@gajae-code/coding-agent 0.8.1 → 0.9.0

package/CHANGELOG.md

@@ -2,6 +2,66 @@
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-07-07
+### Added
+
+- Added `/quit` as an alias of the `/exit` slash command, so the near-universal REPL/CLI quit verb shuts the session down instead of silently falling through to the model as a chat message. Like `/exit` it is a TUI-only shutdown: it is not advertised to ACP clients and is not listed as its own autocomplete/help entry.
+- Added a `/clear` slash command that clears the active conversation context while preserving the current session id and durable session history (#1677).
+- Added an Extragoal local skill template (`docs/extragoal-skill-template.md`) documenting an external final review gate on top of `ultragoal` — a fresh-context, cross-family, tool-restricted read-only reviewer with a machine-parsable verdict contract, mandatory bundle secret scan, prompt-injection stance, explicit findings triage, and a bounded re-sign loop — plus a `reviewer` stance profile and cross-session review-gate recipe in `docs/multi-vendor-profiles.md`, pinned by `test/extragoal-template.test.ts`.
+- Added opt-in live turn streaming to the notifications surface. With `GJC_NOTIFICATIONS_STREAM=1` the session WebSocket now emits throttled non-finalized `turn_stream` frames (each carrying a per-turn `messageRef`) as the assistant message streams, and the Telegram threaded daemon edits ONE message in place — via `editMessageText` keyed by `(session, coalesceKey)` — so the finalized text lands on the same message instead of posting a new one. Off by default; without a `messageRef` finalized turns keep their legacy one-message-per-turn behaviour. Throttle interval is `GJC_NOTIFICATIONS_STREAM_INTERVAL_MS` (default 500ms); streamed frames remain suppressed under redaction.
+- Added `GJC_NOTIFICATIONS_TURN_MAX` to raise the finalized `turn_stream` text cap (default 3500 chars, unchanged) so full long turns reach split-capable clients — the Telegram daemon already fans a long finalized turn across multiple messages via `splitTelegramHtml` — instead of being truncated with an ellipsis at the notification layer. The value is clamped to a finite `[280, 40000]` range: a non-finite or non-positive value (unset, `NaN`, `Infinity`, `<= 0`) falls back to the default, so the cap can never be unbounded. Opt-in and off by default (mirror stays a glanceable per-turn summary); live in-progress frames are intentionally NOT raised so a streaming turn stays one editable preview message rather than fanning across sends.
+
+### Fixed
+
+- Stopped the Hindsight memory backend from injecting stale public-memory-tool guidance into the system prompt. `hindsight/backend.ts`'s `STATIC_INSTRUCTIONS` still instructed the model to "Use `recall`/`retain`/`reflect`", but those tools were removed from the public surface in #341 — they are unregistered in `BUILTIN_TOOLS`/`HIDDEN_TOOLS` and not discoverable — so every Hindsight-backed session advertised three uncallable tools in its injected `# Memory` block. #341 cleaned the local-memory prompts, public docs, and tool registry but never touched the Hindsight backend's own injected block, and its `public-memory-tool-surface.test.ts` guard list omitted `backend.ts`, so the drift went unnoticed. The block now describes the automatic recall/retain lifecycle instead of naming tools, and the regression test now guards `hindsight/backend.ts`.
+- Task subagent output-ID allocation now reserves numeric prefixes from `.jsonl` session artifacts and `.patch` sidecars as well as final `.md` outputs, preventing resumed or partial subagent runs from reusing an existing artifact stem (#1733).
+- Restored `/changelog` as a built-in slash command, including autocomplete and `/changelog --full`/`/changelog full`, so the What's New prompt no longer points at a missing command.
+- Corrected the Extragoal template's read-only enforcement claim: the `--tools` allowlist governs the built-in tool surface, while the runtime injects the session `goal` tool (when `goal.enabled` is on) and `generate_image` (when an image credential exists) beyond it. Because goal's mutating ops persist session mode state, disabling it is now a mandatory gate precondition (`goal.enabled: false` in the review working directory's `.gjc/config.yml`), and reviewer calls outside the allowlist are gate-failing contract violations.
+- Corrected the GJC dogfood template's user-level install instructions (`docs/gjc-dogfood-skill-template.md`): the documented verbatim `cp` wrote to `~/.gjc/skills/`, which is not the user-level scan location (`~/.gjc/agent/skills/`), and left the YAML frontmatter mid-file, so the scan's required `description` never parsed and the installed skill was silently skipped. The template now documents the same frontmatter-first `sed` extraction into the scanned location that the Extragoal template ships with, pinned by `test/gjc-dogfood-template.test.ts`.
+- Reconciled the skill-template docs with review fixes that raced their merges: the Extragoal reviewer now disables the injected `goal` tool via a dedicated gate directory outside the repository (keeping the reviewed checkout clean, per the #1685 review) instead of an untracked in-repo `.gjc/config.yml`; both the Extragoal and dogfood templates document the one-time skill-discovery enablement (`skills.enabled` plus the install-matched `enablePiUser` **or** `enablePiProject` scan — not both, since the project scan opts every future session into repo-local `.gjc/skills` discovery, per the #1704 review); and the Extragoal template test pins the corrected contract strings.
+- Team worker auto-checkpoints now exclude the entire `.gjc/_session-*/` session subtree instead of nine enumerated subdirectories, so extragoal gate receipts and the session activity marker are no longer committed with `--no-verify` and merged into the leader branch on repos that do not gitignore `.gjc/_session-*/`.
+- The Telegram threaded daemon now schedules each split chunk of an oversized message through the shared rate-limit pool: a granted send slot maps to exactly one Bot API send, and continuation chunks are re-queued (one token each) rather than fanned out against a single token. This keeps a long finalized turn (e.g. raised via `GJC_NOTIFICATIONS_TURN_MAX`) within the documented per-chat rate-limit / round-robin fairness invariant instead of bursting many `sendMessage` calls on one slot.
+- `gjc config list`, `gjc config get`, and `gjc config set` now redact secret-like setting paths even when malformed config files store object, array, boolean, or numeric values there; `--show-secrets` remains the explicit unsafe opt-in (#1738).
+- `gjc ultragoal` now fails with a clean CLI error (exit 1, actionable stderr) instead of crashing with an uncaught `SessionResolutionError` stack dump when no session id is resolvable (missing `GJC_SESSION_ID` / `--session-id`), and `gjc ultragoal --help` no longer requires a resolvable session.
+- Local memory consolidation no longer falls back to the registry's first model (which can be a retired model the provider rejects with 404, permanently failing every phase1/phase2 job). When no model role is configured and the session model is not yet resolved, it now prefers the most recently used model before falling back to registry order.
+- `search` no longer fails schema validation when `paths` is omitted; it defaults to searching the working directory, matching the common repo-wide-search intent.
+- Ultragoal validation-batch tests are now hermetic: they previously ran `computeCheckpointChangeSet` against the enclosing repository, so their hardcoded declared change set only covered the branch that introduced them — failing for any contributor branch or dirty checkout that touches other files. They now use a root outside the git work tree with `CI_DEV_CHANGED_PATHS` pinned to the declared paths.
+- Added a discoverable `bisect` tool that hunts down the commit responsible for a regression by driving `git bisect` with a shell predicate (exit `0` = good, `125` = skip, any other non-zero = bad). It validates preconditions (git repo, clean worktree, `good` is an ancestor of `bad`), resolves the worktree top level once and runs every git command, the predicate, and teardown from that repository root (so it is safe even when invoked from a subdirectory that a candidate commit deletes), and always restores the working tree on completion, error, or abort — running `git bisect reset` and then discarding any tracked-file edits the predicate made (`git reset --hard`) so the promised clean teardown holds even when the predicate mutates tracked files (untracked files the predicate creates are left in place and reported, never deleted). It supports an `invert` mode to find the commit that *fixed* a behavior, bounds the search with `maxSteps` and a per-step `stepTimeoutMs` (a timed-out step counts as a skip), and reports the culprit commit with its author, date, subject, changed files, and every revision it tested.
+
+## [0.8.2] - 2026-07-06
+### Added
+
+- Queued message selector entries can now be reordered with `Ctrl+Up` / `Ctrl+Down`, with `Ctrl+Shift+Up` / `Ctrl+Shift+Down` still accepted when the terminal forwards them, while keeping the current draft intact.
+
+- Added `gjc completion inshellisense`, which generates or installs a Fig/withfig-compatible `gjc` completion spec for Microsoft inshellisense without adding inshellisense as a runtime dependency.
+
+### Fixed
+- `gjc team` packaged binaries now avoid persisting Bun virtual `/$bunfs/...` entrypoints as worker commands, so tmux worker panes launch through a real executable or the `gjc` fallback instead of immediately disappearing (#1661).
+- `computer` now honors `include_screenshot` and `computer.autoScreenshot` by returning bounded post-action screenshots, and batch steps now respect nested per-step `timeout` values.
+- Custom-provider `gpt-5.5` entries without an explicit `contextWindow` now default to the 272K Codex prompt budget unless the provider uses first-party `openai-responses`, so Codex passthrough proxies (e.g. CLIProxyAPI) compact in time instead of dying with `context_length_exceeded` at ~272K while the registry advertises 1M.
+- `telegram_send` now rejects files over Telegram's document upload limit before reading them into memory or handing them to the notification sink.
+- `telegram_send` now rejects file attachments while Telegram notification redaction is enabled, preventing explicit file sends from bypassing the redaction boundary.
+- Telegram notification daemons now persist consumed update ids so threaded replies are not reinjected after a daemon restart replays old `getUpdates` entries.
+- Telegram notify setup now hides the interactive BotFather token prompt input, preventing the raw bot token from being echoed into terminal scrollback while pairing notifications.
+- Telegram unattended workflow-gate listeners are now disposed when a notification session stops, preventing stale stopped servers from retaining future gate emissions after shutdown or notification restart.
+- Telegram notification setup and daemon delivery now reject non-private Telegram chat ids before saving configuration, creating forum topics, or sending session content, preserving the private-chat-only routing boundary.
+- Telegram daemon autostart now refuses to attach a new session to a live daemon whose persisted bot-token fingerprint or chat id differs from the current settings, and it avoids registering the session root until ownership is trusted so rotated Telegram credentials cannot keep leaking through the old daemon.
+- Skill autocomplete now supports direct skill-name prefixes after prompt text (for example, `please /ra` → `/skill:ralplan`) while keeping bare `/` menus free of skill entries.
+- `gjc --tmux` on native Windows/psmux now keeps the status line and composer pinned to the bottom after viewport redraws by honoring the GJC tmux launch marker as a multiplexer signal even when `$TMUX` is absent.
+- Provider safety refusals (e.g. Anthropic `stop_reason: "refusal"` → `Refusal (<category>): …`, and `sensitive` → `Content flagged by safety filters`) are now classified as terminal retry errors and surface immediately. They previously fell through to the unbounded `"unknown"` retry class, and because a refusal is deterministic for the submitted context, the session looped refusal → retry → refusal forever — resubmitting the full context every `retry.maxDelayMs` and re-billing it as a prompt-cache write whenever the backoff outlived the cache TTL (#1655).
+- Coordinator event watches now wake on runtime sidecar state changes and emit a bounded `turn.acknowledged` event, so a tmux-resident session that accepts a prompt and then vanishes is durably classified as recoverable `tmux_session_missing_after_prompt_acknowledgement` instead of leaving only a watch registration with no terminal verdict (#1496).
+- Raw tmux-resident sessions now persist public-safe runtime state under their `.gjc/_session-*/runtime/runtime-state.json` even when no coordinator sidecar env is present, so post-ack owner exits leave recoverable `process_exit_before_terminal_state` evidence instead of looking like successful cleanup with no durable output (#1496).
+
+- `gjc config list`, `gjc config get`, and `gjc config set` now redact secret-like string settings by default, with `--show-secrets` as an explicit unsafe opt-in.
+
+- `/new` session-start notifications now render directly under the welcome panel instead of leaving an extra blank row above the confirmation line.
+- Goal completion now preserves the terminal `goal({op: "complete"})` state even when a `goal_updated` extension hook throws, preventing hook-side write errors from trapping a verified ultragoal run in the continuation loop.
+- Ultragoal completion no longer requires the computer-use red-team suite for non-computer changes that only touch the shared `tools/index.ts` registration file.
+- Task subagent output-ID allocation (`AgentOutputManager`) is now concurrency-safe. `#ensureInitialized` previously set a boolean flag *before* the awaited `readdir`, so when two `task` calls are dispatched in the same turn (they run concurrently as shared-concurrency tools on one session-scoped manager) the second allocation short-circuited initialization and started from index `0` while the first scan was still in flight — colliding with existing `N-*.md` outputs and duplicating ids across batches, which overwrote prior subagent outputs on resume. The scan is now memoized as a promise so concurrent `allocate`/`allocateBatch`/`peekNextIndex` calls await the same `readdir` before `#nextId` is derived.
+- Task fork-context seeds (`inheritContext`) now keep a *contiguous* run of the most recent messages. The selection loop in `buildForkContextSeed` walks newest→oldest but used `continue` when a message overflowed the token budget, so it skipped the oversized recent message and scavenged smaller *older* ones — yielding a non-contiguous seed that misrepresents the conversation and breaks the recency contract of the `receipt`/`last-turn`/`bounded` modes. It now `break`s at the first over-budget message, so a subagent receives the actual recent context (or none) instead of a jumbled mix of recent and stale messages.
+- The `/settings` → Model → **Default Model Profile** submenu now lists the model profiles from the registry instead of rendering an empty `No matching commands` list. The setting declared `options: "runtime"`, but the selector layer only injected runtime choices for themes, thinking level, and the status-line preset — never for model profiles — so the submenu was always empty. Selecting a profile there now also applies it live (the same `activateModelProfile` path as the `/model` preset flow) and persists it as the startup default, instead of only persisting for the next startup.
+- `gjc stats` now resolves to the usage-statistics command instead of being treated as a chat prompt. `src/commands/stats.ts` (backed by the `@gajae-code/stats` dependency via `src/cli/stats-cli.ts`) existed and was fully functional, but the entry was never added to the `commands` registry in `cli.ts`, so `isSubcommand()` returned false for `stats` and the invocation fell through to the default `launch` command — leaving the usage dashboard/summary unreachable and absent from `gjc --help`. Registered the command and listed it in the help surface.
+
 ## [0.8.1] - 2026-07-04
 
 ### Added
@@ -72,6 +132,9 @@
 ### Changed
 
 - `web_search` latency overhaul: provider hard timeouts are now class-based (pure search APIs 15s, LLM-mediated providers 120s, Kimi 35s aligned to its upstream 30s budget, replacing the uniform 300s ceiling; an explicitly configured `web_search.timeout` still overrides — the schema default no longer reinstalls 300s), DuckDuckGo is fired as a background hedge 3s into a slower primary so a failing primary falls back to an already-settled result, the Gemini 429/5xx retry-delay budget dropped from 5 minutes to 30 seconds, resolved provider chains are cached per AuthStorage for 60s keyed on the credential generation (availability probes skipped on repeat searches; login/logout invalidates immediately), and `WebSearchTool` prewarms the chain at construction. Measured: hung-primary fallback 301s → 15s, slow-failing-primary fallback ~7s → 6s, repeat chain resolution ~26ms → ~0.01ms.
+### Fixed
+
+- Kept the default composer border one cell inside the terminal edge to avoid the right rounded input corner protruding in narrow/macOS terminal renderers.
 
 ## [0.7.10] - 2026-07-02
 ### Added

package/dist/types/append-only-mode.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Single source of truth for append-only context-mode resolution and manager
+ * construction. Both the initial session build (`sdk.ts`) and the runtime
+ * model/setting-change path (`agent-session.ts`), plus the status UI, resolve
+ * through here so the auto allowlist and prefix-reset diagnostics never drift.
+ */
+import { AppendOnlyContextManager } from "@gajae-code/agent-core";
+/**
+ * Providers for which append-only context auto-enables. Exact provider-string
+ * match only: `anthropic` reached via a gateway/aggregator provider string
+ * (e.g. `openrouter`, a custom gateway) does NOT match and stays opt-in via
+ * `provider.appendOnlyContext: "on"`, because those transports can rewrite or
+ * renormalize the request in ways that have not been validated for append-only
+ * prefix stability.
+ */
+export declare function providerSupportsAppendOnlyAuto(provider: string): boolean;
+/**
+ * Resolve whether to enable append-only context mode based on the setting and provider.
+ *
+ * - `"on"` → always enable
+ * - `"off"` → never enable
+ * - `"auto"` → enable for providers with strong prompt-prefix caching that this
+ *   harness has validated (see {@link providerSupportsAppendOnlyAuto})
+ */
+export declare function resolveAppendOnlyMode(setting: "auto" | "on" | "off" | undefined, provider: string): boolean;
+/**
+ * Construct an {@link AppendOnlyContextManager} wired to emit per-session
+ * stable-prefix reset diagnostics. Use this at every creation site so the
+ * telemetry is uniform.
+ */
+export declare function createAppendOnlyContextManager(provider: string | undefined): AppendOnlyContextManager;

package/dist/types/capability/rule.d.ts

@@ -12,6 +12,10 @@ export interface RuleFrontmatter {
     scope?: string | string[];
     /** Per-rule TTSR interrupt mode override. */
     interruptMode?: "never" | "prose-only" | "tool-only" | "always";
+    /** Per-rule TTSR repeat mode override. */
+    repeatMode?: "once" | "after-gap";
+    /** Per-rule TTSR repeat gap override. */
+    repeatGap?: number;
     [key: string]: unknown;
 }
 /**
@@ -36,6 +40,10 @@ export interface Rule {
     scope?: string[];
     /** Per-rule TTSR interrupt mode override (falls back to global ttsr.interruptMode). */
     interruptMode?: "never" | "prose-only" | "tool-only" | "always";
+    /** Per-rule TTSR repeat mode override (falls back to global ttsr.repeatMode). */
+    repeatMode?: "once" | "after-gap";
+    /** Per-rule TTSR repeat gap override (falls back to global ttsr.repeatGap). */
+    repeatGap?: number;
     /** Source metadata */
     _source: SourceMeta;
 }

package/dist/types/cli/completion-cli.d.ts

@@ -0,0 +1,41 @@
+import type { CommandCtor, CommandEntry } from "@gajae-code/utils/cli";
+export type FigName = string | string[];
+export interface FigArg {
+    name: string;
+    description?: string;
+    isOptional?: boolean;
+    isVariadic?: boolean;
+    suggestions?: string[];
+}
+export interface FigOption {
+    name: FigName;
+    description?: string;
+    args?: FigArg;
+    isRepeatable?: boolean;
+}
+export interface FigSubcommand {
+    name: FigName;
+    description?: string;
+    options?: FigOption[];
+    args?: FigArg | FigArg[];
+}
+export interface FigSpec extends FigSubcommand {
+    name: string;
+    subcommands?: FigSubcommand[];
+}
+export type InshellisenseIndexStatus = "created" | "updated" | "already-compatible" | "overwritten";
+export interface InstallGjcInshellisenseSpecOptions {
+    dir?: string;
+    force?: boolean;
+}
+export interface InstallGjcInshellisenseSpecResult {
+    directory: string;
+    specPath: string;
+    indexPath: string;
+    indexStatus: InshellisenseIndexStatus;
+}
+export declare function defaultInshellisenseSpecDir(homeDir?: string): string;
+export declare function buildGjcFigSpec(entries: CommandEntry[], rootCommandOverride?: CommandCtor): Promise<FigSpec>;
+export declare function renderFigSpecModule(spec: FigSpec): string;
+export declare function renderInshellisenseIndexModule(): string;
+export declare function installGjcInshellisenseSpec(spec: FigSpec, options?: InstallGjcInshellisenseSpecOptions): Promise<InstallGjcInshellisenseSpecResult>;

package/dist/types/cli/config-cli.d.ts

@@ -11,6 +11,7 @@ export interface ConfigCommandArgs {
     value?: string;
     flags: {
         json?: boolean;
+        showSecrets?: boolean;
     };
 }
 /**

package/dist/types/cli/fixture-report.d.ts

@@ -0,0 +1,20 @@
+import type { TaskTokenLog } from "../task/types";
+export interface LiveRunReportShape {
+    schemaVersion: 1;
+    binaryId: string;
+    fixtureId: string;
+    totals: {
+        turns: number;
+        inputTokens: number;
+        outputTokens: number;
+        cacheReadTokens: number;
+        cacheWriteTokens: number;
+        totalTokens: number;
+    };
+    cacheHitRate: number | null;
+    receiptArtifactRatio: number | null;
+    spawnDecisions: number | null;
+    roi: number | null;
+}
+export declare function buildFixtureReport(fixtureId: string, logs: readonly TaskTokenLog[]): LiveRunReportShape;
+export declare function runFixtureReport(fixtureId: string): Promise<number>;

package/dist/types/cli/fixture-report.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/cli/nofile-limit.d.ts

@@ -0,0 +1,11 @@
+import { execFileSync } from "node:child_process";
+export declare const RECOMMENDED_MACOS_NOFILE_LIMIT = 4096;
+export declare function parseNoFileLimit(text: string): number | undefined;
+export declare function buildMacOSNoFileLimitWarning(currentLimit: number): string;
+export interface WarnIfMacOSNoFileLimitTooLowDeps {
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+    execFileSync?: typeof execFileSync;
+    writeStderr?: (text: string) => void;
+}
+export declare function warnIfMacOSNoFileLimitTooLow(deps?: WarnIfMacOSNoFileLimitTooLowDeps): void;

package/dist/types/cli/notify-cli.d.ts

@@ -22,4 +22,11 @@ export interface NotifyCommandDeps {
 }
 export declare function parseNotifyArgs(args: string[]): NotifyCommandArgs | undefined;
 export declare function runNotifyCommand(cmd: NotifyCommandArgs, deps?: NotifyCommandDeps): Promise<void>;
+type TokenPromptInput = NodeJS.ReadStream & {
+    isRaw?: boolean;
+    setRawMode?: (mode: boolean) => unknown;
+};
+type TokenPromptOutput = Pick<NodeJS.WriteStream, "write">;
+export declare function promptForToken(input?: TokenPromptInput, output?: TokenPromptOutput): Promise<string>;
 export declare function printNotifyHelp(): void;
+export {};

package/dist/types/cli/update-cli.d.ts

@@ -53,6 +53,28 @@ export declare function formatVerificationFailureForTest(result: InstalledVersio
  */
 export declare function replaceBinaryForUpdate(options: BinaryReplacementOptions): Promise<InstalledVersionVerification>;
 export declare function runPackageManagerUpdateForTest(options: PackageManagerUpdateOptions): Promise<InstalledVersionVerification>;
+export declare function fsyncFileForTest(filePath: string): Promise<void>;
+/** Injectable steps of the binary update flow (seams for testing ordering). */
+export interface BinaryUpdateFlow {
+    download(url: string, tempPath: string): Promise<void>;
+    fsync(filePath: string): Promise<void>;
+    replace(options: BinaryReplacementOptions): Promise<InstalledVersionVerification>;
+    verifyInstalledVersion(expectedVersion: string): Promise<InstalledVersionVerification>;
+    /** Best-effort cleanup of the temp file when the flow aborts before replace. */
+    removeTemp?(filePath: string): Promise<void>;
+    /** Called once fsync has succeeded, right before replacement begins. */
+    beforeReplace?(): void;
+}
+/**
+ * Orchestrate download → fsync → replace → verify with a strict ordering
+ * contract: the downloaded temp binary MUST be flushed to stable storage
+ * before it is published (renamed into place) or exec'd for verification.
+ *
+ * If fsync fails the temp bytes are not durable, so we abort before
+ * replacement/verification and clean up the temp file rather than installing a
+ * possibly-truncated binary.
+ */
+export declare function runBinaryUpdateFlow(targetPath: string, url: string, expectedVersion: string, flow: BinaryUpdateFlow): Promise<InstalledVersionVerification>;
 /**
  * Run the update command.
  */

package/dist/types/cli.d.ts

@@ -3,7 +3,130 @@
  * CLI entry point — registers all commands explicitly and delegates to the
  * lightweight CLI runner from pi-utils.
  */
-import { type CommandEntry } from "@gajae-code/utils/cli";
+import { Command, type CommandEntry } from "@gajae-code/utils/cli";
 export declare const commands: CommandEntry[];
+export declare class RootHelpCommand extends Command {
+    static description: string;
+    static hidden: boolean;
+    static args: {
+        messages: import("@gajae-code/utils/cli").ArgDescriptor & {
+            description: string;
+            required: false;
+            multiple: true;
+        };
+    };
+    static flags: {
+        model: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        smol: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        slow: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        plan: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        mpreset: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        default: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        provider: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "api-key": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "system-prompt": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "append-system-prompt": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "allow-home": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        mode: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+            options: string[];
+        };
+        print: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            char: string;
+            description: string;
+        };
+        continue: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            char: string;
+            description: string;
+        };
+        resume: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            char: string;
+            description: string;
+        };
+        "session-dir": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "no-session": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        models: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "no-tools": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        "no-lsp": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        "no-pty": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        tmux: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        tools: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        thinking: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+            options: string[];
+        };
+        hook: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+            multiple: true;
+        };
+        extension: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            char: string;
+            description: string;
+            multiple: true;
+        };
+        "no-extensions": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        "no-skills": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        skills: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "no-rules": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        export: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "list-models": import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        "no-title": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+    };
+    static examples: string[];
+    static strict: boolean;
+    run(): Promise<void>;
+}
 /** Run the CLI with the given argv (no `process.argv` prefix). */
 export declare function runCli(argv: string[]): Promise<void>;

package/dist/types/commands/completion.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Generate shell completion specs for external completion engines.
+ */
+import { Command } from "@gajae-code/utils/cli";
+export default class Completion extends Command {
+    static description: string;
+    static args: {
+        target: import("@gajae-code/utils/cli").ArgDescriptor & {
+            description: string;
+            required: false;
+            options: readonly ["inshellisense", "fig"];
+        };
+    };
+    static flags: {
+        install: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        dir: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        force: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        json: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+    };
+    run(): Promise<void>;
+}

package/dist/types/commands/config.d.ts

@@ -25,6 +25,9 @@ export default class Config extends Command {
         json: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };
+        "show-secrets": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
     };
     run(): Promise<void>;
 }

package/dist/types/commands/deep-interview.d.ts

@@ -12,6 +12,9 @@ export default class DeepInterview extends Command {
         deep: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
             description: string;
         };
+        trace: import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
         threshold: import("@gajae-code/utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };

package/dist/types/config/file-lock.d.ts

@@ -13,16 +13,17 @@ export interface FileLockOwnerToken {
     pid: number;
     timestamp: number;
 }
-/** Outcome of a guarded GC removal attempt (`removeFileLockDirForGc`). */
+/** Outcome of a guarded lock-dir removal attempt (`removeFileLockDirForGc`). */
 export type FileLockGcRemoval = "removed" | "owner_changed" | "missing";
 /**
  * @internal
- * Fail-closed removal of a dead lock dir for GC. Re-reads the on-disk owner
- * token as close to the unlink as possible and only deletes the dir when it
- * STILL holds the exact `{pid, timestamp}` identity the caller observed dead.
+ * Fail-closed removal of a lock dir whose owner is expected to be dead or
+ * finished. Re-reads the on-disk owner token as close to the unlink as possible
+ * and only deletes the dir when it STILL holds the exact `{pid, timestamp}`
+ * identity the caller observed.
  *
- * Closes the prune-time TOCTOU window (#606): between GC's dead re-read/probe
- * and the unlink, a live process can reclaim a stale lock at the same path
+ * Closes stale-cleanup TOCTOU windows (#606): between a dead/stale re-read and
+ * the unlink, a live process can reclaim a stale lock at the same path
  * (`acquireLock` rms the stale dir, then re-`mkdir`s and rewrites `info` with a
  * fresh pid+timestamp). Deleting by path alone would reap that LIVE lock. Any
  * mismatch (`owner_changed`) or absent/unreadable info (`missing` — e.g. a

package/dist/types/config/keybindings.d.ts

@@ -244,8 +244,8 @@ export declare const KEYBINDINGS: {
         readonly description: "Queue message for next turn";
     };
     readonly "app.message.dequeue": {
-        readonly defaultKeys: "alt+up";
-        readonly description: "Dequeue message";
+        readonly defaultKeys: ["alt+up", "alt+down"];
+        readonly description: "Select queued message to edit";
     };
     readonly "app.clipboard.pasteImage": {
         readonly defaultKeys: "alt+v" | "ctrl+v";

package/dist/types/config/model-profile-activation.d.ts

@@ -46,7 +46,13 @@ export interface MaterializeModelProfileAssignmentOptions {
     role: GjcModelAssignmentTargetId;
     selector: string;
 }
+export interface MaterializeModelProfileAssignmentsOptions {
+    session: Pick<ModelProfileActivationSession, "model" | "thinkingLevel" | "setActiveModelProfile" | "getActiveModelProfile">;
+    settings: Pick<Settings, "clearOverride" | "get" | "override" | "set">;
+    assignments: ReadonlyMap<GjcModelAssignmentTargetId, string> | Partial<Record<GjcModelAssignmentTargetId, string>>;
+}
 export declare function materializeActiveModelProfileAssignment(options: MaterializeModelProfileAssignmentOptions): boolean;
+export declare function materializeActiveModelProfileAssignments(options: MaterializeModelProfileAssignmentsOptions): boolean;
 export declare function formatModelProfileCredentialError(profileLabel: string, providers: readonly string[]): string;
 export declare function prepareModelProfileActivation(options: PrepareModelProfileActivationOptions): Promise<PreparedModelProfileActivation>;
 export declare function applyPreparedModelProfileActivation(prepared: PreparedModelProfileActivation, options?: {