@gajae-code/coding-agent 0.11.6 → 0.11.8

package/scripts/dogfood-repository-binding.ts

@@ -0,0 +1,209 @@
+/**
+ * Product-surface dogfood for #2901 repository binding.
+ *
+ * Creates two sibling git repos, runs real `gjc ultragoal` / `gjc ralplan`
+ * CLI entrypoints from source, and prints fail-closed mismatch evidence.
+ *
+ * Usage (from monorepo root):
+ *   bun packages/coding-agent/scripts/dogfood-repository-binding.ts
+ */
+import * as fsp from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+	assertCwdMatchesRepositoryBinding,
+	assertPathUnderRepositoryBinding,
+	parseRepositoryBinding,
+	resolveTaskRepositoryBinding,
+} from "../src/gjc-runtime/repository-binding";
+import { readUltragoalPlan, startNextUltragoalGoal } from "../src/gjc-runtime/ultragoal-runtime";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../..");
+const cli = path.join(repoRoot, "packages/coding-agent/src/cli.ts");
+
+async function runGit(cwd: string, args: string[]): Promise<void> {
+	const proc = Bun.spawn(["git", ...args], { cwd, stdout: "pipe", stderr: "pipe" });
+	const code = await proc.exited;
+	if (code !== 0) throw new Error(`git ${args.join(" ")} failed: ${await new Response(proc.stderr).text()}`);
+}
+
+async function initRepo(root: string): Promise<void> {
+	await fsp.mkdir(root, { recursive: true });
+	await runGit(root, ["init"]);
+	await runGit(root, ["config", "user.email", "dogfood@example.com"]);
+	await runGit(root, ["config", "user.name", "Dogfood"]);
+	await fsp.writeFile(path.join(root, "README.md"), `repo ${path.basename(root)}\n`);
+	await runGit(root, ["add", "README.md"]);
+	await runGit(root, ["commit", "-m", `init ${path.basename(root)}`]);
+}
+
+async function runCli(
+	cwd: string,
+	args: string[],
+	env: NodeJS.ProcessEnv,
+): Promise<{ code: number; stdout: string; stderr: string }> {
+	const proc = Bun.spawn(["bun", cli, ...args], { cwd, env, stdout: "pipe", stderr: "pipe" });
+	const [code, stdout, stderr] = await Promise.all([
+		proc.exited,
+		new Response(proc.stdout).text(),
+		new Response(proc.stderr).text(),
+	]);
+	return { code, stdout, stderr };
+}
+
+async function main(): Promise<void> {
+	const dogfoodRoot = await fsp.mkdtemp(path.join(os.tmpdir(), "gjc-dogfood-2901-"));
+	const left = path.join(dogfoodRoot, "gajae-code");
+	const right = path.join(dogfoodRoot, "oh-my-openagent-senpi");
+	await initRepo(left);
+	await initRepo(right);
+
+	const sessionId = `dogfood-2901-${process.pid}`;
+	const env = { ...process.env, GJC_SESSION_ID: sessionId };
+
+	console.log("# Dogfood: repository binding (#2901)");
+	console.log(`root=${dogfoodRoot}`);
+	console.log(`left=${left}`);
+	console.log(`right=${right}`);
+	console.log(`session=${sessionId}`);
+	console.log(`cli=${cli}`);
+	console.log(`bun=${Bun.version}`);
+	console.log(
+		`commit=${Bun.spawnSync(["git", "-C", repoRoot, "rev-parse", "--short", "HEAD"]).stdout.toString().trim()}`,
+	);
+	console.log();
+
+	// 1) Product CLI: create goals stamps binding
+	const create = await runCli(
+		left,
+		[
+			"ultragoal",
+			"create-goals",
+			"--brief",
+			"@goal dogfood binding\nProve repository binding stamps and fail-closed sibling mismatch.",
+			"--json",
+		],
+		env,
+	);
+	console.log("## 1) gjc ultragoal create-goals (LEFT)");
+	console.log(`exit=${create.code}`);
+	console.log(create.stdout.trim() || create.stderr.trim());
+	if (create.code !== 0) process.exit(1);
+
+	const plan = await readUltragoalPlan(left, sessionId);
+	if (!plan?.repositoryBinding) {
+		console.error("FAIL: plan missing repositoryBinding");
+		process.exit(1);
+	}
+	console.log();
+	console.log("## 2) goals.json repositoryBinding");
+	console.log(JSON.stringify(plan.repositoryBinding, null, 2));
+
+	// 2) Matching cwd starts goal
+	console.log();
+	console.log("## 3) startNextUltragoalGoal on LEFT (match)");
+	const started = await startNextUltragoalGoal({ cwd: left, sessionId });
+	console.log(`ok goal=${started.goal?.id} status=${started.goal?.status}`);
+
+	// 3) Sibling mismatch fails closed
+	console.log();
+	console.log("## 4) assertCwdMatchesRepositoryBinding on RIGHT (sibling)");
+	try {
+		await assertCwdMatchesRepositoryBinding(right, plan.repositoryBinding);
+		console.error("FAIL: expected identity_mismatch");
+		process.exit(1);
+	} catch (error) {
+		console.log(`fail_closed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+
+	// 4) Path escape fails closed
+	console.log();
+	console.log("## 5) assertPathUnderRepositoryBinding sibling absolute path");
+	try {
+		assertPathUnderRepositoryBinding(plan.repositoryBinding, path.join(right, "README.md"));
+		console.error("FAIL: expected path_outside_root");
+		process.exit(1);
+	} catch (error) {
+		console.log(`fail_closed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+
+	// 5) Task binding stamp + sibling fail-closed (pre-discovery authority)
+	console.log();
+	console.log("## 6) task binding stamp (omit declaration) + sibling reject");
+	const stamped = await resolveTaskRepositoryBinding(left, undefined);
+	console.log(`stamped_worktreeRoot=${stamped.worktreeRoot}`);
+	await assertCwdMatchesRepositoryBinding(left, stamped);
+	console.log("task_stamp_ok on LEFT");
+	const taskBinding = parseRepositoryBinding(plan.repositoryBinding);
+	try {
+		await resolveTaskRepositoryBinding(right, taskBinding);
+		console.error("FAIL: task binding should reject RIGHT");
+		process.exit(1);
+	} catch (error) {
+		console.log(`task_binding_fail_closed on RIGHT: ${error instanceof Error ? error.message : String(error)}`);
+	}
+
+	// 6) Ralplan seed stamps binding via product CLI
+	console.log();
+	console.log("## 7) gjc ralplan seed (LEFT)");
+	const ralplan = await runCli(left, ["ralplan", "--json", "dogfood multi-repo binding"], env);
+	console.log(`exit=${ralplan.code}`);
+	console.log(ralplan.stdout.trim() || ralplan.stderr.trim());
+	if (ralplan.code !== 0) process.exit(1);
+	const statePath = path.join(left, ".gjc", `_session-${sessionId}`, "state", "ralplan-state.json");
+	const state = JSON.parse(await fsp.readFile(statePath, "utf8")) as {
+		repository_binding?: unknown;
+		run_id?: string;
+	};
+	console.log();
+	console.log("## 8) ralplan-state.json repository_binding");
+	console.log(JSON.stringify({ run_id: state.run_id, repository_binding: state.repository_binding }, null, 2));
+	if (!state.repository_binding) {
+		console.error("FAIL: ralplan state missing repository_binding");
+		process.exit(1);
+	}
+
+	// 7) Ralplan stage write on LEFT succeeds and echoes repository_binding
+	console.log();
+	console.log("## 9) gjc ralplan --write planner on LEFT (match)");
+	const notePath = path.join(left, "dogfood-planner.md");
+	await fsp.writeFile(notePath, "# dogfood planner\n");
+	const writeLeft = await runCli(
+		left,
+		["ralplan", "--write", "--stage", "planner", "--stage_n", "1", "--artifact", notePath, "--json"],
+		env,
+	);
+	console.log(`exit=${writeLeft.code}`);
+	console.log(writeLeft.stdout.trim() || writeLeft.stderr.trim());
+	if (writeLeft.code !== 0) process.exit(1);
+	const writePayload = JSON.parse(writeLeft.stdout) as { repository_binding?: { worktreeRoot?: string } };
+	if (!writePayload.repository_binding?.worktreeRoot) {
+		console.error("FAIL: write receipt missing repository_binding");
+		process.exit(1);
+	}
+
+	// 8) Copy seed authority into RIGHT session layout → stage write fails closed
+	console.log();
+	console.log("## 10) ralplan --write on RIGHT with LEFT binding (fail-closed)");
+	const rightStateDir = path.join(right, ".gjc", `_session-${sessionId}`, "state");
+	await fsp.mkdir(rightStateDir, { recursive: true });
+	await fsp.copyFile(statePath, path.join(rightStateDir, "ralplan-state.json"));
+	const writeRight = await runCli(
+		right,
+		["ralplan", "--write", "--stage", "architect", "--stage_n", "1", "--artifact", "# arch\n", "--json"],
+		env,
+	);
+	console.log(`exit=${writeRight.code}`);
+	console.log((writeRight.stderr || writeRight.stdout).trim());
+	if (writeRight.code === 0) {
+		console.error("FAIL: expected sibling write to fail closed");
+		process.exit(1);
+	}
+	console.log("fail_closed: ralplan write on sibling rejected");
+
+	console.log();
+	console.log("DOGFOOD_OK");
+}
+
+await main();

package/scripts/generate-sdk-operation-inventory.ts

@@ -39,6 +39,8 @@ const LOCKED_EXCLUSIONS: Readonly<Record<string, string>> = {
 	"agent_session:setForcedToolChoice": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:getActiveSkillState": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:getActiveSkillPhase": "internal accessor/plumbing, not a user-facing control seam",
+	"agent_session:getDeepInterviewAskStage":
+		"internal AskTool schema-selection accessor, not a user-facing SDK control seam",
 	"agent_session:peekQueueInvoker": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:peekStandingResolveHandler": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:setStandingResolveHandler": "internal accessor/plumbing, not a user-facing control seam",
@@ -147,6 +149,8 @@ const LOCKED_EXCLUSIONS: Readonly<Record<string, string>> = {
 	"agent_session:prepareContributionPrep": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:setResourceSampler": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:setRetainedMemorySampler": "internal accessor/plumbing, not a user-facing control seam",
+	"agent_session:createBtwConversationScope":
+		"internal privacy-scoped side-chat snapshot factory, not a user-facing SDK control seam",
 	"agent_session:recordBashResult": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:executePython": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:assertEvalExecutionAllowed": "internal accessor/plumbing, not a user-facing control seam",

package/scripts/run-test-manifest.ts

@@ -60,11 +60,11 @@ function validateRowReceipts(rows: ManifestAdapterRow[]): void {
 		}
 		counts.set(row.adapter, (counts.get(row.adapter) ?? 0) + 1);
 	}
-	if (rows.length !== ADAPTERS.length * 91)
-		throw new Error(`Expected ${ADAPTERS.length * 91} adapter rows; received ${rows.length}.`);
+	if (rows.length !== ADAPTERS.length * 93)
+		throw new Error(`Expected ${ADAPTERS.length * 93} adapter rows; received ${rows.length}.`);
 	for (const adapter of ADAPTERS) {
-		if (counts.get(adapter) !== 91)
-			throw new Error(`Expected 91 ${adapter} rows; received ${counts.get(adapter) ?? 0}.`);
+		if (counts.get(adapter) !== 93)
+			throw new Error(`Expected 93 ${adapter} rows; received ${counts.get(adapter) ?? 0}.`);
 	}
 	process.stdout.write(
 		`manifest check: ${rows.length} row receipts (${[...counts].map(([adapter, count]) => `${adapter}=${count}`).join(", ")})\n`,

package/src/capability/index.ts

@@ -41,6 +41,8 @@ const disabledProviders = new Set<string>();
 
 /** Settings manager for persistence (if set) */
 let settings: Settings | null = null;
+/** Session-local settings keyed by normalized working directory. */
+const settingsByCwd = new Map<string, Settings>();
 
 // =============================================================================
 // Registration API
@@ -208,8 +210,9 @@ async function loadImpl<T>(
  * Filter providers based on options and disabled state.
  */
 function filterProviders<T>(capability: Capability<T>, options: LoadOptions): Provider<T>[] {
-	let providers = (capability.providers as Provider<T>[]).filter(p => !disabledProviders.has(p.id));
-
+	const activeSettings = options.settings ?? settingsByCwd.get(path.normalize(options.cwd ?? getProjectDir()));
+	const activeDisabledProviders = new Set(activeSettings?.get("disabledProviders") ?? disabledProviders);
+	let providers = (capability.providers as Provider<T>[]).filter(p => !activeDisabledProviders.has(p.id));
 	if (options.providers) {
 		const allowed = new Set(options.providers);
 		providers = providers.filter(p => allowed.has(p.id));
@@ -249,63 +252,68 @@ export async function loadCapability<T>(capabilityId: string, options: LoadOptio
  * Call this once on startup to enable persistent provider state.
  */
 export function initializeWithSettings(activeSettings: Settings): void {
+	settingsByCwd.set(path.normalize(activeSettings.getCwd()), activeSettings);
 	settings = activeSettings;
-	// Load disabled providers from settings
-	const disabled = settings.get("disabledProviders");
+	const disabled = activeSettings.get("disabledProviders");
 	disabledProviders.clear();
-	for (const id of disabled) {
-		disabledProviders.add(id);
-	}
+	for (const id of disabled) disabledProviders.add(id);
 }
 
 /**
  * Persist current disabled providers to settings.
  */
-function persistDisabledProviders(): void {
-	if (settings) {
-		settings.set("disabledProviders", Array.from(disabledProviders));
-	}
+function persistDisabledProviders(activeSettings: Settings, providers: ReadonlySet<string>): void {
+	activeSettings.set("disabledProviders", Array.from(providers));
 }
 
-/**
- * Disable a provider globally (across all capabilities).
- */
-export function disableProvider(providerId: string): void {
-	disabledProviders.add(providerId);
-	persistDisabledProviders();
+/** Disable a provider for the supplied session settings. */
+export function disableProvider(
+	providerId: string,
+	activeSettings: Settings = settings ??
+		(() => {
+			throw new Error("Capability settings unavailable");
+		})(),
+): void {
+	const providers = new Set(activeSettings.get("disabledProviders"));
+	providers.add(providerId);
+	persistDisabledProviders(activeSettings, providers);
 }
 
-/**
- * Enable a previously disabled provider.
- */
-export function enableProvider(providerId: string): void {
-	disabledProviders.delete(providerId);
-	persistDisabledProviders();
+/** Enable a provider for the supplied session settings. */
+export function enableProvider(
+	providerId: string,
+	activeSettings: Settings = settings ??
+		(() => {
+			throw new Error("Capability settings unavailable");
+		})(),
+): void {
+	const providers = new Set(activeSettings.get("disabledProviders"));
+	providers.delete(providerId);
+	persistDisabledProviders(activeSettings, providers);
 }
 
-/**
- * Check if a provider is enabled.
- */
-export function isProviderEnabled(providerId: string): boolean {
-	return !disabledProviders.has(providerId);
+/** Check whether a provider is enabled by the supplied session settings. */
+export function isProviderEnabled(
+	providerId: string,
+	activeSettings: Settings | undefined = settings ?? undefined,
+): boolean {
+	return !new Set(activeSettings?.get("disabledProviders") ?? disabledProviders).has(providerId);
 }
 
-/**
- * Get list of all disabled provider IDs.
- */
-export function getDisabledProviders(): string[] {
-	return Array.from(disabledProviders);
+/** Get disabled providers from the supplied session settings. */
+export function getDisabledProviders(activeSettings: Settings | undefined = settings ?? undefined): string[] {
+	return [...(activeSettings?.get("disabledProviders") ?? disabledProviders)];
 }
 
-/**
- * Set disabled providers from a list (replaces current set).
- */
-export function setDisabledProviders(providerIds: string[]): void {
-	disabledProviders.clear();
-	for (const id of providerIds) {
-		disabledProviders.add(id);
-	}
-	persistDisabledProviders();
+/** Replace disabled providers for the supplied session settings. */
+export function setDisabledProviders(
+	providerIds: string[],
+	activeSettings: Settings = settings ??
+		(() => {
+			throw new Error("Capability settings unavailable");
+		})(),
+): void {
+	persistDisabledProviders(activeSettings, new Set(providerIds));
 }
 
 // =============================================================================

package/src/capability/types.ts

@@ -6,6 +6,7 @@
  * and get back a unified array of MCP servers.
  */
 
+import type { Settings } from "../config/settings";
 /**
  * Context passed to every provider loader.
  */
@@ -72,6 +73,8 @@ export interface LoadOptions {
 	includeDisabled?: boolean;
 	/** Explicit disabled extension IDs to apply instead of settings. */
 	disabledExtensions?: string[];
+	/** Session settings whose provider policy applies to this load. */
+	settings?: Settings;
 }
 
 /**

package/src/cli/args.ts

@@ -1,11 +1,10 @@
 /**
- * CLI argument parsing and help display
+ * CLI argument parsing
  */
 import * as path from "node:path";
 import { type Effort, THINKING_EFFORTS } from "@gajae-code/ai";
-import { APP_NAME, CONFIG_DIR_NAME, logger } from "@gajae-code/utils";
+import { logger } from "@gajae-code/utils";
 import { CliParseError } from "@gajae-code/utils/cli";
-import chalk from "chalk";
 import { parseEffort } from "../thinking";
 import { BUILTIN_TOOLS } from "../tools";
 
@@ -253,92 +252,3 @@ export function parseArgs(args: string[]): Args {
 
 	return result;
 }
-
-export function getExtraHelpText(): string {
-	return `${chalk.bold("Environment Variables:")}
-  ${chalk.dim("# Core Providers")}
-  ANTHROPIC_API_KEY          - Anthropic Claude models
-  ANTHROPIC_OAUTH_TOKEN      - Anthropic OAuth (takes precedence over API key)
-  CLAUDE_CODE_USE_FOUNDRY    - Enable Anthropic Foundry mode (uses Foundry endpoint + mTLS)
-  FOUNDRY_BASE_URL           - Anthropic Foundry base URL (e.g., https://<foundry-host>)
-  ANTHROPIC_FOUNDRY_API_KEY  - Anthropic token used as Authorization: Bearer <token> in Foundry mode
-  ANTHROPIC_CUSTOM_HEADERS   - Extra Foundry headers (e.g., "user-id: USERNAME")
-  CLAUDE_CODE_CLIENT_CERT    - Client certificate (PEM path or inline PEM) for mTLS
-  CLAUDE_CODE_CLIENT_KEY     - Client private key (PEM path or inline PEM) for mTLS
-  NODE_EXTRA_CA_CERTS        - CA bundle path (or inline PEM) for server certificate validation
-  OPENAI_API_KEY             - OpenAI GPT models
-  GEMINI_API_KEY             - Google Gemini models
-  GITHUB_TOKEN               - GitHub Copilot (or GH_TOKEN, COPILOT_GITHUB_TOKEN)
-
-  ${chalk.dim("# Additional LLM Providers")}
-  AZURE_OPENAI_API_KEY       - Azure OpenAI models
-  GROQ_API_KEY               - Groq models
-  CEREBRAS_API_KEY           - Cerebras models
-  XAI_API_KEY                - xAI Grok models
-  OPENROUTER_API_KEY         - OpenRouter aggregated models
-  KILO_API_KEY               - Kilo Gateway models
-  MISTRAL_API_KEY            - Mistral models
-  ZAI_API_KEY                - z.ai models (ZhipuAI/GLM)
-  MINIMAX_API_KEY            - MiniMax models
-  OPENCODE_API_KEY           - OpenCode Zen/OpenCode Go models
-  CURSOR_ACCESS_TOKEN        - Cursor AI models
-  AI_GATEWAY_API_KEY         - Vercel AI Gateway
-
-  ${chalk.dim("# Cloud Providers")}
-  AWS_PROFILE                - AWS Bedrock (or AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY)
-  GOOGLE_CLOUD_PROJECT       - Google Vertex AI (requires GOOGLE_CLOUD_LOCATION)
-  GOOGLE_APPLICATION_CREDENTIALS - Service account for Vertex AI
-
-  ${chalk.dim("# Search & Tools")}
-  EXA_API_KEY                - Exa web search
-  BRAVE_API_KEY              - Brave web search
-  PERPLEXITY_API_KEY         - Perplexity web search (API)
-  PERPLEXITY_COOKIES         - Perplexity web search (session cookie)
-  TAVILY_API_KEY             - Tavily web search
-  ANTHROPIC_SEARCH_API_KEY   - Anthropic search provider
-
-  ${chalk.dim("# Configuration")}
-  GJC_CODING_AGENT_DIR       - Session storage directory (default: ~/${CONFIG_DIR_NAME}/agent)
-  GJC_PACKAGE_DIR            - Override package directory (for Nix/Guix store paths)
-  GJC_SMOL_MODEL              - Override smol/fast model (see --smol)
-  GJC_SLOW_MODEL              - Override slow/reasoning model (see --slow)
-  GJC_PLAN_MODEL              - Override planning model (see --plan)
-  GJC_NO_PTY                  - Disable PTY-based interactive bash execution
-  --tmux                       - Launch interactive startup inside a fresh tmux session
-  gjc session                  - List, inspect, create, remove, or attach tagged GJC-managed tmux sessions
-  GJC_LAUNCH_POLICY           - Launch policy for --tmux startup: tmux or direct
-  GJC_TMUX_SESSION            - Explicit tmux session name override for --tmux startup
-  GJC_TMUX_PROFILE            - Apply GJC tmux scroll/mouse/clipboard profile to --tmux sessions (set 0/off to skip)
-  GJC_MOUSE                   - Mouse-wheel scroll in --tmux sessions (set 0/off to let the host terminal scroll)
-
-  For complete environment variable reference, see:
-  ${chalk.dim("docs/environment-variables.md")}
-${chalk.bold("Available Tools (default-enabled unless noted):")}
-  read          - Read file contents
-  bash          - Execute bash commands
-  edit          - Edit files with find/replace
-  write         - Write files (creates/overwrites)
-  grep          - Search file contents
-  find          - Find files by glob pattern
-  lsp           - Language server protocol (code intelligence)
-  python        - Execute Python code (requires: ${APP_NAME} setup python)
-  notebook      - Edit Jupyter notebooks
-  browser       - Browser automation (Puppeteer)
-  task          - Launch sub-agents for parallel tasks
-  todo_write    - Manage todo/task lists
-  web_search    - Search the web
-  ask           - Ask user questions (interactive mode only)
-
-${chalk.bold("Useful Commands:")}
-  ${APP_NAME} --list-models        - List configured provider models
-  ${APP_NAME} --help               - Show this help`;
-}
-
-export function printHelp(): void {
-	process.stdout.write(
-		`${chalk.bold(APP_NAME)} - red-claw AI coding assistant\n\n` +
-			`Run ${APP_NAME} --help for full command and option details.\n` +
-			`Run ${APP_NAME} <command> --help for command-specific help.\n\n` +
-			`${getExtraHelpText()}\n`,
-	);
-}

package/src/cli/notify-cli.ts

@@ -7,7 +7,6 @@ import { createInterface } from "node:readline/promises";
 import { APP_NAME } from "@gajae-code/utils/dirs";
 import chalk from "chalk";
 import { Settings, type SettingsAtomicPatch } from "../config/settings";
-import { isProcessIncarnation, processIncarnation } from "../sdk/broker/process-incarnation";
 import { type EnsureChatDaemonResult, ensureDiscordDaemon, ensureSlackDaemon } from "../sdk/bus/chat-daemon-control";
 import { getNotificationConfig, maskToken, tokenFingerprint } from "../sdk/bus/config";
 import {
@@ -33,7 +32,7 @@ import {
 import {
 	type EnsureTelegramDaemonDetailedResult,
 	ensureTelegramDaemonRunningDetailed,
-	readDaemonState,
+	resolveTelegramSetupPreflight,
 } from "../sdk/bus/telegram-daemon";
 import { runDaemonInternal } from "../sdk/bus/telegram-daemon-cli";
 import {
@@ -458,42 +457,10 @@ function proposedIdentityFromSetupPreflight(
 
 async function resolveSetupPreflight(settings: Settings, deps: NotifyCommandDeps): Promise<TelegramSetupPreflight> {
 	if (deps.setupPreflight) return deps.setupPreflight;
-	const cfg = getNotificationConfig(settings);
-	try {
-		const state = await readDaemonState(settings);
-		if (!state) return { storedChatId: cfg.chatId };
-		const validPid = Number.isSafeInteger(state.pid) && state.pid > 0;
-		if (!validPid || !(deps.setupPidAlive ?? daemonPidAlive)(state.pid)) return { storedChatId: cfg.chatId };
-		const persistedIncarnation = state.incarnation;
-		const currentIncarnation = (deps.setupPidIncarnation ?? processIncarnation)(state.pid);
-		if (
-			!isProcessIncarnation(persistedIncarnation) ||
-			!isProcessIncarnation(currentIncarnation) ||
-			persistedIncarnation !== currentIncarnation
-		)
-			return { storedChatId: cfg.chatId };
-		return {
-			storedChatId: cfg.chatId,
-			daemon: {
-				live: true,
-				tokenFingerprint: typeof state.tokenFingerprint === "string" ? state.tokenFingerprint : undefined,
-				chatId: typeof state.chatId === "string" ? state.chatId : undefined,
-			},
-		};
-	} catch {
-		// A state read failure is not proof of a live daemon; proceed normally. The
-		// daemon's own 409 handling remains the backstop against poller contention.
-		return { storedChatId: cfg.chatId };
-	}
-}
-
-function daemonPidAlive(pid: number): boolean {
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch (error) {
-		return (error as NodeJS.ErrnoException).code === "EPERM";
-	}
+	return await resolveTelegramSetupPreflight(settings, {
+		pidAlive: deps.setupPidAlive,
+		pidIncarnation: deps.setupPidIncarnation,
+	});
 }
 
 type TokenPromptInput = NodeJS.ReadStream & {

package/src/cli/setup-cli.ts

@@ -18,7 +18,11 @@ import {
 } from "../hooks/codex-native-hooks-config";
 import { theme } from "../modes/theme/theme";
 import { formatCredentialAutoImportResult, runExternalCredentialAutoImport } from "../setup/credential-auto-import";
-import { filterAutoImportOAuthCredentials, formatDiscoverySummary } from "../setup/credential-import";
+import {
+	formatDiscoverySummary,
+	getAutoImportOAuthCredentialSkips,
+	isAutoImportOAuthCredential,
+} from "../setup/credential-import";
 import {
 	formatHermesSetupResult,
 	type HermesSetupFlags,
@@ -596,8 +600,10 @@ export async function handleCredentialsSetup(
 			trigger: "setup-cli",
 		});
 		const result = preview.discovery ?? { importable: [], skipped: [], environment: [] };
-		const candidates = filterAutoImportOAuthCredentials(result.importable);
-		const filteredResult = { ...result, importable: candidates };
+		const now = Date.now();
+		const candidates = result.importable.filter(credential => isAutoImportOAuthCredential(credential, now));
+		const autoImportSkips = getAutoImportOAuthCredentialSkips(result.importable, now);
+		const filteredResult = { ...result, importable: candidates, skipped: [...result.skipped, ...autoImportSkips] };
 		const redactedPlan = {
 			importable: candidates.map(c => ({
 				provider: c.provider,
@@ -607,7 +613,7 @@ export async function handleCredentialsSetup(
 				expiresAt: c.expiresAt,
 				redactedToken: c.redactedToken,
 			})),
-			skipped: result.skipped,
+			skipped: filteredResult.skipped,
 			environment: result.environment,
 			keychainChecked: flags.keychain === true,
 		};