@gajae-code/coding-agent 0.15.6 → 0.16.0

package/dist/types/sdk/lifecycle/broker-client.d.ts

@@ -6,3 +6,9 @@ export declare class AgentDirSessionLifecycleClient implements SessionLifecycleC
     global(operation: SessionLifecycleOperation, input: Record<string, unknown>, options: SessionLifecycleClientRequestOptions): Promise<unknown>;
 }
 export declare function createBrokerSessionLifecycleService(agentDir: string): SessionLifecycleService;
+/**
+ * Dedicated dispatch for the local master `session.spawn` surface. It shares
+ * the lifecycle client's credential boundary but bypasses the generic mutation
+ * outcome types: spawn responses are validated by the caller's allowlist.
+ */
+export declare function dispatchSpawnGlobal(agentDir: string, input: Record<string, unknown>, idempotencyKey: string, timeoutMs: number): Promise<unknown>;

package/dist/types/sdk/lifecycle/service.d.ts

@@ -1,3 +1,4 @@
+import { type ScopeRequestV1, type SdkSearchResultV1 } from "../broker/session-scope";
 export type SessionLifecycleOperation = "session.create" | "session.fork" | "session.resume" | "session.close" | "session.delete" | "session.reconcile_uncertain" | "session.list";
 export interface SessionLifecycleActor {
     readonly id: string;
@@ -104,6 +105,9 @@ export interface SessionDeleteTarget {
 export interface SessionListTarget {
     readonly cwd?: string;
     readonly resolveSessionId?: string;
+    readonly scope?: ScopeRequestV1;
+    readonly limit?: number;
+    readonly cursor?: string;
 }
 interface SessionLifecycleMutationRequestBase<TOperation extends Exclude<SessionLifecycleOperation, "session.list">, TTarget> {
     readonly operation: TOperation;
@@ -141,7 +145,12 @@ export interface SessionLifecycleListEntry {
     readonly live?: boolean;
     readonly endpointGeneration?: number;
     readonly terminalUncertain?: boolean;
-    readonly repo?: string;
+    readonly cwd?: string;
+    readonly locator?: {
+        readonly cwd: string;
+        readonly worktreeRoot: string | null;
+        readonly stateRoot: string;
+    };
 }
 export interface SessionLifecycleListResult {
     readonly indexSeq: number;
@@ -149,6 +158,7 @@ export interface SessionLifecycleListResult {
     readonly warnings: readonly string[];
     readonly savedSession?: SessionLifecycleSavedSession;
 }
+export type SessionScopedListResult = SdkSearchResultV1;
 export interface SessionCreateResult {
     readonly ok: true;
     readonly operation: "session.create";
@@ -182,7 +192,7 @@ export interface SessionReconcileUncertainResult {
 export interface SessionListSuccessResult {
     readonly ok: true;
     readonly operation: "session.list";
-    readonly result: SessionLifecycleListResult;
+    readonly result: SessionLifecycleListResult | SessionScopedListResult;
 }
 export interface SessionLifecycleError {
     readonly code: string;
@@ -229,6 +239,7 @@ export type SessionListFailure = {
     readonly operation: "session.list";
     readonly certainty: SessionLifecycleCertainty;
     readonly error: SessionLifecycleError;
+    readonly result?: SessionScopedListResult;
 };
 export type SessionCreateOutcome = SessionCreateResult | SessionCreateFailure;
 export type SessionForkOutcome = SessionForkResult | SessionForkFailure;
@@ -254,7 +265,8 @@ export declare function validateSessionLifecycleMutationRequest(request: unknown
 export declare class SessionLifecycleService {
     #private;
     constructor(client: SessionLifecycleClient);
-    execute(request: SessionLifecycleMutationRequest): Promise<SessionCreateOutcome | SessionForkOutcome | SessionResumeOutcome | SessionCloseOutcome | SessionDeleteOutcome | SessionReconcileUncertainOutcome>;
+    scopedList(scope: ScopeRequestV1, limit?: number, cursor?: string): Promise<SessionListOutcome>;
+    execute(request: SessionLifecycleMutationRequest, idempotencyKeyOverride?: string): Promise<SessionCreateOutcome | SessionForkOutcome | SessionResumeOutcome | SessionCloseOutcome | SessionDeleteOutcome | SessionReconcileUncertainOutcome>;
     executeWithIdempotencyKey(request: SessionLifecycleMutationRequest, idempotencyKey: string): Promise<SessionCreateOutcome | SessionForkOutcome | SessionResumeOutcome | SessionCloseOutcome | SessionDeleteOutcome | SessionReconcileUncertainOutcome>;
     create(request: Omit<SessionCreateRequest, "operation">): Promise<SessionCreateOutcome>;
     fork(request: Omit<SessionForkRequest, "operation">): Promise<SessionForkOutcome>;

package/dist/types/sdk/lifecycle-session.d.ts

@@ -48,6 +48,8 @@ export type CreateLifecycleAgentSessionOptions = Omit<CreateAgentSessionOptions,
      * a prepared signal instead of readiness until it is explicitly activated.
      */
     readiness?: "immediate" | "deferred";
+    /** Broker-issued lifecycle request identity published with host registration. */
+    lifecycleRequestId?: string;
 };
 /** Internal lifecycle-only session construction with an owner-bound SDK startup result. */
 export declare function createLifecycleAgentSession(options?: CreateLifecycleAgentSessionOptions): Promise<CreateLifecycleAgentSessionResult>;

package/dist/types/sdk/router/session-router.d.ts

@@ -164,6 +164,8 @@ export interface SessionRouterDeps {
 export type SessionRouterProviderDeps = Pick<SessionRouterDeps, "createClient" | "createIndex" | "createBrokerClient" | "setInterval" | "clearInterval" | "setTimeout" | "clearTimeout" | "onReconciled">;
 export interface SessionRouterOptions {
     agentDir: string;
+    /** Limits attachment to exact ids selected by a Broker-scoped operation. */
+    sessionIds?: readonly string[];
     deps?: SessionRouterDeps;
     /** Runtime-specific identity validation; Router supplies a conservative fallback. */
     correlateFrame?: SessionRouterFrameCorrelator;

package/dist/types/sdk/session.d.ts

@@ -7,6 +7,7 @@ import { ModelRegistry } from "../config/model-registry";
 import { type ScopedModelSelection } from "../config/model-resolver";
 import { type PromptTemplate } from "../config/prompt-templates";
 import { Settings, type SkillsSettings } from "../config/settings";
+import type { MasterModeContext } from "../master-mode/context";
 import type { BashRestrictionProfile } from "../tools/bash-allowed-prefixes";
 import "../discovery";
 import type { CustomCommandsLoadResult } from "../extensibility/custom-commands";
@@ -176,6 +177,8 @@ export interface CreateAgentSessionOptions {
      * @internal CLI-only startup optimization; SDK callers retain synchronous loading by default.
      */
     deferMcpConfigStartup?: boolean;
+    /** Process-local master authority. Never persist or pass to lifecycle children. */
+    masterModeContext?: MasterModeContext;
     /**
      * Defer memory backend startup until the caller has applied startup model profiles.
      * @internal CLI-only ordering guard; SDK callers retain immediate startup by default.
@@ -384,4 +387,17 @@ export declare function createPluginHooksExtension(hooks: ConstrainedPluginHook[
 export declare function resolveIntentTracingEnabled(intentTracingSetting: boolean | undefined, options: {
     subSession: boolean;
 }): boolean;
+/**
+ * Order candidates so each known provider's curated default model is tried
+ * before the rest of the catalog.
+ *
+ * Provider catalogs are not ranked by fitness — a withdrawn model whose ID
+ * carries an older date suffix sorts ahead of its current replacement — so
+ * picking the first credentialed entry can start an unconfigured install on a
+ * model the provider no longer serves. `DEFAULT_MODEL_PER_PROVIDER` is the
+ * curated table `findInitialModel` already sweeps for the same purpose;
+ * reusing it keeps both unconfigured paths on one source of truth. Candidates
+ * that are not a provider default keep their original relative order.
+ */
+export declare function orderByProviderDefaultFirst(candidates: readonly Model[], providerOrder?: readonly string[]): Model[];
 export declare function createAgentSession(options?: CreateAgentSessionOptions): Promise<CreateAgentSessionResult>;

package/dist/types/sdk/startup-capability.d.ts

@@ -49,6 +49,7 @@ export declare class SdkStartupCapability {
     #private;
     readonly rollback?: SdkStartupRollbackTracker | undefined;
     readonly readiness: "immediate" | "deferred";
+    readonly lifecycleRequestId?: string | undefined;
     get cancelled(): boolean;
     cancel(): void;
     /**
@@ -57,7 +58,7 @@ export declare class SdkStartupCapability {
      * environment so bus wiring can never mistake an inherited process-global
      * flag for a broker-managed preparation.
      */
-    constructor(rollback?: SdkStartupRollbackTracker | undefined, readiness?: "immediate" | "deferred");
+    constructor(rollback?: SdkStartupRollbackTracker | undefined, readiness?: "immediate" | "deferred", lifecycleRequestId?: string | undefined);
     normalizeFailure(phase: SdkStartupPhase, reason: SdkStartupReason, error?: unknown): SdkStartupFailure;
     get result(): SdkStartupResult | undefined;
     get promise(): Promise<SdkStartupResult>;

package/dist/types/session/agent-session.d.ts

@@ -805,6 +805,11 @@ export declare class AgentSession {
      * proceeds.
      */
     awaitSessionSettlement(): Promise<void>;
+    queueCoordinatorRuntimeStatePersistForTests(event: AgentSessionEvent, gate: Promise<void>): Promise<void>;
+    parkAgentEndForCoordinatorPersistForTests(event: Extract<AgentSessionEvent, {
+        type: "agent_end";
+    }>): void;
+    flushParkedAgentEndForCoordinatorPersistForTests(): void;
     drainAsyncJobDeliveriesForAcp(options?: {
         timeoutMs?: number;
     }): Promise<boolean>;

package/dist/types/session/credential-store-errors.d.ts

@@ -0,0 +1 @@
+export declare const CREDENTIAL_STORE_UNREADABLE_MESSAGE = "Credential store is unreadable. Back up the database, then have an operator run PRAGMA integrity_check or REINDEX; no automatic repair was attempted.";

package/dist/types/session/session-manager.d.ts

@@ -1175,7 +1175,63 @@ export declare class SessionManager {
     runWithCwdReadLease<T>(fn: () => Promise<T>): Promise<T>;
     /** Wait for any in-flight exclusive cwd transition to settle. */
     joinCwdTransition(): Promise<void>;
+    closeCwdMoveAdmission(): Promise<void>;
     getCwdGeneration(): number;
+    /**
+     * Register a listener invoked after every committed `moveTo`. Returns an idempotent
+     * unregister handle. Every move surface funnels through `moveTo`, so a single
+     * registration covers `move_session`, `/move`, and SDK/ACP `session.cwd.move`.
+     */
+    registerAfterMoveListener(listener: (move: {
+        previousCwd: string;
+        newCwd: string;
+        previousSessionFile: string | undefined;
+    }) => void | Promise<void>): () => void;
+    registerBeforeMoveListener(listener: (move: {
+        previousCwd: string;
+        newCwd: string;
+        previousSessionFile: string | undefined;
+        newSessionFile: string | undefined;
+        previousCwdIdentity: {
+            dev: bigint;
+            ino: bigint;
+        };
+        newCwdIdentity: {
+            dev: bigint;
+            ino: bigint;
+        };
+        preserveRecoveryJournal?: boolean;
+    }) => void | Promise<void>): () => void;
+    registerMovePublicationListener(listener: (move: {
+        previousCwd: string;
+        newCwd: string;
+        previousSessionFile: string | undefined;
+        newSessionFile: string | undefined;
+        previousCwdIdentity: {
+            dev: bigint;
+            ino: bigint;
+        };
+        newCwdIdentity: {
+            dev: bigint;
+            ino: bigint;
+        };
+        preserveRecoveryJournal?: boolean;
+    }) => void | Promise<void>): () => void;
+    registerMoveAbortListener(listener: (move: {
+        previousCwd: string;
+        newCwd: string;
+        previousSessionFile: string | undefined;
+        newSessionFile: string | undefined;
+        previousCwdIdentity: {
+            dev: bigint;
+            ino: bigint;
+        };
+        newCwdIdentity: {
+            dev: bigint;
+            ino: bigint;
+        };
+        preserveRecoveryJournal?: boolean;
+    }) => void | Promise<void>): () => void;
     static openNoFollowDirectory(dir: string): Promise<fs.promises.FileHandle>;
     /**
      * Claim process-cwd authority for `manager` when it is unowned or the prior
@@ -1215,6 +1271,15 @@ export declare class SessionManager {
                 bigint: true;
             }) => Promise<fs.BigIntStats>;
         };
+        expectedSourceIdentity?: {
+            dev: bigint;
+            ino: bigint;
+        };
+        sourceHandle?: {
+            stat: (opts: {
+                bigint: true;
+            }) => Promise<fs.BigIntStats>;
+        };
     }): Promise<void>;
     isPersisted(): boolean;
     stageDefaultModelSelection(model: string, thinkingLevel: string | undefined, options?: {

package/dist/types/session/yield-queue.d.ts

@@ -15,8 +15,9 @@ export interface YieldDispatcher<P> {
 export interface YieldQueueOptions {
     isStreaming: () => boolean;
     injectStreaming(msg: AgentMessage): void;
-    injectIdle(messages: AgentMessage[]): Promise<void>;
-    scheduleIdleFlush(run: () => Promise<void>): void;
+    injectIdle(messages: AgentMessage[], signal?: AbortSignal): Promise<void>;
+    scheduleIdleFlush(run: (signal?: AbortSignal) => Promise<void>, onSkip: () => void): void;
+    getIdleFlushSignal?(): AbortSignal | undefined;
 }
 type YieldFlushMode = "streaming" | "idle";
 export declare class YieldQueue {
@@ -25,8 +26,8 @@ export declare class YieldQueue {
     register<P>(kind: string, dispatcher: YieldDispatcher<P>): () => void;
     enqueue<P>(kind: string, entry: P): void;
     has(kind?: string): boolean;
-    flush(mode: YieldFlushMode): Promise<void>;
-    clear(): void;
+    flush(mode: YieldFlushMode, signal?: AbortSignal): Promise<void>;
+    clear(onDrop?: (kind: string, entries: readonly unknown[]) => void): void;
     /** Drop only the queued entries of a single kind, leaving other kinds intact. */
     clearKind(kind: string): void;
     /**

package/dist/types/setup/frictionless-onboarding.d.ts

@@ -68,6 +68,7 @@ export declare function hasCorroboratedRecentEvidence(evidence: readonly Onboard
 export declare function shouldOfferOnboarding(state: FrictionlessOnboardingState): boolean;
 export interface AutomaticOnboardingInput {
     normalInteractive: boolean;
+    automation?: boolean;
     initialMessage?: string;
     initialMessages: readonly string[];
     initialImages?: readonly unknown[];

package/dist/types/tools/bash.d.ts

@@ -4,6 +4,7 @@ import * as z from "zod/v4";
 import { type BashArtifactSaveResult } from "../exec/bash-executor";
 import type { RenderResultOptions } from "../extensibility/custom-tools/types";
 import { type Theme } from "../modes/theme/theme";
+import { type SdkSpawnArgs } from "../sdk/cli/master-cli";
 import type { ToolSession } from ".";
 import { type OutputMeta } from "./output-meta";
 export declare const BASH_DEFAULT_PREVIEW_LINES = 10;
@@ -48,6 +49,9 @@ export interface BashToolDetails {
 export declare function summarizeBashToolActivity(kind: "args" | "result", value: unknown): string | undefined;
 export interface BashToolOptions {
 }
+export declare function isStrictDirectSdkSpawnCommand(command: string): boolean;
+export declare function parseDirectSdkSpawnArgs(command: string): SdkSpawnArgs;
+export declare function masterCommandEnvOverrides(env: Record<string, string> | undefined, directMasterSpawn: boolean): Record<string, string>;
 export declare class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
     #private;
     private readonly session;

package/dist/types/tools/gh.d.ts

@@ -322,6 +322,14 @@ export interface PrDiffFile {
     changeType: "modified" | "added" | "deleted" | "renamed" | "binary";
     /** Pre-image path for renames/deletes; same as `path` otherwise. */
     oldPath?: string;
+    /**
+     * Set when `path` kept its C-style escaped source form because the quoted
+     * token held invalid UTF-8 or a malformed escape; distinguishes it from a
+     * valid path whose decoded text looks identical.
+     */
+    pathEscaped?: boolean;
+    /** Same as {@link PrDiffFile.pathEscaped}, for `oldPath`. */
+    oldPathEscaped?: boolean;
     /** Byte offset of the section's `diff --git` line in the unified diff. */
     startOffset: number;
     /** Byte offset of the next section (or end-of-text). */

package/dist/types/tools/index.d.ts

@@ -219,6 +219,10 @@ export interface ToolSession {
     bashAllowedPrefixes?: string[];
     /** Restriction policy for sessions that deliberately expose a narrow bash surface. */
     bashRestrictionProfile?: BashRestrictionProfile;
+    /** Process-local master capability injected into direct Bash children only. */
+    getMasterBashCapability?: () => string | undefined;
+    /** Stable master lineage identity used across session switches and branches. */
+    getMasterOwnerSessionId?: () => string | undefined;
     /** Optional per-session allowlist for tools exposed through search_tool_bm25. */
     discoverableToolAllowedNames?: readonly string[];
     /** Throw instead of warn when toolNames contains an unknown name. */

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.15.6",
+	"version": "0.16.0",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -56,12 +56,12 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.15.6",
-		"@gajae-code/agent-core": "0.15.6",
-		"@gajae-code/ai": "0.15.6",
-		"@gajae-code/natives": "0.15.6",
-		"@gajae-code/tui": "0.15.6",
-		"@gajae-code/utils": "0.15.6",
+		"@gajae-code/stats": "0.16.0",
+		"@gajae-code/agent-core": "0.16.0",
+		"@gajae-code/ai": "0.16.0",
+		"@gajae-code/natives": "0.16.0",
+		"@gajae-code/tui": "0.16.0",
+		"@gajae-code/utils": "0.16.0",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/scripts/generate-sdk-operation-inventory.ts

@@ -107,6 +107,12 @@ const LOCKED_EXCLUSIONS: Readonly<Record<string, string>> = {
 	"agent_session:activeMidRunBarrierCountForTests": "read-only test seam, not a user-facing SDK control seam",
 	"agent_session:activeMidRunMaintenanceCountForTests": "read-only test seam, not a user-facing SDK control seam",
 	"agent_session:getPendingNextTurnMessagesForTests": "read-only test seam, not a user-facing SDK control seam",
+	"agent_session:queueCoordinatorRuntimeStatePersistForTests":
+		"test-only coordinator persistence ordering seam, not a user-facing SDK control seam",
+	"agent_session:parkAgentEndForCoordinatorPersistForTests":
+		"test-only parked terminal persistence seam, not a user-facing SDK control seam",
+	"agent_session:flushParkedAgentEndForCoordinatorPersistForTests":
+		"test-only parked terminal flush seam, not a user-facing SDK control seam",
 	"agent_session:setCancelAndSubmitAbortOutcomeProviderForTests":
 		"test-only cancellation seam, not a user-facing SDK control seam",
 	"agent_session:getAgentId": "internal accessor/plumbing, not a user-facing control seam",

package/scripts/verify-gjc-sdk-canonicalization.ts

@@ -1567,6 +1567,24 @@ function isTypeOnlyTmuxPrimitiveOccurrence(contents: string, occurrence: TmuxPri
 	return /^\s*(?:export\s+)?type\b/.test(contents.slice(lineStart, lineEnd === -1 ? contents.length : lineEnd));
 }
 
+function isExactTmuxSelfInjectionGuardVerb(
+	file: string,
+	contents: string,
+	occurrence: TmuxPrimitiveOccurrence,
+): boolean {
+	if (file !== "packages/coding-agent/src/tools/tmux-self-injection-guard.ts") return false;
+	const declaration = 'const INPUT_VERBS = new Set(["send-keys", "paste-buffer", "send-prefix"]);';
+	const declarationStart = contents.indexOf(declaration);
+	if (declarationStart === -1 || contents.indexOf(declaration, declarationStart + 1) !== -1) return false;
+	const references = [...contents.matchAll(/\bINPUT_VERBS\b/g)];
+	if (references.length !== 2) return false;
+	const guardUse = "INPUT_VERBS.has(invocation.verb)";
+	const guardUseStart = contents.indexOf(guardUse);
+	if (guardUseStart === -1 || contents.indexOf(guardUse, guardUseStart + 1) !== -1) return false;
+	if (!references.some(reference => reference.index === guardUseStart)) return false;
+	return occurrence.start >= declarationStart && occurrence.end <= declarationStart + declaration.length;
+}
+
 function tmuxMachineBusViolations(file: string, contents: string): string[] {
 	if (isGeneratedDocumentationIndex(file)) return [];
 	const allowedTeamFallbackRanges =
@@ -1581,7 +1599,8 @@ function tmuxMachineBusViolations(file: string, contents: string): string[] {
 		if (
 			isExactTeamFallback ||
 			isExactTmuxScrollCopyModeSendKeys(file, contents, occurrence) ||
-			isTypeOnlyTmuxPrimitiveOccurrence(contents, occurrence)
+			isTypeOnlyTmuxPrimitiveOccurrence(contents, occurrence) ||
+			isExactTmuxSelfInjectionGuardVerb(file, contents, occurrence)
 		)
 			continue;
 		const detail =
@@ -3147,6 +3166,21 @@ fi
 		1,
 		"tmux send-keys content injection is outside sanctioned process lifecycle",
 	);
+	await runSelfTestFixture(
+		{
+			"packages/coding-agent/src/tools/tmux-self-injection-guard.ts":
+				'const INPUT_VERBS = new Set(["send-keys", "paste-buffer", "send-prefix"]);\nfunction guarded(invocation: { verb: string }): void { if (!INPUT_VERBS.has(invocation.verb)) return; }\n',
+		},
+		0,
+	);
+	await runSelfTestFixture(
+		{
+			"packages/coding-agent/src/tools/tmux-self-injection-guard.ts":
+				'const INPUT_VERBS = new Set(["send-keys", "paste-buffer", "send-prefix"]);\nfunction guarded(invocation: { verb: string }): void { if (!INPUT_VERBS.has(invocation.verb)) return; }\nfor (const verb of INPUT_VERBS) Bun.spawnSync(["tmux", verb, "-t", pane, prompt]);\n',
+		},
+		1,
+		"tmux send-keys content injection is outside sanctioned process lifecycle",
+	);
 	await runSelfTestFixture(
 		{
 			"packages/coding-agent/src/gjc-runtime/team-runtime.ts":

package/src/cli/accounts-cli.ts

@@ -10,6 +10,7 @@ import {
 	type AuthStorage,
 	type CredentialInventoryRecord,
 	type CredentialRemovalTarget,
+	isSqliteCorruptionError,
 	OAuthCredentialSelectorError,
 	type OAuthPinTarget,
 	resolveOAuthStorageProvider,
@@ -23,6 +24,7 @@ import {
 	checkAccountInventory,
 	clearPersistentPinForRemovedRows,
 } from "../session/account-inventory";
+import { CREDENTIAL_STORE_UNREADABLE_MESSAGE } from "../session/credential-store-errors";
 import { resolveStartupAuthConfig, type StartupAuthConfigSnapshot } from "../session/startup-auth-config";
 
 export const ACCOUNTS_ACTIONS = ["list", "check", "pin", "logout"] as const;
@@ -48,6 +50,7 @@ class AccountsCommandError extends Error {
 	}
 }
 export function toAccountsCommandError(error: unknown): AccountsCommandError | undefined {
+	if (isSqliteCorruptionError(error)) return new AccountsCommandError(CREDENTIAL_STORE_UNREADABLE_MESSAGE);
 	if (error instanceof OAuthCredentialSelectorError) return new AccountsCommandError(error.message);
 	return undefined;
 }
@@ -391,16 +394,17 @@ export async function runAccountsCommand(cmd: AccountsCommandArgs): Promise<void
 			}
 		}
 	} catch (error) {
+		const normalizedError = toAccountsCommandError(error) ?? error;
 		if (cmd.flags.json) {
-			if (!(error instanceof AccountsCommandError)) {
-				process.stderr.write(`accounts command failed: ${cleanReason(error) ?? "Command failed."}\n`);
+			if (!(normalizedError instanceof AccountsCommandError)) {
+				process.stderr.write(`accounts command failed: ${cleanReason(normalizedError) ?? "Command failed."}\n`);
 			}
 			process.exitCode = 1;
-			writeJsonFailure(error);
+			writeJsonFailure(normalizedError);
 			return;
 		}
-		if (error instanceof AccountsCommandError) {
-			process.stderr.write(`${error.message}\n`);
+		if (normalizedError instanceof AccountsCommandError) {
+			process.stderr.write(`${normalizedError.message}\n`);
 			process.exitCode = 1;
 			return;
 		}

package/src/cli/args.ts

@@ -84,6 +84,8 @@ export interface Args {
 	noRules?: boolean;
 	listModels?: string | true;
 	noTitle?: boolean;
+	master?: true;
+	masterScope?: "repo" | "pwd" | "global";
 	messages: string[];
 	fileArgs: string[];
 	/** Flags unknown to every launch parser; their consumer supplies the diagnostic. */
@@ -178,6 +180,17 @@ export function parseArgs(args: string[], authority: ParseArgsAuthority = "local
 			result.help = true;
 		} else if (arg === "--version" || arg === "-v") {
 			result.version = true;
+		} else if (arg === "--master") {
+			result.master = true;
+		} else if (arg === "--scope") {
+			const scope = takeFlagValue(args, i++, "--scope");
+			if (scope !== "repo" && scope !== "pwd" && scope !== "global") {
+				throw new CliParseError("invalid --scope value (expected repo, pwd, or global)");
+			}
+			if (result.masterScope !== undefined && result.masterScope !== scope) {
+				throw new CliParseError("--scope cannot be specified with conflicting values");
+			}
+			result.masterScope = scope;
 		} else if (arg === "--allow-home") {
 			result.allowHome = true;
 		} else if (arg === "--mode") {
@@ -371,6 +384,10 @@ export function parseArgs(args: string[], authority: ParseArgsAuthority = "local
 		}
 	}
 
+	if (result.masterScope !== undefined && result.master !== true) {
+		throw new CliParseError("--scope requires --master");
+	}
+	if (result.master === true && result.masterScope === undefined) result.masterScope = "repo";
 	if (result.default && !result.mpreset) {
 		throw new CliParseError("--default requires --mpreset <name>");
 	}

package/src/cli/fast-help.ts

@@ -79,6 +79,7 @@ Environment Variables:
 
   # Configuration
   GJC_CODING_AGENT_DIR       - Session storage directory (default: ~/${CONFIG_DIR_NAME}/agent)
+  GJC_UI_LANGUAGE            - Explicit first-use onboarding language (en, ko, zh, or ja); invalid values use English without prompting
   GJC_PACKAGE_DIR            - Override package directory (for Nix/Guix store paths)
   GJC_SMOL_MODEL              - Override smol/fast model (see --smol)
   GJC_SLOW_MODEL              - Override slow/reasoning model (see --slow)

package/src/cli/root-flags.ts

@@ -73,6 +73,11 @@ export const ROOT_LAUNCH_FLAGS = {
 		optionalValue: true,
 	}),
 	"no-title": Flags.boolean({ description: "Disable title auto-generation" }),
+	master: Flags.boolean({ description: "Launch an interactive master session" }),
+	scope: Flags.string({
+		description: "Master scope: repo (default), pwd, or global",
+		options: ["repo", "pwd", "global"],
+	}),
 };
 
 export type ConsumerLaunchFlagName = "hook" | "extension" | "no-extensions" | "no-skills" | "skills";

package/src/cli/update-cli.ts

@@ -9,7 +9,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { pipeline } from "node:stream/promises";
-import { $which, APP_NAME, isCompiledBinary, isEnoent, VERSION } from "@gajae-code/utils";
+import { $which, APP_NAME, isCompiledBinary, isEnoent, redactCrashSecrets, VERSION } from "@gajae-code/utils";
 import { $ } from "bun";
 import chalk from "chalk";
 import { Settings } from "../config/settings";
@@ -55,6 +55,7 @@ export interface InstalledVersionVerification {
 	ok: boolean;
 	actual?: string;
 	path?: string;
+	versionOutput?: string;
 	smokeTestFailed?: boolean;
 	smokeTestOutput?: string;
 	cleanupWarning?: string;
@@ -462,6 +463,71 @@ export function parseReportedVersionForTest(output: string): string | undefined
 	return parseReportedVersion(output);
 }
 
+const VERIFICATION_OUTPUT_MAX_LENGTH = 512;
+const ANSI_ESCAPE = /\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07]*(?:\x07|\x1b\\))/gu;
+const UNSAFE_CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/gu;
+
+function sanitizeVerificationOutput(...streams: Array<string | undefined>): string | undefined {
+	const output = streams
+		.map(stream => stream?.replace(ANSI_ESCAPE, "").replace(UNSAFE_CONTROL, " ").replace(/\s+/g, " ").trim() ?? "")
+		.filter(Boolean)
+		.filter((stream, index, all) => all.indexOf(stream) === index)
+		.join(" ");
+	if (!output) return undefined;
+	const redacted = redactCrashSecrets(output);
+	if (redacted.length <= VERIFICATION_OUTPUT_MAX_LENGTH) return redacted;
+	return `${redacted.slice(0, VERIFICATION_OUTPUT_MAX_LENGTH - 3)}...`;
+}
+
+export function sanitizeVerificationOutputForTest(
+	stderr: string | undefined,
+	stdout: string | undefined,
+): string | undefined {
+	return sanitizeVerificationOutput(stderr, stdout);
+}
+
+interface InstalledVersionCommandResult {
+	exitCode: number | null;
+	stdout: string;
+	stderr: string;
+}
+
+type InstalledVersionCommandRunner = (runtimePath: string) => Promise<InstalledVersionCommandResult>;
+
+async function verifyInstalledVersionWith(
+	expectedVersion: string,
+	runtimePath: string | undefined,
+	runVersion: InstalledVersionCommandRunner,
+): Promise<InstalledVersionVerification> {
+	if (!runtimePath) return { ok: false };
+	try {
+		const result = await runVersion(runtimePath);
+		if (result.exitCode !== 0) {
+			return {
+				ok: false,
+				path: runtimePath,
+				versionOutput: sanitizeVerificationOutput(result.stderr, result.stdout),
+			};
+		}
+		const actual = parseReportedVersion(result.stdout);
+		return { ok: actual === expectedVersion, actual, path: runtimePath };
+	} catch (error) {
+		return {
+			ok: false,
+			path: runtimePath,
+			versionOutput: sanitizeVerificationOutput(error instanceof Error ? error.message : String(error)),
+		};
+	}
+}
+
+export async function verifyInstalledVersionForTest(options: {
+	expectedVersion: string;
+	runtimePath: string | undefined;
+	runVersion: InstalledVersionCommandRunner;
+}): Promise<InstalledVersionVerification> {
+	return await verifyInstalledVersionWith(options.expectedVersion, options.runtimePath, options.runVersion);
+}
+
 /**
  * Run the resolved gjc binary and check if it reports the expected version.
  */
@@ -469,15 +535,14 @@ async function verifyInstalledVersion(
 	expectedVersion: string,
 	runtimePath: string | undefined = resolveGjcPath(),
 ): Promise<InstalledVersionVerification> {
-	if (!runtimePath) return { ok: false };
-	try {
-		const result = await $`${runtimePath} --version`.quiet().nothrow();
-		if (result.exitCode !== 0) return { ok: false, path: runtimePath };
-		const actual = parseReportedVersion(result.text());
-		return { ok: actual === expectedVersion, actual, path: runtimePath };
-	} catch {
-		return { ok: false, path: runtimePath };
-	}
+	return await verifyInstalledVersionWith(expectedVersion, runtimePath, async resolvedPath => {
+		const result = await $`${resolvedPath} --version`.quiet().nothrow();
+		return {
+			exitCode: result.exitCode,
+			stdout: result.stdout.toString(),
+			stderr: result.stderr.toString(),
+		};
+	});
 }
 
 async function verifyInstalledRuntime(
@@ -665,7 +730,8 @@ function formatVerificationFailure(result: InstalledVersionVerification, expecte
 	if (result.actual) {
 		return `${APP_NAME} at ${result.path} still reports ${result.actual} (expected ${expectedVersion})`;
 	}
-	return `could not verify updated version${result.path ? ` at ${result.path}` : ""}`;
+	const outputSuffix = result.versionOutput ? `: ${result.versionOutput}` : "";
+	return `could not verify updated version${result.path ? ` at ${result.path}` : ""}${outputSuffix}`;
 }
 
 export function formatVerificationFailureForTest(