@orion-agents/orion-code 0.3.22 → 0.3.24

package/CHANGELOG.md

@@ -22,12 +22,59 @@ which is **not** a pass.
 
 ## [Unreleased]
 
-## [0.3.22] — UNRELEASED
+## [0.3.24]
 
-> **Status: candidate.** Open. Agent Reliability & Efficiency — hardens ToolGateway
+> **Status: candidate.** Implementation on `codex/v0.3.24`, based on `main@6ed47fd`.
+> Plan: `docs/plan/v0.3.24-plan.md`. Registry and release status must be
+> verified from their own immutable receipts, not inferred from this changelog.
+
+### Fixed
+
+- Session command and Composer requests track only their originating Session;
+  sending no longer blocks another Session's Composer or session creation.
+- Same-Context snapshots across a live event stream are reused when unchanged;
+  warm selection does not re-fetch or disable input. Background changes and
+  disconnections still require synchronization before writes.
+- Foreground display caches retain streamed messages, tool cards and loaded
+  history instead of restoring an older HTTP tail when switching back.
+- Creation is single-flight and respects a later foreground selection. Late
+  send responses do not clear, focus or replace another Session's draft.
+- Web creation bounds asynchronous Git branch probes; project storage identity
+  resolution reuses an invalidatable bounded cache instead of repeatedly
+  spawning synchronous Git on every storage helper call.
+- Cross-Workspace navigation remains usable while another Session is running;
+  the most recent navigation intent wins when Context activation is in flight.
+- Per-Session scroll position and loaded history survive navigation, while
+  foreground Snapshot and SSE reconciliation no longer skips background events.
+- Web Session creation waits for file locks without freezing the Host event
+  loop, and cold Catalog scans yield to unrelated HTTP and SSE traffic.
+
+## [0.3.23] — UNRELEASED
+
+> **Status: candidate.** Open. Coding Intelligence & Verified Execution — wires the live
+> coding-task evaluation to the production runtime (isolated workspaces, machine-verified
+> success, five-outcome classification), adds repo-intelligence symbol indexing and
+> recall, and consolidates the bounded verification/repair loop into the HarnessKernel
+> completion audit. Plan: `docs/plan/v0.3.23-plan.md`. Not merged, tagged or published.
+
+### Added (planned)
+
+- Live Coding Eval: `LiveTaskExecutor` + `compare-receipts` A/B reporting; five-outcome
+  classification with orthogonal falseComplete; `command_exit_zero` / `invariant` checks.
+- Repo Intelligence: lightweight TS/JS symbol index with incremental maintenance and
+  sourced recall (Recall@K evaluated).
+- Verified Repair: structured failure attribution, bounded repair loop (feature-flagged),
+  five-state completion audit; the orphaned auto-fix / verification-profile modules merge
+  into the wired stack and are removed.
+
+## [0.3.22] — 2026-10-09
+
+> **Status: published.** Released as `@orion-agents/orion-code@0.3.22` from
+> `refs/tags/v0.3.22`, and merged to `main` as `9f09e0a` (#265). Hardens ToolGateway
 > in-flight request identity (T22-01), adds the durability fault-injection matrix (T22-02),
 > the four-state release verification gate (T22-03), and a real coding-task evaluation
-> harness (T22-04). Plan: `docs/plan/v0.3.22-plan.md`. Not merged, tagged or published.
+> harness (T22-04). Plan: `docs/plan/v0.3.22-plan.md`. GitHub Release:
+> https://github.com/orion-agents/orion-code/releases/tag/v0.3.22。
 
 ### Fixed (product)
 

package/README.md

@@ -2,11 +2,12 @@
 
 Local-first, goal-driven coding agent for the terminal and browser.
 
-> v0.3.22 candidate — open. Hardens agent reliability (ToolGateway in-flight request
-> identity) and builds a real coding-task evaluation harness. The previous release 0.3.21
-> is on npm (registry `latest`) and tagged `v0.3.21` (`0d22c9a`, #264).
+> v0.3.24 development focus — Web session responsiveness: Session-scoped request admission,
+> cached foreground switching, retained live views, and bounded Git probes during creation.
+> Built on the merged v0.3.23 source (`6ed47fd`, #266).
 
 [中文说明](README.zh-CN.md) ·
+[v0.3.24 plan](docs/plan/v0.3.24-plan.md) ·
 [v0.3.7 plan](docs/plan/v0.3.7-left-rail-improvement-plan.md) ·
 [v0.3.6 plan](docs/plan/v0.3.6-plan.md) ·
 [v0.3.5 plan](docs/plan/v0.3.5-plan.md) ·
@@ -166,10 +167,10 @@ user extension boundaries.
 Node.js 22.12+, 24, and 26 are supported. Use Node 24 LTS for production or Node 26 Current for
 current development environments. Node 20 is upstream EOL and is no longer a v0.3 runtime.
 
-After the immutable `0.3.5` npm receipt exists:
+To install the pinned v0.3.24 package when it is available on npm:
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.22
+npm install -g @orion-agents/orion-code@0.3.24
 orion --version
 orion doctor
 ```

package/README.zh-CN.md

@@ -2,10 +2,11 @@
 
 面向终端与浏览器、本地优先的目标驱动 Coding Agent。
 
-> v0.3.22 候选版本：进行中。强化 Agent 可靠性（ToolGateway 执行中请求身份）并建设真实编码
-> 任务评测体系。上一版 0.3.21 已发布 npm（registry `latest`）并打 tag `v0.3.21`（`0d22c9a`，#264）。
+> v0.3.24 开发重点：Web 会话响应性。发送按会话等待、有效缓存即时切换、保留实时显示内容，
+> 新建使用有界 Git 探测。基于已合并的 v0.3.23 源码（`6ed47fd`，#266）。
 
 [English](README.md) ·
+[v0.3.24 方案](docs/plan/v0.3.24-plan.md) ·
 [v0.3.7 方案](docs/plan/v0.3.7-left-rail-improvement-plan.md) ·
 [v0.3.6 方案](docs/plan/v0.3.6-plan.md) ·
 [v0.3.4 稳定化方案](docs/plan/v0.3.4-stabilization-plan.md) ·
@@ -97,10 +98,10 @@ MCP 仍是用户可见的扩展边界。
 支持 Node.js 22.12+、24 和 26。生产环境建议使用 Node 24 LTS，当前开发环境也支持 Node 26
 Current。Node 20 已结束上游维护，不再属于 v0.3 Runtime 合同。
 
-当 npm 已存在不可变的 `0.3.4` 发布凭据后：
+v0.3.24 在 npm 可用后，可安装固定版本：
 
 ```bash
-npm install -g @orion-agents/orion-code@0.3.22
+npm install -g @orion-agents/orion-code@0.3.24
 orion --version
 orion doctor
 ```

package/dist/harness/failure-attribution.d.ts

@@ -0,0 +1,23 @@
+export type FailureKind = 'typescript' | 'lint' | 'build' | 'unit-test' | 'integration-test' | 'environment' | 'provider' | 'unknown';
+export interface FailureEntryV1 {
+    readonly file?: string;
+    readonly line?: number;
+    readonly code?: string;
+    readonly message: string;
+}
+export interface StructuredFailureEvidenceV1 {
+    readonly kind: FailureKind;
+    readonly summary: string;
+    readonly entries: readonly FailureEntryV1[];
+    /** Stable over identical failures; changes when the failure changes. */
+    readonly digest: string;
+}
+export declare function parseTypeScriptDiagnostics(output: string): readonly FailureEntryV1[];
+export declare function parseEsLintOutput(output: string): readonly FailureEntryV1[];
+export declare function parseJestFailures(output: string): readonly FailureEntryV1[];
+/**
+ * Attribute a verification failure to a structured kind. Detection order:
+ * TypeScript → test failure → lint → build → provider → environment → unknown.
+ */
+export declare function attributeFailure(output: string, command?: string): StructuredFailureEvidenceV1;
+//# sourceMappingURL=failure-attribution.d.ts.map

package/dist/harness/failure-attribution.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTypeScriptDiagnostics = parseTypeScriptDiagnostics;
+exports.parseEsLintOutput = parseEsLintOutput;
+exports.parseJestFailures = parseJestFailures;
+exports.attributeFailure = attributeFailure;
+/**
+ * v0.3.23 T23-C2 — structured failure attribution.
+ *
+ * Parses verification output (tsc, jest, eslint, build tooling, environment
+ * errors) into bounded structured evidence instead of feeding raw logs back to
+ * the model. Each attribution carries a stable digest so the repair loop can
+ * detect no-progress rounds objectively.
+ */
+const crypto_1 = require("crypto");
+const TSC_PATTERN = /^(.+?)\((\d+),(\d+)\):\s+(?:error|warning)\s+(TS\d+):\s+(.+)$/gm;
+const ESLINT_PATTERN = /^(.+?):(\d+):(\d+)\s+(error|warning)\s+(.+)$/gm;
+const JEST_FAIL_PATTERN = /✕\s+(.+?)(?:\s*\(\d+\s*m?s\))?$/gm;
+function digestOf(kind, entries) {
+    const hash = (0, crypto_1.createHash)('sha256');
+    hash.update(kind);
+    for (const entry of entries) {
+        hash.update(`${entry.file ?? ''}|${entry.line ?? ''}|${entry.code ?? ''}|${entry.message}`);
+    }
+    return hash.digest('hex').slice(0, 32);
+}
+function evidence(kind, entries, summary) {
+    return {
+        kind,
+        summary,
+        entries: Object.freeze(entries),
+        digest: digestOf(kind, entries),
+    };
+}
+function parseTypeScriptDiagnostics(output) {
+    const entries = [];
+    for (const match of output.matchAll(TSC_PATTERN)) {
+        entries.push({
+            file: match[1],
+            line: Number(match[2]),
+            code: match[4],
+            message: match[5].trim(),
+        });
+    }
+    return entries;
+}
+function parseEsLintOutput(output) {
+    const entries = [];
+    for (const match of output.matchAll(ESLINT_PATTERN)) {
+        entries.push({
+            file: match[1],
+            line: Number(match[2]),
+            code: match[4],
+            message: match[5].trim(),
+        });
+    }
+    return entries;
+}
+function parseJestFailures(output) {
+    const entries = [];
+    for (const match of output.matchAll(JEST_FAIL_PATTERN)) {
+        entries.push({ message: match[1].trim() });
+    }
+    const summary = /Tests:\s+(\d+)\s+failed/.exec(output);
+    if (summary && entries.length === 0) {
+        entries.push({ message: `${summary[1]} test(s) failed` });
+    }
+    return entries;
+}
+/**
+ * Attribute a verification failure to a structured kind. Detection order:
+ * TypeScript → test failure → lint → build → provider → environment → unknown.
+ */
+function attributeFailure(output, command = '') {
+    const commandLower = command.toLowerCase();
+    const tsEntries = parseTypeScriptDiagnostics(output);
+    if (tsEntries.length > 0) {
+        return evidence('typescript', tsEntries.slice(0, 50), `${tsEntries.length} TypeScript diagnostic(s); first: ${tsEntries[0].file}:${tsEntries[0].line} ${tsEntries[0].code}`);
+    }
+    if (/✕|●.*›|Tests:\s+\d+\s+failed|FAIL\s+\S+test/i.test(output)) {
+        const jestEntries = parseJestFailures(output);
+        const kind = /integrat|e2e|playwright/i.test(output) || /e2e/i.test(commandLower)
+            ? 'integration-test'
+            : 'unit-test';
+        return evidence(kind, jestEntries.slice(0, 50), `${jestEntries.length} failed test(s)`);
+    }
+    const lintEntries = parseEsLintOutput(output);
+    if (lintEntries.length > 0 || /eslint/i.test(commandLower)) {
+        return evidence('lint', lintEntries.slice(0, 50), `${lintEntries.length} lint problem(s)`);
+    }
+    if (/build failed|rollup|webpack|vite build|tsc && |error during build/i.test(output)) {
+        return evidence('build', [], 'build tooling reported a failure');
+    }
+    if (/provider|api key|rate limit|429|status 5|econnrefused|enotfound|fetch failed|timed out/i.test(output) ||
+        /provider/i.test(commandLower)) {
+        return evidence('provider', [], 'provider or network failure during verification');
+    }
+    if (/eacces|eperm|enoent|enoentries|no such file|permission denied|disk space|enospc/i.test(output)) {
+        return evidence('environment', [], 'environment or filesystem failure during verification');
+    }
+    return evidence('unknown', [], 'verification failed without a recognizable pattern');
+}
+//# sourceMappingURL=failure-attribution.js.map

package/dist/harness/verified-repair.d.ts

@@ -0,0 +1,71 @@
+import type { StructuredFailureEvidenceV1 } from './failure-attribution';
+export interface VerificationRunV1 {
+    readonly ok: boolean;
+    readonly output: string;
+    readonly command: string;
+    readonly durationMs: number;
+}
+export interface RepairGuardSnapshotV1 {
+    /** Workspace-relative paths of test files present BEFORE the repair. */
+    readonly testFiles: readonly string[];
+    /** Path → count of assertion tokens (`expect(`) per test file. */
+    readonly assertionTokens: Readonly<Record<string, number>>;
+    /** Path → digest of acceptance/verification criteria files. */
+    readonly acceptanceDigests: Readonly<Record<string, string>>;
+}
+export declare class ForbiddenRepairError extends Error {
+    readonly guard: 'test_deleted' | 'assertion_weakened' | 'acceptance_modified';
+    constructor(message: string, guard: 'test_deleted' | 'assertion_weakened' | 'acceptance_modified');
+}
+export declare function snapshotTestFiles(workspace: string, testFilePaths: readonly string[]): RepairGuardSnapshotV1;
+/**
+ * C4 — forbidden repair detection. Throws ForbiddenRepairError when the
+ * after-snapshot shows a test deleted, assertions materially weakened
+ * (>20% fewer `expect(` calls in a file), or an acceptance file modified.
+ */
+export declare function assertNoForbiddenRepair(before: RepairGuardSnapshotV1, after: RepairGuardSnapshotV1): void;
+export type VerifiedRepairTerminal = 'completed' | 'failed' | 'blocked' | 'cancelled' | 'unverified';
+export interface RepairRoundV1 {
+    readonly attempt: number;
+    readonly verification: VerificationRunV1;
+    readonly attribution: StructuredFailureEvidenceV1;
+    readonly repairRan: boolean;
+    readonly repairError?: string;
+}
+export interface VerifiedRepairOutcomeV1 {
+    readonly terminal: VerifiedRepairTerminal;
+    readonly attempts: number;
+    readonly rounds: readonly RepairRoundV1[];
+    readonly noProgress: boolean;
+    readonly failureReason?: string;
+    readonly lastAttribution?: StructuredFailureEvidenceV1;
+}
+export interface VerifiedRepairOptionsV1 {
+    /** Runs the (change-aware) verification command. */
+    readonly verify: () => Promise<VerificationRunV1>;
+    /** Performs the bounded repair for the given attribution. */
+    readonly repair: (attribution: StructuredFailureEvidenceV1, attempt: number) => Promise<void>;
+    /** Compares guard snapshots after each repair; throws on forbidden repairs. */
+    readonly guard?: (previous: RepairGuardSnapshotV1 | undefined) => Promise<RepairGuardSnapshotV1> | RepairGuardSnapshotV1;
+    readonly maxAttempts?: number;
+    readonly noProgressThreshold?: number;
+    readonly signal?: AbortSignal;
+}
+/**
+ * The bounded verified-repair loop (C3). The first verification is the
+ * change-aware check; each failed round attributes the failure structurally
+ * (C2), runs one bounded repair, re-verifies, and evaluates progress.
+ */
+export declare function runVerifiedRepairLoop(options: VerifiedRepairOptionsV1): Promise<VerifiedRepairOutcomeV1>;
+/**
+ * C5 — five-state completion mapping. A turn may only be `completed` with
+ * trusted verification evidence; no evidence maps to `unverified`.
+ */
+export declare function completionStateFromVerification(state: {
+    readonly cancelled: boolean;
+    readonly blockedReason?: string;
+    readonly verificationRan: boolean;
+    readonly verificationOk: boolean;
+    readonly agentClaimedSuccess: boolean;
+}): VerifiedRepairTerminal;
+//# sourceMappingURL=verified-repair.d.ts.map

package/dist/harness/verified-repair.js

@@ -0,0 +1,212 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ForbiddenRepairError = void 0;
+exports.snapshotTestFiles = snapshotTestFiles;
+exports.assertNoForbiddenRepair = assertNoForbiddenRepair;
+exports.runVerifiedRepairLoop = runVerifiedRepairLoop;
+exports.completionStateFromVerification = completionStateFromVerification;
+/**
+ * v0.3.23 T23-C3/C4/C5 — bounded verified-repair loop and the five-state
+ * completion audit.
+ *
+ * The loop alternates `verify` → structured attribution → caller-supplied
+ * `repair` with hard bounds: `maxAttempts` (default 3, from the archived
+ * AutoFixConfig semantics), an objective no-progress detector (identical
+ * attribution digests on consecutive rounds), a wall-clock/cancel signal, and
+ * an anti-cheat guard that maps forbidden repair behaviors (deleting tests,
+ * weakening assertions, touching acceptance criteria) to a hard `failed`.
+ *
+ * Completion states: completed / failed / blocked / cancelled / unverified.
+ * `unverified` is used when no trusted verification ran and nothing else
+ * explains the stop — a task can never be marked completed without
+ * verification evidence.
+ */
+const crypto_1 = require("crypto");
+const failure_attribution_1 = require("./failure-attribution");
+class ForbiddenRepairError extends Error {
+    constructor(message, guard) {
+        super(message);
+        this.guard = guard;
+        this.name = 'ForbiddenRepairError';
+    }
+}
+exports.ForbiddenRepairError = ForbiddenRepairError;
+const hash = (value) => (0, crypto_1.createHash)('sha256').update(value).digest('hex').slice(0, 32);
+function snapshotTestFiles(workspace, testFilePaths) {
+    const { existsSync, readFileSync } = require('fs');
+    const assertionTokens = {};
+    const acceptanceDigests = {};
+    for (const relative of testFilePaths) {
+        const target = joinWorkspace(workspace, relative);
+        if (!existsSync(target))
+            continue;
+        const content = readFileSync(target, 'utf8');
+        assertionTokens[relative] = (content.match(/expect\s*\(/g) ?? []).length;
+        acceptanceDigests[relative] = hash(content);
+    }
+    return { testFiles: testFilePaths, assertionTokens, acceptanceDigests };
+}
+function joinWorkspace(workspace, relative) {
+    return `${workspace.replace(/[\\/]+$/, '')}/${relative}`;
+}
+/**
+ * C4 — forbidden repair detection. Throws ForbiddenRepairError when the
+ * after-snapshot shows a test deleted, assertions materially weakened
+ * (>20% fewer `expect(` calls in a file), or an acceptance file modified.
+ */
+function assertNoForbiddenRepair(before, after) {
+    for (const testFile of before.testFiles) {
+        const beforeTokens = before.assertionTokens[testFile] ?? 0;
+        const afterExists = after.testFiles.includes(testFile) && after.assertionTokens[testFile] !== undefined;
+        if (!afterExists) {
+            throw new ForbiddenRepairError(`a test file was deleted during repair: ${testFile}`, 'test_deleted');
+        }
+        const afterTokens = after.assertionTokens[testFile] ?? 0;
+        if (beforeTokens > 0 && afterTokens < Math.ceil(beforeTokens * 0.8)) {
+            throw new ForbiddenRepairError(`assertions were weakened during repair: ${testFile} (${beforeTokens} → ${afterTokens} expect calls)`, 'assertion_weakened');
+        }
+    }
+    for (const [file, beforeDigest] of Object.entries(before.acceptanceDigests)) {
+        const afterDigest = after.acceptanceDigests[file];
+        if (afterDigest !== undefined && afterDigest !== beforeDigest) {
+            throw new ForbiddenRepairError(`acceptance criteria were modified during repair: ${file}`, 'acceptance_modified');
+        }
+    }
+}
+/**
+ * The bounded verified-repair loop (C3). The first verification is the
+ * change-aware check; each failed round attributes the failure structurally
+ * (C2), runs one bounded repair, re-verifies, and evaluates progress.
+ */
+async function runVerifiedRepairLoop(options) {
+    const maxAttempts = options.maxAttempts ?? 3;
+    const noProgressThreshold = options.noProgressThreshold ?? 2;
+    const rounds = [];
+    const seenDigests = [];
+    let previousGuard;
+    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+        if (options.signal?.aborted) {
+            return {
+                terminal: 'cancelled',
+                attempts: attempt - 1,
+                rounds,
+                noProgress: false,
+                failureReason: 'cancelled before verification',
+            };
+        }
+        let verification;
+        try {
+            verification = await options.verify();
+        }
+        catch (error) {
+            return {
+                terminal: 'blocked',
+                attempts: attempt - 1,
+                rounds,
+                noProgress: false,
+                failureReason: `verification infrastructure failed: ${error instanceof Error ? error.message : String(error)}`,
+            };
+        }
+        const attribution = (0, failure_attribution_1.attributeFailure)(verification.output, verification.command);
+        rounds.push({
+            attempt,
+            verification,
+            attribution,
+            repairRan: false,
+        });
+        if (verification.ok) {
+            return {
+                terminal: 'completed',
+                attempts: attempt,
+                rounds,
+                noProgress: false,
+                lastAttribution: attribution,
+            };
+        }
+        // Guard FIRST (before no-progress): a forbidden repair from the previous
+        // round must surface as failed, never as a soft no-progress block.
+        try {
+            previousGuard = options.guard ? await options.guard(previousGuard) : undefined;
+        }
+        catch (error) {
+            if (error instanceof ForbiddenRepairError) {
+                return {
+                    terminal: 'failed',
+                    attempts: attempt,
+                    rounds,
+                    noProgress: false,
+                    failureReason: `forbidden repair: ${error.message}`,
+                    lastAttribution: attribution,
+                };
+            }
+            return {
+                terminal: 'blocked',
+                attempts: attempt,
+                rounds,
+                noProgress: false,
+                failureReason: `repair guard failed: ${error instanceof Error ? error.message : String(error)}`,
+                lastAttribution: attribution,
+            };
+        }
+        // No-progress detection: identical failure digests on consecutive rounds.
+        if (seenDigests.length >= noProgressThreshold) {
+            seenDigests.shift();
+        }
+        seenDigests.push(attribution.digest);
+        const stuck = seenDigests.length >= noProgressThreshold &&
+            seenDigests.every(digest => digest === seenDigests[0]);
+        if (stuck || attempt === maxAttempts) {
+            return {
+                terminal: stuck ? 'blocked' : 'failed',
+                attempts: attempt,
+                rounds,
+                noProgress: stuck,
+                failureReason: stuck
+                    ? `no progress: the same failure persisted across ${seenDigests.length} rounds`
+                    : `verification still failing after ${maxAttempts} attempt(s)`,
+                lastAttribution: attribution,
+            };
+        }
+        try {
+            await options.repair(attribution, attempt);
+            rounds[rounds.length - 1] = { ...rounds[rounds.length - 1], repairRan: true };
+        }
+        catch (error) {
+            rounds[rounds.length - 1] = {
+                ...rounds[rounds.length - 1],
+                repairRan: true,
+                repairError: error instanceof Error ? error.message : String(error),
+            };
+        }
+        if (options.signal?.aborted) {
+            return {
+                terminal: 'cancelled',
+                attempts: attempt,
+                rounds,
+                noProgress: false,
+                failureReason: 'cancelled during repair',
+            };
+        }
+    }
+    return {
+        terminal: 'failed',
+        attempts: maxAttempts,
+        rounds,
+        noProgress: false,
+        failureReason: `verification still failing after ${maxAttempts} attempt(s)`,
+    };
+}
+/**
+ * C5 — five-state completion mapping. A turn may only be `completed` with
+ * trusted verification evidence; no evidence maps to `unverified`.
+ */
+function completionStateFromVerification(state) {
+    if (state.cancelled)
+        return 'cancelled';
+    if (state.blockedReason)
+        return 'blocked';
+    if (!state.verificationRan)
+        return 'unverified';
+    return state.verificationOk ? 'completed' : 'failed';
+}
+//# sourceMappingURL=verified-repair.js.map

package/dist/product/paths.d.ts

@@ -29,8 +29,25 @@ export declare function getProjectsDir(): string;
 export declare function getGlobalEnvPath(): string;
 /** Encode an absolute project path into a stable directory key. */
 export declare function encodeProjectPath(projectPath: string): string;
-/** Resolve a project path for storage identity. */
+/** Interactive Hosts must not persist an unverified Git project identity. */
+export declare class ProjectStorageIdentityUnavailableError extends Error {
+    readonly code = "project_storage_identity_unavailable";
+    constructor(message?: string);
+}
+/** An operation-local verified identity; never a permanent external-env cache. */
+export interface ProjectStorageIdentity {
+    readonly requestedPath: string;
+    readonly canonicalPath: string;
+    readonly projectKey: string;
+    readonly fingerprint: string;
+}
+export declare function resolveProjectStorageIdentityAsync(projectPath: string): Promise<ProjectStorageIdentity>;
+/** Cheap lock-admission validation: filesystem/environment only, no Git spawn. */
+export declare function assertProjectStorageIdentity(identity: ProjectStorageIdentity): void;
+/** Resolve a project path for storage identity with bounded, invalidatable reuse. */
 export declare function resolveProjectStoragePath(projectPath: string): string;
+/** Pre-resolve interactive Host identities without blocking its event loop. */
+export declare function resolveProjectStoragePathAsync(projectPath: string): Promise<string>;
 export declare function getCanonicalProjectKey(projectPath: string): string;
 export declare function getProjectDir(projectPath: string): string;
 export declare function getProjectMetadataPath(projectPath: string): string;
@@ -59,6 +76,8 @@ export declare function getMemoryPath(type: MemoryType, cwd?: string): string;
 export declare function getExistingMemoryPaths(cwd?: string): string[];
 export declare function ensureConfigDir(): void;
 export declare function ensureProjectDir(projectPath: string): void;
+/** Use the already-verified identity; do not re-probe Git under explicit env. */
+export declare function ensureResolvedProjectDir(identity: ProjectStorageIdentity): string;
 /** Ordered project config candidate files (relative to project root). */
 export declare const PROJECT_CONFIG_CANDIDATES: readonly [".orion-code.yaml", ".orion-code.yml", ".orion-code.json", "orion-code.yaml", "orion-code.yml", "orion.json"];
 /** Project instructions file (relative to project root). */