@oh-my-pi/pi-coding-agent 17.1.8 → 17.2.1

package/dist/types/session/agent-session-types.d.ts

@@ -1,4 +1,4 @@
-import type { Agent, AgentMessage, AgentTool, StreamFn, ThinkingLevel } from "@oh-my-pi/pi-agent-core";
+import type { Agent, AgentMessage, AgentTool, AgentToolContext, StreamFn, ThinkingLevel } from "@oh-my-pi/pi-agent-core";
 import type { Context, Effort, ImageContent, Message, MessageAttribution, Model, OAuthAccountSummary, ServiceTierByFamily, SimpleStreamOptions, ToolChoice } from "@oh-my-pi/pi-ai";
 import type { postmortem } from "@oh-my-pi/pi-utils";
 import type { AdvisorConfig } from "../advisor/index.js";
@@ -6,6 +6,7 @@ import type { AsyncJob, AsyncJobDeliveryState, AsyncJobManager } from "../async/
 import type { ModelRegistry } from "../config/model-registry.js";
 import type { PromptTemplate } from "../config/prompt-templates.js";
 import type { Settings, SkillsSettings } from "../config/settings.js";
+import type { CursorMcpResourceAdapter } from "../cursor.js";
 import type { RawSseDebugBuffer } from "../debug/raw-sse-buffer.js";
 import type { TtsrManager } from "../export/ttsr.js";
 import type { LoadedCustomCommand } from "../extensibility/custom-commands/index.js";
@@ -143,6 +144,8 @@ export interface AgentSessionConfig {
     sideStreamFn?: StreamFn;
     /** Stream wrapper for advisor requests. */
     advisorStreamFn?: StreamFn;
+    /** Advisor spend already recorded for the session being opened, restored on resume. */
+    initialAdvisorCosts?: ReadonlyMap<string, number>;
     /** Prefer websocket transport for OpenAI Codex requests when supported. */
     preferWebsockets?: boolean;
     /** Provider payload hook used by the active session request path. */
@@ -194,6 +197,38 @@ export interface AgentSessionConfig {
     providerPromptCacheKeySource?: "explicit" | "fork";
     /** Full advisor toolset built against an advisor-scoped tool session. */
     advisorTools?: AgentTool[];
+    /**
+     * Build a `grep` honoring a Cursor `pi_grep` frame's own context width and
+     * match cap, against the advisor-scoped tool session. Without it an advisor
+     * running on Cursor silently drops both fields.
+     */
+    advisorCreateGrepTool?(options: {
+        context?: number;
+        totalMatchLimit?: number;
+    }): AgentTool | undefined;
+    /**
+     * Build the `replace`-mode `edit` a Cursor `pi_edit` frame needs, against the
+     * advisor-scoped tool session. The advisor's ordinary instance follows the
+     * configured `edit.mode` and rejects the frame's `old_text`/`new_text` pairs.
+     */
+    advisorCreateEditTool?(): AgentTool | undefined;
+    /**
+     * The execute-time context the advisor's bridge tools resolve approval from.
+     *
+     * `ExtensionToolWrapper` reads `tools.approvalMode`, per-tool
+     * `tools.approval.<tool>` policies and `autoApprove` only from this context;
+     * with none it defaults to `yolo` with empty policies, so a bridge tool would
+     * run a native frame the user configured `ask` or `deny` for.
+     */
+    advisorGetToolContext?: () => AgentToolContext | undefined;
+    /**
+     * The live MCP connections the advisor's Cursor resource frames answer from.
+     *
+     * Advisors share the session's connections and may be granted tools from
+     * those same servers; without this their `list_mcp_resources` reports an
+     * empty catalog and every `read_mcp_resource` a `not_found`.
+     */
+    advisorMcpResources?: CursorMcpResourceAdapter;
     /** Preloaded watchdog prompt content for the advisor. */
     advisorWatchdogPrompt?: string;
     /** Shared advisor instructions loaded from WATCHDOG.yml. */

package/dist/types/session/agent-session.d.ts

@@ -12,12 +12,12 @@
  *
  * Modes use this class and add their own I/O layer on top.
  */
-import type { InMemorySnapshotStore } from "@oh-my-pi/hashline";
+import type { Clipboard, InMemorySnapshotStore } from "@oh-my-pi/hashline";
 import { type Agent, type AgentMessage, type AgentState, type AgentTool, type AgentToolContext, type AgentToolResult, type ThinkingLevel, type ToolChoiceDirective } from "@oh-my-pi/pi-agent-core";
 import { type CompactionResult, type ShakeConfig } from "@oh-my-pi/pi-agent-core/compaction";
 import type { AssistantMessage, ImageContent, Message, Model, ProviderSessionState, ResetCreditAccountStatus, ResetCreditRedeemOutcome, ResetCreditTarget, ServiceTier, ServiceTierByFamily, ServiceTierFamily, SimpleStreamOptions, TextContent, UsageReport } from "@oh-my-pi/pi-ai";
 import { type Effort } from "@oh-my-pi/pi-ai";
-import type { AdvisorConfig, AdvisorRuntimeStatus } from "../advisor/index.js";
+import { type AdvisorConfig, type AdvisorRuntimeStatus } from "../advisor/index.js";
 import { AsyncJobManager } from "../async/index.js";
 import type { ModelRegistry } from "../config/model-registry.js";
 import { type ResolvedModelRoleValue } from "../config/model-resolver.js";
@@ -75,6 +75,8 @@ export declare class AgentSession {
     }>;
     readonly yieldQueue: YieldQueue;
     fileSnapshotStore?: InMemorySnapshotStore;
+    /** Per-session `CUT`/`PASTE` clipboard register shared across edit calls. */
+    editClipboard?: Clipboard;
     readonly configWarnings: string[];
     readonly rawSseDebugBuffer: RawSseDebugBuffer;
     /**

package/dist/types/session/claude-session-store.d.ts

@@ -0,0 +1,13 @@
+import type { ForeignSessionInfo, ForeignSessionStore } from "./foreign-session-store.js";
+import { SessionManager } from "./session-manager.js";
+/** Imports Claude Code JSONL sessions into non-persistent OMP session managers. */
+export declare class ClaudeSessionStore implements ForeignSessionStore {
+    #private;
+    readonly source = "claude";
+    /** Creates a store rooted at Claude's data directory, or at a fixture root when supplied. */
+    constructor(root?: string);
+    /** Lists indexed Claude sessions without reading transcript bodies. */
+    list(): Promise<ForeignSessionInfo[]>;
+    /** Loads and converts a Claude transcript while preserving its source tree and timestamps. */
+    load(info: ForeignSessionInfo): Promise<SessionManager>;
+}

package/dist/types/session/codex-session-store.d.ts

@@ -0,0 +1,14 @@
+import type { ForeignSessionInfo, ForeignSessionStore } from "./foreign-session-store.js";
+import { SessionManager } from "./session-manager.js";
+/** Imports locally stored OpenAI Codex sessions into OMP's in-memory session format. */
+export declare class CodexSessionStore implements ForeignSessionStore {
+    #private;
+    /** Foreign-session source discriminator. */
+    readonly source = "codex";
+    /** Uses the supplied Codex data root, or ~/.codex by default. */
+    constructor(rootDirectory?: string);
+    /** Lists Codex sessions from its state index without reading transcript bodies. */
+    list(): Promise<ForeignSessionInfo[]>;
+    /** Converts one Codex rollout into a non-persistent OMP session. */
+    load(info: ForeignSessionInfo): Promise<SessionManager>;
+}

package/dist/types/session/credential-pin.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Session-file persistence of the OAuth account that served a session.
+ *
+ * Provider prompt caches are account-scoped (Anthropic bills a full cache
+ * re-write after an account flip), and the auth store's session-sticky routing
+ * is process-local when a remote auth broker is configured — the broker
+ * store's KV cache is in-memory, so sticky rows die with the CLI process.
+ * Resuming a session in a fresh process then re-ranks accounts by usage
+ * headroom, which is biased *away* from the account that just served the
+ * session (it has the highest recent burn), cold-missing the entire prefix.
+ *
+ * These helpers close the loop through the session file itself: after each
+ * assistant turn the serving account is recorded as a `credential_pin` entry,
+ * and on session adoption the pin is matched against the stored accounts and
+ * seeded back into the auth store with the session's effective last-use
+ * timestamp, so the provider's warm-window semantics still decide whether to
+ * stick or re-rank.
+ */
+import type { AuthStorage } from "./auth-storage.js";
+import type { SessionManager } from "./session-manager.js";
+/** Account fields shared by `OAuthAccountIdentity` and `OAuthAccountSummary`. */
+interface CredentialPinIdentity {
+    accountId?: string;
+    email?: string;
+    projectId?: string;
+    orgId?: string;
+}
+/**
+ * Stable identifier for a provider account within its billing scope. The
+ * digest covers the full scope tuple — the same account in two orgs (Anthropic
+ * multi-subscription) or projects (Gemini) is two distinct cache domains and
+ * must produce two distinct pins. The digest input is the persisted contract
+ * for `CredentialPinEntry.hash` — changing it orphans every recorded pin.
+ *
+ * Hashing avoids embedding raw emails/uuids in session files, but an unsalted
+ * digest of a guessable email is still linkable — treat exported sessions
+ * accordingly.
+ *
+ * Returns `undefined` when the identity carries no account key at all.
+ */
+export declare function credentialPinHash(provider: string, identity: CredentialPinIdentity): string | undefined;
+/**
+ * Record the account that served the latest assistant turn for `provider`.
+ * Appends a `credential_pin` entry only when the account differs from the
+ * branch's latest pin, so steady-state sessions add a single entry; the
+ * effective last-use time is derived from later assistant turns on read
+ * (see `SessionManager.getCredentialPins`).
+ */
+export declare function recordCredentialPin(authStorage: AuthStorage, sessionManager: SessionManager, sessionId: string, provider: string): void;
+/**
+ * Re-pin the accounts recorded in the session file onto the auth store's
+ * session stickiness. No-op per provider when the account is gone (logged out)
+ * or when a live sticky already exists (same-process branch/session switches
+ * must not clobber fresher routing). Seeds with the session's effective
+ * last-use time so stale resumes still fall through to usage ranking.
+ */
+export declare function seedCredentialPins(authStorage: AuthStorage, sessionManager: SessionManager, sessionId: string): void;
+export {};

package/dist/types/session/foreign-session-import.d.ts

@@ -0,0 +1,15 @@
+import type { ForeignSessionInfo, ForeignSessionSource, ForeignSessionStore } from "./foreign-session-store.js";
+import type { SessionInfo } from "./session-listing.js";
+import type { SessionManager } from "./session-manager.js";
+/** Construct the importer for a supported foreign session source. */
+export declare function createForeignSessionStore(source: ForeignSessionSource): ForeignSessionStore;
+/** Display name for a supported foreign session source. */
+export declare function foreignSessionSourceName(source: ForeignSessionSource): string;
+/** Convert lightweight foreign metadata for the existing session picker. */
+export declare function foreignSessionInfoToSessionInfo(info: ForeignSessionInfo): SessionInfo;
+/** Import and persist one foreign session under a fresh OMP session identity. */
+export declare function persistForeignSession(store: ForeignSessionStore, info: ForeignSessionInfo, options?: {
+    fallbackCwd?: string;
+    sessionDir?: string;
+    suppressBreadcrumb?: boolean;
+}): Promise<SessionManager>;

package/dist/types/session/foreign-session-jsonl.d.ts

@@ -0,0 +1,9 @@
+/** One readable object record from a foreign JSONL transcript. */
+export interface ForeignJsonRecord {
+    readonly value: Record<string, unknown>;
+    readonly line: number;
+}
+/** Stream valid object records while tolerating malformed or truncated lines. */
+export declare function readForeignJsonRecords(filePath: string): AsyncGenerator<ForeignJsonRecord>;
+/** Read every valid object record from a foreign JSONL transcript. */
+export declare function collectForeignJsonRecords(filePath: string): Promise<ForeignJsonRecord[]>;

package/dist/types/session/foreign-session-store.d.ts

@@ -0,0 +1,23 @@
+import type { SessionManager } from "./session-manager.js";
+/** External coding-agent session source supported by OMP imports. */
+export type ForeignSessionSource = "claude" | "codex";
+/** Lightweight source metadata used to choose a foreign session before loading its transcript. */
+export interface ForeignSessionInfo {
+    readonly source: ForeignSessionSource;
+    readonly id: string;
+    readonly path: string;
+    readonly cwd: string;
+    readonly title?: string;
+    readonly created: Date;
+    readonly modified: Date;
+    readonly messageCount?: number;
+    readonly firstMessage?: string;
+}
+/** Lists and converts sessions owned by another coding agent. */
+export interface ForeignSessionStore {
+    readonly source: ForeignSessionSource;
+    /** Lists source sessions without parsing complete transcripts. */
+    list(): Promise<ForeignSessionInfo[]>;
+    /** Converts one source session into a non-persistent OMP session. */
+    load(session: ForeignSessionInfo): Promise<SessionManager>;
+}

package/dist/types/session/session-advisors.d.ts

@@ -1,8 +1,9 @@
-import { Agent, type AgentMessage, type AgentTool, type StreamFn } from "@oh-my-pi/pi-agent-core";
+import { Agent, type AgentMessage, type AgentTool, type AgentToolContext, type StreamFn } from "@oh-my-pi/pi-agent-core";
 import type { CodexCompactionContext, Context, Message, Model, ProviderSessionState, ServiceTier, SimpleStreamOptions } from "@oh-my-pi/pi-ai";
 import { type AdvisorConfig, type AdvisorRuntimeStatus } from "../advisor/index.js";
 import type { ModelRegistry } from "../config/model-registry.js";
 import type { Settings } from "../config/settings.js";
+import { type CursorMcpResourceAdapter } from "../cursor.js";
 import type { PlanModeState } from "../plan-mode/state.js";
 import type { SecretObfuscator } from "../secrets/obfuscator.js";
 import type { AgentSessionEvent } from "./agent-session-events.js";
@@ -51,12 +52,47 @@ export interface PerAdvisorStat {
 export interface SessionAdvisorsOptions {
     enabled: boolean;
     tools?: AgentTool[];
+    /**
+     * Build a `grep` honoring a Cursor `pi_grep` frame's own context width and
+     * match cap. The advisor's tools are fixed instances carrying session
+     * defaults, so without this an advisor running against Cursor silently
+     * drops both fields — the same gap the primary bridge closes.
+     */
+    createGrepTool?(options: {
+        context?: number;
+        totalMatchLimit?: number;
+    }): AgentTool | undefined;
+    /**
+     * Build the `replace`-mode `edit` a Cursor `pi_edit` frame needs. The
+     * advisor's own instance follows the configured `edit.mode` (`hashline` by
+     * default), whose schema the frame's `old_text`/`new_text` pairs do not
+     * match, so without this every native advisor edit fails validation.
+     */
+    createEditTool?(): AgentTool | undefined;
+    /**
+     * The execute-time context the bridge's tools resolve approval from.
+     *
+     * `ExtensionToolWrapper` reads the approval mode, per-tool policies and
+     * `autoApprove` only from here; with none it falls back to `yolo` and empty
+     * policies, so a native frame would run past a configured `ask` or `deny`.
+     */
+    getToolContext?: () => AgentToolContext | undefined;
+    /**
+     * The live MCP connections Cursor's resource frames answer from.
+     *
+     * Advisors share the session's connections and may hold tools from those
+     * same servers, so without this their frames report that every server
+     * advertises nothing.
+     */
+    mcpResources?: CursorMcpResourceAdapter;
     watchdogPrompt?: string;
     sharedInstructions?: string;
     contextPrompt?: string;
     configs?: AdvisorConfig[];
     streamFn?: StreamFn;
     transformProviderContext?: (context: Context, model: Model) => Context | Promise<Context>;
+    /** Advisor spend already persisted for this session, restored on resume. */
+    initialCosts?: ReadonlyMap<string, number>;
 }
 /** Options accepted when an advisor injects a primary-session message. */
 export interface AdvisorMessageDeliveryOptions {
@@ -93,7 +129,7 @@ export interface SessionAdvisorsHost {
     hasPendingNextTurnMessages(): boolean;
     convertToLlmForSideRequest(messages: AgentMessage[]): Message[];
     effectiveServiceTier(model: Model): ServiceTier | undefined;
-    resolveContextPromotionTarget(currentModel: Model, contextWindow: number): Promise<Model | undefined>;
+    resolveContextPromotionTarget(currentModel: Model, contextWindow: number, signal: AbortSignal): Promise<Model | undefined>;
     resolveCompactionModelCandidates(preferredModel: Model | null | undefined, availableModels: Model[]): Model[];
     resolveRetryFallbackRole(currentSelector: string, currentModel?: Model | null): string | undefined;
     findRetryFallbackCandidates(role: string, currentSelector: string, currentModel?: Model | null): RetryFallbackSelector[];
@@ -118,14 +154,23 @@ export declare class SessionAdvisors {
     buildRuntime(seedToCurrent?: boolean): boolean;
     /** Stops every advisor runtime and starts recorder shutdown. */
     stopRuntime(): void;
+    /**
+     * Pause advisor work while old-session recorder feeds remain attached, then
+     * detach only after any active prompt has settled.
+     */
+    drainAndDetachRecorders(): Promise<void>;
     /** Detaches and drains recorder feeds before transcript artifacts are removed. */
     detachAndCloseRecorders(): Promise<void>;
+    /** Reattach recorder feeds and resume work after a rolled-back or preserving transition. */
+    reattachRecorderFeeds(): void;
     /** Re-primes advisor transcript views across a conversation boundary. */
     resetSessionState(options?: {
         preserveCost?: boolean;
     }): void;
     /** Drop the recorded spend once a conversation boundary has committed. */
     clearCost(): void;
+    /** Replace the ledger with the spend recorded for the session becoming active. */
+    restoreCost(costs: ReadonlyMap<string, number>): void;
     /**
      * Rebind every live advisor to the active primary conversation's provider
      * identity (session id, prompt-cache key, credential + metadata resolvers,

package/dist/types/session/session-entries.d.ts

@@ -134,6 +134,7 @@ export interface TitleChangeEntry extends SessionEntryBase {
 declare module "@oh-my-pi/pi-agent-core/compaction/entries" {
     interface CustomCompactionSessionEntries {
         titleChange: TitleChangeEntry;
+        credentialPin: CredentialPinEntry;
     }
 }
 /** TTSR injection entry - tracks which time-traveling rules have been injected this session. */
@@ -142,6 +143,23 @@ export interface TtsrInjectionEntry extends SessionEntryBase {
     /** Names of rules that were injected */
     injectedRules: string[];
 }
+/**
+ * Records which OAuth account served this session's requests for a provider.
+ *
+ * Provider prompt caches (Anthropic in particular) are account-scoped, and the
+ * auth store's session-sticky routing is process-local under a remote auth
+ * broker, so resume must re-pin the same account to reuse the warm cache
+ * prefix. Stores a sha-256 of the account + billing-scope tuple instead of
+ * the raw email/uuid/org; note an unsalted digest of a guessable email is
+ * still linkable, so exported sessions are pseudonymous, not anonymous.
+ */
+export interface CredentialPinEntry extends SessionEntryBase {
+    type: "credential_pin";
+    /** Provider id the pin applies to (e.g. "anthropic"). */
+    provider: string;
+    /** `credentialPinHash()` of the serving account's identity + scope tuple. */
+    hash: string;
+}
 /** Session init entry - captures initial context for subagent sessions (debugging/replay). */
 export interface SessionInitEntry extends SessionEntryBase {
     type: "session_init";
@@ -192,7 +210,7 @@ export interface CustomMessageEntry<T = unknown> extends SessionEntryBase {
     attribution?: MessageAttribution;
 }
 /** Session entry - has id/parentId for tree structure (returned by "read" methods in SessionManager) */
-export type SessionEntry = SessionMessageEntry | ThinkingLevelChangeEntry | ModelChangeEntry | ServiceTierChangeEntry | CompactionEntry | BranchSummaryEntry | CustomEntry | CustomMessageEntry | LabelEntry | TitleChangeEntry | TtsrInjectionEntry | SessionInitEntry | ModeChangeEntry;
+export type SessionEntry = SessionMessageEntry | ThinkingLevelChangeEntry | ModelChangeEntry | ServiceTierChangeEntry | CompactionEntry | BranchSummaryEntry | CustomEntry | CustomMessageEntry | LabelEntry | TitleChangeEntry | TtsrInjectionEntry | SessionInitEntry | ModeChangeEntry | CredentialPinEntry;
 /** Raw logical file entry after loaders strip any fixed-width title slot. */
 export type FileEntry = SessionHeader | SessionEntry;
 /** Physical JSONL entry before slot-aware loaders fold the title slot. */

package/dist/types/session/session-handoff.d.ts

@@ -44,7 +44,10 @@ export interface SessionHandoffHost {
     clearPendingNextTurnMessages(): void;
     resetTodoCycle(): void;
     buildDisplaySessionContext(): SessionContext;
-    resetAdvisorRuntimes(): void;
+    resetAdvisorSessionState(): void;
+    drainAndDetachAdvisorRecorders(): Promise<void>;
+    reattachAdvisorRecorderFeeds(): void;
+    clearAdvisorCost(): void;
     syncTodoPhasesFromBranch(): void;
 }
 /** Generates handoff documents and owns the handoff session transition. */

package/dist/types/session/session-loader.d.ts

@@ -8,6 +8,8 @@ export declare function parseSessionContent(content: string): {
     entries: FileEntry[];
     titleSlot: SessionTitleUpdate | undefined;
 };
+/** Parse session JSONL and visit each entry without retaining prior entries. */
+export declare function visitEntriesFromFileStream(filePath: string, visit: (entry: FileEntry) => void): Promise<SessionTitleUpdate | undefined>;
 /** Exported for testing — the ≥8MiB streaming path (works on any file size). */
 export declare function loadEntriesFromFileStream(filePath: string): Promise<{
     entries: FileEntry[];

package/dist/types/session/session-maintenance.d.ts

@@ -214,7 +214,7 @@ export declare class SessionMaintenance {
      *   is true.
      */
     checkCompaction(assistantMessage: AssistantMessage, skipAbortedCheck?: boolean, allowDefer?: boolean, autoContinue?: boolean): Promise<CompactionCheckResult>;
-    resolveContextPromotionTarget(currentModel: Model, contextWindow: number): Promise<Model | undefined>;
+    resolveContextPromotionTarget(currentModel: Model, contextWindow: number, signal?: AbortSignal): Promise<Model | undefined>;
     resolveCompactionModelCandidates(preferredModel: Model | null | undefined, availableModels: Model[], filter?: (model: Model) => boolean): Model[];
     /**
      * Internal: Run auto-compaction with events.

package/dist/types/session/session-manager.d.ts

@@ -92,6 +92,11 @@ export declare class SessionManager {
      * session/new must create a discoverable file immediately).
      */
     ensureOnDisk(): Promise<void>;
+    /** Persist this session's transcript as a newly identified OMP session. */
+    persistCopy(options?: {
+        sessionDir?: string;
+        suppressBreadcrumb?: boolean;
+    }, storage?: SessionStorage): Promise<SessionManager>;
     /**
      * Stage a synchronous group of entry appends and publish the resulting full
      * journal with one atomic replace. A failed publish removes only the staged
@@ -236,6 +241,22 @@ export declare class SessionManager {
     appendTtsrInjection(ruleNames: string[]): string;
     /** All unique TTSR rule names injected on the current branch (root → leaf). */
     getInjectedTtsrRules(): string[];
+    /** Append a credential pin recording which OAuth account served `provider`. */
+    appendCredentialPin(provider: string, hash: string): string;
+    /**
+     * Latest credential pin per provider on the current branch (root → leaf),
+     * with the effective last-use time of the pinned account.
+     *
+     * Pins are appended only when the serving account *changes*, so a long
+     * session on one account carries a single old pin entry. Any assistant turn
+     * for the same provider after that pin was necessarily served by the pinned
+     * account, so its timestamp advances `lastUsedAt` — a resume seconds after
+     * the last turn seeds a warm sticky instead of a stale one.
+     */
+    getCredentialPins(): Map<string, {
+        hash: string;
+        lastUsedAt: number;
+    }>;
     getLeafId(): string | null;
     getLeafEntry(): SessionEntry | undefined;
     /**

package/dist/types/session/session-tools.d.ts

@@ -86,6 +86,17 @@ export declare function collectMountedMCPToolRoutes(tools: Iterable<MountedMCPTo
  * rendered by the static MCP guidance prompt.
  */
 export declare function projectMountedMCPXdevGuidance(routes: Iterable<MountedMCPToolRoute>): MCPXdevGuidanceProjection;
+/**
+ * Structured payload persisted on each {@link XDEV_MOUNT_NOTICE_MESSAGE_TYPE}
+ * custom message. Lets a resumed session reconstruct which dynamic devices the
+ * model has already been told about, so reconnecting hosts do not re-announce
+ * (and re-splice a redundant developer message that busts the provider
+ * prompt-cache prefix).
+ */
+interface XdevMountNoticeDetails {
+    added: string[];
+    removed: string[];
+}
 /** Owns tool registration, presentation, prompt rebuilding, skills, and permissions. */
 export declare class SessionTools {
     #private;
@@ -134,8 +145,21 @@ export declare class SessionTools {
     getSelectedMCPToolNames(): string[];
     /** Applies an enabled tool set and reconciles its `xd://` partition. */
     applyActiveToolsByName(toolNames: string[]): Promise<void>;
+    /**
+     * Forget the announced-mount baseline for a replaced transcript. Called when
+     * session history is swapped wholesale (`/new`, `switchSession`, `branch`): the
+     * previous transcript's persisted notices no longer apply, so the next notice
+     * re-seeds from the new history and a device reconnecting into it announces
+     * again.
+     *
+     * The pending delta is deliberately preserved: it holds mounts that are still
+     * live but not yet delivered to the model, and `branch()` does not rebuild the
+     * base system prompt, so dropping it would leave the branched transcript
+     * unaware of a still-mounted device that no later refresh would re-queue.
+     */
+    resetAnnouncedMounts(): void;
     /** Consumes the hidden notice for unannounced `xd://` mount changes. */
-    takePendingXdevMountNotice(): CustomMessage | undefined;
+    takePendingXdevMountNotice(): CustomMessage<XdevMountNoticeDetails> | undefined;
     /** Rediscovers reloadable skills and refreshes prompt metadata. */
     refreshSkills(): Promise<void>;
     /** Selects enabled tools, ignoring names absent from the registry. */

package/dist/types/session/turn-recovery.d.ts

@@ -42,6 +42,7 @@ export interface TurnRecoveryHost {
     }): void;
     waitForSessionMessagePersistence(message: AssistantMessage): Promise<void>;
     appendSessionMessage(message: AssistantMessage): void;
+    persistedAssistantEntryId(message: AssistantMessage): string | undefined;
     sessionMessageAlreadyPersisted(message: AssistantMessage): boolean;
     setModelWithProviderSessionReset(model: Model): Promise<void>;
     resetCurrentResponsesProviderSession(reason: string): void;
@@ -100,6 +101,12 @@ export declare class TurnRecovery {
         hardErrorFallback?: boolean;
         preserveFailedTurn?: boolean;
     }): Promise<boolean>;
+    /**
+     * Records a usage-limit failure before replay eligibility decides whether the
+     * failed turn may be discarded. Returns whether credential recovery switched
+     * the active account.
+     */
+    recordUsageLimitOutcome(message: AssistantMessage): Promise<boolean>;
     /** Prompts after transient overlap with a prior agent run. */
     promptAgentWithIdleRetry(messages: AgentMessage[], options?: {
         toolChoice?: ToolChoice;
@@ -176,8 +183,8 @@ export declare class TurnRecovery {
      * transient overload/5xx or a hard "router/model not found / unsupported" —
      * is worth retrying on the base id. Skips failures the base model shares:
      * context overflow (compaction's job), usage limits and auth errors (same
-     * account/key), and turns that already emitted a tool call (replaying would
-     * duplicate work). Requires the base model to exist in the registry.
+     * account/key), and turns that already emitted any replay-unsafe output.
+     * Requires the base model to exist in the registry.
      */
     isFireworksFastFallbackEligible(message: AssistantMessage): boolean;
     /**
@@ -188,8 +195,7 @@ export declare class TurnRecovery {
      * model switch cannot fix or must not replay: cancellations (abort-flavored
      * errors are not model faults), context overflow (compaction's job),
      * classifier refusals (chain consult is handled on the retryable path with
-     * `pinFallback`), and turns that already emitted a tool call (replaying
-     * could duplicate work).
+     * `pinFallback`), and turns that already emitted replay-unsafe output.
      */
     isHardErrorFallbackEligible(message: AssistantMessage): boolean;
     /**

package/dist/types/slash-commands/helpers/security.d.ts

@@ -0,0 +1,2 @@
+import type { ParsedSlashCommand, SlashCommandResult, SlashCommandRuntime } from "../types.js";
+export declare function handleSecurityCommand(command: ParsedSlashCommand, runtime: SlashCommandRuntime): Promise<SlashCommandResult>;

package/dist/types/system-prompt.d.ts

@@ -119,6 +119,8 @@ export interface BuildSystemPromptOptions {
     workspaceTree?: WorkspaceTree | Promise<WorkspaceTree>;
     /** Whether the local memory://root summary is active. */
     memoryRootEnabled?: boolean;
+    /** Whether the read-only security:// resource namespace is active. */
+    securityEnabled?: boolean;
     /** Active model identifier (e.g. "anthropic/claude-opus-4") used by prompt policy and optionally surfaced. */
     model?: string;
     /** Whether to surface `model` in the workstation block. Model-specific prompt policy still uses it. Default: true. */
@@ -131,10 +133,11 @@ export interface BuildSystemPromptOptions {
     renderMermaid?: boolean;
     /** Pre-resolved nested active repo context. Undefined resolves from cwd. */
     activeRepoContext?: ActiveRepoContext | null;
-    /** Tools mounted under `xd://`; renders the protocol section when non-empty. */
+    /** Tools mounted under `xd://`; renders the protocol section when non-empty. `dynamic` marks external devices whose summary is third-party metadata. */
     xdevTools?: Array<{
         name: string;
         summary: string;
+        dynamic?: boolean;
     }>;
     /** Full docs + JSON schema for every `xd://`-mounted tool, inlined into the protocol section so no discovery `read` is needed. */
     xdevDocs?: string;

package/dist/types/task/executor.d.ts

@@ -18,6 +18,7 @@ import type { LocalProtocolOptions } from "../internal-urls/index.js";
 import type { MCPManager } from "../mcp/manager.js";
 import type { MnemopiSessionState } from "../mnemopi/state.js";
 import { type AgentReviver } from "../registry/agent-lifecycle.js";
+import { type CreateAgentSessionOptions } from "../sdk.js";
 import type { AgentSession } from "../session/agent-session.js";
 import type { ArtifactManager } from "../session/artifacts.js";
 import type { AuthStorage } from "../session/auth-storage.js";
@@ -34,10 +35,19 @@ export type { YieldItem } from "./types.js";
  * agent is driven to one forced final `yield` so partial findings come back
  * as a real report; only if it still refuses to yield within
  * {@link BUDGET_STOP_GRACE_REQUESTS} more requests is the run hard-aborted.
- * The `default` key applies to agents without an explicit entry and can be
- * overridden via the `task.softRequestBudget` setting (0 disables the guard).
+ * Entries are ceilings, not fixed values: the `default` key applies to agents
+ * without an explicit entry, and the `task.softRequestBudget` setting can only
+ * lower an agent's budget, never raise it above its bundled entry (0 disables
+ * the guard entirely).
  */
 export declare const SOFT_REQUEST_BUDGET: Record<string, number>;
+/**
+ * Resolves the effective soft request budget for an agent. The configured
+ * `task.softRequestBudget` and the agent's bundled entry are both upper
+ * bounds, so the tighter one wins; a configured budget of 0 disables the
+ * guard regardless of the bundled entry.
+ */
+export declare function resolveSoftRequestBudget(agentName: string, configuredBudget: number): number;
 /** Extra requests allowed after a budget stop for the forced yield to land before the run is hard-aborted. */
 export declare const BUDGET_STOP_GRACE_REQUESTS = 5;
 /** Steering notice injected when a subagent crosses its soft request budget. */
@@ -47,6 +57,8 @@ export interface ExecutorOptions {
     cwd: string;
     /** Additional workspace directories to seed on the subagent session (multi-root). */
     additionalDirectories?: string[];
+    /** Exact provider credential resolver inherited from the parent session. */
+    getApiKey?: CreateAgentSessionOptions["getApiKey"];
     worktree?: string;
     agent: AgentDefinition;
     task: string;

package/dist/types/task/render.d.ts

@@ -11,6 +11,13 @@ interface TaskRenderContext {
      * commit-eligible rows do not repaint after entering native scrollback.
      */
     frozen?: boolean;
+    /**
+     * Wall clock for time-derived rows (current-tool elapsed, retry countdown).
+     * The component freezes it once the block settles or any of its rows enter
+     * native scrollback, so identical-input rebuilds stay byte-identical with
+     * committed history. Absent: render with the live clock.
+     */
+    nowMs?: number;
 }
 type TaskRenderOptions = RenderResultOptions & {
     renderContext?: TaskRenderContext;

package/dist/types/thinking.d.ts

@@ -103,6 +103,12 @@ export declare function parseCliThinkingLevel(value: string | null | undefined):
  * above Low (falling back to the full supported set only when the model maxes
  * out below Low). Within that pool the request snaps to the highest level not
  * exceeding it, or the pool minimum when the request is below the pool.
+ * `ceiling` bounds the pool from above, so a policy ceiling survives the model
+ * clamp: a sparse ladder such as `["max"]` must not snap an `xhigh` request up
+ * to `max`. The Low floor is resolved against the model's own ladder *before*
+ * the ceiling applies — a ceiling that hides every tier at or above Low means
+ * there is nothing legal to pick (`undefined`), not a licence to fall through
+ * to a sub-Low tier the model happens to expose.
  *
  * Returns `undefined` for reasoning-capable models without a controllable
  * effort surface (`thinking.efforts` empty — e.g. devin-agent models, where
@@ -111,7 +117,7 @@ export declare function parseCliThinkingLevel(value: string | null | undefined):
  * forward a concrete effort that would then trip {@link requireSupportedEffort}
  * downstream.
  */
-export declare function clampAutoThinkingEffort(model: Model | undefined, effort: Effort): Effort | undefined;
+export declare function clampAutoThinkingEffort(model: Model | undefined, effort: Effort, ceiling?: Effort): Effort | undefined;
 /** Coarse per-spawn effort selectors accepted by the task tool. */
 export declare const TASK_EFFORTS: readonly ["lo", "med", "hi"];
 /** Coarse task-spawn effort: the lowest, middle, or highest thinking level the target model supports. */
@@ -146,10 +152,16 @@ export declare function clampThinkingLevelToCeiling(model: Model | undefined, le
 export declare function modelSupportsEffortCeiling(model: Model, ceiling: Effort): boolean;
 /**
  * The provisional concrete level shown while `auto` is configured but before a
- * turn has been classified. Prefers the model's `defaultLevel`, otherwise High,
- * clamped into the auto range. Auto never provisions {@link Effort.Max} (the
- * classifier ceiling is XHigh; only an explicit user request reaches Max), so a
- * `defaultLevel` of `max` is capped at XHigh before clamping. Returns
- * `undefined` for non-reasoning models.
+ * turn has been classified, and the fallback when classification fails. Prefers
+ * the model's `defaultLevel`, otherwise High, clamped into the auto range.
+ *
+ * Deliberately stays below {@link Effort.Max}: the placeholder must not bill the
+ * top tier for a turn nobody classified, so XHigh is passed as a hard ceiling
+ * rather than only capping the preferred level — otherwise a sparse `["max"]`
+ * ladder would snap straight back up. A model whose ladder offers nothing at or
+ * below XHigh therefore has no provisional level, and `auto` leaves the current
+ * one in place. Classification itself may still resolve Max on models that
+ * expose the tier when the user opts in. Returns `undefined` for non-reasoning
+ * models.
  */
 export declare function resolveProvisionalAutoLevel(model: Model | undefined): Effort | undefined;