@gajae-code/coding-agent 0.18.6 → 0.18.8

package/dist/types/session/internal/task-artifact-owner-transcript.d.ts

@@ -0,0 +1,11 @@
+import type { FileSessionStorage } from "../session-storage";
+import { type TaskArtifactOwnerLocator, type TaskArtifactOwnerStorageContext } from "../task-artifact-owner-codec";
+import type { ManagedGcProtocolScopeInspector } from "./managed-session-scope";
+/** Resolve the path-free owner locator using transcript replay's header-patch semantics. */
+export declare function taskArtifactOwnerLocatorFromTranscriptBytes(bytes: Uint8Array, expectedSessionId: string): TaskArtifactOwnerLocator | undefined;
+/**
+ * Read-only inventory of every authenticated managed cwd directory under one profile's
+ * sessions root. Any incomplete, replaced, or unrecognized inventory conservatively
+ * blocks owner retirement.
+ */
+export declare function hasSiblingTaskArtifactOwnerTranscript(storage: Pick<FileSessionStorage, "readSnapshotSync">, transcriptPath: string, locator: TaskArtifactOwnerLocator, context: TaskArtifactOwnerStorageContext, inspectProtocol?: ManagedGcProtocolScopeInspector): Promise<boolean>;

package/dist/types/session/session-manager.d.ts

@@ -638,6 +638,21 @@ export interface ResumeSessionIdentity {
     ctimeNs?: bigint;
     sha256: string;
 }
+/** Descriptor-bound bounded fingerprint for private explicit-session rollback authority.
+ * JSON-safe: all bigint fields are stored as strings to survive JSON serialization,
+ * spread, structuredClone, and JSON round-trip. */
+export type ExplicitPersistIdentity = {
+    dev: string;
+    ino: string;
+    nlink?: string;
+    size: number;
+    mtimeMs: number;
+    mtimeNs: string;
+    ctimeNs?: string;
+    canonicalPath: string;
+    sessionId: string;
+    fingerprintSha256: string;
+};
 export interface ResumeTailResumable {
     kind: "resumable";
     identity: ResumeSessionIdentity;
@@ -953,7 +968,8 @@ export interface ReadonlySessionManager {
 /** Creates an immutable facade that never exposes SessionManager mutation authority. */
 export declare function createReadonlySessionManager(manager: SessionManager): ReadonlySessionManager;
 /** Internal artifact-writing capability. Read-only facades expose it only through a private weak-map lookup. */
-export type SessionArtifactCapability = Readonly<Pick<SessionManager, "allocateArtifactPath" | "saveArtifact" | "putBlob">>;
+export type SessionArtifactPublication = (content: string, toolType: string) => Promise<string | undefined>;
+export type SessionArtifactCapability = Readonly<Pick<SessionManager, "allocateArtifactPath" | "saveArtifact" | "putBlob" | "captureArtifactPublication">>;
 /**
  * Returns the artifact capability for a concrete persistence owner or one of its
  * immutable read-only facades. Structural lookalikes remain unauthorized.
@@ -1038,6 +1054,8 @@ export declare function materializeResidentEntriesThrowingForTests<T>(entries: T
     sessionFile?: string;
 }): T[];
 export declare function materializeResidentEntriesForPersistenceForTests<T>(entries: T[], textStore: BlobStore, imageStore?: BlobStore): T[];
+export declare function isProjectSessionTranscriptPath(projectGjcDir: string, filePath: string): boolean;
+export declare function readAuthorizedProjectSessionTranscript(projectGjcDir: string, filePath: string, maxBytes: number): Buffer | undefined;
 /**
  * Discover resumable transcripts intentionally stored inside a project's `.gjc`.
  * Runtime token/audit JSONL files are excluded by requiring a known transcript
@@ -1084,10 +1102,12 @@ interface SessionManagerStateSnapshot {
     flushed: boolean;
     ensuredOnDisk: boolean;
     needsFullRewriteOnNextPersist: boolean;
-    fileEntries: FileEntry[];
-    materializedFileEntries: FileEntry[];
+    fileEntries: readonly FileEntry[];
+    materializedFileEntries: readonly FileEntry[];
     adoptedArtifactManager: ArtifactManager | null;
     coldRestoreFile?: string;
+    /** Explicit persistence identity for snapshot serialization safety. Preserved across cross-manager adoptions. */
+    readonly explicitPersistIdentity?: ExplicitPersistIdentity;
 }
 /** Benchmark-derived cap for strong materialized session snapshots. */
 export declare const MATERIALIZED_CACHE_MAX_BYTES: number;
@@ -1109,6 +1129,7 @@ export declare const SessionManagerTestHooks: {
     beforeManagedMissingReturn?: (filePath: string, storage: SessionStorage) => void | Promise<void>;
     afterManagedMissingAssertion?: (filePath: string, storage: SessionStorage) => void | Promise<void>;
     beforeManagedSwitchIdentity?: (filePath: string, storage: SessionStorage) => void | Promise<void>;
+    beforeColdRollbackCommit?: (filePath: string, storage: SessionStorage) => void | Promise<void>;
     /** Internal first-open GC strategy override; omitted means current. */
     firstOpenGcStrategy?: SessionMemoryGcStrategy;
     /** Internal first-open secondary-artifact mode override; omitted means auto. */
@@ -1428,8 +1449,11 @@ export declare class SessionManager {
      * one bound to the current session file unless an external manager was
      * adopted via `adoptArtifactManager`. Falls back to the lazily created
      * ephemeral filesystem store once a non-persistent session has saved an
-     * artifact, so `artifact://` stays resolvable. Returns null only when no
-     * store has been established yet.
+     * artifact, so `artifact://` stays resolvable. Returns null when no store has
+     * been established yet and once the manager has released its artifact
+     * authority while closing — released authority stays observable as absence
+     * (matching `isArtifactManagerAuthorized`), while artifact *operations* are
+     * fenced by `#assertArtifactOpen()` and keep throwing.
      */
     getArtifactManager(): ArtifactManager | null;
     /** Linearizably establish this session's persistent or ephemeral artifact manager. */
@@ -1449,6 +1473,8 @@ export declare class SessionManager {
      * read back from the filesystem instead of being retained in memory.
      */
     saveArtifact(content: string, toolType: string): Promise<string | undefined>;
+    /** Capture artifact publication authority for one session lifecycle. */
+    captureArtifactPublication(): SessionArtifactPublication;
     /** Inspect an evicted artifact using a bounded range read; never rehydrates by default. */
     inspectEvictedToolOutput(handle: unknown, range?: {
         start?: number;

package/dist/types/session/session-retirement.d.ts

@@ -0,0 +1,71 @@
+import type { ManagedGcSessionRetirementReceipt } from "./internal/managed-gc-retirement-codec";
+import { type ManagedScope } from "./internal/managed-session-scope";
+import { type FileSessionStorage } from "./session-storage";
+import type { TaskArtifactOwnerDeletionEvidence, TaskArtifactOwnerRetirementContinuation, TaskArtifactOwnerRetirementOutcome } from "./task-artifact-owner-codec";
+export interface SessionRetirementContinuation {
+    readonly managedScope: ManagedScope;
+}
+/**
+ * Outcome of a disk-retention retirement attempt.
+ *
+ * `kept` means the transcript survived and nothing of the session was
+ * destroyed, with the exact reason so `gjc gc --disk` can report it.
+ * `cleanup_pending` means the delete authority already detached or removed the
+ * session's artifact tree (or quarantined the transcript) before it stopped:
+ * the record survives, the session does not, and a caller must NOT report that
+ * as an ordinary keep.
+ */
+export type SessionRetirementOutcome = {
+    kind: "retired";
+    taskArtifactOwnerRetired?: true;
+} | {
+    kind: "kept";
+    reason: string;
+} | {
+    kind: "cleanup_pending";
+    reason: string;
+    phase?: "artifacts" | "transcript";
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
+    taskArtifactOwnerRetired?: true;
+};
+export type SessionRetirementProbeOutcome = Extract<SessionRetirementOutcome, {
+    kind: "cleanup_pending";
+}> | {
+    kind: "retirable";
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
+} | {
+    kind: "kept";
+    reason: string;
+};
+/**
+ * Non-mutating projection of {@link retireSessionTranscript}: would the
+ * retention pass's own preconditions let this transcript be retired at all?
+ *
+ * `gjc gc --disk` runs it so a dry run reports the verdict a prune would reach
+ * instead of promising bytes the delete authority will refuse to release. The
+ * authority's verdict (containment, identity, artifact tree) is deliberately
+ * not predicted here — it is re-derived against live state at delete time.
+ */
+export declare function probeSessionRetirement(storage: FileSessionStorage, sessionsRoot: string, transcriptPath: string, continuation?: SessionRetirementContinuation): Promise<SessionRetirementProbeOutcome>;
+export declare function retireOrphanSessionTranscript(storage: FileSessionStorage, sessionsRoot: string, continuation: SessionRetirementContinuation, receipt: ManagedGcSessionRetirementReceipt): Promise<SessionRetirementOutcome>;
+/**
+ * Retire one managed session transcript through the verified hard-delete
+ * authority.
+ *
+ * This is the only supported way for a retention pass to remove a transcript:
+ * identity, containment, header id/cwd, artifact tree and parent directory are
+ * all re-verified inside {@link FileSessionStorage.deleteSessionVerified}, and
+ * anything ambiguous fails closed as `kept` rather than deleting bytes. The
+ * caller owns the retention policy; this function owns nothing but the delete
+ * authority.
+ */
+export declare function retireSessionTranscript(storage: FileSessionStorage, sessionsRoot: string, transcriptPath: string, continuation?: SessionRetirementContinuation): Promise<SessionRetirementOutcome>;

package/dist/types/session/session-storage.d.ts

@@ -1,5 +1,7 @@
 import type * as native from "@gajae-code/natives";
+import type { ManagedGcProtocolScopeInspector } from "./internal/managed-session-scope";
 import { type ManagedDirectoryRoot } from "./internal/managed-session-storage";
+import { type TaskArtifactOwnerDeletionEvidence, type TaskArtifactOwnerRetirementContinuation, type TaskArtifactOwnerRetirementOutcome, type TaskArtifactOwnerStorageContext } from "./task-artifact-owner-codec";
 export interface SessionStorageStat {
     dev: bigint;
     ino: bigint;
@@ -312,8 +314,24 @@ export interface VerifiedSessionDeleteTarget {
     retainedTranscriptSuccessorPath?: string;
     /** Native-retained exchange placeholder observed during transcript cleanup. */
     retainedTranscriptPlaceholderPath?: string;
-    /** Native-retained transcript entry whose identity could not be verified. */
+    /** Native-retained entry whose identity could not be verified. */
     retainedTranscriptUnknownPath?: string;
+    /** Trusted managed authority for the path-free persisted task-artifact locator. */
+    taskArtifactOwnerStorageContext?: TaskArtifactOwnerStorageContext;
+    /** Exact owner-tree evidence captured before deletion and retained across retries. */
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    /** Owning journal persists the full native disposition across delete effects. */
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    /** Native terminal evidence of logical transcript deletion; pathname absence alone is insufficient. */
+    taskArtifactOwnerTranscriptDeleted?: true;
+    /** Explicitly leave owner retirement to its owning coordinator. */
+    deferTaskArtifactOwnerRetirement?: true;
+    /** Durable evidence that exact owner retirement completed. */
+    taskArtifactOwnerRetired?: true;
+    /** Exact native remnant, separate from immutable original authority. */
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
     /** Native-retained publisher successor observed during cleanup. */
     retainedArtifactsSuccessorPath?: string;
     /** Native-retained exchange placeholder observed during cleanup. */
@@ -337,8 +355,22 @@ export type VerifiedSessionDeleteResult = {
     kind: "artifacts_removed";
     phase: "artifacts";
     transcriptIdentity: SessionStorageFileIdentity;
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerTranscriptDeleted?: true;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
 } | {
     kind: "deleted";
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerTranscriptDeleted?: true;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
 } | {
     kind: "cleanup_pending";
     phase: "artifacts";
@@ -355,6 +387,27 @@ export type VerifiedSessionDeleteResult = {
     retainedSuccessorPath?: string;
     retainedPlaceholderPath?: string;
     retainedUnknownPath?: string;
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerTranscriptDeleted?: true;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
+} | {
+    kind: "cleanup_pending";
+    phase: "task_artifact_owner";
+    /** True only after verified artifact completion, never inferred from the failure phase. */
+    artifactsRemoved: boolean;
+    error: Error;
+    transcriptIdentity: SessionStorageFileIdentity;
+    taskArtifactOwnerDeletionEvidence: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerTranscriptDeleted?: true;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
 } | {
     kind: "cleanup_pending";
     phase: "transcript";
@@ -367,6 +420,13 @@ export type VerifiedSessionDeleteResult = {
     retainedSuccessorPath?: string;
     retainedPlaceholderPath?: string;
     retainedUnknownPath?: string;
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerTranscriptDeleted?: true;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
 };
 type NativeDirectoryTreeEntry = {
     relativePath: string;
@@ -469,7 +529,7 @@ export declare class FileSessionStorage implements SessionStorage {
      * revalidate, transcript last. Partial deletion returns typed cleanup_pending
      * evidence; identity/symlink/containment/header/cwd mismatch throws.
      */
-    deleteSessionVerified(target: VerifiedSessionDeleteTarget): Promise<VerifiedSessionDeleteResult>;
+    deleteSessionVerified(target: VerifiedSessionDeleteTarget, inspectProtocol?: ManagedGcProtocolScopeInspector): Promise<VerifiedSessionDeleteResult>;
 }
 export declare class MemorySessionStorage implements SessionStorage {
     #private;
@@ -512,50 +572,4 @@ export declare class MemorySessionStorage implements SessionStorage {
     openBufferedWriter(path: string, options?: SessionStorageWriterOpenOptions): SessionStorageBufferedWriter;
     openStagedWriter(path: string): StagedStreamingWriter;
 }
-/**
- * Outcome of a disk-retention retirement attempt.
- *
- * `kept` means the transcript survived and nothing of the session was
- * destroyed, with the exact reason so `gjc gc --disk` can report it.
- * `cleanup_pending` means the delete authority already detached or removed the
- * session's artifact tree (or quarantined the transcript) before it stopped:
- * the record survives, the session does not, and a caller must NOT report that
- * as an ordinary keep.
- */
-export type SessionRetirementOutcome = {
-    kind: "retired";
-} | {
-    kind: "kept";
-    reason: string;
-} | {
-    kind: "cleanup_pending";
-    reason: string;
-};
-/**
- * Non-mutating projection of {@link retireSessionTranscript}: would the
- * retention pass's own preconditions let this transcript be retired at all?
- *
- * `gjc gc --disk` runs it so a dry run reports the verdict a prune would reach
- * instead of promising bytes the delete authority will refuse to release. The
- * authority's verdict (containment, identity, artifact tree) is deliberately
- * not predicted here — it is re-derived against live state at delete time.
- */
-export declare function probeSessionRetirement(storage: FileSessionStorage, sessionsRoot: string, transcriptPath: string): {
-    kind: "retirable";
-} | {
-    kind: "kept";
-    reason: string;
-};
-/**
- * Retire one managed session transcript through the verified hard-delete
- * authority.
- *
- * This is the only supported way for a retention pass to remove a transcript:
- * identity, containment, header id/cwd, artifact tree and parent directory are
- * all re-verified inside {@link FileSessionStorage.deleteSessionVerified}, and
- * anything ambiguous fails closed as `kept` rather than deleting bytes. The
- * caller owns the retention policy; this function owns nothing but the delete
- * authority.
- */
-export declare function retireSessionTranscript(storage: FileSessionStorage, sessionsRoot: string, transcriptPath: string): Promise<SessionRetirementOutcome>;
 export {};

package/dist/types/session/session-transcript-header.d.ts

@@ -0,0 +1,2 @@
+/** Parse the first JSONL line as a generic record; returns undefined on parse failure. */
+export declare function parseFirstJsonlLine(bytes: Uint8Array): Record<string, unknown> | undefined;

package/dist/types/session/task-artifact-owner-codec.d.ts

@@ -0,0 +1,109 @@
+import type { NativeExactUnlinkResult } from "@gajae-code/natives";
+import type { ManagedDirectoryRoot, ManagedSessionSecurityPolicy } from "./internal/managed-session-storage";
+import type { NativeDirectoryTreeSnapshot } from "./session-storage";
+export declare const OWNER_DIRECTORY = ".task-artifact-owners";
+export declare const OWNER_LOCK_DIRECTORY = ".task-artifact-owner-locks";
+export declare const OWNER_MANIFEST = ".gjc-task-artifact-owner-v1.json";
+export declare const OWNER_SCHEMA_VERSION: 1;
+export declare const OWNER_DELETION_SCHEMA_VERSION: 2;
+export declare const OWNER_RETIREMENT_SCHEMA_VERSION: 1;
+export declare const EMPTY_PAYLOAD_SHA256: string;
+export interface TaskArtifactOwnerLocator {
+    readonly schemaVersion: typeof OWNER_SCHEMA_VERSION;
+    readonly ownerId: string;
+    readonly directoryDev: string;
+    readonly directoryIno: string;
+}
+export interface TaskArtifactOwnerStorageContext {
+    readonly rootAuthority: ManagedDirectoryRoot;
+    readonly sessionsRoot: string;
+    readonly securityPolicy: ManagedSessionSecurityPolicy;
+    readonly profileAgentDir: string;
+}
+/** Exact parent directory identity authorizing direct native owner-tree removal. */
+export interface TaskArtifactOwnerParentIdentity {
+    readonly dev: string;
+    readonly ino: string;
+}
+/** Immutable exact deletion input retained by managed lifecycle tombstones and retries. */
+export interface TaskArtifactOwnerDeletionEvidence {
+    readonly schemaVersion: typeof OWNER_DELETION_SCHEMA_VERSION;
+    readonly sessionId: string;
+    readonly locator: TaskArtifactOwnerLocator;
+    readonly parentIdentity: TaskArtifactOwnerParentIdentity;
+    readonly treeSnapshot: NativeDirectoryTreeSnapshot;
+}
+/** Native retained-root and side-path state safe to persist for a later retirement attempt. */
+export interface TaskArtifactOwnerRetirementContinuation {
+    readonly schemaVersion: typeof OWNER_RETIREMENT_SCHEMA_VERSION;
+    /** Must remain equal to the immutable evidence's managed owner-parent identity. */
+    readonly parentIdentity: TaskArtifactOwnerParentIdentity;
+    /** Only the original owner root or its native `.removing` sibling is actionable. */
+    readonly retainedRootPath: string;
+    /** Last identity-checked tree snapshot; it may only shrink from the original evidence. */
+    readonly retainedTreeSnapshot: NativeDirectoryTreeSnapshot;
+    /** Historical exact native detached-root roles; these paths are diagnostics, not extra authority. */
+    readonly detachedPaths?: readonly string[];
+    readonly nativeCodes?: readonly string[];
+    readonly payloadDurable?: boolean;
+    readonly retainedSuccessorPaths?: readonly string[];
+    readonly retainedPlaceholderPaths?: readonly string[];
+    readonly retainedUnknownPaths?: readonly string[];
+    readonly windowsErrorCodes?: readonly string[];
+}
+/** `completed` is decoded persisted data, not proof of physical retirement or writer closure. */
+export type TaskArtifactOwnerRetirementOutcome = {
+    readonly kind: "completed";
+    readonly evidence: TaskArtifactOwnerDeletionEvidence;
+    readonly nativeOutcome?: NativeExactUnlinkResult;
+} | {
+    /** Live payload is durably destroyed; native namespace cleanup remains pending. */
+    readonly kind: "payload_retired";
+    readonly namespace: "retained";
+    readonly evidence: TaskArtifactOwnerDeletionEvidence;
+    readonly continuation: TaskArtifactOwnerRetirementContinuation;
+    readonly nativeOutcome: NativeExactUnlinkResult;
+} | {
+    /** Native explicitly retained cleanup state with a validated, non-expanding continuation. */
+    readonly kind: "cleanup_pending";
+    readonly evidence: TaskArtifactOwnerDeletionEvidence;
+    readonly continuation: TaskArtifactOwnerRetirementContinuation;
+    readonly nativeOutcome?: NativeExactUnlinkResult;
+} | {
+    /** No safe completion proof exists; callers must retain evidence and continuation. */
+    readonly kind: "uncertain";
+    readonly evidence: TaskArtifactOwnerDeletionEvidence;
+    readonly continuation: TaskArtifactOwnerRetirementContinuation;
+    readonly reason: string;
+    readonly nativeOutcome?: NativeExactUnlinkResult;
+};
+/** True only for canonical unsigned decimal strings within the native u64 range. */
+export declare function isCanonicalDecimal(value: unknown): value is string;
+export declare function isCanonicalNativeId(value: unknown): value is string;
+/** Deterministic owner identity bound to one non-empty logical session ID. */
+export declare function ownerIdForSession(sessionId: string): string;
+export declare function ownerRelativePath(ownerId: string): string;
+export declare function manifestRelativePath(ownerId: string): string;
+export declare function assertSafeRelativePath(relativePath: string): void;
+export declare function assertSessionRoot(context: TaskArtifactOwnerStorageContext): void;
+export declare function freezeTreeSnapshot(snapshot: NativeDirectoryTreeSnapshot): NativeDirectoryTreeSnapshot;
+/** Project only authenticated remaining entries; never restore an omitted entry's authority. */
+export declare function normalizeRetainedTreeSnapshot(expected: NativeDirectoryTreeSnapshot, retained: NativeDirectoryTreeSnapshot): NativeDirectoryTreeSnapshot | undefined;
+export declare function retainedTreeDoesNotExpandAuthority(expected: NativeDirectoryTreeSnapshot, retained: NativeDirectoryTreeSnapshot): boolean;
+export declare function sameTreeContents(left: NativeDirectoryTreeSnapshot, right: NativeDirectoryTreeSnapshot): boolean;
+export declare function sameOwnerParentIdentity(left: TaskArtifactOwnerParentIdentity, right: TaskArtifactOwnerParentIdentity): boolean;
+export declare function immutableDeletionEvidence(sessionId: string, locatorValue: TaskArtifactOwnerLocator, parentIdentityValue: TaskArtifactOwnerParentIdentity, treeSnapshotValue: NativeDirectoryTreeSnapshot): TaskArtifactOwnerDeletionEvidence;
+/** Parse a persisted locator. Missing metadata returns undefined; malformed metadata fails closed. */
+export declare function parseTaskArtifactOwnerLocator(value: unknown): TaskArtifactOwnerLocator | undefined;
+/** Validate JSON-restored tombstone evidence before it is used for exact retirement. */
+export declare function parseTaskArtifactOwnerDeletionEvidence(value: unknown): TaskArtifactOwnerDeletionEvidence;
+export declare function ownerAbsolutePath(context: TaskArtifactOwnerStorageContext, ownerId: string): string;
+export declare function isOwnerRetainedRoot(context: TaskArtifactOwnerStorageContext, ownerId: string, pathname: string): boolean;
+export declare function isKnownNativeSidePath(context: TaskArtifactOwnerStorageContext, ownerId: string, pathname: string): boolean;
+/** Validate JSON-restored native continuation data against immutable owner authorization. */
+export declare function parseTaskArtifactOwnerRetirementContinuation(context: TaskArtifactOwnerStorageContext, evidenceValue: TaskArtifactOwnerDeletionEvidence, value: unknown): TaskArtifactOwnerRetirementContinuation;
+/**
+ * Strictly decode persisted managed-journal data. Parsing does not establish current physical retirement,
+ * payload destruction, or writer quiescence.
+ */
+export declare function parseTaskArtifactOwnerRetirementOutcome(context: TaskArtifactOwnerStorageContext, evidence: TaskArtifactOwnerDeletionEvidence, value: unknown): TaskArtifactOwnerRetirementOutcome;

package/dist/types/session/task-artifact-owner-retirement.d.ts

@@ -0,0 +1,7 @@
+import { type TaskArtifactOwnerDeletionEvidence, type TaskArtifactOwnerRetirementContinuation, type TaskArtifactOwnerRetirementOutcome, type TaskArtifactOwnerStorageContext } from "./task-artifact-owner-codec";
+/** Confirm physical completion from a managed native proof, never from canonical absence alone. */
+export declare function verifyTaskArtifactOwnerPhysicalRetirement(context: TaskArtifactOwnerStorageContext, evidence: TaskArtifactOwnerDeletionEvidence, value: unknown): void;
+/** Revalidate a persisted remnant through managed authority without mutation or new payload proof. */
+export declare function verifyTaskArtifactOwnerRetirementContinuation(context: TaskArtifactOwnerStorageContext, evidenceValue: TaskArtifactOwnerDeletionEvidence, value: unknown): TaskArtifactOwnerRetirementContinuation;
+/** Continue exact native removal without widening the original owner-tree authority. */
+export declare function retireTaskArtifactOwner(context: TaskArtifactOwnerStorageContext, evidenceValue: TaskArtifactOwnerDeletionEvidence, continuationValue?: unknown): TaskArtifactOwnerRetirementOutcome;

package/dist/types/session/task-artifact-owner.d.ts

@@ -0,0 +1,10 @@
+import { ArtifactManager } from "./artifacts";
+import { type TaskArtifactOwnerLocator, type TaskArtifactOwnerStorageContext } from "./task-artifact-owner-codec";
+export interface ManagedTaskArtifactOwner {
+    readonly locator: TaskArtifactOwnerLocator;
+    readonly manager: ArtifactManager;
+}
+/** Reopen an owner only beneath the captured managed sessions-root authority. */
+export declare function restoreManagedTaskArtifactOwner(context: TaskArtifactOwnerStorageContext, sessionId: string, locatorValue: unknown): ManagedTaskArtifactOwner;
+/** Establish or restore the logical-session owner under the captured managed sessions authority. */
+export declare function ensureManagedTaskArtifactOwner(context: TaskArtifactOwnerStorageContext, sessionId: string, locatorValue: unknown, legacyArtifactRelativePath?: string): Promise<ManagedTaskArtifactOwner>;

package/dist/types/setup/credential-auto-import.d.ts

@@ -7,7 +7,7 @@ export declare const CREDENTIAL_AUTO_IMPORT_REFRESH_WARNING = "Imported credenti
 export declare const CREDENTIAL_AUTO_IMPORT_DISCOVERY_WARNING = "External credential discovery could not be completed. Use /provider to import credentials manually.";
 export declare const CREDENTIAL_AUTO_IMPORT_RETRY_WARNING = "Some external credentials could not be imported. Use /provider to retry.";
 export declare const CREDENTIAL_AUTO_IMPORT_STATE_UNREADABLE_WARNING = "Credential import preference could not be read. External credential discovery was skipped; use /provider to import credentials manually.";
-export type CredentialAutoImportSourceLabel = "claude-code-file" | "claude-code-keychain" | "codex-file";
+export type CredentialAutoImportSourceLabel = "claude-code-file" | "claude-code-keychain" | "codex-file" | "kiro-cli-social";
 export type CredentialAutoImportTrigger = "startup" | "bare-login" | "setup-cli";
 export type InitialImportResolution = "accepted" | "declined";
 export type CredentialAutoImportStateProblem = "invalid-initial-import-resolution" | "invalid-last-import-version" | "malformed-json" | "malformed-root";

package/dist/types/setup/credential-import.d.ts

@@ -1,8 +1,8 @@
 import type { AuthCredential } from "@gajae-code/ai/core";
 /** gjc provider ids that external credentials map onto. */
-export type ExternalProvider = "anthropic" | "openai-codex";
+export type ExternalProvider = "anthropic" | "openai-codex" | "kiro";
 /** Where a discovered credential came from. */
-export type CredentialOrigin = "claude-code-file" | "claude-code-keychain" | "codex-file";
+export type CredentialOrigin = "claude-code-file" | "claude-code-keychain" | "codex-file" | "kiro-cli-social";
 export declare const AUTO_IMPORT_OAUTH_PROVIDER_ORIGINS: Record<ExternalProvider, ReadonlySet<CredentialOrigin>>;
 /** Human labels for providers, used in redacted summaries. */
 export declare const EXTERNAL_PROVIDER_LABELS: Record<ExternalProvider, string>;
@@ -66,6 +66,8 @@ export interface DiscoveryOptions {
      * or `null` when no entry exists.
      */
     readClaudeKeychain?: () => Promise<string | null>;
+    /** Absolute Kiro CLI data.sqlite3 override, primarily for tests and embedders. */
+    kiroCliDatabasePath?: string;
 }
 export type CredentialUpserter = (provider: string, credential: AuthCredential) => unknown | Promise<unknown>;
 export interface ImportSummary {
@@ -76,8 +78,8 @@ export interface ImportSummary {
     }>;
 }
 /**
- * Discover Claude Code and Codex CLI credentials across files, the macOS
- * Keychain, and environment variables. Never throws for individual unreadable or
+ * Discover Claude Code, Codex CLI, and Kiro CLI credentials across their local
+ * stores and environment variables. Never throws for individual unreadable or
  * malformed sources — those land in {@link CredentialDiscoveryResult.skipped}.
  */
 export declare function discoverExternalCredentials(options?: DiscoveryOptions): Promise<CredentialDiscoveryResult>;

package/dist/types/skill-state/active-state.d.ts

@@ -135,6 +135,44 @@ interface ActiveStateSignature {
 }
 export declare function computeActiveStateSignature(cwd: string, sessionId: string): Promise<ActiveStateSignature>;
 export declare function invalidateVisibleSkillActiveStateCache(cwd?: string, sessionId?: string): void;
+/**
+ * Outcome of a failure-observable workflow-state read:
+ * - `absent`: neither a session snapshot nor a per-skill entry is recorded.
+ * - `read`: every recorded source was read and no snapshot row lacks authority.
+ * - `recovered`: the session snapshot was unreadable, but authoritative per-skill
+ *   entries (which the snapshot is rebuilt from) supplied the visible state.
+ * - `discarded`: the snapshot is a derived cache that still lists active workflows
+ *   whose per-skill entry is gone or inactive (e.g. a deactivation whose snapshot
+ *   rebuild never ran); those stale rows were dropped and the visible state comes
+ *   from the per-skill entries alone.
+ * - `unresolved`: the snapshot lists active workflows without an active per-skill
+ *   entry, but it cannot be shown to be a derived cache, so those rows may be legacy
+ *   authority or stale cache; they are excluded without confirming their absence.
+ * - `failed`: the session snapshot was unreadable and no per-skill entry could
+ *   replace it (e.g. a corrupt legacy root-only record), so the state is unknown.
+ */
+export type VisibleSkillActiveStateReadStatus = "absent" | "read" | "recovered" | "discarded" | "unresolved" | "failed";
+export interface VisibleSkillActiveStateRead {
+    status: VisibleSkillActiveStateReadStatus;
+    /** Visible active state; `null` when nothing is active or the read failed. */
+    state: SkillActiveState | null;
+}
+/**
+ * Uncached, failure-observable counterpart of `readVisibleSkillActiveState` for
+ * read-only projections that must not present unreadable state as absence. The
+ * tolerant reader keeps mapping an unreadable session snapshot to `null` for
+ * HUD and guard callers; this variant reports `failed` or `recovered` instead.
+ *
+ * Unlike the tolerant reader, a snapshot row never survives without authority: an
+ * active row with no active per-skill entry is dropped as stale (`discarded`) when
+ * the snapshot is provably derived, or excluded as `unresolved` when it is not.
+ * Only a legacy root-only record keeps its own row. Per-skill entry read failures
+ * propagate, as they do from the tolerant reader, and so does an entry file that
+ * exists but holds no usable skill entry (e.g. `{}`): the tolerant reader skips
+ * it, which would make it indistinguishable from a deleted entry and let it pass
+ * as proof that a snapshot row is stale. The read never repairs state.
+ */
+export declare function readVisibleSkillActiveStateWithStatus(cwd: string, sessionId: string): Promise<VisibleSkillActiveStateRead>;
 export declare function readVisibleSkillActiveState(cwd: string, sessionId?: string, opts?: ReadVisibleSkillActiveStateOptions): Promise<SkillActiveState | null>;
 export declare function syncSkillActiveState(options: SyncSkillActiveStateOptions): Promise<GuardedWriteResult | undefined>;
 export interface ApplyHandoffOptions {

package/dist/types/slash-commands/helpers/progress-report.d.ts

@@ -0,0 +1,8 @@
+import type { ProjectProgressReport } from "../../progress/project-progress";
+import { type ProgressRenderStyle } from "../../progress/render-progress";
+/** Bound untrusted durable text (objectives, titles, HUD values) to one sanitized display line of `max` columns. */
+export declare function clipProgressText(text: string, max: number): string;
+/** TUI view: the `session.progress` snapshot rendered with column-aware clipping and theme colours. */
+export declare function renderProgressReportLines(report: ProjectProgressReport, style?: ProgressRenderStyle): string[];
+/** Plain text view: identical to what production ACP renders from the `session.progress` query. */
+export declare function renderProgressReportText(report: ProjectProgressReport): string;

package/dist/types/task/executor.d.ts

@@ -7,6 +7,7 @@ import type { AgentTelemetryConfig, ThinkingLevel } from "@gajae-code/agent-core
 import { type Model, type ServiceTier } from "@gajae-code/ai/core";
 import { AsyncJobManager } from "../async";
 import { type AutoroutingReasonCode } from "../config/autorouting-contract";
+import type { ModelProfileOwnershipMarker } from "../config/model-profile-ownership";
 import { ModelRegistry } from "../config/model-registry";
 import type { PromptTemplate } from "../config/prompt-templates";
 import { Settings } from "../config/settings";
@@ -71,6 +72,8 @@ export interface ExecutorOptions {
      * Manual/direct parents (no active profile) keep exact resolution.
      */
     parentActiveModelProfile?: string;
+    /** Parent session's model profile ownership marker for propagating to subagent sessions. */
+    parentModelProfileOwnershipMarker?: ModelProfileOwnershipMarker;
     parentSessionId?: string;
     parentCredentialSessionId?: string;
     thinkingLevel?: ThinkingLevel;

package/dist/types/tools/bash-skill-urls.d.ts

@@ -1,5 +1,5 @@
 import type { Skill } from "../extensibility/skills";
-import { type LocalProtocolOptions } from "../internal-urls";
+import { type LocalProtocolOptions } from "../internal-urls/local-protocol";
 import type { InternalResource } from "../internal-urls/types";
 interface InternalUrlResolver {
     canHandle(input: string): boolean;

package/dist/types/tools/index.d.ts

@@ -14,6 +14,7 @@ import type { ArtifactManager } from "../session/artifacts";
 import type { ClientBridge } from "../session/client-bridge";
 import type { FoldAdapter } from "../session/fold-coordinator";
 import type { CustomMessage } from "../session/messages";
+import type { SessionArtifactPublication } from "../session/session-manager";
 import type { ToolChoiceQueue } from "../session/tool-choice-queue";
 import type { SkillActiveEntry } from "../skill-state/active-state";
 import type { AgentOutputManager } from "../task/output-manager";
@@ -258,6 +259,8 @@ export interface ToolSession {
         id?: string;
         path?: string;
     }>;
+    /** Capture owner-bound artifact publication authority for one session lifecycle. */
+    captureArtifactPublication?: () => SessionArtifactPublication;
     /** Get session spawns */
     getSessionSpawns: () => string | null;
     /** Get resolved model string if explicitly set for this session */

package/dist/types/tools/python.d.ts

@@ -5,11 +5,19 @@ export declare function pythonKernelOwnerId(sessionId: string): string;
 export interface SessionPythonToolInput {
     /** Working directory for kernel execution (session cwd). */
     cwd: string;
+    /** Resolve the current working directory for each admitted invocation. */
+    getCwd?: () => string;
     /** Session settings used for Python runtime policy. */
     settings?: SettingsType;
+    /** Resolve the session file associated with each admitted invocation. */
+    getSessionFile?: () => string | null;
     /** Resolve the GJC session id used for the kernel owner and transcript paths. */
     getSessionId: () => string | null;
     /** Register cleanup with the current logical session lifecycle. */
-    registerSessionCleanup: (cleanup: () => Promise<void> | void) => void;
+    registerSessionCleanup: (cleanup: () => Promise<void> | void) => (() => void) | void;
+    /** Reject execution after the owning session has begun disposal. */
+    assertEvalExecutionAllowed?: () => void;
+    /** Track this whole invocation through its transcript append. */
+    trackEvalExecution?: <T>(execution: Promise<T>, abortController: AbortController) => Promise<T>;
 }
 export declare function createSessionPythonTool(input: SessionPythonToolInput): AgentTool;

package/dist/types/tools/recipe/recipe-guard.d.ts

@@ -0,0 +1,7 @@
+/** Apply the session bash planning guard to a recipe command before it runs. */
+export declare function assertRecipeCommandAllowed(input: {
+    cwd: string;
+    sessionId?: string;
+    command: string;
+    commandCwd?: string;
+}): Promise<void>;

package/dist/types/tools/restricted-cwd.d.ts

@@ -0,0 +1 @@
+export declare function assertCwdInsideWorkspace(workspace: string, commandCwd: string): Promise<void>;