@kodax-ai/kodax 0.7.69 → 0.7.70

package/dist/types-chunks/{bash-prefix-extractor.d-BkIA8Wto.d.ts → bash-prefix-extractor.d-h9AwGqmO.d.ts}

@@ -3,7 +3,7 @@ import { a0 as KodaXTokenUsage, k as KodaXMessage, a1 as KodaXToolDefinition, a9
 import { I as ISkillRegistry, d as SkillDynamicContextExecutor } from './types.d-vJExiRje.js';
 import { Diagnostic, Position, Location, Hover, DocumentSymbol, SymbolInformation, WorkspaceSymbol, CallHierarchyItem, CallHierarchyIncomingCall, CallHierarchyOutgoingCall } from 'vscode-languageserver-protocol';
 import { K as KodaXLlmTimeoutConfig, a as CostTracker } from './cost-tracker.d-BeaenODW.js';
-import { C as CapabilityKind, b as CapabilityResult } from './capability.d-3C62G8Eq.js';
+import { C as CapabilityKind, f as CapabilitySearchSnapshot, b as CapabilityResult } from './capability.d-K664nHOS.js';
 import { K as KodaXBaseProvider } from './base.d-CYjtB68X.js';
 
 /**
@@ -910,7 +910,7 @@ declare function buildGoalRuntimeBinding(deps: GoalRuntimeBindingDeps): GoalRunt
  * configure / install / troubleshoot KodaX?" questions. Pure data + a
  * deterministic resolver — no RAG, no vector store, no network fetch.
  */
-type KodaXManualTopicId = 'overview' | 'install' | 'quickstart' | 'providers' | 'custom-providers' | 'config' | 'permissions' | 'commands' | 'tools' | 'agents' | 'skills' | 'extensions' | 'mcp' | 'repo-intelligence' | 'sessions' | 'memory' | 'doctor' | 'sdk' | 'troubleshooting';
+type KodaXManualTopicId = 'overview' | 'license' | 'install' | 'quickstart' | 'providers' | 'custom-providers' | 'config' | 'permissions' | 'commands' | 'tools' | 'agents' | 'skills' | 'extensions' | 'mcp' | 'a2a' | 'repo-intelligence' | 'sessions' | 'memory' | 'doctor' | 'sdk' | 'troubleshooting';
 /** A pointer to the code/doc the topic is derived from (for traceability). */
 interface KodaXManualSource {
     readonly label: string;
@@ -1312,6 +1312,10 @@ interface CapabilityRuntimeContract {
         limit?: number;
         server?: string;
     }): Promise<unknown[]>;
+    searchCapabilitySnapshot?(providerId: string, query: string, options?: {
+        kind?: CapabilityKind;
+        server?: string;
+    }): Promise<CapabilitySearchSnapshot>;
     describeCapability(providerId: string, capabilityId: string): Promise<unknown>;
     executeCapability(providerId: string, capabilityId: string, input: Record<string, unknown>): Promise<CapabilityResult>;
     readCapability(providerId: string, capabilityId: string, options?: Record<string, unknown>): Promise<CapabilityResult>;
@@ -2593,6 +2597,8 @@ interface KodaXContextOptions {
      * and shell execution. Defaults to `gitRoot`, then `process.cwd()`.
      */
     executionCwd?: string;
+    /** Fail-closed host policy applied to every concrete file a read tool opens. */
+    assertReadablePath?: (candidate: string) => void;
     /**
      * Best-known token snapshot for the current conversation history.
      * When present, the core will prefer it over local estimation and rebase it as
@@ -3218,6 +3224,10 @@ interface KodaXToolExecutionContext {
     skillScriptRunner?: KodaXSkillScriptRunner;
     /** Working directory used to resolve relative paths and execute shell commands. */
     executionCwd?: string;
+    /** Fail-closed host policy applied to every concrete file a read tool opens. */
+    assertReadablePath?: (candidate: string) => void;
+    /** Host tool visibility ceiling inherited by child agents. */
+    toolVisibilityPolicy?: KodaXToolVisibilityPolicy;
     /** Maximum physical input capacity of the active model request. */
     maximumInputTokens?: number;
     /** Remaining capacity for the complete tool-result batch in this request. */

package/dist/types-chunks/{capability.d-3C62G8Eq.d.ts → capability.d-K664nHOS.d.ts}

@@ -10,6 +10,24 @@
  * because it is coupled to the coding CLI surface.
  */
 type CapabilityKind = 'tool' | 'resource' | 'prompt';
+interface CapabilitySearchOptions {
+    kind?: CapabilityKind;
+    limit?: number;
+    server?: string;
+}
+type CapabilitySearchFreshness = 'live' | 'cached' | 'stale' | 'mixed' | 'unknown';
+interface CapabilitySearchFailure {
+    source: string;
+    message: string;
+}
+/** Complete internal search view. Model-facing tools page this snapshot. */
+interface CapabilitySearchSnapshot {
+    items: unknown[];
+    revision?: string;
+    complete: boolean;
+    freshness: CapabilitySearchFreshness;
+    failures?: CapabilitySearchFailure[];
+}
 interface CapabilityResult {
     kind: CapabilityKind;
     content?: string;
@@ -21,11 +39,8 @@ interface CapabilityResult {
 interface CapabilityProvider {
     id: string;
     kinds: CapabilityKind[];
-    search?: (query: string, options?: {
-        kind?: CapabilityKind;
-        limit?: number;
-        server?: string;
-    }) => Promise<unknown[]>;
+    search?: (query: string, options?: CapabilitySearchOptions) => Promise<unknown[]>;
+    searchSnapshot?: (query: string, options?: Omit<CapabilitySearchOptions, 'limit'>) => Promise<CapabilitySearchSnapshot>;
     describe?: (id: string) => Promise<unknown>;
     execute?: (id: string, input: Record<string, unknown>) => Promise<CapabilityResult>;
     read?: (id: string, options?: Record<string, unknown>) => Promise<CapabilityResult>;
@@ -36,4 +51,4 @@ interface CapabilityProvider {
     dispose?: () => Promise<void>;
 }
 
-export type { CapabilityKind as C, CapabilityProvider as a, CapabilityResult as b };
+export type { CapabilityKind as C, CapabilityProvider as a, CapabilityResult as b, CapabilitySearchFailure as c, CapabilitySearchFreshness as d, CapabilitySearchOptions as e, CapabilitySearchSnapshot as f };

package/dist/types-chunks/{commands.d-DkPfcQWG.d.ts → commands.d-DxiVanpI.d.ts}

@@ -1,6 +1,6 @@
-import { h as SessionStorage$1, f as PermissionMode } from './public-api.d-7G4--RZE.js';
-import { Y as KodaXOptions, a6 as KodaXResult } from './bash-prefix-extractor.d-BkIA8Wto.js';
-import { n as RuntimeSurfaceStatus, b as CommandDefinition, e as CommandSource, c as CommandInfo, C as Command$1, I as InteractiveContext, a as CommandCallbacks, g as CurrentConfig, d as CommandInvocationRequest, f as CommandWorkflowInvocationRequest } from './utils.d-BbB5jzi1.js';
+import { h as SessionStorage$1, f as PermissionMode } from './public-api.d-BqFKI5fK.js';
+import { Y as KodaXOptions, a6 as KodaXResult } from './bash-prefix-extractor.d-h9AwGqmO.js';
+import { n as RuntimeSurfaceStatus, b as CommandDefinition, e as CommandSource, c as CommandInfo, C as Command$1, I as InteractiveContext, a as CommandCallbacks, g as CurrentConfig, d as CommandInvocationRequest, f as CommandWorkflowInvocationRequest } from './utils.d-B4zc7oot.js';
 import { be as KodaXSessionStorage, b0 as KodaXSessionData } from './types.d-BtC4yLYO.js';
 
 /**

package/dist/types-chunks/{manager.d-CoEuPRAo.d.ts → manager.d-B67TmPO1.d.ts}

@@ -1,4 +1,4 @@
-import { a as CapabilityProvider, C as CapabilityKind, b as CapabilityResult } from './capability.d-3C62G8Eq.js';
+import { a as CapabilityProvider, C as CapabilityKind, f as CapabilitySearchSnapshot, b as CapabilityResult } from './capability.d-K664nHOS.js';
 import { a as McpServerConfig, b as McpServersConfig, M as McpConnectMode } from './config.d-CJy1WENT.js';
 
 type McpCapabilityKind = 'tool' | 'resource' | 'prompt';
@@ -180,6 +180,12 @@ interface McpServerRuntimeDiagnostics {
     resources: number;
     prompts: number;
 }
+interface McpDiscoveryCatalog {
+    snapshot: McpServerCatalogSnapshot;
+    freshness: 'live' | 'stale';
+    complete: boolean;
+    error?: string;
+}
 declare class McpServerRuntime {
     private readonly serverId;
     private readonly config;
@@ -195,7 +201,10 @@ declare class McpServerRuntime {
     private readonly completedElicitations;
     private nextRequestId;
     private initialized;
+    private liveCatalogValidated;
+    private catalogInvalidationVersion;
     private connectPromise?;
+    private discoveryPromise?;
     private catalog?;
     private serverCapabilities?;
     private cachedHttpTransport?;
@@ -208,6 +217,9 @@ declare class McpServerRuntime {
     /** Load catalog from memory or disk only — never triggers a lazy connection. */
     getCachedCatalog(): Promise<McpServerCatalogSnapshot | undefined>;
     getCatalog(forceRefresh?: boolean): Promise<McpServerCatalogSnapshot>;
+    /** Validate cached capability truth on first model-facing discovery use. */
+    getDiscoveryCatalog(): Promise<McpDiscoveryCatalog>;
+    private resolveDiscoveryCatalog;
     describeCapability(capabilityId: string): Promise<McpCapabilityDescriptor | undefined>;
     callTool(name: string, args: Record<string, unknown>): Promise<{
         content?: string;
@@ -272,6 +284,7 @@ declare class McpServerRuntime {
     private dispatchServerRequest;
     private failPending;
     private applyCatalogSnapshot;
+    private emptyCatalog;
 }
 
 /**
@@ -338,15 +351,26 @@ declare class McpCapabilityProvider implements CapabilityProvider {
         limit?: number;
         server?: string;
     }): Promise<unknown[]>;
+    searchSnapshot(query: string, options?: {
+        kind?: CapabilityKind;
+        server?: string;
+    }): Promise<CapabilitySearchSnapshot>;
     describe(id: string): Promise<unknown>;
     execute(id: string, input: Record<string, unknown>): Promise<CapabilityResult>;
     read(id: string, options?: Record<string, unknown>): Promise<CapabilityResult>;
     getPrompt(id: string, args?: Record<string, unknown>): Promise<unknown>;
     getPromptContext(): Promise<string | undefined>;
+    private formatPromptContext;
+    private formatExactIdPrompt;
+    private formatCompleteNamePrompt;
     getDiagnostics(): Record<string, unknown> | undefined;
     refresh(): Promise<void>;
     dispose(): Promise<void>;
     private collectCatalogItems;
+    private collectDiscoveryCatalog;
+    private formatPromptServerLine;
+    private formatPromptNameLines;
+    private formatFleetSummary;
     private listServerDiagnostics;
     private requireRuntime;
 }
@@ -530,5 +554,5 @@ declare class McpManager {
  */
 declare function createMcpManager(servers: McpServersConfig | undefined, options?: McpProviderOptions): McpManager;
 
-export { normalizeMcpCapabilityId as A, parseMcpCapabilityId as B, searchMcpCatalog as C, McpCapabilityProvider as b, McpManager as h, McpServerRuntime as q, buildInitializeCapabilities as v, createMcpCapabilityId as w, createMcpManager as x, defaultMcpCacheDir as y, getMcpCachePaths as z };
-export type { McpCapabilityDescriptor as M, McpCapabilityKind as a, McpCapabilityRisk as c, McpCatalogItem as d, McpElicitRequest as e, McpElicitResult as f, McpIcon as g, McpProviderOptions as i, McpReverseCapabilities as j, McpRoot as k, McpSamplingRequest as l, McpSamplingResult as m, McpServerCatalog as n, McpServerCatalogSnapshot as o, McpServerLogs as p, McpServerRuntimeDiagnostics as r, McpServerStatus as s, McpServerToolList as t, McpToolTaskSupport as u };
+export { getMcpCachePaths as A, normalizeMcpCapabilityId as B, parseMcpCapabilityId as C, searchMcpCatalog as D, McpCapabilityProvider as b, McpManager as i, McpServerRuntime as r, buildInitializeCapabilities as w, createMcpCapabilityId as x, createMcpManager as y, defaultMcpCacheDir as z };
+export type { McpCapabilityDescriptor as M, McpCapabilityKind as a, McpCapabilityRisk as c, McpCatalogItem as d, McpDiscoveryCatalog as e, McpElicitRequest as f, McpElicitResult as g, McpIcon as h, McpProviderOptions as j, McpReverseCapabilities as k, McpRoot as l, McpSamplingRequest as m, McpSamplingResult as n, McpServerCatalog as o, McpServerCatalogSnapshot as p, McpServerLogs as q, McpServerRuntimeDiagnostics as s, McpServerStatus as t, McpServerToolList as u, McpToolTaskSupport as v };

package/dist/types-chunks/{public-api.d-7G4--RZE.d.ts → public-api.d-BqFKI5fK.d.ts}

@@ -1,4 +1,4 @@
-import { a as BashPrefixExtractor } from './bash-prefix-extractor.d-BkIA8Wto.js';
+import { a as BashPrefixExtractor } from './bash-prefix-extractor.d-h9AwGqmO.js';
 import { b0 as KodaXSessionData, b5 as KodaXSessionLineage, ba as KodaXSessionNavigationOptions, bc as KodaXSessionRuntimeInfo, be as KodaXSessionStorage, aT as KodaXJsonValue } from './types.d-BtC4yLYO.js';
 import { k as KodaXMessage, S as KodaXTaskResultMetadata } from './types.d-TTvpAGWf.js';
 

package/dist/types-chunks/{sdk-session-BQccrODn.d.ts → sdk-session-tcoxrMHQ.d.ts}

@@ -1,6 +1,6 @@
-import { f as PermissionMode } from './public-api.d-7G4--RZE.js';
+import { f as PermissionMode } from './public-api.d-BqFKI5fK.js';
 import { F as KodaXReasoningMode, k as KodaXMessage, c as KodaXContentBlock } from './types.d-TTvpAGWf.js';
-import { r as KodaXAgentMode } from './bash-prefix-extractor.d-BkIA8Wto.js';
+import { r as KodaXAgentMode } from './bash-prefix-extractor.d-h9AwGqmO.js';
 import { bg as KodaXSessionUiHistoryItem, bk as KodaXSessionUiToolCall } from './types.d-BtC4yLYO.js';
 
 /**

package/dist/types-chunks/{types.d-C9YHEAmA.d.ts → types.d-DZaYznxo.d.ts}

@@ -1,8 +1,8 @@
 import { a9 as KodaXWireReasoningEffort, a1 as KodaXToolDefinition, a3 as KodaXToolResultContentItem, k as KodaXMessage } from './types.d-TTvpAGWf.js';
 import { K as KodaXBaseProvider } from './base.d-CYjtB68X.js';
-import { C as CapabilityKind, a as CapabilityProvider } from './capability.d-3C62G8Eq.js';
+import { C as CapabilityKind, a as CapabilityProvider } from './capability.d-K664nHOS.js';
 import { aT as KodaXJsonValue, aH as KodaXExtensionSessionRecord, aJ as KodaXExtensionStore } from './types.d-BtC4yLYO.js';
-import { aB as KodaXToolExecutionContext, bi as ToolSideEffect } from './bash-prefix-extractor.d-BkIA8Wto.js';
+import { aB as KodaXToolExecutionContext, bi as ToolSideEffect } from './bash-prefix-extractor.d-h9AwGqmO.js';
 
 /**
  * KodaX Constructed-World types (FEATURE_087, v0.7.28).

package/dist/types-chunks/{utils.d-BbB5jzi1.d.ts → utils.d-B4zc7oot.d.ts}

@@ -1,9 +1,9 @@
 import { k as KodaXMessage, F as KodaXReasoningMode, d as KodaXCustomProviderConfig, p as KodaXProviderCapabilityProfile } from './types.d-TTvpAGWf.js';
-import { I as KodaXContextTokenSnapshot, ae as KodaXSkillDynamicContextPolicy, r as KodaXAgentMode, a1 as KodaXRepoIntelligenceMode, Y as KodaXOptions, af as KodaXSkillInvocationContext } from './bash-prefix-extractor.d-BkIA8Wto.js';
+import { I as KodaXContextTokenSnapshot, ae as KodaXSkillDynamicContextPolicy, r as KodaXAgentMode, a1 as KodaXRepoIntelligenceMode, Y as KodaXOptions, af as KodaXSkillInvocationContext } from './bash-prefix-extractor.d-h9AwGqmO.js';
 import { bg as KodaXSessionUiHistoryItem, b5 as KodaXSessionLineage, aY as KodaXSessionArtifactLedgerEntry, aI as KodaXExtensionSessionState, aH as KodaXExtensionSessionRecord, bc as KodaXSessionRuntimeInfo, du as WorkflowProcessSource } from './types.d-BtC4yLYO.js';
 import { A as AgentsFile, f as AutoModeStats, l as KodaXMcpServersConfig } from './guardrail.d-R7AiGfrI.js';
 import * as readline from 'readline';
-import { f as PermissionMode } from './public-api.d-7G4--RZE.js';
+import { f as PermissionMode } from './public-api.d-BqFKI5fK.js';
 import { SpawnSyncReturns } from 'child_process';
 
 /**

package/docs/SDK_EMBEDDER_GUIDE.md

@@ -3208,6 +3208,12 @@ time/body/redirects, and strips authorization on a cross-origin redirect. A
 custom `fetch` option is a trusted transport override: the embedder then owns
 equivalent DNS-to-connection binding in that transport or proxy.
 
+Starting in v0.7.70, the interface selected from the Agent Card must remain on
+the Card's trusted origin. A configured `credentialRef` is used only when the
+Card advertises the A2A 1.0 Bearer security scheme; discovery fails closed
+rather than sending a secret to an unadvertised or differently secured
+endpoint.
+
 ```ts
 import {
   createA2AAgentExecutorFactory,
@@ -3264,6 +3270,12 @@ The executor supports durable task start/get, input continuation, cancel,
 reconcile, SSE events, and polling fallback. An ambiguous start is not retried
 automatically. A `credentialRef` is resolved just in time by the F258 broker;
 the registration, task store, and diagnostics never contain the credential.
+Authenticated SSE uses that same broker. JSON-RPC ID/version and task/context
+correlation are validated before an event is accepted; if a stream ends
+normally before a terminal snapshot, the executor resumes bounded polling.
+Streamed `artifactUpdate` chunks are accumulated by artifact ID according to
+`append`, and direct Message file Parts are preserved as authorized artifact
+references.
 
 ### Built-in configured path (no host code)
 
@@ -3293,6 +3305,12 @@ kodax a2a expose document-agent     # ~/.kodax/agents/document-agent.md
 kodax a2a serve --port 8765
 ```
 
+`a2a serve` resolves its Runtime provider in this order: explicit CLI option,
+environment, core configuration, then the built-in default. Provider-compatible
+model selection follows the normal hosted Runtime rule. A selected Markdown
+Agent may declare its own validated `provider`; remote A2A input cannot choose
+or override provider, model, reasoning, profile, workspace, or tools.
+
 `expose` validates a named user Markdown Agent before writing its reference.
 `serve` loads configured MCP and Extensions before it resolves the execution
 binding or opens a socket. Native workspace read tools are admitted by
@@ -3309,6 +3327,10 @@ require an explicit restart. Managed contexts live below
 `process: isolated`, an admitted `scripts/...` path, and a passing
 `kodax sandbox doctor`; KodaX never falls back to an unsandboxed shell.
 
+Every concrete file reached by `read`, `grep`, or `glob` is checked against the
+bound workspace. Child runs inherit ceilings for native reads, tools, Skills,
+and Skill scripts; they cannot expand the parent's admitted authority.
+
 ### Publish one KodaX Agent
 
 Publication is host-owned and opt-in. The public card describes only the
@@ -3375,12 +3397,28 @@ default). When that bound is reached the response contains the current working
 task; it does not cancel the Runtime run, and clients can continue with
 `GetTask` or `SubscribeToTask`.
 
+When a task enters `INPUT_REQUIRED`, the next accepted input answers the pending
+interaction on the original Runtime run; it does not start a replacement run.
+History length and list filters are validated and bounded. Task listing uses a
+stable opaque cursor, while per-principal retention prunes only the oldest
+terminal records. Terminal subscriptions and failed-start resources are closed
+by their owning lifecycle.
+
 Remote messages are ordinary user inputs. They cannot select provider, model,
 profile, tools, working directory, permission mode, or Runtime configuration.
 URL parts are rejected; inline raw/data parts are bounded and materialized under
 the server-owned data directory. Responses expose final approved output only,
 not system prompts, reasoning deltas, tool payloads, credentials, or local paths.
 
+Generated files are published only through the trusted output broker: a normal
+tool or Extension stages a file in the context's `.kodax-a2a-staging` area, or
+a successfully admitted `run_skill_script` promotes one of its declared
+outputs. The server rechecks that the result is a regular non-symlink file in
+the real bound workspace and applies part-size/output-mode limits before
+inlining it. A declaration from a failed Skill run, an ordinary `write`/`edit`
+elsewhere in the workspace, and a local path in model text never become A2A
+artifacts implicitly.
+
 The normative baseline is A2A repository commit
 `2183794bfb9b67af4aee1be0a0ef726050642873`, protocol `1.0`, with
 `specification/a2a.proto` SHA-256
@@ -3445,6 +3483,7 @@ const runtime = await connectKodaXRuntime({
     daemonSafeRunInput: 1,
     sharedSessionSettings: 1,
     durableRecoveryQueries: 1,
+    daemonManagement: 1,
   },
 });
 ```
@@ -3532,10 +3571,13 @@ reset boundary.
 
 ### Durable mutations, stable ordering, and settings CAS
 
-Every public control mutation uses a durable operation envelope. Credential
-supply and Host Tool completion are connection-local reverse-result frames and
-are deliberately excluded from the control journal so secrets/results are not
-persisted. The SDK creates an operation ID for ordinary one-shot calls. A
+Every durable public control mutation uses an operation envelope. Credential
+and Host Tool register/revoke/supply/complete requests are reverse-bridge
+control frames and are deliberately excluded from the control journal so
+secrets/results are not persisted. They still enter the daemon management
+draining fence: once an atomic stop begins, they fail with typed `conflict` and
+cannot change reverse-bridge state. The SDK creates an operation ID for
+ordinary one-shot calls. A
 product-level retry after a lost response must reuse its own stable operation
 ID; changing its method, payload, resource, or authenticated principal is
 rejected.
@@ -3743,10 +3785,24 @@ remain valid only for embedded Runtime calls.
 
 ### Recovery queries and stop preflight
 
-`runtime.status.preflight()` returns connected-client count, active and queued
-runs, pending AskUser/permission records, blockers, and `canStop`. Treat this as
-a required check before stop or inline rollback; the query does not stop the
-daemon by itself. `runtime.operations.get()` reconciles durable mutations,
+`runtime.status.preflight()` returns the initialized logical-client count,
+active and queued runs, running/paused Workflows, every non-terminal External
+Agent task (including `unknown`), pending AskUser/permission records, blockers,
+and `canStop`. The background-work blockers are `active_workflows` and
+`active_agent_tasks`. The current facade counts as one; daemon self-connections
+and bounded health probes do not count. A second process changes the count to
+two, and its awaited `close()` makes the count converge back to one.
+
+Preflight is useful for UI, but it is not a stop authorization token. Use
+`runtime.daemon.inspect()` to obtain one consistent management revision,
+verified owner fence, owner-policy revision, and preflight projection. Only
+`runtime.daemon.stopForInline()` atomically rechecks and commits a rollback.
+The management revision also advances when the preflight projection changes,
+so a Workflow or AgentTask lifecycle transition between inspect and commit
+invalidates the stale stop. Capability details
+`daemonManagement.backgroundWorkPreflight` and
+`daemonManagement.reverseBridgeDrainingFence` identify this complete contract.
+`runtime.operations.get()` reconciles durable mutations,
 `hostTools.getInvocation()` reconciles Host Tool metadata, and
 `permissions.listGrants()` returns the daemon-owned persistent grant set.
 
@@ -3758,27 +3814,64 @@ truth.
 
 ### Owner policy, rollback, and Electron boundary
 
-Daemon and inline Coder use one profile fence. For an emergency rollback, stop
-the daemon, switch the policy with revision CAS, then acquire the inline owner:
+Daemon and inline Coder use one profile fence. Do not compose
+`status.preflight()` with a low-level unconditional stop: another client or run
+can appear between those calls. The public rollback transaction gates new
+clients and mutations, rechecks the same Runtime and management/policy
+revisions, verifies there is no other client or active/queued/pending work,
+commits sticky inline policy while that daemon still owns the fence, and then
+requests shutdown.
 
 ```ts
 import {
   acquireKodaXInlineOwner,
-  setKodaXRuntimeOwnerMode,
+  enableKodaXDaemonOwner,
+  getKodaXRuntimeOwnerState,
 } from '@kodax-ai/kodax/runtime';
 
-const policy = setKodaXRuntimeOwnerMode({
-  homeDir: kodaxHome,
-  profile: 'coder',
-  mode: 'inline',
-  expectedRevision: currentPolicyRevision,
+const management = await runtime.daemon.inspect();
+if (!management.preflight.canStop) {
+  showRollbackBlockers(management.preflight.blockers);
+  return;
+}
+
+const rollback = await runtime.daemon.stopForInline({
+  expectedRuntimeId: management.runtimeId,
+  expectedRevision: management.revision,
+  expectedOwnerPolicyRevision: management.ownerPolicy.revision,
+  operation: { operationId: loadOrCreatePendingOperationId('coder-inline-rollback') },
 });
+
+// `accepted` means inline policy is committed and shutdown is in progress.
+// Wait through the public owner-state query; never infer release from a PID.
+const shutdownDeadline = Date.now() + 30_000;
+while (getKodaXRuntimeOwnerState({ homeDir: kodaxHome, profile: 'coder' }).owner?.runtimeId
+  === rollback.runtimeId) {
+  if (Date.now() >= shutdownDeadline) throw new Error('Timed out waiting for daemon owner release.');
+  await delay(25);
+}
+const releasedOwner = getKodaXRuntimeOwnerState({ homeDir: kodaxHome, profile: 'coder' });
+if (releasedOwner.ownerStatus !== 'unowned') {
+  throw new Error('Coder profile acquired a different owner during rollback.');
+}
+await runtime.close(); // Detach only; it does not perform a second stop.
 const inlineOwner = acquireKodaXInlineOwner({ homeDir: kodaxHome, profile: 'coder' });
+
+// Later, after the inline owner has released its fence:
+inlineOwner.close();
+const daemonPolicy = enableKodaXDaemonOwner({ homeDir: kodaxHome, profile: 'coder' });
+// daemonPolicy.revision is authoritative; no expectedRevision guess is needed.
 ```
 
-The inline policy is sticky: later CLI auto-start is rejected until an explicit
-CAS changes the policy back to `daemon`. Stale-owner handling validates the
-owned lock/state and never kills a process merely because a PID was reused.
+Any management revision change, another logical client, active or queued run,
+running/paused Workflow, non-terminal/unknown AgentTask, pending
+AskUser/permission, or in-flight mutation returns structured `conflict`; the
+daemon remains running and policy remains unchanged. Draining also rejects
+credential and Host Tool state changes without journaling their secrets or
+results. The inline policy is sticky: later CLI auto-start is rejected until
+`enableKodaXDaemonOwner()` changes it back to `daemon`. `runtime.close()` still
+only detaches. Stale-owner handling validates the owned lock/state and never
+kills a process merely because a PID was reused.
 
 Keep all trusted objects in Electron Main: daemon token/endpoint, stable client
 identity, operation IDs, owner policy, keychain broker, Host Tool handlers, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kodax-ai/kodax",
-  "version": "0.7.69",
+  "version": "0.7.70",
   "description": "KodaX lightweight coding agent - TypeScript implementation with 15 built-in LLM provider aliases, published as a Node-free single-file CLI and SDK",
   "type": "module",
   "private": false,
@@ -100,7 +100,7 @@
     "cli"
   ],
   "author": "",
-  "license": "Apache-2.0",
+  "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
     "@agentclientprotocol/sdk": "^0.15.0",
     "@alcalzone/ansi-tokenize": "^0.2.5",

package/dist/chunks/argument-completer-RSK6CCGP.js

@@ -1,2 +0,0 @@
-// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{Ba as a,Ca as b}from"./chunk-VAZ25MDX.js";import"./chunk-M7TCFYTO.js";import"./chunk-WW2O2DEP.js";import"./chunk-ZG4DMYBS.js";import"./chunk-URC6ZI6P.js";import"./chunk-PA76WUBL.js";import"./chunk-4WIODYOH.js";import"./chunk-I4TPQEJN.js";import"./chunk-Y4WOTWUC.js";import"./chunk-PQ3XUSY2.js";import"./chunk-UJEMSPM5.js";import"./chunk-VYKFM3TB.js";import"./chunk-AWMTNUDS.js";import"./chunk-F7C7J6IM.js";import"./chunk-NGHQIGVW.js";import"./chunk-ONUPGMER.js";export{a as ArgumentCompleter,b as createArgumentCompleter};