@gajae-code/coding-agent 0.16.3 → 0.16.6

package/CHANGELOG.md

@@ -2,6 +2,119 @@
 
 ## [Unreleased]
 
+## [0.16.6] - 2026-09-07
+### Fixed
+
+- `gjc --smoke-test` no longer fails on a cold or loaded host. The isolated-shell smoke wrote its descendant marker empty while the in-shell wait loop tested for a non-empty file, so the probe command could never reach its parked `sleep` and always burned the full 5s budget, leaving the 5s readiness poll no slack; the 1s descendant-reap window was equally tight. The marker now carries content, readiness and reaping use explicit 30s/15s deadlines, and the probe gets a 60s budget it still never needs. This failed the darwin-x64 release binary check on v0.16.5, which published nothing.
+- SDK lifecycle replay no longer rejects a live endpoint as replaced because of sub-millisecond filesystem metadata drift. The ready authority re-derived the endpoint mtime from a fresh `stat` while every other field came from the indexed record, so the two floats could differ in their last digits and replay hashing reported `endpoint_stale` for the endpoint it had just validated. Replacement fencing is unchanged: the on-disk file must still match the indexed record before that authority exists.
+
+## [0.16.5] - 2026-09-07
+### Added
+
+- `gjc ultragoal succession offer|adopt|status` gives an approved Ultragoal an explicit, audited path from the repository it was planned in to the repository its implementation belongs to (#5353). Previously the repository-binding guard correctly refused to execute the plan from the second repository and the only ways forward — editing `repositoryBinding` or copying the runtime directory — both defeated that boundary and laundered verification provenance. `offer` records the source repository/session, the selected unfinished goal ids, verified source artifact digests, and the complete carryover (the source brief and each objective verbatim, plus the unresolved obligations recorded against those goals), then installs a durable outgoing ownership fence: the source run immediately refuses to schedule or checkpoint the handed-off goals, while goals outside the selection stay schedulable. The source `brief.md`, `goals.json` and `ledger.jsonl` are never written — not even appended to — so their recorded digests stay verifiable, and adoption performs no write to the source repository at all. `adopt` starts a fresh run under the target repository's own binding with new pending goals and no inherited receipts, quality gates, validation batches, steering, owner identity or activated objective; historical statuses, reviews and approvals travel as provenance only. Digests are integrity evidence, never authorization: adoption additionally requires the source fence, a bounded `--authorize`/`--authorized-by` statement, and an explicit goal selection. Because the fence deliberately leaves unselected goals schedulable, admission compares a snapshot of the offered work — the brief plus each selected goal's record and unresolved obligations — rather than whole-file digests, so ordinary source progress cannot permanently strand the handed-off work; whole-file digests remain recorded as provenance and observed drift is written into the adoption record. A selection that takes only part of a validation batch, or splits a review blocker from the goal it still blocks, is rejected rather than silently dropping that obligation, and dependency groups travel as explicit obligations with source-to-target id mapping while the source's batch metadata and receipts stay behind. Terminal-critic blockers are carried as unmet requirements even though the verdict itself is not inherited. Exclusion is a single repository-wide `O_EXCL` claim per operation rather than a directory scan, so two simultaneous sessions cannot both become owners, and adoption is pinned to the exact worktree the offer named because linked worktrees keep separate `.gjc` state. Until publication completes the target refuses to execute — a visible `goals.json` is not admission evidence, the adoption record is. Adoption fails closed on changed offered work, an altered or unfenced offer, an offer path that escapes the source worktree, a target the offer does not name, an occupied target session, and any duplicate or simultaneous adoption in the target repository. A retry reconciles only this operation's own partial bytes: a matching operation id is never authority to overwrite target work it did not write, and a published plan whose files have disappeared is refused rather than reconstructed. There is deliberately no `revoke` verb, because any read-then-delete of the fence races a concurrent adoption and could revive the source while the target is starting.
+
+### Fixed
+
+- Concurrent print-mode resumes rejected by the managed transcript append fence now exit with one retry diagnostic instead of crashing during disposal, including failures while persisting startup model overrides before print mode begins. A pre-write identity mismatch disowns the stale transcript without rewriting another process's successor; genuinely uncertain I/O closure still fails closed.
+- Disk artifact GC and `gjc gc --empty-delete-receipts` now reclaim empty artifact `.removing` directories left by interrupted session deletion, including projects with no remaining transcripts. Only the two generated quarantine-name shapes qualify; no-follow directory snapshots prove emptiness, and non-recursive removal retains non-empty, symlinked, or raced entries with explicit reasons.
+- SDK `session.spawn` now publishes the child PID/incarnation-bound lifecycle marker before waiting for host registration, so headless and managed-tmux children can become ready. Incomplete substrate proofs are rejected and released before seed handoff; registration failures include validated startup phase/reason diagnostics without task text.
+- File-lock acquisition and GC now reclaim orphaned `.lock.pending.<pid>.<uuid>` directories after their owner dies, with a bounded acquisition sweep and exact-identity deletion. Live, unknown, in-process, malformed, symlinked, and host-qualified owners remain protected; cleanup failures cannot block acquisition (related #5198).
+- File-lock acquisition timeouts now expose a typed error with the lock path, retry count, and holder description. Lease mutation and SDK shutdown classify contention without depending on operator-facing wording, and unrelated shutdown failures still propagate.
+- Broker `session.list` pagination cursors now evict the oldest entry when the 32-cursor budget is full instead of failing new paginations with `cursor capacity is exhausted` (#5370). Abandoned or partial paginations degrade gracefully (the evicted cursor reports `cursor is expired or invalid` on next use) so unrelated session ops never fail once the index exceeds one page; the obsolete capacity-exhausted path is removed.
+- `session.delete` uncertain-cleanup fences are now identity-scoped: an unbound `terminal_uncertain` ledger entry no longer blanket-fences deletes for every other session id, and a delete refusal records its own target session so the fence it leaves is scoped to that session. Existing poisoned ledgers need no migration — unbound rows are ignored in place on the next read and stop amplifying (#5364).
+- Runtime state persistence now identifies contradictory `ready_for_input`/`live` fields with their lifecycle state and expected value instead of reporting only a generic invalid/unreadable marker error. Invalid markers remain untouched; this does not migrate or repair old session state.
+- LSP auto-discovery now launches trusted executable symlinks through their discovered paths instead of canonicalizing them to their targets, preserving proxy invocation names such as `rust-analyzer` when installed through rustup. The LSP status action now labels these entries as configured rather than active, since a client has not necessarily started (#5354).
+- SDK snapshot pages now read and integrity-check one contiguous span instead of rereading chunks per row. Reverse-provider disconnects discard connection-scoped registration receipts; relay shutdown releases backpressure listeners without destroying caller-owned sinks, and fragmented request frames are assembled once per newline.
+
+- The TUI working spinner and tool intent remain visible when a run continues after automatic context compaction, a compaction-hook veto, or a successful managed model retry. Temporary status replacement no longer marks the foreground run as finished; actual completion and cancellation still clear it.
+- Coordinator delegates recover a creation-WAL crash before the initial prompt claim without recreating the session or replaying compacted requests. Recurring pin cleanup bounds each readiness pass to 32 session WALs and 32 pinned receipts, skips live caller-key locks, and revisits the namespace after clean scans so surviving coordinators discover later peer crashes as well as previously skipped pins.
+- Session import no longer stalls on large credential-free content. The import redactor's URL-credential rule accepted an unbounded scheme before the literal `://`, so a long alphabetic run re-tried every prefix and scanning cost grew quadratically with the input (50k/100k/200k characters took 0.7s/2.7s/10.6s on text containing no credential at all). Every imported string crosses this fail-closed redactor, so one large transcript message was enough to stall an import of Claude Code or Codex history. The scheme is now length-bounded, which restores linear scanning while `https://`, `postgres://`, and `git+ssh://` credentials are still redacted.
+- SDK saved-session resume now enforces a supplied transcript `sessionIdentity` for both live reattach and cold launch instead of silently replacing it with the broker's current snapshot. Lifecycle create/resume results also expose the opaque `endpointIncarnation`, and same-key replay refuses an endpoint replacement rather than refreshing success by session ID when a numeric generation is reused.
+- An ACP client that declares no MCP servers no longer loses `session/new`, `session/load`, and `session/fork` to the broker's bare readiness default. Only the MCP branch asked for a readiness budget, so an MCP-less launch kept the 10s default while a host cold start measurably crosses it whenever a second host starts alongside the first: the broker then returned `terminal_uncertain` ("Lifecycle startup could not be proven"), which Paseo recorded as a failed provider snapshot and left the GJC provider reading `error` instead of `available`, so imported terminal sessions attached to nothing and showed no transcript. Every ACP launch now requests the same budget the MCP path already used, independent of whether the client declared servers.
+- `subagent await` now accepts integer heartbeat intervals up to 60,000 ms, including 10,000 ms, instead of rejecting them at an undocumented 5,000 ms schema limit. Zero still disables heartbeat updates and the default cadence is unchanged.
+- Coordinator delegates recover a creation-WAL crash before the initial prompt claim without recreating the session or replaying compacted requests. Startup pin cleanup skips live observations without waiting on their caller-key locks, and revisits skipped pins so a surviving coordinator can clean up after a peer commits its response and crashes.
+- Interrupted standalone-binary installs now reclaim an installer lock only when its recorded process ID is no longer running. Live or malformed locks remain protected and fail closed, so a cancelled `gjc update` no longer permanently blocks the next update while concurrent installers remain serialized.
+- Disconnecting an MCP server during its initial connection now returns after cancelling the acquisition instead of waiting forever when an uncooperative transport ignores abort. The pool still owns and closes any late connection, retains cleanup failures for retry, and releases the manager's pending-cleanup fence after successful settlement (#5329).
+- SDK session routing now uses the Broker's endpoint timestamp comparison, accepting sub-millisecond representation differences while retaining device/inode and exact file-replacement checks. Valid live sessions no longer become unavailable solely because timestamp conversions round differently.
+- Paseo announcement now honors `PASEO_LISTEN` ahead of daemon pid metadata, uses `$PASEO_HOME` consistently in default path construction, and removes redundant target-selection and SDK frame-delivery indirection.
+- When every auto-compaction candidate fails, the reported error now leads with the first candidate's failure and lists each candidate that was tried with its own error. The chain starts at the session model and ends on a same-provider largest-context fallback, so surfacing only the final error named a model the user never chose (e.g. `openai-codex/gpt-5.4` on an `astra` preset session) and hid that their own model had already failed the same way.
+- Registry fingerprints now enforce the existing regular-file and 32 MiB admission limits with bounded reads. Model activation, thinking overlay lookup, transcript navigation, slash autocomplete, and observer digest updates avoid repeated allocations; status lines without a git segment no longer request git status.
+- Telegram `/session_recent` now distinguishes sessions currently connected to the notification daemon from saved history and prints a ready-to-copy resume command. Inside a session's existing topic, `/session_resume` and `/session_close` can omit the session ID, including after that topic became inactive.
+- POSIX bash tool sessions now run the embedded persistent brush shell behind a guardian, supervisor, and runtime boundary. Shell self-signals such as `kill -TRAP $$`, external self-signals, process-group signals, and runtime/supervisor death terminate only the owned boundary, reap ordinary and new-session descendants, authenticate control records, return and persist signal-derived status metadata, retire the affected session, and leave the GJC host available for subsequent commands.
+- Memory-guard samples finishing after disable/re-enable or session re-registration no longer restore stale GC latches or restart-advisory windows that suppress the next lifecycle's pressure response.
+- Added ordered, capability-scoped Function Hooks middleware to the canonical extension event runner, with monotonic grant attenuation, target-aware transforms and denials, bounded timeout/abort behavior, redacted provenance-aware audit evidence, and activation-generation fencing. Plugin-bundle Function Hook declarations are validated and hashed but fail closed before host-realm import until a genuine capability-enforcing isolate is available; legacy constrained plugin hooks remain compatible.
+- Coordinator MCP delegation now releases the session transition lock after durable admission so force/queue prompts can dispatch during bounded completion observation. New and reused delegates persist and replay the complete bounded response, including timeout and waiting snapshots, while receipt-first crash recovery preserves accepted prompt identity and successor terminal fences without redispatch. Pending delegate responses pin their source prompt/turn through age and size compaction until final response commit; resumed keys with missing live authority remain unsealed and fail closed instead of redispatching or sealing a busy error.
+- Concurrent SDK CLI cold starts now single-flight broker spawning through an atomically published, process-incarnation-bound lock. Coordination owners use a machine identity keyed from the shared agent root, so separate config profiles recover one another's dead claims without allowing another machine to reclaim a live generation. Every discovery probe is bounded by the startup deadline, and a dedicated bootstrap watchdog terminates a child that outlives its startup fence. A crashed spawner is reclaimed without letting simultaneous healers delete a successor claim; retained legacy broker-lock quarantines no longer collide with takeover; incomplete owner records fail closed; and PID reuse no longer wedges broker startup. (#5198)
+- Skill discovery now reports project `.claude/skills` / `.codex/skills` import candidates before user-home ones, so a populated operator home (hundreds of convention skills is ordinary) can no longer spend the bounded diagnostic budget before the project's own convention skill is named.
+
+### Fixed
+
+- SDK submissions that reject during post-turn cleanup no longer publish a contradictory second terminal after their correlation has already settled.
+- Paseo session imports discard unused CLI stdout instead of leaving an unread pipe.
+- SDK live-attach streams preserve producer order across text deltas, final messages, and tool events even when asynchronous extension handlers are slow, without replaying or broadcasting turn content. Content observed while the correlated `agent_start` is still being durably recorded is held and released after the start frame, so no consumer sees turn content before the turn it belongs to; held content is delivered only to the owners that held the run when it was produced, and the hold is bounded (256 events, oldest dropped with one warning) so a wedged start write can neither invert the start/content boundary nor accumulate a whole response in memory.
+- SDK prompts consumed together after queued steering is interrupted now each receive correlated starts, streamed content, and one terminal, without adopting unrelated pending submissions.
+
+- Tool hot paths avoid overlap-table allocations for equal/append-only ACP output, redundant UTF-8 tail previews, repeated diagnostics suffix scans, and duplicate background GitHub-cache refreshes. Job polling now releases watches and timers when a progress callback throws.
+
+## [0.16.4] - 2026-09-05
+### Added
+
+- Added selectable `astra-lite`, `astra-default`, and `astra-heavy` CODEX presets with `ASTRA-` labels, plus `astra-fable` and `astra-fable-opus` cross-family review combinations. Existing presets and automatic provider recommendations remain unchanged.
+- An interactive `gjc` now shows up inside [Paseo](https://paseo.sh) by itself, controllable from the desktop and mobile apps, instead of only being reachable when Paseo started it. Every terminal session already registered its SDK endpoint with the broker, and GJC's ACP surface already resolves a `live` index entry straight to the running host — a `session/load` attaches to it rather than resuming a second copy — so the only thing missing was telling the Paseo daemon the session exists. That is now done at interactive startup with `paseo import --provider <key> --cwd <cwd> <session-id>`, which makes the terminal session and the Paseo agent the same live session rather than two transcripts. The announcement is gated so it costs nothing when it cannot apply: an absent `$PASEO_HOME/config.json` (default `~/.paseo/config.json`), no enabled GJC ACP provider entry, no `paseo` on PATH, a daemon that is not listening, or a session the broker does not yet report as live each stop it before anything is spawned. The daemon check is a plain socket probe rather than a CLI invocation because the Paseo CLI blocks indefinitely when its daemon is down (measured: no output and no exit after two minutes), and the liveness check exists because importing a not-yet-registered id would make `session/load` fork a second host for a session that is already running. While the daemon is merely not up yet, the probe retries every 30 seconds for approximately ten minutes on unref'd timers, so launching Paseo after the terminal still works; the loaded opt-in can cancel its own pending or active announcement, changes made by another process apply on the next launch, and Paseo's own duplicate-import refusal is read as success. Interactive-only by construction — a `gjc acp` provider process never builds the interactive mode, so an imported session cannot announce itself back. Create-only by construction too: GJC adds an entry and never deletes, archives, or rewrites one, so it can never remove an agent you still wanted. The consequence is yours to manage — every interactive start gets a fresh session id (including `gjc -c`), so each launch adds one row, and ending a session leaves its row listed as `idle` until a send fails with `SDK session attachment is stale` and Paseo marks it `error`; prune with `paseo delete <agent-id>`. Opt-in: the new operator-owned `paseo.autoImport` setting is **off by default**, so a repository cannot enable it and an installation that never asks for it never reads a Paseo file, probes a socket, or spawns the CLI; enable it with `gjc config set paseo.autoImport true` (Settings → Interaction → "Announce Sessions to Paseo"). See [`docs/terminal-app-integrations.md`](../../docs/terminal-app-integrations.md#announcing-interactive-sessions).
+- Corrected a stale claim in [`docs/external-control-readiness.md`](../../docs/external-control-readiness.md): interactive `gjc` sessions *are* broker-registered and *are* listed by ACP clients, and an ACP `session/load` against a live entry attaches to the running host instead of resuming a copy.
+- An externally submitted prompt against a session on the SDK-only host runtime no longer hangs forever after its turn has already finished. That runtime published the lifecycle boundary as a bare `{ type, sessionId }` frame: it computed each ended invocation's `commandId`/`turnId` for durable reconciliation and then discarded them at publication, and it never carried a normalized outcome at all — only the `agent_failed` diagnostic was published per invocation with its correlation. An ACP client matches a terminal against the correlation it was acknowledged under and requires the outcome, so a real `agent_end` was rejected as `acp_prompt_terminal_dropped` / `incomplete_correlation`, `session/prompt` never settled, and the client sat in `working` until the 30-minute prompt deadline (reproduced against Paseo 0.6.1 attached to a live interactive session: the terminal rendered the full answer while Paseo showed the agent `running` indefinitely). An owned `agent_end` is now published once per ended invocation carrying that invocation's correlation and a normalized `stopped` outcome, mirroring the existing `agent_failed` shape. Frames that terminalize nothing are unchanged and stay uncorrelated: `agent_start`, a host-originated run with no owning invocation (autonomous continuation, cron, monitor), and a continuing maintenance checkpoint (`pruned`/`compacted`/`promoted`) — which is published but is deliberately not a terminal boundary, so stamping it would settle a client's prompt mid-turn. The ACP ownership gate is untouched.
+- An ACP client attached to a *live interactive* session now receives the turn it submitted: assistant text, thinking, and tool calls stream as they happen instead of arriving as an empty completed turn. The SDK-only host runtime subscribed to lifecycle and watchdog events only — its two `tool_execution_*` handlers just renewed a deadline watchdog and it never subscribed to `message_update`/`message_end` at all — so it published no agent wire events and an attached client could drive the session and watch the turn settle without receiving a single word of the answer (measured against Paseo 0.6.1: `paseo logs` showed the prompt and nothing else, with `--filter tools` and `--filter text` both reporting no activity). It now streams the same five events the notifications runtime does (`message_update`, `message_end`, `tool_execution_start`/`update`/`end`), built with the same shared `toAgentWireEventPayload` producer so the wire shape cannot drift from what ACP maps. Delivery matches the notifications runtime too: one frame per owning invocation, sent directly to the connection that submitted the turn and carrying that invocation's correlation. It deliberately does **not** go through the session event ring — that ring is bounded by frame count with no byte ceiling, so streaming high-frequency chunks through it would evict the lifecycle events clients depend on (including the `agent_end` that settles their prompt) and would broadcast a turn's content to every authenticated subscriber rather than the one that asked for it. A turn nobody submitted over the SDK (an ordinary terminal prompt, an autonomous continuation, cron, monitor) has no owning connection and streams nothing.
+- `gjc` no longer reports an error at every interactive launch when the Paseo daemon requires a password. `paseo import` refuses with `Cannot connect to daemon ...: Password required`, which the socket probe cannot anticipate because the TCP connect succeeds; that refusal is now read as a quiet skip instead of a failed announcement. GJC has no credential setting and reads no Paseo credential file: `paseo import` runs with the session's own environment, so an exported `PASEO_PASSWORD` is used and an absent one simply skips.
+
+- Status-line settings now include a draft-local spatial custom editor with exact-slot keyboard reordering, hidden-segment palette management, command text configuration, persisted Confirm/Exit semantics, live multi-row preview compatibility, narrow/Unicode rendering, and deterministic visual evidence.
+- Added opt-in `reasoningLanguage: english` guidance for technical work while preserving the user's requested response language; the default remains off.
+
+### Changed
+
+- Interactive assistant `text_delta` presentation now coalesces eligible updates into the latest message projection before the existing TUI frame while preserving ordered event processing, immediate non-text updates, and authoritative final output. Session/transcript replacement and disposal cancel stale presentation; temporary TUI stop/start rearms current live text before the first restarted frame without invalidating live historical image callbacks.
+
+### Fixed
+
+- Credential replacement lookups now propagate the owning request's cancellation through scoped and allowed unscoped retries, preventing aborted turns from continuing OAuth preparation or selecting another key.
+- Removing the committed status-line command segment or clearing its trusted command now cancels the running process and clears stale output; draft-only previews remain side-effect-free.
+- Slack inbound acknowledgment reactions now use bounded, abortable, tracked provider work that drains on shutdown or attachment retirement without delaying accepted turns; rejected or timed-out reactions emit sanitized diagnostics.
+- Task repository bindings now accept explicit `relativeSubdir: "."` as the already-bound worktree root, avoiding unnecessary launch retries while retaining traversal, absolute-path, symlink-escape, and sibling-repository rejection.
+- Blank optional task output schemas now inherit the configured agent/session schema instead of failing successful subagents at completion; malformed nonempty schemas and required-field validation remain fail-closed.
+- The read-URL cache is now bounded (FIFO, 64 keys), so long-lived TUI and SDK-host processes no longer retain every fetched page's full output and image payload for the process lifetime; an evicted entry simply refetches on the next read, and unpersisted sessions sharing a working directory remain isolated by session identity.
+- The insane-search web bridge now kills the engine's whole process group instead of only the `python3` process. `killChild` promised a group kill but the engine was not spawned detached, so when the bridge timeout fired mid-flight (25s default vs the engine's internal 90s playwright budget), `node` and headless `chromium` children survived as orphans. The engine now leads its own POSIX process group and receives group-wide SIGTERM→SIGKILL escalation even when the group leader exits during the grace period, with a direct child-kill fallback on Windows.
+- Contribution-prep outbound artifacts now redact complete AWS credentials, including AKIA/ASIA access-key IDs and SecretAccessKey/SessionToken values in shell-style and escaped JSON forms, while preserving structured output and existing GitHub, Slack, authorization-header, and cookie redaction.
+- Model preset registry URL and disable overrides now resolve only from explicitly inherited or user-owned environment sources, so a checkout `.env` cannot suppress updates or redirect signed-registry polling while dependency injection, HTTPS validation, signatures, ETags, cache, and offline behavior remain unchanged (#5300).
+- OpenCode Go's provider conversation identity now remains distinct from generic cache affinity across normal turns and maintenance calls, so the required session header reuses the session manager's opaque lifecycle without accepting auth-gateway prompt-derived cache keys (#5295).
+- Perplexity web search now clamps upstream search breadth to the API's 3–100 contract, retries one structurally empty completion, rejects malformed or ungrounded success payloads through the provider fallback path, and preserves valid grounded responses.
+- Architect/task subagents now retry API-key lookup without the parent session id after a scoped miss, so broker OAuth that works for `gjc -p --no-session` is not thrown away as `Agent run failed` / 0 tokens (#5081 follow-up). Failures still throw `provider_unavailable` without leaking the token.
+- Python work that completes after strict session disposal now returns its result without attempting to append to the closed session transcript.
+- SDK-hosted workflow tools now retain the logical session id for ask, skill, deep-interview, and ultragoal state paths while job, monitor, bash, cron, task, and subagent ownership routes through a separate opaque async endpoint key. Explicit provider session identities no longer create encoded duplicate workflow trees or redirect endpoint-owned work to another live session.
+- Explicit root startup `--thinking off` and `--thinking=off` now override a configured higher startup default while leaving the provider `Effort` catalog unchanged.
+- Skills installed from marketplace plugins are now enumerated into sessions instead of only resolving by exact name. `loadSkills` asked the `native` provider alone, so every installed plugin skill was absent from `/` autocomplete and from the `skill` tool's `Available:` list while `gjc skill list` reported it and the discovery fallback still loaded it — 46 installed skills presented as 5. The already-registered marketplace provider is now loaded alongside `native`, keeping `<plugin>:<skill>` namespacing and per-item scope trust.
+- File-content search now has a call-wide timeout (`timeout`, default 5 seconds, range 0.5–60) that is forwarded through internal-URL resolution and native grep together with cancellation. Native scans poll cancellation around each bounded file, and the tool joins cancellation cleanup before returning instead of leaving scope resolution, archive scratch, or grep workers running after a timeout. Timeout failures tell callers to narrow the scope or explicitly increase the budget, while user cancellation remains a distinct tool abort.
+- `restart:sdk-broker -- --close-session-hosts` now continues replacing the broker when its pre-restart session-host listing fails, reports the partial teardown with exit code 1, tolerates another authenticated restart caller retiring the same exact broker identity, and catches other top-level failures instead of emitting an unhandled-rejection crash record.
+- `install:dev` now builds the workspace native addon before linking the source CLI, preventing fresh or cleaned development checkouts from failing startup with a missing or stale addon. The installer also supports the local `--dev` binary shortcut.
+- Plain and explicit-model launches now refresh a missing provider's cached dynamic catalog before resolving a qualified startup selector, so configured models such as `glm-zcode/glm-5.3` no longer open in `no-model` state while preserving cache-only startup for already available models.
+- The explicit thinking-choice gate for xAI models now derives from the parsed grok generation (4.5+) shared with `@gajae-code/ai`, instead of the exact ids `grok-4.5`/`grok-4.6`. A future grok release failed the id list, so `supportsReasoningEffort` stayed `false` and the user's thinking level was silently dropped from requests; reseller-hosted grok routes (OpenRouter & co.) keep their existing audited-transport behavior.
+
+- The status-line usage segment now paints only the active model's provider, so switching to Grok no longer keeps a stale Claude 5h/7d pair. Canonical Grok Build reports render only their authoritative weekly window, while monthly credits are omitted instead of being mislabeled as `7d`.
+
+- Bundled plugin MCP launchers now execute Node `.mjs` entrypoints on Linux from startup-authenticated interpreter bytes and a complete copied-file snapshot. Runtime options cannot precede the entrypoint, path-qualified/shebang commands fail closed, unexpected post-install files quarantine the bundle, and canonical registry identity plus the complete copied-file manifest are rebound before every spawn. Runtime captures the interpreter and authenticated bundle files through bounded stable handles into a unique owner-only launch capsule; the Node loader returns authenticated captured module bytes while preserving file-URL relative imports and blocking package/CommonJS/native escapes. Concurrent connections use separate authority. Capsule cleanup failures retain ownership and fence reconnect until cleanup succeeds. Bun, macOS, and Windows bundled stdio launch fail closed pending equivalent loader and owner/process-tree authority; capsules do not provide hostile-same-UID process isolation.
+
+- Moving the `/model` preset cursor now reuses the authentication snapshot produced by catalog and credential refreshes instead of resolving every profile against the full model catalog on each Up/Down keypress; auth-dependent preset actions remain blocked until the initial static refresh and the availability snapshot are complete.
+- Bundled Grok Build models now explicitly declare `reasoning_effort` support only for catalog-supported models, so `grok-build/grok-4.6:xhigh` reaches the Responses request while unsupported Grok models remain fail-closed. (#5264)
+- Mid-run OpenAI remote-compaction fallback failures now stop before another provider request, surface the local summarization error through ACP/SDK terminal handling, and leave the uncompacted context unsubmitted. Successful local fallback still commits the compaction and resumes normally.
+- Opening `/model` now renders the preset landing before constructing the full model browser catalog. Canonical search indexing, sorting, and the redundant offline registry refresh are deferred until the user searches or chooses a browse action, while the lightweight preset-availability check remains immediate and scoped or direct-search selectors still load immediately.
+- Slack lean notifications now publish only finalized assistant answers and actionable states instead of the internal lifecycle, identity, and activity frame stream. Final answer delivery uses the message reference as a durable publication identity, so repeated unpositioned SDK frames no longer post duplicate replies; accepted inbound Slack messages receive a 👀 reaction while GJC awaits the agent's answer.
+- `/model` provider-tab refreshes now reuse the already loaded static catalog and update only the selected provider's discovery state, avoiding repeated signed preset registry work while retaining full-catalog refresh behavior for static configuration changes.
+- Added the `command` status-line segment for user-produced HUD content. It runs
+  configured user/global shell commands in the background with scheduled cached
+  refreshes, bounded timeout/output, ANSI sanitization, placeholder degradation,
+  disposal cancellation, and custom-editor configuration while preserving
+  synchronous TUI rendering; project-scoped settings cannot trigger execution.
+
+- Business/Enterprise/Team ChatGPT accounts can bind GPT-5.6 Sol again. The Codex entitlement preflight treated only `plan_type` values containing `"pro"` as eligible, so an `openai-codex` OAuth account on a Business/Enterprise/Team plan was rejected at model-binding/subagent setup time with a spurious entitlement error even though the backend accepts the request. Exact Pro/Business/Enterprise/Team tiers are now recognized as entitled, Plus/Free remain rejected, and unfamiliar plan names are deferred to the provider rather than guessed locally.
+
 ## [0.16.3] - 2026-09-04
 
 ## [0.16.2] - 2026-09-04

package/dist/types/capability/types.d.ts

@@ -28,6 +28,8 @@ export interface LoadContext {
      * produced. This includes MCP registrations and user-installed skills.
      */
     userAgentDir?: string;
+    /** Resolver-owned classification for the selected user agent directory. */
+    profileAuthority?: "default" | "custom";
     /** Git repository root (directory containing .git), or null if not in a repo */
     repoRoot: string | null;
     /** Owning session settings for provider policy decisions. */
@@ -81,6 +83,8 @@ export interface LoadOptions {
      * process-wide one (`createAgentSession({ agentDir })`).
      */
     agentDir?: string;
+    /** Resolver-owned classification for `agentDir`; preserve it across HOME/config refreshes. */
+    profileAuthority?: "default" | "custom";
     /** Include items even if they fail validation. Default: false */
     includeInvalid?: boolean;
     /** Include items disabled via settings. Default: false */

package/dist/types/cli/args.d.ts

@@ -1,4 +1,4 @@
-import { type Effort } from "@gajae-code/ai/core";
+import { type RootThinkingLevel } from "./root-flags";
 export type Mode = "text" | "json" | "acp";
 export type ParseArgsAuthority = "local" | "acp" | "deferred";
 export interface Args {
@@ -21,7 +21,7 @@ export interface Args {
     mcpConfig?: string;
     /** Opt a standalone session out of conventional MCP autoload (mutually exclusive with --mcp-config). */
     noMcp?: boolean;
-    thinking?: Effort;
+    thinking?: RootThinkingLevel;
     continue?: boolean;
     resume?: string | true;
     help?: boolean;

package/dist/types/cli/customize-doctor.d.ts

@@ -89,6 +89,28 @@ export interface CustomizeDoctorItem {
     mcp?: McpSafeSummary;
     /** Present only for quarantined plugin-bundle surfaces. */
     quarantineCode?: string;
+    /** Metadata-only Function Hook policy projection; hook code is never executed. */
+    functionHooks?: CustomizeFunctionHookSummary[];
+}
+export interface CustomizeFunctionHookSummary {
+    extensionId: string;
+    order: number;
+    event: string;
+    target?: string;
+    phase?: "before" | "after";
+    scope: "user" | "project";
+    plugin: string;
+    relativePath: string;
+    status: "disabled" | "quarantined" | "blocked-isolate" | "legacy-active";
+    requestedCapabilities: string[];
+    effectiveCapabilities: string[];
+    attenuateDownstream: string[];
+    networkDestinations: string[];
+    filesystemRoots: string[];
+    capabilityHash?: string;
+    implementationHash?: string;
+    quarantineCode?: string;
+    remediation: string;
 }
 export interface CustomizeDoctorSurface {
     kind: CustomizeSurfaceKind;

package/dist/types/cli/root-flags.d.ts

@@ -1,4 +1,6 @@
 import { type FlagDescriptor } from "@gajae-code/utils/cli";
+export declare const ROOT_THINKING_LEVELS: readonly ["off", ...import("@gajae-code/ai").Effort[]];
+export type RootThinkingLevel = (typeof ROOT_THINKING_LEVELS)[number];
 /** Public launch flags shared by root help, completion, and the launch command. */
 export declare const ROOT_LAUNCH_FLAGS: {
     model: FlagDescriptor<"string"> & {
@@ -104,7 +106,7 @@ export declare const ROOT_LAUNCH_FLAGS: {
     };
     thinking: FlagDescriptor<"string"> & {
         description: string;
-        options: readonly ["minimal", "low", "medium", "high", "xhigh", "max"];
+        options: readonly ["off", ...import("@gajae-code/ai").Effort[]];
     };
     "no-rules": FlagDescriptor<"boolean"> & {
         description: string;
@@ -239,7 +241,7 @@ export declare const LAUNCH_PARSE_FLAGS: {
     };
     thinking: FlagDescriptor<"string"> & {
         description: string;
-        options: readonly ["minimal", "low", "medium", "high", "xhigh", "max"];
+        options: readonly ["off", ...import("@gajae-code/ai").Effort[]];
     };
     "no-rules": FlagDescriptor<"boolean"> & {
         description: string;

package/dist/types/cli.d.ts

@@ -127,7 +127,7 @@ export declare class RootHelpCommand extends Command {
         };
         thinking: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
-            options: readonly ["minimal", "low", "medium", "high", "xhigh", "max"];
+            options: readonly ["off", ...import("@gajae-code/ai").Effort[]];
         };
         "no-rules": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;

package/dist/types/commands/launch.d.ts

@@ -120,7 +120,7 @@ export default class Index extends Command {
         };
         thinking: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
-            options: readonly ["minimal", "low", "medium", "high", "xhigh", "max"];
+            options: readonly ["off", ...import("@gajae-code/ai").Effort[]];
         };
         "no-rules": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;

package/dist/types/config/autorouting-tier-map.d.ts

@@ -781,6 +781,9 @@ export declare const TIER_MAP_SKIP_LIST: {
     readonly "nvidia/upstage/solar-10.7b-instruct": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };
+    readonly "openai-codex/gpt-6-astra": {
+        readonly rationale: "GPT-6 Astra catalog addition (2026-09-03 release); not yet curated";
+    };
     readonly "openai-codex/gpt-daybreak-blue-latest": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };

package/dist/types/config/file-lock.d.ts

@@ -11,9 +11,17 @@ export interface FileLockOptions {
     /** Previous local host identities accepted only when deciding stale-owner reclamation. */
     previousOwnerHostIds?: readonly string[];
 }
-/** Release retries cover transient Windows/Dropbox handle denial without extending the lock indefinitely. */
-export declare const FILE_LOCK_RELEASE_RETRY_ATTEMPTS = 5;
-export declare const FILE_LOCK_RELEASE_RETRY_DELAY_MS = 10;
+export declare class FileLockAcquireError extends Error {
+    readonly filePath: string;
+    readonly lockPath: string;
+    readonly attempts: number;
+    readonly holder: string;
+    readonly code = "acquire_timeout";
+    constructor(filePath: string, lockPath: string, attempts: number, holder: string);
+}
+/** Release retries cover transient handle denial and a competing exact-removal quarantine cleanup. */
+export declare const FILE_LOCK_RELEASE_RETRY_ATTEMPTS = 20;
+export declare const FILE_LOCK_RELEASE_RETRY_DELAY_MS = 25;
 export declare const FileLockTestHooks: {
     afterParentMkdir?: (lockPath: string) => void | Promise<void>;
     nativePublicationBindings?: () => {
@@ -47,6 +55,8 @@ export declare function readFileLockInfoForGc(lockDir: string): Promise<FileLock
 /** Owner identity stamped into a `<file>.lock/info` record. */
 export interface FileLockOwnerToken {
     pid: number;
+    /** Kernel-derived identity for the exact process generation owning `pid`. */
+    process_incarnation?: string;
     start_time?: string;
     /** Encoding marker for the canonical UTC process-start identity. */
     start_time_format?: string;
@@ -93,6 +103,7 @@ export type GenericFileLockDirStaleVerdict = {
  * but the reclaim-after-stale scenario the issue describes is now guarded.
  */
 export declare function removeFileLockDirForGc(lockDir: string, expected: FileLockOwnerToken, preVerdictIdentity?: GenericFileLockDirIdentity): Promise<FileLockGcRemoval>;
+type OwnerLiveness = "alive" | "dead" | "unknown";
 /**
  * @internal
  * READ-ONLY verdict on an EXISTING generic `<file>.lock/` directory that another lock
@@ -122,6 +133,7 @@ type NativeFileLockBindings = {
     snapshotDirectoryTree(lockPath: string): NativeDirectoryTreeResult;
     exactRemoveDirectoryTree(lockPath: string, snapshot: NonNullable<NativeDirectoryTreeResult["snapshot"]>): NativeExactUnlinkResult;
 };
+export declare function acquireFileLock(filePath: string, options?: FileLockOptions): Promise<() => Promise<void>>;
 /**
  * Serializes all contenders, including callers in the same process. Because this
  * API exposes no ownership token, recursive acquisition is indistinguishable
@@ -129,4 +141,20 @@ type NativeFileLockBindings = {
  * that fact through its own `lockHeld` path instead of acquiring it again.
  */
 export declare function withFileLock<T>(filePath: string, fn: () => Promise<T>, options?: FileLockOptions): Promise<T>;
+/** Strictly recognize the staging names emitted by tryAcquireLock. */
+export declare function fileLockStagingOwnerPid(name: string): number | null;
+export interface FileLockStagingResult {
+    path: string;
+    pid?: number;
+    status: OwnerLiveness;
+    removed: boolean;
+    reason: string;
+}
+/** Observe identity before probing; neither a replacement nor a symlink inherits the verdict. */
+export declare function inspectFileLockStagingDir(stagingPath: string, probe?: (pid: number) => OwnerLiveness, remove?: boolean): Promise<FileLockStagingResult>;
+/** Bounded opportunistic cleanup; the acquisition caller treats failures as diagnostic only. */
+export declare function reapOrphanedLockStagingDirs(lockPath: string): Promise<{
+    removed: string[];
+    retained: FileLockStagingResult[];
+}>;
 export {};

package/dist/types/config/model-registry.d.ts

@@ -368,6 +368,10 @@ export declare class ModelRegistry {
     /**
      * Reload models from disk (embedded + accepted registry + custom from models.yml).
      */
+    refreshStatic(): Promise<void>;
+    /**
+     * Reload models from disk and refresh runtime provider discovery state.
+     */
     refresh(strategy?: ModelRefreshStrategy): Promise<void>;
     refreshInBackground(strategy?: ModelRefreshStrategy): void;
     refreshProvider(providerId: string, strategy?: ModelRefreshStrategy): Promise<void>;

package/dist/types/config/model-resolver.d.ts

@@ -33,6 +33,15 @@ export declare function parseModelString(modelStr: string): {
     id: string;
     thinkingLevel?: ThinkingLevel;
 } | undefined;
+export declare function resolveStartupModelRefreshSelectors(options: {
+    model?: string;
+    provider?: string;
+    credential?: string;
+    continue?: boolean;
+    resume?: string | boolean;
+    hasStartupProfile: boolean;
+}, settings: ModelRoleSettings): ModelSelectorValue | undefined;
+export declare function refreshMissingQualifiedModelProviders(selectors: ModelSelectorValue | undefined, modelRegistry: Pick<ModelRegistry, "getAvailable" | "getDiscoverableProviders" | "refreshProvider">): Promise<boolean>;
 /**
  * Format a model as "provider/modelId" string.
  */

package/dist/types/config/settings-schema.d.ts

@@ -27,7 +27,7 @@ export declare const TAB_METADATA: Record<SettingTab, {
     icon: `tab.${string}`;
 }>;
 /** Status line segment identifiers */
-export type StatusLineSegmentId = "gajae" | "pi" | "model" | "mode" | "path" | "git" | "pr" | "subagents" | "jobs" | "token_in" | "token_out" | "token_total" | "token_rate" | "cost" | "context_pct" | "context_total" | "time_spent" | "time" | "session" | "hostname" | "cache_read" | "cache_write" | "session_name" | "usage";
+export type StatusLineSegmentId = "gajae" | "pi" | "model" | "mode" | "path" | "git" | "pr" | "subagents" | "jobs" | "token_in" | "token_out" | "token_total" | "token_rate" | "cost" | "context_pct" | "context_total" | "time_spent" | "time" | "session" | "hostname" | "cache_read" | "cache_write" | "session_name" | "usage" | "command";
 /** Submenu choice metadata. */
 export type SubmenuOption<V extends string = string> = {
     value: V;
@@ -1306,6 +1306,25 @@ export declare const SETTINGS_SCHEMA: {
             readonly options: readonly import("../thinking-metadata").ThinkingLevelMetadata[];
         };
     };
+    readonly reasoningLanguage: {
+        readonly type: "enum";
+        readonly values: readonly ["off", "english"];
+        readonly default: "off";
+        readonly ui: {
+            readonly tab: "model";
+            readonly label: "Reasoning Language";
+            readonly description: "Optionally reason through development work in English while preserving the user's response language";
+            readonly options: readonly [{
+                readonly value: "off";
+                readonly label: "Off";
+                readonly description: "Do not add reasoning-language guidance";
+            }, {
+                readonly value: "english";
+                readonly label: "English";
+                readonly description: "Reason through technical work in English and answer in the user's language";
+            }];
+        };
+    };
     readonly hideThinkingBlock: {
         readonly type: "boolean";
         readonly default: false;
@@ -1915,6 +1934,15 @@ export declare const SETTINGS_SCHEMA: {
             readonly description: "Show the interactive GitHub star reminder when gh is authenticated";
         };
     };
+    readonly "paseo.autoImport": {
+        readonly type: "boolean";
+        readonly default: false;
+        readonly ui: {
+            readonly tab: "interaction";
+            readonly label: "Announce Sessions to Paseo";
+            readonly description: "Global-only operator opt-in. When enabled, and only when a GJC ACP provider is already registered in Paseo and its daemon is already running, import each interactive session into Paseo so it can be driven from there. Project settings cannot enable it. Never starts the Paseo daemon or removes imported entries; stale entries must be pruned in Paseo. Never runs when Paseo is absent.";
+        };
+    };
     readonly "crashReport.nudge": {
         readonly type: "boolean";
         readonly default: true;

package/dist/types/coordinator-mcp/question-state.d.ts

@@ -187,6 +187,8 @@ export interface PromptRequestV1 {
         turn_id: string;
     };
     coordinator_turn_id?: string;
+    /** Retain prompt and source turn until the delegate's outer response is durable. */
+    delegate_response_pending?: boolean;
     safe_response?: Record<string, unknown>;
     error_code?: PublicReason | "idempotency_conflict";
     created_at: string;
@@ -275,6 +277,11 @@ export interface CoordinatorSessionTransactionV1 {
     recovery: {
         prompt_watermark_at: string | null;
         last_repaired_at: string | null;
+        /** One-shot authority for the initial delegate prompt, consumed atomically with its claim. */
+        initial_delegate_request?: {
+            key_digest: string;
+            request_digest: string;
+        };
     };
 }
 export type CanonicalCreateIntentV1 = {

package/dist/types/coordinator-mcp/server.d.ts

@@ -72,6 +72,13 @@ interface CoordinatorServices {
     afterCanonicalReportCommit?: (sessionId: string) => void | Promise<void>;
     /** Test barrier invoked after a canonical report safe response is durable and before outer idempotency completion. */
     afterCanonicalReportSafeResponse?: (sessionId: string, response: Record<string, unknown>) => void | Promise<void>;
+    /** Test barriers around delegate admission and outer response durability. */
+    afterDelegateAdmission?: (sessionId: string) => void | Promise<void>;
+    afterDelegateCreationWalCommitted?: (sessionId: string) => void | Promise<void>;
+    afterDelegateCreationCompleted?: () => void | Promise<void>;
+    beforeDelegateResponseCommit?: () => void | Promise<void>;
+    afterDelegateResponseCommit?: () => void | Promise<void>;
+    readCoordinatorSessionEntries?: (directory: string) => Promise<string[]>;
 }
 type CoordinatorModelResolution = {
     ok: true;

package/dist/types/discovery/claude-plugins.d.ts

@@ -1 +1,3 @@
-export {};
+import { type Skill } from "../capability/skill";
+import type { LoadContext, LoadResult } from "../capability/types";
+export declare function loadMarketplaceSkills(ctx: LoadContext, allowedLevels?: ReadonlySet<"user" | "project">): Promise<LoadResult<Skill>>;

package/dist/types/discovery/helpers.d.ts

@@ -59,11 +59,34 @@ export declare const SOURCE_PATHS: {
         readonly projectDir: ".vscode";
     };
 };
+/** Ancestors from `cwd` through `stopAt`, excluding one normalized authority boundary. */
+export declare function getAncestorDirs(cwd: string, stopAt?: string | null, excludeDir?: string): Array<{
+    dir: string;
+    depth: number;
+}>;
 export type SourceId = keyof typeof SOURCE_PATHS;
+export type ProfileAuthority = "default" | "custom";
 /**
  * Get user-level path for a source.
  */
 export declare function getUserPath(ctx: LoadContext, source: SourceId, subpath: string): string | null;
+/**
+ * Deterministic user-scope skill scan directories, highest precedence first.
+ *
+ * The canonical root is the agent directory (`getAgentDir()`, moved by
+ * `--agent-dir` / `GJC_CODING_AGENT_DIR` / `setAgentDir()`) — the target of
+ * every user-scope skill writer (`gjc migrate`, `gjc skill`). An agent-directory
+ * profile is a *separate* user scope, the same contract as MCP user config
+ * (#4768): its legacy home-relative roots are not scanned, so a profile cannot
+ * pick up the default profile's skills (and vice versa). The resolver-owned
+ * `profileAuthority` classification is authoritative when supplied, so a
+ * custom profile remains isolated even if a later HOME/config-root refresh
+ * makes its path look like the current default. In the default profile the
+ * agent directory is `<home>/<configDir>/agent` and the configured legacy roots
+ * below it are still honored, exactly as before.
+ */
+export declare function resolveUserAgentDir(home: string, userAgentDir?: string): string;
+export declare function getUserSkillScanDirs(home: string, userAgentDir?: string, profileAuthority?: ProfileAuthority): string[];
 /**
  * Get project-level path for a source (cwd only).
  */
@@ -115,6 +138,8 @@ export interface ParsedAgentFields {
 export declare function parseAgentFields(frontmatter: Record<string, unknown>): ParsedAgentFields | null;
 export interface ScanSkillsFromDirOptions {
     dir: string;
+    /** Selected authority root whose own identity must not be a symlink. */
+    authorityRoot?: string;
     providerId: string;
     level: "user" | "project";
     requireDescription?: boolean;
@@ -124,7 +149,15 @@ export declare function compareSkillOrder(aName: string, aPath: string, bName: s
 export declare const SKILL_FRONTMATTER_SCAN_BYTES: number;
 /** Maximum total bytes read while seeking the frontmatter closing delimiter. */
 export declare const SKILL_FRONTMATTER_SCAN_TOTAL_BYTES: number;
+export declare const SkillDiscoveryTestHooks: {
+    afterCandidateValidated?: (candidatePath: string) => void | Promise<void>;
+    afterAuthorityRootValidated?: (root: string) => void | Promise<void>;
+    afterAuthorityRootMissing?: (root: string) => void | Promise<void>;
+    afterContainedRootValidated?: (root: string) => void | Promise<void>;
+};
 export declare function scanSkillsFromDir(_ctx: LoadContext, options: ScanSkillsFromDirOptions): Promise<LoadResult<Skill>>;
+/** Read a regular single-link file that remains contained by its configured root. */
+export declare function readContainedFile(root: string, filePath: string): Promise<string | null>;
 /**
  * Recursively expand environment variables in an object.
  */
@@ -236,6 +269,8 @@ export declare function resolveActiveProjectRegistryPath(cwd: string): Promise<s
  * never alias as the project registry.
  */
 export declare function resolveOrDefaultProjectRegistryPath(cwd: string): Promise<string | undefined>;
+/** Invalidate the exact user/project registry pair and their resolved-root cache entry. */
+export declare function invalidateClaudePluginRoots(home: string, cwd?: string): Promise<void>;
 /**
  * List installed GJC plugin roots from the GJC plugin registry and, when present,
  * the nearest project-scoped registry resolved from `cwd`.

package/dist/types/exec/bash-executor.d.ts

@@ -1,6 +1,19 @@
-import type { MinimizerOptions } from "@gajae-code/natives";
+import type { MinimizerOptions, ShellOptions, ShellRunOptions, ShellRunResult } from "@gajae-code/natives";
 import { Settings, type ShellMinimizerSettings } from "../config/settings";
 import { type TerminalArtifactPublisher } from "../session/streaming-output";
+type BashShellRunResult = ShellRunResult & {
+    signal?: string;
+};
+type Shell = {
+    run(options: ShellRunOptions, onChunk?: (error: Error | null, chunk: string) => void): Promise<BashShellRunResult>;
+    abort(): Promise<void>;
+    close(): Promise<void>;
+    isTerminal?(): boolean;
+    ready?(): Promise<void>;
+    isRunSignalActive?(signal: AbortSignal): boolean;
+};
+type ShellFactory = (options?: ShellOptions) => Shell | Promise<Shell>;
+export declare function setShellFactoryForTests(factory: ShellFactory | undefined): void;
 export interface BashArtifactSaveSummary {
     artifactId: string;
     complete: boolean;
@@ -74,6 +87,8 @@ export interface BashExecutorOptions {
 export interface BashResult {
     output: string;
     exitCode: number | undefined;
+    /** POSIX signal that terminated the isolated shell execution boundary. */
+    signal?: string;
     cancelled: boolean;
     truncated: boolean;
     totalLines: number;
@@ -97,3 +112,4 @@ export declare function disposeAllShellSessions(): Promise<void>;
 /** Translate `ShellMinimizerSettings` into native `MinimizerOptions`, or `undefined` when disabled. */
 export declare function buildMinimizerOptions(group: ShellMinimizerSettings): MinimizerOptions | undefined;
 export declare function executeBash(command: string, options?: BashExecutorOptions): Promise<BashResult>;
+export {};

package/dist/types/exec/bash-shell-guardian.d.ts

@@ -0,0 +1,15 @@
+import type { Process as NativeProcess } from "@gajae-code/natives";
+type OwnershipRecord = {
+    pid: number;
+    incarnation: string;
+    darwinUniqueId?: string | null;
+    signature: string;
+};
+export declare function parseOwnershipRecord(line: string): OwnershipRecord | undefined;
+export declare function retainOwnedProcess<T extends Pick<NativeProcess, "pid" | "incarnation">>(owned: Map<string, T>, processRef: T, guardianPid?: number): boolean;
+export declare function extendOwnedDarwinAncestry<T extends {
+    uniqueId: bigint;
+    parentUniqueId: bigint;
+}>(knownUniqueIds: Set<bigint>, candidates: ReadonlyMap<number, T>): number[];
+export declare function runBashShellGuardian(): Promise<void>;
+export {};

package/dist/types/exec/bash-shell-runtime-entry.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env bun
+export {};

package/dist/types/exec/bash-shell-signals.d.ts

@@ -0,0 +1,2 @@
+export declare function fatalCatchableSignals(): NodeJS.Signals[];
+export declare function signalExitCode(signal: NodeJS.Signals): number | undefined;

package/dist/types/exec/bash-shell-supervisor-entry.d.ts

@@ -0,0 +1 @@
+export {};