@gajae-code/coding-agent 0.11.9 → 0.11.10

package/CHANGELOG.md

@@ -2,21 +2,38 @@
 
 ## [Unreleased]
 
+## [0.11.10] - 2026-07-25
+### Changed
+
+- The built-in `claude-opus`, `opus-codex`, and `fable-opus-codex` presets now use `anthropic/claude-opus-5` instead of `anthropic/claude-opus-4-8`, with effort suffixes preserved; `packages/ai/src/models.json` was regenerated so `anthropic/claude-opus-5` resolves; non-opus roles (`anthropic/claude-sonnet-5` executor/planner overrides, codex and fable roles) are unchanged.
+
 ## [0.11.9] - 2026-07-24
 
 ### Fixed
 
+- Restricted role-agent `bash` now accepts literal mid-word tildes, so git revision syntax such as `git diff HEAD~1` no longer has to be quoted. Bash performs tilde expansion only at the start of a word, so word-initial forms (`~`, `~/path`, `~user`) remain blocked.
+- Restricted role-agent `bash` now rejects unquoted tildes at every bash expansion position inside assignment words, including the compound `name+=value` form, so `A=~`, `A+=~`, `foo=~root/bar`, `A=x:~`, `A+=x:~`, and repeated colon segments such as `a=x:~:y:~` fail closed. Tildes bash does not expand — mid-word git revisions (`HEAD~1`), non-assignment words (`--opt=~`, `1abc=~`, `a++=~`, `a+b=~`), and quoted forms — remain allowed (#3117).
+- Read-only role agents (`architect`, `planner`, `critic`) now receive the `irc` coordination tool and a read-only git prefix set (`status`, `log`, `show`, `diff`, `blame`, `rev-parse`, `ls-files`) in restricted bash; mutating git and arbitrary shell stay blocked. `irc` also stays in the initial active tool set for subagents whenever the parent runtime reports IRC availability, instead of costing a discovery round-trip (#3109).
+- The restricted-bash workflow guard now allows `/dev/null` redirects (so `cmd 2>/dev/null` is no longer treated as a repository write during planning phases) while keeping `/dev/stdout`, `/dev/stderr`, and `/dev/fd/<n>` blocked, failing closed on `exec` redirections, and recognizing `>|`, `>&path`, `<>`, path-qualified writers, and every `dd of=` operand. Hook-seeded deep-interview state is now gated on `isNativeDeepInterviewV1` and seeded as a native v1 envelope, so typed operations no longer fail with `DI_STATE_SCHEMA_INVALID` and run the interview manually (#3127).
+- The vendored `insane-search` engine no longer treats a `429` as terminal: rate-limited probe and grid candidates back off (linear escalation honoring `Retry-After`, hard-capped at 30s) and continue through grid diversity and browser fallback. The backoff base from `INSANE_RATE_LIMIT_BACKOFF_S` is validated and clamped, so non-numeric, `NaN`, infinite, negative, or huge values can no longer raise, hang, or defeat a per-attempt deadline, and sleeps stay short enough to honor cancellation (#3131).
+- ACP sessions now apply execution permission decisions to eval calls and to tools invoked from JavaScript or Python eval contexts, while non-ACP session behavior remains unchanged.
+- Interactive prompt cancellation now reaches API-key preflight through `ModelRegistry`, allowing aborted submissions to clear immediately even while a shared credential-usage request continues in the background.
 - Alibaba Token Plan canonical first-event timeouts now surface without session retry/fallback replay and are not internally retried by auto-compaction, preventing repeated provider usage (#3026).
+- Delegated-task and subagent status surfaces now distinguish provider recovery from normal running, identify first-event versus idle-stream stalls, show retry budget and provider-progress age, and aggregate concurrent degradation by provider (#3071).
+- Telegram notification daemon ownership hardening (#3048): Bot API outcomes now share one honest classifier so both the initiating `429` response and cooldown-suppressed calls settle retryably instead of being lost or falsely rejected, including selected acknowledgements; exclusive operator work is registered before its callback can throw; notification health degrades corrupt daemon-state JSON to a warning; root-registration ownership tokens propagate through injected and built-in ensure, rollback, reconciliation, teardown, and abandoned-startup cleanup seams, with token-bearing rows refusing tokenless cleanup while genuinely legacy rows retain root-match behavior; and initial daemon readiness is published only after the matching heartbeat sidecar rename is durable, so no waiter can attach during the proof window.
+- `/new`, `fork()`, handoff, `/resume`, and branch/tree-jump transitions now complete verified managed `local://` legacy-root migration for the successor session identity *before* that identity is published to the agent, the workflow-gate emitter, or extension hooks, so no observer can resolve `local://` against an ungated root across the gate's `await` boundary. Matches cold-start `createAgentSession()` (#2797) and extends `/resume` (#2925). Sending a prompt right after `/new` no longer fails with "local:// legacy migration must complete before path resolution".
 
 - Telegram notification topics now fence malformed successful `createForumTopic` responses per session endpoint, preventing repeated ambiguous topic creation while keeping explicit Bot API failures retryable.
 - Windows managed-session resume no longer reports `durability_failed` when Bun rejects `fsync` on the read-only descriptor used to revalidate an existing canonical binding; Windows now uses an owner-writable descriptor for that durability fence while retaining no-follow and pre/post identity/content checks.
-- SDK daemon CLI end-to-end tests now drain spawned child stdout and stderr concurrently with process exit, preventing CI pipe teardown races from replacing the product exit contract with SIGPIPE status 141 (#3024).
+- SDK daemon CLI end-to-end tests now capture spawned child stdout and stderr through temporary files instead of pipes, removing the CI pipe teardown race that replaced the product exit contract with SIGPIPE status 141 (#3024).
 - Interactive launch bootstrap is now suppressed for parser-accepted `--print=`, `--help=`, and `--version=` equals forms, keeping non-interactive output free of the warming-workspace preamble on TTYs.
 - Managed legacy-session artifact migration now accepts up to 50,000 files, processes copy work in bounded batches, and reports capacity exhaustion separately from unsafe artifact topology (#2935).
 - Kimi Code first-event timeouts now surface after the provider's continuous first-event wait instead of replaying the full request from zero.
 
 - Rejected subagent schema payloads now retain their complete structured data in canonical output artifacts; inline results remain bounded while `agent://` output stays lossless (#2894).
 - Managed legacy-session artifact migration now validates Windows directory roots from the native tree snapshot, tolerates only lazy metadata on plain Windows directories, and replays both clean and cleanup-pending detaches while retaining fail-closed receipt validation. Canonical binding durability sync uses a writable no-follow handle on Windows NTFS stacks that reject `FlushFileBuffers` on read-only handles (#3015, #2913).
+- A single managed session tombstone that fails to reconcile (e.g. an artifact directory identity mismatch) no longer blocks resume or delete of every other session in the same managed scope; the failure is isolated to that tombstone and logged, unless it belongs to the session currently being opened, which still fails closed.
+
 ## [0.11.8] - 2026-07-23
 ### Added
 

package/dist/types/config/model-registry.d.ts

@@ -387,12 +387,14 @@ export declare class ModelRegistry {
      */
     getApiKey(model: Model<Api>, sessionId?: string, options?: {
         credentialSelector?: AuthCredentialSelector;
+        signal?: AbortSignal;
     }): Promise<string | undefined>;
     /**
      * Get API key for a provider (e.g., "openai").
      */
     getApiKeyForProvider(provider: string, sessionId?: string, baseUrl?: string, options?: {
         credentialSelector?: AuthCredentialSelector;
+        signal?: AbortSignal;
     }): Promise<string | undefined>;
     /**
      * Check if a model is using OAuth credentials (subscription).

package/dist/types/gjc-runtime/state-writer.d.ts

@@ -183,6 +183,7 @@ export type StrictMutationReadResult = {
 };
 export declare function readExistingStateForMutation(filePath: string): Promise<StrictMutationReadResult>;
 export declare function workflowEnvelopeContentSha256(value: unknown): string;
+export declare function isNativeDeepInterviewV1(value: Record<string, unknown>): boolean;
 export declare function verifyWorkflowEnvelopeReceiptValue(value: unknown, filePath: string): WorkflowReceiptVerification;
 export declare function stampWorkflowEnvelopeChecksum<T>(value: T, filePath: string, computedAt?: string): T;
 export declare function detectWorkflowEnvelopeIntegrityMismatch(filePath: string): Promise<WorkflowEnvelopeIntegrityMismatch | undefined>;

package/dist/types/modes/controllers/selector-controller.d.ts

@@ -5,7 +5,7 @@ import type { InteractiveModeContext, OAuthSelectorOptions } from "../../modes/t
 import { getNotificationConfig, maskToken } from "../../sdk/bus/config";
 import { proposedTelegramIdentity, reconcileCommittedTelegramConfiguration, removeTelegramConfiguration, saveTelegramInactive } from "../../sdk/bus/notification-orchestration";
 import { buildNotificationStatusReport, checkNotificationHealth, recoverNotifications, sanitizeDiagnostic, sendNotificationTest } from "../../sdk/bus/notification-service";
-import { ensureTelegramDaemonRunningDetailed, resolveTelegramSetupPreflight, unregisterNotificationRoot } from "../../sdk/bus/telegram-daemon";
+import { ensureTelegramDaemonRunningDetailed, readNotificationRootRegistration, resolveTelegramSetupPreflight, unregisterNotificationRoot } from "../../sdk/bus/telegram-daemon";
 import { runTelegramSetup } from "../../sdk/bus/telegram-setup";
 import { type CredentialAutoImportStateStore } from "../../setup/credential-auto-import";
 import { type CommandPaletteAction } from "../components/command-palette";
@@ -28,6 +28,13 @@ export interface NotificationsEditorAdapterContext {
     sessionManager: Pick<InteractiveModeContext["sessionManager"], "getCwd" | "getSessionId">;
     notifyConfigChanged?: () => Promise<void> | void;
 }
+type TelegramDaemonStopResult = {
+    ok: boolean;
+    message: string;
+    before?: {
+        health?: string;
+    };
+};
 export interface NotificationsEditorOperationDependencies {
     getNotificationConfig: typeof getNotificationConfig;
     maskToken: typeof maskToken;
@@ -43,7 +50,13 @@ export interface NotificationsEditorOperationDependencies {
     reconcileCommittedTelegramConfiguration: typeof reconcileCommittedTelegramConfiguration;
     saveTelegramInactive: typeof saveTelegramInactive;
     removeTelegramConfiguration: typeof removeTelegramConfiguration;
+    readNotificationRootRegistration: typeof readNotificationRootRegistration;
     unregisterNotificationRoot: typeof unregisterNotificationRoot;
+    stopTelegramDaemonIfRootRegistryFenceMatches(input: {
+        settings: Settings;
+        registryFingerprint: string;
+        stop: () => Promise<TelegramDaemonStopResult>;
+    }): Promise<boolean>;
     reloadTelegramDaemon(settings: Settings): Promise<{
         ok: boolean;
         message: string;
@@ -52,13 +65,7 @@ export interface NotificationsEditorOperationDependencies {
         ok: boolean;
         message: string;
     }>;
-    stopTelegramDaemon(settings: Settings): Promise<{
-        ok: boolean;
-        message: string;
-        before?: {
-            health?: string;
-        };
-    }>;
+    stopTelegramDaemon(settings: Settings): Promise<TelegramDaemonStopResult>;
 }
 /**
  * Concrete service adapter for the direct Notifications settings tab. Secrets remain in this closure's
@@ -128,3 +135,4 @@ export declare class SelectorController {
     showJobsOverlay(observer: JobsObserver): void;
     showTasksPane(aggregator: TasksAggregator): void;
 }
+export {};

package/dist/types/sdk/bus/daemon-paths.d.ts

@@ -9,6 +9,7 @@ export interface DaemonPaths {
     dir: string;
     lock: string;
     state: string;
+    heartbeat: string;
     ownership: string;
     roots: string;
     steal: string;

package/dist/types/sdk/bus/index.d.ts

@@ -29,7 +29,7 @@ import { CursorRegistry, RevisionStore } from "../host/query";
 import { type SdkStartupFailure } from "../startup-capability";
 import { type NotificationConfig } from "./config";
 import { NotificationSessionController } from "./session-control";
-import { type EnsureDaemonResult } from "./telegram-daemon";
+import { type EnsureDaemonResult, type RegisterNotificationRootResult } from "./telegram-daemon";
 /** Where a `session_create` should run. Discriminated by `kind`. */
 export type SessionCreateTarget = {
     kind: "existing_path";
@@ -324,6 +324,12 @@ interface SessionRuntime {
     hostStopped: boolean;
     serverStopped: boolean;
     brokerRegistrationReleased: boolean;
+    /** Managed Telegram root registration released during terminal teardown. */
+    notificationRootRegistration?: {
+        settings: Settings;
+        cwd: string;
+        registrationToken?: string;
+    };
     verbosity: "lean" | "verbose";
     sessionTag: string;
     /** Whether the agent loop is currently running (drives the typing indicator). */
@@ -511,6 +517,7 @@ export declare function createNotificationsExtension(api: ExtensionAPI, options?
         settings: Settings;
         cwd: string;
         sessionId: string;
+        onRegistered?: (registration: RegisterNotificationRootResult) => void;
     }) => Promise<EnsureDaemonResult>;
     ensureProviderDaemon?: (provider: "discord" | "slack", settings: Settings) => Promise<unknown>;
     /** Suppress auto-delivery for a GJC-spawned child under `sessionScope=primary`. */

package/dist/types/sdk/bus/operator-runtime.d.ts

@@ -47,6 +47,7 @@ export declare class NotificationOperatorRuntime {
     stopInterval(name: string): void;
     stopAllIntervals(): void;
     runExclusive(name: string, fn: () => Promise<void>): Promise<void>;
+    joinExclusive(name: string, timeoutMs: number): Promise<boolean>;
     sleep(ms: number, signal?: AbortSignal): Promise<void>;
     now(): number;
 }

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -5,12 +5,9 @@
 /** Protocol version the daemon advertises in its ClientHello. */
 export declare const NOTIFICATION_PROTOCOL_VERSION = 3;
 /**
- * Operational generation the current daemon build speaks. Decoupled from
- * {@link NOTIFICATION_PROTOCOL_VERSION} (#2304): additive `tool_activity` /
- * `reasoning_summary` frames do not bump the wire protocol version, but a
- * freshly-upgraded host must still recognize an older, still-live daemon that
- * predates capability-gated frame enforcement and trigger a reload. Bump this
- * on every daemon-behavior change independent of the wire version.
+ * Guarded behavior-inventory version for the current daemon build. Bump this
+ * on every guarded daemon-behavior change independent of the wire version; it
+ * does not force a live daemon reload by itself.
  * The current development baseline already includes #2299's generation 4,
  * incarnation fencing in generation 5, owner-lock authority in generation 6,
  * identity-atomic transition markers in generation 7, stable signaling plus
@@ -38,5 +35,13 @@ export declare const NOTIFICATION_PROTOCOL_VERSION = 3;
  * cooldown and lazy Telegram topic lifecycle safeguards (#2956, #2960, #2984).
  * Generation 27 refreshes retained native path and process authority semantics.
  * Generation 28 rejects special files before retained native authority opens.
+ * Generation 29 adds serving-epoch compatibility, sidecar heartbeat, root GC,
+ * and Bot API cooldown structural fixes (#2956, #2960, #3048).
  */
-export declare const DAEMON_GENERATION = 28;
+export declare const DAEMON_GENERATION = 29;
+/**
+ * Serving-compatibility boundary for daemon lifecycle requests. Epoch 1 covers
+ * all builds published before this field existed; bump this to force serving
+ * convergence and reload of compatible live predecessors.
+ */
+export declare const SERVING_EPOCH = 2;

package/dist/types/sdk/bus/telegram-daemon.d.ts

@@ -5,10 +5,10 @@ import { HEARTBEAT_TTL_MS } from "./daemon-paths";
 import { type DaemonTransitionLock, type NotificationEndpointFile, type NotificationEndpointFileIdentity, type NotificationExactUnlinkResult } from "./notification-service";
 import { type DaemonProcessReference } from "./telegram-daemon-control";
 import { type TelegramSetupPreflight } from "./telegram-setup";
-export { DAEMON_GENERATION, NOTIFICATION_PROTOCOL_VERSION } from "./telegram-daemon-contract";
+export { DAEMON_GENERATION, NOTIFICATION_PROTOCOL_VERSION, SERVING_EPOCH } from "./telegram-daemon-contract";
 import { type ControlServerLike, type LifecycleControlServerFactory } from "./lifecycle-control-runtime";
 import type { OrchestratorDeps } from "./lifecycle-orchestrator";
-import { NotificationOperatorRuntime, OperatorBackoffPolicy } from "./operator-runtime";
+import { NotificationOperatorRuntime } from "./operator-runtime";
 import { type AliasTable, type CallbackRoute } from "./telegram-reference";
 import { type TopicEndpointBinding } from "./topic-registry";
 export type EnsureDaemonResult = "owner_spawned" | "attached" | "disabled" | "blocked";
@@ -41,6 +41,8 @@ export interface DaemonState {
      * notification wire protocol version. Absent on pre-generation state.
      */
     generation?: number;
+    /** Lifecycle-serving compatibility epoch; absent pre-epoch records are epoch 1. */
+    servingEpoch?: number;
     stoppedAt?: number;
 }
 export interface TelegramDaemonFs {
@@ -201,15 +203,59 @@ export declare function liveOwnershipLockDecision(input: {
     attached: false;
     provisional: true;
 } | undefined;
+type OwnerHeartbeatSidecar = {
+    pid: number;
+    incarnation: string;
+    ownerId: string;
+    acquisitionId: string;
+    heartbeatAt: number;
+};
+export interface OwnerFreshnessSnapshot {
+    ownerTag: Pick<OwnerHeartbeatSidecar, "pid" | "incarnation" | "ownerId" | "acquisitionId"> | null;
+    effectiveHeartbeatAt: number | undefined;
+    legacyEmbedded: boolean;
+    state: DaemonState | undefined;
+}
+export declare function readOwnerFreshnessSnapshot(input: {
+    settings: Settings;
+    fs?: TelegramDaemonFs;
+}): Promise<OwnerFreshnessSnapshot>;
+/** Marker-free steady heartbeat renewal. The final lock reread fences a stale writer. */
+export declare function renewOwnerHeartbeatSidecar(input: {
+    settings: Settings;
+    ownerId: string;
+    acquisitionId?: string;
+    fs?: TelegramDaemonFs;
+    now?: () => number;
+    pid?: number;
+    pidIncarnation?: (pid: number) => string | undefined;
+}): Promise<boolean>;
+export interface NotificationRootRegistration {
+    root?: string;
+    managed?: boolean;
+    token?: string;
+}
+export declare function readNotificationRootRegistration(input: {
+    settings: Settings;
+    sessionId: string;
+    fs?: TelegramDaemonFs;
+}): Promise<NotificationRootRegistration>;
+export interface RegisterNotificationRootResult {
+    root: string;
+    /** Per-registration ownership token fencing a stale same-session cleanup from deleting a live replacement registration. */
+    token: string;
+}
 export declare function registerNotificationRoot(input: {
     settings: Settings;
     cwd: string;
     sessionId: string;
     fs?: TelegramDaemonFs;
-}): Promise<string>;
+}): Promise<RegisterNotificationRootResult>;
 export interface UnregisterNotificationRootResult {
     root: string;
     remainingRoots: number;
+    /** Opaque fingerprint of the exact registry written by this successful unregister. */
+    registryFingerprint?: string;
 }
 /** Remove one session's Telegram scan root without disturbing other live session roots. */
 export declare function unregisterNotificationRoot(input: {
@@ -217,7 +263,16 @@ export declare function unregisterNotificationRoot(input: {
     cwd: string;
     sessionId: string;
     fs?: TelegramDaemonFs;
+    /** Ownership token minted by this runtime's own registration; a stale cleanup presenting an older token never deletes a replacement registration. */
+    registrationToken?: string;
 }): Promise<UnregisterNotificationRootResult>;
+/** Run an action while the roots registry lock excludes any registration or unregister. */
+export declare function withNotificationRootRegistryFence(input: {
+    settings: Settings;
+    registryFingerprint: string;
+    action: () => Promise<void>;
+    fs?: TelegramDaemonFs;
+}): Promise<boolean>;
 /**
  * Leak artifact prefixes left when native exact-unlink cleanup is retained
  * (#2956). Nothing previously reaped these; they accumulate in the notifications
@@ -319,6 +374,7 @@ export declare function isFreshLiveOwner(input: {
     chatId: string;
     pidAlive: (pid: number) => boolean;
     pidIncarnation?: (pid: number) => string | undefined;
+    effectiveHeartbeatAt?: number;
 }): boolean;
 /** True only when a physically live matching owner can serve this build's daemon lifecycle contract. */
 export declare function isCurrentCompatibleOwner(input: {
@@ -328,6 +384,7 @@ export declare function isCurrentCompatibleOwner(input: {
     chatId: string;
     pidAlive: (pid: number) => boolean;
     pidIncarnation?: (pid: number) => string | undefined;
+    effectiveHeartbeatAt?: number;
 }): boolean;
 export declare function acquireDaemonOwnership(input: {
     settings: Settings;
@@ -399,7 +456,7 @@ export declare function retireProvisionalDaemonOwnership(input: {
     /** Only no-child confirmation may retire a ready-like launcher publication. */
     allowReadyWithoutChildPid?: boolean;
 }): Promise<boolean>;
-/** Wait for a matching current-generation daemon to publish a ready state. */
+/** Wait for a matching compatible owner to publish a ready state. Readiness is serving-epoch gated (same-epoch cross-generation owners attach, per isCurrentCompatibleOwner); generation is inventory-only here. Mutation paths still require exact current-generation equality. */
 export declare function waitForTelegramDaemonReady(input: {
     settings: Settings;
     ownerId?: string;
@@ -548,6 +605,9 @@ export declare function ensureTelegramDaemonRunningDetailed(input: {
     settings: Settings;
     cwd: string;
     sessionId: string;
+    registerRoot?: boolean;
+    /** Receives each registration this ensure operation minted so the caller can fence its own later cleanup. */
+    onRegistered?: (registration: RegisterNotificationRootResult) => void;
 }, deps?: TelegramDaemonDeps): Promise<EnsureTelegramDaemonDetailedResult>;
 /**
  * Legacy compatibility mapping for callers that only distinguish ownership from
@@ -600,7 +660,10 @@ export type TelegramPollResult = {
 export interface TelegramUpdatePollerOptions {
     botApi: BotApi;
     runtime: NotificationOperatorRuntime;
-    backoff: OperatorBackoffPolicy;
+    backoff: {
+        next(): number;
+        reset(): void;
+    };
     processUpdate: (update: unknown) => Promise<TelegramUpdateOutcome>;
     health?: TelegramPollHealth;
 }
@@ -785,6 +848,9 @@ export declare class TelegramNotificationDaemon {
     private readonly pool;
     private readonly poller;
     private readonly dispatchState;
+    /** Bot-wide flood-control window; inbound polling remains eligible during it. */
+    private botCooldownUntil;
+    private warnedBotCooldownUntil;
     /** Original markdown of rich messages we sent (chat+message_id), for restoring reply context on inbound replies. */
     private readonly replyStore;
     /** Per-session debounce + monotonic draft-id state for opt-in draft streaming. */
@@ -871,6 +937,9 @@ export declare class TelegramNotificationDaemon {
     private refreshBotIdentity;
     /** Map a lifecycle response/error to a user-facing message (G010 surfacing). */
     private formatLifecycleResponse;
+    private callBotApi;
+    private readonly callBotApiClassified;
+    private botApiWithOutcomeCollector;
     constructor(opts: TelegramDaemonOptions);
     private createSessionRouter;
     loadAliases(): Promise<void>;

package/dist/types/sdk/session.d.ts

@@ -149,6 +149,13 @@ export interface CreateAgentSessionOptions {
     goalToolAllowedOps?: readonly ("create" | "get" | "complete" | "resume" | "drop" | "pause")[];
     /** Optional per-session allowlist for tools exposed through search_tool_bm25. */
     discoverableToolAllowedNames?: readonly string[];
+    /**
+     * Discoverable built-in tools that must stay in the initial active set even when
+     * `tools.discoveryMode === "all"` would otherwise hide them behind `search_tool_bm25`.
+     * Used for coordination tools (e.g. `irc`) that a subagent must be able to use
+     * immediately without first spending a discovery round-trip to find them.
+     */
+    alwaysActiveToolNames?: readonly string[];
     /** Optional shared agent registry for IRC routing. Default: AgentRegistry.global(). */
     agentRegistry?: AgentRegistry;
     /** Parent task ID prefix for nested artifact naming (e.g., "6-Extensions") */

package/dist/types/session/agent-session.d.ts

@@ -677,6 +677,8 @@ export declare class AgentSession {
      * Get a tool by name from the registry.
      */
     getToolByName(name: string): AgentTool | undefined;
+    /** Get a registered tool with the same guards used for model-facing execution. */
+    getToolForExecution(name: string): AgentTool | undefined;
     /**
      * Register a UI/control-plane request handler for a currently foregrounded
      * managed bash execution. This is intentionally narrower than generic

package/dist/types/session/internal/managed-session-scope.d.ts

@@ -129,7 +129,7 @@ export declare function matchesMigrationArtifactRoot(pathname: string, identity:
 }, expectedTree: NativeDirectoryTreeSnapshot, platform?: NodeJS.Platform): boolean;
 export declare function restorePreparedArtifactRoot(scope: ManagedScope, source: ManagedCandidate, lock?: ManagedStorageLock): void;
 /** Resume tombstoned cleanup under its original operation lease without restoring retired candidates. */
-export declare function reconcileManagedTombstones(scope: ManagedScope): Promise<void>;
+export declare function reconcileManagedTombstones(scope: ManagedScope, expectedCandidate?: ManagedCandidate): Promise<void>;
 /** Create the v2 binding and private write protocol directories before managed writes. */
 export declare function prepareManagedSessionScopeForWrite(scope: ManagedScope, policy?: ManagedSessionSecurityPolicy, authority?: ManagedCandidateWriteAuthority, expectedCandidate?: ManagedCandidate, expectedIdentity?: ResumeSessionIdentity): Promise<ManagedScopeResolution>;
 /**

package/dist/types/task/provider-retry-status.d.ts

@@ -0,0 +1,13 @@
+import type { AgentProgress, TaskToolDetails } from "./types";
+export type ProviderRetryKind = NonNullable<AgentProgress["retryState"]>["kind"];
+export declare function classifyProviderRetry(errorMessage: string): ProviderRetryKind;
+export declare function providerNameFromModel(model: string | undefined): string | undefined;
+export declare function providerRetryPhaseLabel(kind: ProviderRetryKind): string;
+export declare function providerProgressAgeLabel(retryState: NonNullable<AgentProgress["retryState"]>, nowMs: number): string;
+export declare function hasActiveProviderRetryInTaskDetails(details: TaskToolDetails, seen?: WeakSet<object>): boolean;
+export declare function hasActiveProviderRetryInProgress(progress: AgentProgress, seen?: WeakSet<object>): boolean;
+export interface ProviderDegradationGroup {
+    provider: string;
+    count: number;
+}
+export declare function collectProviderDegradationGroups(progress: readonly AgentProgress[]): ProviderDegradationGroup[];

package/dist/types/task/types.d.ts

@@ -416,6 +416,9 @@ export interface AgentProgress {
         attempt: number;
         maxAttempts: number;
         unbounded?: boolean;
+        kind: "first_event_timeout" | "idle_stream_stall" | "provider_error";
+        provider?: string;
+        lastProviderProgressAtMs?: number;
         delayMs: number;
         errorMessage: string;
         startedAtMs: number;

package/dist/types/tools/index.d.ts

@@ -198,9 +198,11 @@ export interface ToolSession {
     /** Agent identity used for IRC routing. Returns the registry id (e.g. "0-Main", "0-AuthLoader"). */
     getAgentId?: () => string | null;
     /** Look up a registered tool by name (used by the eval js backend's tool bridge). */
+    getToolByName?: (name: string) => AgentTool | undefined;
+    /** Look up a registered tool with the session's execution guards applied. */
+    getToolForExecution?: (name: string) => AgentTool | undefined;
     /** Purge undelivered queued custom messages matching the predicate. Returns counts. */
     purgeQueuedCustomMessages?: (predicate: (message: CustomMessage) => boolean) => PurgeQueuedCustomMessagesResult;
-    getToolByName?: (name: string) => AgentTool | undefined;
     /** Agent registry for IRC routing across live sessions. */
     agentRegistry?: AgentRegistry;
     /** Optional restricted bash command prefixes for read-only role agents and constrained modes. */

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.11.9",
+	"version": "0.11.10",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -53,13 +53,13 @@
 		"@agentclientprotocol/sdk": "1.2.1",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.11.9",
-		"@gajae-code/agent-core": "0.11.9",
-		"@gajae-code/ai": "0.11.9",
-		"@gajae-code/bridge-client": "0.11.9",
-		"@gajae-code/natives": "0.11.9",
-		"@gajae-code/tui": "0.11.9",
-		"@gajae-code/utils": "0.11.9",
+		"@gajae-code/stats": "0.11.10",
+		"@gajae-code/agent-core": "0.11.10",
+		"@gajae-code/ai": "0.11.10",
+		"@gajae-code/bridge-client": "0.11.10",
+		"@gajae-code/natives": "0.11.10",
+		"@gajae-code/tui": "0.11.10",
+		"@gajae-code/utils": "0.11.10",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/scripts/generate-sdk-operation-inventory.ts

@@ -70,6 +70,7 @@ const LOCKED_EXCLUSIONS: Readonly<Record<string, string>> = {
 	"agent_session:getAsyncDeliveryStateForAcp":
 		"internal ACP lifecycle quiescence plumbing, not a user-facing control seam",
 	"agent_session:getToolByName": "internal accessor/plumbing, not a user-facing control seam",
+	"agent_session:getToolForExecution": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:registerForegroundBashBackgroundRequestHandler":
 		"internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:hasForegroundBashBackgroundRequestHandler":

package/src/cli/notify-cli.ts

@@ -413,6 +413,7 @@ async function runTelegramSetup(cmd: NotifyCommandArgs, deps: NotifyCommandDeps)
 								settings,
 								cwd: process.cwd(),
 								sessionId: `notify-cli-${process.pid}`,
+								registerRoot: false,
 							}),
 				persistInactive: async marker => await persistTelegramActivationMarker(settings, marker),
 				clearInactive: async marker => await clearTelegramActivationMarker(settings, marker),

package/src/config/model-profiles.ts

@@ -100,11 +100,11 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		architect: "opencode-go/deepseek-v4-pro",
 	}),
 	profile("claude-opus", ["anthropic"], {
-		default: "anthropic/claude-opus-4-8:xhigh",
+		default: "anthropic/claude-opus-5:xhigh",
 		executor: "anthropic/claude-sonnet-5",
-		planner: "anthropic/claude-opus-4-8:low",
-		critic: "anthropic/claude-opus-4-8:high",
-		architect: "anthropic/claude-opus-4-8:xhigh",
+		planner: "anthropic/claude-opus-5:low",
+		critic: "anthropic/claude-opus-5:high",
+		architect: "anthropic/claude-opus-5:xhigh",
 	}),
 	profile("claude-fable", ["anthropic"], {
 		default: "anthropic/claude-fable-5:xhigh",
@@ -271,7 +271,7 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		critic: "alibaba-token-plan/qwen3.8-max-preview:xhigh",
 	}),
 	profile("opus-codex", ["anthropic", "openai-codex"], {
-		default: "anthropic/claude-opus-4-8:xhigh",
+		default: "anthropic/claude-opus-5:xhigh",
 		executor: "openai-codex/gpt-5.6-terra:low",
 		planner: "anthropic/claude-sonnet-5",
 		critic: "openai-codex/gpt-5.6-sol:xhigh",
@@ -287,8 +287,8 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 	profile("fable-opus-codex", ["anthropic", "openai-codex"], {
 		default: "anthropic/claude-fable-5:high",
 		executor: "openai-codex/gpt-5.6-terra:medium",
-		planner: "anthropic/claude-opus-4-8:medium",
-		critic: "anthropic/claude-opus-4-8:high",
+		planner: "anthropic/claude-opus-5:medium",
+		critic: "anthropic/claude-opus-5:high",
 		architect: "openai-codex/gpt-5.6-sol:xhigh",
 	}),
 ];

package/src/config/model-registry.ts

@@ -2564,13 +2564,14 @@ export class ModelRegistry {
 	async getApiKey(
 		model: Model<Api>,
 		sessionId?: string,
-		options: { credentialSelector?: AuthCredentialSelector } = {},
+		options: { credentialSelector?: AuthCredentialSelector; signal?: AbortSignal } = {},
 	): Promise<string | undefined> {
 		return this.#getApiKeyOrNoAuth(model.provider, () =>
 			this.authStorage.getApiKey(model.provider, sessionId, {
 				baseUrl: model.baseUrl,
 				modelId: model.id,
 				credentialSelector: options.credentialSelector,
+				signal: options.signal,
 			}),
 		);
 	}
@@ -2582,12 +2583,13 @@ export class ModelRegistry {
 		provider: string,
 		sessionId?: string,
 		baseUrl?: string,
-		options: { credentialSelector?: AuthCredentialSelector } = {},
+		options: { credentialSelector?: AuthCredentialSelector; signal?: AbortSignal } = {},
 	): Promise<string | undefined> {
 		return this.#getApiKeyOrNoAuth(provider, () =>
 			this.authStorage.getApiKey(provider, sessionId, {
 				baseUrl,
 				credentialSelector: options.credentialSelector,
+				signal: options.signal,
 			}),
 		);
 	}

package/src/eval/js/tool-bridge.ts

@@ -30,7 +30,7 @@ function toolResultHasError(result: AgentToolResult): boolean {
 }
 
 function getTool(session: ToolSession, name: string): AgentTool {
-	const tool = session.getToolByName?.(name);
+	const tool = session.getToolForExecution ? session.getToolForExecution(name) : session.getToolByName?.(name);
 	if (!tool) {
 		throw new ToolError(`Unknown tool from js runtime: ${name}`);
 	}

package/src/gjc-runtime/deep-interview-draft.ts

@@ -17,6 +17,7 @@ import { type DeepInterviewRepairResult, runDeepInterviewRepairCommand } from ".
 import { canonicalDeepInterviewJson, validateDeepInterviewV1Envelope } from "./deep-interview-state";
 import { modeStatePath } from "./session-layout";
 import {
+	isNativeDeepInterviewV1,
 	readExistingStateForMutation,
 	transformGuardedWorkflowEnvelopeAtomic,
 	verifyWorkflowEnvelopeReceiptValue,
@@ -295,7 +296,7 @@ async function revision(cwd: string, session: string): Promise<{ revision: numbe
 	if (receipt === "receipt-missing") throw new Error("DI_RECEIPT_MISSING");
 	if (receipt === "checksum-mismatch") throw new Error("DI_RECEIPT_CHECKSUM_MISMATCH");
 	try {
-		if (receipt === "native-valid") validateDeepInterviewV1Envelope(observed.value);
+		if (isNativeDeepInterviewV1(observed.value)) validateDeepInterviewV1Envelope(observed.value);
 	} catch {
 		throw new Error("DI_STATE_SCHEMA_INVALID");
 	}

package/src/gjc-runtime/deep-interview-recorder.ts

@@ -101,6 +101,21 @@ export interface TransitionValidationResult {
 // Pure helpers: records
 // =============================================================================
 
+/**
+ * `deepInterview.dimension` is agent-supplied free text on post-topology asks, but the persisted
+ * envelope only accepts canonical dimension ids. Fold obvious case/label variants down, and drop
+ * anything unrecognized rather than persisting a value the validator rejects.
+ */
+function canonicalDimension(value: string | undefined): string | undefined {
+	if (value === undefined) return undefined;
+	const normalized = value.trim().toLowerCase();
+	if (normalized === "topology") return "topology";
+	for (const dimension of ["goal", "constraints", "criteria", "context"]) {
+		if (normalized === dimension || normalized.startsWith(`${dimension} `)) return dimension;
+	}
+	return undefined;
+}
+
 export function buildAnswerShell(
 	input: DeepInterviewAnswerInput,
 	now: string = new Date().toISOString(),
@@ -116,7 +131,7 @@ export function buildAnswerShell(
 		selected_options: input.selectedOptions,
 		custom_input: input.customInput,
 		component: input.component,
-		dimension: input.dimension,
+		dimension: canonicalDimension(input.dimension),
 		ambiguity_at_ask: input.ambiguity,
 		lifecycle: "answered",
 		answered_at: now,

package/src/gjc-runtime/state-writer.ts

@@ -298,7 +298,7 @@ export function workflowEnvelopeContentSha256(value: unknown): string {
 		.update(JSON.stringify(canonicalizeJson(withoutReceiptChecksum(value))))
 		.digest("hex");
 }
-function isNativeDeepInterviewV1(value: Record<string, unknown>): boolean {
+export function isNativeDeepInterviewV1(value: Record<string, unknown>): boolean {
 	if (value.skill !== "deep-interview") return false;
 	return value.schema_version === 1 || (isPlainObject(value.state) && value.state.schema_version === 1);
 }