@gajae-code/coding-agent 0.18.7 → 0.18.9

package/dist/types/session/internal/task-artifact-owner-transcript.d.ts

@@ -1,3 +1,11 @@
-import { type TaskArtifactOwnerLocator } from "../task-artifact-owner-codec";
+import type { FileSessionStorage } from "../session-storage";
+import { type TaskArtifactOwnerLocator, type TaskArtifactOwnerStorageContext } from "../task-artifact-owner-codec";
+import type { ManagedGcProtocolScopeInspector } from "./managed-session-scope";
 /** Resolve the path-free owner locator using transcript replay's header-patch semantics. */
 export declare function taskArtifactOwnerLocatorFromTranscriptBytes(bytes: Uint8Array, expectedSessionId: string): TaskArtifactOwnerLocator | undefined;
+/**
+ * Read-only inventory of every authenticated managed cwd directory under one profile's
+ * sessions root. Any incomplete, replaced, or unrecognized inventory conservatively
+ * blocks owner retirement.
+ */
+export declare function hasSiblingTaskArtifactOwnerTranscript(storage: Pick<FileSessionStorage, "readSnapshotSync">, transcriptPath: string, locator: TaskArtifactOwnerLocator, context: TaskArtifactOwnerStorageContext, inspectProtocol?: ManagedGcProtocolScopeInspector): Promise<boolean>;

package/dist/types/session/session-manager.d.ts

@@ -638,6 +638,21 @@ export interface ResumeSessionIdentity {
     ctimeNs?: bigint;
     sha256: string;
 }
+/** Descriptor-bound bounded fingerprint for private explicit-session rollback authority.
+ * JSON-safe: all bigint fields are stored as strings to survive JSON serialization,
+ * spread, structuredClone, and JSON round-trip. */
+export type ExplicitPersistIdentity = {
+    dev: string;
+    ino: string;
+    nlink?: string;
+    size: number;
+    mtimeMs: number;
+    mtimeNs: string;
+    ctimeNs?: string;
+    canonicalPath: string;
+    sessionId: string;
+    fingerprintSha256: string;
+};
 export interface ResumeTailResumable {
     kind: "resumable";
     identity: ResumeSessionIdentity;
@@ -953,7 +968,8 @@ export interface ReadonlySessionManager {
 /** Creates an immutable facade that never exposes SessionManager mutation authority. */
 export declare function createReadonlySessionManager(manager: SessionManager): ReadonlySessionManager;
 /** Internal artifact-writing capability. Read-only facades expose it only through a private weak-map lookup. */
-export type SessionArtifactCapability = Readonly<Pick<SessionManager, "allocateArtifactPath" | "saveArtifact" | "putBlob">>;
+export type SessionArtifactPublication = (content: string, toolType: string) => Promise<string | undefined>;
+export type SessionArtifactCapability = Readonly<Pick<SessionManager, "allocateArtifactPath" | "saveArtifact" | "putBlob" | "captureArtifactPublication">>;
 /**
  * Returns the artifact capability for a concrete persistence owner or one of its
  * immutable read-only facades. Structural lookalikes remain unauthorized.
@@ -1038,6 +1054,8 @@ export declare function materializeResidentEntriesThrowingForTests<T>(entries: T
     sessionFile?: string;
 }): T[];
 export declare function materializeResidentEntriesForPersistenceForTests<T>(entries: T[], textStore: BlobStore, imageStore?: BlobStore): T[];
+export declare function isProjectSessionTranscriptPath(projectGjcDir: string, filePath: string): boolean;
+export declare function readAuthorizedProjectSessionTranscript(projectGjcDir: string, filePath: string, maxBytes: number): Buffer | undefined;
 /**
  * Discover resumable transcripts intentionally stored inside a project's `.gjc`.
  * Runtime token/audit JSONL files are excluded by requiring a known transcript
@@ -1084,10 +1102,12 @@ interface SessionManagerStateSnapshot {
     flushed: boolean;
     ensuredOnDisk: boolean;
     needsFullRewriteOnNextPersist: boolean;
-    fileEntries: FileEntry[];
-    materializedFileEntries: FileEntry[];
+    fileEntries: readonly FileEntry[];
+    materializedFileEntries: readonly FileEntry[];
     adoptedArtifactManager: ArtifactManager | null;
     coldRestoreFile?: string;
+    /** Explicit persistence identity for snapshot serialization safety. Preserved across cross-manager adoptions. */
+    readonly explicitPersistIdentity?: ExplicitPersistIdentity;
 }
 /** Benchmark-derived cap for strong materialized session snapshots. */
 export declare const MATERIALIZED_CACHE_MAX_BYTES: number;
@@ -1109,6 +1129,7 @@ export declare const SessionManagerTestHooks: {
     beforeManagedMissingReturn?: (filePath: string, storage: SessionStorage) => void | Promise<void>;
     afterManagedMissingAssertion?: (filePath: string, storage: SessionStorage) => void | Promise<void>;
     beforeManagedSwitchIdentity?: (filePath: string, storage: SessionStorage) => void | Promise<void>;
+    beforeColdRollbackCommit?: (filePath: string, storage: SessionStorage) => void | Promise<void>;
     /** Internal first-open GC strategy override; omitted means current. */
     firstOpenGcStrategy?: SessionMemoryGcStrategy;
     /** Internal first-open secondary-artifact mode override; omitted means auto. */
@@ -1428,8 +1449,11 @@ export declare class SessionManager {
      * one bound to the current session file unless an external manager was
      * adopted via `adoptArtifactManager`. Falls back to the lazily created
      * ephemeral filesystem store once a non-persistent session has saved an
-     * artifact, so `artifact://` stays resolvable. Returns null only when no
-     * store has been established yet.
+     * artifact, so `artifact://` stays resolvable. Returns null when no store has
+     * been established yet and once the manager has released its artifact
+     * authority while closing — released authority stays observable as absence
+     * (matching `isArtifactManagerAuthorized`), while artifact *operations* are
+     * fenced by `#assertArtifactOpen()` and keep throwing.
      */
     getArtifactManager(): ArtifactManager | null;
     /** Linearizably establish this session's persistent or ephemeral artifact manager. */
@@ -1449,6 +1473,8 @@ export declare class SessionManager {
      * read back from the filesystem instead of being retained in memory.
      */
     saveArtifact(content: string, toolType: string): Promise<string | undefined>;
+    /** Capture artifact publication authority for one session lifecycle. */
+    captureArtifactPublication(): SessionArtifactPublication;
     /** Inspect an evicted artifact using a bounded range read; never rehydrates by default. */
     inspectEvictedToolOutput(handle: unknown, range?: {
         start?: number;

package/dist/types/session/session-retirement.d.ts

@@ -1,4 +1,10 @@
+import type { ManagedGcSessionRetirementReceipt } from "./internal/managed-gc-retirement-codec";
+import { type ManagedScope } from "./internal/managed-session-scope";
 import { type FileSessionStorage } from "./session-storage";
+import type { TaskArtifactOwnerDeletionEvidence, TaskArtifactOwnerRetirementContinuation, TaskArtifactOwnerRetirementOutcome } from "./task-artifact-owner-codec";
+export interface SessionRetirementContinuation {
+    readonly managedScope: ManagedScope;
+}
 /**
  * Outcome of a disk-retention retirement attempt.
  *
@@ -11,12 +17,34 @@ import { type FileSessionStorage } from "./session-storage";
  */
 export type SessionRetirementOutcome = {
     kind: "retired";
+    taskArtifactOwnerRetired?: true;
 } | {
     kind: "kept";
     reason: string;
 } | {
     kind: "cleanup_pending";
     reason: string;
+    phase?: "artifacts" | "transcript";
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
+    taskArtifactOwnerRetired?: true;
+};
+export type SessionRetirementProbeOutcome = Extract<SessionRetirementOutcome, {
+    kind: "cleanup_pending";
+}> | {
+    kind: "retirable";
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
+} | {
+    kind: "kept";
+    reason: string;
 };
 /**
  * Non-mutating projection of {@link retireSessionTranscript}: would the
@@ -27,12 +55,8 @@ export type SessionRetirementOutcome = {
  * authority's verdict (containment, identity, artifact tree) is deliberately
  * not predicted here — it is re-derived against live state at delete time.
  */
-export declare function probeSessionRetirement(storage: FileSessionStorage, sessionsRoot: string, transcriptPath: string): {
-    kind: "retirable";
-} | {
-    kind: "kept";
-    reason: string;
-};
+export declare function probeSessionRetirement(storage: FileSessionStorage, sessionsRoot: string, transcriptPath: string, continuation?: SessionRetirementContinuation): Promise<SessionRetirementProbeOutcome>;
+export declare function retireOrphanSessionTranscript(storage: FileSessionStorage, sessionsRoot: string, continuation: SessionRetirementContinuation, receipt: ManagedGcSessionRetirementReceipt): Promise<SessionRetirementOutcome>;
 /**
  * Retire one managed session transcript through the verified hard-delete
  * authority.
@@ -44,4 +68,4 @@ export declare function probeSessionRetirement(storage: FileSessionStorage, sess
  * caller owns the retention policy; this function owns nothing but the delete
  * authority.
  */
-export declare function retireSessionTranscript(storage: FileSessionStorage, sessionsRoot: string, transcriptPath: string): Promise<SessionRetirementOutcome>;
+export declare function retireSessionTranscript(storage: FileSessionStorage, sessionsRoot: string, transcriptPath: string, continuation?: SessionRetirementContinuation): Promise<SessionRetirementOutcome>;

package/dist/types/session/session-storage.d.ts

@@ -1,5 +1,7 @@
 import type * as native from "@gajae-code/natives";
+import type { ManagedGcProtocolScopeInspector } from "./internal/managed-session-scope";
 import { type ManagedDirectoryRoot } from "./internal/managed-session-storage";
+import { type TaskArtifactOwnerDeletionEvidence, type TaskArtifactOwnerRetirementContinuation, type TaskArtifactOwnerRetirementOutcome, type TaskArtifactOwnerStorageContext } from "./task-artifact-owner-codec";
 export interface SessionStorageStat {
     dev: bigint;
     ino: bigint;
@@ -312,8 +314,24 @@ export interface VerifiedSessionDeleteTarget {
     retainedTranscriptSuccessorPath?: string;
     /** Native-retained exchange placeholder observed during transcript cleanup. */
     retainedTranscriptPlaceholderPath?: string;
-    /** Native-retained transcript entry whose identity could not be verified. */
+    /** Native-retained entry whose identity could not be verified. */
     retainedTranscriptUnknownPath?: string;
+    /** Trusted managed authority for the path-free persisted task-artifact locator. */
+    taskArtifactOwnerStorageContext?: TaskArtifactOwnerStorageContext;
+    /** Exact owner-tree evidence captured before deletion and retained across retries. */
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    /** Owning journal persists the full native disposition across delete effects. */
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    /** Native terminal evidence of logical transcript deletion; pathname absence alone is insufficient. */
+    taskArtifactOwnerTranscriptDeleted?: true;
+    /** Explicitly leave owner retirement to its owning coordinator. */
+    deferTaskArtifactOwnerRetirement?: true;
+    /** Durable evidence that exact owner retirement completed. */
+    taskArtifactOwnerRetired?: true;
+    /** Exact native remnant, separate from immutable original authority. */
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
     /** Native-retained publisher successor observed during cleanup. */
     retainedArtifactsSuccessorPath?: string;
     /** Native-retained exchange placeholder observed during cleanup. */
@@ -337,8 +355,22 @@ export type VerifiedSessionDeleteResult = {
     kind: "artifacts_removed";
     phase: "artifacts";
     transcriptIdentity: SessionStorageFileIdentity;
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerTranscriptDeleted?: true;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
 } | {
     kind: "deleted";
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerTranscriptDeleted?: true;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
 } | {
     kind: "cleanup_pending";
     phase: "artifacts";
@@ -355,6 +387,27 @@ export type VerifiedSessionDeleteResult = {
     retainedSuccessorPath?: string;
     retainedPlaceholderPath?: string;
     retainedUnknownPath?: string;
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerTranscriptDeleted?: true;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
+} | {
+    kind: "cleanup_pending";
+    phase: "task_artifact_owner";
+    /** True only after verified artifact completion, never inferred from the failure phase. */
+    artifactsRemoved: boolean;
+    error: Error;
+    transcriptIdentity: SessionStorageFileIdentity;
+    taskArtifactOwnerDeletionEvidence: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerTranscriptDeleted?: true;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
 } | {
     kind: "cleanup_pending";
     phase: "transcript";
@@ -367,6 +420,13 @@ export type VerifiedSessionDeleteResult = {
     retainedSuccessorPath?: string;
     retainedPlaceholderPath?: string;
     retainedUnknownPath?: string;
+    taskArtifactOwnerDeletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    taskArtifactOwnerRetirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    taskArtifactOwnerTranscriptDeleted?: true;
+    taskArtifactOwnerRetired?: true;
+    taskArtifactOwnerRetirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    taskArtifactOwnerPayloadRetired?: true;
+    taskArtifactOwnerNamespaceRetained?: true;
 };
 type NativeDirectoryTreeEntry = {
     relativePath: string;
@@ -384,6 +444,13 @@ export type NativeDirectoryTreeSnapshot = {
     rootIno: string;
     entries: NativeDirectoryTreeEntry[];
 };
+/**
+ * Replace an explicit session file. Creation mode `0600` does not install a
+ * Windows owner-only DACL, so this applies and verifies the same native path a
+ * primary transcript uses when it has no managed security context. POSIX mode
+ * stays `0600`.
+ */
+export declare function writeExplicitOwnerOnlyTextSync(pathname: string, content: string): void;
 /** Physically observed commit-marker state; corrupt JSON is still `present`. */
 export type SessionCommitMarkerState = {
     kind: "missing";
@@ -469,7 +536,7 @@ export declare class FileSessionStorage implements SessionStorage {
      * revalidate, transcript last. Partial deletion returns typed cleanup_pending
      * evidence; identity/symlink/containment/header/cwd mismatch throws.
      */
-    deleteSessionVerified(target: VerifiedSessionDeleteTarget): Promise<VerifiedSessionDeleteResult>;
+    deleteSessionVerified(target: VerifiedSessionDeleteTarget, inspectProtocol?: ManagedGcProtocolScopeInspector): Promise<VerifiedSessionDeleteResult>;
 }
 export declare class MemorySessionStorage implements SessionStorage {
     #private;

package/dist/types/session/task-artifact-owner-codec.d.ts

@@ -87,6 +87,8 @@ export declare function manifestRelativePath(ownerId: string): string;
 export declare function assertSafeRelativePath(relativePath: string): void;
 export declare function assertSessionRoot(context: TaskArtifactOwnerStorageContext): void;
 export declare function freezeTreeSnapshot(snapshot: NativeDirectoryTreeSnapshot): NativeDirectoryTreeSnapshot;
+/** Project only authenticated remaining entries; never restore an omitted entry's authority. */
+export declare function normalizeRetainedTreeSnapshot(expected: NativeDirectoryTreeSnapshot, retained: NativeDirectoryTreeSnapshot): NativeDirectoryTreeSnapshot | undefined;
 export declare function retainedTreeDoesNotExpandAuthority(expected: NativeDirectoryTreeSnapshot, retained: NativeDirectoryTreeSnapshot): boolean;
 export declare function sameTreeContents(left: NativeDirectoryTreeSnapshot, right: NativeDirectoryTreeSnapshot): boolean;
 export declare function sameOwnerParentIdentity(left: TaskArtifactOwnerParentIdentity, right: TaskArtifactOwnerParentIdentity): boolean;

package/dist/types/setup/credential-auto-import.d.ts

@@ -7,7 +7,7 @@ export declare const CREDENTIAL_AUTO_IMPORT_REFRESH_WARNING = "Imported credenti
 export declare const CREDENTIAL_AUTO_IMPORT_DISCOVERY_WARNING = "External credential discovery could not be completed. Use /provider to import credentials manually.";
 export declare const CREDENTIAL_AUTO_IMPORT_RETRY_WARNING = "Some external credentials could not be imported. Use /provider to retry.";
 export declare const CREDENTIAL_AUTO_IMPORT_STATE_UNREADABLE_WARNING = "Credential import preference could not be read. External credential discovery was skipped; use /provider to import credentials manually.";
-export type CredentialAutoImportSourceLabel = "claude-code-file" | "claude-code-keychain" | "codex-file";
+export type CredentialAutoImportSourceLabel = "claude-code-file" | "claude-code-keychain" | "codex-file" | "kiro-cli-social";
 export type CredentialAutoImportTrigger = "startup" | "bare-login" | "setup-cli";
 export type InitialImportResolution = "accepted" | "declined";
 export type CredentialAutoImportStateProblem = "invalid-initial-import-resolution" | "invalid-last-import-version" | "malformed-json" | "malformed-root";

package/dist/types/setup/credential-import.d.ts

@@ -1,8 +1,8 @@
 import type { AuthCredential } from "@gajae-code/ai/core";
 /** gjc provider ids that external credentials map onto. */
-export type ExternalProvider = "anthropic" | "openai-codex";
+export type ExternalProvider = "anthropic" | "openai-codex" | "kiro";
 /** Where a discovered credential came from. */
-export type CredentialOrigin = "claude-code-file" | "claude-code-keychain" | "codex-file";
+export type CredentialOrigin = "claude-code-file" | "claude-code-keychain" | "codex-file" | "kiro-cli-social";
 export declare const AUTO_IMPORT_OAUTH_PROVIDER_ORIGINS: Record<ExternalProvider, ReadonlySet<CredentialOrigin>>;
 /** Human labels for providers, used in redacted summaries. */
 export declare const EXTERNAL_PROVIDER_LABELS: Record<ExternalProvider, string>;
@@ -66,6 +66,8 @@ export interface DiscoveryOptions {
      * or `null` when no entry exists.
      */
     readClaudeKeychain?: () => Promise<string | null>;
+    /** Absolute Kiro CLI data.sqlite3 override, primarily for tests and embedders. */
+    kiroCliDatabasePath?: string;
 }
 export type CredentialUpserter = (provider: string, credential: AuthCredential) => unknown | Promise<unknown>;
 export interface ImportSummary {
@@ -76,8 +78,8 @@ export interface ImportSummary {
     }>;
 }
 /**
- * Discover Claude Code and Codex CLI credentials across files, the macOS
- * Keychain, and environment variables. Never throws for individual unreadable or
+ * Discover Claude Code, Codex CLI, and Kiro CLI credentials across their local
+ * stores and environment variables. Never throws for individual unreadable or
  * malformed sources — those land in {@link CredentialDiscoveryResult.skipped}.
  */
 export declare function discoverExternalCredentials(options?: DiscoveryOptions): Promise<CredentialDiscoveryResult>;

package/dist/types/skill-state/active-state.d.ts

@@ -135,6 +135,44 @@ interface ActiveStateSignature {
 }
 export declare function computeActiveStateSignature(cwd: string, sessionId: string): Promise<ActiveStateSignature>;
 export declare function invalidateVisibleSkillActiveStateCache(cwd?: string, sessionId?: string): void;
+/**
+ * Outcome of a failure-observable workflow-state read:
+ * - `absent`: neither a session snapshot nor a per-skill entry is recorded.
+ * - `read`: every recorded source was read and no snapshot row lacks authority.
+ * - `recovered`: the session snapshot was unreadable, but authoritative per-skill
+ *   entries (which the snapshot is rebuilt from) supplied the visible state.
+ * - `discarded`: the snapshot is a derived cache that still lists active workflows
+ *   whose per-skill entry is gone or inactive (e.g. a deactivation whose snapshot
+ *   rebuild never ran); those stale rows were dropped and the visible state comes
+ *   from the per-skill entries alone.
+ * - `unresolved`: the snapshot lists active workflows without an active per-skill
+ *   entry, but it cannot be shown to be a derived cache, so those rows may be legacy
+ *   authority or stale cache; they are excluded without confirming their absence.
+ * - `failed`: the session snapshot was unreadable and no per-skill entry could
+ *   replace it (e.g. a corrupt legacy root-only record), so the state is unknown.
+ */
+export type VisibleSkillActiveStateReadStatus = "absent" | "read" | "recovered" | "discarded" | "unresolved" | "failed";
+export interface VisibleSkillActiveStateRead {
+    status: VisibleSkillActiveStateReadStatus;
+    /** Visible active state; `null` when nothing is active or the read failed. */
+    state: SkillActiveState | null;
+}
+/**
+ * Uncached, failure-observable counterpart of `readVisibleSkillActiveState` for
+ * read-only projections that must not present unreadable state as absence. The
+ * tolerant reader keeps mapping an unreadable session snapshot to `null` for
+ * HUD and guard callers; this variant reports `failed` or `recovered` instead.
+ *
+ * Unlike the tolerant reader, a snapshot row never survives without authority: an
+ * active row with no active per-skill entry is dropped as stale (`discarded`) when
+ * the snapshot is provably derived, or excluded as `unresolved` when it is not.
+ * Only a legacy root-only record keeps its own row. Per-skill entry read failures
+ * propagate, as they do from the tolerant reader, and so does an entry file that
+ * exists but holds no usable skill entry (e.g. `{}`): the tolerant reader skips
+ * it, which would make it indistinguishable from a deleted entry and let it pass
+ * as proof that a snapshot row is stale. The read never repairs state.
+ */
+export declare function readVisibleSkillActiveStateWithStatus(cwd: string, sessionId: string): Promise<VisibleSkillActiveStateRead>;
 export declare function readVisibleSkillActiveState(cwd: string, sessionId?: string, opts?: ReadVisibleSkillActiveStateOptions): Promise<SkillActiveState | null>;
 export declare function syncSkillActiveState(options: SyncSkillActiveStateOptions): Promise<GuardedWriteResult | undefined>;
 export interface ApplyHandoffOptions {

package/dist/types/skill-state/workflow-mutation-guard.d.ts

@@ -5,6 +5,9 @@ export declare const WORKFLOW_STATE_MUTATION_BLOCK_MESSAGE = ".gjc workflow stat
 export declare const RALPLAN_MUTATION_BLOCK_MESSAGE = "Ralplan planning phase boundary: keep refining the consensus plan and persist plan artifacts through `gjc ralplan --write` (stage scratch files under a temp dir if needed). Product-code mutation tools and patch execution are blocked while ralplan is active; mutate only after the plan is approved and execution begins.";
 export declare const ULTRAGOAL_GOAL_PLANNING_MUTATION_BLOCK_MESSAGE = "Ultragoal goal-planning phase boundary: finish goal planning and record goals through `gjc ultragoal` before editing code. Product-code mutation tools and patch execution are blocked until goal planning completes and execution begins.";
 export declare const AUTORESEARCH_MUTATION_BLOCK_MESSAGE = "Autoresearch research-only boundary: this workflow produces findings, evidence, and a verdict \u2014 never product code. Product-code mutation tools and patch execution are blocked everywhere, on every branch. Mission research artifacts (`autoresearch.sh` at the workdir root and mission state through the sanctioned `gjc autoresearch` CLI) stay writable; run experiments through the `python` tool, or finish the mission and hand off to an approved implementation workflow.";
+/** Tools whose execute path can mutate product state. `github` is included so side-effect ops share this guard. */
+export declare const WORKFLOW_MUTATION_TOOL_NAMES: readonly ["edit", "write", "ast_edit", "bash", "github"];
+export declare function isWorkflowMutationTool(name: string): boolean;
 type ToolWithEditMode = AgentTool & {
     mode?: unknown;
     customWireName?: unknown;

package/dist/types/slash-commands/helpers/progress-report.d.ts

@@ -0,0 +1,8 @@
+import type { ProjectProgressReport } from "../../progress/project-progress";
+import { type ProgressRenderStyle } from "../../progress/render-progress";
+/** Bound untrusted durable text (objectives, titles, HUD values) to one sanitized display line of `max` columns. */
+export declare function clipProgressText(text: string, max: number): string;
+/** TUI view: the `session.progress` snapshot rendered with column-aware clipping and theme colours. */
+export declare function renderProgressReportLines(report: ProjectProgressReport, style?: ProgressRenderStyle): string[];
+/** Plain text view: identical to what production ACP renders from the `session.progress` query. */
+export declare function renderProgressReportText(report: ProjectProgressReport): string;

package/dist/types/task/executor.d.ts

@@ -7,6 +7,7 @@ import type { AgentTelemetryConfig, ThinkingLevel } from "@gajae-code/agent-core
 import { type Model, type ServiceTier } from "@gajae-code/ai/core";
 import { AsyncJobManager } from "../async";
 import { type AutoroutingReasonCode } from "../config/autorouting-contract";
+import type { ModelProfileOwnershipMarker } from "../config/model-profile-ownership";
 import { ModelRegistry } from "../config/model-registry";
 import type { PromptTemplate } from "../config/prompt-templates";
 import { Settings } from "../config/settings";
@@ -71,6 +72,8 @@ export interface ExecutorOptions {
      * Manual/direct parents (no active profile) keep exact resolution.
      */
     parentActiveModelProfile?: string;
+    /** Parent session's model profile ownership marker for propagating to subagent sessions. */
+    parentModelProfileOwnershipMarker?: ModelProfileOwnershipMarker;
     parentSessionId?: string;
     parentCredentialSessionId?: string;
     thinkingLevel?: ThinkingLevel;

package/dist/types/task/isolation-dir.d.ts

@@ -0,0 +1,26 @@
+import * as path from "node:path";
+type PathApi = Pick<typeof path, "dirname" | "isAbsolute" | "relative" | "resolve" | "sep">;
+/**
+ * Parent directory of `mergedDir`, but only when it is a single entry inside
+ * `worktreeRoot`. Root, empty, nested, and escaped paths are refused so
+ * cleanup cannot delete the worktree root or another session's tree by
+ * walking up.
+ */
+export declare function resolveIsolationRemovalTarget(mergedDir: string, worktreeRoot: string, pathApi?: PathApi): string;
+/**
+ * Create an exclusive directory next to `canonicalBaseDir`. Never removes
+ * `canonicalBaseDir` or any path that already exists.
+ */
+export declare function allocateDisjointIsolationDir(canonicalBaseDir: string, tokenFactory?: () => string): Promise<string>;
+/**
+ * Confirm native teardown may see `mergedDir`.
+ *
+ * `isoStop` deletes that path. The parent entry and `merged` itself must
+ * already be real directories, because native removal follows symlinks.
+ * A missing parent means there is nothing to stop. This does not close a
+ * replacement that happens after the lstat returns.
+ */
+export declare function assertIsolationTeardownTarget(mergedDir: string, worktreeRoot: string): Promise<"stop" | "skip">;
+/** Remove the isolation directory that owns `mergedDir`. Missing directories are ignored. */
+export declare function removeIsolationDirectory(mergedDir: string, worktreeRoot: string): Promise<void>;
+export {};

package/dist/types/tools/ast-edit-write-path.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Path the native writer will mutate: realpath of an existing file, or realpath
+ * of the nearest existing ancestor plus the missing tail.
+ */
+export declare function canonicalizeAstEditWritePath(absolutePath: string): Promise<string>;
+/**
+ * Preview paths as the workflow guard must see them.
+ *
+ * The guard compares lexically against the session cwd. A raw realpath misses
+ * `.gjc/**` when that cwd is not already canonical (`/var` vs `/private/var`,
+ * or a symlinked workspace), so an in-workspace real path is reattached to `cwd`.
+ */
+export declare function resolveAstEditPreviewWritePaths(cwd: string, previewedPaths: readonly string[]): Promise<string[]>;

package/dist/types/tools/bash-skill-urls.d.ts

@@ -1,5 +1,5 @@
 import type { Skill } from "../extensibility/skills";
-import { type LocalProtocolOptions } from "../internal-urls";
+import { type LocalProtocolOptions } from "../internal-urls/local-protocol";
 import type { InternalResource } from "../internal-urls/types";
 interface InternalUrlResolver {
     canHandle(input: string): boolean;

package/dist/types/tools/browser/cdp-url.d.ts

@@ -0,0 +1,2 @@
+/** Require an http(s) CDP URL whose host is loopback. */
+export declare function assertLoopbackCdpUrl(cdpUrl: string): string;

package/dist/types/tools/github-side-effect.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Classify `github` tool operations for the approval gate and the planning
+ * mutation guard. Read-only ops stay available. Every other op, including a
+ * missing or unrecognized one, is a side effect and fails closed.
+ */
+import type { AgentTool } from "@gajae-code/agent-core";
+/** Name-only tool the planning guard uses when `GithubTool.execute` checks itself. */
+export declare const githubMutationTool: AgentTool;
+export declare function githubOp(args: unknown): string | undefined;
+/** True only for a known read-only github op. Missing and unknown ops are not read-only. */
+export declare function isGithubReadOnlyArgs(args: unknown): boolean;
+export declare function isGithubReadOnlyOp(op: string): boolean;
+/**
+ * Approval summary for a side-effect github call. The PR body is omitted so a
+ * token pasted into `body` is not copied into the permission title.
+ */
+export declare function describeGithubSideEffect(args: unknown): string;
+export declare function githubPermissionIntent(args: unknown): {
+    toolName: string;
+    title: string;
+    cacheKey: string;
+} | undefined;

package/dist/types/tools/index.d.ts

@@ -14,6 +14,7 @@ import type { ArtifactManager } from "../session/artifacts";
 import type { ClientBridge } from "../session/client-bridge";
 import type { FoldAdapter } from "../session/fold-coordinator";
 import type { CustomMessage } from "../session/messages";
+import type { SessionArtifactPublication } from "../session/session-manager";
 import type { ToolChoiceQueue } from "../session/tool-choice-queue";
 import type { SkillActiveEntry } from "../skill-state/active-state";
 import type { AgentOutputManager } from "../task/output-manager";
@@ -258,6 +259,8 @@ export interface ToolSession {
         id?: string;
         path?: string;
     }>;
+    /** Capture owner-bound artifact publication authority for one session lifecycle. */
+    captureArtifactPublication?: () => SessionArtifactPublication;
     /** Get session spawns */
     getSessionSpawns: () => string | null;
     /** Get resolved model string if explicitly set for this session */

package/dist/types/tools/monitor-mutation.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Judge a monitor command with the same mutation rules as bash. Monitor is a
+ * background shell, so a planning-phase mutation must fail before the job starts.
+ */
+export declare function assertMonitorMutationAllowed(input: {
+    cwd: string;
+    sessionId?: string;
+    command: string;
+}): Promise<void>;

package/dist/types/tools/python.d.ts

@@ -5,11 +5,19 @@ export declare function pythonKernelOwnerId(sessionId: string): string;
 export interface SessionPythonToolInput {
     /** Working directory for kernel execution (session cwd). */
     cwd: string;
+    /** Resolve the current working directory for each admitted invocation. */
+    getCwd?: () => string;
     /** Session settings used for Python runtime policy. */
     settings?: SettingsType;
+    /** Resolve the session file associated with each admitted invocation. */
+    getSessionFile?: () => string | null;
     /** Resolve the GJC session id used for the kernel owner and transcript paths. */
     getSessionId: () => string | null;
     /** Register cleanup with the current logical session lifecycle. */
-    registerSessionCleanup: (cleanup: () => Promise<void> | void) => void;
+    registerSessionCleanup: (cleanup: () => Promise<void> | void) => (() => void) | void;
+    /** Reject execution after the owning session has begun disposal. */
+    assertEvalExecutionAllowed?: () => void;
+    /** Track this whole invocation through its transcript append. */
+    trackEvalExecution?: <T>(execution: Promise<T>, abortController: AbortController) => Promise<T>;
 }
 export declare function createSessionPythonTool(input: SessionPythonToolInput): AgentTool;

package/dist/types/tools/recipe/recipe-guard.d.ts

@@ -0,0 +1,7 @@
+/** Apply the session bash planning guard to a recipe command before it runs. */
+export declare function assertRecipeCommandAllowed(input: {
+    cwd: string;
+    sessionId?: string;
+    command: string;
+    commandCwd?: string;
+}): Promise<void>;

package/dist/types/tools/restricted-cwd.d.ts

@@ -0,0 +1 @@
+export declare function assertCwdInsideWorkspace(workspace: string, commandCwd: string): Promise<void>;

package/dist/types/tools/todo-write.d.ts

@@ -51,6 +51,12 @@ declare const todoWriteSchema: z.ZodObject<{
 type TodoWriteParams = z.infer<typeof todoWriteSchema>;
 export declare const USER_TODO_EDIT_CUSTOM_TYPE = "user_todo_edit";
 export declare function getLatestTodoPhasesFromEntries(entries: SessionEntry[]): TodoPhase[];
+/**
+ * Latest persisted todo list on the branch, terminal items included. `undefined`
+ * means no todo state was ever persisted; an empty array is an authoritative
+ * empty list (for example after a bare `/todo rm`).
+ */
+export declare function findLatestTodoPhasesFromEntries(entries: SessionEntry[]): TodoPhase[] | undefined;
 /** Apply an array of `todo_write`-style ops to existing phases. Used by /todo slash command. */
 export declare function applyOpsToPhases(currentPhases: TodoPhase[], ops: TodoWriteParams["ops"]): {
     phases: TodoPhase[];

package/dist/types/utils/tools-checksum.d.ts

@@ -0,0 +1,7 @@
+export interface ReleaseAssetDigest {
+    name?: string;
+    digest?: string | null;
+}
+export declare function sha256FromReleaseDigest(digest: string | null | undefined): string | null;
+export declare function requireAssetSha256(assets: readonly ReleaseAssetDigest[], assetName: string): string;
+export declare function assertFileMatchesSha256(filePath: string, expectedSha256: string): Promise<void>;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.18.7",
+	"version": "0.18.9",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -57,12 +57,12 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.18.7",
-		"@gajae-code/agent-core": "0.18.7",
-		"@gajae-code/ai": "0.18.7",
-		"@gajae-code/natives": "0.18.7",
-		"@gajae-code/tui": "0.18.7",
-		"@gajae-code/utils": "0.18.7",
+		"@gajae-code/stats": "0.18.9",
+		"@gajae-code/agent-core": "0.18.9",
+		"@gajae-code/ai": "0.18.9",
+		"@gajae-code/natives": "0.18.9",
+		"@gajae-code/tui": "0.18.9",
+		"@gajae-code/utils": "0.18.9",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",