@gajae-code/coding-agent 0.12.8 → 0.12.10

package/src/session/agent-session.ts

@@ -109,6 +109,7 @@ import {
 	streamSimple,
 } from "@gajae-code/ai";
 import {
+	type AuthDisposition,
 	beginAttempt,
 	classifyFallbackTrigger,
 	type FallbackAttemptToken,
@@ -14228,6 +14229,12 @@ export class AgentSession {
 			);
 		}
 		const trigger = classifyFallbackTrigger(transportFailure ?? { status: message.errorStatus });
+		// A plain `forbidden` is terminal. Without this, the blanket
+		// `transportFailure` admission below re-admits a committed forbidden
+		// failure into retry policy: credential mutation is vetoed downstream, but
+		// the chain would still retry and advance models on a request the caller is
+		// simply not authorized to make.
+		if (trigger.class === "auth" && trigger.authDisposition === "forbidden") return false;
 		if (transportFailure) return true;
 		if (
 			trigger.class === "rate_limit" ||
@@ -14616,7 +14623,10 @@ export class AgentSession {
 		message: AssistantMessage,
 		allowLegacyUsageLimit: boolean,
 		transportFailure?: TransportFailureFacts,
-	): { class: FallbackTriggerClass; retryAfterMs?: number } | undefined {
+		// `authDisposition` is carried through from `classifyFallbackTrigger`, whose
+		// result is returned verbatim below. Narrowing it away here would silently
+		// disable the terminal-403 guard in `#markFailedCredential`.
+	): { class: FallbackTriggerClass; retryAfterMs?: number; authDisposition?: AuthDisposition } | undefined {
 		if (classifyContextOverflow(message, transportFailure, this.model?.contextWindow ?? 0)) return undefined;
 		const transport = classifyFallbackTrigger(transportFailure ?? { status: message.errorStatus });
 		if (transport.class !== "other") return transport;
@@ -14723,25 +14733,60 @@ export class AgentSession {
 		return `Model fallback chain exhausted; models tried: ${tried}; models skipped: ${skipped}`;
 	}
 
-	async #markFailedCredential(trigger: { class: FallbackTriggerClass; retryAfterMs?: number }): Promise<boolean> {
+	/**
+	 * Marks the credential that just failed and reports whether the session
+	 * actually moved to a DIFFERENT stored credential.
+	 *
+	 * Three invariants this enforces, in order:
+	 *
+	 * 1. **Pin guard, first and for every trigger class.** A pinned credential
+	 *    (`--api-key` or `--credential`) must never be mutated or rotated away
+	 *    from. Both overrides are consulted: they live in separate maps, so
+	 *    checking only `hasRuntimeApiKey` would silently rotate a `--credential`
+	 *    pin. Previously the guard existed only on the quota path, so the `auth`
+	 *    path invalidated pinned credentials outright.
+	 * 2. **A terminal `forbidden` never mutates credential state.** Rotation
+	 *    would hide an authorization defect and cycle through healthy rows.
+	 * 3. **Distinct-row proof in BOTH branches.** `invalidateCredentialMatching`
+	 *    reports "I matched and blocked a row", which is not the same as "the
+	 *    session now uses a different credential" — with a single-row pool it is
+	 *    true while nothing rotated. Both branches therefore re-resolve and
+	 *    require the active key to have actually changed.
+	 */
+	async #markFailedCredential(trigger: {
+		class: FallbackTriggerClass;
+		retryAfterMs?: number;
+		authDisposition?: AuthDisposition;
+	}): Promise<boolean> {
 		if (!this.model || (trigger.class !== "auth" && trigger.class !== "quota" && trigger.class !== "rate_limit")) {
 			return false;
 		}
+		// (2) Terminal forbidden: no credential state may change.
+		if (trigger.class === "auth" && trigger.authDisposition === "forbidden") return false;
+
 		const authStorage = this.#modelRegistry.authStorage;
+		const provider = this.model.provider;
+		// (1) Pin guard, before any mutation and for every branch.
+		if (authStorage.hasRuntimeApiKey(provider) || authStorage.hasRuntimeCredentialSelector(provider)) return false;
+
 		const providerAffinitySessionId = this.agent.providerSessionId ?? this.agent.sessionId ?? this.sessionId;
+		const activeApiKey = await this.#modelRegistry.getApiKey(this.model, providerAffinitySessionId);
+
+		let mutated: boolean;
 		if (trigger.class === "auth") {
-			const apiKey = await this.#modelRegistry.getApiKey(this.model, providerAffinitySessionId);
-			if (!isAuthenticated(apiKey)) return false;
-			return authStorage.invalidateCredentialMatching(this.model.provider, apiKey, {
+			if (!isAuthenticated(activeApiKey)) return false;
+			mutated = await authStorage.invalidateCredentialMatching(provider, activeApiKey, {
 				sessionId: providerAffinitySessionId,
 			});
+		} else {
+			mutated = await authStorage.markUsageLimitReached(provider, providerAffinitySessionId, {
+				retryAfterMs: trigger.retryAfterMs,
+			});
 		}
-		if (authStorage.hasRuntimeApiKey(this.model.provider)) return false;
-		const activeApiKey = await this.#modelRegistry.getApiKey(this.model, providerAffinitySessionId);
-		const rotated = await authStorage.markUsageLimitReached(this.model.provider, providerAffinitySessionId, {
-			retryAfterMs: trigger.retryAfterMs,
-		});
-		return rotated && (await this.#modelRegistry.getApiKey(this.model, providerAffinitySessionId)) !== activeApiKey;
+		if (!mutated) return false;
+
+		// (3) Distinct-row proof.
+		return (await this.#modelRegistry.getApiKey(this.model, providerAffinitySessionId)) !== activeApiKey;
 	}
 
 	/** Handle retryable errors with exponential backoff. */
@@ -14836,8 +14881,15 @@ export class AgentSession {
 			credentialRotated = await this.#markFailedCredential(trigger);
 		}
 		if (credentialRotated) {
-			if (managedFallback) controller.restorePreviousEntryForRetry();
-			outcome = "retry";
+			// A rotation only becomes a same-model retry if the controller can
+			// actually be rewound. `restorePreviousEntryForRetry()` refuses once an
+			// entry's restore budget is consumed or attempts are exhausted; ignoring
+			// that would force `outcome = "retry"` while `activeIndex` stays on the
+			// next entry and `this.model` stays on the previous one — splitting
+			// attempt attribution, exhaustion, and sticky selection across two models.
+			if (!managedFallback || controller.restorePreviousEntryForRetry()) {
+				outcome = "retry";
+			}
 		}
 		if (outcome === "exhausted") {
 			if (managedFallback) {

package/src/session/internal/managed-session-storage.ts

@@ -9,6 +9,7 @@ import {
 	exactReplacePath,
 	exactRestore,
 	exactUnlink,
+	linkNoReplacePath,
 	type NativeDirectoryTreeSnapshot,
 	type NativeOwnerOnlySecurityResult,
 	openRecoveryFsRoot,
@@ -114,6 +115,21 @@ export function mayCleanManagedTreeStaging(error: unknown): boolean {
 	return !(error instanceof ManagedTreeMoveOutcomeError) || error.stagingCleanupSafe;
 }
 
+/**
+ * A filesystem that implements no `renameat2` rename flag at all rejects the no-replace publish
+ * before mutating anything: NFS answers `EINVAL` (`invalid_request`) and kernels older than 3.15
+ * answer `ENOSYS` (`atomic_unavailable`). Only those two pre-mutation outcomes authorize the
+ * `linkat` stand-in; every other failure describes a publish that was actually attempted, and
+ * retrying it under a different primitive could publish twice.
+ */
+export function renameFlagsUnsupported(outcome: NativePublishOutcome): boolean {
+	return (
+		!outcome.ok &&
+		mayCleanCurrentStaging(outcome) &&
+		(outcome.reason === "atomic_unavailable" || outcome.reason === "invalid_request")
+	);
+}
+
 export type ManagedSessionSecurityPolicy = "default" | "windows-existing-verify-first";
 
 export type ManagedStorageFailure =
@@ -1580,6 +1596,7 @@ export async function publishManagedFileNoReplace(
 	let failure: unknown;
 	let outcome: NativePublishOutcome | undefined;
 	let renameAttempted = false;
+	let linkPublished = false;
 
 	try {
 		assertOwned?.();
@@ -1599,6 +1616,16 @@ export async function publishManagedFileNoReplace(
 
 		renameAttempted = true;
 		outcome = classifyNativePublishOutcome(renameNoReplacePath(staging, destination));
+		if (renameFlagsUnsupported(outcome)) {
+			// linkat publishes the destination without consuming the staging name, so the
+			// secured staging descriptor stays authoritative across publication exactly as
+			// it does across a rename. The staging link is removed in the finally block
+			// below, after that descriptor is closed: unlinking a still-open name on NFS
+			// silly-renames it instead of removing it, which would leave a second link on
+			// the published inode.
+			outcome = classifyNativePublishOutcome(linkNoReplacePath(staging, destination));
+			linkPublished = outcome.ok;
+		}
 
 		if (!outcome.ok) throw publishFailure(outcome);
 
@@ -1621,7 +1648,7 @@ export async function publishManagedFileNoReplace(
 	} finally {
 		if (fd !== undefined) fs.closeSync(fd);
 
-		if (stagingIdentity && (!renameAttempted || (outcome && mayCleanCurrentStaging(outcome)))) {
+		if (stagingIdentity && (linkPublished || !renameAttempted || (outcome && mayCleanCurrentStaging(outcome)))) {
 			await fsp
 				.lstat(staging, { bigint: true })
 				.then(stat => {
@@ -1649,6 +1676,7 @@ export function publishManagedFileNoReplaceSync(
 	let stagingIdentity: { dev: bigint; ino: bigint } | undefined;
 	let failure: unknown;
 	let outcome: NativePublishOutcome | undefined;
+	let linkPublished = false;
 
 	try {
 		fd = fs.openSync(
@@ -1665,6 +1693,12 @@ export function publishManagedFileNoReplaceSync(
 		stagingIdentity = { dev: staged.dev, ino: staged.ino };
 
 		outcome = classifyNativePublishOutcome(renameNoReplacePath(staging, destination));
+		if (renameFlagsUnsupported(outcome)) {
+			// See publishManagedFileNoReplace: the staging link outlives this publication
+			// and is removed only after the secured descriptor is closed.
+			outcome = classifyNativePublishOutcome(linkNoReplacePath(staging, destination));
+			linkPublished = outcome.ok;
+		}
 		if (!outcome.ok) throw publishFailure(outcome);
 
 		const named = fs.lstatSync(destination, { bigint: true });
@@ -1680,7 +1714,7 @@ export function publishManagedFileNoReplaceSync(
 	} finally {
 		if (fd !== undefined) fs.closeSync(fd);
 	}
-	if (stagingIdentity && outcome && mayCleanCurrentStaging(outcome)) {
+	if (stagingIdentity && (linkPublished || (outcome && mayCleanCurrentStaging(outcome)))) {
 		try {
 			const named = fs.lstatSync(staging, { bigint: true });
 			if (named.dev !== stagingIdentity.dev || named.ino !== stagingIdentity.ino) {

package/src/session/internal/native-publish-outcome.ts

@@ -16,6 +16,8 @@ export type NativePublishOperation = "direct_rename" | "retained_file" | "retain
 
 export type NativePublishPrimitive =
 	| "renameat2_noreplace"
+	| "linkat_noreplace"
+	| "mkdirat_renameat_noreplace"
 	| "renameatx_np_excl"
 	| "windows_rename_noreplace"
 	| "unsupported"
@@ -24,6 +26,7 @@ export type NativePublishPhase =
 	| "preflight"
 	| "file_sync"
 	| "rename"
+	| "source_unlink"
 	| "source_parent_sync"
 	| "destination_parent_sync"
 	| "terminal_identity"
@@ -83,6 +86,8 @@ const reasons = new Set<NativePublishReason>([
 ]);
 const primitives = new Set<NativePublishPrimitive>([
 	"renameat2_noreplace",
+	"linkat_noreplace",
+	"mkdirat_renameat_noreplace",
 	"renameatx_np_excl",
 	"windows_rename_noreplace",
 	"unsupported",
@@ -92,6 +97,7 @@ const phases = new Set<NativePublishPhase>([
 	"preflight",
 	"file_sync",
 	"rename",
+	"source_unlink",
 	"source_parent_sync",
 	"destination_parent_sync",
 	"terminal_identity",
@@ -204,7 +210,7 @@ function legalOutcome(outcome: NativePublishOutcome): boolean {
 		((outcome.reason === "durability_not_provable" &&
 			["file_sync", "source_parent_sync", "destination_parent_sync"].includes(outcome.phase)) ||
 			(outcome.reason === "identity_violation" && outcome.phase === "terminal_identity") ||
-			(outcome.reason === "io_failure" && outcome.phase === "terminal_identity"))
+			(outcome.reason === "io_failure" && ["source_unlink", "terminal_identity"].includes(outcome.phase)))
 	);
 }
 
@@ -247,8 +253,12 @@ export function classifyNativePublishOutcome(
 	const outcome = value as unknown as NativePublishOutcome;
 	if (!legalOutcome(outcome)) return malformed;
 	if (operation === "direct_rename") return outcome;
+	const retainedPrimitiveValid =
+		operation === "retained_file"
+			? outcome.primitive === "renameat2_noreplace" || outcome.primitive === "linkat_noreplace"
+			: outcome.primitive === "renameat2_noreplace" || outcome.primitive === "mkdirat_renameat_noreplace";
 	if (
-		outcome.primitive !== "renameat2_noreplace" ||
+		!retainedPrimitiveValid ||
 		(outcome.ok && (!outcome.identity || outcome.durabilityState !== "proven" || outcome.phase !== "complete"))
 	)
 		return malformed;

package/src/slash-commands/builtin-registry.ts

@@ -417,6 +417,9 @@ function modelSelectionUsage(runtime: SlashCommandRuntime, currentModelLine?: st
 		.join("\n\n");
 }
 
+/** Opt into the paste-a-code OAuth login for browsers that cannot reach this machine. */
+const MANUAL_LOGIN_FLAG = "--manual";
+
 const EFFORT_COMMAND_INPUT_HINT = "[inherit|off|minimal|low|medium|high|xhigh|max]";
 const EFFORT_COMMAND_ACCEPTED_VALUES = ["inherit", "off", "minimal", "low", "medium", "high", "xhigh", "max"] as const;
 
@@ -1364,20 +1367,45 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 	{
 		name: "login",
 		description: "Login with OAuth provider",
-		inlineHint: "[provider|redirect URL]",
+		inlineHint: "[provider|redirect URL] [--manual]",
 		allowArgs: true,
 		handleTui: (command, runtime) => {
 			const manualInput = runtime.ctx.oauthManualInput;
 			const args = command.args.trim();
+			const pendingLoginMessage = (): string => {
+				const pendingProvider = manualInput.pendingProviderId;
+				return pendingProvider
+					? `OAuth login already in progress for ${pendingProvider}. Paste the redirect URL with /login <url>.`
+					: "OAuth login already in progress. Paste the redirect URL with /login <url>.";
+			};
 			if (args.length > 0) {
+				const tokens = args.split(/\s+/);
+				// `--manual` is resolved before the paste fallback below, otherwise
+				// `/login anthropic --manual` would be submitted as an authorization code.
+				if (tokens.includes(MANUAL_LOGIN_FLAG)) {
+					const rest = tokens.filter(token => token !== MANUAL_LOGIN_FLAG);
+					const requestedProvider = rest.length === 1 ? rest[0] : undefined;
+					const manualProvider = requestedProvider
+						? getOAuthProviders().find(provider => provider.id === requestedProvider)
+						: undefined;
+					if (!manualProvider) {
+						runtime.ctx.showWarning(`Usage: /login <provider> ${MANUAL_LOGIN_FLAG}`);
+						runtime.ctx.editor.setText("");
+						return;
+					}
+					if (manualInput.hasPending()) {
+						runtime.ctx.showWarning(pendingLoginMessage());
+						runtime.ctx.editor.setText("");
+						return;
+					}
+					void runtime.ctx.showOAuthSelector("login", manualProvider.id, { manualCode: true });
+					runtime.ctx.editor.setText("");
+					return;
+				}
 				const matchedProvider = getOAuthProviders().find(provider => provider.id === args);
 				if (matchedProvider) {
 					if (manualInput.hasPending()) {
-						const pendingProvider = manualInput.pendingProviderId;
-						const message = pendingProvider
-							? `OAuth login already in progress for ${pendingProvider}. Paste the redirect URL with /login <url>.`
-							: "OAuth login already in progress. Paste the redirect URL with /login <url>.";
-						runtime.ctx.showWarning(message);
+						runtime.ctx.showWarning(pendingLoginMessage());
 						runtime.ctx.editor.setText("");
 						return;
 					}
@@ -1396,11 +1424,7 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 			}
 
 			if (manualInput.hasPending()) {
-				const provider = manualInput.pendingProviderId;
-				const message = provider
-					? `OAuth login already in progress for ${provider}. Paste the redirect URL with /login <url>.`
-					: "OAuth login already in progress. Paste the redirect URL with /login <url>.";
-				runtime.ctx.showWarning(message);
+				runtime.ctx.showWarning(pendingLoginMessage());
 				runtime.ctx.editor.setText("");
 				return;
 			}

package/src/system-prompt.ts

@@ -245,10 +245,14 @@ function dedupeExactContextFiles(
 		// Keep the closest matching context entry when content is byte-for-byte identical.
 		lastIndexByContent.set(file.content, index);
 	}
-
 	return contextFiles.filter((file, index) => lastIndexByContent.get(file.content) === index);
 }
 
+export interface ProjectContextFilesResult {
+	contextFiles: Array<{ path: string; content: string; depth?: number }>;
+	warnings: string[];
+}
+
 /**
  * Load all context files using the capability API.
  * Returns {path, content, depth} entries for all discovered context files.
@@ -257,11 +261,10 @@ function dedupeExactContextFiles(
  * prominent. User-home files from foreign providers (`~/.claude/CLAUDE.md`,
  * `~/.codex/AGENTS.md`, …) stay excluded — only gjc's own user config applies.
  */
-export async function loadProjectContextFiles(
+export async function loadProjectContextFilesResult(
 	options: LoadContextFilesOptions = {},
-): Promise<Array<{ path: string; content: string; depth?: number }>> {
+): Promise<ProjectContextFilesResult> {
 	const resolvedCwd = options.cwd ?? getProjectDir();
-
 	const result = await loadCapability(contextFileCapability.id, { cwd: resolvedCwd });
 	const items = result.items as ContextFile[];
 
@@ -288,7 +291,17 @@ export async function loadProjectContextFiles(
 		return depthB - depthA;
 	});
 
-	return dedupeExactContextFiles([...userFiles, ...projectFiles]);
+	return {
+		contextFiles: dedupeExactContextFiles([...userFiles, ...projectFiles]),
+		warnings: result.warnings,
+	};
+}
+
+/** Load project context files without exposing discovery diagnostics. */
+export async function loadProjectContextFiles(
+	options: LoadContextFilesOptions = {},
+): Promise<Array<{ path: string; content: string; depth?: number }>> {
+	return (await loadProjectContextFilesResult(options)).contextFiles;
 }
 
 /**
@@ -386,10 +399,11 @@ export interface BuildSystemPromptOptions {
 	subagent?: boolean;
 }
 
-/** Result of building provider-facing system prompt messages. */
 export interface BuildSystemPromptResult {
 	/** Ordered system prompt blocks. Providers should preserve entries as distinct messages/blocks. */
 	systemPrompt: string[];
+	/** Context-file discovery warnings visible to SDK and session callers. */
+	warnings: string[];
 }
 export interface BuildVolatileProjectContextOptions {
 	cwd?: string;
@@ -421,7 +435,7 @@ export function buildVolatileProjectContext(options: BuildVolatileProjectContext
 /** Build the system prompt with tools, guidelines, and context */
 export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}): Promise<BuildSystemPromptResult> {
 	if ($env.NULL_PROMPT === "true") {
-		return { systemPrompt: [] };
+		return { systemPrompt: [], warnings: [] };
 	}
 
 	const {
@@ -448,7 +462,7 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		resolvedCustomPrompt: undefined as string | undefined,
 		resolvedAppendPrompt: undefined as string | undefined,
 		systemPromptCustomization: null as string | null,
-		contextFiles: dedupeExactContextFiles(providedContextFiles ?? []),
+		contextFiles: { contextFiles: [] as Array<{ path: string; content: string; depth?: number }>, warnings: [] },
 		workspaceTree: {
 			rootPath: resolvedCwd,
 			rendered: "",
@@ -490,8 +504,8 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		cwd: resolvedCwd,
 	});
 	const contextFilesPromise = providedContextFiles
-		? Promise.resolve(providedContextFiles)
-		: logger.time("loadProjectContextFiles", loadProjectContextFiles, { cwd: resolvedCwd });
+		? Promise.resolve({ contextFiles: providedContextFiles, warnings: [] })
+		: logger.time("loadProjectContextFiles", loadProjectContextFilesResult, { cwd: resolvedCwd });
 	const workspaceTreePromise =
 		providedWorkspaceTree !== undefined
 			? Promise.resolve(providedWorkspaceTree)
@@ -499,7 +513,7 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 					buildWorkspaceTree(resolvedCwd, { timeoutMs: SYSTEM_PROMPT_PREP_TIMEOUT_MS }),
 				);
 
-	const [resolvedCustomPrompt, resolvedAppendPrompt, systemPromptCustomization, contextFiles, workspaceTree] =
+	const [resolvedCustomPrompt, resolvedAppendPrompt, systemPromptCustomization, contextFileResult, workspaceTree] =
 		await Promise.all([
 			withDeadline(
 				"customPrompt",
@@ -516,11 +530,10 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 				systemPromptCustomizationPromise,
 				prepDefaults.systemPromptCustomization,
 			),
-			withDeadline("loadProjectContextFiles", contextFilesPromise, prepDefaults.contextFiles).then(
-				dedupeExactContextFiles,
-			),
+			withDeadline("loadProjectContextFiles", contextFilesPromise, prepDefaults.contextFiles),
 			withDeadline("buildWorkspaceTree", workspaceTreePromise, prepDefaults.workspaceTree),
 		]);
+	const contextFiles = dedupeExactContextFiles(contextFileResult.contextFiles);
 	const agentsMdFiles = Array.from(new Set(workspaceTree.agentsMdFiles)).sort().slice(0, AGENTS_MD_LIMIT);
 
 	if (timedOut.length > 0) {
@@ -628,5 +641,5 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		systemPrompt.push(pluginAppendices.trim());
 	}
 
-	return { systemPrompt };
+	return { systemPrompt, warnings: contextFileResult.warnings };
 }

package/src/tools/bash.ts

@@ -982,8 +982,10 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			}
 		}
 
+		const activeModel = this.session.model;
 		const composerPolicy = checkComposerBashPolicy({
-			modelId: this.session.getActiveModelString?.() ?? this.session.getModelString?.() ?? this.session.model?.id,
+			modelId: this.session.getActiveModelString?.() ?? this.session.getModelString?.() ?? activeModel?.id,
+			provider: activeModel?.provider,
 			commands: rawCommand === command ? [command] : [rawCommand, command],
 		});
 		if (!composerPolicy.allowed) {

package/src/tools/composer-bash-policy.ts

@@ -1,7 +1,11 @@
-import { isComposerHarnessModel } from "@gajae-code/ai/providers/composer-discipline";
+import {
+	type ComposerBashPolicyToolSurface,
+	formatComposerBashPolicyError,
+	isComposerHarnessModel,
+} from "@gajae-code/ai/providers/composer-discipline";
 
-export const COMPOSER_BASH_POLICY_ERROR =
-	"Composer bash policy blocked repository file I/O. Use find, search, read, and edit tools for file discovery, file inspection, and file mutation.";
+export const COMPOSER_BASH_POLICY_ERROR = formatComposerBashPolicyError("generic");
+export const CURSOR_COMPOSER_BASH_POLICY_ERROR = formatComposerBashPolicyError("cursor");
 
 type ComposerBashPolicyResult =
 	| { allowed: true }
@@ -9,6 +13,7 @@ type ComposerBashPolicyResult =
 			allowed: false;
 			reason: string;
 			message: string;
+			surface: ComposerBashPolicyToolSurface;
 	  };
 
 const BLOCK_PATTERNS: Array<{ id: string; pattern: RegExp }> = [
@@ -77,19 +82,30 @@ export function isComposerBashPolicyModel(modelId: string | undefined): boolean
 	return Boolean(modelId && isComposerHarnessModel(modelId));
 }
 
+export function resolveComposerBashPolicyToolSurface(input: {
+	modelId?: string;
+	provider?: string;
+}): ComposerBashPolicyToolSurface {
+	if (input.provider?.toLowerCase() === "cursor") return "cursor";
+	return /(?:^|[/:._-])cursor(?:[/:._-]|$)/i.test(input.modelId ?? "") ? "cursor" : "generic";
+}
+
 export function checkComposerBashPolicy(input: {
 	modelId?: string;
+	provider?: string;
 	commands: readonly string[];
 }): ComposerBashPolicyResult {
 	if (!isComposerBashPolicyModel(input.modelId)) return { allowed: true };
+	const surface = resolveComposerBashPolicyToolSurface(input);
+	const message = formatComposerBashPolicyError(surface);
 	for (const command of input.commands) {
 		for (const block of BLOCK_PATTERNS) {
 			if (block.pattern.test(command)) {
-				return { allowed: false, reason: block.id, message: COMPOSER_BASH_POLICY_ERROR };
+				return { allowed: false, reason: block.id, message, surface };
 			}
 		}
 		if (!isAllowedComposerTerminalCommand(command)) {
-			return { allowed: false, reason: "not-allowlisted", message: COMPOSER_BASH_POLICY_ERROR };
+			return { allowed: false, reason: "not-allowlisted", message, surface };
 		}
 	}
 	return { allowed: true };

package/src/utils/command-args.ts

@@ -39,38 +39,27 @@ export function parseCommandArgs(argsString: string): string[] {
  * containing patterns like $1, $@, or $ARGUMENTS are NOT recursively substituted.
  */
 export function substituteArgs(content: string, args: string[]): string {
-	let result = content;
-
-	// Replace $1, $2, etc. with positional args FIRST (before wildcards)
-	// This prevents wildcard replacement values containing $<digit> patterns from being re-substituted
-	result = result.replace(/\$(\d+)/g, (_, num) => {
-		const index = parseInt(num, 10) - 1;
-		return args[index] ?? "";
-	});
-
-	result = result.replace(/\$@\[(\d+)(?::(\d*)?)?\]/g, (_, startRaw: string, lengthRaw?: string) => {
-		const start = Number.parseInt(startRaw, 10);
-		if (!Number.isFinite(start) || start < 1) return "";
-		const startIndex = start - 1;
-		if (startIndex >= args.length) return "";
-
-		if (lengthRaw === undefined || lengthRaw === "") {
-			return args.slice(startIndex).join(" ");
-		}
-
-		const length = Number.parseInt(lengthRaw, 10);
-		if (!Number.isFinite(length) || length <= 0) return "";
-		return args.slice(startIndex, startIndex + length).join(" ");
-	});
-
-	// Pre-compute all args joined (optimization)
 	const allArgs = args.join(" ");
+	return content.replace(
+		/\$@\[(\d+)(?::(\d*)?)?\]|\$ARGUMENTS|\$@|\$(\d+)/g,
+		(_, startRaw: string | undefined, lengthRaw: string | undefined, positionRaw: string | undefined) => {
+			if (positionRaw !== undefined) {
+				return args[Number.parseInt(positionRaw, 10) - 1] ?? "";
+			}
+			if (startRaw === undefined) return allArgs;
 
-	// Replace $ARGUMENTS with all args joined (new syntax, aligns with Anthropic model, OpenAI code backend, OpenCode)
-	result = result.replaceAll("$ARGUMENTS", allArgs);
+			const start = Number.parseInt(startRaw, 10);
+			if (!Number.isFinite(start) || start < 1) return "";
+			const startIndex = start - 1;
+			if (startIndex >= args.length) return "";
 
-	// Replace $@ with all args joined (existing syntax)
-	result = result.replaceAll("$@", allArgs);
+			if (lengthRaw === undefined || lengthRaw === "") {
+				return args.slice(startIndex).join(" ");
+			}
 
-	return result;
+			const length = Number.parseInt(lengthRaw, 10);
+			if (!Number.isFinite(length) || length <= 0) return "";
+			return args.slice(startIndex, startIndex + length).join(" ");
+		},
+	);
 }

package/src/utils/lang-from-path.ts

@@ -201,18 +201,16 @@ function lspExtensionKey(filePath: string): string {
  * Language id for syntax highlighting and UI (icons, read tool), or undefined if unknown.
  */
 export function getLanguageFromPath(filePath: string): string | undefined {
-	const pair = EXTENSION_LANG[themeExtensionKey(filePath)];
-	if (pair) return pair[0];
-
 	const baseName = path.basename(filePath).toLowerCase();
 	if (baseName.startsWith(".env.")) return "env";
 	if (baseName === "dockerfile" || baseName.startsWith("dockerfile.") || baseName === "containerfile") {
 		return "dockerfile";
 	}
+	if (baseName === "makefile" || baseName === "gnumakefile") return "make";
 	if (baseName === "justfile") return "just";
 	if (baseName === "cmakelists.txt") return "cmake";
 
-	return undefined;
+	return EXTENSION_LANG[themeExtensionKey(filePath)]?.[0];
 }
 
 /**