@kodax-ai/kodax 0.7.76 → 0.7.78

package/dist/types-chunks/{guardrail.d-qjuKJZ31.d.ts → guardrail.d-CXDYRgZ3.d.ts}

@@ -1,8 +1,10 @@
 import { b as McpServersConfig, M as McpConnectMode, a as McpServerConfig, c as McpTransportKind } from './config.d-CJy1WENT.js';
-import { K as KodaXBaseProvider } from './base.d-ChvpaKjZ.js';
+import { K as KodaXBaseProvider } from './base.d-4e74xDdy.js';
 import { a as CostTracker } from './cost-tracker.d-BeaenODW.js';
-import { d6 as RunnerToolCall } from './types.d-sRLugmjy.js';
-import { d as ToolGuardrail } from './guardrail.d-CWYD1bdL.js';
+import { dT as RunnerToolCall } from './types.d-BA-Jwpfs.js';
+import { d as ToolGuardrail } from './guardrail.d-BRE_ErEj.js';
+import { k as KodaXMessage } from './types.d-DIpZJKUl.js';
+import { S as SideQueryDiagnostics } from './side-query.d-DTuLPcC5.js';
 
 /**
  * FEATURE_200 Phase F (v0.7.45) — MCP domain types extracted from types.ts.
@@ -241,6 +243,157 @@ interface SignalCollector {
  */
 declare function collectAllSignals(call: RunnerToolCall, projectRoot: string, collectors: readonly SignalCollector[], executionCwd?: string): readonly ToolCallSignal[];
 
+interface PermissionIntentEvidence {
+    readonly status: 'complete' | 'targeted' | 'missing';
+    /** Latest genuine user request, kept separate as the authoritative intent. */
+    readonly currentUserContent?: string;
+    readonly currentUserContentTruncated?: boolean;
+    readonly content: string;
+    readonly sourceBytes: number;
+    readonly includedBytes: number;
+    readonly omittedBytes: number;
+    readonly sha256: string;
+}
+
+/**
+ * Classifier Projection Helpers — FEATURE_092 (v0.7.33)
+ *
+ * Typed tools implement `toClassifierInput(input): string` to project their
+ * input into a compact action the auto-mode classifier evaluates. Runtime
+ * registration supplies a fail-closed semantic fallback for legacy JavaScript,
+ * extension, and constructed tools that lack a trusted projector.
+ *
+ * ============== EXAMPLES BY CATEGORY ==============
+ *
+ *   --- FILE OPERATIONS (path + size, never raw contents) ---
+ *     write.ts:        (i) => `Write ${i.path} (${i.content.length} bytes)`
+ *     edit.ts:         (i) => `Edit ${i.path} [${describeEdit(i)}]`
+ *     multi-edit:      (i) => `MultiEdit ${i.path}: ${i.edits.length} edits`
+ *
+ *   --- SHELL / EXEC (command verbatim, ignore noise fields) ---
+ *     bash.ts:         (i) => `Bash: ${i.command}`
+ *
+ *   --- NETWORK (URL is THE risk surface) ---
+ *     web_fetch:       (i) => `WebFetch ${i.url}`
+ *
+ *   --- CHILD AGENT SPAWN (routing + execution controls) ---
+ *     spawn_agent:     objective size + scope/read_only/isolation/provider/model
+ *
+ *   --- MCP CALLS (semantic fields + shape-only unknowns) ---
+ *     mcp_call:        (i) => mcpToClassifierInput(i.server, i.tool, i.input)
+ *
+ *   --- READ-ONLY (Tier 1 — fully skipped) ---
+ *     read.ts:         () => ''
+ *     grep.ts:         () => ''
+ *     glob.ts:         () => ''
+ *
+ *   --- UNKNOWN / CONSTRUCTED (semantic fail-closed fallback) ---
+ *     extension:       (i) => safeFallbackToClassifierInput(name, i)
+ *
+ * ============== ANTI-PATTERNS ==============
+ *
+ *   ❌ JSON.stringify(input) as default
+ *      → leaks raw content; hard for LLM to scan
+ *
+ *   ❌ Returning input.description / input.rationale verbatim
+ *      → these are LLM-emitted, manipulable; classifier should see facts
+ *
+ *   ❌ Including raw file contents in Write/Edit projections
+ *      → privacy + token cost; use bytes/line count as proxy
+ *
+ *   ❌ Returning '' for a high-risk tool to "skip the classifier"
+ *      → defeats Tier 1's "safe-only" semantics
+ *
+ *   ❌ Truncating without indicating it ('foo' instead of 'foo…')
+ *      → classifier may make decisions on false-complete information
+ */
+type ClassifierToolProjectionResolver = (toolName: string) => ((input: unknown) => string) | undefined;
+
+/**
+ * Auto-Mode Classifier Orchestrator — FEATURE_092 Phase 2b.3 (v0.7.33).
+ *
+ * Wires the classifier prompt + sideQuery + output parser into a single
+ * `classify(...)` call. Caller supplies the rules, transcript, and the
+ * tool-call action being classified; gets back a `ClassifyDecision`.
+ *
+ * Failure → decision mapping:
+ *
+ *   sideQuery.stopReason   parsedOutput   → ClassifyDecision
+ *   ───────────────────────────────────────────────────────
+ *   end_turn / max_tokens  block          → confirm (with reason)
+ *   end_turn / max_tokens  allow          → allow
+ *   end_turn / max_tokens  unparseable    → retry, then failure
+ *   end_turn / max_tokens  + tool_use     → retry, then failure
+ *                          (sideQuery returns stopReason='error' here)
+ *   timeout                —              → retry, then failure
+ *   aborted                —              → throw AbortError to caller
+ *   error                  —              → retry, then failure
+ *
+ * Every non-abort failure receives one immediate retry. The caller applies
+ * its configured safety fallback after the second failure; a valid model
+ * concern always means "ask the user", never a direct hard block.
+ */
+
+interface ClassifyOptions {
+    readonly provider: KodaXBaseProvider;
+    readonly model: string;
+    readonly rules: AutoRules;
+    readonly claudeMd?: string;
+    readonly transcript: readonly KodaXMessage[];
+    readonly action: string;
+    readonly intentEvidence?: PermissionIntentEvidence;
+    /** Resolve canonical per-tool projections for safe historical context. */
+    readonly getToolProjection?: ClassifierToolProjectionResolver;
+    /**
+     * FEATURE_158 (v0.7.39): static-analysis signals forwarded to the
+     * classifier prompt. Empty / undefined preserves the FEATURE_092 prompt
+     * shape (no `<signals>` block emitted). When supplied, the classifier
+     * sees signals between `<transcript>` and `<action>` as informational
+     * input — not verdicts.
+     */
+    readonly signals?: readonly ToolCallSignal[];
+    readonly timeoutMs?: number;
+    readonly abortSignal?: AbortSignal;
+    readonly costTracker?: CostTracker;
+    /**
+     * Optional setter — invoked once after `sideQuery` returns when the
+     * classifier successfully recorded its token usage. The CostTracker is
+     * immutable, so `sideQuery` produces a fresh tracker copy with the new
+     * record; without this setter the recorded call is silently dropped.
+     * Wired by the AutoModeToolGuardrail so the agent's tracker accumulates
+     * classifier calls under role='auto_mode'.
+     */
+    readonly setCostTracker?: (next: CostTracker) => void;
+}
+type ClassifierFailureKind = 'timeout' | 'provider_error' | 'contract_error' | 'input_budget';
+type ClassifierAttemptOutcome = 'allow' | 'confirm' | ClassifierFailureKind;
+interface ClassifierAttemptDiagnostics {
+    readonly attempt: number;
+    readonly outcome: ClassifierAttemptOutcome;
+    readonly diagnostics?: SideQueryDiagnostics;
+}
+interface ClassifyDecisionDetails {
+    readonly reason: string;
+    /** Structured request metadata only; never includes prompt or response text. */
+    readonly diagnostics?: SideQueryDiagnostics;
+    readonly attempts: readonly ClassifierAttemptDiagnostics[];
+}
+type ClassifyDecision = ({
+    readonly kind: 'allow';
+} & ClassifyDecisionDetails) | ({
+    readonly kind: 'confirm';
+} & ClassifyDecisionDetails) | ({
+    readonly kind: 'failure';
+    readonly failureKind: ClassifierFailureKind;
+} & ClassifyDecisionDetails);
+/**
+ * The deadline includes connection setup, provider-side queueing, inference,
+ * and any Retry-After/backoff handled by the provider adapter. Keep it bounded
+ * so infrastructure failure degrades to an explicit user decision.
+ */
+declare const DEFAULT_CLASSIFIER_TIMEOUT_MS = 20000;
+declare function classify(opts: ClassifyOptions): Promise<ClassifyDecision>;
+
 /**
  * Denial Tracker — FEATURE_092 Phase 2b.4 (v0.7.33).
  *
@@ -365,18 +518,19 @@ declare function checkAbsoluteDeny(call: RunnerToolCall, projectRoot: string, ex
  *
  * Decision flow (per design doc "三层权限金字塔"):
  *
- *   1. Tier-0 deterministic deny             → block
- *   2. Tool projection is '' (Tier 1)        → allow (zero token cost)
- *   3. Engine is rules → deterministic Tier 2, otherwise user confirms
- *   4. denial/circuit threshold              → engine downgrade, then escalate
- *   5. classify(...) sideQuery
- *        allow                               → allow (record allow → reset consecutive)
- *        block                               → block + reason (record block)
- *        escalate                            → escalate + reason (record error)
- *        AbortError thrown                   → re-throw (propagate user cancel)
+ *   1. Tier-0 deterministic critical match   → user confirmation
+ *   2. exact safe read/workspace-temp effect → allow (zero token cost)
+ *   3. Tool projection is '' (Tier 1)        → allow
+ *   4. Engine is rules → deterministic Tier 2, otherwise user confirms
+ *   5. degraded classifier infrastructure    → Accept-edits fallback
+ *   6. classify(...) sideQuery
+ *        allow                                → allow (record allow → reset consecutive)
+ *        confirm                              → user confirmation (record concern)
+ *        failure                              → Accept-edits fallback (record error)
+ *        AbortError thrown                    → re-throw (propagate user cancel)
  *
  * State (mutable, session-scoped):
- *   - engine: 'llm' | 'rules' (starts at 'llm', downgrades on threshold)
+ *   - engine: 'llm' | 'rules' (user-selected; classifier health never changes it)
  *   - denialTracker (immutable type, swapped on each event)
  *   - circuitBreaker (immutable type, swapped on each event)
  *
@@ -402,15 +556,20 @@ interface AutoModeSharedState {
  * User answer for an escalated tool-call. The guardrail translates this into
  * the actual `GuardrailVerdict` returned to the Runner. `'block'` preserves
  * the original escalation reason as the verdict reason so downstream consumers
- * see why the tool was blocked.
+ * see why the tool was blocked. `'timeout'` reports that the action was not
+ * executed and gives the main model a bounded recovery instruction.
  */
-type AutoModeAskUserVerdict = 'allow' | 'block';
+type AutoModeAskUserVerdict = 'allow' | 'block' | 'timeout';
+interface AutoModeDecisionDiagnostics {
+    readonly source: 'classifier_confirm' | 'classifier_failure' | 'classifier_circuit_breaker' | 'configuration';
+    readonly classifierFailureKind?: ClassifierFailureKind;
+    readonly classifierAttempts?: readonly ClassifierAttemptDiagnostics[];
+}
 /**
- * Optional REPL-supplied prompt callback for the 6 escalate paths in
- * `beforeTool` (engine-downgraded, denial-threshold-just-crossed,
- * breaker-just-tripped, classifier-error, classifier-decision-escalate,
- * provider-not-configured). When supplied, the guardrail calls this and
- * translates the user's answer into `'allow'` or `'block'`. When NOT
+ * Optional REPL-supplied prompt callback for calls that require a human
+ * decision (rules escalation, classifier concern/failure, or configuration
+ * failure). When supplied, the guardrail calls this and
+ * translates the user's answer into allow/block/timeout semantics. When NOT
  * supplied, the guardrail returns `'escalate'` as before — the Runner will
  * then throw `GuardrailEscalateError` (preserves backward compat with
  * SDK-side guardrail consumers that have no askUser surface).
@@ -425,7 +584,7 @@ type AutoModeAskUser = (call: RunnerToolCall, reason: string,
  * keep working. REPL uses these to render Scope/Risk labels on the
  * confirm dialog (replacing the input-marker path from FEATURE_066).
  */
-signals?: readonly ToolCallSignal[]) => Promise<AutoModeAskUserVerdict>;
+signals?: readonly ToolCallSignal[], diagnostics?: AutoModeDecisionDiagnostics) => Promise<AutoModeAskUserVerdict>;
 interface AutoModeRulesContext {
     readonly projectRoot: string;
     readonly executionCwd: string;
@@ -498,6 +657,15 @@ interface AutoModeGuardrailConfig {
      * paths. See `AutoModeAskUser` for semantics.
      */
     readonly askUser?: AutoModeAskUser;
+    /**
+     * Runtime-owned Accept-edits fallback used only when classifier
+     * infrastructure or its response contract fails.
+     */
+    readonly allowOnClassifierFailure?: (call: RunnerToolCall) => boolean | Promise<boolean>;
+    /** Whether ordinary bash calls can be enforced by an OS workspace sandbox. */
+    readonly workspaceShellSandboxAvailable?: boolean;
+    /** Mint one exact bash call for workspace-sandboxed execution. */
+    readonly admitWorkspaceSandboxCall?: (call: RunnerToolCall, review: AutoModePermissionReview) => void;
     /**
      * Runtime-owned deterministic Tier-2 evaluator. It is injected rather than
      * implemented in @kodax/coding because canonical path and shell-AST helpers
@@ -544,12 +712,11 @@ interface AutoModeGuardrailConfig {
      */
     readonly getCostTracker?: () => CostTracker | undefined;
     readonly setCostTracker?: (t: CostTracker) => void;
-    /** Optional logger for engine-downgrade and config warnings. */
+    /** Optional logger for classifier-health and configuration warnings. */
     readonly log?: (level: 'info' | 'warn', msg: string) => void;
     /**
-     * Fired whenever the active engine changes — both on automatic downgrades
-     * (denial threshold / circuit breaker) AND on manual `setEngine(...)`
-     * calls. UI surfaces (status bar engine indicator, slash-command
+     * Fired whenever the active engine changes through `setEngine(...)`.
+     * UI surfaces (status bar engine indicator, slash-command
      * confirmations) subscribe here so the displayed engine stays in sync
      * with the guardrail's internal state without the user having to trigger
      * another mode toggle just to refresh the bar.
@@ -558,8 +725,8 @@ interface AutoModeGuardrailConfig {
     /**
      * Optional shared state for subagent threshold-bypass defense
      * (design doc "防绕阈值"). When supplied, the parent and child
-     * guardrails reference the SAME object — engine downgrades and
-     * tracker advances are visible across the session boundary.
+     * guardrails reference the SAME object — engine changes and tracker
+     * advances are visible across the session boundary.
      */
     readonly sharedState?: AutoModeSharedState;
     /**
@@ -625,8 +792,8 @@ interface AutoModeGuardrailConfig {
      * (late-verdict adoption). The window therefore only controls "fast path
      * vs wait", never "dialog vs no dialog": an `allow` never surfaces a
      * confirm dialog regardless of how long the classifier takes, and only an
-     * `escalate` verdict (explicit LLM escalation, classifier timeout, or infra
-     * error — all mapped to `escalate` by classify()) reaches the user.
+     * confirmation/failure verdict reaches the configured user or Accept-edits
+     * fallback path.
      * The background classifier's cost is settled exactly once inside
      * classify(), so awaiting it after window expiry does not double-count.
      *
@@ -645,6 +812,7 @@ interface AutoModeGuardrailConfig {
  */
 interface AutoModeStats {
     readonly engine: AutoModeEngine;
+    readonly classifierHealth: 'healthy' | 'degraded';
     readonly classifierModel?: string;
     readonly denials: DenialTracker;
     readonly breaker: CircuitBreaker;
@@ -656,19 +824,17 @@ interface AutoModeToolGuardrail extends ToolGuardrail {
     getStats(): AutoModeStats;
     /**
      * Manually set the engine. Used by `/auto-engine` slash command to flip
-     * back to 'llm' after an automatic downgrade or to flip to 'rules' for
-     * manual testing. The downgrade thresholds still operate normally — a
-     * subsequent threshold cross will downgrade again.
+     * between 'llm' and 'rules' after an explicit user or host choice.
      */
     setEngine(engine: AutoModeEngine): void;
     /** Test-only alias for getEngine(). Backward-compat for test files. */
     getEngineForTest(): AutoModeEngine;
     /** Test-only alias for getStats(). Backward-compat for test files. */
     getStatsForTest(): AutoModeStats;
-    /** Test-only override: swap the provider mid-test (for downgrade scenarios). */
+    /** Test-only override: swap the provider mid-test. */
     setProviderForTest(provider: KodaXBaseProvider): void;
 }
 declare function createAutoModeToolGuardrail(config: AutoModeGuardrailConfig): AutoModeToolGuardrail;
 
-export { recordBlock as $, CONSECUTIVE_THRESHOLD as C, ERROR_THRESHOLD as E, checkAbsoluteDeny as I, collectAllSignals as J, computeRulesFingerprint as M, createAutoModeToolGuardrail as N, createCircuitBreaker as O, createDenialTracker as P, formatAgentsForPrompt as Q, getKodaxGlobalDir as U, loadAgentsFiles as V, WINDOW_MS as W, loadAutoRules as X, parseAutoRules as Y, readTrustState as Z, recordAllow as _, recordError as a0, shouldFallback$1 as a1, shouldFallback as a2, trustProjectRules as a3, CUMULATIVE_THRESHOLD as u };
-export type { AbsoluteDenyCheck as A, RulesLoadResult as B, DenialTracker as D, SkippedRulesSource as F, ToolCallSignal as G, TrustState as H, KodaXMcpConnectMode as K, LoadAgentsOptions as L, RulesLoadError as R, SignalCollector as S, TierZeroPatternId as T, AbsoluteDenyMatch as a, AbsoluteDenyMiss as b, AbsoluteDenyResult as c, AgentsFile as d, AutoModeAskUser as e, AutoModeAskUserVerdict as f, AutoModeCallAnalyzer as g, AutoModeEngine as h, AutoModeGuardrailConfig as i, AutoModePermissionBoundary as j, AutoModePermissionOperation as k, AutoModePermissionReview as l, AutoModePermissionTarget as m, AutoModeRulesContext as n, AutoModeRulesDecision as o, AutoModeRulesEvaluator as p, AutoModeSharedState as q, AutoModeStats as r, AutoModeToolGuardrail as s, AutoRules as t, CircuitBreaker as v, KodaXMcpServerConfig as w, KodaXMcpServersConfig as x, KodaXMcpTransport as y, LoadedRulesSource as z };
+export { createAutoModeToolGuardrail as $, CONSECUTIVE_THRESHOLD as C, DEFAULT_CLASSIFIER_TIMEOUT_MS as F, ERROR_THRESHOLD as H, WINDOW_MS as W, checkAbsoluteDeny as X, classify as Y, collectAllSignals as Z, computeRulesFingerprint as _, createCircuitBreaker as a0, createDenialTracker as a1, formatAgentsForPrompt as a2, getKodaxGlobalDir as a3, loadAgentsFiles as a4, loadAutoRules as a5, parseAutoRules as a6, readTrustState as a7, recordAllow as a8, recordBlock as a9, recordError as aa, shouldFallback$1 as ab, shouldFallback as ac, trustProjectRules as ad, CUMULATIVE_THRESHOLD as v };
+export type { AbsoluteDenyCheck as A, ClassifierToolProjectionResolver as B, ClassifyDecision as D, ClassifyOptions as E, DenialTracker as G, KodaXMcpServerConfig as I, KodaXMcpServersConfig as J, KodaXMcpConnectMode as K, KodaXMcpTransport as L, LoadAgentsOptions as M, LoadedRulesSource as N, RulesLoadResult as O, PermissionIntentEvidence as P, SkippedRulesSource as Q, RulesLoadError as R, SignalCollector as S, TierZeroPatternId as T, ToolCallSignal as U, TrustState as V, AbsoluteDenyMatch as a, AbsoluteDenyMiss as b, AbsoluteDenyResult as c, AgentsFile as d, AutoModeAskUser as e, AutoModeAskUserVerdict as f, AutoModeCallAnalyzer as g, AutoModeDecisionDiagnostics as h, AutoModeEngine as i, AutoModeGuardrailConfig as j, AutoModePermissionBoundary as k, AutoModePermissionOperation as l, AutoModePermissionReview as m, AutoModePermissionTarget as n, AutoModeRulesContext as o, AutoModeRulesDecision as p, AutoModeRulesEvaluator as q, AutoModeSharedState as r, AutoModeStats as s, AutoModeToolGuardrail as t, AutoRules as u, CircuitBreaker as w, ClassifierAttemptDiagnostics as x, ClassifierAttemptOutcome as y, ClassifierFailureKind as z };

package/dist/types-chunks/{history-retrieval.d-BKTJIrVd.d.ts → history-retrieval.d-DtCy7x64.d.ts}

@@ -1,5 +1,5 @@
-import { k as KodaXMessage } from './types.d-CSmF0t0n.js';
-import { bM as KodaXSessionLineage } from './types.d-sRLugmjy.js';
+import { k as KodaXMessage } from './types.d-DIpZJKUl.js';
+import { bU as KodaXSessionLineage } from './types.d-BA-Jwpfs.js';
 
 type KodaXSessionHistoryScope = 'compacted' | 'all';
 type KodaXSessionHistorySource = 'user' | 'assistant' | 'system' | 'tool' | 'child_task';

package/dist/types-chunks/{integration-config.d-ojG4swOP.d.ts → integration-config.d-BNowXE8k.d.ts}

@@ -1,7 +1,7 @@
 import { b as McpServersConfig } from './config.d-CJy1WENT.js';
 
-type IntegrationDomain = 'mcp' | 'a2a' | 'extensions';
-type IntegrationConfigSource = 'user' | 'legacy-user' | 'default';
+type IntegrationDomain = "mcp" | "a2a" | "extensions";
+type IntegrationConfigSource = "user" | "legacy-user" | "default";
 interface McpIntegrationDocument {
     readonly version: 1;
     readonly servers: McpServersConfig;
@@ -19,7 +19,7 @@ interface IntegrationConfigSnapshot<T extends object> {
     readonly loadedAt: string;
 }
 interface IntegrationConfigDiagnostic {
-    readonly code: 'invalid-config' | 'activation-failed' | 'watcher-degraded';
+    readonly code: "invalid-config" | "activation-failed" | "watcher-degraded";
     readonly message: string;
     readonly time: string;
 }
@@ -33,7 +33,7 @@ interface IntegrationConfigStatus {
     readonly watching: boolean;
 }
 interface LegacyIntegrationMigrationDomainPlan {
-    readonly action: 'create' | 'none';
+    readonly action: "create" | "none";
     readonly entries: number;
     readonly destination: string;
     readonly reason?: string;
@@ -44,9 +44,12 @@ interface LegacyIntegrationMigrationPlan {
     readonly warnings: readonly string[];
 }
 interface LegacyIntegrationMigrationResult extends LegacyIntegrationMigrationPlan {
-    readonly applied: readonly ('mcp' | 'extensions')[];
+    readonly applied: readonly ("mcp" | "extensions")[];
     readonly cleanedLegacy: boolean;
 }
+declare class IntegrationConfigConflictError extends Error {
+    constructor(file: string, expected: string | undefined, actual: string | undefined);
+}
 type IntegrationDocumentValidator<T extends object> = (value: unknown) => T;
 type IntegrationConfigListener<T extends object> = (snapshot: IntegrationConfigSnapshot<T>, previous: IntegrationConfigSnapshot<T> | undefined) => Promise<void> | void;
 type IntegrationReloadResult<T extends object> = {
@@ -71,7 +74,8 @@ declare function writeIntegrationDocument<T extends object>(input: {
     readonly configHome: string;
     readonly document: T;
     readonly validate: IntegrationDocumentValidator<T>;
-    readonly expectedRevision?: string;
+    /** `null` means the destination must still be absent when committed. */
+    readonly expectedRevision?: string | null;
 }): IntegrationConfigSnapshot<T>;
 declare class IntegrationConfigController<T extends object> {
     #private;
@@ -80,6 +84,17 @@ declare class IntegrationConfigController<T extends object> {
         readonly configHome: string;
         readonly validate: IntegrationDocumentValidator<T>;
         readonly read: () => IntegrationConfigSnapshot<T>;
+        /**
+         * Optional legacy source consulted only while the split domain file is
+         * absent. It participates in both filesystem watching and polling.
+         */
+        readonly fallbackPath?: string;
+        /**
+         * Explicit fail-closed document used only when the first disk read is
+         * invalid. The diagnostic remains visible and a later valid file replaces
+         * this snapshot through the normal reload path.
+         */
+        readonly coldStartDefault?: T;
     });
     initialize(): Promise<IntegrationConfigSnapshot<T>>;
     snapshot(): IntegrationConfigSnapshot<T> | undefined;
@@ -91,5 +106,5 @@ declare class IntegrationConfigController<T extends object> {
     close(): void;
 }
 
-export { IntegrationConfigController as I, parseMcpIntegrationDocument as j, planLegacyIntegrationMigration as k, readMcpIntegration as l, migrateLegacyIntegrationConfig as m, resolveIntegrationConfigPath as n, parseExtensionsIntegrationDocument as p, readExtensionsIntegration as r, writeIntegrationDocument as w };
-export type { ExtensionsIntegrationDocument as E, LegacyIntegrationMigrationDomainPlan as L, McpIntegrationDocument as M, IntegrationConfigDiagnostic as a, IntegrationConfigListener as b, IntegrationConfigSnapshot as c, IntegrationConfigSource as d, IntegrationConfigStatus as e, IntegrationDocumentValidator as f, IntegrationDomain as g, LegacyIntegrationMigrationPlan as h, LegacyIntegrationMigrationResult as i };
+export { IntegrationConfigConflictError as I, IntegrationConfigController as a, parseMcpIntegrationDocument as k, planLegacyIntegrationMigration as l, migrateLegacyIntegrationConfig as m, readMcpIntegration as n, resolveIntegrationConfigPath as o, parseExtensionsIntegrationDocument as p, readExtensionsIntegration as r, writeIntegrationDocument as w };
+export type { ExtensionsIntegrationDocument as E, LegacyIntegrationMigrationDomainPlan as L, McpIntegrationDocument as M, IntegrationConfigDiagnostic as b, IntegrationConfigListener as c, IntegrationConfigSnapshot as d, IntegrationConfigSource as e, IntegrationConfigStatus as f, IntegrationDocumentValidator as g, IntegrationDomain as h, LegacyIntegrationMigrationPlan as i, LegacyIntegrationMigrationResult as j };

package/dist/types-chunks/{public-api.d-CX4B11qY.d.ts → public-api.d-B3AohsxN.d.ts}

@@ -1,7 +1,6 @@
-import { a as BashPrefixExtractor, t as KodaXAgentMode } from './bash-prefix-extractor.d-r1beOESM.js';
-import { F as KodaXReasoningMode, k as KodaXMessage, S as KodaXTaskResultMetadata } from './types.d-CSmF0t0n.js';
-import { p as LearningSurfaceSnapshot$1, n as LearningQuery, m as LearningPage, b as LearnedCapabilityRecord, j as LearningEvent, o as LearningSubscribeOptions } from './center-types.d-BBT122uJ.js';
-import { bH as KodaXSessionData, bM as KodaXSessionLineage, bR as KodaXSessionNavigationOptions, bT as KodaXSessionRuntimeInfo, bV as KodaXSessionStorage, i as AgentActorSnapshot, aQ as CompactionReport, by as KodaXJsonValue } from './types.d-sRLugmjy.js';
+import { a as BashPrefixExtractor, t as KodaXAgentMode } from './bash-prefix-extractor.d-uAe2Oqda.js';
+import { F as KodaXReasoningMode, k as KodaXMessage, S as KodaXTaskResultMetadata } from './types.d-DIpZJKUl.js';
+import { cP as LearningSurfaceSnapshot$1, cK as LearningQuery, cJ as LearningPage, cm as LearnedCapabilityRecord, cF as LearningEvent, cO as LearningSubscribeOptions, bP as KodaXSessionData, bU as KodaXSessionLineage, bZ as KodaXSessionNavigationOptions, b$ as KodaXSessionRuntimeInfo, c1 as KodaXSessionStorage, j as AgentActorSnapshot, aU as CompactionReport, bF as KodaXJsonValue } from './types.d-BA-Jwpfs.js';
 
 /**
  * TextBuffer - Text buffer management class - 文本缓冲区管理类
@@ -904,6 +903,7 @@ declare function createMemorySessionStorage(): SessionStorage;
 
 declare class FileSessionStorage implements KodaXSessionStorage {
     private readonly sessionsDir;
+    private readonly configHome;
     /**
      * v0.7.46 — optional explicit project cwd for in-process embedders
      * (KodaX Space) serving multiple projects from a single runtime.
@@ -927,6 +927,7 @@ declare class FileSessionStorage implements KodaXSessionStorage {
     private readonly emitMismatchWarnings;
     constructor(opts?: {
         sessionsDir?: string;
+        configHome?: string;
         cwd?: string;
         emitMismatchWarnings?: boolean;
     });
@@ -934,6 +935,7 @@ declare class FileSessionStorage implements KodaXSessionStorage {
     getSessionsDir(): string;
     private writeQueues;
     private serializedWrite;
+    private sessionWriteLockPath;
     private appendState;
     private sessionDirCache;
     private projectJsonWritten;
@@ -969,9 +971,13 @@ declare class FileSessionStorage implements KodaXSessionStorage {
     private shouldRunMaintenance;
     private runMaintenance;
     save(id: string, data: SessionData): Promise<void>;
+    mutateLineage(id: string, mutation: (lineage: KodaXSessionLineage) => KodaXSessionLineage): Promise<boolean>;
     /** F270/F269 owner mutation: CAS-update only the Actor section of a session snapshot. */
     saveActorSnapshot(id: string, snapshot: AgentActorSnapshot, expectedRevision: number): Promise<void>;
+    /** Read Session data without recovery writes or append-watermark mutation. */
+    peek(id: string): Promise<SessionData | null>;
     load(id: string): Promise<SessionData | null>;
+    isArchived(id: string): Promise<boolean>;
     getLineage(id: string): Promise<KodaXSessionLineage | null>;
     loadFullLineage(id: string): Promise<KodaXSessionLineage | null>;
     setActiveEntry(id: string, selector: string, options?: {
@@ -1016,26 +1022,43 @@ declare class FileSessionStorage implements KodaXSessionStorage {
      * (never orphans the sidecar). No-op + returns false for a missing session.
      */
     archive(id: string): Promise<boolean>;
+    archiveOwned(id: string, ownerId: string): Promise<boolean>;
+    private archiveWithActorOwner;
     /** Restore an archived session back into its project directory. */
     unarchive(id: string): Promise<boolean>;
+    unarchiveOwned(id: string, ownerId: string): Promise<boolean>;
+    private unarchiveWithActorOwner;
     /**
      * Move a session + its island sidecar between two directories. Propagates a
      * non-ENOENT rename error (e.g. Windows file-in-use) so a partial move is
      * surfaced as a failure instead of silently splitting main + sidecar.
      */
     private movePair;
+    /**
+     * Remove a complete Session file set without exposing a partial failure.
+     * Every canonical path is first renamed to an ignored tombstone. A staging
+     * failure rolls all prior renames back; only after the full set is hidden do
+     * we unlink tombstones. A locked tombstone is recoverable and no longer
+     * represents a live Session, so cleanup failure is diagnostic rather than a
+     * failed logical deletion.
+     */
+    private removeFileSetAtomically;
+    private assertActorFileOwner;
     delete(id: string): Promise<void>;
+    /** Strict deletion path for the Runtime that already owns the Actor tree. */
+    deleteOwned(id: string, ownerId: string): Promise<void>;
+    private deleteWithActorOwner;
     deleteAll(gitRoot?: string): Promise<void>;
     /**
-     * Auto-retention: delete session files (`.jsonl` + `.archive.jsonl`) whose
+     * Auto-retention: delete a complete Session file set when its main file
      * mtime is older than `retentionDays`. Modeled on claudecode's
      * `cleanup.ts` (`unlinkIfOld`). Bounds the sessions directory so it never
      * accumulates unboundedly — which is what keeps `list()`'s head-read pass
      * fast (its cost scales with file COUNT, not size). A non-positive /
      * non-finite `retentionDays` disables cleanup (no-op). Best-effort: per-file
-     * errors are swallowed so a single locked/racing file never aborts the
-     * sweep. Returns the number of files removed. mtime-based, so the session
-     * currently being written/resumed (fresh mtime) is never eligible.
+     * errors are isolated so a single locked/racing file never aborts the
+     * sweep. Durable Actor owners and non-terminal turns are never eligible.
+     * Returns the number of files removed.
      */
     cleanupOldSessions(retentionDays: number): Promise<number>;
 }
@@ -1308,6 +1331,10 @@ type DeleteSessionResult = {
             startedAt: number;
         };
     };
+} | {
+    error: {
+        code: 'delete_failed';
+    };
 };
 /**
  * Delete a session by ID.
@@ -1347,9 +1374,11 @@ declare function watchSessions(cb: WatchSessionsCallback): {
  * that directory instead of the module-load-frozen `KODAX_SESSIONS_DIR`.
  * `listRunningSessions` still consults the agent-config-home instances
  * directory (sibling-process awareness is not scoped per sessions dir).
+ * `configHome` binds rewind/setActive review fencing to the same Runtime owner.
  */
 declare function createSessionManager(opts?: {
     sessionsDir?: string;
+    configHome?: string;
 }): SessionManager;
 
 export { KeypressHandlerPriority as B, DEFAULT_UI_STATE as D, FILE_MODIFICATION_TOOLS as F, MemorySessionStorage as M, PERMISSION_MODES as P, StreamingState as a0, TOOL_STATUS_ICONS as a2, TextBuffer as a3, ToolCallStatus as a9, appendClientNotice as ag, archiveSession as ah, compactSession as ai, computeConfirmTools as aj, createMemorySessionStorage as ak, createSessionManager as al, deleteSession as am, forkSession as an, isPermissionMode as ao, listRunningSessions as ap, listSessions as aq, loadFullTranscript as ar, loadSession as as, normalizePermissionMode as at, permissionModeDisplayName as au, rewindSession as av, setActiveEntry as aw, unarchiveSession as ax, watchSessions as ay, FileSessionStorage as j };