@gajae-code/coding-agent 0.10.1 → 0.11.0

package/src/task/executor.ts

@@ -914,19 +914,24 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 		progress.recentOutput = [];
 	};
 
+	const forwardSubagentEvent = (
+		event: AgentEvent | Extract<AgentSessionEvent, { type: "model_fallback_switched" }>,
+	) => {
+		if (!options.eventBus) return;
+		options.eventBus.emit(TASK_SUBAGENT_EVENT_CHANNEL, {
+			index,
+			agent: agent.name,
+			agentSource: agent.source,
+			task,
+			assignment,
+			event,
+		});
+	};
+
 	const processEvent = (event: AgentEvent) => {
 		if (resolved) return;
 
-		if (options.eventBus) {
-			options.eventBus.emit(TASK_SUBAGENT_EVENT_CHANNEL, {
-				index,
-				agent: agent.name,
-				agentSource: agent.source,
-				task,
-				assignment,
-				event,
-			});
-		}
+		forwardSubagentEvent(event);
 
 		const now = Date.now();
 		let flushProgress = false;
@@ -1234,6 +1239,9 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 				authFallbackUsed,
 				requestedModel,
 				fallbackReason,
+				activeIndex,
+				parentFallbackSelector,
+				skips,
 			} = await awaitAbortable(
 				resolveModelOverrideWithAuthFallback(
 					modelPatterns,
@@ -1241,6 +1249,7 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 					modelRegistry,
 					settings,
 					options.parentSessionId,
+					{ managedFallback: true },
 				),
 			);
 			if (model) {
@@ -1431,6 +1440,21 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 			);
 
 			activeSession = session;
+			// Each subagent invocation owns a fresh controller; its configured chain
+			// is scoped to this child session and never shares parent sticky state.
+			// Auth-aware resolution can substitute the parent model only after every
+			// override entry was unavailable. Rebase the controller to that concrete
+			// parent selector so its request is never charged to override index zero.
+			session.setConfiguredModelChain(
+				"default",
+				parentFallbackSelector ? [parentFallbackSelector] : modelPatterns,
+				"subagent",
+				agent.name,
+				true,
+			);
+			if (activeIndex !== undefined && !parentFallbackSelector) {
+				session.seedDefaultFallbackResolution(activeIndex, skips);
+			}
 			const liveSubagentId = options.subagentId ?? id;
 			const manager = AsyncJobManager.instance();
 			if (manager) {
@@ -1508,12 +1532,14 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 							pendingExtensionMessages.push(sendPromise);
 						},
 						sendUserMessage: (content, options) => {
-							const sendPromise = session.sendUserMessage(content, options).catch(e => {
+							const send = session.sendUserMessage(content, options);
+							const observedSend = send.catch(e => {
 								logger.error("Extension sendUserMessage failed", {
 									error: e instanceof Error ? e.message : String(e),
 								});
 							});
-							pendingExtensionMessages.push(sendPromise);
+							pendingExtensionMessages.push(observedSend);
+							return send;
 						},
 						appendEntry: (customType, data) => {
 							session.sessionManager.appendCustomEntry(customType, data);
@@ -1528,7 +1554,17 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 						getCommands: () => getSessionSlashCommands(session),
 						setModel: model => runExtensionSetModel(session, model),
 						getThinkingLevel: () => session.thinkingLevel,
-						setThinkingLevel: level => session.setThinkingLevel(level),
+						setThinkingLevel: (level, persist) => session.setThinkingLevel(level, persist),
+						getThinkingVisibility: () => session.getThinkingVisibility(),
+						setThinkingVisibility: (visibility, persist) => session.setThinkingVisibility(visibility, persist),
+						cycleThinkingLevel: () => session.cycleThinkingLevel(),
+						setThinkingLevelForControl: (level, persist) => session.setThinkingLevelForControl(level, persist),
+						setThinkingVisibilityForControl: (visibility, persist) =>
+							session.setThinkingVisibilityForControl(visibility, persist),
+						setModelTemporaryForControl: (model, expectedSessionId) =>
+							session.setModelTemporaryForControl(model, expectedSessionId),
+						fetchUsageReportsForControl: () => session.fetchUsageReportsForControl(),
+						getThinkingScopeForControl: () => session.getThinkingScopeForControl(),
 						getSessionName: () => session.sessionManager.getSessionName(),
 						setSessionName: async name => {
 							await session.sessionManager.setSessionName(name, "user");
@@ -1539,10 +1575,19 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 						isIdle: () => !session.isStreaming,
 						abort: () => session.abort(),
 						hasPendingMessages: () => session.queuedMessageCount > 0,
+						getPendingMessageCounts: () => session.pendingMessageCounts,
+						getTranscript: () => session.getTranscript(),
+						getTranscriptBody: entryId => session.getTranscriptBody(entryId),
+						getGoalState: () => session.getGoalModeState(),
+						getTodoState: () => session.getTodoPhases(),
+						getQueuedMessages: () => session.getQueuedMessageEntries(),
+						getActiveTools: () => session.getActiveToolNames(),
+						getAllTools: () => session.getAllToolNames(),
 						shutdown: () => {},
 						getContextUsage: () => session.getContextUsage(),
 						getSystemPrompt: () => session.systemPrompt,
 						compact: instructionsOrOptions => runExtensionCompact(session, instructionsOrOptions),
+						clearContext: () => session.clearContext(),
 					},
 				);
 				extensionRunner.onError(err => {
@@ -1581,6 +1626,10 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 					scheduleProgress(true);
 					return;
 				}
+				if (event.type === "model_fallback_switched") {
+					forwardSubagentEvent(event);
+					return;
+				}
 				if (isAgentEvent(event)) {
 					try {
 						processEvent(event);

package/src/tools/ask-answer-registry.ts

@@ -7,7 +7,7 @@
  * source; registering returns a disposer.
  */
 
-import type { WorkflowGateEmitter } from "../modes/shared/agent-wire/unattended-session";
+import type { WorkflowGateEmitter } from "../modes/shared/agent-wire/workflow-gate-broker";
 import type { AskAnswerSource } from "./index";
 
 const sources = new Map<string, AskAnswerSource>();

package/src/tools/ask.ts

@@ -758,9 +758,14 @@ export class AskTool implements AgentTool<typeof askSchema, AskToolDetails> {
 			if (receipt) await receipt.settle(settlement);
 		};
 		const gateEmitter = this.session.getWorkflowGateEmitter?.();
-		const canUseWorkflowGate = gateEmitter?.isUnattended() === true;
-
-		// Headless fallback: unattended workflow gates are the non-TUI answer path.
+		// A durable workflow-gate emitter now exists for every session, and its
+		// isUnattended() is always true, so it can no longer signal "no local UI".
+		// The workflow gate is only the headless (non-TUI) answer path: when a real
+		// interactive UI is present, prefer it — otherwise attended TUI asks would
+		// route to emitGate() and hang forever waiting on a remote responder.
+		const hasInteractiveUi = context?.hasUI === true && !!context.ui;
+		const canUseWorkflowGate = !hasInteractiveUi && gateEmitter?.isUnattended() === true;
+		// Headless fallback: SDK workflow gates are the non-TUI answer path.
 		if (!canUseWorkflowGate && (!context?.hasUI || !context.ui)) {
 			context?.abort();
 			throw new ToolAbortError("Ask tool requires interactive mode");
@@ -772,9 +777,9 @@ export class AskTool implements AgentTool<typeof askSchema, AskToolDetails> {
 				if (!extensionUi) throw new ToolAbortError("Ask tool requires interactive mode");
 				const source = this.session.getAskAnswerSource?.();
 				if (!source) return extensionUi.select(prompt, options, dialogOptions);
-				// Race the local UI against a remote answer (e.g. a Telegram reply via the
-				// notifications SDK) so asks can be answered without RPC mode. First valid
-				// answer wins; the loser is aborted so neither side is left hanging:
+				// Race the local UI against a remote answer (e.g. an SDK reply) so asks
+				// can be answered without local UI interaction. The first valid answer
+				// wins; the loser is aborted so neither side is left hanging:
 				//   - local wins  -> abort the remote source (marks the action resolved-locally)
 				//   - remote wins -> abort the local selector so the TUI dialog actually closes
 				const remoteController = new AbortController();
@@ -975,8 +980,8 @@ export class AskTool implements AgentTool<typeof askSchema, AskToolDetails> {
 		) => {
 			const rawOptionLabels = q.options.map(o => o.label);
 			const questionIndex = params.questions.indexOf(q);
-			// Unattended (#316/#323/G011): route the question through the workflow-gate
-			// emitter instead of the interactive UI; the external agent answers over RPC.
+			// Route headless asks through the SDK workflow-gate emitter; a connected
+			// SDK responder supplies the durable answer instead of an interactive UI.
 			if (gateEmitter && canUseWorkflowGate) {
 				const gateQuestion: AskGateQuestion = {
 					id: q.id,

package/src/tools/browser/STEALTH-THIRD-PARTY-NOTICES.md

@@ -0,0 +1,26 @@
+# Stealth Third-Party Notices
+
+Per the approved plan, anti-detection evasions are **reimplemented/adapted** as
+first-party code (no vendored source tree, no runtime dependency). This file
+records provenance for evasion techniques whose semantics were informed by the
+following open-source projects. Each individual reimplemented script also
+carries an attributing header comment.
+
+| Source project | License | Techniques referenced |
+|----------------|---------|-----------------------|
+| rebrowser-patches | MIT | CDP `Runtime.enable` leak mitigation (data-driven; landed only if the offline baseline shows a runtime/CDP leak signal) |
+| puppeteer-extra-plugin-stealth | MIT | Fingerprint evasion signal set (navigator/webgl/plugins/permissions/webrtc surfaces) overlapping and complementing the existing injection scripts |
+| fingerprint-suite (fingerprint-injector / generator) | Apache-2.0 | Coherent fingerprint attribute generation ideas |
+
+No source files from these projects are copied into this repository. Only the
+observable behaviors/signal semantics were reimplemented against `puppeteer-core`
+after being confirmed by the offline benchmark suite
+(`test/fixtures/stealth-detectors/`, `src/tools/browser/benchmark/`).
+
+## Detector fixtures
+
+The offline detector fixtures under `test/fixtures/stealth-detectors/` are
+first-party probes modeled on the public boolean signal sets used by
+`bot.sannysoft.com` and CreepJS. They are self-contained (inline JS, zero
+network) and are not verbatim copies of those sites. See that directory's
+`MANIFEST.json` for the refresh procedure.

package/src/tools/browser/benchmark/detector-report.ts

@@ -0,0 +1,157 @@
+/**
+ * Offline stealth-detector benchmark model.
+ *
+ * Pure, deterministic logic for the anti-detection benchmark suite: it converts
+ * a browser-collected fingerprint probe into a normalized per-detector verdict,
+ * implements the falsifiable CI gate (see plan Phase 1 / R-T3), and renders a
+ * before/after report. No browser or network access lives here so it can be
+ * unit-tested deterministically; the harness that drives the real browser tool
+ * against vendored detector fixtures feeds its output into these functions.
+ */
+
+export type SignalStatus = "pass" | "fail";
+
+/** A single boolean fingerprint signal, e.g. "navigator.webdriver is undefined". */
+export interface DetectorSignal {
+	/** Stable identifier, used to diff across runs. */
+	id: string;
+	/** Human-readable label for the report. */
+	label: string;
+	/** `pass` means the signal looks human; `fail` means it leaks automation. */
+	status: SignalStatus;
+	/** Optional observed value for debugging. */
+	detail?: string;
+}
+
+export type AutomatedVerdict = "human" | "bot" | "unknown";
+
+/** Normalized result for one detector (e.g. bot.sannysoft, CreepJS). */
+export interface DetectorResult {
+	detector: string;
+	signals: DetectorSignal[];
+	/** Overall automated/not classification when the detector exposes one. */
+	automatedVerdict: AutomatedVerdict;
+	/** Absolute trust score (observability-only, never a hard gate). */
+	trustScore: number | null;
+}
+
+/** Shape emitted by the offline probe fixture on `window.__stealthProbe`. */
+export interface RawProbe {
+	detector: string;
+	signals: Array<{ id: string; label: string; pass: boolean; detail?: string }>;
+	automatedVerdict?: AutomatedVerdict;
+	trustScore?: number | null;
+}
+
+/** Convert a raw browser-collected probe into a normalized {@link DetectorResult}. */
+export function parseProbe(raw: RawProbe): DetectorResult {
+	if (!raw || typeof raw.detector !== "string" || !Array.isArray(raw.signals)) {
+		throw new Error("invalid stealth probe payload");
+	}
+	const signals: DetectorSignal[] = raw.signals.map(s => ({
+		id: s.id,
+		label: s.label,
+		status: s.pass ? "pass" : "fail",
+		...(s.detail !== undefined ? { detail: s.detail } : {}),
+	}));
+	return {
+		detector: raw.detector,
+		signals,
+		automatedVerdict: raw.automatedVerdict ?? "unknown",
+		trustScore: raw.trustScore ?? null,
+	};
+}
+
+function passCount(result: DetectorResult): number {
+	return result.signals.filter(s => s.status === "pass").length;
+}
+
+function failingSignalIds(result: DetectorResult): Set<string> {
+	return new Set(result.signals.filter(s => s.status === "fail").map(s => s.id));
+}
+
+export interface GateOutcome {
+	pass: boolean;
+	reasons: string[];
+}
+
+/**
+ * Falsifiable CI gate (plan Phase 1 / R-T3, R-C1, R-C2):
+ *   (a) zero failing signals in the current run, AND
+ *       current pass-count >= baseline pass-count (no silent regression), AND
+ *   (b) either at least one signal that failed at baseline now passes,
+ *       OR the baseline was already all-green (empty-gap regression lock).
+ * The absolute `trustScore` is never consulted here; it is observability-only.
+ */
+export function evaluateGate(baseline: DetectorResult, current: DetectorResult): GateOutcome {
+	const reasons: string[] = [];
+	const currentFail = failingSignalIds(current);
+	if (currentFail.size > 0) {
+		reasons.push(
+			`${current.detector}: ${currentFail.size} signal(s) still leak automation: ${[...currentFail].join(", ")}`,
+		);
+	}
+
+	const baselinePass = passCount(baseline);
+	const currentPass = passCount(current);
+	if (currentPass < baselinePass) {
+		reasons.push(`${current.detector}: pass-count regressed (${currentPass} < baseline ${baselinePass})`);
+	}
+
+	const baselineFail = failingSignalIds(baseline);
+	const currentPassIds = new Set(current.signals.filter(s => s.status === "pass").map(s => s.id));
+	const newlyPassing = [...baselineFail].filter(id => currentPassIds.has(id));
+	const baselineAllGreen = baselineFail.size === 0;
+	if (!baselineAllGreen && newlyPassing.length === 0) {
+		reasons.push(`${current.detector}: no baseline-failing signal was fixed (improvement required)`);
+	}
+
+	return { pass: reasons.length === 0, reasons };
+}
+
+/** Aggregate gate across every detector; passes only when all detectors pass. */
+export function evaluateSuiteGate(
+	baseline: readonly DetectorResult[],
+	current: readonly DetectorResult[],
+): GateOutcome {
+	const reasons: string[] = [];
+	const currentByName = new Map(current.map(r => [r.detector, r]));
+	for (const base of baseline) {
+		const now = currentByName.get(base.detector);
+		if (!now) {
+			reasons.push(`${base.detector}: missing from current run`);
+			continue;
+		}
+		reasons.push(...evaluateGate(base, now).reasons);
+	}
+	return { pass: reasons.length === 0, reasons };
+}
+
+/** Render a deterministic before/after markdown report for one run. */
+export function renderReport(baseline: readonly DetectorResult[], current: readonly DetectorResult[]): string {
+	const lines: string[] = ["# Stealth Benchmark Report", ""];
+	const gate = evaluateSuiteGate(baseline, current);
+	lines.push(`Gate: ${gate.pass ? "PASS" : "FAIL"}`, "");
+	const currentByName = new Map(current.map(r => [r.detector, r]));
+	for (const base of baseline) {
+		const now = currentByName.get(base.detector);
+		lines.push(`## ${base.detector}`);
+		lines.push(
+			`- Automated verdict: ${base.automatedVerdict} -> ${now?.automatedVerdict ?? "n/a"}`,
+			`- Trust score (observability): ${base.trustScore ?? "n/a"} -> ${now?.trustScore ?? "n/a"}`,
+			`- Passing signals: ${passCount(base)} -> ${now ? passCount(now) : "n/a"} of ${base.signals.length}`,
+			"",
+			"| Signal | Baseline | Current |",
+			"|--------|----------|---------|",
+		);
+		for (const sig of base.signals) {
+			const nowSig = now?.signals.find(s => s.id === sig.id);
+			lines.push(`| ${sig.label} | ${sig.status} | ${nowSig?.status ?? "n/a"} |`);
+		}
+		lines.push("");
+	}
+	if (!gate.pass) {
+		lines.push("## Blocking reasons", ...gate.reasons.map(r => `- ${r}`), "");
+	}
+	return lines.join("\n");
+}

package/src/tools/browser/benchmark/run-suite.ts

@@ -0,0 +1,39 @@
+/**
+ * Offline stealth benchmark harness (plan Phase 1).
+ *
+ * Drives a puppeteer Page (already stealth-patched by the browser tool) against
+ * self-contained offline detector fixtures and collects normalized results. The
+ * navigation/evaluation is injected so this stays unit-testable without a real
+ * browser; the integration test wires a live puppeteer Page.
+ */
+
+import type { Page } from "puppeteer-core";
+import type { DetectorResult, RawProbe } from "./detector-report";
+import { parseProbe } from "./detector-report";
+
+/** Minimal surface of a puppeteer Page that the harness needs. */
+export type SuitePage = Pick<Page, "goto" | "evaluate">;
+
+export interface SuiteFixture {
+	/** file:// (or http://) URL of the offline detector fixture. */
+	url: string;
+}
+
+/** Read the probe the fixture placed on `window.__stealthProbe`. */
+function readProbe(): RawProbe {
+	// Runs in the browser context.
+	const probe = (globalThis as unknown as { __stealthProbe?: RawProbe }).__stealthProbe;
+	if (!probe) throw new Error("fixture did not expose window.__stealthProbe");
+	return probe;
+}
+
+/** Navigate to each fixture and collect a normalized DetectorResult per fixture. */
+export async function runOfflineSuite(page: SuitePage, fixtures: readonly SuiteFixture[]): Promise<DetectorResult[]> {
+	const results: DetectorResult[] = [];
+	for (const fixture of fixtures) {
+		await page.goto(fixture.url, { waitUntil: "load" });
+		const raw = await page.evaluate(readProbe);
+		results.push(parseProbe(raw));
+	}
+	return results;
+}