@gajae-code/coding-agent 0.18.12 → 0.19.0

package/dist/types/session/agent-session.d.ts

@@ -305,6 +305,8 @@ export interface AgentSessionConfig {
     workflowGatePublication?: "endpoint" | "local";
     /** Tool registry for LSP and settings */
     toolRegistry?: Map<string, AgentTool>;
+    /** Publish committed active tool names to tool execution contexts. */
+    onToolNamesChanged?: (toolNames: string[]) => void;
     /**
      * Tool objects this session's builder constructed from built-in descriptors, captured
      * before any extension, MCP, or dynamically registered tool could claim their registry
@@ -372,6 +374,8 @@ export interface AgentSessionConfig {
     defaultSelectedMCPServerNames?: string[];
     /** MCP tool names that should seed brand-new sessions created from this AgentSession. */
     defaultSelectedMCPToolNames?: string[];
+    /** Conventional autoload MCP names for the current catalog when autoload is not deferred. */
+    defaultSelectedConventionalMCPToolNames?: string[];
     /** MCP capabilities that are always active and never part of persisted user selection. */
     mandatoryMCPToolNames?: string[];
     /** TTSR manager for time-traveling stream rules */
@@ -485,6 +489,10 @@ export interface PromptOptions {
     /** Internal host capability; ordinary package callers cannot construct the branded value. */
     sdkRunCapability?: unknown;
 }
+export type QueuedRunStartFailure = {
+    readonly disposition: "not-started";
+    readonly error: unknown;
+};
 export interface SendUserMessageOptions {
     deliverAs?: QueuedInputDelivery;
     /** Preserve a busy SDK dispatch as queued work across an admission fence. */
@@ -498,6 +506,8 @@ export interface SendUserMessageOptions {
         startsOwnRun?: boolean;
         removed?: boolean;
     }) => void;
+    /** Internal positive core refusal, never a provider or teardown failure. */
+    onQueuedRunStartFailed?: (failure: QueuedRunStartFailure) => void;
     /** Internal dispatch disposition used before actual queue consumption. */
     onDispatchDisposition?: (promotion: {
         startsOwnRun: boolean;
@@ -738,6 +748,7 @@ export interface AgentSessionProfileInstalledOverrideState {
     manualModelRoles: ReadonlySet<string>;
     manualAgentModelOverrides: ReadonlySet<string>;
     configuredAgentModelOverrides: ReadonlySet<string>;
+    configuredDefaultChain?: readonly string[];
     preProfileModel: Model | undefined;
 }
 export interface PreparedProfileModelSelection {
@@ -817,19 +828,27 @@ export declare class AgentSession {
         session_id?: string;
     } | undefined;
     /**
-     * Live prompt marker or restored durable workflow — the effective state the
-     * cwd-local mutation guard must honor after resume.
+     * Live prompt marker or durable workflow identity — the effective state the
+     * cwd-local mutation guard must honor during and after a workflow prompt.
      */
     getEffectiveActiveWorkflowSkillState(): {
         skill: string;
         sessionId: string;
     } | undefined;
+    /** Refresh durable workflow identity before a terminal or safety-sensitive operation. */
+    refreshEffectiveActiveWorkflowSkillState(): Promise<{
+        skill: string;
+        sessionId: string;
+    } | undefined>;
     /** Replace the session-owned MCP manager after a cwd rescope. */
     replaceOwnedMcpManager(next: MCPManager | undefined): Promise<void>;
-    /** Swap named custom tools and their optional mandatory MCP selection. */
+    /** Swap named custom tools and restore authoritative MCP selections as late tools arrive. */
     replaceNamedCustomTools(previousNames: readonly string[], nextTools: readonly CustomTool[], options?: {
         mandatoryMCPToolNames?: readonly string[];
+        defaultSelectedConventionalMCPToolNames?: readonly string[];
         activateNewTools?: boolean;
+        inactiveNewToolNames?: readonly string[];
+        persistMCPSelection?: boolean;
     }): Promise<void>;
     /** Best-effort accessor for the active skill's `current_phase` field from
      *  its persisted mode-state file. Used by the `skill` tool to enforce the
@@ -893,6 +912,8 @@ export declare class AgentSession {
      * manager's stable control-plane records (they outlive AsyncJob eviction).
      */
     getSubagentLifecycleStatuses(): SubagentLifecycle[];
+    /** Notify UI projections after a committed session-identity transition. */
+    notifySessionIdentityChanged(): Promise<void>;
     /**
      * Emit a UI-only notice to the session. Surfaces in interactive mode as a
      * `showWarning` / `showError` / `showStatus` line; non-interactive modes
@@ -911,6 +932,8 @@ export declare class AgentSession {
      * Multiple listeners can be added. Returns unsubscribe function for this listener.
      */
     subscribe(listener: AgentSessionEventListener): () => void;
+    /** Subscribe to committed session identity changes that affect UI projections. */
+    subscribeSessionIdentityChanges(listener: () => void | Promise<void>): () => void;
     /**
      * Remove all listeners, flush pending writes, and disconnect from agent.
      * Call this when completely done with the session.
@@ -996,6 +1019,7 @@ export declare class AgentSession {
         type: "agent_end";
     }>): void;
     flushParkedAgentEndForCoordinatorPersistForTests(): void;
+    waitForAgentEndHandlingForTests(): Promise<void>;
     drainAsyncJobDeliveriesForAcp(options?: {
         timeoutMs?: number;
     }): Promise<boolean>;
@@ -1097,6 +1121,11 @@ export declare class AgentSession {
      * deliberately bypassed: suppression is runtime state, not user authority.
      */
     controlExactMcpServer(action: ExactMcpControlAction, name: string): Promise<ExactMcpControlResult | undefined>;
+    /** Whether the current context has committed persisted, constructor, or caller MCP selection authority. */
+    hasCommittedMCPToolSelectionAuthority(): boolean;
+    /** Whether the current context has committed or pending caller MCP selection authority. */
+    hasMCPToolSelectionAuthority(): boolean;
+    getActiveMCPToolNames(): string[];
     getSelectedMCPToolNames(): string[];
     isToolDiscoveryEnabled(): boolean;
     getDiscoverableTools(filter?: {
@@ -1104,7 +1133,9 @@ export declare class AgentSession {
     }): DiscoverableTool[];
     getDiscoverableToolSearchIndex(): DiscoverableToolSearchIndex;
     getSelectedDiscoveredToolNames(): string[];
-    activateDiscoveredTools(toolNames: string[]): Promise<string[]>;
+    activateDiscoveredTools(toolNames: string[], options?: {
+        persistMCPSelection?: boolean;
+    }): Promise<string[]>;
     /**
      * Reload the SSH tool from disk-backed capability discovery and make the
      * refreshed definition visible to the next model call without restarting.
@@ -1117,8 +1148,15 @@ export declare class AgentSession {
      * Only tools in the registry can be enabled. Unknown tool names are ignored.
      * Also rebuilds the system prompt to reflect the new tool set.
      * Changes take effect before the next model call.
+     * Use `explicit: false` for internal filtering and `persistMCPSelection: false` when the live
+     * selection must not be written to the session transcript. Internal mode transitions may set
+     * `retryOnMcpCatalogChange` when a catalog publication must not leave their tool swap unapplied.
      */
-    setActiveToolsByName(toolNames: string[]): Promise<void>;
+    setActiveToolsByName(toolNames: string[], options?: {
+        explicit?: boolean;
+        persistMCPSelection?: boolean;
+        retryOnMcpCatalogChange?: boolean;
+    }): Promise<void>;
     /** Rebuild the base system prompt using the current active tool set. */
     refreshBaseSystemPrompt(): Promise<void>;
     /**
@@ -1517,9 +1555,12 @@ export declare class AgentSession {
         cause?: ModelChangeCause;
         onMutationStarted?: () => void;
     }): Promise<void>;
-    setActiveModelProfile(name: string | undefined): void;
+    /** History may restore the identity without proving this process activated the profile. */
+    setActiveModelProfile(name: string | undefined, activatedByThisProcess?: boolean): void;
     markProfileRoleOverrideManual(path: "modelRoles" | "task.agentModelOverrides", role: string): void;
     getActiveModelProfile(): string | undefined;
+    /** A restored profile identity is not eligible for role-only materialization until activation succeeds. */
+    getActivatedModelProfile(): string | undefined;
     setUnavailableModelProfile(name: string | undefined): void;
     getUnavailableModelProfile(): string | undefined;
     /** Revision fence for deferred activation after a user model selection. */
@@ -1553,7 +1594,7 @@ export declare class AgentSession {
     }, manual?: {
         modelRoles: readonly string[];
         agentModelOverrides: readonly string[];
-    }): void;
+    }, configuredDefaultChain?: readonly string[]): void;
     getProfileInstalledOverrideState(): AgentSessionProfileInstalledOverrideState;
     restoreProfileInstalledOverrideState(state: AgentSessionProfileInstalledOverrideState): void;
     /** Drop the recorded profile-installed override keys after materialization. */
@@ -1938,7 +1979,8 @@ export declare class AgentSession {
      * the reply is generated, both the incoming question and the auto-reply are
      * queued for injection into the recipient's persisted history so the model
      * sees the exchange on its next turn.  Injection happens immediately when the
-     * session is idle, otherwise it is deferred until streaming ends.
+     * session is idle; a busy session steers the exchange into the live run, which
+     * commits it at its next tool boundary.
      */
     respondAsBackground(args: {
         from: string;

package/dist/types/session/session-manager.d.ts

@@ -41,6 +41,17 @@ export interface PreparedNewSession {
     readonly artifactsDir: string | null;
     readonly managedLegacyLocalMigrationSource: ManagedLegacyLocalMigrationSource | null;
 }
+/**
+ * Resident text is a second plaintext copy of assistant and tool output.
+ * A cache root inside a Git worktree can be staged by a later `git add`, so
+ * that root stays in memory. Both the lexical directory and the canonical
+ * directory are classified: a symlink outside the worktree must not hide a
+ * target inside it, and a lexical worktree path stays refused when its
+ * canonical target is outside. A missing or non-directory root still reaches
+ * the resident-cache trust check when both views are outside a worktree.
+ * No existing directory within 64 ancestors, or a resolver error, stays in memory.
+ */
+export declare function residentTextCacheRootAllowsDisk(cacheRoot: string): boolean;
 export interface SessionEntryBase {
     type: string;
     id: string;
@@ -1092,6 +1103,11 @@ export interface ResolvedSessionMatch {
     session: SessionInfo;
     scope: "local" | "global";
 }
+/**
+ * Equal session id first, the same `id ===` check managed resume already uses.
+ * Prefix matching stays for every other argument, in list order.
+ */
+export declare function pickResumableSession(sessions: readonly SessionInfo[], sessionArg: string): SessionInfo | undefined;
 export declare function resolveResumableSession(sessionArg: string, cwd: string, sessionDir?: string, storage?: SessionStorage, managedAgentDir?: string): Promise<ResolvedSessionMatch | undefined>;
 interface SessionManagerStateSnapshot {
     sessionId: string;

package/dist/types/skill-state/workflow-mutation-guard.d.ts

@@ -1,5 +1,5 @@
 import type { AgentTool } from "@gajae-code/agent-core";
-import { readVisibleSkillActiveState } from "./active-state";
+import { readVisibleSkillActiveState, type SkillActiveEntry } from "./active-state";
 export declare const DEEP_INTERVIEW_MUTATION_BLOCK_MESSAGE = "Deep-interview phase boundary: continue gathering context/questions/risks and emit a handoff/spec before code edits. Mutation tools and patch execution are blocked while deep-interview is active; finalize specs through `gjc deep-interview --write --stage final` or hand off to an execution phase.";
 export declare const WORKFLOW_STATE_MUTATION_BLOCK_MESSAGE = ".gjc workflow state and artifacts are runtime-owned. Agent mutation tools cannot edit `.gjc/**`; use the sanctioned `gjc` CLI instead.";
 export declare const RALPLAN_MUTATION_BLOCK_MESSAGE = "Ralplan planning phase boundary: keep refining the consensus plan and persist plan artifacts through `gjc ralplan --write` (stage scratch files under a temp dir if needed). Product-code mutation tools and patch execution are blocked while ralplan is active; mutate only after the plan is approved and execution begins.";
@@ -49,6 +49,18 @@ export declare function readWorkflowGuardContext(cwd: string, options?: {
     sessionId?: string;
     threadId?: string;
 }): Promise<WorkflowGuardContext>;
+/**
+ * Pick the single CURRENT workflow entry among active entries.
+ *
+ * Steady state has exactly one active workflow skill (handoff demotes the prior
+ * to `active:false`, which `listActiveSkills` already filters out). If several
+ * are momentarily active, prefer the most-recently-updated entry so a stale
+ * planning row (e.g. a still-active ralplan `final`) can never be selected over a
+ * newer executor (ultragoal/autoresearch), and a planning *return* (newer `updated_at`)
+ * reliably wins. Ties fall back to the resolved top-level `skill`, then to the
+ * first entry, matching how the HUD/chain guard pick `activeSkills[0]`.
+ */
+export declare function resolveCurrentWorkflowEntry(entries: SkillActiveEntry[], topLevelSkill: string): SkillActiveEntry;
 export declare function assertWorkflowMutationRawPathsAllowed(input: {
     cwd: string;
     sessionId?: string;

package/dist/types/slash-commands/helpers/mcp.d.ts

@@ -1,3 +1,8 @@
 import type { ParsedSlashCommand, SlashCommandResult, SlashCommandRuntime } from "../types";
+/**
+ * One terminal row for an untrusted MCP server or tool name.
+ * Ordinary names are unchanged. Controls, OSC, and line breaks are not.
+ */
+export declare function mcpTerminalLabel(value: string): string;
 /** ACP/text-mode `/mcp` handler. Shared by both dispatchers via the spec. */
 export declare function handleMcpAcp(command: ParsedSlashCommand, runtime: SlashCommandRuntime): Promise<SlashCommandResult>;

package/dist/types/ssh/ssh-executor.d.ts

@@ -1,4 +1,5 @@
 import { Settings } from "../config/settings";
+import { type TerminalArtifactPublisher } from "../session/streaming-output";
 import { type SSHConnectionTarget } from "./connection-manager";
 export interface SSHExecutorOptions {
     /** Session settings used for output policy. */
@@ -16,6 +17,8 @@ export interface SSHExecutorOptions {
     /** Artifact path/id for full output storage */
     artifactPath?: string;
     artifactId?: string;
+    /** Session-owned publisher for managed sessions without a writable artifact path. */
+    artifactPublisher?: TerminalArtifactPublisher;
 }
 export interface SSHResult {
     /** Combined stdout + stderr output (sanitized, possibly truncated) */
@@ -34,7 +37,11 @@ export interface SSHResult {
     outputLines: number;
     /** Number of bytes included in the output text */
     outputBytes: number;
-    /** Artifact ID if full output was saved to artifact storage */
+    /** Artifact ID if output was saved to artifact storage. */
     artifactId?: string;
+    /** Bytes omitted from artifact storage after its hard cap was reached. */
+    artifactTruncatedBytes?: number;
+    /** Bounded diagnostic when artifact storage failed. */
+    artifactFailureDiagnostic?: string;
 }
 export declare function executeSSH(host: SSHConnectionTarget, command: string, options?: SSHExecutorOptions): Promise<SSHResult>;

package/dist/types/system-prompt.d.ts

@@ -59,8 +59,9 @@ export declare function loadProjectContextFiles(options?: LoadContextFilesOption
     depth?: number;
 }>>;
 /**
- * Load the effective system prompt customization from SYSTEM.md.
- * Project-level SYSTEM.md overrides user-level SYSTEM.md.
+ * Load the user system prompt customization from SYSTEM.md.
+ * A repository SYSTEM.md is untrusted project text. It must not replace the
+ * user file or become the customization block.
  */
 export declare function loadSystemPromptFiles(options?: LoadContextFilesOptions): Promise<string | null>;
 export interface SystemPromptToolMetadata {

package/dist/types/task/role-body.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Keep a subagent role body inside the host [ROLE] block.
+ *
+ * The body is the agent instruction. It is inserted between host [ROLE] and
+ * [/ROLE]. A literal framing tag would end that block early. Only the four
+ * host framing names are rewritten; other brackets stay literal.
+ *
+ * One left-to-right scan: a gap run, a slash only when it is present, then
+ * one more gap run, then the word. A non-matching "[" does not hide a later tag.
+ */
+export declare function containSubagentRoleBody(body: string): string;

package/dist/types/tools/awaiting-input.d.ts

@@ -0,0 +1,28 @@
+export type AwaitingInputKind = "browser_auth" | "device_code";
+export interface AwaitingInputSignal {
+    kind: AwaitingInputKind;
+    /** Epoch milliseconds when the quiet window elapsed after the match. */
+    detectedAt: number;
+}
+/** Cancels a scheduled callback. */
+export type CancelScheduled = () => void;
+export interface AwaitingInputDetectorOptions {
+    onDetect: (signal: AwaitingInputSignal) => void;
+    /** Quiet window after a match before the signal fires. */
+    quietMs?: number;
+    /** Injectable scheduler; defaults to `setTimeout`. */
+    schedule?: (callback: () => void, ms: number) => CancelScheduled;
+    /** Injectable clock; defaults to `Date.now`. */
+    now?: () => number;
+}
+export declare const AWAITING_INPUT_QUIET_MS = 3000;
+/** Classify an output tail; `undefined` when it does not look like an auth prompt. */
+export declare function classifyAwaitingInput(tail: string): AwaitingInputKind | undefined;
+export declare class AwaitingInputDetector {
+    #private;
+    constructor(options: AwaitingInputDetectorOptions);
+    /** Feed one streamed output chunk. Any new output restarts the quiet window. */
+    push(chunk: string): void;
+    /** Stop watching; the command exited or was folded. Never fires afterwards. */
+    dispose(): void;
+}

package/dist/types/tools/bash-allowed-prefixes.d.ts

@@ -17,5 +17,11 @@ export interface BashRestrictionOptions {
     profile?: BashRestrictionProfile;
     gjcSessionBinding?: GjcSessionBinding;
 }
+/**
+ * Workflow restricted bash keeps the lexical prefix check, then runs the resolved
+ * executable. Callers also skip the shell snapshot and shell prefix, because a
+ * snapshot function can be named for that absolute path.
+ */
+export declare function normalizeWorkflowBashCommand(command: string, allowedPrefixes: readonly string[] | undefined, options?: BashRestrictionOptions): string | undefined;
 export declare function normalizeReadOnlyBashCommand(command: string): string | undefined;
 export declare function checkBashAllowedPrefixes(command: string, allowedPrefixes: readonly string[] | undefined, options?: BashRestrictionOptions): BashAllowedPrefixesCheck;

package/dist/types/tools/bash-skill-urls.d.ts

@@ -16,6 +16,10 @@ export interface InternalUrlExpansionOptions {
  * Resolve a single skill:// URL to its absolute filesystem path.
  * Does NOT read file content or verify existence.
  */
+export declare function resolveSkillUrl(url: string, skills: readonly Skill[]): {
+    skill: Skill;
+    lexicalPath: string;
+};
 export declare function resolveSkillUrlToPath(url: string, skills: readonly Skill[]): string;
 /**
  * Expand all skill:// URIs in a bash command string.

package/dist/types/tools/bash.d.ts

@@ -7,6 +7,7 @@ import type { RenderResultOptions } from "../extensibility/custom-tools/types";
 import { type Theme } from "../modes/theme/theme";
 import { type SdkSpawnArgs } from "../sdk/cli/master-cli";
 import type { ToolSession } from ".";
+import { type AwaitingInputSignal } from "./awaiting-input";
 import { type OutputMeta } from "./output-meta";
 export { STEER_FOLD_GRACE_MS, steerFoldReasonLine } from "./steer-fold";
 export declare const BASH_DEFAULT_PREVIEW_LINES = 10;
@@ -91,6 +92,12 @@ export interface BashToolDetails {
     foldReason?: FoldReason;
     /** The accepted model-declared activity declaration, when the call carried one. */
     activity?: BashActivityDeclaration;
+    /**
+     * Set on a running (partial) update when the foreground command printed an
+     * interactive auth prompt and then went quiet. Carries only the prompt kind,
+     * never the URL or code.
+     */
+    awaitingInput?: AwaitingInputSignal;
     async?: {
         state: "running" | "completed" | "failed";
         jobId: string;

package/dist/types/tools/descriptors.d.ts

@@ -57,8 +57,14 @@ export declare class LazyAgentTool implements AgentTool<any, any, any> {
     constructor(descriptor: ToolDescriptor, materialized?: AgentTool<any, any, any>, loader?: () => ToolDescriptorLoadResult, session?: ToolSession);
     /** Clear a session-bound materialization after its owning session moves. */
     invalidateForSessionMove(expectedCwd?: string): void;
-    /** Materialize this facade for contract tests without exposing it in production dispatch. */
-    materializeForTests(): Promise<AgentTool<any, any, any>>;
+    /**
+     * Resolve the underlying implementation. Pre-dispatch hooks (TTSR `astCondition`
+     * matching) call this to read implementation-only members such as the matcher
+     * hooks before the first `execute` would otherwise load the tool.
+     * An arrow property (like `execute`) so session guard proxies can forward it
+     * without losing access to the private loader state.
+     */
+    readonly materialize: () => Promise<AgentTool<any, any, any>>;
     get name(): string;
     get description(): string;
     get parameters(): TSchema;
@@ -88,6 +94,11 @@ export declare class LazyAgentTool implements AgentTool<any, any, any> {
     get mergeCallAndResult(): boolean | undefined;
     get inline(): boolean | undefined;
     get mode(): any;
+    get matcherDigest(): ((args: unknown) => string | undefined) | undefined;
+    get matcherEntries(): ((args: unknown) => readonly {
+        path: string;
+        digest: string;
+    }[] | undefined) | undefined;
     readonly execute: AgentTool<any, any, any>["execute"];
 }
 export type EffectiveToolDiscoveryMode = "off" | "mcp-only" | "all";

package/dist/types/tools/fetch.d.ts

@@ -74,6 +74,12 @@ export declare const readUrlCacheTestHooks: {
     readonly retainedOutputChars: number;
     reset(): void;
 };
+/**
+ * Publish text at an explicit artifact path the way `ArtifactManager.save` does:
+ * a temp file opened with `O_NOFOLLOW` and mode 0600, then rename. A symlink is
+ * not followed. A pre-existing regular file is replaced, so mode 0644 is not kept.
+ */
+export declare function publishExplicitArtifactText(destination: string, text: string): Promise<void>;
 export declare function loadReadUrlCacheEntry(session: ToolSession, params: {
     path: string;
     raw?: boolean;

package/dist/types/tools/irc.d.ts

@@ -9,9 +9,11 @@
  * mirrors `/btw`: the recipient's current model, system prompt, and message
  * history are used to compute a reply without persisting it through the
  * normal stream path. After the reply is generated, both the incoming
- * message and the auto-reply are queued for injection into the recipient's
- * persisted history (deferred until the recipient is idle), so the model
- * sees the exchange on its next turn.
+ * message and the auto-reply are injected into the recipient's persisted
+ * history: an idle recipient gets them immediately, while a streaming recipient
+ * receives them at its next step boundary (the live run's next tool boundary)
+ * rather than at the end of its turn — an exchange admitted into a run that ends
+ * before that boundary is still appended to the outgoing session's history.
  *
  * This avoids the deadlock that arises when the recipient is blocked on a
  * long-running tool call: the side-channel call does not depend on the

package/dist/types/tools/tmux-self-injection-guard.d.ts

@@ -10,6 +10,8 @@ export type TmuxPaneResolver = (options: {
 export interface TmuxSelfInjectionOptions {
     env?: Record<string, string | undefined>;
     cwd?: string;
+    /** Effective Bash environment for locating shell-runner scripts; never used for tmux identity. */
+    executionEnv?: Record<string, string | undefined>;
     resolvePaneId?: TmuxPaneResolver;
 }
 export declare function checkTmuxSelfInjection(command: string, options?: TmuxSelfInjectionOptions, depth?: number): Promise<TmuxSelfInjectionResult>;

package/dist/types/tools/ultragoal-ask-guard.d.ts

@@ -11,5 +11,5 @@ export interface UltragoalAskGuardContext {
     sessionId?: string | null;
 }
 export declare function formatUltragoalAskBlockMessage(diagnostic: UltragoalAskBlockDiagnostic): string;
-export declare function assertUltragoalAskAllowed(cwd: string, context?: UltragoalAskGuardContext, agentDir?: string): Promise<void>;
+export declare function assertUltragoalAskAllowed(cwd: string, context?: UltragoalAskGuardContext, agentDir?: string, pendingQuestions?: unknown): Promise<void>;
 export declare function guardToolForUltragoalAsk<T extends AgentTool>(tool: T, getCwd: () => string, getContext?: () => UltragoalAskGuardContext, getSessionAgentDir?: () => string | undefined): T;

package/dist/types/tools/write.d.ts

@@ -37,6 +37,8 @@ export declare class WriteTool implements AgentTool<typeof writeSchema, WriteToo
     readonly concurrency = "exclusive";
     readonly loadMode = "discoverable";
     readonly summary = "Write content to a file (creates or overwrites)";
+    /** Stream matchers should see the real file content, not its JSON-escaped argument encoding. */
+    matcherDigest(args: unknown): string | undefined;
     constructor(session: ToolSession);
     execute(_toolCallId: string, { path, content }: WriteParams, signal?: AbortSignal, _onUpdate?: AgentToolUpdateCallback<WriteToolDetails>, context?: AgentToolContext): Promise<AgentToolResult<WriteToolDetails>>;
 }

package/dist/types/utils/file-mentions.d.ts

@@ -7,6 +7,11 @@ import type { AgentMessage } from "@gajae-code/agent-core";
 export declare const DEFAULT_FILE_MENTION_INLINE_BYTES: number;
 /** Extract all @filepath mentions from text */
 export declare function extractFileMentions(text: string): string[];
+/**
+ * Compare canonical Windows paths without folding directory names: individual
+ * directories can opt into case-sensitive names.
+ */
+export declare function isCanonicalWindowsPathWithin(root: string, candidate: string): boolean;
 /**
  * Generate a FileMentionMessage containing the contents of mentioned files.
  * Returns empty array if no files could be read.

package/dist/types/utils/image-limits.d.ts

@@ -0,0 +1,7 @@
+export declare const MAX_IMAGE_INPUT_BYTES: number;
+export declare const MAX_STAGED_PROMPT_IMAGES = 16;
+export declare const MAX_PASTED_IMAGE_SOURCE_BYTES: number;
+export declare const MAX_PASTED_IMAGE_OUTPUT_BYTES: number;
+export declare const MAX_PASTED_IMAGE_DIMENSION = 20000;
+export declare const MAX_PASTED_IMAGE_PIXELS = 40000000;
+export declare const MAX_PASTED_IMAGE_DECODED_BYTES: number;

package/dist/types/utils/image-loading.d.ts

@@ -1,5 +1,4 @@
 import type { ImageContent } from "@gajae-code/ai/core";
-export declare const MAX_IMAGE_INPUT_BYTES: number;
 export declare const SUPPORTED_INPUT_IMAGE_MIME_TYPES: Set<string>;
 export declare function rasterizeSvgInputBytes(inputBuffer: Uint8Array): Promise<Uint8Array>;
 export interface LoadImageInputOptions {

package/dist/types/utils/open.d.ts

@@ -1,2 +1 @@
-/** Open a URL or file path in the default browser/application. Best-effort, never throws. */
 export declare function openPath(urlOrPath: string): void;

package/dist/types/utils/pasted-image-loading.d.ts

@@ -1,10 +1,5 @@
 import type { ImageContent } from "@gajae-code/ai/core";
 import { type LoadedImageInput, transformImageInputBytes } from "./image-loading";
-export declare const MAX_PASTED_IMAGE_SOURCE_BYTES: number;
-export declare const MAX_PASTED_IMAGE_OUTPUT_BYTES: number;
-export declare const MAX_PASTED_IMAGE_DIMENSION = 20000;
-export declare const MAX_PASTED_IMAGE_PIXELS = 40000000;
-export declare const MAX_PASTED_IMAGE_DECODED_BYTES: number;
 export type PastedImageBatchErrorCode = "too-many" | "unsafe-path" | "unsupported-image" | "source-aggregate-too-large" | "output-aggregate-too-large" | "dimensions-too-large";
 export declare class PastedImageBatchError extends Error {
     readonly code: PastedImageBatchErrorCode;
@@ -23,6 +18,7 @@ export interface PastedImageLoadingDependencies {
     transformImageBytes?: typeof transformImageInputBytes;
 }
 export type PastedImageSourcePolicy = "confirmed" | "automatic-temp";
+export declare function isAnimatedImage(bytes: Buffer, mimeType: string): boolean | undefined;
 export interface LoadPastedImageBatchOptions {
     paths: readonly string[];
     autoResize: boolean;

package/dist/types/utils/prompt-suggestion.d.ts

@@ -1,6 +1,6 @@
 /**
- * Predict the user's likely next prompt after an agent turn using a smol,
- * fast model. Native GJC port of the ghost-text prompt-suggestion behavior
+ * Predict the user's likely next prompt after an agent turn with the `default`
+ * model role. Native GJC port of the ghost-text prompt-suggestion behavior
  * from Claude Code: the prediction renders as dim ghost text in the empty
  * composer and Tab accepts it.
  */

package/dist/types/utils/shell-snapshot.d.ts

@@ -1,3 +1,5 @@
+/** One POSIX shell word. Double quotes would still run `$()` and backticks. */
+export declare function quotePosixShell(value: string): string;
 interface ShellSnapshotCacheOptions {
     tempRoot: string;
     home: string | (() => string);

package/dist/types/utils/title-generator.d.ts

@@ -6,8 +6,17 @@ import type { Settings } from "../config/settings";
  * Build a bounded conversation digest for title regeneration. Regeneration
  * reads several messages so a throwaway first prompt can be corrected, while
  * the automatic first-message path intentionally uses only its initial input.
+ * `obfuscateText`, when set, runs on each kept message's full text before the
+ * per-message character cut so a secret cannot be split by that cut.
  */
-export declare function buildConversationTitleInput(messages: readonly AgentMessage[]): string | undefined;
+export declare function buildConversationTitleInput(messages: readonly AgentMessage[], obfuscateText?: (text: string) => string): string | undefined;
+/**
+ * Obfuscate the full title input, then truncate, then wrap.
+ * A secret that crosses the character cap is replaced before the cut, and the
+ * `<user-message>` fence stays outside the truncated body.
+ */
+export declare function prepareTitleOutboundText(firstMessage: string, obfuscateText?: (text: string) => string): string;
+export declare function titleInputObfuscator(settings: Settings, activeCwd?: string): Promise<((text: string) => string) | undefined>;
 /**
  * Generate a title for a session based on the provided user-message input.
  * Automatic titles pass the first user message; regeneration passes a bounded
@@ -15,15 +24,16 @@ export declare function buildConversationTitleInput(messages: readonly AgentMess
  *
  * @param firstMessage The first user message or bounded conversation digest
  * @param registry Model registry
- * @param settings Settings used to resolve the smol role
+ * @param settings Settings used to resolve the `default` model role
  * @param sessionId Optional session id for sticky API key selection
  * @param currentModel Current model (used to derive title model)
  * @param metadataResolver Optional resolver evaluated after credential selection
  *   to produce request metadata (e.g. user_id for session attribution). Using a
  *   resolver instead of a pre-evaluated value ensures the metadata's account_uuid
  *   reflects the credential actually selected for this request.
+ * @param activeCwd Active session cwd for project-scoped secret lookup.
  */
-export declare function generateSessionTitle(firstMessage: string, registry: ModelRegistry, settings: Settings, sessionId?: string, currentModel?: Model<Api>, metadataResolver?: (provider: string) => Record<string, unknown> | undefined): Promise<string | null>;
+export declare function generateSessionTitle(firstMessage: string, registry: ModelRegistry, settings: Settings, sessionId?: string, currentModel?: Model<Api>, metadataResolver?: (provider: string) => Record<string, unknown> | undefined, activeCwd?: string): Promise<string | null>;
 export declare function formatSessionTerminalTitle(sessionName: string | undefined, cwd?: string): string;
 /**
  * Set the terminal title using OSC 0 (sets both tab and window title). Unsupported terminals ignore it.

package/dist/types/web/search/providers/codex.d.ts

@@ -1,4 +1,4 @@
-import { type AuthStorage } from "@gajae-code/ai/core";
+import type { AuthStorage } from "@gajae-code/ai/core";
 import type { SearchResponse } from "../../../web/search/types";
 import type { SearchParams } from "./base";
 import { SearchProvider } from "./base";
@@ -14,12 +14,11 @@ export interface CodexSearchParams {
  * Executes a web search using OpenAI code provider's built-in web search tool.
  *
  * Default-model behavior:
- * - If `PI_CODEX_WEB_SEARCH_MODEL` is set, use it exactly once and surface any
- *   upstream error verbatim.
- * - Otherwise prefer ChatGPT-account-safe bundled defaults (GPT-5.5, GPT-5.4,
- *   GPT-5 code backend, …) and retry the next candidate only when OpenAI code backend returns the
- *   known 400 "model is not supported" family. This avoids selecting
- *   `gpt-5-codex-mini` first on ChatGPT accounts, which OpenAI rejects.
+ * - Use `GJC_OPENAI_CODE_WEB_SEARCH_MODEL` (then `PI_CODEX_WEB_SEARCH_MODEL`)
+ *   exactly once when configured and surface upstream errors without model retries.
+ * - Otherwise intersect current account discovery with GPT-6.1 Sol, then GPT-6 Luna.
+ *   Fail closed when discovery is unavailable or neither candidate is advertised.
+ *   Retry the next advertised candidate only for the known unsupported-model 400 family.
  */
 export declare function searchCodex(params: SearchParams): Promise<SearchResponse>;
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.18.12",
+	"version": "0.19.0",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -57,12 +57,12 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.18.12",
-		"@gajae-code/agent-core": "0.18.12",
-		"@gajae-code/ai": "0.18.12",
-		"@gajae-code/natives": "0.18.12",
-		"@gajae-code/tui": "0.18.12",
-		"@gajae-code/utils": "0.18.12",
+		"@gajae-code/stats": "0.19.0",
+		"@gajae-code/agent-core": "0.19.0",
+		"@gajae-code/ai": "0.19.0",
+		"@gajae-code/natives": "0.19.0",
+		"@gajae-code/tui": "0.19.0",
+		"@gajae-code/utils": "0.19.0",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",
@@ -91,7 +91,8 @@
 		"@babel/types": "^7.29.0",
 		"@types/babel__traverse": "^7.28.0",
 		"@types/bun": "^1.3.14",
-		"@types/ws": "^8.5.13"
+		"@types/ws": "^8.5.13",
+		"fast-check": "4.10.2"
 	},
 	"engines": {
 		"bun": ">=1.4.0"