@gajae-code/coding-agent 0.18.5 → 0.18.7

package/CHANGELOG.md

@@ -2,6 +2,146 @@
 
 ## [Unreleased]
 
+## [0.18.7] - 2026-10-04
+
+### Added
+
+- Resolve readonly target-directory settings snapshots with normalized values and fresh operation-local metadata reads, without changing parent settings or publishing global hooks.
+
+### Changed
+
+- Cut startup memory for the light CLI invocations by deferring the per-path modules out of the eager root command graph: peak RSS dropped from 32.4 MB to 27.7 MB for `--version` and from 32.7 MB to 28.0 MB for `--help`. The quick lane, the bash-shell guardian/supervisor/worker executors, the isolated shell, the tab-worker smoke probe and the fixture report now load only when their own path actually runs, so their behaviour, output and exit codes are unchanged.
+
+### Fixed
+
+- `session.resume` of a session whose detached-idle host already exited no longer fails with `EEXIST` on `<id>.lifecycle.ready.json`: the host revokes its own ready marker on graceful exit, and a launch retires the same id's leftover ready/marker pair when the recorded owner is proven exited (a live or unknown owner still wins) (#6261).
+
+- Settle active ACP prompts immediately when their SDK session host retires, while preserving prompts across same-generation attachment replacement instead of waiting for the inactivity watchdog.
+
+- Apply ACP thinking-level changes through the session control setter so reasoning effort updates the live session state and session config readback reflects the requested level.
+
+- ACP now rejects unsupported or unapplied thinking levels instead of reporting them as successful changes.
+
+- Session heartbeat checkpoints no longer starve the SDK broker discovery heartbeat while waiting on the session-index lock.
+
+- SDK broker readiness polling now uses the session-index change stamp instead of checkpointing live heartbeats and replaying the full index on every poll.
+
+- `gjc config set|get|list` (text and `--json`) no longer print the Slack app-level token `notifications.slack.appToken` verbatim. Secret detection for setting keys now treats any key segment ending in a secret word (`token`, `secret`, `password`, `passwd`, `pwd`, `credential(s)`) as secret instead of relying on a fixed list of camelCase prefixes, so it shows `<redacted>` like every other token setting. Token-budget settings such as `compaction.reserveTokens` stay visible.
+
+- Retry bare-default Codex overloads when the failed attempt contains only an empty unsigned thinking block.
+
+- `HINDSIGHT_RETAIN_EVERY_N_TURNS`, `HINDSIGHT_RECALL_MAX_TOKENS`, `HINDSIGHT_RECALL_CONTEXT_TURNS` and `HINDSIGHT_RECALL_MAX_QUERY_CHARS` now accept only plain non-negative digits. Malformed values such as `5turns`, `1e3`, `1.5` or `-3` fall back to the matching `hindsight.*` setting instead of being read by `parseInt` as 5, 1, 1 or -3. A negative `HINDSIGHT_RETAIN_EVERY_N_TURNS` previously made chunked retention send nothing.
+
+- Slack and Discord chat daemons no longer post every lean final answer twice. The host sends each turn frame on a positioned leg and a raw leg and drops the raw copy only for connections that negotiate `positioned_notification_effects_v1`; the chat daemons' session connections never did, and a lean final carries no `messageRef` to collapse the two copies onto one publication. Chat daemon session connections now negotiate positioned-only notification effects, while plain SDK observers such as `gjc sdk session tail` keep both surfaces.
+
+- Answer modern MCP roots requests without requiring an interactive input handler, while keeping actual elicitation fail-closed when user input is unavailable.
+- Connect supported MCP form requests to the session's user-input surface instead of failing before users can answer.
+
+- SDK MCP initialize now negotiates supported protocol versions and includes the coding-agent package version in `serverInfo`.
+
+- SSH hosts loaded from `ssh.json` no longer accept a malformed `port`. A string port must be plain digits and every port must be an integer from 1 to 65535, so `"22oops"`, `"+22"`, `2222.5`, `0` and `70000` are now dropped with an `Invalid port` warning (the host falls back to the default port) instead of being used as 22, 22, 2222.5, 0 and 70000.
+
+## [0.18.6] - 2026-10-03
+
+### Added
+
+- Explicit correlated active-turn steering through coordinator send_prompt, with operator guidance separating requested evidence, queued tasks, and verified consumption. Retargeting feedback to a new active turn requires a new idempotency key; admission still does not prove consumption.
+
+- `gjc sdk diagnostics broker` and the exported `observeExistingBroker` facade now report a real running broker: the broker publishes a startup-fixed diagnostic generation, build snapshot and protocol, and the observation reads the publication only through the approved read-only native lease, opens exactly one client connection with no reconnect attempts, and returns a frozen snapshot with no token, endpoint, path, pid or environment value. An observed result exits 0 and a typed unavailability exits 1.
+
+- `gjc sdk diagnostics broker`: a read-only broker observation route that can never start, ensure, retire, restart or recover a broker. This entry ships the inert public entry, grammar and bounded observation document; the observation reader is wired in the accompanying fragment.
+
+### Changed
+
+- Built-in Codex profiles no longer use GPT-6 Sol or GPT-5.6 Terra. Every role that used `openai-codex/gpt-6-sol` or `openai-codex/gpt-5.6-terra` now uses `openai-codex/gpt-6.1-sol` at the same reasoning effort, so `codex-medium` and `codex-pro` are GPT-6.1 Sol in every role. Affected profiles: `codex-medium`, `codex-pro`, `astra-lite`, `astra-default`, `astra-heavy`, `opus-codex`, `codex-opencodego`, and `fable-opus-codex`. Moving Terra roles onto Sol is an intentional tier change; the catalog price of GPT-6.1 Sol is equal to or below Terra's. The `gpt-6-sol` and `gpt-5.6-terra` catalog entries are unchanged for explicit selection (#6163).
+- `codex-eco` is now `codex-medium` with Sol lowered to `openai-codex/gpt-6-luna` at the same effort, so it uses GPT-6 Luna in every role. Its default, critic, and architect move from GPT-5.6 Terra to GPT-6 Luna (#6163).
+- Roles that moved off GPT-5.6 Terra now compact earlier. GJC forces the Codex GPT-5.6 family to a 372K context window, while GPT-6.1 Sol and GPT-6 Luna use 272K, the window the Codex backend reports for both families (#6163).
+- Installs that load a signed preset registry revision defining these profiles keep that registry binding (built-in, then registry, then user `models.yml`) until a registry revision carries this change (#6163).
+
+- The `gjc` entry module is now inert on import: entry metadata moved to the pure `@gajae-code/utils/cli-metadata` leaf (re-exported from `dirs`), and the effectful bootstrap (startup timing, stderr drainer, malloc re-exec, managed-owner admission, public dispatch, registry) moved to `cli-ordinary` which loads lazily for every non-diagnostics command with unchanged ordering.
+
+### Removed
+
+- Removed the `codex-sol61` built-in profile added in 0.18.2. A saved or requested `codex-sol61` now resolves to `codex-pro`, which differs in two roles: critic is `openai-codex/gpt-6.1-sol:max` instead of `:xhigh`, and architect is `openai-codex/gpt-6.1-sol:xhigh` instead of `openai-codex/gpt-6-astra:xhigh`. Define a custom `codex-sol61` profile in `models.yml` to keep the previous mapping; a user-defined profile takes precedence over the alias (#6163).
+
+### Fixed
+
+- The isolated bash shell supervisor no longer busy-spins while its shell is idle. It reaped adopted zombies by sweeping all of `/proc` every 25 ms without waiting for the previous sweep to finish, which kept each supervisor at about 160% CPU and tens of thousands of context switches per second even during `sleep`. Sweeps now run only on `SIGCHLD`, one at a time, so an idle supervisor stays near 0% CPU (#5972).
+
+- Run compound pipeline stages concurrently to prevent pipe-buffer deadlocks.
+- Join remaining pipeline stages when a stage wait returns an error.
+
+- ACP `session/new` now waits for the model to settle before building the response when `modelRoles.default` is configured but no `--model` is passed. This ensures the `model` config option is always present in the response, preventing ACP clients (like Paseo) from failing with `model_not_selected` on the first prompt when the session uses a configured default model.
+
+- Resuming a session with an unavailable pinned credential no longer aborts when the startup model profile probes that provider; credential failure is reported so the user can re-pin or select AUTO.
+- Resuming a session with an unavailable pinned credential now honors an explicit `--api-key` or a literal `models.yml` `apiKey` when restoring the saved model, the settings default, and extension-registered models, instead of reporting the pin unavailable. An `apiKeyEnv` key does not unblock the pin, because another stored api_key account could take precedence over it; without an explicit key the provider stays blocked until the user re-pins or selects AUTO.
+
+- Windows Telegram daemon stop and reload now wait for the owner-fenced cooperative control request before force escalation, and post-update recovery failures exit cleanly with actionable guidance instead of an uncaught exception (#6138).
+- Added an owner-fenced control wakeup for blocked Telegram polls and extended hard-termination cooperative grace before escalation (#6138).
+
+- A process dying between the POSIX lock-removal detach and payload scrub no longer wedges every subsequent launch with `FileLockAcquireError` ("blocked by abandoned removal transition"): the dead owner's `.lock.removing` transition is reclaimed through the identity-bound guarded removal, and a refused reclamation keeps contending and still reports the abandoned transition at exhaustion (#6253).
+
+- Allow a fresh ACP prompt to wait for a previously failed or cancelled turn to finish winding down before reporting a busy conflict.
+- Admit the next ACP prompt immediately after cancellation settles instead of requiring a retry.
+
+- Scope ACP SDK session-router attachments to sessions owned or being attached by that ACP connection, preventing foreign session hosts from being kept alive.
+
+- Sessions without explicit `retry.*` settings now auto-retry a content-free OpenAI Codex `server_error` / `internal_error` error event, the same way a content-free `server_is_overloaded` event is already retried. Attempts that produced visible output or tool content are still never retried.
+
+- Coordinator MCP: `GJC_COORDINATOR_MCP_ARTIFACT_BYTE_CAP`, `GJC_COORDINATOR_MCP_SESSION_IDLE_TTL_MS` and `GJC_COORDINATOR_MCP_SESSION_SWEEP_INTERVAL_MS` accept only plain decimal digits; values such as `64KB`, `1e6` or `1.5` now fall back to the default instead of being read as their leading digits (`64KB` used to set a 64-byte artifact cap).
+- `gjc setup hermes --artifact-byte-cap` rejects integers above `Number.MAX_SAFE_INTEGER` (for example `9007199254740992` or `1e21`), which it used to write in a form the coordinator then ignored, silently leaving the 64 KiB default in place.
+
+- Report out-of-scope Coordinator evidence paths as invalid input instead of service unavailability, without exposing denied paths. Clarify evidence-root restrictions in the Hermes operator guide.
+
+- Coordinator MCP tool arguments `timeout_ms`, `poll_interval_ms`, `limit` and `lines`, and the `GJC_COORDINATOR_MCP_PROMPT_ACK_TIMEOUT_MS` env value, no longer read a leading digit prefix. A string such as `1e4` or `5s` became a 1 ms or 5 ms wait, and a one-element array such as `[50]` was accepted as `50`; strings must now be plain decimal digits and non-numeric types fall back to the defaults.
+
+- `GJC_COORDINATOR_MCP_EVENT_WEBHOOK_TIMEOUT_MS` and `GJC_COORDINATOR_MCP_EVENT_WEBHOOK_MAX_ATTEMPTS` now accept only plain decimal digits. Values such as `1.5`, `1e4` or `10s` were read as their leading digits, shrinking the per-attempt timeout to 1 ms or the retry budget to a single attempt; they now fall back to the defaults.
+
+- Reject active deep-interview questions missing structured round metadata instead of accepting answers that cannot be recorded, and reject extra interview questions before prompting.
+- Reject empty and whitespace-only ask question bodies, including metadata-free extra questions, in deferred, loaded, and direct execution paths while preserving ordinary multi-question and free-text asks, including next-workflow choices after final-spec handoff.
+
+- Restore cache prefix extension across LLM requests by keeping volatile project context and untrusted MCP server instructions in `agent.state.messages` after they are sent, rather than removing them after each turn. This allows subsequent requests to properly reuse the cache prefix from previous requests, improving cache hit rates and reducing unnecessary re-computation. Volatile ephemeral messages are still excluded from persistent storage as intended. Fixes #6167.
+
+- Gate the statusless typed overload check on `managedOutcome` in `#handleRetryableError` to prevent hanging when a managed fallback chain encounters a transport 503 error followed by a typed Responses overload error. The fix ensures that on the agent_end path, the statusless overload check returns false to allow proper session termination handling instead of deadlocking. Fixes #6180.
+
+- `AgentSession.messages` no longer exposes request-scoped ephemeral messages (`volatile-project-context`, `untrusted-mcp-server-instructions`) that #6167 retains in `agent.state.messages` for prompt-cache prefix reuse. The cache prefix behavior is unchanged; the public view and everything built on it match the pre-#6167 transcript again, which fixes the red `dev` CI in the managed fallback attempt transaction test (#6191).
+
+- Bash commands with auto-background disabled no longer leave the foreground via the timeout fold timer after timing out.
+
+- Lifecycle ledger compaction now evicts only safe settled identities while retaining unbound close replay fences and retirement-source dependencies.
+
+- Context-usage and compaction token estimates count the request-scoped ephemeral messages (`volatile-project-context`, `untrusted-mcp-server-instructions`) that are retained in `agent.state.messages` for prompt-cache reuse. They are hidden from `AgentSession.messages`, so estimating over that public view undercounted the real provider request and could delay auto-compaction until the context window overflowed.
+
+- Recover abandoned parseable lock removal transitions when their owner is proven dead.
+
+- Let SDK steering reach the active worker despite an earlier ordinary ordered control, while waiting behind abort-and-prompt replacements and fencing to the exact runtime command/turn identity so stale feedback is rejected instead of delivered to a successor.
+
+- Return an empty observation for missing assistant text instead of a resource-loss error, including compatibility with older running SDK hosts.
+
+- Stubbed credential-pin methods in the login preset recommendation test mock (follow-up to #6025).
+
+- Keep managed replacement receipts owned by their exact publishing attempt until it settles, preventing concurrent sessions in one workspace from stealing active receipts and failing transcript persistence with `identity_mismatch`. Peer recovery of publisher-bound receipts requires positive owner-exit or PID-reuse evidence; orphan receipt identity checks and external transcript replacement guards remain intact.
+
+- Fixed the resident-cache GC reaping a *running* session's cache on Linux hosts with a slewed wall clock (WSL2 in particular), which replaced tool results with `[Session resident text blob missing: …]` placeholders and logged `Resident cache trust rejection … blob_create_failed ENOENT`. The owner lease recorded the process start from `ps -o lstart`, which procps renders as `btime + ticks` where `btime` is re-derived from the current wall clock minus uptime, so the same live process reported a start time that drifted (observed: 15 minutes over 11 hours) and the sweep read the drift as PID reuse. On Linux the lease now records the `/proc/<pid>/stat` start tick count scoped by the kernel `boot_id` (basis `linux-proc-ticks:<boot_id>`), which never moves for a live process; reuse is only proven when the basis matches, so leases written by older builds or another boot are never reaped while their PID is alive.
+
+- Broker observation refuses everything it cannot prove: a publication without the diagnostic capability is `unsupported` (never `absent` or malformed), only the canonical loopback endpoint with an in-range port is accepted, the broker answers only from an already-owned healthy publication, one monotonic budget covers the whole observation so an expired budget never opens a socket and a late answer is discarded, and malformed arguments raise a typed argument error instead of a fabricated observation.
+
+- The read-only diagnostic addon's trusted digest now travels with the addon through the release path: each build emits a provenance sidecar, consuming jobs rebuild the record from those sidecars against the version actually being shipped, and embedding plus platform-package staging refuse bytes that do not match it.
+
+- Reverted the 0.18.2 readiness-cutoff reaping (#6126) because it left hosts in `terminal_uncertain` under concurrent recovery (#6143); unregistered hosts terminated by a signal at readiness cutoff again report `terminal_uncertain` until the fix re-lands.
+
+- Coordinator MCP: a `GJC_COORDINATOR_MCP_SESSION_SWEEP_INTERVAL_MS` above `2147483647` (about 24.9 days) no longer makes the idle-session reaper sweep continuously. The interval was passed straight to `setTimeout`, which treats longer delays as 1 ms; it is now capped at the timer maximum.
+
+- `gjc ssh add --port` now rejects ports that are not plain digits (`"22oops"`, `"2222.5"`, `"+22"`, `"1e3"`) instead of silently saving the leading digits to `ssh.json`.
+
+- `gjc web-search --limit` now rejects `0` and negative values with an error instead of passing them to providers, where a negative limit silently dropped results from the end of the source list.
+
+- The `web_search` tool schema now declares `limit` and `num_search_results` as positive integers, so a model-supplied `0`, negative or fractional count is rejected at validation instead of reaching providers, where a negative count silently dropped sources from the end of the list.
+
+### Tests
+
+- Add regression test for issue #6004: Verify that after overflow auto-compaction without a continuation scheduled, the session remains usable for subsequent prompts. The test exercises the overflow path to ensure pending agent_end events do not block future prompt submissions (related to #6004).
+
 ## [0.18.5] - 2026-09-30
 
 ## [0.18.4] - 2026-09-30

package/dist/types/capability/types.d.ts

@@ -39,6 +39,8 @@ export interface LoadContext {
     repoRoot: string | null;
     /** Whether discovery must remain isolated to the supplied home boundary. */
     isolatedHome?: boolean;
+    /** Bypass lexical filesystem caches for this discovery operation. */
+    bypassCache?: boolean;
     /** Owning session settings for provider policy decisions. */
     settings?: Settings;
 }
@@ -104,6 +106,8 @@ export interface LoadOptions {
     includeDisabledProviders?: boolean;
     /** Explicit disabled extension IDs to apply instead of settings. */
     disabledExtensions?: string[];
+    /** Bypass lexical filesystem caches for this discovery operation. */
+    bypassCache?: boolean;
     /** Session settings whose provider policy applies to this load. */
     settings?: Settings;
     /** Internal: prevent explicit-home loads from consulting process-global policy. */

package/dist/types/cli-commands.d.ts

@@ -0,0 +1,10 @@
+import type { CommandEntry } from "@gajae-code/utils/cli";
+/**
+ * Public-family hooks kept available for private-worker tests without loading the
+ * full registry.
+ *
+ * This is the single shared array: the inert entry (`cli.ts`) and the ordinary
+ * dispatcher (`cli-ordinary.ts`) both re-export THIS object, so a test that
+ * mutates or injects an entry keeps affecting the dispatcher.
+ */
+export declare const commands: CommandEntry[];

package/dist/types/cli-ordinary.d.ts

@@ -0,0 +1,13 @@
+/** Ordinary CLI graph: everything the inert entry must not load eagerly.
+ *
+ * This module owns the effectful bootstrap (startup timing, stderr drainer,
+ * bash-shell worker protocol) plus the unchanged ordinary routing order:
+ * bash-shell workers -> darwin malloc re-exec -> internal smoke -> tmux owner
+ * isolation -> managed-owner supervisor/admission/recovery -> private sdk
+ * stderr drainer -> public family dispatch -> community app -> doctor worker /
+ * probe / cli -> full registry. `cli.ts` imports it lazily, only after argv has
+ * been proven not to be a `sdk diagnostics` observation. */
+import { commands } from "./cli-commands";
+export { commands };
+/** Run every non-diagnostics command with the original admission order. */
+export declare function runOrdinaryCli(argv: string[]): Promise<void>;

package/dist/types/cli.d.ts

@@ -1,6 +1,15 @@
 #!/usr/bin/env bun
-import type { CommandEntry } from "@gajae-code/utils/cli";
-/** Public-family hooks kept available for private-worker tests without loading the full registry. */
-export declare const commands: CommandEntry[];
+/** Inert CLI entry.
+ *
+ * `bin/gjc.js` imports THIS module, so anything statically imported here runs
+ * before argv is inspected. Keep it to pure metadata: the read-only
+ * `sdk diagnostics` observation route must not be able to resolve directories,
+ * consult NSS for a missing/ambiguous HOME, load the native addon, install
+ * runtime globals, re-exec for malloc env vars, run managed-owner admission or
+ * recovery, or touch the error-evidence store. Everything effectful lives in
+ * `./cli-ordinary`, which is imported lazily for every other command with its
+ * original ordering and admission semantics. */
+import { commands } from "./cli-commands";
+export { commands };
 /** Run the CLI with argv excluding process.argv prefix. */
 export declare function runCli(argv: string[]): Promise<void>;

package/dist/types/commands/contribution-prep.d.ts

@@ -3,9 +3,6 @@ export default class ContributionPrep extends Command {
     static description: string;
     static strict: boolean;
     static flags: {
-        "no-spawn": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
-            description: string;
-        };
         "source-session-id": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };

package/dist/types/commands/sdk.d.ts

@@ -132,6 +132,9 @@ export declare function runSessionHost(timing?: {
 export type SdkInternalArgv = {
     action: "broker-internal";
     agentDir: string;
+} | {
+    action: "broker-trampoline-internal";
+    agentDir: string;
 } | {
     action: "session-host-internal";
 } | {

package/dist/types/commands/update.d.ts

@@ -1,4 +1,5 @@
 import { Command } from "@gajae-code/utils/cli";
+export declare function runUpdateRecoveryCommand(recover?: () => Promise<void>): Promise<void>;
 export default class Update extends Command {
     static description: string;
     static flags: {

package/dist/types/config/model-profile-activation.d.ts

@@ -44,6 +44,7 @@ export interface PrepareModelProfileActivationOptions {
     session: ModelProfileActivationSession;
     modelRegistry: Pick<ModelRegistry, "getModelProfile" | "getModelProfiles" | "getAvailableModelProfileNames" | "getApiKeyForProvider" | "getAll" | "resolveCanonicalModel" | "getCanonicalVariants" | "getCanonicalId" | "isSelectorCircuitOpen"> & Partial<Pick<ModelRegistry, "getAvailable" | "getAvailableForProfileActivation" | "resolveModelByLookupAlias" | "lookupAliasExists" | "clearCanonicalVariant" | "seedCanonicalVariant" | "getSessionCanonicalVariant" | "restoreSessionCanonicalVariant" | "getConfiguredProviderIds" | "isKnownProvider">> & {
         getError?: ModelRegistry["getError"];
+        authStorage?: ModelRegistry["authStorage"];
     };
     settings: Pick<Settings, "get" | "getGlobal" | "getOverride">;
     profileName: string;
@@ -129,6 +130,24 @@ export declare class ModelProfileCredentialError extends Error {
     readonly role: string | undefined;
     constructor(profileLabel: string, providers: readonly string[], role?: string);
 }
+interface SessionPinRegistry {
+    authStorage?: {
+        hasRuntimeApiKey(provider: string): boolean;
+        hasLiteralConfigApiKey(provider: string, owner?: object): boolean;
+        hasSessionCredentialUnavailable(provider: string, scopeId?: string): boolean;
+    };
+    getAuthStorageOwner?(): object;
+}
+/**
+ * Whether an unavailable session credential pin blocks `provider`.
+ *
+ * Mirrors `AuthStorage.getApiKey` precedence: a runtime `--api-key` override or a literal
+ * `models.yml` `apiKey` registered for this registry's owner is resolved before the
+ * unavailable-pin marker, so either one keeps the provider usable. An `apiKeyEnv` key does
+ * not: `getApiKey` prefers another stored api_key account over it, which would silently
+ * retarget the unavailable pin.
+ */
+export declare function isSessionCredentialPinBlocking(registry: SessionPinRegistry, provider: string, sessionId: string | undefined): boolean;
 export declare function formatModelProfileCredentialError(profileLabel: string, providers: readonly string[]): string;
 export declare function formatModelProfileUnknownProviderError(profileLabel: string, providers: readonly string[]): string;
 /**

package/dist/types/config/settings.d.ts

@@ -179,6 +179,10 @@ export declare class Settings implements NotificationSettingsReader {
     flush(): Promise<void>;
     /** Like {@link flush}, but reports a durable save failure to the caller. */
     flushOrThrow(): Promise<void>;
+    /** Copy execution settings without reloading, persisting, or sharing mutable layers. */
+    snapshot(): Settings;
+    /** Resolve a retained execution's project layer without persistence or global hooks. */
+    snapshotForCwd(cwd: string): Promise<Settings>;
     cloneForCwd(cwd: string): Promise<Settings>;
     getStorage(): AgentStorage | null;
     /** Flush and close storage owned by an isolated settings scope. */

package/dist/types/coordinator-mcp/session-reaper.d.ts

@@ -19,6 +19,11 @@ export declare const DEFAULT_SESSION_IDLE_TTL_MS: number;
 export declare const DEFAULT_SESSION_SWEEP_INTERVAL_MS: number;
 export declare const MIN_SESSION_IDLE_TTL_MS = 60000;
 export declare const MIN_SESSION_SWEEP_INTERVAL_MS = 30000;
+/**
+ * Longest delay setTimeout honors. Bun, like Node, treats any larger delay as 1 ms,
+ * so an operator's very long sweep interval would otherwise re-sweep back to back.
+ */
+export declare const MAX_SESSION_SWEEP_INTERVAL_MS: number;
 /** After this many consecutive reap failures the session is force-evicted from the index. */
 export declare const MAX_REAP_FAILURES = 3;
 /** Minimal projection of a coordinator session the reaper needs to decide. */

package/dist/types/discovery/helpers.d.ts

@@ -93,8 +93,8 @@ export declare function getUserSkillScanDirs(home: string, userAgentDir?: string
  */
 export declare function getProjectPath(ctx: LoadContext, source: SourceId, subpath: string): string | null;
 /** Build the filesystem authority for a provider read. */
-export declare function getReadOptions(ctx: Pick<LoadContext, "home" | "isolatedHome" | "userAgentDir" | "homeIdentity" | "userAgentIdentity">, scope: ReadScope): ReadFileOptions | undefined;
-export declare function getReadOptionsForContainment(ctx: Pick<LoadContext, "home" | "isolatedHome" | "userAgentDir" | "homeIdentity" | "userAgentIdentity">, scope: ReadScope, containmentRoot?: string): Promise<ReadFileOptions | undefined>;
+export declare function getReadOptions(ctx: Pick<LoadContext, "home" | "isolatedHome" | "userAgentDir" | "homeIdentity" | "userAgentIdentity" | "bypassCache">, scope: ReadScope): ReadFileOptions | undefined;
+export declare function getReadOptionsForContainment(ctx: Pick<LoadContext, "home" | "isolatedHome" | "userAgentDir" | "homeIdentity" | "userAgentIdentity" | "bypassCache">, scope: ReadScope, containmentRoot?: string): Promise<ReadFileOptions | undefined>;
 /**
  * Create source metadata for an item.
  */

package/dist/types/edit/modes/replace.d.ts

@@ -1,8 +1,8 @@
 /**
  * Fuzzy matching utilities for the edit tool.
  *
- * Provides both character-level and line-level fuzzy matching with progressive
- * fallback strategies for finding text in files.
+ * Provides both character-level and line-level fuzzy matching with staged
+ * strategies for finding text in files.
  */
 import type { AgentToolResult } from "@gajae-code/agent-core";
 import * as z from "zod/v4";
@@ -92,7 +92,7 @@ export declare function findClosestSequenceMatch(lines: string[], pattern: strin
  */
 export declare function findContextLine(lines: string[], context: string, startFrom: number, options?: {
     allowFuzzy?: boolean;
-    skipFunctionFallback?: boolean;
+    skipParenRetry?: boolean;
 }): ContextLineResult;
 export declare const replaceEditEntrySchema: z.ZodObject<{
     old_text: z.ZodString;

package/dist/types/edit/streaming.d.ts

@@ -7,7 +7,7 @@
  * - compute unified diff previews for the in-flight args
  *   (`computeDiffPreview`), and
  * - render a text placeholder while no diff exists yet
- *   (`renderStreamingFallback`).
+ *   (`renderStreamingPlaceholder`).
  *
  * The shared renderer / `ToolExecutionComponent` consult the strategy via
  * the injected `editMode` rather than probing argument shape.
@@ -51,7 +51,7 @@ export interface EditStreamingStrategy<Args = unknown> {
      * Rendered inline while the diff hasn't been computed yet (or when the
      * compute returned `null` because args are still too partial).
      */
-    renderStreamingFallback(args: Args, uiTheme: Theme): string;
+    renderStreamingPlaceholder(args: Args, uiTheme: Theme): string;
 }
 export interface EditRequestTargetInventory {
     paths: string[];

package/dist/types/exec/bash-shell-supervisor.d.ts

@@ -1,4 +1,16 @@
+import type { EventEmitter } from "node:events";
 import { type BashShellWorkerResponse } from "./bash-shell-worker-protocol";
+/**
+ * Reap adopted zombies only when the kernel reports a child state change.
+ *
+ * As the Linux child subreaper, the supervisor inherits orphaned descendants
+ * and must reap them, but a full `/proc` sweep is expensive. Polling it on a
+ * short interval kept every idle supervisor busy (issue #5972), so sweeps are
+ * driven by SIGCHLD instead. At most one sweep runs at a time, and a SIGCHLD that
+ * arrives mid-sweep schedules exactly one follow-up so a zombie created after
+ * its `/proc` entry was passed is never missed. Returns the unsubscribe hook.
+ */
+export declare function startLinuxAdoptedZombieReaper(excludedPid: number | undefined, reap?: (excludedPid: number | undefined) => Promise<void>, signals?: Pick<EventEmitter, "on" | "off">): () => void;
 export declare function createUtf8LineDecoder(onLine: (line: string) => void, options?: {
     maxBufferedBytes?: number;
     onOverflow?: () => void;

package/dist/types/runtime-mcp/elicitation.d.ts

@@ -0,0 +1,12 @@
+import type { ExtensionUIContext } from "../extensibility/extensions/types";
+import type { AskAnswerSource } from "../tools";
+import type { MCPInputRequestHandler } from "./types";
+export interface MCPFormInputDependencies {
+    getUi(): {
+        ui?: Pick<ExtensionUIContext, "select" | "input">;
+        hasUI: boolean;
+    };
+    getAskAnswerSource(): AskAnswerSource | undefined;
+}
+/** Register on an owned manager; dependencies are resolved per call for late UI registration. */
+export declare function createMCPFormInputHandler(deps: MCPFormInputDependencies): MCPInputRequestHandler;

package/dist/types/sdk/broker/discovery.d.ts

@@ -36,6 +36,14 @@ export interface BrokerDiscovery {
     ownerId: string;
     pid: number;
     incarnation: string;
+    /**
+     * Public publication-incarnation id for diagnostic observation, fixed at startup.
+     * Absent on publications written before the capability existed; an observer then
+     * reports `unsupported` instead of synthesizing compatibility.
+     */
+    diagnosticGeneration?: string;
+    /** Diagnostic protocol the publisher answers; absent means no capability. */
+    diagnosticProtocol?: number;
     host: "127.0.0.1";
     port: number;
     url: string;

package/dist/types/sdk/broker/ensure.d.ts

@@ -139,6 +139,7 @@ interface BrokerOwner {
     stop(): Promise<void>;
     canReuse(discovery: BrokerDiscovery | null): boolean;
     markReady(discovery: BrokerDiscovery): boolean;
+    setTarget(pid: number, incarnation: string): void;
 }
 interface ReapTiming {
     gracefulMs: number;

package/dist/types/sdk/broker/lifecycle-ledger.d.ts

@@ -61,6 +61,8 @@ export interface LifecycleDurableEffectsReceipt {
 export interface LifecycleLedgerEntry {
     operationKey?: string;
     fingerprint?: string;
+    /** True only when a session.close request supplied immutable generation authority. */
+    closeAuthorityBound?: boolean;
     version: typeof SDK_STATE_VERSION;
     identity: string;
     requestHash: string;
@@ -158,12 +160,14 @@ export declare class LifecycleLedger {
     migrateIdentity(from: string, to: string, metadata: {
         operationKey: string;
         fingerprint: string;
+        closeAuthorityBound?: boolean;
     }): Promise<LifecycleLedgerEntry | undefined>;
     get warnings(): readonly string[];
     begin(identity: string, requestHash: string, metadata?: {
         operationKey?: string;
         fingerprint?: string;
         intendedSessionId?: string;
+        closeAuthorityBound?: boolean;
     }): Promise<BeginResult>;
     transition(identity: string, state: LifecycleState, fields?: Omit<Partial<LifecycleLedgerEntry>, "identity" | "requestHash" | "state" | "ts">): Promise<LifecycleLedgerEntry>;
     assertSupportedStateVersions(): Promise<void>;

package/dist/types/sdk/broker/lifecycle.d.ts

@@ -181,6 +181,15 @@ export declare function observeProcessForTest(pid: number, expectedIncarnation:
  * deliberately left untouched.
  */
 export declare function reapDeadLifecycleMarkers(root: string, limit?: number): Promise<number>;
+/**
+ * Retires one launch id's lifecycle marker pair after its recorded owner has
+ * exited. Unlike the bounded background sweep, this launch-local repair is
+ * not age-gated and does not require the ready sibling to contain the same
+ * effect marker: the primary marker is the owner authority for this id.
+ */
+type RetireExitedLifecycleMarkerPairHook = () => void | Promise<void>;
+export declare function retireExitedLifecycleMarkerPair(root: string, id: string): Promise<boolean>;
+export declare function retireExitedLifecycleMarkerPairForTest(root: string, id: string, afterObservation: RetireExitedLifecycleMarkerPairHook): Promise<boolean>;
 export declare function writeEffectMarker(root: string, id: string, marker: EffectMarker): Promise<void>;
 export declare class LifecycleReadinessCleanupError extends Error {
     constructor(cause: unknown);

package/dist/types/sdk/broker/runtime.d.ts

@@ -1,4 +1,4 @@
-export type SdkInternalAction = "broker-internal" | "session-host-internal" | "stderr-drain-internal";
+export type SdkInternalAction = "broker-internal" | "broker-trampoline-internal" | "session-host-internal" | "stderr-drain-internal";
 export type SdkInternalSpawnCommand = {
     kind: "bun-source";
     file: string;

package/dist/types/sdk/broker/task-artifact-owner-validation.d.ts

@@ -0,0 +1,55 @@
+import type { NativeExactUnlinkResult } from "@gajae-code/natives";
+import { type TaskArtifactOwnerDeletionEvidence, type TaskArtifactOwnerRetirementContinuation, type TaskArtifactOwnerRetirementOutcome, type TaskArtifactOwnerStorageContext } from "../../session/task-artifact-owner-codec";
+export type BrokerCleanupPhase = "artifacts" | "transcript" | "metadata" | "lifecycle";
+/** Exact owner-disposition wire shape. Evidence and continuation are supplied separately by cleanup replay. */
+export type BrokerTaskArtifactOwnerRetirementDisposition = {
+    readonly kind: "completed";
+    readonly nativeOutcome?: NativeExactUnlinkResult;
+} | {
+    readonly kind: "payload_retired";
+    readonly namespace: "retained";
+    readonly nativeOutcome: NativeExactUnlinkResult;
+} | {
+    readonly kind: "cleanup_pending";
+    readonly nativeOutcome?: NativeExactUnlinkResult;
+} | {
+    readonly kind: "uncertain";
+    readonly reason: string;
+    readonly nativeOutcome?: NativeExactUnlinkResult;
+};
+/** Owner-only projection of durable cleanup state accepted by the pure validator. */
+export interface BrokerTaskArtifactOwnerCleanupFields {
+    readonly taskArtifactOwnerDeletionEvidence?: unknown;
+    readonly taskArtifactOwnerRetirementContinuation?: unknown;
+    readonly taskArtifactOwnerRetirementOutcome?: unknown;
+    readonly taskArtifactOwnerPayloadRetired?: unknown;
+    readonly taskArtifactOwnerNamespaceRetained?: unknown;
+    readonly taskArtifactOwnerRetired?: unknown;
+    readonly taskArtifactOwnerTranscriptDeleted?: unknown;
+    readonly taskArtifactOwnerCleanupError?: unknown;
+}
+/** Fully decoded owner-only cleanup state for an authorized session and phase. */
+export interface BrokerTaskArtifactOwnerCleanupValidation {
+    readonly deletionEvidence?: TaskArtifactOwnerDeletionEvidence;
+    readonly retirementContinuation?: TaskArtifactOwnerRetirementContinuation;
+    readonly retirementOutcome?: TaskArtifactOwnerRetirementOutcome;
+    readonly payloadRetired?: true;
+    readonly namespaceRetained?: true;
+    readonly retired?: true;
+    readonly transcriptDeleted?: true;
+    readonly cleanupDiagnostic?: string;
+}
+/**
+ * Decode the owner-only wire disposition using its exact trusted evidence and continuation.
+ * A decoded `completed` value is historical DTO data, not proof of physical retirement or writer closure.
+ */
+export declare function parseBrokerTaskArtifactOwnerRetirementDisposition(value: unknown, context: TaskArtifactOwnerStorageContext, evidence: TaskArtifactOwnerDeletionEvidence, continuation: TaskArtifactOwnerRetirementContinuation | undefined): TaskArtifactOwnerRetirementOutcome;
+/** Project an already validated internal outcome to the exact broker wire disposition. */
+export declare function serializeBrokerTaskArtifactOwnerRetirementDisposition(outcome: TaskArtifactOwnerRetirementOutcome): BrokerTaskArtifactOwnerRetirementDisposition;
+/**
+ * Strictly decode the owner-field projection of cleanup state against trusted session, scope context, phase,
+ * and artifact-removal state. Empty/legacy owner fields decode to an empty result. A decoded completion
+ * remains historical data: any later effect must separately verify current physical absence, fresh scrub
+ * proof, native success and current owner-parent/side-path authority before it mutates storage or transcripts.
+ */
+export declare function decodeBrokerTaskArtifactOwnerCleanupFields(value: unknown, context: TaskArtifactOwnerStorageContext, expectedSessionId: string, phase: BrokerCleanupPhase, artifactsRemoved: boolean | undefined): BrokerTaskArtifactOwnerCleanupValidation;

package/dist/types/sdk/bus/telegram-daemon-contract.d.ts

@@ -292,7 +292,7 @@ export declare const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * Generation 193 gates streamed content on negotiated observer capabilities,
  * so existing owners are replaced before exposing the new observer path.
  */
-export declare const DAEMON_GENERATION = 199;
+export declare const DAEMON_GENERATION = 200;
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7
  * requires durable publication receipts and acknowledged attachment dispatch,

package/dist/types/sdk/bus/telegram-daemon.d.ts

@@ -9,6 +9,7 @@ import { type DaemonProcessReference } from "./telegram-daemon-control";
 import { type TelegramSetupPreflight } from "./telegram-setup";
 export { loadInstallationHostId, loadLegacyInstallationHostId, type MachineIdentityDeps, parseMacPlatformUuid, parseWindowsMachineGuid, } from "../../config/machine-identity";
 export { DAEMON_GENERATION, NOTIFICATION_EVENT_SCHEMA_VERSION, NOTIFICATION_PROTOCOL_VERSION, SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION, SERVING_EPOCH, TELEGRAM_TRANSPORT_GENERATION, } from "./telegram-daemon-contract";
+import { POSITIONED_NOTIFICATION_EFFECTS_CAPABILITY } from "../host/host";
 import { type AgentDirSessionLifecycleService } from "../lifecycle/client";
 import { type NotificationSubscription, type SessionRouterProviderDeps } from "../router/session-router";
 import { NotificationOperatorRuntime } from "./operator-runtime";
@@ -136,8 +137,8 @@ export declare const ASK_CONTROLS_CAPABILITY = "ask_controls_v1";
 export declare const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v2";
 /** Receive-only compatibility capability for pre-v2 hosts. */
 export declare const LEGACY_TOOL_ACTIVITY_CAPABILITY = "tool_activity_v1";
-/** Opts notification adapters into positioned-only delivery for matching live effects. */
-export declare const POSITIONED_NOTIFICATION_EFFECTS_CAPABILITY = "positioned_notification_effects_v1";
+/** Public `sdk/bus/telegram-daemon` path for the canonical `sdk/host` capability token. */
+export { POSITIONED_NOTIFICATION_EFFECTS_CAPABILITY };
 /**
  * File-lock options whose acquisition budget covers the full reload-reservation
  * critical section: the in-lock freshness poll plus the controller's
@@ -1181,4 +1182,5 @@ export declare class TelegramNotificationDaemon {
     run(): Promise<void>;
     /** True when a signal-driven stop or an owner-scoped control request asks the loop to exit. */
     private controlStopRequested;
+    private checkControlStopRequested;
 }

package/dist/types/sdk/cli/diagnostics-cli.d.ts

@@ -0,0 +1,18 @@
+/** Isolated `gjc sdk diagnostics` parser and renderer.
+ *
+ * Reached from the inert entry before any effectful branch, so this module must
+ * stay a pure leaf: no command registry, session CLI, runtime globals, managed
+ * owner admission, malloc guard, evidence publisher, broker client, directory
+ * resolver or logger import. Help and usage never resolve a root or open a file,
+ * and every outcome is a fixed bounded string with a fixed exit code.
+ *
+ * Observation itself must never start, ensure, retire, restart or recover a
+ * broker. The read-only observation facade (DESIGN §B3) is wired: `observe()`
+ * below routes to it and to nothing else, so this command can report only what a
+ * supporting broker publishes to the read-only reader. An unsupported runtime
+ * tuple, a missing or mismatched native artifact and an old broker without a
+ * published generation all still fail closed with the fixed `unsupported`
+ * outcome.
+ */
+/** Run `gjc sdk diagnostics <argv…>`; argv excludes the `sdk diagnostics` prefix. */
+export declare function runDiagnosticsCli(argv: readonly string[]): Promise<void>;