@robota-sdk/agent-session 3.0.0-beta.83 → 3.0.0-beta.84

package/dist/node/index.d.cts

@@ -1,76 +1,5 @@
-import { IAIProvider, IContextWindowState, IEventService, IHistoryEntry, IHookTypeExecutor, IResponseFormatConfig, IRunTraceContext, ISpinner, ISubprocessTraceEnv, ITerminalOutput, IToolExecutionContext, IToolExecutionResult, IToolResultSpillStore, IToolSchema, IToolWithEventService, IUserInteraction, Robota, TBackgroundPermissionPolicy, TModelEffort, TModelEffortSelection, TPermissionMode, TSessionEndReason, TToolArgs, TToolChoice, TToolParameters, TUniversalMessage, TUniversalValue } from "@robota-sdk/agent-core";
-import { ICompactEvent, IInteractiveSessionRecord, IInteractiveSessionRecord as IInteractiveSessionRecord$1, IInteractiveSessionRecord as ISessionRecord, IInteractiveSessionStore, IInteractiveSessionStore as IInteractiveSessionStore$1, IInteractiveSessionStore as ISessionStore, IPromptHistoryBlock, IPromptHistoryEntry, IPromptHistoryReadOptions, IPromptHistorySource, IPromptHistoryWriter, ISessionListEntry, ISessionRecordDecodeIssue, TCompactTrigger, TPermissionResultValue, TSessionLoadOutcome } from "@robota-sdk/agent-interface-session";
-//#region src/turn-claim.d.ts
-/**
- * Thrown when a turn is started on a session that is already running one. RUNTIME-003.
- *
- * A distinct type rather than a bare `Error`, because the point of giving the session a claim is to
- * let consumers STOP maintaining their own busy flags — and a consumer that has to regex-match an
- * error message to tell "busy, retry later" apart from a provider failure has not been given
- * anything it can act on. Follows `CompactionError`, this package's existing precedent.
- */
-declare class SessionBusyError extends Error {
-  /** Always `true`: the caller can run this turn later; nothing about the session is broken. */
-  readonly recoverable = true;
-  constructor(message: string);
-}
-/**
- * The identity of the turn a session is currently running. RUNTIME-003.
- *
- * A session used to express "is something running?" as a bare `AbortController | null` field that
- * `run()` overwrote on entry. That field was doing three jobs at once — cancellation channel, busy
- * flag, and turn identity — and it could only do them for ONE turn, so a second concurrent `run()`
- * orphaned the first: `abort()` reached only whichever turn held the field, and the first turn to
- * finish cleared it in its `finally`, making `abort()` on the survivor a silent no-op. `isRunning()`
- * read the same field, so it answered about whichever turn happened to own it. That is why consumers
- * of this library grew their own busy flags rather than trusting it.
- *
- * The fix is to give the unit of work an OWNER. A claim is taken synchronously, it belongs to the
- * caller that took it, and ONLY that caller releases it.
- *
- * REFUSAL, not pre-emption. A session is a single conversation: two turns interleaving on it produce
- * a history neither of them wrote, and silently cancelling the first would discard work the caller
- * never asked to abandon. `claim()` throws {@link SessionBusyError}, whose message names the three
- * ways forward.
- */
-declare class TurnClaim {
-  private controller;
-  /**
-   * Take the claim for a new turn, or throw if one is already held.
-   *
-   * MUST be called before the first `await` in the turn — a check that yields first is not a claim,
-   * it is a TOCTOU window, and two callers can pass it in the same tick.
-   *
-   * @throws {SessionBusyError} if a turn is already running, INCLUDING one that has been aborted but
-   *   has not finished unwinding. See {@link abort} for why that case is not an exception.
-   */
-  claim(): AbortController;
-  /**
-   * Release the claim — but only if `controller` is still the one holding it.
-   *
-   * The ownership check is what stops the original defect from reappearing in a new shape: a turn
-   * that released unconditionally in its `finally` could free a claim a LATER turn already took, and
-   * `isRunning()` would then report idle while a turn was in flight.
-   */
-  release(controller: AbortController): void;
-  /**
-   * Signal the running turn to stop. Idempotent; a no-op if nothing is running.
-   *
-   * This does NOT release the claim, and that is deliberate. An earlier version cleared it here, so
-   * `isRunning()` answered `false` the instant `abort()` returned — while the aborted turn was still
-   * unwinding, still able to write history and finish tool calls. A new `run()` could then claim the
-   * session and interleave with it: exactly the two-turns-on-one-session defect RUNTIME-003 is
-   * about, just moved behind the abort boundary. Review of the first draft caught it.
-   *
-   * A turn is not over when it is asked to stop; it is over when it has stopped. The claim is
-   * therefore held until the owning turn's `finally` releases it, and until then `isRunning()` says
-   * `true` and a further `run()` is refused. Cancel and restart is `abort()`, then AWAIT the turn,
-   * then `run()` — which is what every caller in this repo already does.
-   */
-  abort(): void;
-  isRunning(): boolean;
-}
-//#endregion
+import { IAIProvider, IContextWindowState, IEventService, IExecutionJournal, IHistoryEntry, IHookTypeExecutor, IRecoverableExecutionJournal, IResponseFormatConfig, IResumeExecutionOptions, IRunTraceContext, ISpinner, ISubprocessTraceEnv, ITerminalOutput, IToolExecutionContext, IToolExecutionResult, IToolResultSpillStore, IToolSchema, IToolWaitRequest, IToolWithEventService, IUserInteraction, Robota, TBackgroundPermissionPolicy, TModelEffort, TModelEffortSelection, TPermissionMode, TSessionEndReason, TToolArgs, TToolChoice, TToolParameters, TUniversalMessage, TUniversalValue } from "@robota-sdk/agent-core";
+import { ICompactEvent, IInteractiveSessionRecord, IInteractiveSessionRecord as IInteractiveSessionRecord$1, IInteractiveSessionRecord as ISessionRecord, IInteractiveSessionStore, IInteractiveSessionStore as IInteractiveSessionStore$1, IInteractiveSessionStore as ISessionStore, IPromptHistoryBlock, IPromptHistoryEntry, IPromptHistoryReadOptions, IPromptHistorySource, IPromptHistoryWriter, ISessionListEntry, ISessionRecordDecodeIssue, TCompactTrigger, TPermissionRequester, TPermissionResultValue, TSessionLoadOutcome } from "@robota-sdk/agent-interface-session";
 //#region src/context-window-tracker.d.ts
 /** Auto-compact when context usage reaches this fraction */
 declare const AUTO_COMPACT_THRESHOLD = 0.835;
@@ -102,60 +31,6 @@ declare class ContextWindowTracker {
   reset(): void;
 }
 //#endregion
-//#region src/auto-mode-gate.d.ts
-/** The call the classifier judges. */
-interface IClassifiedCall {
-  readonly toolName: string;
-  readonly toolArgs: TToolArgs;
-  readonly cwd: string;
-}
-interface IClassifierVerdict {
-  readonly decision: 'allow' | 'block';
-  /** Short, for the model and the user: which rule, and why. */
-  readonly reason: string;
-}
-/**
- * Judges one call. `undefined` means no usable verdict (an error, a refusal, output that does not
- * parse): the call is not run. It counts toward a run of refusals, so a classifier that cannot
- * answer hands the decision to a person instead of refusing every call.
- */
-interface IPermissionClassifier {
-  classify(call: IClassifiedCall, signal?: AbortSignal): Promise<IClassifierVerdict | undefined>;
-}
-/** Refusals in a row (blocks or unusable verdicts), and blocks in the session, that pause the mode. */
-declare const CONSECUTIVE_BLOCK_LIMIT = 3;
-declare const TOTAL_BLOCK_LIMIT = 20;
-/** `reason` is for the user (`/permissions`); `message` is what the model is told. */
-type TAutoModeJudgement = {
-  readonly kind: 'allow';
-} | {
-  readonly kind: 'block';
-  readonly reason: string;
-  readonly message: string;
-} | {
-  readonly kind: 'unusable';
-  readonly reason: string;
-  readonly message: string;
-};
-declare class AutoModeGate {
-  private readonly classifier;
-  private consecutive;
-  private total;
-  private paused;
-  /** Calls a person allowed to be retried once after the classifier blocked them. */
-  private readonly retries;
-  constructor(classifier: IPermissionClassifier);
-  /** The mode asks a person until one approves. */
-  isPaused(): boolean;
-  /** A person approved while paused: the classifier decides again. */
-  resume(): void;
-  /** Let this exact call through once, without the classifier. */
-  grantRetry(toolName: string, toolArgs: TToolArgs): void;
-  /** Consume a retry grant for this exact call, if there is one. */
-  takeRetry(toolName: string, toolArgs: TToolArgs): boolean;
-  judge(call: IClassifiedCall, signal?: AbortSignal): Promise<TAutoModeJudgement>;
-}
-//#endregion
 //#region src/session-log-reference-types.d.ts
 /**
  * Leaf type module for {@link IExternalPayloadReference}.
@@ -243,6 +118,60 @@ declare class SilentSessionLogger implements ISessionLogger {
   log(): void;
 }
 //#endregion
+//#region src/auto-mode-gate.d.ts
+/** The call the classifier judges. */
+interface IClassifiedCall {
+  readonly toolName: string;
+  readonly toolArgs: TToolArgs;
+  readonly cwd: string;
+}
+interface IClassifierVerdict {
+  readonly decision: 'allow' | 'block';
+  /** Short, for the model and the user: which rule, and why. */
+  readonly reason: string;
+}
+/**
+ * Judges one call. `undefined` means no usable verdict (an error, a refusal, output that does not
+ * parse): the call is not run. It counts toward a run of refusals, so a classifier that cannot
+ * answer hands the decision to a person instead of refusing every call.
+ */
+interface IPermissionClassifier {
+  classify(call: IClassifiedCall, signal?: AbortSignal): Promise<IClassifierVerdict | undefined>;
+}
+/** Refusals in a row (blocks or unusable verdicts), and blocks in the session, that pause the mode. */
+declare const CONSECUTIVE_BLOCK_LIMIT = 3;
+declare const TOTAL_BLOCK_LIMIT = 20;
+/** `reason` is for the user (`/permissions`); `message` is what the model is told. */
+type TAutoModeJudgement = {
+  readonly kind: 'allow';
+} | {
+  readonly kind: 'block';
+  readonly reason: string;
+  readonly message: string;
+} | {
+  readonly kind: 'unusable';
+  readonly reason: string;
+  readonly message: string;
+};
+declare class AutoModeGate {
+  private readonly classifier;
+  private consecutive;
+  private total;
+  private paused;
+  /** Calls a person allowed to be retried once after the classifier blocked them. */
+  private readonly retries;
+  constructor(classifier: IPermissionClassifier);
+  /** The mode asks a person until one approves. */
+  isPaused(): boolean;
+  /** A person approved while paused: the classifier decides again. */
+  resume(): void;
+  /** Let this exact call through once, without the classifier. */
+  grantRetry(toolName: string, toolArgs: TToolArgs): void;
+  /** Consume a retry grant for this exact call, if there is one. */
+  takeRetry(toolName: string, toolArgs: TToolArgs): boolean;
+  judge(call: IClassifiedCall, signal?: AbortSignal): Promise<TAutoModeJudgement>;
+}
+//#endregion
 //#region src/permission-types.d.ts
 /** The part of a sandbox client the permission gate consults. */
 interface ICommandSandboxApproval {
@@ -264,11 +193,26 @@ interface ICommandSandboxApproval {
  *   local settings; the storage location is owned by the consuming layer (via `onProjectAllowTool`)
  */
 type TPermissionResult = TPermissionResultValue;
+/**
+ * Issue #3288 §1: context a caller MAY attach to a permission ask beyond the call itself.
+ *
+ * `requester` says WHO is asking, when it is not the person's own turn — a background agent's tool
+ * call forwarded to the person, say — so a surface can show "Background agent X wants to …" instead
+ * of an unattributed prompt. `signal` cancels the ASK itself (not the tool call): a background task
+ * that is stopped or whose child process exits while a person has not yet answered must not leave
+ * that answer parked forever, so aborting it here settles the parked prompt denied and dismisses it
+ * on every attached surface — the same fail-closed direction `checkPermission`'s own `signal` denies
+ * on. Both fields are optional so every existing 2-arg handler stays a valid implementation.
+ */
+interface IPermissionAskContext {
+  readonly requester?: TPermissionRequester;
+  readonly signal?: AbortSignal;
+}
 /**
  * Custom permission handler — called when a tool needs user approval.
  * Returns true to allow, false to deny, or 'allow-session' to remember for the session.
  */
-type TPermissionHandler = (toolName: string, toolArgs: TToolArgs) => Promise<TPermissionResult>;
+type TPermissionHandler = (toolName: string, toolArgs: TToolArgs, context?: IPermissionAskContext) => Promise<TPermissionResult>;
 interface IPermissionEnforcerOptions {
   sessionId: string;
   cwd: string;
@@ -326,20 +270,340 @@ interface IPermissionEnforcerOptions {
    * an ask-everything flag and the task's own lists to the one evaluator, so `deny`/`preapproved`/
    * `inherit-allowlist` still bind under a permissive mode. Absent → no policy constraints.
    */
-  permissionPolicy?: TBackgroundPermissionPolicy;
+  permissionPolicy?: TBackgroundPermissionPolicy;
+  /**
+   * CORE-025: the task's OWN declared allow/deny rules (distinct from the parent session's `config.permissions`
+   * which `inherit-allowlist` inherits). `preapproved` consults these.
+   */
+  taskPermissions?: {
+    allow?: readonly string[];
+    deny?: readonly string[];
+  };
+  /**
+   * Judges, in `auto` mode, the calls the mode would otherwise ask a person about. Absent → the
+   * session cannot enter `auto`.
+   */
+  permissionClassifier?: IPermissionClassifier;
+}
+//#endregion
+//#region src/session-types.d.ts
+/** Options for graceful session shutdown. */
+interface ISessionShutdownOptions {
+  reason?: TSessionEndReason;
+}
+/** Options for constructing a Session */
+interface ISessionOptions {
+  /** Pre-constructed tools to register with the agent */
+  tools: IToolWithEventService[];
+  /**
+   * Applies to a tool added after construction (`Session.addTools`) the wrappers the assembler
+   * applied to `tools`, so a late tool is held to the same safety policy as one present from the
+   * start. The permission gate is applied by the session itself either way.
+   */
+  wrapAddedTools?: (tools: IToolWithEventService[]) => IToolWithEventService[];
+  /** Pre-constructed AI provider */
+  provider: IAIProvider;
+  /** Pre-built system message string */
+  systemMessage: string;
+  /** Terminal I/O for permission prompts */
+  terminal: ITerminalOutput;
+  /**
+   * The session's execution root. REQUIRED — ARCH-010.
+   *
+   * This field did not exist. `Session` read `process.cwd()` in its constructor and that ambient
+   * value became the session's identity everywhere it matters: every hook input,
+   * `CLAUDE_PROJECT_DIR`, `PermissionEnforcer`'s root, and the persisted record. Meanwhile the
+   * subagent spawn contract has always declared `cwd` REQUIRED — and the in-process runner passed
+   * none, because there was no option to pass it to. A session that cannot be told where it runs
+   * silently runs wherever the process happens to be, which for a subagent is not its own workspace.
+   *
+   * A caller that genuinely means "this process's directory" passes `process.cwd()` where a reader
+   * can see the decision.
+   */
+  cwd: string;
+  /** Permission and hook configuration */
+  permissions?: {
+    allow: string[];
+    deny: string[];
+    ask?: string[];
+  };
+  /**
+   * ARCH-040 Group C (issue #1934): the permission rules BEFORE any preset contributed.
+   *
+   * Passed rather than inferred. `permissions` above already has the startup preset's patterns baked
+   * in, so an enforcer that captured its own base from it on the first live `/preset` would keep the
+   * FIRST preset's allowlist forever — the accumulation the replace rule exists to prevent, arriving
+   * through the base instead of through the merge. Absent ⇒ no preset contributed and the two are
+   * the same.
+   */
+  presetFreePermissions?: {
+    allow: readonly string[];
+    deny: readonly string[];
+  };
+  hooks?: Record<string, unknown>;
+  /** Initial permission mode */
+  permissionMode?: TPermissionMode;
+  /**
+   * CORE-025: background/subagent task permission policy. Resolved BEFORE the session-mode gate, so
+   * `deny`/`preapproved`/`inherit-allowlist` override even a permissive `permissionMode`. Absent on a normal
+   * interactive session (mode gate alone). Set by `createSubagentSession` from the spawn request.
+   */
+  permissionPolicy?: TBackgroundPermissionPolicy;
+  /** CORE-025: the task's OWN allow/deny lists (what `preapproved` consults; distinct from `permissions`). */
+  taskPermissions?: {
+    allow?: readonly string[];
+    deny?: readonly string[];
+  };
+  /**
+   * Injected "ask the user" port (CMD-005): forwarded into the agent config so model-invoked tools
+   * (AskUserQuestion) can solicit a structured answer. Absent in headless/automation sessions.
+   */
+  ask?: IUserInteraction['ask'];
+  /** Default trust level — used to derive permissionMode if not given */
+  defaultTrustLevel?: 'safe' | 'moderate' | 'full';
+  /** Active preset id selected at startup (PRESET-011 runtime state). Defaults to 'default'. */
+  activePresetId?: string;
+  /**
+   * Whether subagent dispatch is allowed for this session (PRESET-016 runtime gate). Defaults to
+   * true (current behavior). Only meaningful when the agent runtime was built at assembly.
+   */
+  enableParallelSubagents?: boolean;
+  /** Model name (for context window sizing and Robota config) */
+  model?: string;
+  /** Provider idle timeout in milliseconds for each model call */
+  providerTimeout?: number;
+  /** Maximum number of agentic turns per run() call. Undefined = unlimited. */
+  maxTurns?: number;
+  /** Optional session store for persistence */
+  sessionStore?: IInteractiveSessionStore$1;
+  /** Override session ID (used when resuming a session to reuse the original ID) */
+  sessionId?: string;
+  /** Custom permission handler (overrides terminal-based prompts, used by Ink UI) */
+  permissionHandler?: TPermissionHandler;
+  /** The OS sandbox the shell tools run under, which may let a confined command skip the prompt. */
+  commandSandbox?: ICommandSandboxApproval;
+  /** Decides for `auto` mode. Without one the session refuses that mode. */
+  permissionClassifier?: IPermissionClassifier;
+  /** Called when the user selects "allow for project" — persists the tool pattern to project settings. */
+  onProjectAllowTool?: (toolName: string) => void;
+  /** Callback for text deltas — enables streaming text to the UI in real-time */
+  onTextDelta?: (delta: string) => void;
+  /** Callback when context window usage is refreshed */
+  onContextUpdate?: (state: IContextWindowState) => void;
+  /** Custom prompt-for-approval function (injected from CLI) */
+  promptForApproval?: (terminal: ITerminalOutput, toolName: string, toolArgs: TToolArgs) => Promise<TPermissionResult>;
+  /** Callback when a tool starts or finishes execution — enables real-time tool display in UI */
+  onToolExecution?: (event: {
+    type: 'start' | 'end';
+    toolName: string;
+    toolArgs?: TToolArgs;
+    success?: boolean;
+    denied?: boolean;
+    toolResultData?: string;
+    executionId?: string;
+  }) => void;
+  /** Callback when context is compacted */
+  onCompact?: (summary: string) => void;
+  /** Callback with structured compaction metadata */
+  onCompactEvent?: (event: ICompactEvent) => void;
+  /** Instructions to include in the compaction prompt (e.g. from project context files) */
+  compactInstructions?: string;
+  /**
+   * Replaces the base instruction template of the compaction summarization prompt
+   * (default: `DEFAULT_COMPACTION_PROMPT`, a domain-neutral template). Lets the consuming
+   * layer own the compaction prompt wording entirely.
+   */
+  compactionBasePrompt?: string;
+  /**
+   * Concrete remediation wording for the core's hard-capacity notice, forwarded to the Robota
+   * agent config as `IAgentConfig.contextCapacityHint`. The zero-dependency core emits a
+   * product-neutral default; a surface tier that owns a real remediation command (e.g. a
+   * `/compact` slash command) injects its own actionable hint here. Absent ⇒ the neutral
+   * `DEFAULT_CONTEXT_CAPACITY_HINT` applies.
+   */
+  contextCapacityHint?: string;
+  /** Override context max tokens (otherwise derived from model name) */
+  contextMaxTokens?: number;
+  /** Auto-compact threshold as a 0-1 fraction. Set false to disable automatic compaction. */
+  autoCompactThreshold?: TAutoCompactThreshold;
+  /** Session logger — injected for pluggable session event logging. */
+  sessionLogger?: ISessionLogger;
+  /** Host-projected transcript path for hook compatibility; never inferred from a record store. */
+  transcriptPath?: string;
+  /** Additional hook type executors (e.g. prompt, agent) beyond the core defaults. */
+  hookTypeExecutors?: IHookTypeExecutor[];
+  /** Name reported to the Robota agent config. Defaults to 'agent' if not provided. */
+  agentName?: string;
+  /**
+   * Request structured output from the provider for this session. Issue #2056: the agent config's
+   * own shape (`json_schema` included), so a schema request reaches the provider intact.
+   */
+  responseFormat?: IResponseFormatConfig;
+  /**
+   * Reasoning-effort selection threaded to the Robota agent config and provider boundary.
+   * When unset, Core preserves provider-default selection as `auto`.
+   */
+  effort?: TModelEffortSelection;
+  /**
+   * ARCH-040: sampling temperature and output cap, threaded to the agent config at CONSTRUCTION.
+   *
+   * The live `/preset` path has always applied both through `applyModelOptions`, and startup applied
+   * neither — so one session held two answers for the same preset depending on WHEN it was chosen,
+   * which is what `effort` did before ARCH-013 stage 1 fixed it. `maxOutputTokens` maps to the
+   * agent's `maxTokens` channel, the same name `applyModelOptions` already writes.
+   */
+  temperature?: number;
+  maxOutputTokens?: number;
+}
+/**
+ * The per-TURN options a caller may attach to one `Session.run()`.
+ *
+ * Both are optional and independent, and both are absent on the dominant path, so they are spread
+ * as a group rather than tested one at a time at each call site.
+ */
+interface ISessionRunOptions {
+  /** Awaited core model/tool and automatic-compaction journal for this turn. */
+  executionJournal?: IExecutionJournal;
+  /** Cancellation belongs to this submission and remains linked until execution settles. */
+  signal?: AbortSignal;
+  /**
+   * SELFHOST-008 P3: a transient system-role block for THIS turn's provider request only. Never
+   * written to the conversation store.
+   */
+  ephemeralSystemContext?: string;
+  /**
+   * PEER-007 (issue #1915): display attribution for the stored user message — who drove this turn.
+   * Never an authorization input (issue #1809).
+   */
+  driverId?: string;
+  /** Where this turn came from, stored beside `driverId` on the user message. Display only. */
+  turnSource?: string;
+  /** Run-scoped model tool directive; 'none' remains in force for this turn only. */
+  toolChoice?: TToolChoice;
+  /**
+   * A message from another agent session started this turn. The reply to that session exists only
+   * here, and the provider's hosted tools are withheld because no permission step can decide them;
+   * every other call is decided by the session's ordinary permissions.
+   */
+  peerTurn?: boolean;
+  /** Host-owned trusted trace context for this turn's provider calls (agent-core `IRunOptions`). */
+  traceContext?: IRunTraceContext;
+}
+interface IProviderCallTraceObservation {
+  readonly callId?: string;
+  readonly round: number;
+  readonly startedAt: string;
+  readonly endedAt: string;
+  readonly outcome: 'success' | 'failure' | 'interrupted';
+  readonly disposition?: 'invoked' | 'cache-hit' | 'preflight-refused';
+  readonly providerId?: string;
+  readonly modelId?: string;
+  readonly usageProvenance?: 'complete' | 'partial' | 'absent';
+  readonly promptTokens?: number;
+  readonly completionTokens?: number;
+  readonly totalTokens?: number;
+  /** Present only for an invoked call whose adapter attested one; never fabricated. */
+  readonly providerRequestId?: string;
+}
+//#endregion
+//#region src/session-resume.d.ts
+type TSessionResumeOptions = Pick<IResumeExecutionOptions, 'executionId' | 'journal' | 'signal' | 'traceContext'>;
+//#endregion
+//#region src/session-recoverable.d.ts
+interface ISessionRecoverableRunOptions extends ISessionRunOptions {
+  executionJournal: IRecoverableExecutionJournal;
+}
+type TSessionRecoverableResumeOptions = TSessionResumeOptions & Pick<IResumeExecutionOptions, 'toolResponses'>;
+type TSessionExecutionResult = {
+  status: 'completed';
+  response: string;
+} | {
+  status: 'waiting';
+  requests: readonly IToolWaitRequest[];
+};
+/**
+ * A journaled execution whose round is open in history — parked on saved waits, or stopped by a
+ * failure — so the Session accepts no new input until it is resumed or abandoned. `requests` are
+ * the saved waits whose effect has not been admitted; empty when a failure left the round open.
+ */
+interface ISessionPendingExecution {
+  executionId: string;
+  requests: readonly IToolWaitRequest[];
+}
+//#endregion
+//#region src/turn-claim.d.ts
+/**
+ * Thrown when a turn is started on a session that is already running one. RUNTIME-003.
+ *
+ * A distinct type rather than a bare `Error`, because the point of giving the session a claim is to
+ * let consumers STOP maintaining their own busy flags — and a consumer that has to regex-match an
+ * error message to tell "busy, retry later" apart from a provider failure has not been given
+ * anything it can act on. Follows `CompactionError`, this package's existing precedent.
+ */
+declare class SessionBusyError extends Error {
+  /** Always `true`: the caller can run this turn later; nothing about the session is broken. */
+  readonly recoverable = true;
+  constructor(message: string);
+}
+/**
+ * The identity of the turn a session is currently running. RUNTIME-003.
+ *
+ * A session used to express "is something running?" as a bare `AbortController | null` field that
+ * `run()` overwrote on entry. That field was doing three jobs at once — cancellation channel, busy
+ * flag, and turn identity — and it could only do them for ONE turn, so a second concurrent `run()`
+ * orphaned the first: `abort()` reached only whichever turn held the field, and the first turn to
+ * finish cleared it in its `finally`, making `abort()` on the survivor a silent no-op. `isRunning()`
+ * read the same field, so it answered about whichever turn happened to own it. That is why consumers
+ * of this library grew their own busy flags rather than trusting it.
+ *
+ * The fix is to give the unit of work an OWNER. A claim is taken synchronously, it belongs to the
+ * caller that took it, and ONLY that caller releases it.
+ *
+ * REFUSAL, not pre-emption. A session is a single conversation: two turns interleaving on it produce
+ * a history neither of them wrote, and silently cancelling the first would discard work the caller
+ * never asked to abandon. `claim()` throws {@link SessionBusyError}, whose message names the three
+ * ways forward.
+ */
+declare class TurnClaim {
+  private controller;
+  private settlement;
+  private settle;
+  /** Resolves when the currently claimed turn has finished unwinding. */
+  get drained(): Promise<void>;
+  /**
+   * Take the claim for a new turn, or throw if one is already held.
+   *
+   * MUST be called before the first `await` in the turn — a check that yields first is not a claim,
+   * it is a TOCTOU window, and two callers can pass it in the same tick.
+   *
+   * @throws {SessionBusyError} if a turn is already running, INCLUDING one that has been aborted but
+   *   has not finished unwinding. See {@link abort} for why that case is not an exception.
+   */
+  claim(): AbortController;
   /**
-   * CORE-025: the task's OWN declared allow/deny rules (distinct from the parent session's `config.permissions`
-   * which `inherit-allowlist` inherits). `preapproved` consults these.
+   * Release the claim — but only if `controller` is still the one holding it.
+   *
+   * The ownership check is what stops the original defect from reappearing in a new shape: a turn
+   * that released unconditionally in its `finally` could free a claim a LATER turn already took, and
+   * `isRunning()` would then report idle while a turn was in flight.
    */
-  taskPermissions?: {
-    allow?: readonly string[];
-    deny?: readonly string[];
-  };
+  release(controller: AbortController): void;
   /**
-   * Judges, in `auto` mode, the calls the mode would otherwise ask a person about. Absent → the
-   * session cannot enter `auto`.
+   * Signal the running turn to stop. Idempotent; a no-op if nothing is running.
+   *
+   * This does NOT release the claim, and that is deliberate. An earlier version cleared it here, so
+   * `isRunning()` answered `false` the instant `abort()` returned — while the aborted turn was still
+   * unwinding, still able to write history and finish tool calls. A new `run()` could then claim the
+   * session and interleave with it: exactly the two-turns-on-one-session defect RUNTIME-003 is
+   * about, just moved behind the abort boundary. Review of the first draft caught it.
+   *
+   * A turn is not over when it is asked to stop; it is over when it has stopped. The claim is
+   * therefore held until the owning turn's `finally` releases it, and until then `isRunning()` says
+   * `true` and a further `run()` is refused. Cancel and restart is `abort()`, then AWAIT the turn,
+   * then `run()` — which is what every caller in this repo already does.
    */
-  permissionClassifier?: IPermissionClassifier;
+  abort(): void;
+  isRunning(): boolean;
 }
 //#endregion
 //#region src/permission-denial-log.d.ts
@@ -391,13 +655,14 @@ declare class PermissionEnforcer {
   private readonly denials;
   /** A turn a peer's message started is in progress: the one place the reply to that peer exists. */
   private peerTurn;
+  private checkpointedApprovals;
   private readonly autoMode?;
   constructor(options: IPermissionEnforcerOptions);
   /**
    * Start a turn, which a peer's message started when `peerTurn` is true. That decides only whether
    * the reply to the peer exists; every other call is decided exactly as in any turn.
    */
-  beginTurn(peerTurn: boolean): void;
+  beginTurn(peerTurn: boolean, checkpointedApprovals?: boolean): void;
   /** End the turn; the reply to a peer is gone until the next peer turn begins. */
   endTurn(): void;
   /** Whether `auto` mode can run here: it needs a classifier to decide for it. */
@@ -476,6 +741,7 @@ declare class PermissionEnforcer {
   checkDelegatedToolCall(toolName: string, toolParameters: TToolParameters, signal?: AbortSignal): Promise<boolean>;
   /** {@link checkPermission}, keeping the reason a refusal carries for the model. */
   private decidePermission;
+  private evaluateToolPermission;
   private decideInAutoMode;
   /**
    * The human-approval path: session-scoped allow list → custom handler → injected approval fn → fail-closed
@@ -668,224 +934,6 @@ declare abstract class SessionBase {
   clearHistory(): void;
 }
 //#endregion
-//#region src/session-types.d.ts
-/** Options for graceful session shutdown. */
-interface ISessionShutdownOptions {
-  reason?: TSessionEndReason;
-}
-/** Options for constructing a Session */
-interface ISessionOptions {
-  /** Pre-constructed tools to register with the agent */
-  tools: IToolWithEventService[];
-  /**
-   * Applies to a tool added after construction (`Session.addTools`) the wrappers the assembler
-   * applied to `tools`, so a late tool is held to the same safety policy as one present from the
-   * start. The permission gate is applied by the session itself either way.
-   */
-  wrapAddedTools?: (tools: IToolWithEventService[]) => IToolWithEventService[];
-  /** Pre-constructed AI provider */
-  provider: IAIProvider;
-  /** Pre-built system message string */
-  systemMessage: string;
-  /** Terminal I/O for permission prompts */
-  terminal: ITerminalOutput;
-  /**
-   * The session's execution root. REQUIRED — ARCH-010.
-   *
-   * This field did not exist. `Session` read `process.cwd()` in its constructor and that ambient
-   * value became the session's identity everywhere it matters: every hook input,
-   * `CLAUDE_PROJECT_DIR`, `PermissionEnforcer`'s root, and the persisted record. Meanwhile the
-   * subagent spawn contract has always declared `cwd` REQUIRED — and the in-process runner passed
-   * none, because there was no option to pass it to. A session that cannot be told where it runs
-   * silently runs wherever the process happens to be, which for a subagent is not its own workspace.
-   *
-   * A caller that genuinely means "this process's directory" passes `process.cwd()` where a reader
-   * can see the decision.
-   */
-  cwd: string;
-  /** Permission and hook configuration */
-  permissions?: {
-    allow: string[];
-    deny: string[];
-    ask?: string[];
-  };
-  /**
-   * ARCH-040 Group C (issue #1934): the permission rules BEFORE any preset contributed.
-   *
-   * Passed rather than inferred. `permissions` above already has the startup preset's patterns baked
-   * in, so an enforcer that captured its own base from it on the first live `/preset` would keep the
-   * FIRST preset's allowlist forever — the accumulation the replace rule exists to prevent, arriving
-   * through the base instead of through the merge. Absent ⇒ no preset contributed and the two are
-   * the same.
-   */
-  presetFreePermissions?: {
-    allow: readonly string[];
-    deny: readonly string[];
-  };
-  hooks?: Record<string, unknown>;
-  /** Initial permission mode */
-  permissionMode?: TPermissionMode;
-  /**
-   * CORE-025: background/subagent task permission policy. Resolved BEFORE the session-mode gate, so
-   * `deny`/`preapproved`/`inherit-allowlist` override even a permissive `permissionMode`. Absent on a normal
-   * interactive session (mode gate alone). Set by `createSubagentSession` from the spawn request.
-   */
-  permissionPolicy?: TBackgroundPermissionPolicy;
-  /** CORE-025: the task's OWN allow/deny lists (what `preapproved` consults; distinct from `permissions`). */
-  taskPermissions?: {
-    allow?: readonly string[];
-    deny?: readonly string[];
-  };
-  /**
-   * Injected "ask the user" port (CMD-005): forwarded into the agent config so model-invoked tools
-   * (AskUserQuestion) can solicit a structured answer. Absent in headless/automation sessions.
-   */
-  ask?: IUserInteraction['ask'];
-  /** Default trust level — used to derive permissionMode if not given */
-  defaultTrustLevel?: 'safe' | 'moderate' | 'full';
-  /** Active preset id selected at startup (PRESET-011 runtime state). Defaults to 'default'. */
-  activePresetId?: string;
-  /**
-   * Whether subagent dispatch is allowed for this session (PRESET-016 runtime gate). Defaults to
-   * true (current behavior). Only meaningful when the agent runtime was built at assembly.
-   */
-  enableParallelSubagents?: boolean;
-  /** Model name (for context window sizing and Robota config) */
-  model?: string;
-  /** Provider idle timeout in milliseconds for each model call */
-  providerTimeout?: number;
-  /** Maximum number of agentic turns per run() call. Undefined = unlimited. */
-  maxTurns?: number;
-  /** Optional session store for persistence */
-  sessionStore?: IInteractiveSessionStore$1;
-  /** Override session ID (used when resuming a session to reuse the original ID) */
-  sessionId?: string;
-  /** Custom permission handler (overrides terminal-based prompts, used by Ink UI) */
-  permissionHandler?: TPermissionHandler;
-  /** The OS sandbox the shell tools run under, which may let a confined command skip the prompt. */
-  commandSandbox?: ICommandSandboxApproval;
-  /** Decides for `auto` mode. Without one the session refuses that mode. */
-  permissionClassifier?: IPermissionClassifier;
-  /** Called when the user selects "allow for project" — persists the tool pattern to project settings. */
-  onProjectAllowTool?: (toolName: string) => void;
-  /** Callback for text deltas — enables streaming text to the UI in real-time */
-  onTextDelta?: (delta: string) => void;
-  /** Callback when context window usage is refreshed */
-  onContextUpdate?: (state: IContextWindowState) => void;
-  /** Custom prompt-for-approval function (injected from CLI) */
-  promptForApproval?: (terminal: ITerminalOutput, toolName: string, toolArgs: TToolArgs) => Promise<TPermissionResult>;
-  /** Callback when a tool starts or finishes execution — enables real-time tool display in UI */
-  onToolExecution?: (event: {
-    type: 'start' | 'end';
-    toolName: string;
-    toolArgs?: TToolArgs;
-    success?: boolean;
-    denied?: boolean;
-    toolResultData?: string;
-    executionId?: string;
-  }) => void;
-  /** Callback when context is compacted */
-  onCompact?: (summary: string) => void;
-  /** Callback with structured compaction metadata */
-  onCompactEvent?: (event: ICompactEvent) => void;
-  /** Instructions to include in the compaction prompt (e.g. from project context files) */
-  compactInstructions?: string;
-  /**
-   * Replaces the base instruction template of the compaction summarization prompt
-   * (default: `DEFAULT_COMPACTION_PROMPT`, a domain-neutral template). Lets the consuming
-   * layer own the compaction prompt wording entirely.
-   */
-  compactionBasePrompt?: string;
-  /**
-   * Concrete remediation wording for the core's hard-capacity notice, forwarded to the Robota
-   * agent config as `IAgentConfig.contextCapacityHint`. The zero-dependency core emits a
-   * product-neutral default; a surface tier that owns a real remediation command (e.g. a
-   * `/compact` slash command) injects its own actionable hint here. Absent ⇒ the neutral
-   * `DEFAULT_CONTEXT_CAPACITY_HINT` applies.
-   */
-  contextCapacityHint?: string;
-  /** Override context max tokens (otherwise derived from model name) */
-  contextMaxTokens?: number;
-  /** Auto-compact threshold as a 0-1 fraction. Set false to disable automatic compaction. */
-  autoCompactThreshold?: TAutoCompactThreshold;
-  /** Session logger — injected for pluggable session event logging. */
-  sessionLogger?: ISessionLogger;
-  /** Host-projected transcript path for hook compatibility; never inferred from a record store. */
-  transcriptPath?: string;
-  /** Additional hook type executors (e.g. prompt, agent) beyond the core defaults. */
-  hookTypeExecutors?: IHookTypeExecutor[];
-  /** Name reported to the Robota agent config. Defaults to 'agent' if not provided. */
-  agentName?: string;
-  /**
-   * Request structured output from the provider for this session. Issue #2056: the agent config's
-   * own shape (`json_schema` included), so a schema request reaches the provider intact.
-   */
-  responseFormat?: IResponseFormatConfig;
-  /**
-   * Reasoning-effort selection threaded to the Robota agent config and provider boundary.
-   * When unset, Core preserves provider-default selection as `auto`.
-   */
-  effort?: TModelEffortSelection;
-  /**
-   * ARCH-040: sampling temperature and output cap, threaded to the agent config at CONSTRUCTION.
-   *
-   * The live `/preset` path has always applied both through `applyModelOptions`, and startup applied
-   * neither — so one session held two answers for the same preset depending on WHEN it was chosen,
-   * which is what `effort` did before ARCH-013 stage 1 fixed it. `maxOutputTokens` maps to the
-   * agent's `maxTokens` channel, the same name `applyModelOptions` already writes.
-   */
-  temperature?: number;
-  maxOutputTokens?: number;
-}
-/**
- * The per-TURN options a caller may attach to one `Session.run()`.
- *
- * Both are optional and independent, and both are absent on the dominant path, so they are spread
- * as a group rather than tested one at a time at each call site.
- */
-interface ISessionRunOptions {
-  /** Cancellation belongs to this submission and remains linked until execution settles. */
-  signal?: AbortSignal;
-  /**
-   * SELFHOST-008 P3: a transient system-role block for THIS turn's provider request only. Never
-   * written to the conversation store.
-   */
-  ephemeralSystemContext?: string;
-  /**
-   * PEER-007 (issue #1915): display attribution for the stored user message — who drove this turn.
-   * Never an authorization input (issue #1809).
-   */
-  driverId?: string;
-  /** Where this turn came from, stored beside `driverId` on the user message. Display only. */
-  turnSource?: string;
-  /** Run-scoped model tool directive; 'none' remains in force for this turn only. */
-  toolChoice?: TToolChoice;
-  /**
-   * A message from another agent session started this turn. The reply to that session exists only
-   * here, and the provider's hosted tools are withheld because no permission step can decide them;
-   * every other call is decided by the session's ordinary permissions.
-   */
-  peerTurn?: boolean;
-  /** Host-owned trusted trace context for this turn's provider calls (agent-core `IRunOptions`). */
-  traceContext?: IRunTraceContext;
-}
-interface IProviderCallTraceObservation {
-  readonly callId?: string;
-  readonly round: number;
-  readonly startedAt: string;
-  readonly endedAt: string;
-  readonly outcome: 'success' | 'failure' | 'interrupted';
-  readonly disposition?: 'invoked' | 'cache-hit' | 'preflight-refused';
-  readonly providerId?: string;
-  readonly modelId?: string;
-  readonly usageProvenance?: 'complete' | 'partial' | 'absent';
-  readonly promptTokens?: number;
-  readonly completionTokens?: number;
-  readonly totalTokens?: number;
-  /** Present only for an invoked call whose adapter attested one; never fabricated. */
-  readonly providerRequestId?: string;
-}
-//#endregion
 //#region src/session.d.ts
 /** Wraps a Robota agent with project context, permission state, and optional persistence. */
 declare class Session extends SessionBase {
@@ -926,6 +974,8 @@ declare class Session extends SessionBase {
   /** The last tool change; the next one waits for it. */
   private toolChange;
   private shuttingDown;
+  /** Set while a journaled execution's round is open in history; cleared once it settles or is abandoned. */
+  private pendingExecution?;
   private shutdownPromise;
   /** Stdout collected from SessionStart hooks, injected on first run(). */
   private sessionStartStdout;
@@ -938,6 +988,22 @@ declare class Session extends SessionBase {
    * REJECTS with `SessionBusyError` if a turn is in flight — RUNTIME-003; see `turn-claim.ts`.
    */
   run(message: string, rawInput?: string, options?: ISessionRunOptions): Promise<string>;
+  /** Run with durable approval requests instead of a live approval Promise. */
+  runRecoverable(message: string, options: ISessionRecoverableRunOptions, rawInput?: string): Promise<TSessionExecutionResult>;
+  private runTurn;
+  /** Resume the original Session execution under current permissions without submitting input. */
+  resume(options: TSessionResumeOptions): Promise<string>;
+  /** Recheck current permissions and continue exact journaled responses without another input. */
+  resumeRecoverable(options: TSessionRecoverableResumeOptions): Promise<TSessionExecutionResult>;
+  private resumeTurn;
+  /** The execution blocking new input, if any: parked on saved waits, or left open by a failure. */
+  getPendingExecution(): ISessionPendingExecution | undefined;
+  /**
+   * Give up a pending execution so the Session accepts new input. Nothing runs and nothing is
+   * journaled: calls its parked round left open are closed in history as failed, and the journal's
+   * records stay with the host. Resuming the execution afterwards is refused as a history conflict.
+   */
+  abandonPendingExecution(executionId: string): void;
   /**
    * Make tools available from the next turn on — for a capability that became usable mid-session,
    * such as an MCP server connected after its sign-in. Each goes through the same wrappers and
@@ -973,7 +1039,7 @@ declare class Session extends SessionBase {
    */
   shutdown(options?: ISessionShutdownOptions): Promise<void>;
   swapProvider(newProvider: IAIProvider, model: string): void;
-  compact(instructions?: string, trigger?: TCompactTrigger, signal?: AbortSignal): Promise<void>;
+  compact(instructions?: string, trigger?: TCompactTrigger, signal?: AbortSignal, executionJournal?: IExecutionJournal): Promise<void>;
   /** `hookTraceEnv` reaches PreCompact only for a compaction inside a prompt (see `executeRun`). */
   private compactWith;
   private buildRunContext;
@@ -1038,7 +1104,7 @@ declare class CompactionOrchestrator {
    * @throws {CompactionError} when `history` is empty, or when the provider returns a non-string or
    *   empty summary — callers must leave the conversation history untouched in every such case
    */
-  compact(provider: IAIProvider, history: TUniversalMessage[], instructions?: string, signal?: AbortSignal, trigger?: TCompactTrigger, hookTraceEnv?: ISubprocessTraceEnv): Promise<string>;
+  compact(provider: IAIProvider, history: TUniversalMessage[], instructions?: string, signal?: AbortSignal, trigger?: TCompactTrigger, hookTraceEnv?: ISubprocessTraceEnv, executionJournal?: IExecutionJournal): Promise<string>;
   /** Build the compaction prompt from conversation history */
   private buildCompactionPrompt;
 }
@@ -1554,16 +1620,25 @@ declare class CheckpointTree {
 }
 //#endregion
 //#region src/session-record-codec/decode-outcome.d.ts
-/** What a decode of a persisted session record can conclude. */
+/**
+ * What a decode of a persisted session record can conclude.
+ *
+ * `corrupt` and `unsupported` carry an optional `cwd`: a best-effort, untyped read of the raw value
+ * for a plain `cwd` string, taken even though the rest of the value failed full decode. It exists so
+ * a caller that only wants to know which workspace an unreadable record belongs to — never its
+ * content — is not forced to treat every one of them as workspace-unknown.
+ */
 type TSessionRecordDecodeOutcome = {
   readonly status: 'valid';
   readonly record: IInteractiveSessionRecord$1;
 } | {
   readonly status: 'corrupt';
   readonly issues: readonly ISessionRecordDecodeIssue[];
+  readonly cwd?: string;
 } | {
   readonly status: 'unsupported';
   readonly schemaVersion: number | undefined;
+  readonly cwd?: string;
 };
 //#endregion
 //#region src/session-record-codec/record-decoder.d.ts
@@ -1618,5 +1693,5 @@ declare function decodeInteractiveSessionRecord(value: unknown): TSessionRecordD
  */
 declare function decodeVersionedInteractiveSessionRecord(value: unknown): TSessionRecordDecodeOutcome;
 //#endregion
-export { AUTO_COMPACT_THRESHOLD, AutoModeGate, CONSECUTIVE_BLOCK_LIMIT, CheckpointTree, CompactionError, CompactionOrchestrator, ContextWindowTracker, DEFAULT_COMPACTION_PROMPT, DEFAULT_PROMPT_HISTORY_BLOCK_BYTES, FileSessionLogger, type ICheckpointNode, type IClassifiedCall, type IClassifierVerdict, type ICommandSandboxApproval, type IExternalPayloadReference, type IExternalPayloadSink, type IExternalPayloadSource, type IFileSessionLoggerOptions, type IInteractiveSessionRecord, type IInteractiveSessionStore, INTERACTIVE_SESSION_RECORD_KEYS, type INodePromptHistoryFileOptions, type INodeToolResultSpillStoreOptions, type IPermissionClassifier, type IPermissionDenial, type IProviderCallTraceObservation, type IProviderEventKey, type ISerializeSessionArtifactOptions, type ISessionLogEntry, type ISessionLogLine, type ISessionLogLoadOptions, type ISessionLogPayloadResolutionErrorMetadata, type ISessionLogPayloadResolutionOptions, type ISessionLogSink, type ISessionLogSource, type ISessionLogger, type ISessionOptions, type ISessionRecord, type ISessionReplayRecord, type ISessionReplayValidationIssue, type ISessionReplayValidationResult, type ISessionRunOptions, type ISessionShutdownOptions, type ISessionStore, type ISpinner, type ITerminalOutput, type IToolEventKey, type IVersionedInteractiveSessionRecord, NodeExternalPayloadSource, NodePromptHistoryFile, NodeSessionLogSink, NodeSessionLogSource, NodeSessionStore, NodeToolResultSpillStore, PermissionEnforcer, SENSITIVE_KEY_PATTERN, SESSION_LOG_EVENT, SESSION_LOG_SCHEMA_VERSION, SESSION_RECORD_ENVELOPE_VERSION, Session, SessionBusyError, SessionLogDecodeError, SessionLogPayloadResolutionError, SilentSessionLogger, type TAutoCompactThreshold, type TAutoModeJudgement, type TDecodedSessionLogEntry, TOTAL_BLOCK_LIMIT, type TPermissionDenialReason, type TPermissionHandler, type TPermissionResult, type TScrubbableValue, type TSessionLogData, type TSessionLogDecodeErrorCode, type TSessionLogEventName, type TSessionLogPayloadResolutionErrorCode, type TSessionLogValue, type TSessionRecordDecodeOutcome, type TToolResultSpillErrorCode, ToolResultSpillError, TurnClaim, assertSafeSessionId, consentScopeFor, createSessionLogExternalPayloadReference, decodeInteractiveSessionRecord, decodeSessionLogEntries, decodeVersionedInteractiveSessionRecord, deserializeSessionArtifact, formatConversationEntries, isSafeSessionId, isSensitiveKey, isSessionLogEvent, loadSessionLogEntries, parsePromptHistoryLine, replaySessionLogEntries, resolveSessionLogExternalPayloads, scrubSensitiveKeys, serializeSessionArtifact, validateSessionReplayLogEntries };
+export { AUTO_COMPACT_THRESHOLD, AutoModeGate, CONSECUTIVE_BLOCK_LIMIT, CheckpointTree, CompactionError, CompactionOrchestrator, ContextWindowTracker, DEFAULT_COMPACTION_PROMPT, DEFAULT_PROMPT_HISTORY_BLOCK_BYTES, FileSessionLogger, type ICheckpointNode, type IClassifiedCall, type IClassifierVerdict, type ICommandSandboxApproval, type IExternalPayloadReference, type IExternalPayloadSink, type IExternalPayloadSource, type IFileSessionLoggerOptions, type IInteractiveSessionRecord, type IInteractiveSessionStore, INTERACTIVE_SESSION_RECORD_KEYS, type INodePromptHistoryFileOptions, type INodeToolResultSpillStoreOptions, type IPermissionAskContext, type IPermissionClassifier, type IPermissionDenial, type IProviderCallTraceObservation, type IProviderEventKey, type ISerializeSessionArtifactOptions, type ISessionLogEntry, type ISessionLogLine, type ISessionLogLoadOptions, type ISessionLogPayloadResolutionErrorMetadata, type ISessionLogPayloadResolutionOptions, type ISessionLogSink, type ISessionLogSource, type ISessionLogger, type ISessionOptions, type ISessionPendingExecution, type ISessionRecord, type ISessionRecoverableRunOptions, type ISessionReplayRecord, type ISessionReplayValidationIssue, type ISessionReplayValidationResult, type ISessionRunOptions, type ISessionShutdownOptions, type ISessionStore, type ISpinner, type ITerminalOutput, type IToolEventKey, type IVersionedInteractiveSessionRecord, NodeExternalPayloadSource, NodePromptHistoryFile, NodeSessionLogSink, NodeSessionLogSource, NodeSessionStore, NodeToolResultSpillStore, PermissionEnforcer, SENSITIVE_KEY_PATTERN, SESSION_LOG_EVENT, SESSION_LOG_SCHEMA_VERSION, SESSION_RECORD_ENVELOPE_VERSION, Session, SessionBusyError, SessionLogDecodeError, SessionLogPayloadResolutionError, SilentSessionLogger, type TAutoCompactThreshold, type TAutoModeJudgement, type TDecodedSessionLogEntry, TOTAL_BLOCK_LIMIT, type TPermissionDenialReason, type TPermissionHandler, type TPermissionRequester, type TPermissionResult, type TScrubbableValue, type TSessionExecutionResult, type TSessionLogData, type TSessionLogDecodeErrorCode, type TSessionLogEventName, type TSessionLogPayloadResolutionErrorCode, type TSessionLogValue, type TSessionRecordDecodeOutcome, type TSessionRecoverableResumeOptions, type TSessionResumeOptions, type TToolResultSpillErrorCode, ToolResultSpillError, TurnClaim, assertSafeSessionId, consentScopeFor, createSessionLogExternalPayloadReference, decodeInteractiveSessionRecord, decodeSessionLogEntries, decodeVersionedInteractiveSessionRecord, deserializeSessionArtifact, formatConversationEntries, isSafeSessionId, isSensitiveKey, isSessionLogEvent, loadSessionLogEntries, parsePromptHistoryLine, replaySessionLogEntries, resolveSessionLogExternalPayloads, scrubSensitiveKeys, serializeSessionArtifact, validateSessionReplayLogEntries };
 //# sourceMappingURL=index.d.cts.map