@gajae-code/coding-agent 0.7.10 → 0.7.11

package/src/config/keybindings.ts

@@ -22,6 +22,7 @@ interface AppKeybindings {
 	"app.suspend": true;
 	"app.thinking.cycle": true;
 	"app.thinking.toggle": true;
+	"app.commandPalette.open": true;
 	"app.model.cycleForward": true;
 	"app.model.cycleBackward": true;
 	"app.model.select": true;
@@ -59,6 +60,10 @@ declare module "@gajae-code/tui" {
 	interface Keybindings extends AppKeybindings {}
 }
 
+export function defaultMessageQueueKeysForPlatform(platform: NodeJS.Platform = process.platform): KeyId {
+	return platform === "win32" ? "alt+q" : "alt+enter";
+}
+
 /**
  * All keybindings definitions: TUI + app-specific.
  */
@@ -88,12 +93,16 @@ export const KEYBINDINGS = {
 		defaultKeys: "ctrl+t",
 		description: "Toggle thinking mode",
 	},
-	"app.model.cycleForward": {
+	"app.commandPalette.open": {
 		defaultKeys: "ctrl+p",
+		description: "Open command palette",
+	},
+	"app.model.cycleForward": {
+		defaultKeys: "alt+n",
 		description: "Cycle to next model",
 	},
 	"app.model.cycleBackward": {
-		defaultKeys: "shift+ctrl+p",
+		defaultKeys: "alt+shift+n",
 		description: "Cycle to previous model",
 	},
 	"app.model.select": {
@@ -121,7 +130,7 @@ export const KEYBINDINGS = {
 		description: "Send follow-up message (no default; Ctrl+Enter submits)",
 	},
 	"app.message.queue": {
-		defaultKeys: "alt+enter",
+		defaultKeys: defaultMessageQueueKeysForPlatform(),
 		description: "Queue message for next turn",
 	},
 	"app.message.dequeue": {
@@ -141,8 +150,8 @@ export const KEYBINDINGS = {
 		description: "Copy prompt",
 	},
 	"app.session.new": {
-		defaultKeys: [],
-		description: "Create new session",
+		defaultKeys: "ctrl+n",
+		description: "Start a new session",
 	},
 	"app.session.tree": {
 		defaultKeys: [],

package/src/config/model-profiles.ts

@@ -104,6 +104,13 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		critic: "anthropic/claude-opus-4-8:high",
 		architect: "anthropic/claude-opus-4-8:xhigh",
 	}),
+	profile("claude-fable", ["anthropic"], {
+		default: "anthropic/claude-fable-5:xhigh",
+		executor: "anthropic/claude-sonnet-5",
+		planner: "anthropic/claude-fable-5:low",
+		critic: "anthropic/claude-fable-5:high",
+		architect: "anthropic/claude-fable-5:xhigh",
+	}),
 	profile("glm-eco", ["zai"], {
 		default: "zai/glm-5.2:low",
 		executor: "zai/glm-5.2:minimal",
@@ -261,6 +268,13 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		critic: "opencode-go/mimo-v2.5-pro",
 		architect: "openai-codex/gpt-5.5:xhigh",
 	}),
+	profile("fable-opus-codex", ["anthropic", "openai-codex"], {
+		default: "anthropic/claude-fable-5:high",
+		executor: "openai-codex/gpt-5.5:high",
+		planner: "anthropic/claude-opus-4-8:medium",
+		critic: "anthropic/claude-opus-4-8:high",
+		architect: "openai-codex/gpt-5.5:xhigh",
+	}),
 ];
 
 export interface ModelProfilePresentation {
@@ -278,6 +292,7 @@ const PROFILE_PRESENTATION: Record<string, ModelProfilePresentation> = {
 	"codex-pro": { displayName: "Codex Pro", providerGroup: "CODEX" },
 	opencodego: { displayName: "OpenCodeGo", providerGroup: "OPENCODEGO" },
 	"claude-opus": { displayName: "Claude Opus", providerGroup: "CLAUDE" },
+	"claude-fable": { displayName: "Claude Fable", providerGroup: "CLAUDE" },
 	"glm-eco": { displayName: "GLM Eco", providerGroup: "GLM" },
 	"glm-medium": { displayName: "GLM Medium", providerGroup: "GLM" },
 	"glm-pro": { displayName: "GLM Pro", providerGroup: "GLM" },
@@ -299,6 +314,7 @@ const PROFILE_PRESENTATION: Record<string, ModelProfilePresentation> = {
 	"minimax-pro": { displayName: "MiniMax Pro", providerGroup: "MINIMAX" },
 	"opus-codex": { displayName: "Opus + Codex", providerGroup: "COMBOS" },
 	"codex-opencodego": { displayName: "Codex + OpenCodeGo", providerGroup: "COMBOS" },
+	"fable-opus-codex": { displayName: "Fable + Opus + Codex", providerGroup: "COMBOS" },
 };
 
 const PROFILE_GROUP_ORDER = [

package/src/coordinator-mcp/server.ts

@@ -1273,9 +1273,15 @@ async function sendTmuxPromptKeys(
 	prompt: string,
 	runner: CommandRunner = runCommand,
 ): Promise<boolean> {
-	const typed = await runner(["tmux", "send-keys", "-t", target, "-l", prompt]);
-	if (typed.exitCode !== 0) return false;
-	const submitted = await runner(["tmux", "send-keys", "-t", target, "C-m"]);
+	const bufferName = `gjc-coordinator-prompt-${randomUUID()}`;
+	const buffered = await runner(["tmux", "set-buffer", "-b", bufferName, "--", prompt]);
+	if (buffered.exitCode !== 0) return false;
+	const pasted = await runner(["tmux", "paste-buffer", "-d", "-b", bufferName, "-t", target]);
+	if (pasted.exitCode !== 0) {
+		await runner(["tmux", "delete-buffer", "-b", bufferName]);
+		return false;
+	}
+	const submitted = await runner(["tmux", "send-keys", "-t", target, "Enter"]);
 	return submitted.exitCode === 0;
 }
 

package/src/defaults/gjc/skills/ralplan/SKILL.md

@@ -45,13 +45,15 @@ Planning artifacts and stage handoffs MUST be persisted through the ralplan CLI
 
 ```bash
 gjc ralplan --write --stage <type> --stage_n <N> --artifact "markdown file path or markdown string"
+# restricted role agents use:
+gjc ralplan --write --stage <type> --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT
 ```
 
-Use stage values that match the producer or artifact kind, such as `planner`, `architect`, `critic`, `revision`, `post-interview`, `adr`, or `final`. Increment `--stage_n` for each consensus-loop pass. The `--artifact` value may be either a markdown file path prepared outside `.gjc/` for ingestion or the markdown content string itself. The native `--write` handler persists markdown under `.gjc/_session-{sessionid}/plans/ralplan/<run-id>/stage-<NN>-<stage>.md`, maintains an `index.jsonl` audit log, and for `final` stages additionally writes a `pending-approval.md` copy. Direct `write`, `edit`, or `ast_edit` calls against `.gjc/_session-{sessionid}/specs`, `.gjc/_session-{sessionid}/plans`, `.gjc/_session-{sessionid}/state`, or any other `.gjc/` path are forbidden unless an explicit force override is active.
+Use stage values that match the producer or artifact kind, such as `planner`, `architect`, `critic`, `revision`, `post-interview`, `adr`, or `final`. Increment `--stage_n` for each consensus-loop pass. The `--artifact` value may be either a markdown file path prepared outside `.gjc/` for ingestion or the markdown content string itself. The native `--write` handler also accepts `--artifact-env GJC_RALPLAN_ARTIFACT` to read markdown from that per-command env override. It persists markdown under `.gjc/_session-{sessionid}/plans/ralplan/<run-id>/stage-<NN>-<stage>.md`, maintains an `index.jsonl` audit log, and for `final` stages additionally writes a `pending-approval.md` copy. Direct `write`, `edit`, or `ast_edit` calls against `.gjc/_session-{sessionid}/specs`, `.gjc/_session-{sessionid}/plans`, `.gjc/_session-{sessionid}/state`, or any other `.gjc/` path are forbidden unless an explicit force override is active.
 
-While ralplan is active it is a pre-approval planning phase: product-code mutation tools (`write`/`edit`/`ast_edit`) and product-mutating `bash` (e.g. `tee src/...`, redirects into the project tree) are blocked, exactly like deep-interview. Prefer passing the `--artifact` markdown **inline** (the content string) so no scratch file is needed; this is mandatory for restricted role agents (see below). Only the leader, and only when an artifact is too large to pass inline, may stage it as a file in a system temp directory (`os.tmpdir()`/`$TMPDIR`, `/tmp`, `/var/tmp`) outside the project tree and pass that path — never write scratch files into the repo or `.gjc/`. Product code is mutated only after the plan is approved and execution begins.
+While ralplan is active it is a pre-approval planning phase: product-code mutation tools (`write`/`edit`/`ast_edit`) and product-mutating `bash` (e.g. `tee src/...`, redirects into the project tree) are blocked, exactly like deep-interview. Leaders may pass `--artifact` markdown inline or, when an artifact is too large to pass inline, stage it as a file in a system temp directory (`os.tmpdir()`/`$TMPDIR`, `/tmp`, `/var/tmp`) outside the project tree and pass that path — never write scratch files into the repo or `.gjc/`. Product code is mutated only after the plan is approved and execution begins.
 
-Restricted read-only role agents (`planner`, `architect`, and `critic`) must pass markdown content directly in `--artifact`; their restricted bash environment intentionally disables artifact file-path ingestion so a verdict command cannot persist arbitrary file contents.
+Restricted read-only role agents (`planner`, `architect`, and `critic`) must pass markdown content through the `GJC_RALPLAN_ARTIFACT` env override with `--artifact-env GJC_RALPLAN_ARTIFACT`; their restricted bash environment intentionally disables artifact file-path ingestion so a verdict command cannot persist arbitrary file contents.
 
 After a role agent persists a stage artifact, its model-facing response to the caller SHOULD be receipt-only: return the `gjc ralplan --write --json` receipt (`run_id`, `path`, `stage`, `stage_n`, `sha256`, `created_at`) plus the minimal verdict/status fields the caller needs for routing, and do **not** paste the full persisted markdown back into the parent conversation. Downstream reviewers should receive the artifact path/receipt and read the persisted file themselves when they actually need the body. This preserves the audit trail while preventing Planner/Architect/Critic verdict bodies from being duplicated into the main-agent context.
 
@@ -60,7 +62,7 @@ RECEIPT-ONLY guideline: role agents (`planner`, `architect`, and `critic`) persi
 This skill runs GJC planning in consensus mode for the provided arguments.
 
 The consensus workflow:
-1. **Planner** creates the initial plan and a compact **RALPLAN-DR summary** before review. Launch the Planner ONCE per run as a detached, resumable subagent (await it before the Architect) and record its returned subagent id as the run's persisted Planner id; persist the stage with `gjc ralplan --write --stage planner --stage_n 1 --artifact "..." --planner-id <id> --planner-resumable <true|false>` (see **Persisted Planner** below):
+1. **Planner** creates the initial plan and a compact **RALPLAN-DR summary** before review. Launch the Planner ONCE per run as a detached, resumable subagent (await it before the Architect) and record its returned subagent id as the run's persisted Planner id; persist the stage with `gjc ralplan --write --stage planner --stage_n 1 --artifact-env GJC_RALPLAN_ARTIFACT --planner-id <id> --planner-resumable <true|false>` (see **Persisted Planner** below):
    - After persistence, return only the receipt/path plus compact planning status; do not paste the full plan markdown back to the caller unless explicitly requested.
    - Principles (3-5)
    - Decision Drivers (top 3)
@@ -69,26 +71,26 @@ The consensus workflow:
    - Deliberate mode only: pre-mortem (3 scenarios) + expanded test plan (unit/integration/e2e/observability)
 2. **User feedback** *(--interactive only)*: If `--interactive` is set, use the `ask` tool to present the draft plan **plus the Principles / Drivers / Options summary** before review (Proceed to review / Request changes / Skip review). Otherwise, automatically proceed to review.
 3. **Architect** reviews for architectural soundness and must provide the strongest steelman antithesis, at least one real tradeoff tension, and (when possible) synthesis — **await completion before step 4**. In deliberate mode, Architect should explicitly flag principle violations.
-   - The Architect agent/subagent must persist its review with `gjc ralplan --write --stage architect --stage_n <N> --artifact "..." --json`, then return the receipt/path plus compact verdict/status (`CLEAR`/`WATCH`/`BLOCK`, `APPROVE`/`COMMENT`/`REQUEST CHANGES`) instead of pasting the full review body.
+   - The Architect agent/subagent must persist its review with `gjc ralplan --write --stage architect --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT --json`, then return the receipt/path plus compact verdict/status (`CLEAR`/`WATCH`/`BLOCK`, `APPROVE`/`COMMENT`/`REQUEST CHANGES`) instead of pasting the full review body.
 4. **Critic** evaluates against quality criteria — run only after step 3 completes. Critic must enforce principle-option consistency, fair alternatives, risk mitigation clarity, testable acceptance criteria, and concrete verification steps. In deliberate mode, Critic must reject missing/weak pre-mortem or expanded test plan.
-   - The Critic agent/subagent must persist its evaluation with `gjc ralplan --write --stage critic --stage_n <N> --artifact "..." --json`, then return the receipt/path plus compact verdict/status (`OKAY`/`ITERATE`/`REJECT`) instead of pasting the full evaluation body.
-5. **Re-review loop** (max 5 iterations): Any non-`APPROVE` Critic verdict (`ITERATE` or `REJECT`) MUST run the same full closed loop:
+   - The Critic agent/subagent must persist its evaluation with `gjc ralplan --write --stage critic --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT --json`, then return the receipt/path plus compact verdict/status (`OKAY`/`ITERATE`/`REJECT`) instead of pasting the full evaluation body.
+5. **Re-review loop** (max 5 iterations): Any non-`OKAY` Critic verdict (`ITERATE` or `REJECT`) MUST run the same full closed loop:
    a. Collect Architect + Critic feedback
    b. Revise the plan by resuming the SAME persisted Planner subagent with consolidated Architect + Critic feedback (see **Persisted Planner** below); fall back to a fresh Planner spawn only per the fallback routing table
    c. Return to Architect review
-      - Persist each Planner revision with `gjc ralplan --write --stage revision --stage_n <N> --artifact "..." --json` before re-review, then pass the receipt/path forward instead of duplicating the full revision markdown in the parent conversation.
+      - Persist each Planner revision with `gjc ralplan --write --stage revision --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT --json` before re-review, then pass the receipt/path forward instead of duplicating the full revision markdown in the parent conversation.
    d. Return to Critic evaluation
-   e. Repeat this loop until Critic returns `APPROVE` or 5 iterations are reached
-   f. If 5 iterations are reached without `APPROVE`, present the best version to the user
-6. **Post-ralplan interview** (intent reconciliation gate): After Critic returns `APPROVE` and before the plan is finalized, reconcile the consensus plan against the user's actual intent. The goal is to make sure ralplan did not silently bake in assumptions that conflict with what the user wants.
+   e. Repeat this loop until Critic returns `OKAY` or 5 iterations are reached
+   f. If 5 iterations are reached without `OKAY`, present the best version to the user
+6. **Post-ralplan interview** (intent reconciliation gate): After Critic returns `OKAY` and before the plan is finalized, reconcile the consensus plan against the user's actual intent. The goal is to make sure ralplan did not silently bake in assumptions that conflict with what the user wants.
    a. **Collect open items** from the run: every assumption the Planner/Architect/Critic resolved by assumption rather than by stated fact, every ambiguity flagged during review, and every decision the loop made without explicit user input. Source these from the persisted `planner`/`architect`/`critic`/`revision` stage artifacts, not from memory.
    b. **Cross-check prior context for conflicts**: glob `.gjc/_session-{sessionid}/specs/deep-interview-*.md` and other prior specs/plans/context relevant by topic. For each, list points where the consensus plan contradicts, weakens, or expands beyond a previously crystallized decision, constraint, or non-goal. Cite the conflicting artifact and line/section.
    c. **Reconcile with the user via the `ask` tool (always, regardless of `--interactive`)**: Never stop idle with plain-text prose after the consensus loop. Every reconciliation question MUST go through the `ask` tool with contextual options plus free-text.
       - If open items exist, confirm the open assumptions and conflicts **one at a time** with the `ask` tool, weakest/highest-impact first, polishing intent. If any confirmation reveals that the plan diverges from user intent, route the consolidated correction back into the re-review loop (step 5b Planner revision) and re-run Architect + Critic before returning here. Cap at the same 5-iteration ceiling.
       - If the plan is crystal clear (no open assumptions or prior-context conflicts), skip straight to the step 8 final-options `ask` instead of inventing filler questions.
       - For every confirmed open item, embed the resolved outcome into the final plan under an **## Intent Reconciliation** section so the `pending approval` artifact records each decision; record any item the user explicitly defers as an open confirmation under that same section.
-   d. Persist the reconciliation with `gjc ralplan --write --stage post-interview --stage_n <N> --artifact "..." --json`, then return the receipt/path plus a compact status (reconciled-clean / reconciled-with-revision / open-confirmations-pending) instead of pasting the full body.
-7. On reconciliation completion, mark the plan `pending approval` unless explicit execution approval has already been captured, persist the ADR/final plan via `gjc ralplan --write --stage final --stage_n <N> --artifact "..."`, and do not directly edit `.gjc/_session-{sessionid}/plans`. Final plan must include ADR (Decision, Drivers, Alternatives considered, Why chosen, Consequences, Follow-ups) and, when present, the **## Intent Reconciliation** section.
+   d. Persist the reconciliation with `gjc ralplan --write --stage post-interview --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT --json`, then return the receipt/path plus a compact status (reconciled-clean / reconciled-with-revision / open-confirmations-pending) instead of pasting the full body.
+7. On reconciliation completion, mark the plan `pending approval` unless explicit execution approval has already been captured, persist the ADR/final plan via `gjc ralplan --write --stage final --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT`, and do not directly edit `.gjc/_session-{sessionid}/plans`. Final plan must include ADR (Decision, Drivers, Alternatives considered, Why chosen, Consequences, Follow-ups) and, when present, the **## Intent Reconciliation** section.
 8. **Always** present the finalized plan via the `ask` tool (regardless of `--interactive`) with `workflowGate: { stage: "ralplan", kind: "approval" }` on the final question so RPC/headless clients receive a `ralplan`/`approval` workflow gate, not a deep-interview question gate. Use these options:
    - **Refine further** — re-run the consensus loop / request changes, then return here
    - **Approve execution via ultragoal (Recommended)** — goal-tracked autonomous execution
@@ -128,7 +130,7 @@ The Planner is a **same-session persisted subagent**: launched detached once, aw
 **Recording persisted-Planner metadata** (audit/routing only — never claim `subagent list` proves resumability, since the snapshot does not expose `resumable`). Ride these optional flags on the normal `--write` for the planner/revision stage of the pass:
 
 ```
-gjc ralplan --write --stage revision --stage_n <N> --artifact "..." \
+gjc ralplan --write --stage revision --stage_n <N> --artifact-env GJC_RALPLAN_ARTIFACT \
   --planner-id <id> --planner-resumable <true|false> \
   --fallback-reason <context_unavailable|not_found|no_runner|resume_failed|process_restart|missing_record> \
   --fallback-attempted-id <id> --fallback-stage-n <N> \

package/src/defaults/gjc-defaults.ts

@@ -44,6 +44,13 @@ export type DefaultGjcDefinition = DefaultGjcSkillDefinition | DefaultGjcSkillFr
 export interface InstallDefaultGjcDefinitionsOptions {
 	check?: boolean;
 	force?: boolean;
+	/**
+	 * Only rewrite default definition files that already exist on disk but whose
+	 * content differs from the embedded defaults. Files that are absent are left
+	 * absent (status "missing"). Used by `gjc update` to refresh opted-in copies
+	 * without materializing new on-disk copies for users who never installed them.
+	 */
+	refreshOnly?: boolean;
 	targetRoot?: string;
 }
 
@@ -160,6 +167,15 @@ export async function installDefaultGjcDefinitions(
 
 		if (options.check) {
 			status = existing === undefined ? "missing" : existing === definition.content ? "matching" : "different";
+		} else if (options.refreshOnly) {
+			if (existing === undefined) {
+				status = "missing";
+			} else if (existing === definition.content) {
+				status = "matching";
+			} else {
+				await Bun.write(destination, definition.content);
+				status = "written";
+			}
 		} else if (existing !== undefined && !options.force) {
 			status = "skipped";
 		} else {

package/src/extensibility/extensions/runner.ts

@@ -347,7 +347,8 @@ export class ExtensionRunner {
 		"ctrl+t",
 		"ctrl+g",
 		"shift+tab",
-		"shift+ctrl+p",
+		"alt+n",
+		"alt+shift+n",
 		"ctrl+enter",
 		"alt+enter",
 		"escape",

package/src/gjc-runtime/launch-tmux.ts

@@ -37,6 +37,7 @@ export const GJC_TMUX_LAUNCHED_ENV = "GJC_TMUX_LAUNCHED";
 export const GJC_LAUNCH_POLICY_ENV = "GJC_LAUNCH_POLICY";
 export const GJC_TMUX_WINDOW_LABEL_MAX_WIDTH = 48;
 export const GJC_PSMUX_PROFILE_FORCE_ENV = "GJC_PSMUX_PROFILE_FORCE";
+const WINDOWS_PSMUX_ATTACH_RETRY_DELAY_MS = 100;
 const TERMINAL_TITLE_CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/g;
 
 type LaunchPolicy = "direct" | "tmux";
@@ -59,6 +60,7 @@ export interface TmuxLaunchContext {
 	tty?: TtyState;
 	spawnSync?: TmuxSpawnSync;
 	tmuxAvailable?: boolean;
+	tmuxStatusLines?: number;
 	worktreeBranch?: string | null;
 	currentBranch?: string | null;
 	existingBranchSessionName?: string | null;
@@ -107,6 +109,8 @@ export interface TmuxLaunchPlan {
 	project?: string | null;
 	sessionId?: string | null;
 	sessionStateFile?: string | null;
+	isPsmux: boolean;
+	platform: NodeJS.Platform;
 }
 
 function explicitTmuxSessionName(env: NodeJS.ProcessEnv): string | undefined {
@@ -117,7 +121,9 @@ function hasCurrentGjcVersion(session: GjcTmuxSessionStatus | undefined): boolea
 }
 
 function allowsExistingTmuxAttach(parsed: Args, env: NodeJS.ProcessEnv): boolean {
-	return Boolean(parsed.continue || parsed.resume || explicitTmuxSessionName(env));
+	// `--resume` belongs to the inner GJC session resolver. Let it reach main.ts so
+	// value-less resume can show the session picker and valued resume can honor the target.
+	return Boolean(parsed.continue || explicitTmuxSessionName(env));
 }
 
 function findExistingSessionForLaunch(context: {
@@ -544,42 +550,88 @@ function isTmuxAttachDisconnectError(result: TmuxSpawnResult): boolean {
 	const stderr = result.stderr?.toLowerCase() ?? "";
 	return stderr.includes("eio") || stderr.includes("input/output error");
 }
+function isWindowsPsmuxAttachConnectionRefused(plan: TmuxLaunchPlan, result: TmuxSpawnResult): boolean {
+	if (plan.platform !== "win32" || !plan.isPsmux) return false;
+	return result.stderr?.toLowerCase().includes("os error 10061") === true;
+}
+function waitForWindowsPsmuxAttachRetry(): void {
+	Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, WINDOWS_PSMUX_ATTACH_RETRY_DELAY_MS);
+}
 function normalizeTmuxTerminalDimension(value: number | undefined): number | undefined {
 	if (value === undefined || !Number.isSafeInteger(value) || value <= 0) return undefined;
 	return value;
 }
 
-function resolveCallerTmuxTerminalSize(tty: TtyState): TmuxTerminalSize | undefined {
+function normalizeTmuxStatusLineCount(value: number | undefined): number {
+	if (value === undefined || !Number.isSafeInteger(value) || value <= 0) return 0;
+	return value;
+}
+
+function parseTmuxStatusLineCount(value: string): number {
+	const normalized = value.trim().toLowerCase();
+	if (normalized.length === 0 || normalized === "off" || normalized === "0") return 0;
+	if (normalized === "on") return 1;
+	const parsed = Number.parseInt(normalized, 10);
+	return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : 1;
+}
+
+function readTmuxStatusLineCount(tmuxCommand: string, cwd: string, env: NodeJS.ProcessEnv): number {
+	const result = Bun.spawnSync([tmuxCommand, "show-options", "-gqv", "status"], {
+		cwd,
+		env,
+		stdin: "pipe",
+		stdout: "pipe",
+		stderr: "pipe",
+	});
+	if (result.exitCode !== 0) return 0;
+	return parseTmuxStatusLineCount(new TextDecoder().decode(result.stdout));
+}
+
+function resolveCallerTmuxTerminalSize(tty: TtyState, tmuxStatusLines = 0): TmuxTerminalSize | undefined {
 	if (!tty.stdout) return undefined;
 	const columns = normalizeTmuxTerminalDimension(tty.columns);
 	const rows = normalizeTmuxTerminalDimension(tty.rows);
 	if (columns === undefined || rows === undefined) return undefined;
-	return { columns, rows };
+	const adjustedRows = Math.max(1, rows - normalizeTmuxStatusLineCount(tmuxStatusLines));
+	return { columns, rows: adjustedRows };
 }
 
 function buildTmuxNewSessionSizeArgs(size: TmuxTerminalSize | undefined): string[] {
 	return size ? ["-x", String(size.columns), "-y", String(size.rows)] : [];
 }
 
-function resizeCreatedTmuxWindowToCallerTerminalSize(
+// Ensure the freshly created window fits the terminal that ultimately attaches.
+// `new-session` already starts the window (and the inner TUI) at the caller's
+// captured `-x/-y` size; this step governs what happens on `attach-session`.
+//
+// On native tmux we must NOT reassert with `resize-window`: that command flips
+// the window's `window-size` option to `manual`, pinning it to the capture-time
+// dimensions and stopping `attach-session` from resizing the window to the real
+// client. When the attaching terminal is larger than the capture — e.g. a GUI
+// terminal that reports a smaller size before it finishes sizing — the pinned
+// window stays small and tmux paints the uncovered client area with `·` fill
+// (the "window smaller than client" symptom). Keeping `window-size` on `latest`
+// lets tmux size the window to the attaching client (status line included).
+//
+// psmux (Windows) does not share tmux's `window-size` semantics, so preserve the
+// historical explicit `resize-window` reassert there rather than sending an
+// option its server may reject and echo into the user's pane.
+function ensureCreatedTmuxWindowTracksCallerTerminal(
 	plan: TmuxLaunchPlan,
 	spawnSync: TmuxSpawnSync,
 	options: TmuxSpawnOptions,
 ): void {
 	if (!plan.initialSize) return;
-	spawnSync(
-		plan.tmuxCommand,
-		[
-			"resize-window",
-			"-t",
-			buildGjcTmuxExactOptionTarget(plan.sessionName, { env: options.env }),
-			"-x",
-			String(plan.initialSize.columns),
-			"-y",
-			String(plan.initialSize.rows),
-		],
-		options,
-	);
+	const target = buildGjcTmuxExactOptionTarget(plan.sessionName, { env: options.env });
+	if (plan.isPsmux) {
+		spawnSync(
+			plan.tmuxCommand,
+			["resize-window", "-t", target, "-x", String(plan.initialSize.columns), "-y", String(plan.initialSize.rows)],
+			options,
+		);
+		return;
+	}
+	spawnSync(plan.tmuxCommand, ["set-window-option", "-t", target, "window-size", "latest"], options);
 }
 
 export function buildDefaultTmuxLaunchPlan(context: TmuxLaunchContext): TmuxLaunchPlan | undefined {
@@ -641,9 +693,14 @@ export function buildDefaultTmuxLaunchPlan(context: TmuxLaunchContext): TmuxLaun
 		},
 		context.rawArgs,
 	);
-	const initialSize = resolveCallerTmuxTerminalSize(tty);
+	const tmuxStatusLines =
+		context.tmuxStatusLines ??
+		(context.tmuxAvailable === undefined ? readTmuxStatusLineCount(tmuxCommand, cwd, env) : 0);
+	const initialSize = resolveCallerTmuxTerminalSize(tty, tmuxStatusLines);
 	return {
 		tmuxCommand,
+		isPsmux: resolvedBinary.isPsmux,
+		platform,
 		sessionName,
 		cwd,
 		innerCommand,
@@ -742,6 +799,30 @@ export function launchDefaultTmuxIfNeeded(context: TmuxLaunchContext): boolean {
 	const rootTerminalTitle = shouldSetGjcTmuxRootTerminalTitle(context.parsed, env)
 		? buildGjcTmuxRootTerminalTitle(plan.project ?? plan.cwd, plan.branch)
 		: undefined;
+	const buildProfileInputs = (): GjcTmuxProfileContext => ({
+		tmuxCommand: plan.tmuxCommand,
+		target: plan.sessionName,
+		cwd: plan.cwd,
+		env,
+		spawnSync,
+		branch: plan.branch,
+		project: plan.project,
+		sessionId: plan.sessionId ?? null,
+		sessionStateFile: plan.sessionStateFile ?? null,
+		version: VERSION,
+	});
+	const probeHasSession = (): TmuxSpawnResult =>
+		spawnSync(
+			plan.tmuxCommand,
+			["has-session", "-t", buildGjcTmuxExactSessionTarget(plan.sessionName, { env })],
+			probeOptions,
+		);
+	const attachCreatedSession = (): TmuxSpawnResult =>
+		spawnSync(
+			plan.tmuxCommand,
+			["attach-session", "-t", buildGjcTmuxExactSessionTarget(plan.sessionName, { env })],
+			attachOptions,
+		);
 
 	if (plan.attachSessionName) {
 		applyGjcTmuxRootTerminalTitleProfile({
@@ -767,24 +848,6 @@ export function launchDefaultTmuxIfNeeded(context: TmuxLaunchContext): boolean {
 		// server first, and if the race fired, retry new-session before
 		// we hand the session to rename-window / applyGjcTmuxProfile so the
 		// profile-tagging path always sees a registered session.
-		const buildProfileInputs = (): GjcTmuxProfileContext => ({
-			tmuxCommand: plan.tmuxCommand,
-			target: plan.sessionName,
-			cwd: plan.cwd,
-			env,
-			spawnSync,
-			branch: plan.branch,
-			project: plan.project,
-			sessionId: plan.sessionId ?? null,
-			sessionStateFile: plan.sessionStateFile ?? null,
-			version: VERSION,
-		});
-		const probeHasSession = (): TmuxSpawnResult =>
-			spawnSync(
-				plan.tmuxCommand,
-				["has-session", "-t", buildGjcTmuxExactSessionTarget(plan.sessionName, { env })],
-				probeOptions,
-			);
 		const probeResult = probeHasSession();
 		if (probeResult.exitCode !== 0) {
 			const retry = spawnSync(plan.tmuxCommand, plan.newSessionArgs, newSessionOptions);
@@ -851,7 +914,7 @@ export function launchDefaultTmuxIfNeeded(context: TmuxLaunchContext): boolean {
 			}
 			// Recovery succeeded via retry — fall through to attach-session below.
 		}
-		resizeCreatedTmuxWindowToCallerTerminalSize(plan, spawnSync, controlOptions);
+		ensureCreatedTmuxWindowTracksCallerTerminal(plan, spawnSync, controlOptions);
 		applyGjcTmuxRootTerminalTitleProfile({
 			tmuxCommand: plan.tmuxCommand,
 			target: plan.sessionName,
@@ -875,16 +938,75 @@ export function launchDefaultTmuxIfNeeded(context: TmuxLaunchContext): boolean {
 		return false;
 	}
 	// attach-session needs PTY inherit for the user-facing attach; keep it unchanged.
-	const attached = spawnSync(
-		plan.tmuxCommand,
-		["attach-session", "-t", buildGjcTmuxExactSessionTarget(plan.sessionName, { env })],
-		attachOptions,
-	);
+	const attached = attachCreatedSession();
 	if (attached.exitCode === 0) return true;
 	if (isTmuxAttachDisconnectError(attached)) {
 		(context.diagnosticWriter ?? safeStderrWrite)(formatTmuxLaunchDiagnostic("attach disconnected", attached.stderr));
 		return true;
 	}
+	if (isWindowsPsmuxAttachConnectionRefused(plan, attached)) {
+		waitForWindowsPsmuxAttachRetry();
+		const probeAfterAttach = probeHasSession();
+		if (probeAfterAttach.exitCode === 0) {
+			const retryAttached = attachCreatedSession();
+			if (retryAttached.exitCode === 0) return true;
+			if (isTmuxAttachDisconnectError(retryAttached)) {
+				(context.diagnosticWriter ?? safeStderrWrite)(
+					formatTmuxLaunchDiagnostic("attach disconnected", retryAttached.stderr),
+				);
+				return true;
+			}
+		} else {
+			const retry = spawnSync(plan.tmuxCommand, plan.newSessionArgs, newSessionOptions);
+			const retryProbe = probeHasSession();
+			if (retry.exitCode === 0 && retryProbe.exitCode === 0) {
+				renameTmuxWindow(
+					plan.tmuxCommand,
+					windowTitle,
+					spawnSync,
+					controlOptions,
+					buildGjcTmuxExactSessionTarget(plan.sessionName, { env }),
+				);
+				const retryProfile = applyGjcTmuxProfile(buildProfileInputs());
+				const retryOwnershipFailure = retryProfile.failures.find(item =>
+					item.command.args.includes("@gjc-profile"),
+				);
+				if (!retryOwnershipFailure) {
+					ensureCreatedTmuxWindowTracksCallerTerminal(plan, spawnSync, controlOptions);
+					applyGjcTmuxRootTerminalTitleProfile({
+						tmuxCommand: plan.tmuxCommand,
+						target: plan.sessionName,
+						title: rootTerminalTitle,
+						spawnSync,
+						options,
+					});
+					const retryAttached = attachCreatedSession();
+					if (retryAttached.exitCode === 0) return true;
+					if (isTmuxAttachDisconnectError(retryAttached)) {
+						(context.diagnosticWriter ?? safeStderrWrite)(
+							formatTmuxLaunchDiagnostic("attach disconnected", retryAttached.stderr),
+						);
+						return true;
+					}
+				}
+			}
+		}
+	}
+	// Closing an SSH/Windows Terminal tab can make `tmux attach-session`
+	// exit with code 1 and no captured stderr while the tmux server correctly
+	// keeps the just-created session alive. Preserve that live session so the
+	// user can reattach instead of treating the parent client teardown as a
+	// launch failure.
+	const attachFailureStderr = attached.stderr?.trim() ?? "";
+	if (attachFailureStderr.length === 0) {
+		const probeAfterAttachFailure = probeHasSession();
+		if (probeAfterAttachFailure.exitCode === 0) {
+			(context.diagnosticWriter ?? safeStderrWrite)(
+				formatTmuxLaunchDiagnostic("attach disconnected", attached.stderr),
+			);
+			return true;
+		}
+	}
 	cleanupCreatedTmuxSession(plan, spawnSync, options);
 	(context.diagnosticWriter ?? safeStderrWrite)(formatTmuxLaunchDiagnostic("attach failed", attached.stderr));
 	return true;

package/src/gjc-runtime/ralplan-runtime.ts

@@ -11,7 +11,7 @@ import {
 	type RalplanIndexRow,
 	summarizeRalplanIndex,
 } from "./ledger-event-renderer";
-import { isRestrictedRoleAgentBash } from "./restricted-role-agent-bash";
+import { GJC_RALPLAN_ARTIFACT_ENV, isRestrictedRoleAgentBash } from "./restricted-role-agent-bash";
 import { modeStatePath, sessionPlansDir } from "./session-layout";
 import { resolveGjcSessionForWrite, writeSessionActivityMarker } from "./session-resolution";
 import { migrateWorkflowState } from "./state-migrations";
@@ -35,8 +35,9 @@ import {
  *    that lives in the bundled `/skill:ralplan` skill — but it accepts every documented flag so
  *    scripted users see a useful response and the active run is visible to the TUI.
  *
- * 2. **Artifact write**: `gjc ralplan --write --stage <type> --stage_n <N> --artifact
- *    <path-or-string> [--run-id <id>] [--session-id <id>] [--json]` persists Planner / Architect
+ * 2. **Artifact write**: `gjc ralplan --write --stage <type> --stage_n <N>
+ *    (--artifact <path-or-string> | --artifact-env GJC_RALPLAN_ARTIFACT)
+ *    [--run-id <id>] [--session-id <id>] [--json]` persists Planner / Architect
  *    / Critic / revision / post-interview / ADR / final markdown under `.gjc/plans/ralplan/<run-id>/`, maintains
  *    an `index.jsonl` audit log, copies `final` stages to `pending-approval.md`, and advances
  *    the HUD chip to reflect the latest persisted stage.
@@ -81,6 +82,7 @@ const VALUE_FLAGS = new Set([
 	"--stage",
 	"--stage_n",
 	"--artifact",
+	"--artifact-env",
 	"--run-id",
 	"--session-id",
 	"--architect",
@@ -409,8 +411,16 @@ async function resolveArtifactArgs(args: readonly string[], cwd: string): Promis
 	const stageN = parseStageN(flagValue(args, "--stage_n"));
 
 	const rawArtifact = flagValue(args, "--artifact");
-	if (rawArtifact === undefined || rawArtifact === "") {
-		throw new RalplanCommandError(2, "--artifact is required for ralplan --write");
+	const artifactEnvName = flagValue(args, "--artifact-env");
+	const artifactSources = [rawArtifact, artifactEnvName].filter(value => value !== undefined);
+	if (artifactSources.length === 0 || artifactSources.some(value => value === "")) {
+		throw new RalplanCommandError(2, "--artifact or --artifact-env is required for ralplan --write");
+	}
+	if (artifactSources.length > 1) {
+		throw new RalplanCommandError(2, "--artifact and --artifact-env are mutually exclusive");
+	}
+	if (artifactEnvName !== undefined && artifactEnvName !== GJC_RALPLAN_ARTIFACT_ENV) {
+		throw new RalplanCommandError(2, `--artifact-env must be ${GJC_RALPLAN_ARTIFACT_ENV}`);
 	}
 
 	const session = resolveGjcSessionForWrite(cwd, {
@@ -430,7 +440,13 @@ async function resolveArtifactArgs(args: readonly string[], cwd: string): Promis
 	const runId = explicitRunId || (await readActiveRunId(cwd, sessionId)) || sessionIdRaw || defaultRunId();
 	assertSafePathComponent(runId, "run-id");
 
-	const artifact = await resolveArtifactContent(rawArtifact, cwd);
+	const artifact =
+		artifactEnvName !== undefined
+			? (process.env[GJC_RALPLAN_ARTIFACT_ENV] ?? "")
+			: await resolveArtifactContent(rawArtifact!, cwd);
+	if (artifact === "") {
+		throw new RalplanCommandError(2, "artifact content is empty");
+	}
 	return { stage: stage as RalplanStage, stageN, runId, artifact, sessionId, json: hasFlag(args, "--json") };
 }
 

package/src/gjc-runtime/restricted-role-agent-bash.ts

@@ -1,4 +1,5 @@
 export const GJC_RESTRICTED_ROLE_AGENT_BASH_ENV = "GJC_RESTRICTED_ROLE_AGENT_BASH";
+export const GJC_RALPLAN_ARTIFACT_ENV = "GJC_RALPLAN_ARTIFACT";
 
 export function isRestrictedRoleAgentBash(): boolean {
 	return process.env[GJC_RESTRICTED_ROLE_AGENT_BASH_ENV] === "1";

package/src/gjc-runtime/state-runtime.ts

@@ -847,11 +847,14 @@ async function writeJsonAtomic(
 			forced: options?.force ?? false,
 		},
 	});
-	// `writeResult.revision` is computed inside the writer lock, so it is the revision this
-	// write actually owns. Prefer it over a post-lock file re-read, which a concurrent writer
-	// could have advanced before the read — that race could otherwise let this payload be
-	// published with another writer's newer revision.
-	return { warning, stamped: (await readJsonFile(filePath)) ?? {}, revision: writeResult.revision };
+	// `writeResult.stamped` and `.revision` are computed inside the writer lock, so they are
+	// the envelope/revision this write actually owns. Never post-lock re-read here: a concurrent
+	// writer could advance the file before that read and make this payload publish another
+	// writer's newer revision into the derived active-state cache.
+	if (!writeResult.written || !isPlainObject(writeResult.stamped)) {
+		throw new Error(`state writer did not return a stamped workflow envelope for ${filePath}`);
+	}
+	return { warning, stamped: writeResult.stamped, revision: writeResult.revision };
 }
 
 function parseFieldsFlag(args: readonly string[]): StateProjectionField[] | undefined {