@gajae-code/coding-agent 0.18.12 → 0.19.0

package/CHANGELOG.md

@@ -2,6 +2,473 @@
 
 ## [Unreleased]
 
+## [0.19.0] - 2026-10-22
+
+### Added
+
+- `session.create`, `session.fork`, and `session.resume` accept an optional per-session `env` map and `unsetEnv` list. The broker applies them to that session host's environment, so its Bash executor sees them, without touching the broker's own environment. Two sessions hosted by the same broker can therefore run with different `PATH` or tenant variables. Names must be valid variable names outside the broker-reserved `GJC_*` namespace, and a name may not be both set and unset. Values of credential-named variables are redacted from startup diagnostics (#6735).
+
+- TTSR rules accept an `astCondition` frontmatter field (string or list of ast-grep patterns), matched before a `write` or `edit` executes against an in-memory digest of introduced source. Write supplies full content; replace, patch, hashline, and apply_patch edits supply only added text per file. Vim edits are not evaluated. Language comes from each file's extension, and only the 18 languages built into the default native build are supported (no grammar downloads); `scope`, `globs`, and repeat gating apply. `interruptMode: "always"` blocks the call and retries with the reminder, leaving the file unchanged; `"never"` folds the reminder into the executed tool's result. AST-only rules are registered as TTSR rules.
+
+- Telegram notifications now announce when a foreground `bash` command prints a browser sign-in URL or device code and then waits (for example `tailscale up`, `az login --use-device-code`, `aws sso login`). The notice is sent once per command after 3 s without new output and carries only the prompt kind, never the URL or code, so it is also delivered under `notifications.redact` (#6852).
+
+- `mcp.discoveryDeferAutoload` keeps conventionally autoloaded MCP tools (`gjc mcp add`, `.gjc/mcp.json`, `~/.gjc/agent/mcp.json`) out of the default tool selection when MCP discovery is on. The tools stay registered and become active through `search_tool_bm25`; servers listed in `mcp.discoveryDefaultServers` are still selected, so large MCP catalogs no longer occupy the context window up front.
+
+- `gjc migrate --from claude-code` now imports Claude Code subagents from `.claude/agents` into the selected scope's `agents/` directory. Tool lists are translated to GJC tools, unsupported tools are dropped and reported, and a name that collides with a bundled role (`executor`, `architect`, `planner`, `critic`) is imported as `<source>-<name>` so the bundled role stays authoritative.
+
+- `gjc migrate` imports Claude Code Markdown commands and namespaced Codex prompts as scoped GJC slash commands, preserving nested names, namespacing every imported command under its source so built-in, extension, and MCP command registrations cannot shadow it, and reporting effective command names, case-insensitive/effective-name/structural/unsafe-destination collisions, and late creates.
+
+- `gjc migrate` imports Claude Code hooks as a generated `.gjc/hooks/migrated-claude-code.ts` module. `PreToolUse` maps to `tool_call` and keeps the origin contract (a command that exits 2 blocks the tool and its stderr becomes the reason); `PostToolUse` maps to `tool_result`, `SessionStart` to `session_start`, and `Stop` to `turn_end`. Tool matchers are preserved, the payload keeps the origin's field names, and fields this runtime cannot supply are omitted rather than invented. Events with no faithful equivalent (`Notification`, `SubagentStop`, `PreCompact`, `UserPromptSubmit`) are reported as `skipped_unmappable` for manual porting instead of being silently dropped.
+
+- `gjc migrate` now reports the source settings it cannot import instead of leaving them silent: Claude Code hook events (with their shell-command counts), `model`, `permissions` allow/deny/ask counts, and `env` variable names, plus Codex `config.toml` `model`, `approval_policy`, `sandbox_mode`, and `shell_environment_policy` names. They appear under `Manual actions:` and in `manualActions` with `--json`; environment values are never read.
+
+- Stage lossless prompt images through bounded, authenticated GJC-private SDK uploads on both session hosts without increasing transport frame limits. Staging accepts static PNG, JPEG, WebP, and GIF images and rejects animated PNG, WebP, and GIF; accepted bytes and MIME are preserved without transcoding or byte loss. Uploads expire and remain connection-owned; unadopted submissions retain image capacity until their producer settles, and adopted executions require exact execution-settlement proof even after cancellation or transport teardown. Quarantined or unidentifiable executions remain charged rather than freeing capacity for still-unfenced work. Standard ACP image schemas and oversized-prompt handling are unchanged.
+- Export staged image references in `TurnPromptInput`, with mutually exclusive direct and staged image inputs.
+- Reclaim accepted image capacity through exact ledger settlement events without polling or a release cutoff, including after host teardown. Expose internal process-budget accounting and isolate decode admission per session. Preserve specific image validation errors and retained `clientRef` conflict precedence before consuming staged images.
+- Retire positively refused queued starts without stranding image quota, while preserving producer-settlement fences and exact-run ownership for started or ambiguous executions. Report pre-start refusal as prompt failure rather than queue cancellation.
+
+- Document optional local Sem MCP navigation and a separate Weave merge-preview workflow, including the global `mcp.enableProjectConfig` opt-in a project stdio server requires and resetting it after the example.
+
+### Changed
+
+- Show `/mcp` command metadata only in interactive sessions with exact-file MCP controls; ordinary TUI sessions no longer advertise it.
+- Refresh slash-command visibility after a committed branch even when post-commit cleanup fails.
+
+- Raise daemon generations for incarnation-verified process-tree authority and Linux PTY cleanup that reaps adopted descendants.
+
+### Removed
+
+- Removed the `--smol` and `--slow` CLI flags and the `GJC_SMOL_MODEL`/`GJC_SLOW_MODEL` (and legacy `PI_SMOL_MODEL`/`PI_SLOW_MODEL`) environment variables. Since model roles were reduced to `default` (#449), no built-in feature resolves the `smol` or `slow` roles; passing the flags now fails with `Unknown option`. A custom `cycleOrder` entry named `smol`/`slow` still resolves from persisted `modelRoles`, just without a CLI/env override. The `resolveModelRoleOverrides` export is removed from the package root. `--plan`/`GJC_PLAN_MODEL` are kept because plan mode still switches to the `plan` role.
+
+### Fixed
+
+- `bash --rcfile FILE -c 'payload'` and other long-option forms of bash/sh no longer confuse script arguments with shell command payloads in the tmux self-injection guard.
+- The guard now properly handles bash long options (`--rcfile`, `--init-file`, `--norc`, `--noprofile`) before `-c` and correctly identifies quoted payloads.
+- Quoted `bash -c` arguments that begin with `-` but contain shell syntax are inspected conservatively to avoid false negatives across shell versions.
+
+- A managed session directory that comes back with the same inode on a different volume (after a remount, drive-letter change or volume-serial change) is still refused, but now reports `volume_identity_changed` instead of the generic `Managed write protocol setup failed.` ([#6750](https://github.com/Yeachan-Heo/gajae-code/issues/6750))
+
+- Stop Ultragoal try-harder nudges from targeting goals handed off to a successor run. When a retained source-owned goal remains, nudges target that work instead, keeping aggregate drop guarded until its nudge budget is exhausted; when no retained target remains, the guard falls through to its normal gate without spending budget (#6807).
+
+- Report a refused replacement-cleanup receipt as `managed_replace_cleanup_receipt_invalid` in the managed-scope startup error instead of a generic `binding_invalid`, so operators are pointed at the receipt rather than a healthy binding (#6820).
+
+- Revalidate configuration snapshots after overlapping session transitions that have started but have not committed yet, avoiding a spurious `MODEL_UNAVAILABLE` rejection.
+
+- ACP cancellation now preserves pre-admission intent when the host reports an uncertain abort and retries once the prompt is admitted, so a follow-up turn cannot misclassify the cancelled prompt as `end_turn`.
+
+- A repository APPEND_SYSTEM.md is no longer appended to the system prompt. An explicit append string and a user-level file still are.
+
+- Archive readers enforce per-entry, total member, count, and depth caps while accounting for TAR framing, bounding cumulative gzip output, streaming ZIP deflate input, and truncating long archive-controlled paths.
+- Empty global PAX values clear inherited path and size overrides.
+
+- Browser-backend guidance now continues Aside work through `aside session resume` instead of the unsupported `aside exec --session` option, and declares Aside session follow-ups as `exec` activity so continuations do not fail CLI argument parsing.
+
+- Owner shutdown now proves a cancelled queued subagent resume against the queue generation captured by its lease, instead of the stale job identity from before it was queued.
+
+- Browser open, run, and act results frame page URL, title, extract text, and script return values as untrusted content before they reach the model.
+
+- Browser screenshots that fall back to the shared temp directory are written to an exclusive private file so a preexisting symlink is not followed.
+
+- Codex web search now selects GPT-6.1 Sol, then GPT-6 Luna, only when advertised by current Codex subscription discovery. Removed legacy GPT-5 defaults and unadvertised fallbacks; unavailable or unmatched discovery fails closed. Explicit model overrides bypass discovery and preserve single-attempt behavior; unsupported-model retries stay limited to advertised defaults.
+
+- Strip terminal control characters from commit-agent previews, provider errors, assistant text, and tool labels before writing them to stdout.
+
+- Escape repository context file paths and bodies before they are inserted into the commit analysis prompt.
+
+- Encode the commit analysis diff, stat, scope candidates, and recent subjects before they are inserted into the analysis prompt.
+
+- A project settings file can no longer choose `compaction.remoteEndpoint`. Session compaction keeps the user config endpoint, so a repository cannot redirect the transcript POST or replace the summary.
+
+- Auto-compaction now moves to another stored credential row when its summarization request hits a provider usage limit, the way a normal turn already does. It used to retry the exhausted row until its retries ran out, and because compaction runs before the next request, a session whose context was full stayed stuck on that row while other rows still had quota. The credential-rotation phase marks every stored row that resolves to a failed key, so duplicate aliases cannot bypass its backoff or cause unbounded same-key rotation; once rotation is exhausted, the existing retry policy applies. A `--credential` pin is still never rotated, and only rows of the session model's provider are marked.
+- A stored API-key row selected under an `apiKeyEnv` override can rotate to another stored row; literal config keys, runtime API keys, and explicit credential pins remain fixed. Resolver failures and expired backoffs no longer prevent trying a later healthy row.
+
+- Serialize concurrent discovered-tool activations per session and fence queued or in-flight commits at committed session and MCP catalog boundaries. Revalidate delayed activations against the current MCP catalog, registry identities, prompt generation, and active-tool selection after prompt rebuilds; rebase after prompt refreshes and yield to newer explicit selections. Canceled transitions, manual and automatic compaction, and read-only MCP status snapshots preserve pending activations. Fence branch adoption before fallible MCP retirement, and publish execution-context tool names from active tools, including exact-MCP rollback restoration, so stale rebuilds or failed controls cannot leave mismatched context.
+
+- Crash diagnostics no longer follow a symlink on the diagnostics directory or change that target's mode.
+
+- Crash sanitization now preserves diagnostic text after URLs while stripping credentials, queries, and fragments from each URL.
+
+- Debug launch and attach now require approval and honor the planning mutation guard, and a debug adapter runInTerminal request stays inside the workspace.
+
+- Debug transcripts are written to an exclusive private temp file so a preexisting symlink is not followed.
+
+- Fixed the flaky "a stale deadline callback cannot terminalize after its submission was cleared" test: its `setTimeout` capture matched the bus deadline by delay window alone, so the SDK broker discovery timer the bus arms concurrently during startup (~35s, inside the 30–60s lease window) was intermittently captured as a second deadline. The capture now attributes timers to the `armPromptDeadline` arming site.
+
+- Move the direct CLI session broker-index registration to the successor session id after `/new`, `/resume` and forks, and release the predecessor, so the new session is listed and the old one no longer stays live under the same pid. A predecessor release that fails is retained and retried on the next identity sync and during teardown instead of being forgotten when the successor is already registered. A retained release is dropped when its id becomes current again (`/resume` of that session), so a stale release can never retire the session this process just reactivated, and a registration append that fails after its row was already durable is adopted instead of leaving an unowned live row behind.
+- Follow the manager the session adopted when it replaced its own (a bounded cold-sidecar fork), and retry a successor registration whose append never landed — bounded within the switch, again at the next turn boundary, and once more during teardown — while keeping the predecessor registered until the successor succeeds. The sync reads the live session's manager at dispatch time: the extension context keeps returning the manager the runner was constructed with, so a fork that adopted its own manager would otherwise be read through the stale facade.
+- Publish the committed branch identity even when the fallible post-commit integrations fail. `branch()` commits the successor's identity and then restores tool sessions and MCP selections before emitting `session_branch`; a failure there used to skip the event, leaving the broker index advertising the parent session until a later turn or teardown.
+
+- Session event replay now drops content frames that were stored before notification redaction was turned on, while other replay events stay available.
+
+- GitHub run logs and truncated read-url pages stored at an explicit artifact path are published as mode 0600 via a temporary file opened with O_NOFOLLOW, and a pre-existing mode 0644 file is replaced.
+
+- External editor drafts are written to an exclusive private temp file so a preexisting symlink is not followed.
+
+- Auto-read `@path` mentions now include a file only when its canonical path stays inside the session directory, so `..`, `~`, an outside absolute path, or a symlink cannot insert that file into the prompt.
+
+- Keep replay-only observer capability claims in host demand until native negotiation confirms them, while preserving replay-based stream routing.
+
+- Planning mutation guard now blocks Node preload options (`-r`/`--require`) when stdout writes are exempted, as preload code cannot be scanned.
+- Aliased stdout stream mutations are now detected: commands that pass `process.stdout` through function parameters or arrow functions are blocked during planning, as the method may be rebound.
+- Perl `open` mode operand is now correctly parsed by position instead of gathering unrelated quoted strings; variable modes and unparsed opens fail closed.
+- Python `from os import system as X` import aliases are now detected and calls to the imported alias are marked as unclassifiable during planning.
+
+- The default `/share` GitHub CLI child environment now omits project-declared shell, Node, Python, Ruby, Perl, Java, PHP, and .NET startup hooks and module paths (`BASH_ENV`, `ENV`, `ZDOTDIR`, `NODE_OPTIONS`, `NODE_PATH`, `PYTHONHOME`, `PYTHONPATH`, `PYTHONUSERBASE`, `PYTHONSTARTUP`, `RUBYOPT`, `RUBYLIB`, `PERL5OPT`, `PERL5LIB`, `PERLLIB`, `JAVA_TOOL_OPTIONS`, `JDK_JAVA_OPTIONS`, `_JAVA_OPTIONS`, `CLASSPATH`, `PHPRC`, `PHP_INI_SCAN_DIR`, and `DOTNET_STARTUP_HOOKS`), preventing checkout-controlled code from running with operator GitHub credentials.
+- Trusted GitHub CLI children run from the filesystem root rather than the checkout, preventing Bun wrappers from loading project `bunfig.toml` preloads.
+
+- `/share` strips project-declared `BUN_OPTIONS` so Bun-based GitHub CLI wrappers cannot replay checkout-controlled preloads.
+
+- `/share` strips project-declared `BUNDLE_GEMFILE` so Bundler cannot evaluate the checkout's Gemfile in GitHub CLI children.
+
+- `/share` GitHub CLI children now filter project-declared .NET profiler injection variables, including architecture-specific profiler paths.
+
+- `/share` strips project-declared `DOTNET_ROOT` variants so GitHub CLI apphosts cannot load a checkout-controlled .NET runtime.
+
+- `/share` strips project-declared `ELIXIR_ERL_OPTIONS` from its GitHub CLI children.
+
+- `/share` children now omit project-declared Erlang startup flags while retaining operator-provided values.
+
+- The default `/share` gist upload no longer forwards project `.env` routing, config, proxy, CA, executable-search, or native-loader values to `gh`; it resolves the CLI and child search path only through absolute operator PATH directories and executables whose resolved paths stay outside actual Git checkout roots discovered from the launch and active working directories, while keeping undeclared operator values. PATH entries beneath a non-checkout launch directory remain usable, and launching from the filesystem root does not mark every PATH entry as checkout-owned.
+
+- `/share` strips project-declared `JAVA_HOME` so GitHub CLI wrappers cannot launch a checkout-controlled Java runtime.
+
+- `/share` strips project-declared `JULIA_LOAD_PATH` and `JULIA_PROJECT` values while preserving operator-owned Julia settings.
+
+- `/share` now omits project-declared Julia depot paths from GitHub CLI child environments.
+
+- `/share` strips project-declared Lua module search paths, including versioned `LUA_PATH` and `LUA_CPATH` variants.
+
+- `/share` now omits project-declared Lua startup hooks from GitHub CLI child environments while preserving operator-provided values.
+
+- `/share` now removes project-declared `OPENSSL_CONF` from GitHub CLI child environments while preserving operator-owned configuration.
+
+- `/share` no longer inherits project-declared OpenSSL engine search paths in GitHub CLI child processes.
+
+- `/share` now removes project-declared OpenSSL provider and configuration-include paths from GitHub CLI child environments while preserving operator-owned values.
+
+- `/share` GitHub CLI children now omit project-declared R profile and environment startup files while preserving operator-provided values.
+
+- `/share` now resolves relative operator certificate file and directory paths against the launch directory before starting GitHub CLI from the filesystem root.
+
+- `/share` now resolves a preserved relative `GH_CONFIG_DIR` against the launch directory before starting `gh` from a safe working directory.
+
+- `/share` now resolves a relative `XDG_CONFIG_HOME` against the launch directory before starting GitHub CLI from the filesystem root.
+
+- `/share` no longer forwards a project-declared `BUNDLER_SETUP` Ruby startup hook to GitHub CLI children.
+
+- `/share` strips project-declared `RUBYGEMS_GEMDEPS` so RubyGems cannot activate a project dependency file in GitHub CLI children.
+
+- `/share` strips project-declared RubyGems search paths from its `gh` children.
+
+- `/share` now removes project-declared `TCL_LIBRARY` from GitHub CLI child environments while preserving operator-owned settings.
+
+- `/share` strips project-declared `TCLLIBPATH` so GitHub CLI wrappers cannot load project-controlled Tcl packages.
+
+- `/share` GitHub CLI children now filter version-specific Lua startup hooks for supported Lua runtimes.
+
+- Git patch text is written to an exclusive private temp file so a preexisting symlink is not followed.
+
+- GJC's own `git` and `gh` invocations (`/commit`, the github tool's `pr_checkout`/`pr_push`/`pr_create`, autoresearch commits, task worktree trees) now drop project-dotenv hook variables such as `GIT_CONFIG_*` (`core.hooksPath`), `GIT_SSH_COMMAND`, and `GIT_ASKPASS`, matching the bash tool. Previously a repository `.env` could make GJC run repository code, e.g. a pre-commit hook on `/commit` or an ssh helper on push. `gh` output is captured, so `GH_PAGER` is pinned to `cat` and `GH_FORCE_TTY` is removed.
+
+- GitHub issue and pull request text returned by the github tool, and by `read` of `issue://` and `pr://`, is fenced as untrusted content, with a forged closing tag escaped.
+
+- Isolate Antigravity and Gemini CLI discovered models by the selected OAuth credential and project so one live session cannot see another session’s project-only models.
+
+- Search and AST grep results stay inside an untrusted-content fence after tail-only truncation, and a closing tag inside a match stays escaped.
+
+- Hindsight recall text can no longer end a memories block early, and retention drops orphan or case-variant memory tags instead of storing that breakout.
+
+- Escape Hindsight mental-model names, content, and refresh stamps so a stored closer cannot end the mental-model frame early.
+
+- Hindsight session retain and the queued retain upload now scrub secrets with the same pass the local memory backend uses before it stores consolidation text.
+
+- Session history database files and WAL sidecars are owner-only on POSIX and Windows, are not opened through a symlink, and a failed first open leaves the database in place.
+
+- Interactive turn status markers are opt-in. The emitted `ESC ] 777 ; notify;Terax;...` sequence is the rxvt notification extension, so Ghostty and cmux raised a desktop notification titled `Terax` on every turn start and finish. A host now sets `GJC_HOST_STATUS=terax` to receive them, and unmarked terminals get no bytes at all.
+
+- Turn status is no longer announced to terminals that are not Terax. The OSC 777 `notify;` marker is now emitted only when the hosting terminal identifies itself with `TERAX_TERMINAL`, which stopped Ghostty (and other rxvt-compatible terminals) from raising a desktop notification titled "Terax" on every turn.
+
+- HTML session exports now preserve later diagnostic lines after unterminated quoted credential values.
+
+- HTML session exports now redact Azure Storage account-key fields in structured tool data.
+
+- HTML session exports now redact secrets when credential keys are wrapped in raw or escaped backticks.
+
+- HTML session exports now redact credential values in key/value header records regardless of property-name casing.
+
+- HTML session exports now redact plural `cookies` arrays instead of exposing cookie-jar values.
+
+- HTML exports redact shell-concatenated credential values while retaining following colon-delimited diagnostic context.
+
+- Session HTML export now masks opaque values under dotted credential keys such as `client.secret`, `db.password`, and `api.key`.
+
+- Session HTML export now fully masks backslash-escaped backtick credential values, including nested serialized containers, without dropping following diagnostics.
+
+- HTML session exports now redact credential values in flat alternating header arrays, including Node `rawHeaders`.
+
+- HTML session exports now redact credential values in HAR-style name/value header records.
+
+- HTML session exports now redact credential values in serialized header tuples.
+
+- HTML session exports now redact database URL credentials with long schemes such as `postgresql+asyncpg`.
+
+- HTML session export redaction preserves diagnostic lines after an unterminated credential container.
+
+- HTML session exports now redact password confirmation fields in text and structured tool-call arguments.
+
+- HTML session exports now redact plural values in credential header records.
+
+- HTML session exports now redact comma- and semicolon-bearing unquoted credential values completely.
+
+- Session HTML export redacts values under Rails-style `SECRET_KEY_BASE` fields.
+
+- HTML session exports now redact Azure `SharedAccessKey` values in connection strings and structured data.
+
+- HTML session exports now redact Azure `SharedAccessSignature` values in connection strings and structured data.
+
+- HTML session exports now redact unquoted multiword credential values without dropping later diagnostic fields.
+
+- HTML export coverage now protects credential-valued YAML block-scalar bodies in tool arguments while retaining following diagnostic context.
+
+- HTML exports now redact credential block scalars with YAML anchors or tags while preserving the node header.
+
+- HTML exports now redact credential block scalars inside YAML sequence mappings while preserving sibling fields.
+
+- Session HTML export masks credential-shaped object keys, complete bracketed credential containers, Cookie/Set-Cookie header values, and sensitive JSON-key values, including camelCase fields such as `authToken`, `githubToken`, and `dbPassword`, plus `auth`, `bearer`, `session_key`, `credentials`, `secrets`, and delimiter-separated labels such as `OPENAI_API_KEY` and `api_token`, before base64 encoding while preserving distinct values on key collisions with incremental suffix assignment for large maps and ordinary identifiers such as `session_id`, `source_session_id`, and `native_session_id` as well as `tokensBefore`, `maxTokens`, and `token_budget`.
+- String values are scrubbed without an intermediate JSON re-encoding, preserving diagnostic context after quoted credential values.
+- Structured HTML exports also mask passphrase fields such as `passphrase`, `sshPassphrase`, and `key_passphrase`.
+- Structured HTML exports also recognize multi-segment camelCase credential keys such as `gitHubAccessToken` and `myDatabasePassword`.
+
+- Generated images are written to an exclusive private temp file so a preexisting symlink is not followed.
+
+- On POSIX, skill and hook import publication now creates and writes destination files through no-follow directory descriptors, so replacing the destination directory with a symlink after validation cannot publish the file outside that directory. Windows retains lexical path validation. On POSIX, imports spanning more than 128 distinct destination directories fail before publication rather than risking a partial batch.
+
+- Deliver a background IRC exchange to a busy session at the live run's next tool boundary instead of at the end of the turn, and keep the incoming question and the reply already sent on the model's behalf in one steering cohort (`Agent.steerCohort`) so a later model step cannot see the question without its reply. A goal-mode turn keeps the session streaming from its first prompt to its last message, so a subagent's message could sit outside the model's history for many minutes while the transcript already showed it.
+- Keep that cohort together when a user interrupt re-arms the exchange as a follow-up of the next turn: the cohort metadata now follows the records into the follow-up batch, so the next turn cannot open on the question alone.
+- Keep an accepted exchange when the run it was admitted into ends before its next tool boundary: admission is not persistence, so the batch stays queued until its records are committed, and a session switch — which aborts the outgoing turn and drops unconsumed steering — still appends the exchange to the outgoing session's history instead of losing it.
+
+- IRC peer text is framed as untrusted data before the model sees it, and the incoming message placeholder is escaped.
+
+- Record and reap interrupted Windows retirements before successor publication, reserve `.removing` before scrubbing owner metadata, bound derived sibling components, and retry transient retirement and receipt cleanup failures. Completed same-host receipts no longer block acquisition while their publisher PID is still live, and pending rollback releases are drained before a same-process reacquisition can replace their cleanup authority. Ownerless canonical legacy locks remain fail-closed because age cannot prove a paused writer is dead (issue #6008).
+- Preserve the exact-removal detach contract for marketplace restores so the existing plugin tree remains available as a rollback backup on Windows; classify a failed post-detach restoration as an uncertain mutation, retain its verified path, and bound backup components independently of the canonical cache name.
+
+- Retry validated pre-mutation Windows access-denied lock publications within a three-call publish budget and a separate two-attempt acquisition budget; report exhaustion with the lock path and failure code without labeling it proven live contention (issue #6618).
+- Keep GC candidates withheld when Windows access denial prevents exact removal before detachment, rather than reporting the refused deletion as a GC failure.
+- Stop retrying pre-mutation publication after bounded transient staging-cleanup retries fail, preventing repeated attempts from multiplying same-process residue; keep generic failures distinct from proven contention.
+- Accept the distinct Windows `access_denied` code in managed-session security validation so ACL access refusals remain classified security errors.
+- Map Windows canonical workspace-identity `access_denied` results to `permission_denied` for scope resolution and candidate diagnostics.
+- Preserve candidate-invalid `permission_denied` diagnostics through lifecycle session-list validation.
+- Remove staged info entries after identity-stat retries exhaust only through a handle-derived identity, and refuse recursive cleanup when that identity is unavailable.
+- Defer transient Windows `access_denied` while detaching replacement receipts so a later managed-session mutation can retry cleanup.
+
+- Keep CLI startup model overrides run-scoped: one-shot model selections no longer rewrite the global model profile configuration or model-usage order (fixes #6768).
+- Keep a durable default model profile whose activation failed (for example, missing provider credentials), including when its identity was restored from session history: role-only selections save only the selected role and never persist the startup override as `modelRoles.default` (fixes #6768).
+
+- SDK broker owners can now shut down a detached broker through its retained authenticated endpoint after the agent directory is removed, preventing orphaned brokers on macOS (issue #6816).
+
+- Reclaim orphaned standalone-update staging files and exact-replace placeholders after updates, keep at most the active journal's rollback backup, and preserve stages owned by pending recovery (#6862).
+
+- Headless session resume refreshes the saved model's provider catalog before restoration, so slash-namespaced catalog IDs remain resumable without an explicit `--model` override (#7099).
+
+- Keybindings migration keeps an existing mode 0600 file and writes its marker as mode 0600 without following a symlink.
+
+- On POSIX, `local://` no longer fails with `Unsafe local:// root` for the rest of a session after the temp sweeper removes the session's scratch directory and another gjc process for the same session recreates it; a recreated root owned by you, private to you, and carrying a settled migration marker is adopted. Windows continues to reject changed-inode roots until their ownership and ACLs can be validated.
+
+- Session title debug logs scrub both credential-bearing request text and generated titles, and marketplace clone debug logs scrub URL credentials including token-as-username forms. Shared redaction covers full bracketed credential containers and generic/compound sensitive labels, including `auth`, `bearer`, `credentials`, `secrets`, `session_key`, `private_token`, `OPENAI_API_KEY`, `api_token`, and `AWS_SECRET_ACCESS_KEY`, before they are written.
+
+- Managed session startup now quarantines a valid v3 replacement-cleanup receipt when its publisher is verified dead and its inode still matches after the encoded device number changes. Receipt bytes are preserved, and live, remote, or unknown owners still fail closed.
+
+- Explicit tool selections persist MCP authority even when the selectable catalog is empty or unchanged, so deselections survive resume instead of re-enabling configured defaults.
+- Additive discovery activation retains unavailable names from persisted MCP selection, allowing temporarily missing tools to return when their catalog republishes.
+- Committed MCP activations are merged into live selection authority before catalog-generation retries can discard their result.
+- MCP selection authority now rolls back after failed tool updates and survives non-persisting catalog pruning; failed session-switch rollback restores matching tool signatures, prompts, and permission guards.
+- Reactive custom-tool replacements are fenced against session transitions, so a predecessor catalog update cannot reactivate non-default MCP tools after `/new`.
+- Deferred default-server activation is recomputed after catalog replacement waits for a session transition, preserving successor defaults after `/new`.
+- Plan mode retries its internal tool swap after an MCP catalog change, keeping `resolve` available alongside newly published tools.
+- Plan-mode retries preserve registered local tools whose names begin with `mcp__`.
+- Plan approval preserves late default-server tools and transferred MCP selections without overriding successor-owned selections.
+- Pending goal activation drops its new goal when a concurrent explicit tool selection supersedes the goal-tool swap, releasing the mode gate.
+- Catalog refreshes use committed MCP selection authority so an in-flight tool request cannot leak into a replacement catalog.
+- Discovery activation commits only the prior selection plus activated tools, keeping a concurrent failed explicit request out of MCP authority.
+- Owned and inherited deferred-default callbacks consult committed authority so a pending request cannot suppress a default after catalog publication.
+- Plan-mode exit retries its tool swap after catalog changes, preventing `resolve` from staying active after approval is disabled.
+
+- MCP prompt text and embedded resource text are framed as untrusted content before they replace the user prompt.
+
+- `/mcp test` and `/mcp list` draw server and tool names as plain terminal text, so a connected server cannot set the window title, spoof a hyperlink, or write the clipboard through those labels.
+
+- MCP tool descriptions and schema prose now use the same untrusted-content boundary as MCP tool results, while argument names, enums, defaults, patterns, and example payloads stay unchanged.
+
+- Memory consolidation redacts Bearer and Basic authorization assignments before it writes MEMORY.md and memory_summary.md.
+
+- Model selector search now ranks multi-token queries by aggregated token match quality and keeps the configured default model ahead of equally scoring MRU entries.
+
+- JSON-to-YAML config migration creates the new file as mode 0600, does not follow a dangling symlink, publishes that file only after its contents are fully written, and still publishes it when the volume does not support hard links.
+
+- The Codex native hook no longer appends hook error logs under a session id that the repository dotenv planted in `GJC_SESSION_ID`. An operator id the project does not declare is still used.
+
+- The non-interactive shell environment no longer sets `CI=1`. It made every child tool (including test runners and `node-llama-cpp`) believe it was running in CI, and a per-call `env` cannot unset it. The prompt-suppression intent is already covered by `GIT_TERMINAL_PROMPT`, `SSH_ASKPASS`, `GH_PROMPT_DISABLED`, `DEBIAN_FRONTEND`, and `PIP_NO_INPUT`.
+
+- The `ooo` bridge no longer adopts a project `.env` `OUROBOROS_CLI` as the executable. Only a trusted operator setting replaces the default `ouroboros` command, and a rejected project value is removed before the bridge spawns a child.
+
+- The OS opener launches only http(s) URLs and unchanged local paths, and skips other schemes, control characters, and flag-shaped arguments.
+
+- Imported-text OSC stripping walks each character once and stops at the first terminator, so unterminated ESC prefixes stay cheap and text between terminated OSC sequences is kept.
+
+- Strip terminal control sequences from AST grep, AST edit, and find result lines, and from tool error lines, before they are drawn.
+
+- A patch rename checks generated destinations before writing, again under the mutation lock immediately before a move commits, after an earlier edit marks one generated, and for a Windows path whose file name is generated.
+
+- Planning-phase Bash now refuses sed `w` destinations with spaces and compound scripts, awk quoted redirections, command pipes and opaque program files, alternate awk executables, `ln`, and writes from inline interpreters. Dynamic execution and reflective loading fail closed across supported interpreter one-liners, including Ruby, PHP, Lua, and shell `-c` forms. Read-only planning commands, including GNU awk `-W lint`, stay allowed.
+
+- Reject multiply linked files in planning-writable artifact, scratch, and research harness paths.
+
+- Project discovery no longer follows a symlink to a file outside the repository when loading rules.
+
+- A repository `.gjc/hooks` pre or post module is no longer imported at session startup. Project-scope hook imports and inventories now identify those files as stored-only; user-agent hooks and explicit hook paths still load.
+
+- Project-level MCP config from any provider now drops `!` shell values, keeps sensitive host names literal, and does not pass the host environment into that stdio process.
+
+- An approved project MCP stdio server, including a `/mcp test` entry whose type is omitted or null, spawns with the minimal OS environment plus its own `env` entries, so the repository file cannot read host credentials.
+
+- Python eval ignores a workspace `.venv` or `venv` unless `pyvenv.cfg` exists and the interpreter resolves outside that workspace, including a file named `..payload`.
+
+- `gjc ralplan --write` scrubs credential shapes from stage artifacts and pending-approval copies before it records their digest, and refuses a disposition when distinct target ids collapse to one scrubbed id.
+
+- The Ultragoal ask guard no longer deadlocks the one question that can unblock a blocked goal: an ask that selects the `ralplan` / `approval` workflow gate is now admitted when this session's current ralplan final validates. Validation re-hashes every persisted stage artifact against `index.jsonl`, requires an iteration opener before the final, requires architect and critic verdicts from the same iteration, requires the final to be the newest stage, and requires `autoHandoff` to be `off`; anything missing, stale, rewritten, or outside the session's run directory is refused with the reason. Ordinary asks and incomplete-goal guards are unchanged, and `AskTool` still authenticates the publication it records consent against.
+
+- A project dotenv entry can no longer choose the harness receipt spool directory, including when a command forwards that value to an owner started elsewhere. `spool.jsonl` is opened without following a final-component symlink, and an existing spool file is tightened to owner-only mode before a receipt is appended.
+
+- Encode task names, docs, paths, and runner fields in the recipe tool description so repository metadata cannot close its instruction or runner tags.
+
+- Debug report bundles are created as mode 0600 files, and a symlink at the archive path is refused instead of followed.
+
+- Resident text blobs for long assistant and tool output stay in memory when the resident cache root is inside a Git worktree, so a later git add cannot stage that plaintext.
+
+- Eval refuses to run when the session has a bash allowlist or a read-only bash profile, so in-process Python or JavaScript cannot bypass that restriction. Sessions without those restrictions still run eval.
+
+- `--resume` and `--fork` open the session whose id equals the argument when a newer case-insensitive prefix or filename match would otherwise be chosen.
+
+- SDK sessions now publish deferred `agent_end` events after continuation decisions are resolved and the originating prompt finalizer and earlier event handlers have completed, so terminal updates are not lost and do not race successor turns. Batched terminals publish in order, and settlement waits for the entire batch. Disposing during an in-flight extension delivery rejects the outstanding SDK terminal instead of leaving its submitter pending.
+
+- A detached SDK broker left with no client connection, no live session host, and no open spawn authority now exits on its own after `sdk.brokerAbandonedGraceMs` (default 120s) instead of holding its port, its publication, and its lock until the machine reboots, and it removes the registration it still owns.
+
+- Report a retained heartbeat-renewal block as a broker exit instead of silently dropping the checkpoint cycle. A heartbeat pass whose budget aborted before the lock layer exhausted reported nothing, so a broker blocked by a stale removal transition lingered until shutdown; it now surfaces the block and exits with `heartbeat-renewal-blocked` and the blocking lock path (#6738).
+- Keep the retained broker trampoline's decision backstop longer than the parent's discovery deadline so a broker that never publishes is reported as a discovery timeout rather than an "exited before discovery" startup failure (#6738).
+
+- The broker startup signal directory is taken only from the operator environment, including a value loaded before a worktree changes the working directory, so a project dotenv line cannot create that directory or pass it to the broker child. An operator directory the project does not declare is still used.
+
+- Session-host cwd-equality test seams (`GJC_SDK_TEST_HANG_MODEL_PROFILE`, `GJC_SDK_TEST_FAIL_AFTER_REGISTRATION`, `GJC_SDK_TEST_EXIT_AFTER_READY`, and `GJC_SDK_TEST_REJECT_AFTER_READY`) arm only from a trusted operator value, and a project dotenv copy is removed before a later child inherits it. An operator value the project does not declare is still honored.
+
+- Preserve proven lifecycle terminal results when a late transition attempts to overwrite them, avoiding contradictory ledger history on restart. Broker retries of proven errors return the recorded response even when it contains cleanup metadata. Existing uncertain or quarantined history is not repaired automatically.
+
+- SDK observer streams now deliver live tool activity only to authenticated clients that negotiated the required capabilities, without replaying it as durable history or exposing the prompt owner's identity.
+- Legacy broker admission refusals now retain a fixed public diagnostic while keeping outcome certainty and retryability unknown.
+
+- Event-replay capability claims no longer reduce SDK host demand until native negotiated-capability snapshots confirm the observer role.
+
+- SDK terminal events no longer wait for unrelated event handlers admitted afterward.
+
+- Keep the exact-config `/mcp` exception in the public slash-command boundary: sessions started with `--mcp-config` still expose `/mcp status|list|suspend|resume|reconnect` even though ordinary TUI and ACP surfaces do not.
+
+- SDK broker startup reclaims a same-host `sessions/index.jsonl.lock` whose owner process is provably dead, including a leftover `.lock.removing` directory. A live same-host owner and a lock attributed to another host stay in place.
+
+- Switching to a different session clears the active checkpoint so a later rewind cannot truncate that session or move its branch to the root.
+
+- Switching to a different session drops deferred bash and python results so the next prompt cannot write them into that session.
+
+- Switching to a different session drops the previous session's pending resolve action so apply cannot run after the switch.
+
+- Shell snapshot creation quotes the rc file path before sourcing it, so metacharacters in that path are not executed as shell commands.
+
+- Bash expansion of `skill://` paths now rejects a symlink that leaves the skill directory, and still expands a missing file whose real ancestors stay inside that directory.
+
+- Concurrent Slack root requests now wait through the active durable publication lease and retry only after its state changes or expires, avoiding false timeouts while a valid publisher is still working.
+
+- Slack root publication now stops renewing retired leases and cannot reactivate a mapping after attachment retirement.
+
+- Slack root publication waiters now stop with daemon shutdown instead of lingering through lease renewals or taking over after shutdown.
+
+- The ssh tool now uses the same ACP and SDK permission gate as bash. Prompt mode asks before a remote command runs, and deny mode rejects it. Allow mode is unchanged, and tool names outside that gate still run without a prompt.
+
+- The SSH tool frames remote command output in its direct result and error text, and a shorter inline window keeps that frame. Reading an SSH output artifact wraps the selected text after selection and truncation; stored artifact bytes remain unchanged.
+- A rejected artifact reservation after the remote command has finished still returns that command's framed output and exit status.
+
+- Workflow JSONL and text appends create mode 0600 files, refuse a final-component symlink, and tighten an existing group- or world-accessible file to 0600.
+
+- The Windows speech-to-text recorder script is written to an exclusive private temp file so a preexisting symlink is not followed.
+
+- Neutralize host framing tags inside a subagent role body so that text cannot close the role block early.
+
+- Subagent tool results frame preview, assignment, steer text, and setup diagnostics as untrusted content so a backtick fence cannot close early.
+
+- A repository SYSTEM.md no longer replaces the user file or is inserted raw into the system-prompt customization block; the user file is encoded before insertion.
+
+- Session title generation replaces configured secrets in automatic titles and /rename regeneration text before those prompts are truncated and sent to the model.
+
+- tmux launch and `gjc session create` ignore project dotenv pins for the tmux session name, coordinator session id, GJC session id, and coordinator state-file path, and pass that filtered GJC session id into the child so the project file cannot reload it. An operator value the project does not declare is still used, and an omitted id stays unset.
+
+- Task token logs and harness session state and event files are created mode 0600 in mode 0700 directories, refuse a final-component symlink, and tighten an existing group- or world-accessible file to 0600.
+
+- Background ephemeral turns apply the same host trust notice beside tool-result images as the main provider request, and leave user-attached images unchanged.
+
+- Encode tool names, labels, and descriptions in the system prompt inventory so metadata cannot close that wrapper, while repeated MCP descriptions keep their host untrusted-content fence and escape only the enclosed body.
+
+- Stdio MCP servers, LSP servers, the Biome and SwiftLint linters, and DAP adapters no longer inherit hook variables a project `.env` declares (e.g. `NODE_OPTIONS=--require ./x.js`, `LD_PRELOAD`, `GIT_CONFIG_*`). They now start from the same filtered environment as the bash tool, so opening a repository and writing a file can no longer run repository code through a server GJC starts on its own. Values the launching shell exported are still honored.
+
+- TTSR now records and logs non-fatal `astCondition` parse errors once per rule and language instead of silently treating invalid patterns as non-matches.
+
+- Recognize `develop` and `origin/develop` as authoritative Ultragoal integration bases while retaining nearest-merge-base selection. Exclude the checked-out local branch from default candidates so committed changes remain visible, and reject repositories without a distinct recognized base; explicit overrides and remote-tracking refs remain eligible.
+
+- Fail closed when Ultragoal cannot resolve an integration baseline independent of the checked-out branch, preventing committed goal changes from being authenticated as an empty checkpoint.
+
+- Ultragoal change-set capture no longer fails with "unable to resolve an authoritative integration base" when the repository's only integration ref is the checked-out branch (for example a trunk-only checkout or a single-branch clone). The checked-out branch is used as the fallback base, so the change set is exactly the working-tree diff.
+
+- Fetched pages, MCP tool text, and web search summaries escape an untrusted-content end tag when whitespace sits before its closing bracket.
+
+- `gjc update` recognizes a project dependency install at `<project>/node_modules/.bin/gjc` — including the real `.exe` that Windows dependency installs place there — and refuses with package-manager instructions instead of downloading a replacement. Replacing that file broke the project's lockfile contract and failed on Windows with `acl_present`.
+
+- Fixed the welcome screen model and provider pills staying stale after model switches, including resume choices, extension controls, profile changes, and fallback switches; sanitize discovered model metadata before rendering.
+
+- Restricted workflow bash runs an allowlisted command at its resolved path and disables git external diff and textconv helpers.
+
+### Security
+
+- fix(tmux-self-injection-guard): Fix multiple command-parsing vulnerabilities in the tmux injection guard
+  - Restrict `command -v`/`-V` lookup suppression to the same command invocation; previously suppressed across command boundaries (`;`, `|`)
+  - Preserve environment variable assignments like `env FOO=bar` in wrapper context; previously treated them as wrapped commands
+  - Separate flag-only options (`setsid -c/-w`, `sudo -s/-i`, `xargs -0/-t/-x`) from argument-taking options to prevent adjacent words from being consumed as option arguments
+  - Recognize shell option operands (`bash -O extglob`, `bash -o pipefail`) and skip over them when scanning for script payloads; previously halted at option operands
+  - Removed unreachable dead code in wrapper mode state machine
+- Preserve argv boundaries when recursively inspecting `env -S` payloads, including nested `bash -c` commands, and avoid treating `builtin` or non-executing `sudo` modes as external command executions.
+- Inspect executable here-document input and unquoted command substitutions, follow shell stdin through wrappers, pipelines, and identity descriptor redirects, while leaving literal data-only consumers unblocked.
+- Honor bundled `env` split-string options, environment unsets, and BSD `env -P` operands; keep trailing words as arguments to the split command, ignore lookup-only `env -S` operands, and stop shell command scanning at a pre-command `--`.
+- Resolve `env -C` from the tmux command's simple-command segment and respect bundled `xargs` option operands when detecting socket overrides.
+- Propagate `env -C` working directories into nested shell and here-document payloads; preserve pipeline identity across subshell grouping.
+- Inspect only the final repeated `tmux -c` command and stop command discovery after invalid shell-builtin wrapper options or GNU `env --null`/`-0` modes.
+- Pass the effective environment, including `env -u` changes, to named-target resolution.
+- Resolve wrapper working directories from the effective Bash environment and apply tmux's `/tmp` fallback when `TMUX_TMPDIR` is empty.
+- Inspect assignment-prefixed `eval` strings and shell scripts in their effective working directory, while respecting non-executing wrapper and Bash modes.
+- Respect unambiguous GNU wrapper-option abbreviations and bundled options inside `env -S` payloads.
+- Treat `sudo -e`/`--edit` as file editing rather than command execution when checking wrapper arguments.
+- Preserve Bash option order across mixed bundles and `noexec` toggles, distinguish shell-builtin `eval` from an external command under wrappers, inspect shell-runner scripts resolved through the effective `PATH`, and fail closed on unresolved `PATH` overrides.
+- Resolve statically known environment references in `env -C`, suppress command discovery for non-executing GNU `env` help/version/null modes and sudo modes.
+- Inspect command substitutions in ordinary shell arguments and here-documents, skip literal here-document bodies when matching substitution boundaries, and decode ANSI-C-quoted Bash `-c` payloads.
+- Stop timeout option parsing after its required duration, and recognize terminal help/version modes and unambiguous long-option abbreviations for common wrappers.
+- Document the guard's BashTool preflight scope, its direct `AgentSession.executeBash()`/SDK bypass, and its limitations around interpreter one-liners, shell variable indirection, and Python/eval tools.
+
+- Rulebook names, descriptions, and globs are encoded before the system prompt is rendered, so repository rule frontmatter cannot close the rules block.
+
+- Validation commands that would inject input into the current tmux pane are refused before a shell starts.
+
+### Fixes
+
+- Preserve canonical workflow identity across assistant continuations and helper prompts, including the Deep Interview ask contract, while clearing the identity when its durable workflow ends (#7049).
+
+- **ultragoal change-set**: Support SHA-256 unborn repository baselines. The empty tree object ID was hard-coded to the SHA-1 value, which caused git diff commands to fail (exit code 128) when applied to repositories initialized with `git init --object-format=sha256`. The empty tree ID is now derived dynamically from the repository format using `git hash-object -t tree`, ensuring compatibility with both SHA-1 and SHA-256 object formats.
+
+- **bash tool**: Complete removal of default CI=true injection. PR #6937 removed CI from the non-interactive constant but the underlying buildSpawnEnv() function in shell-config.ts still injected CI by default. This prevented tools like node-llama-cpp and test runners from running correctly, as they change behavior when CI=true is present. The injection is now completely removed; CI is only present in the spawned bash environment if inherited from the parent process.
+
 ## [0.18.12] - 2026-10-16
 
 ### Added

package/dist/types/capability/rule.d.ts

@@ -8,6 +8,8 @@ export interface RuleFrontmatter {
     alwaysApply?: boolean;
     /** New key for TTSR match conditions. */
     condition?: string | string[];
+    /** AST-grep pattern(s) for TTSR AST matching (evaluated on completed tool args). */
+    astCondition?: string | string[];
     /** New key for TTSR stream scope. */
     scope?: string | string[];
     /** Per-rule TTSR interrupt mode override. */
@@ -36,6 +38,8 @@ export interface Rule {
     description?: string;
     /** Regex condition(s) that can trigger TTSR interruption. */
     condition?: string[];
+    /** AST-grep pattern(s) for TTSR AST matching (evaluated on completed tool args). */
+    astCondition?: string[];
     /** Optional stream scope tokens (for example: text, thinking, tool:edit(*.ts)). */
     scope?: string[];
     /** Per-rule TTSR interrupt mode override (falls back to global ttsr.interruptMode). */
@@ -48,15 +52,16 @@ export interface Rule {
     _source: SourceMeta;
 }
 /**
- * Parse `condition` + `scope` from rule frontmatter.
+ * Parse `condition`, `astCondition`, and `scope` from rule frontmatter.
  *
  * - `condition` accepts string or string[]
+ * - `astCondition` accepts string or string[] (ast-grep patterns)
  * - `scope` accepts string or string[]
  * - legacy `ttsr_trigger` / `ttsrTrigger` are accepted as a `condition` fallback
  * - condition tokens that look like file globs become scope shorthands:
  *   `*.rs` => `tool:edit(*.rs)`, `tool:write(*.rs)` and a catch-all condition `.*`
  */
-export declare function parseRuleConditionAndScope(frontmatter: RuleFrontmatter): Pick<Rule, "condition" | "scope">;
+export declare function parseRuleConditionAndScope(frontmatter: RuleFrontmatter): Pick<Rule, "condition" | "astCondition" | "scope">;
 /**
  * Process-global snapshot of rules the active session loaded.
  * Read by internal URL protocol handlers (rule://).

package/dist/types/cli/append-system-prompt.d.ts

@@ -0,0 +1,6 @@
+export interface AppendSystemPromptCandidate {
+    level: "user" | "project";
+    path: string;
+}
+/** First user file. A repository copy is untrusted project text and is never selected. */
+export declare function selectAppendSystemPromptFile(candidates: readonly AppendSystemPromptCandidate[]): string | undefined;

package/dist/types/cli/args.d.ts

@@ -6,8 +6,6 @@ export interface Args {
     allowHome?: boolean;
     provider?: string;
     model?: string;
-    smol?: string;
-    slow?: string;
     plan?: string;
     mpreset?: string;
     default?: boolean;
@@ -62,3 +60,10 @@ export interface Args {
 export declare function parseArgs(args: string[], authority?: ParseArgsAuthority): Args;
 /** Reject flags whose only owners are non-local startup consumers. */
 export declare function assertLocalLaunchArgs(parsed: Args): void;
+/**
+ * Resolve the ephemeral `plan` model-role override that plan mode switches to.
+ *
+ * Precedence is CLI `--plan` > `GJC_PLAN_MODEL` > legacy `PI_PLAN_MODEL`.
+ * `$pickenv` trims values and treats empty/whitespace as unset.
+ */
+export declare function resolvePlanModelOverride(parsed: Pick<Args, "plan">): string | undefined;

package/dist/types/cli/customize-doctor-precedence.d.ts

@@ -0,0 +1,16 @@
+export interface DiscoveryPrecedenceCandidate {
+    key: string | undefined;
+    provider: string;
+    scope: "user" | "project" | "native";
+    eligible: boolean;
+    enabled: boolean;
+}
+export interface DiscoveryPrecedenceResult {
+    shadowed: boolean;
+    shadowedBy?: {
+        provider: string;
+        scope: DiscoveryPrecedenceCandidate["scope"];
+    };
+}
+/** Resolve ordered discovery candidates without allowing ineligible or disabled entries to own keys. */
+export declare function resolveDiscoveryPrecedence(candidates: readonly DiscoveryPrecedenceCandidate[]): DiscoveryPrecedenceResult[];

package/dist/types/cli/customize-doctor.d.ts

@@ -20,9 +20,10 @@ export type CustomizeSurfaceKind = "mcp" | "skill" | "hook" | "tool" | "extensio
  *
  * - `canonical`: project/global `.gjc` entries and GJC bundled defaults — the
  *   primary load path and the persisted authority for sessions.
- * - `convention`: items from registered non-native conventions that are part of
- *   the discovery load path (claude-plugins, claude/codex hooks, agents,
- *   cursor, gemini, opencode, windsurf, cline, github, mcp-json, ssh).
+ * - `convention`: items exposed by registered non-native discovery providers
+ *   (claude-plugins, claude/codex hooks, agents, cursor, gemini, opencode,
+ *   windsurf, cline, github, mcp-json, ssh). The item status identifies whether
+ *   a discovered item is active, stored-only, or otherwise excluded at runtime.
  * - `import-candidate`: Claude Code / Codex project (+ global) files on
  *   surfaces GJC deliberately never loads. Reported for provenance only; never
  *   active runtime authority. Candidates for a future import flow (#4291).

package/dist/types/cli/public-command-errors.d.ts

@@ -81,6 +81,7 @@ export declare const PUBLIC_COMMAND_DIAGNOSTICS: {
     readonly router_cleanup_failed: "SDK session Router cleanup failed.";
     readonly broker_cleanup_failed: "SDK broker client cleanup failed.";
     readonly lifecycle_idempotency_conflict: "The broker reported an idempotency conflict. Reconcile existing lifecycle state before deciding whether another request is safe.";
+    readonly lifecycle_legacy_history_ambiguous: "The broker refused admission because legacy lifecycle history cannot prove this target is unrelated. This request was not dispatched; this refusal does not settle earlier effects. Preserve the ledger and original operation, request key, and target. For a prior session.create, use read-only session.lookup with its original key and create target; not_found is not proof of no effect. An empty transcript, stopped host, or fresh key does not resolve this fence. Do not edit the ledger, force deletion, or retry with another key; missing identity or terminal effect evidence requires operator investigation.";
     readonly lifecycle_input_refused: "The broker refused the request as invalid input. Correct the request payload and reconcile existing lifecycle state before deciding whether another request is safe.";
     readonly usage_transport_exclusive: "Specify exactly one of --stdio or --socket <path>.";
     readonly usage_duplicate_option: "Each option on this command may occur at most once.";