@kodax-ai/kodax 0.7.78 → 0.7.79

package/dist/types-chunks/{guardrail.d-CXDYRgZ3.d.ts → guardrail.d-1NLSFTyN.d.ts}

@@ -1,10 +1,9 @@
 import { b as McpServersConfig, M as McpConnectMode, a as McpServerConfig, c as McpTransportKind } from './config.d-CJy1WENT.js';
-import { K as KodaXBaseProvider } from './base.d-4e74xDdy.js';
+import { K as KodaXBaseProvider } from './base.d-DxG0m09Z.js';
 import { a as CostTracker } from './cost-tracker.d-BeaenODW.js';
-import { dT as RunnerToolCall } from './types.d-BA-Jwpfs.js';
-import { d as ToolGuardrail } from './guardrail.d-BRE_ErEj.js';
-import { k as KodaXMessage } from './types.d-DIpZJKUl.js';
-import { S as SideQueryDiagnostics } from './side-query.d-DTuLPcC5.js';
+import { e1 as RunnerToolCall, ey as ToolGuardrail } from './controller.d-RGV7Pjv9.js';
+import { k as KodaXMessage } from './types.d-CgrXrFrq.js';
+import { S as SideQueryDiagnostics } from './side-query.d-CP1LiRiH.js';
 
 /**
  * FEATURE_200 Phase F (v0.7.45) — MCP domain types extracted from types.ts.
@@ -54,6 +53,50 @@ declare function loadAgentsFiles(options?: LoadAgentsOptions): AgentsFile[];
  */
 declare function formatAgentsForPrompt(files: AgentsFile[]): string;
 
+/**
+ * Parse the auto-mode classifier's output — FEATURE_092 Phase 2b.3 (v0.7.33).
+ *
+ * Preferred format:
+ *   <decision>allow|ask</decision><hazard>...</hazard><reason>...</reason>
+ * Legacy `<block>` output remains parseable during the protocol rollout so a
+ * valid decision from an older prompt/provider cache is not misreported as an
+ * infrastructure failure.
+ *
+ * Robustness:
+ *   - case-insensitive yes/no
+ *   - whitespace inside / around tags tolerated
+ *   - one valid decision is authoritative; hazard/reason defects are retained
+ *     as warnings and never become a second decision mechanism
+ *   - reasons longer than 500 chars are truncated (defense against
+ *     pathological model outputs)
+ *   - missing, invalid, duplicate, or mixed decisions remain contract errors;
+ *     surrounding prose and malformed auxiliary fields are diagnostic only
+ */
+type ClassifierDecision = {
+    readonly kind: 'block';
+    readonly reason: string;
+    readonly hazard?: ClassifierHazard;
+    readonly protocol: ClassifierProtocol;
+    readonly warnings?: readonly ClassifierOutputWarningCode[];
+} | {
+    readonly kind: 'allow';
+    readonly reason: string;
+    readonly hazard?: 'none';
+    readonly protocol: ClassifierProtocol;
+    readonly warnings?: readonly ClassifierOutputWarningCode[];
+} | {
+    readonly kind: 'unparseable';
+    readonly raw: string;
+    readonly failureCode: ClassifierParseFailureCode;
+    readonly observedProtocol: ClassifierObservedProtocol;
+};
+type ClassifierProtocol = 'structured_v2' | 'legacy_v1';
+type ClassifierObservedProtocol = ClassifierProtocol | 'unknown';
+type ClassifierParseFailureCode = 'missing_decision' | 'invalid_decision' | 'ambiguous_decision' | 'missing_hazard' | 'invalid_hazard' | 'decision_hazard_conflict' | 'decision_reason_conflict' | 'missing_reason' | 'structured_format_violation' | 'legacy_format_violation';
+type ClassifierOutputWarningCode = Exclude<ClassifierParseFailureCode, 'missing_decision' | 'invalid_decision' | 'ambiguous_decision'>;
+type ClassifierHazard = 'none' | 'protected_read' | 'outside_write' | 'destructive_loss' | 'credential_exposure' | 'network_exfiltration' | 'remote_code_execution' | 'dependency_poisoning' | 'production_change' | 'privilege_change' | 'intent_conflict';
+declare function parseClassifierOutput(raw: string): ClassifierDecision;
+
 /**
  * Auto-Mode Rules Loader — FEATURE_092 Phase 2b.2 (v0.7.33).
  *
@@ -72,11 +115,15 @@ declare function formatAgentsForPrompt(files: AgentsFile[]): string;
  *
  * Schema (each field optional, defaults to []):
  *   {
- *     "allow":       string[],   // patterns the classifier defaults to allowing
- *     "soft_deny":   string[],   // patterns the classifier defaults to blocking
+ *     "allow":       string[],   // contextual examples supporting an allow
+ *     "soft_deny":   string[],   // contextual cautions for the classifier to inspect
  *     "environment": string[]    // background context the classifier sees verbatim
  *   }
  *
+ * These strings are classifier context, never independent verdicts. In
+ * Auto[LLM], even `soft_deny` cannot create an approval class beyond the two
+ * evidence-based ask classes defined by the classifier contract.
+ *
  * Merge: layers concatenated in order (user → project → local). Identical
  * strings deduplicated by stable insertion (later layers win position only
  * when the string is unique per layer).
@@ -136,7 +183,7 @@ declare function loadAutoRules(opts: LoadAutoRulesOptions): Promise<RulesLoadRes
  *
  * Mechanical pattern matches over a tool call. Signals are NOT verdicts;
  * the classifier consumes them as informational input alongside transcript
- * + user rules and produces the final decision (allow / block / escalate).
+ * + user rules and produces the final Auto[LLM] decision (allow / ask).
  *
  * Two invariants the producers must hold:
  *
@@ -150,10 +197,9 @@ declare function loadAutoRules(opts: LoadAutoRulesOptions): Promise<RulesLoadRes
  *      so the classifier can weight signals, but the verdict is not encoded
  *      here.
  *
- * Tier 0 (absolute deny) is a separate module — signals are pre-verdict
- * material consumed by Tier 2 (LLM classifier). The two paths are not
- * coupled: Tier 0 catches a fixed catastrophic-pattern set; signals
- * describe a wider surface for the classifier to reason about.
+ * The historical Tier 0 detector is a separate module, but its matches are
+ * also pre-verdict facts in Auto[LLM]. Only explicit Auto[Rules] treats that
+ * detector as a legacy approval gate.
  *
  * Design ref: ADR-025, FEATURE_158 (docs/features/v0.7.39.md).
  */
@@ -248,6 +294,12 @@ interface PermissionIntentEvidence {
     /** Latest genuine user request, kept separate as the authoritative intent. */
     readonly currentUserContent?: string;
     readonly currentUserContentTruncated?: boolean;
+    /** Runtime-delegated task context; informative, never a replacement for root authority. */
+    readonly delegatedObjective?: string;
+    readonly delegatedObjectiveTruncated?: boolean;
+    readonly bindingConstraints?: readonly string[];
+    readonly scopeHint?: string;
+    readonly readOnly?: boolean;
     readonly content: string;
     readonly sourceBytes: number;
     readonly includedBytes: number;
@@ -371,6 +423,9 @@ interface ClassifierAttemptDiagnostics {
     readonly attempt: number;
     readonly outcome: ClassifierAttemptOutcome;
     readonly diagnostics?: SideQueryDiagnostics;
+    readonly observedProtocol?: ClassifierObservedProtocol;
+    readonly parseFailureCode?: ClassifierParseFailureCode | 'tool_use';
+    readonly outputWarnings?: readonly ClassifierOutputWarningCode[];
 }
 interface ClassifyDecisionDetails {
     readonly reason: string;
@@ -389,16 +444,19 @@ type ClassifyDecision = ({
 /**
  * The deadline includes connection setup, provider-side queueing, inference,
  * and any Retry-After/backoff handled by the provider adapter. Keep it bounded
- * so infrastructure failure degrades to an explicit user decision.
+ * so infrastructure failure reaches the configured Accept-edits fallback.
  */
-declare const DEFAULT_CLASSIFIER_TIMEOUT_MS = 20000;
+declare const DEFAULT_CLASSIFIER_TIMEOUT_MS = 30000;
+/** The classifier returns three short XML tags; a coding-turn-sized budget is wasteful. */
+declare const CLASSIFIER_MAX_OUTPUT_TOKENS = 256;
 declare function classify(opts: ClassifyOptions): Promise<ClassifyDecision>;
 
 /**
  * Denial Tracker — FEATURE_092 Phase 2b.4 (v0.7.33).
  *
  * Tracks classifier blocks per session. When either threshold is crossed,
- * the auto-mode engine downgrades from `llm` to `rules` (mode stays `auto`).
+ * threshold state is exposed for diagnostics and does not mutate the selected
+ * Auto engine.
  *
  *   - 3 consecutive blocks → likely an unproductive loop (agent not adapting)
  *   - 20 cumulative blocks → broader classifier-noise pattern in this session
@@ -424,8 +482,9 @@ declare function shouldFallback$1(t: DenialTracker): boolean;
  *
  * Sliding-window error counter for classifier failures (timeouts, 5xx, 429,
  * unparseable outputs). When ≥ 5 errors land within a 10-minute window, the
- * auto-mode engine downgrades from `llm` to `rules` (mode stays `auto`) so
- * the user is not blocked by a degraded classifier path.
+ * callers temporarily skip classifier calls and apply the Accept-edits
+ * failure boundary. The selected Auto engine remains `llm`; health state is
+ * diagnostic, not a mode change.
  *
  * Pure functional API: each operation returns a new breaker. No mutation.
  * Memory bound: stale timestamps are pruned on each recordError call so
@@ -441,20 +500,15 @@ declare function recordError(b: CircuitBreaker, now: number): CircuitBreaker;
 declare function shouldFallback(b: CircuitBreaker, now: number): boolean;
 
 /**
- * Tier 0 — Absolute Denylist — FEATURE_158 Step 4 (v0.7.39).
- *
- * The narrowest possible set of catastrophic patterns that must NEVER reach
- * the LLM classifier (which is fallible / can be prompt-injected). Per
- * ADR-025: every entry here must satisfy BOTH gates:
+ * Historical Tier 0 high-impact pattern detector — FEATURE_158 Step 4.
  *
- *   (a) "is there any legitimate context in which this should be allowed?"
- *       — answer must be **no**.
- *   (b) "could the LLM be convinced to allow it under prompt injection?"
- *       — answer must be **yes** (otherwise classifier is sufficient).
+ * The exported names remain source-compatible with FEATURE_158. Auto[LLM]
+ * now treats matches as deterministic facts for the classifier, whose
+ * decision is final. Explicit Auto[Rules] mode retains the legacy approval
+ * gate. The narrow list still identifies high-impact operations worth
+ * describing precisely:
  *
- * The 5-item list is **frozen** by ADR-025; adding entries requires a new
- * ADR addendum answering (a)+(b) again. Removing entries requires evidence
- * of high-volume false-positive friction.
+ * The detector must not expand into a second Auto[LLM] approval policy.
  *
  * Patterns:
  *
@@ -462,7 +516,7 @@ declare function shouldFallback(b: CircuitBreaker, now: number): boolean;
  *                        / -fr variants). Excludes `rm -rf /tmp/foo` (which
  *                        is a `dangerous_pattern` signal but reaches LLM).
  *   2. mkfs_or_format  — `mkfs.* /dev/sd*`, `fdisk /dev/sd*`, `format C:`.
- *                        Block formatting any disk device.
+ *                        Identifies formatting of a disk device.
  *   3. dd_disk_write   — `dd of=/dev/sd*` (raw-disk write). Excludes
  *                        `dd of=test.bin` (file write — reaches LLM as
  *                        dangerous_pattern signal).
@@ -470,13 +524,12 @@ declare function shouldFallback(b: CircuitBreaker, now: number): boolean;
  *   5. user_kodax_write — write/edit to any path under `~/.kodax/`
  *                        (credentials zone — internal kodax config writes
  *                        use the TypeScript API, not bash/tools, so the
- *                        only path here is LLM-emitted shell which is
- *                        always wrong).
+ *                        only path here is normally an LLM-emitted shell).
  *
  * Layer note: bash-level `~/.kodax/` writes (e.g. `echo x > ~/.kodax/y`)
  * require AST path-extraction which lives in `@kodax/repl`. The REPL-side
- * collector wired through `extraCollectors` (Step 7) escalates those to
- * Tier 0 by emitting a synthetic `user_kodax_write` denial via the same
+ * collector wired through `extraCollectors` (Step 7) identifies those as
+ * Tier 0 by emitting a synthetic `user_kodax_write` match via the same
  * `AbsoluteDenyResult` shape. This module handles the file-tool path
  * directly (the most common attack vector) and the four command-string
  * patterns that don't need path extraction.
@@ -494,13 +547,15 @@ interface AbsoluteDenyMiss {
 type AbsoluteDenyResult = AbsoluteDenyMatch | AbsoluteDenyMiss;
 type AbsoluteDenyCheck = (call: RunnerToolCall, projectRoot: string, executionCwd: string) => AbsoluteDenyResult;
 /**
- * Check a tool call against the Tier 0 absolute denylist. Returns the
- * first matching pattern, or `{ denied: false }` if no pattern fires.
+ * Check a tool call against the historical Tier 0 pattern list. Returns the
+ * first matching pattern, or `{ denied: false }` if no pattern fires. A match
+ * is classifier evidence in Auto[LLM] and a legacy approval gate only in
+ * explicit Auto[Rules].
  *
  * Order is deterministic — patterns checked in the order defined above.
  * Multiple matches would be possible (e.g. `rm -rf / ; :(){...};:`) but
- * we return the first hit since the guardrail acts on `denied: true`
- * regardless and the reason string is one-shot.
+ * we return the first hit because one precise fact is sufficient for the
+ * classifier and the reason string is one-shot.
  *
  * **Pure**: deterministic given (call, projectRoot, stable env).
  * **Fast**: ~5 regex tests + 1-2 string ops; safe to run on every
@@ -518,12 +573,14 @@ declare function checkAbsoluteDeny(call: RunnerToolCall, projectRoot: string, ex
  *
  * Decision flow (per design doc "三层权限金字塔"):
  *
- *   1. Tier-0 deterministic critical match   → user confirmation
- *   2. exact safe read/workspace-temp effect → allow (zero token cost)
- *   3. Tool projection is '' (Tier 1)        → allow
- *   4. Engine is rules → deterministic Tier 2, otherwise user confirms
- *   5. degraded classifier infrastructure    → Accept-edits fallback
- *   6. classify(...) sideQuery
+ *   1. exact safe read/workspace-temp effect → allow (zero token cost)
+ *   2. Explicitly exempt empty projection    → allow
+ *   3. Static/high-impact pattern match      → classifier facts in LLM;
+ *                                               legacy gate in explicit Rules
+ *   4. Recoverable projection/analyzer fault → safe facts to classifier
+ *   5. Engine is rules → deterministic Tier 2, otherwise user confirms
+ *   6. degraded classifier infrastructure    → Accept-edits fallback
+ *   7. classify(...) sideQuery (sole Auto[LLM] decision owner)
  *        allow                                → allow (record allow → reset consecutive)
  *        confirm                              → user confirmation (record concern)
  *        failure                              → Accept-edits fallback (record error)
@@ -555,9 +612,10 @@ interface AutoModeSharedState {
 /**
  * User answer for an escalated tool-call. The guardrail translates this into
  * the actual `GuardrailVerdict` returned to the Runner. `'block'` preserves
- * the original escalation reason as the verdict reason so downstream consumers
- * see why the tool was blocked. `'timeout'` reports that the action was not
- * executed and gives the main model a bounded recovery instruction.
+ * a clear call-local user-declined result while retaining the review reason.
+ * It does not create a persistent denial: a safer follow-up is reviewed as a
+ * new call. `'timeout'` reports that the action was not executed and gives the
+ * main model a bounded recovery instruction.
  */
 type AutoModeAskUserVerdict = 'allow' | 'block' | 'timeout';
 interface AutoModeDecisionDiagnostics {
@@ -589,6 +647,13 @@ interface AutoModeRulesContext {
     readonly projectRoot: string;
     readonly executionCwd: string;
     readonly signals: readonly ToolCallSignal[];
+    /**
+     * Whether shell environment aliases such as `%TEMP%` and `$env:TEMP`
+     * are known to resolve from this Node process. Runtime shell profiles can
+     * rewrite them before execution, so embedders must set this to false when
+     * that equivalence cannot be proven.
+     */
+    readonly trustProcessEnvironmentPathExpansion?: boolean;
 }
 type AutoModePermissionBoundary = 'workspace' | 'system-temp' | 'outside-workspace' | 'protected' | 'unresolved';
 interface AutoModePermissionTarget {
@@ -675,7 +740,8 @@ interface AutoModeGuardrailConfig {
     readonly evaluateRulesCall?: AutoModeRulesEvaluator;
     /**
      * Runtime-owned compact facts used by deterministic read admission and the
-     * LLM permission reviewer. Direct read tools fail closed when this is absent.
+     * LLM permission reviewer. When absent or faulty, direct read tools use a
+     * bounded metadata-only projection and remain LLM-reviewed.
      */
     readonly analyzeCall?: AutoModeCallAnalyzer;
     /**
@@ -739,7 +805,7 @@ interface AutoModeGuardrailConfig {
     readonly initialEngine?: AutoModeEngine;
     /**
      * FEATURE_092 phase 2b.7b slice C: classifier sideQuery timeout in ms.
-     * Defaults to 20_000. Resolved by the REPL from `~/.kodax/config.json`
+     * Defaults to 30_000. Resolved by the REPL from `~/.kodax/config.json`
      * `autoMode.timeoutMs`.
      */
     readonly timeoutMs?: number;
@@ -758,6 +824,11 @@ interface AutoModeGuardrailConfig {
     readonly projectRoot?: string;
     /** Directory used to resolve relative tool paths. Defaults to projectRoot. */
     readonly executionCwd?: string;
+    /**
+     * Set to false when the shell profile or execution contract can rewrite
+     * process-derived path aliases such as `%TEMP%` or `$env:TEMP`.
+     */
+    readonly trustProcessEnvironmentPathExpansion?: boolean;
     /**
      * Override the default signal-collector set. When unset, defaults to
      * `[bashSignalCollector, fileSignalCollector]` — coding-side
@@ -780,7 +851,10 @@ interface AutoModeGuardrailConfig {
      * signal order).
      */
     readonly extraCollectors?: readonly SignalCollector[];
-    /** Layer-owned Tier-0 checks that run after the coding-side frozen list. */
+    /**
+     * Layer-owned high-impact pattern checks. In LLM mode they add classifier
+     * evidence; in explicitly selected Rules mode they retain the legacy gate.
+     */
     readonly extraAbsoluteDenyChecks?: readonly AbsoluteDenyCheck[];
     /**
      * Speculative-classify quiet window (ms). When a classifier promise
@@ -836,5 +910,5 @@ interface AutoModeToolGuardrail extends ToolGuardrail {
 }
 declare function createAutoModeToolGuardrail(config: AutoModeGuardrailConfig): AutoModeToolGuardrail;
 
-export { createAutoModeToolGuardrail as $, CONSECUTIVE_THRESHOLD as C, DEFAULT_CLASSIFIER_TIMEOUT_MS as F, ERROR_THRESHOLD as H, WINDOW_MS as W, checkAbsoluteDeny as X, classify as Y, collectAllSignals as Z, computeRulesFingerprint as _, createCircuitBreaker as a0, createDenialTracker as a1, formatAgentsForPrompt as a2, getKodaxGlobalDir as a3, loadAgentsFiles as a4, loadAutoRules as a5, parseAutoRules as a6, readTrustState as a7, recordAllow as a8, recordBlock as a9, recordError as aa, shouldFallback$1 as ab, shouldFallback as ac, trustProjectRules as ad, CUMULATIVE_THRESHOLD as v };
-export type { AbsoluteDenyCheck as A, ClassifierToolProjectionResolver as B, ClassifyDecision as D, ClassifyOptions as E, DenialTracker as G, KodaXMcpServerConfig as I, KodaXMcpServersConfig as J, KodaXMcpConnectMode as K, KodaXMcpTransport as L, LoadAgentsOptions as M, LoadedRulesSource as N, RulesLoadResult as O, PermissionIntentEvidence as P, SkippedRulesSource as Q, RulesLoadError as R, SignalCollector as S, TierZeroPatternId as T, ToolCallSignal as U, TrustState as V, AbsoluteDenyMatch as a, AbsoluteDenyMiss as b, AbsoluteDenyResult as c, AgentsFile as d, AutoModeAskUser as e, AutoModeAskUserVerdict as f, AutoModeCallAnalyzer as g, AutoModeDecisionDiagnostics as h, AutoModeEngine as i, AutoModeGuardrailConfig as j, AutoModePermissionBoundary as k, AutoModePermissionOperation as l, AutoModePermissionReview as m, AutoModePermissionTarget as n, AutoModeRulesContext as o, AutoModeRulesDecision as p, AutoModeRulesEvaluator as q, AutoModeSharedState as r, AutoModeStats as s, AutoModeToolGuardrail as t, AutoRules as u, CircuitBreaker as w, ClassifierAttemptDiagnostics as x, ClassifierAttemptOutcome as y, ClassifierFailureKind as z };
+export { CLASSIFIER_MAX_OUTPUT_TOKENS as C, DEFAULT_CLASSIFIER_TIMEOUT_MS as M, ERROR_THRESHOLD as O, WINDOW_MS as a1, checkAbsoluteDeny as a2, classify as a3, collectAllSignals as a4, computeRulesFingerprint as a5, createAutoModeToolGuardrail as a6, createCircuitBreaker as a7, createDenialTracker as a8, formatAgentsForPrompt as a9, getKodaxGlobalDir as aa, loadAgentsFiles as ab, loadAutoRules as ac, parseAutoRules as ad, parseClassifierOutput as ae, readTrustState as af, recordAllow as ag, recordBlock as ah, recordError as ai, shouldFallback$1 as aj, shouldFallback as ak, trustProjectRules as al, CONSECUTIVE_THRESHOLD as v, CUMULATIVE_THRESHOLD as w };
+export type { ToolCallSignal as $, AbsoluteDenyCheck as A, ClassifierDecision as B, ClassifierFailureKind as D, ClassifierHazard as E, ClassifierObservedProtocol as F, ClassifierOutputWarningCode as G, ClassifierParseFailureCode as H, ClassifierProtocol as I, ClassifierToolProjectionResolver as J, ClassifyDecision as K, ClassifyOptions as L, DenialTracker as N, KodaXMcpConnectMode as P, KodaXMcpServerConfig as Q, KodaXMcpServersConfig as R, KodaXMcpTransport as S, LoadAgentsOptions as T, LoadedRulesSource as U, PermissionIntentEvidence as V, RulesLoadError as W, RulesLoadResult as X, SignalCollector as Y, SkippedRulesSource as Z, TierZeroPatternId as _, AbsoluteDenyMatch as a, TrustState as a0, AbsoluteDenyMiss as b, AbsoluteDenyResult as c, AgentsFile as d, AutoModeAskUser as e, AutoModeAskUserVerdict as f, AutoModeCallAnalyzer as g, AutoModeDecisionDiagnostics as h, AutoModeEngine as i, AutoModeGuardrailConfig as j, AutoModePermissionBoundary as k, AutoModePermissionOperation as l, AutoModePermissionReview as m, AutoModePermissionTarget as n, AutoModeRulesContext as o, AutoModeRulesDecision as p, AutoModeRulesEvaluator as q, AutoModeSharedState as r, AutoModeStats as s, AutoModeToolGuardrail as t, AutoRules as u, CircuitBreaker as x, ClassifierAttemptDiagnostics as y, ClassifierAttemptOutcome as z };

package/dist/types-chunks/{history-retrieval.d-DtCy7x64.d.ts → history-retrieval.d-BAegI14A.d.ts}

@@ -1,5 +1,5 @@
-import { k as KodaXMessage } from './types.d-DIpZJKUl.js';
-import { bU as KodaXSessionLineage } from './types.d-BA-Jwpfs.js';
+import { k as KodaXMessage } from './types.d-CgrXrFrq.js';
+import { c1 as KodaXSessionLineage } from './controller.d-RGV7Pjv9.js';
 
 type KodaXSessionHistoryScope = 'compacted' | 'all';
 type KodaXSessionHistorySource = 'user' | 'assistant' | 'system' | 'tool' | 'child_task';
@@ -25,6 +25,12 @@ interface KodaXSessionHistorySearchResult {
     revision: string;
     hits: KodaXSessionHistoryHit[];
 }
+/** @internal Cooperative control used by Runtime history reads. */
+interface KodaXSessionHistorySearchControl {
+    readonly revision: string;
+    checkpoint(): void;
+    yieldControl(): Promise<void>;
+}
 interface KodaXSessionHistoryReadOptions {
     entryId: string;
     revision?: string;
@@ -51,7 +57,14 @@ type KodaXSessionHistoryReadResult = {
     citation: string;
 };
 declare function searchSessionHistory(lineage: KodaXSessionLineage, options: KodaXSessionHistorySearchOptions): KodaXSessionHistorySearchResult;
+/** @internal Runtime preflight; kept out of the public package barrels. */
+declare function validateSessionHistorySearchQuery(query: string): void;
+/**
+ * Runtime-facing history search that yields between bounded batches so
+ * timeout/cancel signals can be observed while indexing large transcripts.
+ */
+declare function searchSessionHistoryCooperatively(lineage: KodaXSessionLineage, options: KodaXSessionHistorySearchOptions, control: KodaXSessionHistorySearchControl): Promise<KodaXSessionHistorySearchResult>;
 declare function readSessionHistoryEntry(lineage: KodaXSessionLineage, options: KodaXSessionHistoryReadOptions): KodaXSessionHistoryReadResult;
 
-export { readSessionHistoryEntry as r, searchSessionHistory as s };
+export { searchSessionHistoryCooperatively as g, readSessionHistoryEntry as r, searchSessionHistory as s, validateSessionHistorySearchQuery as v };
 export type { KodaXSessionHistoryHit as K, KodaXSessionHistoryReadOptions as a, KodaXSessionHistoryReadResult as b, KodaXSessionHistoryScope as c, KodaXSessionHistorySearchOptions as d, KodaXSessionHistorySearchResult as e, KodaXSessionHistorySource as f };

package/dist/types-chunks/{oauth-login.d-Bgb4rdLN.d.ts → oauth-login.d-6i-vidxv.d.ts}

@@ -30,6 +30,10 @@ declare class McpAuthRequiredError extends Error {
     constructor(status: number, wwwAuthenticate?: string | undefined);
 }
 type StdioFraming = 'content-length' | 'ndjson';
+declare class McpTransportCleanupIncompleteError extends Error {
+    readonly code: "mcp_cleanup_incomplete";
+    constructor();
+}
 interface McpTransportOptions {
     stdioFraming?: StdioFraming;
     httpResolvedTransport?: 'streamable-http' | 'sse';
@@ -170,5 +174,5 @@ declare function performOAuthLogin(options: PerformOAuthLoginOptions): Promise<O
  */
 declare function loadValidToken(serverId: string): Promise<OAuthToken | undefined>;
 
-export { McpAuthRequiredError as M, McpExpiredSessionError as a, createMcpTransport as f, discoverAuthorizationServerMetadata as g, discoverOAuthEndpoints as h, discoverProtectedResourceMetadata as i, extractInsufficientScope as j, extractResourceMetadataUrl as k, loadValidToken as l, performOAuthLogin as p, registerOAuthClient as r };
-export type { AuthorizationServerMetadata as A, DiscoveredOAuthEndpoints as D, OAuthClientInfo as O, PerformOAuthLoginOptions as P, WwwAuthenticateChallenge as W, McpTransport as b, McpTransportEvents as c, OAuthLoginConsent as d, ProtectedResourceMetadata as e };
+export { McpAuthRequiredError as M, McpExpiredSessionError as a, McpTransportCleanupIncompleteError as c, createMcpTransport as g, discoverAuthorizationServerMetadata as h, discoverOAuthEndpoints as i, discoverProtectedResourceMetadata as j, extractInsufficientScope as k, extractResourceMetadataUrl as l, loadValidToken as m, performOAuthLogin as p, registerOAuthClient as r };
+export type { AuthorizationServerMetadata as A, DiscoveredOAuthEndpoints as D, OAuthClientInfo as O, PerformOAuthLoginOptions as P, WwwAuthenticateChallenge as W, McpTransport as b, McpTransportEvents as d, OAuthLoginConsent as e, ProtectedResourceMetadata as f };