@kodax-ai/kodax 0.7.41 → 0.7.43

package/dist/sdk-coding.d.ts

@@ -1,439 +1,24 @@
-import { o as KodaXMessage, a as CapabilityProvider, C as CapabilityKind, b as CapabilityResult, _ as KodaXToolDefinition, G as KodaXReasoningMode, a0 as KodaXToolUseBlock, i as KodaXContentBlock, s as KodaXProviderCapabilityProfile, F as KodaXReasoningCapability, T as KodaXTaskType, k as KodaXExecutionMode, S as KodaXTaskRoutingDecision, K as KodaXAmaControllerDecision, Y as KodaXThinkingDepth } from './types-chunks/capability.d-BxNgd1-c.js';
-export { c as KodaXAmaFanoutClass, d as KodaXAmaFanoutPolicy, e as KodaXAmaProfile, f as KodaXAmaTactic, j as KodaXCustomProviderConfig, n as KodaXImageBlock, p as KodaXModelDescriptor, r as KodaXProtocolFamily, t as KodaXProviderConfig, v as KodaXProviderConversationSemantics, y as KodaXProviderMcpSupport, B as KodaXProviderStreamOptions, E as KodaXProviderTransport, H as KodaXReasoningOverride, I as KodaXReasoningRequest, J as KodaXRedactedThinkingBlock, L as KodaXReviewScale, M as KodaXRiskLevel, N as KodaXStreamResult, P as KodaXTaskBudgetOverrides, V as KodaXTextBlock, W as KodaXThinkingBlock, X as KodaXThinkingBudgetMap, Z as KodaXTokenUsage, $ as KodaXToolResultBlock } from './types-chunks/capability.d-BxNgd1-c.js';
-export { K as KODAX_DEFAULT_PROVIDER, b as KODAX_PROVIDERS, c as KODAX_PROVIDER_SNAPSHOTS, d as KODAX_REASONING_MODE_SEQUENCE, f as KodaXAnthropicCompatProvider, g as KodaXError, i as KodaXOpenAICompatProvider, j as KodaXProviderError, k as KodaXRateLimitError, P as ProviderName, m as buildReasoningOverrideKey, o as clearReasoningOverride, p as clearRuntimeModelProviders, q as createCustomProvider, r as getAvailableProviderNames, s as getCustomProvider, t as getCustomProviderList, u as getCustomProviderModels, v as getCustomProviderNames, x as getProvider, y as getProviderConfiguredCapabilityProfile, z as getProviderConfiguredReasoningCapability, A as getProviderList, B as getProviderModel, C as getProviderModels, E as getRuntimeModelProvider, F as getRuntimeModelProviderNames, G as isCustomProviderName, H as isKnownProvider, I as isProviderConfigured, J as isProviderName, M as isRuntimeModelProviderName, N as loadReasoningOverride, R as reasoningCapabilityToOverride, S as reasoningOverrideToCapability, T as registerCustomProviders, U as registerModelProvider, V as resolveProvider, X as saveReasoningOverride } from './types-chunks/resolver.d-BwD6TKz7.js';
-import { K as KodaXBaseProvider, a as CostTracker } from './types-chunks/cost-tracker.d-C4dMlQuV.js';
-import { q as CompactionDetails, ay as McpServerConfig, az as McpServersConfig, as as KodaXToolExecutionContext, a2 as KodaXRepoIntelligenceCapability, a5 as KodaXRepoIntelligenceTrace, a3 as KodaXRepoIntelligenceMode, a7 as KodaXRepoRoutingSignals, a4 as KodaXRepoIntelligenceResolvedMode, _ as KodaXOptions, P as KodaXInputArtifact, G as KodaXContextOptions, a1 as KodaXProviderPolicyHints, aD as ProviderResilienceConfig, aE as ProviderResiliencePolicy, F as FailureStage, aJ as ResilienceClassification, aB as ProviderExecutionState, aG as RecoveryDecision, aI as RecoveryResult, a8 as KodaXResult, O as KodaXFanoutSchedulerPlan, M as KodaXFanoutBranchTransition, N as KodaXFanoutSchedulerInput, z as KodaXChildContextBundle, a0 as KodaXParentReductionContract, L as KodaXFanoutBranchRecord, R as KodaXManagedProtocolPayload, u as ExtensionRuntimeContract, I as KodaXEvents, k as AutoRules, aS as ToolCallSignal, aN as SignalCollector } from './types-chunks/bash-prefix-extractor.d-B2iliwdi.js';
-export { C as AUTO_MODE_DENIAL_CONSECUTIVE_THRESHOLD, n as AUTO_MODE_DENIAL_CUMULATIVE_THRESHOLD, A as AgentsFile, a as AskUserMultiOptions, b as AskUserQuestionItem, c as AskUserQuestionOptions, d as AutoModeAskUser, e as AutoModeAskUserVerdict, D as AutoModeDenialTracker, f as AutoModeEngine, g as AutoModeGuardrailConfig, h as AutoModeSharedState, i as AutoModeStats, j as AutoModeToolGuardrail, B as BASH_POLICY_SPEC, E as BREAKER_ERROR_THRESHOLD, aU as BREAKER_WINDOW_MS, l as BashPrefixExtractor, m as BashPrefixResult, o as CircuitBreaker, p as CompactionAnchor, r as CompactionResult, s as CompactionUpdate, t as CreateBashPrefixExtractorOptions, v as ExtractCommandPrefixOptions, K as KodaXAgentMode, w as KodaXBudgetDisclosureZone, x as KodaXBudgetExtensionRequest, y as KodaXChildAgentResult, H as KodaXContextTokenSnapshot, J as KodaXFanoutBranchLifecycle, Q as KodaXManagedBudgetSnapshot, S as KodaXManagedTask, T as KodaXManagedTaskRuntimeState, U as KodaXManagedTaskStatusEvent, V as KodaXMcpConnectMode, W as KodaXMcpServerConfig, X as KodaXMcpServersConfig, Y as KodaXMcpTransport, Z as KodaXMemoryStrategy, $ as KodaXOrchestrationVerdict, a6 as KodaXRepoIntelligenceTraceEvent, a9 as KodaXRoleRoundSummary, aa as KodaXRuntimeVerificationContract, ab as KodaXSessionOptions, ac as KodaXSkillInvocationContext, ad as KodaXSkillMap, ae as KodaXSkillProjectionConfidence, af as KodaXTaskCapabilityHint, ag as KodaXTaskContract, ah as KodaXTaskEvidenceArtifact, ai as KodaXTaskEvidenceBundle, aj as KodaXTaskEvidenceEntry, ak as KodaXTaskRole, al as KodaXTaskRoleAssignment, am as KodaXTaskStatus, an as KodaXTaskSurface, ao as KodaXTaskToolPolicy, ap as KodaXTaskVerificationContract, aq as KodaXTaskVerificationCriterion, ar as KodaXTaskWorkItem, at as KodaXVerificationScorecard, au as KodaXVerificationScorecardCriterion, av as LoadAgentsOptions, aw as LoadedRulesSource, ax as McpConnectMode, aA as McpTransportKind, aC as ProviderRecoveryEvent, aF as RecoveryAction, aH as RecoveryLadderStep, aK as ResilienceErrorClass, aL as RulesLoadError, aM as RulesLoadResult, aO as SkippedRulesSource, aP as TodoItem, aQ as TodoList, aR as TodoStatus, aT as TrustState, b9 as autoModeDenialShouldFallback, ba as breakerShouldFallback, aV as collectAllSignals, aW as computeRulesFingerprint, a_ as createAutoModeDenialTracker, aX as createAutoModeToolGuardrail, aY as createBashPrefixExtractor, aZ as createCircuitBreaker, a$ as extractCommandPrefix, b0 as formatAgentsForPrompt, b1 as getKodaxGlobalDir, b2 as loadAgentsFiles, b3 as loadAutoRules, b4 as parseAutoRules, b5 as readTrustState, b6 as recordAutoModeAllow, b7 as recordAutoModeBlock, b8 as recordBreakerError, bb as trustProjectRules } from './types-chunks/bash-prefix-extractor.d-B2iliwdi.js';
-import { N as SessionExtension, L as SessionEntry, g as CompactionPolicy, S as Session, C as CompactionContext, w as PolicyCompactionResult, Q as QualityInvariant, W as ToolCapability } from './types-chunks/history-cleanup.d-q1vAvCss.js';
-export { e as CompactionEntry, f as CompactionEntryPayload, h as DefaultSummaryCompaction, i as DefaultSummaryCompactionOptions, I as InMemorySessionOptions, K as KODAX_API_MIN_INTERVAL, n as KODAX_DEFAULT_TIMEOUT, o as KODAX_HARD_TIMEOUT, p as KODAX_MAX_INCOMPLETE_RETRIES, r as KODAX_MAX_RETRIES, s as KODAX_MAX_TOKENS, t as KODAX_RETRY_BASE_DELAY, u as KODAX_STAGGER_DELAY, v as MessageEntry, P as PROMISE_PATTERN, x as PresetDispatcher, B as RunEvent, E as RunOptions, F as RunResult, G as Runner, T as SessionForkOptions, $ as cleanupIncompleteToolCalls, a0 as countTokens, a1 as createInMemorySession, a4 as estimateTokens, a7 as registerPresetDispatcher, aa as validateAndFixToolHistory } from './types-chunks/history-cleanup.d-q1vAvCss.js';
-import { z as KodaXSessionLineage, q as KodaXJsonValue, l as KodaXCompactMemorySeed, w as KodaXSessionEntry, N as KodaXSessionTreeNode, y as KodaXSessionLabelEntry, F as KodaXSessionNavigationOptions, s as KodaXSessionArtifactLedgerEntry, m as KodaXExtensionSessionRecord, o as KodaXExtensionStore, a3 as SessionErrorMetadata, Y as RunnableTool, A as Agent, ae as ToolGuardrail, a as AgentMessage, _ as RunnerLlmReturn, $ as RunnerToolCall } from './types-chunks/instance-discovery.d-DZhp77vb.js';
-export { c as AgentReasoningProfile, d as AgentTool, G as Guardrail, H as Handoff, K as KodaXCompactMemoryProgress, n as KodaXExtensionSessionState, t as KodaXSessionBranchSummaryEntry, u as KodaXSessionCompactionEntry, v as KodaXSessionData, x as KodaXSessionEntryBase, B as KodaXSessionMessageEntry, E as KodaXSessionMeta, J as KodaXSessionRuntimeInfo, L as KodaXSessionScope, M as KodaXSessionStorage, O as KodaXSessionUiHistoryItem, P as KodaXSessionUiHistoryItemType, Q as KodaXSessionWorkspaceKind, U as ReasoningDepth, ai as createAgent, aj as createHandoff } from './types-chunks/instance-discovery.d-DZhp77vb.js';
+import { X as KodaXToolDefinition, Z as KodaXToolResultContentItem, D as KodaXReasoningMode, m as KodaXMessage, a0 as KodaXToolUseBlock, g as KodaXContentBlock, q as KodaXProviderCapabilityProfile, C as KodaXReasoningCapability, Q as KodaXTaskType, i as KodaXExecutionMode, P as KodaXTaskRoutingDecision, K as KodaXAmaControllerDecision, V as KodaXThinkingDepth } from './types-chunks/types.d-B1uGoVTE.js';
+export { a as KodaXAmaFanoutClass, b as KodaXAmaFanoutPolicy, c as KodaXAmaProfile, d as KodaXAmaTactic, h as KodaXCustomProviderConfig, l as KodaXImageBlock, n as KodaXModelDescriptor, p as KodaXProtocolFamily, r as KodaXProviderConfig, t as KodaXProviderConversationSemantics, w as KodaXProviderMcpSupport, z as KodaXProviderStreamOptions, B as KodaXProviderTransport, E as KodaXReasoningOverride, F as KodaXReasoningRequest, G as KodaXRedactedThinkingBlock, H as KodaXReviewScale, I as KodaXRiskLevel, J as KodaXStreamResult, M as KodaXTaskBudgetOverrides, S as KodaXTextBlock, T as KodaXThinkingBlock, U as KodaXThinkingBudgetMap, W as KodaXTokenUsage, Y as KodaXToolResultBlock } from './types-chunks/types.d-B1uGoVTE.js';
+export { K as KODAX_DEFAULT_PROVIDER, b as KODAX_PROVIDERS, c as KODAX_PROVIDER_SNAPSHOTS, d as KODAX_REASONING_MODE_SEQUENCE, f as KodaXAnthropicCompatProvider, g as KodaXError, h as KodaXModelCapabilities, j as KodaXOpenAICompatProvider, k as KodaXProviderError, l as KodaXRateLimitError, P as ProviderName, n as buildReasoningOverrideKey, p as clearReasoningOverride, q as clearRuntimeModelProviders, r as createCustomProvider, s as getAvailableProviderNames, t as getCustomModelCapabilities, u as getCustomProvider, v as getCustomProviderList, w as getCustomProviderModelDescriptors, x as getCustomProviderModels, y as getCustomProviderNames, A as getModelCapabilities, B as getProvider, C as getProviderConfiguredCapabilityProfile, D as getProviderConfiguredReasoningCapability, E as getProviderList, F as getProviderModel, G as getProviderModelDescriptors, H as getProviderModels, J as getRuntimeModelProvider, L as getRuntimeModelProviderNames, M as isCustomProviderName, N as isKnownProvider, O as isProviderConfigured, Q as isProviderName, S as isRuntimeModelProviderName, T as listAllModelCapabilities, U as listBuiltinModelCapabilities, V as listCustomProviderModelCapabilities, W as loadReasoningOverride, Z as reasoningCapabilityToOverride, _ as reasoningOverrideToCapability, $ as registerCustomProviders, a0 as registerModelProvider, a1 as resolveModelCapabilities, a2 as resolveProvider, a3 as resolveProviderModelDescriptors, a5 as saveReasoningOverride, a6 as validateCustomProviderConfig } from './types-chunks/resolver.d-CA68_NeH.js';
+import { K as KodaXBaseProvider } from './types-chunks/base.d-FUJahC0i.js';
+import { C as CapabilityKind, a as CapabilityProvider, b as CapabilityResult } from './types-chunks/capability.d-3C62G8Eq.js';
+import { aq as KodaXToolExecutionContext, _ as KodaXRepoIntelligenceCapability, a1 as KodaXRepoIntelligenceTrace, $ as KodaXRepoIntelligenceMode, a3 as KodaXRepoRoutingSignals, a0 as KodaXRepoIntelligenceResolvedMode, W as KodaXOptions, L as KodaXInputArtifact, w as KodaXContextOptions, Z as KodaXProviderPolicyHints, ax as ProviderResilienceConfig, ay as ProviderResiliencePolicy, F as FailureStage, aD as ResilienceClassification, av as ProviderExecutionState, aA as RecoveryDecision, aC as RecoveryResult, a4 as KodaXResult, a7 as KodaXSessionControl, a8 as KodaXSessionMutators, J as KodaXFanoutSchedulerPlan, H as KodaXFanoutBranchTransition, I as KodaXFanoutSchedulerInput, v as KodaXChildContextBundle, Y as KodaXParentReductionContract, G as KodaXFanoutBranchRecord, N as KodaXManagedProtocolPayload, q as ExtensionRuntimeContract, y as KodaXEvents, k as AutoRules, aM as ToolCallSignal, aH as SignalCollector } from './types-chunks/bash-prefix-extractor.d-DMrGImMl.js';
+export { C as AUTO_MODE_DENIAL_CONSECUTIVE_THRESHOLD, n as AUTO_MODE_DENIAL_CUMULATIVE_THRESHOLD, A as AgentsFile, a as AskUserMultiOptions, b as AskUserQuestionItem, c as AskUserQuestionOptions, d as AutoModeAskUser, e as AutoModeAskUserVerdict, D as AutoModeDenialTracker, f as AutoModeEngine, g as AutoModeGuardrailConfig, h as AutoModeSharedState, i as AutoModeStats, j as AutoModeToolGuardrail, B as BASH_POLICY_SPEC, E as BREAKER_ERROR_THRESHOLD, aO as BREAKER_WINDOW_MS, l as BashPrefixExtractor, m as BashPrefixResult, o as CircuitBreaker, p as CreateBashPrefixExtractorOptions, r as ExtractCommandPrefixOptions, K as KodaXAgentMode, s as KodaXBudgetDisclosureZone, t as KodaXBudgetExtensionRequest, u as KodaXChildAgentResult, x as KodaXContextTokenSnapshot, z as KodaXFanoutBranchLifecycle, M as KodaXManagedBudgetSnapshot, O as KodaXManagedTask, P as KodaXManagedTaskRuntimeState, Q as KodaXManagedTaskStatusEvent, R as KodaXMcpConnectMode, S as KodaXMcpServerConfig, T as KodaXMcpServersConfig, U as KodaXMcpTransport, V as KodaXMemoryStrategy, X as KodaXOrchestrationVerdict, a2 as KodaXRepoIntelligenceTraceEvent, a5 as KodaXRoleRoundSummary, a6 as KodaXRuntimeVerificationContract, a9 as KodaXSessionOptions, aa as KodaXSkillInvocationContext, ab as KodaXSkillMap, ac as KodaXSkillProjectionConfidence, ad as KodaXTaskCapabilityHint, ae as KodaXTaskContract, af as KodaXTaskEvidenceArtifact, ag as KodaXTaskEvidenceBundle, ah as KodaXTaskEvidenceEntry, ai as KodaXTaskRole, aj as KodaXTaskRoleAssignment, ak as KodaXTaskStatus, al as KodaXTaskSurface, am as KodaXTaskToolPolicy, an as KodaXTaskVerificationContract, ao as KodaXTaskVerificationCriterion, ap as KodaXTaskWorkItem, ar as KodaXVerificationScorecard, as as KodaXVerificationScorecardCriterion, at as LoadAgentsOptions, au as LoadedRulesSource, aw as ProviderRecoveryEvent, az as RecoveryAction, aB as RecoveryLadderStep, aE as ResilienceErrorClass, aF as RulesLoadError, aG as RulesLoadResult, aI as SkippedRulesSource, aJ as TodoItem, aK as TodoList, aL as TodoStatus, aN as TrustState, b3 as autoModeDenialShouldFallback, b4 as breakerShouldFallback, aP as collectAllSignals, aQ as computeRulesFingerprint, aU as createAutoModeDenialTracker, aR as createAutoModeToolGuardrail, aS as createBashPrefixExtractor, aT as createCircuitBreaker, aV as extractCommandPrefix, aW as formatAgentsForPrompt, aX as getKodaxGlobalDir, aY as loadAgentsFiles, aZ as loadAutoRules, a_ as parseAutoRules, a$ as readTrustState, b0 as recordAutoModeAllow, b1 as recordAutoModeBlock, b2 as recordBreakerError, b5 as trustProjectRules } from './types-chunks/bash-prefix-extractor.d-DMrGImMl.js';
+import { f as KodaXJsonValue, b as KodaXExtensionSessionRecord, d as KodaXExtensionStore, S as SessionErrorMetadata } from './types-chunks/types.d-mM8vqvhT.js';
+export { K as KodaXCompactMemoryProgress, a as KodaXCompactMemorySeed, c as KodaXExtensionSessionState, h as KodaXSessionArtifactLedgerEntry, i as KodaXSessionBranchSummaryEntry, j as KodaXSessionCompactionEntry, k as KodaXSessionData, l as KodaXSessionEntry, m as KodaXSessionEntryBase, n as KodaXSessionLabelEntry, o as KodaXSessionLineage, p as KodaXSessionMessageEntry, q as KodaXSessionMeta, r as KodaXSessionNavigationOptions, s as KodaXSessionRuntimeInfo, t as KodaXSessionScope, u as KodaXSessionStorage, v as KodaXSessionTreeNode, w as KodaXSessionUiHistoryItem, x as KodaXSessionUiHistoryItemType, y as KodaXSessionWorkspaceKind } from './types-chunks/types.d-mM8vqvhT.js';
+import { Q as QualityInvariant, a6 as ToolCapability } from './types-chunks/file-tracker.d-zaLZeNBK.js';
+export { C as CompactionContext, e as CompactionEntry, f as CompactionEntryPayload, g as CompactionPolicy, h as DefaultSummaryCompaction, i as DefaultSummaryCompactionOptions, I as InMemorySessionOptions, K as KODAX_API_MIN_INTERVAL, n as KODAX_DEFAULT_TIMEOUT, o as KODAX_HARD_TIMEOUT, p as KODAX_MAX_INCOMPLETE_RETRIES, r as KODAX_MAX_RETRIES, s as KODAX_MAX_TOKENS, t as KODAX_RETRY_BASE_DELAY, u as KODAX_STAGGER_DELAY, L as LINEAGE_ENTRY_TYPES, v as LineageArtifactLedgerPayload, w as LineageCompaction, x as LineageCompactionDelegates, y as LineageEntryType, z as LineageExtension, B as LineageLabelPayload, E as LineageTreeNode, F as MessageEntry, P as PROMISE_PATTERN, H as PresetDispatcher, S as RunEvent, T as RunOptions, U as RunResult, V as Runner, X as Session, Z as SessionEntry, _ as SessionExtension, $ as SessionForkOptions, ae as appendSessionLineageLabel, ag as applySessionCompaction, ah as archiveOldIslands, ai as buildSessionTree, ak as cleanupIncompleteToolCalls, al as countActiveLineageMessages, am as countTokens, an as createInMemorySession, ap as createSessionLineage, at as estimateTokens, au as extractArtifactLedger, ax as extractTitleFromMessages, ay as findPreviousUserEntryId, az as forkSessionLineage, aA as generateSessionId, aC as getAgentConfigHome, aD as getAgentConfigPath, aE as getAppDataDir, aF as getSessionLineagePath, aG as getSessionMessagesFromLineage, aH as mergeArtifactLedger, aJ as registerPresetDispatcher, aK as resolveSessionLineageTarget, aL as rewindSessionLineage, aO as setAgentConfigHome, aP as setSessionLineageActiveEntry, aQ as validateAndFixToolHistory } from './types-chunks/file-tracker.d-zaLZeNBK.js';
+import { z as RunnableTool, A as Agent, a4 as ToolGuardrail, a as AgentMessage, J as RunnerLlmReturn, K as RunnerToolCall } from './types-chunks/types.d-CKJtjo-6.js';
+export { c as AgentReasoningProfile, e as AgentTool, f as CompactionAnchor, i as CompactionResult, k as CompactionUpdate, o as Guardrail, H as Handoff, R as ReasoningDepth, a8 as createAgent, a9 as createHandoff } from './types-chunks/types.d-CKJtjo-6.js';
+import { b as McpServersConfig } from './types-chunks/config.d-BfJUXxC0.js';
+export { M as McpConnectMode, a as McpServerConfig, c as McpTransportKind } from './types-chunks/config.d-BfJUXxC0.js';
+import { f as McpProviderOptions, b as McpCapabilityProvider } from './types-chunks/manager.d-87belpiS.js';
+export { M as McpCapabilityDescriptor, a as McpCapabilityKind, c as McpCapabilityRisk, d as McpCatalogItem, e as McpManager, g as McpServerCatalog, h as McpServerCatalogSnapshot, i as McpServerLogs, j as McpServerRuntime, k as McpServerRuntimeDiagnostics, l as McpServerStatus, m as McpServerToolList, n as McpTransport, o as McpTransportEvents, p as createMcpCapabilityId, q as createMcpManager, r as createMcpTransport, s as defaultMcpCacheDir, t as getMcpCachePaths, u as parseMcpCapabilityId, v as searchMcpCatalog } from './types-chunks/manager.d-87belpiS.js';
+import { a as CostTracker } from './types-chunks/cost-tracker.d-wRtyEW9d.js';
 import '@anthropic-ai/sdk';
 import 'openai';
 
-/**
- * LineageExtension — SessionExtension façade over lineage semantics.
- *
- * FEATURE_081 (v0.7.23): expresses today's `KodaXSessionLineage` operations
- * (label, rewind, compaction ledger, branch summary) as a
- * `SessionExtension` over the base `Session` primitive.
- *
- * FEATURE_082 (v0.7.24): moved from `@kodax-ai/coding/src/extensions/lineage.ts`
- * to this package. Depends on `@kodax-ai/agent` for `Session` / `SessionEntry` /
- * `SessionExtension` (Layer A primitives — extracted to `@kodax-ai/core` in
- * FEATURE_082, merged back into `@kodax-ai/agent` in v0.7.35.1 FEATURE_142).
- * `@kodax-ai/coding` keeps a barrel re-export.
- *
- * Scope:
- *   - Declare the extension object.
- *   - Implement `label` and `attachArtifact` operators that append standard
- *     entries to a Session.
- *   - Implement a `buildLineageTree` reducer that projects an entry stream
- *     back to a navigable tree.
- *   - NOT re-implemented here: `branch`, `rewind`, full compaction. Those
- *     stay in `@kodax-ai/agent/session-lineage.ts` for coding-preset use; the
- *     `LineageCompaction` policy in this package is the thin wrapper that
- *     adapts them to the Layer A `CompactionPolicy` contract.
- */
-
-/**
- * Entry types claimed by `LineageExtension`. Mirrors the legacy
- * `KodaXSessionEntry` tagged union plus a `rewind_marker` placeholder (the
- * legacy lineage records rewinds via `activeEntryId` mutation; Session is
- * linear, so a marker entry is the equivalent).
- */
-declare const LINEAGE_ENTRY_TYPES: readonly ["message", "label", "compaction", "branch_summary", "archive_marker", "rewind_marker", "artifact_ledger"];
-type LineageEntryType = (typeof LINEAGE_ENTRY_TYPES)[number];
-/**
- * Payload shape for a `label` entry. Mirrors
- * `KodaXSessionLabelEntry.targetId`/`label` fields on the legacy lineage.
- */
-interface LineageLabelPayload {
-    readonly targetId: string;
-    readonly label?: string;
-}
-/**
- * Payload shape for an `artifact_ledger` entry. Mirrors a minimal subset of
- * `KodaXSessionArtifactLedgerEntry`; full semantic fidelity is kept on the
- * legacy side for now and normalised in FEATURE_082.
- */
-interface LineageArtifactLedgerPayload {
-    readonly ref: string;
-    readonly kind?: string;
-    readonly summary?: string;
-}
-/**
- * Projected tree node. Mirrors the navigation shape of
- * `KodaXSessionTreeNode` from `@kodax-ai/agent/types.ts`, restricted to the
- * fields the base Session can supply.
- */
-interface LineageTreeNode {
-    readonly entry: SessionEntry;
-    readonly children: LineageTreeNode[];
-    readonly label?: string;
-}
-/**
- * The exported extension. Operators write standard-shaped entries; the
- * reducer projects an entry stream back to a navigable tree.
- *
- * Immutability: top-level object, `operators`, and `reducers` are all
- * frozen. Freezes are shallow — the functions stored inside `operators`
- * and `reducers` are immutable by nature (closures reference only
- * module-private state). External code must not mutate the extension;
- * doing so is a programmer error that the type-level `readonly` already
- * disallows without a cast.
- */
-declare const LineageExtension: SessionExtension;
-
-/**
- * LineageCompaction — `CompactionPolicy` adapter for the coding preset's
- * FEATURE_072 lineage-native compaction runtime.
- *
- * FEATURE_082 (v0.7.24): introduced alongside the lineage extraction so the
- * coding preset can implement `CompactionPolicy` without re-implementing the
- * compaction loop. The actual compaction runtime (microcompaction, post-
- * compact reconstruction, summary generation) stays in
- * `@kodax-ai/agent/src/compaction/` until FEATURE_084 (v0.7.26) consolidates it.
- *
- * Usage (inside @kodax-ai/coding):
- *
- *   const policy = new LineageCompaction({
- *     shouldCompact: (session, used, budget) => runFeature072Heuristic(used, budget),
- *     compact: async (session, ctx) => runFeature072Compaction(session, ctx),
- *   });
- *
- * The injected delegates keep this package free of coding-specific imports,
- * preserving the dependency direction
- * `@kodax-ai/coding -> @kodax-ai/session-lineage -> @kodax-ai/agent`.
- */
-
-/**
- * Delegates required to implement `LineageCompaction`. The coding preset
- * supplies implementations that bridge to the existing FEATURE_072 code
- * paths.
- */
-interface LineageCompactionDelegates {
-    readonly shouldCompact: (session: Session, tokensUsed: number, budget: number) => boolean;
-    readonly compact: (session: Session, ctx: CompactionContext) => Promise<PolicyCompactionResult>;
-    readonly restore?: (session: Session, hint: unknown) => Promise<void>;
-}
-/**
- * `CompactionPolicy` implementation that preserves FEATURE_072 lineage-native
- * compaction semantics by delegating to injected coding-preset functions.
- */
-declare class LineageCompaction implements CompactionPolicy {
-    readonly name = "lineage-compaction";
-    private readonly delegates;
-    constructor(delegates: LineageCompactionDelegates);
-    shouldCompact(session: Session, tokensUsed: number, budget: number): boolean;
-    compact(session: Session, ctx: CompactionContext): Promise<PolicyCompactionResult>;
-    restore(session: Session, hint: unknown): Promise<void>;
-}
-
-/**
- * @kodax-ai/agent Session
- *
- * 会话管理 - Session ID 生成和消息处理
- */
-
-/**
- * 生成会话 ID
- * 格式: YYYYMMDD_HHMMSS
- */
-declare function generateSessionId(): Promise<string>;
-/**
- * 从消息中提取标题
- * 取第一条用户消息的前50个字符
- */
-declare function extractTitleFromMessages(messages: KodaXMessage[]): string;
-
-type NavigableSessionEntry = Exclude<KodaXSessionEntry, KodaXSessionLabelEntry>;
-/**
- * Reconcile a linear message list against an existing lineage tree.
- *
- * Existing matching entries are reused when possible, and only the missing
- * tail is appended as new message entries.
- */
-declare function createSessionLineage(messages: KodaXMessage[], previous?: KodaXSessionLineage): KodaXSessionLineage;
-/**
- * Walk the lineage from a target entry back to the root.
- *
- * Traversal stops safely if malformed data introduces a parent cycle.
- */
-declare function getSessionLineagePath(lineage: KodaXSessionLineage, targetId?: string | null): NavigableSessionEntry[];
-/**
- * Build the effective LLM-visible message context for the active lineage path.
- *
- * FEATURE_072: for non-rewind compaction entries that carry
- * `postCompactAttachments`, the slicer inlines attachments immediately after
- * the summary. `getContextMessagesForEntry` stays 1-to-1 — attachments are a
- * slicer-layer concern, which preserves the contract
- * `entryMatchesContextMessage` and FEATURE_073's future firstKeptEntryId-based
- * slicing both depend on.
- */
-declare function getSessionMessagesFromLineage(lineage: KodaXSessionLineage, targetId?: string | null): KodaXMessage[];
-/**
- * Resolve an entry selector using either a direct entry id or the latest label.
- */
-declare function resolveSessionLineageTarget(lineage: KodaXSessionLineage, selector: string): NavigableSessionEntry | undefined;
-/**
- * Move the active leaf to a selected target, optionally appending a
- * branch-summary node that captures the abandoned path.
- */
-declare function setSessionLineageActiveEntry(lineage: KodaXSessionLineage, selector: string, options?: KodaXSessionNavigationOptions): KodaXSessionLineage | null;
-/**
- * Append a label change entry that bookmarks a lineage node.
- */
-declare function appendSessionLineageLabel(lineage: KodaXSessionLineage, selector: string, label?: string): KodaXSessionLineage | null;
-/**
- * Apply a compaction event to the lineage.
- *
- * FEATURE_072 signature change: `keptMessages` (the post-summary tail that
- * will become lineage entries) and `postCompactAttachments` (ledger +
- * file-content messages that live on the CompactionEntry itself) are now
- * separate parameters. The kept tail MUST NOT include attachments — otherwise
- * they would be double-stored (once as message entries in lineage, once on
- * the compaction entry). Phase A keeps `postCompactAttachments` optional so
- * current callers that pass `[]` (or omit it) behave identically to today.
- * Phase B migrates callers to supply real attachments.
- */
-declare function applySessionCompaction(lineage: KodaXSessionLineage | undefined, compactedMessages: KodaXMessage[], anchor: {
-    summary: string;
-    tokensBefore?: number;
-    tokensAfter?: number;
-    artifactLedgerId?: string;
-    reason?: string;
-    details?: KodaXJsonValue | CompactionDetails;
-    memorySeed?: KodaXCompactMemorySeed;
-}, postCompactAttachments?: readonly KodaXMessage[]): KodaXSessionLineage;
-/**
- * Rewind the current session lineage to a target entry, truncating all entries after it.
- * Records a rewind event in the lineage for auditability.
- * Returns null if targetEntryId is not found.
- *
- * @param lineage - The session lineage to rewind
- * @param targetEntryId - The entry ID to rewind to (inclusive)
- * @returns A new lineage with entries truncated after the target, or null if target not found
- */
-/**
- * Find the entry ID of the second-to-last user message in the lineage.
- * Used by `/rewind` (no argument) to go back one conversational turn.
- * Returns null if fewer than 2 user messages exist.
- */
-declare function findPreviousUserEntryId(lineage: KodaXSessionLineage): string | null;
-declare function rewindSessionLineage(lineage: KodaXSessionLineage, targetEntryId: string): KodaXSessionLineage | null;
-declare function forkSessionLineage(lineage: KodaXSessionLineage, selector?: string): KodaXSessionLineage | null;
-/**
- * Convert a lineage into a nested tree structure for UI presentation.
- */
-declare function buildSessionTree(lineage: KodaXSessionLineage): KodaXSessionTreeNode[];
-/**
- * Count the effective context messages on the active lineage path.
- */
-declare function countActiveLineageMessages(lineage: KodaXSessionLineage): number;
-/**
- * Archive message entries from old "islands" (disconnected subtrees).
- *
- * Each compaction entry has parentId: null, creating an independent island.
- * The active leaf lives in one island (the "current" island). All other
- * islands are considered "old" and eligible for archival.
- *
- * A "preserve closure" is computed first:
- *  - All entries in the current island (active path + recent branches)
- *  - Label targets and their ancestor chains
- *  - Non-message entries and their ancestor chains (prevents tree drift)
- *
- * Only entries outside the preserve closure are archived.
- */
-declare function archiveOldIslands(lineage: KodaXSessionLineage): {
-    slimmedLineage: KodaXSessionLineage;
-    archivedEntries: KodaXSessionEntry[];
-    archivedCount: number;
-    archiveBatchId: string;
-};
-
-/**
- * @kodax-ai/agent File Tracking
- */
-
-declare function extractArtifactLedger(messages: KodaXMessage[]): KodaXSessionArtifactLedgerEntry[];
-declare function mergeArtifactLedger(existing: KodaXSessionArtifactLedgerEntry[], next: KodaXSessionArtifactLedgerEntry[]): KodaXSessionArtifactLedgerEntry[];
-
-type McpCapabilityKind = 'tool' | 'resource' | 'prompt';
-type McpCapabilityRisk = 'read' | 'write' | 'network' | 'exec';
-interface McpCatalogItem {
-    id: string;
-    serverId: string;
-    kind: McpCapabilityKind;
-    name: string;
-    title?: string;
-    summary: string;
-    tags?: string[];
-    risk?: McpCapabilityRisk;
-    annotations?: Record<string, unknown>;
-    cachedAt: string;
-}
-interface McpCapabilityDescriptor extends McpCatalogItem {
-    inputSchema?: unknown;
-    outputSchema?: unknown;
-    promptArgsSchema?: unknown;
-    uri?: string;
-    mimeType?: string;
-}
-interface McpServerCatalogSnapshot {
-    serverId: string;
-    items: McpCatalogItem[];
-    descriptors: McpCapabilityDescriptor[];
-    updatedAt: string;
-}
-interface McpCatalogSearchOptions {
-    kind?: McpCapabilityKind;
-    limit?: number;
-}
-declare function defaultMcpCacheDir(): string;
-declare function createMcpCapabilityId(serverId: string, kind: McpCapabilityKind, name: string): string;
-declare function parseMcpCapabilityId(id: string): {
-    serverId: string;
-    kind: McpCapabilityKind;
-    name: string;
-};
-declare function searchMcpCatalog(items: readonly McpCatalogItem[], query: string, options?: McpCatalogSearchOptions): McpCatalogItem[];
-declare function getMcpCachePaths(cacheDir: string, serverId: string): {
-    catalogDir: string;
-    indexPath: string;
-    itemsPath: string;
-};
-
-interface McpServerRuntimeDiagnostics {
-    serverId: string;
-    connect: 'lazy' | 'prewarm' | 'disabled';
-    status: 'idle' | 'connecting' | 'ready' | 'error' | 'disabled';
-    dirty: boolean;
-    lastError?: string;
-    cachedAt?: string;
-    tools: number;
-    resources: number;
-    prompts: number;
-}
-declare class McpServerRuntime {
-    private readonly serverId;
-    private readonly config;
-    private readonly cacheDir;
-    private transport?;
-    private readonly pending;
-    private nextRequestId;
-    private initialized;
-    private connectPromise?;
-    private catalog?;
-    private diagnostics;
-    constructor(serverId: string, config: McpServerConfig, cacheDir: string);
-    getDiagnostics(): McpServerRuntimeDiagnostics;
-    prewarmIfNeeded(): Promise<void>;
-    /** Load catalog from memory or disk only — never triggers a lazy connection. */
-    getCachedCatalog(): Promise<McpServerCatalogSnapshot | undefined>;
-    getCatalog(forceRefresh?: boolean): Promise<McpServerCatalogSnapshot>;
-    describeCapability(capabilityId: string): Promise<McpCapabilityDescriptor | undefined>;
-    callTool(name: string, args: Record<string, unknown>): Promise<{
-        content?: string;
-        structuredContent?: unknown;
-        metadata?: Record<string, unknown>;
-    }>;
-    readResource(name: string, options: Record<string, unknown>): Promise<{
-        content?: string;
-        structuredContent?: unknown;
-        metadata?: Record<string, unknown>;
-    }>;
-    getPrompt(name: string, args: Record<string, unknown>): Promise<unknown>;
-    refreshCatalog(forceReconnect?: boolean): Promise<void>;
-    /** Public teardown — clears everything including the connect lock. */
-    dispose(): Promise<void>;
-    /** Internal transport teardown — does NOT clear connectPromise so the
-     *  retry loop inside doConnect() can safely call it between attempts. */
-    private resetTransport;
-    private connect;
-    private doConnect;
-    private listDescriptors;
-    private request;
-    private notify;
-    private handleMessage;
-    private failPending;
-    private applyCatalogSnapshot;
-}
-
-/**
- * `McpCapabilityProvider` — implements the Layer A `CapabilityProvider`
- * contract for an MCP server fleet.
- *
- * FEATURE_082 (v0.7.24): moved from
- * `@kodax-ai/coding/src/capabilities/providers/mcp/provider.ts` to this package.
- * The coding-specific `registerConfiguredMcpCapabilityProvider` adapter (which
- * pulls in `KodaXExtensionRuntime`) lives in
- * `@kodax-ai/coding/src/capabilities/providers/mcp-adapter.ts`.
- */
-
-interface McpProviderOptions {
-    cacheDir?: string;
-}
-declare class McpCapabilityProvider implements CapabilityProvider {
-    readonly id = "mcp";
-    readonly kinds: CapabilityProvider['kinds'];
-    private readonly runtimes;
-    private readonly cacheDir;
-    /**
-     * Construct an MCP capability provider.
-     *
-     * **Cache-dir capture warning (v0.7.35.1 FEATURE_145)** — when
-     * `options.cacheDir` is omitted, this constructor resolves
-     * `defaultMcpCacheDir()` ONCE at instantiation time and threads the
-     * result into every `McpServerRuntime` it spawns. If a substrate
-     * consumer plans to redirect the agent config home via
-     * `setAgentConfigHome()` from `@kodax-ai/agent`, that call MUST happen
-     * BEFORE constructing this provider. Late calls have no effect on
-     * already-constructed runtimes.
-     *
-     * To bypass the agent-home resolver entirely, pass
-     * `options.cacheDir` explicitly — that path wins unconditionally.
-     */
-    constructor(servers: McpServersConfig | undefined, options?: McpProviderOptions);
-    hasActiveServers(): boolean;
-    prewarm(): Promise<void>;
-    search(query: string, options?: {
-        kind?: CapabilityKind;
-        limit?: number;
-        server?: string;
-    }): Promise<unknown[]>;
-    describe(id: string): Promise<unknown>;
-    execute(id: string, input: Record<string, unknown>): Promise<CapabilityResult>;
-    read(id: string, options?: Record<string, unknown>): Promise<CapabilityResult>;
-    getPrompt(id: string, args?: Record<string, unknown>): Promise<unknown>;
-    getPromptContext(): Promise<string | undefined>;
-    getDiagnostics(): Record<string, unknown> | undefined;
-    refresh(): Promise<void>;
-    dispose(): Promise<void>;
-    private collectCatalogItems;
-    private listServerDiagnostics;
-    private requireRuntime;
-}
-
-interface McpTransportEvents {
-    /** Called with a complete JSON-RPC message (raw JSON string). */
-    onMessage(raw: string): void;
-    onError(error: Error): void;
-    onClose(reason: string): void;
-}
-interface McpTransport {
-    open(events: McpTransportEvents): Promise<void>;
-    /** Send a JSON string. The transport handles framing. */
-    send(json: string): Promise<void>;
-    close(): Promise<void>;
-    readonly connected: boolean;
-}
-type StdioFraming = 'content-length' | 'ndjson';
-interface McpTransportOptions {
-    stdioFraming?: StdioFraming;
-}
-declare function createMcpTransport(config: McpServerConfig, options?: McpTransportOptions): McpTransport;
-
 /**
  * KodaX Core Errors
  *
@@ -506,12 +91,63 @@ interface ToolProgress {
     readonly stage: string;
     readonly message: string;
 }
-/** Standard tool handler — returns a single result string. */
-type ToolHandlerSync = (input: Record<string, unknown>, context: KodaXToolExecutionContext) => Promise<string>;
-/** Streaming tool handler — yields progress updates, returns final result string. */
-type ToolHandlerStreaming = (input: Record<string, unknown>, context: KodaXToolExecutionContext) => AsyncGenerator<ToolProgress, string, void>;
+/**
+ * Final result a tool may return. Either a plain string (the default for
+ * text-only tools) OR a typed-array form for multimodal returns (e.g.
+ * `read` on an image path returns `[{type:'text',...}, {type:'image',...}]`).
+ * Providers serialize each shape to their wire format; OpenAI-compat
+ * gateways downgrade image items to a placeholder rather than rejecting.
+ *
+ * The array form mirrors claudecode's FileReadTool image return — Claude
+ * Code packs image data into `tool_result` content so the model can
+ * re-fetch images via the tool path. See
+ * `c:/Works/claudecode/src/tools/FileReadTool/FileReadTool.ts:866-891`.
+ */
+type ToolResult = string | readonly KodaXToolResultContentItem[];
+/** Standard tool handler — returns a final result (text or multimodal). */
+type ToolHandlerSync = (input: Record<string, unknown>, context: KodaXToolExecutionContext) => Promise<ToolResult>;
+/** Streaming tool handler — yields progress updates, returns final result. */
+type ToolHandlerStreaming = (input: Record<string, unknown>, context: KodaXToolExecutionContext) => AsyncGenerator<ToolProgress, ToolResult, void>;
 /** Union of both handler types. Existing tools use ToolHandlerSync; new long-running tools may use ToolHandlerStreaming. */
 type ToolHandler = ToolHandlerSync | ToolHandlerStreaming;
+/**
+ * v0.7.42 — Declarative tool side-effect class.
+ *
+ * Required field on every {@link LocalToolDefinition}. Used by:
+ *   - Plan mode: tools with `sideEffect !== 'readonly'` are blocked unless
+ *     they explicitly opt in via `planModeAllowed: true` (e.g.
+ *     `exit_plan_mode`, `task_stop`).
+ *   - SDK embedders (KodaX Space etc.): iterate `getAllRegisteredTools()`
+ *     and build their own blocklist by category — replaces the previous
+ *     practice of hardcoding a `Set<string>` of tool names, which silently
+ *     drifted whenever KodaX added a new tool.
+ *   - Internal permission system: `FILE_MODIFICATION_TOOLS` and
+ *     `MODIFICATION_TOOLS` exports in `@kodax-ai/repl` are now computed
+ *     from this metadata at module load time, so adding a new
+ *     `'mutates-fs'` tool here automatically reaches every callsite
+ *     that consumes those sets.
+ *
+ * Categories (mutually exclusive; pick the dominant effect):
+ *   - `'readonly'`        — produces no observable side effect, just reads
+ *                            local state (FS, registry, computed views).
+ *   - `'mutates-fs'`      — writes to the local filesystem (write, edit,
+ *                            multi-edit, undo, worktree-*, construction
+ *                            artifacts). Bash is NOT in this bucket; it has
+ *                            its own.
+ *   - `'mutates-shell'`   — invokes an arbitrary shell command (bash).
+ *   - `'mutates-network'` — performs a network request that may have side
+ *                            effects on the remote (web_fetch with any
+ *                            method, web_search, MCP server calls).
+ *   - `'mutates-state'`   — changes internal session/agent state without
+ *                            FS or shell side effects (todo_update,
+ *                            send_message, dispatch_child_task,
+ *                            exit_plan_mode, emit_managed_protocol).
+ *
+ * Pick the dominant effect when a tool touches multiple. e.g. `dispatch_
+ * child_task` may transitively run any tool, but its own direct effect is
+ * spawning a child agent (`mutates-state`).
+ */
+type ToolSideEffect = 'readonly' | 'mutates-fs' | 'mutates-shell' | 'mutates-network' | 'mutates-state';
 /**
  * FEATURE_149 (v0.7.38) — interrupt-on-submit policy for in-flight tools.
  *
@@ -533,11 +169,60 @@ type ToolHandler = ToolHandlerSync | ToolHandlerStreaming;
 type ToolInterruptBehavior = 'cancel' | 'wait';
 interface LocalToolDefinition extends KodaXToolDefinition {
     handler: ToolHandler;
+    /**
+     * v0.7.42 — Required declarative side-effect class. See
+     * {@link ToolSideEffect} for category definitions and rationale. Plan
+     * mode and SDK embedders' permission brokers consume this; failure to
+     * declare is a TypeScript error (by design — `sideEffect` is required,
+     * not optional, to prevent silent drift when new tools are added).
+     */
+    sideEffect: ToolSideEffect;
+    /**
+     * v0.7.42 — Optional plan-mode override.
+     *
+     *   - `undefined` (default): plan-mode permits only `sideEffect ===
+     *     'readonly'` tools.
+     *   - `true`: explicitly permitted in plan mode even when sideEffect is
+     *     not `'readonly'`. Reserve for tools whose effect is itself part of
+     *     the planning loop (`exit_plan_mode`, `task_stop`, `todo_update`,
+     *     `todo_create`, `ask_user_question`).
+     *   - `false`: explicitly blocked in plan mode even when sideEffect is
+     *     `'readonly'`. Rare — useful for read-only tools whose output would
+     *     leak content the planner should not see.
+     */
+    planModeAllowed?: boolean;
     /**
      * FEATURE_149 (v0.7.38) — submit-time interrupt policy. See
      * {@link ToolInterruptBehavior}. Default `'wait'` when undefined.
      */
     interruptBehavior?: ToolInterruptBehavior;
+    /**
+     * Progressive disclosure — when `true`, the tool's full description is
+     * replaced with `searchHint` (a one-line summary) in the LLM-visible
+     * tool schema until the per-session unlock Set marks the tool name as
+     * unlocked. Unlocking happens via the `tool_search` tool: the LLM
+     * invokes `tool_search` with a query that selects this tool, and the
+     * full description + JSON schema are returned in the tool_result text.
+     * The next `getActiveToolDefinitions` call for the same session sees
+     * the unlock and emits the full description.
+     *
+     * Use for tools with rich descriptions (>500 bytes) whose teaching
+     * content the model only needs to consume when it actually plans to
+     * call the tool. Saves turn-1 context without dropping the tool.
+     *
+     * Mirrors claudecode `Tool.shouldDefer` — see
+     * `c:/Works/claudecode/src/tools/Tool.ts` for the parent design and
+     * `c:/Works/claudecode/src/tools/ToolSearchTool/` for the bootstrap.
+     */
+    shouldDefer?: boolean;
+    /**
+     * One-line hint shown in place of the full description when this tool
+     * is deferred and not yet unlocked. Required when `shouldDefer: true`.
+     * Should answer "when would I want to look this up" in ≤ 100 chars
+     * so the LLM can decide whether to invoke `tool_search` for the full
+     * schema. Example: `'Fetch a specific remote URL — use tool_search to load full schema.'`
+     */
+    searchHint?: string;
     /**
      * Classifier projection — REQUIRED (FEATURE_092 v0.7.33).
      *
@@ -643,12 +328,59 @@ declare function getBuiltinToolDefinition(name: string): KodaXToolDefinition | u
 declare function getBuiltinRegisteredToolDefinition(name: string): RegisteredToolDefinition | undefined;
 declare function createBuiltinToolDefinition(name: string): LocalToolDefinition | undefined;
 declare function listBuiltinToolDefinitions(): RegisteredToolDefinition[];
+/**
+ * v0.7.42 — snapshot of every currently-active tool registration.
+ *
+ * Returns the most-recent registration for each tool name (mirroring
+ * {@link getRegisteredToolDefinition}'s single-name semantics across the
+ * full registry). Use this to drive metadata-based filters such as:
+ *
+ *   - SDK embedder permission brokers building a blocklist by side-effect class:
+ *     `getAllRegisteredTools().filter(t => t.sideEffect !== 'readonly')`
+ *   - UI that displays available tools grouped by category.
+ *   - Plan-mode gates that compute their own blocklist from metadata
+ *     instead of hardcoded `Set<string>` of names.
+ *
+ * The returned array is a fresh copy per call (safe to mutate without
+ * affecting the registry). Order is registration order (sorted by name
+ * within each registration to keep the snapshot deterministic).
+ */
+declare function getAllRegisteredTools(): RegisteredToolDefinition[];
+/**
+ * v0.7.42 — plan-mode permit check driven by tool metadata.
+ *
+ *   - `sideEffect === 'readonly'` ⇒ permitted (unless explicitly
+ *     `planModeAllowed: false`).
+ *   - `planModeAllowed: true` ⇒ permitted (overrides non-readonly).
+ *   - any other sideEffect ⇒ blocked.
+ *
+ * Returns `false` for unknown tool names (fail-closed). Use this in
+ * preference to hardcoded `Set<string>` of tool names — adding a new
+ * `'mutates-fs'` builtin will flow through automatically.
+ */
+declare function isToolPlanModeAllowed(name: string): boolean;
+/**
+ * v0.7.42 — does this tool mutate the filesystem?
+ *
+ * Wraps `sideEffect === 'mutates-fs'`. Used by the REPL permission
+ * pipeline's gitRoot guard and Space's permission broker. Replaces the
+ * previous practice of hardcoding `Set(["write", "edit"])`-style lookups
+ * scattered across 5+ callsites.
+ */
+declare function isToolFileMutation(name: string): boolean;
+/**
+ * v0.7.42 — does this tool mutate anything (FS, shell, network, state)?
+ *
+ * True for every `sideEffect` except `'readonly'`. Fail-closed (unknown
+ * names return `true` — assumed mutating until proven otherwise).
+ */
+declare function isToolMutation(name: string): boolean;
 declare function getRequiredToolParams(name: string): string[];
 declare function listTools(): string[];
 declare function listToolDefinitions(): KodaXToolDefinition[];
 declare function executeTool(name: string, input: Record<string, unknown>, ctx: KodaXToolExecutionContext): Promise<string>;
 
-declare function toolRead(input: Record<string, unknown>, ctx: KodaXToolExecutionContext): Promise<string>;
+declare function toolRead(input: Record<string, unknown>, ctx: KodaXToolExecutionContext): Promise<string | readonly KodaXToolResultContentItem[]>;
 
 declare function toolWrite(input: Record<string, unknown>, ctx: KodaXToolExecutionContext): Promise<string>;
 
@@ -726,6 +458,291 @@ declare function toolCodeSearch(input: Record<string, unknown>, ctx: KodaXToolEx
 
 declare function toolSemanticLookup(input: Record<string, unknown>, ctx: KodaXToolExecutionContext): Promise<string>;
 
+/**
+ * KodaX Constructed-World types (FEATURE_087, v0.7.28).
+ *
+ * Runtime-generated capabilities (tools / agents / skills / ...) live in
+ * `.kodax/constructed/` and are loaded into the same registries as builtin
+ * primitives. v0.7.28 only ships tool generation (FEATURE_088); other kinds
+ * land in FEATURE_089 / FEATURE_090.
+ *
+ * Cross-references:
+ *   - DD §14 — lifecycle, security model, registry merge semantics.
+ *   - docs/features/v0.7.28.md — capability schema, generation flow.
+ */
+/**
+ * Handler script source. v0.7.28 limits language to `'javascript'` so that
+ * `loadHandler()` can `await import()` the file directly without an
+ * intermediate TS → JS compile step (no esbuild / tsx dependency).
+ *
+ * TypeScript handlers are explicitly out of scope; Coding Agent generates
+ * JS strings on the wire.
+ */
+interface ScriptSource {
+    readonly kind: 'script';
+    readonly language: 'javascript';
+    readonly code: string;
+}
+/**
+ * Capability declaration.
+ *
+ * v0.7.28 ships the single-dimension form: a whitelist of builtin tool
+ * names that the handler may invoke through `ctx.tools.<name>(...)`.
+ * All I/O — fs / net / env — must flow through builtin tools (`read` /
+ * `write` / `bash` / etc.); handlers do not receive direct `ctx.fs` /
+ * `ctx.net` / `ctx.env` entry points.
+ *
+ * Forward-compatible evolution: if the future demands path/domain-level
+ * constraints, this can grow to `(string | { name; constraints })[]`
+ * without breaking existing manifests.
+ */
+interface Capabilities {
+    readonly tools: readonly string[];
+}
+/**
+ * Tool-kind artifact body (the `content` of `ConstructionArtifact` when
+ * `kind === 'tool'`).
+ */
+interface ToolContent {
+    readonly description: string;
+    readonly inputSchema: Record<string, unknown>;
+    readonly capabilities: Capabilities;
+    readonly handler: ScriptSource;
+    /**
+     * Per-tool timeout override. Defaults to {@link DEFAULT_HANDLER_TIMEOUT_MS}
+     * when omitted. Bounded by AbortController in `loadHandler()`.
+     */
+    readonly timeoutMs?: number;
+}
+/**
+ * Default handler timeout. Picked to match the historical ceiling on
+ * builtin streaming tools (30s); revisit if a constructed tool demands
+ * longer-running computation.
+ */
+declare const DEFAULT_HANDLER_TIMEOUT_MS = 30000;
+/**
+ * Lifecycle state on disk. Drives both the startup glob filter and the
+ * `revoke()` semantics. See DD §14.1 — file system is the single source
+ * of truth; no separate `_manifest.json` index file (C4 decision).
+ */
+type ArtifactStatus = 'staged' | 'active' | 'revoked';
+/**
+ * Reference to a tool by stable id. v0.7.31 (FEATURE_089) introduces
+ * Agent manifests that bundle tool refs rather than inline tool bodies;
+ * the resolver expands these refs to concrete `KodaXToolDefinition`
+ * instances at activate time.
+ *
+ * `ref` shape:
+ *   - `builtin:<name>`            — a tool from the static registry
+ *     (e.g. `builtin:read`, `builtin:bash`)
+ *   - `constructed:<name>@<ver>`  — a previously-activated constructed tool
+ */
+interface ToolRef {
+    readonly ref: string;
+}
+/**
+ * Reference to a Guardrail by stable id. The Layer A `Guardrail`
+ * declaration is name-only (no runtime hooks); resolvers map known
+ * names to constructed `ToolGuardrail` / `InputGuardrail` /
+ * `OutputGuardrail` instances at activation time.
+ */
+interface GuardrailRef {
+    readonly kind: 'input' | 'output' | 'tool';
+    readonly ref: string;
+}
+/**
+ * Reference to a handoff target by stable id (another constructed agent
+ * or a builtin role). The resolver expands `target.ref` to the actual
+ * `Agent` declaration at admission time so the handoff DAG check
+ * (`handoffLegality` invariant) sees the full graph.
+ */
+interface AgentHandoffRef {
+    readonly target: {
+        readonly ref: string;
+    };
+    readonly kind: 'continuation' | 'as-tool';
+    readonly description?: string;
+}
+/**
+ * Reasoning profile declaration mirroring the Layer A
+ * `AgentReasoningProfile`. Kept structurally identical so the resolver
+ * passes the value through without re-shaping.
+ */
+interface AgentReasoningRef {
+    readonly default: 'quick' | 'balanced' | 'deep';
+    readonly max?: 'quick' | 'balanced' | 'deep';
+    readonly escalateOnRevise?: boolean;
+}
+/**
+ * Sandbox test case. Used by `sandbox_test_agent` to verify a
+ * constructed agent before it can activate. Each case feeds `input`
+ * to a sandbox Runner instance and grades the agent's final output:
+ *
+ *   - `expectMatch`     — final text must match this regex (string form)
+ *   - `expectNotMatch`  — final text must NOT match this regex
+ *   - `expectFinalText` — exact substring match (case-sensitive)
+ *
+ * At least one of the three expect-fields must be present; the cases
+ * are graded by `runSandboxAgentTest()` (FEATURE_089 Phase 3.5).
+ */
+interface AgentTestCase {
+    readonly id: string;
+    readonly input: string;
+    readonly expectMatch?: string;
+    readonly expectNotMatch?: string;
+    readonly expectFinalText?: string;
+}
+/**
+ * Agent-kind artifact body (the `content` of `ConstructionArtifact`
+ * when `kind === 'agent'`).
+ *
+ * FEATURE_089 (v0.7.31): all fields except `instructions` are optional;
+ * a minimal "echo agent" can be expressed as `{ instructions: '...' }`.
+ * Tool / handoff / guardrail refs are resolved at admission time
+ * (Runner.admit's 5-step audit expands them and feeds the resolved
+ * Agent through the invariant chain).
+ */
+interface AgentContent {
+    readonly instructions: string;
+    readonly tools?: readonly ToolRef[];
+    readonly handoffs?: readonly AgentHandoffRef[];
+    readonly reasoning?: AgentReasoningRef;
+    readonly guardrails?: readonly GuardrailRef[];
+    readonly model?: string;
+    readonly provider?: string;
+    /**
+     * FEATURE_191 — one-sentence human-readable summary surfaced in the
+     * Worker system prompt's `=== Available specialist agents ===`
+     * block (FEATURE_191 A.3) and in `/agents list` UIs. Frontmatter
+     * `description` field of `~/.kodax/agents/<name>.md` and the
+     * `name`-paired argument of `KodaXExtensionAPI.registerAgent`
+     * funnel into this field. Optional for backward compatibility with
+     * FEATURE_089 minimal-agent shape (`{ instructions: '...' }`);
+     * the SP block renders `(no description)` when absent.
+     */
+    readonly description?: string;
+    /**
+     * Optional structured-output schema mirroring `Agent.outputSchema`.
+     * Pure pass-through to the runtime — admission does not validate
+     * shape semantics here, only well-formed JSON.
+     */
+    readonly outputSchema?: Record<string, unknown>;
+    /**
+     * Optional sandbox test cases. When present, `sandbox_test_agent`
+     * runs them; when absent, the test step performs only the static
+     * checks (manifest schema + admission audit).
+     */
+    readonly testCases?: readonly AgentTestCase[];
+    /**
+     * Maximum total budget (iteration count) the agent may consume.
+     * Plumbed onto the resolved `AgentManifest.maxBudget` and clamped by
+     * `budgetCeiling` invariant during admission.
+     */
+    readonly maxBudget?: number;
+    /**
+     * Voluntary additional invariants the LLM declares this agent
+     * commits to. Plumbed onto `AgentManifest.declaredInvariants`;
+     * unioned on top of the required set during admission.
+     */
+    readonly declaredInvariants?: readonly string[];
+}
+/**
+ * Persisted artifact shape (one JSON file per name/version under
+ * `.kodax/constructed/<kind>s/<name>/<version>.json`).
+ *
+ * Discriminated union over `kind`:
+ *   - `kind: 'tool'`  — v0.7.28 (FEATURE_088) tool generation
+ *   - `kind: 'agent'` — v0.7.31 (FEATURE_089) agent generation; passes
+ *                       through `Runner.admit()` at activation time
+ *
+ * Lifecycle fields (status / timestamps / contentHash / sourceAgent /
+ * signedBy) are common to all kinds.
+ */
+type ConstructionArtifact = ToolArtifact | AgentArtifact;
+interface ConstructionArtifactBase {
+    readonly name: string;
+    readonly version: string;
+    status: ArtifactStatus;
+    readonly signedBy?: string;
+    readonly createdAt: number;
+    readonly sourceAgent?: string;
+    testedAt?: number;
+    activatedAt?: number;
+    revokedAt?: number;
+    /**
+     * SHA-256 of `JSON.stringify(content)` captured at activate time.
+     * `rehydrateActiveArtifacts()` recomputes and compares — a mismatch
+     * indicates the manifest was edited between activation and the next
+     * boot (naive cross-session tampering, e.g. an LLM rewriting the .json
+     * via the Write tool without recomputing the hash). Mismatched
+     * artifacts are skipped at rehydrate with a stderr warning. This is
+     * NOT a defense against a coordinated attacker who recomputes the
+     * hash; the threat model is single-user CLI integrity, not multi-user
+     * supply chain.
+     */
+    contentHash?: string;
+}
+interface ToolArtifact extends ConstructionArtifactBase {
+    readonly kind: 'tool';
+    readonly content: ToolContent;
+}
+interface AgentArtifact extends ConstructionArtifactBase {
+    readonly kind: 'agent';
+    readonly content: AgentContent;
+}
+/**
+ * Returned by {@link ConstructionRuntime.stage}; opaque handle that
+ * downstream `test()` / `activate()` calls bind to.
+ */
+interface StagedHandle {
+    readonly artifact: ConstructionArtifact;
+    readonly stagedAt: number;
+}
+/**
+ * Outcome of {@link ConstructionRuntime.test}. `ok=false` blocks
+ * activation; `warnings` surface but do not block.
+ */
+interface TestResult {
+    readonly ok: boolean;
+    readonly errors?: readonly string[];
+    readonly warnings?: readonly string[];
+}
+/**
+ * Policy gate — invoked once per `activate()` before the artifact is
+ * registered. Default rejects implicit auto-approval; the REPL surface
+ * binds a dialog-based policy in `packages/repl/src/common/construction-
+ * bootstrap.ts` so user approval flows through the live askUser channel.
+ *
+ * Modeled as a function type rather than an interface (D3 decision):
+ * keeps the contract surface tiny, no class boilerplate.
+ *
+ * No declarative `kodax.config.ts` override hatch is provided — see the
+ * "Deferred Design Decisions" section in `features/v0.7.28.md` for why
+ * a `risk_mode` enum (when truly needed) is preferred over user-authored
+ * policy functions.
+ */
+type ConstructionPolicy = (artifact: ConstructionArtifact) => Promise<ConstructionPolicyVerdict>;
+type ConstructionPolicyVerdict = 'approve' | 'reject' | 'ask-user';
+/** Default policy: always ask the user; no implicit approvals. */
+declare const defaultPolicy: ConstructionPolicy;
+/**
+ * Thrown by `CtxProxy` when handler attempts to access a tool not declared
+ * in `capabilities.tools`. Caught in tracer; surfaces as a tool error.
+ */
+declare class CapabilityDeniedError extends Error {
+    readonly toolName: string;
+    readonly declaredTools: readonly string[];
+    constructor(toolName: string, declaredTools: readonly string[]);
+}
+/**
+ * Thrown when a manifest cannot be parsed / is missing required fields.
+ * Surfaces during stage() / startup glob; tracer records details.
+ */
+declare class ConstructionManifestError extends Error {
+    readonly path?: string;
+    constructor(message: string, path?: string);
+}
+
 interface ExecOptions {
     /** Extra environment variables to inject (merged with safe base env). */
     readonly env?: Readonly<Record<string, string>>;
@@ -907,6 +924,51 @@ interface ExtensionTurnSettleHookContext {
     setModelSelection: (next: ExtensionModelSelection) => void;
     setThinkingLevel: (level: KodaXReasoningMode) => void;
 }
+/**
+ * FEATURE_184 (v0.7.45) — Stop Hook bridge context for extensions.
+ *
+ * Fires ONLY when the model terminates a turn text-only (no tool_use)
+ * — a strict subset of `turn:settle`, which fires on every turn end
+ * including mid-task tool turns. Use this hook for verification or
+ * "is the task actually done?" checks. The three-state return surface
+ * mirrors `RunOptions.stopHook` at the agent layer; the bridge passes
+ * the extension's return through unchanged.
+ *
+ * Coding-layer first-party consumers (Sidecar Verifier, FEATURE_184
+ * Phase D) wire directly to the agent `stopHook`. Third-party
+ * extensions write `api.hook('turn:complete', handler)` and the bridge
+ * dispatches to them inside the agent's `stopHook` callback. Handlers
+ * fire in registration order, first non-`void` return short-circuits
+ * the chain (matches `tool:before` semantics).
+ *
+ * Scope note: this hook fires on the AMA `runner-driven` path only
+ * (main loop, B1 retry, V2 worker). SA-path child agents dispatched
+ * via `dispatch_child_task` go through `runKodaX` and do NOT trigger
+ * this hook — observe their lifecycle via `turn:settle` on the SA
+ * path. Extensions wanting "every agent termination" semantics must
+ * register both hooks.
+ */
+interface ExtensionTurnCompleteHookContext {
+    sessionId: string;
+    lastAssistantText: string;
+    signal: 'natural-end';
+    reanimateCount: number;
+    reanimateBudget: number;
+}
+/**
+ * FEATURE_184 (v0.7.45) — Extension `turn:complete` return surface.
+ *
+ *   - `void` / `undefined` → accept the termination, defer to next
+ *     handler (or fall through to agent terminal path if none).
+ *   - `string` → reanimate: synthesize a user message, run another
+ *     turn. Bounded by Runner's `stopHookReanimateBudget`.
+ *   - `{ abort: true, reason }` → halt the run, surface reason to
+ *     caller via `RunResult.output` + `stoppedByHook = true`.
+ */
+type ExtensionTurnCompleteHookResult = void | string | {
+    readonly abort: true;
+    readonly reason: string;
+};
 interface ExtensionSessionHydrateHookContext {
     sessionId: string;
     getState: <T = KodaXJsonValue>(key: string) => T | undefined;
@@ -1018,9 +1080,14 @@ type TodoMutationSource = 'tool' | 'internal';
  * FEATURE_170 v0.7.41 — seed shape passed to `'todo:before-create'`.
  * Mirrors `TodoAddSeed` from todo-store.ts (kept structurally compatible
  * to avoid coupling extension authors to the internal task-engine type).
+ *
+ * v0.7.42 — `content` renamed to `subject` + optional `description` to
+ * match claudecode V2 `TaskCreateTool` schema. See `TodoItem` JSDoc in
+ * packages/coding/src/types.ts.
  */
 interface ExtensionTodoCreateSeed {
-    readonly content: string;
+    readonly subject: string;
+    readonly description?: string;
     readonly activeForm?: string;
     readonly evaluator?: 'build' | 'test' | 'lint';
     readonly owner?: string;
@@ -1040,7 +1107,9 @@ interface ExtensionTodoCreateSeed {
  */
 interface KodaXTodoItem {
     readonly id: string;
-    readonly content: string;
+    /** v0.7.42 — see TodoItem.subject JSDoc in packages/coding/src/types.ts. */
+    readonly subject: string;
+    readonly description?: string;
     readonly status: 'pending' | 'in_progress' | 'completed' | 'failed' | 'skipped' | 'cancelled';
     readonly owner?: string;
     readonly sourceObligationIndex?: number;
@@ -1053,6 +1122,7 @@ interface ExtensionHookMap {
     'tool:before': (context: ExtensionToolBeforeHookContext) => Promise<void | string | false> | void | string | false;
     'provider:before': (context: ExtensionProviderBeforeHookContext) => Promise<void> | void;
     'turn:settle': (context: ExtensionTurnSettleHookContext) => Promise<void> | void;
+    'turn:complete': (context: ExtensionTurnCompleteHookContext) => Promise<ExtensionTurnCompleteHookResult> | ExtensionTurnCompleteHookResult;
     'session:hydrate': (context: ExtensionSessionHydrateHookContext) => Promise<void> | void;
     'todo:before-create': (context: {
         seed: ExtensionTodoCreateSeed;
@@ -1086,6 +1156,53 @@ interface KodaXExtensionAPI {
     registerCapabilityProvider: (provider: CapabilityProvider) => () => void;
     registerCommand: (command: ExtensionCommandDefinition) => () => void;
     registerSkillPath: (skillPath: string) => () => void;
+    /**
+     * FEATURE_191 (v0.7.43) — register a constructed agent at extension
+     * activate time. The extension supplies the agent name and an
+     * `AgentContent` body (instructions + optional tools/handoffs/
+     * reasoning/model/description); the runtime threads it through
+     * `buildAdmissionManifest` + `Runner.admit` and registers the
+     * activated Agent via `registerConstructedAgent({ source:
+     * 'extension' })`. The returned dispose fn (also auto-pushed onto
+     * the extension's disposables list) unregisters the agent on
+     * extension deactivate.
+     *
+     * Returns `Promise<() => void>` — **you MUST `await` the call**
+     * before invoking the dispose function. Unlike sibling
+     * `registerTool` (sync), this is async because `Runner.admit` is
+     * declared async (FEATURE_101 admission contract — admission may
+     * consult disk for handoff-target staged-agent resolution).
+     *
+     * @example
+     * ```ts
+     * // CORRECT — await unwraps the Promise to a sync dispose
+     * export default async function activate(api: KodaXExtensionAPI) {
+     *   const dispose = await api.registerAgent('db-reviewer', {
+     *     instructions: 'You review DB migrations.',
+     *     description: 'DB migration reviewer',
+     *   });
+     *   // dispose() is now callable on demand; the runtime also auto-
+     *   // disposes via the extension's disposables list at deactivate.
+     * }
+     * ```
+     *
+     * @example
+     * ```ts
+     * // WRONG — TypeScript catches this; .js / @ts-ignore consumers
+     * // hit a runtime TypeError because Promise is not a function.
+     * export default function activate(api: KodaXExtensionAPI) {
+     *   const dispose = api.registerAgent('x', { instructions: '...' });
+     *   dispose();  // TypeError: dispose is not a function
+     * }
+     * ```
+     *
+     * Throws on admission rejection (with the verdict reason) so the
+     * extension author sees the failure at activate time rather than
+     * having a silently-dropped registration. The throw also halts
+     * extension loading — the extension's other registrations roll back
+     * via `LoadedExtensionRecord.disposables` reverse-iterate.
+     */
+    registerAgent: (name: string, content: AgentContent) => Promise<() => void>;
     on: <TEvent extends keyof ExtensionEventMap>(event: TEvent, handler: (payload: ExtensionEventMap[TEvent]) => Promise<void> | void) => () => void;
     hook: <THook extends keyof ExtensionHookMap>(hook: THook, handler: ExtensionHookMap[THook]) => () => void;
     logger: ExtensionLogger;
@@ -1508,7 +1625,7 @@ declare function warmRepoIntelligenceRuntime(options?: {
     trace?: boolean;
 }): Promise<RepoIntelligenceRuntimeWarmResult>;
 
-declare const SYSTEM_PROMPT = "You are KodaX, a helpful multi-provider coding agent. You can read, write, and edit files, and execute shell commands.\n\n## Error Handling\n\nWhen a tool call returns an error:\n1. STOP and READ the error message carefully\n2. DO NOT repeat the same tool call with the same parameters\n3. Identify what's wrong (missing parameter? wrong type? wrong path?)\n4. Fix the issue BEFORE making another tool call\n5. Common errors:\n   - \"Missing required parameter 'X'\" -> Add the missing parameter to your JSON\n   - \"File not found\" -> Check the path with read or glob first\n   - \"String not found\" -> Read the file again to see exact content\n\nWhen a shell command fails, prefer this recovery order:\n1. Check whether a specialized tool can solve the task directly\n2. Fix the command itself (quoting, workdir, platform-specific command, smaller scope)\n3. Split the task into smaller read/edit/write steps\n4. Only create a helper script when repeated inline commands are clearly less safe or less maintainable\n\n## Editing Files\n\n- Always read the file first to understand its current content\n- Make precise, targeted edits rather than rewriting entire files\n- Preserve the existing code style and formatting\n- Do not create new files unless the user asks for one or the task genuinely needs one. Prefer editing an existing file to creating a new one, as this prevents file bloat and keeps each tool call small\n- When a modification is scoped to an existing file, ALWAYS prefer `edit` over `write`. Only fall back to `write` when no file exists yet or the user explicitly requested a complete rewrite\n\n## Tool Usage\n\nPrefer specialized tools over shell for file operations:\n- Use read to view files instead of cat, head, or tail\n- Use edit to modify existing files instead of sed or awk when possible\n- Use write to create new files instead of echo redirection or heredocs\n- Use glob or grep for file discovery and content search before falling back to shell\n- When multiple read-only tool calls are independent, emit them in the same response so parallel mode can run them together\n- Only serialize tool calls when a later call depends on an earlier result\n- Keep parallel batches focused: prefer a few narrow grep/read/diff calls over many tiny sequential probes\n\nRead is intentionally bounded:\n- A single read call only returns a limited slice of a file\n- For large files, continue with offset/limit instead of retrying a whole-file read\n- Prefer grep first, then read the specific section you need\n\nTool outputs are also bounded:\n- Large bash output may be truncated to the tail\n- Large grep results and diffs may be summarized\n- When you see a truncation hint, narrow the next tool call instead of repeating the same broad request\n- If edit fails to find a stable anchor, do not rewrite the entire existing file with write; retry with a smaller unique edit anchor or use insert_after_anchor for section appends\n\nIf you truly need a script:\n- Do NOT create temporary scripts or scratch files in the project root\n- Do NOT place them at `.agent/` top level \u2014 that directory is reserved for system-managed artifacts (managed-tasks/, project/, repo-intelligence/, etc.)\n- Write them to `.agent/tmp/` (relative to the git root). This is the designated ephemeral workspace; files there can be safely cleaned up later\n- Alternatively, use the system temp directory if the script does not need to be inspectable from the project\n- Treat helper scripts as a last resort, not the default recovery path\n\n## Shell Commands\n\n- Be careful with destructive operations\n- Reserve shell commands for terminal operations such as git, package managers, builds, tests, and system commands\n- Prefer read-only operations when possible\n- For file edits, prefer read/edit/write over shell transforms unless shell scripting is genuinely more efficient\n\n### Cross-Platform Notes\n\nDifferent platforms have different commands:\n- Move: `move` (Windows) vs `mv` (Unix/Mac)\n- List: `dir` (Windows) vs `ls` (Unix/Mac)\n- Delete: `del` (Windows) vs `rm` (Unix/Mac)\n\n**IMPORTANT: Directories are created automatically by the `write` tool.**\n- NEVER use `mkdir` before writing files - the write tool handles directory creation\n- If you truly need an empty directory: `mkdir dir` (Windows) or `mkdir -p dir` (Unix)\n\nIf you see \"not recognized\", \"\u4E0D\u662F\u5185\u90E8\u6216\u5916\u90E8\u547D\u4EE4\", or a similar shell lookup error, the command does not exist on this platform. Try the platform equivalent.\n\n## Multi-step Tasks\n\n- Track your progress by listing what you've done and what's next\n- Break complex tasks into smaller steps\n- Summarize progress periodically\n\n## Plan Before Action\n\nFor any non-trivial task (creating files, editing code, running complex commands):\n1. First explain your understanding of the task\n2. Outline your approach (what files, what changes, what order)\n3. Consider potential issues (edge cases, dependencies, conflicts)\n4. Then execute step by step\n\nFor simple read-only tasks (reading a file, listing directory), just do it directly.\n\nIf the environment is currently in a read-only planning mode:\n- Do not try to write files or run mutating shell commands during planning\n- Finish the plan first\n- After the plan is complete, use `ask_user_question` to ask whether the user wants to proceed with implementation\n- If the user confirms, call `set_permission_mode` with `mode: \"accept-edits\"` to switch to implementation mode\n- If the user declines, stay in plan mode \u2014 do NOT call `set_permission_mode`\n\n## Asking User Questions\n\nWhen you need the user to make decisions, use `ask_user_question`.\n- For **multiple independent questions**, use the `questions` array (1-4 items). Each question has its own `question`, `header`, `options`, and optional `multi_select`. The user answers each question separately. Do NOT combine multiple questions into a single question string with pre-combined option combinations.\n- For a **single question**, use the `question` + `options` fields as before.\n- For **free-text input**, use `kind: \"input\"`.\n\nAlways explain what you're doing before taking action.\n\n{context}";
+declare const SYSTEM_PROMPT = "You are KodaX, a helpful multi-provider coding agent. You can read, write, and edit files, and execute shell commands.\n\n## Error Handling\n\nWhen a tool call returns an error:\n1. STOP and READ the error message carefully\n2. DO NOT repeat the same tool call with the same parameters \u2014 a re-issue with identical params almost always lands in a retry loop that wastes tokens without producing new information. Vary the params or switch to a different tool\n3. Identify what's wrong (missing parameter? wrong type? wrong path?)\n4. Fix the issue BEFORE making another tool call\n5. Common errors:\n   - \"Missing required parameter 'X'\" -> Add the missing parameter to your JSON\n   - \"File not found\" -> Check the path with read or glob first\n   - \"String not found\" -> Read the file again to see exact content\n\nWhen a shell command fails, prefer this recovery order:\n1. Check whether a specialized tool can solve the task directly\n2. Fix the command itself (quoting, workdir, platform-specific command, smaller scope)\n3. Split the task into smaller read/edit/write steps\n4. Only create a helper script when repeated inline commands are clearly less safe or less maintainable\n\n## Editing Files\n\n- Always read the file first to understand its current content\n- Make precise, targeted edits rather than rewriting entire files\n- Preserve the existing code style and formatting\n- Do not create new files unless the user asks for one or the task genuinely needs one. Prefer editing an existing file to creating a new one, as this prevents file bloat and keeps each tool call small\n- When a modification is scoped to an existing file, ALWAYS prefer `edit` over `write`. Only fall back to `write` when no file exists yet or the user explicitly requested a complete rewrite\n\n## Tool Usage\n\nPrefer specialized tools over shell for file operations:\n- Use read to view files instead of cat, head, or tail\n- Use edit to modify existing files instead of sed or awk when possible\n- Use write to create new files instead of echo redirection or heredocs\n- Use glob or grep for file discovery and content search before falling back to shell\n- When multiple read-only tool calls are independent, emit them in the same response so parallel mode can run them together\n- Only serialize tool calls when a later call depends on an earlier result\n- Keep parallel batches focused: prefer a few narrow grep/read/diff calls over many tiny sequential probes\n\nRead is intentionally bounded:\n- A single read call only returns a limited slice of a file\n- For large files, continue with offset/limit instead of retrying a whole-file read\n- Prefer grep first, then read the specific section you need\n\nTool outputs are also bounded:\n- Large bash output may be truncated to the tail\n- Large grep results and diffs may be summarized\n- When you see a truncation hint, narrow the next tool call instead of repeating the same broad request\n- If edit fails to find a stable anchor, do not rewrite the entire existing file with write; retry with a smaller unique edit anchor or use insert_after_anchor for section appends\n\nIf you truly need a script:\n- Do NOT create temporary scripts or scratch files in the project root \u2014 they leak into `git status` and file listings, confusing the user about what was actually changed\n- Do NOT place them at `.agent/` top level \u2014 that directory is reserved for system-managed artifacts (managed-tasks/, project/, repo-intelligence/, etc.)\n- Write them to `.agent/tmp/` (relative to the git root). This is the designated ephemeral workspace; files there can be safely cleaned up later\n- Alternatively, use the system temp directory if the script does not need to be inspectable from the project\n- Treat helper scripts as a last resort, not the default recovery path\n\n## Shell Commands\n\n- Be careful with destructive operations\n- Reserve shell commands for terminal operations such as git, package managers, builds, tests, and system commands\n- Prefer read-only operations when possible\n- For file edits, prefer read/edit/write over shell transforms unless shell scripting is genuinely more efficient\n\n### Cross-Platform Notes\n\nDifferent platforms have different commands:\n- Move: `move` (Windows) vs `mv` (Unix/Mac)\n- List: `dir` (Windows) vs `ls` (Unix/Mac)\n- Delete: `del` (Windows) vs `rm` (Unix/Mac)\n\n**IMPORTANT: Directories are created automatically by the `write` tool.**\n- NEVER use `mkdir` before writing files - the write tool handles directory creation\n- If you truly need an empty directory: `mkdir dir` (Windows) or `mkdir -p dir` (Unix)\n\nIf you see \"not recognized\", \"\u4E0D\u662F\u5185\u90E8\u6216\u5916\u90E8\u547D\u4EE4\", or a similar shell lookup error, the command does not exist on this platform. Try the platform equivalent.\n\n## Multi-step Tasks\n\n- Track your progress by listing what you've done and what's next\n- Break complex tasks into smaller steps\n- Summarize progress periodically\n\n## Plan Before Action\n\nFor any non-trivial task (creating files, editing code, running complex commands):\n1. First explain your understanding of the task\n2. Outline your approach (what files, what changes, what order)\n3. Consider potential issues (edge cases, dependencies, conflicts)\n4. Then execute step by step\n\nFor simple read-only tasks (reading a file, listing directory), just do it directly.\n\nIf the environment is currently in a read-only planning mode:\n- Do not try to write files or run mutating shell commands during planning\n- Finish the plan first\n- After the plan is complete, use `ask_user_question` to ask whether the user wants to proceed with implementation\n- If the user confirms, call `set_permission_mode` with `mode: \"accept-edits\"` to switch to implementation mode\n- If the user declines, stay in plan mode \u2014 do NOT call `set_permission_mode`\n\n## Asking User Questions\n\nWhen you need the user to make decisions, use `ask_user_question`.\n- For **multiple independent questions**, use the `questions` array (the schema accepts up to 4 items per call \u2014 if you need more, ask the additional ones in a follow-up turn). Each question has its own `question`, `header`, `options`, and optional `multi_select`. The user answers each question separately. Do NOT combine multiple questions into a single question string with pre-combined option combinations, because that forces the user to mentally disambiguate combinations and breaks the option-button UI.\n- For a **single question**, use the `question` + `options` fields as before.\n- For **free-text input**, use `kind: \"input\"`.\n\nAlways explain what you're doing before taking action.\n\n{context}";
 
 type KodaXPromptSectionSlot = 'base' | 'runtime-context' | 'session-context' | 'capability-truth' | 'base-suffix' | 'mode-overlay' | 'project-rules' | 'skill-addendum' | 'specialist';
 type KodaXPromptSectionStability = 'stable' | 'dynamic' | 'project' | 'specialist';
@@ -1602,7 +1719,7 @@ declare function buildSystemPrompt(options: KodaXOptions, isNewSession: boolean)
  *     reuse is at the **pattern** level (each agent has its own
  *     `capability-sections.ts`), not the **content** level.
  *   - Hoisting to `@kodax-ai/agent/` would force `@kodax-ai/agent` →
- *     `@kodax-ai/skills` / `@kodax-ai/mcp` cross-package dependencies,
+ *     `@kodax-ai/agent` / `@kodax-ai/agent` cross-package dependencies,
  *     breaking the "agent doesn't depend on application-layer
  *     packages" promise.
  *   - The drift problem this batch solves is "SA / AMA assemble the
@@ -1806,11 +1923,12 @@ declare function createReasoningPlan(options: KodaXOptions, prompt: string, prov
  *
  * Capability inventory: docs/features/v0.7.29-capability-inventory.md#cap-039-promise-signal-split-for-thinking-mode-replay
  *
- * Recognises the convention used by managed-protocol harnesses (Scout,
- * Planner, Generator, Evaluator) to embed a single-line signal at the end
- * of an assistant turn — e.g. `[CONFIRMED H1_EXECUTE_EVAL]` — that downstream
- * lifecycle code (scout-signals.ts, evaluator gating, etc.) inspects to
- * decide whether to advance the harness state.
+ * Recognises the convention historically used by V1 managed-protocol
+ * harnesses (Scout / Planner / Generator / Evaluator) to embed a single-line
+ * signal at the end of an assistant turn — e.g. `[CONFIRMED H1_EXECUTE_EVAL]`.
+ * Most of those downstream consumers (`scout-signals.ts`, in-chain Evaluator
+ * gating) were retired in FEATURE_184 / FEATURE_193; the helper is kept as
+ * the canonical signal-extraction primitive for any future consumer.
  *
  * Returns `[signal, residual]` where:
  *   - `signal`  — uppercased tag (e.g. `CONFIRMED`) or `''` when absent
@@ -2041,23 +2159,92 @@ declare function reconstructMessagesWithToolGuard(stableMessages: KodaXMessage[]
  * per ADR-020 / v0.7.29 §239 §371). Substrate body lives in
  * `agent-runtime/run-substrate.ts` (`runSubstrate`) and is wired via
  * the `Agent.substrateExecutor` closure attached in `coding-preset.ts`.
+ *
+ * v0.7.42: `runRunKodaXInternal` is the shared implementation. The
+ * embedder-facing `startKodaX` (non-blocking, returns `RunningSession`)
+ * lives in `./running-session.ts` and wraps the same internal path —
+ * no dual route (per feedback_no_parallel_refactor_paths).
  */
 
 declare function runKodaX(options: KodaXOptions, prompt: string): Promise<KodaXResult>;
 
+/**
+ * RunningSession — v0.7.42 (closes gap 6 reported by KodaX Space).
+ *
+ * `runKodaX(opts, prompt)` is a blocking `Promise<KodaXResult>` — once
+ * a run is in-flight the SDK consumer cannot observe its session id,
+ * flip provider / model / reasoning mid-run, or abort cooperatively
+ * without forging an external `AbortSignal` and squinting at the
+ * resolved `KodaXResult` after the fact.
+ *
+ * `startKodaX(opts, prompt)` returns a `RunningSession` handle
+ * immediately (the run starts on the next microtask). The handle
+ * exposes:
+ *
+ *   - `id`               — the resolved session id (from
+ *                          `options.session.id` or freshly generated)
+ *   - `currentProvider` / `currentModel` / `currentReasoning`
+ *                          — last value the embedder requested
+ *                          (mirrors what the next turn will see)
+ *   - `setProvider` / `setModel` / `setReasoning`
+ *                          — apply between turns; the next CAP-055
+ *                          re-resolution picks them up
+ *   - `abort(reason?)`    — cooperative abort via internal
+ *                          `AbortController`; honors external
+ *                          `options.abortSignal` too (forwarded)
+ *   - `result`            — `Promise<KodaXResult>` (same shape
+ *                          `runKodaX` returns)
+ *
+ * `runKodaX` is now a thin wrapper over `startKodaX(...).result` so
+ * there is no dual code path (per feedback_no_parallel_refactor_paths).
+ */
+
+interface RunningSession {
+    /** Session id used by the underlying run (echoes options.session.id when supplied). */
+    readonly id: string;
+    /** Last provider value requested via constructor or `setProvider`. */
+    readonly currentProvider: string;
+    /** Last model value requested via constructor or `setModel`. Undefined = provider default. */
+    readonly currentModel: string | undefined;
+    /** Last reasoning mode requested via constructor or `setReasoning`. */
+    readonly currentReasoning: KodaXReasoningMode | undefined;
+    /** Whether `abort` has been called (or the external signal has fired). */
+    readonly aborted: boolean;
+    /** Whether the substrate has wired up the live mutators yet. */
+    readonly attached: boolean;
+    /** Switch provider mid-run. Applies on the next turn. */
+    setProvider(name: string): void;
+    /** Switch model mid-run. Pass undefined to clear an override. */
+    setModel(model: string | undefined): void;
+    /** Switch reasoning mode mid-run. */
+    setReasoning(mode: KodaXReasoningMode | undefined): void;
+    /** Cooperatively abort. The underlying provider stream sees an AbortError. */
+    abort(reason?: unknown): void;
+    /** Resolves to the same shape `runKodaX` returns. */
+    readonly result: Promise<KodaXResult>;
+}
+/**
+ * Public-friendly factory for {@link KodaXSessionControl}. Callers that
+ * want the mid-run mutation surface WITHOUT the `startKodaX` wrapper
+ * (e.g. building their own abort + lifecycle) can instantiate this and
+ * pass it as `KodaXOptions.sessionControl`.
+ */
+declare function createSessionControl(): KodaXSessionControl & KodaXSessionMutators;
+declare function startKodaX(options: KodaXOptions, prompt: string): RunningSession;
+
 /**
  * v0.7.35.1 FEATURE_142 (B-R1) — Coding-flavored compaction summary prompts.
  *
  * These are the verbatim v0.7.35 compaction prompts (byte-identical to
  * the prior `SUMMARY_PROMPT` / `UPDATE_SUMMARY_PROMPT` constants in
- * `@kodax-ai/session-lineage/src/compaction/summary-generator.ts`). They
+ * `@kodax-ai/agent/src/compaction/summary-generator.ts`). They
  * remain the empirically best-performing prompts on the coding domain
  * (96.7% recall on the 10-fixture eval; see
  * `tests/compaction-prompt.eval.ts`) AND happen to also be the best on
  * the non-coding domain (97.0% recall) in the same eval — the wording
  * is coding-flavored but the structure generalizes.
  *
- * Why they live here: per ADR-021, @kodax-ai/session-lineage is the
+ * Why they live here: per ADR-021, @kodax-ai/agent is the
  * generic compaction primitive package and must not enumerate
  * coding-specific language ("coding agent", "file paths, function
  * names", "HTTP status codes", "## Files & Changes") in its public
@@ -2071,7 +2258,7 @@ declare function runKodaX(options: KodaXOptions, prompt: string): Promise<KodaXR
  * coding path produces a byte-equivalent prompt to v0.7.35 — preserving
  * the empirically validated 96.7% recall.
  *
- * Generic / non-coding consumers of @kodax-ai/session-lineage get the
+ * Generic / non-coding consumers of @kodax-ai/agent get the
  * neutral `DEFAULT_SUMMARY_PROMPT` / `DEFAULT_UPDATE_SUMMARY_PROMPT`
  * (the candidate-a-conservative eval winner) by default — they pay a
  * 2-3pt non-coding recall cost for not knowing they should pass these
@@ -2143,33 +2330,6 @@ declare const boundedRevise: QualityInvariant;
 
 declare const budgetCeiling: QualityInvariant;
 
-/**
- * FEATURE_101 invariant: `independentReview`.
- *
- * Verifier-binding invariant: when a manifest's role topology includes
- * a Generator (mutation-producing) role, an Evaluator must also be
- * reachable so the generator's output is independently verified. v1
- * uses agent name conventions (`generator` / `evaluator`) — the
- * canonical role names declared by `@kodax-ai/core/task-engine-agents.ts`.
- *
- * Hooks:
- *   - admit: walk the reachable handoff graph from the manifest. If
- *     any node has name === 'generator', some node must also have name
- *     === 'evaluator'. Single-role manifests (scout / planner / direct
- *     execution) admit unconditionally.
- *   - assertTerminal: if the deliverable recorded mutations, it must
- *     carry a `verdict` field (the evaluator's accept/revise/blocked
- *     emission). A mutating run with no verdict means the generator
- *     bypassed verification — reject.
- *
- * The verifier-can't-read-generator-reasoning contract from
- * FEATURE_101 §verifier separation lives at the message-routing layer
- * (handoff inputFilter); admission's job here is to ensure the role
- * pairing exists, not to police the message flow.
- */
-
-declare const independentReview: QualityInvariant;
-
 /**
  * FEATURE_101 invariant: `toolPermission`.
  *
@@ -2211,15 +2371,19 @@ declare const toolPermission: QualityInvariant;
  *
  *   - Three pure invariants (finalOwner, handoffLegality, evidenceTrail)
  *     are pure functions of admission types and live in @kodax-ai/agent.
- *   - Four coupled invariants (budgetCeiling, toolPermission,
- *     boundedRevise, independentReview) tie into @kodax-ai/coding's budget
- *     controller / tool registry / revise tracker / role conventions and
- *     live here.
+ *   - Three coupled invariants (budgetCeiling, toolPermission,
+ *     boundedRevise) tie into @kodax-ai/coding's budget controller /
+ *     tool registry / revise tracker and live here.
+ *     (FEATURE_184 Phase C.1: `independentReview` deleted — superseded by
+ *     Sidecar Verifier.)
  *   - `harnessSelectionTiming` (FEATURE_106 external) reads coding's AMA
  *     `ctx.recorder.scout.payload.scout.confirmedHarness` and lives here
  *     too (v0.7.35.1 FEATURE_142 A-R2 moved it from @kodax-ai/agent per
  *     ADR-021 — agent admission framework must not enumerate coding-AMA
- *     field names).
+ *     field names). FEATURE_193 (v0.7.43) retired V1 Scout — the
+ *     invariant is now a permanent no-op (predicate always admits)
+ *     but stays registered so existing admission manifests + tests
+ *     keep working.
  *
  * `registerCodingInvariants()` is the canonical bootstrap entry point
  * — call it once at SDK startup (or in test setup paired with
@@ -2235,11 +2399,11 @@ declare const toolPermission: QualityInvariant;
  *
  * v0.7.36 FEATURE_114: added `planBeforeMutate` — V2 plan-first
  * structural observation. Registers alongside `harnessSelectionTiming`
- * (not as a replacement); the two coexist because V1 runs gate on the
- * Scout-emitted harness verdict while V2 runs gate on Worker
- * `todo_update`. Each predicate no-ops when its expected fields are
- * absent, so ship-side flag toggle (KODAX_HARNESS_V2) does not need a
- * separate registry.
+ * (not as a replacement). FEATURE_193 (v0.7.43) retired V1 — the
+ * `harnessSelectionTiming` predicate is now a permanent no-op (it
+ * always admits, since the V2 Worker single-loop is the new V2
+ * harness-discipline anchor) but stays registered so existing
+ * admission manifests + tests keep working.
  */
 declare const CODING_INVARIANTS: readonly QualityInvariant[];
 /**
@@ -2283,40 +2447,30 @@ declare function markFanoutBranchCompleted(plan: KodaXFanoutSchedulerPlan, bundl
 declare function markFanoutBranchCancelled(plan: KodaXFanoutSchedulerPlan, bundleId: string, reason: string): KodaXFanoutSchedulerPlan;
 
 /**
- * Protocol emitter tools — FEATURE_084 Shard 2 (v0.7.26).
- *
- * Four role-specific `RunnableTool`s that replace the fenced-block text
- * protocol used by Scout / Planner / Generator / Evaluator today. Each tool
- * accepts a structured JSON payload, normalizes it via
- * `coerceManagedProtocolToolPayload` (the same normalizer the old fenced-block
- * parser uses), and surfaces the normalized payload on the tool result
- * `metadata.payload` field so the new Runner-driven task engine
- * (FEATURE_084 Shard 5) can make routing decisions without text parsing.
+ * Protocol emitter tools.
  *
- * **Data-only at this shard**: nothing consumes these tools yet. The SA
- * preset path and the existing managed-task engine continue to use the
- * legacy `emit_managed_protocol` tool + fenced-block fallback unchanged.
- *
- * **Payload parity contract**: a given JSON input MUST produce an identical
- * normalized payload to what the legacy fenced-block parser would produce
- * for the same JSON. This is enforced by sharing
- * `coerceManagedProtocolToolPayload` between both paths.
+ * After FEATURE_193 (v0.7.43) V1 chain retirement, this module exposes a
+ * single emitter: `emitVerdict` (the Sidecar Verifier verdict tool). The
+ * supporting types and helpers (`ProtocolEmitterMetadata`,
+ * `resolveHandoffTarget`, `buildEmitter`, `summarizeNormalized`) survive in
+ * generic form because `verifier-recorder-bridge.ts` and the recorder
+ * still observe the emitter metadata shape — but every Scout / Planner /
+ * Generator branch is gone with the V1 roles.
  */
 
-/** Public tool name — LLM sees this on the tool list. */
-declare const EMIT_SCOUT_VERDICT_TOOL_NAME = "emit_scout_verdict";
-declare const EMIT_CONTRACT_TOOL_NAME = "emit_contract";
-declare const EMIT_HANDOFF_TOOL_NAME = "emit_handoff";
 declare const EMIT_VERDICT_TOOL_NAME = "emit_verdict";
 /**
  * Shared metadata shape on the tool result. The Runner-driven task engine
- * (Shard 5) inspects `payload` to understand verdicts and
- * `handoffTarget` to execute the next role transition.
+ * inspects `payload` to understand the Sidecar Verifier verdict.
+ *
+ * FEATURE_193 (v0.7.43): the role union narrowed from the V1 four-role
+ * set (scout/planner/generator/evaluator) to `'evaluator'` only — Sidecar
+ * Verifier is the sole emitter that survives V1 chain retirement.
  */
 interface ProtocolEmitterMetadata {
-    /** The role that emitted this payload — always matches the tool's role. */
-    readonly role: 'scout' | 'planner' | 'generator' | 'evaluator';
-    /** Normalized payload slice (scout / contract / handoff / verdict). */
+    /** The role that emitted this payload — always `'evaluator'` in V2. */
+    readonly role: 'evaluator';
+    /** Normalized payload slice (verdict). */
     readonly payload: Partial<KodaXManagedProtocolPayload>;
     /**
      * FEATURE_084 Shard 4 handoff signal. When set, the Runner looks up the
@@ -2333,29 +2487,19 @@ interface ProtocolEmitterMetadata {
     readonly isTerminal?: boolean;
 }
 /**
- * Scout verdict emitter. Reports the outcome of scope analysis and the
- * chosen harness tier. The Runner-driven task engine reads
- * `metadata.payload.scout.confirmedHarness` to decide whether to hand off
- * to Generator (H1) or Planner (H2), or to finish directly (H0).
- */
-declare const emitScoutVerdict: RunnableTool;
-/**
- * Planner contract emitter (H2 only). Produces the execution contract the
- * Generator consumes: success criteria, required evidence, constraints.
- */
-declare const emitContract: RunnableTool;
-/**
- * Generator handoff emitter. Signals that the Generator has finished its
- * execution round and hands off to the Evaluator for verification.
+ * Sidecar Verifier verdict emitter (FEATURE_184). Decides the terminal
+ * outcome of the round: accept, revise (Worker re-runs to fix), or
+ * blocked. The Runner-driven engine reads `metadata.payload.verdict.status`
+ * to decide next hop. Called by the Stop-hook Sidecar Verifier, never
+ * by Worker/Generator directly.
  */
-declare const emitHandoff: RunnableTool;
+declare const emitVerdict: RunnableTool;
 /**
- * Evaluator verdict emitter. Decides the terminal outcome of the round:
- * accept, revise (retry with same harness), or blocked. The Runner-driven
- * engine reads `metadata.payload.verdict.status` to decide next hop.
+ * Emitter tools tuple. FEATURE_190 (v0.7.43) shrank from 4→3 with
+ * `emitHandoff` deletion; FEATURE_193 (v0.7.43) shrank to 1 with
+ * `emitScoutVerdict` + `emitContract` deletion — only the Sidecar Verifier
+ * emitter survives.
  */
-declare const emitVerdict: RunnableTool;
-/** All four emitter tools, exposed as a tuple for iteration. */
 declare const PROTOCOL_EMITTER_TOOLS: readonly RunnableTool[];
 
 declare function runManagedTask(options: KodaXOptions, prompt: string): Promise<KodaXResult>;
@@ -2464,11 +2608,11 @@ declare function getActiveExtensionRuntime(): KodaXExtensionRuntime | null;
 
 /**
  * Coding-runtime adapter: registers an `McpCapabilityProvider` (from
- * `@kodax-ai/mcp`) against the coding-specific `KodaXExtensionRuntime`.
+ * `@kodax-ai/agent`) against the coding-specific `KodaXExtensionRuntime`.
  *
  * FEATURE_082 (v0.7.24): split out of the old
  * `capabilities/providers/mcp/provider.ts`. The provider class now lives in
- * `@kodax-ai/mcp` and stays free of any coding runtime dependency; this file
+ * `@kodax-ai/agent` and stays free of any coding runtime dependency; this file
  * is the thin bridge that wires the provider into the coding extension
  * runtime.
  */
@@ -2540,13 +2684,13 @@ type OrchestrationWorkerRunner<TTask extends OrchestrationWorkerSpec = Orchestra
  * `appendTrace` to `{workspaceDir}/orchestration-trace.jsonl`.
  *
  * @deprecated FEATURE_083 (v0.7.24) originally superseded this by
- * `AgentSpan` / `HandoffSpan` in `@kodax-ai/tracing`. **FEATURE_086 (v0.7.27)
+ * `AgentSpan` / `HandoffSpan` in `@kodax-ai/agent`. **FEATURE_086 (v0.7.27)
  * evaluated removal and kept it**: AgentSpan is scoped to a single Runner
  * lifecycle, whereas OrchestrationTraceEvent spans across Tasks scheduled
  * by `runOrchestration` — no cross-task span equivalent exists yet, and
  * `runOrchestration` + this type are part of the `@kodax-ai/coding` public
  * surface. The `@deprecated` tag is kept as a signal that new code
- * targeting in-Runner tracing should prefer `@kodax-ai/tracing` spans;
+ * targeting in-Runner tracing should prefer `@kodax-ai/agent` spans;
  * cross-task orchestration code is free to continue using this event.
  */
 interface OrchestrationTraceEvent {
@@ -2691,471 +2835,135 @@ declare function createDenialTracker(): DenialTracker;
  * - bash: first 3 tokens of the command
  * - edit/write/read: file path
  * - other: tool name + hash prefix
- */
-declare function computeInputSignature(toolName: string, input: Record<string, unknown>): string;
-declare function recordDenial(tracker: DenialTracker, toolName: string, input: Record<string, unknown>, reason?: string): DenialTracker;
-declare function isDeniedRecently(tracker: DenialTracker, toolName: string, input: Record<string, unknown>, ttl?: number): boolean;
-/**
- * Generate a denial context string for injection into agent messages.
- * Tells the LLM what was denied so it can adjust its strategy.
- */
-declare function getDenialContext(tracker: DenialTracker): string;
-
-/**
- * Placeholder Agent declarations for the coding-AMA H2 task-engine roles
- * (Scout / Planner / Generator / Evaluator).
- *
- * FEATURE_080 (v0.7.23): these declarations exist so the role identities
- * are represented as Layer A `Agent` data, which downstream features need:
- *
- *   - FEATURE_084 (v0.7.26): runtime rewrite of Scout/Planner/Generator/
- *     Evaluator on top of `Runner` consumes these declarations as the
- *     source of truth for role metadata.
- *   - FEATURE_078 (v0.7.29): reasoning profiles attach to the `reasoning`
- *     field on these declarations.
- *   - FEATURE_087+ self-construction: Agent-as-data means role specs can
- *     be serialized, versioned, and mutated.
- *
- * Runtime note: **no preset dispatcher is registered for these agents**.
- * They are declarative placeholders. `Runner.run(scoutAgent, ...)` without
- * an `opts.llm` callback will throw the generic "no dispatcher" error;
- * that's intentional — the current task-engine executes these roles via
- * its existing internal flow, not through `Runner`. FEATURE_084 wires the
- * Runner runtime to these declarations.
- *
- * `instructions` strings here are short identifier-level summaries — the
- * full role prompts live in
- * `packages/coding/src/task-engine/_internal/prompts/role-prompt.ts` (the
- * FEATURE_079 extraction) and are loaded by the existing code path.
- *
- * v0.7.35.1 FEATURE_142 (A-R1): moved from `@kodax-ai/agent/src/primitives/`
- * back to `@kodax-ai/coding/src/agents/`. These role declarations are
- * coding-AMA-specific (Scout / Planner / Generator / Evaluator are the
- * H2 state-machine roles, not generic Agent platform primitives). Per
- * ADR-021, the universal `@kodax-ai/agent` framework must not predeclare
- * coding's H2 role identities.
- */
-
-declare const SCOUT_AGENT_NAME = "kodax/role/scout";
-declare const PLANNER_AGENT_NAME = "kodax/role/planner";
-declare const GENERATOR_AGENT_NAME = "kodax/role/generator";
-declare const EVALUATOR_AGENT_NAME = "kodax/role/evaluator";
-/**
- * Scout role declaration. Scout is the AMA entry point that both judges
- * task complexity and executes the H0 direct case; on H1/H2 it hands off
- * to Generator or Planner (see FEATURE_061).
- */
-declare const scoutAgent: Agent;
-/**
- * Planner role declaration. Produces an execution plan consumed by
- * Generator in the H2 harness.
- */
-declare const plannerAgent: Agent;
-/**
- * Generator role declaration. Performs the actual code changes /
- * investigations in both H1 and H2 harnesses.
- */
-declare const generatorAgent: Agent;
-/**
- * Evaluator role declaration. Lightweight verifier in H1, structured
- * revise/replan gate in H2.
- */
-declare const evaluatorAgent: Agent;
-/** All four placeholder role agents, exposed for iteration in downstream features. */
-declare const TASK_ENGINE_ROLE_AGENTS: Readonly<{
-    readonly scout: Agent<unknown>;
-    readonly planner: Agent<unknown>;
-    readonly generator: Agent<unknown>;
-    readonly evaluator: Agent<unknown>;
-}>;
-
-/**
- * Default coding agent preset (FEATURE_080 → FEATURE_100).
- *
- * History:
- *   v0.7.23 (FEATURE_080) introduced "Option Y": a `registerPresetDispatcher`
- *   indirection that wrapped `runKodaX` so `Runner.run(defaultCodingAgent, …)`
- *   appeared SDK-native while the body stayed on the legacy path. The trade-off
- *   was deliberate parity insurance during the Layer-A primitives rollout.
- *
- *   v0.7.29 (FEATURE_100) deletes Option Y per ADR-020. The substrate executor
- *   is attached directly to the Agent declaration via `Agent.substrateExecutor`
- *   (an Agent field added in this version), and `Runner.run` consults that
- *   field before any registry lookup. No `registerPresetDispatcher` call is
- *   made any more, so `Runner.run(createDefaultCodingAgent(), …)` and
- *   `runKodaX(opts, prompt)` (now a thin `Runner.run` wrapper in `agent.ts`)
- *   share one execution path.
- *
- * This file stays in `@kodax-ai/coding` because the substrate executor closure
- * imports `runSubstrate` from `agent-runtime/run-substrate.ts`. Importing
- * `@kodax-ai/core` alone never loads the substrate body.
- */
-
-/** Stable name used as the dispatch key for the built-in coding preset. */
-declare const DEFAULT_CODING_AGENT_NAME = "kodax/coding/default";
-/**
- * Construct the default coding Agent declaration. SDK consumers may write
- * `Runner.run(createDefaultCodingAgent(), prompt, { presetOptions })` and
- * the Runner will execute the substrate via `Agent.substrateExecutor`.
- *
- * `overrides` lets callers attach additional declarative fields
- * (e.g. custom `reasoning` profile, extra `guardrails`, custom
- * `provider`/`model`); these are preserved on the Agent and may be
- * consumed by the substrate executor through `presetOptions`.
- */
-declare function createDefaultCodingAgent(overrides?: Partial<Omit<Agent, 'name' | 'instructions'>>): Agent;
-
-/**
- * Coding Agent declarations — FEATURE_084 (v0.7.26).
- *
- * **These are declarative references exposing the canonical Scout /
- * Planner / Generator / Evaluator topology to SDK consumers.** Each
- * exported Agent carries the role's emit tool + the H0/H1/H2 handoff
- * graph, but carries ONLY a short identifier `instructions` string and
- * NO coding tools (read / grep / bash / write / edit / etc.).
- *
- * **The runtime agents are built fresh by
- * `task-engine/runner-driven.ts::buildRunnerAgentChain` on every run**,
- * with:
- *   - full v0.7.22-parity `instructions` via
- *     `_internal/managed-task/role-prompt.ts::createRolePrompt` (dynamic
- *     closure resolving decision / contract / metadata / verification /
- *     tool-policy / evidence-strategy / dispatch guidance per turn)
- *   - per-run coding tools (read / grep / glob / bash / write / edit /
- *     dispatch_child_task) wrapped with budget + mutation tracking +
- *     progress reporting
- *   - recorder-wrapped emit tools that drive the budget-extension
- *     dialog + degraded-continue logic
- *
- * So these exports are **useful as topology documentation and as a
- * starting point for custom Runner invocations** (e.g. Runner.run with
- * your own llm adapter), but they are NOT the agents that run under
- * normal AMA dispatch. Do not expect wrapping `scoutCodingAgent` to
- * give you the behaviour of an in-SDK AMA run — for that, use
- * `runManagedTaskViaRunner` or the preset dispatcher on
- * `createDefaultCodingAgent`.
- */
-
-/** Marker exported for tests and for future binding sites in Shard 5. */
-declare const CODING_AGENT_MARKER: "kodax-coding-agent@0.7.26";
-declare const scoutCodingAgent: Agent;
-declare const plannerCodingAgent: Agent;
-declare const generatorCodingAgent: Agent;
-declare const evaluatorCodingAgent: Agent;
-/**
- * Topology record — iterable form of the four coding agents. Shard 5's
- * Runner-driven dispatcher uses this as the agent lookup.
- */
-declare const CODING_AGENTS: Readonly<{
-    readonly scout: Agent<unknown>;
-    readonly planner: Agent<unknown>;
-    readonly generator: Agent<unknown>;
-    readonly evaluator: Agent<unknown>;
-}>;
-
-/**
- * Adapter: wrap `applyToolResultGuardrail` (the existing per-tool truncation
- * policy) as a Layer A `ToolGuardrail.afterTool`.
- *
- * FEATURE_085 (v0.7.26): the tri-layer Guardrail runtime lives in
- * `@kodax-ai/core`. The existing truncation logic in `tool-result-policy.ts`
- * predates that runtime and targets `KodaXToolExecutionContext`. Rather
- * than merge the two, we expose an adapter that coding consumers can
- * register when driving a Runner through the generic path — the adapter
- * preserves byte-exact truncation behaviour while participating in the
- * new Guardrail lifecycle (Span emission, declaration-order composition).
- *
- * **Not** registered by default. Consumers opt in via
- * `Runner.run(agent, input, { guardrails: [createToolResultTruncationGuardrail(ctx)] })`.
- * The built-in `runKodaX` preset dispatcher continues to call
- * `applyToolResultGuardrail` directly — no behavioural change there.
- */
-
-declare const TOOL_RESULT_TRUNCATION_GUARDRAIL_NAME = "tool-result-truncation";
-/**
- * Create a `ToolGuardrail` that delegates to `applyToolResultGuardrail` in
- * its `afterTool` hook. The returned guardrail does not touch the call
- * going in (no `beforeTool`).
- *
- * @param ctx The coding-layer execution context that
- * `applyToolResultGuardrail` needs (mutation tracker, persistence dir,
- * etc.). Typically created alongside the `KodaXOptions` for the run.
- */
-declare function createToolResultTruncationGuardrail(ctx: KodaXToolExecutionContext): ToolGuardrail;
-
-/**
- * KodaX Constructed-World types (FEATURE_087, v0.7.28).
- *
- * Runtime-generated capabilities (tools / agents / skills / ...) live in
- * `.kodax/constructed/` and are loaded into the same registries as builtin
- * primitives. v0.7.28 only ships tool generation (FEATURE_088); other kinds
- * land in FEATURE_089 / FEATURE_090.
- *
- * Cross-references:
- *   - DD §14 — lifecycle, security model, registry merge semantics.
- *   - docs/features/v0.7.28.md — capability schema, generation flow.
- */
-/**
- * Handler script source. v0.7.28 limits language to `'javascript'` so that
- * `loadHandler()` can `await import()` the file directly without an
- * intermediate TS → JS compile step (no esbuild / tsx dependency).
- *
- * TypeScript handlers are explicitly out of scope; Coding Agent generates
- * JS strings on the wire.
- */
-interface ScriptSource {
-    readonly kind: 'script';
-    readonly language: 'javascript';
-    readonly code: string;
-}
-/**
- * Capability declaration.
- *
- * v0.7.28 ships the single-dimension form: a whitelist of builtin tool
- * names that the handler may invoke through `ctx.tools.<name>(...)`.
- * All I/O — fs / net / env — must flow through builtin tools (`read` /
- * `write` / `bash` / etc.); handlers do not receive direct `ctx.fs` /
- * `ctx.net` / `ctx.env` entry points.
- *
- * Forward-compatible evolution: if the future demands path/domain-level
- * constraints, this can grow to `(string | { name; constraints })[]`
- * without breaking existing manifests.
- */
-interface Capabilities {
-    readonly tools: readonly string[];
-}
-/**
- * Tool-kind artifact body (the `content` of `ConstructionArtifact` when
- * `kind === 'tool'`).
- */
-interface ToolContent {
-    readonly description: string;
-    readonly inputSchema: Record<string, unknown>;
-    readonly capabilities: Capabilities;
-    readonly handler: ScriptSource;
-    /**
-     * Per-tool timeout override. Defaults to {@link DEFAULT_HANDLER_TIMEOUT_MS}
-     * when omitted. Bounded by AbortController in `loadHandler()`.
-     */
-    readonly timeoutMs?: number;
-}
-/**
- * Default handler timeout. Picked to match the historical ceiling on
- * builtin streaming tools (30s); revisit if a constructed tool demands
- * longer-running computation.
- */
-declare const DEFAULT_HANDLER_TIMEOUT_MS = 30000;
-/**
- * Lifecycle state on disk. Drives both the startup glob filter and the
- * `revoke()` semantics. See DD §14.1 — file system is the single source
- * of truth; no separate `_manifest.json` index file (C4 decision).
- */
-type ArtifactStatus = 'staged' | 'active' | 'revoked';
-/**
- * Reference to a tool by stable id. v0.7.31 (FEATURE_089) introduces
- * Agent manifests that bundle tool refs rather than inline tool bodies;
- * the resolver expands these refs to concrete `KodaXToolDefinition`
- * instances at activate time.
- *
- * `ref` shape:
- *   - `builtin:<name>`            — a tool from the static registry
- *     (e.g. `builtin:read`, `builtin:bash`)
- *   - `constructed:<name>@<ver>`  — a previously-activated constructed tool
- */
-interface ToolRef {
-    readonly ref: string;
-}
-/**
- * Reference to a Guardrail by stable id. The Layer A `Guardrail`
- * declaration is name-only (no runtime hooks); resolvers map known
- * names to constructed `ToolGuardrail` / `InputGuardrail` /
- * `OutputGuardrail` instances at activation time.
- */
-interface GuardrailRef {
-    readonly kind: 'input' | 'output' | 'tool';
-    readonly ref: string;
-}
-/**
- * Reference to a handoff target by stable id (another constructed agent
- * or a builtin role). The resolver expands `target.ref` to the actual
- * `Agent` declaration at admission time so the handoff DAG check
- * (`handoffLegality` invariant) sees the full graph.
- */
-interface AgentHandoffRef {
-    readonly target: {
-        readonly ref: string;
-    };
-    readonly kind: 'continuation' | 'as-tool';
-    readonly description?: string;
-}
+ */
+declare function computeInputSignature(toolName: string, input: Record<string, unknown>): string;
+declare function recordDenial(tracker: DenialTracker, toolName: string, input: Record<string, unknown>, reason?: string): DenialTracker;
+declare function isDeniedRecently(tracker: DenialTracker, toolName: string, input: Record<string, unknown>, ttl?: number): boolean;
 /**
- * Reasoning profile declaration mirroring the Layer A
- * `AgentReasoningProfile`. Kept structurally identical so the resolver
- * passes the value through without re-shaping.
+ * Generate a denial context string for injection into agent messages.
+ * Tells the LLM what was denied so it can adjust its strategy.
  */
-interface AgentReasoningRef {
-    readonly default: 'quick' | 'balanced' | 'deep';
-    readonly max?: 'quick' | 'balanced' | 'deep';
-    readonly escalateOnRevise?: boolean;
-}
+declare function getDenialContext(tracker: DenialTracker): string;
+
 /**
- * Sandbox test case. Used by `sandbox_test_agent` to verify a
- * constructed agent before it can activate. Each case feeds `input`
- * to a sandbox Runner instance and grades the agent's final output:
+ * Role-name constants for the coding-AMA task-engine.
  *
- *   - `expectMatch`     — final text must match this regex (string form)
- *   - `expectNotMatch`  — final text must NOT match this regex
- *   - `expectFinalText` — exact substring match (case-sensitive)
+ * FEATURE_193 v0.7.43: V1 chain (Scout/Planner/Generator) retired — the
+ * placeholder Agent declarations are deleted, but the name constants
+ * (`SCOUT_AGENT_NAME` / `PLANNER_AGENT_NAME` / `GENERATOR_AGENT_NAME`) survive
+ * as string literals so:
+ *   - verdict-recorder.ts routing logic that compares `handoffTarget` against
+ *     these names still compiles
+ *   - historical session id strings that reference these roles can still parse
  *
- * At least one of the three expect-fields must be present; the cases
- * are graded by `runSandboxAgentTest()` (FEATURE_089 Phase 3.5).
+ * Worker is the only live placeholder Agent — the runtime Worker (with full
+ * tool set, handoffs, mutation guards) is constructed in
+ * `task-engine/runner-driven.ts::buildRunnerAgentChain`.
  */
-interface AgentTestCase {
-    readonly id: string;
-    readonly input: string;
-    readonly expectMatch?: string;
-    readonly expectNotMatch?: string;
-    readonly expectFinalText?: string;
-}
+
+declare const SCOUT_AGENT_NAME = "kodax/role/scout";
+declare const PLANNER_AGENT_NAME = "kodax/role/planner";
+declare const GENERATOR_AGENT_NAME = "kodax/role/generator";
+declare const WORKER_AGENT_NAME = "kodax/role/worker";
 /**
- * Agent-kind artifact body (the `content` of `ConstructionArtifact`
- * when `kind === 'agent'`).
+ * Worker role declaration — FEATURE_114 v0.7.36. The single primary agent
+ * after FEATURE_193 V1 chain retirement. Plans (todo_update), executes
+ * (read/write/edit/bash/dispatch), text-only terminates so Sidecar Verifier
+ * (FEATURE_184 Phase D.2) runs verification.
  *
- * FEATURE_089 (v0.7.31): all fields except `instructions` are optional;
- * a minimal "echo agent" can be expressed as `{ instructions: '...' }`.
- * Tool / handoff / guardrail refs are resolved at admission time
- * (Runner.admit's 5-step audit expands them and feeds the resolved
- * Agent through the invariant chain).
+ * Placeholder for Layer A `Agent` data — the runtime Worker (with full
+ * tool set, handoffs, mutation guards) is constructed in
+ * `task-engine/runner-driven.ts::buildRunnerAgentChain`.
  */
-interface AgentContent {
-    readonly instructions: string;
-    readonly tools?: readonly ToolRef[];
-    readonly handoffs?: readonly AgentHandoffRef[];
-    readonly reasoning?: AgentReasoningRef;
-    readonly guardrails?: readonly GuardrailRef[];
-    readonly model?: string;
-    readonly provider?: string;
-    /**
-     * Optional structured-output schema mirroring `Agent.outputSchema`.
-     * Pure pass-through to the runtime — admission does not validate
-     * shape semantics here, only well-formed JSON.
-     */
-    readonly outputSchema?: Record<string, unknown>;
-    /**
-     * Optional sandbox test cases. When present, `sandbox_test_agent`
-     * runs them; when absent, the test step performs only the static
-     * checks (manifest schema + admission audit).
-     */
-    readonly testCases?: readonly AgentTestCase[];
-    /**
-     * Maximum total budget (iteration count) the agent may consume.
-     * Plumbed onto the resolved `AgentManifest.maxBudget` and clamped by
-     * `budgetCeiling` invariant during admission.
-     */
-    readonly maxBudget?: number;
-    /**
-     * Voluntary additional invariants the LLM declares this agent
-     * commits to. Plumbed onto `AgentManifest.declaredInvariants`;
-     * unioned on top of the required set during admission.
-     */
-    readonly declaredInvariants?: readonly string[];
-}
+declare const workerAgent: Agent;
+/** Worker role agent exposed for iteration in downstream features. */
+declare const TASK_ENGINE_ROLE_AGENTS: Readonly<{
+    readonly worker: Agent<unknown>;
+}>;
+
 /**
- * Persisted artifact shape (one JSON file per name/version under
- * `.kodax/constructed/<kind>s/<name>/<version>.json`).
+ * Default coding agent preset (FEATURE_080 → FEATURE_100).
  *
- * Discriminated union over `kind`:
- *   - `kind: 'tool'`  — v0.7.28 (FEATURE_088) tool generation
- *   - `kind: 'agent'` — v0.7.31 (FEATURE_089) agent generation; passes
- *                       through `Runner.admit()` at activation time
+ * History:
+ *   v0.7.23 (FEATURE_080) introduced "Option Y": a `registerPresetDispatcher`
+ *   indirection that wrapped `runKodaX` so `Runner.run(defaultCodingAgent, …)`
+ *   appeared SDK-native while the body stayed on the legacy path. The trade-off
+ *   was deliberate parity insurance during the Layer-A primitives rollout.
  *
- * Lifecycle fields (status / timestamps / contentHash / sourceAgent /
- * signedBy) are common to all kinds.
+ *   v0.7.29 (FEATURE_100) deletes Option Y per ADR-020. The substrate executor
+ *   is attached directly to the Agent declaration via `Agent.substrateExecutor`
+ *   (an Agent field added in this version), and `Runner.run` consults that
+ *   field before any registry lookup. No `registerPresetDispatcher` call is
+ *   made any more, so `Runner.run(createDefaultCodingAgent(), …)` and
+ *   `runKodaX(opts, prompt)` (now a thin `Runner.run` wrapper in `agent.ts`)
+ *   share one execution path.
+ *
+ * This file stays in `@kodax-ai/coding` because the substrate executor closure
+ * imports `runSubstrate` from `agent-runtime/run-substrate.ts`. Importing
+ * `@kodax-ai/core` alone never loads the substrate body.
  */
-type ConstructionArtifact = ToolArtifact | AgentArtifact;
-interface ConstructionArtifactBase {
-    readonly name: string;
-    readonly version: string;
-    status: ArtifactStatus;
-    readonly signedBy?: string;
-    readonly createdAt: number;
-    readonly sourceAgent?: string;
-    testedAt?: number;
-    activatedAt?: number;
-    revokedAt?: number;
-    /**
-     * SHA-256 of `JSON.stringify(content)` captured at activate time.
-     * `rehydrateActiveArtifacts()` recomputes and compares — a mismatch
-     * indicates the manifest was edited between activation and the next
-     * boot (naive cross-session tampering, e.g. an LLM rewriting the .json
-     * via the Write tool without recomputing the hash). Mismatched
-     * artifacts are skipped at rehydrate with a stderr warning. This is
-     * NOT a defense against a coordinated attacker who recomputes the
-     * hash; the threat model is single-user CLI integrity, not multi-user
-     * supply chain.
-     */
-    contentHash?: string;
-}
-interface ToolArtifact extends ConstructionArtifactBase {
-    readonly kind: 'tool';
-    readonly content: ToolContent;
-}
-interface AgentArtifact extends ConstructionArtifactBase {
-    readonly kind: 'agent';
-    readonly content: AgentContent;
-}
+
+/** Stable name used as the dispatch key for the built-in coding preset. */
+declare const DEFAULT_CODING_AGENT_NAME = "kodax/coding/default";
 /**
- * Returned by {@link ConstructionRuntime.stage}; opaque handle that
- * downstream `test()` / `activate()` calls bind to.
+ * Construct the default coding Agent declaration. SDK consumers may write
+ * `Runner.run(createDefaultCodingAgent(), prompt, { presetOptions })` and
+ * the Runner will execute the substrate via `Agent.substrateExecutor`.
+ *
+ * `overrides` lets callers attach additional declarative fields
+ * (e.g. custom `reasoning` profile, extra `guardrails`, custom
+ * `provider`/`model`); these are preserved on the Agent and may be
+ * consumed by the substrate executor through `presetOptions`.
  */
-interface StagedHandle {
-    readonly artifact: ConstructionArtifact;
-    readonly stagedAt: number;
-}
+declare function createDefaultCodingAgent(overrides?: Partial<Omit<Agent, 'name' | 'instructions'>>): Agent;
+
 /**
- * Outcome of {@link ConstructionRuntime.test}. `ok=false` blocks
- * activation; `warnings` surface but do not block.
+ * Coding Agent declarations — FEATURE_193 v0.7.43.
+ *
+ * The V1 chain (Scout / Planner / Generator) was retired in FEATURE_193.
+ * The Worker single-loop is now the only entry path; the runtime Worker
+ * agent (with full tool set, handoffs, mutation guards) is constructed
+ * fresh by `task-engine/runner-driven.ts::buildRunnerAgentChain` on every
+ * run. This file retains only the declarative marker for the
+ * `Constructed` admission contract since downstream consumers
+ * (coding-preset / extension API) test against it.
  */
-interface TestResult {
-    readonly ok: boolean;
-    readonly errors?: readonly string[];
-    readonly warnings?: readonly string[];
-}
 /**
- * Policy gate — invoked once per `activate()` before the artifact is
- * registered. Default rejects implicit auto-approval; the REPL surface
- * binds a dialog-based policy in `packages/repl/src/common/construction-
- * bootstrap.ts` so user approval flows through the live askUser channel.
- *
- * Modeled as a function type rather than an interface (D3 decision):
- * keeps the contract surface tiny, no class boilerplate.
- *
- * No declarative `kodax.config.ts` override hatch is provided — see the
- * "Deferred Design Decisions" section in `features/v0.7.28.md` for why
- * a `risk_mode` enum (when truly needed) is preferred over user-authored
- * policy functions.
+ * Sentinel guardrail name used by the coding-AMA admission contract to
+ * identify Constructed agents (FEATURE_087+). Kept here as the canonical
+ * marker string after the V1 chain agent declarations were retired.
  */
-type ConstructionPolicy = (artifact: ConstructionArtifact) => Promise<ConstructionPolicyVerdict>;
-type ConstructionPolicyVerdict = 'approve' | 'reject' | 'ask-user';
-/** Default policy: always ask the user; no implicit approvals. */
-declare const defaultPolicy: ConstructionPolicy;
+declare const CODING_AGENT_MARKER = "kodax/coding-agent";
+
 /**
- * Thrown by `CtxProxy` when handler attempts to access a tool not declared
- * in `capabilities.tools`. Caught in tracer; surfaces as a tool error.
+ * Adapter: wrap `applyToolResultGuardrail` (the existing per-tool truncation
+ * policy) as a Layer A `ToolGuardrail.afterTool`.
+ *
+ * FEATURE_085 (v0.7.26): the tri-layer Guardrail runtime lives in
+ * `@kodax-ai/core`. The existing truncation logic in `tool-result-policy.ts`
+ * predates that runtime and targets `KodaXToolExecutionContext`. Rather
+ * than merge the two, we expose an adapter that coding consumers can
+ * register when driving a Runner through the generic path — the adapter
+ * preserves byte-exact truncation behaviour while participating in the
+ * new Guardrail lifecycle (Span emission, declaration-order composition).
+ *
+ * **Not** registered by default. Consumers opt in via
+ * `Runner.run(agent, input, { guardrails: [createToolResultTruncationGuardrail(ctx)] })`.
+ * The built-in `runKodaX` preset dispatcher continues to call
+ * `applyToolResultGuardrail` directly — no behavioural change there.
  */
-declare class CapabilityDeniedError extends Error {
-    readonly toolName: string;
-    readonly declaredTools: readonly string[];
-    constructor(toolName: string, declaredTools: readonly string[]);
-}
+
+declare const TOOL_RESULT_TRUNCATION_GUARDRAIL_NAME = "tool-result-truncation";
 /**
- * Thrown when a manifest cannot be parsed / is missing required fields.
- * Surfaces during stage() / startup glob; tracer records details.
+ * Create a `ToolGuardrail` that delegates to `applyToolResultGuardrail` in
+ * its `afterTool` hook. The returned guardrail does not touch the call
+ * going in (no `beforeTool`).
+ *
+ * @param ctx The coding-layer execution context that
+ * `applyToolResultGuardrail` needs (mutation tracker, persistence dir,
+ * etc.). Typically created alongside the `KodaXOptions` for the run.
  */
-declare class ConstructionManifestError extends Error {
-    readonly path?: string;
-    constructor(message: string, path?: string);
-}
+declare function createToolResultTruncationGuardrail(ctx: KodaXToolExecutionContext): ToolGuardrail;
 
 /**
  * FEATURE_089 Phase 3.5 — Sandbox Agent Test Runner.
@@ -3657,6 +3465,149 @@ declare function hasPendingSwap(name: string): boolean;
  */
 declare function drainPendingSwaps(): readonly string[];
 
+/**
+ * FEATURE_191 (v0.7.43) — markdown-defined agent loader.
+ *
+ * Scans two directories for user/project-authored agent definitions
+ * (claudecode-style `<name>.md` with YAML frontmatter + body) and
+ * registers them as constructed agents via `Runner.admit` →
+ * `registerConstructedAgent`. Two-tier path (user first, then project)
+ * with `last-write-wins` semantics implements precedence: a project
+ * agent of the same name shadows the user agent (the more-specific
+ * scope wins).
+ *
+ * Markdown shape:
+ *
+ *   ---
+ *   name: db-reviewer
+ *   description: Reviews DB migrations for safety
+ *   tools: [read, grep]
+ *   model: claude-sonnet-4-6
+ *   ---
+ *   You are a DB migration reviewer. ...
+ *
+ * Files without YAML frontmatter, or with a missing `name`, are
+ * silently skipped (claudecode-compatible: a `.md` without
+ * frontmatter is treated as a reference doc). Files with frontmatter
+ * but a missing/invalid `description` are reported as failures so the
+ * REPL can surface diagnostics.
+ *
+ * `mcpServers` / `hooks` / `memory` / `isolation` / `permissionMode` /
+ * `maxTurns` / `skills` frontmatter fields are ignored in v0.7.43 — they
+ * are intentional non-goals; each one is an independent product
+ * decision. Ignoring them silently keeps user `.md` files
+ * forward-compatible across future feature versions.
+ */
+/**
+ * Per-file failure record returned to the boot caller. Mirrors
+ * claudecode's `getAgentDefinitionsWithOverrides.failedFiles` shape so
+ * the REPL `/agents list` diagnostic can surface per-file reasons
+ * instead of a global count.
+ */
+interface MarkdownLoadFailure {
+    readonly path: string;
+    readonly reason: string;
+}
+interface LoadAgentsFromMarkdownResult {
+    readonly loaded: number;
+    readonly failed: readonly MarkdownLoadFailure[];
+}
+interface LoadAgentsFromMarkdownOptions {
+    /**
+     * Project root. Defaults to `process.cwd()`. Project agents live at
+     * `<cwd>/.kodax/agents/*.md` and override user-level agents of the
+     * same name via last-write-wins (loaded second).
+     */
+    readonly cwd?: string;
+    /**
+     * Override for the user-level config home. Defaults to the agent
+     * runtime's resolved config home (`getAgentConfigHome()`, e.g.
+     * `~/.kodax`). User agents live at `<configHome>/agents/*.md` and
+     * are loaded before project agents.
+     */
+    readonly configHome?: string;
+}
+/**
+ * FEATURE_197 (v0.7.43) — discovered markdown agent metadata.
+ *
+ * Read-only counterpart to `ConstructedAgentEntry` exposed by
+ * `discoverMarkdownAgents`. Differs from `ConstructedAgentEntry` in
+ * three ways: (1) no resolved `Agent` runtime object — discovery is
+ * purely file-system-side; (2) `source` is narrowed to the two
+ * markdown scopes only; (3) `path` carries the source file location
+ * so consumers can offer "open file" affordances.
+ */
+interface DiscoveredMarkdownAgent {
+    /** Agent name from frontmatter `name` field. */
+    readonly name: string;
+    /** Agent description from frontmatter `description` field. */
+    readonly description: string;
+    /** Provenance: which scope the file was found in. */
+    readonly source: 'markdown:user' | 'markdown:project';
+    /** Absolute path of the markdown file on disk. */
+    readonly path: string;
+    /**
+     * Tool names declared in the frontmatter `tools` field, normalized
+     * to a string array. The `builtin:` prefix that the loader applies
+     * to `ToolRef`s is NOT applied here — discovery returns the raw
+     * names the user wrote.
+     */
+    readonly tools?: readonly string[];
+    /** Optional model alias from frontmatter `model` field. */
+    readonly model?: string;
+}
+interface DiscoverMarkdownAgentsResult {
+    /**
+     * Well-formed agents found in the scanned directories. Same
+     * last-write-wins precedence as `loadAgentsFromMarkdown`: when a
+     * name appears in both user and project scopes, the project entry
+     * wins and the user entry is omitted. The returned set mirrors
+     * exactly what `loadAgentsFromMarkdown` would activate.
+     */
+    readonly agents: readonly DiscoveredMarkdownAgent[];
+    /** Files that had frontmatter but failed validation. */
+    readonly failed: readonly MarkdownLoadFailure[];
+}
+/**
+ * Entry point. Scans user then project dirs; registers every
+ * well-formed agent that passes admission. Failures are accumulated
+ * into the result instead of throwing — a single malformed file must
+ * not break boot.
+ */
+declare function loadAgentsFromMarkdown(opts?: LoadAgentsFromMarkdownOptions): Promise<LoadAgentsFromMarkdownResult>;
+/**
+ * FEATURE_197 (v0.7.43) — read-only counterpart to
+ * `loadAgentsFromMarkdown`. Scans the same two-tier path (user dir
+ * then project dir) and returns metadata for every well-formed
+ * agent found, WITHOUT calling `Runner.admit` or
+ * `registerConstructedAgent`. Pure file-system + YAML parse — no
+ * mutation of the in-memory agent registry.
+ *
+ * SDK consumers building an "agent picker" UI call this to preview
+ * available agents before deciding whether (and when) to call
+ * `loadAgentsFromMarkdown` to activate them.
+ *
+ * Validation semantics match `loadAgentsFromMarkdown` exactly so
+ * that `discoverMarkdownAgents` + `loadAgentsFromMarkdown` agree on
+ * which files are well-formed:
+ *   - Missing/empty `description` → reported in `failed`
+ *   - Empty body → reported in `failed`
+ *   - No frontmatter / missing `name` → silently skipped (treated
+ *     as reference doc, claudecode parity)
+ *   - I/O error on a single file → reported in `failed`
+ *
+ * Precedence: project entries shadow user entries of the same name
+ * (last-write-wins via `Map.set`), matching the loader's effective
+ * activation order. Consumers wanting to see shadowed user entries
+ * should run a separate pass with `cwd` pointing at a non-existent
+ * dir — feature not added by default per YAGNI.
+ *
+ * Does NOT validate against admission invariants — discovered
+ * agents may still be rejected when `loadAgentsFromMarkdown` runs
+ * (e.g. unknown tool refs). Validation happens at load time.
+ */
+declare function discoverMarkdownAgents(opts?: LoadAgentsFromMarkdownOptions): Promise<DiscoverMarkdownAgentsResult>;
+
 /**
  * CtxProxy — runtime gate for constructed tool handlers.
  *
@@ -4545,5 +4496,5 @@ declare function readWindowFromEnv(): number | undefined;
  */
 declare function speculativeRace<T>(promise: Promise<T>, windowMs?: number): Promise<SpeculativeResult<T>>;
 
-export { Agent, AgentMessage, AutoRules, CANCELLED_TOOL_RESULT_MESSAGE, CANCELLED_TOOL_RESULT_PREFIX, CODING_AGENTS, CODING_AGENT_MARKER, CODING_INVARIANTS, CODING_SUMMARY_PROMPT, CODING_UPDATE_SUMMARY_PROMPT, CapabilityDeniedError, CapabilityKind, CapabilityProvider, CapabilityResult, KodaXClient as Client, CompactionContext, CompactionPolicy, ConstructionManifestError, DEFAULT_CODING_AGENT_NAME, DEFAULT_DANGEROUS_PATTERNS, DEFAULT_HANDLER_TIMEOUT_MS, DEFAULT_RESILIENCE_CONFIG, DEFAULT_SAFE_PATTERNS, DEFAULT_SELF_MODIFY_BUDGET, DEFAULT_WINDOW_MS as DEFAULT_SPECULATIVE_WINDOW_MS, DEFAULT_TOOL_OUTPUT_MAX_BYTES, DEFAULT_TOOL_OUTPUT_MAX_LINES, EMIT_CONTRACT_TOOL_NAME, EMIT_HANDOFF_TOOL_NAME, EMIT_SCOUT_VERDICT_TOOL_NAME, EMIT_VERDICT_TOOL_NAME, EVALUATOR_AGENT_NAME, ErrorCategory, FailureStage, GENERATOR_AGENT_NAME, KODAX_TOOLS, KodaXAmaControllerDecision, KodaXBaseProvider, KodaXChildContextBundle, KodaXClient, KodaXCompactMemorySeed, KodaXContentBlock, KodaXContextOptions, KodaXEvents, KodaXExecutionMode, KodaXExtensionRuntime, KodaXExtensionSessionRecord, KodaXFanoutBranchRecord, KodaXFanoutBranchTransition, KodaXFanoutSchedulerInput, KodaXFanoutSchedulerPlan, KodaXInputArtifact, KodaXJsonValue, KodaXMessage, KodaXOptions, KodaXParentReductionContract, KodaXProviderCapabilityProfile, KodaXProviderPolicyHints, KodaXReasoningCapability, KodaXReasoningMode, KodaXRepoIntelligenceCapability, KodaXRepoIntelligenceMode, KodaXRepoIntelligenceResolvedMode, KodaXRepoIntelligenceTrace, KodaXRepoRoutingSignals, KodaXResult, KodaXSessionArtifactLedgerEntry, KodaXSessionEntry, KodaXSessionError, KodaXSessionLabelEntry, KodaXSessionLineage, KodaXSessionNavigationOptions, KodaXSessionTreeNode, KodaXTaskRoutingDecision, KodaXTaskType, KodaXTerminalError, KodaXThinkingDepth, KodaXToolDefinition, KodaXToolError, KodaXToolExecutionContext, KodaXToolUseBlock, LINEAGE_ENTRY_TYPES, LineageCompaction, LineageExtension, McpCapabilityProvider, McpServerConfig, McpServerRuntime, McpServersConfig, PLANNER_AGENT_NAME, PROMPT_SECTION_REGISTRY, PROTOCOL_EMITTER_TOOLS, ProviderExecutionState, ProviderRecoveryCoordinator, ProviderResilienceConfig, ProviderResiliencePolicy, READ_DEFAULT_LIMIT, READ_MAX_LINE_CHARS, READ_PREFLIGHT_SIZE_BYTES, REPOINTEL_DEFAULT_ENDPOINT, RecoveryDecision, RecoveryResult, ResilienceClassification, SCOUT_AGENT_NAME, SYSTEM_PROMPT, Session, SessionEntry, SessionErrorMetadata, SessionExtension, SignalCollector, StableBoundaryTracker, TASK_ENGINE_ROLE_AGENTS, TOOL_RESULT_TRUNCATION_GUARDRAIL_NAME, ToolCallSignal, _resetRuntimeForTesting, activate, analyzeChangedScope, appendAuditEntry, appendSessionLineageLabel, applyFanoutBranchTransition, applySessionCompaction, applyToolResultGuardrail, archiveOldIslands, assignFanoutBranchWorker, bashSignalCollector, boundedRevise, budgetCeiling, buildAmaControllerDecision, buildCapabilityContextSections, buildClassifierPrompt, buildFallbackRoutingDecision, buildFanoutSchedulerPlan, buildLlmReviewPrompt, buildPromptMessageContent, buildPromptOverlay, buildPromptSnapshot, buildProviderCapabilitySnapshot, buildProviderPolicyHintsForDecision, buildProviderPolicyPromptNotes, buildRepoIntelligenceContext, buildRepoIntelligenceIndex, buildRepoOverview, buildSessionTree, buildSystemPrompt, buildSystemPromptSnapshot, checkAbsoluteDeny, checkIncompleteToolCalls, checkPromiseSignal, classify, classifyBashCommand, classifyError, classifyResilienceError, computeInputSignature, configureRuntime, convertCapabilityReadResult, convertProviderSearchResults, countActiveFanoutBranches, countActiveLineageMessages, createBashClassifierConfig, createBuiltinToolDefinition, createCtxProxy, createDefaultCodingAgent, createDenialTracker, createExtensionRuntime, createFanoutSchedulerInput, createKodaXTaskRunner, createMcpCapabilityId, createMcpTransport, createPromptSection, createReasoningPlan, createSessionLineage, createToolResultTruncationGuardrail, defaultMcpCacheDir, defaultPolicy, disableSelfModify, drainPendingSwaps, emitContract, emitHandoff, emitScoutVerdict, emitVerdict, evaluateProviderPolicy, evaluatorAgent, evaluatorCodingAgent, exec, executeTool, extractArtifactLedger, extractComparableUserMessageText, extractHtmlTitle, extractPromptComparableText, extractTitleFromMessages, fileSignalCollector, finalizeRetrievalResult, findByVersion, findPreviousUserEntryId, forkSessionLineage, formatParallelDispatchResult, formatSize, generateSessionId, generatorAgent, generatorCodingAgent, getActiveExtensionRuntime, getBuiltinRegisteredToolDefinition, getBuiltinToolDefinition, getDenialContext, getFanoutBranch, getImpactEstimate, getMcpCachePaths, getModuleContext, getProcessContext, getRegisteredToolDefinition, getRepoIntelligenceIndex, getRepoOverview, getRepoRoutingSignals, getRequiredToolParams, getSessionLineagePath, getSessionMessagesFromLineage, getSymbolContext, getTool, getToolDefinition, getToolRegistrations, getToolResultPolicy, hasPendingSwap, independentReview, inferTaskType, inspectEditFailure, inspectRepoIntelligenceRuntime, isDeniedRecently, isParallelDispatchDirective, listAll, list as listArtifacts, listBuiltinToolDefinitions, listConstructed, listToolDefinitions, listTools, loadHandler, markFanoutBranchCancelled, markFanoutBranchCompleted, mergeArtifactLedger, orderPromptSections, parseClassifierOutput, parseEditToolError, parseLlmReviewVerdict, parseMcpCapabilityId, parseModelSpec, persistToolOutput, plannerAgent, plannerCodingAgent, prewarmRepoIntelligenceCaches, readArtifact, readAuditEntries, readBudget, readDisableState, readWindowFromEnv as readSpeculativeWindowFromEnv, reasoningModeToDepth, reconstructMessagesWithToolGuard, recordDenial, registerCodingInvariants, registerConfiguredMcpCapabilityProvider, registerOfficialSandboxExtension, registerTool, rehydrateActiveArtifacts, remaining as remainingSelfModifyBudget, renderChangedScope, renderImpactEstimate, renderModuleContext, renderProcessContext, renderPromptSections, renderRepoOverview, renderRetrievalResult, renderSymbolContext, resetBudget, resolveClassifierModel, resolveConstructedAgent, resolveReasoningMode, resolveRepoIntelligenceMode, resolveRepoIntelligenceRuntimeConfig, resolveResilienceConfig, resolveSessionLineageTarget, resolveToolCapability, revoke, rewindSessionLineage, rollbackSelfModify, runAstRules, runKodaX, runLlmReview, runManagedTask, runOrchestration, scoutAgent, scoutCodingAgent, searchMcpCatalog, setActiveExtensionRuntime, setSessionLineageActiveEntry, speculativeRace, stage, stripAssistantText, stripHtmlToText, test as testArtifact, toolAskUserQuestion, toolBash, toolChangedDiff, toolChangedScope, toolCodeSearch, toolEdit, toolGlob, toolGrep, toolImpactEstimate, toolInsertAfterAnchor, toolModuleContext, toolPermission, toolProcessContext, toolRead, toolRepoOverview, toolSemanticLookup, toolSymbolContext, toolUndo, toolWebFetch, toolWebSearch, toolWrite, truncateHead, truncateLine, truncateTail, validateSubtaskIndependence, validateToolSchemaForProvider, warmRepoIntelligenceRuntime, webhook };
-export type { AbsoluteDenyMatch, AbsoluteDenyMiss, AbsoluteDenyResult, AgentArtifact, ArtifactStatus, AstCheckResult, AstRuleId, AstRuleViolation, AuditEntry, AuditEventKind, BashClassificationResult, BashClassifierConfig, BashRiskLevel, BudgetState, BuildClassifierPromptInput, BuildPromptInput, Capabilities, ChangedFileEntry, ChangedFileStatus, ChangedScopeAreaSummary, ChangedScopeReport, ClassifierDecision, ClassifierPrompt, ClassifyDecision, ClassifyOptions, ConstructionArtifact, ConstructionPolicy, ConstructionPolicyVerdict, CreateCtxProxyOptions, CreateKodaXTaskRunnerOptions, DenialRecord, DenialTracker, DisableState, EditRecoveryDiagnostic, EditToolErrorCode, ErrorClassification, ExecOptions, ExecResult, ExtensionCommandContext, ExtensionCommandDefinition, ExtensionCommandInvocation, ExtensionCommandResult, ExtensionContributionSource, ExtensionEventMap, ExtensionFailureDiagnostic, ExtensionFailureStage, ExtensionHookMap, ExtensionLoadSource, ExtensionLogger, ExtensionRuntimeController, ExtensionRuntimeDiagnostics, ExtensionToolBeforeHookContext, ImpactEstimateResult, KodaXAgentWorkerSpec, KodaXExtensionAPI, KodaXExtensionActivationResult, KodaXExtensionModule, KodaXPromptSection, KodaXPromptSectionDefinition, KodaXPromptSectionSlot, KodaXPromptSectionStability, KodaXPromptSnapshot, KodaXPromptSnapshotMetadata, KodaXProviderCapabilitySnapshot, KodaXProviderPolicyDecision, KodaXProviderPolicyIssue, KodaXProviderPolicyIssueSeverity, KodaXProviderSourceKind, KodaXRetrievalArtifact, KodaXRetrievalFreshness, KodaXRetrievalItem, KodaXRetrievalResult, KodaXRetrievalScope, KodaXRetrievalToolName, KodaXRetrievalTrust, LanguageCapabilityTier, LineageArtifactLedgerPayload, LineageCompactionDelegates, LineageEntryType, LineageLabelPayload, LineageTreeNode, LlmReviewClient, LlmReviewResult, LlmReviewVerdict, LoadHandlerOptions, LoadHandlerScope, LoadedExtensionDiagnostic, LocalToolDefinition, McpCapabilityDescriptor, McpCapabilityKind, McpCapabilityRisk, McpCatalogItem, McpProviderOptions, McpServerCatalogSnapshot, McpServerRuntimeDiagnostics, McpTransport, McpTransportEvents, ModelProviderRegistration, ModuleCapsule, ModuleContextResult, OfficialSandboxMode, OfficialSandboxOptions, OrchestrationArtifact, OrchestrationCompletedTask, OrchestrationRunEvents, OrchestrationRunOptions, OrchestrationRunResult, OrchestrationTaskBudget, OrchestrationTaskContext, OrchestrationTaskExecution, OrchestrationTaskStatus, OrchestrationTraceEvent, OrchestrationWorkerResult, OrchestrationWorkerRunner, OrchestrationWorkerSpec, ParallelDispatchDirective, ParallelDispatchResult, ParallelSubtask, ParsedModelSpec, ProcessCapsule, ProcessContextResult, ProcessStep, ProtocolEmitterMetadata, RegisteredCapabilityProviderDiagnostic, RegisteredCommandDiagnostic, RegisteredHookDiagnostic, RegisteredToolDefinition, RegisteredToolDiagnostic, RepoAreaKind, RepoAreaOverview, RepoIntelligenceIndex, RepoIntelligenceRuntimeInspection, RepoIntelligenceRuntimeWarmResult, RepoLanguageId, RepoLanguageSupport, RepoOverview, RepoSymbolKind, RepoSymbolRecord, RepoSymbolReference, ResolveClassifierModelOptions, ResolveSource, ResolvedClassifierModel, RollbackResult, SchemaProvider, SchemaValidationResult, ScriptSource, SelfModifyAskUser, SelfModifyAskUserInput, SelfModifyDiffSeverity, SelfModifyDiffSummary, SpeculativeResult, StagedHandle, StripOptions, SymbolContextResult, TestArtifactOptions, TestResult, TierZeroPatternId, ToolContent, ToolDefinitionSource, ToolHandler, ToolRegistrationOptions, ToolRegistry, WebhookOptions, WebhookResult };
+export { Agent, AgentMessage, AutoRules, CANCELLED_TOOL_RESULT_MESSAGE, CANCELLED_TOOL_RESULT_PREFIX, CODING_AGENT_MARKER, CODING_INVARIANTS, CODING_SUMMARY_PROMPT, CODING_UPDATE_SUMMARY_PROMPT, CapabilityDeniedError, CapabilityKind, CapabilityProvider, CapabilityResult, KodaXClient as Client, ConstructionManifestError, DEFAULT_CODING_AGENT_NAME, DEFAULT_DANGEROUS_PATTERNS, DEFAULT_HANDLER_TIMEOUT_MS, DEFAULT_RESILIENCE_CONFIG, DEFAULT_SAFE_PATTERNS, DEFAULT_SELF_MODIFY_BUDGET, DEFAULT_WINDOW_MS as DEFAULT_SPECULATIVE_WINDOW_MS, DEFAULT_TOOL_OUTPUT_MAX_BYTES, DEFAULT_TOOL_OUTPUT_MAX_LINES, EMIT_VERDICT_TOOL_NAME, ErrorCategory, FailureStage, GENERATOR_AGENT_NAME, KODAX_TOOLS, KodaXAmaControllerDecision, KodaXBaseProvider, KodaXChildContextBundle, KodaXClient, KodaXContentBlock, KodaXContextOptions, KodaXEvents, KodaXExecutionMode, KodaXExtensionRuntime, KodaXExtensionSessionRecord, KodaXFanoutBranchRecord, KodaXFanoutBranchTransition, KodaXFanoutSchedulerInput, KodaXFanoutSchedulerPlan, KodaXInputArtifact, KodaXJsonValue, KodaXMessage, KodaXOptions, KodaXParentReductionContract, KodaXProviderCapabilityProfile, KodaXProviderPolicyHints, KodaXReasoningCapability, KodaXReasoningMode, KodaXRepoIntelligenceCapability, KodaXRepoIntelligenceMode, KodaXRepoIntelligenceResolvedMode, KodaXRepoIntelligenceTrace, KodaXRepoRoutingSignals, KodaXResult, KodaXSessionControl, KodaXSessionError, KodaXSessionMutators, KodaXTaskRoutingDecision, KodaXTaskType, KodaXTerminalError, KodaXThinkingDepth, KodaXToolDefinition, KodaXToolError, KodaXToolExecutionContext, KodaXToolUseBlock, McpCapabilityProvider, McpProviderOptions, McpServersConfig, PLANNER_AGENT_NAME, PROMPT_SECTION_REGISTRY, PROTOCOL_EMITTER_TOOLS, ProviderExecutionState, ProviderRecoveryCoordinator, ProviderResilienceConfig, ProviderResiliencePolicy, READ_DEFAULT_LIMIT, READ_MAX_LINE_CHARS, READ_PREFLIGHT_SIZE_BYTES, REPOINTEL_DEFAULT_ENDPOINT, RecoveryDecision, RecoveryResult, ResilienceClassification, SCOUT_AGENT_NAME, SYSTEM_PROMPT, SessionErrorMetadata, SignalCollector, StableBoundaryTracker, TASK_ENGINE_ROLE_AGENTS, TOOL_RESULT_TRUNCATION_GUARDRAIL_NAME, ToolCallSignal, WORKER_AGENT_NAME, _resetRuntimeForTesting, activate, analyzeChangedScope, appendAuditEntry, applyFanoutBranchTransition, applyToolResultGuardrail, assignFanoutBranchWorker, bashSignalCollector, boundedRevise, budgetCeiling, buildAmaControllerDecision, buildCapabilityContextSections, buildClassifierPrompt, buildFallbackRoutingDecision, buildFanoutSchedulerPlan, buildLlmReviewPrompt, buildPromptMessageContent, buildPromptOverlay, buildPromptSnapshot, buildProviderCapabilitySnapshot, buildProviderPolicyHintsForDecision, buildProviderPolicyPromptNotes, buildRepoIntelligenceContext, buildRepoIntelligenceIndex, buildRepoOverview, buildSystemPrompt, buildSystemPromptSnapshot, checkAbsoluteDeny, checkIncompleteToolCalls, checkPromiseSignal, classify, classifyBashCommand, classifyError, classifyResilienceError, computeInputSignature, configureRuntime, convertCapabilityReadResult, convertProviderSearchResults, countActiveFanoutBranches, createBashClassifierConfig, createBuiltinToolDefinition, createCtxProxy, createDefaultCodingAgent, createDenialTracker, createExtensionRuntime, createFanoutSchedulerInput, createKodaXTaskRunner, createPromptSection, createReasoningPlan, createSessionControl, createToolResultTruncationGuardrail, defaultPolicy, disableSelfModify, discoverMarkdownAgents, drainPendingSwaps, emitVerdict, evaluateProviderPolicy, exec, executeTool, extractComparableUserMessageText, extractHtmlTitle, extractPromptComparableText, fileSignalCollector, finalizeRetrievalResult, findByVersion, formatParallelDispatchResult, formatSize, getActiveExtensionRuntime, getAllRegisteredTools, getBuiltinRegisteredToolDefinition, getBuiltinToolDefinition, getDenialContext, getFanoutBranch, getImpactEstimate, getModuleContext, getProcessContext, getRegisteredToolDefinition, getRepoIntelligenceIndex, getRepoOverview, getRepoRoutingSignals, getRequiredToolParams, getSymbolContext, getTool, getToolDefinition, getToolRegistrations, getToolResultPolicy, hasPendingSwap, inferTaskType, inspectEditFailure, inspectRepoIntelligenceRuntime, isDeniedRecently, isParallelDispatchDirective, isToolFileMutation, isToolMutation, isToolPlanModeAllowed, listAll, list as listArtifacts, listBuiltinToolDefinitions, listConstructed, listToolDefinitions, listTools, loadAgentsFromMarkdown, loadHandler, markFanoutBranchCancelled, markFanoutBranchCompleted, orderPromptSections, parseClassifierOutput, parseEditToolError, parseLlmReviewVerdict, parseModelSpec, persistToolOutput, prewarmRepoIntelligenceCaches, readArtifact, readAuditEntries, readBudget, readDisableState, readWindowFromEnv as readSpeculativeWindowFromEnv, reasoningModeToDepth, reconstructMessagesWithToolGuard, recordDenial, registerCodingInvariants, registerConfiguredMcpCapabilityProvider, registerOfficialSandboxExtension, registerTool, rehydrateActiveArtifacts, remaining as remainingSelfModifyBudget, renderChangedScope, renderImpactEstimate, renderModuleContext, renderProcessContext, renderPromptSections, renderRepoOverview, renderRetrievalResult, renderSymbolContext, resetBudget, resolveClassifierModel, resolveConstructedAgent, resolveReasoningMode, resolveRepoIntelligenceMode, resolveRepoIntelligenceRuntimeConfig, resolveResilienceConfig, resolveToolCapability, revoke, rollbackSelfModify, runAstRules, runKodaX, runLlmReview, runManagedTask, runOrchestration, setActiveExtensionRuntime, speculativeRace, stage, startKodaX, stripAssistantText, stripHtmlToText, test as testArtifact, toolAskUserQuestion, toolBash, toolChangedDiff, toolChangedScope, toolCodeSearch, toolEdit, toolGlob, toolGrep, toolImpactEstimate, toolInsertAfterAnchor, toolModuleContext, toolPermission, toolProcessContext, toolRead, toolRepoOverview, toolSemanticLookup, toolSymbolContext, toolUndo, toolWebFetch, toolWebSearch, toolWrite, truncateHead, truncateLine, truncateTail, validateSubtaskIndependence, validateToolSchemaForProvider, warmRepoIntelligenceRuntime, webhook, workerAgent };
+export type { AbsoluteDenyMatch, AbsoluteDenyMiss, AbsoluteDenyResult, AgentArtifact, ArtifactStatus, AstCheckResult, AstRuleId, AstRuleViolation, AuditEntry, AuditEventKind, BashClassificationResult, BashClassifierConfig, BashRiskLevel, BudgetState, BuildClassifierPromptInput, BuildPromptInput, Capabilities, ChangedFileEntry, ChangedFileStatus, ChangedScopeAreaSummary, ChangedScopeReport, ClassifierDecision, ClassifierPrompt, ClassifyDecision, ClassifyOptions, ConstructionArtifact, ConstructionPolicy, ConstructionPolicyVerdict, CreateCtxProxyOptions, CreateKodaXTaskRunnerOptions, DenialRecord, DenialTracker, DisableState, DiscoverMarkdownAgentsResult, DiscoveredMarkdownAgent, EditRecoveryDiagnostic, EditToolErrorCode, ErrorClassification, ExecOptions, ExecResult, ExtensionCommandContext, ExtensionCommandDefinition, ExtensionCommandInvocation, ExtensionCommandResult, ExtensionContributionSource, ExtensionEventMap, ExtensionFailureDiagnostic, ExtensionFailureStage, ExtensionHookMap, ExtensionLoadSource, ExtensionLogger, ExtensionRuntimeController, ExtensionRuntimeDiagnostics, ExtensionToolBeforeHookContext, ImpactEstimateResult, KodaXAgentWorkerSpec, KodaXExtensionAPI, KodaXExtensionActivationResult, KodaXExtensionModule, KodaXPromptSection, KodaXPromptSectionDefinition, KodaXPromptSectionSlot, KodaXPromptSectionStability, KodaXPromptSnapshot, KodaXPromptSnapshotMetadata, KodaXProviderCapabilitySnapshot, KodaXProviderPolicyDecision, KodaXProviderPolicyIssue, KodaXProviderPolicyIssueSeverity, KodaXProviderSourceKind, KodaXRetrievalArtifact, KodaXRetrievalFreshness, KodaXRetrievalItem, KodaXRetrievalResult, KodaXRetrievalScope, KodaXRetrievalToolName, KodaXRetrievalTrust, LanguageCapabilityTier, LlmReviewClient, LlmReviewResult, LlmReviewVerdict, LoadAgentsFromMarkdownOptions, LoadAgentsFromMarkdownResult, LoadHandlerOptions, LoadHandlerScope, LoadedExtensionDiagnostic, LocalToolDefinition, MarkdownLoadFailure, ModelProviderRegistration, ModuleCapsule, ModuleContextResult, OfficialSandboxMode, OfficialSandboxOptions, OrchestrationArtifact, OrchestrationCompletedTask, OrchestrationRunEvents, OrchestrationRunOptions, OrchestrationRunResult, OrchestrationTaskBudget, OrchestrationTaskContext, OrchestrationTaskExecution, OrchestrationTaskStatus, OrchestrationTraceEvent, OrchestrationWorkerResult, OrchestrationWorkerRunner, OrchestrationWorkerSpec, ParallelDispatchDirective, ParallelDispatchResult, ParallelSubtask, ParsedModelSpec, ProcessCapsule, ProcessContextResult, ProcessStep, ProtocolEmitterMetadata, RegisteredCapabilityProviderDiagnostic, RegisteredCommandDiagnostic, RegisteredHookDiagnostic, RegisteredToolDefinition, RegisteredToolDiagnostic, RepoAreaKind, RepoAreaOverview, RepoIntelligenceIndex, RepoIntelligenceRuntimeInspection, RepoIntelligenceRuntimeWarmResult, RepoLanguageId, RepoLanguageSupport, RepoOverview, RepoSymbolKind, RepoSymbolRecord, RepoSymbolReference, ResolveClassifierModelOptions, ResolveSource, ResolvedClassifierModel, RollbackResult, RunningSession, SchemaProvider, SchemaValidationResult, ScriptSource, SelfModifyAskUser, SelfModifyAskUserInput, SelfModifyDiffSeverity, SelfModifyDiffSummary, SpeculativeResult, StagedHandle, StripOptions, SymbolContextResult, TestArtifactOptions, TestResult, TierZeroPatternId, ToolContent, ToolDefinitionSource, ToolHandler, ToolRegistrationOptions, ToolRegistry, ToolSideEffect, WebhookOptions, WebhookResult };