@makaio/framework 1.0.0-dev-1790598955306 → 1.0.0-dev-1790614475240

package/dist/{index-CXroIgOA.d.mts → index-3G70bNLs.d.mts}

@@ -11,7 +11,7 @@ import { Qt as SESSION_EVENT_TYPES, bn as SessionMessage$1, i as MakaioSessionEv
 import { D as EntityUIConfig$1, I as FormFieldProps } from "./index-DDCixELI.mjs";
 import { l as FacetNamespaceDefinition } from "./index-Bmb7jPIe2.mjs";
 import { t as ExtensionReactionsContribution } from "./index-BRXETFym.mjs";
-import { G as SurfaceBindingDefinition, p as ExtensionArtifactViewBuildersContribution } from "./view-builder-Nffvg8MI.mjs";
+import { G as SurfaceBindingDefinition, p as ExtensionArtifactViewBuildersContribution } from "./view-builder-tgwZ1ucc.mjs";
 import { z } from "zod";
 import { MakaioBusLike, PayloadFilter, RegistrableBusNamespaceDefinition, SubjectSchema } from "@makaio/framework/core";
 import * as _$_makaio_contracts0 from "@makaio/framework/contracts";

package/dist/{index-oE2q0pTG.d.mts → index-B1uHTa1l.d.mts}

@@ -1,4 +1,4 @@
-import { c as AdapterRuntimeSnapshotErrorCode } from "./schemas-Dyp3rHZ7.mjs";
+import { c as AdapterRuntimeSnapshotErrorCode } from "./schemas-D9pXu76T.mjs";
 import { ProviderContext, ResolvedProviderContext } from "@makaio/framework/contracts";
 import { IMakaioBus } from "@makaio/framework/bus";
 

package/dist/{index-CPOJqxrf2.d.mts → index-BYMgvz_a2.d.mts}

@@ -781,8 +781,8 @@ declare const WorkerSchemas$1: {
     }, z.core.$strict>;
     response: z.ZodObject<{
       decision: z.ZodEnum<{
-        accepted: "accepted";
         fenced: "fenced";
+        accepted: "accepted";
         duplicate: "duplicate";
         conflict: "conflict";
       }>;
@@ -1386,8 +1386,8 @@ declare const WorkerNamespace: _$_makaio_core0.BusNamespaceDefinition<"worker",
     }, _$zod_v4_core0.$strict>;
     response: _$zod.ZodObject<{
       decision: _$zod.ZodEnum<{
-        accepted: "accepted";
         fenced: "fenced";
+        accepted: "accepted";
         duplicate: "duplicate";
         conflict: "conflict";
       }>;
@@ -1898,8 +1898,8 @@ declare const WorkerSubjects$1: _$_makaio_core0.BusSubjects<_$_makaio_core0.Flat
     }, _$zod_v4_core0.$strict>;
     response: _$zod.ZodObject<{
       decision: _$zod.ZodEnum<{
-        accepted: "accepted";
         fenced: "fenced";
+        accepted: "accepted";
         duplicate: "duplicate";
         conflict: "conflict";
       }>;

package/dist/{index-CGM0-mt2.d.mts → index-C-tLT_IE.d.mts}

@@ -313,8 +313,8 @@ declare const VCSCheckRunSchema: z.ZodObject<{
     cancelled: "cancelled";
     failure: "failure";
     timed_out: "timed_out";
-    skipped: "skipped";
     neutral: "neutral";
+    skipped: "skipped";
     action_required: "action_required";
   }>>;
   startedAt: z.ZodNullable<z.ZodString>;
@@ -569,8 +569,8 @@ declare const VCSSchemas: {
           cancelled: "cancelled";
           failure: "failure";
           timed_out: "timed_out";
-          skipped: "skipped";
           neutral: "neutral";
+          skipped: "skipped";
           action_required: "action_required";
         }>>;
         startedAt: z.ZodNullable<z.ZodString>;
@@ -1131,8 +1131,8 @@ declare const VCSNamespace: _$_makaio_core0.BusNamespaceDefinition<"vcs", {
           cancelled: "cancelled";
           failure: "failure";
           timed_out: "timed_out";
-          skipped: "skipped";
           neutral: "neutral";
+          skipped: "skipped";
           action_required: "action_required";
         }>>;
         startedAt: _$zod.ZodNullable<_$zod.ZodString>;
@@ -1424,8 +1424,8 @@ declare const VCSSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSubje
           cancelled: "cancelled";
           failure: "failure";
           timed_out: "timed_out";
-          skipped: "skipped";
           neutral: "neutral";
+          skipped: "skipped";
           action_required: "action_required";
         }>>;
         startedAt: _$zod.ZodNullable<_$zod.ZodString>;
@@ -1648,8 +1648,8 @@ declare function unregisterVCSProvider(bus: MakaioBusLike, providerId: string):
  * Lifecycle states for a review finding.
  */
 declare const FindingStatusSchema: z.ZodEnum<{
-  open: "open";
   verified: "verified";
+  open: "open";
   addressed: "addressed";
   dismissed: "dismissed";
   deferred: "deferred";
@@ -1733,8 +1733,8 @@ declare const ReviewFindingSchema: z.ZodObject<{
     newCode: z.ZodString;
   }, z.core.$strip>>;
   status: z.ZodEnum<{
-    open: "open";
     verified: "verified";
+    open: "open";
     addressed: "addressed";
     dismissed: "dismissed";
     deferred: "deferred";
@@ -1911,8 +1911,8 @@ declare const ReviewSchemas: {
           newCode: z.ZodString;
         }, z.core.$strip>>;
         status: z.ZodEnum<{
-          open: "open";
           verified: "verified";
+          open: "open";
           addressed: "addressed";
           dismissed: "dismissed";
           deferred: "deferred";
@@ -1943,8 +1943,8 @@ declare const ReviewSchemas: {
         headSha: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       status: z.ZodOptional<z.ZodEnum<{
-        open: "open";
         verified: "verified";
+        open: "open";
         addressed: "addressed";
         dismissed: "dismissed";
         deferred: "deferred";
@@ -1986,8 +1986,8 @@ declare const ReviewSchemas: {
           newCode: z.ZodString;
         }, z.core.$strip>>;
         status: z.ZodEnum<{
-          open: "open";
           verified: "verified";
+          open: "open";
           addressed: "addressed";
           dismissed: "dismissed";
           deferred: "deferred";
@@ -2048,8 +2048,8 @@ declare const ReviewSchemas: {
         }>;
         id: z.ZodString;
         status: z.ZodEnum<{
-          open: "open";
           verified: "verified";
+          open: "open";
           addressed: "addressed";
           dismissed: "dismissed";
           deferred: "deferred";
@@ -2113,8 +2113,8 @@ declare const ReviewSchemas: {
           newCode: z.ZodString;
         }, z.core.$strip>>;
         status: z.ZodEnum<{
-          open: "open";
           verified: "verified";
+          open: "open";
           addressed: "addressed";
           dismissed: "dismissed";
           deferred: "deferred";
@@ -2144,8 +2144,8 @@ declare const ReviewSchemas: {
         headSha: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>;
       status: z.ZodEnum<{
-        open: "open";
         verified: "verified";
+        open: "open";
         addressed: "addressed";
         dismissed: "dismissed";
         deferred: "deferred";
@@ -2190,8 +2190,8 @@ declare const ReviewSchemas: {
           newCode: z.ZodString;
         }, z.core.$strip>>;
         status: z.ZodEnum<{
-          open: "open";
           verified: "verified";
+          open: "open";
           addressed: "addressed";
           dismissed: "dismissed";
           deferred: "deferred";
@@ -2247,8 +2247,8 @@ declare const ReviewSchemas: {
         newCode: z.ZodString;
       }, z.core.$strip>>;
       status: z.ZodEnum<{
-        open: "open";
         verified: "verified";
+        open: "open";
         addressed: "addressed";
         dismissed: "dismissed";
         deferred: "deferred";
@@ -2262,8 +2262,8 @@ declare const ReviewSchemas: {
       rawCommentId: z.ZodNullable<z.ZodNumber>;
     }, z.core.$strip>;
     previousStatus: z.ZodEnum<{
-      open: "open";
       verified: "verified";
+      open: "open";
       addressed: "addressed";
       dismissed: "dismissed";
       deferred: "deferred";
@@ -2607,8 +2607,8 @@ declare const ReviewNamespace: _$_makaio_core0.BusNamespaceDefinition<"review",
           newCode: _$zod.ZodString;
         }, _$zod_v4_core0.$strip>>;
         status: _$zod.ZodEnum<{
-          open: "open";
           verified: "verified";
+          open: "open";
           addressed: "addressed";
           dismissed: "dismissed";
           deferred: "deferred";
@@ -2634,8 +2634,8 @@ declare const ReviewNamespace: _$_makaio_core0.BusNamespaceDefinition<"review",
         headSha: _$zod.ZodOptional<_$zod.ZodString>;
       }, _$zod_v4_core0.$strip>;
       status: _$zod.ZodOptional<_$zod.ZodEnum<{
-        open: "open";
         verified: "verified";
+        open: "open";
         addressed: "addressed";
         dismissed: "dismissed";
         deferred: "deferred";
@@ -2677,8 +2677,8 @@ declare const ReviewNamespace: _$_makaio_core0.BusNamespaceDefinition<"review",
           newCode: _$zod.ZodString;
         }, _$zod_v4_core0.$strip>>;
         status: _$zod.ZodEnum<{
-          open: "open";
           verified: "verified";
+          open: "open";
           addressed: "addressed";
           dismissed: "dismissed";
           deferred: "deferred";
@@ -2725,8 +2725,8 @@ declare const ReviewNamespace: _$_makaio_core0.BusNamespaceDefinition<"review",
         }>;
         id: _$zod.ZodString;
         status: _$zod.ZodEnum<{
-          open: "open";
           verified: "verified";
+          open: "open";
           addressed: "addressed";
           dismissed: "dismissed";
           deferred: "deferred";
@@ -2790,8 +2790,8 @@ declare const ReviewNamespace: _$_makaio_core0.BusNamespaceDefinition<"review",
           newCode: _$zod.ZodString;
         }, _$zod_v4_core0.$strip>>;
         status: _$zod.ZodEnum<{
-          open: "open";
           verified: "verified";
+          open: "open";
           addressed: "addressed";
           dismissed: "dismissed";
           deferred: "deferred";
@@ -2816,8 +2816,8 @@ declare const ReviewNamespace: _$_makaio_core0.BusNamespaceDefinition<"review",
         headSha: _$zod.ZodOptional<_$zod.ZodString>;
       }, _$zod_v4_core0.$strip>;
       status: _$zod.ZodEnum<{
-        open: "open";
         verified: "verified";
+        open: "open";
         addressed: "addressed";
         dismissed: "dismissed";
         deferred: "deferred";
@@ -2862,8 +2862,8 @@ declare const ReviewNamespace: _$_makaio_core0.BusNamespaceDefinition<"review",
           newCode: _$zod.ZodString;
         }, _$zod_v4_core0.$strip>>;
         status: _$zod.ZodEnum<{
-          open: "open";
           verified: "verified";
+          open: "open";
           addressed: "addressed";
           dismissed: "dismissed";
           deferred: "deferred";
@@ -2914,8 +2914,8 @@ declare const ReviewNamespace: _$_makaio_core0.BusNamespaceDefinition<"review",
         newCode: _$zod.ZodString;
       }, _$zod_v4_core0.$strip>>;
       status: _$zod.ZodEnum<{
-        open: "open";
         verified: "verified";
+        open: "open";
         addressed: "addressed";
         dismissed: "dismissed";
         deferred: "deferred";
@@ -2929,8 +2929,8 @@ declare const ReviewNamespace: _$_makaio_core0.BusNamespaceDefinition<"review",
       rawCommentId: _$zod.ZodNullable<_$zod.ZodNumber>;
     }, _$zod_v4_core0.$strip>;
     previousStatus: _$zod.ZodEnum<{
-      open: "open";
       verified: "verified";
+      open: "open";
       addressed: "addressed";
       dismissed: "dismissed";
       deferred: "deferred";
@@ -3059,8 +3059,8 @@ declare const ReviewSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSu
           newCode: _$zod.ZodString;
         }, _$zod_v4_core0.$strip>>;
         status: _$zod.ZodEnum<{
-          open: "open";
           verified: "verified";
+          open: "open";
           addressed: "addressed";
           dismissed: "dismissed";
           deferred: "deferred";
@@ -3086,8 +3086,8 @@ declare const ReviewSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSu
         headSha: _$zod.ZodOptional<_$zod.ZodString>;
       }, _$zod_v4_core0.$strip>;
       status: _$zod.ZodOptional<_$zod.ZodEnum<{
-        open: "open";
         verified: "verified";
+        open: "open";
         addressed: "addressed";
         dismissed: "dismissed";
         deferred: "deferred";
@@ -3129,8 +3129,8 @@ declare const ReviewSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSu
           newCode: _$zod.ZodString;
         }, _$zod_v4_core0.$strip>>;
         status: _$zod.ZodEnum<{
-          open: "open";
           verified: "verified";
+          open: "open";
           addressed: "addressed";
           dismissed: "dismissed";
           deferred: "deferred";
@@ -3177,8 +3177,8 @@ declare const ReviewSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSu
         }>;
         id: _$zod.ZodString;
         status: _$zod.ZodEnum<{
-          open: "open";
           verified: "verified";
+          open: "open";
           addressed: "addressed";
           dismissed: "dismissed";
           deferred: "deferred";
@@ -3242,8 +3242,8 @@ declare const ReviewSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSu
           newCode: _$zod.ZodString;
         }, _$zod_v4_core0.$strip>>;
         status: _$zod.ZodEnum<{
-          open: "open";
           verified: "verified";
+          open: "open";
           addressed: "addressed";
           dismissed: "dismissed";
           deferred: "deferred";
@@ -3268,8 +3268,8 @@ declare const ReviewSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSu
         headSha: _$zod.ZodOptional<_$zod.ZodString>;
       }, _$zod_v4_core0.$strip>;
       status: _$zod.ZodEnum<{
-        open: "open";
         verified: "verified";
+        open: "open";
         addressed: "addressed";
         dismissed: "dismissed";
         deferred: "deferred";
@@ -3314,8 +3314,8 @@ declare const ReviewSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSu
           newCode: _$zod.ZodString;
         }, _$zod_v4_core0.$strip>>;
         status: _$zod.ZodEnum<{
-          open: "open";
           verified: "verified";
+          open: "open";
           addressed: "addressed";
           dismissed: "dismissed";
           deferred: "deferred";
@@ -3366,8 +3366,8 @@ declare const ReviewSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSu
         newCode: _$zod.ZodString;
       }, _$zod_v4_core0.$strip>>;
       status: _$zod.ZodEnum<{
-        open: "open";
         verified: "verified";
+        open: "open";
         addressed: "addressed";
         dismissed: "dismissed";
         deferred: "deferred";
@@ -3381,8 +3381,8 @@ declare const ReviewSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSu
       rawCommentId: _$zod.ZodNullable<_$zod.ZodNumber>;
     }, _$zod_v4_core0.$strip>;
     previousStatus: _$zod.ZodEnum<{
-      open: "open";
       verified: "verified";
+      open: "open";
       addressed: "addressed";
       dismissed: "dismissed";
       deferred: "deferred";
@@ -6797,8 +6797,8 @@ type OutcomeAckDecision = 'accepted' | 'duplicate' | 'conflict' | 'fenced';
  * Zod schema for outcome ACK decisions.
  */
 declare const OutcomeAckDecisionSchema: z.ZodEnum<{
-  accepted: "accepted";
   fenced: "fenced";
+  accepted: "accepted";
   duplicate: "duplicate";
   conflict: "conflict";
 }>;

package/dist/{index-xqiInEhj.d.mts → index-DmV9ybgT.d.mts}

@@ -56,7 +56,29 @@ declare class ToolApprovalService extends BaseService {
    */
   private dispatchAlwaysAskApproval;
   /**
-   * Evaluate `.makaioignore` file access rules before policy cascade handling.
+   * Evaluate `.makaioignore` file access rules and the directory allowlist before policy
+   * cascade handling.
+   *
+   * The rules are tested against both the lexical and the canonical (symlink-resolved)
+   * target, so an in-tree symlink cannot alias a denied path such as `.git/config`. A
+   * target that cannot be canonicalized safely (dangling symlink, non-`ENOENT` error) is
+   * denied; a missing file canonicalizes through its nearest existing ancestor, so a Write
+   * of a new file stays possible. A symlinked cwd itself is not covered: the rules are
+   * cwd-relative, so a canonical spelling outside the lexical cwd is not matched (same
+   * limit as `createPathValidator` in the filesystem extension).
+   *
+   * A raw path argument with a `..` segment (split on `/` and `\`) is denied outright:
+   * `path.resolve` collapses `..` before symlinks are followed, so `link/../config` with
+   * `link -> .git/subdir` would be checked as `<cwd>/config` while the OS opens
+   * `<cwd>/.git/config`. This also denies harmless spellings such as `src/../README.md`.
+   *
+   * The allowlist is `agent.allowedDirectories`, else the profile's. A target whose
+   * canonical path lies outside every entry is denied, so an empty list denies every
+   * native file-tool call with a path, matching the runtime contract and the filesystem
+   * extension's path validator. An absent list (`undefined`) adds no containment. An
+   * agent with a `profileId` but no own list gets `[]` when the profile RPC is unhandled
+   * or fails, so such a host denies all native file-tool calls with a path; hosts without
+   * a profile service set the agent's `allowedDirectories` or leave `profileId` unset.
    * @param payload - Incoming tool approval payload
    * @param context - CWD and directory constraints for rule evaluation
    * @returns Deny message when access should be blocked, otherwise undefined
@@ -116,4 +138,4 @@ declare class ToolApprovalService extends BaseService {
   private resolveHarnessPolicy;
 }
 //#endregion
-export { ToolApprovalService as t };
+export { ToolApprovalServiceOptions as n, ToolApprovalService as t };

package/dist/{index-D9hIDsPr.d.mts → index-DyWD9bfP.d.mts}

@@ -5,7 +5,8 @@ import { BusTransport, IFilteredBus, IMakaioBus, SubjectTelemetryProjectorRegist
 import { DispatchingAuth, HmacAuth, TransportAuth } from "@makaio/framework/node/transports";
 import { ContributionProcessor, ExtensionCoordinator, ExtensionRuntimeSurface, KernelExtensionContext, KernelMakaioExtension, RuntimeCapability, TransportProvider, WindowRegistry } from "@makaio/framework/kernel";
 import { StorageEngine } from "@makaio/framework/storage/drizzle";
-import { Toolset } from "@makaio/framework/tools";
+import { FileAccessRuleProvider, Toolset } from "@makaio/framework/tools";
+import { FrameworkFileAccessOptions } from "@makaio/framework/services";
 import { IAdapterConfigRepository } from "@makaio/framework/services/adapter-subsystem";
 import { PostInstallHandler, StrategyDependencies } from "@makaio/framework/clients";
 import { DatabaseClient } from "@makaio/framework/storage/drizzle/client";
@@ -356,9 +357,11 @@ type RuntimeOwnershipPackageView = Pick<KernelMakaioExtension, 'name' | 'display
  * `runtimeOwnership.sessionOrchestrator`, and boot fails if more than one
  * loaded extension declares that ownership.
  * @param loadedExtensionPackages - Descriptor-loaded executable extension packages.
+ * @param fileAccessOptions - Host file-access rule provider bound into the tool
+ *   registry and tool approval packages; without one the static core set is used.
  * @returns Framework core packages for this boot.
  */
-declare function selectFrameworkCorePackages(loadedExtensionPackages: ReadonlyArray<RuntimeOwnershipPackageView> | true): ReadonlyArray<KernelMakaioExtension>;
+declare function selectFrameworkCorePackages(loadedExtensionPackages: ReadonlyArray<RuntimeOwnershipPackageView> | true, fileAccessOptions?: FrameworkFileAccessOptions): ReadonlyArray<KernelMakaioExtension>;
 //#endregion
 //#region runtimes/node/src/initialize-node-database.d.ts
 /**
@@ -1111,6 +1114,47 @@ interface CoreBootOptions {
    * `MachineIdentity` shape.
    */
   readonly machineIdentity?: PersistedMachineIdentity;
+  /**
+   * Host-provided file-access rule provider (`.makaioignore` hierarchy plus
+   * built-in deny list), for example `createMakaioIgnoreProvider()` from
+   * `@makaio/extension-filesystem`.
+   *
+   * When provided, boot binds it into the framework tool registry, which
+   * injects the resolved rules into every tool execution context, and into the
+   * tool approval service, which denies file tool calls whose path argument
+   * names a restricted path (lexical or symlink-resolved) before any approval
+   * policy applies. When omitted, neither enforces file-access rules.
+   *
+   * Scope:
+   * - The patterns apply inside the agent's working directory. With a provider
+   *   configured, the approval service also denies native file-tool calls
+   *   outside the agent's `allowedDirectories` (else the profile's); an empty
+   *   list denies every native file-tool call with a path. Without
+   *   `allowedDirectories` (`undefined`), paths outside the working directory
+   *   are not restricted by this check. An agent with a `profileId` but no own
+   *   list gets an empty list when the profile RPC is unhandled or fails, so a
+   *   host without a profile service denies all native file tools for such
+   *   agents unless it sets the agent's `allowedDirectories`.
+   * - A path argument with a `..` segment is denied, because resolving it
+   *   before following symlinks could alias a restricted path; harmless
+   *   spellings such as `src/../README.md` are denied too.
+   * - `Glob` and `Grep` are checked on their supplied search root only. Without
+   *   a `path` argument they get no file-access check, and files reached
+   *   recursively are not filtered by the patterns; filtering descendants needs
+   *   OS-level isolation (Cyberport FACT-272).
+   * - A symlinked working directory itself is not resolved: the patterns match
+   *   cwd-relative spellings only.
+   * - Only file tools with a path argument are inspected. Shell commands and
+   *   other tools without a path argument are not.
+   * - A known file-tool call from an agent without a working directory is
+   *   denied (fail-closed), because the rules cannot be resolved without one.
+   * - Boot fails when an extension overrides the framework tool registry or
+   *   tool approval package while a provider is configured, since the
+   *   override would drop the provider.
+   * - Workflow-worker tool registries are not covered: they run in separate
+   *   threads or processes and do not receive this provider.
+   */
+  readonly fileAccessRuleProvider?: FileAccessRuleProvider;
   /**
    * Host launcher command embedded into client wiring installed from warning actions.
    *

package/dist/{index-CZIFCrMc.d.mts → index-_CsKmUOy.d.mts}

@@ -17,8 +17,8 @@ declare const ClientExecutionContextSchema: z.ZodObject<{
   env: z.ZodRecord<z.ZodString, z.ZodString>;
   configDir: z.ZodNullable<z.ZodString>;
   source: z.ZodEnum<{
-    managed: "managed";
     global: "global";
+    managed: "managed";
   }>;
   version: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
@@ -39,8 +39,8 @@ declare const ClientResolveBinarySchema: {
     sessionId: z.ZodOptional<z.ZodString>;
     projectDir: z.ZodOptional<z.ZodString>;
     preferSource: z.ZodOptional<z.ZodEnum<{
-      managed: "managed";
       global: "global";
+      managed: "managed";
     }>>;
     harnessId: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
@@ -49,8 +49,8 @@ declare const ClientResolveBinarySchema: {
     env: z.ZodRecord<z.ZodString, z.ZodString>;
     configDir: z.ZodNullable<z.ZodString>;
     source: z.ZodEnum<{
-      managed: "managed";
       global: "global";
+      managed: "managed";
     }>;
     version: z.ZodNullable<z.ZodString>;
   }, z.core.$strip>;
@@ -788,8 +788,8 @@ declare const ClientSchemas: {
       sessionId: z.ZodOptional<z.ZodString>;
       projectDir: z.ZodOptional<z.ZodString>;
       preferSource: z.ZodOptional<z.ZodEnum<{
-        managed: "managed";
         global: "global";
+        managed: "managed";
       }>>;
       harnessId: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
@@ -798,8 +798,8 @@ declare const ClientSchemas: {
       env: z.ZodRecord<z.ZodString, z.ZodString>;
       configDir: z.ZodNullable<z.ZodString>;
       source: z.ZodEnum<{
-        managed: "managed";
         global: "global";
+        managed: "managed";
       }>;
       version: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>;
@@ -1636,6 +1636,11 @@ type ClientSessionObservedBase = z.infer<typeof ClientSessionObservedBaseSchema>
  * Maps 1:1 to the Claude Code SDK `SessionStartHookInput.source` union:
  * `'startup'` → `'fresh'`, `'resume'` → `'resume'` or `'fork'` (after
  * transcript sniff), `'clear'` → `'clear'`, `'compact'` → `'compact'`.
+ *
+ * Codex CLI `0.158.0` `SessionStart.source`: `'startup'` → `'fresh'`,
+ * `'resume'` → `'resume'`, `'clear'` → `'clear'`, `'compact'` → `'compact'`,
+ * `'fork'` → `'fork'` with the parent recovered from the rollout file, or
+ * `'fresh'` when the parent cannot be recovered.
  */
 declare const CLIENT_SESSION_START_MODES: readonly ["fresh", "fork", "resume", "clear", "compact"];
 /** Zod schema for the client-reported session start mode. */
@@ -2682,8 +2687,8 @@ declare const ClientNamespace: _$_makaio_core0.BusNamespaceDefinition<"client",
       sessionId: _$zod.ZodOptional<_$zod.ZodString>;
       projectDir: _$zod.ZodOptional<_$zod.ZodString>;
       preferSource: _$zod.ZodOptional<_$zod.ZodEnum<{
-        managed: "managed";
         global: "global";
+        managed: "managed";
       }>>;
       harnessId: _$zod.ZodOptional<_$zod.ZodString>;
     }, _$zod_v4_core0.$strip>;
@@ -2692,8 +2697,8 @@ declare const ClientNamespace: _$_makaio_core0.BusNamespaceDefinition<"client",
       env: _$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>;
       configDir: _$zod.ZodNullable<_$zod.ZodString>;
       source: _$zod.ZodEnum<{
-        managed: "managed";
         global: "global";
+        managed: "managed";
       }>;
       version: _$zod.ZodNullable<_$zod.ZodString>;
     }, _$zod_v4_core0.$strip>;
@@ -3412,8 +3417,8 @@ declare const ClientSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSu
       sessionId: _$zod.ZodOptional<_$zod.ZodString>;
       projectDir: _$zod.ZodOptional<_$zod.ZodString>;
       preferSource: _$zod.ZodOptional<_$zod.ZodEnum<{
-        managed: "managed";
         global: "global";
+        managed: "managed";
       }>>;
       harnessId: _$zod.ZodOptional<_$zod.ZodString>;
     }, _$zod_v4_core0.$strip>;
@@ -3422,8 +3427,8 @@ declare const ClientSubjects: _$_makaio_core0.BusSubjects<_$_makaio_core0.FlatSu
       env: _$zod.ZodRecord<_$zod.ZodString, _$zod.ZodString>;
       configDir: _$zod.ZodNullable<_$zod.ZodString>;
       source: _$zod.ZodEnum<{
-        managed: "managed";
         global: "global";
+        managed: "managed";
       }>;
       version: _$zod.ZodNullable<_$zod.ZodString>;
     }, _$zod_v4_core0.$strip>;