@sayknow-cli/coding-agent 0.4.7 → 0.5.0

package/dist/types/session/memory-guard-checkpoint-participant.d.ts

@@ -0,0 +1,69 @@
+import type { RecoveryFsRoot } from "@sayknow-cli/natives";
+import type { RecoveryHydrationContext, ResumeSessionIdentity, SessionDestinationInput, SessionManager, SessionManagerCheckpointRevisionStrings, StrictSessionOpenFailure } from "./session-manager";
+export interface MemoryGuardTranscriptDescriptorV1 {
+    bytes: string;
+    relative_path: string;
+    sha256: string;
+}
+export interface MemoryGuardCheckpointBlobAuthorityV1 {
+    kind: "checkpoint_blob_tree_v1";
+    manifest_relative_path: string;
+    manifest_sha256: string;
+    root_relative_path: string;
+}
+export interface MemoryGuardCheckpointBlobManifestEntryV1 {
+    bytes: string;
+    relative_path: string;
+    sha256: string;
+}
+export interface MemoryGuardCheckpointBlobManifestV1 {
+    entries: MemoryGuardCheckpointBlobManifestEntryV1[];
+    schema_version: 1;
+}
+export interface MemoryGuardSessionManagerCheckpointV1 {
+    blob_authority: MemoryGuardCheckpointBlobAuthorityV1;
+    revisions: SessionManagerCheckpointRevisionStrings;
+    schema_version: 1;
+    session_id: string;
+    session_name: string | null;
+    transcript: MemoryGuardTranscriptDescriptorV1;
+}
+export interface MemoryGuardParticipantDescriptorV1 {
+    ordinal: number;
+    checkpoint: MemoryGuardCheckpointBlobAuthorityV1;
+    revisions: SessionManagerCheckpointRevisionStrings;
+    session_id: string;
+    session_name: string | null;
+    transcript: MemoryGuardTranscriptDescriptorV1;
+}
+export interface MemoryGuardParticipantIngressLease {
+    readonly token: symbol;
+    release(): void;
+}
+export interface MemoryGuardCreateCheckpointInput {
+    ingressLease: MemoryGuardParticipantIngressLease;
+    checkpointRoot: string;
+}
+export type MemoryGuardRestoreBlockedReason = StrictSessionOpenFailure["reason"] | "checkpoint-mismatch" | "participant-mismatch" | "transcript-mismatch" | "blob-manifest-mismatch" | "blob-missing" | "blob-hash-mismatch" | "blob-authority-mismatch" | "destination-unavailable";
+export interface MemoryGuardRestoreInput {
+    incidentAuthority: RecoveryFsRoot;
+    participant: MemoryGuardParticipantDescriptorV1;
+    checkpoint: MemoryGuardSessionManagerCheckpointV1;
+    destination: SessionDestinationInput;
+}
+export type MemoryGuardRestoreResult = {
+    kind: "staged";
+    manager: SessionManager;
+    hydrationContext: RecoveryHydrationContext;
+    transcriptIdentity: ResumeSessionIdentity;
+    cleanup: () => Promise<void>;
+} | {
+    kind: "blocked";
+    reason: MemoryGuardRestoreBlockedReason;
+};
+export declare function memoryGuardCanonicalJson(value: unknown): string;
+export declare function memoryGuardSha256Hex(value: Uint8Array | string): string;
+export declare function isMemoryGuardDecimalString(value: unknown): value is string;
+export declare function isMemoryGuardSha256Hex(value: unknown): value is string;
+export declare function isMemoryGuardRelativePath(value: unknown): value is string;
+export declare function hasOnlyKeys(value: Record<string, unknown>, allowed: readonly string[]): boolean;

package/dist/types/session/session-manager.d.ts

@@ -8,6 +8,7 @@ import { ArtifactManager } from "./artifacts";
 import { type BlobPutResult, BlobStore } from "./blob-store";
 import { type ManagedMigrationPolicy } from "./internal/managed-session-scope";
 import { type ManagedDirectoryRoot, ManagedSessionDescendantStore } from "./internal/managed-session-storage";
+import { type MemoryGuardCreateCheckpointInput, type MemoryGuardParticipantIngressLease, type MemoryGuardRestoreInput, type MemoryGuardRestoreResult, type MemoryGuardSessionManagerCheckpointV1 } from "./memory-guard-checkpoint-participant";
 import { type BashExecutionMessage, type CustomMessage, type FileMentionMessage, type HookMessage, type PythonExecutionMessage } from "./messages";
 import { type SessionManagerReadAccess, sessionManagerReadCapability } from "./session-manager-internal";
 import type { ManagedSessionSecurityContext, SessionStorage, SessionStorageStat, VerifiedSessionDeleteResult, VerifiedSessionDeleteTarget } from "./session-storage";
@@ -27,6 +28,13 @@ export interface NewSessionOptions {
     /** Skip flushing the current session and delete it instead of saving. */
     drop?: boolean;
 }
+/** Internal successor prepared without changing the manager's visible identity. */
+export interface PreparedNewSession {
+    readonly sessionId: string;
+    readonly sessionFile: string | undefined;
+    readonly artifactsDir: string | null;
+    readonly managedLegacyLocalMigrationSource: ManagedLegacyLocalMigrationSource | null;
+}
 export interface SessionEntryBase {
     type: string;
     id: string;
@@ -252,6 +260,21 @@ export type DefaultModelSelectionStage = {
     readonly tempPath: string | undefined;
     readonly persistsToExistingFile: boolean;
 };
+export interface SessionManagerRevisionSnapshot {
+    entry: number;
+    leaf: number;
+    headerExport: number;
+    label: number;
+    replayMetadata: number;
+}
+export interface SessionManagerCheckpointRevisionStrings {
+    entry: string;
+    leaf: string;
+    headerExport: string;
+    label: string;
+    replayMetadata: string;
+}
+export declare function toSessionManagerCheckpointRevisionStrings(snapshot: SessionManagerRevisionSnapshot): SessionManagerCheckpointRevisionStrings;
 export type DefaultModelSelectionPromotion = {
     readonly kind: "promoted";
 } | {
@@ -327,6 +350,9 @@ export declare class SessionMigrationPolicyError extends Error {
     readonly code = "legacy_migration_disabled";
     constructor();
 }
+export declare class SessionArtifactCapacityError extends Error {
+    constructor(message: string);
+}
 export type ResumeTailInspection = ResumeTailResumable | ResumeTailTerminal | ResumeTailError;
 export interface StrictSessionOpenSuccess {
     kind: "opened";
@@ -334,7 +360,8 @@ export interface StrictSessionOpenSuccess {
 }
 export interface StrictSessionOpenFailure {
     kind: "error";
-    reason: ResumeTailError["reason"] | "identity-mismatch" | "migration-required";
+    reason: ResumeTailError["reason"] | "identity-mismatch" | "migration-required" | "artifact_capacity_exceeded";
+    message?: string;
 }
 /** Exact transcript bytes and authority captured from one descriptor-bound read. */
 export interface CapturedSessionTranscriptSnapshot {
@@ -530,6 +557,10 @@ export declare function residentBlobSentinelForTests(kind: ResidentBlobKind, ref
 export declare function materializeResidentEntriesForPersistenceForTests<T>(entries: T[], textStore: BlobStore, imageStore?: BlobStore): T[];
 /** Get recent sessions for display in welcome screen */
 export declare function getRecentSessions(sessionDir: string, limit?: number, storage?: SessionStorage): Promise<RecentSessionInfo[]>;
+export declare function getRecentSessionDisplay(sessions: readonly SessionInfo[], limit?: number): Array<{
+    name: string;
+    timeAgo: string;
+}>;
 /**
  * Manages conversation sessions as append-only trees stored in JSONL files.
  *
@@ -553,7 +584,7 @@ export interface ResolvedSessionMatch {
     session: SessionInfo;
     scope: "local" | "global";
 }
-export declare function resolveResumableSession(sessionArg: string, cwd: string, sessionDir?: string, storage?: SessionStorage): Promise<ResolvedSessionMatch | undefined>;
+export declare function resolveResumableSession(sessionArg: string, cwd: string, sessionDir?: string, storage?: SessionStorage, managedAgentDir?: string): Promise<ResolvedSessionMatch | undefined>;
 interface SessionManagerStateSnapshot {
     sessionId: string;
     sessionName: string | undefined;
@@ -578,13 +609,7 @@ export declare class SessionManager {
      * revision contract). Tests assert the invalidation mapping through this;
      * future export/label-view caches key off their respective domains.
      */
-    revisionSnapshot(): {
-        entry: number;
-        leaf: number;
-        headerExport: number;
-        label: number;
-        replayMetadata: number;
-    };
+    revisionSnapshot(): SessionManagerRevisionSnapshot;
     /** Puts a binary blob into the blob store and returns the blob reference */
     putBlob(data: Buffer): Promise<BlobPutResult>;
     captureState(): SessionManagerStateSnapshot;
@@ -593,6 +618,33 @@ export declare class SessionManager {
     setSessionFile(sessionFile: string): Promise<void>;
     /** Start a new session. Closes any existing writer first. */
     newSession(options?: NewSessionOptions): Promise<string | undefined>;
+    /**
+     * Allocate a fresh successor without publishing it through the manager's public
+     * getters. The returned authority is deliberately immutable so readiness work
+     * can resolve local:// against the successor while the predecessor stays live.
+     * @internal
+     */
+    prepareNewSession(options?: NewSessionOptions): Promise<PreparedNewSession>;
+    /** Append a model selection to an unpublished successor. @internal */
+    appendPreparedModelChange(prepared: PreparedNewSession, model: string): string;
+    /** Append a thinking-level selection to an unpublished successor. @internal */
+    appendPreparedThinkingLevelChange(prepared: PreparedNewSession, thinkingLevel?: string): string;
+    /** Append a service-tier selection to an unpublished successor. @internal */
+    appendPreparedServiceTierChange(prepared: PreparedNewSession, serviceTier: ServiceTier | null): string;
+    /** Append a displayable custom message to an unpublished successor. @internal */
+    appendPreparedCustomMessageEntry<T = unknown>(prepared: PreparedNewSession, customType: string, content: string | (TextContent | ImageContent)[], display: boolean, details?: T, attribution?: MessageAttribution): string;
+    /** Persist an unpublished successor without adopting it. @internal */
+    ensurePreparedNewSessionOnDisk(prepared: PreparedNewSession): Promise<void>;
+    /** Build context from an unpublished successor without reading active manager state. @internal */
+    buildPreparedNewSessionContext(prepared: PreparedNewSession): SessionContext;
+    /** Prepare a forked successor without publishing it through public manager state. @internal */
+    prepareFork(): Promise<PreparedNewSession | undefined>;
+    /** Prepare a path-only branch successor without publishing it through public manager state. @internal */
+    prepareBranchedSession(leafId: string): Promise<PreparedNewSession>;
+    /** Publish a prepared successor synchronously after all readiness awaits succeed. @internal */
+    commitPreparedNewSession(prepared: PreparedNewSession): void;
+    /** Exact-discard only an uncommitted successor prepared by this manager. @internal */
+    discardPreparedNewSession(prepared: PreparedNewSession): Promise<void>;
     /** Tombstone and exact-delete managed transcripts, detaching the active transcript first. */
     dropSession(sessionPath: string): Promise<void>;
     /**
@@ -649,8 +701,12 @@ export declare class SessionManager {
     /** Get usage statistics across all assistant messages in the session. */
     getUsageStatistics(): UsageStatistics;
     getSessionDir(): string;
+    /** Lists picker candidates within this manager's captured destination authority. */
+    listForResumePickerReadOnly(): Promise<SessionInfo[]>;
     getSessionId(): string;
     getSessionFile(): string | undefined;
+    acquireMemoryGuardParticipantIngressLease(): MemoryGuardParticipantIngressLease;
+    createMemoryGuardCheckpoint(input: MemoryGuardCreateCheckpointInput): Promise<MemoryGuardSessionManagerCheckpointV1>;
     /**
      * Returns the session artifacts directory path (session file path without .jsonl).
      * Returns null when the session is not persisted to a file.
@@ -707,11 +763,6 @@ export declare class SessionManager {
     /** The source that set the session name: "user" (manual /rename or RPC) or "auto" (generated title). */
     get titleSource(): "auto" | "user" | undefined;
     getSessionName(): string | undefined;
-    /**
-     * Set the session display name.
-     * @param source - "user" for explicit renames (/rename command, RPC); "auto" for generated titles.
-     *   Auto-generated titles are silently ignored when the user has already set a name.
-     */
     setSessionName(name: string, source?: "auto" | "user"): Promise<boolean>;
     _persist(entry: SessionEntry): void;
     /** Append a configured fallback chain as child of current leaf, then advance leaf. Returns entry id. */
@@ -901,8 +952,12 @@ export declare class SessionManager {
     static managedDestination(cwd: string, agentDir?: string, storage?: SessionStorage): SessionDestination;
     static explicitDestination(directory: string): SessionDestination;
     static create(cwd: string, destinationInput?: SessionDestinationInput, storage?: SessionStorage): SessionManager;
+    /** Prepare a selected candidate using this manager's captured managed destination authority. */
+    prepareManagedCandidateForWrite(filePath: string, migrationPolicy: SessionDirectoryMigrationPolicy, expectedIdentity?: ResumeSessionIdentity): Promise<string>;
+    /** Prepare a managed candidate and retain its exact post-preparation identity for the next adoption. */
+    prepareManagedCandidateForStrictAdoption(filePath: string, migrationPolicy: SessionDirectoryMigrationPolicy, expectedIdentity: ResumeSessionIdentity): Promise<string>;
     /** Resolve a default-managed candidate through binding validation and copy-retain migration before mutation. */
-    static prepareManagedCandidateForWrite(filePath: string, migrationPolicy: SessionDirectoryMigrationPolicy): Promise<string>;
+    static prepareManagedCandidateForWrite(filePath: string, migrationPolicy: SessionDirectoryMigrationPolicy, destination: SessionDestination, expectedIdentity?: ResumeSessionIdentity): Promise<string>;
     /**
      * Fork a session into the current project directory.
      * Copies history from another session file while creating a new session file in the current sessionDir.
@@ -916,10 +971,18 @@ export declare class SessionManager {
     static open(filePath: string, destinationInput?: SessionDestinationInput, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy): Promise<SessionManager>;
     static openNestedManaged(filePath: string, destination: SessionDestination, store: ManagedSessionDescendantStore, storage?: SessionStorage): Promise<SessionManager>;
     /**
-     * List sessions for the resume picker without recovery or other maintenance writes.
+     * List default-managed sessions for the resume picker without recovery or other
+     * maintenance writes. This is the only picker inventory that includes legacy
+     * sibling directories.
+     */
+    static listManagedForResumePickerReadOnly(cwd: string, managedAgentDir?: string, storage?: SessionStorage): Promise<SessionInfo[]>;
+    /**
+     * List sessions from an explicitly supplied picker directory without recovery
+     * or other maintenance writes. Unlike managed inventory, this never scans
+     * legacy sibling directories.
      */
     static listForResumePickerReadOnly(cwd: string, sessionDir?: string, storage?: SessionStorage): Promise<SessionInfo[]>;
-    /** Tombstone and exact-delete a default-managed candidate. */
+    /** Delete an authorized managed or project-local picker candidate. */
     static deleteManagedCandidate(sessionPath: string): Promise<void>;
     /** Capture exact source content for a strict fork without granting write ownership. */
     static captureTranscriptStrict(filePath: string, storage?: SessionStorage): StrictSessionCaptureResult;
@@ -929,6 +992,7 @@ export declare class SessionManager {
      * persistence; destination history always comes from the captured bytes.
      */
     static forkFromCaptured(snapshot: CapturedSessionTranscriptSnapshot, cwd: string, destinationInput?: SessionDestinationInput, _migrationPolicy?: SessionDirectoryMigrationPolicy): Promise<StrictSessionForkResult>;
+    static restoreMemoryGuardCheckpoint(input: MemoryGuardRestoreInput): Promise<MemoryGuardRestoreResult>;
     /** Inspect a selected session without acquiring write-capable ownership. */
     static inspectSessionTailReadOnly(filePath: string, storage?: SessionStorage): Promise<ResumeTailInspection>;
     /**
@@ -966,7 +1030,13 @@ export declare class SessionManager {
     /**
      * List all sessions across all project directories.
      */
-    static listAll(storage?: SessionStorage): Promise<SessionInfo[]>;
+    static listAll(storage?: SessionStorage, managedAgentDir?: string): Promise<SessionInfo[]>;
+    /**
+     * Strict inventory bound to this manager's captured session authority. Managed
+     * managers include authorized legacy and current candidates; explicit managers
+     * authorize only their exact directory.
+     */
+    inventorySessionsStrict(): StrictInventoryResult;
     /**
      * Strict raw scoped inventory for ACP authorization. Enumerates the scoped
      * session directory without suppressing any root/scan/lstat/read/parse/stat/
@@ -977,6 +1047,7 @@ export declare class SessionManager {
     static inventorySessionsStrict(cwd: string, options?: {
         sessionDir?: string;
         storage?: SessionStorage;
+        destination?: SessionDestination;
     }): StrictInventoryResult;
     /**
      * Propagate the storage-layer verified hard delete bound to exact identity evidence.

package/dist/types/session/session-storage.d.ts

@@ -112,6 +112,11 @@ export interface SessionStorage {
     readSnapshotSync?(path: string): SessionStorageSnapshot;
     statSync(path: string): SessionStorageStat;
     listFilesSync(dir: string, pattern: string): string[];
+    /** List matching files with mtimes without issuing one JavaScript stat call per path. */
+    listFilesByMtime?(dir: string, pattern: string): Promise<Array<{
+        path: string;
+        mtimeMs: number;
+    }>>;
     /**
      * Strict directory scan that never suppresses scan/root errors. Used by strict
      * authorization inventory; the forgiving {@link listFilesSync} stays display-only.
@@ -184,6 +189,18 @@ export interface VerifiedSessionDeleteTarget {
     detachedArtifactsPath?: string;
     /** Identity-bound quarantine path retained when transcript unlink deferred cleanup. */
     detachedTranscriptPath?: string;
+    /** Native-retained publisher successor observed during transcript cleanup. */
+    retainedTranscriptSuccessorPath?: string;
+    /** Native-retained exchange placeholder observed during transcript cleanup. */
+    retainedTranscriptPlaceholderPath?: string;
+    /** Native-retained transcript entry whose identity could not be verified. */
+    retainedTranscriptUnknownPath?: string;
+    /** Native-retained publisher successor observed during cleanup. */
+    retainedArtifactsSuccessorPath?: string;
+    /** Native-retained exchange placeholder observed during cleanup. */
+    retainedArtifactsPlaceholderPath?: string;
+    /** Native-retained entry whose identity could not be verified. */
+    retainedArtifactsUnknownPath?: string;
     /** Caller-published, no-replace quarantine pathname for the next artifact detach. */
     plannedArtifactsPath?: string;
     /** Caller-published, no-replace quarantine pathname for the next transcript detach. */
@@ -215,6 +232,9 @@ export type VerifiedSessionDeleteResult = {
     artifactsTree: NativeDirectoryTreeSnapshot;
     /** Transcript identity (unchanged) for retry binding. */
     transcriptIdentity: SessionStorageFileIdentity;
+    retainedSuccessorPath?: string;
+    retainedPlaceholderPath?: string;
+    retainedUnknownPath?: string;
 } | {
     kind: "cleanup_pending";
     phase: "transcript";
@@ -223,6 +243,9 @@ export type VerifiedSessionDeleteResult = {
     transcriptIdentity: SessionStorageFileIdentity;
     /** Optional identity-bound transcript quarantine path for restart cleanup. */
     detachedTranscriptPath?: string;
+    retainedSuccessorPath?: string;
+    retainedPlaceholderPath?: string;
+    retainedUnknownPath?: string;
 };
 type NativeDirectoryTreeEntry = {
     relativePath: string;
@@ -249,6 +272,10 @@ export declare class FileSessionStorage implements SessionStorage {
     readSnapshotSync(fpath: string): SessionStorageSnapshot;
     statSync(path: string): SessionStorageStat;
     listFilesSync(dir: string, pattern: string): string[];
+    listFilesByMtime(dir: string, pattern: string): Promise<Array<{
+        path: string;
+        mtimeMs: number;
+    }>>;
     listFilesStrictSync(dir: string, pattern: string): string[];
     exists(path: string): Promise<boolean>;
     readText(path: string): Promise<string>;
@@ -281,6 +308,10 @@ export declare class MemorySessionStorage implements SessionStorage {
     readSnapshotSync(path: string): SessionStorageSnapshot;
     statSync(path: string): SessionStorageStat;
     listFilesSync(dir: string, pattern: string): string[];
+    listFilesByMtime(dir: string, pattern: string): Promise<Array<{
+        path: string;
+        mtimeMs: number;
+    }>>;
     listFilesStrictSync(dir: string, pattern: string): string[];
     exists(path: string): Promise<boolean>;
     readText(path: string): Promise<string>;

package/dist/types/session/streaming-output.d.ts

@@ -83,7 +83,10 @@ export interface TruncationResult {
     elidedLines?: number;
     lastLinePartial?: boolean;
     firstLineExceedsLimit?: boolean;
+    lastLineExceedsLimit?: boolean;
 }
+/** Direction vocabulary used by callers that select which end of content to retain. */
+export type TruncationDirection = "head" | "last" | "both";
 export interface TruncationOptions {
     /** Maximum number of lines (default: 3000) */
     maxLines?: number;
@@ -99,6 +102,8 @@ export interface TruncationOptions {
      * window receives `maxLines - maxHeadLines`. Default `floor(maxLines/2)`.
      */
     maxHeadLines?: number;
+    /** Direction to dispatch through truncateContent (head, last, or both). */
+    direction?: TruncationDirection;
 }
 /** Result from byte-level truncation helpers. */
 export interface ByteTruncationResult {
@@ -155,14 +160,64 @@ export declare function truncateTail(content: string, options?: TruncationOption
  */
 export declare function formatMiddleElisionMarker(elidedLines: number, elidedBytes: number): string;
 /**
- * Truncate content keeping a head window and a tail window, eliding the middle.
+ * A retained source segment returned by {@link truncateMiddleWindows}.
+ * Line coordinates are 1-indexed and inclusive.
+ */
+export type ReadSegment = {
+    kind: "lines";
+    content: string;
+    lines: number;
+    bytes: number;
+    origin: {
+        startLine: number;
+        endLine: number;
+    };
+    lastLinePartial: false;
+} | {
+    kind: "partial-line";
+    content: string;
+    lines: 1;
+    bytes: number;
+    origin: {
+        startLine: number;
+        endLine: number;
+    };
+    sourceLineBytes: number;
+    lastLinePartial: true;
+};
+/** The actual windows retained by middle truncation. */
+export interface ReadWindow {
+    kind: "full" | "head-only" | "tail-only" | "middle";
+    head?: ReadSegment;
+    tail?: ReadSegment;
+    overlap: "disjoint" | "adjacent" | "overlapping";
+    elidedLines: number;
+    elidedBytes: number;
+    totalLines: number;
+    totalBytes: number;
+    /** @deprecated Non-enumerable compatibility reason for older consumers. */
+    truncatedBy?: "lines" | "bytes" | "middle";
+}
+/**
+ * Truncate content while exposing the exact retained head/tail windows.
  *
- * The combined output is `<head>\n<marker>\n<tail>` when truncation is needed.
- * `maxHeadBytes` defaults to `floor(maxBytes / 2)`; the tail receives the
- * remainder. Falls back to `truncateTail` / `truncateHead` if either side's
- * budget is empty or the content already fits.
+ * The budget split and fallback ordering intentionally mirror truncateMiddle.
+ * The overlap classification is performed before resolving an overlap to a
+ * full window, so callers can distinguish disjoint, adjacent and overlapping
+ * candidate windows even when no marker is needed.
+ */
+export declare function truncateMiddleWindows(content: string, options?: TruncationOptions): ReadWindow;
+/**
+ * Truncate content keeping a head window and a tail window, eliding the middle.
+ * The composed return shape remains field-for-field compatible with the
+ * historical implementation; callers that need coordinates use
+ * truncateMiddleWindows directly.
  */
 export declare function truncateMiddle(content: string, options?: TruncationOptions): TruncationResult;
+/**
+ * Dispatch truncation using the caller-facing direction vocabulary.
+ */
+export declare function truncateContent(content: string, options?: TruncationOptions): TruncationResult;
 export declare class TailBuffer {
     #private;
     readonly maxBytes: number;

package/dist/types/setup/credential-import.d.ts

@@ -73,7 +73,11 @@ export declare function discoverExternalCredentials(options?: DiscoveryOptions):
 export declare function formatCredentialSummary(credential: ImportableCredential): string;
 /** Redacted summary lines for an entire discovery result. Never includes secrets. */
 export declare function formatDiscoverySummary(result: CredentialDiscoveryResult): string[];
-export declare function isAutoImportOAuthCredential(credential: ImportableCredential): boolean;
+/** Reason shown when automatic OAuth import rejects an unusable discovery record. */
+export declare const INVALID_AUTO_IMPORT_OAUTH_EXPIRY_REASON = "OAuth credential has no valid future expiry";
+export declare function isAutoImportOAuthCredential(credential: ImportableCredential, now?: number): boolean;
+/** Keep rejected OAuth discoveries visible to operators without offering them for automatic import. */
+export declare function getAutoImportOAuthCredentialSkips(credentials: readonly ImportableCredential[], now?: number): SkippedCredential[];
 export declare function filterAutoImportOAuthCredentials(credentials: readonly ImportableCredential[]): ImportableCredential[];
 /**
  * Persist discovered credentials via `upsert`. Each credential is imported

package/dist/types/setup/provider-onboarding.d.ts

@@ -37,6 +37,7 @@ interface ProviderPreset {
     baseUrl: string;
     apiKeyEnv: string;
     models: readonly string[];
+    modelApi?: Readonly<Record<string, ProviderSetupApi>>;
     compat?: ProviderCompatConfig;
 }
 export declare const PROVIDER_PRESETS: readonly ProviderPreset[];
@@ -47,6 +48,7 @@ export declare function findProviderPreset(value: string | undefined): ProviderP
 export declare function formatProviderPresetList(): string;
 export declare function parseModelList(values: readonly string[]): string[];
 export declare function redactSecret(secret: string): string;
+export declare function validateModelApi(modelApi: Readonly<Record<string, string>> | undefined, models: readonly string[], presetId: string): void;
 export declare function addApiCompatibleProvider(input: ProviderSetupInput): Promise<ProviderSetupResult>;
 export declare function formatProviderSetupResult(result: ProviderSetupResult): string;
 export {};

package/dist/types/skc-runtime/deep-interview-runtime.d.ts

@@ -4,7 +4,7 @@ export * from "./deep-interview-recorder";
  *
  * The CLI itself does not run the Socratic interview; that lives inside the `/skill:deep-interview`
  * skill executed by the agent. This handler validates the documented argument-hint surface
- * (`[--quick|--standard|--deep] <idea>`), seeds `.skc/state/deep-interview-state.json`, and
+ * (`[--trace] [--quick|--standard|--deep] <idea>`), seeds `.skc/state/deep-interview-state.json`, and
  * updates the shared HUD rail via `syncSkillActiveState` so the active interview is visible to
  * the TUI.
  */

package/dist/types/skc-runtime/deep-interview-stage.d.ts

@@ -0,0 +1,37 @@
+import { CommandError } from "./workflow-cli-common";
+export declare const DEEP_INTERVIEW_STAGE_TRANSITIONS: readonly ["initialize-context", "record-round", "update-facts", "merge-state"];
+export type DeepInterviewStageTransition = (typeof DEEP_INTERVIEW_STAGE_TRANSITIONS)[number];
+declare const DRAFT_VERSION = 1;
+export type DeepInterviewStageErrorCode = "DI_STAGE_USAGE" | "DI_STAGE_INPUT_INVALID" | "DI_STAGE_SESSION_REQUIRED" | "DI_STAGE_DRAFT_EXISTS" | "DI_STAGE_NO_DRAFT" | "DI_STAGE_DRAFT_CORRUPT" | "DI_STAGE_STATE_MISSING" | "DI_STAGE_STATE_CORRUPT" | "DI_STAGE_REVISION_CONFLICT" | "DI_STAGE_MERGE_REJECTED";
+export declare class DeepInterviewStageError extends CommandError {
+    readonly code: DeepInterviewStageErrorCode;
+    readonly recovery?: string | undefined;
+    constructor(code: DeepInterviewStageErrorCode, message: string, recovery?: string | undefined);
+}
+export interface DeepInterviewStageDraft {
+    version: typeof DRAFT_VERSION;
+    draft_id: string;
+    session_id: string;
+    transition: DeepInterviewStageTransition;
+    /** State revision the draft was staged against; `apply` CAS-checks this. */
+    staged_against_revision: number;
+    /**
+     * Canonical content SHA-256 of the state the draft was staged against. Revision
+     * alone cannot catch sanctioned writers that do not bump `state_revision`
+     * (seed/spec-persistence), so `apply` requires BOTH to match.
+     */
+    staged_against_sha256: string;
+    payload: Record<string, unknown>;
+    created_at: string;
+}
+export interface DeepInterviewStageCommandResult {
+    status: number;
+    stdout?: string;
+    stderr?: string;
+}
+export declare function deepInterviewDraftPath(cwd: string, sessionId: string): string;
+export declare const DEEP_INTERVIEW_STAGE_VERBS: readonly ["stage", "check", "apply", "discard", "read", "write", "clear", "handoff"];
+export type DeepInterviewStageVerb = (typeof DEEP_INTERVIEW_STAGE_VERBS)[number];
+export declare function isDeepInterviewStageVerb(value: string | undefined): value is DeepInterviewStageVerb;
+export declare function runDeepInterviewStageCommand(verb: DeepInterviewStageVerb, args: readonly string[], cwd?: string): Promise<DeepInterviewStageCommandResult>;
+export {};

package/dist/types/skc-runtime/gc-runtime.d.ts

@@ -12,7 +12,7 @@
  *   error all mean KEEP — a live process is never signalled or killed.
  * - Dry-run by default: nothing is deleted unless `--prune`/`--force`.
  */
-export type GcStore = "harness_leases" | "team_workers" | "file_locks" | "tmux_sessions" | "registry_entries";
+export type GcStore = "harness_leases" | "team_workers" | "file_locks" | "tmux_sessions" | "registry_entries" | "local_roots";
 export declare const GC_STORES: readonly GcStore[];
 /** Why a probed pid is kept instead of treated as dead. */
 export type GcPidKeepReason = "alive" | "eperm" | "unknown";

package/dist/types/skc-runtime/linux-proc.d.ts

@@ -1,29 +1,37 @@
 /**
- * Shared helpers for reading Linux `/proc/<pid>/stat` process start time.
+ * Shared helpers for reading Linux `/proc/<pid>/stat` process identity fields.
  *
  * The `comm` field (field 2, wrapped in parentheses) may itself contain spaces
  * and parentheses, so the only robust anchor is the *last* `)` in the stat
  * string. Field 22 (the process start time in clock ticks since boot) is the
- * 20th whitespace-separated token after that closing paren (index 19).
- *
- * Every caller previously parsed this format independently, with subtly
- * different failure handling. This module fails closed: any malformed input
- * (missing `)`, non-numeric field 22, unreadable `/proc` file, non-Linux
- * platform) yields `null` rather than an inconsistent sentinel.
- */
-/**
- * Parse field 22 (process start time, in clock ticks since boot) from one
- * `/proc/<pid>/stat` record. Returns the raw numeric token, or `null` when the
- * record shape is malformed or field 22 is absent/non-numeric.
+ * 20th whitespace-separated token after that closing paren (index 19). Field 7
+ * (`tty_nr`) is the 5th token after the closing paren (index 4).
  */
+export interface LinuxProcStatIdentity {
+    startTime: string;
+    ttyDevice: string;
+}
+export type LinuxProcPidProbeResult = ({
+    kind: "live";
+} & LinuxProcStatIdentity) | {
+    kind: "absent";
+} | {
+    kind: "unverifiable";
+    reason: "unsupported_platform" | "invalid_pid" | "permission_denied" | "read_error" | "malformed_stat";
+};
+/** Parse field 22 (start time) from a `/proc/<pid>/stat` record. */
 export declare function parseLinuxProcStartTime(stat: string | null | undefined): string | null;
+/** Parse field 7 (`tty_nr`) from a `/proc/<pid>/stat` record. */
+export declare function parseLinuxProcTtyDevice(stat: string | null | undefined): string | null;
+export declare function probeLinuxProcPidSync(pid: number): LinuxProcPidProbeResult;
+export declare function probeLinuxProcPid(pid: number): Promise<LinuxProcPidProbeResult>;
 /**
  * Read `/proc/<pid>/stat` synchronously and return the parsed start time.
- * Returns `null` on non-Linux platforms, unreadable files, or malformed input.
+ * Returns `null` when the probe is absent or unverifiable.
  */
 export declare function readLinuxProcStartTimeSync(pid: number): string | null;
 /**
  * Read `/proc/<pid>/stat` asynchronously and return the parsed start time.
- * Returns `null` on non-Linux platforms, unreadable files, or malformed input.
+ * Returns `null` when the probe is absent or unverifiable.
  */
 export declare function readLinuxProcStartTime(pid: number): Promise<string | null>;

package/dist/types/skc-runtime/memory-guard-owner-claims.d.ts

@@ -0,0 +1,47 @@
+import { type LinuxProcPidProbeResult } from "./linux-proc";
+declare const MEMORY_GUARD_CLAIM_RESOURCES: readonly ["writer", "tty"];
+type MemoryGuardClaimResource = (typeof MEMORY_GUARD_CLAIM_RESOURCES)[number];
+export interface MemoryGuardClaimOwner {
+    sessionId: string;
+    generation: string;
+    runId: string;
+    childToken: string;
+    pid: number;
+    processStartTime: string;
+    ttyDevice: string;
+}
+export interface MemoryGuardClaimsLease {
+    writerEpoch: number;
+    ttyEpoch: number;
+    owner: MemoryGuardClaimOwner;
+    claimStorePath: string;
+}
+export declare function isMemoryGuardClaimsLease(value: unknown): value is MemoryGuardClaimsLease;
+export declare function isMemoryGuardClaimsLeaseForStateDir(value: unknown, stateDir: string): value is MemoryGuardClaimsLease;
+export type MemoryGuardClaimsReleasedProof = MemoryGuardClaimsLease;
+interface PersistedMemoryGuardClaimRow {
+    resource: MemoryGuardClaimResource;
+    epoch: number;
+    session_id: string;
+    generation: string;
+    run_id: string;
+    child_token: string;
+    pid: number;
+    process_start_time: string;
+    tty_device: string;
+    acquired_at: string;
+}
+export interface MemoryGuardOwnerClaimsDeps {
+    probePid(pid: number): Promise<LinuxProcPidProbeResult>;
+    now(): string;
+}
+export declare function memoryGuardClaimsDatabaseFile(stateDir: string, sessionId: string): string;
+export declare function acquireMemoryGuardClaims(stateDir: string, owner: MemoryGuardClaimOwner, deps?: MemoryGuardOwnerClaimsDeps): Promise<MemoryGuardClaimsLease>;
+export declare function releaseMemoryGuardClaims(stateDir: string, claim: MemoryGuardClaimsLease): Promise<void>;
+export declare function probeMemoryGuardClaimsReleased(stateDir: string, owner: MemoryGuardClaimOwner, deps?: MemoryGuardOwnerClaimsDeps): Promise<MemoryGuardClaimsReleasedProof>;
+export interface PersistedMemoryGuardClaimsSnapshot {
+    epoch: number;
+    claims: PersistedMemoryGuardClaimRow[];
+}
+export declare function readMemoryGuardClaimsForTest(stateDir: string, sessionId: string): Promise<PersistedMemoryGuardClaimsSnapshot>;
+export {};