@gajae-code/coding-agent 0.18.11 → 0.19.0

package/dist/types/task/executor.d.ts

@@ -14,10 +14,12 @@ import { Settings } from "../config/settings";
 import { type Skill } from "../extensibility/skills";
 import type { HindsightSessionState } from "../hindsight/state";
 import type { LocalProtocolOptions } from "../internal-urls";
+import type { PlanModeState } from "../plan-mode/state";
 import { AgentRegistry } from "../registry/agent-registry";
 import type { ForkContextSeed } from "../session/agent-session";
 import { ArtifactManager } from "../session/artifacts";
 import type { AuthStorage } from "../session/auth-storage";
+import type { ClientBridge } from "../session/client-bridge";
 import { SessionManager, type SessionMemoryMode } from "../session/session-manager";
 import "../tools/yield";
 import type { ContextFileEntry } from "../tools";
@@ -109,6 +111,21 @@ export interface ExecutorOptions {
      * the same immutable child settings snapshot.
      */
     inheritedServiceTier?: ServiceTier;
+    /**
+     * Parent ACP/SDK approval mode. `deny` and `prompt` replace the child
+     * default (`allow`) before the first prompt. `allow` is that default.
+     */
+    sdkPermissionMode?: "prompt" | "allow" | "deny";
+    /**
+     * Parent plan-mode state. Copied onto the child before the first prompt so
+     * `enforcePlanModeWrite` still refuses product-file writes.
+     */
+    planModeState?: PlanModeState;
+    /**
+     * Parent client bridge. Only `requestPermission` is copied onto the child.
+     * Terminal, filesystem, and deferAgentInitiatedTurns stay on the parent.
+     */
+    clientBridge?: ClientBridge;
     /** Override local:// protocol options so subagent shares parent's local:// root */
     localProtocolOptions?: LocalProtocolOptions;
     /**
@@ -149,12 +166,12 @@ export interface ExecutorOptions {
 }
 export declare class ManagedTaskPersistence {
     #private;
-    constructor(artifacts: ArtifactManager, taskId: string);
+    constructor(artifacts: ArtifactManager, taskId: string, getArtifacts?: () => ArtifactManager);
     openSession(cwd: string, sessionMemoryMode?: SessionMemoryMode): Promise<SessionManager>;
     openStagedSession(attemptId?: string): Promise<SessionManager>;
     publishOutput(rawOutput: string, metadata: Uint8Array): Promise<void>;
 }
-export declare function createManagedTaskPersistence(artifacts: ArtifactManager, taskId: string): ManagedTaskPersistence;
+export declare function createManagedTaskPersistence(artifacts: ArtifactManager, taskId: string, getArtifacts?: () => ArtifactManager): ManagedTaskPersistence;
 export declare function renderSubagentUserPrompt(assignment: string, independentMode: boolean): string;
 export interface YieldItem {
     data?: unknown;

package/dist/types/task/role-body.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Keep a subagent role body inside the host [ROLE] block.
+ *
+ * The body is the agent instruction. It is inserted between host [ROLE] and
+ * [/ROLE]. A literal framing tag would end that block early. Only the four
+ * host framing names are rewritten; other brackets stay literal.
+ *
+ * One left-to-right scan: a gap run, a slash only when it is present, then
+ * one more gap run, then the word. A non-matching "[" does not hide a later tag.
+ */
+export declare function containSubagentRoleBody(body: string): string;

package/dist/types/tools/ast-edit-write-path.d.ts

@@ -11,3 +11,13 @@ export declare function canonicalizeAstEditWritePath(absolutePath: string): Prom
  * or a symlinked workspace), so an in-workspace real path is reattached to `cwd`.
  */
 export declare function resolveAstEditPreviewWritePaths(cwd: string, previewedPaths: readonly string[]): Promise<string[]>;
+/** Refusal prefix when a single-file real path leaves its reference root. */
+export declare const AST_EDIT_OUTSIDE_ROOT_MESSAGE = "AST edit target resolves outside its root";
+/**
+ * Native astEdit canonicalizes one file and writes that real path. Directory
+ * scans do not follow links. A lexical path inside cwd uses the real cwd as
+ * the reference root; an explicit path outside cwd uses its real parent, so a
+ * direct file there still applies. Returns the lexical path that would leave
+ * that root, if any.
+ */
+export declare function astEditSingleFileOutsideReferenceRoot(cwd: string, candidatePaths: readonly string[], signal?: AbortSignal): Promise<string | undefined>;

package/dist/types/tools/atomic-file-write.d.ts

@@ -25,10 +25,11 @@
  *
  * Destination symlinks are followed: the referent is replaced, the link stays.
  * The referent is re-resolved immediately before publication so a retargeted
- * link cannot silently repoint the write, and when the lexical destination
- * sits inside a session-scoped `gjc-local` root the resolved referent and its
- * parent must remain inside that root (a link there must not redirect the
- * write out of the trust boundary).
+ * link cannot silently repoint the write. When the lexical destination sits
+ * inside the active explicit artifacts local root (`<artifacts>/local`) or a
+ * session-scoped `gjc-local` root, the resolved referent and its parent must
+ * remain inside that root (a link there must not redirect the write out of
+ * the trust boundary).
  *
  * Staging uses exclusive create (`wx`) so a colliding leftover temp is never
  * truncated or unlinked; only the temp this call created is cleaned on failure.
@@ -57,9 +58,10 @@ export declare function formatFileWriteError(error: unknown, dest: string, optio
 export interface WriteFileAtomicallyOptions {
     /**
      * Trusted root that a resolved symlink referent and its parent must not
-     * leave. When omitted, the helper still enforces the session-scoped
-     * `gjc-local` boundary implied by a lexical destination under
-     * `<tmpdir>/gjc-local/<session-id>`.
+     * leave. When omitted, a destination inside the active explicit artifacts
+     * local root (`<artifacts>/local`) uses that root. Otherwise the helper
+     * still enforces the session-scoped `gjc-local` boundary implied by a
+     * lexical destination under `<tmpdir>/gjc-local/<session-id>`.
      */
     trustBoundary?: string;
     /** Platform override used by deterministic retry tests. */

package/dist/types/tools/awaiting-input.d.ts

@@ -0,0 +1,28 @@
+export type AwaitingInputKind = "browser_auth" | "device_code";
+export interface AwaitingInputSignal {
+    kind: AwaitingInputKind;
+    /** Epoch milliseconds when the quiet window elapsed after the match. */
+    detectedAt: number;
+}
+/** Cancels a scheduled callback. */
+export type CancelScheduled = () => void;
+export interface AwaitingInputDetectorOptions {
+    onDetect: (signal: AwaitingInputSignal) => void;
+    /** Quiet window after a match before the signal fires. */
+    quietMs?: number;
+    /** Injectable scheduler; defaults to `setTimeout`. */
+    schedule?: (callback: () => void, ms: number) => CancelScheduled;
+    /** Injectable clock; defaults to `Date.now`. */
+    now?: () => number;
+}
+export declare const AWAITING_INPUT_QUIET_MS = 3000;
+/** Classify an output tail; `undefined` when it does not look like an auth prompt. */
+export declare function classifyAwaitingInput(tail: string): AwaitingInputKind | undefined;
+export declare class AwaitingInputDetector {
+    #private;
+    constructor(options: AwaitingInputDetectorOptions);
+    /** Feed one streamed output chunk. Any new output restarts the quiet window. */
+    push(chunk: string): void;
+    /** Stop watching; the command exited or was folded. Never fires afterwards. */
+    dispose(): void;
+}

package/dist/types/tools/bash-allowed-prefixes.d.ts

@@ -3,8 +3,25 @@ export interface BashAllowedPrefixesCheck {
     reason?: string;
 }
 export type BashRestrictionProfile = "workflow" | "read-only";
+/** Session identities and workspace the restricted `gjc` command may name. */
+export interface GjcSessionBinding {
+    sessionId?: string | null;
+    /** Owner identity already on the tool session. Role-agent ralplan writes use it. */
+    credentialSessionId?: string | null;
+    /** Session workspace. A `--worktree-root` must be this repo, not a foreign one. */
+    worktreeRoot: string;
+    /** Child cwd. Relative `--worktree-root` resolves against it, as ralplan does. */
+    invocationCwd: string;
+}
 export interface BashRestrictionOptions {
     profile?: BashRestrictionProfile;
+    gjcSessionBinding?: GjcSessionBinding;
 }
+/**
+ * Workflow restricted bash keeps the lexical prefix check, then runs the resolved
+ * executable. Callers also skip the shell snapshot and shell prefix, because a
+ * snapshot function can be named for that absolute path.
+ */
+export declare function normalizeWorkflowBashCommand(command: string, allowedPrefixes: readonly string[] | undefined, options?: BashRestrictionOptions): string | undefined;
 export declare function normalizeReadOnlyBashCommand(command: string): string | undefined;
 export declare function checkBashAllowedPrefixes(command: string, allowedPrefixes: readonly string[] | undefined, options?: BashRestrictionOptions): BashAllowedPrefixesCheck;

package/dist/types/tools/bash-skill-urls.d.ts

@@ -16,6 +16,10 @@ export interface InternalUrlExpansionOptions {
  * Resolve a single skill:// URL to its absolute filesystem path.
  * Does NOT read file content or verify existence.
  */
+export declare function resolveSkillUrl(url: string, skills: readonly Skill[]): {
+    skill: Skill;
+    lexicalPath: string;
+};
 export declare function resolveSkillUrlToPath(url: string, skills: readonly Skill[]): string;
 /**
  * Expand all skill:// URIs in a bash command string.

package/dist/types/tools/bash.d.ts

@@ -7,6 +7,7 @@ import type { RenderResultOptions } from "../extensibility/custom-tools/types";
 import { type Theme } from "../modes/theme/theme";
 import { type SdkSpawnArgs } from "../sdk/cli/master-cli";
 import type { ToolSession } from ".";
+import { type AwaitingInputSignal } from "./awaiting-input";
 import { type OutputMeta } from "./output-meta";
 export { STEER_FOLD_GRACE_MS, steerFoldReasonLine } from "./steer-fold";
 export declare const BASH_DEFAULT_PREVIEW_LINES = 10;
@@ -91,6 +92,12 @@ export interface BashToolDetails {
     foldReason?: FoldReason;
     /** The accepted model-declared activity declaration, when the call carried one. */
     activity?: BashActivityDeclaration;
+    /**
+     * Set on a running (partial) update when the foreground command printed an
+     * interactive auth prompt and then went quiet. Carries only the prompt kind,
+     * never the URL or code.
+     */
+    awaitingInput?: AwaitingInputSignal;
     async?: {
         state: "running" | "completed" | "failed";
         jobId: string;

package/dist/types/tools/descriptors.d.ts

@@ -55,8 +55,16 @@ export declare class LazyAgentTool implements AgentTool<any, any, any> {
     #private;
     readonly descriptor: ToolDescriptor;
     constructor(descriptor: ToolDescriptor, materialized?: AgentTool<any, any, any>, loader?: () => ToolDescriptorLoadResult, session?: ToolSession);
-    /** Materialize this facade for contract tests without exposing it in production dispatch. */
-    materializeForTests(): Promise<AgentTool<any, any, any>>;
+    /** Clear a session-bound materialization after its owning session moves. */
+    invalidateForSessionMove(expectedCwd?: string): void;
+    /**
+     * Resolve the underlying implementation. Pre-dispatch hooks (TTSR `astCondition`
+     * matching) call this to read implementation-only members such as the matcher
+     * hooks before the first `execute` would otherwise load the tool.
+     * An arrow property (like `execute`) so session guard proxies can forward it
+     * without losing access to the private loader state.
+     */
+    readonly materialize: () => Promise<AgentTool<any, any, any>>;
     get name(): string;
     get description(): string;
     get parameters(): TSchema;
@@ -86,6 +94,11 @@ export declare class LazyAgentTool implements AgentTool<any, any, any> {
     get mergeCallAndResult(): boolean | undefined;
     get inline(): boolean | undefined;
     get mode(): any;
+    get matcherDigest(): ((args: unknown) => string | undefined) | undefined;
+    get matcherEntries(): ((args: unknown) => readonly {
+        path: string;
+        digest: string;
+    }[] | undefined) | undefined;
     readonly execute: AgentTool<any, any, any>["execute"];
 }
 export type EffectiveToolDiscoveryMode = "off" | "mcp-only" | "all";

package/dist/types/tools/fetch.d.ts

@@ -31,7 +31,7 @@ type FetchRenderResult = RenderResult & {
 /**
  * Try all special handlers
  */
-declare function handleSpecialUrls(url: string, timeout: number, signal: AbortSignal | undefined, storage: AgentStorage | null): Promise<FetchRenderResult | null>;
+declare function handleSpecialUrls(url: string, timeout: number, signal: AbortSignal | undefined, storage: AgentStorage | null, settings: Settings): Promise<FetchRenderResult | null>;
 /** Test-only seam for verifying lazy special-handler loading and dispatch. */
 export declare const fetchSpecialHandlerTestHooks: {
     dispatch: typeof handleSpecialUrls;
@@ -74,6 +74,12 @@ export declare const readUrlCacheTestHooks: {
     readonly retainedOutputChars: number;
     reset(): void;
 };
+/**
+ * Publish text at an explicit artifact path the way `ArtifactManager.save` does:
+ * a temp file opened with `O_NOFOLLOW` and mode 0600, then rename. A symlink is
+ * not followed. A pre-existing regular file is replaced, so mode 0644 is not kept.
+ */
+export declare function publishExplicitArtifactText(destination: string, text: string): Promise<void>;
 export declare function loadReadUrlCacheEntry(session: ToolSession, params: {
     path: string;
     raw?: boolean;

package/dist/types/tools/index.d.ts

@@ -317,6 +317,8 @@ export interface ToolSession {
         from: string;
         to: string;
     }>;
+    /** Live ACP/SDK approval mode. Task children copy this at spawn; absent means `allow`. */
+    getSdkPermissionMode?: () => "prompt" | "allow" | "deny";
     /** Bridge to the connected client (e.g. ACP editor host). Tools should route fs/terminal/permission requests through this when available. */
     getClientBridge?: () => ClientBridge | undefined;
     /** Get compact conversation context for subagents (excludes tool results, system prompts) */

package/dist/types/tools/irc.d.ts

@@ -9,9 +9,11 @@
  * mirrors `/btw`: the recipient's current model, system prompt, and message
  * history are used to compute a reply without persisting it through the
  * normal stream path. After the reply is generated, both the incoming
- * message and the auto-reply are queued for injection into the recipient's
- * persisted history (deferred until the recipient is idle), so the model
- * sees the exchange on its next turn.
+ * message and the auto-reply are injected into the recipient's persisted
+ * history: an idle recipient gets them immediately, while a streaming recipient
+ * receives them at its next step boundary (the live run's next tool boundary)
+ * rather than at the end of its turn — an exchange admitted into a run that ends
+ * before that boundary is still appended to the outgoing session's history.
  *
  * This avoids the deadlock that arises when the recipient is blocked on a
  * long-running tool call: the side-channel call does not depend on the

package/dist/types/tools/python.d.ts

@@ -14,7 +14,7 @@ export interface SessionPythonToolInput {
     /** Resolve the GJC session id used for the kernel owner and transcript paths. */
     getSessionId: () => string | null;
     /** Register cleanup with the current logical session lifecycle. */
-    registerSessionCleanup: (cleanup: () => Promise<void> | void) => (() => void) | void;
+    registerSessionCleanup: (cleanup: () => Promise<void> | void) => (() => void) | undefined;
     /** Reject execution after the owning session has begun disposal. */
     assertEvalExecutionAllowed?: () => void;
     /** Track this whole invocation through its transcript append. */

package/dist/types/tools/report-issue.d.ts

@@ -0,0 +1,41 @@
+import type { AgentTool, AgentToolResult } from "@gajae-code/agent-core";
+import * as z from "zod/v4";
+import type { ToolSession } from "./index";
+declare const reportIssueSchema: z.ZodObject<{
+    tool: z.ZodString;
+    report: z.ZodString;
+}, z.core.$strip>;
+export type ReportIssueToolInput = z.infer<typeof reportIssueSchema>;
+export interface ReportIssueToolDetails {
+    recorded: boolean;
+    tool: string;
+}
+export interface ToolIssueEntry {
+    tool: string;
+    report: string;
+    model: string | null;
+    sessionId: string | null;
+}
+/** Normalize and clamp a report to the stored field limits. */
+export declare function normalizeToolIssue(tool: string, report: string): {
+    tool: string;
+    report: string;
+};
+/** Append one report to the tool-issue database at `dbPath`. */
+export declare function recordToolIssue(dbPath: string, entry: ToolIssueEntry): Promise<void>;
+export declare class ReportIssueTool implements AgentTool<typeof reportIssueSchema, ReportIssueToolDetails> {
+    #private;
+    readonly name = "report_issue";
+    readonly label = "Report Issue";
+    readonly loadMode: "essential";
+    readonly description: string;
+    readonly parameters: z.ZodObject<{
+        tool: z.ZodString;
+        report: z.ZodString;
+    }, z.core.$strip>;
+    readonly strict = true;
+    readonly intent: "omit";
+    constructor(session: ToolSession, dbPath?: string);
+    execute(_toolCallId: string, params: ReportIssueToolInput): Promise<AgentToolResult<ReportIssueToolDetails>>;
+}
+export {};

package/dist/types/tools/subagent.d.ts

@@ -178,4 +178,27 @@ export declare function capCodePointsAndBytes(text: string, maxCodePoints: numbe
 /** Shared cadence for await progress refreshes and rendered last-activity age. */
 export declare const SUBAGENT_ACTIVITY_BUCKET_MS = 5000;
 export declare function subagentAwaitRenderedStateSignature(subagents: readonly SubagentSnapshot[], receipt?: Pick<SubagentToolDetails, "awaitOutcome" | "interrupted">): string;
+/** A running subagent with no activity for longer than this counts as idle in the compact panel. */
+export declare const SUBAGENT_COMPACT_IDLE_MS = 30000;
+/** Group counts behind the compact await panel's single summary line. */
+export interface SubagentGroupSummary {
+    running: number;
+    idle: number;
+    retrying: number;
+    queued: number;
+    paused: number;
+    completed: number;
+    failed: number;
+    cancelled: number;
+    /** Running subagents in provider retry, per provider; drives the degradation warning. */
+    retryingByProvider: Record<string, number>;
+}
+export declare function summarizeSubagentGroup(subagents: readonly SubagentSnapshot[], nowMs: number): SubagentGroupSummary;
+/**
+ * Rendered-state signature for the compact await panel. It covers only what the
+ * compact view shows (group counts and the single degradation row), so per-subagent activity that does not move
+ * a count no longer re-emits: the update rate is bounded by count transitions and
+ * the liveness interval instead of growing with the number of live subagents.
+ */
+export declare function subagentCompactRenderedStateSignature(subagents: readonly SubagentSnapshot[], nowMs: number, receipt?: Pick<SubagentToolDetails, "awaitOutcome" | "interrupted">): string;
 export {};

package/dist/types/tools/tmux-self-injection-guard.d.ts

@@ -10,6 +10,8 @@ export type TmuxPaneResolver = (options: {
 export interface TmuxSelfInjectionOptions {
     env?: Record<string, string | undefined>;
     cwd?: string;
+    /** Effective Bash environment for locating shell-runner scripts; never used for tmux identity. */
+    executionEnv?: Record<string, string | undefined>;
     resolvePaneId?: TmuxPaneResolver;
 }
 export declare function checkTmuxSelfInjection(command: string, options?: TmuxSelfInjectionOptions, depth?: number): Promise<TmuxSelfInjectionResult>;

package/dist/types/tools/ultragoal-ask-guard.d.ts

@@ -11,5 +11,5 @@ export interface UltragoalAskGuardContext {
     sessionId?: string | null;
 }
 export declare function formatUltragoalAskBlockMessage(diagnostic: UltragoalAskBlockDiagnostic): string;
-export declare function assertUltragoalAskAllowed(cwd: string, context?: UltragoalAskGuardContext, agentDir?: string): Promise<void>;
+export declare function assertUltragoalAskAllowed(cwd: string, context?: UltragoalAskGuardContext, agentDir?: string, pendingQuestions?: unknown): Promise<void>;
 export declare function guardToolForUltragoalAsk<T extends AgentTool>(tool: T, getCwd: () => string, getContext?: () => UltragoalAskGuardContext, getSessionAgentDir?: () => string | undefined): T;

package/dist/types/tools/write.d.ts

@@ -37,6 +37,8 @@ export declare class WriteTool implements AgentTool<typeof writeSchema, WriteToo
     readonly concurrency = "exclusive";
     readonly loadMode = "discoverable";
     readonly summary = "Write content to a file (creates or overwrites)";
+    /** Stream matchers should see the real file content, not its JSON-escaped argument encoding. */
+    matcherDigest(args: unknown): string | undefined;
     constructor(session: ToolSession);
     execute(_toolCallId: string, { path, content }: WriteParams, signal?: AbortSignal, _onUpdate?: AgentToolUpdateCallback<WriteToolDetails>, context?: AgentToolContext): Promise<AgentToolResult<WriteToolDetails>>;
 }

package/dist/types/utils/file-mentions.d.ts

@@ -7,6 +7,11 @@ import type { AgentMessage } from "@gajae-code/agent-core";
 export declare const DEFAULT_FILE_MENTION_INLINE_BYTES: number;
 /** Extract all @filepath mentions from text */
 export declare function extractFileMentions(text: string): string[];
+/**
+ * Compare canonical Windows paths without folding directory names: individual
+ * directories can opt into case-sensitive names.
+ */
+export declare function isCanonicalWindowsPathWithin(root: string, candidate: string): boolean;
 /**
  * Generate a FileMentionMessage containing the contents of mentioned files.
  * Returns empty array if no files could be read.

package/dist/types/utils/image-limits.d.ts

@@ -0,0 +1,7 @@
+export declare const MAX_IMAGE_INPUT_BYTES: number;
+export declare const MAX_STAGED_PROMPT_IMAGES = 16;
+export declare const MAX_PASTED_IMAGE_SOURCE_BYTES: number;
+export declare const MAX_PASTED_IMAGE_OUTPUT_BYTES: number;
+export declare const MAX_PASTED_IMAGE_DIMENSION = 20000;
+export declare const MAX_PASTED_IMAGE_PIXELS = 40000000;
+export declare const MAX_PASTED_IMAGE_DECODED_BYTES: number;

package/dist/types/utils/image-loading.d.ts

@@ -1,5 +1,4 @@
 import type { ImageContent } from "@gajae-code/ai/core";
-export declare const MAX_IMAGE_INPUT_BYTES: number;
 export declare const SUPPORTED_INPUT_IMAGE_MIME_TYPES: Set<string>;
 export declare function rasterizeSvgInputBytes(inputBuffer: Uint8Array): Promise<Uint8Array>;
 export interface LoadImageInputOptions {

package/dist/types/utils/open.d.ts

@@ -1,2 +1 @@
-/** Open a URL or file path in the default browser/application. Best-effort, never throws. */
 export declare function openPath(urlOrPath: string): void;

package/dist/types/utils/pasted-image-loading.d.ts

@@ -1,10 +1,5 @@
 import type { ImageContent } from "@gajae-code/ai/core";
 import { type LoadedImageInput, transformImageInputBytes } from "./image-loading";
-export declare const MAX_PASTED_IMAGE_SOURCE_BYTES: number;
-export declare const MAX_PASTED_IMAGE_OUTPUT_BYTES: number;
-export declare const MAX_PASTED_IMAGE_DIMENSION = 20000;
-export declare const MAX_PASTED_IMAGE_PIXELS = 40000000;
-export declare const MAX_PASTED_IMAGE_DECODED_BYTES: number;
 export type PastedImageBatchErrorCode = "too-many" | "unsafe-path" | "unsupported-image" | "source-aggregate-too-large" | "output-aggregate-too-large" | "dimensions-too-large";
 export declare class PastedImageBatchError extends Error {
     readonly code: PastedImageBatchErrorCode;
@@ -23,6 +18,7 @@ export interface PastedImageLoadingDependencies {
     transformImageBytes?: typeof transformImageInputBytes;
 }
 export type PastedImageSourcePolicy = "confirmed" | "automatic-temp";
+export declare function isAnimatedImage(bytes: Buffer, mimeType: string): boolean | undefined;
 export interface LoadPastedImageBatchOptions {
     paths: readonly string[];
     autoResize: boolean;

package/dist/types/utils/prompt-suggestion.d.ts

@@ -1,6 +1,6 @@
 /**
- * Predict the user's likely next prompt after an agent turn using a smol,
- * fast model. Native GJC port of the ghost-text prompt-suggestion behavior
+ * Predict the user's likely next prompt after an agent turn with the `default`
+ * model role. Native GJC port of the ghost-text prompt-suggestion behavior
  * from Claude Code: the prediction renders as dim ghost text in the empty
  * composer and Tab accepts it.
  */

package/dist/types/utils/shell-snapshot.d.ts

@@ -1,3 +1,5 @@
+/** One POSIX shell word. Double quotes would still run `$()` and backticks. */
+export declare function quotePosixShell(value: string): string;
 interface ShellSnapshotCacheOptions {
     tempRoot: string;
     home: string | (() => string);

package/dist/types/utils/title-generator.d.ts

@@ -6,8 +6,17 @@ import type { Settings } from "../config/settings";
  * Build a bounded conversation digest for title regeneration. Regeneration
  * reads several messages so a throwaway first prompt can be corrected, while
  * the automatic first-message path intentionally uses only its initial input.
+ * `obfuscateText`, when set, runs on each kept message's full text before the
+ * per-message character cut so a secret cannot be split by that cut.
  */
-export declare function buildConversationTitleInput(messages: readonly AgentMessage[]): string | undefined;
+export declare function buildConversationTitleInput(messages: readonly AgentMessage[], obfuscateText?: (text: string) => string): string | undefined;
+/**
+ * Obfuscate the full title input, then truncate, then wrap.
+ * A secret that crosses the character cap is replaced before the cut, and the
+ * `<user-message>` fence stays outside the truncated body.
+ */
+export declare function prepareTitleOutboundText(firstMessage: string, obfuscateText?: (text: string) => string): string;
+export declare function titleInputObfuscator(settings: Settings, activeCwd?: string): Promise<((text: string) => string) | undefined>;
 /**
  * Generate a title for a session based on the provided user-message input.
  * Automatic titles pass the first user message; regeneration passes a bounded
@@ -15,15 +24,16 @@ export declare function buildConversationTitleInput(messages: readonly AgentMess
  *
  * @param firstMessage The first user message or bounded conversation digest
  * @param registry Model registry
- * @param settings Settings used to resolve the smol role
+ * @param settings Settings used to resolve the `default` model role
  * @param sessionId Optional session id for sticky API key selection
  * @param currentModel Current model (used to derive title model)
  * @param metadataResolver Optional resolver evaluated after credential selection
  *   to produce request metadata (e.g. user_id for session attribution). Using a
  *   resolver instead of a pre-evaluated value ensures the metadata's account_uuid
  *   reflects the credential actually selected for this request.
+ * @param activeCwd Active session cwd for project-scoped secret lookup.
  */
-export declare function generateSessionTitle(firstMessage: string, registry: ModelRegistry, settings: Settings, sessionId?: string, currentModel?: Model<Api>, metadataResolver?: (provider: string) => Record<string, unknown> | undefined): Promise<string | null>;
+export declare function generateSessionTitle(firstMessage: string, registry: ModelRegistry, settings: Settings, sessionId?: string, currentModel?: Model<Api>, metadataResolver?: (provider: string) => Record<string, unknown> | undefined, activeCwd?: string): Promise<string | null>;
 export declare function formatSessionTerminalTitle(sessionName: string | undefined, cwd?: string): string;
 /**
  * Set the terminal title using OSC 0 (sets both tab and window title). Unsupported terminals ignore it.

package/dist/types/web/scrapers/types.d.ts

@@ -1,3 +1,4 @@
+import type { Settings } from "../../config/settings";
 import type { AgentStorage } from "../../session/agent-storage";
 import type { AddressResolver } from "../insane/url-guard";
 export { formatNumber } from "@gajae-code/utils";
@@ -11,7 +12,13 @@ export interface RenderResult {
     truncated: boolean;
     notes: string[];
 }
-export type SpecialHandler = (url: string, timeout: number, signal?: AbortSignal, storage?: AgentStorage | null) => Promise<RenderResult | null>;
+/**
+ * `settings` is the caller's session settings. Handlers must read through it
+ * rather than the process-global singleton: the SDK/ACP host path runs tools
+ * without ever calling `Settings.init()`, where a global read throws
+ * "Settings not initialized" instead of scraping the page.
+ */
+export type SpecialHandler = (url: string, timeout: number, signal?: AbortSignal, storage?: AgentStorage | null, settings?: Settings) => Promise<RenderResult | null>;
 export declare const MAX_OUTPUT_CHARS = 500000;
 export declare const MAX_BYTES: number;
 /**

package/dist/types/web/search/providers/codex.d.ts

@@ -1,4 +1,4 @@
-import { type AuthStorage } from "@gajae-code/ai/core";
+import type { AuthStorage } from "@gajae-code/ai/core";
 import type { SearchResponse } from "../../../web/search/types";
 import type { SearchParams } from "./base";
 import { SearchProvider } from "./base";
@@ -14,12 +14,11 @@ export interface CodexSearchParams {
  * Executes a web search using OpenAI code provider's built-in web search tool.
  *
  * Default-model behavior:
- * - If `PI_CODEX_WEB_SEARCH_MODEL` is set, use it exactly once and surface any
- *   upstream error verbatim.
- * - Otherwise prefer ChatGPT-account-safe bundled defaults (GPT-5.5, GPT-5.4,
- *   GPT-5 code backend, …) and retry the next candidate only when OpenAI code backend returns the
- *   known 400 "model is not supported" family. This avoids selecting
- *   `gpt-5-codex-mini` first on ChatGPT accounts, which OpenAI rejects.
+ * - Use `GJC_OPENAI_CODE_WEB_SEARCH_MODEL` (then `PI_CODEX_WEB_SEARCH_MODEL`)
+ *   exactly once when configured and surface upstream errors without model retries.
+ * - Otherwise intersect current account discovery with GPT-6.1 Sol, then GPT-6 Luna.
+ *   Fail closed when discovery is unavailable or neither candidate is advertised.
+ *   Retry the next advertised candidate only for the known unsupported-model 400 family.
  */
 export declare function searchCodex(params: SearchParams): Promise<SearchResponse>;
 /**

package/dist/types/web/search/providers/insane.d.ts

@@ -12,6 +12,7 @@
  */
 import type { AuthStorage } from "@gajae-code/ai/core";
 import type { SearchResponse, SearchSource } from "../../../web/search/types";
+import type { AddressResolver } from "../../insane/url-guard";
 import type { SearchParams } from "./base";
 import { SearchProvider } from "./base";
 export interface InsaneRouteAttempt {
@@ -35,13 +36,18 @@ interface RouteFailure {
     attempts: InsaneRouteAttempt[];
 }
 type RouteResult = RouteSuccess | RouteFailure | null;
-export declare function routeInsanePublicUrl(rawUrl: string, signal?: AbortSignal): Promise<RouteResult>;
+export declare function routeInsanePublicUrl(rawUrl: string, signal?: AbortSignal, resolverOption?: {
+    resolver?: AddressResolver;
+}): Promise<RouteResult>;
 /** Execute safe Insane Search public-route discovery. */
 export declare function searchInsane(params: {
     query: string;
     num_results?: number;
     recency?: "day" | "week" | "month" | "year";
     signal?: AbortSignal;
+    resolverOption?: {
+        resolver?: AddressResolver;
+    };
 }): Promise<SearchResponse>;
 /** Keyless provider that ports safe upstream public-route fallbacks only. */
 export declare class InsaneProvider extends SearchProvider {

package/dist/types/web/search/providers/searxng.d.ts

@@ -22,6 +22,11 @@
  *   SEARXNG_BASIC_USERNAME - Optional RFC 7617 Basic auth username
  *   SEARXNG_BASIC_PASSWORD - Optional RFC 7617 Basic auth password
  *
+ * A project settings endpoint must not receive a credential that exists only in
+ * the operator environment. The project file can still authenticate with a
+ * credential it sets itself, and an operator endpoint still receives an
+ * operator environment credential.
+ *
  * Reference: https://docs.searxng.org/dev/search_api.html
  */
 import type { AuthStorage } from "@gajae-code/ai/core";