@gajae-code/coding-agent 0.10.1 → 0.11.0

package/src/modes/controllers/selector-controller.ts

@@ -1,9 +1,10 @@
+import * as path from "node:path";
 import { ThinkingLevel } from "@gajae-code/agent-core";
 import { getOAuthProviders } from "@gajae-code/ai/utils/oauth";
 import type { OAuthProvider } from "@gajae-code/ai/utils/oauth/types";
 import type { Component, OverlayHandle } from "@gajae-code/tui";
 import { Input, isPetMode, Loader, Spacer, Text } from "@gajae-code/tui";
-import { getAgentDbPath, getProjectDir } from "@gajae-code/utils";
+import { getAgentDbPath, getProjectDir, logger, VERSION } from "@gajae-code/utils";
 import {
 	activateModelProfile,
 	type MaterializeModelProfileForDeletionResult,
@@ -15,6 +16,7 @@ import {
 import { formatModelProfileDisplayLabel, recommendModelProfileForProvider } from "../../config/model-profiles";
 import { GJC_MODEL_ASSIGNMENT_TARGETS, type GjcModelAssignmentTargetId } from "../../config/model-registry";
 import { formatModelSelectorValue } from "../../config/model-resolver";
+import { selectorHead } from "../../config/model-selector-value";
 import type { ModelProfileConfig } from "../../config/models-config-schema";
 import { type Settings, settings } from "../../config/settings";
 import { DebugSelectorComponent } from "../../debug";
@@ -40,10 +42,48 @@ import {
 	theme,
 } from "../../modes/theme/theme";
 import type { InteractiveModeContext, OAuthSelectorOptions } from "../../modes/types";
+import { getNotificationConfig, maskToken } from "../../sdk/bus/config";
+import {
+	clearTelegramActivationMarker,
+	createTelegramActivationMarker,
+	observedTelegramActivationMarker,
+	persistTelegramActivationMarker,
+	proposedTelegramIdentity,
+	reconcileCommittedTelegramConfiguration,
+	removeTelegramConfiguration,
+	saveTelegramInactive,
+} from "../../sdk/bus/notification-orchestration";
+import {
+	buildNotificationStatusReport,
+	checkNotificationHealth,
+	recoverNotifications,
+	sanitizeDiagnostic,
+	sendNotificationTest,
+} from "../../sdk/bus/notification-service";
+import type { NotificationSessionStatus } from "../../sdk/bus/session-control";
+import {
+	ensureTelegramDaemonRunningDetailed,
+	readDaemonState,
+	unregisterNotificationRoot,
+} from "../../sdk/bus/telegram-daemon";
+import { TelegramDaemonController } from "../../sdk/bus/telegram-daemon-control";
+import { runTelegramSetup, type TelegramSetupPreflight } from "../../sdk/bus/telegram-setup";
 import { type SessionInfo, SessionManager } from "../../session/session-manager";
 import { FileSessionStorage } from "../../session/session-storage";
 import {
+	CREDENTIAL_AUTO_IMPORT_DISCOVERY_WARNING,
+	CREDENTIAL_AUTO_IMPORT_PERSISTENCE_WARNING,
+	CREDENTIAL_AUTO_IMPORT_REFRESH_WARNING,
+	CREDENTIAL_AUTO_IMPORT_RETRY_WARNING,
 	CREDENTIAL_AUTO_IMPORT_ROTATION_WARNING,
+	CREDENTIAL_AUTO_IMPORT_STATE_UNREADABLE_WARNING,
+	type CredentialAutoImportStateReadResult,
+	type CredentialAutoImportStateStore,
+	createCredentialAutoImportStateStore,
+	formatCredentialAutoImportCandidateLabel,
+	formatCredentialAutoImportPrompt,
+	isCredentialAutoImportStateResolvedForVersion,
+	logCredentialAutoImportFailures,
 	runExternalCredentialAutoImport,
 } from "../../setup/credential-auto-import";
 import {
@@ -78,7 +118,12 @@ import type { PetMode } from "../components/gajae-pet-widget";
 import { HistorySearchComponent } from "../components/history-search";
 import { JobsOverlayComponent } from "../components/jobs-overlay";
 import { ModelSelectorComponent } from "../components/model-selector";
+import type {
+	NotificationsEditorOperations,
+	PreparedTelegramConfiguration,
+} from "../components/notifications-settings-editor";
 import { OAuthSelectorComponent } from "../components/oauth-selector";
+import { isPetAvailable } from "../components/pet-capability";
 import { PetSelectorComponent } from "../components/pet-selector";
 import { PluginSelectorComponent } from "../components/plugin-selector";
 import {
@@ -141,8 +186,512 @@ function formatProviderOnboardingCommandGuide(): string {
 	].join("\n");
 }
 
+export interface NotificationsEditorAdapterContext {
+	settings: Settings;
+	session: Pick<InteractiveModeContext["session"], "notificationSessionController">;
+	sessionManager: Pick<InteractiveModeContext["sessionManager"], "getCwd" | "getSessionId">;
+	notifyConfigChanged?: () => Promise<void> | void;
+}
+
+export interface NotificationsEditorOperationDependencies {
+	getNotificationConfig: typeof getNotificationConfig;
+	maskToken: typeof maskToken;
+	buildNotificationStatusReport: typeof buildNotificationStatusReport;
+	checkNotificationHealth: typeof checkNotificationHealth;
+	sendNotificationTest: typeof sendNotificationTest;
+	recoverNotifications: typeof recoverNotifications;
+	sanitizeDiagnostic: typeof sanitizeDiagnostic;
+	ensureTelegramDaemonRunningDetailed: typeof ensureTelegramDaemonRunningDetailed;
+	runTelegramSetup: typeof runTelegramSetup;
+	proposedTelegramIdentity: typeof proposedTelegramIdentity;
+	reconcileCommittedTelegramConfiguration: typeof reconcileCommittedTelegramConfiguration;
+	saveTelegramInactive: typeof saveTelegramInactive;
+	removeTelegramConfiguration: typeof removeTelegramConfiguration;
+	unregisterNotificationRoot: typeof unregisterNotificationRoot;
+}
+
+const notificationEditorOperationDependencies: NotificationsEditorOperationDependencies = {
+	getNotificationConfig,
+	maskToken,
+	buildNotificationStatusReport,
+	checkNotificationHealth,
+	sendNotificationTest,
+	recoverNotifications,
+	sanitizeDiagnostic,
+	ensureTelegramDaemonRunningDetailed,
+	runTelegramSetup,
+	proposedTelegramIdentity,
+	reconcileCommittedTelegramConfiguration,
+	saveTelegramInactive,
+	removeTelegramConfiguration,
+	unregisterNotificationRoot,
+};
+
+function unavailableNotificationSessionStatus(): NotificationSessionStatus {
+	return {
+		eligible: false,
+		locallyEnabled: true,
+		effectiveEnabled: false,
+		running: false,
+		environment: "off",
+	};
+}
+
+function unavailableNotificationSessionResult() {
+	return { outcome: "disabled" as const, status: unavailableNotificationSessionStatus() };
+}
+
+function notificationOperationError(
+	services: NotificationsEditorOperationDependencies,
+	error: unknown,
+	token?: string,
+): Error {
+	return new Error(
+		services.sanitizeDiagnostic(error instanceof Error ? error.message : "Notification operation failed.", token),
+	);
+}
+
+/**
+ * Concrete service adapter for the direct Notifications settings tab. Secrets remain in this closure's
+ * WeakMap and are never exposed through the editor's safe draft contract.
+ */
+export function createNotificationsEditorOperations(
+	ctx: NotificationsEditorAdapterContext,
+	overrides: Partial<NotificationsEditorOperationDependencies> = {},
+): NotificationsEditorOperations {
+	const services = { ...notificationEditorOperationDependencies, ...overrides };
+	const drafts = new WeakMap<PreparedTelegramConfiguration, string>();
+	const sessionContext = () => ({ sessionManager: ctx.sessionManager });
+	const notifyAfterDurableCommit = async (): Promise<void> => {
+		await ctx.notifyConfigChanged?.();
+	};
+	const reconnect = async () =>
+		await services.ensureTelegramDaemonRunningDetailed({
+			settings: ctx.settings,
+			cwd: ctx.sessionManager.getCwd(),
+			sessionId: ctx.sessionManager.getSessionId(),
+		});
+	const telegramSetupPreflight = async (): Promise<TelegramSetupPreflight> => {
+		const storedChatId = services.getNotificationConfig(ctx.settings).chatId;
+		try {
+			const state = await readDaemonState(ctx.settings);
+			const validPid = Number.isSafeInteger(state?.pid) && (state?.pid ?? 0) > 0;
+			if (!state || !validPid) return { storedChatId };
+			let live = false;
+			try {
+				process.kill(state.pid, 0);
+				live = true;
+			} catch (error) {
+				live = (error as NodeJS.ErrnoException).code === "EPERM";
+			}
+			return live
+				? {
+						storedChatId,
+						daemon: {
+							live,
+							tokenFingerprint: typeof state.tokenFingerprint === "string" ? state.tokenFingerprint : undefined,
+							chatId: typeof state.chatId === "string" && state.chatId.trim() ? state.chatId.trim() : undefined,
+						},
+					}
+				: { storedChatId };
+		} catch {
+			return { storedChatId };
+		}
+	};
+
+	return {
+		loadState: async () => {
+			const config = services.getNotificationConfig(ctx.settings);
+			return {
+				status: services.buildNotificationStatusReport(ctx.settings),
+				session:
+					ctx.session.notificationSessionController?.query(sessionContext()) ??
+					unavailableNotificationSessionStatus(),
+				preferences: {
+					redact: config.redact,
+					verbosity: config.verbosity,
+					sessionScope: config.sessionScope,
+					richEnabled: config.rich.enabled,
+					richDraftEnabled: config.richDraft.enabled,
+				},
+			};
+		},
+
+		refreshHealth: async ({ probe, signal }) => {
+			if (signal?.aborted) throw new Error("Notification health refresh cancelled.");
+			try {
+				const input: Parameters<typeof checkNotificationHealth>[0] & { signal?: AbortSignal } = {
+					settings: ctx.settings,
+					stateRoot: path.join(ctx.sessionManager.getCwd(), ".gjc", "state"),
+					probe,
+					signal,
+				};
+				const report = await services.checkNotificationHealth(input);
+				if (signal?.aborted) throw new Error("Notification health refresh cancelled.");
+				const token = services.getNotificationConfig(ctx.settings).botToken;
+				return {
+					...report,
+					checks: report.checks.map(check => ({
+						...check,
+						detail: services.sanitizeDiagnostic(check.detail, token),
+					})),
+					reachability: {
+						...report.reachability,
+						detail: services.sanitizeDiagnostic(report.reachability.detail, token),
+					},
+				};
+			} catch (error) {
+				throw notificationOperationError(services, error, services.getNotificationConfig(ctx.settings).botToken);
+			}
+		},
+
+		sendTest: async () => {
+			try {
+				const result = await services.sendNotificationTest({ settings: ctx.settings });
+				return {
+					...result,
+					detail: services.sanitizeDiagnostic(
+						result.detail,
+						services.getNotificationConfig(ctx.settings).botToken,
+					),
+				};
+			} catch (error) {
+				throw notificationOperationError(services, error, services.getNotificationConfig(ctx.settings).botToken);
+			}
+		},
+
+		recover: async () => {
+			try {
+				const result = await services.recoverNotifications({
+					settings: ctx.settings,
+					stateRoot: path.join(ctx.sessionManager.getCwd(), ".gjc", "state"),
+				});
+				return {
+					...result,
+					daemon: {
+						...result.daemon,
+						detail: services.sanitizeDiagnostic(
+							result.daemon.detail,
+							services.getNotificationConfig(ctx.settings).botToken,
+						),
+					},
+				};
+			} catch (error) {
+				throw notificationOperationError(services, error, services.getNotificationConfig(ctx.settings).botToken);
+			}
+		},
+
+		reconnect: async () => {
+			try {
+				const result = await reconnect();
+				const controller = ctx.session.notificationSessionController;
+				if (result === "blocked_identity") {
+					await controller?.enterBlockedRuntime(sessionContext());
+				} else if (result === "spawned" || result === "reloaded" || result === "attached") {
+					await controller?.clearBlockedRuntime(sessionContext());
+					await controller?.reconcileCurrentSession(sessionContext());
+				}
+				return result;
+			} catch (error) {
+				throw notificationOperationError(services, error, services.getNotificationConfig(ctx.settings).botToken);
+			}
+		},
+
+		preflightProposedIdentity: async (input, signal) => {
+			const token = input.token.consume();
+			const unknownIdentity = { status: "unknown" as const };
+			if (!token.trim()) {
+				return {
+					status: "error",
+					identity: unknownIdentity,
+					message: "Telegram bot token is required.",
+				};
+			}
+			try {
+				const setup = await services.runTelegramSetup({
+					token,
+					chatId: input.chatId,
+					preflight: await telegramSetupPreflight(),
+					revalidatePreflight: async () => await telegramSetupPreflight(),
+					interactive: false,
+					signal,
+					deps: { fetchImpl: globalThis.fetch },
+				});
+				if (!setup.ok) {
+					return {
+						status: setup.status === "aborted" ? "aborted" : setup.status === "cancelled" ? "cancelled" : "error",
+						identity: unknownIdentity,
+						message: services.sanitizeDiagnostic(setup.detail, token),
+					};
+				}
+				if (signal.aborted) {
+					return {
+						status: "aborted",
+						identity: unknownIdentity,
+						message: "Telegram setup cancelled.",
+					};
+				}
+				const identity = await services.proposedTelegramIdentity({
+					settings: ctx.settings,
+					botToken: token,
+					chatId: setup.chatId,
+					chatDisplay: setup.chatId,
+				});
+				if (signal.aborted) {
+					return {
+						status: "aborted",
+						identity,
+						message: "Telegram setup cancelled.",
+					};
+				}
+				const draft: PreparedTelegramConfiguration = {
+					chatId: setup.chatId,
+					tokenMask: services.maskToken(token),
+					tokenFingerprint: setup.tokenFingerprint,
+					richEnabled: input.richEnabled,
+					richDraftEnabled: input.richDraftEnabled,
+				};
+				drafts.set(draft, token);
+				const pairingMessage =
+					setup.pairingSource === "discovered"
+						? "Telegram private chat discovered and validated."
+						: setup.pairingSource === "reused"
+							? "Stored Telegram private chat validated without polling."
+							: "Supplied Telegram private chat validated.";
+				return {
+					status: "ready",
+					identity,
+					draft,
+					pairingSource: setup.pairingSource,
+					message:
+						identity.status === "foreign" || identity.status === "unknown"
+							? `${pairingMessage} Activation is blocked by the current daemon identity.`
+							: pairingMessage,
+				};
+			} catch (error) {
+				return {
+					status: signal.aborted ? "aborted" : "error",
+					identity: unknownIdentity,
+					message: signal.aborted
+						? "Telegram setup cancelled."
+						: services.sanitizeDiagnostic(
+								error instanceof Error ? error.message : "Telegram setup failed.",
+								token,
+							),
+				};
+			}
+		},
+
+		commitConfigure: async draft => {
+			const token = drafts.get(draft);
+			if (!token) throw new Error("The Telegram setup draft expired. Re-enter the masked bot token.");
+			try {
+				const inactiveMarkerToClear = observedTelegramActivationMarker(ctx.settings, token, draft.chatId);
+				const receipt = await ctx.settings.commitAtomicBatch([
+					{ path: "notifications.enabled", op: "set", value: true },
+					{ path: "notifications.telegram.botToken", op: "set", value: token },
+					{ path: "notifications.telegram.chatId", op: "set", value: draft.chatId },
+					{ path: "notifications.telegram.rich.enabled", op: "set", value: draft.richEnabled },
+					{ path: "notifications.telegram.richDraft.enabled", op: "set", value: draft.richDraftEnabled },
+				]);
+				drafts.delete(draft);
+				const activationMarker = createTelegramActivationMarker({
+					botToken: token,
+					chatId: draft.chatId,
+					state: "blocked",
+					reason: "identity_mismatch",
+				});
+				const controller = ctx.session.notificationSessionController;
+				const activation = await services.reconcileCommittedTelegramConfiguration({
+					receipt,
+					inactiveMarkerToClear,
+					activation: {
+						controller: controller
+							? {
+									enterBlockedRuntime: async () => await controller.enterBlockedRuntime(sessionContext()),
+									clearBlockedRuntime: async () => await controller.clearBlockedRuntime(sessionContext()),
+									reconcileCurrentSession: async () =>
+										await controller.reconcileCurrentSession(sessionContext()),
+								}
+							: {
+									enterBlockedRuntime: async () => undefined,
+									clearBlockedRuntime: async () => undefined,
+									reconcileCurrentSession: async () => undefined,
+								},
+						reconnect,
+						persistInactive: async marker => await persistTelegramActivationMarker(ctx.settings, marker),
+						clearInactive: async marker => await clearTelegramActivationMarker(ctx.settings, marker),
+						marker: activationMarker,
+					},
+				});
+				await notifyAfterDurableCommit();
+				if (activation.status === "blocked_identity") {
+					return {
+						status: "blocked_identity" as const,
+						receipt,
+						message: services.sanitizeDiagnostic(activation.message, token),
+						restore: async () => {
+							const restored = await activation.restore();
+							if (restored.status === "restored" || restored.status === "still_blocked") {
+								await notifyAfterDurableCommit();
+							}
+							return restored;
+						},
+						retainCommitted: () => activation.retainCommitted(),
+					};
+				}
+				return {
+					status: "saved" as const,
+					receipt,
+					message: services.sanitizeDiagnostic("Telegram configuration saved and reconciled.", token),
+				};
+			} catch (error) {
+				throw notificationOperationError(services, error, token);
+			}
+		},
+
+		saveInactive: async draft => {
+			const token = drafts.get(draft);
+			if (!token) throw new Error("The Telegram setup draft expired. Re-enter the masked bot token.");
+			try {
+				const result = await services.saveTelegramInactive({
+					settings: ctx.settings,
+					botToken: token,
+					chatId: draft.chatId,
+				});
+				drafts.delete(draft);
+				await notifyAfterDurableCommit();
+				return {
+					status: "saved_inactive" as const,
+					receipt: result.receipt,
+					message: "Telegram configuration saved inactive; no runtime activation was requested.",
+				};
+			} catch (error) {
+				throw notificationOperationError(services, error, token);
+			}
+		},
+
+		discardConfigureDraft: draft => {
+			drafts.delete(draft);
+		},
+
+		enableGlobally: async () => {
+			try {
+				const receipt = await ctx.settings.commitAtomicBatch([
+					{ path: "notifications.enabled", op: "set", value: true },
+				]);
+				await notifyAfterDurableCommit();
+				return { receipt, message: "Global notifications enabled using stored configuration." };
+			} catch (error) {
+				throw notificationOperationError(services, error, services.getNotificationConfig(ctx.settings).botToken);
+			}
+		},
+
+		disableGlobally: async () => {
+			try {
+				const receipt = await ctx.settings.commitAtomicBatch([
+					{ path: "notifications.enabled", op: "set", value: false },
+				]);
+				await notifyAfterDurableCommit();
+				return { receipt, message: "Global notifications disabled." };
+			} catch (error) {
+				throw notificationOperationError(services, error, services.getNotificationConfig(ctx.settings).botToken);
+			}
+		},
+
+		removeTelegram: async () => {
+			const controller = ctx.session.notificationSessionController;
+			let runtimePrepared = false;
+			try {
+				const result = await services.removeTelegramConfiguration({
+					settings: ctx.settings,
+					removal: {
+						stopAndUnregister: async () => {
+							if (controller) await controller.enterBlockedRuntime(sessionContext());
+							runtimePrepared = true;
+							const unregistered = await services.unregisterNotificationRoot({
+								settings: ctx.settings,
+								cwd: ctx.sessionManager.getCwd(),
+								sessionId: ctx.sessionManager.getSessionId(),
+							});
+							if (unregistered.remainingRoots === 0) {
+								const stopped = await new TelegramDaemonController(ctx.settings).stop();
+								if (!stopped.ok) throw new Error(stopped.message);
+							}
+						},
+					},
+				});
+				if (runtimePrepared && controller) {
+					await controller.clearBlockedRuntime(sessionContext());
+					await controller.reconcileCurrentSession(sessionContext());
+				}
+				await notifyAfterDurableCommit();
+				return {
+					receipt: result.receipt,
+					globallyDisabled: result.globallyDisabled,
+					message: result.globallyDisabled
+						? "Telegram configuration removed and global notifications disabled."
+						: "Telegram configuration removed; Discord or Slack configuration was preserved.",
+				};
+			} catch (error) {
+				if (runtimePrepared) {
+					const restored = await reconnect();
+					if (restored !== "blocked_identity" && controller) {
+						await controller.clearBlockedRuntime(sessionContext());
+						await controller.reconcileCurrentSession(sessionContext());
+					}
+				}
+				throw notificationOperationError(services, error, services.getNotificationConfig(ctx.settings).botToken);
+			}
+		},
+
+		setSessionLocal: async enabled => {
+			const controller = ctx.session.notificationSessionController;
+			if (!controller) return unavailableNotificationSessionResult();
+			try {
+				return await controller.setLocalEnabled(sessionContext(), enabled);
+			} catch (error) {
+				throw notificationOperationError(services, error, services.getNotificationConfig(ctx.settings).botToken);
+			}
+		},
+
+		commitPreferences: async preferences => {
+			try {
+				const receipt = await ctx.settings.commitAtomicBatch([
+					{ path: "notifications.redact", op: "set", value: preferences.redact },
+					{ path: "notifications.verbosity", op: "set", value: preferences.verbosity },
+					{ path: "notifications.sessionScope", op: "set", value: preferences.sessionScope },
+					{ path: "notifications.telegram.rich.enabled", op: "set", value: preferences.richEnabled },
+					{ path: "notifications.telegram.richDraft.enabled", op: "set", value: preferences.richDraftEnabled },
+				]);
+				await notifyAfterDurableCommit();
+				return { receipt, message: "Notification preferences saved atomically." };
+			} catch (error) {
+				throw notificationOperationError(services, error, services.getNotificationConfig(ctx.settings).botToken);
+			}
+		},
+
+		reconcileCurrentSession: async () => {
+			const controller = ctx.session.notificationSessionController;
+			if (!controller) return unavailableNotificationSessionResult();
+			try {
+				return await controller.reconcileCurrentSession(sessionContext());
+			} catch (error) {
+				throw notificationOperationError(services, error, services.getNotificationConfig(ctx.settings).botToken);
+			}
+		},
+	};
+}
+
 export class SelectorController {
-	constructor(private ctx: InteractiveModeContext) {}
+	#credentialAutoImportStateStore?: CredentialAutoImportStateStore;
+
+	constructor(
+		private ctx: InteractiveModeContext,
+		credentialAutoImportStateStore?: CredentialAutoImportStateStore,
+	) {
+		this.#credentialAutoImportStateStore = credentialAutoImportStateStore;
+	}
 
 	async #refreshOAuthProviderAuthState(): Promise<void> {
 		const oauthProviders = getOAuthProviders();
@@ -485,6 +1034,8 @@ export class SelectorController {
 	showSettingsSelector(): void {
 		getAvailableThemes().then(availableThemes => {
 			this.showSelector(done => {
+				const notificationsOperations = createNotificationsEditorOperations(this.ctx);
+
 				const selector = new SettingsSelectorComponent(
 					{
 						availableThinkingLevels: [...this.ctx.session.getAvailableThinkingLevels()],
@@ -540,6 +1091,7 @@ export class SelectorController {
 							this.ctx.ui.requestRender();
 						},
 					},
+					notificationsOperations,
 				);
 				return { component: selector, focus: selector };
 			});
@@ -607,6 +1159,7 @@ export class SelectorController {
 				mode => {
 					this.ctx.previewPetMode(mode);
 				},
+				isPetAvailable(),
 			);
 			return { component: selector, focus: selector.getSelectList() };
 		});
@@ -660,7 +1213,7 @@ export class SelectorController {
 		const dashboard = await AgentDashboard.create(getProjectDir(), this.ctx.settings, this.ctx.ui.terminal.rows, {
 			modelRegistry: this.ctx.session.modelRegistry,
 			activeModelPattern,
-			defaultModelPattern,
+			defaultModelPattern: selectorHead(defaultModelPattern),
 		});
 		this.showSelector(done => {
 			dashboard.onClose = () => {
@@ -942,7 +1495,13 @@ export class SelectorController {
 						const { model, role, thinkingLevel, selector: selectedSelector } = selection;
 						if (role === null) {
 							// Temporary: update agent state but don't persist to settings
-							await this.ctx.session.setModelTemporary(model, thinkingLevel);
+							await this.ctx.session.setModelTemporary(model, thinkingLevel, {
+								cause: "temporary-operation",
+								reason: "other",
+							});
+							this.ctx.session.setDefaultFallbackRuntimeModel(
+								selectedSelector ?? formatModelSelectorValue(`${model.provider}/${model.id}`, thinkingLevel),
+							);
 							this.ctx.statusLine.invalidate();
 							this.ctx.updateEditorBorderColor();
 							this.ctx.showStatus(`Temporary model: ${selectedSelector ?? model.id}`);
@@ -974,6 +1533,7 @@ export class SelectorController {
 								await this.ctx.session.setModel(model, "default", {
 									selector: defaultSelector,
 									thinkingLevel,
+									cause: "user-selection",
 								});
 								if (thinkingLevel && thinkingLevel !== ThinkingLevel.Inherit) {
 									this.ctx.session.setThinkingLevel(thinkingLevel);
@@ -985,21 +1545,14 @@ export class SelectorController {
 								assignments,
 							});
 							if (!materializedProfile) {
-								const overrides = this.ctx.settings.get("task.agentModelOverrides");
-								const nextOverrides = { ...overrides };
-								let writesOverrides = false;
 								for (const targetRole of targetRoles) {
 									const target = GJC_MODEL_ASSIGNMENT_TARGETS[targetRole];
 									if (target.settingsPath === "modelRoles") {
 										this.ctx.settings.setModelRole(targetRole, value);
 									} else {
-										nextOverrides[targetRole] = value;
-										writesOverrides = true;
+										this.ctx.settings.setAgentModelOverride(targetRole, value);
 									}
 								}
-								if (writesOverrides) {
-									this.ctx.settings.set("task.agentModelOverrides", nextOverrides);
-								}
 							}
 							modelSelector.refreshRoleAssignments({
 								currentModel: this.ctx.session.model,
@@ -1026,6 +1579,7 @@ export class SelectorController {
 							await this.ctx.session.setModel(model, role, {
 								selector: selectedSelector,
 								thinkingLevel,
+								cause: "user-selection",
 							});
 							const value = formatModelSelectorValue(
 								selectedSelector ?? `${model.provider}/${model.id}`,
@@ -1069,10 +1623,7 @@ export class SelectorController {
 								if (target.settingsPath === "modelRoles") {
 									this.ctx.settings.setModelRole(role, value);
 								} else {
-									this.ctx.settings.set("task.agentModelOverrides", {
-										...this.ctx.settings.get("task.agentModelOverrides"),
-										[role]: value,
-									});
+									this.ctx.settings.setAgentModelOverride(role, value);
 								}
 							}
 							modelSelector.refreshRoleAssignments({
@@ -1654,34 +2205,110 @@ export class SelectorController {
 			options?.allowExternalCredentialDiscovery === true &&
 			options.trigger === "bare-login"
 		) {
-			const preview = await runExternalCredentialAutoImport({
-				authStorage: {
-					importCredentialIfAbsent: async () => ({
-						inserted: false,
-						reason: "skipped-existing",
-						provider: "",
-						entries: [],
-					}),
-				},
-				trigger: "bare-login",
-				discover: options.externalCredentialDiscover,
-			});
-			const result = preview.discovery ?? { importable: [], skipped: [], environment: [] };
-			const candidates = filterAutoImportOAuthCredentials(result.importable);
-			if (candidates.length > 0) {
-				const confirmed = await this.ctx.showHookConfirm(
-					`Import ${candidates.length} external credential(s)?`,
-					`${formatDiscoverySummary({ ...result, importable: candidates }).join("\n")}\n\n${CREDENTIAL_AUTO_IMPORT_ROTATION_WARNING}`,
-				);
-				if (confirmed) {
-					const summary = await runExternalCredentialAutoImport({
-						authStorage: this.ctx.session.modelRegistry.authStorage,
-						trigger: "bare-login",
-						discover: options.externalCredentialDiscover,
-					});
-					externalCredentialCandidates = summary.imported;
-					if (externalCredentialCandidates.length > 0) {
-						await this.ctx.session.modelRegistry.refresh("offline");
+			const stateStore =
+				this.#credentialAutoImportStateStore ??
+				createCredentialAutoImportStateStore(this.ctx.settings.getAgentDir());
+			let stateRead: CredentialAutoImportStateReadResult | undefined;
+			try {
+				stateRead = await stateStore.read();
+			} catch {
+				logger.warn("Credential auto-import state read failed", { classification: "state-read-failed" });
+				stateRead = { state: {}, problems: [], unreadable: true };
+			}
+			if (stateRead?.unreadable === true) {
+				logger.warn("Credential auto-import state unavailable", { classification: "state-unreadable" });
+				this.ctx.showWarning(CREDENTIAL_AUTO_IMPORT_STATE_UNREADABLE_WARNING);
+			} else if (stateRead && !isCredentialAutoImportStateResolvedForVersion(stateRead.state, VERSION)) {
+				const preview = await runExternalCredentialAutoImport({
+					authStorage: {
+						importCredentialIfAbsent: async () => ({
+							inserted: false,
+							reason: "skipped-existing",
+							provider: "",
+							entries: [],
+						}),
+					},
+					trigger: "bare-login",
+					discover: options.externalCredentialDiscover,
+				});
+				if (!preview.discovered) {
+					this.ctx.showWarning(CREDENTIAL_AUTO_IMPORT_DISCOVERY_WARNING);
+				} else {
+					const result = preview.discovery ?? { importable: [], skipped: [], environment: [] };
+					const candidates = filterAutoImportOAuthCredentials(result.importable);
+					const previewSourceFailures = preview.failures.filter(failure => failure.credential === undefined);
+					if (candidates.length === 0 && previewSourceFailures.length > 0) {
+						this.ctx.showWarning(CREDENTIAL_AUTO_IMPORT_DISCOVERY_WARNING);
+					} else if (candidates.length > 0) {
+						const confirmed = await this.ctx.showHookConfirm(
+							`Import ${candidates.length} external credential(s)?`,
+							`${formatCredentialAutoImportPrompt(candidates)}\n\n${CREDENTIAL_AUTO_IMPORT_ROTATION_WARNING}`,
+						);
+						if (!confirmed) {
+							let persisted = false;
+							try {
+								persisted = await stateStore.write({ initialImportResolution: "declined" });
+							} catch {
+								logger.warn("Credential auto-import state persistence failed", {
+									classification: "state-write-failed",
+								});
+							}
+							if (!persisted) this.ctx.showWarning(CREDENTIAL_AUTO_IMPORT_PERSISTENCE_WARNING);
+						} else {
+							const summary = await runExternalCredentialAutoImport({
+								authStorage: this.ctx.session.modelRegistry.authStorage,
+								trigger: "bare-login",
+								discover: options.externalCredentialDiscover,
+							});
+							if (!summary.discovered) {
+								logCredentialAutoImportFailures("bare-login", summary.failures);
+								this.ctx.showWarning(CREDENTIAL_AUTO_IMPORT_RETRY_WARNING);
+							} else {
+								const secondResult = summary.discovery ?? { importable: [], skipped: [], environment: [] };
+								const secondCandidates = filterAutoImportOAuthCredentials(secondResult.importable);
+								const secondSourceFailures = summary.failures.filter(
+									failure => failure.credential === undefined,
+								);
+								const handledCandidates = summary.imported.length + summary.skipped.length > 0;
+								if (handledCandidates || (secondCandidates.length === 0 && secondSourceFailures.length === 0)) {
+									let persisted = false;
+									try {
+										persisted = await stateStore.write({ initialImportResolution: "accepted" });
+									} catch {
+										logger.warn("Credential auto-import state persistence failed", {
+											classification: "state-write-failed",
+										});
+									}
+									if (!persisted) this.ctx.showWarning(CREDENTIAL_AUTO_IMPORT_PERSISTENCE_WARNING);
+									externalCredentialCandidates = summary.imported.map(credential => ({
+										...credential,
+										source: formatCredentialAutoImportCandidateLabel(credential),
+									}));
+									if (!handledCandidates) {
+										this.ctx.showStatus("External credentials were no longer available to import.");
+									}
+									if (summary.imported.length > 0) {
+										try {
+											await this.ctx.session.modelRegistry.refresh("offline");
+										} catch {
+											logger.warn("Credential auto-import refresh failed", {
+												classification: "refresh-failed",
+											});
+											this.ctx.showWarning(CREDENTIAL_AUTO_IMPORT_REFRESH_WARNING);
+										}
+									}
+									if (handledCandidates && summary.failures.length > 0) {
+										logCredentialAutoImportFailures("bare-login", summary.failures);
+										this.ctx.showWarning(CREDENTIAL_AUTO_IMPORT_RETRY_WARNING);
+									}
+								} else if (secondCandidates.length > 0 && summary.failures.length > 0) {
+									logCredentialAutoImportFailures("bare-login", summary.failures);
+									this.ctx.showWarning(CREDENTIAL_AUTO_IMPORT_RETRY_WARNING);
+								} else {
+									this.ctx.showWarning(CREDENTIAL_AUTO_IMPORT_DISCOVERY_WARNING);
+								}
+							}
+						}
 					}
 				}
 			}