@gajae-code/coding-agent 0.15.6 → 0.16.1

package/dist/types/sdk/client/client.d.ts

@@ -90,12 +90,13 @@ export interface SdkDispatchContext {
     readonly connectionId: string | undefined;
     readonly generation: number;
 }
-/** Request identity retained after an uncertain send for lifecycle reconciliation. */
+/** Request identity retained after an uncertain send. */
 export interface SdkSentRecord {
     readonly id: string;
     readonly operation?: string;
     readonly idempotencyKey?: string;
-    readonly fingerprint: string;
+    /** Present for lifecycle lookups; `session.spawn` replays through its idempotency key. */
+    readonly fingerprint?: string;
 }
 export type SdkFrameHandler = (frame: SdkFrame) => void;
 export type SdkReconnectHandler = () => void;

package/dist/types/sdk/host/control/dispatch.d.ts

@@ -31,5 +31,15 @@ export declare class BusyError extends TypedControlError {
     constructor(message?: string);
 }
 export declare function controlRequestFromFrame(frame: Record<string, unknown>): ControlRequest;
+export interface TerminalAbortIdentity {
+    input: {
+        mode: "terminal";
+        scope: "turn" | "owned";
+        operator?: true;
+    };
+    inputHash: string;
+}
+/** One strict, capability-free identity shared by dispatch, durable admission, and delivery observation. */
+export declare function terminalAbortIdentity(input: unknown, operatorAuthorized: boolean): TerminalAbortIdentity | undefined;
 /** Dispatches a registry-defined per-session control operation. */
 export declare function dispatchControl(surface: ControlSurface, registryRow: Operation | undefined, request: ControlRequest): Promise<ControlResponse>;

package/dist/types/sdk/host/control/index.d.ts

@@ -1,2 +1,2 @@
-export { BusyError, type ControlError, type ControlErrorCode, type ControlRequest, type ControlResponse, controlRequestFromFrame, dispatchControl, TypedControlError, } from "./dispatch";
+export { BusyError, type ControlError, type ControlErrorCode, type ControlRequest, type ControlResponse, controlRequestFromFrame, dispatchControl, type TerminalAbortIdentity, TypedControlError, terminalAbortIdentity, } from "./dispatch";
 export type { AbortScope, ControlInput, ControlSurface, ControlValue } from "./operations";

package/dist/types/sdk/host/control/operations.d.ts

@@ -10,6 +10,8 @@ export type AbortScope = "turn" | "owned";
 export interface TerminalAbortInput {
     mode: "terminal";
     scope?: AbortScope;
+    /** Broker-authorized local override; public SDK callers cannot grant this authority. */
+    operator?: boolean;
 }
 export type ControlInput = Record<string, unknown>;
 /**

package/dist/types/sdk/host/control/runtime-gate.d.ts

@@ -1,15 +1,26 @@
 /**
- * Private field carried only on the Broker's endpoint close request.
+ * Private fields carried only on Broker-authorized endpoint controls.
  *
- * The value is the lifecycle effect marker bound to the serving process. It is
- * never published in endpoint discovery or lifecycle service results; callers
- * that do not hold the Broker's indexed lifecycle record cannot satisfy this
- * gate.
+ * Their values are lifecycle effect markers bound to the serving process. They
+ * are never published in endpoint discovery or lifecycle service results;
+ * callers that do not hold the Broker's indexed lifecycle record cannot satisfy
+ * either gate.
  */
 export declare const BROKER_RUNTIME_CLOSE_CAPABILITY_FIELD = "__gjcBrokerCloseCapability";
+/** Private field carried only on the Broker-authorized terminal-abort request. */
+export declare const BROKER_RUNTIME_ABORT_CAPABILITY_FIELD = "__gjcBrokerAbortCapability";
 export declare function brokerRuntimeCloseCapability(input: unknown): string | undefined;
-/** Remove the private close capability before a request is exposed to diagnostics. */
-export declare function redactBrokerRuntimeCloseCapability(frame: Record<string, unknown>): Record<string, unknown>;
+export declare function brokerRuntimeAbortCapability(input: unknown): string | undefined;
+/** Remove private Broker capabilities before a request is exposed to diagnostics. */
+export declare function redactBrokerRuntimeCapabilities(frame: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Strips caller content from a request frame before it reaches a diagnostic
+ * observer. Known protocol operation names and finite enum values survive so
+ * instrumentation stays useful; caller-chosen ids and all other values are
+ * redacted, including nested objects, so a field this module has never heard
+ * of cannot leak.
+ */
+export declare function redactObservedRequestContent(frame: Record<string, unknown>): Record<string, unknown>;
 /**
  * Runtime-local authority check for the Broker-only graceful close executor.
  *
@@ -17,3 +28,6 @@ export declare function redactBrokerRuntimeCloseCapability(frame: Record<string,
  * environment. Generic SDK requests never receive that private marker.
  */
 export declare function hasBrokerRuntimeCloseCapability(input: unknown): boolean;
+/** Test-only override for the abort gate; production authority remains process-local. */
+export declare function setBrokerRuntimeAbortCapabilityForTest(capability: string | undefined): void;
+export declare function hasBrokerRuntimeAbortCapability(input: unknown): boolean;

package/dist/types/sdk/host/events.d.ts

@@ -1,6 +1,7 @@
 import type { SdkFrame } from "./types";
 export interface EventFrame extends SdkFrame {
     type: "event";
+    revision?: number;
     generation: number;
     seq: number;
 }

package/dist/types/sdk/host/host.d.ts

@@ -64,6 +64,16 @@ export interface SessionSdkHostOptions extends HostEndpointAdapters {
      * that fails is never read as authorization.
      */
     activationGate?: SessionActivationGate;
+    /** Private one-shot master-capability verification; never durable or public SDK surface. */
+    masterCapabilityVerify?: (frame: {
+        nonce: unknown;
+        attestationEpoch: unknown;
+        capability: unknown;
+    }) => {
+        ok: boolean;
+        nonce: string;
+        attestationEpoch: string;
+    };
 }
 /** Shared by the replay filter and transport live broadcasts: a connection
  *  must see the same capability-gated event kinds on both legs, or live and

package/dist/types/sdk/host/query/cursor.d.ts

@@ -15,6 +15,7 @@ export interface CursorEnvelope {
     issuedAt?: number;
     /** TTL metadata minted by `CursorRegistry.grant`: wall-clock ms when the cursor expires. */
     expiresAt?: number;
+    purpose?: "checkpoint";
     position: unknown;
     direction: string;
     pageShape: unknown;
@@ -46,6 +47,7 @@ export interface CursorQueryContext {
     resourceId?: string;
     direction: string;
     pageShape: unknown;
+    purpose?: "checkpoint";
 }
 export declare class CursorError extends Error {
     readonly code: "cursor_expired" | "invalid_cursor" | "invalid_input" | "resource_gone" | "snapshot_capacity_exceeded";
@@ -64,13 +66,13 @@ export declare class CursorRegistry {
     private readonly now;
     constructor(sessionToken: string | Uint8Array, revisions: RevisionStore, now?: () => number);
     grant(connectionId: string, envelope: CursorEnvelope, resourceKind: string, resourceId: string): Promise<string>;
-    exchange(cursor: string, connectionId: string, expected: CursorQueryContext, resourceKind: string, resourceId: string): Promise<{
+    exchange(cursor: string, connectionId: string, expected: CursorQueryContext, _resourceKind: string, resourceId: string): Promise<{
         cursor: string;
         envelope: CursorEnvelope;
     }>;
     consume(cursor: string, connectionId: string, expected: CursorQueryContext): CursorEnvelope;
     release(cursor: string): void;
     close(): void;
-    sweep(): void;
+    sweep(exceptCursor?: string, at?: number): void;
     get size(): number;
 }

package/dist/types/sdk/host/query/handlers.d.ts

@@ -105,6 +105,7 @@ export interface SdkCheckpointRecord {
     revision: number;
     generation: number;
     seq: number;
+    idle: boolean;
 }
 export declare function isCheckpointRecord(value: unknown): value is SdkCheckpointRecord;
 export declare class QueryHandlers {

package/dist/types/sdk/host/query/revision-store.d.ts

@@ -55,6 +55,7 @@ export declare class RevisionStore {
         offset: number;
     } | undefined>;
     pin(cursorId: string, resourceKind: string, resourceId: string, id: string): Promise<void>;
+    transferPin(sourceCursorId: string, replacementCursorId: string): void;
     unpin(cursorId: string): void;
     sweep(): void;
     close(): Promise<void>;

package/dist/types/sdk/host/session-runtime.d.ts

@@ -1,10 +1,29 @@
 import { type Settings } from "../../config/settings";
 import type { ExtensionAPI, ExtensionContext } from "../../extensibility/extensions";
+import { type MasterRoleAttestationV2, SessionIndex, type SessionLocatorV2 } from "../broker/session-index";
+import type { SdkPromptTerminalOutcome } from "../prompt-status";
+import { type ReceiptState } from "../receipt-state";
 import { type TurnResultContent } from "../turn-result";
 import { SessionSdkHost, type SessionSdkHostOptions } from "./host";
 import { type SessionSurface } from "./query";
 import { type SdkCapabilities, type SdkSurfacePolicy } from "./surface-policy";
 import type { BrokerIndexWriter, SdkFrame } from "./types";
+export type MasterCapabilityReplayState = Map<string, number>;
+export declare function verifyMasterCapabilityFrame(input: {
+    frame: {
+        nonce: unknown;
+        attestationEpoch: unknown;
+        capability: unknown;
+    };
+    expectedCapability: string | undefined;
+    expectedEpoch: string | undefined;
+    replay: MasterCapabilityReplayState;
+    now?: number;
+}): {
+    ok: boolean;
+    nonce: string;
+    attestationEpoch: string;
+};
 /** Transport-neutral endpoint contract consumed by the SDK session runtime. */
 export interface SessionSdkTransport {
     readonly sessionId: string;
@@ -27,6 +46,8 @@ export interface SessionSdkRuntimeOptions extends Omit<SessionSdkHostOptions, "s
     settings?: Settings;
     /** Mutable shadow of patched config values merged into query readback. */
     configOverrides?: Map<string, unknown>;
+    /** Stable master lineage identity retained across session switches/branches. */
+    masterOwnerSessionId?: string;
 }
 export interface SdkOnlyInvocationRecord extends InvocationCorrelation {
     kind: InvocationKind | "terminal" | "steer";
@@ -39,6 +60,8 @@ export interface SdkOnlyInvocationRecord extends InvocationCorrelation {
         code: string;
         message: string;
     };
+    content?: TurnResultContent;
+    receiptState?: Exclude<ReceiptState, "absent">;
     outcome?: unknown;
     pendingOutcome?: unknown;
     skillName?: string;
@@ -161,6 +184,8 @@ export interface CreateSdkSessionRuntimeOptions {
     agentDir: string;
     /** Lifecycle-owned sessions require broker publication before they become usable. */
     brokerRegistrationRequired?: boolean;
+    /** Trusted broker-issued lifecycle marker bound to lifecycle host index events. */
+    lifecycleRequestId?: string;
     createTransport(input: {
         sessionId: string;
         stateRoot: string;
@@ -172,6 +197,12 @@ export interface CreateSdkSessionRuntimeOptions {
     onSdkRequest?: SessionSdkHostOptions["onRequest"];
     /** Mutable shadow of patched config values merged into query readback. */
     configOverrides?: Map<string, unknown>;
+    /** In-memory master capability for private broker verification only. */
+    masterCapability?: string;
+    /** Opaque direct-role epoch this effective host may adopt. */
+    masterAttestationEpoch?: string;
+    /** Stable master lineage identity retained across session switches/branches. */
+    masterOwnerSessionId?: string;
     /** Private session-owned terminal-abort capabilities; never exposed on ExtensionContext. */
     terminalAbortSeams?: SdkOnlyTerminalAbortSeams;
     /** Callback when a frame is admitted to the runtime (test harness). */
@@ -180,6 +211,8 @@ export interface CreateSdkSessionRuntimeOptions {
     onLifecycleDrainTimeoutForTests?: () => void;
     /** Test-only observation of bounded failure-diagnostic deduplication state. */
     onFailureDiagnosticKeyCountForTests?: (count: number) => void;
+    /** Test-only observation after a resolved invocation completion is reconciled. */
+    onInvocationCompletionReconciledForTests?: (kind: InvocationKind, correlation: InvocationCorrelation) => void;
 }
 export interface InvocationCorrelation {
     commandId: string;
@@ -187,6 +220,14 @@ export interface InvocationCorrelation {
 }
 export type InvocationKind = "prompt" | "skill" | "steer";
 type InvocationStatus = "accepted" | "in_flight" | "terminal_ok" | "failed" | "uncertain";
+type InvocationOutcome = SdkPromptTerminalOutcome;
+type InvocationOutcomeInput = {
+    kind: string;
+    reason?: unknown;
+    code?: unknown;
+    message?: unknown;
+    provenance?: unknown;
+};
 export interface InvocationReconciliation {
     /** Shared v2 reconciliation owner; present for durable terminal admission. */
     readonly store?: SdkOnlyReconciliationStore;
@@ -197,11 +238,7 @@ export interface InvocationReconciliation {
         type: "agent_start" | "agent_end";
         content?: TurnResultContent;
         hasActivity?: boolean;
-        outcome?: {
-            kind: "stopped";
-            reason: "cancelled";
-            provenance: "client_cancel";
-        };
+        outcome?: InvocationOutcome;
     } | {
         type: "agent_failed";
         error: unknown;
@@ -224,18 +261,8 @@ export interface InvocationReconciliation {
         deadlineMaxAt?: number;
     }>;
     hydrate(): Promise<void>;
-    claimPendingOutcome(kind: InvocationKind, correlation: InvocationCorrelation, outcome: {
-        kind: string;
-        code: string;
-        message: string;
-        provenance?: string;
-    }): Promise<unknown>;
-    finalizeOutcome(kind: InvocationKind, correlation: InvocationCorrelation, outcome?: {
-        kind: string;
-        code: string;
-        message: string;
-        provenance?: string;
-    }, arg4?: (() => boolean) | {
+    claimPendingOutcome(kind: InvocationKind, correlation: InvocationCorrelation, outcome: InvocationOutcomeInput): Promise<InvocationOutcome>;
+    finalizeOutcome(kind: InvocationKind, correlation: InvocationCorrelation, outcome?: InvocationOutcomeInput, arg4?: (() => boolean) | {
         code: string;
         message: string;
     }, arg5?: unknown, arg6?: {
@@ -276,6 +303,7 @@ export interface SdkSurfaceFactoryOptions {
         clientRef?: string;
     }) => unknown;
     hostTools?: boolean | (() => boolean);
+    getRuntimeHost?: () => SessionSdkHost | undefined;
 }
 /** Shared policy, capability, and query-surface factory for every SDK transport. */
 export interface SdkSurfaceFactory {
@@ -293,6 +321,31 @@ export declare function createSdkSurfaceFactory(options: SdkSurfaceFactoryOption
 }): SdkSurfaceFactory;
 /** Register the default-session notification command without loading notification adapters. */
 export declare function registerSdkOnlyNotificationCommand(api: ExtensionAPI): void;
+export declare function masterAttestationForEffectiveHost(input: {
+    masterCapability: string | undefined;
+    attestationEpoch: string | undefined;
+    ownerSessionId?: string;
+    sessionId: string;
+    pid: number;
+    processIncarnation: string | undefined;
+    direct: MasterRoleAttestationV2 | undefined;
+}): MasterRoleAttestationV2 | undefined;
+/**
+ * Establish direct master authority for the session currently hosted by this
+ * process. Session identity transitions retain the master capability and epoch
+ * but require a new direct attestation before their effective endpoint can
+ * adopt that authority.
+ */
+export declare function reattestMasterSessionIdentity(input: {
+    index: SessionIndex;
+    locator: SessionLocatorV2;
+    masterCapability: string | undefined;
+    attestationEpoch: string | undefined;
+    ownerSessionId?: string;
+    sessionId: string;
+    pid: number;
+    processIncarnation: string | undefined;
+}): Promise<MasterRoleAttestationV2 | undefined>;
 /** Install a complete SDK host for a session when notifications are inactive. */
 export declare function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: CreateSdkSessionRuntimeOptions): void;
 export {};

package/dist/types/sdk/lifecycle/broker-client.d.ts

@@ -6,3 +6,9 @@ export declare class AgentDirSessionLifecycleClient implements SessionLifecycleC
     global(operation: SessionLifecycleOperation, input: Record<string, unknown>, options: SessionLifecycleClientRequestOptions): Promise<unknown>;
 }
 export declare function createBrokerSessionLifecycleService(agentDir: string): SessionLifecycleService;
+/**
+ * Dedicated dispatch for the local master `session.spawn` surface. It shares
+ * the lifecycle client's credential boundary but bypasses the generic mutation
+ * outcome types: spawn responses are validated by the caller's allowlist.
+ */
+export declare function dispatchSpawnGlobal(agentDir: string, input: Record<string, unknown>, idempotencyKey: string, timeoutMs: number): Promise<unknown>;

package/dist/types/sdk/lifecycle/service.d.ts

@@ -1,3 +1,4 @@
+import { type ScopeRequestV1, type SdkSearchResultV1 } from "../broker/session-scope";
 export type SessionLifecycleOperation = "session.create" | "session.fork" | "session.resume" | "session.close" | "session.delete" | "session.reconcile_uncertain" | "session.list";
 export interface SessionLifecycleActor {
     readonly id: string;
@@ -104,6 +105,9 @@ export interface SessionDeleteTarget {
 export interface SessionListTarget {
     readonly cwd?: string;
     readonly resolveSessionId?: string;
+    readonly scope?: ScopeRequestV1;
+    readonly limit?: number;
+    readonly cursor?: string;
 }
 interface SessionLifecycleMutationRequestBase<TOperation extends Exclude<SessionLifecycleOperation, "session.list">, TTarget> {
     readonly operation: TOperation;
@@ -141,7 +145,12 @@ export interface SessionLifecycleListEntry {
     readonly live?: boolean;
     readonly endpointGeneration?: number;
     readonly terminalUncertain?: boolean;
-    readonly repo?: string;
+    readonly cwd?: string;
+    readonly locator?: {
+        readonly cwd: string;
+        readonly worktreeRoot: string | null;
+        readonly stateRoot: string;
+    };
 }
 export interface SessionLifecycleListResult {
     readonly indexSeq: number;
@@ -149,6 +158,7 @@ export interface SessionLifecycleListResult {
     readonly warnings: readonly string[];
     readonly savedSession?: SessionLifecycleSavedSession;
 }
+export type SessionScopedListResult = SdkSearchResultV1;
 export interface SessionCreateResult {
     readonly ok: true;
     readonly operation: "session.create";
@@ -182,7 +192,7 @@ export interface SessionReconcileUncertainResult {
 export interface SessionListSuccessResult {
     readonly ok: true;
     readonly operation: "session.list";
-    readonly result: SessionLifecycleListResult;
+    readonly result: SessionLifecycleListResult | SessionScopedListResult;
 }
 export interface SessionLifecycleError {
     readonly code: string;
@@ -229,6 +239,7 @@ export type SessionListFailure = {
     readonly operation: "session.list";
     readonly certainty: SessionLifecycleCertainty;
     readonly error: SessionLifecycleError;
+    readonly result?: SessionScopedListResult;
 };
 export type SessionCreateOutcome = SessionCreateResult | SessionCreateFailure;
 export type SessionForkOutcome = SessionForkResult | SessionForkFailure;
@@ -254,7 +265,8 @@ export declare function validateSessionLifecycleMutationRequest(request: unknown
 export declare class SessionLifecycleService {
     #private;
     constructor(client: SessionLifecycleClient);
-    execute(request: SessionLifecycleMutationRequest): Promise<SessionCreateOutcome | SessionForkOutcome | SessionResumeOutcome | SessionCloseOutcome | SessionDeleteOutcome | SessionReconcileUncertainOutcome>;
+    scopedList(scope: ScopeRequestV1, limit?: number, cursor?: string): Promise<SessionListOutcome>;
+    execute(request: SessionLifecycleMutationRequest, idempotencyKeyOverride?: string): Promise<SessionCreateOutcome | SessionForkOutcome | SessionResumeOutcome | SessionCloseOutcome | SessionDeleteOutcome | SessionReconcileUncertainOutcome>;
     executeWithIdempotencyKey(request: SessionLifecycleMutationRequest, idempotencyKey: string): Promise<SessionCreateOutcome | SessionForkOutcome | SessionResumeOutcome | SessionCloseOutcome | SessionDeleteOutcome | SessionReconcileUncertainOutcome>;
     create(request: Omit<SessionCreateRequest, "operation">): Promise<SessionCreateOutcome>;
     fork(request: Omit<SessionForkRequest, "operation">): Promise<SessionForkOutcome>;

package/dist/types/sdk/lifecycle-session.d.ts

@@ -1,4 +1,4 @@
-import type { AgentSession } from "../session/agent-session";
+import { type AgentSession } from "../session/agent-session";
 import { type CreateAgentSessionOptions } from "./session";
 import { SdkStartupCapability, type SdkStartupFailure, SdkStartupRollbackTracker } from "./startup-capability";
 export type CreateLifecycleAgentSessionResult = {
@@ -48,6 +48,8 @@ export type CreateLifecycleAgentSessionOptions = Omit<CreateAgentSessionOptions,
      * a prepared signal instead of readiness until it is explicitly activated.
      */
     readiness?: "immediate" | "deferred";
+    /** Broker-issued lifecycle request identity published with host registration. */
+    lifecycleRequestId?: string;
 };
 /** Internal lifecycle-only session construction with an owner-bound SDK startup result. */
 export declare function createLifecycleAgentSession(options?: CreateLifecycleAgentSessionOptions): Promise<CreateLifecycleAgentSessionResult>;

package/dist/types/sdk/prompt-deadline-manager.d.ts

@@ -1,5 +1,6 @@
 import type { KindAwareReconciliation } from "./bus/kind-aware-reconciliation";
 import type { InvocationCorrelation, InvocationReconciliation } from "./host/session-runtime";
+import type { SdkPromptTerminalOutcome } from "./prompt-status";
 import type { TurnResultContent } from "./turn-result";
 type DeadlineReconciliation = InvocationReconciliation | KindAwareReconciliation;
 export type PromptDeadlineOutcome = {
@@ -11,11 +12,7 @@ export type PromptDeadlineOutcome = {
 export interface PromptTerminalTransitionEvidence {
     content?: TurnResultContent;
     hasActivity?: boolean;
-    outcome?: {
-        kind: "stopped";
-        reason: "cancelled";
-        provenance: "client_cancel";
-    };
+    outcome?: SdkPromptTerminalOutcome;
 }
 export declare class PromptDeadlineManager {
     #private;

package/dist/types/sdk/receipt-state.d.ts

@@ -14,4 +14,6 @@ export interface TerminalReceiptState {
 }
 export declare function reportableReceipt({ text, artifactPath }: ReceiptSource): boolean;
 export declare function receiptStateForTerminal(source: ReceiptSource): Extract<ReceiptState, "present" | "missing">;
+/** Terminal receipt evidence is monotonic: present > missing > unknown. */
+export declare function reduceReceiptState(existing: Exclude<ReceiptState, "absent"> | undefined, incoming: Exclude<ReceiptState, "absent"> | undefined): Exclude<ReceiptState, "absent"> | undefined;
 export declare function reduceTerminalReceiptState(input: TerminalReceiptInput): TerminalReceiptState;

package/dist/types/sdk/router/session-router.d.ts

@@ -117,10 +117,12 @@ export interface SessionRouterClient {
     send(frame: Record<string, unknown>): void;
 }
 /** One frame after the caller's envelope/payload identity correlation. */
+/** One frame after the caller's envelope/payload identity correlation. */
 export interface SessionRouterFrame {
     readonly body: Record<string, unknown>;
     readonly name: string | undefined;
     readonly sessionId: string | undefined;
+    readonly revision?: number;
     readonly generation: number | undefined;
     readonly commandId?: string;
     readonly turnId?: string;
@@ -144,6 +146,8 @@ export interface SessionRouterDeps {
     onAttachment?: (attachment: SessionAttachment) => Promise<void> | void;
     /** Called only after the opaque capability becomes externally current. */
     onAttachmentReady?: (attachment: SessionAttachment) => Promise<void> | void;
+    /** Called before deferred replay may perform provider-facing mutations. */
+    onReplayReady?: () => Promise<void> | void;
     /** Called when the Broker index no longer reports an attached session as live. */
     onSessionRemoved?: (attachment: SessionAttachment, reason?: "removed" | "replaced" | "replaced_same_generation") => Promise<void> | void;
     /** Narrow provider surface for notification consumers such as Telegram. */
@@ -164,6 +168,8 @@ export interface SessionRouterDeps {
 export type SessionRouterProviderDeps = Pick<SessionRouterDeps, "createClient" | "createIndex" | "createBrokerClient" | "setInterval" | "clearInterval" | "setTimeout" | "clearTimeout" | "onReconciled">;
 export interface SessionRouterOptions {
     agentDir: string;
+    /** Limits attachment to exact ids selected by a Broker-scoped operation. */
+    sessionIds?: readonly string[];
     deps?: SessionRouterDeps;
     /** Runtime-specific identity validation; Router supplies a conservative fallback. */
     correlateFrame?: SessionRouterFrameCorrelator;

package/dist/types/sdk/session.d.ts

@@ -7,6 +7,7 @@ import { ModelRegistry } from "../config/model-registry";
 import { type ScopedModelSelection } from "../config/model-resolver";
 import { type PromptTemplate } from "../config/prompt-templates";
 import { Settings, type SkillsSettings } from "../config/settings";
+import type { MasterModeContext } from "../master-mode/context";
 import type { BashRestrictionProfile } from "../tools/bash-allowed-prefixes";
 import "../discovery";
 import type { CustomCommandsLoadResult } from "../extensibility/custom-commands";
@@ -176,6 +177,8 @@ export interface CreateAgentSessionOptions {
      * @internal CLI-only startup optimization; SDK callers retain synchronous loading by default.
      */
     deferMcpConfigStartup?: boolean;
+    /** Process-local master authority. Never persist or pass to lifecycle children. */
+    masterModeContext?: MasterModeContext;
     /**
      * Defer memory backend startup until the caller has applied startup model profiles.
      * @internal CLI-only ordering guard; SDK callers retain immediate startup by default.
@@ -384,4 +387,17 @@ export declare function createPluginHooksExtension(hooks: ConstrainedPluginHook[
 export declare function resolveIntentTracingEnabled(intentTracingSetting: boolean | undefined, options: {
     subSession: boolean;
 }): boolean;
+/**
+ * Order candidates so each known provider's curated default model is tried
+ * before the rest of the catalog.
+ *
+ * Provider catalogs are not ranked by fitness — a withdrawn model whose ID
+ * carries an older date suffix sorts ahead of its current replacement — so
+ * picking the first credentialed entry can start an unconfigured install on a
+ * model the provider no longer serves. `DEFAULT_MODEL_PER_PROVIDER` is the
+ * curated table `findInitialModel` already sweeps for the same purpose;
+ * reusing it keeps both unconfigured paths on one source of truth. Candidates
+ * that are not a provider default keep their original relative order.
+ */
+export declare function orderByProviderDefaultFirst(candidates: readonly Model[], providerOrder?: readonly string[]): Model[];
 export declare function createAgentSession(options?: CreateAgentSessionOptions): Promise<CreateAgentSessionResult>;

package/dist/types/sdk/startup-capability.d.ts

@@ -49,6 +49,7 @@ export declare class SdkStartupCapability {
     #private;
     readonly rollback?: SdkStartupRollbackTracker | undefined;
     readonly readiness: "immediate" | "deferred";
+    readonly lifecycleRequestId?: string | undefined;
     get cancelled(): boolean;
     cancel(): void;
     /**
@@ -57,7 +58,7 @@ export declare class SdkStartupCapability {
      * environment so bus wiring can never mistake an inherited process-global
      * flag for a broker-managed preparation.
      */
-    constructor(rollback?: SdkStartupRollbackTracker | undefined, readiness?: "immediate" | "deferred");
+    constructor(rollback?: SdkStartupRollbackTracker | undefined, readiness?: "immediate" | "deferred", lifecycleRequestId?: string | undefined);
     normalizeFailure(phase: SdkStartupPhase, reason: SdkStartupReason, error?: unknown): SdkStartupFailure;
     get result(): SdkStartupResult | undefined;
     get promise(): Promise<SdkStartupResult>;

package/dist/types/sdk/turn-result.d.ts

@@ -22,6 +22,7 @@ export interface TurnResultError {
     code: string;
     message: string;
 }
+export type TurnResultReceiptState = "absent" | "present" | "missing" | "unknown";
 export interface TurnResultPage {
     status: TurnResultStatus;
     kind?: "prompt" | "skill";
@@ -31,7 +32,12 @@ export interface TurnResultPage {
     acceptedAt?: number;
     startedAt?: number;
     terminalAt?: number;
+    receiptState?: TurnResultReceiptState;
+    outcome?: unknown;
     content?: TurnResultContent;
     error?: TurnResultError;
 }
 export declare function sanitizeTurnResultContent(text: unknown): TurnResultContent | undefined;
+export declare function reportableTurnResultContent(content: TurnResultContent | undefined): boolean;
+/** First reportable invocation-owned content wins; blank evidence remains replaceable. */
+export declare function reduceTurnResultContent(existing: TurnResultContent | undefined, incoming: TurnResultContent | undefined): TurnResultContent | undefined;