Record<string, unknown>): unknown;
+    /**
+     * Idempotent provider-lease heartbeat send that skips the pre-send authority
+     * reconcile (#4689).
+     *
+     * Optional so existing exported-capability implementations (including
+     * consumer-provided `resolveAttachment` callbacks on the Discord/Slack daemon
+     * options) stay source- and runtime-compatible (#4730 review). It is NOT a
+     * fail-open fallback: a caller that finds it absent must fail closed rather
+     * than route the heartbeat through `send()`, which would restore the 5s
+     * heartbeat-forced locked rescan this fix exists to remove. Router-owned
+     * attachments always provide it.
+     */
+    sendMaintenance?(leaseId: string): unknown;
     /** Revoke this exact capability after provider admission or replay fails closed. */
     retire?(): Promise<void>;
 }
@@ -57,6 +71,10 @@ export interface SessionRouterClient {
     connect?(): Promise<void>;
     request(frame: Record<string, unknown>, options?: {
         timeoutMs?: number;
+        /** Synchronous pre-send observer; a throw aborts the dispatch before the wire. */
+        beforeDispatch?: (context: SdkDispatchContext) => void;
+        /** Synchronous post-send boundary observer for transport-close-aware consumers. */
+        onDispatch?: (context: SdkDispatchContext) => void;
     }): Promise<Record<string, unknown>>;
     /** Current private transport connection identity, surfaced only through its exact attachment. */
     readonly connectionId?: string;
@@ -86,6 +104,8 @@ export interface SessionRouterDeps {
     createBrokerClient?: () => Promise<SessionRouterClient>;
     /** Receives only an opaque capability and correlated provider-neutral frames. */
     onFrame?: (attachment: SessionAttachment, frame: SessionRouterFrame) => Promise<void> | void;
+    /** Test/runtime observer invoked after a frame's delivery and cursor update settle. */
+    onFrameSettled?: (attachment: SessionAttachment, frame: SessionRouterFrame) => void;
     onAttachment?: (attachment: SessionAttachment) => Promise<void> | void;
     /** Called only after the opaque capability becomes externally current. */
     onAttachmentReady?: (attachment: SessionAttachment) => Promise<void> | void;
@@ -101,6 +121,8 @@ export interface SessionRouterDeps {
     clearInterval?: typeof clearInterval;
     setTimeout?: typeof setTimeout;
     clearTimeout?: typeof clearTimeout;
+    /** Test seam for the idle liveness-sweep cadence (#4689). */
+    idleSweepMs?: number;
 }
 export type SessionRouterProviderDeps = Pick<SessionRouterDeps, "createClient" | "createIndex" | "createBrokerClient" | "setInterval" | "clearInterval" | "setTimeout" | "clearTimeout" | "onReconciled">;
 export interface SessionRouterOptions {
@@ -127,7 +149,9 @@ export declare class SessionRouter {
     /** Starts reconciliation and the index watcher. */
     start(): Promise<void>;
     /** Exposed for deterministic callers and reconciliation tests. */
-    reconcile(): Promise<void>;
+    reconcile(options?: {
+        waitForReplay?: boolean;
+    }): Promise<void>;
     /** Ingests a credential-bearing Broker lifecycle result directly into Router custody. */
     adoptLifecycleResult(value: unknown, fallback: {
         sessionId: string;
@@ -139,6 +163,8 @@ export declare class SessionRouter {
     /** Sends an SDK command through the current attachment without exposing its client. */
     request(sessionId: string, frame: Record<string, unknown>, expectedGeneration?: number, expectedAttachment?: SessionAttachment, options?: {
         timeoutMs?: number;
+        beforeDispatch?: (context: SdkDispatchContext) => void;
+        onDispatch?: SdkDispatchHandler;
     }): Promise<Record<string, unknown>>;
     /** Resolves the exact provider-neutral binding authority for operator adoption. */
     bindingAuthority(sessionId: string): Promise<{

package/dist/types/sdk/session.d.ts

@@ -27,9 +27,12 @@ import { AuthStorage } from "../session/auth-storage";
 import { SessionManager } from "../session/session-manager";
 import { type StartupAuthConfigSnapshot } from "../session/startup-auth-config";
 import { type BuildSystemPromptResult } from "../system-prompt";
-import { BUILTIN_TOOLS, createTools, HIDDEN_TOOLS, type Tool, type ToolSession } from "../tools";
+import { type AutomationTools, BUILTIN_TOOLS, createTools, HIDDEN_TOOLS, type Tool, type ToolSession } from "../tools";
 import { EventBus } from "../utils/event-bus";
 import type { WorkspaceTree } from "../workspace-tree";
+export type { AutomationToolName, AutomationTools } from "../tools";
+/** Capture the cursor edit grant before the model-facing edit entry is removed. */
+export declare function captureCursorEditTool<T>(toolRegistry: ReadonlyMap<string, unknown>, createReplaceTool: () => T): T | undefined;
 /**
  * Reconcile a resumed transcript that ends on an unpaired tool call.
  *
@@ -103,6 +106,13 @@ export interface CreateAgentSessionOptions {
     startupAuthConfig?: StartupAuthConfigSnapshot;
     /** Custom tools to register (in addition to built-in tools). Accepts both CustomTool and ToolDefinition. */
     customTools?: (CustomTool | ToolDefinition)[];
+    /**
+     * Host-owned implementations for the built-in `browser` and `computer`
+     * surfaces. These are materialized as built-ins, retain built-in provenance
+     * and activation behavior, and receive cancellation through AgentTool's
+     * AbortSignal. A matching custom or extension tool is rejected.
+     */
+    automationTools?: AutomationTools;
     /** Explicit parent/phase used to load active GJC sub-skill tools for this session. */
     gjcSubskillToolContext?: {
         parent: string;

package/dist/types/session/agent-session.d.ts

@@ -86,7 +86,6 @@ import type { SessionSwitchEvent } from "../extensibility/shared-events";
 import { type Skill, type SkillWarning } from "../extensibility/skills";
 import { type FileSlashCommand } from "../extensibility/slash-commands";
 import { type MemoryGuardClaimsLease } from "../gjc-runtime/memory-guard-owner-claims";
-import { GjcTeamWorkerHeartbeatReporter } from "../gjc-runtime/team-worker-heartbeat";
 import { GoalRuntime } from "../goals/runtime";
 import type { Goal, GoalModeState } from "../goals/state";
 import type { HindsightSessionState } from "../hindsight/state";
@@ -237,11 +236,6 @@ export interface AgentSessionConfig {
     workerIntegrationRequest?: (signal: AbortSignal) => Promise<void>;
     /** Bound terminal worker-integration settlement for embedded hosts and deterministic lifecycle tests. */
     workerIntegrationTimeoutMs?: number;
-    /**
-     * Override the runtime-owned `gjc team` worker heartbeat reporter. Defaults to a
-     * reporter derived from the team worker environment, or none outside a worker pane.
-     */
-    teamWorkerHeartbeatReporter?: GjcTeamWorkerHeartbeatReporter;
     /** Loaded skills (already discovered by SDK) */
     skills?: Skill[];
     /** Skill loading warnings (already captured by SDK) */
@@ -647,6 +641,18 @@ export declare class AgentSession {
         skill: string;
         session_id?: string;
     } | undefined;
+    /**
+     * Live prompt marker or restored durable workflow — the effective state the
+     * cwd-local mutation guard must honor after resume.
+     */
+    getEffectiveActiveWorkflowSkillState(): {
+        skill: string;
+        sessionId: string;
+    } | undefined;
+    /** Replace the session-owned MCP manager after a cwd rescope. */
+    replaceOwnedMcpManager(next: MCPManager | undefined): Promise<void>;
+    /** Swap named custom/project tools after a cwd rescope. */
+    replaceNamedCustomTools(previousNames: readonly string[], nextTools: CustomTool[]): Promise<void>;
     /** Best-effort accessor for the active skill's `current_phase` field from
      *  its persisted mode-state file. Used by the `skill` tool to enforce the
      *  terminal-phase chain guard. Returns undefined when no active skill is
@@ -1055,6 +1061,19 @@ export declare class AgentSession {
     };
     /** Number of pending messages (includes steering, follow-up, and next-turn messages) */
     get queuedMessageCount(): number;
+    /**
+     * Number of pending messages a user-facing drain can actually deliver back:
+     * exactly the steering and follow-up queues that `clearQueue()`,
+     * `popLastQueuedMessage()`, and `getQueuedMessageEntries()` operate on.
+     *
+     * Hidden next-turn context is deliberately excluded. Those entries are
+     * authored by the agent (e.g. a `todo_write` failure reminder queued with
+     * `deliverAs: "nextTurn"` and no `triggerTurn`), are never returned by the
+     * drain handlers, and deliberately survive turn completion — so a UI gate
+     * that counted them would report permanently pending work that no key press
+     * can clear, locking the user out of their own input (#4741).
+     */
+    get drainableQueuedMessageCount(): number;
     /** Typed pending-message counts per queue (steering, follow-up, next-turn). */
     get pendingMessageCounts(): {
         steering: number;
@@ -1086,6 +1105,17 @@ export declare class AgentSession {
     get skillsSettings(): SkillsSettings | undefined;
     /** Skills loaded by SDK (always includes bundled GJC workflow defaults unless explicitly overridden by SDK callers) */
     get skills(): readonly Skill[];
+    /**
+     * Install the skill set discovered at a newly rescoped cwd (`move_session`).
+     * Project-scoped skills belong to the directory they were discovered in, so
+     * they must not survive a move out of it.
+     */
+    replaceSkills(skills: Skill[]): Promise<void>;
+    /**
+     * Retire the cached workspace tree after a rescope so the next turn re-scans
+     * at the new cwd instead of re-presenting the abandoned launcher root.
+     */
+    retireWorkspaceTreeForRescope(): void;
     /** Skill loading warnings captured by SDK */
     get skillWarnings(): readonly SkillWarning[];
     getTodoPhases(): TodoPhase[];

package/dist/types/session/artifacts.d.ts

@@ -55,7 +55,11 @@ export declare class ArtifactManager {
     /**
      * @param dir Directory that will hold artifact files. Created lazily on first save.
      */
-    constructor(target: string | ManagedSessionDescendantStore);
+    constructor(target: string | ManagedSessionDescendantStore, options?: {
+        readonly attemptId?: string;
+        readonly stagingParentStore?: ManagedSessionDescendantStore;
+        readonly stagingRelativePath?: string;
+    });
     /**
      * Artifact directory path.
      * Directory may not exist until first artifact is saved.
@@ -108,6 +112,17 @@ export declare class ArtifactManager {
      * Returns empty array if directory doesn't exist.
      */
     listFiles(): Promise<string[]>;
+    getAttemptId(): string | undefined;
+    getAllocatedIds(): readonly string[];
+    /** Create an isolated artifact manager rooted below this manager's staging area. */
+    createAttemptStaging(attemptId: string): ArtifactManager;
+    /** Reserve and publish a candidate's staged artifacts with a contiguous parent ID block. */
+    commitAttemptStaging(staging: ArtifactManager, attemptId: string, options?: {
+        beforePublish?: (mapping: ReadonlyMap<string, string>) => Promise<void> | void;
+    }): Promise<ReadonlyMap<string, string>>;
+    rollbackLastAttemptCommit(attemptId?: string): Promise<void>;
+    finalizeLastAttemptCommit(attemptId?: string): void;
+    discardAttemptStaging(): Promise<void>;
     /** Persist exact UTF-8 text for heap-eviction rehydration. */
     publishExactText(text: string, options?: ArtifactPublishOptions): Promise<ArtifactPublishOutcome>;
     readRange(id: string, range?: ArtifactByteRange): Promise<string>;

package/dist/types/session/internal/managed-session-storage.d.ts

@@ -29,6 +29,7 @@ export declare class ManagedCommittedMutationError extends Error {
     readonly operation: "replace" | "append";
     constructor(operation: "replace" | "append", cause: unknown);
 }
+/** A managed move outcome that reports whether the mutation is known not to have committed. */
 export declare class ManagedTreeMoveOutcomeError extends Error {
     readonly stagingCleanupSafe: boolean;
     constructor(message: string, stagingCleanupSafe: boolean);
@@ -218,6 +219,12 @@ export declare class ManagedSessionDescendantStore {
     /** Copy an exact captured tree into an absent managed destination. */
     importTree(sourceRelativePath: string, destinationRelativePath: string, snapshot: NativeDirectoryTreeSnapshot): Promise<void>;
     moveTreeNoReplace(sourceRelativePath: string, destinationRelativePath: string, expected: NativeDirectoryTreeSnapshot): NativeDirectoryTreeSnapshot;
+    /** Move one exact managed regular file to an absent destination through retained authority. */
+    moveFileNoReplace(sourceRelativePath: string, destinationRelativePath: string, expected: ManagedFileSnapshot, options?: {
+        /** Subtree store bound to the source's directory; keeps the verification read basename-scoped when this store lacks retained authority. */
+        sourceStore: ManagedSessionDescendantStore;
+        sourceStoreRelativePath: string;
+    }): ManagedFileSnapshot;
     removeTreeExpected(relativePath: string, expected: NativeDirectoryTreeSnapshot): void;
     fsyncTree(): NativeDirectoryTreeSnapshot;
 }

package/dist/types/session/session-manager.d.ts

@@ -1,4 +1,5 @@
 import * as crypto from "node:crypto";
+import * as fs from "node:fs";
 import { type AgentMessage } from "@gajae-code/agent-core";
 import type { ConfiguredModelChainEntry as SharedConfiguredModelChainEntry } from "@gajae-code/agent-core/compaction";
 import type { ImageContent, Message, MessageAttribution, ServiceTier, TextContent } from "@gajae-code/ai/core";
@@ -972,6 +973,12 @@ export declare function materializeResidentEntriesThrowingForTests<T>(entries: T
     sessionFile?: string;
 }): T[];
 export declare function materializeResidentEntriesForPersistenceForTests<T>(entries: T[], textStore: BlobStore, imageStore?: BlobStore): T[];
+/**
+ * Discover resumable transcripts intentionally stored inside a project's `.gjc`.
+ * Runtime token/audit JSONL files are excluded by requiring a known transcript
+ * container (`agent-session` or `sessions`).
+ */
+export declare function listProjectSessionTranscriptFiles(cwd: string): string[];
 /** Get recent sessions for display in welcome screen */
 export declare function getRecentSessions(sessionDir: string, limit?: number, storage?: SessionStorage): Promise<RecentSessionInfo[]>;
 export declare function getRecentSessionDisplay(sessions: readonly SessionInfo[], limit?: number): Array<{
@@ -1149,12 +1156,66 @@ export declare class SessionManager {
         newSessionFile: string;
     } | undefined>;
     copyArtifactsForFork(oldSessionFile: string, newSessionFile: string): Promise<ForkArtifactPublication | undefined>;
+    /**
+     * Serialize every cwd transition (model, TUI, SDK/ACP). Re-entry is allowed
+     * only for the async context that already owns the lock — unrelated callers
+     * queue on the tail instead of skipping it.
+     */
+    runExclusiveCwdTransition<T>(fn: () => Promise<T>): Promise<T>;
+    /**
+     * Run `fn` under a shared read lease on `cwd`.
+     *
+     * Tools that resolve relative paths against the session cwd must hold this
+     * lease across their WHOLE execution, not merely re-check a generation before
+     * they start: the check-then-yield shape lets a move commit inside the tool's
+     * first `await`, so a command admitted for root A would execute in root B.
+     * Writers wait for outstanding leases to drain, so the cwd observed at lease
+     * acquisition stays authoritative until the lease is released.
+     */
+    runWithCwdReadLease<T>(fn: () => Promise<T>): Promise<T>;
+    /** Wait for any in-flight exclusive cwd transition to settle. */
+    joinCwdTransition(): Promise<void>;
+    getCwdGeneration(): number;
+    static openNoFollowDirectory(dir: string): Promise<fs.promises.FileHandle>;
+    /**
+     * Claim process-cwd authority for `manager` when it is unowned or the prior
+     * owner has been collected. Returns whether `manager` holds the claim.
+     */
+    static claimProcessCwdOwnership(manager: SessionManager): boolean;
+    static isProcessCwdOwner(manager: SessionManager): boolean;
+    static releaseProcessCwdOwnership(manager: SessionManager): void;
+    /**
+     * Verify that `process.cwd()` is the directory pinned by `expectedIdentity`.
+     *
+     * `process.chdir` resolves a NAME, so a path replaced after the last
+     * name-based comparison lands the process outside the validated directory —
+     * the exact confinement `move_session` exists to enforce. Node exposes no
+     * `fchdir`, so the handle cannot be the chdir authority directly; comparing
+     * the resulting cwd's identity to the pinned handle closes the same gap.
+     */
+    static assertProcessCwdIdentity(expectedIdentity: {
+        dev: bigint;
+        ino: bigint;
+    }): Promise<void>;
     /**
      * Move the session to a new working directory.
      * Moves session files and artifacts on disk, updates all internal references,
      * and rewrites the session header with the new cwd.
+     *
+     * All callers (model `move_session`, TUI `/move`, SDK/ACP `session.cwd.move`)
+     * share this exclusive transition so concurrent moves cannot interleave.
      */
-    moveTo(newCwd: string): Promise<void>;
+    moveTo(newCwd: string, options?: {
+        expectedIdentity?: {
+            dev: bigint;
+            ino: bigint;
+        };
+        targetHandle?: {
+            stat: (opts: {
+                bigint: true;
+            }) => Promise<fs.BigIntStats>;
+        };
+    }): Promise<void>;
     isPersisted(): boolean;
     stageDefaultModelSelection(model: string, thinkingLevel: string | undefined, options?: {
         readonly appendThinkingLevel: boolean;
@@ -1215,7 +1276,7 @@ export declare class SessionManager {
      * Adopt an externally-owned ArtifactManager. Used by subagents to share
      * the parent session's artifact directory and ID counter.
      */
-    adoptArtifactManager(manager: ArtifactManager): void;
+    adoptArtifactManager(manager: ArtifactManager, parent?: ArtifactManager): void;
     /** Release only the matching externally adopted manager. */
     releaseArtifactManager(manager: ArtifactManager): void;
     /** Temporarily release adopted authority while an outer transition validates its successor. */
@@ -1354,6 +1415,8 @@ export declare class SessionManager {
      * Use sparingly (e.g., pruning old tool outputs).
      */
     rewriteEntries(): Promise<void>;
+    /** Remap artifact references in an unpublished candidate before its publication fence. */
+    remapStagedArtifactReferences(idMap: ReadonlyMap<string, string>): Promise<void>;
     /**
      * Append a custom message entry (for extensions) that participates in LLM context.
      * @param customType Hook identifier for filtering on reload
@@ -1520,6 +1583,25 @@ export declare class SessionManager {
      * @param path Path to session file
      * @param sessionDir Optional session directory for /new or /branch. If omitted, derives from file's parent.
      */
+    /** Open an unpublished candidate transcript below the reserved staging directory. */
+    static openStaged(finalSessionFile: string, storage?: SessionStorage, attemptId?: string): Promise<SessionManager>;
+    /** Managed-authority variant of {@link openStaged}. */
+    static stagedNestedManaged(finalSessionFile: string, destination: SessionDestination, store: ManagedSessionDescendantStore, storage?: SessionStorage, attemptId?: string): Promise<SessionManager>;
+    /** Publish the candidate-owned staged transcript and artifacts at the real accept fence. */
+    static openStagedNestedManaged(finalSessionFile: string, destination: SessionDestination, store: ManagedSessionDescendantStore, storage?: SessionStorage, attemptId?: string): Promise<SessionManager>;
+    commitStaged(options?: {
+        deferArtifactFinalize?: boolean;
+    }): Promise<void>;
+    /** Finalize a staged publication whose post-fence publisher completed successfully. */
+    finalizeStagedCommit(): void;
+    /** Roll back a staged publication when post-fence visibility setup fails. */
+    rollbackCommittedStaged(): Promise<void>;
+    /** Refresh the owned final snapshot after post-fence session metadata is appended. */
+    refreshStagedCommitSnapshot(): Promise<void>;
+    /** Idempotently remove an unpublished staged transcript and its owned artifacts. */
+    discardStaged(): Promise<void>;
+    commitStagedNestedManaged(): Promise<void>;
+    discardStagedNestedManaged(): Promise<void>;
     static open(filePath: string, destinationInput?: SessionDestinationInput, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy, sessionMemoryMode?: SessionMemoryMode): Promise<SessionManager>;
     static openNestedManaged(filePath: string, destination: SessionDestination, store: ManagedSessionDescendantStore, storage?: SessionStorage, cwdOverride?: string, sessionMemoryMode?: SessionMemoryMode): Promise<SessionManager>;
     /**

package/dist/types/session/session-staging-paths.d.ts

@@ -0,0 +1,3 @@
+export declare const SESSION_STAGING_DIRNAME: ".staging";
+/** True when a path is an immediate child of the reserved session staging directory. */
+export declare function isStagedSessionPath(filePath: string): boolean;

package/dist/types/skill-state/canonical-skills.d.ts

@@ -1,3 +1,3 @@
 /** Native-free canonical GJC workflow skill identifiers. */
-export declare const CANONICAL_GJC_WORKFLOW_SKILLS: readonly ["deep-interview", "ralplan", "ultragoal", "team"];
+export declare const CANONICAL_GJC_WORKFLOW_SKILLS: readonly ["deep-interview", "ralplan", "ultragoal", "autoresearch"];
 export type CanonicalGjcWorkflowSkill = (typeof CANONICAL_GJC_WORKFLOW_SKILLS)[number];

package/dist/types/skill-state/workflow-hud.d.ts

@@ -53,26 +53,6 @@ interface UltragoalHudState extends WorkflowGateHudState {
     };
     updatedAt?: string;
 }
-interface TeamHudWorker {
-    id: string;
-    status?: string;
-}
-interface TeamHudState extends WorkflowGateHudState {
-    phase: string;
-    task_total: number;
-    task_counts: Record<string, number>;
-    workers: TeamHudWorker[];
-    updated_at?: string;
-    latestEvent?: {
-        type?: string;
-        worker?: string;
-        message?: string;
-    };
-    latestMessage?: {
-        from_worker?: string;
-        body?: string;
-    };
-}
 export declare function buildDeepInterviewHudSummary(state: DeepInterviewHudState): WorkflowHudSummary;
 export interface DeepInterviewHudDeriveOptions {
     phase?: string;
@@ -87,6 +67,17 @@ export interface DeepInterviewHudDeriveOptions {
  */
 export declare function deriveDeepInterviewHud(payload: Record<string, unknown>, options?: DeepInterviewHudDeriveOptions): WorkflowHudSummary;
 export declare function buildRalplanHudSummary(state: RalplanHudState): WorkflowHudSummary;
+export interface AutoresearchHudState extends WorkflowGateHudState {
+    phase: string;
+    mode?: string;
+    intake?: string;
+    slug?: string;
+    specPath?: string;
+    verdict?: string;
+    experimentCount?: number;
+    experimentStatuses?: string[];
+    updatedAt?: string;
+}
+export declare function buildAutoresearchHudSummary(state: AutoresearchHudState): WorkflowHudSummary;
 export declare function buildUltragoalHudSummary(state: UltragoalHudState): WorkflowHudSummary;
-export declare function buildTeamHudSummary(state: TeamHudState): WorkflowHudSummary;
 export {};

package/dist/types/skill-state/workflow-mutation-guard.d.ts

@@ -4,6 +4,7 @@ export declare const DEEP_INTERVIEW_MUTATION_BLOCK_MESSAGE = "Deep-interview pha
 export declare const WORKFLOW_STATE_MUTATION_BLOCK_MESSAGE = ".gjc workflow state and artifacts are runtime-owned. Agent mutation tools cannot edit `.gjc/**`; use the sanctioned `gjc` CLI instead.";
 export declare const RALPLAN_MUTATION_BLOCK_MESSAGE = "Ralplan planning phase boundary: keep refining the consensus plan and persist plan artifacts through `gjc ralplan --write` (stage scratch files under a temp dir if needed). Product-code mutation tools and patch execution are blocked while ralplan is active; mutate only after the plan is approved and execution begins.";
 export declare const ULTRAGOAL_GOAL_PLANNING_MUTATION_BLOCK_MESSAGE = "Ultragoal goal-planning phase boundary: finish goal planning and record goals through `gjc ultragoal` before editing code. Product-code mutation tools and patch execution are blocked until goal planning completes and execution begins.";
+export declare const AUTORESEARCH_MUTATION_BLOCK_MESSAGE = "Autoresearch research-only boundary: this workflow produces findings, evidence, and a verdict \u2014 never product code. Product-code mutation tools and patch execution are blocked everywhere, on every branch. Mission research artifacts (`autoresearch.sh` at the workdir root and mission state through the sanctioned `gjc autoresearch` CLI) stay writable; run experiments through the `python` tool, or finish the mission and hand off to an approved implementation workflow.";
 type ToolWithEditMode = AgentTool & {
     mode?: unknown;
     customWireName?: unknown;

package/dist/types/slash-commands/helpers/autorouting-status.d.ts

@@ -0,0 +1,8 @@
+import { type AutoroutingEffective, type AutoroutingProvenance } from "../../config/autorouting-contract";
+export type AutoroutingStatusSnapshot = {
+    effective: AutoroutingEffective;
+    tiers: unknown;
+    provenance: AutoroutingProvenance | undefined;
+};
+/** Render settings-derived autorouting state without consulting registry/auth. */
+export declare function buildAutoroutingStatusReport(snapshot: AutoroutingStatusSnapshot): string;