@gajae-code/coding-agent 0.17.1 → 0.17.2

package/CHANGELOG.md

@@ -2,6 +2,78 @@
 
 ## [Unreleased]
 
+## [0.17.2] - 2026-09-18
+
+### Added
+
+- Add a project-local Bash pre-tool hook example that invokes HOL Guard directly and blocks execution unless Guard classifies the command as explicitly benign with an `allow` minimum action.
+
+### Fixed
+
+- The detached-owner lifecycle suite (`gjc harness start --detach`, B1) no longer skips wholesale on non-Linux hosts. Its `tmux` is a bash fixture and its cgroup inputs are injected through `GJC_HARNESS_TEST_*`, so six of its seven cases carried no real Linux dependency yet only ever ran in CI — leaving a red `dev` undiagnosable for anyone developing on macOS. Only the case that drives the Linux-only `unsafe_service` cgroup branch stays gated.
+- An owner-routed `harness finalize` that never reaches its owner answers `{ completed: false, reason: "owner-not-live" }` with no `finalize` key, so the suite's assertion reported a bare `Received: undefined` and hid the routing reason. It now projects that reason into the assertion and names it.
+
+- The coordinator platform-capability test no longer swaps `process.platform` process-wide (which made valid native lock publication receipts look invalid before the artifact handler ran); platform discovery and refusal are now driven entirely through the resolved server platform option.
+
+- Endpoint-manager ownership is now released only after disposal and retained async authority actually settle, so a replacement endpoint can no longer be admitted while the outgoing one is still tearing down. Disposal is idempotent, rekey applies the same guard, and SDK startup rollback no longer eagerly unregisters an endpoint that has not finished disposing (#5603).
+
+- The detached SDK broker's discovery budget is now published as a composition (`BROKER_DISCOVERY_BUDGET`) instead of three module-private constants and a restated sum, and every deadline and poll on that path runs on an injectable clock. The spawn single-flight regression now spends that budget one leg at a time on a virtual clock, so each leg's cost is measured exactly and a change to any single constant fails an assertion in milliseconds instead of silently re-tuning a wall-clock race (#5604).
+
+- Added real external stdio ACP regression coverage and documented stale-broker startup-control provenance failures.
+
+- A prompt failure that reaches an ACP client now carries the classification the terminal already computed, instead of collapsing to an untyped `-32603` with `{code: "prompt_failed", details: "Prompt submission failed."}` (issue #5615). The failure's execution `phase`, its bounded origin `category`, and the provider classifier that produced it were derived at settlement and carried on the rejection, then discarded at the single JSON-RPC translation point, so a client watching a mid-session turn die could not tell a transient provider blip from a session that will never answer again without parsing an English message. The JSON-RPC code stays `-32603` (pinned ACP core-v1 conformance expects it for this class) and the redacted message is unchanged; the classification travels in `data`, which additionally exposes a derived `retryability` of `transient`, `terminal`, or `unknown` so a caller does not have to re-implement the category matrix. Only `provider_transport` is transient — the same class the shipped first-turn gate already treats as re-submittable — while a provider rejection, a deadline, and an agent runtime failure are terminal for that turn, and an uncertain attribution stays `unknown` rather than being guessed. `providerCode` is forwarded only when it is a bounded safe token and omitted otherwise, so the redaction contract still holds on this newly exposed field. Retry behaviour is unchanged.
+
+- A first-turn startup-readiness failure whose terminal carries only whitespace as final text is now retried once instead of being surfaced as a hard failure, because whitespace carries no assistant content, matching the trimmed presence contract already applied by prompt reconciliation.
+- Such a terminal no longer publishes its whitespace as an assistant message chunk alongside the retry's real answer: final-text resolution and the terminal publication gate now share one trimmed presence predicate, which also suppresses a whitespace-only final-text delta.
+
+- Chat daemon replay retention-gap concessions now warn once per session stream and gap range. Reconnect and polling duplicates are demoted to debug, while a new gap range still emits the original warning; the bounded memo prevents long-running daemons from retaining unbounded stream history (issue #5619).
+
+- Restore MiniMax-M3 reasoning on/off controls in model selection and reasoning menus for the international and China MiniMax and Coding Plan routes. Send the native `adaptive`/`disabled` switch instead of unsupported reasoning-effort or token-budget parameters, and explicitly disable thinking when the agent selects off (#5626).
+- Show MiniMax M2.x reasoning as always on rather than offering ineffective effort or off controls. Keep model-role labels and the status line consistent with these capabilities.
+- Restrict MiniMax-native thinking behavior to validated first-party HTTPS endpoints and API paths, including the resolved endpoint at request time. Custom proxies retaining a MiniMax provider ID no longer inherit the native thinking contract.
+
+- `gjc sdk serve` no longer surfaces a session-selection failure as an uncaught exception with the failure code buried in a message string. Selection failures (`not_found`, `ambiguous_session`, `endpoint_stale`, `no_live_endpoint`, `multiple_live_endpoints`) and the broker-reach failures on the same path now raise a typed error carrying a stable `code`, a broker `SdkClientError` keeps both its `code` and its `details` instead of being downgraded, and the command boundary writes a `{"ok":false,"error":{"code","message"}}` envelope to stderr — never the stdout frame channel — and exits 1 (#5633).
+- `gjc sdk serve` no longer lets broker teardown replace the failure it is reporting. A rejected `broker.close()` in the cleanup path used to overwrite the typed serve error with its own; the primary failure now always wins and the teardown failure rides alongside it as `cleanupError`. When teardown is the only thing that failed, it surfaces as a typed `serve_cleanup_failed` instead of an untyped rejection, and teardown still always runs (#5633).
+- `gjc sdk serve` no longer escapes untyped when the broker discovery record itself is unreadable. A permission, file-kind, or unsupported-state-version failure reading `<agent dir>/sdk/broker.json` used to throw past the command boundary with no stderr envelope and no exit code; it now raises the typed `broker_discovery_unreadable` with the record's path in `details`, never its token. A missing record still reports `broker_unavailable` (#5633).
+- `gjc sdk serve` no longer starts a relay on an endpoint record with an empty credential. A missing, non-string, or empty `token` used to become `""` and be written into the upstream WebSocket URL, where it resurfaced much later as a generic transport failure; it is now refused at the broker boundary with the same typed `unavailable` failure an invalid `url` already produces, before either the stdio or the socket relay starts (#5633).
+- The `gjc sdk serve` stderr envelope no longer drops the broker-teardown diagnostics it records. When a serve failure and a failing `broker.close()` coincide, the envelope now carries `error.cleanupError` alongside `code`, `message` and `details`, so an embedder can see that the session may not have been released cleanly. An envelope with no teardown failure is unchanged — the key is absent, not present and empty (#5633).
+
+- Codex session import now recognizes the same credential shapes as its sibling import scrubber. `session-import/codex.ts` listed only `ghp_` of the five GitHub token prefixes and only `AKIA` of the four AWS access-key id prefixes, and knew none of the Google, Slack, npm, GitLab, or Hugging Face shapes that `session-import/redact.ts` already covers — reaching a new session transcript verbatim from an imported Codex file. Stripe restricted keys (`rk_live_`/`rk_test_`) are included: the generic `sk` branch reached the secret-key forms only because they share that prefix. The cheap pre-check that gates the scan is widened with it so the added shapes are actually reached.
+
+- Documentation now states the real `sdk.promptDeadlineMs` default. Raising it from 30 to 60 minutes updated the schema but left both READMEs, the Japanese and Korean translations, `docs/sdk.md`, `docs/bot-integration.md`, `docs/hermes-mcp-bridge.md`, `docs/acp-local-development.md`, and the shipped `gjc-sdk-operate` skill telling SDK clients their turn dies after 30 minutes. A new parity test derives the expected figure from the schema default rather than restating it, so the next change to the default fails the build instead of silently misinforming callers (#5637).
+
+- The terminal-abort-chain test suite no longer leaks temp agent-state directories. The per-case `finally` already reclaimed the directory on the throwing path, but two paths escaped it: an `afterEach` that exceeds its hook budget is abandoned mid-await so the `finally` never runs, and a writer that outlives teardown can recreate a root the `finally` already removed. Each root is now registered on creation and swept from `afterAll`, which runs in both cases and re-sweeps after a short settle window to catch late writers. A start-of-suite reap also removes roots left by earlier runs, but only ones it can prove are abandoned: each root carries a marker naming the owning pid and host, and a root is removed only when the marker is well-formed, names this host, names a process other than the running one, that process probes as exited (`ESRCH`), and the two-hour age gate has passed. A probe the OS refuses to answer, a missing or malformed marker, and a foreign host all keep the root, so a live shard's directory is never deleted; roots written before the marker existed are consequently never reaped. Measured on macOS, where `os.tmpdir()` is `$TMPDIR` rather than `/tmp`: nine leaked roots per run before, zero after (#5665).
+
+- An ACP prompt abandoned by the inactivity watchdog now reports whether the turn's plan was still unfinished instead of collapsing into a generic internal error. The rejection keeps its `prompt_abandoned` code and message, and its JSON-RPC `data` additionally carries `planIncomplete`, `planPendingCount`, `planTotalCount`, and a bounded `planPending` list of the steps the turn never completed, so a wrapper can tell "the agent finished" from "the agent stopped with work left" instead of publishing unverified work as complete. An abandon that never observed a plan omits those fields entirely rather than guessing. A step dropped via `/todo drop` (internal status `abandoned`) counts as unfinished too, even though ACP's three-value plan status projects it as `completed` for the client's plan UI (#5669).
+
+- Compiled binaries no longer abort at startup with `SyntaxError: Unexpected identifier 'init_model_registry'`. Resolving MuPDF's embedded WASM no longer makes its module asynchronous, so the bundler keeps emitting a valid module initializer for the `model-registry`/`model-resolver` import cycle.
+
+- Managed owner admission now says why it blocked a child. A child that fails closed writes the
+  platform and the exact-evidence reader state into its durable handoff and prints one reason line
+  to stderr before exiting 75, instead of exiting silently. On platforms without the Linux-only
+  recovery-fs authority this reports `exact binding reader unsupported` rather than leaving the
+  operator with only the broker's registration-uncertain timeout.
+
+- File-lock acquisition exhaustion now reports the real liveness of a holder running on this host instead of calling every host-qualified record "liveness unknown from this host". A lock owned under this installation's current or previous host identity is probed and described as live, dead but not reaped, or indeterminate; only a genuinely foreign owner stays opaque. Reclamation authority is unchanged — the diagnostic and the stale verdict now share one host predicate so they can never disagree about whose PID a record names (#5653).
+- A file-lock holder whose record carries no host identity at all is now described as held "on an unrecorded host" instead of "on host undefined". Such a record is still treated as foreign by a host-aware acquirer — its PID is never probed and its lock is never reclaimed — so only the wording changes (#5653).
+
+- ACP prompts no longer hang forever in provider preflight. The inactivity watchdog is now armed from the moment the prompt owns the session, so a `session/prompt` blocked in `ensureProviders()` is rejected as `prompt_abandoned` — naming provider preflight as the phase — instead of reporting `running` with no output, no tool calls and no error.
+- SDK provider activation no longer retries without limit. The registration loop now has an attempt cap and a wall-clock budget, and exhaustion throws `provider_activation_exhausted` naming the contended capability, so lease contention between concurrent session hosts fails attributably instead of spinning.
+
+- Model profile activation now diagnoses a required provider this build does not know (neither a built-in provider id nor declared in `models.yml`) as a build/config mismatch with the exact provider names, instead of telling the user to run `/login` for a provider the running binary cannot serve — for example a profile authored on a newer or custom build.
+
+- npm-installed source commands no longer resolve MuPDF's embedded WASM through a monorepo-only path. Source installs let MuPDF load its adjacent sidecar, while compiled binaries keep the embedded asset used for PDF conversion.
+
+- Allow explicitly configured preset proxy routing through automatically discovered OpenCodex in activation, the preset picker, and SDK availability queries, matching upstream wire model IDs while preserving stored GJC selectors and direct-provider fallback preferences.
+
+- A prompt that reaches its SDK deadline now delivers the correlated terminal failure frame to ACP and other SDK clients instead of leaving `session/prompt` waiting behind the watchdog (issue #5583).
+- A prompt whose deadline expires while its real `agent_end` is in flight now publishes exactly one correlated terminal boundary instead of two, so SDK clients no longer see a duplicate `agent_end` for a turn that reconciled to a single durable outcome.
+- A busy session no longer republishes a terminal boundary it already delivered. The single-boundary claim is bounded by capacity, and a publisher parked on its durable writes could have its claim evicted by later turns, so its delayed `agent_end` published a second boundary for an already-terminalized correlation. A correlation with a publisher still able to reach its claim is now never evicted.
+- A prompt deadline that fails to publish its correlated diagnostic still delivers its correlated terminal boundary. The two frames were emitted as one unguarded sequence, so a failure on the first suppressed the second and left the request with no terminal frame at all; each frame is now published independently and a publication failure is logged instead of swallowed.
+- A prompt that reaches its deadline on the notification-bus route — the route a live `--mode acp` session actually uses — no longer supersedes its own expiry. Fencing the run aborts the tool that was still executing, and that tool's completion counted as fresh progress, so the expiry backed off and re-armed forever: no terminal frame ever reached the client and the durable record stayed frozen on its pending claim. Progress caused by the expiry's own abort is now discounted, while progress observed before it still protects a genuinely live prompt.
+
+- The skill-discovery genuine-emptiness case pins an empty home directory instead of reading the developer's real `~/.claude/skills`. Convention-import diagnostics from a populated home made the notice appear locally and vanish on a clean CI runner, so the case asserted opposite outcomes per machine. The contract it pins is unchanged: an explicit user-scope request that scans nothing and diagnoses nothing carries no `notice`, while the same empty environment under source `all` always scans the four bundled workflow skills and therefore explains the conjunctive filter.
+
 ## [0.17.1] - 2026-09-17
 
 ### Fixed

package/dist/types/async/job-manager.d.ts

@@ -341,14 +341,15 @@ export declare class AsyncJobManager {
      *  instead of the last-created process-global instance (review thread P1).
      *  Returns TRUE when the mapping was installed (or already held by this
      *  manager); returns FALSE when the endpoint id is already held by a
-     *  FOREIGN live manager — a second top-level session constructed or
-     *  resumed under that endpoint must then fail construction instead of
-     *  silently replacing the first manager, which would make the first
-     *  session's tools resolve the second manager and let same-id jobs be
-     *  queried, registered, or cancelled across sessions (review thread P1). */
+     *  FOREIGN manager whose authority has not fully settled — a second
+     *  top-level session constructed or resumed under that endpoint must then
+     *  fail construction instead of silently replacing the first manager, which
+     *  would make the first session's tools resolve the second manager and let
+     *  same-id jobs be queried, registered, or cancelled across sessions
+     *  (review thread P1). */
     static registerForEndpoint(endpointId: string, manager: AsyncJobManager): boolean;
     static forEndpoint(endpointId: string | undefined): AsyncJobManager | undefined;
-    static unregisterForEndpoint(endpointId: string): void;
+    static unregisterForEndpoint(endpointId: string, manager?: AsyncJobManager): void;
     /** Reverse lookup: the endpoint this manager is registered under, if any
      *  (review thread P1 — endpoint-scoped lineage resolution). */
     static endpointIdOf(manager: AsyncJobManager | undefined): string | undefined;

package/dist/types/config/autorouting-tier-map.d.ts

@@ -820,6 +820,9 @@ export declare const TIER_MAP_SKIP_LIST: {
     readonly "opencode-go/qwen3.8-max": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };
+    readonly "opencode-go/union-alpha": {
+        readonly rationale: "stealth model; capability tier not yet independently reviewed";
+    };
     readonly "opencode-zen/grok-4.6": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };
@@ -835,6 +838,9 @@ export declare const TIER_MAP_SKIP_LIST: {
     readonly "opencode-zen/nemotron-3.5-lightning-free": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };
+    readonly "opencode-zen/union-alpha": {
+        readonly rationale: "stealth model; capability tier not yet independently reviewed";
+    };
     readonly "openrouter/anthropic/claude-fable-5:batch": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };

package/dist/types/config/file-lock.d.ts

@@ -6,6 +6,7 @@ export interface FileLockOptions {
     retryDelayMs?: number;
     signal?: AbortSignal;
     onAcquired?: () => void;
+    onContended?: () => void;
     /** Stable host identity required to safely reclaim locks on a shared volume. */
     ownerHostId?: string;
     /** Previous local host identities accepted only when deciding stale-owner reclamation. */

package/dist/types/config/model-profile-activation.d.ts

@@ -1,5 +1,5 @@
 import { ThinkingLevel } from "@gajae-code/agent-core";
-import type { Api, Model } from "@gajae-code/ai/core";
+import { type Api, type Model } from "@gajae-code/ai/core";
 import type { AgentSession, DefaultFallbackRuntimeState } from "../session/agent-session";
 import { type ModelProfileDefinition } from "./model-profiles";
 export { resolveModelProfileName } from "./model-profile-contract";
@@ -42,7 +42,7 @@ type ConfiguredModelChainState = {
 };
 export interface PrepareModelProfileActivationOptions {
     session: ModelProfileActivationSession;
-    modelRegistry: Pick<ModelRegistry, "getModelProfile" | "getModelProfiles" | "getAvailableModelProfileNames" | "getApiKeyForProvider" | "getAll" | "resolveCanonicalModel" | "getCanonicalVariants" | "getCanonicalId"> & Partial<Pick<ModelRegistry, "getAvailable" | "getAvailableForProfileActivation" | "resolveModelByLookupAlias" | "lookupAliasExists" | "clearCanonicalVariant" | "seedCanonicalVariant" | "getSessionCanonicalVariant" | "restoreSessionCanonicalVariant" | "getConfiguredProviderIds">> & {
+    modelRegistry: Pick<ModelRegistry, "getModelProfile" | "getModelProfiles" | "getAvailableModelProfileNames" | "getApiKeyForProvider" | "getAll" | "resolveCanonicalModel" | "getCanonicalVariants" | "getCanonicalId"> & Partial<Pick<ModelRegistry, "getAvailable" | "getAvailableForProfileActivation" | "resolveModelByLookupAlias" | "lookupAliasExists" | "clearCanonicalVariant" | "seedCanonicalVariant" | "getSessionCanonicalVariant" | "restoreSessionCanonicalVariant" | "getConfiguredProviderIds" | "isKnownProvider">> & {
         getError?: ModelRegistry["getError"];
     };
     settings: Pick<Settings, "get" | "getGlobal" | "getOverride">;
@@ -123,13 +123,28 @@ export interface MaterializeModelProfileAssignmentsOptions {
 export declare function materializeActiveModelProfileAssignment(options: MaterializeModelProfileAssignmentOptions): boolean;
 export declare function materializeActiveModelProfileAssignments(options: MaterializeModelProfileAssignmentsOptions): boolean;
 export declare class ModelProfileCredentialError extends Error {
-    readonly code = "authentication_failed";
+    readonly code: string;
     readonly profileLabel: string;
     readonly providers: readonly string[];
     readonly role: string | undefined;
     constructor(profileLabel: string, providers: readonly string[], role?: string);
 }
 export declare function formatModelProfileCredentialError(profileLabel: string, providers: readonly string[]): string;
+export declare function formatModelProfileUnknownProviderError(profileLabel: string, providers: readonly string[]): string;
+/**
+ * A required profile provider that this build cannot know: it is neither a
+ * built-in provider id nor declared in models.yml. That is a build/config
+ * mismatch (for example a profile authored on a newer or custom build), not a
+ * credential gap, so the diagnosis must not send the user to /login.
+ *
+ * Extends {@link ModelProfileCredentialError} so existing startup recovery
+ * (interactive toast-and-continue) keeps working with the sharper message.
+ */
+export declare class ModelProfileUnknownProviderError extends ModelProfileCredentialError {
+    readonly code = "unknown_provider";
+    constructor(profileLabel: string, providers: readonly string[], role?: string);
+}
+export declare function isModelProfileProxyConfigured(provider: string, configuredProviders: readonly string[] | undefined, credentialless: boolean): boolean;
 /**
  * Resolve the explicitly configured OpenAI-compatible proxy provider id for a
  * preset. Returns undefined when unset or empty. Passwords/labels are never

package/dist/types/config/model-registry.d.ts

@@ -406,6 +406,15 @@ export declare class ModelRegistry {
     getAll(): Model<Api>[];
     /** Provider ids declared in models.yml, including override-only providers. */
     getConfiguredProviderIds(): readonly string[];
+    /**
+     * Whether this registry can serve a provider id from any active source.
+     *
+     * Built-in providers are backed by the bundled AI catalog, configured
+     * providers come from models.yml, and extension registrations are retained
+     * in the runtime provider stores below. Runtime model/override state is
+     * included for direct registrations that do not have an extension source id.
+     */
+    isKnownProvider(provider: string): boolean;
     /**
      * Deterministic provider priority for autorouting tier generation: configured
      * `modelProviderOrder` first, then first-wins catalog order.

package/dist/types/coordinator-mcp/server.d.ts

@@ -62,6 +62,9 @@ interface CoordinatorServices {
     canonicalizePath?: (value: string) => Promise<string>;
     codexTransportFactory?: CodexTransportFactory;
     eventWebhookDelivery?: WebhookDelivery;
+    /** Observable transitions for consumers coordinating with the filesystem-backed event wait. */
+    onCoordinatorEventWatchReady?: () => void;
+    onCoordinatorEventWake?: () => void;
     /** Test barrier invoked after an accepted prompt receipt is durable and before turn finalization. */
     afterPromptReceiptPersisted?: (sessionId: string) => void | Promise<void>;
     /** Test barrier invoked after an answer dispatch is claimed and before its final admission check. */

package/dist/types/modes/acp/acp-agent.d.ts

@@ -1,5 +1,6 @@
 import { type Agent, type AgentSideConnection, type AuthenticateRequest, type AuthenticateResponse, type AvailableCommand, type CancelNotification, type ClientCapabilities, type CloseSessionRequest, type CloseSessionResponse, type DeleteSessionRequest, type DeleteSessionResponse, type ForkSessionRequest, type ForkSessionResponse, type InitializeRequest, type InitializeResponse, type ListSessionsRequest, type ListSessionsResponse, type LoadSessionRequest, type LoadSessionResponse, type NewSessionRequest, type NewSessionResponse, type PromptRequest, type PromptResponse, type ResumeSessionRequest, type ResumeSessionResponse, type SetSessionConfigOptionRequest, type SetSessionConfigOptionResponse, type SetSessionModeRequest, type SetSessionModeResponse } from "@agentclientprotocol/sdk";
-import { type AcpProviderRegistration, type AcpReverseConnection, AcpSdkAdapter } from "../../sdk/acp";
+import { type AcpProviderRegistration, type AcpReverseConnection, AcpSdkAdapter, AcpSdkAdapterError } from "../../sdk/acp";
+import type { SdkPromptTerminalOutcome } from "../../sdk/prompt-status";
 import { type PromptWatchdogClock } from "../../sdk/prompt-watchdog";
 import type { AcpStartupOptions } from "./startup-options";
 /**
@@ -43,6 +44,44 @@ export declare function paginateAcpSessions(listed: unknown[], cwd: string | und
 }>): ListSessionsResponse;
 /** Build the ACP command palette from the shared builtins and live SDK skill state. */
 export declare function acpAvailableCommandsFromSkills(query: unknown): AvailableCommand[];
+type SdkPromptFailedOutcome = Extract<SdkPromptTerminalOutcome, {
+    kind: "failed";
+}>;
+/**
+ * A prompt rejection that still carries the terminal's structured failure classification.
+ * The ACP client sees only the code and message, but the first-turn retry gate must decide on
+ * what the terminal actually proved — the failure's execution phase and its bounded origin
+ * category — so settlement carries that classification instead of discarding it into a bare
+ * `AcpSdkAdapterError` (review P1, issue #5574).
+ */
+export declare class AcpPromptFailureError extends AcpSdkAdapterError {
+    readonly failure: SdkPromptFailedOutcome;
+    constructor(failure: SdkPromptFailedOutcome);
+}
+/**
+ * What an ACP `plan` update said the turn intended to do. Structural rather than the SDK's
+ * `PlanEntry` so only the fields this evidence reads are depended on.
+ */
+type AcpPlanSnapshot = Array<{
+    content: string;
+    status: "pending" | "in_progress" | "completed";
+    _meta?: {
+        gjcTodoStatus?: unknown;
+    } | null;
+}>;
+/**
+ * An abandoned prompt that still carries the plan its turn was working through (issue #5669).
+ *
+ * The watchdog settles a prompt whose host stopped producing frames, and that rejection used to
+ * be a bare `AcpSdkAdapterError`: `{code, details}` and nothing else. A wrapper could not tell
+ * "the agent finished" from "the agent stopped with work left", so an abandoned turn's unverified
+ * diff was published as if it were complete. The last observed plan is the evidence that settles
+ * that question, so settlement carries it instead of dropping it at the JSON-RPC boundary.
+ */
+export declare class AcpPromptAbandonedError extends AcpSdkAdapterError {
+    readonly plan: AcpPlanSnapshot | undefined;
+    constructor(code: string, message: string, plan: AcpPlanSnapshot | undefined);
+}
 export type TranscriptReplayBlock = {
     type: "text";
     text: string;

package/dist/types/modes/components/thinking-selector.d.ts

@@ -1,4 +1,5 @@
 import { type ThinkingLevel as ThinkingLevelValue } from "@gajae-code/agent-core";
+import type { Model } from "@gajae-code/ai/types";
 import { Container, SelectList } from "@gajae-code/tui";
 export interface ThinkingSelectorSelection {
     level: ThinkingLevelValue;
@@ -9,7 +10,7 @@ export interface ThinkingSelectorSelection {
  */
 export declare class ThinkingSelectorComponent extends Container {
     #private;
-    constructor(currentLevel: ThinkingLevelValue | undefined, availableLevels: ThinkingLevelValue[], onSelect: (selection: ThinkingSelectorSelection) => void, onCancel: () => void);
+    constructor(currentLevel: ThinkingLevelValue | undefined, availableLevels: ThinkingLevelValue[], onSelect: (selection: ThinkingSelectorSelection) => void, onCancel: () => void, model?: Model);
     handleInput(data: string): void;
     getSelectList(): SelectList;
 }

package/dist/types/sdk/acp/adapter.d.ts

@@ -3,6 +3,33 @@ import type { AbortScope } from "../host/control/operations";
 import { type SessionAttachment, type SessionRouter } from "../router";
 import { ACP_SESSION_RECONNECT } from "../session-reconnect";
 import type { SessionLifecycleMcpServer } from "./mcp";
+/**
+ * Registration rounds one provider activation may spend chasing a moving attachment.
+ *
+ * The activation loop restarts whenever the Router attachment changes identity while it
+ * is registering, because the leases it just took belong to a connection that no longer
+ * exists. One reconnect costs one restart, so a handful covers any churn that is actually
+ * converging; beyond that the attachment is rotating faster than registration completes
+ * and another round only re-takes leases that will be invalidated again. Bounding this is
+ * what turns "many session hosts contend for one agent dir" from an unbounded spin into a
+ * reported failure (issue #5658).
+ */
+export declare const PROVIDER_ACTIVATION_MAX_ATTEMPTS = 8;
+/**
+ * Wall-clock budget for the same loop.
+ *
+ * The attempt cap alone bounds rounds, not time: every round is a `#requestSession` round
+ * trip per provider, so under lease contention attempts are slow rather than fast-spinning
+ * and eight of them can still outlast the caller. The budget is sized to a third of
+ * {@link ACP_PROMPT_INACTIVITY_TIMEOUT_MS} so a prompt stalled in provider preflight fails
+ * with this error — which names the contended capability — with room to spare before the
+ * ACP prompt watchdog reports the same stall as undifferentiated silence.
+ *
+ * It gates *starting* another round, never interrupting one in flight: a single slow but
+ * healthy registration keeps whatever time it needs, and only a retry decided after the
+ * deadline is refused.
+ */
+export declare const PROVIDER_ACTIVATION_BUDGET_MS: number;
 type JsonObject = Record<string, unknown>;
 /** The small agent-side ACP surface used for reverse requests. */
 export interface AcpReverseConnection {

package/dist/types/sdk/acp/final-text.d.ts

@@ -16,4 +16,12 @@ export type AcpFinalTextResolution = {
 };
 export declare function boundAcpFinalText(value: string): BoundedAcpFinalText;
 export declare function acpFinalTextFromMessage(message: unknown): BoundedAcpFinalText;
+/**
+ * Assistant-content presence is trimmed everywhere in the prompt pipeline: whitespace carries no
+ * assistant content. The ACP retry gate, prompt reconciliation
+ * (`sdk/bus/prompt-reconciliation.ts`) and terminal publication must agree, otherwise a terminal
+ * the retry gate treats as "no output" can still publish a whitespace chunk alongside the retry's
+ * real answer (review P2 on #5628).
+ */
+export declare function hasAcpFinalTextContent(value: string): boolean;
 export declare function resolveAcpFinalText(streamed: string, finalText: string): AcpFinalTextResolution;

package/dist/types/sdk/broker/ensure.d.ts

@@ -28,6 +28,51 @@ export interface EnsureBrokerSettings {
      */
     env?: NodeJS.ProcessEnv;
 }
+export interface BrokerStartupLockTestHooks {
+    onAcquired?: () => void;
+    onContended?: () => void;
+}
+/**
+ * Test-only phase observation for detached broker startup regressions. The
+ * signal is opt-in through the child environment and never affects broker
+ * ownership or error handling when the test seam is absent.
+ */
+export declare function emitBrokerStartupTestSignal(signal: string): Promise<void>;
+/**
+ * The parent discovery budget published as a composition rather than a number.
+ * A test that stages a fence contention has to time itself against these legs,
+ * and retyping the sum makes it win or lose on scheduler noise while letting a
+ * change to any single leg silently re-tune it (#5604). This is the one source
+ * of truth for how the budget is built; nothing may restate the arithmetic.
+ */
+export declare const BROKER_DISCOVERY_BUDGET: {
+    readonly staleRetirementMs: 5000;
+    readonly startupLockWaitMs: 9000;
+    readonly publicationMs: 15000;
+    /** What the startup fence grants its holder: retirement plus one publication attempt. */
+    readonly fenceOperationMs: number;
+    /**
+     * When a child spawned under the parent's spawn lock gives up on the fence,
+     * measured from that lock acquisition: the parent retires the stale incumbent
+     * first, then the child exhausts its own fence wait. Not a production
+     * constant -- an emergent property of the two legs that precede publication.
+     */
+    readonly childFenceWaitMs: number;
+    readonly discoveryMs: number;
+};
+/**
+ * Clock the discovery budget is measured on. The default is the real one; a test
+ * installs a virtual clock to assert the composition order -- stale retirement,
+ * then the child fence, then startup and publication -- in-process instead of
+ * racing three wall clocks against each other (#5604). Reaping keeps its own
+ * {@link ReapTiming} seam and is deliberately not driven from here.
+ */
+export interface EnsureBrokerTiming {
+    now(): number;
+    sleep(ms: number): Promise<void>;
+}
+/** Test hook: drives the discovery budget on a controllable clock. */
+export declare function setEnsureBrokerTimingForTest(timing: EnsureBrokerTiming | undefined): void;
 type SpawnLockOptions = Pick<FileLockOptions, "retries" | "retryDelayMs" | "signal">;
 declare function readBrokerDiscoveryBeforeDeadline(agentDir: string, heartbeatTtlMs: number | undefined, deadline: number): Promise<BrokerDiscovery | null>;
 /**
@@ -48,7 +93,7 @@ declare function acquireSpawnLock(agentDir: string, options?: SpawnLockOptions):
  * The parent-held spawn lock prevents ordinary stampedes; this second fence keeps
  * startup single-flight if that detached child's launcher dies and its lock is reclaimed.
  */
-export declare function withBrokerStartupLock<T>(agentDir: string, operation: (deadline: number) => Promise<T>): Promise<T>;
+export declare function withBrokerStartupLock<T>(agentDir: string, operation: (deadline: number) => Promise<T>, testHooks?: BrokerStartupLockTestHooks): Promise<T>;
 /**
  * Tail of the detached broker's stderr folded into a discovery failure.
  *

package/dist/types/sdk/prompt-deadline-manager.d.ts

@@ -21,7 +21,7 @@ export declare class PromptDeadlineManager {
         getLeaseMs: () => number;
         getMaxMs: () => number;
         now?: () => number;
-        onExpired?: (correlation: InvocationCorrelation) => void;
+        onExpired?: (correlation: InvocationCorrelation, outcome?: PromptDeadlineOutcome) => void;
     });
     onAccepted(correlation: InvocationCorrelation): void;
     /** Re-arm a durable uncertainty-recovery record after process startup without

package/dist/types/sdk/prompt-failure.d.ts

@@ -3,7 +3,7 @@
  * Provider error text is retained only in the local diagnostic log; wire and
  * persisted reconciliation details expose a fixed redacted message.
  */
-import type { SdkPromptFailureCategory, SdkPromptFailurePhase, SdkPromptTerminalOutcome } from "./prompt-status";
+import type { SdkPromptFailureCategory, SdkPromptFailurePhase, SdkPromptFailureRetryability, SdkPromptTerminalOutcome } from "./prompt-status";
 export declare const PROMPT_FAILURE_CODE_MAX = 64;
 export declare const PROMPT_FAILURE_MESSAGE_SUBMISSION = "Prompt submission failed.";
 export declare const PROMPT_FAILURE_MESSAGE_POST_START_PROVIDER = "Provider failure after execution started.";
@@ -23,6 +23,35 @@ export declare function promptFailurePhase(evidence: PromptFailureEvidence): Sdk
 export declare function isSdkPromptFailurePhase(value: unknown): value is SdkPromptFailurePhase;
 /** Allowlisted origin category for a bounded safe classifier + provenance. */
 export declare function promptFailureCategory(code: string | undefined, provenance: "agent_failed" | "deadline"): SdkPromptFailureCategory;
+/**
+ * Whether the bounded category says an identical re-submission could still
+ * succeed. Read off the category alone, so it cannot drift from the sets above.
+ *
+ * `provider_transport` is the only transient class: every classifier in
+ * `PROVIDER_TRANSPORT_CODES` (and the 5xx range) describes the link to the
+ * provider failing, never a judgement about the request, so the same bytes may
+ * well succeed on a second attempt. That is exactly the class the shipped
+ * first-turn gate (`isStartupReadinessFailure`, issue #5574) already treats as
+ * re-submittable, so the wire signal and the internal gate stay in agreement.
+ *
+ * Everything else is terminal for this turn: `provider_rejected` is the provider
+ * judging this request (quota, refusal, 4xx) and re-sending it reproduces the
+ * rejection; `deadline` means the turn's budget is spent, which a re-submit does
+ * not restore; `agent_runtime` is a local fault that re-running the same prompt
+ * re-enters. `unknown` stays `unknown` — the module's standing contract is to
+ * preserve uncertain attribution rather than guess a recovery for it.
+ *
+ * This is advisory classification for the caller, not a retry gate: nothing in
+ * this repo's retry paths consults it.
+ */
+export declare function promptFailureRetryability(category: SdkPromptFailureCategory): SdkPromptFailureRetryability;
+/**
+ * Whether a value is a safe bounded classifier token — the same rule
+ * `sanitizePromptFailure` and `assistantFailureCode` apply before retaining one.
+ * Anything else is provider text rather than a classifier and must not be
+ * forwarded to a caller.
+ */
+export declare function isSafePromptFailureCode(value: unknown): value is string;
 /**
  * Phase- and category-aware safe wording. A post-start failure is never
  * described as a submission rejection; the wording says only what the bounded

package/dist/types/sdk/prompt-status.d.ts

@@ -65,6 +65,14 @@ export type SdkPromptFailurePhase = "submission" | "post_start";
  * attribution is uncertain instead of guessing.
  */
 export type SdkPromptFailureCategory = "provider_transport" | "provider_rejected" | "agent_runtime" | "deadline" | "unknown";
+/**
+ * Whether the failure class says an identical re-submission could still succeed.
+ * Derived from `SdkPromptFailureCategory` alone (see `promptFailureRetryability`)
+ * so a consumer never has to re-implement the category matrix or parse a message.
+ * `unknown` is preserved rather than collapsed into `terminal`: an uncertain
+ * attribution is not evidence that the turn is unrecoverable.
+ */
+export type SdkPromptFailureRetryability = "transient" | "terminal" | "unknown";
 export type SdkPromptTerminalOutcome = {
     kind: "stopped";
     reason: SdkPromptStopReason;

package/dist/types/sdk/router/replay-retention-gap-cache.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Retention-gap concessions are durable stream facts, but a Router can observe
+ * many streams over its lifetime. Keep the warning memo bounded while retaining
+ * enough recent coordinates to suppress reconnect/poll duplicates.
+ */
+export declare const REPLAY_CONCESSION_CACHE_LIMIT = 1024;
+/**
+ * Records one stream/gap coordinate in an LRU memo.
+ *
+ * `undefined` means this is the first observation; a number is the duplicate
+ * count after the coordinate was already observed.
+ */
+export declare function rememberReplayRetentionGap(cache: Map<string, number>, key: string): number | undefined;

package/dist/types/sdk/transport/serve-cli.d.ts

@@ -1,4 +1,31 @@
 import { SdkClient } from "../client";
+/**
+ * A `gjc sdk serve` operational failure with a stable machine-readable code and a
+ * documented exit code, mirroring `SdkSessionCliError`. Usage errors keep their own
+ * `CliParseError` path; this type covers only failures an embedder must branch on.
+ */
+export declare class SdkServeError extends Error {
+    readonly code: string;
+    readonly exitCode: 1;
+    readonly details?: unknown;
+    /**
+     * Diagnostics for a broker-teardown failure that happened alongside this primary
+     * failure. It rides beside `details` rather than inside it because `details`
+     * carries the broker's own error payload verbatim and embedders already read it.
+     */
+    cleanupError?: {
+        code: string;
+        message: string;
+    };
+    constructor(code: string, message: string, exitCode: 1, details?: unknown);
+}
+/**
+ * Combines the serve body's failure with the broker-teardown failure. The primary
+ * failure always wins — a rejected teardown only ever rides along as diagnostics, it
+ * never replaces the error an embedder branches on — and a teardown that fails on its
+ * own still leaves typed. Exported for tests.
+ */
+export declare function resolveServeOutcome(primary: Error | undefined, cleanup: Error | undefined): Error | undefined;
 /** Resolves the pending ceiling with flag > env > default precedence; exported for tests. */
 export declare function resolveServePendingCeiling(flagValue: string | undefined, envValue: string | undefined): number;
 type BrokerSessionRow = {

package/dist/types/thinking.d.ts

@@ -1,7 +1,9 @@
 import { type ResolvedThinkingLevel, ThinkingLevel } from "@gajae-code/agent-core/thinking";
 import { type Effort } from "@gajae-code/ai/model-thinking";
 import type { Model } from "@gajae-code/ai/types";
-export { getThinkingLevelMetadata, type ThinkingLevelMetadata } from "./thinking-metadata";
+import { type ThinkingLevelMetadata } from "./thinking-metadata";
+export type { ThinkingLevelMetadata } from "./thinking-metadata";
+export declare function getThinkingLevelMetadata(level: ThinkingLevel, model?: Model): ThinkingLevelMetadata;
 /**
  * Parses a provider-facing effort value.
  */

package/dist/types/utils/mupdf-wasm-embedded.d.ts

@@ -0,0 +1,2 @@
+import mupdfWasmPath from "../../../../node_modules/mupdf/dist/mupdf-wasm.wasm";
+export default mupdfWasmPath;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.17.1",
+	"version": "0.17.2",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -55,12 +55,12 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
-		"@gajae-code/agent-core": "0.17.1",
-		"@gajae-code/ai": "0.17.1",
-		"@gajae-code/natives": "0.17.1",
-		"@gajae-code/stats": "0.17.1",
-		"@gajae-code/tui": "0.17.1",
-		"@gajae-code/utils": "0.17.1",
+		"@gajae-code/agent-core": "0.17.2",
+		"@gajae-code/ai": "0.17.2",
+		"@gajae-code/natives": "0.17.2",
+		"@gajae-code/stats": "0.17.2",
+		"@gajae-code/tui": "0.17.2",
+		"@gajae-code/utils": "0.17.2",
 		"@mozilla/readability": "^0.6.0",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",