@gajae-code/coding-agent 0.16.0 → 0.16.3

package/CHANGELOG.md

@@ -2,6 +2,55 @@
 
 ## [Unreleased]
 
+## [0.16.3] - 2026-09-04
+
+## [0.16.2] - 2026-09-04
+
+- Primary model binding now rejects GPT-5.6 Sol when the selected openai-codex OAuth account is known to be below the Pro tier, preventing a raw entitlement failure on the first turn and preserving the prior model on a failed selection.
+
+- Fixed the steer-triggered bash fold being skipped under `toolInterruptPolicy: finish_tools`: a composer steer over a long foreground `bash` was aborted instead of folded because the fold gate wrongly treated the policy as an exclusion. `finish_tools` governs sibling tools in the batch, not the fold; the fold kills nothing and now applies under both policies. A tmux dogfood driver (`scripts/dogfood/steer-fold-tmux.sh`) proves the real binary folds, answers the steer in the same turn, and wakes on completion.
+- SDK session tails now preserve authoritative transcript revisions in item identity and lifecycle ordering, close the pre-checkpoint live/replay dedupe race, and recover held live frames across reconnect replay without losing ordered delivery.
+- Native Windows external editors now reassert runtime raw input for ConPTY-backed terminals after returning from the editor, preventing cooked-mode handoff from swallowing the first keystroke.
+- ACP reconnect cancellation now reports `cancelled` only after the SDK acknowledges the abort; pre-ack owner loss remains `connection_closed`, while failed aborts preserve non-cancelled prompt outcomes and leave the session reusable.
+
+## [0.16.1] - 2026-09-03
+
+- Broker-launched SDK sessions now activate an already-cached default model profile before refreshing provider catalogs in the background, preventing redundant online discovery from consuming the fixed semantic-readiness window while preserving strict refresh fallback when cached profile resolution fails.
+- Native Windows external editors now launch executable commands directly instead of through `cmd.exe`, preventing the shell handoff from swallowing the first editor keystroke; `.cmd` and `.bat` editor commands retain shell execution.
+- Slack Socket Mode now accepts real `event_callback` payloads, routes ordinary active-thread text as new user turns when no ask is pending, keeps idle notifications non-replyable, deduplicates distinct messages without treating shared `event_context` metadata as event identity, and scopes deterministic root message IDs to the configured workspace and channel.
+- Ask now rejects standalone custom-input pseudo-option labels such as `Other (type your own)`, `custom input`, and `직접 입력` while preserving genuine labels that merely contain those words; single-option asks no longer publish a recommended marker, including through workflow-gate/SDK question projection.
+- Session-state lock acquisition now retries immediately after positively proving and identity-reclaiming a dead transition owner, so forced exits no longer add a retry delay to the next resume while unproven or live claims retain the bounded backoff path.
+- Coordinator persist failures now include typed lock-cause fields and use a per-document, per-failure-class 30-second warn window; proven-refused local model discovery is debug-level, and `session_closed` delivery failures route by attached-client count.
+- `gjc update` now identifies the active Linux libc instead of treating an optional installed musl loader as proof that a glibc-based Ubuntu host runs musl.
+- The interactive TUI now warns when a turn ends with `stopReason: "length"` before producing any visible text or tool call — a reasoning model whose thinking alone consumed the budget — instead of returning to the prompt with no explanation, and the completion notification for that turn no longer reports success. Other surfaces (SDK, ACP, print mode, telemetry) already reported this state; no length-specific automatic continuation is added and existing continuation policies are unchanged.
+- Sessions can now be marked with `/star` and `/unstar`; starred sessions persist in append-only metadata, display a `★` in resume and read-only dashboard views, and sort ahead of unstarred sessions without changing deletion or retention behavior.
+- Steering is now admitted only into a live agent run. A steer submitted when no run is live — after a turn ended, during the post-prompt unwind window where the session still reports streaming, while another prompt is in preflight, or while an abort is unwinding — is no longer parked in the Agent steering queue where it was invisible to the queue display and consumed by whichever unrelated later prompt polled it first (appearing turn after turn, or being drained silently by the first Esc). The session now routes such a steer as a sequential follow-up owned by the next turn and auto-continues into it, so `session.steer()`, `prompt(..., { streamingBehavior: "steer" })`, `sendUserMessage(..., { deliverAs: "steer" })`, `sendCustomMessage(..., { deliverAs: "steer" })`, and SDK `turn.steer` all behave identically. A steer-behavior prompt submitted while another prompt is still acquiring session admission is queued against that prompt's turn instead of being rejected with `busy` and lost.
+- The `interruptMode` setting is renamed to `toolInterruptPolicy` with values `abort_tools` (was `immediate`, default) and `finish_tools` (was `wait`); existing config files are migrated once (config schema version 2). The setting only decides whether a steer aborts the tools still running in the current batch and never changes when a steer is consumed — the previous label implied queue semantics it never had. The ACP config option, its SDK control operation (`queue.interrupt_mode.set` → `queue.tool_interrupt_policy.set`, `setQueueMode("tool_interrupt", ...)`), and `AgentSession.setToolInterruptPolicy()` follow the rename. `ToolSession.steer` is removed: the `cron`, `monitor`, and `resolve` tools deliver through `sendCustomMessage` (`deliverAs: "steer"` for the resolve reminder), so no tool pushes onto the Agent queue directly. Composer-submitted steers request sequential delivery (`steerQueuePolicy: "sequential"`) so they still arrive one at a time under `steeringMode: "all"`.
+- Steering a run leaves unconsumed when it ends is now settled in one place. The session consumes the run's `agent_end.disownedSteering` once: a user interrupt (Esc) and a natural end re-route it as sequential follow-ups of the next turn (queue and pending display together), a terminal abort drops everything except client steers admitted after the abort's admission snapshot (which are re-routed the same way and rearmed as a fresh turn), and every other abort cause (teardown, session switch, compaction, handoff, tool abort) drops it and settles its SDK submission with a removal disposition. This replaces the three cause-specific recovery patches (user-interrupt rearm, terminal-abort steering purge, and steering rearm) that each reasoned about the Agent queue separately. `cancelAndSubmit` now keeps the aborted turn's steers as steers of the new turn — restored into the new run once it is accepted — instead of re-labelling them as follow-ups that drained turn after turn; with a selected queue entry the unselected messages still become follow-ups and their pending display now mirrors that.
+- Rerouted steering preserves its queue policy: `toolInterruptPolicy: "finish_tools"` with `steeringMode: "all"` keeps one ordered successor-turn cohort across run disown and abort unwind, while composer submissions explicitly marked sequential still deliver one per turn.
+- A user steer admitted into a live run now folds a running foreground `bash` call (managed non-PTY, ACP client-terminal, and PTY) into a background job once the command has run for a fixed 2 s grace window (`STEER_FOLD_GRACE_MS`), mirroring how a steer ends a subagent await: the call returns the chord-fold background-start result plus `Folded into background job <id> because a user steer arrived; the command keeps running with its original timeout and its result will wake a later turn.`, the same run consumes the steer at the tool boundary, and the job's completion wakes a later turn. Steers inside the grace window let the command finish; `busyPromptMode=queue` or `toolInterruptPolicy=finish_tools` never fold; Esc still aborts. Every fold (steer, chord, auto-background timer, `bash.background`) publishes one replayable `bash_folded` SDK event and exposes `foldReason` in job snapshots.
+- The TUI activity indicator itemizes running background work by kind (`Working… · 2 subagents, 1 background bash, 1 monitor` / `Background: 2 subagents, 1 background bash, 1 monitor…`) instead of a single `N background task(s)` count.
+- Explicit static `vllm` and `sglang` providers no longer acquire the generic custom-provider `/v1/models` auto-discovery lane; their configured catalog remains authoritative unless `discovery` is explicitly enabled.
+- Coordinator projection scans now use identity-bracketed directory authority on macOS instead of failing every scan as unsupported, while root and candidate replacement races remain fail-closed.
+- The `/model` selector no longer stalls the UI thread on open, model selection, provider-tab switch, and every catalog change for credentialed users. Each `refresh("offline")` re-ran the built-in-discovery freshness filter across the whole cached catalog (thousands of models) while recomputing per model values that only vary per provider — `#getProviderEvidenceGeneration` (an AuthStorage lookup) and `#getProviderBaseUrlForDiscovery` + endpoint normalization (URL parsing). That provider-keyed work is now memoized once per provider per refresh, so on the bundled catalog with credentials `refresh("offline")` drops from ~40ms to ~15ms per interaction with identical freshness results. Complements the earlier batch canonical-selection fix.
+- Skill slash commands now autocomplete from subsequent whitespace-delimited tokens, including later prompt lines and case-insensitive `/Skill:` prefixes, while runtime invocation matching uses the same case-insensitive canonical recognition and case-variant skill discovery preserves project-over-user precedence.
+- `/model` preset authentication refreshes now resolve each repeated role selector once per refresh instead of once per profile assignment, avoiding synchronous UI stalls as the preset catalog grows.
+- Interactive startup no longer re-verifies the signed model preset registry once per subsystem. A launch read the accepted registry four times, and each read verified every cached generation in both the primary and backup state copies from several recovery angles, re-running Ed25519 verification, Zod schema parsing, canonical-JSON re-serialization, and the confusable-identity walk over the same documents. On a 2.5MB accepted state (4278 presets, 58 profiles) that cost about 3.0s of the pre-paint startup path. Verification results are now memoized per generation, the already-schema-parsed documents are no longer re-parsed to derive an identical value, and an accepted-registry read is reused for as long as the state, backup, and control files hash unchanged, so any write or tampering by any process is still verified from scratch. Measured startup drops from ~5.5s to ~1.9s.
+### Added
+
+- Added `browser.backend` (`native` | `aside`, default `native`) to select the browser surface offered to the model. Operators who drive a real logged-in browser through the Aside CLI had no way to keep the model off the built-in Puppeteer `browser` tool short of `browser.enabled: false`, which also dropped every hint about the replacement surface, so the model would still reach for headless Chromium or invent a browser MCP. With `aside`, the built-in `browser` tool is neither active nor discoverable (`descriptors.ts` availability gate) and the system prompt gains a `<browser-backend>` block (`prompts/agent-fragments/browser-aside.md`, threaded from the session settings through `buildSystemPrompt`) that requires browser work to run through Bash as direct `aside repl` / `aside exec` invocations with the attach-verify-snapshot discipline. Nothing is spawned, supervised, or registered by GJC: no MCP server, no in-process Aside driver, no fallback to native when the CLI is missing. `native` is byte-for-byte the previous behavior, and `browser.enabled` keeps its meaning for the native backend.
+- Interactive OAuth account selection now handles a stale or missing pinned credential in place, preserving the session and actionable `/login` or AUTO guidance instead of creating an unhandled rejection and crash record.
+- Custom OpenAI-compatible providers in `models.yml` now auto-populate `/model` from their live `/v1/models` catalog without a manual `discovery:` block, and auto-classify each discovered model's wire API family. Any custom provider with a `baseUrl` and an OpenAI-family `api` (either provider-level, or the dominant OpenAI-family `api` among its statically-configured models) gets an implicit optional `openai-models-list` discovery lane, so a subscription-style gateway (e.g. CLIProxyAPI) shows its full model list with zero extra config and degrades to the configured static models when the endpoint has no `/v1/models`. During discovery each model's API type is inferred from the OpenAI `owned_by` owner (`anthropic` → `anthropic-messages`, `openai` → OpenAI) and then the model id (`claude-*` → `anthropic-messages`, `gpt-*`/`o1`/`codex`/… → OpenAI); OpenAI-family models keep the provider's configured OpenAI transport (`openai-responses` vs `openai-completions`) rather than being forced to chat-completions, an explicit `discovery.apiByModelPrefix` still wins, and an inconclusive model falls back to the provider default api.
+- Named-worktree SDK session.create now gives git worktree add/reuse and workspace install independent 30s budgets instead of charging them against the child 10s semantic-readiness clock. Prep timeouts stay typed and terminal (`worktree_preparation_timeout` / `dependency_preparation_timeout`); Coordinator and ACP preserve those codes instead of collapsing them to `unavailable` or `broker_compensation_unobserved`. Ordinary no-worktree sessions stay 10s/21s.
+- SDK session-index scan/replay now explicitly documents and regression-tests the
+	v4 compatibility boundary: supported v4 session-index events and snapshots are
+	accepted at every entry surface (scan, replay, tail, append, repair), future
+	versions stay fail-closed with data-preserving quarantine, and the generic
+	SDK-state guard (`maximum supported version is 1`) is documented as never
+	applying to session-index rows so the #5181 crash class cannot recur.
+
+- GJC plugin TAR/TGZ installs now bound archive input and aggregate gzip expansion before extraction, preventing compressed bundles from exhausting memory while preserving valid concatenated gzip members.
+
 ## [0.16.0] - 2026-09-02
 
 - Added master mode (`gjc --master [--scope repo|pwd|global]`) with authenticated, broker-authoritative child orchestration: `gjc sdk spawn` creates task-seeded children, scoped `gjc sdk search` discovers broker-visible sessions with paginated results, and locator v2 session rows carry canonical cwd, worktree-root, and state-root identity.
@@ -18,7 +67,6 @@
 
 - A runtime-state marker recorded against a different workspace path now reports that mismatch instead of claiming the file is unreadable, and a terminal, not-live marker that travelled into the current workspace with its session directory is adopted rather than refused. Live, non-terminal, and out-of-workspace markers are still refused untouched.
 - An unavailable provider-qualified `modelRoles.default` selection now reports the requested model instead of silently starting on another provider's baseline. This keeps signed-registry omissions and failed catalog admission actionable rather than routing requests to an unrelated retired model. (#5144)
-
 - Headless SDK substrate close now reports success when exact teardown observes the recorded process gone even if cleanup unlinks the durable proof first; live or identity-ambiguous substrates still report `substrate_mismatch`. (#5130)
 
 - Windows session-state locks now drain late terminal reconciliation writes before disposal returns and safely reclaim valid dead transition claims during resume. (#5102)
@@ -32,6 +80,8 @@
 
 ### Fixed
 
+- The shipped pirate extension example now appends its instructions through the supported `systemPrompt` result, and unsupported `before_agent_start` result fields emit a bounded diagnostic instead of being silently ignored.
+
 - File locks now use a descriptor-relative exclusive directory-publication fallback
 	when a filesystem returns `EINVAL` for `renameat2(RENAME_NOREPLACE)` (for example
 	WSL2 DrvFs), so `edit` and terminal persistence no longer surface `Failed to publish
@@ -53,6 +103,7 @@
 - Concurrent coordinator mutations sharing one idempotency key now join the same in-process flight before taking the durable key lock, so a slow accepted prompt cannot make its retry time out as unavailable. Conflicting in-flight requests still fail closed, completed responses remain durably replayable, and different keys remain isolated. (#5110)
 - Custom providers declaring `transport: pi-native` in `models.yml` now actually dispatch through the auth-gateway native endpoint. The provider-level transport was silently dropped for models.yml-declared models, so requests went to `<baseUrl>/chat/completions` and the gateway answered 404; and the pi-native client now serializes only wire-safe tool fields, so runtime tool state carrying fs-stat BigInts no longer aborts request serialization with `JSON.stringify cannot serialize BigInt`.
 - ACP prompts now settle immediately on correlated explicit failure outcomes without waiting for a later `agent_end`; generic error-only `agent_failed` events remain additive diagnostics until an authoritative terminal, while late duplicates and unrelated correlations stay isolated. (#5107)
+- Session disposal no longer waits behind an abort-ignoring tool's prompt admission or cwd read lease before reaching its bounded Agent abort. Disposal now fences new prompt and cwd-move admissions without draining unbounded reader work, while preserving cwd moves admitted before teardown and suppressing late run events. (#5100)
 
 - Managed-session file identities now use one canonical unsigned 64-bit representation across stat/native boundaries and replacement cleanup receipts. Native Windows file IDs surfaced as signed negative bigints no longer create double-hyphen receipt names that block persistence or reopen; already-written signed receipt names and interrupted pending receipts are recovered only through the existing identity-bound, fail-closed reconciliation paths. (#5095)
 

package/dist/types/async/job-manager.d.ts

@@ -43,9 +43,23 @@ export interface AsyncJob {
  * incrementing a completed job's timer.
  */
 export declare function jobElapsedMs(job: Pick<AsyncJob, "startTime" | "endTime">, now?: number): number;
+/**
+ * Why a foreground wait left the foreground. Every fold path names its
+ * trigger so job snapshots and SDK clients can tell a user steer from the
+ * chord, the auto-background timer, or the explicit `bash.background` control.
+ */
+export type FoldReason = "steer" | "chord" | "timer" | "sdk_control";
+/** A fold observed by the manager; published to SDK clients as `bash_folded`. */
+export interface JobFoldEvent {
+    jobId: string;
+    generation: string;
+    reason: FoldReason;
+}
 export interface AsyncJobMetadata {
     /** Set once a foreground wait has been folded, so surfacing can show folded work. */
     backgrounded?: boolean;
+    /** Why a foreground wait was folded; absent for jobs started directly in the background (`async: true`). */
+    foldReason?: FoldReason;
     subagent?: {
         id: string;
         agent: string;
@@ -197,6 +211,8 @@ export interface AsyncJobSnapshotEntry {
     status: AsyncJob["status"];
     generation: string;
     backgrounded: boolean;
+    /** Present when `backgrounded` was set by a fold; absent for direct background starts. */
+    foldReason?: FoldReason;
     deliveryState: JobDeliveryState;
 }
 /** Scalar delivery-failure evidence that may outlive its AsyncJob record. */
@@ -546,11 +562,25 @@ export declare class AsyncJobManager {
         timeoutMs?: number;
     }): Promise<boolean>;
     getLastDisposeDiagnostics(): AsyncJobDisposeDiagnostics;
+    /**
+     * Subscribe to fold events. Fires once per successful `markBackgrounded`
+     * transition (never on the idempotent repeat), so a subscriber can publish
+     * exactly one `bash_folded` frame per fold. Listener errors are isolated.
+     */
+    onFold(cb: (event: JobFoldEvent) => void): () => void;
+    /**
+     * Mark a job that was launched directly in the background (`bash` with
+     * `async: true`). It never had a foreground wait, so this is not a fold: no
+     * `foldReason` is recorded and no fold listener fires.
+     */
+    markStartedInBackground(jobId: string, generation: string): boolean;
     /**
      * Mark a running job as backgrounded (folded out of its foreground call).
      * Read by getJobsSnapshot so folded work stays visible; safe to call twice.
+     * The first transition records `reason` and notifies fold listeners; a
+     * repeat keeps the original reason and emits nothing.
      */
-    markBackgrounded(jobId: string, generation: string): boolean;
+    markBackgrounded(jobId: string, generation: string, reason: FoldReason): boolean;
     waitForAll(): Promise<void>;
     drainDeliveries(options?: {
         timeoutMs?: number;
@@ -559,5 +589,6 @@ export declare class AsyncJobManager {
     dispose(options?: {
         timeoutMs?: number;
     }): Promise<boolean>;
+    awaitRetainedDisposalCompletion(): Promise<void>;
     isDeliverySuppressed(jobId: string, generation?: string): boolean;
 }

package/dist/types/browser-backend.d.ts

@@ -0,0 +1,12 @@
+export type BrowserBackendId = "native" | "aside";
+export interface BrowserBackend {
+    readonly id: BrowserBackendId;
+    readonly exposesBuiltinTool: boolean;
+    readonly developerInstructions?: string;
+}
+interface BrowserBackendSettingsSource {
+    get(key: string): unknown;
+}
+/** Resolve the configured browser backend. Aside is strictly opt-in. */
+export declare function resolveBrowserBackend(settings: BrowserBackendSettingsSource): BrowserBackend;
+export {};

package/dist/types/cli/update-cli.d.ts

@@ -150,6 +150,7 @@ export interface BinaryUpdateFlow {
  * possibly-truncated binary.
  */
 export declare function runBinaryUpdateFlow(targetPath: string, url: string, expectedVersion: string, flow: BinaryUpdateFlow): Promise<InstalledVersionVerification>;
+export declare function assertSupportedLinuxLibcForTest(glibcVersionRuntime: string | undefined, muslLoaderPresent: boolean): void;
 /**
  * Run the update command.
  */

package/dist/types/commands/sdk.d.ts

@@ -1,5 +1,6 @@
 import { Command } from "@gajae-code/utils/cli";
 import type { Args as ParsedArgs } from "../cli/args";
+import { applyStartupModelProfiles } from "../main";
 import { type SessionLifecycleLaunchRequest } from "../sdk/broker/lifecycle";
 import { SessionManager } from "../session/session-manager";
 export declare function lifecycleArgs(request: SessionLifecycleLaunchRequest, cwd: string, agentDir: string): Promise<ParsedArgs>;
@@ -109,6 +110,7 @@ export declare function runSessionHost(timing?: {
     sleep?: (ms: number) => Promise<void>;
     cwd?: string;
     processIncarnation?: (pid: number) => string | undefined;
+    applyStartupModelProfiles?: typeof applyStartupModelProfiles;
 }): Promise<void>;
 export type SdkInternalArgv = {
     action: "broker-internal";

package/dist/types/config/billing-path.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Billing path for a resolved binding's credential source — audit-reversible.
+ * Derived from (model.api, credential-provenance) where the binding actually
+ * resolves credentials, not from a provider-name allowlist.
+ */
+import type { Api } from "@gajae-code/ai/core";
+import type { EffectiveProviderAuth } from "./provider-selection-policy";
+/**
+ * Label shown in the selector row + active-model line. Only the category is
+ * disclosed (never the key material or project id).
+ */
+export type BillingPathKind = "metered-api" | "cloud-project" | "bundled";
+export interface BillingPath {
+    kind: BillingPathKind;
+    /** Stable per-credential-source key for one-time notice dismissal. */
+    dismissKey: string;
+    label: string;
+}
+/**
+ * Derive from the concrete binding (api + credential provenance).
+ * - oauth/keyless/unknown => bundled (plan/proxied/kNoAuth-like)
+ * - key + cloud-project api (google-vertex / bedrock) => cloud-project
+ * - key + any other api (including custom OpenAI-compatible) => metered-api
+ */
+export declare function deriveBillingPath(provider: string, api: Api | string | undefined, effectiveAuth: EffectiveProviderAuth): BillingPath | undefined;

package/dist/types/config/config-schema-version.d.ts

@@ -7,4 +7,16 @@
  * this dependency-light module so the resolver can import it without pulling in
  * the TUI/AI-heavy settings schema.
  */
-export declare const CONFIG_SCHEMA_VERSION = 1;
+export declare const CONFIG_SCHEMA_VERSION = 2;
+/**
+ * Normalize a durable `configSchemaVersion` marker into a comparable version.
+ *
+ * Every version decision (future-schema detection, migration-pending state, and
+ * the ordered migration registry) must read the SAME normalized value: a
+ * malformed marker read as a future schema by one guard and as unmigrated by
+ * the next would skip legacy migrations while still re-running v0 transforms.
+ * A finite malformed value floors to the nearest completed version; a
+ * non-finite or non-numeric one carries no version information and normalizes
+ * to 0 (fully unmigrated). `undefined` stays `undefined` (no marker written).
+ */
+export declare function normalizeConfigSchemaVersion(value: unknown): number | undefined;

package/dist/types/config/model-registry.d.ts

@@ -4,6 +4,7 @@ import { type ThemeColor } from "../modes/theme/theme";
 import { type ActiveProviderDescriptor } from "../sdk/providers";
 import type { AuthStorage } from "../session/auth-storage";
 import type { ActiveSearchModelContext, WebSearchMode } from "../web/search/types";
+import { type BillingPath } from "./billing-path";
 import { ConfigError, ConfigFile } from "./config-file";
 import { isAuthenticated, kNoAuth } from "./model-auth";
 import { type ConfiguredModelBindings } from "./model-bindings-applier";
@@ -15,9 +16,16 @@ import { type ModelProfileDefinition } from "./model-profiles";
 import { GJC_MODEL_ASSIGNMENT_TARGET_IDS, type ModelProfileConfig } from "./models-config-schema";
 import { type EffectiveProviderAuth } from "./provider-selection-policy";
 import { type Settings } from "./settings";
+export type { BillingPath, BillingPathKind } from "./billing-path";
 export type { EffectiveProviderAuth, ProviderSelectionPolicy } from "./provider-selection-policy";
 export type { CanonicalModelIndex, CanonicalModelRecord, CanonicalModelVariant, ModelEquivalenceConfig };
 export { isAuthenticated, kNoAuth };
+/**
+ * A loopback discovery endpoint that is proven to have no listener is the normal state of
+ * a machine without a local model server. Structured transport evidence is required when
+ * available; DNS, routing, proxy, TLS, and HTTP failures remain warnings.
+ */
+export declare function isQuietLocalDiscoveryFailure(baseUrl: string, _warning: string, evidence?: unknown): boolean;
 export type ModelRole = "default";
 export interface ModelRoleInfo {
     tag?: string;
@@ -466,6 +474,14 @@ export declare class ModelRegistry {
      * unknown/keyless providers fall back to non-OAuth.
      */
     getEffectiveProviderAuth(provider: string, sessionId?: string): EffectiveProviderAuth;
+    /**
+     * Billing path for a resolved binding — derived at the point the binding
+     * resolves credentials (model.api + credential provenance). Not a
+     * provider-name allowlist: a custom OpenAI-compatible provider bound
+     * to a metered gateway is "metered-api" exactly like a first-party
+     * key. Only the billing category is ever disclosed.
+     */
+    getBillingPath(model: Model<Api>, sessionId?: string): BillingPath | undefined;
     /**
      * Forget a session's remembered canonical variant so the next resolution
      * for that session re-ranks from scratch (explicit reselection

package/dist/types/config/settings-schema.d.ts

@@ -1738,14 +1738,14 @@ export declare const SETTINGS_SCHEMA: {
             readonly description: "How to drain follow-up messages after a turn completes";
         };
     };
-    readonly interruptMode: {
+    readonly toolInterruptPolicy: {
         readonly type: "enum";
-        readonly values: readonly ["immediate", "wait"];
-        readonly default: "immediate";
+        readonly values: readonly ["abort_tools", "finish_tools"];
+        readonly default: "abort_tools";
         readonly ui: {
             readonly tab: "interaction";
-            readonly label: "Interrupt Mode";
-            readonly description: "When steering messages interrupt tool execution";
+            readonly label: "Tool Interrupt Policy";
+            readonly description: "Whether a steering message aborts the tools still running in the current batch (abort_tools) or lets them finish first (finish_tools). Never changes when a steer is consumed: it is always picked up at the next tool/turn boundary either way.";
         };
     };
     readonly busyPromptMode: {
@@ -3442,6 +3442,16 @@ export declare const SETTINGS_SCHEMA: {
             readonly description: "Enable the browser tool (Ulixee Hero)";
         };
     };
+    readonly "browser.backend": {
+        readonly type: "enum";
+        readonly values: readonly ["native", "aside"];
+        readonly default: "native";
+        readonly ui: {
+            readonly tab: "tools";
+            readonly label: "Browser Backend";
+            readonly description: "Browser surface offered to the model. 'native' exposes the built-in Puppeteer browser tool. 'aside' hides it and requires every browser task to run through the Aside CLI in your live logged-in browser (requires the Aside CLI).";
+        };
+    };
     readonly "browser.headless": {
         readonly type: "boolean";
         readonly default: true;
@@ -3467,7 +3477,7 @@ export declare const SETTINGS_SCHEMA: {
         readonly ui: {
             readonly tab: "tools";
             readonly label: "Profile reuse posture";
-            readonly description: "'auto' (default): when a usable real Chrome profile is available, the browser tool uses an isolated copy of it (cookies/session/cache) for stronger stealth, warns, and falls back to synthetic. 'opt-in': stay synthetic unless a real profile is explicitly requested.";
+            readonly description: "'auto' (default): when a usable real Chrome profile is available, the browser tool uses an isolated copy of it (cookies/session/cache) for stronger stealth, warns, and falls back to synthetic. 'opt-in': stay synthetic unless a real profile is explicitly requested. On macOS, cookie decryption is brand-specific (Chrome Safe Storage vs Chromium Safe Storage Keychain); a Chrome profile copied into bundled Chromium decrypts to garbage, so auto reuses the profile only when the headless executable can decrypt it — detected system Chrome/Chromium or PUPPETEER_EXECUTABLE_PATH — otherwise it falls back to synthetic with a warning.";
         };
     };
     readonly "browser.geo.timezone": {
@@ -4547,7 +4557,7 @@ export declare function getPathsForTab(tab: SettingTab): SettingPath[];
 export declare function getType(path: SettingPath): SettingDef["type"];
 /** Get enum values for an enum setting */
 export declare function getEnumValues(path: SettingPath): readonly string[] | undefined;
-export { CONFIG_SCHEMA_VERSION } from "./config-schema-version";
+export { CONFIG_SCHEMA_VERSION, normalizeConfigSchemaVersion } from "./config-schema-version";
 export type SettingsSchemaIssue = {
     path: string;
     kind: "unknown" | "invalid" | "coerced" | "pending-migration";

package/dist/types/extensibility/extensions/types.d.ts

@@ -14,6 +14,7 @@ import type { Api, AssistantMessageEvent, AssistantMessageEventStream, Context,
 import type { OAuthCredentials, OAuthLoginCallbacks } from "@gajae-code/ai/utils/oauth/types";
 import type * as piCodingAgent from "@gajae-code/coding-agent";
 import type { AutocompleteItem, Component, EditorTheme, KeyId, TUI } from "@gajae-code/tui";
+import type { JobFoldEvent } from "../../async/job-manager";
 import type { KeybindingsManager } from "../../config/keybindings";
 import type { ModelRegistry } from "../../config/model-registry";
 import type { ModelSelectorValue } from "../../config/model-selector-value";
@@ -319,7 +320,7 @@ export interface ExtensionContext {
     /** Run a control-surface mutation inside the session admission boundary. */
     withSdkControlMutation?<T>(body: () => Promise<T>): Promise<T>;
     cycleThinkingLevel(): ThinkingLevel | undefined;
-    setQueueMode(kind: "steering" | "follow_up" | "interrupt", mode: unknown): boolean;
+    setQueueMode(kind: "steering" | "follow_up" | "tool_interrupt", mode: unknown): boolean;
     getSkillState(): unknown;
     getConfigItems(): unknown;
     getBranchCandidates(): unknown;
@@ -333,6 +334,8 @@ export interface ExtensionContext {
         totalBytes: number;
     } | undefined>;
     getJobs(): unknown;
+    /** Subscribe to foreground-wait folds (`bash_folded`). Returns an unsubscribe function. */
+    onJobFold?(listener: (event: JobFoldEvent) => void): () => void;
     /** Typed skill and mode controls exposed to the SDK host. */
     invokeSkill?(name: string, args?: string, options?: {
         onPreflightAccepted?: () => void;
@@ -722,7 +725,7 @@ export interface UserPythonEventResult {
 export type { ToolResultEventResult } from "../shared-events";
 export interface BeforeAgentStartEventResult {
     message?: Pick<CustomMessage, "customType" | "content" | "display" | "details" | "attribution">;
-    /** Replace the system prompt for this turn. If multiple extensions return this, they are chained. */
+    /** Replace the system prompt for this turn. To append, spread event.systemPrompt into the returned array. */
     systemPrompt?: string[];
 }
 export type { SessionBeforeBranchResult, SessionBeforeCompactResult, SessionBeforeSwitchResult, SessionBeforeTreeResult, SessionCompactingResult, } from "../shared-events";
@@ -1138,7 +1141,7 @@ export interface ExtensionContextActions {
     getActiveModelProfile?: () => string | undefined;
     withSdkControlMutation?: <T>(body: () => Promise<T>) => Promise<T>;
     cycleThinkingLevel?: () => ThinkingLevel | undefined;
-    setQueueMode?: (kind: "steering" | "follow_up" | "interrupt", mode: unknown) => boolean;
+    setQueueMode?: (kind: "steering" | "follow_up" | "tool_interrupt", mode: unknown) => boolean;
     getSkillState?: () => unknown;
     getConfigItems?: () => unknown;
     getBranchCandidates?: () => unknown;
@@ -1152,6 +1155,8 @@ export interface ExtensionContextActions {
         totalBytes: number;
     } | undefined>;
     getJobs?: () => unknown;
+    /** Subscribe to foreground-wait folds so the SDK host can publish `bash_folded`. Returns an unsubscribe. */
+    onJobFold?: (listener: (event: JobFoldEvent) => void) => () => void;
     setSdkPermissionProvider?: (provider: ((toolCall: ClientBridgePermissionToolCall, options: ClientBridgePermissionOption[], signal?: AbortSignal) => Promise<ClientBridgePermissionOutcome>) | undefined) => void;
     setSdkClientBridge?: (bridge: ClientBridge | undefined) => void;
     sdkControl?: (operation: string, input: Record<string, unknown>) => unknown | Promise<unknown>;

package/dist/types/gjc-runtime/launch-worktree.d.ts

@@ -28,6 +28,19 @@ export interface GjcLaunchWorktreeResult extends GjcLaunchWorktreePlan {
     createdBranch: boolean;
     dirty?: boolean;
 }
+export interface LaunchWorktreeAbortOptions {
+    signal?: AbortSignal;
+    deadlineAt?: number;
+    now?: () => number;
+}
+export declare class WorktreePreparationTimeoutError extends Error {
+    readonly code = "worktree_preparation_timeout";
+    constructor(message?: string);
+}
+export declare class DependencyPreparationTimeoutError extends Error {
+    readonly code = "dependency_preparation_timeout";
+    constructor(message?: string);
+}
 /**
  * Pure core of {@link resolveWorktreeBucket}, exported for tests.
  *
@@ -41,11 +54,17 @@ export declare function planLaunchWorktree(cwd: string, mode: GjcLaunchWorktreeM
 };
 export declare function ensureLaunchWorktree(plan: GjcLaunchWorktreePlan | {
     enabled: false;
-}): GjcLaunchWorktreeResult | {
+}, options?: LaunchWorktreeAbortOptions): GjcLaunchWorktreeResult | {
     enabled: false;
 };
+export declare function ensureLaunchWorktreeCancellable(plan: GjcLaunchWorktreePlan | {
+    enabled: false;
+}, options?: LaunchWorktreeAbortOptions): Promise<GjcLaunchWorktreeResult | {
+    enabled: false;
+}>;
 /** Workspace worktrees must own their complete lockfile-resolved dependency graph (#4620). */
 export declare function ensureReusableNodeModules(sourceRoot: string, worktreePath: string): "symlink" | "present" | "missing";
+export declare function ensureReusableNodeModulesCancellable(sourceRoot: string, worktreePath: string, options?: LaunchWorktreeAbortOptions): Promise<"symlink" | "present" | "missing">;
 /** Result of {@link prepareLaunchWorktree}: the effective working directory, remaining args, and resolved worktree plan. */
 export interface PreparedLaunchWorktree {
     cwd: string;
@@ -55,3 +74,8 @@ export interface PreparedLaunchWorktree {
     };
 }
 export declare function prepareLaunchWorktree(cwd: string, args: string[]): PreparedLaunchWorktree;
+export declare function removeOwnedLaunchWorktree(plan: GjcLaunchWorktreePlan, receipt: {
+    created: boolean;
+    reused: boolean;
+    createdBranch: boolean;
+}): void;

package/dist/types/gjc-runtime/session-state-lock.d.ts

@@ -83,6 +83,8 @@ export declare const SessionStateLockTestHooks: {
     forcedQuarantineName?: string;
     /** @internal Observes bounded acquisition retries without changing their timing. */
     afterAcquireContention?: (lockFile: string, attempt: number, elapsedMs: number) => void;
+    /** @internal Runs after transition mkdir contention and before stale-claim inspection. */
+    afterTransitionClaimContention?: (transitionDir: string) => void | Promise<void>;
 };
 /** Raised when the lock could not be acquired; callers map it to their own refusal. */
 export type SessionStateLockUnavailableReason = "acquire_timeout" | "legacy_directory_owner_unprovenanced" | "lock_initialization_failed" | "lock_inspection_failed" | "lock_owner_live_or_unverifiable" | "lock_owner_record_fresh" | "lock_owner_record_unprovenanced" | "lock_release_failed" | "transition_claim_timeout" | "unsafe_lock_path_type";
@@ -100,6 +102,26 @@ export declare class SessionStateLockUnavailableError extends Error {
     readonly elapsedMs?: number;
     constructor(causeOrDetails?: unknown | SessionStateLockUnavailableDetails);
 }
+/**
+ * Log fields describing a persist failure: the error text plus, when a session state
+ * lock refusal sits anywhere in the cause chain, its typed `reason` and `lockPath`.
+ * Wrapping errors (`PreviousRuntimeStateReadError`, `AggregateError`) are searched
+ * so the actionable detail is never buried behind a generic message.
+ */
+export declare function sessionStateLockFailureFields(error: unknown): {
+    error: string;
+    reason?: SessionStateLockUnavailableReason;
+    lockPath?: string;
+};
+export declare const PERSIST_FAILURE_WARN_WINDOW_MS = 30000;
+/**
+ * Whether a persist failure should be logged at warn level. The first failure for each
+ * document and stable failure class in a 30s window warns; repeats are the caller's cue
+ * to log at debug instead.
+ */
+export declare function shouldWarnPersistFailure(key: string, error: unknown, now?: number): boolean;
+/** @internal Test seam: forget every persist-failure warn window. */
+export declare function resetPersistFailureWarnWindows(): void;
 /**
  * The identity-bound deletion primitives this lock is built on.
  *

package/dist/types/main.d.ts

@@ -58,6 +58,7 @@ type StartupModelProfileArgs = {
     startupModel?: CreateAgentSessionOptions["model"];
     startupThinkingLevel?: CreateAgentSessionOptions["thinkingLevel"];
     preferCachedModels?: boolean;
+    preferCachedDefaultProfile?: boolean;
 };
 export declare function applyStartupModelProfiles(args: StartupModelProfileArgs): Promise<void>;
 export declare function applyStartupModelProfilesOrExit(args: StartupModelProfileArgs): Promise<void>;

package/dist/types/modes/acp/acp-agent.d.ts

@@ -123,11 +123,11 @@ export declare function acpSessionStateFromConfig(query: unknown, modelCatalogQu
             readonly value: "one-at-a-time";
             readonly name: "One at a time";
         } | {
-            readonly value: "immediate";
-            readonly name: "Immediate";
+            readonly value: "abort_tools";
+            readonly name: "Abort running tools";
         } | {
-            readonly value: "wait";
-            readonly name: "Wait";
+            readonly value: "finish_tools";
+            readonly name: "Finish running tools";
         })[];
     } | {
         id: "thinking";
@@ -151,11 +151,11 @@ export declare function acpSessionStateFromConfig(query: unknown, modelCatalogQu
             readonly value: "one-at-a-time";
             readonly name: "One at a time";
         } | {
-            readonly value: "immediate";
-            readonly name: "Immediate";
+            readonly value: "abort_tools";
+            readonly name: "Abort running tools";
         } | {
-            readonly value: "wait";
-            readonly name: "Wait";
+            readonly value: "finish_tools";
+            readonly name: "Finish running tools";
         })[];
     } | {
         id: "steeringMode";
@@ -178,11 +178,11 @@ export declare function acpSessionStateFromConfig(query: unknown, modelCatalogQu
             readonly value: "one-at-a-time";
             readonly name: "One at a time";
         } | {
-            readonly value: "immediate";
-            readonly name: "Immediate";
+            readonly value: "abort_tools";
+            readonly name: "Abort running tools";
         } | {
-            readonly value: "wait";
-            readonly name: "Wait";
+            readonly value: "finish_tools";
+            readonly name: "Finish running tools";
         })[];
     } | {
         id: "followUpMode";
@@ -205,14 +205,14 @@ export declare function acpSessionStateFromConfig(query: unknown, modelCatalogQu
             readonly value: "one-at-a-time";
             readonly name: "One at a time";
         } | {
-            readonly value: "immediate";
-            readonly name: "Immediate";
+            readonly value: "abort_tools";
+            readonly name: "Abort running tools";
         } | {
-            readonly value: "wait";
-            readonly name: "Wait";
+            readonly value: "finish_tools";
+            readonly name: "Finish running tools";
         })[];
     } | {
-        id: "interruptMode";
+        id: "toolInterruptPolicy";
         name: string;
         type: "select";
         currentValue: string;
@@ -232,11 +232,11 @@ export declare function acpSessionStateFromConfig(query: unknown, modelCatalogQu
             readonly value: "one-at-a-time";
             readonly name: "One at a time";
         } | {
-            readonly value: "immediate";
-            readonly name: "Immediate";
+            readonly value: "abort_tools";
+            readonly name: "Abort running tools";
         } | {
-            readonly value: "wait";
-            readonly name: "Wait";
+            readonly value: "finish_tools";
+            readonly name: "Finish running tools";
         })[];
     })[];
     modes: {

package/dist/types/modes/components/model-selector.d.ts

@@ -58,6 +58,10 @@ export declare class ModelSelectorComponent extends Container {
         smartRoutingPreview?: (draft: AutoroutingSetup) => SmartRoutingPreview;
         /** Open the smart-routing panel directly instead of the preset landing. */
         smartRoutingOnly?: boolean;
+        /** Test seam: synchronous persisted-dismissal check to avoid async render churn. */
+        isBillingDismissed?: (key: string) => boolean;
+        /** Test seam: record that a billing notice was shown/dismissed. */
+        markBillingDismissed?: (key: string) => void;
     });
     dispose(): void;
     refreshRoleAssignments(options?: {

package/dist/types/modes/components/session-selector.d.ts

@@ -1,5 +1,5 @@
 import { type Component, Container } from "@gajae-code/tui";
-import type { ResumeSessionIdentity, ResumeTailInspection, SessionInfo } from "../../session/session-manager";
+import { type ResumeSessionIdentity, type ResumeTailInspection, type SessionInfo } from "../../session/session-manager";
 export interface SelectedSession {
     kind: "selected";
     path: string;

package/dist/types/modes/components/sessions-dashboard.d.ts

@@ -1,10 +1,11 @@
 import { Container } from "@gajae-code/tui";
-import type { SessionInfo } from "../../session/session-manager";
+import { type SessionInfo } from "../../session/session-manager";
 export type SessionLiveness = "active" | "stale" | "unknown";
 export interface DashboardSession {
     id: string;
     cwd: string;
     title: string;
+    starred: boolean;
     modified: Date;
     messageCount: number;
     messageCountIsEstimate?: boolean;