@gajae-code/coding-agent 0.18.11 → 0.18.12

package/dist/types/session/agent-session.d.ts

@@ -70,10 +70,13 @@ export interface ForkContextSeedOptions {
 import type { AuthCredentialSelector } from "@gajae-code/ai/core";
 import { type AsyncJob, type AsyncJobDeliveryState, AsyncJobManager, type FoldReason, type JobFoldEvent, type SubagentLifecycle } from "../async";
 import type { Rule } from "../capability/rule";
+import type { ConfigHotReloadCandidate, ConfigHotReloadPaths } from "../config/config-hot-reload";
 import { type ModelRegistry } from "../config/model-registry";
 import { type ResolvedModelRoleValue, type ScopedModelSelection } from "../config/model-resolver";
+import { type ModelSelectorValue } from "../config/model-selector-value";
 import { type PromptTemplate } from "../config/prompt-templates";
 import type { Settings, SkillsSettings } from "../config/settings";
+import { type SettingPath } from "../config/settings-schema";
 import { RawSseDebugBuffer } from "../debug/raw-sse-buffer";
 import { type PythonResult } from "../eval/py/executor";
 import { type BashArtifactSaveResult, type BashResult } from "../exec/bash-executor";
@@ -99,11 +102,12 @@ import type { NetworkPrewarmRuntime } from "../runtime/network-prewarm-service";
 import type { WorkspaceTreeRuntime } from "../runtime/workspace-tree-service";
 import { type ExactMcpServerControlResult, MCPManager } from "../runtime-mcp/manager";
 import type { NotificationSessionController } from "../sdk/bus/session-control";
-import type { SecretObfuscator } from "../secrets/obfuscator";
+import { type SecretObfuscator } from "../secrets/obfuscator";
 import { type DiscoverableTool, type DiscoverableToolSearchIndex } from "../tool-discovery/tool-index";
 import type { AskAnswerSource, ToolSession } from "../tools";
 import type { CheckpointState } from "../tools/checkpoint";
 import { type TodoItem, type TodoPhase } from "../tools/todo-write";
+import { type EditMode } from "../utils/edit-mode";
 import { type WorkspaceTree } from "../workspace-tree";
 import { type DefaultModelSelectionResult } from "./default-model-selection";
 import { type ConfiguredFallbackChain, type FallbackChainRuntimeState } from "./fallback-chain-controller";
@@ -726,6 +730,40 @@ export interface DefaultFallbackRuntimeState {
     controller: FallbackChainRuntimeState;
     exhaustedLastTurn: boolean;
 }
+export interface AgentSessionProfileInstalledOverrideState {
+    modelRoles: ReadonlyMap<string, ModelSelectorValue | undefined>;
+    agentModelOverrides: ReadonlyMap<string, ModelSelectorValue | undefined>;
+    installedModelRoles: ReadonlyMap<string, ModelSelectorValue>;
+    installedAgentModelOverrides: ReadonlyMap<string, ModelSelectorValue>;
+    manualModelRoles: ReadonlySet<string>;
+    manualAgentModelOverrides: ReadonlySet<string>;
+    configuredAgentModelOverrides: ReadonlySet<string>;
+    preProfileModel: Model | undefined;
+}
+export interface PreparedProfileModelSelection {
+    readonly sessionId: string;
+    readonly model: Model;
+    readonly thinkingLevel: ThinkingLevel | undefined;
+    readonly committedThinkingLevel: ThinkingLevel | undefined;
+    readonly previousModel: Model | undefined;
+    readonly previousThinkingLevel: ThinkingLevel | undefined;
+    readonly previousEditMode: EditMode;
+    readonly signal: AbortSignal | undefined;
+}
+export interface ConfigurationReloadResult {
+    readonly applied: boolean;
+    readonly settingsChanged: boolean;
+    readonly modelsChanged: boolean;
+    readonly changedSettings: readonly SettingPath[];
+}
+export type ConfigurationReloadErrorCode = "SESSION_UNAVAILABLE" | "PATH_CHANGED" | "SETTINGS_INVALID" | "MODELS_INVALID" | "MODEL_UNAVAILABLE" | "ACTIVE_PROFILE_INVALID" | "PUBLICATION_FAILED" | "VALIDATION_CLEANUP_FAILED";
+export declare class ConfigurationReloadError extends Error {
+    readonly code: ConfigurationReloadErrorCode;
+    readonly retryable: boolean;
+    constructor(code: ConfigurationReloadErrorCode, cause?: unknown, options?: {
+        readonly retryable?: boolean;
+    });
+}
 /** A lost continuation may only settle the emitter/session pair that opened it. */
 export declare function isCurrentWorkflowGateContinuation(currentSessionId: string, expectedSessionId: string, currentEmitter: WorkflowGateEmitter | undefined, expectedEmitter: WorkflowGateEmitter): boolean;
 export declare class AgentSession {
@@ -1480,6 +1518,7 @@ export declare class AgentSession {
         onMutationStarted?: () => void;
     }): Promise<void>;
     setActiveModelProfile(name: string | undefined): void;
+    markProfileRoleOverrideManual(path: "modelRoles" | "task.agentModelOverrides", role: string): void;
     getActiveModelProfile(): string | undefined;
     setUnavailableModelProfile(name: string | undefined): void;
     getUnavailableModelProfile(): string | undefined;
@@ -1492,6 +1531,9 @@ export declare class AgentSession {
     };
     /** Fence deferred startup profile recovery before an explicit control-surface selection. */
     markUserModelSelection(): void;
+    getConfigurationPaths(): ConfigHotReloadPaths | undefined;
+    validateConfiguration(candidate: ConfigHotReloadCandidate): Promise<void>;
+    reloadConfiguration(candidate: ConfigHotReloadCandidate, signal: AbortSignal): Promise<ConfigurationReloadResult>;
     /**
      * Re-apply vendor-separated delegation after a profile activation changed the
      * role layer. `eagerTasks` is resolved at prompt build time, but under
@@ -1502,7 +1544,18 @@ export declare class AgentSession {
      */
     syncEagerDelegation(): Promise<void>;
     /** Record runtime override keys installed by a profile activation. */
-    noteProfileInstalledOverrides(modelRoles: readonly string[], agentModelOverrides: readonly string[], preProfileModel: Model | undefined): void;
+    noteProfileInstalledOverrides(modelRoles: readonly string[], agentModelOverrides: readonly string[], preProfileModel: Model | undefined, baseline?: {
+        modelRoles: Readonly<Record<string, ModelSelectorValue>>;
+        agentModelOverrides: Readonly<Record<string, ModelSelectorValue>>;
+    }, installed?: {
+        modelRoles: Readonly<Record<string, ModelSelectorValue>>;
+        agentModelOverrides: Readonly<Record<string, ModelSelectorValue>>;
+    }, manual?: {
+        modelRoles: readonly string[];
+        agentModelOverrides: readonly string[];
+    }): void;
+    getProfileInstalledOverrideState(): AgentSessionProfileInstalledOverrideState;
+    restoreProfileInstalledOverrideState(state: AgentSessionProfileInstalledOverrideState): void;
     /** Drop the recorded profile-installed override keys after materialization. */
     clearProfileInstalledOverrides(): void;
     /** Current profile-installed override keys, for deriving the activation base. */
@@ -1628,6 +1681,9 @@ export declare class AgentSession {
         shouldMutate?: () => boolean;
         onMutationStarted?: () => void;
     }): Promise<TemporaryProviderSessionScope | void>;
+    prepareModelSelectionForProfileActivation(model: Model, thinkingLevel: ThinkingLevel | undefined, signal?: AbortSignal): Promise<PreparedProfileModelSelection>;
+    commitPreparedProfileModelSelection(prepared: PreparedProfileModelSelection, onThinkingLevelApplied?: (mutationRevision: number) => void): void;
+    finishPreparedProfileModelSelection(prepared: PreparedProfileModelSelection): Promise<void>;
     /** Restore the exact live-model state captured before a failed selector transaction. */
     restoreModelSelectionForRollback(model: Model | undefined, thinkingLevel: ThinkingLevel | undefined): Promise<void>;
     /** Set a durable per-session model from a control surface without exposing credential errors. */

package/dist/types/session/internal/managed-session-scope.d.ts

@@ -87,7 +87,7 @@ export declare function managedDirectoryIdentityForScope(scope: ManagedScope): {
 };
 export declare function managedRootForScope(scope: ManagedScope): ManagedDirectoryRoot;
 export type ManagedMigrationPolicy = "copy-retain" | "disabled";
-export type ManagedScopeErrorCode = "cwd_missing" | "cwd_not_directory" | "identity_unavailable" | "network_unsupported" | "sessions_root_unavailable" | "binding_conflict" | "binding_invalid" | "migration_busy" | "managed_gc_journal_capacity_exceeded" | "atomic_unavailable" | "invalid_request" | "durability_failed" | "durability_not_provable" | "capacity_exceeded";
+export type ManagedScopeErrorCode = "cwd_missing" | "cwd_not_directory" | "identity_unavailable" | "network_unsupported" | "sessions_root_unavailable" | "binding_conflict" | "binding_invalid" | "migration_busy" | "managed_gc_journal_capacity_exceeded" | "atomic_unavailable" | "invalid_request" | "permission_denied" | "durability_failed" | "durability_not_provable" | "capacity_exceeded";
 export type ManagedScopeResolution = {
     kind: "resolved";
     scope: ManagedScope;
@@ -122,7 +122,7 @@ export type ManagedCandidateListing = {
     code: "scan_failed" | "unsafe_root" | "invalid_candidate";
     message: string;
 };
-export type ManagedOpenFailure = "migration_busy" | "binding_conflict" | "binding_invalid" | "destination_conflict" | "source_changed" | "unsafe_artifacts" | "artifact_capacity_exceeded" | "managed_gc_journal_capacity_exceeded" | "durability_failed" | "atomic_unavailable" | "invalid_request" | "durability_not_provable" | "migration_retired" | "legacy_migration_disabled" | "managed_storage_unsupported";
+export type ManagedOpenFailure = "migration_busy" | "binding_conflict" | "binding_invalid" | "destination_conflict" | "source_changed" | "unsafe_artifacts" | "artifact_capacity_exceeded" | "managed_gc_journal_capacity_exceeded" | "durability_failed" | "atomic_unavailable" | "permission_denied" | "invalid_request" | "durability_not_provable" | "migration_retired" | "legacy_migration_disabled" | "managed_storage_unsupported";
 export type ManagedOpenCandidateResult = {
     kind: "opened";
     path: string;

package/dist/types/session/internal/managed-session-storage.d.ts

@@ -15,7 +15,7 @@ export declare class ManagedAppendIdentityMismatchError extends Error {
     constructor(relativePath: string);
 }
 export declare class ManagedPublishError extends Error {
-    readonly classification: "destination_conflict" | "atomic_unavailable" | "invalid_request" | "durability_not_provable" | "identity_mismatch" | "io_error" | "durability_failed";
+    readonly classification: "destination_conflict" | "atomic_unavailable" | "invalid_request" | "durability_not_provable" | "identity_mismatch" | "permission_denied" | "io_error" | "durability_failed";
     readonly diagnostic: string;
     readonly stagingCleanupSafe: boolean;
     constructor(classification: ManagedPublishError["classification"], outcome: NativePublishOutcome);

package/dist/types/session/internal/native-publish-outcome.d.ts

@@ -1,6 +1,6 @@
 export type NativePublishMutationState = "not_committed" | "committed" | "unknown";
 export type NativePublishDurabilityState = "not_attempted" | "proven" | "not_provable";
-export type NativePublishReason = "none" | "destination_exists" | "atomic_unavailable" | "cross_device" | "permission_denied" | "io_failure" | "interrupted" | "invalid_request" | "identity_violation" | "durability_not_provable" | "unknown";
+export type NativePublishReason = "none" | "destination_exists" | "atomic_unavailable" | "cross_device" | "permission_denied" | "access_denied" | "io_failure" | "interrupted" | "invalid_request" | "identity_violation" | "durability_not_provable" | "unknown";
 export type NativePublishOperation = "direct_rename" | "retained_file" | "retained_tree";
 export type NativePublishPrimitive = "renameat2_noreplace" | "linkat_noreplace" | "mkdirat_renameat_noreplace" | "renameatx_np_excl" | "windows_rename_noreplace" | "unsupported" | "unknown";
 export type NativePublishPhase = "preflight" | "file_sync" | "rename" | "source_unlink" | "source_parent_sync" | "destination_parent_sync" | "terminal_identity" | "complete" | "unknown";

package/dist/types/session/messages.d.ts

@@ -72,8 +72,12 @@ export declare const PRE_ADMISSION_ARTIFACT_SPILL_TAIL_BYTES = 4096;
  * Build the deterministic inline receipt for a tool result saved before the
  * next provider context is constructed. Byte boundaries never split UTF-8
  * code points, so head/tail recovery remains readable for emoji and CJK text.
+ *
+ * `redact` runs on the complete text before the cut. The digest stays the
+ * caller's hash of the stored artifact; the omitted count is the redacted
+ * preview's omitted bytes.
  */
-export declare function createPreAdmissionArtifactSpillPreview(fullText: string, artifactId: string, digest: string): string;
+export declare function createPreAdmissionArtifactSpillPreview(fullText: string, artifactId: string, digest: string, redact?: (text: string) => string): string;
 /**
  * Message type for bash executions via the ! command.
  */

package/dist/types/session/session-manager.d.ts

@@ -1152,14 +1152,14 @@ export declare const SessionManagerTestHooks: {
 /**
  * Freshness snapshot captured with every async whole-session persistence
  * preparation. Immediately before the synchronous persistence transaction, the
- * live values are compared: a `sessionFile`/`lifecycleId` change aborts (lifecycle
- * switch); a revision change discards the prepared bytes and re-prepares (bounded),
+ * live values are compared: a logical lifecycle change aborts; a verified storage
+ * relocation or revision change discards prepared bytes and re-prepares (bounded),
  * so a stale snapshot is never published.
  */
 export interface PersistenceInputToken {
     /** Canonical session file path the prepared bytes target. */
     sessionFile: string;
-    /** Per-manager lifecycle identity (`sessionId@sessionFile`); changes on switch/open/reset. */
+    /** Logical lifecycle identity; storage-only relocation preserves its verified origin. */
     lifecycleId: string;
     /** Revision of #fileEntries affecting persisted bytes. */
     entryRevision: number;
@@ -1377,6 +1377,16 @@ export declare class SessionManager {
     }): Promise<void>;
     /** Ownership loss remains observable even when an agent event listener aborts the turn. */
     getAppendIdentityMismatch(): ManagedAppendIdentityMismatchError | undefined;
+    /**
+     * Register the same-owner task capability used to follow a parent's managed
+     * artifact root after its session move. The synchronous resolver must return
+     * only the current ArtifactManager for the same parent ID and parent transcript
+     * basename; it retains the last verified manager on a logical successor.
+     * Registration captures the exact original manager identity. Unchanged identity
+     * keeps using the child's retained store; a changed identity triggers strict
+     * destination transcript verification before re-rooting.
+     */
+    registerManagedTranscriptRelocationResolver(resolver: () => ArtifactManager): () => void;
     isPersisted(): boolean;
     stageDefaultModelSelection(model: string, thinkingLevel: string | undefined, options?: {
         readonly appendThinkingLevel: boolean;

package/dist/types/session/startup-auth-config.d.ts

@@ -6,7 +6,7 @@
  * performed. Environment values are trusted credential sources and take
  * precedence over global config values.
  */
-import type { AuthCredentialSelector, CredentialRankingMode } from "@gajae-code/ai/core";
+import type { AuthCredentialSelector, ConfiguredCredentialPreference, CredentialRankingMode } from "@gajae-code/ai/core";
 export interface AuthBrokerClientConfig {
     url: string;
     token: string;
@@ -19,8 +19,10 @@ export interface StartupAuthConfigSnapshot {
     credentialPinStoreIdentity?: string;
     credentialRankingMode: CredentialRankingMode;
     credentialPins: Readonly<Record<string, string>>;
+    /** Ordered soft per-provider preferences; only portable email/`account:` selectors are accepted. */
+    credentialPreferences: Readonly<Record<string, readonly ConfiguredCredentialPreference[]>>;
 }
-export type StartupAuthConfigErrorKind = "unreadable" | "invalid-yaml" | "non-mapping-root" | "invalid-auth" | "invalid-broker" | "invalid-gateway" | "invalid-ranking-mode" | "invalid-credential-pins";
+export type StartupAuthConfigErrorKind = "unreadable" | "invalid-yaml" | "non-mapping-root" | "invalid-auth" | "invalid-broker" | "invalid-gateway" | "invalid-ranking-mode" | "invalid-credential-pins" | "invalid-credential-preferences";
 /** A malformed startup-auth config aborts resolution rather than downgrading to local authority. */
 export declare class StartupAuthConfigError extends Error {
     readonly kind: StartupAuthConfigErrorKind;
@@ -31,11 +33,31 @@ export declare class StartupAuthConfigError extends Error {
 }
 /** JSON-schema pattern shared with the runtime persisted-selector grammar. */
 export declare const PERSISTED_CREDENTIAL_SELECTOR_PATTERN = "^(id:[1-9][0-9]*|email:[^@\\s]+@[^@\\s]+|account:\\S+)$";
+export declare function startupAuthConfigError(agentDir: string, kind: StartupAuthConfigErrorKind): StartupAuthConfigError;
 /** Path to the local bearer token file. Created on the broker host by `gjc auth-broker token`. */
 export declare function getAuthBrokerTokenFilePath(): string;
 /** Validate the persisted selector grammar used by `auth.credentialPins`. */
 export declare function parsePersistedCredentialSelector(value: string): AuthCredentialSelector | undefined;
 export declare function isValidPersistedCredentialSelector(value: string): boolean;
+/** JSON-schema pattern for a preference account; shared with {@link parsePreferenceAccount}. */
+export declare const PREFERENCE_ACCOUNT_PATTERN = "^(email:[^@\\s]+@[^@\\s]+|account:\\S+|[^@\\s:]+@[^@\\s]+)$";
+/**
+ * Parse one `auth.credentialPreferences` account: a bare email, `email:<address>`, or `account:<id>`. Numeric row ids
+ * are excluded: they are bound to one credential store, and a preference has no store-identity binding to detect a
+ * retargeted row.
+ */
+export declare function parsePreferenceAccount(value: string): AuthCredentialSelector | undefined;
+/** A preference cap accepts (0, 100]; 100 moves past the account only once it is blocked. */
+export declare function isValidCredentialPreferenceCap(value: unknown): value is number;
+/** Canonical config text for one preference entry: the account, or a one-key `{ account: cap }` mapping. */
+export type CredentialPreferenceEntryValue = string | Readonly<Record<string, number>>;
+/**
+ * Parse one provider's `auth.credentialPreferences` value: a single account, or a non-empty ordered list whose
+ * entries are an account (`me@example.com`) or an account with a usage cap in percent (`me@example.com: 75`).
+ * Returns undefined for any invalid value, including an account listed twice, so a typo fails closed instead of
+ * silently changing the order.
+ */
+export declare function parseCredentialPreferenceList(value: unknown): ConfiguredCredentialPreference[] | undefined;
 /**
  * Resolve one typed startup-auth snapshot from trusted env and global config.
  * Project settings are intentionally not read here, so project-scoped pins

package/dist/types/session/streaming-output.d.ts

@@ -3,6 +3,8 @@ export declare const DEFAULT_MAX_LINES = 3000;
 export declare const DEFAULT_MAX_BYTES: number;
 export declare const DEFAULT_MAX_COLUMN = 1024;
 export declare const DEFAULT_ARTIFACT_MAX_BYTES: number;
+/** Run `fn` while column caps can see these plain secrets. */
+export declare function runWithOutputRedaction<T>(plainSecrets: readonly string[], fn: () => T): T;
 /**
  * Terminal publisher used when managed artifact storage exposes an ID but no
  * writable pathname. The sink supplies raw content retained up to its artifact
@@ -167,6 +169,15 @@ export declare function truncateLine(line: string, maxChars?: number): {
     text: string;
     wasTruncated: boolean;
 };
+/**
+ * Truncate each line to max characters without leaving a configured plain-secret
+ * prefix in the retained text. Prior uncapped lines remain in scope because a
+ * later line's cut can split a multiline secret.
+ */
+export declare function truncateTextWithSecretAwareness(text: string, maxChars?: number, secrets?: readonly string[]): {
+    text: string;
+    wasTruncated: boolean;
+};
 /** Shared helper to build a no-truncation result. */
 export declare function noTruncResult(content: string, totalLines?: number, totalBytes?: number): TruncationResult;
 /**

package/dist/types/session/terminal-abort.d.ts

@@ -114,6 +114,8 @@ export declare function registerOwnedRegistration(key: TurnRegistrationKey, opti
  *  scope:"owned" abort of that exact attempt must fail closed to uncertainty
  *  (review thread P2). */
 export declare function isOwnedAttemptRegistrationIncomplete(lineageIdHash: string, attemptEpoch: number): boolean;
+/** Move fail-closed saturation authority with all ownership state during endpoint rekey. */
+export declare function migrateOwnedAttemptSaturationsForEndpoint(predecessorEndpointId: string, successorEndpointId: string): void;
 /** Exact (jobId, jobGeneration) lookup for completion-origin classification. */
 export declare function lookupOwnedRegistration(jobId: string, jobGeneration: string, endpointId?: string): TurnRegistrationKey | undefined;
 export declare function unregisterOwnedRegistration(key: TurnRegistrationKey): void;
@@ -231,7 +233,7 @@ export declare function registerOwnedIfLineaged(manager: {
         generation?: string;
         status?: string;
     } | undefined;
-}, toolCallId: string | undefined, jobId: string, endpointId?: string): void;
+}, toolCallId: string | undefined, jobId: string, endpointId?: string, ownedRegistrationEndpointId?: string): void;
 /** Retire the exact (endpoint, jobId, jobGeneration) owned registration when
  *  its completion delivery is dead-lettered by the manager (delivery-queue
  *  overflow or retry exhaustion): no message is injected and no later

package/dist/types/session-import/service.d.ts

@@ -1,5 +1,5 @@
 import { CodexImportError } from "./codex";
-export type SessionImportErrorCode = CodexImportError["code"] | "invalid_request" | "binding_invalid" | "content_too_large" | "destination_conflict" | "publish_uncertain" | "atomic_unavailable" | "durability_not_provable" | "durability_failed" | "identity_mismatch" | "validation_failed" | "io_failed" | "internal_failed";
+export type SessionImportErrorCode = CodexImportError["code"] | "invalid_request" | "binding_invalid" | "content_too_large" | "destination_conflict" | "publish_uncertain" | "atomic_unavailable" | "permission_denied" | "durability_not_provable" | "durability_failed" | "identity_mismatch" | "validation_failed" | "io_failed" | "internal_failed";
 export interface SessionImportFailure {
     status: "failed";
     provider: "codex";

package/dist/types/skill-state/workflow-mutation-guard.d.ts

@@ -4,9 +4,13 @@ export declare const DEEP_INTERVIEW_MUTATION_BLOCK_MESSAGE = "Deep-interview pha
 export declare const WORKFLOW_STATE_MUTATION_BLOCK_MESSAGE = ".gjc workflow state and artifacts are runtime-owned. Agent mutation tools cannot edit `.gjc/**`; use the sanctioned `gjc` CLI instead.";
 export declare const RALPLAN_MUTATION_BLOCK_MESSAGE = "Ralplan planning phase boundary: keep refining the consensus plan and persist plan artifacts through `gjc ralplan --write` (stage scratch files under a temp dir if needed). Product-code mutation tools and patch execution are blocked while ralplan is active; mutate only after the plan is approved and execution begins.";
 export declare const ULTRAGOAL_GOAL_PLANNING_MUTATION_BLOCK_MESSAGE = "Ultragoal goal-planning phase boundary: finish goal planning and record goals through `gjc ultragoal` before editing code. Product-code mutation tools and patch execution are blocked until goal planning completes and execution begins.";
-export declare const AUTORESEARCH_MUTATION_BLOCK_MESSAGE = "Autoresearch research-only boundary: this workflow produces findings, evidence, and a verdict \u2014 never product code. Product-code mutation tools and patch execution are blocked everywhere, on every branch. Mission research artifacts (`autoresearch.sh` at the workdir root and mission state through the sanctioned `gjc autoresearch` CLI) stay writable; run experiments through the `python` tool, or finish the mission and hand off to an approved implementation workflow.";
-/** Tools whose execute path can mutate product state. `github` is included so side-effect ops share this guard. */
-export declare const WORKFLOW_MUTATION_TOOL_NAMES: readonly ["edit", "write", "ast_edit", "bash", "github"];
+export declare const AUTORESEARCH_MUTATION_BLOCK_MESSAGE = "Autoresearch research-only boundary: this workflow produces findings, evidence, and a verdict \u2014 never product code. Product-code mutation tools and patch execution are blocked everywhere, on every branch. Write the root `autoresearch.sh` only with direct file tools; mission state stays writable through the sanctioned `gjc autoresearch` CLI. Run experiments through the `python` tool, or finish the mission and hand off to an approved implementation workflow.";
+/**
+ * Tools whose execute path can mutate product state. `github` is included so
+ * side-effect ops share this guard. `eval` and `python` run code that can write
+ * files without going through edit, write, or bash.
+ */
+export declare const WORKFLOW_MUTATION_TOOL_NAMES: readonly ["edit", "write", "ast_edit", "bash", "github", "eval", "python"];
 export declare function isWorkflowMutationTool(name: string): boolean;
 type ToolWithEditMode = AgentTool & {
     mode?: unknown;

package/dist/types/slash-commands/helpers/provider-auth-status.d.ts

@@ -0,0 +1,8 @@
+import type { ModelRegistry } from "../../config/model-registry";
+import type { AgentSession } from "../../session/agent-session";
+type ProviderAuthStatusSession = Pick<AgentSession, "credentialSessionId"> & {
+    modelRegistry: Pick<ModelRegistry, "authStorage" | "getAll" | "getAvailable" | "getConfiguredProviderIds" | "getAuthStorageOwner" | "getProviderConfigApiKeySources" | "getProviderRuntimeApiKeyEnvName" | "hasRuntimeProviderApiKey">;
+};
+/** Format credential provenance for `/provider status` without returning credential values. */
+export declare function buildProviderAuthStatusText(session: ProviderAuthStatusSession): Promise<string>;
+export {};

package/dist/types/task/executor.d.ts

@@ -14,10 +14,12 @@ import { Settings } from "../config/settings";
 import { type Skill } from "../extensibility/skills";
 import type { HindsightSessionState } from "../hindsight/state";
 import type { LocalProtocolOptions } from "../internal-urls";
+import type { PlanModeState } from "../plan-mode/state";
 import { AgentRegistry } from "../registry/agent-registry";
 import type { ForkContextSeed } from "../session/agent-session";
 import { ArtifactManager } from "../session/artifacts";
 import type { AuthStorage } from "../session/auth-storage";
+import type { ClientBridge } from "../session/client-bridge";
 import { SessionManager, type SessionMemoryMode } from "../session/session-manager";
 import "../tools/yield";
 import type { ContextFileEntry } from "../tools";
@@ -109,6 +111,21 @@ export interface ExecutorOptions {
      * the same immutable child settings snapshot.
      */
     inheritedServiceTier?: ServiceTier;
+    /**
+     * Parent ACP/SDK approval mode. `deny` and `prompt` replace the child
+     * default (`allow`) before the first prompt. `allow` is that default.
+     */
+    sdkPermissionMode?: "prompt" | "allow" | "deny";
+    /**
+     * Parent plan-mode state. Copied onto the child before the first prompt so
+     * `enforcePlanModeWrite` still refuses product-file writes.
+     */
+    planModeState?: PlanModeState;
+    /**
+     * Parent client bridge. Only `requestPermission` is copied onto the child.
+     * Terminal, filesystem, and deferAgentInitiatedTurns stay on the parent.
+     */
+    clientBridge?: ClientBridge;
     /** Override local:// protocol options so subagent shares parent's local:// root */
     localProtocolOptions?: LocalProtocolOptions;
     /**
@@ -149,12 +166,12 @@ export interface ExecutorOptions {
 }
 export declare class ManagedTaskPersistence {
     #private;
-    constructor(artifacts: ArtifactManager, taskId: string);
+    constructor(artifacts: ArtifactManager, taskId: string, getArtifacts?: () => ArtifactManager);
     openSession(cwd: string, sessionMemoryMode?: SessionMemoryMode): Promise<SessionManager>;
     openStagedSession(attemptId?: string): Promise<SessionManager>;
     publishOutput(rawOutput: string, metadata: Uint8Array): Promise<void>;
 }
-export declare function createManagedTaskPersistence(artifacts: ArtifactManager, taskId: string): ManagedTaskPersistence;
+export declare function createManagedTaskPersistence(artifacts: ArtifactManager, taskId: string, getArtifacts?: () => ArtifactManager): ManagedTaskPersistence;
 export declare function renderSubagentUserPrompt(assignment: string, independentMode: boolean): string;
 export interface YieldItem {
     data?: unknown;

package/dist/types/tools/ast-edit-write-path.d.ts

@@ -11,3 +11,13 @@ export declare function canonicalizeAstEditWritePath(absolutePath: string): Prom
  * or a symlinked workspace), so an in-workspace real path is reattached to `cwd`.
  */
 export declare function resolveAstEditPreviewWritePaths(cwd: string, previewedPaths: readonly string[]): Promise<string[]>;
+/** Refusal prefix when a single-file real path leaves its reference root. */
+export declare const AST_EDIT_OUTSIDE_ROOT_MESSAGE = "AST edit target resolves outside its root";
+/**
+ * Native astEdit canonicalizes one file and writes that real path. Directory
+ * scans do not follow links. A lexical path inside cwd uses the real cwd as
+ * the reference root; an explicit path outside cwd uses its real parent, so a
+ * direct file there still applies. Returns the lexical path that would leave
+ * that root, if any.
+ */
+export declare function astEditSingleFileOutsideReferenceRoot(cwd: string, candidatePaths: readonly string[], signal?: AbortSignal): Promise<string | undefined>;

package/dist/types/tools/atomic-file-write.d.ts

@@ -25,10 +25,11 @@
  *
  * Destination symlinks are followed: the referent is replaced, the link stays.
  * The referent is re-resolved immediately before publication so a retargeted
- * link cannot silently repoint the write, and when the lexical destination
- * sits inside a session-scoped `gjc-local` root the resolved referent and its
- * parent must remain inside that root (a link there must not redirect the
- * write out of the trust boundary).
+ * link cannot silently repoint the write. When the lexical destination sits
+ * inside the active explicit artifacts local root (`<artifacts>/local`) or a
+ * session-scoped `gjc-local` root, the resolved referent and its parent must
+ * remain inside that root (a link there must not redirect the write out of
+ * the trust boundary).
  *
  * Staging uses exclusive create (`wx`) so a colliding leftover temp is never
  * truncated or unlinked; only the temp this call created is cleaned on failure.
@@ -57,9 +58,10 @@ export declare function formatFileWriteError(error: unknown, dest: string, optio
 export interface WriteFileAtomicallyOptions {
     /**
      * Trusted root that a resolved symlink referent and its parent must not
-     * leave. When omitted, the helper still enforces the session-scoped
-     * `gjc-local` boundary implied by a lexical destination under
-     * `<tmpdir>/gjc-local/<session-id>`.
+     * leave. When omitted, a destination inside the active explicit artifacts
+     * local root (`<artifacts>/local`) uses that root. Otherwise the helper
+     * still enforces the session-scoped `gjc-local` boundary implied by a
+     * lexical destination under `<tmpdir>/gjc-local/<session-id>`.
      */
     trustBoundary?: string;
     /** Platform override used by deterministic retry tests. */

package/dist/types/tools/bash-allowed-prefixes.d.ts

@@ -3,8 +3,19 @@ export interface BashAllowedPrefixesCheck {
     reason?: string;
 }
 export type BashRestrictionProfile = "workflow" | "read-only";
+/** Session identities and workspace the restricted `gjc` command may name. */
+export interface GjcSessionBinding {
+    sessionId?: string | null;
+    /** Owner identity already on the tool session. Role-agent ralplan writes use it. */
+    credentialSessionId?: string | null;
+    /** Session workspace. A `--worktree-root` must be this repo, not a foreign one. */
+    worktreeRoot: string;
+    /** Child cwd. Relative `--worktree-root` resolves against it, as ralplan does. */
+    invocationCwd: string;
+}
 export interface BashRestrictionOptions {
     profile?: BashRestrictionProfile;
+    gjcSessionBinding?: GjcSessionBinding;
 }
 export declare function normalizeReadOnlyBashCommand(command: string): string | undefined;
 export declare function checkBashAllowedPrefixes(command: string, allowedPrefixes: readonly string[] | undefined, options?: BashRestrictionOptions): BashAllowedPrefixesCheck;

package/dist/types/tools/descriptors.d.ts

@@ -55,6 +55,8 @@ export declare class LazyAgentTool implements AgentTool<any, any, any> {
     #private;
     readonly descriptor: ToolDescriptor;
     constructor(descriptor: ToolDescriptor, materialized?: AgentTool<any, any, any>, loader?: () => ToolDescriptorLoadResult, session?: ToolSession);
+    /** Clear a session-bound materialization after its owning session moves. */
+    invalidateForSessionMove(expectedCwd?: string): void;
     /** Materialize this facade for contract tests without exposing it in production dispatch. */
     materializeForTests(): Promise<AgentTool<any, any, any>>;
     get name(): string;

package/dist/types/tools/fetch.d.ts

@@ -31,7 +31,7 @@ type FetchRenderResult = RenderResult & {
 /**
  * Try all special handlers
  */
-declare function handleSpecialUrls(url: string, timeout: number, signal: AbortSignal | undefined, storage: AgentStorage | null): Promise<FetchRenderResult | null>;
+declare function handleSpecialUrls(url: string, timeout: number, signal: AbortSignal | undefined, storage: AgentStorage | null, settings: Settings): Promise<FetchRenderResult | null>;
 /** Test-only seam for verifying lazy special-handler loading and dispatch. */
 export declare const fetchSpecialHandlerTestHooks: {
     dispatch: typeof handleSpecialUrls;

package/dist/types/tools/index.d.ts

@@ -317,6 +317,8 @@ export interface ToolSession {
         from: string;
         to: string;
     }>;
+    /** Live ACP/SDK approval mode. Task children copy this at spawn; absent means `allow`. */
+    getSdkPermissionMode?: () => "prompt" | "allow" | "deny";
     /** Bridge to the connected client (e.g. ACP editor host). Tools should route fs/terminal/permission requests through this when available. */
     getClientBridge?: () => ClientBridge | undefined;
     /** Get compact conversation context for subagents (excludes tool results, system prompts) */

package/dist/types/tools/python.d.ts

@@ -14,7 +14,7 @@ export interface SessionPythonToolInput {
     /** Resolve the GJC session id used for the kernel owner and transcript paths. */
     getSessionId: () => string | null;
     /** Register cleanup with the current logical session lifecycle. */
-    registerSessionCleanup: (cleanup: () => Promise<void> | void) => (() => void) | void;
+    registerSessionCleanup: (cleanup: () => Promise<void> | void) => (() => void) | undefined;
     /** Reject execution after the owning session has begun disposal. */
     assertEvalExecutionAllowed?: () => void;
     /** Track this whole invocation through its transcript append. */

package/dist/types/tools/report-issue.d.ts

@@ -0,0 +1,41 @@
+import type { AgentTool, AgentToolResult } from "@gajae-code/agent-core";
+import * as z from "zod/v4";
+import type { ToolSession } from "./index";
+declare const reportIssueSchema: z.ZodObject<{
+    tool: z.ZodString;
+    report: z.ZodString;
+}, z.core.$strip>;
+export type ReportIssueToolInput = z.infer<typeof reportIssueSchema>;
+export interface ReportIssueToolDetails {
+    recorded: boolean;
+    tool: string;
+}
+export interface ToolIssueEntry {
+    tool: string;
+    report: string;
+    model: string | null;
+    sessionId: string | null;
+}
+/** Normalize and clamp a report to the stored field limits. */
+export declare function normalizeToolIssue(tool: string, report: string): {
+    tool: string;
+    report: string;
+};
+/** Append one report to the tool-issue database at `dbPath`. */
+export declare function recordToolIssue(dbPath: string, entry: ToolIssueEntry): Promise<void>;
+export declare class ReportIssueTool implements AgentTool<typeof reportIssueSchema, ReportIssueToolDetails> {
+    #private;
+    readonly name = "report_issue";
+    readonly label = "Report Issue";
+    readonly loadMode: "essential";
+    readonly description: string;
+    readonly parameters: z.ZodObject<{
+        tool: z.ZodString;
+        report: z.ZodString;
+    }, z.core.$strip>;
+    readonly strict = true;
+    readonly intent: "omit";
+    constructor(session: ToolSession, dbPath?: string);
+    execute(_toolCallId: string, params: ReportIssueToolInput): Promise<AgentToolResult<ReportIssueToolDetails>>;
+}
+export {};

package/dist/types/tools/subagent.d.ts

@@ -178,4 +178,27 @@ export declare function capCodePointsAndBytes(text: string, maxCodePoints: numbe
 /** Shared cadence for await progress refreshes and rendered last-activity age. */
 export declare const SUBAGENT_ACTIVITY_BUCKET_MS = 5000;
 export declare function subagentAwaitRenderedStateSignature(subagents: readonly SubagentSnapshot[], receipt?: Pick<SubagentToolDetails, "awaitOutcome" | "interrupted">): string;
+/** A running subagent with no activity for longer than this counts as idle in the compact panel. */
+export declare const SUBAGENT_COMPACT_IDLE_MS = 30000;
+/** Group counts behind the compact await panel's single summary line. */
+export interface SubagentGroupSummary {
+    running: number;
+    idle: number;
+    retrying: number;
+    queued: number;
+    paused: number;
+    completed: number;
+    failed: number;
+    cancelled: number;
+    /** Running subagents in provider retry, per provider; drives the degradation warning. */
+    retryingByProvider: Record<string, number>;
+}
+export declare function summarizeSubagentGroup(subagents: readonly SubagentSnapshot[], nowMs: number): SubagentGroupSummary;
+/**
+ * Rendered-state signature for the compact await panel. It covers only what the
+ * compact view shows (group counts and the single degradation row), so per-subagent activity that does not move
+ * a count no longer re-emits: the update rate is bounded by count transitions and
+ * the liveness interval instead of growing with the number of live subagents.
+ */
+export declare function subagentCompactRenderedStateSignature(subagents: readonly SubagentSnapshot[], nowMs: number, receipt?: Pick<SubagentToolDetails, "awaitOutcome" | "interrupted">): string;
 export {};

package/dist/types/web/scrapers/types.d.ts

@@ -1,3 +1,4 @@
+import type { Settings } from "../../config/settings";
 import type { AgentStorage } from "../../session/agent-storage";
 import type { AddressResolver } from "../insane/url-guard";
 export { formatNumber } from "@gajae-code/utils";
@@ -11,7 +12,13 @@ export interface RenderResult {
     truncated: boolean;
     notes: string[];
 }
-export type SpecialHandler = (url: string, timeout: number, signal?: AbortSignal, storage?: AgentStorage | null) => Promise<RenderResult | null>;
+/**
+ * `settings` is the caller's session settings. Handlers must read through it
+ * rather than the process-global singleton: the SDK/ACP host path runs tools
+ * without ever calling `Settings.init()`, where a global read throws
+ * "Settings not initialized" instead of scraping the page.
+ */
+export type SpecialHandler = (url: string, timeout: number, signal?: AbortSignal, storage?: AgentStorage | null, settings?: Settings) => Promise<RenderResult | null>;
 export declare const MAX_OUTPUT_CHARS = 500000;
 export declare const MAX_BYTES: number;
 /**