@gajae-code/coding-agent 0.11.7 → 0.11.8

package/CHANGELOG.md

@@ -2,22 +2,67 @@
 
 ## [Unreleased]
 
+## [0.11.8] - 2026-07-23
+### Added
+
+- Keybinding configuration now keeps portable canonical text while runtime shortcut labels render platform-native, including concise MacBook glyphs in inline surfaces and glyph-plus-text accessibility labels in `/hotkeys` and `/help`; `/hotkeys` remains authoritative for effective remapped bindings.
+
+### Added
+
+- Plans and delegated tasks carry an authoritative repository binding (`gjc.repository_binding.v1`). Ultragoal/ralplan stamp identity at creation; task lanes stamp omitted bindings from session cwd **before** agent discovery; ralplan stage writes and handoff re-entry enforce the seed binding; declared paths must stay under the bound root; task receipts include the resolved identity; linked isolation worktrees must match the source repository (#2901).
+
+### Fixed
+
+- Runtime MCP OAuth credentials are now bound to their authorized server origin and token endpoint, reject redirecting refresh responses, and fail closed when legacy or changed configuration lacks an exact match.
+- `/share` now keeps full-session HTML in owner-private unpredictable staging until the share handler or `gh gist create` process has fully stopped; cancelling a blocked gist upload terminates and awaits that process before reporting cancellation and removing the export.
+- Telegram notification daemon self-heals degraded on-disk state: permanently missing scan roots are pruned (so one deleted worktree no longer disables orphan-topic cleanup), and retained exact-unlink transition/placeholder artifacts are reaped on ownership acquire and each scan. `gjc daemon reload` can recover without manual filesystem surgery (#2956).
+- On macOS, resuming a managed session no longer fails with `identity_mismatch` when the first write-append open changes only file `ctime` (e.g. APFS write-provenance / `com.apple.provenance`). `appendSync` allows a single bounded re-capture + retry when `dev`/`ino`/`size`/`mtime`/SHA-256 remain unchanged, and still rejects real content races and repeated ctime transitions (#2944).
+- Interactive `/resume` / `AgentSession.switchSession()` now awaits verified managed `local://` legacy-root migration for the newly selected session before post-commit lifecycle proceeds, matching cold-start `createAgentSession()` readiness from #2797 so synchronous `local://` resolution no longer fails with "legacy migration must complete before path resolution" after a mid-session switch (#2925).
+- Concurrent edits to the same file path are serialized through a path-scoped mutation lock (in-process always; durable cross-process lock on the real filesystem). Disjoint concurrent `applyPatch` / replace mutations no longer silently overwrite each other, and a commit-time content check rejects writers that observe a mid-flight change (#2900).
+- Concurrent edits to the same file path are serialized through a path-scoped mutation lock (in-process always; durable cross-process lock on the real filesystem). Disjoint concurrent `applyPatch` / replace mutations no longer silently overwrite each other, and a commit-time content check rejects writers that observe a mid-flight change. The production `executePatchSingle` / `LspFileSystem` path explicitly enables the durable lock rather than inferring it from FileSystem object identity (#2900).
+- Lean notification verbosity no longer floods remote clients with intermediate tool-turn `turn_stream` frames. Under `/lean`, the latest assistant answer is deferred until `agent_end` (idle); ask lead-ins still flush immediately before inline buttons, and `/verbose` keeps per-turn streaming (including opt-in live frames) (#2863).
+- Ultragoal `complete-goals` no longer reports contradictory next actions when every incomplete story is `blocked` or `review_blocked`. Text and JSON now agree on `next-action=resolve-blockers` with blocked goal IDs/status; failed-only schedules surface `retry-failed`; `execute-goal` always includes a `goal_id` (#2903).
+- Bound each Python tool bridge bearer capability to one active session registration, reject non-canonical or empty bearer credentials before lookup, and rotate authority whenever a retained session replaces its kernel.
+- Deep Interview now scopes provider-facing `ask` metadata to the persisted workflow stage, including after durable session resume: Round 0 advertises only the locked `intent_contract` branch, later rounds advertise ordinary and `intent_review` branches, foreign workflow gates cannot seed recorder state, and wire-valid empty positive-round reviews reach canonical Zod diagnostics while malformed authority remains fail-closed.
+- Bounded docs.rs rustdoc downloads, legacy cache reads, and gzip expansion before parsing or caching; transport-level content encoding is disabled and rejected so Bun cannot decompress outside the explicit output guard.
+
+### Added
+
+- Added SDK v3 prompt reconciliation through `turn.prompt_status` with caller-supplied `clientRef` correlation, bounded live-session lifecycle retention, reconnect-safe lookup, and explicit ordered non-replay semantics for `turn.prompt` (#2930).
+- Added `models.profiles.list` discovery of the effective built-in plus `models.yml` profile catalog, exact-ID pre-spawn validation that reloads host configuration for each lifecycle request, and structured `unknown_model_profile` / `model_profile_registry_error` details across lifecycle startup failures (#2931).
+
 ## [0.11.7] - 2026-07-22
 ### Added
 
 - `/btw` now opens an ephemeral multi-turn side chat: plain text continues the side thread until Esc returns to the main chat, while visible text-only context stays outside the main transcript and session observability/debug hooks and is scrubbed synchronously on close or abort.
 - Added `statusLine.showActionHints` (default: `true`) to hide contextual action hints while retaining configured status-line segments.
 - `skill_discovery` empty results now carry a `notice` when discovery config caused the emptiness — naming the exact disabled setting (`skills.enabled`, `skills.enablePiProject`, or `skills.enablePiUser`) and the `gjc config set` command to enable it. Previously a disabled config was indistinguishable from "no skills exist", silently hiding freshly written user/project skills.
+- `generate_image` now supports Alibaba Bailian (Token Plan) `wan2.7-image` as an image provider: set `providers.image` to `alibaba` (or let auto-detect find `ALIBABA_TOKEN_PLAN_API_KEY` / a registered `alibaba-token-plan` key), override the model with `providers.imageModel` (e.g. `wan2.7-image-pro`). Short-lived OSS result URLs are downloaded immediately, and image editing works via input images.
 
 ### Fixed
+- Telegram `/session_recent` now retries one concurrently appended managed transcript and omits only candidates that remain unstable, preserving independently verified recent-session rows.
+- Repeated byte-identical stale SDK broker locks no longer cause startup to loop when a prior tombstone exists.
+- ACP session close now rotates idempotency keys for resumed attachment generations while retaining the same key across terminally uncertain close retries.
+- ConversationStore now tolerates only unsupported Windows parent-directory durability errors after preserving temporary-file fsync and atomic rename.
+- Ralplan no longer re-asks for execution approval when the user already explicitly named `ultragoal` or `team` in the current turn; that naming is the consent.
 
+- Cron guidance now routes silent recurring polling and event-driven PR/CI watchers to `monitor`, because every cron firing starts a normal assistant turn and prompt wording cannot reliably suppress its response.
 - Ordinary `ask` calls now normalize a provider-emitted `deepInterview: null` placeholder instead of misclassifying it as malformed Round-0 intent recovery data and rejecting it before coercion.
+- SDK event replay authorization now refreshes the negotiated capability cache synchronously from the native-sanitized replay snapshot before host filtering, preserving initial and repeated-hello capability updates without trusting client frame claims.
+
+- Plugin-bundle HTTP and SSE MCP requests now bind every connection to a validated public address and revalidate bounded redirects before following them.
+- Deep Interview now exposes stage-specific provider-facing `ask` metadata: Round 0 advertises only the locked `intent_contract` branch, while later rounds advertise ordinary and `intent_review` branches, preventing strict-schema constraint stripping from making an invalid empty Round 0 review selectable.
+- Deep Interview now exposes stage-specific provider-facing `ask` metadata, including after durable session resume: Round 0 advertises only the locked `intent_contract` branch, while later rounds advertise ordinary and `intent_review` branches. Remaining strict-schema constraints that providers cannot express fail closed with bounded corrective guidance instead of an opaque retry loop.
+- Deep Interview now exposes stage-specific provider-facing `ask` metadata, including after durable session resume: Round 0 advertises only the locked `intent_contract` branch, while later rounds advertise ordinary and `intent_review` branches. Foreign workflow gates can no longer seed Deep Interview recorder state, and remaining strict-schema constraints that providers cannot express fail closed with bounded corrective guidance instead of an opaque retry loop.
 - Documented that custom OpenAI-compatible models omit vision by default: when `input` is unset, GJC treats the model as text-only and strips images with `[image omitted: model does not support vision]`. Vision backends must set `input: [text, image]` in `models.yml`.
 - Restored `/models` preset landing navigation after the Image Generation row and made compaction/pruning regression fixtures use an explicit 200K context boundary instead of a mutable provider descriptor default.
 - Fixed Windows legacy session artifact migration by using native directory identity size, a traversable detached-path alias, and writable file handles for final durability sync.
 - `gjc setup credentials` now auto-imports only OAuth credentials with a finite expiry strictly in the future. Expired or malformed-expiry discoveries remain visible as non-importable records, and existing imported credentials remain recoverable through `/login`.
 - Resumed managed sessions now complete the verified legacy `local://` artifact migration before synchronous path resolution, preserving legacy scratch files instead of failing startup with a migration-order error.
 - Corrected Telegram's uncertain lifecycle guidance so create, close, and resume commands describe their own possible outcome; close and resume no longer display the create-only duplicate-start warning.
+- Telegram ask notifications now preserve the authoritative recommended choice from native asks and workflow gates, marking that option as `(Recommended)` in the message body without changing button indices or submitted answers.
+- Telegram `/session_close` now fails closed when tmux disappearance cannot be confirmed, and publishes the managed owner verdict before locked terminal-state preservation so normal close finalization is not delayed behind that state path.
+- Managed publication now fails closed on malformed, committed, or mutation-unknown native outcomes: it never retries or cleans a destination, and preserves bounded atomic-unavailable/durability diagnostics through managed startup (#2804).
 
 ## [0.11.5] - 2026-07-20
 ### Fixed
@@ -38,12 +83,14 @@
 - Shell environment snapshots now use one process-private temporary root with exclusive private files, trusted cache validation, and whole-root shutdown cleanup instead of a predictable shared directory.
 - Python kernel startup now materializes its bundled runner in one process-private temporary directory with exclusive file creation instead of consulting a predictable shared cache path.
 - SSH command construction and discovery now reject malformed destinations with unsafe prefixes or control characters while preserving normal host, address, username, and alias forms.
+- Bounded MCP resource URI and template matching now skips oversized templates and uses deterministic literal-segment matching instead of dynamically constructed regular expressions.
 - Fixed the `subagent` tool's `resume` action silently swallowing manager failures. Resume outcomes other than `context_unavailable`/`not_found` (`no_runner`, `resume_failed`, `owner_shutdown_in_progress`, …) were dropped and the stale terminal subagent snapshot was returned as if the resume had succeeded, so ralplan's re-review loop believed the persisted Planner had resumed when it had not and never fell back correctly. The resume action now surfaces every non-ok reason (matching the `steer` branch), and the task resume runner marks a resumed subprocess that aborted or exited non-zero as a `failed` job (carrying its rendered failure summary) instead of reporting it `completed`.
 - Daemon timeout flags now reject missing, malformed, non-positive, fractional, whitespace-containing, and unsafe integer values before daemon command side effects instead of partially parsing them.
 - Hardened standalone HTML session exports so session identifiers, provider/model labels, and embedded raster images remain confined to their intended HTML contexts; malformed image payloads are omitted.
 - Restored legacy `gjc coordinator-mcp` and root `gjc --team --team-size <n>` routing to their native MCP and team commands, with strict team-size validation that prevents malformed legacy flags from selecting team lifecycle actions.
 - Fixed the `subagent` tool's `resume` action silently swallowing manager failures. Resume outcomes other than `context_unavailable`/`not_found` (`no_runner`, `resume_failed`, `owner_shutdown_in_progress`, …) were dropped and the stale terminal subagent snapshot was returned as if the resume had succeeded, so ralplan's re-review loop believed the persisted Planner had resumed when it had not and never fell back correctly. The resume action now surfaces every non-ok reason (matching the `steer` branch), and the task resume runner marks a resumed subprocess that aborted or exited non-zero as a `failed` job (preserving its error text) instead of reporting it `completed`.
 - OpenRouter image generation now retrieves provider-returned HTTP(S) images only through connection-bound public-address validation, revalidates bounded redirects, and enforces image content-type and byte limits before buffering.
+- Fixed session resume crashing with `TypeError: undefined is not an object (evaluating 'usage.input')`, and hardened both usage-aggregation paths against silent total corruption, when a persisted transcript contained a parseable-but-malformed assistant or `task` tool-result entry — as produced by torn concurrent multi-writer / NFS appends. `parseSessionEntries` accepts any parseable JSON, so a corrupt `usage` could be absent, `{}` (NaN totals), numeric strings (`"0" + "10"` → `"010"`), negative (silently reducing totals), a present-but-null/incomplete `premiumRequests`/`cost`, a non-record `cost` (e.g. an array), or cumulatively overflow to `Infinity`. Both the resume (`#buildIndex`) and runtime append (`#appendEntry`) paths now route through one shared validator that requires every usage bucket and `cost.total` to be finite non-negative numbers (defaulting only truly-absent `premiumRequests`/`cost`, and rejecting present-but-null/incomplete fields rather than zeroing them) and rejects any record that would overflow cumulative totals, skipping and reporting the malformed record instead of poisoning every `getUsageStatistics()` consumer.
 - Fixed the `subagent` tool's `resume` failing immediately for a persisted ralplan Planner. A subagent that finishes by calling `yield` (or is torn down right after a tool executes) left the saved session ending on an assistant `toolCall` with no matching `toolResult`; replaying that history on resume produced an invalid provider request (a `tool_use` not followed by a `tool_result`) that failed the resumed turn at once. Resumed transcripts now reconcile any trailing unpaired tool call with a synthesized placeholder result before the first resumed prompt. Additionally, a failed/no-op resume leg no longer overwrites the prior run's success output artifact with an empty file.
 - Fixed persisted subagent resumes being rejected before session reconstruction with `Session is inside managed storage but is not an authorized managed candidate`. Child session files intentionally live inside their parent session's artifact directory and are not top-level resume-picker candidates; the task resume path now explicitly opens the exact internally registered child session directory while retaining strict candidate validation for user-selected managed sessions.
 - Managed session resume scans now read only a bounded no-follow header prefix from foreign workspace transcripts, while fully recapturing and revalidating owned candidates before granting migration, receipt, or deletion authority.
@@ -87,6 +134,10 @@
 ### Changed
 - The `read` tool is now receipt-by-default: bare and unparseable reads return a bounded receipt (≤50 lines / 10 KiB) with a re-read-with-selector footer only when truncated, `:raw` stays pure verbatim up to a max(2 MiB, spill threshold) ceiling, structural summaries cap unit-granularly at 20 KiB while preserving elision and source-recovery footers, and directories are byte/line capped and never spill. Only an explicit full-content selector (`:raw` or an explicit range) with real content is spill-eligible. Subagent previews now enforce a real byte/code-point cap via per-shape render budgets plus a shape-aware artifact-eligibility tag enforced centrally in output-meta.
 
+
+### Fixed
+- Ultragoal objective ownership no longer treats arbitrary strings that merely mention `goals.json`/`ledger.jsonl` as Ultragoal-owned; only the exact default aggregate objective qualifies for the known-objective path.
+
 ### Fixed
 - Workflow-state handoff no longer self-locks the active-state cache, so a same-turn skill handoff (e.g. ultragoal → ralplan) completes instead of stalling behind a lock the handoff itself still holds (#2638).
 - SDK host shutdown now retries a failed broker unregister instead of short-circuiting with a stale broker-index entry, while retained startup-cleanup owner-release failures remain isolated from the red extension-error path (#2625).
@@ -120,6 +171,7 @@
 ### Fixed
 - Repository LSP configuration can no longer define process-affecting server behavior: project files may control declarative matching, activation, and capabilities, but cannot set launch fields, initialization options, or opaque server settings. Trusted canonical user configuration outside the project retains those overrides; project-controlled plugin roots and the quarantined `--plugin-dir` surface cannot inject them. Automatic discovery uses trusted external executables and rejects repository-owned lexical paths as well as symlink-resolved project binaries; status uses the session cwd as its lspmux trust root. `GJC_DISABLE_LSPMUX=1` is the canonical opt-out and `PI_DISABLE_LSPMUX=1` is a supported compatibility alias; either truthy value disables lspmux probing and wrapping.
 - Palette slash commands now run only from an empty composer; drafts are never touched.
+- Individual default and named-role model assignments now keep the model selector open for consecutive choices, while batch assignments retain their existing close-on-success behavior.
 - Aborting a session without an enabled active goal no longer suppresses the first reminder when a goal is activated later; active-goal abort suppression is one-shot, goal-owned, and clears across inactive or replacement-goal transitions (#2436).
 - Palette slash submissions no longer clear or rewrite composer text, cursor state, history, or pending images created while an asynchronous input hook is awaiting; canonical keyboard submission cleanup remains unchanged (#2441).
 - Dead browser-tab recovery now expires descriptors without releasing replacement, revived, or differently owned tabs, while exactly-once teardown closes stale targets and releases browser holds without refcount underflow (#2437).
@@ -145,6 +197,9 @@
 ### Fixed
 - Connected MCP server instructions now remain untrusted user-role data instead of entering the cached system prompt; hostile file paths, working directories, and workspace-tree metadata are structurally encoded, and volatile project context is removed from durable session history between requests.
 - Restored the strict G002 public-surface quarantine by removing the default README advertisement for the private coordinator MCP runtime.
+### Added
+
+- Added opt-in prompt suggestions (Claude Code-style ghost-text autocomplete): with the `promptSuggestions` setting enabled, a smol-model prediction of your likely next prompt renders as dim ghost text in the empty composer after each agent turn; Tab accepts it, typing dismisses it, and a new turn clears it. Predictions are heuristically gated (silence on evaluative/meta/agent-voice/overlong output) and never generated while the composer has text or a turn is streaming.
 
 ## [0.11.1] - 2026-07-16
 

package/dist/types/cli/args.d.ts

@@ -52,5 +52,3 @@ export interface Args {
     authBootstrap?: true;
 }
 export declare function parseArgs(args: string[]): Args;
-export declare function getExtraHelpText(): string;
-export declare function printHelp(): void;

package/dist/types/config/keybindings.d.ts

@@ -378,6 +378,10 @@ declare function migrateKeybindingsConfigFile(agentDir: string): void;
 export declare class KeybindingsManager extends TuiKeybindingsManager {
     #private;
     constructor(userBindings?: KeybindingsConfig, configPath?: string);
+    /**
+     * Replace user bindings only after canonical grammar validation.
+     */
+    setUserBindings(userBindings: KeybindingsConfig): void;
     /**
      * Create from config file at agentDir/keybindings.json.
      */
@@ -386,6 +390,11 @@ export declare class KeybindingsManager extends TuiKeybindingsManager {
      * Create an in-memory keybindings manager without file persistence.
      */
     static inMemory(userBindings?: KeybindingsConfig): KeybindingsManager;
+    /**
+     * Set the default display context used by composed surfaces that do not
+     * supply an explicit context.
+     */
+    setDisplayContext(context: KeyDisplayContext): void;
     /**
      * Reload keybindings from the config file.
      */
@@ -397,9 +406,30 @@ export declare class KeybindingsManager extends TuiKeybindingsManager {
     /**
      * Get display string for a keybinding (e.g., "ctrl+c/escape").
      */
-    getDisplayString(keybinding: Keybinding): string;
+    getDisplayString(keybinding: Keybinding, context?: KeyDisplayContext): string;
+    /**
+     * Get an accessibility-oriented display string for help surfaces.
+     * Darwin chords include both the concise glyphs and expanded key names.
+     */
+    getAccessibleDisplayString(keybinding: Keybinding, context?: KeyDisplayContext): string;
+    /**
+     * Format a fixed key chord using this manager's display context.
+     */
+    formatKeyHint(key: string): string;
+    /**
+     * Format a fixed key chord for accessibility-oriented help surfaces.
+     */
+    formatAccessibleKeyHint(key: string): string;
+}
+/**
+ * Key hint formatting utilities for UI labels.
+ */
+export interface KeyDisplayContext {
+    platform: NodeJS.Platform;
 }
-export declare function formatKeyHint(key: KeyId): string;
-export declare function formatKeyHints(keys: KeyId | KeyId[]): string;
+export declare function formatKeyHint(key: string, context?: KeyDisplayContext): string;
+export declare function formatAccessibleKeyHint(key: string, context?: KeyDisplayContext): string;
+export declare function formatKeyHints(keys: string | readonly string[], context?: KeyDisplayContext): string;
+export declare function formatAccessibleKeyHints(keys: string | readonly string[], context?: KeyDisplayContext): string;
 export type { Keybinding, KeybindingsConfig, KeyId };
 export { migrateKeybindingsConfigFile };

package/dist/types/config/model-profile-activation.d.ts

@@ -1,6 +1,7 @@
 import { ThinkingLevel } from "@gajae-code/agent-core";
 import type { Api, Model } from "@gajae-code/ai";
 import type { AgentSession } from "../session/agent-session";
+export { resolveModelProfileName } from "./model-profile-contract";
 import { type GjcModelAssignmentTargetId, type ModelRegistry } from "./model-registry";
 import { type ModelSelectorValue } from "./model-selector-value";
 import type { Settings } from "./settings";
@@ -17,7 +18,9 @@ type ModelProfileActivationSession = Pick<AgentSession, "model" | "thinkingLevel
 };
 export interface PrepareModelProfileActivationOptions {
     session: ModelProfileActivationSession;
-    modelRegistry: Pick<ModelRegistry, "getModelProfile" | "getModelProfiles" | "getAvailableModelProfileNames" | "getApiKeyForProvider" | "getAll" | "resolveCanonicalModel" | "getCanonicalVariants" | "getCanonicalId">;
+    modelRegistry: Pick<ModelRegistry, "getModelProfile" | "getModelProfiles" | "getAvailableModelProfileNames" | "getApiKeyForProvider" | "getAll" | "resolveCanonicalModel" | "getCanonicalVariants" | "getCanonicalId"> & {
+        getError?: ModelRegistry["getError"];
+    };
     settings: Pick<Settings, "get">;
     profileName: string;
 }
@@ -78,7 +81,6 @@ export declare class ModelProfileCredentialError extends Error {
     constructor(profileLabel: string, providers: readonly string[]);
 }
 export declare function formatModelProfileCredentialError(profileLabel: string, providers: readonly string[]): string;
-export declare function resolveModelProfileName(profileName: string, profiles: ReadonlyMap<string, unknown>): string;
 export declare function prepareModelProfileActivation(options: PrepareModelProfileActivationOptions): Promise<PreparedModelProfileActivation>;
 export declare function applyPreparedModelProfileActivation(prepared: PreparedModelProfileActivation, options?: ApplyModelProfileActivationOptions): Promise<void>;
 export interface MaterializeModelProfileForDeletionResult {
@@ -99,4 +101,3 @@ export declare function restoreMaterializedModelProfileForDeletion(options: {
     snapshot: MaterializeModelProfileForDeletionResult;
 }): Promise<void>;
 export declare function activateModelProfile(options: PrepareModelProfileActivationOptions, applyOptions?: ApplyModelProfileActivationOptions): Promise<void>;
-export {};

package/dist/types/config/model-profile-contract.d.ts

@@ -0,0 +1,38 @@
+import { type ModelProfileDefinition } from "./model-profiles";
+export declare const MODEL_PROFILE_DISCOVERY_QUERY = "models.profiles.list";
+export declare const MODEL_PROFILE_ERROR_DETAIL_MAX_BYTES = 2048;
+export interface ModelProfileCatalogItem {
+    id: string;
+    displayName: string;
+    source: "builtin" | "configured";
+}
+export interface UnknownModelProfileDetails {
+    requestedProfile: string;
+    availableProfiles: string[];
+    discoveryQuery: typeof MODEL_PROFILE_DISCOVERY_QUERY;
+}
+export interface ModelProfileRegistryErrorDetails {
+    requestedProfile?: string;
+    availableProfiles: [];
+    discoveryQuery: typeof MODEL_PROFILE_DISCOVERY_QUERY;
+}
+export type ModelProfileErrorDetails = UnknownModelProfileDetails | ModelProfileRegistryErrorDetails;
+export type ModelProfileErrorCode = "unknown_model_profile" | "model_profile_registry_error";
+export declare class UnknownModelProfileError extends Error {
+    readonly code: "unknown_model_profile";
+    readonly details: UnknownModelProfileDetails;
+    constructor(requestedProfile: string, profiles: ReadonlyMap<string, unknown>);
+}
+export declare class ModelProfileRegistryError extends Error {
+    readonly code: "model_profile_registry_error";
+    readonly details: ModelProfileRegistryErrorDetails;
+    constructor(requestedProfile?: string);
+}
+export declare function resolveModelProfileName(profileName: string, profiles: ReadonlyMap<string, unknown>): string;
+export declare function validateModelProfileName(profileName: string, profiles: ReadonlyMap<string, unknown>, registryError?: unknown): string;
+export declare function projectModelProfileCatalog(profiles: ReadonlyMap<string, ModelProfileDefinition>, registryError?: unknown): ModelProfileCatalogItem[];
+export declare function isModelProfileError(value: unknown): value is {
+    code: ModelProfileErrorCode;
+    message: string;
+    details: ModelProfileErrorDetails;
+};

package/dist/types/config/settings-schema.d.ts

@@ -1561,6 +1561,15 @@ export declare const SETTINGS_SCHEMA: {
             readonly description: "Suggest emojis from `:name:` shortcodes and expand text emoticons like `:D` or `:-)`";
         };
     };
+    readonly promptSuggestions: {
+        readonly type: "boolean";
+        readonly default: false;
+        readonly ui: {
+            readonly tab: "interaction";
+            readonly label: "Prompt Suggestions";
+            readonly description: "Predict your likely next prompt after each turn (smol-model call) and show it as ghost text; Tab accepts";
+        };
+    };
     readonly "startup.quiet": {
         readonly type: "boolean";
         readonly default: false;
@@ -3786,7 +3795,7 @@ export declare const SETTINGS_SCHEMA: {
     };
     readonly "providers.image": {
         readonly type: "enum";
-        readonly values: readonly ["auto", "openai", "gemini", "openrouter", "antigravity", "custom"];
+        readonly values: readonly ["auto", "openai", "gemini", "openrouter", "antigravity", "alibaba", "custom"];
         readonly default: "auto";
         readonly ui: {
             readonly tab: "providers";
@@ -3795,7 +3804,7 @@ export declare const SETTINGS_SCHEMA: {
             readonly options: readonly [{
                 readonly value: "auto";
                 readonly label: "Auto";
-                readonly description: "Priority: GPT model image tool > Antigravity > OpenRouter > Gemini";
+                readonly description: "Priority: GPT model image tool > Antigravity > OpenRouter > Gemini > Alibaba";
             }, {
                 readonly value: "openai";
                 readonly label: "OpenAI";
@@ -3812,6 +3821,10 @@ export declare const SETTINGS_SCHEMA: {
                 readonly value: "antigravity";
                 readonly label: "Antigravity";
                 readonly description: "Requires login with google-antigravity";
+            }, {
+                readonly value: "alibaba";
+                readonly label: "Alibaba Bailian";
+                readonly description: "Requires ALIBABA_TOKEN_PLAN_API_KEY (wan2.7-image via Token Plan)";
             }, {
                 readonly value: "custom";
                 readonly label: "Custom";

package/dist/types/edit/modes/patch.d.ts

@@ -41,11 +41,24 @@ export interface ApplyPatchOptions {
     fuzzyThreshold?: number;
     allowFuzzy?: boolean;
     fs?: FileSystem;
+    /**
+     * When false, skip durable cross-process file locks (in-process path mutex
+     * still serializes). Defaults to true only for the real `defaultFileSystem`
+     * (or when `fs` is omitted). Disk-backed adapters that are not
+     * `defaultFileSystem` (notably production `LspFileSystem` via
+     * `executePatchSingle`) MUST pass `crossProcessLock: true` explicitly —
+     * object identity is not a durable-lock capability probe.
+     */
+    crossProcessLock?: boolean;
 }
 /** Default filesystem implementation using Bun APIs */
 export declare const defaultFileSystem: FileSystem;
 /**
  * Apply a patch operation to the filesystem.
+ *
+ * Concurrent mutations of the same absolute path are serialized (in-process always;
+ * cross-process file lock when using the real filesystem) so disjoint concurrent
+ * edits cannot silently overwrite each other (#2900).
  */
 export declare function applyPatch(input: PatchInput, options: ApplyPatchOptions): Promise<ApplyPatchResult>;
 /**

package/dist/types/edit/path-mutation-lock.d.ts

@@ -0,0 +1,15 @@
+import { type FileLockOptions } from "../config/file-lock";
+export type EditPathMutationOptions = {
+    /**
+     * When true (default), also acquire a durable cross-process file lock.
+     * Disable for injectible/in-memory filesystem tests that do not touch disk.
+     */
+    crossProcess?: boolean;
+    fileLock?: FileLockOptions;
+};
+/**
+ * Run `fn` while holding exclusive mutation rights for every absolute path.
+ * Paths are locked in lexicographic order to avoid deadlocks on multi-path ops
+ * (e.g. rename source + destination).
+ */
+export declare function withEditPathMutation<T>(absolutePaths: readonly string[], fn: () => Promise<T>, options?: EditPathMutationOptions): Promise<T>;

package/dist/types/eval/py/executor.d.ts

@@ -50,7 +50,7 @@ export interface PythonExecutorOptions {
     /** @internal Bridge endpoint info, set by `executePython` before delegating. */
     bridge?: {
         url: string;
-        token: string;
+        capability: string;
     };
 }
 export interface PythonKernelExecutor {

package/dist/types/eval/py/tool-bridge.d.ts

@@ -7,7 +7,6 @@ export interface PyToolBridgeEntry {
 }
 export interface PyToolBridgeInfo {
     url: string;
-    token: string;
 }
 /** Starts the bridge server lazily and returns its connection info. */
 export declare function ensurePyToolBridge(): Promise<PyToolBridgeInfo>;
@@ -15,6 +14,6 @@ export declare function ensurePyToolBridge(): Promise<PyToolBridgeInfo>;
  * Register a tool session for the duration of one execution. The returned
  * function MUST be called to remove the entry once execution finishes.
  */
-export declare function registerPyToolBridge(sessionId: string, entry: PyToolBridgeEntry): () => void;
+export declare function registerPyToolBridge(sessionId: string, capability: string, entry: PyToolBridgeEntry): () => void;
 /** Stop the bridge and clear registrations. Test-only / shutdown helper. */
 export declare function disposePyToolBridge(): Promise<void>;

package/dist/types/gjc-runtime/repository-binding.d.ts

@@ -0,0 +1,63 @@
+import { type GitRepository } from "../utils/git";
+export declare const REPOSITORY_BINDING_SCHEMA: "gjc.repository_binding.v1";
+export interface RepositoryBinding {
+    schema: typeof REPOSITORY_BINDING_SCHEMA;
+    /** Canonical realpath of the git worktree root (or resolved cwd root). */
+    worktreeRoot: string;
+    /** Git common dir realpath when available; null outside a git checkout. */
+    commonDir: string | null;
+    /** Optional repo-relative subdirectory the lane should operate under. */
+    relativeSubdir?: string;
+    /** Optional display path (may be non-canonical); never used for authority. */
+    displayPath?: string;
+    /** Optional baseline HEAD at capture time. */
+    head?: string;
+    /** Optional branch name at capture time (when not detached). */
+    branch?: string;
+}
+export type RepositoryBindingErrorCode = "not_a_repository" | "identity_mismatch" | "path_outside_root" | "invalid_binding";
+export declare class RepositoryBindingError extends Error {
+    readonly code: RepositoryBindingErrorCode;
+    constructor(code: RepositoryBindingErrorCode, message: string);
+}
+/** Capture a durable binding from the active cwd/worktree. */
+export declare function captureRepositoryBinding(cwd: string, options?: {
+    relativeSubdir?: string;
+    displayPath?: string;
+}): Promise<RepositoryBinding>;
+/** Parse a binding from JSON/plan payload; fail closed on malformed shapes. */
+export declare function parseRepositoryBinding(value: unknown): RepositoryBinding;
+/** True when two bindings refer to the same repository identity (linked worktrees ok). */
+export declare function repositoryBindingsMatch(left: RepositoryBinding, right: RepositoryBinding): boolean;
+/**
+ * Ensure `cwd` is inside the bound repository (or the same linked worktree family).
+ * Fails closed on sibling-repo drift.
+ */
+export declare function assertCwdMatchesRepositoryBinding(cwd: string, binding: RepositoryBinding): Promise<RepositoryBinding>;
+/** Ensure a declared target path resolves under the bound worktree root. */
+export declare function assertPathUnderRepositoryBinding(binding: RepositoryBinding, targetPath: string): string;
+/**
+ * Public identity snapshot for receipts/handoffs (no display-only fields required).
+ * Always includes the schema + durable roots so downstream lanes can re-verify.
+ */
+export declare function publicRepositoryBinding(binding: RepositoryBinding): RepositoryBinding;
+/**
+ * Resolve the authoritative binding for a delegated task before discovery/spawn.
+ *
+ * - Missing declaration → stamp from session cwd (never leave authority implicit).
+ * - Declared binding → parse + fail closed unless it matches the active session worktree.
+ * - relativeSubdir (when present) must resolve under the bound root.
+ */
+export declare function resolveTaskRepositoryBinding(sessionCwd: string, declared: unknown | undefined): Promise<RepositoryBinding>;
+/**
+ * Ensure an execution/isolation root (cwd or worktree) still matches the bound identity.
+ * Used after isolation workspace creation so linked worktrees keep the source repository.
+ */
+export declare function assertExecutionRootMatchesRepositoryBinding(executionRoot: string, binding: RepositoryBinding): Promise<RepositoryBinding>;
+/** Optional helper for tests and diagnostics. */
+export declare function bindingFromGitRepository(repository: GitRepository, options?: {
+    relativeSubdir?: string;
+    displayPath?: string;
+    head?: string;
+    branch?: string;
+}): RepositoryBinding;

package/dist/types/gjc-runtime/ultragoal-guard.d.ts

@@ -25,6 +25,7 @@ export interface CurrentGoalLike {
         source: "user";
     };
 }
+export declare function isKnownUltragoalObjective(currentObjective: string): boolean;
 export declare function validateCompletionReceipt(input: {
     plan: UltragoalPlan;
     ledger: readonly UltragoalLedgerEvent[];

package/dist/types/gjc-runtime/ultragoal-runtime.d.ts

@@ -1,4 +1,5 @@
 import type { WorkflowHudSummary } from "../skill-state/active-state";
+import { type RepositoryBinding } from "./repository-binding";
 import { type CriticVerdict } from "./ultragoal-receipt-freshness";
 export { CRITIC_GATE_HARD_STOP_EVENT, CRITIC_GATE_OVERRIDE_EVENT, CRITIC_VERDICT_EVENT, type CriticVerdict, computeUltragoalPlanGeneration, countTerminalCriticVerdicts, receiptRelevantGoals, TERMINAL_CRITIC_CEILING, terminalCriticCeilingReached, terminalCriticGateOverridden, } from "./ultragoal-receipt-freshness";
 export { captureUltragoalRecoverySnapshot, parseStrictTerminalTranscript, persistUltragoalRecoveryDecision, planUltragoalOwnerLossRecovery, type UltragoalOwnerLossReceipt, type UltragoalRecoveryBinding, type UltragoalRecoveryDecision, type UltragoalRecoverySnapshot, validateOwnerLossBinding, validateRawUltragoalEvidence, validateRecoveryAdmission, validateRecoveryPath, } from "./ultragoal-owner-loss-recovery";
@@ -96,6 +97,8 @@ export interface UltragoalPlan {
     gjcObjective: string;
     gjcObjectiveAliases?: string[];
     goals: UltragoalGoal[];
+    /** Authoritative repository identity for multi-repo fail-closed spawn (#2901). */
+    repositoryBinding?: RepositoryBinding;
     createdAt: string;
     updatedAt: string;
     [key: string]: unknown;
@@ -308,6 +311,26 @@ export { joinUltragoalPipelineOverlap, rebaselineUltragoalPipelineOverlap, start
 export declare function getUltragoalRunCompletionState(plan: UltragoalPlan, options?: {
     retryFailed?: boolean;
 }): UltragoalRunCompletionState;
+/**
+ * Discriminated next-action for `complete-goals` handoff (#2903).
+ * `none` is reserved for genuine completion; `execute-goal` always carries a goal.
+ */
+export type UltragoalCompleteNextActionKind = "none" | "execute-goal" | "retry-failed" | "resolve-blockers" | "final-aggregate-receipt";
+export type UltragoalCompleteNextAction = {
+    kind: UltragoalCompleteNextActionKind;
+    goal?: UltragoalGoal;
+    blockedGoals?: UltragoalGoal[];
+    failedGoals?: UltragoalGoal[];
+};
+/**
+ * Resolve the actionable next step after scheduling / complete-goals.
+ * Blocked and review_blocked goals remain unschedulable; they surface as
+ * `resolve-blockers` instead of a contradictory `execute-goal` without goal_id.
+ */
+export declare function resolveUltragoalCompleteNextAction(plan: UltragoalPlan, options?: {
+    retryFailed?: boolean;
+    selectedGoal?: UltragoalGoal;
+}): UltragoalCompleteNextAction;
 export declare function startNextUltragoalGoal(input: {
     cwd: string;
     retryFailed?: boolean;
@@ -316,6 +339,7 @@ export declare function startNextUltragoalGoal(input: {
     plan: UltragoalPlan;
     goal?: UltragoalGoal;
     allComplete: boolean;
+    nextAction: UltragoalCompleteNextAction;
 }>;
 export declare function qualityGateObject(value: unknown): JsonObject | null;
 export declare function nonEmptyStringArray(value: unknown): string[] | null;

package/dist/types/main.d.ts

@@ -153,6 +153,14 @@ export interface ModelRoleOverrides {
  * invocation never inherits an earlier one's values.
  */
 export declare function resolveModelRoleOverrides(parsed: Pick<Args, "smol" | "slow" | "plan">): ModelRoleOverrides;
+/**
+ * Apply the `--no-pty` / `--no-title` terminal-control flags to the environment.
+ *
+ * Sets the canonical `GJC_*` name (so an explicit flag wins over a user-set
+ * `GJC_*` value under the GJC-first resolver — CLI authority) and the legacy
+ * `PI_*` name for backward compatibility. `--acp` mode implies `--no-title`.
+ */
+export declare function applyTerminalControlFlagsToEnv(parsed: Pick<Args, "noPty" | "noTitle" | "mode">, env?: NodeJS.ProcessEnv): void;
 export declare function runRootCommand(parsed: Args, rawArgs: string[], deps?: RunRootCommandDependencies): Promise<void>;
 export declare function main(args: string[]): Promise<void>;
 export {};

package/dist/types/modes/components/runtime-mcp-add-wizard.d.ts

@@ -14,12 +14,13 @@ type Scope = "user" | "project";
  */
 export interface MCPAddWizardOAuthResult {
     credentialId: string;
+    tokenEndpoint: string;
     clientId?: string;
     clientSecret?: string;
 }
 export declare class MCPAddWizard extends Container {
     #private;
-    constructor(onComplete: (name: string, config: MCPServerConfig, scope: Scope) => void, onCancel: () => void, onOAuth?: (authUrl: string, tokenUrl: string, clientId: string, clientSecret: string, scopes: string) => Promise<MCPAddWizardOAuthResult>, onTestConnection?: (config: MCPServerConfig) => Promise<void>, onRender?: () => void, initialName?: string);
+    constructor(onComplete: (name: string, config: MCPServerConfig, scope: Scope) => void, onCancel: () => void, onOAuth?: (endpointUrl: string, authUrl: string, tokenUrl: string, clientId: string, clientSecret: string, scopes: string) => Promise<MCPAddWizardOAuthResult>, onTestConnection?: (config: MCPServerConfig) => Promise<void>, onRender?: () => void, initialName?: string);
     dispose(): void;
     handleInput(keyData: string): void;
 }

package/dist/types/modes/components/tool-status-header.d.ts

@@ -1,5 +1,5 @@
 import { type Component } from "@gajae-code/tui";
-import type { AppKeybinding, KeybindingsManager } from "../../config/keybindings";
+import { type AppKeybinding, type KeybindingsManager, type KeyDisplayContext } from "../../config/keybindings";
 import type { StatusLinePreset, StatusLineSegmentId, StatusLineSeparatorStyle } from "../../config/settings-schema";
 import type { AgentSession } from "../../session/agent-session";
 import { type SkillActiveEntry } from "../../skill-state/active-state";
@@ -47,6 +47,7 @@ export interface StatusLineComponentOptions {
     actionRegistry?: ActionRegistry<void>;
     getKeybindings?: () => KeybindingsManager;
     focusDomain?: FocusDomain;
+    keyDisplayContext?: KeyDisplayContext;
 }
 export interface StatusLineActionHint {
     id: AppKeybinding;
@@ -57,7 +58,7 @@ export interface StatusLineActionHint {
  * remains the authority for availability; KEYBINDINGS remains the authority for
  * whether an action has a binding and the active manager supplies overrides.
  */
-export declare function getAvailableActionHints(actionRegistry: ActionRegistry<void> | undefined, getKeybindings: (() => KeybindingsManager) | undefined, width: number, domain?: FocusDomain): StatusLineActionHint[];
+export declare function getAvailableActionHints(actionRegistry: ActionRegistry<void> | undefined, getKeybindings: (() => KeybindingsManager) | undefined, width: number, domain?: FocusDomain, keyDisplayContext?: KeyDisplayContext): StatusLineActionHint[];
 export declare class StatusLineComponent implements Component {
     #private;
     private readonly session;

package/dist/types/modes/components/welcome.d.ts

@@ -1,4 +1,5 @@
 import { type Component } from "@gajae-code/tui";
+import { type KeyDisplayContext } from "../../config/keybindings";
 export interface RecentSession {
     name: string;
     timeAgo: string;
@@ -15,6 +16,7 @@ export interface WelcomeComponentOptions {
     changelogMarkdown?: string;
     collapseChangelog?: boolean;
     buildLabel?: string;
+    keyDisplayContext?: KeyDisplayContext;
 }
 /**
  * GJC-native launch surface with compact command affordances, project

package/dist/types/modes/controllers/command-controller.d.ts

@@ -1,8 +1,10 @@
 import { type CompactionOutcome } from "@gajae-code/agent-core/compaction";
 import { type ProviderDetails, type UsageReport } from "@gajae-code/ai";
+import type { KeybindingsManager } from "../../config/keybindings";
 import type { CompactOptions } from "../../extensibility/extensions/types";
 import { theme } from "../../modes/theme/theme";
 import type { InteractiveModeContext } from "../../modes/types";
+export declare function buildHelpMarkdown(keybindings: Pick<KeybindingsManager, "getAccessibleDisplayString">): string;
 export declare class CommandController {
     #private;
     private readonly ctx;

package/dist/types/modes/controllers/selector-controller.d.ts

@@ -5,7 +5,7 @@ import type { InteractiveModeContext, OAuthSelectorOptions } from "../../modes/t
 import { getNotificationConfig, maskToken } from "../../sdk/bus/config";
 import { proposedTelegramIdentity, reconcileCommittedTelegramConfiguration, removeTelegramConfiguration, saveTelegramInactive } from "../../sdk/bus/notification-orchestration";
 import { buildNotificationStatusReport, checkNotificationHealth, recoverNotifications, sanitizeDiagnostic, sendNotificationTest } from "../../sdk/bus/notification-service";
-import { ensureTelegramDaemonRunningDetailed, unregisterNotificationRoot } from "../../sdk/bus/telegram-daemon";
+import { ensureTelegramDaemonRunningDetailed, resolveTelegramSetupPreflight, unregisterNotificationRoot } from "../../sdk/bus/telegram-daemon";
 import { runTelegramSetup } from "../../sdk/bus/telegram-setup";
 import { type CredentialAutoImportStateStore } from "../../setup/credential-auto-import";
 import { type CommandPaletteAction } from "../components/command-palette";
@@ -38,6 +38,7 @@ export interface NotificationsEditorOperationDependencies {
     sanitizeDiagnostic: typeof sanitizeDiagnostic;
     ensureTelegramDaemonRunningDetailed: typeof ensureTelegramDaemonRunningDetailed;
     runTelegramSetup: typeof runTelegramSetup;
+    resolveTelegramSetupPreflight: typeof resolveTelegramSetupPreflight;
     proposedTelegramIdentity: typeof proposedTelegramIdentity;
     reconcileCommittedTelegramConfiguration: typeof reconcileCommittedTelegramConfiguration;
     saveTelegramInactive: typeof saveTelegramInactive;