@gajae-code/coding-agent 0.15.1-nightly.20260823084028.32692335596.g28e375925cf5 → 0.15.2

package/CHANGELOG.md

@@ -2,29 +2,97 @@
 
 ## [Unreleased]
 
-## [0.15.0] - 2026-08-22
+## [0.15.2] - 2026-08-25
+
+### Changed
+
+- Version 0.15.1 was tagged but never published: release automation failed while deriving release notes, before any package reached npm. Everything listed under `## [0.15.1]` below ships in this release.
+
+## [0.15.1] - 2026-08-25
+
+### Added
+
+- Added `/language [en|ko]`, the interactive slash command for the persisted `ui.language` selection. Without arguments it reports the current language; with a canonical code, locale tag (`en-US`, `ko-KR`), endonym (`한국어`), English name, or common aliases (`eng`, `kr`, `kor`) it persists the canonical `en`/`ko` value through settings and confirms in the selected language. An unsupported value is rejected with the available list and changes nothing. See `docs/ui-language.md`.
+- Added a persisted, owner-directed `ui.language` selector for human-facing settings chrome, with deterministic English fallback and an independently authored initial Korean catalog. Commands, flags, environment variables, canonical values, JSON, and other protocol output remain unchanged. Localization-boundary guidance was informed by the unofficial, unaffiliated MIT-licensed community patch [`yazzang-homelab/gajae-code-ko@aff1bfa`](https://github.com/yazzang-homelab/gajae-code-ko/commit/aff1bfa097789a8e2f13349da3c7f99b008d93b6). (#4919)
+- Added frictionless interactive onboarding for unresolved users and `/tutorial`. GJC now performs bounded, local metadata discovery across known coding-agent roots, requires corroborating activity within 90 days before inferring a workflow, falls back to manual guidance when evidence is insufficient, persists only a derived profile and completion decision, discloses unavailable sources, and previews the guided migration result before a single explicit apply or experienced-user skip.
+- vLLM servers are now discovered implicitly at `http://127.0.0.1:8000/v1`, the same zero-config UX as Ollama, LM Studio, and oMLX. The existing descriptor lane remains authoritative so implicit discovery does not race or replace authenticated/custom vLLM discovery evidence. Credentialless discovery is loopback-only; trusted shell/user-env `VLLM_BASE_URL` plus `VLLM_API_KEY`, or an explicit `models.yml` provider entry, supports remote servers. Adds `discovery.type: "vllm"`.
+- SGLang servers are now discovered implicitly at `http://127.0.0.1:30000/v1`, the same zero-config UX as Ollama, LM Studio, oMLX, and vLLM. The existing descriptor lane remains authoritative so implicit discovery does not race or replace authenticated/custom SGLang discovery evidence. Credentialless discovery is loopback-only; trusted shell/user-env `SGLANG_BASE_URL` plus `SGLANG_API_KEY`, or an explicit `models.yml` provider entry, supports remote servers. Adds `discovery.type: "sglang"`.
+- Standalone GitHub release binaries now publish `gajae-release-binaries-v1.json` and `gajae-release-binaries.sha256` so installers and `gjc update` can verify downloads.
+
+### Changed
+
+- End-user install and `gjc update` are standalone-binary-first and do not require Bun. `scripts/install.sh` / `install.ps1` default to the current platform GitHub release (stable, `--channel nightly`, or `--ref <tag>`), never detect or download Bun, and keep `--source` as an explicit development path that requires an already-installed Bun. `gjc update` resolves channels from GitHub releases, atomically replaces a matching binary, migrates package-manager shims to a user binary path instead of overwriting them, and refuses to self-overwrite source checkouts or `dev:link` executables.
+- The five `macOS Local (oMLX)` presets are retuned from same-machine throughput measurements (#4871). All presets now use one role-effort ladder — critic and architect `high`, planner `medium`, executor and default `low` — and pick each preset's model by measured local throughput: `fast` keeps the 4-bit and `balanced` the 8-bit Qwen 3.6 35B A3B MoE quants (93.5 / 71.1 tok/s measured), `quality` keeps the 8-bit MoE for default/executor/planner/architect and routes only the critic to the official dense `Qwen3.8-27B-8bit` checkpoint (public SWE-bench/agent scores still favor dense for criticism), and both `abliterated` presets move to the faster `Qwen3.8-27B-Uncensored-MLX-4bit` (19.8 tok/s measured, ahead of the Abliterated 4-bit/6-bit quants on every measured axis). Preset display names now state the measured throughput instead of the memory-tier hints.
+
+### Fixed
 
+- Onboarding language detection (`/tutorial`, first-run onboarding) no longer misreads English or Korean transcripts as French, Spanish, or German. Word evidence for space-delimited languages is matched on token boundaries instead of substrings — `le`/`la`/`el` used to match inside `file`, `please`, `class`, and `help`, so plain English handed French a majority — Korean, Japanese, and Chinese are identified by script instead of particle substrings, script counts and word hits share one ranking so two Hangul or Han characters cannot override a clearly English transcript, a claimant script needs two characters before it may claim mixed han text so one stray Hangul or kana glyph cannot erase dominant han evidence, a language must lead the runner-up outright to beat the OS locale, and an explicit `ui.language` selection outranks both. `/language` also accepts locale tags such as `en-US` / `ko-KR` and now rejects hostile inputs that used to resolve to inherited object properties (`__proto__`, `constructor`) instead of canonical `en`/`ko`.
+- `ask` question wording and option labels no longer use the post-resample U+2014 display-text exemption because accepted calls enter durable session history and deep-interview rounds; genuinely display-only tool fields retain the existing exemption (#4926).
+- Gajae Pet now treats forwarded `LC_TERMINAL=iTerm2` and `TERM_PROGRAM=iTerm.app` values as probe hints over SSH, enabling iTerm2 only after an active OSC 1337 File-capability reply. Generic SSH, spoofed/noninteractive/CI environments, and unmanaged tmux/screen/zellij nesting remain on the text fallback; verified Kitty and Sixel keep precedence. (#4911)
+- Interactive terminal completion now publishes the local `agent_end` boundary before waiting for the ordered coordinator sidecar write, so slow or lock-hostile WSL drvfs mounts cannot leave the foreground activity indicator and composer busy after a turn has completed. Coordinator persistence ordering and extension delivery remain unchanged. (#4741)
+- One unresponsive session host can no longer own SDK Router startup. A host whose listener still accepts while its loop never serves answers nothing, and `SessionRouter.start()` awaited the initial attach pass, so startup cost the sum of every such session's request budget: measured at 40.7s of a 40.9s startup for a single spinning host, against the 10s budget `gjc sdk session list` gives startup — every SDK CLI call on that agent directory failed with `SDK session Router startup timed out` while eleven healthy sessions had attached in under 200ms combined. `start()` now bounds the initial pass (5s) and lets it finish in the background, and an attach replay whose frame was dispatched and left unanswered (`uncertain_after_send`) no longer runs the 3-retry ladder against a peer that cannot answer any of them. Per-request replay budgets are unchanged, so a host that is legitimately slow — settling a cancellation grace, for example — is not cut off; the periodic 2s reconcile keeps converging stragglers. Measured on the same workspace: startup 40.9s to 5.1s.
+
+- Telegram polling no longer wedges behind a deleted private-chat `forum_topic_created` update. Definitive missing-topic `400` responses from the adoption picker now consume the stale update, remove only its matching pending-topic sidecar, and let the ordered poll offset advance; rate limits, network/server failures, authentication failures, and ambiguous responses remain retryable. (#4904)
+- Quota and rate-limit exhaustion now keep AuthStorage's already-computed unblock instant on the terminal provider error as `retryable at <ISO-8601>`. All-row exhaustion still surfaces immediately with no wait and no extra retry loop (#4908).
+- ACP sessions re-register reverse providers when a permission lease expires or the same client reattaches. Guarded tools no longer fail permanently with `no permission provider is connected` after the reverse-lease TTL/reclaim grace lapses on a still-living session (#4909).
+
+- `gjc --worktree` now runs the declared Bun, npm, or pnpm frozen install in workspace launch worktrees instead of linking the origin checkout's `node_modules`. Workspace imports and install mutations are bound to the worktree's own lockfile and checkout, including reuse of worktrees carrying the legacy source-tree link (#4620).
+- Custom OpenAI-compatible models now expose and send reasoning levels only when their transport capability is known or explicitly opted in. Arbitrary proxies no longer inherit a universal `reasoning_effort` assumption from `reasoning: true`; `compat.supportsReasoningEffort: false` keeps the selector, persisted effort controls, and outbound payload aligned, while bundled OpenRouter, OpenCode, Kilo, and other audited provider routes retain their existing reasoning controls (#4903).
+- Late conventional MCP connections publish into the active session registry through an ordered, failure-isolated chain: concurrent late snapshots can no longer interleave a stale tool list, one failed publication no longer kills every later one, and mixed plugin + conventional sessions re-seal the fixed connection set once the last conventional server settles instead of staying reloadable.
+- User skill discovery now follows the active `agentDir` profile, matching MCP and customization writers instead of silently reading the default home-relative profile. The bundled `deep-interview` trigger no longer claims explicit third-party Ouroboros commands.
+- `gjc setup hermes` no longer hardcodes the Hermes MCP client timeouts. New `--timeout` / `--connect-timeout` flags (whole seconds, 1–3600, exit 2 on anything else) override the 180/60 defaults, and `--install` now preserves existing numeric `timeout` / `connect_timeout` values from a GJC-marked block per field when the flag is omitted — a hand-set `timeout: 900` survives re-installs instead of being reset to 180 (#4878). The managed setup signature no longer pins those two operator knobs (hand-tuning keeps the block managed and `--check` no longer flags timeout drift), and unmarked blocks keep the existing refusal and `--force` full-overwrite behavior. Docs/help now state these are host MCP client call budgets — not GJC turn deadlines and not the coordinator per-call caps (`watch_events` 30000 ms; `await_turn` 30 minutes). Upgrading a pre-#4878 install: a block still matching its stored signature is re-signed on the next `--install`; a hand-tuned legacy block is refused with a dedicated stale-signature error pointing at `--force` (which preserves the tuned values); `--profile-dir` targets holding an older operator-instructions render need one `--force` because that file's digest pins its exact content. Unpreservable values (non-numeric or out of range) fall back to defaults with an explicit warning instead of being written through.
+
+- Bumped Telegram daemon durable authority to generation 176 after the SDK lifecycle changes modified protected broker declarations. Older generation-175 daemons are now unattachable by this host, preserving fail-closed discovery and launch ownership across rolling upgrades (#4668).
+- Gajae Pet now stays reachable in tmux and image-protocol-free SSH clients through a bounded two-row text-cell rendering. The fallback derives conservative Block Elements from the active skin, uses truecolor when available and ANSI-256 otherwise, reserves no extra transcript rows, and retains the pixel renderer unchanged for supported Kitty, Sixel, and iTerm2 terminals (#4867).
+- `gjc setup hermes --gjc-command` now accepts the full server command instead of always appending `mcp-serve coordinator` (#4877). Omitted or single-token values stay executable-only and render byte-identically to previous output (`gjc`, `/opt/gjc` + `args: [mcp-serve, coordinator]`); a multi-token value is the complete command, split quote-aware (single/double quotes, backslash escapes) into controller argv and rendered verbatim with nothing appended — `--gjc-command 'python3 /tmp/gjc-wrapper.py'` now emits `command: python3`, `args: [/tmp/gjc-wrapper.py]`, exactly the shape a wrapper that already execs `gjc mcp-serve coordinator` needs instead of the doubled argv tail it previously received. Unbalanced quotes are rejected with an explicit error; the value is tokenized, never shell-evaluated. Setup signatures are computed from the rendered block, so existing installs and idempotent re-installs remain valid.
+
+- Corrected the session-state lock recovery contract documented for 0.15.0: valid dead regular state owners are reclaimed automatically, while foreign, unqualified, malformed owners and post-crash atomic transition directories remain fail-closed for explicit operator recovery.
+- Python kernel reuse is once again keyed on the settings values that shape a kernel, not on `Settings` object identity. Binding built-in executors to session settings (#4826) made `scopedSessionId` suffix each kernel key with a per-instance counter, so two logical sessions in one process — which resolve the same shell configuration and therefore spawn byte-identical kernels — each started their own kernel, and disposing one shut down a kernel the other still owned. The scope is now a fingerprint of the resolved shell config (shell, args, environment), so equivalent settings share one retained kernel while genuinely different shell environments stay isolated.
+- Flat Telegram private-chat idle markers now carry a short per-session tag (`🟢 Agent idle · <tag>`), because the flat fallback has no topic to identify which session went idle (#4855). Asks and threaded/topic delivery are unchanged, preserving the identity-once contract from #981; the tag is the last six characters of the session id and no full session id is ever rendered. The discarded `sessionTag` parameter threaded through `buildRedactedAction`, `notificationActionPayload`, and `NotificationPresentationEngine` — computed but never consumed anywhere — was removed.
+
+## [0.15.0] - 2026-08-22
 
 ### Added
 
+- Added `router.SessionRouter.generationStatus(sessionId, endpointGeneration)`, a public credential-free exact-generation reconciliation predicate for managed SDK consumers. It returns deterministic `current`, positively evidenced `retired`, live-generation `replaced`, or fail-closed `unknown` results without exposing endpoint URL/token credentials, process IDs, locators, or private Broker payloads. Close/delete proof is durable across Router and Broker restart within the bounded session-index retention policy; unavailable/incomplete reconciliation, expired history, ambiguous authority, and detected generation reuse remain unknown (#4848).
+- The bundled `autoresearch` skill now cooperatively drives missions through GJC goal mode: after spec or cold-intake persistence, the agent creates or resumes a matching inline goal so the continuation loop nudges the mission to a structured verdict receipt. Active or paused goals owned by another objective suppress creation and remain untouched; inconclusive means `status.disposition: "inconclusive"`, while only `status.disposition: "conclusive"` requests mission auto-clear after goal completion. Manual clear, handoff, and cancel require the agent to drop only the mission's own nonterminal goal when the runtime permits it; generic goal guards, aborts, and handoffs can leave state open, so failed steps are surfaced and retried on re-entry without rewriting completed goals as dropped. Verdict writes are append-only and not idempotent, so uncertain retries must inspect the latest receipt before issuing another verdict. Instruction-only: no runtime code, config keys, guards, or `ask` blocking.
 - Added an SDK `automationTools` option for host-owned `browser` and `computer` implementations. External automation retains built-in activation and provenance, receives the normal abort signal, works independently of the default browser/platform gates, and fails closed on custom, extension, or MCP name collisions (#4809).
 - Added opt-in Task autorouting that derives deterministic `fast`, `balanced`, and `strong` model tiers from declared provider priority. Tier generation is catalog-scoped and auth-independent, `/routing` opens the smart-routing setup panel, and bounded preflight evidence records candidate skips and acceptance outcomes.
 
 ### Changed
 
+- `macos-omlx-quality` now routes every role through `omlx/Qwen3.6-35B-A3B-8bit` instead of the BF16 checkpoint, retaining the profile's higher reasoning-effort ladder while reducing the local model footprint and improving measured generation throughput on its M5 Max 128 GB target. The preset group label now uses the branded `macOS Local (oMLX)` casing throughout the public profile picker.
 - Upgrade note: restart the SDK broker after upgrading (`gjc sdk` callers pick this up automatically on the next launch; an already-running daemon does not). This release adds the `model.resolve` broker operation, and the broker discovery record carries no package-generation fence — a daemon left running from an earlier version keeps serving and answers the new operation with `unknown_operation`, so coordinator `model` pins (`gjc_coordinator_start_session`) fail until it is replaced. Verified against a live daemon: the failure is loud, no session is created, and one broker restart clears it.
 - Closed the remaining Sentry triage approval races: `gh` is resolved only from trusted system paths, acknowledgement rechecks and records under the creation lock, pending-create reconciliation uses a per-attempt nonce with compare-and-clear, and malformed timestamp suffixes fail ingestion before rendering. Regression coverage pins the retry/apply interleaving so a newer unresolved create cannot be cleared by an older `--retry-pending` request.
 
 - The SDK session index now self-repairs on append when it finds a corrupt suffix, instead of throwing `Cannot append to corrupt session index log` until an operator runs `gjc gc --repair-session-index`. The inline path reuses the same quarantine-backed repair (evidence preserved under `sessions/quarantine`, valid prefix republished), so a single poisoned row — e.g. a stale long-lived broker signing a `lifecycle_terminal` event against an outdated `indexSeq` — no longer wedges every subsequent session launch in that agent dir; the manual `gc` flag remains for non-converging damage.
 - Breaking: removed `task.autorouting.preset` and the autorouting preset layer. Preset-only autorouting configuration is inactive until tiers are generated from smart-routing setup; public routing contracts no longer expose preset/source fields, and routing notes contain tier, fallback, and resume components only.
 - Autorouting selectors now use one shared provider-qualified grammar and 256-character bound across runtime validation, generated tiers, routing evidence, and JSON Schema. Settings-derived tiers report provenance only when the provenance is valid; malformed provenance fails closed as hand-authored tiers.
+
+### Fixed
+
+- Cleanly exiting foreground turns now settle on filesystems such as CephFS that reject Linux `renameat2` exchange/no-replace. State owners rewrite their identity-verified, machine-qualified records into reusable PID-1 compatibility tombstones, while transition ownership uses atomic `mkdir`/`rmdir` with a validated sidecar; no live release unlinks a pathname that a successor can race. Foreign, unqualified, malformed, and all post-crash state/transition owners remain fail-closed for explicit operator recovery.
+- Telegram inbound reaction acks now stay serialized per update id when an earlier ack settles while a later one is still in flight. `InboundReactionSequencer` deleted the per-update chain unconditionally on settle, so a fast `accepted` ack settling dropped the tail an in-flight `consumed` transition had installed, and the next transition for that update chained onto a fresh promise and ran concurrently — letting a replayed queued marker race the terminal consumed marker the sequencer promises can never be overwritten. The chain delete is now identity-guarded, matching the router's other serialization tail-maps, and tombstone eviction tracks the maximum terminal update id so reverse-order effect completion cannot grow the retained map without bound.
+- The Sentry triage approval store (`scripts/sentry-crash-issues.ts`) now works on Windows without weakening its local approval boundary. Windows store directories, files, and lock metadata receive and verify native protected owner-only DACLs bound to retained filesystem identities instead of relying on synthetic POSIX mode bits; reads use an identity-checked handle, so reparse or pathname substitution fails closed. Lock acquisition now publishes a fully initialized candidate through the native atomic no-replace rename primitive instead of classifying Windows `EPERM` from ordinary directory replacement, stale owners are displaced only after definitive process absence, and cleanup uses an exact native directory-tree snapshot so a successor lock cannot be removed through the stale-owner pathname.
+- `Esc` abort with a cleanup budget now actually recovers the session when a provider stream ignores its abort signal. After the budget fired and the agent was force-aborted, the abort still awaited the aborted-turn drain, which waits on the wedged prompt's in-flight count — a count that only drops when the wedged `agent.prompt(...)` settles, which force-abort does not make happen. The abort therefore never released its unwind, and every later prompt, message, and abort waited on that unwind forever: a permanent input lockout announced as "forced session recovery". Forced recovery now abandons the exact prompts that were in flight when it fired (tracked by identity, since prompts overlap and do not settle FIFO): the aborted-turn drain and the agent_end defer/flush gates stop waiting on abandoned prompts, the forced terminal `agent_end` publishes instead of parking behind them, and an abandoned prompt that does settle later still cleans up after itself. A bounded abort that piggybacks on an earlier unbounded abort's unwind also no longer discards its own budget: it races the shared unwind and forces the same recovery on the first abort's behalf, so a user `Esc` issued while an extension- or tool-initiated abort is wedged can still recover the session.
+- Terminal `agent_end` now retires the foreground `Working…` indicator even when the mutable session streaming flag settles late. The terminal event remains authoritative across later background-task refreshes, while the next `agent_start` re-enables normal streaming activity.
+- Bash tool globs with a trailing separator (`pattern*/`) now match directories only, and literal components after a glob (`*/name`) now require the resulting path to exist, matching bash/POSIX pathname expansion. The vendored shell's expander appended post-glob literal components (including the empty component a trailing `/` splits into) without any filesystem check, so `LICENSE*/` matched the plain file `LICENSE`, `ls -d */` received file arguments and exited 1, `for d in */` iterated over files, and `*/absent` fabricated paths that were never on disk. Directory checks follow symlinks (matching bash `*/` semantics) while literal-suffix existence uses lstat (dangling symlinks still match); patterns whose last component is itself a glob are unchanged since their matches come from directory reads.
 - Workflow handoffs out of autoresearch now transit properly: `/skill:deep-interview`, `/skill:ralplan`, and `/skill:ultragoal` chain from any live autoresearch phase (`intake`/`research`/`verdict`), and ralplan's `final` phase chains via its manifest terminal states; ralplan/ultragoal live phases still require the explicit write-to-handoff step. `gjc autoresearch clear` remains the finalize-only exit.
+- The coordinator idle reaper now judges idle eligibility against the durable WAL's turn activity watermark (`recovery.prompt_watermark_at`, falling back to the session's creation stamp for turn-less sessions) instead of the projection session-state stamp. Projection repair (and any failed close admission) rewrites that state file with a fresh `now` stamp, which reset the idle clock after every failed `session.close` and deferred the reaper's same-key retry by a full idle TTL. The reaper retry contract (`coordinator-reap:<session>:<incarnation>` key reuse) holds again, and an ephemeral session older than the TTL whose last turn completed recently is no longer reapable between turns; the projection stamp remains the fallback only for sessions whose WAL cannot be read. The `stop-session` and `send-prompt-concurrency` lifecycle suites were also re-based onto the post-#4731 durable layout (canonical WAL + namespaced projections; broker `session.create` mocks echo `coordinatorSidecarKeyId`), restoring them to the required CI set (#4835).
 - Breaking: autoresearch spec intake is now the explicit `intake` verb (`gjc autoresearch intake --spec <path>`; the bare `--spec` flag form still works). The ambiguous `handoff` verb token is rejected with disambiguation hints instead of silently becoming a cold-intake goal — workflow handoff lives at `/skill:<callee>` (or `gjc state autoresearch handoff --to <callee>`).
 - Subagents now start correctly on Bun 1.4 when extension tools provide custom renderers. `RegisteredToolAdapter` installs its renderer adapters before proxying the definition, avoiding a write through the proxy's getter-only property while preserving the no-renderer fallback path.
 
 ### Fixed
 
+- Added a fail-closed recursive-deletion boundary to test preloads: recursive cleanup now derives the real home from the account database rather than mutable HOME/TMPDIR values, accepts the supported `/tmp` and `/var/tmp` fixture roots only when they are disjoint from that home, refuses roots, shallow or symlink-escaping targets and unowned paths, and determines Darwin case handling from filesystem evidence; HOME-sensitive fixtures use the safe cleanup contract and static scan, while runtime interception aborts unsafe Bun test processes without touching the target (#4794).
+- `sdk session tail --until-idle` now reconciles retained replay and live lifecycle events that carry a `(generation, seq)` position by that canonical order instead of arrival order, so a retained terminal event from an earlier turn no longer completes a newer turn that is still active, and a terminal event observed live is no longer undone by replayed history arriving after it. Positioned event items are emitted canonically ahead of an arrival-ordered segment of events carrying no position; such an event stays visible but cannot supersede a positioned turn state, including for live Router frames without a publication position. Different lifecycle kinds claiming one `(generation, seq)` now fail closed with `protocol_error` instead of letting arrival order decide, and that conflict outranks an otherwise successful idle or close completion. A canonical position must be a pair of non-negative safe integers, checked on the raw replayed event-ring row before projection: a row stating either coordinate property must state both validly, so claiming one coordinate only, or a null, negative, fractional, non-finite, or unsafe-integer coordinate, fails closed with `protocol_error` rather than being silently treated as unpositioned. Only a row stating neither coordinate is unpositioned. Retained transcript entries now deduplicate independently of event-ring rows, so a transcript row projecting the same kind and position as a real event no longer suppresses that event's lifecycle or conflict evidence. `session status <sessionId> <opRef>` remains the lossless authority for a specific prompt operation; a bare live tail otherwise remains attached until its timeout unless the session closes.
+
+- `gjc plugin uninstall --dry-run` no longer performs the uninstall it was asked to preview. `plugin.ts` parsed `--dry-run` but `handleUninstall` never received it, so a preview removed the plugin through all three uninstall paths and reported `Uninstalled` — most visibly `gjc plugin uninstall <name>@<marketplace> --scope user --dry-run --json`, which deregistered the plugin and deleted its cache. Preview is now a separate read-only API per path rather than an early return inside the mutating one, so under `--dry-run` the handler only ever reaches code that cannot write: `previewGjcBundleUninstall`, `MarketplaceManager.resolveUninstallTarget`, and `PluginManager.previewUninstall`. Each resolves and validates exactly what the real uninstall would act on — GJC registry entry and installed-root containment, marketplace target lookup with scope disambiguation and cache-path validation, npm package-name validation — so a preview refuses whatever the real uninstall refuses. The uninstall entry points keep their existing signatures and result shapes.
+- A `gjc plugin uninstall --dry-run` for *any* target no longer migrates the GJC plugin registry. GJC-bundle classification runs before a target is selected, so it read the registry for every uninstall target — including npm and marketplace names that never reach the GJC path — through a migrating read that persists legacy-root discovery under the scope lock. With a legacy bundle present at `<cwd>/.gjc/gjc-plugins/<name>` (files on disk, no registry entry), a dry run for an unrelated npm name created and wrote `registry.json` in project scope. Preview classification now uses `readEffectiveRegistryUnpersisted`, which applies legacy discovery and entry migration in memory only: the preview still sees the same entries the real uninstall would act on, without persisting them and without taking the lock (acquiring it would itself create the scope root and a lockfile). Real uninstalls keep the migrating read.
+- An unreadable (corrupt) GJC scope registry now makes `gjc plugin uninstall` fail closed for *any* target, dry-run or real. Classification previously skipped an unreadable scope as non-ownership and fell through to the marketplace/npm branches, so a corrupt registry that actually owned the requested name could preview — and the real command could then remove — a same-named marketplace or npm plugin the user never targeted. The refusal is a typed error naming the unreadable scope with a repair hint; nothing is removed while ownership is unknown. The exported mutating GJC uninstall API keeps its historical `invalid_target` result for a malformed registry; only the read-only preview surfaces the internal `registry_unreadable` signal the CLI fails closed on.
+- `gjc plugin uninstall <name>@<marketplace> --json` now emits JSON instead of the human `✔ Uninstalled …` line, which the marketplace branch printed even in JSON mode.
 - Fixed long skill-HUD entries corrupting bottom-pinned TUI row accounting by emitting at most two independent width-bounded rows and preserving severity glyphs through narrow truncation.
+- Image generation now receives the owning session's settings through direct, TUI, tmux, and coordinator/sub-session tool contexts, so `modelRoles.image` resolves for Codex image models without consulting mutable global state (#4826).
 
 - SDK `goal.list/get` no longer reports `resource_gone` when an in-flight session's live goal projection is temporarily unavailable. It recovers the latest authoritative goal mode state from the current session branch after runtime recreation or session replacement, while goal-less sessions return an explicit `no_active_goal` diagnostic instead of being confused with snapshot-store loss (#4824).
 
@@ -34,6 +102,8 @@
 - Queued SDK prompts now retain their dispatch-time ownership across selection fences instead of reclassifying from a contradictory later streaming snapshot. Fresh promotion, earlier follow-up ordering, and terminal-abort cancellation are reachable again, while `/btw` test fixtures now model the user-drainable queue count required by the current empty-submit contract.
 - Coordinator stop and idle-reap now initialize canonical namespace state before reading durable deletion recovery. Fresh or upgraded projection-only sessions were misreported as `state_corrupt` before the broker close was attempted, and completed deletion receipts were excluded from the idempotent missing-session lookup; both paths now preserve strict malformed-state rejection while allowing safe cleanup and replay.
 - Fixed provider safety-stop classification being lost before session persistence (#4777). The managed provider-envelope boundary now preserves only the allowlisted `provider_safety_stop` kind, typed safety stops remain terminal even with transport facts on a multi-model fallback chain, and the regression e2e test is selected both by the focused affected-path route and exactly one normal coding-agent shard.
+- A forged `errorKind: "provider_safety_stop"` label can no longer suppress model fallback (#4777 review). Terminal safety-stop authority is now adapter-minted (module-scoped provenance set by the first-party anthropic/openai/google adapters when they parse a structured refusal) rather than carried on message data: the loop strips unauthenticated labels at the stream exit, the managed discard gate re-verifies identity, and transport facts never upgrade provenance, so a compromised provider that names the typed kind on an error envelope degrades to an ordinary fallback-eligible failure on every status (400 and 429 both keep advancing the chain). Authenticated envelopes remain single-dispatch terminal with the manual-switch hint intact, and persisted/reloaded sessions retain the legacy display classification without retaining live terminal authority, so restart/replay stays fail-closed.
+- The provider safety-stop minting path is now package-private and capability-branded; public AI imports and structural custom-stream payloads cannot forge terminal authority. Trailing stream completion now sanitizes the final message before managed-shell rebuilding when no `done` or `error` event was emitted, preserving fallback for forged labels (#4777 review).
 - Retained-publication acquisition diagnostics now name the stage that actually refused instead of always claiming a failed open, and the native errno vocabulary is closed over the actionable `open(2)` refusal set (#4764). `nativeRetainedObstruction()` rendered every unmatched reason as "could not be opened", so a `broker.json` FIFO — which opens fine `O_RDWR | O_NOFOLLOW | O_NONBLOCK` and then refuses `read_to_end` with `WouldBlock` — was reported as an open failure that had in fact succeeded, `clone`/`metadata` refusals of already-open descriptors were reported as opens, and `unsupported-platform` read as an open error. The structured native reason now drives the prose: `errno-`/`io-` render as open refusals, `read-<kind>` as a read failure, `clone-`/`metadata[-kind]` as inspection failures of an already-open object, `unsupported-platform` as unimplemented authority, and any future reason falls back to a stable "withheld publication authority (reason)" sentence instead of misnaming the stage; the structured reason is preferred whenever the native message parses, so the observed-state fallback is never entered for a stage-named refusal. The Rust `errno_name()` vocabulary adds `EAGAIN`, `EMFILE`, `ENAMETOOLONG`, `ENFILE`, `ENOMEM`, `EOVERFLOW`, and `EPERM` alongside the existing six — descriptor exhaustion and LSM/seccomp denial no longer collapse to `UNKNOWN` — while every unlisted errno still renders as `UNKNOWN` and no errno number or OS string ever leaves the native layer.
 - `move_session` no longer lets a cwd transition commit inside an in-flight tool's execution (#4629). The previous fence re-checked the cwd generation and then yielded, so a move that started inside a tool's first `await` retargeted work already admitted against the launcher root: bash computed `commandCwd` from the live session cwd only after `expandInternalUrls`, running a root-A command in root B. Relative-path tools now hold a shared read lease on the session cwd for their whole execution (`SessionManager.runWithCwdReadLease`), and writers drain outstanding leases before committing, so the cwd observed at admission stays authoritative until the tool finishes. Announced writers also block newly arriving readers, so a stream of tool calls cannot starve a queued move, and async bash jobs stay bound to the cwd they were admitted for.
 - `move_session` re-roots the state the model is shown at the new cwd (#4629). The volatile per-turn message reported the post-move cwd while attaching the launch-bound workspace tree, and subagents launched at the live cwd inherited startup `contextFiles`, `skills`, and `workspaceTree` — pairing the new cwd with the retired root's files and project instructions, which drives wrong path selection rather than merely stale display. Project context files and skills are now re-discovered after a committed move, the workspace-tree service resolves the live cwd per scan instead of capturing the launch root, the cached tree is retired so the next turn re-scans, and the system prompt is rebuilt from the live cwd.
@@ -41,10 +111,12 @@
 - `move_session` now verifies process-cwd identity against the pinned directory handle (#4629). The no-follow handle was only ever `stat()`ed while the commit and `setProjectDir` resolved the target *name*, so a replacement after the last comparison escaped the validated descendant — the confinement the tool exists to enforce. Node exposes no `fchdir`, so the post-`chdir` cwd's inode identity is now compared against the pinned handle and the chdir is rolled back on mismatch.
 - Process-cwd authority is now an explicit claim rather than an inference (#4629). `move_session` decided it owned the process cwd when `process.cwd() === session.cwd`, which two sessions launched at the same root both satisfy, so rescoping one called process-global `setProjectDir`, `resetCapabilities`, `shutdownAllLspClients`, and plugin-cache clearing underneath its sibling — reaching real execution through consumers such as browser tab work. `SessionManager.claimProcessCwdOwnership` grants the claim to one live manager; a session without it moves its own cwd and leaves process-global state untouched.
 - Conventional MCP autoload now reads the user scope from the agent directory instead of a home-relative `<home>/.gjc/agent` path (#4767). Every writer and denylist reader already resolved user scope through `getMCPConfigPath("user")` (the agent directory), while native discovery derived it from the load context's home, so the two disagreed the moment an agent-directory profile was in play: `GJC_CODING_AGENT_DIR=<profile> gjc mcp add <name>` wrote `<profile>/mcp.json` and reported the server as loaded by ordinary sessions at startup, but startup read `~/.gjc/agent/mcp.json` — the profile's own registrations never loaded and the default profile's servers loaded into the profile instead. `loadAllMCPConfigs` accepts an `agentDir`, sessions created with their own `agentDir` pass it, and the `disabledServers` denylist follows the same scope, so discovery, `gjc mcp add`, the `/mcp` wizard, and `gjc customize doctor` all name one file. This also restores isolation for the MCP autoload suites, which established their temp user scope with `setAgentDir()`: after the trusted-home provenance rework their `os.homedir()` mock no longer reached discovery, so on a developer machine the red-team suite read the real `~/.gjc/agent/mcp.json` and in CI it found nothing.
+- Accepted SDK prompt controls now receive a bounded zero-progress deadline at durable acceptance or promotion, renew every correlation attached to a shared run, fence expiry before late lifecycle adoption, and reconcile `agent_failed` through the typed extension event. The `goal.list/get` goal-less response remains an explicit `no_active_goal` diagnostic page; integrations using `onQueuedPromoted` must handle both `startsOwnRun` dispositions.
 - Immediate `turn.prompt` after `turn.abort` acknowledgement now starts exactly one successor turn instead of being silently consumed by aborted-turn teardown. Abort unwind no longer classifies the successor as steering into the dying loop, delayed `agent_end` is paired with the aborted invocation rather than the successor, and abort acknowledgement waits for that serialized terminal transition — no client-side sleep (#4749). Retention is bounded in the other direction too: abort stays terminal across overlapping aborts. Every abort request advances an abort-admission epoch synchronously, including one that shares an already in-flight unwind, so a prompt admitted between two aborts is refused as a cancelled preflight instead of refreshing its generation and starting work the user already aborted twice. An abort sharing another abort's unwind also applies its own request-scoped effects (preflight cancellation, and abort visibility so a later real abort is not silenced by an earlier `silent: true` abort). A prompt admitted after an abort settles still starts a normal successor turn.
 - Esc/Ctrl+C now recover a WSL/basic-terminal session whose busy indicator outlived its turn (#4741). Both the global interrupt/clear listener and the editor escape handler treated any mounted working loader as unconditionally cancellable work: after a completed turn left the loader mounted, every press ran a no-op abort, consumed the key, and reset the escape gestures, so the composer stayed `working [esc]`/`Fetching … [esc]` and Esc, Ctrl+C, and Ctrl+X never did anything (Ctrl+Z suspend/resume was the only escape). The loading branch now stops the stale indicator via the shared activity-indicator stop and lets the key fall through to idle semantics when there is no pending submission (including a started one still inside prompt preflight, exposed through the new `hasPendingSubmission()` context query), no queued steering/follow-up/compaction messages, and the session is neither streaming nor compacting; active work (streaming, queued messages, pending optimistic or started-preflight submission) still aborts exactly as before. Recovery gates on drainable queues only: the new `AgentSession.drainableQueuedMessageCount` counts exactly the steering and follow-up entries that `clearQueue()`/`popLastQueuedMessage()`/`getQueuedMessageEntries()` return, whereas the aggregate `queuedMessageCount` also counts hidden next-turn context that no key press can drain and that deliberately survives turn completion (a `todo_write` failure reminder queued with `deliverAs: "nextTurn"` and no `triggerTurn`) — gating on the aggregate left a permanently nonzero count that reproduced the same lockout while idle. Hidden next-turn ordering and delivery are unchanged; recovery neither clears nor delivers those entries. The same correction applies to the two adjacent gates whose handlers are also visible-queue-only: `app.message.sendNow` no longer advertises itself when only hidden context is queued (its only outcome was "No visible queued message to send"), and an empty submit while streaming no longer aborts the live turn to flush a queue that holds nothing drainable.
 - Bare-default Codex and Anthropic provider-overload retries now honor the configured retry ceiling instead of entering the unbounded transient path, and every replay still requires a clean retry scope after extension lifecycle handlers participate.
-- `gjc accounts` command errors no longer escape as uncaught exceptions in text mode. `accounts pin` resolves its target through `resolveOAuthPinTarget`, which throws a typed `OAuthCredentialSelectorError` for user-correctable selector problems (API-key rows, active overrides, disabled or missing accounts, ambiguity), and `runAccountsCommand` rendered `AccountsCommandError` only in `--json` mode — text mode rethrew everything, so even the command's own "Provider … is not configured; no pin was written" surfaced as a stack trace plus a `gjc-crash.log` entry. Selector failures now map to `AccountsCommandError` with the message preserved (so `--json` reports `accounts-error` instead of `internal-error`), and text mode prints one clean stderr line with exit code 1. The framework's `CliParseError` handling and the JSON machine contract (exactly one document, never stacks or secrets) are unchanged.
+- `gjc accounts` command errors no longer escape as uncaught exceptions in text mode. `accounts pin` resolves its target through `resolveOAuthPinTarget`, which throws a typed `OAuthCredentialSelectorError` for user-correctable selector problems (API-key rows, active overrides, disabled or missing accounts, ambiguity), and `runAccountsCommand` rendered `AccountsCommandError` only in `--json` mode — text mode rethrew everything, so even the command's own "Provider … is not configured; no pin was written" surfaced as a stack trace plus a `gjc-crash.log` entry. Selector failures now map to `AccountsCommandError` with the message preserved (so `--json` reports `accounts-error` instead of `internal-error`), and text mode prints one clean stderr line with exit code 1 instead of an uncaught exception.
+- Reverted the SDK broker package-generation fence (#4862 and its follow-ups). Broker discovery no longer refuses reuse, retires, or signals a live broker because its published `packageGeneration` / `packageVersion` / `installationIdentity` differ from the caller's, so `gjc sdk …`, ACP, and coordinator callers stop failing with `SDK broker package generation … does not match expected generation …`. An in-place upgrade needs the broker stopped once (`bun run restart:sdk-broker` from a source checkout, or stop the published `broker-internal` pid) instead of an automatic retirement handshake.
 - Fixed interactive steering stalling during post-prompt unwind when the terminal transcript message is a bash or Python execution; the auto-continue gate now treats all three terminal roles consistently and regression coverage pins delivery for assistant, bash, and Python tails (#4739).
 - Restored live subagent progress in the `subagent await` panel through a bounded public DTO. #4748 dropped the `progress` field believing it exposed model-generated deltas and tool output to the parent model; the renderer needs live status, tool names, output counts, fast mode, and retry state, but raw progress must not enter tool-result, ACP, or telemetry envelopes. The await signature now tracks only those approved fields and ignores countdown-only churn, so the panel updates without exposing model deltas, tool arguments, arbitrary output, or nested task payloads.
 - Dev CI no longer re-runs the entire code-validation matrix when a pull request body is edited. The verdict line lives in the PR body, so every review verdict update fired a `pull_request: edited` event; with `cancel-in-progress: true` that cancelled the run already validating the identical tree and re-queued the whole matrix against it. Cancelled runs surfaced as confusing downstream failures rather than clean cancellations -- a job would report `Artifact not found for name: dev-affected-plan-<run>` while that artifact existed and its producer had succeeded. `edited` stays in the trigger list because `pr-contract-bootstrap` must re-check the body, but it is now the only job that runs for it; every code-validation root carries an explicit guard and the remaining jobs inherit it through their dependency on a skipped plan.
@@ -98,6 +170,10 @@
 - Fixed an SDK broker that stops publishing while its process stays alive blocking every client permanently (#4704). The publication tick is a chain of awaited IO -- the machine-global session-index lock, the retained heartbeat write, the host checkpoint -- and a fence is only reachable from an observation that returned or an error that was thrown, so a stall that does neither armed neither the loss nor the ambiguity deadline. The broker then held its port and its lock with a published heartbeat aging far past its TTL, and peers refused to reclaim a lock whose owner pid is alive, so every `paseo run --provider gjc`, `gjc sdk`, and ACP launch failed with `Broker lock is held by a live owner (pid N)` until the process was killed by hand (observed: 13.6 hours, after a `session index "heartbeat checkpoint" still holds the index lock after 10s` warning that escalated to nothing). Liveness is now measured from the last *successful* publication rather than from being scheduled: a broker that has published nothing within `max(60s, heartbeatTtl * 4)` terminates itself as `lost-root`, so the dead-owner reclaim from #3963 hands the lock to its successor. The check runs before any await in the tick and on every tick even while an earlier one is still in flight, so a stalled chain cannot starve the path that ends it, and ticks no longer stack behind a stalled predecessor. The retained heartbeat's positional write and its `fsync` also moved off the JS thread onto the libuv blocking pool (`heartbeatAsync`/`syncAsync`, replacing the synchronous bindings): both are unbounded, and running them on the JS thread let a wedged filesystem stop the timers, signal handlers, and broker completion along with the write they were blocking -- a process that could not even notice it had stopped publishing. The retained handle is split accordingly, so shutdown is not merely moved behind the same stall: the single-writer lock is taken only on the pool, while `observe()` and `close()` need the descriptors rather than the write ordering and take a lock held for a pointer read alone. Closing therefore detaches immediately -- an unresolved worker keeps its own reference, observes the closed flag, and returns without committing a heartbeat against authority the owner has already given up -- so `lost-root` completion finishes and the lock stays reclaimable by the successor while the stalled write is still outstanding.
 - The per-turn project context now carries the host's local date, clock time, UTC offset, and IANA zone (`Today is 2026-08-19 (Wed), the local time is 21:04 UTC+09:00 (Asia/Seoul)`) instead of `new Date().toISOString().slice(0, 10)`. The agent previously received a bare UTC calendar date with no clock and no zone, so it reported every timestamp it read from files, logs, git, and APIs in UTC — forcing users outside UTC to convert by hand — and was a full day wrong for east-of-UTC users during their local morning (00:00–09:00 KST rendered as the previous date). The same block now instructs the agent to convert timestamps explicitly identified as UTC to that local zone while preserving timestamps that already include an offset or timezone. Rendering is derived from a single `Intl.DateTimeFormat` pass over one resolved zone, with deterministic UTC fallback for invalid clock values, so date, clock, offset, and zone can never disagree, and the vestigial UTC `date`/`dateTime` fields are dropped from the cached stable system prefix, which never rendered them. The zone follows runtime process configuration and may be influenced by project environment settings; it is display context, not trusted location evidence. Full IANA-zone output can reveal geographic information, and date/time overrides are accepted only in the strict derived formats used by deterministic tests.
 
+### Fixed
+
+- A gjc session no longer disappears from Herdr's sidebar when the Herdr server is replaced under it. A server restart or `herdr update --handoff` starts with an empty agent registry, and the reporter deduplicates against the last state it sent, so a session waiting at its prompt stayed invisible until the user typed into it. The reporter now watches the pane's API socket — replacement rebinds the same path to a new inode — and re-reports its current state and last title when that happens.
+
 ## [0.14.2] - 2026-08-20
 
 ### Added

package/dist/types/capability/index.d.ts

@@ -17,6 +17,8 @@ export declare function loadCapability<T>(capabilityId: string, options?: LoadOp
  * Call this once on startup to enable persistent provider state.
  */
 export declare function initializeWithSettings(activeSettings: Settings): void;
+/** Remove a disposed session scope without disturbing a newer replacement. */
+export declare function releaseSettingsScope(activeSettings: Settings): void;
 /** Disable a provider for the supplied session settings. */
 export declare function disableProvider(providerId: string, activeSettings?: Settings): void;
 /** Enable a provider for the supplied session settings. */

package/dist/types/capability/types.d.ts

@@ -19,17 +19,19 @@ export interface LoadContext {
      * (`getAgentDir()`), which `--agent-dir`, `GJC_CODING_AGENT_DIR` and
      * `setAgentDir()` redirect away from `<home>/.gjc/agent`. `loadCapability`
      * always sets it; ad-hoc contexts built for path scanning may omit it, and
-     * consumers then fall back to the same process-wide `getAgentDir()`.
+     * native providers then fall back to the home-relative default
+     * `<home>/<configDirName>/agent` (see `resolveUserAgentDir` in
+     * `discovery/builtin.ts`).
      *
      * A native surface whose write path targets the agent directory resolves its
-     * user scope from here, or discovery reads a different file than the one the
-     * writer produced: `gjc mcp add` (user scope) writes `getMCPConfigPath("user")`
-     * under this directory. Surfaces whose writers are home-relative (skills) keep
-     * resolving from `home`.
+     * user scope from here, or discovery reads a different file than the writer
+     * produced. This includes MCP registrations and user-installed skills.
      */
     userAgentDir?: string;
     /** Git repository root (directory containing .git), or null if not in a repo */
     repoRoot: string | null;
+    /** Owning session settings for provider policy decisions. */
+    settings?: Settings;
 }
 /**
  * Result from a provider's load function.

package/dist/types/cli/github-release.d.ts

@@ -0,0 +1,47 @@
+/**
+ * GitHub release lookup and checksum helpers for binary install/update.
+ * End-user updates resolve versions from GitHub, not the npm registry.
+ */
+import type { UpdateChannel } from "../config/update-channel";
+export declare const RELEASE_REPO = "Yeachan-Heo/gajae-code";
+export declare const GITHUB_API_ORIGIN = "https://api.github.com";
+export declare const GITHUB_RELEASE_DOWNLOAD_ORIGIN = "https://github.com/Yeachan-Heo/gajae-code/releases/download";
+export declare const BINARY_SHA256_ASSET = "gajae-release-binaries.sha256";
+export declare const BINARY_MANIFEST_ASSET = "gajae-release-binaries-v1.json";
+export interface GithubReleaseInfo {
+    tag: string;
+    version: string;
+    channel: UpdateChannel;
+    htmlUrl?: string;
+    warnings: string[];
+}
+export type GithubFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export interface GithubReleaseLookupOptions {
+    channel?: UpdateChannel;
+    fetchImpl?: GithubFetch;
+    lookupEnv?: (name: string) => string | undefined;
+    apiOrigin?: string;
+    timeoutMs?: number;
+    useAmbientToken?: boolean;
+}
+export declare function isSafeReleaseTag(tag: string): boolean;
+export declare function versionFromTag(tag: string): string;
+export declare function githubReleaseHeaders(token: string | undefined): Record<string, string>;
+export declare function fetchGithubChannelRelease(options?: GithubReleaseLookupOptions): Promise<GithubReleaseInfo>;
+export declare function parseChecksumForAsset(text: string, assetName: string): string | undefined;
+export declare function parseManifestChecksum(payload: unknown, assetName: string): string | undefined;
+export declare function sha256Buffer(bytes: Uint8Array): string;
+export declare function sha256File(filePath: string): Promise<string>;
+export declare function fetchOptionalText(url: string, options?: {
+    fetchImpl?: GithubFetch;
+    lookupEnv?: (name: string) => string | undefined;
+    timeoutMs?: number;
+}): Promise<string | undefined>;
+export declare function verifyDownloadedBinaryChecksum(options: {
+    tag: string;
+    assetName: string;
+    filePath: string;
+    fetchImpl?: GithubFetch;
+    lookupEnv?: (name: string) => string | undefined;
+    downloadOrigin?: string;
+}): Promise<"verified">;

package/dist/types/cli/setup-cli.d.ts

@@ -29,13 +29,17 @@ export interface SetupCommandArgs {
         mpreset?: string;
         noWorktree?: boolean;
         worktreeName?: string;
+        requireWorktree?: boolean;
         stateRoot?: string;
+        codingAgentDir?: string;
         mutation?: string[];
         artifactByteCap?: string;
         serverKey?: string;
         gjcCommand?: string;
         target?: string;
         profileDir?: string;
+        timeout?: string;
+        connectTimeout?: string;
         yes?: boolean;
         dryRun?: boolean;
         keychain?: boolean;

package/dist/types/cli/update-cli.d.ts

@@ -1,7 +1,7 @@
 import { Settings } from "../config/settings";
 import { type UpdateChannel } from "../config/update-channel";
 import { type NotificationProvider } from "../sdk/bus/config";
-import { type NpmRegistryLookupOptions } from "../utils/npm-registry";
+import { type GithubReleaseLookupOptions } from "./github-release";
 export interface UpdateCommandOptions {
     force: boolean;
     check: boolean;
@@ -61,22 +61,35 @@ export type UpdateTarget = {
 } | {
     method: "binary";
     path: string;
+} | {
+    method: "migrate";
+    path: string;
+    previousPath?: string;
 };
 type PathPlatform = NodeJS.Platform;
 type PackageExists = (packageName: string, packageRoot: string) => boolean;
 export declare function resolveUpdateMethodForTest(ompPath: string, bunBinDir: string | undefined): "bun" | "npm" | "binary";
 export declare function resolveNpmManagedTargetForTest(ompPath: string, platform: PathPlatform, packageExists: PackageExists): PackageManagerTarget | undefined;
-/** Lookup options for the release check: registry resolution plus the release channel. */
-export interface LatestReleaseLookupOptions extends NpmRegistryLookupOptions {
+export declare function defaultUserBinaryPath(platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): string;
+export declare function isProtectedSourcePathForTest(filePath: string): boolean;
+export declare function defaultUserBinaryPathForTest(platform?: NodeJS.Platform, env?: NodeJS.ProcessEnv): string;
+/** Lookup options for the GitHub release check. */
+export interface LatestReleaseLookupOptions extends GithubReleaseLookupOptions {
     channel?: UpdateChannel;
 }
 export declare function getLatestReleaseForTest(options: LatestReleaseLookupOptions): Promise<ReleaseInfo>;
 export declare function compareVersionsForTest(a: string, b: string): number;
+export declare function resolveGjcPathForTest(options: {
+    compiled: boolean;
+    execPath: string;
+    whichPath: string | undefined;
+}): string | undefined;
 export declare function parseReportedVersionForTest(output: string): string | undefined;
 export declare function formatBinaryDownloadFailureMessageForTest(binaryName: string, url: string, status: string | number, platform?: NodeJS.Platform, registryNote?: string): string;
 export declare function buildReleaseBinaryUrlForTest(version: string, platform?: NodeJS.Platform, arch?: string): string;
 export declare function formatManualUpdateInstructionsForTest(platform?: NodeJS.Platform): string;
 export declare function formatVerificationFailureForTest(result: InstalledVersionVerification, expectedVersion: string): string;
+export declare function recoverWindowsUpdateJournal(journalPath: string): Promise<void>;
 /**
  * Atomically replace the installed binary and roll back if version verification fails.
  */
@@ -133,7 +146,7 @@ export declare function runManagedNotifyRecovery(deps: Pick<UpdateCommandDepende
 /** How the update command should proceed after comparing versions. */
 export interface UpdateDecision {
     install: boolean;
-    kind: "up-to-date" | "new-version" | "switch-back" | "force";
+    kind: "up-to-date" | "new-version" | "switch-back" | "force" | "migrate";
 }
 /**
  * Decide whether to install after comparing the channel's release with the
@@ -151,6 +164,7 @@ export declare function resolveUpdateDecision(options: {
     force: boolean;
     channel: UpdateChannel;
     currentVersion: string;
+    migrate?: boolean;
 }): UpdateDecision;
 export declare function runUpdateCommand(opts: UpdateCommandOptions, deps?: UpdateCommandDependencies): Promise<void>;
 /**

package/dist/types/commands/setup.d.ts

@@ -49,9 +49,15 @@ export default class Setup extends Command {
         "worktree-name": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
+        "require-worktree": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
         "state-root": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
+        "coding-agent-dir": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
         mutation: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
             multiple: true;
@@ -71,6 +77,12 @@ export default class Setup extends Command {
         "profile-dir": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };
+        timeout: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "connect-timeout": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
         preset: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };

package/dist/types/config/autorouting-tier-map.d.ts

@@ -727,6 +727,9 @@ export declare const TIER_MAP_SKIP_LIST: {
     readonly "kilo/sakana/sakana-namazu": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };
+    readonly "kilo/stealth/ox-alpha": {
+        readonly rationale: "newly pinned preview model; latency and quality rank are not yet curated";
+    };
     readonly "kilo/tencent/hy3:free": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };

package/dist/types/config/file-lock.d.ts

@@ -6,6 +6,8 @@ export interface FileLockOptions {
     onAcquired?: () => void;
     /** Stable host identity required to safely reclaim locks on a shared volume. */
     ownerHostId?: string;
+    /** Previous local host identities accepted only when deciding stale-owner reclamation. */
+    previousOwnerHostIds?: readonly string[];
 }
 export declare const FileLockTestHooks: {
     afterParentMkdir?: (lockPath: string) => void | Promise<void>;
@@ -62,7 +64,7 @@ export declare function removeFileLockDirForGc(lockDir: string, expected: FileLo
  * remove the directory has to do it under an identity-bound primitive that refuses when
  * the object is no longer the one that was judged.
  */
-export declare function genericFileLockDirIsStale(lockDir: string, staleMs: number): Promise<boolean>;
+export declare function genericFileLockDirIsStale(lockDir: string, staleMs: number, ownerHostId?: string): Promise<boolean>;
 /**
  * Serializes all contenders, including callers in the same process. Because this
  * API exposes no ownership token, recursive acquisition is indistinguishable

package/dist/types/config/machine-identity.d.ts

@@ -0,0 +1,19 @@
+export interface MachineIdentityDeps {
+    platform?: NodeJS.Platform;
+    readFile?: (file: string) => Promise<string>;
+    runCommand?: (command: string, args: readonly string[]) => {
+        exitCode: number;
+        stdout: Uint8Array;
+    };
+    installationSecret?: string;
+    configRootDir?: string;
+    link?: (existingPath: string, newPath: string) => Promise<void>;
+}
+/** @internal */
+export declare function parseWindowsMachineGuid(output: string): string | undefined;
+/** @internal */
+export declare function parseMacPlatformUuid(output: string): string | undefined;
+/** Loads a verified machine-local identity without persisting the underlying machine ID. */
+export declare function loadInstallationHostId(deps?: MachineIdentityDeps): Promise<string>;
+/** @internal Recognizes owner records written before installation-keyed identities. */
+export declare function loadLegacyInstallationHostId(deps?: MachineIdentityDeps): Promise<string>;

package/dist/types/config/model-registry.d.ts

@@ -107,7 +107,7 @@ export declare const ModelsConfigFile: ConfigFile<{
         authHeader?: boolean | undefined;
         auth?: "apiKey" | "none" | "oauth" | undefined;
         discovery?: {
-            type: "llama.cpp" | "lm-studio" | "models-dev" | "ollama" | "omlx" | "openai-models-list";
+            type: "llama.cpp" | "lm-studio" | "models-dev" | "ollama" | "omlx" | "openai-models-list" | "sglang" | "vllm";
             apiByModelPrefix?: Record<string, "anthropic-messages" | "openai-completions"> | undefined;
             modelsDevProvider?: string | undefined;
         } | undefined;

package/dist/types/config/model-resolver.d.ts

@@ -86,11 +86,12 @@ export declare function parseModelPattern(pattern: string, availableModels: Mode
     credentialSessionId?: string;
     aliasIntent?: "preset-equivalent" | "reject";
 }): ParsedModelResult;
+export type ModelRoleSettings = Pick<Settings, "getModelRole">;
 /**
  * Expand a role alias like "pi/default" to the configured model string.
  */
-export declare function expandRoleAlias(value: string, settings?: Settings): string;
-export declare function resolveConfiguredModelPatterns(value: ModelSelectorValue | undefined, settings?: Settings): string[];
+export declare function expandRoleAlias(value: string, settings?: ModelRoleSettings): string;
+export declare function resolveConfiguredModelPatterns(value: ModelSelectorValue | undefined, settings?: ModelRoleSettings): string[];
 export interface AgentModelPatternResolutionOptions {
     settingsOverride?: ModelSelectorValue;
     agentModel?: ModelSelectorValue;
@@ -109,7 +110,7 @@ export interface ResolvedModelRoleValue {
     warning: string | undefined;
 }
 export declare function resolveModelRoleValue(roleValue: ModelSelectorValue | undefined, availableModels: Model<Api>[], options?: {
-    settings?: Settings;
+    settings?: ModelRoleSettings;
     matchPreferences?: ModelMatchPreferences;
     modelRegistry?: CanonicalModelRegistry;
     sessionId?: string;

package/dist/types/config/models-config-schema.d.ts

@@ -355,6 +355,8 @@ export declare const ProviderDiscoverySchema: z.ZodObject<{
         ollama: "ollama";
         omlx: "omlx";
         "openai-models-list": "openai-models-list";
+        sglang: "sglang";
+        vllm: "vllm";
     }>;
     apiByModelPrefix: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
         "anthropic-messages": "anthropic-messages";
@@ -478,6 +480,8 @@ export declare const ModelsConfigSchema: z.ZodObject<{
                 ollama: "ollama";
                 omlx: "omlx";
                 "openai-models-list": "openai-models-list";
+                sglang: "sglang";
+                vllm: "vllm";
             }>;
             apiByModelPrefix: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
                 "anthropic-messages": "anthropic-messages";

package/dist/types/config/settings-schema.d.ts

@@ -602,6 +602,23 @@ export declare const SETTINGS_SCHEMA: {
         readonly default: 10;
         readonly validate: (value: number) => boolean;
     };
+    readonly "ui.language": {
+        readonly type: "enum";
+        readonly values: readonly ["en", "ko"];
+        readonly default: "en";
+        readonly ui: {
+            readonly tab: "appearance";
+            readonly label: "Language";
+            readonly description: "Language for human-facing interactive UI text";
+            readonly options: readonly [{
+                readonly value: "en";
+                readonly label: "English";
+            }, {
+                readonly value: "ko";
+                readonly label: "Korean (한국어)";
+            }];
+        };
+    };
     readonly "theme.dark": {
         readonly type: "string";
         readonly default: "red-claw";
@@ -779,7 +796,7 @@ export declare const SETTINGS_SCHEMA: {
         readonly ui: {
             readonly tab: "appearance";
             readonly label: "Gajae Pet";
-            readonly description: "Real-pixel pet living beside the composer (sixel/kitty terminals)";
+            readonly description: "Animated pet beside the composer (pixel graphics where supported; text cells elsewhere)";
             readonly options: readonly [{
                 readonly value: "off";
                 readonly label: "Off";
@@ -1686,7 +1703,7 @@ export declare const SETTINGS_SCHEMA: {
         readonly ui: {
             readonly tab: "interaction";
             readonly label: "Mouse Support";
-            readonly description: "Enable GJC session scrolling, drag-to-copy text selection, and overlay row selection with the mouse. Disabled by default to preserve native terminal or tmux scrollback and selection.";
+            readonly description: "Enable GJC session scrolling, drag-to-copy text selection, double-click word and triple-click line selection, and overlay row selection with the mouse. Disabled by default to preserve native terminal or tmux scrollback and selection; while enabled, most terminals still reach their own selection with a modifier held (Option on macOS, Shift elsewhere), though that path copies only if the host terminal has its own copy-on-select enabled.";
         };
     };
     readonly steeringMode: {
@@ -1837,7 +1854,7 @@ export declare const SETTINGS_SCHEMA: {
         readonly ui: {
             readonly tab: "interaction";
             readonly label: "Check for Updates";
-            readonly description: "At interactive startup, notify of newer versions; never install. Use `gjc update` only for recognized Bun global, Windows npm, or bundled-installer binaries; source, linked, and unrecognized installs use their original method.";
+            readonly description: "At interactive startup, notify of newer versions; never install. `gjc update` installs the matching GitHub release binary. Source, linked, and unrecognized installs stay on their original method.";
         };
     };
     readonly "startup.updateChannel": {
@@ -1851,11 +1868,11 @@ export declare const SETTINGS_SCHEMA: {
             readonly options: readonly [{
                 readonly value: "stable";
                 readonly label: "Stable";
-                readonly description: "Track stable releases (npm `latest` dist-tag)";
+                readonly description: "Track stable GitHub releases";
             }, {
                 readonly value: "nightly";
                 readonly label: "Nightly";
-                readonly description: "Track nightly prereleases (npm `nightly` dist-tag)";
+                readonly description: "Track nightly GitHub prereleases";
             }];
         };
     };

package/dist/types/config/settings.d.ts

@@ -179,6 +179,8 @@ export declare class Settings implements NotificationSettingsReader {
     flushOrThrow(): Promise<void>;
     cloneForCwd(cwd: string): Promise<Settings>;
     getStorage(): AgentStorage | null;
+    /** Flush and close storage owned by an isolated settings scope. */
+    close(): Promise<void>;
     getCwd(): string;
     getAgentDir(): string;
     getPlansDirectory(): string;

package/dist/types/coordinator-mcp/codex-handoff.d.ts

@@ -1,3 +1,4 @@
+import { type CodexTokenFileIdentity } from "./codex-wake-publisher";
 export declare const CODEX_WAKE_EVENT_KINDS: readonly ["question.opened", "turn.waiting_for_answer", "turn.completed", "turn.failed", "turn.cancelled", "turn.superseded"];
 export type CodexWakeEventKind = (typeof CODEX_WAKE_EVENT_KINDS)[number];
 export type CodexHandoffEndpoint = {
@@ -24,6 +25,7 @@ export interface CodexHandoffRegistrationV1 {
     thread_id: string;
     endpoint: CodexHandoffEndpoint;
     token_file: string | null;
+    token_file_identity: CodexTokenFileIdentity | null;
     registered_at: string;
     updated_at: string;
     origin?: CodexHandoffOriginV1;
@@ -55,6 +57,7 @@ export declare function registerCodexHandoff(namespaceDir: string, input: {
     thread_id: string;
     endpoint: CodexHandoffEndpoint;
     token_file?: string | null;
+    token_root?: string;
     origin?: unknown;
 }): Promise<CodexHandoffRegistrationV1>;
 export declare function readCodexHandoff(namespaceDir: string, workUnit: string): Promise<CodexHandoffRegistrationV1 | null>;