@gajae-code/coding-agent 0.17.6 → 0.17.7

package/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 ## [Unreleased]
 
+## [0.17.7] - 2026-09-25
+
+### Added
+
+- Add versioned durable ownership storage and transcript markers for transactional model-profile changes.
+
+- Add an opt-in, off-by-default transient Kev delegation notice from bounded local aggregates, including remaining context budget ratio and the pending/in-progress task count in the largest plan phase. A successful todo update with at least three active steps in one phase can trigger a hint. It does not alter prompts, task arguments, or saved sessions; enforcement and decision telemetry are not included.
+
+### Changed
+
+- Require explicit replacement before deleting a profile owned by a durable default or active session.
+
+### Fixed
+
+- Initialize owned SDK model catalogs with final scoped settings before the first catalog pass.
+
+- Initialize owned SDK model registries once with scoped settings, and keep source-host construction within owner-bound readiness cancellation and rollback.
+
+- SDK `session.list` retries one complete identity-bound scan after a concurrent transcript change and returns a path-free, target-correlated reason if selection still fails; exact saved-session lookups cannot be mixed with page cursors, and resolution remains fail-closed (#5887).
+
+- Preserve pre-session rollback proof when theme startup is interrupted and revoke published readiness markers through bounded off-thread cleanup.
+
+- Interactive sessions now expose their own async-job snapshot to extensions and the SDK, so `runtime.jobs.list` reports the session's running jobs, recent jobs, and pending delivery instead of failing with `resource_gone`.
+- `gjc sdk session` failures caused by a typed `resource_gone` now carry a fixed diagnostic that distinguishes absent resource state from an empty result, without changing the public error code, retryability, or exit code.
+
+- SDK lifecycle failures caused by a broker idempotency conflict now carry a single fixed public diagnostic (`lifecycle_idempotency_conflict`) in both JSON and text command-error output, so an operator can tell a conflict from an ordinary `operation_failed` without the broker's raw message, paths, or credentials reaching the envelope. The diagnostic text names no cause and does not suggest that another request key is safe. The public failure code, effect proof, retryability, and exit code are unchanged.
+- `gjc sdk session raw global --op session.lookup` no longer prints the broker's own idempotency-conflict message. That route returns its structured outcome directly, so it bypasses the public error envelope and its 8192-byte budget, and a hostile or oversized broker message could expose request keys, paths, or credentials in CLI output. The exact `idempotency_conflict` code now carries the same fixed, cause-neutral text as the public diagnostic; lookup status, error code, certainty, reconciliation guidance, and exit code are unchanged, and every other lookup code is left untouched.
+
+- `session.lookup` for a `session.create` now recovers the recorded outcome when the lookup target matches the create target. The broker fingerprinted the raw lookup target while the create path fingerprinted its normalized input (resolved `cwd` plus the derived `stateRoot`), so every lookup reported `idempotency_conflict` and callers could not reconcile a lost create acknowledgement. Lookup targets now pass through the same normalization before fingerprinting; a genuinely different target still conflicts, and an invalid lookup target is rejected as `invalid_input`. Create rows recorded before target-bound identities, which carry a raw-target fingerprint, stay recoverable: lookup falls back to the raw fingerprint only for that exact legacy identity (#5933).
+
+- Answer an SDK `turn.prompt`/`turn.abort_and_prompt` submitted to a session with no selected model with the typed `model_not_selected` control error and a fixed public message, instead of a generic `internal` failure. The local onboarding guidance (providers, commands, environment variables, setup paths) stays local-only and is not published on the control protocol, missing credentials and arbitrary exceptions keep their existing generic classification, and the rejection still happens before admission so no turn is accepted.
+
+- Remove per-process test agent and log isolation directories after each Bun test file completes, while keeping the isolated log sink available throughout the run. Set `GJC_TEST_KEEP_TMP=1` to preserve per-file test sandboxes and their isolated state for debugging, including failed preload initialization (#5852).
+
 ## [0.17.6] - 2026-09-24
 
 ### Fixed

package/dist/types/cli/public-command-errors.d.ts

@@ -75,8 +75,10 @@ export type PublicEvidenceStatus = {
 };
 export declare const PUBLIC_COMMAND_DIAGNOSTICS: {
     readonly macos_nofile_limit_low: "The macOS open-file limit is below the recommended minimum; increase it before starting additional concurrent work.";
+    readonly sdk_resource_gone: "The requested resource is not available from this session endpoint; this reports absent resource state, not an empty result.";
     readonly router_cleanup_failed: "SDK session Router cleanup failed.";
     readonly broker_cleanup_failed: "SDK broker client cleanup failed.";
+    readonly lifecycle_idempotency_conflict: "The broker reported an idempotency conflict. Reconcile existing lifecycle state before deciding whether another request is safe.";
     readonly usage_transport_exclusive: "Specify exactly one of --stdio or --socket <path>.";
     readonly usage_duplicate_option: "Each option on this command may occur at most once.";
     readonly usage_unknown_argument: "An unrecognized argument was supplied; re-read the command help for its accepted grammar.";

package/dist/types/commands/sdk.d.ts

@@ -1,7 +1,9 @@
 import { Command } from "@gajae-code/utils/cli";
 import type { Args as ParsedArgs } from "../cli/args";
 import { applyStartupModelProfiles } from "../main";
-import { type SessionLifecycleLaunchRequest } from "../sdk/broker/lifecycle";
+import { initTheme } from "../modes/theme/theme";
+import { type SessionLifecycleLaunchRequest, writeSessionLifecycleReady } from "../sdk/broker/lifecycle";
+import { createLifecycleAgentSession } from "../sdk/lifecycle-session";
 import { SessionManager } from "../session/session-manager";
 export declare function lifecycleArgs(request: SessionLifecycleLaunchRequest, cwd: string, agentDir: string): Promise<ParsedArgs>;
 /**
@@ -119,6 +121,10 @@ export declare function runSessionHost(timing?: {
     cwd?: string;
     processIncarnation?: (pid: number) => string | undefined;
     applyStartupModelProfiles?: typeof applyStartupModelProfiles;
+    initTheme?: typeof initTheme;
+    createLifecycleAgentSession?: typeof createLifecycleAgentSession;
+    writeSessionLifecycleReady?: typeof writeSessionLifecycleReady;
+    writeMcpConfig?: (filePath: string, contents: string) => Promise<number>;
 }): Promise<void>;
 export type SdkInternalArgv = {
     action: "broker-internal";

package/dist/types/config/model-profile-ownership.d.ts

@@ -0,0 +1,74 @@
+import type { SettingsAtomicPatch } from "./settings";
+export type ModelProfileOwnershipMarker = {
+    kind: "inherit";
+} | {
+    kind: "cleared";
+} | {
+    kind: "profile";
+    profile: string;
+};
+export interface DurableModelProfileOwnership {
+    schemaVersion: 1;
+    version: number;
+    marker: ModelProfileOwnershipMarker;
+}
+export interface ModelProfileOwnershipSettings {
+    getGlobal(path: "modelProfile.ownership" | "modelProfile.default"): unknown;
+}
+export interface DurableModelProfileOwnershipCommit {
+    ownership: DurableModelProfileOwnership;
+    wrote: boolean;
+}
+export interface DurableModelProfileOwnershipStore extends ModelProfileOwnershipSettings {
+    commitAtomicBatchWithCurrent(buildPatches: (current: Readonly<Record<string, unknown>>) => Promise<readonly SettingsAtomicPatch[]> | readonly SettingsAtomicPatch[]): Promise<unknown>;
+}
+export declare const MODEL_PROFILE_OWNERSHIP_ENTRY = "model_profile_ownership";
+export declare function validateModelProfileOwnershipMarker(value: unknown): ModelProfileOwnershipMarker | undefined;
+export declare function validateDurableModelProfileOwnership(value: unknown): DurableModelProfileOwnership | undefined;
+export declare class InvalidModelProfileOwnershipError extends Error {
+    readonly code = "model_profile_ownership_invalid";
+    constructor();
+}
+export declare class UnresolvedModelProfileOwnershipError extends Error {
+    readonly profileName: string;
+    readonly code = "model_profile_unresolved";
+    constructor(profileName: string);
+}
+export declare class ModelProfileReplacementRequiredError extends Error {
+    readonly profileName: string;
+    readonly code = "model_profile_replacement_required";
+    constructor(profileName: string);
+}
+export declare class ModelProfileOwnershipConflictError extends Error {
+    readonly expectedVersion: number;
+    readonly actualVersion: number;
+    readonly actualMarker?: ModelProfileOwnershipMarker | undefined;
+    readonly code = "model_profile_ownership_conflict";
+    constructor(expectedVersion: number, actualVersion: number, actualMarker?: ModelProfileOwnershipMarker | undefined);
+}
+export declare class ModelProfileApplyCommittedError extends Error {
+    readonly profileName: string;
+    readonly committedVersion: number;
+    readonly code = "model_profile_apply_committed";
+    constructor(profileName: string, committedVersion: number, cause: unknown);
+}
+export interface ProfileOwnershipChangedEvent {
+    type: "profile_ownership_changed";
+    transitionId: string;
+    source: "session" | "durable" | "recovery";
+    oldMarker: ModelProfileOwnershipMarker;
+    newMarker: ModelProfileOwnershipMarker;
+    oldSessionId: string;
+    sessionId: string;
+    observedDurableVersion: number;
+    committedDurableVersion?: number;
+    outcome: "committed" | "failed" | "reconciled";
+}
+export declare function readDurableModelProfileOwnership(settings: ModelProfileOwnershipSettings): DurableModelProfileOwnership;
+export declare function readDurableModelProfileOwnershipFromRaw(raw: Readonly<Record<string, unknown>>): DurableModelProfileOwnership;
+export declare function resolveEffectiveModelProfileMarker(sessionMarker: ModelProfileOwnershipMarker | undefined, durable: DurableModelProfileOwnership): ModelProfileOwnershipMarker;
+export declare function resolveOwnedModelProfileName(marker: ModelProfileOwnershipMarker, profiles: ReadonlyMap<string, unknown>): string | undefined;
+export declare function nextDurableModelProfileOwnership(current: DurableModelProfileOwnership, marker: ModelProfileOwnershipMarker): DurableModelProfileOwnership;
+export declare function commitDurableModelProfileOwnershipWithResult(settings: DurableModelProfileOwnershipStore, marker: ModelProfileOwnershipMarker, extraPatches?: readonly SettingsAtomicPatch[], validateCurrent?: () => Promise<void> | void, observedOwnership?: DurableModelProfileOwnership): Promise<DurableModelProfileOwnershipCommit>;
+export declare function commitDurableModelProfileOwnership(settings: DurableModelProfileOwnershipStore, marker: ModelProfileOwnershipMarker, extraPatches?: readonly SettingsAtomicPatch[], validateCurrent?: () => Promise<void> | void, observedOwnership?: DurableModelProfileOwnership): Promise<DurableModelProfileOwnership>;
+export declare function modelProfileOwnershipMarkersEqual(left: ModelProfileOwnershipMarker | undefined, right: ModelProfileOwnershipMarker | undefined): boolean;

package/dist/types/config/model-registry.d.ts

@@ -367,7 +367,7 @@ export declare class ModelRegistry {
     /**
      * @param authStorage - Auth storage for API key resolution
      */
-    constructor(authStorage: AuthStorage, modelsPath?: string, registrySettings?: Pick<Settings, "get" | "getGlobal">, modelPresetRegistryDependencies?: ModelPresetRegistryDependencies);
+    constructor(authStorage: AuthStorage, modelsPath?: string, registrySettings?: Pick<Settings, "get" | "getGlobal"> & Partial<Pick<Settings, "commitAtomicBatchWithCurrent">>, modelPresetRegistryDependencies?: ModelPresetRegistryDependencies);
     dispose(): Promise<void>;
     onCatalogChanged(listener: () => void): () => void;
     /** Replace the read-only settings snapshot used by profile-scoped resolution. */
@@ -394,6 +394,7 @@ export declare class ModelRegistry {
      */
     getError(): ConfigError | undefined;
     getModelProfiles(): Map<string, ModelProfileDefinition>;
+    assertCurrentModelProfileExists(name: string): void;
     getModelProfile(name: string): ModelProfileDefinition | undefined;
     getAvailableModelProfileNames(): string[];
     saveCustomModelProfile(name: string, definition: ModelProfileConfig): Promise<ModelProfileDefinition>;

package/dist/types/config/settings-schema.d.ts

@@ -1,6 +1,7 @@
 import type { Effort } from "@gajae-code/ai/model-thinking";
 import { type EditMode } from "../utils/edit-mode";
 import { type AutoroutingLocalIssue, type AutoroutingProvenance, type AutoroutingSetup, type AutoroutingTierMapInput } from "./autorouting-contract";
+import { type DurableModelProfileOwnership } from "./model-profile-ownership";
 import type { ModelSelectorValue } from "./model-selector-value";
 import { type SkillDiscoverySettings } from "./skill-settings-defaults";
 /** Unified settings schema - single source of truth for all settings.
@@ -529,6 +530,18 @@ export declare const SETTINGS_SCHEMA: {
             readonly options: "runtime";
         };
     };
+    readonly "modelProfile.ownership": {
+        readonly type: "optional-object";
+        readonly default: undefined;
+        readonly jsonSchema: JsonSchemaObject;
+        readonly validate: (value: unknown) => {
+            path: string;
+            code: string;
+            reason: string;
+            detail: string;
+        }[];
+        readonly _value: DurableModelProfileOwnership;
+    };
     readonly "modelProfile.proxyProvider": {
         readonly type: "string";
         readonly default: undefined;
@@ -3994,6 +4007,25 @@ export declare const SETTINGS_SCHEMA: {
             readonly description: "Encourage the agent to delegate work to subagents unless changes are trivial (on by default when executor/planner run on a different provider than the default role)";
         };
     };
+    readonly "task.delegationHint.mode": {
+        readonly type: "enum";
+        readonly values: readonly ["off", "hint"];
+        readonly default: "off";
+        readonly ui: {
+            readonly tab: "tasks";
+            readonly label: "Delegation Decision Hint";
+            readonly description: "Opt in to transient local-only Kev advice after observable edit activity. Notices never alter prompts, task arguments, or saved sessions.";
+            readonly options: readonly [{
+                readonly value: "off";
+                readonly label: "Off";
+                readonly description: "Do not request decision hints (default)";
+            }, {
+                readonly value: "hint";
+                readonly label: "Hint";
+                readonly description: "Show ephemeral user-facing advice from the local Kev service";
+            }];
+        };
+    };
     readonly "task.simple": {
         readonly type: "enum";
         readonly values: readonly ["default", "schema-free", "independent"];

package/dist/types/sdk/broker/lifecycle.d.ts

@@ -178,8 +178,11 @@ export declare function observeProcessForTest(pid: number, expectedIncarnation:
  */
 export declare function reapDeadLifecycleMarkers(root: string, limit?: number): Promise<number>;
 export declare function writeEffectMarker(root: string, id: string, marker: EffectMarker): Promise<void>;
+export declare class LifecycleReadinessCleanupError extends Error {
+    constructor(cause: unknown);
+}
 /** The child writes this only after its endpoint and semantic ready event are both live. */
-export declare function writeSessionLifecycleReady(root: string, id: string, effectMarker: string): Promise<void>;
+export declare function writeSessionLifecycleReady(root: string, id: string, effectMarker: string, canPublish?: () => boolean, onPublishing?: (revoke: () => Promise<boolean>) => void, onPublished?: () => void): Promise<void>;
 export interface LifecycleTranscriptEvidence {
     digest: string;
     identity: SessionLifecycleTranscriptIdentity;

package/dist/types/sdk/lifecycle/service.d.ts

@@ -1,5 +1,6 @@
 import { type ScopeRequestV1, type SdkSearchResultV1 } from "../broker/session-scope";
 import type { SessionBindingAuthority } from "../session-authority";
+import { type SessionListSavedSessionOmission } from "../session-list";
 export type { SessionBindingAuthority, SessionEndpointAuthority } from "../session-authority";
 export type SessionLifecycleOperation = "session.create" | "session.fork" | "session.resume" | "session.close" | "session.delete" | "session.reconcile_uncertain" | "session.lookup" | "session.list";
 export type SessionLifecycleMutationOperation = Exclude<SessionLifecycleOperation, "session.lookup" | "session.list">;
@@ -171,6 +172,7 @@ export interface SessionLifecycleListResult {
     readonly sessions: readonly SessionLifecycleListEntry[];
     readonly warnings: readonly string[];
     readonly savedSession?: SessionLifecycleSavedSession;
+    readonly savedSessionOmission?: SessionListSavedSessionOmission;
 }
 export type SessionScopedListResult = SdkSearchResultV1;
 export interface SessionCreateResult {

package/dist/types/sdk/lifecycle-session.d.ts

@@ -51,5 +51,9 @@ export type CreateLifecycleAgentSessionOptions = Omit<CreateAgentSessionOptions,
     /** Broker-issued lifecycle request identity published with host registration. */
     lifecycleRequestId?: string;
 };
+export interface SdkLifecycleStartupOwner {
+    readonly capability: SdkStartupCapability;
+    readonly rollback: SdkStartupRollbackTracker;
+}
 /** Internal lifecycle-only session construction with an owner-bound SDK startup result. */
-export declare function createLifecycleAgentSession(options?: CreateLifecycleAgentSessionOptions): Promise<CreateLifecycleAgentSessionResult>;
+export declare function createLifecycleAgentSession(options?: CreateLifecycleAgentSessionOptions, owner?: SdkLifecycleStartupOwner): Promise<CreateLifecycleAgentSessionResult>;

package/dist/types/sdk/session-directory.d.ts

@@ -39,6 +39,7 @@ export type ListManagedSessionCandidatesResult = {
     foreignCount: number;
     invalid: readonly {
         code: string;
+        sessionId?: string;
     }[];
 } | {
     kind: "error";

package/dist/types/sdk/session-list.d.ts

@@ -1,4 +1,15 @@
 export type SessionListPageRecord = Record<string, unknown>;
+export type SessionListSavedSessionOmissionReason = "scope_unavailable" | "candidate_scan_failed" | "candidate_not_found" | "candidate_ambiguous" | "candidate_invalid" | "identity_incomplete";
+export declare const SESSION_LIST_SAVED_SESSION_OMISSION_DETAIL_CODES: readonly ["cwd_missing", "cwd_not_directory", "identity_unavailable", "network_unsupported", "sessions_root_unavailable", "binding_conflict", "binding_invalid", "migration_busy", "atomic_unavailable", "invalid_request", "durability_failed", "durability_not_provable", "capacity_exceeded", "scan_failed", "unsafe_root", "invalid_candidate", "invalid_header", "unreadable_candidate", "source_changed", "cwd_not_found", "cwd_not_utf8", "cwd_network_unsupported", "cwd_identity_unavailable", "cwd_io_error"];
+export type SessionListSavedSessionOmissionDetailCode = (typeof SESSION_LIST_SAVED_SESSION_OMISSION_DETAIL_CODES)[number];
+/** Path-free diagnostic for a requested managed transcript that could not be selected safely. */
+export interface SessionListSavedSessionOmission {
+    readonly sessionId: string;
+    readonly reason: SessionListSavedSessionOmissionReason;
+    readonly detailCode?: SessionListSavedSessionOmissionDetailCode;
+    readonly candidateCount?: number;
+    readonly missingIdentityFields?: readonly ("nlink" | "ctimeNs")[];
+}
 export type SessionListTraversalErrorKind = "malformed_page" | "repeated_cursor" | "page_budget_exceeded";
 export declare class SessionListTraversalError extends Error {
     #private;

package/dist/types/sdk/startup-capability.d.ts

@@ -53,7 +53,7 @@ export declare class SdkStartupCapability {
     readonly readiness: "immediate" | "deferred";
     readonly lifecycleRequestId?: string | undefined;
     get cancelled(): boolean;
-    cancel(): void;
+    cancel(failure?: SdkStartupFailure): void;
     /**
      * The broker-issued, session-scoped readiness intent this child was launched
      * with. It is carried on the capability rather than read from the ambient

package/dist/types/session/agent-session.d.ts

@@ -882,6 +882,10 @@ export declare class AgentSession {
     /** Join the retained teardown owner without allocating another public deadline. */
     awaitDisposeCompletion(): Promise<void>;
     setDisposeTimeoutForTests(timeoutMs: number): void;
+    /** Bind coordinator runtime-state persistence to this session in tests. */
+    setCoordinatorRuntimeStateFileForTests(stateFile: string): void;
+    /** Read the test-only coordinator runtime-state path bound to this session. */
+    getCoordinatorRuntimeStateFileForTests(): string | undefined;
     trackPostPromptTaskForTests(task: Promise<void>): void;
     requestWorkerIntegrationForTests(): void;
     /**
@@ -944,6 +948,8 @@ export declare class AgentSession {
     awaitSessionSettlement(): Promise<void>;
     /** Test seam: hold prompt admission while bypassing a pending selection fence. */
     runWithPromptAdmissionForTests(body: () => Promise<void>): Promise<void>;
+    /** Enable sidecar write failure reporting for retry-test teardown. */
+    trackCoordinatorRuntimeStatePersistenceFailuresForTests(): void;
     /** Test seam: await all currently admitted coordinator sidecar writes. */
     awaitCoordinatorRuntimeStatePersistenceForTests(): Promise<void>;
     queueCoordinatorRuntimeStatePersistForTests(event: AgentSessionEvent, gate: Promise<void>): Promise<void>;

package/dist/types/session/internal/managed-session-scope.d.ts

@@ -62,6 +62,7 @@ export type ManagedCandidateListing = {
     foreignCount: number;
     invalid: readonly {
         code: string;
+        sessionId?: string;
     }[];
 } | {
     kind: "error";
@@ -107,6 +108,9 @@ export interface ManagedLockReleaseTestEvent {
 export declare const ManagedSessionScopeTestHooks: {
     beforeVerifiedDelete?: (event: ManagedVerifiedDeleteTestEvent) => void | Promise<void>;
     beforeManagedLockRelease?: (event: ManagedLockReleaseTestEvent) => void | Promise<void>;
+    afterCandidatePreflight?: (event: {
+        readonly sessionId?: string;
+    }) => void;
 };
 declare function scopeDigest(platform: "posix" | "win32", canonicalPath: string): string;
 export declare const computeManagedScopeDigest: typeof scopeDigest;

package/dist/types/session/session-manager.d.ts

@@ -4,6 +4,7 @@ import { type AgentMessage } from "@gajae-code/agent-core";
 import type { ConfiguredModelChainEntry as SharedConfiguredModelChainEntry } from "@gajae-code/agent-core/compaction";
 import type { ImageContent, Message, MessageAttribution, ServiceTier, TextContent } from "@gajae-code/ai/core";
 import type * as native from "@gajae-code/natives";
+import { type ModelProfileOwnershipMarker } from "../config/model-profile-ownership";
 import type { TtsrInjectionRecord } from "../export/ttsr";
 import type { ManagedLegacyLocalMigrationSource } from "../internal-urls/local-protocol";
 import { ArtifactManager } from "./artifacts";
@@ -603,6 +604,8 @@ export interface SessionContext {
     models: Record<string, string>;
     /** Configured fallback chains for model roles on the active branch. */
     configuredModelChains: Record<string, ConfiguredModelChain>;
+    /** Effective-branch profile owner decision; absent means the legacy inherit marker. */
+    modelProfileOwnershipMarker?: ModelProfileOwnershipMarker;
     /** Names of TTSR rules that have been injected this session */
     injectedTtsrRules: string[];
     /** Rich TTSR rule injection records for repeat resume. */
@@ -1524,6 +1527,9 @@ export declare class SessionManager {
     appendCompaction<T = unknown>(summary: string, shortSummary: string | undefined, firstKeptEntryId: string, tokensBefore: number, details?: T, fromExtension?: boolean, preserveData?: Record<string, unknown>): string;
     /** Append a custom entry (for extensions) as child of current leaf, then advance leaf. Returns entry id. */
     appendCustomEntry(customType: string, data?: unknown): string;
+    appendPreparedModelProfileOwnershipMarker(prepared: PreparedNewSession, marker: ModelProfileOwnershipMarker): string;
+    appendModelProfileOwnershipMarker(marker: ModelProfileOwnershipMarker): string;
+    getModelProfileOwnershipMarker(): ModelProfileOwnershipMarker | undefined;
     /**
      * Append a root marker that starts a fresh active branch without changing the
      * session id or deleting earlier durable entries. Subsequent messages descend

package/dist/types/setup/model-onboarding-guidance.d.ts

@@ -5,5 +5,23 @@ export declare const MODEL_ONBOARDING_OAUTH_COMMAND = "/provider login [provider
 export declare function formatModelOnboardingGuidance(): string;
 export declare function formatModelOnboardingInlineHint(): string;
 export declare function formatNoModelOnboardingError(): string;
+/** Control-protocol code for a prompt refused because the session has no model. */
+export declare const MODEL_NOT_SELECTED_CODE = "model_not_selected";
+/**
+ * Fixed public text for {@link MODEL_NOT_SELECTED_CODE}. The onboarding
+ * guidance names providers, commands, environment variables and local setup
+ * paths, so it stays local-only; external clients get this constant instead.
+ */
+export declare const MODEL_NOT_SELECTED_PUBLIC_MESSAGE = "No model is selected for this session. Select a model before submitting a prompt.";
+/**
+ * Missing-model prompt preflight failure. The message keeps the full local
+ * onboarding guidance for the TUI and in-process callers; the `code` is what
+ * lets the SDK control surface answer with a safe, known diagnostic instead of
+ * a generic internal error.
+ */
+export declare class NoModelSelectedError extends Error {
+    readonly code = "model_not_selected";
+    constructor();
+}
 export declare function formatNoCredentialOnboardingError(providerId: string): string;
 export declare function formatNoModelsAvailableFallback(): string;

package/dist/types/task/delegation-hint.d.ts

@@ -0,0 +1,53 @@
+import { type AutoroutingTier } from "../config/autorouting-contract";
+export declare const KEV_SYSTEMONE_ENDPOINT = "http://127.0.0.1:8009/v1/systemone";
+export declare const KEV_SYSTEMONE_MODEL = "kev-latest";
+export declare const DELEGATION_HINT_TIMEOUT_MS = 750;
+type Tier = AutoroutingTier;
+export interface DelegationHintMetrics {
+    toolCount: number;
+    editCount: number;
+    fileCount: number;
+    packageCount: number;
+    verificationCount: number;
+    consecutiveEdits: number;
+    /** Pending/in-progress peer tasks in the largest explicit plan phase. */
+    activePlanStepCount: number;
+    /** Remaining fraction of the context window, omitted when usage is unknown. */
+    remainingContextRatio?: number;
+}
+export interface KevDecision {
+    noul: boolean;
+    pDelegate: number;
+    choice: Tier | null;
+}
+export type KevDecisionFetcher = (metrics: DelegationHintMetrics, choices: readonly Tier[], signal?: AbortSignal) => Promise<KevDecision | undefined>;
+export type KevFetchImplementation = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export interface DelegationHintOptions {
+    getMode: () => unknown;
+    getAutoroutingEnabled: () => unknown;
+    getAutoroutingTiers: () => unknown;
+    notify: (message: string) => void;
+    fetcher?: KevFetchImplementation;
+}
+/** Create a fixed-loopback, bounded Kev-compatible classifier client. */
+export declare function createKevDecisionFetcher(fetchImplementation?: KevFetchImplementation): KevDecisionFetcher;
+/** Ephemeral, bounded inference state. Notices stay out of prompts and session storage. */
+export declare class DelegationHintController {
+    #private;
+    constructor(options: DelegationHintOptions);
+    setEnabled(enabled: boolean): void;
+    /** Reset aggregate counters for the next assistant turn. */
+    onTurnStart(): void;
+    /** Prevent a pending classifier result from crossing into a new user prompt. */
+    onUserMessage(): void;
+    /** Synchronous callback; inference and its user-only notice never alter tool or model state. */
+    observeAfterToolCall(input: {
+        toolName: string;
+        args: Record<string, unknown>;
+        isError: boolean;
+        resultError?: boolean;
+        getActivePlanStepCount?: () => number;
+        getRemainingContextRatio?: () => number | undefined;
+    }, signal?: AbortSignal): void;
+}
+export {};

package/examples/README.md

@@ -16,6 +16,6 @@ Example custom tools that extend the agent's capabilities.
 ## Documentation
 
 - [SDK Reference](sdk/README.md)
-- [Hooks Documentation](../docs/hooks.md)
-- [Custom Tools Documentation](../docs/custom-tools.md)
-- [Skills Documentation](../docs/skills.md)
+- [Hooks Documentation](../../../docs/hooks.md)
+- [Custom Tools Documentation](../../../docs/codegraph-custom-tool.md#2-add-the-custom-tool)
+- [Skills Documentation](../../../docs/skills.md)

package/examples/custom-tools/README.md

@@ -40,7 +40,7 @@ Then in gjc:
 
 ## Writing Custom Tools
 
-See [docs/custom-tools.md](../../docs/custom-tools.md) for full documentation.
+See [docs/codegraph-custom-tool.md](../../../../docs/codegraph-custom-tool.md#2-add-the-custom-tool) for how tools are discovered and loaded.
 
 ### Key Points
 

package/examples/hooks/README.md

@@ -31,7 +31,7 @@ cp permission-gate.ts ~/.gjc/agent/hooks/
 
 ## Writing Hooks
 
-See [docs/hooks.md](../../docs/hooks.md) for full documentation.
+See [docs/hooks.md](../../../../docs/hooks.md) for full documentation.
 
 ```typescript
 import type { HookAPI } from "@gajae-code/coding-agent/hooks";

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.17.6",
+	"version": "0.17.7",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -57,12 +57,12 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.17.6",
-		"@gajae-code/agent-core": "0.17.6",
-		"@gajae-code/ai": "0.17.6",
-		"@gajae-code/natives": "0.17.6",
-		"@gajae-code/tui": "0.17.6",
-		"@gajae-code/utils": "0.17.6",
+		"@gajae-code/stats": "0.17.7",
+		"@gajae-code/agent-core": "0.17.7",
+		"@gajae-code/ai": "0.17.7",
+		"@gajae-code/natives": "0.17.7",
+		"@gajae-code/tui": "0.17.7",
+		"@gajae-code/utils": "0.17.7",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/scripts/generate-sdk-operation-inventory.ts

@@ -119,6 +119,12 @@ const LOCKED_EXCLUSIONS: Readonly<Record<string, string>> = {
 	"agent_session:getPendingNextTurnMessagesForTests": "read-only test seam, not a user-facing SDK control seam",
 	"agent_session:queueCoordinatorRuntimeStatePersistForTests":
 		"test-only coordinator persistence ordering seam, not a user-facing SDK control seam",
+	"agent_session:trackCoordinatorRuntimeStatePersistenceFailuresForTests":
+		"test-only coordinator persistence failure observation seam, not a user-facing SDK control seam",
+	"agent_session:setCoordinatorRuntimeStateFileForTests":
+		"test-only coordinator runtime state file setup seam, not a user-facing SDK control seam",
+	"agent_session:getCoordinatorRuntimeStateFileForTests":
+		"read-only test-only coordinator runtime state file accessor, not a user-facing SDK control seam",
 	"agent_session:awaitCoordinatorRuntimeStatePersistenceForTests":
 		"test-only coordinator persistence drain barrier, not a user-facing SDK control seam",
 	"agent_session:parkAgentEndForCoordinatorPersistForTests":

package/src/cli/config-cli.ts

@@ -101,6 +101,8 @@ function redactConfigValue(path: string, value: unknown, showSecrets?: boolean):
 
 /** Find setting definition by path */
 function findSettingDef(path: string): CliSettingDef | undefined {
+	if (path === "modelProfile.ownership") return undefined;
+	if (path === "modelProfile.default" && settings.getGlobal("modelProfile.ownership") !== undefined) return undefined;
 	if (!(path in SETTINGS_SCHEMA)) return undefined;
 	const key = path as SettingPath;
 	const ui = getUi(key);

package/src/cli/public-command-errors.ts

@@ -98,8 +98,14 @@ export type PublicEvidenceStatus =
 export const PUBLIC_COMMAND_DIAGNOSTICS = {
 	macos_nofile_limit_low:
 		"The macOS open-file limit is below the recommended minimum; increase it before starting additional concurrent work.",
+	sdk_resource_gone:
+		"The requested resource is not available from this session endpoint; this reports absent resource state, not an empty result.",
 	router_cleanup_failed: "SDK session Router cleanup failed.",
 	broker_cleanup_failed: "SDK broker client cleanup failed.",
+	// The broker reports this code from several distinct causes, so the text names none
+	// of them and never implies that another key would be safe.
+	lifecycle_idempotency_conflict:
+		"The broker reported an idempotency conflict. Reconcile existing lifecycle state before deciding whether another request is safe.",
 	usage_transport_exclusive: "Specify exactly one of --stdio or --socket <path>.",
 	usage_duplicate_option: "Each option on this command may occur at most once.",
 	usage_unknown_argument: "An unrecognized argument was supplied; re-read the command help for its accepted grammar.",