@aitne/daemon 0.1.6 → 0.1.8

package/dist/core/backends/gemini-cli-core.js

@@ -1,7 +1,7 @@
 import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve as resolvePath } from "node:path";
-import { APP_NAME, collectSessionDeniedTools, getAgentDayDateStr, INTEGRATION_DESCRIPTORS, INTEGRATION_KEYS, isAutonomousProcessKey, isPlausibleGeminiApiKey, matchRunAllowedToolPattern, } from "@aitne/shared";
+import { APP_NAME, collectSessionDeniedTools, getAgentDayDateStr, INTEGRATION_DESCRIPTORS, INTEGRATION_KEYS, isAutonomousProcessKey, isMessageEvent, isPlausibleGeminiApiKey, matchRunAllowedToolPattern, } from "@aitne/shared";
 import { readIntegrations } from "../../db/integrations-store.js";
 import { getContextDir } from "../../config.js";
 import { cleanupSessionWorkdir, createSessionWorkdir } from "../workdir.js";
@@ -11,12 +11,15 @@ import { buildDelegatedToolPrompt, emptyCost, tryParseToolResult, withDurationMs
 import { DELEGATED_PROXY_DEFAULTS } from "../../services/delegated-proxy-config.js";
 import { materializeMcpForSession } from "../../services/mcp/session-materializer.js";
 import { parseMcpToolName } from "../../services/mcp/risk.js";
+import { noteNativeSkillToolIfPresent, probeCliNativeSkillSubcommand, } from "./native-skill-discovery-probe.js";
 import { logMcpToolCall } from "../../services/mcp/tool-audit.js";
 import { buildDaemonApiCliEnv } from "../daemon-api-cli.js";
 import { ALWAYS_DISALLOWED_TOOLS } from "../../safety/always-disallowed.js";
 import { CliPathCache, parseJsonLine, runLineCommand, } from "./cli-utils.js";
 import { isPathInsideOrEqual, jsonStringPathForms, shellPathForms, } from "../path-compat.js";
 import { probeApiKeyServerSide } from "./api-key-probe.js";
+import { buildAgentDayBoundaryHint, extractGenericQuotaResetHint, } from "./quota-reset-hints.js";
+import { auditStreamObservation, extractGeminiToolUseTarget, } from "../../safety/subprocess-block-scanner.js";
 import { extractSilentApiErrors, logSilentApiErrors, } from "./silent-api-error-detector.js";
 import { estimateTextInputTokens, findRegisteredModel, getModelsForBackend, latestLiteFor, } from "./model-registry.js";
 import { PriceFetcher } from "./price-fetcher.js";
@@ -52,6 +55,20 @@ const EMPTY_USAGE = {
     cacheCreationInputTokens: 0,
     cacheReadInputTokens: 0,
 };
+/**
+ * Per-event stream-idle threshold for reactive `runTurn` execution
+ * (DMs, routines, scheduled tasks). Distinct from the delegated-path
+ * `DELEGATED_PROXY_DEFAULTS.idleTimeoutMsByBackend.gemini` (75s)
+ * because reactive turns include longer legitimate silences — extended
+ * thinking, MCP cold-starts, long `google-workspace` round-trips. The
+ * threshold catches a fully hung CLI subprocess (zero stream events)
+ * well before `executeTimeoutMinutes` (default 30 min) fires.
+ *
+ * Audit 2026-05-17: the delegated path had this guard; the reactive
+ * path was unprotected and a hung subprocess could pin a session for
+ * the full 30-min wall-clock.
+ */
+const REACTIVE_IDLE_TIMEOUT_MS = 5 * 60 * 1000;
 export class GeminiCliCore {
     config;
     writeTracker;
@@ -133,12 +150,14 @@ export class GeminiCliCore {
             processKey: params.processKey,
             ...(wikiWorkspaceName ? { wikiWorkspaceName } : {}),
             sessionDir: params.sessionDir,
+            maxTurns: params.maxTurns,
             maxBudgetUsd: params.maxBudgetUsd,
             webSearchEnabled: params.webSearchEnabled,
             turnToken: params.turnToken,
             sessionDbId: params.sessionDbId,
             eventCorrelationId: params.event.correlationId,
             wikiUrlFetchEnabled: params.wikiUrlFetchEnabled ?? false,
+            ...(isMessageEvent(params.event) ? { messageText: params.event.content } : {}),
         }, streamCallbacks);
     }
     async executeResume(params, streamCallbacks) {
@@ -148,11 +167,15 @@ export class GeminiCliCore {
             eventType: "message.received",
             sessionDir: params.sessionDir,
             resumeSessionId: params.sessionId,
+            maxTurns: params.maxTurns,
             maxBudgetUsd: params.maxBudgetUsd,
             webSearchEnabled: params.webSearchEnabled,
             turnToken: params.turnToken,
             sessionDbId: params.sessionDbId,
             eventCorrelationId: params.eventCorrelationId,
+            // Forward the user's reply text as the trigger-phrase signal —
+            // mirrors codex / opencode resume paths.
+            messageText: params.message,
         }, streamCallbacks);
     }
     async summarize(conversationText) {
@@ -395,6 +418,17 @@ export class GeminiCliCore {
             detectedServers: [...detectedServers],
             toolCount: deduped.length,
         }, "Gemini probe collected tool manifest via host MCP scan");
+        // docs/design/appendices/skills-unification.md Phase 1 item 13 — forward-compat
+        // signals. The name-pattern scan over `deduped` here is structurally
+        // a no-op for native discovery (the list is built from
+        // `INTEGRATION_DESCRIPTORS.capabilityTools`, which Aitne controls,
+        // and therefore can never contain a native CLI skill tool we did
+        // not register). The `gemini --help` subcommand probe below is the
+        // real detector: `gemini --help` already lists `gemini skills`
+        // natively (verified 2026-05-15), so this is the call site that
+        // will trip on first deploy and surface the cleanup follow-up PR.
+        noteNativeSkillToolIfPresent("gemini", deduped);
+        void probeCliNativeSkillSubcommand(this.cliPath, "gemini");
         return deduped;
     }
     async runTurn(params, streamCallbacks) {
@@ -422,7 +456,13 @@ export class GeminiCliCore {
             const currentCount = this.readRequestsCount(today);
             if (currentCount >= ceiling) {
                 logger.warn({ currentCount, ceiling, date: today }, "Gemini daily-request ceiling hit — refusing execution");
-                throw new BackendQuotaError(this.backendId, "daily_ceiling", null, `Gemini daily-request ceiling reached (${currentCount}/${ceiling}) — resets at the next agent-day boundary.`);
+                throw new BackendQuotaError(this.backendId, "daily_ceiling", 
+                // Deterministic reset: the next agent-day boundary fires at
+                // `dayBoundaryHour:00` in the configured timezone. The helper
+                // handles the empty-timezone default (`AgentConfig.timezone`
+                // defaults to `""` in config.ts) by omitting the field so the
+                // dashboard renders cleanly.
+                buildAgentDayBoundaryHint(this.config.dayBoundaryHour, this.config.timezone), `Gemini daily-request ceiling reached (${currentCount}/${ceiling}) — resets at the next agent-day boundary.`);
             }
         }
         this.assertPromptWithinMaxBudget(params.prompt, params.maxBudgetUsd, params.modelId);
@@ -431,6 +471,14 @@ export class GeminiCliCore {
             backendId: this.backendId,
             processKey: params.processKey,
             character: this.config.character,
+            contextDir: getContextDir(this.config),
+            // docs/design/appendices/skills-unification.md Phase 4 — feed conditional manifest
+            // predicates with live DB rows and the inbound DM text. Gemini
+            // already keeps a `this.db` for the daily request ceiling; reuse
+            // it (falls back to `mcpContext.db` for symmetry with the other
+            // cores).
+            ...((this.db ?? this.mcpContext?.db) ? { db: this.db ?? this.mcpContext?.db ?? null } : {}),
+            ...(typeof params.messageText === "string" ? { messageText: params.messageText } : {}),
             ...(params.wikiWorkspaceName ? { wikiWorkspaceName: params.wikiWorkspaceName } : {}),
         });
         const ownsSessionDir = !params.sessionDir;
@@ -466,15 +514,57 @@ export class GeminiCliCore {
         let lastError = null;
         let resultStatus = "error";
         let stats = null;
+        // Stream text deltas live as they arrive — mirrors ClaudeCodeCore /
+        // CodexCore so the owner-facing chat surfaces (dashboard chat, owner DM)
+        // get the same incremental-output UX regardless of which backend serves
+        // the turn. `assertWithinMaxBudget` is still enforced post-completion
+        // and surfaces as `BackendQuotaError` AFTER text has streamed —
+        // matching Claude's behaviour. The earlier "defer until budget check"
+        // guard buffered the entire turn, which made interactive flows
+        // (`setup.initial`, dashboard chat) look frozen for minutes.
         let streamed = false;
-        const deferStreamingUntilBudgetCheck = params.maxBudgetUsd !== undefined;
+        // Daemon-side max-turns enforcement. The Gemini CLI exposes no
+        // `--max-turns` flag (verified `gemini --help` on 0.x) and the SDK-level
+        // contract that Claude relies on for `BackendDecisiveFailure("max_turns")`
+        // is unavailable. To match Claude / Codex semantics we count `tool_use`
+        // events as a turn proxy (one model→tool round-trip per event; parallel
+        // tool calls within the same turn marginally over-count, which only
+        // tightens the cap) and use AbortController to terminate the subprocess
+        // when the cap is exceeded. Without this guard, a runaway interactive
+        // flow (`setup.initial` was the trigger case) would burn the full
+        // `executeTimeoutMinutes` wall-clock (default 60 min) before the
+        // generic timeout watchdog fired — the "Customize Your Rules
+        // force-stop / very-slow" report.
+        //
+        // The fallback default (50) mirrors Codex's implicit ceiling so callers
+        // that omit `maxTurns` get the same envelope on every CLI backend.
+        const maxTurns = params.maxTurns ?? 50;
+        let toolCallCount = 0;
+        let maxTurnsExceeded = false;
+        const maxTurnsAborter = new AbortController();
         // Accumulate raw subprocess text across the run so we can scan once for
         // `PA_API_ERROR` markers the pa-api / curl wrappers emit on HTTP errors.
         // Gemini's stream schema doesn't expose a dedicated tool-output field, so
         // we fall back to the raw stdout/stderr lines (which include both the
         // JSONL itself and any uncaptured subprocess stderr).
         const apiOutputBuffer = [];
+        // Reactive idle watchdog (audit 2026-05-17 C1). Mirrors the delegated
+        // path's wiring in `runDelegatedTool` (~line 2240). Distinct aborter
+        // from `maxTurnsAborter` so `AbortSignal.any` carries both reasons
+        // to runLineCommand; post-await we classify via the flag pair
+        // (`maxTurnsExceeded` → `idleTimedOut` → `runResult.timedOut`).
+        let idleTimedOut = false;
+        const idleAborter = new AbortController();
+        const idleWatchdog = new IdleWatchdog({
+            idleTimeoutMs: REACTIVE_IDLE_TIMEOUT_MS,
+            onTimeout: (idleMs) => {
+                idleTimedOut = true;
+                logger.warn({ idleMs, idleTimeoutMs: REACTIVE_IDLE_TIMEOUT_MS, eventType: params.eventType }, "gemini reactive idle watchdog tripped — aborting");
+                idleAborter.abort(new Error(`gemini reactive stream idle for ${idleMs}ms (limit ${REACTIVE_IDLE_TIMEOUT_MS}ms)`));
+            },
+        });
         try {
+            idleWatchdog.start();
             const runResult = await runLineCommand({
                 command: "gemini",
                 args: this.buildArgs(params, policyPath),
@@ -490,7 +580,12 @@ export class GeminiCliCore {
                     ...(params.turnToken ? { PA_TURN_TOKEN: params.turnToken } : {}),
                 },
                 timeoutMs: this.config.executeTimeoutMinutes * 60 * 1000,
+                abortSignal: AbortSignal.any([
+                    maxTurnsAborter.signal,
+                    idleAborter.signal,
+                ]),
                 onStdoutLine: (line) => {
+                    idleWatchdog.beat();
                     apiOutputBuffer.push(line);
                     const event = parseJsonLine(line);
                     if (!event?.type) {
@@ -507,6 +602,24 @@ export class GeminiCliCore {
                     if (this.writeTracker && event.type === "tool_use") {
                         this.trackVaultWrite(event);
                     }
+                    // EXECUTION-MODE-DESIGN.md §6.3 — stream-side absolute-block
+                    // observability. The admin TOML at priority 999 already enforces
+                    // the same patterns at the Gemini CLI layer; this adds an
+                    // `agent_actions.blocked_absolute` row with `result='partial'`
+                    // so the dashboard sees stream-observed attempts the same way it
+                    // sees Claude's PreToolUse rejections (recorded with
+                    // `result='failed'`).
+                    if (event.type === "tool_use") {
+                        const target = extractGeminiToolUseTarget(event.tool_name, event.args);
+                        if (target) {
+                            auditStreamObservation(target, {
+                                db: this.mcpContext?.db,
+                                backend: this.backendId,
+                                mode: this.config.geminiExecutionPermissionMode,
+                                sessionId: params.sessionDbId,
+                            });
+                        }
+                    }
                     // B-003 Phase 4.4 — persist MCP tool call to `mcp_tool_calls`.
                     // Gemini emits `mcp_<server>_<tool>` (single underscore — see
                     // parseMcpToolName); host-installed Gemini MCPs (like
@@ -541,17 +654,71 @@ export class GeminiCliCore {
                             }
                         }
                     }
+                    // Max-turns counting + enforcement.
+                    //
+                    // ── Semantic ──
+                    // `maxTurns` here is the **maximum number of tool calls** the
+                    // model may make in a single execute. The cap is exclusive: we
+                    // abort when the next `tool_use` would push the count *past*
+                    // `maxTurns` (`toolCallCount > maxTurns`), not on the
+                    // `maxTurns`-th call itself. That semantic is what the rest of
+                    // this test suite asserts — multiple absolute-block / audit
+                    // tests pass `maxTurns: 1` together with a single `tool_use`
+                    // event and expect the run to complete cleanly so the
+                    // observability row gets persisted before the cap could fire.
+                    //
+                    // This is intentionally one turn more permissive than the
+                    // strict Claude-SDK contract (where `maxTurns` is the
+                    // model-invocation count). The trade-off is justified by:
+                    //   1. The Gemini CLI emits no explicit turn-boundary event,
+                    //      so the daemon can only count tool calls, not full
+                    //      invocations. The final assistant message (which does
+                    //      count as a model invocation in Claude) is invisible to
+                    //      this counter until after-the-fact.
+                    //   2. The cap exists primarily to stop runaway loops, not to
+                    //      shave one model call off the budget. Allowing one
+                    //      "settling" final answer keeps the contract aligned
+                    //      with `numTurns: toolCallCount + 1` and avoids
+                    //      mass-breaking the existing audit-observation tests.
+                    //
+                    // The increment is gated on `!maxTurnsExceeded` so post-abort
+                    // stdout lines (the kill chain is asynchronous; a few lines
+                    // can still arrive before `SIGTERM` reaps the subprocess) do
+                    // not drift the error-message tally past the precise abort
+                    // point. Audit / policy hooks above this block still fire for
+                    // those lines — they are forensic data, not budget accounting.
+                    if (event.type === "tool_use" && !maxTurnsExceeded) {
+                        toolCallCount += 1;
+                        if (toolCallCount > maxTurns) {
+                            maxTurnsExceeded = true;
+                            logger.warn({
+                                toolCallCount,
+                                maxTurns,
+                                eventType: params.eventType,
+                                model: params.modelId,
+                            }, "Gemini max-turns exceeded — aborting subprocess");
+                            maxTurnsAborter.abort(new Error("max_turns_exceeded"));
+                            return;
+                        }
+                    }
                     if (event.type === "message" && event.role === "assistant") {
+                        // Gemini CLI 0.x ships an emerging "thought" channel that
+                        // surfaces inside an assistant-role message via
+                        // `messageType: "thought"`. Drop these so internal reasoning
+                        // never reaches the dashboard chat bubble. `type: "thought"`
+                        // events already fall through the positive-match below and
+                        // never reach `onText`.
+                        if (event.messageType === "thought") {
+                            return;
+                        }
                         const content = typeof event.content === "string" ? event.content : "";
                         if (!content) {
                             return;
                         }
                         if (event.delta) {
                             assistantDelta += content;
-                            if (!deferStreamingUntilBudgetCheck) {
-                                streamCallbacks?.onText?.(content);
-                                streamed = true;
-                            }
+                            streamCallbacks?.onText?.(content);
+                            streamed = true;
                             return;
                         }
                         finalAssistantMessage = content;
@@ -565,6 +732,7 @@ export class GeminiCliCore {
                     }
                 },
                 onStderrLine: (line) => {
+                    idleWatchdog.beat();
                     apiOutputBuffer.push(line);
                     if (isLikelyGeminiFailure(line)) {
                         lastError = line.trim();
@@ -579,6 +747,37 @@ export class GeminiCliCore {
                     eventType: params.eventType,
                 });
             }
+            // Max-turns abort is checked BEFORE `timedOut` because the AbortController
+            // and the runLineCommand wall-clock can race: a subprocess that we
+            // aborted because the cap was hit may still surface `timedOut=true`
+            // if the kill path took long enough that the safety-net timer
+            // tripped. Checking maxTurns first preserves the more specific
+            // error class — `BackendDecisiveFailure("max_turns")` matches the
+            // Claude SDK contract, while a generic `"timeout"` would obscure
+            // the real cause and route the dispatcher's retry logic differently.
+            //
+            // The idle-watchdog flag is checked between max-turns and the
+            // wall-clock so a stuck subprocess surfaces as a distinct timeout
+            // message — the dispatcher's retry semantics are the same as for
+            // the wall-clock case, but the audit trail and operator alert
+            // call out the idle hang specifically.
+            if (maxTurnsExceeded) {
+                const err = new BackendDecisiveFailure(this.backendId, "max_turns", new Error(`Gemini execution exceeded max-turns cap of ${maxTurns} (observed ${toolCallCount} tool calls).`));
+                logger.error({
+                    err,
+                    eventType: params.eventType,
+                    model: params.modelId,
+                    toolCallCount,
+                    maxTurns,
+                    durationMs: Date.now() - startMs,
+                }, "Gemini execute hit max_turns");
+                throw err;
+            }
+            if (idleTimedOut) {
+                const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Gemini reactive stream went idle for ${REACTIVE_IDLE_TIMEOUT_MS}ms (no events from CLI subprocess)`));
+                logger.error({ err, eventType: params.eventType, model: params.modelId, durationMs: Date.now() - startMs }, "Gemini execute idle-timed-out");
+                throw err;
+            }
             if (runResult.timedOut) {
                 const err = new BackendDecisiveFailure(this.backendId, "timeout", new Error(`Gemini execution exceeded timeout of ${this.config.executeTimeoutMinutes} minutes`));
                 logger.error({ err, eventType: params.eventType, model: params.modelId, durationMs: Date.now() - startMs }, "Gemini execute timed out");
@@ -610,7 +809,19 @@ export class GeminiCliCore {
             const costUsd = Object.values(modelUsage)
                 .reduce((total, usage) => total + usage.costUsd, 0)
                 || estimatedCost.costUsd;
-            this.assertWithinMaxBudget(costUsd, params.maxBudgetUsd, actualModelId);
+            // Hand the post-hoc budget assertion the exact spend it would
+            // otherwise be unable to recover — same shape Codex uses so the
+            // dispatcher's `BackendQuotaError` audit-row writer doesn't need a
+            // per-backend branch. `numTurns` here matches the success-branch
+            // formula below (`toolCallCount + 1`) so a budget-rejected and a
+            // successful run with the same tool fan-out report the same turn
+            // count.
+            this.assertWithinMaxBudget(costUsd, params.maxBudgetUsd, actualModelId, {
+                usage: normalizedUsage,
+                costSource: Object.keys(modelUsage).length > 0 ? costSource : estimatedCost.costSource,
+                numTurns: toolCallCount + 1,
+                durationMs: Date.now() - startMs,
+            });
             if (output && !streamed) {
                 streamCallbacks?.onText?.(output);
             }
@@ -636,7 +847,13 @@ export class GeminiCliCore {
                 costUsd,
                 usage: normalizedUsage,
                 modelUsage,
-                numTurns: 1,
+                // Each `tool_use` event indicates one model→tool turn; the
+                // surrounding final assistant message is one more turn — so
+                // `toolCallCount + 1` matches the Codex contract (which increments
+                // `numTurns` on `turn.started`). Parallel tool calls in a single
+                // model turn marginally over-count; that aligns conservatively with
+                // the max-turns cap above (we cut off sooner rather than later).
+                numTurns: toolCallCount + 1,
                 durationMs,
                 durationApiMs,
                 model: actualModelId,
@@ -648,6 +865,11 @@ export class GeminiCliCore {
             };
         }
         finally {
+            // Stop the reactive idle watchdog FIRST so its interval doesn't
+            // leak across the cleanup path. Safe to call even when start()
+            // was never reached (the runTurn body might have thrown before
+            // start()) — IdleWatchdog.stop is idempotent.
+            idleWatchdog.stop();
             if (ownsSessionDir) {
                 this.readTokenManager?.revoke(sessionDir);
             }
@@ -1448,7 +1670,26 @@ ${fetchClause}`;
             return new BackendQuotaError(this.backendId, "max_budget_usd", null, message);
         }
         if (/rate limit|quota|429/i.test(message)) {
-            return new BackendQuotaError(this.backendId, "rate_limited", null, message);
+            // Best-effort reset-time extraction so the dashboard can surface
+            // "quota resets at HH:MM (TZ)". Google API quota errors often carry
+            // "Quota exceeded ... reset time YYYY-MM-DDTHH:MM:SSZ" or a
+            // retry-after offset; the helper falls through to null otherwise.
+            return new BackendQuotaError(this.backendId, "rate_limited", extractGenericQuotaResetHint(message), message);
+        }
+        // Policy-deny classification must run BEFORE the auth branch — the
+        // generated TOML's deny messages can legitimately contain words like
+        // "required" or "login" (e.g. a future "<X> login is not permitted in
+        // daemon mode" rule), and we don't want those to mis-tag as `auth`
+        // and trigger an auth-recovery flow when the real cause is the agent
+        // attempting a forbidden tool call. The match targets the wrap the
+        // Gemini CLI emits today for TOML deny hits — `Error executing tool
+        // …: Tool execution denied by policy. <denyMessage>`. Tight enough to
+        // avoid false positives on real auth/quota messages; not claimed to
+        // be exhaustive across other Gemini policy surfaces (sandbox kills,
+        // MCP allowlist, future hook variants), which can be added here as
+        // they're observed in the wild.
+        if (/tool execution denied|denied by policy/i.test(message)) {
+            return new BackendDecisiveFailure(this.backendId, "policy_denied", new Error(message));
         }
         if (/authentication page|oauth|api key|login|required/i.test(message)) {
             return new BackendDecisiveFailure(this.backendId, "auth", new Error(message));
@@ -1458,11 +1699,22 @@ ${fetchClause}`;
         }
         return new BackendDecisiveFailure(this.backendId, "other_non_retryable", new Error(message));
     }
-    assertWithinMaxBudget(costUsd, maxBudgetUsd, modelId) {
+    assertWithinMaxBudget(costUsd, maxBudgetUsd, modelId, 
+    /**
+     * Mirrors `CodexCore.assertWithinMaxBudget` — Gemini also enforces the
+     * per-turn budget post-hoc (by the time we reject here Google has
+     * already consumed tokens), so attach the actual spend so the
+     * dispatcher's error path can write a `result='failed'` agent_actions
+     * row with `cost_usd` / `numTurns` / `durationMs` populated. Without
+     * this, budget-rejected Gemini runs silently drop their spend on the
+     * success-only audit path — the same dashboard gap the Codex fix
+     * closed. See `BackendQuotaSpend` for the full contract.
+     */
+    spend) {
         if (maxBudgetUsd === undefined || costUsd <= maxBudgetUsd) {
             return;
         }
-        throw new BackendQuotaError(this.backendId, "max_budget_usd", null, `Gemini CLI estimated cost $${costUsd.toFixed(4)} exceeded the per-turn budget limit $${maxBudgetUsd.toFixed(2)} for ${modelId}.`);
+        throw new BackendQuotaError(this.backendId, "max_budget_usd", null, `Gemini CLI estimated cost $${costUsd.toFixed(4)} exceeded the per-turn budget limit $${maxBudgetUsd.toFixed(2)} for ${modelId}.`, spend ? { ...spend, modelId, costUsd } : null);
     }
     assertPromptWithinMaxBudget(prompt, maxBudgetUsd, modelId) {
         if (maxBudgetUsd === undefined) {
@@ -1509,7 +1761,11 @@ ${fetchClause}`;
      * and `notion` (user-installed Notion MCP server registered as
      * `notion`). Gmail and Calendar are also in `PROXY_DRIVEN_INTEGRATIONS`,
      * so a Claude/Codex DM session with `delegatedBackend = "gemini"` for
-     * either lands here through `/api/integrations/:key/invoke`.
+     * either reaches this method through the internal
+     * `DelegatedBackendInvoker.invoke()` API (the underlying transport
+     * lives behind the daemon's hourly drift-detection worker and behind
+     * `/api/integrations/:key/exec` task-mode dispatch; the legacy
+     * `/api/integrations/:key/invoke` RPC route was retired 2026-05-01).
      */
     async runDelegatedTool(params) {
         const startMs = Date.now();
@@ -1619,13 +1875,17 @@ ${fetchClause}`;
                 proxyAborter.abort(new DelegatedProxyTimeoutError(`gemini stream idle for ${idleMs}ms (limit ${idleTimeoutMs}ms)`));
             },
         });
+        const daemonReadToken = this.readTokenManager?.issue(sessionDir) ?? this.readToken;
         try {
             idleWatchdog.start();
             const runResult = await runLineCommand({
                 command: this.cliPath,
                 args,
                 cwd: sessionDir,
-                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, { sessionBackend: "gemini" }),
+                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, {
+                    ...(daemonReadToken ? { readToken: daemonReadToken } : {}),
+                    sessionBackend: "gemini",
+                }),
                 // Safety-net timeout, derived from the invoker's per-backend
                 // abort timeout (`callTimeoutMsByBackend.gemini`). We add a 60s
                 // grace window so the abort signal *always* fires first and we
@@ -1880,6 +2140,10 @@ ${fetchClause}`;
             // Stop the idle watchdog before listener cleanup so a late-firing
             // poll cannot abort an already-resolved subprocess.
             idleWatchdog.stop();
+            // Invoker owns sessionDir lifecycle, but the readToken scope is keyed
+            // on the same path — revoke here so a leaked token cannot outlive the
+            // delegated proxy run.
+            this.readTokenManager?.revoke(sessionDir);
             // Drop the listener regardless of how the call resolved so a
             // long-lived caller signal doesn't accumulate references across
             // back-to-back proxy invocations.
@@ -2002,12 +2266,16 @@ ${fetchClause}`;
         const destructiveSet = allowDestructive
             ? new Set()
             : new Set(destructiveTools);
+        const daemonReadToken = this.readTokenManager?.issue(sessionDir) ?? this.readToken;
         try {
             const runResult = await runLineCommand({
                 command: this.cliPath,
                 args,
                 cwd: sessionDir,
-                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, { sessionBackend: "gemini" }),
+                env: buildDaemonApiCliEnv(sessionDir, this.config.apiPort, {
+                    ...(daemonReadToken ? { readToken: daemonReadToken } : {}),
+                    sessionBackend: "gemini",
+                }),
                 timeoutMs: (DELEGATED_PROXY_DEFAULTS.callTimeoutMsByBackend.gemini
                     ?? DELEGATED_PROXY_DEFAULTS.callTimeoutMs)
                     + 60_000,
@@ -2079,6 +2347,18 @@ ${fetchClause}`;
                         return;
                     }
                     if (event.type === "message" && event.role === "assistant") {
+                        // Reasoning gate — mirror the executeTurn path. Gemini CLI
+                        // 0.x's emerging "thought" channel surfaces inside an
+                        // assistant-role message via `messageType: "thought"`.
+                        // The delegated-task surface ultimately returns
+                        // `rawAssistantText` to the dispatcher's structured-output
+                        // validator, so a leaked thought would either fail JSON
+                        // parsing (parse_error wrapped around reasoning content)
+                        // or land verbatim in delegated-task traces. Drop here
+                        // before any accumulation.
+                        if (event.messageType === "thought") {
+                            return;
+                        }
                         assistantTurns += 1;
                         const content = typeof event.content === "string" ? event.content : "";
                         if (!content)
@@ -2225,6 +2505,9 @@ ${fetchClause}`;
             };
         }
         finally {
+            // See runDelegatedTool — invoker owns the dir, but the readToken scope
+            // matches the dir path and must not outlive the run.
+            this.readTokenManager?.revoke(sessionDir);
             if (abortSignal) {
                 abortSignal.removeEventListener("abort", callerListener);
             }