@gajae-code/coding-agent 0.11.4 → 0.11.6

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## [Unreleased]
 
+## [0.11.5] - 2026-07-20
+### Changed
+- Telegram live-message streaming now defaults on for configured Telegram notifications through one durable global preference, supports live in-session preference refresh without weakening redaction, and keeps Discord and Slack finalized-only; process environment overrides remain available.
+- Telegram tool-activity updates can now be disabled persistently with `/toolactivity off` (and restored with `/toolactivity on`) or from the Notifications preferences UI, without disabling final answers, asks, or other notification delivery.
+- Reduced the default session's initial context and corrected tool-schema token accounting: `estimateToolSchemaTokens` now measures the provider-visible wire schema instead of raw zod schema objects, so `/context`, the status line, and compaction report real cost; the `ask` tool is now registered-not-attached (attached only for pending workflow gates, canonical GJC workflow skill activation, and plan-mode enforcement) and its wire schema was slimmed. A fresh default session drops from 12 to 11 resident tools with markedly lower reported non-message context (#2729).
+- Session files now use v5 authority records. Do not roll back to a v4 writer after v5 session data has been created: v4 writers cannot preserve independent MCP and discovered-built-in selections.
+
+### Fixed
+- Fixed the `subagent` tool's `resume` action silently swallowing manager failures. Resume outcomes other than `context_unavailable`/`not_found` (`no_runner`, `resume_failed`, `owner_shutdown_in_progress`, …) were dropped and the stale terminal subagent snapshot was returned as if the resume had succeeded, so ralplan's re-review loop believed the persisted Planner had resumed when it had not and never fell back correctly. The resume action now surfaces every non-ok reason (matching the `steer` branch), and the task resume runner marks a resumed subprocess that aborted or exited non-zero as a `failed` job (carrying its rendered failure summary) instead of reporting it `completed`.
+- Hardened standalone HTML session exports so session identifiers, provider/model labels, and embedded raster images remain confined to their intended HTML contexts; malformed image payloads are omitted.
+- Fixed the `subagent` tool's `resume` failing immediately for a persisted ralplan Planner. A subagent that finishes by calling `yield` (or is torn down right after a tool executes) left the saved session ending on an assistant `toolCall` with no matching `toolResult`; replaying that history on resume produced an invalid provider request (a `tool_use` not followed by a `tool_result`) that failed the resumed turn at once. Resumed transcripts now reconcile any trailing unpaired tool call with a synthesized placeholder result before the first resumed prompt. Additionally, a failed/no-op resume leg no longer overwrites the prior run's success output artifact with an empty file.
+- Fixed persisted subagent resumes being rejected before session reconstruction with `Session is inside managed storage but is not an authorized managed candidate`. Child session files intentionally live inside their parent session's artifact directory and are not top-level resume-picker candidates; the task resume path now explicitly opens the exact internally registered child session directory while retaining strict candidate validation for user-selected managed sessions.
+- Managed session resume scans now read only a bounded no-follow header prefix from foreign workspace transcripts, while fully recapturing and revalidating owned candidates before granting migration, receipt, or deletion authority.
+- Secret obfuscation now uses authenticated process-local placeholders that remain stable within a running process and opaque after restart.
+- Workspace-wide LSP diagnostics now fail closed instead of launching build or typecheck subprocesses outside execution-tool authorization; concrete-file and glob diagnostics remain available.
+- Clean, side-effect-free canonical provider stream first-event and next-event watchdog failures now retry on bare single-model legacy sessions; explicit legacy disable, managed fallback, and fail-closed structured, non-watchdog, or unsafe attempts are unchanged.
+- Added fail-closed managed tmux owner SIGABRT recovery: exact-child supervisor receipts and pre-CLI admission now bind replacement ownership, strict durable Ultragoal/transcript evidence reconciles terminal child yields over stale nonterminal runtime state, recovery hydration remains write-free until an ownership fence, and hostile identity, corruption, concurrency, and path boundaries preserve dirty product files (#2681).
+- Restored non-root startup on Synology and other Linux container filesystems that definitively report POSIX ACL storage unsupported for managed session paths; explicit `--session-dir` semantics and all owner, mode, type, symlink, identity, and scope-binding checks remain unchanged and fail closed (#2687).
+- Preserved access to legal SQLite table names beginning with `sqlite` but not reserved `sqlite_`.
+- Decoupled the Telegram daemon's operational generation from its notification protocol version and advanced it through generation 9, so upgrades from v0.10.2 replace generation-3 owners through durable provisional/ready/retired handoff, canonical process-incarnation fencing, stable process-reference signaling, tri-state foreign-owner provenance, owner-lock leases, identity-atomic transition markers, and retained managed-filesystem authority changes instead of silently attaching. Discord and Slack now use generation 6 with stable process-reference signaling, exact owner/reclaim leases, ownership-heartbeat loss shutdown, replacement of physically live but incompatible owners, and the same retained native-authority boundary; focused rolling-upgrade regressions and a per-family lifecycle authority guard enforce the contract (#2278, #2687).
+- Activated discoverable built-in tools now persist with independent MCP and discovered-built-in authority, preserving explicit empty selections and restoring only eligible built-ins across resumed lifecycle transitions.
+
 ## [0.11.4] - 2026-07-20
 ### Added
 - Bracketed pastes containing complete lists of saved static-image paths can now attach up to 16 images in source order after explicit confirmation. Paste transactions are cancellation-safe, disabled in command modes, enforce source, encoded-output, dimension, and decoded-memory budgets before commit, reject animated, remote, linked, or path-swapped sources, and restore the literal paste on cancellation or failure.
@@ -14,6 +36,7 @@
 - Removed the legacy worktree cleanup implementation behind the `@gajae-code/coding-agent/cli/worktree-cli` and `@gajae-code/coding-agent/commands/worktree` package subpaths (base and `.js` forms). The `gjc worktree`/`wt` CLI command has been unregistered since the workflow-surface narrowing; the modules behind it (including the recursive-deletion `clear` path) were only reachable as package imports. The subpaths now resolve to throwing tombstone modules whose error explains the deliberate removal and the supported replacement: inspect leftover managed worktrees under `~/.gjc/wt` manually and use `git worktree remove` / `git worktree prune`.
 
 ### Fixed
+- MCP OAuth discovery now treats transport error hints as classification-only and uses one public-network-validated, redirect-aware, issuer/resource-bound traversal budget across metadata aliases and cycles.
 - Telegram `/btw` rich-delivery E2E coverage now awaits native and daemon teardown ownership, records exact per-iteration lifecycle phases, and uses an internal exact-tuple terminal-delivery receipt to keep fallback stress deterministic under shard load without extending the original test timeout.
 - Malformed spurious Round-0 review metadata no longer blocks an otherwise valid locked-intent question/gate, while durable intent safety remains fail-closed (#2643).
 - Restricted role-agent `gjc state` command authorization now fails closed on argv-classification disagreement: one shared manifest-aware native state argv grammar (action names, flag arity, positionals, effective modifiers, selector candidates) is consumed by both runtime dispatch and the policy boundary, which rejects ambiguous selectors, malformed flags, destructive actions, and file-backed input (#2665).

package/dist/types/cli/notify-cli.d.ts

@@ -1,5 +1,6 @@
 import { Settings } from "../config/settings";
 import { type EnsureChatDaemonResult } from "../sdk/bus/chat-daemon-control";
+import { type EnsureTelegramDaemonDetailedResult } from "../sdk/bus/telegram-daemon";
 import { type TelegramSetupPreflight, type TelegramSetupTimers } from "../sdk/bus/telegram-setup";
 export type NotifyAction = "setup" | "status" | "health" | "test" | "recovery" | "daemon-internal";
 export type NotifySetupProvider = "telegram" | "discord" | "slack";
@@ -44,7 +45,10 @@ export interface NotifyCommandDeps {
     setupTimers?: TelegramSetupTimers;
     setupAbortSignal?: AbortSignal;
     setupPidAlive?: (pid: number) => boolean;
-    ensureProviderDaemon?: (provider: "discord" | "slack", settings: Settings) => Promise<EnsureChatDaemonResult | "failed">;
+    /** Injectable process-start provenance reader for ambient Telegram setup preflight. */
+    setupPidIncarnation?: (pid: number) => string | undefined;
+    ensureProviderDaemon?: (provider: "discord" | "slack", settings: Settings) => Promise<EnsureChatDaemonResult>;
+    ensureTelegramDaemon?: (settings: Settings) => Promise<EnsureTelegramDaemonDetailedResult>;
 }
 export declare function parseNotifyArgs(args: string[]): NotifyCommandArgs | undefined;
 export declare function runNotifyCommand(cmd: NotifyCommandArgs, deps?: NotifyCommandDeps): Promise<void>;

package/dist/types/config/settings-schema.d.ts

@@ -154,6 +154,10 @@ export declare const SETTINGS_SCHEMA: {
         readonly type: "boolean";
         readonly default: true;
     };
+    readonly "notifications.telegram.streaming.enabled": {
+        readonly type: "boolean";
+        readonly default: true;
+    };
     readonly "notifications.telegram.rich.enabled": {
         readonly type: "boolean";
         readonly default: true;
@@ -174,6 +178,16 @@ export declare const SETTINGS_SCHEMA: {
             readonly editing: "notification-atomic";
         };
     };
+    readonly "notifications.telegram.toolActivity.enabled": {
+        readonly type: "boolean";
+        readonly default: true;
+        readonly ui: {
+            readonly tab: "notifications";
+            readonly label: "Telegram Tool Activity";
+            readonly description: "Send Telegram updates for tool starts and completions.";
+            readonly editing: "notification-atomic";
+        };
+    };
     readonly "notifications.telegram.topics.nameTemplate": {
         readonly type: "string";
         readonly default: undefined;
@@ -1866,7 +1880,16 @@ export declare const SETTINGS_SCHEMA: {
         readonly ui: {
             readonly tab: "context";
             readonly label: "Save Handoff Docs";
-            readonly description: "Save generated handoff documents to markdown files for the auto-handoff flow";
+            readonly description: "Save auto-triggered handoff documents as session artifacts (resolvable artifact:// URIs); manual /handoff does not save";
+        };
+    };
+    readonly "compaction.handoffPromptExtension": {
+        readonly type: "string";
+        readonly default: "";
+        readonly ui: {
+            readonly tab: "context";
+            readonly label: "Handoff Prompt Extension";
+            readonly description: "Extra guidance appended to the default handoff-generation prompt for both manual /handoff and auto-handoff. It supplements, and never replaces, the built-in safety- and continuity-critical instructions.";
         };
     };
     readonly "compaction.remoteEnabled": {
@@ -4032,6 +4055,7 @@ export interface CompactionSettings {
     reserveTokens: number;
     keepRecentTokens: number;
     handoffSaveToDisk: boolean;
+    handoffPromptExtension: string;
     autoContinue: boolean;
     remoteEnabled: boolean;
     remoteEndpoint: string | undefined;
@@ -4154,6 +4178,12 @@ export interface NotificationsSettings {
         richDraft: {
             enabled: boolean;
         };
+        toolActivity: {
+            enabled: boolean;
+        };
+        streaming: {
+            enabled: boolean;
+        };
         topics: {
             nameTemplate: string | undefined;
         };