@gajae-code/coding-agent 0.18.11 → 0.19.0

package/dist/types/sdk/bus/index.d.ts

@@ -27,8 +27,10 @@ import { type WorkflowGateEmitter, type WorkflowGateTerminalProof } from "../../
 import type { AgentSessionEvent } from "../../session/agent-session";
 import { type SessionWorkLease, type SessionWorkLeaseHandle } from "../../session/session-work-lease";
 import type { AskAnswerSource, AskAnswerSourceResult, AskRemoteControl } from "../../tools";
+import type { AwaitingInputKind } from "../../tools/awaiting-input";
 import { type SessionHostRuntimePublication } from "../broker/lifecycle";
 import { type SessionSdkHost } from "../host";
+import { PromptImageUploadStore } from "../host/prompt-image-upload";
 import { CursorRegistry, RevisionStore } from "../host/query";
 import type { SdkFrame } from "../host/types";
 import { type SdkPromptTerminalOutcome } from "../prompt-status";
@@ -266,6 +268,13 @@ export declare class PresentationArbiter {
 interface SessionRuntime {
     server: NotificationServer;
     host: SessionSdkHost;
+    imageUploads: PromptImageUploadStore | undefined;
+    releaseAcceptedImage: (correlation: {
+        commandId: string;
+        turnId: string;
+    }) => void;
+    releaseAcceptedImagesForRun: (owner: AgentTerminalOwnerContext) => void;
+    releaseAcceptedImages: () => void;
     getJoinedPromptCorrelations: (owner: AgentTerminalOwnerContext) => Array<{
         commandId: string;
         turnId: string;
@@ -490,6 +499,16 @@ interface SessionRuntime {
         args?: unknown;
         pendingPhase?: "completed" | "failed" | "cancelled";
     }>;
+    /**
+     * Running tool calls that reported an awaiting-input signal, keyed by tool call
+     * id. An entry stays undelivered while notifications are inactive or policy is
+     * provisional, and is dropped when the call ends; one notification per call.
+     */
+    awaitingInput: Map<string, {
+        toolName: string;
+        kind: AwaitingInputKind;
+        delivered: boolean;
+    }>;
     /** Cancels the postmortem cleanup that emits `session_closed` on process teardown. */
     cancelPostmortemCleanup: () => void;
     /** Disposes side-turn resources when their owning logical session becomes unavailable. */
@@ -612,6 +631,29 @@ export declare function shouldAwaitNotificationStartup(event: {
     };
 }): boolean;
 export declare function boundedCorrelatedAgentEndFrame(frame: Record<string, unknown>): Record<string, unknown>;
+/** Connection-scoped identity of a queued prompt submission an abort may address. */
+export interface TerminalAbortSubmissionScope {
+    connectionId?: string;
+    terminal: boolean;
+}
+/**
+ * Whether a terminal abort addresses this prompt submission.
+ *
+ * An ordinary abort is scoped to the requesting connection's own prompt: `connectionId`
+ * identifies the connection that submitted it, and a submission that already reached a
+ * terminal state is never addressed. Broker-authorized operator authority
+ * (`TerminalAbortInput.operator`, granted only through the broker control route) is the
+ * documented exception — "operator authority changes only connection ownership, never
+ * those settlement proofs" — so it addresses the session's submission even when another
+ * connection submitted it. Without that override every operator abort issued over a
+ * second connection (the SDK client case, where each request is its own connection)
+ * reported no_active_turn while the turn was still running.
+ */
+export declare function terminalAbortAddressesSubmission(input: {
+    connectionId: string | undefined;
+    operatorAuthorized: boolean;
+    submission: TerminalAbortSubmissionScope;
+}): boolean;
 export declare function createNotificationsExtension(api: ExtensionAPI, options?: {
     settings?: Settings;
     ensureTelegramDaemon?: (input: {
@@ -649,6 +691,8 @@ export declare function createNotificationsExtension(api: ExtensionAPI, options?
      * preflight outside the durable admission path (review thread P2).
      */
     terminalAbortSeams?: {
+        /** Definitive event-driven observation; never mutates the owning run. */
+        waitForRunSettlement?: (handle: string) => Promise<RunSettlementProof>;
         getTerminalRunOwnerForEvent?: (event: object) => AgentTerminalOwnerContext | undefined;
         getRunOwnerDomain?: (handle: string) => RunCancellationDomain | undefined;
         getTerminalTurnEpoch: () => number | undefined;

package/dist/types/sdk/bus/reconciliation-store.d.ts

@@ -182,9 +182,19 @@ export interface ReconciliationStore {
     snapshotTerminalScopes(): DurableTerminalScopeRecord[];
     delete(): Promise<void>;
 }
+export interface ReconciliationStoreInstrumentationEvent {
+    at: number;
+    phase: "enqueued" | "started" | "completed" | "failed";
+    operation?: string;
+    substep?: string;
+    error?: string;
+    /** Detailed information about lock acquisition, promise identity, db state, etc. */
+    detail?: string;
+}
 export declare function createReconciliationStore(options: {
     sessionFile: string | null | undefined;
     sessionId: string;
     fs?: ReconciliationStoreFs;
     now?: () => number;
+    onInstrumentationForTests?: (event: ReconciliationStoreInstrumentationEvent) => void;
 }): ReconciliationStore;

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -296,8 +296,16 @@ export declare const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * Generation 202 joins queued-removal terminal publication before ordinary
  * abort acknowledgement, replacing owners that still acknowledge cancellation
  * before its terminal record is durable.
+ * Generation 203 replaces owners that still treat a project `.gjc` file as an
+ * explicit deadline-autosave opt-in for a primary checkout.
+ * Generation 205 replaces owners whose process descendant walk can adopt
+ * children of a recycled PID. Generation 206 verifies macOS descendant
+ * identities and parentage before retaining PTY termination authority, and
+ * reaps adopted Linux PTY descendants when GJC is a child reaper.
+ * Generation 209 installs connection-owned private SDK image staging with
+ * execution-owned reservations, replacing hosts without that lifecycle contract.
  */
-export declare const DAEMON_GENERATION = 202;
+export declare const DAEMON_GENERATION = 209;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7
  * requires durable publication receipts and acknowledged attachment dispatch,

package/dist/types/sdk/bus/telegram-daemon.d.ts

@@ -135,6 +135,8 @@ export declare const ASK_SELECTED_ACK_CAPABILITY = "ask_selected_ack_v1";
 export declare const ASK_CONTROLS_CAPABILITY = "ask_controls_v1";
 /** Capability for the closed tool phase set: started, completed, failed, and cancelled. */
 export declare const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v2";
+/** Receive content-free notifications when a running command needs host-side authentication. */
+export declare const AWAITING_INPUT_CAPABILITY = "awaiting_input_v1";
 /** Receive-only compatibility capability for pre-v2 hosts. */
 export declare const LEGACY_TOOL_ACTIVITY_CAPABILITY = "tool_activity_v1";
 /** Public `sdk/bus/telegram-daemon` path for the canonical `sdk/host` capability token. */

package/dist/types/sdk/bus/threaded-render.d.ts

@@ -2,7 +2,7 @@
  * Pure rendering of threaded-session frames into Telegram send specs.
  *
  * The daemon receives the additive `ServerMessage` frames (identity_header,
- * context_update, turn_stream, image_attachment, config_update) over the session
+ * context_update, turn_stream, image_attachment, config_update, awaiting_input) over the session
  * WS and must turn each into a Bot API call scoped to the session's forum topic
  * (`message_thread_id`), throttled through the shared rate-limit pool. This
  * module is the pure frame→send mapping (including the priority lane and live-
@@ -71,6 +71,7 @@ interface ThreadedFrame {
     turnRef?: unknown;
     toolCallId?: unknown;
     toolName?: unknown;
+    kind?: unknown;
     argsSummary?: unknown;
     resultSummary?: unknown;
     isError?: unknown;

package/dist/types/sdk/cli/session-cli.d.ts

@@ -45,7 +45,6 @@ export interface RetainedTranscriptTailReader {
 export declare const SDK_JSON_INPUT_FILE_MAX_BYTES: number;
 /** Translate only SDK-owned codes and explicitly allowlisted reconciliation fields. */
 export declare function sdkPublicFailure(code: string, details?: unknown, proof?: PublicEffectProof): PublicCommandFailure;
-/** Lifecycle terminality/retryability is not, by itself, proof of an effect outcome. */
 export declare function lifecyclePublicFailure(outcome: Extract<SessionLifecycleResult, {
     ok: false;
 }>): PublicCommandFailure;

package/dist/types/sdk/host/control/operations.d.ts

@@ -19,7 +19,11 @@ export type ControlInput = Record<string, unknown>;
  * AgentSession and its controllers without exposing those concrete types here.
  */
 export interface ControlSurface {
-    prompt(text: string, images?: ControlValue, clientRef?: string): Promise<ControlValue> | ControlValue;
+    prompt(text: string, images?: ControlValue, clientRef?: string, stagedImages?: ControlValue): Promise<ControlValue> | ControlValue;
+    imageBegin?(input: ControlValue): Promise<ControlValue> | ControlValue;
+    imageAppend?(input: ControlValue): Promise<ControlValue> | ControlValue;
+    imageFinish?(input: ControlValue): Promise<ControlValue> | ControlValue;
+    imageDiscard?(input: ControlValue): Promise<ControlValue> | ControlValue;
     steer(text: string, clientRef?: string, expectedSdkRunToken?: string): Promise<ControlValue> | ControlValue;
     followUp(text: string): Promise<ControlValue> | ControlValue;
     abort(): Promise<ControlValue> | ControlValue;

package/dist/types/sdk/host/events.d.ts

@@ -20,6 +20,8 @@ export interface EventReplay {
     events: EventFrame[];
     gap?: EventReplayGap;
 }
+/** Notification policy refresh records the live redaction bit for one session ring. */
+export declare function setSessionOutboundRedact(sessionId: string, enabled: boolean): void;
 export declare class SessionEventStream {
     #private;
     constructor(options?: {
@@ -30,6 +32,8 @@ export declare class SessionEventStream {
     });
     get generation(): number;
     get sequence(): number;
+    /** Follow the session redaction bit. Replay then drops kinds emit sites already suppress. */
+    setOutboundRedact(enabled: boolean): void;
     restart(): number;
     emit(frame: SdkFrame): EventFrame;
     /** Replays retained current-generation events and reports any required resynchronization. */

package/dist/types/sdk/host/host.d.ts

@@ -81,6 +81,7 @@ export interface SessionSdkHostOptions extends HostEndpointAdapters {
  *  must see the same capability-gated event kinds on both legs, or live and
  *  replay delivery diverge for the same subscriber. */
 export declare const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v2";
+export declare const AWAITING_INPUT_CAPABILITY = "awaiting_input_v1";
 /** Capability for non-replayable streamed turn content. */
 export declare const TURN_STREAM_CAPABILITY = "turn_stream";
 /** Capability used by notification adapters that observe a host without owning its work. */
@@ -91,7 +92,7 @@ export declare const SESSION_HOST_OBSERVER_CAPABILITY = "session_host_observer_v
  * of every frame its positioned envelope already reached.
  */
 export declare const POSITIONED_NOTIFICATION_EFFECTS_CAPABILITY = "positioned_notification_effects_v1";
-export declare const CAP_GATED_FRAME_KINDS: ReadonlySet<string>;
+export declare const CAP_GATED_FRAME_KINDS: ReadonlyMap<string, string>;
 /** Keep live delivery and replay on one capability gate. */
 export declare function canDeliverSdkEvent(kind: string, capabilities: ReadonlySet<string> | undefined): boolean;
 /** SDK hosting is independent of notification configuration. Only root sessions host an endpoint. */

package/dist/types/sdk/host/prompt-image-upload.d.ts

@@ -0,0 +1,43 @@
+import type { RunSettlementProof } from "@gajae-code/agent-core";
+import type { ImageContent } from "@gajae-code/ai/core";
+/** One definitive event-driven wait; teardown and elapsed time are not settlement proof. */
+export declare function retirePromptImageReservation(handle: string, waitForRunSettlement: (handle: string) => Promise<RunSettlementProof>, isCurrent: () => boolean, release: () => void): void;
+export interface PromptImageProcessBudgetSnapshot {
+    /** Retained upload and accepted source bytes, including accepted base64 copies. */
+    readonly sourceBytes: number;
+    readonly transientBytes: number;
+    readonly concurrentFinishes: number;
+}
+/** Internal process diagnostics only; not an SDK operation or a release capability. */
+export declare function getPromptImageProcessBudgetSnapshot(): PromptImageProcessBudgetSnapshot;
+/** Session-scoped, connection-owned image leases; no client-supplied path or identity is trusted. */
+export declare class PromptImageUploadStore {
+    #private;
+    /** The host supplies live socket membership; standalone callers must choose an explicit policy. */
+    constructor(isConnectionOpen: (connectionId: string) => boolean);
+    begin(connectionId: string | undefined, value: unknown): {
+        id: string;
+        nextSequence: 0;
+    };
+    append(connectionId: string | undefined, value: unknown): {
+        id: string;
+        nextSequence: number;
+        receivedBytes: number;
+    };
+    finish(connectionId: string | undefined, value: unknown): Promise<{
+        id: string;
+        byteLength: number;
+        sha256: string;
+        mimeType: string;
+    }>;
+    discard(connectionId: string | undefined, value: unknown): {
+        discarded: true;
+    };
+    /** Synchronous reserve–validate–copy–consume transaction, called before prompt admission. */
+    redeem(connectionId: string | undefined, value: unknown): {
+        images: ImageContent[];
+        release: () => void;
+    };
+    disconnect(connectionId: string): void;
+    close(): void;
+}

package/dist/types/sdk/host/session-runtime.d.ts

@@ -1,3 +1,4 @@
+import { type RunSettlementProof } from "@gajae-code/agent-core";
 import type { ProviderDiagnostic } from "@gajae-code/ai/core";
 import { type Settings } from "../../config/settings";
 import type { ExtensionAPI, ExtensionContext } from "../../extensibility/extensions";
@@ -74,9 +75,12 @@ export interface SessionSdkTransport {
     stop(): Promise<void>;
     broadcastFrame?(frame: SdkFrame): void;
     onConnectionClose?(handler: (connectionId: string) => void): undefined | (() => void);
+    /** Authoritative live socket membership, not a cache of previously observed frames. */
+    isConnectionOpen?(connectionId: string): boolean;
     onNegotiatedCapabilities?(handler: (connectionId: string, capabilities: readonly string[]) => void): undefined | (() => void);
 }
 export interface SessionSdkRuntimeOptions extends Omit<SessionSdkHostOptions, "sessionId" | "stateRoot" | "token" | "sendFrame" | "onFrame"> {
+    onDisconnected?: (connectionId: string) => void;
     transport: SessionSdkTransport;
     /** Session settings; enables `config.patch` application on this runtime. */
     settings?: Settings;
@@ -154,9 +158,13 @@ export interface SdkOnlyReconciliationStore {
     }): Promise<void>;
 }
 export interface SdkOnlyTerminalAbortSeams {
+    /** Definitive event-driven observation: never abort, seal or quarantine a run to reclaim images. */
+    waitForRunSettlement?: (handle: string) => Promise<RunSettlementProof>;
     getReconciliationStore?: () => SdkOnlyReconciliationStore | undefined;
     getTerminalTurnEpoch: () => number | undefined;
     getActivePromptHandle: () => string | undefined;
+    onDeadlineRecoveryCheckpointForTests?: (checkpoint: SdkOnlyDeadlineRecoveryCheckpoint) => void;
+    onPersistenceInstrumentationForTests?: (event: PersistenceInstrumentationEvent) => void;
     /** Re-read the active prompt's owning SDK connection for the owner-mismatch
      *  recheck; falls back to the runtime-tracked owner when absent (review
      *  thread P1). */
@@ -196,14 +204,23 @@ export interface SdkOnlyTerminalAbortSeams {
     /** Test override for the maximum durable terminal reservation rows. */
     maxDurableTerminalReservationsForTests?: number;
 }
-/**
- * The transport-neutral SDK session runtime.
- *
- * Concrete transports (including the optional notification/native transport) are
- * injected by the caller. This module owns host construction, control/query
- * dispatch, replay/event publication, and reverse-provider lifecycle without
- * importing any notification adapter or native notification class.
- */
+export interface SdkOnlyDeadlineRecoveryCheckpoint {
+    at: number;
+    stage: "terminalization-start" | "terminalization-result" | "publication-start" | "publication-result" | "note-transition-start" | "note-transition-awaiting-finalization" | "note-transition-finalization-ready" | "note-transition-before-persist" | "note-transition-persisted" | "note-transition-persist-failed" | "deadline-recovery-retired";
+    correlation: InvocationCorrelation;
+    result?: "settled" | "uncertain" | "published" | "not-published" | "rejected";
+    reason?: string;
+    recordStatus?: string;
+    recordRevision?: number;
+    recordTerminalAt?: number;
+    pendingFinalization?: boolean;
+    eventCaptured?: boolean;
+    eventPrepared?: boolean;
+    terminalCommitted?: boolean;
+    leaseCurrent?: boolean;
+    pendingToolCount?: number;
+    errorCode?: string;
+}
 export declare class SessionSdkSessionRuntime {
     #private;
     readonly host: SessionSdkHost;
@@ -354,10 +371,23 @@ export interface InvocationReconciliation {
     }): Promise<void>;
     markUncertain(kind: InvocationKind, correlation: InvocationCorrelation, isCurrent?: () => boolean, deadlineMaxAt?: number): Promise<void>;
 }
+export interface PersistenceInstrumentationEvent {
+    at: number;
+    phase: "enqueued" | "started" | "completed" | "failed";
+    operation?: string;
+    substep?: string;
+    error?: string;
+    /** Detailed information about lock acquisition, promise identity, db state, etc. */
+    detail?: string;
+    /** Time spent waiting (ms) before the operation started. */
+    waitMs?: number;
+}
 export declare function createInvocationReconciliation(options?: {
     stateRoot?: string;
     sessionId?: string;
     store?: SdkOnlyReconciliationStore;
+    onDeadlineRecoveryCheckpointForTests?: (checkpoint: SdkOnlyDeadlineRecoveryCheckpoint) => void;
+    onPersistenceInstrumentationForTests?: (event: PersistenceInstrumentationEvent) => void;
 }): InvocationReconciliation;
 export interface SdkSurfaceFactoryOptions {
     ctx: ExtensionContext;
@@ -365,6 +395,8 @@ export interface SdkSurfaceFactoryOptions {
     api: ExtensionAPI;
     /** Startup surface that owns host-level permission and lifecycle authority. */
     primaryControlSurface?: "cli" | "sdk";
+    /** Private staging controls are advertised only with authoritative transport liveness. */
+    imageUploadsAvailable?: boolean;
     policy?: SdkSurfacePolicy;
     getInstalledDefinitions?: (capability: string) => unknown | undefined;
     getLiveState?: () => {

package/dist/types/sdk/host/surface-policy.d.ts

@@ -7,6 +7,7 @@ export interface SdkSurfacePolicy {
 export interface SdkSurfacePolicyOptions {
     bindings: Iterable<string>;
     workflowGateAvailable: boolean;
+    imageUploadsAvailable?: boolean;
     isBindingInstalled?: (binding: string) => boolean;
 }
 /** Shared operation advertisement policy for every SDK transport. */
@@ -20,4 +21,4 @@ export interface SdkCapabilities {
 }
 export declare function createSdkCapabilities(policy: SdkSurfacePolicy, hostTools?: boolean, primaryControlSurface?: SdkCapabilities["primaryControlSurface"]): SdkCapabilities;
 /** Derive the shared policy from an extension context without importing adapters. */
-export declare function createSdkSurfacePolicyForContext(ctx: ExtensionContext, workflowGateAvailable?: boolean): SdkSurfacePolicy;
+export declare function createSdkSurfacePolicyForContext(ctx: ExtensionContext, workflowGateAvailable?: boolean, imageUploadsAvailable?: boolean): SdkSurfacePolicy;

package/dist/types/sdk/lifecycle/service.d.ts

@@ -57,6 +57,10 @@ export type SessionCreateTarget = SessionLifecycleCoordinatorTarget & {
     readonly body?: string;
     readonly modelPreset?: string;
     readonly mcpServers?: readonly Record<string, unknown>[];
+    /** Per-session environment for the hosted session; `GJC_*` names are reserved (#6735). */
+    readonly env?: Readonly<Record<string, string>>;
+    /** Inherited broker environment names removed from the hosted session (#6735). */
+    readonly unsetEnv?: readonly string[];
     readonly worktree?: SessionLifecycleWorktreeTarget;
     readonly readiness?: "immediate" | "deferred";
     readonly readinessTimeoutMs?: number;
@@ -70,6 +74,10 @@ export type SessionForkTarget = SessionLifecycleCoordinatorTarget & {
     readonly body?: string;
     readonly modelPreset?: string;
     readonly mcpServers?: readonly Record<string, unknown>[];
+    /** Per-session environment for the hosted session; `GJC_*` names are reserved (#6735). */
+    readonly env?: Readonly<Record<string, string>>;
+    /** Inherited broker environment names removed from the hosted session (#6735). */
+    readonly unsetEnv?: readonly string[];
     readonly worktree?: SessionLifecycleWorktreeTarget;
     readonly readinessTimeoutMs?: number;
 };
@@ -82,6 +90,10 @@ export type SessionResumeTarget = SessionLifecycleCoordinatorTarget & {
     readonly body?: string;
     readonly modelPreset?: string;
     readonly mcpServers?: readonly Record<string, unknown>[];
+    /** Per-session environment for the hosted session; `GJC_*` names are reserved (#6735). */
+    readonly env?: Readonly<Record<string, string>>;
+    /** Inherited broker environment names removed from the hosted session (#6735). */
+    readonly unsetEnv?: readonly string[];
     readonly worktree?: SessionLifecycleWorktreeTarget;
     readonly readinessTimeoutMs?: number;
 };

package/dist/types/sdk/prompt-deadline-flush.d.ts

@@ -44,7 +44,8 @@
  * WHERE it runs. `sdk.flushWorktreeOnDeadline` still defaults to on, but the
  * implicit default applies only in a LINKED worktree (`gitDir !== commonDir`) —
  * what agent/paseo sessions run in, and the #5583 field report. In the user's
- * primary checkout an autosave needs an explicit opt-in.
+ * primary checkout an autosave needs an explicit opt-in from the user/global
+ * config or a runtime override. A project `.gjc` file is not that opt-in.
  */
 export interface PromptDeadlineFlushResult {
     /** Branch the WIP commit landed on, or `undefined` on a detached HEAD. */
@@ -58,9 +59,10 @@ export interface PromptDeadlineFlushOptions {
     /** Active session's agent directory, used to keep volatile broker state out of the WIP commit. */
     readonly agentDir?: string;
     /**
-     * Whether the caller resolved `sdk.flushWorktreeOnDeadline` to `true` from a
-     * value the user actually wrote, rather than from the schema default. Only an
-     * explicit opt-in may autosave outside a linked worktree.
+     * Whether the caller resolved `sdk.flushWorktreeOnDeadline` to `true` from the
+     * user/global config or a runtime override, rather than from the schema
+     * default or a project `.gjc` file. Only that opt-in may autosave outside a
+     * linked worktree.
      */
     readonly explicitOptIn?: boolean;
     /**
@@ -71,6 +73,41 @@ export interface PromptDeadlineFlushOptions {
     readonly isCurrent?: () => boolean;
     readonly signal?: AbortSignal;
 }
+declare const DEADLINE_FLUSH_SETTING = "sdk.flushWorktreeOnDeadline";
+/**
+ * The settings view both deadline hosts already hold. `get` is the merged value
+ * (global, then project, then runtime override, otherwise the schema default).
+ * `getGlobal` and `getOverride` are the layers a project file cannot write.
+ */
+export interface DeadlineFlushSettings {
+    get(path: typeof DEADLINE_FLUSH_SETTING): unknown;
+    getAgentDir?(): string | undefined;
+    getGlobal?(path: typeof DEADLINE_FLUSH_SETTING): unknown;
+    getOverride?(path: typeof DEADLINE_FLUSH_SETTING): unknown;
+}
+/**
+ * True only when the user wrote `sdk.flushWorktreeOnDeadline: true` in a runtime
+ * override or the global config. The schema default and a project `.gjc` file
+ * do not count: `Settings.has()` sees the merged view, so a repo-shipped `true`
+ * would otherwise open the primary-checkout gate.
+ */
+export declare function explicitDeadlineFlushOptIn(settings: DeadlineFlushSettings | undefined): boolean;
+/**
+ * Whether this deadline must not autosave.
+ *
+ * A runtime override wins, then the user/global value. A project file cannot
+ * cancel either one. A project `false` still opts out when the user has not
+ * written the key.
+ */
+export declare function deadlineFlushSuppressed(settings: DeadlineFlushSettings | undefined): boolean;
+/**
+ * Deadline-host entry for the worktree autosave. Both the session runtime and
+ * the notification bus call this so the opt-in decision cannot drift.
+ */
+export declare function autosaveWorktreeOnPromptDeadline(cwd: string, settings: DeadlineFlushSettings | undefined, options?: {
+    readonly isCurrent?: () => boolean;
+    readonly signal?: AbortSignal;
+}): Promise<PromptDeadlineFlushResult | undefined>;
 /**
  * Commit any uncommitted work in the worktree owning `cwd`.
  *
@@ -83,3 +120,4 @@ export interface PromptDeadlineFlushOptions {
  * bound, so a caller that passes nothing still cannot hang here.
  */
 export declare function flushWorktreeOnPromptDeadline(cwd: string, options?: AbortSignal | PromptDeadlineFlushOptions): Promise<PromptDeadlineFlushResult | undefined>;
+export {};

package/dist/types/sdk/prompt-deadline-manager.d.ts

@@ -70,6 +70,8 @@ export declare class PromptDeadlineManager {
          */
         deadlineFlushTimeoutMs?: number;
     });
+    /** Notify about termination check results to adjust retry strategy. */
+    notifyTerminationResult(correlation: InvocationCorrelation, _result: PromptDeadlineTerminalization, reason: string): void;
     onAccepted(correlation: InvocationCorrelation): void;
     /** A new exact agent_start retires an uncertainty-only fence, never captured terminal intent. */
     onRunStarted(correlation: InvocationCorrelation): void;

package/dist/types/sdk/prompt-status.d.ts

@@ -37,12 +37,19 @@ export interface TurnPromptImageInput {
     data: string;
     mimeType?: string;
 }
-/** Public input contract for ordered `turn.prompt`. */
-export interface TurnPromptInput {
+/** Public input contract for ordered `turn.prompt`; direct and staged images cannot be mixed. */
+export type TurnPromptInput = {
     text: string;
-    images?: TurnPromptImageInput[];
     clientRef?: string;
-}
+} & ({
+    images?: TurnPromptImageInput[];
+    stagedImages?: never;
+} | {
+    images?: never;
+    stagedImages: Array<{
+        id: string;
+    }>;
+});
 /**
  * Terminal outcome is preserved exactly; active records never age into terminal. An
  * ordinary prompt active at process restart is finalized from its durable pending

package/dist/types/sdk/protocol/adapter-validation.d.ts

@@ -3,14 +3,20 @@ type SecretInputError = {
     code: "secret_field_forbidden";
     message: string;
 };
-/** Rejects secret-bearing config patches from model-facing adapter inputs. */
-export declare function validateAdapterSecretFields(operation: string, input: Input): SecretInputError | undefined;
+type UltrafastRestrictionError = {
+    code: "ultrafast_tier_forbidden";
+    message: string;
+};
+/** Rejects secret-bearing and ultrafast-tier config patches from model-facing adapter inputs. */
+export declare function validateAdapterSecretFields(operation: string, input: Input): SecretInputError | UltrafastRestrictionError | undefined;
 export type AdapterValidationError = {
     code: "invalid_reload_component" | "invalid_input";
     message: string;
 };
 /** Rejects instruction-bearing controls before correlation or provider work. */
 export declare function validateRequiredPromptText(operation: string, input: Input): AdapterValidationError | undefined;
-/** Validates controls that adapters must reject before forwarding them to a host. */
-export declare function validateAdapterControl(operation: string, input: Input): AdapterValidationError | undefined;
+/** Validates controls before forwarding them; adapters reject ultrafast unless explicitly trusted. */
+export declare function validateAdapterControl(operation: string, input: Input, options?: {
+    allowUltrafastTier?: boolean;
+}): AdapterValidationError | undefined;
 export {};

package/dist/types/sdk/reconciliation-extensions.d.ts

@@ -1,2 +1,2 @@
 export { createKindAwareReconciliation, type KindAwareReconciliation, type ReconciliationKind, type SteerReconciliationResult, } from "./bus/kind-aware-reconciliation";
-export { createReconciliationStore, type DurableExecutionReconciliationRecord, type DurableReconciliationRecord, type DurableSteerReconciliationRecord, type ReconciliationStore, resolveReconciliationSessionFile, } from "./bus/reconciliation-store";
+export { createReconciliationStore, type DurableExecutionReconciliationRecord, type DurableReconciliationRecord, type DurableSteerReconciliationRecord, type ReconciliationStore, type ReconciliationStoreInstrumentationEvent, resolveReconciliationSessionFile, } from "./bus/reconciliation-store";

package/dist/types/sdk/session-list.d.ts

@@ -1,6 +1,6 @@
 export type SessionListPageRecord = Record<string, unknown>;
 export type SessionListSavedSessionOmissionReason = "scope_unavailable" | "candidate_scan_failed" | "candidate_not_found" | "candidate_ambiguous" | "candidate_invalid" | "identity_incomplete";
-export declare const SESSION_LIST_SAVED_SESSION_OMISSION_DETAIL_CODES: readonly ["cwd_missing", "cwd_not_directory", "identity_unavailable", "network_unsupported", "sessions_root_unavailable", "binding_conflict", "binding_invalid", "migration_busy", "managed_gc_journal_capacity_exceeded", "atomic_unavailable", "invalid_request", "durability_failed", "durability_not_provable", "capacity_exceeded", "scan_failed", "unsafe_root", "invalid_candidate", "invalid_header", "unreadable_candidate", "source_changed", "cwd_not_found", "cwd_not_utf8", "cwd_network_unsupported", "cwd_identity_unavailable", "cwd_io_error"];
+export declare const SESSION_LIST_SAVED_SESSION_OMISSION_DETAIL_CODES: readonly ["cwd_missing", "cwd_not_directory", "identity_unavailable", "network_unsupported", "sessions_root_unavailable", "binding_conflict", "binding_invalid", "migration_busy", "managed_gc_journal_capacity_exceeded", "atomic_unavailable", "invalid_request", "permission_denied", "durability_failed", "durability_not_provable", "capacity_exceeded", "scan_failed", "unsafe_root", "invalid_candidate", "invalid_header", "unreadable_candidate", "source_changed", "cwd_not_found", "cwd_not_utf8", "cwd_network_unsupported", "cwd_identity_unavailable", "cwd_io_error"];
 export type SessionListSavedSessionOmissionDetailCode = (typeof SESSION_LIST_SAVED_SESSION_OMISSION_DETAIL_CODES)[number];
 /** Path-free diagnostic for a requested managed transcript that could not be selected safely. */
 export interface SessionListSavedSessionOmission {