@gajae-code/coding-agent 0.17.2 → 0.17.4

package/dist/types/sdk/guides/cli.d.ts

@@ -32,8 +32,7 @@ export interface SdkGuidesCliArgs {
 }
 /**
  * Runs the `gjc sdk guides` command family. Exported for command routing from
- * `src/commands/sdk.ts` and for direct service use; the injected `write` /
- * `setExitCode` hooks keep the surface testable without touching stdout or
- * the process exit code.
+ * `src/commands/sdk.ts` and for direct service use. Only successful results are
+ * written here; typed failures belong to the outer public family writer.
  */
-export declare function runSdkGuidesCli(args: SdkGuidesCliArgs, writeOutput?: (value: unknown) => void, setExitCode?: (exitCode: 1 | 2) => void): Promise<void>;
+export declare function runSdkGuidesCli(args: SdkGuidesCliArgs, writeOutput?: (value: unknown) => void): Promise<void>;

package/dist/types/sdk/guides/verify.d.ts

@@ -12,6 +12,8 @@ export interface GuidePinnedKey {
     /** DER-encoded SPKI public key, hex. */
     spkiDerHex: string;
     source: "bundled";
+    /** Optional retirement bound for old bundled signers. */
+    validUntil?: number;
 }
 export declare const GUIDE_PINNED_KEYS: readonly GuidePinnedKey[];
 export declare const GUIDE_PINNED_KEY_IDS: readonly string[];

package/dist/types/sdk/host/host.d.ts

@@ -81,7 +81,13 @@ export interface SessionSdkHostOptions extends HostEndpointAdapters {
  *  must see the same capability-gated event kinds on both legs, or live and
  *  replay delivery diverge for the same subscriber. */
 export declare const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v2";
+/** Capability for non-replayable streamed turn content. */
+export declare const TURN_STREAM_CAPABILITY = "turn_stream";
+/** Capability used by notification adapters that observe a host without owning its work. */
+export declare const SESSION_HOST_OBSERVER_CAPABILITY = "session_host_observer_v1";
 export declare const CAP_GATED_FRAME_KINDS: ReadonlySet<string>;
+/** Keep live delivery and replay on one capability gate. */
+export declare function canDeliverSdkEvent(kind: string, capabilities: ReadonlySet<string> | undefined): boolean;
 /** SDK hosting is independent of notification configuration. Only root sessions host an endpoint. */
 export declare function shouldHostSdk(_settings: unknown, isTopLevel: boolean, env?: NodeJS.ProcessEnv): boolean;
 /** Adapter-based session host; bus wiring owns NotificationServer creation and transport framing. */
@@ -119,6 +125,9 @@ export declare class SessionSdkHost {
     activate(expectedGeneration?: number): Promise<SessionActivationOutcome>;
     stop(options?: {
         allowLockContention?: boolean;
+        unregisterReason?: "detached_idle";
     }): Promise<"stopped" | "already">;
     registerWithBroker(writer: BrokerIndexWriter): Promise<void>;
+    /** Persist the host's observable activity for broker/session-list consumers. */
+    reportActivity(state: "active" | "idle", at?: number): Promise<void>;
 }

package/dist/types/sdk/host/session-runtime.d.ts

@@ -1,6 +1,7 @@
 import { type Settings } from "../../config/settings";
 import type { ExtensionAPI, ExtensionContext } from "../../extensibility/extensions";
 import type { AgentEndEvent } from "../../extensibility/shared-events";
+import { ensureBroker } from "../broker/ensure";
 import { type MasterRoleAttestationV2, SessionIndex, type SessionLocatorV2 } from "../broker/session-index";
 import type { SdkPromptTerminalOutcome } from "../prompt-status";
 import { type ReceiptState } from "../receipt-state";
@@ -25,6 +26,13 @@ export declare function verifyMasterCapabilityFrame(input: {
     nonce: string;
     attestationEpoch: string;
 };
+/**
+ * Keep a live session's broker discovery recoverable well inside the session
+ * index's two-minute heartbeat freshness window. `ensureBroker` has its own
+ * bounded startup/recovery budget; the in-flight guard below prevents those
+ * budgets from stacking when one attempt outlives this cadence.
+ */
+export declare const SESSION_BROKER_RECOVERY_INTERVAL_MS = 30000;
 /**
  * Normalize an agent-loop stop reason into the published terminal outcome.
  *
@@ -158,6 +166,17 @@ export interface SdkOnlyTerminalAbortSeams {
         status: string;
         terminalScope?: unknown;
     }>;
+    /**
+     * Live, SYNCHRONOUS view of the dispatched tool calls the run resource
+     * ledger holds for an execution handle (#5637). Strictly read-only: it
+     * never claims, reserves, seals or quarantines ledger state. Declared here
+     * so both hosts expose ONE seam contract — the bus route consumes it for its
+     * deadline tool-boundary wait, and this route threads it so a future boundary
+     * wait or deadline abort reads the ledger rather than silently falling back
+     * to the event-derived set. Optional so an older host that does not thread it
+     * degrades to that fallback instead of failing to construct.
+     */
+    pendingToolExecutions?: (handle: string) => readonly string[];
     /** Test override for the maximum durable terminal reservation rows. */
     maxDurableTerminalReservationsForTests?: number;
 }
@@ -177,6 +196,8 @@ export declare class SessionSdkSessionRuntime {
     get started(): boolean;
     get generation(): number;
     getProviderDefinitions(capability: string): unknown | undefined;
+    /** Persist the host's current observable activity for broker/session-list consumers. */
+    reportActivity(state: "active" | "idle", at?: number): Promise<void>;
     emitEvent(frame: SdkFrame): void;
     /**
      * Deliver a frame to specific connections without recording it.
@@ -190,6 +211,10 @@ export declare class SessionSdkSessionRuntime {
      * disturb the turn producing the content.
      */
     sendFrameTo(connectionId: string, frame: SdkFrame): void;
+    /** Snapshot connections that negotiated every capability in the requirement set. */
+    connectionIdsWithCapabilities(required: readonly string[]): string[];
+    /** Deliver a non-replayable frame to connections with an explicit capability intersection. */
+    sendFrameToCapabilities(required: readonly string[], frame: SdkFrame, excluding?: ReadonlySet<string>): void;
     publish(frame: SdkFrame): void;
     startHost(): Promise<"started" | "already">;
     startTransport(): Promise<{
@@ -200,6 +225,7 @@ export declare class SessionSdkSessionRuntime {
     }>;
     stop(options?: {
         allowLockContention?: boolean;
+        unregisterReason?: "detached_idle";
     }): Promise<void>;
     registerWithBroker(writer: BrokerIndexWriter): Promise<void>;
 }
@@ -234,6 +260,11 @@ export interface CreateSdkSessionRuntimeOptions {
     terminalAbortSeams?: SdkOnlyTerminalAbortSeams;
     /** Callback when a frame is admitted to the runtime (test harness). */
     onFrameAdmitted?: () => void;
+    /** Timer seams for deterministic broker-recovery lifecycle tests. */
+    setIntervalImpl?: typeof setInterval;
+    clearIntervalImpl?: typeof clearInterval;
+    /** Test-only broker ensure seam; production always uses the owner-fenced helper. */
+    ensureBrokerImpl?: typeof ensureBroker;
     /** Test-only observation of a genuinely timed-out lifecycle drain. */
     onLifecycleDrainTimeoutForTests?: () => void;
     /** Test-only observation of bounded failure-diagnostic deduplication state. */

package/dist/types/sdk/host/types.d.ts

@@ -24,9 +24,19 @@ export interface BrokerIndexWriter {
         stateRoot: string;
         endpointGeneration: number;
     }): void | Promise<void>;
+    heartbeat?(input: {
+        sessionId: string;
+        stateRoot: string;
+        endpointGeneration: number;
+        activity: {
+            state: "active" | "idle";
+            at: number;
+        };
+    }): void | Promise<void>;
     unregister?(input: {
         sessionId: string;
         stateRoot: string;
         endpointGeneration: number;
+        reason?: "detached_idle";
     }): void | Promise<void>;
 }

package/dist/types/sdk/index.d.ts

@@ -1,4 +1,5 @@
 export { MODEL_PROFILE_DISCOVERY_QUERY, MODEL_PROFILE_ERROR_DETAIL_MAX_BYTES, type ModelProfileCatalogItem, type ModelProfileErrorCode, type ModelProfileErrorDetails, ModelProfileRegistryError, type ModelProfileRegistryErrorDetails, type UnknownModelProfileDetails, UnknownModelProfileError, } from "../config/model-profile-contract";
+export type { QueuedInputAdmission, QueuedInputDelivery, QueuedInputExecution, QueuedInputQueuePolicy, QueuedInputRemovalReason, QueuedInputSubmission, QueuedInputTerminal, SendUserMessageOptions, TrackedSendUserMessageOptions, } from "../session/agent-session";
 export * as bus from "./bus";
 export * as host from "./host";
 export * as lifecycle from "./lifecycle";

package/dist/types/sdk/prompt-deadline-flush.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Worktree durability for a prompt retired by its deadline (#5583).
+ *
+ * A raised `sdk.promptDeadlineMs` makes the crash rarer, never impossible: the
+ * hard `sdk.promptMaxRuntimeMs` cap still fires on a long run, and the session
+ * is then torn down with whatever the agent already edited still uncommitted.
+ * Field reports lost ~25 minutes of finished work across 37 dirty files that
+ * way. Persist that work as a WIP commit in the agent's own worktree before
+ * teardown so the next run resumes from a commit instead of re-reasoning.
+ *
+ * Strictly best effort AND strictly bounded. Every failure — including an abort —
+ * is logged and swallowed: the prompt still fails with `prompt_deadline_exceeded`
+ * and teardown still happens, because the deadline outcome must never depend on
+ * git. Every git call that accepts a signal gets one, so a blocking lock or a
+ * hanging plumbing command is killed rather than waited on.
+ *
+ * ── Isolated index, plumbing commit, compare-and-swap ref move (#5623 round 4)
+ *
+ * The autosave never opens the user's real `.git/index` for writing and never
+ * runs a repository hook:
+ *
+ *   1. everything is staged into a throwaway index inside the worktree's own git
+ *      dir (`GIT_INDEX_FILE`), seeded from the HEAD captured before staging;
+ *   2. the commit is built with plumbing — `write-tree` then `commit-tree` — so
+ *      `pre-commit`/`commit-msg` cannot execute during teardown;
+ *   3. the ref moves with a compare-and-swap against that captured HEAD, so the
+ *      one mutation that can outlive teardown is conditional: an abandoned flush
+ *      that wakes up late finds HEAD moved and does nothing. `withRepoLock`
+ *      awaits its predecessor BEFORE honouring the signal, so this really does
+ *      happen — the abort alone cannot prevent it;
+ *   4. the real index is adopted only after that swap succeeds, so a successful
+ *      autosave leaves `git status` clean instead of a phantom reverse diff.
+ *
+ * Every failing and aborted path therefore just unlinks the temp index. There is
+ * no rollback left to get wrong, and index-only state the user set — intent-to-add,
+ * skip-worktree/assume-unchanged, sparse-index, index extensions — survives byte
+ * for byte because the file was never written.
+ *
+ * ── Ownership
+ *
+ * Staging the whole dirty worktree (`git add -A`, untracked files included) is
+ * the point: the work being saved is whatever the agent touched, and narrowing
+ * it would strand exactly the files this exists for. What makes that safe is
+ * WHERE it runs. `sdk.flushWorktreeOnDeadline` still defaults to on, but the
+ * implicit default applies only in a LINKED worktree (`gitDir !== commonDir`) —
+ * what agent/paseo sessions run in, and the #5583 field report. In the user's
+ * primary checkout an autosave needs an explicit opt-in.
+ */
+export interface PromptDeadlineFlushResult {
+    /** Branch the WIP commit landed on, or `undefined` on a detached HEAD. */
+    branch?: string;
+    /** Abbreviated SHA of the WIP commit. */
+    commit: string;
+    /** Worktree root the commit was made in. */
+    worktreeRoot: string;
+}
+export interface PromptDeadlineFlushOptions {
+    /**
+     * Whether the caller resolved `sdk.flushWorktreeOnDeadline` to `true` from a
+     * value the user actually wrote, rather than from the schema default. Only an
+     * explicit opt-in may autosave outside a linked worktree.
+     */
+    readonly explicitOptIn?: boolean;
+    /**
+     * Whether the deadline attempt still owns the prompt. The callback is checked
+     * immediately before the ref move and again before the real index is adopted,
+     * so progress that renews the lease can abandon the prepared WIP safely.
+     */
+    readonly isCurrent?: () => boolean;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Commit any uncommitted work in the worktree owning `cwd`.
+ *
+ * Returns `undefined` — without moving any ref — when `cwd` is not inside a git
+ * worktree, when the tree is already clean, when the session does not own the
+ * checkout, or when git fails or is aborted. Only the session's own worktree is
+ * touched; nothing is ever pushed.
+ *
+ * The abort signal is composed with an internal `DEADLINE_FLUSH_TIMEOUT_MS`
+ * bound, so a caller that passes nothing still cannot hang here.
+ */
+export declare function flushWorktreeOnPromptDeadline(cwd: string, options?: AbortSignal | PromptDeadlineFlushOptions): Promise<PromptDeadlineFlushResult | undefined>;

package/dist/types/sdk/prompt-deadline-manager.d.ts

@@ -2,6 +2,25 @@ import type { KindAwareReconciliation } from "./bus/kind-aware-reconciliation";
 import type { InvocationCorrelation, InvocationReconciliation } from "./host/session-runtime";
 import type { SdkPromptTerminalOutcome } from "./prompt-status";
 import type { TurnResultContent } from "./turn-result";
+/**
+ * Hard real-time bound on the best-effort durability hook, shared with
+ * `prompt-deadline-flush` so the manager's race and the flush's own abort
+ * signal cannot drift apart.
+ */
+export declare const DEADLINE_FLUSH_TIMEOUT_MS = 10000;
+/**
+ * Run a best-effort durability flush under a hard real-time bound that ALWAYS
+ * settles, and never let its result reach the caller.
+ *
+ * Shared by both expiry paths — this manager and the notification bus's own
+ * terminalization (#5583) — so there is one bound, one abort, and one warning,
+ * with no drift between them. A rejection is swallowed; a `run` that never
+ * settles is abandoned after `timeoutMs` with its signal aborted so any git
+ * subprocess dies. The signal alone is not sufficient: `git.withRepoLock`
+ * awaits its predecessor before honouring it, so a hung predecessor in the
+ * per-repo write chain is cut only by this outer race.
+ */
+export declare function runBoundedDeadlineFlush(run: (signal: AbortSignal) => unknown, timeoutMs?: number): Promise<void>;
 type DeadlineReconciliation = InvocationReconciliation | KindAwareReconciliation;
 export type PromptDeadlineOutcome = Extract<SdkPromptTerminalOutcome, {
     kind: "failed";
@@ -22,6 +41,24 @@ export declare class PromptDeadlineManager {
         getMaxMs: () => number;
         now?: () => number;
         onExpired?: (correlation: InvocationCorrelation, outcome?: PromptDeadlineOutcome) => void;
+        /**
+         * Best-effort durability hook for the single path that genuinely retires a
+         * prompt as `prompt_deadline_exceeded` (#5583). Awaited after the durable
+         * pending claim but BEFORE the durable terminal, so a crash in that window
+         * leaves the record pending and recovery retries the prompt; a
+         * rejection is swallowed and never changes the deadline outcome. Not called
+         * when a real terminal transition or a real failure won the race, nor when
+         * renewed progress supersedes this expiry instance. The hook receives an
+         * abort signal that fires when it outruns `deadlineFlushTimeoutMs`, plus a
+         * generation fence for irreversible worktree adoption.
+         */
+        onDeadlineExceeded?: (correlation: InvocationCorrelation, signal: AbortSignal, isCurrent?: () => boolean) => void | Promise<void>;
+        /**
+         * Hard bound on `onDeadlineExceeded`. Measured with a real timer, not
+         * `now`, because it guards real subprocesses — which is also why it is a
+         * constructor option: a fake clock cannot shorten it for tests.
+         */
+        deadlineFlushTimeoutMs?: number;
     });
     onAccepted(correlation: InvocationCorrelation): void;
     /** Re-arm a durable uncertainty-recovery record after process startup without

package/dist/types/sdk/prompt-tool-boundary.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Bounded wait for an in-flight dispatched tool call to reach its boundary
+ * before an expired prompt deadline force-terminates the run (#5637).
+ *
+ * Terminal fencing aborts the run's cancellation domain FIRST and only proves
+ * settlement afterwards (`RunResourceLedger.waitForSettlement` resolves once the
+ * run is sealed and its tracked `kind: "tool"` resources have settled), so a
+ * tool that was mid-write when the deadline expired observes the aborted signal
+ * DURING its write and leaves a torn artifact behind. Waiting for that call's
+ * own `tool_execution_end` — under a short, finite grace — turns the kill into a
+ * boundary abort. When the grace is exhausted the run is force-terminated
+ * exactly as before, and the fact that a tool was still executing is returned as
+ * structured evidence rather than dropped.
+ *
+ * Deliberately dependency-light and clock-injectable: the contended bus module
+ * takes only a call, and the behaviour is testable without a live transport.
+ */
+/**
+ * Hard bound on how long deadline expiry will wait for an in-flight tool call to
+ * reach its boundary before force-terminating. This guards a real subprocess, so
+ * it is a real timer rather than the lease clock — and a parameter rather than a
+ * bare module constant, so a test may shorten it explicitly instead of a fake
+ * clock silently shortening it for production code too.
+ */
+export declare const TOOL_CALL_BOUNDARY_GRACE_MS = 5000;
+/**
+ * Re-check interval for the pending set while the grace runs.
+ *
+ * The authoritative source of "is a tool running?" is the run resource ledger,
+ * a SYNCHRONOUS snapshot with no completion signal of its own, so the wait has
+ * to look again rather than being told. `whenIdle` only wakes the check early
+ * when the event-derived view happens to drain first. Bounded by the grace, so
+ * this costs at most `graceMs / pollMs` array reads on the rare expiry-with-a-
+ * tool-running path and nothing at all on the idle path.
+ */
+export declare const TOOL_CALL_BOUNDARY_POLL_MS = 25;
+export type ToolBoundaryOutcome = "idle" | "settled" | "forced";
+export interface ToolBoundaryWaitResult {
+    outcome: ToolBoundaryOutcome;
+    waitedMs: number;
+    /**
+     * Non-empty ONLY for "forced": the dispatched tool calls still running when
+     * the grace expired. Ids only — never tool arguments, output or paths.
+     */
+    pendingToolCallIds: string[];
+}
+/**
+ * Shared result for the common case of no dispatched tool running at expiry.
+ * Frozen because it is handed to every idle caller: the deadline path must stay
+ * byte-identical to its pre-#5637 behaviour, which includes allocating nothing
+ * and arming no timer.
+ */
+export declare const IDLE_TOOL_BOUNDARY_RESULT: ToolBoundaryWaitResult;
+/**
+ * Wait for the pending dispatched tool calls to drain, bounded by `graceMs`.
+ *
+ * Never composed with an abort signal: at the only call site nothing has been
+ * aborted yet, and a signal that was already aborted would make this wait
+ * unreachable — which is precisely the mid-tool kill being fixed.
+ */
+export declare function waitForToolCallBoundary(input: {
+    pending: () => readonly string[];
+    /**
+     * Resolves when the event-derived view of the pending set drains. A wake-up
+     * HINT only: `pending()` is re-read before the wait is allowed to settle,
+     * because the authoritative source may still hold a call this signal knows
+     * nothing about. Expected never to reject.
+     */
+    whenIdle: () => Promise<void>;
+    graceMs?: number;
+    pollMs?: number;
+    now?: () => number;
+}): Promise<ToolBoundaryWaitResult>;

package/dist/types/sdk/router/session-router.d.ts

@@ -177,6 +177,8 @@ export interface SessionRouterOptions {
     agentDir: string;
     /** Limits attachment to exact ids selected by a Broker-scoped operation. */
     sessionIds?: readonly string[];
+    /** Marks default SDK clients as notification-only observers; demanding by default. */
+    observer?: boolean;
     deps?: SessionRouterDeps;
     /** Runtime-specific identity validation; Router supplies a conservative fallback. */
     correlateFrame?: SessionRouterFrameCorrelator;

package/dist/types/sdk/startup-capability.d.ts

@@ -44,6 +44,8 @@ export declare class SdkStartupRollbackTracker {
 export declare function sanitizeSdkStartupMessage(value: unknown, knownSecrets?: Iterable<unknown>): string;
 /** Convert every lifecycle bootstrap outcome to the public, bounded failure shape. */
 export declare function normalizeSdkStartupFailure(phase: SdkStartupPhase, reason: SdkStartupReason, error?: unknown, knownSecrets?: Iterable<unknown>): SdkStartupFailure;
+/** Collect process-scoped credentials without exposing a raw-secret API. */
+export declare function lifecycleKnownSecrets(): string[];
 /** Session-owned, exactly-once lifecycle bootstrap completion. */
 export declare class SdkStartupCapability {
     #private;

package/dist/types/sdk/transport/relay.d.ts

@@ -2,6 +2,7 @@ import type { Readable, Writable } from "node:stream";
 export declare const REQUEST_FRAME_BYTES: number;
 export declare const DEFAULT_PENDING_CEILING_BYTES: number;
 export declare const MIN_PENDING_CEILING_BYTES: number;
+export declare const DEFAULT_UPSTREAM_HELLO_TIMEOUT_MS = 10000;
 export type RelayDirection = "downstream->ws" | "ws->downstream";
 export type TransportError = {
     type: "transport_error";

package/dist/types/sdk/transport/serve-cli.d.ts

@@ -1,10 +1,13 @@
+import { PublicCommandFailure } from "../../cli/public-command-errors";
 import { SdkClient } from "../client";
+import type { ServeHandle } from "./index";
+import { startSocketServe, startStdioServe } from "./index";
 /**
  * A `gjc sdk serve` operational failure with a stable machine-readable code and a
  * documented exit code, mirroring `SdkSessionCliError`. Usage errors keep their own
- * `CliParseError` path; this type covers only failures an embedder must branch on.
+ * public failure envelope; this type covers only failures an embedder must branch on.
  */
-export declare class SdkServeError extends Error {
+export declare class SdkServeError extends PublicCommandFailure {
     readonly code: string;
     readonly exitCode: 1;
     readonly details?: unknown;
@@ -28,20 +31,61 @@ export declare class SdkServeError extends Error {
 export declare function resolveServeOutcome(primary: Error | undefined, cleanup: Error | undefined): Error | undefined;
 /** Resolves the pending ceiling with flag > env > default precedence; exported for tests. */
 export declare function resolveServePendingCeiling(flagValue: string | undefined, envValue: string | undefined): number;
+type BrokerTranscriptIdentity = {
+    dev: string;
+    ino: string;
+    size: number;
+    mtimeMs: number;
+    mtimeNs: string;
+    sha256: string;
+};
+type BrokerSavedSession = {
+    id: string;
+    path: string;
+    identity: BrokerTranscriptIdentity;
+};
+type BrokerSessionLocator = {
+    cwd: string;
+    worktreeRoot: string | null;
+    stateRoot: string;
+};
 type BrokerSessionRow = {
     sessionId: string;
     live: boolean;
     ambiguous: boolean;
+    terminal?: boolean;
+    hostUnregisteredReason?: "process_exited" | "detached_idle";
+    terminalUncertain?: boolean;
+    locator?: BrokerSessionLocator;
+    savedSession?: BrokerSavedSession;
 };
 /** Exhausts strict broker `session.list` pages into one full session snapshot. */
-export declare function listBrokerSessions(broker: SdkClient, explicitSessionId?: string): Promise<BrokerSessionRow[]>;
+export declare function listBrokerSessions(broker: Pick<SdkClient, "global">, explicitSessionId?: string, cwd?: string): Promise<BrokerSessionRow[]>;
+/** Resolves an explicit or automatic serve target, reattaching one stale explicit session at most once. */
+export declare function resolveServeSession(broker: SdkClient, explicitSessionId?: string): Promise<string>;
 /** Selects the session to serve through broker `session.list` truth (C10); exported for tests. */
 export declare function selectBrokerSession(sessions: BrokerSessionRow[], explicitSessionId: string | undefined): string;
+/** Bounded dependency seam for preflight tests; production keeps the same transport factories. */
+export interface SdkServeDependencies {
+    readDiscovery: (agentDir: string) => Promise<{
+        url: string;
+        token: string;
+    } | null>;
+    connect: (url: string, token: string) => Promise<Pick<SdkClient, "global" | "close">>;
+    startStdio: typeof startStdioServe;
+    startSocket: typeof startSocketServe;
+}
 /**
  * Attaches a stdio or Unix-socket relay to one live SDK session endpoint.
  * Session targeting is broker-bound (C10): `session.list` resolves the session
  * and `session.get_endpoint` mints the exact credential — never a direct
  * endpoint-file read. A missing or unreachable broker fails closed.
  */
-export declare function runSdkServe(argv: string[]): Promise<void>;
+export declare function runSdkServe(argv: string[], dependencies?: SdkServeDependencies): Promise<void>;
+/**
+ * Acquiring a ServeHandle transfers output/termination ownership to transport.
+ * This boundary never rejects into the ordinary public command writer, even
+ * when no frame has been written. Raw relay framing remains transport-owned.
+ */
+export declare function ownSdkServeTransport(handle: ServeHandle, closeBroker: () => Promise<void>): Promise<void>;
 export {};

package/dist/types/sdk/transport/stdio.d.ts

@@ -1,3 +1,7 @@
+import type { Readable, Writable } from "node:stream";
 import type { ServeHandle, ServeOptions } from "./index";
 /** Serves one parent-owned JSONL connection over the process standard streams. */
-export declare function startStdioServe(options: ServeOptions): Promise<ServeHandle>;
+export declare function startStdioServe(options: ServeOptions, streams?: {
+    readonly input?: Readable;
+    readonly output?: Writable;
+}): Promise<ServeHandle>;