@gajae-code/coding-agent 0.11.7 → 0.11.9

package/CHANGELOG.md

@@ -2,22 +2,84 @@
 
 ## [Unreleased]
 
+## [0.11.9] - 2026-07-24
+
+### Fixed
+
+- Alibaba Token Plan canonical first-event timeouts now surface without session retry/fallback replay and are not internally retried by auto-compaction, preventing repeated provider usage (#3026).
+
+- Telegram notification topics now fence malformed successful `createForumTopic` responses per session endpoint, preventing repeated ambiguous topic creation while keeping explicit Bot API failures retryable.
+- Windows managed-session resume no longer reports `durability_failed` when Bun rejects `fsync` on the read-only descriptor used to revalidate an existing canonical binding; Windows now uses an owner-writable descriptor for that durability fence while retaining no-follow and pre/post identity/content checks.
+- SDK daemon CLI end-to-end tests now drain spawned child stdout and stderr concurrently with process exit, preventing CI pipe teardown races from replacing the product exit contract with SIGPIPE status 141 (#3024).
+- Interactive launch bootstrap is now suppressed for parser-accepted `--print=`, `--help=`, and `--version=` equals forms, keeping non-interactive output free of the warming-workspace preamble on TTYs.
+- Managed legacy-session artifact migration now accepts up to 50,000 files, processes copy work in bounded batches, and reports capacity exhaustion separately from unsafe artifact topology (#2935).
+- Kimi Code first-event timeouts now surface after the provider's continuous first-event wait instead of replaying the full request from zero.
+
+- Rejected subagent schema payloads now retain their complete structured data in canonical output artifacts; inline results remain bounded while `agent://` output stays lossless (#2894).
+- Managed legacy-session artifact migration now validates Windows directory roots from the native tree snapshot, tolerates only lazy metadata on plain Windows directories, and replays both clean and cleanup-pending detaches while retaining fail-closed receipt validation. Canonical binding durability sync uses a writable no-follow handle on Windows NTFS stacks that reject `FlushFileBuffers` on read-only handles (#3015, #2913).
+## [0.11.8] - 2026-07-23
+### Added
+
+- Keybinding configuration now keeps portable canonical text while runtime shortcut labels render platform-native, including concise MacBook glyphs in inline surfaces and glyph-plus-text accessibility labels in `/hotkeys` and `/help`; `/hotkeys` remains authoritative for effective remapped bindings.
+
+### Added
+
+- Plans and delegated tasks carry an authoritative repository binding (`gjc.repository_binding.v1`). Ultragoal/ralplan stamp identity at creation; task lanes stamp omitted bindings from session cwd **before** agent discovery; ralplan stage writes and handoff re-entry enforce the seed binding; declared paths must stay under the bound root; task receipts include the resolved identity; linked isolation worktrees must match the source repository (#2901).
+
+### Fixed
+
+- Runtime MCP OAuth credentials are now bound to their authorized server origin and token endpoint, reject redirecting refresh responses, and fail closed when legacy or changed configuration lacks an exact match.
+- `/share` now keeps full-session HTML in owner-private unpredictable staging until the share handler or `gh gist create` process has fully stopped; cancelling a blocked gist upload terminates and awaits that process before reporting cancellation and removing the export.
+- MCP diagnostics now redact opaque endpoint paths, user information, query values, and fragments without changing outbound requests, and parse-failure logs omit response bodies that could echo request secrets.
+- Telegram notification daemon self-heals degraded on-disk state: permanently missing scan roots are pruned (so one deleted worktree no longer disables orphan-topic cleanup), and retained exact-unlink transition/placeholder artifacts are reaped on ownership acquire and each scan. `gjc daemon reload` can recover without manual filesystem surgery (#2956).
+- On macOS, resuming a managed session no longer fails with `identity_mismatch` when the first write-append open changes only file `ctime` (e.g. APFS write-provenance / `com.apple.provenance`). `appendSync` allows a single bounded re-capture + retry when `dev`/`ino`/`size`/`mtime`/SHA-256 remain unchanged, and still rejects real content races and repeated ctime transitions (#2944).
+- Interactive `/resume` / `AgentSession.switchSession()` now awaits verified managed `local://` legacy-root migration for the newly selected session before post-commit lifecycle proceeds, matching cold-start `createAgentSession()` readiness from #2797 so synchronous `local://` resolution no longer fails with "legacy migration must complete before path resolution" after a mid-session switch (#2925).
+- Concurrent edits to the same file path are serialized through a path-scoped mutation lock (in-process always; durable cross-process lock on the real filesystem). Disjoint concurrent `applyPatch` / replace mutations no longer silently overwrite each other, and a commit-time content check rejects writers that observe a mid-flight change (#2900).
+- Concurrent edits to the same file path are serialized through a path-scoped mutation lock (in-process always; durable cross-process lock on the real filesystem). Disjoint concurrent `applyPatch` / replace mutations no longer silently overwrite each other, and a commit-time content check rejects writers that observe a mid-flight change. The production `executePatchSingle` / `LspFileSystem` path explicitly enables the durable lock rather than inferring it from FileSystem object identity (#2900).
+- Lean notification verbosity no longer floods remote clients with intermediate tool-turn `turn_stream` frames. Under `/lean`, the latest assistant answer is deferred until `agent_end` (idle); ask lead-ins still flush immediately before inline buttons, and `/verbose` keeps per-turn streaming (including opt-in live frames) (#2863).
+- Ultragoal `complete-goals` no longer reports contradictory next actions when every incomplete story is `blocked` or `review_blocked`. Text and JSON now agree on `next-action=resolve-blockers` with blocked goal IDs/status; failed-only schedules surface `retry-failed`; `execute-goal` always includes a `goal_id` (#2903).
+- Bound each Python tool bridge bearer capability to one active session registration, reject non-canonical or empty bearer credentials before lookup, and rotate authority whenever a retained session replaces its kernel.
+- Deep Interview now scopes provider-facing `ask` metadata to the persisted workflow stage, including after durable session resume: Round 0 advertises only the locked `intent_contract` branch, later rounds advertise ordinary and `intent_review` branches, foreign workflow gates cannot seed recorder state, and wire-valid empty positive-round reviews reach canonical Zod diagnostics while malformed authority remains fail-closed.
+- Bounded docs.rs rustdoc downloads, legacy cache reads, and gzip expansion before parsing or caching; transport-level content encoding is disabled and rejected so Bun cannot decompress outside the explicit output guard.
+
+### Added
+
+- Added SDK v3 prompt reconciliation through `turn.prompt_status` with caller-supplied `clientRef` correlation, bounded live-session lifecycle retention, reconnect-safe lookup, and explicit ordered non-replay semantics for `turn.prompt` (#2930).
+- Added `models.profiles.list` discovery of the effective built-in plus `models.yml` profile catalog, exact-ID pre-spawn validation that reloads host configuration for each lifecycle request, and structured `unknown_model_profile` / `model_profile_registry_error` details across lifecycle startup failures (#2931).
+
 ## [0.11.7] - 2026-07-22
 ### Added
 
 - `/btw` now opens an ephemeral multi-turn side chat: plain text continues the side thread until Esc returns to the main chat, while visible text-only context stays outside the main transcript and session observability/debug hooks and is scrubbed synchronously on close or abort.
 - Added `statusLine.showActionHints` (default: `true`) to hide contextual action hints while retaining configured status-line segments.
 - `skill_discovery` empty results now carry a `notice` when discovery config caused the emptiness — naming the exact disabled setting (`skills.enabled`, `skills.enablePiProject`, or `skills.enablePiUser`) and the `gjc config set` command to enable it. Previously a disabled config was indistinguishable from "no skills exist", silently hiding freshly written user/project skills.
+- `generate_image` now supports Alibaba Bailian (Token Plan) `wan2.7-image` as an image provider: set `providers.image` to `alibaba` (or let auto-detect find `ALIBABA_TOKEN_PLAN_API_KEY` / a registered `alibaba-token-plan` key), override the model with `providers.imageModel` (e.g. `wan2.7-image-pro`). Short-lived OSS result URLs are downloaded immediately, and image editing works via input images.
 
 ### Fixed
+- Telegram `/session_recent` now retries one concurrently appended managed transcript and omits only candidates that remain unstable, preserving independently verified recent-session rows.
+- Repeated byte-identical stale SDK broker locks no longer cause startup to loop when a prior tombstone exists.
+- ACP session close now rotates idempotency keys for resumed attachment generations while retaining the same key across terminally uncertain close retries.
+- ConversationStore now tolerates only unsupported Windows parent-directory durability errors after preserving temporary-file fsync and atomic rename.
+- Ralplan no longer re-asks for execution approval when the user already explicitly named `ultragoal` or `team` in the current turn; that naming is the consent.
+- Interactive Windows startup now stays keyboard-ready with large session histories and native multiplexers by showing an interactive-only bootstrap before the first TUI start, deferring bounded recent-session discovery until afterward, and reducing psmux frame pressure while preserving the three-second animation and update checks.
 
+- Cron guidance now routes silent recurring polling and event-driven PR/CI watchers to `monitor`, because every cron firing starts a normal assistant turn and prompt wording cannot reliably suppress its response.
 - Ordinary `ask` calls now normalize a provider-emitted `deepInterview: null` placeholder instead of misclassifying it as malformed Round-0 intent recovery data and rejecting it before coercion.
+- SDK event replay authorization now refreshes the negotiated capability cache synchronously from the native-sanitized replay snapshot before host filtering, preserving initial and repeated-hello capability updates without trusting client frame claims.
+
+- Plugin-bundle HTTP and SSE MCP requests now bind every connection to a validated public address and revalidate bounded redirects before following them.
+- Deep Interview now exposes stage-specific provider-facing `ask` metadata: Round 0 advertises only the locked `intent_contract` branch, while later rounds advertise ordinary and `intent_review` branches, preventing strict-schema constraint stripping from making an invalid empty Round 0 review selectable.
+- Deep Interview now exposes stage-specific provider-facing `ask` metadata, including after durable session resume: Round 0 advertises only the locked `intent_contract` branch, while later rounds advertise ordinary and `intent_review` branches. Remaining strict-schema constraints that providers cannot express fail closed with bounded corrective guidance instead of an opaque retry loop.
+- Deep Interview now exposes stage-specific provider-facing `ask` metadata, including after durable session resume: Round 0 advertises only the locked `intent_contract` branch, while later rounds advertise ordinary and `intent_review` branches. Foreign workflow gates can no longer seed Deep Interview recorder state, and remaining strict-schema constraints that providers cannot express fail closed with bounded corrective guidance instead of an opaque retry loop.
 - Documented that custom OpenAI-compatible models omit vision by default: when `input` is unset, GJC treats the model as text-only and strips images with `[image omitted: model does not support vision]`. Vision backends must set `input: [text, image]` in `models.yml`.
 - Restored `/models` preset landing navigation after the Image Generation row and made compaction/pruning regression fixtures use an explicit 200K context boundary instead of a mutable provider descriptor default.
 - Fixed Windows legacy session artifact migration by using native directory identity size, a traversable detached-path alias, and writable file handles for final durability sync.
 - `gjc setup credentials` now auto-imports only OAuth credentials with a finite expiry strictly in the future. Expired or malformed-expiry discoveries remain visible as non-importable records, and existing imported credentials remain recoverable through `/login`.
 - Resumed managed sessions now complete the verified legacy `local://` artifact migration before synchronous path resolution, preserving legacy scratch files instead of failing startup with a migration-order error.
 - Corrected Telegram's uncertain lifecycle guidance so create, close, and resume commands describe their own possible outcome; close and resume no longer display the create-only duplicate-start warning.
+- Telegram ask notifications now preserve the authoritative recommended choice from native asks and workflow gates, marking that option as `(Recommended)` in the message body without changing button indices or submitted answers.
+- Telegram `/session_close` now fails closed when tmux disappearance cannot be confirmed, and publishes the managed owner verdict before locked terminal-state preservation so normal close finalization is not delayed behind that state path.
+- Managed publication now fails closed on malformed, committed, or mutation-unknown native outcomes: it never retries or cleans a destination, and preserves bounded atomic-unavailable/durability diagnostics through managed startup (#2804).
 
 ## [0.11.5] - 2026-07-20
 ### Fixed
@@ -38,12 +100,14 @@
 - Shell environment snapshots now use one process-private temporary root with exclusive private files, trusted cache validation, and whole-root shutdown cleanup instead of a predictable shared directory.
 - Python kernel startup now materializes its bundled runner in one process-private temporary directory with exclusive file creation instead of consulting a predictable shared cache path.
 - SSH command construction and discovery now reject malformed destinations with unsafe prefixes or control characters while preserving normal host, address, username, and alias forms.
+- Bounded MCP resource URI and template matching now skips oversized templates and uses deterministic literal-segment matching instead of dynamically constructed regular expressions.
 - Fixed the `subagent` tool's `resume` action silently swallowing manager failures. Resume outcomes other than `context_unavailable`/`not_found` (`no_runner`, `resume_failed`, `owner_shutdown_in_progress`, …) were dropped and the stale terminal subagent snapshot was returned as if the resume had succeeded, so ralplan's re-review loop believed the persisted Planner had resumed when it had not and never fell back correctly. The resume action now surfaces every non-ok reason (matching the `steer` branch), and the task resume runner marks a resumed subprocess that aborted or exited non-zero as a `failed` job (carrying its rendered failure summary) instead of reporting it `completed`.
 - Daemon timeout flags now reject missing, malformed, non-positive, fractional, whitespace-containing, and unsafe integer values before daemon command side effects instead of partially parsing them.
 - Hardened standalone HTML session exports so session identifiers, provider/model labels, and embedded raster images remain confined to their intended HTML contexts; malformed image payloads are omitted.
 - Restored legacy `gjc coordinator-mcp` and root `gjc --team --team-size <n>` routing to their native MCP and team commands, with strict team-size validation that prevents malformed legacy flags from selecting team lifecycle actions.
 - Fixed the `subagent` tool's `resume` action silently swallowing manager failures. Resume outcomes other than `context_unavailable`/`not_found` (`no_runner`, `resume_failed`, `owner_shutdown_in_progress`, …) were dropped and the stale terminal subagent snapshot was returned as if the resume had succeeded, so ralplan's re-review loop believed the persisted Planner had resumed when it had not and never fell back correctly. The resume action now surfaces every non-ok reason (matching the `steer` branch), and the task resume runner marks a resumed subprocess that aborted or exited non-zero as a `failed` job (preserving its error text) instead of reporting it `completed`.
 - OpenRouter image generation now retrieves provider-returned HTTP(S) images only through connection-bound public-address validation, revalidates bounded redirects, and enforces image content-type and byte limits before buffering.
+- Fixed session resume crashing with `TypeError: undefined is not an object (evaluating 'usage.input')`, and hardened both usage-aggregation paths against silent total corruption, when a persisted transcript contained a parseable-but-malformed assistant or `task` tool-result entry — as produced by torn concurrent multi-writer / NFS appends. `parseSessionEntries` accepts any parseable JSON, so a corrupt `usage` could be absent, `{}` (NaN totals), numeric strings (`"0" + "10"` → `"010"`), negative (silently reducing totals), a present-but-null/incomplete `premiumRequests`/`cost`, a non-record `cost` (e.g. an array), or cumulatively overflow to `Infinity`. Both the resume (`#buildIndex`) and runtime append (`#appendEntry`) paths now route through one shared validator that requires every usage bucket and `cost.total` to be finite non-negative numbers (defaulting only truly-absent `premiumRequests`/`cost`, and rejecting present-but-null/incomplete fields rather than zeroing them) and rejects any record that would overflow cumulative totals, skipping and reporting the malformed record instead of poisoning every `getUsageStatistics()` consumer.
 - Fixed the `subagent` tool's `resume` failing immediately for a persisted ralplan Planner. A subagent that finishes by calling `yield` (or is torn down right after a tool executes) left the saved session ending on an assistant `toolCall` with no matching `toolResult`; replaying that history on resume produced an invalid provider request (a `tool_use` not followed by a `tool_result`) that failed the resumed turn at once. Resumed transcripts now reconcile any trailing unpaired tool call with a synthesized placeholder result before the first resumed prompt. Additionally, a failed/no-op resume leg no longer overwrites the prior run's success output artifact with an empty file.
 - Fixed persisted subagent resumes being rejected before session reconstruction with `Session is inside managed storage but is not an authorized managed candidate`. Child session files intentionally live inside their parent session's artifact directory and are not top-level resume-picker candidates; the task resume path now explicitly opens the exact internally registered child session directory while retaining strict candidate validation for user-selected managed sessions.
 - Managed session resume scans now read only a bounded no-follow header prefix from foreign workspace transcripts, while fully recapturing and revalidating owned candidates before granting migration, receipt, or deletion authority.
@@ -87,6 +151,10 @@
 ### Changed
 - The `read` tool is now receipt-by-default: bare and unparseable reads return a bounded receipt (≤50 lines / 10 KiB) with a re-read-with-selector footer only when truncated, `:raw` stays pure verbatim up to a max(2 MiB, spill threshold) ceiling, structural summaries cap unit-granularly at 20 KiB while preserving elision and source-recovery footers, and directories are byte/line capped and never spill. Only an explicit full-content selector (`:raw` or an explicit range) with real content is spill-eligible. Subagent previews now enforce a real byte/code-point cap via per-shape render budgets plus a shape-aware artifact-eligibility tag enforced centrally in output-meta.
 
+
+### Fixed
+- Ultragoal objective ownership no longer treats arbitrary strings that merely mention `goals.json`/`ledger.jsonl` as Ultragoal-owned; only the exact default aggregate objective qualifies for the known-objective path.
+
 ### Fixed
 - Workflow-state handoff no longer self-locks the active-state cache, so a same-turn skill handoff (e.g. ultragoal → ralplan) completes instead of stalling behind a lock the handoff itself still holds (#2638).
 - SDK host shutdown now retries a failed broker unregister instead of short-circuiting with a stale broker-index entry, while retained startup-cleanup owner-release failures remain isolated from the red extension-error path (#2625).
@@ -120,6 +188,7 @@
 ### Fixed
 - Repository LSP configuration can no longer define process-affecting server behavior: project files may control declarative matching, activation, and capabilities, but cannot set launch fields, initialization options, or opaque server settings. Trusted canonical user configuration outside the project retains those overrides; project-controlled plugin roots and the quarantined `--plugin-dir` surface cannot inject them. Automatic discovery uses trusted external executables and rejects repository-owned lexical paths as well as symlink-resolved project binaries; status uses the session cwd as its lspmux trust root. `GJC_DISABLE_LSPMUX=1` is the canonical opt-out and `PI_DISABLE_LSPMUX=1` is a supported compatibility alias; either truthy value disables lspmux probing and wrapping.
 - Palette slash commands now run only from an empty composer; drafts are never touched.
+- Individual default and named-role model assignments now keep the model selector open for consecutive choices, while batch assignments retain their existing close-on-success behavior.
 - Aborting a session without an enabled active goal no longer suppresses the first reminder when a goal is activated later; active-goal abort suppression is one-shot, goal-owned, and clears across inactive or replacement-goal transitions (#2436).
 - Palette slash submissions no longer clear or rewrite composer text, cursor state, history, or pending images created while an asynchronous input hook is awaiting; canonical keyboard submission cleanup remains unchanged (#2441).
 - Dead browser-tab recovery now expires descriptors without releasing replacement, revived, or differently owned tabs, while exactly-once teardown closes stale targets and releases browser holds without refcount underflow (#2437).
@@ -145,6 +214,9 @@
 ### Fixed
 - Connected MCP server instructions now remain untrusted user-role data instead of entering the cached system prompt; hostile file paths, working directories, and workspace-tree metadata are structurally encoded, and volatile project context is removed from durable session history between requests.
 - Restored the strict G002 public-surface quarantine by removing the default README advertisement for the private coordinator MCP runtime.
+### Added
+
+- Added opt-in prompt suggestions (Claude Code-style ghost-text autocomplete): with the `promptSuggestions` setting enabled, a smol-model prediction of your likely next prompt renders as dim ghost text in the empty composer after each agent turn; Tab accepts it, typing dismisses it, and a new turn clears it. Predictions are heuristically gated (silence on evaluative/meta/agent-voice/overlong output) and never generated while the composer has text or a turn is streaming.
 
 ## [0.11.1] - 2026-07-16
 
@@ -214,11 +286,11 @@
 
 ## [0.10.1] - 2026-07-13
 
+- Deep-interview bundled guidance now uses the typed native setup, topology, answer-recovery, round-result, selective inspection, and sanity-check commands for normal workflow state changes. Generic `gjc state` remains limited to documented compatibility/recovery handoff paths; ambiguity, receipts, revisions, topology persistence, and diagnosis/repair remain runtime-owned.
 ### Added
 
 - Added an owner-proof idle session reaper and `gjc_coordinator_stop_session` for ephemeral (delegate-created) coordinator sessions. Termination goes exclusively through the canonical SDK broker `session.close` lifecycle (durable process identity verified before close) — never a raw `process.kill` or tmux control. The reaper re-validates ephemeral and no-active-turn state at close time under the same per-session mutation lock as delegate reuse, and purges coordinator metadata only after SDK closure is verified, retaining it when closure cannot be confirmed (#2080).
 
-- Added an owner-proof idle session reaper and `gjc_coordinator_stop_session` for ephemeral (delegate-created) coordinator sessions. Termination goes exclusively through the owner-proof `forceCloseGjcTmuxSession` path (pid, native session id, owner generation, server key, and start time all verified before SIGTERM) — never a raw `process.kill`. The reaper binds each close to the persisted runtime-state file, re-validates ephemeral and no-active-turn at kill time under the same per-session mutation lock as delegate reuse, and purges state only on verified termination (#2080).
 - SDK clients can now pass an explicit thinking level to `model.set`, atomically applying the effective model and thinking level to the active session and the machine-global default for future sessions, while project policy and resumed session history retain precedence.
 - Context-usage tokens/% now use provider-reported usage as the single source of truth on every surface. `AgentSession.getContextUsage()` returns a source-tagged snapshot (`source: "provider_anchor" | "heuristic" | "unknown"`), and the status-line `context_pct` segment, inline model percentage, and `/context` totals consume that snapshot instead of recomputing an independent heuristic sum — so footer, status line, `/context`, ACP, and RPC can no longer disagree about the same session state. Heuristic estimation now applies only when no provider anchor exists (session start, aborted/error-only turns), and that fallback now includes the fixed system-prompt/tool/skill context it previously omitted. The pre-prompt compaction estimate honors the latest-compaction boundary (never anchors on stale pre-compaction usage totals), unknown post-compaction usage stays unknown (status line renders `?`; ACP omits the `usage_update` instead of reporting `used: 0`), and `/context` labels its total by provenance with a reconciliation line when the estimated category composition diverges from the provider-reported total.
 - Post-durable default-model-selection failures now expose a stable SDK error with bounded `restored`, `partial`, or `unknown` rollback state; preflight and validation errors remain unchanged.

package/dist/types/cli/args.d.ts

@@ -52,5 +52,3 @@ export interface Args {
     authBootstrap?: true;
 }
 export declare function parseArgs(args: string[]): Args;
-export declare function getExtraHelpText(): string;
-export declare function printHelp(): void;

package/dist/types/cli.d.ts

@@ -6,6 +6,7 @@
 import "@gajae-code/utils/postmortem";
 import { Command, type CommandEntry } from "@gajae-code/utils/cli";
 export declare const commands: CommandEntry[];
+export declare function interactiveBootstrapText(argv: readonly string[], stdinIsTTY?: boolean, stdoutIsTTY?: boolean): string | undefined;
 export declare class RootHelpCommand extends Command {
     static description: string;
     static hidden: boolean;

package/dist/types/config/keybindings.d.ts

@@ -378,6 +378,10 @@ declare function migrateKeybindingsConfigFile(agentDir: string): void;
 export declare class KeybindingsManager extends TuiKeybindingsManager {
     #private;
     constructor(userBindings?: KeybindingsConfig, configPath?: string);
+    /**
+     * Replace user bindings only after canonical grammar validation.
+     */
+    setUserBindings(userBindings: KeybindingsConfig): void;
     /**
      * Create from config file at agentDir/keybindings.json.
      */
@@ -386,6 +390,11 @@ export declare class KeybindingsManager extends TuiKeybindingsManager {
      * Create an in-memory keybindings manager without file persistence.
      */
     static inMemory(userBindings?: KeybindingsConfig): KeybindingsManager;
+    /**
+     * Set the default display context used by composed surfaces that do not
+     * supply an explicit context.
+     */
+    setDisplayContext(context: KeyDisplayContext): void;
     /**
      * Reload keybindings from the config file.
      */
@@ -397,9 +406,30 @@ export declare class KeybindingsManager extends TuiKeybindingsManager {
     /**
      * Get display string for a keybinding (e.g., "ctrl+c/escape").
      */
-    getDisplayString(keybinding: Keybinding): string;
+    getDisplayString(keybinding: Keybinding, context?: KeyDisplayContext): string;
+    /**
+     * Get an accessibility-oriented display string for help surfaces.
+     * Darwin chords include both the concise glyphs and expanded key names.
+     */
+    getAccessibleDisplayString(keybinding: Keybinding, context?: KeyDisplayContext): string;
+    /**
+     * Format a fixed key chord using this manager's display context.
+     */
+    formatKeyHint(key: string): string;
+    /**
+     * Format a fixed key chord for accessibility-oriented help surfaces.
+     */
+    formatAccessibleKeyHint(key: string): string;
+}
+/**
+ * Key hint formatting utilities for UI labels.
+ */
+export interface KeyDisplayContext {
+    platform: NodeJS.Platform;
 }
-export declare function formatKeyHint(key: KeyId): string;
-export declare function formatKeyHints(keys: KeyId | KeyId[]): string;
+export declare function formatKeyHint(key: string, context?: KeyDisplayContext): string;
+export declare function formatAccessibleKeyHint(key: string, context?: KeyDisplayContext): string;
+export declare function formatKeyHints(keys: string | readonly string[], context?: KeyDisplayContext): string;
+export declare function formatAccessibleKeyHints(keys: string | readonly string[], context?: KeyDisplayContext): string;
 export type { Keybinding, KeybindingsConfig, KeyId };
 export { migrateKeybindingsConfigFile };

package/dist/types/config/model-profile-activation.d.ts

@@ -1,6 +1,7 @@
 import { ThinkingLevel } from "@gajae-code/agent-core";
 import type { Api, Model } from "@gajae-code/ai";
 import type { AgentSession } from "../session/agent-session";
+export { resolveModelProfileName } from "./model-profile-contract";
 import { type GjcModelAssignmentTargetId, type ModelRegistry } from "./model-registry";
 import { type ModelSelectorValue } from "./model-selector-value";
 import type { Settings } from "./settings";
@@ -17,7 +18,9 @@ type ModelProfileActivationSession = Pick<AgentSession, "model" | "thinkingLevel
 };
 export interface PrepareModelProfileActivationOptions {
     session: ModelProfileActivationSession;
-    modelRegistry: Pick<ModelRegistry, "getModelProfile" | "getModelProfiles" | "getAvailableModelProfileNames" | "getApiKeyForProvider" | "getAll" | "resolveCanonicalModel" | "getCanonicalVariants" | "getCanonicalId">;
+    modelRegistry: Pick<ModelRegistry, "getModelProfile" | "getModelProfiles" | "getAvailableModelProfileNames" | "getApiKeyForProvider" | "getAll" | "resolveCanonicalModel" | "getCanonicalVariants" | "getCanonicalId"> & {
+        getError?: ModelRegistry["getError"];
+    };
     settings: Pick<Settings, "get">;
     profileName: string;
 }
@@ -78,7 +81,6 @@ export declare class ModelProfileCredentialError extends Error {
     constructor(profileLabel: string, providers: readonly string[]);
 }
 export declare function formatModelProfileCredentialError(profileLabel: string, providers: readonly string[]): string;
-export declare function resolveModelProfileName(profileName: string, profiles: ReadonlyMap<string, unknown>): string;
 export declare function prepareModelProfileActivation(options: PrepareModelProfileActivationOptions): Promise<PreparedModelProfileActivation>;
 export declare function applyPreparedModelProfileActivation(prepared: PreparedModelProfileActivation, options?: ApplyModelProfileActivationOptions): Promise<void>;
 export interface MaterializeModelProfileForDeletionResult {
@@ -99,4 +101,3 @@ export declare function restoreMaterializedModelProfileForDeletion(options: {
     snapshot: MaterializeModelProfileForDeletionResult;
 }): Promise<void>;
 export declare function activateModelProfile(options: PrepareModelProfileActivationOptions, applyOptions?: ApplyModelProfileActivationOptions): Promise<void>;
-export {};

package/dist/types/config/model-profile-contract.d.ts

@@ -0,0 +1,38 @@
+import { type ModelProfileDefinition } from "./model-profiles";
+export declare const MODEL_PROFILE_DISCOVERY_QUERY = "models.profiles.list";
+export declare const MODEL_PROFILE_ERROR_DETAIL_MAX_BYTES = 2048;
+export interface ModelProfileCatalogItem {
+    id: string;
+    displayName: string;
+    source: "builtin" | "configured";
+}
+export interface UnknownModelProfileDetails {
+    requestedProfile: string;
+    availableProfiles: string[];
+    discoveryQuery: typeof MODEL_PROFILE_DISCOVERY_QUERY;
+}
+export interface ModelProfileRegistryErrorDetails {
+    requestedProfile?: string;
+    availableProfiles: [];
+    discoveryQuery: typeof MODEL_PROFILE_DISCOVERY_QUERY;
+}
+export type ModelProfileErrorDetails = UnknownModelProfileDetails | ModelProfileRegistryErrorDetails;
+export type ModelProfileErrorCode = "unknown_model_profile" | "model_profile_registry_error";
+export declare class UnknownModelProfileError extends Error {
+    readonly code: "unknown_model_profile";
+    readonly details: UnknownModelProfileDetails;
+    constructor(requestedProfile: string, profiles: ReadonlyMap<string, unknown>);
+}
+export declare class ModelProfileRegistryError extends Error {
+    readonly code: "model_profile_registry_error";
+    readonly details: ModelProfileRegistryErrorDetails;
+    constructor(requestedProfile?: string);
+}
+export declare function resolveModelProfileName(profileName: string, profiles: ReadonlyMap<string, unknown>): string;
+export declare function validateModelProfileName(profileName: string, profiles: ReadonlyMap<string, unknown>, registryError?: unknown): string;
+export declare function projectModelProfileCatalog(profiles: ReadonlyMap<string, ModelProfileDefinition>, registryError?: unknown): ModelProfileCatalogItem[];
+export declare function isModelProfileError(value: unknown): value is {
+    code: ModelProfileErrorCode;
+    message: string;
+    details: ModelProfileErrorDetails;
+};

package/dist/types/config/model-profiles.d.ts

@@ -1,7 +1,6 @@
-import type { GjcModelAssignmentTargetId } from "./model-registry";
 import { type ModelSelectorValue } from "./model-selector-value";
-import type { ModelsConfig } from "./models-config-schema";
-export type ModelProfileRole = GjcModelAssignmentTargetId;
+import type { GJC_MODEL_ASSIGNMENT_TARGET_IDS, ModelsConfig } from "./models-config-schema";
+export type ModelProfileRole = (typeof GJC_MODEL_ASSIGNMENT_TARGET_IDS)[number];
 export interface ModelProfileDefinition {
     name: string;
     requiredProviders: string[];

package/dist/types/config/settings-schema.d.ts

@@ -1561,6 +1561,15 @@ export declare const SETTINGS_SCHEMA: {
             readonly description: "Suggest emojis from `:name:` shortcodes and expand text emoticons like `:D` or `:-)`";
         };
     };
+    readonly promptSuggestions: {
+        readonly type: "boolean";
+        readonly default: false;
+        readonly ui: {
+            readonly tab: "interaction";
+            readonly label: "Prompt Suggestions";
+            readonly description: "Predict your likely next prompt after each turn (smol-model call) and show it as ghost text; Tab accepts";
+        };
+    };
     readonly "startup.quiet": {
         readonly type: "boolean";
         readonly default: false;
@@ -3786,7 +3795,7 @@ export declare const SETTINGS_SCHEMA: {
     };
     readonly "providers.image": {
         readonly type: "enum";
-        readonly values: readonly ["auto", "openai", "gemini", "openrouter", "antigravity", "custom"];
+        readonly values: readonly ["auto", "openai", "gemini", "openrouter", "antigravity", "alibaba", "custom"];
         readonly default: "auto";
         readonly ui: {
             readonly tab: "providers";
@@ -3795,7 +3804,7 @@ export declare const SETTINGS_SCHEMA: {
             readonly options: readonly [{
                 readonly value: "auto";
                 readonly label: "Auto";
-                readonly description: "Priority: GPT model image tool > Antigravity > OpenRouter > Gemini";
+                readonly description: "Priority: GPT model image tool > Antigravity > OpenRouter > Gemini > Alibaba";
             }, {
                 readonly value: "openai";
                 readonly label: "OpenAI";
@@ -3812,6 +3821,10 @@ export declare const SETTINGS_SCHEMA: {
                 readonly value: "antigravity";
                 readonly label: "Antigravity";
                 readonly description: "Requires login with google-antigravity";
+            }, {
+                readonly value: "alibaba";
+                readonly label: "Alibaba Bailian";
+                readonly description: "Requires ALIBABA_TOKEN_PLAN_API_KEY (wan2.7-image via Token Plan)";
             }, {
                 readonly value: "custom";
                 readonly label: "Custom";

package/dist/types/edit/modes/patch.d.ts

@@ -41,11 +41,24 @@ export interface ApplyPatchOptions {
     fuzzyThreshold?: number;
     allowFuzzy?: boolean;
     fs?: FileSystem;
+    /**
+     * When false, skip durable cross-process file locks (in-process path mutex
+     * still serializes). Defaults to true only for the real `defaultFileSystem`
+     * (or when `fs` is omitted). Disk-backed adapters that are not
+     * `defaultFileSystem` (notably production `LspFileSystem` via
+     * `executePatchSingle`) MUST pass `crossProcessLock: true` explicitly —
+     * object identity is not a durable-lock capability probe.
+     */
+    crossProcessLock?: boolean;
 }
 /** Default filesystem implementation using Bun APIs */
 export declare const defaultFileSystem: FileSystem;
 /**
  * Apply a patch operation to the filesystem.
+ *
+ * Concurrent mutations of the same absolute path are serialized (in-process always;
+ * cross-process file lock when using the real filesystem) so disjoint concurrent
+ * edits cannot silently overwrite each other (#2900).
  */
 export declare function applyPatch(input: PatchInput, options: ApplyPatchOptions): Promise<ApplyPatchResult>;
 /**

package/dist/types/edit/path-mutation-lock.d.ts

@@ -0,0 +1,15 @@
+import { type FileLockOptions } from "../config/file-lock";
+export type EditPathMutationOptions = {
+    /**
+     * When true (default), also acquire a durable cross-process file lock.
+     * Disable for injectible/in-memory filesystem tests that do not touch disk.
+     */
+    crossProcess?: boolean;
+    fileLock?: FileLockOptions;
+};
+/**
+ * Run `fn` while holding exclusive mutation rights for every absolute path.
+ * Paths are locked in lexicographic order to avoid deadlocks on multi-path ops
+ * (e.g. rename source + destination).
+ */
+export declare function withEditPathMutation<T>(absolutePaths: readonly string[], fn: () => Promise<T>, options?: EditPathMutationOptions): Promise<T>;

package/dist/types/eval/py/executor.d.ts

@@ -50,7 +50,7 @@ export interface PythonExecutorOptions {
     /** @internal Bridge endpoint info, set by `executePython` before delegating. */
     bridge?: {
         url: string;
-        token: string;
+        capability: string;
     };
 }
 export interface PythonKernelExecutor {

package/dist/types/eval/py/tool-bridge.d.ts

@@ -7,7 +7,6 @@ export interface PyToolBridgeEntry {
 }
 export interface PyToolBridgeInfo {
     url: string;
-    token: string;
 }
 /** Starts the bridge server lazily and returns its connection info. */
 export declare function ensurePyToolBridge(): Promise<PyToolBridgeInfo>;
@@ -15,6 +14,6 @@ export declare function ensurePyToolBridge(): Promise<PyToolBridgeInfo>;
  * Register a tool session for the duration of one execution. The returned
  * function MUST be called to remove the entry once execution finishes.
  */
-export declare function registerPyToolBridge(sessionId: string, entry: PyToolBridgeEntry): () => void;
+export declare function registerPyToolBridge(sessionId: string, capability: string, entry: PyToolBridgeEntry): () => void;
 /** Stop the bridge and clear registrations. Test-only / shutdown helper. */
 export declare function disposePyToolBridge(): Promise<void>;

package/dist/types/gjc-runtime/deep-interview-ambiguity.d.ts

@@ -9,15 +9,13 @@ export interface AmbiguityClampResult {
     effective: number;
     clamped: boolean;
 }
-/** Compute the deterministic floor from the inner deep-interview `state` object. */
+/** Compute the deterministic floor from integer units of persisted evidence. */
 export declare function computeAmbiguityFloor(inner: unknown): AmbiguityFloorBreakdown;
 /** Clamp an LLM-reported ambiguity to the deterministic floor: `max(reported, floor)`. */
 export declare function clampReportedAmbiguity(reported: number, floor: number): AmbiguityClampResult;
 /**
- * Mark every established fact recorded in `retractedRound` as disputed. This is the
- * mechanical contradiction signal for answer retraction: when the user replaces an
- * already-scored answer (A -> B pivot), the facts that answer established can no
- * longer be trusted, so they raise the floor until re-confirmed or superseded.
+ * Legacy pure utility for migrations and explicit repair flows. The recorder does
+ * not dispute facts when an answer is retracted: scored evidence is immutable.
  * Returns new arrays/objects; never mutates the input.
  */
 export declare function disputeFactsFromRetractedRound(facts: readonly unknown[], retractedRound: number): {
@@ -37,3 +35,12 @@ export interface AppliedAmbiguityFloor {
  * (state CLI write/reconcile, recorder) applies this immediately before persisting.
  */
 export declare function applyAmbiguityFloorToEnvelope(value: unknown): AppliedAmbiguityFloor;
+export type DeepInterviewAmbiguityMilestone = "initial" | "progress" | "refined" | "ready";
+export declare function deriveAmbiguityMilestone(effectiveUnits: number, thresholdUnits: number): DeepInterviewAmbiguityMilestone;
+export declare function scoreToUnits(score: number): number;
+export declare function weightedAmbiguityUnits(scores: {
+    goal: number;
+    constraints: number;
+    criteria: number;
+    context?: number;
+}, type: "greenfield" | "brownfield"): number;

package/dist/types/gjc-runtime/deep-interview-draft.d.ts

@@ -0,0 +1,8 @@
+import { type DeepInterviewDraftKind } from "./deep-interview-payload";
+export interface DeepInterviewDraftResult {
+    status: number;
+    stdout?: string;
+    stderr?: string;
+}
+export declare function runDeepInterviewDraftCommand(input: readonly string[], cwd: string): Promise<DeepInterviewDraftResult>;
+export declare function runDeepInterviewDraftInternalConsumeCommand(draftId: string, expectedDraftRevision: number, kind: DeepInterviewDraftKind, cwd: string): Promise<DeepInterviewDraftResult>;

package/dist/types/gjc-runtime/deep-interview-payload.d.ts

@@ -0,0 +1,41 @@
+import type { DeepInterviewRoundResultV1 } from "./deep-interview-state";
+export declare const DEEP_INTERVIEW_DRAFT_KINDS: readonly ["initialize-context", "confirm-topology", "record-answer", "apply-round-result"];
+export type DeepInterviewDraftKind = (typeof DEEP_INTERVIEW_DRAFT_KINDS)[number];
+export type DeepInterviewDraftPayload = Record<string, unknown>;
+export type DraftScalarType = "string" | "id" | "text" | "score" | "number" | "safe-int" | "boolean" | "enum";
+export interface DraftLeafDescriptor {
+    kind: "leaf";
+    type: DraftScalarType;
+    nullable?: boolean;
+    maxBytes?: number;
+    values?: readonly string[];
+    optional?: boolean;
+    dynamicMapValue?: boolean;
+}
+export interface DraftObjectDescriptor {
+    kind: "object";
+    fields: Record<string, DraftDescriptor>;
+    optional?: boolean;
+    dynamicMapValue?: boolean;
+    dynamicValue?: DraftLeafDescriptor;
+}
+export interface DraftArrayDescriptor {
+    kind: "array";
+    item: DraftLeafDescriptor | DraftObjectDescriptor;
+    maxItems: number;
+    optional?: boolean;
+}
+export type DraftDescriptor = DraftLeafDescriptor | DraftObjectDescriptor | DraftArrayDescriptor;
+export declare function deepInterviewDraftSchema(kind: DeepInterviewDraftKind): DraftObjectDescriptor;
+/** Shared strict payload decoders used by compatibility JSON and CLI-owned drafts. */
+export declare function decodeInitializeContextPayload(payload: unknown): Record<string, unknown>;
+export declare function decodeConfirmTopologyPayload(payload: unknown): Record<string, unknown>;
+export declare function decodeRecordAnswerPayload(payload: unknown): {
+    question: string;
+    answer: {
+        selected_options: string[];
+        custom_input: string | null;
+    };
+};
+export declare function decodeApplyRoundResultPayload(payload: unknown, state: Record<string, unknown>): DeepInterviewRoundResultV1;
+export declare function validateDraftPayload(kind: DeepInterviewDraftKind, payload: unknown, state?: Record<string, unknown>): void;

package/dist/types/gjc-runtime/deep-interview-recorder.d.ts

@@ -1,4 +1,4 @@
-import { type DeepInterviewEstablishedFact, type DeepInterviewIntentItem, type DeepInterviewIntentSubstitution, type DeepInterviewRoundRecord, type DeepInterviewStateEnvelope, type DeepInterviewTriggerMetadata } from "./deep-interview-state";
+import { type DeepInterviewEstablishedFact, type DeepInterviewIntentItem, type DeepInterviewIntentSubstitution, type DeepInterviewRoundRecord, type DeepInterviewRoundResultV1, type DeepInterviewStateEnvelope, type DeepInterviewTriggerMetadata } from "./deep-interview-state";
 export * from "./deep-interview-ambiguity";
 export * from "./deep-interview-state";
 /**
@@ -40,6 +40,8 @@ export interface DeepInterviewScoringInput {
     scores: Record<string, number>;
     ambiguity: number;
     triggers?: DeepInterviewTriggerMetadata[];
+    /** Complete native round result for typed callers. */
+    roundResult?: DeepInterviewRoundResultV1;
 }
 export type AppendOrMergeAction = "created" | "noop" | "replaced";
 export interface AppendOrMergeResult {
@@ -67,11 +69,9 @@ export interface TransitionValidationResult {
 }
 export declare function buildAnswerShell(input: DeepInterviewAnswerInput, now?: string): DeepInterviewRoundRecord;
 /**
- * Append-or-merge by `round_key`. Exactly one record per key:
- * - no existing record -> append (`created`);
- * - identical question_hash + answer_hash -> deterministic no-op (`noop`);
- * - same key, different hashes -> deterministic replacement of the prior shell
- *   (`replaced`); the prior answer for that key is superseded and lifecycle resets.
+ * Append-or-merge by `round_key`. An answer is a no-op only when its complete
+ * canonical shell identity matches; a scored record is immutable evidence and
+ * cannot be replaced by a late answer.
  */
 export declare function appendOrMergeRound(rounds: readonly DeepInterviewRoundRecord[], shell: DeepInterviewRoundRecord): AppendOrMergeResult;
 /**
@@ -94,28 +94,43 @@ export declare function ensureDeepInterviewStateShape(value: unknown): DeepInter
 export declare function projectCompactState(value: unknown, options?: {
     lastN?: number;
 }): DeepInterviewCompactState;
+interface RecorderMutationOptions {
+    sessionId?: string;
+    expectedRevision?: number;
+}
+export interface DeepInterviewPostCommitWarning {
+    code: "DI_POST_COMMIT_AUDIT_FAILED" | "DI_POST_COMMIT_ACTIVITY_FAILED" | "DI_POST_COMMIT_HUD_FAILED";
+    message: string;
+}
+export declare function runDeepInterviewPostCommitEffects(options: {
+    cwd: string;
+    statePath: string;
+    sessionId: string;
+    envelope: Record<string, unknown>;
+    revision: number;
+    writer: string;
+    auditWarnings?: readonly {
+        code: "DI_POST_COMMIT_AUDIT_FAILED";
+        message: string;
+    }[];
+}): Promise<DeepInterviewPostCommitWarning[]>;
 /** Refresh the best-effort HUD cache from persisted deep-interview state. */
 export declare function syncDeepInterviewRecorderHud(cwd: string, statePath: string, sessionId: string | undefined): Promise<void>;
 /**
  * Record an `answered` shell for one round (append-or-merge by durable key).
  *
- * Retraction dynamics: replacing an already-`scored` answer is a mechanical
- * contradiction signal (the user pivoted). The facts that round established are
- * marked disputed, which raises the deterministic ambiguity floor immediately —
- * without waiting for the LLM scorer to self-report a trigger.
+ * Replacing an already-scored answer is rejected with
+ * `DI_ANSWER_LIFECYCLE_CONFLICT`; scored evidence is immutable.
  */
-export declare function appendOrMergeDeepInterviewRound(cwd: string, statePath: string, input: DeepInterviewAnswerInput, options?: {
-    sessionId?: string;
-}): Promise<{
+export declare function appendOrMergeDeepInterviewRound(cwd: string, statePath: string, input: DeepInterviewAnswerInput, options?: RecorderMutationOptions): Promise<{
     action: AppendOrMergeAction;
     record: DeepInterviewRoundRecord;
-    disputedFactIds?: string[];
+    warnings: DeepInterviewPostCommitWarning[];
 }>;
 /** Merge scoring output into the same round record, transitioning to `scored`. */
-export declare function enrichDeepInterviewRoundScoring(cwd: string, statePath: string, input: DeepInterviewScoringInput, options?: {
-    sessionId?: string;
-}): Promise<{
+export declare function enrichDeepInterviewRoundScoring(cwd: string, statePath: string, input: DeepInterviewScoringInput, options?: RecorderMutationOptions): Promise<{
     record: DeepInterviewRoundRecord;
+    warnings: DeepInterviewPostCommitWarning[];
 }>;
 /** Compact projection so callers read a slice instead of the full transcript. */
 export declare function readDeepInterviewStateCompact(statePath: string, options?: {

package/dist/types/gjc-runtime/deep-interview-repair.d.ts

@@ -0,0 +1,17 @@
+import { type DeepInterviewRoundResultV1 } from "./deep-interview-state";
+export interface DeepInterviewRepairResult {
+    status: number;
+    stdout?: string;
+    stderr?: string;
+}
+export declare const DEEP_INTERVIEW_REPAIR_VERBS: readonly ["initialize-context", "confirm-topology", "record-answer", "apply-round-result", "inspect", "sanity-check"];
+export type DeepInterviewRepairVerb = (typeof DEEP_INTERVIEW_REPAIR_VERBS)[number];
+export declare function isDeepInterviewRepairVerb(value: string): value is DeepInterviewRepairVerb;
+export declare function decodeDeepInterviewAnswerJson(value: unknown): {
+    selected_options: string[];
+    custom_input: string | null;
+};
+export declare function decodeDeepInterviewRoundResultJson(value: unknown, state: Record<string, unknown>): DeepInterviewRoundResultV1;
+export declare function decodeDeepInterviewSetupJson(value: unknown): Record<string, unknown>;
+export declare function decodeDeepInterviewTopologyJson(value: unknown): Record<string, unknown>;
+export declare function runDeepInterviewRepairCommand(args: readonly string[], cwd: string): Promise<DeepInterviewRepairResult>;