@gajae-code/ai 0.16.7 → 0.17.1

package/CHANGELOG.md

@@ -2,14 +2,57 @@
 
 ## [Unreleased]
 
+## [0.17.1] - 2026-09-17
+
+## [0.17.0] - 2026-09-17
+
+### Added
+
+- Devin CLI is now a first-class provider (`devin`, api `devin-acp`). Devin publishes no model-inference endpoint, so GJC speaks its documented programmatic surface instead: it spawns `devin acp` and drives the Agent Client Protocol over stdio. Devin owns model selection (discovered from the account's ACP session `model` config option), tool execution, conversation history, and usage; GJC renders Devin's tool calls read-only and always ends the turn with a normal stop so they are never re-executed, forwards cancellation as ACP `session/cancel`, and answers Devin's permission requests from `GJC_DEVIN_PERMISSION_MODE` (`allow` grants `allow_once` and cancels when none is offered, never granting a persistent approval; `deny` rejects; invalid values fail closed). Maintenance and utility calls that need a text model — compaction, handoff, branch summaries, session titles — are refused instead of being spent on a Devin agent turn; `StreamOptions.maintenanceCall` marks them. See `docs/devin-provider.md`.
+
+### Changed
+
+- `@gajae-code/ai/utils/block-symbols` now exports the provider-neutral provider-resolved tool-call marker: `kProviderResolvedToolCall`, `ProviderResolvedCarrier`, `isProviderResolvedToolCall`, and `copyProviderResolvedToolCall` replace `kCursorExecResolved`, `CursorExecResolvedCarrier`, `isCursorExecResolved`, and `copyCursorExecResolved`. Cursor exec-owned calls and Devin's ACP tool calls both use it, and it is registered with `Symbol.for` so duplicate module instances cannot disagree about it.
+
+### Fixed
+
+- Cancelling an OAuth credential lookup during a shared token refresh no longer backs off the healthy credential or marks its session selector unavailable. Cancellation rejects only that caller; peers can still complete the shared refresh, and genuine refresh failures retain their existing handling.
+
+- Usage-limit marking now captures a stable stored row at mark time, including when no explicit row ID is supplied, and re-finds that same row after awaiting usage. Concurrent pointer reassignment or row reordering cannot redirect the mark; a vanished target marks nothing. The same stable-target operation supports OAuth account-specific model-rejection backoff without changing entitlement policy or adding dispatch-bound credential attribution (#5422).
+- The image generation role can select OpenAI's current GPT Image models. `gpt-image-2.5-sunburst` (editing precision) and `gpt-image-2.5-flare` (fast everyday generation) now ship in the bundled catalog under both `openai` and `openai-codex` with the same image-only, zero-cost, 128k-context/16k-max-token shape as `gpt-image-2`, so a provider-qualified `modelRoles.image: openai-codex/gpt-image-2.5-sunburst` selector resolves instead of failing with `No image model configured` (#5478).
+- OpenCode Go's exact `muse-spark-1.3-contributor` model now uses the existing Responses transport with minimal-through-xhigh reasoning, text/image input, and Go pricing. The Go discovery mapper applies the provisional reviewed models.dev Contributor limits over endpoint-reported limits; these are not a published Meta 1.3 specification. The subsequent model-manager merge repairs pre-upgrade ID-only cache placeholders even when fresh, while preserving other already-mapped dynamic limits.
+
+- A Responses stream that fails in an HTTP 200 terminal envelope, throws a top-level `error` event, or closes without any terminal event now carries the bounded `upstream_stream_interrupted` classifier instead of a plain error, and `processResponsesStream` reports whether a terminal event was observed. `response.incomplete` is recognized as a terminal event and derives `stopReason: "length"` from the frame type itself rather than from `response.status`, so a relay that drops or rewrites that field cannot turn a length-truncated turn into a plain `stop`/`toolUse` that dispatches a tool call carrying repaired partial arguments, and the interruption classifier cannot fire on a legitimate truncation. The classifier is a safe assistant-message `errorCode`, not a transport-retry fact, so it cannot admit a replay (#5477).
+- Credential-scoped model discovery now peeks the OAuth account selected for that session instead of falling back to unscoped pool ranking. An expired hard-pinned token returns unavailable rather than querying another account's catalog, while AUTO and callers without a scope retain their existing selection behavior.
+
+- The Cursor conversation blob store no longer bricks a long session. Its entry ceiling sat below the working set of an ordinary long conversation — a few hundred small blobs — and request construction wrote past that ceiling without being charged for it, so every later server `setBlob` was refused and every tool result that depended on one failed with `Cursor blob store exceeded its bounded capacity` for the rest of the session; neither compaction nor restarting the process recovered it. The store is now bounded by bytes alone, both writers are charged to that budget, and an overflowing write sheds the oldest entries instead of being refused (#5454).
+- Auth-broker failure reasons are scanned in linear time. Two rules accepted an unbounded scheme before the literal `://`, so a long run of scheme characters was re-tried at every prefix: 120 KB of upstream failure text cost roughly two seconds. Upstream reason text is remote-influenced, and `cleanReason` is what makes it safe for less-trusted surfaces.
+- OpenAI Codex credential selection no longer classifies, ranks, filters, or rejects OAuth credentials from ChatGPT `plan_type` labels. Selected models, including GPT-5.6 Sol and Spark variants, now reach the provider under the ordinary credential health, cooldown, quota, and explicit-selection rules; provider-confirmed account-specific model rejection permits one content-free retry on the next unpinned OAuth credential while preserving provider evidence instead of rewriting it as a client-authored account restriction (#5410). This supersedes the earlier Sol-only correction (#5270), including its retained Pro preference and Spark filter.
+- Cursor's first-event deadline now bounds asynchronous payload hooks before any authenticated request is opened, and successful HTTP/2 teardown sends END_STREAM before falling back to bounded cleanup for a peer that leaves its response half open (#4834 review).
+- Cursor conversation state and attachment blobs now reuse only within the same endpoint, credential, model, prompt, tool, and message-prefix authority. Request-local cache updates commit only after a successful terminal, preventing reused caller IDs or failed streams from disclosing prior session state (#4834 review).
+- Cursor Connect watchdog and terminal admission now preserve buffered raw progress, partial output, and usage across bounded held-exec backpressure and transport failures.
+- Cursor Connect streams now own their raw protobuf-progress watchdog, so valid heartbeat, usage, checkpoint, and exec frames keep active turns alive even when no normalized assistant event is emitted. Truly silent transports still time out through Cursor's provider terminal, preserving accumulated partial output and usage instead of replacing them with a zero-usage message (#4831).
+- Coalesced Cursor Connect bursts now apply bounded parser backpressure instead of rejecting the 257th valid frame before queued microtasks can drain; HTTP/2 end waits until every buffered frame is parsed, preserving raw progress and partial usage through the final terminal (#4831 review).
+- Cursor's provider-owned idle timeout uses the established `stream stalled while waiting for the next event` identity, and gRPC trailer, queue, and transport failures all settle behind any in-flight non-abortable exec fence before publishing a terminal (#4834 review).
+- The non-abortable terminal fence now covers every Cursor mutation dispatch, not only `piWrite`: native `writeArgs` dispatches and Pi edit dispatches forward `markNonAbortable` through `resolveExecHandler`, so no started non-abortable filesystem mutation can still be running after the exec terminal is published on caller abort or the local deadline (#4834 review).
+- Cursor arms its first-event watchdog BEFORE the proxy tunnel handshake, so a caller-supplied `streamFirstEventTimeoutMs` shorter than the tunnel's fixed 30-second connect timeout actually bounds proxy setup instead of being ignored until after the handshake completes (#4834 review).
+- The pre-proxy first-event deadline actually interrupts a stalled tunnel handshake: the connect is raced against the same deadline, a tunnel that completes after the deadline won is destroyed instead of leaking, and the authenticated request is never created once the stream already settled (#4834 review).
+- The Cursor bridge withholds the per-exec AbortSignal from non-abortable tools (matching agent-loop.ts) so an `untilAborted(signal, ...)` rejection can no longer make the settlement fence publish the terminal while the mutation still runs; the production Agent run guard forwards the `markNonAbortable` marker for native write dispatches (#4834 review).
+- Cursor Connect exec handlers now receive a per-exec AbortSignal. The caller abort and the local exec deadline both abort it, and the coding-agent bridge threads it into `tool.execute`, so timed-out or caller-cancelled Cursor-local tools can actually stop instead of running to completion after the turn terminalizes. The transport abort fence is also installed before payload setup and rechecked immediately before proxy connect and request creation, closing the race where cancellation won after the check while bearer credentials were still transmitted (#4834 review).
+- A started non-abortable Cursor mutation now keeps stream/run terminal publication behind the mutation's actual settlement. Caller abort and the local exec deadline still determine the eventual terminal reason, but neither can publish while an archive write may still commit, preventing post-terminal filesystem mutation (#4834 review).
+- Cursor `delete` is now part of the non-abortable settlement fence: its dispatch forwards `markNonAbortable` through the Agent run guard and the coding-agent bridge marks before the unlink runs, so a caller abort or deadline can no longer publish the exec terminal while the deletion is still in flight (#4834 review).
+- Cursor usage-context caching now hashes only normalized wire-visible tool definitions instead of complete class-backed tool instances. Session state containing filesystem `bigint` identities can no longer fail requests during preflight serialization, while tool name, description, and schema changes still invalidate cached conversation state.
+
+- Claude Code compatibility attribution moved from `2.1.257` to `2.1.273`, and the Gemini CLI spoofed version from `0.58.0` to `0.60.0`. Anthropic gates newer models behind a minimum client version, so a stale `claude-cli/<version>` fingerprint surfaces as an HTTP 400 on a model the account can otherwise reach. Both constants had drifted since the scheduled `spoofed-version-sync` check landed, which is what failed that job.
+
 ## [0.16.7] - 2026-09-13
 
 ## [0.16.6] - 2026-09-07
 
 ## [0.16.5] - 2026-09-07
-
 - Documented `GJC_OPENAI_CODE_WEBSOCKET_V2` as a switch that enables a websocket v2 path. No code read it under that name, under the legacy `PI_CODEX_WEBSOCKET_V2`, or under the `PI_OPENAI_CODE_WEBSOCKET_V2` the historical entry records; the v2 beta header has been unconditional for websocket transport. The documentation row is removed rather than reintroducing a knob, and the test that claimed to gate on it no longer writes an environment variable nothing reads.
 - Maintenance reasoning now fails closed for Anthropic models routed through an unverified custom endpoint and for raw reasoning-enabled models without thinking metadata. This prevents unsupported thinking controls and avoids a synchronous missing-metadata crash before provider wire transformation.
+- The auth-gateway OpenAI Responses and Chat Completions encoders now emit only the `call_id` half of a Codex/Responses compound tool-call id (`call_…|fc_…`) on the wire. The compound encoding is gjc-internal replay state; a downstream OpenAI-format client that echoed it back truncated it at its own 64-character limit and every chained tool turn was then rejected with `400 No tool output found for function call`. The item id still travels as the Responses item `id`.
 
 ## [0.16.4] - 2026-09-05
 

package/dist/types/auth-storage.d.ts

@@ -622,6 +622,10 @@ export declare class AuthStorage {
     setSessionCredentialAuto(provider: string, scopeId: string): void;
     /** Clear a scope's explicit selector and AUTO mask, restoring normal precedence. */
     clearSessionCredentialSelector(provider: string, scopeId: string): void;
+    /** Preserve a failed hard pin as unavailable instead of allowing AUTO fallback. */
+    markSessionCredentialUnavailable(scopeId: string, provider: string, selector: AuthCredentialSelector): void;
+    /** Return a failed hard pin retained for this scope, if any. */
+    hasSessionCredentialUnavailable(provider: string, scopeId?: string): boolean;
     /** Whether the effective selection for a scope is explicitly pinned (AUTO masks are not pins). */
     hasSessionCredentialSelector(provider: string, scopeId?: string): boolean;
     /** Whether this scope explicitly masks provider pins and uses AUTO ranking. */
@@ -887,15 +891,28 @@ export declare class AuthStorage {
     checkApiKeyCredential(provider: Provider, apiKey: string, options?: ApiKeyCredentialCheckOptions): Promise<ApiKeyCredentialCheckResult>;
     checkCredentials(options?: CheckCredentialsOptions): Promise<CredentialHealthResult[]>;
     /**
-     * Marks the current session's credential as temporarily blocked due to usage limits.
-     * Uses usage reports to determine accurate reset time when available.
-     * Returns true if a credential was blocked, enabling automatic fallback to the next credential.
+     * Marks the explicit stored row, or the session row captured at entry, as usage-limited.
+     * Re-finds that same row after the usage lookup; a vanished row marks nothing.
+     * Returns whether another credential of the same type remains unblocked.
      */
     markUsageLimitReached(provider: string, sessionId: string | undefined, options?: {
         retryAfterMs?: number;
         baseUrl?: string;
         signal?: AbortSignal;
         owner?: object;
+        rowId?: number;
+    }): Promise<boolean>;
+    /**
+     * Mark the stored credential whose key matches `apiKey` usage-limited for
+     * `retryAfterMs` (or the default backoff). Used when the caller knows
+     * exactly which leased credential failed (e.g. the auth-gateway leases a
+     * concrete row without a session binding) so bookkeeping cannot land on the
+     * wrong credential. The credential is never invalidated or marked suspect:
+     * the block is a bounded backoff only. Returns false when no stored
+     * credential matches the key.
+     */
+    markUsageLimitReachedMatching(provider: string, apiKey: string, options?: {
+        retryAfterMs?: number;
     }): Promise<boolean>;
     /**
      * Earliest instant at which any currently blocked stored credential for this
@@ -911,7 +928,9 @@ export declare class AuthStorage {
      * and get a best-effort token. For GitHub Copilot we preserve enterprise
      * routing metadata so discovery can hit the correct host.
      */
-    peekApiKey(provider: string, options?: Pick<AuthApiKeyOptions, "owner">): Promise<string | undefined>;
+    peekApiKey(provider: string, options?: Pick<AuthApiKeyOptions, "owner"> & {
+        sessionId?: string;
+    }): Promise<string | undefined>;
     /**
      * Get API key for a provider.
      * Priority:

package/dist/types/models.d.ts

@@ -18,4 +18,18 @@ export declare function calculateCost<TApi extends Api>(model: Model<TApi>, usag
  * Returns false if either model is null or undefined.
  */
 export declare function modelsAreEqual<TApi extends Api>(a: Model<TApi> | null | undefined, b: Model<TApi> | null | undefined): boolean;
+/**
+ * APIs backed by agent-level providers — currently Devin over ACP. An
+ * agent-level provider runs its own agent loop and owns the conversation
+ * history, so it refuses GJC maintenance calls (`maintenanceCall` requests such
+ * as compaction summaries, handoff generation, and branch summaries) instead of
+ * spending billed agent quota on work it cannot answer as a text model.
+ */
+export declare const AGENT_LEVEL_PROVIDER_APIS: ReadonlySet<Api>;
+/**
+ * Whether a model's provider can serve GJC maintenance calls at all. When this
+ * is false for every model a maintenance action can reach, the call can only
+ * report a guaranteed refusal, so callers should skip rather than surface it.
+ */
+export declare function modelSupportsMaintenanceCalls(model: Model<Api>): boolean;
 export {};

package/dist/types/provider-models/special.d.ts

@@ -1,5 +1,17 @@
 import type { ModelManagerOptions } from "../model-manager";
 export declare function openCodexModelManagerOptions(): ModelManagerOptions<"openai-responses">;
+export interface DevinModelManagerConfig {
+    cliPath?: string;
+    cliArgs?: readonly string[];
+    cwd?: string;
+}
+/**
+ * Devin models come from the ACP session's own `model` config option: the
+ * account and enterprise allowlists are authoritative there, and ACP is the
+ * documented programmatic surface (`devin acp`). Discovery fails closed to "no
+ * models" when the CLI is missing or unauthenticated.
+ */
+export declare function devinModelManagerOptions(config?: DevinModelManagerConfig): ModelManagerOptions<"devin-acp">;
 export interface OpenAICodexModelManagerConfig {
     accessToken?: string;
     accountId?: string;

package/dist/types/providers/anthropic.d.ts

@@ -107,7 +107,7 @@ export interface CpaToolAliasRestoreFailure {
  */
 export declare function parseCpaToolAliasRestoreFailure(error: unknown): CpaToolAliasRestoreFailure | undefined;
 export declare function isCpaToolAliasRestoreFailure(error: unknown): boolean;
-export declare const claudeCodeVersion = "2.1.257";
+export declare const claudeCodeVersion = "2.1.273";
 export declare const claudeCodeEntrypoint = "sdk-cli";
 export declare const claudeToolPrefix: string;
 export declare const claudeCodeSystemInstruction = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";

package/dist/types/providers/cursor.d.ts

@@ -1,9 +1,9 @@
+import http2 from "node:http2";
 import { type JsonValue } from "@bufbuild/protobuf";
-import type { AssistantMessage, CursorExecHandlerResult, CursorExecHandlers, CursorToolResultHandler, Message, Model, StreamFunction, StreamOptions, ToolCall, ToolResultMessage, Usage } from "../types";
-import { kCursorExecResolved } from "../utils/block-symbols";
+import type { AssistantMessage, CursorExecHandlerResult, CursorExecHandlers, CursorToolResultHandler, Message, Model, StreamFunction, StreamOptions, Tool, ToolCall, ToolResultMessage, Usage } from "../types";
+import { kProviderResolvedToolCall } from "../utils/block-symbols";
 import { CURSOR_CLIENT_VERSION } from "./cursor/client-version";
 import type { CursorRule, RequestedModel_ModelParameterbytes } from "./cursor/gen/agent_pb";
-import { type ConversationStateStructure } from "./cursor/gen/agent_pb";
 export declare const CURSOR_API_URL = "https://api2.cursor.sh";
 export { CURSOR_CLIENT_VERSION };
 /** Drop all cached state + blob bytes for a conversation (F15 bound + session-teardown hook). */
@@ -14,6 +14,24 @@ export interface CursorOptions extends StreamOptions {
     execHandlers?: CursorExecHandlers;
     onToolResult?: CursorToolResultHandler;
 }
+/** Exported for deterministic validation of fragmented Connect progress. */
+export declare function isPlausibleCursorConnectProgressForTest(bufferedLength: number, flags: number, messageLength?: number): boolean;
+/** Exported for deterministic coverage of the Cursor exec-budget derivation. */
+export declare function cursorExecDeadlineMsForTest(idleTimeoutMs: number | undefined): number;
+/** Settlement proof for a started non-abortable Cursor exec. */
+export interface CursorNonAbortableSettlement {
+    /** Resolves when the marked mutation settles; never rejects. */
+    settled: Promise<void>;
+}
+/** Exported for production-bridge coverage of non-abortable terminal ordering. */
+export declare function runWithCursorExecDeadlineForTest<T>(operation: (signal: AbortSignal, markNonAbortable: () => void) => Promise<T>, signal: AbortSignal | undefined, deadlineMs: number): Promise<T>;
+/** Await request-side END_STREAM under the same bounded teardown contract used by Cursor streams. */
+export declare function endCursorRequestForTest(request: Pick<http2.ClientHttp2Stream, "end">, timeoutMs?: number): Promise<boolean>;
+/** Exported for deterministic coverage of successful writer teardown ordering. */
+export declare function waitForCursorWritesForTest(request: http2.ClientHttp2Stream | null, timeoutMs?: number): Promise<void>;
+export declare function waitForCursorWriteDrainForTest(request: http2.ClientHttp2Stream, timeoutMs?: number): Promise<void>;
+/** Exported for deterministic coverage of the post-fence write race. */
+export declare function writeCursorFrameForTest(request: http2.ClientHttp2Stream, frame: Uint8Array): boolean;
 /** Build the ordered global USER rules Cursor expects for the current system prompt. */
 export declare function buildCursorRequestContextRules(systemPrompt: readonly string[] | undefined): CursorRule[];
 export interface CursorWireModelResolution {
@@ -30,42 +48,34 @@ type ToolCallState = ToolCall & {
     index: number;
     partialJson?: string;
     kind: "mcp" | "todo_write" | "native" | "cursor-exec";
-    [kCursorExecResolved]?: true;
+    [kProviderResolvedToolCall]?: true;
 };
 interface UsageState {
     sawTokenDelta: boolean;
-    /**
-     * Latest `ConversationTokenDetails.used_tokens`: the whole conversation's
-     * token consumption as counted by Cursor, not this turn's output.
-     */
     conversationUsedTokens: number;
-    /** Output tokens already included in the latest checkpoint snapshot. */
     checkpointOutputTokens: number;
-    /** Whether the current stream received a checkpoint, including an explicit zero. */
     hasConversationCheckpoint: boolean;
-    pendingCheckpoint?: ConversationStateStructure;
 }
+export declare function storeCursorBlobForTest(blobStore: Map<string, Uint8Array>, blobId: Uint8Array, blobData: Uint8Array, limits: {
+    maxBytes: number;
+}): boolean;
 /** Exported for tests: verifies handler is invoked with correct `this` when passed as bound. */
-export declare function resolveExecHandler<TArgs, TResult>(args: TArgs, handler: ((args: TArgs) => Promise<CursorExecHandlerResult<TResult>>) | undefined, onToolResult: CursorToolResultHandler | undefined, buildFromToolResult: (toolResult: ToolResultMessage) => TResult, buildRejected: (reason: string) => TResult, buildError: (error: string) => TResult): Promise<{
+export declare function resolveExecHandler<TArgs, TResult>(args: TArgs, handler: ((args: TArgs, signal?: AbortSignal, markNonAbortable?: () => void) => Promise<CursorExecHandlerResult<TResult>>) | undefined, onToolResult: CursorToolResultHandler | undefined, buildFromToolResult: (toolResult: ToolResultMessage) => TResult, buildRejected: (reason: string) => TResult, buildError: (error: string) => TResult, signal?: AbortSignal, markNonAbortable?: () => void): Promise<{
     execResult: TResult;
     toolResult?: ToolResultMessage;
 }>;
 /** Exported for deterministic coverage of ordered server-message handling. */
-export declare function createCursorMessageQueueForTest(onError?: (error: unknown) => void): {
-    enqueue(handler: () => void | Promise<void>): Promise<void>;
+export declare function createCursorMessageQueueForTest(onError?: (error: unknown) => void, maxPendingBytes?: number): {
+    enqueue(handler: () => void | Promise<void>, byteSize?: number): Promise<void>;
     drain(): Promise<void>;
+    pending(): number;
+    pendingBytes(): number;
 };
 /** Exported for direct regression coverage of the JSON-safety boundary. */
 export declare function cursorJsonSafeValueForTest(value: unknown): unknown;
 export declare function buildNativeToolCallBlock(toolCall: Record<string, unknown>, callId: string, index: number): ToolCallState | null;
-/**
- * Cursor streams output tokens as deltas and reports whole-conversation
- * consumption separately as `ConversationTokenDetails.used_tokens`. Derive
- * prompt tokens from the difference so context accounting and compaction see a
- * real prompt size instead of zero.
- */
+/** Derive prompt usage from Cursor's whole-conversation checkpoint total. */
 export declare function finalizeCursorUsage(output: AssistantMessage, usageState: UsageState): void;
-/** Exposes {@link finalizeCursorUsage} for tests without a live HTTP/2 stream. */
 export declare function finalizeCursorUsageForTest(usedTokens: number, outputTokens: number, options?: {
     checkpointOutputTokens?: number;
     hasConversationCheckpoint?: boolean;
@@ -91,6 +101,8 @@ export declare function finalizeCursorUsageForTest(usedTokens: number, outputTok
  * an empty `rootPromptMessagesJson` head.
  */
 export declare function buildCursorSystemPromptJsons(systemPrompt: readonly string[] | undefined, modelId?: string): string[];
+/** Exported for regression coverage of the tool usage-cache identity boundary. */
+export declare function buildCursorUsageToolsKeyForTest(tools: Tool[]): string;
 /** Exported for tests: decodes Cursor history blobs built from conversation messages. */
 export declare function buildCursorHistoryForTest(messages: Message[]): {
     rootPromptMessagesJson: unknown[];

package/dist/types/providers/devin-acp.d.ts

@@ -0,0 +1,157 @@
+/**
+ * Devin CLI provider — an ACP (Agent Client Protocol) client.
+ *
+ * Devin CLI exposes no raw model-inference endpoint. Its programmatic surface is
+ * `devin acp`: an Agent Client Protocol server over stdio that runs the whole
+ * agent (https://docs.devin.ai/cli/reference/commands#devin-acp). GJC therefore
+ * speaks ACP as the *client* and treats Devin as an agent-level provider:
+ *
+ * - GJC spawns `devin acp` and speaks ACP over the child's stdio.
+ * - One ACP session is reused for the lifetime of a GJC conversation, keyed by
+ *   `providerSessionId` and stored in `providerSessionState`; `close()` kills
+ *   the child process at session teardown.
+ * - Devin owns conversation history, so only the newest user turn is forwarded.
+ * - Devin executes its own tools. `session/update` tool calls are rendered as
+ *   display-only `toolCall` blocks and every turn terminates with
+ *   `stopReason: "stop"`, so GJC never re-executes a Devin tool call.
+ * - `session/request_permission` is answered from an explicit policy, never
+ *   silently: see {@link DevinAcpPermissionMode}.
+ *
+ * Boundary (documented in docs/devin-provider.md): GJC tools, skills, workflows,
+ * hooks, and permission prompts for GJC's own tools do not apply inside a Devin
+ * turn; GJC maintenance work (compaction, handoff, branch summaries) and utility
+ * one-shots are refused rather than forwarded to Devin; and Devin bills its own
+ * account/ACU usage.
+ */
+import { type ContentBlock, type PermissionOption, type SessionConfigOption, type StopReason } from "@agentclientprotocol/sdk";
+import type { AssistantMessageEventStream as AssistantMessageEventStreamType, Context, Model, StreamOptions } from "../types";
+/** Environment variable overriding the Devin executable GJC spawns. */
+export declare const DEVIN_ACP_CLI_ENV = "GJC_DEVIN_CLI_PATH";
+/** Environment variable selecting how GJC answers Devin permission requests. */
+export declare const DEVIN_ACP_PERMISSION_MODE_ENV = "GJC_DEVIN_PERMISSION_MODE";
+/** Executable that serves `devin acp` when nothing overrides it. */
+export declare const DEVIN_ACP_DEFAULT_CLI = "devin";
+/**
+ * Placeholder base URL. The ACP transport never issues an HTTP request, but a
+ * model record must carry a non-empty base URL through the model registry.
+ */
+export declare const DEVIN_ACP_BASE_URL = "acp://devin-cli";
+/**
+ * Conservative catalog defaults. ACP exposes no per-model token metadata, and
+ * GJC never sends conversation history to an ACP agent, so these values are
+ * display-only for this provider rather than a transport budget.
+ */
+export declare const DEVIN_ACP_CONTEXT_WINDOW = 200000;
+export declare const DEVIN_ACP_MAX_TOKENS = 64000;
+/**
+ * How GJC answers Devin's `session/request_permission` prompts.
+ *
+ * - `"allow"` (default) selects `allow_once`. A request that offers no
+ *   `allow_once` is cancelled: GJC never grants a persistent approval on its own.
+ * - `"deny"` selects `reject_once` before `reject_always`.
+ *
+ * Neither mode escalates persistently on its own, and an unrecognized
+ * `GJC_DEVIN_PERMISSION_MODE` value fails closed to `"deny"`.
+ */
+export type DevinAcpPermissionMode = "allow" | "deny";
+/** A permission request Devin raised for one of its own tool calls. */
+export interface DevinAcpPermissionRequest {
+    sessionId: string;
+    toolCallId: string;
+    title: string;
+    kind?: string;
+    rawInput?: unknown;
+    options: ReadonlyArray<{
+        optionId: string;
+        name: string;
+        kind: string;
+    }>;
+}
+/** Selected option id, or `cancelled` to answer with ACP `outcome: cancelled`. */
+export type DevinAcpPermissionDecision = {
+    optionId: string;
+} | {
+    cancelled: true;
+};
+/** Explicit decision callback; replaces the built-in permission mode policy. */
+export type DevinAcpPermissionHandler = (request: DevinAcpPermissionRequest) => Promise<DevinAcpPermissionDecision> | DevinAcpPermissionDecision;
+/** Provider configuration threaded through `StreamOptions.devinAcp`. */
+export interface DevinAcpConfig {
+    /** Executable serving `devin acp`. Defaults to {@link DEVIN_ACP_CLI_ENV} or `devin`. */
+    cliPath?: string;
+    /** Extra argv inserted before the `acp` verb. */
+    cliArgs?: readonly string[];
+    /** Working directory for the agent process. Defaults to `process.cwd()`. */
+    cwd?: string;
+    /**
+     * Overrides the permission policy for this request. Any value other than
+     * `"allow"` fails closed to `"deny"`, including out-of-type values from
+     * untyped callers.
+     */
+    permissionMode?: DevinAcpPermissionMode;
+    /** Explicit permission decisions. When absent, the configured mode decides. */
+    permissionHandler?: DevinAcpPermissionHandler;
+}
+/**
+ * Devin ACP stream options. Every provider-specific field lives on
+ * `StreamOptions.devinAcp`; the alias exists so `ApiOptionsMap` can name this
+ * API's option type like every other API does.
+ */
+export type DevinAcpOptions = StreamOptions;
+/** Map an ACP tool kind to the display tool name GJC renders. */
+export declare function devinAcpDisplayToolName(kind: string | null | undefined, name?: string | null): string;
+/**
+ * Copy a tool-call `rawInput` payload into a transcript-safe `arguments` record.
+ *
+ * ACP payloads arrive through JSON-RPC, so they are already JSON-shaped; this
+ * only wraps non-objects and refuses to stage an unbounded payload.
+ */
+export declare function devinAcpToolArguments(rawInput: unknown): Record<string, unknown>;
+/** Map an ACP prompt stop reason onto GJC's assistant stop reason. */
+export declare function devinAcpStopReason(stopReason: StopReason): "stop" | "length" | "aborted";
+/** Flatten ACP select option groups into `{ id, name }` model entries. */
+export declare function devinAcpSelectOptions(options: Extract<SessionConfigOption, {
+    type: "select";
+}>["options"]): Array<{
+    id: string;
+    name: string;
+}>;
+/**
+ * Select the option matching the configured policy.
+ *
+ * `allow` grants a single action and never a persistent one: when the agent
+ * offers no `allow_once`, the request is cancelled rather than escalated to
+ * `allow_always`. `deny` may fall back to `reject_always`, because a persistent
+ * refusal only reduces what the agent may do.
+ */
+export declare function devinAcpSelectPermissionOption(options: ReadonlyArray<PermissionOption>, mode: DevinAcpPermissionMode): {
+    optionId: string;
+} | null;
+/** Resolve the permission policy from an explicit config value or the environment. */
+export declare function devinAcpResolvePermissionMode(configured: DevinAcpPermissionMode | undefined, env?: Record<string, string | undefined>): DevinAcpPermissionMode;
+/** Build the ACP prompt content blocks for the newest user turn. */
+export declare function devinAcpPromptBlocks(context: Context, supportsImages: boolean): ContentBlock[];
+/**
+ * Stable identity for the cached ACP child.
+ *
+ * `cwd` is part of the identity on purpose: `/move` changes `process.cwd()`, and a
+ * cached child keeps the directory it was spawned in, so a cwd change must miss the
+ * cache and respawn instead of running Devin's tools in the abandoned tree.
+ */
+export declare function devinAcpBridgeIdentity(conversationId: string | undefined, cwd: string, argv: readonly string[]): string;
+export declare const streamDevinAcp: (model: Model<"devin-acp">, context: Context, options?: DevinAcpOptions) => AssistantMessageEventStreamType;
+/**
+ * Discover the account's Devin models over ACP.
+ *
+ * `devin models list --format json` is deliberately not parsed: its schema is
+ * undocumented, while the session's own `model` config option is the
+ * authoritative ACP surface for the authenticated account and enterprise
+ * allowlists. Returns `null` when the CLI is missing, unauthenticated, or the
+ * agent advertises no model selector — which the model registry treats as
+ * "no dynamic models".
+ */
+export declare function fetchDevinAcpModels(config?: {
+    cliPath?: string;
+    cliArgs?: readonly string[];
+    cwd?: string;
+}): Promise<Model<"devin-acp">[] | null>;

package/dist/types/providers/google-gemini-headers.d.ts

@@ -5,7 +5,7 @@
  */
 export declare const GEMINI_CLI_VERSION_ENV = "GJC_AI_GEMINI_CLI_VERSION";
 export declare const LEGACY_GEMINI_CLI_VERSION_ENV = "PI_AI_GEMINI_CLI_VERSION";
-export declare const DEFAULT_GEMINI_CLI_VERSION = "0.58.0";
+export declare const DEFAULT_GEMINI_CLI_VERSION = "0.60.0";
 export declare function getGeminiCliUserAgent(modelId?: string): string;
 export declare const getGeminiCliHeaders: (modelId?: string) => {
     "User-Agent": string;

package/dist/types/providers/mock.d.ts

@@ -87,6 +87,8 @@ export interface MockResponse {
     providerPayload?: AssistantMessage["providerPayload"];
     /** Optional typed provider failure metadata for retry/fallback tests. */
     transportFailure?: AssistantMessage["transportFailure"];
+    /** Bounded, redaction-safe failure classifier copied onto the terminal error message. */
+    errorCode?: string;
     /** If set, the stream emits a terminal error event instead of completing. */
     throw?: string | Error;
     /** Delay before any event is emitted. Honors the call's AbortSignal. */

package/dist/types/providers/openai-responses-shared.d.ts

@@ -44,7 +44,27 @@ export interface ProcessResponsesStreamOptions {
     onFirstToken?: () => void;
     onOutputItemDone?: (item: ResponseOutputItem) => void;
 }
-export declare function processResponsesStream<TApi extends Api>(openaiStream: AsyncIterable<OpenAI.Responses.ResponseStreamEvent>, output: AssistantMessage, stream: AssistantMessageEventStream, model: Model<TApi>, options?: ProcessResponsesStreamOptions): Promise<void>;
+export declare function processResponsesStream<TApi extends Api>(openaiStream: AsyncIterable<OpenAI.Responses.ResponseStreamEvent>, output: AssistantMessage, stream: AssistantMessageEventStream, model: Model<TApi>, options?: ProcessResponsesStreamOptions): Promise<boolean>;
+/**
+ * Bounded classifier for a Responses stream that ended in failure before a
+ * successful terminal event: a `response.failed` envelope, a `response.completed`
+ * with `failed` status, a top-level `error` event, or an unexpected EOF (the
+ * stream returning without any terminal event). It is deliberately NOT a
+ * transport-retry fact: `transportFailureFacts` does not admit it, so preserving
+ * this diagnostic can never authorize a replay.
+ */
+export declare const RESPONSES_STREAM_FAILURE_CODE = "upstream_stream_interrupted";
+/**
+ * Typed error for an SSE stream that ended (EOF) before any terminal event, so
+ * the caller sees a bounded classifier instead of a content-free success.
+ */
+export declare function unexpectedResponsesStreamEndError(): Error;
+/**
+ * Read the bounded stream-failure classifier back off a thrown provider error.
+ * Only this module's own classifier is returned, so a foreign error's arbitrary
+ * `code` can never be forwarded onto the assistant message.
+ */
+export declare function responsesStreamFailureCode(error: unknown): string | undefined;
 /**
  * Mark tool-call blocks left incomplete by a length-truncated response so the
  * agent loop rejects them instead of executing a best-effort partial parse.

package/dist/types/providers/register-builtins.d.ts

@@ -53,6 +53,7 @@ export declare const streamOpenAICodexResponses: (model: Model<"openai-codex-res
 export declare const streamOpenAICompletions: (model: Model<"openai-completions">, context: Context, options: OptionsForApi<"openai-completions">, onStreamCreated?: () => void) => EventStreamImpl;
 export declare const streamOpenAIResponses: (model: Model<"openai-responses">, context: Context, options: OptionsForApi<"openai-responses">, onStreamCreated?: () => void) => EventStreamImpl;
 export declare const streamCursor: (model: Model<"cursor-agent">, context: Context, options: OptionsForApi<"cursor-agent">, onStreamCreated?: () => void) => EventStreamImpl;
+export declare const streamDevinAcp: (model: Model<"devin-acp">, context: Context, options: import("..").StreamOptions, onStreamCreated?: () => void) => EventStreamImpl;
 export declare const streamOllama: (model: Model<"ollama-chat">, context: Context, options: OptionsForApi<"ollama-chat">, onStreamCreated?: () => void) => EventStreamImpl;
 export declare const streamBedrock: (model: Model<"bedrock-converse-stream">, context: Context, options: OptionsForApi<"bedrock-converse-stream">, onStreamCreated?: () => void) => EventStreamImpl;
 export declare const streamKiroCodeWhisperer: (model: Model<"kiro-codewhisperer-stream">, context: Context, options: OptionsForApi<"kiro-codewhisperer-stream">, onStreamCreated?: () => void) => EventStreamImpl;

package/dist/types/types.d.ts

@@ -4,6 +4,7 @@ import type { AnthropicOptions } from "./providers/anthropic";
 import type { AzureOpenAIResponsesOptions } from "./providers/azure-openai-responses";
 import type { CursorOptions } from "./providers/cursor";
 import type { DeleteArgs, DeleteResult, DiagnosticsArgs, DiagnosticsResult, GrepArgs, GrepResult, LsArgs, LsResult, McpResult, PiBashExecArgs, PiBashExecResult, PiEditExecArgs, PiEditExecResult, PiFindExecArgs, PiFindExecResult, PiGrepExecArgs, PiGrepExecResult, PiLsExecArgs, PiLsExecResult, PiReadExecArgs, PiReadExecResult, PiWriteExecArgs, PiWriteExecResult, ReadArgs, ReadResult, ShellArgs, ShellResult, WriteArgs, WriteResult } from "./providers/cursor/gen/agent_pb";
+import type { DevinAcpConfig, DevinAcpOptions } from "./providers/devin-acp";
 import type { GoogleOptions } from "./providers/google";
 import type { GoogleGeminiCliOptions } from "./providers/google-gemini-cli";
 import type { GoogleVertexOptions } from "./providers/google-vertex";
@@ -16,7 +17,7 @@ import type { AssistantMessageEventStream } from "./utils/event-stream";
 import type { FallbackAttemptToken, TransportFailureFacts } from "./utils/fallback-transport";
 import type { UnicodeEscapeEvidence } from "./utils/json-parse";
 export type { AssistantMessageEventStream } from "./utils/event-stream";
-export type KnownApi = "openai-completions" | "openai-responses" | "openai-codex-responses" | "azure-openai-responses" | "anthropic-messages" | "bedrock-converse-stream" | "google-generative-ai" | "google-gemini-cli" | "google-vertex" | "ollama-chat" | "cursor-agent" | "kiro-codewhisperer-stream";
+export type KnownApi = "openai-completions" | "openai-responses" | "openai-codex-responses" | "azure-openai-responses" | "anthropic-messages" | "bedrock-converse-stream" | "google-generative-ai" | "google-gemini-cli" | "google-vertex" | "ollama-chat" | "cursor-agent" | "devin-acp" | "kiro-codewhisperer-stream";
 export type Api = KnownApi | (string & {});
 export interface ApiOptionsMap {
     "anthropic-messages": AnthropicOptions;
@@ -30,6 +31,7 @@ export interface ApiOptionsMap {
     "google-vertex": GoogleVertexOptions;
     "ollama-chat": OllamaChatOptions;
     "cursor-agent": CursorOptions;
+    "devin-acp": DevinAcpOptions;
     "kiro-codewhisperer-stream": KiroCodeWhispererOptions;
 }
 export type OptionsForApi<TApi extends Api> = StreamOptions | (TApi extends keyof ApiOptionsMap ? ApiOptionsMap[TApi] : never);
@@ -54,7 +56,7 @@ export interface ThinkingConfig {
     /** Provider-specific transport used to encode the selected effort. */
     mode: ThinkingControlMode;
 }
-export declare const KNOWN_PROVIDERS: readonly ["alibaba-token-plan", "amazon-bedrock", "kiro", "azure-openai", "anthropic", "google", "google-gemini-cli", "google-antigravity", "google-vertex", "openai", "openai-codex", "opencodex", "kimi-code", "minimax-code", "minimax-code-cn", "github-copilot", "fireworks", "firepass", "fugu", "gitlab-duo", "cursor", "jetbrains-junie", "deepseek", "deepinfra", "xai", "groq", "cerebras", "openrouter", "kilo", "vercel-ai-gateway", "zai", "glm-zcode", "mistral", "minimax", "opencode-go", "commandcode-goat", "opencode-zen", "opengateway", "bizrouter", "mara", "synthetic", "cloudflare-ai-gateway", "huggingface", "litellm", "moonshot", "nvidia", "nanogpt", "ollama", "ollama-cloud", "qianfan", "qwen-portal", "sglang", "together", "venice", "vllm", "xiaomi", "xiaomi-token-plan-sgp", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "zenmux", "lm-studio", "omlx"];
+export declare const KNOWN_PROVIDERS: readonly ["alibaba-token-plan", "amazon-bedrock", "kiro", "azure-openai", "anthropic", "google", "google-gemini-cli", "google-antigravity", "google-vertex", "openai", "openai-codex", "opencodex", "kimi-code", "minimax-code", "minimax-code-cn", "github-copilot", "fireworks", "firepass", "fugu", "gitlab-duo", "cursor", "devin", "jetbrains-junie", "deepseek", "deepinfra", "xai", "groq", "cerebras", "openrouter", "kilo", "vercel-ai-gateway", "zai", "glm-zcode", "mistral", "minimax", "opencode-go", "commandcode-goat", "opencode-zen", "opengateway", "bizrouter", "mara", "synthetic", "cloudflare-ai-gateway", "huggingface", "litellm", "moonshot", "nvidia", "nanogpt", "ollama", "ollama-cloud", "qianfan", "qwen-portal", "sglang", "together", "venice", "vllm", "xiaomi", "xiaomi-token-plan-sgp", "xiaomi-token-plan-ams", "xiaomi-token-plan-cn", "zenmux", "lm-studio", "omlx"];
 export type KnownProvider = (typeof KNOWN_PROVIDERS)[number];
 export declare function isKnownProvider(provider: string): provider is KnownProvider;
 export type Provider = KnownProvider | string;
@@ -251,6 +253,13 @@ export interface StreamOptions {
      * Providers can use this to persist transport/session state between turns.
      */
     providerSessionState?: Map<string, ProviderSessionState>;
+    /**
+     * Set by GJC for internal maintenance/one-shot work (context compaction,
+     * handoff and branch summaries, utility generations) rather than an
+     * interactive user turn. Agent-level providers use it to refuse requests they
+     * cannot serve instead of forwarding them to a billed upstream agent.
+     */
+    maintenanceCall?: boolean;
     /**
      * Optional callback for inspecting or replacing provider payloads before sending.
      * Return undefined to keep the payload unchanged.
@@ -306,6 +315,12 @@ export interface StreamOptions {
     authCredentialType?: "api_key" | "oauth";
     /** Cursor exec/MCP tool handlers (cursor-agent only). */
     execHandlers?: CursorExecHandlers;
+    /**
+     * Devin CLI ACP provider configuration (devin-acp only). When absent, the
+     * provider spawns `devin acp` from PATH (or `GJC_DEVIN_CLI_PATH`) in the
+     * current working directory and applies the default permission policy.
+     */
+    devinAcp?: DevinAcpConfig;
     /** Per-attempt identity for execution attribution. Threaded into onPayload/onResponse calls. */
     attemptScope?: AttemptScopeRef;
 }
@@ -550,6 +565,14 @@ export interface AssistantMessage {
     usage: Usage;
     stopReason: StopReason;
     errorMessage?: string;
+    /**
+     * Bounded, redaction-safe failure classifier for a terminal provider/runtime
+     * failure (a safe token matching `[A-Za-z0-9._-]{1,64}`), e.g.
+     * `upstream_stream_interrupted`. Set by the provider/agent that owns the
+     * classifier; never raw provider text and never a retry-admission fact (retry
+     * policy keys on `transportFailure`, not on this diagnostic).
+     */
+    errorCode?: string;
     errorKind?: AssistantErrorKind;
     /**
      * Structured, shape-only diagnostic for a terminal local staging-buffer
@@ -612,17 +635,35 @@ export interface CursorShellStreamCallbacks {
 export interface CursorPiCall<TArgs> {
     args: TArgs;
     toolCallId: string;
+    /** Per-exec cancellation signal; aborted when the caller aborts or the local exec deadline fires. */
+    signal?: AbortSignal;
+    /** Marks a started mutation that must settle before Cursor can terminalize the exec. */
+    markNonAbortable?: () => void;
 }
 export interface CursorExecHandlers {
-    read?: (args: ReadArgs) => Promise<CursorExecHandlerResult<ReadResult>>;
-    ls?: (args: LsArgs) => Promise<CursorExecHandlerResult<LsResult>>;
-    grep?: (args: GrepArgs) => Promise<CursorExecHandlerResult<GrepResult>>;
-    write?: (args: WriteArgs) => Promise<CursorExecHandlerResult<WriteResult>>;
-    delete?: (args: DeleteArgs) => Promise<CursorExecHandlerResult<DeleteResult>>;
-    shell?: (args: ShellArgs) => Promise<CursorExecHandlerResult<ShellResult>>;
-    shellStream?: (args: ShellArgs, callbacks: CursorShellStreamCallbacks) => Promise<CursorExecHandlerResult<ShellResult>>;
-    diagnostics?: (args: DiagnosticsArgs) => Promise<CursorExecHandlerResult<DiagnosticsResult>>;
-    mcp?: (call: CursorMcpCall) => Promise<CursorExecHandlerResult<McpResult>>;
+    read?: (args: ReadArgs, signal?: AbortSignal, 
+    /** Marks a started non-abortable operation so the exec terminal waits for settlement. */
+    markNonAbortable?: () => void) => Promise<CursorExecHandlerResult<ReadResult>>;
+    ls?: (args: LsArgs, signal?: AbortSignal, 
+    /** Marks a started non-abortable operation so the exec terminal waits for settlement. */
+    markNonAbortable?: () => void) => Promise<CursorExecHandlerResult<LsResult>>;
+    grep?: (args: GrepArgs, signal?: AbortSignal) => Promise<CursorExecHandlerResult<GrepResult>>;
+    write?: (args: WriteArgs, signal?: AbortSignal, 
+    /** Marks a started non-abortable mutation so the exec terminal waits for settlement. */
+    markNonAbortable?: () => void) => Promise<CursorExecHandlerResult<WriteResult>>;
+    delete?: (args: DeleteArgs, signal?: AbortSignal, 
+    /** Marks a started non-abortable mutation so the exec terminal waits for settlement. */
+    markNonAbortable?: () => void) => Promise<CursorExecHandlerResult<DeleteResult>>;
+    shell?: (args: ShellArgs, signal?: AbortSignal, 
+    /** Marks a started non-abortable operation so the exec terminal waits for settlement. */
+    markNonAbortable?: () => void) => Promise<CursorExecHandlerResult<ShellResult>>;
+    shellStream?: (args: ShellArgs, callbacks: CursorShellStreamCallbacks, signal?: AbortSignal, 
+    /** Marks a started non-abortable operation so the exec terminal waits for settlement. */
+    markNonAbortable?: () => void) => Promise<CursorExecHandlerResult<ShellResult>>;
+    diagnostics?: (args: DiagnosticsArgs, signal?: AbortSignal) => Promise<CursorExecHandlerResult<DiagnosticsResult>>;
+    mcp?: (call: CursorMcpCall, signal?: AbortSignal, 
+    /** Marks a started non-abortable operation so the exec terminal waits for settlement. */
+    markNonAbortable?: () => void) => Promise<CursorExecHandlerResult<McpResult>>;
     piRead?: (call: CursorPiCall<PiReadExecArgs>) => Promise<CursorExecHandlerResult<PiReadExecResult>>;
     piBash?: (call: CursorPiCall<PiBashExecArgs>) => Promise<CursorExecHandlerResult<PiBashExecResult>>;
     piEdit?: (call: CursorPiCall<PiEditExecArgs>) => Promise<CursorExecHandlerResult<PiEditExecResult>>;