@gajae-code/coding-agent 0.18.12 → 0.19.0

package/dist/types/modes/components/model-selector.d.ts

@@ -5,10 +5,53 @@ import { type AutoroutingSetup } from "../../config/autorouting-contract";
 import type { GjcModelAssignmentTargetId, ModelRegistry } from "../../config/model-registry";
 import { type ScopedModelSelection } from "../../config/model-resolver";
 import type { ModelProfileConfig } from "../../config/models-config-schema";
+import { type ProviderAuthState } from "../../config/provider-ranking";
 import type { Settings } from "../../config/settings";
 import type { SmartRoutingIntent, SmartRoutingPreview } from "./smart-routing-panel";
 import { SmartRoutingPanelComponent } from "./smart-routing-panel";
+export declare function assignFuzzyScoresToModels(items: ModelItem[], query: string): void;
+/**
+ * Compute and assign fuzzy scores to canonical model items based on a query.
+ */
+export declare function assignFuzzyScoresToCanonicalModels(items: CanonicalModelItem[], query: string): void;
+export interface RankedModelOrderContext {
+    roles: RoleAssignments;
+    mruIndex: ReadonlyMap<string, number>;
+    providerAuthStateById: ReadonlyMap<string, ProviderAuthState>;
+}
+/** Ranking shared by the provider view: fuzzy quality, default, MRU, provider, recency. */
+export declare function compareModelItemsForRanking(a: ModelItem, b: ModelItem, context: RankedModelOrderContext): number;
+/** Ranking shared by the canonical view: fuzzy quality, default, MRU, provider, then id. */
+export declare function compareCanonicalModelItemsForRanking(a: CanonicalModelItem, b: CanonicalModelItem, context: RankedModelOrderContext): number;
+interface ModelItem {
+    kind: "provider";
+    provider: string;
+    id: string;
+    model: Model;
+    selector: string;
+    thinkingLevel?: ThinkingLevel;
+    explicitThinkingLevel?: boolean;
+    fuzzyScore?: number;
+}
+interface CanonicalModelItem {
+    kind: "canonical";
+    id: string;
+    model: Model;
+    selector: string;
+    variantCount: number;
+    searchText: string;
+    normalizedSearchText: string;
+    compactSearchText: string;
+    thinkingLevel?: ThinkingLevel;
+    explicitThinkingLevel?: boolean;
+    fuzzyScore?: number;
+}
 type ScopedModelItem = ScopedModelSelection;
+interface RoleAssignment {
+    model: Model;
+    thinkingLevel: ThinkingLevel;
+}
+type RoleAssignments = Record<string, RoleAssignment | undefined>;
 export type ModelSelectorSelection = {
     kind: "assignment";
     model: Model;

package/dist/types/modes/prompt-suggestion-controller.d.ts

@@ -3,7 +3,7 @@ import type { InteractiveModeContext } from "./types";
  * Owns the ghost-text next-prompt prediction lifecycle for interactive mode.
  *
  * After each agent turn ends (and only when `promptSuggestions` is enabled
- * and the composer is empty), a smol-model prediction of the user's next
+ * and the composer is empty), a model prediction of the user's next
  * prompt is generated in the background. The result renders as dim ghost
  * text in the empty composer via the autocomplete provider's inline hint;
  * Tab accepts it, typing dismisses it, and a new turn clears it.

package/dist/types/modes/utils/host-status.d.ts

@@ -1,23 +1,27 @@
 /**
  * Host-terminal agent status markers.
  *
- * Interactive turns announce their state as an OSC 777 sequence:
+ * Interactive turns can announce their state as an OSC 777 sequence:
  *
  *     ESC ] 777 ; notify;Terax;gjc;<event> BEL
  *
- * A terminal that understands the sequence (Terax reads it to drive its per-tab
- * agent status and header bell) reacts; every other terminal discards the OSC
- * as unknown, exactly like the OSC 133 prompt marks and OSC 7 cwd reports that
- * shells emit unconditionally. So there is no host sniffing and no env gate:
- * any host that wants agent status can parse the stream without gjc knowing it
- * exists.
+ * OSC 777 is the rxvt `notify` extension, not a private sequence: a terminal
+ * that implements it does not discard the payload, it raises a desktop
+ * notification. Ghostty parses `777;notify` in `osc/parsers/rxvt_extension.zig`
+ * and maps it to `show_desktop_notification`, so emitting it unconditionally
+ * made every turn pop notifications titled `Terax` in Ghostty and cmux.
  *
- * `notify;Terax;` is the wire identifier of the only protocol that currently
- * carries per-turn agent state, not a host check - the payload names gjc as the
- * reporting agent.
+ * Emission is therefore opt-in. A host that wants per-turn agent status exports
+ * `GJC_HOST_STATUS=terax` from its shell integration; every other host gets no
+ * escape sequence at all. `notify;Terax;` is the wire identifier of that
+ * protocol, and gjc is still named in the payload as the reporting agent.
  *
  * Interactive TUI only. Print and RPC mode stdout stays byte-for-byte parseable
  * because they never reach these controllers.
  */
 export type HostStatusEvent = "working" | "attention" | "finished";
-export declare function emitHostStatus(event: HostStatusEvent, output?: Pick<NodeJS.WriteStream, "write">): void;
+/** The host marker value that opts a terminal into agent-status markers. */
+export declare const HOST_STATUS_MARKER_ENV = "GJC_HOST_STATUS";
+/** Whether the current host opted in to agent-status markers. */
+export declare function hostStatusEnabled(env?: NodeJS.ProcessEnv): boolean;
+export declare function emitHostStatus(event: HostStatusEvent, output?: Pick<NodeJS.WriteStream, "write">, env?: NodeJS.ProcessEnv): void;

package/dist/types/runtime-mcp/project-host-values.d.ts

@@ -2,14 +2,20 @@
  * Host-value policy for MCP config that comes from an untrusted project file.
  *
  * User mcp.json and an explicit `--mcp-config` file may still substitute
- * secret-named environment variables and run `!` shell commands. A project
- * file (native `.gjc/mcp.json` or a repo-root `mcp.json`) uses the same
- * sensitive-name rule as project `ssh.json`: do not copy those host values
- * into server env or headers, and do not execute `!`.
+ * secret-named environment variables and run `!` shell commands. Any
+ * project-level source, including providers other than native `.gjc/mcp.json`
+ * and repo-root `mcp.json`, uses the same sensitive-name rule as project
+ * `ssh.json`: do not copy those host values into server env or headers, and
+ * do not execute `!`.
  */
 import type { SourceMeta } from "../capability/types";
 export declare function nativeMcpSource(level: "user" | "project", filePath: string): SourceMeta;
-/** True when this server was loaded from untrusted project MCP config. */
+/**
+ * True when this server was loaded from untrusted project MCP config.
+ * Every project-level provider is untrusted, including providers other than
+ * native `.gjc/mcp.json` and repo-root `mcp.json`. User scope and a tools-only
+ * load stay on the previous path.
+ */
 export declare function isUntrustedProjectMcpSource(source: SourceMeta | undefined, toolsOnly: boolean): boolean;
 export type ProjectHostValueDecision = {
     action: "resolve";

package/dist/types/sdk/broker/broker-exit.d.ts

@@ -4,7 +4,7 @@ export type { BrokerExitWriterTestBarrier } from "./broker-exit-writer-worker";
 export declare function setBrokerExitWriterBarrierForTest(barrier?: BrokerExitWriterTestBarrier): void;
 export type BrokerExitMode = "owned-root" | "lost-root";
 export type BrokerFenceReason = "suspect-unpublished" | "observation-ambiguous" | "heartbeat-ambiguous";
-export type BrokerExitReason = "ownership-fence-expired" | "publication-liveness-timeout" | "heartbeat-renewal-blocked" | "restart-committed" | "shutdown-request" | "startup-failure" | "signal";
+export type BrokerExitReason = "ownership-fence-expired" | "publication-liveness-timeout" | "heartbeat-renewal-blocked" | "restart-committed" | "shutdown-request" | "startup-failure" | "abandoned" | "signal";
 export type BrokerStopRequest = {
     kind: "shutdown-request";
 } | {

package/dist/types/sdk/broker/broker.d.ts

@@ -26,6 +26,21 @@ export interface BrokerSettings {
     masterCapabilityVerifier?: MasterCapabilityVerifier;
     /** Grace before an orphaned spawn child closes; schema-bounded in production. */
     masterOrphanGraceMs?: number;
+    /**
+     * Grace before a broker nobody is left to use exits on its own. The clock only
+     * runs while the index proves no live session host and no open spawn authority,
+     * so a broker whose client died without closing exits instead of holding its
+     * port, its publication, and its lock for the life of the machine.
+     */
+    abandonedGraceMs?: number;
+    /**
+     * Whether this broker may end itself once nobody is left to use it. Only the
+     * detached autostart entry point enables this: an operator-supervised
+     * `gjc sdk broker run` service owns its own lifetime, and its supervisor reads an
+     * owned-root completion as a clean exit, so self-reaping would quietly retire a
+     * service that was meant to keep serving.
+     */
+    reapWhenAbandoned?: boolean;
     /** Host model resolver override for lifecycle tests and embedders. */
     resolveModelPin?: SdkHostModelResolver;
     /**
@@ -62,10 +77,12 @@ type ResolvedBrokerSettings = {
     spawnSubstrateProvider?: SpawnSubstrateProvider;
     spawnPromptLayer?: SpawnPromptLayer;
     masterOrphanGraceMs: number;
+    abandonedGraceMs: number;
+    reapWhenAbandoned: boolean;
     restartRequestId?: string;
 };
 export declare function resolveBrokerPackageGeneration(): string;
-export type BrokerErrorCode = "idempotency_conflict" | "terminal_uncertain" | "broker_restarting" | "unavailable" | "endpoint_stale" | "resource_gone" | "invalid_input" | "spawn_failed" | "ready_then_exited" | "endpoint_unreadable" | "startup_admission_timeout" | "startup_admission_refused" | "readiness_timeout" | "worktree_preparation_timeout" | "dependency_preparation_timeout" | "worktree_in_use" | "incarnation_unavailable" | "close_refused" | "not_found" | "live_session" | "cleanup_pending" | (string & {});
+export type BrokerErrorCode = "idempotency_conflict" | "legacy_lifecycle_ambiguous" | "terminal_uncertain" | "broker_restarting" | "unavailable" | "endpoint_stale" | "resource_gone" | "invalid_input" | "spawn_failed" | "ready_then_exited" | "endpoint_unreadable" | "startup_admission_timeout" | "startup_admission_refused" | "readiness_timeout" | "worktree_preparation_timeout" | "dependency_preparation_timeout" | "worktree_in_use" | "incarnation_unavailable" | "close_refused" | "not_found" | "live_session" | "cleanup_pending" | (string & {});
 export type BrokerCleanupIdentity = {
     dev: string;
     ino: string;
@@ -373,6 +390,8 @@ export declare class Broker {
     runStartup<T>(queueWaitMs: number, timing: StartupAdmissionTiming, task: (admittedAt: number) => Promise<T>): Promise<StartupAdmissionResult<T>>;
     start(): Promise<BrokerDiscovery>;
     get ownsDiscovery(): boolean;
+    /** Whether this broker completed its initial retained discovery publication. */
+    get hasPublishedDiscovery(): boolean;
     get completion(): Promise<void>;
     /** Why this broker completed, or null while it is still running. */
     get terminalExit(): {
@@ -418,6 +437,8 @@ export declare function setBrokerLockReclaimHooksForTest(broker: Broker, hooks:
     beforeQuarantine?: () => Promise<void>;
     onContended?: () => void;
 } | undefined): void;
+/** Test-only hook for shortening the bounded abandonment grace. */
+export declare function setAbandonedGraceForTest(broker: Broker, graceMs: number | undefined): void;
 /** Test-only hook for shortening the bounded liveness deadline. */
 export declare function setLivenessGraceForTest(broker: Broker, graceMs: number | undefined): void;
 /** Test-only hook for shortening the bounded wait before a deferred managed close is queued. */

package/dist/types/sdk/broker/ensure.d.ts

@@ -1,5 +1,6 @@
 import { type ChildProcess } from "node:child_process";
 import type { FileHandle } from "node:fs/promises";
+import { type ProjectEnvSnapshot } from "@gajae-code/utils/env-file";
 import { type FileLockOptions } from "../../config/file-lock";
 import { type BrokerStartupExitRecord } from "./broker-exit";
 import { type BrokerDiscovery } from "./discovery";
@@ -129,8 +130,8 @@ export interface BrokerStartupLockOptions {
 }
 /**
  * Test-only phase observation for detached broker startup regressions. The
- * signal is opt-in through the child environment and never affects broker
- * ownership or error handling when the test seam is absent.
+ * directory is opt-in through a trusted operator environment and never affects
+ * broker ownership or error handling when the seam is absent.
  */
 export declare function emitBrokerStartupTestSignal(signal: string): Promise<void>;
 /**
@@ -302,6 +303,8 @@ export declare function reapDetachedBrokerPidForTest(pid: number, brokerIncarnat
 export declare function signalPinnedBrokerProcessForTest(reference: PinnedBrokerProcess | null, expectedIncarnation: string, signal: NodeJS.Signals): boolean;
 /** Test hook: verifies platforms without identity-bound signaling fail closed. */
 export declare function signalDetachedBrokerProcessForTest(pid: number, brokerIncarnation: string, signal: NodeJS.Signals, platform: NodeJS.Platform): boolean;
+/** Test hook: the signal directory accepted from this environment and snapshot. */
+export declare function trustedBrokerSignalDirectoryForTest(env: NodeJS.ProcessEnv, snapshot: ProjectEnvSnapshot | readonly ProjectEnvSnapshot[]): string | undefined;
 /** Test hook: resolves the complete broker environment without spawning. */
 export declare function brokerSpawnEnvironmentForTest(command: SdkInternalSpawnCommand, override?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 /** Test hook: installs an exact controllable owner to exercise replacement fencing. */

package/dist/types/sdk/broker/hop.d.ts

@@ -1,9 +1,18 @@
 import * as childProcess from "node:child_process";
 import type * as stream from "node:stream";
 import type { Process } from "@gajae-code/natives";
+/** Handoff protocol frames written to the trampoline's stdin. */
 export declare const BROKER_HANDOFF_ACKNOWLEDGEMENT = "GJC_BROKER_HANDOFF_ACK\n";
 export declare const BROKER_HANDOFF_COMMIT = "GJC_BROKER_HANDOFF_COMMIT\n";
 export declare const BROKER_HANDOFF_ABORT = "GJC_BROKER_HANDOFF_ABORT\n";
+/**
+ * Backstop for a retained trampoline whose parent never sends a decision. It must
+ * outlive the parent's own broker discovery deadline (which is derived from the
+ * publication budget and can double across a guarded retry), otherwise the
+ * trampoline reaps the broker first and the parent misreports its own discovery
+ * timeout as an "exited before discovery" startup failure.
+ */
+export declare const BROKER_HANDOFF_DECISION_TIMEOUT_MS = 120000;
 /**
  * Windows broker hop: spawns the real broker with detached:true and reports its pid.
  *

package/dist/types/sdk/broker/lifecycle.d.ts

@@ -133,6 +133,28 @@ export type SessionLifecycleLaunchRequest = SessionLifecycleLaunchRequestBase &
     coordinatorSidecarSigningKey?: undefined;
 });
 export declare function readSessionLifecycleLaunchRequest(value: string | undefined, now?: number): SessionLifecycleLaunchRequest;
+/**
+ * Validates the optional per-session `env`/`unsetEnv` pair (#6735). Returns
+ * null when either is malformed so the caller fails the launch closed.
+ */
+export declare function lifecycleSessionEnv(input: {
+    env?: unknown;
+    unsetEnv?: unknown;
+}): {
+    env?: Record<string, string>;
+    unsetEnv?: string[];
+} | null;
+/**
+ * Composes the inherited part of a lifecycle session host's environment:
+ * drops the process-local master capability, every `unsetEnv` name, and any
+ * inherited name an explicit per-session `env` entry replaces (case-folded on
+ * Windows so `Path` and `PATH` never both reach the child), then layers the
+ * per-session `env` on top. Broker-issued `GJC_*` keys are applied after this.
+ */
+export declare function lifecycleSessionHostBaseEnv(inherited: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>>, launch: {
+    env?: Readonly<Record<string, string>>;
+    unsetEnv?: readonly string[];
+}): Record<string, string>;
 type CleanupEvidence = BrokerCleanupEvidence;
 export declare function validateBrokerModelPresetSync(agentDir: string, requestedProfile: string): string | BrokerResponse;
 export declare function validateBrokerModelPresetForTest(agentDir: string, requestedProfile: string): string | BrokerResponse;

package/dist/types/sdk/broker/session-index.d.ts

@@ -185,6 +185,8 @@ export declare const DEFAULT_SESSION_RETENTION_MAX_AGE_MS: number;
 export declare const DEFAULT_SESSION_RETENTION_MAX_ROWS = 25000;
 /** Bound ordinary bootstrap waits; authorized doctor successors may use the full prepared window. */
 export declare function sessionIndexStartupLockOptions(deadline: number, signal?: AbortSignal, policy?: "ordinary" | "authorized-successor"): FileLockOptions;
+/** One elapsed budget for queueing, probing and every reacquisition in a pass. */
+export declare const SESSION_HEARTBEAT_CHECKPOINT_BUDGET_MS = 15000;
 export declare class SessionIndex {
     #private;
     constructor(agentDir: string, policy?: RetentionPolicy, observationDeps?: SessionIndexObservationDeps);

package/dist/types/sdk/broker/transport.d.ts

@@ -6,6 +6,8 @@ export declare class BrokerTransport {
     #private;
     constructor(broker: Broker, token: string, port?: number);
     get port(): number;
+    /** Sockets a client holds open right now; the broker outlives every one of them. */
+    get clientCount(): number;
     start(): Promise<number>;
     stop(): Promise<void>;
 }

package/dist/types/sdk/bus/index.d.ts

@@ -27,8 +27,10 @@ import { type WorkflowGateEmitter, type WorkflowGateTerminalProof } from "../../
 import type { AgentSessionEvent } from "../../session/agent-session";
 import { type SessionWorkLease, type SessionWorkLeaseHandle } from "../../session/session-work-lease";
 import type { AskAnswerSource, AskAnswerSourceResult, AskRemoteControl } from "../../tools";
+import type { AwaitingInputKind } from "../../tools/awaiting-input";
 import { type SessionHostRuntimePublication } from "../broker/lifecycle";
 import { type SessionSdkHost } from "../host";
+import { PromptImageUploadStore } from "../host/prompt-image-upload";
 import { CursorRegistry, RevisionStore } from "../host/query";
 import type { SdkFrame } from "../host/types";
 import { type SdkPromptTerminalOutcome } from "../prompt-status";
@@ -266,6 +268,13 @@ export declare class PresentationArbiter {
 interface SessionRuntime {
     server: NotificationServer;
     host: SessionSdkHost;
+    imageUploads: PromptImageUploadStore | undefined;
+    releaseAcceptedImage: (correlation: {
+        commandId: string;
+        turnId: string;
+    }) => void;
+    releaseAcceptedImagesForRun: (owner: AgentTerminalOwnerContext) => void;
+    releaseAcceptedImages: () => void;
     getJoinedPromptCorrelations: (owner: AgentTerminalOwnerContext) => Array<{
         commandId: string;
         turnId: string;
@@ -490,6 +499,16 @@ interface SessionRuntime {
         args?: unknown;
         pendingPhase?: "completed" | "failed" | "cancelled";
     }>;
+    /**
+     * Running tool calls that reported an awaiting-input signal, keyed by tool call
+     * id. An entry stays undelivered while notifications are inactive or policy is
+     * provisional, and is dropped when the call ends; one notification per call.
+     */
+    awaitingInput: Map<string, {
+        toolName: string;
+        kind: AwaitingInputKind;
+        delivered: boolean;
+    }>;
     /** Cancels the postmortem cleanup that emits `session_closed` on process teardown. */
     cancelPostmortemCleanup: () => void;
     /** Disposes side-turn resources when their owning logical session becomes unavailable. */
@@ -672,6 +691,8 @@ export declare function createNotificationsExtension(api: ExtensionAPI, options?
      * preflight outside the durable admission path (review thread P2).
      */
     terminalAbortSeams?: {
+        /** Definitive event-driven observation; never mutates the owning run. */
+        waitForRunSettlement?: (handle: string) => Promise<RunSettlementProof>;
         getTerminalRunOwnerForEvent?: (event: object) => AgentTerminalOwnerContext | undefined;
         getRunOwnerDomain?: (handle: string) => RunCancellationDomain | undefined;
         getTerminalTurnEpoch: () => number | undefined;

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -298,8 +298,14 @@ export declare const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * before its terminal record is durable.
  * Generation 203 replaces owners that still treat a project `.gjc` file as an
  * explicit deadline-autosave opt-in for a primary checkout.
+ * Generation 205 replaces owners whose process descendant walk can adopt
+ * children of a recycled PID. Generation 206 verifies macOS descendant
+ * identities and parentage before retaining PTY termination authority, and
+ * reaps adopted Linux PTY descendants when GJC is a child reaper.
+ * Generation 209 installs connection-owned private SDK image staging with
+ * execution-owned reservations, replacing hosts without that lifecycle contract.
  */
-export declare const DAEMON_GENERATION = 204;
+export declare const DAEMON_GENERATION = 209;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7
  * requires durable publication receipts and acknowledged attachment dispatch,

package/dist/types/sdk/bus/telegram-daemon.d.ts

@@ -135,6 +135,8 @@ export declare const ASK_SELECTED_ACK_CAPABILITY = "ask_selected_ack_v1";
 export declare const ASK_CONTROLS_CAPABILITY = "ask_controls_v1";
 /** Capability for the closed tool phase set: started, completed, failed, and cancelled. */
 export declare const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v2";
+/** Receive content-free notifications when a running command needs host-side authentication. */
+export declare const AWAITING_INPUT_CAPABILITY = "awaiting_input_v1";
 /** Receive-only compatibility capability for pre-v2 hosts. */
 export declare const LEGACY_TOOL_ACTIVITY_CAPABILITY = "tool_activity_v1";
 /** Public `sdk/bus/telegram-daemon` path for the canonical `sdk/host` capability token. */

package/dist/types/sdk/bus/threaded-render.d.ts

@@ -2,7 +2,7 @@
  * Pure rendering of threaded-session frames into Telegram send specs.
  *
  * The daemon receives the additive `ServerMessage` frames (identity_header,
- * context_update, turn_stream, image_attachment, config_update) over the session
+ * context_update, turn_stream, image_attachment, config_update, awaiting_input) over the session
  * WS and must turn each into a Bot API call scoped to the session's forum topic
  * (`message_thread_id`), throttled through the shared rate-limit pool. This
  * module is the pure frame→send mapping (including the priority lane and live-
@@ -71,6 +71,7 @@ interface ThreadedFrame {
     turnRef?: unknown;
     toolCallId?: unknown;
     toolName?: unknown;
+    kind?: unknown;
     argsSummary?: unknown;
     resultSummary?: unknown;
     isError?: unknown;

package/dist/types/sdk/host/control/operations.d.ts

@@ -19,7 +19,11 @@ export type ControlInput = Record<string, unknown>;
  * AgentSession and its controllers without exposing those concrete types here.
  */
 export interface ControlSurface {
-    prompt(text: string, images?: ControlValue, clientRef?: string): Promise<ControlValue> | ControlValue;
+    prompt(text: string, images?: ControlValue, clientRef?: string, stagedImages?: ControlValue): Promise<ControlValue> | ControlValue;
+    imageBegin?(input: ControlValue): Promise<ControlValue> | ControlValue;
+    imageAppend?(input: ControlValue): Promise<ControlValue> | ControlValue;
+    imageFinish?(input: ControlValue): Promise<ControlValue> | ControlValue;
+    imageDiscard?(input: ControlValue): Promise<ControlValue> | ControlValue;
     steer(text: string, clientRef?: string, expectedSdkRunToken?: string): Promise<ControlValue> | ControlValue;
     followUp(text: string): Promise<ControlValue> | ControlValue;
     abort(): Promise<ControlValue> | ControlValue;

package/dist/types/sdk/host/events.d.ts

@@ -20,6 +20,8 @@ export interface EventReplay {
     events: EventFrame[];
     gap?: EventReplayGap;
 }
+/** Notification policy refresh records the live redaction bit for one session ring. */
+export declare function setSessionOutboundRedact(sessionId: string, enabled: boolean): void;
 export declare class SessionEventStream {
     #private;
     constructor(options?: {
@@ -30,6 +32,8 @@ export declare class SessionEventStream {
     });
     get generation(): number;
     get sequence(): number;
+    /** Follow the session redaction bit. Replay then drops kinds emit sites already suppress. */
+    setOutboundRedact(enabled: boolean): void;
     restart(): number;
     emit(frame: SdkFrame): EventFrame;
     /** Replays retained current-generation events and reports any required resynchronization. */

package/dist/types/sdk/host/host.d.ts

@@ -81,6 +81,7 @@ export interface SessionSdkHostOptions extends HostEndpointAdapters {
  *  must see the same capability-gated event kinds on both legs, or live and
  *  replay delivery diverge for the same subscriber. */
 export declare const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v2";
+export declare const AWAITING_INPUT_CAPABILITY = "awaiting_input_v1";
 /** Capability for non-replayable streamed turn content. */
 export declare const TURN_STREAM_CAPABILITY = "turn_stream";
 /** Capability used by notification adapters that observe a host without owning its work. */
@@ -91,7 +92,7 @@ export declare const SESSION_HOST_OBSERVER_CAPABILITY = "session_host_observer_v
  * of every frame its positioned envelope already reached.
  */
 export declare const POSITIONED_NOTIFICATION_EFFECTS_CAPABILITY = "positioned_notification_effects_v1";
-export declare const CAP_GATED_FRAME_KINDS: ReadonlySet<string>;
+export declare const CAP_GATED_FRAME_KINDS: ReadonlyMap<string, string>;
 /** Keep live delivery and replay on one capability gate. */
 export declare function canDeliverSdkEvent(kind: string, capabilities: ReadonlySet<string> | undefined): boolean;
 /** SDK hosting is independent of notification configuration. Only root sessions host an endpoint. */

package/dist/types/sdk/host/prompt-image-upload.d.ts

@@ -0,0 +1,43 @@
+import type { RunSettlementProof } from "@gajae-code/agent-core";
+import type { ImageContent } from "@gajae-code/ai/core";
+/** One definitive event-driven wait; teardown and elapsed time are not settlement proof. */
+export declare function retirePromptImageReservation(handle: string, waitForRunSettlement: (handle: string) => Promise<RunSettlementProof>, isCurrent: () => boolean, release: () => void): void;
+export interface PromptImageProcessBudgetSnapshot {
+    /** Retained upload and accepted source bytes, including accepted base64 copies. */
+    readonly sourceBytes: number;
+    readonly transientBytes: number;
+    readonly concurrentFinishes: number;
+}
+/** Internal process diagnostics only; not an SDK operation or a release capability. */
+export declare function getPromptImageProcessBudgetSnapshot(): PromptImageProcessBudgetSnapshot;
+/** Session-scoped, connection-owned image leases; no client-supplied path or identity is trusted. */
+export declare class PromptImageUploadStore {
+    #private;
+    /** The host supplies live socket membership; standalone callers must choose an explicit policy. */
+    constructor(isConnectionOpen: (connectionId: string) => boolean);
+    begin(connectionId: string | undefined, value: unknown): {
+        id: string;
+        nextSequence: 0;
+    };
+    append(connectionId: string | undefined, value: unknown): {
+        id: string;
+        nextSequence: number;
+        receivedBytes: number;
+    };
+    finish(connectionId: string | undefined, value: unknown): Promise<{
+        id: string;
+        byteLength: number;
+        sha256: string;
+        mimeType: string;
+    }>;
+    discard(connectionId: string | undefined, value: unknown): {
+        discarded: true;
+    };
+    /** Synchronous reserve–validate–copy–consume transaction, called before prompt admission. */
+    redeem(connectionId: string | undefined, value: unknown): {
+        images: ImageContent[];
+        release: () => void;
+    };
+    disconnect(connectionId: string): void;
+    close(): void;
+}

package/dist/types/sdk/host/session-runtime.d.ts

@@ -1,3 +1,4 @@
+import { type RunSettlementProof } from "@gajae-code/agent-core";
 import type { ProviderDiagnostic } from "@gajae-code/ai/core";
 import { type Settings } from "../../config/settings";
 import type { ExtensionAPI, ExtensionContext } from "../../extensibility/extensions";
@@ -74,9 +75,12 @@ export interface SessionSdkTransport {
     stop(): Promise<void>;
     broadcastFrame?(frame: SdkFrame): void;
     onConnectionClose?(handler: (connectionId: string) => void): undefined | (() => void);
+    /** Authoritative live socket membership, not a cache of previously observed frames. */
+    isConnectionOpen?(connectionId: string): boolean;
     onNegotiatedCapabilities?(handler: (connectionId: string, capabilities: readonly string[]) => void): undefined | (() => void);
 }
 export interface SessionSdkRuntimeOptions extends Omit<SessionSdkHostOptions, "sessionId" | "stateRoot" | "token" | "sendFrame" | "onFrame"> {
+    onDisconnected?: (connectionId: string) => void;
     transport: SessionSdkTransport;
     /** Session settings; enables `config.patch` application on this runtime. */
     settings?: Settings;
@@ -154,6 +158,8 @@ export interface SdkOnlyReconciliationStore {
     }): Promise<void>;
 }
 export interface SdkOnlyTerminalAbortSeams {
+    /** Definitive event-driven observation: never abort, seal or quarantine a run to reclaim images. */
+    waitForRunSettlement?: (handle: string) => Promise<RunSettlementProof>;
     getReconciliationStore?: () => SdkOnlyReconciliationStore | undefined;
     getTerminalTurnEpoch: () => number | undefined;
     getActivePromptHandle: () => string | undefined;
@@ -215,14 +221,6 @@ export interface SdkOnlyDeadlineRecoveryCheckpoint {
     pendingToolCount?: number;
     errorCode?: string;
 }
-/**
- * The transport-neutral SDK session runtime.
- *
- * Concrete transports (including the optional notification/native transport) are
- * injected by the caller. This module owns host construction, control/query
- * dispatch, replay/event publication, and reverse-provider lifecycle without
- * importing any notification adapter or native notification class.
- */
 export declare class SessionSdkSessionRuntime {
     #private;
     readonly host: SessionSdkHost;
@@ -397,6 +395,8 @@ export interface SdkSurfaceFactoryOptions {
     api: ExtensionAPI;
     /** Startup surface that owns host-level permission and lifecycle authority. */
     primaryControlSurface?: "cli" | "sdk";
+    /** Private staging controls are advertised only with authoritative transport liveness. */
+    imageUploadsAvailable?: boolean;
     policy?: SdkSurfacePolicy;
     getInstalledDefinitions?: (capability: string) => unknown | undefined;
     getLiveState?: () => {

package/dist/types/sdk/host/surface-policy.d.ts

@@ -7,6 +7,7 @@ export interface SdkSurfacePolicy {
 export interface SdkSurfacePolicyOptions {
     bindings: Iterable<string>;
     workflowGateAvailable: boolean;
+    imageUploadsAvailable?: boolean;
     isBindingInstalled?: (binding: string) => boolean;
 }
 /** Shared operation advertisement policy for every SDK transport. */
@@ -20,4 +21,4 @@ export interface SdkCapabilities {
 }
 export declare function createSdkCapabilities(policy: SdkSurfacePolicy, hostTools?: boolean, primaryControlSurface?: SdkCapabilities["primaryControlSurface"]): SdkCapabilities;
 /** Derive the shared policy from an extension context without importing adapters. */
-export declare function createSdkSurfacePolicyForContext(ctx: ExtensionContext, workflowGateAvailable?: boolean): SdkSurfacePolicy;
+export declare function createSdkSurfacePolicyForContext(ctx: ExtensionContext, workflowGateAvailable?: boolean, imageUploadsAvailable?: boolean): SdkSurfacePolicy;

package/dist/types/sdk/lifecycle/service.d.ts

@@ -57,6 +57,10 @@ export type SessionCreateTarget = SessionLifecycleCoordinatorTarget & {
     readonly body?: string;
     readonly modelPreset?: string;
     readonly mcpServers?: readonly Record<string, unknown>[];
+    /** Per-session environment for the hosted session; `GJC_*` names are reserved (#6735). */
+    readonly env?: Readonly<Record<string, string>>;
+    /** Inherited broker environment names removed from the hosted session (#6735). */
+    readonly unsetEnv?: readonly string[];
     readonly worktree?: SessionLifecycleWorktreeTarget;
     readonly readiness?: "immediate" | "deferred";
     readonly readinessTimeoutMs?: number;
@@ -70,6 +74,10 @@ export type SessionForkTarget = SessionLifecycleCoordinatorTarget & {
     readonly body?: string;
     readonly modelPreset?: string;
     readonly mcpServers?: readonly Record<string, unknown>[];
+    /** Per-session environment for the hosted session; `GJC_*` names are reserved (#6735). */
+    readonly env?: Readonly<Record<string, string>>;
+    /** Inherited broker environment names removed from the hosted session (#6735). */
+    readonly unsetEnv?: readonly string[];
     readonly worktree?: SessionLifecycleWorktreeTarget;
     readonly readinessTimeoutMs?: number;
 };
@@ -82,6 +90,10 @@ export type SessionResumeTarget = SessionLifecycleCoordinatorTarget & {
     readonly body?: string;
     readonly modelPreset?: string;
     readonly mcpServers?: readonly Record<string, unknown>[];
+    /** Per-session environment for the hosted session; `GJC_*` names are reserved (#6735). */
+    readonly env?: Readonly<Record<string, string>>;
+    /** Inherited broker environment names removed from the hosted session (#6735). */
+    readonly unsetEnv?: readonly string[];
     readonly worktree?: SessionLifecycleWorktreeTarget;
     readonly readinessTimeoutMs?: number;
 };

package/dist/types/sdk/prompt-status.d.ts

@@ -37,12 +37,19 @@ export interface TurnPromptImageInput {
     data: string;
     mimeType?: string;
 }
-/** Public input contract for ordered `turn.prompt`. */
-export interface TurnPromptInput {
+/** Public input contract for ordered `turn.prompt`; direct and staged images cannot be mixed. */
+export type TurnPromptInput = {
     text: string;
-    images?: TurnPromptImageInput[];
     clientRef?: string;
-}
+} & ({
+    images?: TurnPromptImageInput[];
+    stagedImages?: never;
+} | {
+    images?: never;
+    stagedImages: Array<{
+        id: string;
+    }>;
+});
 /**
  * Terminal outcome is preserved exactly; active records never age into terminal. An
  * ordinary prompt active at process restart is finalized from its durable pending