@gajae-code/coding-agent 0.10.2 → 0.11.0

package/src/setup/credential-auto-import.ts

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type {
@@ -7,8 +8,8 @@ import type {
 	AuthStorage,
 } from "@gajae-code/ai";
 import { getAgentDir, logger, VERSION } from "@gajae-code/utils";
+import { withFileLock } from "../config/file-lock";
 import type { ModelRegistry } from "../config/model-registry";
-
 import {
 	type CredentialDiscoveryResult,
 	type CredentialOrigin,
@@ -23,42 +24,206 @@ import {
 
 export const CREDENTIAL_AUTO_IMPORT_ROTATION_WARNING =
 	"Refreshing in gjc may log out the Claude/Codex CLI because OAuth refresh tokens can rotate.";
+export const CREDENTIAL_AUTO_IMPORT_PERSISTENCE_WARNING =
+	"Credential import preference could not be saved; external credentials may be offered again.";
+export const CREDENTIAL_AUTO_IMPORT_REFRESH_WARNING =
+	"Imported credentials were saved, but provider availability could not be refreshed.";
+export const CREDENTIAL_AUTO_IMPORT_DISCOVERY_WARNING =
+	"External credential discovery could not be completed. Use /provider to import credentials manually.";
+export const CREDENTIAL_AUTO_IMPORT_RETRY_WARNING =
+	"Some external credentials could not be imported. Use /provider to retry.";
+
+export const CREDENTIAL_AUTO_IMPORT_STATE_UNREADABLE_WARNING =
+	"Credential import preference could not be read. External credential discovery was skipped; use /provider to import credentials manually.";
 
 export type CredentialAutoImportSourceLabel = "claude-code-file" | "claude-code-keychain" | "codex-file";
 export type CredentialAutoImportTrigger = "startup" | "bare-login" | "setup-cli";
+export type InitialImportResolution = "accepted" | "declined";
+export type CredentialAutoImportStateProblem =
+	| "invalid-initial-import-resolution"
+	| "invalid-last-import-version"
+	| "malformed-json"
+	| "malformed-root";
 
 const CREDENTIAL_AUTO_IMPORT_STATE_FILENAME = "credential-auto-import-state.json";
+const VERSION_MARKER_PATTERN = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+
+export interface CredentialAutoImportStateFile {
+	lastImportVersion?: string;
+	initialImportResolution?: InitialImportResolution;
+}
+
+export interface CredentialAutoImportStateReadResult {
+	state: CredentialAutoImportStateFile;
+	problems: CredentialAutoImportStateProblem[];
+	unreadable: boolean;
+}
 
-interface CredentialAutoImportStateFile {
-	lastImportVersion?: unknown;
+export interface CredentialAutoImportStateMutation {
+	lastImportVersion?: string;
+	initialImportResolution?: InitialImportResolution;
+}
+
+export interface CredentialAutoImportStateStore {
+	read: () => Promise<CredentialAutoImportStateReadResult>;
+	write: (mutation: CredentialAutoImportStateMutation) => Promise<boolean>;
+}
+
+export interface CredentialAutoImportStateStoreDependencies {
+	withFileLock?: <T>(filePath: string, transaction: () => Promise<T>) => Promise<T>;
+	rename?: (oldPath: string, newPath: string) => Promise<void>;
 }
 
 export function getCredentialAutoImportStatePath(agentDir: string = getAgentDir()): string {
 	return path.join(agentDir, CREDENTIAL_AUTO_IMPORT_STATE_FILENAME);
 }
 
-export async function readCredentialImportMarker(agentDir?: string): Promise<string | undefined> {
+function isEnoent(error: unknown): boolean {
+	return (error as NodeJS.ErrnoException | undefined)?.code === "ENOENT";
+}
+
+function isValidVersionMarker(value: unknown): value is string {
+	return (
+		typeof value === "string" &&
+		value.length > 0 &&
+		value.trim() === value &&
+		value.length <= 128 &&
+		VERSION_MARKER_PATTERN.test(value)
+	);
+}
+
+function isInitialImportResolution(value: unknown): value is InitialImportResolution {
+	return value === "accepted" || value === "declined";
+}
+
+function projectCredentialAutoImportState(value: unknown): CredentialAutoImportStateReadResult {
+	if (!value || typeof value !== "object" || Array.isArray(value)) {
+		return { state: {}, problems: ["malformed-root"], unreadable: false };
+	}
+
+	const record = value as Record<string, unknown>;
+	const state: CredentialAutoImportStateFile = {};
+	const problems: CredentialAutoImportStateProblem[] = [];
+	if (Object.hasOwn(record, "initialImportResolution")) {
+		if (isInitialImportResolution(record.initialImportResolution)) {
+			state.initialImportResolution = record.initialImportResolution;
+		} else {
+			problems.push("invalid-initial-import-resolution");
+		}
+	}
+	if (Object.hasOwn(record, "lastImportVersion")) {
+		if (isValidVersionMarker(record.lastImportVersion)) {
+			state.lastImportVersion = record.lastImportVersion;
+		} else {
+			problems.push("invalid-last-import-version");
+		}
+	}
+	return { state, problems, unreadable: false };
+}
+
+async function readCredentialAutoImportStateAtPath(statePath: string): Promise<CredentialAutoImportStateReadResult> {
 	try {
-		const raw = await fs.readFile(getCredentialAutoImportStatePath(agentDir), "utf-8");
-		const parsed = JSON.parse(raw) as CredentialAutoImportStateFile;
-		return typeof parsed.lastImportVersion === "string" ? parsed.lastImportVersion : undefined;
-	} catch {
-		return undefined;
+		const raw = await fs.readFile(statePath, "utf-8");
+		try {
+			return projectCredentialAutoImportState(JSON.parse(raw) as unknown);
+		} catch {
+			return { state: {}, problems: ["malformed-json"], unreadable: false };
+		}
+	} catch (error: unknown) {
+		if (isEnoent(error)) return { state: {}, problems: [], unreadable: false };
+		return { state: {}, problems: [], unreadable: true };
 	}
 }
 
-export async function writeCredentialImportMarker(version: string, agentDir?: string): Promise<boolean> {
+function serializeCredentialAutoImportState(state: CredentialAutoImportStateFile): string {
+	const serialized: CredentialAutoImportStateFile = {};
+	if (isValidVersionMarker(state.lastImportVersion)) serialized.lastImportVersion = state.lastImportVersion;
+	if (isInitialImportResolution(state.initialImportResolution)) {
+		serialized.initialImportResolution = state.initialImportResolution;
+	}
+	return `${JSON.stringify(serialized)}\n`;
+}
+
+async function writeCredentialAutoImportStateAtomic(
+	statePath: string,
+	state: CredentialAutoImportStateFile,
+	rename: (oldPath: string, newPath: string) => Promise<void> = fs.rename,
+): Promise<void> {
+	const temporaryPath = `${statePath}.tmp.${process.pid}.${Date.now()}.${randomUUID()}`;
 	try {
-		const statePath = getCredentialAutoImportStatePath(agentDir);
-		await fs.mkdir(path.dirname(statePath), { recursive: true });
-		await fs.writeFile(statePath, `${JSON.stringify({ lastImportVersion: version })}\n`);
-		return true;
+		const handle = await fs.open(temporaryPath, "wx", 0o600);
+		try {
+			await handle.writeFile(serializeCredentialAutoImportState(state));
+		} finally {
+			await handle.close();
+		}
+		await rename(temporaryPath, statePath);
 	} catch (error: unknown) {
-		logger.warn("Failed to persist credential auto-import state", { error });
-		return false;
+		await fs.rm(temporaryPath, { force: true }).catch(() => {});
+		throw error;
 	}
 }
 
+export function createCredentialAutoImportStateStore(
+	agentDir: string = getAgentDir(),
+	dependencies: CredentialAutoImportStateStoreDependencies = {},
+): CredentialAutoImportStateStore {
+	const statePath = getCredentialAutoImportStatePath(agentDir);
+	const lock = dependencies.withFileLock ?? withFileLock;
+	const rename = dependencies.rename ?? fs.rename;
+	return {
+		read: () => readCredentialAutoImportStateAtPath(statePath),
+		write: async mutation => {
+			if (
+				(mutation.lastImportVersion !== undefined && !isValidVersionMarker(mutation.lastImportVersion)) ||
+				(mutation.initialImportResolution !== undefined &&
+					!isInitialImportResolution(mutation.initialImportResolution))
+			) {
+				return false;
+			}
+			try {
+				await fs.mkdir(path.dirname(statePath), { recursive: true, mode: 0o700 });
+				await lock(statePath, async () => {
+					const current = await readCredentialAutoImportStateAtPath(statePath);
+					if (current.unreadable) throw new Error("Credential auto-import state became unreadable");
+					const next: CredentialAutoImportStateFile = { ...current.state };
+					if (mutation.lastImportVersion !== undefined) next.lastImportVersion = mutation.lastImportVersion;
+					if (next.initialImportResolution === undefined && mutation.initialImportResolution !== undefined) {
+						next.initialImportResolution = mutation.initialImportResolution;
+					}
+					await writeCredentialAutoImportStateAtomic(statePath, next, rename);
+				});
+				return true;
+			} catch {
+				logger.warn("Credential auto-import state persistence failed", { classification: "state-write-failed" });
+				return false;
+			}
+		},
+	};
+}
+
+export async function readCredentialAutoImportState(agentDir?: string): Promise<CredentialAutoImportStateReadResult> {
+	return createCredentialAutoImportStateStore(agentDir).read();
+}
+
+export function isCredentialAutoImportStateResolvedForVersion(
+	state: CredentialAutoImportStateFile,
+	version: string,
+): boolean {
+	return (
+		state.initialImportResolution !== undefined ||
+		(state.lastImportVersion !== undefined && state.lastImportVersion === version)
+	);
+}
+
+export async function readCredentialImportMarker(agentDir?: string): Promise<string | undefined> {
+	return (await readCredentialAutoImportState(agentDir)).state.lastImportVersion;
+}
+
+export async function writeCredentialImportMarker(version: string, agentDir?: string): Promise<boolean> {
+	return createCredentialAutoImportStateStore(agentDir).write({ lastImportVersion: version });
+}
+
 export enum CredentialAutoImportFailureClass {
 	DiscoveryUnavailable = "discovery-unavailable",
 	SourceUnreadable = "source-unreadable",
@@ -93,6 +258,63 @@ export interface CredentialAutoImportResult {
 	globalDiscoveryFailure?: CredentialAutoImportFailure;
 }
 
+const CREDENTIAL_AUTO_IMPORT_PROMPT_PROVIDERS: readonly ExternalProvider[] = ["anthropic", "openai-codex"];
+const CREDENTIAL_AUTO_IMPORT_PROMPT_ORIGINS: readonly CredentialOrigin[] = [
+	"claude-code-file",
+	"claude-code-keychain",
+	"codex-file",
+];
+const CREDENTIAL_AUTO_IMPORT_ORIGIN_LABELS: Record<CredentialOrigin, string> = {
+	"claude-code-file": "Claude Code file",
+	"claude-code-keychain": "Claude Code Keychain",
+	"codex-file": "Codex CLI file",
+};
+const CREDENTIAL_AUTO_IMPORT_FAILURE_CLASSES = new Set(Object.values(CredentialAutoImportFailureClass));
+
+export function formatCredentialAutoImportCandidateLabel(
+	candidate: Pick<ImportableCredential, "provider" | "origin">,
+): string {
+	const provider = CREDENTIAL_AUTO_IMPORT_PROMPT_PROVIDERS.includes(candidate.provider)
+		? EXTERNAL_PROVIDER_LABELS[candidate.provider]
+		: undefined;
+	const origin = CREDENTIAL_AUTO_IMPORT_PROMPT_ORIGINS.includes(candidate.origin)
+		? CREDENTIAL_AUTO_IMPORT_ORIGIN_LABELS[candidate.origin]
+		: undefined;
+	return provider && origin ? `${provider} · ${origin}` : "External OAuth credential";
+}
+
+export function formatCredentialAutoImportPrompt(
+	candidates: readonly Pick<ImportableCredential, "provider" | "origin">[],
+): string {
+	const lines: string[] = [];
+	for (const provider of CREDENTIAL_AUTO_IMPORT_PROMPT_PROVIDERS) {
+		for (const origin of CREDENTIAL_AUTO_IMPORT_PROMPT_ORIGINS) {
+			const count = candidates.filter(
+				candidate => candidate.provider === provider && candidate.origin === origin,
+			).length;
+			if (count > 0)
+				lines.push(
+					`${EXTERNAL_PROVIDER_LABELS[provider]} · ${CREDENTIAL_AUTO_IMPORT_ORIGIN_LABELS[origin]}: ${count}`,
+				);
+		}
+	}
+	return `External OAuth credentials found: ${candidates.length}\n${lines.join("\n")}`;
+}
+
+export function logCredentialAutoImportFailures(
+	trigger: CredentialAutoImportTrigger,
+	failures: readonly Pick<CredentialAutoImportFailure, "failureClass">[],
+): void {
+	const failureCounts: Partial<Record<CredentialAutoImportFailureClass, number>> = {};
+	for (const failure of failures) {
+		if (!CREDENTIAL_AUTO_IMPORT_FAILURE_CLASSES.has(failure.failureClass)) continue;
+		failureCounts[failure.failureClass] = (failureCounts[failure.failureClass] ?? 0) + 1;
+	}
+	if (Object.keys(failureCounts).length > 0) {
+		logger.warn("Credential auto-import completed with failures", { trigger, failureCounts });
+	}
+}
+
 export type CredentialAutoImportAuthStorage = Pick<AuthStorage, "importCredentialIfAbsent">;
 
 export interface CredentialAutoImportOptions {
@@ -204,18 +426,38 @@ export function formatCredentialAutoImportResult(result: CredentialAutoImportRes
 	return lines;
 }
 
-export interface CredentialImportMarkerStore {
-	read: () => Promise<string | undefined> | string | undefined;
-	write: (version: string) => Promise<boolean> | boolean;
-}
-
 export interface StartupCredentialAutoImportOptions {
 	authStorage: CredentialAutoImportOptions["authStorage"];
 	modelRegistry: Pick<ModelRegistry, "refresh">;
 	discover?: CredentialAutoImportOptions["discover"];
 	version?: string;
 	agentDir?: string;
-	markerStore?: CredentialImportMarkerStore;
+	stateStore?: CredentialAutoImportStateStore;
+}
+
+function appendNoticeLine(notice: string | undefined, line: string): string {
+	return notice ? `${notice}\n${line}` : line;
+}
+
+async function readStateSafely(store: CredentialAutoImportStateStore): Promise<CredentialAutoImportStateReadResult> {
+	try {
+		return await store.read();
+	} catch {
+		logger.warn("Credential auto-import state read failed", { classification: "state-read-failed" });
+		return { state: {}, problems: [], unreadable: true };
+	}
+}
+
+async function writeStateSafely(
+	store: CredentialAutoImportStateStore,
+	mutation: CredentialAutoImportStateMutation,
+): Promise<boolean> {
+	try {
+		return await store.write(mutation);
+	} catch {
+		logger.warn("Credential auto-import state persistence failed", { classification: "state-write-failed" });
+		return false;
+	}
 }
 
 export async function runStartupCredentialAutoImportIfNeeded({
@@ -224,17 +466,15 @@ export async function runStartupCredentialAutoImportIfNeeded({
 	discover,
 	version = VERSION,
 	agentDir,
-	markerStore,
+	stateStore,
 }: StartupCredentialAutoImportOptions): Promise<string | undefined> {
-	const store = markerStore ?? {
-		read: () => readCredentialImportMarker(agentDir),
-		write: (nextVersion: string) => writeCredentialImportMarker(nextVersion, agentDir),
-	};
-	const lastVersion = await store.read();
-	if (lastVersion === version) {
-		// Steady state: user already completed this version's auto-import gate. Skip all file/Keychain reads.
+	const store = stateStore ?? createCredentialAutoImportStateStore(agentDir);
+	const stateRead = await readStateSafely(store);
+	if (stateRead.unreadable) {
+		logger.warn("Credential auto-import state unavailable", { classification: "state-unreadable" });
 		return undefined;
 	}
+	if (isCredentialAutoImportStateResolvedForVersion(stateRead.state, version)) return undefined;
 
 	const result = await runExternalCredentialAutoImport({
 		authStorage: activeAuthStorage,
@@ -242,17 +482,32 @@ export async function runStartupCredentialAutoImportIfNeeded({
 		trigger: "startup",
 	});
 	if (!result.discovered) {
+		logCredentialAutoImportFailures("startup", result.failures);
 		return undefined;
 	}
 
 	const candidates = filterAutoImportOAuthCredentials(result.discovery?.importable ?? []);
-	if (candidates.length > 0 && result.imported.length === 0 && result.skipped.length === 0) {
-		return undefined;
+	const handledCandidates = result.imported.length + result.skipped.length > 0;
+	if (result.failures.length > 0) logCredentialAutoImportFailures("startup", result.failures);
+	let persisted = true;
+	if (handledCandidates) {
+		persisted = await writeStateSafely(store, {
+			lastImportVersion: version,
+			initialImportResolution: "accepted",
+		});
+	} else if (candidates.length === 0 && result.failures.length === 0) {
+		persisted = await writeStateSafely(store, { lastImportVersion: version });
 	}
-	await store.write(version);
 
+	let notice = buildCredentialAutoImportNotice(result);
+	if (!persisted) notice = appendNoticeLine(notice, CREDENTIAL_AUTO_IMPORT_PERSISTENCE_WARNING);
 	if (result.imported.length > 0) {
-		await activeModelRegistry.refresh("offline");
+		try {
+			await activeModelRegistry.refresh("offline");
+		} catch {
+			logger.warn("Credential auto-import refresh failed", { classification: "refresh-failed" });
+			notice = appendNoticeLine(notice, CREDENTIAL_AUTO_IMPORT_REFRESH_WARNING);
+		}
 	}
-	return buildCredentialAutoImportNotice(result);
+	return notice;
 }

package/src/setup/hermes/templates/operator-instructions.v1.md

@@ -13,7 +13,7 @@ These instructions teach a Hermes-style coordinator how to operate GJC through t
    If a second task is needed while one turn is active, pass `queue: true`; the next queued turn is promoted after the active turn is reported terminal.
 5. If GJC asks a structured question, use `{{TOOL_PREFIX}}_list_questions` and answer with `{{TOOL_PREFIX}}_submit_question_answer`.
 6. Use `{{TOOL_PREFIX}}_report_status` for coordinator-visible status and final reports.
-7. Use `{{TOOL_PREFIX}}_read_tail` only as advisory debug output when structured turn state is insufficient.
+7. Use `{{TOOL_PREFIX}}_read_tail` only to inspect the latest assistant response through the SDK when structured turn state is insufficient; it never reads terminal output.
 
 ## Prefer high-level delegation
 
@@ -39,11 +39,9 @@ The Hermes bridge does not choose a model/provider. Generated setup configures `
 
 Provider-specific commands are examples only, never product defaults.
 
-## Visible routed-session fallback
+## Human-visible TUI boundary
 
-If a Hermes/OpenClaw/Clawhip-style operator needs a human-visible, channel-routed GJC pane instead of a pure Coordinator MCP session, use the visible session pattern in [`docs/gjc-session-clawhip-routing.md`](../../../../../../docs/gjc-session-clawhip-routing.md).
-
-Use that pattern only when the router must watch tmux output, send stale-session alerts, or inject follow-up prompts into the same visible pane. The short version is: prepare a dedicated worktree, register a stable tmux session through the host router, start interactive `gjc`, wait for TUI readiness, inject the task prompt separately, and verify actual tool/work activity before reporting acceptance.
+A human may choose to run the local TUI in tmux for terminal visibility. That terminal is not a controller API: Hermes/OpenClaw/Clawhip-style operators must not inject prompts into, scrape, or route machine decisions through a tmux pane. Use the Coordinator MCP tools above for every external control and viewing operation.
 
 Do not put private channel ids, mention targets, socket names, tokens, or local routing policy into portable setup output. Keep those in the host/operator deployment.
 

package/src/slash-commands/builtin-registry.ts

@@ -33,7 +33,7 @@ import {
 	formatNotificationTestResult,
 	recoverNotifications,
 	sendNotificationTest,
-} from "../notifications/notification-service";
+} from "../sdk/bus/notification-service";
 import { computeCacheMissCostSummary, formatCacheMissSummaryLines } from "../session/cache-economics";
 import { formatModelOnboardingGuidance } from "../setup/model-onboarding-guidance";
 import {
@@ -697,6 +697,7 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 						await runtime.session.setModel(selection.model, "default", {
 							selector: selection.selector,
 							thinkingLevel: existingDefaultThinkingLevel,
+							cause: "user-selection",
 						});
 						if (existingDefaultThinkingLevel) {
 							runtime.session.setThinkingLevel(existingDefaultThinkingLevel);

package/src/task/executor.ts

@@ -914,19 +914,24 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 		progress.recentOutput = [];
 	};
 
+	const forwardSubagentEvent = (
+		event: AgentEvent | Extract<AgentSessionEvent, { type: "model_fallback_switched" }>,
+	) => {
+		if (!options.eventBus) return;
+		options.eventBus.emit(TASK_SUBAGENT_EVENT_CHANNEL, {
+			index,
+			agent: agent.name,
+			agentSource: agent.source,
+			task,
+			assignment,
+			event,
+		});
+	};
+
 	const processEvent = (event: AgentEvent) => {
 		if (resolved) return;
 
-		if (options.eventBus) {
-			options.eventBus.emit(TASK_SUBAGENT_EVENT_CHANNEL, {
-				index,
-				agent: agent.name,
-				agentSource: agent.source,
-				task,
-				assignment,
-				event,
-			});
-		}
+		forwardSubagentEvent(event);
 
 		const now = Date.now();
 		let flushProgress = false;
@@ -1234,6 +1239,9 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 				authFallbackUsed,
 				requestedModel,
 				fallbackReason,
+				activeIndex,
+				parentFallbackSelector,
+				skips,
 			} = await awaitAbortable(
 				resolveModelOverrideWithAuthFallback(
 					modelPatterns,
@@ -1241,6 +1249,7 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 					modelRegistry,
 					settings,
 					options.parentSessionId,
+					{ managedFallback: true },
 				),
 			);
 			if (model) {
@@ -1431,6 +1440,21 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 			);
 
 			activeSession = session;
+			// Each subagent invocation owns a fresh controller; its configured chain
+			// is scoped to this child session and never shares parent sticky state.
+			// Auth-aware resolution can substitute the parent model only after every
+			// override entry was unavailable. Rebase the controller to that concrete
+			// parent selector so its request is never charged to override index zero.
+			session.setConfiguredModelChain(
+				"default",
+				parentFallbackSelector ? [parentFallbackSelector] : modelPatterns,
+				"subagent",
+				agent.name,
+				true,
+			);
+			if (activeIndex !== undefined && !parentFallbackSelector) {
+				session.seedDefaultFallbackResolution(activeIndex, skips);
+			}
 			const liveSubagentId = options.subagentId ?? id;
 			const manager = AsyncJobManager.instance();
 			if (manager) {
@@ -1508,12 +1532,14 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 							pendingExtensionMessages.push(sendPromise);
 						},
 						sendUserMessage: (content, options) => {
-							const sendPromise = session.sendUserMessage(content, options).catch(e => {
+							const send = session.sendUserMessage(content, options);
+							const observedSend = send.catch(e => {
 								logger.error("Extension sendUserMessage failed", {
 									error: e instanceof Error ? e.message : String(e),
 								});
 							});
-							pendingExtensionMessages.push(sendPromise);
+							pendingExtensionMessages.push(observedSend);
+							return send;
 						},
 						appendEntry: (customType, data) => {
 							session.sessionManager.appendCustomEntry(customType, data);
@@ -1528,7 +1554,17 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 						getCommands: () => getSessionSlashCommands(session),
 						setModel: model => runExtensionSetModel(session, model),
 						getThinkingLevel: () => session.thinkingLevel,
-						setThinkingLevel: level => session.setThinkingLevel(level),
+						setThinkingLevel: (level, persist) => session.setThinkingLevel(level, persist),
+						getThinkingVisibility: () => session.getThinkingVisibility(),
+						setThinkingVisibility: (visibility, persist) => session.setThinkingVisibility(visibility, persist),
+						cycleThinkingLevel: () => session.cycleThinkingLevel(),
+						setThinkingLevelForControl: (level, persist) => session.setThinkingLevelForControl(level, persist),
+						setThinkingVisibilityForControl: (visibility, persist) =>
+							session.setThinkingVisibilityForControl(visibility, persist),
+						setModelTemporaryForControl: (model, expectedSessionId) =>
+							session.setModelTemporaryForControl(model, expectedSessionId),
+						fetchUsageReportsForControl: () => session.fetchUsageReportsForControl(),
+						getThinkingScopeForControl: () => session.getThinkingScopeForControl(),
 						getSessionName: () => session.sessionManager.getSessionName(),
 						setSessionName: async name => {
 							await session.sessionManager.setSessionName(name, "user");
@@ -1539,10 +1575,19 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 						isIdle: () => !session.isStreaming,
 						abort: () => session.abort(),
 						hasPendingMessages: () => session.queuedMessageCount > 0,
+						getPendingMessageCounts: () => session.pendingMessageCounts,
+						getTranscript: () => session.getTranscript(),
+						getTranscriptBody: entryId => session.getTranscriptBody(entryId),
+						getGoalState: () => session.getGoalModeState(),
+						getTodoState: () => session.getTodoPhases(),
+						getQueuedMessages: () => session.getQueuedMessageEntries(),
+						getActiveTools: () => session.getActiveToolNames(),
+						getAllTools: () => session.getAllToolNames(),
 						shutdown: () => {},
 						getContextUsage: () => session.getContextUsage(),
 						getSystemPrompt: () => session.systemPrompt,
 						compact: instructionsOrOptions => runExtensionCompact(session, instructionsOrOptions),
+						clearContext: () => session.clearContext(),
 					},
 				);
 				extensionRunner.onError(err => {
@@ -1581,6 +1626,10 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 					scheduleProgress(true);
 					return;
 				}
+				if (event.type === "model_fallback_switched") {
+					forwardSubagentEvent(event);
+					return;
+				}
 				if (isAgentEvent(event)) {
 					try {
 						processEvent(event);

package/src/tools/ask-answer-registry.ts

@@ -7,7 +7,7 @@
  * source; registering returns a disposer.
  */
 
-import type { WorkflowGateEmitter } from "../modes/shared/agent-wire/unattended-session";
+import type { WorkflowGateEmitter } from "../modes/shared/agent-wire/workflow-gate-broker";
 import type { AskAnswerSource } from "./index";
 
 const sources = new Map<string, AskAnswerSource>();

package/src/tools/ask.ts

@@ -758,9 +758,14 @@ export class AskTool implements AgentTool<typeof askSchema, AskToolDetails> {
 			if (receipt) await receipt.settle(settlement);
 		};
 		const gateEmitter = this.session.getWorkflowGateEmitter?.();
-		const canUseWorkflowGate = gateEmitter?.isUnattended() === true;
-
-		// Headless fallback: unattended workflow gates are the non-TUI answer path.
+		// A durable workflow-gate emitter now exists for every session, and its
+		// isUnattended() is always true, so it can no longer signal "no local UI".
+		// The workflow gate is only the headless (non-TUI) answer path: when a real
+		// interactive UI is present, prefer it — otherwise attended TUI asks would
+		// route to emitGate() and hang forever waiting on a remote responder.
+		const hasInteractiveUi = context?.hasUI === true && !!context.ui;
+		const canUseWorkflowGate = !hasInteractiveUi && gateEmitter?.isUnattended() === true;
+		// Headless fallback: SDK workflow gates are the non-TUI answer path.
 		if (!canUseWorkflowGate && (!context?.hasUI || !context.ui)) {
 			context?.abort();
 			throw new ToolAbortError("Ask tool requires interactive mode");
@@ -772,9 +777,9 @@ export class AskTool implements AgentTool<typeof askSchema, AskToolDetails> {
 				if (!extensionUi) throw new ToolAbortError("Ask tool requires interactive mode");
 				const source = this.session.getAskAnswerSource?.();
 				if (!source) return extensionUi.select(prompt, options, dialogOptions);
-				// Race the local UI against a remote answer (e.g. a Telegram reply via the
-				// notifications SDK) so asks can be answered without RPC mode. First valid
-				// answer wins; the loser is aborted so neither side is left hanging:
+				// Race the local UI against a remote answer (e.g. an SDK reply) so asks
+				// can be answered without local UI interaction. The first valid answer
+				// wins; the loser is aborted so neither side is left hanging:
 				//   - local wins  -> abort the remote source (marks the action resolved-locally)
 				//   - remote wins -> abort the local selector so the TUI dialog actually closes
 				const remoteController = new AbortController();
@@ -975,8 +980,8 @@ export class AskTool implements AgentTool<typeof askSchema, AskToolDetails> {
 		) => {
 			const rawOptionLabels = q.options.map(o => o.label);
 			const questionIndex = params.questions.indexOf(q);
-			// Unattended (#316/#323/G011): route the question through the workflow-gate
-			// emitter instead of the interactive UI; the external agent answers over RPC.
+			// Route headless asks through the SDK workflow-gate emitter; a connected
+			// SDK responder supplies the durable answer instead of an interactive UI.
 			if (gateEmitter && canUseWorkflowGate) {
 				const gateQuestion: AskGateQuestion = {
 					id: q.id,

package/src/tools/browser/STEALTH-THIRD-PARTY-NOTICES.md

@@ -0,0 +1,26 @@
+# Stealth Third-Party Notices
+
+Per the approved plan, anti-detection evasions are **reimplemented/adapted** as
+first-party code (no vendored source tree, no runtime dependency). This file
+records provenance for evasion techniques whose semantics were informed by the
+following open-source projects. Each individual reimplemented script also
+carries an attributing header comment.
+
+| Source project | License | Techniques referenced |
+|----------------|---------|-----------------------|
+| rebrowser-patches | MIT | CDP `Runtime.enable` leak mitigation (data-driven; landed only if the offline baseline shows a runtime/CDP leak signal) |
+| puppeteer-extra-plugin-stealth | MIT | Fingerprint evasion signal set (navigator/webgl/plugins/permissions/webrtc surfaces) overlapping and complementing the existing injection scripts |
+| fingerprint-suite (fingerprint-injector / generator) | Apache-2.0 | Coherent fingerprint attribute generation ideas |
+
+No source files from these projects are copied into this repository. Only the
+observable behaviors/signal semantics were reimplemented against `puppeteer-core`
+after being confirmed by the offline benchmark suite
+(`test/fixtures/stealth-detectors/`, `src/tools/browser/benchmark/`).
+
+## Detector fixtures
+
+The offline detector fixtures under `test/fixtures/stealth-detectors/` are
+first-party probes modeled on the public boolean signal sets used by
+`bot.sannysoft.com` and CreepJS. They are self-contained (inline JS, zero
+network) and are not verbatim copies of those sites. See that directory's
+`MANIFEST.json` for the refresh procedure.