v0.11.4

Memory-free stable patch release. The experimental filesystem/MAP memory system was intentionally excluded and remains on dev for a future release.

Added

• Bracketed pastes containing complete lists of saved static-image paths can now attach up to 16 images in source order after explicit confirmation. Paste transactions are cancellation-safe, disabled in command modes, enforce source, encoded-output, dimension, and decoded-memory budgets before commit, reject animated, remote, linked, or path-swapped sources, and restore the literal paste on cancellation or failure.
• Rich tool-call rendering in the transcript viewer: both the session-observer and main-session transcript viewers now share one formatter so tool calls render identically (args summary + intent, then a result block with ✓ done / ✗ error / ⏳ pending states). Fixes a latent bug where a tool call with no result rendered as a false "✓ done"; expanded results cap at 100 source lines with raw/copy exposing the full text (#2656).

Changed

• Updated the Kimi Coding Plan Eco, Medium, and Pro presets to Kimi K3 with its supported low, high, and max reasoning efforts.

Removed

• Removed the legacy worktree cleanup implementation behind the @gajae-code/coding-agent/cli/worktree-cli and @gajae-code/coding-agent/commands/worktree package subpaths (base and .js forms). The gjc worktree/wt CLI command has been unregistered since the workflow-surface narrowing; the modules behind it (including the recursive-deletion clear path) were only reachable as package imports. The subpaths now resolve to throwing tombstone modules whose error explains the deliberate removal and the supported replacement: inspect leftover managed worktrees under ~/.gjc/wt manually and use git worktree remove / git worktree prune.

Fixed

• Telegram /btw rich-delivery E2E coverage now awaits native and daemon teardown ownership, records exact per-iteration lifecycle phases, and uses an internal exact-tuple terminal-delivery receipt to keep fallback stress deterministic under shard load without extending the original test timeout.
• Malformed spurious Round-0 review metadata no longer blocks an otherwise valid locked-intent question/gate, while durable intent safety remains fail-closed (#2643).
• Restricted role-agent gjc state command authorization now fails closed on argv-classification disagreement: one shared manifest-aware native state argv grammar (action names, flag arity, positionals, effective modifiers, selector candidates) is consumed by both runtime dispatch and the policy boundary, which rejects ambiguous selectors, malformed flags, destructive actions, and file-backed input (#2665).
• Browser tab workers now bootstrap through their actual isolated entry without accidentally loading native bindings through broad imports, and startup fails closed instead of falling back to unguarded inline execution; compiled/package smoke now exercises the tab worker, with a PR-head darwin-arm64 CI gate (#2598).
• Added evidence-preserving recovery for legacy multi-writer SDK session-index corruption: gjc gc now diagnoses corrupt prefixes, --repair-session-index quarantines the original snapshot/log under the session-index lock before atomically restoring only the checksum-valid monotonic prefix, and append failures point operators to the explicit repair path (#2654).
• Malformed selectors on internal read URLs now fail explicitly instead of silently falling back to an unbounded resource read.
• Newly registered earlier resource-GC policies advance the pending sweep without postponing an already earlier sweep.
• Provider onboarding wizard completion is now deterministic under CI load: duplicate in-flight confirmation is suppressed, success tests await the real refresh/notification/status boundary instead of fixed sleeps, and the newly configured model is verified through the subsequent model selector.
• OpenAI-compatible web search now turns malformed successful response bodies into bounded provider errors while preserving normal provider fallback (#2593).
• Windows session storage now keeps a symlink-resolved drive-letter path for Bun filesystem I/O instead of a native Volume GUID identity path, preventing ENOENT failures during resident-cache writes that could drop the final assistant message at turn completion.
• On platforms with verified retained publication identity support, detached SDK broker processes now stop after durable loss or replacement of their owned publication while preserving warm reuse and protocol/state formats (#2583). Bounded-practical limitation: requests admitted before the first definitive loss observation—or after authoritative same-object recovery and before a later loss observation—may still perform pathname-based index, ledger, lifecycle, cleanup, or child effects. A detached session-host child spawned by an admitted request may outlive broker exit and may continue pathname effects for the session lifetime. Broker self-reap does not cancel or signal that child and does not provide absolute hostile replacement isolation.

Contributors

Thanks to everyone who contributed to this release: @datell1357, @jaeyunha, @laerad777, @Oreochococukie, @thegreatesthoneybee, @VC-Kyeongmin, @Yeachan-Heo.

Full Changelog: v0.11.3...v0.11.4