@gajae-code/coding-agent 0.12.21 → 0.13.0

package/src/tools/image-gen.ts

@@ -24,6 +24,8 @@ import {
 import * as z from "zod/v4";
 import packageJson from "../../package.json" with { type: "json" };
 import { isAuthenticated, type ModelRegistry } from "../config/model-registry";
+import { resolveModelRoleValue } from "../config/model-resolver";
+import type { Settings } from "../config/settings";
 import type { CustomTool } from "../extensibility/custom-tools/types";
 import imageGenDescription from "../prompts/tools/image-gen.md" with { type: "text" };
 import { isPrivateOrSpecialAddress, validatePublicHttpUrl } from "../web/insane/url-guard";
@@ -46,7 +48,7 @@ const ALIBABA_IMAGE_GENERATION_URL = `${ALIBABA_TOKEN_PLAN_HOST}/api/v1/services
 const IMAGE_SYSTEM_INSTRUCTION =
 	"You are an AI image generator. Generate images based on user descriptions. Focus on creating high-quality, visually appealing images that match the user's request.";
 
-type ImageProvider = "alibaba" | "antigravity" | "gemini" | "openai" | "openai-codex" | "openrouter";
+type ImageProvider = "alibaba" | "antigravity" | "gemini" | "openai" | "openai-codex" | "openrouter" | (string & {});
 interface ImageApiKey {
 	provider: ImageProvider;
 	apiKey: string;
@@ -651,15 +653,7 @@ function extractOpenRouterImageUrls(message: OpenRouterMessage | undefined): str
 	return urls;
 }
 
-/** Preferred provider set via settings (default: auto) */
-let preferredImageProvider: ImageProvider | "auto" = "auto";
-
-/** Set the preferred image provider from settings */
-export function setPreferredImageProvider(provider: ImageProvider | "auto"): void {
-	preferredImageProvider = provider;
-}
-
-/** Provider → default image model mapping for auto-binding */
+/** Provider → default image model mapping for fallbacks */
 export const IMAGE_PROVIDER_DEFAULTS: Record<string, string> = {
 	openai: "gpt-image-2",
 	alibaba: "wan2.7-image",
@@ -669,32 +663,26 @@ export const IMAGE_PROVIDER_DEFAULTS: Record<string, string> = {
 	openrouter: "google/gemini-3-pro-image-preview",
 };
 
-/** Resolved image generation configuration from settings */
-export interface ImageProviderConfig {
-	provider: ImageProvider | "auto" | "custom";
-	model: string | null;
-	customUrl?: string;
-	customKey?: string;
-	customKeyEnv?: string;
-}
-
-/** Module-level configured image model state (set from settings at session init) */
-let configuredImageConfig: ImageProviderConfig | null = null;
-
-/** Set the configured image provider + model from settings */
-export function setConfiguredImageModel(config: ImageProviderConfig | null): void {
-	configuredImageConfig = config;
-	// Keep preferredImageProvider in sync for backward compat
-	if (config && config.provider !== "auto" && config.provider !== "custom") {
-		preferredImageProvider = config.provider;
-	} else if (!config || config.provider === "auto") {
-		preferredImageProvider = "auto";
-	}
-}
-
-/** Get the current configured image model (for UI display) */
-export function getConfiguredImageModel(): ImageProviderConfig | null {
-	return configuredImageConfig;
+/**
+ * Resolve the image-generation model from the `modelRoles.image` settings entry.
+ * Returns the resolved Model (with provider identity) or undefined when no
+ * image role is configured / no matching model is available.
+ */
+export function resolveImageRoleModel(
+	settings: Settings,
+	modelRegistry: ModelRegistry,
+	options?: { sessionId?: string; credentialSessionId?: string },
+): Model | undefined {
+	const roleValue = settings.getModelRole("image");
+	if (!roleValue) return undefined;
+	const availableModels = modelRegistry.getAvailable();
+	const resolved = resolveModelRoleValue(roleValue, availableModels, {
+		settings,
+		modelRegistry,
+		sessionId: options?.sessionId,
+		credentialSessionId: options?.credentialSessionId,
+	});
+	return resolved.model;
 }
 
 /** Resolve the effective image model for a configured provider */
@@ -724,22 +712,6 @@ function parseAntigravityCredentials(raw: string): ParsedAntigravityCredentials
 	return rawToken.length > 0 ? { accessToken: rawToken } : null;
 }
 
-function createCustomImageModel(baseUrl: string, id: string): Model<"openai-responses"> {
-	return {
-		id,
-		name: id,
-		api: "openai-responses",
-		provider: "openai",
-		baseUrl: baseUrl.replace(/\/+$/, ""),
-		reasoning: false,
-		input: ["text"],
-		output: ["text", "image"],
-		cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-		contextWindow: 128_000,
-		maxTokens: 16_384,
-	};
-}
-
 async function findAntigravityCredentials(
 	modelRegistry: ModelRegistry,
 	sessionId?: string,
@@ -766,22 +738,6 @@ async function findAntigravityCredentials(
 	};
 }
 
-async function findOpenAIHostedImageCredentials(
-	modelRegistry: ModelRegistry | undefined,
-	activeModel: Model | undefined,
-	sessionId?: string,
-): Promise<ImageApiKey | null> {
-	if (!modelRegistry || !isOpenAIHostedImageModel(activeModel)) return null;
-	const apiKey = await modelRegistry.getApiKey(activeModel, sessionId);
-	if (!isAuthenticated(apiKey)) return null;
-	return {
-		provider: getOpenAIHostedImageProvider(activeModel),
-		apiKey,
-		model: activeModel,
-		authCredentialType: modelRegistry.getSessionCredentialType?.(activeModel.provider, sessionId),
-	};
-}
-
 async function findAlibabaImageCredentials(
 	modelRegistry: ModelRegistry | undefined,
 	sessionId?: string,
@@ -811,93 +767,77 @@ export function googleImageApiKeyFromEnvForTest(): string | undefined {
 	return googleImageApiKeyFromEnv();
 }
 
+/**
+ * Resolve image API credentials from the `modelRoles.image` model.
+ *
+ * The resolved model's provider identity determines which credential path
+ * is used. Returns null when no image role model is configured or the
+ * corresponding credentials are unavailable.
+ */
 async function findImageApiKey(
-	modelRegistry?: ModelRegistry,
-	activeModel?: Model,
+	modelRegistry: ModelRegistry,
+	settings: Settings,
 	sessionId?: string,
+	credentialSessionId?: string,
 ): Promise<ImageApiKey | null> {
-	// Config-driven routing: if an explicit provider+model is configured, use it.
-	if (configuredImageConfig && configuredImageConfig.provider !== "auto") {
-		const config = configuredImageConfig;
-		if (config.provider === "custom") {
-			const baseUrl = config.customUrl?.trim();
-			const apiKey = config.customKey ?? (config.customKeyEnv ? Bun.env[config.customKeyEnv] : undefined);
-			if (baseUrl && apiKey) {
-				return {
-					provider: "openai",
-					apiKey,
-					model: createCustomImageModel(baseUrl, config.model ?? IMAGE_PROVIDER_DEFAULTS.openai),
-				};
-			}
-			return null;
-		}
-		// For configured providers, resolve credentials through the existing paths.
-		if (config.provider === "openai" || config.provider === "openai-codex") {
-			const openAI = await findOpenAIHostedImageCredentials(modelRegistry, activeModel, sessionId);
-			if (openAI) return openAI;
-			return null;
-		}
-		if (config.provider === "antigravity") {
-			if (!modelRegistry) return null;
-			return await findAntigravityCredentials(modelRegistry, sessionId);
-		}
-		if (config.provider === "gemini") {
-			const geminiKey = getEnvApiKey("google");
-			if (geminiKey) return { provider: "gemini", apiKey: geminiKey };
-			const googleKey = googleImageApiKeyFromEnv();
-			return googleKey ? { provider: "gemini", apiKey: googleKey } : null;
-		}
-		if (config.provider === "openrouter") {
-			const openRouterKey = getEnvApiKey("openrouter");
-			return openRouterKey ? { provider: "openrouter", apiKey: openRouterKey } : null;
-		}
-		if (config.provider === "alibaba") {
-			return await findAlibabaImageCredentials(modelRegistry, sessionId);
-		}
+	const imageModel = resolveImageRoleModel(settings, modelRegistry, { sessionId, credentialSessionId });
+	if (!imageModel) return null;
+	return resolveCredentialsForImageModel(imageModel, modelRegistry, sessionId);
+}
+
+/**
+ * Map a resolved image model to its provider credentials. Each provider
+ * branch mirrors the original credential-resolution path.
+ */
+async function resolveCredentialsForImageModel(
+	model: Model,
+	modelRegistry: ModelRegistry,
+	sessionId?: string,
+): Promise<ImageApiKey | null> {
+	const provider: string = model.provider;
+
+	// OpenAI-hosted image generation (gpt-image via Responses API, including
+	// OpenAI-compatible proxies whose models declare output:image).
+	if (isOpenAIHostedImageModel(model)) {
+		const apiKey = await modelRegistry.getApiKey(model, sessionId);
+		if (!isAuthenticated(apiKey)) return null;
+		return {
+			provider: getOpenAIHostedImageProvider(model),
+			apiKey,
+			model,
+			authCredentialType: modelRegistry.getSessionCredentialType?.(model.provider, sessionId),
+		};
 	}
 
-	// If a specific provider is preferred (legacy path), try it first.
-	if (preferredImageProvider === "openai") {
-		const openAI = await findOpenAIHostedImageCredentials(modelRegistry, activeModel, sessionId);
-		if (openAI) return openAI;
-		// Fall through to auto-detect if preferred provider key not found.
-	} else if (preferredImageProvider === "antigravity") {
-		if (!modelRegistry) return null;
+	if (provider === "antigravity" || provider === "google-antigravity") {
 		return await findAntigravityCredentials(modelRegistry, sessionId);
-	} else if (preferredImageProvider === "gemini") {
-		const geminiKey = getEnvApiKey("google");
-		if (geminiKey) return { provider: "gemini", apiKey: geminiKey };
-		const googleKey = googleImageApiKeyFromEnv();
-		return googleKey ? { provider: "gemini", apiKey: googleKey } : null;
-	} else if (preferredImageProvider === "openrouter") {
-		const openRouterKey = getEnvApiKey("openrouter");
-		return openRouterKey ? { provider: "openrouter", apiKey: openRouterKey } : null;
-	} else if (preferredImageProvider === "alibaba") {
+	}
+	if (provider === "alibaba" || provider === "alibaba-token-plan") {
 		return await findAlibabaImageCredentials(modelRegistry, sessionId);
 	}
-
-	// Auto-detect: GPT hosted image generation, then Antigravity, OpenRouter, Gemini, Alibaba.
-	const openAI = await findOpenAIHostedImageCredentials(modelRegistry, activeModel, sessionId);
-	if (openAI) return openAI;
-
-	if (modelRegistry) {
-		const antigravity = await findAntigravityCredentials(modelRegistry, sessionId);
-		if (antigravity) return antigravity;
+	if (provider === "openrouter") {
+		const openRouterKey = await modelRegistry.getApiKey(model, sessionId);
+		if (isAuthenticated(openRouterKey)) return { provider: "openrouter", apiKey: openRouterKey };
+		const envKey = getEnvApiKey("openrouter");
+		return envKey ? { provider: "openrouter", apiKey: envKey } : null;
+	}
+	if (provider === "gemini" || provider === "google") {
+		const googleKey = await modelRegistry.getApiKey(model, sessionId);
+		if (isAuthenticated(googleKey)) return { provider: "gemini", apiKey: googleKey };
+		const envKey = getEnvApiKey("google");
+		if (envKey) return { provider: "gemini", apiKey: envKey };
+		const fallbackKey = googleImageApiKeyFromEnv();
+		return fallbackKey ? { provider: "gemini", apiKey: fallbackKey } : null;
 	}
 
-	const openRouterKey = getEnvApiKey("openrouter");
-	if (openRouterKey) return { provider: "openrouter", apiKey: openRouterKey };
-
-	const geminiKey = getEnvApiKey("google");
-	if (geminiKey) return { provider: "gemini", apiKey: geminiKey };
-
-	const googleKey = googleImageApiKeyFromEnv();
-	if (googleKey) return { provider: "gemini", apiKey: googleKey };
-
-	const alibaba = await findAlibabaImageCredentials(modelRegistry, sessionId);
-	if (alibaba) return alibaba;
-
-	return null;
+	// Fallback: try the model's own API key via the registry.
+	const apiKey = await modelRegistry.getApiKey(model, sessionId);
+	if (!isAuthenticated(apiKey)) return null;
+	return {
+		provider: provider as ImageProvider,
+		apiKey,
+		model,
+	};
 }
 
 async function loadImageFromPath(imagePath: string, cwd: string): Promise<InlineImageData> {
@@ -1336,27 +1276,29 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 	parameters: imageGenSchema,
 	async execute(_toolCallId, params, _onUpdate, ctx, signal) {
 		return untilAborted(signal, async () => {
-			const sessionId = ctx.sessionManager.getSessionId();
-			const apiKey = await findImageApiKey(ctx.modelRegistry, ctx.model, sessionId);
+			const sessionId = ctx.credentialSessionId ?? ctx.sessionManager.getSessionId();
+			const settings = ctx.settings;
+			if (!settings) {
+				throw new Error("Image generation requires session settings to resolve the image model role.");
+			}
+			const apiKey = await findImageApiKey(ctx.modelRegistry, settings, sessionId, ctx.credentialSessionId);
 			if (!apiKey) {
 				throw new Error(
-					"No image API credentials found. Use a GPT Responses/Codex model with OpenAI credentials, login with google-antigravity, or set OPENROUTER_API_KEY, GEMINI_API_KEY, GOOGLE_API_KEY, or ALIBABA_TOKEN_PLAN_API_KEY.",
+					"No image model configured. Set an image-capable model via /model (image role) to enable image generation.",
 				);
 			}
 
 			const provider = apiKey.provider;
-			const model =
-				configuredImageConfig && configuredImageConfig.provider !== "auto" && configuredImageConfig.model
-					? configuredImageConfig.model
-					: provider === "openai" || provider === "openai-codex"
-						? (apiKey.model?.id ?? resolveImageModel(provider, null))
-						: provider === "antigravity"
-							? resolveImageModel("antigravity", null)
-							: provider === "alibaba"
-								? resolveImageModel("alibaba", null)
-								: provider === "openrouter"
-									? resolveImageModel("openrouter", null)
-									: resolveImageModel("gemini", null);
+			const imageModel = apiKey.model;
+			const model = imageModel
+				? imageModel.id
+				: provider === "antigravity"
+					? resolveImageModel("antigravity", null)
+					: provider === "alibaba"
+						? resolveImageModel("alibaba", null)
+						: provider === "openrouter"
+							? resolveImageModel("openrouter", null)
+							: resolveImageModel("gemini", null);
 			const resolvedModel = provider === "openrouter" ? resolveOpenRouterModel(model) : model;
 			const cwd = ctx.sessionManager.getCwd();
 
@@ -1743,18 +1685,20 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 
 export async function getImageGenTools(
 	modelRegistry?: ModelRegistry,
-	activeModel?: Model,
+	settings?: Settings,
 ): Promise<Array<CustomTool<typeof imageGenSchema, ImageGenToolDetails>>> {
-	const apiKey = await findImageApiKey(modelRegistry, activeModel);
-	if (!apiKey) return [];
+	// The tool is available when an image role model is configured and resolvable.
+	if (!modelRegistry || !settings) return [];
+	const imageModel = resolveImageRoleModel(settings, modelRegistry);
+	if (!imageModel) return [];
 	return [imageGenTool];
 }
 
 export async function getImageGenToolsWithRegistry(
 	modelRegistry: ModelRegistry,
-	activeModel?: Model,
+	settings: Settings,
 ): Promise<Array<CustomTool<typeof imageGenSchema, ImageGenToolDetails>>> {
-	const apiKey = await findImageApiKey(modelRegistry, activeModel);
-	if (!apiKey) return [];
+	const imageModel = resolveImageRoleModel(settings, modelRegistry);
+	if (!imageModel) return [];
 	return [imageGenTool];
 }

package/src/tools/index.ts

@@ -219,6 +219,8 @@ export interface ToolSession {
 	requestForegroundBashBackground?: () => boolean;
 	/** Get session ID */
 	getSessionId?: () => string | null;
+	/** Get credential-selection session identity. */
+	getCredentialSessionId?: () => string | null;
 	/** Scope-held MCP facade for mcp:// resolution. */
 	getMcpManager?: () => import("../runtime-mcp/manager").MCPManager | undefined;
 	/** Whether local:// must use external managed scratch instead of artifacts/local. */

package/src/tools/read.ts

@@ -2409,7 +2409,7 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 			if (countTextLines(code) > MAX_SUMMARY_LINES) return null;
 
 			const summarizeCode = (await nativeRead()).summarizeCode;
-			return summarizeCode({
+			return await summarizeCode({
 				code,
 				path: absolutePath,
 				minBodyLines: this.session.settings.get("read.summarize.minBodyLines"),

package/src/tools/resource-gc.ts

@@ -101,12 +101,17 @@ export interface ResourceGcDeps {
 	) => Promise<void>;
 }
 
+/** Request collection without synchronously stopping the main event loop. */
+export function requestMemoryPressureGc(): void {
+	Bun.gc(false);
+}
+
 const defaultDeps: ResourceGcDeps = {
 	now: () => Date.now(),
 	monotonicNow: () => performance.now(),
 	rssBytes: () => process.memoryUsage().rss,
 	memorySnapshot: () => sampleMemoryPressure(),
-	runGc: () => Bun.gc(true),
+	runGc: requestMemoryPressureGc,
 	logWarn: (msg, meta) => logger.warn(msg, meta),
 	listTabs: () => listTabsForGc(),
 	releaseTab: (name, policy) => releaseTabIfGcEligible(name, policy),

package/src/tools/tool-catalog.generated.ts

@@ -1073,7 +1073,7 @@ export const TOOL_CATALOG: Readonly<Record<string, ToolCatalogEntry>> = {
 	"browser": {
 		"name": "browser",
 		"label": "Browser",
-		"description": "Drives a real Chromium tab with full puppeteer access via JS execution.\n\n<instruction>\n- For static web content (articles, docs, issues/PRs, JSON, PDFs, feeds), prefer the `read` tool with a URL. Use this tool only when you need JS execution, authentication, or interactive actions.\n- Four actions:\n  - `open` — acquire (or reuse) a named tab. `name` defaults to `\"main\"`. Optional `url`, `viewport`, and `dialogs: \"accept\" | \"dismiss\"` (auto-handles `alert`/`confirm`/`beforeunload`). The `app` field selects the browser kind (spawned binary, saved Chrome profile, or existing CDP endpoint); omitted means headless Chromium with stealth patches.\n  - `close` — release a tab by `name`, or every tab with `all: true`. `kill: true` also terminates a spawned-app process tree.\n  - `act` — run a list of structured `actions` against an existing tab without writing JS (preferred for routine navigation/interaction). Each step is `{ verb, … }`; verbs: `navigate {url, wait_until?}`, `click {id|selector}`, `type {id|selector, text}`, `fill {selector, value}`, `select {selector, values}`, `press {key, selector?}`, `scroll {dx?, dy?}`, `back`, `wait {selector?|ms?}`, `observe {viewport_only?, include_all?}`, `extract {format?}`, `screenshot`. Address elements by the numeric `id` from a prior `observe` (preferred) or a selector. Steps run in order; the tool returns per-step results.\n  - `run` — execute JS against an existing tab. `code` is the body of an async function with `page`, `browser`, `tab`, `display`, `assert`, `wait` in scope. The return value is JSON-stringified into the tool result; `display(value)` calls accumulate text/images. Use `run` only when an `act` verb does not cover what you need.\n- Tabs survive across `run` calls and across in-process subagents. Open once, reuse many times.\n- Browser kinds: no `app` launches headless Chromium; `app.path` reuses CDP or kills stale same-path processes before spawning — NEVER use it for a daily Chrome profile; use explicit `app.browser: \"chrome\"` profile mode instead. Saved-profile/CDP automation has access to that profile's cookies and authenticated accounts. Profile mode refuses a matching non-CDP Chrome instead of killing/relaunching it, and `kill: true` can terminate only a Chrome process GJC launched; `app.cdp_url` is externally owned and disconnect-only. CDP must stay on `127.0.0.1`: it grants full browser-account access.\n- Inside `run`, `tab` exposes high-level helpers (`goto`, `observe`, `id`, `click`, `type`, `fill`, `press`, `waitFor`, `screenshot`, `extract`, …); reach for `page` (raw puppeteer Page) when they don't cover it.\n- Selectors accept CSS as well as puppeteer query handlers: `aria/Sign in`, `text/Continue`, `xpath/…`, `pierce/…`.\n- Full reference — helpers, browser kinds, CDP/security details, and more examples — read `gjc://tools/browser.md`.\n</instruction>\n\n<critical>\n- You MUST call `open` before `run` or `act`. Neither implicitly creates a tab.\n- You MUST observe before taking a screenshot to understand page state; screenshot only when visual appearance matters.\n- After a `tab.goto()` or any navigation, prior element ids from `tab.observe()` are invalidated. Re-observe before referencing them.\n- `code` runs with full Node access. Treat it as your code, not sandboxed code.\n</critical>\n\n<examples>\n# Open a tab and read structured page data\n`{\"action\":\"open\",\"name\":\"docs\",\"url\":\"https://example.com\"}`\n`{\"action\":\"act\",\"name\":\"docs\",\"actions\":[{\"verb\":\"observe\"}]}`\n\n# Click an observed element, then fill and submit a form\n`{\"action\":\"act\",\"name\":\"docs\",\"actions\":[{\"verb\":\"click\",\"id\":12},{\"verb\":\"fill\",\"selector\":\"input[name=email]\",\"value\":\"me@example.com\"},{\"verb\":\"click\",\"selector\":\"text/Continue\"}]}`\n\n# Use `run` only when `act` has no suitable verb\n`{\"action\":\"run\",\"name\":\"docs\",\"code\":\"const count = await page.locator('canvas').count(); return { count };\"}`\n</examples>\n\n<output>\n- Per call: any `display(value)` outputs (text/images) followed by the JSON-stringified return value of the `code` function. `run` always produces at least a status line.\n</output>",
+		"description": "Drives a real Chromium tab with full puppeteer access via JS execution.\n\n<instruction>\n- For static web content (articles, docs, issues/PRs, JSON, PDFs, feeds), prefer the `read` tool with a URL. Use this tool only when you need JS execution, authentication, or interactive actions.\n- Four actions:\n  - `open` — acquire (or reuse) a named tab. `name` defaults to `\"main\"`. Optional `url`, `viewport`, and `dialogs: \"accept\" | \"dismiss\"` (auto-handles `alert`/`confirm`/`beforeunload`). The `app` field selects the browser kind (spawned binary, saved Chrome profile, or existing CDP endpoint); omitted means headless Chromium with stealth patches.\n  - `close` — release a tab by `name`, or every tab with `all: true`. `kill: true` also terminates a spawned-app process tree.\n  - `act` — run a list of structured `actions` against an existing tab without writing JS (preferred for routine navigation/interaction). Each step is `{ verb, … }`; verbs: `navigate {url, wait_until?}`, `click {id|selector}`, `type {id|selector, text}`, `fill {selector, value}`, `select {selector, values}`, `press {key, selector?}`, `scroll {dx?, dy?}`, `back`, `wait {selector?|ms?}`, `observe {viewport_only?, include_all?}`, `extract {format?}`, `screenshot`. Address elements by the numeric `id` from a prior `observe` (preferred) or a selector. Steps run in order; the tool returns per-step results.\n  - `run` — execute JS against an existing tab. `code` is the body of an async function with `page`, `browser`, `tab`, `display`, `assert`, `wait` in scope. The return value is JSON-stringified into the tool result; `display(value)` calls accumulate text/images. Use `run` only when an `act` verb does not cover what you need.\n- Tabs survive across `run` calls and across in-process subagents. Open once, reuse many times.\n- Browser kinds: no `app` launches headless Chromium; `app.path` reuses CDP or kills stale same-path processes before spawning — NEVER use it for a daily Chrome profile; use explicit `app.browser: \"chrome\"` profile mode instead. Saved-profile/CDP automation has access to that profile's cookies and authenticated accounts. Profile mode refuses a matching non-CDP Chrome instead of killing/relaunching it, and `kill: true` can terminate only a Chrome process GJC launched; `app.cdp_url` is externally owned and disconnect-only. CDP must stay on `127.0.0.1`: it grants full browser-account access.\n- Inside `run`, `tab` exposes high-level helpers (`goto`, `observe`, `id`, `click`, `type`, `fill`, `press`, `waitFor`, `screenshot`, `extract`, …); reach for `page` (raw puppeteer Page) when they don't cover it.\n- Selectors accept CSS as well as puppeteer query handlers: `aria/Sign in`, `text/Continue`, `xpath/…`, `pierce/…`.\n- Runtime diagnostics are opt-in: pass `diagnostics: true` to `open` to subscribe the tab to page `Runtime.exceptionThrown` and `console.error` events. The next successful `act`/`run` response then includes at most 20 `runtimeDiagnostics` entries plus `runtimeDiagnosticsDropped`, then drains them. Entries contain only kind, time, origin-only URL, line/column, and a built-in error class from a fixed allowlist — never path segments, query strings, messages, console arguments, values, or stacks. Output is byte-bounded and marks truncation explicitly.\n- Full reference — helpers, browser kinds, CDP/security details, and more examples — read `gjc://tools/browser.md`.\n</instruction>\n\n<critical>\n- You MUST call `open` before `run` or `act`. Neither implicitly creates a tab.\n- You MUST observe before taking a screenshot to understand page state; screenshot only when visual appearance matters.\n- After a `tab.goto()` or any navigation, prior element ids from `tab.observe()` are invalidated. Re-observe before referencing them.\n- `code` runs with full Node access. Treat it as your code, not sandboxed code.\n</critical>\n\n<examples>\n# Open a tab and read structured page data\n`{\"action\":\"open\",\"name\":\"docs\",\"url\":\"https://example.com\"}`\n`{\"action\":\"act\",\"name\":\"docs\",\"actions\":[{\"verb\":\"observe\"}]}`\n\n# Click an observed element, then fill and submit a form\n`{\"action\":\"act\",\"name\":\"docs\",\"actions\":[{\"verb\":\"click\",\"id\":12},{\"verb\":\"fill\",\"selector\":\"input[name=email]\",\"value\":\"me@example.com\"},{\"verb\":\"click\",\"selector\":\"text/Continue\"}]}`\n\n# Use `run` only when `act` has no suitable verb\n`{\"action\":\"run\",\"name\":\"docs\",\"code\":\"const count = await page.locator('canvas').count(); return { count };\"}`\n</examples>\n\n<output>\n- Per call: any `display(value)` outputs (text/images) followed by the JSON-stringified return value of the `code` function. `run` always produces at least a status line.\n</output>",
 		"parameters": {
 			"type": "object",
 			"properties": {
@@ -1185,6 +1185,10 @@ export const TOOL_CATALOG: Readonly<Record<string, ToolCatalogEntry>> = {
 					],
 					"description": "auto-handle dialogs"
 				},
+				"diagnostics": {
+					"type": "boolean",
+					"description": "opt-in: capture bounded page runtime diagnostics (page exceptions and console.error metadata) in the next successful run/act response"
+				},
 				"code": {
 					"type": "string",
 					"description": "js body to run in tab"

package/src/utils/pasted-image-path.ts

@@ -316,3 +316,96 @@ export function parsePastedImagePaths(
 export function formatPastedImageReference(placeholder: string, imagePath: string): string {
 	return `${placeholder} source=${JSON.stringify(imagePath)}`;
 }
+export interface PastedImageReferenceRange {
+	imageIndex: number;
+	startCol: number;
+	endCol: number;
+}
+
+function findJsonStringEnd(text: string, startCol: number): number | null {
+	if (text[startCol] !== '"') return null;
+
+	let escaped = false;
+	for (let index = startCol + 1; index < text.length; index += 1) {
+		const character = text[index];
+		if (escaped) {
+			escaped = false;
+			continue;
+		}
+		if (character === "\\") {
+			escaped = true;
+			continue;
+		}
+		if (character !== '"') continue;
+
+		const endCol = index + 1;
+		try {
+			if (typeof JSON.parse(text.slice(startCol, endCol)) !== "string") return null;
+		} catch {
+			return null;
+		}
+		return endCol;
+	}
+	return null;
+}
+
+/**
+ * Collects every validated `source=<JSON string>` value span on the line.
+ *
+ * A placeholder-looking token inside one of these spans is part of a file path,
+ * not a composer placeholder, so deleting it would corrupt the path. Spans are
+ * collected independently of any preceding placeholder because an orphaned
+ * `source="…"` can outlive the placeholder that produced it.
+ */
+function findSourceValueSpans(line: string): Array<{ start: number; end: number }> {
+	const spans: Array<{ start: number; end: number }> = [];
+	const sourcePattern = /source=/g;
+	while (true) {
+		const match = sourcePattern.exec(line);
+		if (!match) return spans;
+		const valueStart = match.index + match[0].length;
+		const valueEnd = findJsonStringEnd(line, valueStart);
+		if (valueEnd === null) continue;
+		spans.push({ start: valueStart, end: valueEnd });
+		sourcePattern.lastIndex = valueEnd;
+	}
+}
+
+export function locatePastedImageReferenceAroundCursor(
+	line: string,
+	cursorCol: number,
+): PastedImageReferenceRange | null {
+	if (!Number.isInteger(cursorCol) || cursorCol < 0 || cursorCol > line.length) return null;
+
+	const sourceValueSpans = findSourceValueSpans(line);
+	const placeholderPattern = /\[image ([1-9]\d*)\]/g;
+	while (true) {
+		const match = placeholderPattern.exec(line);
+		if (!match) return null;
+
+		const startCol = match.index;
+		const placeholder = match[0];
+		const imageIndex = Number.parseInt(match[1] ?? "", 10);
+		if (!Number.isSafeInteger(imageIndex)) continue;
+
+		const enclosingSpan = sourceValueSpans.find(span => startCol >= span.start && startCol < span.end);
+		if (enclosingSpan) {
+			placeholderPattern.lastIndex = enclosingSpan.end;
+			continue;
+		}
+
+		const placeholderEnd = startCol + placeholder.length;
+		const sourcePrefix = " source=";
+		if (line.startsWith(sourcePrefix, placeholderEnd)) {
+			const fullEnd = findJsonStringEnd(line, placeholderEnd + sourcePrefix.length);
+			if (fullEnd === null) return null;
+			if (cursorCol === placeholderEnd || cursorCol === fullEnd) {
+				return { imageIndex, startCol, endCol: fullEnd };
+			}
+			placeholderPattern.lastIndex = fullEnd;
+			continue;
+		}
+
+		if (cursorCol === placeholderEnd) return { imageIndex, startCol, endCol: placeholderEnd };
+	}
+}

package/src/web/search/index.ts

@@ -339,7 +339,7 @@ export class WebSearchTool implements AgentTool<typeof webSearchSchema, SearchRe
 					: undefined;
 				prewarmSearchProviders({
 					authStorage,
-					sessionId: session.getSessionId?.() ?? undefined,
+					sessionId: session.getCredentialSessionId?.() ?? session.getSessionId?.() ?? undefined,
 					activeModelContext,
 				});
 			} catch {
@@ -356,7 +356,7 @@ export class WebSearchTool implements AgentTool<typeof webSearchSchema, SearchRe
 		_context?: AgentToolContext,
 	): Promise<AgentToolResult<SearchRenderDetails>> {
 		const authStorage = this.#session.authStorage ?? (await discoverAuthStorage());
-		const sessionId = this.#session.getSessionId?.() ?? undefined;
+		const sessionId = this.#session.getCredentialSessionId?.() ?? this.#session.getSessionId?.() ?? undefined;
 		const activeModelContext = this.#session.model
 			? this.#session.modelRegistry?.getActiveSearchModelContext(this.#session.model)
 			: undefined;
@@ -379,7 +379,7 @@ export const webSearchCustomTool: CustomTool<typeof webSearchSchema, SearchRende
 		signal?: AbortSignal,
 	) {
 		const authStorage = ctx.modelRegistry?.authStorage ?? (await discoverAuthStorage());
-		const sessionId = ctx.sessionManager.getSessionId();
+		const sessionId = ctx.credentialSessionId ?? ctx.sessionManager.getSessionId();
 		return executeSearch(toolCallId, params, {
 			authStorage,
 			sessionId,