@gajae-code/coding-agent 0.13.3 → 0.14.0

package/src/capability/index.ts

@@ -212,7 +212,9 @@ async function loadImpl<T>(
 function filterProviders<T>(capability: Capability<T>, options: LoadOptions): Provider<T>[] {
 	const activeSettings = options.settings ?? settingsByCwd.get(path.normalize(options.cwd ?? getProjectDir()));
 	const activeDisabledProviders = new Set(activeSettings?.get("disabledProviders") ?? disabledProviders);
-	let providers = (capability.providers as Provider<T>[]).filter(p => !activeDisabledProviders.has(p.id));
+	let providers = (capability.providers as Provider<T>[]).filter(
+		p => options.includeDisabledProviders === true || !activeDisabledProviders.has(p.id),
+	);
 	if (options.providers) {
 		const allowed = new Set(options.providers);
 		providers = providers.filter(p => allowed.has(p.id));

package/src/capability/mcp.ts

@@ -21,6 +21,12 @@ export interface MCPServer {
 	/** MCP connection pool identity mode; defaults to one lease per session. */
 	sharing?: "per-session" | "shared";
 	timeout?: number;
+	/**
+	 * Protocol preference for remote (http/sse) servers: `auto` (default) negotiates
+	 * MCP 2026-07-28 (stateless) first with a bounded observable legacy fallback,
+	 * `2026-07-28` is strict modern-only, `legacy` forces the compatibility handshake.
+	 */
+	protocol?: "auto" | "2026-07-28" | "legacy";
 	/** Command to run (for stdio transport) */
 	command?: string;
 	/** Command arguments */

package/src/capability/types.ts

@@ -71,6 +71,12 @@ export interface LoadOptions {
 	includeInvalid?: boolean;
 	/** Include items disabled via settings. Default: false */
 	includeDisabled?: boolean;
+	/**
+	 * Include providers disabled via settings (for diagnostics). Default: false.
+	 * Items loaded from a disabled provider are not marked by the registry; callers
+	 * compare `_source.provider` against the disabled-provider set themselves.
+	 */
+	includeDisabledProviders?: boolean;
 	/** Explicit disabled extension IDs to apply instead of settings. */
 	disabledExtensions?: string[];
 	/** Session settings whose provider policy applies to this load. */

package/src/cli/accounts-cli.ts

@@ -0,0 +1,395 @@
+/**
+ * Handlers for the sole account-management CLI namespace (`gjc accounts`).
+ *
+ * This surface deliberately consumes AuthStorage's payload-free inventory APIs.
+ * Credential payloads are never rendered or copied into settings; persistent pins
+ * are written as canonical `id:<row-id>` selectors only.
+ */
+import {
+	type AuthCredentialSelector,
+	type AuthStorage,
+	type CredentialInventoryRecord,
+	type CredentialRemovalTarget,
+	resolveOAuthStorageProvider,
+} from "@gajae-code/ai/core";
+import { getAgentDir } from "@gajae-code/utils";
+import { ModelRegistry } from "../config/model-registry";
+import { type RawSettings, Settings, type SettingsAtomicPatch } from "../config/settings";
+import { discoverAuthStorage } from "../sdk/session";
+import {
+	buildAccountInventorySnapshot,
+	checkAccountInventory,
+	clearPersistentPinForRemovedRows,
+} from "../session/account-inventory";
+import { resolveStartupAuthConfig, type StartupAuthConfigSnapshot } from "../session/startup-auth-config";
+
+export const ACCOUNTS_ACTIONS = ["list", "check", "pin", "logout"] as const;
+export type AccountsAction = (typeof ACCOUNTS_ACTIONS)[number];
+
+export interface AccountsCommandArgs {
+	action: AccountsAction;
+	provider?: string;
+	selector?: string;
+	flags: {
+		json?: boolean;
+		persistent?: boolean;
+		clear?: boolean;
+		account?: string;
+		all?: boolean;
+	};
+}
+
+class AccountsCommandError extends Error {
+	constructor(message: string) {
+		super(message);
+		this.name = "AccountsCommandError";
+	}
+}
+
+function writeJson(value: unknown): void {
+	process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+
+function writeText(lines: readonly string[]): void {
+	process.stdout.write(`${lines.join("\n")}\n`);
+}
+
+function asRecord(value: unknown): Record<string, unknown> | undefined {
+	return value !== null && typeof value === "object" && !Array.isArray(value)
+		? (value as Record<string, unknown>)
+		: undefined;
+}
+
+function cleanReason(value: unknown): string | undefined {
+	if (value === undefined || value === null) return undefined;
+	let reason = value instanceof Error ? value.message : String(value);
+	reason = reason.replace(/bearer\s+[^\s,;]+/gi, "Bearer [redacted]");
+	reason = reason.replace(/(api[_-]?key|token|secret|authorization)[=:]\s*[^\s,;]+/gi, "$1=[redacted]");
+	reason = reason.replace(/[\r\n\t ]+/g, " ").trim();
+	if (reason.length > 256) reason = `${reason.slice(0, 253)}...`;
+	return reason || undefined;
+}
+
+function canonicalProvider(provider: string | undefined): string {
+	const value = provider?.trim();
+	if (!value) throw new AccountsCommandError("A provider is required.");
+	if (/[\u0000-\u001f\u007f]/u.test(value))
+		throw new AccountsCommandError("Provider contains invalid control characters.");
+	return resolveOAuthStorageProvider(value);
+}
+
+function selectorFromInput(raw: string | undefined): AuthCredentialSelector {
+	const value = raw?.trim() ?? "";
+	if (/^id:[1-9]\d*$/.test(value)) return { kind: "id", value: value.slice(3) };
+	if (/^email:[^@\s]+@[^@\s]+$/.test(value)) return { kind: "email", value: value.slice(6) };
+	if (/^account:\S+$/.test(value)) return { kind: "account", value: value.slice(8) };
+	if (/^[^@\s]+@[^@\s]+$/.test(value)) return { kind: "email", value };
+	throw new AccountsCommandError(
+		"Pin target must be a bare email or an id:<row-id>, email:<email>, or account:<account-id> selector.",
+	);
+}
+
+function inventoryIdentity(row: CredentialInventoryRecord): string | undefined {
+	return typeof row.identityLabel === "string" ? row.identityLabel : undefined;
+}
+
+function formatCandidate(row: CredentialInventoryRecord): string {
+	const identity = inventoryIdentity(row) ?? "(no identity)";
+	return `  id=${row.id} ${identity}${row.disabled ? " [disabled]" : ""}`;
+}
+
+async function withAuthStorageAndModels<T>(
+	callback: (storage: AuthStorage, modelRegistry: ModelRegistry, startupAuth: StartupAuthConfigSnapshot) => Promise<T>,
+): Promise<T> {
+	const startupAuth = await resolveStartupAuthConfig();
+	const storage = await discoverAuthStorage(getAgentDir(), startupAuth);
+	const modelRegistry = new ModelRegistry(storage);
+	try {
+		await modelRegistry.refresh("offline");
+		return await callback(storage, modelRegistry, startupAuth);
+	} finally {
+		storage.close();
+	}
+}
+
+async function runList(flags: AccountsCommandArgs["flags"]): Promise<void> {
+	await withAuthStorageAndModels(async (storage, modelRegistry) => {
+		const snapshot = buildAccountInventorySnapshot({ authStorage: storage, modelRegistry });
+		const accounts = snapshot.rows;
+		if (flags.json) {
+			writeJson({ ok: true, generatedAt: snapshot.generatedAt, generation: snapshot.generation, accounts });
+			return;
+		}
+		if (accounts.length === 0) {
+			writeText(["No stored accounts or configured API-key sources."]);
+			return;
+		}
+		writeText(
+			accounts.map(account => {
+				const identity = account.identityLabel ?? "(no identity)";
+				const usage = account.usage?.freshness ?? "unknown";
+				const health = account.health.status;
+				return `${account.provider}\tid=${account.id}\t${account.credentialKind}\t${identity}\t${account.source}\t${
+					account.disabled ? "disabled" : "active"
+				}\thealth=${health}\tusage=${usage}`;
+			}),
+		);
+	});
+}
+
+async function runCheck(providerArg: string | undefined, flags: AccountsCommandArgs["flags"]): Promise<void> {
+	const provider = providerArg ? canonicalProvider(providerArg) : undefined;
+	await withAuthStorageAndModels(async (storage, modelRegistry) => {
+		const snapshot = await checkAccountInventory({
+			authStorage: storage,
+			modelRegistry,
+			provider,
+		});
+		const checks = snapshot.rows
+			.filter(row => provider === undefined || row.provider === provider)
+			.map(row => ({
+				id: row.id,
+				provider: row.provider,
+				kind: row.credentialKind,
+				source: row.source,
+				...(row.identityLabel ? { identity: row.identityLabel } : {}),
+				ok: row.health.status === "ok" ? true : row.health.status === "failed" ? false : null,
+				status: row.health.status === "ok" ? "ok" : row.health.status === "failed" ? "failed" : "unknown",
+				...(cleanReason(row.health.reason) ? { reason: cleanReason(row.health.reason) } : {}),
+			}));
+		if (flags.json) {
+			writeJson({ ok: true, ...(provider ? { provider } : {}), checks });
+		} else if (checks.length === 0) {
+			writeText([provider ? `No account sources for ${provider}.` : "No account sources."]);
+		} else {
+			writeText(
+				checks.map(check => {
+					const identity = check.identity ?? "(no identity)";
+					const reason = check.reason ? ` — ${check.reason}` : "";
+					return `${check.provider}\tid=${check.id}\t${check.kind}\t${check.source}\t${identity}\t${check.status}${reason}`;
+				}),
+			);
+		}
+		if (checks.some(check => check.ok === false)) process.exitCode = 1;
+	});
+}
+
+function assertPersistent(flags: AccountsCommandArgs["flags"]): void {
+	if (!flags.persistent) {
+		throw new AccountsCommandError("Persistent account pinning requires --persistent.");
+	}
+}
+
+function pinsFromCurrent(current: Readonly<RawSettings>): Record<string, string> {
+	const auth = current.auth;
+	if (auth === undefined) return {};
+	const authRecord = asRecord(auth);
+	if (!authRecord) throw new AccountsCommandError("Global auth configuration is malformed; no pin was written.");
+	const rawPins = authRecord.credentialPins;
+	if (rawPins === undefined) return {};
+	const pins = asRecord(rawPins);
+	if (!pins || Object.values(pins).some(value => typeof value !== "string")) {
+		throw new AccountsCommandError("Global auth.credentialPins is malformed; no pin was written.");
+	}
+	return Object.fromEntries(Object.entries(pins).map(([key, value]) => [key, String(value).trim()]));
+}
+
+async function writePersistentPin(
+	provider: string,
+	selector: string | undefined,
+	clear: boolean,
+	credentialStoreIdentity?: string,
+): Promise<void> {
+	const settings = await Settings.init();
+	await settings.commitAtomicBatchWithCurrent(current => {
+		const pins = pinsFromCurrent(current);
+		const currentAuth = asRecord(current.auth);
+		const existingStoreIdentity =
+			typeof currentAuth?.credentialPinStoreIdentity === "string"
+				? currentAuth.credentialPinStoreIdentity.trim()
+				: undefined;
+		if (
+			Object.values(pins).some(value => value.startsWith("id:")) &&
+			credentialStoreIdentity &&
+			existingStoreIdentity !== credentialStoreIdentity
+		) {
+			for (const [pinnedProvider, pinnedSelector] of Object.entries(pins)) {
+				if (pinnedSelector.startsWith("id:")) delete pins[pinnedProvider];
+			}
+		}
+		if (clear) delete pins[provider];
+		else if (selector) pins[provider] = selector;
+		const patches: SettingsAtomicPatch[] = [{ path: "auth.credentialPins", op: "set", value: pins }];
+		const hasNumericPins = Object.values(pins).some(value => value.startsWith("id:"));
+		if (hasNumericPins) {
+			if (credentialStoreIdentity && (!existingStoreIdentity || existingStoreIdentity === credentialStoreIdentity)) {
+				patches.push({ path: "auth.credentialPinStoreIdentity", op: "set", value: credentialStoreIdentity });
+			} else if (!clear) {
+				throw new AccountsCommandError(
+					"Numeric persistent pins require a credential-store identity; no pin was written.",
+				);
+			}
+		} else {
+			patches.push({ path: "auth.credentialPinStoreIdentity", op: "unset" });
+		}
+		return patches;
+	});
+}
+
+async function runPin(
+	providerArg: string | undefined,
+	selectorArg: string | undefined,
+	flags: AccountsCommandArgs["flags"],
+): Promise<void> {
+	assertPersistent(flags);
+	const provider = canonicalProvider(providerArg);
+	if (flags.clear && selectorArg) {
+		throw new AccountsCommandError("Use either a pin selector or --clear, not both.");
+	}
+	if (!flags.clear && !selectorArg) {
+		throw new AccountsCommandError("Pin requires a selector, or use --clear to remove the persistent pin.");
+	}
+	if (flags.clear) {
+		await writePersistentPin(provider, undefined, true);
+		if (flags.json) writeJson({ ok: true, provider, cleared: true });
+		else writeText([`Cleared persistent account pin for ${provider}.`]);
+		return;
+	}
+
+	const selector = selectorFromInput(selectorArg);
+	await withAuthStorageAndModels(async (storage, modelRegistry, startupAuth) => {
+		if (
+			!modelRegistry.getConfiguredProviderIds().includes(provider) &&
+			modelRegistry.getAll().every(model => model.provider !== provider)
+		) {
+			throw new AccountsCommandError(`Provider ${provider} is not configured; no pin was written.`);
+		}
+		const target = storage.resolveOAuthPinTarget(provider, selector);
+		const canonicalSelector = `${target.canonicalSelector.kind}:${target.canonicalSelector.value}`;
+		await writePersistentPin(provider, canonicalSelector, false, startupAuth.credentialStoreIdentity);
+		if (flags.json) writeJson({ ok: true, provider, selector: canonicalSelector });
+		else writeText([`Pinned ${provider} to ${canonicalSelector}.`]);
+	});
+}
+
+function accountMatches(row: CredentialInventoryRecord, rawAccount: string): boolean {
+	const value = rawAccount.trim();
+	if (value.length === 0) return false;
+	if (/^[1-9]\d*$/.test(value) && row.id === Number(value)) return true;
+	const identity = inventoryIdentity(row);
+	return identity?.toLowerCase() === value.toLowerCase();
+}
+
+function removalCandidates(
+	inventory: readonly CredentialInventoryRecord[],
+	targets: readonly CredentialRemovalTarget[],
+): Array<{ row: CredentialInventoryRecord; target: CredentialRemovalTarget }> {
+	const targetById = new Map(targets.map(target => [target.id, target]));
+	return inventory
+		.filter(row => row.credentialKind === "oauth")
+		.map(row => ({ row, target: targetById.get(row.id) }))
+		.filter((entry): entry is { row: CredentialInventoryRecord; target: CredentialRemovalTarget } => !!entry.target);
+}
+
+function throwLogoutResolutionError(
+	provider: string,
+	account: string | undefined,
+	candidates: readonly { row: CredentialInventoryRecord; target: CredentialRemovalTarget }[],
+): never {
+	const lines =
+		candidates.length > 0
+			? ["Safe candidates:", ...candidates.map(candidate => formatCandidate(candidate.row))]
+			: ["No OAuth account candidates found."];
+	const prefix = account
+		? `Account ${JSON.stringify(account)} for ${provider} was missing or ambiguous.`
+		: `No removable OAuth accounts found for ${provider}.`;
+	throw new AccountsCommandError(`${prefix} No credentials were removed.\n${lines.join("\n")}`);
+}
+
+async function runLogout(providerArg: string | undefined, flags: AccountsCommandArgs["flags"]): Promise<void> {
+	const provider = canonicalProvider(providerArg);
+	if ((flags.all ? 1 : 0) + (flags.account ? 1 : 0) !== 1) {
+		throw new AccountsCommandError("Logout requires exactly one of --account <id|email> or --all.");
+	}
+	const startupAuth = await resolveStartupAuthConfig();
+	if (startupAuth.broker) {
+		throw new AccountsCommandError(
+			"`gjc accounts logout` only mutates local credentials. A broker/gateway is configured; run logout on the broker host with `gjc auth-broker` or unset the broker configuration. No credentials were removed.",
+		);
+	}
+	const storage = await discoverAuthStorage(getAgentDir(), startupAuth);
+	try {
+		const inventory = storage.listCredentialInventory(provider);
+		const targets = removalCandidates(inventory, storage.listCredentialRemovalTargets(provider));
+		const selected = flags.all
+			? targets
+			: targets.filter(candidate => accountMatches(candidate.row, flags.account ?? ""));
+		if (selected.length !== 1 && !flags.all) throwLogoutResolutionError(provider, flags.account, targets);
+		if (selected.length === 0) throwLogoutResolutionError(provider, flags.account, targets);
+		const result = storage.removeAuthCredentialsHard(
+			provider,
+			selected.map(candidate => candidate.target),
+		);
+		if (result.kind !== "removed") {
+			throw new AccountsCommandError(
+				`Account inventory changed before logout; no credentials were removed. Retry and choose from current candidates (ids: ${result.currentIds.join(", ") || "none"}).`,
+			);
+		}
+		const settings = await Settings.init();
+		await clearPersistentPinForRemovedRows(settings, provider, inventory, result.ids);
+		if (flags.json) writeJson({ ok: true, provider, removedIds: [...result.ids] });
+		else
+			writeText([
+				`Removed ${result.ids.length} OAuth account${result.ids.length === 1 ? "" : "s"} from ${provider}.`,
+			]);
+	} finally {
+		storage.close();
+	}
+}
+
+function writeJsonFailure(error: unknown): void {
+	// Machine contract: exactly one JSON document on stdout, never secrets/stacks.
+	if (error instanceof AccountsCommandError) {
+		writeJson({ ok: false, error: { code: "accounts-error", message: cleanReason(error) ?? "Command failed." } });
+		return;
+	}
+	writeJson({
+		ok: false,
+		error: { code: "internal-error", message: "Accounts command failed; see stderr for diagnostics." },
+	});
+}
+
+export async function runAccountsCommand(cmd: AccountsCommandArgs): Promise<void> {
+	try {
+		switch (cmd.action) {
+			case "list":
+				await runList(cmd.flags);
+				return;
+			case "check":
+				await runCheck(cmd.provider, cmd.flags);
+				return;
+			case "pin":
+				await runPin(cmd.provider, cmd.selector, cmd.flags);
+				return;
+			case "logout":
+				await runLogout(cmd.provider, cmd.flags);
+				return;
+			default: {
+				const exhaustive: never = cmd.action;
+				throw new AccountsCommandError(`Unknown accounts action: ${String(exhaustive)}`);
+			}
+		}
+	} catch (error) {
+		if (cmd.flags.json) {
+			if (!(error instanceof AccountsCommandError)) {
+				process.stderr.write(`accounts command failed: ${cleanReason(error) ?? "Command failed."}\n`);
+			}
+			process.exitCode = 1;
+			writeJsonFailure(error);
+			return;
+		}
+		throw error;
+	}
+}
+
+export { AccountsCommandError };

package/src/cli/args.ts

@@ -47,11 +47,14 @@ export interface Args {
 	default?: boolean;
 	apiKey?: string;
 	credential?: string;
+	preferCredential?: string;
 	systemPrompt?: string;
 	appendSystemPrompt?: string;
 	clipboardTransport?: "auto" | "native" | "osc52" | "ssh";
 	clipboardSshHost?: string;
 	mcpConfig?: string;
+	/** Opt a standalone session out of conventional MCP autoload (mutually exclusive with --mcp-config). */
+	noMcp?: boolean;
 	thinking?: Effort;
 	continue?: boolean;
 	resume?: string | true;
@@ -223,6 +226,12 @@ export function parseArgs(args: string[], authority: ParseArgsAuthority = "local
 				throw new CliParseError("--credential requires <selector>");
 			}
 			result.credential = args[++i];
+		} else if (arg === "--prefer-credential") {
+			const next = args[i + 1];
+			if (!next || next.startsWith("-")) {
+				throw new CliParseError("--prefer-credential requires <selector>");
+			}
+			result.preferCredential = args[++i];
 		} else if (arg === "--system-prompt") {
 			result.systemPrompt = takePromptValue(args, i++, "--system-prompt", hasInlineValue);
 		} else if (arg === "--append-system-prompt") {
@@ -253,11 +262,19 @@ export function parseArgs(args: string[], authority: ParseArgsAuthority = "local
 			if (result.mcpConfig !== undefined) {
 				throw new CliParseError("--mcp-config can only be specified once");
 			}
+			if (result.noMcp === true) {
+				throw new CliParseError("--no-mcp and --mcp-config are mutually exclusive");
+			}
 			const next = args[i + 1];
 			if (!next || next.startsWith("-") || !path.isAbsolute(next)) {
 				throw new CliParseError("--mcp-config requires <absolute-path>");
 			}
 			result.mcpConfig = args[++i];
+		} else if (arg === "--no-mcp") {
+			result.noMcp = true;
+			if (result.mcpConfig !== undefined) {
+				throw new CliParseError("--no-mcp and --mcp-config are mutually exclusive");
+			}
 		} else if (arg === "--provider-session-id") {
 			result.providerSessionId = takeFlagValue(args, i++, "--provider-session-id");
 		} else if (arg === "--no-session") {
@@ -357,6 +374,12 @@ export function parseArgs(args: string[], authority: ParseArgsAuthority = "local
 	if (result.default && !result.mpreset) {
 		throw new CliParseError("--default requires --mpreset <name>");
 	}
+	if (result.credential && result.preferCredential) {
+		throw new CliParseError("--credential and --prefer-credential cannot be used together");
+	}
+	if (result.apiKey && result.preferCredential) {
+		throw new CliParseError("--api-key and --prefer-credential cannot be used together");
+	}
 	if (result.mcpConfig !== undefined && (result.listModels !== undefined || result.export !== undefined)) {
 		throw new CliParseError(
 			"--mcp-config is only supported in standalone interactive, tmux, print, text, or json modes.",