@gajae-code/coding-agent 0.11.6 → 0.11.8

package/src/config/model-profile-contract.ts

@@ -0,0 +1,161 @@
+import { formatModelProfileDisplayLabel, type ModelProfileDefinition } from "./model-profiles";
+
+export const MODEL_PROFILE_DISCOVERY_QUERY = "models.profiles.list";
+export const MODEL_PROFILE_ERROR_DETAIL_MAX_BYTES = 2048;
+const REQUESTED_PROFILE_MAX_BYTES = 256;
+
+const LEGACY_MODEL_PROFILE_ALIASES: ReadonlyMap<string, string> = new Map([["codex-standard", "codex-medium"]]);
+
+export interface ModelProfileCatalogItem {
+	id: string;
+	displayName: string;
+	source: "builtin" | "configured";
+}
+
+export interface UnknownModelProfileDetails {
+	requestedProfile: string;
+	availableProfiles: string[];
+	discoveryQuery: typeof MODEL_PROFILE_DISCOVERY_QUERY;
+}
+
+export interface ModelProfileRegistryErrorDetails {
+	requestedProfile?: string;
+	availableProfiles: [];
+	discoveryQuery: typeof MODEL_PROFILE_DISCOVERY_QUERY;
+}
+
+export type ModelProfileErrorDetails = UnknownModelProfileDetails | ModelProfileRegistryErrorDetails;
+export type ModelProfileErrorCode = "unknown_model_profile" | "model_profile_registry_error";
+
+function truncateUtf8(value: string, maxBytes: number): string {
+	if (Buffer.byteLength(value) <= maxBytes) return value;
+	let end = value.length;
+	while (end > 0 && Buffer.byteLength(value.slice(0, end)) > maxBytes) end--;
+	return value.slice(0, end);
+}
+
+function diagnosticProfileEcho(value: string): string {
+	return truncateUtf8(value.normalize("NFKC").replace(/[\p{Cc}\p{Cf}]+/gu, " "), REQUESTED_PROFILE_MAX_BYTES);
+}
+
+function boundedAvailableProfiles(requestedProfile: string, profiles: ReadonlyMap<string, unknown>): string[] {
+	const availableProfiles: string[] = [];
+	for (const id of [...new Set(profiles.keys())].sort((left, right) => left.localeCompare(right))) {
+		const candidate: UnknownModelProfileDetails = {
+			requestedProfile,
+			availableProfiles: [...availableProfiles, id],
+			discoveryQuery: MODEL_PROFILE_DISCOVERY_QUERY,
+		};
+		if (Buffer.byteLength(JSON.stringify(candidate)) > MODEL_PROFILE_ERROR_DETAIL_MAX_BYTES) continue;
+		availableProfiles.push(id);
+	}
+	return availableProfiles;
+}
+
+export class UnknownModelProfileError extends Error {
+	readonly code = "unknown_model_profile" as const;
+	readonly details: UnknownModelProfileDetails;
+
+	constructor(requestedProfile: string, profiles: ReadonlyMap<string, unknown>) {
+		const echoed = diagnosticProfileEcho(requestedProfile);
+		const availableProfiles = boundedAvailableProfiles(echoed, profiles);
+		const available = availableProfiles.length > 0 ? availableProfiles.join(", ") : "none";
+		super(
+			truncateUtf8(
+				`Unknown model profile ${JSON.stringify(echoed)}. Available profiles: ${available}. Query ${MODEL_PROFILE_DISCOVERY_QUERY} for the complete catalog.`,
+				512,
+			),
+		);
+		this.name = "UnknownModelProfileError";
+		this.details = {
+			requestedProfile: echoed,
+			availableProfiles,
+			discoveryQuery: MODEL_PROFILE_DISCOVERY_QUERY,
+		};
+	}
+}
+
+export class ModelProfileRegistryError extends Error {
+	readonly code = "model_profile_registry_error" as const;
+	readonly details: ModelProfileRegistryErrorDetails;
+
+	constructor(requestedProfile?: string) {
+		super(
+			`The model profile registry is unavailable. Query ${MODEL_PROFILE_DISCOVERY_QUERY} after fixing models.yml.`,
+		);
+		this.name = "ModelProfileRegistryError";
+		const echoed = requestedProfile === undefined ? undefined : diagnosticProfileEcho(requestedProfile);
+		this.details = {
+			...(echoed ? { requestedProfile: echoed } : {}),
+			availableProfiles: [],
+			discoveryQuery: MODEL_PROFILE_DISCOVERY_QUERY,
+		};
+	}
+}
+
+export function resolveModelProfileName(profileName: string, profiles: ReadonlyMap<string, unknown>): string {
+	if (profiles.has(profileName)) return profileName;
+	const replacement = LEGACY_MODEL_PROFILE_ALIASES.get(profileName);
+	return replacement && profiles.has(replacement) ? replacement : profileName;
+}
+
+export function validateModelProfileName(
+	profileName: string,
+	profiles: ReadonlyMap<string, unknown>,
+	registryError?: unknown,
+): string {
+	if (registryError !== undefined) throw new ModelProfileRegistryError(profileName);
+	const resolved = resolveModelProfileName(profileName, profiles);
+	if (!profiles.has(resolved)) throw new UnknownModelProfileError(profileName, profiles);
+	return resolved;
+}
+
+export function projectModelProfileCatalog(
+	profiles: ReadonlyMap<string, ModelProfileDefinition>,
+	registryError?: unknown,
+): ModelProfileCatalogItem[] {
+	if (registryError !== undefined) throw new ModelProfileRegistryError();
+	return [...profiles.entries()]
+		.map(([id, definition]) => ({
+			id,
+			displayName: formatModelProfileDisplayLabel(definition),
+			source: definition.source === "user" ? ("configured" as const) : ("builtin" as const),
+		}))
+		.sort((left, right) => left.id.localeCompare(right.id));
+}
+
+export function isModelProfileError(value: unknown): value is {
+	code: ModelProfileErrorCode;
+	message: string;
+	details: ModelProfileErrorDetails;
+} {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const error = value as Record<string, unknown>;
+	if (
+		(error.code !== "unknown_model_profile" && error.code !== "model_profile_registry_error") ||
+		typeof error.message !== "string" ||
+		!error.details ||
+		typeof error.details !== "object" ||
+		Array.isArray(error.details)
+	)
+		return false;
+	const details = error.details as Record<string, unknown>;
+	const detailKeys = Object.keys(details);
+	if (
+		!detailKeys.every(key => key === "requestedProfile" || key === "availableProfiles" || key === "discoveryQuery") ||
+		details.discoveryQuery !== MODEL_PROFILE_DISCOVERY_QUERY ||
+		!Array.isArray(details.availableProfiles) ||
+		!details.availableProfiles.every(id => typeof id === "string") ||
+		Buffer.byteLength(JSON.stringify(details)) > MODEL_PROFILE_ERROR_DETAIL_MAX_BYTES ||
+		(typeof details.requestedProfile === "string" &&
+			Buffer.byteLength(details.requestedProfile) > REQUESTED_PROFILE_MAX_BYTES)
+	)
+		return false;
+	if (error.code === "unknown_model_profile")
+		return detailKeys.length === 3 && typeof details.requestedProfile === "string";
+	return (
+		detailKeys.length === (details.requestedProfile === undefined ? 2 : 3) &&
+		details.availableProfiles.length === 0 &&
+		(details.requestedProfile === undefined || typeof details.requestedProfile === "string")
+	);
+}

package/src/config/model-profiles.ts

@@ -257,6 +257,20 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		critic: "minimax-code/minimax-m3:xhigh",
 		architect: "minimax-code/minimax-m3:xhigh",
 	}),
+	profile("alibaba-token-plan-balanced", ["alibaba-token-plan"], {
+		default: "alibaba-token-plan/qwen3.8-max-preview:medium",
+		executor: "alibaba-token-plan/deepseek-v4-pro:xhigh",
+		planner: "alibaba-token-plan/glm-5.2:high",
+		architect: "alibaba-token-plan/qwen3.8-max-preview:xhigh",
+		critic: "alibaba-token-plan/glm-5.2:high",
+	}),
+	profile("alibaba-token-plan-qwenmaxxing", ["alibaba-token-plan"], {
+		default: "alibaba-token-plan/qwen3.8-max-preview:medium",
+		executor: "alibaba-token-plan/qwen3.8-max-preview:low",
+		planner: "alibaba-token-plan/qwen3.8-max-preview:medium",
+		architect: "alibaba-token-plan/qwen3.8-max-preview:xhigh",
+		critic: "alibaba-token-plan/qwen3.8-max-preview:xhigh",
+	}),
 	profile("opus-codex", ["anthropic", "openai-codex"], {
 		default: "anthropic/claude-opus-4-8:xhigh",
 		executor: "openai-codex/gpt-5.6-terra:low",
@@ -315,6 +329,8 @@ const PROFILE_PRESENTATION: Record<string, ModelProfilePresentation> = {
 	"minimax-eco": { displayName: "MiniMax Eco", providerGroup: "MINIMAX" },
 	"minimax-medium": { displayName: "MiniMax Medium", providerGroup: "MINIMAX" },
 	"minimax-pro": { displayName: "MiniMax Pro", providerGroup: "MINIMAX" },
+	"alibaba-token-plan-balanced": { displayName: "Balanced", providerGroup: "ALIBABA TOKEN PLAN" },
+	"alibaba-token-plan-qwenmaxxing": { displayName: "QwenMaxxing", providerGroup: "ALIBABA TOKEN PLAN" },
 	"opus-codex": { displayName: "Opus + Codex", providerGroup: "COMBOS" },
 	"codex-opencodego": { displayName: "Codex + OpenCodeGo", providerGroup: "COMBOS" },
 	"fable-opus-codex": { displayName: "Fable + Opus + Codex", providerGroup: "COMBOS" },
@@ -330,6 +346,7 @@ const PROFILE_GROUP_ORDER = [
 	"GROK",
 	"CURSOR",
 	"MINIMAX",
+	"ALIBABA TOKEN PLAN",
 	"COMBOS",
 ];
 
@@ -347,6 +364,7 @@ const PROFILE_RECOMMENDATIONS: Record<string, string> = {
 	"grok-build": "grok-build-pro",
 	cursor: "cursor-medium",
 	"minimax-code": "minimax-medium",
+	"alibaba-token-plan": "alibaba-token-plan-balanced",
 };
 
 export function getModelProfilePresentation(

package/src/config/model-registry.ts

@@ -2049,7 +2049,10 @@ export class ModelRegistry {
 		const modelsUrl = `${baseUrl}/models`;
 
 		const headers: Record<string, string> = { ...(providerConfig.headers ?? {}) };
-		const apiKey = await this.authStorage.getApiKey(providerConfig.provider);
+		// Resolve with the same baseUrl context completion requests use so an
+		// endpoint-scoped (or config-pinned) credential wins here exactly as it
+		// does for chat completions.
+		const apiKey = await this.authStorage.getApiKey(providerConfig.provider, undefined, { baseUrl });
 		if (apiKey && apiKey !== DEFAULT_LOCAL_TOKEN && apiKey !== kNoAuth) {
 			headers.Authorization = `Bearer ${apiKey}`;
 		}
@@ -2059,6 +2062,13 @@ export class ModelRegistry {
 			signal: AbortSignal.timeout(250),
 		});
 		if (!response.ok) {
+			if (response.status === 401 || response.status === 403) {
+				// Redacted by construction: name the provider, endpoint, and the
+				// config surface to fix — never the resolved key.
+				throw new Error(
+					`HTTP ${response.status} from ${modelsUrl}: provider "${providerConfig.provider}" credential was rejected for OpenAI models-list discovery; check providers.${providerConfig.provider}.apiKey/apiKeyEnv.`,
+				);
+			}
 			throw new Error(`HTTP ${response.status} from ${modelsUrl}`);
 		}
 		const payload = (await response.json()) as { data?: Array<{ id: string }> };

package/src/config/settings-schema.ts

@@ -819,6 +819,15 @@ export const SETTINGS_SCHEMA = {
 		type: "boolean",
 		default: true,
 	},
+	"statusLine.showActionHints": {
+		type: "boolean",
+		default: true,
+		ui: {
+			tab: "appearance",
+			label: "Status Line Action Hints",
+			description: "Show contextual keyboard shortcuts in the status line",
+		},
+	},
 
 	"statusLine.leftSegments": { type: "array", default: [] as StatusLineSegmentId[] },
 
@@ -1334,6 +1343,16 @@ export const SETTINGS_SCHEMA = {
 			description: "Suggest emojis from `:name:` shortcodes and expand text emoticons like `:D` or `:-)`",
 		},
 	},
+	promptSuggestions: {
+		type: "boolean",
+		default: false,
+		ui: {
+			tab: "interaction",
+			label: "Prompt Suggestions",
+			description:
+				"Predict your likely next prompt after each turn (smol-model call) and show it as ghost text; Tab accepts",
+		},
+	},
 
 	"startup.quiet": {
 		type: "boolean",
@@ -2451,9 +2470,9 @@ export const SETTINGS_SCHEMA = {
 		default: false,
 		ui: {
 			tab: "tools",
-			label: "Insane Search Fallback",
+			label: "Insane Search Fallback (Compatibility)",
 			description:
-				"Opt in to the vendored insane-search escalation for blocked public URL reads (403/WAF/JS-gated). Off by default. Requires preinstalled python3 + curl_cffi (and node + playwright/stealth for the browser phase); changes network posture by enabling TLS/browser impersonation for public pages.",
+				"Compatibility-only preference. Remote renderer fallback stays disabled because it cannot preserve validated per-hop network routing.",
 		},
 	},
 
@@ -3290,25 +3309,71 @@ export const SETTINGS_SCHEMA = {
 	},
 	"providers.image": {
 		type: "enum",
-		values: ["auto", "openai", "gemini", "openrouter", "antigravity"] as const,
+		values: ["auto", "openai", "gemini", "openrouter", "antigravity", "alibaba", "custom"] as const,
 		default: "auto",
 		ui: {
 			tab: "providers",
-			label: "Image Provider",
-			description: "Provider for image generation tool",
+			label: "Image Generation",
+			description: "Provider and model for image generation tool",
 			options: [
 				{
 					value: "auto",
 					label: "Auto",
-					description: "Priority: GPT model image tool > Antigravity > OpenRouter > Gemini",
+					description: "Priority: GPT model image tool > Antigravity > OpenRouter > Gemini > Alibaba",
 				},
-				{ value: "openai", label: "OpenAI", description: "Uses the active GPT Responses/Codex model" },
+				{ value: "openai", label: "OpenAI", description: "Uses gpt-image-2 via OpenAI Responses/Codex" },
 				{ value: "gemini", label: "Gemini", description: "Requires GEMINI_API_KEY" },
 				{ value: "openrouter", label: "OpenRouter", description: "Requires OPENROUTER_API_KEY" },
 				{ value: "antigravity", label: "Antigravity", description: "Requires login with google-antigravity" },
+				{
+					value: "alibaba",
+					label: "Alibaba Bailian",
+					description: "Requires ALIBABA_TOKEN_PLAN_API_KEY (wan2.7-image via Token Plan)",
+				},
+				{
+					value: "custom",
+					label: "Custom",
+					description: "OpenAI-compatible endpoint (set providers.imageCustomUrl)",
+				},
 			],
 		},
 	},
+	"providers.imageModel": {
+		type: "string",
+		default: undefined,
+		ui: {
+			tab: "providers",
+			label: "Image Model",
+			description: "Override the default image generation model for the selected provider",
+		},
+	},
+	"providers.imageCustomUrl": {
+		type: "string",
+		default: undefined,
+		ui: {
+			tab: "providers",
+			label: "Image Custom URL",
+			description: "Base URL for custom OpenAI-compatible image endpoint",
+		},
+	},
+	"providers.imageCustomKey": {
+		type: "string",
+		default: undefined,
+		ui: {
+			tab: "providers",
+			label: "Image Custom API Key",
+			description: "API key for custom OpenAI-compatible image endpoint",
+		},
+	},
+	"providers.imageCustomKeyEnv": {
+		type: "string",
+		default: undefined,
+		ui: {
+			tab: "providers",
+			label: "Image Custom API Key Env",
+			description: "Environment variable name holding the API key for custom image endpoint",
+		},
+	},
 
 	"providers.kimiApiFormat": {
 		type: "enum",
@@ -3740,6 +3805,7 @@ export interface StatusLineSettings {
 	maxRows: number;
 	showHookStatus: boolean;
 	showSkillHud: boolean;
+	showActionHints: boolean;
 	leftSegments: StatusLineSegmentId[];
 	rightSegments: StatusLineSegmentId[];
 	segmentOptions: Record<string, unknown>;

package/src/coordinator-mcp/model-preset.ts

@@ -1,44 +1,10 @@
 import * as path from "node:path";
 import { getAgentDir } from "@gajae-code/utils";
 import { YAML } from "bun";
+import { UnknownModelProfileError, validateModelProfileName } from "../config/model-profile-contract";
+import { mergeModelProfiles } from "../config/model-profiles";
 import { ModelsConfigSchema } from "../config/models-config-schema";
 
-/**
- * The coordinator runs in the shipped MCP process and must stay outside the
- * session host import graph. Keep this identity catalog in the coordinator
- * boundary; profile activation and model registry code belong to that host.
- */
-const BUILTIN_MODEL_PROFILE_NAMES = [
-	"codex-eco",
-	"codex-medium",
-	"codex-pro",
-	"opencodego",
-	"claude-opus",
-	"claude-fable",
-	"glm-eco",
-	"glm-medium",
-	"glm-pro",
-	"kimi-coding-plan-eco",
-	"kimi-coding-plan-medium",
-	"kimi-coding-plan-pro",
-	"mimo-eco",
-	"mimo-medium",
-	"mimo-pro",
-	"grok-eco",
-	"grok-medium",
-	"grok-pro",
-	"grok-build-pro",
-	"cursor-eco",
-	"cursor-medium",
-	"cursor-pro",
-	"minimax-eco",
-	"minimax-medium",
-	"minimax-pro",
-	"opus-codex",
-	"codex-opencodego",
-	"fable-opus-codex",
-] as const;
-
 export interface CoordinatorModelProfile {
 	name: string;
 }
@@ -53,8 +19,6 @@ export type CoordinatorModelProfileLoader = () =>
 	| Promise<Map<string, CoordinatorModelProfile>>;
 
 const MAX_ECHOED_MPRESET_LENGTH = 128;
-const LEGACY_MODEL_PROFILE_ALIASES: ReadonlyMap<string, string> = new Map([["codex-standard", "codex-medium"]]);
-
 /**
  * Thrown by the default loader when `models.yml` exists but is invalid or
  * unreadable. This lets the resolver fail closed with a distinct, stable reason
@@ -69,35 +33,25 @@ export class CoordinatorModelProfileRegistryError extends Error {
 	}
 }
 
-function builtInCoordinatorModelProfiles(): Map<string, CoordinatorModelProfile> {
-	return new Map(BUILTIN_MODEL_PROFILE_NAMES.map(name => [name, { name }]));
+function coordinatorModelProfiles(
+	profiles?: Parameters<typeof mergeModelProfiles>[0],
+): Map<string, CoordinatorModelProfile> {
+	return new Map([...mergeModelProfiles(profiles).keys()].map(name => [name, { name }]));
 }
 
 export const loadCoordinatorModelProfiles: CoordinatorModelProfileLoader = async () => {
 	const modelsFile = Bun.file(path.join(getAgentDir(), "models.yml"));
-	if (!(await modelsFile.exists())) return builtInCoordinatorModelProfiles();
+	if (!(await modelsFile.exists())) return coordinatorModelProfiles();
 	try {
 		const parsed = YAML.parse(await modelsFile.text());
 		const config = ModelsConfigSchema.safeParse(parsed);
 		if (!config.success) throw config.error;
-		const profiles = builtInCoordinatorModelProfiles();
-		for (const name of Object.keys(config.data.profiles ?? {})) profiles.set(name, { name });
-		return profiles;
+		return coordinatorModelProfiles(config.data.profiles);
 	} catch (error) {
 		throw new CoordinatorModelProfileRegistryError(error);
 	}
 };
 
-function sortedProfileNames(profiles: ReadonlyMap<string, CoordinatorModelProfile>): string[] {
-	return [...profiles.keys()].sort((left, right) => left.localeCompare(right));
-}
-
-function resolveCoordinatorModelProfileName(profileName: string, profiles: ReadonlyMap<string, unknown>): string {
-	if (profiles.has(profileName)) return profileName;
-	const replacement = LEGACY_MODEL_PROFILE_ALIASES.get(profileName);
-	return replacement && profiles.has(replacement) ? replacement : profileName;
-}
-
 export type CoordinatorMpresetResolution =
 	| { ok: true; mpreset: string | null }
 	| { ok: false; reason: "unknown_model_profile"; mpreset: string; available_profiles: string[] }
@@ -120,7 +74,7 @@ export async function resolveCoordinatorMpreset(
 	loadProfiles: CoordinatorModelProfileLoader,
 ): Promise<CoordinatorMpresetResolution> {
 	if (raw === undefined || raw === null) return { ok: true, mpreset: null };
-	const requested = typeof raw === "string" ? raw.trim() : "";
+	const requested = typeof raw === "string" ? raw : "";
 	const echoed = requested.slice(0, MAX_ECHOED_MPRESET_LENGTH);
 	let profiles: Map<string, CoordinatorModelProfile>;
 	try {
@@ -131,24 +85,17 @@ export async function resolveCoordinatorMpreset(
 		}
 		throw error;
 	}
-	// Non-string input and explicit blank/whitespace strings can never name a
-	// profile; only absent/null (handled above) means "no selection".
-	if (typeof raw !== "string" || requested.length === 0) {
-		return {
-			ok: false,
-			reason: "unknown_model_profile",
-			mpreset: echoed,
-			available_profiles: sortedProfileNames(profiles),
-		};
-	}
-	const canonical = resolveCoordinatorModelProfileName(requested, profiles);
-	if (!profiles.has(canonical)) {
-		return {
-			ok: false,
-			reason: "unknown_model_profile",
-			mpreset: echoed,
-			available_profiles: sortedProfileNames(profiles),
-		};
+	try {
+		const canonical = validateModelProfileName(requested, profiles);
+		return { ok: true, mpreset: canonical };
+	} catch (error) {
+		if (error instanceof UnknownModelProfileError)
+			return {
+				ok: false,
+				reason: "unknown_model_profile",
+				mpreset: error.details.requestedProfile.slice(0, MAX_ECHOED_MPRESET_LENGTH),
+				available_profiles: error.details.availableProfiles,
+			};
+		throw error;
 	}
-	return { ok: true, mpreset: canonical };
 }

package/src/defaults/gjc/skills/deep-interview/SKILL.md

@@ -382,7 +382,7 @@ Auto-answer has a clarity cap: unless the architect confidence is `high` and unc
 
 ### Step 2b″: Refine Free-Text Answers
 
-When the user's answer is free-text that carries reasoning, constraints, or scope decisions, do not forward it to scoring as a lossy one-line label. First structure it into a compact interpretation using the canonical sections — **Decision**, **Reasoning**, **Constraints (user-stated)**, **Out of scope (user-stated)**, and **Codebase context (verified)** (omit empty sections) — then confirm with exactly one `ask` that nothing is lost or misrepresented. Apply `language.instruction` when present.
+When the user's answer is free-text that carries reasoning, constraints, or scope decisions, do not forward it to scoring as a lossy one-line label. First structure it into a compact interpretation using the canonical sections — **Decision**, **Reasoning**, **Constraints (user-stated)**, **Out of scope (user-stated)**, and **Codebase context (verified)** (omit empty sections). Then confirm with exactly one `ask` that nothing is lost or misrepresented: the `ask` question body MUST render the full structured interpretation — every non-empty canonical section, verbatim — before the confirmation prompt. The user is approving that specific interpretation, so it must be visible inside the question body; never ask "does this capture it?" / "이 해석이 맞아?" without first displaying the interpretation itself. A confirmation `ask` whose body omits the interpretation it is asking about is a hard error: re-issue it with the interpretation shown. Apply `language.instruction` when present.
 
 Offer options such as **Send as-is**, **Add a constraint**, **Mark something out of scope**, **Add context**, and **Rewrite**, plus free-text. If the user picks anything other than "Send as-is", collect the exact missing text with one follow-up `ask` (never infer it from the option label), fold it into the structured interpretation, and re-confirm. Do not advance to scoring while the user is still saying something is missing.
 
@@ -601,7 +601,7 @@ When ambiguity ≤ threshold (or hard cap / early exit):
 
 **4a. Closure / Acceptance Guard.** Even when ambiguity ≤ threshold, do not treat the math as completion. Run an independent readiness audit from the full main-session perspective (including explore findings, established facts, and triggers the scorer may not have fully weighed). Confirm every active topology component has goal/constraint/criteria coverage, no unresolved or disputed trigger remains on a path that matters, no disputed established fact lacks a `superseded_by` resolution, and no low-confidence auto-answer is standing in for user-confirmed truth above the clarity cap. If a material gap exists, explicitly override the gate to the user — "The math says ready, but I am not accepting it yet because {gap}" — and ask the single highest-impact follow-up, returning to Phase 2. Record any override in `state.closure_overrides`.
 
-**4b. Restate gate.** Once closure passes, collapse the agreed answers into ONE sentence goal that covers every active component, and confirm it with a single `ask`: "If someone read only this line, would they reach the same outcome you have in mind?" Offer **Yes, crystallize**, **Adjust wording**, and **Missing scope**, plus free-text, applying `language.instruction` when present. Because this gate has options, it MUST go through `ask`: do not print the Restate question and options as assistant prose with `Question:`/`Options:` labels. If the Restate gate was already printed that way, immediately call `ask` with the same question/options before accepting or waiting for any answer. On "Adjust wording" / "Missing scope", collect the exact correction with one follow-up `ask`, route it back through Step 2c scoring and established-facts maintenance (a correction can change ambiguity), then re-run closure and ask the Restate gate again. Cap at two loops; if alignment is not reached, return to Phase 2 with a targeted question instead of forcing a goal line. Persist the confirmed line as `state.restated_goal`.
+**4b. Restate gate.** Once closure passes, collapse the agreed answers into ONE sentence goal that covers every active component, and confirm it with a single `ask` whose body MUST begin by stating that one-sentence goal verbatim, followed by: "If someone read only this line, would they reach the same outcome you have in mind?" The goal line must be visible inside the `ask` body; never ask the confirmation without first displaying the collapsed goal it refers to. Offer **Yes, crystallize**, **Adjust wording**, and **Missing scope**, plus free-text, applying `language.instruction` when present. Because this gate has options, it MUST go through `ask`: do not print the Restate question and options as assistant prose with `Question:`/`Options:` labels. If the Restate gate was already printed that way, immediately call `ask` with the same question/options before accepting or waiting for any answer. On "Adjust wording" / "Missing scope", collect the exact correction with one follow-up `ask`, route it back through Step 2c scoring and established-facts maintenance (a correction can change ambiguity), then re-run closure and ask the Restate gate again. Cap at two loops; if alignment is not reached, return to Phase 2 with a targeted question instead of forcing a goal line. Persist the confirmed line as `state.restated_goal`.
 
 1. **Generate the specification** using opus model with the prompt-safe transcript. If the full interview transcript or initial context is too large, include the summary plus all concrete decisions, acceptance criteria, unresolved gaps, and ontology snapshots; never overflow the prompt with raw oversized context.
    - Apply `language.instruction` when present so user-facing prose in the spec preserves the session language; keep code identifiers, file paths, commands, JSON/settings keys, and quoted source text unchanged.

package/src/defaults/gjc/skills/ralplan/SKILL.md

@@ -34,6 +34,8 @@ For corrupt, tampered, unreadable, or stale current-session ralplan state, run `
 
 Ralplan is planning only. It may inspect context and draft plan/spec/proposal artifacts, but those remain `pending approval` until explicit current-turn or structured-UI execution approval. Before that approval, do not mutate product source, run mutation-oriented shell, commit, push, open PRs, invoke execution skills, or delegate implementation.
 
+Explicitly naming `ultragoal` or `team` (including `/skill:` and `gjc` forms) counts as opting into execution for that skill — do not re-ask for the same consent.
+
 Persist planning artifacts and handoffs through the ralplan CLI writer, never direct `.gjc/` edits:
 Direct `write`, `edit`, or `ast_edit` calls against `.gjc/_session-{sessionid}/specs`, `.gjc/_session-{sessionid}/plans`, `.gjc/_session-{sessionid}/state`, or any other `.gjc/` path are forbidden unless an explicit force override is active.
 
@@ -82,7 +84,7 @@ The consensus workflow:
       - For every confirmed open item, embed the resolved outcome into the final plan under an **## Intent Reconciliation** section so the `pending approval` artifact records each decision; record any item the user explicitly defers as an open confirmation under that same section.
    d. Persist the reconciliation with `gjc ralplan --write --stage post-interview --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT --json`, then return the receipt/path plus a compact status (reconciled-clean / reconciled-with-revision / open-confirmations-pending) instead of pasting the full body.
 7. On reconciliation completion, re-check the review join gate (Critic `OKAY` plus Architect `CLEAR`/`APPROVE` for the same Planner artifact/pass), mark the plan `pending approval` unless explicit execution approval has already been captured, persist the ADR/final plan via `gjc ralplan --write --stage final --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT`, and do not directly edit `.gjc/_session-{sessionid}/plans`. Final plan must include ADR (Decision, Drivers, Alternatives considered, Why chosen, Consequences, Follow-ups) and, when present, the **## Intent Reconciliation** section.
-8. **Always** present the finalized plan via the `ask` tool (regardless of `--interactive`) with `workflowGate: { stage: "ralplan", kind: "approval" }` on the final question so RPC/headless clients receive a `ralplan`/`approval` workflow gate, not a deep-interview question gate. Use these options:
+8. **Final approval gate (with explicit-execution exception):** If the user already explicitly named an execution skill in the current turn or via the structured approval UI (`ultragoal`, `/skill:ultragoal`, `gjc ultragoal`, `team`, `/skill:team`, `gjc team`, or "Approve execution via ultragoal/team"), that is execution approval — skip the re-ask and proceed to step 9 with that skill. Otherwise, **always** present the finalized plan via the `ask` tool (regardless of `--interactive`) with `workflowGate: { stage: "ralplan", kind: "approval" }` on the final question so RPC/headless clients receive a `ralplan`/`approval` workflow gate, not a deep-interview question gate. Use these options:
    - **Refine further** — re-run the consensus loop / request changes, then return here
    - **Approve execution via ultragoal (Recommended)** — goal-tracked autonomous execution
    - **Approve execution via team** — only when tmux-based interactive worker parallelization is required

package/src/defaults/gjc/skills/ultragoal/SKILL.md

@@ -123,10 +123,12 @@ An active Ultragoal run must not give up on a blocker by pausing the goal and as
 - **`resolvable`** — anything the agent can act on: failing tests, missing implementation, a dependency to install, an ambiguous-but-inferable detail, investigation. **Never pause.** Exhaust autonomous resolution first: investigate, `gjc ultragoal steer --kind add_subgoal --title "Investigate blocker" --objective "..." --evidence "..." --rationale "..."`, delegate an `executor`, or preserve the blocker durably with `gjc ultragoal checkpoint --status blocked` / `gjc ultragoal record-review-blockers` and keep scheduling the next goal.
 - **`human_blocked`** — only the user can act: credentials/secrets, a manual or physical step, an external approval/decision, access the agent lacks. Pause is the last resort and is gated.
 
-`goal({"op":"pause"})` is **blocked at runtime** while an Ultragoal run is active unless the latest durable ledger event classifies the current blocker as `human_blocked`. To pause, record the classification immediately before pausing and cite the human-only dependency as evidence:
+`goal({"op":"pause"})` is **blocked at runtime** while an Ultragoal run is active unless the latest `blocker_classified` ledger event is `human_blocked` and a later bound clean pause terminal critic verdict is recorded for it (see [Terminal critic gate](#terminal-critic-gate)). `assertUltragoalPauseAllowed` first consumes a pre-existing give-up nudge (a durable ledger write) before it runs the read-only pause diagnostic; only `isUltragoalPauseBlocked` is a pure reader. To pause, first record the human-only classification and capture its event id, then record the terminal critic's clean bound pause verdict, and only then pause:
 
 ```sh
 gjc ultragoal classify-blocker --classification human_blocked --evidence "<the specific human-only dependency>" [--goal-id <id>]
+gjc ultragoal record-critic-verdict --terminus pause --classification-event-id <eventId> --verdict OKAY --evidence "<terminal critic evidence>"
+goal({"op":"pause"})
 ```
 
 Recording `--classification resolvable` is an audit note only; it never authorizes a pause. The `ask` tool stays blocked during active runs regardless of classification — record unresolved decisions as durable blockers instead of prompting.
@@ -343,6 +345,44 @@ Provide one `artifactRefs` entry per live surface actually exercised, using the
 
 For CLI replay artifacts, the JSON at `path` must be an object like `{"schemaVersion":1,"kind":"cli-replay","replaySafe":true,"command":["bun","-e","console.log(\"ultragoal-cli-ok\")"],"cwd":".","env":{"LC_ALL":"C"},"timeoutMs":30000,"expectedExitCode":0,"recordedStdout":"ultragoal-cli-ok\n","recordedStderr":"","invariants":[{"type":"substring","value":"ultragoal-cli-ok"},{"type":"not-substring","value":"error"}]}`. Accepted replay fields are `command` (string array), optional `cwd`, safe `env`, `timeoutMs`, `expectedExitCode`, `recordedStdout`, `recordedStderr`, `normalization`, and `invariants`. The conservative command allowlist is intentionally small: `bun --version`, `node --version`, deterministic `bun/node -e "console.log(...)"`, `npm|pnpm|yarn --version`, `npm|pnpm|yarn list`, read-only `git status|rev-parse|merge-base|diff|show|log` with safe args, and `gjc read|status`. `env` must contain only safe deterministic variables, never credentials or machine/user-specific secrets. `normalization` is optional and, when provided, must be exactly the string `"default"` (the built-in normalizer already strips ANSI codes, normalizes line endings, scrubs paths, and trims trailing whitespace); object-shaped normalization is rejected. Invariants may be substring, regex, or not-substring checks; when present, they replace exact `recordedStdout` equality — without `invariants`, replayed normalized stdout must match `recordedStdout` exactly. Unsafe, non-deterministic, credentialed, interactive, or otherwise unallowlisted commands require audited `replayExempt` metadata with exact fields `reasonCode`, `reason`, `approvedBy`, and `fallbackArtifactRefs` plus a structurally valid same-surface fallback artifact. `reason` must be substantive and audited, and `approvedBy` must identify the verifier. Allowed `reasonCode` values are exactly `unsafe_side_effect`, `requires_credentials`, `requires_network`, `non_deterministic_external`, `destructive`, `interactive_only`, and `platform_unavailable`.
 
+## Terminal critic gate
+
+The terminal critic gate is a fail-closed, once-per-run-terminus review. It guards both terminal exits with a read-only `critic` role agent's `OKAY` verdict; it does not run per story. It is additive to, and does not change, the existing per-story `architect` review and `executor` QA/red-team lanes.
+
+### Completion terminus
+
+Before assembling the final-aggregate `--quality-gate-json`, the leader delegates the terminal critic. Only the final-aggregate completion checkpoint requires the additional top-level `criticReview` key; `criticReview` is tolerated but ignored on non-final checkpoints. A clean final aggregate requires `verdict: "OKAY"`, non-empty `evidence`, and an empty `blockers` array:
+
+```json
+{
+  "criticReview": {
+    "verdict": "OKAY",
+    "evidence": "terminal critic review of the final required-goal state",
+    "blockers": []
+  }
+}
+```
+
+### Pause/blocked terminus
+
+At a `human_blocked` terminus, the leader first runs `gjc ultragoal classify-blocker --classification human_blocked` (capturing that classification's ledger `eventId`), then delegates the terminal critic and records its verdict with `gjc ultragoal record-critic-verdict --terminus pause --classification-event-id <eventId>` before calling `goal({"op":"pause"})`. The pause is allowed only when a later fresh `critic_verdict` ledger receipt exists with `terminus: "pause"`, `verdict: "OKAY"`, non-empty evidence, an empty blockers array, the current `planGeneration`, and a `classificationEventId` bound to the latest `blocker_classified` event, which must be `human_blocked`. Freshness is scoped to the final required-goal state, so required-goal or steer changes stale the receipt, and a newer classification supersedes an older verdict.
+
+The critic must verify that the `human_blocked` classification is genuine, including catching false pauses where needed resources exist locally or the asserted blocker is resolvable. A `REJECT` (or `ITERATE`) verdict refuses the terminal pause; the run keeps executing. The pause (`goal({"op":"pause"})`) is the gated terminal park-and-wait exit — a per-goal `gjc ultragoal checkpoint --status blocked` remains available as non-terminal blocker bookkeeping that never signals run completion and keeps the blocker outstanding until resolved.
+
+### Invocation and containment
+
+At each terminus, the leader gives the read-only `critic` role agent `brief.md`, `goals.json`, `ledger.jsonl`, and the cumulative change set. For completion, invoke it before assembling the final-aggregate gate JSON. For pause, invoke it after the `human_blocked` classification and before `goal({"op":"pause"})`. The terminal critic must not spawn nested `ralplan`, `team`, `deep-interview`, or `ultragoal` workflows. This creates no interactive surface: `ask` remains blocked while an Ultragoal run is active.
+
+### Non-OKAY loop and ceiling
+
+For completion-side `ITERATE` or `REJECT`, the leader MUST first record the terminal verdict so the run-level counter observes it: `gjc ultragoal record-critic-verdict --terminus completion --verdict <ITERATE|REJECT> --evidence "<critic findings>"`; then record the findings with `gjc ultragoal record-review-blockers` and reopen the run. The dedicated counter ceiling is 5, independently of the give-up nudge budget, and is **RUN-LEVEL**: it counts every non-OKAY terminal-critic verdict across the whole run and all reopen cycles. On reaching that ceiling, both pause and final completion are blocked until a human or leader records `gjc ultragoal record-critic-gate-override --evidence "<authorization evidence>"`. There is no automatic pause override.
+
+This gate is always fail-closed and has no grandfathering: in-flight runs must obtain a terminal verdict when they reach a terminus.
+
+#### Deferred / out of scope
+
+Gating active-aggregate `goal drop` after nudge exhaustion is a known follow-up not covered by this gate; `drop` remains governed by the existing nudge discipline.
+
 ## Review mode
 
 `gjc ultragoal review` runs the same hardened gate against an already implemented PR, branch, or worktree. Use `--pr <number>` for a PR, `--branch <ref>` for a branch diff, omit both for the current worktree, and pass `--spec <path>` when a real contract exists. `--mode review-only` emits the verdict/findings without creating fix work; `--mode review-start` records review blockers for follow-up. Review mode validates the same `executorQa` shape and live-surface artifacts as `checkpoint --status complete`. A thin or derived-only contract can never clean-pass: the verdict is capped at `inconclusive: weak-contract` until a supplied spec or equivalent strong acceptance criteria are available.
@@ -372,4 +412,5 @@ The skill tool then dispatches `/skill:ralplan` or `/skill:deep-interview` same-
 - Never call `goal({"op":"complete"})` unless the aggregate run or legacy per-story goal is actually complete.
 - In aggregate mode, intermediate and final story checkpoints update durable `goals.json` state and append receipt proof to `ledger.jsonl`; the final story checkpoint creates the final aggregate receipt before the agent may call `goal({"op":"complete"})`.
 - Completion checkpoints require `--quality-gate-json` only. Shell commands and hooks must not mutate goal state; the agent reconciles inline goal-tool state after durable completion.
+- Final-aggregate completion additionally requires a `criticReview` `OKAY`; a `human_blocked` pause additionally requires a fresh `OKAY` `critic_verdict` receipt.
 - Treat `ledger.jsonl` as the durable audit trail; checkpoint after every success or failure.