@bendyline/gezel-service 1.0.2 → 1.0.4

package/dist/handboek-content/whats-new/1.26226.md

@@ -0,0 +1,89 @@
+---
+id: whats-new/1.26226
+title: 1.26226 — 14 August 2026
+order: -26226
+summary: Five more models on the scorecard, file problems you can hand straight to a gezel, a much fuller terminal app, and memory that keeps working when its index breaks.
+---
+
+# 1.26226 — 14 August 2026
+
+Two days of work since **1.26224**, and a dense two days.
+
+If you read only one thing: the problems gezel finds in your files stopped being a list you read and became work you can hand to someone, the terminal version of gezel caught up with the app, and the model scoreboard more than doubled.
+
+Also: a new model - Qwen 3.8 27B Q4 - is now available. We're doing more testing and additional tuning over the next couple days, but if Qwen 3.6 is any indication, it should be really good!
+
+## Problems in your files became work you can hand off
+
+Gezel's *boekwachter* — the keeper of the books, the crew member who reads through a project and notes what looks wrong — used to produce a list. You read it, and then it was on you.
+
+Now each finding is a tracked issue with its own reference (`BW-1`, `BW-2`, and so on) that survives restarts and re-scans. Each one is **open**, **in progress**, **resolved** or **dismissed**, and you move it between those yourself. Closed ones fold away until you ask to see them.
+
+The part that matters: there is now a **Fix this** button. Press it and gezel opens a dialog that has already worked out what kind of gezel this file needs — a writer for a document, a designer for an image, a developer for code, a researcher for a spreadsheet — and offers you the ones on your crew who fit. Choose one and it becomes a task, linked back to the issue, so the file, the finding and the work are the same thread rather than three things you hold in your head. Each file also shows a plain health score out of ten and the reason behind it.
+
+## The terminal app caught up
+
+If you use `gezel` from a terminal, this release is mostly for you.
+
+- Many stability fixes for the npm '@bendyline/gezel-cli' package and command line
+- `/open` — type it in a chat and gezel offers you the files that conversation just touched, plus the project's artifacts and workspace folders, and opens the one you pick. This works in the desktop app's message box too.
+- `gezel mode <read-only|reactive|reactive+tasks|full-play>`, or `/mode` inside a session — the same four settings for how much gezel is allowed to do on its own that the app has, now in one word from the command line.
+- `gezel do <craftbook>` and `/do` — start a piece of standard work (a *craftbook* is gezel's word for a written-down procedure) without leaving the terminal.
+- `/allow` and `/disallow` — turn a project's write permissions on and off in place.
+- `/model download` — pick and fetch a new on-device model from inside a session.
+- First-run setup in the terminal now shows the same model information the app does, and pressing Ctrl+C actually shuts down the background service it started instead of leaving it running.
+
+The rest of the commands are in the [command-line reference](../technical/cli-reference.md).
+
+## Memory that does not give up
+
+Your gezels' memories are ordinary Markdown files, and a search index sits on top of them to make recall fast. Previously, trouble with the index could take memory down with it — a first-time download of the search model failing because you were offline was enough to turn memory off for the rest of the session.
+
+That is fixed in three places. Saving a memory now always writes the Markdown first, and reports the indexing as deferred rather than failing; the index catches up on its own afterwards. Searching falls back to plain text search when the fast path is unavailable, and tells you it did. And a failed model download is now treated as something that might clear — gezel waits a minute and tries again, instead of concluding that memory is broken.
+
+## Connectors are now an explicit preview
+
+Connectors — the things that pull a calendar, a repository or a social account into a project — have moved behind a switch in **Settings → Advanced → Show very early work-in-progress features**, and it is off. So are the project types and craftbooks that depend on them.
+
+This is a step back in visibility and a step forward in honesty. They are not finished, they change shape between releases, and having them sitting in every project's settings implied a stability they do not have yet.
+
+Behind that switch, they got considerably better. Bluesky, X, LinkedIn and Instagram joined the connectors gezel can talk to, with a deliberate three-step path to publishing anything: a gezel **drafts** a post, **queues** it, and only then can **publish** it — and publishing is denied unless you have said otherwise, one time at a time. Overnight work never publishes; it leaves things in the outbox for you. Gezel ships no social-media app credentials of its own, so connecting an account means registering your own developer app, which the connection panel now walks you through and stores the secret in your operating system's keychain. Posts and mentions that come back land in the project's artifacts and are searchable alongside everything else.
+
+## Five more models measured
+
+The [Model scorecard](../technical/model-scorecard.md) went from four models to nine.
+
+The new entries are **gemma4-26b**, **qwen3.6-27b**, **qwen3.6-35b-a3b**, **muse-glimmer-30b** and **nemotron3.5-lightning-30b**, all measured the same way as the first four: every job run three times on a real machine and checked by a program. The picture that emerges is more interesting than "bigger is better". On general capability, gemma4-26b and qwen3.6-27b both finished every job. On the office and knowledge set, the small ornith-9b still beats several models three times its size. And qwen3.6-27b and qwen3.6-35b-a3b earn the highest marks from the separate quality read, at a fraction of the memory gemma4-26b needs.
+
+[How we test models](../technical/how-we-test-models.md) explains what the numbers do and do not tell you. It is worth five minutes before you pick.
+
+While you are on the models screen, every catalog model now says **who made it and who prepared the version you download**. Those are often different organizations — a company trains the model, someone else converts and compresses it so it runs on your machine — and until now gezel showed you only one name. The terminal app shows the same line when it offers you a model.
+
+
+## Smaller things
+
+- **A job's single gezel is now called the Builder** rather than the Ambachtsman. Same gezel, a more simple word.
+- **Codex and Claude sessions have their own permission setting per project**, separate from what gezel's own tools may do — so you can let one edit and keep the other reading.
+- **Settings → About lists your running local engines** and, for each, the context window it actually got at launch. A model that suddenly seems to have lost the plot is very often one whose window came out smaller than the instructions it carries; this turns that from a log hunt into a glance.
+- **The "stop everything" button now also unloads local engines** and drops gezel to Reactive, and it is reachable from Settings as well as the engine pill.
+- **Model files gezel cannot read appear under "Models needing attention"** with their size and an Update or Remove button, instead of vanishing while still using your disk.
+- **App updates show a real download progress bar** rather than an unmoving "downloading".
+- **If gezel itself crashes, you get a plain dialog** offering to open a pre-filled report in your browser. Nothing is sent anywhere unless you press it.
+- **Your graphics setup is re-checked at every launch**, so installing or removing a driver is noticed instead of remembered wrongly from the first run.
+- **The prompt cache display no longer counts shared groundwork as conversations**, so the number matches what you have open.
+- **Craftbooks now say what each step is supposed to produce**, and the finished result is checked against that rather than against the attempt.
+- **Asking for the same piece of work twice in one turn returns the task already running** instead of starting a duplicate.
+- Refreshed underlying editor and catalog content packages (squisq 2.7.2, gilde 0.1.28).
+
+## For developers
+
+- **The Output Pane API (**`window.gezel`**) is documented and at version 1.** Interactive pages pinned into a project's Output pane get a frozen `gezel` object with `page`, `tools`, `data` and `ui` — reads are declared in the project type's manifest and enforced per request on the server, so a page can never read past its declaration. The earlier hand-rolled postMessage pattern keeps working.
+- **Pull request files and diffs are properly paginated** for tools that read them, so a large PR no longer silently loses its later files.
+- **Dependency operations in the repository are leased.** `pnpm deps:status` diagnoses, `pnpm deps:install` adds only what is genuinely missing, and `pnpm deps:repair` is the one explicit reconciliation path; builds and tests hold a shared read lease and can run alongside each other.
+- `node-pty`** is now an optional dependency**, so an npm install of gezel no longer fails on machines without a build toolchain.
+
+## Anything to do?
+
+No. Update when you are offered it.
+
+Two settings are worth a visit. If connectors disappeared from your projects, they are behind **Settings → Advanced → Show very early work-in-progress features** — turn it on and they come back exactly as they were. And if you run models on your own machine, the new scorecard entries may change which one you want: start at the [Model scorecard](../technical/model-scorecard.md).

package/dist/handboek.js

@@ -344,11 +344,16 @@ var DELEGATION_ORCHESTRATOR_ROLES = /* @__PURE__ */ new Set([
   "voorman",
   "planner"
 ]);
-function roleDelegationGroups(role) {
+function roleDelegationGroups(role, isProjectVoorman) {
   const canonical = canonicalRoleKey(role);
+  if (isProjectVoorman) return ["role-delegation-escalation"];
   if (canonical && DELEGATION_ORCHESTRATOR_ROLES.has(canonical)) return ["role-delegation"];
   return ["role-delegation-escalation"];
 }
+var PROJECT_VOORMAN_SELF_ESCALATION_TOOLS = /* @__PURE__ */ new Set([
+  "delegate_voorman",
+  "consult_voorman"
+]);
 var CONSULTATION_STRIPPED_TOOLS = /* @__PURE__ */ new Set(["ask_specialist", "ask_gezel"]);
 var VOORMAN_STRIPPED_MEESTER_TOOLS = /* @__PURE__ */ new Set([
   "create_gezel",
@@ -423,6 +428,7 @@ var GITHUB_REMOTE_TOOLS = /* @__PURE__ */ new Set([
   "github_pr_list",
   "github_pr_view",
   "github_pr_files",
+  "github_pr_file",
   "github_pr_diff",
   "github_pr_comments",
   "github_pr_comment",
@@ -462,7 +468,7 @@ function computeToolAllowlist(opts) {
   }
   const hasToolsetOverride = !!opts.toolsetsGroupOverride && opts.toolsetsGroupOverride.length > 0;
   const roleBaseGroups = hasToolsetOverride ? opts.toolsetsGroupOverride : roleToolsetGroups(opts.role);
-  const baseGroups = opts.rolesAsTools ? [...roleBaseGroups, ...roleDelegationGroups(opts.role)] : roleBaseGroups;
+  const baseGroups = opts.rolesAsTools ? [...roleBaseGroups, ...roleDelegationGroups(opts.role, opts.isProjectVoorman === true)] : roleBaseGroups;
   const needsTeamStrip = opts.projectMode === "solo" || opts.consultationMode === true;
   const groups = needsTeamStrip ? stripTeamManagement(baseGroups) : baseGroups;
   let resolved = applyGates(expandToolsetGroups(groups));
@@ -482,6 +488,11 @@ function computeToolAllowlist(opts) {
     for (const name of VOORMAN_STRIPPED_DELEGATION_TOOLS) next.delete(name);
     resolved = next;
   }
+  if (opts.isProjectVoorman === true) {
+    const next = new Set(resolved);
+    for (const name of PROJECT_VOORMAN_SELF_ESCALATION_TOOLS) next.delete(name);
+    resolved = next;
+  }
   if (resolved.has("replace_in_file") && !resolved.has("replace_lines")) {
     const next = new Set(resolved);
     next.add("replace_lines");

package/dist/index-store/static-index-worker.js

@@ -253,6 +253,7 @@ import { join, relative } from "path";
 // src/git/git.ts
 import { spawn } from "child_process";
 import { realpath } from "fs/promises";
+import { windowsHeadlessSpawnOptions } from "@bendyline/gezel/native";
 var GitError = class extends Error {
   constructor(message, code, stderr) {
     super(message);
@@ -313,11 +314,13 @@ async function runGit(args, opts = {}) {
     const child = hasStdinPayload ? spawn("git", gitArgs, {
       cwd: opts.cwd,
       env,
-      stdio: ["pipe", "pipe", "pipe"]
+      stdio: ["pipe", "pipe", "pipe"],
+      ...windowsHeadlessSpawnOptions()
     }) : spawn("git", gitArgs, {
       cwd: opts.cwd,
       env,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["ignore", "pipe", "pipe"],
+      ...windowsHeadlessSpawnOptions()
     });
     const stdinState = {};
     if (hasStdinPayload) {
@@ -1012,7 +1015,7 @@ import { mkdtemp, realpath as realpath3, rm as rm2, writeFile as writeFile2 } fr
 import { tmpdir } from "os";
 import { isAbsolute as isAbsolute2, join as join3 } from "path";
 import { pathToFileURL } from "url";
-import { windowsHeadlessSpawnOptions } from "@bendyline/gezel/native";
+import { windowsHeadlessSpawnOptions as windowsHeadlessSpawnOptions2 } from "@bendyline/gezel/native";
 
 // src/sandbox/macos.ts
 function runUnderMacSandbox(command, args, ctx, opts = {}) {
@@ -1163,7 +1166,7 @@ async function readNodeHelp(nodeBin) {
       env: sandboxEnv(process.env),
       // The capability probe is owned and awaited. Hide its Windows console
       // rather than giving the short-lived process a detached one.
-      ...windowsHeadlessSpawnOptions()
+      ...windowsHeadlessSpawnOptions2()
     });
     let stdout = "";
     let stderr = "";
@@ -1189,7 +1192,7 @@ async function runSandboxChild(command, args, opts) {
       // Windows tree cleanup follows parent PIDs instead, so detaching there
       // only creates a new console window; keep it owned and hidden.
       detached: process.platform !== "win32",
-      ...windowsHeadlessSpawnOptions(),
+      ...windowsHeadlessSpawnOptions2(),
       // Allowlist-scrub the env — inheriting everything leaked tokens
       // (GEZEL_TOKEN, OPENAI_API_KEY, GITHUB_PERSONAL_ACCESS_TOKEN,
       // etc.) into the sandboxed script, letting it `fetch` them

package/dist/index.d.ts

@@ -2293,6 +2293,17 @@ interface PromptCtx extends ModelCtx {
 interface TurnCtx extends ModelCtx {
     sessionId: string;
     isMeester: boolean;
+    /** Project receiving this turn. `default` is the unscoped front-door context. */
+    projectId: string;
+    /**
+     * Provenance of the user-role message. Provider schemas use `user` for
+     * human composer turns, question answers, gezel handoffs, and service
+     * nudges alike; behaviors need this stronger signal before applying
+     * user-intent routing such as the Meester new-project prelude.
+     */
+    messageOrigin: 'direct-user' | 'question-answer' | 'cross-gezel' | 'background-nudge' | 'system';
+    /** Canonical/unqualified plus provider-advertised live tool names. */
+    availableToolNames: ReadonlyArray<string>;
     /** Verbatim user-message text for this turn. */
     userText: string;
     /** Tool calls that drained from the per-turn accumulator. */
@@ -5287,6 +5298,12 @@ interface SearchResult {
 
 interface SaveOutcome {
     status: 'saved' | 'duplicate';
+    /** False means Markdown is durable and the derived vector cache needs repair. */
+    indexed?: boolean;
+    degraded?: {
+        code: 'semantic_index_unavailable';
+        message: string;
+    };
     /** Populated on 'duplicate': what it matched and how. */
     match?: {
         text: string;
@@ -5294,6 +5311,16 @@ interface SaveOutcome {
         via: 'exact' | 'vector';
     };
 }
+type MemorySearchMode = 'semantic' | 'hybrid' | 'lexical';
+interface MemorySearchOutcome {
+    results: SearchResult[];
+    mode: MemorySearchMode;
+    /** Present when a semantic-search failure forced the source-text fallback. */
+    degraded?: {
+        code: 'semantic_search_unavailable';
+        message: string;
+    };
+}
 interface MemoryManagerOptions {
     /** Override {@link MEMORY_DEDUP_THRESHOLD} (tests). */
     dedupThreshold?: number;
@@ -5315,8 +5342,8 @@ declare class MemoryManager {
      * that text dedups, so we accept the race rather than lock.
      *
      * Degraded mode (embeddings disabled): markdown is still appended (it is
-     * the source of truth and the index self-heals on rebuild) and the
-     * EmbeddingsDisabledError propagates, preserving the pre-dedup contract.
+     * the source of truth) and the outcome reports deferred indexing. The health
+     * monitor self-heals the derived index once embeddings recover.
      */
     save(scope: 'gezel' | 'project', id: string, text: string, kind?: MemoryKind): Promise<SaveOutcome>;
     /**
@@ -5347,6 +5374,15 @@ declare class MemoryManager {
      */
     hasIndex(scope: 'gezel' | 'project', id: string): boolean;
     searchAll(gezelId: string, projectId: string, query: string, topK?: number): Promise<SearchResult[]>;
+    /**
+     * Search both scopes with one query embedding. Missing indexes fall back to
+     * the daily Markdown source; an unavailable/corrupt semantic cache does the
+     * same and reports a degraded mode instead of turning an optional feature
+     * into an HTTP 500.
+     */
+    searchAllDetailed(gezelId: string, projectId: string, query: string, topK?: number): Promise<MemorySearchOutcome>;
+    private searchAllLexical;
+    private searchLexical;
     listDays(scope: 'gezel' | 'project', id: string): Promise<string[]>;
     readDay(scope: 'gezel' | 'project', id: string, day: string): Promise<string>;
     /**
@@ -6095,9 +6131,17 @@ declare class TaskManager {
     private onTaskSettled?;
     private onTaskNeedsHelp?;
     private onConnectorPrep?;
+    private readonly autoPreparedConnectorTypes;
     private scriptRunner?;
     private craftbookResolver?;
     private roleResolver?;
+    /**
+     * Join concurrent replays of the same step transition. Local models can
+     * retry an MCP call when its response is slow; without single-flight both
+     * requests read the same active step and independently run gates, scripts,
+     * recruitment, and handoff hooks before either write becomes visible.
+     */
+    private readonly inFlightStepCompletions;
     constructor(store: Store, history?: HistoryManager | undefined);
     /**
      * Wake a project that was resting in `stable` because live work just
@@ -6167,7 +6211,9 @@ declare class TaskManager {
      * still enforced (a required, unbound connector fails the launch), but
      * nothing syncs.
      */
-    setConnectorPrepHook(fn: ConnectorPrepHook): void;
+    setConnectorPrepHook(fn: ConnectorPrepHook, opts?: {
+        autoPreparedTypes?: readonly string[];
+    }): void;
     /**
      * Fire the needs-help hook (fire-and-forget, errors logged). Public so
      * the scheduler's stalled-step escalation can report through the same
@@ -6247,7 +6293,7 @@ declare class TaskManager {
     addStep(projectId: string, num: number, input: NewCraftbookStep, pos?: StepPosition): Promise<Task>;
     /**
      * Patch a single step's mutable fields (`description`, `prompt`,
-     * `assignee`, `suggestedGezelId`). `undefined` means "leave alone";
+     * `consumes`, `assignee`, `suggestedGezelId`). `undefined` means "leave alone";
      * explicit `null` on the optional fields means "clear it." Returns
      * the updated task. Returns `null` when the step id doesn't exist.
      */
@@ -6875,6 +6921,7 @@ interface ProviderCacheStats {
     providerName: string;
     totalBytes: number;
     budgetBytes: number;
+    /** All entries, including reusable `prefix-*` entries; legacy field name. */
     warmSessionCount: number;
     hits: number;
     misses: number;
@@ -8477,6 +8524,7 @@ interface TaskBudgetSnapshot {
     inputTokens: number;
 }
 
+type TurnMessageOrigin = 'direct-user' | 'question-answer' | 'cross-gezel' | 'background-nudge' | 'system';
 interface GateScriptDiagnostic {
     scriptName: string;
     runId?: string;
@@ -9368,9 +9416,10 @@ declare class ChatManager {
         cancelled: boolean;
     }>;
     /**
-     * Install-wide panic stop for chat work. The engagement-mode cache flips
-     * synchronously before any teardown awaits, so task runners and autonomous
-     * follow-ups cannot admit replacement turns while the current ones unwind.
+     * Install-wide panic stop for chat work and resident providers. The
+     * engagement-mode cache flips synchronously before any teardown awaits, so
+     * task runners and autonomous follow-ups cannot admit replacement turns
+     * while the current ones unwind.
      * Pending user messages and after-idle handoffs are deliberately discarded:
      * leaving either queue intact would make an "emergency stop" immediately
      * restart work as soon as the cancelled provider call releases its slot.
@@ -9480,6 +9529,14 @@ declare class ChatManager {
          * prompt. See ChatSession.consultationMode for the full contract.
          */
         consultationMode?: boolean;
+        /**
+         * Pin the session's name-rendering mode ("boring mode") instead of
+         * following the live config flag. Passed by clients with a fixed
+         * presentation mode (the TUI) so the prompt's gezel references match
+         * the labels that client renders. See
+         * `ChatSessionSchema.roleBasedNameOnlyMode`.
+         */
+        roleBasedNameOnlyMode?: boolean;
         /**
          * Shape-of-deliverable hint persisted on the session. When
          * `kind: "file"` is set, the consultation-mode addendum swaps
@@ -9577,6 +9634,8 @@ declare class ChatManager {
          * advanced, carry on" instead of naming the recipient as the sender.
          */
         fromGezelId?: string;
+        /** Naming presentation inherited from the task's launching session. */
+        roleBasedNameOnlyMode?: boolean;
         /**
          * `'entry'` is a fresh launch (e.g. the command launcher created the
          * task and is starting its entry step) — there is no prior step, so
@@ -10044,6 +10103,8 @@ declare class ChatManager {
          * the message never queued, so it renders as a normal send.
          */
         nudge?: boolean;
+        /** Strong provenance used by per-turn behavior hooks. */
+        messageOrigin?: TurnMessageOrigin;
     }): Promise<ChatMessage>;
     /**
      * Wrap {@link runSend} so its completion — success or error — triggers
@@ -11393,6 +11454,7 @@ declare class ConnectorManager {
      */
     syncBinding(project: ProjectDetail, bindingId: string, opts?: {
         scopes?: readonly string[];
+        backfillLimit?: number;
     }): Promise<BindingSyncResult>;
     /** Sync every enabled binding on a project (drives the sync manager). */
     syncProject(project: ProjectDetail): Promise<BindingSyncResult[]>;
@@ -12120,6 +12182,8 @@ interface TaskRunnerDispatcher {
         fromGezelName?: string;
         fromGezelId?: string;
         kind?: 'handoff' | 'entry';
+        /** Naming presentation pinned by the task that owns this handoff. */
+        roleBasedNameOnlyMode?: boolean;
         /**
          * Queue lane for the dispatched turn. Task handoffs travel
          * `'background'` so a typed chat always drains first; Night Shift also
@@ -12491,6 +12555,25 @@ declare class CodeReviewManager {
     private mutate;
 }
 
+interface GitHubPullFilesPage {
+    files: GitHubPullFile[];
+    allFiles: number;
+    totalFiles: number;
+    offset: number;
+    limit: number;
+    hasMore: boolean;
+    nextOffset?: number;
+    includesPatch: boolean;
+}
+interface GitHubPullDiffPage {
+    diff: string;
+    path?: string;
+    offset: number;
+    returnedChars: number;
+    totalChars: number;
+    truncated: boolean;
+    nextOffset?: number;
+}
 declare class GitHubPrs {
     private readonly manager;
     constructor(manager: GitManager);
@@ -12505,7 +12588,20 @@ declare class GitHubPrs {
      */
     listFiles(project: ProjectDetail, num: number, opts?: {
         patchLimit?: number;
+        includePatch?: boolean;
     }): Promise<GitHubPullFile[]>;
+    /**
+     * A bounded, explicitly paginated view for API/tool consumers. Metadata is
+     * complete for the selected page before any optional patch bodies appear,
+     * so a bridge cap can no longer erase the existence of later files.
+     */
+    listFilesPage(project: ProjectDetail, num: number, opts?: {
+        offset?: number;
+        limit?: number;
+        paths?: readonly string[];
+        includePatch?: boolean;
+        patchLimit?: number;
+    }): Promise<GitHubPullFilesPage>;
     listComments(project: ProjectDetail, num: number): Promise<GitHubPullComment[]>;
     /**
      * Fetch the unified diff for a PR via the `application/vnd.github.v3.diff`
@@ -12517,6 +12613,12 @@ declare class GitHubPrs {
     getPullRequestDiff(project: ProjectDetail, num: number, opts?: {
         limit?: number;
     }): Promise<string>;
+    /** Bounded diff page with machine-readable continuation metadata. */
+    getPullRequestDiffPage(project: ProjectDetail, num: number, opts?: {
+        offset?: number;
+        limit?: number;
+        path?: string;
+    }): Promise<GitHubPullDiffPage>;
     /**
      * Post a top-level (issue-style) comment to a PR. Returns the new
      * comment id + URL so callers can link the user/model to it.