@gajae-code/coding-agent 0.11.11 → 0.12.0

package/CHANGELOG.md

@@ -2,11 +2,49 @@
 
 ## [Unreleased]
 
+## [0.12.0] - 2026-07-28
+### Resume fixes
+
+- The typed deep-interview repair CLI (#3040 and its follow-ups) was reverted and replaced with a minimal staged-transition surface: `gjc deep-interview stage --for <transition> --input '<json>'` (or `@file`), `check`, `apply`, and `discard`. The payload is one JSON document merged losslessly into current state — no per-field flag grammar. The session resolves from `GJC_SESSION_ID`, exactly one pending draft exists per session (no `--draft-id`), and the draft records the state revision it was staged against so `apply` CAS-checks it runtime-side; a stale draft is auto-invalidated with typed recovery guidance. `check` dry-runs the identical merge `apply` performs. Validation is core-schema only (envelope shape, bounded input sizes, locked intent-contract immutability); free-form interview fields pass through untouched.
+- Memory consolidation redacts GitHub tokens. The scrubber covered AWS ids, JWTs and keyword-prefixed keys, but GitHub tokens carry none of those keywords, so they reached `MEMORY.md` and `memory_summary.md` verbatim — and the summary is injected into every later session. Now covers the same three prefixes the contribution-prep scrubber already handled.
+- The native skill hook resolves its config paths through the trusted directory helpers. It read `GJC_CODING_AGENT_DIR` / `GJC_CONFIG_DIR` straight from `process.env`, which Bun populates from `cwd/.env` before any module runs, so a repository could point the hook at a directory it ships and inject its own `skills.customDirectories` — bypassing the escalation guards that already exist for exactly this.
+- Workflow settings are read from the config root under home. `GJC_CONFIG_DIR` is documented as a dirname under home and `dirs.ts` implements it that way, but the ralplan, ultragoal and deep-interview settings readers used the value as a full path, so setting it to the documented form made them look under the current working directory and silently fall back to built-in defaults.
+- Align managed fallback abort-after-exhaustion expectations with #3257 ownership release: a subscriber abort at terminal `message_end` no longer expects a second `requestRunTerminal(cancelled)` because the logical-run owner is already cleared.
+- Python eval timeout annotations now prefer the caller-configured `timeoutMs` over remaining wall-clock budget so async setup cannot flake second formatting in CI.
+- Overflow maintenance now stops cleanly when no-op compaction would replay the same oversized request; the runtime status explains that `/clear` preserves the current session ID before retrying.
+- The Smithery origin, API base and API key (`SMITHERY_URL`, `SMITHERY_API_URL`, `SMITHERY_API_KEY`) are now resolved from trusted environment sources only. The origin serves the CLI auth session the user is sent to, the API base receives `Authorization: Bearer <apiKey>` on every call and returns the connection records the agent consumes, and the key is that credential — all three were read through the merged view that includes the caller's `cwd/.env`. Shell, config and stored-credential paths are unchanged.
+- `gjc gc` now reports and prunes stale session local roots. Every session gets its own `<tmp>/gjc-local/<session-id>` directory seeded with a migration marker, and nothing ever removed them, so machines accumulated one per session indefinitely. Only marker-only directories past a 24h grace window are eligible, so a root holding real content or belonging to a session that just started is never touched, and prune re-validates immediately before removing.
+- `docs/environment-variables.md` now describes the `$env` loading order as implemented. The login shell rc files (`~/.zshenv`, `~/.zprofile`, `~/.zshrc`, `~/.bash_profile`, `~/.bashrc`) are a real sixth source and were missing from the list, and the page claimed `.env` files mirror `GJC_*` keys to `GJC_*` keys — a rule that is self-referential and that no code implements in either direction.
+- The package no longer advertises `./extensibility/custom-commands/bundled/review`. That module was deleted when the bundled agents were trimmed to four canonical role agents (#922), but its `exports` entry stayed, so the published surface declared a subpath that fails to resolve. A test now checks every declared `exports` / `main` / `module` / `types` / `bin` target resolves to a file that exists.
+- `docs/fs-scan-cache-architecture.md` now points at files that exist. It referenced a `packages/natives/src/` tree that the package does not have (its JS surface is the generated `native/index.js` / `native/index.d.ts`), the grep tool as `tools/grep.ts` when it is `tools/search.ts`, and a `src/patch/index.ts` for the hashline flows that live in `tools/ast-edit.ts`.
+- Provider base URLs resolved from the environment by the model registry are now read from trusted sources only. `resolveProviderBaseUrlFromEnv()` used the merged view that includes the caller's `cwd/.env`, and it is generic — `<PROVIDER>_BASE_URL` is derived for any provider on top of the explicit `ANTHROPIC_BASE_URL` / `OPENAI_BASE_URL` / `GOOGLE_BASE_URL` / `GEMINI_BASE_URL` aliases — so a repository could plant a `.env` that redirected authenticated traffic for every provider, including re-admitting a redirect the provider-level resolvers reject. It now uses the non-project resolver; shell and user-level configuration is unchanged.
+- The `ask` tool no longer rejects a JSON-string-encoded single-sided Round 0 payload before coercion; only the retired contract+review pair stays terminal, so a provider that serializes `questions` as a string no longer drives the model into an unbounded retry loop.
+- Browser launch overrides (`PUPPETEER_EXECUTABLE_PATH`, `PUPPETEER_PROXY`, `PUPPETEER_PROXY_BYPASS_LOOPBACK`, `PUPPETEER_PROXY_IGNORE_CERT_ERRORS`) are now resolved from trusted environment sources only. `Bun.env` is `process.env` and the env module merges the caller's `cwd/.env` into it, so a repository could previously plant a `.env` that chose the browser binary, routed every request through its own proxy, and disabled certificate validation. Resolution now goes through the non-project resolver (launching shell plus GJC/user-owned `.env` files); shell-level configuration is unchanged.
+- The tab-worker native-free import contract no longer invents import edges: its re-export scanner matched a bare `export` declaration followed anywhere later in the file by ` from "…"`, so a `from` inside a comment or string produced a phantom dependency. It now matches real re-export syntax (`export * from`, `export * as ns from`, `export { … } from`) only, and still fails on genuine barrel imports and re-exports.
+- The spawned command overrides `GJC_SDK_SESSION_COMMAND` (broker session host) and `GJC_HARNESS_PROCESS_START_COMMAND` (harness process-start probe) are now resolved from trusted environment sources only. `Bun.env` is `process.env` and the env module merges the caller's `cwd/.env` into it, so a repository could previously plant a `.env` choosing which binary those paths execute. Resolution now goes through the non-project resolver (launching shell plus GJC/user-owned `.env` files); operator and test usage is unchanged, and a malformed harness override stays fatal rather than falling back to `ps`.
+- macOS screenshot paths now recover the narrow no-break space before `AM`/`PM` for any following separator, so IDE-attached files such as `Screenshot … 11.23.30 PM-1785075812409.png` resolve instead of failing with `ENOENT`; word continuations like ` PMX` are left untouched.
+- ACP failures now reach the client with a real JSON-RPC code instead of collapsing to an opaque `-32603 Internal error`: internal string codes with an ACP counterpart map onto auth-required, resource-not-found, and invalid-params, the rest keep their discriminator in `data`, and translation happens once at the connection boundary. An unrecognized `extMethod` now returns `-32601` rather than a resolved `{ok:false}` payload.
+- ACP `Diff.path` is emitted absolute as the schema specifies, `ResourceLink.size` is forwarded only when it is a safe non-negative integer, and a failed tool update no longer overwrites `kind` with `other`, so clients keep the category they use for icons while failure stays carried by `status`.
+- Interactive `/resume` no longer awaits ordinary notification-endpoint rotation after predecessor fencing when the transition is stamped `interactive_selector_resume`; lifecycle/SDK identity-control paths still await readiness and use a fail-closed control-drain orchestration that sends terminal control outcomes only after successor readiness, while uncertain predecessor stop no longer starts the successor (#2914).
+- Interactive TUI `/resume` commits a status-container progress lease before inspect/migration/switch work and clears it on every exit path, with generation-scoped render-commit wait that fails open when the terminal is stopped or unavailable (#2914).
+- Interactive `/resume` progress lease fails open when `statusContainer` or UI lacks child-mutation/render-commit surface, preserving headless/minimal controller contexts without weakening full TUI progress-before-switch (#3234 post-merge).
+- The documented `GJC_OPENAI_CODE_WEB_SEARCH_MODEL` environment variable now overrides the OpenAI-code web-search model; it is resolved GJC-first ahead of the legacy `PI_CODEX_WEB_SEARCH_MODEL` name (previously only the legacy name was read, so the documented name was a silent no-op).
+
+### Added
+
+- Deterministic tests for session_switch await policy (selector defer vs default/branch await), control-drain ordering, host pre-response readiness gating, and resume progress lease-before-switch behavior (#2914).
+- Added an isolated Bun memory-baseline corpus with short/soak profiles across CLI, AgentSession, blob buffers, workers, Telegram, TUI, and shared/native boundaries; reports keep RSS, heap, external buffers, process-tree endpoints, active resources, throughput, and teardown evidence separate and advisory until variance is characterized.
+- Telegram per-tool activity is now opt-in and remains durably controllable with `/toolactivity on|off` or the Notifications preferences UI; disabling it suppresses tool start/completion success and error bubbles without hiding assistant, ask, or session notifications.
+- `/model`, `/login`, and `/provider` now order providers through one shared ranking: providers you already have (valid auth, in-flight validation, or a configured non-OAuth provider) come first, then providers whose stored credentials failed validation, then a curated list of well-known providers with regional and device variants grouped behind their primary, then everything else by display name. In `/model` rows, role/default rank and recent usage still take precedence over provider order (#3243).
+- Ralplan now bounds architect and critic re-review lanes independently through `gjc.ralplan.maxReviewPassesPerLane` (integer 1–10; default 1). Per-lane budget exhaustion emits a lane-specific `PLANNING-STUCK` exit 3, fails closed against on-disk artifact floors, and repairs crash-gap retries. Architect and critic `gjc ralplan --write` calls can optionally pass `--lane-verdict`, which drives HUD lane pass counts and the latest verdict; critic/architect prompts and the ralplan SKILL workflow now ratchet re-reviews through persisted receipts.
+- Ralplan consensus review lanes now persist same-session Architect and Critic subagent metadata (`--architect-id` / `--architect-resumable`, `--critic-id` / `--critic-resumable`) and resume those reviewers by default on pass 2+ with the mandatory re-review context bundle. Unavailable reviewer context falls back to a fresh lane spawn with role-scoped fallback metadata, preserving the existing sequential re-review cadence and receipt-only contract.
+
 ## [0.11.11] - 2026-07-26
 
 ### Added
 
 - Added cross-platform memory-pressure observability with effective host/cgroup limits, configurable GC and restart advisory thresholds, typed Linux process probes, and a Windows Job Object native probe; unsupported lifecycle actions remain advisory-only.
+- Added versioned memory-guard checkpoints with strict transcript/blob validation and fail-closed cross-process writer/TTY ownership claims for future graceful restart activation.
 - Ralplan consensus planning now enforces a finite planner/revision iteration budget at the native write path (default 5, configurable via `gjc.ralplan.maxIterations`). Opening another planner/revision pass past the cap fails closed with exit code 3 and an operator-visible `PLANNING-STUCK` marker instead of silent unbounded re-review; `final`/post-interview escalation remains allowed without auto-implementation. The cap also floors against on-disk `stage-*-{planner,revision}.md` artifacts so a wiped, truncated, or malformed `index.jsonl` cannot fail open after prior openers (#3165).
 - Added `grok-45-eco`, `grok-45-medium`, and `grok-45-pro` built-in xAI presets for `grok-4.5`; every role stays within the model's `high` reasoning cap, while the `xai` provider recommendation remains `grok-medium` to preserve existing defaults (#3177).
 - JetBrains Air ACP sessions now preserve final answers across fast prompt completion, expose tool/retry/goal/notices and session title updates, apply Air's legacy `session/set_model` preset changes through the canonical session configuration path, accept client-supplied stdio/HTTP/SSE MCP servers, reject unsupported additional directories, and reject unavailable model presets before provider dispatch.
@@ -15,10 +53,15 @@
 
 ### Changed
 
+- When GJC owns mouse input (`mouse.enabled: true`), mouse-wheel scrolling moves the session viewport by three rows per notch instead of a full page. PageUp/PageDown keep page-sized transcript-lane steps.
+- While reviewing transcript history, the status line and composer stay fixed at the bottom. Semantic assistant/tool output and visible capped-sidebar changes show `New output — type to follow`; duplicate, elided, hidden, geometry-only, and theme-only changes do not. Ordinary typing or paste returns to live output before editing without changing editor focus.
 - Telegram per-tool activity is now opt-in and remains durably controllable with `/toolactivity on|off` or the Notifications preferences UI; disabling it suppresses tool start/completion success and error bubbles without hiding assistant, ask, or session notifications.
 - Model preset landing now shows explicit `Enter: apply` and `d: set as default` hints; pressing `d` applies the highlighted profile as the default while Enter keeps the session-only apply path (#3161).
 
 ### Fixed
+
+- Session Observer now reads stable source snapshots, publishes only complete JSONL appends, validates replacement candidates, and clears stale transcript/model/tool content on source replacement, truncation, deletion, unreadability, or malformed candidates. Its transcript projection remains eager full-history work; this does not add virtualization or bounded full-history memory.
+- Session-manager fork/moveTo failure-injection tests now use a platform-aware hermetic seam: retained `RecoveryFsRoot` prototype spies on Linux and the direct native/fs fallbacks off Linux, with a required hit counter so a dead injection fails closed (#3209).
 - The #3216 win32 cleanup-producer regression no longer hardcodes divergent directory size `4096`; it injects `nativeRoot.size + 1` so the test stays hermetic when Linux directory size is already `4096` (post-merge Dev CI red on `79f0de870`).
 
 - The synchronous `local://` resolver now accepts a `cleanup_pending` legacy-migration marker instead of rejecting it as unsafe. The async gate already treats that state as settled — entries are installed and content-verified, and only retirement of the legacy source is outstanding — so a managed session whose migration ended in `cleanup_pending` previously failed closed with "Unsafe local:// migration marker" on every `local://` read even though `initializeLocalRoot()` had succeeded. Both marker checks now share one settled-state definition; unrecognized marker values are still rejected. Follow-up to #3080; the asymmetry has been reachable since #2797.
@@ -34,12 +77,14 @@
 - Workflow intent routing now requires a leading `/skill:ultragoal` for slash-command escalation and recognizes Korean object-particle requests such as `ultragoal을 사용해줘` without routing questions that merely mention the command.
 - Aligned the startup GJC Forge splash border with the composer trailing gutter, including the one-row constrained fallback.
 - `gjc resume` and delete no longer pay a durable (fsync-backed) lock acquisition for managed session tombstones that have nothing left to reconcile; a scope with many accumulated already-completed tombstones opens noticeably faster (#3067).
-- `gjc deep-interview apply-round-result` no longer fails with `DI_INTERNAL_ERROR` on every call, which made the deep-interview workflow unable to score a single round. Three defects stacked: the Round-0 topology gate is recorded as a permanently unscorable `answered` shell (`--round` must be >= 1) yet counted toward the "earlier rounds must be scored" precondition, deadlocking every later round; the round-result decoder materializes omitted optional keys as `undefined`, which canonical JSON rejected outright, so any request omitting `targeting`/`ontology`/`bookkeeping` could not be digested; and `scoreToUnits` tested the raw float product, so ordinary scores whose scaling misses the integer grid (`0.69 * 10_000` is `6900.000000000001`) were rejected as non-integral 1e-4 units. Round-0 gate shells are now excluded from the ordering precondition, canonical JSON drops `undefined` object properties like `JSON.stringify` (array elements and the top-level value stay strict), and 1e-4 unit conversion is decided from the shortest round-trip decimal so genuinely off-grid precision such as `0.00005` and `0.05000000000000001` is still rejected.
 - Task output-limit environment overrides now accept only complete positive decimal safe integers; malformed, fractional, exponent-form, whitespace-padded, and precision-losing values fall back to the documented defaults instead of being partially parsed (#3175).
 - Task output-limit environment overrides now honor values loaded from agent, config-root, and home dotenv files through the shared utils env loader while retaining strict positive safe-integer validation and canonical GJC-first alias precedence.
 - `--thinking` now advertises the supported Effort levels and fails closed with a usage error for invalid, missing, empty, or flag-adjacent values, rather than silently ignoring a token or consuming another flag.
 - MCP servers configured with a large `timeout` no longer widen the startup hang window for every consumer. The long startup ceiling now applies only to ACP lifecycle launches that supply their own MCP servers, derived from the session readiness deadline with reserved headroom; ordinary CLI/SDK `mcpConfigPath`, project, user, and plugin-bundle consumers keep the short default. An ACP launch that reaches the readiness cutoff before MCP startup now fails fast as a pending startup instead of silently falling back to the ordinary ceiling.
 
+- SDK MCP stdio (`gjc mcp-serve sdk`) now awaits in-flight JSON-RPC handlers after stdin EOF so tools/call responses finish and WebSocket clients close before process exit; the entrypoint e2e fixture bounds child/server/temp cleanup on success and failure so the suite cannot hang for the full 60s on a stuck server.
+- Shared kind-aware durable invocation reconciliation substrate for `turn.prompt` and `skill.invoke` (#3031/#3032/#3035): private `.sdk-reconciliation` store, awaitable preflight accept fence, non-hanging skill early-accept with optional `clientRef`.
+- AD-L-G02 daemon session CLI e2e is less flaky under CI load: mock WebSocket servers defer `server_hello` one tick, and query failures report stdout/stderr so a non-zero exit surfaces the real SDK error instead of only `exitCode`.
 ## [0.11.10] - 2026-07-25
 ### Changed
 
@@ -52,7 +97,7 @@
 - Restricted role-agent `bash` now accepts literal mid-word tildes, so git revision syntax such as `git diff HEAD~1` no longer has to be quoted. Bash performs tilde expansion only at the start of a word, so word-initial forms (`~`, `~/path`, `~user`) remain blocked.
 - Restricted role-agent `bash` now rejects unquoted tildes at every bash expansion position inside assignment words, including the compound `name+=value` form, so `A=~`, `A+=~`, `foo=~root/bar`, `A=x:~`, `A+=x:~`, and repeated colon segments such as `a=x:~:y:~` fail closed. Tildes bash does not expand — mid-word git revisions (`HEAD~1`), non-assignment words (`--opt=~`, `1abc=~`, `a++=~`, `a+b=~`), and quoted forms — remain allowed (#3117).
 - Read-only role agents (`architect`, `planner`, `critic`) now receive the `irc` coordination tool and a read-only git prefix set (`status`, `log`, `show`, `diff`, `blame`, `rev-parse`, `ls-files`) in restricted bash; mutating git and arbitrary shell stay blocked. `irc` also stays in the initial active tool set for subagents whenever the parent runtime reports IRC availability, instead of costing a discovery round-trip (#3109).
-- The restricted-bash workflow guard now allows `/dev/null` redirects (so `cmd 2>/dev/null` is no longer treated as a repository write during planning phases) while keeping `/dev/stdout`, `/dev/stderr`, and `/dev/fd/<n>` blocked, failing closed on `exec` redirections, and recognizing `>|`, `>&path`, `<>`, path-qualified writers, and every `dd of=` operand. Hook-seeded deep-interview state is now gated on `isNativeDeepInterviewV1` and seeded as a native v1 envelope, so typed operations no longer fail with `DI_STATE_SCHEMA_INVALID` and run the interview manually (#3127).
+- The restricted-bash workflow guard now allows `/dev/null` redirects (so `cmd 2>/dev/null` is no longer treated as a repository write during planning phases) while keeping `/dev/stdout`, `/dev/stderr`, and `/dev/fd/<n>` blocked, failing closed on `exec` redirections, and recognizing `>|`, `>&path`, `<>`, path-qualified writers, and every `dd of=` operand (#3127).
 - The vendored `insane-search` engine no longer treats a `429` as terminal: rate-limited probe and grid candidates back off (linear escalation honoring `Retry-After`, hard-capped at 30s) and continue through grid diversity and browser fallback. The backoff base from `INSANE_RATE_LIMIT_BACKOFF_S` is validated and clamped, so non-numeric, `NaN`, infinite, negative, or huge values can no longer raise, hang, or defeat a per-attempt deadline, and sleeps stay short enough to honor cancellation (#3131).
 - ACP sessions now apply execution permission decisions to eval calls and to tools invoked from JavaScript or Python eval contexts, while non-ACP session behavior remains unchanged.
 - Interactive prompt cancellation now reaches API-key preflight through `ModelRegistry`, allowing aborted submissions to clear immediately even while a shared credential-usage request continues in the background.
@@ -71,6 +116,7 @@
 - Rejected subagent schema payloads now retain their complete structured data in canonical output artifacts; inline results remain bounded while `agent://` output stays lossless (#2894).
 - Managed legacy-session artifact migration now validates Windows directory roots from the native tree snapshot, tolerates only lazy metadata on plain Windows directories, and replays both clean and cleanup-pending detaches while retaining fail-closed receipt validation. Canonical binding durability sync uses a writable no-follow handle on Windows NTFS stacks that reject `FlushFileBuffers` on read-only handles (#3015, #2913).
 - A single managed session tombstone that fails to reconcile (e.g. an artifact directory identity mismatch) no longer blocks resume or delete of every other session in the same managed scope; the failure is isolated to that tombstone and logged, unless it belongs to the session currently being opened, which still fails closed.
+- Added Linux-only team worker memory-pressure replacement with checkpoint classification, bounded retries, deterministic target selection, and fail-closed blocked tasks; Windows and macOS remain advisory-only.
 
 ## [0.11.8] - 2026-07-23
 ### Added
@@ -341,11 +387,11 @@
 
 ## [0.10.1] - 2026-07-13
 
-- Deep-interview bundled guidance now uses the typed native setup, topology, answer-recovery, round-result, selective inspection, and sanity-check commands for normal workflow state changes. Generic `gjc state` remains limited to documented compatibility/recovery handoff paths; ambiguity, receipts, revisions, topology persistence, and diagnosis/repair remain runtime-owned.
 ### Added
 
 - Added an owner-proof idle session reaper and `gjc_coordinator_stop_session` for ephemeral (delegate-created) coordinator sessions. Termination goes exclusively through the canonical SDK broker `session.close` lifecycle (durable process identity verified before close) — never a raw `process.kill` or tmux control. The reaper re-validates ephemeral and no-active-turn state at close time under the same per-session mutation lock as delegate reuse, and purges coordinator metadata only after SDK closure is verified, retaining it when closure cannot be confirmed (#2080).
 
+- Added an owner-proof idle session reaper and `gjc_coordinator_stop_session` for ephemeral (delegate-created) coordinator sessions. Termination goes exclusively through the owner-proof `forceCloseGjcTmuxSession` path (pid, native session id, owner generation, server key, and start time all verified before SIGTERM) — never a raw `process.kill`. The reaper binds each close to the persisted runtime-state file, re-validates ephemeral and no-active-turn at kill time under the same per-session mutation lock as delegate reuse, and purges state only on verified termination (#2080).
 - SDK clients can now pass an explicit thinking level to `model.set`, atomically applying the effective model and thinking level to the active session and the machine-global default for future sessions, while project policy and resumed session history retain precedence.
 - Context-usage tokens/% now use provider-reported usage as the single source of truth on every surface. `AgentSession.getContextUsage()` returns a source-tagged snapshot (`source: "provider_anchor" | "heuristic" | "unknown"`), and the status-line `context_pct` segment, inline model percentage, and `/context` totals consume that snapshot instead of recomputing an independent heuristic sum — so footer, status line, `/context`, ACP, and RPC can no longer disagree about the same session state. Heuristic estimation now applies only when no provider anchor exists (session start, aborted/error-only turns), and that fallback now includes the fixed system-prompt/tool/skill context it previously omitted. The pre-prompt compaction estimate honors the latest-compaction boundary (never anchors on stale pre-compaction usage totals), unknown post-compaction usage stays unknown (status line renders `?`; ACP omits the `usage_update` instead of reporting `used: 0`), and `/context` labels its total by provenance with a reconciliation line when the estimated category composition diverges from the provider-reported total.
 - Post-durable default-model-selection failures now expose a stable SDK error with bounded `restored`, `partial`, or `unknown` rollback state; preflight and validation errors remain unchanged.

package/dist/types/cli/read-cli.d.ts

@@ -1,4 +1,5 @@
 export interface ReadCommandArgs {
     path: string;
+    truncation?: "head" | "last" | "both";
 }
 export declare function runReadCommand(cmd: ReadCommandArgs): Promise<void>;

package/dist/types/commands/deep-interview.d.ts

@@ -24,6 +24,15 @@ export default class DeepInterview extends Command {
         "session-id": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
+        input: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        for: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        reset: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
         write: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };

package/dist/types/commands/harness.d.ts

@@ -1,4 +1,25 @@
 import { Command } from "@gajae-code/utils/cli";
+/**
+ * Operator override for the process-start probe command, resolved from trusted
+ * environment sources only.
+ *
+ * The result is spawned, so whatever can set it chooses which binary runs.
+ * `$env` merges the caller's `cwd/.env` into `process.env`, so reading it there
+ * would let repository content pick the command; resolve it the same way
+ * provider credentials are (launching shell plus GJC/user-owned `.env` files,
+ * never the project `.env`). A malformed override stays fatal rather than
+ * silently falling back to `ps`, matching the previous behavior.
+ */
+type ProcessStartCommandOverride = {
+    kind: "none";
+} | {
+    kind: "invalid";
+} | {
+    kind: "command";
+    command: string[];
+};
+/** Test seam: the process-start command override as resolved from trusted env. */
+export declare function processStartCommandOverrideForTest(): ProcessStartCommandOverride;
 export default class Harness extends Command {
     #private;
     static description: string;
@@ -41,3 +62,4 @@ export default class Harness extends Command {
     static examples: string[];
     run(): Promise<void>;
 }
+export {};

package/dist/types/commands/read.d.ts

@@ -10,6 +10,12 @@ export default class Read extends Command {
             required: true;
         };
     };
+    static flags: {
+        truncation: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            options: string[];
+            description: string;
+        };
+    };
     static examples: string[];
     run(): Promise<void>;
 }

package/dist/types/config/model-registry.d.ts

@@ -370,6 +370,10 @@ export declare class ModelRegistry {
      * as providers with stored credentials. See issue #993.
      */
     hasConfiguredAuth(model: Model<Api>): boolean;
+    /**
+     * Check whether auth is configured for a provider.
+     */
+    hasConfiguredProviderAuth(provider: string): boolean;
     getDiscoverableProviders(): string[];
     getProviderDiscoveryState(provider: string): ProviderDiscoveryState | undefined;
     /**

package/dist/types/config/provider-auth-health.d.ts

@@ -0,0 +1,14 @@
+import type { AuthStorage } from "@gajae-code/ai/auth-storage";
+/**
+ * Most recent OAuth validation outcome per provider, used only as an ordering
+ * hint so `/model` can rank a provider whose stored credentials failed
+ * validation below one that is healthy, without re-running validation itself.
+ *
+ * Entries are scoped to the `AuthStorage` that produced them and to its
+ * credential generation, so any login, logout, import, or deletion discards the
+ * stale result instead of overriding current auth state.
+ */
+export type ProviderAuthHealth = "valid" | "invalid";
+export declare function recordProviderAuthHealth(authStorage: AuthStorage, providerId: string, health: ProviderAuthHealth): void;
+export declare function getProviderAuthHealth(authStorage: AuthStorage, providerId: string): ProviderAuthHealth | undefined;
+export declare function clearProviderAuthHealth(authStorage: AuthStorage): void;

package/dist/types/config/provider-ranking.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Shared provider ordering used by every provider-facing selector (`/login`,
+ * `/model`, `/provider`).
+ *
+ * Providers the user already has come first, then a curated list of well-known
+ * providers, then everything else alphabetically. This is the single source of
+ * truth for that order — surfaces must not keep their own famous-provider list.
+ */
+/**
+ * Auth/config state of a provider as seen by the calling surface.
+ *
+ * - `valid` — stored credentials that validated successfully.
+ * - `checking` — stored credentials whose async validation is still in flight.
+ *   Ranked with `valid` so rows do not reflow when validation resolves.
+ * - `configured` — no OAuth record, but the provider is present in the model
+ *   registry with a working API key (custom/API-compatible providers).
+ * - `invalid` — stored credentials that failed validation (problematic login).
+ * - `none` — nothing stored and nothing configured.
+ */
+export type ProviderAuthState = "valid" | "checking" | "configured" | "invalid" | "none";
+export declare const PROVIDER_RANK_TIER: {
+    readonly existing: 0;
+    readonly problematic: 1;
+    readonly famous: 2;
+    readonly other: 3;
+};
+export type ProviderRankTier = (typeof PROVIDER_RANK_TIER)[keyof typeof PROVIDER_RANK_TIER];
+/**
+ * Curated provider order for the famous tier. Regional and device variants sit
+ * immediately behind their primary so related entries stay grouped.
+ */
+export declare const FAMOUS_PROVIDER_ORDER: readonly string[];
+/** A provider as ranked by a surface. `label` is what the user sees. */
+export interface RankableProvider {
+    id: string;
+    label: string;
+    authState: ProviderAuthState;
+}
+/** A provider's position in the ordering: its tier plus its rank inside that tier. */
+export interface ProviderRank {
+    tier: ProviderRankTier;
+    intraTierRank: number;
+}
+/**
+ * The single ranking result for a provider. `intraTierRank` is the curated
+ * famous-list position, or `Number.MAX_SAFE_INTEGER` for providers that are not
+ * on the list and therefore order by display label.
+ */
+export declare function rankProvider(provider: RankableProvider): ProviderRank;
+export declare function providerRankTier(authState: ProviderAuthState, id: string): ProviderRankTier;
+/** Position within the famous list, or `undefined` for providers not on it. */
+export declare function famousProviderIndex(id: string): number | undefined;
+/**
+ * Total order over providers: tier, then famous-list position, then display
+ * label, then id. The trailing id comparison guarantees no ties.
+ */
+export declare function compareRankedProviders(left: RankableProvider, right: RankableProvider): number;
+/** Convenience wrapper returning a new array in ranked order. */
+export declare function sortRankedProviders<T extends RankableProvider>(providers: readonly T[]): T[];

package/dist/types/config/settings-schema.d.ts

@@ -428,6 +428,11 @@ export declare const SETTINGS_SCHEMA: {
         readonly default: 5;
         readonly validate: (value: number) => boolean;
     };
+    readonly "gjc.ralplan.maxReviewPassesPerLane": {
+        readonly type: "number";
+        readonly default: 1;
+        readonly validate: (value: number) => boolean;
+    };
     readonly "theme.dark": {
         readonly type: "string";
         readonly default: "red-claw";
@@ -2464,7 +2469,7 @@ export declare const SETTINGS_SCHEMA: {
         readonly ui: {
             readonly tab: "editing";
             readonly label: "Default Read Limit";
-            readonly description: "Default number of lines returned when agent calls read without a limit";
+            readonly description: "Default collection/selection limit for read operations; bare local receipts use the separate 50-line / 10 KiB receipt budgets";
             readonly options: readonly [{
                 readonly value: "200";
                 readonly label: "200 lines";
@@ -2532,6 +2537,29 @@ export declare const SETTINGS_SCHEMA: {
             }];
         };
     };
+    readonly "read.truncation": {
+        readonly type: "enum";
+        readonly values: readonly ["head", "last", "both"];
+        readonly default: "last";
+        readonly ui: {
+            readonly tab: "editing";
+            readonly label: "Read Truncation";
+            readonly description: "Configured default direction for routes that support directional truncation; bare local and archive reads use this value (factory default: last), while explicit truncation always wins";
+            readonly options: readonly [{
+                readonly value: "head";
+                readonly label: "Head";
+                readonly description: "Keep the first N lines";
+            }, {
+                readonly value: "last";
+                readonly label: "Last";
+                readonly description: "Keep the last N lines (default)";
+            }, {
+                readonly value: "both";
+                readonly label: "Both";
+                readonly description: "Keep the start and the end, elide the middle";
+            }];
+        };
+    };
     readonly "read.summaryMaxBytes": {
         readonly type: "number";
         readonly default: 20;

package/dist/types/config/settings.d.ts

@@ -90,6 +90,8 @@ export declare class Settings implements NotificationSettingsReader {
     /** Diagnostics from schema reconciliation during the most recent load. */
     getSchemaReport(): SettingsSchemaReport;
     onChanged(listener: (path: SettingPath) => void): () => void;
+    /** Whether durable settings mutations are permitted for the loaded configuration. */
+    canWriteDurableConfig(): boolean;
     /**
      * Set a setting value (sync).
      * Updates global settings and reserves its background persistence slot before

package/dist/types/extensibility/extensions/types.d.ts

@@ -291,7 +291,16 @@ export interface ExtensionContext {
     } | undefined>;
     getJobs(): unknown;
     /** Typed skill and mode controls exposed to the SDK host. */
-    invokeSkill?(name: string, args?: string): Promise<unknown>;
+    invokeSkill?(name: string, args?: string, options?: {
+        onPreflightAccepted?: () => void;
+        onPreflightAcceptCommit?: () => void | Promise<void>;
+        onSkillPrepared?: (meta: {
+            name: string;
+            path: string;
+            lineCount?: number;
+            cleanedArgs?: string;
+        }) => void;
+    }): Promise<unknown>;
     setPlanMode?(on: boolean): unknown;
     operateGoal?(op: "create" | "get" | "resume" | "pause" | "complete" | "drop", objective?: string): Promise<unknown>;
     /** Typed nonvisual session controls exposed to the SDK host. */
@@ -760,6 +769,7 @@ export interface ExtensionAPI {
     sendUserMessage(content: string | (TextContent | ImageContent)[], options?: {
         deliverAs?: "steer" | "followUp";
         onPreflightAccepted?: () => void;
+        onPreflightAcceptCommit?: () => void | Promise<void>;
     }): Promise<void>;
     /** Append a custom entry to the session for state persistence (not sent to LLM). */
     appendEntry<T = unknown>(customType: string, data?: T): void;
@@ -933,6 +943,7 @@ options?: {
 export type SendUserMessageHandler = (content: string | (TextContent | ImageContent)[], options?: {
     deliverAs?: "steer" | "followUp";
     onPreflightAccepted?: () => void;
+    onPreflightAcceptCommit?: () => void | Promise<void>;
 }) => void | Promise<void>;
 export type AppendEntryHandler = <T = unknown>(customType: string, data?: T) => void;
 export type GetActiveToolsHandler = () => string[];
@@ -1037,7 +1048,16 @@ export interface ExtensionContextActions {
     getJobs?: () => unknown;
     setSdkPermissionProvider?: (provider: ((toolCall: ClientBridgePermissionToolCall, options: ClientBridgePermissionOption[], signal?: AbortSignal) => Promise<ClientBridgePermissionOutcome>) | undefined) => void;
     sdkControl?: (operation: string, input: Record<string, unknown>) => unknown | Promise<unknown>;
-    invokeSkill?: (name: string, args?: string) => Promise<unknown>;
+    invokeSkill?: (name: string, args?: string, options?: {
+        onPreflightAccepted?: () => void;
+        onPreflightAcceptCommit?: () => void | Promise<void>;
+        onSkillPrepared?: (meta: {
+            name: string;
+            path: string;
+            lineCount?: number;
+            cleanedArgs?: string;
+        }) => void;
+    }) => Promise<unknown>;
     setPlanMode?: (on: boolean) => unknown;
     operateGoal?: (op: "create" | "get" | "resume" | "pause" | "complete" | "drop", objective?: string) => Promise<unknown>;
 }

package/dist/types/extensibility/shared-events.d.ts

@@ -31,6 +31,8 @@ export interface SessionBeforeSwitchEvent {
     /** Session file we're switching to (only for "resume") */
     targetSessionFile?: string;
 }
+/** Origin used when an interactive session selector resumes a session. */
+export declare const INTERACTIVE_SELECTOR_RESUME_ORIGIN = "interactive_selector_resume";
 /** Fired after switching to another session */
 export interface SessionSwitchEvent {
     type: "session_switch";
@@ -38,6 +40,10 @@ export interface SessionSwitchEvent {
     reason: "new" | "resume" | "fork";
     /** Session file we came from */
     previousSessionFile: string | undefined;
+    /** Optional provenance for this session transition. */
+    transition?: {
+        origin: string;
+    };
 }
 /** Fired before branching a session (can be cancelled) */
 export interface SessionBeforeBranchEvent {

package/dist/types/gjc-runtime/deep-interview-ambiguity.d.ts

@@ -9,13 +9,15 @@ export interface AmbiguityClampResult {
     effective: number;
     clamped: boolean;
 }
-/** Compute the deterministic floor from integer units of persisted evidence. */
+/** Compute the deterministic floor from the inner deep-interview `state` object. */
 export declare function computeAmbiguityFloor(inner: unknown): AmbiguityFloorBreakdown;
 /** Clamp an LLM-reported ambiguity to the deterministic floor: `max(reported, floor)`. */
 export declare function clampReportedAmbiguity(reported: number, floor: number): AmbiguityClampResult;
 /**
- * Legacy pure utility for migrations and explicit repair flows. The recorder does
- * not dispute facts when an answer is retracted: scored evidence is immutable.
+ * Mark every established fact recorded in `retractedRound` as disputed. This is the
+ * mechanical contradiction signal for answer retraction: when the user replaces an
+ * already-scored answer (A -> B pivot), the facts that answer established can no
+ * longer be trusted, so they raise the floor until re-confirmed or superseded.
  * Returns new arrays/objects; never mutates the input.
  */
 export declare function disputeFactsFromRetractedRound(facts: readonly unknown[], retractedRound: number): {
@@ -35,12 +37,3 @@ export interface AppliedAmbiguityFloor {
  * (state CLI write/reconcile, recorder) applies this immediately before persisting.
  */
 export declare function applyAmbiguityFloorToEnvelope(value: unknown): AppliedAmbiguityFloor;
-export type DeepInterviewAmbiguityMilestone = "initial" | "progress" | "refined" | "ready";
-export declare function deriveAmbiguityMilestone(effectiveUnits: number, thresholdUnits: number): DeepInterviewAmbiguityMilestone;
-export declare function scoreToUnits(score: number): number;
-export declare function weightedAmbiguityUnits(scores: {
-    goal: number;
-    constraints: number;
-    criteria: number;
-    context?: number;
-}, type: "greenfield" | "brownfield"): number;

package/dist/types/gjc-runtime/deep-interview-recorder.d.ts

@@ -1,4 +1,4 @@
-import { type DeepInterviewEstablishedFact, type DeepInterviewIntentItem, type DeepInterviewIntentSubstitution, type DeepInterviewRoundRecord, type DeepInterviewRoundResultV1, type DeepInterviewStateEnvelope, type DeepInterviewTriggerMetadata } from "./deep-interview-state";
+import { type DeepInterviewEstablishedFact, type DeepInterviewIntentItem, type DeepInterviewIntentSubstitution, type DeepInterviewRoundRecord, type DeepInterviewStateEnvelope, type DeepInterviewTriggerMetadata } from "./deep-interview-state";
 export * from "./deep-interview-ambiguity";
 export * from "./deep-interview-state";
 /**
@@ -40,8 +40,6 @@ export interface DeepInterviewScoringInput {
     scores: Record<string, number>;
     ambiguity: number;
     triggers?: DeepInterviewTriggerMetadata[];
-    /** Complete native round result for typed callers. */
-    roundResult?: DeepInterviewRoundResultV1;
 }
 export type AppendOrMergeAction = "created" | "noop" | "replaced";
 export interface AppendOrMergeResult {
@@ -69,9 +67,11 @@ export interface TransitionValidationResult {
 }
 export declare function buildAnswerShell(input: DeepInterviewAnswerInput, now?: string): DeepInterviewRoundRecord;
 /**
- * Append-or-merge by `round_key`. An answer is a no-op only when its complete
- * canonical shell identity matches; a scored record is immutable evidence and
- * cannot be replaced by a late answer.
+ * Append-or-merge by `round_key`. Exactly one record per key:
+ * - no existing record -> append (`created`);
+ * - identical question_hash + answer_hash -> deterministic no-op (`noop`);
+ * - same key, different hashes -> deterministic replacement of the prior shell
+ *   (`replaced`); the prior answer for that key is superseded and lifecycle resets.
  */
 export declare function appendOrMergeRound(rounds: readonly DeepInterviewRoundRecord[], shell: DeepInterviewRoundRecord): AppendOrMergeResult;
 /**
@@ -94,43 +94,28 @@ export declare function ensureDeepInterviewStateShape(value: unknown): DeepInter
 export declare function projectCompactState(value: unknown, options?: {
     lastN?: number;
 }): DeepInterviewCompactState;
-interface RecorderMutationOptions {
-    sessionId?: string;
-    expectedRevision?: number;
-}
-export interface DeepInterviewPostCommitWarning {
-    code: "DI_POST_COMMIT_AUDIT_FAILED" | "DI_POST_COMMIT_ACTIVITY_FAILED" | "DI_POST_COMMIT_HUD_FAILED";
-    message: string;
-}
-export declare function runDeepInterviewPostCommitEffects(options: {
-    cwd: string;
-    statePath: string;
-    sessionId: string;
-    envelope: Record<string, unknown>;
-    revision: number;
-    writer: string;
-    auditWarnings?: readonly {
-        code: "DI_POST_COMMIT_AUDIT_FAILED";
-        message: string;
-    }[];
-}): Promise<DeepInterviewPostCommitWarning[]>;
 /** Refresh the best-effort HUD cache from persisted deep-interview state. */
 export declare function syncDeepInterviewRecorderHud(cwd: string, statePath: string, sessionId: string | undefined): Promise<void>;
 /**
  * Record an `answered` shell for one round (append-or-merge by durable key).
  *
- * Replacing an already-scored answer is rejected with
- * `DI_ANSWER_LIFECYCLE_CONFLICT`; scored evidence is immutable.
+ * Retraction dynamics: replacing an already-`scored` answer is a mechanical
+ * contradiction signal (the user pivoted). The facts that round established are
+ * marked disputed, which raises the deterministic ambiguity floor immediately —
+ * without waiting for the LLM scorer to self-report a trigger.
  */
-export declare function appendOrMergeDeepInterviewRound(cwd: string, statePath: string, input: DeepInterviewAnswerInput, options?: RecorderMutationOptions): Promise<{
+export declare function appendOrMergeDeepInterviewRound(cwd: string, statePath: string, input: DeepInterviewAnswerInput, options?: {
+    sessionId?: string;
+}): Promise<{
     action: AppendOrMergeAction;
     record: DeepInterviewRoundRecord;
-    warnings: DeepInterviewPostCommitWarning[];
+    disputedFactIds?: string[];
 }>;
 /** Merge scoring output into the same round record, transitioning to `scored`. */
-export declare function enrichDeepInterviewRoundScoring(cwd: string, statePath: string, input: DeepInterviewScoringInput, options?: RecorderMutationOptions): Promise<{
+export declare function enrichDeepInterviewRoundScoring(cwd: string, statePath: string, input: DeepInterviewScoringInput, options?: {
+    sessionId?: string;
+}): Promise<{
     record: DeepInterviewRoundRecord;
-    warnings: DeepInterviewPostCommitWarning[];
 }>;
 /** Compact projection so callers read a slice instead of the full transcript. */
 export declare function readDeepInterviewStateCompact(statePath: string, options?: {

package/dist/types/gjc-runtime/deep-interview-stage.d.ts

@@ -0,0 +1,37 @@
+import { CommandError } from "./workflow-cli-common";
+export declare const DEEP_INTERVIEW_STAGE_TRANSITIONS: readonly ["initialize-context", "record-round", "update-facts", "merge-state"];
+export type DeepInterviewStageTransition = (typeof DEEP_INTERVIEW_STAGE_TRANSITIONS)[number];
+declare const DRAFT_VERSION = 1;
+export type DeepInterviewStageErrorCode = "DI_STAGE_USAGE" | "DI_STAGE_INPUT_INVALID" | "DI_STAGE_SESSION_REQUIRED" | "DI_STAGE_DRAFT_EXISTS" | "DI_STAGE_NO_DRAFT" | "DI_STAGE_DRAFT_CORRUPT" | "DI_STAGE_STATE_MISSING" | "DI_STAGE_STATE_CORRUPT" | "DI_STAGE_REVISION_CONFLICT" | "DI_STAGE_MERGE_REJECTED";
+export declare class DeepInterviewStageError extends CommandError {
+    readonly code: DeepInterviewStageErrorCode;
+    readonly recovery?: string | undefined;
+    constructor(code: DeepInterviewStageErrorCode, message: string, recovery?: string | undefined);
+}
+export interface DeepInterviewStageDraft {
+    version: typeof DRAFT_VERSION;
+    draft_id: string;
+    session_id: string;
+    transition: DeepInterviewStageTransition;
+    /** State revision the draft was staged against; `apply` CAS-checks this. */
+    staged_against_revision: number;
+    /**
+     * Canonical content SHA-256 of the state the draft was staged against. Revision
+     * alone cannot catch sanctioned writers that do not bump `state_revision`
+     * (seed/spec-persistence), so `apply` requires BOTH to match.
+     */
+    staged_against_sha256: string;
+    payload: Record<string, unknown>;
+    created_at: string;
+}
+export interface DeepInterviewStageCommandResult {
+    status: number;
+    stdout?: string;
+    stderr?: string;
+}
+export declare function deepInterviewDraftPath(cwd: string, sessionId: string): string;
+export declare const DEEP_INTERVIEW_STAGE_VERBS: readonly ["stage", "check", "apply", "discard", "read", "write", "clear", "handoff"];
+export type DeepInterviewStageVerb = (typeof DEEP_INTERVIEW_STAGE_VERBS)[number];
+export declare function isDeepInterviewStageVerb(value: string | undefined): value is DeepInterviewStageVerb;
+export declare function runDeepInterviewStageCommand(verb: DeepInterviewStageVerb, args: readonly string[], cwd?: string): Promise<DeepInterviewStageCommandResult>;
+export {};