@gajae-code/coding-agent 0.12.7 → 0.12.8

package/src/cli/notify-cli.ts

@@ -7,11 +7,18 @@ import { createInterface } from "node:readline/promises";
 import { APP_NAME } from "@gajae-code/utils/dirs";
 import chalk from "chalk";
 import { Settings, type SettingsAtomicPatch } from "../config/settings";
-import { type EnsureChatDaemonResult, ensureDiscordDaemon, ensureSlackDaemon } from "../sdk/bus/chat-daemon-control";
+import {
+	ChatDaemonController,
+	type EnsureChatDaemonResult,
+	ensureDiscordDaemon,
+	ensureSlackDaemon,
+} from "../sdk/bus/chat-daemon-control";
 import { getNotificationConfig, maskToken, tokenFingerprint } from "../sdk/bus/config";
 import {
 	clearTelegramActivationMarker,
 	createTelegramActivationMarker,
+	mutateNotificationProvider,
+	type NotificationProviderRuntimeAuthority,
 	observedTelegramActivationMarker,
 	type ProposedTelegramIdentity,
 	persistTelegramActivationMarker,
@@ -35,6 +42,7 @@ import {
 	resolveTelegramSetupPreflight,
 } from "../sdk/bus/telegram-daemon";
 import { runDaemonInternal } from "../sdk/bus/telegram-daemon-cli";
+import { TelegramDaemonController } from "../sdk/bus/telegram-daemon-control";
 import {
 	runTelegramSetup as runTelegramPairingSetup,
 	type TelegramSetupPreflight,
@@ -93,75 +101,99 @@ export interface NotifyCommandDeps {
 }
 
 export function parseNotifyArgs(args: string[]): NotifyCommandArgs | undefined {
-	if (args.length === 0 || args[0] !== "notify") {
-		return undefined;
-	}
-
+	if (args.length === 0 || args[0] !== "notify") return undefined;
 	const action = args[1];
-	if (action === "setup" || action === "status") {
+	const providerValue = (value: string | undefined): NotifySetupProvider | undefined =>
+		value === "telegram" || value === "discord" || value === "slack" ? value : undefined;
+	const parseFlags = (
+		rest: string[],
+		valueFlags: ReadonlySet<string>,
+		booleanFlags: ReadonlySet<string>,
+	): Map<string, string | true> | undefined => {
+		const parsed = new Map<string, string | true>();
+		for (let index = 0; index < rest.length; index++) {
+			const flag = rest[index];
+			if (!flag?.startsWith("--") || parsed.has(flag)) return undefined;
+			if (booleanFlags.has(flag)) {
+				parsed.set(flag, true);
+				continue;
+			}
+			if (!valueFlags.has(flag)) return undefined;
+			const value = rest[++index];
+			if (!value || value.startsWith("--")) return undefined;
+			parsed.set(flag, value);
+		}
+		return parsed;
+	};
+
+	if (action === "setup") {
 		const rest = args.slice(2);
-		const flag = (name: string): string | undefined => {
-			const i = rest.indexOf(name);
-			return i >= 0 ? rest[i + 1] : undefined;
+		const positional = rest[0]?.startsWith("--") ? undefined : rest.shift();
+		const provider = positional === undefined ? undefined : providerValue(positional);
+		if (positional !== undefined && !provider) return undefined;
+		const flags = parseFlags(
+			rest,
+			new Set([
+				"--token",
+				"--chat-id",
+				"--discord-bot-token",
+				"--discord-application-id",
+				"--discord-guild-id",
+				"--discord-parent-channel-id",
+				"--slack-bot-token",
+				"--slack-app-token",
+				"--slack-workspace-id",
+				"--slack-channel-id",
+				"--slack-authorized-user-id",
+			]),
+			new Set(["--redact"]),
+		);
+		if (!flags) return undefined;
+		const value = (name: string): string | undefined => {
+			const found = flags.get(name);
+			return typeof found === "string" ? found : undefined;
 		};
-		const valueFlags = [
-			"--token",
-			"--chat-id",
-			"--discord-bot-token",
-			"--discord-application-id",
-			"--discord-guild-id",
-			"--discord-parent-channel-id",
-			"--slack-bot-token",
-			"--slack-app-token",
-			"--slack-workspace-id",
-			"--slack-channel-id",
-			"--slack-authorized-user-id",
-		];
-		if (
-			valueFlags.some(name => {
-				const index = rest.indexOf(name);
-				const value = index >= 0 ? rest[index + 1] : undefined;
-				return index >= 0 && (!value || value.startsWith("--"));
-			})
-		)
-			return undefined;
-		const provider = rest[0]?.startsWith("--") ? undefined : rest[0];
-		if (provider !== undefined && provider !== "telegram" && provider !== "discord" && provider !== "slack") {
-			return undefined;
-		}
 		return {
 			action,
-			rawArgs: rest,
+			rawArgs: args.slice(2),
 			...(provider ? { provider } : {}),
-			token: flag("--token"),
-			chatId: flag("--chat-id"),
-			...(flag("--discord-bot-token") ? { discordBotToken: flag("--discord-bot-token") } : {}),
-			...(flag("--discord-application-id") ? { discordApplicationId: flag("--discord-application-id") } : {}),
-			...(flag("--discord-guild-id") ? { discordGuildId: flag("--discord-guild-id") } : {}),
-			...(flag("--discord-parent-channel-id")
-				? { discordParentChannelId: flag("--discord-parent-channel-id") }
-				: {}),
-			...(flag("--slack-bot-token") ? { slackBotToken: flag("--slack-bot-token") } : {}),
-			...(flag("--slack-app-token") ? { slackAppToken: flag("--slack-app-token") } : {}),
-			...(flag("--slack-workspace-id") ? { slackWorkspaceId: flag("--slack-workspace-id") } : {}),
-			...(flag("--slack-channel-id") ? { slackChannelId: flag("--slack-channel-id") } : {}),
-			...(flag("--slack-authorized-user-id") ? { slackAuthorizedUserId: flag("--slack-authorized-user-id") } : {}),
-			redact: rest.includes("--redact"),
+			token: value("--token"),
+			chatId: value("--chat-id"),
+			discordBotToken: value("--discord-bot-token"),
+			discordApplicationId: value("--discord-application-id"),
+			discordGuildId: value("--discord-guild-id"),
+			discordParentChannelId: value("--discord-parent-channel-id"),
+			slackBotToken: value("--slack-bot-token"),
+			slackAppToken: value("--slack-app-token"),
+			slackWorkspaceId: value("--slack-workspace-id"),
+			slackChannelId: value("--slack-channel-id"),
+			slackAuthorizedUserId: value("--slack-authorized-user-id"),
+			redact: flags.get("--redact") === true,
 		};
 	}
-	if (action === "health" || action === "test" || action === "recovery") {
+	if (action === "status") {
+		return args.length === 2 ? { action, rawArgs: [] } : undefined;
+	}
+	if (action === "health" || action === "test") {
 		const rest = args.slice(2);
-		const flag = (name: string): string | undefined => {
-			const i = rest.indexOf(name);
-			return i >= 0 ? rest[i + 1] : undefined;
-		};
+		const flags = parseFlags(
+			rest,
+			new Set(action === "health" ? ["--provider"] : ["--provider", "--message"]),
+			new Set(action === "health" ? ["--probe"] : []),
+		);
+		if (!flags) return undefined;
+		const rawProvider = flags.get("--provider");
+		const provider = typeof rawProvider === "string" ? providerValue(rawProvider) : undefined;
+		if (rawProvider !== undefined && !provider) return undefined;
 		return {
 			action,
 			rawArgs: rest,
-			probe: rest.includes("--probe"),
-			message: flag("--message"),
+			...(provider ? { provider } : {}),
+			probe: flags.get("--probe") === true,
+			message: typeof flags.get("--message") === "string" ? (flags.get("--message") as string) : undefined,
 		};
 	}
+	if (action === "recovery") return args.length === 2 ? { action, rawArgs: [] } : undefined;
 	if (action === "daemon-internal") {
 		return {
 			action,
@@ -169,7 +201,6 @@ export function parseNotifyArgs(args: string[]): NotifyCommandArgs | undefined {
 			rawArgs: args.slice(2),
 		};
 	}
-
 	return undefined;
 }
 
@@ -273,18 +304,46 @@ async function runDiscordSetup(cmd: NotifyCommandArgs, deps: NotifyCommandDeps):
 		deps,
 	);
 	const settings = await getSettings(deps);
-	const patches: SettingsAtomicPatch[] = [
-		{ path: "notifications.discord.botToken", op: "set", value: botToken },
-		{ path: "notifications.discord.applicationId", op: "set", value: applicationId },
-		{ path: "notifications.discord.guildId", op: "set", value: guildId },
-		{ path: "notifications.discord.parentChannelId", op: "set", value: parentChannelId },
-		{ path: "notifications.enabled", op: "set", value: true },
-	];
-	if (cmd.redact) patches.push({ path: "notifications.redact", op: "set", value: true });
-	await settings.commitAtomicBatch(patches);
-	const daemon = await ensureConfiguredProviderDaemon("discord", settings, deps);
+	let activationFailure: string | undefined;
+	let activationOutcome: EnsureChatDaemonResult | undefined;
+	const runtime: NotificationProviderRuntimeAuthority = {
+		activate: async provider => {
+			if (provider !== "discord") throw new Error("Unexpected provider activation request.");
+			try {
+				const result = await ensureConfiguredProviderDaemon("discord", settings, deps);
+				if (result === "disabled") throw new Error("Discord runtime did not activate.");
+				activationOutcome = result;
+			} catch (error) {
+				activationFailure = error instanceof Error ? error.message : "Discord runtime activation failed.";
+				throw error;
+			}
+		},
+		deactivate: async () => undefined,
+	};
+	const result = await mutateNotificationProvider({
+		settings,
+		mutation: {
+			provider: "discord",
+			botToken: { action: "replace", value: botToken },
+			applicationId,
+			guildId,
+			parentChannelId,
+		},
+		configureAndActivate: true,
+		...(cmd.redact ? { redact: true } : {}),
+		runtime,
+	});
+	if (result.status === "commit_failed")
+		throw new Error("Discord configuration was not saved because the CAS commit failed.");
+	if (result.status !== "activated") {
+		const detail = `runtime activation failed: ${activationFailure ?? result.status}`;
+		process.stderr.write(`Discord configuration saved, but ${detail}.\n`);
+		if (deps.setExitCode) deps.setExitCode(1);
+		else process.exitCode = 1;
+		return;
+	}
 	process.stdout.write(
-		`Discord notifications enabled. botToken=${maskToken(botToken)} applicationId=${applicationId} guildId=${guildId} parentChannelId=${parentChannelId} daemon=${daemon}\n`,
+		`Discord configuration saved and activated. botToken=${maskToken(botToken)} applicationId=${applicationId} guildId=${guildId} parentChannelId=${parentChannelId} daemon=${activationOutcome ?? "attached"}\n`,
 	);
 }
 
@@ -295,21 +354,47 @@ async function runSlackSetup(cmd: NotifyCommandArgs, deps: NotifyCommandDeps): P
 	const channelId = await promptSetupValue(cmd.slackChannelId, "--slack-channel-id", false, deps);
 	const authorizedUserId = cmd.slackAuthorizedUserId?.trim() || undefined;
 	const settings = await getSettings(deps);
-	const patches: SettingsAtomicPatch[] = [
-		{ path: "notifications.slack.botToken", op: "set", value: botToken },
-		{ path: "notifications.slack.appToken", op: "set", value: appToken },
-		{ path: "notifications.slack.workspaceId", op: "set", value: workspaceId },
-		{ path: "notifications.slack.channelId", op: "set", value: channelId },
-		authorizedUserId === undefined
-			? { path: "notifications.slack.authorizedUserId", op: "unset" }
-			: { path: "notifications.slack.authorizedUserId", op: "set", value: authorizedUserId },
-		{ path: "notifications.enabled", op: "set", value: true },
-	];
-	if (cmd.redact) patches.push({ path: "notifications.redact", op: "set", value: true });
-	await settings.commitAtomicBatch(patches);
-	const daemon = await ensureConfiguredProviderDaemon("slack", settings, deps);
+	let activationFailure: string | undefined;
+	let activationOutcome: EnsureChatDaemonResult | undefined;
+	const runtime: NotificationProviderRuntimeAuthority = {
+		activate: async provider => {
+			if (provider !== "slack") throw new Error("Unexpected provider activation request.");
+			try {
+				const result = await ensureConfiguredProviderDaemon("slack", settings, deps);
+				if (result === "disabled") throw new Error("Slack runtime did not activate.");
+				activationOutcome = result;
+			} catch (error) {
+				activationFailure = error instanceof Error ? error.message : "Slack runtime activation failed.";
+				throw error;
+			}
+		},
+		deactivate: async () => undefined,
+	};
+	const result = await mutateNotificationProvider({
+		settings,
+		mutation: {
+			provider: "slack",
+			botToken: { action: "replace", value: botToken },
+			appToken: { action: "replace", value: appToken },
+			workspaceId,
+			channelId,
+			authorizedUserId,
+		},
+		configureAndActivate: true,
+		...(cmd.redact ? { redact: true } : {}),
+		runtime,
+	});
+	if (result.status === "commit_failed")
+		throw new Error("Slack configuration was not saved because the CAS commit failed.");
+	if (result.status !== "activated") {
+		const detail = `runtime activation failed: ${activationFailure ?? result.status}`;
+		process.stderr.write(`Slack configuration saved, but ${detail}.\n`);
+		if (deps.setExitCode) deps.setExitCode(1);
+		else process.exitCode = 1;
+		return;
+	}
 	process.stdout.write(
-		`Slack notifications enabled. botToken=${maskToken(botToken)} appToken=${maskToken(appToken)} workspaceId=${workspaceId} channelId=${channelId} authorizedUserId=${authorizedUserId ?? "(unset; inbound denied)"} daemon=${daemon}\n`,
+		`Slack configuration saved and activated. botToken=${maskToken(botToken)} appToken=${maskToken(appToken)} workspaceId=${workspaceId} channelId=${channelId} authorizedUserId=${authorizedUserId ?? "(unset; inbound denied)"} daemon=${activationOutcome ?? "attached"}\n`,
 	);
 }
 
@@ -365,6 +450,7 @@ async function runTelegramSetup(cmd: NotifyCommandArgs, deps: NotifyCommandDeps)
 	if (result.pairingSource === "provided") {
 		process.stdout.write(`Using provided chat id ${result.chatId} (non-interactive).\n`);
 	}
+	let settingsCommitted = false;
 	try {
 		const proposedIdentity = deps.setupPreflight
 			? proposedIdentityFromSetupPreflight(deps.setupPreflight, token.trim(), result.chatId)
@@ -385,9 +471,11 @@ async function runTelegramSetup(cmd: NotifyCommandArgs, deps: NotifyCommandDeps)
 			{ path: "notifications.telegram.botToken", op: "set", value: token.trim() },
 			{ path: "notifications.telegram.chatId", op: "set", value: result.chatId },
 			{ path: "notifications.enabled", op: "set", value: true },
+			{ path: "notifications.telegram.enabled", op: "set", value: true },
 		];
 		if (deps.setupRedact ?? cmd.redact) patches.push({ path: "notifications.redact", op: "set", value: true });
 		const receipt = await settings.commitAtomicBatch(patches);
+		settingsCommitted = true;
 		const activationMarker = createTelegramActivationMarker({
 			botToken: token.trim(),
 			chatId: result.chatId,
@@ -422,6 +510,7 @@ async function runTelegramSetup(cmd: NotifyCommandArgs, deps: NotifyCommandDeps)
 		});
 		if (activation.status === "blocked_identity") {
 			const restored = await activation.restore();
+			if (restored.status === "restored" || restored.status === "still_blocked") settingsCommitted = false;
 			const detail =
 				restored.status === "restored"
 					? "Telegram activation was blocked by a foreign daemon; previous settings were restored."
@@ -432,9 +521,18 @@ async function runTelegramSetup(cmd: NotifyCommandArgs, deps: NotifyCommandDeps)
 							: "Telegram activation was blocked; refusing to report setup success.";
 			throw new Error(detail);
 		}
+		if (activation.status === "activation_failed") {
+			receipt.discard();
+			throw new Error(activation.message);
+		}
+		receipt.discard();
 	} catch (error) {
 		const detail = sanitizeDiagnostic(error instanceof Error ? error.message : "unknown persistence failure", token);
-		throw new Error(`Unable to persist and activate Telegram notification settings: ${detail}`);
+		throw new Error(
+			settingsCommitted
+				? `Telegram notification settings were saved, but activation or recovery failed: ${detail}`
+				: `Unable to persist and activate Telegram notification settings: ${detail}`,
+		);
 	}
 	process.stdout.write(
 		`Notifications enabled. botToken=${maskToken(token)} chatId=${result.chatId} threaded=${result.threadedLabel}\n`,
@@ -586,6 +684,7 @@ async function runHealth(deps: NotifyCommandDeps, cmd: NotifyCommandArgs): Promi
 	const settings = await getSettings(deps);
 	const report = await checkNotificationHealth({
 		settings,
+		provider: cmd.provider,
 		probe: cmd.probe,
 		deps: { fetchImpl: deps.fetchImpl, apiBase: deps.apiBase },
 	});
@@ -598,8 +697,19 @@ async function runTest(deps: NotifyCommandDeps, cmd: NotifyCommandArgs): Promise
 	const settings = await getSettings(deps);
 	const result = await sendNotificationTest({
 		settings,
+		provider: cmd.provider,
 		text: cmd.message,
-		deps: { fetchImpl: deps.fetchImpl, apiBase: deps.apiBase },
+		deps: {
+			fetchImpl: deps.fetchImpl,
+			apiBase: deps.apiBase,
+			providerRuntimeStatus: async provider => {
+				const status =
+					provider === "telegram"
+						? await new TelegramDaemonController(settings).status()
+						: await new ChatDaemonController(settings, provider).status();
+				return status.health === "running" ? "ready" : "inactive";
+			},
+		},
 	});
 	process.stdout.write(`${formatNotificationTestResult(result)}\n`);
 	if (!result.ok && deps.setExitCode) deps.setExitCode(1);
@@ -616,8 +726,8 @@ export function printNotifyHelp(): void {
 	process.stdout.write(`${chalk.bold(`${APP_NAME} notify`)} - Configure Telegram, Discord, or Slack notifications
 
 ${chalk.bold("Interactive path:")}
-  In a running GJC session, use /settings → Notifications for setup, health, test, recovery,
-  reconnect, global enable/disable, adapter-local Telegram removal, and session on/off.
+  In a running GJC session, use /settings → Notifications for first-class Telegram, Discord,
+  and Slack configure/edit/repair, desired intent, health, test, removal, global master, and session controls.
   The CLI subcommands below remain the authoritative headless and automation fallback.
 
 ${chalk.bold("Usage:")}
@@ -625,15 +735,15 @@ ${chalk.bold("Usage:")}
   ${APP_NAME} notify setup discord --discord-bot-token <token> --discord-application-id <id> --discord-guild-id <id> --discord-parent-channel-id <id>
   ${APP_NAME} notify setup slack --slack-bot-token <token> --slack-app-token <token> --slack-workspace-id <id> --slack-channel-id <id> [--slack-authorized-user-id <id>]
   ${APP_NAME} notify status
-  ${APP_NAME} notify health [--probe]
-  ${APP_NAME} notify test [--message <text>]
+  ${APP_NAME} notify health [--provider telegram|discord|slack] [--probe]
+  ${APP_NAME} notify test [--provider telegram|discord|slack] [--message <text>]
   ${APP_NAME} notify recovery
 
 ${chalk.bold("Subcommands:")}
-  setup     Pair Telegram or save complete non-interactive Discord/Slack notification settings
-  status    Show notification configuration without secrets
-  health    Report config, daemon-ownership and endpoint health (--probe adds a Telegram reachability check)
-  test      Send a one-off test notification through the configured Telegram adapter
+  setup     Pair Telegram or atomically save and activate complete Discord/Slack settings
+  status    Show global master and provider configured/repair/desired/effective state without secrets
+  health    Report selected provider state; --probe uses REST only and never opens Gateway/Socket Mode
+  test      Send a one-off test through one selected or uniquely effective provider
   recovery  Clear dead-owner daemon locks and stale per-session endpoint files (never touches a live owner)
 
 ${chalk.bold("Examples:")}
@@ -642,8 +752,8 @@ ${chalk.bold("Examples:")}
   ${APP_NAME} notify setup discord --discord-bot-token <token> --discord-application-id <id> --discord-guild-id <id> --discord-parent-channel-id <id>
   ${APP_NAME} notify setup slack --slack-bot-token <token> --slack-app-token <token> --slack-workspace-id <id> --slack-channel-id <id> [--slack-authorized-user-id <id>]
   ${APP_NAME} notify status
-  ${APP_NAME} notify health --probe
-  ${APP_NAME} notify test --message "hello from gjc"
+  ${APP_NAME} notify health --provider discord --probe
+  ${APP_NAME} notify test --provider slack --message "hello from gjc"
   ${APP_NAME} notify recovery
 
 ${chalk.bold("Threaded Mode:")}

package/src/commands/notify.ts

@@ -40,7 +40,11 @@ export default class Notify extends Command {
 			description: "Slack user id authorized for inbound replies and commands",
 		}),
 		redact: Flags.boolean({ description: "Enable redaction of remote notification content" }),
-		probe: Flags.boolean({ description: "notify health: probe Telegram reachability (getMe)" }),
+		provider: Flags.string({
+			description: "notify health/test: select telegram, discord, or slack",
+			options: ["telegram", "discord", "slack"],
+		}),
+		probe: Flags.boolean({ description: "notify health: run the selected provider's REST diagnostic" }),
 		message: Flags.string({ description: "notify test: custom message body" }),
 		"owner-id": Flags.string({ description: "Internal: daemon owner id" }),
 		"agent-dir": Flags.string({ description: "Internal: agent dir for the daemon" }),
@@ -64,16 +68,23 @@ export default class Notify extends Command {
 			...(agentDir ? ["--agent-dir", agentDir] : []),
 			...extra,
 		];
-		const provider = extra[0];
+		const positionalProvider = action === "setup" ? extra[0] : undefined;
 		if (
-			action === "setup" &&
-			provider !== undefined &&
-			provider !== "telegram" &&
-			provider !== "discord" &&
-			provider !== "slack"
+			positionalProvider !== undefined &&
+			positionalProvider !== "telegram" &&
+			positionalProvider !== "discord" &&
+			positionalProvider !== "slack"
 		) {
-			throw new Error(`Unknown notification provider: ${provider}`);
+			throw new Error(`Unknown notification provider: ${positionalProvider}`);
+		}
+		const providerFlag = flagRec.provider as string | undefined;
+		if (providerFlag && action !== "health" && action !== "test") {
+			throw new Error("--provider is valid only for notify health and notify test.");
+		}
+		if (action !== "setup" && action !== "daemon-internal" && extra.length > 0) {
+			throw new Error(`Unexpected notify arguments: ${extra.join(" ")}`);
 		}
+		const provider = providerFlag ?? positionalProvider;
 
 		const cmd: NotifyCommandArgs = {
 			action: action as NotifyAction,

package/src/config/file-lock.ts

@@ -17,6 +17,10 @@ const DEFAULT_OPTIONS: Required<FileLockOptions> = {
 
 type LockInfo = FileLockOwnerToken;
 
+export const FileLockTestHooks: {
+	afterParentMkdir?: (lockPath: string) => void | Promise<void>;
+} = {};
+
 /**
  * Returns the OS-provided process start timestamp for PID-reuse detection.
  * `ps` is available on the supported Unix hosts (macOS and Linux), unlike
@@ -237,6 +241,8 @@ async function removeStaleLockForAcquire(lockPath: string, snapshot: LockStaleSn
 
 async function tryAcquireLock(lockPath: string): Promise<LockInfo | null> {
 	await fs.mkdir(path.dirname(lockPath), { recursive: true });
+	const afterParentMkdir = FileLockTestHooks.afterParentMkdir;
+	if (afterParentMkdir) await afterParentMkdir(lockPath);
 	try {
 		await fs.mkdir(lockPath);
 		return await writeLockInfo(lockPath);

package/src/config/model-discovery-manager.ts

@@ -37,6 +37,8 @@ export interface DiscoveryMergeInput {
 	models: readonly Model<Api>[];
 	state: ProviderDiscoveryState;
 	warning?: string;
+	authGeneration?: string;
+	fetched?: boolean;
 }
 
 export interface ProviderDiscoveryCallbacks<TProvider extends DiscoveryProvider> {
@@ -44,7 +46,9 @@ export interface ProviderDiscoveryCallbacks<TProvider extends DiscoveryProvider>
 	requiresAuth: (provider: TProvider) => boolean;
 	peekApiKey: (provider: TProvider) => Promise<string | undefined>;
 	isAuthenticated: (apiKey: string | undefined) => boolean;
-	fetchModels: (provider: TProvider) => Promise<Model<Api>[]>;
+	fetchModels: (provider: TProvider, apiKey: string | undefined) => Promise<Model<Api>[]>;
+	getEvidenceGeneration?: (provider: TProvider) => string;
+	canPublishCache?: (provider: TProvider) => boolean;
 }
 
 /** Owns configured discovery inputs, status, cache lifecycle, and refresh generations. */
@@ -89,6 +93,11 @@ export class ModelDiscoveryManager<TProvider extends DiscoveryProvider> {
 		const state = this.#states.get(provider);
 		return state === undefined ? undefined : this.#snapshot(state);
 	}
+	invalidate(provider: string): void {
+		this.#invalidate(provider);
+		this.#states.delete(provider);
+		this.#lastWarnings.delete(provider);
+	}
 
 	loadCached(provider: TProvider, cacheDbPath?: string): readonly Model<Api>[] {
 		const cache = readModelCache<Api>(provider.provider, 24 * 60 * 60 * 1000, Date.now, cacheDbPath);
@@ -133,9 +142,21 @@ export class ModelDiscoveryManager<TProvider extends DiscoveryProvider> {
 				models: models.map(model => model.id),
 			});
 
+		let authGeneration = callbacks.getEvidenceGeneration?.(provider);
+		let apiKey: string | undefined;
 		if (callbacks.requiresAuth(provider)) {
-			const apiKey = await callbacks.peekApiKey(provider);
+			apiKey = await callbacks.peekApiKey(provider);
+			const resolvedGeneration = callbacks.getEvidenceGeneration?.(provider);
 			if (!this.isCurrent(token)) return this.#stale(token);
+			if (authGeneration !== resolvedGeneration) {
+				authGeneration = resolvedGeneration;
+				// Resolving a command-backed key can update the evidence generation. Keep
+				// the key resolved for this refresh so round-robin selection cannot switch
+				// credentials between the request and its published evidence.
+				if (!this.isCurrent(token) || authGeneration !== callbacks.getEvidenceGeneration?.(provider)) {
+					return this.#stale(token);
+				}
+			}
 			if (!callbacks.isAuthenticated(apiKey)) return unauthenticated(cachedModels);
 		}
 
@@ -145,10 +166,14 @@ export class ModelDiscoveryManager<TProvider extends DiscoveryProvider> {
 			staticModels: [],
 			cacheDbPath: callbacks.cacheDbPath,
 			cacheTtlMs: 24 * 60 * 60 * 1000,
-			canPublishCache: () => this.isCurrent(token),
+			canPublishCache: () =>
+				this.isCurrent(token) &&
+				(callbacks.getEvidenceGeneration === undefined ||
+					callbacks.getEvidenceGeneration(provider) === authGeneration) &&
+				(callbacks.canPublishCache?.(provider) ?? true),
 			fetchDynamicModels: async () => {
 				try {
-					return await callbacks.fetchModels(provider);
+					return await callbacks.fetchModels(provider, apiKey);
 				} catch (cause) {
 					error = cause instanceof Error ? cause.message : String(cause);
 					return null;
@@ -156,7 +181,11 @@ export class ModelDiscoveryManager<TProvider extends DiscoveryProvider> {
 			},
 		});
 		const result = await manager.refresh(strategy);
-		if (!this.isCurrent(token)) return this.#stale(token);
+		if (
+			!this.isCurrent(token) ||
+			(callbacks.getEvidenceGeneration !== undefined && callbacks.getEvidenceGeneration(provider) !== authGeneration)
+		)
+			return this.#stale(token);
 		const status: ProviderDiscoveryStatus = error
 			? result.models.length > 0
 				? "cached"
@@ -166,7 +195,9 @@ export class ModelDiscoveryManager<TProvider extends DiscoveryProvider> {
 					? "cached"
 					: "idle"
 				: result.models.length > 0
-					? "ok"
+					? result.stale
+						? "cached"
+						: "ok"
 					: "empty";
 		const state: ProviderDiscoveryState = {
 			provider: provider.provider,
@@ -177,7 +208,7 @@ export class ModelDiscoveryManager<TProvider extends DiscoveryProvider> {
 			models: result.models.map(model => model.id),
 			error,
 		};
-		return this.#complete(token, result.models, state, error);
+		return this.#complete(token, result.models, state, error, authGeneration, result.fetched);
 	}
 
 	#complete(
@@ -185,6 +216,8 @@ export class ModelDiscoveryManager<TProvider extends DiscoveryProvider> {
 		models: readonly Model<Api>[],
 		state: ProviderDiscoveryState,
 		error?: string,
+		authGeneration?: string,
+		fetched?: boolean,
 	): DiscoveryMergeInput {
 		const current = this.isCurrent(token);
 		if (current) this.#states.set(token.provider, this.#snapshot(state));
@@ -193,7 +226,16 @@ export class ModelDiscoveryManager<TProvider extends DiscoveryProvider> {
 			if (error) this.#lastWarnings.set(token.provider, error);
 			else this.#lastWarnings.delete(token.provider);
 		}
-		return this.#snapshot({ provider: token.provider, token, current, models, state, warning });
+		return this.#snapshot({
+			provider: token.provider,
+			token,
+			current,
+			models,
+			state,
+			warning,
+			authGeneration,
+			fetched,
+		});
 	}
 
 	#stale(token: DiscoveryRefreshToken): DiscoveryMergeInput {