@gajae-code/coding-agent 0.19.3-nightly.20261030094347.41301593972.gf536b1010d4e → 0.19.3

package/dist/types/config/model-profile-activation.d.ts

@@ -1,8 +1,9 @@
 import { ThinkingLevel } from "@gajae-code/agent-core";
 import { type Api, type Model } from "@gajae-code/ai/core";
-import type { AgentSession, AgentSessionProfileInstalledOverrideState, DefaultFallbackRuntimeState } from "../session/agent-session";
+import type { AgentSession, AgentSessionProfileInstalledOverrideState, DefaultFallbackRuntimeState, PreparedProfileModelSelection, SessionAgentModelOverrideState } from "../session/agent-session";
 import { type ModelProfileDefinition } from "./model-profiles";
 export { resolveModelProfileName } from "./model-profile-contract";
+import { type DurableModelProfileOwnership } from "./model-profile-ownership";
 import { type GjcModelAssignmentTargetId, type ModelRegistry } from "./model-registry";
 import { type ModelSelectorValue } from "./model-selector-value";
 import type { Settings } from "./settings";
@@ -37,12 +38,16 @@ type ModelProfileActivationSession = Pick<AgentSession, "model" | "thinkingLevel
     /** Profile-installed baselines, preserved when a refreshed profile drops an assignment. */
     getProfileInstalledOverrideState?: () => AgentSessionProfileInstalledOverrideState;
     restoreProfileInstalledOverrideState?: (state: AgentSessionProfileInstalledOverrideState) => void;
+    getSessionAgentModelOverrideState?: AgentSession["getSessionAgentModelOverrideState"];
+    retireSessionAgentModelOverrides?: AgentSession["retireSessionAgentModelOverrides"];
+    restoreSessionAgentModelOverrides?: AgentSession["restoreSessionAgentModelOverrides"];
     /** Re-apply vendor-separated delegation (task tool + prompt) after the role layer changed. */
     syncEagerDelegation?: () => Promise<void>;
     getSessionDefaultModelSelector?: () => string | undefined;
     recordResumeDefaultModel?: (selector: string | undefined) => void;
     getUserCanonicalVariantSelection?: () => UserCanonicalVariantSelection;
     getUserModelSelectionRevision?: () => number;
+    getThinkingLevelMutationRevision?: () => number;
     seedDefaultFallbackResolution?: (activeIndex: number, skips: Array<{
         selector: string;
         reason: string;
@@ -55,6 +60,9 @@ type ModelProfileActivationSession = Pick<AgentSession, "model" | "thinkingLevel
     prepareModelSelectionForProfileActivation?: AgentSession["prepareModelSelectionForProfileActivation"];
     commitPreparedProfileModelSelection?: AgentSession["commitPreparedProfileModelSelection"];
     finishPreparedProfileModelSelection?: AgentSession["finishPreparedProfileModelSelection"];
+    setThinkingLevel?: AgentSession["setThinkingLevel"];
+    dispose?: AgentSession["dispose"];
+    sessionLifecycle?: AgentSession["sessionLifecycle"];
     modelRegistry?: Pick<ModelRegistry, "getSessionCanonicalVariant" | "restoreSessionCanonicalVariant" | "clearCanonicalVariant" | "getModelProfile" | "getAvailable" | "lookupAliasExists" | "resolveModelByLookupAlias" | "authStorage" | "isCredentiallessProvider"> & Partial<Pick<ModelRegistry, "seedCanonicalVariant">>;
     getConfiguredModelChainState?: (role: string) => ConfiguredModelChainState | undefined;
 };
@@ -67,6 +75,7 @@ type ConfiguredModelChainState = {
 type PublishedModelProfileActivationState = {
     model: Model<Api> | undefined;
     thinkingLevel: ThinkingLevel | undefined;
+    thinkingIntentRevision: number | undefined;
     modelRolesOverride: Readonly<Record<string, ModelSelectorValue>> | undefined;
     agentModelOverridesOverride: Readonly<Record<string, ModelSelectorValue>> | undefined;
     defaultChainState: ConfiguredModelChainState | undefined;
@@ -75,12 +84,6 @@ type PublishedModelProfileActivationState = {
     activatedModelProfile: string | undefined;
     profileInstalledOverrideState: AgentSessionProfileInstalledOverrideState | undefined;
     sessionDefaultModel: string | undefined;
-    persistedModelRoles: Readonly<Record<string, ModelSelectorValue>> | undefined;
-    persistedAgentModelOverrides: Readonly<Record<string, ModelSelectorValue>> | undefined;
-    persistedDefaultProfile: string | undefined;
-    persistedDefaultThinkingLevel: Exclude<ThinkingLevel, "inherit"> | undefined;
-    defaultThinkingLevelOverride: Exclude<ThinkingLevel, "inherit"> | undefined;
-    defaultProfileOverride: string | undefined;
 };
 export interface PrepareModelProfileActivationOptions {
     session: ModelProfileActivationSession;
@@ -106,13 +109,33 @@ export interface ApplyModelProfileActivationOptions {
     signal?: AbortSignal;
     /** Cancels deferred activation if a newer user model selection exists. */
     isCurrent?: () => boolean;
+    /** Captured before yielding, or advanced only by an applicable local predecessor receipt. */
+    observedOwnership?: DurableModelProfileOwnership;
+    /** Recheck request intent under the durable lock, then again before synchronous publication. */
+    validateCurrent?: (durableCommitted: boolean) => void;
+    /** Snapshot only activation-owned state, before asynchronous finishing can admit unrelated intent. */
+    onRuntimePublished?: () => void;
 }
 export interface PreparedModelProfileActivation {
     profileName: string;
     session: ModelProfileActivationSession & {
         setModelTemporary: AgentSession["setModelTemporary"];
     };
-    settings: Pick<Settings, "clearOverride" | "get" | "getGlobal" | "getOverride" | "override" | "set" | "unset" | "flush" | "flushOrThrow">;
+    settings: Pick<Settings, "clearOverride" | "get" | "getGlobal" | "getOverride" | "override" | "set" | "unset" | "flush" | "flushOrThrow" | "commitAtomicBatchWithCurrent">;
+    observedOwnership: DurableModelProfileOwnership;
+    committedOwnership?: DurableModelProfileOwnership;
+    binding: {
+        sessionId: string;
+        generation: number | undefined;
+        userSelectionRevision: number | undefined;
+        settingsIntent: {
+            modelRoles: unknown;
+            agentOverrides: unknown;
+            globalRoles: unknown;
+            globalAgentOverrides: unknown;
+            globalThinking: unknown;
+        };
+    };
     previousModel: Model<Api> | undefined;
     previousThinkingLevel: ThinkingLevel | undefined;
     previousAgentModelOverrides: Record<string, ModelSelectorValue>;
@@ -123,16 +146,18 @@ export interface PreparedModelProfileActivation {
     previousAgentModelOverridesOverride: Record<string, ModelSelectorValue> | undefined;
     previousDefaultProfileOverride: string | undefined;
     previousPersistedDefaultProfile: string | undefined;
-    previousPersistedDefaultThinkingLevel: Exclude<ThinkingLevel, "inherit"> | undefined;
-    previousDefaultThinkingLevelOverride: Exclude<ThinkingLevel, "inherit"> | undefined;
     baseAgentModelOverrides: Record<string, ModelSelectorValue>;
     baseModelRoles: Record<string, ModelSelectorValue>;
     previousDefaultChain: readonly string[] | undefined;
     previousDefaultChainState: ConfiguredModelChainState | undefined;
     previousProfileInstalledOverrideState: AgentSessionProfileInstalledOverrideState | undefined;
-    preparedDefaultModelSelection: Awaited<ReturnType<NonNullable<ModelProfileActivationSession["prepareModelSelectionForProfileActivation"]>>> | undefined;
+    previousSessionAgentModelOverrides: SessionAgentModelOverrideState | undefined;
+    preserveSessionAgentModelOverrides: boolean;
+    retiredSessionAgentModelRevision?: number;
+    preparedDefaultModelSelection: PreparedProfileModelSelection | undefined;
     defaultChainPublished: boolean;
     defaultModelPublished: boolean;
+    thinkingLevelPublished: boolean;
     /** MRU order slot claimed when the reload publication committed the profile DEFAULT. */
     defaultModelPublishedUsageSequence?: number;
     publishedState: PublishedModelProfileActivationState | undefined;
@@ -321,7 +346,7 @@ export declare function resolveModelProfileDefaultChain(options: {
 export declare function rewriteSelectorForProxy(selector: string, proxyProvider: string, proxyMode: ModelProfileProxyMode, allModels: Model<Api>[], directlyAuthenticated: ReadonlySet<string>, routableProviders: ReadonlySet<string>): string;
 export declare function prepareModelProfileActivation(options: PrepareModelProfileActivationOptions): Promise<PreparedModelProfileActivation>;
 /** Publish the prepared model selection and role layer without awaiting. */
-export declare function publishPreparedModelProfileActivation(prepared: PreparedModelProfileActivation, options?: Pick<ApplyModelProfileActivationOptions, "preserveDefaultModelSelection" | "preserveLiveModelSelection">): void;
+export declare function publishPreparedModelProfileActivation(prepared: PreparedModelProfileActivation, options?: Pick<ApplyModelProfileActivationOptions, "preserveDefaultModelSelection" | "preserveLiveModelSelection" | "thinkingLevelOverride">): void;
 /**
  * Record a published profile DEFAULT in the model usage order. Call synchronously
  * once the enclosing publication finalized, before any await: a user selection
@@ -329,7 +354,9 @@ export declare function publishPreparedModelProfileActivation(prepared: Prepared
  * most recent usage instead of being overtaken by this older profile choice.
  */
 export declare function recordPublishedModelProfileActivationUsage(prepared: PreparedModelProfileActivation): void;
-export declare function finishPreparedModelProfileActivation(prepared: PreparedModelProfileActivation): Promise<void>;
+export declare function finishPreparedModelProfileActivation(prepared: PreparedModelProfileActivation, options?: {
+    strictModelSelection?: boolean;
+}): Promise<void>;
 export declare function applyPreparedModelProfileActivation(prepared: PreparedModelProfileActivation, options?: ApplyModelProfileActivationOptions): Promise<void>;
 /** Restore an applied activation when its enclosing settings/registry commit fails. */
 export declare function rollbackPreparedModelProfileActivation(prepared: PreparedModelProfileActivation, options?: ApplyModelProfileActivationOptions): Promise<void>;

package/dist/types/config/model-registry.d.ts

@@ -126,6 +126,8 @@ export declare const ModelsConfigFile: ConfigFile<{
             type: "llama.cpp" | "lm-studio" | "models-dev" | "ollama" | "omlx" | "openai-models-list" | "sglang" | "vllm";
             apiByModelPrefix?: Record<string, "anthropic-messages" | "openai-completions"> | undefined;
             modelsDevProvider?: string | undefined;
+            outputModalities?: string[] | undefined;
+            inputModalities?: string[] | undefined;
         } | undefined;
         requestTransform?: {
             profile?: "openai-proxy" | undefined;
@@ -676,6 +678,7 @@ export declare class ModelRegistry {
      * Check if a model is using OAuth credentials (subscription).
      */
     isUsingOAuth(model: Model<Api>): boolean;
+    /** Effective dispatch kind, including this registry's config and runtime key overrides. */
     getSessionCredentialType(provider: string, sessionId?: string): "api_key" | "oauth" | undefined;
     /**
      * Remove custom API/OAuth registrations for a specific extension source.

package/dist/types/config/models-config-schema.d.ts

@@ -367,6 +367,8 @@ export declare const ProviderDiscoverySchema: z.ZodObject<{
         "openai-completions": "openai-completions";
     }>>>;
     modelsDevProvider: z.ZodOptional<z.ZodString>;
+    outputModalities: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    inputModalities: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 export declare const ProviderAuthSchema: z.ZodEnum<{
     apiKey: "apiKey";
@@ -494,6 +496,8 @@ export declare const ModelsConfigSchema: z.ZodObject<{
                 "openai-completions": "openai-completions";
             }>>>;
             modelsDevProvider: z.ZodOptional<z.ZodString>;
+            outputModalities: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            inputModalities: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>>;
         requestTransform: z.ZodOptional<z.ZodObject<{
             profile: z.ZodOptional<z.ZodEnum<{

package/dist/types/config/settings-schema.d.ts

@@ -86,29 +86,37 @@ export type JsonSchemaObject = {
     minimum?: number;
     const?: unknown;
 };
-interface BooleanDef {
+export interface SettingApplication {
+    kind: "next-run" | "host-presentation" | "reload" | "restart";
+    reason: string;
+}
+interface SettingApplicationMetadata {
+    /** Absent means application behavior has not been classified for the portable catalog. */
+    application?: SettingApplication;
+}
+interface BooleanDef extends SettingApplicationMetadata {
     type: "boolean";
     default?: boolean;
     ui?: UiBoolean;
 }
-interface StringDef {
+interface StringDef extends SettingApplicationMetadata {
     type: "string";
     default: string | undefined;
     ui?: UiString;
 }
-interface NumberDef {
+interface NumberDef extends SettingApplicationMetadata {
     type: "number";
     default: number;
     validate?: (value: number) => boolean;
     ui?: UiNumber;
 }
-interface EnumDef<T extends readonly string[]> {
+interface EnumDef<T extends readonly string[]> extends SettingApplicationMetadata {
     type: "enum";
     values: T;
     default: T[number];
     ui?: UiEnum<T>;
 }
-interface ArrayDef<T> {
+interface ArrayDef<T> extends SettingApplicationMetadata {
     type: "array";
     default: T[];
     items?: {
@@ -133,7 +141,7 @@ interface ConstrainedRecordValueDef {
     pattern: string;
     description: string;
 }
-interface ConstrainedRecordDef<T> {
+interface ConstrainedRecordDef<T> extends SettingApplicationMetadata {
     type: "constrained-record";
     default: T;
     keys: readonly string[];
@@ -141,13 +149,13 @@ interface ConstrainedRecordDef<T> {
     description?: string;
     ui?: UiBase;
 }
-interface RecordDef<T> {
+interface RecordDef<T> extends SettingApplicationMetadata {
     type: "record";
     default: Record<string, T>;
     valueSchema?: RecordValueDef;
     ui?: UiBase;
 }
-export interface OptionalObjectDef<T> {
+export interface OptionalObjectDef<T> extends SettingApplicationMetadata {
     type: "optional-object";
     default: undefined;
     jsonSchema: JsonSchemaObject;
@@ -608,6 +616,15 @@ export declare const SETTINGS_SCHEMA: {
             }];
         };
     };
+    readonly "recap.enabled": {
+        readonly type: "boolean";
+        readonly default: false;
+        readonly ui: {
+            readonly tab: "context";
+            readonly label: "Session Recap";
+            readonly description: "Generate a short recap after completed turns for session listings. Uses the default model and may incur model usage; never adds recap text to the conversation.";
+        };
+    };
     readonly modelTags: {
         readonly type: "record";
         readonly default: ModelTagsSettings;
@@ -1394,6 +1411,10 @@ export declare const SETTINGS_SCHEMA: {
         };
     };
     readonly temperature: {
+        readonly application: {
+            readonly kind: "next-run";
+            readonly reason: "New agent runs capture effective sampling; an in-flight run keeps its snapshot.";
+        };
         readonly type: "number";
         readonly default: -1;
         readonly ui: {
@@ -1428,6 +1449,10 @@ export declare const SETTINGS_SCHEMA: {
         };
     };
     readonly topP: {
+        readonly application: {
+            readonly kind: "next-run";
+            readonly reason: "New agent runs capture effective sampling; an in-flight run keeps its snapshot.";
+        };
         readonly type: "number";
         readonly default: -1;
         readonly ui: {
@@ -1462,6 +1487,10 @@ export declare const SETTINGS_SCHEMA: {
         };
     };
     readonly topK: {
+        readonly application: {
+            readonly kind: "next-run";
+            readonly reason: "New agent runs capture effective sampling; an in-flight run keeps its snapshot.";
+        };
         readonly type: "number";
         readonly default: -1;
         readonly ui: {
@@ -1492,6 +1521,10 @@ export declare const SETTINGS_SCHEMA: {
         };
     };
     readonly minP: {
+        readonly application: {
+            readonly kind: "next-run";
+            readonly reason: "New agent runs capture effective sampling; an in-flight run keeps its snapshot.";
+        };
         readonly type: "number";
         readonly default: -1;
         readonly ui: {
@@ -1518,6 +1551,10 @@ export declare const SETTINGS_SCHEMA: {
         };
     };
     readonly presencePenalty: {
+        readonly application: {
+            readonly kind: "next-run";
+            readonly reason: "New agent runs capture effective sampling; an in-flight run keeps its snapshot.";
+        };
         readonly type: "number";
         readonly default: -1;
         readonly ui: {
@@ -1548,6 +1585,10 @@ export declare const SETTINGS_SCHEMA: {
         };
     };
     readonly repetitionPenalty: {
+        readonly application: {
+            readonly kind: "next-run";
+            readonly reason: "New agent runs capture effective sampling; an in-flight run keeps its snapshot.";
+        };
         readonly type: "number";
         readonly default: -1;
         readonly ui: {

package/dist/types/config/settings.d.ts

@@ -61,12 +61,13 @@ export declare const SettingsMigrationTestHooks: {
      * to make the marker unreadable so the rollback path is exercised. */
     beforeProjectMarkerMerge?: () => void | Promise<void>;
 };
+export type SettingsAtomicPath = SettingPath | `modelRoles.${string}`;
 export type SettingsAtomicPatch = {
-    path: SettingPath;
+    path: SettingsAtomicPath;
     op: "set";
     value: unknown;
 } | {
-    path: SettingPath;
+    path: SettingsAtomicPath;
     op: "unset";
 };
 export type SettingsAtomicReceipt = CasReceipt;
@@ -87,6 +88,16 @@ export interface SettingsOptions {
      */
     readonly?: boolean;
 }
+/** Configuration layers, not a claim about a consumer's live application. */
+export type SettingsLayer = "global" | "project" | "runtime";
+export interface SettingsPathResolution {
+    /** Highest configured scalar layer; objects can be constructed from several layers. */
+    origin: SettingsLayer | "default" | "layered";
+    /** Present, permitted layers in precedence order, including shadowed values. */
+    layers: SettingsLayer[];
+    /** Layers accepted by Settings merging; not filesystem write or execution authority. */
+    allowedLayers: SettingsLayer[];
+}
 /** Additional layer setup for {@link Settings.isolated}. */
 export interface IsolatedSettingsOptions {
     /** Initial runtime overrides. Notification paths are rejected. */
@@ -141,6 +152,13 @@ export declare class Settings implements NotificationSettingsReader {
      * Returns the merged value from global + project + overrides, or the default.
      */
     get<P extends SettingPath>(path: P): SettingValue<P>;
+    /**
+     * Describe Settings.get resolution without exposing configuration values.
+     * Object origins describe layered construction, not per-leaf provenance.
+     * This is a read-only snapshot; it is neither a durability receipt nor proof
+     * that an engine consumer has applied the resulting value.
+     */
+    getResolutionSnapshot(): Record<SettingPath, SettingsPathResolution>;
     /**
      * Get a setting value from the user/global config only.
      *
@@ -160,7 +178,12 @@ export declare class Settings implements NotificationSettingsReader {
     getSchemaReport(): SettingsSchemaReport;
     /** Effective merged autorouting state shared by settings diagnostics and routing policy. */
     getEffectiveAutorouting(): AutoroutingEffective;
-    onChanged(listener: (path: SettingPath) => void): () => void;
+    /**
+     * Subscribe to effective-setting changes. The `apply` phase runs before schema hooks and
+     * ordinary observers so a live applicator sees the restored state before an observer can
+     * synchronously start a run.
+     */
+    onChanged(listener: (path: SettingPath) => void, phase?: "apply" | "observe"): () => void;
     /** The resolved global config.yml path, or null for in-memory settings. */
     getGlobalConfigPath(): string | null;
     /**
@@ -193,7 +216,14 @@ export declare class Settings implements NotificationSettingsReader {
      * {@link set}, canonical state and hooks change only after the rename succeeds.
      */
     commitAtomicBatch(patches: readonly SettingsAtomicPatch[]): Promise<CasReceipt>;
-    /** Build a durable batch from the current on-disk YAML under the shared queue and file lock. */
+    /**
+     * Build a batch from current YAML under the shared queue/lock. New local or
+     * runtime intent invalidates nonempty batches prepared asynchronously. Such
+     * builders must not perform irreversible external work before publication.
+     * Empty batches may hold the durable writer queue for an adjacent action, but
+     * cannot prevent synchronous setters or runtime overrides during that action.
+     * Synchronous memory builders publish without yielding to another setter.
+     */
     commitAtomicBatchWithCurrent(buildPatches: (current: Readonly<RawSettings>) => Promise<readonly SettingsAtomicPatch[]> | readonly SettingsAtomicPatch[]): Promise<CasReceipt>;
     /**
      * Apply runtime overrides (not persisted).
@@ -205,7 +235,11 @@ export declare class Settings implements NotificationSettingsReader {
      * Clear a runtime override.
      */
     clearOverride(path: SettingPath): void;
-    /** Flush a reserved debounced save without allowing it to be overtaken. */
+    /**
+     * Flush a reserved debounced save without allowing it to be overtaken.
+     * A caller holding a YAML lease cannot flush an actively held file, even a
+     * different one; independent callers still wait in FIFO order.
+     */
     flush(): Promise<void>;
     /** Like {@link flush}, but reports a durable save failure to the caller. */
     flushOrThrow(): Promise<void>;

package/dist/types/config/task-delegation.d.ts

@@ -24,6 +24,8 @@ export interface EagerTaskDelegationInput {
     settings: Settings;
     /** Active profile, when its bindings are not (yet) installed into settings. */
     profile?: ModelProfileDefinition;
+    /** Authoritative merged task role selectors for a live session. */
+    agentModelOverrides?: Readonly<Record<string, ModelSelectorValue>>;
 }
 /**
  * Effective role selectors: profile mapping as the baseline, installed settings

package/dist/types/extensibility/extensions/runner.d.ts

@@ -110,6 +110,8 @@ export declare class ExtensionRunner {
      */
     emitCredentialDisabled(event: CredentialDisabledEvent): Promise<void>;
     getUIContext(): ExtensionUIContext;
+    /** Bind fresh UI for future contexts without rerunning initialization or changing captured contexts. */
+    setUIContext(uiContext: ExtensionUIContext): void;
     hasUI(): boolean;
     getExtensionPaths(): string[];
     /** Get all registered tools from all extensions. */

package/dist/types/extensibility/slash-commands.d.ts

@@ -1,4 +1,5 @@
 import type { AutocompleteItem } from "@gajae-code/tui";
+import type { AgentSession } from "../session/agent-session";
 import { type BuiltinSlashCommand } from "../slash-commands/builtin-registry";
 export type SlashCommandSource = "extension" | "prompt" | "skill";
 export type SlashCommandLocation = "user" | "project" | "path";
@@ -18,7 +19,12 @@ export declare const BUILTIN_SLASH_COMMANDS: ReadonlyArray<BuiltinSlashCommand &
     getArgumentCompletions?: (prefix: string) => AutocompleteItem[] | null;
     getInlineHint?: (argumentText: string) => string | null;
 }>;
-export declare function getBuiltinSlashCommandsForSession(hasExactMcpControls: boolean): typeof BUILTIN_SLASH_COMMANDS;
+/** Builtin command whose argument completions may resolve asynchronously from session state. */
+export type SessionBuiltinSlashCommand = BuiltinSlashCommand & {
+    getArgumentCompletions?: (prefix: string) => AutocompleteItem[] | null | Promise<AutocompleteItem[] | null>;
+    getInlineHint?: (argumentText: string) => string | null;
+};
+export declare function getBuiltinSlashCommandsForSession(hasExactMcpControls: boolean, session?: Pick<AgentSession, "hasSessionMcpControls" | "getSessionMcpCompletionCandidates">): readonly SessionBuiltinSlashCommand[];
 /**
  * Represents a custom slash command loaded from a file
  */
@@ -33,6 +39,13 @@ export interface FileSlashCommand {
         level: "user" | "project" | "native";
     };
 }
+/** A command name is shown as typed. Names that display sanitization would change are not loaded. */
+export declare function isDisplaySafeCommandName(name: string): boolean;
+/**
+ * Description shown for a file-backed slash command.
+ * Terminal controls are removed before the body-preview cutoff.
+ */
+export declare function slashCommandDescription(content: string): string;
 export interface LoadSlashCommandsOptions {
     /** Working directory for project-local commands. Default: getProjectDir() */
     cwd?: string;

package/dist/types/gjc-runtime/managed-owner-admission.d.ts

@@ -1,4 +1,4 @@
-import type { ManagedOwnerBinding, ManagedOwnerSigabrtReceipt } from "./managed-owner-supervisor";
+import { type ManagedOwnerRecoverableBinding, type ManagedOwnerSigabrtReceipt } from "./managed-owner-binding";
 import { type UltragoalRecoveryDecision } from "./ultragoal-owner-loss-recovery";
 export declare const MANAGED_OWNER_PREDECESSOR_TOKEN_ENV = "GJC_MANAGED_OWNER_PREDECESSOR_TOKEN";
 export declare const MANAGED_OWNER_PREDECESSOR_GENERATION_ENV = "GJC_MANAGED_OWNER_PREDECESSOR_GENERATION";
@@ -10,7 +10,7 @@ export declare function trustedManagedOwnerTranscriptPath(env?: NodeJS.ProcessEn
 export declare function trustedManagedOwnerLaunchSessionFile(env: NodeJS.ProcessEnv, cwd: string): string;
 export interface ManagedOwnerRecoveryContext {
     root: string;
-    binding: ManagedOwnerBinding;
+    binding: ManagedOwnerRecoverableBinding;
     receipt: ManagedOwnerSigabrtReceipt;
     admission: {
         session_id: string;
@@ -28,17 +28,9 @@ export type ManagedOwnerAdmission = {
 } | {
     kind: "blocked";
 };
-/**
- * This is the pre-CLI barrier. A replacement is identified only by the exact
- * predecessor token supplied by its launch binding; directory enumeration is
- * deliberately never an authority source.
- */
+/** Pre-CLI barrier: environment only selects exact evidence; it never grants admission. */
 export declare function admitManagedOwnerBeforeCli(): Promise<ManagedOwnerAdmission>;
-/**
- * The ordinary CLI factory has no recovery-owned writer-lease or exact-child
- * reconciliation capability.  Do not route a recovered owner through it: first
- * revalidate the immutable evidence and B0, then publish a terminal handoff.
- */
+/** The ordinary CLI does not own the recovery writer lease or exact-child reconciliation seam. */
 export declare function completeManagedOwnerRecovery(context: ManagedOwnerRecoveryContext): Promise<{
     kind: "handoff";
     exitCode: 75;

package/dist/types/gjc-runtime/managed-owner-binding.d.ts

@@ -0,0 +1,164 @@
+interface ManagedOwnerBindingBase {
+    schema_version: 3;
+    generation: string;
+    session_id: string;
+    run_id: string;
+    endpoint_incarnation: string;
+    child_token: string;
+    supervisor_pid: number;
+    supervisor_start_time: string;
+    created_at: string;
+}
+export interface ManagedOwnerOpaqueBinding extends ManagedOwnerBindingBase {
+    binding_kind: "opaque";
+}
+export interface ManagedOwnerRecoverableBinding extends ManagedOwnerBindingBase {
+    binding_kind: "recoverable";
+    command: string[];
+    command_sha256: string;
+}
+export type ManagedOwnerBinding = ManagedOwnerOpaqueBinding | ManagedOwnerRecoverableBinding;
+export interface ManagedOwnerSigabrtReceipt {
+    schema_version: 2;
+    generation: string;
+    session_id: string;
+    run_id: string;
+    endpoint_incarnation: string;
+    child_token: string;
+    command_sha256: string;
+    supervisor_pid: number;
+    supervisor_start_time: string;
+    child_pid: number;
+    child_start_time: string;
+    signal: "SIGABRT";
+    signal_number: 6;
+    exit_code: number | null;
+    received_at: string;
+}
+export interface ManagedOwnerBindingIdentity {
+    generation: string;
+    sessionId: string;
+    runId: string;
+    incarnation: string;
+    token: string;
+}
+export declare function managedOwnerCommandDigest(command: readonly string[]): string;
+/** A runnable argv: a nonempty executable; later arguments may be empty but never contain NUL. */
+export declare function isManagedOwnerCommand(value: unknown): value is string[];
+export declare function isManagedOwnerBinding(value: unknown, expected?: ManagedOwnerBindingIdentity): value is ManagedOwnerBinding;
+export declare function isManagedOwnerSigabrtReceipt(value: unknown, binding: ManagedOwnerRecoverableBinding): value is ManagedOwnerSigabrtReceipt;
+/**
+ * Darwin: one per generation, published no-replace by the generation's supervisor
+ * after its binding. A close reads this exact file instead of scanning the
+ * lifecycle root, so retained history from earlier generations never matters.
+ */
+export interface ManagedOwnerSupervisorIndex {
+    schema_version: 1;
+    generation: string;
+    session_id: string;
+    child_token: string;
+    supervisor_pid: number;
+    supervisor_start_time: string;
+}
+export declare function isManagedOwnerSupervisorIndex(value: unknown): value is ManagedOwnerSupervisorIndex;
+/**
+ * Off Linux: published no-replace by each process admitted through a binding,
+ * before its generation fence. A supervisor killed after admission leaves no
+ * receipt and cannot reconcile its child, so a relaunch proves every admitted
+ * process gone through these records before it replaces the generation.
+ */
+export interface ManagedOwnerAdmittedChild {
+    schema_version: 1;
+    generation: string;
+    session_id: string;
+    child_token: string;
+    child_pid: number;
+    child_incarnation: string;
+}
+/**
+ * Named for the exact process: one process admits more than once (both CLI entry
+ * layers run admission), and a reused pid is a different process with its own record.
+ */
+export declare function managedOwnerAdmittedChildFile(token: string, pid: number, incarnation: string): string;
+/** The pid an admitted-child record of `token` is named for, or undefined for any other entry. */
+export declare function managedOwnerAdmittedChildPid(token: string, entry: string): number | undefined;
+export declare function isManagedOwnerAdmittedChild(value: unknown, binding: ManagedOwnerBinding, entry: string): value is ManagedOwnerAdmittedChild;
+/**
+ * Darwin: published no-replace by the exact supervisor, under the generation lock,
+ * as `relay-<generation>.pending.json` before it relays its cooperative signal for one
+ * intent. Only after the signal was sent does it publish `relay-<generation>.json`,
+ * whose `relayed_at` was sampled immediately before delivery, and remove the
+ * pending record. Only the confirmed record proves delivery: an operator-shutdown
+ * verdict requires it, and never for an observation earlier than `relayed_at`. A pending record without confirmation is uncertain and blocks retirement; an
+ * expired intent with neither was provably never delivered and may be retired.
+ */
+export interface ManagedOwnerRelayRecord {
+    schema_version: 1;
+    intent_id: string;
+    dispatch_id: string;
+    generation: string;
+    session_id: string;
+    server_key: string;
+    child_token: string;
+    supervisor_pid: number;
+    supervisor_start_time: string;
+    relayed_at: string;
+}
+export declare function isManagedOwnerRelayRecord(value: unknown): value is ManagedOwnerRelayRecord;
+/** Darwin: the signal only the exact supervisor sends to relay a cooperative intent. */
+export declare const MANAGED_OWNER_COOPERATIVE_SIGNAL = "SIGUSR2";
+/**
+ * Darwin: published no-replace by an admitted child as
+ * `cooperative-ready-<generation>.json` only after it installed its cooperative
+ * signal handler, so its supervisor never relays to a child whose default action
+ * for that signal would kill it.
+ */
+export interface ManagedOwnerCooperativeReady {
+    schema_version: 1;
+    generation: string;
+    session_id: string;
+    child_token: string;
+    child_pid: number;
+    signal: typeof MANAGED_OWNER_COOPERATIVE_SIGNAL;
+}
+export declare function isManagedOwnerCooperativeReady(value: unknown): value is ManagedOwnerCooperativeReady;
+/**
+ * Darwin: created exclusively by an admitted child as `shutdown-cause-<generation>.json`
+ * from the first termination signal it handles. `cooperative` means the supervisor's
+ * cooperative signal came first; any SIGTERM, SIGHUP or SIGINT handled before it
+ * records `signal`. Exclusive creation linearizes the two, so an unrelated signal the
+ * child began handling before the relay can never be attributed to that relay.
+ */
+export interface ManagedOwnerShutdownCause {
+    schema_version: 1;
+    generation: string;
+    session_id: string;
+    child_token: string;
+    child_pid: number;
+    cause: "cooperative" | "signal";
+    signal: string;
+    recorded_at: string;
+}
+export declare function isManagedOwnerShutdownCause(value: unknown): value is ManagedOwnerShutdownCause;
+/**
+ * Darwin: published no-replace by the exact supervisor as `supervised-exit-<generation>.json`
+ * after the child it relayed a cooperative intent to has exited. `explained` is true
+ * only when the child's first handled cause was that relay and it then ended through
+ * its own exit (code 0 or the handled-SIGTERM 143), not a fatal signal. A cooperative
+ * close succeeds only with an explained record for its exact intent.
+ */
+export interface ManagedOwnerChildExit {
+    schema_version: 1;
+    generation: string;
+    session_id: string;
+    child_token: string;
+    child_pid: number;
+    intent_id: string;
+    dispatch_id: string;
+    signal: string | null;
+    exit_code: number | null;
+    explained: boolean;
+    observed_at: string;
+}
+export declare function isManagedOwnerChildExit(value: unknown): value is ManagedOwnerChildExit;
+export {};