@gajae-code/coding-agent 0.19.1-nightly.20261022091658.40484287217.g789b4b74f150 → 0.19.2

package/CHANGELOG.md

@@ -2,6 +2,228 @@
 
 ## [Unreleased]
 
+## [0.19.2] - 2026-10-29
+
+## [0.19.1] - 2026-10-28
+
+### Added
+
+- GPT-6.1 Terra autorouting tier assignments (fast/medium rank 1, balanced/high rank 1). Prioritizes Terra over the legacy GPT-5.6 Terra (now rank 2).
+
+### Changed
+
+- Prompt suggestions (`promptSuggestions`) now follow the Codex TUI logic. After a turn that completes normally, an ephemeral turn on the session's own model, thinking level, system prompt, and full history sends Codex's prompt verbatim to predict the user's likely next message. Only a strict `{"suggestion": string | null}` reply that is one line of at most 240 characters is shown. Ghost text is hidden while you type, while a turn runs, or while an autocomplete popup is open. Tab on an empty composer accepts it and Esc dismisses it. A submission, a new turn, a session switch, or a 30-second deadline cancels the request. No suggestion is requested while messages are queued or a side chat is open. The previous `default`-role transcript summary, word-count heuristics, and system prompt are removed.
+- Unlike Codex's hidden thread fork, the suggestion turn runs with tools disabled and in a fresh provider session. It is marked as a maintenance call, so agent-level providers such as Devin refuse it.
+
+### Fixed
+
+- SDK broker spawn-claim mirror rows in the lifecycle ledger now carry `spawnAnchor: true`, so a mirror no longer turns into a fenced legacy row once its claim leaves the spawn-authority journal and stops blocking `session.create` and `session.close` with `legacy_lifecycle_ambiguous`. Mirrors written by older brokers stay fenced because nothing durable proves their origin; an operator can release them through `sdk/lifecycle-ledger.spawn-anchor-attestation.json` (see `docs/sdk-session-cli.md`). Genuine pre-index legacy rows stay fenced (#7143).
+
+- Collapsed Google Antigravity `/usage` rows by shared quota pool and preserved account email labels across live and cached usage views (#7267).
+- Kept accounts that report only one horizon of a quota pool in the sibling `/usage` row as `not reported` cells (unknown bar, `N% free · M not reported` aggregate, warning instead of a false `exhausted`) instead of dropping the column (#7267).
+
+- ACP session updates strip terminal control sequences from tool titles, raw tool arguments, and command text before they are sent to the client.
+
+- Preserve explicit TAR directory entries in the archive index, including empty directories, and keep the existing first duplicate file record's metadata consistent with its bytes.
+
+- `gjc auth-broker serve` re-reads the bearer token file on each request, so `token --regenerate` revokes the previous bearer while the broker is running.
+
+- `gjc auth-gateway serve` re-reads `auth-gateway.token` on each request, so `token --regenerate` retires the previous bearer without a restart.
+
+- Autoresearch setup and iterate prompts frame the active branch name so repository branch markup cannot close that slot.
+
+- The bisect tool now uses the same ACP and SDK permission gate as eval. Prompt mode asks before its shell predicate runs, and deny mode rejects it. Allow mode is unchanged.
+
+- Bisect tool results are framed as untrusted content when they enter the model, so a commit subject or diffstat cannot close that frame early.
+
+- The bisect predicate now refuses a tmux input verb aimed at this agent pane before each shell starts, including a script that changes at a checked-out commit. The same check refuses a shell runner whose PATH override is still an unresolved expansion; a static PATH is unchanged.
+
+- A broker discovery record is ignored when its url is not the owned loopback endpoint for that record's port.
+
+- A stalled discovery publication fsync/rename no longer keeps an SDK broker alive past its liveness deadline (`publication-liveness-timeout`, `max(60s, heartbeat TTL × 4)`). When that write blocks the JS thread, `gjc sdk broker run` is SIGKILLed (signal status 137, not exit 1), including when stderr cannot accept the diagnostic. While the event loop still runs, it still exits 1.
+
+- SDK broker startup fails when the publication-liveness watchdog cannot be armed, instead of staying up without that protection. The failed attempt releases its discovery file and lock. If the watchdog worker dies after startup, the broker exits with `publication-liveness-timeout` rather than keeping the publication unprotected.
+
+- Foreground `gjc sdk broker run` loads the publication-liveness watchdog from the bundled module. A `PI_COMPILED` value from the environment or a project `.env` cannot redirect that worker to a file in the repository. The project-root worker path is used only when the running module is inside a compiled binary.
+
+- A repository `.gjc/config.yml` or `.gjc/settings.json` can no longer set `clipboard.transport` or `clipboard.sshHost`, and a non-object `clipboard` value there cannot replace the user clipboard settings. User config and the clipboard CLI flags still can.
+
+- Code cells strip terminal control sequences from source bytes before rendering, so a file read cannot write OSC, CSI, or DCS to the operator terminal.
+
+- `gjc crash report` flattens a duplicate issue title and author to one display row before writing the candidate line.
+
+- The custom model preset wizard strips terminal control characters from the snapshot preview before drawing role selectors and providers.
+
+- Correct custom-provider setup recipes so both local and hosted examples pass configuration validation.
+
+- `debug` tool results are framed as untrusted content when they enter the model, so debugger and program text cannot close that frame early.
+
+- A repository `.gjc` config file can no longer clear or replace the operator `disabledExtensions` list, so an operator-disabled extension module stays unloaded. User config and runtime overrides still apply.
+
+- Discord inbound commands and component actions, including claims recovered at startup, are delivered only for actors listed in the global Discord notification config, and are ignored when the author is missing or not listed.
+
+- Discord nonce reconciliation binds a thread only when this bot authored the starter, the thread parent and owner are that bot's thread, and a history fallback matches the starter message rather than a later copy.
+
+- A repository `.gjc/config.yml` or `.gjc/settings.json` can no longer set `edit.blockAutoGenerated`, and a runtime override cannot flip it. The user config keeps that switch, so a project file cannot turn off the auto-generated file edit guard.
+
+- Hashline edit previews and ast-edit before/after lines are framed as untrusted content, so a repository line cannot close that frame early.
+
+- Coordinator event webhook delivery checks https destinations with the public HTTP guard before the POST.
+
+- File-lock acquisition now reaps same-host staging directories whose recorded process generation is dead, and removes empty or missing-info staging directories only when their names prove the local host and they exceed a 60-second grace period. Foreign-host and live-owner staging directories remain protected, while a rotating bounded scan prevents retained entries from starving later candidates.
+
+- Restore parenthesized two-argument literal read-only Perl `open` calls during planning, including escaped literal backslashes, while rejecting unscanned startup modules and imports that can override `open`, custom `open` suffix calls, unsupported handles, and unsafe or unparsed modes.
+
+- The GitHub tool view strips terminal control sequences from repository text before drawing it.
+
+- The Herdr sequence watermark is stored in the trusted agent directory, so a planted file in the shared temp directory is not adopted at startup.
+
+- A `<lock>.removing` left by a lock owner that stamped no host id, such as a broker killed mid-release just before an upgrade, no longer blocks a host-qualified lock like the SDK session index forever. Its remover record stays foreign while the transition could still be in progress. Once the record and every captured entry have been unchanged for the orphan adoption age, the recorded pid is checked locally and a dead remover's transition is adopted. Records from another host, and records naming a live process, are still never reclaimed.
+
+- Point the install guide's retry configuration example at the global settings file actually read by GJC.
+
+- The helpers GJC runs on its own while starting a session -- the `ps` process-identity probe behind file locks, launch-worktree reservations, the resident blob cache and `gjc harness`, the `tmux -V` multiplexer detection, the tmux window rename and its `git symbolic-ref` branch lookup, and the `lspci`/`wmic` GPU probe -- now start from the same filtered environment as the bash tool. Previously a repository `.env` declaring `LD_PRELOAD` (or another loader hook such as `LD_AUDIT` or `DYLD_INSERT_LIBRARIES`) made those helpers load a repository library as soon as `gjc` was launched in the checkout, before any prompt, including in the compiled binary.
+
+- Record a model in the recent-model (usage) order only after its selection succeeds: a model profile switch, TUI default model selection, or configuration reload that fails and rolls back (for example, to a CLI `--model` startup override) no longer records the failed pick or the restored model as a recent choice (follow-up to #6768).
+- Within a session, a model choice that a newer default model or profile selection overtook while its transaction was still finishing (for example, a configuration reload waiting on another session's model-catalog publication, or a profile switch still flushing settings) no longer records itself over the newer choice in the recent-model order. An automatic fallback switch, or a newer selection that fails and rolls back, does not suppress the completed choice.
+
+- SDK broker session heartbeat checkpoints now emit a rate-limited warning when all retries fail because observations are stale.
+
+- Missing or invalid `--owner-id` arguments to private notification-daemon entrypoints now report a usage error and exit 2 instead of recording a crash.
+
+- Lean notifications keep the final answer of a tool-using request when a queued background result settles a short follow-up in the same run; the idle message no longer pins the request's first tool-loop narration in its place (#4458). A completed turn whose tool calls the provider already resolved (Devin ACP display-only calls) still counts as a settled answer.
+
+- Lifecycle MCP server env and headers no longer run `!` shell commands or copy sensitive host values, including a sensitive header placeholder, when the lifecycle host loads that tools-only file. A caller-selected exact config stays trusted.
+
+- Lifecycle read-back no longer rejects its own settled terminal row because an unrelated identity's ledger row exceeds the JSON bounds. A cleanup receipt carrying an artifact snapshot larger than the 1024-element limit no longer makes every later lifecycle result unverifiable on that agent directory; rows for the requested identity, undecodable rows, and unsupported state versions still withhold proof.
+
+- Local `!` and `$` command output that enters model context is framed as untrusted content after the stored excerpt is already truncated.
+
+- The Windows machine-identity probe (`reg query ... MachineGuid`) now runs with `windowsHide`, so the console-less detached broker no longer flashes a visible terminal window each time it derives the ownership-lock host identity.
+
+- Markdown cells strip terminal control sequences from repository content before rendering, and keep a carriage return as a markdown line break.
+
+- Marketplace registry writes no longer follow a symlink or hard link at the predictable temporary path next to `installed_plugins.json` or `marketplaces.json`.
+
+- Exa and Websets tools/call failures no longer write tool arguments or echoed credential text into the rotating log.
+
+- MCP server initialize instructions are framed as untrusted content after the per-server length cut, so a server-supplied closer cannot end that frame early.
+
+- `/mcp resources`, prompts, notifications, reload errors, and the reconnect, enable, disable, unauth, and reauth status lines sanitize the server name before drawing it.
+
+- MCP resource update notifications frame the server-provided URI as untrusted content before the user turn.
+
+- Shared MCP pool keys include an API-key Authorization value, so one binding label cannot send another caller's token.
+
+- Mid-run context maintenance no longer ends the turn with `Context maintenance could not commit a compaction before the next model request.` on models whose window is below 300k (for example a 272k window) when compaction has nothing to summarize but the unchanged context still fits the window. The fit check now uses the configured reserve instead of the window-scaled reserve, which below the 300k ceiling equalled the threshold margin and made the #6813 fallback unreachable.
+
+- `gjc migrate` no longer follows a symlinked Claude Code instruction, settings, or skill file outside the home or project root being imported. A rootless Codex or OpenCode config whose final component is a symlink is still read.
+
+- `/model roles` and the `/model` status summary strip control characters from stored model selectors before they reach the terminal.
+
+- Native hook error logs are created as owner-only files and are not written through a symlink.
+
+- `config.patch` rejects notification binding paths before any settings write, so a generic patch cannot replace a Slack actor, a Slack or Discord destination, or a Telegram chat id.
+
+- Discord and Slack notification frames publish only their own string fields, and a replayed frame body is scrubbed again before the provider post, so prototype text is not sent. Ask choices and an explicit redact opt-out stay readable, including a Slack ask root posted after a lease wait.
+
+- Outbound secret obfuscation now covers string message content and unsigned thinking prose.
+
+- Pasted image paths trim trailing terminal newlines in one pass, so a paste that does not end in a newline cannot stall path parsing.
+
+- The agent settings pending-retirement marker is rewritten on its own descriptor at mode 0600 and is not created through a final-component symlink. A refused marker write leaves settings.json active.
+
+- ACP and SDK tool-approval titles and command text show control bytes visibly and keep the shell text that still executes, including inside an OSC sequence, before the 80-character title preview.
+
+- External editor saves of a non-local plan path stay inside the session directory, including absolute paths, `..`, and symlinks.
+
+- Inspect every imported Python `os.system` alias during planning, including repeated and continued import lists, so an unused alias cannot hide a later shell invocation. Keep inert comments and strings read-only while failing closed on unresolved alias calls.
+
+- Preserve the original CLI argument list while parsing inline option values so tmux relaunches do not add those values to the user's prompt.
+
+- Preserve the terminal startup fallback-model notice when the SDK session stream subscribes before the TUI, without replaying the notice to live extension observers.
+
+- Project-layer task.agentModelOverrides is ignored when the task tool starts a subagent. User config and runtime overrides still apply.
+
+- A project plugin registry entry whose install path resolves inside the directory that owns that registry is no longer loaded. Entries outside that directory, including the user plugin cache, still load. On a case-sensitive Windows directory, a path that differs only by case stays outside that directory.
+
+- A project agent no longer preloads bundled workflow skills into a task subagent.
+
+- Quick-lane file paths are scanned once, so a long slash-separated task that names no file cannot stall classification.
+
+- The read tool description normalizes truncation to schema members and receipt budgets to finite numbers before interpolation and KiB conversion, so a project settings file cannot place arbitrary text in the tool definition.
+
+- Memory phase 2 writes a rollout summary only when its file name stays lexically inside rollout_summaries, and still prunes existing summaries in that directory.
+
+- SDK broker startup failures now wait for the spawned broker to exit before reading its stderr log, preserving the final diagnostic alongside the typed startup error.
+
+- A session resumed in a new process (`--resume`/`--continue`) no longer has its first Telegram notifications silently suppressed. Every SDK host start now takes its event generation from a per-session authority in the agent directory instead of restarting at `1`: generations are strictly increasing and unique across host processes, with wall-clock time only as a floor, so the new process's `(generation, seq)` coordinates and notification publication ids can no longer collide with delivery receipts recorded for the previous process, and a host resumed after the system clock stepped backward still outranks the previous host in the session index and stays visible to Router consumers. The Telegram daemon resumes a stored replay cursor only within the host generation that produced it.
+
+- A repository `.gjc/config.yml` or `.gjc/settings.json` can no longer set `searxng.endpoint` or replace the user SearXNG settings with a non-object value, and a runtime override cannot replace the user endpoint. Web search keeps the user config endpoint, or `SEARXNG_ENDPOINT` when that value is unset.
+
+- Stop a session's coordinator state persistence from failing permanently with `terminal_persistence ... lock_owner_record_unprovenanced` when its `runtime-state.json.lock` owner record ends in zero-filled bytes. File-system filters such as cloud-sync placeholders, or crash recovery, can leave such a tail after an otherwise complete record. Owner records now ignore trailing NUL padding the same way they already ignore the writer's space padding. A NUL inside the record still fails closed.
+
+- The `/session` panel strips terminal control sequences from project append-only settings, LSP server labels, and MCP server names before drawing them.
+
+- An untouched settings or plugin text confirm keeps the stored string, an edit commits the submitted text, and plugin enum confirmation keeps the stored option.
+
+- `skill_discovery` frames the paged skill catalog as untrusted content, so a repository skill description or use condition cannot close that frame early.
+
+- The skill HUD drops ESC, BEL, and C1 bytes from skill, phase, summary, and chip text so a control sequence cannot be reassembled on the status row.
+
+- A repository skill body is fenced as untrusted content in the model prompt, an end tag inside that body stays escaped, and the body and host suffix are shortened before that fence so the saved prompt keeps its closing fence within the session text cap.
+
+- Skills chained with the `skill` tool now reach the model in the same turn. The tool sent the callee prompt as a plain custom message, which a busy session queues as a follow-up; follow-ups are only delivered once the agent stops, so the prompt arrived after the final answer and started an extra turn that re-ran the chained workflow. For example, an autoresearch mission that had already reached a verdict and been cleared was re-activated at `intake`, and its research-only guard then blocked every write for the rest of the session. The prompt is now steered in right after the tool result, and a prompt whose preparation finishes after the run was aborted is dropped instead of restarting the stopped run.
+
+- `gjc skills discover` text output strips terminal control characters from repository skill names, descriptions, paths, and use conditions before writing the row.
+
+- SSH tool descriptions encode host names and destinations from repository `ssh.json` and frame that host list, so a host name cannot insert a newline or sit in the trusted prompt.
+
+- `/ssh list` strips terminal control sequences from host name, host, username, and port before drawing them.
+
+- Streaming artifact output is published as mode 0600 without following a destination symlink, and an existing regular file is still updated when its parent directory is not writable.
+
+- Task subagents inherit the parent session's bash restriction profile and allowlist, and a child allowlist cannot widen that posture.
+
+- A tail-only tool-result cut keeps the opening untrusted-content tag on the retained tail when both the line budget and the byte budget have room for the tags, the trusted suffix, and one body line. A shortfall leaves the unfenced plain tail.
+
+- Task setup-failure summaries escape "<" before they enter the task synopsis, so a repository agent file cannot close that element.
+
+- Resuming a closed session (`--resume`/`--continue`) while the Telegram notification daemon keeps running opens a fresh forum topic and delivers notifications again. The `session_closed` tombstone now fences only the attachment that closed, not every later attachment for the same session id, and refused attachment recovery leaves a daemon warning instead of silently dropping the subscription.
+
+- Managed tmux sessions start from a Broker launched without a UTF-8 locale (launchd, cron, a service manager). The native tmux clients that managed-session creation, inspection, and mutation run and parse now pass `-u`. Before this, tmux replaced the tab separators in their replies with `_`, so creation failed with `gjc_tmux_owner_changed_after_create`, and non-ASCII workspace paths did not round-trip through the session state-file tag. psmux and interactive `attach-session` are unchanged.
+
+- `/todo` strips terminal control sequences from phase, task, and note text before drawing the list and the status lines that echo that text.
+
+- The /tools panel strips terminal control sequences from tool names and descriptions before placing them in the markdown table.
+
+- TTSR rule notifications strip terminal control sequences from the rule name, description, and body before drawing them.
+
+- TTSR interrupt and tool-reminder text encodes rule name, path, and reserved prompt tags before they are rendered into the model message.
+
+- Fixed ACP and SDK clients receiving no message or tool content for a turn they submitted to a session hosted by an interactive terminal; the turn ran and settled, but the client only saw its start and the prompt watchdog later expired. Folded background bash jobs are now published to those clients as well.
+
+- The confirmed operator terminal abort (`gjc sdk session raw control <id> --op turn.abort --json-input '{"mode":"terminal","operator":true}' --confirm --idempotency-key <key>`) now reaches TUI and direct CLI sessions, not only sessions the SDK broker launched. Such a host publishes a process-local random marker in its own endpoint registration in the broker-owned session index; the broker echoes exactly that marker and the runtime accepts only its own. The marker is stripped from `session list` and never appears in endpoint discovery or SDK responses. The stopped session's terminal now shows `Turn stopped by a remote operator.` (#7272).
+- An operator abort to a session whose host publishes no operator authority (a gjc that predates the operator route) now fails with `authorization_denied`, outcome `not-applied`, and diagnostic `sdk_operator_control_unsupported`, instead of `endpoint_stale` — which told callers to retry a request that cannot succeed (#7272).
+
+- Resolve Ultragoal's default integration bases using explicit local and remote branch refs so same-named tags cannot hide committed changes or provide a false baseline.
+
+- Let `gjc update` supersede a pre-promotion activation record left by a failed attempt at an older release instead of failing every later update with `activation_transaction_requires_reconciliation`. The record is superseded only while the installed binary is still the exact recorded baseline (issue #6096).
+
+- v1 session migration records each assigned entry id before choosing the next one, so two entries cannot share an id.
+
+- Vim edit results frame viewport and diff text as untrusted content, so a repository line cannot close that frame early.
+
+- The welcome screen strips terminal controls from LSP server names and file types before drawing them.
+
+- Workflow intent tracking is persisted only after the final prompt acceptance check and immediately before execution, so a prompt cancelled during admission, including at the durable-accept fence, no longer leaves a `workflow-intent-diff` entry for work that never started (#7138).
+
+- Worktree dependency install refuses a non-exact `packageManager` version before `bun x` can resolve it as a package alias.
+
+- Write tool previews strip terminal escapes before syntax highlighting, including when highlighting is off.
+
+- The yield tool frames repository output-schema text in its parameter schema after truncation, so that text is not tool-definition instructions.
+
 ## [0.19.0] - 2026-10-22
 
 ### Added

package/dist/types/capability/types.d.ts

@@ -127,6 +127,8 @@ export interface SourceMeta {
     path: string;
     /** Whether this came from user-level, project-level, or native config */
     level: "user" | "project" | "native";
+    /** Lifecycle host wrote this file. Caller-selected exact configs omit it. */
+    lifecycleOrigin?: boolean;
 }
 /**
  * Merged result from loading a capability across all providers.

package/dist/types/cli/public-command-errors.d.ts

@@ -78,6 +78,7 @@ export declare const PUBLIC_COMMAND_DIAGNOSTICS: {
     readonly sdk_resource_gone: "The requested resource is not available from this session endpoint; this reports absent resource state, not an empty result.";
     readonly sdk_unknown_operation: "The --op value is not a known SDK operation id for this command. Per-session control ids include turn.prompt, turn.steer, turn.follow_up, turn.abort and turn.abort_and_prompt.";
     readonly sdk_scope_requires_repository: "The selected session-list scope requires a Git repository. Run inside a checkout, pass --repo <path>, or use --scope cwd or --scope all.";
+    readonly sdk_operator_control_unsupported: "The session's host does not publish operator control authority, so the broker did not send the operator abort and nothing was stopped. The host likely runs a gjc release that predates operator control; restart that session with a current gjc. Retrying the same request will not succeed.";
     readonly router_cleanup_failed: "SDK session Router cleanup failed.";
     readonly broker_cleanup_failed: "SDK broker client cleanup failed.";
     readonly lifecycle_idempotency_conflict: "The broker reported an idempotency conflict. Reconcile existing lifecycle state before deciding whether another request is safe.";

package/dist/types/cli/skills-cli.d.ts

@@ -1,3 +1,4 @@
+import { type RuntimeSkillDiscoveryCandidate } from "../extensibility/runtime-skill-discovery";
 export type SkillsAction = "list" | "read" | "discover";
 export interface SkillsCommandArgs {
     action: SkillsAction;
@@ -12,4 +13,10 @@ export interface SkillsCommandArgs {
         query?: string;
     };
 }
+/**
+ * One discover text row. Repository name, description, path, and use conditions
+ * are flattened to a single line and stripped of terminal controls here, at the
+ * last step before stdout, so a skill file cannot inject a control sequence.
+ */
+export declare function formatCandidate(candidate: RuntimeSkillDiscoveryCandidate): string;
 export declare function runSkillsCommand(cmd: SkillsCommandArgs): Promise<void>;

package/dist/types/config/autorouting-tier-map.d.ts

@@ -67,11 +67,11 @@ export declare const CURATED_TIER_LABELS: {
     readonly "openai-codex/gpt-5.6-terra": readonly [{
         readonly tier: "fast";
         readonly effort: "low";
-        readonly rank: 1;
+        readonly rank: 2;
     }, {
         readonly tier: "balanced";
         readonly effort: "medium";
-        readonly rank: 1;
+        readonly rank: 2;
     }];
     readonly "openai-codex/gpt-6-sol": readonly [{
         readonly tier: "strong";
@@ -83,6 +83,15 @@ export declare const CURATED_TIER_LABELS: {
         readonly effort: "high";
         readonly rank: 2;
     }];
+    readonly "openai-codex/gpt-6.1-terra": readonly [{
+        readonly tier: "fast";
+        readonly effort: "medium";
+        readonly rank: 1;
+    }, {
+        readonly tier: "balanced";
+        readonly effort: "high";
+        readonly rank: 1;
+    }];
     readonly "google/gemini-3.5-flash-lite": readonly [{
         readonly tier: "fast";
         readonly rank: 1;
@@ -18169,6 +18178,9 @@ export declare const TIER_MAP_SKIP_LIST: {
     readonly "github-copilot/gpt-6.1-sol": {
         readonly rationale: "models.dev refresh addition; not yet curated";
     };
+    readonly "github-copilot/gpt-6.1-terra": {
+        readonly rationale: "models.dev refresh addition; not yet curated";
+    };
     readonly "kilo/aion-labs/aion-3.5": {
         readonly rationale: "models.dev refresh addition; not yet curated";
     };
@@ -18202,6 +18214,12 @@ export declare const TIER_MAP_SKIP_LIST: {
     readonly "kilo/openai/gpt-6.1-sol-pro": {
         readonly rationale: "models.dev refresh addition; not yet curated";
     };
+    readonly "kilo/openai/gpt-6.1-terra": {
+        readonly rationale: "models.dev refresh addition; not yet curated";
+    };
+    readonly "kilo/openai/gpt-6.1-terra-pro": {
+        readonly rationale: "models.dev refresh addition; not yet curated";
+    };
     readonly "kilo/perceptron/perceptron-mk1.5": {
         readonly rationale: "models.dev refresh addition; not yet curated";
     };
@@ -18238,6 +18256,9 @@ export declare const TIER_MAP_SKIP_LIST: {
     readonly "openai/gpt-6.1-sol": {
         readonly rationale: "models.dev refresh addition; not yet curated";
     };
+    readonly "openai/gpt-6.1-terra": {
+        readonly rationale: "models.dev refresh addition; not yet curated";
+    };
     readonly "openai/gpt-daybreak-blue-latest": {
         readonly rationale: "models.dev refresh addition; not yet curated";
     };
@@ -18328,6 +18349,18 @@ export declare const TIER_MAP_SKIP_LIST: {
     readonly "openrouter/openai/gpt-6.1-sol-pro": {
         readonly rationale: "models.dev refresh addition; not yet curated";
     };
+    readonly "openrouter/openai/gpt-6.1-terra": {
+        readonly rationale: "models.dev refresh addition; not yet curated";
+    };
+    readonly "openrouter/openai/gpt-6.1-terra:batch": {
+        readonly rationale: "models.dev refresh addition; not yet curated";
+    };
+    readonly "openrouter/openai/gpt-6.1-terra-pro": {
+        readonly rationale: "models.dev refresh addition; not yet curated";
+    };
+    readonly "openrouter/openai/gpt-6.1-terra-pro:batch": {
+        readonly rationale: "models.dev refresh addition; not yet curated";
+    };
     readonly "openrouter/openai/gpt-oss-120b:batch": {
         readonly rationale: "models.dev refresh addition; not yet curated";
     };
@@ -18412,6 +18445,12 @@ export declare const TIER_MAP_SKIP_LIST: {
     readonly "vercel-ai-gateway/openai/gpt-6.1-sol-fast": {
         readonly rationale: "models.dev refresh addition; not yet curated";
     };
+    readonly "vercel-ai-gateway/openai/gpt-6.1-terra": {
+        readonly rationale: "models.dev refresh addition; not yet curated";
+    };
+    readonly "vercel-ai-gateway/openai/gpt-6.1-terra-fast": {
+        readonly rationale: "models.dev refresh addition; not yet curated";
+    };
     readonly "zenmux/anthropic/claude-fable-5.1": {
         readonly rationale: "models.dev refresh addition; not yet curated";
     };

package/dist/types/config/file-lock.d.ts

@@ -236,9 +236,9 @@ export interface FileLockStagingResult {
     reason: string;
 }
 /** Observe identity before probing; neither a replacement nor a symlink inherits the verdict. */
-export declare function inspectFileLockStagingDir(stagingPath: string, probe?: (pid: number) => OwnerLiveness, remove?: boolean): Promise<FileLockStagingResult>;
+export declare function inspectFileLockStagingDir(stagingPath: string, probe?: (pid: number) => OwnerLiveness, remove?: boolean, ownerHostId?: string, previousOwnerHostIds?: readonly string[]): Promise<FileLockStagingResult>;
 /** Bounded opportunistic cleanup; the acquisition caller treats failures as diagnostic only. */
-export declare function reapOrphanedLockStagingDirs(lockPath: string): Promise<{
+export declare function reapOrphanedLockStagingDirs(lockPath: string, options?: Pick<FileLockOptions, "ownerHostId" | "previousOwnerHostIds">): Promise<{
     removed: string[];
     retained: FileLockStagingResult[];
 }>;

package/dist/types/config/model-profile-activation.d.ts

@@ -50,6 +50,8 @@ type ModelProfileActivationSession = Pick<AgentSession, "model" | "thinkingLevel
     getDefaultFallbackRuntimeState?: () => DefaultFallbackRuntimeState;
     restoreDefaultFallbackRuntimeState?: (state: DefaultFallbackRuntimeState) => void;
     restoreModelSelectionForRollback?: AgentSession["restoreModelSelectionForRollback"];
+    beginModelSelectionUsage?: AgentSession["beginModelSelectionUsage"];
+    recordModelSelectionUsage?: AgentSession["recordModelSelectionUsage"];
     prepareModelSelectionForProfileActivation?: AgentSession["prepareModelSelectionForProfileActivation"];
     commitPreparedProfileModelSelection?: AgentSession["commitPreparedProfileModelSelection"];
     finishPreparedProfileModelSelection?: AgentSession["finishPreparedProfileModelSelection"];
@@ -131,6 +133,8 @@ export interface PreparedModelProfileActivation {
     preparedDefaultModelSelection: Awaited<ReturnType<NonNullable<ModelProfileActivationSession["prepareModelSelectionForProfileActivation"]>>> | undefined;
     defaultChainPublished: boolean;
     defaultModelPublished: boolean;
+    /** MRU order slot claimed when the reload publication committed the profile DEFAULT. */
+    defaultModelPublishedUsageSequence?: number;
     publishedState: PublishedModelProfileActivationState | undefined;
     previousDefaultFallbackRuntimeState: DefaultFallbackRuntimeState | undefined;
     defaultModel: Model<Api> | undefined;
@@ -318,6 +322,13 @@ export declare function rewriteSelectorForProxy(selector: string, proxyProvider:
 export declare function prepareModelProfileActivation(options: PrepareModelProfileActivationOptions): Promise<PreparedModelProfileActivation>;
 /** Publish the prepared model selection and role layer without awaiting. */
 export declare function publishPreparedModelProfileActivation(prepared: PreparedModelProfileActivation, options?: Pick<ApplyModelProfileActivationOptions, "preserveDefaultModelSelection" | "preserveLiveModelSelection">): void;
+/**
+ * Record a published profile DEFAULT in the model usage order. Call synchronously
+ * once the enclosing publication finalized, before any await: a user selection
+ * made while a later step (such as a consumer lease) is pending must stay the
+ * most recent usage instead of being overtaken by this older profile choice.
+ */
+export declare function recordPublishedModelProfileActivationUsage(prepared: PreparedModelProfileActivation): void;
 export declare function finishPreparedModelProfileActivation(prepared: PreparedModelProfileActivation): Promise<void>;
 export declare function applyPreparedModelProfileActivation(prepared: PreparedModelProfileActivation, options?: ApplyModelProfileActivationOptions): Promise<void>;
 /** Restore an applied activation when its enclosing settings/registry commit fails. */

package/dist/types/config/settings-schema.d.ts

@@ -1908,7 +1908,7 @@ export declare const SETTINGS_SCHEMA: {
         readonly ui: {
             readonly tab: "interaction";
             readonly label: "Prompt Suggestions";
-            readonly description: "Predict your likely next prompt after each turn (one extra default-role model call) and show it as ghost text; Tab accepts";
+            readonly description: "Predict your likely next message after each completed turn (one extra call to the session model with the full conversation) and show it as ghost text; Tab accepts, Esc dismisses";
         };
     };
     readonly "startup.quiet": {

package/dist/types/coordinator-mcp/event-webhook.d.ts

@@ -1,3 +1,4 @@
+import { type AddressResolver } from "../web/insane/url-guard";
 /**
  * Opt-in webhook delivery of existing coordinator `watch_events` journal rows
  * (issue #4706). Delivery is a durable outbox keyed by the journal row's stable
@@ -31,11 +32,14 @@ export interface WebhookDelivery {
     now(): number;
 }
 /** Default `WebhookDelivery` over `fetch`: POST, 2xx = ok, no redirects, abort on timeout. */
-export declare function createDefaultEventWebhookDelivery(): WebhookDelivery;
+export declare function createDefaultEventWebhookDelivery(hooks?: {
+    resolver?: AddressResolver;
+}): WebhookDelivery;
 export declare const DEFAULT_EVENT_WEBHOOK_TIMEOUT_MS = 5000;
 export declare const MAX_EVENT_WEBHOOK_TIMEOUT_MS = 30000;
 export declare const DEFAULT_EVENT_WEBHOOK_MAX_ATTEMPTS = 5;
 export declare const MAX_EVENT_WEBHOOK_MAX_ATTEMPTS = 10;
+export declare function isLoopbackHttpWebhook(rawUrl: string): boolean;
 export declare function parseEventWebhookConfig(explicitEnv?: NodeJS.ProcessEnv): EventWebhookConfig | null;
 /**
  * Records the row in the durable outbox and, unless the row is already

package/dist/types/crash/record-loader.d.ts

@@ -5,8 +5,8 @@
  * is explicitly **not** a parseable database. The field corpus contains at least
  * one interleaved record (two headers merged onto one line), and throwable text
  * is arbitrary multiline content. Recovery therefore trusts only a complete
- * v1 record whose terminal identity line matches a fingerprint recomputed from
- * that record's own header and stack.
+ * record whose terminal identity line matches a fingerprint recomputed from
+ * that record's own header and stack using the marker's supported version.
  *
  * Records written before that line existed are `unmatchable` and are never
  * offered for reporting — no retroactive mining is attempted or claimed.
@@ -26,7 +26,7 @@ export interface LoadedCrashRecord {
     readonly provenance?: CrashProvenance;
 }
 export declare function parseCrashRecords(contents: string): LoadedCrashRecord[];
-/** Complete v1 records whose marker fingerprint is recomputed from their diagnostic text. */
+/** Complete records with supported marker versions and fingerprints recomputed from their diagnostic text. */
 export declare function parseRecoverableCrashRecords(contents: string): LoadedCrashRecord[];
 /** Newest identity-bearing record for a fingerprint, or `undefined` when unmatchable. */
 export declare function findLatestRecord(contents: string, fingerprint: string): LoadedCrashRecord | undefined;

package/dist/types/crash/upstream/envelope.d.ts

@@ -6,6 +6,7 @@ export interface CrashEventFrame {
 export interface BuildCrashEnvelopeInput {
     readonly eventId: string;
     readonly fingerprint: string;
+    readonly fpv: number;
     readonly errorName: string;
     readonly messageClass: string;
     readonly frames: readonly CrashEventFrame[];

package/dist/types/discovery/helpers.d.ts

@@ -315,6 +315,11 @@ export declare function canonicalizePathWithinHome(ctx: Pick<LoadContext, "home"
  * an ordinary load may contain external install roots that an isolated load
  * must reject, and reusing that result would cross the home boundary.
  */
+/** Reject install paths inside the registry owner's tree. Windows components use the parent directory's case rule. */
+export declare function projectRegistryInstallPathIsInsideAnchor(projectAnchor: string, installPath: string, options?: {
+    platform?: NodeJS.Platform;
+    sensitivity?: (directory: string) => boolean;
+}): boolean;
 export declare function listClaudePluginRoots(home: string, cwd?: string, isolatedHome?: boolean, homeIdentity?: FileIdentity): Promise<{
     roots: ClaudePluginRoot[];
     warnings: string[];

package/dist/types/extensibility/extensions/types.d.ts

@@ -344,7 +344,7 @@ export interface ExtensionContext {
     getProjectProgress?(): Promise<ProjectProgressSnapshot>;
     /** Subscribe to foreground-wait folds (`bash_folded`). Returns an unsubscribe function. */
     onJobFold?(listener: (event: JobFoldEvent) => void): () => void;
-    /** Observe session events synchronously in producer order. Returns an unsubscribe function. */
+    /** Observe live session events synchronously in producer order, without consuming queued startup fallback notices. */
     onSessionEvent?(listener: AgentSessionEventListener): () => void;
     /** Typed skill and mode controls exposed to the SDK host. */
     invokeSkill?(name: string, args?: string, options?: {

package/dist/types/extensibility/plugins/marketplace/registry.d.ts

@@ -8,8 +8,10 @@
  * Read/write functions accept explicit file paths so callers control the
  * location. Path helpers compute the default paths from the dir singleton.
  *
- * Both use atomic write (tmp + rename). On Windows, rename over existing file
- * can fail with EPERM — fallback: unlink target then rename.
+ * Both use atomic write (exclusive tmp + rename). A symlink, hard link, or
+ * other non-directory at the temp path is removed, not followed. On Windows,
+ * rename over an existing file can fail with EPERM — fallback: unlink target
+ * then rename.
  */
 import type { InstalledPluginEntry, InstalledPluginsRegistry, MarketplaceRegistryEntry, MarketplacesRegistry } from "./types";
 export declare function getMarketplacesRegistryPath(): string;

package/dist/types/extensibility/skills.d.ts

@@ -94,4 +94,12 @@ export interface ParsedSkillInvocation {
 }
 export declare function parseSkillInvocations(text: string, skillsByCommandName: ReadonlyMap<string, Skill>): ParsedSkillInvocation[];
 export declare function resolveSkillSlashCommands(skills: readonly Skill[], _reservedDirectCommandNames: ReadonlySet<string>): ResolvedSkillSlashCommand[];
+/**
+ * Reserve the fence inside `cap`, then keep the body and host suffix.
+ * The attacker-sized body is bounded before `wrapUntrustedContent` runs once.
+ */
+export declare function frameSkillPromptWithinCap(body: string, suffix: string, cap?: number): {
+    message: string;
+    retained: string;
+};
 export declare function buildSkillPromptMessage(skill: Pick<Skill, "name" | "filePath" | "content" | "loadContent">, args: string, context?: BuildSkillPromptMessageContext): Promise<BuiltSkillPromptMessage>;

package/dist/types/memories/index.d.ts

@@ -25,6 +25,8 @@ export declare function clearMemoryData(agentDir: string, cwd: string): Promise<
  * Force-enqueue global consolidation maintenance work.
  */
 export declare function enqueueMemoryConsolidation(agentDir: string, cwd: string, sourceUpdatedAt?: number): void;
+/** Test seam for the rollout summary path gate. */
+export declare function rolloutSummaryDestinationForTesting(summariesDir: string, threadId: string, rolloutSlug: string | null): string | undefined;
 /** Secret scrubbing applied to every phase-2 consolidation output. Test seam. */
 export declare function redactMemorySecretsForTesting(input: string): string;
 export declare function getMemoryRoot(agentDir: string, cwd: string): string;

package/dist/types/migrate/adapters/index.d.ts

@@ -12,13 +12,15 @@ export interface Adapter {
     collect(options: AdapterOptions): Promise<AdapterResult>;
 }
 export declare function getAdapter(source: MigrateSource): Adapter;
+/** Lexical containment after `path.resolve`. Symlink checks are separate. */
+export declare function migrateSourceInsideRoot(root: string, target: string): boolean;
 /** Collect one source instruction file without interpreting or rewriting its content. */
-export declare function collectInstructionFile(filePath: string, source: MigrateSource): Promise<{
+export declare function collectInstructionFile(filePath: string, source: MigrateSource, root?: string): Promise<{
     candidates: InstructionCandidate[];
     diagnostics: SourceDiagnostic[];
 }>;
 /** Read a text file, classifying absence/IO errors into source diagnostics. */
-export declare function readSourceText(filePath: string, source: MigrateSource, type: SourceDiagnostic["type"]): Promise<{
+export declare function readSourceText(filePath: string, source: MigrateSource, type: SourceDiagnostic["type"], root?: string): Promise<{
     text: string;
 } | {
     diagnostic: SourceDiagnostic;
@@ -27,7 +29,7 @@ export declare function readSourceText(filePath: string, source: MigrateSource,
  * Read an optional settings file. A missing file is expected (most setups do not
  * have every settings file), so unlike `readSourceText` it produces no diagnostic.
  */
-export declare function readOptionalJson(filePath: string, source: MigrateSource, type: SourceDiagnostic["type"]): Promise<{
+export declare function readOptionalJson(filePath: string, source: MigrateSource, type: SourceDiagnostic["type"], root?: string): Promise<{
     data: Record<string, unknown>;
 } | {
     diagnostic: SourceDiagnostic;
@@ -44,7 +46,7 @@ export declare function parseSourceJson(text: string, filePath: string, source:
  * Collect skill candidates from a directory of `<name>/SKILL.md` entries.
  * A missing directory yields a `skipped_absent_source` diagnostic.
  */
-export declare function collectSkillDir(dir: string, source: MigrateSource): Promise<{
+export declare function collectSkillDir(dir: string, source: MigrateSource, root?: string): Promise<{
     candidates: SkillCandidate[];
     diagnostics: SourceDiagnostic[];
 }>;
@@ -62,7 +64,7 @@ export declare const PROTECTED_AGENT_NAMES: ReadonlySet<string>;
  * rewritten so the loaded name matches the destination file name, and tool lists
  * are translated to GJC tools.
  */
-export declare function collectMarkdownAgents(dir: string, source: MigrateSource): Promise<{
+export declare function collectMarkdownAgents(dir: string, source: MigrateSource, root?: string): Promise<{
     candidates: AgentCandidate[];
     diagnostics: SourceDiagnostic[];
 }>;
@@ -72,6 +74,7 @@ export declare function collectMarkdownAgents(dir: string, source: MigrateSource
  */
 export declare function collectMarkdownCommands(dir: string, source: MigrateSource, options?: {
     recursive?: boolean;
+    root?: string;
 }): Promise<{
     candidates: SlashCommandCandidate[];
     diagnostics: SourceDiagnostic[];

package/dist/types/modes/components/oauth-selector.d.ts

@@ -7,6 +7,7 @@ export interface OAuthSelectorAccountOptions {
     onAccountSelect?: (selector: AuthCredentialSelector) => void | Promise<void>;
     onAutoSelect?: () => void | Promise<void>;
     onAddAccount?: () => void | Promise<void>;
+    onReloginAccount?: (id: number) => void | Promise<void>;
     onAccountRemove?: (targets: readonly CredentialRemovalTarget[]) => void | Promise<void>;
 }
 /** Component that renders an OAuth provider selector or a provider-scoped account selector. */

package/dist/types/modes/components/plugin-settings.d.ts

@@ -7,9 +7,9 @@
  *     - Feature toggles
  *     - Config value editor
  */
-import { Container } from "@gajae-code/tui";
+import { Container, type SettingItem } from "@gajae-code/tui";
 import { PluginManager } from "../../extensibility/plugins/manager";
-import type { InstalledPlugin } from "../../extensibility/plugins/types";
+import type { InstalledPlugin, PluginSettingSchema } from "../../extensibility/plugins/types";
 /**
  * Forwards a keystroke to `input`, but cancels via `onCancel` when the user presses Escape.
  */
@@ -51,6 +51,8 @@ export declare class PluginDetailComponent extends Container {
     constructor(plugin: InstalledPlugin, manager: PluginManager, callbacks: PluginDetailCallbacks);
     handleInput(data: string): void;
 }
+export declare function commitPluginConfigValue(stored: string, submitted: string, type: PluginSettingSchema["type"], edited: boolean): unknown;
+export declare function createPluginTextSubmenu(key: string, schema: PluginSettingSchema, onConfigChange: (key: string, value: unknown) => void): NonNullable<SettingItem["submenu"]>;
 export interface PluginSettingsCallbacks {
     onClose: () => void;
     onPluginChanged: () => void;