@kodax-ai/kodax 0.7.83 → 0.7.85

package/dist/types-chunks/{guardrail.d-fM3mn4Op.d.ts → guardrail.d-BCkgaWT1.d.ts}

@@ -1,10 +1,10 @@
 import { b as McpServersConfig, M as McpConnectMode, a as McpServerConfig, c as McpTransportKind } from './config.d-CJy1WENT.js';
 import { K as KodaXBaseProvider } from './base.d-DxG0m09Z.js';
 import { a as CostTracker } from './cost-tracker.d-BeaenODW.js';
-import { e2 as RunnerToolCall, ez as ToolGuardrail } from './controller.d-CYNuR2n9.js';
+import { c5 as RunnerToolCall, cB as ToolGuardrail } from './controller.d-Dzxz22X-.js';
 import { k as KodaXMessage } from './types.d-CgrXrFrq.js';
 import { S as SideQueryDiagnostics } from './side-query.d-CP1LiRiH.js';
-import { by as ToolSideEffect } from './bash-prefix-extractor.d-CJM7OY-L.js';
+import { bB as ToolSideEffect } from './bash-prefix-extractor.d-BnZQDirs.js';
 
 /**
  * FEATURE_200 Phase F (v0.7.45) — MCP domain types extracted from types.ts.
@@ -476,18 +476,14 @@ declare function classify(opts: ClassifyOptions): Promise<ClassifyDecision>;
  *                        `dd of=test.bin` (file write — reaches LLM as
  *                        dangerous_pattern signal).
  *   4. fork_bomb       — `:(){ :|:& };:` — denial of service.
- *   5. user_kodax_write — write/edit to any path under `~/.kodax/`
- *                        (credentials zone — internal kodax config writes
- *                        use the TypeScript API, not bash/tools, so the
- *                        only path here is normally an LLM-emitted shell).
- *
- * Layer note: bash-level `~/.kodax/` writes (e.g. `echo x > ~/.kodax/y`)
- * require AST path-extraction. The REPL-side collector wired through
- * `extraCollectors` (Step 7) identifies those as
- * Tier 0 by emitting a synthetic `user_kodax_write` match via the same
- * `AbsoluteDenyResult` shape. This module handles the file-tool path
- * directly (the most common attack vector) and the four command-string
- * patterns that don't need path extraction.
+ *   5. user_kodax_write — write/edit/bash-write to protected agent-home paths
+ *                        under `~/.kodax/`: the home root, Runtime control
+ *                        plane, credentials, security config, and generic
+ *                        sensitive files. Ordinary working data stays open.
+ *
+ * Layer note: bash-level `~/.kodax/` writes are detected via AST
+ * path-extraction (`collectDeterministicBashWriteTargets`) in
+ * `checkUserKodaxBashWrite`, covering both file-tool and bash paths.
  */
 
 type TierZeroPatternId = 'rm_rf_root' | 'mkfs_or_format' | 'dd_disk_write' | 'fork_bomb' | 'user_kodax_write';
@@ -513,8 +509,8 @@ type AbsoluteDenyCheck = (call: RunnerToolCall, projectRoot: string, executionCw
  * classifier and the reason string is one-shot.
  *
  * **Pure**: deterministic given (call, projectRoot, stable env).
- * **Fast**: ~5 regex tests + 1-2 string ops; safe to run on every
- * non-Tier-1 call without measurable overhead.
+ * **Fast**: ~5 regex tests + 1-2 string ops (file-tools); bash calls add
+ * AST path-extraction. Safe to run on every non-Tier-1 call.
  */
 declare function checkAbsoluteDeny(call: RunnerToolCall, projectRoot: string, executionCwd?: string): AbsoluteDenyResult;
 
@@ -659,7 +655,7 @@ interface AutoModeRulesContext {
     /** Trusted host metadata used when a tool has no path-specific analyzer. */
     readonly toolSideEffect?: ToolSideEffect;
 }
-type AutoModePermissionBoundary = 'workspace' | 'system-temp' | 'outside-workspace' | 'protected' | 'unresolved';
+type AutoModePermissionBoundary = 'workspace' | 'system-temp' | 'agent-home' | 'agent-home-readonly' | 'outside-workspace' | 'protected' | 'unresolved';
 interface AutoModePermissionTarget {
     readonly path: string;
     readonly boundary: AutoModePermissionBoundary;
@@ -733,6 +729,8 @@ interface AutoModeGuardrailConfig {
     readonly allowOnClassifierFailure?: (call: RunnerToolCall) => boolean | Promise<boolean>;
     /** Whether ordinary bash calls can be enforced by an OS workspace sandbox. */
     readonly workspaceShellSandboxAvailable?: boolean;
+    /** Host invariant: every allowed Bash call must receive exact fail-closed admission. */
+    readonly requireWorkspaceShellSandbox?: boolean;
     /** Mint one exact bash call for workspace-sandboxed execution. */
     readonly admitWorkspaceSandboxCall?: (call: RunnerToolCall, review: AutoModePermissionReview) => void;
     /**
@@ -874,6 +872,13 @@ interface AutoModeGuardrailConfig {
      */
     readonly speculativeWindowMs?: number;
 }
+interface AgentHomeShellBoundaryGuardrailOptions {
+    readonly projectRoot: string;
+    readonly executionCwd: string;
+    readonly failClosedShellSandbox: boolean;
+    readonly effectTreeContainmentAvailable?: boolean;
+    readonly protectedReadReviewAvailable?: boolean;
+}
 /**
  * Snapshot of the auto-mode guardrail's session-scoped state. Returned by
  * `getStats()` for diagnostic surfaces (`/auto-denials`) and the status bar
@@ -905,7 +910,8 @@ interface AutoModeToolGuardrail extends ToolGuardrail {
     /** Test-only override: swap the provider mid-test. */
     setProviderForTest(provider: KodaXBaseProvider): void;
 }
+declare function createAgentHomeShellBoundaryGuardrail(options: AgentHomeShellBoundaryGuardrailOptions): ToolGuardrail;
 declare function createAutoModeToolGuardrail(config: AutoModeGuardrailConfig): AutoModeToolGuardrail;
 
-export { CLASSIFIER_MAX_OUTPUT_TOKENS as C, DEFAULT_CLASSIFIER_RETRY_TIMEOUT_MS as M, DEFAULT_CLASSIFIER_TIMEOUT_MS as N, ERROR_THRESHOLD as P, WINDOW_MS as a2, checkAbsoluteDeny as a3, classify as a4, collectAllSignals as a5, computeRulesFingerprint as a6, createAutoModeToolGuardrail as a7, createCircuitBreaker as a8, createDenialTracker as a9, formatAgentsForPrompt as aa, getKodaxGlobalDir as ab, loadAgentsFiles as ac, loadAutoRules as ad, parseAutoRules as ae, parseClassifierOutput as af, readTrustState as ag, recordAllow as ah, recordBlock as ai, recordError as aj, shouldFallback as ak, shouldFallback$1 as al, trustProjectRules as am, CONSECUTIVE_THRESHOLD as v, CUMULATIVE_THRESHOLD as w };
-export type { TierZeroPatternId as $, AbsoluteDenyCheck as A, ClassifierDecision as B, ClassifierFailureKind as D, ClassifierHazard as E, ClassifierObservedProtocol as F, ClassifierOutputWarningCode as G, ClassifierParseFailureCode as H, ClassifierProtocol as I, ClassifierToolProjectionResolver as J, ClassifyDecision as K, ClassifyOptions as L, DenialTracker as O, KodaXMcpConnectMode as Q, KodaXMcpServerConfig as R, KodaXMcpServersConfig as S, KodaXMcpTransport as T, LoadAgentsOptions as U, LoadedRulesSource as V, PermissionIntentEvidence as W, RulesLoadError as X, RulesLoadResult as Y, SignalCollector as Z, SkippedRulesSource as _, AbsoluteDenyMatch as a, ToolCallSignal as a0, TrustState as a1, AbsoluteDenyMiss as b, AbsoluteDenyResult as c, AgentsFile as d, AutoModeAskUser as e, AutoModeAskUserVerdict as f, AutoModeCallAnalyzer as g, AutoModeDecisionDiagnostics as h, AutoModeEngine as i, AutoModeGuardrailConfig as j, AutoModePermissionBoundary as k, AutoModePermissionOperation as l, AutoModePermissionReview as m, AutoModePermissionTarget as n, AutoModeRulesContext as o, AutoModeRulesDecision as p, AutoModeRulesEvaluator as q, AutoModeSharedState as r, AutoModeStats as s, AutoModeToolGuardrail as t, AutoRules as u, CircuitBreaker as x, ClassifierAttemptDiagnostics as y, ClassifierAttemptOutcome as z };
+export { CLASSIFIER_MAX_OUTPUT_TOKENS as C, DEFAULT_CLASSIFIER_RETRY_TIMEOUT_MS as N, DEFAULT_CLASSIFIER_TIMEOUT_MS as O, ERROR_THRESHOLD as Q, WINDOW_MS as a3, checkAbsoluteDeny as a4, classify as a5, collectAllSignals as a6, computeRulesFingerprint as a7, createAgentHomeShellBoundaryGuardrail as a8, createAutoModeToolGuardrail as a9, createCircuitBreaker as aa, createDenialTracker as ab, formatAgentsForPrompt as ac, getKodaxGlobalDir as ad, loadAgentsFiles as ae, loadAutoRules as af, parseAutoRules as ag, parseClassifierOutput as ah, readTrustState as ai, recordAllow as aj, recordBlock as ak, recordError as al, shouldFallback as am, shouldFallback$1 as an, trustProjectRules as ao, CONSECUTIVE_THRESHOLD as w, CUMULATIVE_THRESHOLD as x };
+export type { SkippedRulesSource as $, AbsoluteDenyCheck as A, ClassifierAttemptOutcome as B, ClassifierDecision as D, ClassifierFailureKind as E, ClassifierHazard as F, ClassifierObservedProtocol as G, ClassifierOutputWarningCode as H, ClassifierParseFailureCode as I, ClassifierProtocol as J, ClassifierToolProjectionResolver as K, ClassifyDecision as L, ClassifyOptions as M, DenialTracker as P, KodaXMcpConnectMode as R, KodaXMcpServerConfig as S, KodaXMcpServersConfig as T, KodaXMcpTransport as U, LoadAgentsOptions as V, LoadedRulesSource as W, PermissionIntentEvidence as X, RulesLoadError as Y, RulesLoadResult as Z, SignalCollector as _, AbsoluteDenyMatch as a, TierZeroPatternId as a0, ToolCallSignal as a1, TrustState as a2, AbsoluteDenyMiss as b, AbsoluteDenyResult as c, AgentHomeShellBoundaryGuardrailOptions as d, AgentsFile as e, AutoModeAskUser as f, AutoModeAskUserVerdict as g, AutoModeCallAnalyzer as h, AutoModeDecisionDiagnostics as i, AutoModeEngine as j, AutoModeGuardrailConfig as k, AutoModePermissionBoundary as l, AutoModePermissionOperation as m, AutoModePermissionReview as n, AutoModePermissionTarget as o, AutoModeRulesContext as p, AutoModeRulesDecision as q, AutoModeRulesEvaluator as r, AutoModeSharedState as s, AutoModeStats as t, AutoModeToolGuardrail as u, AutoRules as v, CircuitBreaker as y, ClassifierAttemptDiagnostics as z };

package/dist/types-chunks/{history-retrieval.d-BDI-ZMvY.d.ts → history-retrieval.d-Debbzn1z.d.ts}

@@ -1,5 +1,5 @@
 import { k as KodaXMessage } from './types.d-CgrXrFrq.js';
-import { c1 as KodaXSessionLineage } from './controller.d-CYNuR2n9.js';
+import { ab as KodaXSessionLineage } from './types.d-DlLBRqZ9.js';
 
 type KodaXSessionHistoryScope = 'compacted' | 'all';
 type KodaXSessionHistorySource = 'user' | 'assistant' | 'system' | 'tool' | 'child_task';

package/dist/types-chunks/{public-api.d-i10kvYFs.d.ts → public-api.d-N6G6Jw8X.d.ts}

@@ -1,6 +1,7 @@
-import { a as BashPrefixExtractor, t as KodaXAgentMode } from './bash-prefix-extractor.d-CJM7OY-L.js';
+import { a as BashPrefixExtractor, t as KodaXAgentMode } from './bash-prefix-extractor.d-BnZQDirs.js';
 import { G as KodaXReasoningMode, k as KodaXMessage, T as KodaXTaskResultMetadata } from './types.d-CgrXrFrq.js';
-import { cY as LearningSurfaceSnapshot$1, cT as LearningQuery, cS as LearningPage, cv as LearnedCapabilityRecord, cO as LearningEvent, cX as LearningSubscribeOptions, bY as KodaXSessionData, c1 as KodaXSessionLineage, c6 as KodaXSessionNavigationOptions, c8 as KodaXSessionRuntimeInfo, ca as KodaXSessionStorage, bZ as KodaXSessionEntry, bU as KodaXSessionArtifactLedgerEntry, bC as KodaXExtensionSessionRecord, cc as KodaXSessionUiHistoryItem, c9 as KodaXSessionScope, k as AgentActorSnapshot, aX as CompactionReport, bO as KodaXJsonValue } from './controller.d-CYNuR2n9.js';
+import { bF as LearningSurfaceSnapshot$1, bA as LearningQuery, bz as LearningPage, bc as LearnedCapabilityRecord, bv as LearningEvent, bE as LearningSubscribeOptions, aj as CompactionReport } from './controller.d-Dzxz22X-.js';
+import { a6 as KodaXSessionData, ab as KodaXSessionLineage, ag as KodaXSessionNavigationOptions, ai as KodaXSessionRuntimeInfo, ak as KodaXSessionStorage, a7 as KodaXSessionEntry, a2 as KodaXSessionArtifactLedgerEntry, Q as KodaXExtensionSessionRecord, am as KodaXSessionUiHistoryItem, aj as KodaXSessionScope, c as AgentActorSnapshot, Y as KodaXJsonValue } from './types.d-DlLBRqZ9.js';
 
 /**
  * TextBuffer - Text buffer management class - 文本缓冲区管理类

package/dist/types-chunks/{repl.d-Cs3eqGVT.d.ts → repl.d-BkTIOkJD.d.ts}

@@ -1,8 +1,8 @@
-import { n as ResolvedAutoModeSettings, b as CommandDefinition, e as CommandSource, c as CommandInfo, C as Command$1, I as InteractiveContext, a as CommandCallbacks, g as CurrentConfig, d as CommandInvocationRequest, f as CommandWorkflowInvocationRequest, p as RuntimeSurfaceStatus } from './utils.d-CgITiLyc.js';
-import { ae as SessionStorage$1, S as PermissionMode, L as LearningBinding } from './public-api.d-i10kvYFs.js';
-import { a1 as KodaXOptions, ad as KodaXResult } from './bash-prefix-extractor.d-CJM7OY-L.js';
-import { ca as KodaXSessionStorage, bY as KodaXSessionData } from './controller.d-CYNuR2n9.js';
-import { s as AutoModeStats } from './guardrail.d-fM3mn4Op.js';
+import { n as ResolvedAutoModeSettings, b as CommandDefinition, e as CommandSource, c as CommandInfo, C as Command$1, I as InteractiveContext, a as CommandCallbacks, g as CurrentConfig, d as CommandInvocationRequest, f as CommandWorkflowInvocationRequest, p as RuntimeSurfaceStatus } from './utils.d-BI-kjuev.js';
+import { ae as SessionStorage$1, S as PermissionMode, L as LearningBinding } from './public-api.d-N6G6Jw8X.js';
+import { a4 as KodaXOptions, ag as KodaXResult } from './bash-prefix-extractor.d-BnZQDirs.js';
+import { ak as KodaXSessionStorage, a6 as KodaXSessionData } from './types.d-DlLBRqZ9.js';
+import { t as AutoModeStats } from './guardrail.d-BCkgaWT1.js';
 
 interface ReplRuntimePermissionGrantSuggestion {
     readonly id: string;

package/dist/types-chunks/review-inbox.d-DuZqFX-z.d.ts

@@ -0,0 +1,221 @@
+import { $ as KodaXMemoryOutcomeDigest, aE as MemoryContextIdentity } from './types.d-DlLBRqZ9.js';
+
+interface PendingEpisodeReviewV1 {
+    readonly version: 1;
+    readonly reviewKey: string;
+    readonly digest: KodaXMemoryOutcomeDigest;
+    readonly ownerSessionRef: string;
+    readonly ownerAgentHash: string;
+    readonly ownerProjectHash?: string;
+    readonly createdAt: string;
+}
+interface PendingEpisodeReviewV2 {
+    readonly version: 2;
+    readonly jobId: string;
+    readonly reviewKey: string;
+    readonly digest: KodaXMemoryOutcomeDigest;
+    readonly ownerSessionRef: string;
+    readonly ownerAgentHash: string;
+    readonly ownerProjectHash?: string;
+    readonly branchId: string;
+    readonly branchEpoch: number;
+    readonly authorityCeiling: 'memory_and_project_skill';
+    readonly createdAt: string;
+}
+type PendingEpisodeReview = PendingEpisodeReviewV1 | PendingEpisodeReviewV2;
+interface PendingEpisodeReviewFilter {
+    readonly configHome?: string;
+    readonly tenantId: string;
+    readonly agentId?: string;
+    /** Omit for every project; pass null for ownerless reviews only. */
+    readonly projectId?: string | null;
+}
+type EpisodeReviewJobStatus = 'pending' | 'processing' | 'decided' | 'completed' | 'attention';
+interface EpisodeReviewJobState {
+    readonly schemaVersion: 1;
+    readonly jobId: string;
+    readonly status: EpisodeReviewJobStatus;
+    readonly claimEpoch: number;
+    readonly claimToken?: string;
+    readonly leaseDeadline?: string;
+    readonly providerAttempts: number;
+    readonly applyAttempts: number;
+    readonly applyAttemptsByCarrier: {
+        readonly memory: number;
+        readonly skill: number;
+    };
+    readonly completionAttempts: number;
+    readonly nextAttemptAt?: string;
+    readonly nextApplyAttemptAt?: string;
+    readonly nextCompletionAttemptAt?: string;
+    readonly lastError?: string;
+    readonly updatedAt: string;
+}
+interface PendingEpisodeReviewSummary {
+    readonly version: 1 | 2;
+    readonly jobId?: string;
+    readonly reviewKey: string;
+    readonly ownerSessionRef: string;
+    readonly createdAt: string;
+    readonly status: EpisodeReviewJobStatus | 'unknown';
+    readonly providerAttempts?: number;
+    readonly applyAttempts?: number;
+    readonly completionAttempts?: number;
+    readonly nextAttemptAt?: string;
+    readonly nextApplyAttemptAt?: string;
+    readonly nextCompletionAttemptAt?: string;
+    readonly lastError?: string;
+}
+interface EpisodeReviewClaim {
+    readonly jobId: string;
+    readonly reviewKey: string;
+    readonly ownerSessionRef: string;
+    readonly branchId: string;
+    readonly branchEpoch: number;
+    readonly epoch: number;
+    readonly token: string;
+    readonly leaseDeadline: string;
+}
+interface EpisodeReviewInputSpec {
+    readonly evidence: unknown;
+    readonly promptRevision: string;
+    readonly schemaRevision: string;
+    readonly policyRevision: string;
+    readonly providerRevision: string;
+}
+interface EpisodeReviewInputCheckpoint extends EpisodeReviewInputSpec {
+    readonly version: 1;
+    readonly jobId: string;
+    readonly evidenceBytes: string;
+    readonly evidenceHash: string;
+    readonly createdAt: string;
+}
+interface EpisodeReviewDecisionInput {
+    readonly inputHash: string;
+    readonly memoryProposalIds: readonly string[];
+    readonly requiredCarriers?: readonly ('memory' | 'skill')[];
+    readonly memoryPlan?: unknown;
+    readonly capabilityDecision?: unknown;
+}
+interface EpisodeReviewDecision extends EpisodeReviewDecisionInput {
+    readonly version: 1;
+    readonly jobId: string;
+    readonly decisionId: string;
+    readonly committedAt: string;
+}
+interface EpisodeReviewActionInput {
+    readonly actionId: string;
+    readonly decisionId: string;
+    readonly carrier: 'memory' | 'skill';
+    readonly resultRefs: readonly string[];
+}
+interface EpisodeReviewActionReceipt extends EpisodeReviewActionInput {
+    readonly version: 1;
+    readonly jobId: string;
+    readonly committedAt: string;
+}
+type EpisodeReviewFailureKind = 'provider_timeout' | 'provider_error' | 'malformed_response' | 'shutdown' | 'budget_unavailable' | 'provider_unavailable';
+declare class EpisodeReviewFailure extends Error {
+    readonly kind: EpisodeReviewFailureKind;
+    constructor(kind: EpisodeReviewFailureKind, message: string);
+}
+interface EpisodeReviewJobSnapshot {
+    readonly envelope: PendingEpisodeReviewV2;
+    readonly state: EpisodeReviewJobState;
+    readonly input?: EpisodeReviewInputCheckpoint;
+    readonly decision?: EpisodeReviewDecision;
+    readonly actions: readonly EpisodeReviewActionReceipt[];
+}
+interface EpisodeReviewReceipt {
+    readonly version: 1;
+    readonly jobId?: string;
+    readonly reviewKey: string;
+    readonly ownerAgentHash?: string;
+    readonly ownerProjectHash?: string;
+    readonly proposalIds: readonly string[];
+    readonly completedAt: string;
+}
+type EpisodeReviewDrainEligibility = 'eligible' | 'discard' | 'defer';
+interface EpisodeReviewDrainOptions {
+    readonly maxEntries?: number;
+    /** Process this just-persisted job before bounded backlog work. */
+    readonly preferredJobId?: string;
+    /** Skip unrelated backlog when searching across alternate project identities. */
+    readonly onlyPreferred?: boolean;
+    /** Epoch-ms deadline: stop claiming new jobs once passed and release an
+     * in-flight claim instead of committing a decision. */
+    readonly deadlineAtMs?: number;
+    readonly revalidate: (entry: PendingEpisodeReview) => Promise<EpisodeReviewDrainEligibility>;
+    readonly review: (entry: PendingEpisodeReview) => Promise<readonly string[]>;
+    readonly prepareV2Input?: (entry: PendingEpisodeReviewV2) => Promise<EpisodeReviewInputSpec>;
+    readonly decideV2?: (entry: PendingEpisodeReviewV2, input: EpisodeReviewInputCheckpoint, signal: AbortSignal) => Promise<EpisodeReviewDecisionInput>;
+    readonly listV2Actions?: (entry: PendingEpisodeReviewV2, decision: EpisodeReviewDecision) => readonly ('memory' | 'skill')[];
+    readonly applyV2Action?: (entry: PendingEpisodeReviewV2, decision: EpisodeReviewDecision, carrier: 'memory' | 'skill', claim: EpisodeReviewClaim, commitWithAuthority: (effect: (revalidateAuthority: () => Promise<void>) => Promise<readonly string[]>) => Promise<readonly string[]>) => Promise<readonly string[]>;
+    readonly onV2Completed?: (entry: PendingEpisodeReviewV2, decision: EpisodeReviewDecision, proposalIds: readonly string[]) => Promise<void>;
+}
+interface EpisodeReviewDrainResult {
+    readonly reviewed: number;
+    readonly discarded: number;
+    readonly deferred: number;
+    readonly failed: number;
+    readonly failures: readonly {
+        readonly reviewKey: string;
+        readonly error: string;
+    }[];
+}
+declare class EpisodeReviewBranchChangedError extends Error {
+    constructor();
+}
+declare function captureEpisodeReviewBranchEpoch(identity: MemoryContextIdentity): Promise<number>;
+declare function persistPendingEpisodeReview(identity: MemoryContextIdentity, digest: KodaXMemoryOutcomeDigest, options?: {
+    readonly expectedBranchEpoch?: number;
+    readonly persistOwner?: (entry: PendingEpisodeReviewV2) => Promise<void>;
+}): Promise<{
+    readonly path: string;
+    readonly entry: PendingEpisodeReviewV2;
+}>;
+declare function claimEpisodeReview(identity: MemoryContextIdentity, reviewKeyOrJobId: string, options?: {
+    readonly now?: Date;
+    readonly leaseMs?: number;
+}): Promise<EpisodeReviewClaim | undefined>;
+declare function freezeEpisodeReviewInput(identity: MemoryContextIdentity, claim: EpisodeReviewClaim, spec: EpisodeReviewInputSpec, now?: Date): Promise<EpisodeReviewInputCheckpoint>;
+declare function commitEpisodeReviewDecision(identity: MemoryContextIdentity, claim: EpisodeReviewClaim, input: EpisodeReviewDecisionInput, now?: Date): Promise<EpisodeReviewDecision>;
+declare function commitEpisodeReviewAction(identity: MemoryContextIdentity, claim: EpisodeReviewClaim, input: EpisodeReviewActionInput, now?: Date): Promise<EpisodeReviewActionReceipt>;
+declare function withEpisodeReviewClaimAuthority<T>(identity: MemoryContextIdentity, claim: EpisodeReviewClaim, operation: (revalidateAuthority: () => Promise<void>) => Promise<T>): Promise<T>;
+declare function failEpisodeReviewAttempt(identity: MemoryContextIdentity, claim: EpisodeReviewClaim, failure: {
+    readonly kind: EpisodeReviewFailureKind;
+    readonly message: string;
+}, now?: Date): Promise<EpisodeReviewJobState>;
+declare function failEpisodeReviewApply(identity: MemoryContextIdentity, claim: EpisodeReviewClaim, failure: {
+    readonly carrier: 'memory' | 'skill';
+    readonly message: string;
+}, now?: Date): Promise<EpisodeReviewJobState>;
+declare function deferEpisodeReview(identity: MemoryContextIdentity, claim: EpisodeReviewClaim, reason: string, now?: Date): Promise<EpisodeReviewJobState>;
+declare function completeFencedEpisodeReview(identity: MemoryContextIdentity, claim: EpisodeReviewClaim, proposalIds: readonly string[], now?: Date): Promise<{
+    readonly acknowledged: boolean;
+    readonly receiptPath: string;
+}>;
+declare function discardFencedEpisodeReview(identity: MemoryContextIdentity, claim: EpisodeReviewClaim, reason: string, now?: Date): Promise<void>;
+declare function inspectEpisodeReviewJob(identity: MemoryContextIdentity, reviewKeyOrJobId: string): Promise<EpisodeReviewJobSnapshot | undefined>;
+declare function listPendingEpisodeReviews(filter: PendingEpisodeReviewFilter): Promise<readonly PendingEpisodeReview[]>;
+declare function listPendingEpisodeReviewSummaries(filter: PendingEpisodeReviewFilter): Promise<readonly PendingEpisodeReviewSummary[]>;
+declare function completeEpisodeReview(identity: MemoryContextIdentity, reviewKey: string, proposalIds: readonly string[]): Promise<{
+    readonly acknowledged: boolean;
+    readonly receiptPath: string;
+}>;
+/**
+ * Establishes the lock order used by both review completion and Session branch
+ * mutation: the Session root registry first, every sorted tenant branch fence
+ * next, then the caller-owned Session transaction. The supplied fence operation
+ * runs without reacquiring those locks, so a mutation can fence its prospective
+ * lineage and persist that exact lineage atomically with respect to review
+ * effects, new tenant registration and completion delivery.
+ */
+declare function withPendingEpisodeReviewSessionFence<T>(input: {
+    readonly configHome?: string;
+    readonly sessionId: string;
+}, operation: (fence: (activeReviewIds: readonly string[]) => Promise<number>) => Promise<T>): Promise<T>;
+declare function drainPendingEpisodeReviews(identity: MemoryContextIdentity, options: EpisodeReviewDrainOptions): Promise<EpisodeReviewDrainResult>;
+
+export { deferEpisodeReview as A, discardFencedEpisodeReview as B, drainPendingEpisodeReviews as C, failEpisodeReviewApply as D, failEpisodeReviewAttempt as F, freezeEpisodeReviewInput as G, inspectEpisodeReviewJob as H, listPendingEpisodeReviewSummaries as I, listPendingEpisodeReviews as J, persistPendingEpisodeReview as K, withEpisodeReviewClaimAuthority as L, withPendingEpisodeReviewSessionFence as M, EpisodeReviewBranchChangedError as b, EpisodeReviewFailure as i, captureEpisodeReviewBranchEpoch as u, claimEpisodeReview as v, commitEpisodeReviewAction as w, commitEpisodeReviewDecision as x, completeEpisodeReview as y, completeFencedEpisodeReview as z };
+export type { EpisodeReviewActionInput as E, PendingEpisodeReview as P, EpisodeReviewActionReceipt as a, EpisodeReviewClaim as c, EpisodeReviewDecision as d, EpisodeReviewDecisionInput as e, EpisodeReviewDrainEligibility as f, EpisodeReviewDrainOptions as g, EpisodeReviewDrainResult as h, EpisodeReviewFailureKind as j, EpisodeReviewInputCheckpoint as k, EpisodeReviewInputSpec as l, EpisodeReviewJobSnapshot as m, EpisodeReviewJobState as n, EpisodeReviewJobStatus as o, EpisodeReviewReceipt as p, PendingEpisodeReviewFilter as q, PendingEpisodeReviewSummary as r, PendingEpisodeReviewV1 as s, PendingEpisodeReviewV2 as t };

package/dist/types-chunks/{run-manager.d-CodHf6rw.d.ts → run-manager.d-BS4lJfL3.d.ts}

@@ -1,4 +1,4 @@
-import { fh as WorkflowProcessTrackerOptions, eP as WorkflowEvent, fb as WorkflowProcessSnapshot, f5 as WorkflowProcessEvent } from './controller.d-CYNuR2n9.js';
+import { dj as WorkflowProcessTrackerOptions, cR as WorkflowEvent, dd as WorkflowProcessSnapshot, d7 as WorkflowProcessEvent } from './controller.d-Dzxz22X-.js';
 
 /**
  * FEATURE_246 Part A0 (ADR-046) — neutral workflow run lifecycle manager.

package/dist/types-chunks/{sdk-session-CRXu5xNs.d.ts → sdk-session-DLkZTOc-.d.ts}

@@ -1,6 +1,6 @@
-import { h as CreatableHistoryItem, ar as ToolCall } from './public-api.d-i10kvYFs.js';
+import { h as CreatableHistoryItem, ar as ToolCall } from './public-api.d-N6G6Jw8X.js';
 import { k as KodaXMessage, c as KodaXContentBlock } from './types.d-CgrXrFrq.js';
-import { cc as KodaXSessionUiHistoryItem, cg as KodaXSessionUiToolCall } from './controller.d-CYNuR2n9.js';
+import { am as KodaXSessionUiHistoryItem, aq as KodaXSessionUiToolCall } from './types.d-DlLBRqZ9.js';
 
 interface RestoreHistoryItemsFromSessionInput {
     messages: readonly KodaXMessage[];

package/dist/types-chunks/{shell-command-sets.d-DfeSUjjM.d.ts → shell-command-sets.d-BrLw-WN9.d.ts}

@@ -1,4 +1,4 @@
-import { a as BashPrefixExtractor } from './bash-prefix-extractor.d-CJM7OY-L.js';
+import { a as BashPrefixExtractor } from './bash-prefix-extractor.d-BnZQDirs.js';
 
 /**
  * Permission Utilities
@@ -219,6 +219,7 @@ declare function extractPathsFromCommand(command: string): string[];
  * Issue 052: Prevent "always" option for bash commands on protected paths
  */
 declare function isCommandOnProtectedPath(command: string, projectRoot: string, executionCwd?: string): boolean;
+declare function isBashReadCommandAutoAllowed(command: string, projectRoot: string, executionCwd?: string): boolean;
 /**
  * Check whether a path stays inside the project root after resolution.
  */
@@ -293,5 +294,5 @@ declare const MODIFICATION_TOOLS: Set<string>;
 declare const BASH_WRITE_COMMANDS: Set<string>;
 declare const BASH_SAFE_READ_COMMANDS: Set<string>;
 
-export { BASH_SAFE_READ_COMMANDS as B, FILE_MODIFICATION_TOOLS as F, MODIFICATION_TOOLS as M, BASH_WRITE_COMMANDS as a, collectDeterministicBashWriteTargets as b, collectBashWriteTargets as c, getBashOutsideProjectWriteRisk as d, extractPathsFromCommand as e, findGitSubcommandIndex as f, generateSavePattern as g, getDirectShellBypassBlockReason as h, getPlanModeAllowedWritablePaths as i, getPlanModeBlockReason as j, gitSignatureInspectionMayExecute as k, inferPermissionMode as l, isAlwaysConfirmPath as m, isBashReadCommand as n, isBashWriteCommand as o, isCommandOnProtectedPath as p, isHelpCommand as q, isPathInsideProject as r, isPlanModeAllowedPath as s, isShellReadOnlyArgv as t, isToolCallAllowed as u, parseAllowedToolPattern as v, parseGitGrepShortOption as w, tokenizeRawCommandStages as x };
+export { BASH_SAFE_READ_COMMANDS as B, FILE_MODIFICATION_TOOLS as F, MODIFICATION_TOOLS as M, BASH_WRITE_COMMANDS as a, collectDeterministicBashWriteTargets as b, collectBashWriteTargets as c, getBashOutsideProjectWriteRisk as d, extractPathsFromCommand as e, findGitSubcommandIndex as f, generateSavePattern as g, getDirectShellBypassBlockReason as h, getPlanModeAllowedWritablePaths as i, getPlanModeBlockReason as j, gitSignatureInspectionMayExecute as k, inferPermissionMode as l, isAlwaysConfirmPath as m, isBashReadCommand as n, isBashReadCommandAutoAllowed as o, isBashWriteCommand as p, isCommandOnProtectedPath as q, isHelpCommand as r, isPathInsideProject as s, isPlanModeAllowedPath as t, isShellReadOnlyArgv as u, isToolCallAllowed as v, parseAllowedToolPattern as w, parseGitGrepShortOption as x, tokenizeRawCommandStages as y };
 export type { GitGrepShortOption as G, PermissionMode as P, RawCommandWord as R };