@gajae-code/coding-agent 0.17.1 → 0.17.4

package/dist/types/sdk/broker/session-index.d.ts

@@ -1,7 +1,7 @@
 import { SDK_STATE_VERSION, SESSION_INDEX_EVENT_VERSION } from "./state-version";
 export type SessionIndexEventType = "host_registered" | "host_heartbeat" | "host_unregistered" | "lifecycle_started" | "lifecycle_terminal" | "session_closed" | "session_deleted" | "record_reconciled";
 export type SessionActivityState = "active" | "idle";
-/** Coalesced broker-owned heartbeat checkpoint (C2): state plus the observation time. */
+/** Host-reported or broker-coalesced heartbeat: state plus the observation time. */
 export interface SessionActivity {
     state: SessionActivityState;
     at: number;
@@ -9,6 +9,8 @@ export interface SessionActivity {
 /** Events persisted without an OS process incarnation (v1/v2 era) are legacy provenance. */
 export type SessionIdentityProvenance = "composite" | "legacy";
 export type SessionTombstoneRule = "retain" | "expire";
+/** Durable provenance for a retired host registration. */
+export type HostUnregisteredReason = "process_exited" | "detached_idle";
 /**
  * Injected retention policy (C3). The broker schedules compaction independently of
  * rotation; settings apply at the next scheduled compaction. `clock` drives both
@@ -76,6 +78,7 @@ export interface SessionIndexEvent {
     /** Immutable endpoint file identity captured by the broker at registration. */
     endpointFileId?: string;
     lifecycleRequestId?: string;
+    hostUnregisteredReason?: HostUnregisteredReason;
     terminalUncertain?: boolean;
     /**
      * Distinguishes the terminal-uncertain claim written by a forced stop of a
@@ -105,6 +108,7 @@ export interface IndexedSession {
     live: boolean;
     indexSeq: number;
     lifecycleRequestId?: string;
+    hostUnregisteredReason?: HostUnregisteredReason;
     terminalUncertain?: boolean;
     /** True only for a terminal-uncertain claim written by a forced stale-worktree release. */
     forcedStaleRelease?: boolean;
@@ -174,6 +178,8 @@ export interface SessionIndexAuditRecord {
 export declare const sessionIndexChecksum: (event: Omit<SessionIndexEvent, "checksum">) => string;
 /** Coalesced heartbeat checkpoint rate cap (C2): at most one per session per minute. */
 export declare const SESSION_HEARTBEAT_INTERVAL_MS = 60000;
+/** A stale-host retirement requires silence well beyond the broker freshness window. */
+export declare const DEAD_HOST_HEARTBEAT_SILENCE_MS: number;
 export declare const DEFAULT_SESSION_RETENTION_MAX_AGE_MS: number;
 export declare const DEFAULT_SESSION_RETENTION_MAX_ROWS = 25000;
 export declare class SessionIndex {
@@ -201,7 +207,20 @@ export declare class SessionIndex {
     refresh(): Promise<void>;
     get indexSeq(): number;
     append(input: Omit<SessionIndexEvent, "version" | "indexSeq" | "checksum" | "ts"> & Partial<Pick<SessionIndexEvent, "ts">>): Promise<SessionIndexEvent>;
-    unregisterIfCurrent(expected: Pick<SessionIndexEvent, "sessionId" | "locator" | "endpointGeneration" | "pid" | "indexSeq" | "endpointMtimeMs" | "endpointFileId" | "lifecycleRequestId" | "processIncarnation" | "hostIncarnation">): Promise<boolean>;
+    /**
+     * Atomically fence an exact, long-silent dead-host authority before a caller
+     * removes state outside the broker index. The comparison and terminal event
+     * append share the machine-global index lock, so a heartbeat, successor
+     * registration, or unresolved-authority update that wins the lock prevents
+     * destructive coordinator cleanup.
+     */
+    retireStaleIfCurrent(expected: {
+        sessionId: string;
+        workspace: string;
+        endpointGeneration: number;
+        endpointIncarnation: string;
+    }): Promise<"retired" | "already_retired" | "not_found" | "stale">;
+    unregisterIfCurrent(expected: Pick<SessionIndexEvent, "sessionId" | "locator" | "endpointGeneration" | "pid" | "indexSeq" | "endpointMtimeMs" | "endpointFileId" | "lifecycleRequestId" | "processIncarnation" | "hostIncarnation">, reason?: HostUnregisteredReason): Promise<boolean>;
     /** Hold the canonical index lock across an authority-sensitive operation. */
     withLocked<T>(callback: () => Promise<T>): Promise<T>;
     snapshot(): Promise<void>;
@@ -210,7 +229,7 @@ export declare class SessionIndex {
      * injected retention policy to a fresh snapshot and truncates the log.
      */
     compact(): Promise<void>;
-    listSessions(): SessionList;
+    listSessions(probedIncarnations?: ReadonlyMap<string, string | undefined>): SessionList;
     /**
      * Credential-free proof for one exact public endpoint generation.
      *

package/dist/types/sdk/broker/spawn-authority.d.ts

@@ -12,6 +12,8 @@ export type SpawnClaimV2 = {
         status: "owned" | "consumed";
     };
     childId?: string;
+    /** Launch proof retained while registration is still unbound so a later retry can re-prove or close it. */
+    substrateProof?: SpawnSubstrateProof;
     seed?: SeedDeliveryV2;
     authorityRef?: string;
     createdAt: number;
@@ -122,6 +124,8 @@ export type SpawnClaimTransition = {
     leaseEpoch?: string;
     /** The fresh child ID is committed before substrate launch. */
     childId?: string;
+    /** Launch proof may be appended to the pre-registration state for later reconciliation. */
+    substrateProof?: SpawnSubstrateProof;
     /** Required for seed and terminal state transitions that carry Q26 facts. */
     seed?: SeedDeliveryV2;
     failure?: SpawnSubstrateFailure;

package/dist/types/sdk/broker/stderr-drainer.d.ts

@@ -0,0 +1,13 @@
+/** Parse and run the private source/compiled CLI drainer route. */
+export declare function runSdkStderrDrainerFromArgv(argv: readonly string[]): Promise<void>;
+/**
+ * Drain a detached lifecycle host's stderr without letting a noisy child grow
+ * its diagnostic artifact. The drainer owns the read side of the pipe, so the
+ * host remains attached to a process that outlives the broker itself.
+ *
+ * The artifact is written through one descriptor opened up front: once the
+ * broker has finished reading the startup diagnostic it unlinks the path, and
+ * the remaining output lands on an unlinked inode that disappears with this
+ * process instead of accumulating under the agent directory.
+ */
+export declare function runSdkStderrDrainer(logPath: string, maxBytes: number): Promise<void>;

package/dist/types/sdk/bus/index.d.ts

@@ -25,6 +25,7 @@ import { Settings } from "../../config/settings";
 import type { ExtensionAPI, ExtensionContext } from "../../extensibility/extensions";
 import { type WorkflowGateEmitter, type WorkflowGateTerminalProof } from "../../modes/shared/agent-wire/workflow-gate-broker";
 import type { AgentSessionEvent } from "../../session/agent-session";
+import { type SessionWorkLease, type SessionWorkLeaseHandle } from "../../session/session-work-lease";
 import type { AskAnswerSource, AskAnswerSourceResult, AskRemoteControl } from "../../tools";
 import { type SessionHostRuntimePublication } from "../broker/lifecycle";
 import { type SessionSdkHost } from "../host";
@@ -342,6 +343,17 @@ interface SessionRuntime {
     serverStopped: boolean;
     /** This runtime's own host-liveness publication; only its teardown may retract it. */
     evidencePublication?: SessionHostRuntimePublication;
+    /** Authoritative lease held by admitted input, execution, and recovery work. */
+    workLease: SessionWorkLease;
+    /** Lease retained while an uncorrelated agent loop is active. */
+    activeWorkLease?: SessionWorkLeaseHandle;
+    /** Lease retained while an agent loop is paused awaiting resumption. */
+    pausedWorkLease?: SessionWorkLeaseHandle;
+    /**
+     * Handles of queued submissions promoted to their own run, handed over at
+     * the promotion boundary and retired by that run's agent_start.
+     */
+    promotedWorkLeases: SessionWorkLeaseHandle[];
     brokerRegistrationReleased: boolean;
     verbosity: "lean" | "verbose";
     /** Whether the agent loop is currently running (drives the typing indicator). */
@@ -639,5 +651,12 @@ export declare function createNotificationsExtension(api: ExtensionAPI, options?
                 expectedEpoch?: number;
             };
         }) => Promise<RunSettlementProof>;
+        /**
+         * Live, SYNCHRONOUS view of the dispatched tool calls the run resource
+         * ledger holds for an execution handle (#5637). Strictly read-only: it
+         * never claims, seals or otherwise mutates ledger state. Optional so an
+         * older host that does not thread it degrades to the event-derived set.
+         */
+        pendingToolExecutions?: (handle: string) => readonly string[];
     };
 }): void;

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -285,8 +285,10 @@ export declare const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * first refusal, so an owner still running the generation-178 router keeps
  * killing a session's mirroring after one transient rejection and must be
  * replaced across this upgrade.
+ * Generation 190 acknowledges the protected prompt-deadline boundary change,
+ * so generation-189 owners are replaced instead of retaining the old path.
  */
-export declare const DAEMON_GENERATION = 187;
+export declare const DAEMON_GENERATION = 192;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7
  * requires durable publication receipts and acknowledged attachment dispatch,

package/dist/types/sdk/bus/telegram-daemon.d.ts

@@ -725,6 +725,11 @@ export interface TelegramDaemonOptions {
         enabled: boolean;
     };
     idleTimeoutMs?: number;
+    /**
+     * Standalone daemon owners keep Telegram command ingress alive while no SDK
+     * endpoints are attached. Embedded/test daemons retain finite-idle behavior.
+     */
+    keepAliveWithoutAttachments?: boolean;
     /** TTL for durable topic-adoption intents (default 10 minutes). Observed, not a fixed contract. */
     adoptionIntentTtlMs?: number;
     pid?: number;

package/dist/types/sdk/cli/master-cli.d.ts

@@ -1,8 +1,9 @@
+import { PublicCommandFailure } from "../../cli/public-command-errors";
 import { type IndexedSession } from "../broker/session-index";
-export declare class SdkMasterCliError extends Error {
+export declare class SdkMasterCliError extends PublicCommandFailure {
     readonly code: string;
     readonly exitCode: 1 | 2;
-    constructor(code: string, message: string, exitCode?: 1 | 2);
+    constructor(code: string, _message: string, exitCode?: 1 | 2);
 }
 export interface SdkSpawnArgs {
     cwd?: string;
@@ -26,11 +27,6 @@ export interface SdkSpawnRendered {
         turnId?: string;
         status?: string;
     };
-    idempotencyKey?: string;
-    error?: {
-        code: string;
-        message: string;
-    };
 }
 export interface SdkSpawnDependencies {
     env: Record<string, string | undefined>;
@@ -48,9 +44,9 @@ export interface SdkSpawnDependencies {
  */
 export declare function selectNewestMasterAttestationEpoch(rows: readonly IndexedSession[], ownerSessionId: string): string | undefined;
 /** Projects an arbitrary Broker response onto the allowlisted render shape. */
-export declare function safeSpawnRender(response: unknown): {
+export declare function safeSpawnRender(response: unknown, idempotencyKey?: string): {
     rendered: SdkSpawnRendered;
-    exitCode: 0 | 1;
+    exitCode: 0;
 };
 export declare function renderSpawnTable(rendered: SdkSpawnRendered): string;
 /**
@@ -59,5 +55,5 @@ export declare function renderSpawnTable(rendered: SdkSpawnRendered): string;
  */
 export declare function runSdkSpawn(args: SdkSpawnArgs, dependencies?: Partial<SdkSpawnDependencies>): Promise<{
     rendered: SdkSpawnRendered;
-    exitCode: 0 | 1;
+    exitCode: 0;
 }>;

package/dist/types/sdk/cli/rows.d.ts

@@ -76,7 +76,25 @@ export interface SdkTailEnvelopeV1 {
     items: SdkTailItemV1[];
 }
 export declare function tailItemKey(item: SdkTailItemV1): string;
-/** Holds positioned live frames until the checkpoint can stamp their authoritative revision. */
+/**
+ * Holds positioned live frames until the checkpoint can stamp their
+ * authoritative revision, and keeps stamping after it.
+ *
+ * A positioned frame (generation+seq) that carries no revision after the
+ * checkpoint used to abort the whole tail with protocol_error. The host emits
+ * such frames whenever its transcript provider is momentarily unavailable
+ * (`eventRevision` returns undefined), which is ordinary during a turn - and
+ * one such frame turned a live, answering session into one no consumer could
+ * observe: every poll failed, the caller held the turn, and after five minutes
+ * reported it failed while the answer sat in the transcript (2026-09-17/18,
+ * five sessions). A frame is never a reason to lose the tail.
+ *
+ * The stamp is the LATEST revision observed, not the checkpoint's: revisions
+ * advance during a turn, and lifecycle order is compared revision-first. A
+ * terminal frame stamped with the initial checkpoint revision would sort
+ * before a start that carried a later one, and `--until-idle` would wait on a
+ * turn that had already ended.
+ */
 export declare class TailRevisionBuffer {
     #private;
     push(item: SdkTailItemV1): SdkTailItemV1[];

package/dist/types/sdk/cli/session-cli.d.ts

@@ -1,8 +1,9 @@
+import { PublicCommandFailure, type PublicEffectProof } from "../../cli/public-command-errors";
 import { type SdkSearchResultV1, type SdkSearchRowV1 } from "../broker/session-scope";
-import type { SessionLifecycleService } from "../lifecycle/service";
+import type { SessionLifecycleResult, SessionLifecycleService } from "../lifecycle/service";
 import { SessionRouter } from "../router";
 import { type SdkSessionRowV1 } from "./rows";
-export type SdkSessionCliAction = "list" | "search" | "inspect" | "send" | "status" | "tail" | "retire" | "global" | "raw" | "control" | "query" | "global";
+export type SdkSessionCliAction = "list" | "search" | "inspect" | "send" | "status" | "tail" | "close" | "retire" | "global" | "raw" | "control" | "query";
 export type SdkSessionListScope = "repo" | "cwd" | "worktree" | "all";
 export type SdkSessionCliRawKind = "control" | "query" | "global";
 export interface SdkSessionCliArgs {
@@ -24,6 +25,8 @@ export interface SdkSessionCliArgs {
     strict?: boolean;
     untilIdle?: boolean;
     allEvents?: boolean;
+    /** tail --cursor: transcript row id the caller has already processed; rows up to and including it are omitted. */
+    afterTranscriptId?: string;
     page?: boolean;
     repo?: string;
     scope?: string;
@@ -31,16 +34,28 @@ export interface SdkSessionCliArgs {
     json?: boolean;
     agentDir?: string;
 }
+export interface SdkSessionCliDependencies {
+    readonly lifecycleService?: SessionLifecycleService;
+}
 type JsonRecord = Record<string, unknown>;
 export interface RetainedTranscriptTailReader {
     readonly size: number;
     readRange(start: number, end: number): Promise<Uint8Array>;
 }
+export declare const SDK_JSON_INPUT_FILE_MAX_BYTES: number;
+/** Translate only SDK-owned codes and explicitly allowlisted reconciliation fields. */
+export declare function sdkPublicFailure(code: string, details?: unknown, proof?: PublicEffectProof): PublicCommandFailure;
+/** Lifecycle terminality/retryability is not, by itself, proof of an effect outcome. */
+export declare function lifecyclePublicFailure(outcome: Extract<SessionLifecycleResult, {
+    ok: false;
+}>): PublicCommandFailure;
+/** Reads a 0600 JSON input through one descriptor, never through a replaceable pathname. */
+export declare function readSecureJsonInputFile(filePath: string): Promise<string>;
 export declare function mergeProbedSearchRows(rows: readonly SdkSearchRowV1[], probedRows: readonly SdkSearchRowV1[]): readonly SdkSearchRowV1[];
 /** Resolves, lists, and probes only the exact rows selected by the Broker-scoped search. */
 export declare function runSdkSearch(args: Pick<SdkSessionCliArgs, "agentDir" | "repo" | "scope" | "limit" | "cursor">, createService?: (agentDir: string) => SessionLifecycleService, probe?: (agentDir: string, result: SdkSearchResultV1) => Promise<SdkSearchResultV1>): Promise<{
     result: SdkSearchResultV1;
-    exitCode: 0 | 1;
+    exitCode: 0;
 }>;
 /** Renders a credential-free scope/status preamble and bounded search table. */
 export declare function renderSdkSearchTable(result: SdkSearchResultV1): string;
@@ -93,8 +108,10 @@ export declare function waitForTerminalStatus(router: SessionRouter, sessionId:
     status: string;
     detail: unknown;
 }>;
-export declare function scanRetainedTranscriptTail(reader: RetainedTranscriptTailReader): Promise<unknown[]>;
+export declare function scanRetainedTranscriptTail(reader: RetainedTranscriptTailReader, options?: {
+    boundaryId?: string;
+}): Promise<unknown[]>;
 export declare function runTail(repo: string, agentDir: string, sessionId: string, args: SdkSessionCliArgs): Promise<unknown>;
 /** Runs the broker-bound `gjc sdk session` command family without exposing endpoint credentials. */
-export declare function runSdkSessionCli(args: SdkSessionCliArgs, writeOutput?: (value: unknown) => void, setExitCode?: (exitCode: 1 | 2) => void): Promise<void>;
+export declare function runSdkSessionCli(args: SdkSessionCliArgs, writeOutput?: (value: unknown) => void, setExitCode?: (exitCode: 1 | 2) => void, deps?: SdkSessionCliDependencies): Promise<void>;
 export {};

package/dist/types/sdk/client/client.d.ts

@@ -41,6 +41,8 @@ export interface SdkClientOptions {
     timeoutMs?: number;
     /** Absolute wall-clock deadline shared by connect, hello, retry, and request work. */
     deadline?: number;
+    /** Optional client capabilities sent in the protocol hello handshake. */
+    capabilities?: readonly string[];
     reconnectAttempts?: number;
     reconnectBackoffMs?: number;
     /**

package/dist/types/sdk/guides/cli.d.ts

@@ -32,8 +32,7 @@ export interface SdkGuidesCliArgs {
 }
 /**
  * Runs the `gjc sdk guides` command family. Exported for command routing from
- * `src/commands/sdk.ts` and for direct service use; the injected `write` /
- * `setExitCode` hooks keep the surface testable without touching stdout or
- * the process exit code.
+ * `src/commands/sdk.ts` and for direct service use. Only successful results are
+ * written here; typed failures belong to the outer public family writer.
  */
-export declare function runSdkGuidesCli(args: SdkGuidesCliArgs, writeOutput?: (value: unknown) => void, setExitCode?: (exitCode: 1 | 2) => void): Promise<void>;
+export declare function runSdkGuidesCli(args: SdkGuidesCliArgs, writeOutput?: (value: unknown) => void): Promise<void>;

package/dist/types/sdk/guides/verify.d.ts

@@ -12,6 +12,8 @@ export interface GuidePinnedKey {
     /** DER-encoded SPKI public key, hex. */
     spkiDerHex: string;
     source: "bundled";
+    /** Optional retirement bound for old bundled signers. */
+    validUntil?: number;
 }
 export declare const GUIDE_PINNED_KEYS: readonly GuidePinnedKey[];
 export declare const GUIDE_PINNED_KEY_IDS: readonly string[];

package/dist/types/sdk/host/host.d.ts

@@ -81,7 +81,13 @@ export interface SessionSdkHostOptions extends HostEndpointAdapters {
  *  must see the same capability-gated event kinds on both legs, or live and
  *  replay delivery diverge for the same subscriber. */
 export declare const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v2";
+/** Capability for non-replayable streamed turn content. */
+export declare const TURN_STREAM_CAPABILITY = "turn_stream";
+/** Capability used by notification adapters that observe a host without owning its work. */
+export declare const SESSION_HOST_OBSERVER_CAPABILITY = "session_host_observer_v1";
 export declare const CAP_GATED_FRAME_KINDS: ReadonlySet<string>;
+/** Keep live delivery and replay on one capability gate. */
+export declare function canDeliverSdkEvent(kind: string, capabilities: ReadonlySet<string> | undefined): boolean;
 /** SDK hosting is independent of notification configuration. Only root sessions host an endpoint. */
 export declare function shouldHostSdk(_settings: unknown, isTopLevel: boolean, env?: NodeJS.ProcessEnv): boolean;
 /** Adapter-based session host; bus wiring owns NotificationServer creation and transport framing. */
@@ -119,6 +125,9 @@ export declare class SessionSdkHost {
     activate(expectedGeneration?: number): Promise<SessionActivationOutcome>;
     stop(options?: {
         allowLockContention?: boolean;
+        unregisterReason?: "detached_idle";
     }): Promise<"stopped" | "already">;
     registerWithBroker(writer: BrokerIndexWriter): Promise<void>;
+    /** Persist the host's observable activity for broker/session-list consumers. */
+    reportActivity(state: "active" | "idle", at?: number): Promise<void>;
 }

package/dist/types/sdk/host/session-runtime.d.ts

@@ -1,6 +1,7 @@
 import { type Settings } from "../../config/settings";
 import type { ExtensionAPI, ExtensionContext } from "../../extensibility/extensions";
 import type { AgentEndEvent } from "../../extensibility/shared-events";
+import { ensureBroker } from "../broker/ensure";
 import { type MasterRoleAttestationV2, SessionIndex, type SessionLocatorV2 } from "../broker/session-index";
 import type { SdkPromptTerminalOutcome } from "../prompt-status";
 import { type ReceiptState } from "../receipt-state";
@@ -25,6 +26,13 @@ export declare function verifyMasterCapabilityFrame(input: {
     nonce: string;
     attestationEpoch: string;
 };
+/**
+ * Keep a live session's broker discovery recoverable well inside the session
+ * index's two-minute heartbeat freshness window. `ensureBroker` has its own
+ * bounded startup/recovery budget; the in-flight guard below prevents those
+ * budgets from stacking when one attempt outlives this cadence.
+ */
+export declare const SESSION_BROKER_RECOVERY_INTERVAL_MS = 30000;
 /**
  * Normalize an agent-loop stop reason into the published terminal outcome.
  *
@@ -158,6 +166,17 @@ export interface SdkOnlyTerminalAbortSeams {
         status: string;
         terminalScope?: unknown;
     }>;
+    /**
+     * Live, SYNCHRONOUS view of the dispatched tool calls the run resource
+     * ledger holds for an execution handle (#5637). Strictly read-only: it
+     * never claims, reserves, seals or quarantines ledger state. Declared here
+     * so both hosts expose ONE seam contract — the bus route consumes it for its
+     * deadline tool-boundary wait, and this route threads it so a future boundary
+     * wait or deadline abort reads the ledger rather than silently falling back
+     * to the event-derived set. Optional so an older host that does not thread it
+     * degrades to that fallback instead of failing to construct.
+     */
+    pendingToolExecutions?: (handle: string) => readonly string[];
     /** Test override for the maximum durable terminal reservation rows. */
     maxDurableTerminalReservationsForTests?: number;
 }
@@ -177,6 +196,8 @@ export declare class SessionSdkSessionRuntime {
     get started(): boolean;
     get generation(): number;
     getProviderDefinitions(capability: string): unknown | undefined;
+    /** Persist the host's current observable activity for broker/session-list consumers. */
+    reportActivity(state: "active" | "idle", at?: number): Promise<void>;
     emitEvent(frame: SdkFrame): void;
     /**
      * Deliver a frame to specific connections without recording it.
@@ -190,6 +211,10 @@ export declare class SessionSdkSessionRuntime {
      * disturb the turn producing the content.
      */
     sendFrameTo(connectionId: string, frame: SdkFrame): void;
+    /** Snapshot connections that negotiated every capability in the requirement set. */
+    connectionIdsWithCapabilities(required: readonly string[]): string[];
+    /** Deliver a non-replayable frame to connections with an explicit capability intersection. */
+    sendFrameToCapabilities(required: readonly string[], frame: SdkFrame, excluding?: ReadonlySet<string>): void;
     publish(frame: SdkFrame): void;
     startHost(): Promise<"started" | "already">;
     startTransport(): Promise<{
@@ -200,6 +225,7 @@ export declare class SessionSdkSessionRuntime {
     }>;
     stop(options?: {
         allowLockContention?: boolean;
+        unregisterReason?: "detached_idle";
     }): Promise<void>;
     registerWithBroker(writer: BrokerIndexWriter): Promise<void>;
 }
@@ -234,6 +260,11 @@ export interface CreateSdkSessionRuntimeOptions {
     terminalAbortSeams?: SdkOnlyTerminalAbortSeams;
     /** Callback when a frame is admitted to the runtime (test harness). */
     onFrameAdmitted?: () => void;
+    /** Timer seams for deterministic broker-recovery lifecycle tests. */
+    setIntervalImpl?: typeof setInterval;
+    clearIntervalImpl?: typeof clearInterval;
+    /** Test-only broker ensure seam; production always uses the owner-fenced helper. */
+    ensureBrokerImpl?: typeof ensureBroker;
     /** Test-only observation of a genuinely timed-out lifecycle drain. */
     onLifecycleDrainTimeoutForTests?: () => void;
     /** Test-only observation of bounded failure-diagnostic deduplication state. */

package/dist/types/sdk/host/types.d.ts

@@ -24,9 +24,19 @@ export interface BrokerIndexWriter {
         stateRoot: string;
         endpointGeneration: number;
     }): void | Promise<void>;
+    heartbeat?(input: {
+        sessionId: string;
+        stateRoot: string;
+        endpointGeneration: number;
+        activity: {
+            state: "active" | "idle";
+            at: number;
+        };
+    }): void | Promise<void>;
     unregister?(input: {
         sessionId: string;
         stateRoot: string;
         endpointGeneration: number;
+        reason?: "detached_idle";
     }): void | Promise<void>;
 }

package/dist/types/sdk/index.d.ts

@@ -1,4 +1,5 @@
 export { MODEL_PROFILE_DISCOVERY_QUERY, MODEL_PROFILE_ERROR_DETAIL_MAX_BYTES, type ModelProfileCatalogItem, type ModelProfileErrorCode, type ModelProfileErrorDetails, ModelProfileRegistryError, type ModelProfileRegistryErrorDetails, type UnknownModelProfileDetails, UnknownModelProfileError, } from "../config/model-profile-contract";
+export type { QueuedInputAdmission, QueuedInputDelivery, QueuedInputExecution, QueuedInputQueuePolicy, QueuedInputRemovalReason, QueuedInputSubmission, QueuedInputTerminal, SendUserMessageOptions, TrackedSendUserMessageOptions, } from "../session/agent-session";
 export * as bus from "./bus";
 export * as host from "./host";
 export * as lifecycle from "./lifecycle";

package/dist/types/sdk/prompt-deadline-flush.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Worktree durability for a prompt retired by its deadline (#5583).
+ *
+ * A raised `sdk.promptDeadlineMs` makes the crash rarer, never impossible: the
+ * hard `sdk.promptMaxRuntimeMs` cap still fires on a long run, and the session
+ * is then torn down with whatever the agent already edited still uncommitted.
+ * Field reports lost ~25 minutes of finished work across 37 dirty files that
+ * way. Persist that work as a WIP commit in the agent's own worktree before
+ * teardown so the next run resumes from a commit instead of re-reasoning.
+ *
+ * Strictly best effort AND strictly bounded. Every failure — including an abort —
+ * is logged and swallowed: the prompt still fails with `prompt_deadline_exceeded`
+ * and teardown still happens, because the deadline outcome must never depend on
+ * git. Every git call that accepts a signal gets one, so a blocking lock or a
+ * hanging plumbing command is killed rather than waited on.
+ *
+ * ── Isolated index, plumbing commit, compare-and-swap ref move (#5623 round 4)
+ *
+ * The autosave never opens the user's real `.git/index` for writing and never
+ * runs a repository hook:
+ *
+ *   1. everything is staged into a throwaway index inside the worktree's own git
+ *      dir (`GIT_INDEX_FILE`), seeded from the HEAD captured before staging;
+ *   2. the commit is built with plumbing — `write-tree` then `commit-tree` — so
+ *      `pre-commit`/`commit-msg` cannot execute during teardown;
+ *   3. the ref moves with a compare-and-swap against that captured HEAD, so the
+ *      one mutation that can outlive teardown is conditional: an abandoned flush
+ *      that wakes up late finds HEAD moved and does nothing. `withRepoLock`
+ *      awaits its predecessor BEFORE honouring the signal, so this really does
+ *      happen — the abort alone cannot prevent it;
+ *   4. the real index is adopted only after that swap succeeds, so a successful
+ *      autosave leaves `git status` clean instead of a phantom reverse diff.
+ *
+ * Every failing and aborted path therefore just unlinks the temp index. There is
+ * no rollback left to get wrong, and index-only state the user set — intent-to-add,
+ * skip-worktree/assume-unchanged, sparse-index, index extensions — survives byte
+ * for byte because the file was never written.
+ *
+ * ── Ownership
+ *
+ * Staging the whole dirty worktree (`git add -A`, untracked files included) is
+ * the point: the work being saved is whatever the agent touched, and narrowing
+ * it would strand exactly the files this exists for. What makes that safe is
+ * WHERE it runs. `sdk.flushWorktreeOnDeadline` still defaults to on, but the
+ * implicit default applies only in a LINKED worktree (`gitDir !== commonDir`) —
+ * what agent/paseo sessions run in, and the #5583 field report. In the user's
+ * primary checkout an autosave needs an explicit opt-in.
+ */
+export interface PromptDeadlineFlushResult {
+    /** Branch the WIP commit landed on, or `undefined` on a detached HEAD. */
+    branch?: string;
+    /** Abbreviated SHA of the WIP commit. */
+    commit: string;
+    /** Worktree root the commit was made in. */
+    worktreeRoot: string;
+}
+export interface PromptDeadlineFlushOptions {
+    /**
+     * Whether the caller resolved `sdk.flushWorktreeOnDeadline` to `true` from a
+     * value the user actually wrote, rather than from the schema default. Only an
+     * explicit opt-in may autosave outside a linked worktree.
+     */
+    readonly explicitOptIn?: boolean;
+    /**
+     * Whether the deadline attempt still owns the prompt. The callback is checked
+     * immediately before the ref move and again before the real index is adopted,
+     * so progress that renews the lease can abandon the prepared WIP safely.
+     */
+    readonly isCurrent?: () => boolean;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Commit any uncommitted work in the worktree owning `cwd`.
+ *
+ * Returns `undefined` — without moving any ref — when `cwd` is not inside a git
+ * worktree, when the tree is already clean, when the session does not own the
+ * checkout, or when git fails or is aborted. Only the session's own worktree is
+ * touched; nothing is ever pushed.
+ *
+ * The abort signal is composed with an internal `DEADLINE_FLUSH_TIMEOUT_MS`
+ * bound, so a caller that passes nothing still cannot hang here.
+ */
+export declare function flushWorktreeOnPromptDeadline(cwd: string, options?: AbortSignal | PromptDeadlineFlushOptions): Promise<PromptDeadlineFlushResult | undefined>;

package/dist/types/sdk/prompt-deadline-manager.d.ts

@@ -2,6 +2,25 @@ import type { KindAwareReconciliation } from "./bus/kind-aware-reconciliation";
 import type { InvocationCorrelation, InvocationReconciliation } from "./host/session-runtime";
 import type { SdkPromptTerminalOutcome } from "./prompt-status";
 import type { TurnResultContent } from "./turn-result";
+/**
+ * Hard real-time bound on the best-effort durability hook, shared with
+ * `prompt-deadline-flush` so the manager's race and the flush's own abort
+ * signal cannot drift apart.
+ */
+export declare const DEADLINE_FLUSH_TIMEOUT_MS = 10000;
+/**
+ * Run a best-effort durability flush under a hard real-time bound that ALWAYS
+ * settles, and never let its result reach the caller.
+ *
+ * Shared by both expiry paths — this manager and the notification bus's own
+ * terminalization (#5583) — so there is one bound, one abort, and one warning,
+ * with no drift between them. A rejection is swallowed; a `run` that never
+ * settles is abandoned after `timeoutMs` with its signal aborted so any git
+ * subprocess dies. The signal alone is not sufficient: `git.withRepoLock`
+ * awaits its predecessor before honouring it, so a hung predecessor in the
+ * per-repo write chain is cut only by this outer race.
+ */
+export declare function runBoundedDeadlineFlush(run: (signal: AbortSignal) => unknown, timeoutMs?: number): Promise<void>;
 type DeadlineReconciliation = InvocationReconciliation | KindAwareReconciliation;
 export type PromptDeadlineOutcome = Extract<SdkPromptTerminalOutcome, {
     kind: "failed";
@@ -21,7 +40,25 @@ export declare class PromptDeadlineManager {
         getLeaseMs: () => number;
         getMaxMs: () => number;
         now?: () => number;
-        onExpired?: (correlation: InvocationCorrelation) => void;
+        onExpired?: (correlation: InvocationCorrelation, outcome?: PromptDeadlineOutcome) => void;
+        /**
+         * Best-effort durability hook for the single path that genuinely retires a
+         * prompt as `prompt_deadline_exceeded` (#5583). Awaited after the durable
+         * pending claim but BEFORE the durable terminal, so a crash in that window
+         * leaves the record pending and recovery retries the prompt; a
+         * rejection is swallowed and never changes the deadline outcome. Not called
+         * when a real terminal transition or a real failure won the race, nor when
+         * renewed progress supersedes this expiry instance. The hook receives an
+         * abort signal that fires when it outruns `deadlineFlushTimeoutMs`, plus a
+         * generation fence for irreversible worktree adoption.
+         */
+        onDeadlineExceeded?: (correlation: InvocationCorrelation, signal: AbortSignal, isCurrent?: () => boolean) => void | Promise<void>;
+        /**
+         * Hard bound on `onDeadlineExceeded`. Measured with a real timer, not
+         * `now`, because it guards real subprocesses — which is also why it is a
+         * constructor option: a fake clock cannot shorten it for tests.
+         */
+        deadlineFlushTimeoutMs?: number;
     });
     onAccepted(correlation: InvocationCorrelation): void;
     /** Re-arm a durable uncertainty-recovery record after process startup without