@kodax-ai/kodax 0.7.97-alpha.10 → 0.7.97-alpha.12

package/CHANGELOG.md

@@ -6,6 +6,212 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Fixed
+
+- Preserve lexical and physical protected paths across Windows short names;
+  keep missing SSH identities excluded and native cache anchors free of reparse
+  aliases. Replace credential staging DACLs without retaining explicit broad
+  grants. Preserve Undo's native identity and CAS fences while correcting
+  canonical test fixtures and retaining failed sandbox bootstrap diagnostics.
+
+---
+
+## [0.7.97-alpha.12] - 2026-11-01
+
+Twelfth alpha of the v0.7.97 line: public product execution converges on the
+independent shared Host with retired embedded/default construction, inline
+owner switching and function-based external-agent Hosts, plus abandoned-owner
+policy migration with a one-way fence; FEATURE_302 lands native
+provider/OAuth credential parity across the Responses transport, ordered
+history, native cloud protocols, Mistral Pi, native media classification,
+shared file credentials and hidden API-key setup; Claude 5.5 history fragments
+and per-message effort controls join the LLM layer; and the 2026-11-01
+full-chain audit's Windows recovery, credential and permission hardening
+ships. Every v0.7.96 stable and v0.7.97-alpha.1 through alpha.11 contract is
+retained. npm publication remains a manual maintainer action.
+
+### Changed
+
+- Store execution statistics in append-only, Session-root-scoped journals;
+  retain legacy projections and expire pagination cursors after projection
+  recovery. Keep unknown outcomes non-authoritative for execution.
+- Load optional Node CLI auth, doctor, storage maintenance and one-shot
+  components on demand within the existing size reserve; standalone binaries
+  embed those components and public SDK entry points remain unchanged.
+- Add native Claude 5.5 history fragments, ordered thinking/tool blocks,
+  inline tool/system updates and per-message effort controls. Preserve
+  admitted images across restore and keep cache policy out of tool arguments.
+
+- Converge public Runtime ownership on the independent shared Host. Retire
+  embedded/default construction, inline owner switching and function-based
+  in-process external-agent Hosts. Keep the explicit daemon launcher and its
+  new-owner policy bootstrap; independent libraries remain usable.
+- Migrate eligible abandoned owner policies under profile and real Session-root
+  ownership checks. Persist a one-way policy that verified old readers reject,
+  preventing inline rollback after Host idle exit. Live/unknown owners and
+  unsafe Run recovery remain protected; old private unfenced writers must stop
+  and upgrade before sharing data. See the SDK migration guide for breaking
+  API and downgrade limits.
+
+### Fixed
+
+- Refresh rejected OAuth credential generations through the existing broker
+  without replaying the failed request or changing the selected account.
+  Preserve trusted account identity across refresh and fence revoked leases.
+- Publish migration/OAuth/storage lock owners completely; add explicit local
+  inspection, retained backups, repair fences and separately attested recovery
+  for supported damaged ledgers/snapshots and unidentified historical locks.
+- Prevent ambient Anthropic SDK headers from replacing the selected credential;
+  keep unsupported Claude sampling/prefill and hook effort overrides off wire.
+- Preserve explicit non-retryable provider facts through returned child
+  failures while retaining configured fallback for transient HTTP failures.
+- Prevent terminal quota, authentication and explicitly non-retryable child
+  failures from triggering cross-provider fallback. Diagnose retained Session
+  writer locks and lock-record syntax without disclosing owner fields or
+  reclaiming unknown ownership; add a Windows streaming-history PTY CI gate.
+- Keep help, version and read-only doctor available with corrupt configuration;
+  retain execution/write fencing and diagnose exact lock locations without
+  exposing config contents or following directory aliases.
+- Pin Windows CLI-provider child birth identities through delayed exit events
+  and retain captured descendants across intermediate-parent exit.
+- Preserve explicit SDK Skill catalogs, including empty overrides, across SA/AMA
+  learned bindings and compaction. Keep the stricter CLI size reserve using an
+  audited, lazily assembled broker program resource with identical emitted bytes.
+
+- Restore AMA Root learned Skill admission and owned finalization; explicit SDK
+  Skill calls now settle the existing policy and hooks without a model request.
+  Keep empty learned stores off foreground initialization and discover protected
+  formal names when a review actually commits a Skill.
+- Correct verified model ceilings, generic Skill aliases, cache pricing and Kimi
+  cache-write usage; retain default output budgets, fixed IDs and account choices.
+  Project unsupported historical images explicitly without rewriting history.
+- Derive SDK build/type entries from package exports and compile published examples.
+  Share current Runtime guardrail facts while retaining independent minimums.
+  Add explicit storage-capacity inspection and isolate cleanup state by directory.
+- Discover Windows source regressions automatically and retain the native OS gate.
+  Publish complete config/Host lock records, recover verified dead owners without
+  TTL stealing, and retry completed migration/release cleanup. Config and extension
+  publication failures retain original bytes, including legacy credential fields.
+- Isolate corrupt execution statistics, pending inputs and agent event ledgers
+  without replaying unknown effects or discarding queued intent. Retry failed CLI
+  credential bootstrap and load linked OAuth registrations only when selected;
+  preserve profile/account binding, revocation and Host replacement fences.
+- Reject unreadable or invalid existing core configuration in CLI and SDK
+  execution instead of selecting default credentials. Retain the original bytes,
+  permit first-use missing configuration, and retry after explicit repair.
+- Prevent native Anthropic API-key requests from inheriting ambient Bearer auth,
+  and omit unsigned foreign thinking on native Anthropic OAuth tool history.
+  Constrain SDK shell prefix fallback and protect governed Memory mutation at
+  sandbox and obvious direct Host targets. Plan recovery names the actual
+  `exit_plan_mode` approval flow.
+- Ship configuration templates, static prompts and audited native scripts in standalone
+  archives; load the byte-identical native programs lazily within the CLI budget.
+
+- Resolve explicit and queued Skill references against the executing Host's
+  config home, keeping separate Hosts' user Skills and registries isolated.
+- Keep admitted Skill catalogs available under Markdown Agent and SDK profile instructions across Solo, Adaptive and public Runner entries; reuse the bounded catalog formatter for Runtime bindings while preserving complete caller prompt overrides and pinned authorization.
+- Restore already-authorized tool evidence to the next model request when an actual Host/guardrail refusal or failed read makes its saved preview unrecoverable; retain read denials and Run isolation. Unknown Skill errors no longer enumerate hidden or budget-omitted registry entries.
+- Preserve complete MCP/tool results inline when active Skill restrictions or read hooks could block recovery, without speculative hook execution or permission bypasses.
+- Discover project `.agents/skills` and nested Skill collections with native-source precedence, support-directory boundaries and cycle protection; report shadowed sources and bound model Skill catalogs with visible shortening/omission diagnostics.
+- Stabilize executor registration revision fingerprints using normalized JSON
+  content, including persisted and rediscovered registrations.
+- Distinguish POSIX sandbox dependency, interpreter and seccomp diagnostics while
+  preserving authorized once-only host fallback and its actual isolation state.
+- Put standalone Windows Shell commands and environment probes behind a registered
+  Job gate. Verify descendant drain before retiring recovery records; fail cleanup
+  acceptance instead of only warning when verification is unavailable.
+- Compare checkpoint write times at millisecond precision so a filesystem's
+  fractional timestamp cannot discard fresh recovery state as future-dated.
+- Drain admitted Session view and item reads before Host-owner disposal completes,
+  preventing released reads from recreating storage indexes after shutdown.
+
+- Give Partner the selected generic Agent surface without persona-based restrictions.
+  Evaluate explicit policies against the Host catalog, retain metadata ceilings across
+  native/MCP/child routes, and keep allowed Actor lease calls working. Persist and
+  expose actual executable/model tool scopes, including after Host restart.
+  Repeated root recovery preserves original tool ceilings, persona and verification
+  while intersecting fresh authority; arbitrary callbacks still require rebinding.
+
+- Support Partner on the unified Host through trusted Main execution-profile
+  snapshots, intersecting Agent mode with existing profile/tool/lease ceilings.
+  Expose actual Run workMode and honor extension activeTools in effective scope;
+  keep standalone profile compatibility and specialist child declarations.
+- Preserve Actor checkpoint followup across daemon IPC and restart, and route
+  SA Script through its managed executor. Apply live plan effort to actual
+  Provider requests as well as the view.
+- Keep numeric token configuration typed, capture saved output/cache/LSP/tier
+  defaults for new Runs, and expose per-field application boundaries. Clearing
+  defaults cannot revive old bootstrap projections or remove external env values;
+  older Hosts retain unknown application support.
+- Refresh `kodax_manual` topic guidance for retired verification/journal paths,
+  work modes, original tool results, token estimates, task reports, question
+  deadlines, Skill policy and sandbox readiness. Exact query IDs/aliases now
+  take precedence over keyword ranking, preserving custom SDK manual topics.
+- Keep trusted-text, POSIX sandbox and storage-repair test fixtures on
+  canonical temporary roots so macOS runner paths under the `/var` symbolic
+  link satisfy the hardened agent-home and filesystem-alias fences.
+
+---
+
+## [0.7.97-alpha.11] - 2026-10-29
+
+### Added
+
+- Add explicit Agent, Coding and experimental Script work modes through the
+  CLI, interactive `/work-mode` command and managed SDK/Session paths. Coding
+  remains the default. Script executes supported leaf tools through the existing
+  permission and receipt boundaries; SDK profiles and specialist agents retain
+  their declared capabilities.
+
+- Refresh Ark, MiMo and MiniMax model catalogs and their reasoning/capacity
+  metadata. Provider-specific mappings and validation limits are documented in
+  the provider configuration guide.
+
+### Fixed
+
+- Run release builds alongside full CI while retaining all publication gates;
+  move the complete serial Node 20 system suite to its own runner, validate
+  archives before lengthy Electron checks, and bound bundle/archive execution
+  with retained failure evidence. Ordinary branch pushes still do not trigger CI.
+- Preserve the Windows PowerShell module search path in isolated archive tests,
+  avoiding stalled OS containment probes. Reject unverified supervised Hosts
+  before publishing incomplete capabilities and a misleading upgrade error.
+
+- Align current SDK, Client, design and user documentation with post-alpha.10
+  work modes, question deadlines, saved tool originals, structured task reports
+  and streaming token estimates; retain historical release/validation limits.
+
+- Preserve non-interactive question outcomes through the REPL client and reject
+  client-supplied timeout answers before daemon submission; the Host owns deadlines.
+- Constrain Skill `Bash(pattern)` rules to a single parsed command, preventing
+  wildcard matches from admitting additional shell statements, pipelines,
+  redirects or command substitutions. Bare Bash and absent Skill restrictions
+  continue through normal Host authorization.
+- Correct Windows stale-process recovery startup overhead and history browsing
+  cursor resynchronization; validate sandbox filesystem capabilities at startup.
+  Historical intermittent first-read latency remains under investigation.
+- Display estimated tokens consistently across model streaming progress surfaces.
+
+- Project existing task-result metadata into Product live views and recovered
+  history with explicit source, task identity, terminal/unknown status and
+  Markdown report bodies. Preserve multi-report order, literal report content,
+  existing full-body reads and raw canonical envelopes; decode only explicitly
+  sourced legacy deliveries and keep child failures separate from root Provider
+  errors. Deduplicate only identified task-message mirrors; preserve independent
+  same-text notices and ambiguous old UI records during history restoration.
+
+- Keep Skill discovery rooted at the repository when the SDK runs from a
+  subdirectory, synchronize catalogs with loader availability in SA/AMA, and
+  invalidate stale bodies across rediscovery and in-flight reads. Model loads
+  now apply the existing Skill action policies, lifecycle hooks and model
+  preference, retaining Host authorization and safe multi-Skill composition.
+
+- Preserve complete MCP tool output behind explicit SDK `part: 'original'`
+  reads, including daemon IPC and Host restart, while retaining existing preview
+  offsets. Keep results inline when recovery cannot be read, improve long JSON
+  previews, and stop Session-local automatic cleanup from deleting shared output
+  artifacts. Add simulated-provider/MCP E2E coverage against the built SDK.
+
 ---
 
 ## [0.7.97-alpha.10] - 2026-10-27
@@ -58,6 +264,10 @@ remains a manual maintainer action.
   back a failed save acknowledgement before retrying, preserving newer metadata
   and avoiding duplicate history transactions; permission failures still surface.
 
+- Keep the natural-eval fixture's `npm test` working on staged Node installs by
+  allowing reads of an npm CLI installed outside the binary directory, and
+  canonicalize the native test fixture root so hosted-runner 8.3 temp paths
+  (`RUNNER~1`) are not rejected by the native path policy.
 - Keep eval dump directories and unrelated `kodax-eval-*` directories out of orphan
   worktree cleanup. Require a worktree gitfile and successful Git-owned removal;
   isolate the cleanup regression from the shared system temporary directory.

package/README.md

@@ -36,6 +36,29 @@
 
 ---
 
+## Current development after alpha.10
+
+The unified Host cutover shipped in the `v0.7.97-alpha.12` tag retires
+`runtimeExitSettlement` and `settleKodaXRuntimeExit()`. Version-labelled
+paragraphs below describe their historical releases; use the [current SDK
+migration guide](docs/SDK_MIGRATION.md) for supported interfaces and
+[provider contracts](docs/LLM_INTEGRATION.md) for credential/account-preserving
+upgrades. Existing SDK/config/API_KEY entries remain.
+
+Agent / Coding / experimental Script work modes ship with Coding as the
+default. Select them with `--work-mode`, `/work-mode`, or Product Client
+Session `workMode`; this is independent of permissions and model choice.
+SDK/Host paths now share the corresponding settings, question outcomes,
+saved original tool reads, structured task reports and estimated-token
+progress. See the [SDK alignment and migration checklist](docs/SDK_MIGRATION.md#2026-10-29-未发布改动对齐)
+and [English integration guide](public_docs/sdk/embedder-guide.md#post-alpha10-sdk-alignment).
+These source additions shipped in the `v0.7.97-alpha.11` tag; the
+`v0.7.97-alpha.12` tag ships the unified shared-Host cutover, the
+FEATURE_302 provider/OAuth credential parity stack, and the 2026-11-01
+full-chain audit's Windows recovery, credential and permission fixes.
+Issue 371's historical first-read latency and Script model-efficiency
+acceptance remain open.
+
 ## Install in 30 seconds
 
 ```bash
@@ -294,10 +317,12 @@ name, not an API key value. Put the custom provider's actual API key in the
 `MY_LLM_API_KEY` environment variable, then close the current terminal and open
 a new one before running `kodax`.
 
+For native OpenAI Responses, add `"api": "responses"` to the custom provider. Omitted `api` keeps Chat Completions. Responses uses client-managed history and preserves ordered output; see [configuration and scope](public_docs/configuration/custom-providers.md#native-responses-api).
+
 `userAgentMode` defaults to `"compat"`, which sends `KodaX` instead of the official SDK User-Agent. Switch it to `"sdk"` only when your gateway expects the upstream SDK header.
 For custom reasoning models, `reasoning: { efforts, default }` is the preferred v0.7.57 shape; use `"reasoning": "none"` for models without thinking capability. SDK hosts should render effort pickers from `reasoningProfile.supportedEfforts` / `defaultEffort` rather than assuming a fixed five-option ladder.
 
-An undeclared OpenAI-compatible reasoning profile means capability is unknown. Omitted effort uses `auto`: the declared default wins, otherwise KodaX tries `max` and lowers only after explicit parameter/value rejection. `none` attempts to disable reasoning, then tries the lowest available thinking effort if disabling is rejected. SDK hosts receive `onReasoningResolved` with the requested effort, sent effort, fallback reasons, and `verified: false`; request acceptance does not prove that the model honored the strength. See [reasoning negotiation](docs/DD.md#23-custom-openai-compatible-reasoning) for cache and replay contracts.
+For the default Chat Completions API, an undeclared OpenAI-compatible reasoning profile means capability is unknown. Omitted effort uses `auto`: the declared default wins, otherwise KodaX tries `max` and lowers only after explicit parameter/value rejection. `none` attempts to disable reasoning, then tries the lowest available thinking effort if disabling is rejected. SDK hosts receive `onReasoningResolved` with the requested effort, sent effort, fallback reasons, and `verified: false`; request acceptance does not prove that the model honored the strength. See [reasoning negotiation](docs/DD.md#23-custom-openai-compatible-reasoning) for cache and replay contracts.
 
 #### OpenAI-compatible reasoning providers
 
@@ -443,7 +468,7 @@ try {
 
 `connectKodaXClient` attaches without starting or replacing a Host. The Node
 connector does not provide browser HTTP/WebSocket transport. The retained
-`/runtime` inline/daemon APIs are for explicit low-level Host integration;
+`/runtime` APIs connect trusted integrations to the same shared Host;
 Worker-hosted embedded Runtime is removed. The following structured-failure
 reference is scoped to that low-level API, not fields promised by Product Client.
 
@@ -485,8 +510,10 @@ See [Structured Runtime failures](public_docs/sdk/embedder-guide.md#structured-c
 for the field contract, taxonomy, migration guidance, and security boundary.
 
 The product CLI uses the shared Host; `--runtime-mode`, `KODAX_RUNTIME_MODE`
-and the `runtimeMode` config key are removed. Explicit low-level inline
-embedding retains private ownership, while daemon clients detach independently.
+and the `runtimeMode` config key are removed. The unreleased Host-only SDK
+cutover also retires public embedded construction and inline owner switching.
+Use `/client` for product execution; daemon clients detach independently.
+See [migration and downgrade limits](docs/SDK_MIGRATION.md#统一-host-sdk-收口未发布).
 Worker-hosted embedded Runtime is no longer an option.
 
 ```bash
@@ -795,6 +822,41 @@ starts, upgrades, or waits. See
 Every v0.7.96 stable and v0.7.97-alpha.1/alpha.2/alpha.3 contract is
 retained.
 
+**v0.7.97-alpha.12 release:** Public product execution converges on the
+independent shared Host — embedded/default Runtime construction, inline
+owner switching and function-based in-process external-agent Hosts are
+retired behind an explicit daemon launcher with one-way abandoned-owner
+policy migration, and `runtimeExitSettlement`/`settleKodaXRuntimeExit()`
+retire. FEATURE_302 provider/OAuth credential parity lands the native
+Responses transport, ordered history, native cloud protocols with scoped
+authentication, Mistral Pi, native media classification, shared file
+credentials bound to actual provider connections and hidden API-key setup;
+Claude 5.5 history fragments and per-message effort controls join the LLM
+layer; manual data moves out of the CLI JavaScript budget; and the
+2026-11-01 full-chain audit's Windows recovery, credential and permission
+hardening ships with lock diagnostics and a Windows streaming-history PTY
+CI gate. Tagging and publication remain separate. See the
+[v0.7.97-alpha.12 release notes](docs/release.md#v0797-alpha12-release-preparation).
+Every v0.7.96 stable and v0.7.97-alpha.1 through alpha.11 contract is
+retained.
+
+**v0.7.97-alpha.11 release:** Explicit Agent, Coding and experimental Script
+work modes land through the CLI, `/work-mode` and managed SDK/Session paths —
+Coding stays the default and Script runs supported leaf tools through the
+existing permission and receipt boundaries. Ark, MiMo and MiniMax catalogs
+refresh their reasoning and capacity metadata; non-interactive question
+outcomes are preserved with Host-owned deadlines; Skill `Bash(pattern)` rules
+admit a single parsed command; MCP tool originals stay readable through
+`part: 'original'` across daemon IPC and Host restart; structured task reports
+project into Product live views and recovered history; streaming progress
+shows consistent estimated tokens; Windows stale-process recovery and
+history-browsing cursor resync are corrected and sandbox filesystem
+capabilities are validated at startup. Tagging and publication remain
+separate. See the
+[v0.7.97-alpha.11 release notes](docs/release.md#v0797-alpha11-release-preparation).
+Every v0.7.96 stable and v0.7.97-alpha.1 through alpha.10 contract is
+retained.
+
 **v0.7.97-alpha.10 release:** Checkpointed Runs and task trees resume after
 Host restart with fresh scoped authority on top of durable context-capacity
 recovery boundaries; Kimi K3.1 provider routes join the registry with all
@@ -1530,7 +1592,7 @@ KodaX has two layers that consumers should understand separately:
 | `packages/repl`   | `@kodax-ai/kodax/repl`    | Full package | Ink TUI + permission modes + commands (217 exports) | Terminal-UI consumers |
 | `packages/repl`   | `@kodax-ai/kodax/session` | **Narrow subset** | Session management only — `listSessions` / `loadFullTranscript` / `appendClientNotice` / `forkSession` / `compactSession` / `watchSessions` / ... (17 exports) | IDE plugins and desktop hosts reading session history |
 | `src`             | `@kodax-ai/kodax/client` | Product API | Shared Host connection and `KodaXProductClient` contract | TUI, desktop/IDE and automation applications |
-| `src`             | `@kodax-ai/kodax/runtime` | Host API | Explicit inline/daemon runtime facade, sessions/runs/events/permissions/catalog/MCP/artifacts/diagnostics/external agents, daemon protocol schema (10 exports) | Trusted Host integration |
+| `src`             | `@kodax-ai/kodax/runtime` | Host API | Shared-Host runtime facade, sessions/runs/events/permissions/catalog/MCP/artifacts/diagnostics/external agents, daemon protocol schema (10 exports) | Trusted Host integration |
 | `src`             | `@kodax-ai/kodax/sandbox` | Host API | Explicit ASRT capability/doctor/setup and host-owned contained command execution; unavailability never means silent ordinary execution | SDK hosts that need standalone process containment |
 | `src`             | `@kodax-ai/kodax/a2a` | Integration edge | A2A 1.0 Agent Card discovery, JSON-RPC/SSE F258 executor, safe fetch policy, and authenticated Runtime-backed Agent server | Agent orchestrators and KodaX hosts |
 
@@ -1544,7 +1606,7 @@ KodaX has two layers that consumers should understand separately:
 
 **Inline Workflow Authoring (FEATURE_246, v0.7.58; F270 update in v0.7.72)**: the Worker can author and run a workflow inline via the model-callable `run_workflow` tool when Workflow intent is explicit. It scouts the codebase first, bakes concrete findings into child prompts, and runs the script through the sandbox, static-validation, and postcondition-verification pipeline. F270 retires AMAW and complexity-driven activation; AMA keeps explicit `/workflow`, named/SDK, and natural-language Workflow requests. Workflow child Agents now run on the unified Actor control plane. See [docs/features/v0.7.58.md](docs/features/v0.7.58.md), [docs/features/v0.7.72.md](docs/features/v0.7.72.md), and ADR-044/046/047/048/049/055.
 
-**Historical Workflow Activation Tiers (FEATURE_248 + FEATURE_249, v0.7.59; superseded by F270 in v0.7.72)**: v0.7.59 introduced AMAW and explicit-request AMA behavior. F270 retires AMAW and its complexity-driven directive. SA remains solo; AMA is the single adaptive multi-Agent mode and activates Workflow only from explicit Workflow intent. See [docs/features/v0.7.59.md](docs/features/v0.7.59.md) and [docs/features/v0.7.72.md](docs/features/v0.7.72.md).
+**Historical Workflow Activation Tiers (FEATURE_248 + FEATURE_249, v0.7.59; superseded by F270 in v0.7.72)**: v0.7.59 introduced AMAW and explicit-request AMA behavior. F270 retires AMAW and its complexity-driven directive. CLI and REPL tasks use AMA; explicit SDK SA selection and the internal solo executor remain compatible. AMA is the single adaptive multi-Agent mode and activates Workflow only from explicit Workflow intent. See [docs/features/v0.7.59.md](docs/features/v0.7.59.md) and [docs/features/v0.7.72.md](docs/features/v0.7.72.md).
 
 **Progressive Disclosure on the Managed Tool Path (FEATURE_250, v0.7.60; current policy corrected in v0.7.74)**: the deferred-tool mechanism applies to the managed AMA path as well as SA. The current deferred set contains exactly 11 tools: six repo-intelligence tools, four web/code discovery tools, and `run_workflow`. Their `input_schema` remains directly callable while `tool_search` provides the full description on demand. The five fixed `mcp_*` facades and the `get_goal` / `create_goal` / `update_goal` lifecycle tools stay resident with their complete contracts. The v0.7.74 goal correction adds only about 109 estimated schema tokens versus the former hints (`get_goal` is actually 12 tokens smaller when resident), removes a discovery round trip, and changes no tool schema, handler, permission, goal state, or compaction-protection behavior. See [docs/features/v0.7.60.md](docs/features/v0.7.60.md) and [docs/features/v0.7.74.md](docs/features/v0.7.74.md#feature_250-v0774-correction-resident-goal-lifecycle-tools).
 
@@ -1556,7 +1618,7 @@ KodaX has two layers that consumers should understand separately:
 
 **Active-Run Interrupt Input (v0.7.74)**: embedded Runtime and the shared daemon advertise `interruptInput:1`. `runtime.runs.submitInput()` queues an immutable, ordered input for the current active Actor Run; all inputs admitted before one safe Runner boundary are delivered FIFO as separate user messages in the next LLM request, without creating continuation Runs. Queued/delivered state is visible in typed Run snapshots/events, delivery is acknowledged against the exact consumed IDs, and terminal cleanup prevents undelivered input from leaking into later Runs.
 
-**External Agent SDK Plane (FEATURE_258, v0.7.67)**: `/agent` exports the protocol-neutral executor, registration, policy, credential-broker, artifact-policy, catalog, and durable task contracts. `/runtime` exposes the installed plane through `admin.agentRegistrations`, `agents`, and `agentTasks`, with the same DTO service methods over embedded and daemon clients. Executor factories are host functions: install them in an inline owner or while creating a new in-process daemon owner; they cannot be injected through an existing daemon connection or across a Runtime Worker boundary. Plane shutdown is terminal: pending waits and all later service calls reject. Restricted Workflow scripts preserve validated `phase` and external `target` routing. See the [complete owner/consumer recipes and safety contract](public_docs/sdk/embedder-guide.md#18-external-agent-executor-plane-feature_258-v0767).
+**External Agent SDK Plane (FEATURE_258, v0.7.67)**: `/agent` exports the protocol-neutral executor, registration, policy, credential-broker, artifact-policy, catalog, and durable task contracts. `/runtime` exposes the installed plane through `admin.agentRegistrations`, `agents`, and `agentTasks`, through the shared Host DTO services. The unified Host cutover retires public executor-factory injection and in-process owner construction. Configure supported A2A agents in the Host; arbitrary executor functions remain a standalone library integration and have no transparent product Host equivalent. Plane shutdown is terminal: pending waits and all later service calls reject. Restricted Workflow scripts preserve validated `phase` and external `target` routing. See the [complete owner/consumer recipes and safety contract](public_docs/sdk/embedder-guide.md#18-external-agent-executor-plane-feature_258-v0767).
 
 **Cost-Disciplined Workflow SDK (FEATURE_259, v0.7.67)**: SDK callers configure run-scoped `modelTiers` and `workflow.maxConcurrency`, while workflow authors express semantic `fast` / `balanced` / `deep` intent. Terminal workflow events expose resolved tier/source/fallback/usage/duration facts, and each durable `run.json` contains an `efficiencyReport` with token coverage, role/tier starts, packet-read topology, review waves, and quality-gate outcomes. See the [routing and telemetry contract](public_docs/sdk/embedder-guide.md#20-cost-disciplined-workflow-routing-and-telemetry-feature_259-v0767).
 
@@ -1564,7 +1626,7 @@ KodaX has two layers that consumers should understand separately:
 
 **Experimental Memory Agent SDK (FEATURE_260 + FEATURE_292)**: `/experimental-memory` exposes the source-compatible `MemoryAgent`/`MemorySession` lifecycle plus the additive `MemoryManagementAgent` facade when `createMemoryAgent()` receives a `MemoryManagementController`. That facade provides governed `list()`, `remember()`, and `forget()` through the same plane used by the conversation-first product surface. Passive recall is zero-wait; `query()` is read-only and deliberate; recalled content stays low-authority, and safety/scope gates remain deterministic. See the [direct session and boundary guide](public_docs/sdk/embedder-guide.md#21-experimental-governed-memory--experimental-memory-feature_260--feature_275--feature_292-v0768v0785).
 
-**Bidirectional A2A 1.0 (FEATURE_267, v0.7.69)**: `/a2a` discovers allowed Agent Cards and installs a JSON-RPC/SSE executor through the existing F258 plane. Configured outbound Agents are also registered automatically as `external:<name>` in embedded CLI and user-daemon Runtimes, so the main Agent can orchestrate them without host code. One `a2a.json` may hold many outbound registrations and at most one inbound server, which publishes either the Runtime default or one validated `~/.kodax/agents/*.md` Agent behind an authenticated Runtime facade. The built-in listener is loopback-only and will not return a port blocked by Fetch-compatible clients; public deployment uses `handle()` behind host-owned TLS and authorization. A2A 0.3, gRPC, HTTP+JSON, push notifications, and automatic public exposure are not advertised. See the [client/server recipes and security boundaries](public_docs/sdk/embedder-guide.md#22-bidirectional-a2a-10--a2a-feature_267-v0769).
+**Bidirectional A2A 1.0 (FEATURE_267, v0.7.69)**: `/a2a` discovers allowed Agent Cards and installs a JSON-RPC/SSE executor through the existing F258 plane. Configured outbound Agents are also registered automatically as `external:<name>` in the shared Host, so the main Agent can orchestrate them without host code. One `a2a.json` may hold many outbound registrations and at most one inbound server, which publishes either the Runtime default or one validated `~/.kodax/agents/*.md` Agent behind an authenticated Runtime facade. The built-in listener is loopback-only and will not return a port blocked by Fetch-compatible clients; public deployment uses `handle()` behind host-owned TLS and authorization. A2A 0.3, gRPC, HTTP+JSON, push notifications, and automatic public exposure are not advertised. See the [client/server recipes and security boundaries](public_docs/sdk/embedder-guide.md#22-bidirectional-a2a-10--a2a-feature_267-v0769).
 
 **A2A interoperability and authentication hardening** keeps a discovered
 interface on the trusted Agent Card origin and sends credentials only when one
@@ -1653,11 +1715,11 @@ later re-enable. Private-address access and non-loopback plaintext HTTP are
 independent, persisted, default-deny permissions (`--allow-private` and
 `--allow-insecure-http`); exact loopback HTTP remains available without either.
 OAuth token endpoints retain their stricter HTTPS-or-exact-loopback rule.
-SDK hosts load this same configured plane by wiring
-`createConfiguredA2ARuntimeIntegration({ configHome })` and passing its
-`runtimeOptions` as `externalAgents` — the CLI does this for its embedded
-sessions and the daemon Host it launches, and the `worker.configuredA2A` opt-in
-was removed with the Worker facade in v0.7.97. `a2a serve` loads
+The shared Host loads this configured plane through its internal
+`createConfiguredA2ARuntimeIntegration({ configHome })` wiring. SDK clients
+connect to that Host; public `externalAgents` function injection is retired.
+The `worker.configuredA2A` opt-in was removed with the Worker facade in v0.7.97.
+`a2a serve` loads
 its configured MCP/Extension capability surface before listening and pins that
 execution authority; it hot-reloads publication, authentication, and limits.
 
@@ -1795,7 +1857,7 @@ import { SkillRegistry } from '@kodax-ai/kodax/skills';         // zero-dep skil
 import { loadConfig } from '@kodax-ai/kodax/repl';              // REPL config / session helpers
 import { createMcpManager } from '@kodax-ai/kodax/mcp';         // MCP popout manager (v0.7.42)
 import { listSessions } from '@kodax-ai/kodax/session';         // session history helpers
-import { createKodaXRuntime } from '@kodax-ai/kodax/runtime';   // embedded/daemon runtime API
+import { ensureKodaXRuntime } from '@kodax-ai/kodax/runtime';   // shared Host runtime API
 import { runKodaXSandboxed } from '@kodax-ai/kodax/sandbox';    // standalone ASRT containment
 import { createKodaXA2AServer } from '@kodax-ai/kodax/a2a';    // A2A 1.0 client/server edge
 import { createMemoryAgent } from '@kodax-ai/kodax/experimental-memory'; // opt-in memory SDK
@@ -1803,7 +1865,7 @@ import { createMemoryAgent } from '@kodax-ai/kodax/experimental-memory'; // opt-
 
 All 14 SDK entries (root + 13 subpaths, including `/client`) share internal code via ESM chunk splitting — importing from `/agent` does not pull in `/repl`'s Ink + React surface.
 
-For the product contract and separate low-level inline/daemon ownership,
+For the product contract and low-level shared Host connections,
 external-agent registration and task control, session cursor pagination, workflow
 model-tier routing, and efficiency telemetry — see the
 [SDK Embedder Integration Guide](public_docs/sdk/embedder-guide.md).
@@ -2127,7 +2189,7 @@ This development tree exposes 17 SDK subpaths plus the root. Shared product
 applications use `@kodax-ai/kodax/client`; independent libraries and trusted Host
 APIs remain available through the other subpaths. See the [Client contract](docs/CLIENT_CONTRACT.md)
 and [SDK migration guide](docs/SDK_MIGRATION.md). This documentation was checked
-against package version `0.7.97-alpha.10`; npm publication is separate from
+against package version `0.7.97-alpha.12`; npm publication is separate from
 the current development-tree contract.
 
 ```bash
@@ -2145,7 +2207,7 @@ import { runInkInteractiveMode } from '@kodax-ai/kodax/repl';     // Ink TUI ent
 import { SkillRegistry } from '@kodax-ai/kodax/skills';           // zero-dep skill loader
 import { createMcpManager } from '@kodax-ai/kodax/mcp';           // MCP popout manager (v0.7.42)
 import { listSessions } from '@kodax-ai/kodax/session';           // session history helpers
-import { createKodaXRuntime } from '@kodax-ai/kodax/runtime';     // embedded/daemon runtime API
+import { ensureKodaXRuntime } from '@kodax-ai/kodax/runtime';     // shared Host runtime API
 import { runKodaXSandboxed } from '@kodax-ai/kodax/sandbox';      // explicit standalone containment
 import { createKodaXA2AServer } from '@kodax-ai/kodax/a2a';      // A2A 1.0 client/server edge
 import { createMemoryAgent } from '@kodax-ai/kodax/experimental-memory'; // opt-in experimental memory SDK
@@ -2323,10 +2385,10 @@ await runInkInteractiveMode({ provider: 'zhipu-coding', effort: 'auto' });
 | zhipu | `ZHIPU_API_KEY` | Native | glm-5 (`glm-5.3` / `glm-5.2` 1M ctx, plus `glm-5.1` / `glm-5-turbo` via `/model`; GLM-5.3 is pre-registered while the public API remains marked upcoming) |
 | zhipu-coding | `ZHIPU_CODING_API_KEY` | Native | glm-5.3 (1M ctx, 128K output; `glm-5.2` rollback plus `glm-5-turbo` / `glm-4.7` via `/model`; raw upstream IDs) |
 | zai-coding | `ZAI_CODING_API_KEY` | Native | glm-5.3 (`glm-5.2` rollback; raw upstream IDs; switched from glm-5.2 default on 2026-08-15) |
-| minimax-coding | `MINIMAX_CODING_API_KEY` | Native | MiniMax-M3 (Frontier Coding, native multimodal + 1M ctx; legacy `MiniMax-M2.7` / `MiniMax-M2.7-highspeed` remain selectable via `/model`) |
-| mimo | `MIMO_API_KEY` | Native | mimo-v2.5-pro (Xiaomi MiMo pay-per-token, Anthropic-compat) |
-| mimo-coding | `MIMO_CODING_API_KEY` | Native | mimo-v2.5-pro (Xiaomi Token Plan, Anthropic-compat) |
-| ark-coding | `ARK_CODING_API_KEY` | Native | glm-5.3 (Volcengine Ark Coding Plan — GLM-5.3 (1M ctx, 128K out) · GLM-5.2 (alias: `glm-latest`) · Kimi K2.7 Code / K2.6 · MiniMax M3 / M2.7 · DeepSeek V4 Pro / V4 Flash · Doubao Seed 2.0 Code / Pro / Lite · Doubao Seed Code) |
+| minimax-coding | `MINIMAX_CODING_API_KEY` | Native | MiniMax-M3.1-Flash (M Plan, 1M ctx, five effort levels; always-on thinking) |
+| mimo | `MIMO_API_KEY` | Native | mimo-v2.6-pro (Xiaomi MiMo pay-per-token; V2.6 Flash also selectable) |
+| mimo-coding | `MIMO_CODING_API_KEY` | Native | mimo-v2.6-pro (Xiaomi Token Plan; V2.6 Flash also selectable, image input, thinking on/off) |
+| ark-coding | `ARK_CODING_API_KEY` | Native | glm-5.3 (Ark Coding Plan; new `deepseek-v4.1-flash` / `deepseek-v4.1-flash-economy`, `glm-5.3-flash`, `kimi-k3.1-pro` / `kimi-k3` / `kimi-k2.8-preview`; all six accept images; previous configured IDs retained) |
 | deepseek | `DEEPSEEK_API_KEY` | Native | deepseek-flash (Anthropic-compat; DeepSeek-V4.1-Flash, 1M ctx, native image input; legacy text-only `deepseek-v4-pro`, via `/model`) |
 | gemini-cli | Provider CLI authentication (no KodaX API-key variable) | Prompt-only / CLI bridge | (via gemini CLI) |
 | codex-cli | Provider CLI authentication (no KodaX API-key variable) | Prompt-only / CLI bridge | (via codex CLI) |
@@ -2353,7 +2415,7 @@ kodax --session list
 kodax --parallel "Read package.json and tsconfig.json"
 
 # Adaptive multi-agent (AMA) mode — V2 Worker single-loop with Actor collaboration
-kodax --agent-mode ama "Analyze code structure, check test coverage, find bugs"
+kodax "Analyze code structure, check test coverage, find bugs"
 ```
 
 ---