@gajae-code/coding-agent 0.13.2 → 0.14.0

package/dist/types/commands/launch.d.ts

@@ -41,6 +41,9 @@ export default class Index extends Command {
         credential: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
+        "prefer-credential": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
         "system-prompt": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
@@ -50,6 +53,9 @@ export default class Index extends Command {
         "mcp-config": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
+        "no-mcp": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
         "clipboard-transport": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
             options: string[];

package/dist/types/commands/setup.d.ts

@@ -93,6 +93,12 @@ export default class Setup extends Command {
         "models-path": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
+        remove: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        mpreset: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
         yes: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             char: string;
             description: string;

package/dist/types/commands/skills.d.ts

@@ -1,5 +1,5 @@
 /**
- * Inspect bundled workflow skills.
+ * Inspect bundled workflow skills and filesystem-discovered custom skills.
  */
 import { Command } from "@gajae-code/utils/cli";
 import { type SkillsAction } from "../cli/skills-cli";
@@ -20,6 +20,11 @@ export default class Skills extends Command {
         json: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };
+        source: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+            options: string[];
+            default: string;
+        };
     };
     static examples: string[];
     run(): Promise<void>;

package/dist/types/commands/update.d.ts

@@ -16,5 +16,12 @@ export default class Update extends Command {
             description: string;
         };
     };
+    static args: {
+        action: import("@gajae-code/utils/cli").ArgDescriptor & {
+            description: string;
+            required: false;
+            options: string[];
+        };
+    };
     run(): Promise<void>;
 }

package/dist/types/config/atomic-yaml-patch-worker.d.ts

@@ -0,0 +1,25 @@
+import type { NativeExactFileIdentity, NativeExactUnlinkResult, NativeNoReplaceResult } from "@gajae-code/natives";
+export type AtomicYamlNativeWorkerRequest = {
+    operation: "exact-replace";
+    sourcePath: string;
+    destinationPath: string;
+    expectedSource: NativeExactFileIdentity;
+    expectedDestination: NativeExactFileIdentity;
+} | {
+    operation: "no-replace";
+    sourcePath: string;
+    destinationPath: string;
+} | {
+    operation: "no-replace-link";
+    sourcePath: string;
+    destinationPath: string;
+};
+export type AtomicYamlNativeWorkerResponse = {
+    type: "result";
+    result: NativeExactUnlinkResult | NativeNoReplaceResult;
+} | {
+    type: "error";
+    name?: string;
+    message: string;
+    stack?: string;
+};

package/dist/types/config/atomic-yaml-patch.d.ts

@@ -1,3 +1,4 @@
+import type { NativeExactFileIdentity, NativeExactUnlinkResult, NativeNoReplaceResult } from "@gajae-code/natives";
 export interface AtomicYamlExpectedPrecondition {
     path: string;
     hash: string;
@@ -37,6 +38,8 @@ export type CasRestoreResult = {
     paths: readonly string[];
 } | {
     status: "discarded";
+} | {
+    status: "not-restorable";
 };
 /**
  * A receipt intentionally exposes only path-level hashes and opaque revisions.
@@ -55,6 +58,10 @@ export interface AtomicYamlUpdate<T> {
 export interface AtomicYamlPatchOptions {
     /** Test seam for deterministic pre-rename and Windows sharing-violation failures. */
     rename?: (from: string, to: string) => Promise<void>;
+    /** Test seam for an identity-checked atomic replacement. */
+    exactReplace?: (sourcePath: string, destinationPath: string, expectedSource: NativeExactFileIdentity, expectedDestination: NativeExactFileIdentity) => NativeExactUnlinkResult | Promise<NativeExactUnlinkResult>;
+    /** Test seam for an atomic no-replace publication. */
+    noReplace?: (sourcePath: string, destinationPath: string) => NativeNoReplaceResult | Promise<NativeNoReplaceResult>;
     /** Test seam for bounded retry timing. */
     sleep?: (ms: number) => Promise<void>;
     /** Test seam for Windows rename retry behavior. */
@@ -69,8 +76,24 @@ export declare class AtomicYamlReplaceError extends Error {
     readonly configPath: string;
     readonly attempts: number;
     readonly cause: unknown;
+    readonly preserveTempPath: boolean;
     readonly code = "ATOMIC_YAML_REPLACE_FAILED";
-    constructor(configPath: string, attempts: number, cause: unknown);
+    constructor(configPath: string, attempts: number, cause: unknown, preserveTempPath?: boolean);
+}
+/**
+ * Raised when the LEXICAL config path no longer resolves to the canonical
+ * target an operation is about to write: e.g. a `config.yml` symlink was
+ * repointed while the operation waited in the per-file queue or ran. The
+ * native identity check protects only the previously resolved destination, so
+ * without this guard the write would modify an unrelated prior target and
+ * report success while the now-active configuration is left unchanged.
+ */
+export declare class AtomicYamlRetargetError extends Error {
+    readonly lexicalPath: string;
+    readonly expectedCanonicalPath: string;
+    readonly actualCanonicalPath: string;
+    readonly code = "ATOMIC_YAML_RETARGETED";
+    constructor(lexicalPath: string, expectedCanonicalPath: string, actualCanonicalPath: string);
 }
 /** Set a dotted YAML path, creating object intermediates as needed. */
 export declare function setByPath(value: Record<string, unknown>, segments: readonly string[], nextValue: unknown): void;
@@ -80,12 +103,49 @@ export declare function deleteByPath(value: Record<string, unknown>, segments: r
 export declare function atomicYamlPathHash(value: Record<string, unknown>, path: string): string;
 /** Build patches from current durable YAML while holding the shared queue and file lock. */
 export declare function applyAtomicYamlPatchesWithCurrent(configPath: string, buildPatches: (current: Readonly<Record<string, unknown>>) => Promise<readonly AtomicYamlPatch[]> | readonly AtomicYamlPatch[], options?: AtomicYamlPatchOptions): Promise<CasReceipt>;
+export interface AtomicYamlConfigTransaction {
+    configPath: string;
+    root: unknown;
+    current: Readonly<Record<string, unknown>>;
+    /** True once any write op has durably committed (a later CAS rejection then
+     * leaves the target with partial writes, so recovery artifacts must stay). */
+    written: boolean;
+    applyPatches(patches: readonly AtomicYamlPatch[], options?: AtomicYamlPatchOptions): Promise<CasReceipt>;
+    /**
+     * Delete top-level keys verbatim, including dotted key names (e.g. a flat
+     * `"gjc.ralplan.maxIterations"` key that the patch grammar would otherwise
+     * interpret as a nested path). Writes atomically under the same lock.
+     */
+    removeTopLevelKeys(keys: readonly string[], options?: AtomicYamlPatchOptions): Promise<CasReceipt>;
+    /**
+     * Apply patches AND delete top-level keys verbatim in a SINGLE atomic
+     * write, so an external editor's change cannot land between the two
+     * operations (external editors do not participate in the file lock). The
+     * returned receipt is not restorable (the deletions are not journaled).
+     */
+    applyPatchesAndRemoveTopLevelKeys(patches: readonly AtomicYamlPatch[], topLevelKeys: readonly string[], options?: AtomicYamlPatchOptions): Promise<CasReceipt>;
+    /**
+     * Replace the whole document (used to revert the target when a later
+     * verification fails). Writes atomically under the same lock; the returned
+     * receipt is not restorable.
+     */
+    replaceCurrent(next: Readonly<Record<string, unknown>>, options?: AtomicYamlPatchOptions): Promise<CasReceipt>;
+}
+/**
+ * Run a caller-owned multi-step mutation under the config file's per-file queue
+ * and cross-process lock. The current YAML is read once and exposed as
+ * `root`/`current`; the callback may inspect it, decide patches, and apply them
+ * (or perform adjacent durable actions such as marker/source transitions)
+ * without re-acquiring the lock. A YAML parse failure surfaces before the
+ * callback runs, so no migration action can execute against a malformed target.
+ */
+export declare function withAtomicYamlConfigTransaction<T>(configPath: string, operation: (transaction: AtomicYamlConfigTransaction) => Promise<T>): Promise<T>;
 /**
  * Reserve a FIFO operation for a config file immediately. The patch supplier runs
  * only when this operation reaches the front of the in-process queue, which lets
  * Settings debounce/coalesce inside its already-reserved causal slot.
  */
-export declare function enqueueAtomicYamlOperation<T>(configPath: string, operation: (canonicalConfigPath: string) => Promise<T>): Promise<T>;
+export declare function enqueueAtomicYamlOperation<T>(configPath: string, operation: (canonicalConfigPath: string, lexicalConfigPath: string) => Promise<T>): Promise<T>;
 /**
  * Reserve an atomic patch slot now, producing patches only after earlier slots
  * complete. Writers with state-aware merges use {@link reserveAtomicYamlUpdateSlot}.

package/dist/types/config/config-schema-version.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The current settings/config schema version. A `config.yml` whose
+ * `configSchemaVersion` is newer is treated as read-only by Settings migrations
+ * (a future schema must not inherit stale keys); the workflow-settings
+ * resolver mirrors that guard when deciding whether a migration target is
+ * non-publishable (so the retained legacy fallback still applies). Defined in
+ * this dependency-light module so the resolver can import it without pulling in
+ * the TUI/AI-heavy settings schema.
+ */
+export declare const CONFIG_SCHEMA_VERSION = 1;

package/dist/types/config/file-lock.d.ts

@@ -45,6 +45,24 @@ export type FileLockGcRemoval = "removed" | "owner_changed" | "missing";
  * but the reclaim-after-stale scenario the issue describes is now guarded.
  */
 export declare function removeFileLockDirForGc(lockDir: string, expected: FileLockOwnerToken): Promise<FileLockGcRemoval>;
+/**
+ * @internal
+ * READ-ONLY verdict on an EXISTING generic `<file>.lock/` directory that another lock
+ * protocol has collided with: is its owner gone, by this protocol's own rules?
+ *
+ * Exposed so a foreign holder of the same path never has to reimplement this protocol's
+ * owner parsing or liveness rules. Reusing them is what makes the two implementations
+ * agree: `processStartTime` here is the portable `ps` value that `info.start_time` was
+ * written from, so a live owner is proved live rather than compared against a value from a
+ * different clock source and then reaped. A live owner is never reported stale by elapsed
+ * time alone.
+ *
+ * Deletion is deliberately NOT offered. This protocol can only re-read an owner token and
+ * then unlink a pathname, which a successor can take over in between; a caller that must
+ * remove the directory has to do it under an identity-bound primitive that refuses when
+ * the object is no longer the one that was judged.
+ */
+export declare function genericFileLockDirIsStale(lockDir: string, staleMs: number): Promise<boolean>;
 /**
  * Serializes all contenders, including callers in the same process. Because this
  * API exposes no ownership token, recursive acquisition is indistinguishable

package/dist/types/config/model-profile-activation.d.ts

@@ -19,6 +19,8 @@ type ModelProfileActivationSession = Pick<AgentSession, "model" | "thinkingLevel
         modelRoles: readonly string[];
         agentModelOverrides: readonly string[];
     };
+    /** Re-apply vendor-separated delegation (task tool + prompt) after the role layer changed. */
+    syncEagerDelegation?: () => Promise<void>;
     getSessionDefaultModelSelector?: () => string | undefined;
     recordResumeDefaultModel?: (selector: string | undefined) => void;
     seedDefaultFallbackResolution?: (activeIndex: number, skips: Array<{
@@ -39,7 +41,7 @@ type ConfiguredModelChainState = {
 };
 export interface PrepareModelProfileActivationOptions {
     session: ModelProfileActivationSession;
-    modelRegistry: Pick<ModelRegistry, "getModelProfile" | "getModelProfiles" | "getAvailableModelProfileNames" | "getApiKeyForProvider" | "getAll" | "resolveCanonicalModel" | "getCanonicalVariants" | "getCanonicalId"> & Partial<Pick<ModelRegistry, "getAvailable" | "resolveModelByLookupAlias" | "lookupAliasExists" | "clearCanonicalVariant" | "seedCanonicalVariant" | "getSessionCanonicalVariant" | "restoreSessionCanonicalVariant" | "getConfiguredProviderIds">> & {
+    modelRegistry: Pick<ModelRegistry, "getModelProfile" | "getModelProfiles" | "getAvailableModelProfileNames" | "getApiKeyForProvider" | "getAll" | "resolveCanonicalModel" | "getCanonicalVariants" | "getCanonicalId"> & Partial<Pick<ModelRegistry, "getAvailable" | "getAvailableForProfileActivation" | "resolveModelByLookupAlias" | "lookupAliasExists" | "clearCanonicalVariant" | "seedCanonicalVariant" | "getSessionCanonicalVariant" | "restoreSessionCanonicalVariant" | "getConfiguredProviderIds">> & {
         getError?: ModelRegistry["getError"];
     };
     settings: Pick<Settings, "get" | "getGlobal" | "getOverride">;

package/dist/types/config/model-registry.d.ts

@@ -34,6 +34,7 @@ export interface GjcModelAssignmentTargetInfo extends ModelRoleInfo {
 }
 export { GJC_MODEL_ASSIGNMENT_TARGET_IDS };
 export declare const GJC_MODEL_ASSIGNMENT_TARGETS: Record<GjcModelAssignmentTargetId, GjcModelAssignmentTargetInfo>;
+export declare function requiresExplicitThinkingChoice(model: Model, role: GjcModelAssignmentTargetId | null): boolean;
 /** Alias for ModelRoleInfo - used for both built-in and custom roles */
 export type RoleInfo = ModelRoleInfo;
 /**
@@ -106,7 +107,7 @@ export declare const ModelsConfigFile: ConfigFile<{
         authHeader?: boolean | undefined;
         auth?: "apiKey" | "none" | "oauth" | undefined;
         discovery?: {
-            type: "llama.cpp" | "lm-studio" | "models-dev" | "ollama" | "openai-models-list";
+            type: "llama.cpp" | "lm-studio" | "models-dev" | "ollama" | "omlx" | "openai-models-list";
             apiByModelPrefix?: Record<string, "anthropic-messages" | "openai-completions"> | undefined;
             modelsDevProvider?: string | undefined;
         } | undefined;
@@ -453,6 +454,12 @@ export declare class ModelRegistry {
      * This is a fast check that doesn't refresh OAuth tokens.
      */
     getAvailable(): Model<Api>[];
+    /**
+     * Get authenticated models, excluding bundled entries that a fresh provider
+     * catalog has positively shown to be unavailable. Bundled entries remain
+     * usable until live catalog evidence exists so offline startup is unchanged.
+     */
+    getAvailableForProfileActivation(): Model<Api>[];
     getActiveProviders(): ActiveProviderDescriptor[];
     /**
      * Check whether auth is configured for a model's provider.
@@ -486,6 +493,7 @@ export declare class ModelRegistry {
      */
     getApiKey(model: Model<Api>, sessionId?: string, options?: {
         credentialSelector?: AuthCredentialSelector;
+        preferredCredentialSelector?: AuthCredentialSelector;
         signal?: AbortSignal;
     }): Promise<string | undefined>;
     /**
@@ -493,6 +501,7 @@ export declare class ModelRegistry {
      */
     getApiKeyForProvider(provider: string, sessionId?: string, baseUrl?: string, options?: {
         credentialSelector?: AuthCredentialSelector;
+        preferredCredentialSelector?: AuthCredentialSelector;
         signal?: AbortSignal;
     }): Promise<string | undefined>;
     /**

package/dist/types/config/models-config-schema.d.ts

@@ -353,6 +353,7 @@ export declare const ProviderDiscoverySchema: z.ZodObject<{
         "lm-studio": "lm-studio";
         "models-dev": "models-dev";
         ollama: "ollama";
+        omlx: "omlx";
         "openai-models-list": "openai-models-list";
     }>;
     apiByModelPrefix: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
@@ -475,6 +476,7 @@ export declare const ModelsConfigSchema: z.ZodObject<{
                 "lm-studio": "lm-studio";
                 "models-dev": "models-dev";
                 ollama: "ollama";
+                omlx: "omlx";
                 "openai-models-list": "openai-models-list";
             }>;
             apiByModelPrefix: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{

package/dist/types/config/settings-schema.d.ts

@@ -103,6 +103,8 @@ type RecordValueDef = {
 } | {
     type: "string-enum";
     values: readonly string[];
+} | {
+    type: "credential-selector";
 };
 interface RecordDef<T> {
     type: "record";
@@ -132,6 +134,27 @@ export declare const SETTINGS_SCHEMA: {
         readonly type: "string";
         readonly default: undefined;
     };
+    readonly "auth.credentialRankingMode": {
+        readonly type: "enum";
+        readonly values: readonly ["balanced", "earliest-reset"];
+        readonly default: "balanced";
+        readonly ui: {
+            readonly tab: "providers";
+            readonly label: "Credential Ranking";
+            readonly description: "Choose balanced distribution or earliest-reset-first OAuth account selection.";
+        };
+    };
+    readonly "auth.credentialPins": {
+        readonly type: "record";
+        readonly default: Record<string, string>;
+        readonly valueSchema: {
+            readonly type: "credential-selector";
+        };
+    };
+    readonly "auth.credentialPinStoreIdentity": {
+        readonly type: "string";
+        readonly default: undefined;
+    };
     readonly "session.directoryMigration": {
         readonly type: "enum";
         readonly values: readonly ["copy-retain", "disabled"];
@@ -154,6 +177,12 @@ export declare const SETTINGS_SCHEMA: {
         readonly description: "SDK-owned prompt deadline; ACP has no separate timeout.";
         readonly validate: (value: number) => boolean;
     };
+    readonly "sdk.promptMaxRuntimeMs": {
+        readonly type: "number";
+        readonly default: 21600000;
+        readonly description: "Hard maximum runtime for an SDK prompt from acceptance, bounding progress-aware renewals.";
+        readonly validate: (value: number) => boolean;
+    };
     readonly "notifications.enabled": {
         readonly type: "boolean";
         readonly default: false;
@@ -330,7 +359,7 @@ export declare const SETTINGS_SCHEMA: {
         readonly ui: {
             readonly tab: "interaction";
             readonly label: "Terminal Bell";
-            readonly description: "Emit a BEL character for local terminal notifications. Windows Terminal may keep BEL silent depending on profile/system sound settings; use completion.notifyCommand for a PowerShell Console.Beep workaround.";
+            readonly description: "Emit a BEL character for local terminal notifications. macOS enables this by default unless explicitly disabled. Windows Terminal may keep BEL silent depending on profile/system sound settings; use completion.notifyCommand for a PowerShell Console.Beep workaround.";
         };
     };
     readonly "notifications.bellOnComplete": {
@@ -532,6 +561,11 @@ export declare const SETTINGS_SCHEMA: {
         readonly default: 1;
         readonly validate: (value: number) => boolean;
     };
+    readonly "gjc.ultragoal.nudgeBudget": {
+        readonly type: "number";
+        readonly default: 10;
+        readonly validate: (value: number) => boolean;
+    };
     readonly "theme.dark": {
         readonly type: "string";
         readonly default: "red-claw";
@@ -704,18 +738,18 @@ export declare const SETTINGS_SCHEMA: {
     };
     readonly "pet.mode": {
         readonly type: "enum";
-        readonly values: readonly ["off", "red", "blue"];
+        readonly values: readonly ["off", "red", "blue", "ouroboros"];
         readonly default: "off";
         readonly ui: {
             readonly tab: "appearance";
             readonly label: "Gajae Pet";
-            readonly description: "16x16 real-pixel gajae living beside the composer (sixel/kitty terminals)";
+            readonly description: "Real-pixel pet living beside the composer (sixel/kitty terminals)";
             readonly options: readonly [{
                 readonly value: "off";
                 readonly label: "Off";
                 readonly description: "No pet";
             }, ...{
-                value: "blue" | "red";
+                value: "blue" | "ouroboros" | "red";
                 label: string;
                 description: string;
             }[]];
@@ -1798,6 +1832,15 @@ export declare const SETTINGS_SCHEMA: {
             readonly description: "Show the interactive GitHub star reminder when gh is authenticated";
         };
     };
+    readonly "crashReport.nudge": {
+        readonly type: "boolean";
+        readonly default: true;
+        readonly ui: {
+            readonly tab: "interaction";
+            readonly label: "Crash Report Nudge";
+            readonly description: "At interactive startup, show one rate-limited line when unreported crash signatures exist. Reads local state only; nothing is ever transmitted without the explicit consent flow in `gjc crash report`.";
+        };
+    };
     readonly collapseChangelog: {
         readonly type: "boolean";
         readonly default: false;
@@ -3752,7 +3795,7 @@ export declare const SETTINGS_SCHEMA: {
         readonly ui: {
             readonly tab: "tasks";
             readonly label: "Prefer Task Delegation";
-            readonly description: "Encourage the agent to delegate work to subagents unless changes are trivial";
+            readonly description: "Encourage the agent to delegate work to subagents unless changes are trivial (on by default when executor/planner run on a different provider than the default role)";
         };
     };
     readonly "task.simple": {
@@ -3962,13 +4005,35 @@ export declare const SETTINGS_SCHEMA: {
         readonly type: "boolean";
         readonly default: boolean | undefined;
     };
+    readonly "skills.trustProjectSkills": {
+        readonly type: "boolean";
+        readonly ui: {
+            readonly tab: "customization";
+            readonly label: "Trust Project Skills";
+            readonly description: "Load skills from project .gjc/skills, .claude/skills, and .codex/skills. Set to false to ignore project-controlled skills while keeping user skills.";
+        };
+    };
+    readonly "skills.trustUserSkills": {
+        readonly type: "boolean";
+        readonly ui: {
+            readonly tab: "customization";
+            readonly label: "Trust User Skills";
+            readonly description: "Load skills from ~/.gjc/agent/skills (and legacy ~/.gjc/skills / <config>/skills). Set to false to ignore user-installed skills while keeping project skills.";
+        };
+    };
     readonly "skills.enablePiUser": {
         readonly type: "boolean";
-        readonly default: boolean | undefined;
+        readonly ui: {
+            readonly tab: "customization";
+            readonly label: "Trust User Skills (legacy)";
+        };
     };
     readonly "skills.enablePiProject": {
         readonly type: "boolean";
-        readonly default: boolean | undefined;
+        readonly ui: {
+            readonly tab: "customization";
+            readonly label: "Trust Project Skills (legacy)";
+        };
     };
     readonly "skills.customDirectories": {
         readonly type: "array";
@@ -4313,7 +4378,7 @@ export declare function getPathsForTab(tab: SettingTab): SettingPath[];
 export declare function getType(path: SettingPath): SettingDef["type"];
 /** Get enum values for an enum setting */
 export declare function getEnumValues(path: SettingPath): readonly string[] | undefined;
-export declare const CONFIG_SCHEMA_VERSION = 1;
+export { CONFIG_SCHEMA_VERSION } from "./config-schema-version";
 export type SettingsSchemaIssue = {
     path: string;
     kind: "unknown" | "invalid" | "coerced" | "pending-migration";
@@ -4549,4 +4614,3 @@ export interface GroupTypeMap {
     notifications: NotificationsSettings;
 }
 export type GroupPrefix = keyof GroupTypeMap;
-export {};

package/dist/types/config/settings.d.ts

@@ -1,3 +1,15 @@
+/**
+ * Settings singleton with sync get/set and background persistence.
+ *
+ * Usage:
+ *   import { settings } from "./settings";
+ *
+ *   const enabled = settings.get("compaction.enabled");  // sync read
+ *   settings.set("theme.dark", "red-claw");              // sync write, saves in background
+ *
+ * For tests, `Settings.isolated()` seeds explicit user/global settings:
+ *   const isolated = Settings.isolated({ "compaction.enabled": false });
+ */
 import type { ModelRole } from "../config/model-registry";
 import { type NotificationSettingsReader, type NotificationSettingsSnapshot } from "../sdk/bus/config";
 import { AgentStorage } from "../session/agent-storage";
@@ -11,6 +23,25 @@ export * from "./settings-schema";
 export interface RawSettings {
     [key: string]: unknown;
 }
+/**
+ * Test-only seams for the config-root workflow migration. Production code
+ * never sets these; tests use them to interleave external filesystem changes
+ * at exact points of the migration state machine (mirroring
+ * `FileLockTestHooks` in file-lock.ts).
+ */
+export declare const SettingsMigrationTestHooks: {
+    /** Fires after the no-replace backup copy is created and its identity
+     * (inode + sha256) has been captured, immediately before the source is
+     * re-hashed for the move verification. */
+    afterBackupIdentityCaptured?: (backupPath: string) => void | Promise<void>;
+    /** Fires after a quarantined backup is verified as this run's file,
+     * immediately before the quarantined entry is unlinked. */
+    beforeQuarantineRemoval?: (backupPath: string) => void | Promise<void>;
+    /** Fires immediately before the project migration's POST-publication marker
+     * re-read, after the migrated values already committed: test seams use it
+     * to make the marker unreadable so the rollback path is exercised. */
+    beforeProjectMarkerMerge?: () => void | Promise<void>;
+};
 export type SettingsAtomicPatch = {
     path: SettingPath;
     op: "set";
@@ -29,6 +60,13 @@ export interface SettingsOptions {
     inMemory?: boolean;
     /** Initial overrides */
     overrides?: Partial<Record<SettingPath, unknown>>;
+    /**
+     * Read the canonical config.yml from disk but never persist: no DB open,
+     * no legacy/config-root/project migrations, no file writes, renames, locks,
+     * or mtime changes. Used by read-only inspection surfaces (`gjc customize
+     * doctor`). When true, inMemory must be false so config.yml is still read.
+     */
+    readonly?: boolean;
 }
 /** Additional layer setup for {@link Settings.isolated}. */
 export interface IsolatedSettingsOptions {
@@ -56,6 +94,19 @@ export declare class Settings implements NotificationSettingsReader {
         cwd: string;
         agentDir?: string;
     }): Promise<Settings>;
+    /**
+     * Load settings for read-only inspection without any persistence side-effects:
+     * no DB open, no legacy/config-root/project migrations, no file writes,
+     * renames, locks, or mtime changes. Reads the canonical config.yml and
+     * discovers/merges project settings exactly like the durable path, but the
+     * result is a transient snapshot. Does not affect the global singleton.
+     *
+     * Used by `gjc customize doctor` to honor the read-only product contract.
+     */
+    static loadReadonly(options: {
+        cwd?: string;
+        agentDir?: string;
+    }): Promise<Settings>;
     /**
      * Create an isolated instance for testing with explicit user/global settings.
      * Does not affect the global singleton.
@@ -195,6 +246,18 @@ export declare function isSettingsInitialized(): boolean;
  * @internal
  */
 export declare function resetSettingsForTest(): void;
+/**
+ * Ensure the one-time legacy workflow settings migrations have run for `cwd`
+ * before a workflow runtime resolves settings. The direct CLI commands
+ * (`gjc ralplan`, `gjc deep-interview`, `gjc ultragoal`) never initialize
+ * Settings, so without this the project `.gjc/settings.json` and config-root
+ * `settings.json` workflow keys would silently fall back to defaults after the
+ * resolver stopped reading settings.json. No-op when the global Settings
+ * singleton is already initialized (session path). Best-effort: a settings
+ * load failure must not block the native command, whose resolver falls back to
+ * defaults exactly as before.
+ */
+export declare function ensureWorkflowSettingsMigrated(cwd: string): Promise<void>;
 /**
  * The global settings singleton.
  * Must call `Settings.init()` before using.

package/dist/types/config/skill-settings-defaults.d.ts

@@ -4,11 +4,37 @@ export interface SkillDiscoverySettings {
     enableCodexUser?: boolean;
     enableClaudeUser?: boolean;
     enableClaudeProject?: boolean;
+    /**
+     * User-facing trust controls for filesystem-discovered skills. Discovery is
+     * on by default: a valid skill placed in a documented project or user
+     * location is loaded without extra configuration ceremony. Setting either of
+     * these to `false` disables that scope while leaving the other scope (and
+     * the `skills.enabled` master switch) intact.
+     *
+     * `enablePiUser` / `enablePiProject` are deprecated legacy aliases for the
+     * same effective setting: an explicitly configured legacy value is honored
+     * only when the corresponding trust flag is not configured.
+     */
+    trustProjectSkills?: boolean;
+    trustUserSkills?: boolean;
+    /** @deprecated Legacy alias for `trustUserSkills`. */
     enablePiUser?: boolean;
+    /** @deprecated Legacy alias for `trustProjectSkills`. */
     enablePiProject?: boolean;
     customDirectories?: string[];
     ignoredSkills?: string[];
     includeSkills?: string[];
 }
+/** Default trust for a skill scope when neither the trust flag nor its legacy alias is configured. */
+export declare const DEFAULT_SKILL_SCOPE_TRUST = true;
+/**
+ * Resolve whether a skill scope is trusted, honoring the user-facing trust flag
+ * first and the deprecated `enablePiUser` / `enablePiProject` aliases second.
+ *
+ * Because both settings are optional (`undefined` when unconfigured), an
+ * explicitly configured legacy value keeps working, and a fresh install with no
+ * configuration resolves to the zero-config default (`true`).
+ */
+export declare function resolveSkillScopeTrust(settings: Pick<SkillDiscoverySettings, "trustProjectSkills" | "trustUserSkills" | "enablePiUser" | "enablePiProject">, scope: "project" | "user"): boolean;
 export declare const DEFAULT_SKILL_DISCOVERY_SETTINGS: SkillDiscoverySettings;
 export declare const DEFAULT_DISABLED_EXTENSIONS: string[];

package/dist/types/config/task-delegation.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Vendor-separated delegation policy.
+ *
+ * A model profile that pins worker roles (`executor`, `planner`) to a provider
+ * other than the main `default` role exists to move heavy implementation onto
+ * that other provider's quota. That only pays off when the main agent actually
+ * delegates, and the strong delegation directive is gated behind `task.eager`,
+ * whose schema default is `false`. Such a layout therefore used to run
+ * everything on the main provider with no signal at all.
+ *
+ * Vendor separation now implies eager delegation unless `task.eager` is
+ * configured explicitly, in which case the user's value always wins.
+ */
+import type { ModelProfileDefinition, ModelProfileRole } from "./model-profiles";
+import { type ModelSelectorValue } from "./model-selector-value";
+import type { Settings } from "./settings";
+/** Worker roles whose provider separation expresses delegation intent. */
+export declare const VENDOR_SEPARATION_WORKER_ROLES: readonly ["executor", "planner"];
+export type VendorSeparationWorkerRole = (typeof VENDOR_SEPARATION_WORKER_ROLES)[number];
+export type RoleSelectorMap = Partial<Record<ModelProfileRole, ModelSelectorValue>>;
+/** Worker roles pinned to a provider other than the `default` role's provider. */
+export declare function findVendorSeparatedWorkerRoles(mapping: RoleSelectorMap): VendorSeparationWorkerRole[];
+export interface EagerTaskDelegationInput {
+    settings: Settings;
+    /** Active profile, when its bindings are not (yet) installed into settings. */
+    profile?: ModelProfileDefinition;
+}
+/**
+ * Effective role selectors: profile mapping as the baseline, installed settings
+ * bindings on top, since profile activation writes into those same settings.
+ */
+export declare function collectEffectiveRoleSelectors(input: EagerTaskDelegationInput): RoleSelectorMap;
+export interface EagerTaskDelegation {
+    eagerTasks: boolean;
+    vendorSeparatedRoles: VendorSeparationWorkerRole[];
+    /** Vendor-separated workers that an explicit `task.eager false` keeps unused. */
+    suppressedByExplicitSetting: boolean;
+}
+export declare function resolveEagerTaskDelegation(input: EagerTaskDelegationInput): EagerTaskDelegation;