@gajae-code/coding-agent 0.11.5 → 0.11.7

package/dist/types/session/internal/managed-session-storage.d.ts

@@ -3,6 +3,7 @@ export declare const MANAGED_ARTIFACT_MAX_DEPTH = 32;
 export declare const MANAGED_ARTIFACT_MAX_FILES = 10000;
 export declare const MANAGED_ARTIFACT_MAX_FILE_BYTES: number;
 export declare const MANAGED_ARTIFACT_MAX_TOTAL_BYTES: number;
+export type ManagedSessionSecurityPolicy = "default" | "windows-existing-verify-first";
 export type ManagedStorageFailure = "migration_busy" | "binding_conflict" | "binding_invalid" | "destination_conflict" | "source_changed" | "unsafe_artifacts" | "durability_failed" | "migration_retired" | "managed_storage_unsupported";
 export interface ManagedStorageLock {
     path: string;
@@ -40,10 +41,11 @@ export declare class ManagedSessionDescendantStore {
     constructor(root: ManagedDirectoryRoot, baseDir: string, retained?: {
         authority: RecoveryFsRoot;
         authorityBaseDir: string;
-    });
+    }, policy?: ManagedSessionSecurityPolicy);
     get dir(): string;
     get rootAuthority(): ManagedDirectoryRoot;
     get subtreeRootAuthority(): ManagedDirectoryRoot;
+    get securityPolicy(): ManagedSessionSecurityPolicy;
     deriveSubtree(relativePath: string): ManagedSessionDescendantStore;
     retainAuthority(): RecoveryFsRoot | undefined;
     assertBound(): void;
@@ -72,21 +74,21 @@ export declare class ManagedSessionDescendantStore {
 }
 export declare function shouldFsyncManagedDirectory(platform?: NodeJS.Platform): boolean;
 /** Create a managed directory and fail closed unless its owner-only mode/ACL verifies. */
-export declare function ensureManagedDirectory(pathname: string, root?: ManagedDirectoryRoot): void;
+export declare function ensureManagedDirectory(pathname: string, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): void;
 /** Captures a bounded prefix from one no-follow descriptor and rechecks the pathname before use. */
 export declare function captureManagedFilePrefixNoFollow(pathname: string, maxBytes: number): ManagedFileSnapshot;
 /** Captures header/hash/copy input from one no-follow descriptor and rechecks the pathname before use. */
 export declare function captureManagedFileNoFollow(pathname: string): ManagedFileSnapshot;
 /** Atomically publishes bytes without replacing an existing destination. */
-export declare function publishManagedFileNoReplace(destination: string, bytes: Uint8Array, assertOwned?: () => void, root?: ManagedDirectoryRoot): Promise<void>;
-export declare function publishManagedFileNoReplaceSync(destination: string, bytes: Uint8Array, root?: ManagedDirectoryRoot): void;
+export declare function publishManagedFileNoReplace(destination: string, bytes: Uint8Array, assertOwned?: () => void, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): Promise<void>;
+export declare function publishManagedFileNoReplaceSync(destination: string, bytes: Uint8Array, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): void;
 /** Replace one managed regular file while retaining the secured staging fd through publication. */
-export declare function replaceManagedFileSync(destination: string, bytes: Uint8Array, root: ManagedDirectoryRoot): void;
-export declare function replaceManagedFile(destination: string, bytes: Uint8Array, root: ManagedDirectoryRoot): Promise<void>;
+export declare function replaceManagedFileSync(destination: string, bytes: Uint8Array, root: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): void;
+export declare function replaceManagedFile(destination: string, bytes: Uint8Array, root: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): Promise<void>;
 /** Copy the exact bytes captured from one no-follow source descriptor. */
-export declare function copyManagedFileNoReplace(source: string, destination: string, snapshot?: ManagedFileSnapshot, root?: ManagedDirectoryRoot): Promise<void>;
+export declare function copyManagedFileNoReplace(source: string, destination: string, snapshot?: ManagedFileSnapshot, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): Promise<void>;
 /** Acquire a lease lock with bounded wait, heartbeats, conservative stale reclaim, and fencing. */
-export declare function acquireManagedLock(locksDirectory: string, name: string, root?: ManagedDirectoryRoot): Promise<ManagedStorageLock>;
+export declare function acquireManagedLock(locksDirectory: string, name: string, root?: ManagedDirectoryRoot, policy?: ManagedSessionSecurityPolicy): Promise<ManagedStorageLock>;
 /** Bounds a no-follow artifact tree before it can be copied or deleted. */
 export declare function validateManagedArtifactTree(root: string): void;
 /** Flush a copied managed artifact tree, including empty directories, before publishing its receipt. */

package/dist/types/session/session-manager.d.ts

@@ -553,7 +553,7 @@ export interface ResolvedSessionMatch {
     session: SessionInfo;
     scope: "local" | "global";
 }
-export declare function resolveResumableSession(sessionArg: string, cwd: string, sessionDir?: string, storage?: SessionStorage): Promise<ResolvedSessionMatch | undefined>;
+export declare function resolveResumableSession(sessionArg: string, cwd: string, sessionDir?: string, storage?: SessionStorage, managedAgentDir?: string): Promise<ResolvedSessionMatch | undefined>;
 interface SessionManagerStateSnapshot {
     sessionId: string;
     sessionName: string | undefined;
@@ -595,6 +595,16 @@ export declare class SessionManager {
     newSession(options?: NewSessionOptions): Promise<string | undefined>;
     /** Tombstone and exact-delete managed transcripts, detaching the active transcript first. */
     dropSession(sessionPath: string): Promise<void>;
+    /**
+     * Exact-delete a session transcript and its artifacts by path WITHOUT requiring
+     * managed logical authorization. This is only for discarding an UNCOMMITTED
+     * successor that a transaction (e.g. handoff) created via `newSession()` but
+     * never durably authorized — such a session has no managed candidate listing
+     * yet, so `dropSession` would refuse it and leak its resident-cache/artifact
+     * root. Bounded to this manager's configured session root and refuses to touch
+     * the active session; tolerates missing files.
+     */
+    discardUncommittedSession(sessionPath: string): Promise<void>;
     /**
      * Fork the current session, creating a new session file with the same entries.
      * Returns both the old and new session file paths for artifact copying.
@@ -639,6 +649,8 @@ export declare class SessionManager {
     /** Get usage statistics across all assistant messages in the session. */
     getUsageStatistics(): UsageStatistics;
     getSessionDir(): string;
+    /** Lists picker candidates within this manager's captured destination authority. */
+    listForResumePickerReadOnly(): Promise<SessionInfo[]>;
     getSessionId(): string;
     getSessionFile(): string | undefined;
     /**
@@ -891,8 +903,12 @@ export declare class SessionManager {
     static managedDestination(cwd: string, agentDir?: string, storage?: SessionStorage): SessionDestination;
     static explicitDestination(directory: string): SessionDestination;
     static create(cwd: string, destinationInput?: SessionDestinationInput, storage?: SessionStorage): SessionManager;
+    /** Prepare a selected candidate using this manager's captured managed destination authority. */
+    prepareManagedCandidateForWrite(filePath: string, migrationPolicy: SessionDirectoryMigrationPolicy, expectedIdentity?: ResumeSessionIdentity): Promise<string>;
+    /** Prepare a managed candidate and retain its exact post-preparation identity for the next adoption. */
+    prepareManagedCandidateForStrictAdoption(filePath: string, migrationPolicy: SessionDirectoryMigrationPolicy, expectedIdentity: ResumeSessionIdentity): Promise<string>;
     /** Resolve a default-managed candidate through binding validation and copy-retain migration before mutation. */
-    static prepareManagedCandidateForWrite(filePath: string, migrationPolicy: SessionDirectoryMigrationPolicy): Promise<string>;
+    static prepareManagedCandidateForWrite(filePath: string, migrationPolicy: SessionDirectoryMigrationPolicy, destination: SessionDestination, expectedIdentity?: ResumeSessionIdentity): Promise<string>;
     /**
      * Fork a session into the current project directory.
      * Copies history from another session file while creating a new session file in the current sessionDir.
@@ -906,7 +922,15 @@ export declare class SessionManager {
     static open(filePath: string, destinationInput?: SessionDestinationInput, storage?: SessionStorage, migrationPolicy?: SessionDirectoryMigrationPolicy): Promise<SessionManager>;
     static openNestedManaged(filePath: string, destination: SessionDestination, store: ManagedSessionDescendantStore, storage?: SessionStorage): Promise<SessionManager>;
     /**
-     * List sessions for the resume picker without recovery or other maintenance writes.
+     * List default-managed sessions for the resume picker without recovery or other
+     * maintenance writes. This is the only picker inventory that includes legacy
+     * sibling directories.
+     */
+    static listManagedForResumePickerReadOnly(cwd: string, managedAgentDir?: string, storage?: SessionStorage): Promise<SessionInfo[]>;
+    /**
+     * List sessions from an explicitly supplied picker directory without recovery
+     * or other maintenance writes. Unlike managed inventory, this never scans
+     * legacy sibling directories.
      */
     static listForResumePickerReadOnly(cwd: string, sessionDir?: string, storage?: SessionStorage): Promise<SessionInfo[]>;
     /** Tombstone and exact-delete a default-managed candidate. */
@@ -956,7 +980,13 @@ export declare class SessionManager {
     /**
      * List all sessions across all project directories.
      */
-    static listAll(storage?: SessionStorage): Promise<SessionInfo[]>;
+    static listAll(storage?: SessionStorage, managedAgentDir?: string): Promise<SessionInfo[]>;
+    /**
+     * Strict inventory bound to this manager's captured session authority. Managed
+     * managers include authorized legacy and current candidates; explicit managers
+     * authorize only their exact directory.
+     */
+    inventorySessionsStrict(): StrictInventoryResult;
     /**
      * Strict raw scoped inventory for ACP authorization. Enumerates the scoped
      * session directory without suppressing any root/scan/lstat/read/parse/stat/
@@ -967,6 +997,7 @@ export declare class SessionManager {
     static inventorySessionsStrict(cwd: string, options?: {
         sessionDir?: string;
         storage?: SessionStorage;
+        destination?: SessionDestination;
     }): StrictInventoryResult;
     /**
      * Propagate the storage-layer verified hard delete bound to exact identity evidence.

package/dist/types/session/yield-queue.d.ts

@@ -20,5 +20,13 @@ export declare class YieldQueue {
     has(kind?: string): boolean;
     flush(mode: YieldFlushMode): Promise<void>;
     clear(): void;
+    /** Drop only the queued entries of a single kind, leaving other kinds intact. */
+    clearKind(kind: string): void;
+    /**
+     * Re-schedule an idle flush if work remains and the session is idle. Used after
+     * a transition (e.g. handoff) releases a delivery fence so entries queued while
+     * fenced are not stranded until an unrelated enqueue or agent yield.
+     */
+    rearmIdle(): void;
 }
 export {};

package/dist/types/setup/credential-import.d.ts

@@ -73,7 +73,11 @@ export declare function discoverExternalCredentials(options?: DiscoveryOptions):
 export declare function formatCredentialSummary(credential: ImportableCredential): string;
 /** Redacted summary lines for an entire discovery result. Never includes secrets. */
 export declare function formatDiscoverySummary(result: CredentialDiscoveryResult): string[];
-export declare function isAutoImportOAuthCredential(credential: ImportableCredential): boolean;
+/** Reason shown when automatic OAuth import rejects an unusable discovery record. */
+export declare const INVALID_AUTO_IMPORT_OAUTH_EXPIRY_REASON = "OAuth credential has no valid future expiry";
+export declare function isAutoImportOAuthCredential(credential: ImportableCredential, now?: number): boolean;
+/** Keep rejected OAuth discoveries visible to operators without offering them for automatic import. */
+export declare function getAutoImportOAuthCredentialSkips(credentials: readonly ImportableCredential[], now?: number): SkippedCredential[];
 export declare function filterAutoImportOAuthCredentials(credentials: readonly ImportableCredential[]): ImportableCredential[];
 /**
  * Persist discovered credentials via `upsert`. Each credential is imported

package/dist/types/setup/provider-onboarding.d.ts

@@ -37,6 +37,7 @@ interface ProviderPreset {
     baseUrl: string;
     apiKeyEnv: string;
     models: readonly string[];
+    modelApi?: Readonly<Record<string, ProviderSetupApi>>;
     compat?: ProviderCompatConfig;
 }
 export declare const PROVIDER_PRESETS: readonly ProviderPreset[];
@@ -47,6 +48,7 @@ export declare function findProviderPreset(value: string | undefined): ProviderP
 export declare function formatProviderPresetList(): string;
 export declare function parseModelList(values: readonly string[]): string[];
 export declare function redactSecret(secret: string): string;
+export declare function validateModelApi(modelApi: Readonly<Record<string, string>> | undefined, models: readonly string[], presetId: string): void;
 export declare function addApiCompatibleProvider(input: ProviderSetupInput): Promise<ProviderSetupResult>;
 export declare function formatProviderSetupResult(result: ProviderSetupResult): string;
 export {};

package/dist/types/ssh/utils.d.ts

@@ -1,2 +1,3 @@
 export declare function sanitizeHostName(name: string): string;
+export declare function validateSshDestination(username: string | undefined, host: string): string | undefined;
 export declare function buildSshTarget(username: string | undefined, host: string): string;

package/dist/types/task/discovery.d.ts

@@ -1,3 +1,4 @@
+import type { Settings } from "../config/settings";
 import type { AgentDefinition } from "./types";
 /** Result of agent discovery */
 export interface DiscoveryResult {
@@ -11,8 +12,9 @@ export declare function filterVisibleAgents(agents: readonly AgentDefinition[]):
  * Precedence (highest wins): .gjc project, .gjc user, GJC plugins, then bundled
  *
  * @param cwd - Current working directory for project agent discovery
+ * @param activeSettings - Settings used to resolve enabled providers.
  */
-export declare function discoverAgents(cwd: string, home?: string): Promise<DiscoveryResult>;
+export declare function discoverAgents(cwd: string, home?: string, activeSettings?: Settings): Promise<DiscoveryResult>;
 /**
  * Get an agent by name from discovered agents.
  */

package/dist/types/tools/fetch.d.ts

@@ -14,6 +14,11 @@ export interface ParsedReadUrlTarget {
     limit?: number;
 }
 export declare function parseReadUrlTarget(readPath: string): ParsedReadUrlTarget | null;
+export declare function renderHtmlToText(html: string, signal?: AbortSignal): Promise<{
+    content: string;
+    ok: boolean;
+    method: string;
+}>;
 interface FetchImagePayload {
     data: string;
     mimeType: string;
@@ -21,14 +26,6 @@ interface FetchImagePayload {
 type FetchRenderResult = RenderResult & {
     image?: FetchImagePayload;
 };
-/**
- * Opt-in insane-search fallback for blocked / degraded public URL reads.
- *
- * Returns a finalized `method: "insane"` result on success, or null (so the
- * caller continues with its normal degraded behavior). Fail-closed: no note,
- * guard DNS, dependency probe, or subprocess when raw mode or the opt-in
- * setting is off. The public-URL guard runs BEFORE any probe/spawn.
- */
 export declare function tryInsaneFallback(args: {
     url: string;
     finalUrl: string;

package/dist/types/tools/image-gen.d.ts

@@ -72,6 +72,22 @@ interface InlineImageData {
 }
 /** Set the preferred image provider from settings */
 export declare function setPreferredImageProvider(provider: ImageProvider | "auto"): void;
+/** Provider → default image model mapping for auto-binding */
+export declare const IMAGE_PROVIDER_DEFAULTS: Record<string, string>;
+/** Resolved image generation configuration from settings */
+export interface ImageProviderConfig {
+    provider: ImageProvider | "auto" | "custom";
+    model: string | null;
+    customUrl?: string;
+    customKey?: string;
+    customKeyEnv?: string;
+}
+/** Set the configured image provider + model from settings */
+export declare function setConfiguredImageModel(config: ImageProviderConfig | null): void;
+/** Get the current configured image model (for UI display) */
+export declare function getConfiguredImageModel(): ImageProviderConfig | null;
+/** Resolve the effective image model for a configured provider */
+export declare function resolveImageModel(provider: string, modelOverride: string | null): string;
 export declare function isOpenAIHostedImageModel(model: Model | undefined): model is Model;
 export declare const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails>;
 export declare function getImageGenTools(modelRegistry?: ModelRegistry, activeModel?: Model): Promise<Array<CustomTool<typeof imageGenSchema, ImageGenToolDetails>>>;

package/dist/types/tools/skill-discovery.d.ts

@@ -15,6 +15,13 @@ export type SkillDiscoveryToolInput = z.infer<typeof skillDiscoverySchema>;
 export interface SkillDiscoveryToolDetails {
     candidates: RuntimeSkillDiscoveryCandidate[];
     count: number;
+    /**
+     * Present only when zero candidates were returned AND discovery config gates
+     * (`skills.enabled` / `skills.enablePiProject` / `skills.enablePiUser`)
+     * prevented some or all of the requested scope from being searched. Without
+     * this, a disabled config is indistinguishable from "no skills exist".
+     */
+    notice?: string;
 }
 export declare class SkillDiscoveryTool implements AgentTool<typeof skillDiscoverySchema, SkillDiscoveryToolDetails> {
     #private;

package/dist/types/tools/sqlite-reader.d.ts

@@ -32,6 +32,13 @@ export type SqliteRowLookup = {
 } | {
     kind: "rowid";
 };
+/**
+ * Keep raw reads deliberately narrower than SQLite's full grammar. Comments are
+ * rejected, and a statement terminator is accepted only as the final
+ * non-whitespace character. Quoted semicolons remain ordinary query data.
+ */
+export declare function validateSqliteReadQuery(sql: string): string;
+export declare function enforceSqliteQueryOnly(db: Database): void;
 export declare function parseSqlitePathCandidates(filePath: string): SqlitePathCandidate[];
 export declare function isSqliteFile(absolutePath: string): Promise<boolean>;
 export declare function parseSqliteSelector(subPath: string, queryString: string): SqliteSelector;

package/dist/types/utils/shell-snapshot.d.ts

@@ -1,5 +1,17 @@
+interface ShellSnapshotCacheOptions {
+    tempRoot: string;
+    home: string | (() => string);
+    platform: NodeJS.Platform;
+}
+declare function createShellSnapshotCache(options: ShellSnapshotCacheOptions): {
+    getOrCreateSnapshot(shell: string, env: Record<string, string | undefined>): Promise<string | null>;
+    cleanup(): Promise<void>;
+};
+/** @internal Test-only factory for isolated filesystem and platform assertions. */
+export declare const createShellSnapshotCacheForTesting: typeof createShellSnapshotCache;
 /**
  * Create a shell snapshot, caching the result.
  * Returns the path to the snapshot file, or null if creation failed.
  */
 export declare function getOrCreateSnapshot(shell: string, env: Record<string, string | undefined>): Promise<string | null>;
+export {};

package/dist/types/web/insane/bridge.d.ts

@@ -16,6 +16,7 @@ import { spawn as nodeSpawn } from "node:child_process";
 export declare const INSANE_VENDOR_DIR: string;
 /** Stable note prefixes — tests assert on these without depending on full stderr. */
 export declare const INSANE_NOTES: {
+    readonly securityDisabled: `insane fallback disabled: remote renderer cannot preserve validated network routing`;
     readonly guardBlocked: (reason: string) => string;
     readonly vendorMissing: `insane fallback unavailable: vendor engine missing at packages/coding-agent/vendor/insane-search`;
     readonly noPython: `insane fallback unavailable: python3 not found; install python3 and curl_cffi, then retry with web.insaneFallback=true`;

package/dist/types/web/insane/url-guard.d.ts

@@ -10,6 +10,18 @@ export interface PublicUrlRejected {
 export type PublicUrlResult = PublicUrlAccepted | PublicUrlRejected;
 /** Resolver seam so tests can inject DNS results without real lookups. */
 export type AddressResolver = (hostname: string) => Promise<string[]>;
+type ProxyEnvironment = Record<string, string | undefined>;
+export type GuardedPublicFetchResult = {
+    ok: true;
+    response: Response;
+    logicalUrl: URL;
+    wireUrl: URL;
+} | {
+    ok: false;
+    reason: string;
+    logicalUrl: string;
+};
+export declare function hasConfiguredProxy(env: ProxyEnvironment): boolean;
 /** True for any address that is not a routable public unicast address. */
 export declare function isPrivateOrSpecialAddress(address: string): boolean;
 /**
@@ -19,7 +31,12 @@ export declare function isPrivateOrSpecialAddress(address: string): boolean;
  */
 export declare function validatePublicHttpUrl(rawUrl: string, options?: {
     resolver?: AddressResolver;
+    signal?: AbortSignal;
 }): Promise<PublicUrlResult>;
+export declare function guardedPublicFetch(rawUrl: string, init?: BunFetchRequestInit, options?: {
+    resolver?: AddressResolver;
+}): Promise<GuardedPublicFetchResult>;
 export declare function validatePublicHttpUrlForInsane(rawUrl: string, options?: {
     resolver?: AddressResolver;
 }): Promise<PublicUrlResult>;
+export {};

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.11.5",
+	"version": "0.11.7",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -53,13 +53,13 @@
 		"@agentclientprotocol/sdk": "1.2.1",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.11.5",
-		"@gajae-code/agent-core": "0.11.5",
-		"@gajae-code/ai": "0.11.5",
-		"@gajae-code/bridge-client": "0.11.5",
-		"@gajae-code/natives": "0.11.5",
-		"@gajae-code/tui": "0.11.5",
-		"@gajae-code/utils": "0.11.5",
+		"@gajae-code/stats": "0.11.7",
+		"@gajae-code/agent-core": "0.11.7",
+		"@gajae-code/ai": "0.11.7",
+		"@gajae-code/bridge-client": "0.11.7",
+		"@gajae-code/natives": "0.11.7",
+		"@gajae-code/tui": "0.11.7",
+		"@gajae-code/utils": "0.11.7",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/scripts/generate-sdk-operation-inventory.ts

@@ -147,6 +147,8 @@ const LOCKED_EXCLUSIONS: Readonly<Record<string, string>> = {
 	"agent_session:prepareContributionPrep": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:setResourceSampler": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:setRetainedMemorySampler": "internal accessor/plumbing, not a user-facing control seam",
+	"agent_session:createBtwConversationScope":
+		"internal privacy-scoped side-chat snapshot factory, not a user-facing SDK control seam",
 	"agent_session:recordBashResult": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:executePython": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:assertEvalExecutionAllowed": "internal accessor/plumbing, not a user-facing control seam",
@@ -258,6 +260,7 @@ const SEAM_TO_SDK: Readonly<Record<string, string>> = {
 	"slash_command:clear": "context.clear",
 	"slash_command:new": "session.new",
 	"slash_command:compact": "compaction.run",
+	"slash_command:handoff": "session.handoff",
 	"slash_command:resume": "session.resume",
 	"slash_command:retry": "retry.last",
 	"slash_command:background": "bash.background",

package/src/capability/index.ts

@@ -41,6 +41,8 @@ const disabledProviders = new Set<string>();
 
 /** Settings manager for persistence (if set) */
 let settings: Settings | null = null;
+/** Session-local settings keyed by normalized working directory. */
+const settingsByCwd = new Map<string, Settings>();
 
 // =============================================================================
 // Registration API
@@ -208,8 +210,9 @@ async function loadImpl<T>(
  * Filter providers based on options and disabled state.
  */
 function filterProviders<T>(capability: Capability<T>, options: LoadOptions): Provider<T>[] {
-	let providers = (capability.providers as Provider<T>[]).filter(p => !disabledProviders.has(p.id));
-
+	const activeSettings = options.settings ?? settingsByCwd.get(path.normalize(options.cwd ?? getProjectDir()));
+	const activeDisabledProviders = new Set(activeSettings?.get("disabledProviders") ?? disabledProviders);
+	let providers = (capability.providers as Provider<T>[]).filter(p => !activeDisabledProviders.has(p.id));
 	if (options.providers) {
 		const allowed = new Set(options.providers);
 		providers = providers.filter(p => allowed.has(p.id));
@@ -249,63 +252,68 @@ export async function loadCapability<T>(capabilityId: string, options: LoadOptio
  * Call this once on startup to enable persistent provider state.
  */
 export function initializeWithSettings(activeSettings: Settings): void {
+	settingsByCwd.set(path.normalize(activeSettings.getCwd()), activeSettings);
 	settings = activeSettings;
-	// Load disabled providers from settings
-	const disabled = settings.get("disabledProviders");
+	const disabled = activeSettings.get("disabledProviders");
 	disabledProviders.clear();
-	for (const id of disabled) {
-		disabledProviders.add(id);
-	}
+	for (const id of disabled) disabledProviders.add(id);
 }
 
 /**
  * Persist current disabled providers to settings.
  */
-function persistDisabledProviders(): void {
-	if (settings) {
-		settings.set("disabledProviders", Array.from(disabledProviders));
-	}
+function persistDisabledProviders(activeSettings: Settings, providers: ReadonlySet<string>): void {
+	activeSettings.set("disabledProviders", Array.from(providers));
 }
 
-/**
- * Disable a provider globally (across all capabilities).
- */
-export function disableProvider(providerId: string): void {
-	disabledProviders.add(providerId);
-	persistDisabledProviders();
+/** Disable a provider for the supplied session settings. */
+export function disableProvider(
+	providerId: string,
+	activeSettings: Settings = settings ??
+		(() => {
+			throw new Error("Capability settings unavailable");
+		})(),
+): void {
+	const providers = new Set(activeSettings.get("disabledProviders"));
+	providers.add(providerId);
+	persistDisabledProviders(activeSettings, providers);
 }
 
-/**
- * Enable a previously disabled provider.
- */
-export function enableProvider(providerId: string): void {
-	disabledProviders.delete(providerId);
-	persistDisabledProviders();
+/** Enable a provider for the supplied session settings. */
+export function enableProvider(
+	providerId: string,
+	activeSettings: Settings = settings ??
+		(() => {
+			throw new Error("Capability settings unavailable");
+		})(),
+): void {
+	const providers = new Set(activeSettings.get("disabledProviders"));
+	providers.delete(providerId);
+	persistDisabledProviders(activeSettings, providers);
 }
 
-/**
- * Check if a provider is enabled.
- */
-export function isProviderEnabled(providerId: string): boolean {
-	return !disabledProviders.has(providerId);
+/** Check whether a provider is enabled by the supplied session settings. */
+export function isProviderEnabled(
+	providerId: string,
+	activeSettings: Settings | undefined = settings ?? undefined,
+): boolean {
+	return !new Set(activeSettings?.get("disabledProviders") ?? disabledProviders).has(providerId);
 }
 
-/**
- * Get list of all disabled provider IDs.
- */
-export function getDisabledProviders(): string[] {
-	return Array.from(disabledProviders);
+/** Get disabled providers from the supplied session settings. */
+export function getDisabledProviders(activeSettings: Settings | undefined = settings ?? undefined): string[] {
+	return [...(activeSettings?.get("disabledProviders") ?? disabledProviders)];
 }
 
-/**
- * Set disabled providers from a list (replaces current set).
- */
-export function setDisabledProviders(providerIds: string[]): void {
-	disabledProviders.clear();
-	for (const id of providerIds) {
-		disabledProviders.add(id);
-	}
-	persistDisabledProviders();
+/** Replace disabled providers for the supplied session settings. */
+export function setDisabledProviders(
+	providerIds: string[],
+	activeSettings: Settings = settings ??
+		(() => {
+			throw new Error("Capability settings unavailable");
+		})(),
+): void {
+	persistDisabledProviders(activeSettings, new Set(providerIds));
 }
 
 // =============================================================================

package/src/capability/types.ts

@@ -6,6 +6,7 @@
  * and get back a unified array of MCP servers.
  */
 
+import type { Settings } from "../config/settings";
 /**
  * Context passed to every provider loader.
  */
@@ -72,6 +73,8 @@ export interface LoadOptions {
 	includeDisabled?: boolean;
 	/** Explicit disabled extension IDs to apply instead of settings. */
 	disabledExtensions?: string[];
+	/** Session settings whose provider policy applies to this load. */
+	settings?: Settings;
 }
 
 /**

package/src/cli/setup-cli.ts

@@ -18,7 +18,11 @@ import {
 } from "../hooks/codex-native-hooks-config";
 import { theme } from "../modes/theme/theme";
 import { formatCredentialAutoImportResult, runExternalCredentialAutoImport } from "../setup/credential-auto-import";
-import { filterAutoImportOAuthCredentials, formatDiscoverySummary } from "../setup/credential-import";
+import {
+	formatDiscoverySummary,
+	getAutoImportOAuthCredentialSkips,
+	isAutoImportOAuthCredential,
+} from "../setup/credential-import";
 import {
 	formatHermesSetupResult,
 	type HermesSetupFlags,
@@ -596,8 +600,10 @@ export async function handleCredentialsSetup(
 			trigger: "setup-cli",
 		});
 		const result = preview.discovery ?? { importable: [], skipped: [], environment: [] };
-		const candidates = filterAutoImportOAuthCredentials(result.importable);
-		const filteredResult = { ...result, importable: candidates };
+		const now = Date.now();
+		const candidates = result.importable.filter(credential => isAutoImportOAuthCredential(credential, now));
+		const autoImportSkips = getAutoImportOAuthCredentialSkips(result.importable, now);
+		const filteredResult = { ...result, importable: candidates, skipped: [...result.skipped, ...autoImportSkips] };
 		const redactedPlan = {
 			importable: candidates.map(c => ({
 				provider: c.provider,
@@ -607,7 +613,7 @@ export async function handleCredentialsSetup(
 				expiresAt: c.expiresAt,
 				redactedToken: c.redactedToken,
 			})),
-			skipped: result.skipped,
+			skipped: filteredResult.skipped,
 			environment: result.environment,
 			keychainChecked: flags.keychain === true,
 		};