@gajae-code/coding-agent 0.12.11 → 0.12.13

package/CHANGELOG.md

@@ -2,6 +2,65 @@
 
 ## [Unreleased]
 
+## [0.12.13] - 2026-08-06
+
+### Fixed
+- ACP session configuration now emits the spec-defined `category` field on the Mode, Model, and Thinking select options (`mode`, `model`, `thought_level`), so standards-compliant ACP clients such as Paseo discover models, modes, and thinking levels instead of an empty model picker (#3922).
+- The ACP session model catalog is now filtered to active providers via `providers.list/active`, falling back to the full catalog on older session hosts, so ACP clients no longer list models for providers without usable credentials (#3922).
+
+- `todo_write` now rejects malformed raw arguments with bounded, authority-controlled correction codes instead of a generic rejection: unknown root keys, unknown operation-entry keys, done/drop entries without a task or phase target, and unknown init list-entry keys each surface a fixed message naming the accepted shape without echoing the offending input, while recoverable payloads keep the passthrough/coercion path and the existing ask-tool codes are untouched (#3916).
+- The Alibaba Token Plan onboarding preset and `alibaba-token-plan-qwen-deepseek` profile now reference the provider-supported `qwen3.8-max` model id instead of `qwen-3.8-max`, preventing the built-in profile from selecting an HTTP 400 unsupported model (#3909).
+- `/model` reasoning menu header now shows the highlighted reasoning level (not the model id), seeds the cursor from the role badge when re-editing the same model, and uses a provider-neutral label for `max` instead of "Opus maximum reasoning" (#3847).
+- Resume listing now reverse-scans for buried but canonically valid `header_patch` titles, so a persisted manual title remains visible in the picker after later transcript growth instead of falling back to an empty/line-1 projection (#3633).
+- Custom OpenAI-compatible models whose wire id is namespaced (for example `cline-pass/deepseek-v4-flash`) now inherit capability metadata from the bundled leaf model when `contextWindow` / `maxTokens` are omitted, instead of silently falling back to the generic 128K / 16K defaults. True unknown leaf ids still default; explicit limits remain authoritative (#3856).
+- `gjc gc` file-lock discovery now budgets the walk **per lock root** and reports a hit entry cap as a **warning**, not a hard error. Truncating one root no longer skips the remaining roots, and a healthy run with only cap warnings exits `0` so scripts/cron/`&&` chains stay usable (#3852).
+
+- `gjc models` is no longer treated as a free-form agent prompt. The mistaken subcommand spelling now routes to the existing `--list-models` listing path so a nested bash-tool invocation cannot recursively spawn unbounded GJC agents (#3857).
+- Always-apply and rulebook rules are injected on the default system prompt path again. Discovery still loaded `.gjc/rules/`, `~/.gjc/agent/rules/`, and sticky `RULES.md`, but only `custom-system-prompt.md` rendered them, so normal sessions silently dropped the content while AGENTS.md in the same directory continued to work (#3859).
+- Made Telegram reference-client capability diagnostics safe for TUI embedding.
+- Custom `anthropic-messages` providers can now configure `compat.promptCacheMode` (`none`, `explicit`, or `automatic`) and `compat.supportsLongCacheRetention` at provider, model, and model-override levels. This makes the automatic Claude-family caching default safely overridable for compatible endpoints that require block-level cache markers or do not support 1-hour retention.
+- A Telegram notification daemon whose reconciliation pass fails no longer exits. The pass persists through the shared topic authority, and a momentarily unavailable authority (lock contention or a rejected compare-and-set) rejected out of both the scan timer and the run loop into the process-level fatal handler, killing the owner. Every session topic was then left behind as an unarchived shell that answers nothing — including for sessions that were still live and lost their notifications. The pass now reports the failure and the next scan interval retries it; the queue-flush timer is guarded the same way.
+- MiniMax M3 preset and profile ids canonicalized to `MiniMax-M3` (issue #3896): the `minimax` / `minimax-cn` onboarding presets and the `minimax-eco` / `minimax-medium` / `minimax-pro` builtin model profiles no longer reference the removed lowercase `minimax-m3` / `minimax-v3` first-class catalog ids.
+- Deep-interview round identity and input caps are now Unicode-canonical. Question text, selected options, and custom input are canonicalized to NFC before hashing and persisting, so the same Korean answer arriving in decomposed form (macOS-sourced pastes and some IME/clipboard paths emit NFD) no longer produces a second `answer_hash` — the documented append-or-merge no-op holds, and intent-review approval evidence still matches the user's recorded answer. Free-text caps are measured on the NFC form, so decomposed Hangul is charged the same character budget as the identical composed text instead of 2–3 code points per syllable (#3871).
+- Telegram notifications no longer disappear in a paired private chat whose bot has no Threaded Mode. Telegram answers `createForumTopic` there with `Bad Request: the chat is not a forum`, which was not recognized as a capability refusal, and the refusal verdict lived in caller-local flags — so every frame that joined the shared in-flight topic creation rethrew and its message (identity headers after `/resume`, asks, context updates) was dropped instead of being delivered flat. The rejection is now carried by typed errors that every awaiter of the same creation classifies identically, `the chat is not a forum` counts as a capability refusal, and a confirmed refusal is latched so later frames stop re-issuing a rejected `createForumTopic` per message.
+- Slash commands now expand in non-interactive runs. `gjc -p "/init"` previously reached the model as the literal text `/init`, so no command body was injected, no file was written, and the model still answered as if the command had run. Print mode now loads the same bundled and file-based command list interactive mode uses before it prompts.
+- `gjc plugin install <name>` now names the marketplaces that offer `<name>` when the npm resolution it falls back to fails, so a plugin name copied out of `gjc plugin discover` no longer dead-ends on a bare `install_failed`.
+- A remote multi-select ask now shows what is already selected. The ask tool re-issues one remote request per toggle, but the request carried no selection state, so Telegram kept posting an identical prompt with no sign that option 1 had been picked — the checkbox rendering existed only for durable workflow gates. `AskAnswerRequest` now carries `multi` and the selected option labels, the notification bus publishes them as `selectedOptionIndices` with the `(N selected)` question prefix while keeping the ask tool's own Next/Done control, and pre-numbered options (deep interview) are renumbered once instead of rendering as `1. ☑ 1. …`.
+
+## [0.12.12] - 2026-08-05
+
+### Added
+
+- Interactive turns now announce their state as an OSC 777 sequence (`notify;Terax;gjc;working|attention|finished`), so a hosting terminal can follow the agent without polling. Terminals that do not parse it discard it like any unknown OSC, and print/RPC mode stdout is untouched.
+- Existing Slack threads can now be adopted through an opt-in prepare → bind → activate lifecycle. A prepared session (broker `readiness: "deferred"` / `gjc_coordinator_start_session` with `prepare_existing_thread`, or `GJC_NOTIFY_BIND_EXISTING_THREAD=1` for a manually started one) publishes discoverable endpoint authority while withholding readiness, so no stock root is claimed; `gjc notify bind-thread` then adopts the exact operator-supplied root through the running Slack daemon owner over a new per-request command channel — the CLI is never a direct mapping writer — and `gjc notify activate-thread` / `gjc_coordinator_activate_session` publishes the withheld readiness exactly once behind a gate that proves the daemon-owned mapping at that endpoint generation. Adoption posts zero replacement roots, is fenced on the exact session/generation/daemon-owner tuple, and is idempotent on exact retry. Every mapping mutation passes a two-sided final authority fence inside the store lock — authority is proven, commit authority is taken, and authority is proven again — so a session, endpoint generation, or daemon-owner tuple that rolls while commit authority is being taken leaves no mapping behind. `ChatDaemonRuntime` now drops internal control-plane frames (`session_prepared`, `event_replay_result`, `control_response`, `query_response`, `hello`) before any post, root, mapping, resume, close, or action mutation on both the live and replay paths, and correlates each delivered frame first: an event envelope, its `name`/`kind` aliases, and its payload are representations of one event, so disagreeing spellings, a duplicated `sessionId`/`generation` that is unequal or present-but-malformed, and a reserved lifecycle or control-plane identity carried on only one representation all make the frame inert before any mutation. Because the command channel proves correlation and never authorship, a reported `status:"ok"` that the durable conversation store does not corroborate is reported as `binding_outcome_unknown` instead of success; a storage failure raised after commit authority was granted — the mapping rename applies before its durability barrier — is reported as `binding_outcome_unknown` rather than as a definitive rejection an operator could retry against; and a timeout that wins the single-winner response claim is a definitive, mutation-free failure for that submission's race against a concurrent serve (not durable settlement across a crashed and resurrected daemon). Ordinary sessions keep the stock immediate ready/root behaviour.
+
+### Added
+
+- Added a verified, copy-installable `ooo` bridge example: `ooo interview` renders Ouroboros MCP questions in GJC, serializes startup and follow-up answers by session ID, cancellation-fences late settlement, disposes state on GJC session changes and `/clear`, drops queued predecessor-generation starts, releases dead transports and controls, honors `OUROBOROS_CLI`, and loads dependency-free in compiled binaries (#3803).
+
+### Fixed
+
+- Fixed deep-interview prompts exposing the literal argument placeholder.
+
+- Automatic session retry now refuses to re-issue a request once the failed attempt carries observable assistant text, thinking, or tool-call content — including under explicit legacy `retry.*` settings. Content-free clean failures keep their existing bounded/unbounded policy; managed provisional discard, credential rotation, first-event timeout scope checks, and manual `/retry` are unchanged (#3791).
+- Resuming a session whose transcript file is at or above the ~64 MiB managed-storage per-file bound no longer OOMs, stalls the process, or fails with a bare unhandled rejection. Resume/open now fail closed with a structured `oversized` reason (`SessionTranscriptOversizedError`) and recovery guidance before the full read/decode/parse path, instead of loading the entire file into memory. The bound matches the existing managed-artifact per-file limit and is not raised; sub-limit sessions resume unchanged (#3851).
+
+- Parent sessions and their subagent trees now share one identity-authorized artifact manager across persistent and ephemeral operation. Non-persistent roots are retired on committed session transitions and terminal close, failed transitions retain predecessor ownership, and atomic numeric-ID claims prevent same-root managers from creating ambiguous artifact references (#3813).
+
+- Telegram daemon restart now revokes every persisted callback alias before polling. Reconnecting sessions must replay a pending ask to receive fresh, owner-bound aliases; old controls remain stale, and their keyboards are best-effort terminalized when the original Telegram message id is available. Shutdown now fences new session messages and drains every admitted handler before final callback persistence and ownership release, preventing a successful send racing shutdown from publishing alias state after a successor takes ownership (#3727).
+- Extension handler timeout signals now preserve lazy, live context accessors instead of eagerly snapshotting them. Model changes made through SDK controls are immediately visible to later context reads, and unused getters can no longer reject lifecycle emission before the runner's extension error boundary (#3817).
+- Direct interactive launches inside tmux now bind automatic window renames to the originating pane's immutable pane/window identities and observed window index. If that binding changes before mutation, GJC preserves every window name instead of renaming whichever window became active (#3808).
+- `gjc update` and the startup version check now resolve the npm registry from npm configuration — `npm_config_registry` or `BUN_CONFIG_REGISTRY` from the environment, a scoped `@scope:registry` key, and the user and machine-wide `.npmrc` files, including the credentials registered for that registry — instead of always querying `registry.npmjs.org`. On networks that mirror or block the public registry the check failed with an empty `Failed to fetch release info:` even though the install step, which already shells out to bun/npm and therefore honored the configured registry, would have succeeded. Repository-controlled configuration is excluded: a `.npmrc` in the current working directory is not read, the environment is read through `$credentialEnv`, and `npm_config_*` is ignored entirely when GJC is launched by an npm lifecycle, because npm synthesizes those variables from the project `.npmrc` with `${VAR}` already expanded. Credentials are never sent to a remote plaintext `http:` registry, including credentials embedded in the registry URL. Whichever manager will run the install decides Bun-vs-npm config priority, the machine-wide config path is derived from npm's own prefix rather than guessed, and keys inside an ini `[section]` are not treated as top-level config. A registry that is configured but unusable, and a config file that exists but cannot be read, fail loudly instead of silently falling back to the public registry; failures name the URL, the status, and the exact file or environment variable the registry came from — including the case where an intercepting proxy answers 200 with a non-JSON body — and credentials are stripped from a `https://user:pass@host` registry rather than printed with it. `bunfig.toml` is not read. (#3821)
+
+### Fixed
+
+- Telegram `notify setup` activation works when `notifications/` is a directory symlink (multi-account shared notification dirs). Transition-lock release previously rejected intermediate directory reparse points, left `telegram-daemon.steal` behind, and failed with "provisional ownership could not be retired safely" while durable settings remained armed. Only intermediate directory components are resolved before native exact unlink; the final basename is rejoined so final-component file symlinks stay `reparse_point` under native `AT_SYMLINK_NOFOLLOW`, including TOCTOU replacement after JS preflight (#3761).
+- A failed `notify setup` no longer reports "Unable to persist and activate Telegram notification settings" when the durable configuration already carries the attempted bot token, chat id, and enabled state. The wording now follows the stored configuration, so it can no longer contradict a follow-up `notify status`; an operator who reads the failure as "nothing was saved" would otherwise leave Telegram armed for a token another poller may own. A commit that was entered and then failed while the stored configuration is also unreadable is reported as undecided, pointing at `notify status`, instead of guessing either outcome (#3761).
+- Continuing a large managed session on Darwin now batches stale OpenAI Responses replay-metadata patches into one transcript append instead of performing one identity-verified whole-file replacement per patch. Interactive startup also renders before exact MCP connection and explicit `--mpreset` activation, gates every provider turn until both are ready, and refreshes models online only after the UI is usable, preventing `gjc -c` from remaining at `GJC warming workspace` with sustained CPU, multi-gigabyte RSS growth, or avoidable network waits (#3793).
+- Slack Web API requests now use form encoding instead of JSON, preventing thread reconciliation through `conversations.replies` from failing with `invalid_arguments`.
+
+- Managed replacement cleanup now migrates version-one receipts from earlier releases and recovers canonical exchange placeholders left by interrupted cleanup, so a stale receipt cannot permanently block the next managed session mutation with `managed_replace_cleanup_receipt_invalid`.
+
 ## [0.12.11] - 2026-08-03
 
 ### Fixed
@@ -10,6 +69,7 @@
 - Managed session rewrites and authority-absent Darwin appends now use native identity-verified atomic replacement instead of deterministically failing with `managed_replace_exact_unavailable` or risking a torn JSONL tail; uncertain readable outcomes are re-fsynced and carried through ctime-bound strict adoption before recovery reports them durable. This unblocks Darwin compaction and session append durability when retained native authority is absent (#3742, #3760).
 - `todo_write` recovery reminders now distinguish rejected payloads from runtime aborts, preserve the available cause, and require durable state reconciliation instead of incorrectly telling the agent to change a valid payload (#3743, #3760).
 - Authority-absent Darwin `appendSync` regression coverage now exercises the replace-based race window (destination mutation during successor staging) instead of the retired in-place `O_APPEND` open path, and documents that ctime-only destination transitions are tolerated by exact replacement.
+- The legacy interactive footer now uses the session manager's cumulative usage index, so completed task and subagent tokens, premium requests, and estimated costs are included exactly once instead of reporting only the parent agent's assistant messages.
 
 ## [0.12.10] - 2026-08-03
 
@@ -31,6 +91,9 @@
 - Dead-owner notification recovery now preserves a machine-readable transition block, marker-age diagnostics, and safe force-recovery guidance without weakening ownership proofs (#3762).
 - Detached SDK session hosts no longer outlive the broker that spawned them. A host whose broker died without teardown (crash, `SIGKILL`, restart without `--close-session-hosts`) previously stayed resident forever, holding its session's memory — hundreds of MB per orphan. Each host now polls the broker discovery publication and, after a bounded grace period with no live broker, disposes itself through the same graceful teardown a `SIGTERM` takes. A replacement broker resets the window, so hosts still survive ordinary broker restarts, and a transient discovery read failure is treated as ambiguity rather than proof of orphanhood.
 - Syntax highlighting now recognizes special filenames such as `CMakeLists.txt`, `Dockerfile.*`, `Makefile`, and `.env.*` before generic filename extensions.
+### Changed
+
+- Updated the Cursor Eco, Medium, and Pro profiles from Composer 1.5 to distinct Composer 2.5 tiers: standard throughout for Eco, Fast on execution/review/design roles for Medium, and Fast throughout for Pro. Removed inert generic effort suffixes that the Cursor RPC could not transport.
 
 ## [0.12.8] - 2026-08-02
 ### Added
@@ -46,6 +109,9 @@
 
 - Windows automatic tmux resolution now selects `psmux` then `pmux` by canonical command order without rejecting distinct lower-priority aliases; it probes `tmux` only when neither named provider is available (#3725).
 - CI failure extraction now aggregates Bun failure and suite-error summaries across every test invocation in a job log instead of silently using only the first summary.
+- The GitHub status-line lookup now binds terminal links to positive PR numbers and canonical matching HTTP(S) pull-request URLs, rejecting ambiguous or control-bearing targets.
+- Fork-context subagents no longer inherit the parent's provider continuity identity. Each child session now presents its own `session_id`/`prompt_cache_key`, so concurrent subagent fleets stop colliding on session-owning upstream transports (`owner_busy` websocket-to-HTTP fallbacks) and keep per-worker cache affinity. Explicit `providerSessionId` overrides and serial same-session continuity are unchanged.
+- Fork-context subagents no longer inherit the parent's provider continuity identity. Each child session now presents its own `session_id`/`prompt_cache_key`, so concurrent subagent fleets stop colliding on session-owning upstream transports (`owner_busy` websocket-to-HTTP fallbacks) and keep per-worker cache affinity. Because `providerSessionId` scopes sticky credential selection as well as prompt-cache affinity, each child also selects its provider credential independently instead of following the parent's sticky choice. Explicit `providerSessionId` overrides and serial same-session continuity are unchanged.
 - Ordinary `ask` selectors now bound long question premises and page through every premise row without skipping rows hidden by overflow indicators (#3675).
 - First-event timeout retries now require a typed, content-free failure from the current clean attempt scope, preventing prior or stale extension activity from suppressing or admitting a later request (#3553).
 - The issue-1979 Korean prose wrap test now cleans up inherited multiplexer env vars (`TMUX`, `TMUX_PANE`, etc.) so it deterministically exercises the plain-terminal render path regardless of the CI runner's terminal session (#1979).
@@ -146,6 +212,8 @@
 
 - User-created Telegram forum topics can now start a GJC session by selecting the home folder, choosing a verified recent work folder, or entering an explicit folder path. The selected topic is adopted by the new session without creating or deleting a separate Telegram topic.
 - The interactive terminal’s responsive IRC/todo work-lane contract now covers exact narrow/wide geometry, requested versus effective IRC visibility, direct-root pin ordering, todo lane bounds, remapped IRC toggles, and live composer shortcut hints.
+- Managed-session startup now preserves bounded Windows ACL and identity failure classifications in path-redacted recovery guidance without broadening permissions, elevation, or unsafe fallback.
+- Telegram topic synchronization now uses generation-CAS shared authority, durable pre-create claims, lease-fenced effects, bounded single-flight archive retries, and an isolated owner-backed validation-supergroup mode without deleting topics.
 
 ### Fixed
 

package/dist/types/cli/marketplace-hint.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Install-failure hints for marketplace-shaped plugin names.
+ *
+ * A bare spec (no `@marketplace`) is always classified as npm, so a user who
+ * copies a plugin name out of `plugin discover` gets an npm resolution failure
+ * with no hint that the same name is offered by a registered marketplace.
+ *
+ * Kept dependency-free — the marketplace barrel loads native addons — so this
+ * takes the narrow catalog surface it actually reads instead of the manager.
+ */
+/** The catalog lookups this module needs; `MarketplaceManager` satisfies it. */
+export interface MarketplaceCatalogLookup {
+    listMarketplaces(): Promise<ReadonlyArray<{
+        name: string;
+    }>>;
+    getPluginInfo(name: string, marketplace: string): Promise<unknown | null>;
+}
+/**
+ * A bare name carries no `@scope`, version specifier, or path separator, so it
+ * is the only install spec shape that is safe to echo back in an error.
+ */
+export declare function isBareInstallName(spec: string): boolean;
+/**
+ * Names of registered marketplaces whose catalog offers a plugin under exactly
+ * `name`. Only marketplace names are returned: they are user-chosen registry
+ * labels, never the plugin source, so they carry no credentials or home paths.
+ */
+export declare function findMarketplacesOffering(catalogs: MarketplaceCatalogLookup, name: string): Promise<string[]>;

package/dist/types/cli/notify-cli.d.ts

@@ -1,8 +1,10 @@
 import { Settings } from "../config/settings";
 import { type EnsureChatDaemonResult } from "../sdk/bus/chat-daemon-control";
+import { type ActivatedPreparedSession } from "../sdk/bus/existing-thread-readiness";
+import { type BoundSlackThread } from "../sdk/bus/slack-thread-binding";
 import { type EnsureTelegramDaemonDetailedResult } from "../sdk/bus/telegram-daemon";
 import { type TelegramSetupPreflight, type TelegramSetupTimers } from "../sdk/bus/telegram-setup";
-export type NotifyAction = "setup" | "status" | "health" | "test" | "recovery" | "daemon-internal";
+export type NotifyAction = "setup" | "status" | "health" | "test" | "recovery" | "bind-thread" | "activate-thread" | "daemon-internal";
 export type NotifySetupProvider = "telegram" | "discord" | "slack";
 export interface NotifyCommandArgs {
     action: NotifyAction;
@@ -24,6 +26,8 @@ export interface NotifyCommandArgs {
     forceDaemonLock?: boolean;
     probe?: boolean;
     message?: string;
+    sessionId?: string;
+    threadTs?: string;
 }
 export interface NotifyCommandDeps {
     fetchImpl?: typeof fetch;
@@ -50,6 +54,15 @@ export interface NotifyCommandDeps {
     setupPidIncarnation?: (pid: number) => string | undefined;
     ensureProviderDaemon?: (provider: "discord" | "slack", settings: Settings) => Promise<EnsureChatDaemonResult>;
     ensureTelegramDaemon?: (settings: Settings) => Promise<EnsureTelegramDaemonDetailedResult>;
+    bindSlackThread?: (input: {
+        settings: Settings;
+        sessionId: string;
+        threadTs: string;
+    }) => Promise<BoundSlackThread>;
+    activatePreparedSession?: (input: {
+        settings: Settings;
+        sessionId: string;
+    }) => Promise<ActivatedPreparedSession>;
 }
 export declare function parseNotifyArgs(args: string[]): NotifyCommandArgs | undefined;
 export declare function runNotifyCommand(cmd: NotifyCommandArgs, deps?: NotifyCommandDeps): Promise<void>;
@@ -61,5 +74,33 @@ type TokenPromptInput = NodeJS.ReadStream & {
 };
 type TokenPromptOutput = Pick<NodeJS.WriteStream, "write">;
 export declare function promptForToken(input?: TokenPromptInput, output?: TokenPromptOutput): Promise<string>;
+export interface BindThreadInvocation {
+    sessionId: string;
+    threadTs: string;
+}
+/**
+ * Enforce the exact `bind-thread` grammar at every entrypoint.
+ *
+ * The command accepts only a session and a root; a positional argument, an
+ * unrelated notify flag, or a target/credential input is a rejection rather than
+ * something silently ignored, so no other invocation shape can reach the
+ * binding authority.
+ */
+export declare function assertStrictBindThreadInvocation(cmd: NotifyCommandArgs): BindThreadInvocation;
+/** Confirmation carries identifiers only: no tokens, message bodies, or control secrets. */
+export declare function formatBoundSlackThread(bound: BoundSlackThread): string;
+export interface ActivateThreadInvocation {
+    sessionId: string;
+}
+/**
+ * Enforce the exact `activate-thread` grammar at every entrypoint.
+ *
+ * Activation names one prepared session and nothing else: the root it adopts is
+ * already the applied binding, so a supplied root, target, or credential is a
+ * rejection rather than something silently ignored.
+ */
+export declare function assertStrictActivateThreadInvocation(cmd: NotifyCommandArgs): ActivateThreadInvocation;
+/** Confirmation carries identifiers only: no endpoints, tokens, or thread content. */
+export declare function formatActivatedSession(activated: ActivatedPreparedSession): string;
 export declare function printNotifyHelp(): void;
 export {};

package/dist/types/cli/update-cli.d.ts

@@ -1,6 +1,11 @@
+import { type Installer, type NpmRegistryLookupOptions } from "../utils/npm-registry";
 interface ReleaseInfo {
     tag: string;
     version: string;
+    /** Registry the version came from. Release binaries still come from GitHub. */
+    registry: string;
+    /** Config problems that did not stop the lookup but changed its outcome. */
+    warnings: string[];
 }
 /** Result from running the installed binary and parsing its reported version. */
 export interface InstalledVersionVerification {
@@ -56,7 +61,8 @@ type PathPlatform = NodeJS.Platform;
 type PackageExists = (packageName: string, packageRoot: string) => boolean;
 export declare function resolveUpdateMethodForTest(ompPath: string, bunBinDir: string | undefined): "bun" | "npm" | "binary";
 export declare function resolveNpmManagedTargetForTest(ompPath: string, platform: PathPlatform, packageExists: PackageExists): PackageManagerTarget | undefined;
-export declare function formatBinaryDownloadFailureMessageForTest(binaryName: string, url: string, status: string | number, platform?: NodeJS.Platform): string;
+export declare function getLatestReleaseForTest(options: NpmRegistryLookupOptions): Promise<ReleaseInfo>;
+export declare function formatBinaryDownloadFailureMessageForTest(binaryName: string, url: string, status: string | number, platform?: NodeJS.Platform, registryNote?: string): string;
 export declare function buildReleaseBinaryUrlForTest(version: string, platform?: NodeJS.Platform, arch?: string): string;
 export declare function formatManualUpdateInstructionsForTest(platform?: NodeJS.Platform): string;
 export declare function formatVerificationFailureForTest(result: InstalledVersionVerification, expectedVersion: string): string;
@@ -91,9 +97,9 @@ export declare function runBinaryUpdateFlow(targetPath: string, url: string, exp
  * Run the update command.
  */
 export interface UpdateCommandDependencies {
-    getLatestRelease?: () => Promise<ReleaseInfo>;
+    getLatestRelease?: (installer?: Installer) => Promise<ReleaseInfo>;
     resolveUpdateTarget?: () => Promise<UpdateTarget>;
-    performUpdate?: (target: UpdateTarget, expectedVersion: string) => Promise<void>;
+    performUpdate?: (target: UpdateTarget, expectedVersion: string, registry?: string) => Promise<void>;
     refreshInstalledDefaultSkills?: () => Promise<void>;
     exit?: (code: number) => never;
 }

package/dist/types/cli.d.ts

@@ -144,6 +144,16 @@ export declare class RootHelpCommand extends Command {
 }
 /** Normalize the sole `gjc resume` alias into the value-less launch intent. */
 export declare function normalizeResumeAlias(argv: readonly string[]): string[];
+/**
+ * Map the common mistaken `models` subcommand spelling to non-agent listing.
+ *
+ * Agents frequently run `gjc models` from the bash tool expecting a catalog.
+ * Without this route, `models` was a positional launch prompt and nested agents
+ * re-invoked `gjc models`, spawning an unbounded process chain (#3857).
+ * Always rewrite to `launch --list-models` so the invocation exits after a
+ * bounded listing and never starts an interactive agent session.
+ */
+export declare function routeModelsAlias(argv: readonly string[]): string[] | undefined;
 /** Apply the same default-launch routing used by runCli after root fast paths. */
 export declare function routeRootArgv(argv: readonly string[]): string[];
 /** Run the CLI with the given argv (no `process.argv` prefix). */

package/dist/types/commands/notify.d.ts

@@ -65,6 +65,12 @@ export default class Notify extends Command {
         message: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
+        "session-id": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "thread-ts": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
         "owner-id": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };

package/dist/types/config/file-lock-gc.d.ts

@@ -1,5 +1,17 @@
 /**
  * GC adapter for config file-locks (`<file>.lock` dirs holding `{pid, timestamp}`).
  */
-import type { GcStoreAdapter } from "../gjc-runtime/gc-runtime";
+import type { GcCollectResult, GcContext, GcStoreAdapter } from "../gjc-runtime/gc-runtime";
+/** Default per-root walk budget. Truncation is a warning, not a hard error. */
+export declare const FILE_LOCK_GC_MAX_WALK_ENTRIES = 20000;
+export interface FileLocksGcCollectOptions {
+    /** Override per-root entry budget (tests). Defaults to {@link FILE_LOCK_GC_MAX_WALK_ENTRIES}. */
+    maxWalkEntries?: number;
+}
+/**
+ * Discover + classify file-lock records. Each known lock root gets its own walk
+ * budget so truncating one root never skips the others. Caps surface as
+ * warnings (partial results), not hard discovery errors.
+ */
+export declare function collectFileLocksForGc(ctx: GcContext, options?: FileLocksGcCollectOptions): Promise<GcCollectResult>;
 export declare const fileLocksGcAdapter: GcStoreAdapter;

package/dist/types/config/file-lock.d.ts

@@ -2,6 +2,8 @@ export interface FileLockOptions {
     staleMs?: number;
     retries?: number;
     retryDelayMs?: number;
+    /** Stable host identity required to safely reclaim locks on a shared volume. */
+    ownerHostId?: string;
 }
 export declare const FileLockTestHooks: {
     afterParentMkdir?: (lockPath: string) => void | Promise<void>;
@@ -18,6 +20,7 @@ export declare function readFileLockInfoForGc(lockDir: string): Promise<FileLock
 export interface FileLockOwnerToken {
     pid: number;
     start_time?: string;
+    owner_host_id?: string;
     timestamp: number;
 }
 /** Outcome of a guarded lock-dir removal attempt (`removeFileLockDirForGc`). */

package/dist/types/config/model-registry.d.ts

@@ -94,6 +94,8 @@ export declare const ModelsConfigFile: ConfigFile<{
             extraBody?: Record<string, unknown> | undefined;
             supportsStrictMode?: boolean | undefined;
             toolStrictMode?: "all_strict" | "none" | undefined;
+            supportsLongCacheRetention?: boolean | undefined;
+            promptCacheMode?: "automatic" | "explicit" | "none" | undefined;
         } | undefined;
         webSearch?: "auto" | "off" | "on" | undefined;
         authHeader?: boolean | undefined;
@@ -173,6 +175,8 @@ export declare const ModelsConfigFile: ConfigFile<{
                 extraBody?: Record<string, unknown> | undefined;
                 supportsStrictMode?: boolean | undefined;
                 toolStrictMode?: "all_strict" | "none" | undefined;
+                supportsLongCacheRetention?: boolean | undefined;
+                promptCacheMode?: "automatic" | "explicit" | "none" | undefined;
             } | undefined;
             contextPromotionTarget?: string | undefined;
             wireModelId?: string | undefined;
@@ -247,6 +251,8 @@ export declare const ModelsConfigFile: ConfigFile<{
                 extraBody?: Record<string, unknown> | undefined;
                 supportsStrictMode?: boolean | undefined;
                 toolStrictMode?: "all_strict" | "none" | undefined;
+                supportsLongCacheRetention?: boolean | undefined;
+                promptCacheMode?: "automatic" | "explicit" | "none" | undefined;
             } | undefined;
             contextPromotionTarget?: string | undefined;
             wireModelId?: string | undefined;

package/dist/types/config/models-config-schema.d.ts

@@ -1,4 +1,73 @@
 import * as z from "zod/v4";
+export declare const ModelCompatSchema: z.ZodObject<{
+    supportsStore: z.ZodOptional<z.ZodBoolean>;
+    supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
+    sendSessionHeaders: z.ZodOptional<z.ZodBoolean>;
+    supportsMultipleSystemMessages: z.ZodOptional<z.ZodBoolean>;
+    supportsReasoningEffort: z.ZodOptional<z.ZodBoolean>;
+    reasoningEffortMap: z.ZodOptional<z.ZodObject<{
+        minimal: z.ZodOptional<z.ZodString>;
+        low: z.ZodOptional<z.ZodString>;
+        medium: z.ZodOptional<z.ZodString>;
+        high: z.ZodOptional<z.ZodString>;
+        xhigh: z.ZodOptional<z.ZodString>;
+        max: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    maxTokensField: z.ZodOptional<z.ZodEnum<{
+        max_completion_tokens: "max_completion_tokens";
+        max_tokens: "max_tokens";
+    }>>;
+    supportsUsageInStreaming: z.ZodOptional<z.ZodBoolean>;
+    requiresToolResultName: z.ZodOptional<z.ZodBoolean>;
+    requiresMistralToolIds: z.ZodOptional<z.ZodBoolean>;
+    requiresAssistantAfterToolResult: z.ZodOptional<z.ZodBoolean>;
+    requiresThinkingAsText: z.ZodOptional<z.ZodBoolean>;
+    reasoningContentField: z.ZodOptional<z.ZodEnum<{
+        reasoning: "reasoning";
+        reasoning_content: "reasoning_content";
+        reasoning_text: "reasoning_text";
+    }>>;
+    requiresReasoningContentForToolCalls: z.ZodOptional<z.ZodBoolean>;
+    allowsSyntheticReasoningContentForToolCalls: z.ZodOptional<z.ZodBoolean>;
+    requiresAssistantContentForToolCalls: z.ZodOptional<z.ZodBoolean>;
+    supportsToolChoice: z.ZodOptional<z.ZodBoolean>;
+    supportsForcedToolChoice: z.ZodOptional<z.ZodBoolean>;
+    toolChoiceSupport: z.ZodOptional<z.ZodEnum<{
+        auto: "auto";
+        named: "named";
+        none: "none";
+        required: "required";
+    }>>;
+    disableReasoningOnForcedToolChoice: z.ZodOptional<z.ZodBoolean>;
+    disableReasoningOnToolChoice: z.ZodOptional<z.ZodBoolean>;
+    thinkingFormat: z.ZodOptional<z.ZodEnum<{
+        openai: "openai";
+        openrouter: "openrouter";
+        qwen: "qwen";
+        "qwen-chat-template": "qwen-chat-template";
+        zai: "zai";
+    }>>;
+    openRouterRouting: z.ZodOptional<z.ZodObject<{
+        only: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        order: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    vercelGatewayRouting: z.ZodOptional<z.ZodObject<{
+        only: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        order: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    extraBody: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    supportsStrictMode: z.ZodOptional<z.ZodBoolean>;
+    toolStrictMode: z.ZodOptional<z.ZodEnum<{
+        all_strict: "all_strict";
+        none: "none";
+    }>>;
+    supportsLongCacheRetention: z.ZodOptional<z.ZodBoolean>;
+    promptCacheMode: z.ZodOptional<z.ZodEnum<{
+        automatic: "automatic";
+        explicit: "explicit";
+        none: "none";
+    }>>;
+}, z.core.$strip>;
 export declare const OpenAICompatSchema: z.ZodObject<{
     supportsStore: z.ZodOptional<z.ZodBoolean>;
     supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
@@ -61,6 +130,12 @@ export declare const OpenAICompatSchema: z.ZodObject<{
         all_strict: "all_strict";
         none: "none";
     }>>;
+    supportsLongCacheRetention: z.ZodOptional<z.ZodBoolean>;
+    promptCacheMode: z.ZodOptional<z.ZodEnum<{
+        automatic: "automatic";
+        explicit: "explicit";
+        none: "none";
+    }>>;
 }, z.core.$strip>;
 export declare const GJC_MODEL_EFFORT_IDS: readonly ["minimal", "low", "medium", "high", "xhigh", "max"];
 export declare const GJC_MODEL_ASSIGNMENT_TARGET_IDS: readonly ["default", "executor", "architect", "planner", "critic"];
@@ -238,6 +313,12 @@ export declare const ModelOverrideSchema: z.ZodObject<{
             all_strict: "all_strict";
             none: "none";
         }>>;
+        supportsLongCacheRetention: z.ZodOptional<z.ZodBoolean>;
+        promptCacheMode: z.ZodOptional<z.ZodEnum<{
+            automatic: "automatic";
+            explicit: "explicit";
+            none: "none";
+        }>>;
     }, z.core.$strip>>;
     contextPromotionTarget: z.ZodOptional<z.ZodString>;
     wireModelId: z.ZodOptional<z.ZodString>;
@@ -352,6 +433,12 @@ export declare const ModelsConfigSchema: z.ZodObject<{
                 all_strict: "all_strict";
                 none: "none";
             }>>;
+            supportsLongCacheRetention: z.ZodOptional<z.ZodBoolean>;
+            promptCacheMode: z.ZodOptional<z.ZodEnum<{
+                automatic: "automatic";
+                explicit: "explicit";
+                none: "none";
+            }>>;
         }, z.core.$strip>>;
         webSearch: z.ZodOptional<z.ZodEnum<{
             auto: "auto";
@@ -519,6 +606,12 @@ export declare const ModelsConfigSchema: z.ZodObject<{
                     all_strict: "all_strict";
                     none: "none";
                 }>>;
+                supportsLongCacheRetention: z.ZodOptional<z.ZodBoolean>;
+                promptCacheMode: z.ZodOptional<z.ZodEnum<{
+                    automatic: "automatic";
+                    explicit: "explicit";
+                    none: "none";
+                }>>;
             }, z.core.$strip>>;
             contextPromotionTarget: z.ZodOptional<z.ZodString>;
             wireModelId: z.ZodOptional<z.ZodString>;
@@ -660,6 +753,12 @@ export declare const ModelsConfigSchema: z.ZodObject<{
                     all_strict: "all_strict";
                     none: "none";
                 }>>;
+                supportsLongCacheRetention: z.ZodOptional<z.ZodBoolean>;
+                promptCacheMode: z.ZodOptional<z.ZodEnum<{
+                    automatic: "automatic";
+                    explicit: "explicit";
+                    none: "none";
+                }>>;
             }, z.core.$strip>>;
             contextPromotionTarget: z.ZodOptional<z.ZodString>;
             wireModelId: z.ZodOptional<z.ZodString>;

package/dist/types/coordinator/contract.d.ts

@@ -1,4 +1,4 @@
 export declare const COORDINATOR_MCP_PROTOCOL_VERSION = "2024-11-05";
 export declare const COORDINATOR_MCP_SERVER_NAME = "gjc-coordinator-mcp";
-export declare const COORDINATOR_MCP_TOOL_NAMES: readonly ["gjc_coordinator_list_sessions", "gjc_coordinator_read_status", "gjc_coordinator_read_tail", "gjc_coordinator_list_questions", "gjc_coordinator_list_artifacts", "gjc_coordinator_read_artifact", "gjc_coordinator_read_coordination_status", "gjc_coordinator_watch_events", "gjc_coordinator_register_session", "gjc_coordinator_start_session", "gjc_coordinator_stop_session", "gjc_coordinator_send_prompt", "gjc_coordinator_submit_question_answer", "gjc_coordinator_read_turn", "gjc_coordinator_await_turn", "gjc_coordinator_report_status", "gjc_delegate_plan", "gjc_delegate_execute", "gjc_delegate_team"];
+export declare const COORDINATOR_MCP_TOOL_NAMES: readonly ["gjc_coordinator_list_sessions", "gjc_coordinator_read_status", "gjc_coordinator_read_tail", "gjc_coordinator_list_questions", "gjc_coordinator_list_artifacts", "gjc_coordinator_read_artifact", "gjc_coordinator_read_coordination_status", "gjc_coordinator_watch_events", "gjc_coordinator_register_session", "gjc_coordinator_start_session", "gjc_coordinator_activate_session", "gjc_coordinator_stop_session", "gjc_coordinator_send_prompt", "gjc_coordinator_submit_question_answer", "gjc_coordinator_read_turn", "gjc_coordinator_await_turn", "gjc_coordinator_report_status", "gjc_delegate_plan", "gjc_delegate_execute", "gjc_delegate_team"];
 export type CoordinatorToolName = (typeof COORDINATOR_MCP_TOOL_NAMES)[number];

package/dist/types/coordinator-mcp/question-state.d.ts

@@ -1,5 +1,7 @@
 import type { PrivateAskGateCodecV1, PublicReason } from "./question-gate-codec";
-export type CoordinatorSessionState = "booting" | "ready_for_input" | "running" | "needs_user_input" | "completed" | "errored" | "stale" | "unknown";
+export type CoordinatorSessionState = "booting"
+/** Live and endpoint-addressable, but withholding readiness until activation. */
+ | "prepared" | "ready_for_input" | "running" | "needs_user_input" | "completed" | "errored" | "stale" | "unknown";
 export interface CanonicalSessionSnapshotV1 {
     schema_version: 1;
     namespace_id: string;

package/dist/types/extensibility/extensions/index.d.ts

@@ -3,6 +3,7 @@
  */
 export type { SlashCommandInfo, SlashCommandLocation, SlashCommandSource } from "../slash-commands";
 export { discoverAndLoadExtensions, ExtensionRuntimeNotInitializedError, loadExtensionFromFactory, loadExtensions, } from "./loader";
+export * from "./ouroboros-ooo-bridge";
 export * from "./prefix-command-bridge";
 export * from "./runner";
 export * from "./types";

package/dist/types/extensibility/extensions/ouroboros-ooo-bridge.d.ts

@@ -0,0 +1,13 @@
+import { callTool, connectToServer, disconnectServer } from "../../runtime-mcp";
+import type { ExtensionContext, InputEvent, InputEventResult } from "./types";
+interface OuroborosOooBridgeOptions {
+    connect?: typeof connectToServer;
+    callTool?: typeof callTool;
+    disconnect?: typeof disconnectServer;
+}
+interface OuroborosOooBridgeHandler {
+    (event: InputEvent, ctx: ExtensionContext): Promise<InputEventResult>;
+    reset(): Promise<void>;
+}
+export declare function createOuroborosOooBridge(options?: OuroborosOooBridgeOptions): OuroborosOooBridgeHandler;
+export {};

package/dist/types/extensibility/extensions/prefix-command-bridge.d.ts

@@ -32,4 +32,3 @@ export interface ExactPrefixCommandBridgeOptions {
  * bridge while the child command runs.
  */
 export declare function createExactPrefixCommandBridge(options: ExactPrefixCommandBridgeOptions): (event: InputEvent, ctx: ExtensionContext) => Promise<InputEventResult>;
-export declare function createOuroborosOooBridge(): (event: InputEvent, ctx: ExtensionContext) => Promise<InputEventResult>;

package/dist/types/extensibility/extensions/types.d.ts

@@ -239,6 +239,8 @@ export interface ExtensionContext {
     hasUI: boolean;
     /** Current working directory */
     cwd: string;
+    /** Aborted when the runner stops waiting for this handler, including handler timeout. */
+    signal?: AbortSignal;
     /** Session manager (read-only) */
     sessionManager: ReadonlySessionManager;
     /** Session classification supplied by the SDK for extension policy decisions. */

package/dist/types/gjc-runtime/deep-interview-state.d.ts

@@ -76,6 +76,18 @@ export interface DeepInterviewStateEnvelope {
     [key: string]: unknown;
 }
 export declare function hashContent(value: string): string;
+/**
+ * Canonicalize interview prose to NFC.
+ *
+ * Hangul, unlike most Latin prose, routinely reaches the interview in both
+ * composed and decomposed form (macOS-sourced pastes and some IME/clipboard
+ * paths emit NFD), and the two forms are the same text for the user while
+ * being different JavaScript strings. Canonicalizing at the identity and
+ * length boundaries keeps one round per answer and keeps the character caps
+ * script-fair: decomposed Hangul otherwise costs two to three code points per
+ * syllable against the same budget.
+ */
+export declare function canonicalizeDeepInterviewText(value: string): string;
 export declare function questionHash(questionText: string): string;
 export declare function answerHash(selectedOptions: string[] | undefined, customInput: string | undefined): string;
 /**
@@ -151,6 +163,8 @@ export declare function assertDeepInterviewStructuredResponseWithinLimit(value:
 /**
  * Assert a free-text input is within its size cap. Never inspects content for shell
  * metacharacters — free-text fields accept prose verbatim; this only bounds length.
+ * The cap is measured on the NFC form so decomposed Hangul is charged the same
+ * budget as the identical composed text.
  */
 export declare function assertDeepInterviewInputWithinLimit(value: string, max: number, fieldName?: string): void;
 /** Validate user-supplied deep-interview prose before an envelope is persisted. */

package/dist/types/gjc-runtime/gc-runtime.d.ts

@@ -49,9 +49,17 @@ export interface GcError {
     scope: string;
     message: string;
 }
+/** Non-fatal discovery partials (e.g. traversal caps). Does not affect exit code. */
+export interface GcWarning {
+    store: GcStore;
+    scope: string;
+    message: string;
+}
 export interface GcCollectResult {
     records: GcRecord[];
     errors: GcError[];
+    /** Optional partial-result notices; omitted by adapters that have none. */
+    warnings?: GcWarning[];
 }
 export interface GcPruneOutcome {
     removed: boolean;
@@ -108,6 +116,8 @@ export interface GcReport {
     stores: Record<GcStore, GcRecord[]>;
     counts: GcCounts;
     errors: GcError[];
+    /** Partial-result notices that do not fail the run (e.g. walk caps). */
+    warnings: GcWarning[];
     session_index?: GcSessionIndexHealth;
 }
 export interface GcRunResult {
@@ -134,6 +144,7 @@ export declare function collectGcReport(adapters: GcStoreAdapter[], ctx: GcConte
  * - usage/parse error => 2
  * - hard discovery errors => 1 (both modes)
  * - prune mode with a failed intended removal => 1
+ * - warnings alone never fail the run
  * - otherwise => 0
  */
 export declare function computeExitCode(report: GcReport): number;