@gajae-code/coding-agent 0.17.2 → 0.17.5

package/dist/types/sdk/prompt-deadline-manager.d.ts

@@ -2,6 +2,25 @@ import type { KindAwareReconciliation } from "./bus/kind-aware-reconciliation";
 import type { InvocationCorrelation, InvocationReconciliation } from "./host/session-runtime";
 import type { SdkPromptTerminalOutcome } from "./prompt-status";
 import type { TurnResultContent } from "./turn-result";
+/**
+ * Hard real-time bound on the best-effort durability hook, shared with
+ * `prompt-deadline-flush` so the manager's race and the flush's own abort
+ * signal cannot drift apart.
+ */
+export declare const DEADLINE_FLUSH_TIMEOUT_MS = 10000;
+/**
+ * Run a best-effort durability flush under a hard real-time bound that ALWAYS
+ * settles, and never let its result reach the caller.
+ *
+ * Shared by both expiry paths — this manager and the notification bus's own
+ * terminalization (#5583) — so there is one bound, one abort, and one warning,
+ * with no drift between them. A rejection is swallowed; a `run` that never
+ * settles is abandoned after `timeoutMs` with its signal aborted so any git
+ * subprocess dies. The signal alone is not sufficient: `git.withRepoLock`
+ * awaits its predecessor before honouring it, so a hung predecessor in the
+ * per-repo write chain is cut only by this outer race.
+ */
+export declare function runBoundedDeadlineFlush(run: (signal: AbortSignal) => unknown, timeoutMs?: number): Promise<void>;
 type DeadlineReconciliation = InvocationReconciliation | KindAwareReconciliation;
 export type PromptDeadlineOutcome = Extract<SdkPromptTerminalOutcome, {
     kind: "failed";
@@ -22,6 +41,24 @@ export declare class PromptDeadlineManager {
         getMaxMs: () => number;
         now?: () => number;
         onExpired?: (correlation: InvocationCorrelation, outcome?: PromptDeadlineOutcome) => void;
+        /**
+         * Best-effort durability hook for the single path that genuinely retires a
+         * prompt as `prompt_deadline_exceeded` (#5583). Awaited after the durable
+         * pending claim but BEFORE the durable terminal, so a crash in that window
+         * leaves the record pending and recovery retries the prompt; a
+         * rejection is swallowed and never changes the deadline outcome. Not called
+         * when a real terminal transition or a real failure won the race, nor when
+         * renewed progress supersedes this expiry instance. The hook receives an
+         * abort signal that fires when it outruns `deadlineFlushTimeoutMs`, plus a
+         * generation fence for irreversible worktree adoption.
+         */
+        onDeadlineExceeded?: (correlation: InvocationCorrelation, signal: AbortSignal, isCurrent?: () => boolean) => void | Promise<void>;
+        /**
+         * Hard bound on `onDeadlineExceeded`. Measured with a real timer, not
+         * `now`, because it guards real subprocesses — which is also why it is a
+         * constructor option: a fake clock cannot shorten it for tests.
+         */
+        deadlineFlushTimeoutMs?: number;
     });
     onAccepted(correlation: InvocationCorrelation): void;
     /** Re-arm a durable uncertainty-recovery record after process startup without

package/dist/types/sdk/prompt-tool-boundary.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Bounded wait for an in-flight dispatched tool call to reach its boundary
+ * before an expired prompt deadline force-terminates the run (#5637).
+ *
+ * Terminal fencing aborts the run's cancellation domain FIRST and only proves
+ * settlement afterwards (`RunResourceLedger.waitForSettlement` resolves once the
+ * run is sealed and its tracked `kind: "tool"` resources have settled), so a
+ * tool that was mid-write when the deadline expired observes the aborted signal
+ * DURING its write and leaves a torn artifact behind. Waiting for that call's
+ * own `tool_execution_end` — under a short, finite grace — turns the kill into a
+ * boundary abort. When the grace is exhausted the run is force-terminated
+ * exactly as before, and the fact that a tool was still executing is returned as
+ * structured evidence rather than dropped.
+ *
+ * Deliberately dependency-light and clock-injectable: the contended bus module
+ * takes only a call, and the behaviour is testable without a live transport.
+ */
+/**
+ * Hard bound on how long deadline expiry will wait for an in-flight tool call to
+ * reach its boundary before force-terminating. This guards a real subprocess, so
+ * it is a real timer rather than the lease clock — and a parameter rather than a
+ * bare module constant, so a test may shorten it explicitly instead of a fake
+ * clock silently shortening it for production code too.
+ */
+export declare const TOOL_CALL_BOUNDARY_GRACE_MS = 5000;
+/**
+ * Re-check interval for the pending set while the grace runs.
+ *
+ * The authoritative source of "is a tool running?" is the run resource ledger,
+ * a SYNCHRONOUS snapshot with no completion signal of its own, so the wait has
+ * to look again rather than being told. `whenIdle` only wakes the check early
+ * when the event-derived view happens to drain first. Bounded by the grace, so
+ * this costs at most `graceMs / pollMs` array reads on the rare expiry-with-a-
+ * tool-running path and nothing at all on the idle path.
+ */
+export declare const TOOL_CALL_BOUNDARY_POLL_MS = 25;
+export type ToolBoundaryOutcome = "idle" | "settled" | "forced";
+export interface ToolBoundaryWaitResult {
+    outcome: ToolBoundaryOutcome;
+    waitedMs: number;
+    /**
+     * Non-empty ONLY for "forced": the dispatched tool calls still running when
+     * the grace expired. Ids only — never tool arguments, output or paths.
+     */
+    pendingToolCallIds: string[];
+}
+/**
+ * Shared result for the common case of no dispatched tool running at expiry.
+ * Frozen because it is handed to every idle caller: the deadline path must stay
+ * byte-identical to its pre-#5637 behaviour, which includes allocating nothing
+ * and arming no timer.
+ */
+export declare const IDLE_TOOL_BOUNDARY_RESULT: ToolBoundaryWaitResult;
+/**
+ * Wait for the pending dispatched tool calls to drain, bounded by `graceMs`.
+ *
+ * Never composed with an abort signal: at the only call site nothing has been
+ * aborted yet, and a signal that was already aborted would make this wait
+ * unreachable — which is precisely the mid-tool kill being fixed.
+ */
+export declare function waitForToolCallBoundary(input: {
+    pending: () => readonly string[];
+    /**
+     * Resolves when the event-derived view of the pending set drains. A wake-up
+     * HINT only: `pending()` is re-read before the wait is allowed to settle,
+     * because the authoritative source may still hold a call this signal knows
+     * nothing about. Expected never to reject.
+     */
+    whenIdle: () => Promise<void>;
+    graceMs?: number;
+    pollMs?: number;
+    now?: () => number;
+}): Promise<ToolBoundaryWaitResult>;

package/dist/types/sdk/router/session-router.d.ts

@@ -177,6 +177,8 @@ export interface SessionRouterOptions {
     agentDir: string;
     /** Limits attachment to exact ids selected by a Broker-scoped operation. */
     sessionIds?: readonly string[];
+    /** Marks default SDK clients as notification-only observers; demanding by default. */
+    observer?: boolean;
     deps?: SessionRouterDeps;
     /** Runtime-specific identity validation; Router supplies a conservative fallback. */
     correlateFrame?: SessionRouterFrameCorrelator;

package/dist/types/sdk/session.d.ts

@@ -233,9 +233,9 @@ export interface CreateAgentSessionOptions {
     inheritedAsyncJobManager?: AsyncJobManager;
     /**
      * W6b: the parent's scope-held MCP facade, handed to a canonical sub-session so
-     * it can inherit always-on MCP tools without owning the manager. Replaces the
-     * removed `MCPManager.instance()` inheritance path; the sub-session never
-     * connects, registers callbacks, or disposes this manager.
+     * it can inherit MCP tools without owning the manager. Replaces the removed
+     * `MCPManager.instance()` inheritance path; the sub-session subscribes to catalog
+     * changes but never connects or disposes this manager.
      */
     inheritedMcpManager?: import("../runtime-mcp/manager").MCPManager;
     /** Session manager. Default: session stored under the configured agentDir sessions root */

package/dist/types/sdk/startup-capability.d.ts

@@ -44,6 +44,8 @@ export declare class SdkStartupRollbackTracker {
 export declare function sanitizeSdkStartupMessage(value: unknown, knownSecrets?: Iterable<unknown>): string;
 /** Convert every lifecycle bootstrap outcome to the public, bounded failure shape. */
 export declare function normalizeSdkStartupFailure(phase: SdkStartupPhase, reason: SdkStartupReason, error?: unknown, knownSecrets?: Iterable<unknown>): SdkStartupFailure;
+/** Collect process-scoped credentials without exposing a raw-secret API. */
+export declare function lifecycleKnownSecrets(): string[];
 /** Session-owned, exactly-once lifecycle bootstrap completion. */
 export declare class SdkStartupCapability {
     #private;

package/dist/types/sdk/transport/relay.d.ts

@@ -2,6 +2,7 @@ import type { Readable, Writable } from "node:stream";
 export declare const REQUEST_FRAME_BYTES: number;
 export declare const DEFAULT_PENDING_CEILING_BYTES: number;
 export declare const MIN_PENDING_CEILING_BYTES: number;
+export declare const DEFAULT_UPSTREAM_HELLO_TIMEOUT_MS = 10000;
 export type RelayDirection = "downstream->ws" | "ws->downstream";
 export type TransportError = {
     type: "transport_error";

package/dist/types/sdk/transport/serve-cli.d.ts

@@ -1,10 +1,13 @@
+import { PublicCommandFailure } from "../../cli/public-command-errors";
 import { SdkClient } from "../client";
+import type { ServeHandle } from "./index";
+import { startSocketServe, startStdioServe } from "./index";
 /**
  * A `gjc sdk serve` operational failure with a stable machine-readable code and a
  * documented exit code, mirroring `SdkSessionCliError`. Usage errors keep their own
- * `CliParseError` path; this type covers only failures an embedder must branch on.
+ * public failure envelope; this type covers only failures an embedder must branch on.
  */
-export declare class SdkServeError extends Error {
+export declare class SdkServeError extends PublicCommandFailure {
     readonly code: string;
     readonly exitCode: 1;
     readonly details?: unknown;
@@ -28,20 +31,61 @@ export declare class SdkServeError extends Error {
 export declare function resolveServeOutcome(primary: Error | undefined, cleanup: Error | undefined): Error | undefined;
 /** Resolves the pending ceiling with flag > env > default precedence; exported for tests. */
 export declare function resolveServePendingCeiling(flagValue: string | undefined, envValue: string | undefined): number;
+type BrokerTranscriptIdentity = {
+    dev: string;
+    ino: string;
+    size: number;
+    mtimeMs: number;
+    mtimeNs: string;
+    sha256: string;
+};
+type BrokerSavedSession = {
+    id: string;
+    path: string;
+    identity: BrokerTranscriptIdentity;
+};
+type BrokerSessionLocator = {
+    cwd: string;
+    worktreeRoot: string | null;
+    stateRoot: string;
+};
 type BrokerSessionRow = {
     sessionId: string;
     live: boolean;
     ambiguous: boolean;
+    terminal?: boolean;
+    hostUnregisteredReason?: "process_exited" | "detached_idle";
+    terminalUncertain?: boolean;
+    locator?: BrokerSessionLocator;
+    savedSession?: BrokerSavedSession;
 };
 /** Exhausts strict broker `session.list` pages into one full session snapshot. */
-export declare function listBrokerSessions(broker: SdkClient, explicitSessionId?: string): Promise<BrokerSessionRow[]>;
+export declare function listBrokerSessions(broker: Pick<SdkClient, "global">, explicitSessionId?: string, cwd?: string): Promise<BrokerSessionRow[]>;
+/** Resolves an explicit or automatic serve target, reattaching one stale explicit session at most once. */
+export declare function resolveServeSession(broker: SdkClient, explicitSessionId?: string): Promise<string>;
 /** Selects the session to serve through broker `session.list` truth (C10); exported for tests. */
 export declare function selectBrokerSession(sessions: BrokerSessionRow[], explicitSessionId: string | undefined): string;
+/** Bounded dependency seam for preflight tests; production keeps the same transport factories. */
+export interface SdkServeDependencies {
+    readDiscovery: (agentDir: string) => Promise<{
+        url: string;
+        token: string;
+    } | null>;
+    connect: (url: string, token: string) => Promise<Pick<SdkClient, "global" | "close">>;
+    startStdio: typeof startStdioServe;
+    startSocket: typeof startSocketServe;
+}
 /**
  * Attaches a stdio or Unix-socket relay to one live SDK session endpoint.
  * Session targeting is broker-bound (C10): `session.list` resolves the session
  * and `session.get_endpoint` mints the exact credential — never a direct
  * endpoint-file read. A missing or unreachable broker fails closed.
  */
-export declare function runSdkServe(argv: string[]): Promise<void>;
+export declare function runSdkServe(argv: string[], dependencies?: SdkServeDependencies): Promise<void>;
+/**
+ * Acquiring a ServeHandle transfers output/termination ownership to transport.
+ * This boundary never rejects into the ordinary public command writer, even
+ * when no frame has been written. Raw relay framing remains transport-owned.
+ */
+export declare function ownSdkServeTransport(handle: ServeHandle, closeBroker: () => Promise<void>): Promise<void>;
 export {};

package/dist/types/sdk/transport/stdio.d.ts

@@ -1,3 +1,7 @@
+import type { Readable, Writable } from "node:stream";
 import type { ServeHandle, ServeOptions } from "./index";
 /** Serves one parent-owned JSONL connection over the process standard streams. */
-export declare function startStdioServe(options: ServeOptions): Promise<ServeHandle>;
+export declare function startStdioServe(options: ServeOptions, streams?: {
+    readonly input?: Readable;
+    readonly output?: Writable;
+}): Promise<ServeHandle>;

package/dist/types/session/agent-session.d.ts

@@ -17,6 +17,7 @@ import type { AttemptScope } from "@gajae-code/agent-core/attempt-scope";
 import { type CompactionResult, type EmergencyCompactionSample } from "@gajae-code/agent-core/compaction";
 import type { AssistantMessage, AttemptScopeRef, Effort, ImageContent, Message, MessageAttribution, Model, ProviderSessionState, ServiceTier, SimpleStreamOptions, TextContent, ToolCall, ToolChoice, Usage, UsageReport } from "@gajae-code/ai/core";
 import { type BtwTextExchange } from "./btw-contract";
+import { type SessionWorkLease } from "./session-work-lease";
 export interface ForkContextSeedMetadata {
     sourceSessionId: string;
     parentMessageCount: number;
@@ -96,7 +97,7 @@ import { type AgentRegistry } from "../registry/agent-registry";
 import type { LazyService } from "../runtime/lazy-service";
 import type { NetworkPrewarmRuntime } from "../runtime/network-prewarm-service";
 import type { WorkspaceTreeRuntime } from "../runtime/workspace-tree-service";
-import { MCPManager } from "../runtime-mcp/manager";
+import { type ExactMcpServerControlResult, MCPManager } from "../runtime-mcp/manager";
 import type { NotificationSessionController } from "../sdk/bus/session-control";
 import type { SecretObfuscator } from "../secrets/obfuscator";
 import { type DiscoverableTool, type DiscoverableToolSearchIndex } from "../tool-discovery/tool-index";
@@ -196,6 +197,47 @@ export type AgentSessionEvent = AgentEvent | {
     goal: Goal | null;
     state?: GoalModeState;
 };
+export type QueuedInputDelivery = "steer" | "followUp";
+export type QueuedInputQueuePolicy = "respect-mode" | "sequential";
+export type QueuedInputRemovalReason = "cancelled" | "removed";
+export interface QueuedInputAdmission {
+    submissionId: string;
+    delivery: QueuedInputDelivery;
+    queuePolicy: QueuedInputQueuePolicy;
+}
+export type QueuedInputExecution = {
+    submissionId: string;
+    delivery: QueuedInputDelivery;
+    disposition: "joined-current-run" | "promoted-to-run";
+    attemptScope: AttemptScopeRef;
+} | {
+    submissionId: string;
+    delivery: QueuedInputDelivery;
+    disposition: "removed";
+    reason: QueuedInputRemovalReason;
+};
+export type QueuedInputTerminal = {
+    submissionId: string;
+    delivery: QueuedInputDelivery;
+    disposition: "completed";
+    attemptScope: AttemptScopeRef;
+} | {
+    submissionId: string;
+    delivery: QueuedInputDelivery;
+    disposition: "removed";
+    reason: QueuedInputRemovalReason;
+};
+/**
+ * Lifecycle receipt for one explicitly queued `submitUserMessage` submission.
+ */
+export interface QueuedInputSubmission {
+    readonly submissionId: string;
+    readonly admitted: Promise<QueuedInputAdmission>;
+    readonly execution: Promise<QueuedInputExecution>;
+    readonly terminal: Promise<QueuedInputTerminal>;
+    /** Remove the submission if it is still queued. Returns false after execution or removal. */
+    readonly cancel: () => boolean;
+}
 /** Listener function for agent session events */
 export type AgentSessionEventListener = (event: AgentSessionEvent) => void;
 export type AsyncJobSnapshotItem = Pick<AsyncJob, "id" | "type" | "status" | "label" | "startTime" | "endTime" | "metadata">;
@@ -439,6 +481,30 @@ export interface PromptOptions {
     /** Internal host capability; ordinary package callers cannot construct the branded value. */
     sdkRunCapability?: unknown;
 }
+export interface SendUserMessageOptions {
+    deliverAs?: QueuedInputDelivery;
+    /** Preserve a busy SDK dispatch as queued work across an admission fence. */
+    queuedAtDispatch?: boolean;
+    /** Delivery ordering for a tracked or SDK-queued submission. */
+    queuePolicy?: QueuedInputQueuePolicy;
+    onPreflightAccepted?: () => void;
+    onPreflightAcceptCommit?: () => void | Promise<void>;
+    /** Internal SDK ownership callback. */
+    onQueuedPromoted?: (promotion: {
+        startsOwnRun?: boolean;
+        removed?: boolean;
+    }) => void;
+    /** Internal dispatch disposition used before actual queue consumption. */
+    onDispatchDisposition?: (promotion: {
+        startsOwnRun: boolean;
+    }) => void;
+    preflightSignal?: AbortSignal;
+    sdkRunCapability?: unknown;
+}
+export interface TrackedSendUserMessageOptions extends SendUserMessageOptions {
+    deliverAs: QueuedInputDelivery;
+    trackSubmission: true;
+}
 /** Result from a handoff operation. */
 export interface HandoffResult {
     document: string;
@@ -614,11 +680,58 @@ export declare class StreamingEditFileCache {
     has(path: string): boolean;
     get totalBytes(): number;
 }
+/**
+ * Startup phase of the session-owned exact-config MCP manager.
+ *
+ * `not-started` and `no-servers-declared` are distinguishable only because the
+ * snapshot reads the declared server list from the exact config; the manager
+ * alone reports an empty name list in both cases.
+ */
+export type ExactMcpStartupState = "not-started" | "no-servers-declared" | "in-flight" | "settled";
+/**
+ * Per-server state.
+ *
+ * `unavailable` covers a server the config declares that the manager has no
+ * live record of. A tools-only manager erases a server from its own bookkeeping
+ * when the connection fails, so a failed server and one whose startup has not
+ * reached it are indistinguishable from here; both surface as `unavailable`
+ * rather than being dropped from the table.
+ */
+export type ExactMcpServerState = "connecting" | "connected" | "disconnected" | "unavailable";
+export type ExactMcpServerDisplayState = ExactMcpServerState | "suspended";
+/**
+ * Transport a server is declared with. Taken from the config's own
+ * discriminator, never from a live connection: `getConnection` throws on a
+ * tools-only manager, so the declaration is the only source available here.
+ */
+export type ExactMcpTransport = "stdio" | "http" | "sse" | "unknown";
+export interface ExactMcpServerStatus {
+    readonly name: string;
+    readonly transport: ExactMcpTransport;
+    readonly state: ExactMcpServerDisplayState;
+    readonly toolCount: number;
+}
+/**
+ * Whitelisted status shape for the TUI `/mcp` command. Every field here is
+ * either a server name the operator already supplied or a derived enum/count;
+ * pool keys, endpoints, commands, env, headers, tokens, and raw exception text
+ * have no field to travel in.
+ */
+export interface ExactMcpStatusSnapshot {
+    readonly startup: ExactMcpStartupState;
+    readonly servers: readonly ExactMcpServerStatus[];
+}
+export type ExactMcpControlAction = "suspend" | "resume" | "reconnect";
+export interface ExactMcpControlResult extends ExactMcpServerControlResult {
+    readonly action: ExactMcpControlAction;
+}
 export interface DefaultFallbackRuntimeState {
     chain: ConfiguredFallbackChain;
     controller: FallbackChainRuntimeState;
     exhaustedLastTurn: boolean;
 }
+/** A lost continuation may only settle the emitter/session pair that opened it. */
+export declare function isCurrentWorkflowGateContinuation(currentSessionId: string, expectedSessionId: string, currentEmitter: WorkflowGateEmitter | undefined, expectedEmitter: WorkflowGateEmitter): boolean;
 export declare class AgentSession {
     #private;
     readonly agent: Agent;
@@ -679,8 +792,11 @@ export declare class AgentSession {
     } | undefined;
     /** Replace the session-owned MCP manager after a cwd rescope. */
     replaceOwnedMcpManager(next: MCPManager | undefined): Promise<void>;
-    /** Swap named custom/project tools after a cwd rescope. */
-    replaceNamedCustomTools(previousNames: readonly string[], nextTools: CustomTool[]): Promise<void>;
+    /** Swap named custom tools and their optional mandatory MCP selection. */
+    replaceNamedCustomTools(previousNames: readonly string[], nextTools: readonly CustomTool[], options?: {
+        mandatoryMCPToolNames?: readonly string[];
+        activateNewTools?: boolean;
+    }): Promise<void>;
     /** Best-effort accessor for the active skill's `current_phase` field from
      *  its persisted mode-state file. Used by the `skill` tool to enforce the
      *  terminal-phase chain guard. Returns undefined when no active skill is
@@ -760,7 +876,9 @@ export declare class AgentSession {
      * Remove all listeners, flush pending writes, and disconnect from agent.
      * Call this when completely done with the session.
      */
-    dispose(): Promise<void>;
+    dispose(options?: {
+        sessionShutdownReason?: "detached_idle";
+    }): Promise<void>;
     /** Join the retained teardown owner without allocating another public deadline. */
     awaitDisposeCompletion(): Promise<void>;
     setDisposeTimeoutForTests(timeoutMs: number): void;
@@ -919,6 +1037,21 @@ export declare class AgentSession {
      * Get all configured tool names (built-in via --tools or default, plus custom tools).
      */
     getAllToolNames(): string[];
+    get hasExactMcpControls(): boolean;
+    /**
+     * Exact-config MCP status for the TUI `/mcp` command.
+     *
+     * Returns `undefined` unless this session holds the exact-config capability,
+     * so a session built outside the root interactive entry point cannot read MCP
+     * state through it. Data comes only from the session-owned tools-only manager
+     * and the call never starts a deferred MCP startup or mutates connections.
+     */
+    getExactMcpStatusSnapshot(): Promise<ExactMcpStatusSnapshot | undefined>;
+    /**
+     * Apply one session-local exact-config control. Selection persistence is
+     * deliberately bypassed: suppression is runtime state, not user authority.
+     */
+    controlExactMcpServer(action: ExactMcpControlAction, name: string): Promise<ExactMcpControlResult | undefined>;
     getSelectedMCPToolNames(): string[];
     isToolDiscoveryEnabled(): boolean;
     getDiscoverableTools(filter?: {
@@ -947,7 +1080,12 @@ export declare class AgentSession {
      * Replace MCP tools in the registry and recompute the visible MCP tool set immediately.
      * This allows /mcp add/remove/reauth to take effect without restarting the session.
      */
-    refreshMCPTools(mcpTools: CustomTool[]): Promise<void>;
+    refreshMCPTools(mcpTools: CustomTool[], options?: {
+        selectedMCPToolNames?: string[];
+        activeMCPToolNames?: string[];
+        mandatoryMCPToolNames?: string[];
+        persistMCPSelection?: boolean;
+    }): Promise<void>;
     /**
      * Refresh plugin sub-skill tools after workflow/sub-skill activation or phase changes.
      */
@@ -963,6 +1101,8 @@ export declare class AgentSession {
      * to avoid racing against the delivery turn.
      */
     get hasPostPromptWork(): boolean;
+    /** The host-liveness lease shared by admission, execution, and recovery work. */
+    get sessionWorkLease(): SessionWorkLease;
     /** Stable resource ownership identifier for the active prompt run. */
     get activePromptHandle(): string | undefined;
     /** All messages including custom types like BashExecutionMessage */
@@ -1107,24 +1247,14 @@ export declare class AgentSession {
      * @param content User message content (string or content array)
      * @param options.deliverAs Delivery mode: "steer" or "followUp"
      */
-    sendUserMessage(content: string | (TextContent | ImageContent)[], options?: {
-        deliverAs?: "steer" | "followUp";
-        /** Preserve a busy SDK dispatch as queued work across an admission fence. */
-        queuedAtDispatch?: boolean;
-        onPreflightAccepted?: () => void;
-        onPreflightAcceptCommit?: () => void | Promise<void>;
-        /** Fired when a queued submission (steering or follow-up) is promoted to its own run (SDK ownership correlation). */
-        onQueuedPromoted?: (promotion: {
-            startsOwnRun?: boolean;
-            removed?: boolean;
-        }) => void;
-        /** Internal dispatch disposition used before actual queue consumption. */
-        onDispatchDisposition?: (promotion: {
-            startsOwnRun: boolean;
-        }) => void;
-        preflightSignal?: AbortSignal;
-        sdkRunCapability?: unknown;
-    }): Promise<void>;
+    sendUserMessage(content: string | (TextContent | ImageContent)[], options?: SendUserMessageOptions): Promise<void>;
+    /**
+     * Queue one steer or follow-up and return a stable lifecycle handle for that
+     * exact submission. Unlike `sendUserMessage`, this method resolves when the
+     * queue admission receipt is available; use the returned promises to await
+     * execution and the owning terminal boundary.
+     */
+    submitUserMessage(content: string | (TextContent | ImageContent)[], options: TrackedSendUserMessageOptions): Promise<QueuedInputSubmission>;
     /**
      * Clear queued messages and return them.
      * Useful for restoring to editor when user aborts.
@@ -1257,6 +1387,18 @@ export declare class AgentSession {
     rebindTerminalAbortSteeringSnapshot(token: number): void;
     discardTerminalAbortSteeringSnapshot(token: number): void;
     getTerminalTurnEpoch(): number | undefined;
+    /**
+     * Tool call ids the run resource ledger currently holds for `handle` (#5637).
+     *
+     * The authoritative answer to "is a tool running?": AgentLoop reserves the
+     * `kind: "tool"` lease SYNCHRONOUSLY inside its dispatch loop, before the
+     * tool's `execute` is invoked, and the lease settles when the call really
+     * ends — whereas `tool_execution_start` only reaches an extension after an
+     * asynchronous fanout. Strictly read-only: it takes a snapshot and never
+     * claims, reserves, seals or quarantines. An unknown run reads as empty,
+     * matching `RunResourceLedger.pending`.
+     */
+    pendingToolExecutions(handle: string): readonly string[];
     abortPromptAndWait(handle: string, options: {
         graceMs: number;
         terminal?: {
@@ -1386,6 +1528,15 @@ export declare class AgentSession {
      * must not mutate the persisted configured intent.
      */
     setDefaultFallbackRuntimeModel(selector: string): void;
+    /** Install a runtime-only durable fallback without changing saved session intent. */
+    installRecoveredDefaultFallbackChain(entries: readonly string[], identity: string | undefined, activeIndex: number, skips: Array<{
+        selector: string;
+        reason: string;
+    }>, options?: {
+        emitResolutionEvent?: boolean;
+    }): void;
+    markStartupRecoveryBindingsRequired(): void;
+    hasRecoveredDefaultFallbackChain(): boolean;
     /**
      * Seed default fallback state after guarded auth-aware model resolution skips chain entries.
      * The configured chain's role, origin, and identity are retained by the controller.
@@ -1436,6 +1587,7 @@ export declare class AgentSession {
         reason?: TemporaryModelReason;
         providerSessionScope?: TemporaryProviderSessionScope;
         signal?: AbortSignal;
+        onMutationStarted?: () => void;
     }): Promise<TemporaryProviderSessionScope | void>;
     /** Restore the exact live-model state captured before a failed selector transaction. */
     restoreModelSelectionForRollback(model: Model | undefined, thinkingLevel: ThinkingLevel | undefined): Promise<void>;

package/dist/types/session/fallback-chain-controller.d.ts

@@ -97,15 +97,15 @@ export interface CompactionCandidateFailure {
     readonly model: string;
     readonly message: string;
 }
+export declare function sanitizeCompactionCandidateFailureMessage(message: string): string;
 /**
  * Error for an auto-compaction run whose every candidate failed.
  *
- * The candidate chain starts at the session model and ends on a same-provider
- * largest-context fallback, so surfacing only the final error named a model
- * the user never chose and hid that their own model had already failed the
- * same way. The message leads with the first failure (the one the user can act
- * on), then lists every candidate that was tried with its own error. `cause`
- * is the final error so callers that classify by type keep the same object.
+ * The candidate chain starts at the session model and includes only explicitly
+ * configured role candidates. The message leads with the first failure (the
+ * one the user can act on), then lists every candidate that was tried with its
+ * own error. `cause` is the final error so callers that classify by type keep
+ * the same object.
  */
 export declare function describeCompactionCandidateFailures(failures: readonly CompactionCandidateFailure[], lastError: unknown): Error;
 export declare function effectiveFallbackDelay(baseDelayMs: number, maxDelayMs: number, attemptK: number, random?: () => number): number;

package/dist/types/session/fold-coordinator.d.ts

@@ -35,7 +35,17 @@ import type { AsyncJob, FoldReason } from "../async/job-manager";
  */
 export declare const FOLD_WAKE_MERGE_WINDOW_MS = 800;
 /** The wait kinds that can be folded. `task`/`subagent` awaits are a non-goal. */
-export type FoldWaitKind = "bash-managed" | "client-terminal" | "bash-pty";
+export type FoldWaitKind = "bash-managed" | "client-terminal" | "bash-pty" | "job-await";
+/**
+ * Whether a wait may be picked as the implicit fold target by the chord and
+ * the SDK `bash.background` control. A `job-await` watches jobs that are
+ * already in the background, so "move the foreground bash into a background
+ * job" has nothing to move; it folds only when the `job` tool's own steer
+ * watcher names it explicitly. Keeping it out of implicit targeting also stops
+ * a `job poll` registered after a foreground bash from taking the chord away
+ * from the command the user is actually watching.
+ */
+export declare function isImplicitFoldTarget(adapter: FoldAdapter): boolean;
 /** Outcome of settling the foreground caller. Exactly one party may settle it. */
 export type ForegroundSettleOutcome = "resolved" | "already-settled";
 /**
@@ -178,9 +188,13 @@ export declare class FoldCoordinator {
     constructor(deps: FoldCoordinatorDeps);
     /** Register a foldable wait. The most recently registered wait is the default target. */
     registerParticipant(adapter: FoldAdapter): () => void;
-    /** Whether any wait is currently foldable, for the key-availability gate. */
+    /** Whether any implicitly targetable wait is currently foldable, for the key-availability gate. */
     hasFoldableParticipant(): boolean;
-    /** Deterministic target: newest registration wins, so the chord folds what the user is watching. */
+    /**
+     * Deterministic implicit target: newest implicitly targetable registration
+     * wins, so the chord folds what the user is watching. `job-await` waits are
+     * skipped; they fold only through an explicit adapter.
+     */
     resolveTarget(): FoldAdapter | undefined;
     /**
      * T1. Synchronous prologue then async durability tail.

package/dist/types/session/internal/managed-session-storage.d.ts

@@ -117,12 +117,18 @@ export interface ScrubbedProtocolRemnantReapResult {
  * or detached receipts retained as evidence) are never touched. A proven
  * concurrent disappearance (ENOENT) is benign; all other I/O failures are
  * returned and logged once without aborting scope preparation.
+ *
+ * Stranded replacement staging that aliases its own published destination is
+ * reaped by the same pass. That entry is neither zero-length nor single-link,
+ * so the terminal-remnant filters above can never reach it, yet leaving it in
+ * place bricks resume for the session it aliases.
  */
 export declare function reapScrubbedProtocolRemnantsSync(directory: string, minAgeMs?: number): ScrubbedProtocolRemnantReapResult;
 /**
  * Async twin of {@link reapScrubbedProtocolRemnantsSync} with the same safety
  * filters (terminal remnant prefix, zero-length, single-link, non-symlink,
- * older than the age gate), yielding between bounded batches. Long-lived
+ * older than the age gate, plus stranded staging that aliases its own
+ * published destination), yielding between bounded batches. Long-lived
  * processes reap per-session descendant directories through this path so a
  * legacy oversized directory cannot starve timers or sibling subagents while
  * it is being drained (issue #4394).