@gajae-code/coding-agent 0.10.1 → 0.11.0

package/CHANGELOG.md

@@ -2,18 +2,84 @@
 
 ## [Unreleased]
 
+## [0.11.0] - 2026-07-15
+
+### Fixed
+- Input-free interactive TTY startup now keeps the TUI reachable when configured model profiles are missing required provider credentials, skips only the blocked profiles, and preserves later `--mpreset` and explicit model/thinking precedence; redirected terminals, input-bearing, resume-continuation, image-only, print/text, and unrelated activation failures remain fail-closed (#2277).
+- Browser geo settings now propagate coherently across request `Accept-Language`, navigator languages, and `Intl` locale/timezone surfaces; configured managed browsers are isolated by geo/profile posture, concurrent acquisition is serialized, and unset geo preserves Chromium's native locale/timezone instead of injecting a fixed New York profile.
+
+- Cooperative mid-run context maintenance now waits at a cancellation-aware FIFO consumer-drain checkpoint before flushing or rewriting session history. Materialized tool results and steering messages are synchronously canonicalized first; aborted barriers and hook/signal-cancelled compactions settle without rewriting or scheduling a continuation. Promotion, pruning, and compaction each start a clean provider/prompt-cache epoch. Script-aware #2067 unsent-delta accounting remains cache-free and distinct from the lifecycle checkpoint.
+- Classified the cooperative mid-run maintenance driver and token estimator test seams as locked non-public SDK exclusions, restoring deterministic operation-inventory generation and post-merge dev CI coverage.
+- Accepted SDK prompts now deliver correlated `agent_start` and exactly one terminal lifecycle frame directly to the requesting authenticated WebSocket connection while retaining replayable host events. Harness owner observation also waits for every previously accepted frame to finish serial persistence, so message-update storms and polling gaps cannot hide sticky completion evidence (#2169).
+
+### Added
+
+- Added the additive SDK Q10 model-catalog DTO: `Q10`, `models.list/current`, `models.list`, and `models.current` now return the same paged registry rows with reasoning/thinking capability metadata and current-model readback. `thinking.validLevels` is an `off`-first canonical menu; sparse raw reasoning descriptors remain available for inspection. The public DTO types are exported from `@gajae-code/coding-agent/sdk`, while undocumented `/sdk/models` deep imports remain unavailable. `inherit` is readback-only and malformed descriptors fail with a safe internal SDK error (#2163).
+- Gajae Pet selection is now terminal-capability aware: unsupported terminals show an actionable warning (with multiplexer-specific guidance for tmux/screen/zellij, including the `PI_FORCE_IMAGE_PROTOCOL=sixel` expert opt-in), `/pet` and Settings disable the unavailable `RedGajae`/`BlueGajae` choices while `off` stays selectable, a saved-but-unavailable choice is identified as `(saved)`, and the public command names are consistent across execution, completion, and inline hints (`/pet RedGajae`, `/pet BlueGajae`, `/pet off`, case-insensitive).
+- Added the standalone `@gajae-code/bridge-client` transport-only v3 SDK package. It exports `SdkClient` and its associated types; `@gajae-code/coding-agent/sdk` remains a compatibility re-export with the exact same class identity. Historical BridgeClient backend protocol, handshake, commands, SSE, and host-control bypass surfaces remain unavailable.
+- Added explicit `--mcp-config <absolute-path>` support for one trusted, tools-only MCP config in top-level standalone sessions without enabling automatic user or project MCP discovery; exact reads reject links and identity changes, and MCP tool-name collisions fail closed.
+- Added additive v3 workflow-gate correlation compatibility surfaces (#2171): explicit Rust workflow-frame readers/registration preserve `workflowGateId` without changing legacy `ActionNeeded`, `ServerMessage`, or `register_ask`; N-API retains `registerAsk` and adds correlated/arbitrated registration and exact unclaimed-retirement APIs. Private presentation leases, routes, claims, receipts, epochs, and endpoint generations remain non-public.
+
+### Changed
+
+- Renamed the notifications SDK to the Gajae-Code SDK: `docs/notifications-sdk.md` is now `docs/sdk.md`, `src/notifications/` is now `src/sdk/bus/`, and `src/sdk.ts` is now the `src/sdk/` module directory. Old deep-import specifiers no longer resolve.
+- Moved SDK discovery from `.gjc/state/notifications/` to `.gjc/state/sdk/`. Restart sessions and daemons together when upgrading; the runtime does not dual-scan the old and new directories.
+- Removed the `--mode rpc`, `--mode rpc-ui`, and `--mode bridge` external ingress modes. Machine clients must use the SDK WebSocket interfaces documented in `docs/sdk.md`; no RPC or Bridge compatibility path remains.
+- Documented the current GPT-5.6 Codex and combo profile mappings as product judgments, including the durable `opus-codex` `anthropic/claude-sonnet-5` planner override and `fable-opus-codex` `anthropic/claude-opus-4-8:medium` planner.
+- Resolved the SDK v3 workflow-gate shipping classification (#2171): `workflowGateId` and Q12 diagnostics are additive SDK v3 surfaces, while `action_needed.id` remains the transient, generic `reply.id` authority. `expectedSessionId` omission remains accepted and audited for the entire SDK v3 line; new clients must send it, and mandatory enforcement or removal can occur no earlier than SDK v4 only after at least one full published deprecation release/window with deployed-client notice. Explicit session mismatches fail closed before resolution; mismatched sessions, stale/reissued actions, and unsafe ambiguity never regain authority.
+- Documented release pairing: the `@gajae-code/coding-agent` runtime and `@gajae-code/natives` native addon ship from the same source release at exact matching package versions (currently `0.10.2`), with the native loader version sentinel enforcing the pair. Mixed native/runtime versions are unsupported and cannot claim SDK compatibility.
+### Fixed
+- Startup continuation now participates in the existing managed fallback and in-flight recovery envelope, preventing a retryable resumed turn from publishing `agent_end`/idle before retry success, exhaustion, cancellation, or startup failure has settled (#2092).
+
+- Fenced SDK WebSocket lifecycle callbacks and request settlement to the owning retry cycle/socket incarnation, so stale open, close, error, message, and timeout delivery cannot reject or corrupt work on a replacement connection; sent mutations remain non-replayed and deterministic race regressions cover the reconnect boundary (#2164).
+- Owned LSP stdin `EPIPE` and `ERR_STREAM_DESTROYED` failures now terminalize and evict only the affected client, reject pending and stale requests with a stable transport-closed error, and permit clean client recreation without suppressing serialization or unrelated sink failures (#2138).
+- Serialized fresh prompt preflight and durable default-model selection through deterministic per-session admission, preventing a later `model.set` from overtaking an earlier prompt while preserving provider-stream and continuation behavior (#2199).
+- Direct SDK broker lifecycle hosts now wait for their session-owned startup capability before publishing lifecycle readiness. Only a `started` capability permits a ready marker; failed startup requires proven process, endpoint, and host cleanup before the broker reports `spawn_failed` with no endpoint available, otherwise it preserves terminal uncertainty (#2168).
+- Isolated default source-mode SDK broker and session-host respawns from caller Bun startup policy. Internal children now use fixed `--no-env-file` plus product-owned config/entrypoint paths, scrub `BUN_OPTIONS` and mutable compiled markers, preserve compiled/custom launch compatibility, and clean up owned broker children on startup failure without leaking launch secrets (#2178).
+## [0.10.2] - 2026-07-14
+
+### Added
+
+- Gajae Pet selection is now terminal-capability aware: unsupported terminals show an actionable warning (with multiplexer-specific guidance for tmux/screen/zellij, including the `PI_FORCE_IMAGE_PROTOCOL=sixel` expert opt-in), `/pet` and Settings disable the unavailable `RedGajae`/`BlueGajae` choices while `off` stays selectable, a saved-but-unavailable choice is identified as `(saved)`, and the public command names are consistent across execution, completion, and inline hints (`/pet RedGajae`, `/pet BlueGajae`, `/pet off`, case-insensitive).
+
+### Changed
+
+- Documented the current GPT-5.6 Codex and combo profile mappings as product judgments, including the durable `opus-codex` `anthropic/claude-sonnet-5` planner override and `fable-opus-codex` `anthropic/claude-opus-4-8:medium` planner.
+- RPC clients can now durably select the machine-global default model and effective thinking level for subsequent messages, while project policy and resumed session history retain precedence; a late live-apply failure now restores the prior runtime model and thinking level without masking the original error.
+
+### Fixed
+
+- Gajae Pet overlays no longer leak images or stale pixels across lifecycle changes: each widget owns a randomized Kitty image ID (deleted on disable, replace, switch, and dispose), the previous Sixel footprint is tracked and erased on movement, resize, and narrow-terminal fallback, replaced pet widgets are disposed before their successors install, and a saved pet preference survives editor replacement while graphics are still unavailable (so a delayed Sixel capability probe can still activate it). Teardown is exception-safe and idempotent: a failed or unavailable terminal write never aborts logical disposal or steals a successor widget's overlay slot, and Sixel/Kitty cleanup authority is retained until the erase is actually delivered so a later mode switch or dispose retries it.
+- Gajae Pet cleanup that fails during final widget disposal is now retained by the TUI for retry, and Kitty image IDs remain reserved until their exact-ID delete is delivered.
+- Fixed `gjc --tmux` startup from GNOME and other VTE terminals by recognizing `vte-spawn-*.scope` only when cgroup metadata proves matching user-manager ancestry (#2159).
+- Fixed native Windows `GJC_TMUX_COMMAND=tmux` resolution when WinGet's `tmux.exe` is a psmux alias with a generic `tmux` banner: GJC now compares executable identity with the installed `psmux.exe`/`pmux.exe` companions and fails closed when identity cannot be established instead of authorizing native-tmux semantics (#2086).
+
+- Accepted or declined initial external credential-import decisions now persist across normal restarts and upgrades, suppressing automatic startup and bare `/login` discovery; same-version legacy markers remain compatible and explicit `/provider` import remains available ([#2117](https://github.com/Yeachan-Heo/gajae-code/issues/2117)).
+
+
 ## [0.10.1] - 2026-07-13
 
 ### Added
 
+- Added an owner-proof idle session reaper and `gjc_coordinator_stop_session` for ephemeral (delegate-created) coordinator sessions. Termination goes exclusively through the canonical SDK broker `session.close` lifecycle (durable process identity verified before close) — never a raw `process.kill` or tmux control. The reaper re-validates ephemeral and no-active-turn state at close time under the same per-session mutation lock as delegate reuse, and purges coordinator metadata only after SDK closure is verified, retaining it when closure cannot be confirmed (#2080).
+
 - Added an owner-proof idle session reaper and `gjc_coordinator_stop_session` for ephemeral (delegate-created) coordinator sessions. Termination goes exclusively through the owner-proof `forceCloseGjcTmuxSession` path (pid, native session id, owner generation, server key, and start time all verified before SIGTERM) — never a raw `process.kill`. The reaper binds each close to the persisted runtime-state file, re-validates ephemeral and no-active-turn at kill time under the same per-session mutation lock as delegate reuse, and purges state only on verified termination (#2080).
-- RPC clients can now durably select the machine-global default model and effective thinking level for subsequent messages, while project policy and resumed session history retain precedence.
+- SDK clients can now pass an explicit thinking level to `model.set`, atomically applying the effective model and thinking level to the active session and the machine-global default for future sessions, while project policy and resumed session history retain precedence.
 - Context-usage tokens/% now use provider-reported usage as the single source of truth on every surface. `AgentSession.getContextUsage()` returns a source-tagged snapshot (`source: "provider_anchor" | "heuristic" | "unknown"`), and the status-line `context_pct` segment, inline model percentage, and `/context` totals consume that snapshot instead of recomputing an independent heuristic sum — so footer, status line, `/context`, ACP, and RPC can no longer disagree about the same session state. Heuristic estimation now applies only when no provider anchor exists (session start, aborted/error-only turns), and that fallback now includes the fixed system-prompt/tool/skill context it previously omitted. The pre-prompt compaction estimate honors the latest-compaction boundary (never anchors on stale pre-compaction usage totals), unknown post-compaction usage stays unknown (status line renders `?`; ACP omits the `usage_update` instead of reporting `used: 0`), and `/context` labels its total by provenance with a reconciliation line when the estimated category composition diverges from the provider-reported total.
+- Post-durable default-model-selection failures now expose a stable SDK error with bounded `restored`, `partial`, or `unknown` rollback state; preflight and validation errors remain unchanged.
 ### Fixed
+- Made SDK host startup publish its runtime and initial identity frame before exposing direct-v3 transport endpoints, preventing early replay/control frames from being dropped or dereferencing uninitialized session state under concurrent test and process load.
 
 - IRC deliveries now accept their exchange batch in the recipient's volatile current-session queue before recipient/main UI observations or sender success. Awaited deliveries generate the reply first, then accept the ordered incoming + auto-reply pair and commit the IRC roster claim before observation; provider failures and sender aborts before acceptance leave no ghost exchange, while observer failures after acceptance are isolated. This is not a durability guarantee: durable history injection remains a later flush and no fsync, recovery, persistent IDs, or deduplication was added.
+- `/model` role-agent assignments now replace active model-profile overrides immediately, so changing architect, critic, planner, or executor models and reasoning levels takes effect in the current session and remains persisted afterward.
 - Print mode now records terminal text-mode errors as exit status 1 (or 78 for context overflow) without bypassing output quiescence or session disposal. It retains JSON event delivery through disposal and suppresses `EPIPE` from its owned stdout; `ERR_STREAM_DESTROYED` is suppressed only after that `EPIPE` has latched, while other output failures remain errors.
+- Preserved clipboard image attachments when the interactive editor clears the composer before dispatching the submit callback, so Alt+V image placeholders still send their image blocks instead of placeholder-only text (#2126).
 - Extension contexts now receive a defensive copy from `getSystemPrompt()` instead of the live mutable system-prompt array, so an in-place mutation by an in-process extension can no longer bypass context-revision tracking and serve stale display-only context-usage estimates.
+- Completed bracketed-paste input now returns a manually paged transcript to live output before the paste is dispatched, including asynchronous consumed and unconsumed paste paths.
+- Prevented orphaned background processes by reaping failed detached harness owners and their exact SDK session children with verified TERM/KILL cleanup, giving only the invocation-scoped transport-close capability permission to break a direct owner-stop cycle while every public stop caller awaits truthful teardown, keeping runtime-owner lease/heartbeat authority live while failed teardown retries, binding broker discovery to OS process incarnations before accepting retained ownership, making isolated ACP and broker subprocess tests stop their exact broker before deleting temporary state, and adding a cooperative Telegram daemon watchdog that stops superseded or non-progressing owners.
+- Preserved clipboard image attachments when the interactive editor clears the composer before dispatching the submit callback, so Alt+V image placeholders still send their image blocks instead of placeholder-only text (#2126).
+- Completed bracketed-paste input now returns a manually paged transcript to live output before the paste is dispatched, including asynchronous consumed and unconsumed paste paths.
+- Telegram `/usage` now includes secret-safe 5-hour and weekly limit summaries when normalized provider data is available, `/reasoning` reports effort/scope/display with compatible controls and accurate help, and `/model` offers owner-authorized one-shot inline buttons with stale/invalid callback safeguards (#2095).
 
 ## [0.10.0] - 2026-07-12
 
@@ -30,15 +96,17 @@
 - Added a transport-agnostic, secret-safe shared notification service (status, health, test delivery, ownership-protected recovery) consumed by both the `gjc notify` CLI and the cross-mode `/notify` slash command (TUI + ACP), so onboarding and daemon recovery no longer duplicate daemon/config logic per surface. `/notify` now exposes `status|health|test|recovery|setup` and `gjc notify` gains `health`/`test`/`recovery` with `--probe`/`--message` (#2050).
 - Added beginner-safe `gjc daemon` operational shortcuts sharing one operator contract so the guided human surface and machine-readable `--json` never drift: a `restart` alias that resolves to reload-if-running-else-spawn, concise per-daemon output by default with `--verbose`/`-v` for runtime detail and the full roots list, and an actionable structured recovery path when token/chat ownership mismatches instead of a large payload ending in `blocked`. Exit codes stay 0 on success / 1 on failure (#2057).
 - Added fail-closed ACP session deletion: the delete path refuses rather than proceeding when the target session cannot be safely resolved, and retains the inode in the replacement case (#2074).
+- Added the interactive **Notifications** settings tab with masked Telegram setup, global and session controls, health/test/recovery/reconnect actions, atomic preference saves, and safe blocked-owner recovery guidance (#2050).
 
 ### Changed
 
-- Migrated the repository type-check and release declaration pipeline to stable TypeScript 7.0.2, including the robogjc web workspace and a non-mutating publish-type gate.
+- Migrated the repository type-check and release declaration pipeline to stable TypeScript 7.0.2 with a non-mutating publish-type gate.
 - Rebalanced GPT-5.6 Codex and combo presets around published family tiers and reasoning-effort curves. The executor assignments are informed by descriptive repeated local exact-edit evidence from selected TypeScript tasks; default, planner, architect, and critic assignments remain product judgments rather than benchmark claims.
 - Cache-miss diagnostics now separate actionable, diagnostic-only, and provider-side-suspected causes instead of asserting a user-side fix for every miss (#2020). A large, costly miss with no cache reads or writes is reported as a neutral `Cache notice` marked "provider-side suspected / not user-actionable" (with what GJC cannot determine) rather than telling the user to keep a stable prefix; a miss with reads but no writes is reported as diagnostic-only without asserting a single cause; and the "cache write without enough matching reads" warning now only fires when reads actually fail to cover the writes. The existing miss cost summary and the #1929/#1936 pricing/provenance safeguards are unchanged.
 
 ### Fixed
 
+- Fixed native-Windows coordinator/runtime compatibility by treating psmux's successful empty `list-sessions` response as an absent server while keeping malformed rows fail-closed, reading process incarnations through a validated PowerShell start-time query, sharing the existing BOM-free encoded PowerShell pane command, preserving multiline SDK prompts behind semantic readiness, and retaining runtime command/turn acknowledgement identity across Windows-equivalent workspace paths (#2145).
 - The coordinator MCP owner-server probe now recognizes tmux ≥3.7's missing-server diagnostic (`error connecting to <socket> (No such file or directory)`) as an absent server. tmux 3.7 changed the wording from the older `no server running on <socket>`, which the coordinator probe did not match — so a brand-new coordinator socket (which never has a server yet) was misclassified `unverifiable` instead of `absent`, and **every** `gjc_delegate_*` / session create failed closed with `coordinator_tmux_owner_server_unverifiable` on tmux ≥3.7. The coordinator and `gjc` harness probes now match the same no-server wordings the other owner-isolation probes already did.
 - Preserved explicit Telegram forum-topic renames as durable user-owned names, immediately re-asserting delayed edits while retaining restart and rename-race recovery (#1910).
 - Prevented typed provider safety stops from entering automatic retry loops and aligned ACP refusal reporting with the provider-native classification.

package/dist/types/append-only-mode.d.ts

@@ -1,6 +1,6 @@
 /**
  * Single source of truth for append-only context-mode resolution and manager
- * construction. Both the initial session build (`sdk.ts`) and the runtime
+ * construction. Both the initial session build (`sdk/session.ts`) and the runtime
  * model/setting-change path (`agent-session.ts`), plus the status UI, resolve
  * through here so the auto allowlist and prefix-reset diagnostics never drift.
  */

package/dist/types/cli/args.d.ts

@@ -1,8 +1,5 @@
-/**
- * CLI argument parsing and help display
- */
 import { type Effort } from "@gajae-code/ai";
-export type Mode = "text" | "json" | "rpc" | "acp" | "rpc-ui" | "bridge";
+export type Mode = "text" | "json" | "acp";
 export interface Args {
     cwd?: string;
     allowHome?: boolean;
@@ -17,6 +14,7 @@ export interface Args {
     credential?: string;
     systemPrompt?: string;
     appendSystemPrompt?: string;
+    mcpConfig?: string;
     thinking?: Effort;
     continue?: boolean;
     resume?: string | true;
@@ -25,7 +23,6 @@ export interface Args {
     mode?: Mode;
     noSession?: boolean;
     sessionDir?: string;
-    rpcListen?: string;
     providerSessionId?: string;
     fork?: string;
     models?: string[];
@@ -51,6 +48,8 @@ export interface Args {
     fileArgs: string[];
     /** Retained for test/runtime compatibility; extension-defined flags are no longer parsed. */
     unknownFlags: Map<string, boolean | string>;
+    /** Exact interactive startup login intent, recognized before model-profile activation. */
+    authBootstrap?: true;
 }
 export declare function parseArgs(args: string[]): Args;
 export declare function getExtraHelpText(): string;

package/dist/types/cli/daemon-cli.d.ts

@@ -7,8 +7,16 @@
 import { Settings } from "../config/settings";
 import type { BuiltInDaemonController, DaemonKind } from "../daemon/control-types";
 export type DaemonCliAction = "list" | "status" | "stop" | "reload";
+export type DaemonInternalCliAction = "discord-internal" | "slack-internal";
+export type DaemonCommandAction = DaemonCliAction | DaemonInternalCliAction;
+export declare class UnknownDaemonKindError extends Error {
+    readonly kinds: readonly string[];
+    readonly knownKinds: readonly DaemonKind[];
+    constructor(kinds: readonly string[], knownKinds: readonly DaemonKind[]);
+}
+export declare function isDaemonInternalAction(action: DaemonCommandAction): action is DaemonInternalCliAction;
 export interface DaemonCommandArgs {
-    action: DaemonCliAction;
+    action: DaemonCommandAction;
     kinds: DaemonKind[];
     all: boolean;
     json: boolean;
@@ -16,6 +24,9 @@ export interface DaemonCommandArgs {
     gracefulTimeoutMs?: number;
     killTimeoutMs?: number;
     spawnIfStopped?: boolean;
+    smoke?: boolean;
+    ownerId?: string;
+    agentDir?: string;
     /** Show runtime detail and the full roots list in human output. */
     verbose?: boolean;
 }

package/dist/types/cli/notify-cli.d.ts

@@ -1,11 +1,24 @@
-import type { Settings } from "../config/settings";
+import { Settings } from "../config/settings";
+import { type EnsureChatDaemonResult } from "../sdk/bus/chat-daemon-control";
+import { type TelegramSetupPreflight, type TelegramSetupTimers } from "../sdk/bus/telegram-setup";
 export type NotifyAction = "setup" | "status" | "health" | "test" | "recovery" | "daemon-internal";
+export type NotifySetupProvider = "telegram" | "discord" | "slack";
 export interface NotifyCommandArgs {
     action: NotifyAction;
     smoke?: boolean;
     rawArgs: string[];
+    provider?: NotifySetupProvider;
     token?: string;
     chatId?: string;
+    discordBotToken?: string;
+    discordApplicationId?: string;
+    discordGuildId?: string;
+    discordParentChannelId?: string;
+    slackBotToken?: string;
+    slackAppToken?: string;
+    slackWorkspaceId?: string;
+    slackChannelId?: string;
+    slackAuthorizedUserId?: string;
     redact?: boolean;
     probe?: boolean;
     message?: string;
@@ -24,6 +37,13 @@ export interface NotifyCommandDeps {
     tokenPrompt?: () => Promise<string>;
     setExitCode?: (code: number) => void;
     exitProcess?: (code: number) => void;
+    /** Optional daemon ownership facts collected by an embedding host. */
+    setupPreflight?: TelegramSetupPreflight;
+    /** Injectable timers and cancellation for setup pairing. */
+    setupTimers?: TelegramSetupTimers;
+    setupAbortSignal?: AbortSignal;
+    setupPidAlive?: (pid: number) => boolean;
+    ensureProviderDaemon?: (provider: "discord" | "slack", settings: Settings) => Promise<EnsureChatDaemonResult | "failed">;
 }
 export declare function parseNotifyArgs(args: string[]): NotifyCommandArgs | undefined;
 export declare function runNotifyCommand(cmd: NotifyCommandArgs, deps?: NotifyCommandDeps): Promise<void>;

package/dist/types/cli.d.ts

@@ -50,6 +50,9 @@ export declare class RootHelpCommand extends Command {
         "append-system-prompt": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
+        "mcp-config": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
         "allow-home": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };

package/dist/types/commands/daemon.d.ts

@@ -40,6 +40,45 @@ export default class Daemon extends Command {
         "spawn-if-stopped": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };
+        smoke: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        "owner-id": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "agent-dir": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        op: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "idempotency-key": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "json-input": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "json-input-file": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "json-input-stdin": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        confirm: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        query: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        cursor: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "show-endpoint-credential": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        yes: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
     };
     run(): Promise<void>;
 }

package/dist/types/commands/launch.d.ts

@@ -47,6 +47,9 @@ export default class Index extends Command {
         "append-system-prompt": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
+        "mcp-config": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
         "allow-home": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };

package/dist/types/commands/notify.d.ts

@@ -1,5 +1,5 @@
 /**
- * Configure Telegram notifications.
+ * Configure Telegram, Discord, or Slack notifications.
  */
 import { Command } from "@gajae-code/utils/cli";
 import { type NotifyAction } from "../cli/notify-cli";
@@ -27,6 +27,33 @@ export default class Notify extends Command {
         "chat-id": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
+        "discord-bot-token": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "discord-application-id": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "discord-guild-id": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "discord-parent-channel-id": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "slack-bot-token": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "slack-app-token": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "slack-workspace-id": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "slack-channel-id": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "slack-authorized-user-id": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
         redact: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };

package/dist/types/commands/sdk.d.ts

@@ -0,0 +1,33 @@
+import { Command } from "@gajae-code/utils/cli";
+import type { Args as ParsedArgs } from "../cli/args";
+import { type SessionLifecycleLaunchRequest } from "../sdk/broker/lifecycle";
+import { SessionManager } from "../session/session-manager";
+export declare function lifecycleArgs(request: SessionLifecycleLaunchRequest, cwd: string, agentDir: string): ParsedArgs;
+/** Opens lifecycle-authorized history without letting replacement content reach readiness. */
+export declare function openLifecycleSessionManager(request: SessionLifecycleLaunchRequest, cwd: string, agentDir: string): Promise<{
+    parsed: ParsedArgs;
+    sessionManager: SessionManager | undefined;
+}>;
+/** Runs the same persisted AgentSession bootstrap used by the production CLI. */
+export declare function runSessionHost(timing?: {
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+    cwd?: string;
+    processIncarnation?: (pid: number) => string | undefined;
+}): Promise<void>;
+export default class Sdk extends Command {
+    static description: string;
+    static hidden: boolean;
+    static args: {
+        action: import("@gajae-code/utils/cli").ArgDescriptor & {
+            required: true;
+            options: string[];
+        };
+    };
+    static flags: {
+        "agent-dir": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+    };
+    run(): Promise<void>;
+}

package/dist/types/config/atomic-yaml-patch.d.ts

@@ -0,0 +1,85 @@
+export interface AtomicYamlSetPatch {
+    path: string;
+    op: "set";
+    value: unknown;
+}
+export interface AtomicYamlUnsetPatch {
+    path: string;
+    op: "unset";
+}
+export type AtomicYamlPatch = AtomicYamlSetPatch | AtomicYamlUnsetPatch;
+export interface AtomicYamlPatchRevision {
+    path: string;
+    beforeHash: string;
+    afterHash: string;
+    beforeRevision: number;
+    afterRevision: number;
+}
+export type CasRestoreResult = {
+    status: "restored";
+    receipt: CasReceipt;
+} | {
+    status: "conflict";
+    paths: readonly string[];
+} | {
+    status: "discarded";
+};
+/**
+ * A receipt intentionally exposes only path-level hashes and opaque revisions.
+ * The before values needed by restore stay in this module's closure.
+ */
+export interface CasReceipt {
+    readonly revisions: readonly AtomicYamlPatchRevision[];
+    restore(): Promise<CasRestoreResult>;
+    discard(): void;
+}
+export interface AtomicYamlUpdate<T> {
+    apply(current: Record<string, unknown>): T | Promise<T>;
+    shouldWrite?(result: T): boolean;
+    committed?(current: Record<string, unknown>, result: T): void | Promise<void>;
+}
+export interface AtomicYamlPatchOptions {
+    /** Test seam for deterministic pre-rename and Windows sharing-violation failures. */
+    rename?: (from: string, to: string) => Promise<void>;
+    /** Test seam for bounded retry timing. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Test seam for Windows rename retry behavior. */
+    platform?: NodeJS.Platform;
+    /** Called under the config lock after a successful CAS restore. */
+    onRestored?: (patches: readonly AtomicYamlPatch[]) => void | Promise<void>;
+}
+/** A replacement failure never unlinks the destination as a fallback. */
+export declare class AtomicYamlReplaceError extends Error {
+    readonly configPath: string;
+    readonly attempts: number;
+    readonly cause: unknown;
+    readonly code = "ATOMIC_YAML_REPLACE_FAILED";
+    constructor(configPath: string, attempts: number, cause: unknown);
+}
+/** Set a dotted YAML path, creating object intermediates as needed. */
+export declare function setByPath(value: Record<string, unknown>, segments: readonly string[], nextValue: unknown): void;
+/** Delete a dotted YAML path without disturbing sibling keys or parent objects. */
+export declare function deleteByPath(value: Record<string, unknown>, segments: readonly string[]): void;
+/** Build patches from current durable YAML while holding the shared queue and file lock. */
+export declare function applyAtomicYamlPatchesWithCurrent(configPath: string, buildPatches: (current: Readonly<Record<string, unknown>>) => Promise<readonly AtomicYamlPatch[]> | readonly AtomicYamlPatch[], options?: AtomicYamlPatchOptions): Promise<CasReceipt>;
+/**
+ * Reserve a FIFO operation for a config file immediately. The patch supplier runs
+ * only when this operation reaches the front of the in-process queue, which lets
+ * Settings debounce/coalesce inside its already-reserved causal slot.
+ */
+export declare function enqueueAtomicYamlOperation<T>(configPath: string, operation: (canonicalConfigPath: string) => Promise<T>): Promise<T>;
+/**
+ * Reserve an atomic patch slot now, producing patches only after earlier slots
+ * complete. Writers with state-aware merges use {@link reserveAtomicYamlUpdateSlot}.
+ */
+export declare function reserveAtomicYamlPatchSlot(configPath: string, patches: () => Promise<readonly AtomicYamlPatch[]> | readonly AtomicYamlPatch[], options?: AtomicYamlPatchOptions): Promise<CasReceipt>;
+/**
+ * Reserve a FIFO update slot and atomically persist a caller-owned YAML mutation.
+ * The supplier runs only when its operation reaches the front of the queue.
+ */
+export declare function reserveAtomicYamlUpdateSlot<T>(configPath: string, update: () => Promise<AtomicYamlUpdate<T>> | AtomicYamlUpdate<T>, options?: AtomicYamlPatchOptions): Promise<T>;
+/**
+ * Apply tagged patches through the one per-file in-process queue and the shared
+ * cross-process file lock. Success means the temp file was fsynced and renamed.
+ */
+export declare function applyAtomicYamlPatches(configPath: string, patches: readonly AtomicYamlPatch[], options?: AtomicYamlPatchOptions): Promise<CasReceipt>;

package/dist/types/config/model-profile-activation.d.ts

@@ -2,13 +2,18 @@ import { ThinkingLevel } from "@gajae-code/agent-core";
 import type { Api, Model } from "@gajae-code/ai";
 import type { AgentSession } from "../session/agent-session";
 import { type GjcModelAssignmentTargetId, type ModelRegistry } from "./model-registry";
+import { type ModelSelectorValue } from "./model-selector-value";
 import type { Settings } from "./settings";
-type ModelProfileActivationSession = Pick<AgentSession, "model" | "thinkingLevel" | "sessionId"> & {
+type ModelProfileActivationSession = Pick<AgentSession, "model" | "thinkingLevel" | "sessionId" | "getConfiguredModelChain" | "setConfiguredModelChain"> & {
     setModelTemporary?: AgentSession["setModelTemporary"];
     setActiveModelProfile?: (name: string | undefined) => void;
     getActiveModelProfile?: () => string | undefined;
     getSessionDefaultModelSelector?: () => string | undefined;
     recordResumeDefaultModel?: (selector: string) => void;
+    seedDefaultFallbackResolution?: (activeIndex: number, skips: Array<{
+        selector: string;
+        reason: string;
+    }>) => void;
 };
 export interface PrepareModelProfileActivationOptions {
     session: ModelProfileActivationSession;
@@ -25,15 +30,25 @@ export interface PreparedModelProfileActivation {
     session: ModelProfileActivationSession & {
         setModelTemporary: AgentSession["setModelTemporary"];
     };
-    settings: Pick<Settings, "clearOverride" | "get" | "getGlobal" | "override" | "set" | "flush">;
+    settings: Pick<Settings, "clearOverride" | "get" | "getGlobal" | "override" | "set" | "unset" | "flush">;
     previousModel: Model<Api> | undefined;
     previousThinkingLevel: ThinkingLevel | undefined;
-    previousAgentModelOverrides: Record<string, string>;
-    previousModelRoles: Record<string, string>;
+    previousAgentModelOverrides: Record<string, ModelSelectorValue>;
+    previousModelRoles: Record<string, ModelSelectorValue>;
+    previousDefaultChain: readonly string[] | undefined;
     defaultModel: Model<Api> | undefined;
     defaultThinkingLevel: ThinkingLevel | undefined;
-    modelRoles: Record<string, string>;
-    agentModelOverrides: Record<string, string>;
+    /** Full configured default fallback chain with resolvable entries clamped. */
+    defaultChain: readonly string[];
+    /** Index of the authenticated default-chain entry selected for activation. */
+    defaultActiveIndex: number | undefined;
+    /** Resolution-time skips that occurred before selecting the default entry. */
+    defaultResolutionSkips: Array<{
+        selector: string;
+        reason: string;
+    }>;
+    modelRoles: Record<string, ModelSelectorValue>;
+    agentModelOverrides: Record<string, ModelSelectorValue>;
     previousActiveModelProfile: string | undefined;
     /**
      * The session resume default ("provider/id") captured BEFORE activation —
@@ -45,33 +60,38 @@ export interface PreparedModelProfileActivation {
     previousSessionDefaultModel: string | undefined;
 }
 export interface MaterializeModelProfileAssignmentOptions {
-    session: Pick<ModelProfileActivationSession, "model" | "thinkingLevel" | "setActiveModelProfile" | "getActiveModelProfile">;
-    settings: Pick<Settings, "clearOverride" | "get" | "override" | "set">;
+    session: Pick<ModelProfileActivationSession, "model" | "thinkingLevel" | "getConfiguredModelChain" | "setActiveModelProfile" | "getActiveModelProfile">;
+    settings: Pick<Settings, "clearOverride" | "get" | "override" | "set" | "unset">;
     role: GjcModelAssignmentTargetId;
     selector: string;
 }
 export interface MaterializeModelProfileAssignmentsOptions {
-    session: Pick<ModelProfileActivationSession, "model" | "thinkingLevel" | "setActiveModelProfile" | "getActiveModelProfile">;
-    settings: Pick<Settings, "clearOverride" | "get" | "override" | "set">;
+    session: Pick<ModelProfileActivationSession, "model" | "thinkingLevel" | "getConfiguredModelChain" | "setActiveModelProfile" | "getActiveModelProfile">;
+    settings: Pick<Settings, "clearOverride" | "get" | "override" | "set" | "unset">;
     assignments: ReadonlyMap<GjcModelAssignmentTargetId, string> | Partial<Record<GjcModelAssignmentTargetId, string>>;
 }
 export declare function materializeActiveModelProfileAssignment(options: MaterializeModelProfileAssignmentOptions): boolean;
 export declare function materializeActiveModelProfileAssignments(options: MaterializeModelProfileAssignmentsOptions): boolean;
+export declare class ModelProfileCredentialError extends Error {
+    readonly profileLabel: string;
+    readonly providers: readonly string[];
+    constructor(profileLabel: string, providers: readonly string[]);
+}
 export declare function formatModelProfileCredentialError(profileLabel: string, providers: readonly string[]): string;
 export declare function resolveModelProfileName(profileName: string, profiles: ReadonlyMap<string, unknown>): string;
 export declare function prepareModelProfileActivation(options: PrepareModelProfileActivationOptions): Promise<PreparedModelProfileActivation>;
 export declare function applyPreparedModelProfileActivation(prepared: PreparedModelProfileActivation, options?: ApplyModelProfileActivationOptions): Promise<void>;
 export interface MaterializeModelProfileForDeletionResult {
-    modelRoles: Record<string, string>;
-    agentModelOverrides: Record<string, string>;
-    previousModelRoles: Record<string, string>;
-    previousAgentModelOverrides: Record<string, string>;
+    modelRoles: Record<string, ModelSelectorValue>;
+    agentModelOverrides: Record<string, ModelSelectorValue>;
+    previousModelRoles: Record<string, ModelSelectorValue>;
+    previousAgentModelOverrides: Record<string, ModelSelectorValue>;
     previousDefaultProfile: string | undefined;
     previousPersistedDefaultProfile: string | undefined;
     previousActiveModelProfile: string | undefined;
 }
 export declare function materializeModelProfileForDeletion(options: PrepareModelProfileActivationOptions & {
-    settings: Pick<Settings, "clearOverride" | "flush" | "get" | "getGlobal" | "override" | "set">;
+    settings: Pick<Settings, "clearOverride" | "flush" | "get" | "getGlobal" | "override" | "set" | "unset">;
 }): Promise<MaterializeModelProfileForDeletionResult>;
 export declare function restoreMaterializedModelProfileForDeletion(options: {
     settings: Pick<Settings, "flush" | "override" | "set">;

package/dist/types/config/model-profiles.d.ts

@@ -1,4 +1,5 @@
 import type { GjcModelAssignmentTargetId } from "./model-registry";
+import { type ModelSelectorValue } from "./model-selector-value";
 import type { ModelsConfig } from "./models-config-schema";
 export type ModelProfileRole = GjcModelAssignmentTargetId;
 export interface ModelProfileDefinition {
@@ -15,16 +16,21 @@ export interface ModelProfileDefinition {
      * means any single xiaomi credential satisfies the group.
      */
     alternativeProviderGroups?: readonly (readonly string[])[];
-    modelMapping: Partial<Record<ModelProfileRole, string>>;
+    modelMapping: Partial<Record<ModelProfileRole, ModelSelectorValue>>;
     source: "builtin" | "user";
 }
 export interface ResolvedProfileBinding {
-    defaultSelector?: string;
-    modelRoles: Record<string, string>;
-    agentModelOverrides: Partial<Record<Exclude<ModelProfileRole, "default">, string>>;
+    defaultSelector?: ModelSelectorValue;
+    modelRoles: Record<string, ModelSelectorValue>;
+    agentModelOverrides: Partial<Record<Exclude<ModelProfileRole, "default">, ModelSelectorValue>>;
 }
 export declare function deriveModelProfileMappedProviders(definition: Pick<ModelProfileDefinition, "modelMapping">): string[];
-export declare function aggregateModelProfileRequiredProviders(requiredProviders: readonly string[], definition: Pick<ModelProfileDefinition, "modelMapping">): string[];
+/**
+ * Return the providers explicitly declared as hard prerequisites.
+ * Model mappings may reference fallback providers, but those references are
+ * resolution-time candidates rather than activation requirements.
+ */
+export declare function aggregateModelProfileRequiredProviders(requiredProviders: readonly string[], _definition: Pick<ModelProfileDefinition, "modelMapping">): string[];
 export declare const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[];
 export interface ModelProfilePresentation {
     displayName: string;

package/dist/types/config/model-registry.d.ts

@@ -265,8 +265,8 @@ export declare const ModelsConfigFile: ConfigFile<{
         } | undefined;
     }> | undefined;
     modelBindings?: {
-        modelRoles?: Record<string, string> | undefined;
-        agentModelOverrides?: Record<string, string> | undefined;
+        modelRoles?: Record<string, string | string[]> | undefined;
+        agentModelOverrides?: Record<string, string | string[]> | undefined;
     } | undefined;
     equivalence?: {
         overrides?: Record<string, string> | undefined;
@@ -275,7 +275,7 @@ export declare const ModelsConfigFile: ConfigFile<{
     profiles?: Record<string, {
         required_providers: string[];
         display_name?: string | undefined;
-        model_mapping: Partial<Record<"architect" | "critic" | "default" | "executor" | "planner", string>>;
+        model_mapping: Partial<Record<"architect" | "critic" | "default" | "executor" | "planner", string | string[]>>;
     }> | undefined;
 }>;
 /** Provider override config (baseUrl, headers, apiKey, compat, transport) without custom models */