@sayknow-cli/coding-agent 0.5.10 → 0.5.13

package/CHANGELOG.md

@@ -2,6 +2,48 @@
 
 ## [Unreleased]
 
+## [0.5.13] - 2026-09-15
+### Fixed
+
+- Session-import's cross-process idempotency test no longer depends on Bun child stdout surviving a contended file lock. The child writes its result to a file as well as stdout, so a silent empty pipe on Linux CI cannot fail a successful import.
+
+
+## [0.5.12] - 2026-09-15
+### Added
+
+- `skc ultragoal succession offer|adopt|status` gives an approved Ultragoal an explicit, audited path from the repository it was planned in to the repository its implementation belongs to (ported from upstream #5353). The source run fences the selected unfinished goals immediately; the target adopts a fresh pending plan with verbatim brief/objectives and unresolved obligations as provenance, not inherited completion authority.
+- Custom OpenAI-compatible providers in `models.yml` auto-populate `/model` from their live `/v1/models` catalog without a manual `discovery:` block, and auto-classify each discovered model's wire API family (ported from upstream #5187). Explicit `discovery` config and the local `openaiCompat` proxy lane are unchanged.
+
+### Fixed
+
+- Session import redaction now bounds the URL-credential scheme to 16 characters so large credential-free transcripts scan in linear time instead of quadratic (ported from upstream #5346). Markdown-wrapped `https://user:pass@host` credentials remain redacted.
+- File-lock acquisition timeouts are a typed `FileLockAcquireError` with the lock path, retry count, and holder, instead of an untyped string. Empty `.lock` directories left by a crash between `mkdir` and writing `info` are reclaimable by GC (the SKC-shaped subset of upstream #5378/#5381; this tree has no `.lock.pending.<pid>.<uuid>` staging).
+- `writeGuardedJsonAtomic` honors `lockHeld`, so callers already inside `withWorkflowStateLock` (succession offer/adopt, start/checkpoint) no longer self-deadlock.
+- Under tmux, a successful sixel DA1 no longer turns INLINE transcript images back on. Ghostty answers that query with ";4" even though it never paints sixel, so every screenshot was smuggled through DCS passthrough onto the outer image plane and stacked over the chat. The probe now enables overlay sixel (the pet) only; inline sixel stays off unless tmux itself owns `terminal-features=sixel`.
+
+
+## [0.5.11] - 2026-09-10
+
+### Fixed
+
+- Telegram tool activity and reasoning summaries flow again. The native notifications server (`crates/skc-notifications`) still admitted only the legacy `tool_activity_v1` token while the daemon and SDK host negotiated `tool_activity_v2`, so every tool-activity and reasoning-summary frame was silently dropped. Ported the upstream protocol constants: v2 is canonical, v1 stays receive-only for legacy clients.
+- `bisect` recognizes git 2.55's quoted convergence line (`<sha> is the first 'bad' commit`). On newer git every bisect ran to the step limit and reported no conclusion.
+- `/resume` with an explicit `--session-dir` no longer fails closed: the interactive selector called the managed-only candidate preparation unconditionally. It now lists through the read-only picker inventory, uses strict adoption only for managed destinations, and tags switches with the selector resume origin.
+- Model registry: `getAvailable()` is memoized (keyed on disabled providers and credential env, invalidated on auth-generation changes and catalog rebuilds), provider-discovery 401/403 errors name the provider and the `providers.<id>.apiKey` / `apiKeyEnv` surface through a redacted URL, and the resolver forwards the session id so parent-session canonical stickiness reaches bare subagent overrides.
+- Thinking/effort selector awaits the session's control-level change and surfaces errors instead of closing optimistically. Command palette hints use the configured key display strings.
+- Status line custom editor caught up with upstream: usage-mode row, stable description-area height, parent preview refresh on edit and cancel, and `usage` merged into segment options.
+- Hidden `__gateway` telegram subcommand imports `@sayknow-cli/telegram-remote` by package name instead of a cross-package relative path that does not exist in published installs.
+- Deep-interview skill: ported the "Per-question advisory fanout lanes" subsection that the v0.5.0 sync missed.
+- Stdio RPC client reports the child's exit code and stderr when the child exits before `ready`, instead of a misleading JSONL parse error.
+- `ask` tool caught up with the SDK contract: the parameter schema is stage-gated for deep interviews (topology vs post-topology vs ordinary asks), and SDK-routed asks consume the typed `awaitAnswerRequest` receipt and settlement (commit / resolve-without-commit / invalid) instead of only the legacy `awaitAnswer` path, so remote answers fire at invocation time.
+- Model profile activation raises typed `UnknownModelProfileError` / registry errors, so an SDK child that fails profile activation reports `code` and `details` through readiness and `BrokerResponse` instead of a bare `spawn_failed`.
+- SDK host shutdown awaits the native notifications server's `stopAndWait()`; a failing stop is no longer recorded as a successful `hostStopped` during rollback.
+- `mupdf` compiled-binary test and the Python SDK real-session tests run against whichever native addon variant CI built.
+
+### CI
+
+- Main CI is green again for the first time since the v0.11.6 sync. The `runtime-check` shard now downloads the native addon artifact, the planner (`scripts/ci-dev-affected.ts`) was rebuilt on the upstream v0.12.0 model with the fork's deltas (including the isolated production SDK host shard), the install smoke Dockerfile publishes the platform native packages, and roughly one hundred stale test contracts carried over from the v0.11.6/v0.12.0 syncs (rebrand strings, retired `--mode rpc`, catalog growth, default theme, golden HMAC domains) were realigned to the fork's intended behavior without removing or skipping tests.
+
 ## [0.5.10] - 2026-09-10
 
 ### Added

package/dist/types/config/file-lock.d.ts

@@ -3,6 +3,14 @@ export interface FileLockOptions {
     retries?: number;
     retryDelayMs?: number;
 }
+export declare class FileLockAcquireError extends Error {
+    readonly filePath: string;
+    readonly lockPath: string;
+    readonly attempts: number;
+    readonly holder: string;
+    readonly code = "acquire_timeout";
+    constructor(filePath: string, lockPath: string, attempts: number, holder: string);
+}
 /**
  * Returns the OS-provided process start timestamp for PID-reuse detection.
  * `ps` is available on the supported Unix hosts (macOS and Linux), unlike

package/dist/types/config/model-profile-activation.d.ts

@@ -17,7 +17,9 @@ type ModelProfileActivationSession = Pick<AgentSession, "model" | "thinkingLevel
 };
 export interface PrepareModelProfileActivationOptions {
     session: ModelProfileActivationSession;
-    modelRegistry: Pick<ModelRegistry, "getModelProfile" | "getModelProfiles" | "getAvailableModelProfileNames" | "getApiKeyForProvider" | "getAll" | "resolveCanonicalModel" | "getCanonicalVariants" | "getCanonicalId">;
+    modelRegistry: Pick<ModelRegistry, "getModelProfile" | "getModelProfiles" | "getAvailableModelProfileNames" | "getApiKeyForProvider" | "getAll" | "resolveCanonicalModel" | "getCanonicalVariants" | "getCanonicalId"> & {
+        getError?: ModelRegistry["getError"];
+    };
     settings: Pick<Settings, "get">;
     profileName: string;
 }

package/dist/types/config/model-registry.d.ts

@@ -97,6 +97,7 @@ export declare const ModelsConfigFile: ConfigFile<{
         auth?: "none" | "apiKey" | "oauth" | undefined;
         discovery?: {
             type: "ollama" | "lm-studio" | "omlx" | "sglang" | "llama.cpp" | "openai-models-list";
+            apiByModelPrefix?: Record<string, string> | undefined;
         } | undefined;
         requestTransform?: {
             profile?: "openai-proxy" | undefined;
@@ -319,6 +320,8 @@ export interface ProviderDiscoveryState {
 export interface CanonicalModelQueryOptions {
     availableOnly?: boolean;
     candidates?: readonly Model<Api>[];
+    /** Session whose canonical stickiness should scope the lookup, when the caller has one. */
+    sessionId?: string;
 }
 /**
  * Model registry - loads and manages models, resolves API keys via AuthStorage.

package/dist/types/config/models-config-schema.d.ts

@@ -265,6 +265,7 @@ export declare const ProviderDiscoverySchema: z.ZodObject<{
         "llama.cpp": "llama.cpp";
         "openai-models-list": "openai-models-list";
     }>;
+    apiByModelPrefix: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strip>;
 export declare const ProviderAuthSchema: z.ZodEnum<{
     none: "none";
@@ -375,6 +376,7 @@ export declare const ModelsConfigSchema: z.ZodObject<{
                 "llama.cpp": "llama.cpp";
                 "openai-models-list": "openai-models-list";
             }>;
+            apiByModelPrefix: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         }, z.core.$strip>>;
         requestTransform: z.ZodOptional<z.ZodObject<{
             profile: z.ZodOptional<z.ZodEnum<{

package/dist/types/session-import/redact.d.ts

@@ -8,7 +8,7 @@
  */
 export declare const IMPORT_REDACTED_PLACEHOLDER = "[REDACTED]";
 /** Bumped when patterns change; persisted in import provenance. */
-export declare const IMPORT_SANITIZER_VERSION = 3;
+export declare const IMPORT_SANITIZER_VERSION = 4;
 export interface ImportRedactionResult {
     value: string;
     redacted: number;

package/dist/types/skc-runtime/ultragoal-runtime.d.ts

@@ -264,7 +264,19 @@ export declare function recordUltragoalNudgeIfBudgetRemaining(input: {
     reason: string;
     currentGoalObjective?: string;
 }): Promise<UltragoalNudgeOutcome>;
-export declare function writePlan(cwd: string, plan: UltragoalPlan, sessionId?: string | null): Promise<void>;
+export declare function writePlan(cwd: string, plan: UltragoalPlan, sessionId?: string | null, options?: {
+    lockHeld?: boolean;
+}): Promise<void>;
+/**
+ * The single exclusion that decides who owns an Ultragoal run.
+ *
+ * Establishing ownership is a read-decide-write sequence: a start reads the plan,
+ * checks the outgoing succession fence, then commits `active`. Every caller that
+ * decides ownership — source admission, succession offer, and successor
+ * publication — runs that decision inside this lock, keyed on the plan.
+ */
+export declare function withUltragoalPlanOwnership<T>(cwd: string, sessionId: string, fn: () => Promise<T>): Promise<T>;
+export declare function resolveUltragoalOwnershipSession(cwd: string, sessionId?: string | null): Promise<string>;
 export declare function nonEmptyString(value: unknown): string | null;
 export declare function stringArray(value: unknown): string[] | null;
 export declare function hashPipelineMetadata(metadata: Omit<UltragoalPipelineMetadata, "metadataHash">): string;

package/dist/types/skc-runtime/ultragoal-succession.d.ts

@@ -0,0 +1,251 @@
+import { type RepositoryBinding } from "./repository-binding";
+import { type UltragoalCommandResult, type UltragoalGoalStatus, type UltragoalPlan, type UltragoalSkcGoalMode } from "./ultragoal-runtime";
+export declare const ULTRAGOAL_SUCCESSION_OPERATION_SCHEMA: "skc.ultragoal_succession_operation.v1";
+export declare const ULTRAGOAL_SUCCESSION_OFFER_SCHEMA: "skc.ultragoal_succession_offer.v1";
+export declare const ULTRAGOAL_SUCCESSION_FENCE_SCHEMA: "skc.ultragoal_succession_fence.v1";
+export declare const ULTRAGOAL_SUCCESSION_ADOPTION_SCHEMA: "skc.ultragoal_succession_adoption.v1";
+export declare const ULTRAGOAL_SUCCESSION_CLAIM_SCHEMA: "skc.ultragoal_succession_claim.v1";
+export declare const SUCCESSION_ADOPTED_EVENT: "succession_adopted";
+export type UltragoalSuccessionErrorCode = "source_plan_missing" | "source_not_quiescent" | "invalid_selection" | "unsafe_target" | "authorization_required" | "divergent_operation" | "goal_handed_off" | "adoption_unpublished" | "publication_conflict" | "published_plan_missing" | "fence_missing" | "fence_mismatch" | "source_changed" | "offer_untrusted" | "offer_path_escape" | "target_mismatch" | "target_occupied" | "duplicate_adoption";
+export declare class UltragoalSuccessionError extends Error {
+    readonly code: UltragoalSuccessionErrorCode;
+    constructor(code: UltragoalSuccessionErrorCode, message: string);
+}
+export interface UltragoalSuccessionArtifactDigests {
+    briefSha256: string;
+    goalsSha256: string;
+    ledgerSha256: string;
+}
+export interface UltragoalSuccessionCarriedGoal {
+    sourceGoalId: string;
+    title: string;
+    /** The source objective, verbatim. Never a summary. */
+    objective: string;
+    /** Historical provenance only; never a receipt. */
+    sourceStatusAtOffer: UltragoalGoalStatus;
+    unresolvedObligations: string[];
+    /**
+     * Source dependency groups this goal belonged to, carried as an obligation
+     * with explicit id mapping. The group's *metadata* (batch hashes, receipts)
+     * is deliberately not carried — that would be inherited validation authority.
+     * What is carried is the requirement that these goals be validated together.
+     */
+    dependencyGroups: UltragoalSuccessionDependencyGroup[];
+}
+export type UltragoalSuccessionDependencyGroupKind = "validation-batch" | "review-blocker";
+export interface UltragoalSuccessionDependencyGroup {
+    kind: UltragoalSuccessionDependencyGroupKind;
+    groupId: string;
+    memberSourceGoalIds: string[];
+    /** For validation batches: the source goal that closed the batch. */
+    finalSourceGoalId?: string;
+}
+/**
+ * Per-selected-goal snapshot of exactly what was offered.
+ *
+ * Admission compares *this*, not whole-file equality. The fence deliberately
+ * leaves unselected goals schedulable, so ordinary source progress moves
+ * `goals.json`/`ledger.jsonl` bytes; requiring whole-file equality would
+ * permanently strand the selected work through drift that never touched it
+ * (issue #5353 review item 3). Whole-file digests remain recorded as provenance
+ * and any observed drift is written into the adoption record.
+ */
+export interface UltragoalSuccessionSelectionSnapshot {
+    /** The brief carries global constraints, so it must not change. */
+    briefSha256: string;
+    goals: Array<{
+        sourceGoalId: string;
+        recordSha256: string;
+        obligationsSha256: string;
+    }>;
+    snapshotSha256: string;
+}
+export interface UltragoalSuccessionOffer {
+    schema: typeof ULTRAGOAL_SUCCESSION_OFFER_SCHEMA;
+    operationId: string;
+    createdAt: string;
+    source: {
+        sessionId: string;
+        repository: RepositoryBinding;
+        /** Whole-file digests at offer time. Provenance; not the admission test. */
+        artifacts: UltragoalSuccessionArtifactDigests;
+        /** The authoritative admission test for "did the offered work change". */
+        selectionSnapshot: UltragoalSuccessionSelectionSnapshot;
+        skcGoalMode: UltragoalSkcGoalMode;
+    };
+    target: {
+        repository: RepositoryBinding;
+    };
+    selection: {
+        goalIds: string[];
+    };
+    carryover: {
+        /** The source brief, verbatim. */
+        brief: string;
+        goals: UltragoalSuccessionCarriedGoal[];
+    };
+    authorization: {
+        statement: string;
+        authorizedBy: string;
+    };
+    provenanceNotice: string;
+}
+export interface UltragoalSuccessionFence {
+    schema: typeof ULTRAGOAL_SUCCESSION_FENCE_SCHEMA;
+    operationId: string;
+    createdAt: string;
+    sourceSessionId: string;
+    sourceRepository: RepositoryBinding;
+    targetRepository: RepositoryBinding;
+    selectedGoalIds: string[];
+    sourceArtifacts: UltragoalSuccessionArtifactDigests;
+    offerPath: string;
+    offerSha256: string;
+}
+export interface UltragoalSuccessionGoalMapping {
+    sourceGoalId: string;
+    targetGoalId: string;
+}
+export interface UltragoalSuccessionAdoption {
+    schema: typeof ULTRAGOAL_SUCCESSION_ADOPTION_SCHEMA;
+    operationId: string;
+    status: "pending" | "published";
+    claimedAt: string;
+    publishedAt?: string;
+    targetSessionId: string;
+    targetRepository: RepositoryBinding;
+    source: {
+        sessionId: string;
+        repository: RepositoryBinding;
+        artifacts: UltragoalSuccessionArtifactDigests;
+        /** Whole-file digests observed at adoption; may differ from the offer. */
+        artifactsAtAdoption: UltragoalSuccessionArtifactDigests;
+        /** Whole-file drift on goals the offer did not select, recorded honestly. */
+        unselectedDrift: string[];
+        verifiedAt: string;
+    };
+    goalMap: UltragoalSuccessionGoalMapping[];
+    /**
+     * Content digest of the plan this operation is entitled to publish, recorded
+     * before publication. A pending replay may only proceed when the target plan
+     * is absent or matches this exactly; anything else is someone else's work.
+     */
+    expectedPlanDigest: string;
+    /** Pinned so the published plan is a deterministic function of the claim. */
+    plannedAt: string;
+    offerPath: string;
+    offerSha256: string;
+    fencePath: string;
+    claimPath: string;
+    authorization: {
+        statement: string;
+        authorizedBy: string;
+    };
+    provenanceNotice: string;
+}
+/**
+ * Repository-wide adoption claim.
+ *
+ * The session-scoped adoption record cannot be the exclusion primitive: two
+ * simultaneous sessions in one repository each create their own file and both
+ * win. This claim is a single O_EXCL file per operation for the whole
+ * repository, so exclusion is atomic rather than scan-then-write.
+ */
+export interface UltragoalSuccessionRepositoryClaim {
+    schema: typeof ULTRAGOAL_SUCCESSION_CLAIM_SCHEMA;
+    operationId: string;
+    targetSessionId: string;
+    targetWorktreeRoot: string;
+    targetCommonDir: string | null;
+    claimedAt: string;
+}
+export declare function ultragoalSuccessionDir(cwd: string, sessionId: string): string;
+export declare function ultragoalSuccessionFencePath(cwd: string, sessionId: string): string;
+export declare function ultragoalSuccessionAdoptionPath(cwd: string, sessionId: string): string;
+export declare function ultragoalSuccessionOfferPath(cwd: string, sessionId: string, operationId: string): string;
+/**
+ * Repository-wide (deliberately NOT session-scoped) adoption claim.
+ *
+ * Session directories cannot express "this repository has already adopted this
+ * operation", so the exclusion primitive lives beside them under the shared
+ * ultragoal root that `getUltragoalPaths` already uses for session-less state.
+ */
+export declare function ultragoalSuccessionClaimPath(cwd: string, operationId: string): string;
+/** Read the durable outgoing ownership fence for a source session, if any. */
+export declare function readUltragoalSuccessionFence(cwd: string, sessionId: string): Promise<UltragoalSuccessionFence | null>;
+/** Read the durable adoption claim for a target session, if any. */
+export declare function readUltragoalSuccessionAdoption(cwd: string, sessionId: string): Promise<UltragoalSuccessionAdoption | null>;
+/**
+ * Source admission guard: a goal that has been handed off to a successor run is
+ * no longer this run's to schedule or checkpoint.
+ *
+ * Goals outside the fenced selection stay fully schedulable — the fence defines
+ * one owner per goal, not a freeze of the whole source run.
+ */
+export declare function assertUltragoalGoalNotFenced(cwd: string, sessionId: string | null | undefined, goalId: string): Promise<void>;
+/**
+ * Target admission guard: an adoption that has not finished publishing does not
+ * yet own anything.
+ *
+ * Publication writes `goals.json` before it marks the claim published, so a
+ * crash leaves a *visible plan with an unpublished claim*. A visible plan is not
+ * admission evidence — the claim is. Without this, the target executes goals
+ * whose adoption was never completed, and the run's own completion receipts
+ * would rest on a transaction that never committed.
+ *
+ * Callers must invoke this before any mutation so a refusal leaves `goals.json`
+ * and `ledger.jsonl` untouched.
+ */
+export declare function assertUltragoalAdoptionPublished(cwd: string, sessionId: string | null | undefined): Promise<void>;
+export interface UltragoalSuccessionOfferInput {
+    cwd: string;
+    sessionId?: string | null;
+    targetRepositoryPath: string;
+    goalIds: readonly string[];
+    authorization: string;
+    authorizedBy: string;
+}
+export interface UltragoalSuccessionOfferResult {
+    operationId: string;
+    offerPath: string;
+    fencePath: string;
+    offer: UltragoalSuccessionOffer;
+    /** True when an identical prior operation was reconciled instead of re-recorded. */
+    reconciled: boolean;
+}
+/**
+ * Record an explicit successor offer and fence the selected goals off from the
+ * source run. Writes nothing to the source brief, goals or ledger.
+ */
+export declare function offerUltragoalSuccession(input: UltragoalSuccessionOfferInput): Promise<UltragoalSuccessionOfferResult>;
+export interface UltragoalSuccessionAdoptInput {
+    cwd: string;
+    sessionId?: string | null;
+    offerPath: string;
+    skcGoalMode?: UltragoalSkcGoalMode;
+}
+export interface UltragoalSuccessionAdoptResult {
+    operationId: string;
+    adoptionPath: string;
+    plan: UltragoalPlan;
+    goalMap: UltragoalSuccessionGoalMapping[];
+    reconciled: boolean;
+}
+/**
+ * Adopt an explicit successor offer into this repository/session.
+ *
+ * Fails closed on a forged or stale offer, a changed source, a missing source
+ * fence, an unnamed target, an occupied target, and any duplicate or divergent
+ * adoption anywhere in this repository. A retry reconciles the exact recorded
+ * operation or fails closed; it never resumes a different one.
+ */
+export declare function adoptUltragoalSuccession(input: UltragoalSuccessionAdoptInput): Promise<UltragoalSuccessionAdoptResult>;
+/**
+ * `skc ultragoal succession <offer|adopt|status>`.
+ *
+ * Kept out of `RECONCILE_COMMANDS` on purpose: the reconcile pass appends a
+ * `reconcile_failed` ledger row on failure, which would move the very source
+ * digests this feature records. The target's workflow state and HUD reconcile on
+ * the next ordinary `skc ultragoal status`.
+ */
+export declare function runUltragoalSuccessionCommand(args: readonly string[], cwd: string): Promise<UltragoalCommandResult>;

package/dist/types/skc-runtime/workflow-placeholder.d.ts

@@ -0,0 +1,6 @@
+/** Shared placeholder semantics for model-authored workflow content. */
+export declare const WORKFLOW_PLACEHOLDER_CORRECTION = "provide a specific, non-placeholder question or objective instead of empty, whitespace, unused, TODO, TBD, N/A, N-A, NA, none, placeholder, or stub";
+/** Exact, case-insensitive placeholder detection; meaningful sentences remain valid. */
+export declare function isWorkflowPlaceholderText(value: unknown): boolean;
+/** Detect a legacy formatted deep-interview ask whose visible body is a placeholder. */
+export declare function isLegacyDeepInterviewPlaceholder(value: unknown): boolean;