@gajae-code/coding-agent 0.7.2 → 0.7.4

package/dist/types/notifications/telegram-daemon.d.ts

@@ -1,6 +1,8 @@
 import * as fs from "node:fs";
 import type { Settings } from "../config/settings";
 import type { DaemonRuntimeInfo } from "../daemon/control-types";
+import { type ControlServerLike, type LifecycleControlServerFactory } from "./lifecycle-control-runtime";
+import { NotificationOperatorRuntime, OperatorBackoffPolicy } from "./operator-runtime";
 import { type AliasTable, type CallbackRoute, type PendingAsk } from "./telegram-reference";
 export type EnsureDaemonResult = "owner_spawned" | "attached" | "disabled";
 export interface DaemonState {
@@ -58,6 +60,22 @@ export declare const CLIENT_PING_PONG_CAPABILITY = "client_ping_pong";
 /** Protocol version the daemon advertises in its ClientHello. */
 export declare const NOTIFICATION_PROTOCOL_VERSION = 2;
 export declare function daemonPaths(agentDir: string): DaemonPaths;
+/**
+ * Attach session-lifecycle control (create/close/resume) to the running daemon.
+ *
+ * Wires an already-started, authenticated control server to the lifecycle
+ * orchestrator with real daemon-side effects (tmux launcher / force-close /
+ * resume), a durable fsynced idempotency ledger + audit JSONL under the agent
+ * notifications dir, and strict paired-chat gating. The control server itself
+ * (NotificationControlServer) is owned/started by the daemon process; this
+ * function only connects it to policy. Returns the orchestrator deps for tests.
+ */
+export declare function startDaemonLifecycleControl(input: {
+    controlServer: ControlServerLike;
+    pairedChatId: string;
+    agentDir: string;
+    env?: NodeJS.ProcessEnv;
+}): void;
 export declare function registerNotificationRoot(input: {
     settings: Settings;
     cwd: string;
@@ -146,6 +164,40 @@ export interface BotApi {
         signal?: AbortSignal;
     }): Promise<unknown>;
 }
+export interface TelegramTransportOptions {
+    botToken: string;
+    apiBase?: string;
+    fetchImpl?: typeof fetch;
+    setTimeoutImpl?: typeof setTimeout;
+}
+/** Telegram Bot API transport: HTTP JSON/multipart details stay out of daemon orchestration. */
+export declare class TelegramBotTransport implements BotApi {
+    #private;
+    constructor(opts: TelegramTransportOptions);
+    call(method: string, body: unknown, opts?: {
+        signal?: AbortSignal;
+    }): Promise<unknown>;
+}
+export interface TelegramUpdatePollerOptions {
+    botApi: BotApi;
+    runtime: NotificationOperatorRuntime;
+    backoff: OperatorBackoffPolicy;
+    processUpdate: (update: unknown) => Promise<void>;
+}
+/** Owns getUpdates offset, conflict backoff, and per-update error isolation. */
+export declare class TelegramUpdatePoller {
+    #private;
+    constructor(opts: TelegramUpdatePollerOptions);
+    pollOnce(signal?: AbortSignal): Promise<number>;
+}
+/** Mutable dispatch state shared by session frames and inbound Telegram updates. */
+export declare class TelegramEventDispatchState {
+    readonly busy: Set<string>;
+    readonly inboundReactions: Map<number, {
+        messageId: number;
+    }>;
+    readonly seenUpdateIds: Set<number>;
+}
 /**
  * Cooperative control seam for the daemon run loop. Implemented by the
  * daemon-internal CLI / controller against the owner-scoped control-request
@@ -174,8 +226,17 @@ export interface TelegramDaemonOptions {
     idleTimeoutMs?: number;
     scanIntervalMs?: number;
     pid?: number;
+    /** Liveness probe for skipping dead-PID endpoint records in {@link TelegramNotificationDaemon.scanRoots}. */
+    pidAlive?: (pid: number) => boolean;
     botApi?: BotApi;
     control?: DaemonControlHooks;
+    /**
+     * Factory for the session-lifecycle control server. Defaults to the real
+     * native NotificationControlServer; tests inject a fake to verify the
+     * owner-bound start/stop lifecycle without a socket. When `undefined` AND no
+     * default applies (e.g. lifecycle control disabled), no control server starts.
+     */
+    createLifecycleControlServer?: LifecycleControlServerFactory | null;
 }
 interface SessionSocket {
     sessionId: string;
@@ -199,40 +260,72 @@ export declare class TelegramNotificationDaemon {
     readonly aliasTable: AliasTable;
     readonly messageRoutes: Map<string | number, CallbackRoute | Omit<CallbackRoute, "answer">>;
     readonly sessions: Map<string, SessionSocket>;
+    private readonly runtime;
+    private readonly sessionRouter;
+    private readonly pollConflictBackoff;
+    private readonly loopBackoff;
     private running;
-    private offset;
     private readonly fsImpl;
     private readonly botApi;
     private readonly topics;
     private readonly pool;
-    private readonly seenUpdateIds;
+    private readonly poller;
+    private readonly dispatchState;
+    /** Identity-bearing sessions by repo/branch surface, used to avoid transient duplicate topics. */
+    private readonly topicOwnerByIdentity;
+    /** Non-identity frames held until identity creates the correct thread. */
+    private readonly pendingThreadedFrames;
     /** True once the daemon has nudged the user to enable Threaded Mode. */
     private threadedFallbackNoticeSent;
     /** Sessions whose identity header was already sent flat (Threaded Mode off). */
     private readonly flatIdentitySent;
     /** Cached result of whether the paired chat is a private chat (flat-fallback gate). */
     private pairedChatPrivate;
-    private flushTimer;
-    private scanTimer;
-    private scanning;
-    private typingTimer;
     /** Sessions whose agent loop is currently busy (drives the typing indicator). */
-    private readonly busy;
+    private get busy();
     /** Inbound update id → originating Telegram message, for delivery reactions. */
-    private readonly inboundReactions;
-    /** AbortController for the in-flight long poll; aborted by requestStop() to wake the loop. */
-    private activePoll;
-    /** Set when a cooperative stop has been requested (signal or control request). */
-    private stopRequested;
-    /** Current bounded backoff after a Telegram getUpdates 409 conflict (0 when healthy). */
-    private pollConflictBackoffMs;
+    private get inboundReactions();
+    /**
+     * The owner-bound session-lifecycle control server (create/close/resume).
+     * Started in {@link run} after ownership is confirmed (so exactly one owner
+     * ever runs one), stopped in run()'s finally on any exit path.
+     */
+    private controlServer;
+    /** True while lifecycle control is active, so the loop keeps polling at idle. */
+    private lifecycleControlActive;
+    /** Control token (in-memory) the loopback client presents; never persisted/logged. */
+    private controlToken;
+    /** Loopback WS client to the daemon's own control endpoint (Option A real wire path). */
+    private controlClient;
+    /** Pending lifecycle responses awaiting a control-endpoint reply, by requestId. */
+    private readonly pendingLifecycle;
+    /** Monotonic counter for unique lifecycle request ids. */
+    private lifecycleSeq;
     /**
      * Cooperatively stop the daemon: set the stop flag and abort the in-flight
      * long poll so the run loop wakes immediately instead of waiting out the
      * ~25s getUpdates timeout. Safe to call from a signal handler.
      */
     requestStop(_reason?: "reload" | "stop" | "signal"): void;
+    private startLifecycleControl;
+    /** Stop the lifecycle control server (idempotent); called from run()'s finally. */
+    private stopLifecycleControl;
+    /**
+     * Connect the loopback control client and resolve responses by requestId.
+     * Resolves true once the socket is OPEN (bounded), false on error/timeout, so
+     * the caller only marks lifecycle control active when commands can be sent.
+     */
+    private connectControlClient;
+    /** Send a lifecycle frame over the loopback client and await the response. */
+    private submitLifecycleFrame;
+    private nextLifecycleRequestId;
+    /** Build an authenticated lifecycle frame from a parsed command + identity. */
+    private buildLifecycleFrame;
+    private handleLifecycleCommand;
+    /** Map a lifecycle response/error to a user-facing message (G010 surfacing). */
+    private formatLifecycleResponse;
     constructor(opts: TelegramDaemonOptions);
+    private createSessionRouter;
     loadAliases(): Promise<void>;
     persistAliases(): Promise<void>;
     scanRoots(): Promise<void>;
@@ -254,7 +347,14 @@ export declare class TelegramNotificationDaemon {
     private dropSession;
     private static readonly THREADED_FRAMES;
     private topicNameFor;
+    private topicIdentityKey;
+    private topicIdentityBase;
+    private topicOwnerForIdentity;
+    private submitThreadedFrame;
+    private rememberPendingThreadedFrame;
+    private flushPendingThreadedFrames;
     private ensureTopic;
+    private deleteTopic;
     private persistTopics;
     loadTopics(): Promise<void>;
     private downloadTelegramFile;
@@ -285,8 +385,6 @@ export declare class TelegramNotificationDaemon {
     private sendStaleGuidance;
     handleTelegramUpdate(update: unknown): Promise<void>;
     pollOnce(signal?: AbortSignal): Promise<number>;
-    /** Abortable sleep honoring the injected timer; resolves early on abort. */
-    private sleep;
     /** Sync the bot's Telegram command menu to what the daemon actually handles. */
     registerBotCommands(): Promise<void>;
     run(): Promise<void>;

package/dist/types/notifications/telegram-reference.d.ts

@@ -90,10 +90,12 @@ export interface RouteInboundContext {
 }
 /** Route a Telegram update to a session/action without I/O. Fail closed under ambiguity. */
 export declare function routeInboundUpdate(update: unknown, ctx: RouteInboundContext): RouteDecision;
-/** Read `{url, token}` from an endpoint discovery file. */
+/** Read `{url, token, pid?, stale?}` from an endpoint discovery file. */
 export declare function readEndpoint(path: string): {
     url: string;
     token: string;
+    pid?: number;
+    stale?: boolean;
 };
 /** Options for {@link runTelegramReferenceClient}. */
 export interface TelegramReferenceOptions {

package/dist/types/notifications/topic-registry.d.ts

@@ -1,11 +1,11 @@
 /**
  * Per-session forum-topic registry for the threaded session surface.
  *
- * Each GJC session owns exactly one Telegram forum topic in the paired private
- * DM. The topic is created once (via `createForumTopic`) and REUSED on resume,
- * keyed by session id, so a resumed session streams back into its existing
- * thread/history. The registry also tracks whether the one-time identity header
- * has already been pinned, so it is sent exactly once per topic even across
+ * Each GJC session owns one active Telegram forum topic in the paired private
+ * DM. The topic is created via `createForumTopic`, reused while the session
+ * remains active, and removed from the registry when the daemon deletes it on
+ * shutdown. The registry also tracks whether the one-time identity header has
+ * already been pinned, so it is sent exactly once per active topic, even across
  * reconnects.
  *
  * State is a plain serialisable map persisted beside the daemon state files;
@@ -45,14 +45,15 @@ export declare class TopicRegistry {
     load(state: TopicRegistryState): void;
     /** Resolve the owning session for a topic id (for fail-closed inbound routing). */
     sessionForTopic(topicId: string): string | undefined;
+    /** All session ids with a persisted topic record. */
+    sessionIds(): string[];
     /** The existing topic record for a session, if any. */
     get(sessionId: string): TopicRecord | undefined;
     /**
-     * Return the existing topic for `sessionId`, or create one via `create`
-     * (called only on first use). Reuse-on-resume: an existing record is
-     * returned without invoking `create`.
+     * Return the existing active topic for `sessionId`, or create one via
+     * `create` (called only on first use).
      */
-    getOrCreateTopic(sessionId: string, create: () => Promise<string>, now?: () => number): Promise<TopicRecord>;
+    getOrCreateTopic(sessionId: string, create: () => Promise<string>, now?: () => number, name?: string): Promise<TopicRecord>;
     /** Mark the identity header as sent for a session. Idempotent. */
     markIdentitySent(sessionId: string): void;
     /** Whether the identity header still needs sending for this session. */
@@ -62,6 +63,8 @@ export declare class TopicRegistry {
      * caller should `editForumTopic`), `false` when already current or unknown.
      */
     applyName(sessionId: string, name: string): boolean;
+    /** Remove a session topic record after Telegram deletes the topic. */
+    delete(sessionId: string): boolean;
     /** Serialise for atomic persistence beside the daemon state. */
     serialize(): TopicRegistryState;
 }

package/dist/types/runtime-mcp/types.d.ts

@@ -64,6 +64,13 @@ export interface MCPStdioServerConfig extends MCPServerConfigBase {
     command: string;
     args?: string[];
     env?: Record<string, string>;
+    /**
+     * When true, the child process is NOT given the host environment. Only a
+     * minimal OS allowlist (PATH/HOME/temp/locale) plus any explicit `env` keys
+     * are passed. Used for third-party plugin-bundle MCP servers so they cannot
+     * read host secrets from the inherited environment.
+     */
+    noInheritEnv?: boolean;
     cwd?: string;
 }
 /** HTTP server configuration (Streamable HTTP transport) */

package/dist/types/sdk.d.ts

@@ -10,6 +10,7 @@ import "./discovery";
 import type { CustomCommandsLoadResult } from "./extensibility/custom-commands";
 import type { CustomTool } from "./extensibility/custom-tools/types";
 import { type ExtensionFactory, type ExtensionUIContext, type LoadExtensionsResult, type ToolDefinition } from "./extensibility/extensions";
+import { type ConstrainedPluginHook } from "./extensibility/gjc-plugins/constrained-hooks";
 import { type Skill, type SkillWarning } from "./extensibility/skills";
 import type { FileSlashCommand } from "./extensibility/slash-commands";
 import type { HindsightSessionState } from "./hindsight/state";
@@ -240,4 +241,5 @@ export interface BuildSystemPromptOptions {
  * as separate entries so providers can cache prompt prefixes without concatenating blocks.
  */
 export declare function buildSystemPrompt(options?: BuildSystemPromptOptions): Promise<BuildSystemPromptResult>;
+export declare function createPluginHooksExtension(hooks: ConstrainedPluginHook[]): ExtensionFactory;
 export declare function createAgentSession(options?: CreateAgentSessionOptions): Promise<CreateAgentSessionResult>;

package/dist/types/session/agent-session.d.ts

@@ -69,6 +69,7 @@ import type { WorkflowGateEmitter } from "../modes/shared/agent-wire/unattended-
 import type { PlanModeState } from "../plan-mode/state";
 import { type AgentRegistry } from "../registry/agent-registry";
 import { type DiscoverableMCPSearchIndex, type DiscoverableMCPTool } from "../runtime-mcp/discoverable-tool-metadata";
+import { MCPManager } from "../runtime-mcp/manager";
 import { type SecretObfuscator } from "../secrets/obfuscator";
 import { type DiscoverableTool, type DiscoverableToolSearchIndex } from "../tool-discovery/tool-index";
 import type { AskAnswerSource, ToolSession } from "../tools";
@@ -77,7 +78,7 @@ import { type TodoItem, type TodoPhase } from "../tools/todo-write";
 import type { ClientBridge } from "./client-bridge";
 import { type ContributionPrepOptions, type ContributionPrepResult } from "./contribution-prep";
 import { type CustomMessage } from "./messages";
-import type { BranchSummaryEntry, NewSessionOptions, SessionContext, SessionManager } from "./session-manager";
+import type { BranchSummaryEntry, CompactionEntry, NewSessionOptions, SessionContext, SessionManager } from "./session-manager";
 import { ToolChoiceQueue } from "./tool-choice-queue";
 import { YieldQueue } from "./yield-queue";
 /** Session-specific events that extend the core AgentEvent */
@@ -233,6 +234,13 @@ export interface AgentSessionConfig {
      * **MUST NOT** dispose it on their own teardown.
      */
     ownedAsyncJobManager?: AsyncJobManager;
+    /**
+     * MCPManager whose lifecycle this session owns (top-level sessions that
+     * connected plugin-bundle MCP servers). Only the owned manager is
+     * disconnected on dispose; subagents and callers that merely observe the
+     * process-global manager **MUST NOT** dispose it on their own teardown.
+     */
+    ownedMcpManager?: MCPManager;
     /** Optional fork-context seed used to initialize a child session before its first prompt. */
     forkContextSeed?: ForkContextSeed;
     /** Optional provider state override. Fork-context children should omit this by default. */
@@ -676,6 +684,7 @@ export declare class AgentSession {
     get skillWarnings(): readonly SkillWarning[];
     getTodoPhases(): TodoPhase[];
     setTodoPhases(phases: TodoPhase[]): void;
+    applyCompactionPostAppendForTests(compactionEntryId: string, firstKeptEntryId: string, fromExtension?: boolean): Promise<CompactionEntry | undefined>;
     /**
      * Abort current operation and wait for agent to become idle.
      */
@@ -807,9 +816,10 @@ export declare class AgentSession {
     isFastForSubagentProvider(provider?: string): boolean;
     /**
      * True when the configured `serviceTier` resolves to `"priority"` for the
-     * *currently selected model's provider*. Returns false for scoped tiers
-     * that don't match (e.g. `"openai-only"` on an anthropic model) and when
-     * no model is selected.
+     * *currently selected model's provider* AND fast mode was not auto-disabled
+     * for that provider this session. This is the current-model EFFECTIVE
+     * predicate (what the next request actually does); use {@link isFastForProvider}
+     * for pure configured intent (e.g. subagent/`modelRoles` display rows).
      */
     isFastModeActive(): boolean;
     setServiceTier(serviceTier: ServiceTier | undefined): void;

package/dist/types/session/blob-store.d.ts

@@ -3,6 +3,14 @@ export interface BlobPutResult {
     path: string;
     get ref(): string;
 }
+export interface CheckedBlobPutResult extends BlobPutResult {
+    bytes: number;
+}
+export declare class BlobCorruptError extends Error {
+    readonly hash: string;
+    readonly path: string;
+    constructor(hash: string, path: string);
+}
 /**
  * Content-addressed blob store for externalizing large binary data (images) from session JSONL files.
  *
@@ -24,10 +32,22 @@ export declare class BlobStore {
      * Returns once the bytes are in the kernel page cache.
      */
     putSync(data: Buffer): BlobPutResult;
+    /**
+     * Durably install binary data as an immutable content-addressed blob.
+     *
+     * Callers that persist references to this blob must mutate canonical session entries only
+     * after this method returns successfully. A corrupt pre-existing target is reported with
+     * {@link BlobCorruptError}; it is never silently overwritten or trusted.
+     */
+    putImmutableSync(data: Buffer): CheckedBlobPutResult;
     /** Read blob by hash, returns Buffer or null if not found. */
     get(hash: string): Promise<Buffer | null>;
     /** Synchronously read blob by hash, returns Buffer or null if not found. */
     getSync(hash: string): Buffer | null;
+    /** Read blob by hash and verify its content hash; returns null if not found. */
+    getChecked(hash: string): Promise<Buffer | null>;
+    /** Synchronously read blob by hash and verify its content hash; returns null if not found. */
+    getCheckedSync(hash: string): Buffer | null;
     /** Check if a blob exists. */
     has(hash: string): Promise<boolean>;
 }
@@ -35,7 +55,9 @@ export declare class EphemeralBlobStore extends BlobStore {
     #private;
     constructor(dir: string);
     putSync(data: Buffer): BlobPutResult;
+    putImmutableSync(data: Buffer): CheckedBlobPutResult;
     getSync(hash: string): Buffer | null;
+    getCheckedSync(hash: string): Buffer | null;
     clear(): void;
     dispose(): void;
 }
@@ -44,8 +66,11 @@ export declare class MemoryBlobStore extends BlobStore {
     constructor();
     put(data: Buffer): Promise<BlobPutResult>;
     putSync(data: Buffer): BlobPutResult;
+    putImmutableSync(data: Buffer): CheckedBlobPutResult;
     get(hash: string): Promise<Buffer | null>;
     getSync(hash: string): Buffer | null;
+    getChecked(hash: string): Promise<Buffer | null>;
+    getCheckedSync(hash: string): Buffer | null;
     has(hash: string): Promise<boolean>;
 }
 export declare class ResidentBlobMissingError extends Error {

package/dist/types/session/session-manager.d.ts

@@ -26,9 +26,51 @@ export interface SessionEntryBase {
     parentId: string | null;
     timestamp: string;
 }
+export interface ColdSpillRef {
+    kind: "cold_spill";
+    ref: string;
+    encoding: "utf8" | "json";
+    originalChars: number;
+    sha256: string;
+    bytes: number;
+}
+export interface EvictedContentMarker {
+    evictedAt: number;
+    reason: "compacted_history";
+    compactionEntryId: string;
+    firstKeptEntryId: string;
+    payloads: Record<string, ColdSpillRef>;
+}
+export interface EvictCompactedContentResult {
+    evictedEntries: number;
+    hotCharsRemoved: number;
+    coldBlobBytes: number;
+    payloadRefs: number;
+    alreadyEvictedEntries: number;
+    coldSpillWriteCount: number;
+    coldSpillReadCount: number;
+    residentTextReadCount: number;
+    residentImageReadCount: number;
+}
+export interface SessionManagerObservabilityStats {
+    coldSpillWriteCount: number;
+    coldSpillReadCount: number;
+    residentTextReadCount: number;
+    residentImageReadCount: number;
+    publicMaterializerCallCount: number;
+    getEntryMaterializerCallCount: number;
+    getBranchMaterializerCallCount: number;
+    getEntriesMaterializerCallCount: number;
+    materializedEntriesCachePopulateCount: number;
+    pathOnlyContextBuildCount: number;
+}
 export interface SessionMessageEntry extends SessionEntryBase {
     type: "message";
     message: AgentMessage;
+    /** Cold-spill marker: when present, heavy message content was moved to durable
+     *  content-addressed blobs after compaction. The marker is entry-level session
+     *  metadata (not a message field) so strict message types stay intact. */
+    evictedContent?: EvictedContentMarker;
 }
 export interface ThinkingLevelChangeEntry extends SessionEntryBase {
     type: "thinking_level_change";
@@ -148,6 +190,8 @@ export interface CustomMessageEntry<T = unknown> extends SessionEntryBase {
     display: boolean;
     /** Who initiated this message for billing/attribution semantics. */
     attribution?: MessageAttribution;
+    /** Cold-spill marker for custom-message content evicted after compaction. */
+    evictedContent?: EvictedContentMarker;
 }
 /** Session entry - has id/parentId for tree structure (returned by "read" methods in SessionManager) */
 export type SessionEntry = SessionMessageEntry | ThinkingLevelChangeEntry | ModelChangeEntry | ServiceTierChangeEntry | CompactionEntry | BranchSummaryEntry | CustomEntry | CustomMessageEntry | LabelEntry | TtsrInjectionEntry | MCPToolSelectionEntry | SessionInitEntry | ModeChangeEntry;
@@ -480,6 +524,19 @@ export declare class SessionManager {
      * Returns undefined if no model change has been recorded.
      */
     getLastModelChangeRole(): string | undefined;
+    evictCompactedContent(firstKeptEntryId: string, compactionEntryId: string): EvictCompactedContentResult;
+    getObservabilityStatsForTests(): SessionManagerObservabilityStats;
+    hotRetainedMessageCharsForTests(): number;
+    getCanonicalEntryForTests(id: string): SessionEntry | undefined;
+    getEntryForFidelity(id: string): SessionEntry | undefined;
+    getBranchForFidelity(fromId?: string): SessionEntry[];
+    /**
+     * Walk the active branch without materializing resident blobs or rehydrating
+     * cold-spill payloads. Intended for metadata-only scans such as todo-phase
+     * sync; callers must not mutate returned entries.
+     */
+    getActivePathEntriesCanonical(fromId?: string): SessionEntry[];
+    getEntriesForExport(): SessionEntry[];
     getEntry(id: string): SessionEntry | undefined;
     /**
      * Get all direct children of an entry.

package/dist/types/slash-commands/helpers/fast-status-report.d.ts

@@ -37,6 +37,12 @@ export interface FastStatusSessionLike {
     readonly model?: Model;
     /** Fast predicate against the main session tier (current model + `modelRoles`). */
     isFastForProvider(provider?: string): boolean;
+    /**
+     * Current-model EFFECTIVE fast state (intent minus any provider auto-disable).
+     * Used for the current-model row so it matches what the next request does.
+     * Optional so lightweight fakes can omit it; falls back to `isFastForProvider`.
+     */
+    isFastModeActive?(): boolean;
     /** Fast predicate against the effective subagent tier (`task.agentModelOverrides` roles). */
     isFastForSubagentProvider(provider?: string): boolean;
     resolveRoleModelWithThinking(role: string): {

package/dist/types/system-prompt.d.ts

@@ -47,6 +47,8 @@ export interface BuildSystemPromptOptions {
     toolNames?: string[];
     /** Text to append to system prompt. */
     appendSystemPrompt?: string;
+    /** Rendered GJC plugin system-appendix blocks (lower-authority, appended last). */
+    pluginAppendices?: string;
     /** Repeat full tool descriptions in system prompt. Default: false */
     repeatToolDescriptions?: boolean;
     /** Skills settings for discovery. */

package/dist/types/task/executor.d.ts

@@ -4,6 +4,7 @@
  * Runs each subagent on the main thread and forwards AgentEvents for progress tracking.
  */
 import type { AgentTelemetryConfig, ThinkingLevel } from "@gajae-code/agent-core";
+import type { ServiceTier } from "@gajae-code/ai";
 import { ModelRegistry } from "../config/model-registry";
 import type { PromptTemplate } from "../config/prompt-templates";
 import { Settings } from "../config/settings";
@@ -58,6 +59,13 @@ export interface ExecutorOptions {
     authStorage?: AuthStorage;
     modelRegistry?: ModelRegistry;
     settings?: Settings;
+    /**
+     * Live service-tier intent of the parent session (`AgentSession.serviceTier`),
+     * used as the inherited tier when `task.serviceTier === "inherit"`. Passing the
+     * live value (not the stale settings snapshot) lets a runtime `/fast on` reach
+     * subagents, and a main-model fast-mode auto-disable does not clobber it.
+     */
+    inheritedServiceTier?: ServiceTier;
     /** Override local:// protocol options so subagent shares parent's local:// root */
     localProtocolOptions?: LocalProtocolOptions;
     /**
@@ -105,7 +113,7 @@ interface FinalizeSubprocessOutputResult {
 export declare const SUBAGENT_WARNING_NULL_YIELD = "SYSTEM WARNING: Subagent called yield with null data.";
 export declare const SUBAGENT_WARNING_MISSING_YIELD = "SYSTEM WARNING: Subagent exited without calling yield tool after 3 reminders.";
 export declare function finalizeSubprocessOutput(args: FinalizeSubprocessOutputArgs): FinalizeSubprocessOutputResult;
-export declare function createSubagentSettings(baseSettings: Settings): Settings;
+export declare function createSubagentSettings(baseSettings: Settings, inheritedServiceTier?: ServiceTier): Settings;
 /**
  * Run a single agent in-process.
  */

package/dist/types/tools/composer-bash-policy.d.ts

@@ -0,0 +1,14 @@
+export declare const COMPOSER_BASH_POLICY_ERROR = "Composer bash policy blocked repository file I/O. Use find, search, read, and edit tools for file discovery, file inspection, and file mutation.";
+type ComposerBashPolicyResult = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: string;
+    message: string;
+};
+export declare function isComposerBashPolicyModel(modelId: string | undefined): boolean;
+export declare function checkComposerBashPolicy(input: {
+    modelId?: string;
+    commands: readonly string[];
+}): ComposerBashPolicyResult;
+export {};

package/dist/types/tools/index.d.ts

@@ -1,5 +1,5 @@
 import type { AgentTelemetryConfig, AgentTool } from "@gajae-code/agent-core";
-import type { Model, ToolChoice } from "@gajae-code/ai";
+import type { Model, ServiceTier, ToolChoice } from "@gajae-code/ai";
 import type { PromptTemplate } from "../config/prompt-templates";
 import type { Settings } from "../config/settings";
 import type { Skill } from "../extensibility/skills";
@@ -173,6 +173,8 @@ export interface ToolSession {
     agentOutputManager?: AgentOutputManager;
     /** Settings instance for passing to subagents */
     settings: Settings;
+    /** Live service-tier intent of the parent session, inherited by `inherit` subagents. */
+    serviceTier?: ServiceTier;
     /** Plan mode state (if active) */
     getPlanModeState?: () => PlanModeState | undefined;
     /** Goal mode state (if active or paused) */

package/dist/types/utils/changelog.d.ts

@@ -25,6 +25,7 @@ export declare function parseChangelog(changelogPath: string): Promise<Changelog
  * binary-identity changelog).
  */
 export declare function getDisplayChangelogEntries(): ChangelogEntry[];
+export declare function getInstalledVersionChangelogEntry(entries: readonly ChangelogEntry[], installedVersion: string): ChangelogEntry | undefined;
 /**
  * Compare versions. Returns: -1 if v1 < v2, 0 if v1 === v2, 1 if v1 > v2
  */

package/dist/types/web/insane/url-guard.d.ts

@@ -13,10 +13,13 @@ export type AddressResolver = (hostname: string) => Promise<string[]>;
 /** True for any address that is not a routable public unicast address. */
 export declare function isPrivateOrSpecialAddress(address: string): boolean;
 /**
- * Validate that `rawUrl` is a public http/https target safe to hand to the
- * insane-search engine. Resolves DNS names and rejects any that map to a
- * private/special address. Never throws; returns a discriminated result.
+ * Validate that `rawUrl` is a public http/https target. Resolves DNS names and
+ * rejects any that map to a private/special address. Never throws; returns a
+ * discriminated result.
  */
+export declare function validatePublicHttpUrl(rawUrl: string, options?: {
+    resolver?: AddressResolver;
+}): Promise<PublicUrlResult>;
 export declare function validatePublicHttpUrlForInsane(rawUrl: string, options?: {
     resolver?: AddressResolver;
 }): Promise<PublicUrlResult>;

package/dist/types/web/scrapers/types.d.ts

@@ -1,4 +1,5 @@
 import type { AgentStorage } from "../../session/agent-storage";
+import type { AddressResolver } from "../insane/url-guard";
 export { formatNumber } from "@gajae-code/utils";
 export interface RenderResult {
     url: string;
@@ -27,6 +28,9 @@ export interface LoadPageOptions {
     body?: string;
     maxBytes?: number;
     signal?: AbortSignal;
+    publicUrlGuard?: boolean;
+    resolver?: AddressResolver;
+    maxRedirects?: number;
 }
 export interface LoadPageResult {
     content: string;
@@ -34,6 +38,7 @@ export interface LoadPageResult {
     finalUrl: string;
     ok: boolean;
     status?: number;
+    error?: string;
 }
 /**
  * Fetch a page with timeout and size limit

package/dist/types/web/scrapers/utils.d.ts

@@ -1,5 +1,6 @@
 import { isRecord } from "@gajae-code/utils";
 export { isRecord };
+import type { AddressResolver } from "../insane/url-guard";
 export declare function asRecord(value: unknown): Record<string, unknown> | null;
 export declare function asString(value: unknown): string | null;
 export declare function asNumber(value: unknown): number | null;
@@ -12,10 +13,15 @@ export type BinaryFetchResult = BinaryFetchSuccess | {
     ok: false;
     error?: string;
 };
+export interface FetchBinaryOptions {
+    publicUrlGuard?: boolean;
+    resolver?: AddressResolver;
+    maxRedirects?: number;
+}
 /**
  * Fetch binary content from a URL
  */
-export declare function fetchBinary(url: string, timeout?: number, signal?: AbortSignal): Promise<BinaryFetchResult>;
+export declare function fetchBinary(url: string, timeout?: number, signal?: AbortSignal, options?: FetchBinaryOptions): Promise<BinaryFetchResult>;
 /**
  * Convert binary content to markdown using markit.
  */