@gajae-code/coding-agent 0.12.21 → 0.13.0

package/CHANGELOG.md

@@ -2,6 +2,41 @@
 
 ## [Unreleased]
 
+### Added
+- `/model <preset>` and `/model gajae-code/<preset>` now activate a known model profile immediately instead of failing with "Unknown model". Unknown names still fall through to model resolution, and `/model <role> <preset>` keeps assigning a model to the named role.
+- Browser `act` and `run` responses can now surface an opt-in (`open(..., { diagnostics: true })`), bounded mailbox of page exceptions and `console.error` metadata. Entries carry only kind, timestamp, origin-only URL, line/column, and an allowlisted built-in error class; path segments, query strings, messages, arguments, values, and stacks are never retained. Serialization is byte-bounded with an explicit truncation marker.
+- A generated, host-neutral `sdk-skills/` bundle now provides namespaced external-agent skills for direct GJC SDK session discovery, approved trusted-local operations, and TypeScript/Python script authoring, with deterministic drift checks and credential-safe fail-closed templates. The bundle carries a versioned `manifest.json` (format version 1) so installed bundles fail closed on missing or unsupported layouts, and the skill prompts are authored as static Markdown sources under `scripts/gjc-sdk-skills/prompts/` that the generator copies and validates.
+- `GJC_SESSION_CONTEXT_BUDGET_BYTES` now overrides the synchronous session-context materialization budget that backs `SessionContextTooLargeError` (previously hardcoded to 64 MiB, now a 512 MiB default). The override parses fail-closed: only a canonical positive-integer value is honored, while empty, non-numeric, negative, zero, safe-integer-overflowing, or above-ceiling (8 GiB) values fall back to the 512 MiB default with a warning, so a malformed value can never silently raise or lower the memory guard. Raise it above your measured session size to suppress the preflight, or lower it to restore the old tight bound.
+
+### Fixed
+- Option+Q verification now supports normal macOS Terminal.app profiles and fails with an actionable Settings > Profiles > Keyboard > Use Option as Meta key diagnostic when the profile cannot forward Option as Meta/Esc.
+- Enabling Speech-to-Text from `/settings` now checks and configures its local dependencies immediately instead of deferring setup until the first recording. Setup progress is shown in the status line; failures disable STT again rather than leaving an unusable enabled toggle. Setup also reports platform-correct recorder commands, detects Ghostty's `macos-option-as-alt` requirement, and documents the Ctrl+P command-palette fallback, permissions, models, troubleshooting, and remapping.
+- Queued-message selection now accepts the actual macOS Terminal.app Option+Up/Down byte sequence from either physical Option key, enabling multi-message restore, delete, and reorder flows.
+- Keybinding configuration now normalizes `option`/`meta` to Option and `command`/`cmd` to Command, while Terminal.app guidance covers both physical Option keys and explicit Command profile mappings.
+- ACP prompts now settle when a terminal frame arrives before prompt acknowledgement with correlation split between the frame envelope and event payload. Live and deferred frames share strict ownership derivation, correlated nonterminals wait for exact acknowledgement ownership, and watchdog or cancel settlement no longer waits for a missing acknowledgement. Incomplete or foreign terminals emit structured error logs, unrelated session traffic cannot keep a wedged turn alive, and correlationless session events remain publishable without contaminating prompt-owned final-text state. Deferred terminal replay failures are contained by the session frame queue.
+- `bun run restart:sdk-broker --close-session-hosts` no longer fails against session hosts whose workspace was deleted while they kept running. The teardown fence proved a pid's identity only from the spawn-time marker inside the session's own workspace state root, so deleting that workspace (a removed worktree, a cleaned scratch directory) destroyed the only evidence the broker would accept: `session.close` answered `close_refused` forever, the host stayed resident serving the source it started with, and every restart exited non-zero naming the same unkillable orphans. Hosts now publish their OS start incarnation into the broker-owned session index at registration — and reconciliation preserves it — so the pid stays provable after its workspace is gone, while a marker naming a different process still refuses the signal and an incarnation that no longer matches the live pid still fails closed. A host that dies before withdrawing its own registration is now retired by the broker on the same evidence its dead-registration sweep already uses, so a completed teardown is reported as one instead of surfacing as `endpoint_stale` or `terminal_uncertain`.
+- Bounded cold-session resume now uses automatic size routing, keeps ordinary sessions eager, admits two-GiB transcripts with fork-header headroom, and reduces first-open work with reusable scanning, buffered sidecar writes, pressure-based GC, one full transcript JSON pass plus a bounded authenticated suffix read, owner-bound concurrent publication, fail-closed post-admission tamper handling, deferred secondary artifacts, and split reservation/residency/disk accounting.
+- Session resume entrypoints now share size-aware bounded admission without weakening strict small-session validation, and hard-link fallback cleanup uses identity-bound native retirement instead of a pathname `lstat`/`unlink` pair.
+- OpenCode Go Responses completions that carry a response id but no output items or token usage are now treated as typed retryable failures instead of successful turns; untyped proxy empty responses retain the existing context-overflow promotion and compaction path.
+- Memory-pressure sweeps now request asynchronous garbage collection instead of forcing a stop-the-world collection on the main event loop, preventing periodic input and rendering stalls under the opt-in memory guard.
+- `gjc gc --disk --prune` now fences the blob mark/sweep so a session transcript that keeps changing under the mark can never cause unsafe reclamation: each transcript's references are bound to a stat snapshot taken before and after its read, the store must be observed completely quiet across a quiescence window before the sweep may act, and the fence is re-verified immediately before every removal. A store that still moves withholds the sweep with `keep:withheld_evidence_incomplete: sessions_changed_during_mark` instead of reclaiming on evidence it could not prove stable (#4158).
+- Follow-up queue auto-continuation now waits for compaction and foreground bash/eval work to settle, preventing queued prompts from starting a model turn concurrently with those operations.
+- Scheduled continuations no longer route through `continueQueuedMessages()` merely because the last message is a non-assistant execution tail. The queue-consuming continuation is now used only for the explicit follow-up/steer drains (post-execution settlement, auto-compaction `queued_continue` recovery, and user-interrupt steering), so retry, fallback, auto-compaction, deep-interview, active-goal, TTSR, and reminder continuations keep `continue()` semantics and no longer fail with "No queued messages to continue" when no prompt is queued.
+- Follow-up queue submissions now defer slash/skill text during foreground bash/eval work instead of invoking a competing custom-message turn.
+- Follow-up queues now resume through a dedicated queued-message continuation after Python/Bash execution tails, avoiding an extra stale-turn replay.
+- Post-maintenance continuation now resumes the current non-assistant tail when no queued messages exist, while consuming queued steering/follow-ups only when present; overflow recovery no longer fails with `No queued messages to continue`, and accepted queued successors reset fallback accounting exactly once.
+- Superseded lifecycle SDK startups are now treated as expected cancellation during background notification reconciliation, preventing a red extension error while fail-closed `/notify on` admission and later same-session replacement recovery remain intact.
+- Streamed edit preview coalescing now keys on the complete partial-JSON payload rather than its length, so same-size in-place argument replacements recompute and render while repeated payloads remain cached.
+- CLI parsing now fails closed by default, while launch and ACP explicitly defer only their owned startup options; this preserves ACP-specific diagnostics, SDK startup forwarding, real ACP subprocess framing, and RLM typo rejection without exposing retired flags in root help or completion.
+- Read-tool code summarization and ZIP extraction now run asynchronously instead of blocking the TUI event loop during structural parsing or decompression.
+- `secrets.yml` entries with `mode: "replace"` and no explicit `replacement` now derive their substitute from a keyed, domain-separated HMAC-SHA256 construction over the process key instead of an unkeyed public `Bun.hash`. Derived replacements are no longer confirmable offline without the key (issue #4166); same-process determinism, same-length output, and alphanumeric character behavior are preserved, and explicit `replacement` values are unchanged. Note: derived replacements differ across processes/key rotations — set an explicit `replacement` when a stable value is required.
+- Managed scope preparation now reaps scrubbed write-protocol remnants. The POSIX exact-unlink fallback detaches and scrubs but never deletes, and macOS has no retained directory authority to complete deletion, so every managed replacement leaked zero-length `.gjc-exact-unlink-placeholder-*`, `.gjc-receipt-remove-*`, and `.gjc-exact-replace-destination-*` entries; scope directories grew without bound (observed at 83k dirents), degrading every per-mutation receipt scan and widening the quarantine-collision window behind intermittent `Could not prepare managed session scope (binding_invalid: prepare:binding_publish)` launch crashes. Preparation now removes zero-length, single-link remnants older than 15 minutes; non-zero displaced predecessors and detached receipts are retained as evidence, and in-flight protocol steps are protected by the age gate.
+
+### Added
+- `gjc setup provider` now ships parameterized proxy presets: `--preset litellm` and `--preset openai-compatible-proxy` (aliases `litellm-proxy`, `openai-proxy`, `compatible-proxy`, `custom-proxy`) with a required `--base-url`, configurable `--api-key-env`, and live model discovery (#4123).
+- New `modelProfile.proxyProvider` and `modelProfile.proxyMode` settings route built-in model-preset selectors through an authenticated OpenAI-compatible proxy (e.g. `xai/grok-4.3` → `litellm/xai/grok-4.3`). `fallback` preserves directly authenticated providers by default; `always` forces every proxy-routable built-in selector through the configured gateway. Routing fails closed for unconfigured or unauthenticated proxies and missing or ambiguous proxy models (#4123).
+- SDK-only session hosts now publish their session ID and register their endpoint lifecycle with the broker, matching its identity and staleness fences. This restores broker/coordinator resolution for durable workflow-gate controls (`workflow.gates.list` and `workflow.gate_answer`) without relying on tmux pane input; broker unavailability leaves non-lifecycle local hosts usable and retries publication later.
+
 ## [0.12.21] - 2026-08-09
 
 ### Fixed
@@ -18,14 +53,25 @@
 
 - Shadow-mode cold-session builds now compare the actual sidecar-derived provider context against the authoritative eager context and expose check/mismatch counters in `/session`; corrupt provider metadata produces a counted mismatch without weakening transcript authority. Cold branch activation now resolves compacted 10k-entry branches through one bounded ordinal-index scan and one bounded transcript range read instead of scanning a dictionary partition for every ancestor, and cold dictionary lookup skips unrelated JSON decoding while retaining full partition-digest verification. Bounded first-open, exact-reopen, and lazy cold-entry paths apply the same stale OpenAI Responses replay-metadata sanitation as eager resume.
 - ACP startup now rejects unrecognized command flags and incompatible terminal-auth modes through the normal CLI usage-error path, while preserving separate dash-leading system-prompt text.
+- ACP now rejects `--tools` by presence. A comma-only filter such as `--tools ,,` normalized to an empty list, which passed the length-based startup check and then set `toolNames` to `[]` because an empty array is truthy, starting an ACP session with every tool disabled instead of failing closed.
 
+- Ultragoal per-goal completion receipts no longer go permanently stale when a later `record-critic-verdict` call names that (already-`complete`, therefore immutable) goal's id — for example while re-confirming an earlier goal's evidence during a subsequent goal's terminal-critic gate. `critic_verdict` ledger rows are purely additive audit evidence that never mutate a goal's `goals.json` row, but the receipt-freshness check previously treated any ledger row carrying a goal's id as proof that goal had changed; one such `critic_verdict` row permanently staled the earlier goal's own per-goal receipt, which in turn blocked every later `final-aggregate` receipt that depends on it — with no actionable diagnostic identifying the actual cause. `critic_verdict` now joins `nudge` as a receipt-freshness bookkeeping event.
 - `gjc --mode acp` no longer aborts on flags it advertises in `--help`. `parseArgs` never recognized `--extension`/`-e`, `--hook`, `--no-extensions`, `--no-skills`, or `--skills`, so every one of them landed in `unknownFlags`; once unknown flags became a hard ACP failure, launching ACP with `--no-extensions` crashed at startup with `Unsupported under SDK-backed ACP: extension flags`. All five are parsed again, so `--no-extensions` starts normally while `--extension`, `--hook`, `--no-skills`, and `--skills` are rejected under ACP by their own names — the rejection list in `resolveAcpStartupOptions` had been dead code because nothing ever populated the fields it tested. A genuinely unknown flag is now reported as `unknown flags: --typo` instead of being mislabeled an extension flag.
+- Strict session resume now sanitizes stale replay metadata in memory without mutating the selected transcript, then publishes the terminal resume breadcrumb only after the first durable user-visible write. Declined auto-continuations restore their deferred predecessor terminal instead of dropping client settlement evidence.
+- Todo completion reminders now honor `todo.reminders.max` across an interactive turn rather than stopping after the first reminder.
+- A transient Windows `io_error` while detaching a managed replacement cleanup receipt now defers that receipt for later reconciliation instead of aborting the current session mutation. Invalid receipt and non-I/O cleanup failures remain fail-closed.
+
+- Attached image placeholders such as `[image 1]`, including the `[image N] source="…"` pasted-path reference form, are now deleted atomically with Backspace when the cursor sits at the placeholder boundary or the end of the full reference, instead of being erased one character at a time.
+- Root CLI help and shell completion now share the launch flag table instead of maintaining divergent copies, advertise the working `--fork` and `--worktree` options, omit retired extension/skill flags, and reject unknown options instead of silently dropping typos (#4023).
 
 ### Added
+- Added a deterministic quick-lane task classifier (`classifyQuickLane`) exposed through a read-only `gjc quick-lane classify` command. It is an auditable classification surface that performs no routing and is NOT wired into runtime routing: it only prints whether a task request carries quick-lane eligibility signals (explicit file paths, issue/PR numbers, named symbols, explicit tests, numbered steps, acceptance criteria, error references, code blocks, or an explicit `force:`/`!` override) or deep-lane exclusions (vague, ambiguous, exploratory, risk-sensitive, or multi-file/cross-contract scope), and it never alters deep-path defaults. The classifier is deterministic and fail-closed: any exclusion forces the deep lane even when a concrete anchor is present. The #3984 routing decision remains open.
 
+- `session.list` now supports bounded pages with opaque continuation cursors and stable snapshot sequences. Internal ACP, coordinator, CLI, and broker-restart consumers drain every page so existing session discovery remains complete.
 - Bounded-memory cold-session disk offloading is rollout-ready behind the `sessionMemory` settings namespace. `sessionMemory.mode` (default `"shadow"`) selects `off`/`shadow`/`enabled`: shadow measures without changing observable session behavior, and canary/default-on remain release-channel decisions rather than user-facing enum values. Fixed implementation budgets preserve the ≤64 MiB steady-state guarantee; transcript v5 stays authoritative and derived `.spill.*` sidecars remain disposable. Context materialization uses the typed `SessionContextTooLargeError` preflight, while `sessionMemory.contextOverflowRecovery` independently controls the async compact-once recovery path.
-- Enabled explicit-path resumes validate descriptor-bound commit metadata, base/tail hashes, terminal proof, and hot-record digests before loading only the authenticated post-compaction tail. Fresh-process gates cover 120k compaction cycles, direct/captured forks, and one-million-record first build plus exact lazy reopen. Managed retained-authority startup remains on the eager compatibility path pending retained-authority range support.
+- Enabled explicit-path and managed-session resumes validate descriptor-bound commit metadata, base/tail hashes, terminal proof, and hot-record digests before retaining only the authenticated post-compaction tail. Managed TUI and nested review-subagent sessions read authoritative transcript ranges through retained/no-follow descriptor checks while keeping disposable sidecars in a verified per-process resident cache outside the managed tree. Fresh-process gates cover 120k compaction cycles, direct/captured forks, and one-million-record first build plus exact lazy reopen.
 - Enabled canary sessions fail closed to shadow/eager behavior after repeated sidecar build failures or failed adoption, expose the live auto-disable reason through `/session`, and clear the session-local latch through the existing `off` rollback mode. Live `enabled` → `shadow`/`off` rollback keeps existing cold entries lazily readable for the current process; the next `off`-mode start ignores derived state and restores eager compatibility.
+- `gjc team` no longer rejects every successful native tmux startup with `tmux_layout_postproof_failed` and then, after passing layout verification, `tmux_window_option_postproof_failed`. tmux reports `#{window_layout}` as an encoded layout string rather than the requested preset name, so Team now verifies the encoded readback and the non-mutating `main-vertical` pane geometry without replaying the readback. Window-option readback now also uses `show-window-options -v`; unlike `show-options`, native tmux does not support the quiet `-q` flag on that command.
 
 ## [0.12.19] - 2026-08-08
 
@@ -37,7 +83,6 @@
 
 ### Fixed
 - Repeated provider idle-stream stalls now stop after `retry.maxRetries` instead of inheriting the unbounded transient-error retry path. A one-off stall still retries normally, while a persistently silent stream surfaces its error rather than resubmitting the same billable context indefinitely.
-
 - SDK snapshot spill writes now retry once with a fresh temporary file when Bun reports `EBADF` during write or `fsync` under heavily contended descriptor teardown, and no longer fail when `close()` reports `EBADF` after a successful write and sync. The atomic writer removes the abandoned attempt before retrying, preserves primary I/O failures, accepts only the proven already-closed close case, and keeps every non-`EBADF` error or repeated descriptor failure fatal.
 - Discord Gateway ingestion now decodes text and binary WebSocket payloads, resolves a thread's missing parent-channel metadata through Discord's REST API, and stops reconnecting after terminal authentication, sharding, version, or intent close codes.
 
@@ -47,12 +92,30 @@
 
 ### Added
 
+- Added provider-agnostic model presets that resolve bare model-family aliases across authenticated bundled and custom providers while preserving concrete provider/model identity, session stickiness, and exact provider pins. Settings now includes a durable global Provider Priority Order editor, and the preset catalog includes a curated Open Weight Models group for GLM, DeepSeek, Kimi, Luna, and mixed-role combinations.
 - `gjc gc` now reports managed session scope capacity when a scope is at or past 75% of the managed byte budget. A scope is snapshotted in full on every session start and fails closed once it exceeds the budget, but it is filled by GJC's own session records, so a working directory in sustained use can cross the limit with no prior signal — the first symptom is a launch that aborts. The probe is read-only and never fails a gc run: an absent, unreadable, or non-directory scope is reported as `unavailable`, an unreadable subtree is skipped so a partial walk still answers "am I near the budget?", and scopes below the threshold are omitted entirely so existing output is unchanged. `gc` still reclaims nothing here; the report names the scope path so stale session directories can be moved out by hand.
 - `--clipboard-transport <auto|native|osc52|ssh>` and `--clipboard-ssh-host <alias>` CLI flags, plus persisted `clipboard.transport` / `clipboard.sshHost` settings (CLI overrides config, config overrides the `auto` default). `ssh` mode routes text copy/paste through `ssh -o BatchMode=yes -o ConnectTimeout=3 -- <host> pbcopy/pbpaste` via argv spawn (never a shell string) with a 5-second hard timeout covering the whole operation lifecycle, a 1 MiB payload cap enforced during streaming (never fully buffered before the check), fatal UTF-8 decoding on the inbound side (invalid bytes are rejected, not silently normalized to U+FFFD), and outbound NUL-byte/unpaired-surrogate rejection. Explicit `ssh` failures (nonzero exit, timeout, invalid host, oversize/invalid payload) surface a sanitized error and never silently fall back to native clipboard or OSC 52 — clipboard payloads are never written to logs or artifacts. `auto`/`native`/`osc52` behave exactly as before. New `app.clipboard.pasteText` action (no default key; command palette only, so it never collides with the existing image-paste binding) reads the configured `ssh` clipboard and inserts it at the cursor.
+- `gjc sdk session` is the new broker-bound CLI for operating live SDK sessions: `list`, `inspect`, `send`, `status`, and `tail` plus the explicit `raw control|query|global` hatch. Every semantic verb resolves sessions through the SDK broker (validated endpoint identity, credentials used and never printed), output is a versioned credential-free row DTO, `send --wait` polls `turn.prompt_status` to a terminal state without ever cancelling, `tail` replays retained history from the durable checkpoint with `--strict` failing closed on `retention_gap`, and `--until-idle`/`--all-events`/`--cursor` bound and widen the follow. The removed `gjc daemon session` route is not aliased; the new surface is documented in `docs/sdk-session-cli.md` and referenced from `docs/sdk.md`.
+
+### Changed
+
+- Edit cards now keep live calls concise when collapsed and show per-file results, diff statistics, diagnostics availability, and full details consistently when expanded.
 
 ### Fixed
 
 - SDK snapshot shutdown now reserves a revision write synchronously before any asynchronous serialization work, so an immediate `close()` cannot begin terminal cleanup ahead of an in-progress spill write under heavily contended CI scheduling. The coordinator owner-intent negative matrix also receives the same 30-second contention budget used by other filesystem-backed integration cases; its assertions and four-case coverage are unchanged.
+- Provider-agnostic preset ranking now uses AuthStorage's effective selectable credential type. Unusable stored command keys no longer misclassify OAuth-backed providers, and session-selected OAuth, fail-closed selectors, blocked/expired OAuth retry, and `openai-codex-device` aliases now follow the same precedence and normalization as request dispatch.
+- Customizing one assignment in an active provider-agnostic model profile now concretizes every remaining bare profile alias before clearing profile ownership, matching profile deletion and preventing untouched roles from losing their equivalent-provider resolution semantics.
+- Opening or refreshing the `/model` profile preview no longer passes the live canonical session ID while resolving role badges, so display-only alias resolution cannot overwrite the default model's provider affinity; credential-session ranking remains intact.
+- SDK/ACP Q10 synthetic preset rows now resolve provider-agnostic defaults with the same authenticated equivalent-provider fallback as activation while using a read-only canonical scope; custom preset snapshots likewise keep credential context without mutating live provider affinity.
+- Bare model selectors in custom profiles now distinguish configuration from authentication across both scalar and fallback-array forms: typos report unknown catalog models, while known aliases whose entire fallback array lacks usable credentials remain recoverable authentication errors with login guidance.
+- Command-palette cycle availability checks and role metadata lookups no longer let read-only resolution mutate an active profile's canonical provider affinity; actual user-initiated cycling and fallback transitions still use the live canonical scope. Bare profile aliases now clamp explicit thinking suffixes against the authenticated concrete model while preserving the alias itself.
+- Profile customization now snapshots canonical affinity before alias concretization and restores it if any later persistence step fails. Colon-bearing bare aliases keep their full route identity through equivalent-provider auth retry and diagnostics. Subagents inherit the parent credential-selection session separately from their child-owned provider transport/cache identity, aligning preflight ranking with request dispatch without sharing mutable provider state.
+- SDK/ACP synthetic profile availability now validates every bare default and role assignment through authenticated preset-equivalent resolution, so partially available combined profiles are not advertised as selectable. Partial profiles grant equivalent-provider alias intent only to default, role, and role-agent assignments they actually own across task dispatch, cycling, compaction, resume, and fallback; pre-existing manual assignments remain exact.
+- Credential-session identity is now propagated through profile catalog availability, startup/default resolution, metadata account UUIDs, temporary model preflight, auth-error invalidation, quota/auth rotation, compaction provenance, and `/btw` turns while provider transport/cache identity remains separate. Failed profile activation also restores the prior persisted resume-default selector or explicit absence.
+- Profile activation/materialization, memory maintenance, interactive selectors, slash-command assignment, model-profile previews, and SDK extension contexts now use the same explicit credential identity as request dispatch; canonical session IDs remain reserved for sticky routing and provider transport/cache identities remain isolated.
+- Task subagents and branch commit-message generation now inherit the parent's credential identity separately from logical/canonical state. Extension model preflight, custom tools (including image generation and web search), title/prompt maintenance, background ephemeral metadata, and profile materialization use the same credential scope. Preset landing auth now requires usable effective credentials rather than catalog presence alone.
+- SDK tool sessions, deferred SDK selectors, slash-command aliases, memory role resolution, and provider-order status now carry credential identity. Provider alias invalidation updates canonical storage/backoff/session state, and preset landing availability is derived from actual credential-scoped `getApiKey` results (including keyless providers) rather than credential-type metadata.
 - `todo_write` and `ask` no longer reject valid calls before the tool loads. Both tools carried two independent copies of their raw-argument rules — one in the loaded tool, one in the cold descriptor registry that runs first — and the deferred copies had drifted: `todo_write`'s dropped the `content` synonym for `task` and the `complete`/`completed` aliases for `done`, accepted targetless `complete` entries the loaded tool rejects, and returned every rejection without its correction code, so the model saw a bare "raw arguments rejected before coercion" with nothing to fix and retried the same shape until the turn died. Both also rejected the harness's own injected `_i` intent field, failing any call carrying it with an unknown-root-key error the model could not repair. `todo_write` validation now lives in a single shared contract module (`tools/todo-contract.ts`) used by both paths, and both tools tolerate `_i` at the root while still rejecting genuinely unknown keys.
 - A stalled ACP session is no longer unrecoverable. The SDK host drops a session whose client has not ponged within `HEARTBEAT_TTL_MS` (20s), but the ACP client inherited the transport's one-shot reconnect defaults — 3 attempts at a 25ms base backoff, a total budget of 175ms — so any event-loop stall long enough for the host to reap the session exceeded the client's entire retry window by two orders of magnitude and surfaced as a terminal `-32603 ACP session transport was lost: SDK WebSocket reconnect attempts exhausted`. Under machine load this killed long-running agent sessions outright while their processes stayed alive. The ACP adapter and the broker connection now share an explicit `ACP_SESSION_RECONNECT` budget derived from `HEARTBEAT_TTL_MS` rather than a magic number: backoff ramps 250ms → 500ms → 1s and holds at a 2s cap for 23 attempts (~41.75s), so the client outlives twice the host TTL while individual sleeps stay short enough to reattach promptly once the host answers again.
 - Managed scope prepare and legacy-local resume no longer report success while group/other-readable descendants remain on disk (e.g. mode `0o036`/`0o644`): prepare uses a mode-only walk (not `snapshotManagedTree("")`, which races concurrent writers and broke `/move`) to detect drift, re-secures with apply+verify, and retries once; legacy-local capture uses the same resecure helper.
@@ -71,6 +134,7 @@
 - Added plugin registry v2 as the single execution authority for plugin tools, subskills, and prompt appendices, with digest verification at final use.
 - Added module-trace and process-tree RSS verification harnesses for startup-memory regressions.
 - Added `bun run clean` / `bun run clean:native` (`scripts/clean.ts`) to remove build output — `dist/`, `binaries/`, `coverage/`, stray `*.bun-build`, `*.tsbuildinfo`, and with `--native` compiled `.node` addons. Sources, `node_modules/`, `.gjc/` runtime state, and `artifacts/` test evidence are refused as targets rather than silently skipped, and `--dry-run` lists targets without deleting.
+- Codex GPT-5.6 OAuth context-window overrides are honored instead of silently re-clamped: explicit `modelOverrides.<id>.contextWindow` values survive the bundled 372K cap when positive and finite, non-positive values are ignored with a warning, and the precedence/fallback contract is codified in the Codex context-cap policy (#3987).
 
 ### Changed
 
@@ -296,6 +360,7 @@
 
 ### Fixed
 
+- Managed session forks no longer fail with `managed_nested_path_unsupported` on platforms without retained root authority. Nested reads verify each intermediate directory component as a real same-device directory instead of being rejected outright, restoring artifact copying during `fork()` and `moveTo()`.
 - Terminal input now normalizes Option/Meta navigation and psmux modified-Enter encodings through the native key parser, keeping legacy, Kitty CSI-u, and modifyOtherKeys behavior consistent.
 - Ultragoal CLI replay no longer executes model-authored test source or trusts `replaySafe: true` as arbitrary command authority. Runtime replay is limited to the pinned Bun runtime for `--version` and literal `-e "console.log(...)"`; shells, interpreter code strings, path-qualified executables, tests, install/publish/network/git mutation commands, and arbitrary argv are rejected. Replay cwd/artifact files are realpath-confined, ambiguous rows fail closed, stdout and stderr are checked, and POSIX timeout cleanup signals the process group. Structured test-report fallback remains deliberately unsupported pending a separate trusted-provenance design (#3533).
 - Ultragoal CLI replay evidence now reads the replay file referenced by an `executorQa.artifactRefs` entry whose `kind` is `cli-replay`. Inline, nested, and file-backed replay forms are disambiguated explicitly; mixed or malformed rows fail closed (#3533).

package/dist/types/cli/args.d.ts

@@ -1,5 +1,6 @@
 import { type Effort } from "@gajae-code/ai/core";
 export type Mode = "text" | "json" | "acp";
+export type ParseArgsAuthority = "local" | "acp" | "deferred";
 export interface Args {
     cwd?: string;
     allowHome?: boolean;
@@ -48,9 +49,11 @@ export interface Args {
     noTitle?: boolean;
     messages: string[];
     fileArgs: string[];
-    /** Retained for test/runtime compatibility; extension-defined flags are no longer parsed. */
+    /** Flags unknown to every launch parser; their consumer supplies the diagnostic. */
     unknownFlags: Map<string, boolean | string>;
     /** Exact interactive startup login intent, recognized before model-profile activation. */
     authBootstrap?: true;
 }
-export declare function parseArgs(args: string[]): Args;
+export declare function parseArgs(args: string[], authority?: ParseArgsAuthority): Args;
+/** Reject flags whose only owners are non-local startup consumers. */
+export declare function assertLocalLaunchArgs(parsed: Args): void;

package/dist/types/cli/root-flags.d.ts

@@ -0,0 +1,246 @@
+import { type FlagDescriptor } from "@gajae-code/utils/cli";
+/** Public launch flags shared by root help, completion, and the launch command. */
+export declare const ROOT_LAUNCH_FLAGS: {
+    model: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    smol: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    slow: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    plan: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    mpreset: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    default: FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    provider: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "api-key": FlagDescriptor<"string"> & {
+        description: string;
+    };
+    credential: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "system-prompt": FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "append-system-prompt": FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "mcp-config": FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "clipboard-transport": FlagDescriptor<"string"> & {
+        description: string;
+        options: string[];
+    };
+    "clipboard-ssh-host": FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "allow-home": FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    mode: FlagDescriptor<"string"> & {
+        description: string;
+        options: string[];
+    };
+    print: FlagDescriptor<"boolean"> & {
+        char: string;
+        description: string;
+    };
+    continue: FlagDescriptor<"boolean"> & {
+        char: string;
+        description: string;
+    };
+    resume: FlagDescriptor<"string"> & {
+        char: string;
+        description: string;
+        optionalValue: true;
+    };
+    fork: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    worktree: FlagDescriptor<"string"> & {
+        char: string;
+        description: string;
+        optionalValue: true;
+    };
+    "session-dir": FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "no-session": FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    models: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "no-tools": FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    "no-lsp": FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    "no-pty": FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    tmux: FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    tools: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    thinking: FlagDescriptor<"string"> & {
+        description: string;
+        options: readonly ["minimal", "low", "medium", "high", "xhigh", "max"];
+    };
+    "no-rules": FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    export: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "list-models": FlagDescriptor<"string"> & {
+        description: string;
+        optionalValue: true;
+    };
+    "no-title": FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+};
+export type ConsumerLaunchFlagName = "hook" | "extension" | "no-extensions" | "no-skills" | "skills";
+export type LaunchFlagConsumer = "acp" | "local";
+/**
+ * Flags accepted only so their owning startup consumer can classify them. They
+ * deliberately stay out of root help and completion.
+ */
+export declare const CONSUMER_LAUNCH_FLAGS: Record<ConsumerLaunchFlagName, FlagDescriptor>;
+/** Every flag understood by the launch argument parser, including hidden consumer-owned flags. */
+export declare const LAUNCH_PARSE_FLAGS: {
+    model: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    smol: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    slow: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    plan: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    mpreset: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    default: FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    provider: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "api-key": FlagDescriptor<"string"> & {
+        description: string;
+    };
+    credential: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "system-prompt": FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "append-system-prompt": FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "mcp-config": FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "clipboard-transport": FlagDescriptor<"string"> & {
+        description: string;
+        options: string[];
+    };
+    "clipboard-ssh-host": FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "allow-home": FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    mode: FlagDescriptor<"string"> & {
+        description: string;
+        options: string[];
+    };
+    print: FlagDescriptor<"boolean"> & {
+        char: string;
+        description: string;
+    };
+    continue: FlagDescriptor<"boolean"> & {
+        char: string;
+        description: string;
+    };
+    resume: FlagDescriptor<"string"> & {
+        char: string;
+        description: string;
+        optionalValue: true;
+    };
+    fork: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    worktree: FlagDescriptor<"string"> & {
+        char: string;
+        description: string;
+        optionalValue: true;
+    };
+    "session-dir": FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "no-session": FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    models: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "no-tools": FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    "no-lsp": FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    "no-pty": FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    tmux: FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    tools: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    thinking: FlagDescriptor<"string"> & {
+        description: string;
+        options: readonly ["minimal", "low", "medium", "high", "xhigh", "max"];
+    };
+    "no-rules": FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    export: FlagDescriptor<"string"> & {
+        description: string;
+    };
+    "list-models": FlagDescriptor<"string"> & {
+        description: string;
+        optionalValue: true;
+    };
+    "no-title": FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    extension: FlagDescriptor<"boolean" | "integer" | "string">;
+    hook: FlagDescriptor<"boolean" | "integer" | "string">;
+    "no-extensions": FlagDescriptor<"boolean" | "integer" | "string">;
+    "no-skills": FlagDescriptor<"boolean" | "integer" | "string">;
+    skills: FlagDescriptor<"boolean" | "integer" | "string">;
+};
+/** Startup consumers that may receive a hidden launch flag. */
+export declare const LAUNCH_FLAG_CONSUMERS: Record<ConsumerLaunchFlagName, readonly LaunchFlagConsumer[]>;
+export declare function launchFlagIsOwnedBy(name: ConsumerLaunchFlagName, consumer: LaunchFlagConsumer): boolean;

package/dist/types/cli.d.ts

@@ -85,6 +85,15 @@ export declare class RootHelpCommand extends Command {
         resume: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             char: string;
             description: string;
+            optionalValue: true;
+        };
+        fork: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        worktree: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            char: string;
+            description: string;
+            optionalValue: true;
         };
         "session-dir": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
@@ -112,25 +121,7 @@ export declare class RootHelpCommand extends Command {
         };
         thinking: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
-            options: ("high" | "low" | "max" | "medium" | "minimal" | "xhigh")[];
-        };
-        hook: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
-            description: string;
-            multiple: true;
-        };
-        extension: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
-            char: string;
-            description: string;
-            multiple: true;
-        };
-        "no-extensions": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
-            description: string;
-        };
-        "no-skills": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
-            description: string;
-        };
-        skills: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
-            description: string;
+            options: readonly ["minimal", "low", "medium", "high", "xhigh", "max"];
         };
         "no-rules": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
@@ -140,6 +131,7 @@ export declare class RootHelpCommand extends Command {
         };
         "list-models": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
+            optionalValue: true;
         };
         "no-title": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;

package/dist/types/commands/daemon.d.ts

@@ -49,36 +49,6 @@ export default class Daemon extends Command {
         "agent-dir": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
-        op: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
-            description: string;
-        };
-        "idempotency-key": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
-            description: string;
-        };
-        "json-input": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
-            description: string;
-        };
-        "json-input-file": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
-            description: string;
-        };
-        "json-input-stdin": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
-            description: string;
-        };
-        confirm: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
-            description: string;
-        };
-        query: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
-            description: string;
-        };
-        cursor: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
-            description: string;
-        };
-        "show-endpoint-credential": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
-            description: string;
-        };
-        yes: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
-            description: string;
-        };
     };
     run(): Promise<void>;
 }

package/dist/types/commands/launch.d.ts

@@ -75,6 +75,15 @@ export default class Index extends Command {
         resume: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             char: string;
             description: string;
+            optionalValue: true;
+        };
+        fork: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        worktree: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            char: string;
+            description: string;
+            optionalValue: true;
         };
         "session-dir": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
@@ -102,25 +111,7 @@ export default class Index extends Command {
         };
         thinking: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
-            options: import("@gajae-code/ai").Effort[];
-        };
-        hook: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
-            description: string;
-            multiple: true;
-        };
-        extension: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
-            char: string;
-            description: string;
-            multiple: true;
-        };
-        "no-extensions": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
-            description: string;
-        };
-        "no-skills": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
-            description: string;
-        };
-        skills: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
-            description: string;
+            options: readonly ["minimal", "low", "medium", "high", "xhigh", "max"];
         };
         "no-rules": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
@@ -130,6 +121,7 @@ export default class Index extends Command {
         };
         "list-models": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
+            optionalValue: true;
         };
         "no-title": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;

package/dist/types/commands/quick-lane.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Quick-lane task classification (issue #3984).
+ *
+ * Read-only classification surface for the quick lane: prints whether a task
+ * request is eligible for the quick lane (bounded, direct execution) or must
+ * keep the existing deep path (planning/interview). This performs no routing
+ * and mutates nothing — it only exposes the deterministic classifier so task
+ * classification can be inspected, audited, and consumed by tooling.
+ */
+import { Command } from "@gajae-code/utils/cli";
+export default class QuickLane extends Command {
+    static description: string;
+    static args: {
+        action: import("@gajae-code/utils/cli").ArgDescriptor & {
+            description: string;
+            required: true;
+            options: string[];
+        };
+        text: import("@gajae-code/utils/cli").ArgDescriptor & {
+            description: string;
+            required: true;
+            multiple: true;
+        };
+    };
+    static flags: {
+        json: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+    };
+    static examples: string[];
+    run(): Promise<void>;
+}