@gajae-code/coding-agent 0.18.6 → 0.18.7

package/CHANGELOG.md

@@ -2,6 +2,45 @@
 
 ## [Unreleased]
 
+## [0.18.7] - 2026-10-04
+
+### Added
+
+- Resolve readonly target-directory settings snapshots with normalized values and fresh operation-local metadata reads, without changing parent settings or publishing global hooks.
+
+### Changed
+
+- Cut startup memory for the light CLI invocations by deferring the per-path modules out of the eager root command graph: peak RSS dropped from 32.4 MB to 27.7 MB for `--version` and from 32.7 MB to 28.0 MB for `--help`. The quick lane, the bash-shell guardian/supervisor/worker executors, the isolated shell, the tab-worker smoke probe and the fixture report now load only when their own path actually runs, so their behaviour, output and exit codes are unchanged.
+
+### Fixed
+
+- `session.resume` of a session whose detached-idle host already exited no longer fails with `EEXIST` on `<id>.lifecycle.ready.json`: the host revokes its own ready marker on graceful exit, and a launch retires the same id's leftover ready/marker pair when the recorded owner is proven exited (a live or unknown owner still wins) (#6261).
+
+- Settle active ACP prompts immediately when their SDK session host retires, while preserving prompts across same-generation attachment replacement instead of waiting for the inactivity watchdog.
+
+- Apply ACP thinking-level changes through the session control setter so reasoning effort updates the live session state and session config readback reflects the requested level.
+
+- ACP now rejects unsupported or unapplied thinking levels instead of reporting them as successful changes.
+
+- Session heartbeat checkpoints no longer starve the SDK broker discovery heartbeat while waiting on the session-index lock.
+
+- SDK broker readiness polling now uses the session-index change stamp instead of checkpointing live heartbeats and replaying the full index on every poll.
+
+- `gjc config set|get|list` (text and `--json`) no longer print the Slack app-level token `notifications.slack.appToken` verbatim. Secret detection for setting keys now treats any key segment ending in a secret word (`token`, `secret`, `password`, `passwd`, `pwd`, `credential(s)`) as secret instead of relying on a fixed list of camelCase prefixes, so it shows `<redacted>` like every other token setting. Token-budget settings such as `compaction.reserveTokens` stay visible.
+
+- Retry bare-default Codex overloads when the failed attempt contains only an empty unsigned thinking block.
+
+- `HINDSIGHT_RETAIN_EVERY_N_TURNS`, `HINDSIGHT_RECALL_MAX_TOKENS`, `HINDSIGHT_RECALL_CONTEXT_TURNS` and `HINDSIGHT_RECALL_MAX_QUERY_CHARS` now accept only plain non-negative digits. Malformed values such as `5turns`, `1e3`, `1.5` or `-3` fall back to the matching `hindsight.*` setting instead of being read by `parseInt` as 5, 1, 1 or -3. A negative `HINDSIGHT_RETAIN_EVERY_N_TURNS` previously made chunked retention send nothing.
+
+- Slack and Discord chat daemons no longer post every lean final answer twice. The host sends each turn frame on a positioned leg and a raw leg and drops the raw copy only for connections that negotiate `positioned_notification_effects_v1`; the chat daemons' session connections never did, and a lean final carries no `messageRef` to collapse the two copies onto one publication. Chat daemon session connections now negotiate positioned-only notification effects, while plain SDK observers such as `gjc sdk session tail` keep both surfaces.
+
+- Answer modern MCP roots requests without requiring an interactive input handler, while keeping actual elicitation fail-closed when user input is unavailable.
+- Connect supported MCP form requests to the session's user-input surface instead of failing before users can answer.
+
+- SDK MCP initialize now negotiates supported protocol versions and includes the coding-agent package version in `serverInfo`.
+
+- SSH hosts loaded from `ssh.json` no longer accept a malformed `port`. A string port must be plain digits and every port must be an integer from 1 to 65535, so `"22oops"`, `"+22"`, `2222.5`, `0` and `70000` are now dropped with an `Invalid port` warning (the host falls back to the default port) instead of being used as 22, 22, 2222.5, 0 and 70000.
+
 ## [0.18.6] - 2026-10-03
 
 ### Added

package/dist/types/capability/types.d.ts

@@ -39,6 +39,8 @@ export interface LoadContext {
     repoRoot: string | null;
     /** Whether discovery must remain isolated to the supplied home boundary. */
     isolatedHome?: boolean;
+    /** Bypass lexical filesystem caches for this discovery operation. */
+    bypassCache?: boolean;
     /** Owning session settings for provider policy decisions. */
     settings?: Settings;
 }
@@ -104,6 +106,8 @@ export interface LoadOptions {
     includeDisabledProviders?: boolean;
     /** Explicit disabled extension IDs to apply instead of settings. */
     disabledExtensions?: string[];
+    /** Bypass lexical filesystem caches for this discovery operation. */
+    bypassCache?: boolean;
     /** Session settings whose provider policy applies to this load. */
     settings?: Settings;
     /** Internal: prevent explicit-home loads from consulting process-global policy. */

package/dist/types/config/settings.d.ts

@@ -179,6 +179,10 @@ export declare class Settings implements NotificationSettingsReader {
     flush(): Promise<void>;
     /** Like {@link flush}, but reports a durable save failure to the caller. */
     flushOrThrow(): Promise<void>;
+    /** Copy execution settings without reloading, persisting, or sharing mutable layers. */
+    snapshot(): Settings;
+    /** Resolve a retained execution's project layer without persistence or global hooks. */
+    snapshotForCwd(cwd: string): Promise<Settings>;
     cloneForCwd(cwd: string): Promise<Settings>;
     getStorage(): AgentStorage | null;
     /** Flush and close storage owned by an isolated settings scope. */

package/dist/types/discovery/helpers.d.ts

@@ -93,8 +93,8 @@ export declare function getUserSkillScanDirs(home: string, userAgentDir?: string
  */
 export declare function getProjectPath(ctx: LoadContext, source: SourceId, subpath: string): string | null;
 /** Build the filesystem authority for a provider read. */
-export declare function getReadOptions(ctx: Pick<LoadContext, "home" | "isolatedHome" | "userAgentDir" | "homeIdentity" | "userAgentIdentity">, scope: ReadScope): ReadFileOptions | undefined;
-export declare function getReadOptionsForContainment(ctx: Pick<LoadContext, "home" | "isolatedHome" | "userAgentDir" | "homeIdentity" | "userAgentIdentity">, scope: ReadScope, containmentRoot?: string): Promise<ReadFileOptions | undefined>;
+export declare function getReadOptions(ctx: Pick<LoadContext, "home" | "isolatedHome" | "userAgentDir" | "homeIdentity" | "userAgentIdentity" | "bypassCache">, scope: ReadScope): ReadFileOptions | undefined;
+export declare function getReadOptionsForContainment(ctx: Pick<LoadContext, "home" | "isolatedHome" | "userAgentDir" | "homeIdentity" | "userAgentIdentity" | "bypassCache">, scope: ReadScope, containmentRoot?: string): Promise<ReadFileOptions | undefined>;
 /**
  * Create source metadata for an item.
  */

package/dist/types/runtime-mcp/elicitation.d.ts

@@ -0,0 +1,12 @@
+import type { ExtensionUIContext } from "../extensibility/extensions/types";
+import type { AskAnswerSource } from "../tools";
+import type { MCPInputRequestHandler } from "./types";
+export interface MCPFormInputDependencies {
+    getUi(): {
+        ui?: Pick<ExtensionUIContext, "select" | "input">;
+        hasUI: boolean;
+    };
+    getAskAnswerSource(): AskAnswerSource | undefined;
+}
+/** Register on an owned manager; dependencies are resolved per call for late UI registration. */
+export declare function createMCPFormInputHandler(deps: MCPFormInputDependencies): MCPInputRequestHandler;

package/dist/types/sdk/broker/lifecycle.d.ts

@@ -181,6 +181,15 @@ export declare function observeProcessForTest(pid: number, expectedIncarnation:
  * deliberately left untouched.
  */
 export declare function reapDeadLifecycleMarkers(root: string, limit?: number): Promise<number>;
+/**
+ * Retires one launch id's lifecycle marker pair after its recorded owner has
+ * exited. Unlike the bounded background sweep, this launch-local repair is
+ * not age-gated and does not require the ready sibling to contain the same
+ * effect marker: the primary marker is the owner authority for this id.
+ */
+type RetireExitedLifecycleMarkerPairHook = () => void | Promise<void>;
+export declare function retireExitedLifecycleMarkerPair(root: string, id: string): Promise<boolean>;
+export declare function retireExitedLifecycleMarkerPairForTest(root: string, id: string, afterObservation: RetireExitedLifecycleMarkerPairHook): Promise<boolean>;
 export declare function writeEffectMarker(root: string, id: string, marker: EffectMarker): Promise<void>;
 export declare class LifecycleReadinessCleanupError extends Error {
     constructor(cause: unknown);

package/dist/types/sdk/broker/task-artifact-owner-validation.d.ts

@@ -0,0 +1,55 @@
+import type { NativeExactUnlinkResult } from "@gajae-code/natives";
+import { type TaskArtifactOwnerDeletionEvidence, type TaskArtifactOwnerRetirementContinuation, type TaskArtifactOwnerRetirementOutcome, type TaskArtifactOwnerStorageContext } from "../../session/task-artifact-owner-codec";
+export type BrokerCleanupPhase = "artifacts" | "transcript" | "metadata" | "lifecycle";
+/** Exact owner-disposition wire shape. Evidence and continuation are supplied separately by cleanup replay. */
+export type BrokerTaskArtifactOwnerRetirementDisposition = {
+    readonly kind: "completed";
+    readonly nativeOutcome?: NativeExactUnlinkResult;
+} | {
+    readonly kind: "payload_retired";
+    readonly namespace: "retained";
+    readonly nativeOutcome: NativeExactUnlinkResult;
+} | {
+    readonly kind: "cleanup_pending";
+    readonly nativeOutcome?: NativeExactUnlinkResult;
+} | {
+    readonly kind: "uncertain";
+    readonly reason: string;
+    readonly nativeOutcome?: NativeExactUnlinkResult;
+};
+/** Owner-only projection of durable cleanup state accepted by the pure validator. */
+export interface BrokerTaskArtifactOwnerCleanupFields {
+    readonly taskArtifactOwnerDeletionEvidence?: unknown;
+    readonly taskArtifactOwnerRetirementContinuation?: unknown;
+    readonly taskArtifactOwnerRetirementOutcome?: unknown;
+    readonly taskArtifactOwnerPayloadRetired?: unknown;
+    readonly taskArtifactOwnerNamespaceRetained?: unknown;
+    readonly taskArtifactOwnerRetired?: unknown;
+    readonly taskArtifactOwnerTranscriptDeleted?: unknown;
+    readonly taskArtifactOwnerCleanupError?: unknown;
+}
+/** Fully decoded owner-only cleanup state for an authorized session and phase. */
+export interface BrokerTaskArtifactOwnerCleanupValidation {
+    readonly deletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    readonly retirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    readonly retirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    readonly payloadRetired?: true;
+    readonly namespaceRetained?: true;
+    readonly retired?: true;
+    readonly transcriptDeleted?: true;
+    readonly cleanupDiagnostic?: string;
+}
+/**
+ * Decode the owner-only wire disposition using its exact trusted evidence and continuation.
+ * A decoded `completed` value is historical DTO data, not proof of physical retirement or writer closure.
+ */
+export declare function parseBrokerTaskArtifactOwnerRetirementDisposition(value: unknown, context: TaskArtifactOwnerStorageContext, evidence: TaskArtifactOwnerDeletionEvidence, continuation: TaskArtifactOwnerRetirementContinuation | undefined): TaskArtifactOwnerRetirementOutcome;
+/** Project an already validated internal outcome to the exact broker wire disposition. */
+export declare function serializeBrokerTaskArtifactOwnerRetirementDisposition(outcome: TaskArtifactOwnerRetirementOutcome): BrokerTaskArtifactOwnerRetirementDisposition;
+/**
+ * Strictly decode the owner-field projection of cleanup state against trusted session, scope context, phase,
+ * and artifact-removal state. Empty/legacy owner fields decode to an empty result. A decoded completion
+ * remains historical data: any later effect must separately verify current physical absence, fresh scrub
+ * proof, native success and current owner-parent/side-path authority before it mutates storage or transcripts.
+ */
+export declare function decodeBrokerTaskArtifactOwnerCleanupFields(value: unknown, context: TaskArtifactOwnerStorageContext, expectedSessionId: string, phase: BrokerCleanupPhase, artifactsRemoved: boolean | undefined): BrokerTaskArtifactOwnerCleanupValidation;

package/dist/types/sdk/bus/telegram-daemon.d.ts

@@ -9,6 +9,7 @@ import { type DaemonProcessReference } from "./telegram-daemon-control";
 import { type TelegramSetupPreflight } from "./telegram-setup";
 export { loadInstallationHostId, loadLegacyInstallationHostId, type MachineIdentityDeps, parseMacPlatformUuid, parseWindowsMachineGuid, } from "../../config/machine-identity";
 export { DAEMON_GENERATION, NOTIFICATION_EVENT_SCHEMA_VERSION, NOTIFICATION_PROTOCOL_VERSION, SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION, SERVING_EPOCH, TELEGRAM_TRANSPORT_GENERATION, } from "./telegram-daemon-contract";
+import { POSITIONED_NOTIFICATION_EFFECTS_CAPABILITY } from "../host/host";
 import { type AgentDirSessionLifecycleService } from "../lifecycle/client";
 import { type NotificationSubscription, type SessionRouterProviderDeps } from "../router/session-router";
 import { NotificationOperatorRuntime } from "./operator-runtime";
@@ -136,8 +137,8 @@ export declare const ASK_CONTROLS_CAPABILITY = "ask_controls_v1";
 export declare const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v2";
 /** Receive-only compatibility capability for pre-v2 hosts. */
 export declare const LEGACY_TOOL_ACTIVITY_CAPABILITY = "tool_activity_v1";
-/** Opts notification adapters into positioned-only delivery for matching live effects. */
-export declare const POSITIONED_NOTIFICATION_EFFECTS_CAPABILITY = "positioned_notification_effects_v1";
+/** Public `sdk/bus/telegram-daemon` path for the canonical `sdk/host` capability token. */
+export { POSITIONED_NOTIFICATION_EFFECTS_CAPABILITY };
 /**
  * File-lock options whose acquisition budget covers the full reload-reservation
  * critical section: the in-lock freshness poll plus the controller's

package/dist/types/sdk/host/host.d.ts

@@ -85,6 +85,12 @@ export declare const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v2";
 export declare const TURN_STREAM_CAPABILITY = "turn_stream";
 /** Capability used by notification adapters that observe a host without owning its work. */
 export declare const SESSION_HOST_OBSERVER_CAPABILITY = "session_host_observer_v1";
+/**
+ * Opts notification adapters into positioned-only delivery for matching live
+ * effects: the host excludes a negotiating connection from the raw native leg
+ * of every frame its positioned envelope already reached.
+ */
+export declare const POSITIONED_NOTIFICATION_EFFECTS_CAPABILITY = "positioned_notification_effects_v1";
 export declare const CAP_GATED_FRAME_KINDS: ReadonlySet<string>;
 /** Keep live delivery and replay on one capability gate. */
 export declare function canDeliverSdkEvent(kind: string, capabilities: ReadonlySet<string> | undefined): boolean;

package/dist/types/sdk/router/session-router.d.ts

@@ -181,6 +181,13 @@ export interface SessionRouterOptions {
     attachFilter?: (sessionId: string) => boolean;
     /** Marks default SDK clients as notification-only observers; demanding by default. */
     observer?: boolean;
+    /**
+     * Negotiates positioned-only notification effects on default SDK clients, so the
+     * host stops sending them the raw native copy of frames whose positioned
+     * envelope already reached them. Only notification-effect publishers opt in;
+     * ordinary SDK observers keep both public surfaces.
+     */
+    positionedNotificationEffects?: boolean;
     deps?: SessionRouterDeps;
     /** Runtime-specific identity validation; Router supplies a conservative fallback. */
     correlateFrame?: SessionRouterFrameCorrelator;

package/dist/types/session/internal/managed-session-storage.d.ts

@@ -174,7 +174,7 @@ export declare class ManagedSessionDescendantStore {
     constructor(root: ManagedDirectoryRoot, baseDir: string, retained?: {
         authority: RecoveryFsRoot;
         authorityBaseDir: string;
-    }, policy?: ManagedSessionSecurityPolicy, profileAgentDir?: string);
+    }, policy?: ManagedSessionSecurityPolicy, profileAgentDir?: string, expectedSubtreeRoot?: ManagedDirectoryRoot);
     get dir(): string;
     get rootAuthority(): ManagedDirectoryRoot;
     get subtreeRootAuthority(): ManagedDirectoryRoot;
@@ -189,6 +189,11 @@ export declare class ManagedSessionDescendantStore {
     close(): void;
     assertBound(): void;
     verifyRootSecurity(): void;
+    /** Capture a directory identity through this store's retained managed root without repairing it. */
+    captureDirectoryIdentity(relativePath: string): {
+        dev: string;
+        ino: string;
+    };
     ensureDirectory(relativePath?: string): ManagedDirectoryRoot;
     publishNoReplace(relativePath: string, bytes: Uint8Array): Promise<void>;
     publishNoReplaceSync(relativePath: string, bytes: Uint8Array): void;
@@ -240,6 +245,11 @@ export declare class ManagedSessionDescendantStore {
         sourceStoreRelativePath: string;
     }): ManagedFileSnapshot;
     removeTreeExpected(relativePath: string, expected: NativeDirectoryTreeSnapshot): void;
+    /** Remove one exact managed tree through the parent-identity-bound native protocol. */
+    removeTreeExpectedWithParentIdentity(relativePath: string, expected: NativeDirectoryTreeSnapshot, parentIdentity: {
+        dev: bigint;
+        ino: bigint;
+    }): NativeExactUnlinkResult;
     fsyncTree(): NativeDirectoryTreeSnapshot;
 }
 export declare function shouldFsyncManagedDirectory(platform?: NodeJS.Platform): boolean;

package/dist/types/session/internal/task-artifact-owner-access.d.ts

@@ -0,0 +1,17 @@
+import type { NativeDirectoryTreeSnapshot } from "@gajae-code/natives";
+import { type TaskArtifactOwnerDeletionEvidence, type TaskArtifactOwnerLocator, type TaskArtifactOwnerStorageContext } from "../task-artifact-owner-codec";
+import { ManagedSessionDescendantStore } from "./managed-session-storage";
+export interface OwnerManifest extends TaskArtifactOwnerLocator {
+    readonly sessionId: string;
+}
+export declare function newSessionRootStore(context: TaskArtifactOwnerStorageContext): ManagedSessionDescendantStore;
+export declare function readOwnerManifest(store: ManagedSessionDescendantStore, locator: TaskArtifactOwnerLocator, relativePath?: string): OwnerManifest;
+export declare function assertOwnerDirectoryExists(context: TaskArtifactOwnerStorageContext, ownerId: string): void;
+export declare function assertOwnerIdentity(store: ManagedSessionDescendantStore, locator: TaskArtifactOwnerLocator): void;
+export declare function openOwnerStore(context: TaskArtifactOwnerStorageContext, rootStore: ManagedSessionDescendantStore, locator: TaskArtifactOwnerLocator, sessionId: string): ManagedSessionDescendantStore;
+export declare function locatorFromManifest(manifest: OwnerManifest): TaskArtifactOwnerLocator;
+export declare function captureValidatedOwnerTree(context: TaskArtifactOwnerStorageContext, rootStore: ManagedSessionDescendantStore, sessionId: string, locator: TaskArtifactOwnerLocator): NativeDirectoryTreeSnapshot;
+export declare function captureOwnerTreeIfPresent(context: TaskArtifactOwnerStorageContext, rootStore: ManagedSessionDescendantStore, ownerId: string, pathname: string): NativeDirectoryTreeSnapshot | undefined;
+export declare function ownerTreeHasPendingManagedPublication(snapshot: NativeDirectoryTreeSnapshot): boolean;
+/** Capture exact owner evidence without repairing its security, timestamps, or namespace. */
+export declare function captureTaskArtifactOwnerDeletionEvidence(context: TaskArtifactOwnerStorageContext, sessionId: string, locatorValue: unknown): TaskArtifactOwnerDeletionEvidence | undefined;

package/dist/types/session/internal/task-artifact-owner-transcript.d.ts

@@ -0,0 +1,3 @@
+import { type TaskArtifactOwnerLocator } from "../task-artifact-owner-codec";
+/** Resolve the path-free owner locator using transcript replay's header-patch semantics. */
+export declare function taskArtifactOwnerLocatorFromTranscriptBytes(bytes: Uint8Array, expectedSessionId: string): TaskArtifactOwnerLocator | undefined;

package/dist/types/session/session-retirement.d.ts

@@ -0,0 +1,47 @@
+import { type FileSessionStorage } from "./session-storage";
+/**
+ * Outcome of a disk-retention retirement attempt.
+ *
+ * `kept` means the transcript survived and nothing of the session was
+ * destroyed, with the exact reason so `gjc gc --disk` can report it.
+ * `cleanup_pending` means the delete authority already detached or removed the
+ * session's artifact tree (or quarantined the transcript) before it stopped:
+ * the record survives, the session does not, and a caller must NOT report that
+ * as an ordinary keep.
+ */
+export type SessionRetirementOutcome = {
+    kind: "retired";
+} | {
+    kind: "kept";
+    reason: string;
+} | {
+    kind: "cleanup_pending";
+    reason: string;
+};
+/**
+ * Non-mutating projection of {@link retireSessionTranscript}: would the
+ * retention pass's own preconditions let this transcript be retired at all?
+ *
+ * `gjc gc --disk` runs it so a dry run reports the verdict a prune would reach
+ * instead of promising bytes the delete authority will refuse to release. The
+ * authority's verdict (containment, identity, artifact tree) is deliberately
+ * not predicted here — it is re-derived against live state at delete time.
+ */
+export declare function probeSessionRetirement(storage: FileSessionStorage, sessionsRoot: string, transcriptPath: string): {
+    kind: "retirable";
+} | {
+    kind: "kept";
+    reason: string;
+};
+/**
+ * Retire one managed session transcript through the verified hard-delete
+ * authority.
+ *
+ * This is the only supported way for a retention pass to remove a transcript:
+ * identity, containment, header id/cwd, artifact tree and parent directory are
+ * all re-verified inside {@link FileSessionStorage.deleteSessionVerified}, and
+ * anything ambiguous fails closed as `kept` rather than deleting bytes. The
+ * caller owns the retention policy; this function owns nothing but the delete
+ * authority.
+ */
+export declare function retireSessionTranscript(storage: FileSessionStorage, sessionsRoot: string, transcriptPath: string): Promise<SessionRetirementOutcome>;

package/dist/types/session/session-storage.d.ts

@@ -512,50 +512,4 @@ export declare class MemorySessionStorage implements SessionStorage {
     openBufferedWriter(path: string, options?: SessionStorageWriterOpenOptions): SessionStorageBufferedWriter;
     openStagedWriter(path: string): StagedStreamingWriter;
 }
-/**
- * Outcome of a disk-retention retirement attempt.
- *
- * `kept` means the transcript survived and nothing of the session was
- * destroyed, with the exact reason so `gjc gc --disk` can report it.
- * `cleanup_pending` means the delete authority already detached or removed the
- * session's artifact tree (or quarantined the transcript) before it stopped:
- * the record survives, the session does not, and a caller must NOT report that
- * as an ordinary keep.
- */
-export type SessionRetirementOutcome = {
-    kind: "retired";
-} | {
-    kind: "kept";
-    reason: string;
-} | {
-    kind: "cleanup_pending";
-    reason: string;
-};
-/**
- * Non-mutating projection of {@link retireSessionTranscript}: would the
- * retention pass's own preconditions let this transcript be retired at all?
- *
- * `gjc gc --disk` runs it so a dry run reports the verdict a prune would reach
- * instead of promising bytes the delete authority will refuse to release. The
- * authority's verdict (containment, identity, artifact tree) is deliberately
- * not predicted here — it is re-derived against live state at delete time.
- */
-export declare function probeSessionRetirement(storage: FileSessionStorage, sessionsRoot: string, transcriptPath: string): {
-    kind: "retirable";
-} | {
-    kind: "kept";
-    reason: string;
-};
-/**
- * Retire one managed session transcript through the verified hard-delete
- * authority.
- *
- * This is the only supported way for a retention pass to remove a transcript:
- * identity, containment, header id/cwd, artifact tree and parent directory are
- * all re-verified inside {@link FileSessionStorage.deleteSessionVerified}, and
- * anything ambiguous fails closed as `kept` rather than deleting bytes. The
- * caller owns the retention policy; this function owns nothing but the delete
- * authority.
- */
-export declare function retireSessionTranscript(storage: FileSessionStorage, sessionsRoot: string, transcriptPath: string): Promise<SessionRetirementOutcome>;
 export {};

package/dist/types/session/session-transcript-header.d.ts

@@ -0,0 +1,2 @@
+/** Parse the first JSONL line as a generic record; returns undefined on parse failure. */
+export declare function parseFirstJsonlLine(bytes: Uint8Array): Record<string, unknown> | undefined;

package/dist/types/session/task-artifact-owner-codec.d.ts

@@ -0,0 +1,107 @@
+import type { NativeExactUnlinkResult } from "@gajae-code/natives";
+import type { ManagedDirectoryRoot, ManagedSessionSecurityPolicy } from "./internal/managed-session-storage";
+import type { NativeDirectoryTreeSnapshot } from "./session-storage";
+export declare const OWNER_DIRECTORY = ".task-artifact-owners";
+export declare const OWNER_LOCK_DIRECTORY = ".task-artifact-owner-locks";
+export declare const OWNER_MANIFEST = ".gjc-task-artifact-owner-v1.json";
+export declare const OWNER_SCHEMA_VERSION: 1;
+export declare const OWNER_DELETION_SCHEMA_VERSION: 2;
+export declare const OWNER_RETIREMENT_SCHEMA_VERSION: 1;
+export declare const EMPTY_PAYLOAD_SHA256: string;
+export interface TaskArtifactOwnerLocator {
+    readonly schemaVersion: typeof OWNER_SCHEMA_VERSION;
+    readonly ownerId: string;
+    readonly directoryDev: string;
+    readonly directoryIno: string;
+}
+export interface TaskArtifactOwnerStorageContext {
+    readonly rootAuthority: ManagedDirectoryRoot;
+    readonly sessionsRoot: string;
+    readonly securityPolicy: ManagedSessionSecurityPolicy;
+    readonly profileAgentDir: string;
+}
+/** Exact parent directory identity authorizing direct native owner-tree removal. */
+export interface TaskArtifactOwnerParentIdentity {
+    readonly dev: string;
+    readonly ino: string;
+}
+/** Immutable exact deletion input retained by managed lifecycle tombstones and retries. */
+export interface TaskArtifactOwnerDeletionEvidence {
+    readonly schemaVersion: typeof OWNER_DELETION_SCHEMA_VERSION;
+    readonly sessionId: string;
+    readonly locator: TaskArtifactOwnerLocator;
+    readonly parentIdentity: TaskArtifactOwnerParentIdentity;
+    readonly treeSnapshot: NativeDirectoryTreeSnapshot;
+}
+/** Native retained-root and side-path state safe to persist for a later retirement attempt. */
+export interface TaskArtifactOwnerRetirementContinuation {
+    readonly schemaVersion: typeof OWNER_RETIREMENT_SCHEMA_VERSION;
+    /** Must remain equal to the immutable evidence's managed owner-parent identity. */
+    readonly parentIdentity: TaskArtifactOwnerParentIdentity;
+    /** Only the original owner root or its native `.removing` sibling is actionable. */
+    readonly retainedRootPath: string;
+    /** Last identity-checked tree snapshot; it may only shrink from the original evidence. */
+    readonly retainedTreeSnapshot: NativeDirectoryTreeSnapshot;
+    /** Historical exact native detached-root roles; these paths are diagnostics, not extra authority. */
+    readonly detachedPaths?: readonly string[];
+    readonly nativeCodes?: readonly string[];
+    readonly payloadDurable?: boolean;
+    readonly retainedSuccessorPaths?: readonly string[];
+    readonly retainedPlaceholderPaths?: readonly string[];
+    readonly retainedUnknownPaths?: readonly string[];
+    readonly windowsErrorCodes?: readonly string[];
+}
+/** `completed` is decoded persisted data, not proof of physical retirement or writer closure. */
+export type TaskArtifactOwnerRetirementOutcome = {
+    readonly kind: "completed";
+    readonly evidence: TaskArtifactOwnerDeletionEvidence;
+    readonly nativeOutcome?: NativeExactUnlinkResult;
+} | {
+    /** Live payload is durably destroyed; native namespace cleanup remains pending. */
+    readonly kind: "payload_retired";
+    readonly namespace: "retained";
+    readonly evidence: TaskArtifactOwnerDeletionEvidence;
+    readonly continuation: TaskArtifactOwnerRetirementContinuation;
+    readonly nativeOutcome: NativeExactUnlinkResult;
+} | {
+    /** Native explicitly retained cleanup state with a validated, non-expanding continuation. */
+    readonly kind: "cleanup_pending";
+    readonly evidence: TaskArtifactOwnerDeletionEvidence;
+    readonly continuation: TaskArtifactOwnerRetirementContinuation;
+    readonly nativeOutcome?: NativeExactUnlinkResult;
+} | {
+    /** No safe completion proof exists; callers must retain evidence and continuation. */
+    readonly kind: "uncertain";
+    readonly evidence: TaskArtifactOwnerDeletionEvidence;
+    readonly continuation: TaskArtifactOwnerRetirementContinuation;
+    readonly reason: string;
+    readonly nativeOutcome?: NativeExactUnlinkResult;
+};
+/** True only for canonical unsigned decimal strings within the native u64 range. */
+export declare function isCanonicalDecimal(value: unknown): value is string;
+export declare function isCanonicalNativeId(value: unknown): value is string;
+/** Deterministic owner identity bound to one non-empty logical session ID. */
+export declare function ownerIdForSession(sessionId: string): string;
+export declare function ownerRelativePath(ownerId: string): string;
+export declare function manifestRelativePath(ownerId: string): string;
+export declare function assertSafeRelativePath(relativePath: string): void;
+export declare function assertSessionRoot(context: TaskArtifactOwnerStorageContext): void;
+export declare function freezeTreeSnapshot(snapshot: NativeDirectoryTreeSnapshot): NativeDirectoryTreeSnapshot;
+export declare function retainedTreeDoesNotExpandAuthority(expected: NativeDirectoryTreeSnapshot, retained: NativeDirectoryTreeSnapshot): boolean;
+export declare function sameTreeContents(left: NativeDirectoryTreeSnapshot, right: NativeDirectoryTreeSnapshot): boolean;
+export declare function sameOwnerParentIdentity(left: TaskArtifactOwnerParentIdentity, right: TaskArtifactOwnerParentIdentity): boolean;
+export declare function immutableDeletionEvidence(sessionId: string, locatorValue: TaskArtifactOwnerLocator, parentIdentityValue: TaskArtifactOwnerParentIdentity, treeSnapshotValue: NativeDirectoryTreeSnapshot): TaskArtifactOwnerDeletionEvidence;
+/** Parse a persisted locator. Missing metadata returns undefined; malformed metadata fails closed. */
+export declare function parseTaskArtifactOwnerLocator(value: unknown): TaskArtifactOwnerLocator | undefined;
+/** Validate JSON-restored tombstone evidence before it is used for exact retirement. */
+export declare function parseTaskArtifactOwnerDeletionEvidence(value: unknown): TaskArtifactOwnerDeletionEvidence;
+export declare function ownerAbsolutePath(context: TaskArtifactOwnerStorageContext, ownerId: string): string;
+export declare function isOwnerRetainedRoot(context: TaskArtifactOwnerStorageContext, ownerId: string, pathname: string): boolean;
+export declare function isKnownNativeSidePath(context: TaskArtifactOwnerStorageContext, ownerId: string, pathname: string): boolean;
+/** Validate JSON-restored native continuation data against immutable owner authorization. */
+export declare function parseTaskArtifactOwnerRetirementContinuation(context: TaskArtifactOwnerStorageContext, evidenceValue: TaskArtifactOwnerDeletionEvidence, value: unknown): TaskArtifactOwnerRetirementContinuation;
+/**
+ * Strictly decode persisted managed-journal data. Parsing does not establish current physical retirement,
+ * payload destruction, or writer quiescence.
+ */
+export declare function parseTaskArtifactOwnerRetirementOutcome(context: TaskArtifactOwnerStorageContext, evidence: TaskArtifactOwnerDeletionEvidence, value: unknown): TaskArtifactOwnerRetirementOutcome;

package/dist/types/session/task-artifact-owner-retirement.d.ts

@@ -0,0 +1,7 @@
+import { type TaskArtifactOwnerDeletionEvidence, type TaskArtifactOwnerRetirementContinuation, type TaskArtifactOwnerRetirementOutcome, type TaskArtifactOwnerStorageContext } from "./task-artifact-owner-codec";
+/** Confirm physical completion from a managed native proof, never from canonical absence alone. */
+export declare function verifyTaskArtifactOwnerPhysicalRetirement(context: TaskArtifactOwnerStorageContext, evidence: TaskArtifactOwnerDeletionEvidence, value: unknown): void;
+/** Revalidate a persisted remnant through managed authority without mutation or new payload proof. */
+export declare function verifyTaskArtifactOwnerRetirementContinuation(context: TaskArtifactOwnerStorageContext, evidenceValue: TaskArtifactOwnerDeletionEvidence, value: unknown): TaskArtifactOwnerRetirementContinuation;
+/** Continue exact native removal without widening the original owner-tree authority. */
+export declare function retireTaskArtifactOwner(context: TaskArtifactOwnerStorageContext, evidenceValue: TaskArtifactOwnerDeletionEvidence, continuationValue?: unknown): TaskArtifactOwnerRetirementOutcome;

package/dist/types/session/task-artifact-owner.d.ts

@@ -0,0 +1,10 @@
+import { ArtifactManager } from "./artifacts";
+import { type TaskArtifactOwnerLocator, type TaskArtifactOwnerStorageContext } from "./task-artifact-owner-codec";
+export interface ManagedTaskArtifactOwner {
+    readonly locator: TaskArtifactOwnerLocator;
+    readonly manager: ArtifactManager;
+}
+/** Reopen an owner only beneath the captured managed sessions-root authority. */
+export declare function restoreManagedTaskArtifactOwner(context: TaskArtifactOwnerStorageContext, sessionId: string, locatorValue: unknown): ManagedTaskArtifactOwner;
+/** Establish or restore the logical-session owner under the captured managed sessions authority. */
+export declare function ensureManagedTaskArtifactOwner(context: TaskArtifactOwnerStorageContext, sessionId: string, locatorValue: unknown, legacyArtifactRelativePath?: string): Promise<ManagedTaskArtifactOwner>;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.18.6",
+	"version": "0.18.7",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -57,12 +57,12 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.18.6",
-		"@gajae-code/agent-core": "0.18.6",
-		"@gajae-code/ai": "0.18.6",
-		"@gajae-code/natives": "0.18.6",
-		"@gajae-code/tui": "0.18.6",
-		"@gajae-code/utils": "0.18.6",
+		"@gajae-code/stats": "0.18.7",
+		"@gajae-code/agent-core": "0.18.7",
+		"@gajae-code/ai": "0.18.7",
+		"@gajae-code/natives": "0.18.7",
+		"@gajae-code/tui": "0.18.7",
+		"@gajae-code/utils": "0.18.7",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",