@gajae-code/coding-agent 0.15.2 → 0.15.4

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 ## [Unreleased]
 
+## [0.15.4] - 2026-08-29
+
+- The `ask` tool now rejects empty or whitespace-only custom answers on every local and remote input path. Remote invalid answers receive a visible explanation and are retried at most three times with an event-loop yield between attempts before the ask is cancelled; local empty custom input is never returned as a valid answer. (#5001)
+
+## [0.15.3] - 2026-08-27
+
+### Added
+
+- Added opt-in `compaction.adaptive.*` settings and wired them into post-turn and pre-prompt auto-compaction. Adaptive mode remains disabled by default, preserves fixed-token precedence, and exposes bounded base, aggression, call-window, and minimum-threshold controls.
+
+- The `ask` tool declares its display-only argument fields (`questions.question`, `questions.options.label`) via `displaySafeEscapedArgFields`, so an `ask` call whose question text or option labels arrive as `\uXXXX` escapes (common from Anthropic models writing Korean or emoji) completes with a single warning instead of discarding the turn, charging the managed-fallback retry budget, and ultimately failing the run. Ids, workflow-gate metadata, and deep-interview records remain load-bearing and keep the fail-closed rejection. (#4983)
+
+- Added an explicit `Copy OAuth URL` command-palette action for interactive `/login` and runtime MCP OAuth flows. It copies the exact pending authorization URL through the configured clipboard transport only after the user selects the action; it never overwrites the clipboard automatically and clears the pending URL when the flow ends. This preserves OSC 8 policy, tmux/SSH/no-hyperlink behavior, and avoids relying on padded soft-wrapped terminal rows for copying.
+- Six navigation actions are now reachable from the command palette and dispatch a user remap: `app.session.dashboard`, `app.transcript.browse`, `app.transcript.prevTurn`, `app.transcript.nextTurn`, `app.queue.togglePane`, and `app.message.sendNow`. All six already carried a registry callback and an availability predicate but shipped with no curated palette entry and no key dispatch, so four were unreachable from every surface and two only through `/transcript` and `/sessions`. Each entry is listed through an opt-in availability gate, so an action whose predicate is false (send-now while idle, transcript turns with no anchored user messages, transcript browsing with an empty session) is not offered rather than being offered and refused on selection. Pre-existing curated palette entries keep their previous listing semantics: the gate is a sibling opt-in set, not a blanket filter, so entries such as thinking-cycle, model-cycle, external editor, and the session tree/fork actions are unaffected. Default chords stay empty; the new `setCustomKeyHandler` loops are inert until a user binds one of these ids, which previously would have been displayed by the palette without ever dispatching.
+- The todo HUD can now be expanded. `app.todo.toggle` (`alt+shift+t`, remappable via `~/.gjc/agent/keybindings.json`) and a command-palette entry both reach `toggleTodoExpansion()`, which previously had no caller anywhere in the source: the HUD rendered a `+N more` row summarising hidden tasks with no way to reveal them. The action is unavailable while no phase has tasks, so the chord stays inert and the palette entry is not listed rather than being offered and refused.
+- The session tree, branch-from-message, and resume actions now ship default chords: `alt+shift+s` (`app.session.tree`), `alt+shift+f` (`app.session.fork`), and `alt+shift+r` (`app.session.resume`). All three already had key-dispatch loops and curated palette entries; the loops were simply empty because the actions carried no default keys, so the bindings were reachable only through the palette. All three remain remappable via `~/.gjc/agent/keybindings.json`, and user bindings continue to win over defaults. Tree and branch stay unavailable on an empty session, so their chords are inert instead of opening an empty selector.
+- New `startup.skipLogoAnimation` setting (Interaction tab, default off) skips the animated startup logo sweep. The welcome surface, its resting logo, and every information row (recent sessions, LSP state, flow keys) still render — unlike `startup.quiet`, which suppresses the whole surface. Previously the roughly three-second gradient sweep drove about 91 forced renders on every interactive start with no way to opt out short of losing the entire welcome screen. The value is read once during interactive startup, so changing it takes effect at the next start. Pet and loader motion are deliberately out of scope and unaffected.
+- Added Japanese (`ja`) to the persisted `ui.language` response-language surface: the `/language` command and the Settings → Appearance selector. Accepted input spellings include `ja`, `ja-JP`, `japanese`, `jp`, `jpn`, and `日本語`. English and Korean behavior, defaults, and onboarding language ranking are unchanged. (#4947)
+- Added `/aside`, a composer slash command that probes a user-installed Aside CLI (`~/.local/bin/aside`, the macOS `Aside CLI.app` bundle, then `PATH`) and runs explicit `exec` / `account` invocations from GJC. Bare `/aside` prints the resolved path and version; `/aside mcp` prints `gjc mcp add aside <cli> mcp --project` with a quoted concrete binary instead of starting a stdio server; `/aside repl` stays terminal-only because the GJC host cannot attach a TTY. Missing-binary output includes the official install command. This does not restore the reverted Aside browser-tool backend and does not enable browser-control by default.
+- Added the semantic `gjc sdk session retire <sessionId>` wrapper for the identity-bound `session.reconcile_uncertain` lifecycle global. It fails closed on live, ambiguous, malformed, or endpoint-bearing state and retires stranded coordinator start intents through `gjc_coordinator_retire_start_session`.
+- `gjc sdk session raw global --op session.reconcile_uncertain` retires an indexed `terminalUncertain` create effect after dead-host, absent-endpoint, and identity-bound leftover proof, appending `session_closed` and a ledger `terminal_error` successor. It does not weaken `session.close` / `session.delete`. The official `gjc_coordinator_retire_start_session` mutation seals a matching coordinator start-session `in_progress` projection only after the same broker proof (issue #4950).
+
+### Changed
+
+- The pinned status rail now cues dropped segments instead of discarding them silently. When telemetry does not fit, the rail appends a width-reserved marker — `…+N` with the exact count of omitted segments when the count fits, degrading to a bare `…` when it cannot — in both loss paths: the single-row path that shrinks the path then pops right-side and left-side segments, and the multi-row path that stops at the `statusLine.maxRows` cutoff. Eviction order and semantics are deliberately unchanged: which segments survive is still decided by configured segment order, and no cross-segment priority policy is introduced. The marker reserves its cells inside the layout calculation and renders through a dedicated compact path with no padding or end caps, so it can occupy a single column and the final width truncation stays a defensive guard rather than deciding whether the cue survives. The count is never truncated into a wrong number: it is either exact or intentionally absent. Note that the rail was already dropping a segment at 48 columns for a two-segment preset; that loss is now visible.
+
+### Fixed
+
+- `--no-tools` now disables every built-in tool. The flag is documented as "Disable all built-in tools" and maps to an empty explicit tool selection, but the session builder unconditionally folded `goal` back into any explicit selection whenever `goal.enabled` was on (its default), so a `--no-tools` run still exposed exactly one built-in tool against that promise. `goal` is still folded into a non-empty explicit selection such as `--tools read,bash`, where it carries session state rather than competing with the requested work tools, and sessions with no explicit selection are unaffected.
+- The coordinator session-state lock now works on Windows. Two production defects and two POSIX-only fixtures were exposed once the suite reached a windows-latest shard (#4990): `processStartTime()` probed only through `ps`, which does not exist on Windows, so every owner start time was `null` and PID-reuse verdicts degraded to indeterminate; it now reads the natives addon's kernel-derived `Process.incarnation` on win32, the same evidence the SDK broker uses, and still returns `null` fail-closed when the incarnation cannot be proved. Separately, `createOwnerLock`'s failed-write retraction ran the identity-bound delete while the create descriptor was still open, which Windows refuses (the descriptor grants no share-delete), leaving a half-written owner record stranded at the lock path; the Windows strategy now closes the descriptor after it has vouched for the created object and lets the compare-and-delete re-prove the full recorded identity (dev/ino, link count, size, mtime, payload hash) at delete time, so a successor that took the pathname in the window is still refused. Fail-closed identity and successor semantics are unchanged. The two FIFO fixtures (created with `mkfifo`, whose EOF helper also needs `sh`) are now gated POSIX-only — the descriptor-proved-regular contract stays covered on Windows by the symlink variants — the suite gained cross-platform coverage for the portable start probe and the retract-under-open-handle ordering, and the suite plus its routing predicates now execute on the windows-latest dev-CI job.
+- `gjc deep-interview write`/`stage` now report all envelope-reserved keys nested under `state` in `ignored_runtime_owned_keys`, including `source_state_revision` and `last_applied_draft_id`. A payload such as `{"state":{"current_phase":"cancelled"}}` returned an unqualified `ok:true` while the key was discarded before it reached disk, so a caller asking for a phase transition got a success receipt for an instruction that never took effect. The same key sent at the top level was already reported, and `gjc state deep-interview write` rejects it outright. Which keys are discarded, the persisted envelope, and every existing error are unchanged; only the response now names the discard.
+- Idle notifications are now bound to the exact SDK connection generations that accepted their positioned identity prerequisite; raw-only recipients receive identity and idle through the same bounded writer command. Late joins, replaced generations, and saturated writers therefore cannot receive a dependent Telegram idle through an unrelated global broadcast.
+- Interactive input now releases the foreground submission loop at the terminal `agent_end` boundary even when forced recovery leaves the provider-facing prompt unresolved. This lets the main loop reinstall its input callback for exactly one follow-up submission without bypassing pending-submission or goal-mode ownership, completing the terminal-boundary fix in #4741. (#4970)
+- Managed escaped non-ASCII tool-call recovery now carries the literal-UTF-8 steering instruction on every bounded retry, charges and advances the fallback chain once after a model exhausts those retries, and fails closed only after every eligible fallback model has exhausted its own bounded recovery. Escaped arguments remain unexecuted and excluded from durable history.
+- When OSC 8 hyperlinks are enabled, the `/login` URL row is now an anchor pointing at itself, so a login URL wider than the pane stays clickable on every wrapped fragment. A login URL is one unbreakable token, so a pane narrower than the URL splits it across rows; the row printed the bare URL, so the wrap layer had no link to carry (#4711) and every fragment rendered as dead text. Bare URLs in Markdown prose already got this treatment; the login row did not. The existing hyperlink policy still disables OSC 8 where the terminal or user settings do not support it.
+- Coordinator uncertain-retirement retries now replay a completed retired start intent when a crash occurs after broker proof is sealed but before the retirement idempotency record is finalized; lifecycle retirement also revalidates the exact `sdk` parent identity before index closure, preventing a replacement directory from inheriting stale cleanup authority (#4950).
+- Foreground activity animation now uses layout-only TUI repaints, avoiding repeated reconstruction of unchanged transcript content during long sessions.
+- Notification adapters can now opt into one live representation per native effect: adapters that accept a positioned event are excluded from its matching raw fan-out, while ordinary direct SDK and raw-only legacy subscribers retain their existing delivery. Telegram opts in, preventing turn output, tool activity, and reasoning summaries from rendering twice after #4570; acknowledged terminal shutdown delivery is unchanged.
+- Lean notifications no longer replay a retained completion receipt at idle when identical text was already delivered immediately before an autonomous `ask`; distinct receipts and other settlement windows remain preserved.
+
 ## [0.15.2] - 2026-08-25
 
 ### Changed
@@ -26,7 +66,9 @@
 
 ### Fixed
 
-- Onboarding language detection (`/tutorial`, first-run onboarding) no longer misreads English or Korean transcripts as French, Spanish, or German. Word evidence for space-delimited languages is matched on token boundaries instead of substrings — `le`/`la`/`el` used to match inside `file`, `please`, `class`, and `help`, so plain English handed French a majority — Korean, Japanese, and Chinese are identified by script instead of particle substrings, script counts and word hits share one ranking so two Hangul or Han characters cannot override a clearly English transcript, a claimant script needs two characters before it may claim mixed han text so one stray Hangul or kana glyph cannot erase dominant han evidence, a language must lead the runner-up outright to beat the OS locale, and an explicit `ui.language` selection outranks both. `/language` also accepts locale tags such as `en-US` / `ko-KR` and now rejects hostile inputs that used to resolve to inherited object properties (`__proto__`, `constructor`) instead of canonical `en`/`ko`.
+- Onboarding language detection (`/tutorial`, first-run onboarding) no longer misreads English or Korean transcripts as French, Spanish, or German. Word evidence for space-delimited languages is matched on token boundaries instead of substrings — `le`/`la`/`el` used to match inside `file`, `please`, `class`, and `help`, so plain English handed French a majority — Korean, Japanese, and Chinese are identified by script instead of particle substrings, script counts and word hits share one ranking so two Hangul or Han characters cannot override a clearly English transcript, a Hangul claimant needs two characters before it may claim mixed han text so one stray Hangul glyph cannot erase dominant han evidence, a language must lead the runner-up outright to beat the OS locale, and an explicit `ui.language` selection outranks both. `/language` also accepts locale tags such as `en-US` / `ko-KR` and now rejects hostile inputs that used to resolve to inherited object properties (`__proto__`, `constructor`) instead of canonical `en`/`ko`.
+- Fresh SDK and print sessions now admit a matching credential- and endpoint-scoped discovered-model cache before validating an explicit provider/model, avoiding a startup provider request; caller-supplied registries, foreign credentials, and unknown models remain fail-closed.
+- Fresh SDK and print sessions now admit a matching credential- and endpoint-scoped discovered-model cache before validating an explicit provider/model, and revalidate pre-existing dynamic targets against the selected row; caller-supplied registries stay immutable while foreign credentials and unknown models remain fail-closed.
 - `ask` question wording and option labels no longer use the post-resample U+2014 display-text exemption because accepted calls enter durable session history and deep-interview rounds; genuinely display-only tool fields retain the existing exemption (#4926).
 - Gajae Pet now treats forwarded `LC_TERMINAL=iTerm2` and `TERM_PROGRAM=iTerm.app` values as probe hints over SSH, enabling iTerm2 only after an active OSC 1337 File-capability reply. Generic SSH, spoofed/noninteractive/CI environments, and unmanaged tmux/screen/zellij nesting remain on the text fallback; verified Kitty and Sixel keep precedence. (#4911)
 - Interactive terminal completion now publishes the local `agent_end` boundary before waiting for the ordered coordinator sidecar write, so slow or lock-hostile WSL drvfs mounts cannot leave the foreground activity indicator and composer busy after a turn has completed. Coordinator persistence ordering and extension delivery remain unchanged. (#4741)

package/dist/types/config/autorouting-tier-map.d.ts

@@ -259,15 +259,6 @@ export declare const TIER_MAP_SKIP_LIST: {
     readonly "cursor/gemini-3.7-flash-medium": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };
-    readonly "google-antigravity/gemini-3.7-flash-high": {
-        readonly rationale: "post-rebase catalog addition from dev; not yet curated";
-    };
-    readonly "google-antigravity/gemini-3.7-flash-low": {
-        readonly rationale: "post-rebase catalog addition from dev; not yet curated";
-    };
-    readonly "google-antigravity/gemini-3.7-flash-medium": {
-        readonly rationale: "post-rebase catalog addition from dev; not yet curated";
-    };
     readonly "google-antigravity/gemini-3.7-flash-tiered": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };

package/dist/types/config/file-lock.d.ts

@@ -15,7 +15,13 @@ export declare const FileLockTestHooks: {
 /**
  * Returns the OS-provided process start timestamp for PID-reuse detection.
  * `ps` is available on the supported Unix hosts (macOS and Linux), unlike
- * Linux's `/proc/<pid>/stat` pseudo-file.
+ * Linux's `/proc/<pid>/stat` pseudo-file. Windows has no `ps`; there the
+ * kernel-derived process creation time exposed by the natives addon
+ * (`Process.incarnation`, the same identity evidence the SDK broker prefers)
+ * is used instead. Either way the value is only ever compared for equality
+ * against a value this same function produced on the same platform, and `null`
+ * stays fail-closed: an owner whose incarnation cannot be proved is never
+ * treated as reused.
  */
 export declare function processStartTime(pid: number): string | null;
 /** @internal */

package/dist/types/config/keybindings.d.ts

@@ -25,6 +25,7 @@ interface AppKeybindings {
     "app.clipboard.pasteText": true;
     "app.clipboard.copyLine": true;
     "app.clipboard.copyPrompt": true;
+    "app.clipboard.copyOAuthUrl": true;
     "app.session.new": true;
     "app.session.tree": true;
     "app.session.fork": true;
@@ -48,6 +49,7 @@ interface AppKeybindings {
     "app.transcript.nextTurn": true;
     "app.mode.cycle": true;
     "app.tasks.toggle": true;
+    "app.todo.toggle": true;
     "app.queue.togglePane": true;
     "app.message.sendNow": true;
 }
@@ -274,20 +276,24 @@ export declare const KEYBINDINGS: {
         readonly defaultKeys: "alt+shift+c";
         readonly description: "Copy prompt";
     };
+    readonly "app.clipboard.copyOAuthUrl": {
+        readonly defaultKeys: "alt+shift+u";
+        readonly description: "Copy OAuth URL";
+    };
     readonly "app.session.new": {
         readonly defaultKeys: "ctrl+n";
         readonly description: "Start a new session";
     };
     readonly "app.session.tree": {
-        readonly defaultKeys: [];
+        readonly defaultKeys: "alt+shift+s";
         readonly description: "Show session tree";
     };
     readonly "app.session.fork": {
-        readonly defaultKeys: [];
+        readonly defaultKeys: "alt+shift+f";
         readonly description: "Branch from message";
     };
     readonly "app.session.resume": {
-        readonly defaultKeys: [];
+        readonly defaultKeys: "alt+shift+r";
         readonly description: "Resume session";
     };
     readonly "app.session.observe": {
@@ -366,6 +372,10 @@ export declare const KEYBINDINGS: {
         readonly defaultKeys: "alt+t";
         readonly description: "Toggle tasks pane";
     };
+    readonly "app.todo.toggle": {
+        readonly defaultKeys: "alt+shift+t";
+        readonly description: "Toggle todo list expansion";
+    };
     readonly "app.queue.togglePane": {
         readonly defaultKeys: [];
         readonly description: "Toggle message queue pane";

package/dist/types/config/model-registry.d.ts

@@ -359,6 +359,11 @@ export declare class ModelRegistry {
     refresh(strategy?: ModelRefreshStrategy): Promise<void>;
     refreshInBackground(strategy?: ModelRefreshStrategy): void;
     refreshProvider(providerId: string, strategy?: ModelRefreshStrategy): Promise<void>;
+    admitCachedProviderForStoredLiteralCredential(providerId: string, selector: AuthCredentialSelector): boolean;
+    /** @internal Validate an existing startup model without mutating a caller-supplied registry. */
+    validateModelForStoredLiteralCredential(providerId: string, modelId: string, selector: AuthCredentialSelector): boolean;
+    /** @internal Whether startup must establish credential-scoped cache provenance for this exact target. */
+    requiresStoredLiteralCredentialCacheAdmission(providerId: string, modelId: string): boolean;
     /**
      * Get any error from loading models.json (undefined if no error).
      */

package/dist/types/config/model-resolver.d.ts

@@ -152,6 +152,7 @@ export interface ModelChainResolutionOptions {
     aliasIntent?: "preset-equivalent" | "reject";
     canonicalSessionId?: string | null;
     credentialSessionId?: string;
+    signal?: AbortSignal;
 }
 export declare function resolveModelChainWithAuth(modelPatterns: readonly string[], modelRegistry: ModelLookupRegistry & Pick<ModelRegistry, "getApiKey">, settings?: Settings, sessionId?: string, options?: ModelChainResolutionOptions): Promise<{
     model?: Model<Api>;

package/dist/types/config/settings-schema.d.ts

@@ -604,7 +604,7 @@ export declare const SETTINGS_SCHEMA: {
     };
     readonly "ui.language": {
         readonly type: "enum";
-        readonly values: readonly ["en", "ko"];
+        readonly values: readonly ["en", "ko", "ja"];
         readonly default: "en";
         readonly ui: {
             readonly tab: "appearance";
@@ -616,6 +616,9 @@ export declare const SETTINGS_SCHEMA: {
             }, {
                 readonly value: "ko";
                 readonly label: "Korean (한국어)";
+            }, {
+                readonly value: "ja";
+                readonly label: "Japanese (日本語)";
             }];
         };
     };
@@ -1848,6 +1851,15 @@ export declare const SETTINGS_SCHEMA: {
             }];
         };
     };
+    readonly "startup.skipLogoAnimation": {
+        readonly type: "boolean";
+        readonly default: false;
+        readonly ui: {
+            readonly tab: "interaction";
+            readonly label: "Skip Startup Logo Animation";
+            readonly description: "Skip the animated startup logo sweep; the welcome surface, its resting logo, and all information rows still render. Applies at the next interactive start.";
+        };
+    };
     readonly "startup.checkUpdate": {
         readonly type: "boolean";
         readonly default: true;
@@ -2181,6 +2193,51 @@ export declare const SETTINGS_SCHEMA: {
             }];
         };
     };
+    readonly "compaction.adaptive.enabled": {
+        readonly type: "boolean";
+        readonly default: false;
+        readonly ui: {
+            readonly tab: "context";
+            readonly label: "Adaptive Compaction";
+            readonly description: "Adjust compaction frequency by context size and call rate";
+        };
+    };
+    readonly "compaction.adaptive.baseThresholdPercent": {
+        readonly type: "number";
+        readonly default: 85;
+        readonly ui: {
+            readonly tab: "context";
+            readonly label: "Adaptive Base Threshold %";
+            readonly description: "Base context percentage used when adaptive compaction is enabled";
+        };
+    };
+    readonly "compaction.adaptive.aggression": {
+        readonly type: "number";
+        readonly default: 0.15;
+        readonly ui: {
+            readonly tab: "context";
+            readonly label: "Adaptive Aggression";
+            readonly description: "How strongly call rate lowers the compaction threshold; use 0 to 1";
+        };
+    };
+    readonly "compaction.adaptive.turnWindow": {
+        readonly type: "number";
+        readonly default: 15;
+        readonly ui: {
+            readonly tab: "context";
+            readonly label: "Call-Rate Window";
+            readonly description: "Minutes of recent calls considered by adaptive compaction";
+        };
+    };
+    readonly "compaction.adaptive.minThresholdPercent": {
+        readonly type: "number";
+        readonly default: 50;
+        readonly ui: {
+            readonly tab: "context";
+            readonly label: "Adaptive Floor %";
+            readonly description: "Lowest context percentage adaptive compaction may lower the threshold to";
+        };
+    };
     readonly "compaction.handoffSaveToDisk": {
         readonly type: "boolean";
         readonly default: false;
@@ -4509,6 +4566,13 @@ export interface CompactionSettings {
     strategy: "context-full" | "handoff" | "off";
     thresholdPercent: number;
     thresholdTokens: number;
+    adaptive: {
+        enabled: boolean;
+        baseThresholdPercent: number;
+        aggression: number;
+        turnWindow: number;
+        minThresholdPercent: number;
+    };
     reserveTokens: number;
     keepRecentTokens: number;
     handoffSaveToDisk: boolean;

package/dist/types/coordinator/contract.d.ts

@@ -1,4 +1,4 @@
 export declare const COORDINATOR_MCP_PROTOCOL_VERSION = "2024-11-05";
 export declare const COORDINATOR_MCP_SERVER_NAME = "gjc-coordinator-mcp";
-export declare const COORDINATOR_MCP_TOOL_NAMES: readonly ["gjc_coordinator_list_sessions", "gjc_coordinator_read_status", "gjc_coordinator_read_tail", "gjc_coordinator_list_questions", "gjc_coordinator_list_artifacts", "gjc_coordinator_read_artifact", "gjc_coordinator_read_coordination_status", "gjc_coordinator_watch_events", "gjc_coordinator_register_session", "gjc_coordinator_start_session", "gjc_coordinator_activate_session", "gjc_coordinator_stop_session", "gjc_coordinator_send_prompt", "gjc_coordinator_submit_question_answer", "gjc_coordinator_read_turn", "gjc_coordinator_await_turn", "gjc_coordinator_report_status", "gjc_coordinator_register_codex_handoff", "gjc_coordinator_read_codex_handoff", "gjc_coordinator_ack_codex_handoff", "gjc_delegate_plan", "gjc_delegate_execute"];
+export declare const COORDINATOR_MCP_TOOL_NAMES: readonly ["gjc_coordinator_list_sessions", "gjc_coordinator_read_status", "gjc_coordinator_read_tail", "gjc_coordinator_list_questions", "gjc_coordinator_list_artifacts", "gjc_coordinator_read_artifact", "gjc_coordinator_read_coordination_status", "gjc_coordinator_watch_events", "gjc_coordinator_register_session", "gjc_coordinator_start_session", "gjc_coordinator_retire_start_session", "gjc_coordinator_activate_session", "gjc_coordinator_stop_session", "gjc_coordinator_send_prompt", "gjc_coordinator_submit_question_answer", "gjc_coordinator_read_turn", "gjc_coordinator_await_turn", "gjc_coordinator_report_status", "gjc_coordinator_register_codex_handoff", "gjc_coordinator_read_codex_handoff", "gjc_coordinator_ack_codex_handoff", "gjc_delegate_plan", "gjc_delegate_execute"];
 export type CoordinatorToolName = (typeof COORDINATOR_MCP_TOOL_NAMES)[number];

package/dist/types/coordinator-mcp/question-state.d.ts

@@ -308,7 +308,7 @@ export interface CreationRequestV1 {
     key_digest: string;
     request_digest: string;
     tool: string;
-    phase: "claimed" | "remote_started" | "wal_committed" | "projected" | "completed" | "uncertain";
+    phase: "claimed" | "remote_started" | "wal_committed" | "projected" | "completed" | "uncertain" | "retired";
     canonical_create_intent: CanonicalCreateIntentV1 | null;
     remote_create_key: string;
     session_id: string | null;
@@ -317,12 +317,45 @@ export interface CreationRequestV1 {
         key_id: string;
         public_key: string;
     } | null;
+    /** Retirement is staged before the broker effect so a post-effect crash can replay safely. */
+    retirement_intent?: CreationRetirementIntentV1;
     wal_revision?: number;
     wal_digest?: string;
     safe_response?: Record<string, unknown>;
     created_at: string;
     updated_at: string;
 }
+export interface CreationRetirementProofV1 {
+    session_id: string;
+    cwd: string;
+    state_root: string;
+    endpoint_generation: number;
+    endpoint_mtime_ms: number;
+    process_incarnation: string;
+    host_incarnation: string;
+    lifecycle_request_id: string;
+    remote_create_key: string;
+}
+export interface CreationRetirementBrokerProofV1 {
+    session_id: string;
+    retired: true;
+    ledger_state: "terminal_error";
+    index_type: "session_closed";
+    state_root: string;
+    endpoint_generation: number;
+    endpoint_mtime_ms: number;
+    process_incarnation: string;
+    host_incarnation: string;
+    lifecycle_request_id: string;
+    remote_create_key: string;
+}
+export interface CreationRetirementIntentV1 {
+    phase: "intent" | "pre_effect_rejected" | "broker_retired";
+    proof: CreationRetirementProofV1;
+    retirement_key_digest?: string;
+    broker_proof?: CreationRetirementBrokerProofV1;
+    updated_at: string;
+}
 export interface NamespaceDeletionEntryV1 {
     deletion_id: string;
     session_id: string;
@@ -528,8 +561,15 @@ export declare function compactTransaction(transaction: CoordinatorSessionTransa
 export declare function repairProjections(paths: CoordinatorStatePaths, sessionId: string, project: (canonical: CoordinatorSessionTransactionV1["canonical"]) => Promise<void>, options?: {
     signal?: AbortSignal;
 }): Promise<void>;
+/** Claims retirement under the creation receipt before any broker effect. */
+export declare function recordCreationRetirementIntent(paths: CoordinatorStatePaths, keyDigest: string, proof: CreationRetirementProofV1, retirementKeyDigest?: string): Promise<CreationRequestV1>;
+/** Replaces only a pre-effect retirement proof after an explicit broker rejection. */
+export declare function replaceCreationRetirementIntent(paths: CoordinatorStatePaths, keyDigest: string, proof: CreationRetirementProofV1, retirementKeyDigest: string): Promise<CreationRequestV1>;
+/** Records the bounded broker proof before receipt advancement or idempotency sealing. */
+export declare function recordCreationRetirementBrokerProof(paths: CoordinatorStatePaths, keyDigest: string, proof: CreationRetirementProofV1, brokerProof: CreationRetirementBrokerProofV1): Promise<CreationRequestV1>;
 /** Advances a creation receipt only after its WAL or projection authority exists. */
-export declare function advanceCreationReceipt(paths: CoordinatorStatePaths, keyDigest: string, phase: "projected" | "completed" | "uncertain", safeResponse?: Record<string, unknown>): Promise<void>;
+export declare function assertCreationRetirementIdentity(paths: CoordinatorStatePaths, keyDigest: string, proof: CreationRetirementProofV1): Promise<CreationRequestV1>;
+export declare function advanceCreationReceipt(paths: CoordinatorStatePaths, keyDigest: string, phase: "projected" | "completed" | "uncertain" | "retired", safeResponse?: Record<string, unknown>, proof?: CreationRetirementProofV1): Promise<void>;
 export declare function hasEmergencyCapacity(transaction: CoordinatorSessionTransactionV1, incomingBytes: number, essential: boolean): boolean;
 export declare function recordDeletionIntent(paths: CoordinatorStatePaths, entry: NamespaceDeletionEntryV1): Promise<void>;
 export declare function advanceDeletion(paths: CoordinatorStatePaths, deletionId: string, phase: NamespaceDeletionEntryV1["phase"], cleanup?: Partial<NamespaceDeletionEntryV1["cleanup"]>, safeResponse?: Record<string, unknown>): Promise<void>;

package/dist/types/extensibility/extensions/types.d.ts

@@ -80,6 +80,8 @@ export interface ExtensionUIDialogOptions {
     customInput?: {
         optionLabel: string;
         onSubmit: (text: string) => void;
+        /** Empty/whitespace-only submissions may be rejected by the selector. */
+        allowEmpty?: boolean;
     };
     /**
      * Inline free-text input for a non-answer clarification action. It is

package/dist/types/gjc-runtime/deep-interview-state.d.ts

@@ -99,6 +99,18 @@ export declare function deriveRoundKey(interviewId: string | undefined, input: {
     round: number;
     questionId?: string;
 }): string;
+/**
+ * Envelope-reserved keys that are never legitimate interview `state` fields.
+ *
+ * A malformed write that wraps a whole envelope under `state`
+ * (`gjc state deep-interview write --input '{"state": <envelope>}'`) leaks these
+ * into the nested state. Because normalization otherwise preserves unknown
+ * nested fields, they would accrete a recursive `state.state` chain (plus stale
+ * `receipt`/`skill`/`version`/... duplicates) that no later merge or write ever
+ * removes, permanently corrupting the shape. They are stripped from `state` on
+ * normalize so the canonical envelope self-heals on the next write.
+ */
+export declare const ENVELOPE_RESERVED_STATE_KEYS: readonly ["state", "receipt", "skill", "version", "updated_at", "active", "current_phase", "state_revision", "source_state_revision", "last_applied_draft_id", "session_id"];
 /**
  * Canonicalize a deep-interview envelope: interview data nested under `state`,
  * legacy flattened fields hoisted in losslessly, transcript duplicates removed

package/dist/types/gjc-runtime/workflow-placeholder.d.ts

@@ -0,0 +1,6 @@
+/** Shared placeholder semantics for model-authored workflow content. */
+export declare const WORKFLOW_PLACEHOLDER_CORRECTION = "provide a specific, non-placeholder question or objective instead of empty, whitespace, unused, TODO, TBD, N/A, N-A, NA, none, placeholder, or stub";
+/** Exact, case-insensitive placeholder detection; meaningful sentences remain valid. */
+export declare function isWorkflowPlaceholderText(value: unknown): boolean;
+/** Detect a legacy formatted deep-interview ask whose visible body is a placeholder. */
+export declare function isLegacyDeepInterviewPlaceholder(value: unknown): boolean;

package/dist/types/main.d.ts

@@ -47,7 +47,7 @@ export interface InteractiveModeNotify {
     kind: "warn" | "error" | "info";
     message: string;
 }
-export declare function submitInteractiveInput(mode: Pick<InteractiveMode, "markPendingSubmissionStarted" | "finishPendingSubmission" | "showError" | "checkShutdownRequested">, session: Pick<AgentSession, "prompt" | "promptCustomMessage">, input: SubmittedUserInput): Promise<void>;
+export declare function submitInteractiveInput(mode: Pick<InteractiveMode, "markPendingSubmissionStarted" | "finishPendingSubmission" | "showError" | "checkShutdownRequested" | "waitForAgentEnd">, session: Pick<AgentSession, "prompt" | "promptCustomMessage">, input: SubmittedUserInput): Promise<void>;
 type StartupModelProfileArgs = {
     session: AgentSession;
     settings: Settings;

package/dist/types/modes/action-registry.d.ts

@@ -26,4 +26,5 @@ export declare class ActionRegistry<Context> {
     all(): readonly ActionDefinition<Context>[];
     isAvailable(id: AppKeybinding): boolean;
     execute(id: AppKeybinding): Promise<boolean>;
+    executeFresh(id: AppKeybinding): Promise<boolean>;
 }

package/dist/types/modes/components/hook-selector.d.ts

@@ -47,6 +47,7 @@ export interface HookSelectorOptions {
     customInput?: {
         optionLabel: string;
         onSubmit: (text: string) => void;
+        allowEmpty?: boolean;
     };
     clarificationInput?: {
         optionLabel: string;

package/dist/types/modes/components/runtime-mcp-add-wizard.d.ts

@@ -20,7 +20,7 @@ export interface MCPAddWizardOAuthResult {
 }
 export declare class MCPAddWizard extends Container {
     #private;
-    constructor(onComplete: (name: string, config: MCPServerConfig, scope: Scope) => void, onCancel: () => void, onOAuth?: (endpointUrl: string, authUrl: string, tokenUrl: string, clientId: string, clientSecret: string, scopes: string) => Promise<MCPAddWizardOAuthResult>, onTestConnection?: (config: MCPServerConfig) => Promise<void>, onRender?: () => void, initialName?: string);
+    constructor(onComplete: (name: string, config: MCPServerConfig, scope: Scope) => void, onCancel: () => void, onOAuth?: (endpointUrl: string, authUrl: string, tokenUrl: string, clientId: string, clientSecret: string, scopes: string, signal: AbortSignal) => Promise<MCPAddWizardOAuthResult>, onTestConnection?: (config: MCPServerConfig) => Promise<void>, onRender?: () => void, onCommandPalette?: (keyData: string) => boolean, initialName?: string, onOAuthCredentialCleanup?: (credentialId: string) => Promise<void> | void, onOAuthCredentialCleanupError?: (credentialId: string, error: unknown) => void);
     dispose(): void;
     handleInput(keyData: string): void;
 }

package/dist/types/modes/components/welcome.d.ts

@@ -18,6 +18,8 @@ export interface WelcomeComponentOptions {
     collapseChangelog?: boolean;
     buildLabel?: string;
     keyDisplayContext?: KeyDisplayContext;
+    /** Render the resting logo frame instead of playing the startup gradient sweep. */
+    reducedMotion?: boolean;
 }
 /**
  * GJC-native launch surface with compact command affordances, project

package/dist/types/modes/controllers/input-controller.d.ts

@@ -1,8 +1,17 @@
 import { type AutocompleteProvider, type SlashCommand } from "@gajae-code/tui";
-import { type ComposerSubmissionOptions, type InteractiveModeContext } from "../../modes/types";
+import { type ComposerSubmissionOptions, type InteractiveModeContext, type SubmittedUserInput } from "../../modes/types";
 import { loadPastedImageBatch } from "../../utils/pasted-image-loading";
 import { ActionRegistry } from "../action-registry";
 import type { PasteTextContext } from "../components/custom-editor";
+/**
+ * Navigation actions that already carry a registry callback and an availability
+ * predicate but shipped with no curated command-palette entry and no key
+ * dispatch, leaving them unreachable from the palette. They opt into
+ * availability gating so an unavailable id is not listed, and each gets a remap
+ * dispatch loop while keeping `defaultKeys: []` -- inert at defaults, but a user
+ * binding now dispatches instead of only being rendered by the selector.
+ */
+export declare const AVAILABILITY_GATED_NAV_PALETTE_ACTIONS: readonly ["app.session.dashboard", "app.transcript.browse", "app.transcript.prevTurn", "app.transcript.nextTurn", "app.queue.togglePane", "app.message.sendNow"];
 export declare const INTERACTIVE_ABORT_CLEANUP_TIMEOUT_MS = 5000;
 export declare const BACKGROUND_FOLD_DOUBLE_PRESS_MS = 750;
 interface InputControllerDependencies {
@@ -16,6 +25,12 @@ export declare class InputController {
     setupKeyHandlers(): void;
     setupEditorSubmitHandler(): void;
     submitText(text: string, composer: ComposerSubmissionOptions): Promise<void>;
+    takeDeferredSubmission(): SubmittedUserInput | undefined;
+    takeDeferredSubmissionForShutdown(): {
+        text: string;
+        images?: InteractiveModeContext["pendingImages"];
+    } | undefined;
+    discardDeferredSubmission(): void;
     handleCtrlC(): void;
     handleCtrlD(): void;
     handleCtrlZ(): void;

package/dist/types/modes/controllers/runtime-mcp-command-controller.d.ts

@@ -1,4 +1,37 @@
+import { type MCPOAuthConfig, MCPOAuthFlow } from "../../runtime-mcp/oauth-flow";
 import type { InteractiveModeContext } from "../types";
+/**
+ * Outcome of {@link MCPCommandController}'s OAuth handler.
+ *
+ * `clientId`/`clientSecret` are populated when the OAuth provider required (or
+ * accepted) dynamic client registration; callers MUST persist them alongside
+ * `credentialId` so subsequent token refreshes and reauthorizations can reuse
+ * the same registered client. Both are also set when the caller pre-supplied a
+ * client id via the wizard or `oauth.clientId` in `mcp.json`, in which case the
+ * write-back is a no-op.
+ */
+interface OAuthFlowResult {
+    credentialId: string;
+    tokenEndpoint: string;
+    clientId?: string;
+    clientSecret?: string;
+}
+type MCPAuthFlow = Pick<MCPOAuthFlow, "resolvedClientId" | "registeredClientSecret"> & {
+    login(): Promise<{
+        access: string;
+        refresh: string;
+        expires: number;
+    }>;
+};
+type MCPAuthCallbacks = {
+    onAuth(info: {
+        url: string;
+        instructions?: string;
+    }): void;
+    onProgress(message: string): void;
+    signal?: AbortSignal;
+};
+type MCPAuthFlowFactory = (config: MCPOAuthConfig, callbacks: MCPAuthCallbacks) => MCPAuthFlow;
 export declare class MCPCommandController {
     #private;
     private ctx;
@@ -7,4 +40,13 @@ export declare class MCPCommandController {
      * Handle /mcp command and route to subcommands
      */
     handle(text: string): Promise<void>;
+    /**
+     * Handle OAuth authentication flow for MCP server
+     */
+    /** Internal OAuth entry point; injectable flow construction keeps controller lifecycle coverage deterministic. */
+    handleOAuthFlow(endpointUrl: string, authUrl: string, tokenUrl: string, clientId: string, clientSecret: string, scopes: string, callbackPort?: number, callbackPath?: string, redirectUri?: string, oauthMeta?: {
+        issuer?: string;
+        issuerResponseIssSupported?: boolean;
+    }, createFlow?: MCPAuthFlowFactory, openBrowser?: (url: string) => void, signal?: AbortSignal): Promise<OAuthFlowResult>;
 }
+export {};

package/dist/types/modes/interactive-mode.d.ts

@@ -126,6 +126,10 @@ export declare class InteractiveMode implements InteractiveModeContext {
     skillCommands: Map<string, Skill>;
     oauthManualInput: OAuthManualInputManager;
     promptSuggestion: PromptSuggestionController;
+    waitForAgentEnd(): {
+        promise: Promise<void>;
+        dispose: () => void;
+    };
     readonly lspServers: LspStartupServerInfo[] | undefined;
     mcpManager?: import("../runtime-mcp").MCPManager;
     /** Direct controller capabilities for consumers that coordinate mode transitions. */
@@ -177,6 +181,9 @@ export declare class InteractiveMode implements InteractiveModeContext {
     }): void;
     showError(message: string): void;
     showWarning(message: string): void;
+    beginOAuthUrlForCopy(url: string): () => void;
+    hasOAuthUrlForCopy(): boolean;
+    copyOAuthUrl(): Promise<void>;
     syncActivityIndicator(): void;
     ensureLoadingAnimation(): void;
     stopLoadingAnimation(options?: ActivityIndicatorStopOptions): void;

package/dist/types/modes/shared/oauth-url-copy.d.ts

@@ -0,0 +1,9 @@
+export interface OAuthUrlCopyLeaseHost {
+    beginOAuthUrlForCopy(url: string): () => void;
+}
+export interface OAuthUrlCopyLease {
+    replace(url: string): void;
+    release(): void;
+}
+export declare function buildOAuthLoginAnchor(url: string, label?: string, hyperlinks?: boolean): string;
+export declare function createOAuthUrlCopyLease(host: OAuthUrlCopyLeaseHost): OAuthUrlCopyLease;

package/dist/types/modes/types.d.ts

@@ -173,6 +173,9 @@ export interface InteractiveModeContext {
     }): void;
     showError(message: string): void;
     showWarning(message: string): void;
+    beginOAuthUrlForCopy(url: string): () => void;
+    hasOAuthUrlForCopy(): boolean;
+    copyOAuthUrl(): Promise<void>;
     notifyConfigChanged?: () => Promise<void> | void;
     showNewVersionNotification(newVersion: string): void;
     clearEditor(): void;

package/dist/types/modes/ui-language.d.ts

@@ -1,4 +1,4 @@
-export declare const UI_LANGUAGES: readonly ["en", "ko"];
+export declare const UI_LANGUAGES: readonly ["en", "ko", "ja"];
 export type UiLanguage = (typeof UI_LANGUAGES)[number];
 declare const ENGLISH_STRINGS: {
     readonly "settings.title": "Settings";
@@ -21,6 +21,7 @@ declare const ENGLISH_STRINGS: {
     readonly "settings.language.description": "Language for human-facing interactive UI text";
     readonly "settings.language.english": "English";
     readonly "settings.language.korean": "Korean (한국어)";
+    readonly "settings.language.japanese": "Japanese (日本語)";
     readonly "language.current": "Current UI language:";
     readonly "language.changed": "UI language changed to";
     readonly "language.unknown": "Unknown language";

package/dist/types/sdk/broker/lifecycle-ledger.d.ts

@@ -144,5 +144,6 @@ export declare class LifecycleLedger {
     findCleanupPendingBySessionId(sessionId: string, excludingIdentity: string): LifecycleLedgerEntry | undefined;
     hasUncertainCleanupForSession(sessionId: string, excludingIdentity: string): boolean;
     get(identity: string): LifecycleLedgerEntry | undefined;
+    listUncertainCreatesBySessionId(sessionId: string, effectMarker?: string, remoteCreateKey?: string): LifecycleLedgerEntry[];
     findPendingCleanupByTarget(sessionId: string, cwd: string, transcriptPath: string): LifecycleLedgerEntry | undefined;
 }