@gajae-code/coding-agent 0.10.2 → 0.11.0

package/src/tools/browser/profile-reuse.ts

@@ -0,0 +1,102 @@
+/**
+ * Profile-reuse orchestration (plan Phase 2 wiring).
+ *
+ * Single entry point the launch path calls to decide, for a default headless
+ * session, whether to warm up from an isolated copy of the user's real Chrome
+ * profile. Ties together discovery + posture + isolated warm-up. Filesystem
+ * effects (the copy) are performed only when the posture resolves to `real`.
+ * The heavy pieces are injectable so this is unit-testable without a browser.
+ */
+
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { type DiscoveredProfile, type DiscoveryEnv, discoverDefaultChromeProfile } from "./profile-discovery";
+import { decideProfilePosture, type ProfileReusePosture } from "./profile-posture";
+import { collectWarmupArtifacts, type WarmupManifest } from "./profile-warmup";
+
+export interface ResolveProfileReuseInputs {
+	posture?: ProfileReusePosture;
+	/** Caller explicitly requested real-profile reuse (e.g. app.browser === "chrome"). */
+	explicitlyRequested?: boolean;
+	discoveryEnv: DiscoveryEnv;
+	/** Destination for the isolated warm-up copy; defaults to an ephemeral temp dir. */
+	destDir?: string;
+	/** Injectable copier (defaults to collectWarmupArtifacts). */
+	copy?: (sourceProfileDir: string, destDir: string) => WarmupManifest;
+	/** Injectable temp-dir factory (defaults to fs.mkdtemp under os.tmpdir()). */
+	makeTempDir?: () => string;
+}
+
+export interface ProfileReuseResult {
+	mode: "real" | "synthetic";
+	reason: string;
+	warning: string | null;
+	discovered: DiscoveredProfile | null;
+	/** Isolated copy directory when mode === "real", else null. */
+	warmupDir: string | null;
+	manifest: WarmupManifest | null;
+}
+
+function defaultTempDir(): string {
+	return fs.mkdtempSync(path.join(os.tmpdir(), "gjc-profile-warmup-"));
+}
+
+function errorMessage(error: unknown): string {
+	return error instanceof Error ? error.message : String(error);
+}
+
+/**
+ * Resolve profile reuse for a default session. When the posture resolves to
+ * `real`, copies an allowlisted, lock-free subset of the discovered profile
+ * into an isolated dir and returns that dir for the launcher to use.
+ */
+export function resolveProfileReuse(inputs: ResolveProfileReuseInputs): ProfileReuseResult {
+	const discovered = discoverDefaultChromeProfile(inputs.discoveryEnv);
+	const decision = decideProfilePosture({
+		posture: inputs.posture,
+		realProfileAvailable: discovered !== null,
+		explicitlyRequested: inputs.explicitlyRequested,
+	});
+
+	if (decision.mode !== "real" || !discovered) {
+		return {
+			mode: "synthetic",
+			reason: decision.reason,
+			warning: null,
+			discovered,
+			warmupDir: null,
+			manifest: null,
+		};
+	}
+
+	const ownsDestDir = inputs.destDir === undefined;
+	let destDir: string | undefined;
+	const copy = inputs.copy ?? collectWarmupArtifacts;
+	try {
+		destDir = inputs.destDir ?? (inputs.makeTempDir ?? defaultTempDir)();
+		const manifest = copy(discovered.profileDir, destDir);
+		return {
+			mode: "real",
+			reason: decision.reason,
+			warning: decision.warning,
+			discovered,
+			warmupDir: destDir,
+			manifest,
+		};
+	} catch (error) {
+		if (ownsDestDir && destDir) {
+			try {
+				fs.rmSync(destDir, { recursive: true, force: true });
+			} catch {}
+		}
+		return {
+			mode: "synthetic",
+			reason: "synthetic-copy-failed",
+			warning: `Could not safely copy the discovered Chrome profile; using synthetic browser state instead: ${errorMessage(error)}`,
+			discovered,
+			warmupDir: null,
+			manifest: null,
+		};
+	}
+}

package/src/tools/browser/profile-warmup.ts

@@ -0,0 +1,109 @@
+/**
+ * Isolated profile warm-up (plan Phase 2, R-C3).
+ *
+ * Aggressive real-profile reuse seeds a session with the user's cookies /
+ * localStorage / cache. To stay safe (never lock or corrupt the live browser
+ * session) we NEVER bind the source profile directly: we copy an allowlisted
+ * subset of artifacts into an ephemeral, isolated directory and drive Chromium
+ * against that copy. Chromium single-instance lock files (SingletonLock/Socket/
+ * Cookie) are explicitly excluded so the isolated copy can never contend with a
+ * running browser.
+ *
+ * This module is pure filesystem logic (no browser, no network) so it is
+ * deterministically unit-testable.
+ */
+
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+/** Chromium single-instance lock artifacts — must never be copied. */
+export const CHROME_LOCK_ARTIFACTS = ["SingletonLock", "SingletonSocket", "SingletonCookie"] as const;
+const CHROME_LOCK_ARTIFACT_SET = new Set<string>(CHROME_LOCK_ARTIFACTS);
+
+/**
+ * Profile-relative artifacts worth seeding for warm-up. Kept intentionally
+ * small: session state (cookies, storage) plus a light cache. Anything not
+ * listed is skipped, which also keeps the isolated copy cheap.
+ */
+export const WARMUP_ARTIFACTS = [
+	"Cookies",
+	"Cookies-journal",
+	"Local Storage",
+	"Session Storage",
+	"IndexedDB",
+	"Network",
+	"Preferences",
+] as const;
+
+export interface WarmupManifest {
+	sourceProfileDir: string;
+	destDir: string;
+	copied: string[];
+	skippedMissing: string[];
+	/** Always empty unless a lock artifact was seen (never copied). */
+	excludedLocks: string[];
+}
+
+function copyRecursive(src: string, dest: string, manifest: WarmupManifest): void {
+	const stat = fs.statSync(src);
+	if (stat.isDirectory()) {
+		fs.mkdirSync(dest, { recursive: true });
+		for (const entry of fs.readdirSync(src)) {
+			if (CHROME_LOCK_ARTIFACT_SET.has(entry)) {
+				if (!manifest.excludedLocks.includes(entry)) manifest.excludedLocks.push(entry);
+				continue;
+			}
+			copyRecursive(path.join(src, entry), path.join(dest, entry), manifest);
+		}
+	} else {
+		fs.mkdirSync(path.dirname(dest), { recursive: true });
+		fs.copyFileSync(src, dest);
+	}
+}
+
+/**
+ * Copy warm-up artifacts from `sourceProfileDir` into an isolated `destDir`.
+ *
+ * Guarantees:
+ * - The source profile is only ever read, never written or locked.
+ * - Chromium lock artifacts are never copied (recorded in `excludedLocks`).
+ * - Missing artifacts are skipped, not fatal (recorded in `skippedMissing`).
+ */
+export function collectWarmupArtifacts(sourceProfileDir: string, destDir: string): WarmupManifest {
+	const manifest: WarmupManifest = {
+		sourceProfileDir,
+		destDir,
+		copied: [],
+		skippedMissing: [],
+		excludedLocks: [],
+	};
+
+	if (!fs.existsSync(sourceProfileDir)) {
+		throw new Error(`source profile directory does not exist: ${sourceProfileDir}`);
+	}
+	const resolvedSource = path.resolve(sourceProfileDir);
+	const resolvedDest = path.resolve(destDir);
+	if (resolvedDest === resolvedSource || resolvedDest.startsWith(`${resolvedSource}${path.sep}`)) {
+		throw new Error("warm-up destination must be outside the source profile directory");
+	}
+	fs.mkdirSync(destDir, { recursive: true });
+
+	// Record (but never copy) any lock artifacts present in the source.
+	for (const lock of CHROME_LOCK_ARTIFACTS) {
+		if (fs.existsSync(path.join(sourceProfileDir, lock))) {
+			manifest.excludedLocks.push(lock);
+		}
+	}
+
+	for (const artifact of WARMUP_ARTIFACTS) {
+		const src = path.join(sourceProfileDir, artifact);
+		if (!fs.existsSync(src)) {
+			manifest.skippedMissing.push(artifact);
+			continue;
+		}
+		copyRecursive(src, path.join(destDir, artifact), manifest);
+		manifest.copied.push(artifact);
+	}
+
+	return manifest;
+}

package/src/tools/browser/registry.ts

@@ -1,3 +1,4 @@
+import * as fs from "node:fs";
 import * as path from "node:path";
 import { logger } from "@gajae-code/utils";
 import type { Subprocess } from "bun";
@@ -12,6 +13,9 @@ import {
 	waitForCdp,
 } from "./attach";
 import { BROWSER_PROTOCOL_TIMEOUT_MS, launchHeadlessBrowser, loadPuppeteer, type UserAgentOverride } from "./launch";
+import { defaultDiscoveryEnv } from "./profile-discovery";
+import type { ProfileReusePosture } from "./profile-posture";
+import { resolveProfileReuse } from "./profile-reuse";
 
 export type BrowserKind =
 	| { kind: "headless"; headless: boolean }
@@ -29,9 +33,15 @@ export type BrowserKind =
 
 export type BrowserKindTag = BrowserKind["kind"];
 
+export interface BrowserGeo {
+	readonly timezone?: string;
+	readonly locale?: string;
+}
+
 export interface BrowserHandle {
 	key: string;
 	kind: BrowserKind;
+	readonly geo?: BrowserGeo;
 	browser: Browser;
 	cdpUrl?: string;
 	pid?: number;
@@ -43,6 +53,7 @@ export interface BrowserHandle {
 type SpawnedChromeProfileKind = Extract<BrowserKind, { kind: "chrome-profile" }>;
 
 const browsers = new Map<string, BrowserHandle>();
+const browserOpenPromises = new Map<string, Promise<BrowserHandle>>();
 
 /**
  * Upper bound on the CDP `browser.close()` round-trip during a forced (signal-path)
@@ -51,10 +62,10 @@ const browsers = new Map<string, BrowserHandle>();
  */
 const HEADLESS_FORCE_CLOSE_GRACE_MS = 1_500;
 
-function browserKey(kind: BrowserKind): string {
+function browserKey(kind: BrowserKind, geo?: BrowserGeo, profileReuse?: ProfileReusePosture): string {
 	switch (kind.kind) {
 		case "headless":
-			return `headless:${kind.headless ? "1" : "0"}`;
+			return `headless:${kind.headless ? "1" : "0"}:${profileReuse ?? "synthetic"}:${geo?.timezone ?? ""}:${geo?.locale ?? ""}`;
 		case "spawned":
 			return `spawned:${kind.path}`;
 		case "chrome-profile":
@@ -69,28 +80,90 @@ export interface AcquireBrowserOptions {
 	viewport?: { width: number; height: number; deviceScaleFactor?: number };
 	appArgs?: string[];
 	signal?: AbortSignal;
+	/**
+	 * Profile-reuse posture for the default headless path (from settings
+	 * `browser.profileReuse`, resolved by the settings-aware caller). When set,
+	 * the headless browser may warm up from an isolated copy of the user's real
+	 * Chrome profile (see profile-reuse.ts). Omitted = synthetic session.
+	 */
+	profileReuse?: ProfileReusePosture;
+	/**
+	 * Opt-in geo alignment for the default headless path (from settings
+	 * `browser.geo.*`). Default unset = no-op (real timezone/locale preserved).
+	 */
+	geo?: BrowserGeo;
+}
+
+function normalizeGeo(geo: AcquireBrowserOptions["geo"]): BrowserGeo | undefined {
+	const timezone = geo?.timezone
+		? new Intl.DateTimeFormat(undefined, { timeZone: geo.timezone }).resolvedOptions().timeZone
+		: undefined;
+	const locale = geo?.locale ? Intl.getCanonicalLocales(geo.locale)[0] : undefined;
+	return timezone || locale ? Object.freeze({ timezone, locale }) : undefined;
+}
+
+export function browserKeyForTest(
+	kind: BrowserKind,
+	opts: Pick<AcquireBrowserOptions, "geo" | "profileReuse">,
+): string {
+	const geo = kind.kind === "headless" ? normalizeGeo(opts.geo) : undefined;
+	return browserKey(kind, geo, opts.profileReuse);
 }
 
 export async function acquireBrowser(kind: BrowserKind, opts: AcquireBrowserOptions): Promise<BrowserHandle> {
-	const key = browserKey(kind);
+	const geo = kind.kind === "headless" ? normalizeGeo(opts.geo) : undefined;
+	const key = browserKey(kind, geo, opts.profileReuse);
 	const existing = browsers.get(key);
 	if (existing) {
 		if (existing.browser.connected) return existing;
 		browsers.delete(key);
 		await disposeBrowserHandle(existing, { kill: false });
 	}
+	const pending = browserOpenPromises.get(key);
+	if (pending) return await pending;
 
-	const handle = await openBrowserHandle(kind, opts);
-	browsers.set(key, handle);
-	return handle;
+	const opening = openBrowserHandle(kind, opts, geo, key).then(handle => {
+		browsers.set(key, handle);
+		return handle;
+	});
+	browserOpenPromises.set(key, opening);
+	try {
+		return await opening;
+	} finally {
+		if (browserOpenPromises.get(key) === opening) browserOpenPromises.delete(key);
+	}
 }
 
-async function openBrowserHandle(kind: BrowserKind, opts: AcquireBrowserOptions): Promise<BrowserHandle> {
+async function openBrowserHandle(
+	kind: BrowserKind,
+	opts: AcquireBrowserOptions,
+	geo: BrowserGeo | undefined,
+	key: string,
+): Promise<BrowserHandle> {
 	if (kind.kind === "headless") {
-		const browser = await launchHeadlessBrowser({ headless: kind.headless, viewport: opts.viewport });
+		let profileWarmupDir: string | undefined;
+		if (opts.profileReuse) {
+			const reuse = resolveProfileReuse({
+				posture: opts.profileReuse,
+				discoveryEnv: defaultDiscoveryEnv(fs.existsSync),
+			});
+			if (reuse.warning) logger.warn(reuse.warning);
+			if (reuse.mode === "real" && reuse.warmupDir) {
+				profileWarmupDir = reuse.warmupDir;
+			}
+		}
+		const browser = await launchHeadlessBrowser({
+			headless: kind.headless,
+			viewport: opts.viewport,
+			profileWarmupDir,
+			...(geo ? { geo } : {}),
+		});
 		return {
-			key: browserKey(kind),
+			key,
+
 			kind,
+			geo,
+
 			browser,
 			refCount: 0,
 			stealth: { browserSession: null, override: null },
@@ -106,7 +179,8 @@ async function openBrowserHandle(kind: BrowserKind, opts: AcquireBrowserOptions)
 			protocolTimeout: BROWSER_PROTOCOL_TIMEOUT_MS,
 		});
 		return {
-			key: browserKey(kind),
+			key,
+
 			kind,
 			browser,
 			cdpUrl,
@@ -254,6 +328,7 @@ export async function openChromeProfileHandle(
 	}
 	return {
 		key: browserKey(kind),
+
 		kind,
 		browser,
 		cdpUrl,
@@ -320,6 +395,7 @@ async function openSpawnedBrowserHandle(
 	}
 	return {
 		key: browserKey(kind),
+
 		kind,
 		browser,
 		cdpUrl,
@@ -337,7 +413,7 @@ export function holdBrowser(handle: BrowserHandle): void {
 export async function releaseBrowser(handle: BrowserHandle, opts: { kill: boolean }): Promise<void> {
 	handle.refCount = Math.max(0, handle.refCount - 1);
 	if (handle.refCount === 0) {
-		browsers.delete(handle.key);
+		if (browsers.get(handle.key) === handle) browsers.delete(handle.key);
 		await disposeBrowserHandle(handle, opts);
 	}
 }

package/src/tools/browser/tab-protocol.ts

@@ -46,6 +46,7 @@ export type WorkerInitPayload =
 			browserWSEndpoint: string;
 			safeDir: string;
 			viewport?: { width: number; height: number; deviceScaleFactor?: number };
+			geo?: { readonly timezone?: string; readonly locale?: string };
 			dialogs?: "accept" | "dismiss";
 			url?: string;
 			waitUntil?: "load" | "domcontentloaded" | "networkidle0" | "networkidle2";

package/src/tools/browser/tab-supervisor.ts

@@ -427,6 +427,7 @@ async function buildInitPayload(browser: BrowserHandle, opts: AcquireTabOptions)
 			browserWSEndpoint,
 			safeDir,
 			viewport: opts.viewport,
+			...(browser.geo ? { geo: browser.geo } : {}),
 			dialogs: opts.dialogs,
 			url: opts.url,
 			waitUntil: opts.waitUntil,

package/src/tools/browser/tab-worker.ts

@@ -454,7 +454,7 @@ export class WorkerCore {
 			});
 			if (payload.mode === "headless") {
 				this.#page = await this.#browser.newPage();
-				await applyStealthPatches(this.#browser, this.#page, { browserSession: null, override: null });
+				await applyStealthPatches(this.#browser, this.#page, { browserSession: null, override: null }, payload.geo);
 				await applyViewport(this.#page, payload.viewport);
 				if (payload.dialogs) this.#applyDialogPolicy(payload.dialogs);
 				if (payload.url) {

package/src/tools/browser.ts

@@ -233,6 +233,12 @@ export class BrowserTool implements AgentTool<typeof browserSchema, BrowserToolD
 						}
 					: undefined,
 				appArgs: params.app?.args,
+				profileReuse:
+					(this.session.settings.get("browser.profileReuse") as "auto" | "opt-in" | undefined) ?? "auto",
+				geo: {
+					timezone: this.session.settings.get("browser.geo.timezone") as string | undefined,
+					locale: this.session.settings.get("browser.geo.locale") as string | undefined,
+				},
 				signal,
 			}),
 		);

package/src/tools/index.ts

@@ -10,7 +10,7 @@ import type { GoalModeState, GoalRuntime } from "../goals";
 import { GoalTool } from "../goals/tools/goal-tool";
 import type { HindsightSessionState } from "../hindsight/state";
 import { LspTool } from "../lsp";
-import type { WorkflowGateEmitter } from "../modes/shared/agent-wire/unattended-session";
+import type { WorkflowGateEmitter } from "../modes/shared/agent-wire/workflow-gate-broker";
 import type { PlanModeState } from "../plan-mode/state";
 import type { AgentRegistry } from "../registry/agent-registry";
 import type {
@@ -200,9 +200,10 @@ export interface AskRemoteReceipt {
 export type AskAnswerSourceResult = AskRemoteReceipt | string | undefined;
 
 /**
- * Source of remote answers. `awaitAnswer` remains the legacy wire for existing
- * integrations; typed sources opt into `awaitAnswerRequest`. This keeps an old
- * string-only source from accidentally acquiring acknowledgement authority.
+ * Source of remote answers for interactive asks. `awaitAnswer` remains the legacy
+ * wire for existing integrations; typed sources opt into `awaitAnswerRequest`.
+ * This keeps a string-only source from accidentally acquiring acknowledgement
+ * authority while allowing SDK-routed interactions to settle durably.
  */
 export interface AskAnswerSource {
 	awaitAnswer(question: string, options: string[], signal?: AbortSignal): Promise<string | undefined>;
@@ -305,12 +306,11 @@ export interface ToolSession {
 	getPlanModeState?: () => PlanModeState | undefined;
 	/** Goal mode state (if active or paused) */
 	getGoalModeState?: () => GoalModeState | undefined;
-	/** Unattended workflow-gate emitter (present only when unattended mode is negotiated). */
+	/** SDK workflow-gate emitter, when a remote gate responder is connected. */
 	getWorkflowGateEmitter?: () => WorkflowGateEmitter | undefined;
 	/**
-	 * Optional remote answer source for interactive asks. When present, the ask
-	 * tool races the local UI selection against a remote answer (e.g. a Telegram
-	 * reply via the notifications SDK) so asks can be answered without RPC mode.
+	 * Optional SDK-routed answer source for interactive asks. When present, the
+	 * tool races the local UI selection against the remote SDK answer.
 	 * No-op when undefined: the ask path behaves exactly as before.
 	 */
 	getAskAnswerSource?: () => AskAnswerSource | undefined;

package/src/tools/puppeteer/14_stealth_permissions.txt

@@ -0,0 +1,57 @@
+// Permissions / notification headless tell.
+//
+// Headless Chrome reports `Notification.permission === "denied"` by default and
+// a matching `permissions.query({name:"notifications"})` state, while a real
+// user browser reports `"default"` / `"prompt"`. Detectors such as CreepJS key
+// on this exact mismatch to flag headless. Normalize both to the human default.
+//
+// Technique adapted (reimplemented) from puppeteer-extra-plugin-stealth
+// (navigator.permissions) — see STEALTH-THIRD-PARTY-NOTICES.md.
+
+try {
+	if (typeof Notification !== "undefined" && Notification.permission === "denied") {
+		Object_defineProperty(Notification, "permission", {
+			get() {
+				return "default";
+			},
+			configurable: true,
+		});
+	}
+} catch (e) {}
+
+try {
+	const permissions = navigator.permissions;
+	const originalQuery = permissions && permissions.query;
+	if (originalQuery && typeof PermissionStatus !== "undefined") {
+		permissions.query = new Window_Proxy(originalQuery, {
+			apply(target, ctx, args) {
+				const params = args[0];
+				if (params && params.name === "notifications") {
+					return Promise_resolve(
+						Object_create(PermissionStatus.prototype, {
+							state: {
+								get() {
+									return "prompt";
+								},
+								enumerable: true,
+								configurable: true,
+							},
+							name: {
+								value: "notifications",
+								enumerable: true,
+								configurable: true,
+							},
+							onchange: {
+								value: null,
+								writable: true,
+								enumerable: true,
+								configurable: true,
+							},
+						}),
+					);
+				}
+				return Reflect.apply(target, ctx, args);
+			},
+		});
+	}
+} catch (e) {}

package/src/tools/puppeteer/15_stealth_webrtc.txt

@@ -0,0 +1,60 @@
+// WebRTC IP-leak guard.
+//
+// Even with --force-webrtc-ip-handling-policy, RTCPeerConnection can surface
+// ICE candidates that embed a raw local/public IP literal — a bot/deanon tell
+// that CreepJS and others read. This wrapper strips ONLY candidates that carry
+// a non-mDNS raw IP literal; mDNS ".local" candidates and all other WebRTC
+// behavior (offer/answer, data channels) are left intact so real WebRTC keeps
+// working.
+//
+// Technique adapted (reimplemented) from puppeteer-extra-plugin-stealth
+// (navigator.mediaDevices / webrtc) — see STEALTH-THIRD-PARTY-NOTICES.md.
+
+try {
+	const RTCP = typeof RTCPeerConnection !== "undefined" ? RTCPeerConnection : undefined;
+	if (RTCP && RTCP.prototype) {
+		// A raw IPv4/IPv6 literal that is NOT an mDNS ".local" hostname.
+		const rawIpInCandidate = (candidate) => {
+			if (typeof candidate !== "string" || candidate.length === 0) return false;
+			if (/\.local\b/i.test(candidate)) return false; // mDNS obfuscated — safe
+			const ipv4 = /\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/;
+			const ipv6 = /\b(?:[0-9a-f]{1,4}:){2,}[0-9a-f]{0,4}\b/i;
+			return ipv4.test(candidate) || ipv6.test(candidate);
+		};
+
+		const origAddEventListener = RTCP.prototype.addEventListener;
+		RTCP.prototype.addEventListener = new Window_Proxy(origAddEventListener, {
+			apply(target, ctx, args) {
+				if (args[0] === "icecandidate" && typeof args[1] === "function") {
+					const userCb = args[1];
+					const wrapped = function (event) {
+						if (event && event.candidate && rawIpInCandidate(event.candidate.candidate)) {
+							return; // drop the raw-IP candidate; keep gathering others
+						}
+						return Reflect.apply(userCb, this, arguments);
+					};
+					return Reflect.apply(target, ctx, [args[0], wrapped, args[2]]);
+				}
+				return Reflect.apply(target, ctx, args);
+			},
+		});
+
+		// Also guard the onicecandidate setter path.
+		const desc = Object_getOwnPropertyDescriptor(RTCP.prototype, "onicecandidate");
+		if (desc && desc.set) {
+			Object_defineProperty(RTCP.prototype, "onicecandidate", {
+				configurable: true,
+				enumerable: desc.enumerable,
+				get: desc.get,
+				set(cb) {
+					if (typeof cb !== "function") return desc.set.call(this, cb);
+					const wrapped = function (event) {
+						if (event && event.candidate && rawIpInCandidate(event.candidate.candidate)) return;
+						return Reflect.apply(cb, this, arguments);
+					};
+					return desc.set.call(this, wrapped);
+				},
+			});
+		}
+	}
+} catch (e) {}

package/src/tools/telegram-send.ts

@@ -2,8 +2,8 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import type { AgentTool, AgentToolContext, AgentToolResult, AgentToolUpdateCallback } from "@gajae-code/agent-core";
 import { z } from "zod/v4";
-import { getTelegramFileSink } from "../notifications/attachment-registry";
-import { getNotificationConfig, isGloballyConfigured } from "../notifications/config";
+import { getTelegramFileSink } from "../sdk/bus/attachment-registry";
+import { getNotificationConfig, isGloballyConfigured } from "../sdk/bus/config";
 import type { ToolSession } from "./index";
 
 const TELEGRAM_SEND_MAX_FILE_BYTES = 50 * 1024 * 1024;

package/vendor/insane-search/MANIFEST.json

@@ -20,7 +20,8 @@
   ],
   "exclusionRationale": "Excludes upstream install hooks (SessionStart settings.json mutation), GitHub star-baiting (gh api user/starred), the update-notifier, and the past-session transcript-language scanner. Only the runtime Phase 0-3 engine and its Playwright/stealth templates are vendored.",
   "localPatches": [
-    "engine/content_safety.py + FetchResult trust/risk metadata (content_trust, prompt_injection_risk, prompt_injection_signals, untrusted_content_boundary) and to_untrusted_text(): cherry-picked from insane-search a16f7c1 (upstream PR #5, v0.9.0). Adds prompt-injection labelling to the JSON surface (to_dict); the default CLI text output is intentionally left unchanged (plain content preserved, no envelope)."
+    "engine/content_safety.py + FetchResult trust/risk metadata (content_trust, prompt_injection_risk, prompt_injection_signals, untrusted_content_boundary) and to_untrusted_text(): cherry-picked from insane-search a16f7c1 (upstream PR #5, v0.9.0). Adds prompt-injection labelling to the JSON surface (to_dict); the default CLI text output is intentionally left unchanged (plain content preserved, no envelope).",
+    "engine/phase0.py _ytdlp_argv() console-script→module fallback + engine/bias_check.py rel.as_posix() Windows exemption + engine/tests/test_u9.py: cherry-picked from insane-search 33f898d (upstream PR #6, released v0.9.2). Cross-platform yt-dlp resolution; no capability or site logic added."
   ],
   "notes": "Runtime engine is invoked via `python3 -m engine \"<url>\" --json` with cwd=this directory and PYTHONPATH pointed at this directory. Phase 0-2 require python3 + curl_cffi; Phase 3 requires node + playwright/playwright-extra/puppeteer-extra-plugin-stealth installed under engine/templates. GJC never auto-installs these dependencies."
 }

package/vendor/insane-search/engine/bias_check.py

@@ -98,7 +98,10 @@ def _line_is_exempt(line: str, ext: str) -> bool:
 def _scan_file(path: Path, root: Path) -> list[str]:
     """Return list of violation strings for this file."""
     rel = path.relative_to(root.parent)
-    if str(rel) in EXPLICIT_ALLOW_FILES:
+    # Compare with forward slashes so the exemption matches on Windows too —
+    # `str(rel)` yields backslashes there, silently defeating the phase0.py
+    # exemption (EXPLICIT_ALLOW_FILES uses POSIX-style paths).
+    if rel.as_posix() in EXPLICIT_ALLOW_FILES:
         return []
 
     ext = path.suffix.lower()

package/vendor/insane-search/engine/phase0.py

@@ -24,8 +24,11 @@ Each attempt dict: {"route","platform","ok","status","bytes","note"}.
 """
 from __future__ import annotations
 
+import importlib.util
 import re
+import shutil
 import subprocess
+import sys
 from typing import Optional
 from urllib.parse import urlsplit
 
@@ -182,11 +185,33 @@ def _x(url: str, timeout: int) -> dict:
 
 
 # --- youtube -----------------------------------------------------------------
+def _ytdlp_argv() -> Optional[list[str]]:
+    """Best yt-dlp invocation for this environment, or None if unavailable.
+
+    Prefers the ``yt-dlp`` console script on PATH; falls back to
+    ``<python> -m yt_dlp`` when the script dir is not on PATH but the module is
+    importable — the common case for ``pip install --user`` and Windows / venv
+    installs, where the Scripts/bin dir is frequently absent from PATH. Mirrors
+    the ``which yt-dlp || python3 -m yt_dlp`` fallback already documented in
+    references/media.md."""
+    exe = shutil.which("yt-dlp")
+    if exe:
+        return [exe]
+    if importlib.util.find_spec("yt_dlp") is not None:
+        return [sys.executable, "-m", "yt_dlp"]
+    return None
+
+
 def _youtube(url: str, timeout: int) -> dict:
     attempts: list[dict] = []
+    argv = _ytdlp_argv()
+    if argv is None:
+        attempts.append(_attempt("youtube", "yt-dlp", False, 0, "", "yt-dlp not installed"))
+        return {"platform": "youtube", "ok": False, "route": None, "content": "",
+                "final_url": url, "attempts": attempts}
     try:
         p = subprocess.run(
-            ["yt-dlp", "--dump-json", "--skip-download", url],
+            argv + ["--dump-json", "--skip-download", url],
             capture_output=True, text=True, timeout=max(timeout, 60),
         )
         ok = p.returncode == 0 and p.stdout.strip().startswith("{")