@gajae-code/coding-agent 0.13.0 → 0.13.1

package/CHANGELOG.md

@@ -2,24 +2,34 @@
 
 ## [Unreleased]
 
+## [0.13.1] - 2026-08-11
+
 ### Added
 - `/model <preset>` and `/model gajae-code/<preset>` now activate a known model profile immediately instead of failing with "Unknown model". Unknown names still fall through to model resolution, and `/model <role> <preset>` keeps assigning a model to the named role.
 - Browser `act` and `run` responses can now surface an opt-in (`open(..., { diagnostics: true })`), bounded mailbox of page exceptions and `console.error` metadata. Entries carry only kind, timestamp, origin-only URL, line/column, and an allowlisted built-in error class; path segments, query strings, messages, arguments, values, and stacks are never retained. Serialization is byte-bounded with an explicit truncation marker.
 - A generated, host-neutral `sdk-skills/` bundle now provides namespaced external-agent skills for direct GJC SDK session discovery, approved trusted-local operations, and TypeScript/Python script authoring, with deterministic drift checks and credential-safe fail-closed templates. The bundle carries a versioned `manifest.json` (format version 1) so installed bundles fail closed on missing or unsupported layouts, and the skill prompts are authored as static Markdown sources under `scripts/gjc-sdk-skills/prompts/` that the generator copies and validates.
 - `GJC_SESSION_CONTEXT_BUDGET_BYTES` now overrides the synchronous session-context materialization budget that backs `SessionContextTooLargeError` (previously hardcoded to 64 MiB, now a 512 MiB default). The override parses fail-closed: only a canonical positive-integer value is honored, while empty, non-numeric, negative, zero, safe-integer-overflowing, or above-ceiling (8 GiB) values fall back to the 512 MiB default with a warning, so a malformed value can never silently raise or lower the memory guard. Raise it above your measured session size to suppress the preflight, or lower it to restore the old tight bound.
+- Custom OpenAI-compatible providers can opt into `/fast` forwarding with `compat.supportsServiceTier: true`; first-class OpenCodex discovery enables it automatically so client `service_tier: "priority"` reaches an OpenCodex proxy running in passthrough (`Auto`) mode.
 
 ### Fixed
+- A just-created or just-registered SDK session no longer reads as not-live (failing immediate `session.close`/`session.delete`, endpoint resolution, and chat-daemon attachment) for up to one heartbeat interval: the host-written registration now counts as initial liveness evidence, aging out exactly like a heartbeat, with the OS process-incarnation match still required. The broker's shutdown-escalation identity proof also accepts the incarnation the index auto-stamps at registration, and ACP `session/list` no longer advertises or re-adopts closed/unregistered (DR-1 terminal) rows — repeated ACP deletes answer already-gone instead of escalating against a host that no longer exists.
+- Insane public-route search now cancels and rejects response bodies larger than 1 MiB instead of buffering unbounded feed, HTML, or JSON payloads.
+- The Telegram notification daemon no longer terminates with an uncaught `EPERM` when publishing its heartbeat sidecar while an external Windows file lock (antivirus, indexer) briefly holds the destination. The rename is retried a bounded number of times under the ownership-lock fence, a still-failing publication is contained as a diagnostic-logged transient (the next heartbeat cycle republishes), and only a proven ownership loss stops the daemon; the stale-writer fence and staging-temp cleanup are preserved on every path (#4200).
+- `/fast` status, model badges, and task/subagent badges no longer show `⚡` for providers that silently drop unscoped priority intent. Indicators now follow wire-effective built-in support or an explicit `compat.supportsServiceTier` capability instead of treating every provider as fast-capable.
+- The broker's dead-registration sweep now requires positive proof of host death (ESRCH, or a readable OS process incarnation that differs from the recorded one) before unregistering a session. Under heartbeat-based liveness a registered host whose heartbeat had not yet been checkpointed read as not-live and could be reaped while still running; a stale or missing heartbeat is no longer grounds for a reap, and terminal registrations are never re-reaped.
 - Option+Q verification now supports normal macOS Terminal.app profiles and fails with an actionable Settings > Profiles > Keyboard > Use Option as Meta key diagnostic when the profile cannot forward Option as Meta/Esc.
 - Enabling Speech-to-Text from `/settings` now checks and configures its local dependencies immediately instead of deferring setup until the first recording. Setup progress is shown in the status line; failures disable STT again rather than leaving an unusable enabled toggle. Setup also reports platform-correct recorder commands, detects Ghostty's `macos-option-as-alt` requirement, and documents the Ctrl+P command-palette fallback, permissions, models, troubleshooting, and remapping.
 - Queued-message selection now accepts the actual macOS Terminal.app Option+Up/Down byte sequence from either physical Option key, enabling multi-message restore, delete, and reorder flows.
 - Keybinding configuration now normalizes `option`/`meta` to Option and `command`/`cmd` to Command, while Terminal.app guidance covers both physical Option keys and explicit Command profile mappings.
 - ACP prompts now settle when a terminal frame arrives before prompt acknowledgement with correlation split between the frame envelope and event payload. Live and deferred frames share strict ownership derivation, correlated nonterminals wait for exact acknowledgement ownership, and watchdog or cancel settlement no longer waits for a missing acknowledgement. Incomplete or foreign terminals emit structured error logs, unrelated session traffic cannot keep a wedged turn alive, and correlationless session events remain publishable without contaminating prompt-owned final-text state. Deferred terminal replay failures are contained by the session frame queue.
+- Closing a managed session no longer crashes the process when its cold-history sidecar resident-cache directory has already been removed. `SessionManager.close()` released the sidecar cache through an unguarded `dispose()`, so a `ResidentCacheTrustError` escaped teardown as an unhandled rejection (`directory_unverifiable`) and took down the CLI. Disposing an instance directory that no longer exists is now a completed disposal rather than a trust violation — a present-but-untrusted directory still fails closed — and sidecar release both clears its state before disposing and downgrades any remaining trust failure to a warning, matching every other resident-store disposal site.
 - `bun run restart:sdk-broker --close-session-hosts` no longer fails against session hosts whose workspace was deleted while they kept running. The teardown fence proved a pid's identity only from the spawn-time marker inside the session's own workspace state root, so deleting that workspace (a removed worktree, a cleaned scratch directory) destroyed the only evidence the broker would accept: `session.close` answered `close_refused` forever, the host stayed resident serving the source it started with, and every restart exited non-zero naming the same unkillable orphans. Hosts now publish their OS start incarnation into the broker-owned session index at registration — and reconciliation preserves it — so the pid stays provable after its workspace is gone, while a marker naming a different process still refuses the signal and an incarnation that no longer matches the live pid still fails closed. A host that dies before withdrawing its own registration is now retired by the broker on the same evidence its dead-registration sweep already uses, so a completed teardown is reported as one instead of surfacing as `endpoint_stale` or `terminal_uncertain`.
 - Bounded cold-session resume now uses automatic size routing, keeps ordinary sessions eager, admits two-GiB transcripts with fork-header headroom, and reduces first-open work with reusable scanning, buffered sidecar writes, pressure-based GC, one full transcript JSON pass plus a bounded authenticated suffix read, owner-bound concurrent publication, fail-closed post-admission tamper handling, deferred secondary artifacts, and split reservation/residency/disk accounting.
 - Session resume entrypoints now share size-aware bounded admission without weakening strict small-session validation, and hard-link fallback cleanup uses identity-bound native retirement instead of a pathname `lstat`/`unlink` pair.
 - OpenCode Go Responses completions that carry a response id but no output items or token usage are now treated as typed retryable failures instead of successful turns; untyped proxy empty responses retain the existing context-overflow promotion and compaction path.
 - Memory-pressure sweeps now request asynchronous garbage collection instead of forcing a stop-the-world collection on the main event loop, preventing periodic input and rendering stalls under the opt-in memory guard.
 - `gjc gc --disk --prune` now fences the blob mark/sweep so a session transcript that keeps changing under the mark can never cause unsafe reclamation: each transcript's references are bound to a stat snapshot taken before and after its read, the store must be observed completely quiet across a quiescence window before the sweep may act, and the fence is re-verified immediately before every removal. A store that still moves withholds the sweep with `keep:withheld_evidence_incomplete: sessions_changed_during_mark` instead of reclaiming on evidence it could not prove stable (#4158).
+- Concurrent interactive launches now atomically publish mode-600 core SDK discovery even when notification-daemon ownership is blocked, retry failed notification readiness without republishing the SDK endpoint, wait through bounded session-index contention with dead-owner recovery, and recover exact tmux-owner cleanup from competing valid terminal-verdict publishers.
 - Follow-up queue auto-continuation now waits for compaction and foreground bash/eval work to settle, preventing queued prompts from starting a model turn concurrently with those operations.
 - Scheduled continuations no longer route through `continueQueuedMessages()` merely because the last message is a non-assistant execution tail. The queue-consuming continuation is now used only for the explicit follow-up/steer drains (post-execution settlement, auto-compaction `queued_continue` recovery, and user-interrupt steering), so retry, fallback, auto-compaction, deep-interview, active-goal, TTSR, and reminder continuations keep `continue()` semantics and no longer fail with "No queued messages to continue" when no prompt is queued.
 - Follow-up queue submissions now defer slash/skill text during foreground bash/eval work instead of invoking a competing custom-message turn.
@@ -31,12 +41,15 @@
 - Read-tool code summarization and ZIP extraction now run asynchronously instead of blocking the TUI event loop during structural parsing or decompression.
 - `secrets.yml` entries with `mode: "replace"` and no explicit `replacement` now derive their substitute from a keyed, domain-separated HMAC-SHA256 construction over the process key instead of an unkeyed public `Bun.hash`. Derived replacements are no longer confirmable offline without the key (issue #4166); same-process determinism, same-length output, and alphanumeric character behavior are preserved, and explicit `replacement` values are unchanged. Note: derived replacements differ across processes/key rotations — set an explicit `replacement` when a stable value is required.
 - Managed scope preparation now reaps scrubbed write-protocol remnants. The POSIX exact-unlink fallback detaches and scrubs but never deletes, and macOS has no retained directory authority to complete deletion, so every managed replacement leaked zero-length `.gjc-exact-unlink-placeholder-*`, `.gjc-receipt-remove-*`, and `.gjc-exact-replace-destination-*` entries; scope directories grew without bound (observed at 83k dirents), degrading every per-mutation receipt scan and widening the quarantine-collision window behind intermittent `Could not prepare managed session scope (binding_invalid: prepare:binding_publish)` launch crashes. Preparation now removes zero-length, single-link remnants older than 15 minutes; non-zero displaced predecessors and detached receipts are retained as evidence, and in-flight protocol steps are protected by the age gate.
+- Conversation store file locks now publish complete, synced metadata atomically and release idempotently: failed lock construction cleans its pending artifact, release cleanup is ownership-checked, and recovery reclaims only stale locks or provably abandoned locks from the same process isolate. Empty, malformed, and unproven legacy markers fail closed at the normal timeout; concurrent healers and predecessors cannot delete a successor lock.
+- Owned subprocess teardown now recognizes zombie-only Linux process groups without consuming its grace window, while failing closed on unreadable `/proc` evidence, guarding recycled process-group leaders with their spawn-time identity, and reporting an explicit incomplete-teardown outcome to MCP stdio callers. Recycled-leader guarding applies only where that identity is readable (`/proc`); on macOS and other POSIX platforms teardown still signals the owned group instead of refusing it as unverifiable.
 
 ### Added
 - `gjc setup provider` now ships parameterized proxy presets: `--preset litellm` and `--preset openai-compatible-proxy` (aliases `litellm-proxy`, `openai-proxy`, `compatible-proxy`, `custom-proxy`) with a required `--base-url`, configurable `--api-key-env`, and live model discovery (#4123).
 - New `modelProfile.proxyProvider` and `modelProfile.proxyMode` settings route built-in model-preset selectors through an authenticated OpenAI-compatible proxy (e.g. `xai/grok-4.3` → `litellm/xai/grok-4.3`). `fallback` preserves directly authenticated providers by default; `always` forces every proxy-routable built-in selector through the configured gateway. Routing fails closed for unconfigured or unauthenticated proxies and missing or ambiguous proxy models (#4123).
 - SDK-only session hosts now publish their session ID and register their endpoint lifecycle with the broker, matching its identity and staleness fences. This restores broker/coordinator resolution for durable workflow-gate controls (`workflow.gates.list` and `workflow.gate_answer`) without relying on tmux pane input; broker unavailability leaves non-lifecycle local hosts usable and retries publication later.
 
+- Python eval now settles managed-runtime provisioning before cancellation, retires cancelled initialization without sharing it with successors, and retains late kernels whose shutdown is unconfirmed for postmortem retry.
 ## [0.12.21] - 2026-08-09
 
 ### Fixed
@@ -63,6 +76,8 @@
 
 - Attached image placeholders such as `[image 1]`, including the `[image N] source="…"` pasted-path reference form, are now deleted atomically with Backspace when the cursor sits at the placeholder boundary or the end of the full reference, instead of being erased one character at a time.
 - Root CLI help and shell completion now share the launch flag table instead of maintaining divergent copies, advertise the working `--fork` and `--worktree` options, omit retired extension/skill flags, and reject unknown options instead of silently dropping typos (#4023).
+- SDK broker startup diagnostics (#3963): a detached broker that exits before publishing discovery now writes a durable bounded startup-failure marker under `sdk/`, and the caller surfaces a typed `broker_startup_failed` error carrying the exit code, reason, and a bounded stderr excerpt instead of a bare `code=0`.
+- Image paste now defaults to Ctrl+V before Command+V on macOS (where terminals commonly consume Command+V), while Windows also accepts Ctrl+V and Alt+V; generated hotkey guidance reflects every platform chord.
 
 ### Added
 - Added a deterministic quick-lane task classifier (`classifyQuickLane`) exposed through a read-only `gjc quick-lane classify` command. It is an auditable classification surface that performs no routing and is NOT wired into runtime routing: it only prints whether a task request carries quick-lane eligibility signals (explicit file paths, issue/PR numbers, named symbols, explicit tests, numbered steps, acceptance criteria, error references, code blocks, or an explicit `force:`/`!` override) or deep-lane exclusions (vague, ambiguous, exploratory, risk-sensitive, or multi-file/cross-contract scope), and it never alters deep-path defaults. The classifier is deterministic and fail-closed: any exclusion forces the deep lane even when a concrete anchor is present. The #3984 routing decision remains open.
@@ -102,6 +117,7 @@
 - Edit cards now keep live calls concise when collapsed and show per-file results, diff statistics, diagnostics availability, and full details consistently when expanded.
 
 ### Fixed
+- SDK turn-result reconciliation now has one canonical content-bearing query with durable, UTF-8-safe bounded (16 KiB) terminal content. Prompt and skill terminal results remain correlated to their exact invocation and survive restart without retaining process-local revisions or cursors. Cursored continuation was removed as unreachable: the bounded content cap is well under both the response ceiling and the page target, so no revision is ever created; cursors are now rejected upfront instead of advertising a dead continuation path. Legacy status aliases delegate to the same authority, while provider query IDs and adapter dispositions remain unchanged.
 
 - SDK snapshot shutdown now reserves a revision write synchronously before any asynchronous serialization work, so an immediate `close()` cannot begin terminal cleanup ahead of an in-progress spill write under heavily contended CI scheduling. The coordinator owner-intent negative matrix also receives the same 30-second contention budget used by other filesystem-backed integration cases; its assertions and four-case coverage are unchanged.
 - Provider-agnostic preset ranking now uses AuthStorage's effective selectable credential type. Unusable stored command keys no longer misclassify OAuth-backed providers, and session-selected OAuth, fail-closed selectors, blocked/expired OAuth retry, and `openai-codex-device` aliases now follow the same precedence and normalization as request dispatch.
@@ -137,6 +153,8 @@
 - Codex GPT-5.6 OAuth context-window overrides are honored instead of silently re-clamped: explicit `modelOverrides.<id>.contextWindow` values survive the bundled 372K cap when positive and finite, non-positive values are ignored with a warning, and the precedence/fallback contract is codified in the Codex context-cap policy (#3987).
 
 ### Changed
+- `edit.mode` now defaults to `auto`: the edit protocol is routed by the active model's family (GPT/Codex → `apply_patch`; Claude/DeepSeek/Qwen → `replace`; MiniMax/GLM/Kimi/Moonshot and unknown models → `hashline`), independent of which provider serves the model. Resolution precedence is `GJC_EDIT_VARIANT`/`PI_EDIT_VARIANT` env force, then a matching `edit.modelVariants` rule, then explicit non-`auto` `edit.mode`, then a model-catalog edit recommendation when the session exposes one, then the built-in family mapping, then the `hashline` fallback. Invalid forced env values fail fast and a matched-but-invalid `edit.modelVariants` value fails closed with a diagnostic instead of silently falling through. Persisted explicit `edit.mode` values and the `atom` → `hashline` migration are unchanged; `resolveEditModeDetails()` exposes the resolved mode with provenance (source, model, family, matched rule).
+- Because `read`/`search` emit hash-line anchors and default line numbers only in `hashline` mode, `edit.mode: auto` now routes those display surfaces with the edit protocol: GPT/Codex (`apply_patch`) and Claude/DeepSeek/Qwen (`replace`) sessions no longer show hash anchors or line numbers in `read`/`search` output unless `readLineNumbers: true` is configured, while MiniMax/GLM/Kimi/Moonshot and unknown models keep the hashline display. `GJC_EDIT_VARIANT=hashline` restores the previous hashline read/search display exactly.
 
 - Workflow skills are no longer implicitly auto-routed. The UserPromptSubmit keyword autoroute now matches only explicit `$`-prefixed tokens (`$deep-interview`, `$ralplan`, `$ultragoal`, `$team`); natural-language phrases ("don't assume", "consensus plan", "interview me", "coordinated team") and bare skill names no longer activate workflows. The system prompt now ranks explicit user intent above every routing heuristic, forbids workflow self-invocation and plan stacking, bans task-difficulty overestimation, directs the agent to offer heuristic workflow escalation (especially deep-interview for vague requirements) through the `ask` tool with an opt-out, and adds an `<engineering>` principles section.
 - Deferred notification adapters, native bindings, provider construction, tools, skills, eval, session artifacts, and history storage until their feature paths are used, reducing the CLI startup module graph without changing default behavior.

package/dist/types/config/file-lock.d.ts

@@ -2,6 +2,8 @@ export interface FileLockOptions {
     staleMs?: number;
     retries?: number;
     retryDelayMs?: number;
+    signal?: AbortSignal;
+    onAcquired?: () => void;
     /** Stable host identity required to safely reclaim locks on a shared volume. */
     ownerHostId?: string;
 }

package/dist/types/config/keybindings.d.ts

@@ -57,7 +57,7 @@ declare module "@gajae-code/tui" {
     }
 }
 export declare function defaultMessageQueueKeysForPlatform(platform?: NodeJS.Platform): KeyId;
-export declare function defaultClipboardPasteImageKeysForPlatform(platform?: NodeJS.Platform): KeyId;
+export declare function defaultClipboardPasteImageKeysForPlatform(platform?: NodeJS.Platform): KeyId[];
 /**
  * All keybindings definitions: TUI + app-specific.
  */
@@ -259,7 +259,7 @@ export declare const KEYBINDINGS: {
         readonly description: "Select queued message to edit";
     };
     readonly "app.clipboard.pasteImage": {
-        readonly defaultKeys: KeyId;
+        readonly defaultKeys: KeyId[];
         readonly description: "Paste image from clipboard";
     };
     readonly "app.clipboard.pasteText": {

package/dist/types/config/model-registry.d.ts

@@ -61,6 +61,7 @@ export declare const ModelsConfigFile: ConfigFile<{
             supportsDeveloperRole?: boolean | undefined;
             sendSessionHeaders?: boolean | undefined;
             supportsResponsesSessionAffinity?: boolean | undefined;
+            supportsServiceTier?: boolean | undefined;
             supportsMultipleSystemMessages?: boolean | undefined;
             supportsReasoningEffort?: boolean | undefined;
             reasoningEffortMap?: {
@@ -145,6 +146,7 @@ export declare const ModelsConfigFile: ConfigFile<{
                 supportsDeveloperRole?: boolean | undefined;
                 sendSessionHeaders?: boolean | undefined;
                 supportsResponsesSessionAffinity?: boolean | undefined;
+                supportsServiceTier?: boolean | undefined;
                 supportsMultipleSystemMessages?: boolean | undefined;
                 supportsReasoningEffort?: boolean | undefined;
                 reasoningEffortMap?: {
@@ -222,6 +224,7 @@ export declare const ModelsConfigFile: ConfigFile<{
                 supportsDeveloperRole?: boolean | undefined;
                 sendSessionHeaders?: boolean | undefined;
                 supportsResponsesSessionAffinity?: boolean | undefined;
+                supportsServiceTier?: boolean | undefined;
                 supportsMultipleSystemMessages?: boolean | undefined;
                 supportsReasoningEffort?: boolean | undefined;
                 reasoningEffortMap?: {
@@ -341,6 +344,7 @@ export declare class ModelRegistry {
      * @param authStorage - Auth storage for API key resolution
      */
     constructor(authStorage: AuthStorage, modelsPath?: string);
+    onCatalogChanged(listener: () => void): () => void;
     /**
      * Reload models from disk (built-in + custom from models.json).
      */

package/dist/types/config/models-config-schema.d.ts

@@ -4,6 +4,7 @@ export declare const ModelCompatSchema: z.ZodObject<{
     supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
     sendSessionHeaders: z.ZodOptional<z.ZodBoolean>;
     supportsResponsesSessionAffinity: z.ZodOptional<z.ZodBoolean>;
+    supportsServiceTier: z.ZodOptional<z.ZodBoolean>;
     supportsMultipleSystemMessages: z.ZodOptional<z.ZodBoolean>;
     supportsReasoningEffort: z.ZodOptional<z.ZodBoolean>;
     reasoningEffortMap: z.ZodOptional<z.ZodObject<{
@@ -74,6 +75,7 @@ export declare const OpenAICompatSchema: z.ZodObject<{
     supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
     sendSessionHeaders: z.ZodOptional<z.ZodBoolean>;
     supportsResponsesSessionAffinity: z.ZodOptional<z.ZodBoolean>;
+    supportsServiceTier: z.ZodOptional<z.ZodBoolean>;
     supportsMultipleSystemMessages: z.ZodOptional<z.ZodBoolean>;
     supportsReasoningEffort: z.ZodOptional<z.ZodBoolean>;
     reasoningEffortMap: z.ZodOptional<z.ZodObject<{
@@ -262,6 +264,7 @@ export declare const ModelOverrideSchema: z.ZodObject<{
         supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
         sendSessionHeaders: z.ZodOptional<z.ZodBoolean>;
         supportsResponsesSessionAffinity: z.ZodOptional<z.ZodBoolean>;
+        supportsServiceTier: z.ZodOptional<z.ZodBoolean>;
         supportsMultipleSystemMessages: z.ZodOptional<z.ZodBoolean>;
         supportsReasoningEffort: z.ZodOptional<z.ZodBoolean>;
         reasoningEffortMap: z.ZodOptional<z.ZodObject<{
@@ -389,6 +392,7 @@ export declare const ModelsConfigSchema: z.ZodObject<{
             supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
             sendSessionHeaders: z.ZodOptional<z.ZodBoolean>;
             supportsResponsesSessionAffinity: z.ZodOptional<z.ZodBoolean>;
+            supportsServiceTier: z.ZodOptional<z.ZodBoolean>;
             supportsMultipleSystemMessages: z.ZodOptional<z.ZodBoolean>;
             supportsReasoningEffort: z.ZodOptional<z.ZodBoolean>;
             reasoningEffortMap: z.ZodOptional<z.ZodObject<{
@@ -569,6 +573,7 @@ export declare const ModelsConfigSchema: z.ZodObject<{
                 supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
                 sendSessionHeaders: z.ZodOptional<z.ZodBoolean>;
                 supportsResponsesSessionAffinity: z.ZodOptional<z.ZodBoolean>;
+                supportsServiceTier: z.ZodOptional<z.ZodBoolean>;
                 supportsMultipleSystemMessages: z.ZodOptional<z.ZodBoolean>;
                 supportsReasoningEffort: z.ZodOptional<z.ZodBoolean>;
                 reasoningEffortMap: z.ZodOptional<z.ZodObject<{
@@ -717,6 +722,7 @@ export declare const ModelsConfigSchema: z.ZodObject<{
                 supportsDeveloperRole: z.ZodOptional<z.ZodBoolean>;
                 sendSessionHeaders: z.ZodOptional<z.ZodBoolean>;
                 supportsResponsesSessionAffinity: z.ZodOptional<z.ZodBoolean>;
+                supportsServiceTier: z.ZodOptional<z.ZodBoolean>;
                 supportsMultipleSystemMessages: z.ZodOptional<z.ZodBoolean>;
                 supportsReasoningEffort: z.ZodOptional<z.ZodBoolean>;
                 reasoningEffortMap: z.ZodOptional<z.ZodObject<{

package/dist/types/config/settings-schema.d.ts

@@ -1,4 +1,5 @@
 import type { Effort } from "@gajae-code/ai/model-thinking";
+import { type EditMode } from "../utils/edit-mode";
 import type { ModelSelectorValue } from "./model-selector-value";
 import { type SkillDiscoverySettings } from "./skill-settings-defaults";
 /** Unified settings schema - single source of truth for all settings.
@@ -97,9 +98,12 @@ interface ArrayDef<T> {
     };
     ui?: UiBase;
 }
-interface RecordValueDef {
+type RecordValueDef = {
     type: "model-selector-value";
-}
+} | {
+    type: "string-enum";
+    values: readonly string[];
+};
 interface RecordDef<T> {
     type: "record";
     default: Record<string, T>;
@@ -2544,12 +2548,20 @@ export declare const SETTINGS_SCHEMA: {
     };
     readonly "edit.mode": {
         readonly type: "enum";
-        readonly values: import("../edit").EditMode[];
-        readonly default: "hashline";
+        readonly values: import("../utils/edit-mode").EditModeSetting[];
+        readonly default: import("../utils/edit-mode").EditModeSetting;
         readonly ui: {
             readonly tab: "editing";
             readonly label: "Edit Mode";
-            readonly description: "Select the edit tool variant (replace, patch, hashline, vim, or apply_patch)";
+            readonly description: "Select the edit tool variant (auto routes by model family; replace, patch, hashline, vim, or apply_patch)";
+        };
+    };
+    readonly "edit.modelVariants": {
+        readonly type: "record";
+        readonly default: Record<string, EditMode>;
+        readonly valueSchema: {
+            readonly type: "string-enum";
+            readonly values: EditMode[];
         };
     };
     readonly "edit.fuzzyMatch": {

package/dist/types/config/settings.d.ts

@@ -1,7 +1,7 @@
 import type { ModelRole } from "../config/model-registry";
 import { type NotificationSettingsReader, type NotificationSettingsSnapshot } from "../sdk/bus/config";
 import { AgentStorage } from "../session/agent-storage";
-import { type EditMode } from "../utils/edit-mode";
+import { type EditMode, type EditVariantMatch } from "../utils/edit-mode";
 import { type CasReceipt } from "./atomic-yaml-patch";
 import { type ModelSelectorValue } from "./model-selector-value";
 import { type BashInterceptorRule, type GroupPrefix, type GroupTypeMap, type SettingPath, type SettingsSchemaReport, type SettingValue } from "./settings-schema";
@@ -139,8 +139,17 @@ export declare class Settings implements NotificationSettingsReader {
     /**
      * Get the edit variant for a specific model.
      * Returns "patch", "replace", "hashline", "vim", "apply_patch", or null (use global default).
+     * Skips invalid values; prefer `matchEditVariantForModel` when invalid
+     * matches must fail closed instead of falling through.
      */
     getEditVariantForModel(model: string | undefined): EditMode | null;
+    /**
+     * First matching `edit.modelVariants` rule for a model, with its raw
+     * (unvalidated) value. The edit-mode resolver uses this discriminated
+     * result so a matched-but-invalid value fails closed with a diagnostic
+     * rather than silently resolving to another mode.
+     */
+    matchEditVariantForModel(model: string | undefined): EditVariantMatch | null;
     /**
      * Get bash interceptor rules (typed accessor for complex array config).
      */

package/dist/types/edit/streaming.d.ts

@@ -14,7 +14,7 @@
  */
 import type { Theme } from "../modes/theme/theme";
 import { type EditMode, resolveEditMode } from "../utils/edit-mode";
-import { type Operation } from "./modes/patch";
+import { type PatchEditEntry } from "./modes/patch";
 export interface PerFileDiffPreview {
     path: string;
     diff?: string;
@@ -55,11 +55,11 @@ export interface EditStreamingStrategy<Args = unknown> {
 }
 export interface EditRequestTargetInventory {
     paths: string[];
-    /** Operation of the first target (Create/Delete) when derivable from the
-     * request payload (apply_patch/hashline free-form envelopes carry op on the
-     * parsed entry, not on the top-level args). */
-    firstOp?: Operation;
     parseError?: string;
+    /** First envelope entry operation, for free-form modes that carry no structured `edits`. */
+    op?: PatchEditEntry["op"];
+    /** First envelope entry rename target, for free-form modes that carry no structured `edits`. */
+    rename?: string;
 }
 export declare function orderedDistinctPaths(paths: readonly (string | undefined)[]): string[];
 export declare function getEditRequestTargetInventory(args: unknown, editMode: EditMode | undefined, options: {

package/dist/types/eval/py/kernel.d.ts

@@ -1,5 +1,5 @@
 import { type KernelDisplayOutput } from "./display";
-import { type PythonRuntimeOptions } from "./runtime";
+import { type PythonRuntimeLifecycleOptions, type PythonRuntimeOptions } from "./runtime";
 export type { KernelDisplayOutput, PythonStatusEvent } from "./display";
 export { renderKernelDisplay } from "./display";
 export interface KernelExecuteOptions {
@@ -50,7 +50,7 @@ export interface PythonKernelAvailability {
     pythonPath?: string;
     reason?: string;
 }
-export declare function checkPythonKernelAvailability(cwd: string, runtimeOptions?: PythonRuntimeOptions): Promise<PythonKernelAvailability>;
+export declare function checkPythonKernelAvailability(cwd: string, runtimeOptions?: PythonRuntimeOptions, lifecycle?: PythonRuntimeLifecycleOptions): Promise<PythonKernelAvailability>;
 export declare class PythonKernel {
     #private;
     readonly id: string;

package/dist/types/eval/py/runtime.d.ts

@@ -5,6 +5,10 @@ export interface PythonRuntimeOptions {
     /** Packages to seed into the managed workspace venv when provisioning it. */
     seedPackages?: readonly string[];
 }
+export interface PythonRuntimeLifecycleOptions {
+    signal?: AbortSignal;
+    deadlineMs?: number;
+}
 export interface PythonRuntime {
     /** Path to python executable */
     pythonPath: string;
@@ -26,4 +30,4 @@ export declare function resolveVenvPath(cwd: string): string | undefined;
  * Resolve Python runtime including executable path, environment, and venv detection.
  */
 export declare function resolvePythonRuntime(cwd: string, baseEnv: Record<string, string | undefined>, options?: PythonRuntimeOptions): PythonRuntime;
-export declare function ensurePythonRuntime(cwd: string, baseEnv: Record<string, string | undefined>, options?: PythonRuntimeOptions): Promise<PythonRuntime>;
+export declare function ensurePythonRuntime(cwd: string, baseEnv: Record<string, string | undefined>, options?: PythonRuntimeOptions, lifecycle?: PythonRuntimeLifecycleOptions): Promise<PythonRuntime>;

package/dist/types/gjc-runtime/session-state-sidecar.d.ts

@@ -27,6 +27,9 @@ export declare const __sessionStateSidecarPerfCounters: {
 interface RuntimeStateEvent {
     type: string;
     messages?: unknown[];
+    toolCallId?: unknown;
+    toolName?: unknown;
+    isError?: unknown;
 }
 export interface OwnerTerminalContext {
     generation: string;

package/dist/types/gjc-runtime/tmux-sessions.d.ts

@@ -1,5 +1,5 @@
 import { type ProviderAuthority } from "./tmux-common";
-import { type OwnerIsolationProbeSync, type PlanResponse, type TmuxOwnerIsolationExecutionDependencies, type TmuxOwnerIsolationExecutionResult } from "./tmux-owner-isolation";
+import { type OwnerIsolationProbeSync, type OwnerVerdict, type PlanResponse, type TmuxOwnerIsolationExecutionDependencies, type TmuxOwnerIsolationExecutionResult } from "./tmux-owner-isolation";
 export interface GjcTmuxSessionStatus {
     name: string;
     attached: boolean;
@@ -71,6 +71,8 @@ export interface ForceCloseOwnerDependencies {
     now(): Date;
     sleep(ms: number): Promise<void>;
     listPanePids(sessionName: string, env: NodeJS.ProcessEnv): number[];
+    /** Test/runtime seam for an exact owner-exit observer; durable validation remains authoritative. */
+    waitForOwnerExitVerdict?(): Promise<OwnerVerdict>;
 }
 export interface CreateGjcTmuxSessionOptions {
     platform?: NodeJS.Platform;

package/dist/types/modes/components/model-selector.d.ts

@@ -42,13 +42,14 @@ export declare class ModelSelectorComponent extends Container {
         temporaryOnly?: boolean;
         initialSearchInput?: string;
         sessionId?: string;
-        isFastForProvider?: (provider?: string) => boolean;
-        isFastForSubagentProvider?: (provider?: string) => boolean;
+        isFastForProvider?: (provider?: string, supportsServiceTier?: boolean) => boolean;
+        isFastForSubagentProvider?: (provider?: string, supportsServiceTier?: boolean) => boolean;
         isCurrentModelFastModeActive?: () => boolean;
         currentThinkingLevel?: ThinkingLevel;
         activeModelProfile?: string;
         configuredDefaultChain?: readonly string[];
     });
+    dispose(): void;
     refreshRoleAssignments(options?: {
         currentModel?: Model;
         currentThinkingLevel?: ThinkingLevel;

package/dist/types/runtime/process-lifecycle.d.ts

@@ -1,34 +1,9 @@
-/**
- * Shared runtime lifecycle foundation.
- *
- * Two minimal, deliberately small primitives that subsystem runtimes
- * (DAP/LSP/MCP stdio, eval workers, etc.) adopt so spawned children and
- * non-process resources cannot outlive their owner:
- *
- *   F1(a) `spawnOwnedProcess` — wraps `ptree.spawn` with explicit
- *         process-group ownership, escalating (SIGTERM -> grace -> SIGKILL)
- *         tree termination, bounded `awaitExit`, abort-listener cleanup on
- *         settle, idempotent `dispose`, and a single postmortem hook that
- *         reaps every still-live owned process group on fatal/normal shutdown.
- *
- *   F1(b) `registerResourceOwner` — a generic, idempotent postmortem adapter
- *         for non-process resources (Bun Workers, VM contexts, timers,
- *         sockets) built on the existing `postmortem.register` facility.
- *
- * Ownership is keyed to the *process group*, not the root process. A root that
- * exits after backgrounding descendants (`sh -c "worker & exit 0"`) keeps the
- * owner registered until the group is actually gone, so the descendant tree is
- * still reaped by `dispose()`/postmortem.
- *
- * This module intentionally owns only these primitives. It does not migrate
- * existing call sites; subsystem PRs adopt it incrementally.
- *
- * Note: `ptree.spawn` always pipes stdout/stderr. Adopters that expect output
- * (DAP/LSP/MCP protocol servers) must consume `owner.child.stdout`; F1 does not
- * drain it, so a chatty child whose stdout is never read can still block on a
- * full pipe. That draining is the adopter's responsibility.
- */
 import { ptree } from "@gajae-code/utils";
+import { type LinuxProcPidProbeResult } from "../gjc-runtime/linux-proc";
+/** Whether an unreadable `/proc` entry might still describe a running process. */
+export declare function procEntryMayStillBeRunning(error: unknown): boolean;
+/** Whether a process-group leader still has the spawn-time identity we own. */
+export declare function groupLeaderIdentityMatches(expectedStartTime: string | undefined, leader: LinuxProcPidProbeResult): boolean;
 /** Options for {@link spawnOwnedProcess}. */
 export interface SpawnOwnedOptions {
     cwd?: string;
@@ -55,6 +30,12 @@ export interface AwaitExitResult {
     /** Exit code if known, else `null`. */
     code: number | null;
 }
+/** The observed outcome of an owned-process teardown attempt. */
+export type OwnedProcessTeardownStatus = "terminated" | "still_running" | "identity_unverified";
+/** Result of {@link OwnedProcess.dispose}. */
+export interface OwnedProcessTeardownResult {
+    status: OwnedProcessTeardownStatus;
+}
 /** A spawned child process owned by the runtime with guaranteed teardown. */
 export interface OwnedProcess {
     readonly child: ptree.ChildProcess;
@@ -76,7 +57,7 @@ export interface OwnedProcess {
      * abort listener and deregisters from the live-owner set only after teardown
      * has completed. Repeated/concurrent calls return the same in-flight promise.
      */
-    dispose(): Promise<void>;
+    dispose(): Promise<OwnedProcessTeardownResult>;
 }
 /**
  * Spawn a child process owned by the runtime. The returned {@link OwnedProcess}

package/dist/types/sdk/broker/identity.d.ts

@@ -1,3 +1,4 @@
 export declare function brokerIdentityPath(agentDir: string): string;
 export declare function getBrokerIdentityKey(agentDir: string): Promise<string>;
-export declare function deriveIdempotencyIdentity(agentDir: string, operation: string, callerKey: string, canonicalTargetHash: string): Promise<string>;
+export declare function deriveIdempotencyIdentity(agentDir: string, operation: string, callerKey: string, _protocolVersionOrLegacyTargetHash?: string): Promise<string>;
+export declare function deriveLegacyTargetIdentity(agentDir: string, operation: string, callerKey: string, canonicalTargetHash: string): Promise<string>;

package/dist/types/sdk/broker/lifecycle-ledger.d.ts

@@ -53,6 +53,8 @@ export interface LifecycleDurableEffectsReceipt {
     digest?: string;
 }
 export interface LifecycleLedgerEntry {
+    operationKey?: string;
+    fingerprint?: string;
     version: typeof SDK_STATE_VERSION;
     identity: string;
     requestHash: string;
@@ -115,8 +117,22 @@ export declare class LifecycleLedger {
      * synced row as unpersisted and replace its true reason with a generic one.
      */
     readTerminal(identity: string, requestHash: string): Promise<LifecycleLedgerEntry | undefined>;
+    findByOperationKey(operationKey: string): LifecycleLedgerEntry | undefined;
+    /**
+     * Legacy target-inclusive rows predate the operation/key index. Their opaque
+     * identities cannot establish that a different target is safe, so callers
+     * must reject rather than create a second admission.
+     */
+    hasLegacyIdentity(): boolean;
+    migrateIdentity(from: string, to: string, metadata: {
+        operationKey: string;
+        fingerprint: string;
+    }): Promise<LifecycleLedgerEntry | undefined>;
     get warnings(): readonly string[];
-    begin(identity: string, requestHash: string): Promise<BeginResult>;
+    begin(identity: string, requestHash: string, metadata?: {
+        operationKey?: string;
+        fingerprint?: string;
+    }): Promise<BeginResult>;
     transition(identity: string, state: LifecycleState, fields?: Omit<Partial<LifecycleLedgerEntry>, "identity" | "requestHash" | "state" | "ts">): Promise<LifecycleLedgerEntry>;
     assertSupportedStateVersions(): Promise<void>;
     findCleanupPendingByDeleteTarget(target: {

package/dist/types/sdk/broker/lifecycle.d.ts

@@ -182,12 +182,17 @@ export interface ReapedSessionRegistration {
 /**
  * Drops every indexed session registration whose host process is provably gone.
  *
- * Liveness is the session index's own `alive(pid)` probe (`listSessions().live`),
- * which reports live for both a running pid and an EPERM pid, so an alien or
- * unreadable process is never mistaken for a dead one. Registrations already
- * marked `terminalUncertain` are left alone: their disposition belongs to the
- * terminal-uncertainty reconciliation path, and silently dropping them would
- * turn a fail-closed `session.close`/`session.delete` refusal into `not_found`.
+ * Proof of death is positive, never inferred from a missing liveness proof:
+ * `observeProcess` reports "exited" only on ESRCH or on a readable OS process
+ * incarnation that differs from the recorded one (a reused pid). A stale or
+ * missing heartbeat merely makes a session read as not-live — the host may
+ * still be running ahead of the next heartbeat checkpoint pass, so it is never
+ * grounds for a reap. EPERM and unreadable incarnations stay "uncertain", so an
+ * alien or unreadable process is never mistaken for a dead one. Registrations
+ * already terminal or marked `terminalUncertain` are left alone: their
+ * disposition belongs to the terminal-uncertainty reconciliation path, and
+ * silently dropping them would turn a fail-closed `session.close`/
+ * `session.delete` refusal into `not_found`.
  */
 export declare function reapDeadSessionRegistrations(broker: Pick<Broker, "index">): Promise<ReapedSessionRegistration[]>;
 /**

package/dist/types/sdk/broker/startup-failure.d.ts

@@ -0,0 +1,32 @@
+export interface BrokerStartupFailureMarker {
+    version: 1;
+    reason: string;
+    exitCode: number | null;
+    signal: string | null;
+    writtenAt: number;
+}
+export declare function brokerStartupFailurePath(agentDir: string): string;
+/** Best-effort durable marker write; never throws (diagnostics must not mask the exit itself). */
+export declare function writeBrokerStartupFailureMarker(agentDir: string, failure: {
+    reason: string;
+    exitCode: number | null;
+    signal: string | null;
+}): Promise<void>;
+/** Reads a bounded startup-failure marker; `undefined` when absent or malformed. */
+export declare function readBrokerStartupFailureMarker(agentDir: string): Promise<BrokerStartupFailureMarker | undefined>;
+/** Best-effort marker removal; used at spawn so a stale marker never misattributes an older failure. */
+export declare function clearBrokerStartupFailureMarker(agentDir: string): Promise<void>;
+/** Typed error returned when a detached broker exits before discovery. */
+export declare class BrokerStartupError extends Error {
+    readonly code = "broker_startup_failed";
+    readonly exitCode: number | null;
+    readonly signal: string | null;
+    readonly reason: string;
+    readonly stderrExcerpt?: string;
+    constructor(fields: {
+        exitCode: number | null;
+        signal: string | null;
+        reason: string;
+        stderrExcerpt?: string;
+    });
+}

package/dist/types/sdk/bus/chat-daemon-control.d.ts

@@ -44,7 +44,8 @@ export type ChatDaemonAction = "stop" | "reload";
  * before the host heartbeat TTL expires and permanently loses its attachment. Discord
  * generation 29 / slack generation 28 advance the replay cursor only after a frame is
  * published, so an owner at an earlier generation acknowledges an event before delivering
- * it and loses that event for good the first time a surface refuses it.
+ * it and loses that event for good the first time a surface refuses it. Discord generation 30 /
+ * slack generation 29 invalidate existing owners after SDK discovery validation changes.
  */
 export declare const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>>;
 export declare function chatDaemonGeneration(kind: ChatDaemonKind): number;

package/dist/types/sdk/bus/conversation-store.d.ts

@@ -24,6 +24,7 @@ export interface ConversationStoreFs {
         mode: number;
     }): Promise<void>;
     rename(from: string, to: string): Promise<void>;
+    link(from: string, to: string): Promise<void>;
     unlink(file: string): Promise<void>;
     open(file: string, flags: string): Promise<ConversationStoreFileHandle>;
     stat?(file: string): Promise<{

package/dist/types/sdk/bus/index.d.ts

@@ -333,6 +333,8 @@ interface SessionRuntime {
     cursors: CursorRegistry;
     /** Current endpoint session identity; never re-key an existing host across a switch. */
     id: string;
+    /** Discovery scope is fixed before publication; a live default endpoint is never rotated in place. */
+    endpointScope: "default" | "chat";
     idleSeq: number;
     /** Interactive asks awaiting a remote answer, by action id. */
     pendingInteractive: Map<string, PendingInteractiveAsk>;
@@ -344,6 +346,8 @@ interface SessionRuntime {
     disposeGateListener: () => void;
     /** Whether notification-only delivery and answer resources are active. */
     notificationsActive: boolean;
+    /** Provider ownership state is independent from the already-published core SDK runtime. */
+    notificationOwnerState: "ready" | "retry" | "blocked";
     /** Rejects new SDK frames while a leased terminal response drains. */
     inboundFenced: boolean;
     /** Set as soon as terminal teardown is requested, before startup settles. */