@gajae-code/coding-agent 0.15.3 → 0.15.5

package/CHANGELOG.md

@@ -2,10 +2,35 @@
 
 ## [Unreleased]
 
+## [0.15.5] - 2026-08-29
+
+- Bash now blocks tmux input commands that resolve to the agent's own pane before spawning the shell, including direct pane targets, session aliases, explicit socket forms, shell wrappers, and inspected script indirection. Read-only inspection and cross-session orchestration remain available, while blocked input cannot reach the transcript as a user turn. (#5039)
+- Saved-session staged model-selection appends now re-authenticate metadata-only drift on the same managed transcript object using its unchanged inode, link count, length, and content digest. A changed successor still fails closed, so native Windows persistence no longer turns routine timestamp updates into `managed_append_identity_mismatch` setup failures.
+- The GLM tiers now spend `zai/glm-5.3-flash` on the high-volume lanes and keep judgment roles on `zai/glm-5.3`: `glm-eco` moves default, executor, and planner to `glm-5.3-flash:low` (critic and architect stay `glm-5.3:high`), `glm-medium` swaps only the executor to `glm-5.3-flash:low`, and `glm-pro` swaps the executor to `glm-5.3-flash:high`. GLM-5.3-Flash also joins the bundled `zai` catalog with GLM-5.3's text contract pinned in `applyGeneratedModelPolicy` (1M context, 128K output, always-on `low`/`high`/`max` reasoning effort), because models.dev currently lists it with null limits and a catalog regeneration would otherwise degrade it to the unknown-window fallback; it is skip-listed in the autorouting tier map as not yet curated.
+- A content-free generic OpenAI Responses capacity overload no longer ends the turn under the default retry configuration. OpenAI reports it inside an HTTP 200 terminal envelope (`response.failed`, or `response.completed` with a `failed` status), so the turn surfaced `server_is_overloaded: …` and went idle for a failure the provider says to retry. The bare-default admission now also accepts that exact typed code, read only from transport facts and never from prose: the failed attempt must be on the `openai-responses` API, carry `openaiErrorCode` and `providerCode` equal to `server_is_overloaded` (matched case-sensitively) and no other transport fact (no status, no retained retry header, no second typed code, no error kind, no request size, first-event timing, endpoint class, or provider retry ceiling), and carry no assistant text, thinking, or tool call. Under bare defaults, an overload that follows observable work earlier in the same run is still terminal, `retry.enabled: false` still surfaces immediately, and the Codex and Anthropic overload admissions are unchanged. (#5018)
+- A metadata-only touch of the managed transcript file (AV scanning, indexing, backup sync — anything that bumps `mtimeNs`/`ctimeNs` without changing bytes) no longer crashes an interactive session with an unhandled `managed_append_identity_mismatch` rejection. `appendExpectedIdentitySync` compared only `dev`/`ino`/`size`/`mtimeNs`/`ctimeNs` against the persisted expectation, so a present-but-drifted predecessor was rethrown as a genuine successor and killed the process at the next prompt. The append receipt now carries the content digest the append path already computes (`append_managed` binds `sha256` to the final identity), `#captureManagedPersistIdentity` persists that descriptor-bound digest with the expectation, and a mismatching expectation is re-authenticated: identical bytes on the same unlinked file object with an unchanged link count refresh the expectation and proceed, while a changed inode, length, link count, or digest keeps failing closed so a concurrent successor is never overwritten. Regression-tested with two consecutive drifts, an intact successor guarantee, and an interactive input-loop containment test. (#4892)
+- Behavior change: this overload is now treated as a bounded provider-overload replay under explicit `retry.*` settings as well. It previously fell into the unbounded transient-prose retry class (its message matches `overloaded`), so a configured session retried it without limit; it now stops at `retry.maxRetries` with the existing capped exponential backoff, the same bound bare defaults use. (#5018)
+- Managed fallback behavior is preserved for the typed Responses overload: the new transport facts do not change the agent loop's managed transaction handling or the managed chain's retry/advance policy for this failure (the `server` classification remains a session-side classifier only). (#5018)
+- A single refused notification publication no longer kills a live session's chat mirroring for the rest of that session. `SessionRouter.#dispatchNotificationFrame` treated any rejection from the provider hook as terminal and called `#detachNotification(attached, "cancelled")`, which latches `notificationCancelled` on the `AttachedSession`; only a new attachment clears that latch, and a session that keeps running never gets one. The Telegram daemon throws exactly such a per-frame rejection from `#failPublicationPreSend` (for example `Telegram publication rejected before send: trusted attachment lease is stale`) when its topic or attachment lease momentarily fails `#leaseAllows` while another session attaches or detaches, so one transient authority flip permanently silenced that session's topic while every other session kept delivering — the user-visible symptom being Telegram that "works sometimes". Measured on one install over a single day: 20 such rejections across 20 distinct sessions, exactly one each, and 19 of the 20 never emitted another notification frame afterwards (their topic lease heartbeat stopped one to five seconds after the rejection, because the detach removed the endpoint from the daemon). Dispatch now tolerates a bounded run of consecutive local failures before conceding, mirroring `DELIVERY_ATTEMPT_LIMIT` on the ordered-delivery path in the same file: the refused frame is still dropped (the provider has already settled that publication as rejected on its own side), the next delivered frame resets the run, and a provider that never accepts anything is still cancelled after the limit. The `NOTIFICATION_WORK_TIMEOUT` path is deliberately unchanged — a hung provider is a different failure class and keeps its immediate detach — and core attachment authority, replay, lease renewal, and every other detach reason (`removed`, `replaced`, `replaced_same_generation`) are untouched.
+- `gjc update` now recognizes an already verified standalone binary during package-manager shim migration, avoiding repeated downloads and post-update work while clearly explaining the required PATH ordering.
+
+- GJC-managed launch worktrees now default to `<repo>/.worktrees/<slug>` instead of a `<repo>.gajae-code-worktrees` sibling beside the checkout, keeping each repository's isolated branches in one predictable local folder. Launch fails with an actionable diagnostic unless an in-repository bucket is ignored by Git, preventing nested worktrees from polluting the source checkout; external `GJC_WORKTREE_DIR` buckets and already registered sibling worktrees are unchanged.
+- Launch worktree reuse now revalidates Git-registered paths before adoption and reports locked or replaced stale entries instead of running Git commands in an unavailable or occupied directory; coordinator policy and Stream Deck project grouping use the repository-local default while retaining legacy sibling-path recognition.
+
+### Fixed
+
+- A one-shot `gjc sdk` command no longer idles for five seconds after its response is written. `SessionRouter` bounded four waits with `Bun.sleep` inside `Promise.race`; the race settles on the winner but does not cancel the loser, and a pending `Bun.sleep` keeps the event loop alive, so work that finished in milliseconds still owed the rest of the budget before the process could exit. `gjc sdk session list` wrote its result at 0.50s and exited at 5.51s. The startup attach budget, shutdown timeout, bounded notification work, and replay backoff now use the existing `cancellableSleep` helper with an `AbortController` cancelled once the race settles, and the reconcile interval is unref'd so a Router started without a matching `stop()` does not hold a host process open. The same command now exits at 1.65s, and every command routed through `withRouter` (`session.list`, `session.create`, `session.delete`, `session.fork`, `turn.prompt`, `turn.result`, `queue.*`, `compaction.*`) is affected.
+
+## [0.15.4] - 2026-08-29
+
+- The `ask` tool now rejects empty or whitespace-only custom answers on every local and remote input path. Remote invalid answers receive a visible explanation and are retried at most three times with an event-loop yield between attempts before the ask is cancelled; local empty custom input is never returned as a valid answer. (#5001)
+
 ## [0.15.3] - 2026-08-27
 
 ### Added
 
+- Added opt-in `compaction.adaptive.*` settings and wired them into post-turn and pre-prompt auto-compaction. Adaptive mode remains disabled by default, preserves fixed-token precedence, and exposes bounded base, aggression, call-window, and minimum-threshold controls.
+
 - The `ask` tool declares its display-only argument fields (`questions.question`, `questions.options.label`) via `displaySafeEscapedArgFields`, so an `ask` call whose question text or option labels arrive as `\uXXXX` escapes (common from Anthropic models writing Korean or emoji) completes with a single warning instead of discarding the turn, charging the managed-fallback retry budget, and ultimately failing the run. Ids, workflow-gate metadata, and deep-interview records remain load-bearing and keep the fail-closed rejection. (#4983)
 
 - Added an explicit `Copy OAuth URL` command-palette action for interactive `/login` and runtime MCP OAuth flows. It copies the exact pending authorization URL through the configured clipboard transport only after the user selects the action; it never overwrites the clipboard automatically and clears the pending URL when the flow ends. This preserves OSC 8 policy, tmux/SSH/no-hyperlink behavior, and avoids relying on padded soft-wrapped terminal rows for copying.
@@ -35,6 +60,7 @@
 - Foreground activity animation now uses layout-only TUI repaints, avoiding repeated reconstruction of unchanged transcript content during long sessions.
 - Notification adapters can now opt into one live representation per native effect: adapters that accept a positioned event are excluded from its matching raw fan-out, while ordinary direct SDK and raw-only legacy subscribers retain their existing delivery. Telegram opts in, preventing turn output, tool activity, and reasoning summaries from rendering twice after #4570; acknowledged terminal shutdown delivery is unchanged.
 - Lean notifications no longer replay a retained completion receipt at idle when identical text was already delivered immediately before an autonomous `ask`; distinct receipts and other settlement windows remain preserved.
+- SDK prompts now publish a bounded structured terminal failure when a provider immediately returns HTTP 402 or 429. The accepted receipt remains non-terminal until the correlated `agent_end`, while `turn.result`/`turn.prompt_status` no longer strand the prompt as `in_flight`; replacement turns remain independently abortable and recoverable. (#4941)
 
 ## [0.15.2] - 2026-08-25
 
@@ -43,7 +69,6 @@
 - Version 0.15.1 was tagged but never published: release automation failed while deriving release notes, before any package reached npm. Everything listed under `## [0.15.1]` below ships in this release.
 
 ## [0.15.1] - 2026-08-25
-
 ### Added
 
 - Added `/language [en|ko]`, the interactive slash command for the persisted `ui.language` selection. Without arguments it reports the current language; with a canonical code, locale tag (`en-US`, `ko-KR`), endonym (`한국어`), English name, or common aliases (`eng`, `kr`, `kor`) it persists the canonical `en`/`ko` value through settings and confirms in the selected language. An unsupported value is rejected with the available list and changes nothing. See `docs/ui-language.md`.

package/dist/types/cli/update-cli.d.ts

@@ -53,6 +53,11 @@ export type PackageManagerTarget = {
     manager: "npm";
     packageName: string;
 };
+type MigrationUpdateTarget = {
+    method: "migrate";
+    path: string;
+    previousPath?: string;
+};
 export type UpdateTarget = {
     method: "bun";
 } | {
@@ -61,11 +66,7 @@ export type UpdateTarget = {
 } | {
     method: "binary";
     path: string;
-} | {
-    method: "migrate";
-    path: string;
-    previousPath?: string;
-};
+} | MigrationUpdateTarget;
 type PathPlatform = NodeJS.Platform;
 type PackageExists = (packageName: string, packageRoot: string) => boolean;
 export declare function resolveUpdateMethodForTest(ompPath: string, bunBinDir: string | undefined): "bun" | "npm" | "binary";
@@ -85,6 +86,24 @@ export declare function resolveGjcPathForTest(options: {
     whichPath: string | undefined;
 }): string | undefined;
 export declare function parseReportedVersionForTest(output: string): string | undefined;
+interface MigrationTargetVerificationOptions {
+    runtimePath: string;
+    verifyChecksum: () => Promise<void>;
+    verifyRuntime: () => Promise<InstalledVersionVerification>;
+}
+interface MigrationChecksumOptions {
+    tag: string;
+    assetName: string;
+    filePath: string;
+}
+type MigrationChecksumVerifier = (options: MigrationChecksumOptions) => Promise<unknown>;
+export declare function verifyMigrationTargetForTest(options: MigrationTargetVerificationOptions): Promise<InstalledVersionVerification>;
+export declare function verifyMigrationTargetAdapterForTest(options: {
+    release: Pick<ReleaseInfo, "tag" | "version">;
+    runtimePath: string;
+    verifyChecksum: MigrationChecksumVerifier;
+    verifyRuntime: (expectedVersion: string, runtimePath: string) => Promise<InstalledVersionVerification>;
+}): Promise<InstalledVersionVerification>;
 export declare function formatBinaryDownloadFailureMessageForTest(binaryName: string, url: string, status: string | number, platform?: NodeJS.Platform, registryNote?: string): string;
 export declare function buildReleaseBinaryUrlForTest(version: string, platform?: NodeJS.Platform, arch?: string): string;
 export declare function formatManualUpdateInstructionsForTest(platform?: NodeJS.Platform): string;
@@ -123,6 +142,7 @@ export declare function runBinaryUpdateFlow(targetPath: string, url: string, exp
 export interface UpdateCommandDependencies {
     getLatestRelease?: (options?: LatestReleaseLookupOptions) => Promise<ReleaseInfo>;
     resolveUpdateTarget?: () => Promise<UpdateTarget>;
+    verifyMigrationTarget?: (release: ReleaseInfo, runtimePath: string) => Promise<InstalledVersionVerification>;
     performUpdate?: (target: UpdateTarget, expectedVersion: string, registry?: string) => Promise<InstalledVersionVerification | undefined>;
     refreshInstalledDefaultSkills?: () => Promise<void>;
     settings?: () => Promise<Settings>;

package/dist/types/config/autorouting-tier-map.d.ts

@@ -250,6 +250,9 @@ export declare const TIER_MAP_SKIP_LIST: {
     readonly "zai/glm-5.3": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };
+    readonly "zai/glm-5.3-flash": {
+        readonly rationale: "post-feature catalog addition; not yet curated";
+    };
     readonly "cursor/gemini-3.7-flash-high": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };

package/dist/types/config/settings-schema.d.ts

@@ -2193,6 +2193,51 @@ export declare const SETTINGS_SCHEMA: {
             }];
         };
     };
+    readonly "compaction.adaptive.enabled": {
+        readonly type: "boolean";
+        readonly default: false;
+        readonly ui: {
+            readonly tab: "context";
+            readonly label: "Adaptive Compaction";
+            readonly description: "Adjust compaction frequency by context size and call rate";
+        };
+    };
+    readonly "compaction.adaptive.baseThresholdPercent": {
+        readonly type: "number";
+        readonly default: 85;
+        readonly ui: {
+            readonly tab: "context";
+            readonly label: "Adaptive Base Threshold %";
+            readonly description: "Base context percentage used when adaptive compaction is enabled";
+        };
+    };
+    readonly "compaction.adaptive.aggression": {
+        readonly type: "number";
+        readonly default: 0.15;
+        readonly ui: {
+            readonly tab: "context";
+            readonly label: "Adaptive Aggression";
+            readonly description: "How strongly call rate lowers the compaction threshold; use 0 to 1";
+        };
+    };
+    readonly "compaction.adaptive.turnWindow": {
+        readonly type: "number";
+        readonly default: 15;
+        readonly ui: {
+            readonly tab: "context";
+            readonly label: "Call-Rate Window";
+            readonly description: "Minutes of recent calls considered by adaptive compaction";
+        };
+    };
+    readonly "compaction.adaptive.minThresholdPercent": {
+        readonly type: "number";
+        readonly default: 50;
+        readonly ui: {
+            readonly tab: "context";
+            readonly label: "Adaptive Floor %";
+            readonly description: "Lowest context percentage adaptive compaction may lower the threshold to";
+        };
+    };
     readonly "compaction.handoffSaveToDisk": {
         readonly type: "boolean";
         readonly default: false;
@@ -4521,6 +4566,13 @@ export interface CompactionSettings {
     strategy: "context-full" | "handoff" | "off";
     thresholdPercent: number;
     thresholdTokens: number;
+    adaptive: {
+        enabled: boolean;
+        baseThresholdPercent: number;
+        aggression: number;
+        turnWindow: number;
+        minThresholdPercent: number;
+    };
     reserveTokens: number;
     keepRecentTokens: number;
     handoffSaveToDisk: boolean;

package/dist/types/extensibility/extensions/types.d.ts

@@ -80,6 +80,8 @@ export interface ExtensionUIDialogOptions {
     customInput?: {
         optionLabel: string;
         onSubmit: (text: string) => void;
+        /** Empty/whitespace-only submissions may be rejected by the selector. */
+        allowEmpty?: boolean;
     };
     /**
      * Inline free-text input for a non-answer clarification action. It is
@@ -342,6 +344,7 @@ export interface ExtensionContext {
             cleanedArgs?: string;
         }) => void;
         preflightSignal?: AbortSignal;
+        sdkRunToken?: string;
     }): Promise<unknown>;
     setPlanMode?(on: boolean): unknown;
     operateGoal?(op: "create" | "get" | "resume" | "pause" | "complete" | "drop", objective?: string): Promise<unknown>;
@@ -490,6 +493,8 @@ export interface AgentStartEvent extends SharedAgentStartEvent {
 export interface AgentFailedEvent {
     type: "agent_failed";
     error: AgentFailureDiagnostic;
+    /** Internal SDK queue-owner binding for exact lifecycle attribution. */
+    sdkRunToken?: string;
     /** Attempt correlation for the failing run, when scoped (matches the
      * agent_start/agent_end scope contract). */
     scope?: AttemptScope;

package/dist/types/extensibility/shared-events.d.ts

@@ -148,6 +148,8 @@ export interface AgentStartEvent {
 export interface AgentEndEvent {
     type: "agent_end";
     messages: AgentMessage[];
+    /** Internal SDK queue-owner binding for exact lifecycle attribution. */
+    sdkRunToken?: string;
     /** Indicates whether the loop ended normally, suspended, cancelled, or entered maintenance. */
     stopReason?: "completed" | "paused" | "cancelled" | "maintenance";
     /** Present for maintenance checkpoints; non-aborted checkpoints are not terminal. */

package/dist/types/gjc-runtime/workflow-placeholder.d.ts

@@ -0,0 +1,6 @@
+/** Shared placeholder semantics for model-authored workflow content. */
+export declare const WORKFLOW_PLACEHOLDER_CORRECTION = "provide a specific, non-placeholder question or objective instead of empty, whitespace, unused, TODO, TBD, N/A, N-A, NA, none, placeholder, or stub";
+/** Exact, case-insensitive placeholder detection; meaningful sentences remain valid. */
+export declare function isWorkflowPlaceholderText(value: unknown): boolean;
+/** Detect a legacy formatted deep-interview ask whose visible body is a placeholder. */
+export declare function isLegacyDeepInterviewPlaceholder(value: unknown): boolean;

package/dist/types/modes/components/hook-selector.d.ts

@@ -47,6 +47,7 @@ export interface HookSelectorOptions {
     customInput?: {
         optionLabel: string;
         onSubmit: (text: string) => void;
+        allowEmpty?: boolean;
     };
     clarificationInput?: {
         optionLabel: string;

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -278,8 +278,15 @@ export declare const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * Generation 177 consumes an exact same-window lean settlement receipt only
  * after its autonomous ask lead-in publishes successfully, preventing idle
  * replay without changing the serving protocol.
+ * Generation 178: idle publication waits for positioned identity delivery to
+ * cross the native writer barrier before the independent broadcast lane.
+ * Generation 179 tolerates a bounded consecutive run of refused notification
+ * publications in the router instead of cancelling the subscription on the
+ * first refusal, so an owner still running the generation-178 router keeps
+ * killing a session's mirroring after one transient rejection and must be
+ * replaced across this upgrade.
  */
-export declare const DAEMON_GENERATION = 178;
+export declare const DAEMON_GENERATION = 179;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7
  * requires durable publication receipts and acknowledged attachment dispatch,

package/dist/types/sdk/cli/session-cli.d.ts

@@ -1,5 +1,7 @@
 import { SessionRouter } from "../router";
-export type SdkSessionCliAction = "list" | "inspect" | "send" | "status" | "tail" | "retire" | "raw" | "control" | "query" | "global";
+import { type SdkSessionRowV1 } from "./rows";
+export type SdkSessionCliAction = "list" | "inspect" | "send" | "status" | "tail" | "retire" | "global" | "raw" | "control" | "query" | "global";
+export type SdkSessionListScope = "repo" | "cwd" | "worktree" | "all";
 export type SdkSessionCliRawKind = "control" | "query" | "global";
 export interface SdkSessionCliArgs {
     action?: string;
@@ -13,6 +15,7 @@ export interface SdkSessionCliArgs {
     jsonInputFile?: string;
     jsonInputStdin?: boolean;
     idempotencyKey?: string;
+    scope?: string;
     confirm?: boolean;
     cursor?: string;
     wait?: boolean;
@@ -27,6 +30,43 @@ export interface RetainedTranscriptTailReader {
     readonly size: number;
     readRange(start: number, end: number): Promise<Uint8Array>;
 }
+interface WorkspaceIdentity {
+    /** Canonical workspace path (realpath when it exists, lexical resolve otherwise). */
+    canonicalPath: string;
+    /** Canonical containing worktree root; null outside a Git checkout. */
+    repoRoot: string | null;
+    /** Canonical Git common dir; shared by the main checkout and linked worktrees. */
+    commonDir: string | null;
+}
+export interface SdkSessionListSelection {
+    scope: SdkSessionListScope;
+    selection: WorkspaceIdentity;
+    /** Bounded, credential-free descriptor included in list output. */
+    descriptor: {
+        scope: SdkSessionListScope;
+        path: string;
+        worktreeRoot?: string;
+        commonDir?: string;
+    };
+}
+/** Parses `--scope`; missing means `repo`, anything else invalid is a usage error. */
+export declare function parseSessionListScope(value: string | undefined): SdkSessionListScope;
+/**
+ * Resolves the list selection from `--repo` (default: process cwd) under the
+ * effective scope. Outside Git, `repo`/`worktree` fail typed and actionable —
+ * they never broaden to `all`; `cwd` remains an exact canonical match.
+ */
+export declare function resolveSessionListSelection(scope: SdkSessionListScope, repoArg: string | undefined): Promise<SdkSessionListSelection>;
+/**
+ * Filters fully traversed broker rows by the selection scope. Row workspaces
+ * are canonicalized and cached per distinct locator; `repo` matches the shared
+ * common dir across the main checkout and linked worktrees, `worktree` the
+ * containing worktree only, and `cwd` the exact canonical workspace.
+ */
+export declare function filterSessionRowsByScope(rows: readonly SdkSessionRowV1[], scope: SdkSessionListScope, selection: SdkSessionListSelection): Promise<{
+    sessions: SdkSessionRowV1[];
+    warnings: string[];
+}>;
 /** Creates a lowercase ULID operation reference for prompt reconciliation. */
 export declare function createOperationRef(now?: number): string;
 /** Exported for tests: each status poll must stay inside the caller's wait window. */
@@ -39,3 +79,4 @@ export declare function scanRetainedTranscriptTail(reader: RetainedTranscriptTai
 export declare function runTail(repo: string, agentDir: string, sessionId: string, args: SdkSessionCliArgs): Promise<unknown>;
 /** Runs the broker-bound `gjc sdk session` command family without exposing endpoint credentials. */
 export declare function runSdkSessionCli(args: SdkSessionCliArgs, writeOutput?: (value: unknown) => void, setExitCode?: (exitCode: 1 | 2) => void): Promise<void>;
+export {};

package/dist/types/sdk/host/host.d.ts

@@ -36,6 +36,8 @@ export interface SessionSdkHostOptions extends HostEndpointAdapters {
     query?: (connectionId: string, frame: SdkFrame) => unknown | Promise<unknown>;
     /** Test/lifecycle seam invoked synchronously before fire-and-forget dispatch. */
     onFrameAdmitted?: (connectionId: string, frame: SdkFrame) => void;
+    /** Synchronously rejects external input while a runtime is being replaced. */
+    onFrameAdmission?: (connectionId: string, frame: SdkFrame) => SdkFrame | undefined;
     /** Best-effort diagnostic observation of accepted control/query frames. */
     onRequest?: SdkRequestObserver;
     /** Runs before a control response is sent; identity transitions use sendTerminal. */

package/dist/types/sdk/host/session-runtime.d.ts

@@ -175,6 +175,10 @@ export interface CreateSdkSessionRuntimeOptions {
     terminalAbortSeams?: SdkOnlyTerminalAbortSeams;
     /** Callback when a frame is admitted to the runtime (test harness). */
     onFrameAdmitted?: () => void;
+    /** Test-only observation of a genuinely timed-out lifecycle drain. */
+    onLifecycleDrainTimeoutForTests?: () => void;
+    /** Test-only observation of bounded failure-diagnostic deduplication state. */
+    onFailureDiagnosticKeyCountForTests?: (count: number) => void;
 }
 export interface InvocationCorrelation {
     commandId: string;

package/dist/types/session/agent-session.d.ts

@@ -426,6 +426,8 @@ export interface PromptOptions {
     }) => void;
     /** Optional invocation-scoped cancellation fence used before an accepted skill starts execution. */
     preflightSignal?: AbortSignal;
+    /** Internal SDK lifecycle owner token. */
+    sdkRunToken?: string;
 }
 /** Result from a handoff operation. */
 export interface HandoffResult {
@@ -945,7 +947,7 @@ export declare class AgentSession {
     /** Live SDK configuration values exposed through the session query surface. */
     getSdkConfigItems(): Record<string, string>;
     setPlanModeState(state: PlanModeState | undefined): void;
-    invokeSkill(name: string, args?: string, options?: Pick<PromptOptions, "onPreflightAccepted" | "onPreflightAcceptCommit" | "onSkillPrepared" | "preflightSignal">): Promise<{
+    invokeSkill(name: string, args?: string, options?: Pick<PromptOptions, "onPreflightAccepted" | "onPreflightAcceptCommit" | "onSkillPrepared" | "preflightSignal" | "sdkRunToken">): Promise<{
         name: string;
         path: string;
         args?: string;
@@ -1000,7 +1002,7 @@ export declare class AgentSession {
      * @throws Error if no model selected or no API key available (when not streaming)
      */
     prompt(text: string, options?: PromptOptions): Promise<void>;
-    promptCustomMessage<T = unknown>(message: Pick<CustomMessage<T>, "customType" | "content" | "display" | "details" | "attribution">, options?: Pick<PromptOptions, "streamingBehavior" | "toolChoice" | "followUpQueuePolicy" | "onPreflightAccepted" | "onPreflightAcceptCommit" | "preflightSignal">): Promise<void>;
+    promptCustomMessage<T = unknown>(message: Pick<CustomMessage<T>, "customType" | "content" | "display" | "details" | "attribution">, options?: Pick<PromptOptions, "streamingBehavior" | "toolChoice" | "followUpQueuePolicy" | "onPreflightAccepted" | "onPreflightAcceptCommit" | "preflightSignal" | "sdkRunToken">): Promise<void>;
     /**
      * Queue a steering message to interrupt the agent mid-run.
      */

package/dist/types/session/internal/managed-session-storage.d.ts

@@ -65,9 +65,8 @@ export interface ManagedFileSnapshot {
     };
 }
 /**
- * Descriptor identity of one managed file object. Deliberately excludes the
- * content sha256: append receipts must bind the post-operation object without
- * re-reading the whole payload.
+ * Descriptor identity of one managed file object. Append receipts include a
+ * content digest when the append implementation has already computed it.
  */
 export interface ManagedFileIdentity {
     dev: bigint;
@@ -76,6 +75,7 @@ export interface ManagedFileIdentity {
     size: number;
     mtimeNs: bigint;
     ctimeNs: bigint;
+    sha256?: string;
 }
 /**
  * Post-operation evidence for one managed append. `descriptor` is the
@@ -91,6 +91,7 @@ export interface ManagedAppendReceipt {
 export interface ManagedBoundedAppendExpectation {
     readonly dev: string;
     readonly ino: string;
+    readonly nlink: string;
     readonly size: string;
     readonly mtimeNs: string;
     readonly ctimeNs: string;

package/dist/types/tools/ask.d.ts

@@ -45,6 +45,7 @@ export interface AskToolDetails {
 export declare const OTHER_OPTION = "Other (type your own)";
 export declare const ASK_CLARIFICATION_OPTION = "Ask about these choices";
 export declare const RECOMMENDED_SUFFIX = " (Recommended)";
+export declare const MAX_EMPTY_CUSTOM_ATTEMPTS = 3;
 /** The only remote navigation control; labels are presentation, never protocol. */
 export declare function askRemoteControls(input: {
     multi: boolean;

package/dist/types/tools/path-utils.d.ts

@@ -8,12 +8,11 @@ export declare function splitPathAndSel(rawPath: string): {
 /**
  * Variant of {@link splitPathAndSel} for internal URLs (`scheme://...`).
  *
- * Artifact authorities are generated identifiers, so their complete tail is
- * unambiguously a selector and malformed selectors can be rejected before
- * resolving the artifact. Other resources may legitimately use colons in
- * their identities, so they only lose strict, recognized selector suffixes.
- * Skill authorities additionally use the active registry to distinguish a
- * skill name from its selector without making path-utils depend on skills.
+ * Selector-capable internal authorities use identifier-shaped resource names,
+ * so an authority-only `:<tail>` is an explicit read selector even when the
+ * selector is malformed. Skill authorities are the exception: namespaced
+ * skill names already contain a colon, so the active registry gets first
+ * refusal and the fallback recognizes a later colon as the selector boundary.
  */
 export declare function splitInternalUrlSel(rawPath: string, options?: {
     activeSkillNames?: readonly string[];

package/dist/types/tools/tmux-self-injection-guard.d.ts

@@ -0,0 +1,15 @@
+export interface TmuxSelfInjectionResult {
+    block: boolean;
+    reason?: string;
+}
+export type TmuxPaneResolver = (options: {
+    socketArgs: string[];
+    target: string;
+    env: Record<string, string>;
+}) => Promise<string | undefined>;
+export interface TmuxSelfInjectionOptions {
+    env?: Record<string, string | undefined>;
+    cwd?: string;
+    resolvePaneId?: TmuxPaneResolver;
+}
+export declare function checkTmuxSelfInjection(command: string, options?: TmuxSelfInjectionOptions, depth?: number): Promise<TmuxSelfInjectionResult>;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.15.3",
+	"version": "0.15.5",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -56,12 +56,12 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.15.3",
-		"@gajae-code/agent-core": "0.15.3",
-		"@gajae-code/ai": "0.15.3",
-		"@gajae-code/natives": "0.15.3",
-		"@gajae-code/tui": "0.15.3",
-		"@gajae-code/utils": "0.15.3",
+		"@gajae-code/stats": "0.15.5",
+		"@gajae-code/agent-core": "0.15.5",
+		"@gajae-code/ai": "0.15.5",
+		"@gajae-code/natives": "0.15.5",
+		"@gajae-code/tui": "0.15.5",
+		"@gajae-code/utils": "0.15.5",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/src/cli/update-cli.ts

@@ -163,11 +163,12 @@ function isPathInDirectory(filePath: string, directoryPath: string): boolean {
 }
 
 export type PackageManagerTarget = { manager: "npm"; packageName: string };
+type MigrationUpdateTarget = { method: "migrate"; path: string; previousPath?: string };
 export type UpdateTarget =
 	| { method: "bun" }
 	| { method: "npm"; packageName: string }
 	| { method: "binary"; path: string }
-	| { method: "migrate"; path: string; previousPath?: string };
+	| MigrationUpdateTarget;
 
 type PathPlatform = NodeJS.Platform;
 type PackageExists = (packageName: string, packageRoot: string) => boolean;
@@ -506,6 +507,73 @@ async function verifyInstalledRuntime(
 	}
 }
 
+interface MigrationTargetVerificationOptions {
+	runtimePath: string;
+	verifyChecksum: () => Promise<void>;
+	verifyRuntime: () => Promise<InstalledVersionVerification>;
+}
+
+interface MigrationChecksumOptions {
+	tag: string;
+	assetName: string;
+	filePath: string;
+}
+
+type MigrationChecksumVerifier = (options: MigrationChecksumOptions) => Promise<unknown>;
+
+async function verifyMigrationTargetWith(
+	options: MigrationTargetVerificationOptions,
+): Promise<InstalledVersionVerification> {
+	try {
+		await options.verifyChecksum();
+	} catch {
+		return { ok: false, path: options.runtimePath };
+	}
+	return await options.verifyRuntime();
+}
+
+async function verifyMigrationTarget(
+	release: Pick<ReleaseInfo, "tag" | "version">,
+	runtimePath: string,
+	verifyChecksum: MigrationChecksumVerifier = verifyDownloadedBinaryChecksum,
+	verifyRuntime: (
+		expectedVersion: string,
+		runtimePath: string,
+	) => Promise<InstalledVersionVerification> = verifyInstalledRuntime,
+): Promise<InstalledVersionVerification> {
+	return await verifyMigrationTargetWith({
+		runtimePath,
+		verifyChecksum: async () => {
+			await verifyChecksum({
+				tag: release.tag,
+				assetName: getBinaryName(),
+				filePath: runtimePath,
+			});
+		},
+		verifyRuntime: async () => await verifyRuntime(release.version, runtimePath),
+	});
+}
+
+export async function verifyMigrationTargetForTest(
+	options: MigrationTargetVerificationOptions,
+): Promise<InstalledVersionVerification> {
+	return await verifyMigrationTargetWith(options);
+}
+
+export async function verifyMigrationTargetAdapterForTest(options: {
+	release: Pick<ReleaseInfo, "tag" | "version">;
+	runtimePath: string;
+	verifyChecksum: MigrationChecksumVerifier;
+	verifyRuntime: (expectedVersion: string, runtimePath: string) => Promise<InstalledVersionVerification>;
+}): Promise<InstalledVersionVerification> {
+	return await verifyMigrationTarget(
+		options.release,
+		options.runtimePath,
+		options.verifyChecksum,
+		options.verifyRuntime,
+	);
+}
+
 function printRestartGuidance(): void {
 	console.log(chalk.dim(`Restart ${APP_NAME} to use the new version`));
 }
@@ -1062,6 +1130,7 @@ async function updateViaBinaryAt(
 export interface UpdateCommandDependencies {
 	getLatestRelease?: (options?: LatestReleaseLookupOptions) => Promise<ReleaseInfo>;
 	resolveUpdateTarget?: () => Promise<UpdateTarget>;
+	verifyMigrationTarget?: (release: ReleaseInfo, runtimePath: string) => Promise<InstalledVersionVerification>;
 	performUpdate?: (
 		target: UpdateTarget,
 		expectedVersion: string,
@@ -1265,6 +1334,24 @@ export function resolveUpdateDecision(options: {
 	return { install: true, kind: options.comparison > 0 ? "new-version" : "force" };
 }
 
+function printVerifiedMigrationTarget(target: MigrationUpdateTarget, version: string): void {
+	console.log(
+		chalk.green(
+			`${theme.status.success} Standalone ${APP_NAME} ${version} is already installed and verified at ${target.path}`,
+		),
+	);
+	if (target.previousPath) {
+		console.log(chalk.yellow(`${target.previousPath} shadows it on PATH.`));
+		console.log(
+			chalk.cyan(
+				`The standalone directory ${path.dirname(target.path)} must precede the shim directory ${path.dirname(target.previousPath)} on PATH.`,
+			),
+		);
+		return;
+	}
+	console.log(chalk.cyan(`Ensure the standalone directory ${path.dirname(target.path)} is on PATH.`));
+}
+
 export async function runUpdateCommand(
 	opts: UpdateCommandOptions,
 	deps: UpdateCommandDependencies = {},
@@ -1272,6 +1359,7 @@ export async function runUpdateCommand(
 	const channel = opts.channel ?? "stable";
 	const lookupRelease = deps.getLatestRelease ?? getLatestRelease;
 	const resolveTarget = deps.resolveUpdateTarget ?? resolveUpdateTarget;
+	const verifyTarget = deps.verifyMigrationTarget ?? verifyMigrationTarget;
 	const update = deps.performUpdate ?? performUpdate;
 	const refreshDefaults = deps.refreshInstalledDefaultSkills ?? refreshInstalledDefaultSkills;
 	const exit = deps.exit ?? process.exit;
@@ -1323,6 +1411,19 @@ export async function runUpdateCommand(
 		migrate: target?.method === "migrate",
 	});
 
+	if (target.method === "migrate" && decision.install && !opts.force) {
+		const releaseLock = await acquireBinaryUpdateLock(target.path);
+		try {
+			const verification = await verifyTarget(release, target.path);
+			if (verification.ok) {
+				printVerifiedMigrationTarget(target, release.version);
+				return;
+			}
+		} finally {
+			await releaseLock();
+		}
+	}
+
 	if (!decision.install) {
 		console.log(chalk.green(`${theme.status.success} Already up to date`));
 		return;