@gajae-code/coding-agent 0.11.6 → 0.11.7

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## [Unreleased]
 
+## [0.11.7] - 2026-07-22
+### Added
+
+- `/btw` now opens an ephemeral multi-turn side chat: plain text continues the side thread until Esc returns to the main chat, while visible text-only context stays outside the main transcript and session observability/debug hooks and is scrubbed synchronously on close or abort.
+- Added `statusLine.showActionHints` (default: `true`) to hide contextual action hints while retaining configured status-line segments.
+- `skill_discovery` empty results now carry a `notice` when discovery config caused the emptiness — naming the exact disabled setting (`skills.enabled`, `skills.enablePiProject`, or `skills.enablePiUser`) and the `gjc config set` command to enable it. Previously a disabled config was indistinguishable from "no skills exist", silently hiding freshly written user/project skills.
+
+### Fixed
+
+- Ordinary `ask` calls now normalize a provider-emitted `deepInterview: null` placeholder instead of misclassifying it as malformed Round-0 intent recovery data and rejecting it before coercion.
+- Documented that custom OpenAI-compatible models omit vision by default: when `input` is unset, GJC treats the model as text-only and strips images with `[image omitted: model does not support vision]`. Vision backends must set `input: [text, image]` in `models.yml`.
+- Restored `/models` preset landing navigation after the Image Generation row and made compaction/pruning regression fixtures use an explicit 200K context boundary instead of a mutable provider descriptor default.
+- Fixed Windows legacy session artifact migration by using native directory identity size, a traversable detached-path alias, and writable file handles for final durability sync.
+- `gjc setup credentials` now auto-imports only OAuth credentials with a finite expiry strictly in the future. Expired or malformed-expiry discoveries remain visible as non-importable records, and existing imported credentials remain recoverable through `/login`.
+- Resumed managed sessions now complete the verified legacy `local://` artifact migration before synchronous path resolution, preserving legacy scratch files instead of failing startup with a migration-order error.
+- Corrected Telegram's uncertain lifecycle guidance so create, close, and resume commands describe their own possible outcome; close and resume no longer display the create-only duplicate-start warning.
+
+## [0.11.5] - 2026-07-20
+### Fixed
+
+- Internal transcript PageUp/PageDown now keeps moving through tool-output and other non-semantic rows instead of intermittently becoming a no-op after scrolling through anchored conversation content.
+
 ## [0.11.5] - 2026-07-20
 ### Changed
 - Telegram live-message streaming now defaults on for configured Telegram notifications through one durable global preference, supports live in-session preference refresh without weakening redaction, and keeps Discord and Slack finalized-only; process environment overrides remain available.
@@ -10,14 +32,25 @@
 - Session files now use v5 authority records. Do not roll back to a v4 writer after v5 session data has been created: v4 writers cannot preserve independent MCP and discovered-built-in selections.
 
 ### Fixed
+- SQLite `read` raw queries now accept exactly one explicit `SELECT` statement, reject comments and statement tails before opening the database, recheck the invariant at execution, and enable SQLite query-only mode as defense in depth.
+- Direct HTTP(S) marketplace catalogs now use connection-bound public-address validation, bounded redirects, and a 2 MiB response limit before parsing or caching.
+- Bounded MCP list pagination by cursor-cycle, page-count, and item-count limits while preserving abort and cache behavior.
+- Shell environment snapshots now use one process-private temporary root with exclusive private files, trusted cache validation, and whole-root shutdown cleanup instead of a predictable shared directory.
+- Python kernel startup now materializes its bundled runner in one process-private temporary directory with exclusive file creation instead of consulting a predictable shared cache path.
+- SSH command construction and discovery now reject malformed destinations with unsafe prefixes or control characters while preserving normal host, address, username, and alias forms.
 - Fixed the `subagent` tool's `resume` action silently swallowing manager failures. Resume outcomes other than `context_unavailable`/`not_found` (`no_runner`, `resume_failed`, `owner_shutdown_in_progress`, …) were dropped and the stale terminal subagent snapshot was returned as if the resume had succeeded, so ralplan's re-review loop believed the persisted Planner had resumed when it had not and never fell back correctly. The resume action now surfaces every non-ok reason (matching the `steer` branch), and the task resume runner marks a resumed subprocess that aborted or exited non-zero as a `failed` job (carrying its rendered failure summary) instead of reporting it `completed`.
+- Daemon timeout flags now reject missing, malformed, non-positive, fractional, whitespace-containing, and unsafe integer values before daemon command side effects instead of partially parsing them.
 - Hardened standalone HTML session exports so session identifiers, provider/model labels, and embedded raster images remain confined to their intended HTML contexts; malformed image payloads are omitted.
+- Restored legacy `gjc coordinator-mcp` and root `gjc --team --team-size <n>` routing to their native MCP and team commands, with strict team-size validation that prevents malformed legacy flags from selecting team lifecycle actions.
+- Fixed the `subagent` tool's `resume` action silently swallowing manager failures. Resume outcomes other than `context_unavailable`/`not_found` (`no_runner`, `resume_failed`, `owner_shutdown_in_progress`, …) were dropped and the stale terminal subagent snapshot was returned as if the resume had succeeded, so ralplan's re-review loop believed the persisted Planner had resumed when it had not and never fell back correctly. The resume action now surfaces every non-ok reason (matching the `steer` branch), and the task resume runner marks a resumed subprocess that aborted or exited non-zero as a `failed` job (preserving its error text) instead of reporting it `completed`.
+- OpenRouter image generation now retrieves provider-returned HTTP(S) images only through connection-bound public-address validation, revalidates bounded redirects, and enforces image content-type and byte limits before buffering.
 - Fixed the `subagent` tool's `resume` failing immediately for a persisted ralplan Planner. A subagent that finishes by calling `yield` (or is torn down right after a tool executes) left the saved session ending on an assistant `toolCall` with no matching `toolResult`; replaying that history on resume produced an invalid provider request (a `tool_use` not followed by a `tool_result`) that failed the resumed turn at once. Resumed transcripts now reconcile any trailing unpaired tool call with a synthesized placeholder result before the first resumed prompt. Additionally, a failed/no-op resume leg no longer overwrites the prior run's success output artifact with an empty file.
 - Fixed persisted subagent resumes being rejected before session reconstruction with `Session is inside managed storage but is not an authorized managed candidate`. Child session files intentionally live inside their parent session's artifact directory and are not top-level resume-picker candidates; the task resume path now explicitly opens the exact internally registered child session directory while retaining strict candidate validation for user-selected managed sessions.
 - Managed session resume scans now read only a bounded no-follow header prefix from foreign workspace transcripts, while fully recapturing and revalidating owned candidates before granting migration, receipt, or deletion authority.
 - Secret obfuscation now uses authenticated process-local placeholders that remain stable within a running process and opaque after restart.
 - Workspace-wide LSP diagnostics now fail closed instead of launching build or typecheck subprocesses outside execution-tool authorization; concrete-file and glob diagnostics remain available.
 - Clean, side-effect-free canonical provider stream first-event and next-event watchdog failures now retry on bare single-model legacy sessions; explicit legacy disable, managed fallback, and fail-closed structured, non-watchdog, or unsafe attempts are unchanged.
+- Remote MCP HTTP and SSE responses now enforce finite content and message budgets before parsing or dispatch.
 - Added fail-closed managed tmux owner SIGABRT recovery: exact-child supervisor receipts and pre-CLI admission now bind replacement ownership, strict durable Ultragoal/transcript evidence reconciles terminal child yields over stale nonterminal runtime state, recovery hydration remains write-free until an ownership fence, and hostile identity, corruption, concurrency, and path boundaries preserve dirty product files (#2681).
 - Restored non-root startup on Synology and other Linux container filesystems that definitively report POSIX ACL storage unsupported for managed session paths; explicit `--session-dir` semantics and all owner, mode, type, symlink, identity, and scope-binding checks remain unchanged and fail closed (#2687).
 - Preserved access to legal SQLite table names beginning with `sqlite` but not reserved `sqlite_`.
@@ -59,6 +92,10 @@
 - SDK host shutdown now retries a failed broker unregister instead of short-circuiting with a stale broker-index entry, while retained startup-cleanup owner-release failures remain isolated from the red extension-error path (#2625).
 - Non-TTY launches now fail fast when stdin is empty and automatically use print mode for positional prompts and `@file` inputs, preventing orphaned interactive TUI processes (#2507).
 
+### Fixed
+
+- The command palette now labels `app.session.fork` as “Branch from message,” matching its user-message selector and `AgentSession.branch()` behavior while preserving the existing action ID for keybinding compatibility.
+
 ## [0.11.2] - 2026-07-19
 
 ### Changed

package/dist/types/capability/index.d.ts

@@ -17,26 +17,16 @@ export declare function loadCapability<T>(capabilityId: string, options?: LoadOp
  * Call this once on startup to enable persistent provider state.
  */
 export declare function initializeWithSettings(activeSettings: Settings): void;
-/**
- * Disable a provider globally (across all capabilities).
- */
-export declare function disableProvider(providerId: string): void;
-/**
- * Enable a previously disabled provider.
- */
-export declare function enableProvider(providerId: string): void;
-/**
- * Check if a provider is enabled.
- */
-export declare function isProviderEnabled(providerId: string): boolean;
-/**
- * Get list of all disabled provider IDs.
- */
-export declare function getDisabledProviders(): string[];
-/**
- * Set disabled providers from a list (replaces current set).
- */
-export declare function setDisabledProviders(providerIds: string[]): void;
+/** Disable a provider for the supplied session settings. */
+export declare function disableProvider(providerId: string, activeSettings?: Settings): void;
+/** Enable a provider for the supplied session settings. */
+export declare function enableProvider(providerId: string, activeSettings?: Settings): void;
+/** Check whether a provider is enabled by the supplied session settings. */
+export declare function isProviderEnabled(providerId: string, activeSettings?: Settings | undefined): boolean;
+/** Get disabled providers from the supplied session settings. */
+export declare function getDisabledProviders(activeSettings?: Settings | undefined): string[];
+/** Replace disabled providers for the supplied session settings. */
+export declare function setDisabledProviders(providerIds: string[], activeSettings?: Settings): void;
 /**
  * Get a capability definition (for introspection).
  */

package/dist/types/capability/types.d.ts

@@ -5,6 +5,7 @@
  * paths like `.gjc`, `.gemini`, or `.vscode`, they simply ask for `load("mcps")`
  * and get back a unified array of MCP servers.
  */
+import type { Settings } from "../config/settings";
 /**
  * Context passed to every provider loader.
  */
@@ -64,6 +65,8 @@ export interface LoadOptions {
     includeDisabled?: boolean;
     /** Explicit disabled extension IDs to apply instead of settings. */
     disabledExtensions?: string[];
+    /** Session settings whose provider policy applies to this load. */
+    settings?: Settings;
 }
 /**
  * Source metadata attached to every loaded item.

package/dist/types/commands/daemon.d.ts

@@ -31,10 +31,10 @@ export default class Daemon extends Command {
         force: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };
-        "graceful-timeout-ms": import("@gajae-code/utils/cli").FlagDescriptor<"integer"> & {
+        "graceful-timeout-ms": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
-        "kill-timeout-ms": import("@gajae-code/utils/cli").FlagDescriptor<"integer"> & {
+        "kill-timeout-ms": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
         "spawn-if-stopped": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {

package/dist/types/commands/sdk.d.ts

@@ -15,17 +15,35 @@ export declare function runSessionHost(timing?: {
     cwd?: string;
     processIncarnation?: (pid: number) => string | undefined;
 }): Promise<void>;
+export type SdkInternalArgv = {
+    action: "broker-internal";
+    agentDir: string;
+} | {
+    action: "session-host-internal";
+};
+/** Parses the exact private argv contracts used by SDK child-process spawns. */
+export declare function parseSdkInternalArgv(argv: readonly string[]): SdkInternalArgv;
 export default class Sdk extends Command {
     static description: string;
     static hidden: boolean;
+    static delegateHelp: boolean;
     static args: {
         action: import("@gajae-code/utils/cli").ArgDescriptor & {
-            required: true;
+            required: false;
             options: string[];
         };
     };
     static flags: {
-        "agent-dir": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+        stdio: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        socket: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        session: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "pending-ceiling": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
     };

package/dist/types/config/keybindings.d.ts

@@ -279,7 +279,7 @@ export declare const KEYBINDINGS: {
     };
     readonly "app.session.fork": {
         readonly defaultKeys: [];
-        readonly description: "Fork session";
+        readonly description: "Branch from message";
     };
     readonly "app.session.resume": {
         readonly defaultKeys: [];

package/dist/types/config/settings-schema.d.ts

@@ -937,6 +937,15 @@ export declare const SETTINGS_SCHEMA: {
         readonly type: "boolean";
         readonly default: true;
     };
+    readonly "statusLine.showActionHints": {
+        readonly type: "boolean";
+        readonly default: true;
+        readonly ui: {
+            readonly tab: "appearance";
+            readonly label: "Status Line Action Hints";
+            readonly description: "Show contextual keyboard shortcuts in the status line";
+        };
+    };
     readonly "statusLine.leftSegments": {
         readonly type: "array";
         readonly default: StatusLineSegmentId[];
@@ -2915,8 +2924,8 @@ export declare const SETTINGS_SCHEMA: {
         readonly default: false;
         readonly ui: {
             readonly tab: "tools";
-            readonly label: "Insane Search Fallback";
-            readonly description: "Opt in to the vendored insane-search escalation for blocked public URL reads (403/WAF/JS-gated). Off by default. Requires preinstalled python3 + curl_cffi (and node + playwright/stealth for the browser phase); changes network posture by enabling TLS/browser impersonation for public pages.";
+            readonly label: "Insane Search Fallback (Compatibility)";
+            readonly description: "Compatibility-only preference. Remote renderer fallback stays disabled because it cannot preserve validated per-hop network routing.";
         };
     };
     readonly "github.enabled": {
@@ -3777,12 +3786,12 @@ export declare const SETTINGS_SCHEMA: {
     };
     readonly "providers.image": {
         readonly type: "enum";
-        readonly values: readonly ["auto", "openai", "gemini", "openrouter", "antigravity"];
+        readonly values: readonly ["auto", "openai", "gemini", "openrouter", "antigravity", "custom"];
         readonly default: "auto";
         readonly ui: {
             readonly tab: "providers";
-            readonly label: "Image Provider";
-            readonly description: "Provider for image generation tool";
+            readonly label: "Image Generation";
+            readonly description: "Provider and model for image generation tool";
             readonly options: readonly [{
                 readonly value: "auto";
                 readonly label: "Auto";
@@ -3790,7 +3799,7 @@ export declare const SETTINGS_SCHEMA: {
             }, {
                 readonly value: "openai";
                 readonly label: "OpenAI";
-                readonly description: "Uses the active GPT Responses/Codex model";
+                readonly description: "Uses gpt-image-2 via OpenAI Responses/Codex";
             }, {
                 readonly value: "gemini";
                 readonly label: "Gemini";
@@ -3803,9 +3812,49 @@ export declare const SETTINGS_SCHEMA: {
                 readonly value: "antigravity";
                 readonly label: "Antigravity";
                 readonly description: "Requires login with google-antigravity";
+            }, {
+                readonly value: "custom";
+                readonly label: "Custom";
+                readonly description: "OpenAI-compatible endpoint (set providers.imageCustomUrl)";
             }];
         };
     };
+    readonly "providers.imageModel": {
+        readonly type: "string";
+        readonly default: undefined;
+        readonly ui: {
+            readonly tab: "providers";
+            readonly label: "Image Model";
+            readonly description: "Override the default image generation model for the selected provider";
+        };
+    };
+    readonly "providers.imageCustomUrl": {
+        readonly type: "string";
+        readonly default: undefined;
+        readonly ui: {
+            readonly tab: "providers";
+            readonly label: "Image Custom URL";
+            readonly description: "Base URL for custom OpenAI-compatible image endpoint";
+        };
+    };
+    readonly "providers.imageCustomKey": {
+        readonly type: "string";
+        readonly default: undefined;
+        readonly ui: {
+            readonly tab: "providers";
+            readonly label: "Image Custom API Key";
+            readonly description: "API key for custom OpenAI-compatible image endpoint";
+        };
+    };
+    readonly "providers.imageCustomKeyEnv": {
+        readonly type: "string";
+        readonly default: undefined;
+        readonly ui: {
+            readonly tab: "providers";
+            readonly label: "Image Custom API Key Env";
+            readonly description: "Environment variable name holding the API key for custom image endpoint";
+        };
+    };
     readonly "providers.kimiApiFormat": {
         readonly type: "enum";
         readonly values: readonly ["openai", "anthropic"];
@@ -4131,6 +4180,7 @@ export interface StatusLineSettings {
     maxRows: number;
     showHookStatus: boolean;
     showSkillHud: boolean;
+    showActionHints: boolean;
     leftSegments: StatusLineSegmentId[];
     rightSegments: StatusLineSegmentId[];
     segmentOptions: Record<string, unknown>;

package/dist/types/eval/py/runner-artifact.d.ts

@@ -0,0 +1,8 @@
+export interface RunnerScriptCache {
+    ensureRunnerScript(): Promise<string>;
+    cleanup(): Promise<void>;
+}
+export declare function createRunnerScriptCache(tempRoot: string): RunnerScriptCache;
+/** @internal Test-only initializer for isolated artifact assertions. */
+export declare function createRunnerScriptInitializer(tempRoot: string): () => Promise<string>;
+export declare const ensureRunnerScript: () => Promise<string>;

package/dist/types/gjc-runtime/ultragoal-guard.d.ts

@@ -1,5 +1,5 @@
 import { type UltragoalGoal, type UltragoalLedgerEvent, type UltragoalNudgeSurface, type UltragoalPlan, type UltragoalReceiptKind } from "./ultragoal-runtime";
-export type UltragoalGuardState = "inactive" | "unrelated_goal" | "active_verified_complete" | "active_missing_receipt" | "active_stale_receipt" | "active_missing_final_receipt" | "active_dirty_quality_gate" | "active_review_blocked_unrecorded" | "active_review_blocked_recorded" | "unreadable_fail_closed";
+export type UltragoalGuardState = "inactive" | "unrelated_goal" | "active_verified_complete" | "active_missing_receipt" | "active_stale_receipt" | "active_missing_final_receipt" | "active_dirty_quality_gate" | "active_review_blocked_unrecorded" | "active_review_blocked_recorded" | "active_missing_critic_verdict" | "unreadable_fail_closed";
 export interface UltragoalGuardDiagnostic {
     state: UltragoalGuardState;
     message: string;
@@ -78,10 +78,10 @@ export interface UltragoalPauseBlockDiagnostic {
 }
 /**
  * While an Ultragoal run is active, `goal({"op":"pause"})` is only allowed when the
- * current durable Ultragoal state is readable and the latest durable ledger event
- * classifies the current blocker as `human_blocked`. Resolvable blockers must be
- * worked, not parked. Reads fail closed so unreadable durable state or ledger data
- * blocks pause rather than silently allowing a give-up.
+ * current durable Ultragoal state is readable, the latest `blocker_classified`
+ * event is `human_blocked`, and a later fresh clean pause terminal critic verdict is bound to
+ * that exact classification. Reads fail closed so unreadable durable state or
+ * ledger data blocks pause rather than silently allowing a give-up.
  */
 export declare function isUltragoalPauseBlocked(cwd: string): Promise<UltragoalPauseBlockDiagnostic>;
 export declare function assertUltragoalPauseAllowed(cwd: string): Promise<void>;

package/dist/types/gjc-runtime/ultragoal-receipt-freshness.d.ts

@@ -1,10 +1,30 @@
 import type { UltragoalCompletionVerification, UltragoalGoal, UltragoalGoalStatus, UltragoalLedgerEvent, UltragoalPlan, UltragoalReceiptKind } from "./ultragoal-runtime";
+export declare const CRITIC_VERDICT_EVENT = "critic_verdict";
+export declare const CRITIC_GATE_HARD_STOP_EVENT = "critic_gate_hard_stop";
+export declare const CRITIC_GATE_OVERRIDE_EVENT = "critic_gate_override";
+export declare const TERMINAL_CRITIC_CEILING = 5;
+export type CriticVerdict = "OKAY" | "ITERATE" | "REJECT";
 export type UltragoalReceiptFreshnessDiagnostic = {
     state: "inactive" | "unrelated_goal" | "active_verified_complete" | "active_missing_receipt" | "active_stale_receipt" | "active_missing_final_receipt" | "active_dirty_quality_gate" | "active_review_blocked_unrecorded" | "active_review_blocked_recorded" | "unreadable_fail_closed";
     message: string;
     goalId?: string;
 };
 export declare function requiredUltragoalGoals(plan: UltragoalPlan): UltragoalGoal[];
+/** Hash the current required-goal set for terminal critic verdict freshness. */
+export declare function computeCriticVerdictPlanGeneration(plan: UltragoalPlan): string;
+export declare function isCleanPauseCriticVerdictShape(candidate: UltragoalLedgerEvent, planGeneration: string, classificationEventId: string): boolean;
+export declare function isCleanPauseCriticVerdict(event: UltragoalLedgerEvent, opts: {
+    planGeneration: string;
+    classificationEventId: string;
+}): boolean;
+export declare function findCleanPauseCriticVerdict(plan: UltragoalPlan, ledger: readonly UltragoalLedgerEvent[], classificationEventId: string): UltragoalLedgerEvent | null;
+/** Pure: count all ledger `critic_verdict` rows for an exact plan generation. */
+export declare function countTerminalCriticVerdicts(ledger: readonly UltragoalLedgerEvent[], planGeneration: string): number;
+/** Pure: count every non-OKAY terminal critic verdict recorded for this run. */
+export declare function countNonOkayTerminalCriticVerdicts(ledger: readonly UltragoalLedgerEvent[], _legacyPlanGeneration?: string): number;
+export declare function terminalCriticHardStopReached(ledger: readonly UltragoalLedgerEvent[], _legacyPlanGeneration?: string): boolean;
+export declare function terminalCriticGateOverridden(ledger: readonly UltragoalLedgerEvent[]): boolean;
+export declare function terminalCriticCeilingReached(ledger: readonly UltragoalLedgerEvent[], _legacyPlanGeneration?: string): boolean;
 export declare function receiptRelevantGoals(plan: UltragoalPlan, goal: UltragoalGoal, receiptKind: UltragoalReceiptKind): UltragoalGoal[];
 export declare function computeUltragoalPlanGeneration(input: {
     plan: UltragoalPlan;

package/dist/types/gjc-runtime/ultragoal-runtime.d.ts

@@ -1,5 +1,6 @@
 import type { WorkflowHudSummary } from "../skill-state/active-state";
-export { computeUltragoalPlanGeneration, receiptRelevantGoals } from "./ultragoal-receipt-freshness";
+import { type CriticVerdict } from "./ultragoal-receipt-freshness";
+export { CRITIC_GATE_HARD_STOP_EVENT, CRITIC_GATE_OVERRIDE_EVENT, CRITIC_VERDICT_EVENT, type CriticVerdict, computeUltragoalPlanGeneration, countTerminalCriticVerdicts, receiptRelevantGoals, TERMINAL_CRITIC_CEILING, terminalCriticCeilingReached, terminalCriticGateOverridden, } from "./ultragoal-receipt-freshness";
 export { captureUltragoalRecoverySnapshot, parseStrictTerminalTranscript, persistUltragoalRecoveryDecision, planUltragoalOwnerLossRecovery, type UltragoalOwnerLossReceipt, type UltragoalRecoveryBinding, type UltragoalRecoveryDecision, type UltragoalRecoverySnapshot, validateOwnerLossBinding, validateRawUltragoalEvidence, validateRecoveryAdmission, validateRecoveryPath, } from "./ultragoal-owner-loss-recovery";
 export type UltragoalGjcGoalMode = "aggregate" | "per-story";
 export type UltragoalGoalStatus = "pending" | "active" | "complete" | "failed" | "blocked" | "review_blocked" | "superseded";
@@ -401,10 +402,10 @@ export declare function recordUltragoalReviewBlockers(input: {
 }): Promise<UltragoalPlan>;
 export type UltragoalBlockerClassification = "human_blocked" | "resolvable";
 /**
- * Record an audited blocker triage classification in the durable ledger. A
- * `human_blocked` classification is the only thing that authorizes
- * `goal({"op":"pause"})` while an Ultragoal run is active; `resolvable` is an
- * audit note and never unblocks pause.
+ * Record an audited blocker triage classification in the durable ledger. Pause
+ * requires the latest `blocker_classified` event to be `human_blocked` and a
+ * later clean pause terminal critic verdict bound to that classification; `resolvable`
+ * is an audit note and never unblocks pause.
  */
 export declare function recordUltragoalBlockerClassification(input: {
     cwd: string;
@@ -412,6 +413,19 @@ export declare function recordUltragoalBlockerClassification(input: {
     evidence: string;
     goalId?: string;
 }): Promise<UltragoalLedgerEvent>;
+export declare function recordUltragoalCriticVerdict(input: {
+    cwd: string;
+    terminus: "completion" | "pause";
+    verdict: CriticVerdict;
+    evidence: string;
+    blockers?: string[];
+    goalId?: string;
+    classificationEventId?: string;
+}): Promise<UltragoalLedgerEvent>;
+export declare function recordUltragoalCriticGateOverride(input: {
+    cwd: string;
+    evidence: string;
+}): Promise<UltragoalLedgerEvent>;
 type UltragoalReviewContractStrength = "strong" | "thin-derived";
 interface UltragoalReviewFinding extends JsonObject {
     severity: "blocker";

package/dist/types/main.d.ts

@@ -85,11 +85,15 @@ interface InteractiveModeFactoryOptions {
 }
 type CreateInteractiveMode = (options: InteractiveModeFactoryOptions) => InteractiveMode;
 type ResumePickerTerminalCheck = () => boolean;
-type ListForResumePickerReadOnly = (cwd: string, sessionDir?: string) => Promise<SessionInfo[]>;
+type ListForResumePickerReadOnly = (cwd: string, sessionDir?: string, storage?: undefined) => Promise<SessionInfo[]>;
+type ListManagedForResumePickerReadOnly = (cwd: string, managedAgentDir?: string, storage?: undefined) => Promise<SessionInfo[]>;
+type ResolveManagedAgentDirForScope = (cwd: string) => string;
 type SelectResumeSession = (sessions: SessionInfo[]) => Promise<SessionSelectionResult>;
 type OpenExistingSessionStrict = (identity: ResumeSessionIdentity, destination: SessionDestination, storage?: undefined, migrationPolicy?: SessionDirectoryMigrationPolicy) => Promise<StrictSessionOpenResult>;
 export declare const BARE_RESUME_CONFLICT_ERROR = "--resume without a session cannot be combined with --continue, --fork, or --no-session.";
 export declare const BARE_RESUME_INTERACTIVE_ERROR = "--resume requires an interactive terminal; use --resume <id>.";
+/** Resolves only the managed agent root needed for pre-consent picker inventory. */
+export declare function resolveManagedAgentDirForScope(_cwd: string): string;
 export declare const BARE_RESUME_OPEN_ERROR = "Could not open the selected session. Use --resume <id>.";
 export declare function runInteractiveMode(session: AgentSession, version: string, changelogMarkdown: string | undefined, notifs: (InteractiveModeNotify | null)[], startupUpdate: StartupUpdateOrchestrator, initialMessages: string[], setExtensionUIContext: (uiContext: ExtensionUIContext, hasUI: boolean) => void, lspServers: LspStartupServerInfo[] | undefined, mcpManager: MCPManager | undefined, eventBus?: EventBus, initialMessage?: string, initialImages?: ImageContent[], createInteractiveMode?: CreateInteractiveMode, resumeAction?: "continue-tail" | "open-idle"): Promise<void>;
 declare function getChangelogForDisplay(parsed: Args): Promise<string | undefined>;
@@ -125,11 +129,30 @@ export interface RunRootCommandDependencies {
     runPrintMode?: RunPrintMode;
     isResumePickerTerminal?: ResumePickerTerminalCheck;
     listForResumePickerReadOnly?: ListForResumePickerReadOnly;
+    listManagedForResumePickerReadOnly?: ListManagedForResumePickerReadOnly;
+    resolveManagedAgentDirForScope?: ResolveManagedAgentDirForScope;
     selectResumeSession?: SelectResumeSession;
     openExistingSessionStrict?: OpenExistingSessionStrict;
     initializeSettings?: typeof Settings.init;
     loadSettingsForScope?: typeof Settings.loadForScope;
 }
+export interface ModelRoleOverrides {
+    smol?: string;
+    slow?: string;
+    plan?: string;
+}
+/**
+ * Resolve the ephemeral `smol`/`slow`/`plan` model-role overrides.
+ *
+ * Precedence per role is CLI flag > documented `GJC_*_MODEL` > legacy
+ * `PI_*_MODEL`, matching the repo-wide GJC-first/PI-fallback convention.
+ * Resolution reads the process environment via `$pickenv`, which trims values
+ * and treats empty/whitespace as unset; it is deliberately kept separate from
+ * credential env resolution (`$credentialEnv`/`$pickCredentialEnv`). The
+ * function is pure and stateless, so it reads fresh each call and a later
+ * invocation never inherits an earlier one's values.
+ */
+export declare function resolveModelRoleOverrides(parsed: Pick<Args, "smol" | "slow" | "plan">): ModelRoleOverrides;
 export declare function runRootCommand(parsed: Args, rawArgs: string[], deps?: RunRootCommandDependencies): Promise<void>;
 export declare function main(args: string[]): Promise<void>;
 export {};

package/dist/types/modes/components/btw-panel.d.ts

@@ -6,6 +6,7 @@ interface BtwPanelComponentOptions {
 export declare class BtwPanelComponent extends Container {
     #private;
     constructor(options: BtwPanelComponentOptions);
+    beginTurn(question: string): void;
     appendText(delta: string): void;
     setAnswer(text: string): void;
     markComplete(): void;

package/dist/types/modes/components/model-selector.d.ts

@@ -26,6 +26,8 @@ export type ModelSelectorSelection = {
 } | {
     kind: "deleteProfile";
     profileName: string;
+} | {
+    kind: "imageGeneration";
 };
 type RoleSelectCallback = (selection: ModelSelectorSelection) => void | Promise<void>;
 /**

package/dist/types/modes/components/tool-status-header.d.ts

@@ -38,6 +38,7 @@ export interface StatusLineSettings {
     previewHighlightSegment?: StatusLineSegmentId;
     showHookStatus?: boolean;
     showSkillHud?: boolean;
+    showActionHints?: boolean;
     sessionAccent?: boolean;
     maxRows?: number;
 }

package/dist/types/modes/controllers/btw-controller.d.ts

@@ -1,10 +1,15 @@
 import type { InteractiveModeContext } from "../types";
+type BtwFollowUpResult = "accepted" | "busy" | "closed" | "rejected";
 export declare class BtwController {
     #private;
     private readonly ctx;
     constructor(ctx: InteractiveModeContext);
     hasActiveRequest(): boolean;
+    hasOpenPanel(): boolean;
+    isTurnInFlight(): boolean;
     handleEscape(): boolean;
     dispose(): void;
     start(question: string): Promise<void>;
+    submitFollowUp(question: string): Promise<BtwFollowUpResult>;
 }
+export {};

package/dist/types/modes/interactive-mode.d.ts

@@ -50,6 +50,7 @@ export interface InteractiveModeOptions {
     /** Additional initial messages to queue */
     initialMessages?: string[];
 }
+export declare function selectShutdownDraft(editorText: string, hasActiveBtw: boolean): string;
 export declare class InteractiveMode implements InteractiveModeContext {
     #private;
     session: AgentSession;
@@ -261,6 +262,7 @@ export declare class InteractiveMode implements InteractiveModeContext {
     handleImagePaste(): Promise<boolean>;
     handleBtwCommand(question: string): Promise<void>;
     hasActiveBtw(): boolean;
+    handleBtwFollowUp(question: string): Promise<"accepted" | "busy" | "closed" | "rejected">;
     handleBtwEscape(): boolean;
     cycleThinkingLevel(): void;
     cycleRoleModel(options?: {

package/dist/types/modes/types.d.ts

@@ -295,6 +295,7 @@ export interface InteractiveModeContext {
     handleBackgroundCommand(): void;
     handleImagePaste(): Promise<boolean>;
     handleBtwCommand(question: string): Promise<void>;
+    handleBtwFollowUp(question: string): Promise<"accepted" | "busy" | "closed" | "rejected">;
     hasActiveBtw(): boolean;
     handleBtwEscape(): boolean;
     cycleThinkingLevel(): void;

package/dist/types/runtime-mcp/content-limits.d.ts

@@ -0,0 +1,7 @@
+export declare const MCP_MAX_CONTENT_BYTES: number;
+export declare const MCP_MAX_ERROR_BYTES: number;
+export declare const MCP_MAX_SSE_REQUEST_MESSAGES = 1024;
+export declare const MCP_MAX_SSE_BATCH_MESSAGES = 1024;
+export declare const MCP_HTTP_TIMEOUT_MS = 30000;
+export declare function cancelMCPStream(stream: ReadableStream<Uint8Array> | null): void;
+export declare function readMCPResponseText(response: Response, limit: number, truncate?: boolean, signal?: AbortSignal): Promise<string>;

package/dist/types/sdk/bus/chat-daemon-control.d.ts

@@ -8,7 +8,8 @@ export type ChatDaemonAction = "stop" | "reload";
  * Generation 6 carries the retained managed filesystem authority boundary.
  * Generation 7 restores macOS daemon signaling (kill(2) with a start-time
  * incarnation recheck) so a live/hung owner can be replaced without an external
- * `kill -9`.
+ * `kill -9`. Generation 8 adopts Windows expected-identity ACL verification and
+ * repair for shared native authority.
  */
 export declare const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>>;
 export declare function chatDaemonGeneration(kind: ChatDaemonKind): number;

package/dist/types/sdk/bus/index.d.ts

@@ -494,7 +494,7 @@ export declare function createNotificationsExtension(api: ExtensionAPI, options?
     /** Whether this host mode can own the root SDK endpoint. Default: true. */
     sdkHostModeSupported?: boolean;
     onSdkRequest?: (kind: "control" | "query", connectionId: string, frame: Record<string, unknown>) => void;
-    runEphemeralTurn?: (promptText: string, signal: AbortSignal) => Promise<{
+    runBtwTurn?: (question: string, signal: AbortSignal) => Promise<{
         replyText: string;
     }>;
     /** Observes settlement of optional session-branch startup after reconciliation completes. */

package/dist/types/sdk/bus/lifecycle-commands.d.ts

@@ -62,8 +62,9 @@ export declare function normalizeLifecyclePath(value: string): string | undefine
 /**
  * Map a lifecycle response/error to a user-facing Telegram message (G010).
  *
- * Only derives text from sessionId, mode, reason, a safe message, and candidate
- * {sessionId,path} — never a token or prompt. Each error reason gets tailored,
- * actionable copy; an "in progress" pending response is surfaced distinctly.
+ * Only derives text from sessionId, mode, reason, a safe message, the originating
+ * lifecycle verb, and candidate {sessionId,path} — never a token or prompt. Each
+ * error reason gets tailored, actionable copy; an "in progress" pending response
+ * is surfaced distinctly.
  */
-export declare function formatLifecycleOutcome(r: SessionLifecycleResponse): string;
+export declare function formatLifecycleOutcome(r: SessionLifecycleResponse, verb?: LifecycleCommandVerb): string;

package/dist/types/sdk/bus/notification-service.d.ts

@@ -74,6 +74,40 @@ export interface NotificationStatusReport {
 export declare function buildNotificationStatusReport(settings: Settings): NotificationStatusReport;
 /** Render a status report as human-readable lines (no secrets). */
 export declare function formatNotificationStatusReport(report: NotificationStatusReport): string;
+export interface NotificationEndpointView {
+    sessionId: string;
+    pid: number | undefined;
+    stale: boolean;
+}
+export type NotificationEndpointLiveness = "live" | "dead" | "unknown";
+/**
+ * Classification used by recovery and startup takeover. A file is an endpoint
+ * only when it has endpoint authority fields; lifecycle/audit records are never
+ * candidates for endpoint cleanup.
+ */
+export type NotificationEndpointClassification = {
+    kind: "endpoint";
+    view: NotificationEndpointView;
+    liveness: NotificationEndpointLiveness;
+    identity: NotificationEndpointFileIdentity;
+} | {
+    kind: "non-endpoint";
+} | {
+    kind: "unreadable";
+};
+/**
+ * Classify an endpoint using owner-proof semantics. An endpoint is only `dead`
+ * with positive proof: an explicit `stale` tombstone, or a recorded pid that is
+ * confirmed not alive. A PID-less endpoint is `unknown` (not provably dead) and
+ * must never be treated as dead — removing it could delete a live session's
+ * discovery file that simply omitted a pid.
+ */
+export declare function notificationEndpointLiveness(view: NotificationEndpointView, pidAlive: (pid: number) => boolean): NotificationEndpointLiveness;
+/**
+ * Read and classify one endpoint candidate. The returned identity belongs to
+ * exactly the bytes inspected and is required for any later deletion.
+ */
+export declare function classifyNotificationEndpoint(fs: Pick<NotificationServiceFs, "readEndpointFile">, file: string, pidAlive: (pid: number) => boolean): Promise<NotificationEndpointClassification>;
 export type HealthLevel = "ok" | "warn" | "error";
 export interface HealthCheck {
     name: string;