@gajae-code/coding-agent 0.12.1 → 0.12.4

package/CHANGELOG.md

@@ -1,4 +1,42 @@
 # Changelog
+
+## [Unreleased]
+
+## [0.12.4] - 2026-07-30
+
+## [0.12.3] - 2026-07-30
+
+### Fixed
+
+- The release cut no longer deletes previously released changelog headings whose body is empty. `releasedChangelogContent` ran `removeEmptyVersionEntries` before transforming `## [Unreleased]`, so cutting a release replaced the prior empty semver heading instead of inserting the new one above it — v0.12.2 dropped the `## [0.12.1] - 2026-07-29` heading from four package changelogs. Released sections are now immutable history and are always preserved.
+
+## [0.12.2] - 2026-07-30
+
+### Added
+
+- `gjc ultragoal quality-gate init` scaffolds a multi-surface quality-gate template (`--surface` repeatable, `--out` required) so agents can fill evidence once and use read-only `quality-gate validate` multi-error diagnostics instead of discovering missing fields one checkpoint at a time (#3474).
+- Ralplan can persist a typed `disposition` stage (`ralplan.review_conflicts.v1`) when Architect and Critic prescribe incompatible actions on the same plan target. Writes fail closed until every conflict has an explicit disposition, and source receipts must resolve against the same-pass Architect/Critic rows in the run index (#2902).
+- Published bounded, redacted, hash-bound sealed perf-corpus memory evidence and an output-free replay notebook. The authenticated analysis identifies sustained heap growth on the `agent-session` and `tui` surfaces while keeping RSS/native allocation and p95 claims explicitly out of scope.
+- The interactive terminal’s responsive IRC/todo work-lane contract now covers exact narrow/wide geometry, requested versus effective IRC visibility, direct-root pin ordering, todo lane bounds, remapped IRC toggles, and live composer shortcut hints.
+- Managed-session startup now preserves bounded Windows ACL and identity failure classifications in path-redacted recovery guidance without broadening permissions, elevation, or unsafe fallback.
+
+### Fixed
+
+- Terminal input now normalizes Option/Meta navigation and psmux modified-Enter encodings through the native key parser, keeping legacy, Kitty CSI-u, and modifyOtherKeys behavior consistent.
+- Ultragoal CLI replay no longer executes model-authored test source or trusts `replaySafe: true` as arbitrary command authority. Runtime replay is limited to the pinned Bun runtime for `--version` and literal `-e "console.log(...)"`; shells, interpreter code strings, path-qualified executables, tests, install/publish/network/git mutation commands, and arbitrary argv are rejected. Replay cwd/artifact files are realpath-confined, ambiguous rows fail closed, stdout and stderr are checked, and POSIX timeout cleanup signals the process group. Structured test-report fallback remains deliberately unsupported pending a separate trusted-provenance design (#3533).
+- Ultragoal CLI replay evidence now reads the replay file referenced by an `executorQa.artifactRefs` entry whose `kind` is `cli-replay`. Inline, nested, and file-backed replay forms are disambiguated explicitly; mixed or malformed rows fail closed (#3533).
+
+- Broker artifact cleanup no longer promotes a non-empty `cleanup_pending` quarantine to transcript-phase completion. The broker advances only when the retained quarantine is root-only/empty or when the lower layer returns `artifacts_removed`, so artifact bytes cannot vanish behind a success receipt (#3489).
+- `gjc --worktree` / `gjc -w` launch no longer crashes with a raw uncaught `EEXIST` when the worktree bucket directory (`<repo>.gajae-code-worktrees`) is a broken symbolic link to unmounted or offloaded cold storage. The launch distinguishes dangling links and non-directory entries from valid directory symlinks or Windows junctions, reclassifies mkdir races, avoids disclosing raw link targets or unsafe shell commands, and never deletes or replaces an obstructing entry.
+- POSIX parent identity reproof/fsync is now centralized before every promotable artifact-phase result, preventing a crash-window where a rename is lost after durable retirement is recorded (#3489).
+- Artifact retirement, planned paths, retained authority, and transcript retry in both managed reconciliation and deletion now bind to the newest published `pendingEvidence` attempt, preventing stranded detached transcripts at paths absent from the newest receipt after a crash (#3489).
+- Detached task receipts for in-memory parent sessions no longer advertise dead `agent://` output URIs. TaskTool allocates a session-lifetime durable artifact root under the process temp directory, persists child outputs there, authorizes parent and same-session descendants for scoped resolution, and omits the URI entirely when durable allocation fails (#3471).
+- Managed-session replacement and cleanup now bind Windows destination mutation to exact native identity, keep lock acquisition/release retryable without reviving lost ownership, and report retained artifact payloads as `cleanup_pending` until only the verified root remains.
+- Resuming a session no longer crashes with an unhandled rejection when another session transition is already running. The session picker dispatches resume through a void-returning callback, and `handleResumeSession` had no re-entrancy guard, so a second selection (or a resume issued while compaction, handoff, or a fork was in flight) reached `switchSession` and the `{ code: "busy" }` transition error rejected a promise nobody awaited. Resume now ignores an overlapping request with a status message, reports a busy transition as status, and still propagates every other failure. The progress lease is released on all paths.
+- The interactive `Working…` indicator now remains visible and explicitly labels owner-scoped detached background work across foreground completion, provider errors, pending-submission aborts, and job completion, without resurrecting after TUI disposal (#3479).
+- Activity-indicator suspension now detaches and restores the exact owned loader instead of stopping foreign transition UI; optimistic pre-init prompts still show and clear their spinner, context clear retains its eager teardown contract, and resume cancellation preserves transient state until session mutation actually begins.
+- Activity-indicator stop and suspension helpers now fail safely for lightweight controller contexts with absent or partial status rails, while full interactive contexts retain exact loader detach/restore ownership.
+
 ## [0.12.1] - 2026-07-29
 
 ### Fixed
@@ -10,6 +48,7 @@
 - Managed-session startup failures now include their bounded preparation classification (and path-free native durability diagnostic when available), so Windows launch crashes no longer collapse to an unactionable generic error while filesystem paths and raw OS messages remain redacted (#3383).
 - Single-model sessions now rotate immediately to another stored provider credential after a content-free quota or rate-limit failure, without requiring a synthetic model fallback chain. Credential rotation is replay-safe for content-free failures regardless of extension lifecycle participation, and traverses the full credential pool independent of `retry.maxRetries` (#3491).
 - External credential discovery now follows `CLAUDE_CONFIG_DIR` and `CODEX_HOME` instead of always reading `~/.claude` and `~/.codex`, so importing from an account switcher (or any relocated Claude Code / Codex CLI config root) picks up the account the launching shell selected. Both variables resolve through the credential env trust boundary and must be absolute; redacted summaries name the variable, never the resolved path.
+- The `acp_conformance` CI job runs again. The pinned upstream `acpx` checkout resolves its own imports (`@agentclientprotocol/sdk`, `zod`) from its own tree, but its dependencies were never installed, so the corpus runner aborted with `Cannot find module 'zod/v4'` before executing a single case. The checkout is now installed after provenance verification, and the reused warm cache still skips the reinstall.
 
 ### Added
 

package/dist/types/config/settings-schema.d.ts

@@ -994,8 +994,8 @@ export declare const SETTINGS_SCHEMA: {
         readonly default: true;
         readonly ui: {
             readonly tab: "appearance";
-            readonly label: "Status Line Action Hints";
-            readonly description: "Show contextual keyboard shortcuts in the status line";
+            readonly label: "Composer Shortcut Hints";
+            readonly description: "Show contextual keyboard shortcuts in the composer placeholder";
         };
     };
     readonly "statusLine.leftSegments": {

package/dist/types/gjc-runtime/ralplan-review-conflicts.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Typed ralplan review conflicts and dispositions (#2902).
+ *
+ * Architect and Critic findings remain free-form in their stage markdown, but
+ * the join/revision path can record machine-checkable findings against stable
+ * plan targets. Incompatible actions on the same target produce open conflicts
+ * that block a clean join until an explicit disposition is recorded.
+ */
+export declare const RALPLAN_REVIEW_CONFLICTS_SCHEMA: "ralplan.review_conflicts.v1";
+export type ReviewAction = "add" | "remove" | "change" | "clarify";
+export type ReviewRole = "architect" | "critic";
+export type ReviewSeverity = "info" | "watch" | "block";
+export type DispositionChoice = "accept_architect" | "accept_critic" | "synthesize" | "defer_user" | "reject_both";
+export interface ReviewSourceReceipt {
+    stage: "architect" | "critic";
+    stageN: number;
+    path: string;
+    sha256: string;
+}
+export interface ReviewFinding {
+    findingId: string;
+    targetId: string;
+    action: ReviewAction;
+    severity: ReviewSeverity;
+    evidence: string;
+    sourceRole: ReviewRole;
+    sourceReceipt: ReviewSourceReceipt;
+    proposedOwner?: string;
+}
+export interface ReviewConflict {
+    conflictId: string;
+    targetId: string;
+    findingIds: [string, string];
+    actions: [ReviewAction, ReviewAction];
+    sourceRoles: [ReviewRole, ReviewRole];
+    status: "open" | "dispositioned";
+}
+export interface ConflictDisposition {
+    conflictId: string;
+    choice: DispositionChoice;
+    rationale: string;
+    decisionOwner: string;
+    affectedSections: string[];
+    dispositionedAt?: string;
+}
+export interface ReviewConflictDocument {
+    schema: typeof RALPLAN_REVIEW_CONFLICTS_SCHEMA;
+    plannerStageN: number;
+    findings: ReviewFinding[];
+    conflicts: ReviewConflict[];
+    dispositions: ConflictDisposition[];
+}
+export interface JoinGateResult {
+    ok: boolean;
+    openConflictIds: string[];
+    missingDispositionIds: string[];
+    orphanDispositionIds: string[];
+    message: string;
+}
+/** True when two actions on the same target cannot both remain. */
+export declare function actionsAreIncompatible(left: ReviewAction, right: ReviewAction): boolean;
+/**
+ * Derive open conflicts from typed findings. Only cross-role incompatible pairs
+ * on the same targetId are conflicts (Architect remove vs Critic add, etc.).
+ */
+export declare function detectReviewConflicts(findings: readonly ReviewFinding[]): ReviewConflict[];
+/** Mark conflicts dispositioned when a matching disposition exists. */
+export declare function applyDispositions(conflicts: readonly ReviewConflict[], dispositions: readonly ConflictDisposition[]): ReviewConflict[];
+/**
+ * Join gate: clean only when every derived conflict has an explicit disposition
+ * with rationale and decision owner, and no orphan dispositions reference unknown
+ * conflicts.
+ */
+export declare function evaluateReviewJoinGate(findings: readonly ReviewFinding[], dispositions: readonly ConflictDisposition[], precomputedConflicts?: readonly ReviewConflict[]): JoinGateResult;
+/** Strip optional markdown fence and parse JSON. */
+export declare function parseReviewConflictJson(raw: string): unknown;
+/**
+ * Authoritative provenance required by `gjc ralplan --write --stage disposition`.
+ *
+ * Without this, a disposition document can claim arbitrary path/hash strings and
+ * join the wrong Architect/Critic pass (#3013 adversarial review).
+ */
+export interface IndexedReviewArtifact {
+    path: string;
+    sha256: string;
+}
+export interface DispositionProvenanceContext {
+    /** CLI `--stage_n` for this disposition write; must equal `plannerStageN`. */
+    expectedStageN: number;
+    /**
+     * Persisted Architect/Critic (and other) stage artifacts from this run's
+     * `index.jsonl`, keyed by `${stage}\u0000${stageN}`.
+     */
+    indexedArtifacts: ReadonlyMap<string, IndexedReviewArtifact>;
+}
+/** Stable map key for a staged artifact identity in the run index. */
+export declare function reviewArtifactIndexKey(stage: string, stageN: number): string;
+/**
+ * Cross-check every finding's source receipt against the CLI stage number and
+ * the run's persisted Architect/Critic artifact index. Fail closed on mismatch
+ * or spoofed path/hash attestations.
+ */
+export declare function assertDispositionProvenance(doc: ReviewConflictDocument, provenance: DispositionProvenanceContext): void;
+/**
+ * Parse and validate a disposition-stage document. Re-derives conflicts from
+ * findings when omitted, then fails closed unless every conflict is dispositioned
+ * (or findings produce zero conflicts and dispositions are empty).
+ *
+ * When `provenance` is provided (CLI write path), also enforces authoritative
+ * same-pass receipt checks against the run index.
+ */
+export declare function parseReviewConflictDocument(raw: string | unknown, provenance?: DispositionProvenanceContext): ReviewConflictDocument;
+/** Canonical JSON serialization for disposition-stage artifacts. */
+export declare function serializeReviewConflictDocument(doc: ReviewConflictDocument): string;

package/dist/types/gjc-runtime/ralplan-runtime.d.ts

@@ -14,9 +14,11 @@ import { type RalplanIndexRow } from "./ledger-event-renderer";
  * 2. **Artifact write**: `gjc ralplan --write --stage <type> --stage_n <N>
  *    (--artifact <path-or-string> | --artifact-env GJC_RALPLAN_ARTIFACT)
  *    [--run-id <id>] [--session-id <id>] [--lane-verdict <token>] [--json]` persists Planner / Architect
- *    / Critic / revision / post-interview / ADR / final markdown under `.gjc/plans/ralplan/<run-id>/`, maintains
- *    an `index.jsonl` audit log, copies `final` stages to `pending-approval.md`, and advances
- *    the HUD chip to reflect the latest persisted stage.
+ *    / Critic / disposition / revision / post-interview / ADR / final artifacts under
+ *    `.gjc/plans/ralplan/<run-id>/`, maintains an `index.jsonl` audit log, copies `final`
+ *    stages to `pending-approval.md`, and advances the HUD chip to reflect the latest
+ *    persisted stage. Disposition stage artifacts are fail-closed JSON documents that
+ *    record typed review conflicts with authoritative same-pass source receipts (#2902).
  */
 export interface RalplanCommandResult {
     status: number;

package/dist/types/gjc-runtime/ultragoal-evidence.d.ts

@@ -17,12 +17,16 @@ export declare function validateStructuralArtifact(cwd: string, row: JsonObject,
     live: boolean;
 }): Promise<boolean>;
 export declare function isAllowedGitReplayCommand(args: readonly string[]): boolean;
+export declare function resolveCliReplayCommand(command: string[], options?: {
+    compiled?: boolean;
+}): string[];
 export declare function readCliReplayRecord(cwd: string, row: JsonObject, fieldName: string): Promise<JsonObject | null>;
 export interface ReplayProcessHandle {
     readonly exited: Promise<number>;
+    readonly pid?: number;
     kill(signal?: number | NodeJS.Signals): void;
 }
-export declare function waitForReplayProcessWithTimeout(process: ReplayProcessHandle, timeoutMs: number, graceMs?: number): Promise<number>;
+export declare function waitForReplayProcessWithTimeout(handle: ReplayProcessHandle, timeoutMs: number, graceMs?: number): Promise<number>;
 export declare function validateReplayExemptFallback(cwd: string, record: JsonObject, fieldName: string, artifactRefs: Map<string, JsonObject>, options: {
     surfaceFamily: SurfaceFamily;
     live: boolean;

package/dist/types/gjc-runtime/ultragoal-runtime.d.ts

@@ -315,13 +315,19 @@ export declare function isSubstantiveEvidence(value: unknown): boolean;
 export declare function hasTypedVerifiedReceipt(value: unknown): boolean;
 export declare function hasExistingNonEmptyArtifact(cwd: string, value: unknown): Promise<boolean>;
 export declare function readArtifactBytes(cwd: string, row: JsonObject, fieldName: string): Promise<Buffer | null>;
-import { validateArtifactProof, validateCliReplay, validateLiveSurfaceProofPresence, validateReplayExemptFallback, validateStructuralArtifact, validateSurfaceStructuralRequirement, waitForReplayProcessWithTimeout } from "./ultragoal-evidence";
+import { resolveCliReplayCommand, validateArtifactProof, validateCliReplay, validateLiveSurfaceProofPresence, validateReplayExemptFallback, validateStructuralArtifact, validateSurfaceStructuralRequirement, waitForReplayProcessWithTimeout } from "./ultragoal-evidence";
 export type { ReplayProcessHandle } from "./ultragoal-evidence";
-export { validateArtifactProof, validateCliReplay, validateLiveSurfaceProofPresence, validateReplayExemptFallback, validateStructuralArtifact, validateSurfaceStructuralRequirement, waitForReplayProcessWithTimeout, };
+export { resolveCliReplayCommand, validateArtifactProof, validateCliReplay, validateLiveSurfaceProofPresence, validateReplayExemptFallback, validateStructuralArtifact, validateSurfaceStructuralRequirement, waitForReplayProcessWithTimeout, };
 export declare function validateExecutorQaRedTeamEvidenceForReview(cwd: string, executorQa: Record<string, unknown>, options?: {
     mode?: "review";
     changeSet?: UltragoalChangeSet;
 }): Promise<void>;
+/**
+ * Scaffold a schema-shaped quality-gate template for selected surfaces (#3474).
+ * The template is intentionally incomplete for live artifact proofs so `quality-gate
+ * validate` can report remaining evidence gaps in one pass after the author fills paths.
+ */
+export declare function buildQualityGateInitTemplate(surfaces: readonly string[]): JsonObject;
 /**
  * Read-only quality-gate validation (#3474). Applies exactly the same rules as
  * `checkpoint --status complete` — including deferred-vs-boundary gate selection and

package/dist/types/modes/components/irc-sidebar.d.ts

@@ -32,6 +32,22 @@ export declare function computeIrcSplitWidths(width: number): {
     separatorWidth: number;
     rightWidth: number;
 };
+/**
+ * Resolves the single shared work-lane geometry. The left lane is used by both
+ * transcript and todo content whenever the IRC lane is effective.
+ */
+export declare function computeIrcWorkLaneWidths(width: number, sidebarVisible: boolean): {
+    leftWidth: number;
+    separatorWidth: number;
+    rightWidth: number;
+};
+export declare class IrcLeftLaneComponent implements Component {
+    private readonly content;
+    private readonly isSidebarVisible;
+    constructor(content: Component, isSidebarVisible: (width: number) => boolean);
+    render(width: number): string[];
+    invalidate(): void;
+}
 type SemanticLine = Readonly<{
     kind: "header" | "body" | "elision" | "blank";
     text: string;

package/dist/types/modes/controllers/command-controller.d.ts

@@ -3,7 +3,7 @@ import { type ProviderDetails, type UsageReport } from "@gajae-code/ai";
 import type { KeybindingsManager } from "../../config/keybindings";
 import type { CompactOptions } from "../../extensibility/extensions/types";
 import { theme } from "../../modes/theme/theme";
-import type { InteractiveModeContext } from "../../modes/types";
+import { type InteractiveModeContext } from "../../modes/types";
 export declare function buildHelpMarkdown(keybindings: Pick<KeybindingsManager, "getAccessibleDisplayString">): string;
 export declare class CommandController {
     #private;

package/dist/types/modes/controllers/event-controller.d.ts

@@ -1,5 +1,5 @@
 import { type Component } from "@gajae-code/tui";
-import type { InteractiveModeContext } from "../../modes/types";
+import { type InteractiveModeContext } from "../../modes/types";
 import type { AgentSessionEvent } from "../../session/agent-session";
 /** Test-only performance counters for advisory baseline tests. */
 export declare const __eventControllerPerfCounters: {

package/dist/types/modes/controllers/extension-ui-controller.d.ts

@@ -2,7 +2,7 @@ import type { Component, TUI } from "@gajae-code/tui";
 import { KeybindingsManager } from "../../config/keybindings";
 import type { ExtensionUIContext, ExtensionUIDialogOptions, ExtensionWidgetContent, ExtensionWidgetOptions, TerminalInputHandler } from "../../extensibility/extensions";
 import { type Theme } from "../../modes/theme/theme";
-import type { InteractiveModeContext } from "../../modes/types";
+import { type InteractiveModeContext } from "../../modes/types";
 export declare class ExtensionUiController {
     #private;
     private ctx;
@@ -79,5 +79,6 @@ export declare class ExtensionUiController {
     addExtensionTerminalInputListener(handler: TerminalInputHandler): () => void;
     clearHookWidgets(): void;
     clearExtensionTerminalInputListeners(): void;
+    dispose(): void;
     showExtensionError(extensionPath: string, error: string): void;
 }

package/dist/types/modes/controllers/selector-controller.d.ts

@@ -1,7 +1,7 @@
 import type { Component, SlashCommand } from "@gajae-code/tui";
 import type { ModelProfileConfig } from "../../config/models-config-schema";
 import { type Settings } from "../../config/settings";
-import type { InteractiveModeContext, OAuthSelectorOptions } from "../../modes/types";
+import { type InteractiveModeContext, type OAuthSelectorOptions } from "../../modes/types";
 import { getNotificationConfig, maskToken } from "../../sdk/bus/config";
 import { proposedTelegramIdentity, reconcileCommittedTelegramConfiguration, removeTelegramConfiguration, saveTelegramInactive } from "../../sdk/bus/notification-orchestration";
 import { buildNotificationStatusReport, checkNotificationHealth, recoverNotifications, sanitizeDiagnostic, sendNotificationTest } from "../../sdk/bus/notification-service";

package/dist/types/modes/interactive-mode.d.ts

@@ -39,7 +39,9 @@ export declare const DEFAULT_COMPOSER_PLACEHOLDER: string;
 export declare function getComposerPlaceholder(keybindings: Pick<KeybindingsManager, "getDisplayString">, context: KeyDisplayContext, options: {
     readonly busy: boolean;
     readonly busyPromptMode: "steer" | "queue";
+    readonly showActionHints: boolean;
 }): string;
+export declare function resolveActivityIndicatorMessage(foregroundActive: boolean, activeBackgroundTasks: number, foregroundMessage: string): string | undefined;
 export declare function getWelcomeTranscriptReservedRows(chatContainer: Container, width: number): number;
 export type WelcomeBannerSettingMode = "auto" | "unicode" | "square" | "ascii";
 export declare function resolveWelcomeLogoMode(mode: WelcomeBannerSettingMode, env?: Record<string, string | undefined>, platform?: NodeJS.Platform): WelcomeLogoMode;
@@ -156,6 +158,8 @@ export declare class InteractiveMode implements InteractiveModeContext {
     commitPetPreviewMode(mode: PetMode): boolean;
     restoreComposer(): void;
     rebuildChatFromMessages(policy: TranscriptRebuildPolicy): void;
+    isStopped(): boolean;
+    onStop(callback: () => void): () => void;
     stop(): void;
     shutdown(): Promise<void>;
     checkShutdownRequested(): Promise<void>;
@@ -169,7 +173,12 @@ export declare class InteractiveMode implements InteractiveModeContext {
     }): void;
     showError(message: string): void;
     showWarning(message: string): void;
+    syncActivityIndicator(): void;
     ensureLoadingAnimation(): void;
+    stopLoadingAnimation(options?: {
+        restoreBackground?: boolean;
+    }): void;
+    suspendActivityIndicator(): () => void;
     setWorkingMessage(message?: string): void;
     applyPendingWorkingMessage(): void;
     showNewVersionNotification(newVersion: string): void;

package/dist/types/modes/theme/theme.d.ts

@@ -193,7 +193,9 @@ export declare var theme: Theme;
 /** Get the name of the currently active theme. */
 export declare function getCurrentThemeName(): string | undefined;
 export declare function initTheme(enableWatcher?: boolean, symbolPreset?: SymbolPreset, colorBlindMode?: boolean, darkTheme?: string, lightTheme?: string): Promise<void>;
-export declare function setTheme(name: string, enableWatcher?: boolean): Promise<{
+export declare function setTheme(name: string, enableWatcher?: boolean, options?: {
+    shouldApply?: () => boolean;
+}): Promise<{
     success: boolean;
     error?: string;
 }>;

package/dist/types/modes/types.d.ts

@@ -49,6 +49,29 @@ export type ComposerSubmissionOptions = Readonly<{
     editor: CustomEditor;
 }>;
 export declare function canApplyComposerSubmission(options: ComposerSubmissionOptions | undefined, editor: CustomEditor): boolean;
+type PartialActivityStatusContainer = Partial<Pick<Container, "children" | "clear" | "detachChild" | "addChild">>;
+export declare function stopInteractiveActivityIndicator(ctx: {
+    loadingAnimation?: Loader;
+    statusContainer?: PartialActivityStatusContainer;
+    stopLoadingAnimation?: (options?: {
+        restoreBackground?: boolean;
+    }) => void;
+}, options?: {
+    restoreBackground?: boolean;
+}): void;
+export declare function clearInteractiveActivityLoaders(ctx: Pick<InteractiveModeContext, "autoCompactionLoader" | "autoCompactionEscapeHandler" | "retryLoader" | "retryCountdownTimer" | "retryEscapeHandler" | "retryEscapePrimed" | "editor">): void;
+export declare function suspendInteractiveActivityIndicator(ctx: {
+    loadingAnimation?: Loader;
+    statusContainer?: PartialActivityStatusContainer;
+    stopLoadingAnimation?: (options?: {
+        restoreBackground?: boolean;
+    }) => void;
+    syncActivityIndicator?: () => void;
+    suspendActivityIndicator?: () => () => void;
+}): () => void;
+export declare function syncInteractiveActivityIndicator(ctx: {
+    syncActivityIndicator?: () => void;
+}): void;
 export type TodoStatus = "pending" | "in_progress" | "completed" | "abandoned";
 export type TodoItem = {
     content: string;
@@ -139,6 +162,8 @@ export interface InteractiveModeContext {
     init(): Promise<void>;
     shutdown(): Promise<void>;
     checkShutdownRequested(): Promise<void>;
+    isStopped?(): boolean;
+    onStop(callback: () => void): () => void;
     setToolUIContext(uiContext: ExtensionUIContext, hasUI: boolean): void;
     initializeHookRunner(uiContext: ExtensionUIContext, hasUI: boolean): void;
     createBackgroundUiContext(): ExtensionUIContext;
@@ -161,6 +186,11 @@ export interface InteractiveModeContext {
     setWorkingMessage(message?: string): void;
     applyPendingWorkingMessage(): void;
     ensureLoadingAnimation(): void;
+    syncActivityIndicator(): void;
+    suspendActivityIndicator(): () => void;
+    stopLoadingAnimation(options?: {
+        restoreBackground?: boolean;
+    }): void;
     /**
      * Commit a pet mode through the shared result-returning policy: capability
      * is rechecked immediately before mutation and the preference persists only
@@ -223,6 +253,7 @@ export interface InteractiveModeContext {
     updateEditorTopBorder(): void;
     updateEditorBorderColor(): void;
     rebuildChatFromMessages(policy: TranscriptRebuildPolicy): void;
+    updateEditorChrome(): void;
     setTodos(todos: TodoItem[] | TodoPhase[]): void;
     reloadTodos(): Promise<void>;
     toggleTodoExpansion(): void;
@@ -344,3 +375,4 @@ export interface OAuthSelectorOptions {
     trigger?: "bare-login";
     externalCredentialDiscover?: CredentialAutoImportOptions["discover"];
 }
+export {};

package/dist/types/sdk/bus/chat-daemon-control.d.ts

@@ -19,7 +19,8 @@ export type ChatDaemonAction = "stop" | "reload";
  * chat daemons after notification configuration parsing changes. Generation 15
  * applies the current notification configuration directly when starting chat
  * daemon transports. Generation 16 applies Telegram sound-policy configuration
- * through shared notification parsing.
+ * through shared notification parsing. Generation 17 binds managed-session
+ * replacement to exact native filesystem authority.
  */
 export declare const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>>;
 export declare function chatDaemonGeneration(kind: ChatDaemonKind): number;

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -44,9 +44,10 @@ export declare const NOTIFICATION_PROTOCOL_VERSION = 3;
  * 33 adds action-bound multi-select state rendering and replay-safe option
  * snapshots. Generation 34 converts non-photo image formats (including WebP)
  * into Telegram-compatible photo uploads when possible. Generation 35 adds
- * user-created topic adoption (forum-topic folder picker).
+ * user-created topic adoption (forum-topic folder picker). Generation 36 binds
+ * managed-session replacement to exact native filesystem authority.
  */
-export declare const DAEMON_GENERATION = 35;
+export declare const DAEMON_GENERATION = 36;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 1 covers
  * all builds published before this field existed; epoch 2 covered generation 29;

package/dist/types/session/agent-session.d.ts

@@ -633,6 +633,7 @@ export declare class AgentSession {
      *  separately inside `sendCustomMessage`. */
     enqueueCustomMessageDisplay(text: string, mode: "steer" | "followUp"): string;
     getAgentId(): string | undefined;
+    registerToolSessionCleanup(cleanup: () => Promise<void> | void): () => void;
     getAsyncJobSnapshot(options?: {
         recentLimit?: number;
     }): AsyncJobSnapshot | null;
@@ -1386,6 +1387,7 @@ export declare class AgentSession {
      */
     switchSession(sessionPath: string, options?: {
         transition?: SessionSwitchEvent["transition"];
+        onTransitionMutationStarted?: () => void;
     }): Promise<boolean>;
     /**
      * Create a branch from a specific entry.

package/dist/types/session/internal/managed-session-storage.d.ts

@@ -7,6 +7,7 @@ export declare const MANAGED_ARTIFACT_MAX_TOTAL_BYTES: number;
 export declare const MANAGED_ARTIFACT_COPY_BATCH_SIZE = 256;
 export declare class ManagedPublishError extends Error {
     readonly classification: "destination_conflict" | "atomic_unavailable" | "invalid_request" | "durability_not_provable" | "identity_mismatch" | "io_error" | "durability_failed";
+    readonly code: ManagedPublishError["classification"];
     readonly diagnostic: string;
     constructor(classification: ManagedPublishError["classification"], outcome: NativePublishOutcome);
 }
@@ -20,6 +21,12 @@ export interface ManagedStorageLock {
     assertOwned(): void;
     release(): Promise<void>;
 }
+export interface ManagedStorageLockSync {
+    path: string;
+    attemptId: string;
+    assertOwned(): void;
+    release(): void;
+}
 export interface ManagedFileSnapshot {
     bytes: Buffer;
     identity: {
@@ -31,6 +38,13 @@ export interface ManagedFileSnapshot {
         sha256: string;
     };
 }
+export declare const MANAGED_SESSION_SECURITY_CODES: readonly ["acl_denied", "acl_io_error", "acl_present", "acl_malformed", "acl_unknown", "acl_unavailable", "acl_apply_failed", "acl_verify_failed", "not_found", "not_directory", "network_unsupported", "reparse_point", "identity_unavailable", "identity_mismatch", "owner_mismatch", "mode_mismatch", "io_error"];
+export type ManagedSessionSecurityCode = (typeof MANAGED_SESSION_SECURITY_CODES)[number];
+export declare class ManagedSessionSecurityError extends Error {
+    readonly code: ManagedSessionSecurityCode;
+    constructor(code: ManagedSessionSecurityCode);
+}
+export declare function managedSessionSecurityCode(error: unknown): ManagedSessionSecurityCode | undefined;
 export declare function validateNativeSecurityResult(value: unknown, operation: "apply" | "verify", kind: "directory" | "file"): NativeOwnerOnlySecurityResult;
 /** Captured configured-root authority for managed paths only. */
 export interface ManagedDirectoryRoot {
@@ -105,13 +119,18 @@ export declare function captureManagedFileNoFollow(pathname: string): ManagedFil
 /** Atomically publishes bytes without replacing an existing destination. */
 export declare function publishManagedFileNoReplace(destination: string, bytes: Uint8Array, assertOwned?: () => void, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): Promise<void>;
 export declare function publishManagedFileNoReplaceSync(destination: string, bytes: Uint8Array, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): void;
-/** Replace one managed regular file while retaining the secured staging fd through publication. */
-export declare function replaceManagedFileSync(destination: string, bytes: Uint8Array, root: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): void;
-export declare function replaceManagedFile(destination: string, bytes: Uint8Array, root: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): Promise<void>;
+/**
+ * Atomically replace a managed file only when the destination is still the
+ * exact captured object. Unlike `replaceManagedFileSync`, this never performs
+ * an unconditional pathname rename.
+ */
+export declare function replaceManagedFileExactSync(destination: string, bytes: Uint8Array, expected: Pick<ManagedFileSnapshot, "identity">, root: ManagedDirectoryRoot): void;
 /** Copy the exact bytes captured from one no-follow source descriptor. */
 export declare function copyManagedFileNoReplace(source: string, destination: string, snapshot?: ManagedFileSnapshot, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): Promise<void>;
 /** Acquire a lease lock with bounded wait, heartbeats, conservative stale reclaim, and fencing. */
 export declare function acquireManagedLock(locksDirectory: string, name: string, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): Promise<ManagedStorageLock>;
+/** Acquire a synchronous lease lock for a short cross-process critical section. */
+export declare function acquireManagedLockSync(locksDirectory: string, name: string, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): ManagedStorageLockSync;
 export interface ManagedArtifactTreeLimits {
     maxFiles?: number;
     maxTotalBytes?: number;

package/dist/types/task/index.d.ts

@@ -32,6 +32,10 @@ export declare class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskT
     readonly strict = true;
     readonly loadMode = "discoverable";
     readonly renderResult: typeof renderResult;
+    /**
+     * Session-lifetime durable artifact state is shared atomically by every
+     * TaskTool created for the same parent ToolSession.
+     */
     get parameters(): TaskToolSchemaInstance;
     renderCall(args: unknown, options: Parameters<typeof renderTaskCall>[1], theme: Theme): import("@gajae-code/tui").Component;
     /** Dynamic description that reflects current disabled-agent settings */

package/dist/types/task/output-manager.d.ts

@@ -10,6 +10,7 @@ export declare class AgentOutputManager {
     #private;
     constructor(getArtifactsDir: () => string | null, options?: {
         parentPrefix?: string;
+        getAuthorizedArtifactsDirs?: () => readonly string[];
     });
     /**
      * Allocate a unique ID with numeric prefix.

package/dist/types/task/receipt.d.ts

@@ -50,6 +50,8 @@ export interface TaskResultReceipt {
         sizeBytes: number;
         lineCount: number;
         sha256?: string;
+        /** Output remains readable for the parent session lifetime (and same-session descendants). */
+        durability?: "session";
     };
     outputUnavailable?: boolean;
     review?: {

package/dist/types/tools/index.d.ts

@@ -219,6 +219,8 @@ export interface ToolSession {
     getAuthorizedArtifactsDirs?: () => readonly string[];
     /** Get the ArtifactManager backing this session (shared across parent + subagents). */
     getArtifactManager?: () => ArtifactManager | null;
+    /** Register teardown work owned by the current logical session. */
+    registerSessionCleanup?: (cleanup: () => Promise<void> | void) => () => void;
     /** Allocate a new artifact path and ID for session-scoped truncated output. */
     allocateOutputArtifact?: (toolType: string) => Promise<{
         id?: string;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.12.1",
+	"version": "0.12.4",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -53,13 +53,13 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.12.1",
-		"@gajae-code/agent-core": "0.12.1",
-		"@gajae-code/ai": "0.12.1",
-		"@gajae-code/bridge-client": "0.12.1",
-		"@gajae-code/natives": "0.12.1",
-		"@gajae-code/tui": "0.12.1",
-		"@gajae-code/utils": "0.12.1",
+		"@gajae-code/stats": "0.12.4",
+		"@gajae-code/agent-core": "0.12.4",
+		"@gajae-code/ai": "0.12.4",
+		"@gajae-code/bridge-client": "0.12.4",
+		"@gajae-code/natives": "0.12.4",
+		"@gajae-code/tui": "0.12.4",
+		"@gajae-code/utils": "0.12.4",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",