@gajae-code/coding-agent 0.18.1 → 0.18.6

package/CHANGELOG.md

@@ -2,6 +2,167 @@
 
 ## [Unreleased]
 
+## [0.18.6] - 2026-10-03
+
+### Added
+
+- Explicit correlated active-turn steering through coordinator send_prompt, with operator guidance separating requested evidence, queued tasks, and verified consumption. Retargeting feedback to a new active turn requires a new idempotency key; admission still does not prove consumption.
+
+- `gjc sdk diagnostics broker` and the exported `observeExistingBroker` facade now report a real running broker: the broker publishes a startup-fixed diagnostic generation, build snapshot and protocol, and the observation reads the publication only through the approved read-only native lease, opens exactly one client connection with no reconnect attempts, and returns a frozen snapshot with no token, endpoint, path, pid or environment value. An observed result exits 0 and a typed unavailability exits 1.
+
+- `gjc sdk diagnostics broker`: a read-only broker observation route that can never start, ensure, retire, restart or recover a broker. This entry ships the inert public entry, grammar and bounded observation document; the observation reader is wired in the accompanying fragment.
+
+### Changed
+
+- Built-in Codex profiles no longer use GPT-6 Sol or GPT-5.6 Terra. Every role that used `openai-codex/gpt-6-sol` or `openai-codex/gpt-5.6-terra` now uses `openai-codex/gpt-6.1-sol` at the same reasoning effort, so `codex-medium` and `codex-pro` are GPT-6.1 Sol in every role. Affected profiles: `codex-medium`, `codex-pro`, `astra-lite`, `astra-default`, `astra-heavy`, `opus-codex`, `codex-opencodego`, and `fable-opus-codex`. Moving Terra roles onto Sol is an intentional tier change; the catalog price of GPT-6.1 Sol is equal to or below Terra's. The `gpt-6-sol` and `gpt-5.6-terra` catalog entries are unchanged for explicit selection (#6163).
+- `codex-eco` is now `codex-medium` with Sol lowered to `openai-codex/gpt-6-luna` at the same effort, so it uses GPT-6 Luna in every role. Its default, critic, and architect move from GPT-5.6 Terra to GPT-6 Luna (#6163).
+- Roles that moved off GPT-5.6 Terra now compact earlier. GJC forces the Codex GPT-5.6 family to a 372K context window, while GPT-6.1 Sol and GPT-6 Luna use 272K, the window the Codex backend reports for both families (#6163).
+- Installs that load a signed preset registry revision defining these profiles keep that registry binding (built-in, then registry, then user `models.yml`) until a registry revision carries this change (#6163).
+
+- The `gjc` entry module is now inert on import: entry metadata moved to the pure `@gajae-code/utils/cli-metadata` leaf (re-exported from `dirs`), and the effectful bootstrap (startup timing, stderr drainer, malloc re-exec, managed-owner admission, public dispatch, registry) moved to `cli-ordinary` which loads lazily for every non-diagnostics command with unchanged ordering.
+
+### Removed
+
+- Removed the `codex-sol61` built-in profile added in 0.18.2. A saved or requested `codex-sol61` now resolves to `codex-pro`, which differs in two roles: critic is `openai-codex/gpt-6.1-sol:max` instead of `:xhigh`, and architect is `openai-codex/gpt-6.1-sol:xhigh` instead of `openai-codex/gpt-6-astra:xhigh`. Define a custom `codex-sol61` profile in `models.yml` to keep the previous mapping; a user-defined profile takes precedence over the alias (#6163).
+
+### Fixed
+
+- The isolated bash shell supervisor no longer busy-spins while its shell is idle. It reaped adopted zombies by sweeping all of `/proc` every 25 ms without waiting for the previous sweep to finish, which kept each supervisor at about 160% CPU and tens of thousands of context switches per second even during `sleep`. Sweeps now run only on `SIGCHLD`, one at a time, so an idle supervisor stays near 0% CPU (#5972).
+
+- Run compound pipeline stages concurrently to prevent pipe-buffer deadlocks.
+- Join remaining pipeline stages when a stage wait returns an error.
+
+- ACP `session/new` now waits for the model to settle before building the response when `modelRoles.default` is configured but no `--model` is passed. This ensures the `model` config option is always present in the response, preventing ACP clients (like Paseo) from failing with `model_not_selected` on the first prompt when the session uses a configured default model.
+
+- Resuming a session with an unavailable pinned credential no longer aborts when the startup model profile probes that provider; credential failure is reported so the user can re-pin or select AUTO.
+- Resuming a session with an unavailable pinned credential now honors an explicit `--api-key` or a literal `models.yml` `apiKey` when restoring the saved model, the settings default, and extension-registered models, instead of reporting the pin unavailable. An `apiKeyEnv` key does not unblock the pin, because another stored api_key account could take precedence over it; without an explicit key the provider stays blocked until the user re-pins or selects AUTO.
+
+- Windows Telegram daemon stop and reload now wait for the owner-fenced cooperative control request before force escalation, and post-update recovery failures exit cleanly with actionable guidance instead of an uncaught exception (#6138).
+- Added an owner-fenced control wakeup for blocked Telegram polls and extended hard-termination cooperative grace before escalation (#6138).
+
+- A process dying between the POSIX lock-removal detach and payload scrub no longer wedges every subsequent launch with `FileLockAcquireError` ("blocked by abandoned removal transition"): the dead owner's `.lock.removing` transition is reclaimed through the identity-bound guarded removal, and a refused reclamation keeps contending and still reports the abandoned transition at exhaustion (#6253).
+
+- Allow a fresh ACP prompt to wait for a previously failed or cancelled turn to finish winding down before reporting a busy conflict.
+- Admit the next ACP prompt immediately after cancellation settles instead of requiring a retry.
+
+- Scope ACP SDK session-router attachments to sessions owned or being attached by that ACP connection, preventing foreign session hosts from being kept alive.
+
+- Sessions without explicit `retry.*` settings now auto-retry a content-free OpenAI Codex `server_error` / `internal_error` error event, the same way a content-free `server_is_overloaded` event is already retried. Attempts that produced visible output or tool content are still never retried.
+
+- Coordinator MCP: `GJC_COORDINATOR_MCP_ARTIFACT_BYTE_CAP`, `GJC_COORDINATOR_MCP_SESSION_IDLE_TTL_MS` and `GJC_COORDINATOR_MCP_SESSION_SWEEP_INTERVAL_MS` accept only plain decimal digits; values such as `64KB`, `1e6` or `1.5` now fall back to the default instead of being read as their leading digits (`64KB` used to set a 64-byte artifact cap).
+- `gjc setup hermes --artifact-byte-cap` rejects integers above `Number.MAX_SAFE_INTEGER` (for example `9007199254740992` or `1e21`), which it used to write in a form the coordinator then ignored, silently leaving the 64 KiB default in place.
+
+- Report out-of-scope Coordinator evidence paths as invalid input instead of service unavailability, without exposing denied paths. Clarify evidence-root restrictions in the Hermes operator guide.
+
+- Coordinator MCP tool arguments `timeout_ms`, `poll_interval_ms`, `limit` and `lines`, and the `GJC_COORDINATOR_MCP_PROMPT_ACK_TIMEOUT_MS` env value, no longer read a leading digit prefix. A string such as `1e4` or `5s` became a 1 ms or 5 ms wait, and a one-element array such as `[50]` was accepted as `50`; strings must now be plain decimal digits and non-numeric types fall back to the defaults.
+
+- `GJC_COORDINATOR_MCP_EVENT_WEBHOOK_TIMEOUT_MS` and `GJC_COORDINATOR_MCP_EVENT_WEBHOOK_MAX_ATTEMPTS` now accept only plain decimal digits. Values such as `1.5`, `1e4` or `10s` were read as their leading digits, shrinking the per-attempt timeout to 1 ms or the retry budget to a single attempt; they now fall back to the defaults.
+
+- Reject active deep-interview questions missing structured round metadata instead of accepting answers that cannot be recorded, and reject extra interview questions before prompting.
+- Reject empty and whitespace-only ask question bodies, including metadata-free extra questions, in deferred, loaded, and direct execution paths while preserving ordinary multi-question and free-text asks, including next-workflow choices after final-spec handoff.
+
+- Restore cache prefix extension across LLM requests by keeping volatile project context and untrusted MCP server instructions in `agent.state.messages` after they are sent, rather than removing them after each turn. This allows subsequent requests to properly reuse the cache prefix from previous requests, improving cache hit rates and reducing unnecessary re-computation. Volatile ephemeral messages are still excluded from persistent storage as intended. Fixes #6167.
+
+- Gate the statusless typed overload check on `managedOutcome` in `#handleRetryableError` to prevent hanging when a managed fallback chain encounters a transport 503 error followed by a typed Responses overload error. The fix ensures that on the agent_end path, the statusless overload check returns false to allow proper session termination handling instead of deadlocking. Fixes #6180.
+
+- `AgentSession.messages` no longer exposes request-scoped ephemeral messages (`volatile-project-context`, `untrusted-mcp-server-instructions`) that #6167 retains in `agent.state.messages` for prompt-cache prefix reuse. The cache prefix behavior is unchanged; the public view and everything built on it match the pre-#6167 transcript again, which fixes the red `dev` CI in the managed fallback attempt transaction test (#6191).
+
+- Bash commands with auto-background disabled no longer leave the foreground via the timeout fold timer after timing out.
+
+- Lifecycle ledger compaction now evicts only safe settled identities while retaining unbound close replay fences and retirement-source dependencies.
+
+- Context-usage and compaction token estimates count the request-scoped ephemeral messages (`volatile-project-context`, `untrusted-mcp-server-instructions`) that are retained in `agent.state.messages` for prompt-cache reuse. They are hidden from `AgentSession.messages`, so estimating over that public view undercounted the real provider request and could delay auto-compaction until the context window overflowed.
+
+- Recover abandoned parseable lock removal transitions when their owner is proven dead.
+
+- Let SDK steering reach the active worker despite an earlier ordinary ordered control, while waiting behind abort-and-prompt replacements and fencing to the exact runtime command/turn identity so stale feedback is rejected instead of delivered to a successor.
+
+- Return an empty observation for missing assistant text instead of a resource-loss error, including compatibility with older running SDK hosts.
+
+- Stubbed credential-pin methods in the login preset recommendation test mock (follow-up to #6025).
+
+- Keep managed replacement receipts owned by their exact publishing attempt until it settles, preventing concurrent sessions in one workspace from stealing active receipts and failing transcript persistence with `identity_mismatch`. Peer recovery of publisher-bound receipts requires positive owner-exit or PID-reuse evidence; orphan receipt identity checks and external transcript replacement guards remain intact.
+
+- Fixed the resident-cache GC reaping a *running* session's cache on Linux hosts with a slewed wall clock (WSL2 in particular), which replaced tool results with `[Session resident text blob missing: …]` placeholders and logged `Resident cache trust rejection … blob_create_failed ENOENT`. The owner lease recorded the process start from `ps -o lstart`, which procps renders as `btime + ticks` where `btime` is re-derived from the current wall clock minus uptime, so the same live process reported a start time that drifted (observed: 15 minutes over 11 hours) and the sweep read the drift as PID reuse. On Linux the lease now records the `/proc/<pid>/stat` start tick count scoped by the kernel `boot_id` (basis `linux-proc-ticks:<boot_id>`), which never moves for a live process; reuse is only proven when the basis matches, so leases written by older builds or another boot are never reaped while their PID is alive.
+
+- Broker observation refuses everything it cannot prove: a publication without the diagnostic capability is `unsupported` (never `absent` or malformed), only the canonical loopback endpoint with an in-range port is accepted, the broker answers only from an already-owned healthy publication, one monotonic budget covers the whole observation so an expired budget never opens a socket and a late answer is discarded, and malformed arguments raise a typed argument error instead of a fabricated observation.
+
+- The read-only diagnostic addon's trusted digest now travels with the addon through the release path: each build emits a provenance sidecar, consuming jobs rebuild the record from those sidecars against the version actually being shipped, and embedding plus platform-package staging refuse bytes that do not match it.
+
+- Reverted the 0.18.2 readiness-cutoff reaping (#6126) because it left hosts in `terminal_uncertain` under concurrent recovery (#6143); unregistered hosts terminated by a signal at readiness cutoff again report `terminal_uncertain` until the fix re-lands.
+
+- Coordinator MCP: a `GJC_COORDINATOR_MCP_SESSION_SWEEP_INTERVAL_MS` above `2147483647` (about 24.9 days) no longer makes the idle-session reaper sweep continuously. The interval was passed straight to `setTimeout`, which treats longer delays as 1 ms; it is now capped at the timer maximum.
+
+- `gjc ssh add --port` now rejects ports that are not plain digits (`"22oops"`, `"2222.5"`, `"+22"`, `"1e3"`) instead of silently saving the leading digits to `ssh.json`.
+
+- `gjc web-search --limit` now rejects `0` and negative values with an error instead of passing them to providers, where a negative limit silently dropped results from the end of the source list.
+
+- The `web_search` tool schema now declares `limit` and `num_search_results` as positive integers, so a model-supplied `0`, negative or fractional count is rejected at validation instead of reaching providers, where a negative count silently dropped sources from the end of the list.
+
+### Tests
+
+- Add regression test for issue #6004: Verify that after overflow auto-compaction without a continuation scheduled, the session remains usable for subsequent prompts. The test exercises the overflow path to ensure pending agent_end events do not block future prompt submissions (related to #6004).
+
+## [0.18.5] - 2026-09-30
+
+## [0.18.4] - 2026-09-30
+
+## [0.18.3] - 2026-09-30
+
+## [0.18.2] - 2026-09-30
+
+### Added
+
+- Added the additive `codex-sol61` built-in model profile for GPT-6.1 Sol.
+
+### Changed
+
+- Built-in `claude-opus` and `claude-fable` executor roles and the `opus-codex` planner role now use `anthropic/claude-sonnet-5-5` instead of `anthropic/claude-sonnet-5` (#6111).
+
+### Fixed
+
+- Bare line-number and hash-only hashline anchors now fail with actionable, copy-ready full-anchor suggestions; edits remain unapplied until a full anchor is supplied.
+
+- On macOS, the shell runtime no longer exits with code 70 when spawning fast-exiting child processes or entitled/setuid children (like `/bin/ps`, `/usr/bin/top`, `sudo`) that cannot be queried for unique identity. When a child is confirmed absent or terminated before observation, the process identity is recorded like on Linux. Only genuine integrity failures (ledger write failures, HMAC errors) trigger exit 70 on a live child (#6085).
+
+- Exa MCP tool-call responses are formatted in bounded time. `formatGenericResponse` re-indents the entire formatted subtree at every object level, so cost grew super-linearly with nesting depth: 500/1000/2000/4000/8000 levels cost 60ms/227ms/730ms/5.9s/94s, and 20000 levels exhausted the call stack. The payload is whatever the remote MCP server returned, and the 16 MiB content cap does not bound depth — 8000 levels of `{"a":` is under 47 KB. Depth is now limited to 64, matching the session-import walker, and output for payloads within that limit is unchanged.
+
+- Preserve the one-line hashline retry hint when copied text contains literal `..`, while keeping ambiguous range edits rejected without modifying the file (#6112).
+
+- Nested `gjc` commands run through the Bash tool inside a managed-owner (tmux-supervised) session no longer fail with `managed_owner_admission_metadata_invalid`: the Bash boundary now scrubs the whole managed-owner env family, including the tmux owner server key and `GJC_TMUX_LAUNCHED`, instead of leaving a partial owner context behind (#6140).
+
+- Keep the ACP prompt watchdog on its awaiting-model bound until a streamed tool call actually begins executing.
+
+- Sessions without explicit `retry.*` settings now retry a content-free "socket connection was closed unexpectedly" (`ECONNRESET`) failure when the attempt is replay-safe, bounded by `retry.maxRetries`. Previously the bare-default gate only admitted stream-timeout watchdog errors, so a transient connection reset before any response ended the turn even though it was classified as transient.
+
+- Fixed sessions intermittently hanging after a tool call on long contexts (seen with OpenGateway `-ultrafast` models). The CLI no longer routes `fetch()` through Bun's HTTP/2 client, which could stall a pooled connection on large request bodies until the process restarted.
+
+- A long-running session whose `gjc` binary was replaced on disk no longer respawns the shared SDK broker over and over. Broker recovery now stops and asks for a session restart when this process's runtime image was replaced (same path, new file identity) or removed, and repeated recovery failures back off exponentially up to a cap instead of retrying every 30–60 seconds. Other clients sharing the broker are no longer disrupted by the churn (#6040).
+
+- Model registry refreshes no longer rescan and re-lowercase the whole model catalog for every registry-profile selector; selector matching uses a prebuilt index.
+
+- Validating cached model-preset registry documents is about a third faster: canonical JSON serialization no longer calls `JSON.stringify` for strings that need no escaping and checks surrogates with the native well-formedness test.
+
+- A session sharing its managed scope with another `gjc` process (for example a master session and the SDK session it spawned) no longer stops persisting with `managed_replace_receipt_cleanup_pending:quarantine_collision` when both processes try to retire the same replacement cleanup receipt at the same time. The process that loses the race to claim the retirement slot now leaves the receipt for a later reconciliation, and its own session write continues.
+
+- Keep SDK prompts alive when transient directed delivery back-pressure (`writer_backlog_full`) drops a correlated progress frame. Previously the prompt was abandoned while the run kept executing, so the final `agent_end` was dropped and ACP clients only settled the prompt when the prompt watchdog expired. Terminal frames now retry briefly under back-pressure so the prompt settles normally.
+- Release the prompt submission and work lease when terminal delivery still fails after the retry window, while preserving the `delivery_failed` terminal outcome.
+
+- Keep SDK and ACP prompts alive when a streaming message snapshot exceeds the directed frame limit, and report a correlated delivery failure to the requester only when the undeliverable frame is the run's own terminal, so a prompt is never reported failed while its execution is still running.
+- Preserve assistant text shape and terminal truncation metadata when bounding oversized correlated frames.
+- Preserve as much aggregate assistant message_end text as fits, including ordered text blocks.
+
+- Give broker-admitted lifecycle launches without a worktree a fresh child readiness budget after bounded pre-spawn bookkeeping, while preserving caller-supplied exact deadlines.
+- Bound broker-derived non-worktree pre-spawn preparation by the unused admission window (10s without queueing at default readiness), so fresh readiness still finishes inside the unchanged caller deadline.
+
+- Exit lifecycle session hosts cleanly after publishing a complete rollback receipt at the readiness cutoff.
+
+- Prove broker-owned session hosts have exited at readiness cutoff before returning retryable startup failures, including hosts blocked during extension initialization.
+
+- `gjc stats --json` now writes only the JSON document to stdout, so `gjc stats --json | jq ...` works. The `Synced N new entries ...` summary goes to stderr in JSON mode, alongside the sync progress. The dashboard and `--summary` output are unchanged.
+
+- Interactive `/ssh add ... --port` rejects a port with trailing or non-digit characters (for example `22oops` or `2222.5`) instead of saving the digits before them, matching the ACP `/ssh add` parser.
+
 ## [0.18.1] - 2026-09-29
 
 ### Fixed

package/dist/types/cli/stats-cli.d.ts

@@ -8,10 +8,5 @@ export interface StatsCommandArgs {
     json: boolean;
     summary: boolean;
 }
-/**
- * Parse stats subcommand arguments.
- * Returns undefined if not a stats command.
- */
-export declare function parseStatsArgs(args: string[]): StatsCommandArgs | undefined;
 export declare function runStatsCommand(cmd: StatsCommandArgs): Promise<void>;
 export declare function printStatsHelp(): void;

package/dist/types/cli-commands.d.ts

@@ -0,0 +1,10 @@
+import type { CommandEntry } from "@gajae-code/utils/cli";
+/**
+ * Public-family hooks kept available for private-worker tests without loading the
+ * full registry.
+ *
+ * This is the single shared array: the inert entry (`cli.ts`) and the ordinary
+ * dispatcher (`cli-ordinary.ts`) both re-export THIS object, so a test that
+ * mutates or injects an entry keeps affecting the dispatcher.
+ */
+export declare const commands: CommandEntry[];

package/dist/types/cli-ordinary.d.ts

@@ -0,0 +1,13 @@
+/** Ordinary CLI graph: everything the inert entry must not load eagerly.
+ *
+ * This module owns the effectful bootstrap (startup timing, stderr drainer,
+ * bash-shell worker protocol) plus the unchanged ordinary routing order:
+ * bash-shell workers -> darwin malloc re-exec -> internal smoke -> tmux owner
+ * isolation -> managed-owner supervisor/admission/recovery -> private sdk
+ * stderr drainer -> public family dispatch -> community app -> doctor worker /
+ * probe / cli -> full registry. `cli.ts` imports it lazily, only after argv has
+ * been proven not to be a `sdk diagnostics` observation. */
+import { commands } from "./cli-commands";
+export { commands };
+/** Run every non-diagnostics command with the original admission order. */
+export declare function runOrdinaryCli(argv: string[]): Promise<void>;

package/dist/types/cli.d.ts

@@ -1,6 +1,15 @@
 #!/usr/bin/env bun
-import type { CommandEntry } from "@gajae-code/utils/cli";
-/** Public-family hooks kept available for private-worker tests without loading the full registry. */
-export declare const commands: CommandEntry[];
+/** Inert CLI entry.
+ *
+ * `bin/gjc.js` imports THIS module, so anything statically imported here runs
+ * before argv is inspected. Keep it to pure metadata: the read-only
+ * `sdk diagnostics` observation route must not be able to resolve directories,
+ * consult NSS for a missing/ambiguous HOME, load the native addon, install
+ * runtime globals, re-exec for malloc env vars, run managed-owner admission or
+ * recovery, or touch the error-evidence store. Everything effectful lives in
+ * `./cli-ordinary`, which is imported lazily for every other command with its
+ * original ordering and admission semantics. */
+import { commands } from "./cli-commands";
+export { commands };
 /** Run the CLI with argv excluding process.argv prefix. */
 export declare function runCli(argv: string[]): Promise<void>;

package/dist/types/commands/contribution-prep.d.ts

@@ -3,9 +3,6 @@ export default class ContributionPrep extends Command {
     static description: string;
     static strict: boolean;
     static flags: {
-        "no-spawn": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
-            description: string;
-        };
         "source-session-id": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };

package/dist/types/commands/sdk.d.ts

@@ -132,6 +132,9 @@ export declare function runSessionHost(timing?: {
 export type SdkInternalArgv = {
     action: "broker-internal";
     agentDir: string;
+} | {
+    action: "broker-trampoline-internal";
+    agentDir: string;
 } | {
     action: "session-host-internal";
 } | {

package/dist/types/commands/update.d.ts

@@ -1,4 +1,5 @@
 import { Command } from "@gajae-code/utils/cli";
+export declare function runUpdateRecoveryCommand(recover?: () => Promise<void>): Promise<void>;
 export default class Update extends Command {
     static description: string;
     static flags: {

package/dist/types/config/autorouting-tier-map.d.ts

@@ -33,14 +33,18 @@ export declare const CURATED_TIER_LABELS: {
         readonly tier: "fast";
         readonly rank: 1;
     }];
-    readonly "anthropic/claude-sonnet-5": readonly [{
+    readonly "anthropic/claude-sonnet-5-5": readonly [{
         readonly tier: "balanced";
         readonly rank: 1;
     }];
-    readonly "anthropic/claude-sonnet-4-6": readonly [{
+    readonly "anthropic/claude-sonnet-5": readonly [{
         readonly tier: "balanced";
         readonly rank: 2;
     }];
+    readonly "anthropic/claude-sonnet-4-6": readonly [{
+        readonly tier: "balanced";
+        readonly rank: 3;
+    }];
     readonly "anthropic/claude-opus-5-5": readonly [{
         readonly tier: "strong";
         readonly effort: "high";
@@ -70,6 +74,11 @@ export declare const CURATED_TIER_LABELS: {
         readonly effort: "high";
         readonly rank: 1;
     }];
+    readonly "openai-codex/gpt-6.1-sol": readonly [{
+        readonly tier: "strong";
+        readonly effort: "high";
+        readonly rank: 2;
+    }];
     readonly "google/gemini-3.5-flash-lite": readonly [{
         readonly tier: "fast";
         readonly rank: 1;
@@ -123,6 +132,24 @@ export declare const CURATED_TIER_LABELS: {
 };
 /** Generated from packages/ai/src/models.json at feature land: 3936 in-scope baseline skips. */
 export declare const TIER_MAP_SKIP_LIST: {
+    readonly "amazon-bedrock/anthropic.claude-sonnet-5-5": {
+        readonly rationale: "Sonnet 5.5 catalog addition (#6111); not yet curated";
+    };
+    readonly "amazon-bedrock/au.anthropic.claude-sonnet-5-5": {
+        readonly rationale: "Sonnet 5.5 catalog addition (#6111); not yet curated";
+    };
+    readonly "amazon-bedrock/eu.anthropic.claude-sonnet-5-5": {
+        readonly rationale: "Sonnet 5.5 catalog addition (#6111); not yet curated";
+    };
+    readonly "amazon-bedrock/global.anthropic.claude-sonnet-5-5": {
+        readonly rationale: "Sonnet 5.5 catalog addition (#6111); not yet curated";
+    };
+    readonly "amazon-bedrock/jp.anthropic.claude-sonnet-5-5": {
+        readonly rationale: "Sonnet 5.5 catalog addition (#6111); not yet curated";
+    };
+    readonly "amazon-bedrock/us.anthropic.claude-sonnet-5-5": {
+        readonly rationale: "Sonnet 5.5 catalog addition (#6111); not yet curated";
+    };
     readonly "kiro/claude-opus-5-5": {
         readonly rationale: "post-rebase catalog addition from dev; not yet curated";
     };

package/dist/types/config/model-profile-activation.d.ts

@@ -44,6 +44,7 @@ export interface PrepareModelProfileActivationOptions {
     session: ModelProfileActivationSession;
     modelRegistry: Pick<ModelRegistry, "getModelProfile" | "getModelProfiles" | "getAvailableModelProfileNames" | "getApiKeyForProvider" | "getAll" | "resolveCanonicalModel" | "getCanonicalVariants" | "getCanonicalId" | "isSelectorCircuitOpen"> & Partial<Pick<ModelRegistry, "getAvailable" | "getAvailableForProfileActivation" | "resolveModelByLookupAlias" | "lookupAliasExists" | "clearCanonicalVariant" | "seedCanonicalVariant" | "getSessionCanonicalVariant" | "restoreSessionCanonicalVariant" | "getConfiguredProviderIds" | "isKnownProvider">> & {
         getError?: ModelRegistry["getError"];
+        authStorage?: ModelRegistry["authStorage"];
     };
     settings: Pick<Settings, "get" | "getGlobal" | "getOverride">;
     profileName: string;
@@ -129,6 +130,24 @@ export declare class ModelProfileCredentialError extends Error {
     readonly role: string | undefined;
     constructor(profileLabel: string, providers: readonly string[], role?: string);
 }
+interface SessionPinRegistry {
+    authStorage?: {
+        hasRuntimeApiKey(provider: string): boolean;
+        hasLiteralConfigApiKey(provider: string, owner?: object): boolean;
+        hasSessionCredentialUnavailable(provider: string, scopeId?: string): boolean;
+    };
+    getAuthStorageOwner?(): object;
+}
+/**
+ * Whether an unavailable session credential pin blocks `provider`.
+ *
+ * Mirrors `AuthStorage.getApiKey` precedence: a runtime `--api-key` override or a literal
+ * `models.yml` `apiKey` registered for this registry's owner is resolved before the
+ * unavailable-pin marker, so either one keeps the provider usable. An `apiKeyEnv` key does
+ * not: `getApiKey` prefers another stored api_key account over it, which would silently
+ * retarget the unavailable pin.
+ */
+export declare function isSessionCredentialPinBlocking(registry: SessionPinRegistry, provider: string, sessionId: string | undefined): boolean;
 export declare function formatModelProfileCredentialError(profileLabel: string, providers: readonly string[]): string;
 export declare function formatModelProfileUnknownProviderError(profileLabel: string, providers: readonly string[]): string;
 /**

package/dist/types/config/model-registry.d.ts

@@ -327,7 +327,22 @@ interface ProviderOverride {
     cacheRetention?: CacheRetention;
     isOAuth?: boolean;
 }
-export declare function registrySelectorResolvesToModel(selector: string, models: readonly Model<Api>[]): boolean;
+/**
+ * Lowercased lookup keys for a model catalog, so selector resolution is a set
+ * lookup instead of a scan that re-lowercases every model id per selector.
+ */
+export interface RegistrySelectorIndex {
+    /** `id` and `provider/id`. */
+    exact: ReadonlySet<string>;
+    /** `id` alone. */
+    ids: ReadonlySet<string>;
+    /** Model ids per provider, for parsed `provider/id` selectors (nested, so no delimiter can collide). */
+    providerIds: ReadonlyMap<string, ReadonlySet<string>>;
+    /** Every `/`-delimited suffix of each id (`a/b/c` → `b/c`, `c`). */
+    idSuffixes: ReadonlySet<string>;
+}
+export declare function createRegistrySelectorIndex(models: readonly Model<Api>[]): RegistrySelectorIndex;
+export declare function registrySelectorResolvesToModel(selector: string, index: RegistrySelectorIndex): boolean;
 /**
  * Merge a freshly discovered model with the matching bundled/configured entry
  * (or a runtime provider override when no bundled entry exists).

package/dist/types/coordinator-mcp/session-reaper.d.ts

@@ -19,6 +19,11 @@ export declare const DEFAULT_SESSION_IDLE_TTL_MS: number;
 export declare const DEFAULT_SESSION_SWEEP_INTERVAL_MS: number;
 export declare const MIN_SESSION_IDLE_TTL_MS = 60000;
 export declare const MIN_SESSION_SWEEP_INTERVAL_MS = 30000;
+/**
+ * Longest delay setTimeout honors. Bun, like Node, treats any larger delay as 1 ms,
+ * so an operator's very long sweep interval would otherwise re-sweep back to back.
+ */
+export declare const MAX_SESSION_SWEEP_INTERVAL_MS: number;
 /** After this many consecutive reap failures the session is force-evicted from the index. */
 export declare const MAX_REAP_FAILURES = 3;
 /** Minimal projection of a coordinator session the reaper needs to decide. */

package/dist/types/edit/modes/replace.d.ts

@@ -1,8 +1,8 @@
 /**
  * Fuzzy matching utilities for the edit tool.
  *
- * Provides both character-level and line-level fuzzy matching with progressive
- * fallback strategies for finding text in files.
+ * Provides both character-level and line-level fuzzy matching with staged
+ * strategies for finding text in files.
  */
 import type { AgentToolResult } from "@gajae-code/agent-core";
 import * as z from "zod/v4";
@@ -92,7 +92,7 @@ export declare function findClosestSequenceMatch(lines: string[], pattern: strin
  */
 export declare function findContextLine(lines: string[], context: string, startFrom: number, options?: {
     allowFuzzy?: boolean;
-    skipFunctionFallback?: boolean;
+    skipParenRetry?: boolean;
 }): ContextLineResult;
 export declare const replaceEditEntrySchema: z.ZodObject<{
     old_text: z.ZodString;

package/dist/types/edit/streaming.d.ts

@@ -7,7 +7,7 @@
  * - compute unified diff previews for the in-flight args
  *   (`computeDiffPreview`), and
  * - render a text placeholder while no diff exists yet
- *   (`renderStreamingFallback`).
+ *   (`renderStreamingPlaceholder`).
  *
  * The shared renderer / `ToolExecutionComponent` consult the strategy via
  * the injected `editMode` rather than probing argument shape.
@@ -51,7 +51,7 @@ export interface EditStreamingStrategy<Args = unknown> {
      * Rendered inline while the diff hasn't been computed yet (or when the
      * compute returned `null` because args are still too partial).
      */
-    renderStreamingFallback(args: Args, uiTheme: Theme): string;
+    renderStreamingPlaceholder(args: Args, uiTheme: Theme): string;
 }
 export interface EditRequestTargetInventory {
     paths: string[];

package/dist/types/exa/mcp-client.d.ts

@@ -22,11 +22,7 @@ export declare function callExaTool(toolName: string, args: Record<string, unkno
 export declare function callWebsetsTool(apiKey: string, toolName: string, args: Record<string, unknown>): Promise<unknown>;
 /** Format search results for LLM */
 export declare function formatSearchResults(data: ExaSearchResponse): string;
-/**
- * Format a non-search MCP response as human-readable text.
- * Handles objects, arrays, primitives, and common MCP response shapes.
- */
-export declare function formatGenericResponse(data: unknown): string;
+export declare function formatGenericResponse(data: unknown, depth?: number): string;
 /** Check if result is a search response */
 export declare function isSearchResponse(data: unknown): data is ExaSearchResponse;
 /** Fetch and cache MCP tool schema */

package/dist/types/exec/bash-shell-guardian.d.ts

@@ -11,5 +11,31 @@ export declare function extendOwnedDarwinAncestry<T extends {
     uniqueId: bigint;
     parentUniqueId: bigint;
 }>(knownUniqueIds: Set<bigint>, candidates: ReadonlyMap<number, T>): number[];
+export declare function authenticateOwnershipRecord(line: string, ledgerToken: string): {
+    processRef?: NativeProcess;
+    darwinUniqueId?: bigint;
+    pending?: true;
+} | undefined;
+export type DarwinAncestryTracker = {
+    seed(uniqueId: bigint): void;
+    track(processRef: NativeProcess, uniqueId?: bigint): boolean;
+    trackGuardian(processRef: NativeProcess, uniqueId?: bigint): boolean;
+    poll(): boolean;
+    close(): void;
+};
+export type DarwinIdentity = {
+    uniqueId: bigint;
+    parentUniqueId: bigint;
+};
+/** Test seams for the Darwin tracker; production uses libproc and the natives binding. */
+export type DarwinAncestryTrackerDeps = {
+    uniqueIdentity?: (pid: number) => DarwinIdentity | undefined;
+    fromPid?: (pid: number) => NativeProcess | null | undefined;
+    observe?: (pid: number) => {
+        status: "present" | "absent" | "unknown";
+        incarnation?: string;
+    };
+};
+export declare function createDarwinAncestryTracker(owned: Map<string, NativeProcess>, deps?: DarwinAncestryTrackerDeps): DarwinAncestryTracker | undefined;
 export declare function runBashShellGuardian(): Promise<void>;
 export {};

package/dist/types/exec/bash-shell-supervisor.d.ts

@@ -1,4 +1,16 @@
+import type { EventEmitter } from "node:events";
 import { type BashShellWorkerResponse } from "./bash-shell-worker-protocol";
+/**
+ * Reap adopted zombies only when the kernel reports a child state change.
+ *
+ * As the Linux child subreaper, the supervisor inherits orphaned descendants
+ * and must reap them, but a full `/proc` sweep is expensive. Polling it on a
+ * short interval kept every idle supervisor busy (issue #5972), so sweeps are
+ * driven by SIGCHLD instead. At most one sweep runs at a time, and a SIGCHLD that
+ * arrives mid-sweep schedules exactly one follow-up so a zombie created after
+ * its `/proc` entry was passed is never missed. Returns the unsubscribe hook.
+ */
+export declare function startLinuxAdoptedZombieReaper(excludedPid: number | undefined, reap?: (excludedPid: number | undefined) => Promise<void>, signals?: Pick<EventEmitter, "on" | "off">): () => void;
 export declare function createUtf8LineDecoder(onLine: (line: string) => void, options?: {
     maxBufferedBytes?: number;
     onOverflow?: () => void;

package/dist/types/hashline/parser.d.ts

@@ -1,19 +1,41 @@
+import { HL_OP_INSERT_AFTER, HL_OP_INSERT_BEFORE, HL_OP_REPLACE } from "./hash";
 import type { HashlineCursor, HashlineEdit } from "./types";
+type HashlineOpSigil = typeof HL_OP_INSERT_BEFORE | typeof HL_OP_INSERT_AFTER | typeof HL_OP_REPLACE;
 /**
- * An op referenced lines by number alone, without the content hash. The edit
- * is never applied on a line number alone; the executor answers with the
- * current full anchors for {@link lines} so the model can retry without an
- * extra read.
+ * An op referenced lines by number alone. The edit is never applied on a line
+ * number alone; the executor answers with the current full anchors so the model
+ * can retry without another read.
  */
 export declare class HashlineMissingHashError extends Error {
     readonly lines: {
         start: number;
         end: number;
     };
+    readonly opSigil: HashlineOpSigil;
+    readonly rangeRaw?: {
+        start: string;
+        end: string;
+    } | undefined;
     constructor(message: string, lines: {
         start: number;
         end: number;
-    });
+    }, opSigil: HashlineOpSigil, rangeRaw?: {
+        start: string;
+        end: string;
+    } | undefined);
+}
+export declare class HashlineMissingLineError extends Error {
+    readonly hash: string;
+    readonly lineNum: number | undefined;
+    readonly opSigil: HashlineOpSigil;
+    readonly rangeRaw?: {
+        start: string;
+        end: string;
+    } | undefined;
+    constructor(hash: string, lineNum: number | undefined, opSigil: HashlineOpSigil, rangeRaw?: {
+        start: string;
+        end: string;
+    } | undefined);
 }
 export declare function cloneCursor(cursor: HashlineCursor): HashlineCursor;
 export declare function parseHashline(diff: string): HashlineEdit[];
@@ -21,3 +43,4 @@ export declare function parseHashlineWithWarnings(diff: string): {
     edits: HashlineEdit[];
     warnings: string[];
 };
+export {};

package/dist/types/modes/acp/acp-agent.d.ts

@@ -46,7 +46,12 @@ export declare function paginateAcpSessions(listed: unknown[], cwd: string | und
 export declare function acpAvailableCommandsFromSkills(query: unknown): AvailableCommand[];
 type SdkPromptFailedOutcome = Extract<SdkPromptTerminalOutcome, {
     kind: "failed";
-}>;
+}> & {
+    deliveryFailure?: {
+        cause: string;
+        frameBytes: number;
+    };
+};
 /**
  * A prompt rejection that still carries the terminal's structured failure classification.
  * The ACP client sees only the code and message, but the first-turn retry gate must decide on

package/dist/types/sdk/broker/discovery.d.ts

@@ -36,6 +36,14 @@ export interface BrokerDiscovery {
     ownerId: string;
     pid: number;
     incarnation: string;
+    /**
+     * Public publication-incarnation id for diagnostic observation, fixed at startup.
+     * Absent on publications written before the capability existed; an observer then
+     * reports `unsupported` instead of synthesizing compatibility.
+     */
+    diagnosticGeneration?: string;
+    /** Diagnostic protocol the publisher answers; absent means no capability. */
+    diagnosticProtocol?: number;
     host: "127.0.0.1";
     port: number;
     url: string;

package/dist/types/sdk/broker/ensure.d.ts

@@ -139,6 +139,7 @@ interface BrokerOwner {
     stop(): Promise<void>;
     canReuse(discovery: BrokerDiscovery | null): boolean;
     markReady(discovery: BrokerDiscovery): boolean;
+    setTarget(pid: number, incarnation: string): void;
 }
 interface ReapTiming {
     gracefulMs: number;

package/dist/types/sdk/broker/lifecycle-ledger.d.ts

@@ -61,6 +61,8 @@ export interface LifecycleDurableEffectsReceipt {
 export interface LifecycleLedgerEntry {
     operationKey?: string;
     fingerprint?: string;
+    /** True only when a session.close request supplied immutable generation authority. */
+    closeAuthorityBound?: boolean;
     version: typeof SDK_STATE_VERSION;
     identity: string;
     requestHash: string;
@@ -158,12 +160,14 @@ export declare class LifecycleLedger {
     migrateIdentity(from: string, to: string, metadata: {
         operationKey: string;
         fingerprint: string;
+        closeAuthorityBound?: boolean;
     }): Promise<LifecycleLedgerEntry | undefined>;
     get warnings(): readonly string[];
     begin(identity: string, requestHash: string, metadata?: {
         operationKey?: string;
         fingerprint?: string;
         intendedSessionId?: string;
+        closeAuthorityBound?: boolean;
     }): Promise<BeginResult>;
     transition(identity: string, state: LifecycleState, fields?: Omit<Partial<LifecycleLedgerEntry>, "identity" | "requestHash" | "state" | "ts">): Promise<LifecycleLedgerEntry>;
     assertSupportedStateVersions(): Promise<void>;