@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/cli/auth-broker-cli.ts

@@ -25,6 +25,7 @@ import {
 	AuthStorage,
 	type CredentialDisabledEvent,
 	DEFAULT_AUTH_BROKER_BIND,
+	formatOAuthIdentityLabel,
 	getEnvApiKey,
 	getOAuthProviders,
 	listProvidersWithEnvKey,
@@ -568,19 +569,21 @@ interface MigrateSkip {
 
 function credentialIdentity(provider: string, credential: AuthCredential): string {
 	if (credential.type === "api_key") return "(api key)";
-	return credential.email ?? credential.accountId ?? credential.projectId ?? `<${provider} oauth>`;
+	return formatOAuthIdentityLabel(credential) ?? `<${provider} oauth>`;
 }
 
 /**
  * Build the set of "identities already on the broker" so re-runs are idempotent.
- * For OAuth, identity = email|accountId|projectId. For api_key, we collapse
- * to a single marker per provider (broker has no concept of "multiple api keys
- * per provider with different identities"; upsert would coalesce them).
+ * For OAuth, identity = email|accountId|projectId, scoped to the organization
+ * when the credential carries one (one account can sign in to several
+ * organizations). For api_key, we collapse to a single marker per provider
+ * (broker has no concept of "multiple api keys per provider with different
+ * identities"; upsert would coalesce them).
  */
 function indexBrokerSnapshot(snapshot: {
 	credentials: Array<{
 		provider: string;
-		credential: { type: string; email?: string; accountId?: string; projectId?: string };
+		credential: { type: string; email?: string; accountId?: string; projectId?: string; organizationId?: string };
 	}>;
 }): Map<string, Set<string>> {
 	const out = new Map<string, Set<string>>();
@@ -589,22 +592,29 @@ function indexBrokerSnapshot(snapshot: {
 		if (entry.credential.type === "api_key") {
 			ids.add("@api_key");
 		} else {
-			if (entry.credential.email) ids.add(`email:${entry.credential.email}`);
-			if (entry.credential.accountId) ids.add(`accountId:${entry.credential.accountId}`);
-			if (entry.credential.projectId) ids.add(`projectId:${entry.credential.projectId}`);
+			const org = organizationSuffix(entry.credential.organizationId);
+			if (entry.credential.email) ids.add(`email:${entry.credential.email}${org}`);
+			if (entry.credential.accountId) ids.add(`accountId:${entry.credential.accountId}${org}`);
+			if (entry.credential.projectId) ids.add(`projectId:${entry.credential.projectId}${org}`);
 		}
 		out.set(entry.provider, ids);
 	}
 	return out;
 }
 
+function organizationSuffix(organizationId: string | undefined): string {
+	const trimmed = organizationId?.trim();
+	return trimmed ? `|org:${trimmed}` : "";
+}
+
 function brokerAlreadyHas(existing: Map<string, Set<string>>, provider: string, credential: AuthCredential): boolean {
 	const ids = existing.get(provider);
 	if (!ids) return false;
 	if (credential.type === "api_key") return ids.has("@api_key");
-	if (credential.email && ids.has(`email:${credential.email}`)) return true;
-	if (credential.accountId && ids.has(`accountId:${credential.accountId}`)) return true;
-	if (credential.projectId && ids.has(`projectId:${credential.projectId}`)) return true;
+	const org = organizationSuffix(credential.organizationId);
+	if (credential.email && ids.has(`email:${credential.email}${org}`)) return true;
+	if (credential.accountId && ids.has(`accountId:${credential.accountId}${org}`)) return true;
+	if (credential.projectId && ids.has(`projectId:${credential.projectId}${org}`)) return true;
 	return false;
 }
 

package/src/cli/customize-doctor-precedence.ts

@@ -0,0 +1,31 @@
+export interface DiscoveryPrecedenceCandidate {
+	key: string | undefined;
+	provider: string;
+	scope: "user" | "project" | "native";
+	eligible: boolean;
+	enabled: boolean;
+}
+
+export interface DiscoveryPrecedenceResult {
+	shadowed: boolean;
+	shadowedBy?: { provider: string; scope: DiscoveryPrecedenceCandidate["scope"] };
+}
+
+/** Resolve ordered discovery candidates without allowing ineligible or disabled entries to own keys. */
+export function resolveDiscoveryPrecedence(
+	candidates: readonly DiscoveryPrecedenceCandidate[],
+): DiscoveryPrecedenceResult[] {
+	const winners = new Map<string, { provider: string; scope: DiscoveryPrecedenceCandidate["scope"] }>();
+
+	return candidates.map(candidate => {
+		if (!candidate.eligible || candidate.key === undefined) return { shadowed: false };
+
+		const winner = winners.get(candidate.key);
+		if (winner) return { shadowed: true, shadowedBy: winner };
+
+		if (candidate.enabled) {
+			winners.set(candidate.key, { provider: candidate.provider, scope: candidate.scope });
+		}
+		return { shadowed: false };
+	});
+}

package/src/cli/customize-doctor.ts

@@ -54,6 +54,7 @@ import {
 	isCanonicalGjcWorkflowSkillFilesystemAlias,
 } from "../skill-state/canonical-skills";
 import { expandTilde } from "../tools/path-utils";
+import { resolveDiscoveryPrecedence } from "./customize-doctor-precedence";
 
 // =============================================================================
 // Public types (stable JSON contract)
@@ -67,9 +68,10 @@ export type CustomizeSurfaceKind = "mcp" | "skill" | "hook" | "tool" | "extensio
  *
  * - `canonical`: project/global `.gjc` entries and GJC bundled defaults — the
  *   primary load path and the persisted authority for sessions.
- * - `convention`: items from registered non-native conventions that are part of
- *   the discovery load path (claude-plugins, claude/codex hooks, agents,
- *   cursor, gemini, opencode, windsurf, cline, github, mcp-json, ssh).
+ * - `convention`: items exposed by registered non-native discovery providers
+ *   (claude-plugins, claude/codex hooks, agents, cursor, gemini, opencode,
+ *   windsurf, cline, github, mcp-json, ssh). The item status identifies whether
+ *   a discovered item is active, stored-only, or otherwise excluded at runtime.
  * - `import-candidate`: Claude Code / Codex project (+ global) files on
  *   surfaces GJC deliberately never loads. Reported for provenance only; never
  *   active runtime authority. Candidates for a future import flow (#4291).
@@ -267,7 +269,7 @@ const SOURCE_CLASS_DESCRIPTIONS: Array<{ sourceClass: CustomizeSourceClass; desc
 	{
 		sourceClass: "convention",
 		description:
-			"Items from other registered conventions (claude-plugins, claude/codex hooks, agents, cursor, gemini, opencode, windsurf, cline, github, mcp-json, ssh) that are part of the discovery load path.",
+			"Items exposed by registered convention providers (claude-plugins, claude/codex hooks, agents, cursor, gemini, opencode, windsurf, cline, github, mcp-json, ssh); item status identifies runtime eligibility.",
 	},
 	{
 		sourceClass: "import-candidate",
@@ -394,6 +396,7 @@ async function discoverCapability<T extends { _source: SourceMeta }>(
 		nameOf: (item: T) => string;
 		pathOf: (item: T) => string;
 		extensionIdOf?: (item: T) => string | undefined;
+		precedenceEligible?: (item: T) => boolean;
 	},
 ): Promise<DiscoveredSet<T>> {
 	const disabledProviders = new Set(activeSettings.get("disabledProviders"));
@@ -405,41 +408,34 @@ async function discoverCapability<T extends { _source: SourceMeta }>(
 		includeDisabledProviders: true,
 	});
 
-	// First item per dedup key wins (highest priority provider first in `all`).
-	const winners = new Map<string, { provider: string; scope: "user" | "project" | "native" }>();
-	const entries: DiscoveredEntry<T>[] = [];
-	for (const item of result.all) {
-		const key = capability.key(item);
-		const scope = scopeOf(item._source);
-		let shadowed = (item as { _shadowed?: boolean })._shadowed === true;
-		let shadowedBy: { provider: string; scope: string } | undefined;
-		if (key !== undefined) {
-			const winner = winners.get(key);
-			if (winner) {
-				shadowed = true;
-				shadowedBy = winner;
-			} else if (!disabledProviders.has(item._source.provider)) {
-				// Only enabled providers can own a dedup key; a disabled
-				// higher-priority provider must never shadow an enabled
-				// lower-priority source (includeDisabledProviders reports it
-				// as a listed item without giving it effective precedence).
-				winners.set(key, { provider: item._source.provider, scope });
-			}
-		}
-		entries.push({
+	// Resolve provider-order winners only after applying surface eligibility and
+	// the configured provider-disabled policy.
+	const resolvedPrecedence = resolveDiscoveryPrecedence(
+		result.all.map(item => ({
+			key: capability.key(item),
+			provider: item._source.provider,
+			scope: scopeOf(item._source),
+			eligible: options.precedenceEligible?.(item) ?? true,
+			enabled: !disabledProviders.has(item._source.provider),
+		})),
+	);
+	const entries: DiscoveredEntry<T>[] = result.all.map((item, index) => {
+		const precedence = resolvedPrecedence[index];
+		if (!precedence) throw new Error("discovery precedence result is missing an item");
+		return {
 			item,
 			name: options.nameOf(item),
 			path: options.pathOf(item),
 			provider: item._source.provider,
 			providerName: item._source.providerName,
-			scope,
+			scope: scopeOf(item._source),
 			priority: capability.providers.find(p => p.id === item._source.provider)?.priority ?? 0,
-			shadowed,
-			shadowedBy,
+			shadowed: precedence.shadowed,
+			shadowedBy: precedence.shadowedBy,
 			invalidReason: capability.validate?.(item),
 			extensionId: options.extensionIdOf?.(item),
-		});
-	}
+		};
+	});
 
 	entries.sort((a, b) => a.name.localeCompare(b.name) || a.provider.localeCompare(b.provider));
 
@@ -954,6 +950,7 @@ async function collectHooks(cwd: string, activeSettings: SettingsInstance): Prom
 	return collectNotExecutedAtStartup("hook", hookCapability, cwd, activeSettings, {
 		nameOf: hook => hook.name,
 		pathOf: hook => hook.path,
+		precedenceEligible: hook => hook.level !== "project",
 		notExecutedDetail:
 			"Trusted filesystem hook module discovered for session-start activation. Doctor does not execute the module, so dynamic Function Hook registrations and effective runtime order remain opaque until a session loads it.",
 		notExecutedRemediation: [
@@ -989,6 +986,7 @@ async function collectExtensions(cwd: string, activeSettings: SettingsInstance):
 interface NotExecutedOptions<T extends { _source: SourceMeta }> {
 	nameOf: (item: T) => string;
 	pathOf: (item: T) => string;
+	precedenceEligible?: (item: T) => boolean;
 	notExecutedDetail: string;
 	notExecutedRemediation: string[];
 }
@@ -1004,6 +1002,7 @@ async function collectNotExecutedAtStartup<T extends { _source: SourceMeta }>(
 		nameOf: options.nameOf,
 		pathOf: options.pathOf,
 		extensionIdOf: item => capability.toExtensionId?.(item),
+		precedenceEligible: options.precedenceEligible,
 	});
 	const disabledExts = disabledExtensionIds(activeSettings);
 	const disabledProviders = new Set(activeSettings.get("disabledProviders"));
@@ -1019,6 +1018,18 @@ async function collectNotExecutedAtStartup<T extends { _source: SourceMeta }>(
 				[`Fix ${entry.path}`],
 			);
 		}
+		if (kind === "hook" && entry.scope === "project") {
+			return finalizeItem(
+				base,
+				"stored-only",
+				"storage-only",
+				"Project-scoped hooks are stored for inspection, but ordinary sessions do not load repository hook modules.",
+				[
+					"Import the hook into Global .gjc to load it for future sessions",
+					"or configure an explicit hook path if repository-local activation is intentional",
+				],
+			);
+		}
 		if (entry.extensionId !== undefined && disabledExts.has(entry.extensionId)) {
 			return finalizeItem(
 				base,
@@ -1360,13 +1371,12 @@ async function collectPluginBundles(cwd: string): Promise<CustomizeDoctorSurface
 // Foreign conventions (Claude project / Codex project)
 //
 // Claude Code / Codex project hooks are discovered by the registered
-// claude-hooks/codex-hooks providers (see discovery/index.ts) and appear in the
-// Hooks surface above; sessions surface them in the extension dashboard but do
-// not execute hook files. Every OTHER `.claude`/`.codex` surface (MCP, skills,
-// tools, extensions, commands, prompts, settings) is deliberately not part of
-// the load path: the doctor reports those files by invoking the canonical
-// provider load functions directly (without registering the providers) and
-// marks every such item as `ignored`.
+// claude-hooks/codex-hooks providers (see discovery/index.ts), but like native
+// project hooks are stored-only and are not imported by ordinary sessions.
+// Every OTHER `.claude`/`.codex` surface (MCP, skills, tools, extensions,
+// commands, prompts, settings) is deliberately not part of the load path: the
+// doctor reports those files by invoking canonical provider load functions
+// directly (without registering the providers) and marks them `ignored`.
 // =============================================================================
 
 interface ForeignConventionDescriptor {
@@ -1468,7 +1478,7 @@ function foreignItem(
 async function collectForeignConventions(cwd: string): Promise<ForeignConventionCollection> {
 	const ctx: LoadContext = { cwd, home: os.homedir(), repoRoot: await findRepoRoot(cwd) };
 	const itemsByKind: Map<CustomizeSurfaceKind, CustomizeDoctorItem[]> = new Map();
-	const policyNote = `${FOREIGN_CONVENTIONS.map(d => d.dirName).join(" and ")} project hooks are discovered by GJC (see the Hooks surface); all other ${FOREIGN_CONVENTIONS.map(d => d.providerName).join(" / ")} project config surfaces (MCP servers, skills, tools, extensions, commands, prompts, settings) are not part of the GJC load path. Those files are reported below as import candidates for provenance but are never discovered by sessions.`;
+	const policyNote = `${FOREIGN_CONVENTIONS.map(d => d.dirName).join(" and ")} project hooks are shown as stored-only (see the Hooks surface); ordinary sessions do not load repository hook modules. All other ${FOREIGN_CONVENTIONS.map(d => d.providerName).join(" / ")} project config surfaces (MCP servers, skills, tools, extensions, commands, prompts, settings) are not part of the GJC load path and are reported below as import candidates for provenance.`;
 
 	for (const desc of FOREIGN_CONVENTIONS) {
 		const inspection = await desc.inspect(ctx);

package/src/cli/doctor/install-repairs.ts

@@ -14,7 +14,7 @@ import { randomUUID } from "node:crypto";
 import { realpathSync } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { isCompiledBinary, VERSION } from "@gajae-code/utils";
+import { isCompiledBinary, logger, VERSION } from "@gajae-code/utils";
 import { isUpdateChannel } from "../../config/update-channel";
 import {
 	activationRecordPath,
@@ -27,8 +27,10 @@ import {
 	snapshotRegularFile,
 } from "../install-activation";
 import {
+	ActivationRetryCandidateRepointError,
 	acquireBinaryUpdateLock,
 	fetchAndVerifyOfficialPinnedCandidate,
+	InstallationAccessDeniedError,
 	isProtectedSourcePathForInstall,
 	replaceBinaryForUpdate,
 	smokeTestPinnedCandidate,
@@ -111,8 +113,10 @@ export interface InstallRepairResult {
 	readonly reason?: string;
 	readonly recordPath?: string;
 	readonly sideEffectStarted: boolean;
-	/** Present only for a pre-mutation Windows sharing violation (nothing was renamed). */
+	/** Native Windows status returned by exact replacement. */
 	readonly windowsErrorCode?: string;
+	readonly stagingCleanupWarning?: string;
+	readonly retainedPaths?: InstallationAccessDeniedError["retainedPaths"];
 	readonly before?: { readonly identity?: FileIdentity; readonly digest?: string };
 	readonly after?: { readonly identity?: FileIdentity; readonly digest?: string; readonly version?: string };
 }
@@ -317,17 +321,43 @@ export async function repairStandaloneBinary(
 		};
 	} catch (error) {
 		const pendingActivation = error instanceof Error && error.message === "installation_pending_activation";
+		const accessDeniedError = error instanceof InstallationAccessDeniedError ? error : undefined;
+		const repointError = error instanceof ActivationRetryCandidateRepointError ? error : undefined;
 		const reason = pendingActivation
 			? "sharing_violation"
-			: error instanceof Error && /^[a-z][a-z0-9_]{0,63}$/.test(error.message)
-				? error.message
-				: "installation_execution_unverified";
+			: accessDeniedError
+				? accessDeniedError.code
+				: repointError
+					? repointError.reasonCode
+					: error instanceof Error && /^[a-z][a-z0-9_]{0,63}$/.test(error.message)
+						? error.message
+						: "installation_execution_unverified";
+		if (accessDeniedError)
+			logger.warn("Doctor standalone binary restore failed with access denied", {
+				targetPath,
+				code: accessDeniedError.code,
+				...(accessDeniedError.windowsErrorCode ? { windowsErrorCode: accessDeniedError.windowsErrorCode } : {}),
+				...(accessDeniedError.stagingCleanupWarning
+					? { stagingCleanupWarning: accessDeniedError.stagingCleanupWarning }
+					: {}),
+				...(accessDeniedError.retainedPaths ? { retainedPaths: accessDeniedError.retainedPaths } : {}),
+			});
+		if (repointError)
+			logger.warn("Doctor standalone binary restore retained a retry candidate after record repoint failed", {
+				path: repointError.candidatePath,
+				reason: repointError.reasonCode,
+			});
 		return {
 			state: pendingActivation ? "pending_activation" : started ? "failed" : "blocked",
 			reason,
 			sideEffectStarted: started,
 			before,
 			recordPath,
+			...(accessDeniedError?.windowsErrorCode ? { windowsErrorCode: accessDeniedError.windowsErrorCode } : {}),
+			...(accessDeniedError?.stagingCleanupWarning
+				? { stagingCleanupWarning: accessDeniedError.stagingCleanupWarning }
+				: {}),
+			...(accessDeniedError?.retainedPaths ? { retainedPaths: accessDeniedError.retainedPaths } : {}),
 		};
 	} finally {
 		await release();

package/src/cli/fast-help.ts

@@ -8,7 +8,7 @@ export function getExtraHelpText(): string {
   ${APP_NAME} session              - List, inspect, create, remove, or attach sessions
   ${APP_NAME} state                - Inspect or manage persisted GJC state
   ${APP_NAME} auth-broker         - Manage the auth-broker (credential vault)
-  ${APP_NAME} accounts             - List, check, pin, and remove stored OAuth accounts
+  ${APP_NAME} accounts             - List, check, pin, prefer, and remove stored OAuth accounts
   ${APP_NAME} models presets       - Inspect, refresh, pin, rollback, or disable the signed model preset registry
   ${APP_NAME} auth-gateway        - Run an auth-gateway forward proxy
   ${APP_NAME} harness              - Run harness control-plane commands
@@ -81,8 +81,6 @@ Environment Variables:
   GJC_CODING_AGENT_DIR       - Session storage directory (default: ~/${CONFIG_DIR_NAME}/agent)
   GJC_UI_LANGUAGE            - Explicit first-use onboarding language (en, ko, zh, or ja); invalid values use English without prompting
   GJC_PACKAGE_DIR            - Override package directory (for Nix/Guix store paths)
-  GJC_SMOL_MODEL              - Override smol/fast model (see --smol)
-  GJC_SLOW_MODEL              - Override slow/reasoning model (see --slow)
   GJC_PLAN_MODEL              - Override planning model (see --plan)
   GJC_MODEL_PRESET_REGISTRY_URL - HTTPS latest.json override for the signed preset registry
   GJC_MODEL_PRESET_REGISTRY_DISABLED - Disable registry fetch/use (1/true/yes/on)

package/src/cli/install-activation.ts

@@ -504,8 +504,12 @@ export interface ReconcileResult {
 	readonly record?: ActivationRecordV1;
 	readonly recordIdentity?: FileIdentity;
 	readonly reason?: string;
-	/** Present only for a pre-mutation Windows sharing violation on the destination open. */
+	/** Present only for a pre-mutation Windows exact-replacement failure. */
 	readonly windowsErrorCode?: string;
+	readonly detachedPath?: string;
+	readonly retainedSuccessorPath?: string;
+	readonly retainedPlaceholderPath?: string;
+	readonly retainedUnknownPath?: string;
 }
 
 /**
@@ -519,9 +523,11 @@ export interface ReconcileResult {
  * records are re-verified and advanced to `verified` once the target
  * digest/identity matches the candidate. `verified` records are read-only
  * re-confirmations. Anything else (target/parent drift, missing staged
- * candidate, an already-occupied backup name, a pre-mutation Windows
- * sharing violation) is reported as `conflict` with the exact reason and
- * never silently promoted.
+ * candidate, an already-occupied backup name) is reported as `conflict` with
+ * the exact reason and never silently promoted. A pre-mutation Windows
+ * sharing violation becomes `pending_activation`; an access-denied result is
+ * also recorded as pending for safe reuse but remains a `conflict` so the
+ * caller reports the publication failure.
  */
 export async function reconcileActivationRecord(
 	targetPath: string,
@@ -637,11 +643,48 @@ export async function reconcileActivationRecord(
 					};
 				}
 			}
+			if (
+				record.targetIdentity &&
+				record.stagingIdentity &&
+				result.code === "access_denied" &&
+				(process.platform === "win32" || result.windowsErrorCode === "0xC0000022") &&
+				!result.detachedPath &&
+				!result.retainedSuccessorPath &&
+				!result.retainedUnknownPath &&
+				!result.retainedPlaceholderPath
+			) {
+				const unchangedTarget = await snapshotRegularFile(targetPath);
+				const unchangedStaging = await snapshotRegularFile(record.stagingPath);
+				if (
+					unchangedTarget &&
+					unchangedStaging &&
+					sameFileIdentity(record.targetIdentity, unchangedTarget.identity) &&
+					sameFileIdentity(record.stagingIdentity, unchangedStaging.identity)
+				) {
+					const pending: ActivationRecordV1 = { ...record, phase: "pending_activation" };
+					const pendingIdentity = await updateActivationRecordFile(pending, recordIdentity);
+					return {
+						status: "conflict",
+						record: pending,
+						recordIdentity: pendingIdentity,
+						reason: "access_denied",
+						...(result.windowsErrorCode ? { windowsErrorCode: result.windowsErrorCode } : {}),
+					};
+				}
+			}
 			return {
 				status: "conflict",
 				record,
 				reason: result.code ?? "activation_promotion_failed",
 				...(result.windowsErrorCode ? { windowsErrorCode: result.windowsErrorCode } : {}),
+				...(result.detachedPath !== undefined ? { detachedPath: result.detachedPath } : {}),
+				...(result.retainedSuccessorPath !== undefined
+					? { retainedSuccessorPath: result.retainedSuccessorPath }
+					: {}),
+				...(result.retainedPlaceholderPath !== undefined
+					? { retainedPlaceholderPath: result.retainedPlaceholderPath }
+					: {}),
+				...(result.retainedUnknownPath !== undefined ? { retainedUnknownPath: result.retainedUnknownPath } : {}),
 			};
 		}
 		const promoted = await snapshotRegularFile(targetPath);

package/src/cli/migrate-cli.ts

@@ -1,5 +1,5 @@
 /**
- * `gjc migrate` — import MCP servers and skills from other coding agents.
+ * `gjc migrate` — import MCP servers, skills, slash commands, and instruction files from other coding agents.
  */
 import * as os from "node:os";
 import * as path from "node:path";
@@ -53,8 +53,20 @@ export function resolveSources(from: string[]): MigrateSource[] {
 
 function resolveDestinations(project: boolean, cwd: string): MigrateDestinations {
 	const scope = project ? "project" : "user";
-	const skillsDir = project ? path.join(getProjectAgentDir(cwd), "skills") : path.join(getAgentDir(), "skills");
-	return { mcpConfigPath: getMCPConfigPath(scope, cwd), skillsDir };
+	const agentDir = project ? getProjectAgentDir(cwd) : getAgentDir();
+	const skillsDir = path.join(agentDir, "skills");
+	const commandsDir = path.join(agentDir, "commands");
+	const agentsDir = path.join(agentDir, "agents");
+	const hooksDir = path.join(agentDir, "hooks");
+	const instructionsPath = path.join(agentDir, "AGENTS.md");
+	return {
+		mcpConfigPath: getMCPConfigPath(scope, cwd),
+		skillsDir,
+		commandsDir,
+		agentsDir,
+		hooksDir,
+		instructionsPath,
+	};
 }
 
 /** Run the migration and return the report (does not set process.exitCode). */
@@ -66,15 +78,16 @@ export async function runMigrate(args: MigrateCommandArgs): Promise<MigrateRepor
 
 	const results: AdapterResult[] = [];
 	for (const source of sources) {
-		results.push(await getAdapter(source).collect({ homeDir }));
+		results.push(await getAdapter(source).collect({ homeDir, cwd, scope: args.project ? "project" : "user" }));
 	}
 
-	const { actions, warnings } = await planMigration({ results, destinations, force: args.force });
-	const finalActions = args.dryRun ? actions : await executeActions(actions);
+	const { actions, warnings, manualActions } = await planMigration({ results, destinations, force: args.force });
+	const finalActions = args.dryRun ? actions : await executeActions(actions, { project: args.project });
 
 	return buildReport({
 		actions: finalActions,
 		warnings,
+		manualActions,
 		sources,
 		destinations,
 		dryRun: args.dryRun,

package/src/cli/public-command-errors.ts

@@ -111,6 +111,12 @@ export const PUBLIC_COMMAND_DIAGNOSTICS = {
 	// of them and never implies that another key would be safe.
 	lifecycle_idempotency_conflict:
 		"The broker reported an idempotency conflict. Reconcile existing lifecycle state before deciding whether another request is safe.",
+	lifecycle_legacy_history_ambiguous:
+		"The broker refused admission because legacy lifecycle history cannot prove this target is unrelated. This request was not dispatched; this refusal does not settle earlier effects. Preserve the ledger and original operation, request key, and target. For a prior session.create, use read-only session.lookup with its original key and create target; not_found is not proof of no effect. An empty transcript, stopped host, or fresh key does not resolve this fence. Do not edit the ledger, force deletion, or retry with another key; missing identity or terminal effect evidence requires operator investigation.",
+	// Refusals of the request payload itself: the broker's own text names the missing field
+	// (a required `sessionPath`, for one), and it is never rendered, so the class is named here.
+	lifecycle_input_refused:
+		"The broker refused the request as invalid input. Correct the request payload and reconcile existing lifecycle state before deciding whether another request is safe.",
 	usage_transport_exclusive: "Specify exactly one of --stdio or --socket <path>.",
 	usage_duplicate_option: "Each option on this command may occur at most once.",
 	usage_unknown_argument: "An unrecognized argument was supplied; re-read the command help for its accepted grammar.",

package/src/cli/root-flags.ts

@@ -10,8 +10,6 @@ export type RootThinkingLevel = (typeof ROOT_THINKING_LEVELS)[number];
 /** Public launch flags shared by root help, completion, and the launch command. */
 export const ROOT_LAUNCH_FLAGS = {
 	model: Flags.string({ description: 'Model to use (fuzzy match: "opus", "gpt-5.2", or "openai/gpt-5.2")' }),
-	smol: Flags.string({ description: "Smol/fast model for lightweight tasks (or GJC_SMOL_MODEL env)" }),
-	slow: Flags.string({ description: "Slow/reasoning model for thorough analysis (or GJC_SLOW_MODEL env)" }),
 	plan: Flags.string({ description: "Plan model for architectural planning (or GJC_PLAN_MODEL env)" }),
 	mpreset: Flags.string({ description: "Model profile preset to activate for this session" }),
 	default: Flags.boolean({ description: "Persist --mpreset as the default model profile" }),
@@ -19,11 +17,11 @@ export const ROOT_LAUNCH_FLAGS = {
 	"api-key": Flags.string({ description: "API key (defaults to env vars)" }),
 	credential: Flags.string({
 		description:
-			"Stored credential selector: email:<addr>, id:<n>, account:<id>, project:<id>, or provider/email:<addr>",
+			"Stored credential selector: email:<addr>, id:<n>, account:<id>, project:<id>, org:<id|name>, or provider/email:<addr>",
 	}),
 	"prefer-credential": Flags.string({
 		description:
-			"Preferred stored credential with quota fallback: email:<addr>, id:<n>, account:<id>, project:<id>, or provider/id:<n>",
+			"Preferred stored credential with quota fallback: email:<addr>, id:<n>, account:<id>, project:<id>, org:<id|name>, or provider/id:<n>",
 	}),
 	"system-prompt": Flags.string({ description: "System prompt (default: coding assistant prompt)" }),
 	"append-system-prompt": Flags.string({ description: "Append text or file contents to the system prompt" }),

package/src/cli/stats-cli.ts

@@ -4,7 +4,7 @@
  * Handles `gjc stats` subcommand for viewing AI usage statistics.
  */
 
-import { APP_NAME, formatDuration, formatNumber, formatPercent } from "@gajae-code/utils";
+import { APP_NAME, formatDuration, formatNumber, formatPercent, sanitizeDisplayLine } from "@gajae-code/utils";
 import chalk from "chalk";
 import { openPath } from "../utils/open";
 
@@ -168,7 +168,7 @@ async function printStatsSummary(): Promise<void> {
 		console.log(chalk.bold("\nBy Model:"));
 		for (const m of byModel.slice(0, 10)) {
 			console.log(
-				`  ${m.model}: ${formatNumber(m.totalRequests)} reqs, ${formatCost(m.totalCost)}, ${formatPercent(m.cacheRate)} cache`,
+				`  ${sanitizeDisplayLine(m.model)}: ${formatNumber(m.totalRequests)} reqs, ${formatCost(m.totalCost)}, ${formatPercent(m.cacheRate)} cache`,
 			);
 		}
 	}
@@ -177,7 +177,7 @@ async function printStatsSummary(): Promise<void> {
 		console.log(chalk.bold("\nBy Agent Role:"));
 		for (const agent of byAgent) {
 			console.log(
-				`  ${agent.agent}: ${formatNumber(agent.totalRequests)} reqs, ${formatNumber(agent.totalInputTokens)} input / ${formatNumber(agent.totalOutputTokens)} output, ${formatPercent(agent.cacheRate)} cache, ${formatCost(agent.totalCost)}`,
+				`  ${sanitizeDisplayLine(agent.agent)}: ${formatNumber(agent.totalRequests)} reqs, ${formatNumber(agent.totalInputTokens)} input / ${formatNumber(agent.totalOutputTokens)} output, ${formatPercent(agent.cacheRate)} cache, ${formatCost(agent.totalCost)}`,
 			);
 		}
 	}
@@ -185,7 +185,9 @@ async function printStatsSummary(): Promise<void> {
 	if (byFolder.length > 0) {
 		console.log(chalk.bold("\nBy Folder:"));
 		for (const f of byFolder.slice(0, 10)) {
-			console.log(`  ${f.folder}: ${formatNumber(f.totalRequests)} reqs, ${formatCost(f.totalCost)}`);
+			console.log(
+				`  ${sanitizeDisplayLine(f.folder)}: ${formatNumber(f.totalRequests)} reqs, ${formatCost(f.totalCost)}`,
+			);
 		}
 	}
 
@@ -201,7 +203,9 @@ async function printStatsSummary(): Promise<void> {
 		console.log(`  Provider-side (prefix intact): ${formatNumber(misses.providerSideMisses)}`);
 		console.log(`  Model switch: ${formatNumber(misses.modelSwitchMisses)}`);
 		for (const cause of misses.byCause) {
-			const label = cause.divergedRole ? `${cause.change} (${cause.divergedRole})` : cause.change;
+			const label = sanitizeDisplayLine(
+				cause.divergedRole ? `${cause.change} (${cause.divergedRole})` : cause.change,
+			);
 			console.log(`    ${label}: ${formatNumber(cause.misses)}`);
 		}
 	}