@gajae-code/coding-agent 0.11.0 → 0.11.2

package/dist/types/tools/browser/dead-tab-recovery.d.ts

@@ -0,0 +1,24 @@
+export type DeadTabRecoveryConsumeStatus = "consumed" | "expired_or_missing" | "owner_mismatch";
+export interface DeadTabRecoveryConsumeResult<T> {
+    status: DeadTabRecoveryConsumeStatus;
+    descriptor?: T;
+}
+interface DeadTabRecoveryDeps {
+    now(): number;
+    onPeek(): void;
+}
+/** Store a short-lived immutable recovery descriptor for a dead tab worker. */
+export declare function registerDeadTabRecovery<T extends object>(name: string, ownerId: string | undefined, descriptor: T, ttlMs?: number): void;
+/**
+ * Check whether a recovery descriptor may be consumed by this owner. The test hook is
+ * intentionally synchronous: recovery must not yield between this check and consume.
+ */
+export declare function peekDeadTabRecovery<T>(name: string, ownerId: string | undefined): DeadTabRecoveryConsumeResult<T>;
+/** Consume only a live descriptor belonging to the expected owner. */
+export declare function consumeDeadTabRecovery<T>(name: string, ownerId: string | undefined): DeadTabRecoveryConsumeResult<T>;
+export declare function discardDeadTabRecovery(name: string): void;
+/** Whether an unconsumed descriptor remains live at the supplied policy clock. */
+export declare function isDeadTabRecoveryLive(name: string, now: number): boolean;
+export declare function __setDeadTabRecoveryDepsForTest(overrides: Partial<DeadTabRecoveryDeps>): void;
+export declare function __resetDeadTabRecoveryForTest(): void;
+export {};

package/dist/types/tools/browser/tab-supervisor.d.ts

@@ -26,6 +26,8 @@ export interface TabSession {
     pending: Map<string, PendingRun>;
     dialogPolicy?: DialogPolicy;
     kindTag: BrowserKindTag;
+    /** Immutable inputs needed to recreate this worker after an unexpected exit. */
+    recoveryOpts: AcquireTabOptions;
     /** Session that acquired this tab; used for session-scoped teardown (F13). */
     ownerId?: string;
     /** Unix-ms timestamp of the last acquire/run activity; drives GC idle + LRU ordering. */
@@ -47,6 +49,10 @@ export interface AcquireTabOptions {
     dialogs?: DialogPolicy;
     /** Owning session id so dispose can release only this session's tabs (F13). */
     ownerId?: string;
+    /** Internal recovery-only target id; makes a headless replacement attach, not open a page. */
+    recoveryTargetId?: string;
+    /** Recovery fence: replacement must not overwrite a tab installed after dead teardown. */
+    requireVacantName?: boolean;
 }
 export interface AcquireTabResult {
     tab: TabSession;
@@ -68,6 +74,13 @@ export interface ReleaseTabOptions {
     deadlineAt?: number;
 }
 export declare function getTab(name: string): TabSession | undefined;
+/** Test-only: exercise the same hold-transfer primitive used by replacement recovery. */
+export declare function withTemporaryBrowserHoldForTest<T>(browser: BrowserHandle, work: () => Promise<T>): Promise<T>;
+/** Test-only: close exactly the target belonging to the supplied dead session. */
+export declare function closeOrphanTargetForTest(tab: TabSession): Promise<void>;
+/** Test-only: install an in-flight recovery and observe owner isolation. */
+export declare function __setRecoveringTabForTest(name: string, ownerId: string | undefined, promise: Promise<TabSession>): void;
+export declare function recoveryPromiseForOwnerForTest(name: string, ownerId: string | undefined): Promise<TabSession> | undefined;
 /** Read-only, GC-facing projection of a live tab. Never exposes the mutable `tabs` map. */
 export interface TabGcSnapshot {
     name: string;
@@ -95,8 +108,15 @@ export declare function releaseTabIfGcEligible(name: string, policy: BrowserGcEl
 export declare function setTabForTest(tab: TabSession): void;
 /** Test-only: clear the tab registry between cases. */
 export declare function clearTabsForTest(): void;
+export declare function __setAfterWorkerInitializationForTest(callback: ((name: string) => void) | undefined): void;
+export declare function __setAcquireTabWorkerDepsForTest(factory: (() => Promise<WorkerHandle>) | undefined, initializer: ((worker: WorkerHandle, payload: WorkerInitPayload, timeoutMs: number) => Promise<ReadyInfo>) | undefined): void;
 export declare function acquireTab(name: string, browser: BrowserHandle, opts: AcquireTabOptions): Promise<AcquireTabResult>;
 export declare function runInTab(name: string, opts: RunInTabOptions): Promise<RunResultOk>;
+/**
+ * Claim and release exactly the dead tab that produced a recovery descriptor. Every
+ * predicate and the release election run synchronously before teardown can await.
+ */
+export declare function releaseDeadTabForRecovery(name: string, expected: TabSession, ownerId: string | undefined, preserveHeadlessTarget?: boolean): Promise<boolean>;
 export declare function releaseTab(name: string, opts?: ReleaseTabOptions): Promise<boolean>;
 export declare function releaseAllTabs(opts?: ReleaseTabOptions): Promise<number>;
 /**
@@ -105,5 +125,6 @@ export declare function releaseAllTabs(opts?: ReleaseTabOptions): Promise<number
  */
 export declare function releaseTabsForOwner(ownerId: string | null | undefined, opts?: ReleaseTabOptions): Promise<number>;
 export declare function dropHeadlessTabs(): Promise<void>;
+export declare function buildInitPayloadForTest(browser: BrowserHandle, opts: AcquireTabOptions): Promise<WorkerInitPayload>;
 export declare function initializeTabWorkerForTest(worker: WorkerHandle, payload: WorkerInitPayload, timeoutMs: number): Promise<ReadyInfo>;
 export {};

package/dist/types/tools/cron.d.ts

@@ -25,6 +25,8 @@ export interface CronJobSnapshot {
     createdAt: number;
     expiresAt?: number;
     nextFireAt?: number;
+    /** True while this owner-scoped schedule's delivery is in progress. */
+    firing?: boolean;
     humanSchedule: string;
     ownerId?: string;
 }

package/dist/types/tools/fetch.d.ts

@@ -62,6 +62,7 @@ export declare function loadReadUrlCacheEntry(session: ToolSession, params: {
     ensureArtifact?: boolean;
     preferCached?: boolean;
 }): Promise<ReadUrlCacheEntry>;
+export declare function wrapUntrustedContent(content: string): string;
 export declare function executeReadUrl(session: ToolSession, params: {
     path: string;
     raw?: boolean;

package/dist/types/tools/index.d.ts

@@ -68,7 +68,6 @@ export type ContextFileEntry = {
     content: string;
     depth?: number;
 };
-export type { DiscoverableMCPTool } from "../runtime-mcp/discoverable-tool-metadata";
 export type { DiscoverableTool, DiscoverableToolSearchIndex, DiscoverableToolSearchResult, DiscoverableToolSource, } from "../tool-discovery/tool-index";
 /** A typed remote action available to an ask answer source. */
 export type AskRemoteControlId = "navigation_forward";
@@ -202,6 +201,8 @@ export interface ToolSession {
     bashRestrictionProfile?: BashRestrictionProfile;
     /** Optional per-session allowlist for tools exposed through search_tool_bm25. */
     discoverableToolAllowedNames?: readonly string[];
+    /** Throw instead of warn when toolNames contains an unknown name. */
+    strictToolNames?: boolean;
     /** Get artifacts directory for artifact:// URLs */
     getArtifactsDir?: () => string | null;
     /** Get the ArtifactManager backing this session (shared across parent + subagents). */
@@ -253,18 +254,6 @@ export interface ToolSession {
     getTodoPhases?: () => TodoPhase[];
     /** Replace cached todo phases for this session. */
     setTodoPhases?: (phases: TodoPhase[]) => void;
-    /** Whether MCP tool discovery is active for this session. */
-    isMCPDiscoveryEnabled?: () => boolean;
-    /** Get hidden-but-discoverable MCP tools for search_tool_bm25 prompts and fallbacks.
-     * @deprecated Use getDiscoverableTools with source filter instead. */
-    getDiscoverableMCPTools?: () => import("../runtime-mcp/discoverable-tool-metadata").DiscoverableMCPTool[];
-    /** Get the cached discoverable MCP search index for search_tool_bm25 execution.
-     * @deprecated Use getDiscoverableToolSearchIndex instead. */
-    getDiscoverableMCPSearchIndex?: () => import("../tool-discovery/tool-index").DiscoverableMCPSearchIndex;
-    /** Get MCP tools activated by prior search_tool_bm25 calls. */
-    getSelectedMCPToolNames?: () => string[];
-    /** Merge MCP tool selections into the active session tool set. */
-    activateDiscoveredMCPTools?: (toolNames: string[]) => Promise<string[]>;
     /** Whether any form of tool discovery is active (tools.discoveryMode !== "off" or mcp.discoveryMode). */
     isToolDiscoveryEnabled?: () => boolean;
     /** Get all hidden-but-discoverable tools for search_tool_bm25 prompts. */
@@ -358,13 +347,39 @@ export interface EvalBackendsAllowance {
     python: boolean;
     js: boolean;
 }
+/**
+ * Parse the `GJC_PY` multi-value token into per-backend booleans.
+ *
+ * Tokens (case-insensitive):
+ * - `0` / `bash` → JavaScript only (`{ py: false, js: true }`)
+ * - `1` / `py`   → Python only (`{ py: true, js: false }`)
+ * - `js`         → JavaScript only (`{ py: false, js: true }`)
+ * - `mix` / `both` → both backends (`{ py: true, js: true }`)
+ *
+ * Returns `null` when `GJC_PY` is unset, empty, or holds an unrecognized
+ * token, so the caller can fall back to the legacy `PI_PY` / `PI_JS` flags or
+ * per-key settings. This matches the documented contract that invalid values
+ * are ignored.
+ */
+export declare function parseGjcPy(env: Record<string, string | undefined>): {
+    py: boolean;
+    js: boolean;
+} | null;
+/**
+ * Resolve eval-backend allowance from environment only. `GJC_PY` wins when set
+ * to a recognized token; otherwise the legacy `PI_PY` / `PI_JS` flags apply.
+ * Returns `null` when no env override is set so the caller can defer to settings.
+ */
+export declare function resolveEvalBackendsFromEnv(env: Record<string, string | undefined>): EvalBackendsAllowance | null;
 /** Read per-backend allowance from settings (defaults true). */
 export declare function readEvalBackendsAllowance(session: ToolSession): EvalBackendsAllowance;
 /**
- * Materialize the active eval backend allowance: PI_PY / PI_JS env flags
- * override the per-key settings; otherwise settings (defaults true) win.
+ * Materialize the active eval backend allowance. `GJC_PY` takes precedence
+ * over the legacy `PI_PY` / `PI_JS` env flags, which in turn override the
+ * per-key settings (defaults true). When no env override is set, settings win.
  */
 export declare function resolveEvalBackends(session: ToolSession): EvalBackendsAllowance;
+export { resolvePythonIntegrationGate, resolvePythonIpcTrace, resolvePythonSkipCheck, } from "../eval/py/env";
 /**
  * Create tools from BUILTIN_TOOLS registry.
  */

package/dist/types/tools/output-meta.d.ts

@@ -107,6 +107,7 @@ export interface TruncationTextOptions {
     totalLines?: number;
     totalBytes?: number;
     maxBytes?: number;
+    artifactId?: string;
 }
 /**
  * Fluent builder for OutputMeta.

package/dist/types/tools/read.d.ts

@@ -10,6 +10,8 @@ declare const readSchema: z.ZodObject<{
     path: z.ZodString;
 }, z.core.$strict>;
 export type ReadToolInput = z.infer<typeof readSchema>;
+/** Project paths and output sizes without exposing read content or remote URLs. */
+export declare function summarizeReadToolActivity(kind: "args" | "result", value: unknown): string | undefined;
 export interface ReadToolDetails {
     kind?: "file" | "url";
     truncation?: TruncationResult;
@@ -59,6 +61,7 @@ export declare class ReadTool implements AgentTool<typeof readSchema, ReadToolDe
     }, z.core.$strict>;
     readonly nonAbortable = true;
     readonly strict = true;
+    readonly safeSummary: typeof summarizeReadToolActivity;
     constructor(session: ToolSession);
     execute(_toolCallId: string, params: ReadParams, signal?: AbortSignal, _onUpdate?: AgentToolUpdateCallback<ReadToolDetails>, _toolContext?: AgentToolContext): Promise<AgentToolResult<ReadToolDetails>>;
 }

package/dist/types/tools/search-tool-bm25.d.ts

@@ -3,9 +3,7 @@ import type { Component } from "@gajae-code/tui";
 import * as z from "zod/v4";
 import type { RenderResultOptions } from "../extensibility/custom-tools/types";
 import type { Theme } from "../modes/theme/theme";
-import { type DiscoverableTool } from "../tool-discovery/tool-index";
 import type { ToolSession } from ".";
-export type { DiscoverableMCPSearchIndex, DiscoverableMCPTool, } from "../runtime-mcp/discoverable-tool-metadata";
 declare const searchToolBm25Schema: z.ZodObject<{
     query: z.ZodString;
     limit: z.ZodOptional<z.ZodNumber>;
@@ -28,7 +26,7 @@ export interface SearchToolBm25Details {
     active_selected_tools: string[];
     tools: SearchToolBm25Match[];
 }
-export declare function renderSearchToolBm25Description(discoverableTools?: DiscoverableTool[]): string;
+export declare function renderSearchToolBm25Description(): string;
 /**
  * SearchToolsTool — wire name `search_tool_bm25` (preserved for persisted session back-compat).
  *
@@ -40,7 +38,7 @@ export declare class SearchToolBm25Tool implements AgentTool<typeof searchToolBm
     readonly name = "search_tool_bm25";
     readonly label = "SearchTools";
     readonly loadMode = "essential";
-    get description(): string;
+    readonly description: string;
     readonly parameters: z.ZodObject<{
         query: z.ZodString;
         limit: z.ZodOptional<z.ZodNumber>;
@@ -63,3 +61,4 @@ export declare const searchToolBm25Renderer: {
     mergeCallAndResult: boolean;
     inline: boolean;
 };
+export {};

package/dist/types/tools/subagent-render.d.ts

@@ -11,6 +11,7 @@ import type { Component } from "@gajae-code/tui";
 import type { RenderResultOptions } from "../extensibility/custom-tools/types";
 import type { Theme } from "../modes/theme/theme";
 import { type SubagentToolDetails } from "./subagent";
+export { subagentAwaitRenderedStateSignature } from "./subagent";
 /** Test-only seam (PR3 deterministic cache-hit assertions). */
 export declare const subagentBodyCacheTestHooks: {
     readonly bodyRenders: number;

package/dist/types/tools/subagent.d.ts

@@ -56,8 +56,13 @@ export interface SubagentSnapshot {
     /** True when the requested model lacked credentials and fell back to the parent model. */
     modelFellBack?: boolean;
 }
+export type SubagentAwaitOutcome = "completed" | "timed_out" | "interrupted";
 export interface SubagentToolDetails {
     subagents: SubagentSnapshot[];
+    /** Await outcome for a live await receipt; omitted when no wait was started. */
+    awaitOutcome?: SubagentAwaitOutcome;
+    /** True only when the parent await was interrupted; the child was not cancelled. */
+    interrupted?: true;
 }
 export declare class SubagentTool implements AgentTool<typeof subagentSchema, SubagentToolDetails> {
     #private;
@@ -113,5 +118,5 @@ export declare class SubagentTool implements AgentTool<typeof subagentSchema, Su
  * countdown ticking is sacrificed by design; every real transition still changes
  * the signature.
  */
-export declare function subagentAwaitRenderedStateSignature(subagents: readonly SubagentSnapshot[]): string;
+export declare function subagentAwaitRenderedStateSignature(subagents: readonly SubagentSnapshot[], receipt?: Pick<SubagentToolDetails, "awaitOutcome" | "interrupted">): string;
 export {};

package/dist/types/utils/event-bus.d.ts

@@ -1,6 +1,6 @@
 export declare class EventBus {
     #private;
     emit(channel: string, data: unknown): void;
-    on(channel: string, handler: (data: unknown) => void): () => void;
+    on(channel: string, handler: (data: unknown) => void | PromiseLike<void>): () => void;
     clear(): void;
 }

package/dist/types/web/search/index.d.ts

@@ -10,7 +10,7 @@ import * as z from "zod/v4";
 import type { CustomTool } from "../../extensibility/custom-tools/types";
 import type { ToolSession } from "../../tools";
 import { type SearchRenderDetails } from "./render";
-import type { ActiveSearchModelContext, SearchProviderId } from "./types";
+import type { ActiveSearchModelContext, SearchProviderId, SearchResponse } from "./types";
 /** Web search tool parameters schema */
 export declare const webSearchSchema: z.ZodObject<{
     query: z.ZodString;
@@ -44,6 +44,8 @@ export type SearchToolParams = z.infer<typeof webSearchSchema>;
 export interface SearchQueryParams extends SearchToolParams {
     provider?: SearchProviderId | "auto";
 }
+/** Format response for LLM consumption */
+export declare function formatSearchResponseForLlm(response: SearchResponse): string;
 /** Override the hedge delay (tests). Non-finite/non-positive resets to default. */
 export declare function setDdgHedgeDelayMs(ms: number | undefined): void;
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.11.0",
+	"version": "0.11.2",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -29,10 +29,12 @@
 	},
 	"scripts": {
 		"build": "bun scripts/build-binary.ts",
-		"check": "biome check . && bun run verify:sdk-canonicalization && bun run check:types",
+		"check": "biome check . && bun run check:types",
+		"check:runtime": "bun run generate-hotkeys-docs --check && bun run verify:sdk-canonicalization",
 		"check:types": "tsc -p tsconfig.json --noEmit",
 		"lint": "biome lint .",
 		"test": "bun test",
+		"generate-hotkeys-docs": "bun scripts/generate-hotkeys-docs.ts",
 		"bench:context": "bun run bench/context-optimization.bench.ts",
 		"generate-schemas": "bun ../../scripts/generate-json-schemas.ts",
 		"check:schemas": "bun ../../scripts/generate-json-schemas.ts --check",
@@ -51,13 +53,13 @@
 		"@agentclientprotocol/sdk": "1.2.1",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.11.0",
-		"@gajae-code/agent-core": "0.11.0",
-		"@gajae-code/ai": "0.11.0",
-		"@gajae-code/bridge-client": "0.11.0",
-		"@gajae-code/natives": "0.11.0",
-		"@gajae-code/tui": "0.11.0",
-		"@gajae-code/utils": "0.11.0",
+		"@gajae-code/stats": "0.11.2",
+		"@gajae-code/agent-core": "0.11.2",
+		"@gajae-code/ai": "0.11.2",
+		"@gajae-code/bridge-client": "0.11.2",
+		"@gajae-code/natives": "0.11.2",
+		"@gajae-code/tui": "0.11.2",
+		"@gajae-code/utils": "0.11.2",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",
@@ -68,6 +70,7 @@
 		"linkedom": "^0.18.12",
 		"lru-cache": "11.3.6",
 		"markit-ai": "0.5.3",
+		"marked": "18.0.6",
 		"puppeteer-core": "^24.42.0",
 		"turndown": "7.2.4",
 		"turndown-plugin-gfm": "1.0.2",
@@ -121,6 +124,8 @@
 		"./modes/components/runtime-mcp-add-wizard": null,
 		"./modes/controllers/runtime-mcp-command-controller": null,
 		"./slash-commands/helpers/mcp": null,
+		"./session/session-manager-internal": null,
+		"./session/session-manager-internal.js": null,
 		"./sdk": {
 			"types": "./dist/types/sdk/index.d.ts",
 			"import": "./src/sdk/index.ts"
@@ -139,6 +144,13 @@
 			"types": "./dist/types/sdk/bus/*.d.ts",
 			"import": "./src/sdk/bus/*.ts"
 		},
+		"./session/internal/*": null,
+		"./config/model-auth": null,
+		"./config/model-auth.js": null,
+		"./config/model-bindings-applier": null,
+		"./config/model-bindings-applier.js": null,
+		"./config/model-discovery-manager": null,
+		"./config/model-discovery-manager.js": null,
 		"./*": {
 			"types": "./dist/types/*.d.ts",
 			"import": "./src/*.ts"

package/scripts/build-sdk-package-smoke.ts

@@ -8,6 +8,9 @@ const packageDir = path.resolve(import.meta.dir, "..");
 const packageName = "@gajae-code/coding-agent";
 const aiPackageDir = path.resolve(packageDir, "../ai");
 const bridgeClientPackageDir = path.resolve(packageDir, "../bridge-client");
+const tuiPackageDir = path.resolve(packageDir, "../tui");
+const nativesPackageDir = path.resolve(packageDir, "../natives");
+const linuxX64PackageDir = path.resolve(packageDir, "../natives-linux-x64");
 const manifestsDir = path.join(packageDir, "test/manifests");
 const baselinePath = path.join(manifestsDir, "sdk-public-surface-v1.json");
 const generatedPath = path.join(manifestsDir, "sdk-public-surface.generated.json");
@@ -29,16 +32,35 @@ function assertExport(module: Record<string, unknown>, name: string, subpath: st
 async function runSmoke(): Promise<Surface> {
 	const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "gjc-sdk-package-smoke-"));
 	try {
+		const stagedLinuxX64Dir = path.join(tempDir, "natives-linux-x64");
+		await fs.cp(linuxX64PackageDir, stagedLinuxX64Dir, { recursive: true });
+		const stagedNativeDir = path.join(stagedLinuxX64Dir, "native");
+		await fs.mkdir(stagedNativeDir, { recursive: true });
+		for (const entry of await fs.readdir(path.join(nativesPackageDir, "native"))) {
+			if (entry.startsWith("pi_natives.linux-x64") && entry.endsWith(".node")) {
+				await fs.copyFile(path.join(nativesPackageDir, "native", entry), path.join(stagedNativeDir, entry));
+			}
+		}
 		const aiTarball = run(["bun", "pm", "pack", "--destination", tempDir, "--quiet"], aiPackageDir);
 		const bridgeClientTarball = run(
 			["bun", "pm", "pack", "--destination", tempDir, "--quiet"],
 			bridgeClientPackageDir,
 		);
+		const tuiTarball = run(["bun", "pm", "pack", "--destination", tempDir, "--quiet"], tuiPackageDir);
+		const nativesTarball = run(["bun", "pm", "pack", "--destination", tempDir, "--quiet"], nativesPackageDir);
+		const linuxX64Tarball = run(["bun", "pm", "pack", "--destination", tempDir, "--quiet"], stagedLinuxX64Dir);
 		const codingAgentTarball = run(["bun", "pm", "pack", "--destination", tempDir, "--quiet"], packageDir);
 		const aiTarballPath = path.isAbsolute(aiTarball) ? aiTarball : path.join(aiPackageDir, aiTarball);
 		const bridgeClientTarballPath = path.isAbsolute(bridgeClientTarball)
 			? bridgeClientTarball
 			: path.join(bridgeClientPackageDir, bridgeClientTarball);
+		const tuiTarballPath = path.isAbsolute(tuiTarball) ? tuiTarball : path.join(tuiPackageDir, tuiTarball);
+		const nativesTarballPath = path.isAbsolute(nativesTarball)
+			? nativesTarball
+			: path.join(nativesPackageDir, nativesTarball);
+		const linuxX64TarballPath = path.isAbsolute(linuxX64Tarball)
+			? linuxX64Tarball
+			: path.join(stagedLinuxX64Dir, linuxX64Tarball);
 		const codingAgentTarballPath = path.isAbsolute(codingAgentTarball)
 			? codingAgentTarball
 			: path.join(packageDir, codingAgentTarball);
@@ -52,10 +74,16 @@ async function runSmoke(): Promise<Surface> {
 						"@gajae-code/ai": `file:${aiTarballPath}`,
 						"@gajae-code/bridge-client": `file:${bridgeClientTarballPath}`,
 						[packageName]: `file:${codingAgentTarballPath}`,
+						"@gajae-code/tui": `file:${tuiTarballPath}`,
+						"@gajae-code/natives": `file:${nativesTarballPath}`,
+						"@gajae-code/natives-linux-x64": `file:${linuxX64TarballPath}`,
 					},
 					overrides: {
 						"@gajae-code/ai": `file:${aiTarballPath}`,
 						"@gajae-code/bridge-client": `file:${bridgeClientTarballPath}`,
+						"@gajae-code/tui": `file:${tuiTarballPath}`,
+						"@gajae-code/natives": `file:${nativesTarballPath}`,
+						"@gajae-code/natives-linux-x64": `file:${linuxX64TarballPath}`,
 					},
 				},
 				null,
@@ -65,10 +93,20 @@ async function runSmoke(): Promise<Surface> {
 		// Install the matching packed workspace artifacts so the smoke test exercises the
 		// release dependency boundary without falling back to an older registry package.
 		run(["bun", "install", "--ignore-scripts"], tempDir);
+		const installedPackage = JSON.parse(
+			await fs.readFile(path.join(tempDir, "node_modules", packageName, "package.json"), "utf8"),
+		) as { exports?: Record<string, unknown> };
+		if (installedPackage.exports?.["./session/internal/*"] !== null) {
+			throw new Error("packed package must explicitly block ./session/internal/*");
+		}
 		const probePath = path.join(tempDir, "probe.ts");
 		await fs.writeFile(
 			probePath,
-			`import * as root from ${JSON.stringify(packageName)};\nimport * as sdk from ${JSON.stringify(`${packageName}/sdk`)};\nimport * as bus from ${JSON.stringify(`${packageName}/sdk/bus`)};\nimport * as bridgeClient from "@gajae-code/bridge-client";\nconst required = [[root, "createAgentSession", "root"], [sdk, "createAgentSession", "sdk"], [bus, "createNotificationsExtension", "sdk/bus"], [sdk, "SdkClient", "sdk"], [bridgeClient, "SdkClient", "bridge-client"]] as const;\nfor (const [module, name, subpath] of required) if (!(name in module)) throw new Error(subpath + " missing " + name);\nif (sdk.SdkClient !== bridgeClient.SdkClient) throw new Error("SdkClient class identity differs between sdk and bridge-client");\nprocess.stdout.write(JSON.stringify({ root: Object.keys(root).sort(), sdk: Object.keys(sdk).sort() }));\n`,
+			`import * as fs from "node:fs/promises";\nimport * as path from "node:path";\nimport * as root from ${JSON.stringify(packageName)};\nimport * as sdk from ${JSON.stringify(`${packageName}/sdk`)};\nimport * as bus from ${JSON.stringify(`${packageName}/sdk/bus`)};\nconst required = [[root, "createAgentSession", "root"], [root, "SESSION_DIRECTORY_API_VERSION", "root"], [root, "resolveManagedSessionScope", "root"], [root, "listManagedSessionCandidates", "root"], [sdk, "createAgentSession", "sdk"], [bus, "createNotificationsExtension", "sdk/bus"], [sdk, "SdkClient", "sdk"], [sdk, "SESSION_DIRECTORY_API_VERSION", "sdk"], [sdk, "resolveManagedSessionScope", "sdk"], [sdk, "listManagedSessionCandidates", "sdk"]] as const;\nfor (const [module, name, subpath] of required) if (!(name in module)) throw new Error(subpath + " missing " + name);\nconst sandbox = path.join(process.cwd(), "managed-listing-smoke");\nconst cwd = path.join(sandbox, "workspace", "a-b", "c");\nconst agentDir = path.join(sandbox, "agent");\nconst sessionsRoot = path.join(agentDir, "sessions");\nawait fs.mkdir(cwd, { recursive: true });\nconst resolved = await sdk.resolveManagedSessionScope({ cwd, agentDir, sessionsRoot });\nif (resolved.kind !== "resolved") throw new Error("packed resolver failed: " + resolved.message);\nawait fs.mkdir(resolved.scope.directoryPath, { recursive: true, mode: 0o700 });\nawait fs.chmod(sessionsRoot, 0o700);\nawait fs.chmod(resolved.scope.directoryPath, 0o700);\nawait fs.writeFile(path.join(resolved.scope.directoryPath, ".gjc-managed-session-scope.v2.json"), JSON.stringify({ schemaVersion: 1, layoutVersion: 2, identityVersion: 1, platform: process.platform === "win32" ? "win32" : "posix", canonicalPath: resolved.scope.canonicalCwd, identityDigest: resolved.scope.directoryName.slice(3) }) + "\\n", { mode: 0o600 });\nconst transcriptPath = path.join(resolved.scope.directoryPath, "packed-session.jsonl");\nawait fs.writeFile(transcriptPath, JSON.stringify({ type: "session", id: "packed-session", cwd }) + "\\n", { mode: 0o600 });\nconst snapshot = async () => Promise.all((await fs.readdir(sandbox, { recursive: true })).sort().map(async name => { const pathname = path.join(sandbox, name); const stat = await fs.lstat(pathname); return [name, stat.mode, stat.size, stat.mtimeMs, stat.isFile() ? await fs.readFile(pathname, "utf8") : null]; }));\nconst before = JSON.stringify(await snapshot());\nconst listing = await sdk.listManagedSessionCandidates({ scope: resolved.scope });\nif (listing.kind !== "complete" || listing.owned.length !== 1 || listing.owned[0]?.sessionId !== "packed-session") throw new Error("packed readonly listing failed: " + JSON.stringify(listing));\nconst after = JSON.stringify(await snapshot());\nif (after !== before) throw new Error("packed readonly listing mutated the filesystem");\nconst privateSubpath = ${JSON.stringify(`${packageName}/session/internal/managed-session-scope`)};\ntry { await import(privateSubpath); throw new Error("private managed-session scope subpath resolved"); } catch (error) {\n\tif (error instanceof Error && error.message === "private managed-session scope subpath resolved") throw error;\n\tconst message = String(error);\n\tconst exportsRejected = /Package subpath .* is not defined by "exports"/.test(message);\n\tconst bunRejected = message.startsWith("ResolveMessage: Cannot find module '" + privateSubpath + "' from '") && message.endsWith("/probe.ts'");\n\tif (!exportsRejected && !bunRejected) throw new Error("private managed-session scope failed for an unexpected reason: " + message);\n}\nprocess.stdout.write(JSON.stringify({ root: Object.keys(root).sort(), sdk: Object.keys(sdk).sort() }));\n`,
+		);
+		await fs.appendFile(
+			probePath,
+			`\nconst rootBefore = JSON.stringify(await snapshot());\nconst rootListing = await root.listManagedSessionCandidates({ scope: resolved.scope });\nif (rootListing.kind !== "complete" || rootListing.owned.length !== listing.owned.length || rootListing.owned[0]?.sessionId !== listing.owned[0]?.sessionId || rootListing.owned[0]?.path !== listing.owned[0]?.path) throw new Error("packed root readonly listing diverged from SDK listing");\nconst rootAfter = JSON.stringify(await snapshot());\nif (rootAfter !== rootBefore) throw new Error("packed root readonly listing mutated the filesystem");\nconst bridgeClient = await import("@gajae-code/bridge-client");\nif (sdk.SdkClient !== bridgeClient.SdkClient) throw new Error("SdkClient class identity differs between sdk and bridge-client");\n`,
 		);
 		const surface = JSON.parse(run(["bun", "run", probePath], tempDir)) as Surface;
 		assertExport(Object.fromEntries(surface.root.map(name => [name, true])), "createAgentSession", "root");

package/scripts/generate-hotkeys-docs.ts

@@ -0,0 +1,74 @@
+import { readFileSync, writeFileSync } from "node:fs";
+import * as path from "node:path";
+import {
+	defaultClipboardPasteImageKeysForPlatform,
+	defaultMessageQueueKeysForPlatform,
+	KEYBINDINGS,
+} from "../src/config/keybindings";
+
+import { APP_ACTION_METADATA } from "../src/modes/action-registry";
+
+const DOC_PATH = path.resolve(import.meta.dir, "../../../docs/keybindings.md");
+const SECTION_START = "### Application context (`app.*`)";
+const SECTION_END = "### Global engine context (`tui.global.*`)";
+
+const DOCUMENTATION_PLATFORMS = ["darwin", "win32", "linux"] as const;
+
+function defaultKeys(
+	value: (typeof KEYBINDINGS)[keyof typeof KEYBINDINGS],
+	bindingId: keyof typeof KEYBINDINGS,
+): string {
+	const defaultsByPlatform = DOCUMENTATION_PLATFORMS.map(platform => {
+		switch (bindingId) {
+			case "app.message.queue":
+				return defaultMessageQueueKeysForPlatform(platform);
+			case "app.clipboard.pasteImage":
+				return defaultClipboardPasteImageKeysForPlatform(platform);
+			default: {
+				const keys = value.defaultKeys;
+				return (Array.isArray(keys) ? keys : [keys]).join(", ") || "_(none)_";
+			}
+		}
+	});
+	const groups = new Map<string, string[]>();
+	for (const [index, keys] of defaultsByPlatform.entries()) {
+		const platform = DOCUMENTATION_PLATFORMS[index]!;
+		groups.set(keys, [...(groups.get(keys) ?? []), platform]);
+	}
+	return groups.size === 1
+		? defaultsByPlatform[0]!
+		: [...groups].map(([keys, platforms]) => `${keys} (${platforms.join("/")})`).join(" / ");
+}
+
+/** Canonical application-action table shared by docs and drift tests. */
+export function generateHotkeysDocsTable(): string {
+	return [
+		"| Action ID | Default | Domains |",
+		"| --- | --- | --- |",
+		...APP_ACTION_METADATA.map(action => {
+			const binding = KEYBINDINGS[action.bindingId ?? action.id];
+			return `| \`${action.id}\` | ${defaultKeys(binding, action.bindingId ?? action.id)} | ${action.domains.join(", ")} |`;
+		}),
+	].join("\n");
+}
+
+export function generateKeybindingsDocument(source = readFileSync(DOC_PATH, "utf8")): string {
+	const start = source.indexOf(SECTION_START);
+	const end = source.indexOf(SECTION_END);
+	if (start < 0 || end < 0 || end <= start) throw new Error("Application keybinding section not found");
+	return `${source.slice(0, start)}${SECTION_START}\n\n${generateHotkeysDocsTable()}\n\n${source.slice(end)}`;
+}
+
+if (import.meta.main) {
+	const expected = generateKeybindingsDocument();
+	if (process.argv.includes("--check")) {
+		if (readFileSync(DOC_PATH, "utf8") !== expected) {
+			console.error(
+				`${path.relative(process.cwd(), DOC_PATH)} is out of date; run bun scripts/generate-hotkeys-docs.ts`,
+			);
+			process.exitCode = 1;
+		}
+	} else {
+		writeFileSync(DOC_PATH, expected);
+	}
+}