@gajae-code/coding-agent 0.15.6 → 0.16.1

package/CHANGELOG.md

@@ -2,6 +2,105 @@
 
 ## [Unreleased]
 
+## [0.16.1] - 2026-09-03
+
+- Broker-launched SDK sessions now activate an already-cached default model profile before refreshing provider catalogs in the background, preventing redundant online discovery from consuming the fixed semantic-readiness window while preserving strict refresh fallback when cached profile resolution fails.
+- Native Windows external editors now launch executable commands directly instead of through `cmd.exe`, preventing the shell handoff from swallowing the first editor keystroke; `.cmd` and `.bat` editor commands retain shell execution.
+- Slack Socket Mode now accepts real `event_callback` payloads, routes ordinary active-thread text as new user turns when no ask is pending, keeps idle notifications non-replyable, deduplicates distinct messages without treating shared `event_context` metadata as event identity, and scopes deterministic root message IDs to the configured workspace and channel.
+- Ask now rejects standalone custom-input pseudo-option labels such as `Other (type your own)`, `custom input`, and `직접 입력` while preserving genuine labels that merely contain those words; single-option asks no longer publish a recommended marker, including through workflow-gate/SDK question projection.
+- Session-state lock acquisition now retries immediately after positively proving and identity-reclaiming a dead transition owner, so forced exits no longer add a retry delay to the next resume while unproven or live claims retain the bounded backoff path.
+- Coordinator persist failures now include typed lock-cause fields and use a per-document, per-failure-class 30-second warn window; proven-refused local model discovery is debug-level, and `session_closed` delivery failures route by attached-client count.
+- `gjc update` now identifies the active Linux libc instead of treating an optional installed musl loader as proof that a glibc-based Ubuntu host runs musl.
+- The interactive TUI now warns when a turn ends with `stopReason: "length"` before producing any visible text or tool call — a reasoning model whose thinking alone consumed the budget — instead of returning to the prompt with no explanation, and the completion notification for that turn no longer reports success. Other surfaces (SDK, ACP, print mode, telemetry) already reported this state; no length-specific automatic continuation is added and existing continuation policies are unchanged.
+- Sessions can now be marked with `/star` and `/unstar`; starred sessions persist in append-only metadata, display a `★` in resume and read-only dashboard views, and sort ahead of unstarred sessions without changing deletion or retention behavior.
+- Steering is now admitted only into a live agent run. A steer submitted when no run is live — after a turn ended, during the post-prompt unwind window where the session still reports streaming, while another prompt is in preflight, or while an abort is unwinding — is no longer parked in the Agent steering queue where it was invisible to the queue display and consumed by whichever unrelated later prompt polled it first (appearing turn after turn, or being drained silently by the first Esc). The session now routes such a steer as a sequential follow-up owned by the next turn and auto-continues into it, so `session.steer()`, `prompt(..., { streamingBehavior: "steer" })`, `sendUserMessage(..., { deliverAs: "steer" })`, `sendCustomMessage(..., { deliverAs: "steer" })`, and SDK `turn.steer` all behave identically. A steer-behavior prompt submitted while another prompt is still acquiring session admission is queued against that prompt's turn instead of being rejected with `busy` and lost.
+- The `interruptMode` setting is renamed to `toolInterruptPolicy` with values `abort_tools` (was `immediate`, default) and `finish_tools` (was `wait`); existing config files are migrated once (config schema version 2). The setting only decides whether a steer aborts the tools still running in the current batch and never changes when a steer is consumed — the previous label implied queue semantics it never had. The ACP config option, its SDK control operation (`queue.interrupt_mode.set` → `queue.tool_interrupt_policy.set`, `setQueueMode("tool_interrupt", ...)`), and `AgentSession.setToolInterruptPolicy()` follow the rename. `ToolSession.steer` is removed: the `cron`, `monitor`, and `resolve` tools deliver through `sendCustomMessage` (`deliverAs: "steer"` for the resolve reminder), so no tool pushes onto the Agent queue directly. Composer-submitted steers request sequential delivery (`steerQueuePolicy: "sequential"`) so they still arrive one at a time under `steeringMode: "all"`.
+- Steering a run leaves unconsumed when it ends is now settled in one place. The session consumes the run's `agent_end.disownedSteering` once: a user interrupt (Esc) and a natural end re-route it as sequential follow-ups of the next turn (queue and pending display together), a terminal abort drops everything except client steers admitted after the abort's admission snapshot (which are re-routed the same way and rearmed as a fresh turn), and every other abort cause (teardown, session switch, compaction, handoff, tool abort) drops it and settles its SDK submission with a removal disposition. This replaces the three cause-specific recovery patches (user-interrupt rearm, terminal-abort steering purge, and steering rearm) that each reasoned about the Agent queue separately. `cancelAndSubmit` now keeps the aborted turn's steers as steers of the new turn — restored into the new run once it is accepted — instead of re-labelling them as follow-ups that drained turn after turn; with a selected queue entry the unselected messages still become follow-ups and their pending display now mirrors that.
+- Rerouted steering preserves its queue policy: `toolInterruptPolicy: "finish_tools"` with `steeringMode: "all"` keeps one ordered successor-turn cohort across run disown and abort unwind, while composer submissions explicitly marked sequential still deliver one per turn.
+- A user steer admitted into a live run now folds a running foreground `bash` call (managed non-PTY, ACP client-terminal, and PTY) into a background job once the command has run for a fixed 2 s grace window (`STEER_FOLD_GRACE_MS`), mirroring how a steer ends a subagent await: the call returns the chord-fold background-start result plus `Folded into background job <id> because a user steer arrived; the command keeps running with its original timeout and its result will wake a later turn.`, the same run consumes the steer at the tool boundary, and the job's completion wakes a later turn. Steers inside the grace window let the command finish; `busyPromptMode=queue` or `toolInterruptPolicy=finish_tools` never fold; Esc still aborts. Every fold (steer, chord, auto-background timer, `bash.background`) publishes one replayable `bash_folded` SDK event and exposes `foldReason` in job snapshots.
+- The TUI activity indicator itemizes running background work by kind (`Working… · 2 subagents, 1 background bash, 1 monitor` / `Background: 2 subagents, 1 background bash, 1 monitor…`) instead of a single `N background task(s)` count.
+- Explicit static `vllm` and `sglang` providers no longer acquire the generic custom-provider `/v1/models` auto-discovery lane; their configured catalog remains authoritative unless `discovery` is explicitly enabled.
+- Coordinator projection scans now use identity-bracketed directory authority on macOS instead of failing every scan as unsupported, while root and candidate replacement races remain fail-closed.
+- The `/model` selector no longer stalls the UI thread on open, model selection, provider-tab switch, and every catalog change for credentialed users. Each `refresh("offline")` re-ran the built-in-discovery freshness filter across the whole cached catalog (thousands of models) while recomputing per model values that only vary per provider — `#getProviderEvidenceGeneration` (an AuthStorage lookup) and `#getProviderBaseUrlForDiscovery` + endpoint normalization (URL parsing). That provider-keyed work is now memoized once per provider per refresh, so on the bundled catalog with credentials `refresh("offline")` drops from ~40ms to ~15ms per interaction with identical freshness results. Complements the earlier batch canonical-selection fix.
+- Skill slash commands now autocomplete from subsequent whitespace-delimited tokens, including later prompt lines and case-insensitive `/Skill:` prefixes, while runtime invocation matching uses the same case-insensitive canonical recognition and case-variant skill discovery preserves project-over-user precedence.
+- `/model` preset authentication refreshes now resolve each repeated role selector once per refresh instead of once per profile assignment, avoiding synchronous UI stalls as the preset catalog grows.
+- Interactive startup no longer re-verifies the signed model preset registry once per subsystem. A launch read the accepted registry four times, and each read verified every cached generation in both the primary and backup state copies from several recovery angles, re-running Ed25519 verification, Zod schema parsing, canonical-JSON re-serialization, and the confusable-identity walk over the same documents. On a 2.5MB accepted state (4278 presets, 58 profiles) that cost about 3.0s of the pre-paint startup path. Verification results are now memoized per generation, the already-schema-parsed documents are no longer re-parsed to derive an identical value, and an accepted-registry read is reused for as long as the state, backup, and control files hash unchanged, so any write or tampering by any process is still verified from scratch. Measured startup drops from ~5.5s to ~1.9s.
+### Added
+
+- Added `browser.backend` (`native` | `aside`, default `native`) to select the browser surface offered to the model. Operators who drive a real logged-in browser through the Aside CLI had no way to keep the model off the built-in Puppeteer `browser` tool short of `browser.enabled: false`, which also dropped every hint about the replacement surface, so the model would still reach for headless Chromium or invent a browser MCP. With `aside`, the built-in `browser` tool is neither active nor discoverable (`descriptors.ts` availability gate) and the system prompt gains a `<browser-backend>` block (`prompts/agent-fragments/browser-aside.md`, threaded from the session settings through `buildSystemPrompt`) that requires browser work to run through Bash as direct `aside repl` / `aside exec` invocations with the attach-verify-snapshot discipline. Nothing is spawned, supervised, or registered by GJC: no MCP server, no in-process Aside driver, no fallback to native when the CLI is missing. `native` is byte-for-byte the previous behavior, and `browser.enabled` keeps its meaning for the native backend.
+- Interactive OAuth account selection now handles a stale or missing pinned credential in place, preserving the session and actionable `/login` or AUTO guidance instead of creating an unhandled rejection and crash record.
+- Custom OpenAI-compatible providers in `models.yml` now auto-populate `/model` from their live `/v1/models` catalog without a manual `discovery:` block, and auto-classify each discovered model's wire API family. Any custom provider with a `baseUrl` and an OpenAI-family `api` (either provider-level, or the dominant OpenAI-family `api` among its statically-configured models) gets an implicit optional `openai-models-list` discovery lane, so a subscription-style gateway (e.g. CLIProxyAPI) shows its full model list with zero extra config and degrades to the configured static models when the endpoint has no `/v1/models`. During discovery each model's API type is inferred from the OpenAI `owned_by` owner (`anthropic` → `anthropic-messages`, `openai` → OpenAI) and then the model id (`claude-*` → `anthropic-messages`, `gpt-*`/`o1`/`codex`/… → OpenAI); OpenAI-family models keep the provider's configured OpenAI transport (`openai-responses` vs `openai-completions`) rather than being forced to chat-completions, an explicit `discovery.apiByModelPrefix` still wins, and an inconclusive model falls back to the provider default api.
+- Named-worktree SDK session.create now gives git worktree add/reuse and workspace install independent 30s budgets instead of charging them against the child 10s semantic-readiness clock. Prep timeouts stay typed and terminal (`worktree_preparation_timeout` / `dependency_preparation_timeout`); Coordinator and ACP preserve those codes instead of collapsing them to `unavailable` or `broker_compensation_unobserved`. Ordinary no-worktree sessions stay 10s/21s.
+- SDK session-index scan/replay now explicitly documents and regression-tests the
+	v4 compatibility boundary: supported v4 session-index events and snapshots are
+	accepted at every entry surface (scan, replay, tail, append, repair), future
+	versions stay fail-closed with data-preserving quarantine, and the generic
+	SDK-state guard (`maximum supported version is 1`) is documented as never
+	applying to session-index rows so the #5181 crash class cannot recur.
+
+- GJC plugin TAR/TGZ installs now bound archive input and aggregate gzip expansion before extraction, preventing compressed bundles from exhausting memory while preserving valid concatenated gzip members.
+
+## [0.16.0] - 2026-09-02
+
+- Added master mode (`gjc --master [--scope repo|pwd|global]`) with authenticated, broker-authoritative child orchestration: `gjc sdk spawn` creates task-seeded children, scoped `gjc sdk search` discovers broker-visible sessions with paginated results, and locator v2 session rows carry canonical cwd, worktree-root, and state-root identity.
+- SDK master-mode authority now selects the newest retained master epoch, binds worktree occupancy to canonical worktree roots with positive process-exit proof, keeps master capabilities out of ordinary Bash descendants, bounds authenticated nonce replay state, and preserves scoped search rows across pagination beyond the probe budget.
+- `move_session`, TUI `/move`, and SDK/ACP `session.cwd.move` no longer strand coordinator runtime-state persistence for the rest of the session. All three surfaces now cross one `SessionManager.moveTo` lifecycle: admitted old-cwd sidecar writes drain before commit, later queued writes are generation-fenced, and a durable rescope journal records the exact old/new cwd and session-file identities before publication so restart can finish an interrupted migration. Relocation holds both canonical state paths' process, namespace, and state-file locks in deterministic order across read/authenticate/write/remove; signed predecessors and destinations require the matching key id plus a valid Ed25519 signature, unsigned rows require complete exact cwd/workdir/session-file identity, and coordinator bootstrap or partial rows are never laundered into authoritative state. No-follow descriptor reads and native identity-bound orphan retirement reject symlink/path replacement, a valid self-healed destination is preserved while its authenticated old marker is removed, and rejected/tampered evidence stays intact with the journal retained for recovery. Rollback clears the prepared journal, committed metadata failures still run relocation, and postmortem finalizer rebinding is unconditional even when repair fails, so unexpected exit targets the live cwd/session file. (#4629)
+- `move_session` and `session.cwd.move` now report an unreadable target as `Directory identity or access unavailable` on macOS too. Darwin's `realpath(3)` fails with `EACCES` on a mode-0 directory where Linux resolves it and fails later at the access probe, so the same refusal was previously misreported as `Directory does not exist or is not a directory`.
+- The status rail no longer collapses to a bare `…+N` overflow marker on very small terminals. Context %, the goal indicator and the model name are now the last segments evicted (in that order), and once ordinary telemetry is gone they degrade through shortened and single-glyph forms before being dropped — context % is never dropped, keeps `18.3%/200K` while it fits, falls back to an integer `18%`, and retains its usage-level color. The overflow marker is suppressed at those widths so its cells go to the priority items instead. Rails with no context window and no active goal evict exactly as before.
+- Model names now render in their shortest recognizable id-derived form (`anthropic/claude-sonnet-4-5-20250929` → `sonnet-4.5`) in both the status rail and the footer telemetry line, replacing the raw id in the footer and the previous Anthropic-only `"Claude "` prefix strip in the rail. The rule is a pure heuristic — provider prefix, vendor family word and trailing date/build stamp removed — with no curated override table, and never yields an empty label. Model pickers and selectors keep full ids.
+- The `claude-fable` and `fable-opus-codex` built-in presets now use `anthropic/claude-fable-5-1` instead of `anthropic/claude-fable-5`, with effort suffixes preserved (`claude-fable` default/architect `xhigh`, critic `high`, planner `low`; `fable-opus-codex` default `high`). Fable 5.1 exposes the identical effort ladder, so no role mapping changed shape, and the non-fable roles (`anthropic/claude-sonnet-5` executor, `anthropic/claude-opus-5` planner/critic, the Codex executor/architect) are untouched. The extragoal reviewer template moves to `anthropic/claude-fable-5-1:xhigh` for the same reason. `claude-fable-5` remains in the catalog for pinned selectors and for gateways that do not serve 5.1.
+- Fresh interactive onboarding now asks for an interface language before showing guidance, supports English, Korean, Simplified Chinese, and Japanese, persists the choice through `ui.language`, and uses a documented English fallback for noninteractive, invalid, cancelled, or unwritable startup.
+- Coordinator projection consumers now retry a bounded number of fresh authoritative scans when concurrent session churn races a candidate. Cap exhaustion, owner disappearance, unsupported authority, and parse failures remain fail-closed, while settled concurrent SDK sessions no longer permanently starve the session reaper or coordinator mutations. (#5168)
+
+- Coordinator session-state locks now reclaim an empty, identity-qualified released transition tombstone on POSIX after a short release grace period. Live, foreign, malformed, non-empty, or identity-changed claims remain fail-closed, while persistent macOS/File Provider debris no longer burns the full transition timeout on every state write. (#5159)
+
+- A runtime-state marker recorded against a different workspace path now reports that mismatch instead of claiming the file is unreadable, and a terminal, not-live marker that travelled into the current workspace with its session directory is adopted rather than refused. Live, non-terminal, and out-of-workspace markers are still refused untouched.
+- An unavailable provider-qualified `modelRoles.default` selection now reports the requested model instead of silently starting on another provider's baseline. This keeps signed-registry omissions and failed catalog admission actionable rather than routing requests to an unrelated retired model. (#5144)
+- Headless SDK substrate close now reports success when exact teardown observes the recorded process gone even if cleanup unlinks the durable proof first; live or identity-ambiguous substrates still report `substrate_mismatch`. (#5130)
+
+- Windows session-state locks now drain late terminal reconciliation writes before disposal returns and safely reclaim valid dead transition claims during resume. (#5102)
+
+- Deferred MCP startup now releases queued idle yields as soon as readiness settles without bypassing prompt admission. Barrier extensions remain gated, rejected startup drops the wake without prompting, settled sessions retain the normal idle merge window, and readiness stays session-local. (#5085)
+- ACP deep-interview's real subprocess fixture now retires its owned lifecycle sessions before broker/root cleanup, preventing detached session hosts from recreating the fixture root after teardown. (#5086)
+- The ACP fixture tracks broker startup through its full producer deadline and tracks session creation before awaiting responses, keeps its independent broker fallback client available when runtime shutdown fails, and retires sessions first seen in either broker inventory phase directly through that fallback across cleanup retries. Verified broker-startup rejection no longer strands the root, while an unverified child-reap failure retains cleanup authority. Reconciliation recognizes the real ACP `terminal_uncertain` after-send wire envelope as transport uncertainty while preserving semantic close diagnostics, then accepts terminal races only after strict inventory proves unambiguous and certain retirement. A stalled broker-client transport close no longer blocks authoritative lease/root cleanup, and the child environment confines Windows profile and temporary paths to the fixture root. (#5086)
+- Telemetry install IDs are now staged in private temporary files and published atomically, so concurrent startup readers cannot observe a partial UUID payload; stale temporary files are never adopted and malformed persisted IDs still fail closed. Publication also falls back through native no-replace links and an exclusive claim protocol when rename-no-replace is unavailable, Windows reads and claim mutations use identity-bracketed opens, transient claimed payloads are retried, and every winner is tightened to mode 0600. (#5048)
+
+- An install with no configured model no longer starts on a model its provider has already withdrawn. The startup fallback now applies the configured provider-priority policy, skips bundled defaults disproved by fresh provider discovery, and only then preserves catalog order for remaining candidates. Explicit model and profile selections, enabled-model allowlists, credential selectors, disabled providers, and provider/id collision-safe candidate membership remain unchanged.
+
+### Fixed
+
+- The shipped pirate extension example now appends its instructions through the supported `systemPrompt` result, and unsupported `before_agent_start` result fields emit a bounded diagnostic instead of being silently ignored.
+
+- File locks now use a descriptor-relative exclusive directory-publication fallback
+	when a filesystem returns `EINVAL` for `renameat2(RENAME_NOREPLACE)` (for example
+	WSL2 DrvFs), so `edit` and terminal persistence no longer surface `Failed to publish
+	file lock: invalid_request` on valid paths. The native fallback preserves no-follow
+	path containment, owner identity, no-replace contention, and fail-closed stale-owner
+	checks. (#5164)
+
+- The first Esc on a streaming turn with a queued steering message again consumes that steer and auto-continues instead of aborting the turn and dumping the queue back into the composer. The busy-indicator recovery branch counted the same drainable queue as cancellable work and, because a streaming turn always has that indicator mounted, it short-circuited before the steer-on-interrupt branch could run. Stale busy-indicator recovery, pending-submission cancellation, and the loud second-Esc abort are unchanged.
+
+- Print and JSON turns now fail closed when the provider/agent produces no readable assistant text: JSON emits a bounded `agent_failed` disposition and failures exit nonzero, while tool-only terminal output can no longer masquerade as success. (#5153)
+- Interactive `/login`, `/logout`, and account inventory commands now keep the TUI alive when the credential database reports `SQLITE_CORRUPT` or `SQLITE_NOTADB`. They show a bounded, payload-free recovery message and never auto-repair or delete the database. (#5070)
+- `session.last_assistant` now reads the public transcript projection, skips trailing tool-only, thinking-only, empty, and whitespace-only assistant rows, and returns the most recent readable assistant text or an empty string when none exists. (#5078)
+- Chat-daemon same-generation successor attachments now wait for predecessor provider retirement before admitting frames. Retired attachment frames remain fenced, successor frames resume after retirement, queue waiters settle during takeover and shutdown, and cross-generation replacement remains isolated. (#5120)
+
+- SDK lifecycle readiness now uses the same descriptor-bound endpoint identity tolerance as broker endpoint reads and selects owners by scoped state root, process incarnation, and lifecycle marker instead of bare session ID. This restores default source-host startup, shipped SDK lifecycle topology, shared-agent saved-source isolation, cold resume/fork cleanup, local SDK-only broker recovery, and generated operation-matrix closure after the master-mode merge. (#5114)
+
+- Coordinator event watchers now advertise the exact supported event-kind enum, while outbox entity validation and durable WAL/active-turn cleanup reuse their existing authority helpers instead of leaving those checks disconnected. (#5115)
+- Post-install update verification now preserves a bounded, secret-redacted stderr/stdout cause when the newly installed `gjc --version` exits unsuccessfully, so runtime guards such as Bun version incompatibilities remain actionable instead of collapsing to a generic verification failure. (#5108)
+- Concurrent coordinator mutations sharing one idempotency key now join the same in-process flight before taking the durable key lock, so a slow accepted prompt cannot make its retry time out as unavailable. Conflicting in-flight requests still fail closed, completed responses remain durably replayable, and different keys remain isolated. (#5110)
+- Custom providers declaring `transport: pi-native` in `models.yml` now actually dispatch through the auth-gateway native endpoint. The provider-level transport was silently dropped for models.yml-declared models, so requests went to `<baseUrl>/chat/completions` and the gateway answered 404; and the pi-native client now serializes only wire-safe tool fields, so runtime tool state carrying fs-stat BigInts no longer aborts request serialization with `JSON.stringify cannot serialize BigInt`.
+- ACP prompts now settle immediately on correlated explicit failure outcomes without waiting for a later `agent_end`; generic error-only `agent_failed` events remain additive diagnostics until an authoritative terminal, while late duplicates and unrelated correlations stay isolated. (#5107)
+- Session disposal no longer waits behind an abort-ignoring tool's prompt admission or cwd read lease before reaching its bounded Agent abort. Disposal now fences new prompt and cwd-move admissions without draining unbounded reader work, while preserving cwd moves admitted before teardown and suppressing late run events. (#5100)
+
+- Managed-session file identities now use one canonical unsigned 64-bit representation across stat/native boundaries and replacement cleanup receipts. Native Windows file IDs surfaced as signed negative bigints no longer create double-hyphen receipt names that block persistence or reopen; already-written signed receipt names and interrupted pending receipts are recovered only through the existing identity-bound, fail-closed reconciliation paths. (#5095)
+
+- `gh` PR diffs decode git's C-style quoted paths as UTF-8 bytes instead of Latin-1 code points, so non-ASCII file names (`docs/\355\225\234\352\270\200.md`) no longer surface as mojibake in the file list, and quoted `rename from`/`rename to` lines are unquoted the same way instead of keeping their literal quotes and escapes.
+- Confirmed operator `turn.abort` requests now travel through a dedicated local Broker route instead of trusting caller-supplied `operator:true` and `confirm:true` on ordinary SDK frames. The Broker revalidates the exact live endpoint identity, injects a process-bound private capability, preserves post-send uncertainty, and the host uses one capability-free canonical identity for dispatch idempotency, durable admission, and delivery receipts, so forged, stale, dropped, and replayed requests fail closed consistently across restart boundaries.
+
+- Blob references and filesystem-backed blob reads now accept only exact lowercase SHA-256 names before resolving a disk path; canonical references and valid missing-blob behavior are unchanged.
+
 ## [0.15.6] - 2026-08-30
 
 - Auth metadata remains session-only when a compatibility registry has auth storage but no owner accessor, preventing an unscoped OAuth account lookup from attributing a registry-scoped API-key request to the wrong account.

package/dist/types/async/job-manager.d.ts

@@ -43,9 +43,23 @@ export interface AsyncJob {
  * incrementing a completed job's timer.
  */
 export declare function jobElapsedMs(job: Pick<AsyncJob, "startTime" | "endTime">, now?: number): number;
+/**
+ * Why a foreground wait left the foreground. Every fold path names its
+ * trigger so job snapshots and SDK clients can tell a user steer from the
+ * chord, the auto-background timer, or the explicit `bash.background` control.
+ */
+export type FoldReason = "steer" | "chord" | "timer" | "sdk_control";
+/** A fold observed by the manager; published to SDK clients as `bash_folded`. */
+export interface JobFoldEvent {
+    jobId: string;
+    generation: string;
+    reason: FoldReason;
+}
 export interface AsyncJobMetadata {
     /** Set once a foreground wait has been folded, so surfacing can show folded work. */
     backgrounded?: boolean;
+    /** Why a foreground wait was folded; absent for jobs started directly in the background (`async: true`). */
+    foldReason?: FoldReason;
     subagent?: {
         id: string;
         agent: string;
@@ -197,6 +211,8 @@ export interface AsyncJobSnapshotEntry {
     status: AsyncJob["status"];
     generation: string;
     backgrounded: boolean;
+    /** Present when `backgrounded` was set by a fold; absent for direct background starts. */
+    foldReason?: FoldReason;
     deliveryState: JobDeliveryState;
 }
 /** Scalar delivery-failure evidence that may outlive its AsyncJob record. */
@@ -546,11 +562,25 @@ export declare class AsyncJobManager {
         timeoutMs?: number;
     }): Promise<boolean>;
     getLastDisposeDiagnostics(): AsyncJobDisposeDiagnostics;
+    /**
+     * Subscribe to fold events. Fires once per successful `markBackgrounded`
+     * transition (never on the idempotent repeat), so a subscriber can publish
+     * exactly one `bash_folded` frame per fold. Listener errors are isolated.
+     */
+    onFold(cb: (event: JobFoldEvent) => void): () => void;
+    /**
+     * Mark a job that was launched directly in the background (`bash` with
+     * `async: true`). It never had a foreground wait, so this is not a fold: no
+     * `foldReason` is recorded and no fold listener fires.
+     */
+    markStartedInBackground(jobId: string, generation: string): boolean;
     /**
      * Mark a running job as backgrounded (folded out of its foreground call).
      * Read by getJobsSnapshot so folded work stays visible; safe to call twice.
+     * The first transition records `reason` and notifies fold listeners; a
+     * repeat keeps the original reason and emits nothing.
      */
-    markBackgrounded(jobId: string, generation: string): boolean;
+    markBackgrounded(jobId: string, generation: string, reason: FoldReason): boolean;
     waitForAll(): Promise<void>;
     drainDeliveries(options?: {
         timeoutMs?: number;
@@ -559,5 +589,6 @@ export declare class AsyncJobManager {
     dispose(options?: {
         timeoutMs?: number;
     }): Promise<boolean>;
+    awaitRetainedDisposalCompletion(): Promise<void>;
     isDeliverySuppressed(jobId: string, generation?: string): boolean;
 }

package/dist/types/browser-backend.d.ts

@@ -0,0 +1,12 @@
+export type BrowserBackendId = "native" | "aside";
+export interface BrowserBackend {
+    readonly id: BrowserBackendId;
+    readonly exposesBuiltinTool: boolean;
+    readonly developerInstructions?: string;
+}
+interface BrowserBackendSettingsSource {
+    get(key: string): unknown;
+}
+/** Resolve the configured browser backend. Aside is strictly opt-in. */
+export declare function resolveBrowserBackend(settings: BrowserBackendSettingsSource): BrowserBackend;
+export {};

package/dist/types/cli/args.d.ts

@@ -50,6 +50,8 @@ export interface Args {
     noRules?: boolean;
     listModels?: string | true;
     noTitle?: boolean;
+    master?: true;
+    masterScope?: "repo" | "pwd" | "global";
     messages: string[];
     fileArgs: string[];
     /** Flags unknown to every launch parser; their consumer supplies the diagnostic. */

package/dist/types/cli/root-flags.d.ts

@@ -119,6 +119,13 @@ export declare const ROOT_LAUNCH_FLAGS: {
     "no-title": FlagDescriptor<"boolean"> & {
         description: string;
     };
+    master: FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    scope: FlagDescriptor<"string"> & {
+        description: string;
+        options: string[];
+    };
 };
 export type ConsumerLaunchFlagName = "hook" | "extension" | "no-extensions" | "no-skills" | "skills";
 export type LaunchFlagConsumer = "acp" | "local";
@@ -247,6 +254,13 @@ export declare const LAUNCH_PARSE_FLAGS: {
     "no-title": FlagDescriptor<"boolean"> & {
         description: string;
     };
+    master: FlagDescriptor<"boolean"> & {
+        description: string;
+    };
+    scope: FlagDescriptor<"string"> & {
+        description: string;
+        options: string[];
+    };
     extension: FlagDescriptor<"boolean" | "integer" | "string">;
     hook: FlagDescriptor<"boolean" | "integer" | "string">;
     "no-extensions": FlagDescriptor<"boolean" | "integer" | "string">;

package/dist/types/cli/update-cli.d.ts

@@ -21,6 +21,7 @@ export interface InstalledVersionVerification {
     ok: boolean;
     actual?: string;
     path?: string;
+    versionOutput?: string;
     smokeTestFailed?: boolean;
     smokeTestOutput?: string;
     cleanupWarning?: string;
@@ -87,6 +88,18 @@ export declare function resolveGjcPathForTest(options: {
     whichPath: string | undefined;
 }): string | undefined;
 export declare function parseReportedVersionForTest(output: string): string | undefined;
+export declare function sanitizeVerificationOutputForTest(stderr: string | undefined, stdout: string | undefined): string | undefined;
+interface InstalledVersionCommandResult {
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+}
+type InstalledVersionCommandRunner = (runtimePath: string) => Promise<InstalledVersionCommandResult>;
+export declare function verifyInstalledVersionForTest(options: {
+    expectedVersion: string;
+    runtimePath: string | undefined;
+    runVersion: InstalledVersionCommandRunner;
+}): Promise<InstalledVersionVerification>;
 interface MigrationTargetVerificationOptions {
     runtimePath: string;
     verifyChecksum: () => Promise<void>;
@@ -137,6 +150,7 @@ export interface BinaryUpdateFlow {
  * possibly-truncated binary.
  */
 export declare function runBinaryUpdateFlow(targetPath: string, url: string, expectedVersion: string, flow: BinaryUpdateFlow): Promise<InstalledVersionVerification>;
+export declare function assertSupportedLinuxLibcForTest(glibcVersionRuntime: string | undefined, muslLoaderPresent: boolean): void;
 /**
  * Run the update command.
  */

package/dist/types/cli.d.ts

@@ -142,6 +142,13 @@ export declare class RootHelpCommand extends Command {
         "no-title": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };
+        master: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        scope: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+            options: string[];
+        };
     };
     static examples: string[];
     static strict: boolean;

package/dist/types/commands/launch.d.ts

@@ -2,7 +2,10 @@
  * Root command for the coding agent CLI.
  */
 import { Command } from "@gajae-code/utils/cli";
+import { type LaunchWorktreeReservation } from "../gjc-runtime/launch-worktree-reservation";
 export declare function persistCoordinatorLaunchFailure(error: unknown, cwd: string, env?: NodeJS.ProcessEnv): Promise<void>;
+/** Test seam for the path-keyed atomic reservation. */
+export declare function reserveLaunchWorktreeForTest(agentDir: string, worktreePath: string): Promise<LaunchWorktreeReservation>;
 export default class Index extends Command {
     static description: string;
     static hidden: boolean;
@@ -132,6 +135,13 @@ export default class Index extends Command {
         "no-title": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };
+        master: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        scope: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+            options: string[];
+        };
     };
     static examples: string[];
     static strict: boolean;

package/dist/types/commands/sdk.d.ts

@@ -1,5 +1,6 @@
 import { Command } from "@gajae-code/utils/cli";
 import type { Args as ParsedArgs } from "../cli/args";
+import { applyStartupModelProfiles } from "../main";
 import { type SessionLifecycleLaunchRequest } from "../sdk/broker/lifecycle";
 import { SessionManager } from "../session/session-manager";
 export declare function lifecycleArgs(request: SessionLifecycleLaunchRequest, cwd: string, agentDir: string): Promise<ParsedArgs>;
@@ -109,6 +110,7 @@ export declare function runSessionHost(timing?: {
     sleep?: (ms: number) => Promise<void>;
     cwd?: string;
     processIncarnation?: (pid: number) => string | undefined;
+    applyStartupModelProfiles?: typeof applyStartupModelProfiles;
 }): Promise<void>;
 export type SdkInternalArgv = {
     action: "broker-internal";

package/dist/types/config/autorouting-tier-map.d.ts

@@ -784,12 +784,33 @@ export declare const TIER_MAP_SKIP_LIST: {
     readonly "openai-codex/gpt-daybreak-blue-latest": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };
+    readonly "opencode-go/deepseek-v4-flash-vision-exp": {
+        readonly rationale: "post-rebase catalog addition from dev; not yet curated";
+    };
+    readonly "opencode-go/glm-5.3-flash": {
+        readonly rationale: "post-rebase catalog addition from dev; not yet curated";
+    };
     readonly "opencode-go/gpt-5.6-luna": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };
+    readonly "opencode-go/grok-4.6": {
+        readonly rationale: "post-rebase catalog addition from dev; not yet curated";
+    };
     readonly "opencode-go/hy3": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };
+    readonly "opencode-go/hy4-preview": {
+        readonly rationale: "post-rebase catalog addition from dev; not yet curated";
+    };
+    readonly "opencode-go/longcat-2.0": {
+        readonly rationale: "post-rebase catalog addition from dev; not yet curated";
+    };
+    readonly "opencode-go/muse-spark-1.2-contributor": {
+        readonly rationale: "post-rebase catalog addition from dev; not yet curated";
+    };
+    readonly "opencode-go/qwen3.8-flash": {
+        readonly rationale: "post-rebase catalog addition from dev; not yet curated";
+    };
     readonly "opencode-go/qwen3.8-max": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };
@@ -1686,6 +1707,9 @@ export declare const TIER_MAP_SKIP_LIST: {
         readonly baseline: true;
         readonly rationale: "pre-feature baseline; not yet curated";
     };
+    readonly "anthropic/claude-fable-5-1": {
+        readonly rationale: "post-feature catalog addition; not yet curated";
+    };
     readonly "anthropic/claude-haiku-4-5-20251001": {
         readonly baseline: true;
         readonly rationale: "pre-feature baseline; not yet curated";

package/dist/types/config/billing-path.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Billing path for a resolved binding's credential source — audit-reversible.
+ * Derived from (model.api, credential-provenance) where the binding actually
+ * resolves credentials, not from a provider-name allowlist.
+ */
+import type { Api } from "@gajae-code/ai/core";
+import type { EffectiveProviderAuth } from "./provider-selection-policy";
+/**
+ * Label shown in the selector row + active-model line. Only the category is
+ * disclosed (never the key material or project id).
+ */
+export type BillingPathKind = "metered-api" | "cloud-project" | "bundled";
+export interface BillingPath {
+    kind: BillingPathKind;
+    /** Stable per-credential-source key for one-time notice dismissal. */
+    dismissKey: string;
+    label: string;
+}
+/**
+ * Derive from the concrete binding (api + credential provenance).
+ * - oauth/keyless/unknown => bundled (plan/proxied/kNoAuth-like)
+ * - key + cloud-project api (google-vertex / bedrock) => cloud-project
+ * - key + any other api (including custom OpenAI-compatible) => metered-api
+ */
+export declare function deriveBillingPath(provider: string, api: Api | string | undefined, effectiveAuth: EffectiveProviderAuth): BillingPath | undefined;

package/dist/types/config/config-schema-version.d.ts

@@ -7,4 +7,16 @@
  * this dependency-light module so the resolver can import it without pulling in
  * the TUI/AI-heavy settings schema.
  */
-export declare const CONFIG_SCHEMA_VERSION = 1;
+export declare const CONFIG_SCHEMA_VERSION = 2;
+/**
+ * Normalize a durable `configSchemaVersion` marker into a comparable version.
+ *
+ * Every version decision (future-schema detection, migration-pending state, and
+ * the ordered migration registry) must read the SAME normalized value: a
+ * malformed marker read as a future schema by one guard and as unmigrated by
+ * the next would skip legacy migrations while still re-running v0 transforms.
+ * A finite malformed value floors to the nearest completed version; a
+ * non-finite or non-numeric one carries no version information and normalizes
+ * to 0 (fully unmigrated). `undefined` stays `undefined` (no marker written).
+ */
+export declare function normalizeConfigSchemaVersion(value: unknown): number | undefined;

package/dist/types/config/file-lock.d.ts

@@ -1,4 +1,5 @@
 import type { NativeDirectoryTreeResult, NativeExactUnlinkResult } from "@gajae-code/natives";
+import { renameDirectoryNoReplacePathAsync, renameNoReplacePathAsync } from "@gajae-code/natives";
 export interface FileLockOptions {
     staleMs?: number;
     retries?: number;
@@ -15,6 +16,10 @@ export declare const FILE_LOCK_RELEASE_RETRY_ATTEMPTS = 5;
 export declare const FILE_LOCK_RELEASE_RETRY_DELAY_MS = 10;
 export declare const FileLockTestHooks: {
     afterParentMkdir?: (lockPath: string) => void | Promise<void>;
+    nativePublicationBindings?: () => {
+        renameNoReplacePathAsync: typeof renameNoReplacePathAsync;
+        renameDirectoryNoReplacePathAsync: typeof renameDirectoryNoReplacePathAsync;
+    };
     nativeQuarantineBindings?: () => NativeFileLockBindings;
 };
 /**

package/dist/types/config/model-registry.d.ts

@@ -4,6 +4,7 @@ import { type ThemeColor } from "../modes/theme/theme";
 import { type ActiveProviderDescriptor } from "../sdk/providers";
 import type { AuthStorage } from "../session/auth-storage";
 import type { ActiveSearchModelContext, WebSearchMode } from "../web/search/types";
+import { type BillingPath } from "./billing-path";
 import { ConfigError, ConfigFile } from "./config-file";
 import { isAuthenticated, kNoAuth } from "./model-auth";
 import { type ConfiguredModelBindings } from "./model-bindings-applier";
@@ -15,9 +16,16 @@ import { type ModelProfileDefinition } from "./model-profiles";
 import { GJC_MODEL_ASSIGNMENT_TARGET_IDS, type ModelProfileConfig } from "./models-config-schema";
 import { type EffectiveProviderAuth } from "./provider-selection-policy";
 import { type Settings } from "./settings";
+export type { BillingPath, BillingPathKind } from "./billing-path";
 export type { EffectiveProviderAuth, ProviderSelectionPolicy } from "./provider-selection-policy";
 export type { CanonicalModelIndex, CanonicalModelRecord, CanonicalModelVariant, ModelEquivalenceConfig };
 export { isAuthenticated, kNoAuth };
+/**
+ * A loopback discovery endpoint that is proven to have no listener is the normal state of
+ * a machine without a local model server. Structured transport evidence is required when
+ * available; DNS, routing, proxy, TLS, and HTTP failures remain warnings.
+ */
+export declare function isQuietLocalDiscoveryFailure(baseUrl: string, _warning: string, evidence?: unknown): boolean;
 export type ModelRole = "default";
 export interface ModelRoleInfo {
     tag?: string;
@@ -409,6 +417,12 @@ export declare class ModelRegistry {
      * with case-sensitive exact strings.
      */
     autoroutingProviderOrder(): readonly string[];
+    /**
+     * Provider priority for automatic model selection. Explicit provider order
+     * wins first, followed by omitted OAuth providers, then other providers;
+     * catalog order breaks ties within each policy band.
+     */
+    automaticProviderOrder(sessionId?: string): readonly string[];
     getCanonicalModels(options?: CanonicalModelQueryOptions): CanonicalModelRecord[];
     /**
      * Batch form of {@link resolveCanonicalModel} over every canonical record:
@@ -460,6 +474,14 @@ export declare class ModelRegistry {
      * unknown/keyless providers fall back to non-OAuth.
      */
     getEffectiveProviderAuth(provider: string, sessionId?: string): EffectiveProviderAuth;
+    /**
+     * Billing path for a resolved binding — derived at the point the binding
+     * resolves credentials (model.api + credential provenance). Not a
+     * provider-name allowlist: a custom OpenAI-compatible provider bound
+     * to a metered gateway is "metered-api" exactly like a first-party
+     * key. Only the billing category is ever disclosed.
+     */
+    getBillingPath(model: Model<Api>, sessionId?: string): BillingPath | undefined;
     /**
      * Forget a session's remembered canonical variant so the next resolution
      * for that session re-ranks from scratch (explicit reselection

package/dist/types/config/settings-schema.d.ts

@@ -219,6 +219,12 @@ export declare const SETTINGS_SCHEMA: {
         readonly description: "Hard maximum runtime for an SDK prompt from acceptance, bounding progress-aware renewals.";
         readonly validate: (value: number) => boolean;
     };
+    readonly "sdk.masterOrphanGraceMs": {
+        readonly type: "number";
+        readonly default: 120000;
+        readonly description: "Grace period before a master-spawned child orphaned by confirmed master loss is closed.";
+        readonly validate: (value: number) => boolean;
+    };
     readonly "notifications.enabled": {
         readonly type: "boolean";
         readonly default: false;
@@ -604,7 +610,7 @@ export declare const SETTINGS_SCHEMA: {
     };
     readonly "ui.language": {
         readonly type: "enum";
-        readonly values: readonly ["en", "ko", "ja"];
+        readonly values: readonly ["en", "ko", "zh", "ja"];
         readonly default: "en";
         readonly ui: {
             readonly tab: "appearance";
@@ -616,6 +622,9 @@ export declare const SETTINGS_SCHEMA: {
             }, {
                 readonly value: "ko";
                 readonly label: "Korean (한국어)";
+            }, {
+                readonly value: "zh";
+                readonly label: "Chinese (简体中文)";
             }, {
                 readonly value: "ja";
                 readonly label: "Japanese (日本語)";
@@ -1729,14 +1738,14 @@ export declare const SETTINGS_SCHEMA: {
             readonly description: "How to drain follow-up messages after a turn completes";
         };
     };
-    readonly interruptMode: {
+    readonly toolInterruptPolicy: {
         readonly type: "enum";
-        readonly values: readonly ["immediate", "wait"];
-        readonly default: "immediate";
+        readonly values: readonly ["abort_tools", "finish_tools"];
+        readonly default: "abort_tools";
         readonly ui: {
             readonly tab: "interaction";
-            readonly label: "Interrupt Mode";
-            readonly description: "When steering messages interrupt tool execution";
+            readonly label: "Tool Interrupt Policy";
+            readonly description: "Whether a steering message aborts the tools still running in the current batch (abort_tools) or lets them finish first (finish_tools). Never changes when a steer is consumed: it is always picked up at the next tool/turn boundary either way.";
         };
     };
     readonly busyPromptMode: {
@@ -3433,6 +3442,16 @@ export declare const SETTINGS_SCHEMA: {
             readonly description: "Enable the browser tool (Ulixee Hero)";
         };
     };
+    readonly "browser.backend": {
+        readonly type: "enum";
+        readonly values: readonly ["native", "aside"];
+        readonly default: "native";
+        readonly ui: {
+            readonly tab: "tools";
+            readonly label: "Browser Backend";
+            readonly description: "Browser surface offered to the model. 'native' exposes the built-in Puppeteer browser tool. 'aside' hides it and requires every browser task to run through the Aside CLI in your live logged-in browser (requires the Aside CLI).";
+        };
+    };
     readonly "browser.headless": {
         readonly type: "boolean";
         readonly default: true;
@@ -3458,7 +3477,7 @@ export declare const SETTINGS_SCHEMA: {
         readonly ui: {
             readonly tab: "tools";
             readonly label: "Profile reuse posture";
-            readonly description: "'auto' (default): when a usable real Chrome profile is available, the browser tool uses an isolated copy of it (cookies/session/cache) for stronger stealth, warns, and falls back to synthetic. 'opt-in': stay synthetic unless a real profile is explicitly requested.";
+            readonly description: "'auto' (default): when a usable real Chrome profile is available, the browser tool uses an isolated copy of it (cookies/session/cache) for stronger stealth, warns, and falls back to synthetic. 'opt-in': stay synthetic unless a real profile is explicitly requested. On macOS, cookie decryption is brand-specific (Chrome Safe Storage vs Chromium Safe Storage Keychain); a Chrome profile copied into bundled Chromium decrypts to garbage, so auto reuses the profile only when the headless executable can decrypt it — detected system Chrome/Chromium or PUPPETEER_EXECUTABLE_PATH — otherwise it falls back to synthetic with a warning.";
         };
     };
     readonly "browser.geo.timezone": {
@@ -4538,7 +4557,7 @@ export declare function getPathsForTab(tab: SettingTab): SettingPath[];
 export declare function getType(path: SettingPath): SettingDef["type"];
 /** Get enum values for an enum setting */
 export declare function getEnumValues(path: SettingPath): readonly string[] | undefined;
-export { CONFIG_SCHEMA_VERSION } from "./config-schema-version";
+export { CONFIG_SCHEMA_VERSION, normalizeConfigSchemaVersion } from "./config-schema-version";
 export type SettingsSchemaIssue = {
     path: string;
     kind: "unknown" | "invalid" | "coerced" | "pending-migration";

package/dist/types/config/settings.d.ts

@@ -145,6 +145,8 @@ export declare class Settings implements NotificationSettingsReader {
     onChanged(listener: (path: SettingPath) => void): () => void;
     /** Whether durable settings mutations are permitted for the loaded configuration. */
     canWriteDurableConfig(): boolean;
+    /** Whether this instance can publish a mutation to a durable config file. */
+    canPersistDurableConfig(): boolean;
     /**
      * Set a setting value (sync).
      * Updates global settings and reserves its background persistence slot before

package/dist/types/coordinator-mcp/projection-scan.d.ts

@@ -4,6 +4,8 @@ export declare const ProjectionScanTestHooks: {
 };
 /** Post-filter parse-candidate cap. Exhaustion returns an explicit incomplete result. */
 export declare const COORDINATOR_JSON_SCAN_CAP = 10000;
+/** Number of fresh authoritative attempts allowed for a scan that observed churn. */
+export declare const COORDINATOR_JSON_SCAN_RETRY_ATTEMPTS = 3;
 export interface ProjectionScanStat {
     size: number | bigint;
     dev?: number | bigint;
@@ -44,3 +46,9 @@ export interface ProjectionScanResult {
 }
 export declare function isCoordinatorScanDebrisName(name: string): boolean;
 export declare function listCoordinatorJsonFiles(dir: string, io?: ProjectionScanFs, cap?: number): Promise<ProjectionScanResult>;
+/**
+ * Retry only scans invalidated by observed directory/file churn. A candidate cap,
+ * unsupported authority, parse error, or any other failure remains fail-closed.
+ * Each attempt acquires a new authority, so no partial result crosses attempts.
+ */
+export declare function listCoordinatorJsonFilesWithRetry(dir: string, io?: ProjectionScanFs, cap?: number, maxAttempts?: number): Promise<ProjectionScanResult>;