@gajae-code/coding-agent 0.15.6 → 0.16.1

package/dist/types/crash/record-loader.d.ts

@@ -1,3 +1,17 @@
+/**
+ * Crash-log record recovery.
+ *
+ * The crash log is an append-only text file written by concurrent processes; it
+ * is explicitly **not** a parseable database. The field corpus contains at least
+ * one interleaved record (two headers merged onto one line), and throwable text
+ * is arbitrary multiline content. Recovery therefore trusts only a complete
+ * v1 record whose terminal identity line matches a fingerprint recomputed from
+ * that record's own header and stack.
+ *
+ * Records written before that line existed are `unmatchable` and are never
+ * offered for reporting — no retroactive mining is attempted or claimed.
+ */
+import { type CrashProvenance } from "@gajae-code/utils";
 export interface LoadedCrashRecord {
     readonly fingerprint: string;
     readonly fpv: number;
@@ -9,6 +23,7 @@ export interface LoadedCrashRecord {
     readonly body: string;
     /** The `Name: message` part of the header line. */
     readonly headline: string;
+    readonly provenance?: CrashProvenance;
 }
 export declare function parseCrashRecords(contents: string): LoadedCrashRecord[];
 /** Complete v1 records whose marker fingerprint is recomputed from their diagnostic text. */

package/dist/types/extensibility/extensions/types.d.ts

@@ -14,6 +14,7 @@ import type { Api, AssistantMessageEvent, AssistantMessageEventStream, Context,
 import type { OAuthCredentials, OAuthLoginCallbacks } from "@gajae-code/ai/utils/oauth/types";
 import type * as piCodingAgent from "@gajae-code/coding-agent";
 import type { AutocompleteItem, Component, EditorTheme, KeyId, TUI } from "@gajae-code/tui";
+import type { JobFoldEvent } from "../../async/job-manager";
 import type { KeybindingsManager } from "../../config/keybindings";
 import type { ModelRegistry } from "../../config/model-registry";
 import type { ModelSelectorValue } from "../../config/model-selector-value";
@@ -319,7 +320,7 @@ export interface ExtensionContext {
     /** Run a control-surface mutation inside the session admission boundary. */
     withSdkControlMutation?<T>(body: () => Promise<T>): Promise<T>;
     cycleThinkingLevel(): ThinkingLevel | undefined;
-    setQueueMode(kind: "steering" | "follow_up" | "interrupt", mode: unknown): boolean;
+    setQueueMode(kind: "steering" | "follow_up" | "tool_interrupt", mode: unknown): boolean;
     getSkillState(): unknown;
     getConfigItems(): unknown;
     getBranchCandidates(): unknown;
@@ -333,6 +334,8 @@ export interface ExtensionContext {
         totalBytes: number;
     } | undefined>;
     getJobs(): unknown;
+    /** Subscribe to foreground-wait folds (`bash_folded`). Returns an unsubscribe function. */
+    onJobFold?(listener: (event: JobFoldEvent) => void): () => void;
     /** Typed skill and mode controls exposed to the SDK host. */
     invokeSkill?(name: string, args?: string, options?: {
         onPreflightAccepted?: () => void;
@@ -722,7 +725,7 @@ export interface UserPythonEventResult {
 export type { ToolResultEventResult } from "../shared-events";
 export interface BeforeAgentStartEventResult {
     message?: Pick<CustomMessage, "customType" | "content" | "display" | "details" | "attribution">;
-    /** Replace the system prompt for this turn. If multiple extensions return this, they are chained. */
+    /** Replace the system prompt for this turn. To append, spread event.systemPrompt into the returned array. */
     systemPrompt?: string[];
 }
 export type { SessionBeforeBranchResult, SessionBeforeCompactResult, SessionBeforeSwitchResult, SessionBeforeTreeResult, SessionCompactingResult, } from "../shared-events";
@@ -1138,7 +1141,7 @@ export interface ExtensionContextActions {
     getActiveModelProfile?: () => string | undefined;
     withSdkControlMutation?: <T>(body: () => Promise<T>) => Promise<T>;
     cycleThinkingLevel?: () => ThinkingLevel | undefined;
-    setQueueMode?: (kind: "steering" | "follow_up" | "interrupt", mode: unknown) => boolean;
+    setQueueMode?: (kind: "steering" | "follow_up" | "tool_interrupt", mode: unknown) => boolean;
     getSkillState?: () => unknown;
     getConfigItems?: () => unknown;
     getBranchCandidates?: () => unknown;
@@ -1152,6 +1155,8 @@ export interface ExtensionContextActions {
         totalBytes: number;
     } | undefined>;
     getJobs?: () => unknown;
+    /** Subscribe to foreground-wait folds so the SDK host can publish `bash_folded`. Returns an unsubscribe. */
+    onJobFold?: (listener: (event: JobFoldEvent) => void) => () => void;
     setSdkPermissionProvider?: (provider: ((toolCall: ClientBridgePermissionToolCall, options: ClientBridgePermissionOption[], signal?: AbortSignal) => Promise<ClientBridgePermissionOutcome>) | undefined) => void;
     setSdkClientBridge?: (bridge: ClientBridge | undefined) => void;
     sdkControl?: (operation: string, input: Record<string, unknown>) => unknown | Promise<unknown>;

package/dist/types/gjc-runtime/launch-worktree-reservation.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Cross-process reservation for a deterministic launch-worktree path.
+ *
+ * The durable session index is the long-lived ownership record, but a newly
+ * planned worktree has no index row yet. This reservation closes that interval:
+ * it is acquired before preparation and removed after `host_registered` is
+ * durably appended to the index.
+ */
+export interface LaunchWorktreeReservation {
+    release(): Promise<void>;
+}
+/** Test seam for seeding a dead-owner reservation at the exact production path. */
+export declare function launchWorktreeReservationDirectoryForTest(agentDir: string, worktreePath: string): string;
+/**
+ * Atomically claim `worktreePath`, returning `null` only when another live or
+ * unverified launch already owns the same deterministic target. A dead or
+ * PID-reused owner is reclaimed before retrying the exclusive directory create.
+ */
+export declare function reserveLaunchWorktree(agentDir: string, worktreePath: string): Promise<LaunchWorktreeReservation | null>;
+/** Remove the transient reservation only after the matching worktree is indexed. */
+export declare function releaseLaunchWorktreeReservationAfterRegistration(agentDir: string, worktreePath: string): Promise<void>;

package/dist/types/gjc-runtime/launch-worktree.d.ts

@@ -28,6 +28,19 @@ export interface GjcLaunchWorktreeResult extends GjcLaunchWorktreePlan {
     createdBranch: boolean;
     dirty?: boolean;
 }
+export interface LaunchWorktreeAbortOptions {
+    signal?: AbortSignal;
+    deadlineAt?: number;
+    now?: () => number;
+}
+export declare class WorktreePreparationTimeoutError extends Error {
+    readonly code = "worktree_preparation_timeout";
+    constructor(message?: string);
+}
+export declare class DependencyPreparationTimeoutError extends Error {
+    readonly code = "dependency_preparation_timeout";
+    constructor(message?: string);
+}
 /**
  * Pure core of {@link resolveWorktreeBucket}, exported for tests.
  *
@@ -41,11 +54,17 @@ export declare function planLaunchWorktree(cwd: string, mode: GjcLaunchWorktreeM
 };
 export declare function ensureLaunchWorktree(plan: GjcLaunchWorktreePlan | {
     enabled: false;
-}): GjcLaunchWorktreeResult | {
+}, options?: LaunchWorktreeAbortOptions): GjcLaunchWorktreeResult | {
     enabled: false;
 };
+export declare function ensureLaunchWorktreeCancellable(plan: GjcLaunchWorktreePlan | {
+    enabled: false;
+}, options?: LaunchWorktreeAbortOptions): Promise<GjcLaunchWorktreeResult | {
+    enabled: false;
+}>;
 /** Workspace worktrees must own their complete lockfile-resolved dependency graph (#4620). */
 export declare function ensureReusableNodeModules(sourceRoot: string, worktreePath: string): "symlink" | "present" | "missing";
+export declare function ensureReusableNodeModulesCancellable(sourceRoot: string, worktreePath: string, options?: LaunchWorktreeAbortOptions): Promise<"symlink" | "present" | "missing">;
 /** Result of {@link prepareLaunchWorktree}: the effective working directory, remaining args, and resolved worktree plan. */
 export interface PreparedLaunchWorktree {
     cwd: string;
@@ -55,3 +74,8 @@ export interface PreparedLaunchWorktree {
     };
 }
 export declare function prepareLaunchWorktree(cwd: string, args: string[]): PreparedLaunchWorktree;
+export declare function removeOwnedLaunchWorktree(plan: GjcLaunchWorktreePlan, receipt: {
+    created: boolean;
+    reused: boolean;
+    createdBranch: boolean;
+}): void;

package/dist/types/gjc-runtime/managed-owner-supervisor.d.ts

@@ -6,6 +6,8 @@ export declare const MANAGED_OWNER_GENERATION_ENV = "GJC_TMUX_OWNER_GENERATION";
 export declare const MANAGED_OWNER_STATE_DIR_ENV = "GJC_TMUX_OWNER_STATE_DIR";
 export declare const MANAGED_OWNER_RUN_ID_ENV = "GJC_MANAGED_OWNER_RUN_ID";
 export declare const MANAGED_OWNER_INCARNATION_ENV = "GJC_MANAGED_OWNER_INCARNATION";
+/** Suppresses command-derived durable artifacts for Broker-owned opaque spawn children. */
+export declare const MANAGED_OWNER_REDACT_COMMAND_ENV = "GJC_MANAGED_OWNER_REDACT_COMMAND";
 export interface ManagedOwnerBinding {
     schema_version: 2;
     generation: string;

package/dist/types/gjc-runtime/session-state-lock.d.ts

@@ -83,6 +83,8 @@ export declare const SessionStateLockTestHooks: {
     forcedQuarantineName?: string;
     /** @internal Observes bounded acquisition retries without changing their timing. */
     afterAcquireContention?: (lockFile: string, attempt: number, elapsedMs: number) => void;
+    /** @internal Runs after transition mkdir contention and before stale-claim inspection. */
+    afterTransitionClaimContention?: (transitionDir: string) => void | Promise<void>;
 };
 /** Raised when the lock could not be acquired; callers map it to their own refusal. */
 export type SessionStateLockUnavailableReason = "acquire_timeout" | "legacy_directory_owner_unprovenanced" | "lock_initialization_failed" | "lock_inspection_failed" | "lock_owner_live_or_unverifiable" | "lock_owner_record_fresh" | "lock_owner_record_unprovenanced" | "lock_release_failed" | "transition_claim_timeout" | "unsafe_lock_path_type";
@@ -100,6 +102,26 @@ export declare class SessionStateLockUnavailableError extends Error {
     readonly elapsedMs?: number;
     constructor(causeOrDetails?: unknown | SessionStateLockUnavailableDetails);
 }
+/**
+ * Log fields describing a persist failure: the error text plus, when a session state
+ * lock refusal sits anywhere in the cause chain, its typed `reason` and `lockPath`.
+ * Wrapping errors (`PreviousRuntimeStateReadError`, `AggregateError`) are searched
+ * so the actionable detail is never buried behind a generic message.
+ */
+export declare function sessionStateLockFailureFields(error: unknown): {
+    error: string;
+    reason?: SessionStateLockUnavailableReason;
+    lockPath?: string;
+};
+export declare const PERSIST_FAILURE_WARN_WINDOW_MS = 30000;
+/**
+ * Whether a persist failure should be logged at warn level. The first failure for each
+ * document and stable failure class in a 30s window warns; repeats are the caller's cue
+ * to log at debug instead.
+ */
+export declare function shouldWarnPersistFailure(key: string, error: unknown, now?: number): boolean;
+/** @internal Test seam: forget every persist-failure warn window. */
+export declare function resetPersistFailureWarnWindows(): void;
 /**
  * The identity-bound deletion primitives this lock is built on.
  *

package/dist/types/gjc-runtime/session-state-sidecar.d.ts

@@ -33,6 +33,13 @@ export declare const __sessionStateSidecarPerfCounters: {
     persistFromEventCalls: number;
     reset(): void;
 };
+/** Test-only barriers for deterministic rescope transaction race coverage. */
+export declare const __sessionStateSidecarTestHooks: {
+    afterRescopeLocksAcquired?: () => void | Promise<void>;
+    beforeRescopeJournalWrite?: (cwd: string) => void | Promise<void>;
+    beforePersistFromEvent?: (eventType: string, cwd: string) => void | Promise<void>;
+    beforeRescopePublish?: () => void | Promise<void>;
+};
 interface RuntimeStateEvent {
     type: string;
     messages?: unknown[];
@@ -168,6 +175,12 @@ export interface RuntimeStateContext {
     ownerTerminal?: OwnerTerminalContext | null;
     /** Internal fail-closed marker set only when managed owner metadata is malformed or missing. */
     ownerTerminalMetadataInvalid?: boolean;
+    /**
+     * The session file as it was BEFORE a committed rescope, used only by
+     * {@link relocateCoordinatorRuntimeStateForRescope} to authenticate the predecessor
+     * payload against its old identity. Absent outside a move.
+     */
+    previousSessionFile?: string | null;
 }
 export type TerminalRuntimeStateStatus = {
     terminal: true;
@@ -201,7 +214,59 @@ export declare function persistCoordinatorWorkerIntegrationOutcome(context: Runt
     correlationId?: string;
     error?: string;
 }): Promise<void>;
+export declare function prepareCoordinatorRuntimeStateRescope(input: {
+    moveId?: string;
+    sessionId: string;
+    previousCwd: string;
+    newCwd: string;
+    previousCwdIdentity?: {
+        dev: bigint;
+        ino: bigint;
+    };
+    newCwdIdentity?: {
+        dev: bigint;
+        ino: bigint;
+    };
+    previousSessionFile?: string | null;
+    newSessionFile?: string | null;
+}): Promise<string>;
+export declare function markCoordinatorRuntimeStateRescopePublishing(context: RuntimeStateContext, previousCwd: string, moveId: string): Promise<void>;
+export declare function clearCoordinatorRuntimeStateRescope(context: RuntimeStateContext, expectedMoveId?: string, previousCwd?: string): Promise<void>;
+/**
+ * Cheap synchronous probe for a pending rescope-recovery journal at this cwd. Sessions
+ * that never moved (the overwhelming majority) have none, so callers use this to avoid
+ * arming a startup-turn barrier for a no-op recovery \u2014 an armed barrier is not free even
+ * when it resolves immediately: it flips the session's startup gate from absent to present
+ * and reorders barrier-gated post-turn work.
+ */
+export declare function hasCoordinatorRuntimeStateRescopeJournal(context: RuntimeStateContext): boolean;
+export declare function recoverCoordinatorRuntimeStateRescope(context: RuntimeStateContext): Promise<void>;
+/**
+ * Repairs the coordinator-shared runtime state after a committed cwd rescope, for every
+ * move surface (`move_session`, TUI `/move`, SDK/ACP `session.cwd.move`) through the one
+ * shared {@link SessionManager.moveTo} seam.
+ *
+ * The identity fence in {@link assertPreviousRuntimeStateIdentity} rejects any write whose
+ * predecessor payload records a different cwd/workdir than the live session. A rescope
+ * changes the session cwd but leaves the predecessor payload pointing at the launch root,
+ * so every later persist for the session would be refused as a foreign marker.
+ *
+ * The predecessor is fully authenticated against its OLD identity before it is trusted:
+ * signed mode verifies the predecessor's key id and Ed25519 signature; unsigned mode
+ * requires an exact old cwd/workdir/session-file match (the same checks the fence applies).
+ * Only a predecessor that passes is rewritten to the new identity and re-signed. When the
+ * state file is cwd-derived rather than pinned by
+ * {@link GJC_COORDINATOR_SESSION_STATE_FILE_ENV}, the payload is migrated to the new path
+ * and the orphaned launch-root file is removed. A payload already self-healed at the new
+ * cwd is left untouched.
+ *
+ * Both the old and new cwd-derived paths are locked (new first, then old) so a concurrent
+ * writer at either path serializes behind this repair. Best-effort by contract: the move
+ * is already durable, so a failure here is logged by the caller and never resurfaced as a
+ * rescope rejection.
+ */
+export declare function relocateCoordinatorRuntimeStateForRescope(context: RuntimeStateContext, previousCwd: string): Promise<boolean>;
 export declare function ownerTerminalContextFromEnvironment(): OwnerTerminalContext | "invalid" | null;
 export declare function persistCoordinatorRuntimeStateFromPostmortem(reason: postmortem.Reason, context: RuntimeStateContext): Promise<void>;
-export declare function registerCoordinatorRuntimeStateFinalizer(context: RuntimeStateContext): () => void;
+export declare function registerCoordinatorRuntimeStateFinalizer(context: RuntimeStateContext, resolveContext?: () => RuntimeStateContext): () => void;
 export {};

package/dist/types/gjc-runtime/tmux-owner-isolation.d.ts

@@ -149,6 +149,7 @@ export interface TmuxOwnerIsolationExecutionDependencies {
     spawn(argv: string[], stdinLine?: string): {
         exitCode: number | null;
         stdout?: string;
+        stderr?: string;
     };
     probeServer(socketKey: string): TmuxServerProof;
     /** Reads the published owner generation immediately around direct execution. */

package/dist/types/gjc-runtime/tmux-sessions.d.ts

@@ -1,5 +1,23 @@
 import { type ProviderAuthority } from "./tmux-common";
 import { type OwnerIsolationProbeSync, type OwnerVerdict, type PlanResponse, type TmuxOwnerIsolationExecutionDependencies, type TmuxOwnerIsolationExecutionResult } from "./tmux-owner-isolation";
+export interface ManagedTmuxLaunchSpec {
+    childSessionId: string;
+    cwd: string;
+    argv: readonly string[];
+    env?: Readonly<Record<string, string>>;
+}
+export interface ManagedTmuxLaunchProof {
+    name: string;
+    nativeSessionId: string;
+    serverPid: number;
+    serverStartTime: string;
+    ownerGeneration: string;
+    sessionId: string;
+    sessionStateFile: string;
+    pid: number;
+    providerIdentity: string;
+    psmuxIncarnation?: string;
+}
 export interface GjcTmuxSessionStatus {
     name: string;
     attached: boolean;
@@ -73,9 +91,12 @@ export interface ForceCloseOwnerDependencies {
     listPanePids(sessionName: string, env: NodeJS.ProcessEnv): number[];
     /** Test/runtime seam for an exact owner-exit observer; durable validation remains authoritative. */
     waitForOwnerExitVerdict?(): Promise<OwnerVerdict>;
+    /** Broker close pin; production callers use this to reject reused session identity. */
+    expectedManagedProof?: ManagedTmuxLaunchProof;
 }
 export interface CreateGjcTmuxSessionOptions {
     platform?: NodeJS.Platform;
+    launch?: ManagedTmuxLaunchSpec;
 }
 export type CreateOwnerIsolationTestDependencies = {
     probe?: Partial<OwnerIsolationProbeSync>;
@@ -93,6 +114,12 @@ export declare function findGjcTmuxSessionByName(sessionName: string, env?: Node
 export declare function findGjcTmuxSessionByScope(project: string, branch: string | null | undefined, env?: NodeJS.ProcessEnv): GjcTmuxSessionStatus | undefined;
 export declare function statusGjcTmuxSession(sessionName: string, env?: NodeJS.ProcessEnv): GjcTmuxSessionStatus;
 export declare function createGjcTmuxSession(env?: NodeJS.ProcessEnv, options?: CreateGjcTmuxSessionOptions): GjcTmuxSessionStatus;
+/** Launches one Broker-owned child through the managed owner path and returns only re-proof inputs. */
+export declare function createManagedGjcTmuxSession(spec: ManagedTmuxLaunchSpec, env?: NodeJS.ProcessEnv, options?: Omit<CreateGjcTmuxSessionOptions, "launch">): ManagedTmuxLaunchProof;
+/** Re-proves every mutable multiplexer identity field before a Broker effect. */
+export declare function verifyManagedGjcTmuxSession(expected: ManagedTmuxLaunchProof, env?: NodeJS.ProcessEnv): "verified" | "mismatch" | "gone";
+/** Closes only an identity that passes the same exhaustive verification used for replay and reaping. */
+export declare function forceCloseManagedGjcTmuxSession(expected: ManagedTmuxLaunchProof, env?: NodeJS.ProcessEnv): Promise<GjcTmuxSessionStatus>;
 /** Proves a managed reusable name still resolves to one immutable session on one server. */
 export declare function proveGjcTmuxSessionMutationTarget(sessionName: string, env?: NodeJS.ProcessEnv, provisionalAuthority?: ProviderAuthority): ProvenTmuxSessionIdentity;
 /** @internal */

package/dist/types/main.d.ts

@@ -58,6 +58,7 @@ type StartupModelProfileArgs = {
     startupModel?: CreateAgentSessionOptions["model"];
     startupThinkingLevel?: CreateAgentSessionOptions["thinkingLevel"];
     preferCachedModels?: boolean;
+    preferCachedDefaultProfile?: boolean;
 };
 export declare function applyStartupModelProfiles(args: StartupModelProfileArgs): Promise<void>;
 export declare function applyStartupModelProfilesOrExit(args: StartupModelProfileArgs): Promise<void>;

package/dist/types/master-mode/context.d.ts

@@ -0,0 +1,21 @@
+import type { Args } from "../cli/args";
+export type MasterScope = "repo" | "pwd" | "global";
+/**
+ * Process-local master authority. Its capability accessor is deliberately the
+ * only way to reach the raw capability; this context is never serializable.
+ */
+export interface MasterModeContext {
+    readonly scope: MasterScope;
+    readonly ownerSessionId: string;
+    readonly attestationEpoch: string;
+    getCapability(): string;
+}
+export declare function createMasterModeContext(scope: MasterScope, ownerSessionId: string, attestationEpoch: string): MasterModeContext;
+/** Reject routes that cannot establish an interactive, durable master session. */
+export declare function assertMasterLaunchArgs(parsed: Args): void;
+export declare function assertMasterLaunchDisposition(input: {
+    master: boolean | undefined;
+    isInteractive: boolean;
+    autoPrint: boolean;
+    nonInteractiveError?: string;
+}): void;

package/dist/types/master-mode/first-request.d.ts

@@ -0,0 +1,34 @@
+import type { MasterScope } from "./context";
+import { type MasterPeerSnapshotLifecycle } from "./snapshot";
+export declare const MASTER_PEER_SNAPSHOT_CUSTOM_TYPE = "master-peer-snapshot";
+/** The injected message shape consumed by the agent-session contributor seam. */
+export interface MasterPeerSnapshotMessage {
+    customType: string;
+    content: string;
+    display: false;
+    attribution: "agent";
+}
+export interface MasterPeerSnapshotContributorInput {
+    readonly lifecycle: MasterPeerSnapshotLifecycle;
+    readonly ownerSessionId: string;
+    /** Current transcript/session identity; differs from ownerSessionId after a branch or switch. */
+    readonly getSessionId?: () => string;
+    readonly scope: MasterScope;
+    /** Live cwd accessor; resolved at injection time, not at registration. */
+    readonly getCwd: () => string;
+    /**
+     * Whether a prior injection was persisted to the session branch. A persisted
+     * block proves a first request was accepted, so later turns never duplicate
+     * it; a pre-accept cancellation persists nothing and the next attempt
+     * re-collects a fresh snapshot.
+     */
+    readonly hasPersistedInjection: () => boolean;
+    readonly onError?: (error: unknown) => void;
+}
+/**
+ * Builds the one-shot before-agent-start contributor that injects the scoped,
+ * no-probe master peer snapshot immediately before the first accepted provider
+ * request. Idle masters never collect: the snapshot is gathered only when a
+ * prompt actually starts.
+ */
+export declare function createMasterPeerSnapshotContributor(input: MasterPeerSnapshotContributorInput): () => Promise<MasterPeerSnapshotMessage | undefined>;

package/dist/types/master-mode/snapshot.d.ts

@@ -0,0 +1,32 @@
+import { type ResolvedScopeV1, type ScopeNameV1, type ScopeRequestV1, type SdkSearchResultV1, type SdkSearchRowV1 } from "../sdk/broker/session-scope";
+import type { SessionLifecycleActor, SessionListOutcome, SessionListRequest } from "../sdk/lifecycle/service";
+export type MasterPeerSnapshot = {
+    readonly status: SdkSearchResultV1["status"];
+    readonly scope: ResolvedScopeV1;
+    readonly observedAt: string;
+    readonly indexSeq?: number;
+    readonly rows: readonly SdkSearchRowV1[];
+    readonly truncated?: boolean;
+};
+/** The scoped Broker surface needed for the one-time master peer snapshot. */
+export interface MasterPeerSnapshotLifecycle {
+    list(request: Omit<SessionListRequest, "operation">): Promise<SessionListOutcome>;
+}
+export interface CollectMasterPeerSnapshotInput {
+    readonly lifecycle: MasterPeerSnapshotLifecycle;
+    readonly actor: SessionLifecycleActor;
+    readonly ownerSessionId: string;
+    readonly currentSessionId?: string;
+    readonly scope: ScopeNameV1;
+    readonly requestAnchor: ScopeRequestV1["requestAnchor"];
+    readonly timeoutMs?: number;
+}
+/**
+ * Collects the first-request peer snapshot through scoped Broker session.list.
+ * It deliberately has no Router or endpoint-probe dependency.
+ */
+export declare function collectMasterPeerSnapshot(input: CollectMasterPeerSnapshotInput): Promise<MasterPeerSnapshot>;
+/** Escapes untrusted metadata before it is placed in fixed prompt framing. */
+export declare function escapeMasterPeerSnapshotText(input: string): string;
+/** Renders the fixed, escaped prompt block for one master peer observation. */
+export declare function renderMasterPeerSnapshot(snapshot: MasterPeerSnapshot): string;

package/dist/types/modes/acp/acp-agent.d.ts

@@ -123,11 +123,11 @@ export declare function acpSessionStateFromConfig(query: unknown, modelCatalogQu
             readonly value: "one-at-a-time";
             readonly name: "One at a time";
         } | {
-            readonly value: "immediate";
-            readonly name: "Immediate";
+            readonly value: "abort_tools";
+            readonly name: "Abort running tools";
         } | {
-            readonly value: "wait";
-            readonly name: "Wait";
+            readonly value: "finish_tools";
+            readonly name: "Finish running tools";
         })[];
     } | {
         id: "thinking";
@@ -151,11 +151,11 @@ export declare function acpSessionStateFromConfig(query: unknown, modelCatalogQu
             readonly value: "one-at-a-time";
             readonly name: "One at a time";
         } | {
-            readonly value: "immediate";
-            readonly name: "Immediate";
+            readonly value: "abort_tools";
+            readonly name: "Abort running tools";
         } | {
-            readonly value: "wait";
-            readonly name: "Wait";
+            readonly value: "finish_tools";
+            readonly name: "Finish running tools";
         })[];
     } | {
         id: "steeringMode";
@@ -178,11 +178,11 @@ export declare function acpSessionStateFromConfig(query: unknown, modelCatalogQu
             readonly value: "one-at-a-time";
             readonly name: "One at a time";
         } | {
-            readonly value: "immediate";
-            readonly name: "Immediate";
+            readonly value: "abort_tools";
+            readonly name: "Abort running tools";
         } | {
-            readonly value: "wait";
-            readonly name: "Wait";
+            readonly value: "finish_tools";
+            readonly name: "Finish running tools";
         })[];
     } | {
         id: "followUpMode";
@@ -205,14 +205,14 @@ export declare function acpSessionStateFromConfig(query: unknown, modelCatalogQu
             readonly value: "one-at-a-time";
             readonly name: "One at a time";
         } | {
-            readonly value: "immediate";
-            readonly name: "Immediate";
+            readonly value: "abort_tools";
+            readonly name: "Abort running tools";
         } | {
-            readonly value: "wait";
-            readonly name: "Wait";
+            readonly value: "finish_tools";
+            readonly name: "Finish running tools";
         })[];
     } | {
-        id: "interruptMode";
+        id: "toolInterruptPolicy";
         name: string;
         type: "select";
         currentValue: string;
@@ -232,11 +232,11 @@ export declare function acpSessionStateFromConfig(query: unknown, modelCatalogQu
             readonly value: "one-at-a-time";
             readonly name: "One at a time";
         } | {
-            readonly value: "immediate";
-            readonly name: "Immediate";
+            readonly value: "abort_tools";
+            readonly name: "Abort running tools";
         } | {
-            readonly value: "wait";
-            readonly name: "Wait";
+            readonly value: "finish_tools";
+            readonly name: "Finish running tools";
         })[];
     })[];
     modes: {

package/dist/types/modes/components/frictionless-onboarding-selector.d.ts

@@ -1,5 +1,15 @@
 import { Container } from "@gajae-code/tui";
 import type { OnboardingProfile } from "../../setup/frictionless-onboarding";
+import { type UiLanguage } from "../ui-language";
+export declare const UI_LANGUAGE_CHOICES: readonly {
+    value: UiLanguage;
+    label: string;
+}[];
+export declare class InterfaceLanguageSelectorComponent extends Container {
+    #private;
+    constructor(onSelect: (language: UiLanguage) => void, onCancel: () => void);
+    handleInput(keyData: string): void;
+}
 export type FrictionlessOnboardingAction = "analyze" | "apply" | "skip" | "later" | "manual" | "manual-migration" | "manual-learn";
 export type FrictionlessOnboardingStage = "disclosure" | "manual" | "preview";
 export interface FrictionlessOnboardingCopy {

package/dist/types/modes/components/model-selector.d.ts

@@ -58,6 +58,10 @@ export declare class ModelSelectorComponent extends Container {
         smartRoutingPreview?: (draft: AutoroutingSetup) => SmartRoutingPreview;
         /** Open the smart-routing panel directly instead of the preset landing. */
         smartRoutingOnly?: boolean;
+        /** Test seam: synchronous persisted-dismissal check to avoid async render churn. */
+        isBillingDismissed?: (key: string) => boolean;
+        /** Test seam: record that a billing notice was shown/dismissed. */
+        markBillingDismissed?: (key: string) => void;
     });
     dispose(): void;
     refreshRoleAssignments(options?: {

package/dist/types/modes/components/oauth-selector.d.ts

@@ -14,6 +14,7 @@ export declare class OAuthSelectorComponent extends Container {
     #private;
     constructor(mode: "login" | "logout", authStorage: AuthStorage, onSelect: (providerId: string) => void, onCancel: () => void, options?: {
         validateAuth?: (providerId: string) => Promise<boolean>;
+        onValidationError?: (error: unknown) => boolean;
         requestRender?: () => void;
         externalCredentialCandidates?: ImportableCredential[];
     } & Partial<OAuthSelectorAccountOptions>);

package/dist/types/modes/components/session-selector.d.ts

@@ -1,5 +1,5 @@
 import { type Component, Container } from "@gajae-code/tui";
-import type { ResumeSessionIdentity, ResumeTailInspection, SessionInfo } from "../../session/session-manager";
+import { type ResumeSessionIdentity, type ResumeTailInspection, type SessionInfo } from "../../session/session-manager";
 export interface SelectedSession {
     kind: "selected";
     path: string;

package/dist/types/modes/components/sessions-dashboard.d.ts

@@ -1,10 +1,11 @@
 import { Container } from "@gajae-code/tui";
-import type { SessionInfo } from "../../session/session-manager";
+import { type SessionInfo } from "../../session/session-manager";
 export type SessionLiveness = "active" | "stale" | "unknown";
 export interface DashboardSession {
     id: string;
     cwd: string;
     title: string;
+    starred: boolean;
     modified: Date;
     messageCount: number;
     messageCountIsEstimate?: boolean;

package/dist/types/modes/components/status-line/model-name.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Shortest recognizable model label, derived purely from the model id.
+ *
+ * The rail and the footer both render this form, so a narrow terminal spends
+ * its cells on the part of the id that actually identifies the model:
+ *
+ *   `anthropic/claude-sonnet-4-5-20250929` -> `sonnet-4.5`
+ *   `openai/gpt-4o-2024-05-13`             -> `gpt-4o`
+ *   `google/gemini-3-pro`                  -> `gemini-3-pro`
+ *   `qwen2.5:7b`                           -> `qwen2.5:7b`
+ *
+ * Deliberately a pure heuristic with no curated override table: every provider
+ * in `models.json` must degrade sanely without per-model maintenance. The
+ * function never returns an empty string — an id that the heuristic would
+ * strip to nothing falls back to the previous, longer form.
+ */
+export declare const NO_MODEL_LABEL = "no-model";
+export declare function shortenModelId(rawId: string | undefined | null): string;

package/dist/types/modes/components/status-line/priority-row.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Narrow-width survival row for the status rail.
+ *
+ * The rail evicts segments continuously as the terminal narrows. Without this
+ * row the last thing left at very small widths is the `…+N` overflow marker —
+ * the three things a user actually needs (how much context is left, whether a
+ * goal is running, which model is answering) are exactly what the generic
+ * eviction throws away first or last by accident.
+ *
+ * This row keeps them, in priority order, by stepping each item down its own
+ * ladder instead of dropping it:
+ *
+ *   full form -> shortened form -> single glyph -> dropped
+ *
+ * Context % is never dropped and is the last survivor; the model name is
+ * dropped first of the three. The row is rendered as bare colored text with no
+ * group padding or end caps, so — like the overflow marker — it can survive at
+ * widths where a normal segment group cannot.
+ */
+import type { SegmentContext } from "./types";
+/** Which priority items the active layout is supposed to be carrying. */
+export interface PriorityItemSet {
+    context: boolean;
+    goal: boolean;
+    model: boolean;
+}
+/**
+ * Widest priority row that fits `width`, or null when even the minimal form
+ * cannot fit (callers then fall back to the overflow marker).
+ *
+ * Returns null when neither context nor goal is available: the model name alone
+ * is the lowest-priority item and never justifies replacing the normal rail.
+ */
+export declare function buildPriorityRow(ctx: SegmentContext, width: number, include: PriorityItemSet): string | null;