@kodax-ai/kodax 0.7.71 → 0.7.72

package/dist/types-chunks/{capsule.d-CK5Pfz1k.d.ts → capsule.d-DxtdE-GD.d.ts}

@@ -1,6 +1,5 @@
 import { k as KodaXMessage } from './types.d-Cqaw71Ax.js';
-import { Q as QueueEventListener, c as QueuedMessage, E as EnqueueInput, D as DequeueFilter } from './types.d-CEZZSY9s.js';
-import { M as AgentMessage, cH as SessionEntry, cF as Session, cJ as SessionExtension, bb as KodaXSessionLineage, aZ as KodaXJsonValue, af as CompactionDetails, aM as KodaXCompactMemorySeed, b7 as KodaXSessionEntry, bl as KodaXSessionTreeNode, ba as KodaXSessionLabelEntry, b9 as KodaXSessionGoalEntry, b4 as KodaXSessionClientNoticeEntry, bh as KodaXSessionRewindMarkerEntry, bc as KodaXSessionMemoryOutcomeDigestEntry, bd as KodaXSessionMemoryReviewReceiptEntry, bg as KodaXSessionNavigationOptions, b2 as KodaXSessionArtifactLedgerEntry, aA as FileOperations, dm as WorkflowMeta, dn as WorkflowModelHint, dp as WorkflowModule } from './types.d-CRCaLt_s.js';
+import { a8 as AgentMessage, dd as SessionEntry, db as Session, df as SessionExtension, bL as KodaXSessionLineage, bx as KodaXJsonValue, aP as CompactionDetails, bk as KodaXCompactMemorySeed, bH as KodaXSessionEntry, bV as KodaXSessionTreeNode, bK as KodaXSessionLabelEntry, bJ as KodaXSessionGoalEntry, bE as KodaXSessionClientNoticeEntry, bR as KodaXSessionRewindMarkerEntry, bM as KodaXSessionMemoryOutcomeDigestEntry, bN as KodaXSessionMemoryReviewReceiptEntry, bQ as KodaXSessionNavigationOptions, bC as KodaXSessionArtifactLedgerEntry, b8 as FileOperations, dU as WorkflowMeta, dV as WorkflowModelHint, dW as WorkflowModule } from './types.d-DH1mvdcl.js';
 
 /**
  * @kodax-ai/agent Constants
@@ -250,6 +249,14 @@ declare function getAgentConfigHome(): string;
  * 30 callsites of `getAgentConfigPath(x, y)`).
  */
 declare function getAgentConfigPath(...segments: string[]): string;
+/**
+ * Lexical path containment with the host filesystem's comparison semantics.
+ * Windows paths are case-insensitive; segment boundaries prevent sibling
+ * prefixes such as `.kodax-backup` from being treated as descendants.
+ */
+declare function isPathInsideDirectory(targetPath: string, directoryPath: string): boolean;
+/** Resolve a tool path from the directory where the tool actually executes. */
+declare function resolveExecutionPath(targetPath: string, executionCwd: string): string;
 /**
  * v0.7.42 — Namespaced data directory for third-party apps embedding the
  * KodaX SDK (e.g. `KodaX Space` desktop client, IDE extensions).
@@ -271,97 +278,19 @@ declare function getAgentConfigPath(...segments: string[]): string;
  */
 declare function getAppDataDir(appId: string): string;
 
-/**
- * @kodax-ai/agent/messaging/queue — 2-tier agentId-scoped FIFO message queue.
- *
- * FEATURE_115 (v0.7.36).
- *
- * Invariants:
- *   - In-priority FIFO: messages of the same priority drain in enqueue order.
- *   - Cross-priority precedence: 'user' drains before 'background', regardless
- *     of enqueue order.
- *   - agentId routing: messages addressed to agentId X are only visible to
- *     consumers filtering for that exact agentId. undefined ≠ "any agent" —
- *     it specifically matches main-thread messages.
- *   - Not persistent: process restart loses queue state, by design (matches
- *     TodoStore semantics).
- *
- * The queue is process-global by default (`getMessageQueue()`); the class is
- * also exported for tests / isolated downstream use.
- */
-
-declare class MessageQueue {
-    private messages;
-    private nextSeq;
-    /**
-     * FEATURE_159 (v0.7.40) — observable subscription set. Same pattern as
-     * Claude Code's `messageQueueManager.ts` `createSignal()` substrate,
-     * but the listener carries a structured `QueueEvent` so SDK
-     * observability consumers (logger, tracer, metrics) can react per-
-     * event without re-diffing snapshots. `useSyncExternalStore` consumers
-     * still work — they ignore the event argument.
-     *
-     * Cached `snapshotRef` keeps reference identity stable across reads
-     * when nothing changed — required by React 18's `useSyncExternalStore`
-     * to avoid render loops.
-     */
-    private listeners;
-    private snapshotRef;
-    private notify;
-    /**
-     * Subscribe to queue mutations. Compatible with React 18's
-     * `useSyncExternalStore(subscribe, getSnapshot)` — the hook passes a
-     * `() => void` callback, which is structurally assignable to the
-     * `QueueEventListener` parameter because TypeScript treats
-     * callback parameter discards as compatible. SDK consumers that
-     * declare a typed `(event: QueueEvent) => void` listener see the
-     * structured event.
-     *
-     * Listener is called synchronously after every mutation; returns an
-     * unsubscribe function.
-     */
-    subscribe: (listener: QueueEventListener) => (() => void);
-    /**
-     * Returns the current frozen queue snapshot. Reference identity is
-     * stable across reads when the queue has not mutated, which is the
-     * contract React's `useSyncExternalStore` relies on.
-     */
-    getSnapshot: () => readonly QueuedMessage[];
-    /** Returns the assigned id of the enqueued message. */
-    enqueue(input: EnqueueInput): string;
-    /**
-     * Drain matching messages, ordered by priority (user > background) then
-     * FIFO within each priority. Removes drained messages from the queue.
-     */
-    dequeue(filter: DequeueFilter): QueuedMessage[];
-    /**
-     * Peek at matching messages without removing them. Returns messages in
-     * the same priority + FIFO order that `dequeue(filter)` would return,
-     * so callers can inspect what the next drain would yield.
-     */
-    peek(filter: DequeueFilter): QueuedMessage[];
-    /** Total queue size across all priorities / agents. */
-    size(): number;
-    /** Count of messages matching the filter. */
-    count(filter: DequeueFilter): number;
-    /** True iff at least one message matches the filter. */
-    has(filter: DequeueFilter): boolean;
-    /** Remove all queued messages — used in tests / process abort scenarios. */
-    clear(): void;
-}
-/**
- * Returns the process-global MessageQueue singleton, creating it lazily on
- * first call. Use this for production wiring; instantiate `MessageQueue`
- * directly in tests / isolated subsystems where a shared instance would
- * cause cross-test pollution.
- */
-declare function getMessageQueue(): MessageQueue;
-/**
- * Test-only reset hook. Production code MUST NOT call this. Underscored
- * prefix follows the same convention as `_resetInvariantRegistry` /
- * `_resetAdmittedAgentBindings` / `_resetAdmissionMetrics`.
- */
-declare function _resetMessageQueueForTests(): void;
+/** Canonical MessageQueue routing key for an Actor within a runtime session. */
+declare function actorQueueId(sessionId: string, actorPath: string): string;
+declare function actorQueueId(sessionId: string | undefined, actorPath: string): string | undefined;
+/**
+ * Advertise a live Actor root queue to compatibility helpers. Repeated
+ * registration is reference-counted because nested execution layers can own
+ * the same route.
+ */
+declare function registerActiveRootQueueRoute(agentId: string): () => void;
+/** Resolve the sole live Actor root, failing closed when routing is ambiguous. */
+declare function resolveActiveRootQueueRoute(): string | undefined;
+/** Test-only process-global reset. */
+declare function _resetActiveRootQueueRoutesForTests(): void;
 
 /**
  * History cleanup middleware — CAP-002
@@ -831,5 +760,5 @@ declare function buildWorkflowCapsuleIntent(manifest: {
     readonly originalRequest?: string;
 }): WorkflowCapsuleIntent;
 
-export { createSessionLineage as $, DefaultSummaryCompaction as D, KODAX_API_MIN_INTERVAL as K, LINEAGE_ENTRY_TYPES as L, MessageQueue as M, appendSessionLineageLabel as O, PROMISE_PATTERN as P, applyLineageTruncation as Q, applySessionCompaction as R, archiveOldIslands as S, assertRestrictedWorkflowQuality as T, buildSessionTree as U, buildWorkflowCapsuleIntent as V, WORKFLOW_CAPSULE_API_VERSION as W, cleanupIncompleteToolCalls as X, countActiveLineageMessages as Y, countTokens as Z, _resetMessageQueueForTests as _, createWorkflowCapsule as a0, createWorkflowModuleFromCapsule as a1, estimateTokens as a2, extractArtifactLedger as a3, extractFileOps as a4, extractTitleFromMessages as a5, findPreviousUserEntryId as a6, forkSessionLineage as a7, generateSessionId as a8, getAgentConfigHome as a9, getAgentConfigPath as aa, getAppDataDir as ab, getMessageQueue as ac, getSessionLineagePath as ad, getSessionMessagesFromLineage as ae, lintRestrictedWorkflowSource as af, mergeArtifactLedger as ag, mergeFileOps as ah, resolveSessionLineageTarget as ai, rewindSessionLineage as aj, setAgentConfigHome as ak, setSessionLineageActiveEntry as al, validateAndFixToolHistory as am, validateWorkflowCapsule as an, validateWorkflowScriptManifest as ao, KODAX_DEFAULT_TIMEOUT as f, KODAX_HARD_TIMEOUT as g, KODAX_MAX_INCOMPLETE_RETRIES as h, KODAX_MAX_MAXTOKENS_RETRIES as i, KODAX_MAX_RETRIES as j, KODAX_MAX_TOKENS as k, KODAX_RETRY_BASE_DELAY as l, KODAX_STAGGER_DELAY as m, LineageCompaction as o, LineageExtension as r, WORKFLOW_CAPSULE_FORMAT as v, WORKFLOW_CAPSULE_VERSION as w, WORKFLOW_PATTERN_IDS as x };
-export type { WorkflowCapsuleInputs as A, WorkflowCapsuleIntent as B, CompactionContext as C, WorkflowCapsuleProvenance as E, WorkflowCapsuleRequirements as F, WorkflowPatternId as G, WorkflowQualityLintFinding as H, WorkflowQualityLintOptions as I, WorkflowQualityLintSeverity as J, WorkflowScriptManifest as N, CompactionEntry as a, CompactionEntryPayload as b, CompactionPolicy as c, CreateWorkflowCapsuleInput as d, DefaultSummaryCompactionOptions as e, LineageArtifactLedgerPayload as n, LineageCompactionDelegates as p, LineageEntryType as q, LineageLabelPayload as s, LineageTreeNode as t, PolicyCompactionResult as u, WorkflowCapsule as y, WorkflowCapsuleEnvironmentRequirement as z };
+export { createSessionLineage as $, DefaultSummaryCompaction as D, KODAX_API_MIN_INTERVAL as K, LINEAGE_ENTRY_TYPES as L, actorQueueId as N, appendSessionLineageLabel as O, PROMISE_PATTERN as P, applyLineageTruncation as Q, applySessionCompaction as R, archiveOldIslands as S, assertRestrictedWorkflowQuality as T, buildSessionTree as U, buildWorkflowCapsuleIntent as V, WORKFLOW_CAPSULE_API_VERSION as W, cleanupIncompleteToolCalls as X, countActiveLineageMessages as Y, countTokens as Z, _resetActiveRootQueueRoutesForTests as _, createWorkflowCapsule as a0, createWorkflowModuleFromCapsule as a1, estimateTokens as a2, extractArtifactLedger as a3, extractFileOps as a4, extractTitleFromMessages as a5, findPreviousUserEntryId as a6, forkSessionLineage as a7, generateSessionId as a8, getAgentConfigHome as a9, getAgentConfigPath as aa, getAppDataDir as ab, getSessionLineagePath as ac, getSessionMessagesFromLineage as ad, isPathInsideDirectory as ae, lintRestrictedWorkflowSource as af, mergeArtifactLedger as ag, mergeFileOps as ah, registerActiveRootQueueRoute as ai, resolveActiveRootQueueRoute as aj, resolveExecutionPath as ak, resolveSessionLineageTarget as al, rewindSessionLineage as am, setAgentConfigHome as an, setSessionLineageActiveEntry as ao, validateAndFixToolHistory as ap, validateWorkflowCapsule as aq, validateWorkflowScriptManifest as ar, KODAX_DEFAULT_TIMEOUT as f, KODAX_HARD_TIMEOUT as g, KODAX_MAX_INCOMPLETE_RETRIES as h, KODAX_MAX_MAXTOKENS_RETRIES as i, KODAX_MAX_RETRIES as j, KODAX_MAX_TOKENS as k, KODAX_RETRY_BASE_DELAY as l, KODAX_STAGGER_DELAY as m, LineageCompaction as o, LineageExtension as r, WORKFLOW_CAPSULE_FORMAT as v, WORKFLOW_CAPSULE_VERSION as w, WORKFLOW_PATTERN_IDS as x };
+export type { WorkflowCapsuleInputs as A, WorkflowCapsuleIntent as B, CompactionContext as C, WorkflowCapsuleProvenance as E, WorkflowCapsuleRequirements as F, WorkflowPatternId as G, WorkflowQualityLintFinding as H, WorkflowQualityLintOptions as I, WorkflowQualityLintSeverity as J, WorkflowScriptManifest as M, CompactionEntry as a, CompactionEntryPayload as b, CompactionPolicy as c, CreateWorkflowCapsuleInput as d, DefaultSummaryCompactionOptions as e, LineageArtifactLedgerPayload as n, LineageCompactionDelegates as p, LineageEntryType as q, LineageLabelPayload as s, LineageTreeNode as t, PolicyCompactionResult as u, WorkflowCapsule as y, WorkflowCapsuleEnvironmentRequirement as z };

package/dist/types-chunks/center-types.d-BBT122uJ.d.ts

@@ -0,0 +1,91 @@
+type LearnedCapabilityCarrier = 'skill' | 'extension' | 'workflow_handoff';
+type LearnedCapabilityLifecycle = 'opportunity' | 'drafting' | 'ready' | 'testing' | 'active_learned' | 'promoted_user' | 'quarantined' | 'archived' | 'rejected';
+type LearningEventKind = 'opportunity' | 'drafting' | 'ready' | 'testing' | 'activated' | 'promoted' | 'attention' | 'archived' | 'rejected';
+type LearningAction = 'review' | 'trust' | 'reject' | 'disable' | 'rollback' | 'archive' | 'restore' | 'promote';
+interface LearnedCapabilitySource {
+    readonly kind: 'learning_controller' | 'f224_proposal';
+    readonly proposalId?: string;
+}
+interface LearnedCapabilityRecord {
+    readonly schemaVersion: 1;
+    readonly capabilityId: string;
+    readonly displayName: string;
+    readonly slug: string;
+    readonly carrier: LearnedCapabilityCarrier;
+    readonly lifecycle: LearnedCapabilityLifecycle;
+    readonly revision: number;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    readonly source: LearnedCapabilitySource;
+    /** The control action that produced this revision, when it is not implied by lifecycle. */
+    readonly lastAction?: LearningAction;
+    readonly artifactPath?: string;
+    readonly previousGoodRevision?: number;
+    readonly previousLifecycle?: LearnedCapabilityLifecycle;
+    readonly diagnostics?: readonly string[];
+}
+interface LearningEvent {
+    readonly schemaVersion: 1;
+    readonly sequence: number;
+    readonly eventId: string;
+    readonly capabilityId: string;
+    readonly capabilityRevision: number;
+    readonly kind: LearningEventKind;
+    readonly lifecycle: LearnedCapabilityLifecycle;
+    readonly displayName: string;
+    readonly slug: string;
+    readonly carrier: LearnedCapabilityCarrier;
+    readonly createdAt: string;
+}
+type LearningNotificationState = 'unread' | 'seen' | 'acknowledged' | 'snoozed';
+interface LearningClientEventState {
+    readonly state: LearningNotificationState;
+    readonly capabilityRevision: number;
+    readonly updatedAt: string;
+    readonly snoozedUntil?: string;
+}
+interface LearningClientRecord {
+    readonly schemaVersion: 1;
+    readonly clientIdentity: string;
+    readonly events: Readonly<Record<string, LearningClientEventState>>;
+}
+interface LearningSurfaceSnapshot {
+    readonly ready: number;
+    readonly newlyActive: number;
+    readonly attention: number;
+    readonly active: number;
+    readonly revision: number;
+}
+interface LearningQuery {
+    readonly search?: string;
+    readonly carrier?: LearnedCapabilityCarrier;
+    readonly lifecycle?: LearnedCapabilityLifecycle;
+    readonly limit?: number;
+    readonly cursor?: string;
+}
+interface LearningPage {
+    readonly items: readonly LearnedCapabilityRecord[];
+    readonly nextCursor?: string;
+    readonly revision: number;
+}
+interface LearningSubscribeOptions {
+    readonly afterRevision?: number;
+}
+interface LearningActionDriver {
+    readonly carrier: LearnedCapabilityCarrier;
+    readonly actions: readonly LearningAction[];
+    execute(action: LearningAction, capability: LearnedCapabilityRecord): Promise<LearnedCapabilityRecord>;
+}
+type LearningCapabilityErrorCode = 'ambiguous_name' | 'action_failed' | 'capability_not_found' | 'invalid_record' | 'invalid_transition' | 'store_integrity_error' | 'unsupported_action';
+declare class LearningCapabilityError extends Error {
+    readonly code: LearningCapabilityErrorCode;
+    constructor(code: LearningCapabilityErrorCode, message: string);
+}
+declare function canTransitionLearnedCapability(from: LearnedCapabilityLifecycle, to: LearnedCapabilityLifecycle): boolean;
+declare function assertLearnedCapabilityTransition(from: LearnedCapabilityLifecycle, to: LearnedCapabilityLifecycle): void;
+declare function slugifyLearnedCapabilityName(displayName: string): string;
+declare function learningEventKindForLifecycle(lifecycle: LearnedCapabilityLifecycle): LearningEventKind;
+declare function learningEventIdFor(record: LearnedCapabilityRecord): string;
+
+export { LearningCapabilityError as f, assertLearnedCapabilityTransition as q, canTransitionLearnedCapability as r, learningEventIdFor as s, learningEventKindForLifecycle as t, slugifyLearnedCapabilityName as u };
+export type { LearnedCapabilityCarrier as L, LearnedCapabilityLifecycle as a, LearnedCapabilityRecord as b, LearnedCapabilitySource as c, LearningAction as d, LearningActionDriver as e, LearningCapabilityErrorCode as g, LearningClientEventState as h, LearningClientRecord as i, LearningEvent as j, LearningEventKind as k, LearningNotificationState as l, LearningPage as m, LearningQuery as n, LearningSubscribeOptions as o, LearningSurfaceSnapshot as p };

package/dist/types-chunks/{commands.d-D6g2jq8V.d.ts → commands.d-DZxHzH5-.d.ts}

@@ -1,7 +1,7 @@
-import { h as SessionStorage$1, f as PermissionMode } from './public-api.d-BvCp5VkW.js';
-import { Y as KodaXOptions, a6 as KodaXResult } from './bash-prefix-extractor.d-YoiZl5yt.js';
-import { n as RuntimeSurfaceStatus, b as CommandDefinition, e as CommandSource, c as CommandInfo, C as Command$1, I as InteractiveContext, a as CommandCallbacks, g as CurrentConfig, d as CommandInvocationRequest, f as CommandWorkflowInvocationRequest } from './utils.d-Cb6vdvFM.js';
-import { bk as KodaXSessionStorage, b6 as KodaXSessionData } from './types.d-CRCaLt_s.js';
+import { X as SessionStorage$1, R as PermissionMode, L as LearningBinding } from './public-api.d--IDNJsu1.js';
+import { $ as KodaXOptions, a9 as KodaXResult } from './bash-prefix-extractor.d-CHJO5y94.js';
+import { n as RuntimeSurfaceStatus, b as CommandDefinition, e as CommandSource, c as CommandInfo, C as Command$1, I as InteractiveContext, a as CommandCallbacks, g as CurrentConfig, d as CommandInvocationRequest, f as CommandWorkflowInvocationRequest } from './utils.d-gmn3c5U4.js';
+import { bU as KodaXSessionStorage, bG as KodaXSessionData } from './types.d-DH1mvdcl.js';
 
 /**
  * InkREPL - Ink-based REPL Adapter
@@ -28,6 +28,7 @@ interface InkREPLOptions extends KodaXOptions {
     hardExitOnClose?: boolean;
     runtimeRunner?: InkRuntimeRunner;
     getRuntimeStatus?: InkRuntimeStatusProvider;
+    learning?: LearningBinding;
 }
 /**
  * Run Ink-based interactive mode
@@ -55,6 +56,7 @@ interface RepLOptions extends KodaXOptions {
     storage?: SessionStorage;
     runtimeRunner?: ReplRuntimeRunner;
     getRuntimeStatus?: ReplRuntimeStatusProvider;
+    learning?: LearningBinding;
 }
 declare function runInteractiveMode(options: RepLOptions): Promise<void>;
 declare function processSpecialSyntax(input: string): Promise<string>;

package/dist/types-chunks/{guardrail.d-DilYC1dh.d.ts → guardrail.d-DlpMnd-Y.d.ts}

@@ -1,4 +1,4 @@
-import { aC as Guardrail, cz as RunnerToolCall, f as Agent, M as AgentMessage, cC as RunnerToolResult, cN as Span } from './types.d-CRCaLt_s.js';
+import { ba as Guardrail, d5 as RunnerToolCall, f as Agent, a8 as AgentMessage, d8 as RunnerToolResult, dj as Span } from './types.d-DH1mvdcl.js';
 
 /**
  * Guardrail Runtime — FEATURE_085 (v0.7.26).

package/dist/types-chunks/{guardrail.d-DdeDWnVu.d.ts → guardrail.d-auV61_h5.d.ts}

@@ -1,8 +1,8 @@
 import { b as McpServersConfig, M as McpConnectMode, a as McpServerConfig, c as McpTransportKind } from './config.d-CJy1WENT.js';
 import { K as KodaXBaseProvider } from './base.d-Cz_rwpOi.js';
 import { a as CostTracker } from './cost-tracker.d-BeaenODW.js';
-import { cz as RunnerToolCall } from './types.d-CRCaLt_s.js';
-import { d as ToolGuardrail } from './guardrail.d-DilYC1dh.js';
+import { d5 as RunnerToolCall } from './types.d-DH1mvdcl.js';
+import { d as ToolGuardrail } from './guardrail.d-DlpMnd-Y.js';
 
 /**
  * FEATURE_200 Phase F (v0.7.45) — MCP domain types extracted from types.ts.
@@ -138,7 +138,7 @@ declare function loadAutoRules(opts: LoadAutoRulesOptions): Promise<RulesLoadRes
  *
  * Two invariants the producers must hold:
  *
- *   1. **Pure**: same `call` + `projectRoot` ⇒ same signals. No I/O, no
+ *   1. **Pure**: same `call` + path context ⇒ same signals. No I/O, no
  *      timestamps, no env reads inside collectors. Collectors run on every
  *      non-Tier-1 tool call, so they must be cheap and deterministic.
  *
@@ -222,10 +222,11 @@ interface SignalCollector {
      * Inspect the call and produce zero or more signals.
      *
      * Must be pure: no I/O, no timing, no global state reads. The
-     * `projectRoot` argument is the only environmental context — pass
-     * the same value through every call site to keep results stable.
+     * `projectRoot` is the authorization boundary. `executionCwd` is the
+     * directory relative paths resolve from and defaults to `projectRoot` for
+     * backward compatibility.
      */
-    collect(call: RunnerToolCall, projectRoot: string): readonly ToolCallSignal[];
+    collect(call: RunnerToolCall, projectRoot: string, executionCwd?: string): readonly ToolCallSignal[];
 }
 /**
  * Run every applicable collector on `call` and return the merged signal
@@ -238,7 +239,7 @@ interface SignalCollector {
  * from an argv token in the same command). The classifier prompt
  * tolerates duplicates; dedup would risk dropping load-bearing context.
  */
-declare function collectAllSignals(call: RunnerToolCall, projectRoot: string, collectors: readonly SignalCollector[]): readonly ToolCallSignal[];
+declare function collectAllSignals(call: RunnerToolCall, projectRoot: string, collectors: readonly SignalCollector[], executionCwd?: string): readonly ToolCallSignal[];
 
 /**
  * Denial Tracker — FEATURE_092 Phase 2b.4 (v0.7.33).
@@ -286,6 +287,74 @@ declare function createCircuitBreaker(): CircuitBreaker;
 declare function recordError(b: CircuitBreaker, now: number): CircuitBreaker;
 declare function shouldFallback(b: CircuitBreaker, now: number): boolean;
 
+/**
+ * Tier 0 — Absolute Denylist — FEATURE_158 Step 4 (v0.7.39).
+ *
+ * The narrowest possible set of catastrophic patterns that must NEVER reach
+ * the LLM classifier (which is fallible / can be prompt-injected). Per
+ * ADR-025: every entry here must satisfy BOTH gates:
+ *
+ *   (a) "is there any legitimate context in which this should be allowed?"
+ *       — answer must be **no**.
+ *   (b) "could the LLM be convinced to allow it under prompt injection?"
+ *       — answer must be **yes** (otherwise classifier is sufficient).
+ *
+ * The 5-item list is **frozen** by ADR-025; adding entries requires a new
+ * ADR addendum answering (a)+(b) again. Removing entries requires evidence
+ * of high-volume false-positive friction.
+ *
+ * Patterns:
+ *
+ *   1. rm_rf_root      — `rm -rf /`, `rm -rf ~`, `rm -rf $HOME` (and quoted
+ *                        / -fr variants). Excludes `rm -rf /tmp/foo` (which
+ *                        is a `dangerous_pattern` signal but reaches LLM).
+ *   2. mkfs_or_format  — `mkfs.* /dev/sd*`, `fdisk /dev/sd*`, `format C:`.
+ *                        Block formatting any disk device.
+ *   3. dd_disk_write   — `dd of=/dev/sd*` (raw-disk write). Excludes
+ *                        `dd of=test.bin` (file write — reaches LLM as
+ *                        dangerous_pattern signal).
+ *   4. fork_bomb       — `:(){ :|:& };:` — denial of service.
+ *   5. user_kodax_write — write/edit to any path under `~/.kodax/`
+ *                        (credentials zone — internal kodax config writes
+ *                        use the TypeScript API, not bash/tools, so the
+ *                        only path here is LLM-emitted shell which is
+ *                        always wrong).
+ *
+ * Layer note: bash-level `~/.kodax/` writes (e.g. `echo x > ~/.kodax/y`)
+ * require AST path-extraction which lives in `@kodax/repl`. The REPL-side
+ * collector wired through `extraCollectors` (Step 7) escalates those to
+ * Tier 0 by emitting a synthetic `user_kodax_write` denial via the same
+ * `AbsoluteDenyResult` shape. This module handles the file-tool path
+ * directly (the most common attack vector) and the four command-string
+ * patterns that don't need path extraction.
+ */
+
+type TierZeroPatternId = 'rm_rf_root' | 'mkfs_or_format' | 'dd_disk_write' | 'fork_bomb' | 'user_kodax_write';
+interface AbsoluteDenyMatch {
+    readonly denied: true;
+    readonly patternId: TierZeroPatternId;
+    readonly reason: string;
+}
+interface AbsoluteDenyMiss {
+    readonly denied: false;
+}
+type AbsoluteDenyResult = AbsoluteDenyMatch | AbsoluteDenyMiss;
+type AbsoluteDenyCheck = (call: RunnerToolCall, projectRoot: string, executionCwd: string) => AbsoluteDenyResult;
+/**
+ * Check a tool call against the Tier 0 absolute denylist. Returns the
+ * first matching pattern, or `{ denied: false }` if no pattern fires.
+ *
+ * Order is deterministic — patterns checked in the order defined above.
+ * Multiple matches would be possible (e.g. `rm -rf / ; :(){...};:`) but
+ * we return the first hit since the guardrail acts on `denied: true`
+ * regardless and the reason string is one-shot.
+ *
+ * **Pure**: deterministic given (call, projectRoot, stable env).
+ * **Fast**: ~5 regex tests + 1-2 string ops; safe to run on every
+ * non-Tier-1 call without measurable overhead.
+ */
+declare function checkAbsoluteDeny(call: RunnerToolCall, projectRoot: string, executionCwd?: string): AbsoluteDenyResult;
+
 /**
  * AutoModeToolGuardrail — FEATURE_092 Phase 2b.6 (v0.7.33).
  *
@@ -443,7 +512,7 @@ interface AutoModeGuardrailConfig {
     readonly initialEngine?: AutoModeEngine;
     /**
      * FEATURE_092 phase 2b.7b slice C: classifier sideQuery timeout in ms.
-     * Defaults to 8000. Resolved by the REPL from `~/.kodax/config.json`
+     * Defaults to 20_000. Resolved by the REPL from `~/.kodax/config.json`
      * `autoMode.timeoutMs`.
      */
     readonly timeoutMs?: number;
@@ -460,6 +529,8 @@ interface AutoModeGuardrailConfig {
      * and supply no `extraCollectors`.
      */
     readonly projectRoot?: string;
+    /** Directory used to resolve relative tool paths. Defaults to projectRoot. */
+    readonly executionCwd?: string;
     /**
      * Override the default signal-collector set. When unset, defaults to
      * `[bashSignalCollector, fileSignalCollector]` — coding-side
@@ -482,6 +553,8 @@ interface AutoModeGuardrailConfig {
      * signal order).
      */
     readonly extraCollectors?: readonly SignalCollector[];
+    /** Layer-owned Tier-0 checks that run after the coding-side frozen list. */
+    readonly extraAbsoluteDenyChecks?: readonly AbsoluteDenyCheck[];
     /**
      * Speculative-classify quiet window (ms). When a classifier promise
      * settles within this window, the guardrail uses the verdict directly
@@ -536,5 +609,5 @@ interface AutoModeToolGuardrail extends ToolGuardrail {
 }
 declare function createAutoModeToolGuardrail(config: AutoModeGuardrailConfig): AutoModeToolGuardrail;
 
-export { parseAutoRules as B, CONSECUTIVE_THRESHOLD as C, ERROR_THRESHOLD as E, readTrustState as F, recordAllow as G, recordBlock as H, recordError as I, shouldFallback$1 as J, shouldFallback as M, trustProjectRules as N, WINDOW_MS as W, CUMULATIVE_THRESHOLD as i, collectAllSignals as r, computeRulesFingerprint as s, createAutoModeToolGuardrail as t, createCircuitBreaker as u, createDenialTracker as v, formatAgentsForPrompt as w, getKodaxGlobalDir as x, loadAgentsFiles as y, loadAutoRules as z };
-export type { AgentsFile as A, DenialTracker as D, KodaXMcpConnectMode as K, LoadAgentsOptions as L, RulesLoadError as R, SignalCollector as S, ToolCallSignal as T, AutoModeAskUser as a, AutoModeAskUserVerdict as b, AutoModeEngine as c, AutoModeGuardrailConfig as d, AutoModeSharedState as e, AutoModeStats as f, AutoModeToolGuardrail as g, AutoRules as h, CircuitBreaker as j, KodaXMcpServerConfig as k, KodaXMcpServersConfig as l, KodaXMcpTransport as m, LoadedRulesSource as n, RulesLoadResult as o, SkippedRulesSource as p, TrustState as q };
+export { createCircuitBreaker as B, CONSECUTIVE_THRESHOLD as C, ERROR_THRESHOLD as E, createDenialTracker as F, formatAgentsForPrompt as G, getKodaxGlobalDir as H, loadAgentsFiles as I, loadAutoRules as J, parseAutoRules as M, readTrustState as N, recordAllow as O, recordBlock as P, recordError as Q, shouldFallback$1 as U, shouldFallback as V, WINDOW_MS as W, trustProjectRules as X, CUMULATIVE_THRESHOLD as m, checkAbsoluteDeny as w, collectAllSignals as x, computeRulesFingerprint as y, createAutoModeToolGuardrail as z };
+export type { AbsoluteDenyCheck as A, DenialTracker as D, KodaXMcpConnectMode as K, LoadAgentsOptions as L, RulesLoadError as R, SignalCollector as S, TierZeroPatternId as T, AbsoluteDenyMatch as a, AbsoluteDenyMiss as b, AbsoluteDenyResult as c, AgentsFile as d, AutoModeAskUser as e, AutoModeAskUserVerdict as f, AutoModeEngine as g, AutoModeGuardrailConfig as h, AutoModeSharedState as i, AutoModeStats as j, AutoModeToolGuardrail as k, AutoRules as l, CircuitBreaker as n, KodaXMcpServerConfig as o, KodaXMcpServersConfig as p, KodaXMcpTransport as q, LoadedRulesSource as r, RulesLoadResult as s, SkippedRulesSource as t, ToolCallSignal as u, TrustState as v };