@theokit/sdk 4.40.0 → 4.41.1

package/dist/{inject-session-BVSERZCI.cjs → inject-session-DDC36KKP.cjs}

@@ -1,17 +1,17 @@
 'use strict';
 
-var chunkN4JNY5DT_cjs = require('./chunk-N4JNY5DT.cjs');
-var chunkBURYFNOM_cjs = require('./chunk-BURYFNOM.cjs');
-require('./chunk-3LK3ZDL5.cjs');
-var chunkNJVV5OAV_cjs = require('./chunk-NJVV5OAV.cjs');
-require('./chunk-33B2BSME.cjs');
-require('./chunk-A76OFN2B.cjs');
+var chunkZO2L5U6F_cjs = require('./chunk-ZO2L5U6F.cjs');
+var chunk4JBHSLQO_cjs = require('./chunk-4JBHSLQO.cjs');
+require('./chunk-FZ4YMZA3.cjs');
+var chunkWCXOKGOQ_cjs = require('./chunk-WCXOKGOQ.cjs');
+require('./chunk-NETYW4V3.cjs');
+require('./chunk-ZHPET3LZ.cjs');
 
 // src/internal/session/inject-session.ts
 async function injectSessionTurn(opts) {
-  await chunkN4JNY5DT_cjs.enqueueSessionWrite(opts.loc.cwd, opts.loc.agentId, async () => {
+  await chunkZO2L5U6F_cjs.enqueueSessionWrite(opts.loc.cwd, opts.loc.agentId, async () => {
     const prior = await opts.store.readRecords(opts.loc.agentId);
-    const transcript = chunkNJVV5OAV_cjs.SessionTranscript.fromRecords(prior, {
+    const transcript = chunkWCXOKGOQ_cjs.SessionTranscript.fromRecords(prior, {
       cwd: opts.loc.cwd,
       sessionId: opts.sessionId,
       model: opts.loc.model ?? "unknown"
@@ -19,10 +19,10 @@ async function injectSessionTurn(opts) {
     transcript.appendUserTurn(opts.userText);
     transcript.appendAssistantTurn({ text: opts.assistantText });
     await opts.store.appendRecords(opts.loc.agentId, transcript.records().slice(prior.length));
-    chunkBURYFNOM_cjs.invalidateSessionCache(opts.loc.cwd, opts.loc.agentId);
+    chunk4JBHSLQO_cjs.invalidateSessionCache(opts.loc.cwd, opts.loc.agentId);
   });
 }
 
 exports.injectSessionTurn = injectSessionTurn;
-//# sourceMappingURL=inject-session-BVSERZCI.cjs.map
-//# sourceMappingURL=inject-session-BVSERZCI.cjs.map
+//# sourceMappingURL=inject-session-DDC36KKP.cjs.map
+//# sourceMappingURL=inject-session-DDC36KKP.cjs.map

package/dist/{inject-session-BVSERZCI.cjs.map → inject-session-DDC36KKP.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/session/inject-session.ts"],"names":["enqueueSessionWrite","SessionTranscript","invalidateSessionCache"],"mappings":";;;;;;;;;;AAWA,eAAsB,kBAAkB,IAAA,EAMtB;AAChB,EAAA,MAAMA,sCAAoB,IAAA,CAAK,GAAA,CAAI,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,YAAY;AACpE,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,MAAM,WAAA,CAAY,IAAA,CAAK,IAAI,OAAO,CAAA;AAC3D,IAAA,MAAM,UAAA,GAAaC,mCAAA,CAAkB,WAAA,CAAY,KAAA,EAAO;AAAA,MACtD,GAAA,EAAK,KAAK,GAAA,CAAI,GAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,KAAA,EAAO,IAAA,CAAK,GAAA,CAAI,KAAA,IAAS;AAAA,KAC1B,CAAA;AACD,IAAA,UAAA,CAAW,cAAA,CAAe,KAAK,QAAQ,CAAA;AACvC,IAAA,UAAA,CAAW,mBAAA,CAAoB,EAAE,IAAA,EAAM,IAAA,CAAK,eAAe,CAAA;AAC3D,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,aAAA,CAAc,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,UAAA,CAAW,OAAA,EAAQ,CAAE,KAAA,CAAM,KAAA,CAAM,MAAM,CAAC,CAAA;AACzF,IAAAC,wCAAA,CAAuB,IAAA,CAAK,GAAA,CAAI,GAAA,EAAK,IAAA,CAAK,IAAI,OAAO,CAAA;AAAA,EACvD,CAAC,CAAA;AACH","file":"inject-session-BVSERZCI.cjs","sourcesContent":["/**\n * M51 (agent-builder) — inject a SYNTHETIC user+assistant pair into a session's persisted transcript\n * WITHOUT running an LLM turn. This is the Codex review-exit mechanism (`exit_success.xml` appended to\n * the parent thread history so follow-ups like \"fix finding 2\" work): the pair chains onto the DAG\n * leaf (M50 pattern) and the in-memory cache is invalidated so the NEXT send re-hydrates with it.\n */\nimport type { SessionStore } from \"../../types/session-store.js\";\nimport { SessionTranscript } from \"../persistence/session-transcript.js\";\nimport { enqueueSessionWrite, invalidateSessionCache } from \"./agent-session.js\";\nimport type { CompactLocation } from \"./compact-session.js\";\n\nexport async function injectSessionTurn(opts: {\n  store: SessionStore;\n  loc: CompactLocation;\n  sessionId: string;\n  userText: string;\n  assistantText: string;\n}): Promise<void> {\n  await enqueueSessionWrite(opts.loc.cwd, opts.loc.agentId, async () => {\n    const prior = await opts.store.readRecords(opts.loc.agentId);\n    const transcript = SessionTranscript.fromRecords(prior, {\n      cwd: opts.loc.cwd,\n      sessionId: opts.sessionId,\n      model: opts.loc.model ?? \"unknown\",\n    });\n    transcript.appendUserTurn(opts.userText);\n    transcript.appendAssistantTurn({ text: opts.assistantText });\n    await opts.store.appendRecords(opts.loc.agentId, transcript.records().slice(prior.length));\n    invalidateSessionCache(opts.loc.cwd, opts.loc.agentId);\n  });\n}\n"]}
+{"version":3,"sources":["../src/internal/session/inject-session.ts"],"names":["enqueueSessionWrite","SessionTranscript","invalidateSessionCache"],"mappings":";;;;;;;;;;AAWA,eAAsB,kBAAkB,IAAA,EAMtB;AAChB,EAAA,MAAMA,sCAAoB,IAAA,CAAK,GAAA,CAAI,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,YAAY;AACpE,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,MAAM,WAAA,CAAY,IAAA,CAAK,IAAI,OAAO,CAAA;AAC3D,IAAA,MAAM,UAAA,GAAaC,mCAAA,CAAkB,WAAA,CAAY,KAAA,EAAO;AAAA,MACtD,GAAA,EAAK,KAAK,GAAA,CAAI,GAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,KAAA,EAAO,IAAA,CAAK,GAAA,CAAI,KAAA,IAAS;AAAA,KAC1B,CAAA;AACD,IAAA,UAAA,CAAW,cAAA,CAAe,KAAK,QAAQ,CAAA;AACvC,IAAA,UAAA,CAAW,mBAAA,CAAoB,EAAE,IAAA,EAAM,IAAA,CAAK,eAAe,CAAA;AAC3D,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,aAAA,CAAc,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,UAAA,CAAW,OAAA,EAAQ,CAAE,KAAA,CAAM,KAAA,CAAM,MAAM,CAAC,CAAA;AACzF,IAAAC,wCAAA,CAAuB,IAAA,CAAK,GAAA,CAAI,GAAA,EAAK,IAAA,CAAK,IAAI,OAAO,CAAA;AAAA,EACvD,CAAC,CAAA;AACH","file":"inject-session-DDC36KKP.cjs","sourcesContent":["/**\n * M51 (agent-builder) — inject a SYNTHETIC user+assistant pair into a session's persisted transcript\n * WITHOUT running an LLM turn. This is the Codex review-exit mechanism (`exit_success.xml` appended to\n * the parent thread history so follow-ups like \"fix finding 2\" work): the pair chains onto the DAG\n * leaf (M50 pattern) and the in-memory cache is invalidated so the NEXT send re-hydrates with it.\n */\nimport type { SessionStore } from \"../../types/session-store.js\";\nimport { SessionTranscript } from \"../persistence/session-transcript.js\";\nimport { enqueueSessionWrite, invalidateSessionCache } from \"./agent-session.js\";\nimport type { CompactLocation } from \"./compact-session.js\";\n\nexport async function injectSessionTurn(opts: {\n  store: SessionStore;\n  loc: CompactLocation;\n  sessionId: string;\n  userText: string;\n  assistantText: string;\n}): Promise<void> {\n  await enqueueSessionWrite(opts.loc.cwd, opts.loc.agentId, async () => {\n    const prior = await opts.store.readRecords(opts.loc.agentId);\n    const transcript = SessionTranscript.fromRecords(prior, {\n      cwd: opts.loc.cwd,\n      sessionId: opts.sessionId,\n      model: opts.loc.model ?? \"unknown\",\n    });\n    transcript.appendUserTurn(opts.userText);\n    transcript.appendAssistantTurn({ text: opts.assistantText });\n    await opts.store.appendRecords(opts.loc.agentId, transcript.records().slice(prior.length));\n    invalidateSessionCache(opts.loc.cwd, opts.loc.agentId);\n  });\n}\n"]}

package/dist/{inject-session-E75EP3LL.js → inject-session-UBM4KVSV.js}

@@ -1,9 +1,9 @@
-import { enqueueSessionWrite } from './chunk-ONVIALVV.js';
-import { invalidateSessionCache } from './chunk-5KOW3GLE.js';
-import './chunk-7PBAJ2WA.js';
-import { SessionTranscript } from './chunk-EYUZZXHZ.js';
-import './chunk-5XPKYDK7.js';
-import './chunk-RNCN2TTP.js';
+import { enqueueSessionWrite } from './chunk-IMX5YODO.js';
+import { invalidateSessionCache } from './chunk-4QEC4CCS.js';
+import './chunk-ZTEAJAE6.js';
+import { SessionTranscript } from './chunk-AF4BBKIF.js';
+import './chunk-VQFSEKU5.js';
+import './chunk-PBML2FHN.js';
 
 // src/internal/session/inject-session.ts
 async function injectSessionTurn(opts) {
@@ -22,5 +22,5 @@ async function injectSessionTurn(opts) {
 }
 
 export { injectSessionTurn };
-//# sourceMappingURL=inject-session-E75EP3LL.js.map
-//# sourceMappingURL=inject-session-E75EP3LL.js.map
+//# sourceMappingURL=inject-session-UBM4KVSV.js.map
+//# sourceMappingURL=inject-session-UBM4KVSV.js.map

package/dist/{inject-session-E75EP3LL.js.map → inject-session-UBM4KVSV.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/session/inject-session.ts"],"names":[],"mappings":";;;;;;;;AAWA,eAAsB,kBAAkB,IAAA,EAMtB;AAChB,EAAA,MAAM,oBAAoB,IAAA,CAAK,GAAA,CAAI,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,YAAY;AACpE,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,MAAM,WAAA,CAAY,IAAA,CAAK,IAAI,OAAO,CAAA;AAC3D,IAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,WAAA,CAAY,KAAA,EAAO;AAAA,MACtD,GAAA,EAAK,KAAK,GAAA,CAAI,GAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,KAAA,EAAO,IAAA,CAAK,GAAA,CAAI,KAAA,IAAS;AAAA,KAC1B,CAAA;AACD,IAAA,UAAA,CAAW,cAAA,CAAe,KAAK,QAAQ,CAAA;AACvC,IAAA,UAAA,CAAW,mBAAA,CAAoB,EAAE,IAAA,EAAM,IAAA,CAAK,eAAe,CAAA;AAC3D,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,aAAA,CAAc,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,UAAA,CAAW,OAAA,EAAQ,CAAE,KAAA,CAAM,KAAA,CAAM,MAAM,CAAC,CAAA;AACzF,IAAA,sBAAA,CAAuB,IAAA,CAAK,GAAA,CAAI,GAAA,EAAK,IAAA,CAAK,IAAI,OAAO,CAAA;AAAA,EACvD,CAAC,CAAA;AACH","file":"inject-session-E75EP3LL.js","sourcesContent":["/**\n * M51 (agent-builder) — inject a SYNTHETIC user+assistant pair into a session's persisted transcript\n * WITHOUT running an LLM turn. This is the Codex review-exit mechanism (`exit_success.xml` appended to\n * the parent thread history so follow-ups like \"fix finding 2\" work): the pair chains onto the DAG\n * leaf (M50 pattern) and the in-memory cache is invalidated so the NEXT send re-hydrates with it.\n */\nimport type { SessionStore } from \"../../types/session-store.js\";\nimport { SessionTranscript } from \"../persistence/session-transcript.js\";\nimport { enqueueSessionWrite, invalidateSessionCache } from \"./agent-session.js\";\nimport type { CompactLocation } from \"./compact-session.js\";\n\nexport async function injectSessionTurn(opts: {\n  store: SessionStore;\n  loc: CompactLocation;\n  sessionId: string;\n  userText: string;\n  assistantText: string;\n}): Promise<void> {\n  await enqueueSessionWrite(opts.loc.cwd, opts.loc.agentId, async () => {\n    const prior = await opts.store.readRecords(opts.loc.agentId);\n    const transcript = SessionTranscript.fromRecords(prior, {\n      cwd: opts.loc.cwd,\n      sessionId: opts.sessionId,\n      model: opts.loc.model ?? \"unknown\",\n    });\n    transcript.appendUserTurn(opts.userText);\n    transcript.appendAssistantTurn({ text: opts.assistantText });\n    await opts.store.appendRecords(opts.loc.agentId, transcript.records().slice(prior.length));\n    invalidateSessionCache(opts.loc.cwd, opts.loc.agentId);\n  });\n}\n"]}
+{"version":3,"sources":["../src/internal/session/inject-session.ts"],"names":[],"mappings":";;;;;;;;AAWA,eAAsB,kBAAkB,IAAA,EAMtB;AAChB,EAAA,MAAM,oBAAoB,IAAA,CAAK,GAAA,CAAI,KAAK,IAAA,CAAK,GAAA,CAAI,SAAS,YAAY;AACpE,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,MAAM,WAAA,CAAY,IAAA,CAAK,IAAI,OAAO,CAAA;AAC3D,IAAA,MAAM,UAAA,GAAa,iBAAA,CAAkB,WAAA,CAAY,KAAA,EAAO;AAAA,MACtD,GAAA,EAAK,KAAK,GAAA,CAAI,GAAA;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,KAAA,EAAO,IAAA,CAAK,GAAA,CAAI,KAAA,IAAS;AAAA,KAC1B,CAAA;AACD,IAAA,UAAA,CAAW,cAAA,CAAe,KAAK,QAAQ,CAAA;AACvC,IAAA,UAAA,CAAW,mBAAA,CAAoB,EAAE,IAAA,EAAM,IAAA,CAAK,eAAe,CAAA;AAC3D,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,aAAA,CAAc,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,UAAA,CAAW,OAAA,EAAQ,CAAE,KAAA,CAAM,KAAA,CAAM,MAAM,CAAC,CAAA;AACzF,IAAA,sBAAA,CAAuB,IAAA,CAAK,GAAA,CAAI,GAAA,EAAK,IAAA,CAAK,IAAI,OAAO,CAAA;AAAA,EACvD,CAAC,CAAA;AACH","file":"inject-session-UBM4KVSV.js","sourcesContent":["/**\n * M51 (agent-builder) — inject a SYNTHETIC user+assistant pair into a session's persisted transcript\n * WITHOUT running an LLM turn. This is the Codex review-exit mechanism (`exit_success.xml` appended to\n * the parent thread history so follow-ups like \"fix finding 2\" work): the pair chains onto the DAG\n * leaf (M50 pattern) and the in-memory cache is invalidated so the NEXT send re-hydrates with it.\n */\nimport type { SessionStore } from \"../../types/session-store.js\";\nimport { SessionTranscript } from \"../persistence/session-transcript.js\";\nimport { enqueueSessionWrite, invalidateSessionCache } from \"./agent-session.js\";\nimport type { CompactLocation } from \"./compact-session.js\";\n\nexport async function injectSessionTurn(opts: {\n  store: SessionStore;\n  loc: CompactLocation;\n  sessionId: string;\n  userText: string;\n  assistantText: string;\n}): Promise<void> {\n  await enqueueSessionWrite(opts.loc.cwd, opts.loc.agentId, async () => {\n    const prior = await opts.store.readRecords(opts.loc.agentId);\n    const transcript = SessionTranscript.fromRecords(prior, {\n      cwd: opts.loc.cwd,\n      sessionId: opts.sessionId,\n      model: opts.loc.model ?? \"unknown\",\n    });\n    transcript.appendUserTurn(opts.userText);\n    transcript.appendAssistantTurn({ text: opts.assistantText });\n    await opts.store.appendRecords(opts.loc.agentId, transcript.records().slice(prior.length));\n    invalidateSessionCache(opts.loc.cwd, opts.loc.agentId);\n  });\n}\n"]}

package/dist/internal/auth/credential-store.d.ts

@@ -23,6 +23,19 @@ export declare function authFilePath(config: CredentialStoreConfig, env?: Record
 export declare class CredentialError extends AuthenticationError {
     readonly name: string;
 }
+/**
+ * Read the credential file. Absent ⇒ `undefined` (the normal case). Present-but-wrong is a typed error
+ * naming the file: a malformed credential store must not surface as a raw parse crash. Enforces the
+ * 0700 dir / 0600 file mode gates (ported verbatim — a writable dir lets an attacker swap the file for a
+ * symlink to their own account).
+ */
+/**
+ * The 0700-dir / 0600-file mode gates (ported verbatim). The DIRECTORY matters as much as the file:
+ * `mkdirSync(mode)` applies only at creation, so a pre-existing store dir keeps whatever mode it had, and a
+ * writable dir lets an attacker replace the credential file with a symlink to their own 0600 file — the
+ * agent then runs on THEIR account.
+ */
+export declare function assertSecureModes(dirPath: string, path: string): void;
 export declare function readAuthFile(config: CredentialStoreConfig, env?: Record<string, string | undefined>): StoredCredential | undefined;
 /**
  * Read the stored OAuth credential (with its refresh token), or `undefined` when the store is absent or

package/dist/internal/diagnostics.d.ts

@@ -1,7 +1,7 @@
 /**
  * The library's single diagnostics channel — silent by default (#147).
  *
- * ## O problema
+ * ## The problem
  *
  * The SDK wrote diagnostics straight to `process.stderr` from hot paths — 92 sites across 51
  * files under `internal/`. In a TUI host (Ink, alternate screen), those writes interleave with the
@@ -12,7 +12,7 @@
  * A library cannot assume `stdout`/`stderr` are free sinks. The application owns the terminal, not
  * the dependency.
  *
- * ## O contrato
+ * ## The contract
  *
  * - **`setDiagnosticsSink(fn)`** hands the messages to the application, which decides where to put
  *   them (a status line, a file, a panel). It is what was missing for a TUI to coexist with the SDK.

package/dist/internal/error-mappers/anthropic.d.ts

@@ -13,7 +13,7 @@
  *   408     → `NetworkError`          (`code: "timeout"`)
  *   5xx     → `NetworkError`          (`code: "server_error"` — covers 529
  *                                       overloaded_error common at peak
- *                                       de pico)
+ *                                       at peak)
  *   other   → `UnknownAgentError`     (`code: "unknown"`)
  *
  * Never throws — caller is already in an error path.

package/dist/internal/eval/code-runner.d.ts

@@ -8,7 +8,7 @@
  * verify-gate grades. Every command rides {@link SandboxBackend.execute}
  * (ADR D2 — portable across Local/Docker/E2B).
  *
- * referencia: knowledge-base/references/theocode-eval/lib/swebench-batch.ts:154
+ * reference: knowledge-base/references/theocode-eval/lib/swebench-batch.ts:154
  * (build prediction from captured diff), :157 (reverse apply-check on the
  * mutated tree).
  *

package/dist/internal/global-singleton.d.ts

@@ -1,5 +1,5 @@
 /**
- * Singleton por realm, chaveado por `Symbol.for`.
+ * One singleton per realm, keyed by `Symbol.for`.
  *
  * It exists because a package can be loaded more than once in the same process (two copies in
  * `node_modules`, ESM and CJS side by side, a monorepo with distinct versions) — and then a module-level

package/dist/internal/judge/judge-call.d.ts

@@ -34,7 +34,7 @@ export interface JudgeOptions {
  * credential. A slow, opaque failure traded for a fast, clear one.
  *
  * PARSE failures and network errors stay folded: they are recoverable, and the loop already decides on
- * consecutivas.
+ * in a row.
  */
 export declare class JudgeCredentialError extends TheokitAgentError {
     readonly httpStatus: number;

package/dist/internal/memory/adapters/index.cjs

@@ -1,20 +1,20 @@
 'use strict';
 
-var chunkX2LDDKFM_cjs = require('../../../chunk-X2LDDKFM.cjs');
-require('../../../chunk-U53AYSHS.cjs');
+var chunk7PESI6YD_cjs = require('../../../chunk-7PESI6YD.cjs');
+require('../../../chunk-S4Q5OMIK.cjs');
 var chunk2RW7K6FN_cjs = require('../../../chunk-2RW7K6FN.cjs');
 require('../../../chunk-MUUQ2WFJ.cjs');
-require('../../../chunk-RHQJX3EI.cjs');
-require('../../../chunk-PDOLUFGY.cjs');
-require('../../../chunk-ZAKTZ5B4.cjs');
-require('../../../chunk-E7WWIX34.cjs');
-require('../../../chunk-A76OFN2B.cjs');
+require('../../../chunk-OEFFPR2S.cjs');
+require('../../../chunk-27DYRARU.cjs');
+require('../../../chunk-XA3TSBAH.cjs');
+require('../../../chunk-YULF6FPB.cjs');
+require('../../../chunk-ZHPET3LZ.cjs');
 
 
 
 Object.defineProperty(exports, "createOpenAiCompatibleRuntime", {
   enumerable: true,
-  get: function () { return chunkX2LDDKFM_cjs.createOpenAiCompatibleRuntime; }
+  get: function () { return chunk7PESI6YD_cjs.createOpenAiCompatibleRuntime; }
 });
 Object.defineProperty(exports, "LruEmbeddingCache", {
   enumerable: true,

package/dist/internal/memory/adapters/index.js

@@ -1,11 +1,11 @@
-export { createOpenAiCompatibleRuntime } from '../../../chunk-HJMFPIRM.js';
-import '../../../chunk-FUP3ZA5T.js';
+export { createOpenAiCompatibleRuntime } from '../../../chunk-LLE7HPRI.js';
+import '../../../chunk-SNKY3C2L.js';
 export { LruEmbeddingCache, globalEmbeddingCache } from '../../../chunk-OXNYIMZZ.js';
 import '../../../chunk-FD2UT76F.js';
-import '../../../chunk-XKGOIGTJ.js';
-import '../../../chunk-F4SQTWVR.js';
-import '../../../chunk-IEKSEAIV.js';
-import '../../../chunk-VQ33XLC6.js';
-import '../../../chunk-RNCN2TTP.js';
+import '../../../chunk-AZ6FKDQR.js';
+import '../../../chunk-Q4DTGCSD.js';
+import '../../../chunk-6FSQ3CHQ.js';
+import '../../../chunk-MRKSSN36.js';
+import '../../../chunk-PBML2FHN.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/internal/memory/embedding-adapter.d.ts

@@ -2,7 +2,7 @@
  * Memory embedding provider adapter contract (ADR D3 of memory-system-peer-project-parity).
  *
  * Mirrors peer-project's `MemoryEmbeddingProviderAdapter` from
- * `referencia/peer-project/extensions/openai/memory-embedding-adapter.ts` so
+ * `reference/peer-project/extensions/openai/memory-embedding-adapter.ts` so
  * adding a new provider becomes one new file under `adapters/`.
  *
  * @internal

package/dist/internal/memory/memory-index.d.ts

@@ -8,7 +8,7 @@
  * `close()` — the union of those four methods is the portable surface.
  *
  * Why a separate file (vs declaring inline in `index-manager.ts`)? D43
- * promised "extrair interface abstrata `MemoryIndex` em
+ * promised "extract an abstract `MemoryIndex` interface in
  * `internal/memory/index-interface.ts`". Keeping the contract physically
  * separated from one of its implementations preserves OCP — future
  * backends (Qdrant, PGVector) can land without touching IndexManager.

package/dist/internal/persistence/atomic-write.d.cts

@@ -1 +1,14 @@
-export {};
+/**
+ * U-9 — the file a leftover temp was replacing, or `undefined` if this is not one of ours.
+ *
+ * A crash between the open and the rename leaves `<file>.<pid>.<hex>.tmp` behind, and nothing here
+ * collects it: this module creates temps and has no opinion about sweeping them. A consumer that
+ * wants to has to know the format — which lived only in the implementation, so one copied it out of
+ * a compiled chunk as a regex. That copy would have gone on reporting "nothing to collect" the day
+ * the format changed, which is the quietest possible way for a cleanup to stop working.
+ *
+ * Deliberately strict: the pid must be digits and the suffix exactly 16 hex characters. Matching any
+ * `.tmp` would claim editors' swap files and other tools' scratch, on a path whose purpose is
+ * deleting them.
+ */
+export declare function atomicWriteTempTarget(name: string): string | undefined;

package/dist/internal/persistence/atomic-write.d.ts

@@ -1 +1,14 @@
-export {};
+/**
+ * U-9 — the file a leftover temp was replacing, or `undefined` if this is not one of ours.
+ *
+ * A crash between the open and the rename leaves `<file>.<pid>.<hex>.tmp` behind, and nothing here
+ * collects it: this module creates temps and has no opinion about sweeping them. A consumer that
+ * wants to has to know the format — which lived only in the implementation, so one copied it out of
+ * a compiled chunk as a regex. That copy would have gone on reporting "nothing to collect" the day
+ * the format changed, which is the quietest possible way for a cleanup to stop working.
+ *
+ * Deliberately strict: the pid must be digits and the suffix exactly 16 hex characters. Matching any
+ * `.tmp` would claim editors' swap files and other tools' scratch, on a path whose purpose is
+ * deleting them.
+ */
+export declare function atomicWriteTempTarget(name: string): string | undefined;

package/dist/internal/persistence/index.cjs

@@ -1,13 +1,13 @@
 'use strict';
 
 var chunkPNVDQL5Y_cjs = require('../../chunk-PNVDQL5Y.cjs');
-var chunkFMDZZRYE_cjs = require('../../chunk-FMDZZRYE.cjs');
-var chunkZVQJHY4Y_cjs = require('../../chunk-ZVQJHY4Y.cjs');
-var chunk4H2QARXM_cjs = require('../../chunk-4H2QARXM.cjs');
+var chunk6X2HUT4A_cjs = require('../../chunk-6X2HUT4A.cjs');
+var chunk6W4U2G3J_cjs = require('../../chunk-6W4U2G3J.cjs');
+var chunkBV42CCRP_cjs = require('../../chunk-BV42CCRP.cjs');
 var chunkYLQQX5W2_cjs = require('../../chunk-YLQQX5W2.cjs');
-var chunk33B2BSME_cjs = require('../../chunk-33B2BSME.cjs');
-require('../../chunk-E7WWIX34.cjs');
-require('../../chunk-A76OFN2B.cjs');
+var chunkNETYW4V3_cjs = require('../../chunk-NETYW4V3.cjs');
+require('../../chunk-YULF6FPB.cjs');
+require('../../chunk-ZHPET3LZ.cjs');
 var promises = require('fs/promises');
 
 async function createExclusive(path, data, options) {
@@ -41,67 +41,67 @@ Object.defineProperty(exports, "PersistenceSchema", {
 });
 Object.defineProperty(exports, "displayTheokitHome", {
   enumerable: true,
-  get: function () { return chunkFMDZZRYE_cjs.displayTheokitHome; }
+  get: function () { return chunk6X2HUT4A_cjs.displayTheokitHome; }
 });
 Object.defineProperty(exports, "getProfilesRoot", {
   enumerable: true,
-  get: function () { return chunkFMDZZRYE_cjs.getProfilesRoot; }
+  get: function () { return chunk6X2HUT4A_cjs.getProfilesRoot; }
 });
 Object.defineProperty(exports, "getTheokitHome", {
   enumerable: true,
-  get: function () { return chunkFMDZZRYE_cjs.getTheokitHome; }
+  get: function () { return chunk6X2HUT4A_cjs.getTheokitHome; }
 });
 Object.defineProperty(exports, "migrateSchema", {
   enumerable: true,
-  get: function () { return chunkFMDZZRYE_cjs.migrateSchema; }
+  get: function () { return chunk6X2HUT4A_cjs.migrateSchema; }
 });
 Object.defineProperty(exports, "readVersionedJson", {
   enumerable: true,
-  get: function () { return chunkFMDZZRYE_cjs.readVersionedJson; }
+  get: function () { return chunk6X2HUT4A_cjs.readVersionedJson; }
 });
 Object.defineProperty(exports, "writeVersionedJson", {
   enumerable: true,
-  get: function () { return chunkFMDZZRYE_cjs.writeVersionedJson; }
+  get: function () { return chunk6X2HUT4A_cjs.writeVersionedJson; }
 });
 Object.defineProperty(exports, "JsonlParseError", {
   enumerable: true,
-  get: function () { return chunkZVQJHY4Y_cjs.JsonlParseError; }
+  get: function () { return chunk6W4U2G3J_cjs.JsonlParseError; }
 });
 Object.defineProperty(exports, "appendJsonl", {
   enumerable: true,
-  get: function () { return chunkZVQJHY4Y_cjs.appendJsonl; }
+  get: function () { return chunk6W4U2G3J_cjs.appendJsonl; }
 });
 Object.defineProperty(exports, "loadJsonl", {
   enumerable: true,
-  get: function () { return chunkZVQJHY4Y_cjs.loadJsonl; }
+  get: function () { return chunk6W4U2G3J_cjs.loadJsonl; }
 });
 Object.defineProperty(exports, "readJsonlIds", {
   enumerable: true,
-  get: function () { return chunkZVQJHY4Y_cjs.readJsonlIds; }
+  get: function () { return chunk6W4U2G3J_cjs.readJsonlIds; }
 });
 Object.defineProperty(exports, "withFileLock", {
   enumerable: true,
-  get: function () { return chunkZVQJHY4Y_cjs.withFileLock; }
+  get: function () { return chunk6W4U2G3J_cjs.withFileLock; }
 });
 Object.defineProperty(exports, "applyWalWithFallback", {
   enumerable: true,
-  get: function () { return chunk4H2QARXM_cjs.applyWalWithFallback; }
+  get: function () { return chunkBV42CCRP_cjs.applyWalWithFallback; }
 });
 Object.defineProperty(exports, "containsCjk", {
   enumerable: true,
-  get: function () { return chunk4H2QARXM_cjs.containsCjk; }
+  get: function () { return chunkBV42CCRP_cjs.containsCjk; }
 });
 Object.defineProperty(exports, "isCorruptionError", {
   enumerable: true,
-  get: function () { return chunk4H2QARXM_cjs.isCorruptionError; }
+  get: function () { return chunkBV42CCRP_cjs.isCorruptionError; }
 });
 Object.defineProperty(exports, "openSqliteResilient", {
   enumerable: true,
-  get: function () { return chunk4H2QARXM_cjs.openSqliteResilient; }
+  get: function () { return chunkBV42CCRP_cjs.openSqliteResilient; }
 });
 Object.defineProperty(exports, "sanitizeFts5Query", {
   enumerable: true,
-  get: function () { return chunk4H2QARXM_cjs.sanitizeFts5Query; }
+  get: function () { return chunkBV42CCRP_cjs.sanitizeFts5Query; }
 });
 Object.defineProperty(exports, "withCwdMutex", {
   enumerable: true,
@@ -109,15 +109,15 @@ Object.defineProperty(exports, "withCwdMutex", {
 });
 Object.defineProperty(exports, "atomicWriteJson", {
   enumerable: true,
-  get: function () { return chunk33B2BSME_cjs.atomicWriteJson; }
+  get: function () { return chunkNETYW4V3_cjs.atomicWriteJson; }
 });
 Object.defineProperty(exports, "atomicWriteText", {
   enumerable: true,
-  get: function () { return chunk33B2BSME_cjs.atomicWriteText; }
+  get: function () { return chunkNETYW4V3_cjs.atomicWriteText; }
 });
 Object.defineProperty(exports, "replaceFileAtomic", {
   enumerable: true,
-  get: function () { return chunk33B2BSME_cjs.replaceFileAtomic; }
+  get: function () { return chunkNETYW4V3_cjs.replaceFileAtomic; }
 });
 exports.casUpdate = casUpdate;
 exports.createExclusive = createExclusive;

package/dist/internal/persistence/index.js

@@ -1,11 +1,11 @@
 export { PersistenceSchema } from '../../chunk-CAH3G4IS.js';
-export { displayTheokitHome, getProfilesRoot, getTheokitHome, migrateSchema, readVersionedJson, writeVersionedJson } from '../../chunk-RMCHJZNZ.js';
-export { JsonlParseError, appendJsonl, loadJsonl, readJsonlIds, withFileLock } from '../../chunk-5VKUZ26Q.js';
-export { applyWalWithFallback, containsCjk, isCorruptionError, openSqliteResilient, sanitizeFts5Query } from '../../chunk-VTDQRUAJ.js';
+export { displayTheokitHome, getProfilesRoot, getTheokitHome, migrateSchema, readVersionedJson, writeVersionedJson } from '../../chunk-ZS6SLELQ.js';
+export { JsonlParseError, appendJsonl, loadJsonl, readJsonlIds, withFileLock } from '../../chunk-ZNW2TXLO.js';
+export { applyWalWithFallback, containsCjk, isCorruptionError, openSqliteResilient, sanitizeFts5Query } from '../../chunk-2WB6EIYW.js';
 export { withCwdMutex } from '../../chunk-2XLKLVVR.js';
-export { atomicWriteJson, atomicWriteText, replaceFileAtomic } from '../../chunk-5XPKYDK7.js';
-import '../../chunk-VQ33XLC6.js';
-import '../../chunk-RNCN2TTP.js';
+export { atomicWriteJson, atomicWriteText, replaceFileAtomic } from '../../chunk-VQFSEKU5.js';
+import '../../chunk-MRKSSN36.js';
+import '../../chunk-PBML2FHN.js';
 import { open } from 'fs/promises';
 
 async function createExclusive(path, data, options) {

package/dist/internal/persistence/jsonl.d.cts

@@ -25,7 +25,7 @@ export declare function loadJsonl<T = Record<string, unknown>>(path: string, opt
  * the event loop serializes writes and each call writes its line atomically —
  * interleave-safe for the bounded-concurrency batch runner.
  *
- * referencia: swebench-batch.ts:192 (mkdir-before-append), :205 (per-line flush).
+ * reference: swebench-batch.ts:192 (mkdir-before-append), :205 (per-line flush).
  */
 export declare function appendJsonl(path: string, record: unknown): void;
 /**
@@ -35,7 +35,7 @@ export declare function appendJsonl(path: string, record: unknown): void;
  * interrupted append is tolerated (skipped, not thrown), and a missing file
  * yields an empty set.
  *
- * referencia: swebench-batch.ts:113 (readDoneIds), :129 (success-only),
+ * reference: swebench-batch.ts:113 (readDoneIds), :129 (success-only),
  * :131 (tolerate partial line).
  */
 export declare function readJsonlIds(path: string, keyFn: (parsed: Record<string, unknown>) => string | undefined): Set<string>;

package/dist/internal/persistence/jsonl.d.ts

@@ -25,7 +25,7 @@ export declare function loadJsonl<T = Record<string, unknown>>(path: string, opt
  * the event loop serializes writes and each call writes its line atomically —
  * interleave-safe for the bounded-concurrency batch runner.
  *
- * referencia: swebench-batch.ts:192 (mkdir-before-append), :205 (per-line flush).
+ * reference: swebench-batch.ts:192 (mkdir-before-append), :205 (per-line flush).
  */
 export declare function appendJsonl(path: string, record: unknown): void;
 /**
@@ -35,7 +35,7 @@ export declare function appendJsonl(path: string, record: unknown): void;
  * interrupted append is tolerated (skipped, not thrown), and a missing file
  * yields an empty set.
  *
- * referencia: swebench-batch.ts:113 (readDoneIds), :129 (success-only),
+ * reference: swebench-batch.ts:113 (readDoneIds), :129 (success-only),
  * :131 (tolerate partial line).
  */
 export declare function readJsonlIds(path: string, keyFn: (parsed: Record<string, unknown>) => string | undefined): Set<string>;

package/dist/internal/persistence/session-artifacts.d.cts

@@ -0,0 +1,27 @@
+/**
+ * The kinds of file this SDK leaves in a project's transcript directory.
+ *
+ * - `transcript` — the session itself (`transcriptPath`).
+ * - `writer-lock` — the cross-process writer lease (`session-writer.ts`, `<file>.writer.lock`).
+ * - `lock-directory` — `withFileLock`'s companion, taken by `mkdir`, so it is a DIRECTORY.
+ * - `temp` — what `replaceFileAtomic` leaves when a process dies between the open and the rename.
+ */
+export type SessionArtifact = "transcript" | "writer-lock" | "lock-directory" | "temp";
+/**
+ * U-1 — what is this entry, if it is one of ours?
+ *
+ * The SDK writes four kinds of file into a project directory and reasons about none of them
+ * afterwards: there is no retention, no collector, and there was no way even to ask what an entry
+ * IS. A consumer wanting to reclaim disk had to re-derive the suffixes by reading this source — and
+ * one did, which means a suffix changing here would have left its classifier silently mislabelling
+ * files on a path that deletes them.
+ *
+ * This is deliberately NOT a garbage collector. Retention is policy — how many days, how many to
+ * keep, which session is live, whether to delete at all — and policy belongs to the application,
+ * which is the only one that can know. What belongs here is the half only the SDK can answer.
+ *
+ * `undefined` means "not written by this SDK", and it is the answer that matters most: a caller
+ * deleting what it does not recognise is how an editor's swap file gets collected. The `temp` case
+ * defers to {@link atomicWriteTempTarget} rather than matching `.tmp`, for exactly that reason.
+ */
+export declare function classifySessionArtifact(name: string, isDirectory: boolean): SessionArtifact | undefined;

package/dist/internal/persistence/session-artifacts.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The kinds of file this SDK leaves in a project's transcript directory.
+ *
+ * - `transcript` — the session itself (`transcriptPath`).
+ * - `writer-lock` — the cross-process writer lease (`session-writer.ts`, `<file>.writer.lock`).
+ * - `lock-directory` — `withFileLock`'s companion, taken by `mkdir`, so it is a DIRECTORY.
+ * - `temp` — what `replaceFileAtomic` leaves when a process dies between the open and the rename.
+ */
+export type SessionArtifact = "transcript" | "writer-lock" | "lock-directory" | "temp";
+/**
+ * U-1 — what is this entry, if it is one of ours?
+ *
+ * The SDK writes four kinds of file into a project directory and reasons about none of them
+ * afterwards: there is no retention, no collector, and there was no way even to ask what an entry
+ * IS. A consumer wanting to reclaim disk had to re-derive the suffixes by reading this source — and
+ * one did, which means a suffix changing here would have left its classifier silently mislabelling
+ * files on a path that deletes them.
+ *
+ * This is deliberately NOT a garbage collector. Retention is policy — how many days, how many to
+ * keep, which session is live, whether to delete at all — and policy belongs to the application,
+ * which is the only one that can know. What belongs here is the half only the SDK can answer.
+ *
+ * `undefined` means "not written by this SDK", and it is the answer that matters most: a caller
+ * deleting what it does not recognise is how an editor's swap file gets collected. The `temp` case
+ * defers to {@link atomicWriteTempTarget} rather than matching `.tmp`, for exactly that reason.
+ */
+export declare function classifySessionArtifact(name: string, isDirectory: boolean): SessionArtifact | undefined;

package/dist/internal/persistence/session-transcript.d.cts

@@ -61,7 +61,7 @@ export declare class SessionTranscript {
  */
 export declare function reconstructMessages(records: readonly SessionRecord[]): LlmMessage[];
 /**
- * Raiz do estado de transcript.
+ * Root of the transcript state.
  *
  * `THEOKIT_HOME` wins; the fallback is `~/.theokit`. Home-anchored on purpose, and NOT
  * `paths.ts`'s `getTheokitHome(cwd)`: that one falls back to `<cwd>/.theokit`, and switching

package/dist/internal/persistence/session-transcript.d.ts

@@ -61,7 +61,7 @@ export declare class SessionTranscript {
  */
 export declare function reconstructMessages(records: readonly SessionRecord[]): LlmMessage[];
 /**
- * Raiz do estado de transcript.
+ * Root of the transcript state.
  *
  * `THEOKIT_HOME` wins; the fallback is `~/.theokit`. Home-anchored on purpose, and NOT
  * `paths.ts`'s `getTheokitHome(cwd)`: that one falls back to `<cwd>/.theokit`, and switching

package/dist/internal/runtime/context/context-discovery-runner.d.ts

@@ -24,4 +24,13 @@ export interface DiscoveryRunnerOptions {
     readonly touchedFiles?: ReadonlyArray<string>;
     /** When true, skip `theokit-context` spec — caller already handles the legacy path. */
     readonly skipLegacyTheokitContext?: boolean;
+    /**
+     * The root an `@import` may not escape. Defaults to `gitRoot ?? cwd` — the same value
+     * this runner already uses to keep absolute paths out of `<source name="">`.
+     *
+     * Present so an embedder with a trust boundary narrower than the repository can declare
+     * it. Absent, the repository IS the boundary, which is the honest default for a document
+     * discovered by walking the repository.
+     */
+    readonly importRoot?: string;
 }

package/dist/internal/runtime/context/context-import-resolver.d.ts

@@ -21,4 +21,21 @@ export interface ResolveImportsOptions {
     readonly depth: number;
     /** Per-import file cap (EC-D). Forwarded to loadPlainMarkdown. */
     readonly maxBytesPerFile: number;
+    /**
+     * The directory an import may not escape. When set, a target resolving outside it is
+     * refused and replaced with a placeholder.
+     *
+     * The file carrying the import is REPOSITORY-CONTROLLED — `CLAUDE.md` and `GEMINI.md`
+     * are the two default specs with `followImports: true`, and both are found by
+     * `git-root-walk` inside the tree the agent was pointed at. Without a root, a cloned
+     * repository could name `@~/.ssh/id_rsa` or any absolute path and have its contents
+     * inlined into the system prompt, and from there sent to the model provider. The
+     * traversal guard that already existed (`isSafePattern`) guards the discovery PATTERN,
+     * not the import TARGET, so it never saw this.
+     *
+     * OPTIONAL, so a caller outside the discovery path keeps the previous behaviour rather
+     * than breaking on an upgrade. `runDiscovery` always supplies `gitRoot ?? cwd` — the
+     * same value it already uses to keep absolute paths out of `<source name="">`.
+     */
+    readonly projectRoot?: string;
 }

package/dist/internal/runtime/lifecycle/env-policy.d.ts

@@ -5,7 +5,7 @@
  * so API keys, tokens and passwords leaked into hook scripts and shell tools.
  * `resolveChildEnv` computes the env a child receives under an explicit policy,
  * modeled on codex's `ShellEnvironmentPolicy`
- * (referencia: codex/codex-rs/protocol/src/shell_environment.rs).
+ * (reference: codex/codex-rs/protocol/src/shell_environment.rs).
  *
  * Modes:
  *  - `inherit-scrubbed` (DEFAULT) — inherit all parent vars EXCEPT secret-like