@gajae-code/coding-agent 0.5.2 → 0.5.4

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [0.5.4] - 2026-06-17
+
+### Fixed
+
+- Fixed subagent resume returning `not_found` after terminal job eviction removed the in-memory subagent record. Resume descriptors are now retained as durable same-session metadata and rehydrate a resumable record from the saved subagent session file, so ralplan Planner revision passes can resume with fallback metadata instead of forcing a fresh Planner spawn after 0.5.3.
+- `AgentSession` now forwards the live provider session state (`providerSessionState`), session affinity id (`providerSessionId ?? sessionId`), and configured WebSocket transport preference (`preferWebsockets`) into local maintenance one-shot calls — manual/automatic compaction summaries, handoff generation, and tree branch summaries — via a shared `#maintenanceProviderTransport()` helper. Previously these Codex/OpenAI-compatible maintenance calls could fall back to HTTP/SSE and lose `session_id` affinity even when `providers.openaiWebsockets: "on"` routed live turns over WebSocket (#736).
+- Fixed `ollama-cloud` first-event timeouts driving an unbounded, usage-spiking retry loop. The ollama-chat backend (exclusively `ollama-cloud`; local Ollama uses the `openai-responses` API) can stall before its first token even for tiny prompts, surfacing `Provider stream timed out while waiting for the first event`. That message matched the generic transient classifier, which retries forever (capped only on delay), so every continuation re-issued the full request to a billable backend and silently spiked usage — disabling retries was the only workaround. First-event timeouts on the ollama-chat API are now a distinct fail-closed class bounded by `retry.maxRetries`: they still retry transient cold starts a few times, then surface instead of looping. First-party providers keep their existing unbounded first-event-timeout retry behavior (#713).
+- Interactive sessions no longer orphan the `browser` tool's headless/spawned Chrome (and the Python eval kernel) to PID 1 when killed by a signal. The interactive entry now registers a bounded, idempotent `postmortem` cleanup (`session-subprocess-teardown`) that runs `AgentSession.disposeChildSubprocesses()` on `SIGINT`/`SIGTERM`/`SIGHUP`, force-releasing the session's browser tabs (`kill:true`) and disposing its Python/JS kernels — the teardown the graceful `/quit` (`dispose()`) path already performs but that an external `kill`/terminal-close used to bypass. Headless `disposeBrowserHandle` now also SIGTERM/SIGKILLs the captured Chrome process tree as a fallback when forced, so a wedged renderer can't survive a bounded CDP `close()`; graceful release behavior is unchanged. The teardown is time-boxed (5s) so a stuck subprocess can't hang process exit (#698).
+
+## [0.5.3] - 2026-06-16
+
+### Added
+
+- Added `GJC_CREDENTIAL_RANKING_MODE` env var (`balanced` (default) | `earliest-reset`), wired through `discoverAuthStorage` into `AuthStorage.credentialRankingMode`. `earliest-reset` selects multi-account OAuth credentials earliest-expiry-first so soon-to-reset tumbling-window quota (e.g. Claude 5h/7d) is drained before it is lost at reset; unset/unknown leaves the default `balanced` behavior unchanged.
+- The `/model` selector and `/fast` status now show a per-model fast-mode indicator (`⚡`) resolved with the provider-aware predicate, including subagent (role) models evaluated against the effective `task.serviceTier` (falling back to the session tier when `inherit`), so it is visible at a glance which models will run with Anthropic `speed:"fast"` / OpenAI `service_tier=priority`. Display-only: no `serviceTier`/`modelRoles`/`agentModelOverrides` writes (#691).
+- Added an opt-in `GJC_BRIDGE_ENDPOINTS` env var (`all`, or a comma list of matrix keys: `events`, `commands`, `control`, `uiResponses`, `hostToolResults`, `hostUriResults`) to enable bridge-mode session-control endpoints, which were previously permanently fail-closed (`403 endpoint_disabled`) with no supported way to turn them on. Unset stays fail-closed and backward compatible (#663).
+
+### Fixed
+
+- Auto-compaction no longer silently requires OpenAI when the active route is a custom Anthropic-capable provider. The compaction model-candidate selection already prefers the active session model, but its last-resort "largest-context model" fallback scanned the entire bundled catalog across all providers, so a stray OpenAI credential (e.g. an out-of-credit key left in the environment) could be picked when the active provider's compaction credential was unusable — turning OpenAI into an implicit hard dependency. The implicit fallback is now scoped to the active model's provider; cross-provider compaction still works but only when explicitly configured via `modelRoles`. When the active provider cannot compact and no role is configured, compaction now fails with the existing clear, provider-specific credential error instead of reaching for OpenAI (#697).
+- Long-running-session freeze/leak remediation across the TUI, agent, and tool runtime: the TUI render loop, component-dispose lifecycle, and markdown highlighting are hardened against huge frames and reuse leaks (#716); agent context append, an emergency-compaction floor that cannot be disabled, token accounting, and session resource teardown (own-session browser tabs, LSP clients, Cursor conversation cache) are bounded (#717); oversized tool inputs/outputs are capped (8 MiB edit/read guard ahead of the notebook fast-path, 1000-row SQLite raw-query cap, 16 MiB artifact / 256 MiB archive read caps, budget-bounded browser return serialization) (#721); native synchronous entrypoints add defense-in-depth caps for tokenization, highlighting, and fuzzy edit matching (#744); and the session blob store is LRU-bounded (64 MiB / 4096 entries) with bounded-concurrency blob resume (limit 8) (#719).
+- Process & resource lifecycle hardening so child processes and external resources are reliably reaped on disconnect, abort, and shutdown, built on a new owned-process foundation — process-group ownership with escalating SIGTERM→SIGKILL tree termination, idempotent dispose, and a postmortem reap hook (F1). Owned-process handles are terminalized on clean drain so a retained handle can never signal a recycled PID/process group (B1); the native blocking-task boundary, PTY lifecycle, and pi-shell timeout/abort reaping are hardened (U1–U3); the Python eval kernel (U4) and JS eval worker/VM (U5) coalesce concurrent first cells, settle queued/pending runs on teardown, and return worker/kernel counts to baseline; bash shell sessions are owner-scoped with one-shot async/monitor jobs and a hard artifact byte cap (U6); DAP adapters and LSP servers are spawned as owned processes and killed on terminate/timeout/reload (U7); MCP stdio/HTTP/SSE transports and the manager close idempotently with stale-publication identity guards (U8); the async job-manager bounds dispose, the delivery queue/retry (with dead-lettering), and terminal purge (U9); and tmux GC never prunes live/attached sessions and reaps only durably-owned orphans (U10).
+
 ## [0.5.2] - 2026-06-15
 
 ### Fixed

package/dist/types/async/job-manager.d.ts

@@ -109,11 +109,16 @@ export interface AsyncJobManagerOptions {
     maxRunningJobs?: number;
     retentionMs?: number;
 }
+export interface AsyncJobDisposeDiagnostics {
+    stuckJobIds: string[];
+    deliveriesDrained: boolean;
+}
 export interface AsyncJobDeliveryState {
     queued: number;
     delivering: boolean;
     nextRetryAt?: number;
     pendingJobIds: string[];
+    deadLettered: number;
 }
 export interface AsyncJobLifecycleCleanup {
     onCancel?: (job: AsyncJob) => void;
@@ -308,6 +313,7 @@ export declare class AsyncJobManager {
      * (used by `dispose()` to nuke the manager's state).
      */
     cancelAll(filter?: AsyncJobFilter): void;
+    getLastDisposeDiagnostics(): AsyncJobDisposeDiagnostics;
     waitForAll(): Promise<void>;
     drainDeliveries(options?: {
         timeoutMs?: number;

package/dist/types/config/model-profiles.d.ts

@@ -4,6 +4,16 @@ export type ModelProfileRole = GjcModelAssignmentTargetId;
 export interface ModelProfileDefinition {
     name: string;
     requiredProviders: string[];
+    /**
+     * Optional groups of providers that are interchangeable fallbacks.
+     * Each group is an array of provider ids where at least one must be
+     * authenticated. Providers NOT in any group are treated as strict
+     * requirements (all must be authenticated).
+     *
+     * Example: `[["xiaomi", "xiaomi-token-plan-sgp", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn"]]`
+     * means any single xiaomi credential satisfies the group.
+     */
+    alternativeProviderGroups?: readonly (readonly string[])[];
     modelMapping: Partial<Record<ModelProfileRole, string>>;
     source: "builtin" | "user";
 }

package/dist/types/dap/client.d.ts

@@ -1,3 +1,4 @@
+import { type OwnedProcess } from "../runtime/process-lifecycle";
 import type { DapCapabilities, DapClientState, DapEventMessage, DapInitializeArguments, DapRequestMessage, DapResolvedAdapter } from "./types";
 interface DapSpawnOptions {
     adapter: DapResolvedAdapter;
@@ -15,7 +16,7 @@ export declare class DapClient {
     readonly adapter: DapResolvedAdapter;
     readonly cwd: string;
     readonly proc: DapClientState["proc"];
-    constructor(adapter: DapResolvedAdapter, cwd: string, proc: DapClientState["proc"], options?: {
+    constructor(adapter: DapResolvedAdapter, cwd: string, owner: OwnedProcess, options?: {
         readable?: ReadableStream<Uint8Array>;
         writeSink?: DapWriteSink;
         socket?: {

package/dist/types/edit/read-file.d.ts

@@ -1,2 +1,8 @@
+/**
+ * Max byte size of a file the edit modes will load whole. Editing loads + normalizes +
+ * fuzzy-matches + diffs the entire file on the main thread, so a multi-MB/generated file
+ * would block the event loop (F19). Above this, fail fast with an actionable error.
+ */
+export declare const MAX_EDIT_FILE_BYTES: number;
 export declare function readEditFileText(absolutePath: string, path: string): Promise<string>;
 export declare function serializeEditFileText(absolutePath: string, path: string, content: string): Promise<string>;

package/dist/types/eval/js/context-manager.d.ts

@@ -12,6 +12,7 @@ export declare function executeInVmContext(options: {
     sessionId: string;
     cwd: string;
     session: ToolSession;
+    ownerId?: string;
     reset?: boolean;
     code: string;
     filename: string;
@@ -21,4 +22,6 @@ export declare function executeInVmContext(options: {
     value: unknown;
 }>;
 export declare function resetVmContext(sessionKey: string): Promise<void>;
+export declare function disposeVmContextsByOwner(ownerId: string): Promise<void>;
 export declare function disposeAllVmContexts(): Promise<void>;
+export declare function liveVmContextCount(): number;

package/dist/types/eval/js/executor.d.ts

@@ -7,6 +7,7 @@ export interface JsExecutorOptions {
     onChunk?: (chunk: string) => Promise<void> | void;
     signal?: AbortSignal;
     sessionId: string;
+    ownerId?: string;
     reset?: boolean;
     sessionFile?: string;
     artifactPath?: string;

package/dist/types/exec/bash-executor.d.ts

@@ -19,6 +19,8 @@ export interface BashExecutorOptions {
     /** Artifact path/id for full output storage */
     artifactPath?: string;
     artifactId?: string;
+    /** Execute without retaining a native Shell in the persistent session registry. */
+    oneShot?: boolean;
     /**
      * Invoked when the native minimizer rewrote the command's output, giving
      * the caller a chance to persist the lossless original capture (typically

package/dist/types/gjc-runtime/tmux-sessions.d.ts

@@ -8,15 +8,21 @@ export interface GjcTmuxSessionStatus {
     branch?: string;
     branchSlug?: string;
     project?: string;
+    panePids: number[];
+    profile?: string;
 }
 export interface GjcTmuxSessionTagsForGc {
     profile?: string;
     project?: string;
     branch?: string;
+    branchSlug?: string;
+    createdAt?: string;
+    attached?: boolean;
+    panePids?: number[];
 }
 export interface GjcTmuxSessionsForGc {
     tagged: GjcTmuxSessionStatus[];
-    untagged: string[];
+    untagged: GjcTmuxSessionStatus[];
 }
 export declare function listGjcTmuxSessions(env?: NodeJS.ProcessEnv): GjcTmuxSessionStatus[];
 /** @internal */

package/dist/types/lsp/types.d.ts

@@ -1,5 +1,6 @@
 import type { ptree } from "@gajae-code/utils";
 import * as z from "zod/v4";
+import type { OwnedProcess } from "../runtime/process-lifecycle";
 export declare const lspSchema: z.ZodObject<{
     action: z.ZodEnum<{
         capabilities: "capabilities";
@@ -261,6 +262,7 @@ export interface LspClient {
     cwd: string;
     config: ServerConfig;
     proc: ptree.ChildProcess<"pipe">;
+    owner?: OwnedProcess;
     requestId: number;
     diagnostics: Map<string, PublishedDiagnostics>;
     diagnosticsVersion: number;

package/dist/types/modes/bridge/bridge-mode.d.ts

@@ -41,6 +41,7 @@ interface BridgeIdempotencyRecord {
     pending?: boolean;
 }
 type BridgeIdempotencyCache = Map<string, BridgeIdempotencyRecord>;
+export declare function parseBridgeEndpoints(value: string | undefined): Partial<BridgeEndpointMatrix> | undefined;
 export declare function createBridgeFetchHandler(options: BridgeFetchHandlerOptions): (request: Request) => Promise<Response>;
 export declare function runBridgeMode(session: AgentSession, setToolUIContext?: (uiContext: ExtensionUIContext, hasUI: boolean) => void): Promise<never>;
 export {};

package/dist/types/modes/components/model-selector.d.ts

@@ -30,6 +30,8 @@ export declare class ModelSelectorComponent extends Container {
         temporaryOnly?: boolean;
         initialSearchInput?: string;
         sessionId?: string;
+        isFastForProvider?: (provider?: string) => boolean;
+        isFastForSubagentProvider?: (provider?: string) => boolean;
     });
     handleInput(keyData: string): void;
     getSearchInput(): Input;

package/dist/types/modes/components/oauth-selector.d.ts

@@ -10,5 +10,6 @@ export declare class OAuthSelectorComponent extends Container {
         requestRender?: () => void;
     });
     stopValidation(): void;
+    dispose(): void;
     handleInput(keyData: string): void;
 }

package/dist/types/modes/components/runtime-mcp-add-wizard.d.ts

@@ -20,6 +20,7 @@ export interface MCPAddWizardOAuthResult {
 export declare class MCPAddWizard extends Container {
     #private;
     constructor(onComplete: (name: string, config: MCPServerConfig, scope: Scope) => void, onCancel: () => void, onOAuth?: (authUrl: string, tokenUrl: string, clientId: string, clientSecret: string, scopes: string) => Promise<MCPAddWizardOAuthResult>, onTestConnection?: (config: MCPServerConfig) => Promise<void>, onRender?: () => void, initialName?: string);
+    dispose(): void;
     handleInput(keyData: string): void;
 }
 export {};

package/dist/types/modes/components/tool-execution.d.ts

@@ -47,6 +47,7 @@ export declare class ToolExecutionComponent extends Container {
      * Stop spinner animation and cleanup resources.
      */
     stopAnimation(): void;
+    dispose(): void;
     setExpanded(expanded: boolean): void;
     setShowImages(show: boolean): void;
     invalidate(): void;

package/dist/types/modes/interactive-mode.d.ts

@@ -93,6 +93,7 @@ export declare class InteractiveMode implements InteractiveModeContext {
     locallySubmittedUserSignatures: Set<string>;
     lastSigintTime: number;
     lastEscapeTime: number;
+    lastComposerClearEscapeTime: number;
     shutdownRequested: boolean;
     hookSelector: HookSelectorComponent | undefined;
     hookInput: HookInputComponent | undefined;

package/dist/types/modes/types.d.ts

@@ -100,6 +100,7 @@ export interface InteractiveModeContext {
     locallySubmittedUserSignatures: Set<string>;
     lastSigintTime: number;
     lastEscapeTime: number;
+    lastComposerClearEscapeTime: number;
     shutdownRequested: boolean;
     hookSelector: HookSelectorComponent | undefined;
     hookInput: HookInputComponent | undefined;

package/dist/types/runtime/process-lifecycle.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Shared runtime lifecycle foundation.
+ *
+ * Two minimal, deliberately small primitives that subsystem runtimes
+ * (DAP/LSP/MCP stdio, eval workers, etc.) adopt so spawned children and
+ * non-process resources cannot outlive their owner:
+ *
+ *   F1(a) `spawnOwnedProcess` — wraps `ptree.spawn` with explicit
+ *         process-group ownership, escalating (SIGTERM -> grace -> SIGKILL)
+ *         tree termination, bounded `awaitExit`, abort-listener cleanup on
+ *         settle, idempotent `dispose`, and a single postmortem hook that
+ *         reaps every still-live owned process group on fatal/normal shutdown.
+ *
+ *   F1(b) `registerResourceOwner` — a generic, idempotent postmortem adapter
+ *         for non-process resources (Bun Workers, VM contexts, timers,
+ *         sockets) built on the existing `postmortem.register` facility.
+ *
+ * Ownership is keyed to the *process group*, not the root process. A root that
+ * exits after backgrounding descendants (`sh -c "worker & exit 0"`) keeps the
+ * owner registered until the group is actually gone, so the descendant tree is
+ * still reaped by `dispose()`/postmortem.
+ *
+ * This module intentionally owns only these primitives. It does not migrate
+ * existing call sites; subsystem PRs adopt it incrementally.
+ *
+ * Note: `ptree.spawn` always pipes stdout/stderr. Adopters that expect output
+ * (DAP/LSP/MCP protocol servers) must consume `owner.child.stdout`; F1 does not
+ * drain it, so a chatty child whose stdout is never read can still block on a
+ * full pipe. That draining is the adopter's responsibility.
+ */
+import { ptree } from "@gajae-code/utils";
+/** Options for {@link spawnOwnedProcess}. */
+export interface SpawnOwnedOptions {
+    cwd?: string;
+    env?: Record<string, string | undefined>;
+    /** stdin mode passed through to the child. Defaults to `"ignore"`. */
+    stdin?: "pipe" | "ignore";
+    /** When aborted, the owned process tree is disposed (escalating kill). */
+    signal?: AbortSignal;
+    /** Grace period (ms) between SIGTERM and SIGKILL on dispose. Default 2000. */
+    gracefulMs?: number;
+    /**
+     * Spawn the child as its own process-group leader so the whole descendant
+     * tree can be signalled on dispose. Defaults to `true` on POSIX. Has no
+     * effect on Windows, where teardown falls back to single-process kill.
+     */
+    processGroup?: boolean;
+    /** Label used in diagnostics. */
+    name?: string;
+}
+/** Result of a bounded {@link OwnedProcess.awaitExit}. */
+export interface AwaitExitResult {
+    /** `true` when the process has exited; `false` when the timeout fired first. */
+    exited: boolean;
+    /** Exit code if known, else `null`. */
+    code: number | null;
+}
+/** A spawned child process owned by the runtime with guaranteed teardown. */
+export interface OwnedProcess {
+    readonly child: ptree.ChildProcess;
+    readonly pid: number | undefined;
+    /** Resolves/rejects when the root child exits (mirrors ptree's `exited`). */
+    readonly exited: Promise<number>;
+    /** `true` once `dispose()` has started. */
+    readonly disposed: boolean;
+    /**
+     * Wait for the root child to exit, optionally bounded by `timeoutMs`. With no
+     * timeout it resolves only when the child exits. Never rejects.
+     */
+    awaitExit(opts?: {
+        timeoutMs?: number;
+    }): Promise<AwaitExitResult>;
+    /**
+     * Idempotently terminate the owned process *group*: SIGTERM the group, wait
+     * `gracefulMs`, then SIGKILL, polling group liveness throughout. Removes the
+     * abort listener and deregisters from the live-owner set only after teardown
+     * has completed. Repeated/concurrent calls return the same in-flight promise.
+     */
+    dispose(): Promise<void>;
+}
+/**
+ * Spawn a child process owned by the runtime. The returned {@link OwnedProcess}
+ * is registered for postmortem cleanup and tears down its whole process group
+ * on dispose/abort.
+ */
+export declare function spawnOwnedProcess(cmd: string[], opts?: SpawnOwnedOptions): OwnedProcess;
+/** Number of currently live owned processes. Exposed for leak assertions/tests. */
+export declare function liveOwnedProcessCount(): number;
+/** Dispose every live owned process. For owner-scoped teardown and tests. */
+export declare function disposeAllOwnedProcesses(): Promise<void>;
+type ResourceDisposer = () => void | Promise<void>;
+/**
+ * Register a non-process resource for postmortem/fatal-exit cleanup.
+ *
+ * Idempotent by `name`: re-registering the same name replaces the prior
+ * disposer (last wins). Returns an unregister function that removes the owner
+ * only while it is still the active registration for that name.
+ */
+export declare function registerResourceOwner(name: string, disposer: ResourceDisposer): () => void;
+/** Number of registered resource owners. Exposed for leak assertions/tests. */
+export declare function resourceOwnerCount(): number;
+/**
+ * Run and clear every registered resource disposer. Attempts all disposers even
+ * if some throw, then surfaces the failures as an `AggregateError` so callers
+ * can distinguish "all closed" from "a resource may still be alive".
+ */
+export declare function disposeAllResourceOwners(): Promise<void>;
+export {};

package/dist/types/runtime-mcp/transports/stdio.d.ts

@@ -14,6 +14,7 @@ export declare class StdioTransport implements MCPTransport {
     onRequest?: (method: string, params: unknown) => Promise<unknown>;
     constructor(config: MCPStdioServerConfig);
     get connected(): boolean;
+    get closeBeforeReconnect(): true;
     /**
      * Start the subprocess and begin reading.
      */

package/dist/types/runtime-mcp/types.d.ts

@@ -185,6 +185,8 @@ export interface MCPTransport {
     notify(method: string, params?: Record<string, unknown>): Promise<void>;
     /** Close the transport */
     close(): Promise<void>;
+    /** Whether close must finish before reconnect can safely spawn a replacement. */
+    readonly closeBeforeReconnect?: boolean;
     /** Whether the transport is connected */
     readonly connected: boolean;
     /** Event handlers */

package/dist/types/session/agent-session.d.ts

@@ -13,7 +13,7 @@
  * Modes use this class and add their own I/O layer on top.
  */
 import { type Agent, type AgentEvent, type AgentMessage, type AgentState, type AgentTool, type StablePrefixSnapshot, ThinkingLevel } from "@gajae-code/agent-core";
-import { type CompactionResult } from "@gajae-code/agent-core/compaction";
+import { type CompactionResult, type EmergencyCompactionSample } from "@gajae-code/agent-core/compaction";
 import type { AssistantMessage, Effort, ImageContent, Message, MessageAttribution, Model, ProviderSessionState, ServiceTier, SimpleStreamOptions, TextContent, ToolChoice, UsageReport } from "@gajae-code/ai";
 export interface ForkContextSeedMetadata {
     sourceSessionId: string;
@@ -407,6 +407,18 @@ export declare class AgentSession {
      * Call this when completely done with the session.
      */
     dispose(): Promise<void>;
+    /**
+     * Bounded, best-effort teardown of the subprocess-spawning resources this session
+     * owns: the browser tool's headless/spawned Chrome and the Python eval kernel + JS VM
+     * contexts. Unlike {@link dispose}, this touches only child processes and is time-boxed,
+     * so a top-level `SIGINT`/`SIGTERM`/`SIGHUP` handler can run it without hanging — without
+     * it, an external kill bypasses `dispose()` and orphans Chrome/Python to PID 1 (#698).
+     *
+     * Idempotent: every step is a no-op once the graceful {@link dispose} path has released
+     * the resources. Never throws; per-step failures are logged and the whole run is capped
+     * at `timeoutMs` so a wedged subprocess can't stall process exit.
+     */
+    disposeChildSubprocesses(timeoutMs?: number): Promise<void>;
     /** Full agent state */
     get state(): AgentState;
     /** Current model (may be undefined if not yet selected) */
@@ -726,6 +738,20 @@ export declare class AgentSession {
      * {@link isFastModeActive} instead — that one respects the model's provider.
      */
     isFastModeEnabled(): boolean;
+    /**
+     * True when the configured `serviceTier` resolves to `"priority"` for the
+     * given model `provider`. Returns false for scoped tiers that don't match
+     * (e.g. `"openai-only"` on an anthropic provider) and when `provider` is
+     * undefined. This is the canonical provider-aware fast-mode predicate.
+     */
+    isFastForProvider(provider?: string): boolean;
+    /**
+     * Provider-aware fast-mode predicate for task-tool subagent roles, evaluated
+     * against the effective subagent tier (`task.serviceTier`) rather than the
+     * main session tier. Use this for `task.agentModelOverrides` role rows so the
+     * ⚡ glyph reflects the tier the subagent actually runs under.
+     */
+    isFastForSubagentProvider(provider?: string): boolean;
     /**
      * True when the configured `serviceTier` resolves to `"priority"` for the
      * *currently selected model's provider*. Returns false for scoped tiers
@@ -789,6 +815,8 @@ export declare class AgentSession {
      */
     handoff(customInstructions?: string, options?: SessionHandoffOptions): Promise<HandoffResult | undefined>;
     prepareContributionPrep(options?: ContributionPrepOptions): Promise<ContributionPrepResult>;
+    /** Test seam: override the emergency-compaction resource sampler so tests never read real RSS. */
+    setResourceSampler(sampler: () => EmergencyCompactionSample): void;
     /**
      * Toggle auto-compaction setting.
      */

package/dist/types/session/artifacts.d.ts

@@ -1,3 +1,6 @@
+export interface ArtifactSaveOptions {
+    maxBytes?: number;
+}
 /**
  * Manages artifact storage for a session.
  *
@@ -40,7 +43,7 @@ export declare class ArtifactManager {
      * @param toolType Tool name for file extension (e.g., "bash", "read")
      * @returns Artifact ID (numeric string)
      */
-    save(content: string, toolType: string): Promise<string>;
+    save(content: string, toolType: string, options?: ArtifactSaveOptions): Promise<string>;
     /**
      * Check if an artifact exists.
      * @param id Artifact ID (numeric string)

package/dist/types/session/streaming-output.d.ts

@@ -2,6 +2,7 @@ import type { AgentToolUpdateCallback } from "@gajae-code/agent-core";
 export declare const DEFAULT_MAX_LINES = 3000;
 export declare const DEFAULT_MAX_BYTES: number;
 export declare const DEFAULT_MAX_COLUMN = 1024;
+export declare const DEFAULT_ARTIFACT_MAX_BYTES: number;
 export interface OutputSummary {
     output: string;
     truncated: boolean;
@@ -19,6 +20,8 @@ export interface OutputSummary {
     columnTruncatedLines?: number;
     /** Artifact ID for internal URL access (artifact://<id>) when truncated */
     artifactId?: string;
+    /** Bytes omitted from artifact storage after the artifact hard cap was reached. */
+    artifactTruncatedBytes?: number;
 }
 export interface OutputSinkOptions {
     artifactPath?: string;
@@ -38,6 +41,8 @@ export interface OutputSinkOptions {
      * writes still respect the budget. Default 0 = no per-line cap.
      */
     maxColumns?: number;
+    /** Hard cap for artifact writes/pending replay. Default DEFAULT_ARTIFACT_MAX_BYTES. */
+    artifactMaxBytes?: number;
     onChunk?: (chunk: string) => void;
     /** Minimum ms between onChunk calls. 0 = every chunk (default). */
     chunkThrottleMs?: number;
@@ -52,6 +57,13 @@ export interface OutputSinkOptions {
      * relative to the sink (the sink does not catch errors from this callback).
      */
     onRawChunk?: (chunk: string) => void;
+    /**
+     * Opt-in (F21): when true, sanitization + live callback delivery + retention are coalesced over
+     * batched raw chunks instead of run per chunk, bounding sync CPU for many-small-chunk output. The
+     * raw artifact mirror stays byte-correct. Defaults to the PI_OUTPUT_SANITIZE_COALESCE env flag
+     * (default OFF — the per-chunk path is byte-identical to historical behavior).
+     */
+    coalesceSanitize?: boolean;
 }
 export interface TruncationResult {
     content: string;

package/dist/types/slash-commands/helpers/fast-status-report.d.ts

@@ -0,0 +1,76 @@
+import type { Model } from "@gajae-code/ai";
+/**
+ * A single line in the `/fast status` report: a labelled model and whether fast
+ * mode is effective for it. The `fast` flag is resolved by the caller
+ * (`buildFastStatusReport`) so each row can use the correct service tier — the
+ * main session tier for the current model / `modelRoles` roles, or the subagent
+ * tier (`task.serviceTier`) for `task.agentModelOverrides` roles.
+ */
+export interface FastStatusRow {
+    /** Display label, e.g. "현재 모델", "DEFAULT", "EXECUTOR". */
+    label: string;
+    /** Resolved model for this row, if any. */
+    model?: Model;
+    /** Whether fast mode is effective for this row's model. */
+    fast: boolean;
+}
+export interface FormatFastStatusReportArgs {
+    rows: FastStatusRow[];
+    /** The active theme's fast icon token (`theme.icon.fast`). */
+    iconFast: string;
+    /** Optional decorator for inactive ("off") text, e.g. theme dim in the TUI. */
+    formatInactive?: (text: string) => string;
+}
+/** Title line of the `/fast status` report. */
+export declare const FAST_STATUS_TITLE = "Fast \uBAA8\uB4DC \uC0C1\uD0DC";
+/** The inactive marker shown for rows where fast mode does not apply. */
+export declare const FAST_STATUS_OFF = "off";
+/**
+ * Format a multiline `/fast status` report. Pure and shared by the CLI
+ * (`handle`) and TUI (`handleTui`) command branches so the two never drift.
+ * Each row's fast/off state is decided by the caller (see
+ * {@link buildFastStatusReport}) so per-row service-tier differences are honored.
+ */
+export declare function formatFastStatusReport(args: FormatFastStatusReportArgs): string;
+/** Minimal session surface needed to build the `/fast status` report. */
+export interface FastStatusSessionLike {
+    readonly model?: Model;
+    /** Fast predicate against the main session tier (current model + `modelRoles`). */
+    isFastForProvider(provider?: string): boolean;
+    /** Fast predicate against the effective subagent tier (`task.agentModelOverrides` roles). */
+    isFastForSubagentProvider(provider?: string): boolean;
+    resolveRoleModelWithThinking(role: string): {
+        model?: Model;
+    };
+}
+/** A role to enumerate in the report, with the tier source its subagent runs under. */
+export interface FastStatusRoleTarget {
+    id: string;
+    label: string;
+    /**
+     * True for `task.agentModelOverrides` roles (executor/architect/planner/critic)
+     * that run under `task.serviceTier`; false for `modelRoles` roles (default)
+     * that run under the main session tier.
+     */
+    isSubagentRole: boolean;
+}
+export interface BuildFastStatusReportArgs {
+    session: FastStatusSessionLike;
+    /** Role targets to enumerate, in display order. */
+    roleTargets: ReadonlyArray<FastStatusRoleTarget>;
+    /** The active theme's fast icon token (`theme.icon.fast`). */
+    iconFast: string;
+    /** Optional decorator for inactive ("off") text, e.g. theme dim in the TUI. */
+    formatInactive?: (text: string) => string;
+}
+/**
+ * Build the `/fast status` report from a live session: the active/current model
+ * followed by each assigned role (subagent) model. Unassigned roles are skipped
+ * so the report mirrors the `/model` selector, which only badges assigned roles.
+ *
+ * Subagent roles (`task.agentModelOverrides`) are evaluated against the
+ * effective subagent tier (`task.serviceTier`), while the current model and
+ * `modelRoles` roles use the main session tier — matching where each model
+ * actually runs.
+ */
+export declare function buildFastStatusReport(args: BuildFastStatusReportArgs): string;

package/dist/types/tools/bash.d.ts

@@ -6,6 +6,7 @@ import { type Theme } from "../modes/theme/theme";
 import type { ToolSession } from ".";
 import { type OutputMeta } from "./output-meta";
 export declare const BASH_DEFAULT_PREVIEW_LINES = 10;
+export declare function saveBashOriginalArtifactForTests(session: ToolSession, originalText: string): Promise<string | undefined>;
 declare const bashSchemaBase: z.ZodObject<{
     command: z.ZodString;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;

package/dist/types/tools/browser/tab-supervisor.d.ts

@@ -26,6 +26,8 @@ export interface TabSession {
     pending: Map<string, PendingRun>;
     dialogPolicy?: DialogPolicy;
     kindTag: BrowserKindTag;
+    /** Session that acquired this tab; used for session-scoped teardown (F13). */
+    ownerId?: string;
 }
 export interface AcquireTabOptions {
     url?: string;
@@ -39,6 +41,8 @@ export interface AcquireTabOptions {
     signal?: AbortSignal;
     timeoutMs: number;
     dialogs?: DialogPolicy;
+    /** Owning session id so dispose can release only this session's tabs (F13). */
+    ownerId?: string;
 }
 export interface AcquireTabResult {
     tab: TabSession;
@@ -58,6 +62,11 @@ export declare function acquireTab(name: string, browser: BrowserHandle, opts: A
 export declare function runInTab(name: string, opts: RunInTabOptions): Promise<RunResultOk>;
 export declare function releaseTab(name: string, opts?: ReleaseTabOptions): Promise<boolean>;
 export declare function releaseAllTabs(opts?: ReleaseTabOptions): Promise<number>;
+/**
+ * Release only the tabs owned by `ownerId` (F13 session-scoped teardown). Tabs acquired
+ * by other sessions (or with no owner) are left untouched. No-op for a null/empty owner.
+ */
+export declare function releaseTabsForOwner(ownerId: string | null | undefined, opts?: ReleaseTabOptions): Promise<number>;
 export declare function dropHeadlessTabs(): Promise<void>;
 export declare function initializeTabWorkerForTest(worker: WorkerHandle, payload: WorkerInitPayload, timeoutMs: number): Promise<ReadyInfo>;
 export {};

package/dist/types/tools/sqlite-reader.d.ts

@@ -60,9 +60,10 @@ export declare function getRowByKey(db: Database, table: string, pk: {
     type?: string;
 }, key: string): Record<string, unknown> | null;
 export declare function getRowByRowId(db: Database, table: string, key: string): Record<string, unknown> | null;
-export declare function executeReadQuery(db: Database, sql: string): {
+export declare function executeReadQuery(db: Database, sql: string, maxRows?: number): {
     columns: string[];
     rows: Record<string, unknown>[];
+    truncated: boolean;
 };
 export declare function insertRow(db: Database, table: string, data: Record<string, unknown>): void;
 export declare function updateRowByKey(db: Database, table: string, pk: {

package/dist/types/web/search/providers/codex.d.ts

@@ -14,12 +14,12 @@ export interface CodexSearchParams {
  * Executes a web search using OpenAI code provider's built-in web search tool.
  *
  * Default-model behavior:
- * - If `PI_OPENAI_CODE_WEB_SEARCH_MODEL` is set, use it exactly once and surface any
+ * - If `PI_CODEX_WEB_SEARCH_MODEL` is set, use it exactly once and surface any
  *   upstream error verbatim.
- * - Otherwise prefer ChatGPT-account-safe bundled defaults (GPT-5.4, GPT-5
- *   OpenAI code backend, GPT-5, …) and retry the next candidate only when OpenAI code backend returns the
+ * - Otherwise prefer ChatGPT-account-safe bundled defaults (GPT-5.5, GPT-5.4,
+ *   GPT-5 code backend, …) and retry the next candidate only when OpenAI code backend returns the
  *   known 400 "model is not supported" family. This avoids selecting
- *   `gpt-5-OpenAI code backend-mini` first on ChatGPT accounts, which OpenAI rejects.
+ *   `gpt-5-codex-mini` first on ChatGPT accounts, which OpenAI rejects.
  */
 export declare function searchCodex(params: SearchParams): Promise<SearchResponse>;
 /**