@gajae-code/coding-agent 0.12.16 → 0.12.19

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [0.12.19] - 2026-08-08
+
+### Fixed
+
+- Telegram topic-registry archive transitions remain parser-valid across durable-fence load promotion and failed archive-publication rollback. The initial generation-57 fix cleared `disconnectGraceExpiresAt` on direct archive transitions, but loading a `disconnect_grace` record superseded by a newer durable fence could still promote it to `archive_pending` while retaining the grace-only field, and rollback could restore `disconnect_grace` without restoring its required deadline. Both paths now preserve the state/field invariant with parser-roundtrip coverage. This entry also corrects the hotfix attribution omitted from the published 0.12.18 release notes. `DAEMON_GENERATION` bumped to 58.
+
+## [0.12.18] - 2026-08-08
+
+### Fixed
+
+- SDK snapshot spill writes now retry once with a fresh temporary file when Bun reports `EBADF` during write or `fsync` under heavily contended descriptor teardown, and no longer fail when `close()` reports `EBADF` after a successful write and sync. The atomic writer removes the abandoned attempt before retrying, preserves primary I/O failures, accepts only the proven already-closed close case, and keeps every non-`EBADF` error or repeated descriptor failure fatal.
+- ACP now imports the synthetic model-profile provider namespace from a dependency-free SDK constant module, keeping the machine entrypoint out of model-registry, session-host, MCP-manager, and extension-runner closures enforced by `check:runtime`.
+
+## [0.12.17] - 2026-08-08
+
 ## [0.12.16] - 2026-08-08
 
 ### Added
@@ -39,6 +54,7 @@
 - `sticky-viewport-showcase.test.ts` runs in ~53s instead of ~192s, cutting the slowest CI test shard from ~369s to ~167s locally. Each of its 17 cases spawned a `bun` subprocess that re-rendered all 20 showcase frames (~9.4s per capture, ~187s of the file's ~192s) purely to obtain a pristine bundle it then corrupted. The bundle is now captured once and handed out as filesystem copies; the one case that must observe mutated `GJC_STICKY_VIEWPORT_ORACLE_COMMIT` state still captures for itself. Isolation is load-bearing and verified: sharing the directory instead of copying it fails 9 cases.
 
 ### Fixed
+- Telegram topic archival no longer corrupts the shared topic registry when an active topic first enters disconnect grace. `beginArchive` changed `authorityState` to `archive_pending` but retained `disconnectGraceExpiresAt`, a field the persisted-state parser permits only for `disconnect_grace`; one closed or stale session therefore made the entire otherwise-valid registry unreadable, after which every daemon scan reported `shared topic authority unavailable` and no new session could create a thread or replay a message. Every transition out of disconnect grace now clears the grace-only deadline before persistence. `DAEMON_GENERATION` bumped to 57.
 
 - `notifications-topic-registry.test.ts` pins `DAEMON_GENERATION` at 54 after #3965 (was stale at 53; Dev CI run 31133356543).
 - `smithery-env-trust.test.ts` no longer awaits hung probe pipes past a hard per-attempt deadline: minimal child env, `stdin: "ignore"`, SIGKILL + settled race, and up to 2 timeout-only retries. Fixes the inherited-config case that hit exactly 60001ms on Dev CI run 31133356543 after kill-at-45s left `Promise.all` on stdout/stderr unresolved. Assertions unchanged.

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -85,9 +85,14 @@ export declare const NOTIFICATION_PROTOCOL_VERSION = 3;
  * of escaping to the process-level fatal handler, authority-failure throws
  * preserve their underlying cause, and the compensation fence retry is bounded.
  * Generation 56 moves exact unlink and process-incarnation authority behind
- * lazy native bindings for the startup-cost cut (#3846).
+ * lazy native bindings for the startup-cost cut (#3846). Generation 57 clears
+ * disconnect-grace-only fields whenever a topic enters an archive state, so
+ * one stale session cannot make the shared registry unreadable and block every
+ * later session from creating a topic or replaying notifications. Generation
+ * 58 preserves that invariant during durable-fence load promotion and restores
+ * the exact grace deadline when a failed archive publication rolls back.
  */
-export declare const DAEMON_GENERATION = 56;
+export declare const DAEMON_GENERATION = 58;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 5
  * requires the complete generation-36 topic authority contract, so older

package/dist/types/sdk/model-profile-model.d.ts

@@ -1,14 +1,5 @@
 import type { ModelProfileDefinition } from "../config/model-profiles";
-/**
- * Reserved logical provider namespace for the preset-as-model facade.
- *
- * `gajae-code/<profile>` is not a real API provider: rows under this namespace
- * exist only in the SDK Q10 projection and `model.set` selection routes to a
- * session-scoped model-profile activation transaction. The namespace is
- * reserved so a user-defined `models.yml` provider of the same name cannot
- * silently shadow the facade (see {@link syntheticNamespaceCollision}).
- */
-export declare const SYNTHETIC_PROVIDER_ID = "gajae-code";
+export { SYNTHETIC_PROVIDER_ID } from "./model-profile-namespace";
 /**
  * Display metadata used for synthetic rows whose profile default model cannot
  * be resolved to a registered model. Mirrors the shared unknown-model

package/dist/types/sdk/model-profile-namespace.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Reserved logical provider namespace for the preset-as-model facade.
+ *
+ * Kept dependency-free because machine entrypoints use the namespace when
+ * filtering projected models and must not pull the model registry/session host
+ * graph into their static import closure.
+ */
+export declare const SYNTHETIC_PROVIDER_ID = "gajae-code";

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.12.16",
+	"version": "0.12.19",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -54,13 +54,13 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.12.16",
-		"@gajae-code/agent-core": "0.12.16",
-		"@gajae-code/ai": "0.12.16",
-		"@gajae-code/bridge-client": "0.12.16",
-		"@gajae-code/natives": "0.12.16",
-		"@gajae-code/tui": "0.12.16",
-		"@gajae-code/utils": "0.12.16",
+		"@gajae-code/stats": "0.12.19",
+		"@gajae-code/agent-core": "0.12.19",
+		"@gajae-code/ai": "0.12.19",
+		"@gajae-code/bridge-client": "0.12.19",
+		"@gajae-code/natives": "0.12.19",
+		"@gajae-code/tui": "0.12.19",
+		"@gajae-code/utils": "0.12.19",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/src/modes/acp/acp-agent.ts

@@ -48,7 +48,7 @@ import { resolveAcpFinalText } from "../../sdk/acp/final-text";
 import { ACP_MCP_LIFECYCLE_TIMEOUT_MS, type SessionLifecycleMcpServer } from "../../sdk/acp/mcp";
 import { ensureBroker } from "../../sdk/broker/ensure";
 import { readSdkBrokerDiscovery, SdkClient, SdkClientError } from "../../sdk/client";
-import { SYNTHETIC_PROVIDER_ID } from "../../sdk/model-profile-model";
+import { SYNTHETIC_PROVIDER_ID } from "../../sdk/model-profile-namespace";
 import type { SdkPromptTerminalOutcome } from "../../sdk/prompt-status";
 import {
 	buildToolCallStartUpdate,

package/src/sdk/bus/telegram-daemon-contract.ts

@@ -87,9 +87,14 @@ export const NOTIFICATION_PROTOCOL_VERSION = 3;
  * of escaping to the process-level fatal handler, authority-failure throws
  * preserve their underlying cause, and the compensation fence retry is bounded.
  * Generation 56 moves exact unlink and process-incarnation authority behind
- * lazy native bindings for the startup-cost cut (#3846).
+ * lazy native bindings for the startup-cost cut (#3846). Generation 57 clears
+ * disconnect-grace-only fields whenever a topic enters an archive state, so
+ * one stale session cannot make the shared registry unreadable and block every
+ * later session from creating a topic or replaying notifications. Generation
+ * 58 preserves that invariant during durable-fence load promotion and restores
+ * the exact grace deadline when a failed archive publication rolls back.
  */
-export const DAEMON_GENERATION = 56;
+export const DAEMON_GENERATION = 58;
 
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 5

package/src/sdk/bus/topic-registry.ts

@@ -578,7 +578,10 @@ export class TopicRegistry {
 					: {}),
 				...(isValidBindingString(raw.archiveHostId) ? { archiveHostId: raw.archiveHostId } : {}),
 				...(isValidBindingGeneration(raw.archiveLeaseEpoch) ? { archiveLeaseEpoch: raw.archiveLeaseEpoch } : {}),
-				...(typeof raw.disconnectGraceExpiresAt === "number" && Number.isFinite(raw.disconnectGraceExpiresAt)
+				...(raw.authorityState === "disconnect_grace" &&
+				!fenceSupersedesRecord &&
+				typeof raw.disconnectGraceExpiresAt === "number" &&
+				Number.isFinite(raw.disconnectGraceExpiresAt)
 					? { disconnectGraceExpiresAt: raw.disconnectGraceExpiresAt }
 					: {}),
 				...(bindingMalformed ? { bindingMalformed: true as const } : {}),
@@ -1179,6 +1182,9 @@ export class TopicRegistry {
 		} else {
 			record.authorityEpoch = snapshot.authorityEpoch;
 			record.authorityState = snapshot.authorityState;
+			if (snapshot.authorityState === "disconnect_grace" && snapshot.record?.disconnectGraceExpiresAt !== undefined)
+				record.disconnectGraceExpiresAt = snapshot.record.disconnectGraceExpiresAt;
+			else delete record.disconnectGraceExpiresAt;
 			this.rebuildInboundRoutes();
 		}
 		if (snapshot.fenceEpoch === undefined) this.epochs.delete(snapshot.sessionId);
@@ -1202,11 +1208,14 @@ export class TopicRegistry {
 				authorityEpoch: deleteEpoch,
 				authorityState: "archive_pending",
 			});
+			const restored = this.topics.get(snapshot.sessionId);
+			if (restored) delete restored.disconnectGraceExpiresAt;
 		} else if (record.topicId !== snapshot.topicId) {
 			return false;
 		} else {
 			record.authorityEpoch = deleteEpoch;
 			record.authorityState = "archive_pending";
+			delete record.disconnectGraceExpiresAt;
 			if (this.byTopic.get(record.topicId) === snapshot.sessionId) this.byTopic.delete(record.topicId);
 		}
 		this.epochs.set(snapshot.sessionId, deleteEpoch);
@@ -1230,6 +1239,7 @@ export class TopicRegistry {
 			if (record) {
 				record.authorityEpoch = Number.MAX_SAFE_INTEGER;
 				record.authorityState = "archive_exhausted";
+				delete record.disconnectGraceExpiresAt;
 				if (this.byTopic.get(record.topicId) === sessionId) this.byTopic.delete(record.topicId);
 			}
 			return undefined;
@@ -1239,6 +1249,7 @@ export class TopicRegistry {
 		if (!record) return undefined;
 		record.authorityEpoch = epoch;
 		record.authorityState = "archive_pending";
+		delete record.disconnectGraceExpiresAt;
 		if (hostId) record.archiveHostId = hostId;
 		record.archiveLeaseEpoch = epoch;
 		if (this.byTopic.get(record.topicId) === sessionId) this.byTopic.delete(record.topicId);
@@ -1368,6 +1379,7 @@ export class TopicRegistry {
 		)
 			return false;
 		record.authorityState = "inactive";
+		delete record.disconnectGraceExpiresAt;
 		if (this.byTopic.get(record.topicId) === sessionId) this.byTopic.delete(record.topicId);
 		this.archiveJobs.delete(sessionId);
 		return true;
@@ -1383,6 +1395,7 @@ export class TopicRegistry {
 					record.authorityEpoch = epoch;
 					record.archiveLeaseEpoch = epoch;
 					record.authorityState = "archive_pending";
+					delete record.disconnectGraceExpiresAt;
 				}
 			}
 			return (record.authorityState === "archive_pending" || record.authorityState === "archive_exhausted") &&
@@ -1420,6 +1433,7 @@ export class TopicRegistry {
 			...(exhausted ? { safeDiagnostic: "archive retry remains discoverable after retry budget" } : {}),
 		};
 		record.authorityState = "archive_pending";
+		delete record.disconnectGraceExpiresAt;
 		this.archiveJobs.set(sessionId, job);
 		return job;
 	}

package/src/sdk/host/query/revision-store.ts

@@ -1084,16 +1084,38 @@ export class RevisionStore {
 	}
 
 	async #writeAtomic(file: string, data: Buffer): Promise<void> {
-		const temporary = `${file}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`;
+		for (let attempt = 0; attempt < 2; attempt++) {
+			const temporary = `${file}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`;
+			try {
+				await this.#writeAtomicAttempt(temporary, data);
+				await chmod(temporary, 0o600);
+				await rename(temporary, file);
+				return;
+			} catch (error) {
+				await rm(temporary, { force: true }).catch(() => undefined);
+				if ((error as NodeJS.ErrnoException).code !== "EBADF" || attempt === 1) throw error;
+			}
+		}
+	}
+
+	async #writeAtomicAttempt(temporary: string, data: Buffer): Promise<void> {
 		const handle = await open(temporary, "w", 0o600);
+		let failure: { error: unknown } | undefined;
 		try {
 			await handle.writeFile(data);
 			await handle.sync();
-		} finally {
+		} catch (error) {
+			failure = { error };
+		}
+		try {
 			await handle.close();
+		} catch (error) {
+			// Bun can report EBADF when concurrent descriptor teardown has already
+			// closed a fully written and fsynced handle. Preserve every primary write
+			// failure and keep all other close errors fatal.
+			if ((error as NodeJS.ErrnoException).code !== "EBADF" && failure === undefined) failure = { error };
 		}
-		await chmod(temporary, 0o600);
-		await rename(temporary, file);
+		if (failure !== undefined) throw failure.error;
 	}
 
 	#retainSpill(revision: Revision): void {

package/src/sdk/model-profile-model.ts

@@ -6,17 +6,9 @@ import {
 } from "../config/model-profile-contract";
 import type { ModelProfileDefinition } from "../config/model-profiles";
 import { isAuthenticated, kNoAuth } from "../config/model-registry";
+import { SYNTHETIC_PROVIDER_ID } from "./model-profile-namespace";
 
-/**
- * Reserved logical provider namespace for the preset-as-model facade.
- *
- * `gajae-code/<profile>` is not a real API provider: rows under this namespace
- * exist only in the SDK Q10 projection and `model.set` selection routes to a
- * session-scoped model-profile activation transaction. The namespace is
- * reserved so a user-defined `models.yml` provider of the same name cannot
- * silently shadow the facade (see {@link syntheticNamespaceCollision}).
- */
-export const SYNTHETIC_PROVIDER_ID = "gajae-code";
+export { SYNTHETIC_PROVIDER_ID } from "./model-profile-namespace";
 
 /**
  * Display metadata used for synthetic rows whose profile default model cannot

package/src/sdk/model-profile-namespace.ts

@@ -0,0 +1,8 @@
+/**
+ * Reserved logical provider namespace for the preset-as-model facade.
+ *
+ * Kept dependency-free because machine entrypoints use the namespace when
+ * filtering projected models and must not pull the model registry/session host
+ * graph into their static import closure.
+ */
+export const SYNTHETIC_PROVIDER_ID = "gajae-code";