@gajae-code/coding-agent 0.12.7 → 0.12.10

package/src/session/internal/native-publish-outcome.ts

@@ -16,6 +16,8 @@ export type NativePublishOperation = "direct_rename" | "retained_file" | "retain
 
 export type NativePublishPrimitive =
 	| "renameat2_noreplace"
+	| "linkat_noreplace"
+	| "mkdirat_renameat_noreplace"
 	| "renameatx_np_excl"
 	| "windows_rename_noreplace"
 	| "unsupported"
@@ -24,6 +26,7 @@ export type NativePublishPhase =
 	| "preflight"
 	| "file_sync"
 	| "rename"
+	| "source_unlink"
 	| "source_parent_sync"
 	| "destination_parent_sync"
 	| "terminal_identity"
@@ -48,6 +51,7 @@ export type NativePublishIdentity = {
 	readonly dev: string;
 	readonly ino: string;
 	readonly size: string;
+	readonly nlink?: string;
 	readonly mtimeNs: string;
 	readonly ctimeNs: string;
 	readonly sha256?: string;
@@ -82,6 +86,8 @@ const reasons = new Set<NativePublishReason>([
 ]);
 const primitives = new Set<NativePublishPrimitive>([
 	"renameat2_noreplace",
+	"linkat_noreplace",
+	"mkdirat_renameat_noreplace",
 	"renameatx_np_excl",
 	"windows_rename_noreplace",
 	"unsupported",
@@ -91,6 +97,7 @@ const phases = new Set<NativePublishPhase>([
 	"preflight",
 	"file_sync",
 	"rename",
+	"source_unlink",
 	"source_parent_sync",
 	"destination_parent_sync",
 	"terminal_identity",
@@ -126,12 +133,13 @@ const malformed: NativePublishOutcome = Object.freeze({
 
 function validIdentity(value: unknown): boolean {
 	if (value === undefined) return true;
-	if (!ownPlainRecord(value) || !exactKeys(value, ["dev", "ino", "size", "mtimeNs", "ctimeNs", "sha256"]))
+	if (!ownPlainRecord(value) || !exactKeys(value, ["dev", "ino", "nlink", "size", "mtimeNs", "ctimeNs", "sha256"]))
 		return false;
 	const decimal = (field: unknown) => typeof field === "string" && /^-?[0-9]{1,32}$/.test(field);
 	return (
 		decimal(value.dev) &&
 		decimal(value.ino) &&
+		(value.nlink === undefined || decimal(value.nlink)) &&
 		decimal(value.size) &&
 		decimal(value.mtimeNs) &&
 		decimal(value.ctimeNs) &&
@@ -202,7 +210,7 @@ function legalOutcome(outcome: NativePublishOutcome): boolean {
 		((outcome.reason === "durability_not_provable" &&
 			["file_sync", "source_parent_sync", "destination_parent_sync"].includes(outcome.phase)) ||
 			(outcome.reason === "identity_violation" && outcome.phase === "terminal_identity") ||
-			(outcome.reason === "io_failure" && outcome.phase === "terminal_identity"))
+			(outcome.reason === "io_failure" && ["source_unlink", "terminal_identity"].includes(outcome.phase)))
 	);
 }
 
@@ -245,8 +253,12 @@ export function classifyNativePublishOutcome(
 	const outcome = value as unknown as NativePublishOutcome;
 	if (!legalOutcome(outcome)) return malformed;
 	if (operation === "direct_rename") return outcome;
+	const retainedPrimitiveValid =
+		operation === "retained_file"
+			? outcome.primitive === "renameat2_noreplace" || outcome.primitive === "linkat_noreplace"
+			: outcome.primitive === "renameat2_noreplace" || outcome.primitive === "mkdirat_renameat_noreplace";
 	if (
-		outcome.primitive !== "renameat2_noreplace" ||
+		!retainedPrimitiveValid ||
 		(outcome.ok && (!outcome.identity || outcome.durabilityState !== "proven" || outcome.phase !== "complete"))
 	)
 		return malformed;

package/src/session/internal/session-open-errors.ts

@@ -0,0 +1,11 @@
+export const SESSION_MIGRATION_BUSY_MESSAGE =
+	"Another session migration is still active. Wait for it to finish, then retry.";
+
+export class SessionMigrationBusyError extends Error {
+	readonly code = "migration_busy";
+
+	constructor() {
+		super(SESSION_MIGRATION_BUSY_MESSAGE);
+		this.name = "SessionMigrationBusyError";
+	}
+}

package/src/session/session-manager.ts

@@ -83,8 +83,8 @@ import {
 	mayCleanManagedTreeStaging,
 	retainManagedDirectoryAuthority,
 } from "./internal/managed-session-storage";
-
 import { classifyNativePublishOutcome, formatNativePublishDiagnostic } from "./internal/native-publish-outcome";
+import { SessionMigrationBusyError } from "./internal/session-open-errors";
 import {
 	hasOnlyKeys as hasOnlyMemoryGuardKeys,
 	isMemoryGuardDecimalString,
@@ -940,6 +940,8 @@ export class SessionMigrationPolicyError extends Error {
 }
 
 export class SessionArtifactCapacityError extends Error {
+	readonly code = "artifact_capacity_exceeded";
+
 	constructor(message: string) {
 		super(message);
 		this.name = "SessionArtifactCapacityError";
@@ -954,7 +956,12 @@ export interface StrictSessionOpenSuccess {
 
 export interface StrictSessionOpenFailure {
 	kind: "error";
-	reason: ResumeTailError["reason"] | "identity-mismatch" | "migration-required" | "artifact_capacity_exceeded";
+	reason:
+		| ResumeTailError["reason"]
+		| "identity-mismatch"
+		| "migration-required"
+		| "artifact_capacity_exceeded"
+		| "migration_busy";
 	message?: string;
 }
 
@@ -4707,6 +4714,7 @@ export const MATERIALIZED_CACHE_MAX_BYTES = 32 * 1024 * 1024;
 export const SessionManagerTestHooks: {
 	materializedCacheMaxBytesOverride?: number;
 	beforeResidentTransitionIndexBuild?: () => void;
+	afterForkSnapshot?: () => void | Promise<void>;
 } = {};
 
 function materializedCacheMaxBytes(): number {
@@ -6165,6 +6173,7 @@ export class SessionManager {
 				const candidate = listing.owned.find(candidate => path.resolve(candidate.path) === requestedPath);
 				if (!candidate) throw new Error("Managed session deletion requires exact logical authorization.");
 				const deleted = await deleteManagedSessionCandidate(resolved.scope, candidate);
+				if (deleted.kind === "error" && deleted.code === "migration_busy") throw new SessionMigrationBusyError();
 				if (deleted.kind !== "deleted" && deleted.kind !== "already_deleted")
 					throw new Error(`Could not delete managed session: ${deleted.message}`);
 			} else {
@@ -6248,6 +6257,8 @@ export class SessionManager {
 			newHeader,
 			...materializedEntries.filter((entry): entry is SessionEntry => entry.type !== "session"),
 		];
+		const forkSnapshotHook = SessionManagerTestHooks.afterForkSnapshot;
+		if (forkSnapshotHook) await forkSnapshotHook();
 
 		await this.#closePersistWriter();
 		this.#persistChain = Promise.resolve();
@@ -9603,6 +9614,7 @@ export class SessionManager {
 				authority,
 			);
 		} catch (error) {
+			if (error instanceof Error && error.message === "migration_busy") throw new SessionMigrationBusyError();
 			if (error instanceof Error && error.message.startsWith("Managed root authority changed"))
 				managedDestinationStore.assertBound();
 			throw error;
@@ -9611,6 +9623,7 @@ export class SessionManager {
 			managedDestinationStore.assertBound();
 			if (opened.code === "legacy_migration_disabled") throw new SessionMigrationPolicyError();
 			if (opened.code === "artifact_capacity_exceeded") throw new SessionArtifactCapacityError(opened.message);
+			if (opened.code === "migration_busy") throw new SessionMigrationBusyError();
 			throw new Error(`Could not open managed session: ${opened.message}`);
 		}
 		assertManagedDestinationBound();
@@ -9706,7 +9719,15 @@ export class SessionManager {
 			throw new Error(`Could not open session: ${inspected.reason}`);
 		}
 		const opened = await SessionManager.openExistingStrict(inspected.identity, destination, storage, migrationPolicy);
-		if (opened.kind === "error") throw new Error(`Could not open session: ${opened.reason}`);
+		if (opened.kind === "error") {
+			if (opened.reason === "legacy_migration_disabled") throw new SessionMigrationPolicyError();
+			if (opened.reason === "artifact_capacity_exceeded")
+				throw new SessionArtifactCapacityError(
+					opened.message ?? "Session artifacts exceed the migration capacity.",
+				);
+			if (opened.reason === "migration_busy") throw new SessionMigrationBusyError();
+			throw new Error(`Could not open session: ${opened.reason}`);
+		}
 		return opened.manager;
 	}
 
@@ -9844,6 +9865,7 @@ export class SessionManager {
 		const candidate = listing.owned.find(item => path.resolve(item.path) === path.resolve(sessionPath));
 		if (!candidate) throw new Error("Session is not an authorized managed candidate.");
 		const deleted = await deleteManagedSessionCandidate(resolved.scope, candidate);
+		if (deleted.kind === "error" && deleted.code === "migration_busy") throw new SessionMigrationBusyError();
 		if (deleted.kind !== "deleted" && deleted.kind !== "already_deleted")
 			throw new Error(`Could not delete managed session: ${deleted.message}`);
 	}
@@ -10389,6 +10411,7 @@ export class SessionManager {
 					return { kind: "error", reason: "legacy_migration_disabled" };
 				if (error instanceof SessionArtifactCapacityError)
 					return { kind: "error", reason: "artifact_capacity_exceeded", message: error.message };
+				if (error instanceof SessionMigrationBusyError) return { kind: "error", reason: "migration_busy" };
 				if (
 					error instanceof Error &&
 					(error.message.includes("source_changed") || error.message.includes("changed before migration"))
@@ -10451,6 +10474,7 @@ export class SessionManager {
 					throw new SessionArtifactCapacityError(
 						opened.message ?? "Session artifacts exceed the migration capacity.",
 					);
+				if (opened.reason === "migration_busy") throw new SessionMigrationBusyError();
 				return undefined;
 			}
 			return opened.manager;

package/src/session/session-storage.ts

@@ -312,6 +312,7 @@ export type VerifiedSessionDeleteResult =
 			artifactsIdentity: SessionStorageFileIdentity | undefined;
 			/** Identity-bound quarantine path retained when recursive cleanup failed. */
 			detachedArtifactsPath: string;
+			artifactsPayloadDurable?: true;
 			/** Native snapshot required for an identity-bound recursive retry. */
 			artifactsTree: NativeDirectoryTreeSnapshot;
 			/** Transcript identity (unchanged) for retry binding. */
@@ -328,6 +329,7 @@ export type VerifiedSessionDeleteResult =
 			transcriptIdentity: SessionStorageFileIdentity;
 			/** Optional identity-bound transcript quarantine path for restart cleanup. */
 			detachedTranscriptPath?: string;
+			transcriptPayloadDurable?: true;
 			retainedSuccessorPath?: string;
 			retainedPlaceholderPath?: string;
 			retainedUnknownPath?: string;
@@ -423,6 +425,7 @@ type NativeDirectoryTreeApi = {
 function nativeDirectoryTreeApi(): NativeDirectoryTreeApi {
 	return native as unknown as NativeDirectoryTreeApi;
 }
+
 function snapshotDirectoryTree(pathname: string): NativeDirectoryTreeSnapshot {
 	const result = nativeDirectoryTreeApi().snapshotDirectoryTree(pathname);
 	if (!result.ok || !result.snapshot)
@@ -438,10 +441,21 @@ function retainedTreeDoesNotExpandAuthority(
 ): boolean {
 	if (expected.rootDev !== retained.rootDev || expected.rootIno !== retained.rootIno) return false;
 	const expectedEntries = new Map(expected.entries.map(entry => [entry.relativePath, entry]));
+	if (retained.entries.length > expected.entries.length) return false;
 	return retained.entries.every(entry => {
 		if (entry.relativePath === "") return entry.kind === "directory";
 		const authorized = expectedEntries.get(entry.relativePath);
-		return authorized !== undefined && JSON.stringify(authorized) === JSON.stringify(entry);
+		if (
+			authorized === undefined ||
+			authorized.kind !== entry.kind ||
+			authorized.dev !== entry.dev ||
+			authorized.ino !== entry.ino ||
+			authorized.nlink !== entry.nlink
+		)
+			return false;
+		if (entry.kind !== "file") return entry.size === authorized.size;
+		const scrubbed = entry.size === "0" && entry.sha256 === createHash("sha256").update("").digest("hex");
+		return scrubbed || (entry.size === authorized.size && entry.sha256 === authorized.sha256);
 	});
 }
 
@@ -938,7 +952,7 @@ export class FileSessionStorage implements SessionStorage {
 				"Transcript parent identity does not match authorization",
 			);
 		const authorizedTranscriptParentIdentity = transcriptParentIdentity ?? parentIdentity;
-		if (detachedArtifactsPath) {
+		if (detachedArtifactsPath && !artifactsRemoved) {
 			if (
 				!expectedArtifactsIdentity ||
 				path.dirname(detachedArtifactsPath) !== path.dirname(transcriptPath) ||
@@ -997,6 +1011,9 @@ export class FileSessionStorage implements SessionStorage {
 					artifactsIdentity: expectedArtifactsIdentity,
 					detachedArtifactsPath: retainedRoot,
 					artifactsTree: retainedTree,
+					...((removal as typeof removal & { payloadDurable?: boolean }).payloadDurable === true
+						? { artifactsPayloadDurable: true as const }
+						: {}),
 					...((removal.retainedSuccessorPath ?? retainedArtifactsSuccessorPath)
 						? { retainedSuccessorPath: removal.retainedSuccessorPath ?? retainedArtifactsSuccessorPath }
 						: {}),
@@ -1045,6 +1062,24 @@ export class FileSessionStorage implements SessionStorage {
 				"Artifact path reappeared after durable artifact-phase completion",
 			);
 		}
+		if (artifactsRemoved && detachedArtifactsPath && expectedArtifactsIdentity && expectedArtifactsTree) {
+			const retainedIdentity = this.#optionalDirectoryIdentity(detachedArtifactsPath);
+			if (
+				!retainedIdentity ||
+				retainedIdentity.dev !== expectedArtifactsIdentity.dev ||
+				retainedIdentity.ino !== expectedArtifactsIdentity.ino
+			)
+				throw new SessionDeleteVerificationError(
+					"artifacts",
+					"Retained artifact root identity changed before transcript cleanup",
+				);
+			const retainedTree = snapshotDirectoryTree(detachedArtifactsPath);
+			if (!retainedTreeDoesNotExpandAuthority(expectedArtifactsTree, retainedTree))
+				throw new SessionDeleteVerificationError(
+					"artifacts",
+					"Partial artifact cleanup expanded retained tree authority",
+				);
+		}
 		if (!artifactsIdentity && expectedArtifactsIdentity && !detachedArtifactsPath && !artifactsRemoved) {
 			// Absence at the original path alone is not completion: native recursive removal
 			// may retain the planned root or its deterministic `.removing` final-stage root.
@@ -1116,12 +1151,22 @@ export class FileSessionStorage implements SessionStorage {
 						throw new Error("parent_changed");
 					fs.fsyncSync(descriptor);
 				} catch (error) {
-					throw new SessionDeleteVerificationError("artifacts", "durability_failed", { cause: toError(error) });
+					return {
+						kind: "cleanup_pending",
+						phase: "artifacts",
+						error: new SessionDeleteVerificationError("artifacts", "durability_failed", {
+							cause: toError(error),
+						}),
+						artifactsIdentity,
+						detachedArtifactsPath: detach.detachedPath,
+						artifactsTree,
+						transcriptIdentity,
+					};
 				} finally {
 					if (descriptor !== undefined) fs.closeSync(descriptor);
 				}
 			}
-			if (!detach.ok) {
+			if (!detach.ok && process.platform === "win32") {
 				return {
 					kind: "cleanup_pending",
 					phase: "artifacts",
@@ -1132,7 +1177,6 @@ export class FileSessionStorage implements SessionStorage {
 					...(detach.retainedSuccessorPath ? { retainedSuccessorPath: detach.retainedSuccessorPath } : {}),
 					...(detach.retainedPlaceholderPath ? { retainedPlaceholderPath: detach.retainedPlaceholderPath } : {}),
 					...(detach.retainedUnknownPath ? { retainedUnknownPath: detach.retainedUnknownPath } : {}),
-
 					transcriptIdentity,
 				};
 			}
@@ -1173,6 +1217,9 @@ export class FileSessionStorage implements SessionStorage {
 					artifactsIdentity,
 					detachedArtifactsPath: retainedRoot,
 					artifactsTree: retainedTree,
+					...((removal as typeof removal & { payloadDurable?: boolean }).payloadDurable === true
+						? { artifactsPayloadDurable: true as const }
+						: {}),
 					...((removal.retainedSuccessorPath ?? retainedArtifactsSuccessorPath)
 						? { retainedSuccessorPath: removal.retainedSuccessorPath ?? retainedArtifactsSuccessorPath }
 						: {}),
@@ -1223,6 +1270,13 @@ export class FileSessionStorage implements SessionStorage {
 				quarantineName: path.basename(plannedTranscriptPath),
 			});
 			if (!deletion.ok) {
+				if (
+					deletion.code === "cleanup_pending" &&
+					(deletion as typeof deletion & { payloadDurable?: boolean }).payloadDurable === true &&
+					deletion.retainedSuccessorPath === undefined &&
+					deletion.retainedUnknownPath === undefined
+				)
+					return { kind: "deleted" };
 				const error = exactUnlinkFailure(deletion);
 				const retainedAuthority =
 					deletion.detachedPath ||
@@ -1234,6 +1288,9 @@ export class FileSessionStorage implements SessionStorage {
 					kind: "cleanup_pending",
 					phase: "transcript",
 					error,
+					...((deletion as typeof deletion & { payloadDurable?: boolean }).payloadDurable === true
+						? { transcriptPayloadDurable: true as const }
+						: {}),
 					transcriptIdentity,
 					detachedTranscriptPath: deletion.detachedPath ?? detachedTranscriptPath,
 					...((deletion.retainedSuccessorPath ?? retainedTranscriptSuccessorPath)
@@ -1288,6 +1345,13 @@ export class FileSessionStorage implements SessionStorage {
 			quarantineName: path.basename(plannedTranscriptPath),
 		});
 		if (!deletion.ok) {
+			if (
+				deletion.code === "cleanup_pending" &&
+				(deletion as typeof deletion & { payloadDurable?: boolean }).payloadDurable === true &&
+				deletion.retainedSuccessorPath === undefined &&
+				deletion.retainedUnknownPath === undefined
+			)
+				return { kind: "deleted" };
 			const error = exactUnlinkFailure(deletion);
 			const retainedAuthority =
 				deletion.detachedPath ||
@@ -1299,6 +1363,9 @@ export class FileSessionStorage implements SessionStorage {
 				kind: "cleanup_pending",
 				phase: "transcript",
 				error,
+				...((deletion as typeof deletion & { payloadDurable?: boolean }).payloadDurable === true
+					? { transcriptPayloadDurable: true as const }
+					: {}),
 				transcriptIdentity,
 				detachedTranscriptPath: deletion.detachedPath,
 				...((deletion.retainedSuccessorPath ?? retainedTranscriptSuccessorPath)

package/src/slash-commands/builtin-registry.ts

@@ -29,6 +29,8 @@ import {
 	canApplyComposerSubmission,
 	type InteractiveModeContext,
 } from "../modes/types";
+import { ChatDaemonController } from "../sdk/bus/chat-daemon-control";
+import type { NotificationProvider } from "../sdk/bus/config";
 import {
 	buildNotificationStatusReport,
 	checkNotificationHealth,
@@ -39,6 +41,7 @@ import {
 	recoverNotifications,
 	sendNotificationTest,
 } from "../sdk/bus/notification-service";
+import { TelegramDaemonController } from "../sdk/bus/telegram-daemon-control";
 import { computeCacheMissCostSummary, formatCacheMissSummaryLines } from "../session/cache-economics";
 import { formatModelOnboardingGuidance } from "../setup/model-onboarding-guidance";
 import {
@@ -414,6 +417,9 @@ function modelSelectionUsage(runtime: SlashCommandRuntime, currentModelLine?: st
 		.join("\n\n");
 }
 
+/** Opt into the paste-a-code OAuth login for browsers that cannot reach this machine. */
+const MANUAL_LOGIN_FLAG = "--manual";
+
 const EFFORT_COMMAND_INPUT_HINT = "[inherit|off|minimal|low|medium|high|xhigh|max]";
 const EFFORT_COMMAND_ACCEPTED_VALUES = ["inherit", "off", "minimal", "low", "medium", "high", "xhigh", "max"] as const;
 
@@ -498,6 +504,48 @@ function buildChangelogCommandOutput(showFull: boolean): string {
 	return `${title}\n\n${changelogMarkdown}${hint}`;
 }
 
+type NotifyServiceArgs = { provider?: NotificationProvider; probe: boolean; message?: string } | { error: string };
+
+function isNotificationProvider(value: string): value is NotificationProvider {
+	return value === "telegram" || value === "discord" || value === "slack";
+}
+
+function parseNotifyServiceArgs(input: string, allowMessage: boolean): NotifyServiceArgs {
+	const tokens = input.trim().split(/\s+/).filter(Boolean);
+	let provider: NotificationProvider | undefined;
+	let probe = false;
+	const message: string[] = [];
+	for (let index = 0; index < tokens.length; index += 1) {
+		const token = tokens[index]!;
+		if (token === "--probe") {
+			if (allowMessage) return { error: "--probe is valid only for /notify health." };
+			probe = true;
+			continue;
+		}
+		if (token === "--provider" || token.startsWith("--provider=")) {
+			const value = token === "--provider" ? tokens[++index] : token.slice("--provider=".length);
+			if (!value || !isNotificationProvider(value)) {
+				return { error: "--provider must be telegram, discord, or slack." };
+			}
+			if (provider && provider !== value) return { error: "Conflicting notification providers were supplied." };
+			provider = value;
+			continue;
+		}
+		if (!provider && message.length === 0 && isNotificationProvider(token)) {
+			provider = token;
+			continue;
+		}
+		if (token.startsWith("--")) return { error: `Unknown notification option: ${token}` };
+		message.push(token);
+	}
+	if (!allowMessage && message.length > 0) return { error: "Health accepts only a provider and --probe." };
+	return {
+		...(provider ? { provider } : {}),
+		probe,
+		...(message.length > 0 ? { message: message.join(" ") } : {}),
+	};
+}
+
 const shutdownHandlerTui = (_command: ParsedSlashCommand, runtime: TuiSlashCommandRuntime): SlashCommandResult => {
 	runtime.ctx.editor.setText("");
 	void runtime.ctx.shutdown();
@@ -514,8 +562,12 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 			{ name: "on", description: "Enable notifications for this session" },
 			{ name: "off", description: "Disable notifications for this session" },
 			{ name: "status", description: "Show notification configuration (no secrets)" },
-			{ name: "health", description: "Config, daemon-ownership and endpoint health" },
-			{ name: "test", description: "Send a test notification", usage: "[message]" },
+			{
+				name: "health",
+				description: "Config, ownership, endpoint, and selected-provider health",
+				usage: "[provider] [--probe]",
+			},
+			{ name: "test", description: "Send a test notification", usage: "[provider|--provider provider] [message]" },
 			{ name: "recovery", description: "Clear dead-owner locks and stale endpoint files" },
 			{ name: "setup", description: "How to pair a Telegram bot (run in a terminal)" },
 		],
@@ -541,12 +593,41 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 					await runtime.output(formatNotificationStatusReport(buildNotificationStatusReport(runtime.settings)));
 					return commandConsumed();
 				case "health": {
-					const report = await checkNotificationHealth({ settings: runtime.settings, stateRoot });
+					const parsed = parseNotifyServiceArgs(rest, false);
+					if ("error" in parsed) {
+						return usage(`Usage: /notify health [telegram|discord|slack] [--probe]\n${parsed.error}`, runtime);
+					}
+					const report = await checkNotificationHealth({
+						settings: runtime.settings,
+						stateRoot,
+						provider: parsed.provider,
+						probe: parsed.probe,
+					});
 					await runtime.output(formatNotificationHealthReport(report));
 					return commandConsumed();
 				}
 				case "test": {
-					const result = await sendNotificationTest({ settings: runtime.settings, text: rest || undefined });
+					const parsed = parseNotifyServiceArgs(rest, true);
+					if ("error" in parsed) {
+						return usage(
+							`Usage: /notify test [telegram|discord|slack|--provider provider] [message]\n${parsed.error}`,
+							runtime,
+						);
+					}
+					const result = await sendNotificationTest({
+						settings: runtime.settings,
+						provider: parsed.provider,
+						text: parsed.message,
+						deps: {
+							providerRuntimeStatus: async provider => {
+								const status =
+									provider === "telegram"
+										? await new TelegramDaemonController(runtime.settings).status()
+										: await new ChatDaemonController(runtime.settings, provider).status();
+								return status.health === "running" ? "ready" : "inactive";
+							},
+						},
+					});
 					await runtime.output(formatNotificationTestResult(result));
 					return commandConsumed();
 				}
@@ -1286,20 +1367,45 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 	{
 		name: "login",
 		description: "Login with OAuth provider",
-		inlineHint: "[provider|redirect URL]",
+		inlineHint: "[provider|redirect URL] [--manual]",
 		allowArgs: true,
 		handleTui: (command, runtime) => {
 			const manualInput = runtime.ctx.oauthManualInput;
 			const args = command.args.trim();
+			const pendingLoginMessage = (): string => {
+				const pendingProvider = manualInput.pendingProviderId;
+				return pendingProvider
+					? `OAuth login already in progress for ${pendingProvider}. Paste the redirect URL with /login <url>.`
+					: "OAuth login already in progress. Paste the redirect URL with /login <url>.";
+			};
 			if (args.length > 0) {
+				const tokens = args.split(/\s+/);
+				// `--manual` is resolved before the paste fallback below, otherwise
+				// `/login anthropic --manual` would be submitted as an authorization code.
+				if (tokens.includes(MANUAL_LOGIN_FLAG)) {
+					const rest = tokens.filter(token => token !== MANUAL_LOGIN_FLAG);
+					const requestedProvider = rest.length === 1 ? rest[0] : undefined;
+					const manualProvider = requestedProvider
+						? getOAuthProviders().find(provider => provider.id === requestedProvider)
+						: undefined;
+					if (!manualProvider) {
+						runtime.ctx.showWarning(`Usage: /login <provider> ${MANUAL_LOGIN_FLAG}`);
+						runtime.ctx.editor.setText("");
+						return;
+					}
+					if (manualInput.hasPending()) {
+						runtime.ctx.showWarning(pendingLoginMessage());
+						runtime.ctx.editor.setText("");
+						return;
+					}
+					void runtime.ctx.showOAuthSelector("login", manualProvider.id, { manualCode: true });
+					runtime.ctx.editor.setText("");
+					return;
+				}
 				const matchedProvider = getOAuthProviders().find(provider => provider.id === args);
 				if (matchedProvider) {
 					if (manualInput.hasPending()) {
-						const pendingProvider = manualInput.pendingProviderId;
-						const message = pendingProvider
-							? `OAuth login already in progress for ${pendingProvider}. Paste the redirect URL with /login <url>.`
-							: "OAuth login already in progress. Paste the redirect URL with /login <url>.";
-						runtime.ctx.showWarning(message);
+						runtime.ctx.showWarning(pendingLoginMessage());
 						runtime.ctx.editor.setText("");
 						return;
 					}
@@ -1318,11 +1424,7 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 			}
 
 			if (manualInput.hasPending()) {
-				const provider = manualInput.pendingProviderId;
-				const message = provider
-					? `OAuth login already in progress for ${provider}. Paste the redirect URL with /login <url>.`
-					: "OAuth login already in progress. Paste the redirect URL with /login <url>.";
-				runtime.ctx.showWarning(message);
+				runtime.ctx.showWarning(pendingLoginMessage());
 				runtime.ctx.editor.setText("");
 				return;
 			}