@gajae-code/coding-agent 0.11.8 → 0.11.9

package/src/modes/interactive-mode.ts

@@ -70,6 +70,7 @@ import type { ToolExecutionHandle } from "./components/tool-execution";
 import { StatusLineComponent } from "./components/tool-status-header";
 import { composeToolText } from "./components/tool-transcript-format";
 import {
+	type RecentSession,
 	WelcomeComponent,
 	type WelcomeLogoMode,
 	type LspServerInfo as WelcomeLspServerInfo,
@@ -631,15 +632,9 @@ export class InteractiveMode implements InteractiveModeContext {
 		const modelName = this.session.model?.name ?? "Unknown";
 		const providerName = this.session.model?.provider ?? "Unknown";
 
-		// Get recent sessions
-		const recentSessions = await logger.time("InteractiveMode.init:recentSessions", () =>
-			getRecentSessions(this.sessionManager.getSessionDir()).then(sessions =>
-				sessions.map(s => ({
-					name: s.name,
-					timeAgo: s.timeAgo,
-				})),
-			),
-		);
+		// Session history is display-only. Never hold the editor and keyboard behind
+		// transcript I/O; populate the welcome trail after the interactive surface exists.
+		const recentSessions: RecentSession[] = [];
 
 		const startupQuiet = settings.get("startup.quiet");
 		const welcomeLogoMode = resolveWelcomeLogoMode(settings.get("startup.welcomeBannerMode"));
@@ -763,6 +758,31 @@ export class InteractiveMode implements InteractiveModeContext {
 		if (this.settings.get("tasksPane.defaultVisible")) this.showTasksPane();
 		this.#syncIrcSidebarAvailabilityFromSettings();
 		this.ui.requestRender(true);
+		if (this.#welcomeComponent) {
+			const welcomeComponent = this.#welcomeComponent;
+			const recentSessionsTimer = setTimeout(() => {
+				void logger
+					.time("InteractiveMode.init:recentSessions", () =>
+						getRecentSessions(this.sessionManager.getSessionDir()),
+					)
+					.then(sessions => {
+						if (this.#welcomeComponent !== welcomeComponent) return;
+						welcomeComponent.setRecentSessions(
+							sessions.map(session => ({
+								name: session.name,
+								timeAgo: session.timeAgo,
+							})),
+						);
+						this.ui.requestRender();
+					})
+					.catch(error => {
+						logger.debug("Failed to load recent sessions for welcome screen", {
+							error: error instanceof Error ? error.message : String(error),
+						});
+					});
+			}, 0);
+			recentSessionsTimer.unref?.();
+		}
 
 		// GitHub star reminder (interactive-only). Register the decline-driven
 		// injection contributor and schedule the launch nudge after the first

package/src/prompts/system/system-prompt.md

@@ -24,6 +24,7 @@ Optimize for correctness first, maintainability second, and brevity third. Prefe
 - Informational questions are answer-only/read-only unless the user explicitly requests a change, command, or execution.
 - Vague requirements use `/skill:deep-interview`: a requirements-only workflow that must not mutate product code. Its spec hands off as deep-interview → ralplan consensus → pending approval → separately approved execution.
 - Clear work with non-trivial architecture or sequencing risk uses `/skill:ralplan --deliberate` and stops pending approval.
+- Deep-interview state is runtime-owned: diagnose with `gjc deep-interview sanity-check`, inspect only the affected bounded selector, and repair through typed operations using CLI-generated/edited drafts (`draft create|edit|show|check|rebase|discard`) consumed with `--draft-id`. Inline JSON request flags are compatibility-only; normal flow must never reconstruct a payload or full envelope.
 - Use `/skill:ultragoal` for durable goal ledgers and `/skill:team` for approved coordinated persistent work.
 - Delegate large implementation slices to `executor`; use `planner`, `architect`, or `critic` for bounded planning and review.
 - Active skills are authoritative: never ignore an invoked skill; read the full skill text and follow it exactly.

package/src/runtime-mcp/json-rpc.ts

@@ -4,9 +4,9 @@
  * Lightweight utilities for calling MCP servers directly via HTTP
  * without maintaining persistent connections.
  */
-// biome-ignore assist/source/organizeImports: Keep independent MCP security imports on separate merge anchors.
-import { cancelMCPStream, MCP_HTTP_TIMEOUT_MS, MCP_MAX_CONTENT_BYTES, readMCPResponseText } from "./content-limits";
 import { logger } from "@gajae-code/utils";
+import { cancelMCPStream, MCP_HTTP_TIMEOUT_MS, MCP_MAX_CONTENT_BYTES, readMCPResponseText } from "./content-limits";
+import { redactMCPDiagnosticValue, redactMCPEndpoint } from "./redaction";
 
 /** Parse SSE response format (lines starting with "data: ") */
 export function parseSSE(text: string): unknown {
@@ -82,7 +82,7 @@ export async function callMCP<T = unknown>(
 	if (!response.ok) {
 		cancelMCPStream(response.body);
 		const errorMsg = `MCP request failed: ${response.status} ${response.statusText}`;
-		logger.error(errorMsg, { url, method, params });
+		logger.error(errorMsg, { url: redactMCPEndpoint(url), method, params: redactMCPDiagnosticValue(params) });
 		throw new Error(errorMsg);
 	}
 
@@ -90,7 +90,10 @@ export async function callMCP<T = unknown>(
 	const result = parseSSE(text) as JsonRpcResponse<T> | null;
 
 	if (!result) {
-		logger.error("Failed to parse MCP response", { url, method, responseText: text.slice(0, 500) });
+		logger.error("Failed to parse MCP response", {
+			url: redactMCPEndpoint(url),
+			method,
+		});
 		throw new Error("Failed to parse MCP response");
 	}
 

package/src/runtime-mcp/redaction.ts

@@ -0,0 +1,30 @@
+const REDACTED = "<redacted>";
+const SENSITIVE_KEY_PATTERN = /(?:token|secret|key|credential|password|authorization|auth|bearer|cookie|session)/i;
+
+export function redactMCPEndpoint(value: string | undefined): string | undefined {
+	if (!value) return value;
+	try {
+		const url = new URL(value);
+		if (url.username) url.username = REDACTED;
+		if (url.password) url.password = REDACTED;
+		if (url.pathname !== "/") url.pathname = `/${REDACTED}`;
+		for (const key of Array.from(url.searchParams.keys())) {
+			url.searchParams.set(key, REDACTED);
+		}
+		url.hash = "";
+		return url.toString();
+	} catch {
+		return REDACTED;
+	}
+}
+
+export function redactMCPDiagnosticValue(value: unknown): unknown {
+	if (Array.isArray(value)) return value.map(redactMCPDiagnosticValue);
+	if (!value || typeof value !== "object") return value;
+	return Object.fromEntries(
+		Object.entries(value).map(([key, entry]) => [
+			key,
+			SENSITIVE_KEY_PATTERN.test(key) ? REDACTED : redactMCPDiagnosticValue(entry),
+		]),
+	);
+}

package/src/sdk/broker/session-index.ts

@@ -131,6 +131,7 @@ function compactEvents(events: SessionIndexEvent[]): SessionIndexEvent[] {
 
 async function appendSync(file: string, value: string): Promise<void> {
 	const h = await fs.open(file, "a", 0o600);
+	let failure: { error: unknown } | undefined;
 	try {
 		const data = Buffer.from(`${value}\n`);
 		for (let offset = 0; offset < data.length; ) {
@@ -139,9 +140,18 @@ async function appendSync(file: string, value: string): Promise<void> {
 			offset += bytesWritten;
 		}
 		await h.sync();
-	} finally {
+	} catch (error) {
+		failure = { error };
+	}
+	try {
 		await h.close();
+	} catch (error) {
+		// Bun may report EBADF when concurrent child-pipe teardown has already
+		// released a fully written and fsynced append handle. The descriptor is
+		// closed in that case; every other close failure remains fatal.
+		if ((error as NodeJS.ErrnoException).code !== "EBADF" && failure === undefined) failure = { error };
 	}
+	if (failure !== undefined) throw failure.error;
 }
 
 async function syncDirectory(file: string): Promise<void> {

package/src/sdk/bus/chat-daemon-control.ts

@@ -32,11 +32,13 @@ export type ChatDaemonAction = "stop" | "reload";
  * authority declaration contract with bounded frame-delivery acknowledgement.
  * Generation 11 accepts typed retained exact-unlink cleanup authority — a
  * concrete detached quarantine plus a proven-absent canonical lock pathname —
- * when deleting an observed owner-lock lease.
+ * when deleting an observed owner-lock lease. Generation 12 refreshes retained
+ * native path and process authority semantics. Generation 13 rejects special
+ * files before retained native authority opens.
  */
 export const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>> = {
-	discord: 11,
-	slack: 11,
+	discord: 13,
+	slack: 13,
 };
 
 export function chatDaemonGeneration(kind: ChatDaemonKind): number {

package/src/sdk/bus/telegram-daemon-contract.ts

@@ -38,5 +38,7 @@ export const NOTIFICATION_PROTOCOL_VERSION = 3;
  * Generation 25 adds startup dead-root prune + leak-artifact self-heal
  * on TelegramNotificationDaemon.run (#2958). Generation 26 adds bounded reload
  * cooldown and lazy Telegram topic lifecycle safeguards (#2956, #2960, #2984).
+ * Generation 27 refreshes retained native path and process authority semantics.
+ * Generation 28 rejects special files before retained native authority opens.
  */
-export const DAEMON_GENERATION = 26;
+export const DAEMON_GENERATION = 28;

package/src/sdk/bus/telegram-daemon.ts

@@ -3668,6 +3668,12 @@ export class TelegramNotificationDaemon {
 	private readonly botApi: BotApi;
 	private readonly effects = new TelegramEffectSupervisor();
 	private readonly topics = new TopicRegistry();
+	/**
+	 * Telegram may accept createForumTopic while returning an unusable success
+	 * payload. Remember that ambiguity per endpoint so later frames cannot repeat
+	 * the external side effect. Explicit API failures remain retryable.
+	 */
+	readonly #malformedTopicCreateEndpoints = new Map<string, string>();
 	/** Serializes registry snapshots so an older atomic write cannot overwrite newer rename state. */
 	/** Legacy sockets have no durable token, so explicit teardown is their revocation fence. */
 	private readonly droppedSessions = new WeakSet<SessionSocket>();
@@ -5844,6 +5850,9 @@ export class TelegramNotificationDaemon {
 		if (session && sessionId === session.sessionId && this.#logicalSessionId(session) !== sessionId) return undefined;
 		const capturedCreationLease = creationLease ?? (session ? this.#socketLease(session, sessionId) : undefined);
 		if (session?.logicalSessionIdTrusted && !capturedCreationLease) return undefined;
+		const creationEndpointKey = session?.endpointDigest ?? session?.endpointKey ?? "unbound";
+		if (this.#malformedTopicCreateEndpoints.get(sessionId) === creationEndpointKey)
+			throw new Error("createForumTopic: invalid message_thread_id");
 		const existing = this.topics.get(sessionId);
 		if (existing?.authorityState === "delete_pending" || existing?.bindingMalformed) return undefined;
 		if (existing) return existing.topicId;
@@ -5867,10 +5876,17 @@ export class TelegramNotificationDaemon {
 						throw new Error("topic authority was revoked during creation");
 					const res = await this.botApi.call("createForumTopic", { chat_id: this.opts.chatId, name });
 					if (isThreadedModeCapabilityRefusal(res)) throw new ThreadedModeCapabilityRefusal();
-					const tid = (res as { result?: { message_thread_id?: unknown } }).result?.message_thread_id;
-					if (typeof tid !== "number" || !Number.isSafeInteger(tid) || tid <= 0)
+					const response = res as {
+						ok?: unknown;
+						result?: { message_thread_id?: unknown };
+					};
+					const tid = response.result?.message_thread_id;
+					if (typeof tid !== "number" || !Number.isSafeInteger(tid) || tid <= 0) {
+						if (response.ok === true) this.#malformedTopicCreateEndpoints.set(sessionId, creationEndpointKey);
 						throw new Error("createForumTopic: invalid message_thread_id");
+					}
 					acceptedTopicId = String(tid);
+					this.#malformedTopicCreateEndpoints.delete(sessionId);
 					if (capturedCreationLease && !(await this.#awaitCreationLeaseAuthority(capturedCreationLease))) {
 						if (
 							!this.topics.fenceAcceptedCreateForLease(

package/src/session/agent-session.ts

@@ -785,6 +785,22 @@ type RetryErrorClassification =
 
 const BARE_DEFAULT_WATCHDOG_ERROR =
 	/^(?:[A-Za-z][A-Za-z0-9-]*(?: [A-Za-z][A-Za-z0-9-]*){0,3} )stream (?:timed out while waiting for the first event|stalled while waiting for the next event)$/;
+const KIMI_CODE_FIRST_EVENT_TIMEOUT_MESSAGES = {
+	"anthropic-messages": new Set([
+		"Provider stream timed out while waiting for the first event",
+		"Anthropic stream timed out while waiting for the first event",
+	]),
+	"openai-completions": new Set([
+		"Provider stream timed out while waiting for the first event",
+		"OpenAI completions stream timed out while waiting for the first event",
+	]),
+} as const;
+
+const ALIBABA_TOKEN_PLAN_PROVIDER = "alibaba-token-plan";
+const ALIBABA_TOKEN_PLAN_FIRST_EVENT_TIMEOUT_MESSAGES = {
+	"openai-responses": "OpenAI responses stream timed out while waiting for the first event",
+	"openai-completions": "OpenAI completions stream timed out while waiting for the first event",
+} as const;
 
 function hasBareDefaultRetryDisqualifyingFacts(message: AssistantMessage): boolean {
 	if (message.errorKind !== undefined || message.errorStatus !== undefined) return true;
@@ -12432,6 +12448,7 @@ export class AgentSession {
 							}
 							const retryAfterMs = this.#parseRetryAfterMsFromError(message);
 							const shouldRetry =
+								!this.#isTerminalProviderCompactionTimeout(candidate, message) &&
 								retrySettings.enabled &&
 								attempt < retrySettings.maxRetries &&
 								(retryAfterMs !== undefined ||
@@ -12617,7 +12634,61 @@ export class AgentSession {
 	 * unknown/no-code errors are retryable.
 	 */
 
+	#isKimiCodeFirstEventTimeout(message: AssistantMessage): boolean {
+		if (message.stopReason !== "error" || message.provider !== "kimi-code") return false;
+		const errorMessage = message.errorMessage ?? "";
+		if (message.api === "anthropic-messages") {
+			return KIMI_CODE_FIRST_EVENT_TIMEOUT_MESSAGES["anthropic-messages"].has(errorMessage);
+		}
+		if (message.api === "openai-completions") {
+			return KIMI_CODE_FIRST_EVENT_TIMEOUT_MESSAGES["openai-completions"].has(errorMessage);
+		}
+		return false;
+	}
+
+	#isKimiCodeCompactionTimeout(candidate: Model, errorMessage: string): boolean {
+		if (candidate.provider !== "kimi-code") return false;
+		return /^(?:Summarization failed|Turn prefix summarization failed): (?:Provider|Anthropic|OpenAI completions) stream timed out while waiting for the first event$/.test(
+			errorMessage,
+		);
+	}
+
+	#alibabaTokenPlanCanonicalTimeoutForApi(api: string): string | undefined {
+		if (api === "openai-responses" || api === "openai-completions") {
+			return ALIBABA_TOKEN_PLAN_FIRST_EVENT_TIMEOUT_MESSAGES[api];
+		}
+		return undefined;
+	}
+
+	#isAlibabaTokenPlanFirstEventTimeout(message: AssistantMessage): boolean {
+		if (message.stopReason !== "error" || message.provider !== ALIBABA_TOKEN_PLAN_PROVIDER) return false;
+		const canonicalMessage = this.#alibabaTokenPlanCanonicalTimeoutForApi(message.api);
+		return canonicalMessage !== undefined && message.errorMessage === canonicalMessage;
+	}
+
+	#isAlibabaTokenPlanCompactionTimeout(candidate: Model, errorMessage: string): boolean {
+		if (candidate.provider !== ALIBABA_TOKEN_PLAN_PROVIDER) return false;
+		const canonicalMessage = this.#alibabaTokenPlanCanonicalTimeoutForApi(candidate.api);
+		if (canonicalMessage === undefined) return false;
+		return (
+			errorMessage === `Summarization failed: ${canonicalMessage}` ||
+			errorMessage === `Turn prefix summarization failed: ${canonicalMessage}`
+		);
+	}
+
+	#isTerminalProviderFirstEventTimeout(message: AssistantMessage): boolean {
+		return this.#isKimiCodeFirstEventTimeout(message) || this.#isAlibabaTokenPlanFirstEventTimeout(message);
+	}
+
+	#isTerminalProviderCompactionTimeout(candidate: Model, errorMessage: string): boolean {
+		return (
+			this.#isKimiCodeCompactionTimeout(candidate, errorMessage) ||
+			this.#isAlibabaTokenPlanCompactionTimeout(candidate, errorMessage)
+		);
+	}
+
 	#isRetryableError(message: AssistantMessage): boolean {
+		if (this.#isTerminalProviderFirstEventTimeout(message)) return false;
 		if (message.errorMessage?.startsWith("Model fallback chain exhausted;")) return false;
 		const transportFailure = message.transportFailure;
 		const contextWindow = this.model?.contextWindow ?? 0;
@@ -12767,6 +12838,9 @@ export class AgentSession {
 		if (isTerminalHttp4xx && (explicitStatus !== undefined || !/rate.?limit|too many requests/i.test(err))) {
 			return "terminal";
 		}
+		if (this.#isTerminalProviderFirstEventTimeout(message)) {
+			return "terminal";
+		}
 		// A first-event timeout on ollama-cloud (the ollama-chat API) must not
 		// join the unbounded transient class: each continuation retry re-issues
 		// the full request to a remote, billable backend, so an unbounded loop
@@ -12949,6 +13023,18 @@ export class AgentSession {
 				},
 			};
 		}
+		if (this.#isTerminalProviderFirstEventTimeout(outcome.failure.message)) {
+			// The managed transport discarded this attempt before session policy saw it.
+			// Remove its provisional controller charge and surface the original message.
+			this.#defaultFallbackChain().discardStartedAttempt();
+			return {
+				type: "terminal",
+				terminal: {
+					stopReason: "error",
+					messages: [outcome.failure.message],
+				},
+			};
+		}
 		return this.#handleRetryableError(
 			outcome.failure.message,
 			true,