@gajae-code/coding-agent 0.12.14 → 0.12.16-nightly.20260807070805.31156495595.g91c4eff67ce2

package/CHANGELOG.md

@@ -1,6 +1,48 @@
 # Changelog
 
 ## [Unreleased]
+### Fixed
+
+- `todo_write` and `ask` no longer reject valid calls before the tool loads. Both tools carried two independent copies of their raw-argument rules — one in the loaded tool, one in the cold descriptor registry that runs first — and the deferred copies had drifted: `todo_write`'s dropped the `content` synonym for `task` and the `complete`/`completed` aliases for `done`, accepted targetless `complete` entries the loaded tool rejects, and returned every rejection without its correction code, so the model saw a bare "raw arguments rejected before coercion" with nothing to fix and retried the same shape until the turn died. Both also rejected the harness's own injected `_i` intent field, failing any call carrying it with an unknown-root-key error the model could not repair. `todo_write` validation now lives in a single shared contract module (`tools/todo-contract.ts`) used by both paths, and both tools tolerate `_i` at the root while still rejecting genuinely unknown keys.
+- Managed scope prepare and legacy-local resume no longer report success while group/other-readable descendants remain on disk (e.g. mode `0o036`/`0o644`): prepare uses a mode-only walk (not `snapshotManagedTree("")`, which races concurrent writers and broke `/move`) to detect drift, re-secures with apply+verify, and retries once; legacy-local capture uses the same resecure helper.
+- ACP `session/request_permission` responses are now normalized from the spec-shaped `RequestPermissionResponse` (`{ outcome: { outcome, optionId } }`) into the SDK's flat permission-decision contract before reaching the permission provider. Standards-compliant ACP clients such as Paseo can now authorize permission-gated shell/eval and destructive file operations (`bash`, `monitor`, `eval`, `delete`, `move`, and `edit` only for delete/move operations) without an invalid-response failure; `write` and ordinary edits remain ungated. Nested and flat selected/cancelled responses are accepted by reconstructing the canonical SDK decision fields, while malformed or unknown decisions fail closed.
+
+### Added
+
+- Added first-class `cline-pass` and `commandcode-goat` provider presets with documented API endpoints, environment-variable credentials, non-hardcoded live model discovery from models.dev and the Command Code Provider API, and prefix-based Claude routing.
+- Added lease-backed MCP connection pooling with typed recovery, shared HTTP/SSE sessions, per-lease callback demultiplexing, and authorization binding scopes that keep credential secrets out of pool keys.
+- Added plugin registry v2 as the single execution authority for plugin tools, subskills, and prompt appendices, with digest verification at final use.
+- Added module-trace and process-tree RSS verification harnesses for startup-memory regressions.
+
+### Changed
+
+- Deferred notification adapters, native bindings, provider construction, tools, skills, eval, session artifacts, and history storage until their feature paths are used, reducing the CLI startup module graph without changing default behavior.
+- Split SDK session hosting into a transport-neutral runtime and lazy notification adapters.
+
+### Fixed
+
+- `notifications-topic-registry.test.ts` pins `DAEMON_GENERATION` at 54 after #3965 (was stale at 53; Dev CI run 31133356543).
+- `smithery-env-trust.test.ts` no longer awaits hung probe pipes past a hard per-attempt deadline: minimal child env, `stdin: "ignore"`, SIGKILL + settled race, and up to 2 timeout-only retries. Fixes the inherited-config case that hit exactly 60001ms on Dev CI run 31133356543 after kill-at-45s left `Promise.all` on stdout/stderr unresolved. Assertions unchanged.
+- A Telegram notification daemon that dies without a clean shutdown no longer keeps advertising itself as the ready owner. Ownership was surrendered only by `releaseDaemonOwnership`, which runs after a fully quiesced and fully persisted shutdown; an uncaught error, a failed final topic-registry persist, or a signal left `ownershipPhase: "ready"` and a matching ownership lock on disk, and every later reader attached to a process that no longer existed. Observed in the field: a daemon wrote one heartbeat 559 ms after readiness, died on an uncaught `shared topic authority unavailable` error, and was still recorded as ready eight hours and seventeen crashes later, with no notification delivered in between. The daemon-internal entrypoint now records `stoppedAt` on the way out — from its own `finally` and from a `postmortem` hook that also covers the fatal paths that call `process.exit()` without unwinding — fenced on full owner identity so a successor's state is never touched, and leaving the ownership lock for the existing reclaim path to adjudicate. `isFreshLiveOwner` already treats `stoppedAt` as disqualifying, so recovery no longer depends on a pid liveness check that a recycled pid can defeat.
+- Under the default configuration (no explicit `retry.*` keys), message-only first-event stream timeouts — the wrapped `Error: Provider stream timed out while waiting for the first event`, the bare canonical form, and the per-provider `Anthropic stream timed out...` / `OpenAI responses stream timed out...` variants — were not retried once the run had observable activity (e.g. a prior tool execution in the same turn), so the turn surfaced the timeout instead of retrying like other provider non-critical errors. Content-free message-only watchdog prose is now admitted in the bare-default first-event retry gate like the typed path; visible content, conflicting structured facts, near-miss prose, extension-hook participation, Alibaba/Kimi terminal policy, and ollama-cloud bounded retry remain fail-closed.
+- `smithery-env-trust.test.ts` warms the Bun probe child in `beforeAll` and kills stalled spawns at a 45s budget so the first case no longer absorbs cold-start compile cost into its per-test timeout under shard contention (observed 60001ms timeout after the 60s cap on #3969 exact-head CI). Assertions unchanged.
+- `smithery-env-trust.test.ts` raises the per-test child-process timeout from 30s to 60s so CI contention cannot fail at the previous 30s cap (Dev CI run 31128319216 timed out at 30004ms).
+- Headless coordinator `ralplan` approval gates no longer stall with `missing_runtime_turn` or reject a direct answer with `resource_gone`. Canonical subagents keep workflow-gate emitters local instead of replacing the endpoint owner, the coordinator projects the ask-shaped `ralplan/approval` contract, and provisional notification policy retains gates without publishing them until activation. Direct-control completion is fenced to the exact source generation and preserves exact terminal proof across replacement races.
+- `smithery-env-trust.test.ts` now sets a 30s per-test timeout on all five child-process-spawning trust-boundary tests, preventing CI flake when the Bun child-process spawn + env-file-parse chain exceeds the default 5s budget under parallel shard contention (Dev CI run 31102063678).
+- Fire-and-forget agent continuations (auto-compaction retries, queued follow-ups) racing a still-busy agent no longer spin on a fixed 100ms reschedule forever: they now back off exponentially (100ms doubling up to 5s) and give up after 50 attempts (~4 minutes) with an explicit warn, fixing a runaway loop observed as 10,742 reschedules over 21 minutes in a single session.
+- A Telegram daemon no longer crashes when the shared topic authority is momentarily unavailable. The liveness heartbeat renewed a session's topic lease through a single-argument `.then()` whose rejection escaped to the process-level fatal handler (observed as repeated `Uncaught exception` / `Unhandled rejection: shared topic authority unavailable` deaths while the authority was down); it now reports the failure and retries on the next heartbeat. A startup topic-registry load failure is likewise reported and the daemon continues with an empty registry instead of dying before it starts serving. The four `catch { throw }` authority-failure sites now preserve the underlying error as `cause`, and the compensation fence stops retrying a failed persist every 250ms forever (it gives up after ~10s and lets the next scan/session pass retry), so a shutdown can quiesce instead of spinning. `DAEMON_GENERATION` bumped to 55.
+- ACP `session/prompt` no longer hangs forever when the agent continues mid-prompt. Any continuation (todo reminder, TTSR resume, auto-continue) re-enters the agent loop and emits a second `agent_start`, which shifted the already-empty pending queue and overwrote the live prompt correlation with `undefined`. The prompt's `agent_end` then carried no correlation, `terminalizePrompt` never ran, and every ACP client (Paseo, Zed, JetBrains Air) waited until the 30-minute `sdk.promptDeadlineMs` before failing with `prompt_deadline_exceeded` — despite the answer having already streamed. `agent_start` now claims a pending correlation only when the session has no active one, and the todo-completion continuation holds the predecessor `agent_end` like every other continuation call site (#3949).
+- ACP `session/prompt` no longer hangs forever when the agent continues mid-prompt. Any continuation (todo reminder, TTSR resume, auto-continue) re-enters the agent loop and emits a second `agent_start`, which shifted the already-empty pending queue and overwrote the live prompt correlation with `undefined`. The prompt's `agent_end` then carried no correlation, `terminalizePrompt` never ran, and every ACP client (Paseo, Zed, JetBrains Air) waited until the 30-minute `sdk.promptDeadlineMs` before failing with `prompt_deadline_exceeded` — despite the answer having already streamed. `agent_start` now claims a pending correlation only when the session has no active one, and the todo-completion continuation holds the predecessor `agent_end` like every other continuation call site (#3949).
+- ACP skills, slash commands, and initial session state now actually reach the client. `session/new`, `session/resume`, and `session/fork` scheduled their bootstrap `session/update` notifications on a fixed 50 ms timer taken *before* the session-state queries ran, so on any host where those queries took longer the notifications overtook the response that carries the `sessionId` — naming a session the client had never seen, which clients drop. Measured against Paseo: `available_commands_update` arrived 27 ms *before* the `session/new` response, so the skill list was silently discarded. Bootstrap is now scheduled only once the response payload is ready, matching the ACP session-setup sequence, which permits updates before the response only for `session/load` (#3962).
+- ACP clients can now render the user's own message and its image attachments. A live prompt turn emitted no `user_message_chunk` at all — that update only existed on the `session/load` replay path — so an attached image reached the model but never appeared in the client transcript. `session/prompt` now echoes the prompt's text and image content blocks as `user_message_chunk` before dispatching the turn (#3962).
+- An oversize ACP prompt now fails with a typed, actionable error instead of killing the session. The SDK WebSocket server caps a request frame at 256 KiB (`REQUEST_FRAME_BYTES`) and answers an oversize frame with `CloseCode::Size`, which surfaced to clients as an opaque `-32603 connection_closed` mid-turn; a 244 KiB PNG reproduced it while a 59 KiB PNG succeeded. The prompt is now measured inside its real `control_request` envelope and rejected up front with `-32602` naming the actual and permitted size (#3962).
+- ACP `session/cancel` and `session/close` now settle the pending `session/prompt` with `stopReason: "cancelled"` instead of surfacing a transport error. A cancel that landed during prompt preflight rejected with `busy`, and `session/close` rejected with `connection_closed`, both of which clients display as spurious errors for the user's own action. The spec requires agents to "catch these errors and return the semantically meaningful `cancelled` stop reason"; involuntary teardown still rejects (#3962).
+- GJC no longer advertises `mcpCapabilities.sse`. The legacy MCP HTTP+SSE transport (spec 2024-11-05, deprecated) is not implemented: an `sse` config is routed to the Streamable HTTP transport, which never performs the required `endpoint`-event handshake, so a genuine legacy-SSE server offered by an ACP client could not connect. Locally configured `sse` entries still resolve through `createTransport` and keep working (#3962).
+- Reverse ACP responses (`fs/read_text_file`, terminal output) are now measured as the full serialized frame rather than only the inner `result`. A near-limit result passed the 256 KiB check and then tripped the WebSocket total-frame ceiling, closing the whole session instead of raising the typed `payload_too_large` (#3962).
+- `todo_write` now accepts the synonyms models actually emit instead of failing the tool call mid-turn: `complete`/`completed` for the `done` operation, and `content` for `task`. The operation sets a status spelled `completed` and stores the task as `content`, so the schema's own vocabulary invited both mistakes. The accepted key set and the requirement that a completion name a task or phase are unchanged (#3962).
+
+- Managed session scope failures are no longer misreported as `binding_invalid`. An over-budget managed-tree snapshot now surfaces as `capacity_exceeded` carrying the native `content_too_large` message instead of pointing operators at a byte-for-byte canonical binding file, and `migration_busy` is preserved from every classification path rather than only one of the three.
+## [0.12.15] - 2026-08-06
 
 ## [0.12.14] - 2026-08-06
 
@@ -9,9 +51,28 @@
 ### Fixed
 - ACP session configuration now emits the spec-defined `category` field on the Mode, Model, and Thinking select options (`mode`, `model`, `thought_level`), so standards-compliant ACP clients such as Paseo discover models, modes, and thinking levels instead of an empty model picker (#3922).
 - The ACP session model catalog is now filtered to active providers via `providers.list/active`, falling back to the full catalog on older session hosts, so ACP clients no longer list models for providers without usable credentials (#3922).
+- Workflow-gate asks (ralplan approval, deep-interview questions) now surface through the ACP permission channel when the client does not advertise ACP form elicitation, so plain ACP clients such as Paseo can answer selector gates; free-text asks remain unanswered and the richer `ui` channel stays preferred when advertised (#3925).
+- ACP `session/prompt` no longer hangs forever when the agent continues mid-prompt. Any continuation (todo reminder, TTSR resume, auto-continue) re-enters the agent loop and emits a second `agent_start`, which shifted the already-empty pending queue and overwrote the live prompt correlation with `undefined`. The prompt's `agent_end` then carried no correlation, `terminalizePrompt` never ran, and every ACP client (Paseo, Zed, JetBrains Air) waited until the 30-minute `sdk.promptDeadlineMs` before failing with `prompt_deadline_exceeded` — despite the answer having already streamed. `agent_start` now claims a pending correlation only when the session has no active one, and the todo-completion continuation holds the predecessor `agent_end` like every other continuation call site.
+- ACP clients can now render the user's own message and its image attachments. A live prompt turn emitted no `user_message_chunk` at all — that update only existed on the `session/load` replay path — so an attached image reached the model but never appeared in the client transcript. `session/prompt` now echoes the prompt's text and image content blocks as `user_message_chunk` before dispatching the turn.
+- An oversize ACP prompt now fails with a typed, actionable error instead of killing the session. The SDK WebSocket server caps a request frame at 256 KiB (`REQUEST_FRAME_BYTES`) and answers an oversize frame with `CloseCode::Size`, which surfaced to clients as an opaque `-32603 connection_closed` mid-turn; a 244 KiB PNG reproduced it while a 59 KiB PNG succeeded. The prompt is now measured inside its real `control_request` envelope and rejected up front with `-32602` naming the actual and permitted size.
+- ACP `session/cancel` and `session/close` now settle the pending `session/prompt` with `stopReason: "cancelled"` instead of surfacing a transport error. A cancel that landed during prompt preflight rejected with `busy`, and `session/close` rejected with `connection_closed`, both of which clients display as spurious errors for the user's own action. The spec requires agents to "catch these errors and return the semantically meaningful `cancelled` stop reason"; involuntary teardown still rejects.
+- GJC no longer advertises `mcpCapabilities.sse`. The legacy MCP HTTP+SSE transport (spec 2024-11-05, deprecated) is not implemented: an `sse` config is routed to the Streamable HTTP transport, which never performs the required `endpoint`-event handshake, so a genuine legacy-SSE server offered by an ACP client could not connect. Locally configured `sse` entries still resolve through `createTransport` and keep working.
+- Reverse ACP responses (`fs/read_text_file`, terminal output) are now measured as the full serialized frame rather than only the inner `result`. A near-limit result passed the 256 KiB check and then tripped the WebSocket total-frame ceiling, closing the whole session instead of raising the typed `payload_too_large`.
+- `todo_write` now accepts `complete` and `completed` as aliases for the `done` operation. The status this operation sets is spelled `completed`, so models repeatedly emitted `op: "complete"` and hit a hard mid-turn tool failure; the operation vocabulary is otherwise unchanged and a completion still requires a task or phase target.
+||||||| parent of d5f44548e (fix(todo): accept the operation and field synonyms models actually emit)
+- ACP `session/prompt` no longer hangs forever when the agent continues mid-prompt. Any continuation (todo reminder, TTSR resume, auto-continue) re-enters the agent loop and emits a second `agent_start`, which shifted the already-empty pending queue and overwrote the live prompt correlation with `undefined`. The prompt's `agent_end` then carried no correlation, `terminalizePrompt` never ran, and every ACP client (Paseo, Zed, JetBrains Air) waited until the 30-minute `sdk.promptDeadlineMs` before failing with `prompt_deadline_exceeded` — despite the answer having already streamed. `agent_start` now claims a pending correlation only when the session has no active one, and the todo-completion continuation holds the predecessor `agent_end` like every other continuation call site.
+- ACP clients can now render the user's own message and its image attachments. A live prompt turn emitted no `user_message_chunk` at all — that update only existed on the `session/load` replay path — so an attached image reached the model but never appeared in the client transcript. `session/prompt` now echoes the prompt's text and image content blocks as `user_message_chunk` before dispatching the turn.
+- An oversize ACP prompt now fails with a typed, actionable error instead of killing the session. The SDK WebSocket server caps a request frame at 256 KiB (`REQUEST_FRAME_BYTES`) and answers an oversize frame with `CloseCode::Size`, which surfaced to clients as an opaque `-32603 connection_closed` mid-turn; a 244 KiB PNG reproduced it while a 59 KiB PNG succeeded. The prompt is now measured inside its real `control_request` envelope and rejected up front with `-32602` naming the actual and permitted size.
+- ACP `session/cancel` and `session/close` now settle the pending `session/prompt` with `stopReason: "cancelled"` instead of surfacing a transport error. A cancel that landed during prompt preflight rejected with `busy`, and `session/close` rejected with `connection_closed`, both of which clients display as spurious errors for the user's own action. The spec requires agents to "catch these errors and return the semantically meaningful `cancelled` stop reason"; involuntary teardown still rejects.
+- GJC no longer advertises `mcpCapabilities.sse`. The legacy MCP HTTP+SSE transport (spec 2024-11-05, deprecated) is not implemented: an `sse` config is routed to the Streamable HTTP transport, which never performs the required `endpoint`-event handshake, so a genuine legacy-SSE server offered by an ACP client could not connect. Locally configured `sse` entries still resolve through `createTransport` and keep working.
+- Reverse ACP responses (`fs/read_text_file`, terminal output) are now measured as the full serialized frame rather than only the inner `result`. A near-limit result passed the 256 KiB check and then tripped the WebSocket total-frame ceiling, closing the whole session instead of raising the typed `payload_too_large`.
+- `todo_write` now accepts `complete` and `completed` as aliases for the `done` operation. The status this operation sets is spelled `completed`, so models repeatedly emitted `op: "complete"` and hit a hard mid-turn tool failure; the operation vocabulary is otherwise unchanged and a completion still requires a task or phase target.
 
 - `todo_write` now rejects malformed raw arguments with bounded, authority-controlled correction codes instead of a generic rejection: unknown root keys, unknown operation-entry keys, done/drop entries without a task or phase target, and unknown init list-entry keys each surface a fixed message naming the accepted shape without echoing the offending input, while recoverable payloads keep the passthrough/coercion path and the existing ask-tool codes are untouched (#3916).
 - The Alibaba Token Plan onboarding preset and `alibaba-token-plan-qwen-deepseek` profile now reference the provider-supported `qwen3.8-max` model id instead of `qwen-3.8-max`, preventing the built-in profile from selecting an HTTP 400 unsupported model (#3909).
+- Restored computer batch failure metadata, timeout handling, and coordinate bounds validation to match single-action dispatch.
+- Preserved idempotent deletion of unknown SDK sessions and fixed concurrent `/notify on` startup after native loading became lazy.
+- Kept deferred tool descriptors aligned with eager availability guards for headless asks, subagent checkpoints, IRC, GitHub, and cron.
 - `/model` reasoning menu header now shows the highlighted reasoning level (not the model id), seeds the cursor from the role badge when re-editing the same model, and uses a provider-neutral label for `max` instead of "Opus maximum reasoning" (#3847).
 - Resume listing now reverse-scans for buried but canonically valid `header_patch` titles, so a persisted manual title remains visible in the picker after later transcript growth instead of falling back to an empty/line-1 projection (#3633).
 - Custom OpenAI-compatible models whose wire id is namespaced (for example `cline-pass/deepseek-v4-flash`) now inherit capability metadata from the bundled leaf model when `contextWindow` / `maxTokens` are omitted, instead of silently falling back to the generic 128K / 16K defaults. True unknown leaf ids still default; explicit limits remain authoritative (#3856).
@@ -20,7 +81,7 @@
 - `gjc models` is no longer treated as a free-form agent prompt. The mistaken subcommand spelling now routes to the existing `--list-models` listing path so a nested bash-tool invocation cannot recursively spawn unbounded GJC agents (#3857).
 - Always-apply and rulebook rules are injected on the default system prompt path again. Discovery still loaded `.gjc/rules/`, `~/.gjc/agent/rules/`, and sticky `RULES.md`, but only `custom-system-prompt.md` rendered them, so normal sessions silently dropped the content while AGENTS.md in the same directory continued to work (#3859).
 - Made Telegram reference-client capability diagnostics safe for TUI embedding.
-- Custom `anthropic-messages` providers can now configure `compat.promptCacheMode` (`none`, `explicit`, or `automatic`) and `compat.supportsLongCacheRetention` at provider, model, and model-override levels. This makes the automatic Claude-family caching default safely overridable for compatible endpoints that require block-level cache markers or do not support 1-hour retention.
+- Custom `anthropic-messages` providers can now configure `compat.promptCacheMode` (`none`, `explicit`, or `automatic`) and `compat.supportsLongCacheRetention` at provider, model, and model-override levels. Canonical Anthropic defaults to automatic caching, while non-canonical Claude-family endpoints default to gateway-safe explicit block markers and can opt into top-level automatic caching when supported.
 - A Telegram notification daemon whose reconciliation pass fails no longer exits. The pass persists through the shared topic authority, and a momentarily unavailable authority (lock contention or a rejected compare-and-set) rejected out of both the scan timer and the run loop into the process-level fatal handler, killing the owner. Every session topic was then left behind as an unarchived shell that answers nothing — including for sessions that were still live and lost their notifications. The pass now reports the failure and the next scan interval retries it; the queue-flush timer is guarded the same way.
 - MiniMax M3 preset and profile ids canonicalized to `MiniMax-M3` (issue #3896): the `minimax` / `minimax-cn` onboarding presets and the `minimax-eco` / `minimax-medium` / `minimax-pro` builtin model profiles no longer reference the removed lowercase `minimax-m3` / `minimax-v3` first-class catalog ids.
 - Deep-interview round identity and input caps are now Unicode-canonical. Question text, selected options, and custom input are canonicalized to NFC before hashing and persisting, so the same Korean answer arriving in decomposed form (macOS-sourced pastes and some IME/clipboard paths emit NFD) no longer produces a second `answer_hash` — the documented append-or-merge no-op holds, and intent-review approval evidence still matches the user's recorded answer. Free-text caps are measured on the NFC form, so decomposed Hangul is charged the same character budget as the identical composed text instead of 2–3 code points per syllable (#3871).
@@ -39,6 +100,9 @@
 ### Added
 
 - Added a verified, copy-installable `ooo` bridge example: `ooo interview` renders Ouroboros MCP questions in GJC, serializes startup and follow-up answers by session ID, cancellation-fences late settlement, disposes state on GJC session changes and `/clear`, drops queued predecessor-generation starts, releases dead transports and controls, honors `OUROBOROS_CLI`, and loads dependency-free in compiled binaries (#3803).
+- Added a scheduled and manually dispatchable nightly deployment cycle that verifies the full `main` graph, stages one immutable source-bound prerelease version across npm/Cargo/native surfaces, publishes the complete package set under the npm `nightly` dist-tag without moving `latest`, and creates a matching GitHub prerelease with binaries and closed package evidence.
+
+- `gjc update` now accepts `--channel stable|nightly` to switch release channels in place, and a new **Update Channel** settings entry (`startup.updateChannel`, stable by default) picks the default channel for both `gjc update` and the interactive startup update check. Channel resolution maps to the npm `latest`/`nightly` dist-tags without ever pointing nightly at `latest`, version comparison now orders nightly prereleases with real semver semantics instead of NaN-falling into a forced reinstall, and installed-version verification recognizes prerelease version strings reported by nightly binaries.
 
 ### Fixed
 

package/dist/types/ai-core-import-gate.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/capability/mcp.d.ts

@@ -10,6 +10,8 @@ export interface MCPServer {
     /** Whether explicit runtime MCP consumers should connect automatically (default: true) */
     autoload?: boolean;
     /** Connection timeout in milliseconds */
+    /** MCP connection pool identity mode; defaults to one lease per session. */
+    sharing?: "per-session" | "shared";
     timeout?: number;
     /** Command to run (for stdio transport) */
     command?: string;

package/dist/types/capability/skill.d.ts

@@ -16,6 +16,14 @@ export interface SkillFrontmatter {
     hide?: boolean;
     [key: string]: unknown;
 }
+/**
+ * Metadata-only skill handle. Callers must opt in to reading the body through
+ * `loadContent`; discovery never loads the body while building this metadata.
+ */
+export interface SkillDescriptor {
+    readonly metadata: Omit<Skill, "content" | "loadContent">;
+    readonly loadContent: () => Promise<string>;
+}
 /**
  * A skill that provides specialized knowledge or workflows.
  */
@@ -25,7 +33,9 @@ export interface Skill {
     /** Absolute path to skill file */
     path: string;
     /** Skill content (markdown) */
-    content: string;
+    /** Lazily load the markdown body when the caller needs prompt content. */
+    loadContent?: () => Promise<string>;
+    content?: string;
     /** Parsed frontmatter */
     frontmatter?: SkillFrontmatter;
     /** Source level */

package/dist/types/cli/args.d.ts

@@ -1,4 +1,4 @@
-import { type Effort } from "@gajae-code/ai";
+import { type Effort } from "@gajae-code/ai/core";
 export type Mode = "text" | "json" | "acp";
 export interface Args {
     cwd?: string;

package/dist/types/cli/file-processor.d.ts

@@ -1,4 +1,4 @@
-import type { ImageContent } from "@gajae-code/ai";
+import type { ImageContent } from "@gajae-code/ai/core";
 export interface ProcessedFiles {
     text: string;
     images: ImageContent[];

package/dist/types/cli/initial-message.d.ts

@@ -1,4 +1,4 @@
-import type { ImageContent } from "@gajae-code/ai";
+import type { ImageContent } from "@gajae-code/ai/core";
 import type { Args } from "./args";
 export interface InitialMessageInput {
     parsed: Args;

package/dist/types/cli/mcp-cli.d.ts

@@ -16,6 +16,7 @@ export interface MCPCommandArgs {
         header?: string[];
         cwd?: string;
         timeout?: number;
+        sharing?: "per-session" | "shared";
     };
     cwd?: string;
 }

package/dist/types/cli/native-smoke.d.ts

@@ -0,0 +1,12 @@
+import type { WindowsJobMemoryProbeResult } from "@gajae-code/natives";
+export type MemoryGuardNativeSmokeLoad = () => Record<string, unknown>;
+export type MemoryGuardNativeSmokeReceipt = {
+    api: "memory_guard_windows_job_probe_v1";
+    source: "pi_natives";
+    result: WindowsJobMemoryProbeResult;
+};
+export declare function runMemoryGuardNativeSmoke(options?: {
+    loadNative?: MemoryGuardNativeSmokeLoad;
+    writeStdout?: (text: string) => void;
+}): void;
+export declare function runNativeSmokeTest(): Promise<void>;

package/dist/types/cli/plugin-cli.d.ts

@@ -10,6 +10,7 @@ export interface PluginCommandArgs {
     flags: {
         json?: boolean;
         fix?: boolean;
+        migratePlugins?: boolean;
         force?: boolean;
         dryRun?: boolean;
         local?: boolean;

package/dist/types/cli/setup-cli.d.ts

@@ -3,7 +3,7 @@
  *
  * Handles `gjc setup [component]` to install the normal defaults or optional feature dependencies.
  */
-import { AuthStorage, SqliteAuthCredentialStore } from "@gajae-code/ai";
+import { AuthStorage, SqliteAuthCredentialStore } from "@gajae-code/ai/core";
 import { runExternalCredentialAutoImport } from "../setup/credential-auto-import";
 export type SetupComponent = "claude" | "codex" | "credentials" | "defaults" | "hermes" | "hooks" | "provider" | "python" | "stt";
 export interface SetupCommandArgs {

package/dist/types/cli/update-cli.d.ts

@@ -1,4 +1,10 @@
-import { type Installer, type NpmRegistryLookupOptions } from "../utils/npm-registry";
+import { type UpdateChannel } from "../config/update-channel";
+import { type NpmRegistryLookupOptions } from "../utils/npm-registry";
+export interface UpdateCommandOptions {
+    force: boolean;
+    check: boolean;
+    channel?: UpdateChannel;
+}
 interface ReleaseInfo {
     tag: string;
     version: string;
@@ -40,10 +46,7 @@ export interface BinaryReplacementOptions {
  * Parse update subcommand arguments.
  * Returns undefined if not an update command.
  */
-export declare function parseUpdateArgs(args: string[]): {
-    force: boolean;
-    check: boolean;
-} | undefined;
+export declare function parseUpdateArgs(args: string[]): UpdateCommandOptions | undefined;
 export type PackageManagerTarget = {
     manager: "npm";
     packageName: string;
@@ -61,7 +64,13 @@ type PathPlatform = NodeJS.Platform;
 type PackageExists = (packageName: string, packageRoot: string) => boolean;
 export declare function resolveUpdateMethodForTest(ompPath: string, bunBinDir: string | undefined): "bun" | "npm" | "binary";
 export declare function resolveNpmManagedTargetForTest(ompPath: string, platform: PathPlatform, packageExists: PackageExists): PackageManagerTarget | undefined;
-export declare function getLatestReleaseForTest(options: NpmRegistryLookupOptions): Promise<ReleaseInfo>;
+/** Lookup options for the release check: registry resolution plus the release channel. */
+export interface LatestReleaseLookupOptions extends NpmRegistryLookupOptions {
+    channel?: UpdateChannel;
+}
+export declare function getLatestReleaseForTest(options: LatestReleaseLookupOptions): Promise<ReleaseInfo>;
+export declare function compareVersionsForTest(a: string, b: string): number;
+export declare function parseReportedVersionForTest(output: string): string | undefined;
 export declare function formatBinaryDownloadFailureMessageForTest(binaryName: string, url: string, status: string | number, platform?: NodeJS.Platform, registryNote?: string): string;
 export declare function buildReleaseBinaryUrlForTest(version: string, platform?: NodeJS.Platform, arch?: string): string;
 export declare function formatManualUpdateInstructionsForTest(platform?: NodeJS.Platform): string;
@@ -97,16 +106,35 @@ export declare function runBinaryUpdateFlow(targetPath: string, url: string, exp
  * Run the update command.
  */
 export interface UpdateCommandDependencies {
-    getLatestRelease?: (installer?: Installer) => Promise<ReleaseInfo>;
+    getLatestRelease?: (options?: LatestReleaseLookupOptions) => Promise<ReleaseInfo>;
     resolveUpdateTarget?: () => Promise<UpdateTarget>;
     performUpdate?: (target: UpdateTarget, expectedVersion: string, registry?: string) => Promise<void>;
     refreshInstalledDefaultSkills?: () => Promise<void>;
     exit?: (code: number) => never;
 }
-export declare function runUpdateCommand(opts: {
+/** How the update command should proceed after comparing versions. */
+export interface UpdateDecision {
+    install: boolean;
+    kind: "up-to-date" | "new-version" | "switch-back" | "force";
+}
+/**
+ * Decide whether to install after comparing the channel's release with the
+ * installed version.
+ *
+ * A nightly install is semver-newer than every stable release (nightlies
+ * version as stable-max-patch+1), so a plain comparison would pin the user on
+ * nightly forever: switching back to stable must install even though the
+ * target is semver-lower. Only a stable lookup from a nightly build is an
+ * intentional switch-back — the reverse (a same-core nightly behind the
+ * installed stable) still requires --force.
+ */
+export declare function resolveUpdateDecision(options: {
+    comparison: number;
     force: boolean;
-    check: boolean;
-}, deps?: UpdateCommandDependencies): Promise<void>;
+    channel: UpdateChannel;
+    currentVersion: string;
+}): UpdateDecision;
+export declare function runUpdateCommand(opts: UpdateCommandOptions, deps?: UpdateCommandDependencies): Promise<void>;
 /**
  * Print update command help.
  */

package/dist/types/cli.d.ts

@@ -105,7 +105,7 @@ export declare class RootHelpCommand extends Command {
         };
         thinking: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
-            options: import("@gajae-code/ai").Effort[];
+            options: ("high" | "low" | "max" | "medium" | "minimal" | "xhigh")[];
         };
         hook: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;

package/dist/types/commands/mcp.d.ts

@@ -65,6 +65,11 @@ export default class MCP extends Command {
         timeout: import("@gajae-code/utils/cli").FlagDescriptor<"integer"> & {
             description: string;
         };
+        sharing: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+            options: string[];
+            default: string;
+        };
     };
     run(): Promise<void>;
 }

package/dist/types/commands/plugin.d.ts

@@ -24,6 +24,9 @@ export default class Plugin extends Command {
         fix: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };
+        "migrate-plugins": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
         force: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };

package/dist/types/commands/update.d.ts

@@ -1,6 +1,3 @@
-/**
- * Check for and install updates.
- */
 import { Command } from "@gajae-code/utils/cli";
 export default class Update extends Command {
     static description: string;
@@ -15,6 +12,9 @@ export default class Update extends Command {
             description: string;
             default: boolean;
         };
+        channel: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
     };
     run(): Promise<void>;
 }

package/dist/types/commit/agentic/agent.d.ts

@@ -1,5 +1,5 @@
 import { type ThinkingLevel } from "@gajae-code/agent-core";
-import type { Api, Model } from "@gajae-code/ai";
+import type { Api, Model } from "@gajae-code/ai/core";
 import type { ModelRegistry } from "../../config/model-registry";
 import type { Settings } from "../../config/settings";
 import type { AuthStorage } from "../../session/auth-storage";

package/dist/types/commit/analysis/conventional.d.ts

@@ -1,5 +1,5 @@
 import type { ThinkingLevel } from "@gajae-code/agent-core";
-import type { Api, Model } from "@gajae-code/ai";
+import type { Api, Model } from "@gajae-code/ai/core";
 import type { ConventionalAnalysis } from "../../commit/types";
 export interface ConventionalAnalysisInput {
     model: Model<Api>;

package/dist/types/commit/analysis/summary.d.ts

@@ -1,5 +1,5 @@
 import type { ThinkingLevel } from "@gajae-code/agent-core";
-import type { Api, Model } from "@gajae-code/ai";
+import type { Api, Model } from "@gajae-code/ai/core";
 import type { CommitSummary } from "../../commit/types";
 export interface SummaryInput {
     model: Model<Api>;

package/dist/types/commit/changelog/generate.d.ts

@@ -1,5 +1,5 @@
 import type { ThinkingLevel } from "@gajae-code/agent-core";
-import type { Api, Model } from "@gajae-code/ai";
+import type { Api, Model } from "@gajae-code/ai/core";
 import * as z from "zod/v4";
 import { type ChangelogGenerationResult } from "../../commit/types";
 export declare const changelogTool: {

package/dist/types/commit/changelog/index.d.ts

@@ -1,5 +1,5 @@
 import type { ThinkingLevel } from "@gajae-code/agent-core";
-import type { Api, Model } from "@gajae-code/ai";
+import type { Api, Model } from "@gajae-code/ai/core";
 export interface ChangelogFlowInput {
     cwd: string;
     model: Model<Api>;

package/dist/types/commit/map-reduce/index.d.ts

@@ -1,5 +1,5 @@
 import type { ThinkingLevel } from "@gajae-code/agent-core";
-import type { Api, Model } from "@gajae-code/ai";
+import type { Api, Model } from "@gajae-code/ai/core";
 import type { ConventionalAnalysis } from "../../commit/types";
 export interface MapReduceSettings {
     enabled?: boolean;

package/dist/types/commit/map-reduce/map-phase.d.ts

@@ -1,5 +1,5 @@
 import type { ThinkingLevel } from "@gajae-code/agent-core";
-import type { Api, Model } from "@gajae-code/ai";
+import type { Api, Model } from "@gajae-code/ai/core";
 import type { FileDiff, FileObservation } from "../../commit/types";
 export interface MapPhaseInput {
     model: Model<Api>;

package/dist/types/commit/map-reduce/reduce-phase.d.ts

@@ -1,5 +1,5 @@
 import type { ThinkingLevel } from "@gajae-code/agent-core";
-import type { Api, Model } from "@gajae-code/ai";
+import type { Api, Model } from "@gajae-code/ai/core";
 import type { ConventionalAnalysis, FileObservation } from "../../commit/types";
 export interface ReducePhaseInput {
     model: Model<Api>;

package/dist/types/commit/model-selection.d.ts

@@ -1,5 +1,5 @@
 import type { ThinkingLevel } from "@gajae-code/agent-core";
-import type { Api, Model } from "@gajae-code/ai";
+import type { Api, Model } from "@gajae-code/ai/core";
 import { type ModelLookupRegistry } from "../config/model-resolver";
 import type { Settings } from "../config/settings";
 export interface ResolvedCommitModel {

package/dist/types/commit/shared-llm.d.ts

@@ -1,4 +1,4 @@
-import type { AssistantMessage } from "@gajae-code/ai";
+import type { AssistantMessage } from "@gajae-code/ai/core";
 import * as z from "zod/v4";
 import type { ConventionalAnalysis } from "./types";
 /**

package/dist/types/commit/utils.d.ts

@@ -1,4 +1,4 @@
-import type { AssistantMessage, ToolCall } from "@gajae-code/ai";
+import type { AssistantMessage, ToolCall } from "@gajae-code/ai/core";
 import type { ChangelogCategory, ConventionalAnalysis, ConventionalDetail } from "./types";
 export declare function extractToolCall(message: AssistantMessage, name: string): ToolCall | undefined;
 export declare function extractTextContent(message: AssistantMessage): string;

package/dist/types/config/model-discovery-manager.d.ts

@@ -1,4 +1,4 @@
-import { type Api, type Model, type ModelRefreshStrategy } from "@gajae-code/ai";
+import { type Api, type Model, type ModelRefreshStrategy } from "@gajae-code/ai/core";
 export interface DiscoveryProvider {
     provider: string;
     optional?: boolean;

package/dist/types/config/model-equivalence.d.ts

@@ -1,4 +1,4 @@
-import { type Api, type Model } from "@gajae-code/ai";
+import { type Api, type Model } from "@gajae-code/ai/core";
 export type CanonicalModelSource = "override" | "bundled" | "heuristic" | "fallback";
 export interface ModelEquivalenceConfig {
     overrides?: Record<string, string>;

package/dist/types/config/model-profile-activation.d.ts

@@ -1,5 +1,5 @@
 import { ThinkingLevel } from "@gajae-code/agent-core";
-import type { Api, Model } from "@gajae-code/ai";
+import type { Api, Model } from "@gajae-code/ai/core";
 import type { AgentSession } from "../session/agent-session";
 export { resolveModelProfileName } from "./model-profile-contract";
 import { type GjcModelAssignmentTargetId, type ModelRegistry } from "./model-registry";

package/dist/types/config/model-registry.d.ts

@@ -1,4 +1,4 @@
-import { type Api, type AssistantMessageEventStream, type AuthCredentialSelector, type CacheRetention, type Context, type Model, type ModelRefreshStrategy, type ModelRequestTransform, type SimpleStreamOptions, type ThinkingConfig } from "@gajae-code/ai";
+import { type Api, type AssistantMessageEventStream, type AuthCredentialSelector, type CacheRetention, type Context, type Model, type ModelRefreshStrategy, type ModelRequestTransform, type SimpleStreamOptions, type ThinkingConfig } from "@gajae-code/ai/core";
 import type { OAuthCredentials, OAuthLoginCallbacks } from "@gajae-code/ai/utils/oauth/types";
 import { type ThemeColor } from "../modes/theme/theme";
 import { type ActiveProviderDescriptor } from "../sdk/providers";
@@ -57,6 +57,7 @@ export declare const ModelsConfigFile: ConfigFile<{
             supportsStore?: boolean | undefined;
             supportsDeveloperRole?: boolean | undefined;
             sendSessionHeaders?: boolean | undefined;
+            supportsResponsesSessionAffinity?: boolean | undefined;
             supportsMultipleSystemMessages?: boolean | undefined;
             supportsReasoningEffort?: boolean | undefined;
             reasoningEffortMap?: {
@@ -101,7 +102,9 @@ export declare const ModelsConfigFile: ConfigFile<{
         authHeader?: boolean | undefined;
         auth?: "apiKey" | "none" | "oauth" | undefined;
         discovery?: {
-            type: "llama.cpp" | "lm-studio" | "ollama" | "openai-models-list";
+            type: "llama.cpp" | "lm-studio" | "models-dev" | "ollama" | "openai-models-list";
+            apiByModelPrefix?: Record<string, "anthropic-messages" | "openai-completions"> | undefined;
+            modelsDevProvider?: string | undefined;
         } | undefined;
         requestTransform?: {
             profile?: "openai-proxy" | undefined;
@@ -138,6 +141,7 @@ export declare const ModelsConfigFile: ConfigFile<{
                 supportsStore?: boolean | undefined;
                 supportsDeveloperRole?: boolean | undefined;
                 sendSessionHeaders?: boolean | undefined;
+                supportsResponsesSessionAffinity?: boolean | undefined;
                 supportsMultipleSystemMessages?: boolean | undefined;
                 supportsReasoningEffort?: boolean | undefined;
                 reasoningEffortMap?: {
@@ -214,6 +218,7 @@ export declare const ModelsConfigFile: ConfigFile<{
                 supportsStore?: boolean | undefined;
                 supportsDeveloperRole?: boolean | undefined;
                 sendSessionHeaders?: boolean | undefined;
+                supportsResponsesSessionAffinity?: boolean | undefined;
                 supportsMultipleSystemMessages?: boolean | undefined;
                 supportsReasoningEffort?: boolean | undefined;
                 reasoningEffortMap?: {

package/dist/types/config/model-resolver.d.ts

@@ -2,7 +2,7 @@
  * Model resolution, scoping, and initial selection
  */
 import { ThinkingLevel } from "@gajae-code/agent-core";
-import { type Api, type KnownProvider, type Model } from "@gajae-code/ai";
+import { type Api, type KnownProvider, type Model } from "@gajae-code/ai/core";
 import { type ModelRegistry, type ModelRole } from "./model-registry";
 import { type ModelSelectorValue } from "./model-selector-value";
 import type { Settings } from "./settings";

package/dist/types/config/models-config-schema.d.ts

@@ -3,6 +3,7 @@ export declare const ModelCompatSchema: z.ZodObject<{
     supportsStore: z.ZodOptional<z.ZodBoolean>;
     supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
     sendSessionHeaders: z.ZodOptional<z.ZodBoolean>;
+    supportsResponsesSessionAffinity: z.ZodOptional<z.ZodBoolean>;
     supportsMultipleSystemMessages: z.ZodOptional<z.ZodBoolean>;
     supportsReasoningEffort: z.ZodOptional<z.ZodBoolean>;
     reasoningEffortMap: z.ZodOptional<z.ZodObject<{
@@ -72,6 +73,7 @@ export declare const OpenAICompatSchema: z.ZodObject<{
     supportsStore: z.ZodOptional<z.ZodBoolean>;
     supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
     sendSessionHeaders: z.ZodOptional<z.ZodBoolean>;
+    supportsResponsesSessionAffinity: z.ZodOptional<z.ZodBoolean>;
     supportsMultipleSystemMessages: z.ZodOptional<z.ZodBoolean>;
     supportsReasoningEffort: z.ZodOptional<z.ZodBoolean>;
     reasoningEffortMap: z.ZodOptional<z.ZodObject<{
@@ -255,6 +257,7 @@ export declare const ModelOverrideSchema: z.ZodObject<{
         supportsStore: z.ZodOptional<z.ZodBoolean>;
         supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
         sendSessionHeaders: z.ZodOptional<z.ZodBoolean>;
+        supportsResponsesSessionAffinity: z.ZodOptional<z.ZodBoolean>;
         supportsMultipleSystemMessages: z.ZodOptional<z.ZodBoolean>;
         supportsReasoningEffort: z.ZodOptional<z.ZodBoolean>;
         reasoningEffortMap: z.ZodOptional<z.ZodObject<{
@@ -341,9 +344,15 @@ export declare const ProviderDiscoverySchema: z.ZodObject<{
     type: z.ZodEnum<{
         "llama.cpp": "llama.cpp";
         "lm-studio": "lm-studio";
+        "models-dev": "models-dev";
         ollama: "ollama";
         "openai-models-list": "openai-models-list";
     }>;
+    apiByModelPrefix: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
+        "anthropic-messages": "anthropic-messages";
+        "openai-completions": "openai-completions";
+    }>>>;
+    modelsDevProvider: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const ProviderAuthSchema: z.ZodEnum<{
     apiKey: "apiKey";
@@ -375,6 +384,7 @@ export declare const ModelsConfigSchema: z.ZodObject<{
             supportsStore: z.ZodOptional<z.ZodBoolean>;
             supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
             sendSessionHeaders: z.ZodOptional<z.ZodBoolean>;
+            supportsResponsesSessionAffinity: z.ZodOptional<z.ZodBoolean>;
             supportsMultipleSystemMessages: z.ZodOptional<z.ZodBoolean>;
             supportsReasoningEffort: z.ZodOptional<z.ZodBoolean>;
             reasoningEffortMap: z.ZodOptional<z.ZodObject<{
@@ -455,9 +465,15 @@ export declare const ModelsConfigSchema: z.ZodObject<{
             type: z.ZodEnum<{
                 "llama.cpp": "llama.cpp";
                 "lm-studio": "lm-studio";
+                "models-dev": "models-dev";
                 ollama: "ollama";
                 "openai-models-list": "openai-models-list";
             }>;
+            apiByModelPrefix: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
+                "anthropic-messages": "anthropic-messages";
+                "openai-completions": "openai-completions";
+            }>>>;
+            modelsDevProvider: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
         requestTransform: z.ZodOptional<z.ZodObject<{
             profile: z.ZodOptional<z.ZodEnum<{
@@ -548,6 +564,7 @@ export declare const ModelsConfigSchema: z.ZodObject<{
                 supportsStore: z.ZodOptional<z.ZodBoolean>;
                 supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
                 sendSessionHeaders: z.ZodOptional<z.ZodBoolean>;
+                supportsResponsesSessionAffinity: z.ZodOptional<z.ZodBoolean>;
                 supportsMultipleSystemMessages: z.ZodOptional<z.ZodBoolean>;
                 supportsReasoningEffort: z.ZodOptional<z.ZodBoolean>;
                 reasoningEffortMap: z.ZodOptional<z.ZodObject<{
@@ -695,6 +712,7 @@ export declare const ModelsConfigSchema: z.ZodObject<{
                 supportsStore: z.ZodOptional<z.ZodBoolean>;
                 supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
                 sendSessionHeaders: z.ZodOptional<z.ZodBoolean>;
+                supportsResponsesSessionAffinity: z.ZodOptional<z.ZodBoolean>;
                 supportsMultipleSystemMessages: z.ZodOptional<z.ZodBoolean>;
                 supportsReasoningEffort: z.ZodOptional<z.ZodBoolean>;
                 reasoningEffortMap: z.ZodOptional<z.ZodObject<{