@gajae-code/coding-agent 0.15.5 → 0.15.6

package/CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## [Unreleased]
 
+## [0.15.6] - 2026-08-30
+
+- Auth metadata remains session-only when a compatibility registry has auth storage but no owner accessor, preventing an unscoped OAuth account lookup from attributing a registry-scoped API-key request to the wrong account.
+
+- Every prompt no longer throws inside the session metadata resolver when the model registry does not implement `getAuthStorageOwner`. `80bbc96192` added the lookup as a required call in the resolver that runs on every prompt, but `buildSessionMetadata` takes `owner?: object` and 65 test files construct `AgentSession` with a deliberately minimal `modelRegistry` stub, so the resolver raised `TypeError: this.#modelRegistry.getAuthStorageOwner is not a function`. The throw stranded session admission, which then reported the misleading `Agent session admission is busy due to same-session reentrancy` on every following prompt, so a single missing method surfaced as ~45 failures and 5-second timeouts across six CI test shards in ten unrelated suites (IRC roster delivery, `respondAsBackground` visibility, deferred shell publication, coordinator activity labels, and others). The two optional-argument resolver call sites are now optional calls, matching the existing defensive convention in `account-inventory.ts`; the auth-credential call sites (`resolveOAuthPinTarget`, `invalidateCredentialMatching`, `markUsageLimitReached`) deliberately keep the strict call because they genuinely require a real registry owner and passing `undefined` there would change credential ownership scoping.
+- SDK prompt controls now reject empty and whitespace-only text before client correlation, turn allocation, transcript mutation, or provider activity across CLI, MCP, ACP, and direct session controls; multiline and Unicode prompts remain valid. (#5059)
+- Added disabled-by-default privacy-preserving update telemetry with a versioned allowlist, random local UUIDv4 install ID, bounded nonblocking HTTPS transport, explicit `telemetry.enabled` control, and the `GJC_DISABLE_TELEMETRY` emergency kill switch. Events never include prompts, argv, paths, environment, secrets, account/model/provider/repository identity, arbitrary errors, hostname, username, machine ID, or IP-derived identity. (#5046)
+- A running foreground command can now be folded into a background job with the fold chord (default `Alt+Shift+B`, plus `Cmd+B` on macOS; remappable via `app.tool.backgroundFold`). The turn ends as a clean stop-after-result rather than an abort, and the folded job's completion automatically wakes a fresh turn carrying a receipt — the command's output, a retrieval handle, and the original request — so the interrupted task is finished instead of abandoned. All three command surfaces fold — managed non-PTY bash, editor/ACP client-terminal commands, and PTY-mode commands — and a folded command is never killed or restarted by folding (a folded PTY continues output-only, so it stops accepting input). Folded jobs keep their original deadlines, folded work is visible in the status line and jobs overlay with its delivery state, completions arriving close together merge into one wake turn, and `task`/`subagent` waits are deliberately not foldable. The previous `Ctrl+B` default could never work: `Ctrl+B` is already `tui.editor.cursorLeft` (and is tmux's default prefix), so the keypress fell through to cursor movement whenever nothing was foldable.
+- Background job results are no longer silently lost in two pre-existing cases that also affected plain `async: true` bash. A job id with a queued or in-flight delivery is no longer recycled, which previously gave the pending delivery a mismatched generation and discarded it before it was ever delivered; and a delivery callback that fails after its job record was evicted is now retried, with a retry-cap failure recorded as visibly failed instead of vanishing with no dead letter.
+- Fixed `AsyncJobManager.dispose()` ordering: it marked itself disposed before running owner cleanups, and the delivery loop is inert once disposed, so a failure an owner cleanup settled could never be drained. Registration is now closed by its own flag, which keeps cleanups from registering fresh work without disabling delivery.
+- ACP prompt terminal publication no longer waits behind post-prompt worker integration or recovery work. SDK prompts pass the correlated `agent_end` boundary through immediately, while the existing bounded integration drain continues independently, preventing streamed turns from remaining pending until `sdk.promptDeadlineMs` when owned subagent work lingers. (#5030)
+
+### Fixed
+
+- Session resume no longer spends minutes in a CPU-hot 5ms loop when `runtime-state.json.lock` contains corrupt or unprovenanced debris. Session-state acquisition now uses a two-second monotonic wall-time budget with capped exponential backoff and typed exact-path diagnostics; stale malformed records are reclaimed only when their local host provenance and dead PID are proved, old empty legacy lock directories are removed only through exact tree identity, and live, foreign, or replacement owners remain fail-closed. (#5062)
+
+- `gjc sdk session tail` no longer rejects the host's `event_replay_result` control frame when its response position includes `generation` and `lastSeq` but no event `seq`; replay metadata is kept out of the event-ring tail while malformed event positions remain fail-closed. (#5055)
+
+- Coordinator no longer treats native exact-unlink placeholders (empty `.gjc-delete-*.json`) as live projection JSON. Directory scans skip dotfiles before open; truncated canonical projections remain parse candidates and fail closed, while the parse cap applies only after filtering debris. Session-state lock reclaim reuses one quarantine name per acquire cycle and removes a verified-empty leftover at that name before exchange — deletion is the native identity-bound `exactUnlinkDirect`, so a replacement planted at the reserved name is refused instead of deleted. `gjc gc --empty-delete-receipts --root/--manifest` validates every operand before any store can prune, reports or prunes only operator-supplied empty receipts matching the strict UUID namespace (inode identity + symlink-root reject; no hardcoded host paths), and surfaces native retained recovery paths and discovery failures as report errors. Receipt discovery is fail-closed under concurrent cleanup: a candidate that vanishes between `readdir` and `lstat` is recorded as a `skipped`/`raced` row instead of silently shrinking the report.
+
+- Fold control operations now report success only after the foreground fold transaction commits, while rejected fold requests follow the existing warning path; cleanup-triggered delivery failures remain eligible for bounded retry and visible dead-letter recording during manager disposal, and folded jobs expose read-only detail rows in the jobs overlay.
+- Generic file-lock release now retries transient Windows sharing denials and quarantines a verified self-owned lock when deletion remains unavailable, using an in-process acquisition generation rather than reclaiming every live lock with the same PID. Terminal `agent_end` publication remains independent of coordinator sidecar persistence, and a repeated interactive exit escalates through bounded postmortem cleanup. (#4943)
+
+- A one-shot `gjc sdk` command no longer idles for five seconds after its response is written. `SessionRouter` bounded four waits with `Bun.sleep` inside `Promise.race`; the race settles on the winner but does not cancel the loser, and a pending `Bun.sleep` keeps the event loop alive, so work that finished in milliseconds still owed the rest of the budget before the process could exit. `gjc sdk session list` wrote its result at 0.50s and exited at 5.51s. The startup attach budget, shutdown timeout, bounded notification work, and replay backoff now use the existing `cancellableSleep` helper with an `AbortController` cancelled once the race settles, and the reconcile interval is unref'd so a Router started without a matching `stop()` does not hold a host proce…
+
 ## [0.15.5] - 2026-08-29
 
 - Bash now blocks tmux input commands that resolve to the agent's own pane before spawning the shell, including direct pane targets, session aliases, explicit socket forms, shell wrappers, and inspected script indirection. Read-only inspection and cross-session orchestration remain available, while blocked input cannot reach the transcript as a user turn. (#5039)
@@ -653,7 +678,7 @@
 ### Added
 
 - The SDK `models.list/current` (Q10) catalog now lists model profiles as synthetic `gajae-code/<profile>` entries (e.g. `gajae-code/codex-eco`), and selecting one through `model.set` (or the ACP Model picker) activates the profile for the live session only; global persistence remains the explicit `gjc --mpreset <name> --default` or TUI default-selection path. ACP/SDK clients such as Paseo can therefore offer presets like ordinary models; only availability-filtered profiles are advertised, the reserved `gajae-code` namespace fails closed on collision, and `config.patch` serializes with profile activation through the session admission boundary.
-- Added first-class `cline-pass` and `commandcode-goat` provider presets with documented API endpoints, environment-variable credentials, non-hardcoded live model discovery from models.dev and the Command Code Provider API, and prefix-based Claude routing.
+- Added first-class `cline-pass` and `commandcode-goat` provider presets with documented API endpoints, environment-variable credentials, non-hardcoded live model discovery from models.dev and the Command Code Provider API; Command Code models stay on its documented OpenAI-compatible transport regardless of model name.
 - Registered the `jetbrains-junie` provider in the famous-provider ordering and the `JUNIE_API_KEY` credential help so JetBrains AI (Junie) Claude models surface in `/model`, `--list-models` and `gjc --help` alongside the other first-class providers (#3626).
 - Added lease-backed MCP connection pooling with typed recovery, shared HTTP/SSE sessions, per-lease callback demultiplexing, and authorization binding scopes that keep credential secrets out of pool keys.
 - Added plugin registry v2 as the single execution authority for plugin tools, subskills, and prompt appendices, with digest verification at final use.

package/dist/types/async/job-manager.d.ts

@@ -21,6 +21,12 @@ export interface AsyncJob {
     setupFailureSummary?: string;
     /** Safe, bounded summary of a terminal local (non-provider) failure kind. */
     localErrorSummary?: LocalErrorSummary;
+    /** Compact delivery-failure marker retained while the job row remains live. */
+    deliveryFailure?: {
+        attempt: number;
+        lastError?: string;
+        recordedAt: number;
+    };
     metadata?: AsyncJobMetadata;
     /**
      * Registry id of the agent that registered the job (e.g. "0-Main",
@@ -38,6 +44,8 @@ export interface AsyncJob {
  */
 export declare function jobElapsedMs(job: Pick<AsyncJob, "startTime" | "endTime">, now?: number): number;
 export interface AsyncJobMetadata {
+    /** Set once a foreground wait has been folded, so surfacing can show folded work. */
+    backgrounded?: boolean;
     subagent?: {
         id: string;
         agent: string;
@@ -170,11 +178,50 @@ export interface AsyncJobManagerOptions {
     onJobComplete: (jobId: string, text: string, job?: AsyncJob) => void | Promise<void>;
     maxRunningJobs?: number;
     retentionMs?: number;
+    maxDeadLetterOverflowOwners?: number;
+}
+export interface AsyncJobAdmission {
+    readonly manager: AsyncJobManager;
 }
 export interface AsyncJobDisposeDiagnostics {
     stuckJobIds: string[];
     deliveriesDrained: boolean;
 }
+/** Per-job public delivery classification. Exactly one value per terminal job. */
+export type JobDeliveryState = "pending" | "delivered" | "failed-visible";
+/** One job as projected by {@link AsyncJobManager.getJobsSnapshot}. */
+export interface AsyncJobSnapshotEntry {
+    id: string;
+    kind: string;
+    label: string;
+    status: AsyncJob["status"];
+    generation: string;
+    backgrounded: boolean;
+    deliveryState: JobDeliveryState;
+}
+/** Scalar delivery-failure evidence that may outlive its AsyncJob record. */
+export interface DeadLetteredJobSnapshotEntry {
+    jobId: string;
+    generation: string;
+    ownerId?: string;
+    /** Whether the failed delivery originated from a backgrounded job. */
+    backgrounded?: boolean;
+    attempt: number;
+    lastError?: string;
+    recordedAt: number;
+}
+/**
+ * One atomic projection of job + delivery state.
+ *
+ * Computed in a single synchronous pass with no interleaved awaits so it cannot
+ * tear, and consumed verbatim: a UI that re-derives delivery classification from
+ * separate getters can disagree with this and produce a job that is in no public
+ * state at all.
+ */
+export interface AsyncJobsSnapshot {
+    jobs: AsyncJobSnapshotEntry[];
+    deadLettered: DeadLetteredJobSnapshotEntry[];
+}
 export interface AsyncJobDeliveryState {
     queued: number;
     delivering: boolean;
@@ -209,6 +256,8 @@ export interface AsyncJobRegisterOptions {
     metadata?: AsyncJobMetadata;
     onProgress?: (text: string, details?: Record<string, unknown>) => void | Promise<void>;
     lifecycle?: AsyncJobLifecycleCleanup;
+    /** Reserved capacity consumed atomically by this registration. */
+    admissionToken?: AsyncJobAdmission;
 }
 /**
  * Filter applied to job query/cancel APIs. With `ownerId`, results are
@@ -411,6 +460,10 @@ export declare class AsyncJobManager {
      */
     getJobPromise(id: string, generation: string): Promise<void> | undefined;
     getRunningJobs(filter?: AsyncJobFilter): AsyncJob[];
+    /** Whether a new running job can be admitted without starting side effects. */
+    hasCapacity(filter?: AsyncJobFilter): boolean;
+    reserveCapacity(): AsyncJobAdmission;
+    releaseCapacity(token: AsyncJobAdmission): void;
     getRecentJobs(limit?: number, filter?: AsyncJobFilter): AsyncJob[];
     getAllJobs(filter?: AsyncJobFilter): AsyncJob[];
     /**
@@ -450,6 +503,18 @@ export declare class AsyncJobManager {
     /** Run producer cleanups, then perform the legacy destructive subagent purge. */
     runOwnerCleanups(filter?: AsyncJobFilter): void;
     getDeliveryState(filter?: AsyncJobFilter): AsyncJobDeliveryState;
+    /**
+     * One synchronous pass over jobs plus delivery state.
+     *
+     * Every returned job carries exactly one {@link JobDeliveryState}, and
+     * dead-lettered evidence is included even when its record is already gone, so
+     * no terminal job can end up invisible to the UI.
+     */
+    getJobsSnapshot(filter?: AsyncJobFilter): AsyncJobsSnapshot;
+    retainParkedDelivery(job: AsyncJob, text: string): void;
+    retainDeliveryClaim(job: AsyncJob): void;
+    releaseDeliveryClaim(generation: string): void;
+    clearParkedDelivery(generation: string): void;
     hasPendingDeliveries(filter?: AsyncJobFilter): boolean;
     watchJobGenerations(jobIds: string[]): AsyncJobWatchHandle;
     watchJobs(jobIds: string[]): number;
@@ -460,6 +525,19 @@ export declare class AsyncJobManager {
      * matching agent registered; with no filter, cancels every running job
      * (used by `dispose()` to nuke the manager's state).
      */
+    /**
+     * Synchronously fail a running job AND enqueue its delivery, exactly once.
+     *
+     * An externally owned wait -- an ACP client terminal, say -- can fail while its
+     * owner is being torn down. `cancel()` is the wrong tool there: it marks the job
+     * cancelled, and the cancelled path deliberately enqueues NO delivery, so the
+     * failure would never become visible to anyone. This is the single transition
+     * that both fails the job and delivers that failure in one synchronous block, so
+     * it cannot lose the race against disposal.
+     */
+    failNow(jobId: string, generation: string, errorText: string, options?: {
+        abort?: boolean;
+    }): boolean;
     cancelAll(filter?: AsyncJobFilter): void;
     waitForOwnerInFlightDeliveries(ownerId: string, options?: {
         timeoutMs?: number;
@@ -468,6 +546,11 @@ export declare class AsyncJobManager {
         timeoutMs?: number;
     }): Promise<boolean>;
     getLastDisposeDiagnostics(): AsyncJobDisposeDiagnostics;
+    /**
+     * Mark a running job as backgrounded (folded out of its foreground call).
+     * Read by getJobsSnapshot so folded work stays visible; safe to call twice.
+     */
+    markBackgrounded(jobId: string, generation: string): boolean;
     waitForAll(): Promise<void>;
     drainDeliveries(options?: {
         timeoutMs?: number;

package/dist/types/cli/auth-gateway-cli.d.ts

@@ -1,9 +1,11 @@
+import { type AuthCredentialSnapshot, type CredentialHealthResult } from "@gajae-code/ai/core";
 export type AuthGatewayAction = "serve" | "token" | "status" | "check";
 export interface AuthGatewayCommandArgs {
     action: AuthGatewayAction;
     flags: {
         json?: boolean;
         bind?: string;
+        provider?: string;
         regenerate?: boolean;
         /**
          * Disable bearer-token auth on inbound requests. Useful when the gateway
@@ -14,5 +16,20 @@ export interface AuthGatewayCommandArgs {
     };
 }
 declare const ACTIONS: readonly AuthGatewayAction[];
+export declare function resolveAuthGatewayReadiness(input: {
+    noAuth: boolean;
+    tokenPresent: boolean;
+    credentialCount: number;
+    modelCount: number;
+}): {
+    ready: boolean;
+    reason: "token_missing" | "provider_credential_missing" | "provider_catalog_empty" | null;
+};
+export declare function normalizeProviderScope(provider: string | undefined): string | undefined;
+export declare function filterCredentialCheckResults(results: readonly CredentialHealthResult[], provider: string | undefined): CredentialHealthResult[];
+export declare function redactBrokerUrl(rawUrl: string): string;
+export declare function hasEnabledProviderCredential(snapshot: Pick<AuthCredentialSnapshot, "credentials">, provider: string): boolean;
+export declare function matchesProviderCredential(entry: AuthCredentialSnapshot["credentials"][number], apiKey: string): boolean;
+export declare function assertEnabledProviderCredential(snapshot: Pick<AuthCredentialSnapshot, "credentials">, provider: string): void;
 export declare function runAuthGatewayCommand(cmd: AuthGatewayCommandArgs): Promise<void>;
 export { ACTIONS as AUTH_GATEWAY_ACTIONS };

package/dist/types/cli/model-presets-cli.d.ts

@@ -0,0 +1,9 @@
+export declare const MODEL_PRESETS_ACTIONS: readonly ["status", "refresh", "rollback", "pin", "unpin", "disable", "enable"];
+export type ModelPresetsAction = (typeof MODEL_PRESETS_ACTIONS)[number];
+export interface ModelPresetsCommandArgs {
+    action: ModelPresetsAction;
+    revision?: string;
+    json?: boolean;
+    agentDir?: string;
+}
+export declare function runModelPresetsCommand(args: ModelPresetsCommandArgs): Promise<void>;

package/dist/types/cli/update-cli.d.ts

@@ -1,6 +1,7 @@
 import { Settings } from "../config/settings";
 import { type UpdateChannel } from "../config/update-channel";
 import { type NotificationProvider } from "../sdk/bus/config";
+import type { TelemetryDetails, TelemetryEventName } from "../telemetry";
 import { type GithubReleaseLookupOptions } from "./github-release";
 export interface UpdateCommandOptions {
     force: boolean;
@@ -150,6 +151,7 @@ export interface UpdateCommandDependencies {
     restartDaemon?: (settings: Settings) => Promise<void>;
     recoverNotifications?: (settings: Settings) => Promise<void>;
     runPostUpdateRecovery?: (runtimePath: string) => Promise<void>;
+    recordTelemetryEvent?: (event: TelemetryEventName, details: TelemetryDetails) => unknown;
     exit?: (code: number) => never;
 }
 export type PostUpdateRecoverySpawn = (argv: string[]) => Promise<number>;

package/dist/types/commands/auth-gateway.d.ts

@@ -20,6 +20,9 @@ export default class AuthGateway extends Command {
             description: string;
             char: string;
         };
+        provider: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
         regenerate: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };

package/dist/types/commands/gc.d.ts

@@ -2,6 +2,7 @@ import { Command } from "@gajae-code/utils/cli";
 export default class Gc extends Command {
     static description: string;
     static strict: boolean;
+    static delegateHelp: boolean;
     static flags: {
         json: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             char: string;
@@ -28,6 +29,18 @@ export default class Gc extends Command {
             description: string;
             default: boolean;
         };
+        "empty-delete-receipts": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+            default: boolean;
+        };
+        root: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+            multiple: true;
+        };
+        manifest: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+            multiple: true;
+        };
     };
     static examples: string[];
     run(): Promise<void>;

package/dist/types/commands/model-presets.d.ts

@@ -0,0 +1,21 @@
+import { Command } from "@gajae-code/utils/cli";
+export default class ModelPresets extends Command {
+    static description: string;
+    static args: {
+        action: import("@gajae-code/utils/cli").ArgDescriptor & {
+            description: string;
+            required: false;
+            options: readonly ["status", "refresh", "rollback", "pin", "unpin", "disable", "enable"];
+        };
+        revision: import("@gajae-code/utils/cli").ArgDescriptor & {
+            description: string;
+            required: false;
+        };
+    };
+    static flags: {
+        json: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+    };
+    run(): Promise<void>;
+}

package/dist/types/config/autorouting-tier-map.d.ts

@@ -16821,6 +16821,102 @@ export declare const TIER_MAP_SKIP_LIST: {
         readonly baseline: true;
         readonly rationale: "pre-feature baseline; not yet curated";
     };
+    readonly "kiro/auto": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-haiku-4-5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-haiku-4.5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4-5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4-6": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4-7": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4-8": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4.5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4.6": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4.7": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-4.8": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-opus-5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-sonnet-4": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-sonnet-4-5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-sonnet-4-6": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-sonnet-4.5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-sonnet-4.6": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/claude-sonnet-5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/deepseek-3-2": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/deepseek-3.2": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/glm-5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/gpt-5-6-luna": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/gpt-5-6-sol": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/gpt-5-6-terra": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/gpt-5.6-luna": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/gpt-5.6-sol": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/gpt-5.6-terra": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/minimax-m2-1": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/minimax-m2-5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/minimax-m2.1": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/minimax-m2.5": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
+    readonly "kiro/qwen3-coder-next": {
+        readonly rationale: "Kiro API-key catalog addition; not yet curated";
+    };
 };
 export declare const CURATED_TIER_MAP: AutoroutingCuratedTierMap;
 /** Canonical JSON uses sorted object keys and preserves array order. */

package/dist/types/config/file-lock.d.ts

@@ -1,3 +1,4 @@
+import type { NativeDirectoryTreeResult, NativeExactUnlinkResult } from "@gajae-code/natives";
 export interface FileLockOptions {
     staleMs?: number;
     retries?: number;
@@ -9,8 +10,12 @@ export interface FileLockOptions {
     /** Previous local host identities accepted only when deciding stale-owner reclamation. */
     previousOwnerHostIds?: readonly string[];
 }
+/** Release retries cover transient Windows/Dropbox handle denial without extending the lock indefinitely. */
+export declare const FILE_LOCK_RELEASE_RETRY_ATTEMPTS = 5;
+export declare const FILE_LOCK_RELEASE_RETRY_DELAY_MS = 10;
 export declare const FileLockTestHooks: {
     afterParentMkdir?: (lockPath: string) => void | Promise<void>;
+    nativeQuarantineBindings?: () => NativeFileLockBindings;
 };
 /**
  * Returns the OS-provided process start timestamp for PID-reuse detection.
@@ -25,16 +30,46 @@ export declare const FileLockTestHooks: {
  */
 export declare function processStartTime(pid: number): string | null;
 /** @internal */
+export interface FileLockGcObservation {
+    info: FileLockOwnerToken;
+    bytes: string;
+    identity: GenericFileLockDirIdentity;
+}
+/** Capture owner bytes and the identity proving those exact bytes came from this tree. */
+export declare function readFileLockObservationForGc(lockDir: string): Promise<FileLockGcObservation | null>;
+/** @internal */
 export declare function readFileLockInfoForGc(lockDir: string): Promise<FileLockOwnerToken | null>;
 /** Owner identity stamped into a `<file>.lock/info` record. */
 export interface FileLockOwnerToken {
     pid: number;
     start_time?: string;
+    /** Encoding marker for the canonical UTC process-start identity. */
+    start_time_format?: string;
     owner_host_id?: string;
+    /** Unique acquisition generation, present on locks created by this runtime. */
+    owner_token?: string;
     timestamp: number;
 }
 /** Outcome of a guarded lock-dir removal attempt (`removeFileLockDirForGc`). */
-export type FileLockGcRemoval = "removed" | "owner_changed" | "missing";
+export type FileLockGcRemoval = "removed" | "owner_changed" | "missing" | "cleanup_failed";
+/** Identity evidence carried by the generic stale verdict into a later removal. */
+export interface GenericFileLockDirIdentity {
+    rootDev: string;
+    rootIno: string;
+    infoDev: string;
+    infoIno: string;
+    infoNlink: string;
+    infoSize: string;
+    infoMtimeNs: string;
+    infoCtimeNs: string;
+    infoSha256: string;
+}
+export type GenericFileLockDirStaleVerdict = {
+    stale: false;
+} | {
+    stale: true;
+    identity: GenericFileLockDirIdentity;
+};
 /**
  * @internal
  * Fail-closed removal of a lock dir whose owner is expected to be dead or
@@ -52,7 +87,7 @@ export type FileLockGcRemoval = "removed" | "owner_changed" | "missing";
  * directory, so the residual read->unlink window cannot be fully eliminated,
  * but the reclaim-after-stale scenario the issue describes is now guarded.
  */
-export declare function removeFileLockDirForGc(lockDir: string, expected: FileLockOwnerToken): Promise<FileLockGcRemoval>;
+export declare function removeFileLockDirForGc(lockDir: string, expected: FileLockOwnerToken, preVerdictIdentity?: GenericFileLockDirIdentity): Promise<FileLockGcRemoval>;
 /**
  * @internal
  * READ-ONLY verdict on an EXISTING generic `<file>.lock/` directory that another lock
@@ -71,6 +106,17 @@ export declare function removeFileLockDirForGc(lockDir: string, expected: FileLo
  * the object is no longer the one that was judged.
  */
 export declare function genericFileLockDirIsStale(lockDir: string, staleMs: number, ownerHostId?: string): Promise<boolean>;
+/**
+ * Render a generic stale verdict together with the root and owner-file identity that
+ * verdict actually observed. A caller that removes the directory must require a later
+ * native snapshot to carry this same identity; a snapshot taken only after a clone was
+ * installed is not authority for the stale verdict.
+ */
+export declare function genericFileLockDirStaleVerdict(lockDir: string, staleMs: number, ownerHostId?: string): Promise<GenericFileLockDirStaleVerdict>;
+type NativeFileLockBindings = {
+    snapshotDirectoryTree(lockPath: string): NativeDirectoryTreeResult;
+    exactRemoveDirectoryTree(lockPath: string, snapshot: NonNullable<NativeDirectoryTreeResult["snapshot"]>): NativeExactUnlinkResult;
+};
 /**
  * Serializes all contenders, including callers in the same process. Because this
  * API exposes no ownership token, recursive acquisition is indistinguishable
@@ -78,3 +124,4 @@ export declare function genericFileLockDirIsStale(lockDir: string, staleMs: numb
  * that fact through its own `lockHeld` path instead of acquiring it again.
  */
 export declare function withFileLock<T>(filePath: string, fn: () => Promise<T>, options?: FileLockOptions): Promise<T>;
+export {};

package/dist/types/config/internal/model-preset-registry-test-state.d.ts

@@ -0,0 +1,4 @@
+import type { ModelPresetRegistryTrustedKey } from "../model-preset-registry";
+export declare function getModelPresetRegistryTestTrustedKeys(agentDir: string): ReadonlyMap<string, ModelPresetRegistryTrustedKey> | undefined;
+export declare function modelPresetRegistryTestUrlsAllowed(agentDir: string): boolean;
+export declare function runWithModelPresetRegistryTestTrust<T>(agentDir: string, trustedKeys: ReadonlyMap<string, ModelPresetRegistryTrustedKey>, operation: () => T): T;

package/dist/types/config/internal/model-preset-registry-test-support.d.ts

@@ -0,0 +1,3 @@
+import type { ModelPresetRegistryTrustedKey } from "../model-preset-registry";
+/** Runs one test operation with scoped trust. This module is denied by package exports. */
+export declare function withModelPresetRegistryTestTrust<T>(agentDir: string, trustedKeys: ReadonlyMap<string, ModelPresetRegistryTrustedKey>, operation: () => T): T;

package/dist/types/config/keybindings.d.ts

@@ -60,6 +60,7 @@ declare module "@gajae-code/tui" {
 }
 export declare function defaultMessageQueueKeysForPlatform(platform?: NodeJS.Platform): KeyId;
 export declare function defaultClipboardPasteImageKeysForPlatform(platform?: NodeJS.Platform): KeyId[];
+export declare function defaultForegroundFoldKeysForPlatform(platform?: NodeJS.Platform): KeyId[];
 /**
  * All keybindings definitions: TUI + app-specific.
  */
@@ -241,8 +242,8 @@ export declare const KEYBINDINGS: {
         readonly description: "Expand tools";
     };
     readonly "app.tool.backgroundFold": {
-        readonly defaultKeys: "ctrl+b";
-        readonly description: "Fold/background supported foreground tool";
+        readonly defaultKeys: KeyId[];
+        readonly description: "Fold supported foreground tool into a background job";
     };
     readonly "app.editor.external": {
         readonly defaultKeys: "ctrl+g";