@gajae-code/coding-agent 0.11.10 → 0.12.0

package/src/cli/read-cli.ts

@@ -15,6 +15,7 @@ import { renderError } from "../tools/tool-errors";
 
 export interface ReadCommandArgs {
 	path: string;
+	truncation?: "head" | "last" | "both";
 }
 
 export async function runReadCommand(cmd: ReadCommandArgs): Promise<void> {
@@ -37,7 +38,7 @@ export async function runReadCommand(cmd: ReadCommandArgs): Promise<void> {
 	const tool = wrapToolWithMetaNotice(new ReadTool(session));
 
 	try {
-		const result = await tool.execute("gjc-read", { path: cmd.path });
+		const result = await tool.execute("gjc-read", { path: cmd.path, truncation: cmd.truncation });
 
 		for (const block of result.content) {
 			if (block.type === "text") {

package/src/cli.ts

@@ -5,8 +5,10 @@
  * lightweight CLI runner from pi-utils.
  */
 import "@gajae-code/utils/postmortem";
+import { THINKING_EFFORTS } from "@gajae-code/ai";
 import { Args, type CliConfig, Command, type CommandEntry, Flags, run } from "@gajae-code/utils/cli";
 import { APP_NAME, formatBunRuntimeError, MIN_BUN_VERSION, VERSION } from "@gajae-code/utils/dirs";
+import { loadNative as loadNativeBindings } from "../../natives/native/loader-state.js";
 import { runFixtureReport } from "./cli/fixture-report";
 import { admitManagedOwnerBeforeCli, completeManagedOwnerRecovery } from "./gjc-runtime/managed-owner-admission";
 import {
@@ -63,6 +65,7 @@ export const commands: CommandEntry[] = [
 	{ name: "migrate", load: () => import("./commands/migrate").then(m => m.default) },
 	{ name: "rlm", load: () => import("./commands/rlm").then(m => m.default) },
 	{ name: "update", load: () => import("./commands/update").then(m => m.default) },
+	{ name: "read", load: () => import("./commands/read").then(m => m.default) },
 	{ name: "plugin", load: () => import("./commands/plugin").then(m => m.default) },
 	{ name: "completion", load: () => import("./commands/completion").then(m => m.default) },
 	{ name: "launch", load: () => import("./commands/launch").then(m => m.default) },
@@ -174,6 +177,46 @@ async function runChatDaemonInternalFastPath(argv: string[]): Promise<void> {
 	await runChatDaemonInternal(action === "discord-internal" ? "discord" : "slack", argv.slice(2));
 }
 
+type MemoryGuardNativeSmokeLoad = () => Record<string, unknown>;
+type WindowsJobMemoryProbeResult = Record<string, unknown> & { kind: string };
+type MemoryGuardNativeSmokeReceipt = {
+	api: "memory_guard_windows_job_probe_v1";
+	source: "pi_natives";
+	result: WindowsJobMemoryProbeResult;
+};
+
+export function isMemoryGuardNativeSmokeFastPath(argv: readonly string[]): boolean {
+	return (
+		argv.length === 3 && argv[0] === "internal" && argv[1] === "memory-guard-native-smoke" && argv[2] === "--json"
+	);
+}
+
+function parseWindowsJobMemoryProbeResult(value: unknown): WindowsJobMemoryProbeResult {
+	if (!value || typeof value !== "object") {
+		throw new Error("memory-guard-native-smoke: native probe returned a non-object result");
+	}
+	const result = value as Record<string, unknown>;
+	if (typeof result.kind !== "string") {
+		throw new Error("memory-guard-native-smoke: native probe result is missing a string kind tag");
+	}
+	return result as WindowsJobMemoryProbeResult;
+}
+
+export function runMemoryGuardNativeSmokeFastPath(
+	options: { loadNative?: MemoryGuardNativeSmokeLoad; writeStdout?: (text: string) => void } = {},
+): void {
+	const probe = (options.loadNative ?? loadNativeBindings)().probeWindowsJobMemory;
+	if (typeof probe !== "function") {
+		throw new Error("memory-guard-native-smoke: probeWindowsJobMemory export missing from native addon");
+	}
+	const receipt: MemoryGuardNativeSmokeReceipt = {
+		api: "memory_guard_windows_job_probe_v1",
+		source: "pi_natives",
+		result: parseWindowsJobMemoryProbeResult((probe as () => unknown)()),
+	};
+	(options.writeStdout ?? (text => process.stdout.write(text)))(`${JSON.stringify(receipt)}\n`);
+}
+
 function rootFixtureArg(argv: string[]): { present: boolean; id: string | undefined } {
 	for (let i = 0; i < argv.length; i++) {
 		const arg = argv[i];
@@ -244,8 +287,8 @@ export class RootHelpCommand extends Command {
 		tmux: Flags.boolean({ description: "Launch interactive startup inside tmux" }),
 		tools: Flags.string({ description: "Comma-separated list of tools to enable (default: all)" }),
 		thinking: Flags.string({
-			description: "Set thinking level: ultra, high, medium, low",
-			options: ["ultra", "high", "medium", "low"],
+			description: `Set thinking level: ${THINKING_EFFORTS.join(", ")}`,
+			options: [...THINKING_EFFORTS],
 		}),
 		hook: Flags.string({ description: "Load a hook/extension file (can be used multiple times)", multiple: true }),
 		extension: Flags.string({
@@ -382,6 +425,10 @@ export async function runCli(argv: string[]): Promise<void> {
 		}
 		// Re-exec could not be spawned; fall through and run in this process.
 	}
+	if (isMemoryGuardNativeSmokeFastPath(argv)) {
+		runMemoryGuardNativeSmokeFastPath();
+		return;
+	}
 	if (isTmuxOwnerIsolationCliArgv(argv)) {
 		await runTmuxOwnerIsolationCliFromStdin();
 		return;

package/src/commands/deep-interview.ts

@@ -2,8 +2,22 @@ import { Command, Flags } from "@gajae-code/utils/cli";
 import { runNativeDeepInterviewCommand } from "../gjc-runtime/deep-interview-runtime";
 
 export default class DeepInterview extends Command {
-	static description =
-		"Run native GJC deep-interview workflow. Use `draft` for editable CLI-owned mutation inputs; JSON repair verbs are compatibility-only.";
+	static description = `Run native GJC deep-interview workflow.
+
+All deep-interview state operations go through this command — no gjc state needed:
+  read                Print the persisted envelope, revision, content sha, and any pending draft
+  write               One-shot incremental JSON merge into state (--reset replaces; the locked
+                      intent contract survives a reset)
+  stage               Stage one JSON transition draft (--for <transition> --input '<json>'|@file)
+  check               Dry-run the staged draft against current state (same merge apply performs)
+  apply               Commit the staged draft with runtime-owned revision+sha CAS
+  discard             Remove the pending draft
+  clear               Clear deep-interview state for the session (lifecycle passthrough)
+  handoff             Hand off to the next workflow skill (lifecycle passthrough)
+
+Ambiguity is runtime-owned: apply/write derive current_ambiguity from the latest valid scored
+round and clamp it to the deterministic floor. Sessions resolve from --session-id, payload
+session_id, or GJC_SESSION_ID.`;
 	static strict = false;
 	static flags = {
 		quick: Flags.boolean({ description: "Seed a quick deep-interview run" }),
@@ -15,6 +29,11 @@ export default class DeepInterview extends Command {
 		"session-id": Flags.string({
 			description: "Route state/spec handoff through a session-scoped .gjc/_session-{sessionid} directory",
 		}),
+		input: Flags.string({ description: "JSON payload (or @file) for the write/stage verbs" }),
+		for: Flags.string({
+			description: "Transition for stage: initialize-context | record-round | update-facts | merge-state",
+		}),
+		reset: Flags.boolean({ description: "With write: replace state instead of incremental merge" }),
 		write: Flags.boolean({ description: "Persist a final deep-interview spec through the sanctioned GJC CLI/API" }),
 		stage: Flags.string({ description: 'Spec stage for --write (currently "final")' }),
 		slug: Flags.string({ description: "Safe slug for .gjc/_session-{sessionid}/specs/deep-interview-<slug>.md" }),
@@ -27,13 +46,14 @@ export default class DeepInterview extends Command {
 		json: Flags.boolean({ description: "Output JSON" }),
 	};
 	static examples = [
-		'$ gjc deep-interview --trace --standard "<idea>" --json',
-		"$ gjc deep-interview draft create --for initialize-context --session-id <id> --json",
-		"$ gjc deep-interview draft edit --draft-id <id> --expected-draft-revision 1 --op set --path /type --value greenfield --json",
-		"$ gjc deep-interview draft check --draft-id <id> --json",
-		"$ gjc deep-interview initialize-context --draft-id <id> --expected-draft-revision <n> --json",
-		"$ gjc deep-interview --write --stage final --slug my-feature --spec ./final-spec.md --json",
-		"$ gjc deep-interview inspect --session-id <id> --selector summary --json",
+		'$ gjc deep-interview --trace --standard "<idea>"',
+		"$ gjc deep-interview read --json",
+		'$ gjc deep-interview write --input \'{"state":{"threshold":0.05}}\' --json',
+		'$ gjc deep-interview stage --for record-round --input \'{"state":{"rounds":[{"round":1,"round_key":"r1"}]}}\' --json',
+		"$ gjc deep-interview check --json",
+		"$ gjc deep-interview apply --json",
+		"$ gjc deep-interview --write --stage final --slug my-feature --spec ./final-spec.md",
+		"$ gjc deep-interview --write --stage final --slug my-feature --spec ./final-spec.md --deliberate",
 	];
 
 	async run(): Promise<void> {

package/src/commands/harness.ts

@@ -14,6 +14,7 @@ import { existsSync, readFileSync } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { Args, Command, Flags } from "@gajae-code/utils/cli";
+import { $credentialEnv } from "@gajae-code/utils/env";
 import {
 	GJC_TMUX_OWNER_GENERATION_ENV,
 	GJC_TMUX_OWNER_SERVER_KEY_ENV,
@@ -565,20 +566,42 @@ function ownerIsolationPlatform(): NodeJS.Platform {
 		: "linux";
 }
 
+/**
+ * Operator override for the process-start probe command, resolved from trusted
+ * environment sources only.
+ *
+ * The result is spawned, so whatever can set it chooses which binary runs.
+ * `$env` merges the caller's `cwd/.env` into `process.env`, so reading it there
+ * would let repository content pick the command; resolve it the same way
+ * provider credentials are (launching shell plus GJC/user-owned `.env` files,
+ * never the project `.env`). A malformed override stays fatal rather than
+ * silently falling back to `ps`, matching the previous behavior.
+ */
+type ProcessStartCommandOverride = { kind: "none" } | { kind: "invalid" } | { kind: "command"; command: string[] };
+
+function processStartCommandOverride(): ProcessStartCommandOverride {
+	const configured = $credentialEnv("GJC_HARNESS_PROCESS_START_COMMAND");
+	if (!configured) return { kind: "none" };
+	try {
+		const parsed = JSON.parse(configured) as unknown;
+		if (!Array.isArray(parsed) || parsed.length === 0 || parsed.some(value => typeof value !== "string" || !value))
+			return { kind: "invalid" };
+		return { kind: "command", command: parsed as string[] };
+	} catch {
+		return { kind: "invalid" };
+	}
+}
+
+/** Test seam: the process-start command override as resolved from trusted env. */
+export function processStartCommandOverrideForTest(): ProcessStartCommandOverride {
+	return processStartCommandOverride();
+}
+
 function portableProcessStartTime(pid: number): string | null {
 	if (process.platform === "linux") return null;
-	const configured = process.env.GJC_HARNESS_PROCESS_START_COMMAND;
-	let command: string[] = ["ps", "-o", "lstart=", "-p"];
-	if (configured) {
-		try {
-			const parsed = JSON.parse(configured) as unknown;
-			if (!Array.isArray(parsed) || parsed.length === 0 || parsed.some(value => typeof value !== "string" || !value))
-				return null;
-			command = parsed;
-		} catch {
-			return null;
-		}
-	}
+	const override = processStartCommandOverride();
+	if (override.kind === "invalid") return null;
+	const command: string[] = override.kind === "command" ? override.command : ["ps", "-o", "lstart=", "-p"];
 	const result = Bun.spawnSync([...command, String(pid)], {
 		stdout: "pipe",
 		stderr: "ignore",

package/src/commands/read.ts

@@ -1,7 +1,7 @@
 /**
  * Show what the read tool will return for a given path.
  */
-import { Args, Command } from "@gajae-code/utils/cli";
+import { Args, Command, Flags } from "@gajae-code/utils/cli";
 import { type ReadCommandArgs, runReadCommand } from "../cli/read-cli";
 import { initTheme } from "../modes/theme/theme";
 
@@ -15,8 +15,16 @@ export default class Read extends Command {
 		}),
 	};
 
+	static flags = {
+		truncation: Flags.string({
+			options: ["head", "last", "both"],
+			description: "Which end of an over-budget result to keep",
+		}),
+	};
+
 	static examples = [
 		"gjc read src/foo.ts",
+		"gjc read src/foo.ts --truncation head",
 		"gjc read src/foo.ts:50-100",
 		"gjc read src/foo.ts:raw",
 		"gjc read https://example.com",
@@ -25,9 +33,10 @@ export default class Read extends Command {
 	];
 
 	async run(): Promise<void> {
-		const { args } = await this.parse(Read);
+		const { args, flags } = await this.parse(Read);
 		const cmd: ReadCommandArgs = {
 			path: args.path ?? "",
+			truncation: flags.truncation as ReadCommandArgs["truncation"],
 		};
 		await initTheme();
 		await runReadCommand(cmd);

package/src/commands/sdk.ts

@@ -1,11 +1,13 @@
 import { createHash } from "node:crypto";
 import * as fs from "node:fs/promises";
+import * as os from "node:os";
 import * as path from "node:path";
 import { Args, CliParseError, Command, Flags, renderCommandHelp } from "@gajae-code/utils/cli";
 import type { Args as ParsedArgs } from "../cli/args";
 import { Settings } from "../config/settings";
 import { applyStartupModelProfiles, createSessionManager } from "../main";
 import { initializeExtensions } from "../modes/runtime-init";
+import { ACP_MCP_REQUEST_TIMEOUT_MS, ACP_MCP_STARTUP_HEADROOM_MS } from "../sdk/acp/mcp";
 import { Broker } from "../sdk/broker/broker";
 import { completeBrokerProcess } from "../sdk/broker/internal";
 import {
@@ -285,17 +287,99 @@ export async function runSessionHost(
 		throw new Error("SDK startup did not complete before readiness cutoff.");
 	}
 
-	let opened: { parsed: ParsedArgs; sessionManager: SessionManager | undefined };
-	let created: CreateLifecycleAgentSessionResult;
-	try {
-		opened = await openLifecycleSessionManager(request, cwd, agentDir);
-		created = await createLifecycleAgentSession({ cwd, agentDir, sessionManager: opened.sessionManager });
-	} catch (error) {
+	// Inlined rather than extracted to a helper: TypeScript's definite-assignment
+	// analysis does not see a `Promise<never>` helper as terminating, so hoisting
+	// this would make `opened`/`created` "used before assigned" below.
+	const registrationFailure = async (error: unknown): Promise<SdkStartupFailure> => {
 		const rollback = new SdkStartupRollbackTracker();
 		rollback.recordAbsent();
 		const failure = normalizeSdkStartupFailure("registration", "failed", error);
 		await writeFailure(failure, rollback.result);
-		throw failure;
+		return failure;
+	};
+
+	let opened: { parsed: ParsedArgs; sessionManager: SessionManager | undefined };
+	let created: CreateLifecycleAgentSessionResult;
+	let mcpConfigDirectory: string | undefined;
+	try {
+		let mcpConfigPath: string | undefined;
+		try {
+			opened = await openLifecycleSessionManager(request, cwd, agentDir);
+			if (request.mcpServers && request.mcpServers.length > 0) {
+				mcpConfigDirectory = await fs.realpath(await fs.mkdtemp(path.join(os.tmpdir(), "gjc-acp-mcp-")));
+				mcpConfigPath = path.join(mcpConfigDirectory, "mcp.json");
+				await Bun.write(
+					mcpConfigPath,
+					JSON.stringify({
+						mcpServers: Object.fromEntries(
+							request.mcpServers.map(server => [
+								server.name,
+								"url" in server
+									? {
+											type: server.type,
+											url: server.url,
+											...(server.headers ? { headers: server.headers } : {}),
+											timeout: ACP_MCP_REQUEST_TIMEOUT_MS,
+										}
+									: {
+											type: "stdio",
+											command: server.command,
+											args: server.args,
+											...(server.env ? { env: server.env } : {}),
+											noInheritEnv: true,
+											timeout: ACP_MCP_REQUEST_TIMEOUT_MS,
+										},
+							]),
+						),
+					}),
+				);
+			}
+		} catch (error) {
+			throw await registrationFailure(error);
+		}
+
+		// The longer MCP startup ceiling is scoped to ACP lifecycle launches only:
+		// it applies when this request actually carried `mcpServers`. Ordinary
+		// CLI/SDK `mcpConfigPath` consumers keep the manager's short default.
+		//
+		// This recheck deliberately sits OUTSIDE the registration catch above.
+		// Inside it, the throw would be caught, reclassified as
+		// `registration`/`failed`, and written a second time, losing the
+		// `startup`/`pending` outcome the readiness cutoff is supposed to report.
+		// Session-manager open and MCP config write already consumed part of the
+		// budget, so re-read the clock here rather than reusing the earlier check.
+		let mcpStartupTimeoutMs: number | undefined;
+		if (mcpConfigPath !== undefined) {
+			const remaining = request.semanticReadyDeadlineAt - now() - ACP_MCP_STARTUP_HEADROOM_MS;
+			if (remaining <= 0) {
+				const absent = new SdkStartupRollbackTracker();
+				absent.recordAbsent();
+				await writeFailure(
+					{
+						phase: "startup",
+						reason: "pending",
+						message: "SDK startup did not complete before readiness cutoff.",
+					},
+					absent.result,
+				);
+				throw new Error("SDK startup did not complete before readiness cutoff.");
+			}
+			mcpStartupTimeoutMs = remaining;
+		}
+
+		try {
+			created = await createLifecycleAgentSession({
+				cwd,
+				agentDir,
+				sessionManager: opened.sessionManager,
+				...(mcpConfigPath ? { mcpConfigPath } : {}),
+				...(mcpStartupTimeoutMs !== undefined ? { mcpStartupTimeoutMs } : {}),
+			});
+		} catch (error) {
+			throw await registrationFailure(error);
+		}
+	} finally {
+		if (mcpConfigDirectory) await fs.rm(mcpConfigDirectory, { recursive: true, force: true });
 	}
 	const { parsed } = opened;
 	if ("failure" in created) {

package/src/commands/team.ts

@@ -173,7 +173,7 @@ export default class Team extends Command {
 					"Supported operations:",
 					"send-message broadcast mailbox-list mailbox-mark-delivered mailbox-mark-notified notification-list notification-read notification-replay notification-mark-pane-attempt worker-startup-ack",
 					"create-task read-task list-tasks update-task claim-task transition-task-status release-task-claim",
-					"read-config read-manifest read-worker-status update-worker-status read-worker-heartbeat recover-stale-claims update-worker-heartbeat write-worker-inbox write-worker-identity",
+					"read-config read-manifest read-worker-status update-worker-status read-worker-heartbeat recover-stale-claims update-worker-heartbeat read-worker-memory-guard update-worker-memory-guard apply-worker-memory-guard write-worker-inbox write-worker-identity",
 					"append-event read-events read-traces await-event write-shutdown-request read-shutdown-ack read-monitor-snapshot write-monitor-snapshot read-task-approval write-task-approval",
 					"Completion example:",
 					'transition-task-status --input \'{"team_name":"demo","task_id":"task-1","to":"completed","claim_token":"...","completion_evidence":{"summary":"done","items":[{"kind":"command","status":"passed","summary":"focused tests passed","command":"bun test packages/coding-agent/test/gjc-runtime/team-runtime.test.ts"}]}}\' --json',

package/src/config/model-profile-activation.ts

@@ -222,6 +222,7 @@ export function materializeActiveModelProfileAssignments(options: MaterializeMod
 }
 
 export class ModelProfileCredentialError extends Error {
+	readonly code = "authentication_failed";
 	readonly profileLabel: string;
 	readonly providers: readonly string[];
 

package/src/config/model-profile-contract.ts

@@ -10,6 +10,7 @@ export interface ModelProfileCatalogItem {
 	id: string;
 	displayName: string;
 	source: "builtin" | "configured";
+	available?: boolean;
 }
 
 export interface UnknownModelProfileDetails {
@@ -124,6 +125,18 @@ export function projectModelProfileCatalog(
 		.sort((left, right) => left.id.localeCompare(right.id));
 }
 
+export function isModelProfileProviderAvailable(
+	profile: ModelProfileDefinition,
+	authenticatedProviders: ReadonlySet<string>,
+): boolean {
+	const alternativeGroups = profile.alternativeProviderGroups ?? [];
+	const alternativeProviders = new Set(alternativeGroups.flat());
+	for (const provider of profile.requiredProviders) {
+		if (!alternativeProviders.has(provider) && !authenticatedProviders.has(provider)) return false;
+	}
+	return alternativeGroups.every(group => group.some(provider => authenticatedProviders.has(provider)));
+}
+
 export function isModelProfileError(value: unknown): value is {
 	code: ModelProfileErrorCode;
 	message: string;

package/src/config/model-profiles.ts

@@ -207,6 +207,27 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		critic: "xai/grok-4.3:xhigh",
 		architect: "xai/grok-4.3:xhigh",
 	}),
+	profile("grok-45-eco", ["xai"], {
+		default: "xai/grok-4.5:low",
+		executor: "xai/grok-4.5:minimal",
+		planner: "xai/grok-4.5:low",
+		critic: "xai/grok-4.5:medium",
+		architect: "xai/grok-4.5:high",
+	}),
+	profile("grok-45-medium", ["xai"], {
+		default: "xai/grok-4.5:medium",
+		executor: "xai/grok-4.5:low",
+		planner: "xai/grok-4.5:medium",
+		critic: "xai/grok-4.5:high",
+		architect: "xai/grok-4.5:high",
+	}),
+	profile("grok-45-pro", ["xai"], {
+		default: "xai/grok-4.5:high",
+		executor: "xai/grok-4.5:medium",
+		planner: "xai/grok-4.5:high",
+		critic: "xai/grok-4.5:high",
+		architect: "xai/grok-4.5:high",
+	}),
 	profile("grok-build-pro", ["grok-build"], {
 		default: "grok-build/grok-composer-2.5-fast",
 		executor: "grok-build/grok-build",
@@ -321,6 +342,9 @@ const PROFILE_PRESENTATION: Record<string, ModelProfilePresentation> = {
 	"grok-eco": { displayName: "Grok Eco", providerGroup: "GROK" },
 	"grok-medium": { displayName: "Grok Medium", providerGroup: "GROK" },
 	"grok-pro": { displayName: "Grok Pro", providerGroup: "GROK" },
+	"grok-45-eco": { displayName: "Grok 4.5 Eco", providerGroup: "GROK" },
+	"grok-45-medium": { displayName: "Grok 4.5 Medium", providerGroup: "GROK" },
+	"grok-45-pro": { displayName: "Grok 4.5 Pro", providerGroup: "GROK" },
 	"grok-build-pro": { displayName: "Grok Build Pro", providerGroup: "GROK" },
 	"cursor-eco": { displayName: "Cursor Eco", providerGroup: "CURSOR" },
 	"cursor-medium": { displayName: "Cursor Medium", providerGroup: "CURSOR" },

package/src/config/model-registry.ts

@@ -34,7 +34,7 @@ const DEFAULT_LOCAL_TOKEN = "lm-studio-local";
 
 import { registerOAuthProvider, unregisterOAuthProviders } from "@gajae-code/ai/utils/oauth";
 import type { OAuthCredentials, OAuthLoginCallbacks } from "@gajae-code/ai/utils/oauth/types";
-import { $pickenv, isRecord, logger } from "@gajae-code/utils";
+import { $pickCredentialEnv, isRecord, logger } from "@gajae-code/utils";
 import { parseModelString, resolveProviderModelReference } from "../config/model-resolver";
 import { isValidThemeColor, type ThemeColor } from "../modes/theme/theme";
 import type { AuthStorage, OAuthCredential } from "../session/auth-storage";
@@ -450,8 +450,20 @@ function getProviderBaseUrlEnvKeys(provider: string): string[] {
 	return keys;
 }
 
+/**
+ * Provider base URL from the environment, trusted sources only.
+ *
+ * The result is baked into the provider override and reaches `model.baseUrl`,
+ * which the provider resolvers use as the request endpoint that carries the
+ * provider credential. `$env` (and therefore `$pickenv`) merges the caller's
+ * `cwd/.env`, so reading it there would let repository content redirect
+ * authenticated traffic for any provider — including re-admitting a redirect
+ * that the provider-level resolvers already reject. Resolve it the same way
+ * provider credentials are: launching shell plus GJC/user-owned `.env` files,
+ * never the project `.env`.
+ */
 function resolveProviderBaseUrlFromEnv(provider: string): string | undefined {
-	return $pickenv(...getProviderBaseUrlEnvKeys(provider));
+	return $pickCredentialEnv(...getProviderBaseUrlEnvKeys(provider));
 }
 
 function normalizeLocalOpenAICompatBaseUrl(baseUrl: string): string {
@@ -2507,6 +2519,13 @@ export class ModelRegistry {
 		return this.#keylessProviders.has(model.provider) || this.authStorage.hasAuth(model.provider);
 	}
 
+	/**
+	 * Check whether auth is configured for a provider.
+	 */
+	hasConfiguredProviderAuth(provider: string): boolean {
+		return this.#keylessProviders.has(provider) || this.authStorage.hasAuth(provider);
+	}
+
 	getDiscoverableProviders(): string[] {
 		const disabledProviders = getDisabledProviderIdsFromSettings();
 		return this.#discoveryManager.providers

package/src/config/provider-auth-health.ts

@@ -0,0 +1,42 @@
+import type { AuthStorage } from "@gajae-code/ai/auth-storage";
+
+/**
+ * Most recent OAuth validation outcome per provider, used only as an ordering
+ * hint so `/model` can rank a provider whose stored credentials failed
+ * validation below one that is healthy, without re-running validation itself.
+ *
+ * Entries are scoped to the `AuthStorage` that produced them and to its
+ * credential generation, so any login, logout, import, or deletion discards the
+ * stale result instead of overriding current auth state.
+ */
+export type ProviderAuthHealth = "valid" | "invalid";
+
+interface HealthEntry {
+	generation: number;
+	health: ProviderAuthHealth;
+}
+
+const healthByStorage = new WeakMap<AuthStorage, Map<string, HealthEntry>>();
+
+export function recordProviderAuthHealth(
+	authStorage: AuthStorage,
+	providerId: string,
+	health: ProviderAuthHealth,
+): void {
+	let entries = healthByStorage.get(authStorage);
+	if (!entries) {
+		entries = new Map();
+		healthByStorage.set(authStorage, entries);
+	}
+	entries.set(providerId, { generation: authStorage.getGeneration(), health });
+}
+
+export function getProviderAuthHealth(authStorage: AuthStorage, providerId: string): ProviderAuthHealth | undefined {
+	const entry = healthByStorage.get(authStorage)?.get(providerId);
+	if (!entry || entry.generation !== authStorage.getGeneration()) return undefined;
+	return entry.health;
+}
+
+export function clearProviderAuthHealth(authStorage: AuthStorage): void {
+	healthByStorage.delete(authStorage);
+}