@gajae-code/coding-agent 0.12.11 → 0.12.12

package/CHANGELOG.md

@@ -2,6 +2,37 @@
 
 ## [Unreleased]
 
+## [0.12.12] - 2026-08-05
+
+### Added
+
+- Interactive turns now announce their state as an OSC 777 sequence (`notify;Terax;gjc;working|attention|finished`), so a hosting terminal can follow the agent without polling. Terminals that do not parse it discard it like any unknown OSC, and print/RPC mode stdout is untouched.
+- Existing Slack threads can now be adopted through an opt-in prepare → bind → activate lifecycle. A prepared session (broker `readiness: "deferred"` / `gjc_coordinator_start_session` with `prepare_existing_thread`, or `GJC_NOTIFY_BIND_EXISTING_THREAD=1` for a manually started one) publishes discoverable endpoint authority while withholding readiness, so no stock root is claimed; `gjc notify bind-thread` then adopts the exact operator-supplied root through the running Slack daemon owner over a new per-request command channel — the CLI is never a direct mapping writer — and `gjc notify activate-thread` / `gjc_coordinator_activate_session` publishes the withheld readiness exactly once behind a gate that proves the daemon-owned mapping at that endpoint generation. Adoption posts zero replacement roots, is fenced on the exact session/generation/daemon-owner tuple, and is idempotent on exact retry. Every mapping mutation passes a two-sided final authority fence inside the store lock — authority is proven, commit authority is taken, and authority is proven again — so a session, endpoint generation, or daemon-owner tuple that rolls while commit authority is being taken leaves no mapping behind. `ChatDaemonRuntime` now drops internal control-plane frames (`session_prepared`, `event_replay_result`, `control_response`, `query_response`, `hello`) before any post, root, mapping, resume, close, or action mutation on both the live and replay paths, and correlates each delivered frame first: an event envelope, its `name`/`kind` aliases, and its payload are representations of one event, so disagreeing spellings, a duplicated `sessionId`/`generation` that is unequal or present-but-malformed, and a reserved lifecycle or control-plane identity carried on only one representation all make the frame inert before any mutation. Because the command channel proves correlation and never authorship, a reported `status:"ok"` that the durable conversation store does not corroborate is reported as `binding_outcome_unknown` instead of success; a storage failure raised after commit authority was granted — the mapping rename applies before its durability barrier — is reported as `binding_outcome_unknown` rather than as a definitive rejection an operator could retry against; and a timeout that wins the single-winner response claim is a definitive, mutation-free failure for that submission's race against a concurrent serve (not durable settlement across a crashed and resurrected daemon). Ordinary sessions keep the stock immediate ready/root behaviour.
+
+### Added
+
+- Added a verified, copy-installable `ooo` bridge example: `ooo interview` renders Ouroboros MCP questions in GJC, serializes startup and follow-up answers by session ID, cancellation-fences late settlement, disposes state on GJC session changes and `/clear`, drops queued predecessor-generation starts, releases dead transports and controls, honors `OUROBOROS_CLI`, and loads dependency-free in compiled binaries (#3803).
+
+### Fixed
+
+- Automatic session retry now refuses to re-issue a request once the failed attempt carries observable assistant text, thinking, or tool-call content — including under explicit legacy `retry.*` settings. Content-free clean failures keep their existing bounded/unbounded policy; managed provisional discard, credential rotation, first-event timeout scope checks, and manual `/retry` are unchanged (#3791).
+
+- Parent sessions and their subagent trees now share one identity-authorized artifact manager across persistent and ephemeral operation. Non-persistent roots are retired on committed session transitions and terminal close, failed transitions retain predecessor ownership, and atomic numeric-ID claims prevent same-root managers from creating ambiguous artifact references (#3813).
+
+- Telegram daemon restart now revokes every persisted callback alias before polling. Reconnecting sessions must replay a pending ask to receive fresh, owner-bound aliases; old controls remain stale, and their keyboards are best-effort terminalized when the original Telegram message id is available. Shutdown now fences new session messages and drains every admitted handler before final callback persistence and ownership release, preventing a successful send racing shutdown from publishing alias state after a successor takes ownership (#3727).
+- Extension handler timeout signals now preserve lazy, live context accessors instead of eagerly snapshotting them. Model changes made through SDK controls are immediately visible to later context reads, and unused getters can no longer reject lifecycle emission before the runner's extension error boundary (#3817).
+- Direct interactive launches inside tmux now bind automatic window renames to the originating pane's immutable pane/window identities and observed window index. If that binding changes before mutation, GJC preserves every window name instead of renaming whichever window became active (#3808).
+- `gjc update` and the startup version check now resolve the npm registry from npm configuration — `npm_config_registry` or `BUN_CONFIG_REGISTRY` from the environment, a scoped `@scope:registry` key, and the user and machine-wide `.npmrc` files, including the credentials registered for that registry — instead of always querying `registry.npmjs.org`. On networks that mirror or block the public registry the check failed with an empty `Failed to fetch release info:` even though the install step, which already shells out to bun/npm and therefore honored the configured registry, would have succeeded. Repository-controlled configuration is excluded: a `.npmrc` in the current working directory is not read, the environment is read through `$credentialEnv`, and `npm_config_*` is ignored entirely when GJC is launched by an npm lifecycle, because npm synthesizes those variables from the project `.npmrc` with `${VAR}` already expanded. Credentials are never sent to a remote plaintext `http:` registry, including credentials embedded in the registry URL. Whichever manager will run the install decides Bun-vs-npm config priority, the machine-wide config path is derived from npm's own prefix rather than guessed, and keys inside an ini `[section]` are not treated as top-level config. A registry that is configured but unusable, and a config file that exists but cannot be read, fail loudly instead of silently falling back to the public registry; failures name the URL, the status, and the exact file or environment variable the registry came from — including the case where an intercepting proxy answers 200 with a non-JSON body — and credentials are stripped from a `https://user:pass@host` registry rather than printed with it. `bunfig.toml` is not read. (#3821)
+
+### Fixed
+
+- Telegram `notify setup` activation works when `notifications/` is a directory symlink (multi-account shared notification dirs). Transition-lock release previously rejected intermediate directory reparse points, left `telegram-daemon.steal` behind, and failed with "provisional ownership could not be retired safely" while durable settings remained armed. Only intermediate directory components are resolved before native exact unlink; the final basename is rejoined so final-component file symlinks stay `reparse_point` under native `AT_SYMLINK_NOFOLLOW`, including TOCTOU replacement after JS preflight (#3761).
+- A failed `notify setup` no longer reports "Unable to persist and activate Telegram notification settings" when the durable configuration already carries the attempted bot token, chat id, and enabled state. The wording now follows the stored configuration, so it can no longer contradict a follow-up `notify status`; an operator who reads the failure as "nothing was saved" would otherwise leave Telegram armed for a token another poller may own. A commit that was entered and then failed while the stored configuration is also unreadable is reported as undecided, pointing at `notify status`, instead of guessing either outcome (#3761).
+- Continuing a large managed session on Darwin now batches stale OpenAI Responses replay-metadata patches into one transcript append instead of performing one identity-verified whole-file replacement per patch. Interactive startup also renders before exact MCP connection and explicit `--mpreset` activation, gates every provider turn until both are ready, and refreshes models online only after the UI is usable, preventing `gjc -c` from remaining at `GJC warming workspace` with sustained CPU, multi-gigabyte RSS growth, or avoidable network waits (#3793).
+- Slack Web API requests now use form encoding instead of JSON, preventing thread reconciliation through `conversations.replies` from failing with `invalid_arguments`.
+
+- Managed replacement cleanup now migrates version-one receipts from earlier releases and recovers canonical exchange placeholders left by interrupted cleanup, so a stale receipt cannot permanently block the next managed session mutation with `managed_replace_cleanup_receipt_invalid`.
+
 ## [0.12.11] - 2026-08-03
 
 ### Fixed
@@ -10,6 +41,7 @@
 - Managed session rewrites and authority-absent Darwin appends now use native identity-verified atomic replacement instead of deterministically failing with `managed_replace_exact_unavailable` or risking a torn JSONL tail; uncertain readable outcomes are re-fsynced and carried through ctime-bound strict adoption before recovery reports them durable. This unblocks Darwin compaction and session append durability when retained native authority is absent (#3742, #3760).
 - `todo_write` recovery reminders now distinguish rejected payloads from runtime aborts, preserve the available cause, and require durable state reconciliation instead of incorrectly telling the agent to change a valid payload (#3743, #3760).
 - Authority-absent Darwin `appendSync` regression coverage now exercises the replace-based race window (destination mutation during successor staging) instead of the retired in-place `O_APPEND` open path, and documents that ctime-only destination transitions are tolerated by exact replacement.
+- The legacy interactive footer now uses the session manager's cumulative usage index, so completed task and subagent tokens, premium requests, and estimated costs are included exactly once instead of reporting only the parent agent's assistant messages.
 
 ## [0.12.10] - 2026-08-03
 
@@ -31,6 +63,9 @@
 - Dead-owner notification recovery now preserves a machine-readable transition block, marker-age diagnostics, and safe force-recovery guidance without weakening ownership proofs (#3762).
 - Detached SDK session hosts no longer outlive the broker that spawned them. A host whose broker died without teardown (crash, `SIGKILL`, restart without `--close-session-hosts`) previously stayed resident forever, holding its session's memory — hundreds of MB per orphan. Each host now polls the broker discovery publication and, after a bounded grace period with no live broker, disposes itself through the same graceful teardown a `SIGTERM` takes. A replacement broker resets the window, so hosts still survive ordinary broker restarts, and a transient discovery read failure is treated as ambiguity rather than proof of orphanhood.
 - Syntax highlighting now recognizes special filenames such as `CMakeLists.txt`, `Dockerfile.*`, `Makefile`, and `.env.*` before generic filename extensions.
+### Changed
+
+- Updated the Cursor Eco, Medium, and Pro profiles from Composer 1.5 to distinct Composer 2.5 tiers: standard throughout for Eco, Fast on execution/review/design roles for Medium, and Fast throughout for Pro. Removed inert generic effort suffixes that the Cursor RPC could not transport.
 
 ## [0.12.8] - 2026-08-02
 ### Added
@@ -46,6 +81,7 @@
 
 - Windows automatic tmux resolution now selects `psmux` then `pmux` by canonical command order without rejecting distinct lower-priority aliases; it probes `tmux` only when neither named provider is available (#3725).
 - CI failure extraction now aggregates Bun failure and suite-error summaries across every test invocation in a job log instead of silently using only the first summary.
+- The GitHub status-line lookup now binds terminal links to positive PR numbers and canonical matching HTTP(S) pull-request URLs, rejecting ambiguous or control-bearing targets.
 - Ordinary `ask` selectors now bound long question premises and page through every premise row without skipping rows hidden by overflow indicators (#3675).
 - First-event timeout retries now require a typed, content-free failure from the current clean attempt scope, preventing prior or stale extension activity from suppressing or admitting a later request (#3553).
 - The issue-1979 Korean prose wrap test now cleans up inherited multiplexer env vars (`TMUX`, `TMUX_PANE`, etc.) so it deterministically exercises the plain-terminal render path regardless of the CI runner's terminal session (#1979).
@@ -146,6 +182,8 @@
 
 - User-created Telegram forum topics can now start a GJC session by selecting the home folder, choosing a verified recent work folder, or entering an explicit folder path. The selected topic is adopted by the new session without creating or deleting a separate Telegram topic.
 - The interactive terminal’s responsive IRC/todo work-lane contract now covers exact narrow/wide geometry, requested versus effective IRC visibility, direct-root pin ordering, todo lane bounds, remapped IRC toggles, and live composer shortcut hints.
+- Managed-session startup now preserves bounded Windows ACL and identity failure classifications in path-redacted recovery guidance without broadening permissions, elevation, or unsafe fallback.
+- Telegram topic synchronization now uses generation-CAS shared authority, durable pre-create claims, lease-fenced effects, bounded single-flight archive retries, and an isolated owner-backed validation-supergroup mode without deleting topics.
 
 ### Fixed
 

package/dist/types/cli/notify-cli.d.ts

@@ -1,8 +1,10 @@
 import { Settings } from "../config/settings";
 import { type EnsureChatDaemonResult } from "../sdk/bus/chat-daemon-control";
+import { type ActivatedPreparedSession } from "../sdk/bus/existing-thread-readiness";
+import { type BoundSlackThread } from "../sdk/bus/slack-thread-binding";
 import { type EnsureTelegramDaemonDetailedResult } from "../sdk/bus/telegram-daemon";
 import { type TelegramSetupPreflight, type TelegramSetupTimers } from "../sdk/bus/telegram-setup";
-export type NotifyAction = "setup" | "status" | "health" | "test" | "recovery" | "daemon-internal";
+export type NotifyAction = "setup" | "status" | "health" | "test" | "recovery" | "bind-thread" | "activate-thread" | "daemon-internal";
 export type NotifySetupProvider = "telegram" | "discord" | "slack";
 export interface NotifyCommandArgs {
     action: NotifyAction;
@@ -24,6 +26,8 @@ export interface NotifyCommandArgs {
     forceDaemonLock?: boolean;
     probe?: boolean;
     message?: string;
+    sessionId?: string;
+    threadTs?: string;
 }
 export interface NotifyCommandDeps {
     fetchImpl?: typeof fetch;
@@ -50,6 +54,15 @@ export interface NotifyCommandDeps {
     setupPidIncarnation?: (pid: number) => string | undefined;
     ensureProviderDaemon?: (provider: "discord" | "slack", settings: Settings) => Promise<EnsureChatDaemonResult>;
     ensureTelegramDaemon?: (settings: Settings) => Promise<EnsureTelegramDaemonDetailedResult>;
+    bindSlackThread?: (input: {
+        settings: Settings;
+        sessionId: string;
+        threadTs: string;
+    }) => Promise<BoundSlackThread>;
+    activatePreparedSession?: (input: {
+        settings: Settings;
+        sessionId: string;
+    }) => Promise<ActivatedPreparedSession>;
 }
 export declare function parseNotifyArgs(args: string[]): NotifyCommandArgs | undefined;
 export declare function runNotifyCommand(cmd: NotifyCommandArgs, deps?: NotifyCommandDeps): Promise<void>;
@@ -61,5 +74,33 @@ type TokenPromptInput = NodeJS.ReadStream & {
 };
 type TokenPromptOutput = Pick<NodeJS.WriteStream, "write">;
 export declare function promptForToken(input?: TokenPromptInput, output?: TokenPromptOutput): Promise<string>;
+export interface BindThreadInvocation {
+    sessionId: string;
+    threadTs: string;
+}
+/**
+ * Enforce the exact `bind-thread` grammar at every entrypoint.
+ *
+ * The command accepts only a session and a root; a positional argument, an
+ * unrelated notify flag, or a target/credential input is a rejection rather than
+ * something silently ignored, so no other invocation shape can reach the
+ * binding authority.
+ */
+export declare function assertStrictBindThreadInvocation(cmd: NotifyCommandArgs): BindThreadInvocation;
+/** Confirmation carries identifiers only: no tokens, message bodies, or control secrets. */
+export declare function formatBoundSlackThread(bound: BoundSlackThread): string;
+export interface ActivateThreadInvocation {
+    sessionId: string;
+}
+/**
+ * Enforce the exact `activate-thread` grammar at every entrypoint.
+ *
+ * Activation names one prepared session and nothing else: the root it adopts is
+ * already the applied binding, so a supplied root, target, or credential is a
+ * rejection rather than something silently ignored.
+ */
+export declare function assertStrictActivateThreadInvocation(cmd: NotifyCommandArgs): ActivateThreadInvocation;
+/** Confirmation carries identifiers only: no endpoints, tokens, or thread content. */
+export declare function formatActivatedSession(activated: ActivatedPreparedSession): string;
 export declare function printNotifyHelp(): void;
 export {};

package/dist/types/cli/update-cli.d.ts

@@ -1,6 +1,11 @@
+import { type Installer, type NpmRegistryLookupOptions } from "../utils/npm-registry";
 interface ReleaseInfo {
     tag: string;
     version: string;
+    /** Registry the version came from. Release binaries still come from GitHub. */
+    registry: string;
+    /** Config problems that did not stop the lookup but changed its outcome. */
+    warnings: string[];
 }
 /** Result from running the installed binary and parsing its reported version. */
 export interface InstalledVersionVerification {
@@ -56,7 +61,8 @@ type PathPlatform = NodeJS.Platform;
 type PackageExists = (packageName: string, packageRoot: string) => boolean;
 export declare function resolveUpdateMethodForTest(ompPath: string, bunBinDir: string | undefined): "bun" | "npm" | "binary";
 export declare function resolveNpmManagedTargetForTest(ompPath: string, platform: PathPlatform, packageExists: PackageExists): PackageManagerTarget | undefined;
-export declare function formatBinaryDownloadFailureMessageForTest(binaryName: string, url: string, status: string | number, platform?: NodeJS.Platform): string;
+export declare function getLatestReleaseForTest(options: NpmRegistryLookupOptions): Promise<ReleaseInfo>;
+export declare function formatBinaryDownloadFailureMessageForTest(binaryName: string, url: string, status: string | number, platform?: NodeJS.Platform, registryNote?: string): string;
 export declare function buildReleaseBinaryUrlForTest(version: string, platform?: NodeJS.Platform, arch?: string): string;
 export declare function formatManualUpdateInstructionsForTest(platform?: NodeJS.Platform): string;
 export declare function formatVerificationFailureForTest(result: InstalledVersionVerification, expectedVersion: string): string;
@@ -91,9 +97,9 @@ export declare function runBinaryUpdateFlow(targetPath: string, url: string, exp
  * Run the update command.
  */
 export interface UpdateCommandDependencies {
-    getLatestRelease?: () => Promise<ReleaseInfo>;
+    getLatestRelease?: (installer?: Installer) => Promise<ReleaseInfo>;
     resolveUpdateTarget?: () => Promise<UpdateTarget>;
-    performUpdate?: (target: UpdateTarget, expectedVersion: string) => Promise<void>;
+    performUpdate?: (target: UpdateTarget, expectedVersion: string, registry?: string) => Promise<void>;
     refreshInstalledDefaultSkills?: () => Promise<void>;
     exit?: (code: number) => never;
 }

package/dist/types/commands/notify.d.ts

@@ -65,6 +65,12 @@ export default class Notify extends Command {
         message: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
+        "session-id": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "thread-ts": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
         "owner-id": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };

package/dist/types/config/file-lock.d.ts

@@ -2,6 +2,8 @@ export interface FileLockOptions {
     staleMs?: number;
     retries?: number;
     retryDelayMs?: number;
+    /** Stable host identity required to safely reclaim locks on a shared volume. */
+    ownerHostId?: string;
 }
 export declare const FileLockTestHooks: {
     afterParentMkdir?: (lockPath: string) => void | Promise<void>;
@@ -18,6 +20,7 @@ export declare function readFileLockInfoForGc(lockDir: string): Promise<FileLock
 export interface FileLockOwnerToken {
     pid: number;
     start_time?: string;
+    owner_host_id?: string;
     timestamp: number;
 }
 /** Outcome of a guarded lock-dir removal attempt (`removeFileLockDirForGc`). */

package/dist/types/coordinator/contract.d.ts

@@ -1,4 +1,4 @@
 export declare const COORDINATOR_MCP_PROTOCOL_VERSION = "2024-11-05";
 export declare const COORDINATOR_MCP_SERVER_NAME = "gjc-coordinator-mcp";
-export declare const COORDINATOR_MCP_TOOL_NAMES: readonly ["gjc_coordinator_list_sessions", "gjc_coordinator_read_status", "gjc_coordinator_read_tail", "gjc_coordinator_list_questions", "gjc_coordinator_list_artifacts", "gjc_coordinator_read_artifact", "gjc_coordinator_read_coordination_status", "gjc_coordinator_watch_events", "gjc_coordinator_register_session", "gjc_coordinator_start_session", "gjc_coordinator_stop_session", "gjc_coordinator_send_prompt", "gjc_coordinator_submit_question_answer", "gjc_coordinator_read_turn", "gjc_coordinator_await_turn", "gjc_coordinator_report_status", "gjc_delegate_plan", "gjc_delegate_execute", "gjc_delegate_team"];
+export declare const COORDINATOR_MCP_TOOL_NAMES: readonly ["gjc_coordinator_list_sessions", "gjc_coordinator_read_status", "gjc_coordinator_read_tail", "gjc_coordinator_list_questions", "gjc_coordinator_list_artifacts", "gjc_coordinator_read_artifact", "gjc_coordinator_read_coordination_status", "gjc_coordinator_watch_events", "gjc_coordinator_register_session", "gjc_coordinator_start_session", "gjc_coordinator_activate_session", "gjc_coordinator_stop_session", "gjc_coordinator_send_prompt", "gjc_coordinator_submit_question_answer", "gjc_coordinator_read_turn", "gjc_coordinator_await_turn", "gjc_coordinator_report_status", "gjc_delegate_plan", "gjc_delegate_execute", "gjc_delegate_team"];
 export type CoordinatorToolName = (typeof COORDINATOR_MCP_TOOL_NAMES)[number];

package/dist/types/coordinator-mcp/question-state.d.ts

@@ -1,5 +1,7 @@
 import type { PrivateAskGateCodecV1, PublicReason } from "./question-gate-codec";
-export type CoordinatorSessionState = "booting" | "ready_for_input" | "running" | "needs_user_input" | "completed" | "errored" | "stale" | "unknown";
+export type CoordinatorSessionState = "booting"
+/** Live and endpoint-addressable, but withholding readiness until activation. */
+ | "prepared" | "ready_for_input" | "running" | "needs_user_input" | "completed" | "errored" | "stale" | "unknown";
 export interface CanonicalSessionSnapshotV1 {
     schema_version: 1;
     namespace_id: string;

package/dist/types/extensibility/extensions/index.d.ts

@@ -3,6 +3,7 @@
  */
 export type { SlashCommandInfo, SlashCommandLocation, SlashCommandSource } from "../slash-commands";
 export { discoverAndLoadExtensions, ExtensionRuntimeNotInitializedError, loadExtensionFromFactory, loadExtensions, } from "./loader";
+export * from "./ouroboros-ooo-bridge";
 export * from "./prefix-command-bridge";
 export * from "./runner";
 export * from "./types";

package/dist/types/extensibility/extensions/ouroboros-ooo-bridge.d.ts

@@ -0,0 +1,13 @@
+import { callTool, connectToServer, disconnectServer } from "../../runtime-mcp";
+import type { ExtensionContext, InputEvent, InputEventResult } from "./types";
+interface OuroborosOooBridgeOptions {
+    connect?: typeof connectToServer;
+    callTool?: typeof callTool;
+    disconnect?: typeof disconnectServer;
+}
+interface OuroborosOooBridgeHandler {
+    (event: InputEvent, ctx: ExtensionContext): Promise<InputEventResult>;
+    reset(): Promise<void>;
+}
+export declare function createOuroborosOooBridge(options?: OuroborosOooBridgeOptions): OuroborosOooBridgeHandler;
+export {};

package/dist/types/extensibility/extensions/prefix-command-bridge.d.ts

@@ -32,4 +32,3 @@ export interface ExactPrefixCommandBridgeOptions {
  * bridge while the child command runs.
  */
 export declare function createExactPrefixCommandBridge(options: ExactPrefixCommandBridgeOptions): (event: InputEvent, ctx: ExtensionContext) => Promise<InputEventResult>;
-export declare function createOuroborosOooBridge(): (event: InputEvent, ctx: ExtensionContext) => Promise<InputEventResult>;

package/dist/types/extensibility/extensions/types.d.ts

@@ -239,6 +239,8 @@ export interface ExtensionContext {
     hasUI: boolean;
     /** Current working directory */
     cwd: string;
+    /** Aborted when the runner stops waiting for this handler, including handler timeout. */
+    signal?: AbortSignal;
     /** Session manager (read-only) */
     sessionManager: ReadonlySessionManager;
     /** Session classification supplied by the SDK for extension policy decisions. */

package/dist/types/main.d.ts

@@ -16,7 +16,7 @@ import type { PrintModeOptions } from "./modes/print-mode";
 import { initTheme } from "./modes/theme/theme";
 import type { SubmittedUserInput } from "./modes/types";
 import type { MCPManager } from "./runtime-mcp";
-import { type CreateAgentSessionOptions, createAgentSession, discoverAuthStorage } from "./sdk";
+import { type CreateAgentSessionOptions, type CreateAgentSessionResult, createAgentSession, discoverAuthStorage } from "./sdk";
 import type { AgentSession } from "./session/agent-session";
 import { type ResumeSessionIdentity, type SessionDestination, type SessionDirectoryMigrationPolicy, type SessionInfo, SessionManager, type StrictSessionOpenResult } from "./session/session-manager";
 import { runStartupCredentialAutoImportIfNeeded } from "./setup/credential-auto-import";
@@ -55,6 +55,7 @@ type StartupModelProfileArgs = {
     parsedArgs: Pick<Args, "default" | "model" | "mpreset" | "thinking">;
     startupModel?: CreateAgentSessionOptions["model"];
     startupThinkingLevel?: CreateAgentSessionOptions["thinkingLevel"];
+    preferCachedModels?: boolean;
 };
 export declare function applyStartupModelProfiles(args: StartupModelProfileArgs): Promise<void>;
 export declare function applyStartupModelProfilesOrExit(args: StartupModelProfileArgs): Promise<void>;
@@ -74,6 +75,9 @@ export declare function applyStartupModelProfilesForRoot(args: StartupModelProfi
 }): Promise<{
     recoverableErrors: string[];
 }>;
+type DeferredModelProfileStartup = () => Promise<{
+    recoverableErrors: string[];
+}>;
 interface InteractiveModeFactoryOptions {
     session: AgentSession;
     version: string;
@@ -95,7 +99,7 @@ export declare const BARE_RESUME_INTERACTIVE_ERROR = "--resume requires an inter
 /** Resolves only the managed agent root needed for pre-consent picker inventory. */
 export declare function resolveManagedAgentDirForScope(_cwd: string): string;
 export declare const BARE_RESUME_OPEN_ERROR = "Could not open the selected session. Use --resume <id>.";
-export declare function runInteractiveMode(session: AgentSession, version: string, changelogMarkdown: string | undefined, notifs: (InteractiveModeNotify | null)[], startupUpdate: StartupUpdateOrchestrator, initialMessages: string[], setExtensionUIContext: (uiContext: ExtensionUIContext, hasUI: boolean) => void, lspServers: LspStartupServerInfo[] | undefined, mcpManager: MCPManager | undefined, eventBus?: EventBus, initialMessage?: string, initialImages?: ImageContent[], createInteractiveMode?: CreateInteractiveMode, resumeAction?: "continue-tail" | "open-idle"): Promise<void>;
+export declare function runInteractiveMode(session: AgentSession, version: string, changelogMarkdown: string | undefined, notifs: (InteractiveModeNotify | null)[], startupUpdate: StartupUpdateOrchestrator, initialMessages: string[], setExtensionUIContext: (uiContext: ExtensionUIContext, hasUI: boolean) => void, lspServers: LspStartupServerInfo[] | undefined, mcpManager: MCPManager | undefined, eventBus?: EventBus, initialMessage?: string, initialImages?: ImageContent[], createInteractiveMode?: CreateInteractiveMode, resumeAction?: "continue-tail" | "open-idle", startDeferredMcpConfig?: CreateAgentSessionResult["startDeferredMcpConfig"], startDeferredModelProfiles?: DeferredModelProfileStartup): Promise<void>;
 export declare function getChangelogForDisplay(parsed: Args): Promise<string | undefined>;
 export declare function createSessionManager(parsed: Args, cwd: string, activeSettings?: Settings): Promise<SessionManager | undefined>;
 /**

package/dist/types/modes/components/session-selector.d.ts

@@ -35,7 +35,7 @@ export declare class SessionSelectorComponent extends Container {
     private readonly onDelete?;
     private readonly inspector?;
     private readonly onSelection?;
-    constructor(sessions: SessionInfo[], onSelect: (sessionPath: string) => void, onCancel: () => void, onExit: () => void, onDelete?: ((session: SessionInfo) => Promise<boolean>) | undefined, inspector?: SessionInspector | undefined, onSelection?: ((selection: SessionSelectionResult) => void) | undefined);
+    constructor(sessions: SessionInfo[], onSelect: (sessionPath: string) => void | Promise<void>, onCancel: () => void, onExit: () => void, onDelete?: ((session: SessionInfo) => Promise<boolean>) | undefined, inspector?: SessionInspector | undefined, onSelection?: ((selection: SessionSelectionResult) => void) | undefined);
     setOnRequestRender(callback: () => void): void;
     handleInput(keyData: string): void;
     getSessionList(): SessionList;

package/dist/types/modes/utils/host-status.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Host-terminal agent status markers.
+ *
+ * Interactive turns announce their state as an OSC 777 sequence:
+ *
+ *     ESC ] 777 ; notify;Terax;gjc;<event> BEL
+ *
+ * A terminal that understands the sequence (Terax reads it to drive its per-tab
+ * agent status and header bell) reacts; every other terminal discards the OSC
+ * as unknown, exactly like the OSC 133 prompt marks and OSC 7 cwd reports that
+ * shells emit unconditionally. So there is no host sniffing and no env gate:
+ * any host that wants agent status can parse the stream without gjc knowing it
+ * exists.
+ *
+ * `notify;Terax;` is the wire identifier of the only protocol that currently
+ * carries per-turn agent state, not a host check - the payload names gjc as the
+ * reporting agent.
+ *
+ * Interactive TUI only. Print and RPC mode stdout stays byte-for-byte parseable
+ * because they never reach these controllers.
+ */
+export type HostStatusEvent = "working" | "attention" | "finished";
+export declare function emitHostStatus(event: HostStatusEvent, output?: Pick<NodeJS.WriteStream, "write">): void;

package/dist/types/runtime-mcp/types.d.ts

@@ -186,6 +186,8 @@ export type MCPContent = MCPTextContent | MCPImageContent | MCPResourceContent;
 export interface MCPToolCallResult {
     content: MCPContent[];
     isError?: boolean;
+    /** MCP result metadata, encoded as `_meta` on the wire. */
+    _meta?: Record<string, unknown>;
 }
 /** Expected configured-server transport or protocol failure. */
 export declare class MCPExpectedFailure extends Error {

package/dist/types/sdk/broker/lifecycle.d.ts

@@ -48,6 +48,16 @@ export interface SessionLifecycleTranscriptIdentity {
     mtimeNs: string;
     sha256: string;
 }
+/**
+ * When a lifecycle-managed session publishes its replayable readiness signal.
+ *
+ * `immediate` is the stock contract. `deferred` prepares the session instead:
+ * the child publishes a distinct prepared signal, keeps `session_ready`
+ * withheld, and stays unusable for input until it is explicitly activated. It
+ * is broker-issued and session-scoped precisely so a prepared session can never
+ * be produced by an inherited process-global flag.
+ */
+export type SessionLifecycleReadiness = "immediate" | "deferred";
 export interface SessionLifecycleLaunchRequest {
     operation: "session.create" | "session.fork" | "session.resume";
     sessionId: string;
@@ -64,6 +74,8 @@ export interface SessionLifecycleLaunchRequest {
     modelPreset?: string;
     mcpServers?: SessionLifecycleMcpServer[];
     worktree?: SessionLifecycleWorktreeTarget;
+    /** Absent means the stock immediate contract; `deferred` prepares the session. */
+    readiness?: SessionLifecycleReadiness;
     receivedAt: number;
     requestedReadinessTimeoutMs: number;
     semanticReadyDeadlineAt: number;

package/dist/types/sdk/bus/chat-daemon-cli.d.ts

@@ -1,9 +1,12 @@
+import { type ChatDaemonCommandBindInput, type ChatDaemonCommandOutcome } from "./chat-daemon-command-channel";
 import { type ChatDaemonKind, renewChatDaemonHeartbeat } from "./chat-daemon-control";
 import { type ChatDaemonRuntimeConfig } from "./chat-daemon-runtime";
 export interface ChatDaemonRuntimeHandle {
     start(): Promise<void>;
     stop(): Promise<void>;
     transportHealthy?(): boolean;
+    /** Executes operator commands that must run inside the owning daemon. */
+    bindExistingRoot?(request: ChatDaemonCommandBindInput): Promise<ChatDaemonCommandOutcome>;
 }
 export interface RunChatDaemonInternalDeps {
     processPid?: number;