@gajae-code/coding-agent 0.11.3 → 0.11.5

package/CHANGELOG.md

@@ -2,6 +2,53 @@
 
 ## [Unreleased]
 
+## [0.11.5] - 2026-07-20
+### Changed
+- Telegram live-message streaming now defaults on for configured Telegram notifications through one durable global preference, supports live in-session preference refresh without weakening redaction, and keeps Discord and Slack finalized-only; process environment overrides remain available.
+- Telegram tool-activity updates can now be disabled persistently with `/toolactivity off` (and restored with `/toolactivity on`) or from the Notifications preferences UI, without disabling final answers, asks, or other notification delivery.
+- Reduced the default session's initial context and corrected tool-schema token accounting: `estimateToolSchemaTokens` now measures the provider-visible wire schema instead of raw zod schema objects, so `/context`, the status line, and compaction report real cost; the `ask` tool is now registered-not-attached (attached only for pending workflow gates, canonical GJC workflow skill activation, and plan-mode enforcement) and its wire schema was slimmed. A fresh default session drops from 12 to 11 resident tools with markedly lower reported non-message context (#2729).
+- Session files now use v5 authority records. Do not roll back to a v4 writer after v5 session data has been created: v4 writers cannot preserve independent MCP and discovered-built-in selections.
+
+### Fixed
+- Fixed the `subagent` tool's `resume` action silently swallowing manager failures. Resume outcomes other than `context_unavailable`/`not_found` (`no_runner`, `resume_failed`, `owner_shutdown_in_progress`, …) were dropped and the stale terminal subagent snapshot was returned as if the resume had succeeded, so ralplan's re-review loop believed the persisted Planner had resumed when it had not and never fell back correctly. The resume action now surfaces every non-ok reason (matching the `steer` branch), and the task resume runner marks a resumed subprocess that aborted or exited non-zero as a `failed` job (carrying its rendered failure summary) instead of reporting it `completed`.
+- Hardened standalone HTML session exports so session identifiers, provider/model labels, and embedded raster images remain confined to their intended HTML contexts; malformed image payloads are omitted.
+- Fixed the `subagent` tool's `resume` failing immediately for a persisted ralplan Planner. A subagent that finishes by calling `yield` (or is torn down right after a tool executes) left the saved session ending on an assistant `toolCall` with no matching `toolResult`; replaying that history on resume produced an invalid provider request (a `tool_use` not followed by a `tool_result`) that failed the resumed turn at once. Resumed transcripts now reconcile any trailing unpaired tool call with a synthesized placeholder result before the first resumed prompt. Additionally, a failed/no-op resume leg no longer overwrites the prior run's success output artifact with an empty file.
+- Fixed persisted subagent resumes being rejected before session reconstruction with `Session is inside managed storage but is not an authorized managed candidate`. Child session files intentionally live inside their parent session's artifact directory and are not top-level resume-picker candidates; the task resume path now explicitly opens the exact internally registered child session directory while retaining strict candidate validation for user-selected managed sessions.
+- Managed session resume scans now read only a bounded no-follow header prefix from foreign workspace transcripts, while fully recapturing and revalidating owned candidates before granting migration, receipt, or deletion authority.
+- Secret obfuscation now uses authenticated process-local placeholders that remain stable within a running process and opaque after restart.
+- Workspace-wide LSP diagnostics now fail closed instead of launching build or typecheck subprocesses outside execution-tool authorization; concrete-file and glob diagnostics remain available.
+- Clean, side-effect-free canonical provider stream first-event and next-event watchdog failures now retry on bare single-model legacy sessions; explicit legacy disable, managed fallback, and fail-closed structured, non-watchdog, or unsafe attempts are unchanged.
+- Added fail-closed managed tmux owner SIGABRT recovery: exact-child supervisor receipts and pre-CLI admission now bind replacement ownership, strict durable Ultragoal/transcript evidence reconciles terminal child yields over stale nonterminal runtime state, recovery hydration remains write-free until an ownership fence, and hostile identity, corruption, concurrency, and path boundaries preserve dirty product files (#2681).
+- Restored non-root startup on Synology and other Linux container filesystems that definitively report POSIX ACL storage unsupported for managed session paths; explicit `--session-dir` semantics and all owner, mode, type, symlink, identity, and scope-binding checks remain unchanged and fail closed (#2687).
+- Preserved access to legal SQLite table names beginning with `sqlite` but not reserved `sqlite_`.
+- Decoupled the Telegram daemon's operational generation from its notification protocol version and advanced it through generation 9, so upgrades from v0.10.2 replace generation-3 owners through durable provisional/ready/retired handoff, canonical process-incarnation fencing, stable process-reference signaling, tri-state foreign-owner provenance, owner-lock leases, identity-atomic transition markers, and retained managed-filesystem authority changes instead of silently attaching. Discord and Slack now use generation 6 with stable process-reference signaling, exact owner/reclaim leases, ownership-heartbeat loss shutdown, replacement of physically live but incompatible owners, and the same retained native-authority boundary; focused rolling-upgrade regressions and a per-family lifecycle authority guard enforce the contract (#2278, #2687).
+- Activated discoverable built-in tools now persist with independent MCP and discovered-built-in authority, preserving explicit empty selections and restoring only eligible built-ins across resumed lifecycle transitions.
+
+## [0.11.4] - 2026-07-20
+### Added
+- Bracketed pastes containing complete lists of saved static-image paths can now attach up to 16 images in source order after explicit confirmation. Paste transactions are cancellation-safe, disabled in command modes, enforce source, encoded-output, dimension, and decoded-memory budgets before commit, reject animated, remote, linked, or path-swapped sources, and restore the literal paste on cancellation or failure.
+- Rich tool-call rendering in the transcript viewer: both the session-observer and main-session transcript viewers now share one formatter so tool calls render identically (args summary + intent, then a result block with ✓ done / ✗ error / ⏳ pending states). Fixes a latent bug where a tool call with no result rendered as a false "✓ done"; expanded results cap at 100 source lines with raw/copy exposing the full text (#2656).
+
+### Changed
+- Updated the Kimi Coding Plan Eco, Medium, and Pro presets to Kimi K3 with its supported `low`, `high`, and `max` reasoning efforts.
+
+### Removed
+- Removed the legacy worktree cleanup implementation behind the `@gajae-code/coding-agent/cli/worktree-cli` and `@gajae-code/coding-agent/commands/worktree` package subpaths (base and `.js` forms). The `gjc worktree`/`wt` CLI command has been unregistered since the workflow-surface narrowing; the modules behind it (including the recursive-deletion `clear` path) were only reachable as package imports. The subpaths now resolve to throwing tombstone modules whose error explains the deliberate removal and the supported replacement: inspect leftover managed worktrees under `~/.gjc/wt` manually and use `git worktree remove` / `git worktree prune`.
+
+### Fixed
+- MCP OAuth discovery now treats transport error hints as classification-only and uses one public-network-validated, redirect-aware, issuer/resource-bound traversal budget across metadata aliases and cycles.
+- Telegram `/btw` rich-delivery E2E coverage now awaits native and daemon teardown ownership, records exact per-iteration lifecycle phases, and uses an internal exact-tuple terminal-delivery receipt to keep fallback stress deterministic under shard load without extending the original test timeout.
+- Malformed spurious Round-0 review metadata no longer blocks an otherwise valid locked-intent question/gate, while durable intent safety remains fail-closed (#2643).
+- Restricted role-agent `gjc state` command authorization now fails closed on argv-classification disagreement: one shared manifest-aware native state argv grammar (action names, flag arity, positionals, effective modifiers, selector candidates) is consumed by both runtime dispatch and the policy boundary, which rejects ambiguous selectors, malformed flags, destructive actions, and file-backed input (#2665).
+- Browser tab workers now bootstrap through their actual isolated entry without accidentally loading native bindings through broad imports, and startup fails closed instead of falling back to unguarded inline execution; compiled/package smoke now exercises the tab worker, with a PR-head darwin-arm64 CI gate (#2598).
+- Added evidence-preserving recovery for legacy multi-writer SDK session-index corruption: `gjc gc` now diagnoses corrupt prefixes, `--repair-session-index` quarantines the original snapshot/log under the session-index lock before atomically restoring only the checksum-valid monotonic prefix, and append failures point operators to the explicit repair path (#2654).
+- Malformed selectors on internal read URLs now fail explicitly instead of silently falling back to an unbounded resource read.
+- Newly registered earlier resource-GC policies advance the pending sweep without postponing an already earlier sweep.
+- Provider onboarding wizard completion is now deterministic under CI load: duplicate in-flight confirmation is suppressed, success tests await the real refresh/notification/status boundary instead of fixed sleeps, and the newly configured model is verified through the subsequent model selector.
+- OpenAI-compatible web search now turns malformed successful response bodies into bounded provider errors while preserving normal provider fallback (#2593).
+- Windows session storage now keeps a symlink-resolved drive-letter path for Bun filesystem I/O instead of a native Volume GUID identity path, preventing `ENOENT` failures during resident-cache writes that could drop the final assistant message at turn completion.
+- On platforms with verified retained publication identity support, detached SDK broker processes now stop after durable loss or replacement of their owned publication while preserving warm reuse and protocol/state formats (#2583). Bounded-practical limitation: requests admitted before the first definitive loss observation—or after authoritative same-object recovery and before a later loss observation—may still perform pathname-based index, ledger, lifecycle, cleanup, or child effects. A detached session-host child spawned by an admitted request may outlive broker exit and may continue pathname effects for the session lifetime. Broker self-reap does not cancel or signal that child and does not provide absolute hostile replacement isolation.
+
 ## [0.11.3] - 2026-07-19
 
 ### Changed

package/dist/types/cli/notify-cli.d.ts

@@ -1,5 +1,6 @@
 import { Settings } from "../config/settings";
 import { type EnsureChatDaemonResult } from "../sdk/bus/chat-daemon-control";
+import { type EnsureTelegramDaemonDetailedResult } from "../sdk/bus/telegram-daemon";
 import { type TelegramSetupPreflight, type TelegramSetupTimers } from "../sdk/bus/telegram-setup";
 export type NotifyAction = "setup" | "status" | "health" | "test" | "recovery" | "daemon-internal";
 export type NotifySetupProvider = "telegram" | "discord" | "slack";
@@ -44,7 +45,10 @@ export interface NotifyCommandDeps {
     setupTimers?: TelegramSetupTimers;
     setupAbortSignal?: AbortSignal;
     setupPidAlive?: (pid: number) => boolean;
-    ensureProviderDaemon?: (provider: "discord" | "slack", settings: Settings) => Promise<EnsureChatDaemonResult | "failed">;
+    /** Injectable process-start provenance reader for ambient Telegram setup preflight. */
+    setupPidIncarnation?: (pid: number) => string | undefined;
+    ensureProviderDaemon?: (provider: "discord" | "slack", settings: Settings) => Promise<EnsureChatDaemonResult>;
+    ensureTelegramDaemon?: (settings: Settings) => Promise<EnsureTelegramDaemonDetailedResult>;
 }
 export declare function parseNotifyArgs(args: string[]): NotifyCommandArgs | undefined;
 export declare function runNotifyCommand(cmd: NotifyCommandArgs, deps?: NotifyCommandDeps): Promise<void>;

package/dist/types/cli/worktree-cli.d.ts

@@ -1,26 +1,9 @@
-type WorktreeKind = "pr-checkout" | "task-isolation" | "empty" | "stray";
-export interface WorktreeEntry {
-    /** Absolute path to the worktree dir (or stray container) under `~/.gjc/wt/`. */
-    path: string;
-    /** Classification of what we found on disk. */
-    kind: WorktreeKind;
-    /** Parent repo root, when this is a registered git worktree. */
-    parentRepo?: string;
-    /** Branch name extracted from the parent's tracking file, when available. */
-    branch?: string;
-    /** When set, the entry is unhealthy and `gjc worktree clear` will remove it. */
-    orphanReason?: string;
-}
-export interface ListWorktreesOptions {
-    json: boolean;
-}
-export interface ClearWorktreesOptions {
-    /** Remove every entry, including live PR-checkout worktrees. */
-    all: boolean;
-    /** Print what would be removed without touching the filesystem. */
-    dryRun: boolean;
-    json: boolean;
-}
-export declare function listWorktrees(options: ListWorktreesOptions): Promise<void>;
-export declare function clearWorktrees(options: ClearWorktreesOptions): Promise<void>;
+/**
+ * Tombstone for the removed legacy worktree cleanup API.
+ *
+ * The recursive-deletion implementation that previously lived here
+ * (`listWorktrees`/`clearWorktrees`) was deliberately removed and does not
+ * come back through this subpath. This module exists only to fail imports
+ * with actionable migration guidance.
+ */
 export {};

package/dist/types/commands/gc.d.ts

@@ -20,6 +20,10 @@ export default class Gc extends Command {
             description: string;
             default: boolean;
         };
+        "repair-session-index": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+            default: boolean;
+        };
     };
     static examples: string[];
     run(): Promise<void>;

package/dist/types/commands/worktree.d.ts

@@ -1,34 +1,9 @@
 /**
- * List and clean up agent-managed git worktrees under `~/.gjc/wt`.
+ * Tombstone for the removed legacy `worktree` CLI command module.
+ *
+ * The `gjc worktree`/`wt` command was unregistered during the
+ * workflow-surface narrowing and its implementation was deliberately
+ * removed. This module exists only to fail imports with actionable
+ * migration guidance.
  */
-import { Command } from "@gajae-code/utils/cli";
-export default class Worktree extends Command {
-    static description: string;
-    static aliases: string[];
-    static args: {
-        action: import("@gajae-code/utils/cli").ArgDescriptor & {
-            description: string;
-            required: false;
-            options: string[];
-            default: string;
-        };
-    };
-    static flags: {
-        all: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
-            description: string;
-            default: boolean;
-        };
-        "dry-run": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
-            char: string;
-            description: string;
-            default: boolean;
-        };
-        json: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
-            char: string;
-            description: string;
-            default: boolean;
-        };
-    };
-    static examples: string[];
-    run(): Promise<void>;
-}
+export {};

package/dist/types/config/settings-schema.d.ts

@@ -154,6 +154,10 @@ export declare const SETTINGS_SCHEMA: {
         readonly type: "boolean";
         readonly default: true;
     };
+    readonly "notifications.telegram.streaming.enabled": {
+        readonly type: "boolean";
+        readonly default: true;
+    };
     readonly "notifications.telegram.rich.enabled": {
         readonly type: "boolean";
         readonly default: true;
@@ -174,6 +178,16 @@ export declare const SETTINGS_SCHEMA: {
             readonly editing: "notification-atomic";
         };
     };
+    readonly "notifications.telegram.toolActivity.enabled": {
+        readonly type: "boolean";
+        readonly default: true;
+        readonly ui: {
+            readonly tab: "notifications";
+            readonly label: "Telegram Tool Activity";
+            readonly description: "Send Telegram updates for tool starts and completions.";
+            readonly editing: "notification-atomic";
+        };
+    };
     readonly "notifications.telegram.topics.nameTemplate": {
         readonly type: "string";
         readonly default: undefined;
@@ -4154,6 +4168,12 @@ export interface NotificationsSettings {
         richDraft: {
             enabled: boolean;
         };
+        toolActivity: {
+            enabled: boolean;
+        };
+        streaming: {
+            enabled: boolean;
+        };
         topics: {
             nameTemplate: string | undefined;
         };