@namzu/sdk 43.0.0 → 44.1.0

package/src/types/guardrail/index.ts

@@ -1,14 +1,14 @@
-import type { RunId } from '../ids/index.js'
+import type { SessionId, TurnId } from '../ids/index.js'
 import type { Message } from '../message/index.js'
 import type { ToolProvenance } from '../tool/index.js'
 
 /**
- * Guardrails inspect what goes INTO a run and what comes OUT of it.
+ * Guardrails inspect what goes INTO a turn and what comes OUT of it.
  *
  * namzu had three good gates on tool calls — probe veto, `AuthorizationGate`,
  * HITL review — and they all point the same way: they protect the world
  * from the agent. Nothing protected the user from the agent's own output,
- * and nothing looked at the prompt before the run started.
+ * and nothing looked at the prompt before the turn started.
  *
  * The concrete failure: an agent reads a credential file, the read is
  * allowed (it is a legitimate file), the secret enters context, and it is
@@ -17,16 +17,18 @@ import type { ToolProvenance } from '../tool/index.js'
  */
 
 export interface InputGuardrailContext {
-	readonly runId: RunId
-	/** The messages the run is about to start with. */
+	readonly sessionId: SessionId
+	readonly turnId: TurnId
+	/** The messages the turn is about to start with. */
 	readonly messages: readonly Message[]
 	/** The assembled system prompt, when there is one. */
 	readonly systemPrompt?: string
 }
 
 export interface OutputGuardrailContext {
-	readonly runId: RunId
-	/** The run's final assistant text. */
+	readonly sessionId: SessionId
+	readonly turnId: TurnId
+	/** The turn's final assistant text. */
 	readonly output: string
 	/** Full message history, for a guardrail that needs the conversation. */
 	readonly messages: readonly Message[]
@@ -62,7 +64,7 @@ export interface NamedGuardrail<T> {
 /**
  * What a guardrail sees when a tool has produced a result.
  *
- * The two above bracket the RUN. This one sits at the tool boundary, which
+ * The two above bracket the TURN. This one sits at the tool boundary, which
  * is the only place a result can be examined before the model reads it:
  * the registry returns to the executor, the executor applies the output
  * budget and spills what is over it, and compaction summarises later still.
@@ -93,8 +95,8 @@ export interface ToolResultGuardrailContext {
 /**
  * What a guardrail decided about a tool result.
  *
- * Deliberately NOT {@link GuardrailVerdict}. There, `block` ends the run —
- * it is the only thing it can mean when the subject is the run's input or
+ * Deliberately NOT {@link GuardrailVerdict}. There, `block` ends the turn —
+ * it is the only thing it can mean when the subject is the turn's input or
  * its final answer. At a tool boundary the useful refusal is usually the
  * other one: fail this call, tell the model why, and let it choose
  * something else. Reusing the word would give one spelling two meanings

package/src/types/hitl/index.ts

@@ -1,10 +1,5 @@
-import type { WorkingStateSnapshot } from '../../compaction/wire.js'
-import type { SerializedSpanContext } from '../../telemetry/attributes.js'
 import type { CostInfo, TokenUsage } from '../common/index.js'
-import type { CheckpointId, PlanId, RunId } from '../ids/index.js'
-import type { Message, UserMessage } from '../message/index.js'
-import type { PlanStatus } from '../plan/index.js'
-import type { TokenBudgetBinding } from '../run/token-budget-store.js'
+import type { CheckpointId, PlanId, SessionId, TurnId } from '../ids/index.js'
 
 export type { CheckpointId }
 
@@ -16,7 +11,7 @@ export type HITLResumeDecision =
 			action: 'approve_tools'
 			/**
 			 * Grant keys to remember, so calls covered by them are not asked
-			 * about again for the rest of the run.
+			 * about again for the rest of the turn.
 			 *
 			 * Nothing is remembered unless this says so, and only an explicit
 			 * approval can say it — a denial or a non-response leaves nothing
@@ -32,8 +27,26 @@ export type HITLResumeDecision =
 			 * only way out was a blanket grant that also covered `rm -rf`.
 			 */
 			remember?: readonly string[]
+			/**
+			 * Ids of calls whose sandbox escape a reviewer confirmed.
+			 *
+			 * A call that asks to leave the sandbox
+			 * (`ToolCallSummary.escalation.sandboxEscape`) runs unconfined only
+			 * when its id is here. An approval that does not list it refuses
+			 * that call and runs the rest, so a policy that answers
+			 * `approve_tools` to everything — an auto mode, a remembered
+			 * "approve all", a host's own blanket handler — cannot grant an
+			 * escape by accident. `createReviewHandler` fills it only after a
+			 * person said yes to a batch that showed the escape.
+			 */
+			confirmedEscalations?: readonly string[]
+	  }
+	| {
+			action: 'modify_tools'
+			modifications: ToolModification[]
+			/** See the `approve_tools` field of the same name. */
+			confirmedEscalations?: readonly string[]
 	  }
-	| { action: 'modify_tools'; modifications: ToolModification[] }
 	| { action: 'reject_tools'; feedback: string }
 	| {
 			action: 'answer_question'
@@ -42,8 +55,8 @@ export type HITLResumeDecision =
 			/**
 			 * Echo of `UserQuestionData.questionId` — the misdirection
 			 * guard. The park/resolve registry on hosts is typically
-			 * keyed by run, so a stale client can answer question N
-			 * after question N+1 re-parked under the same run. When
+			 * keyed by turn, so a stale client can answer question N
+			 * after question N+1 re-parked under the same turn. When
 			 * present and it does not match the asking tool's own
 			 * questionId, the tool treats the decision as unanswered
 			 * instead of fabricating a selection against the wrong
@@ -55,15 +68,34 @@ export type HITLResumeDecision =
 	| { action: 'abort'; reason: string }
 
 export type HITLDecisionRequest =
-	| { type: 'plan_approval'; runId: RunId; checkpointId: CheckpointId; plan: PlanApprovalData }
-	| { type: 'tool_review'; runId: RunId; checkpointId: CheckpointId; toolCalls: ToolCallSummary[] }
+	| {
+			type: 'plan_approval'
+			sessionId: SessionId
+			turnId: TurnId
+			checkpointId: CheckpointId
+			plan: PlanApprovalData
+	  }
+	| {
+			type: 'tool_review'
+			sessionId: SessionId
+			turnId: TurnId
+			checkpointId: CheckpointId
+			toolCalls: ToolCallSummary[]
+	  }
 	| {
 			type: 'iteration_checkpoint'
-			runId: RunId
+			sessionId: SessionId
+			turnId: TurnId
 			checkpointId: CheckpointId
 			summary: CheckpointSummary
 	  }
-	| { type: 'user_question'; runId: RunId; checkpointId: CheckpointId; question: UserQuestionData }
+	| {
+			type: 'user_question'
+			sessionId: SessionId
+			turnId: TurnId
+			checkpointId: CheckpointId
+			question: UserQuestionData
+	  }
 
 export type ResumeHandler = (request: HITLDecisionRequest) => Promise<HITLResumeDecision>
 
@@ -85,6 +117,33 @@ export interface ToolCallSummary {
 		/** A matching rule requested review; read-only exemptions must not bypass it. */
 		explicitReview?: true
 	}
+	/**
+	 * What this call reaches beyond the turn's ordinary boundary, as the
+	 * kernel found it in the prepared input. Absent for the ordinary call.
+	 *
+	 * A call carrying one is always reviewed: an `allow` rule, a remembered
+	 * grant, a read-only declaration and `accept-edits` all decline to
+	 * approve it on their own. A `deny` rule still refuses it outright.
+	 */
+	escalation?: ToolCallEscalation
+}
+
+/** See {@link ToolCallSummary.escalation}. */
+export interface ToolCallEscalation {
+	/**
+	 * Absolute paths the call names outside the working directory and the
+	 * added directories. Present only when the turn reviews such paths
+	 * (`QueryParams.outsideRootAccess: 'review'`) and runs without a sandbox;
+	 * an approval lets this call, and only this call, reach them.
+	 */
+	outsidePaths?: readonly string[]
+	/**
+	 * The call asks to run outside the turn's sandbox. Present only when the
+	 * turn has a sandbox and allows escapes (`QueryParams.sandboxEscape:
+	 * 'review'`). Honoured only when the decision lists the call's id in
+	 * `confirmedEscalations`.
+	 */
+	sandboxEscape?: true
 }
 
 export interface ToolModification {
@@ -156,23 +215,23 @@ export interface CheckpointSummary {
 }
 
 /**
- * A decision the run is parked on, recorded durably.
+ * A decision a turn is parked on, recorded durably (`decision_requested`).
  *
  * Without this the park exists only as a suspended `await` inside one
  * process: a checkpoint written at a tool-review gate looks identical to a
  * checkpoint written mid-run, so nothing on disk says "a human owes this
  * run an answer". Kill the process and the request is gone — the approval
  * queue a host would build from durable state has nothing to read, and a
- * resumed run silently re-asks the model instead of honoring the approval
+ * resumed turn silently re-asks the model instead of honoring the approval
  * that was already granted.
  *
  * `request` is stored verbatim so a fresh process can render exactly what
  * the human was shown, and apply the answer to exactly those tool calls.
  */
 export interface PendingDecision {
-	/** The request the run parked on, as the `resumeHandler` received it. */
+	/** The request the turn parked on, as the `resumeHandler` received it. */
 	readonly request: HITLDecisionRequest
-	/** Epoch ms at which the run parked. */
+	/** Epoch ms at which the turn parked. */
 	readonly parkedAt: number
 	/**
 	 * Epoch ms after which this park is no longer worth serving.
@@ -180,14 +239,14 @@ export interface PendingDecision {
 	 * Absolute, not a duration, so it survives the process that set it —
 	 * every timer in the SDK is an in-process `setTimeout` and the
 	 * park-record delay is deliberately `unref`'d, so nothing in-memory can
-	 * outlive a redeploy. Without it a run parks for approval, the worker is
+	 * outlive a redeploy. Without it a turn parks for approval, the worker is
 	 * replaced, nobody answers, and the checkpoint stays outstanding
 	 * forever: every approval-queue reader keeps serving it and its
 	 * workspace is never reclaimed.
 	 *
-	 * The run timeout cannot cover this. `checkLimitsDetailed` is only
+	 * The turn timeout cannot cover this. `checkLimitsDetailed` is only
 	 * reached between iterations and a park suspends mid-iteration, so a
-	 * long-lived process hard-stops the run immediately AFTER the human
+	 * long-lived process hard-stops the turn immediately AFTER the human
 	 * finally approves, while across a restart the restored elapsed time
 	 * excludes parked time entirely — the same configuration giving two
 	 * opposite outcomes.
@@ -205,109 +264,6 @@ export interface PendingDecision {
 	readonly decision?: HITLResumeDecision
 }
 
-export interface IterationCheckpoint {
-	/** Reference to the canonical tree ledger; a checkpoint never resets it. */
-	readonly budgetBinding?: TokenBudgetBinding
-	/** Also present for non-durable accounts; those require the live authority on resume. */
-	readonly budgetAccountId?: string
-	id: CheckpointId
-	runId: RunId
-	iteration: number
-	messages: Message[]
-	/**
-	 * Current operator/goal/steering text and provenance, independent of
-	 * compacted history. Attachments are not duplicated here. Older
-	 * checkpoints omit this field and use surviving history on resume.
-	 */
-	latestUserMessage?: UserMessage
-	/** Structured host-review rejections consumed at this checkpoint, independent of compacted messages. */
-	structuredReviewAttempts?: number
-	/** Consumed prose-answer rejections, independent of compactable feedback messages. */
-	answerReviewAttempts?: number
-	/** Native structured-output corrections consumed independently of message history. */
-	nativeStructuredAttempts?: number
-	tokenUsage: TokenUsage
-	costInfo: CostInfo
-	/**
-	 * **Never set.** No checkpoint is written with a plan status.
-	 *
-	 * It matters more than an unused field usually would: a host restoring a
-	 * checkpoint and reading this to decide whether the plan was approved
-	 * gets `undefined` for every run, approved or not, and cannot tell the
-	 * two apart. Ask the plan manager instead.
-	 *
-	 * @deprecated No producer. Removed in the next major.
-	 */
-	planStatus?: PlanStatus
-
-	/**
-	 * When the RUN was attributed — not when this checkpoint was written.
-	 * See {@link IterationCheckpoint.createdAt} for the latter.
-	 *
-	 * Denormalized onto every checkpoint of the run, identically, and that
-	 * repetition is the whole point. A listing above the run needs a key it
-	 * can order by, and a key a paging caller can trust is one that cannot
-	 * MOVE. Every other time a checkpoint store can derive per run moves: the
-	 * newest checkpoint's `createdAt` advances every time the run checkpoints
-	 * again, and the oldest one's advances every time `prune` deletes
-	 * oldest-first. Carried on all of them, this one survives both — pruning
-	 * cannot reach a value every survivor also holds.
-	 *
-	 * `readonly`, and written exactly once per run by
-	 * {@link import('../../runtime/query/checkpoint.js').CheckpointManager},
-	 * which settles it on whichever comes first — adopting it from the
-	 * checkpoint a resume restores, or minting it from the run's own start
-	 * instant — and never reassigns after. A field that COULD be updated is
-	 * one edit away from moving again, which would put the ordering back
-	 * where it started.
-	 *
-	 * Absent on checkpoints written before this existed. That absence is
-	 * information, not a gap: a run with no stamp on any of its checkpoints
-	 * was attributed before the stamp existed, and therefore before every
-	 * run that has one.
-	 */
-	readonly runCreatedAt?: number
-
-	/**
-	 * Present when the run parked at this checkpoint awaiting a human.
-	 * See {@link PendingDecision}.
-	 */
-	pending?: PendingDecision
-	guardState: {
-		iterationCount: number
-		elapsedMs: number
-	}
-	createdAt: number
-
-	toolResultHashes?: Record<string, string>
-
-	/**
-	 * Compaction's accumulated working state at the moment of the
-	 * checkpoint.
-	 *
-	 * Absent on checkpoints written before this existed, and absent when
-	 * compaction is disabled — in both cases the resumed run starts with an
-	 * empty manager, which is exactly today's behaviour.
-	 */
-	workingState?: WorkingStateSnapshot
-
-	/**
-	 * The trace this checkpoint was taken inside.
-	 *
-	 * A resumed run used to mint a fresh root span with a new trace id and
-	 * no link to the one that crashed, so the failure and its recovery could
-	 * not be reconstructed as one timeline. Every span carries the run id,
-	 * which is enough to find both traces by query and not enough to see one
-	 * waterfall — and even that goes away for a replay fork, which mints a
-	 * new run id.
-	 *
-	 * Absent on checkpoints written before this existed, and on runs with no
-	 * telemetry registered; in both cases the resumed run starts its own
-	 * trace, which is exactly today's behaviour.
-	 */
-	traceContext?: SerializedSpanContext
-}
-
 export function autoApproveHandler(request: HITLDecisionRequest): Promise<HITLResumeDecision> {
 	switch (request.type) {
 		case 'plan_approval':
@@ -317,7 +273,7 @@ export function autoApproveHandler(request: HITLDecisionRequest): Promise<HITLRe
 		case 'iteration_checkpoint':
 			return Promise.resolve({ action: 'continue' })
 		case 'user_question':
-			// Headless runs must never deadlock on a question and must
+			// Headless turns must never deadlock on a question and must
 			// never fabricate a user choice: answer with an explicit
 			// no-selection sentinel so the asking tool renders "the user
 			// did not answer" rather than consent.

package/src/types/hitl/policy.ts

@@ -1,12 +1,12 @@
-import type { RunId } from '../ids/index.js'
+import type { SessionId, TurnId } from '../ids/index.js'
 import type { ResumeHandler } from './index.js'
 
 /**
- * Who answers when the run asks a human, as a value rather than a closure.
+ * Who answers when a turn asks a human, as a value rather than a closure.
  *
  * `ResumeHandler` was captured once at `query()` start and never read again
  * from anywhere a host could reach — so switching from "ask me about every
- * write" to "go ahead, I'm stepping out" meant ending the run and starting
+ * write" to "go ahead, I'm stepping out" meant ending the turn and starting
  * another. That is the same defect `permissionMode` had before it became a
  * box the executor reads through, and it has the same cost: the fix
  * discards the in-flight step and the context that step was built from.
@@ -33,7 +33,7 @@ export interface ApprovalPolicy {
  * writes before the record landed would leave a log where the approvals
  * precede the decision that permitted them.
  */
-export interface RunApprovalPolicy {
+export interface SessionApprovalPolicy {
 	readonly current: ApprovalPolicy
 	/**
 	 * Swap the policy, recording who and why.
@@ -49,7 +49,7 @@ export interface RunApprovalPolicy {
 	 * The change the model has not been told about yet — and reading it is
 	 * what marks it told.
 	 *
-	 * The model plans around how closely it is being watched. A run that
+	 * The model plans around how closely it is being watched. A turn that
 	 * silently stops asking a human, or silently starts, leaves the model
 	 * working from a supervision assumption that is no longer true: it will
 	 * keep batching destructive calls it expects to be reviewed, or keep
@@ -76,7 +76,9 @@ export interface ApprovalPolicyChange {
 /** The durable record of a policy change. */
 export interface ApprovalPolicyChangedEvent {
 	readonly type: 'approval_policy_changed'
-	readonly runId: RunId
+	readonly sessionId: SessionId
+	/** Absent when the policy changed between turns. */
+	readonly turnId?: TurnId
 	readonly from: string
 	readonly to: string
 	readonly reason: string

package/src/types/ids/brand.ts

@@ -1,11 +1,19 @@
 /** Nominal identity is independent of the identifier's serialized spelling. */
 declare const ID_BRAND: unique symbol
 
-/** An opaque string whose tag prevents mixing different entity types. */
-export type Id<B extends string> = string & {
+/**
+ * The nominal tag of an entity id. An interface rather than an inline object
+ * type so a declaration file can name it: a zod schema over branded ids makes
+ * TypeScript expand the id type, and an anonymous `{ [ID_BRAND]: B }` would
+ * then need the module-private symbol spelled in the emitting file.
+ */
+export interface IdBrand<B extends string> {
 	readonly [ID_BRAND]: B
 }
 
+/** An opaque string whose tag prevents mixing different entity types. */
+export type Id<B extends string> = string & IdBrand<B>
+
 /**
  * Internal escape hatch for factories and checked constructors. Not exported
  * from the package barrel; consumers validate external strings with `as*Id`.

package/src/types/ids/index.ts

@@ -3,14 +3,21 @@ import type { Id } from './brand.js'
 /**
  * Entity ids are opaque branded strings. Factories mint UUIDs; checked
  * constructors reject every other spelling, including earlier type prefixes.
- * A RunId cannot be assigned to a SessionId even though their wire shapes
+ * A TurnId cannot be assigned to a SessionId even though their wire shapes
  * are identical. Persisted records and typed fields establish the kind,
  * not the spelling of the id.
  *
  * Brands do not validate a type assertion. Use the checked constructors
  * for values received from JSON, flags, URLs, or other untyped boundaries.
  */
-export type RunId = Id<'RunId'>
+/**
+ * One turn of a session: a user prompt (or a goal round, resident step or
+ * verification step) and everything the agent did to answer it. Recorded in
+ * the session log between `turn_started` and `turn_completed`/`turn_failed`.
+ */
+export type TurnId = Id<'TurnId'>
+/** One line of a session log. Every record carries its own UUIDv7 id. */
+export type RecordId = Id<'RecordId'>
 export type MessageId = Id<'MessageId'>
 export type SessionId = Id<'SessionId'>
 /** Identifies one durable completion goal across its revisions. */
@@ -45,11 +52,10 @@ export type CheckpointId = Id<'CheckpointId'>
 export type LockId = Id<'LockId'>
 export type AdvisoryId = Id<'AdvisoryId'>
 export type AdvisoryCallId = Id<'AdvisoryCallId'>
-export type EmergencySaveId = Id<'EmergencySaveId'>
 export type MemoryId = Id<'MemoryId'>
 export type PluginId = Id<'PluginId'>
 export type SandboxId = Id<'SandboxId'>
-/** LOG-14: the audit trail's own record id — distinct from `RunEvent.seq`. */
+/** LOG-14: the audit trail's own record id — distinct from a session record's `seq`. */
 export type AuditEventId = Id<'AuditEventId'>
 
 // Actor identifiers (Session Hierarchy §4.3).

package/src/types/memory/index.ts

@@ -14,6 +14,38 @@ export function assertMemoryStatus(status: MemoryStatus): void {
 	}
 }
 
+/**
+ * What kind of thing a memory records, which decides when it is worth
+ * reading again:
+ *
+ * - `user` — who the operator is: role, expertise, preferences.
+ * - `feedback` — a rule the operator gave about how to work, with why.
+ * - `project` — a fact or decision about the work that the code and its
+ *   history do not already say.
+ * - `reference` — where to look: a dashboard, a ticket queue, a document.
+ */
+export type MemoryType = 'user' | 'feedback' | 'project' | 'reference'
+
+export const MEMORY_TYPES: readonly MemoryType[] = ['user', 'feedback', 'project', 'reference']
+
+export function assertMemoryType(type: MemoryType): void {
+	switch (type) {
+		case 'user':
+		case 'feedback':
+		case 'project':
+		case 'reference':
+			return
+		default: {
+			const _exhaustive: never = type
+			throw new Error(`Unknown MemoryType: ${_exhaustive}`)
+		}
+	}
+}
+
+export function isMemoryType(value: unknown): value is MemoryType {
+	return typeof value === 'string' && (MEMORY_TYPES as readonly string[]).includes(value)
+}
+
 export interface MemoryIndexEntry {
 	readonly id: MemoryId
 	readonly title: string
@@ -22,6 +54,17 @@ export interface MemoryIndexEntry {
 	readonly status: MemoryStatus
 	readonly createdAt: number
 	readonly updatedAt: number
+	/**
+	 * Unique kebab-case slug (`[a-z0-9]+(-[a-z0-9]+)*`, at most 64
+	 * characters). A store that keeps one file per memory names the file
+	 * after it, and `[[name]]` in another memory's body links here. Absent on
+	 * records written before names existed.
+	 */
+	readonly name?: string
+	/** One line saying what the memory is for, used to judge relevance without reading it. */
+	readonly description?: string
+	/** Absent on records written before types existed. */
+	readonly type?: MemoryType
 }
 
 export interface MemoryContent {
@@ -58,6 +101,16 @@ export interface CreateMemoryParams {
 	readonly tags?: string[]
 	readonly format?: 'text' | 'markdown' | 'json'
 	readonly metadata?: Record<string, unknown>
+	/**
+	 * Unique slug for this memory. A store refuses a name another record
+	 * already holds with {@link MemoryNameConflictError}, which names that
+	 * record, so a caller updates it instead of writing a second copy. When
+	 * omitted, a store that requires names derives one from `title` and
+	 * suffixes it (`-2`, `-3`) until it is free.
+	 */
+	readonly name?: string
+	readonly description?: string
+	readonly type?: MemoryType
 }
 
 /** Change a memory's content or explicitly archive/reactivate it. */

package/src/types/message/index.ts

@@ -112,7 +112,7 @@ export interface Citation {
  * Inline base64 puts the bytes in the durable transcript, in every
  * checkpoint, in every compaction pass, and — because a conversation
  * resends its history — on the wire once per turn. A 4 MB PDF attached once
- * is 4 MB per request for the rest of the run.
+ * is 4 MB per request for the rest of the turn.
  */
 export interface StoredAttachmentRef {
 	readonly type: 'stored'
@@ -170,7 +170,7 @@ export interface BaseMessage {
 	/**
 	 * Exempt this message from compaction and from tool-result clearing.
 	 *
-	 * Everything the run protected before was protected by POSITION — the
+	 * Everything the turn protected before was protected by POSITION — the
 	 * leading system run, the working-memory slot, the last N turns, the
 	 * most recent tool results. A standing constraint stated in the middle
 	 * of a conversation ("the account id is X; never bill a different
@@ -184,10 +184,10 @@ export interface BaseMessage {
 	 * or an assistant-first retained tail, is not a smaller history — it is
 	 * one the provider rejects.
 	 *
-	 * Pinned turns are exempt from the reclaim that keeps a long run
+	 * Pinned turns are exempt from the reclaim that keeps a long turn
 	 * alive, so this is a budget the setter spends. Nothing caps it: a cap
 	 * would have to guess which pin mattered, and dropping the wrong one
-	 * quietly is worse than a run that overflows in the open.
+	 * quietly is worse than a turn that overflows in the open.
 	 */
 	retain?: boolean
 }

package/src/types/plan/index.ts

@@ -1,4 +1,4 @@
-import type { PlanId, RunId } from '../ids/index.js'
+import type { PlanId, SessionId, TurnId } from '../ids/index.js'
 
 export type PlanStatus =
 	| 'generating'
@@ -56,7 +56,8 @@ export interface PlanStep {
 
 export interface Plan {
 	id: PlanId
-	runId: RunId
+	sessionId: SessionId
+	turnId: TurnId
 	status: PlanStatus
 	title: string
 	summary?: string
@@ -86,7 +87,8 @@ export interface Plan {
 
 export interface PlanApprovalRequest {
 	planId: PlanId
-	runId: RunId
+	sessionId: SessionId
+	turnId: TurnId
 	title: string
 	steps: PlanStep[]
 	summary?: string