@sema-agent/core 5.65.0 → 7.0.0

package/dist/engine/harness/agent-harness.d.ts

@@ -264,9 +264,12 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
     private handleAgentEvent;
     private emitRunFailure;
     private executeTurn;
+    /** Returns the run's final assistant message — or `undefined` on exactly one arm (#504): a bare
+     *  user halt ({@link halt}) stopped the run before any assistant output existed. Every other
+     *  zero-assistant ending still throws (see the executeTurn tail). */
     prompt(text: string, options?: {
         images?: ImageContent[];
-    } & UserMessageProvenance): Promise<AssistantMessage>;
+    } & UserMessageProvenance): Promise<AssistantMessage | undefined>;
     /** R2-③: an empty/whitespace-only injection with no images carries ZERO information — it
      *  must not mint a user frame (strict endpoints reject empty user content, and an empty follow-up would
      *  pointlessly extend the run by one turn). No-op, not a throw: injection callers are fire-and-
@@ -315,6 +318,54 @@ export declare class AgentHarness<TSkill extends Skill = Skill, TPromptTemplate
      *    turn — later immediates join the same boundary batch).
      */
     interruptTurn(frame: AgentMessage): boolean;
+    /**
+     * design/373 (#504) — the BARE user interrupt, the CC Esc form: CUT the in-flight turn (when one
+     * is in flight) and STOP the run at that manufactured boundary — no new model turn starts, the
+     * run collects to a clean, resumable ending (never the orphan-[INTERRUPTED] run-abort reconcile).
+     * The run-model equivalent of "the session stays alive waiting for the user's next input".
+     *
+     * Two halves, one call:
+     *  - STOP — the one-way `requestStopAfterTurn` latch, now consulted at BOTH boundary faces
+     *    (post-turn `shouldStopAfterTurn` and #504's pre-turn `shouldHaltBeforeTurn`), so the loop
+     *    ends at whichever boundary comes first and never starts another provider request;
+     *  - CUT — the design/373 S1 turn seat, aborted WITHOUT the frame-consumption guard: unlike
+     *    {@link interruptTurn} (an accelerator FOR a queued immediate frame, guarded so it can never
+     *    cut the delivery it exists to speed up), a bare halt is not delivering anything — there is
+     *    no frame whose consumption could make the cut self-defeating, so the seat's own liveness is
+     *    the only guard. The cut settles exactly as every S1 cut does: finished tool calls keep
+     *    their REAL results, never-started ones settle as paired interrupted results, the
+     *    CC-verbatim interruption marker lands.
+     *
+     * Returns `{ turnCut, accepted }` — `turnCut` `true` iff THIS call aborted a live turn seat (an
+     * in-flight provider stream / tool batch will settle as interrupted; the completion-race arm is
+     * honest: a turn whose work already finished when the abort landed ends normally and the run
+     * still stops at its boundary). `false` = nothing was in flight (between turns / boundary
+     * housekeeping / a boundary already being manufactured) — the stop half alone answers, at the
+     * imminent boundary. `accepted` (#504 codex r3) is the ATOMIC ownership bit: `true` iff this
+     * call latched the stop on a run whose harness-channel abort had NOT already fired — captured
+     * BEFORE the seat abort dispatches, so a re-entrant abort fired by the cut's own listeners can
+     * never rewrite the answer. The unwinding arm answers `{ turnCut:false, accepted:false }`: an
+     * abort-owned ending is never this verb's claim (the runner's attribution seat keys on it).
+     *
+     * Guards, in order (the interruptTurn discipline, minus the frame guard):
+     *  - idle ⇒ typed refusal (the steer posture — misuse must be loud; the runner's birth-window
+     *    poll owns the not-yet-started arm);
+     *  - an unwinding run (`abort()` latched) owns its ending — never contest it, and never latch a
+     *    stale stop onto a harness a later `prompt()` would inherit... (the latch is per-prompt
+     *    reset, but the honest answer while unwinding is still "nothing for this verb to do");
+     *  - stop latch, THEN seat: latch-before-abort ordering is load-bearing — the cut's settlement
+     *    consults the latch at its own boundary, so the stop is provably in place when the forced
+     *    boundary arrives (the enqueue-then-abort discipline, one lane over).
+     *
+     * Queued injection frames are deliberately NOT touched (CC 2.1.223 `control_request:"interrupt"`
+     * keeps the queue and answers `still_queued` — see {@link abort}'s recorded ruling): whatever
+     * the queues hold settles by the run's ordinary terminal contract for accepted-but-undelivered
+     * input (durable park when a suspend seat exists, else the loud undrained accounts).
+     */
+    halt(): {
+        turnCut: boolean;
+        accepted: boolean;
+    };
     /**
      * design/373 §3.3 (the final-commit-point double check) — how many queued injection frames a
      * boundary drain could deliver RIGHT NOW: both lanes, minus frames the current state refuses to

package/dist/engine/harness/agent-harness.js

@@ -1,4 +1,4 @@
-import { snapshotActorAssertion, stripEngineMetadata } from "../llm/index.js";
+import { createAssistantMessageEventStream, snapshotActorAssertion, stripEngineMetadata } from "../llm/index.js";
 import { runAgentLoop } from "../loop/agent-loop.js";
 import { resolveAgentCoreStreamFn } from "../loop/runtime-deps.js";
 import { normalizeEngineSegments } from "../../core/untrusted-text.js";
@@ -456,6 +456,25 @@ export class AgentHarness {
                 headers: mergeHeaders(dropAuthCarriers(turnState.streamOptions.headers), auth?.headers),
             };
             const requestOptions = await this.emitBeforeProviderRequest(model, turnState.sessionId, snapshotOptions);
+            if (streamOptions?.signal?.aborted) {
+                const out = createAssistantMessageEventStream();
+                out.push({
+                    type: "error",
+                    reason: "aborted",
+                    error: {
+                        role: "assistant",
+                        content: [{ type: "text", text: "" }],
+                        api: model.api,
+                        provider: model.provider,
+                        model: model.id,
+                        stopReason: "aborted",
+                        timestamp: Date.now(),
+                        usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } },
+                        usageMissing: true,
+                    },
+                });
+                return out;
+            }
             return resolveAgentCoreStreamFn(this.runtime)(model, context, {
                 ...(auth?.apiKey !== undefined ? { apiKey: auth.apiKey } : {}),
                 cacheRetention: requestOptions.cacheRetention,
@@ -564,6 +583,7 @@ export class AgentHarness {
                 : {}),
             convertToLlm: (messages) => stripEngineMetadata(convertToLlm(messages)),
             shouldStopAfterTurn: () => this._stopAfterTurn,
+            shouldHaltBeforeTurn: () => this._stopAfterTurn,
             transformContext: async (messages, signal) => {
                 const result = await this.emitHook({ type: "context", messages: [...messages], ...(signal !== undefined ? { signal } : {}) });
                 if (result?.adoptSessionRebuild !== true) {
@@ -820,6 +840,8 @@ export class AgentHarness {
                     return mergeTruncatedOutputChain(newMessages, i);
                 }
             }
+            if (this._stopAfterTurn)
+                return undefined;
             throw new AgentHarnessError("invalid_state", "AgentHarness prompt completed without an assistant message");
         }
         finally {
@@ -955,6 +977,19 @@ export class AgentHarness {
         seat.abort();
         return true;
     }
+    halt() {
+        if (this.phase === "idle") {
+            throw new AgentHarnessError("invalid_state", "Cannot halt while idle");
+        }
+        if (this.aborting)
+            return { turnCut: false, accepted: false };
+        this._stopAfterTurn = true;
+        const seat = this.turnInterruptSeat;
+        if (seat === undefined || seat.signal.aborted)
+            return { turnCut: false, accepted: true };
+        seat.abort();
+        return { turnCut: true, accepted: true };
+    }
     pendingInjectionCount() {
         if (this.aborting)
             return 0;

package/dist/engine/harness/types.d.ts

@@ -259,6 +259,17 @@ export interface FileInfo {
     size: number;
     /** Modification time as milliseconds since Unix epoch. */
     mtimeMs: number;
+    /**
+     * design/381 DV-8 — OPTIONAL POSIX permission bits of the addressed object (`mode & 0o7777`,
+     * symlinks not followed, like every other field here). Present only when the backend can express
+     * them: an env whose filesystem has no POSIX permission model, or a transport that does not carry
+     * them, OMITS the field rather than inventing a plausible number — a fabricated `0o644` is
+     * indistinguishable from a real one, and the rewind history would then "preserve" a mode the file
+     * never had. Absent ⇒ a consumer has nothing to preserve and says so
+     * ({@link import("../../core/file-history-store.js").FileHistoryRestoreResult.modeNotPreserved}),
+     * which is the honest degraded form.
+     */
+    mode?: number;
 }
 /** Options for {@link Shell.exec}. */
 export interface ExecutionEnvExecOptions {
@@ -360,6 +371,20 @@ export interface FileSystem {
     appendFile(path: string, content: string | Uint8Array, abortSignal?: AbortSignal): Promise<Result<void, FileError>>;
     /** Return metadata for the addressed path without following symlinks. */
     fileInfo(path: string, abortSignal?: AbortSignal): Promise<Result<FileInfo, FileError>>;
+    /**
+     * design/381 DV-8 — OPTIONAL companion of {@link FileInfo.mode}: set the addressed object's POSIX
+     * permission bits (`mode & 0o7777`), symlinks NOT followed (an env whose backend can only chmod
+     * through a link omits this method rather than following one — a restore must never re-permission
+     * a file it was pointed at by a link it did not verify).
+     *
+     * Optional in the same sense as {@link readLink}/{@link writeFileGuarded}: an env whose filesystem
+     * has no permission model, or whose transport cannot carry one, leaves this `undefined`. The
+     * caller then reports the mode as NOT preserved rather than silently dropping it — the whole point
+     * of the pair being optional is that "we could not keep the executable bit" is a fact somebody has
+     * to be able to read. An env that CAN express modes but is asked for one it cannot apply answers a
+     * typed {@link FileError}; the caller treats that exactly like absence (disclosed, never fatal).
+     */
+    setFileMode?(path: string, mode: number, abortSignal?: AbortSignal): Promise<Result<void, FileError>>;
     /** List direct children of a directory without following symlinks. */
     listDir(path: string, abortSignal?: AbortSignal): Promise<Result<FileInfo[], FileError>>;
     /** Return the canonical path for an existing path, resolving symlinks where supported. */
@@ -825,7 +850,7 @@ export interface SessionStorage<TMetadata extends SessionMetadata = SessionMetad
  * `windowTokens` arms a DEFENSIVE re-clamp of the compaction summary's retained invoked-skills
  * area against the CURRENT model's window (the area was budgeted at compaction time against the
  * model active THEN; a later, smaller-window model must not inherit an area that alone overflows
- * its window). `charsPerToken` is the structural coefficient for that clamp (default 4). Absent ⇒
+ * its window). `charsPerToken` is the structural coefficient for that clamp (default 3 since design/374 slice 4). Absent ⇒
  * legacy behavior, byte-identical context.
  */
 export interface BuildContextOptions {

package/dist/engine/llm/types.d.ts

@@ -387,6 +387,49 @@ export interface AssistantMessage {
     model: string;
     responseModel?: string;
     responseId?: string;
+    /**
+     * The provider's own REQUEST identifier for the attempt this message reports on, lifted from the
+     * response headers (`request-id` / `x-request-id`) and admitted only in a conservative identifier
+     * shape. It is the handle a provider's support channel asks for, and it is the ONLY field on an
+     * error message that can be correlated with the upstream's own records.
+     *
+     * IN-SCOPE / PRESENCE: stamped by the streaming engine on the terminal ERROR shell of a provider
+     * failure ({@link isApiErrorMessage}), and only when the failing attempt's response actually
+     * carried a readable header — a connect failure, a DNS refusal, or a provider that states no such
+     * header leaves it ABSENT. Absence is a fact ("no id was stated"), never a default; a consumer must
+     * not read it as "no request was made". Distinct from {@link responseId}, which is the provider's
+     * identifier for a RESPONSE BODY on the success path. Additive/optional throughout.
+     */
+    requestId?: string;
+    /**
+     * This assistant message WRAPS A PROVIDER FAILURE — the turn ended because the transport or the
+     * provider failed, not because the model or this engine decided something. Set from the brain
+     * error's minter-declared provider-boundary mark, so a DEPLOYMENT-side refusal that never reached
+     * the wire (a credential-pairing refusal, an inexpressible request) is deliberately NOT marked:
+     * the two need different operator responses and had no machine-readable difference before this seat
+     * (both arrive as `stopReason:"error"` with a `[code]` prefix, and `invalid_request` is minted by
+     * both). CC-anchored spelling (`isApiErrorMessage`).
+     *
+     * PRESENCE: `true` only on an errored message the engine minted for a provider/transport failure.
+     * ABSENT on success, on an aborted turn (a cancel is not a provider fault), on the circuit
+     * breaker's local fast-fail, and on the in-band terminal-output causes (`stream_torn` / `refusal` /
+     * `length_empty`), which are model-output problems rather than API failures. A consumer must not
+     * infer the negative from absence on messages minted by a custom Brain that does not stamp it.
+     */
+    isApiErrorMessage?: true;
+    /**
+     * The HTTP status of the failing provider response, when there WAS one. Only meaningful together
+     * with {@link isApiErrorMessage}.
+     *
+     * PRESENCE: present only when the provider answered with an error STATUS (the terminal HTTP throw).
+     * ABSENT — deliberately, not zeroed — for every failure that had no HTTP error status of its own: a
+     * connect failure or DNS refusal (no response at all), a connect/first-token/idle stall, a
+     * mid-stream tear (the response's own status was a success and reporting it here would name a
+     * status that failed nothing), and an in-band SSE error frame (delivered inside a 200). Same
+     * three-state discipline CC states for its own `api_error_status`; absence must never be rendered
+     * as `0`.
+     */
+    apiErrorStatus?: number;
     diagnostics?: AssistantMessageDiagnostic[];
     usage: Usage;
     /** TB 尸检 T1-5: the provider never delivered a usage frame for this message (e.g. a
@@ -788,10 +831,13 @@ export interface Model<TApi extends Api = Api> {
      * trimToBudget), cut-point accounting, the prompt-overhead term, and the summarization input guard.
      * API-agnostic model property (NOT a wire knob), hence top-level and not `compat`.
      *
-     * Default **4** (byte-compatible with the historical chars/4 heuristic; CC 198's legacy-family
-     * value — claude-3.x / opus·sonnet-4-x / haiku-4-5). Newer families tokenize denser (CC 198 uses
-     * **3** for the sonnet-5/fable-5 class). CJK-heavy deployments should consider **2–3**: chars/4
-     * underestimates Chinese by 60–75%, which lets the defenses pass over-window requests.
+     * Default **3** (design/374 slice 4, 2026-08-28; it was 4 before). CC's coefficient is a
+     * two-branch function `Z6.has(family) ? 4 : 3` whose table holds only the OLDER families
+     * (claude-3.x / opus-4-0·4-1·4-5·4-6 / sonnet-4-0·4-5·4-6 / haiku-4-5) — **3 is the default
+     * branch**, 4 is the whitelist hit, and CC's own opus-5/sonnet-5 generation is outside the table.
+     * Declare **4** explicitly for a model of that older generation. CJK-heavy deployments should
+     * consider **2**: even chars/3 underestimates Chinese, and an underestimate is what lets the
+     * defenses pass an over-window request.
      */
     charsPerToken?: number;
     maxTokens: number;

package/dist/engine/loop/agent-loop.d.ts

@@ -31,7 +31,11 @@ export type LoopTerminalReason =
  | "aborted_before_stream"
 /** The assistant message itself ended with stopReason "error" or "aborted". */
  | "assistant_error"
-/** `shouldStopAfterTurn` requested a clean stop at the turn boundary (mod #16 one-shot). */
+/** A clean stop was requested at a turn boundary (mod #16 one-shot): `shouldStopAfterTurn`
+ *  answered true after a turn, or — #504's pre-turn half — `shouldHaltBeforeTurn` refused to
+ *  start the next one. One reason for both consult points: the fact reported is the same (the
+ *  loop ended cleanly at a manufactured boundary, no reconcile owed), and which consult caught
+ *  it is timing, not semantics. */
  | "stop_requested"
 /** RB-206 (CC 220 counterpart @400176-400230, `Bxs` @397652-397674 buckets it
  *  with budget_exhausted/api_error/model_error/turn_setup_failed, explicitly NOT `"completed"`): every

package/dist/engine/loop/agent-loop.js

@@ -195,8 +195,16 @@ async function runSingleTurn(state, signal, emit, streamFn, runtime, trace) {
         await emit({ type: "agent_end", messages: state.newMessages });
         return { kind: "terminal", reason: "aborted_before_stream" };
     }
+    if (state.config.shouldHaltBeforeTurn?.() === true) {
+        await emit({ type: "agent_end", messages: state.newMessages });
+        return { kind: "terminal", reason: "stop_requested" };
+    }
     if (!state.firstTurn) {
         await emit({ type: "turn_start" });
+        if (state.config.shouldHaltBeforeTurn?.() === true) {
+            await emit({ type: "agent_end", messages: state.newMessages });
+            return { kind: "terminal", reason: "stop_requested" };
+        }
     }
     else {
         state.firstTurn = false;
@@ -580,6 +588,23 @@ async function streamAssistantResponse(context, config, signal, emit, streamFn,
     const resolvedApiKey = (config.getApiKey ? await config.getApiKey(config.model.provider) : undefined) || config.apiKey;
     const perCallMaxTokens = config.maxTokensPerCall?.();
     const perCallStallTimeouts = config.stallTimeoutsPerCall?.();
+    if (signal?.aborted) {
+        const abortedBeforeDispatch = {
+            role: "assistant",
+            content: [{ type: "text", text: "" }],
+            api: config.model.api,
+            provider: config.model.provider,
+            model: config.model.id,
+            stopReason: "aborted",
+            timestamp: Date.now(),
+            usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } },
+            usageMissing: true,
+        };
+        context.messages.push(abortedBeforeDispatch);
+        await emit({ type: "message_start", message: { ...abortedBeforeDispatch } });
+        await emit({ type: "message_end", message: abortedBeforeDispatch });
+        return abortedBeforeDispatch;
+    }
     const response = await streamFunction(config.model, llmContext, {
         ...config,
         ...(perCallMaxTokens !== undefined ? { maxTokens: perCallMaxTokens, maxTokensDynamic: true } : {}),

package/dist/engine/loop/types.d.ts

@@ -411,6 +411,25 @@ export interface AgentLoopConfig extends SimpleStreamOptions {
      * Contract: must not throw or reject. Throwing interrupts the low-level agent loop without producing a normal event sequence.
      */
     shouldStopAfterTurn?: (context: ShouldStopAfterTurnContext) => boolean | Promise<boolean>;
+    /**
+     * design/373 (#504) — the PRE-turn half of the clean-stop latch, consulted at the top of every
+     * turn BEFORE any provider work (and before `turn_start` for non-first turns). `true` ⇒ the loop
+     * emits `agent_end` and exits at this manufactured boundary instead of starting a new model turn
+     * (terminal reason `"stop_requested"`, the same clean stop the post-turn consult reports).
+     *
+     * It exists because `shouldStopAfterTurn`'s consult sits at the END of a turn: a stop requested
+     * while the loop is between its boundary consult and the next provider request (the drain-point
+     * awaits, the stop gate's await, the follow-up drain) used to buy one full extra model turn
+     * before being honored. The bare user-halt verb ("cut + stop", the CC Esc form) promises that no
+     * new model turn starts once the halt is accepted, so the latch must guard the turn that has NOT
+     * started — a context-carrying callback about the finished turn cannot.
+     *
+     * Contract: SYNCHRONOUS and side-effect-free (the `pendingInjectionCount` discipline). Frames
+     * already drained into the refused turn's pending batch are NOT injected (no message events); the
+     * host's in-flight accounting (`#389`) reports them through its own terminal account. Absent ⇒
+     * the pre-#504 behavior (only the post-turn consult stops the loop).
+     */
+    shouldHaltBeforeTurn?: () => boolean;
     /**
      * Called after `turn_end` and before the loop decides whether another provider request should start.
      * Return replacement context/model/thinking state to affect the next turn in this run.

package/dist/engine/lsp/node-lsp-manager.d.ts

@@ -124,7 +124,7 @@ export declare function languageFor(filePath: string): string | undefined;
 export { MAX_LSP_FILE_BYTES } from "../../core/lsp.js";
 /**
  * RB-232: the local default {@link LspReadText}, hardened with a stat-first precondition (CC
- * 2.1.220 validateInput does the same before ever reading — "Path is not a file", pretty220.js ~474700).
+ * 2.1.220 validateInput does the same before ever reading — "Path is not a file", (pretty220.js:474700, historical; not relocated in 250 — see cc-250 anchors)).
  * The stat check is the LOAD-BEARING part, do not "simplify" it away: a plain `readFile` on a FIFO/socket
  * blocks forever on the FIRST read and PINS a libuv threadpool thread (default pool = 4) for the process
  * lifetime — measured: `readFile(fifo, { signal })` with an abort fired at 2s was still unsettled at 10s,

package/dist/engine/session/session.js

@@ -2,7 +2,7 @@ import { asAgentMessage, createCompactionSummaryMessage, createCustomMessage, }
 import { SessionError, isValidModelChange, normalizeAnnouncedListing, normalizeCompactionStateCarrier, normalizeGitAnnouncement, normalizeReminderMark, normalizeWorkspaceState } from "../harness/types.js";
 import { normalizePromptEpoch } from "../../prompt-assembly/epoch.js";
 import { budgetInvokedSkillsRetention, readElidedMessages, readRetainedInvokedSkills, readUnsummarizedMessages, renderInvokedSkillsRetention, } from "../compaction/utils.js";
-const RETENTION_CLAMP_DEFAULT_CHARS_PER_TOKEN = 4;
+const RETENTION_CLAMP_DEFAULT_CHARS_PER_TOKEN = 3;
 const RETENTION_CLAMP_WINDOW_FRACTION = 0.5;
 export function buildSessionContext(pathEntries, opts) {
     let thinkingLevel = "off";

package/dist/index.d.ts

@@ -99,10 +99,18 @@ export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpo
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, type UsageWindow, type UsageWindowStore, type UsageWindowReading, type UsageWindowRecord, type UsageSlot, type UsageBucketRow, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
-export { InMemoryFileSnapshotStore, DEFAULT_SNAPSHOT_BOUNDS } from "./core/file-snapshot-store.js";
-export { captureManifest, applyManifest } from "./core/file-snapshot-store.js";
-export type { FileSnapshotStore, FileSnapshotResult, FileSnapshotError, FileSnapshotBounds } from "./core/file-snapshot-store.js";
-export { FileStorageBackend, FileSessionRepo, FileCheckpointStore, FileMemoryStore, FileToolResultStore, FileSessionPolicyStore, FileFileSnapshotStore, FileStrategyStore, FileWorkflowJournalStore, MAX_JOURNAL_RESULT_BYTES, oversizeJournalResult, resolveDataRoot, sanitizeScope, sanitizePathComponent, createFileConsolidationLock, atomicWriteFile, writeThenLink, ensureDir, readJsonlRecords, AppendLog, FileStoreLockError, type FileStoreLockErrorCode, type FileStorageBackendOptions, type FileStorageCorruptReadInfo, type FileStrategyStoreOptions, type FileSessionRepoOptions, type FileFileSnapshotStoreOptions, type FileCheckpointStoreOptions, } from "./stores/file/index.js";
+export { InMemoryFileHistoryStore, boundaryPublishVerdict } from "./core/file-history-store.js";
+export { captureFileBackupViaEnv, applyFileRestoreViaEnv } from "./core/file-history-store.js";
+export { modeProvenDifferent as fileHistoryModeProvenDifferent } from "./core/file-history-store.js";
+export { previewFileDelta as fileHistoryPreviewFileDelta, countRestoreLineDiff, FILE_HISTORY_DIFF_LINE_BUDGET } from "./core/file-history-store.js";
+export { worldStillMatchesMint } from "./core/file-history-store.js";
+export { trackKeyOf as fileHistoryTrackKeyOf, resolveTrackKey as fileHistoryResolveTrackKey } from "./core/file-history-store.js";
+export { describeTrackKey as fileHistoryDescribeTrackKey, trackKeyFamilyOf as fileHistoryKeyFamilyOf, fileHistoryExportDigest, validateFileHistoryExport } from "./core/file-history-store.js";
+export type { FileHistoryStore, FileHistoryResult, FileHistoryTrackResult, FileHistoryError, FileHistoryKeyFamily, FileHistoryTrackKeyDescriptor, FileHistoryRestoreResult, FileHistoryDiffStats, FileHistoryExport, FileBackupCapture, FileRestoreTarget, FileRestoreApplyOptions, FileRestoreApplyOutcome, FileHistoryTrackKeyResolution } from "./core/file-history-store.js";
+export type { InMemoryFileHistoryStoreOptions } from "./core/file-history-store.js";
+export { DEFAULT_FILE_HISTORY_BOUNDARY_KEEP, resolveFileHistoryRetention, fileHistoryBoundariesToKeep } from "./core/file-history-retention.js";
+export type { FileHistoryRetentionPolicy } from "./core/file-history-retention.js";
+export { FileStorageBackend, FileSessionRepo, FileCheckpointStore, FileMemoryStore, FileToolResultStore, FileSessionPolicyStore, FileStrategyStore, FileFileHistoryStore, FileWorkflowJournalStore, MAX_JOURNAL_RESULT_BYTES, oversizeJournalResult, resolveDataRoot, sanitizeScope, sanitizePathComponent, createFileConsolidationLock, atomicWriteFile, writeThenLink, ensureDir, readJsonlRecords, AppendLog, FileStoreLockError, type FileStoreLockErrorCode, type FileStorageBackendOptions, type FileStorageCorruptReadInfo, type FileStrategyStoreOptions, type FileFileHistoryStoreOptions, type FileSessionRepoOptions, type FileCheckpointStoreOptions, } from "./stores/file/index.js";
 export { CacheBreakDetector, type CacheBreakFinding, type ToolFingerprintInput } from "./core/cache-break-detector.js";
 export { maybeCompact, type MaybeCompactOptions, type CompactionWindowSafetyInfo } from "./core/auto-compaction.js";
 export { brainToRuntime } from "./core/runtime.js";
@@ -110,7 +118,7 @@ export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./cor
 export { createFsWriteGatePolicy, type FsWriteGatePolicyOptions } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, type TaskNotificationPayload, type TaskNotificationStatus, type ExternalNotificationInput, type SystemInjection, type SystemInjectionPriority, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, } from "./core/task-notification.js";
 export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, type SubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, type WiringManifest, type WiringFacts, type WiringLegKind, type AskSeamForm, type AskEffective, type QuestionChannelState, type SeamProvenance, type ParkLaneReason, type ManifestDurability, type StaticWiringDeps, type StaticWiringSpec, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, type ParkSelfCheckResult, type ParkProbeFinding, type ParkProbeFindingCode, } from "./core/park-selfcheck.js";
 export { type StoreDurability } from "./core/checkpoint-store.js";
@@ -140,6 +148,8 @@ export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, create
 export { parseAutoModeResponse, createAutoModeDecider, type AutoModeVerdict, type AutoModeDecider, type AutoModeDeciderOptions, type AutoModeClassifyFn, type AutoModeClassifyInput, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, type AutoModeRules, type BuildAutoModePromptOptions, type AutoModeWindowOptions, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
+export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, type AutoModeArmingRecipe, type AutoModeArmingFace, type AutoModeArmingFold, type AutoModeRebuildRefusal, } from "./core/auto-mode-arming.js";
+export { rebuildAutoModeDecider, type AutoModeClassifierCompletion, type AutoModeRebuildOptions, type AutoModeRebuildResult, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, type PermissionRule, type ParsedPermissionRule, type PermissionRuleIssue, type PermissionRuleCaps, type PermissionRulePolicyOptions, } from "./core/permission-rules.js";
 /**
  * design/179 — persisted ALLOW rules: the standing form of approvals a person already gave.
@@ -157,8 +167,9 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * allowed and widening is not.
  */
 export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedAllowRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedAllowRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, type PermissionRuleWriter, type WritablePermissionRuleStore, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
+export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, type PermissionRuleStore, type PermissionRuleStoreProvider, type StoredAllowRules, type RemoveResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritablePermissionRuleStore, type RuleWriteDelta, type RuleAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
+export { InMemorySessionRuleOverlay, type SessionRuleOverlay, type SessionRuleOverlayAdd, type SessionRuleOverlayApplyResult, } from "./core/permission-rule-session.js";
 export { createOrgRuleOverlay, orgRuleVerdictFor, effectivePermissionRules, orgRuleStatePersistenceOf, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRuleOverlay, type OrgOverlayResolution, type OrgOverlayStatus, type EffectivePermissionRule, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES, type RuleSyncDropReason, type RuleQuarantineReason } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, type ConfirmResult, type ConfirmRefusalReason, precheckEditedRuleText, type EditedRuleTextPrecheck, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, type RuleTicket, type RuleCandidate, type RuleApprovalKind, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleOffer2, type StaleRuleApprovalRecord, type RuleConsentDeps, type RedeemResult, type RedeemedBatchMember, type CcImportLayer, type ImportedSettingsLayer, type ImportPreview, } from "./core/permission-rule-consent.js";
@@ -168,7 +179,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, type AdoptionStatus, type AdoptLocalDataRootOptions, type AdoptLocalDataRootResult, type AdoptionCarriageLeg, type AdoptionCarriageLegContext, type AdoptionConfigWitnessReceipt, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, type PersistedRuleHit, type PersistedRuleHitRule, type PersistedRuleUnreadable, type PersistedRuleCoverage, type PersistedRuleAnswer, normalizePersistedRuleHit, type Hooks, type HookToolContext, type HookInvocationIdentity, type UserPromptSubmitContext, type PostToolBatchContext, type HookEnvCapabilities, type HookToolOutput, type PreToolUseResult, type PostToolUseResult, type UserPromptSubmitResult, type HookToolFailure, type PostToolUseFailureResult, type PostToolBatchCall, type PostToolBatchResult, type PreCompactContext, type PreCompactResult, type PostCompactContext, type StopFailureContext, type PermissionDeniedPayload, type PermissionDeniedSource, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, type NormalizedMemorySpec, type MemorySpecInput, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, type Embedder, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, type UtilityGate, type MemoryStore, type MemoryVectorMode, type ScoredMemory, type MemoryNoteHeader, type MemoryNoteRecord, type MemoryNoteType, type StructuredNoteInput, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, ambiguousOriginRepresentation, type OriginClearanceRow, type OriginClearanceEvent, type OriginClearanceShadow, committedDistilledOf, distilledEquals, type MemoryEntryDistilled, type MemoryEntryDistilledInput, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type ConsolidationRunStopReason, type RunMemoryConsolidationOptions, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, type MemoryGetDetails, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type MemoryScopeEnumeration, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, type MemoryBackendContractHooks, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, type OriginClearanceRow, type OriginClearanceEvent, type OriginClearanceShadow, committedDistilledOf, distilledEquals, type MemoryEntryDistilled, type MemoryEntryDistilledInput, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, type ConsolidationGateRead, type ConsolidationGateRow, type ConsolidationIntent, type ConsolidationIntentCredentialRow, type ConsolidationLeaseSeat, type ConsolidationProductProposal, type ConsolidationProposal, type MemoryConsolidationOptions, type ConsolidationCommitReceipt, type ConsolidationReconcileReport, type ConsolidationResolveReceipt, type ConsolidationPlanSummary, type ConsolidationPlanFoldEvidence, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, type CleanArmLeakFinding, type CleanArmLeakVerdict, type MemoryDistillerPurityContract, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, type ConsolidationDistillFn, type ConsolidationDriveCycleRow, type ConsolidationDriveEngine, type ConsolidationDriveResult, type ConsolidationFoldState, type DistillerCandidate, type DistillerChatAnswer, type DistillerChatFn, type DistillerChatRequest, type FuseSchedule, type LlmConsolidationPlan, type LlmConsolidationPlanArm, type LlmConsolidationPlanProduct, type LlmDistillerContract, type MintLlmConsolidationPlanResult, type PlanParseRepairs, type SanitizedLlmGroups, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, type ConsolidationDriverEngine, type ConsolidationDriverRunRow, type ConsolidationRunReceipt, type ConsolidationRunStopReason, type RunMemoryConsolidationOptions, isInstructionEntry, type MemoryEntryOrigin, type MemoryOriginCause, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, type SessionCaptureOptOutRecord, type SessionCaptureOptOutMarkOutcome, type SessionCaptureRecordStore, readV2HeaderHints, type V2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, type ControlPlaneRebuildReceipt, type StrictControlPlaneLedger, type ChallengeAssignment, type ChallengeEvent, type ChallengedHistoryRow, type LineagePendingTxn, type LineagePromotion, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, type MemorySearchDetails, type MemorySearchHit, type CleanMemorySearchHit, type ExposedMemorySearchHit, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, type MemoryGetDetails, type MemoryIndexDetails, type MemoryIndexRow, type CleanMemoryIndexRow, type ExposedMemoryIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, type MemoryAnnouncement, type ScanFinding, type MemoryEngineOptions, type MemoryInjection, type EntryProvenanceAccount, type TransferEvidence, type CommittedBinding, type CommittedEntrySnapshot, type CommittedScopeSnapshots, type EntryCustodyReport, erasureSelectHash, type EraseMemoryEntriesInput, type ErasureSelect, type ErasedBinding, type MemoryErasureAttestation, computeMemoryBundleHash, type MemoryExportBundle, type MemoryImportReport, type MemoryExportSnapshot, type MemoryBundleImportPlan, type BundleChallengeRow, type BundleLineageRow, type BundlePollutedSession, type MemoryBackend, type MemoryEntry, type MemoryEntryFrontmatter, type MemoryEntryHeader, type MemoryScopeEnumeration, type ScoredMemoryEntry, type NotePatch, type PatchReport, type MaterializedFile, type MemorySessionHandle, type HarvestReport, type HarvestRejection, type HarvestRejectionCode, type ParsedEntryFile, type ScannedEntryFile, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, type ParsedScopeKey, migrateScope, type MigrateScopeReport, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, type RemoteMemoryFile, type RemoteMemoryBaseline, type RemoteMaterialization, type RemoteHarvestResult, type InboundEntryFinding, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, type MemorySyncCursor, type MemorySyncConflict, type MemorySyncPlan, type RecallSource, syncMemoryScope, type MemorySyncTransport, type MemorySyncRequestBody, type MemorySyncResponseBody, type MemorySyncClientConflict, type SyncMemoryScopeOptions, type MemorySyncClientResult, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, type SharedMemoryStoreProvider, type SharedMemoryStoreReader, type SharedMemoryPagedList, type SharedMemoryStoreInfo, type SharedMemoryDocumentEntry, type SharedMemorySnapshot, type SharedMemoryRequestContext, type MemoryListDetails, type MemoryReadDetails, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, type SharedMemoryFixture, type SharedMemoryStoreContractHooks, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";
@@ -219,7 +230,7 @@ export { type ContractAssertionRunner } from "./core/store-contracts/contract-ha
 export { checkpointStoreContract } from "./core/store-contracts/checkpoint-store-contract.js";
 export { sessionRepoContract } from "./core/store-contracts/session-repo-contract.js";
 export { toolResultStoreContract } from "./core/store-contracts/tool-result-store-contract.js";
-export { fileSnapshotStoreContract } from "./core/store-contracts/file-snapshot-store-contract.js";
+export { fileHistoryStoreContract } from "./core/store-contracts/file-history-store-contract.js";
 export { permissionRuleSyncContract, type PermissionRuleSyncContractHooks } from "./core/store-contracts/permission-rule-sync-contract.js";
 export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, type MailboxTombstonedRecipientContractHooks, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";
@@ -263,7 +274,7 @@ export { ROUTE_ADJUDICATION_CONFORMANCE_CORPUS, type RouteAdjudicationVector } f
 export { type BrainTimeoutConfig } from "./brain/timeout.js";
 export { createAssistantMessageEventStream } from "./internal/llm.js";
 export type { AssistantMessage, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, StopReason, StreamFn, TextContent, ThinkingContent, ToolCall, ToolResultMessage, Usage, UserMessage, } from "./internal/llm.js";
-export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, BrainRetryErrClass, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, ResumePreflightInfo, ResumePreflightVerdict, EngineNotice, RuntimeCaps, BackgroundChildEvent, DelegationLifecycleEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, EffectiveMemoryScopes, RemoteEnvFailureNote, TaskSpec, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ReversibilityVerdict, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
+export type { AgentDefinition, BeforeWriteHook, BeforeWriteRequest, BeforeWriteResult, TrackFileEditHook, TrackEditRequest, TrackEditResult, HandsBandOptions, Brain, BrainStatus, BrainStatusPhase, BrainRetryErrClass, ImageInput, McpElicitRequest, McpElicitResponse, McpServerSpec, A2aServerSpec, OnElicit, Model, ModelRef, ProjectMemoryLoad, RunnerDeps, ResumePreflightInfo, ResumePreflightVerdict, EngineNotice, RuntimeCaps, BackgroundChildEvent, DelegationLifecycleEvent, SkillManifest, SkillSpec, TaskEvent, TaskEventIdentity, ToolActivity, TaskLimits, StaleToolResultOffloadOptions, TaskResult, EffectiveMemoryScopes, RemoteEnvFailureNote, TaskSpec, TaskStatus, TaskStream, CompactOutcome, ThinkingLevel, ToolExecuteContext, ToolReturn, ToolSpec, ReversibilityVerdict, ToolEffect, ToolContentOrigin, WorkflowGovernanceBaseline, DelegationTaskType, } from "./core/types.js";
 export { Type } from "typebox";
 export type { TSchema, Static } from "typebox";
 export { explainPromptAssembly, describeDefaultPack, type DefaultPackDescription, type ExplainInput } from "./prompt-assembly/explain.js";

package/dist/index.js

@@ -79,9 +79,15 @@ export { InMemoryCheckpointStore, CheckpointError, mintCheckpointId, mintCheckpo
 export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD, chargeUsageRecord, readUsageRecord, usageRetryAfterMs, resolveUsageWindows, } from "./core/usage-window-store.js";
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
-export { InMemoryFileSnapshotStore, DEFAULT_SNAPSHOT_BOUNDS } from "./core/file-snapshot-store.js";
-export { captureManifest, applyManifest } from "./core/file-snapshot-store.js";
-export { FileStorageBackend, FileSessionRepo, FileCheckpointStore, FileMemoryStore, FileToolResultStore, FileSessionPolicyStore, FileFileSnapshotStore, FileStrategyStore, FileWorkflowJournalStore, MAX_JOURNAL_RESULT_BYTES, oversizeJournalResult, resolveDataRoot, sanitizeScope, sanitizePathComponent, createFileConsolidationLock, atomicWriteFile, writeThenLink, ensureDir, readJsonlRecords, AppendLog, FileStoreLockError, } from "./stores/file/index.js";
+export { InMemoryFileHistoryStore, boundaryPublishVerdict } from "./core/file-history-store.js";
+export { captureFileBackupViaEnv, applyFileRestoreViaEnv } from "./core/file-history-store.js";
+export { modeProvenDifferent as fileHistoryModeProvenDifferent } from "./core/file-history-store.js";
+export { previewFileDelta as fileHistoryPreviewFileDelta, countRestoreLineDiff, FILE_HISTORY_DIFF_LINE_BUDGET } from "./core/file-history-store.js";
+export { worldStillMatchesMint } from "./core/file-history-store.js";
+export { trackKeyOf as fileHistoryTrackKeyOf, resolveTrackKey as fileHistoryResolveTrackKey } from "./core/file-history-store.js";
+export { describeTrackKey as fileHistoryDescribeTrackKey, trackKeyFamilyOf as fileHistoryKeyFamilyOf, fileHistoryExportDigest, validateFileHistoryExport } from "./core/file-history-store.js";
+export { DEFAULT_FILE_HISTORY_BOUNDARY_KEEP, resolveFileHistoryRetention, fileHistoryBoundariesToKeep } from "./core/file-history-retention.js";
+export { FileStorageBackend, FileSessionRepo, FileCheckpointStore, FileMemoryStore, FileToolResultStore, FileSessionPolicyStore, FileStrategyStore, FileFileHistoryStore, FileWorkflowJournalStore, MAX_JOURNAL_RESULT_BYTES, oversizeJournalResult, resolveDataRoot, sanitizeScope, sanitizePathComponent, createFileConsolidationLock, atomicWriteFile, writeThenLink, ensureDir, readJsonlRecords, AppendLog, FileStoreLockError, } from "./stores/file/index.js";
 export { CacheBreakDetector } from "./core/cache-break-detector.js";
 export { maybeCompact } from "./core/auto-compaction.js";
 export { brainToRuntime } from "./core/runtime.js";
@@ -89,7 +95,7 @@ export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./cor
 export { createFsWriteGatePolicy } from "./core/fs-write-gate-policy.js";
 export { RETIRED_TOOL_NAMES } from "./core/tool-name-aliases.js";
 export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
-export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, } from "./core/task-notification.js";
+export { renderTaskNotificationXml, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, SystemInjectionQueue, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, } from "./core/task-notification.js";
 export { describeStaticWiring, deriveWiringManifest, deriveAskEffective, resolveDeclaredDurability, resolveSubagentTranscriptTier, resolveAskSeamForm, resolveQuestionSeam, countElicitOptIns, } from "./core/wiring-manifest.js";
 export { probeParkRoundTrip, durableParkGapOf, durableParkGapFor, PARK_SELFCHECK_SCOPE_PREFIX, } from "./core/park-selfcheck.js";
 export {} from "./core/checkpoint-store.js";
@@ -117,10 +123,13 @@ export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, create
 export { parseAutoModeResponse, createAutoModeDecider, } from "./core/auto-mode.js";
 export { buildAutoModePrompt, renderAutoModeWindow, renderAutoModeAction, AUTO_MODE_DEFAULTS_SENTINEL, } from "./core/auto-mode-prompt.js";
 export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/auto-mode-prompt-assets.js";
+export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
+export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
 export { parseAllowRuleText, formatAllowRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
-export { removePersistedRule, applyTombstones, sameScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, } from "./core/permission-rule-store.js";
+export { removePersistedRule, applyTombstones, sameScope, isValidConsentScope, isValidDurableScope, InMemoryPermissionRuleStore, EMPTY_RULE_STORE, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
+export { InMemorySessionRuleOverlay, } from "./core/permission-rule-session.js";
 export { createOrgRuleOverlay, orgRuleVerdictFor, effectivePermissionRules, orgRuleStatePersistenceOf, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES } from "./core/governance-codes.js";
 export { prepareCardApproval, confirmRuleApproval, precheckEditedRuleText, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, } from "./core/permission-rule-consent.js";
@@ -130,7 +139,7 @@ export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootA
 export { adoptLocalDataRoot, ackAdoptionConfig, witnessAdoptionConfig, listAdoptionQuarantine, readAdoptionStatus, } from "./stores/file/adoption/adopt.js";
 export { formatHookFeedback, runToolGate, createHookEnvCapabilities, createPreToolUseConstraintPolicy, normalizePersistedRuleHit, } from "./core/hooks.js";
 export { InMemoryMemoryStore, composeMemoryBlock, composeLayeredMemoryBlock, normalizeMemorySpec, supportsConsolidation, supportsPeriodicConsolidation, firstSentence, expandLexicalTerms, lexicalSearchMatch, classifyPromotable, enforcePromotableWriteGate, guardedMemoryStore, MemoryGateError, detectSecret, enforceSecretWriteGate, enforceStructuredNoteSecretGate, } from "./core/memory.js";
-export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, ambiguousOriginRepresentation, committedDistilledOf, distilledEquals, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, isInstructionEntry, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
+export { MemoryEngine, FileMemoryEngineBackend, memoryBackendContract, assertMemoryBackendSearchEquivalence, buildMemoryInstruction, truncateIndex, scanEntryFiles, deriveRepoKey, deriveRepoMemoryDir, deriveControlPlaneDir, deriveRepoControlPlaneDir, resolveMemoryEngineRoot, scopeDirName, ControlPlaneCorruptError, parseEntryFile, serializeEntryFile, computeEntryRev, entryFromFile, MEMORY_ORIGIN_CAUSES, committedOriginOf, originEquals, consolidationExposedFrontmatter, ambiguousOriginRepresentation, committedDistilledOf, distilledEquals, CONSOLIDATION_DEFAULTS, ConsolidationRefusedError, MEMORY_SEARCH_SUPERSEDED_TAG, consolidationTypeEligible, deriveSupersededSet, memorySupersededNote, readIntentCredentials, supersessionFuseCeiling, memoryConsolidationRecommendedNotice, memoryConsolidationCommittedNotice, memoryConsolidationConflictNotice, memoryConsolidationIncompleteNotice, memoryConsolidationRefusedNotice, memoryConsolidationWithheldNotice, DISTILLER_DEFAULT_MAX_INPUTS_PER_PRODUCT, LLM_DISTILLER_CONTRACT, LLM_DISTILLER_CONTRACT_DL2, LLM_DISTILLER_CONTRACT_DL3, LLM_DISTILLER_CONTRACTS, MEMORY_DISTILLER_CONTRACT_V1, contractGroupingDiff, driveConsolidationToFixpoint, isAliasModelId, llmPlanDistiller, mintExposurePartitionedPlan, mintLlmConsolidationPlan, MEMORY_DISTILLER_PURITY_CONTRACT_V1, detectCleanArmVerbatimLeak, openAiCompatChatSeat, parseJsonAnswer, planParseRepairs, sanitizeLlmGroups, scheduleUnderFuse, CONSOLIDATION_DRIVER_PLANS_DIR, CONSOLIDATION_DRIVER_RUNS_FILE, CONSOLIDATION_RUN_STOP_REASONS, archiveDistillerPlan, readConsolidationDriverRun, runMemoryConsolidationDriver, isInstructionEntry, MEMORY_INSTRUCTION_TEMPLATE, MEMORY_RECALL_DISCIPLINE, MEMORY_PREFERENCE_DISCIPLINE, MEMORY_READONLY_NOTICE, MEMORY_CAPTURE_OPTOUT_NOTICE, memoryCaptureOptedOutNotice, memoryCaptureOptOutUnpersistedNotice, SESSION_CAPTURE_OPTOUT_DIR, markSessionCaptureOptOut, readSessionCaptureOptOut, listSessionCaptureOptOut, fileSessionCaptureRecordStore, readV2HeaderHints, LINEAGE_FILE, CHALLENGES_FILE, CHALLENGED_HISTORY_FILE, CHALLENGE_LEDGER_MAX_EVENTS, rebuildStrictControlPlaneLedger, MEMORY_INDEX_FILENAME, MEMORY_INDEX_MAX_LINES, MEMORY_INDEX_MAX_BYTES, MEMORY_SEARCH_TOOL_NAME, MEMORY_GET_TOOL_NAME, MEMORY_INDEX_TOOL_NAME, MEMORY_ENGINE_TOOL_NAMES, MEMORY_EXPOSURE_BANNER, MEMORY_EXPOSURE_HANDLE_TAG, memoryExposureIndexRow, STUB_ARCHIVED_LINE, DEFAULT_MAX_MEMORY_FILES, DEFAULT_MAX_ENTRY_DEPTH, DEFAULT_HARVEST_DEADLINE_MS, DEFAULT_HARVEST_FILE_BUDGET, MASS_DELETION_FUSE_RATIO, scanMemoryWrite, scanMemoryFileName, scanRemediation, MEMORY_FILENAME_SEGMENT_RE, renderAnnouncements, enqueueMemoryAnnouncement, drainMemoryAnnouncements, peekMemoryAnnouncements, bumpScanFuse, scanFuseCount, clearScanFuse, ANNOUNCEMENTS_FILE, MEMORY_ANNOUNCEMENTS_MAX, SCAN_FUSE_FILE, SCAN_FUSE_THRESHOLD, erasureSelectHash, computeMemoryBundleHash, SCOPE_SEGMENT_MAX_ENCODED, PROJECT_MARKER_PATH, encodeScopeSegment, decodeScopeSegment, parseScopeKey, formatUserScope, formatOrgScope, formatProjScope, formatUserProjScope, isPersonalScope, assertScopeContractPlacement, formatProjectMarker, parseProjectMarker, resolveProjectId, PROJECT_ID_REGEX, migrateScope, materializeEntriesToFiles, harvestFilesToPatches, projectionsToWriteBack, screenInboundEntries, REMOTE_HARVEST_PER_FILE_BYTES, REMOTE_MASS_DELETION_FUSE_RATIO, deriveProjectMemoryDir, deriveProjectControlDir, recordProjectIdHint, lookupProjectIdHint, PROJECT_ID_HINTS_FILE, reconcileMemoryEntries, nextSyncBaseline, mergeRecallHits, syncMemoryScope, } from "./core/memory-engine/index.js";
 export { SHARED_MEMORY_READ_CAP_BYTES, SHARED_MEMORY_LIST_PAGE_SIZE, SharedMemoryStoreError, } from "./core/shared-memory/types.js";
 export { sharedMemoryStoreContract, } from "./core/shared-memory/contract.js";
 export { termSet, jaccardDistance, cosineDistance } from "./core/memory-vector.js";
@@ -180,7 +189,7 @@ export {} from "./core/store-contracts/contract-harness.js";
 export { checkpointStoreContract } from "./core/store-contracts/checkpoint-store-contract.js";
 export { sessionRepoContract } from "./core/store-contracts/session-repo-contract.js";
 export { toolResultStoreContract } from "./core/store-contracts/tool-result-store-contract.js";
-export { fileSnapshotStoreContract } from "./core/store-contracts/file-snapshot-store-contract.js";
+export { fileHistoryStoreContract } from "./core/store-contracts/file-history-store-contract.js";
 export { permissionRuleSyncContract } from "./core/store-contracts/permission-rule-sync-contract.js";
 export { MAILBOX_CONTRACT_SCOPE, mailboxStoreContract, mailboxAckOwnershipContract, mailboxBundledOnlyContract, mailboxTombstonedRecipientContract, } from "./core/store-contracts/mailbox-store-contract.js";
 export { BACKGROUND_AGENT_CONTRACT_SCOPE, backgroundAgentStoreContract, backgroundAgentStoreScopesContract, } from "./core/store-contracts/background-agent-store-contract.js";

package/dist/orchestration/run-workflow-tool.d.ts

@@ -230,6 +230,22 @@ export interface RunWorkflowToolDeps {
      *  reason `forwardEvent`/`inheritedGateForChildren` ride deps); `ctx.interactionPosture` still
      *  wins when a wrapping path provides it. */
     parentInteractionPosture?: "interactive" | "headless";
+    /**
+     * design/383 §2.5 (rescan post-6.0.0-RC) — the HOST session's live capture opt-out state,
+     * threaded as a MOUNT dep for the same unenriched-auto-mount reason as the posture seat above.
+     * A call-time GETTER on purpose (`ctx.memoryCaptureOptedOut` is live — a mid-run flip must
+     * floor agents the workflow spawns after it); the enriched-ctx getters win when a wrapping
+     * mount provides them. Rides `RunWorkflowOptions.parentMemoryCaptureState` into both spawn legs.
+     */
+    parentMemoryCaptureState?: () => {
+        optedOut: boolean;
+        indeterminate: boolean;
+        controlDir?: string;
+        ancestors?: ReadonlyArray<{
+            sessionId: string;
+            controlDir?: string;
+        }>;
+    };
     /** TRUSTED nesting depth from the run's internals (NOT a tool param) — passed to `startWorkflow` so a
      *  cross-process child workflow is rejected by the one-level guard. */
     workflowDepth?: number;
@@ -317,8 +333,10 @@ export interface RunWorkflowToolDeps {
     parentCheckpointStoreDisabled?: boolean;
     /** #235 — the deployment's structured notice sink (`RunnerDeps.onNotice`), forwarded into the governed
      *  build so the fields a script's agent spec wrote that did NOT reach the child are announced instead of
-     *  vanishing (`workflow.governance_key_stripped`). A dep for the same reason as the seats above: this
-     *  auto-mount's execute ctx is minimal. Absent ⇒ the historic `console.warn` loudness. */
+     *  vanishing (`workflow.governance_key_stripped`). #505 ① — the same seat now also carries the OPTIONS
+     *  membrane's twin announcement (`workflow.agent_option_ignored`: keys of `agent(spec, opts)`'s second
+     *  argument that did not apply). A dep for the same reason as the seats above: this auto-mount's execute
+     *  ctx is minimal. Absent ⇒ the historic `console.warn` loudness. */
     onNotice?: (n: import("../core/types.js").EngineNotice) => void;
     /** Twin of the above for design/148 S1's center-artifact inheritance (see the `ctx.centerArtifactDigest`/
      *  `ctx.centerSourceRevision` reads at the `startWorkflow` options site) — `centerAdoption` resolves