@gajae-code/coding-agent 0.12.8 → 0.12.11

package/CHANGELOG.md

@@ -2,10 +2,41 @@
 
 ## [Unreleased]
 
+## [0.12.11] - 2026-08-03
+
+### Fixed
+
+- Side-effecting native macOS computer input now restores the global cursor after releasing held input on success, cancellation, supervisor rejection, and action failure. Batches containing input execute in one serialized native capture-to-restore transaction, while screenshot/wait-only operations remain cursor-neutral; capture/restore failures are reported distinctly without masking the primary action error, and global focus behavior remains unchanged (#3642, #3781).
+- Managed session rewrites and authority-absent Darwin appends now use native identity-verified atomic replacement instead of deterministically failing with `managed_replace_exact_unavailable` or risking a torn JSONL tail; uncertain readable outcomes are re-fsynced and carried through ctime-bound strict adoption before recovery reports them durable. This unblocks Darwin compaction and session append durability when retained native authority is absent (#3742, #3760).
+- `todo_write` recovery reminders now distinguish rejected payloads from runtime aborts, preserve the available cause, and require durable state reconciliation instead of incorrectly telling the agent to change a valid payload (#3743, #3760).
+- Authority-absent Darwin `appendSync` regression coverage now exercises the replace-based race window (destination mutation during successor staging) instead of the retired in-place `O_APPEND` open path, and documents that ctime-only destination transitions are tolerated by exact replacement.
+
+## [0.12.10] - 2026-08-03
+
+### Added
+
+- `/login anthropic --manual` pairs by pasting the authorization code Anthropic shows in the browser instead of waiting on a `localhost:54545` callback the browser cannot reach. Complete it with `/login <code>`. Use it when gjc runs over SSH, in a container, or on a headless host; the default `/login anthropic` still uses the loopback callback. The flag is resolved before the paste fallback, so it is never mistaken for an authorization code, and providers without a paste-a-code redirect reject it explicitly instead of silently falling back.
+
+### Fixed
+
+- Composer Bash policy rejections now identify the active provider surface and direct Cursor Composer models to their native repository tools, enabling the agent runtime's bounded automatic recovery instead of leaving a blocked shell attempt as a terminal turn.
+- The `AgentSession retry fallback > invalidates an auth-failed managed credential` test now uses a stored credential instead of a runtime-key override, matching the pin-guard behavior added in #3724 where `--api-key`/`--credential` pinned keys are never invalidated; the shared test fixture installed runtime keys as plumbing, which silently tripped the new guard and blocked the auth invalidation path.
+- The Extension Control Center inspector no longer crashes when a narrow two-column layout leaves its preview pane fewer than two columns wide.
+- Prompt-template positional arguments now preserve literal `$@` and `$ARGUMENTS` text instead of recursively expanding it during placeholder substitution.
+- Native Windows session and GC commands now report the searched `psmux` / `pmux` / `tmux` provider set when no compatible multiplexer is available instead of leaking a literal `tmux` spawn error (#3688).
+- Managed-session recovery now preserves committed mutation state and the actual Linux fallback primitive in native publish receipts, preventing unsafe retry classification after a post-link staging unlink failure (#3746).
+- The system prompt now requires non-ASCII tool-input text to be written as literal UTF-8 rather than hand-spelled `\uXXXX` escapes, including JSON serialized into a string field, while leaving escapes that are intended source syntax alone. Models that hand-spell hex codepoints for CJK mis-type them, and each mis-typed escape decodes to a valid-but-wrong syllable, so Korean text in tool parameters silently arrives corrupted (anthropics/claude-code#83033).
+- The `models.yml` validation error for a custom provider without a credential source now explains that `auth` selects only the auth scheme and lists the three corrective forms (`apiKeyEnv`, literal `apiKey`, or `auth: none`) instead of restating the rule that was already misread. `docs/models.md` documents the same contract in a table (#3738).
+- Credential rotation no longer mutates a pinned credential, and no longer reports a rotation that did not happen. `#markFailedCredential` now applies its pin guard first and for every trigger class, consulting both the `--api-key` runtime override and the `--credential` runtime selector — previously the guard existed only on the quota path and checked only the API-key override, so a `--credential` pin could be rotated away from and the `auth` path could invalidate a pinned credential outright. Both paths now also require the re-resolved credential to actually differ before reporting a rotation: `invalidateCredentialMatching` reports that a row was matched and blocked, which is not the same as the session having moved to a different credential, and with a single-row pool it was true while nothing rotated. A terminal `forbidden` failure is now excluded from retry admission and makes no credential-state change at all. Finally, a rotation is only converted into a same-model retry when the fallback controller could actually be rewound; `restorePreviousEntryForRetry()` refuses once an entry's restore budget is spent, and ignoring that refusal left `activeIndex` on the next entry while the session still requested the previous model.
+- Dead-owner notification recovery now preserves a machine-readable transition block, marker-age diagnostics, and safe force-recovery guidance without weakening ownership proofs (#3762).
+- Detached SDK session hosts no longer outlive the broker that spawned them. A host whose broker died without teardown (crash, `SIGKILL`, restart without `--close-session-hosts`) previously stayed resident forever, holding its session's memory — hundreds of MB per orphan. Each host now polls the broker discovery publication and, after a bounded grace period with no live broker, disposes itself through the same graceful teardown a `SIGTERM` takes. A replacement broker resets the window, so hosts still survive ordinary broker restarts, and a transient discovery read failure is treated as ambiguity rather than proof of orphanhood.
+- Syntax highlighting now recognizes special filenames such as `CMakeLists.txt`, `Dockerfile.*`, `Makefile`, and `.env.*` before generic filename extensions.
+
 ## [0.12.8] - 2026-08-02
 ### Added
 
 - Added the paginated public SDK query `providers.list/active` (Q29), returning deterministic, deduplicated `{ provider, connectionKind }` descriptors for locally eligible providers without exposing credentials or performing remote health probes.
+- Added the opt-in Alibaba Token Plan Pro profile with `deepseek-v4-flash-0731:max` for execution and `glm-5.2:xhigh` for independent criticism, preserving the existing Balanced profile unchanged.
 
 ### Added
 
@@ -13,10 +44,14 @@
 
 ### Fixed
 
+- Windows automatic tmux resolution now selects `psmux` then `pmux` by canonical command order without rejecting distinct lower-priority aliases; it probes `tmux` only when neither named provider is available (#3725).
+- CI failure extraction now aggregates Bun failure and suite-error summaries across every test invocation in a job log instead of silently using only the first summary.
 - Ordinary `ask` selectors now bound long question premises and page through every premise row without skipping rows hidden by overflow indicators (#3675).
 - First-event timeout retries now require a typed, content-free failure from the current clean attempt scope, preventing prior or stale extension activity from suppressing or admitting a later request (#3553).
 - The issue-1979 Korean prose wrap test now cleans up inherited multiplexer env vars (`TMUX`, `TMUX_PANE`, etc.) so it deterministically exercises the plain-terminal render path regardless of the CI runner's terminal session (#1979).
 - The model selector's assignment menu now shows the model each role currently resolves to (`Set as EXECUTOR (Executor) — now: anthropic/claude-haiku-4-5`), distinguishing an unset default, a role that inherits the default, and a configured-but-unresolvable selector. Previously the role rows were unlabeled, so the only way to learn a role's model was to scan the whole 800+ entry model list for role badges.
+- Standalone `AGENTS.md` ancestor discovery now bounds directory traversal, per-file reads, and aggregate instruction bytes while surfacing content-free omission warnings (#3722).
+
 ## [0.12.7] - 2026-07-31
 
 ## [0.12.6] - 2026-07-31
@@ -26,6 +61,7 @@
 
 ### Fixed
 
+- Managed session publication now works on filesystems that implement no `renameat2` rename flags at all. NFS rejects both `RENAME_NOREPLACE` and `RENAME_EXCHANGE` with `EINVAL`, so publishing a migration receipt failed the whole resume with `Could not open managed session: invalid_request`. The no-replace publish now falls back to `linkat(2)`, which fails with `EEXIST` on an occupied destination and therefore carries the identical no-overwrite guarantee; the fallback is authorized only by a pre-mutation missing-primitive outcome, so a publish that may have committed is never retried under a second primitive. The staged descriptor is retained across publication and the staging link is removed only after it is released, because unlinking a still-open name on NFS silly-renames it and would leave a second link on the published inode.
 - Settings now requests a repaint after asynchronous GJC bundle and plugin views rebuild, so loaded content and mutation results appear without an extra keypress (#3643).
 - `todo_write` now rejects unsupported operation keys and treats a bare `done` or `drop` as an error instead of completing or abandoning every task (#3640).
 - Deferred `agent_end` publication again settles public session readiness before slow extension handlers finish, while retaining exact cancellation leases through queued extension delivery and draining that delivery before session shutdown.

package/dist/types/cli/notify-cli.d.ts

@@ -21,6 +21,7 @@ export interface NotifyCommandArgs {
     slackChannelId?: string;
     slackAuthorizedUserId?: string;
     redact?: boolean;
+    forceDaemonLock?: boolean;
     probe?: boolean;
     message?: string;
 }

package/dist/types/commands/sdk.d.ts

@@ -3,6 +3,29 @@ import type { Args as ParsedArgs } from "../cli/args";
 import { type SessionLifecycleLaunchRequest } from "../sdk/broker/lifecycle";
 import { SessionManager } from "../session/session-manager";
 export declare function lifecycleArgs(request: SessionLifecycleLaunchRequest, cwd: string, agentDir: string): Promise<ParsedArgs>;
+/**
+ * How long a session host tolerates the complete absence of a live broker
+ * publication before treating itself as orphaned. Hosts intentionally survive
+ * broker restarts (a replacement broker republishes discovery within seconds),
+ * so this must comfortably exceed a restart window while still bounding the
+ * lifetime of hosts whose broker is gone for good — otherwise every crashed or
+ * torn-down broker leaks a detached multi-hundred-megabyte host forever.
+ */
+export declare const SESSION_HOST_BROKER_ABSENCE_GRACE_MS: number;
+/**
+ * Resolves only once no live broker publication has been observable in
+ * `agentDir` for the full grace window. A reappearing broker (including a
+ * replacement with a different pid) resets the window; an unreadable
+ * publication is not proof of orphanhood but accrues against the same bound.
+ */
+export declare function watchSessionHostBrokerLiveness(deps: {
+    agentDir: string;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+    readDiscovery?: (agentDir: string) => Promise<unknown>;
+    graceMs?: number;
+    pollMs?: number;
+}): Promise<void>;
 /** Opens lifecycle-authorized history without letting replacement content reach readiness. */
 export declare function openLifecycleSessionManager(request: SessionLifecycleLaunchRequest, cwd: string, agentDir: string): Promise<{
     parsed: ParsedArgs;

package/dist/types/discovery/agents-md.d.ts

@@ -1 +1,11 @@
-export {};
+import { type ContextFile } from "../capability/context-file";
+import type { LoadContext, LoadResult } from "../capability/types";
+export type AgentsMdReader = (filePath: string, maxBytes: number) => Promise<{
+    content: string | null;
+    byteLength: number;
+    tooLarge: boolean;
+}>;
+/**
+ * Load standalone AGENTS.md files.
+ */
+export declare function loadAgentsMd(ctx: LoadContext, readCandidate?: AgentsMdReader): Promise<LoadResult<ContextFile>>;

package/dist/types/modes/types.d.ts

@@ -374,5 +374,11 @@ export interface OAuthSelectorOptions {
     allowExternalCredentialDiscovery?: boolean;
     trigger?: "bare-login";
     externalCredentialDiscover?: CredentialAutoImportOptions["discover"];
+    /**
+     * Pair by pasting the code the provider displays instead of waiting on the
+     * loopback callback. Set by `/login <provider> --manual` for browsers that
+     * cannot reach this machine.
+     */
+    manualCode?: boolean;
 }
 export {};

package/dist/types/sdk/bus/chat-daemon-control.d.ts

@@ -30,7 +30,9 @@ export type ChatDaemonAction = "stop" | "reload";
  * semantics; discord generation 23 / slack generation 22 hardens exact Bash
  * process-tree ownership shared by chat daemon cleanup.
  * Discord generation 24 / slack generation 23 apply provider-completeness and
- * effective-enable admission to chat daemon lifecycle controls.
+ * effective-enable admission to chat daemon lifecycle controls. Discord
+ * generation 25 / slack generation 24 apply identity-bound exact replacement
+ * cleanup shared by managed-session and daemon filesystem authority.
  */
 export declare const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>>;
 export declare function chatDaemonGeneration(kind: ChatDaemonKind): number;

package/dist/types/sdk/bus/daemon-paths.d.ts

@@ -13,6 +13,7 @@ export interface DaemonPaths {
     ownership: string;
     roots: string;
     steal: string;
+    diagnostic: string;
     aliases: string;
     seenUpdates: string;
 }

package/dist/types/sdk/bus/notification-service.d.ts

@@ -9,6 +9,21 @@ import type { SlackDiagnosticProvider } from "./slack-provider";
  * can never leak a credential regardless of where the string originated.
  */
 export declare function sanitizeDiagnostic(text: string, token?: string): string;
+export interface NotificationDiagnosticEvent {
+    timestamp: string;
+    operation: string;
+    phase: string;
+    outcome: string;
+    reason: string;
+    pid?: number;
+    incarnation?: string;
+    ageMs?: number;
+    detail?: string;
+}
+/** Append a bounded, private, secret-safe daemon diagnostic event. */
+export declare function writeNotificationDiagnostic(settings: Pick<Settings, "getAgentDir">, event: Omit<NotificationDiagnosticEvent, "timestamp"> & {
+    timestamp?: string;
+}): Promise<void>;
 /** Identity evidence required to remove precisely the endpoint that was inspected. */
 export interface NotificationEndpointFileIdentity {
     dev: bigint;
@@ -54,6 +69,7 @@ export interface NotificationServiceDeps {
     fs?: NotificationServiceFs;
     now?: () => number;
     pidAlive?: (pid: number) => boolean;
+    pidIncarnation?: (pid: number) => string | undefined;
     fetchImpl?: typeof fetch;
     apiBase?: string;
     createDiscordDiagnostic?: (config: {
@@ -223,6 +239,9 @@ export interface NotificationRecoveryReport {
         action: DaemonRecoveryAction;
         detail: string;
         ownerId: string | undefined;
+        blockingReason?: string;
+        markerAgeMs?: number;
+        forceCommand?: string;
         pid: number | undefined;
     };
 }
@@ -230,6 +249,7 @@ export interface RecoveryOptions {
     settings: Settings;
     stateRoot?: string;
     deps?: NotificationServiceDeps;
+    forceDaemonLock?: boolean;
 }
 export interface DaemonTransitionLock {
     pid: number;
@@ -243,6 +263,9 @@ type TransitionMarkerFs = {
     writeFile?(file: string, data: string, opts?: WriteFileOptions): Promise<void>;
     readEndpointFile?(file: string): Promise<NotificationEndpointFile>;
     exactUnlink?(file: string, identity: NotificationEndpointFileIdentity): Promise<NotificationExactUnlinkResult>;
+    stat?(file: string): Promise<{
+        mtimeMs: number;
+    }>;
 };
 /** True only while the exact transition acquisition still occupies the marker path. */
 export declare function daemonTransitionLockIsHeld(input: {

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -53,10 +53,11 @@ export declare const NOTIFICATION_PROTOCOL_VERSION = 3;
  * ownership, settlement, and descendant cleanup authority. Generation 38 also
  * adds durable provider-intent admission without changing owner, reclaim,
  * signal, or spawn authority.
- * Generation 41 applies first-class provider-settings admission to Telegram
- * lifecycle controls.
+ * Generation 42 applies first-class provider-settings admission to Telegram
+ * lifecycle controls. Generation 43 applies identity-bound exact replacement
+ * cleanup shared by managed-session and daemon filesystem authority.
  */
-export declare const DAEMON_GENERATION = 41;
+export declare const DAEMON_GENERATION = 43;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 1 covers
  * all builds published before this field existed; epoch 2 covered generation 29;

package/dist/types/session/internal/managed-session-storage.d.ts

@@ -1,4 +1,4 @@
-import { type NativeDirectoryTreeSnapshot, type NativeOwnerOnlySecurityResult, type RecoveryFsRoot } from "@gajae-code/natives";
+import { type NativeDirectoryTreeSnapshot, type NativeExactUnlinkResult, type NativeOwnerOnlySecurityResult, type RecoveryFsRoot } from "@gajae-code/natives";
 import { type NativePublishOutcome } from "./native-publish-outcome";
 export declare const MANAGED_ARTIFACT_MAX_DEPTH = 32;
 export declare const MANAGED_ARTIFACT_MAX_FILES = 50000;
@@ -10,8 +10,26 @@ export declare class ManagedPublishError extends Error {
     readonly diagnostic: string;
     constructor(classification: ManagedPublishError["classification"], outcome: NativePublishOutcome);
 }
+export declare class ManagedReplaceError extends Error {
+    readonly code: string;
+    readonly cleanupReceiptPath: string;
+    readonly detachedPath: string | undefined;
+    readonly retainedSuccessorPath: string | undefined;
+    readonly retainedPlaceholderPath: string | undefined;
+    readonly retainedUnknownPath: string | undefined;
+    readonly replacementCause: unknown;
+    constructor(result: NativeExactUnlinkResult, cleanupReceiptPath: string, replacementCause?: unknown);
+}
 /** Cleanup is safe only when the native move reports that it did not commit. */
 export declare function mayCleanManagedTreeStaging(error: unknown): boolean;
+/**
+ * A filesystem that implements no `renameat2` rename flag at all rejects the no-replace publish
+ * before mutating anything: NFS answers `EINVAL` (`invalid_request`) and kernels older than 3.15
+ * answer `ENOSYS` (`atomic_unavailable`). Only those two pre-mutation outcomes authorize the
+ * `linkat` stand-in; every other failure describes a publish that was actually attempted, and
+ * retrying it under a different primitive could publish twice.
+ */
+export declare function renameFlagsUnsupported(outcome: NativePublishOutcome): boolean;
 export type ManagedSessionSecurityPolicy = "default" | "windows-existing-verify-first";
 export type ManagedStorageFailure = "migration_busy" | "binding_conflict" | "binding_invalid" | "destination_conflict" | "source_changed" | "unsafe_artifacts" | "artifact_capacity_exceeded" | "durability_failed" | "atomic_unavailable" | "durability_not_provable" | "migration_retired" | "managed_storage_unsupported";
 export interface ManagedStorageLock {
@@ -114,7 +132,7 @@ export declare function captureManagedFilePrefixNoFollow(pathname: string, maxBy
 export declare function captureManagedFileNoFollow(pathname: string): ManagedFileSnapshot;
 /** Atomically publishes bytes without replacing an existing destination. */
 export declare function publishManagedFileNoReplace(destination: string, bytes: Uint8Array, assertOwned?: () => void, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): Promise<void>;
-export declare function publishManagedFileNoReplaceSync(destination: string, bytes: Uint8Array, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): void;
+export declare function publishManagedFileNoReplaceSync(destination: string, bytes: Uint8Array, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): ManagedFileSnapshot["identity"];
 /** Replace one managed regular file while retaining the secured staging fd through publication. */
 export declare function replaceManagedFileSync(destination: string, bytes: Uint8Array, root: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy, assertFence?: () => void, expectedDestination?: ManagedFileSnapshot["identity"]): void;
 export declare function replaceManagedFile(destination: string, bytes: Uint8Array, root: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): Promise<void>;

package/dist/types/session/internal/native-publish-outcome.d.ts

@@ -2,8 +2,8 @@ export type NativePublishMutationState = "not_committed" | "committed" | "unknow
 export type NativePublishDurabilityState = "not_attempted" | "proven" | "not_provable";
 export type NativePublishReason = "none" | "destination_exists" | "atomic_unavailable" | "cross_device" | "permission_denied" | "io_failure" | "interrupted" | "invalid_request" | "identity_violation" | "durability_not_provable" | "unknown";
 export type NativePublishOperation = "direct_rename" | "retained_file" | "retained_tree";
-export type NativePublishPrimitive = "renameat2_noreplace" | "renameatx_np_excl" | "windows_rename_noreplace" | "unsupported" | "unknown";
-export type NativePublishPhase = "preflight" | "file_sync" | "rename" | "source_parent_sync" | "destination_parent_sync" | "terminal_identity" | "complete" | "unknown";
+export type NativePublishPrimitive = "renameat2_noreplace" | "linkat_noreplace" | "mkdirat_renameat_noreplace" | "renameatx_np_excl" | "windows_rename_noreplace" | "unsupported" | "unknown";
+export type NativePublishPhase = "preflight" | "file_sync" | "rename" | "source_unlink" | "source_parent_sync" | "destination_parent_sync" | "terminal_identity" | "complete" | "unknown";
 type SyncFailure = {
     phase: Exclude<NativePublishPhase, "preflight" | "file_sync" | "rename" | "complete" | "unknown">;
     parentRole: "source" | "destination" | "shared" | "staged_file";

package/dist/types/session/session-manager.d.ts

@@ -333,6 +333,7 @@ export interface ResumeSessionIdentity {
     size: number;
     mtimeMs: number;
     mtimeNs: bigint;
+    ctimeNs?: bigint;
     sha256: string;
 }
 export interface ResumeTailResumable {
@@ -348,6 +349,13 @@ export interface ResumeTailError {
     reason: "missing" | "malformed" | "unstable" | "read-failed" | "legacy_migration_disabled";
 }
 export type SessionDirectoryMigrationPolicy = ManagedMigrationPolicy;
+export type SessionAppendPersistenceFailurePhase = "current_append" | "prior_failure";
+export declare class SessionAppendPersistenceError extends Error {
+    readonly phase: SessionAppendPersistenceFailurePhase;
+    readonly entryId: string;
+    readonly persistenceError: Error;
+    constructor(phase: SessionAppendPersistenceFailurePhase, entryId: string, persistenceError: Error);
+}
 export declare class SessionManagedStorageError extends Error {
     readonly code = "managed_storage_unsupported";
     constructor();
@@ -838,6 +846,15 @@ export declare class SessionManager {
     applyEntryMessageUpdates(entries: readonly SessionMessageEntry[]): void;
     /** Write mutated custom-message entries back into the canonical entry store by id. */
     applyCustomMessageEntryUpdates(entries: readonly CustomMessageEntry[]): void;
+    /**
+     * Rehydrate the canonical transcript after a synchronous persistence failure.
+     *
+     * The failed append may have committed before reporting an uncertain outcome,
+     * so callers must not clear the sticky error or retry against the resident
+     * branch. Reloading the exact session file is the only supported recovery
+     * boundary for both managed and explicit persistent destinations.
+     */
+    recoverPersistenceFailure(): Promise<void>;
     /**
      * Rewrite the session file after in-place entry updates.
      * Use sparingly (e.g., pruning old tool outputs).

package/dist/types/session/session-storage.d.ts

@@ -7,6 +7,7 @@ export interface SessionStorageStat {
     size: number;
     mtimeMs: number;
     mtimeNs: bigint;
+    ctimeNs: bigint;
     mtime: Date;
     isFile: boolean;
 }

package/dist/types/system-prompt.d.ts

@@ -16,6 +16,14 @@ export interface LoadContextFilesOptions {
     /** Working directory to start walking up from. Default: getProjectDir() */
     cwd?: string;
 }
+export interface ProjectContextFilesResult {
+    contextFiles: Array<{
+        path: string;
+        content: string;
+        depth?: number;
+    }>;
+    warnings: string[];
+}
 /**
  * Load all context files using the capability API.
  * Returns {path, content, depth} entries for all discovered context files.
@@ -24,6 +32,8 @@ export interface LoadContextFilesOptions {
  * prominent. User-home files from foreign providers (`~/.claude/CLAUDE.md`,
  * `~/.codex/AGENTS.md`, …) stay excluded — only gjc's own user config applies.
  */
+export declare function loadProjectContextFilesResult(options?: LoadContextFilesOptions): Promise<ProjectContextFilesResult>;
+/** Load project context files without exposing discovery diagnostics. */
 export declare function loadProjectContextFiles(options?: LoadContextFilesOptions): Promise<Array<{
     path: string;
     content: string;
@@ -93,10 +103,11 @@ export interface BuildSystemPromptOptions {
      */
     subagent?: boolean;
 }
-/** Result of building provider-facing system prompt messages. */
 export interface BuildSystemPromptResult {
     /** Ordered system prompt blocks. Providers should preserve entries as distinct messages/blocks. */
     systemPrompt: string[];
+    /** Context-file discovery warnings visible to SDK and session callers. */
+    warnings: string[];
 }
 export interface BuildVolatileProjectContextOptions {
     cwd?: string;

package/dist/types/tools/composer-bash-policy.d.ts

@@ -1,14 +1,22 @@
-export declare const COMPOSER_BASH_POLICY_ERROR = "Composer bash policy blocked repository file I/O. Use find, search, read, and edit tools for file discovery, file inspection, and file mutation.";
+import { type ComposerBashPolicyToolSurface } from "@gajae-code/ai/providers/composer-discipline";
+export declare const COMPOSER_BASH_POLICY_ERROR: string;
+export declare const CURSOR_COMPOSER_BASH_POLICY_ERROR: string;
 type ComposerBashPolicyResult = {
     allowed: true;
 } | {
     allowed: false;
     reason: string;
     message: string;
+    surface: ComposerBashPolicyToolSurface;
 };
 export declare function isComposerBashPolicyModel(modelId: string | undefined): boolean;
+export declare function resolveComposerBashPolicyToolSurface(input: {
+    modelId?: string;
+    provider?: string;
+}): ComposerBashPolicyToolSurface;
 export declare function checkComposerBashPolicy(input: {
     modelId?: string;
+    provider?: string;
     commands: readonly string[];
 }): ComposerBashPolicyResult;
 export {};

package/dist/types/tools/computer.d.ts

@@ -239,7 +239,7 @@ export interface ComputerScreenshotDetails {
     originX?: number;
     originY?: number;
     displayEpoch?: number;
-    captureId?: string;
+    captureId?: number;
     pngBytes?: number;
     path?: string;
 }
@@ -258,11 +258,44 @@ export interface ComputerToolDetails {
     keys?: string[];
     ms?: number;
     screenshot?: ComputerScreenshotDetails;
+    primaryError?: {
+        code: string;
+        message: string;
+    };
     supervisor?: string;
     steps?: ComputerToolDetails[];
     meta?: OutputMeta;
 }
+type NativeBatchAction = {
+    action: "screenshot" | "click" | "double_click" | "move" | "drag" | "scroll" | "type" | "keypress" | "wait";
+    x?: number;
+    y?: number;
+    toX?: number;
+    toY?: number;
+    scrollX?: number;
+    scrollY?: number;
+    button?: string;
+    text?: string;
+    keys?: string[];
+    ms?: number;
+    timeoutMs?: number;
+    timeoutGroup?: number;
+};
+type NativeBatchStepResult = {
+    index: number;
+    action: string;
+    screenshot?: NativeScreenshot;
+};
+type NativeBatchResult = {
+    results: NativeBatchStepResult[];
+    failureCode?: string;
+    failureIndex?: number;
+    failureMessage?: string;
+    primaryFailureCode?: string;
+    primaryFailureMessage?: string;
+};
 type NativeController = {
+    executeBatch?: (expectedEpoch: number | undefined, actions: NativeBatchAction[], timeoutMs?: number, signal?: AbortSignal) => Promise<NativeBatchResult> | NativeBatchResult;
     screenshot?: () => Promise<NativeScreenshot> | NativeScreenshot;
     click?: (expectedEpoch: number | undefined, x: number, y: number, button?: string) => void;
     doubleClick?: (expectedEpoch: number | undefined, x: number, y: number, button?: string) => void;
@@ -282,7 +315,7 @@ type NativeScreenshot = {
     originX?: number;
     originY?: number;
     displayEpoch?: number;
-    captureId?: string;
+    captureId?: number;
 };
 export type ComputerControllerFactory = () => NativeController;
 export declare const COMPUTER_DISABLED_CODE = "COMPUTER_DISABLED";

package/dist/types/tools/todo-write.d.ts

@@ -25,6 +25,7 @@ export interface TodoPhase {
 export interface TodoWriteToolDetails {
     phases: TodoPhase[];
     storage: "session" | "memory";
+    failureKind?: "payload_rejected" | "persistence";
 }
 declare function validateRawTodoArguments(arguments_: Record<string, unknown>): RawArgumentValidationResult;
 declare const todoWriteSchema: z.ZodObject<{
@@ -117,6 +118,7 @@ export declare const todoWriteToolRenderer: {
             text?: string;
         }>;
         details?: TodoWriteToolDetails;
+        isError?: boolean;
     }, options: RenderResultOptions, uiTheme: Theme, _args?: TodoWriteRenderArgs): Component;
     mergeCallAndResult: boolean;
 };

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.12.8",
+	"version": "0.12.11",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -53,13 +53,13 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.12.8",
-		"@gajae-code/agent-core": "0.12.8",
-		"@gajae-code/ai": "0.12.8",
-		"@gajae-code/bridge-client": "0.12.8",
-		"@gajae-code/natives": "0.12.8",
-		"@gajae-code/tui": "0.12.8",
-		"@gajae-code/utils": "0.12.8",
+		"@gajae-code/stats": "0.12.11",
+		"@gajae-code/agent-core": "0.12.11",
+		"@gajae-code/ai": "0.12.11",
+		"@gajae-code/bridge-client": "0.12.11",
+		"@gajae-code/natives": "0.12.11",
+		"@gajae-code/tui": "0.12.11",
+		"@gajae-code/utils": "0.12.11",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/scripts/verify-gjc-sdk-canonicalization.ts

@@ -1531,13 +1531,26 @@ function exactTeamRuntimeSendKeysRanges(contents: string): ShellRange[] {
 		return [];
 
 	const continuationBody = contents.slice(continuationRange.start, continuationRange.end);
+	// The frozen argv may address the pane either through `worker.pane_id` directly or
+	// through a local binding that was proven non-empty first (the optional field does
+	// not narrow for the type checker). Either way both send operations must name the
+	// identical pane token, and a local token must come from a checked `worker.pane_id`.
 	const continuationArgs =
-		/const\s+args\s*=\s*Object\.freeze\(\s*\[\s*["']send-keys["']\s*,\s*["']-l["']\s*,\s*["']-t["']\s*,\s*worker\.pane_id\s*,\s*continuationPrompt\s*,\s*["'];["']\s*,\s*["']send-keys["']\s*,\s*["']-t["']\s*,\s*worker\.pane_id\s*,\s*["']Enter["']\s*,?\s*\]\s*\)\s*;/.exec(
+		/const\s+args(?:\s*:\s*readonly\s+string\[\])?\s*=\s*Object\.freeze\(\s*\[\s*["']send-keys["']\s*,\s*["']-l["']\s*,\s*["']-t["']\s*,\s*(worker\.pane_id|[A-Za-z_$][\w$]*)\s*,\s*continuationPrompt\s*,\s*["'];["']\s*,\s*["']send-keys["']\s*,\s*["']-t["']\s*,\s*(worker\.pane_id|[A-Za-z_$][\w$]*)\s*,\s*["']Enter["']\s*,?\s*\]\s*\)\s*;/.exec(
 			continuationBody,
 		);
+	const paneToken = continuationArgs?.[1];
+	const paneTokenIsProvenLocal =
+		paneToken !== undefined &&
+		paneToken !== "worker.pane_id" &&
+		new RegExp(`const\\s+${paneToken}\\s*=\\s*worker\\.pane_id\\s*;`).test(continuationBody) &&
+		new RegExp(`if\\s*\\(\\s*!${paneToken}\\s*\\)\\s*return\\b`).test(continuationBody);
 	if (
 		!continuationArgs ||
+		continuationArgs[1] !== continuationArgs[2] ||
+		!(paneToken === "worker.pane_id" || paneTokenIsProvenLocal) ||
 		!continuationBody.includes("const revalidationReason =") ||
+		!/if\s*\(\s*revalidationReason\s*\)\s*(?:\{\s*return\b[^}]*;?\s*\}|return\b[^;]*;)/.test(continuationBody) ||
 		!continuationBody.includes("await createJsonNoClobber(") ||
 		!continuationBody.includes('type: "literal-send"') ||
 		!continuationBody.includes('type: "key-send"') ||

package/src/cli/notify-cli.ts

@@ -69,6 +69,7 @@ export interface NotifyCommandArgs {
 	slackChannelId?: string;
 	slackAuthorizedUserId?: string;
 	redact?: boolean;
+	forceDaemonLock?: boolean;
 	probe?: boolean;
 	message?: string;
 }
@@ -193,7 +194,12 @@ export function parseNotifyArgs(args: string[]): NotifyCommandArgs | undefined {
 			message: typeof flags.get("--message") === "string" ? (flags.get("--message") as string) : undefined,
 		};
 	}
-	if (action === "recovery") return args.length === 2 ? { action, rawArgs: [] } : undefined;
+	if (action === "recovery") {
+		const flags = parseFlags(args.slice(2), new Set(), new Set(["--force-daemon-lock"]));
+		return flags
+			? { action, rawArgs: args.slice(2), forceDaemonLock: flags.get("--force-daemon-lock") === true }
+			: undefined;
+	}
 	if (action === "daemon-internal") {
 		return {
 			action,
@@ -224,7 +230,7 @@ export async function runNotifyCommand(cmd: NotifyCommandArgs, deps: NotifyComma
 			await runTest(deps, cmd);
 			return;
 		case "recovery":
-			await runRecovery(deps);
+			await runRecovery(deps, cmd.forceDaemonLock);
 			return;
 		case "daemon-internal":
 			if (cmd.smoke) {
@@ -716,9 +722,9 @@ async function runTest(deps: NotifyCommandDeps, cmd: NotifyCommandArgs): Promise
 	else if (!result.ok) process.exitCode = 1;
 }
 
-async function runRecovery(deps: NotifyCommandDeps): Promise<void> {
+async function runRecovery(deps: NotifyCommandDeps, forceDaemonLock = false): Promise<void> {
 	const settings = await getSettings(deps);
-	const report = await recoverNotifications({ settings });
+	const report = await recoverNotifications({ settings, forceDaemonLock });
 	process.stdout.write(`${formatNotificationRecoveryReport(report)}\n`);
 }
 
@@ -737,14 +743,14 @@ ${chalk.bold("Usage:")}
   ${APP_NAME} notify status
   ${APP_NAME} notify health [--provider telegram|discord|slack] [--probe]
   ${APP_NAME} notify test [--provider telegram|discord|slack] [--message <text>]
-  ${APP_NAME} notify recovery
+  ${APP_NAME} notify recovery [--force-daemon-lock]
 
 ${chalk.bold("Subcommands:")}
   setup     Pair Telegram or atomically save and activate complete Discord/Slack settings
   status    Show global master and provider configured/repair/desired/effective state without secrets
   health    Report selected provider state; --probe uses REST only and never opens Gateway/Socket Mode
   test      Send a one-off test through one selected or uniquely effective provider
-  recovery  Clear dead-owner daemon locks and stale per-session endpoint files (never touches a live owner)
+  recovery  Clear dead-owner daemon locks and stale per-session endpoint files (never touches a live owner); --force-daemon-lock retries only with the same fail-closed dead-owner proof
 
 ${chalk.bold("Examples:")}
   ${APP_NAME} notify setup