@gajae-code/coding-agent 0.15.4 → 0.15.6

package/CHANGELOG.md

@@ -2,6 +2,50 @@
 
 ## [Unreleased]
 
+## [0.15.6] - 2026-08-30
+
+- Auth metadata remains session-only when a compatibility registry has auth storage but no owner accessor, preventing an unscoped OAuth account lookup from attributing a registry-scoped API-key request to the wrong account.
+
+- Every prompt no longer throws inside the session metadata resolver when the model registry does not implement `getAuthStorageOwner`. `80bbc96192` added the lookup as a required call in the resolver that runs on every prompt, but `buildSessionMetadata` takes `owner?: object` and 65 test files construct `AgentSession` with a deliberately minimal `modelRegistry` stub, so the resolver raised `TypeError: this.#modelRegistry.getAuthStorageOwner is not a function`. The throw stranded session admission, which then reported the misleading `Agent session admission is busy due to same-session reentrancy` on every following prompt, so a single missing method surfaced as ~45 failures and 5-second timeouts across six CI test shards in ten unrelated suites (IRC roster delivery, `respondAsBackground` visibility, deferred shell publication, coordinator activity labels, and others). The two optional-argument resolver call sites are now optional calls, matching the existing defensive convention in `account-inventory.ts`; the auth-credential call sites (`resolveOAuthPinTarget`, `invalidateCredentialMatching`, `markUsageLimitReached`) deliberately keep the strict call because they genuinely require a real registry owner and passing `undefined` there would change credential ownership scoping.
+- SDK prompt controls now reject empty and whitespace-only text before client correlation, turn allocation, transcript mutation, or provider activity across CLI, MCP, ACP, and direct session controls; multiline and Unicode prompts remain valid. (#5059)
+- Added disabled-by-default privacy-preserving update telemetry with a versioned allowlist, random local UUIDv4 install ID, bounded nonblocking HTTPS transport, explicit `telemetry.enabled` control, and the `GJC_DISABLE_TELEMETRY` emergency kill switch. Events never include prompts, argv, paths, environment, secrets, account/model/provider/repository identity, arbitrary errors, hostname, username, machine ID, or IP-derived identity. (#5046)
+- A running foreground command can now be folded into a background job with the fold chord (default `Alt+Shift+B`, plus `Cmd+B` on macOS; remappable via `app.tool.backgroundFold`). The turn ends as a clean stop-after-result rather than an abort, and the folded job's completion automatically wakes a fresh turn carrying a receipt — the command's output, a retrieval handle, and the original request — so the interrupted task is finished instead of abandoned. All three command surfaces fold — managed non-PTY bash, editor/ACP client-terminal commands, and PTY-mode commands — and a folded command is never killed or restarted by folding (a folded PTY continues output-only, so it stops accepting input). Folded jobs keep their original deadlines, folded work is visible in the status line and jobs overlay with its delivery state, completions arriving close together merge into one wake turn, and `task`/`subagent` waits are deliberately not foldable. The previous `Ctrl+B` default could never work: `Ctrl+B` is already `tui.editor.cursorLeft` (and is tmux's default prefix), so the keypress fell through to cursor movement whenever nothing was foldable.
+- Background job results are no longer silently lost in two pre-existing cases that also affected plain `async: true` bash. A job id with a queued or in-flight delivery is no longer recycled, which previously gave the pending delivery a mismatched generation and discarded it before it was ever delivered; and a delivery callback that fails after its job record was evicted is now retried, with a retry-cap failure recorded as visibly failed instead of vanishing with no dead letter.
+- Fixed `AsyncJobManager.dispose()` ordering: it marked itself disposed before running owner cleanups, and the delivery loop is inert once disposed, so a failure an owner cleanup settled could never be drained. Registration is now closed by its own flag, which keeps cleanups from registering fresh work without disabling delivery.
+- ACP prompt terminal publication no longer waits behind post-prompt worker integration or recovery work. SDK prompts pass the correlated `agent_end` boundary through immediately, while the existing bounded integration drain continues independently, preventing streamed turns from remaining pending until `sdk.promptDeadlineMs` when owned subagent work lingers. (#5030)
+
+### Fixed
+
+- Session resume no longer spends minutes in a CPU-hot 5ms loop when `runtime-state.json.lock` contains corrupt or unprovenanced debris. Session-state acquisition now uses a two-second monotonic wall-time budget with capped exponential backoff and typed exact-path diagnostics; stale malformed records are reclaimed only when their local host provenance and dead PID are proved, old empty legacy lock directories are removed only through exact tree identity, and live, foreign, or replacement owners remain fail-closed. (#5062)
+
+- `gjc sdk session tail` no longer rejects the host's `event_replay_result` control frame when its response position includes `generation` and `lastSeq` but no event `seq`; replay metadata is kept out of the event-ring tail while malformed event positions remain fail-closed. (#5055)
+
+- Coordinator no longer treats native exact-unlink placeholders (empty `.gjc-delete-*.json`) as live projection JSON. Directory scans skip dotfiles before open; truncated canonical projections remain parse candidates and fail closed, while the parse cap applies only after filtering debris. Session-state lock reclaim reuses one quarantine name per acquire cycle and removes a verified-empty leftover at that name before exchange — deletion is the native identity-bound `exactUnlinkDirect`, so a replacement planted at the reserved name is refused instead of deleted. `gjc gc --empty-delete-receipts --root/--manifest` validates every operand before any store can prune, reports or prunes only operator-supplied empty receipts matching the strict UUID namespace (inode identity + symlink-root reject; no hardcoded host paths), and surfaces native retained recovery paths and discovery failures as report errors. Receipt discovery is fail-closed under concurrent cleanup: a candidate that vanishes between `readdir` and `lstat` is recorded as a `skipped`/`raced` row instead of silently shrinking the report.
+
+- Fold control operations now report success only after the foreground fold transaction commits, while rejected fold requests follow the existing warning path; cleanup-triggered delivery failures remain eligible for bounded retry and visible dead-letter recording during manager disposal, and folded jobs expose read-only detail rows in the jobs overlay.
+- Generic file-lock release now retries transient Windows sharing denials and quarantines a verified self-owned lock when deletion remains unavailable, using an in-process acquisition generation rather than reclaiming every live lock with the same PID. Terminal `agent_end` publication remains independent of coordinator sidecar persistence, and a repeated interactive exit escalates through bounded postmortem cleanup. (#4943)
+
+- A one-shot `gjc sdk` command no longer idles for five seconds after its response is written. `SessionRouter` bounded four waits with `Bun.sleep` inside `Promise.race`; the race settles on the winner but does not cancel the loser, and a pending `Bun.sleep` keeps the event loop alive, so work that finished in milliseconds still owed the rest of the budget before the process could exit. `gjc sdk session list` wrote its result at 0.50s and exited at 5.51s. The startup attach budget, shutdown timeout, bounded notification work, and replay backoff now use the existing `cancellableSleep` helper with an `AbortController` cancelled once the race settles, and the reconcile interval is unref'd so a Router started without a matching `stop()` does not hold a host proce…
+
+## [0.15.5] - 2026-08-29
+
+- Bash now blocks tmux input commands that resolve to the agent's own pane before spawning the shell, including direct pane targets, session aliases, explicit socket forms, shell wrappers, and inspected script indirection. Read-only inspection and cross-session orchestration remain available, while blocked input cannot reach the transcript as a user turn. (#5039)
+- Saved-session staged model-selection appends now re-authenticate metadata-only drift on the same managed transcript object using its unchanged inode, link count, length, and content digest. A changed successor still fails closed, so native Windows persistence no longer turns routine timestamp updates into `managed_append_identity_mismatch` setup failures.
+- The GLM tiers now spend `zai/glm-5.3-flash` on the high-volume lanes and keep judgment roles on `zai/glm-5.3`: `glm-eco` moves default, executor, and planner to `glm-5.3-flash:low` (critic and architect stay `glm-5.3:high`), `glm-medium` swaps only the executor to `glm-5.3-flash:low`, and `glm-pro` swaps the executor to `glm-5.3-flash:high`. GLM-5.3-Flash also joins the bundled `zai` catalog with GLM-5.3's text contract pinned in `applyGeneratedModelPolicy` (1M context, 128K output, always-on `low`/`high`/`max` reasoning effort), because models.dev currently lists it with null limits and a catalog regeneration would otherwise degrade it to the unknown-window fallback; it is skip-listed in the autorouting tier map as not yet curated.
+- A content-free generic OpenAI Responses capacity overload no longer ends the turn under the default retry configuration. OpenAI reports it inside an HTTP 200 terminal envelope (`response.failed`, or `response.completed` with a `failed` status), so the turn surfaced `server_is_overloaded: …` and went idle for a failure the provider says to retry. The bare-default admission now also accepts that exact typed code, read only from transport facts and never from prose: the failed attempt must be on the `openai-responses` API, carry `openaiErrorCode` and `providerCode` equal to `server_is_overloaded` (matched case-sensitively) and no other transport fact (no status, no retained retry header, no second typed code, no error kind, no request size, first-event timing, endpoint class, or provider retry ceiling), and carry no assistant text, thinking, or tool call. Under bare defaults, an overload that follows observable work earlier in the same run is still terminal, `retry.enabled: false` still surfaces immediately, and the Codex and Anthropic overload admissions are unchanged. (#5018)
+- A metadata-only touch of the managed transcript file (AV scanning, indexing, backup sync — anything that bumps `mtimeNs`/`ctimeNs` without changing bytes) no longer crashes an interactive session with an unhandled `managed_append_identity_mismatch` rejection. `appendExpectedIdentitySync` compared only `dev`/`ino`/`size`/`mtimeNs`/`ctimeNs` against the persisted expectation, so a present-but-drifted predecessor was rethrown as a genuine successor and killed the process at the next prompt. The append receipt now carries the content digest the append path already computes (`append_managed` binds `sha256` to the final identity), `#captureManagedPersistIdentity` persists that descriptor-bound digest with the expectation, and a mismatching expectation is re-authenticated: identical bytes on the same unlinked file object with an unchanged link count refresh the expectation and proceed, while a changed inode, length, link count, or digest keeps failing closed so a concurrent successor is never overwritten. Regression-tested with two consecutive drifts, an intact successor guarantee, and an interactive input-loop containment test. (#4892)
+- Behavior change: this overload is now treated as a bounded provider-overload replay under explicit `retry.*` settings as well. It previously fell into the unbounded transient-prose retry class (its message matches `overloaded`), so a configured session retried it without limit; it now stops at `retry.maxRetries` with the existing capped exponential backoff, the same bound bare defaults use. (#5018)
+- Managed fallback behavior is preserved for the typed Responses overload: the new transport facts do not change the agent loop's managed transaction handling or the managed chain's retry/advance policy for this failure (the `server` classification remains a session-side classifier only). (#5018)
+- A single refused notification publication no longer kills a live session's chat mirroring for the rest of that session. `SessionRouter.#dispatchNotificationFrame` treated any rejection from the provider hook as terminal and called `#detachNotification(attached, "cancelled")`, which latches `notificationCancelled` on the `AttachedSession`; only a new attachment clears that latch, and a session that keeps running never gets one. The Telegram daemon throws exactly such a per-frame rejection from `#failPublicationPreSend` (for example `Telegram publication rejected before send: trusted attachment lease is stale`) when its topic or attachment lease momentarily fails `#leaseAllows` while another session attaches or detaches, so one transient authority flip permanently silenced that session's topic while every other session kept delivering — the user-visible symptom being Telegram that "works sometimes". Measured on one install over a single day: 20 such rejections across 20 distinct sessions, exactly one each, and 19 of the 20 never emitted another notification frame afterwards (their topic lease heartbeat stopped one to five seconds after the rejection, because the detach removed the endpoint from the daemon). Dispatch now tolerates a bounded run of consecutive local failures before conceding, mirroring `DELIVERY_ATTEMPT_LIMIT` on the ordered-delivery path in the same file: the refused frame is still dropped (the provider has already settled that publication as rejected on its own side), the next delivered frame resets the run, and a provider that never accepts anything is still cancelled after the limit. The `NOTIFICATION_WORK_TIMEOUT` path is deliberately unchanged — a hung provider is a different failure class and keeps its immediate detach — and core attachment authority, replay, lease renewal, and every other detach reason (`removed`, `replaced`, `replaced_same_generation`) are untouched.
+- `gjc update` now recognizes an already verified standalone binary during package-manager shim migration, avoiding repeated downloads and post-update work while clearly explaining the required PATH ordering.
+
+- GJC-managed launch worktrees now default to `<repo>/.worktrees/<slug>` instead of a `<repo>.gajae-code-worktrees` sibling beside the checkout, keeping each repository's isolated branches in one predictable local folder. Launch fails with an actionable diagnostic unless an in-repository bucket is ignored by Git, preventing nested worktrees from polluting the source checkout; external `GJC_WORKTREE_DIR` buckets and already registered sibling worktrees are unchanged.
+- Launch worktree reuse now revalidates Git-registered paths before adoption and reports locked or replaced stale entries instead of running Git commands in an unavailable or occupied directory; coordinator policy and Stream Deck project grouping use the repository-local default while retaining legacy sibling-path recognition.
+
+### Fixed
+
+- A one-shot `gjc sdk` command no longer idles for five seconds after its response is written. `SessionRouter` bounded four waits with `Bun.sleep` inside `Promise.race`; the race settles on the winner but does not cancel the loser, and a pending `Bun.sleep` keeps the event loop alive, so work that finished in milliseconds still owed the rest of the budget before the process could exit. `gjc sdk session list` wrote its result at 0.50s and exited at 5.51s. The startup attach budget, shutdown timeout, bounded notification work, and replay backoff now use the existing `cancellableSleep` helper with an `AbortController` cancelled once the race settles, and the reconcile interval is unref'd so a Router started without a matching `stop()` does not hold a host process open. The same command now exits at 1.65s, and every command routed through `withRouter` (`session.list`, `session.create`, `session.delete`, `session.fork`, `turn.prompt`, `turn.result`, `queue.*`, `compaction.*`) is affected.
+
 ## [0.15.4] - 2026-08-29
 
 - The `ask` tool now rejects empty or whitespace-only custom answers on every local and remote input path. Remote invalid answers receive a visible explanation and are retried at most three times with an event-loop yield between attempts before the ask is cancelled; local empty custom input is never returned as a valid answer. (#5001)
@@ -41,6 +85,7 @@
 - Foreground activity animation now uses layout-only TUI repaints, avoiding repeated reconstruction of unchanged transcript content during long sessions.
 - Notification adapters can now opt into one live representation per native effect: adapters that accept a positioned event are excluded from its matching raw fan-out, while ordinary direct SDK and raw-only legacy subscribers retain their existing delivery. Telegram opts in, preventing turn output, tool activity, and reasoning summaries from rendering twice after #4570; acknowledged terminal shutdown delivery is unchanged.
 - Lean notifications no longer replay a retained completion receipt at idle when identical text was already delivered immediately before an autonomous `ask`; distinct receipts and other settlement windows remain preserved.
+- SDK prompts now publish a bounded structured terminal failure when a provider immediately returns HTTP 402 or 429. The accepted receipt remains non-terminal until the correlated `agent_end`, while `turn.result`/`turn.prompt_status` no longer strand the prompt as `in_flight`; replacement turns remain independently abortable and recoverable. (#4941)
 
 ## [0.15.2] - 2026-08-25
 
@@ -49,7 +94,6 @@
 - Version 0.15.1 was tagged but never published: release automation failed while deriving release notes, before any package reached npm. Everything listed under `## [0.15.1]` below ships in this release.
 
 ## [0.15.1] - 2026-08-25
-
 ### Added
 
 - Added `/language [en|ko]`, the interactive slash command for the persisted `ui.language` selection. Without arguments it reports the current language; with a canonical code, locale tag (`en-US`, `ko-KR`), endonym (`한국어`), English name, or common aliases (`eng`, `kr`, `kor`) it persists the canonical `en`/`ko` value through settings and confirms in the selected language. An unsupported value is rejected with the available list and changes nothing. See `docs/ui-language.md`.
@@ -634,7 +678,7 @@
 ### Added
 
 - The SDK `models.list/current` (Q10) catalog now lists model profiles as synthetic `gajae-code/<profile>` entries (e.g. `gajae-code/codex-eco`), and selecting one through `model.set` (or the ACP Model picker) activates the profile for the live session only; global persistence remains the explicit `gjc --mpreset <name> --default` or TUI default-selection path. ACP/SDK clients such as Paseo can therefore offer presets like ordinary models; only availability-filtered profiles are advertised, the reserved `gajae-code` namespace fails closed on collision, and `config.patch` serializes with profile activation through the session admission boundary.
-- Added first-class `cline-pass` and `commandcode-goat` provider presets with documented API endpoints, environment-variable credentials, non-hardcoded live model discovery from models.dev and the Command Code Provider API, and prefix-based Claude routing.
+- Added first-class `cline-pass` and `commandcode-goat` provider presets with documented API endpoints, environment-variable credentials, non-hardcoded live model discovery from models.dev and the Command Code Provider API; Command Code models stay on its documented OpenAI-compatible transport regardless of model name.
 - Registered the `jetbrains-junie` provider in the famous-provider ordering and the `JUNIE_API_KEY` credential help so JetBrains AI (Junie) Claude models surface in `/model`, `--list-models` and `gjc --help` alongside the other first-class providers (#3626).
 - Added lease-backed MCP connection pooling with typed recovery, shared HTTP/SSE sessions, per-lease callback demultiplexing, and authorization binding scopes that keep credential secrets out of pool keys.
 - Added plugin registry v2 as the single execution authority for plugin tools, subskills, and prompt appendices, with digest verification at final use.

package/dist/types/async/job-manager.d.ts

@@ -21,6 +21,12 @@ export interface AsyncJob {
     setupFailureSummary?: string;
     /** Safe, bounded summary of a terminal local (non-provider) failure kind. */
     localErrorSummary?: LocalErrorSummary;
+    /** Compact delivery-failure marker retained while the job row remains live. */
+    deliveryFailure?: {
+        attempt: number;
+        lastError?: string;
+        recordedAt: number;
+    };
     metadata?: AsyncJobMetadata;
     /**
      * Registry id of the agent that registered the job (e.g. "0-Main",
@@ -38,6 +44,8 @@ export interface AsyncJob {
  */
 export declare function jobElapsedMs(job: Pick<AsyncJob, "startTime" | "endTime">, now?: number): number;
 export interface AsyncJobMetadata {
+    /** Set once a foreground wait has been folded, so surfacing can show folded work. */
+    backgrounded?: boolean;
     subagent?: {
         id: string;
         agent: string;
@@ -170,11 +178,50 @@ export interface AsyncJobManagerOptions {
     onJobComplete: (jobId: string, text: string, job?: AsyncJob) => void | Promise<void>;
     maxRunningJobs?: number;
     retentionMs?: number;
+    maxDeadLetterOverflowOwners?: number;
+}
+export interface AsyncJobAdmission {
+    readonly manager: AsyncJobManager;
 }
 export interface AsyncJobDisposeDiagnostics {
     stuckJobIds: string[];
     deliveriesDrained: boolean;
 }
+/** Per-job public delivery classification. Exactly one value per terminal job. */
+export type JobDeliveryState = "pending" | "delivered" | "failed-visible";
+/** One job as projected by {@link AsyncJobManager.getJobsSnapshot}. */
+export interface AsyncJobSnapshotEntry {
+    id: string;
+    kind: string;
+    label: string;
+    status: AsyncJob["status"];
+    generation: string;
+    backgrounded: boolean;
+    deliveryState: JobDeliveryState;
+}
+/** Scalar delivery-failure evidence that may outlive its AsyncJob record. */
+export interface DeadLetteredJobSnapshotEntry {
+    jobId: string;
+    generation: string;
+    ownerId?: string;
+    /** Whether the failed delivery originated from a backgrounded job. */
+    backgrounded?: boolean;
+    attempt: number;
+    lastError?: string;
+    recordedAt: number;
+}
+/**
+ * One atomic projection of job + delivery state.
+ *
+ * Computed in a single synchronous pass with no interleaved awaits so it cannot
+ * tear, and consumed verbatim: a UI that re-derives delivery classification from
+ * separate getters can disagree with this and produce a job that is in no public
+ * state at all.
+ */
+export interface AsyncJobsSnapshot {
+    jobs: AsyncJobSnapshotEntry[];
+    deadLettered: DeadLetteredJobSnapshotEntry[];
+}
 export interface AsyncJobDeliveryState {
     queued: number;
     delivering: boolean;
@@ -209,6 +256,8 @@ export interface AsyncJobRegisterOptions {
     metadata?: AsyncJobMetadata;
     onProgress?: (text: string, details?: Record<string, unknown>) => void | Promise<void>;
     lifecycle?: AsyncJobLifecycleCleanup;
+    /** Reserved capacity consumed atomically by this registration. */
+    admissionToken?: AsyncJobAdmission;
 }
 /**
  * Filter applied to job query/cancel APIs. With `ownerId`, results are
@@ -411,6 +460,10 @@ export declare class AsyncJobManager {
      */
     getJobPromise(id: string, generation: string): Promise<void> | undefined;
     getRunningJobs(filter?: AsyncJobFilter): AsyncJob[];
+    /** Whether a new running job can be admitted without starting side effects. */
+    hasCapacity(filter?: AsyncJobFilter): boolean;
+    reserveCapacity(): AsyncJobAdmission;
+    releaseCapacity(token: AsyncJobAdmission): void;
     getRecentJobs(limit?: number, filter?: AsyncJobFilter): AsyncJob[];
     getAllJobs(filter?: AsyncJobFilter): AsyncJob[];
     /**
@@ -450,6 +503,18 @@ export declare class AsyncJobManager {
     /** Run producer cleanups, then perform the legacy destructive subagent purge. */
     runOwnerCleanups(filter?: AsyncJobFilter): void;
     getDeliveryState(filter?: AsyncJobFilter): AsyncJobDeliveryState;
+    /**
+     * One synchronous pass over jobs plus delivery state.
+     *
+     * Every returned job carries exactly one {@link JobDeliveryState}, and
+     * dead-lettered evidence is included even when its record is already gone, so
+     * no terminal job can end up invisible to the UI.
+     */
+    getJobsSnapshot(filter?: AsyncJobFilter): AsyncJobsSnapshot;
+    retainParkedDelivery(job: AsyncJob, text: string): void;
+    retainDeliveryClaim(job: AsyncJob): void;
+    releaseDeliveryClaim(generation: string): void;
+    clearParkedDelivery(generation: string): void;
     hasPendingDeliveries(filter?: AsyncJobFilter): boolean;
     watchJobGenerations(jobIds: string[]): AsyncJobWatchHandle;
     watchJobs(jobIds: string[]): number;
@@ -460,6 +525,19 @@ export declare class AsyncJobManager {
      * matching agent registered; with no filter, cancels every running job
      * (used by `dispose()` to nuke the manager's state).
      */
+    /**
+     * Synchronously fail a running job AND enqueue its delivery, exactly once.
+     *
+     * An externally owned wait -- an ACP client terminal, say -- can fail while its
+     * owner is being torn down. `cancel()` is the wrong tool there: it marks the job
+     * cancelled, and the cancelled path deliberately enqueues NO delivery, so the
+     * failure would never become visible to anyone. This is the single transition
+     * that both fails the job and delivers that failure in one synchronous block, so
+     * it cannot lose the race against disposal.
+     */
+    failNow(jobId: string, generation: string, errorText: string, options?: {
+        abort?: boolean;
+    }): boolean;
     cancelAll(filter?: AsyncJobFilter): void;
     waitForOwnerInFlightDeliveries(ownerId: string, options?: {
         timeoutMs?: number;
@@ -468,6 +546,11 @@ export declare class AsyncJobManager {
         timeoutMs?: number;
     }): Promise<boolean>;
     getLastDisposeDiagnostics(): AsyncJobDisposeDiagnostics;
+    /**
+     * Mark a running job as backgrounded (folded out of its foreground call).
+     * Read by getJobsSnapshot so folded work stays visible; safe to call twice.
+     */
+    markBackgrounded(jobId: string, generation: string): boolean;
     waitForAll(): Promise<void>;
     drainDeliveries(options?: {
         timeoutMs?: number;

package/dist/types/cli/auth-gateway-cli.d.ts

@@ -1,9 +1,11 @@
+import { type AuthCredentialSnapshot, type CredentialHealthResult } from "@gajae-code/ai/core";
 export type AuthGatewayAction = "serve" | "token" | "status" | "check";
 export interface AuthGatewayCommandArgs {
     action: AuthGatewayAction;
     flags: {
         json?: boolean;
         bind?: string;
+        provider?: string;
         regenerate?: boolean;
         /**
          * Disable bearer-token auth on inbound requests. Useful when the gateway
@@ -14,5 +16,20 @@ export interface AuthGatewayCommandArgs {
     };
 }
 declare const ACTIONS: readonly AuthGatewayAction[];
+export declare function resolveAuthGatewayReadiness(input: {
+    noAuth: boolean;
+    tokenPresent: boolean;
+    credentialCount: number;
+    modelCount: number;
+}): {
+    ready: boolean;
+    reason: "token_missing" | "provider_credential_missing" | "provider_catalog_empty" | null;
+};
+export declare function normalizeProviderScope(provider: string | undefined): string | undefined;
+export declare function filterCredentialCheckResults(results: readonly CredentialHealthResult[], provider: string | undefined): CredentialHealthResult[];
+export declare function redactBrokerUrl(rawUrl: string): string;
+export declare function hasEnabledProviderCredential(snapshot: Pick<AuthCredentialSnapshot, "credentials">, provider: string): boolean;
+export declare function matchesProviderCredential(entry: AuthCredentialSnapshot["credentials"][number], apiKey: string): boolean;
+export declare function assertEnabledProviderCredential(snapshot: Pick<AuthCredentialSnapshot, "credentials">, provider: string): void;
 export declare function runAuthGatewayCommand(cmd: AuthGatewayCommandArgs): Promise<void>;
 export { ACTIONS as AUTH_GATEWAY_ACTIONS };

package/dist/types/cli/model-presets-cli.d.ts

@@ -0,0 +1,9 @@
+export declare const MODEL_PRESETS_ACTIONS: readonly ["status", "refresh", "rollback", "pin", "unpin", "disable", "enable"];
+export type ModelPresetsAction = (typeof MODEL_PRESETS_ACTIONS)[number];
+export interface ModelPresetsCommandArgs {
+    action: ModelPresetsAction;
+    revision?: string;
+    json?: boolean;
+    agentDir?: string;
+}
+export declare function runModelPresetsCommand(args: ModelPresetsCommandArgs): Promise<void>;

package/dist/types/cli/update-cli.d.ts

@@ -1,6 +1,7 @@
 import { Settings } from "../config/settings";
 import { type UpdateChannel } from "../config/update-channel";
 import { type NotificationProvider } from "../sdk/bus/config";
+import type { TelemetryDetails, TelemetryEventName } from "../telemetry";
 import { type GithubReleaseLookupOptions } from "./github-release";
 export interface UpdateCommandOptions {
     force: boolean;
@@ -53,6 +54,11 @@ export type PackageManagerTarget = {
     manager: "npm";
     packageName: string;
 };
+type MigrationUpdateTarget = {
+    method: "migrate";
+    path: string;
+    previousPath?: string;
+};
 export type UpdateTarget = {
     method: "bun";
 } | {
@@ -61,11 +67,7 @@ export type UpdateTarget = {
 } | {
     method: "binary";
     path: string;
-} | {
-    method: "migrate";
-    path: string;
-    previousPath?: string;
-};
+} | MigrationUpdateTarget;
 type PathPlatform = NodeJS.Platform;
 type PackageExists = (packageName: string, packageRoot: string) => boolean;
 export declare function resolveUpdateMethodForTest(ompPath: string, bunBinDir: string | undefined): "bun" | "npm" | "binary";
@@ -85,6 +87,24 @@ export declare function resolveGjcPathForTest(options: {
     whichPath: string | undefined;
 }): string | undefined;
 export declare function parseReportedVersionForTest(output: string): string | undefined;
+interface MigrationTargetVerificationOptions {
+    runtimePath: string;
+    verifyChecksum: () => Promise<void>;
+    verifyRuntime: () => Promise<InstalledVersionVerification>;
+}
+interface MigrationChecksumOptions {
+    tag: string;
+    assetName: string;
+    filePath: string;
+}
+type MigrationChecksumVerifier = (options: MigrationChecksumOptions) => Promise<unknown>;
+export declare function verifyMigrationTargetForTest(options: MigrationTargetVerificationOptions): Promise<InstalledVersionVerification>;
+export declare function verifyMigrationTargetAdapterForTest(options: {
+    release: Pick<ReleaseInfo, "tag" | "version">;
+    runtimePath: string;
+    verifyChecksum: MigrationChecksumVerifier;
+    verifyRuntime: (expectedVersion: string, runtimePath: string) => Promise<InstalledVersionVerification>;
+}): Promise<InstalledVersionVerification>;
 export declare function formatBinaryDownloadFailureMessageForTest(binaryName: string, url: string, status: string | number, platform?: NodeJS.Platform, registryNote?: string): string;
 export declare function buildReleaseBinaryUrlForTest(version: string, platform?: NodeJS.Platform, arch?: string): string;
 export declare function formatManualUpdateInstructionsForTest(platform?: NodeJS.Platform): string;
@@ -123,6 +143,7 @@ export declare function runBinaryUpdateFlow(targetPath: string, url: string, exp
 export interface UpdateCommandDependencies {
     getLatestRelease?: (options?: LatestReleaseLookupOptions) => Promise<ReleaseInfo>;
     resolveUpdateTarget?: () => Promise<UpdateTarget>;
+    verifyMigrationTarget?: (release: ReleaseInfo, runtimePath: string) => Promise<InstalledVersionVerification>;
     performUpdate?: (target: UpdateTarget, expectedVersion: string, registry?: string) => Promise<InstalledVersionVerification | undefined>;
     refreshInstalledDefaultSkills?: () => Promise<void>;
     settings?: () => Promise<Settings>;
@@ -130,6 +151,7 @@ export interface UpdateCommandDependencies {
     restartDaemon?: (settings: Settings) => Promise<void>;
     recoverNotifications?: (settings: Settings) => Promise<void>;
     runPostUpdateRecovery?: (runtimePath: string) => Promise<void>;
+    recordTelemetryEvent?: (event: TelemetryEventName, details: TelemetryDetails) => unknown;
     exit?: (code: number) => never;
 }
 export type PostUpdateRecoverySpawn = (argv: string[]) => Promise<number>;

package/dist/types/commands/auth-gateway.d.ts

@@ -20,6 +20,9 @@ export default class AuthGateway extends Command {
             description: string;
             char: string;
         };
+        provider: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
         regenerate: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };

package/dist/types/commands/gc.d.ts

@@ -2,6 +2,7 @@ import { Command } from "@gajae-code/utils/cli";
 export default class Gc extends Command {
     static description: string;
     static strict: boolean;
+    static delegateHelp: boolean;
     static flags: {
         json: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             char: string;
@@ -28,6 +29,18 @@ export default class Gc extends Command {
             description: string;
             default: boolean;
         };
+        "empty-delete-receipts": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+            default: boolean;
+        };
+        root: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+            multiple: true;
+        };
+        manifest: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+            multiple: true;
+        };
     };
     static examples: string[];
     run(): Promise<void>;

package/dist/types/commands/model-presets.d.ts

@@ -0,0 +1,21 @@
+import { Command } from "@gajae-code/utils/cli";
+export default class ModelPresets extends Command {
+    static description: string;
+    static args: {
+        action: import("@gajae-code/utils/cli").ArgDescriptor & {
+            description: string;
+            required: false;
+            options: readonly ["status", "refresh", "rollback", "pin", "unpin", "disable", "enable"];
+        };
+        revision: import("@gajae-code/utils/cli").ArgDescriptor & {
+            description: string;
+            required: false;
+        };
+    };
+    static flags: {
+        json: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+    };
+    run(): Promise<void>;
+}

package/dist/types/config/autorouting-tier-map.d.ts

@@ -250,6 +250,9 @@ export declare const TIER_MAP_SKIP_LIST: {
     readonly "zai/glm-5.3": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };
+    readonly "zai/glm-5.3-flash": {
+        readonly rationale: "post-feature catalog addition; not yet curated";
+    };
     readonly "cursor/gemini-3.7-flash-high": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };
@@ -16818,6 +16821,102 @@ export declare const TIER_MAP_SKIP_LIST: {
         readonly baseline: true;
         readonly rationale: "pre-feature baseline; not yet curated";
     };
+    readonly "kiro/auto": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-haiku-4-5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-haiku-4.5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4-5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4-6": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4-7": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4-8": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4.5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4.6": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4.7": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4.8": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-sonnet-4": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-sonnet-4-5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-sonnet-4-6": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-sonnet-4.5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-sonnet-4.6": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-sonnet-5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/deepseek-3-2": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/deepseek-3.2": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/glm-5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/gpt-5-6-luna": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/gpt-5-6-sol": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/gpt-5-6-terra": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/gpt-5.6-luna": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/gpt-5.6-sol": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/gpt-5.6-terra": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/minimax-m2-1": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/minimax-m2-5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/minimax-m2.1": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/minimax-m2.5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/qwen3-coder-next": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
 };
 export declare const CURATED_TIER_MAP: AutoroutingCuratedTierMap;
 /** Canonical JSON uses sorted object keys and preserves array order. */

package/dist/types/config/file-lock.d.ts

@@ -1,3 +1,4 @@
+import type { NativeDirectoryTreeResult, NativeExactUnlinkResult } from "@gajae-code/natives";
 export interface FileLockOptions {
     staleMs?: number;
     retries?: number;
@@ -9,8 +10,12 @@ export interface FileLockOptions {
     /** Previous local host identities accepted only when deciding stale-owner reclamation. */
     previousOwnerHostIds?: readonly string[];
 }
+/** Release retries cover transient Windows/Dropbox handle denial without extending the lock indefinitely. */
+export declare const FILE_LOCK_RELEASE_RETRY_ATTEMPTS = 5;
+export declare const FILE_LOCK_RELEASE_RETRY_DELAY_MS = 10;
 export declare const FileLockTestHooks: {
     afterParentMkdir?: (lockPath: string) => void | Promise<void>;
+    nativeQuarantineBindings?: () => NativeFileLockBindings;
 };
 /**
  * Returns the OS-provided process start timestamp for PID-reuse detection.
@@ -25,16 +30,46 @@ export declare const FileLockTestHooks: {
  */
 export declare function processStartTime(pid: number): string | null;
 /** @internal */
+export interface FileLockGcObservation {
+    info: FileLockOwnerToken;
+    bytes: string;
+    identity: GenericFileLockDirIdentity;
+}
+/** Capture owner bytes and the identity proving those exact bytes came from this tree. */
+export declare function readFileLockObservationForGc(lockDir: string): Promise<FileLockGcObservation | null>;
+/** @internal */
 export declare function readFileLockInfoForGc(lockDir: string): Promise<FileLockOwnerToken | null>;
 /** Owner identity stamped into a `<file>.lock/info` record. */
 export interface FileLockOwnerToken {
     pid: number;
     start_time?: string;
+    /** Encoding marker for the canonical UTC process-start identity. */
+    start_time_format?: string;
     owner_host_id?: string;
+    /** Unique acquisition generation, present on locks created by this runtime. */
+    owner_token?: string;
     timestamp: number;
 }
 /** Outcome of a guarded lock-dir removal attempt (`removeFileLockDirForGc`). */
-export type FileLockGcRemoval = "removed" | "owner_changed" | "missing";
+export type FileLockGcRemoval = "removed" | "owner_changed" | "missing" | "cleanup_failed";
+/** Identity evidence carried by the generic stale verdict into a later removal. */
+export interface GenericFileLockDirIdentity {
+    rootDev: string;
+    rootIno: string;
+    infoDev: string;
+    infoIno: string;
+    infoNlink: string;
+    infoSize: string;
+    infoMtimeNs: string;
+    infoCtimeNs: string;
+    infoSha256: string;
+}
+export type GenericFileLockDirStaleVerdict = {
+    stale: false;
+} | {
+    stale: true;
+    identity: GenericFileLockDirIdentity;
+};
 /**
  * @internal
  * Fail-closed removal of a lock dir whose owner is expected to be dead or
@@ -52,7 +87,7 @@ export type FileLockGcRemoval = "removed" | "owner_changed" | "missing";
  * directory, so the residual read->unlink window cannot be fully eliminated,
  * but the reclaim-after-stale scenario the issue describes is now guarded.
  */
-export declare function removeFileLockDirForGc(lockDir: string, expected: FileLockOwnerToken): Promise<FileLockGcRemoval>;
+export declare function removeFileLockDirForGc(lockDir: string, expected: FileLockOwnerToken, preVerdictIdentity?: GenericFileLockDirIdentity): Promise<FileLockGcRemoval>;
 /**
  * @internal
  * READ-ONLY verdict on an EXISTING generic `<file>.lock/` directory that another lock
@@ -71,6 +106,17 @@ export declare function removeFileLockDirForGc(lockDir: string, expected: FileLo
  * the object is no longer the one that was judged.
  */
 export declare function genericFileLockDirIsStale(lockDir: string, staleMs: number, ownerHostId?: string): Promise<boolean>;
+/**
+ * Render a generic stale verdict together with the root and owner-file identity that
+ * verdict actually observed. A caller that removes the directory must require a later
+ * native snapshot to carry this same identity; a snapshot taken only after a clone was
+ * installed is not authority for the stale verdict.
+ */
+export declare function genericFileLockDirStaleVerdict(lockDir: string, staleMs: number, ownerHostId?: string): Promise<GenericFileLockDirStaleVerdict>;
+type NativeFileLockBindings = {
+    snapshotDirectoryTree(lockPath: string): NativeDirectoryTreeResult;
+    exactRemoveDirectoryTree(lockPath: string, snapshot: NonNullable<NativeDirectoryTreeResult["snapshot"]>): NativeExactUnlinkResult;
+};
 /**
  * Serializes all contenders, including callers in the same process. Because this
  * API exposes no ownership token, recursive acquisition is indistinguishable
@@ -78,3 +124,4 @@ export declare function genericFileLockDirIsStale(lockDir: string, staleMs: numb
  * that fact through its own `lockHeld` path instead of acquiring it again.
  */
 export declare function withFileLock<T>(filePath: string, fn: () => Promise<T>, options?: FileLockOptions): Promise<T>;
+export {};

package/dist/types/config/internal/model-preset-registry-test-state.d.ts

@@ -0,0 +1,4 @@
+import type { ModelPresetRegistryTrustedKey } from "../model-preset-registry";
+export declare function getModelPresetRegistryTestTrustedKeys(agentDir: string): ReadonlyMap<string, ModelPresetRegistryTrustedKey> | undefined;
+export declare function modelPresetRegistryTestUrlsAllowed(agentDir: string): boolean;
+export declare function runWithModelPresetRegistryTestTrust<T>(agentDir: string, trustedKeys: ReadonlyMap<string, ModelPresetRegistryTrustedKey>, operation: () => T): T;

package/dist/types/config/internal/model-preset-registry-test-support.d.ts

@@ -0,0 +1,3 @@
+import type { ModelPresetRegistryTrustedKey } from "../model-preset-registry";
+/** Runs one test operation with scoped trust. This module is denied by package exports. */
+export declare function withModelPresetRegistryTestTrust<T>(agentDir: string, trustedKeys: ReadonlyMap<string, ModelPresetRegistryTrustedKey>, operation: () => T): T;