@gajae-code/coding-agent 0.18.7 → 0.18.8

package/dist/types/session/session-storage.d.ts

@@ -1,5 +1,7 @@
 import type * as native from "@gajae-code/natives";
+import type { ManagedGcProtocolScopeInspector } from "./internal/managed-session-scope";
 import { type ManagedDirectoryRoot } from "./internal/managed-session-storage";
+import { type TaskArtifactOwnerDeletionEvidence, type TaskArtifactOwnerRetirementContinuation, type TaskArtifactOwnerRetirementOutcome, type TaskArtifactOwnerStorageContext } from "./task-artifact-owner-codec";
 export interface SessionStorageStat {
     dev: bigint;
     ino: bigint;
@@ -312,8 +314,24 @@ export interface VerifiedSessionDeleteTarget {
     retainedTranscriptSuccessorPath?: string;
     /** Native-retained exchange placeholder observed during transcript cleanup. */
     retainedTranscriptPlaceholderPath?: string;
-    /** Native-retained transcript entry whose identity could not be verified. */
+    /** Native-retained entry whose identity could not be verified. */
     retainedTranscriptUnknownPath?: string;
+    /** Trusted managed authority for the path-free persisted task-artifact locator. */
+    taskArtifactOwnerStorageContext?: TaskArtifactOwnerStorageContext;
+    /** Exact owner-tree evidence captured before deletion and retained across retries. */
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    /** Owning journal persists the full native disposition across delete effects. */
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    /** Native terminal evidence of logical transcript deletion; pathname absence alone is insufficient. */
+    taskArtifactOwnerTranscriptDeleted?: true;
+    /** Explicitly leave owner retirement to its owning coordinator. */
+    deferTaskArtifactOwnerRetirement?: true;
+    /** Durable evidence that exact owner retirement completed. */
+    taskArtifactOwnerRetired?: true;
+    /** Exact native remnant, separate from immutable original authority. */
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
     /** Native-retained publisher successor observed during cleanup. */
     retainedArtifactsSuccessorPath?: string;
     /** Native-retained exchange placeholder observed during cleanup. */
@@ -337,8 +355,22 @@ export type VerifiedSessionDeleteResult = {
     kind: "artifacts_removed";
     phase: "artifacts";
     transcriptIdentity: SessionStorageFileIdentity;
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerTranscriptDeleted?: true;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
 } | {
     kind: "deleted";
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerTranscriptDeleted?: true;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
 } | {
     kind: "cleanup_pending";
     phase: "artifacts";
@@ -355,6 +387,27 @@ export type VerifiedSessionDeleteResult = {
     retainedSuccessorPath?: string;
     retainedPlaceholderPath?: string;
     retainedUnknownPath?: string;
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerTranscriptDeleted?: true;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
+} | {
+    kind: "cleanup_pending";
+    phase: "task_artifact_owner";
+    /** True only after verified artifact completion, never inferred from the failure phase. */
+    artifactsRemoved: boolean;
+    error: Error;
+    transcriptIdentity: SessionStorageFileIdentity;
+    taskArtifactOwnerDeletionEvidence: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerTranscriptDeleted?: true;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
 } | {
     kind: "cleanup_pending";
     phase: "transcript";
@@ -367,6 +420,13 @@ export type VerifiedSessionDeleteResult = {
     retainedSuccessorPath?: string;
     retainedPlaceholderPath?: string;
     retainedUnknownPath?: string;
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerTranscriptDeleted?: true;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
 };
 type NativeDirectoryTreeEntry = {
     relativePath: string;
@@ -469,7 +529,7 @@ export declare class FileSessionStorage implements SessionStorage {
      * revalidate, transcript last. Partial deletion returns typed cleanup_pending
      * evidence; identity/symlink/containment/header/cwd mismatch throws.
      */
-    deleteSessionVerified(target: VerifiedSessionDeleteTarget): Promise<VerifiedSessionDeleteResult>;
+    deleteSessionVerified(target: VerifiedSessionDeleteTarget, inspectProtocol?: ManagedGcProtocolScopeInspector): Promise<VerifiedSessionDeleteResult>;
 }
 export declare class MemorySessionStorage implements SessionStorage {
     #private;

package/dist/types/session/task-artifact-owner-codec.d.ts

@@ -87,6 +87,8 @@ export declare function manifestRelativePath(ownerId: string): string;
 export declare function assertSafeRelativePath(relativePath: string): void;
 export declare function assertSessionRoot(context: TaskArtifactOwnerStorageContext): void;
 export declare function freezeTreeSnapshot(snapshot: NativeDirectoryTreeSnapshot): NativeDirectoryTreeSnapshot;
+/** Project only authenticated remaining entries; never restore an omitted entry's authority. */
+export declare function normalizeRetainedTreeSnapshot(expected: NativeDirectoryTreeSnapshot, retained: NativeDirectoryTreeSnapshot): NativeDirectoryTreeSnapshot | undefined;
 export declare function retainedTreeDoesNotExpandAuthority(expected: NativeDirectoryTreeSnapshot, retained: NativeDirectoryTreeSnapshot): boolean;
 export declare function sameTreeContents(left: NativeDirectoryTreeSnapshot, right: NativeDirectoryTreeSnapshot): boolean;
 export declare function sameOwnerParentIdentity(left: TaskArtifactOwnerParentIdentity, right: TaskArtifactOwnerParentIdentity): boolean;

package/dist/types/setup/credential-auto-import.d.ts

@@ -7,7 +7,7 @@ export declare const CREDENTIAL_AUTO_IMPORT_REFRESH_WARNING = "Imported credenti
 export declare const CREDENTIAL_AUTO_IMPORT_DISCOVERY_WARNING = "External credential discovery could not be completed. Use /provider to import credentials manually.";
 export declare const CREDENTIAL_AUTO_IMPORT_RETRY_WARNING = "Some external credentials could not be imported. Use /provider to retry.";
 export declare const CREDENTIAL_AUTO_IMPORT_STATE_UNREADABLE_WARNING = "Credential import preference could not be read. External credential discovery was skipped; use /provider to import credentials manually.";
-export type CredentialAutoImportSourceLabel = "claude-code-file" | "claude-code-keychain" | "codex-file";
+export type CredentialAutoImportSourceLabel = "claude-code-file" | "claude-code-keychain" | "codex-file" | "kiro-cli-social";
 export type CredentialAutoImportTrigger = "startup" | "bare-login" | "setup-cli";
 export type InitialImportResolution = "accepted" | "declined";
 export type CredentialAutoImportStateProblem = "invalid-initial-import-resolution" | "invalid-last-import-version" | "malformed-json" | "malformed-root";

package/dist/types/setup/credential-import.d.ts

@@ -1,8 +1,8 @@
 import type { AuthCredential } from "@gajae-code/ai/core";
 /** gjc provider ids that external credentials map onto. */
-export type ExternalProvider = "anthropic" | "openai-codex";
+export type ExternalProvider = "anthropic" | "openai-codex" | "kiro";
 /** Where a discovered credential came from. */
-export type CredentialOrigin = "claude-code-file" | "claude-code-keychain" | "codex-file";
+export type CredentialOrigin = "claude-code-file" | "claude-code-keychain" | "codex-file" | "kiro-cli-social";
 export declare const AUTO_IMPORT_OAUTH_PROVIDER_ORIGINS: Record<ExternalProvider, ReadonlySet<CredentialOrigin>>;
 /** Human labels for providers, used in redacted summaries. */
 export declare const EXTERNAL_PROVIDER_LABELS: Record<ExternalProvider, string>;
@@ -66,6 +66,8 @@ export interface DiscoveryOptions {
      * or `null` when no entry exists.
      */
     readClaudeKeychain?: () => Promise<string | null>;
+    /** Absolute Kiro CLI data.sqlite3 override, primarily for tests and embedders. */
+    kiroCliDatabasePath?: string;
 }
 export type CredentialUpserter = (provider: string, credential: AuthCredential) => unknown | Promise<unknown>;
 export interface ImportSummary {
@@ -76,8 +78,8 @@ export interface ImportSummary {
     }>;
 }
 /**
- * Discover Claude Code and Codex CLI credentials across files, the macOS
- * Keychain, and environment variables. Never throws for individual unreadable or
+ * Discover Claude Code, Codex CLI, and Kiro CLI credentials across their local
+ * stores and environment variables. Never throws for individual unreadable or
  * malformed sources — those land in {@link CredentialDiscoveryResult.skipped}.
  */
 export declare function discoverExternalCredentials(options?: DiscoveryOptions): Promise<CredentialDiscoveryResult>;

package/dist/types/skill-state/active-state.d.ts

@@ -135,6 +135,44 @@ interface ActiveStateSignature {
 }
 export declare function computeActiveStateSignature(cwd: string, sessionId: string): Promise<ActiveStateSignature>;
 export declare function invalidateVisibleSkillActiveStateCache(cwd?: string, sessionId?: string): void;
+/**
+ * Outcome of a failure-observable workflow-state read:
+ * - `absent`: neither a session snapshot nor a per-skill entry is recorded.
+ * - `read`: every recorded source was read and no snapshot row lacks authority.
+ * - `recovered`: the session snapshot was unreadable, but authoritative per-skill
+ *   entries (which the snapshot is rebuilt from) supplied the visible state.
+ * - `discarded`: the snapshot is a derived cache that still lists active workflows
+ *   whose per-skill entry is gone or inactive (e.g. a deactivation whose snapshot
+ *   rebuild never ran); those stale rows were dropped and the visible state comes
+ *   from the per-skill entries alone.
+ * - `unresolved`: the snapshot lists active workflows without an active per-skill
+ *   entry, but it cannot be shown to be a derived cache, so those rows may be legacy
+ *   authority or stale cache; they are excluded without confirming their absence.
+ * - `failed`: the session snapshot was unreadable and no per-skill entry could
+ *   replace it (e.g. a corrupt legacy root-only record), so the state is unknown.
+ */
+export type VisibleSkillActiveStateReadStatus = "absent" | "read" | "recovered" | "discarded" | "unresolved" | "failed";
+export interface VisibleSkillActiveStateRead {
+    status: VisibleSkillActiveStateReadStatus;
+    /** Visible active state; `null` when nothing is active or the read failed. */
+    state: SkillActiveState | null;
+}
+/**
+ * Uncached, failure-observable counterpart of `readVisibleSkillActiveState` for
+ * read-only projections that must not present unreadable state as absence. The
+ * tolerant reader keeps mapping an unreadable session snapshot to `null` for
+ * HUD and guard callers; this variant reports `failed` or `recovered` instead.
+ *
+ * Unlike the tolerant reader, a snapshot row never survives without authority: an
+ * active row with no active per-skill entry is dropped as stale (`discarded`) when
+ * the snapshot is provably derived, or excluded as `unresolved` when it is not.
+ * Only a legacy root-only record keeps its own row. Per-skill entry read failures
+ * propagate, as they do from the tolerant reader, and so does an entry file that
+ * exists but holds no usable skill entry (e.g. `{}`): the tolerant reader skips
+ * it, which would make it indistinguishable from a deleted entry and let it pass
+ * as proof that a snapshot row is stale. The read never repairs state.
+ */
+export declare function readVisibleSkillActiveStateWithStatus(cwd: string, sessionId: string): Promise<VisibleSkillActiveStateRead>;
 export declare function readVisibleSkillActiveState(cwd: string, sessionId?: string, opts?: ReadVisibleSkillActiveStateOptions): Promise<SkillActiveState | null>;
 export declare function syncSkillActiveState(options: SyncSkillActiveStateOptions): Promise<GuardedWriteResult | undefined>;
 export interface ApplyHandoffOptions {

package/dist/types/slash-commands/helpers/progress-report.d.ts

@@ -0,0 +1,8 @@
+import type { ProjectProgressReport } from "../../progress/project-progress";
+import { type ProgressRenderStyle } from "../../progress/render-progress";
+/** Bound untrusted durable text (objectives, titles, HUD values) to one sanitized display line of `max` columns. */
+export declare function clipProgressText(text: string, max: number): string;
+/** TUI view: the `session.progress` snapshot rendered with column-aware clipping and theme colours. */
+export declare function renderProgressReportLines(report: ProjectProgressReport, style?: ProgressRenderStyle): string[];
+/** Plain text view: identical to what production ACP renders from the `session.progress` query. */
+export declare function renderProgressReportText(report: ProjectProgressReport): string;

package/dist/types/task/executor.d.ts

@@ -7,6 +7,7 @@ import type { AgentTelemetryConfig, ThinkingLevel } from "@gajae-code/agent-core
 import { type Model, type ServiceTier } from "@gajae-code/ai/core";
 import { AsyncJobManager } from "../async";
 import { type AutoroutingReasonCode } from "../config/autorouting-contract";
+import type { ModelProfileOwnershipMarker } from "../config/model-profile-ownership";
 import { ModelRegistry } from "../config/model-registry";
 import type { PromptTemplate } from "../config/prompt-templates";
 import { Settings } from "../config/settings";
@@ -71,6 +72,8 @@ export interface ExecutorOptions {
      * Manual/direct parents (no active profile) keep exact resolution.
      */
     parentActiveModelProfile?: string;
+    /** Parent session's model profile ownership marker for propagating to subagent sessions. */
+    parentModelProfileOwnershipMarker?: ModelProfileOwnershipMarker;
     parentSessionId?: string;
     parentCredentialSessionId?: string;
     thinkingLevel?: ThinkingLevel;

package/dist/types/tools/bash-skill-urls.d.ts

@@ -1,5 +1,5 @@
 import type { Skill } from "../extensibility/skills";
-import { type LocalProtocolOptions } from "../internal-urls";
+import { type LocalProtocolOptions } from "../internal-urls/local-protocol";
 import type { InternalResource } from "../internal-urls/types";
 interface InternalUrlResolver {
     canHandle(input: string): boolean;

package/dist/types/tools/index.d.ts

@@ -14,6 +14,7 @@ import type { ArtifactManager } from "../session/artifacts";
 import type { ClientBridge } from "../session/client-bridge";
 import type { FoldAdapter } from "../session/fold-coordinator";
 import type { CustomMessage } from "../session/messages";
+import type { SessionArtifactPublication } from "../session/session-manager";
 import type { ToolChoiceQueue } from "../session/tool-choice-queue";
 import type { SkillActiveEntry } from "../skill-state/active-state";
 import type { AgentOutputManager } from "../task/output-manager";
@@ -258,6 +259,8 @@ export interface ToolSession {
         id?: string;
         path?: string;
     }>;
+    /** Capture owner-bound artifact publication authority for one session lifecycle. */
+    captureArtifactPublication?: () => SessionArtifactPublication;
     /** Get session spawns */
     getSessionSpawns: () => string | null;
     /** Get resolved model string if explicitly set for this session */

package/dist/types/tools/python.d.ts

@@ -5,11 +5,19 @@ export declare function pythonKernelOwnerId(sessionId: string): string;
 export interface SessionPythonToolInput {
     /** Working directory for kernel execution (session cwd). */
     cwd: string;
+    /** Resolve the current working directory for each admitted invocation. */
+    getCwd?: () => string;
     /** Session settings used for Python runtime policy. */
     settings?: SettingsType;
+    /** Resolve the session file associated with each admitted invocation. */
+    getSessionFile?: () => string | null;
     /** Resolve the GJC session id used for the kernel owner and transcript paths. */
     getSessionId: () => string | null;
     /** Register cleanup with the current logical session lifecycle. */
-    registerSessionCleanup: (cleanup: () => Promise<void> | void) => void;
+    registerSessionCleanup: (cleanup: () => Promise<void> | void) => (() => void) | void;
+    /** Reject execution after the owning session has begun disposal. */
+    assertEvalExecutionAllowed?: () => void;
+    /** Track this whole invocation through its transcript append. */
+    trackEvalExecution?: <T>(execution: Promise<T>, abortController: AbortController) => Promise<T>;
 }
 export declare function createSessionPythonTool(input: SessionPythonToolInput): AgentTool;

package/dist/types/tools/recipe/recipe-guard.d.ts

@@ -0,0 +1,7 @@
+/** Apply the session bash planning guard to a recipe command before it runs. */
+export declare function assertRecipeCommandAllowed(input: {
+    cwd: string;
+    sessionId?: string;
+    command: string;
+    commandCwd?: string;
+}): Promise<void>;

package/dist/types/tools/restricted-cwd.d.ts

@@ -0,0 +1 @@
+export declare function assertCwdInsideWorkspace(workspace: string, commandCwd: string): Promise<void>;

package/dist/types/tools/todo-write.d.ts

@@ -51,6 +51,12 @@ declare const todoWriteSchema: z.ZodObject<{
 type TodoWriteParams = z.infer<typeof todoWriteSchema>;
 export declare const USER_TODO_EDIT_CUSTOM_TYPE = "user_todo_edit";
 export declare function getLatestTodoPhasesFromEntries(entries: SessionEntry[]): TodoPhase[];
+/**
+ * Latest persisted todo list on the branch, terminal items included. `undefined`
+ * means no todo state was ever persisted; an empty array is an authoritative
+ * empty list (for example after a bare `/todo rm`).
+ */
+export declare function findLatestTodoPhasesFromEntries(entries: SessionEntry[]): TodoPhase[] | undefined;
 /** Apply an array of `todo_write`-style ops to existing phases. Used by /todo slash command. */
 export declare function applyOpsToPhases(currentPhases: TodoPhase[], ops: TodoWriteParams["ops"]): {
     phases: TodoPhase[];

package/dist/types/utils/tools-checksum.d.ts

@@ -0,0 +1,7 @@
+export interface ReleaseAssetDigest {
+    name?: string;
+    digest?: string | null;
+}
+export declare function sha256FromReleaseDigest(digest: string | null | undefined): string | null;
+export declare function requireAssetSha256(assets: readonly ReleaseAssetDigest[], assetName: string): string;
+export declare function assertFileMatchesSha256(filePath: string, expectedSha256: string): Promise<void>;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.18.7",
+	"version": "0.18.8",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -57,12 +57,12 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.18.7",
-		"@gajae-code/agent-core": "0.18.7",
-		"@gajae-code/ai": "0.18.7",
-		"@gajae-code/natives": "0.18.7",
-		"@gajae-code/tui": "0.18.7",
-		"@gajae-code/utils": "0.18.7",
+		"@gajae-code/stats": "0.18.8",
+		"@gajae-code/agent-core": "0.18.8",
+		"@gajae-code/ai": "0.18.8",
+		"@gajae-code/natives": "0.18.8",
+		"@gajae-code/tui": "0.18.8",
+		"@gajae-code/utils": "0.18.8",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/scripts/generate-sdk-operation-inventory.ts

@@ -15,6 +15,10 @@ const LOCKED_EXCLUSIONS: Readonly<Record<string, string>> = {
 		"internal marketplace lifecycle refresh for the session skill catalog; not an independent SDK ingress operation",
 	"agent_session:getTerminalTurnEpoch":
 		"internal terminal-abort bus seam (epoch only), threaded via terminalAbortSeams; not a user-facing SDK control seam",
+	"agent_session:getTerminalRunOwnerForEvent":
+		"internal Agent-claimed event ownership proof, read only through the terminalAbortSeams bus capability; not a public SDK operation",
+	"agent_session:getRunOwnerDomain":
+		"internal run-resource ledger domain lookup for exact consuming-run ownership; not a public SDK operation",
 	"agent_session:cancelPendingPreflightForTerminalAbort":
 		"internal terminal-abort bus seam, threaded via terminalAbortSeams; not a user-facing SDK control seam",
 	"agent_session:abortPromptAndWaitWithTerminal":
@@ -62,6 +66,8 @@ const LOCKED_EXCLUSIONS: Readonly<Record<string, string>> = {
 		"local transcript-discovery metadata command; no SDK operation counterpart or runtime/retention authority",
 	"slash_command:unstar":
 		"local transcript-discovery metadata command; no SDK operation counterpart or runtime/retention authority",
+	"agent_session:getSubagentLifecycleStatuses":
+		"internal read-only subagent status projection consumed through session.progress (Q32), not a separate SDK seam",
 	"agent_session:constructor": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:getSessionAgentDir":
 		"internal session-scoped agent-directory accessor, not a user-facing SDK control seam",
@@ -205,6 +211,10 @@ const LOCKED_EXCLUSIONS: Readonly<Record<string, string>> = {
 	"agent_session:getContextUsageObservabilityForTests": "test-only observability, not a user-facing control seam",
 	"agent_session:getAutoCompactionThresholdTokens":
 		"internal compaction-threshold accessor feeding the /context breakdown; exposed through context.get, not an independent SDK operation",
+	"agent_session:resolvePromptSkillInvocation":
+		"internal prompt-dispatch classifier shared with interactive title seeding, not a user-facing control seam",
+	"agent_session:isLocallyHandledSlashCommand":
+		"internal slash-command classifier that keeps command text out of title seeding, not a user-facing control seam",
 	"agent_session:purgeQueuedCustomMessages": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:clearQueue": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:popLastQueuedMessage": "internal accessor/plumbing, not a user-facing control seam",
@@ -217,6 +227,12 @@ const LOCKED_EXCLUSIONS: Readonly<Record<string, string>> = {
 		"internal owner-recovery staged restore builder after durable claims/fencing, never a user-facing SDK operation",
 	"agent_session:setActiveModelProfile": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:getActiveModelProfile": "internal accessor/plumbing, not a user-facing control seam",
+	"agent_session:getUserModelSelectionRevision":
+		"internal session-scoped model selection revision tracking behind the reviewed model.set seam, not an independent public SDK operation",
+	"agent_session:getUserCanonicalVariantSelection":
+		"internal session-scoped model variant selection state behind the reviewed model.set seam, not an independent public SDK operation",
+	"agent_session:markUserModelSelection":
+		"internal session-scoped model selection revision marker behind the reviewed model.set seam, not an independent public SDK operation",
 	"agent_session:clearSessionOnlyModelProfileState":
 		"internal session-scoped profile lifecycle plumbing behind the reviewed model.set seam, not an independent public SDK operation",
 	"agent_session:noteProfileInstalledOverrides":
@@ -311,6 +327,10 @@ const LOCKED_EXCLUSIONS: Readonly<Record<string, string>> = {
 		"internal profile-derived eager delegation synchronization, not a user-facing SDK control seam",
 	"agent_session:submitUserMessage":
 		"public in-process embedder lifecycle API; direct handle surface, not an SDK transport operation",
+	"agent_session:setUnavailableModelProfile":
+		"internal session-scoped unavailable profile tracking; mutated by the session lifecycle on model-load failure, not a public SDK control seam",
+	"agent_session:getUnavailableModelProfile":
+		"internal session-scoped unavailable profile query for UI status rendering; not a public SDK operation",
 };
 /** Maps reviewed source seams to registry SDK operation IDs. */
 const SEAM_TO_SDK: Readonly<Record<string, string>> = {
@@ -385,6 +405,7 @@ const SEAM_TO_SDK: Readonly<Record<string, string>> = {
 	"slash_command:session": "session.list",
 	"slash_command:jobs": "runtime.jobs.list",
 	"slash_command:context": "context.get",
+	"slash_command:progress": "session.progress",
 	"slash_command:usage": "usage.get",
 	"slash_command:tools": "tools.list",
 	"slash_command:login": "auth.login",

package/scripts/verify-managed-empty-stop.ts

@@ -0,0 +1,28 @@
+import {
+	assertExecutedScenarios,
+	parseHarnessPort,
+	runManagedEmptyStopScenario,
+	scenarioNames,
+} from "../test/helpers/managed-empty-stop-harness";
+
+export async function main(args = process.argv.slice(2)): Promise<number> {
+	let executed = 0;
+	try {
+		const scenarios = scenarioNames(args);
+		const port = parseHarnessPort();
+		for (const scenario of scenarios) {
+			executed++;
+			const report = await runManagedEmptyStopScenario(scenario, port);
+			process.stdout.write(`PASS ${scenario}: ${report.providerModels.join(" -> ")}, ${report.terminal.status}\n`);
+		}
+		assertExecutedScenarios(executed);
+		return 0;
+	} catch (error) {
+		process.stderr.write(`FAIL managed-empty-stop: ${error instanceof Error ? error.message : String(error)}\n`);
+		return 1;
+	} finally {
+		process.stdout.write(`managed-empty-stop: executed ${executed} scenario(s)\n`);
+	}
+}
+
+if (import.meta.main) process.exitCode = await main();