@gajae-code/coding-agent 0.12.0 → 0.12.2

package/CHANGELOG.md

@@ -2,13 +2,106 @@
 
 ## [Unreleased]
 
+## [0.12.2] - 2026-07-30
+
+### Added
+
+- `gjc ultragoal quality-gate init` scaffolds a multi-surface quality-gate template (`--surface` repeatable, `--out` required) so agents can fill evidence once and use read-only `quality-gate validate` multi-error diagnostics instead of discovering missing fields one checkpoint at a time (#3474).
+- Ralplan can persist a typed `disposition` stage (`ralplan.review_conflicts.v1`) when Architect and Critic prescribe incompatible actions on the same plan target. Writes fail closed until every conflict has an explicit disposition, and source receipts must resolve against the same-pass Architect/Critic rows in the run index (#2902).
+- Published bounded, redacted, hash-bound sealed perf-corpus memory evidence and an output-free replay notebook. The authenticated analysis identifies sustained heap growth on the `agent-session` and `tui` surfaces while keeping RSS/native allocation and p95 claims explicitly out of scope.
+- The interactive terminal’s responsive IRC/todo work-lane contract now covers exact narrow/wide geometry, requested versus effective IRC visibility, direct-root pin ordering, todo lane bounds, remapped IRC toggles, and live composer shortcut hints.
+- Managed-session startup now preserves bounded Windows ACL and identity failure classifications in path-redacted recovery guidance without broadening permissions, elevation, or unsafe fallback.
+
+### Fixed
+
+- Terminal input now normalizes Option/Meta navigation and psmux modified-Enter encodings through the native key parser, keeping legacy, Kitty CSI-u, and modifyOtherKeys behavior consistent.
+- Ultragoal CLI replay evidence now accepts any argv `command` instead of a small conservative executable allowlist. Proving a CLI-surface change with the project's own test runner (e.g. `bun test <file>`) was impossible: the allowlist only permitted `--version` probes, `bun/node -e "console.log(...)"` literals, read-only `git`, and `gjc read|status`, so real verification commands were rejected and forced agents into `replayExempt` metadata that additionally demanded a screenshot/automation/PTY fallback artifact. `replaySafe: true` is now the gating attestation, backed by the existing sandbox (subprocess isolation with explicit argv and no shell, timeout kill, 1 MiB output cap, env scrubbing). Every other rail is unchanged and still fails closed: shell-string commands, `replaySafe` not true, dangerous env vars, stdout/`recordedStdout` mismatch, and unexpected exit codes are all still rejected (#3533).
+- Ultragoal CLI replay evidence now reads the replay file referenced by an `executorQa.artifactRefs` entry whose `kind` is `cli-replay`. Such a row short-circuited as an *inline* replay record, so its `path` was never read and validation failed with a confusing `schemaVersion must be 1` diagnostic pointing at the ref instead of the file — forcing an undocumented workaround of renaming the ref's `kind`. A row is now treated as inline only when it actually carries replay fields (#3533).
+- Broker artifact cleanup no longer promotes a non-empty `cleanup_pending` quarantine to transcript-phase completion. The broker advances only when the retained quarantine is root-only/empty or when the lower layer returns `artifacts_removed`, so artifact bytes cannot vanish behind a success receipt (#3489).
+- `gjc --worktree` / `gjc -w` launch no longer crashes with a raw uncaught `EEXIST` when the worktree bucket directory (`<repo>.gajae-code-worktrees`) is a broken symbolic link to unmounted or offloaded cold storage. The launch distinguishes dangling links and non-directory entries from valid directory symlinks or Windows junctions, reclassifies mkdir races, avoids disclosing raw link targets or unsafe shell commands, and never deletes or replaces an obstructing entry.
+- POSIX parent identity reproof/fsync is now centralized before every promotable artifact-phase result, preventing a crash-window where a rename is lost after durable retirement is recorded (#3489).
+- Artifact retirement, planned paths, retained authority, and transcript retry in both managed reconciliation and deletion now bind to the newest published `pendingEvidence` attempt, preventing stranded detached transcripts at paths absent from the newest receipt after a crash (#3489).
+- Detached task receipts for in-memory parent sessions no longer advertise dead `agent://` output URIs. TaskTool allocates a session-lifetime durable artifact root under the process temp directory, persists child outputs there, authorizes parent and same-session descendants for scoped resolution, and omits the URI entirely when durable allocation fails (#3471).
+- Managed-session replacement and cleanup now bind Windows destination mutation to exact native identity, keep lock acquisition/release retryable without reviving lost ownership, and report retained artifact payloads as `cleanup_pending` until only the verified root remains.
+- Resuming a session no longer crashes with an unhandled rejection when another session transition is already running. The session picker dispatches resume through a void-returning callback, and `handleResumeSession` had no re-entrancy guard, so a second selection (or a resume issued while compaction, handoff, or a fork was in flight) reached `switchSession` and the `{ code: "busy" }` transition error rejected a promise nobody awaited. Resume now ignores an overlapping request with a status message, reports a busy transition as status, and still propagates every other failure. The progress lease is released on all paths.
+- The interactive `Working…` indicator now remains visible and explicitly labels owner-scoped detached background work across foreground completion, provider errors, pending-submission aborts, and job completion, without resurrecting after TUI disposal (#3479).
+- Activity-indicator suspension now detaches and restores the exact owned loader instead of stopping foreign transition UI; optimistic pre-init prompts still show and clear their spinner, context clear retains its eager teardown contract, and resume cancellation preserves transient state until session mutation actually begins.
+- Activity-indicator stop and suspension helpers now fail safely for lightweight controller contexts with absent or partial status rails, while full interactive contexts retain exact loader detach/restore ownership.
+
+## [0.12.1] - 2026-07-29
+
+### Fixed
+
+- Provider retry classification prefers the typed `stream_first_event_timeout` transport fact when present, falling back to error-message regex for message-only callers (#3496).
+- Team Linux worker memory-guard replacement no longer holds the team task-mutation fence across the successor startup-ack wait, so concurrent `worker-startup-ack` can publish and selector-replacement no longer hangs under CI contention.
+- Kitty/Ghostty inline images no longer remain visually pinned when transcript, pinned, or overlay rows are replaced, removed, scrolled, resized, or fully repainted. The TUI now parses only bounded named placements, soft-deletes overwritten placements from the previously committed physical frame, retains transmitted pixels, and restores placements from application scrollback without retransmitting image data.
+- Reviewer `report_finding` evidence is no longer injected into caller-owned strict JTD completion data; full findings are published separately through a bounded artifact reference, and failed evidence publication now fails the task closed (#2893).
+- Managed-session startup failures now include their bounded preparation classification (and path-free native durability diagnostic when available), so Windows launch crashes no longer collapse to an unactionable generic error while filesystem paths and raw OS messages remain redacted (#3383).
+- Single-model sessions now rotate immediately to another stored provider credential after a content-free quota or rate-limit failure, without requiring a synthetic model fallback chain. Credential rotation is replay-safe for content-free failures regardless of extension lifecycle participation, and traverses the full credential pool independent of `retry.maxRetries` (#3491).
+- External credential discovery now follows `CLAUDE_CONFIG_DIR` and `CODEX_HOME` instead of always reading `~/.claude` and `~/.codex`, so importing from an account switcher (or any relocated Claude Code / Codex CLI config root) picks up the account the launching shell selected. Both variables resolve through the credential env trust boundary and must be absolute; redacted summaries name the variable, never the resolved path.
+- The `acp_conformance` CI job runs again. The pinned upstream `acpx` checkout resolves its own imports (`@agentclientprotocol/sdk`, `zod`) from its own tree, but its dependencies were never installed, so the corpus runner aborted with `Cannot find module 'zod/v4'` before executing a single case. The checkout is now installed after provenance verification, and the reused warm cache still skips the reinstall.
+
+### Added
+
+- User-created Telegram forum topics can now start a GJC session by selecting the home folder, choosing a verified recent work folder, or entering an explicit folder path. The selected topic is adopted by the new session without creating or deleting a separate Telegram topic.
+
+### Fixed
+
+- Detached subagents spawned by the `task` tool are resumable again. The resume gate treated a missing record-level `sessionFile` as missing context even though task and managed-persistence sessions retain the descriptor consumed by the resume runner, so persisted role agents always fell back with `context_unavailable`. Resume eligibility now accepts an owner-compatible retained descriptor while preserving `not_found`, explicit `context_unavailable`, missing-runner `no_runner`, and `resume_failed` outcomes.
+- Ralplan supports opt-in automatic handoff to ultragoal or team through a durable runtime-owned final receipt, with read-only team preflight and PLANNING-STUCK dominance.
+- Subagent setup failures now retain a bounded, redacted cause through live progress, async snapshots, inspect/await, and terminal receipts instead of reporting an empty generic failure.
+- Telegram notification sound can be set to all, important, or none; the reference CLI exposes this with `--sound <all|important|none>`, defaulting to all. Important (ask/idle only) and none are explicit opt-ins for quieter notifications.
+- First-event provider timeouts are configurable and replayed only by AgentSession with a bounded attempt budget, progress-aware safety checks, and measured exhaustion details.
+### Fixed
+- Telegram image delivery now converts WebP and other decodable image formats to Telegram-compatible JPEG or PNG photos, preserves MIME types for files sent with `telegram_send`, and falls back to named document uploads when conversion is unsupported or invalid.
+- `bun run install:dev` now removes only Bun launchers that resolve to the current checkout's CLI wrapper before validating the managed source link, preventing `bun link` from leaving `~/.bun/bin/gjc` ahead of the new `~/.local/bin/gjc` link on `PATH`.
+- A same-tree detached/resumed subagent could not read a verified `agent://`/`artifact://` reference its parent could read (`No session - agent outputs unavailable`), even though parent/child/sibling tree reads are an explicit acceptance criterion of #326: the runtime never supplied `ToolSession.getAuthorizedArtifactsDirs`, so an adopted subagent (whose own `getArtifactsDir()` intentionally collapses to `null`) reached the scoped resolver with zero authorized directories. `ToolSession` now exposes `getAuthorizedArtifactsDirs`, derived only from the session's own explicitly adopted/shared `ArtifactManager` directory, and it is threaded through `read`, `find`, `search`, `ast_grep`, and `ast_edit`'s internal-URL resolution. No registry-wide session enumeration was added; unrelated sessions, missing metadata, and integrity failures remain denied and fail-closed exactly as before (#3302).
+- The auth-broker connection (`GJC_AUTH_BROKER_URL` / `GJC_AUTH_BROKER_TOKEN`) is now resolved from trusted environment sources only. `discoverAuthStorage()` turns that configuration into the `AuthStorage` used for every provider, so reading it through the merged view that includes the caller's `cwd/.env` let a repository replace the agent's credential store wholesale — serving the credentials it authenticates with and receiving the ones it writes back. Resolution now uses the non-project resolver; shell, config-file and token-file configuration is unchanged.
+- Image generation now resolves its OpenAI base URL and its `GOOGLE_API_KEY` fallback from trusted environment sources only. Both were read through the merged view that includes the caller's `cwd/.env`, so a repository could plant a `.env` choosing where authenticated image requests go, or supplying the credential they authenticate with. They now use the non-project resolver; shell and user-level configuration is unchanged, and the trusted `getEnvApiKey("google")` lookup still takes precedence over the fallback.
+- GJC-managed tmux sessions work on macOS again. `gjc session create` failed with `gjc_tmux_profile_tag_failed_cleanup_failed` and leaked the session it had just created, and every close path failed with `gjc_tmux_owner_unverifiable` or `managed_owner_supervisor_signal_failed`. Three non-Linux gaps fed each other: guarded mutations pinned `#{pid}` to the placeholder PID that non-Linux server probes report (which no live tmux server can match), the owner start-time proof only read `/proc`, and SIGTERM dispatch only used the pidfd/handle-backed native signal that deliberately fails closed on macOS. Guards now emit the `#{pid}` clause only for a proven PID, the start-time proof falls back to the natives process incarnation off Linux, and macOS delivers SIGTERM to the already-proved owner PID. Session identity is still pinned by session id, session name and owner generation, and Linux behaviour is unchanged.
+
+### Changed
+
+- Session Observer now incrementally projects append-only session messages and narrowly patches late tool results, avoiding repeated full-history transcript projection while preserving eager output parity and safe full-projection fallback for ambiguous source changes.
+- Compaction now publishes complete pruned tool outputs as session artifacts transactionally, carries active goal/workflow/todo state into summaries, and skips synthetic auto-continue when no unfinished work remains.
+
+### Fixed
+
+- Explicit `--mcp-config` sessions now honor each server's configured connection timeout during startup instead of aborting otherwise healthy tools-only servers at the ordinary 1.75-second startup ceiling; sessions without an explicit config retain the existing bounded startup policy.
+
+### Resume fixes
+
+- Eager todo initialization now gives the model the actual phased `todo_write` payload shape (`ops` → `init` → `list` → `phase`/`items`) instead of instructing it to send unsupported `content`, `details`, and status fields, preventing the first forced todo call from failing validation (#3403).
+
+### Fixed
+- Fast CLI help now advertises the active `search` built-in tool instead of the retired `grep` name.
+- `bun run restart:sdk-broker` no longer crashes with an uncaught `unknown broker operation` error when the live broker predates the `broker.shutdown` operation; the restart now falls back to an identity-fenced `SIGTERM` on the published broker pid, which stops that process through the same rollback path before the replacement is started.
+- `bun run restart:sdk-broker --close-session-hosts` closes the broker-hosted sessions before replacing the broker, so ACP clients no longer reattach to session hosts that keep serving the source they were spawned with. Only sessions served by a `sdk session-host-internal` process are selected, and each one is closed through the live broker's verified-identity teardown.
+
+- Coordinator MCP now reconciles canonical structured questions from every workflow stage without misclassifying row-level gate diagnostics as malformed pagination, and unwraps accepted SDK gate-answer envelopes before reporting the terminal resolution.
+- Queued named tool choices are revalidated against the live model and active tool set before each request, preventing first-turn eager todo, resolve, or yield flows from sending a stale forced choice after preflight tool changes.
+- Ralplan role-agent writes now resolve an existing run's immutable owner session instead of creating workflow state and artifacts under each Planner/Architect/Critic transcript session; conflicting explicit session ids fail closed, and receipts expose the owner `session_id`.
+- Subagent task panels now show the fast-mode glyph for the resolved provider in both live and completed states (#3402).
+- Auto-retry now strips the whole trailing run of failed assistant attempts before continuing. A turn wedged by an `invalid_prompt` repair leaves two error assistant messages behind, and dropping only the last one left an assistant tail that `agent.continue()` refuses, so the retry died with "Retry continuation failed to start" and the turn was lost.
+
+- Session Observer now receives persisted subagent session paths on lifecycle and progress events, so active ralplan reviewer transcripts render instead of remaining at `No transcript entries yet`.
+### Changed
+
+- Bash tool output now keeps only the last 1 KiB when it exceeds the inline capture budget, reducing noisy model input and nudging callers toward focused commands and dedicated search tools. Users who explicitly configure `tools.artifactTailBytes` or `tools.artifactHeadBytes` can set the tail budget or opt into head+tail middle elision. Complete streams received by the Bash tool remain artifact-backed when storage is available; client-truncated ACP tails stay explicitly marked incomplete and cannot be reconstructed locally. Direct user `!` commands retain the existing shared executor window.
+
 ## [0.12.0] - 2026-07-28
 ### Resume fixes
 
+- Status-line pull-request discovery no longer lets the background `gh pr view` process inherit the interactive TUI's stdin, preventing a misconfigured or prompting `gh` executable from stealing keystrokes; the lookup now also fails closed when `gh` is unavailable and terminates after a bounded timeout (#3354).
+- Completed `!` shell commands issued during an active agent turn now leave the bottom-pinned pending surface immediately instead of obscuring the live status area until the next prompt; the completed command is still retained for normal transcript insertion.
 - The typed deep-interview repair CLI (#3040 and its follow-ups) was reverted and replaced with a minimal staged-transition surface: `gjc deep-interview stage --for <transition> --input '<json>'` (or `@file`), `check`, `apply`, and `discard`. The payload is one JSON document merged losslessly into current state — no per-field flag grammar. The session resolves from `GJC_SESSION_ID`, exactly one pending draft exists per session (no `--draft-id`), and the draft records the state revision it was staged against so `apply` CAS-checks it runtime-side; a stale draft is auto-invalidated with typed recovery guidance. `check` dry-runs the identical merge `apply` performs. Validation is core-schema only (envelope shape, bounded input sizes, locked intent-contract immutability); free-form interview fields pass through untouched.
+- `gjc team` workers now publish their own heartbeat while a turn or owned background job is active, so a worker inside a single long tool call is no longer reported stale and stripped of its task claim. Liveness was published only when the model remembered to call `gjc team api update-worker-heartbeat` between turns, so any tool call longer than `GJC_TEAM_HEARTBEAT_STALE_MS` (default 120s) — a build, a test suite, a large read — caused the claim file to be deleted, the `in_progress` task to be reset to `pending`, and the worker to be refused re-claim with `worker_not_live:<worker>:stale_heartbeat` while it was still running, all against a 30-minute claim lease. The worker session now publishes at a third of the stale window (minimum 1ms, capped at 30s) from the top-level session only, and `gjc team` exports the configured window into worker panes so a tightened window applies to the workers policing it too. Recovery semantics are unchanged: a worker that publishes nothing is still recovered exactly as before.
+- With all-tool discovery enabled, `task.eager` now keeps the `task` tool active so its delegation instruction can actually be followed; discovery guidance now distinguishes activating a tool from executing it and directs explicit parallel/delegation requests to discover the subagent capability before claiming workers started.
+- Unknown `gjc team api` operations now fail as normal CLI usage errors instead of invoking the global uncaught-exception crash reporter. JSON mode returns a compact typed receipt with the invalid operation and suggestions; text mode prints one actionable line. Common mistakes such as `heartbeat` now point to `read-worker-heartbeat` or `update-worker-heartbeat`, and operation validation runs before team-state lookup so a missing `team_name` cannot hide the actual command error.
 - Memory consolidation redacts GitHub tokens. The scrubber covered AWS ids, JWTs and keyword-prefixed keys, but GitHub tokens carry none of those keywords, so they reached `MEMORY.md` and `memory_summary.md` verbatim — and the summary is injected into every later session. Now covers the same three prefixes the contribution-prep scrubber already handled.
 - The native skill hook resolves its config paths through the trusted directory helpers. It read `GJC_CODING_AGENT_DIR` / `GJC_CONFIG_DIR` straight from `process.env`, which Bun populates from `cwd/.env` before any module runs, so a repository could point the hook at a directory it ships and inject its own `skills.customDirectories` — bypassing the escalation guards that already exist for exactly this.
 - Workflow settings are read from the config root under home. `GJC_CONFIG_DIR` is documented as a dirname under home and `dirs.ts` implements it that way, but the ralplan, ultragoal and deep-interview settings readers used the value as a full path, so setting it to the documented form made them look under the current working directory and silently fall back to built-in defaults.
+- Session resident-cache directories are now swept when the process exits abnormally. `EphemeralBlobStore` removed its directory only in `dispose()`, and the directory name embeds the pid, so a terminated run's cache could never be collected by a later run. A developer machine held seven of them from dead pids, up to 26 days old, totalling 13.4 MB of externalized session text.
 - Align managed fallback abort-after-exhaustion expectations with #3257 ownership release: a subscriber abort at terminal `message_end` no longer expects a second `requestRunTerminal(cancelled)` because the logical-run owner is already cleared.
 - Python eval timeout annotations now prefer the caller-configured `timeoutMs` over remaining wall-clock budget so async setup cannot flake second formatting in CI.
 - Overflow maintenance now stops cleanly when no-op compaction would replay the same oversized request; the runtime status explains that `/clear` preserves the current session ID before retrying.
@@ -18,6 +111,14 @@
 - The package no longer advertises `./extensibility/custom-commands/bundled/review`. That module was deleted when the bundled agents were trimmed to four canonical role agents (#922), but its `exports` entry stayed, so the published surface declared a subpath that fails to resolve. A test now checks every declared `exports` / `main` / `module` / `types` / `bin` target resolves to a file that exists.
 - `docs/fs-scan-cache-architecture.md` now points at files that exist. It referenced a `packages/natives/src/` tree that the package does not have (its JS surface is the generated `native/index.js` / `native/index.d.ts`), the grep tool as `tools/grep.ts` when it is `tools/search.ts`, and a `src/patch/index.ts` for the hashline flows that live in `tools/ast-edit.ts`.
 - Provider base URLs resolved from the environment by the model registry are now read from trusted sources only. `resolveProviderBaseUrlFromEnv()` used the merged view that includes the caller's `cwd/.env`, and it is generic — `<PROVIDER>_BASE_URL` is derived for any provider on top of the explicit `ANTHROPIC_BASE_URL` / `OPENAI_BASE_URL` / `GOOGLE_BASE_URL` / `GEMINI_BASE_URL` aliases — so a repository could plant a `.env` that redirected authenticated traffic for every provider, including re-admitting a redirect the provider-level resolvers reject. It now uses the non-project resolver; shell and user-level configuration is unchanged.
+- Web-search provider endpoints and keys are now resolved from trusted environment sources only: `KIMI_SEARCH_BASE_URL` / `MOONSHOT_SEARCH_BASE_URL`, `KIMI_SEARCH_API_KEY` / `MOONSHOT_SEARCH_API_KEY`, `XAI_SEARCH_BASE_URL`, and `ANTHROPIC_SEARCH_BASE_URL` / `ANTHROPIC_SEARCH_API_KEY`. Each provider sends its credential to the endpoint it resolves, so reading them through the merged view that includes the caller's `cwd/.env` let a repository redirect search traffic and collect the user's search credentials. Shell and user-level configuration is unchanged.
+- The Exa MCP API key (`EXA_API_KEY`) is now resolved from trusted environment sources only. The key authenticates every Exa MCP call and travels in the request URL, so reading it through the merged view that includes the caller's `cwd/.env` let a repository decide which account the agent's searches run through — and therefore who could see those queries. `findApiKey()` also now returns `null` rather than `undefined` when nothing supplies a key, matching its declared type.
+- The notifications channel switch and the Telegram reference client's bot credentials are now resolved from trusted environment sources only. `notificationsEnabled()` read `GJC_NOTIFICATIONS` / `GJC_NOTIFICATIONS_TOKEN` straight from the merged view that includes the caller's `cwd/.env` — unlike its siblings in `config.ts` and `session-control.ts`, which already read an injected env record — so a repository could open the session control/answer channel. The Telegram client's `GJC_TG_BOT_TOKEN` / `GJC_TG_CHAT_ID` fallbacks had the same exposure, and that client is normally run from inside a repository, so a planted bot token would have routed the session's notifications and the operator's replies to a bot the repository chose.
+- SearXNG search configuration (`SEARXNG_ENDPOINT`, `SEARXNG_TOKEN`, `SEARXNG_BASIC_USERNAME`, `SEARXNG_BASIC_PASSWORD`) is now resolved from trusted environment sources only, completing the web-search provider family. The endpoint receives the `Authorization: Basic`/`Bearer` header, so reading these through the merged view that includes the caller's `cwd/.env` let a repository redirect the search and hand over the credential. An intentionally empty username or password remains meaningful for basic auth and is still honoured when it comes from a trusted source, while an empty value planted by the project `.env` is rejected.
+- The `natives-*` architecture docs no longer describe native APIs that were removed. `countTokens`, `PhotonImage.parse/resize/encode` and `projfsOverlayProbe/Start/Stop` are absent from the addon's JS surface, and `tokens.rs`, `image.rs` and `projfs_overlay.rs` are not in the crate. ProjFS now reaches users through the iso backend (`isoProbe`/`isoStart`/`isoStop` with `IsoBackendKind.Projfs`, implemented in the `pi-iso` crate), and image decode/transform/encode moved to `Bun.Image` in TypeScript.
+- `docs/ooo-bridge-extension-contract.md` no longer inverts the scope of the two directory overrides. `GJC_CONFIG_DIR` is a home-relative name (`<home>/<name>`, default `~/.gjc`), not a project directory name, and `GJC_CODING_AGENT_DIR` overrides the agent directory path through `path.resolve` rather than naming a directory under `$HOME`.
+- Telegram deep-interview multi-select prompts now mark each option as checked or unchecked after every selection while preserving canonical option values and numeric callback routing.
+- SDK revision-store spill directories are now removed when the process exits abnormally. `close()` already removed them, but a terminated session never reaches `close()`, so the spilled snapshot payload stayed in the system temp directory — unlike the sibling `shell-snapshot` and `python-runner-artifact` caches, which already registered a postmortem sweep. Only `mkdtemp` spill directories are tracked; a caller-supplied `storageDir` is durable session storage and is never swept.
 - The `ask` tool no longer rejects a JSON-string-encoded single-sided Round 0 payload before coercion; only the retired contract+review pair stays terminal, so a provider that serializes `questions` as a string no longer drives the model into an unbounded retry loop.
 - Browser launch overrides (`PUPPETEER_EXECUTABLE_PATH`, `PUPPETEER_PROXY`, `PUPPETEER_PROXY_BYPASS_LOOPBACK`, `PUPPETEER_PROXY_IGNORE_CERT_ERRORS`) are now resolved from trusted environment sources only. `Bun.env` is `process.env` and the env module merges the caller's `cwd/.env` into it, so a repository could previously plant a `.env` that chose the browser binary, routed every request through its own proxy, and disabled certificate validation. Resolution now goes through the non-project resolver (launching shell plus GJC/user-owned `.env` files); shell-level configuration is unchanged.
 - The tab-worker native-free import contract no longer invents import edges: its re-export scanner matched a bare `export` declaration followed anywhere later in the file by ` from "…"`, so a `from` inside a comment or string produced a phantom dependency. It now matches real re-export syntax (`export * from`, `export * as ns from`, `export { … } from`) only, and still fails on genuine barrel imports and re-exports.
@@ -29,10 +130,20 @@
 - Interactive TUI `/resume` commits a status-container progress lease before inspect/migration/switch work and clears it on every exit path, with generation-scoped render-commit wait that fails open when the terminal is stopped or unavailable (#2914).
 - Interactive `/resume` progress lease fails open when `statusContainer` or UI lacks child-mutation/render-commit surface, preserving headless/minimal controller contexts without weakening full TUI progress-before-switch (#3234 post-merge).
 - The documented `GJC_OPENAI_CODE_WEB_SEARCH_MODEL` environment variable now overrides the OpenAI-code web-search model; it is resolved GJC-first ahead of the legacy `PI_CODEX_WEB_SEARCH_MODEL` name (previously only the legacy name was read, so the documented name was a silent no-op).
+- ACP prompt completion no longer hangs clients: terminal prompt outcomes are now projected through ACP after the SDK finalizes them.
+- Prompt terminalization now exposes exactly one normalized outcome per accepted prompt, preserving the terminal reason or controlled failure code across SDK and ACP clients.
+- ACP clients can reconnect to a live session while replaying their MCP server declarations. The live session keeps its immutable MCP configuration instead of rejecting the reconnect as a configuration mutation.
+- ACP `AskUserQuestion` now routes through the registered SDK UI provider as a schema-valid form elicitation, including selector, free-text, and navigation-control responses for Air.
+- Telegram `/session_create` and cold resume no longer route macOS or other non-Linux hosts through the Linux-only managed-owner supervisor. Non-Linux launches now bind success and cleanup to the exact tmux server, native session, and live pane process identities, scrub inherited managed-owner authority, and reject children that die during launch stabilization; Linux keeps its existing owner-isolation transaction.
+
+### Changed
+
+- Session Observer and the main transcript viewer no longer re-project and re-layout their full transcript on every paint. Source changes still refresh through registry/session-event notifications, while navigation rebuilds only affected layout variants; deterministic counters and replacement-safety coverage preserve selection, follow-tail, raw, expanded, fullscreen, mouse, theme, width, and source-replacement behavior.
 
 ### Added
 
 - Deterministic tests for session_switch await policy (selector defer vs default/branch await), control-drain ordering, host pre-response readiness gating, and resume progress lease-before-switch behavior (#2914).
+- Added `bun run restart:sdk-broker` for authenticated, identity-checked SDK broker replacement during local Air/ACP testing.
 - Added an isolated Bun memory-baseline corpus with short/soak profiles across CLI, AgentSession, blob buffers, workers, Telegram, TUI, and shared/native boundaries; reports keep RSS, heap, external buffers, process-tree endpoints, active resources, throughput, and teardown evidence separate and advisory until variance is characterized.
 - Telegram per-tool activity is now opt-in and remains durably controllable with `/toolactivity on|off` or the Notifications preferences UI; disabling it suppresses tool start/completion success and error bubbles without hiding assistant, ask, or session notifications.
 - `/model`, `/login`, and `/provider` now order providers through one shared ranking: providers you already have (valid auth, in-flight validation, or a configured non-OAuth provider) come first, then providers whose stored credentials failed validation, then a curated list of well-known providers with regional and device variants grouped behind their primary, then everything else by display name. In `/model` rows, role/default rank and recent usage still take precedence over provider order (#3243).

package/dist/types/async/job-manager.d.ts

@@ -16,6 +16,8 @@ export interface AsyncJob {
     promise: Promise<void>;
     resultText?: string;
     errorText?: string;
+    /** Safe, bounded cause when session setup failed before the LLM began work. */
+    setupFailureSummary?: string;
     metadata?: AsyncJobMetadata;
     /**
      * Registry id of the agent that registered the job (e.g. "0-Main",
@@ -48,11 +50,15 @@ export interface AsyncJobMetadata {
  * non-terminal and non-delivering: the run suspended at a safe boundary and the
  * subagent can be resumed from its persisted sessionFile. `completed` always
  * wins a race with a late pause because the run returns it once it has actually
- * finished.
+ * finished. A `failed` outcome retains a safe setup diagnostic for receipt rendering.
  */
 export type SubagentRunOutcome = {
     kind: "completed";
     text: string;
+} | {
+    kind: "failed";
+    text: string;
+    setupFailureSummary?: string;
 } | {
     kind: "paused";
     note?: string;
@@ -110,7 +116,11 @@ export interface SubagentRecord {
     historicalJobIds: string[];
     status: SubagentLifecycle;
     sessionFile: string | null;
-    /** False for ephemeral sessions (no persistent artifacts dir). */
+    /**
+     * Explicit veto, not a complete availability result. False always denies;
+     * true still requires an owner-compatible descriptor or non-blank session
+     * file, followed by a separately available runner (`no_runner` otherwise).
+     */
     resumable: boolean;
     queued?: {
         ownerId?: string;
@@ -287,7 +297,11 @@ export declare class AsyncJobManager {
         status?: SubagentLifecycle;
         reason?: string;
     };
-    /** Resume a non-running subagent from its sessionFile, optionally injecting a message first. */
+    /**
+     * Resume a non-running subagent from retained context: an owner-compatible
+     * descriptor or a legacy session file. Workflow routing keeps `not_found`,
+     * `context_unavailable`, `no_runner`, and `resume_failed` distinct.
+     */
     resumeSubagent(subagentId: string, filter?: AsyncJobFilter, message?: string): {
         ok: boolean;
         status?: SubagentLifecycle;

package/dist/types/config/settings-schema.d.ts

@@ -133,6 +133,12 @@ export declare const SETTINGS_SCHEMA: {
         readonly values: readonly ["copy-retain", "disabled"];
         readonly default: "copy-retain";
     };
+    readonly "sdk.promptDeadlineMs": {
+        readonly type: "number";
+        readonly default: 1800000;
+        readonly description: "SDK-owned prompt deadline; ACP has no separate timeout.";
+        readonly validate: (value: number) => boolean;
+    };
     readonly "notifications.enabled": {
         readonly type: "boolean";
         readonly default: false;
@@ -158,6 +164,17 @@ export declare const SETTINGS_SCHEMA: {
         readonly type: "boolean";
         readonly default: true;
     };
+    readonly "notifications.telegram.sound": {
+        readonly type: "enum";
+        readonly values: readonly ["all", "important", "none"];
+        readonly default: "all";
+        readonly ui: {
+            readonly tab: "notifications";
+            readonly label: "Telegram Notification Sounds";
+            readonly description: "Choose which Telegram notifications play a sound.";
+            readonly editing: "notification-atomic";
+        };
+    };
     readonly "notifications.telegram.rich.enabled": {
         readonly type: "boolean";
         readonly default: true;
@@ -406,6 +423,26 @@ export declare const SETTINGS_SCHEMA: {
             readonly options: "runtime";
         };
     };
+    readonly "session.resumeModelBehavior": {
+        readonly type: "enum";
+        readonly values: readonly ["keepSessionModel", "useCurrentDefault", "ask"];
+        readonly default: "keepSessionModel";
+        readonly ui: {
+            readonly tab: "model";
+            readonly label: "Resume Model Behavior";
+            readonly description: "When resuming a session: keep the model that session last used, switch to the currently configured default model, or ask (TUI only; falls back to keeping the session's model in headless/CLI resume).";
+            readonly options: readonly [{
+                readonly value: "keepSessionModel";
+                readonly label: "Keep session's saved model";
+            }, {
+                readonly value: "useCurrentDefault";
+                readonly label: "Use current default model";
+            }, {
+                readonly value: "ask";
+                readonly label: "Ask on resume (TUI only)";
+            }];
+        };
+    };
     readonly modelTags: {
         readonly type: "record";
         readonly default: ModelTagsSettings;
@@ -423,6 +460,11 @@ export declare const SETTINGS_SCHEMA: {
         readonly default: 0.05;
         readonly validate: (value: number) => boolean;
     };
+    readonly "gjc.ralplan.autoHandoff": {
+        readonly type: "enum";
+        readonly values: readonly ["off", "ultragoal", "team"];
+        readonly default: "off";
+    };
     readonly "gjc.ralplan.maxIterations": {
         readonly type: "number";
         readonly default: 5;
@@ -952,8 +994,8 @@ export declare const SETTINGS_SCHEMA: {
         readonly default: true;
         readonly ui: {
             readonly tab: "appearance";
-            readonly label: "Status Line Action Hints";
-            readonly description: "Show contextual keyboard shortcuts in the status line";
+            readonly label: "Composer Shortcut Hints";
+            readonly description: "Show contextual keyboard shortcuts in the composer placeholder";
         };
     };
     readonly "statusLine.leftSegments": {
@@ -1442,6 +1484,16 @@ export declare const SETTINGS_SCHEMA: {
             readonly description: "Maximum provider stream replay retries for replay-safe transient stream failures. Counts retries, not the first attempt. Set to 0 to disable provider stream retries.";
         };
     };
+    readonly "retry.streamFirstEventTimeoutMs": {
+        readonly type: "number";
+        readonly default: 100000;
+        readonly validate: (value: number) => boolean;
+        readonly ui: {
+            readonly tab: "model";
+            readonly label: "First Event Timeout";
+            readonly description: "Maximum wait for the first provider stream event, in ms. Set to 0 to disable the watchdog.";
+        };
+    };
     readonly "retry.fallbackChains": {
         readonly type: "record";
         readonly default: Record<string, string[]>;
@@ -4209,6 +4261,7 @@ export interface RetrySettings {
     maxDelayMs: number;
     requestMaxRetries: number;
     streamMaxRetries: number;
+    streamFirstEventTimeoutMs: number;
 }
 export interface MemoriesSettings {
     enabled: boolean;
@@ -4314,6 +4367,7 @@ export interface NotificationsSettings {
     telegram: {
         botToken: string | undefined;
         chatId: string | undefined;
+        sound: "all" | "important" | "none";
         btw: {
             enabled: boolean;
         };

package/dist/types/exa/mcp-client.d.ts

@@ -1,7 +1,16 @@
 import type { TSchema } from "@gajae-code/ai";
 import type { CustomTool, CustomToolResult } from "../extensibility/custom-tools/types";
 import type { ExaRenderDetails, ExaSearchResponse, MCPTool, MCPToolWrapperConfig } from "./types";
-/** Find EXA_API_KEY from Bun.env or .env files */
+/**
+ * Find `EXA_API_KEY` from trusted environment sources.
+ *
+ * The key authenticates every Exa MCP call and travels in the request URL, so
+ * whatever can set it decides which account the agent's searches run through —
+ * and therefore who can see those queries. `$env` merges the caller's `cwd/.env`
+ * into `process.env`, so reading it there would let repository content supply
+ * that account. Resolve it the same way provider credentials are: launching
+ * shell plus GJC/user-owned `.env` files, never the project `.env`.
+ */
 export declare function findApiKey(): string | null;
 /** Fetch available tools from Exa MCP */
 export declare function fetchExaTools(apiKey: string | null, toolNames: string[]): Promise<MCPTool[]>;

package/dist/types/exec/bash-executor.d.ts

@@ -1,6 +1,43 @@
 import { type MinimizerOptions } from "@gajae-code/natives";
 import { type ShellMinimizerSettings } from "../config/settings";
+import { type TerminalArtifactPublisher } from "../session/streaming-output";
+export interface BashArtifactSaveSummary {
+    artifactId: string;
+    complete: boolean;
+    omittedBytes?: number;
+}
+export type BashMinimizedSaveReturn = BashArtifactSaveResult | BashArtifactSaveSummary | string | undefined;
+export type BashArtifactSaveResult = {
+    status: "saved";
+    artifactId: string;
+    complete: true;
+    omittedBytes?: undefined;
+} | {
+    status: "saved";
+    artifactId: string;
+    complete: false;
+    omittedBytes: number;
+} | {
+    status: "unavailable";
+} | {
+    status: "failed";
+    diagnostic: string;
+};
+export declare function normalizeMinimizedSaveResultForTests(value: BashMinimizedSaveReturn, originalText: string): BashArtifactSaveResult;
 export interface BashExecutorOptions {
+    /**
+     * Invoked when the native minimizer rewrote the command's output, giving
+     * the caller a chance to persist the lossless original capture (typically
+     * via the session's `ArtifactManager`). Complete saves preserve the
+     * historical `[raw output: artifact://<id>]` footer; capped saves carry an
+     * honest retained/omitted reference. A legacy string id is still accepted
+     * for non-tool callers and is classified from the original UTF-8 byte count.
+     */
+    onMinimizedSave?: (originalText: string, info: {
+        filter: string;
+        inputBytes: number;
+        outputBytes: number;
+    }) => Promise<BashMinimizedSaveReturn>;
     cwd?: string;
     timeout?: number | null;
     onChunk?: (chunk: string) => void;
@@ -19,24 +56,18 @@ export interface BashExecutorOptions {
     /** Artifact path/id for full output storage */
     artifactPath?: string;
     artifactId?: string;
+    /** Optional terminal publisher for managed artifacts without writable paths. */
+    artifactPublisher?: TerminalArtifactPublisher;
+    /** Optional Bash-specific retained tail budget in bytes. */
+    spillThreshold?: number;
+    /** Optional Bash-specific retained head budget in bytes. */
+    headBytes?: number;
     /** Execute without retaining a native Shell in the persistent session registry. */
     oneShot?: boolean;
     /** Ignore user-configured shell command prefixes. Used by constrained read-only shells. */
     ignoreShellPrefix?: boolean;
     /** Skip sourced shell snapshots. Used by constrained read-only shells. */
     disableShellSnapshot?: boolean;
-    /**
-     * Invoked when the native minimizer rewrote the command's output, giving
-     * the caller a chance to persist the lossless original capture (typically
-     * via the session's `ArtifactManager`). The returned id is spliced into
-     * the sink output as `artifact://<id>` so the agent can retrieve the raw
-     * bytes. Return `undefined` to skip the footer.
-     */
-    onMinimizedSave?: (originalText: string, info: {
-        filter: string;
-        inputBytes: number;
-        outputBytes: number;
-    }) => Promise<string | undefined>;
 }
 export interface BashResult {
     output: string;
@@ -48,6 +79,8 @@ export interface BashResult {
     outputLines: number;
     outputBytes: number;
     artifactId?: string;
+    artifactTruncatedBytes?: number;
+    artifactFailureDiagnostic?: string;
 }
 /** Number of persistent shell sessions currently retained (owner gauge). */
 export declare function getShellSessionCount(): number;

package/dist/types/extensibility/extensions/types.d.ts

@@ -7,7 +7,7 @@
  * - Register commands, keyboard shortcuts, and CLI flags
  * - Interact with the user via UI primitives
  */
-import type { AgentMessage, AgentToolResult, AgentToolUpdateCallback, ThinkingLevel } from "@gajae-code/agent-core";
+import type { AgentMessage, AgentToolResult, AgentToolUpdateCallback, RunSettlementProof, ThinkingLevel } from "@gajae-code/agent-core";
 import type { CompactionResult } from "@gajae-code/agent-core/compaction";
 import type { Api, AssistantMessageEvent, AssistantMessageEventStream, Context, ImageContent, Model, ProviderResponseMetadata, SimpleStreamOptions, Static, TextContent, Tool, TSchema, UsageReport } from "@gajae-code/ai";
 import type { OAuthCredentials, OAuthLoginCallbacks } from "@gajae-code/ai/utils/oauth/types";
@@ -22,7 +22,7 @@ import type { ExecOptions, ExecResult } from "../../exec/exec";
 import type { CustomEditor } from "../../modes/components/custom-editor";
 import type { WorkflowGateEmitter } from "../../modes/shared/agent-wire/workflow-gate-broker";
 import type { Theme } from "../../modes/theme/theme";
-import type { ClientBridgePermissionOption, ClientBridgePermissionOutcome, ClientBridgePermissionToolCall } from "../../session/client-bridge";
+import type { ClientBridge, ClientBridgePermissionOption, ClientBridgePermissionOutcome, ClientBridgePermissionToolCall } from "../../session/client-bridge";
 import type { CustomMessage } from "../../session/messages";
 import type { ReadonlySessionManager, SessionManager } from "../../session/session-manager";
 import type { BashToolDetails, BashToolInput, FindToolDetails, FindToolInput, ReadToolDetails, ReadToolInput, SearchToolDetails, SearchToolInput, WriteToolInput } from "../../tools";
@@ -249,8 +249,14 @@ export interface ExtensionContext {
     model: Model | undefined;
     /** Whether the agent is idle (not streaming) */
     isIdle(): boolean;
+    /** Stable resource ownership identifier for the active prompt run. */
+    getActivePromptHandle(): string | undefined;
     /** Abort the current agent operation */
     abort(): void;
+    /** Abort and prove whether resources for a specific prompt settled. */
+    abortPromptAndWait?(handle: string, options: {
+        graceMs: number;
+    }): Promise<RunSettlementProof>;
     /** Whether there are queued messages waiting */
     hasPendingMessages(): boolean;
     /** Typed pending-message counts per queue (steering, follow-up, next-turn). */
@@ -307,6 +313,8 @@ export interface ExtensionContext {
     sdkControl?(operation: string, input: Record<string, unknown>): unknown | Promise<unknown>;
     /** Install a permission callback backed by a live SDK reverse provider lease. */
     setSdkPermissionProvider?(provider: ((toolCall: ClientBridgePermissionToolCall, options: ClientBridgePermissionOption[], signal?: AbortSignal) => Promise<ClientBridgePermissionOutcome>) | undefined): void;
+    /** Install a client bridge backed by a live SDK reverse provider lease. */
+    setSdkClientBridge?(bridge: ClientBridge | undefined): void;
     /** Names of session SDK seams actually installed by the active runtime. */
     sdkBindings?(): readonly string[];
     /** Gracefully shutdown and exit. */
@@ -1001,7 +1009,12 @@ export interface ExtensionActions {
 export interface ExtensionContextActions {
     getModel: () => Model | undefined;
     isIdle: () => boolean;
+    /** Stable resource ownership identifier for the active prompt run. */
+    getActivePromptHandle?: () => string | undefined;
     abort: () => void;
+    abortPromptAndWait?: (handle: string, options: {
+        graceMs: number;
+    }) => Promise<RunSettlementProof>;
     hasPendingMessages: () => boolean;
     /** Typed pending-message counts per queue; optional for embedders without a counted queue. */
     getPendingMessageCounts?: () => {
@@ -1047,6 +1060,7 @@ export interface ExtensionContextActions {
     } | undefined>;
     getJobs?: () => unknown;
     setSdkPermissionProvider?: (provider: ((toolCall: ClientBridgePermissionToolCall, options: ClientBridgePermissionOption[], signal?: AbortSignal) => Promise<ClientBridgePermissionOutcome>) | undefined) => void;
+    setSdkClientBridge?: (bridge: ClientBridge | undefined) => void;
     sdkControl?: (operation: string, input: Record<string, unknown>) => unknown | Promise<unknown>;
     invokeSkill?: (name: string, args?: string, options?: {
         onPreflightAccepted?: () => void;

package/dist/types/extensibility/gjc-plugins/index.d.ts

@@ -2,14 +2,24 @@ export * from "./activation";
 export * from "./compiler";
 export * from "./constrained-hooks";
 export * from "./injection";
-export * from "./installer";
+/**
+ * Public barrel. Mutation primitives are deliberately NOT re-exported here:
+ * `lifecycle.ts` is the sole policy and persistence writer, so the installer
+ * transaction and the registry writers stay reachable only through their own
+ * modules. Re-exporting them would let a caller commit a replacement and
+ * bypass the create-only rule.
+ */
+export { isGjcPluginBundleSource, isGjcPluginSourceShape } from "./installer";
+export * from "./lifecycle";
+export * from "./lifecycle-reconciliation";
 export * from "./loader";
 export * from "./mcp-policy";
 export * from "./observability";
 export * from "./paths";
 export * from "./prompt-appendix";
-export * from "./registry";
+export { loadEffectiveGjcPluginRegistry, readRegistry, registryEntryFingerprint, registryPathForScope, registryRootForScope, sortRegistryEntries, } from "./registry";
 export * from "./runtime-adapters";
+export * from "./runtime-quarantine";
 export * from "./schema";
 export * from "./session-validation";
 export * from "./state";

package/dist/types/extensibility/gjc-plugins/installer.d.ts

@@ -1,13 +1,69 @@
-import { type GjcPluginRegistryEntry, type GjcPluginScope } from "./types";
-export interface InstallGjcPluginOptions {
+import { type GjcLifecycleError, type GjcPluginRegistry, type GjcPluginRegistryEntry, type GjcPluginRegistrySource, type GjcPluginScope, type NormalizedGjcPluginBundle } from "./types";
+export interface GjcBundleTransactionOptions {
     scope: GjcPluginScope;
     cwd: string;
-    force?: boolean;
+    /**
+     * Policy hook evaluated while both scope locks are held. It decides whether
+     * to commit the candidate, report an already-satisfied no-op, or abort with
+     * a typed lifecycle error. Only the lifecycle service supplies this.
+     */
+    decide: (input: GjcBundleTransactionContext) => Promise<GjcBundleTransactionDecision>;
 }
-export interface InstallGjcPluginResult {
-    status: "installed" | "updated" | "unchanged";
-    entry: GjcPluginRegistryEntry;
+export interface GjcBundleTransactionContext {
+    targetRegistry: GjcPluginRegistry;
+    /** Both scopes, deterministically sorted, for cross-scope decisions. */
+    effective: GjcPluginRegistryEntry[];
+    existing: GjcPluginRegistryEntry | undefined;
+    bundle: NormalizedGjcPluginBundle;
+    /** Entry the candidate would produce if committed as-is. */
+    candidate: GjcPluginRegistryEntry;
 }
-export declare function installGjcPluginBundle(source: string, options: InstallGjcPluginOptions): Promise<InstallGjcPluginResult>;
+export type GjcBundleTransactionDecision = {
+    kind: "commit";
+    entry: GjcPluginRegistryEntry;
+} | {
+    kind: "noop";
+    entry: GjcPluginRegistryEntry;
+} | {
+    kind: "abort";
+    error: GjcLifecycleError;
+};
+export type GjcBundleTransactionResult = {
+    status: "committed";
+    entry: GjcPluginRegistryEntry;
+    remnants: string[];
+} | {
+    status: "noop";
+    entry: GjcPluginRegistryEntry;
+    remnants: string[];
+} | {
+    status: "aborted";
+    error: GjcLifecycleError;
+    remnants: string[];
+};
+/**
+ * Serialized bundle transaction: prepare outside the locks, then hold the
+ * user->project locks in a fixed order so the decision sees a consistent
+ * cross-scope view. Only the target scope is ever committed.
+ */
+export declare function runGjcBundleTransaction(source: string, options: GjcBundleTransactionOptions): Promise<GjcBundleTransactionResult>;
+/** Compile a source into a validated candidate bundle without touching disk state. */
+export declare function resolveGjcBundleCandidate<T>(source: string, fn: (input: {
+    bundle: NormalizedGjcPluginBundle;
+    source: GjcPluginRegistrySource;
+}) => Promise<T>): Promise<T>;
+/** Build the registry entry a candidate bundle would produce at a target path. */
+export declare function candidateRegistryEntry(bundle: NormalizedGjcPluginBundle, scope: GjcPluginScope, cwd: string, source: GjcPluginRegistrySource, now: string): GjcPluginRegistryEntry;
+/**
+ * True when a spec has the SHAPE of a GJC bundle source: a filesystem path, a
+ * git locator, or a tarball. This is a pure string test that never touches the
+ * filesystem or the network, so a deleted or unreachable source is still
+ * recognised as GJC-intent and can reach the lifecycle's typed refusal instead
+ * of falling through to npm.
+ *
+ * npm and marketplace specs are never path/git/tarball shaped, so this cleanly
+ * separates the two install worlds.
+ */
+export declare function isGjcPluginSourceShape(source: string): boolean;
 /** True only when the source actually resolves to a GJC plugin bundle (root gajae-plugin.json). */
 export declare function isGjcPluginBundleSource(source: string): Promise<boolean>;