@gajae-code/coding-agent 0.18.11 → 0.19.0

package/dist/types/session/agent-session.d.ts

@@ -70,10 +70,13 @@ export interface ForkContextSeedOptions {
 import type { AuthCredentialSelector } from "@gajae-code/ai/core";
 import { type AsyncJob, type AsyncJobDeliveryState, AsyncJobManager, type FoldReason, type JobFoldEvent, type SubagentLifecycle } from "../async";
 import type { Rule } from "../capability/rule";
+import type { ConfigHotReloadCandidate, ConfigHotReloadPaths } from "../config/config-hot-reload";
 import { type ModelRegistry } from "../config/model-registry";
 import { type ResolvedModelRoleValue, type ScopedModelSelection } from "../config/model-resolver";
+import { type ModelSelectorValue } from "../config/model-selector-value";
 import { type PromptTemplate } from "../config/prompt-templates";
 import type { Settings, SkillsSettings } from "../config/settings";
+import { type SettingPath } from "../config/settings-schema";
 import { RawSseDebugBuffer } from "../debug/raw-sse-buffer";
 import { type PythonResult } from "../eval/py/executor";
 import { type BashArtifactSaveResult, type BashResult } from "../exec/bash-executor";
@@ -99,11 +102,12 @@ import type { NetworkPrewarmRuntime } from "../runtime/network-prewarm-service";
 import type { WorkspaceTreeRuntime } from "../runtime/workspace-tree-service";
 import { type ExactMcpServerControlResult, MCPManager } from "../runtime-mcp/manager";
 import type { NotificationSessionController } from "../sdk/bus/session-control";
-import type { SecretObfuscator } from "../secrets/obfuscator";
+import { type SecretObfuscator } from "../secrets/obfuscator";
 import { type DiscoverableTool, type DiscoverableToolSearchIndex } from "../tool-discovery/tool-index";
 import type { AskAnswerSource, ToolSession } from "../tools";
 import type { CheckpointState } from "../tools/checkpoint";
 import { type TodoItem, type TodoPhase } from "../tools/todo-write";
+import { type EditMode } from "../utils/edit-mode";
 import { type WorkspaceTree } from "../workspace-tree";
 import { type DefaultModelSelectionResult } from "./default-model-selection";
 import { type ConfiguredFallbackChain, type FallbackChainRuntimeState } from "./fallback-chain-controller";
@@ -301,6 +305,8 @@ export interface AgentSessionConfig {
     workflowGatePublication?: "endpoint" | "local";
     /** Tool registry for LSP and settings */
     toolRegistry?: Map<string, AgentTool>;
+    /** Publish committed active tool names to tool execution contexts. */
+    onToolNamesChanged?: (toolNames: string[]) => void;
     /**
      * Tool objects this session's builder constructed from built-in descriptors, captured
      * before any extension, MCP, or dynamically registered tool could claim their registry
@@ -368,6 +374,8 @@ export interface AgentSessionConfig {
     defaultSelectedMCPServerNames?: string[];
     /** MCP tool names that should seed brand-new sessions created from this AgentSession. */
     defaultSelectedMCPToolNames?: string[];
+    /** Conventional autoload MCP names for the current catalog when autoload is not deferred. */
+    defaultSelectedConventionalMCPToolNames?: string[];
     /** MCP capabilities that are always active and never part of persisted user selection. */
     mandatoryMCPToolNames?: string[];
     /** TTSR manager for time-traveling stream rules */
@@ -481,6 +489,10 @@ export interface PromptOptions {
     /** Internal host capability; ordinary package callers cannot construct the branded value. */
     sdkRunCapability?: unknown;
 }
+export type QueuedRunStartFailure = {
+    readonly disposition: "not-started";
+    readonly error: unknown;
+};
 export interface SendUserMessageOptions {
     deliverAs?: QueuedInputDelivery;
     /** Preserve a busy SDK dispatch as queued work across an admission fence. */
@@ -494,6 +506,8 @@ export interface SendUserMessageOptions {
         startsOwnRun?: boolean;
         removed?: boolean;
     }) => void;
+    /** Internal positive core refusal, never a provider or teardown failure. */
+    onQueuedRunStartFailed?: (failure: QueuedRunStartFailure) => void;
     /** Internal dispatch disposition used before actual queue consumption. */
     onDispatchDisposition?: (promotion: {
         startsOwnRun: boolean;
@@ -726,6 +740,41 @@ export interface DefaultFallbackRuntimeState {
     controller: FallbackChainRuntimeState;
     exhaustedLastTurn: boolean;
 }
+export interface AgentSessionProfileInstalledOverrideState {
+    modelRoles: ReadonlyMap<string, ModelSelectorValue | undefined>;
+    agentModelOverrides: ReadonlyMap<string, ModelSelectorValue | undefined>;
+    installedModelRoles: ReadonlyMap<string, ModelSelectorValue>;
+    installedAgentModelOverrides: ReadonlyMap<string, ModelSelectorValue>;
+    manualModelRoles: ReadonlySet<string>;
+    manualAgentModelOverrides: ReadonlySet<string>;
+    configuredAgentModelOverrides: ReadonlySet<string>;
+    configuredDefaultChain?: readonly string[];
+    preProfileModel: Model | undefined;
+}
+export interface PreparedProfileModelSelection {
+    readonly sessionId: string;
+    readonly model: Model;
+    readonly thinkingLevel: ThinkingLevel | undefined;
+    readonly committedThinkingLevel: ThinkingLevel | undefined;
+    readonly previousModel: Model | undefined;
+    readonly previousThinkingLevel: ThinkingLevel | undefined;
+    readonly previousEditMode: EditMode;
+    readonly signal: AbortSignal | undefined;
+}
+export interface ConfigurationReloadResult {
+    readonly applied: boolean;
+    readonly settingsChanged: boolean;
+    readonly modelsChanged: boolean;
+    readonly changedSettings: readonly SettingPath[];
+}
+export type ConfigurationReloadErrorCode = "SESSION_UNAVAILABLE" | "PATH_CHANGED" | "SETTINGS_INVALID" | "MODELS_INVALID" | "MODEL_UNAVAILABLE" | "ACTIVE_PROFILE_INVALID" | "PUBLICATION_FAILED" | "VALIDATION_CLEANUP_FAILED";
+export declare class ConfigurationReloadError extends Error {
+    readonly code: ConfigurationReloadErrorCode;
+    readonly retryable: boolean;
+    constructor(code: ConfigurationReloadErrorCode, cause?: unknown, options?: {
+        readonly retryable?: boolean;
+    });
+}
 /** A lost continuation may only settle the emitter/session pair that opened it. */
 export declare function isCurrentWorkflowGateContinuation(currentSessionId: string, expectedSessionId: string, currentEmitter: WorkflowGateEmitter | undefined, expectedEmitter: WorkflowGateEmitter): boolean;
 export declare class AgentSession {
@@ -779,19 +828,27 @@ export declare class AgentSession {
         session_id?: string;
     } | undefined;
     /**
-     * Live prompt marker or restored durable workflow — the effective state the
-     * cwd-local mutation guard must honor after resume.
+     * Live prompt marker or durable workflow identity — the effective state the
+     * cwd-local mutation guard must honor during and after a workflow prompt.
      */
     getEffectiveActiveWorkflowSkillState(): {
         skill: string;
         sessionId: string;
     } | undefined;
+    /** Refresh durable workflow identity before a terminal or safety-sensitive operation. */
+    refreshEffectiveActiveWorkflowSkillState(): Promise<{
+        skill: string;
+        sessionId: string;
+    } | undefined>;
     /** Replace the session-owned MCP manager after a cwd rescope. */
     replaceOwnedMcpManager(next: MCPManager | undefined): Promise<void>;
-    /** Swap named custom tools and their optional mandatory MCP selection. */
+    /** Swap named custom tools and restore authoritative MCP selections as late tools arrive. */
     replaceNamedCustomTools(previousNames: readonly string[], nextTools: readonly CustomTool[], options?: {
         mandatoryMCPToolNames?: readonly string[];
+        defaultSelectedConventionalMCPToolNames?: readonly string[];
         activateNewTools?: boolean;
+        inactiveNewToolNames?: readonly string[];
+        persistMCPSelection?: boolean;
     }): Promise<void>;
     /** Best-effort accessor for the active skill's `current_phase` field from
      *  its persisted mode-state file. Used by the `skill` tool to enforce the
@@ -855,6 +912,8 @@ export declare class AgentSession {
      * manager's stable control-plane records (they outlive AsyncJob eviction).
      */
     getSubagentLifecycleStatuses(): SubagentLifecycle[];
+    /** Notify UI projections after a committed session-identity transition. */
+    notifySessionIdentityChanged(): Promise<void>;
     /**
      * Emit a UI-only notice to the session. Surfaces in interactive mode as a
      * `showWarning` / `showError` / `showStatus` line; non-interactive modes
@@ -873,6 +932,8 @@ export declare class AgentSession {
      * Multiple listeners can be added. Returns unsubscribe function for this listener.
      */
     subscribe(listener: AgentSessionEventListener): () => void;
+    /** Subscribe to committed session identity changes that affect UI projections. */
+    subscribeSessionIdentityChanges(listener: () => void | Promise<void>): () => void;
     /**
      * Remove all listeners, flush pending writes, and disconnect from agent.
      * Call this when completely done with the session.
@@ -958,6 +1019,7 @@ export declare class AgentSession {
         type: "agent_end";
     }>): void;
     flushParkedAgentEndForCoordinatorPersistForTests(): void;
+    waitForAgentEndHandlingForTests(): Promise<void>;
     drainAsyncJobDeliveriesForAcp(options?: {
         timeoutMs?: number;
     }): Promise<boolean>;
@@ -1059,6 +1121,11 @@ export declare class AgentSession {
      * deliberately bypassed: suppression is runtime state, not user authority.
      */
     controlExactMcpServer(action: ExactMcpControlAction, name: string): Promise<ExactMcpControlResult | undefined>;
+    /** Whether the current context has committed persisted, constructor, or caller MCP selection authority. */
+    hasCommittedMCPToolSelectionAuthority(): boolean;
+    /** Whether the current context has committed or pending caller MCP selection authority. */
+    hasMCPToolSelectionAuthority(): boolean;
+    getActiveMCPToolNames(): string[];
     getSelectedMCPToolNames(): string[];
     isToolDiscoveryEnabled(): boolean;
     getDiscoverableTools(filter?: {
@@ -1066,7 +1133,9 @@ export declare class AgentSession {
     }): DiscoverableTool[];
     getDiscoverableToolSearchIndex(): DiscoverableToolSearchIndex;
     getSelectedDiscoveredToolNames(): string[];
-    activateDiscoveredTools(toolNames: string[]): Promise<string[]>;
+    activateDiscoveredTools(toolNames: string[], options?: {
+        persistMCPSelection?: boolean;
+    }): Promise<string[]>;
     /**
      * Reload the SSH tool from disk-backed capability discovery and make the
      * refreshed definition visible to the next model call without restarting.
@@ -1079,8 +1148,15 @@ export declare class AgentSession {
      * Only tools in the registry can be enabled. Unknown tool names are ignored.
      * Also rebuilds the system prompt to reflect the new tool set.
      * Changes take effect before the next model call.
+     * Use `explicit: false` for internal filtering and `persistMCPSelection: false` when the live
+     * selection must not be written to the session transcript. Internal mode transitions may set
+     * `retryOnMcpCatalogChange` when a catalog publication must not leave their tool swap unapplied.
      */
-    setActiveToolsByName(toolNames: string[]): Promise<void>;
+    setActiveToolsByName(toolNames: string[], options?: {
+        explicit?: boolean;
+        persistMCPSelection?: boolean;
+        retryOnMcpCatalogChange?: boolean;
+    }): Promise<void>;
     /** Rebuild the base system prompt using the current active tool set. */
     refreshBaseSystemPrompt(): Promise<void>;
     /**
@@ -1479,8 +1555,12 @@ export declare class AgentSession {
         cause?: ModelChangeCause;
         onMutationStarted?: () => void;
     }): Promise<void>;
-    setActiveModelProfile(name: string | undefined): void;
+    /** History may restore the identity without proving this process activated the profile. */
+    setActiveModelProfile(name: string | undefined, activatedByThisProcess?: boolean): void;
+    markProfileRoleOverrideManual(path: "modelRoles" | "task.agentModelOverrides", role: string): void;
     getActiveModelProfile(): string | undefined;
+    /** A restored profile identity is not eligible for role-only materialization until activation succeeds. */
+    getActivatedModelProfile(): string | undefined;
     setUnavailableModelProfile(name: string | undefined): void;
     getUnavailableModelProfile(): string | undefined;
     /** Revision fence for deferred activation after a user model selection. */
@@ -1492,6 +1572,9 @@ export declare class AgentSession {
     };
     /** Fence deferred startup profile recovery before an explicit control-surface selection. */
     markUserModelSelection(): void;
+    getConfigurationPaths(): ConfigHotReloadPaths | undefined;
+    validateConfiguration(candidate: ConfigHotReloadCandidate): Promise<void>;
+    reloadConfiguration(candidate: ConfigHotReloadCandidate, signal: AbortSignal): Promise<ConfigurationReloadResult>;
     /**
      * Re-apply vendor-separated delegation after a profile activation changed the
      * role layer. `eagerTasks` is resolved at prompt build time, but under
@@ -1502,7 +1585,18 @@ export declare class AgentSession {
      */
     syncEagerDelegation(): Promise<void>;
     /** Record runtime override keys installed by a profile activation. */
-    noteProfileInstalledOverrides(modelRoles: readonly string[], agentModelOverrides: readonly string[], preProfileModel: Model | undefined): void;
+    noteProfileInstalledOverrides(modelRoles: readonly string[], agentModelOverrides: readonly string[], preProfileModel: Model | undefined, baseline?: {
+        modelRoles: Readonly<Record<string, ModelSelectorValue>>;
+        agentModelOverrides: Readonly<Record<string, ModelSelectorValue>>;
+    }, installed?: {
+        modelRoles: Readonly<Record<string, ModelSelectorValue>>;
+        agentModelOverrides: Readonly<Record<string, ModelSelectorValue>>;
+    }, manual?: {
+        modelRoles: readonly string[];
+        agentModelOverrides: readonly string[];
+    }, configuredDefaultChain?: readonly string[]): void;
+    getProfileInstalledOverrideState(): AgentSessionProfileInstalledOverrideState;
+    restoreProfileInstalledOverrideState(state: AgentSessionProfileInstalledOverrideState): void;
     /** Drop the recorded profile-installed override keys after materialization. */
     clearProfileInstalledOverrides(): void;
     /** Current profile-installed override keys, for deriving the activation base. */
@@ -1628,6 +1722,9 @@ export declare class AgentSession {
         shouldMutate?: () => boolean;
         onMutationStarted?: () => void;
     }): Promise<TemporaryProviderSessionScope | void>;
+    prepareModelSelectionForProfileActivation(model: Model, thinkingLevel: ThinkingLevel | undefined, signal?: AbortSignal): Promise<PreparedProfileModelSelection>;
+    commitPreparedProfileModelSelection(prepared: PreparedProfileModelSelection, onThinkingLevelApplied?: (mutationRevision: number) => void): void;
+    finishPreparedProfileModelSelection(prepared: PreparedProfileModelSelection): Promise<void>;
     /** Restore the exact live-model state captured before a failed selector transaction. */
     restoreModelSelectionForRollback(model: Model | undefined, thinkingLevel: ThinkingLevel | undefined): Promise<void>;
     /** Set a durable per-session model from a control surface without exposing credential errors. */
@@ -1882,7 +1979,8 @@ export declare class AgentSession {
      * the reply is generated, both the incoming question and the auto-reply are
      * queued for injection into the recipient's persisted history so the model
      * sees the exchange on its next turn.  Injection happens immediately when the
-     * session is idle, otherwise it is deferred until streaming ends.
+     * session is idle; a busy session steers the exchange into the live run, which
+     * commits it at its next tool boundary.
      */
     respondAsBackground(args: {
         from: string;

package/dist/types/session/internal/managed-session-scope.d.ts

@@ -87,7 +87,7 @@ export declare function managedDirectoryIdentityForScope(scope: ManagedScope): {
 };
 export declare function managedRootForScope(scope: ManagedScope): ManagedDirectoryRoot;
 export type ManagedMigrationPolicy = "copy-retain" | "disabled";
-export type ManagedScopeErrorCode = "cwd_missing" | "cwd_not_directory" | "identity_unavailable" | "network_unsupported" | "sessions_root_unavailable" | "binding_conflict" | "binding_invalid" | "migration_busy" | "managed_gc_journal_capacity_exceeded" | "atomic_unavailable" | "invalid_request" | "durability_failed" | "durability_not_provable" | "capacity_exceeded";
+export type ManagedScopeErrorCode = "cwd_missing" | "cwd_not_directory" | "identity_unavailable" | "network_unsupported" | "sessions_root_unavailable" | "binding_conflict" | "binding_invalid" | "migration_busy" | "managed_gc_journal_capacity_exceeded" | "atomic_unavailable" | "invalid_request" | "permission_denied" | "durability_failed" | "durability_not_provable" | "capacity_exceeded";
 export type ManagedScopeResolution = {
     kind: "resolved";
     scope: ManagedScope;
@@ -122,7 +122,7 @@ export type ManagedCandidateListing = {
     code: "scan_failed" | "unsafe_root" | "invalid_candidate";
     message: string;
 };
-export type ManagedOpenFailure = "migration_busy" | "binding_conflict" | "binding_invalid" | "destination_conflict" | "source_changed" | "unsafe_artifacts" | "artifact_capacity_exceeded" | "managed_gc_journal_capacity_exceeded" | "durability_failed" | "atomic_unavailable" | "invalid_request" | "durability_not_provable" | "migration_retired" | "legacy_migration_disabled" | "managed_storage_unsupported";
+export type ManagedOpenFailure = "migration_busy" | "binding_conflict" | "binding_invalid" | "destination_conflict" | "source_changed" | "unsafe_artifacts" | "artifact_capacity_exceeded" | "managed_gc_journal_capacity_exceeded" | "durability_failed" | "atomic_unavailable" | "permission_denied" | "invalid_request" | "durability_not_provable" | "migration_retired" | "legacy_migration_disabled" | "managed_storage_unsupported";
 export type ManagedOpenCandidateResult = {
     kind: "opened";
     path: string;

package/dist/types/session/internal/managed-session-storage.d.ts

@@ -15,7 +15,7 @@ export declare class ManagedAppendIdentityMismatchError extends Error {
     constructor(relativePath: string);
 }
 export declare class ManagedPublishError extends Error {
-    readonly classification: "destination_conflict" | "atomic_unavailable" | "invalid_request" | "durability_not_provable" | "identity_mismatch" | "io_error" | "durability_failed";
+    readonly classification: "destination_conflict" | "atomic_unavailable" | "invalid_request" | "durability_not_provable" | "identity_mismatch" | "permission_denied" | "io_error" | "durability_failed";
     readonly diagnostic: string;
     readonly stagingCleanupSafe: boolean;
     constructor(classification: ManagedPublishError["classification"], outcome: NativePublishOutcome);

package/dist/types/session/internal/native-publish-outcome.d.ts

@@ -1,6 +1,6 @@
 export type NativePublishMutationState = "not_committed" | "committed" | "unknown";
 export type NativePublishDurabilityState = "not_attempted" | "proven" | "not_provable";
-export type NativePublishReason = "none" | "destination_exists" | "atomic_unavailable" | "cross_device" | "permission_denied" | "io_failure" | "interrupted" | "invalid_request" | "identity_violation" | "durability_not_provable" | "unknown";
+export type NativePublishReason = "none" | "destination_exists" | "atomic_unavailable" | "cross_device" | "permission_denied" | "access_denied" | "io_failure" | "interrupted" | "invalid_request" | "identity_violation" | "durability_not_provable" | "unknown";
 export type NativePublishOperation = "direct_rename" | "retained_file" | "retained_tree";
 export type NativePublishPrimitive = "renameat2_noreplace" | "linkat_noreplace" | "mkdirat_renameat_noreplace" | "renameatx_np_excl" | "windows_rename_noreplace" | "unsupported" | "unknown";
 export type NativePublishPhase = "preflight" | "file_sync" | "rename" | "source_unlink" | "source_parent_sync" | "destination_parent_sync" | "terminal_identity" | "complete" | "unknown";

package/dist/types/session/messages.d.ts

@@ -72,8 +72,12 @@ export declare const PRE_ADMISSION_ARTIFACT_SPILL_TAIL_BYTES = 4096;
  * Build the deterministic inline receipt for a tool result saved before the
  * next provider context is constructed. Byte boundaries never split UTF-8
  * code points, so head/tail recovery remains readable for emoji and CJK text.
+ *
+ * `redact` runs on the complete text before the cut. The digest stays the
+ * caller's hash of the stored artifact; the omitted count is the redacted
+ * preview's omitted bytes.
  */
-export declare function createPreAdmissionArtifactSpillPreview(fullText: string, artifactId: string, digest: string): string;
+export declare function createPreAdmissionArtifactSpillPreview(fullText: string, artifactId: string, digest: string, redact?: (text: string) => string): string;
 /**
  * Message type for bash executions via the ! command.
  */

package/dist/types/session/session-manager.d.ts

@@ -41,6 +41,17 @@ export interface PreparedNewSession {
     readonly artifactsDir: string | null;
     readonly managedLegacyLocalMigrationSource: ManagedLegacyLocalMigrationSource | null;
 }
+/**
+ * Resident text is a second plaintext copy of assistant and tool output.
+ * A cache root inside a Git worktree can be staged by a later `git add`, so
+ * that root stays in memory. Both the lexical directory and the canonical
+ * directory are classified: a symlink outside the worktree must not hide a
+ * target inside it, and a lexical worktree path stays refused when its
+ * canonical target is outside. A missing or non-directory root still reaches
+ * the resident-cache trust check when both views are outside a worktree.
+ * No existing directory within 64 ancestors, or a resolver error, stays in memory.
+ */
+export declare function residentTextCacheRootAllowsDisk(cacheRoot: string): boolean;
 export interface SessionEntryBase {
     type: string;
     id: string;
@@ -1092,6 +1103,11 @@ export interface ResolvedSessionMatch {
     session: SessionInfo;
     scope: "local" | "global";
 }
+/**
+ * Equal session id first, the same `id ===` check managed resume already uses.
+ * Prefix matching stays for every other argument, in list order.
+ */
+export declare function pickResumableSession(sessions: readonly SessionInfo[], sessionArg: string): SessionInfo | undefined;
 export declare function resolveResumableSession(sessionArg: string, cwd: string, sessionDir?: string, storage?: SessionStorage, managedAgentDir?: string): Promise<ResolvedSessionMatch | undefined>;
 interface SessionManagerStateSnapshot {
     sessionId: string;
@@ -1152,14 +1168,14 @@ export declare const SessionManagerTestHooks: {
 /**
  * Freshness snapshot captured with every async whole-session persistence
  * preparation. Immediately before the synchronous persistence transaction, the
- * live values are compared: a `sessionFile`/`lifecycleId` change aborts (lifecycle
- * switch); a revision change discards the prepared bytes and re-prepares (bounded),
+ * live values are compared: a logical lifecycle change aborts; a verified storage
+ * relocation or revision change discards prepared bytes and re-prepares (bounded),
  * so a stale snapshot is never published.
  */
 export interface PersistenceInputToken {
     /** Canonical session file path the prepared bytes target. */
     sessionFile: string;
-    /** Per-manager lifecycle identity (`sessionId@sessionFile`); changes on switch/open/reset. */
+    /** Logical lifecycle identity; storage-only relocation preserves its verified origin. */
     lifecycleId: string;
     /** Revision of #fileEntries affecting persisted bytes. */
     entryRevision: number;
@@ -1377,6 +1393,16 @@ export declare class SessionManager {
     }): Promise<void>;
     /** Ownership loss remains observable even when an agent event listener aborts the turn. */
     getAppendIdentityMismatch(): ManagedAppendIdentityMismatchError | undefined;
+    /**
+     * Register the same-owner task capability used to follow a parent's managed
+     * artifact root after its session move. The synchronous resolver must return
+     * only the current ArtifactManager for the same parent ID and parent transcript
+     * basename; it retains the last verified manager on a logical successor.
+     * Registration captures the exact original manager identity. Unchanged identity
+     * keeps using the child's retained store; a changed identity triggers strict
+     * destination transcript verification before re-rooting.
+     */
+    registerManagedTranscriptRelocationResolver(resolver: () => ArtifactManager): () => void;
     isPersisted(): boolean;
     stageDefaultModelSelection(model: string, thinkingLevel: string | undefined, options?: {
         readonly appendThinkingLevel: boolean;

package/dist/types/session/startup-auth-config.d.ts

@@ -6,7 +6,7 @@
  * performed. Environment values are trusted credential sources and take
  * precedence over global config values.
  */
-import type { AuthCredentialSelector, CredentialRankingMode } from "@gajae-code/ai/core";
+import type { AuthCredentialSelector, ConfiguredCredentialPreference, CredentialRankingMode } from "@gajae-code/ai/core";
 export interface AuthBrokerClientConfig {
     url: string;
     token: string;
@@ -19,8 +19,10 @@ export interface StartupAuthConfigSnapshot {
     credentialPinStoreIdentity?: string;
     credentialRankingMode: CredentialRankingMode;
     credentialPins: Readonly<Record<string, string>>;
+    /** Ordered soft per-provider preferences; only portable email/`account:` selectors are accepted. */
+    credentialPreferences: Readonly<Record<string, readonly ConfiguredCredentialPreference[]>>;
 }
-export type StartupAuthConfigErrorKind = "unreadable" | "invalid-yaml" | "non-mapping-root" | "invalid-auth" | "invalid-broker" | "invalid-gateway" | "invalid-ranking-mode" | "invalid-credential-pins";
+export type StartupAuthConfigErrorKind = "unreadable" | "invalid-yaml" | "non-mapping-root" | "invalid-auth" | "invalid-broker" | "invalid-gateway" | "invalid-ranking-mode" | "invalid-credential-pins" | "invalid-credential-preferences";
 /** A malformed startup-auth config aborts resolution rather than downgrading to local authority. */
 export declare class StartupAuthConfigError extends Error {
     readonly kind: StartupAuthConfigErrorKind;
@@ -31,11 +33,31 @@ export declare class StartupAuthConfigError extends Error {
 }
 /** JSON-schema pattern shared with the runtime persisted-selector grammar. */
 export declare const PERSISTED_CREDENTIAL_SELECTOR_PATTERN = "^(id:[1-9][0-9]*|email:[^@\\s]+@[^@\\s]+|account:\\S+)$";
+export declare function startupAuthConfigError(agentDir: string, kind: StartupAuthConfigErrorKind): StartupAuthConfigError;
 /** Path to the local bearer token file. Created on the broker host by `gjc auth-broker token`. */
 export declare function getAuthBrokerTokenFilePath(): string;
 /** Validate the persisted selector grammar used by `auth.credentialPins`. */
 export declare function parsePersistedCredentialSelector(value: string): AuthCredentialSelector | undefined;
 export declare function isValidPersistedCredentialSelector(value: string): boolean;
+/** JSON-schema pattern for a preference account; shared with {@link parsePreferenceAccount}. */
+export declare const PREFERENCE_ACCOUNT_PATTERN = "^(email:[^@\\s]+@[^@\\s]+|account:\\S+|[^@\\s:]+@[^@\\s]+)$";
+/**
+ * Parse one `auth.credentialPreferences` account: a bare email, `email:<address>`, or `account:<id>`. Numeric row ids
+ * are excluded: they are bound to one credential store, and a preference has no store-identity binding to detect a
+ * retargeted row.
+ */
+export declare function parsePreferenceAccount(value: string): AuthCredentialSelector | undefined;
+/** A preference cap accepts (0, 100]; 100 moves past the account only once it is blocked. */
+export declare function isValidCredentialPreferenceCap(value: unknown): value is number;
+/** Canonical config text for one preference entry: the account, or a one-key `{ account: cap }` mapping. */
+export type CredentialPreferenceEntryValue = string | Readonly<Record<string, number>>;
+/**
+ * Parse one provider's `auth.credentialPreferences` value: a single account, or a non-empty ordered list whose
+ * entries are an account (`me@example.com`) or an account with a usage cap in percent (`me@example.com: 75`).
+ * Returns undefined for any invalid value, including an account listed twice, so a typo fails closed instead of
+ * silently changing the order.
+ */
+export declare function parseCredentialPreferenceList(value: unknown): ConfiguredCredentialPreference[] | undefined;
 /**
  * Resolve one typed startup-auth snapshot from trusted env and global config.
  * Project settings are intentionally not read here, so project-scoped pins

package/dist/types/session/streaming-output.d.ts

@@ -3,6 +3,8 @@ export declare const DEFAULT_MAX_LINES = 3000;
 export declare const DEFAULT_MAX_BYTES: number;
 export declare const DEFAULT_MAX_COLUMN = 1024;
 export declare const DEFAULT_ARTIFACT_MAX_BYTES: number;
+/** Run `fn` while column caps can see these plain secrets. */
+export declare function runWithOutputRedaction<T>(plainSecrets: readonly string[], fn: () => T): T;
 /**
  * Terminal publisher used when managed artifact storage exposes an ID but no
  * writable pathname. The sink supplies raw content retained up to its artifact
@@ -167,6 +169,15 @@ export declare function truncateLine(line: string, maxChars?: number): {
     text: string;
     wasTruncated: boolean;
 };
+/**
+ * Truncate each line to max characters without leaving a configured plain-secret
+ * prefix in the retained text. Prior uncapped lines remain in scope because a
+ * later line's cut can split a multiline secret.
+ */
+export declare function truncateTextWithSecretAwareness(text: string, maxChars?: number, secrets?: readonly string[]): {
+    text: string;
+    wasTruncated: boolean;
+};
 /** Shared helper to build a no-truncation result. */
 export declare function noTruncResult(content: string, totalLines?: number, totalBytes?: number): TruncationResult;
 /**

package/dist/types/session/terminal-abort.d.ts

@@ -114,6 +114,8 @@ export declare function registerOwnedRegistration(key: TurnRegistrationKey, opti
  *  scope:"owned" abort of that exact attempt must fail closed to uncertainty
  *  (review thread P2). */
 export declare function isOwnedAttemptRegistrationIncomplete(lineageIdHash: string, attemptEpoch: number): boolean;
+/** Move fail-closed saturation authority with all ownership state during endpoint rekey. */
+export declare function migrateOwnedAttemptSaturationsForEndpoint(predecessorEndpointId: string, successorEndpointId: string): void;
 /** Exact (jobId, jobGeneration) lookup for completion-origin classification. */
 export declare function lookupOwnedRegistration(jobId: string, jobGeneration: string, endpointId?: string): TurnRegistrationKey | undefined;
 export declare function unregisterOwnedRegistration(key: TurnRegistrationKey): void;
@@ -231,7 +233,7 @@ export declare function registerOwnedIfLineaged(manager: {
         generation?: string;
         status?: string;
     } | undefined;
-}, toolCallId: string | undefined, jobId: string, endpointId?: string): void;
+}, toolCallId: string | undefined, jobId: string, endpointId?: string, ownedRegistrationEndpointId?: string): void;
 /** Retire the exact (endpoint, jobId, jobGeneration) owned registration when
  *  its completion delivery is dead-lettered by the manager (delivery-queue
  *  overflow or retry exhaustion): no message is injected and no later

package/dist/types/session-import/service.d.ts

@@ -1,5 +1,5 @@
 import { CodexImportError } from "./codex";
-export type SessionImportErrorCode = CodexImportError["code"] | "invalid_request" | "binding_invalid" | "content_too_large" | "destination_conflict" | "publish_uncertain" | "atomic_unavailable" | "durability_not_provable" | "durability_failed" | "identity_mismatch" | "validation_failed" | "io_failed" | "internal_failed";
+export type SessionImportErrorCode = CodexImportError["code"] | "invalid_request" | "binding_invalid" | "content_too_large" | "destination_conflict" | "publish_uncertain" | "atomic_unavailable" | "permission_denied" | "durability_not_provable" | "durability_failed" | "identity_mismatch" | "validation_failed" | "io_failed" | "internal_failed";
 export interface SessionImportFailure {
     status: "failed";
     provider: "codex";

package/dist/types/skill-state/workflow-mutation-guard.d.ts

@@ -1,12 +1,16 @@
 import type { AgentTool } from "@gajae-code/agent-core";
-import { readVisibleSkillActiveState } from "./active-state";
+import { readVisibleSkillActiveState, type SkillActiveEntry } from "./active-state";
 export declare const DEEP_INTERVIEW_MUTATION_BLOCK_MESSAGE = "Deep-interview phase boundary: continue gathering context/questions/risks and emit a handoff/spec before code edits. Mutation tools and patch execution are blocked while deep-interview is active; finalize specs through `gjc deep-interview --write --stage final` or hand off to an execution phase.";
 export declare const WORKFLOW_STATE_MUTATION_BLOCK_MESSAGE = ".gjc workflow state and artifacts are runtime-owned. Agent mutation tools cannot edit `.gjc/**`; use the sanctioned `gjc` CLI instead.";
 export declare const RALPLAN_MUTATION_BLOCK_MESSAGE = "Ralplan planning phase boundary: keep refining the consensus plan and persist plan artifacts through `gjc ralplan --write` (stage scratch files under a temp dir if needed). Product-code mutation tools and patch execution are blocked while ralplan is active; mutate only after the plan is approved and execution begins.";
 export declare const ULTRAGOAL_GOAL_PLANNING_MUTATION_BLOCK_MESSAGE = "Ultragoal goal-planning phase boundary: finish goal planning and record goals through `gjc ultragoal` before editing code. Product-code mutation tools and patch execution are blocked until goal planning completes and execution begins.";
-export declare const AUTORESEARCH_MUTATION_BLOCK_MESSAGE = "Autoresearch research-only boundary: this workflow produces findings, evidence, and a verdict \u2014 never product code. Product-code mutation tools and patch execution are blocked everywhere, on every branch. Mission research artifacts (`autoresearch.sh` at the workdir root and mission state through the sanctioned `gjc autoresearch` CLI) stay writable; run experiments through the `python` tool, or finish the mission and hand off to an approved implementation workflow.";
-/** Tools whose execute path can mutate product state. `github` is included so side-effect ops share this guard. */
-export declare const WORKFLOW_MUTATION_TOOL_NAMES: readonly ["edit", "write", "ast_edit", "bash", "github"];
+export declare const AUTORESEARCH_MUTATION_BLOCK_MESSAGE = "Autoresearch research-only boundary: this workflow produces findings, evidence, and a verdict \u2014 never product code. Product-code mutation tools and patch execution are blocked everywhere, on every branch. Write the root `autoresearch.sh` only with direct file tools; mission state stays writable through the sanctioned `gjc autoresearch` CLI. Run experiments through the `python` tool, or finish the mission and hand off to an approved implementation workflow.";
+/**
+ * Tools whose execute path can mutate product state. `github` is included so
+ * side-effect ops share this guard. `eval` and `python` run code that can write
+ * files without going through edit, write, or bash.
+ */
+export declare const WORKFLOW_MUTATION_TOOL_NAMES: readonly ["edit", "write", "ast_edit", "bash", "github", "eval", "python"];
 export declare function isWorkflowMutationTool(name: string): boolean;
 type ToolWithEditMode = AgentTool & {
     mode?: unknown;
@@ -45,6 +49,18 @@ export declare function readWorkflowGuardContext(cwd: string, options?: {
     sessionId?: string;
     threadId?: string;
 }): Promise<WorkflowGuardContext>;
+/**
+ * Pick the single CURRENT workflow entry among active entries.
+ *
+ * Steady state has exactly one active workflow skill (handoff demotes the prior
+ * to `active:false`, which `listActiveSkills` already filters out). If several
+ * are momentarily active, prefer the most-recently-updated entry so a stale
+ * planning row (e.g. a still-active ralplan `final`) can never be selected over a
+ * newer executor (ultragoal/autoresearch), and a planning *return* (newer `updated_at`)
+ * reliably wins. Ties fall back to the resolved top-level `skill`, then to the
+ * first entry, matching how the HUD/chain guard pick `activeSkills[0]`.
+ */
+export declare function resolveCurrentWorkflowEntry(entries: SkillActiveEntry[], topLevelSkill: string): SkillActiveEntry;
 export declare function assertWorkflowMutationRawPathsAllowed(input: {
     cwd: string;
     sessionId?: string;

package/dist/types/slash-commands/helpers/mcp.d.ts

@@ -1,3 +1,8 @@
 import type { ParsedSlashCommand, SlashCommandResult, SlashCommandRuntime } from "../types";
+/**
+ * One terminal row for an untrusted MCP server or tool name.
+ * Ordinary names are unchanged. Controls, OSC, and line breaks are not.
+ */
+export declare function mcpTerminalLabel(value: string): string;
 /** ACP/text-mode `/mcp` handler. Shared by both dispatchers via the spec. */
 export declare function handleMcpAcp(command: ParsedSlashCommand, runtime: SlashCommandRuntime): Promise<SlashCommandResult>;

package/dist/types/slash-commands/helpers/provider-auth-status.d.ts

@@ -0,0 +1,8 @@
+import type { ModelRegistry } from "../../config/model-registry";
+import type { AgentSession } from "../../session/agent-session";
+type ProviderAuthStatusSession = Pick<AgentSession, "credentialSessionId"> & {
+    modelRegistry: Pick<ModelRegistry, "authStorage" | "getAll" | "getAvailable" | "getConfiguredProviderIds" | "getAuthStorageOwner" | "getProviderConfigApiKeySources" | "getProviderRuntimeApiKeyEnvName" | "hasRuntimeProviderApiKey">;
+};
+/** Format credential provenance for `/provider status` without returning credential values. */
+export declare function buildProviderAuthStatusText(session: ProviderAuthStatusSession): Promise<string>;
+export {};

package/dist/types/ssh/ssh-executor.d.ts

@@ -1,4 +1,5 @@
 import { Settings } from "../config/settings";
+import { type TerminalArtifactPublisher } from "../session/streaming-output";
 import { type SSHConnectionTarget } from "./connection-manager";
 export interface SSHExecutorOptions {
     /** Session settings used for output policy. */
@@ -16,6 +17,8 @@ export interface SSHExecutorOptions {
     /** Artifact path/id for full output storage */
     artifactPath?: string;
     artifactId?: string;
+    /** Session-owned publisher for managed sessions without a writable artifact path. */
+    artifactPublisher?: TerminalArtifactPublisher;
 }
 export interface SSHResult {
     /** Combined stdout + stderr output (sanitized, possibly truncated) */
@@ -34,7 +37,11 @@ export interface SSHResult {
     outputLines: number;
     /** Number of bytes included in the output text */
     outputBytes: number;
-    /** Artifact ID if full output was saved to artifact storage */
+    /** Artifact ID if output was saved to artifact storage. */
     artifactId?: string;
+    /** Bytes omitted from artifact storage after its hard cap was reached. */
+    artifactTruncatedBytes?: number;
+    /** Bounded diagnostic when artifact storage failed. */
+    artifactFailureDiagnostic?: string;
 }
 export declare function executeSSH(host: SSHConnectionTarget, command: string, options?: SSHExecutorOptions): Promise<SSHResult>;

package/dist/types/system-prompt.d.ts

@@ -59,8 +59,9 @@ export declare function loadProjectContextFiles(options?: LoadContextFilesOption
     depth?: number;
 }>>;
 /**
- * Load the effective system prompt customization from SYSTEM.md.
- * Project-level SYSTEM.md overrides user-level SYSTEM.md.
+ * Load the user system prompt customization from SYSTEM.md.
+ * A repository SYSTEM.md is untrusted project text. It must not replace the
+ * user file or become the customization block.
  */
 export declare function loadSystemPromptFiles(options?: LoadContextFilesOptions): Promise<string | null>;
 export interface SystemPromptToolMetadata {