@gajae-code/coding-agent 0.18.7 → 0.18.8

package/dist/types/progress/progress-contract.d.ts

@@ -0,0 +1,154 @@
+/** Ultragoal story status (`UltragoalGoalStatus`). */
+export type ProgressStoryStatus = "pending" | "active" | "complete" | "failed" | "blocked" | "review_blocked" | "superseded";
+/** Session goal status (`GoalStatus`). */
+export type ProgressGoalStatus = "active" | "paused" | "complete" | "dropped";
+/** Todo item status (`TodoStatus`). */
+export type ProgressTodoStatus = "pending" | "in_progress" | "completed" | "abandoned";
+/** Workflow HUD chip severity (`WorkflowHudSeverity`). */
+export type ProgressChipSeverity = "info" | "warning" | "blocked" | "error" | "success";
+/** Durable `.gjc` session-state sources that can fail to read. */
+export type ProgressDurableSource = "workflow-state" | "ultragoal-plan";
+export type ProgressBasisKind = "ultragoal-stories" | "todos" | "goal-status" | "none";
+export type ProgressHeadline = "complete" | "awaiting-completion" | "blocked" | "in-progress" | "not-started" | "paused" | "dropped" | "no-tracked-work";
+export type ProgressSignalKind = "blocker" | "pending" | "note";
+export type ProgressSignalSource = "ultragoal" | "workflow" | "subagents" | "todos" | "goal" | "state";
+export interface ProgressAgentCounts {
+    total: number;
+    running: number;
+    /** Subagents that are queued or paused. */
+    waiting: number;
+    completed: number;
+    failed: number;
+    cancelled: number;
+}
+export interface ProgressReviewVerdict {
+    skill: string;
+    verdict: string;
+}
+export declare const PROJECT_PROGRESS_SNAPSHOT_SCHEMA = "gjc.project_progress.v1";
+/** Bounds keep one snapshot well under a single SDK query page. */
+export declare const PROGRESS_SNAPSHOT_LIMITS: {
+    readonly stories: 100;
+    readonly todos: 100;
+    readonly workflows: 16;
+    readonly attention: 50;
+    readonly text: 300;
+};
+export interface ProgressSnapshotStory {
+    id: string;
+    title: string;
+    status: ProgressStoryStatus;
+    /** A completion-verification (quality-gate) receipt is recorded on the story. */
+    verificationReceipt: boolean;
+}
+export interface ProgressSnapshotTodo {
+    content: string;
+    status: ProgressTodoStatus;
+}
+export interface ProgressSnapshotWorkflow {
+    skill: string;
+    phase: string;
+    summary: string | null;
+    chips: {
+        label: string;
+        value: string | null;
+        severity: ProgressChipSeverity | null;
+    }[];
+}
+export interface ProgressSnapshotAttention {
+    kind: ProgressSignalKind;
+    source: ProgressSignalSource;
+    ref: string | null;
+    text: string;
+}
+export interface ProjectProgressSnapshot {
+    schema: typeof PROJECT_PROGRESS_SNAPSHOT_SCHEMA;
+    /** Overall completion state; identical to the `/progress` headline. */
+    state: ProgressHeadline;
+    completion: {
+        /** Which countable units the indicator was derived from; `none` means nothing is countable. */
+        basis: ProgressBasisKind;
+        done: number;
+        total: number;
+        /** Whole percent; `null` when `basis` is `none`. Never 100 while a unit is open. */
+        percent: number | null;
+        /** Every counted unit is done (the session may still be awaiting goal completion or subagents). */
+        allUnitsDone: boolean;
+        /** `state === "complete"`: units done, goal (if any) complete, no subagents running, queued, or paused. */
+        complete: boolean;
+        explanation: string;
+    };
+    execution: {
+        goal: {
+            objective: string;
+            status: ProgressGoalStatus;
+            timeUsedSeconds: number;
+        } | null;
+        ultragoal: {
+            objective: string;
+            counts: {
+                total: number;
+                complete: number;
+                active: number;
+                pending: number;
+                blocked: number;
+                superseded: number;
+            };
+            stories: ProgressSnapshotStory[];
+            omittedStories: number;
+        } | null;
+        todos: {
+            counts: {
+                total: number;
+                completed: number;
+                inProgress: number;
+                pending: number;
+                abandoned: number;
+            };
+            items: ProgressSnapshotTodo[];
+            omittedItems: number;
+        } | null;
+    };
+    activeWork: {
+        /**
+         * Active story, else the next pending one, matching the Ultragoal scheduler.
+         * Blocked, review-blocked, and failed stories are never reported here (failed
+         * stories are retried only on explicit request); `null` when nothing is schedulable.
+         */
+        story: {
+            id: string;
+            title: string;
+        } | null;
+        /** In-progress todo, else the next pending one. */
+        todo: string | null;
+        workflows: ProgressSnapshotWorkflow[];
+        /** Active workflows beyond `PROGRESS_SNAPSHOT_LIMITS.workflows` that `workflows` leaves out. */
+        omittedWorkflows: number;
+        agents: ProgressAgentCounts;
+    };
+    verification: {
+        /** Present only when at least one story is complete. */
+        storyReceipts: {
+            complete: number;
+            withReceipt: number;
+            withoutReceipt: number;
+        } | null;
+        reviewVerdicts: ProgressReviewVerdict[];
+    };
+    attention: ProgressSnapshotAttention[];
+    omittedAttention: number;
+    sources: {
+        /** Session-scoped `.gjc` state (workflows, ultragoal plan) was consulted. */
+        sessionStateRead: boolean;
+        /** Sources that exist but could not be read; excluded from every count. */
+        unreadable: ProgressDurableSource[];
+        /** Sources whose primary record was unreadable but whose contents were recovered from authoritative per-entry records. */
+        recovered: ProgressDurableSource[];
+        /** Sources whose readable derived snapshot listed entries the authoritative per-entry records do not; those stale entries were discarded. */
+        discarded: ProgressDurableSource[];
+        /** Sources listing entries whose authority could not be established; those entries are excluded and their absence is unconfirmed. */
+        unresolved: ProgressDurableSource[];
+    };
+}
+/** Strip terminal escapes/control characters and bound length; durable text is untrusted. */
+export declare function boundSnapshotText(text: string, max?: number): string;

package/dist/types/progress/progress-snapshot.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Machine-facing projection of the project progress report (SDK query
+ * `session.progress`, Q32). It is a pure re-shaping of `ProjectProgressReport`:
+ * every number, state, and attention item comes from the same computation, and
+ * the human `/progress` view renders this snapshot (`render-progress.ts`), so
+ * the two can never disagree. Absent evidence is `null`/empty, never estimated.
+ * Every bounded list reports how many entries it omitted.
+ */
+import { type ProjectProgressSnapshot } from "./progress-contract";
+import type { ProjectProgressReport } from "./project-progress";
+export declare function toProjectProgressSnapshot(report: ProjectProgressReport): ProjectProgressSnapshot;

package/dist/types/progress/project-progress.d.ts

@@ -0,0 +1,141 @@
+/**
+ * Read-only project progress projection. One report is re-shaped into the
+ * machine-facing `session.progress` SDK snapshot (`progress-snapshot.ts`), and
+ * the human-facing `/progress` view renders that same snapshot
+ * (`render-progress.ts`) in the TUI, text mode, and ACP.
+ *
+ * The completion indicator is derived exclusively from countable units that
+ * carry a durable completion status. It never weights units by size, never
+ * credits partial work on an open unit, and never infers progress from
+ * conversation text, elapsed time, or token spend. When no countable basis
+ * exists the indicator is reported as unknown instead of guessed.
+ */
+import type { SubagentLifecycle } from "../async/job-manager";
+import { type UltragoalGoalStatus } from "../gjc-runtime/ultragoal-runtime";
+import type { GoalStatus } from "../goals/state";
+import type { WorkflowHudSeverity } from "../skill-state/active-state";
+import type { TodoStatus } from "../tools/todo-write";
+import type { ProgressAgentCounts, ProgressBasisKind, ProgressDurableSource, ProgressHeadline, ProgressReviewVerdict, ProgressSignalKind, ProgressSignalSource } from "./progress-contract";
+export interface ProgressGoalInput {
+    objective: string;
+    status: GoalStatus;
+    timeUsedSeconds: number;
+}
+export interface ProgressTodoInput {
+    content: string;
+    status: TodoStatus;
+}
+export interface ProgressWorkflowChip {
+    label: string;
+    value?: string;
+    severity?: WorkflowHudSeverity;
+}
+export interface ProgressWorkflowInput {
+    skill: string;
+    phase: string;
+    summary?: string;
+    chips: ProgressWorkflowChip[];
+}
+export interface ProgressStoryInput {
+    id: string;
+    title: string;
+    status: UltragoalGoalStatus;
+    /** A completion-verification (quality-gate) receipt is recorded on the story. */
+    hasVerificationReceipt: boolean;
+}
+export interface ProgressUltragoalInput {
+    objective: string;
+    stories: ProgressStoryInput[];
+}
+export declare const PROGRESS_SOURCE_LABELS: Record<ProgressDurableSource, string>;
+export interface ProjectProgressInput {
+    goal?: ProgressGoalInput;
+    todos: ProgressTodoInput[];
+    workflows: ProgressWorkflowInput[];
+    ultragoal?: ProgressUltragoalInput;
+    subagents: SubagentLifecycle[];
+    /** Whether session-scoped `.gjc` state (workflows, ultragoal plan) was consulted at all. */
+    sessionStateRead: boolean;
+    /** Durable sources that exist but could not be read; excluded from the estimate. */
+    unreadable: ProgressDurableSource[];
+    /** Durable sources whose primary record was unreadable but whose contents were recovered from authoritative per-entry records. */
+    recovered: ProgressDurableSource[];
+    /** Durable sources whose readable derived snapshot listed entries the authoritative per-entry records do not; those stale entries were discarded. */
+    discarded: ProgressDurableSource[];
+    /** Durable sources listing entries whose authority could not be established; those entries are excluded and their absence is unconfirmed. */
+    unresolved: ProgressDurableSource[];
+}
+export interface ProgressSignal {
+    kind: ProgressSignalKind;
+    /** Which durable state produced the signal. */
+    source: ProgressSignalSource;
+    /** Stable identifier inside the source: story id, workflow skill, or durable source key. */
+    ref?: string;
+    text: string;
+}
+export interface ProgressCompletion {
+    basis: ProgressBasisKind;
+    done: number;
+    total: number;
+    /**
+     * Displayed whole percent, or undefined when no countable basis exists.
+     * Never rounds up to 100 while a unit is open, nor down to 0 once a unit is done.
+     */
+    percent: number | undefined;
+}
+export interface ProgressStoryCounts {
+    total: number;
+    complete: number;
+    active: number;
+    pending: number;
+    blocked: number;
+    superseded: number;
+    verified: number;
+    /** Active story, else the next pending one; blocked, review-blocked, and failed stories are never selected. */
+    current?: {
+        id: string;
+        title: string;
+    };
+}
+export interface ProgressTodoCounts {
+    total: number;
+    completed: number;
+    inProgress: number;
+    pending: number;
+    abandoned: number;
+    current?: string;
+}
+/** Verification evidence that durable state actually records; nothing is inferred. */
+export interface ProgressVerification {
+    /** Complete stories that carry a quality-gate completion receipt (only when stories are complete). */
+    storyReceipts?: {
+        complete: number;
+        withReceipt: number;
+    };
+    /** Latest review verdict chips published by active workflows. */
+    reviewVerdicts: ProgressReviewVerdict[];
+}
+export interface ProjectProgressReport {
+    headline: ProgressHeadline;
+    completion: ProgressCompletion;
+    /** How the completion indicator was derived, in plain words. */
+    basisExplanation: string;
+    goal?: ProgressGoalInput;
+    /** The ultragoal plan the story counts were derived from. */
+    ultragoal?: ProgressUltragoalInput;
+    stories?: ProgressStoryCounts;
+    todoItems: ProgressTodoInput[];
+    todos?: ProgressTodoCounts;
+    workflows: ProgressWorkflowInput[];
+    agents: ProgressAgentCounts;
+    verification: ProgressVerification;
+    signals: ProgressSignal[];
+    sessionStateRead: boolean;
+    unreadable: ProgressDurableSource[];
+    recovered: ProgressDurableSource[];
+    discarded: ProgressDurableSource[];
+    unresolved: ProgressDurableSource[];
+}
+/** Whole percent that never overstates (no 100 while open) nor erases (no 0 once started) progress. */
+export declare function displayPercent(done: number, total: number): number | undefined;
+export declare function computeProjectProgress(input: ProjectProgressInput): ProjectProgressReport;

package/dist/types/progress/render-progress.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Human-readable `/progress` view. It renders the machine-facing
+ * `session.progress` snapshot, so the TUI, text mode, and ACP (which reads the
+ * snapshot over the SDK) show exactly what an orchestrator receives.
+ *
+ * Like `progress-contract.ts`, this module must stay a dependency leaf: the ACP
+ * agent imports it, and the ACP entrypoint may not reach the session graph.
+ */
+import { type ProgressHeadline, type ProjectProgressSnapshot } from "./progress-contract";
+/** ACP palette copy for `/progress`, shared by the builtin registry and the production ACP agent. */
+export declare const PROGRESS_COMMAND_ACP_DESCRIPTION = "Show read-only project progress overview";
+export declare const PROGRESS_HEADLINE_LABELS: Record<ProgressHeadline, string>;
+/** Styling hooks so the TUI can colour output while ACP/text mode stays plain. */
+export interface ProgressRenderStyle {
+    bold(text: string): string;
+    fg(color: "accent" | "success" | "warning" | "error" | "dim" | "muted", text: string): string;
+}
+export interface ProgressRenderOptions {
+    style?: ProgressRenderStyle;
+    /**
+     * Sanitizes and bounds durable text to one display line of at most `max` columns.
+     * Defaults to a character-bounded plain-text clip for ACP and text mode.
+     */
+    clip?: (text: string, max: number) => string;
+    barWidth?: number;
+}
+/** Render the overview as display lines (no trailing newline). */
+export declare function renderProgressSnapshot(snapshot: ProjectProgressSnapshot, options?: ProgressRenderOptions): string[];

package/dist/types/runtime-mcp/oauth-public-url.d.ts

@@ -0,0 +1 @@
+export declare function assertPublicOAuthUrl(url: string): Promise<void>;

package/dist/types/runtime-mcp/plugin-network-boundary.d.ts

@@ -3,6 +3,7 @@ import type { MCPHttpServerConfig, MCPSseServerConfig } from "./types";
 /** Mark an in-memory plugin-bundle remote MCP config for connection-bound public-network enforcement. */
 export declare function bindPluginMcpToPublicNetwork<T extends MCPHttpServerConfig | MCPSseServerConfig>(config: T): T;
 /** The marker is an internal symbol, so persisted user MCP configs cannot opt into or forge this path. */
+export declare function usesPublicNetworkMcpFetch(config: MCPHttpServerConfig | MCPSseServerConfig): boolean;
 export declare function isPluginMcpPublicNetworkBound(config: MCPHttpServerConfig | MCPSseServerConfig): boolean;
 /**
  * Fetch a plugin-bundle MCP request through a DNS-pinned public address. Every

package/dist/types/runtime-mcp/smithery-registry.d.ts

@@ -1,4 +1,22 @@
+import { type AddressResolver } from "../web/insane/url-guard";
 import type { MCPServerConfig } from "./types";
+type SmitheryConnection = {
+    type?: "http" | "stdio";
+    deploymentUrl?: string;
+    configSchema?: SmitheryConfigSchema;
+};
+type SmitheryConfigSchema = {
+    type?: string;
+    required?: string[];
+    properties?: Record<string, SmitheryConfigProperty>;
+};
+type SmitheryConfigProperty = {
+    type?: string;
+    description?: string;
+    default?: unknown;
+    enum?: unknown[];
+    format?: string;
+};
 type RegistryInputType = "string" | "number" | "boolean";
 export type SmitherySearchResult = {
     id: string;
@@ -46,6 +64,12 @@ export declare class SmitheryRegistryError extends Error {
     status: number;
     constructor(message: string, status: number);
 }
+export declare function resolveSmitheryServerConfig(qualifiedName: string, selected: {
+    connection: SmitheryConnection;
+    useDirectHttp: boolean;
+}, options?: {
+    resolver?: AddressResolver;
+}): Promise<MCPServerConfig | null>;
 export declare function searchSmitheryRegistry(keyword: string, options?: SmitherySearchOptions): Promise<SmitherySearchResult[]>;
 export declare function toConfigName(candidate: string): string;
 export {};

package/dist/types/runtime-mcp/types.d.ts

@@ -119,6 +119,12 @@ export interface MCPHttpServerConfig extends MCPServerConfigBase {
     type: "http";
     url: string;
     headers?: Record<string, string>;
+    /**
+     * When true, every request and redirect for this URL is rechecked against
+     * the public-network policy. Persisted so a later process cannot fall back
+     * to an unguarded fetch. Ordinary localhost MCP servers leave this unset.
+     */
+    publicNetwork?: boolean;
 }
 /** SSE server configuration (deprecated, use HTTP) */
 export interface MCPSseServerConfig extends MCPServerConfigBase {

package/dist/types/sdk/acp/adapter.d.ts

@@ -129,5 +129,5 @@ export declare class AcpSdkAdapter {
     }): Promise<unknown>;
     /** Dispatches the ACP extension method names without exposing endpoint credentials. */
     handle(method: string, params?: JsonObject): Promise<unknown>;
-    registerProvider(provider: AcpProviderRegistration): Promise<void>;
+    registerProvider(provider: AcpProviderRegistration, timeoutMs?: number, deadline?: number): Promise<void>;
 }

package/dist/types/sdk/broker/broker-exit.d.ts

@@ -4,7 +4,7 @@ export type { BrokerExitWriterTestBarrier } from "./broker-exit-writer-worker";
 export declare function setBrokerExitWriterBarrierForTest(barrier?: BrokerExitWriterTestBarrier): void;
 export type BrokerExitMode = "owned-root" | "lost-root";
 export type BrokerFenceReason = "suspect-unpublished" | "observation-ambiguous" | "heartbeat-ambiguous";
-export type BrokerExitReason = "ownership-fence-expired" | "publication-liveness-timeout" | "restart-committed" | "shutdown-request" | "startup-failure" | "signal";
+export type BrokerExitReason = "ownership-fence-expired" | "publication-liveness-timeout" | "heartbeat-renewal-blocked" | "restart-committed" | "shutdown-request" | "startup-failure" | "signal";
 export type BrokerStopRequest = {
     kind: "shutdown-request";
 } | {
@@ -20,6 +20,8 @@ export interface BrokerExitRecord {
     fenceReason: BrokerFenceReason | null;
     fencedForMs: number;
     uptimeMs: number;
+    /** For a blocked heartbeat renewal: retained removal transition path. */
+    blockingLockPath?: string;
     pid: number;
     signal: "SIGINT" | "SIGTERM" | null;
     writtenAt: number;
@@ -27,7 +29,7 @@ export interface BrokerExitRecord {
 export interface BrokerStartupExitRecord {
     version: 1;
     mode: "startup";
-    reason: "startup-deadline" | "startup-signal";
+    reason: "startup-deadline" | "startup-signal" | "startup-lock-blocked";
     fenceReason: null;
     fencedForMs: 0;
     uptimeMs: number;
@@ -36,6 +38,8 @@ export interface BrokerStartupExitRecord {
     exitCode: 1 | 130 | 143;
     timeoutMs: number | null;
     writtenAt: number;
+    /** For lock-blocked reason: path to the retained removal transition. */
+    blockingLockPath?: string;
 }
 export type BrokerStartupExitWriteStatus = {
     kind: "written";

package/dist/types/sdk/broker/broker.d.ts

@@ -1,5 +1,6 @@
 import type { NativeDirectoryTreeSnapshot } from "@gajae-code/natives";
 import type { ModelProfileErrorDetails } from "../../config/model-profile-contract";
+import type { TaskArtifactOwnerDeletionEvidence, TaskArtifactOwnerRetirementContinuation } from "../../session/task-artifact-owner-codec";
 import { type SdkHostModelResolver } from "../host/model-pin";
 import { type DirectoryMigrationPolicy } from "../session-directory";
 import { type BrokerStopRequest } from "./broker-exit";
@@ -7,6 +8,7 @@ import { type BrokerDiscovery, type BrokerPublicationObservation, type RedactedB
 import { type LifecycleDurableEffectsReceipt, LifecycleLedger, type LifecycleStartupFailureReceipt } from "./lifecycle-ledger";
 import { type IndexedSession, SessionIndex } from "./session-index";
 import { type MasterCapabilityVerifier, type SpawnSubstrateFailure, type SpawnSubstrateProvider } from "./spawn-authority";
+import type { BrokerTaskArtifactOwnerRetirementDisposition } from "./task-artifact-owner-validation";
 export interface BrokerSettings {
     agentDir: string;
     packageGeneration?: string;
@@ -36,6 +38,8 @@ export interface BrokerSettings {
     restartRequestId?: string;
     /** Cancel bootstrap before retained publication when the owning CLI receives a signal. */
     startupAbortSignal?: AbortSignal;
+    /** Monotonic checkpoint deadline, leaving time for retained publication. */
+    startupCheckpointDeadline?: number;
     /** Called synchronously when retained publication establishes broker readiness. */
     onStartupReady?: () => void;
     /** Test-only delay after session checkpoint to verify unpublished discovery ownership. */
@@ -127,6 +131,19 @@ export type BrokerCleanupEvidence = {
     retainedTranscriptSuccessorPath?: string;
     retainedTranscriptPlaceholderPath?: string;
     retainedTranscriptUnknownPath?: string;
+    /** Immutable task-artifact owner authority captured before the first deletion effect. */
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    /** Latest exact native remnant; it never replaces the original deletion evidence. */
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    /** Strict owner-only wire disposition, decoded only with its separately stored evidence. */
+    taskArtifactOwnerRetirementOutcome?: BrokerTaskArtifactOwnerRetirementDisposition;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
+    taskArtifactOwnerRetired?: true;
+    /** Durable fact that transcript retirement completed while the owner namespace remains. */
+    taskArtifactOwnerTranscriptDeleted?: true;
+    /** Stable artifacts-phase owner refusal diagnostic. */
+    taskArtifactOwnerCleanupError?: string;
     /** Durable proof that artifact cleanup completed before transcript mutation. */
     artifactsRemoved?: boolean;
     artifactsAbsentAtAuthorization?: true;
@@ -362,7 +379,7 @@ export declare class Broker {
     status(): RedactedBrokerDiscovery | null;
     heartbeat(): Promise<void>;
     /** Re-observes provably live session hosts and checkpoints their liveness. */
-    heartbeatSessions(now?: number): Promise<number>;
+    heartbeatSessions(now?: number, abortSignal?: AbortSignal, deadlineAt?: number): Promise<number>;
     /**
      * Revalidate retained publication ownership and begin one synchronous effect in
      * the same stack. The callback is the authority boundary: callers must perform

package/dist/types/sdk/broker/session-index.d.ts

@@ -192,10 +192,12 @@ export declare class SessionIndex {
      * stamp of the last completed locked pass, the in-memory projection is
      * already current and the locked rescan is skipped entirely — this is what
      * keeps an idle SessionRouter reconcile (2s cadence) from re-parsing and
-     * re-checksumming the whole index forever. An append committed before the
-     * stat always changes the stamp, so a miss is impossible; a change landing
-     * after the stat is seen on the next poll, the same TOCTOU envelope a
-     * locked read has. A corrupt suffix never takes the fast path: re-scanning
+     * re-checksumming the whole index forever. The unchanged check runs before
+     * the local queue so unrelated heartbeat work cannot delay ordinary creates.
+     * Admission that requires serialized authority must use refresh() instead.
+     * An append committed before the stat always changes
+     * the stamp; a change landing after the stat is seen on the next poll, the
+     * same TOCTOU envelope a locked read has. A corrupt suffix never takes the fast path: re-scanning
      * preserves the existing re-diagnosis behavior. Returns true when state was
      * reloaded. Authority revalidation that needs the strongest available
      * snapshot inside an already-locked write (append, unregister) keeps using
@@ -229,7 +231,11 @@ export declare class SessionIndex {
      * injected retention policy to a fresh snapshot and truncates the log.
      */
     compact(): Promise<void>;
-    listSessions(probedIncarnations?: ReadonlyMap<string, string | undefined>): SessionList;
+    /**
+     * Public session rows. `sessionIds` scopes the projection to those sessions:
+     * rows for them are identical to the unscoped read, other sessions are absent.
+     */
+    listSessions(probedIncarnations?: ReadonlyMap<string, string | undefined>, sessionIds?: ReadonlySet<string>): SessionList;
     /**
      * Credential-free proof for one exact public endpoint generation.
      *
@@ -274,7 +280,7 @@ export declare class SessionIndex {
      * while the broker was down keep their stale or missing heartbeat and read as
      * unknown/not-live (never fresh forever). Returns the number of checkpoints written.
      */
-    checkpointLiveHeartbeats(now?: number): Promise<number>;
+    checkpointLiveHeartbeats(now?: number, abortSignal?: AbortSignal, deadlineAt?: number): Promise<number>;
     hostUnregisteredAfter(registration: Pick<IndexedSession, "sessionId" | "locator" | "endpointGeneration" | "pid" | "indexSeq" | "lifecycleRequestId" | "hostIncarnation" | "processIncarnation" | "endpointFileId">): {
         indexSeq: number;
         lifecycleRequestId?: string;

package/dist/types/sdk/bus/index.d.ts

@@ -17,7 +17,7 @@
  * Enable with Settings notifications config, `GJC_NOTIFICATIONS=1` (a token is
  * generated), or `GJC_NOTIFICATIONS_TOKEN`.
  */
-import { type RunSettlementProof } from "@gajae-code/agent-core";
+import { type AgentTerminalOwnerContext, type RunCancellationDomain, type RunSettlementProof } from "@gajae-code/agent-core";
 import type { Tool } from "@gajae-code/ai/core";
 import type { NotificationServer as NativeNotificationServer } from "@gajae-code/natives";
 type NotificationServer = NativeNotificationServer;
@@ -266,6 +266,15 @@ export declare class PresentationArbiter {
 interface SessionRuntime {
     server: NotificationServer;
     host: SessionSdkHost;
+    getJoinedPromptCorrelations: (owner: AgentTerminalOwnerContext) => Array<{
+        commandId: string;
+        turnId: string;
+    }>;
+    isPromptRunOwner: (correlation: {
+        commandId: string;
+        turnId: string;
+    }, owner: AgentTerminalOwnerContext) => boolean;
+    retireJoinedPromptOwners: () => void;
     /** Delivers one ring-positioned event envelope to every attached subscriber
      *  connection, applying the same capability gate as event replay. */
     broadcastEventFrame: (event: SdkFrame) => string[];
@@ -640,6 +649,8 @@ export declare function createNotificationsExtension(api: ExtensionAPI, options?
      * preflight outside the durable admission path (review thread P2).
      */
     terminalAbortSeams?: {
+        getTerminalRunOwnerForEvent?: (event: object) => AgentTerminalOwnerContext | undefined;
+        getRunOwnerDomain?: (handle: string) => RunCancellationDomain | undefined;
         getTerminalTurnEpoch: () => number | undefined;
         cancelPendingPreflightForTerminalAbort: () => void;
         captureTerminalAbortSteeringSnapshot?: () => void;

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -291,8 +291,13 @@ export declare const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * so generation-191 owners cannot reap hosts with queued or promoted work.
  * Generation 193 gates streamed content on negotiated observer capabilities,
  * so existing owners are replaced before exposing the new observer path.
+ * Generation 201 binds queued cancellation and terminal deadlines to the exact
+ * consuming run, so pre-fix owners cannot serve the new generic lifecycle path.
+ * Generation 202 joins queued-removal terminal publication before ordinary
+ * abort acknowledgement, replacing owners that still acknowledge cancellation
+ * before its terminal record is durable.
  */
-export declare const DAEMON_GENERATION = 200;
+export declare const DAEMON_GENERATION = 202;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7
  * requires durable publication receipts and acknowledged attachment dispatch,

package/dist/types/sdk/client/client.d.ts

@@ -58,6 +58,8 @@ export interface SdkClientOptions {
 }
 export interface SdkRequestOptions {
     timeoutMs?: number;
+    /** Absolute wall-clock deadline for this request, including connection setup. */
+    deadline?: number;
     idempotencyKey?: string;
     confirm?: boolean;
     /**

package/dist/types/sdk/host/query/handlers.d.ts

@@ -1,3 +1,4 @@
+import type { ProjectProgressSnapshot } from "../../../progress/progress-contract.js";
 import type { ActiveProviderDescriptor } from "../../providers.js";
 import { type CursorRegistry } from "./cursor.js";
 import type { RevisionStore } from "./revision-store.js";
@@ -33,6 +34,8 @@ export interface SessionSurface {
         totalBytes: number;
     } | undefined>;
     getJobs(): unknown | Promise<unknown>;
+    /** Q32 read-only project progress snapshot (`gjc.project_progress.v1`). */
+    getProjectProgress?(): ProjectProgressSnapshot | Promise<ProjectProgressSnapshot>;
     /** Q26 keyed lookup of a submitted prompt's authoritative reconciliation status. */
     getPromptStatus?(selector: {
         commandId?: string;

package/dist/types/sdk/index.d.ts

@@ -1,4 +1,5 @@
 export { MODEL_PROFILE_DISCOVERY_QUERY, MODEL_PROFILE_ERROR_DETAIL_MAX_BYTES, type ModelProfileCatalogItem, type ModelProfileErrorCode, type ModelProfileErrorDetails, ModelProfileRegistryError, type ModelProfileRegistryErrorDetails, type UnknownModelProfileDetails, UnknownModelProfileError, } from "../config/model-profile-contract";
+export { PROJECT_PROGRESS_SNAPSHOT_SCHEMA, type ProgressSnapshotAttention, type ProgressSnapshotStory, type ProgressSnapshotTodo, type ProgressSnapshotWorkflow, type ProjectProgressSnapshot, } from "../progress/progress-contract";
 export type { QueuedInputAdmission, QueuedInputDelivery, QueuedInputExecution, QueuedInputQueuePolicy, QueuedInputRemovalReason, QueuedInputSubmission, QueuedInputTerminal, SendUserMessageOptions, TrackedSendUserMessageOptions, } from "../session/agent-session";
 export * as bus from "./bus";
 export * from "./diagnostics/observe-broker";

package/dist/types/sdk/router/session-router.d.ts

@@ -112,6 +112,7 @@ export interface SessionRouterClient {
     connect?(): Promise<void>;
     request(frame: Record<string, unknown>, options?: {
         timeoutMs?: number;
+        deadline?: number;
         connectedOnly?: boolean;
         /** Synchronous pre-send observer; a throw aborts the dispatch before the wire. */
         beforeDispatch?: (context: SdkDispatchContext) => void;
@@ -224,6 +225,7 @@ export declare class SessionRouter {
     /** Sends an SDK command through the current attachment without exposing its client. */
     request(sessionId: string, frame: Record<string, unknown>, expectedGeneration?: number, expectedAttachment?: SessionAttachment, options?: {
         timeoutMs?: number;
+        deadline?: number;
         beforeDispatch?: (context: SdkDispatchContext) => void;
         onDispatch?: SdkDispatchHandler;
         dispatchFence?: (dispatch: () => Promise<Record<string, unknown>>) => Promise<Record<string, unknown>>;

package/dist/types/sdk/session-list.d.ts

@@ -1,6 +1,6 @@
 export type SessionListPageRecord = Record<string, unknown>;
 export type SessionListSavedSessionOmissionReason = "scope_unavailable" | "candidate_scan_failed" | "candidate_not_found" | "candidate_ambiguous" | "candidate_invalid" | "identity_incomplete";
-export declare const SESSION_LIST_SAVED_SESSION_OMISSION_DETAIL_CODES: readonly ["cwd_missing", "cwd_not_directory", "identity_unavailable", "network_unsupported", "sessions_root_unavailable", "binding_conflict", "binding_invalid", "migration_busy", "atomic_unavailable", "invalid_request", "durability_failed", "durability_not_provable", "capacity_exceeded", "scan_failed", "unsafe_root", "invalid_candidate", "invalid_header", "unreadable_candidate", "source_changed", "cwd_not_found", "cwd_not_utf8", "cwd_network_unsupported", "cwd_identity_unavailable", "cwd_io_error"];
+export declare const SESSION_LIST_SAVED_SESSION_OMISSION_DETAIL_CODES: readonly ["cwd_missing", "cwd_not_directory", "identity_unavailable", "network_unsupported", "sessions_root_unavailable", "binding_conflict", "binding_invalid", "migration_busy", "managed_gc_journal_capacity_exceeded", "atomic_unavailable", "invalid_request", "durability_failed", "durability_not_provable", "capacity_exceeded", "scan_failed", "unsafe_root", "invalid_candidate", "invalid_header", "unreadable_candidate", "source_changed", "cwd_not_found", "cwd_not_utf8", "cwd_network_unsupported", "cwd_identity_unavailable", "cwd_io_error"];
 export type SessionListSavedSessionOmissionDetailCode = (typeof SESSION_LIST_SAVED_SESSION_OMISSION_DETAIL_CODES)[number];
 /** Path-free diagnostic for a requested managed transcript that could not be selected safely. */
 export interface SessionListSavedSessionOmission {