@gajae-code/coding-agent 0.18.0 → 0.18.5

package/CHANGELOG.md

@@ -2,6 +2,101 @@
 
 ## [Unreleased]
 
+## [0.18.5] - 2026-09-30
+
+## [0.18.4] - 2026-09-30
+
+## [0.18.3] - 2026-09-30
+
+## [0.18.2] - 2026-09-30
+
+### Added
+
+- Added the additive `codex-sol61` built-in model profile for GPT-6.1 Sol.
+
+### Changed
+
+- Built-in `claude-opus` and `claude-fable` executor roles and the `opus-codex` planner role now use `anthropic/claude-sonnet-5-5` instead of `anthropic/claude-sonnet-5` (#6111).
+
+### Fixed
+
+- Bare line-number and hash-only hashline anchors now fail with actionable, copy-ready full-anchor suggestions; edits remain unapplied until a full anchor is supplied.
+
+- On macOS, the shell runtime no longer exits with code 70 when spawning fast-exiting child processes or entitled/setuid children (like `/bin/ps`, `/usr/bin/top`, `sudo`) that cannot be queried for unique identity. When a child is confirmed absent or terminated before observation, the process identity is recorded like on Linux. Only genuine integrity failures (ledger write failures, HMAC errors) trigger exit 70 on a live child (#6085).
+
+- Exa MCP tool-call responses are formatted in bounded time. `formatGenericResponse` re-indents the entire formatted subtree at every object level, so cost grew super-linearly with nesting depth: 500/1000/2000/4000/8000 levels cost 60ms/227ms/730ms/5.9s/94s, and 20000 levels exhausted the call stack. The payload is whatever the remote MCP server returned, and the 16 MiB content cap does not bound depth — 8000 levels of `{"a":` is under 47 KB. Depth is now limited to 64, matching the session-import walker, and output for payloads within that limit is unchanged.
+
+- Preserve the one-line hashline retry hint when copied text contains literal `..`, while keeping ambiguous range edits rejected without modifying the file (#6112).
+
+- Nested `gjc` commands run through the Bash tool inside a managed-owner (tmux-supervised) session no longer fail with `managed_owner_admission_metadata_invalid`: the Bash boundary now scrubs the whole managed-owner env family, including the tmux owner server key and `GJC_TMUX_LAUNCHED`, instead of leaving a partial owner context behind (#6140).
+
+- Keep the ACP prompt watchdog on its awaiting-model bound until a streamed tool call actually begins executing.
+
+- Sessions without explicit `retry.*` settings now retry a content-free "socket connection was closed unexpectedly" (`ECONNRESET`) failure when the attempt is replay-safe, bounded by `retry.maxRetries`. Previously the bare-default gate only admitted stream-timeout watchdog errors, so a transient connection reset before any response ended the turn even though it was classified as transient.
+
+- Fixed sessions intermittently hanging after a tool call on long contexts (seen with OpenGateway `-ultrafast` models). The CLI no longer routes `fetch()` through Bun's HTTP/2 client, which could stall a pooled connection on large request bodies until the process restarted.
+
+- A long-running session whose `gjc` binary was replaced on disk no longer respawns the shared SDK broker over and over. Broker recovery now stops and asks for a session restart when this process's runtime image was replaced (same path, new file identity) or removed, and repeated recovery failures back off exponentially up to a cap instead of retrying every 30–60 seconds. Other clients sharing the broker are no longer disrupted by the churn (#6040).
+
+- Model registry refreshes no longer rescan and re-lowercase the whole model catalog for every registry-profile selector; selector matching uses a prebuilt index.
+
+- Validating cached model-preset registry documents is about a third faster: canonical JSON serialization no longer calls `JSON.stringify` for strings that need no escaping and checks surrogates with the native well-formedness test.
+
+- A session sharing its managed scope with another `gjc` process (for example a master session and the SDK session it spawned) no longer stops persisting with `managed_replace_receipt_cleanup_pending:quarantine_collision` when both processes try to retire the same replacement cleanup receipt at the same time. The process that loses the race to claim the retirement slot now leaves the receipt for a later reconciliation, and its own session write continues.
+
+- Keep SDK prompts alive when transient directed delivery back-pressure (`writer_backlog_full`) drops a correlated progress frame. Previously the prompt was abandoned while the run kept executing, so the final `agent_end` was dropped and ACP clients only settled the prompt when the prompt watchdog expired. Terminal frames now retry briefly under back-pressure so the prompt settles normally.
+- Release the prompt submission and work lease when terminal delivery still fails after the retry window, while preserving the `delivery_failed` terminal outcome.
+
+- Keep SDK and ACP prompts alive when a streaming message snapshot exceeds the directed frame limit, and report a correlated delivery failure to the requester only when the undeliverable frame is the run's own terminal, so a prompt is never reported failed while its execution is still running.
+- Preserve assistant text shape and terminal truncation metadata when bounding oversized correlated frames.
+- Preserve as much aggregate assistant message_end text as fits, including ordered text blocks.
+
+- Give broker-admitted lifecycle launches without a worktree a fresh child readiness budget after bounded pre-spawn bookkeeping, while preserving caller-supplied exact deadlines.
+- Bound broker-derived non-worktree pre-spawn preparation by the unused admission window (10s without queueing at default readiness), so fresh readiness still finishes inside the unchanged caller deadline.
+
+- Exit lifecycle session hosts cleanly after publishing a complete rollback receipt at the readiness cutoff.
+
+- Prove broker-owned session hosts have exited at readiness cutoff before returning retryable startup failures, including hosts blocked during extension initialization.
+
+- `gjc stats --json` now writes only the JSON document to stdout, so `gjc stats --json | jq ...` works. The `Synced N new entries ...` summary goes to stderr in JSON mode, alongside the sync progress. The dashboard and `--summary` output are unchanged.
+
+- Interactive `/ssh add ... --port` rejects a port with trailing or non-digit characters (for example `22oops` or `2222.5`) instead of saving the digits before them, matching the ACP `/ssh add` parser.
+
+## [0.18.1] - 2026-09-29
+
+### Fixed
+
+- `./install.sh --dev` and `gjc doctor` no longer treat this checkout's own `gjc` and `가재씨` links as foreign after a macOS reboot. The ownership receipt still binds the link by inode, but no longer compares the recorded `st_dev`, which APFS changes across boots. A receipt left behind after its link was removed by hand is recognized as this checkout's and replaced, while a receipt that names another checkout is refused before either link is touched.
+
+- Loading `search` or `eval` for the first time no longer changes its advertised tool description, so the provider-visible `tools` block and the prompt-cache prefix stay stable. Before the implementation loads, the description is now rendered from the session (hashline or line-number display for `search`, the allowed Python/JavaScript backends for `eval`), instead of taking the stub-session text from the generated catalog.
+
+- Keep the provider-visible `task` description stable before and after the tool loads by rendering it from session settings without listing configured agent names; unknown-agent errors continue to list all visible agents. IRC guidance is now independent of whether the IRC tool becomes available mid-session.
+
+- Windows binary update via exactReplaceRetained now succeeds with owner-only ACL enforcement. The retained update path required READ_CONTROL on both the staged source and current destination handles to query ACL ownership, but the handles were opened without READ_CONTROL, causing every real Windows update to fail with acl_unavailable. (#6096)
+
+- Reduced macOS idle CPU from the bash shell guardian: the Darwin ancestry poll now reads kernel process identities first and validates only new descendants with `Process.fromPid`, instead of querying every process on each scan. A descendant whose validation fails transiently is retried on the next poll rather than dropped from cleanup.
+
+- User-cancelled turns (ACP session/cancel, SDK turn.abort) settle as `cancelled` again instead of a failed terminal (regression from 0.18.0).
+
+- ACP cancels received before SDK prompt admission now stay attached to the waiter: the prompt is not dispatched, or a real terminal abort is retried after admission, rather than letting the turn continue.
+
+- ACP MCP launch failures now retain the broker lifecycle cause and a bounded, credential-free diagnostic, while SDK transport failures keep their original retry code.
+
+- `gjc doctor --fix --repair service.restart-owned` on the SDK broker now reports a broker refusal, such as `restart_busy` while any session is live, as `blocked` with reason `prepare_refused:<code>` and no side effect. It was previously reported as `uncertain` / `repair_execution_unverified` with `sideEffectStarted: true`. A refused commit now also cancels its prepared reservation instead of leaving new work refused until the lease expires.
+
+- Treat cooperative SDK prompt pauses as successful terminal stops instead of unreported failures.
+
+- A displayed extension message sent from `session_start` (such as a handoff summary) now appears once at startup instead of twice, and startup notices shown before the first paint are no longer wiped. Transcript rebuilds requested before the initial transcript paint are skipped; the first paint renders the full session.
+
+### Documentation
+
+- Updated: Clarified that human reviewers only need to approve the current head on GitHub; body verdict lines are required only for agent reviewers and owner self-approval.
+
+### Bug fixes
+
+- Fixed: Human approval now works when a PR has no verdict line in its body. GJC checks GitHub reviews for human approval on the current head instead.
+- Fixed: A valid PR contract with no approval yet now shows a "Waiting for approval" notice instead of an error.
+
 ## [0.18.0] - 2026-09-27
 
 ### Added

package/dist/types/cli/stats-cli.d.ts

@@ -8,10 +8,5 @@ export interface StatsCommandArgs {
     json: boolean;
     summary: boolean;
 }
-/**
- * Parse stats subcommand arguments.
- * Returns undefined if not a stats command.
- */
-export declare function parseStatsArgs(args: string[]): StatsCommandArgs | undefined;
 export declare function runStatsCommand(cmd: StatsCommandArgs): Promise<void>;
 export declare function printStatsHelp(): void;

package/dist/types/config/autorouting-tier-map.d.ts

@@ -33,14 +33,18 @@ export declare const CURATED_TIER_LABELS: {
         readonly tier: "fast";
         readonly rank: 1;
     }];
-    readonly "anthropic/claude-sonnet-5": readonly [{
+    readonly "anthropic/claude-sonnet-5-5": readonly [{
         readonly tier: "balanced";
         readonly rank: 1;
     }];
-    readonly "anthropic/claude-sonnet-4-6": readonly [{
+    readonly "anthropic/claude-sonnet-5": readonly [{
         readonly tier: "balanced";
         readonly rank: 2;
     }];
+    readonly "anthropic/claude-sonnet-4-6": readonly [{
+        readonly tier: "balanced";
+        readonly rank: 3;
+    }];
     readonly "anthropic/claude-opus-5-5": readonly [{
         readonly tier: "strong";
         readonly effort: "high";
@@ -70,6 +74,11 @@ export declare const CURATED_TIER_LABELS: {
         readonly effort: "high";
         readonly rank: 1;
     }];
+    readonly "openai-codex/gpt-6.1-sol": readonly [{
+        readonly tier: "strong";
+        readonly effort: "high";
+        readonly rank: 2;
+    }];
     readonly "google/gemini-3.5-flash-lite": readonly [{
         readonly tier: "fast";
         readonly rank: 1;
@@ -123,6 +132,24 @@ export declare const CURATED_TIER_LABELS: {
 };
 /** Generated from packages/ai/src/models.json at feature land: 3936 in-scope baseline skips. */
 export declare const TIER_MAP_SKIP_LIST: {
+    readonly "amazon-bedrock/anthropic.claude-sonnet-5-5": {
+        readonly rationale: "Sonnet 5.5 catalog addition (#6111); not yet curated";
+    };
+    readonly "amazon-bedrock/au.anthropic.claude-sonnet-5-5": {
+        readonly rationale: "Sonnet 5.5 catalog addition (#6111); not yet curated";
+    };
+    readonly "amazon-bedrock/eu.anthropic.claude-sonnet-5-5": {
+        readonly rationale: "Sonnet 5.5 catalog addition (#6111); not yet curated";
+    };
+    readonly "amazon-bedrock/global.anthropic.claude-sonnet-5-5": {
+        readonly rationale: "Sonnet 5.5 catalog addition (#6111); not yet curated";
+    };
+    readonly "amazon-bedrock/jp.anthropic.claude-sonnet-5-5": {
+        readonly rationale: "Sonnet 5.5 catalog addition (#6111); not yet curated";
+    };
+    readonly "amazon-bedrock/us.anthropic.claude-sonnet-5-5": {
+        readonly rationale: "Sonnet 5.5 catalog addition (#6111); not yet curated";
+    };
     readonly "kiro/claude-opus-5-5": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };

package/dist/types/config/model-registry.d.ts

@@ -327,7 +327,22 @@ interface ProviderOverride {
     cacheRetention?: CacheRetention;
     isOAuth?: boolean;
 }
-export declare function registrySelectorResolvesToModel(selector: string, models: readonly Model<Api>[]): boolean;
+/**
+ * Lowercased lookup keys for a model catalog, so selector resolution is a set
+ * lookup instead of a scan that re-lowercases every model id per selector.
+ */
+export interface RegistrySelectorIndex {
+    /** `id` and `provider/id`. */
+    exact: ReadonlySet<string>;
+    /** `id` alone. */
+    ids: ReadonlySet<string>;
+    /** Model ids per provider, for parsed `provider/id` selectors (nested, so no delimiter can collide). */
+    providerIds: ReadonlyMap<string, ReadonlySet<string>>;
+    /** Every `/`-delimited suffix of each id (`a/b/c` → `b/c`, `c`). */
+    idSuffixes: ReadonlySet<string>;
+}
+export declare function createRegistrySelectorIndex(models: readonly Model<Api>[]): RegistrySelectorIndex;
+export declare function registrySelectorResolvesToModel(selector: string, index: RegistrySelectorIndex): boolean;
 /**
  * Merge a freshly discovered model with the matching bundled/configured entry
  * (or a runtime provider override when no bundled entry exists).

package/dist/types/config/settings-schema.d.ts

@@ -2183,11 +2183,11 @@ export declare const SETTINGS_SCHEMA: {
         readonly ui: {
             readonly tab: "context";
             readonly label: "Compaction Threshold";
-            readonly description: "Percent threshold for context maintenance; set to Default to use legacy reserve-based behavior";
+            readonly description: "Percent threshold for context maintenance; the 300,000-token default cap applies only with adaptive mode disabled (except during context promotion)";
             readonly options: readonly [{
                 readonly value: "default";
                 readonly label: "Default";
-                readonly description: "Legacy reserve-based threshold";
+                readonly description: "300,000-token default cap applies only with adaptive mode disabled (except during context promotion)";
             }, {
                 readonly value: "10";
                 readonly label: "10%";

package/dist/types/exa/mcp-client.d.ts

@@ -22,11 +22,7 @@ export declare function callExaTool(toolName: string, args: Record<string, unkno
 export declare function callWebsetsTool(apiKey: string, toolName: string, args: Record<string, unknown>): Promise<unknown>;
 /** Format search results for LLM */
 export declare function formatSearchResults(data: ExaSearchResponse): string;
-/**
- * Format a non-search MCP response as human-readable text.
- * Handles objects, arrays, primitives, and common MCP response shapes.
- */
-export declare function formatGenericResponse(data: unknown): string;
+export declare function formatGenericResponse(data: unknown, depth?: number): string;
 /** Check if result is a search response */
 export declare function isSearchResponse(data: unknown): data is ExaSearchResponse;
 /** Fetch and cache MCP tool schema */

package/dist/types/exec/bash-shell-guardian.d.ts

@@ -11,5 +11,31 @@ export declare function extendOwnedDarwinAncestry<T extends {
     uniqueId: bigint;
     parentUniqueId: bigint;
 }>(knownUniqueIds: Set<bigint>, candidates: ReadonlyMap<number, T>): number[];
+export declare function authenticateOwnershipRecord(line: string, ledgerToken: string): {
+    processRef?: NativeProcess;
+    darwinUniqueId?: bigint;
+    pending?: true;
+} | undefined;
+export type DarwinAncestryTracker = {
+    seed(uniqueId: bigint): void;
+    track(processRef: NativeProcess, uniqueId?: bigint): boolean;
+    trackGuardian(processRef: NativeProcess, uniqueId?: bigint): boolean;
+    poll(): boolean;
+    close(): void;
+};
+export type DarwinIdentity = {
+    uniqueId: bigint;
+    parentUniqueId: bigint;
+};
+/** Test seams for the Darwin tracker; production uses libproc and the natives binding. */
+export type DarwinAncestryTrackerDeps = {
+    uniqueIdentity?: (pid: number) => DarwinIdentity | undefined;
+    fromPid?: (pid: number) => NativeProcess | null | undefined;
+    observe?: (pid: number) => {
+        status: "present" | "absent" | "unknown";
+        incarnation?: string;
+    };
+};
+export declare function createDarwinAncestryTracker(owned: Map<string, NativeProcess>, deps?: DarwinAncestryTrackerDeps): DarwinAncestryTracker | undefined;
 export declare function runBashShellGuardian(): Promise<void>;
 export {};

package/dist/types/gjc-runtime/session-state-sidecar.d.ts

@@ -39,6 +39,7 @@ export declare const __sessionStateSidecarTestHooks: {
     beforeRescopeJournalWrite?: (cwd: string) => void | Promise<void>;
     beforePersistFromEvent?: (eventType: string, cwd: string) => void | Promise<void>;
     beforeRescopePublish?: () => void | Promise<void>;
+    disableCoordinatorFileSyncForTests?: boolean;
 };
 interface RuntimeStateEvent {
     type: string;

package/dist/types/hashline/parser.d.ts

@@ -1,19 +1,41 @@
+import { HL_OP_INSERT_AFTER, HL_OP_INSERT_BEFORE, HL_OP_REPLACE } from "./hash";
 import type { HashlineCursor, HashlineEdit } from "./types";
+type HashlineOpSigil = typeof HL_OP_INSERT_BEFORE | typeof HL_OP_INSERT_AFTER | typeof HL_OP_REPLACE;
 /**
- * An op referenced lines by number alone, without the content hash. The edit
- * is never applied on a line number alone; the executor answers with the
- * current full anchors for {@link lines} so the model can retry without an
- * extra read.
+ * An op referenced lines by number alone. The edit is never applied on a line
+ * number alone; the executor answers with the current full anchors so the model
+ * can retry without another read.
  */
 export declare class HashlineMissingHashError extends Error {
     readonly lines: {
         start: number;
         end: number;
     };
+    readonly opSigil: HashlineOpSigil;
+    readonly rangeRaw?: {
+        start: string;
+        end: string;
+    } | undefined;
     constructor(message: string, lines: {
         start: number;
         end: number;
-    });
+    }, opSigil: HashlineOpSigil, rangeRaw?: {
+        start: string;
+        end: string;
+    } | undefined);
+}
+export declare class HashlineMissingLineError extends Error {
+    readonly hash: string;
+    readonly lineNum: number | undefined;
+    readonly opSigil: HashlineOpSigil;
+    readonly rangeRaw?: {
+        start: string;
+        end: string;
+    } | undefined;
+    constructor(hash: string, lineNum: number | undefined, opSigil: HashlineOpSigil, rangeRaw?: {
+        start: string;
+        end: string;
+    } | undefined);
 }
 export declare function cloneCursor(cursor: HashlineCursor): HashlineCursor;
 export declare function parseHashline(diff: string): HashlineEdit[];
@@ -21,3 +43,4 @@ export declare function parseHashlineWithWarnings(diff: string): {
     edits: HashlineEdit[];
     warnings: string[];
 };
+export {};

package/dist/types/modes/acp/acp-agent.d.ts

@@ -46,7 +46,12 @@ export declare function paginateAcpSessions(listed: unknown[], cwd: string | und
 export declare function acpAvailableCommandsFromSkills(query: unknown): AvailableCommand[];
 type SdkPromptFailedOutcome = Extract<SdkPromptTerminalOutcome, {
     kind: "failed";
-}>;
+}> & {
+    deliveryFailure?: {
+        cause: string;
+        frameBytes: number;
+    };
+};
 /**
  * A prompt rejection that still carries the terminal's structured failure classification.
  * The ACP client sees only the code and message, but the first-turn retry gate must decide on

package/dist/types/sdk/acp/adapter.d.ts

@@ -61,7 +61,9 @@ export declare class AcpSdkAdapterError extends Error {
 }
 /**
  * The error an ACP session launch must throw once a lifecycle request that carried MCP
- * servers has failed.
+ * servers has failed. Broker transport failures from the SDK client are preserved verbatim;
+ * other failures keep the adapter's `unavailable` code while carrying a bounded, credential-free
+ * copy of the original code and message as their cause diagnostic.
  */
 export declare function acpMcpLaunchFailure(error: unknown, mcpServers: SessionLifecycleMcpServer[]): unknown;
 export type AcpReconnectFailedHandler = (error: SdkClientError) => void;

package/dist/types/sdk/broker/lifecycle.d.ts

@@ -4,7 +4,7 @@ import type { SessionWorkLease } from "../../session/session-work-lease";
 import type { SessionLifecycleMcpServer } from "../acp/mcp";
 import { type SdkStartupFailure, type SdkStartupRollbackResult } from "../startup-capability";
 import type { Broker, BrokerCleanupEvidence, BrokerResponse } from "./broker";
-import type { LifecycleDurableEffectsReceipt, LifecycleStartupFailureReceipt } from "./lifecycle-ledger";
+import type { LifecycleDurableEffectsReceipt, LifecycleEffectIntent, LifecycleStartupFailureReceipt } from "./lifecycle-ledger";
 import { type ProcessIncarnationCommandRunner, type ProcessIncarnationOptions, parseDarwinProcessIncarnation, processIncarnation } from "./process-incarnation";
 import { type SdkInternalSpawnCommand } from "./runtime";
 import { type IndexedSession } from "./session-index";
@@ -52,6 +52,10 @@ export declare function setLifecycleHostPlatformForTest(platform: NodeJS.Platfor
 export declare function readyThenExitToleranceEnabledForTest(): boolean;
 export declare function hasValidLifecycleDeadlines(value: LifecycleDeadlines, now?: number): boolean;
 type Input = Record<string, unknown>;
+type LifecycleEffectIntentWithDeadline = LifecycleEffectIntent & {
+    lifecycleCleanupDeadlineAt?: number;
+    admissionCleanupDeadlineAt?: number;
+};
 export declare const isCanonicalSessionId: (value: string) => boolean;
 export interface SessionLifecycleWorktreeTarget {
     enabled: true;
@@ -260,6 +264,7 @@ export interface LifecycleExecutionOutcome {
     startupFailure?: LifecycleStartupFailureReceipt;
     deferredArtifactCleanup?: () => Promise<void>;
 }
+export declare function classifyLateAdmissionSpawnFailure(response: BrokerResponse, effectIntent: LifecycleEffectIntentWithDeadline | undefined, now: number, messageSource: BrokerResponse): BrokerResponse;
 /** Returns the response together with every durable lifecycle fact needed for truthful replay. */
 export declare function executeLifecycle(broker: Broker, operation: string, input: Input, identity: string, cleanup?: CleanupEvidence): Promise<LifecycleExecutionOutcome>;
 /**

package/dist/types/sdk/broker/recovery-backoff.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Bounded exponential backoff tracker for broker recovery failures per agent dir.
+ * Tracks repeated recovery failures and implements exponential backoff with a cap
+ * to prevent repeated spawns from destabilizing the system.
+ */
+/** Configuration for recovery backoff behavior. */
+export interface RecoveryBackoffConfig {
+    /** Initial backoff delay in milliseconds (default: 1000ms). */
+    initialDelayMs: number;
+    /** Maximum backoff delay in milliseconds (default: 30000ms = 30s). */
+    maxDelayMs: number;
+    /** Backoff multiplier applied each retry (default: 2). */
+    multiplier: number;
+    /** Maximum number of recovery attempts per session (default: 5). */
+    maxAttempts: number;
+}
+/** State for a single agent dir's recovery backoff. */
+export interface RecoveryBackoffState {
+    /** Timestamp of the last recovery failure. */
+    lastFailureAt: number;
+    /** Current backoff delay in milliseconds. */
+    currentDelayMs: number;
+    /** Number of consecutive failures. */
+    failureCount: number;
+    /** Whether recovery has been permanently stopped due to max attempts. */
+    stopped: boolean;
+}
+/** Manages per-agent-dir recovery backoff state. */
+export declare class RecoveryBackoffTracker {
+    #private;
+    constructor(config?: Partial<RecoveryBackoffConfig>);
+    /** Test hook: inject a custom clock. */
+    setClockForTest(clock: {
+        now(): number;
+    }): void;
+    /**
+     * Check if recovery should proceed now, considering backoff.
+     * Returns true if sufficient time has elapsed since the last failure.
+     */
+    canAttemptRecovery(agentDir: string): boolean;
+    /**
+     * Record a recovery failure and update backoff state.
+     * Returns true if recovery should continue to be attempted, false if max attempts reached.
+     */
+    recordFailure(agentDir: string): boolean;
+    /**
+     * Record a successful recovery and reset backoff state.
+     */
+    recordSuccess(agentDir: string): void;
+    /**
+     * Get the current backoff state for an agent dir (for testing/diagnostics).
+     */
+    getState(agentDir: string): RecoveryBackoffState | undefined;
+    /**
+     * Get milliseconds until the next recovery attempt can proceed.
+     */
+    getBackoffWaitMs(agentDir: string): number;
+    /**
+     * Reset all backoff state (for testing).
+     */
+    resetForTest(): void;
+}

package/dist/types/sdk/broker/runtime.d.ts

@@ -40,6 +40,14 @@ export interface SdkInternalRuntimeDescriptorTestOptions {
  * must not hide behind it.
  */
 export declare function sdkInternalRuntimeImage(): string | undefined;
+/** Identity of a runtime image: enough to detect replacement at the same path. */
+export interface SdkInternalRuntimeImageIdentity {
+    path: string;
+    dev: number;
+    ino: number;
+    mtimeMs: number;
+    size: number;
+}
 /**
  * Whether a published runtime image is still a regular file on disk. A resident broker keeps
  * answering requests after the executable it was started from is deleted (a
@@ -50,6 +58,18 @@ export declare function sdkInternalRuntimeImage(): string | undefined;
  * its bound: a false retirement kills a healthy broker.
  */
 export declare function isSdkInternalRuntimeImagePresent(file: string): Promise<boolean>;
+/**
+ * Capture the runtime image identity (dev, ino, mtimeMs, size) at startup.
+ * Used to detect if the binary at the same path has been replaced.
+ */
+export declare function captureRuntimeImageIdentity(file: string): Promise<SdkInternalRuntimeImageIdentity | undefined>;
+/**
+ * Check if the runtime image has been replaced since startup.
+ * Returns `true` if the path is gone, its dev/ino differ from the startup identity,
+ * or its size or modification time changed (an in-place rewrite keeps the inode).
+ * Returns `false` (inconclusive) if the file exists and matches, or on any error.
+ */
+export declare function isSdkInternalRuntimeImageReplaced(startupIdentity: SdkInternalRuntimeImageIdentity | undefined): Promise<boolean>;
 /** Resolve the production descriptor from the statically imported marker and current Bun runtime evidence. */
 export declare function resolveSdkInternalSpawnCommand(action: SdkInternalAction): SdkInternalSpawnCommand;
 /** Test hook: injects runtime evidence without weakening the production marker authority. */

package/dist/types/sdk/broker/startup-budget.d.ts

@@ -8,6 +8,8 @@ export declare const MIN_PREPARATION_TIMEOUT_MS = 1000;
 export declare const MAX_PREPARATION_TIMEOUT_MS = 120000;
 /** Bounded workspace install window; independent of child semantic readiness. */
 export declare const DEFAULT_DEPENDENCY_PREPARATION_TIMEOUT_MS = 30000;
+/** Non-worktree broker pre-spawn cap, also limited by the admission window remaining since receipt. */
+export declare const DEFAULT_BROKER_PRESPAWN_PREPARATION_TIMEOUT_MS = 30000;
 export declare function isValidReadinessTimeoutMs(value: unknown): value is number;
 export declare function isValidPreparationTimeoutMs(value: unknown): value is number;
 export declare const READINESS_TIMEOUT_INVALID_MESSAGE = "readinessTimeoutMs must be an integer between 4000 and 60000.";
@@ -51,7 +53,9 @@ export declare function lifecycleStartupBudgetMs(requestedReadinessTimeoutMs: nu
  *
  * Worktree launches add independent preparation budgets so git add / install cannot
  * cut the caller while the broker still owns the request. One-arg
- * {@link lifecycleStartupBudgetMs} stays queue+readiness for no-worktree callers.
+ * {@link lifecycleStartupBudgetMs} stays queue+readiness for no-worktree callers:
+ * broker-derived pre-spawn work uses only the unspent admission window from receipt,
+ * and the fresh readiness window ends within that unchanged caller budget.
  */
 export declare function lifecycleRequestTimeoutMs(operation: string, input: Record<string, unknown>): number | undefined;
 /**

package/dist/types/sdk/bus/index.d.ts

@@ -602,6 +602,7 @@ export declare function shouldAwaitNotificationStartup(event: {
         origin: string;
     };
 }): boolean;
+export declare function boundedCorrelatedAgentEndFrame(frame: Record<string, unknown>): Record<string, unknown>;
 export declare function createNotificationsExtension(api: ExtensionAPI, options?: {
     settings?: Settings;
     ensureTelegramDaemon?: (input: {

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -292,7 +292,7 @@ export declare const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * Generation 193 gates streamed content on negotiated observer capabilities,
  * so existing owners are replaced before exposing the new observer path.
  */
-export declare const DAEMON_GENERATION = 196;
+export declare const DAEMON_GENERATION = 199;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7
  * requires durable publication receipts and acknowledged attachment dispatch,

package/dist/types/sdk/client/client.d.ts

@@ -2,6 +2,8 @@ export type SdkErrorCode = "invalid_input" | "unknown_operation" | "not_found" |
 export declare class SdkClientError extends Error {
     readonly code: SdkErrorCode;
     readonly details: unknown;
+    /** True only when the SDK client itself reported a transport failure, never for a server error frame. */
+    readonly transport: boolean;
     /**
      * Reconnect-cycle diagnostics, separate from `details` because `details` is an
      * established contract: callers read the terminating transport error straight off
@@ -10,7 +12,9 @@ export declare class SdkClientError extends Error {
      * break every such reader, so the new attribution rides alongside it instead.
      */
     readonly reconnect?: SdkReconnectExhaustedDetails;
-    constructor(code: SdkErrorCode, message: string, details?: unknown, reconnect?: SdkReconnectExhaustedDetails);
+    constructor(code: SdkErrorCode, message: string, details?: unknown, reconnect?: SdkReconnectExhaustedDetails, options?: {
+        transport?: boolean;
+    });
 }
 /** A prepared transport operation failed before any wire handoff. */
 export declare class SdkPreparedDispatchError extends SdkClientError {

package/dist/types/sdk/host/session-runtime.d.ts

@@ -3,6 +3,7 @@ import { type Settings } from "../../config/settings";
 import type { ExtensionAPI, ExtensionContext } from "../../extensibility/extensions";
 import type { AgentEndEvent } from "../../extensibility/shared-events";
 import { ensureBroker } from "../broker/ensure";
+import { captureRuntimeImageIdentity } from "../broker/runtime";
 import { type MasterRoleAttestationV2, SessionIndex, type SessionLocatorV2 } from "../broker/session-index";
 import type { SdkPromptTerminalOutcome } from "../prompt-status";
 import { type ReceiptState } from "../receipt-state";
@@ -286,6 +287,12 @@ export interface CreateSdkSessionRuntimeOptions {
     onFailureDiagnosticKeyCountForTests?: (count: number) => void;
     /** Test-only observation after a resolved invocation completion is reconciled. */
     onInvocationCompletionReconciledForTests?: (kind: InvocationKind, correlation: InvocationCorrelation) => void;
+    /** Test hook: provides a function to inject a controlled clock for broker recovery backoff assertions. */
+    setRecoveryBackoffClockForTest?: (inject: (clock: {
+        now(): number;
+    }) => void) => void;
+    /** Test hook: inject mock runtime image identity and replacement detection for broker recovery tests. */
+    setRuntimeImageIdentityForTest?: (register: (captureFn: () => Awaited<ReturnType<typeof captureRuntimeImageIdentity>> | undefined, isReplacedFn: () => Promise<boolean>) => void) => void;
 }
 export interface InvocationCorrelation {
     commandId: string;

package/dist/types/sdk/prompt-watchdog.d.ts

@@ -65,7 +65,7 @@ export declare const ACP_PROMPT_INFERENCE_TIMEOUT_MS: number;
 export declare class PromptActivity {
     #private;
     /** Folds one inbound frame's lifecycle event into the in-flight tool and model state. */
-    observe(eventType: string | undefined, toolCallId: string | undefined, messageRole: string | undefined): void;
+    observe(eventType: string | undefined, toolCallId: string | undefined, messageRole: string | undefined, messageHasToolCall?: boolean): void;
     /** True while at least one started tool call has not reported an end. */
     get running(): boolean;
     /** True while a dispatched model call has not produced the first frame of its response. */

package/dist/types/session/agent-session.d.ts

@@ -1940,6 +1940,8 @@ export declare class AgentSession {
      * Get session statistics.
      */
     getSessionStats(): SessionStats;
+    /** Current auto-compaction threshold, including active model-promotion policy. */
+    getAutoCompactionThresholdTokens(contextTokens?: number): number;
     /**
      * Get current context usage statistics.
      * Uses the last assistant message's usage data when available,

package/dist/types/task/index.d.ts

@@ -51,7 +51,6 @@ export declare class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskT
      */
     get parameters(): TaskToolSchemaInstance;
     renderCall(args: unknown, options: Parameters<typeof renderTaskCall>[1], theme: Theme): import("@gajae-code/tui").Component;
-    /** Dynamic description that reflects current disabled-agent settings */
     get description(): string;
     private constructor();
     /**

package/dist/types/tools/bash.d.ts

@@ -10,6 +10,7 @@ import type { ToolSession } from ".";
 import { type OutputMeta } from "./output-meta";
 export { STEER_FOLD_GRACE_MS, steerFoldReasonLine } from "./steer-fold";
 export declare const BASH_DEFAULT_PREVIEW_LINES = 10;
+export declare const MANAGED_OWNER_BASH_ENV: readonly ["GJC_TMUX_OWNER_STATE_DIR", "GJC_TMUX_OWNER_GENERATION", "GJC_MANAGED_OWNER_RUN_ID", "GJC_MANAGED_OWNER_INCARNATION", "GJC_MANAGED_OWNER_CHILD_TOKEN", "GJC_MANAGED_OWNER_PREDECESSOR_TOKEN", "GJC_MANAGED_OWNER_PREDECESSOR_GENERATION", "GJC_MANAGED_OWNER_PREDECESSOR_RUN_ID", "GJC_MANAGED_OWNER_PREDECESSOR_INCARNATION", "GJC_MANAGED_OWNER_TRANSCRIPT_PATH", "GJC_TMUX_OWNER_SERVER_KEY", "GJC_TMUX_LAUNCHED"];
 export type BashOriginalArtifactSaveResult = BashArtifactSaveResult;
 /**
  * Lift a leading `cd <dir> &&` into the tool cwd only when `<dir>` is exactly

package/dist/types/tools/descriptors.d.ts

@@ -17,6 +17,11 @@ export interface ToolDescriptorMetadata {
     readonly intent?: AgentTool<any, any, any>["intent"];
     readonly parametersForSession?: (session?: ToolSession) => TSchema;
     readonly parameters?: TSchema;
+    /**
+     * Renders the description the loaded tool will report for this session. Tools whose prompt text
+     * depends on session settings need it, or the advertised text changes on first load (#5992).
+     */
+    readonly descriptionForSession?: (session: ToolSession) => string;
     readonly description?: string;
     readonly label?: string;
     readonly customWireName?: string;