@gajae-code/coding-agent 0.12.8 → 0.12.10

package/CHANGELOG.md

@@ -2,10 +2,34 @@
 
 ## [Unreleased]
 
+## [0.12.10] - 2026-08-03
+
+## [0.12.9] - 2026-08-03
+
+### Added
+
+- `/login anthropic --manual` pairs by pasting the authorization code Anthropic shows in the browser instead of waiting on a `localhost:54545` callback the browser cannot reach. Complete it with `/login <code>`. Use it when gjc runs over SSH, in a container, or on a headless host; the default `/login anthropic` still uses the loopback callback. The flag is resolved before the paste fallback, so it is never mistaken for an authorization code, and providers without a paste-a-code redirect reject it explicitly instead of silently falling back.
+
+### Fixed
+
+- Composer Bash policy rejections now identify the active provider surface and direct Cursor Composer models to their native repository tools, enabling the agent runtime's bounded automatic recovery instead of leaving a blocked shell attempt as a terminal turn.
+- The `AgentSession retry fallback > invalidates an auth-failed managed credential` test now uses a stored credential instead of a runtime-key override, matching the pin-guard behavior added in #3724 where `--api-key`/`--credential` pinned keys are never invalidated; the shared test fixture installed runtime keys as plumbing, which silently tripped the new guard and blocked the auth invalidation path.
+- The Extension Control Center inspector no longer crashes when a narrow two-column layout leaves its preview pane fewer than two columns wide.
+- Prompt-template positional arguments now preserve literal `$@` and `$ARGUMENTS` text instead of recursively expanding it during placeholder substitution.
+- Native Windows session and GC commands now report the searched `psmux` / `pmux` / `tmux` provider set when no compatible multiplexer is available instead of leaking a literal `tmux` spawn error (#3688).
+- Managed-session recovery now preserves committed mutation state and the actual Linux fallback primitive in native publish receipts, preventing unsafe retry classification after a post-link staging unlink failure (#3746).
+- The system prompt now requires non-ASCII tool-input text to be written as literal UTF-8 rather than hand-spelled `\uXXXX` escapes, including JSON serialized into a string field, while leaving escapes that are intended source syntax alone. Models that hand-spell hex codepoints for CJK mis-type them, and each mis-typed escape decodes to a valid-but-wrong syllable, so Korean text in tool parameters silently arrives corrupted (anthropics/claude-code#83033).
+- The `models.yml` validation error for a custom provider without a credential source now explains that `auth` selects only the auth scheme and lists the three corrective forms (`apiKeyEnv`, literal `apiKey`, or `auth: none`) instead of restating the rule that was already misread. `docs/models.md` documents the same contract in a table (#3738).
+- Credential rotation no longer mutates a pinned credential, and no longer reports a rotation that did not happen. `#markFailedCredential` now applies its pin guard first and for every trigger class, consulting both the `--api-key` runtime override and the `--credential` runtime selector — previously the guard existed only on the quota path and checked only the API-key override, so a `--credential` pin could be rotated away from and the `auth` path could invalidate a pinned credential outright. Both paths now also require the re-resolved credential to actually differ before reporting a rotation: `invalidateCredentialMatching` reports that a row was matched and blocked, which is not the same as the session having moved to a different credential, and with a single-row pool it was true while nothing rotated. A terminal `forbidden` failure is now excluded from retry admission and makes no credential-state change at all. Finally, a rotation is only converted into a same-model retry when the fallback controller could actually be rewound; `restorePreviousEntryForRetry()` refuses once an entry's restore budget is spent, and ignoring that refusal left `activeIndex` on the next entry while the session still requested the previous model.
+- Dead-owner notification recovery now preserves a machine-readable transition block, marker-age diagnostics, and safe force-recovery guidance without weakening ownership proofs (#3762).
+- Detached SDK session hosts no longer outlive the broker that spawned them. A host whose broker died without teardown (crash, `SIGKILL`, restart without `--close-session-hosts`) previously stayed resident forever, holding its session's memory — hundreds of MB per orphan. Each host now polls the broker discovery publication and, after a bounded grace period with no live broker, disposes itself through the same graceful teardown a `SIGTERM` takes. A replacement broker resets the window, so hosts still survive ordinary broker restarts, and a transient discovery read failure is treated as ambiguity rather than proof of orphanhood.
+- Syntax highlighting now recognizes special filenames such as `CMakeLists.txt`, `Dockerfile.*`, `Makefile`, and `.env.*` before generic filename extensions.
+
 ## [0.12.8] - 2026-08-02
 ### Added
 
 - Added the paginated public SDK query `providers.list/active` (Q29), returning deterministic, deduplicated `{ provider, connectionKind }` descriptors for locally eligible providers without exposing credentials or performing remote health probes.
+- Added the opt-in Alibaba Token Plan Pro profile with `deepseek-v4-flash-0731:max` for execution and `glm-5.2:xhigh` for independent criticism, preserving the existing Balanced profile unchanged.
 
 ### Added
 
@@ -13,10 +37,14 @@
 
 ### Fixed
 
+- Windows automatic tmux resolution now selects `psmux` then `pmux` by canonical command order without rejecting distinct lower-priority aliases; it probes `tmux` only when neither named provider is available (#3725).
+- CI failure extraction now aggregates Bun failure and suite-error summaries across every test invocation in a job log instead of silently using only the first summary.
 - Ordinary `ask` selectors now bound long question premises and page through every premise row without skipping rows hidden by overflow indicators (#3675).
 - First-event timeout retries now require a typed, content-free failure from the current clean attempt scope, preventing prior or stale extension activity from suppressing or admitting a later request (#3553).
 - The issue-1979 Korean prose wrap test now cleans up inherited multiplexer env vars (`TMUX`, `TMUX_PANE`, etc.) so it deterministically exercises the plain-terminal render path regardless of the CI runner's terminal session (#1979).
 - The model selector's assignment menu now shows the model each role currently resolves to (`Set as EXECUTOR (Executor) — now: anthropic/claude-haiku-4-5`), distinguishing an unset default, a role that inherits the default, and a configured-but-unresolvable selector. Previously the role rows were unlabeled, so the only way to learn a role's model was to scan the whole 800+ entry model list for role badges.
+- Standalone `AGENTS.md` ancestor discovery now bounds directory traversal, per-file reads, and aggregate instruction bytes while surfacing content-free omission warnings (#3722).
+
 ## [0.12.7] - 2026-07-31
 
 ## [0.12.6] - 2026-07-31
@@ -26,6 +54,7 @@
 
 ### Fixed
 
+- Managed session publication now works on filesystems that implement no `renameat2` rename flags at all. NFS rejects both `RENAME_NOREPLACE` and `RENAME_EXCHANGE` with `EINVAL`, so publishing a migration receipt failed the whole resume with `Could not open managed session: invalid_request`. The no-replace publish now falls back to `linkat(2)`, which fails with `EEXIST` on an occupied destination and therefore carries the identical no-overwrite guarantee; the fallback is authorized only by a pre-mutation missing-primitive outcome, so a publish that may have committed is never retried under a second primitive. The staged descriptor is retained across publication and the staging link is removed only after it is released, because unlinking a still-open name on NFS silly-renames it and would leave a second link on the published inode.
 - Settings now requests a repaint after asynchronous GJC bundle and plugin views rebuild, so loaded content and mutation results appear without an extra keypress (#3643).
 - `todo_write` now rejects unsupported operation keys and treats a bare `done` or `drop` as an error instead of completing or abandoning every task (#3640).
 - Deferred `agent_end` publication again settles public session readiness before slow extension handlers finish, while retaining exact cancellation leases through queued extension delivery and draining that delivery before session shutdown.

package/dist/types/cli/notify-cli.d.ts

@@ -21,6 +21,7 @@ export interface NotifyCommandArgs {
     slackChannelId?: string;
     slackAuthorizedUserId?: string;
     redact?: boolean;
+    forceDaemonLock?: boolean;
     probe?: boolean;
     message?: string;
 }

package/dist/types/commands/sdk.d.ts

@@ -3,6 +3,29 @@ import type { Args as ParsedArgs } from "../cli/args";
 import { type SessionLifecycleLaunchRequest } from "../sdk/broker/lifecycle";
 import { SessionManager } from "../session/session-manager";
 export declare function lifecycleArgs(request: SessionLifecycleLaunchRequest, cwd: string, agentDir: string): Promise<ParsedArgs>;
+/**
+ * How long a session host tolerates the complete absence of a live broker
+ * publication before treating itself as orphaned. Hosts intentionally survive
+ * broker restarts (a replacement broker republishes discovery within seconds),
+ * so this must comfortably exceed a restart window while still bounding the
+ * lifetime of hosts whose broker is gone for good — otherwise every crashed or
+ * torn-down broker leaks a detached multi-hundred-megabyte host forever.
+ */
+export declare const SESSION_HOST_BROKER_ABSENCE_GRACE_MS: number;
+/**
+ * Resolves only once no live broker publication has been observable in
+ * `agentDir` for the full grace window. A reappearing broker (including a
+ * replacement with a different pid) resets the window; an unreadable
+ * publication is not proof of orphanhood but accrues against the same bound.
+ */
+export declare function watchSessionHostBrokerLiveness(deps: {
+    agentDir: string;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+    readDiscovery?: (agentDir: string) => Promise<unknown>;
+    graceMs?: number;
+    pollMs?: number;
+}): Promise<void>;
 /** Opens lifecycle-authorized history without letting replacement content reach readiness. */
 export declare function openLifecycleSessionManager(request: SessionLifecycleLaunchRequest, cwd: string, agentDir: string): Promise<{
     parsed: ParsedArgs;

package/dist/types/discovery/agents-md.d.ts

@@ -1 +1,11 @@
-export {};
+import { type ContextFile } from "../capability/context-file";
+import type { LoadContext, LoadResult } from "../capability/types";
+export type AgentsMdReader = (filePath: string, maxBytes: number) => Promise<{
+    content: string | null;
+    byteLength: number;
+    tooLarge: boolean;
+}>;
+/**
+ * Load standalone AGENTS.md files.
+ */
+export declare function loadAgentsMd(ctx: LoadContext, readCandidate?: AgentsMdReader): Promise<LoadResult<ContextFile>>;

package/dist/types/modes/types.d.ts

@@ -374,5 +374,11 @@ export interface OAuthSelectorOptions {
     allowExternalCredentialDiscovery?: boolean;
     trigger?: "bare-login";
     externalCredentialDiscover?: CredentialAutoImportOptions["discover"];
+    /**
+     * Pair by pasting the code the provider displays instead of waiting on the
+     * loopback callback. Set by `/login <provider> --manual` for browsers that
+     * cannot reach this machine.
+     */
+    manualCode?: boolean;
 }
 export {};

package/dist/types/sdk/bus/daemon-paths.d.ts

@@ -13,6 +13,7 @@ export interface DaemonPaths {
     ownership: string;
     roots: string;
     steal: string;
+    diagnostic: string;
     aliases: string;
     seenUpdates: string;
 }

package/dist/types/sdk/bus/notification-service.d.ts

@@ -9,6 +9,21 @@ import type { SlackDiagnosticProvider } from "./slack-provider";
  * can never leak a credential regardless of where the string originated.
  */
 export declare function sanitizeDiagnostic(text: string, token?: string): string;
+export interface NotificationDiagnosticEvent {
+    timestamp: string;
+    operation: string;
+    phase: string;
+    outcome: string;
+    reason: string;
+    pid?: number;
+    incarnation?: string;
+    ageMs?: number;
+    detail?: string;
+}
+/** Append a bounded, private, secret-safe daemon diagnostic event. */
+export declare function writeNotificationDiagnostic(settings: Pick<Settings, "getAgentDir">, event: Omit<NotificationDiagnosticEvent, "timestamp"> & {
+    timestamp?: string;
+}): Promise<void>;
 /** Identity evidence required to remove precisely the endpoint that was inspected. */
 export interface NotificationEndpointFileIdentity {
     dev: bigint;
@@ -54,6 +69,7 @@ export interface NotificationServiceDeps {
     fs?: NotificationServiceFs;
     now?: () => number;
     pidAlive?: (pid: number) => boolean;
+    pidIncarnation?: (pid: number) => string | undefined;
     fetchImpl?: typeof fetch;
     apiBase?: string;
     createDiscordDiagnostic?: (config: {
@@ -223,6 +239,9 @@ export interface NotificationRecoveryReport {
         action: DaemonRecoveryAction;
         detail: string;
         ownerId: string | undefined;
+        blockingReason?: string;
+        markerAgeMs?: number;
+        forceCommand?: string;
         pid: number | undefined;
     };
 }
@@ -230,6 +249,7 @@ export interface RecoveryOptions {
     settings: Settings;
     stateRoot?: string;
     deps?: NotificationServiceDeps;
+    forceDaemonLock?: boolean;
 }
 export interface DaemonTransitionLock {
     pid: number;
@@ -243,6 +263,9 @@ type TransitionMarkerFs = {
     writeFile?(file: string, data: string, opts?: WriteFileOptions): Promise<void>;
     readEndpointFile?(file: string): Promise<NotificationEndpointFile>;
     exactUnlink?(file: string, identity: NotificationEndpointFileIdentity): Promise<NotificationExactUnlinkResult>;
+    stat?(file: string): Promise<{
+        mtimeMs: number;
+    }>;
 };
 /** True only while the exact transition acquisition still occupies the marker path. */
 export declare function daemonTransitionLockIsHeld(input: {

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -53,10 +53,10 @@ export declare const NOTIFICATION_PROTOCOL_VERSION = 3;
  * ownership, settlement, and descendant cleanup authority. Generation 38 also
  * adds durable provider-intent admission without changing owner, reclaim,
  * signal, or spawn authority.
- * Generation 41 applies first-class provider-settings admission to Telegram
+ * Generation 42 applies first-class provider-settings admission to Telegram
  * lifecycle controls.
  */
-export declare const DAEMON_GENERATION = 41;
+export declare const DAEMON_GENERATION = 42;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 1 covers
  * all builds published before this field existed; epoch 2 covered generation 29;

package/dist/types/session/internal/managed-session-storage.d.ts

@@ -12,6 +12,14 @@ export declare class ManagedPublishError extends Error {
 }
 /** Cleanup is safe only when the native move reports that it did not commit. */
 export declare function mayCleanManagedTreeStaging(error: unknown): boolean;
+/**
+ * A filesystem that implements no `renameat2` rename flag at all rejects the no-replace publish
+ * before mutating anything: NFS answers `EINVAL` (`invalid_request`) and kernels older than 3.15
+ * answer `ENOSYS` (`atomic_unavailable`). Only those two pre-mutation outcomes authorize the
+ * `linkat` stand-in; every other failure describes a publish that was actually attempted, and
+ * retrying it under a different primitive could publish twice.
+ */
+export declare function renameFlagsUnsupported(outcome: NativePublishOutcome): boolean;
 export type ManagedSessionSecurityPolicy = "default" | "windows-existing-verify-first";
 export type ManagedStorageFailure = "migration_busy" | "binding_conflict" | "binding_invalid" | "destination_conflict" | "source_changed" | "unsafe_artifacts" | "artifact_capacity_exceeded" | "durability_failed" | "atomic_unavailable" | "durability_not_provable" | "migration_retired" | "managed_storage_unsupported";
 export interface ManagedStorageLock {

package/dist/types/session/internal/native-publish-outcome.d.ts

@@ -2,8 +2,8 @@ export type NativePublishMutationState = "not_committed" | "committed" | "unknow
 export type NativePublishDurabilityState = "not_attempted" | "proven" | "not_provable";
 export type NativePublishReason = "none" | "destination_exists" | "atomic_unavailable" | "cross_device" | "permission_denied" | "io_failure" | "interrupted" | "invalid_request" | "identity_violation" | "durability_not_provable" | "unknown";
 export type NativePublishOperation = "direct_rename" | "retained_file" | "retained_tree";
-export type NativePublishPrimitive = "renameat2_noreplace" | "renameatx_np_excl" | "windows_rename_noreplace" | "unsupported" | "unknown";
-export type NativePublishPhase = "preflight" | "file_sync" | "rename" | "source_parent_sync" | "destination_parent_sync" | "terminal_identity" | "complete" | "unknown";
+export type NativePublishPrimitive = "renameat2_noreplace" | "linkat_noreplace" | "mkdirat_renameat_noreplace" | "renameatx_np_excl" | "windows_rename_noreplace" | "unsupported" | "unknown";
+export type NativePublishPhase = "preflight" | "file_sync" | "rename" | "source_unlink" | "source_parent_sync" | "destination_parent_sync" | "terminal_identity" | "complete" | "unknown";
 type SyncFailure = {
     phase: Exclude<NativePublishPhase, "preflight" | "file_sync" | "rename" | "complete" | "unknown">;
     parentRole: "source" | "destination" | "shared" | "staged_file";

package/dist/types/system-prompt.d.ts

@@ -16,6 +16,14 @@ export interface LoadContextFilesOptions {
     /** Working directory to start walking up from. Default: getProjectDir() */
     cwd?: string;
 }
+export interface ProjectContextFilesResult {
+    contextFiles: Array<{
+        path: string;
+        content: string;
+        depth?: number;
+    }>;
+    warnings: string[];
+}
 /**
  * Load all context files using the capability API.
  * Returns {path, content, depth} entries for all discovered context files.
@@ -24,6 +32,8 @@ export interface LoadContextFilesOptions {
  * prominent. User-home files from foreign providers (`~/.claude/CLAUDE.md`,
  * `~/.codex/AGENTS.md`, …) stay excluded — only gjc's own user config applies.
  */
+export declare function loadProjectContextFilesResult(options?: LoadContextFilesOptions): Promise<ProjectContextFilesResult>;
+/** Load project context files without exposing discovery diagnostics. */
 export declare function loadProjectContextFiles(options?: LoadContextFilesOptions): Promise<Array<{
     path: string;
     content: string;
@@ -93,10 +103,11 @@ export interface BuildSystemPromptOptions {
      */
     subagent?: boolean;
 }
-/** Result of building provider-facing system prompt messages. */
 export interface BuildSystemPromptResult {
     /** Ordered system prompt blocks. Providers should preserve entries as distinct messages/blocks. */
     systemPrompt: string[];
+    /** Context-file discovery warnings visible to SDK and session callers. */
+    warnings: string[];
 }
 export interface BuildVolatileProjectContextOptions {
     cwd?: string;

package/dist/types/tools/composer-bash-policy.d.ts

@@ -1,14 +1,22 @@
-export declare const COMPOSER_BASH_POLICY_ERROR = "Composer bash policy blocked repository file I/O. Use find, search, read, and edit tools for file discovery, file inspection, and file mutation.";
+import { type ComposerBashPolicyToolSurface } from "@gajae-code/ai/providers/composer-discipline";
+export declare const COMPOSER_BASH_POLICY_ERROR: string;
+export declare const CURSOR_COMPOSER_BASH_POLICY_ERROR: string;
 type ComposerBashPolicyResult = {
     allowed: true;
 } | {
     allowed: false;
     reason: string;
     message: string;
+    surface: ComposerBashPolicyToolSurface;
 };
 export declare function isComposerBashPolicyModel(modelId: string | undefined): boolean;
+export declare function resolveComposerBashPolicyToolSurface(input: {
+    modelId?: string;
+    provider?: string;
+}): ComposerBashPolicyToolSurface;
 export declare function checkComposerBashPolicy(input: {
     modelId?: string;
+    provider?: string;
     commands: readonly string[];
 }): ComposerBashPolicyResult;
 export {};

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.12.8",
+	"version": "0.12.10",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -53,13 +53,13 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.12.8",
-		"@gajae-code/agent-core": "0.12.8",
-		"@gajae-code/ai": "0.12.8",
-		"@gajae-code/bridge-client": "0.12.8",
-		"@gajae-code/natives": "0.12.8",
-		"@gajae-code/tui": "0.12.8",
-		"@gajae-code/utils": "0.12.8",
+		"@gajae-code/stats": "0.12.10",
+		"@gajae-code/agent-core": "0.12.10",
+		"@gajae-code/ai": "0.12.10",
+		"@gajae-code/bridge-client": "0.12.10",
+		"@gajae-code/natives": "0.12.10",
+		"@gajae-code/tui": "0.12.10",
+		"@gajae-code/utils": "0.12.10",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/scripts/verify-gjc-sdk-canonicalization.ts

@@ -1531,13 +1531,26 @@ function exactTeamRuntimeSendKeysRanges(contents: string): ShellRange[] {
 		return [];
 
 	const continuationBody = contents.slice(continuationRange.start, continuationRange.end);
+	// The frozen argv may address the pane either through `worker.pane_id` directly or
+	// through a local binding that was proven non-empty first (the optional field does
+	// not narrow for the type checker). Either way both send operations must name the
+	// identical pane token, and a local token must come from a checked `worker.pane_id`.
 	const continuationArgs =
-		/const\s+args\s*=\s*Object\.freeze\(\s*\[\s*["']send-keys["']\s*,\s*["']-l["']\s*,\s*["']-t["']\s*,\s*worker\.pane_id\s*,\s*continuationPrompt\s*,\s*["'];["']\s*,\s*["']send-keys["']\s*,\s*["']-t["']\s*,\s*worker\.pane_id\s*,\s*["']Enter["']\s*,?\s*\]\s*\)\s*;/.exec(
+		/const\s+args(?:\s*:\s*readonly\s+string\[\])?\s*=\s*Object\.freeze\(\s*\[\s*["']send-keys["']\s*,\s*["']-l["']\s*,\s*["']-t["']\s*,\s*(worker\.pane_id|[A-Za-z_$][\w$]*)\s*,\s*continuationPrompt\s*,\s*["'];["']\s*,\s*["']send-keys["']\s*,\s*["']-t["']\s*,\s*(worker\.pane_id|[A-Za-z_$][\w$]*)\s*,\s*["']Enter["']\s*,?\s*\]\s*\)\s*;/.exec(
 			continuationBody,
 		);
+	const paneToken = continuationArgs?.[1];
+	const paneTokenIsProvenLocal =
+		paneToken !== undefined &&
+		paneToken !== "worker.pane_id" &&
+		new RegExp(`const\\s+${paneToken}\\s*=\\s*worker\\.pane_id\\s*;`).test(continuationBody) &&
+		new RegExp(`if\\s*\\(\\s*!${paneToken}\\s*\\)\\s*return\\b`).test(continuationBody);
 	if (
 		!continuationArgs ||
+		continuationArgs[1] !== continuationArgs[2] ||
+		!(paneToken === "worker.pane_id" || paneTokenIsProvenLocal) ||
 		!continuationBody.includes("const revalidationReason =") ||
+		!/if\s*\(\s*revalidationReason\s*\)\s*(?:\{\s*return\b[^}]*;?\s*\}|return\b[^;]*;)/.test(continuationBody) ||
 		!continuationBody.includes("await createJsonNoClobber(") ||
 		!continuationBody.includes('type: "literal-send"') ||
 		!continuationBody.includes('type: "key-send"') ||

package/src/cli/notify-cli.ts

@@ -69,6 +69,7 @@ export interface NotifyCommandArgs {
 	slackChannelId?: string;
 	slackAuthorizedUserId?: string;
 	redact?: boolean;
+	forceDaemonLock?: boolean;
 	probe?: boolean;
 	message?: string;
 }
@@ -193,7 +194,12 @@ export function parseNotifyArgs(args: string[]): NotifyCommandArgs | undefined {
 			message: typeof flags.get("--message") === "string" ? (flags.get("--message") as string) : undefined,
 		};
 	}
-	if (action === "recovery") return args.length === 2 ? { action, rawArgs: [] } : undefined;
+	if (action === "recovery") {
+		const flags = parseFlags(args.slice(2), new Set(), new Set(["--force-daemon-lock"]));
+		return flags
+			? { action, rawArgs: args.slice(2), forceDaemonLock: flags.get("--force-daemon-lock") === true }
+			: undefined;
+	}
 	if (action === "daemon-internal") {
 		return {
 			action,
@@ -224,7 +230,7 @@ export async function runNotifyCommand(cmd: NotifyCommandArgs, deps: NotifyComma
 			await runTest(deps, cmd);
 			return;
 		case "recovery":
-			await runRecovery(deps);
+			await runRecovery(deps, cmd.forceDaemonLock);
 			return;
 		case "daemon-internal":
 			if (cmd.smoke) {
@@ -716,9 +722,9 @@ async function runTest(deps: NotifyCommandDeps, cmd: NotifyCommandArgs): Promise
 	else if (!result.ok) process.exitCode = 1;
 }
 
-async function runRecovery(deps: NotifyCommandDeps): Promise<void> {
+async function runRecovery(deps: NotifyCommandDeps, forceDaemonLock = false): Promise<void> {
 	const settings = await getSettings(deps);
-	const report = await recoverNotifications({ settings });
+	const report = await recoverNotifications({ settings, forceDaemonLock });
 	process.stdout.write(`${formatNotificationRecoveryReport(report)}\n`);
 }
 
@@ -737,14 +743,14 @@ ${chalk.bold("Usage:")}
   ${APP_NAME} notify status
   ${APP_NAME} notify health [--provider telegram|discord|slack] [--probe]
   ${APP_NAME} notify test [--provider telegram|discord|slack] [--message <text>]
-  ${APP_NAME} notify recovery
+  ${APP_NAME} notify recovery [--force-daemon-lock]
 
 ${chalk.bold("Subcommands:")}
   setup     Pair Telegram or atomically save and activate complete Discord/Slack settings
   status    Show global master and provider configured/repair/desired/effective state without secrets
   health    Report selected provider state; --probe uses REST only and never opens Gateway/Socket Mode
   test      Send a one-off test through one selected or uniquely effective provider
-  recovery  Clear dead-owner daemon locks and stale per-session endpoint files (never touches a live owner)
+  recovery  Clear dead-owner daemon locks and stale per-session endpoint files (never touches a live owner); --force-daemon-lock retries only with the same fail-closed dead-owner proof
 
 ${chalk.bold("Examples:")}
   ${APP_NAME} notify setup

package/src/commands/sdk.ts

@@ -9,6 +9,7 @@ import { applyStartupModelProfiles, createSessionManager } from "../main";
 import { initializeExtensions } from "../modes/runtime-init";
 import { ACP_MCP_REQUEST_TIMEOUT_MS, ACP_MCP_STARTUP_HEADROOM_MS } from "../sdk/acp/mcp";
 import { Broker } from "../sdk/broker/broker";
+import { readBrokerDiscovery } from "../sdk/broker/discovery";
 import { completeBrokerProcess } from "../sdk/broker/internal";
 import {
 	type LifecycleTranscriptEvidence,
@@ -58,6 +59,54 @@ export async function lifecycleArgs(
 	};
 }
 
+/**
+ * How long a session host tolerates the complete absence of a live broker
+ * publication before treating itself as orphaned. Hosts intentionally survive
+ * broker restarts (a replacement broker republishes discovery within seconds),
+ * so this must comfortably exceed a restart window while still bounding the
+ * lifetime of hosts whose broker is gone for good — otherwise every crashed or
+ * torn-down broker leaks a detached multi-hundred-megabyte host forever.
+ */
+export const SESSION_HOST_BROKER_ABSENCE_GRACE_MS = 10 * 60_000;
+const SESSION_HOST_BROKER_POLL_MS = 15_000;
+
+/**
+ * Resolves only once no live broker publication has been observable in
+ * `agentDir` for the full grace window. A reappearing broker (including a
+ * replacement with a different pid) resets the window; an unreadable
+ * publication is not proof of orphanhood but accrues against the same bound.
+ */
+export async function watchSessionHostBrokerLiveness(deps: {
+	agentDir: string;
+	now?: () => number;
+	sleep?: (ms: number) => Promise<void>;
+	readDiscovery?: (agentDir: string) => Promise<unknown>;
+	graceMs?: number;
+	pollMs?: number;
+}): Promise<void> {
+	const now = deps.now ?? Date.now;
+	const sleep = deps.sleep ?? (async ms => await Bun.sleep(ms));
+	const readDiscovery = deps.readDiscovery ?? readBrokerDiscovery;
+	const graceMs = deps.graceMs ?? SESSION_HOST_BROKER_ABSENCE_GRACE_MS;
+	const pollMs = deps.pollMs ?? SESSION_HOST_BROKER_POLL_MS;
+	let absentSince: number | null = null;
+	for (;;) {
+		let live: unknown = null;
+		try {
+			live = await readDiscovery(deps.agentDir);
+		} catch {
+			// Transient read failures are ambiguity, not proof of orphanhood.
+		}
+		if (live) {
+			absentSince = null;
+		} else {
+			absentSince ??= now();
+			if (now() - absentSince >= graceMs) return;
+		}
+		await sleep(pollMs);
+	}
+}
+
 type LifecycleTranscriptSource = {
 	cwd: string;
 	path: string;
@@ -505,6 +554,11 @@ export async function runSessionHost(
 	}
 	process.once("SIGTERM", stop);
 	process.once("SIGINT", stop);
+	// A detached host whose broker is gone for good would otherwise live (and
+	// hold its session's memory) forever; reap it through the same graceful
+	// teardown a SIGTERM would take once the bounded absence grace elapses.
+	await watchSessionHostBrokerLiveness({ agentDir });
+	stop();
 	await new Promise<void>(() => {});
 }
 

package/src/config/model-profiles.ts

@@ -291,6 +291,13 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		architect: "alibaba-token-plan/qwen3.8-max-preview:xhigh",
 		critic: "alibaba-token-plan/glm-5.2:high",
 	}),
+	profile("alibaba-token-plan-pro", ["alibaba-token-plan"], {
+		default: "alibaba-token-plan/qwen3.8-max-preview:medium",
+		executor: "alibaba-token-plan/deepseek-v4-flash-0731:max",
+		planner: "alibaba-token-plan/glm-5.2:high",
+		architect: "alibaba-token-plan/qwen3.8-max-preview:xhigh",
+		critic: "alibaba-token-plan/glm-5.2:xhigh",
+	}),
 	profile("alibaba-token-plan-qwenmaxxing", ["alibaba-token-plan"], {
 		default: "alibaba-token-plan/qwen3.8-max-preview:medium",
 		executor: "alibaba-token-plan/qwen3.8-max-preview:low",
@@ -361,6 +368,7 @@ const PROFILE_PRESENTATION: Record<string, ModelProfilePresentation> = {
 	"minimax-medium": { displayName: "MiniMax Medium", providerGroup: "MINIMAX" },
 	"minimax-pro": { displayName: "MiniMax Pro", providerGroup: "MINIMAX" },
 	"alibaba-token-plan-balanced": { displayName: "Balanced", providerGroup: "ALIBABA TOKEN PLAN" },
+	"alibaba-token-plan-pro": { displayName: "Pro", providerGroup: "ALIBABA TOKEN PLAN" },
 	"alibaba-token-plan-qwenmaxxing": { displayName: "QwenMaxxing", providerGroup: "ALIBABA TOKEN PLAN" },
 	"opus-codex": { displayName: "Opus + Codex", providerGroup: "COMBOS" },
 	"codex-opencodego": { displayName: "Codex + OpenCodeGo", providerGroup: "COMBOS" },

package/src/config/model-registry.ts

@@ -331,7 +331,10 @@ function validateProviderConfiguration(
 			throw new Error(
 				mode === "runtime-register"
 					? `Provider ${providerName}: "apiKey" or "oauth" is required when defining models.`
-					: `Provider ${providerName}: "apiKey" or "apiKeyEnv" is required when defining custom models unless auth is "none".`,
+					: `Provider ${providerName}: custom models need a credential source, but none is configured. ` +
+							`"auth" only selects the scheme ("auth: apiKey" does not supply a key). ` +
+							`Fix by adding "apiKeyEnv: <ENV_VAR>" (recommended) or "apiKey: <literal-key>", ` +
+							`or set "auth: none" if the endpoint is genuinely unauthenticated.`,
 			);
 		}
 	}