@gajae-code/coding-agent 0.11.6 → 0.11.8

package/CHANGELOG.md

@@ -2,6 +2,73 @@
 
 ## [Unreleased]
 
+## [0.11.8] - 2026-07-23
+### Added
+
+- Keybinding configuration now keeps portable canonical text while runtime shortcut labels render platform-native, including concise MacBook glyphs in inline surfaces and glyph-plus-text accessibility labels in `/hotkeys` and `/help`; `/hotkeys` remains authoritative for effective remapped bindings.
+
+### Added
+
+- Plans and delegated tasks carry an authoritative repository binding (`gjc.repository_binding.v1`). Ultragoal/ralplan stamp identity at creation; task lanes stamp omitted bindings from session cwd **before** agent discovery; ralplan stage writes and handoff re-entry enforce the seed binding; declared paths must stay under the bound root; task receipts include the resolved identity; linked isolation worktrees must match the source repository (#2901).
+
+### Fixed
+
+- Runtime MCP OAuth credentials are now bound to their authorized server origin and token endpoint, reject redirecting refresh responses, and fail closed when legacy or changed configuration lacks an exact match.
+- `/share` now keeps full-session HTML in owner-private unpredictable staging until the share handler or `gh gist create` process has fully stopped; cancelling a blocked gist upload terminates and awaits that process before reporting cancellation and removing the export.
+- Telegram notification daemon self-heals degraded on-disk state: permanently missing scan roots are pruned (so one deleted worktree no longer disables orphan-topic cleanup), and retained exact-unlink transition/placeholder artifacts are reaped on ownership acquire and each scan. `gjc daemon reload` can recover without manual filesystem surgery (#2956).
+- On macOS, resuming a managed session no longer fails with `identity_mismatch` when the first write-append open changes only file `ctime` (e.g. APFS write-provenance / `com.apple.provenance`). `appendSync` allows a single bounded re-capture + retry when `dev`/`ino`/`size`/`mtime`/SHA-256 remain unchanged, and still rejects real content races and repeated ctime transitions (#2944).
+- Interactive `/resume` / `AgentSession.switchSession()` now awaits verified managed `local://` legacy-root migration for the newly selected session before post-commit lifecycle proceeds, matching cold-start `createAgentSession()` readiness from #2797 so synchronous `local://` resolution no longer fails with "legacy migration must complete before path resolution" after a mid-session switch (#2925).
+- Concurrent edits to the same file path are serialized through a path-scoped mutation lock (in-process always; durable cross-process lock on the real filesystem). Disjoint concurrent `applyPatch` / replace mutations no longer silently overwrite each other, and a commit-time content check rejects writers that observe a mid-flight change (#2900).
+- Concurrent edits to the same file path are serialized through a path-scoped mutation lock (in-process always; durable cross-process lock on the real filesystem). Disjoint concurrent `applyPatch` / replace mutations no longer silently overwrite each other, and a commit-time content check rejects writers that observe a mid-flight change. The production `executePatchSingle` / `LspFileSystem` path explicitly enables the durable lock rather than inferring it from FileSystem object identity (#2900).
+- Lean notification verbosity no longer floods remote clients with intermediate tool-turn `turn_stream` frames. Under `/lean`, the latest assistant answer is deferred until `agent_end` (idle); ask lead-ins still flush immediately before inline buttons, and `/verbose` keeps per-turn streaming (including opt-in live frames) (#2863).
+- Ultragoal `complete-goals` no longer reports contradictory next actions when every incomplete story is `blocked` or `review_blocked`. Text and JSON now agree on `next-action=resolve-blockers` with blocked goal IDs/status; failed-only schedules surface `retry-failed`; `execute-goal` always includes a `goal_id` (#2903).
+- Bound each Python tool bridge bearer capability to one active session registration, reject non-canonical or empty bearer credentials before lookup, and rotate authority whenever a retained session replaces its kernel.
+- Deep Interview now scopes provider-facing `ask` metadata to the persisted workflow stage, including after durable session resume: Round 0 advertises only the locked `intent_contract` branch, later rounds advertise ordinary and `intent_review` branches, foreign workflow gates cannot seed recorder state, and wire-valid empty positive-round reviews reach canonical Zod diagnostics while malformed authority remains fail-closed.
+- Bounded docs.rs rustdoc downloads, legacy cache reads, and gzip expansion before parsing or caching; transport-level content encoding is disabled and rejected so Bun cannot decompress outside the explicit output guard.
+
+### Added
+
+- Added SDK v3 prompt reconciliation through `turn.prompt_status` with caller-supplied `clientRef` correlation, bounded live-session lifecycle retention, reconnect-safe lookup, and explicit ordered non-replay semantics for `turn.prompt` (#2930).
+- Added `models.profiles.list` discovery of the effective built-in plus `models.yml` profile catalog, exact-ID pre-spawn validation that reloads host configuration for each lifecycle request, and structured `unknown_model_profile` / `model_profile_registry_error` details across lifecycle startup failures (#2931).
+
+## [0.11.7] - 2026-07-22
+### Added
+
+- `/btw` now opens an ephemeral multi-turn side chat: plain text continues the side thread until Esc returns to the main chat, while visible text-only context stays outside the main transcript and session observability/debug hooks and is scrubbed synchronously on close or abort.
+- Added `statusLine.showActionHints` (default: `true`) to hide contextual action hints while retaining configured status-line segments.
+- `skill_discovery` empty results now carry a `notice` when discovery config caused the emptiness — naming the exact disabled setting (`skills.enabled`, `skills.enablePiProject`, or `skills.enablePiUser`) and the `gjc config set` command to enable it. Previously a disabled config was indistinguishable from "no skills exist", silently hiding freshly written user/project skills.
+- `generate_image` now supports Alibaba Bailian (Token Plan) `wan2.7-image` as an image provider: set `providers.image` to `alibaba` (or let auto-detect find `ALIBABA_TOKEN_PLAN_API_KEY` / a registered `alibaba-token-plan` key), override the model with `providers.imageModel` (e.g. `wan2.7-image-pro`). Short-lived OSS result URLs are downloaded immediately, and image editing works via input images.
+
+### Fixed
+- Telegram `/session_recent` now retries one concurrently appended managed transcript and omits only candidates that remain unstable, preserving independently verified recent-session rows.
+- Repeated byte-identical stale SDK broker locks no longer cause startup to loop when a prior tombstone exists.
+- ACP session close now rotates idempotency keys for resumed attachment generations while retaining the same key across terminally uncertain close retries.
+- ConversationStore now tolerates only unsupported Windows parent-directory durability errors after preserving temporary-file fsync and atomic rename.
+- Ralplan no longer re-asks for execution approval when the user already explicitly named `ultragoal` or `team` in the current turn; that naming is the consent.
+
+- Cron guidance now routes silent recurring polling and event-driven PR/CI watchers to `monitor`, because every cron firing starts a normal assistant turn and prompt wording cannot reliably suppress its response.
+- Ordinary `ask` calls now normalize a provider-emitted `deepInterview: null` placeholder instead of misclassifying it as malformed Round-0 intent recovery data and rejecting it before coercion.
+- SDK event replay authorization now refreshes the negotiated capability cache synchronously from the native-sanitized replay snapshot before host filtering, preserving initial and repeated-hello capability updates without trusting client frame claims.
+
+- Plugin-bundle HTTP and SSE MCP requests now bind every connection to a validated public address and revalidate bounded redirects before following them.
+- Deep Interview now exposes stage-specific provider-facing `ask` metadata: Round 0 advertises only the locked `intent_contract` branch, while later rounds advertise ordinary and `intent_review` branches, preventing strict-schema constraint stripping from making an invalid empty Round 0 review selectable.
+- Deep Interview now exposes stage-specific provider-facing `ask` metadata, including after durable session resume: Round 0 advertises only the locked `intent_contract` branch, while later rounds advertise ordinary and `intent_review` branches. Remaining strict-schema constraints that providers cannot express fail closed with bounded corrective guidance instead of an opaque retry loop.
+- Deep Interview now exposes stage-specific provider-facing `ask` metadata, including after durable session resume: Round 0 advertises only the locked `intent_contract` branch, while later rounds advertise ordinary and `intent_review` branches. Foreign workflow gates can no longer seed Deep Interview recorder state, and remaining strict-schema constraints that providers cannot express fail closed with bounded corrective guidance instead of an opaque retry loop.
+- Documented that custom OpenAI-compatible models omit vision by default: when `input` is unset, GJC treats the model as text-only and strips images with `[image omitted: model does not support vision]`. Vision backends must set `input: [text, image]` in `models.yml`.
+- Restored `/models` preset landing navigation after the Image Generation row and made compaction/pruning regression fixtures use an explicit 200K context boundary instead of a mutable provider descriptor default.
+- Fixed Windows legacy session artifact migration by using native directory identity size, a traversable detached-path alias, and writable file handles for final durability sync.
+- `gjc setup credentials` now auto-imports only OAuth credentials with a finite expiry strictly in the future. Expired or malformed-expiry discoveries remain visible as non-importable records, and existing imported credentials remain recoverable through `/login`.
+- Resumed managed sessions now complete the verified legacy `local://` artifact migration before synchronous path resolution, preserving legacy scratch files instead of failing startup with a migration-order error.
+- Corrected Telegram's uncertain lifecycle guidance so create, close, and resume commands describe their own possible outcome; close and resume no longer display the create-only duplicate-start warning.
+- Telegram ask notifications now preserve the authoritative recommended choice from native asks and workflow gates, marking that option as `(Recommended)` in the message body without changing button indices or submitted answers.
+- Telegram `/session_close` now fails closed when tmux disappearance cannot be confirmed, and publishes the managed owner verdict before locked terminal-state preservation so normal close finalization is not delayed behind that state path.
+- Managed publication now fails closed on malformed, committed, or mutation-unknown native outcomes: it never retries or cleans a destination, and preserves bounded atomic-unavailable/durability diagnostics through managed startup (#2804).
+
+## [0.11.5] - 2026-07-20
+### Fixed
+
+- Internal transcript PageUp/PageDown now keeps moving through tool-output and other non-semantic rows instead of intermittently becoming a no-op after scrolling through anchored conversation content.
+
 ## [0.11.5] - 2026-07-20
 ### Changed
 - Telegram live-message streaming now defaults on for configured Telegram notifications through one durable global preference, supports live in-session preference refresh without weakening redaction, and keeps Discord and Slack finalized-only; process environment overrides remain available.
@@ -10,14 +77,27 @@
 - Session files now use v5 authority records. Do not roll back to a v4 writer after v5 session data has been created: v4 writers cannot preserve independent MCP and discovered-built-in selections.
 
 ### Fixed
+- SQLite `read` raw queries now accept exactly one explicit `SELECT` statement, reject comments and statement tails before opening the database, recheck the invariant at execution, and enable SQLite query-only mode as defense in depth.
+- Direct HTTP(S) marketplace catalogs now use connection-bound public-address validation, bounded redirects, and a 2 MiB response limit before parsing or caching.
+- Bounded MCP list pagination by cursor-cycle, page-count, and item-count limits while preserving abort and cache behavior.
+- Shell environment snapshots now use one process-private temporary root with exclusive private files, trusted cache validation, and whole-root shutdown cleanup instead of a predictable shared directory.
+- Python kernel startup now materializes its bundled runner in one process-private temporary directory with exclusive file creation instead of consulting a predictable shared cache path.
+- SSH command construction and discovery now reject malformed destinations with unsafe prefixes or control characters while preserving normal host, address, username, and alias forms.
+- Bounded MCP resource URI and template matching now skips oversized templates and uses deterministic literal-segment matching instead of dynamically constructed regular expressions.
 - Fixed the `subagent` tool's `resume` action silently swallowing manager failures. Resume outcomes other than `context_unavailable`/`not_found` (`no_runner`, `resume_failed`, `owner_shutdown_in_progress`, …) were dropped and the stale terminal subagent snapshot was returned as if the resume had succeeded, so ralplan's re-review loop believed the persisted Planner had resumed when it had not and never fell back correctly. The resume action now surfaces every non-ok reason (matching the `steer` branch), and the task resume runner marks a resumed subprocess that aborted or exited non-zero as a `failed` job (carrying its rendered failure summary) instead of reporting it `completed`.
+- Daemon timeout flags now reject missing, malformed, non-positive, fractional, whitespace-containing, and unsafe integer values before daemon command side effects instead of partially parsing them.
 - Hardened standalone HTML session exports so session identifiers, provider/model labels, and embedded raster images remain confined to their intended HTML contexts; malformed image payloads are omitted.
+- Restored legacy `gjc coordinator-mcp` and root `gjc --team --team-size <n>` routing to their native MCP and team commands, with strict team-size validation that prevents malformed legacy flags from selecting team lifecycle actions.
+- Fixed the `subagent` tool's `resume` action silently swallowing manager failures. Resume outcomes other than `context_unavailable`/`not_found` (`no_runner`, `resume_failed`, `owner_shutdown_in_progress`, …) were dropped and the stale terminal subagent snapshot was returned as if the resume had succeeded, so ralplan's re-review loop believed the persisted Planner had resumed when it had not and never fell back correctly. The resume action now surfaces every non-ok reason (matching the `steer` branch), and the task resume runner marks a resumed subprocess that aborted or exited non-zero as a `failed` job (preserving its error text) instead of reporting it `completed`.
+- OpenRouter image generation now retrieves provider-returned HTTP(S) images only through connection-bound public-address validation, revalidates bounded redirects, and enforces image content-type and byte limits before buffering.
+- Fixed session resume crashing with `TypeError: undefined is not an object (evaluating 'usage.input')`, and hardened both usage-aggregation paths against silent total corruption, when a persisted transcript contained a parseable-but-malformed assistant or `task` tool-result entry — as produced by torn concurrent multi-writer / NFS appends. `parseSessionEntries` accepts any parseable JSON, so a corrupt `usage` could be absent, `{}` (NaN totals), numeric strings (`"0" + "10"` → `"010"`), negative (silently reducing totals), a present-but-null/incomplete `premiumRequests`/`cost`, a non-record `cost` (e.g. an array), or cumulatively overflow to `Infinity`. Both the resume (`#buildIndex`) and runtime append (`#appendEntry`) paths now route through one shared validator that requires every usage bucket and `cost.total` to be finite non-negative numbers (defaulting only truly-absent `premiumRequests`/`cost`, and rejecting present-but-null/incomplete fields rather than zeroing them) and rejects any record that would overflow cumulative totals, skipping and reporting the malformed record instead of poisoning every `getUsageStatistics()` consumer.
 - Fixed the `subagent` tool's `resume` failing immediately for a persisted ralplan Planner. A subagent that finishes by calling `yield` (or is torn down right after a tool executes) left the saved session ending on an assistant `toolCall` with no matching `toolResult`; replaying that history on resume produced an invalid provider request (a `tool_use` not followed by a `tool_result`) that failed the resumed turn at once. Resumed transcripts now reconcile any trailing unpaired tool call with a synthesized placeholder result before the first resumed prompt. Additionally, a failed/no-op resume leg no longer overwrites the prior run's success output artifact with an empty file.
 - Fixed persisted subagent resumes being rejected before session reconstruction with `Session is inside managed storage but is not an authorized managed candidate`. Child session files intentionally live inside their parent session's artifact directory and are not top-level resume-picker candidates; the task resume path now explicitly opens the exact internally registered child session directory while retaining strict candidate validation for user-selected managed sessions.
 - Managed session resume scans now read only a bounded no-follow header prefix from foreign workspace transcripts, while fully recapturing and revalidating owned candidates before granting migration, receipt, or deletion authority.
 - Secret obfuscation now uses authenticated process-local placeholders that remain stable within a running process and opaque after restart.
 - Workspace-wide LSP diagnostics now fail closed instead of launching build or typecheck subprocesses outside execution-tool authorization; concrete-file and glob diagnostics remain available.
 - Clean, side-effect-free canonical provider stream first-event and next-event watchdog failures now retry on bare single-model legacy sessions; explicit legacy disable, managed fallback, and fail-closed structured, non-watchdog, or unsafe attempts are unchanged.
+- Remote MCP HTTP and SSE responses now enforce finite content and message budgets before parsing or dispatch.
 - Added fail-closed managed tmux owner SIGABRT recovery: exact-child supervisor receipts and pre-CLI admission now bind replacement ownership, strict durable Ultragoal/transcript evidence reconciles terminal child yields over stale nonterminal runtime state, recovery hydration remains write-free until an ownership fence, and hostile identity, corruption, concurrency, and path boundaries preserve dirty product files (#2681).
 - Restored non-root startup on Synology and other Linux container filesystems that definitively report POSIX ACL storage unsupported for managed session paths; explicit `--session-dir` semantics and all owner, mode, type, symlink, identity, and scope-binding checks remain unchanged and fail closed (#2687).
 - Preserved access to legal SQLite table names beginning with `sqlite` but not reserved `sqlite_`.
@@ -54,11 +134,19 @@
 ### Changed
 - The `read` tool is now receipt-by-default: bare and unparseable reads return a bounded receipt (≤50 lines / 10 KiB) with a re-read-with-selector footer only when truncated, `:raw` stays pure verbatim up to a max(2 MiB, spill threshold) ceiling, structural summaries cap unit-granularly at 20 KiB while preserving elision and source-recovery footers, and directories are byte/line capped and never spill. Only an explicit full-content selector (`:raw` or an explicit range) with real content is spill-eligible. Subagent previews now enforce a real byte/code-point cap via per-shape render budgets plus a shape-aware artifact-eligibility tag enforced centrally in output-meta.
 
+
+### Fixed
+- Ultragoal objective ownership no longer treats arbitrary strings that merely mention `goals.json`/`ledger.jsonl` as Ultragoal-owned; only the exact default aggregate objective qualifies for the known-objective path.
+
 ### Fixed
 - Workflow-state handoff no longer self-locks the active-state cache, so a same-turn skill handoff (e.g. ultragoal → ralplan) completes instead of stalling behind a lock the handoff itself still holds (#2638).
 - SDK host shutdown now retries a failed broker unregister instead of short-circuiting with a stale broker-index entry, while retained startup-cleanup owner-release failures remain isolated from the red extension-error path (#2625).
 - Non-TTY launches now fail fast when stdin is empty and automatically use print mode for positional prompts and `@file` inputs, preventing orphaned interactive TUI processes (#2507).
 
+### Fixed
+
+- The command palette now labels `app.session.fork` as “Branch from message,” matching its user-message selector and `AgentSession.branch()` behavior while preserving the existing action ID for keybinding compatibility.
+
 ## [0.11.2] - 2026-07-19
 
 ### Changed
@@ -83,6 +171,7 @@
 ### Fixed
 - Repository LSP configuration can no longer define process-affecting server behavior: project files may control declarative matching, activation, and capabilities, but cannot set launch fields, initialization options, or opaque server settings. Trusted canonical user configuration outside the project retains those overrides; project-controlled plugin roots and the quarantined `--plugin-dir` surface cannot inject them. Automatic discovery uses trusted external executables and rejects repository-owned lexical paths as well as symlink-resolved project binaries; status uses the session cwd as its lspmux trust root. `GJC_DISABLE_LSPMUX=1` is the canonical opt-out and `PI_DISABLE_LSPMUX=1` is a supported compatibility alias; either truthy value disables lspmux probing and wrapping.
 - Palette slash commands now run only from an empty composer; drafts are never touched.
+- Individual default and named-role model assignments now keep the model selector open for consecutive choices, while batch assignments retain their existing close-on-success behavior.
 - Aborting a session without an enabled active goal no longer suppresses the first reminder when a goal is activated later; active-goal abort suppression is one-shot, goal-owned, and clears across inactive or replacement-goal transitions (#2436).
 - Palette slash submissions no longer clear or rewrite composer text, cursor state, history, or pending images created while an asynchronous input hook is awaiting; canonical keyboard submission cleanup remains unchanged (#2441).
 - Dead browser-tab recovery now expires descriptors without releasing replacement, revived, or differently owned tabs, while exactly-once teardown closes stale targets and releases browser holds without refcount underflow (#2437).
@@ -108,6 +197,9 @@
 ### Fixed
 - Connected MCP server instructions now remain untrusted user-role data instead of entering the cached system prompt; hostile file paths, working directories, and workspace-tree metadata are structurally encoded, and volatile project context is removed from durable session history between requests.
 - Restored the strict G002 public-surface quarantine by removing the default README advertisement for the private coordinator MCP runtime.
+### Added
+
+- Added opt-in prompt suggestions (Claude Code-style ghost-text autocomplete): with the `promptSuggestions` setting enabled, a smol-model prediction of your likely next prompt renders as dim ghost text in the empty composer after each agent turn; Tab accepts it, typing dismisses it, and a new turn clears it. Predictions are heuristically gated (silence on evaluative/meta/agent-voice/overlong output) and never generated while the composer has text or a turn is streaming.
 
 ## [0.11.1] - 2026-07-16
 

package/dist/types/capability/index.d.ts

@@ -17,26 +17,16 @@ export declare function loadCapability<T>(capabilityId: string, options?: LoadOp
  * Call this once on startup to enable persistent provider state.
  */
 export declare function initializeWithSettings(activeSettings: Settings): void;
-/**
- * Disable a provider globally (across all capabilities).
- */
-export declare function disableProvider(providerId: string): void;
-/**
- * Enable a previously disabled provider.
- */
-export declare function enableProvider(providerId: string): void;
-/**
- * Check if a provider is enabled.
- */
-export declare function isProviderEnabled(providerId: string): boolean;
-/**
- * Get list of all disabled provider IDs.
- */
-export declare function getDisabledProviders(): string[];
-/**
- * Set disabled providers from a list (replaces current set).
- */
-export declare function setDisabledProviders(providerIds: string[]): void;
+/** Disable a provider for the supplied session settings. */
+export declare function disableProvider(providerId: string, activeSettings?: Settings): void;
+/** Enable a provider for the supplied session settings. */
+export declare function enableProvider(providerId: string, activeSettings?: Settings): void;
+/** Check whether a provider is enabled by the supplied session settings. */
+export declare function isProviderEnabled(providerId: string, activeSettings?: Settings | undefined): boolean;
+/** Get disabled providers from the supplied session settings. */
+export declare function getDisabledProviders(activeSettings?: Settings | undefined): string[];
+/** Replace disabled providers for the supplied session settings. */
+export declare function setDisabledProviders(providerIds: string[], activeSettings?: Settings): void;
 /**
  * Get a capability definition (for introspection).
  */

package/dist/types/capability/types.d.ts

@@ -5,6 +5,7 @@
  * paths like `.gjc`, `.gemini`, or `.vscode`, they simply ask for `load("mcps")`
  * and get back a unified array of MCP servers.
  */
+import type { Settings } from "../config/settings";
 /**
  * Context passed to every provider loader.
  */
@@ -64,6 +65,8 @@ export interface LoadOptions {
     includeDisabled?: boolean;
     /** Explicit disabled extension IDs to apply instead of settings. */
     disabledExtensions?: string[];
+    /** Session settings whose provider policy applies to this load. */
+    settings?: Settings;
 }
 /**
  * Source metadata attached to every loaded item.

package/dist/types/cli/args.d.ts

@@ -52,5 +52,3 @@ export interface Args {
     authBootstrap?: true;
 }
 export declare function parseArgs(args: string[]): Args;
-export declare function getExtraHelpText(): string;
-export declare function printHelp(): void;

package/dist/types/commands/daemon.d.ts

@@ -31,10 +31,10 @@ export default class Daemon extends Command {
         force: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };
-        "graceful-timeout-ms": import("@gajae-code/utils/cli").FlagDescriptor<"integer"> & {
+        "graceful-timeout-ms": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
-        "kill-timeout-ms": import("@gajae-code/utils/cli").FlagDescriptor<"integer"> & {
+        "kill-timeout-ms": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
         "spawn-if-stopped": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {

package/dist/types/commands/sdk.d.ts

@@ -15,17 +15,35 @@ export declare function runSessionHost(timing?: {
     cwd?: string;
     processIncarnation?: (pid: number) => string | undefined;
 }): Promise<void>;
+export type SdkInternalArgv = {
+    action: "broker-internal";
+    agentDir: string;
+} | {
+    action: "session-host-internal";
+};
+/** Parses the exact private argv contracts used by SDK child-process spawns. */
+export declare function parseSdkInternalArgv(argv: readonly string[]): SdkInternalArgv;
 export default class Sdk extends Command {
     static description: string;
     static hidden: boolean;
+    static delegateHelp: boolean;
     static args: {
         action: import("@gajae-code/utils/cli").ArgDescriptor & {
-            required: true;
+            required: false;
             options: string[];
         };
     };
     static flags: {
-        "agent-dir": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+        stdio: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        socket: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        session: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "pending-ceiling": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
     };

package/dist/types/config/keybindings.d.ts

@@ -279,7 +279,7 @@ export declare const KEYBINDINGS: {
     };
     readonly "app.session.fork": {
         readonly defaultKeys: [];
-        readonly description: "Fork session";
+        readonly description: "Branch from message";
     };
     readonly "app.session.resume": {
         readonly defaultKeys: [];
@@ -378,6 +378,10 @@ declare function migrateKeybindingsConfigFile(agentDir: string): void;
 export declare class KeybindingsManager extends TuiKeybindingsManager {
     #private;
     constructor(userBindings?: KeybindingsConfig, configPath?: string);
+    /**
+     * Replace user bindings only after canonical grammar validation.
+     */
+    setUserBindings(userBindings: KeybindingsConfig): void;
     /**
      * Create from config file at agentDir/keybindings.json.
      */
@@ -386,6 +390,11 @@ export declare class KeybindingsManager extends TuiKeybindingsManager {
      * Create an in-memory keybindings manager without file persistence.
      */
     static inMemory(userBindings?: KeybindingsConfig): KeybindingsManager;
+    /**
+     * Set the default display context used by composed surfaces that do not
+     * supply an explicit context.
+     */
+    setDisplayContext(context: KeyDisplayContext): void;
     /**
      * Reload keybindings from the config file.
      */
@@ -397,9 +406,30 @@ export declare class KeybindingsManager extends TuiKeybindingsManager {
     /**
      * Get display string for a keybinding (e.g., "ctrl+c/escape").
      */
-    getDisplayString(keybinding: Keybinding): string;
+    getDisplayString(keybinding: Keybinding, context?: KeyDisplayContext): string;
+    /**
+     * Get an accessibility-oriented display string for help surfaces.
+     * Darwin chords include both the concise glyphs and expanded key names.
+     */
+    getAccessibleDisplayString(keybinding: Keybinding, context?: KeyDisplayContext): string;
+    /**
+     * Format a fixed key chord using this manager's display context.
+     */
+    formatKeyHint(key: string): string;
+    /**
+     * Format a fixed key chord for accessibility-oriented help surfaces.
+     */
+    formatAccessibleKeyHint(key: string): string;
+}
+/**
+ * Key hint formatting utilities for UI labels.
+ */
+export interface KeyDisplayContext {
+    platform: NodeJS.Platform;
 }
-export declare function formatKeyHint(key: KeyId): string;
-export declare function formatKeyHints(keys: KeyId | KeyId[]): string;
+export declare function formatKeyHint(key: string, context?: KeyDisplayContext): string;
+export declare function formatAccessibleKeyHint(key: string, context?: KeyDisplayContext): string;
+export declare function formatKeyHints(keys: string | readonly string[], context?: KeyDisplayContext): string;
+export declare function formatAccessibleKeyHints(keys: string | readonly string[], context?: KeyDisplayContext): string;
 export type { Keybinding, KeybindingsConfig, KeyId };
 export { migrateKeybindingsConfigFile };

package/dist/types/config/model-profile-activation.d.ts

@@ -1,6 +1,7 @@
 import { ThinkingLevel } from "@gajae-code/agent-core";
 import type { Api, Model } from "@gajae-code/ai";
 import type { AgentSession } from "../session/agent-session";
+export { resolveModelProfileName } from "./model-profile-contract";
 import { type GjcModelAssignmentTargetId, type ModelRegistry } from "./model-registry";
 import { type ModelSelectorValue } from "./model-selector-value";
 import type { Settings } from "./settings";
@@ -17,7 +18,9 @@ type ModelProfileActivationSession = Pick<AgentSession, "model" | "thinkingLevel
 };
 export interface PrepareModelProfileActivationOptions {
     session: ModelProfileActivationSession;
-    modelRegistry: Pick<ModelRegistry, "getModelProfile" | "getModelProfiles" | "getAvailableModelProfileNames" | "getApiKeyForProvider" | "getAll" | "resolveCanonicalModel" | "getCanonicalVariants" | "getCanonicalId">;
+    modelRegistry: Pick<ModelRegistry, "getModelProfile" | "getModelProfiles" | "getAvailableModelProfileNames" | "getApiKeyForProvider" | "getAll" | "resolveCanonicalModel" | "getCanonicalVariants" | "getCanonicalId"> & {
+        getError?: ModelRegistry["getError"];
+    };
     settings: Pick<Settings, "get">;
     profileName: string;
 }
@@ -78,7 +81,6 @@ export declare class ModelProfileCredentialError extends Error {
     constructor(profileLabel: string, providers: readonly string[]);
 }
 export declare function formatModelProfileCredentialError(profileLabel: string, providers: readonly string[]): string;
-export declare function resolveModelProfileName(profileName: string, profiles: ReadonlyMap<string, unknown>): string;
 export declare function prepareModelProfileActivation(options: PrepareModelProfileActivationOptions): Promise<PreparedModelProfileActivation>;
 export declare function applyPreparedModelProfileActivation(prepared: PreparedModelProfileActivation, options?: ApplyModelProfileActivationOptions): Promise<void>;
 export interface MaterializeModelProfileForDeletionResult {
@@ -99,4 +101,3 @@ export declare function restoreMaterializedModelProfileForDeletion(options: {
     snapshot: MaterializeModelProfileForDeletionResult;
 }): Promise<void>;
 export declare function activateModelProfile(options: PrepareModelProfileActivationOptions, applyOptions?: ApplyModelProfileActivationOptions): Promise<void>;
-export {};

package/dist/types/config/model-profile-contract.d.ts

@@ -0,0 +1,38 @@
+import { type ModelProfileDefinition } from "./model-profiles";
+export declare const MODEL_PROFILE_DISCOVERY_QUERY = "models.profiles.list";
+export declare const MODEL_PROFILE_ERROR_DETAIL_MAX_BYTES = 2048;
+export interface ModelProfileCatalogItem {
+    id: string;
+    displayName: string;
+    source: "builtin" | "configured";
+}
+export interface UnknownModelProfileDetails {
+    requestedProfile: string;
+    availableProfiles: string[];
+    discoveryQuery: typeof MODEL_PROFILE_DISCOVERY_QUERY;
+}
+export interface ModelProfileRegistryErrorDetails {
+    requestedProfile?: string;
+    availableProfiles: [];
+    discoveryQuery: typeof MODEL_PROFILE_DISCOVERY_QUERY;
+}
+export type ModelProfileErrorDetails = UnknownModelProfileDetails | ModelProfileRegistryErrorDetails;
+export type ModelProfileErrorCode = "unknown_model_profile" | "model_profile_registry_error";
+export declare class UnknownModelProfileError extends Error {
+    readonly code: "unknown_model_profile";
+    readonly details: UnknownModelProfileDetails;
+    constructor(requestedProfile: string, profiles: ReadonlyMap<string, unknown>);
+}
+export declare class ModelProfileRegistryError extends Error {
+    readonly code: "model_profile_registry_error";
+    readonly details: ModelProfileRegistryErrorDetails;
+    constructor(requestedProfile?: string);
+}
+export declare function resolveModelProfileName(profileName: string, profiles: ReadonlyMap<string, unknown>): string;
+export declare function validateModelProfileName(profileName: string, profiles: ReadonlyMap<string, unknown>, registryError?: unknown): string;
+export declare function projectModelProfileCatalog(profiles: ReadonlyMap<string, ModelProfileDefinition>, registryError?: unknown): ModelProfileCatalogItem[];
+export declare function isModelProfileError(value: unknown): value is {
+    code: ModelProfileErrorCode;
+    message: string;
+    details: ModelProfileErrorDetails;
+};

package/dist/types/config/settings-schema.d.ts

@@ -937,6 +937,15 @@ export declare const SETTINGS_SCHEMA: {
         readonly type: "boolean";
         readonly default: true;
     };
+    readonly "statusLine.showActionHints": {
+        readonly type: "boolean";
+        readonly default: true;
+        readonly ui: {
+            readonly tab: "appearance";
+            readonly label: "Status Line Action Hints";
+            readonly description: "Show contextual keyboard shortcuts in the status line";
+        };
+    };
     readonly "statusLine.leftSegments": {
         readonly type: "array";
         readonly default: StatusLineSegmentId[];
@@ -1552,6 +1561,15 @@ export declare const SETTINGS_SCHEMA: {
             readonly description: "Suggest emojis from `:name:` shortcodes and expand text emoticons like `:D` or `:-)`";
         };
     };
+    readonly promptSuggestions: {
+        readonly type: "boolean";
+        readonly default: false;
+        readonly ui: {
+            readonly tab: "interaction";
+            readonly label: "Prompt Suggestions";
+            readonly description: "Predict your likely next prompt after each turn (smol-model call) and show it as ghost text; Tab accepts";
+        };
+    };
     readonly "startup.quiet": {
         readonly type: "boolean";
         readonly default: false;
@@ -2915,8 +2933,8 @@ export declare const SETTINGS_SCHEMA: {
         readonly default: false;
         readonly ui: {
             readonly tab: "tools";
-            readonly label: "Insane Search Fallback";
-            readonly description: "Opt in to the vendored insane-search escalation for blocked public URL reads (403/WAF/JS-gated). Off by default. Requires preinstalled python3 + curl_cffi (and node + playwright/stealth for the browser phase); changes network posture by enabling TLS/browser impersonation for public pages.";
+            readonly label: "Insane Search Fallback (Compatibility)";
+            readonly description: "Compatibility-only preference. Remote renderer fallback stays disabled because it cannot preserve validated per-hop network routing.";
         };
     };
     readonly "github.enabled": {
@@ -3777,20 +3795,20 @@ export declare const SETTINGS_SCHEMA: {
     };
     readonly "providers.image": {
         readonly type: "enum";
-        readonly values: readonly ["auto", "openai", "gemini", "openrouter", "antigravity"];
+        readonly values: readonly ["auto", "openai", "gemini", "openrouter", "antigravity", "alibaba", "custom"];
         readonly default: "auto";
         readonly ui: {
             readonly tab: "providers";
-            readonly label: "Image Provider";
-            readonly description: "Provider for image generation tool";
+            readonly label: "Image Generation";
+            readonly description: "Provider and model for image generation tool";
             readonly options: readonly [{
                 readonly value: "auto";
                 readonly label: "Auto";
-                readonly description: "Priority: GPT model image tool > Antigravity > OpenRouter > Gemini";
+                readonly description: "Priority: GPT model image tool > Antigravity > OpenRouter > Gemini > Alibaba";
             }, {
                 readonly value: "openai";
                 readonly label: "OpenAI";
-                readonly description: "Uses the active GPT Responses/Codex model";
+                readonly description: "Uses gpt-image-2 via OpenAI Responses/Codex";
             }, {
                 readonly value: "gemini";
                 readonly label: "Gemini";
@@ -3803,9 +3821,53 @@ export declare const SETTINGS_SCHEMA: {
                 readonly value: "antigravity";
                 readonly label: "Antigravity";
                 readonly description: "Requires login with google-antigravity";
+            }, {
+                readonly value: "alibaba";
+                readonly label: "Alibaba Bailian";
+                readonly description: "Requires ALIBABA_TOKEN_PLAN_API_KEY (wan2.7-image via Token Plan)";
+            }, {
+                readonly value: "custom";
+                readonly label: "Custom";
+                readonly description: "OpenAI-compatible endpoint (set providers.imageCustomUrl)";
             }];
         };
     };
+    readonly "providers.imageModel": {
+        readonly type: "string";
+        readonly default: undefined;
+        readonly ui: {
+            readonly tab: "providers";
+            readonly label: "Image Model";
+            readonly description: "Override the default image generation model for the selected provider";
+        };
+    };
+    readonly "providers.imageCustomUrl": {
+        readonly type: "string";
+        readonly default: undefined;
+        readonly ui: {
+            readonly tab: "providers";
+            readonly label: "Image Custom URL";
+            readonly description: "Base URL for custom OpenAI-compatible image endpoint";
+        };
+    };
+    readonly "providers.imageCustomKey": {
+        readonly type: "string";
+        readonly default: undefined;
+        readonly ui: {
+            readonly tab: "providers";
+            readonly label: "Image Custom API Key";
+            readonly description: "API key for custom OpenAI-compatible image endpoint";
+        };
+    };
+    readonly "providers.imageCustomKeyEnv": {
+        readonly type: "string";
+        readonly default: undefined;
+        readonly ui: {
+            readonly tab: "providers";
+            readonly label: "Image Custom API Key Env";
+            readonly description: "Environment variable name holding the API key for custom image endpoint";
+        };
+    };
     readonly "providers.kimiApiFormat": {
         readonly type: "enum";
         readonly values: readonly ["openai", "anthropic"];
@@ -4131,6 +4193,7 @@ export interface StatusLineSettings {
     maxRows: number;
     showHookStatus: boolean;
     showSkillHud: boolean;
+    showActionHints: boolean;
     leftSegments: StatusLineSegmentId[];
     rightSegments: StatusLineSegmentId[];
     segmentOptions: Record<string, unknown>;

package/dist/types/edit/modes/patch.d.ts

@@ -41,11 +41,24 @@ export interface ApplyPatchOptions {
     fuzzyThreshold?: number;
     allowFuzzy?: boolean;
     fs?: FileSystem;
+    /**
+     * When false, skip durable cross-process file locks (in-process path mutex
+     * still serializes). Defaults to true only for the real `defaultFileSystem`
+     * (or when `fs` is omitted). Disk-backed adapters that are not
+     * `defaultFileSystem` (notably production `LspFileSystem` via
+     * `executePatchSingle`) MUST pass `crossProcessLock: true` explicitly —
+     * object identity is not a durable-lock capability probe.
+     */
+    crossProcessLock?: boolean;
 }
 /** Default filesystem implementation using Bun APIs */
 export declare const defaultFileSystem: FileSystem;
 /**
  * Apply a patch operation to the filesystem.
+ *
+ * Concurrent mutations of the same absolute path are serialized (in-process always;
+ * cross-process file lock when using the real filesystem) so disjoint concurrent
+ * edits cannot silently overwrite each other (#2900).
  */
 export declare function applyPatch(input: PatchInput, options: ApplyPatchOptions): Promise<ApplyPatchResult>;
 /**

package/dist/types/edit/path-mutation-lock.d.ts

@@ -0,0 +1,15 @@
+import { type FileLockOptions } from "../config/file-lock";
+export type EditPathMutationOptions = {
+    /**
+     * When true (default), also acquire a durable cross-process file lock.
+     * Disable for injectible/in-memory filesystem tests that do not touch disk.
+     */
+    crossProcess?: boolean;
+    fileLock?: FileLockOptions;
+};
+/**
+ * Run `fn` while holding exclusive mutation rights for every absolute path.
+ * Paths are locked in lexicographic order to avoid deadlocks on multi-path ops
+ * (e.g. rename source + destination).
+ */
+export declare function withEditPathMutation<T>(absolutePaths: readonly string[], fn: () => Promise<T>, options?: EditPathMutationOptions): Promise<T>;

package/dist/types/eval/py/executor.d.ts

@@ -50,7 +50,7 @@ export interface PythonExecutorOptions {
     /** @internal Bridge endpoint info, set by `executePython` before delegating. */
     bridge?: {
         url: string;
-        token: string;
+        capability: string;
     };
 }
 export interface PythonKernelExecutor {

package/dist/types/eval/py/runner-artifact.d.ts

@@ -0,0 +1,8 @@
+export interface RunnerScriptCache {
+    ensureRunnerScript(): Promise<string>;
+    cleanup(): Promise<void>;
+}
+export declare function createRunnerScriptCache(tempRoot: string): RunnerScriptCache;
+/** @internal Test-only initializer for isolated artifact assertions. */
+export declare function createRunnerScriptInitializer(tempRoot: string): () => Promise<string>;
+export declare const ensureRunnerScript: () => Promise<string>;

package/dist/types/eval/py/tool-bridge.d.ts

@@ -7,7 +7,6 @@ export interface PyToolBridgeEntry {
 }
 export interface PyToolBridgeInfo {
     url: string;
-    token: string;
 }
 /** Starts the bridge server lazily and returns its connection info. */
 export declare function ensurePyToolBridge(): Promise<PyToolBridgeInfo>;
@@ -15,6 +14,6 @@ export declare function ensurePyToolBridge(): Promise<PyToolBridgeInfo>;
  * Register a tool session for the duration of one execution. The returned
  * function MUST be called to remove the entry once execution finishes.
  */
-export declare function registerPyToolBridge(sessionId: string, entry: PyToolBridgeEntry): () => void;
+export declare function registerPyToolBridge(sessionId: string, capability: string, entry: PyToolBridgeEntry): () => void;
 /** Stop the bridge and clear registrations. Test-only / shutdown helper. */
 export declare function disposePyToolBridge(): Promise<void>;