@gajae-code/coding-agent 0.14.2 → 0.15.0

package/src/modes/controllers/runtime-mcp-command-controller.ts

@@ -504,6 +504,10 @@ export class MCPCommandController {
 		);
 
 		// Replace editor with wizard
+		// The composer is reusable across overlays; detach it before clearing so
+		// clear() disposes only the transient wizard, not the editor's
+		// tab-width listener / paste state (disposal is terminal).
+		this.ctx.editorContainer.detachChild(this.ctx.editor);
 		this.ctx.editorContainer.clear();
 		this.ctx.editorContainer.addChild(wizard);
 		this.ctx.ui.setFocus(wizard);

package/src/modes/controllers/selector-controller.ts

@@ -12,6 +12,16 @@ import type { OAuthProvider } from "@gajae-code/ai/utils/oauth/types";
 import type { Component, OverlayHandle, SlashCommand } from "@gajae-code/tui";
 import { Input, Loader, resolvePetMode, Spacer, Text } from "@gajae-code/tui";
 import { getAgentDbPath, getProjectDir, logger, VERSION } from "@gajae-code/utils";
+import {
+	type AutoroutingProvenance,
+	type AutoroutingSetup,
+	buildAutoroutingEnabledPatch,
+	buildAutoroutingSettingsBatch,
+	evaluateAutoroutingProvenanceState,
+	validateAutoroutingSetup,
+} from "../../config/autorouting-contract";
+import { canonicalJsonBytes, generateTierChains } from "../../config/autorouting-generator";
+import { CURATED_TIER_MAP } from "../../config/autorouting-tier-map";
 import type { AppKeybinding } from "../../config/keybindings";
 import {
 	activateModelProfile,
@@ -26,7 +36,7 @@ import { GJC_MODEL_ASSIGNMENT_TARGETS, type GjcModelAssignmentTargetId } from ".
 import { formatModelSelectorValue } from "../../config/model-resolver";
 import { selectorHead } from "../../config/model-selector-value";
 import type { ModelProfileConfig } from "../../config/models-config-schema";
-import { type Settings, type SettingsAtomicReceipt, settings } from "../../config/settings";
+import { type RawSettings, type Settings, type SettingsAtomicReceipt, settings } from "../../config/settings";
 import type { SettingValue } from "../../config/settings-schema";
 import { DebugSelectorComponent } from "../../debug";
 import { disableProvider, enableProvider } from "../../discovery";
@@ -167,7 +177,6 @@ import {
 	PlanPreviewOverlay,
 	type PlanPreviewResult,
 } from "../components/plan-preview-overlay";
-
 import { PluginSelectorComponent } from "../components/plugin-selector";
 import {
 	type ProviderOnboardingAction,
@@ -179,6 +188,7 @@ import { SessionObserverOverlayComponent } from "../components/session-observer-
 import { SessionSelectorComponent } from "../components/session-selector";
 import { dashboardSessions, SessionsDashboardComponent } from "../components/sessions-dashboard";
 import { SettingsSelectorComponent } from "../components/settings-selector";
+import type { SmartRoutingPreview } from "../components/smart-routing-panel";
 import { TasksPaneComponent } from "../components/tasks-pane";
 import { ThemeSelectorComponent } from "../components/theme-selector";
 import { ThinkingSelectorComponent } from "../components/thinking-selector";
@@ -1176,7 +1186,36 @@ interface DefaultAssignmentRollbackSnapshot {
 	resumeDefaultSelector: string | undefined;
 	fallbackRuntimeState: DefaultFallbackRuntimeState;
 }
+
+function sameCanonicalAutoroutingValue(left: unknown, right: unknown): boolean {
+	const leftBytes = canonicalJsonBytes(left);
+	const rightBytes = canonicalJsonBytes(right);
+	if (leftBytes.length !== rightBytes.length) return false;
+	for (let index = 0; index < leftBytes.length; index++) {
+		if (leftBytes[index] !== rightBytes[index]) return false;
+	}
+	return true;
+}
+
+function rawAutoroutingState(current: RawSettings): {
+	provenance?: AutoroutingProvenance;
+	setup?: AutoroutingSetup;
+	tiers?: unknown;
+} {
+	const task = current.task;
+	if (!task || typeof task !== "object" || Array.isArray(task)) return {};
+	const autorouting = (task as Record<string, unknown>).autorouting;
+	if (!autorouting || typeof autorouting !== "object" || Array.isArray(autorouting)) return {};
+	const record = autorouting as Record<string, unknown>;
+	return {
+		provenance: record.provenance as AutoroutingProvenance | undefined,
+		setup: record.setup as AutoroutingSetup | undefined,
+		tiers: record.tiers,
+	};
+}
+
 export class SelectorController {
+	#smartRoutingInFlight?: Promise<unknown>;
 	#transcriptViewerOpen = false;
 	#transcriptViewer?: TranscriptViewerOverlay;
 	#sessionsDashboardOpen = false;
@@ -1338,6 +1377,10 @@ export class SelectorController {
 			}
 		};
 		const { component, focus } = create(done);
+		// The composer is reusable across overlays; detach it before clearing so
+		// clear() disposes only the transient overlay, not the editor's
+		// tab-width listener / paste state (disposal is terminal).
+		this.ctx.editorContainer.detachChild(this.ctx.editor);
 		this.ctx.editorContainer.clear();
 		this.ctx.editorContainer.addChild(component);
 		this.ctx.ui.setFocus(focus);
@@ -2274,7 +2317,208 @@ export class SelectorController {
 		this.ctx.showStatus(persistDefault ? `Default model profile: ${profileLabel}` : `Model profile: ${profileLabel}`);
 	}
 
-	showModelSelector(options?: { temporaryOnly?: boolean }): void {
+	/** Generate the immutable preview used by the smart-routing panel. */
+	previewSmartRouting(draft: AutoroutingSetup): SmartRoutingPreview {
+		const issues = validateAutoroutingSetup(draft);
+		if (issues.length > 0)
+			throw new Error(issues.map(issue => `${issue.path || "setup"}: ${issue.detail}`).join("; "));
+		const setup = structuredClone(draft);
+		const generated = generateTierChains(setup, CURATED_TIER_MAP, [...this.ctx.session.modelRegistry.getAll()]);
+		const provenance: AutoroutingProvenance = {
+			schema: 1,
+			source: structuredClone(generated.sourceIdentity),
+			declarationFingerprint: generated.declarationFingerprint,
+			tiersFingerprint: generated.tiersFingerprint,
+		};
+		return {
+			setup,
+			tiers: structuredClone(generated.tiers),
+			provenance,
+			sourceIdentity: structuredClone(generated.sourceIdentity),
+		};
+	}
+
+	#assertSmartRoutingWritable(): void {
+		if ((this.ctx.session.scopedModels?.length ?? 0) > 0) {
+			throw new Error("Smart-routing settings are read-only in a --models-scoped session.");
+		}
+		if (!this.ctx.settings.canWriteDurableConfig()) {
+			throw new Error("Cannot change smart-routing settings while durable config is unavailable.");
+		}
+	}
+
+	#assertSmartRoutingNotHandEdited(
+		preview: SmartRoutingPreview,
+		allowHandEdit: boolean,
+		current?: { provenance?: AutoroutingProvenance; tiers?: unknown },
+	): void {
+		if (allowHandEdit) return;
+		const provenance = current?.provenance ?? this.ctx.settings.get("task.autorouting.provenance");
+		const currentTiers = current?.tiers ?? this.ctx.settings.get("task.autorouting.tiers");
+		if (!provenance || currentTiers === undefined) return;
+		const state = evaluateAutoroutingProvenanceState(provenance, {
+			catalogFingerprint: preview.sourceIdentity.catalogFingerprint,
+			mapFingerprint: preview.sourceIdentity.mapFingerprint,
+			tiers: currentTiers,
+		});
+		if (!state.handEdited) return;
+		throw Object.assign(
+			new Error("Generated autorouting tiers were hand-edited; explicit confirmation is required."),
+			{ code: "autorouting-hand-edited" },
+		);
+	}
+
+	async #runSmartRoutingIntent<T>(label: string, operation: () => Promise<T>): Promise<T> {
+		if (this.#smartRoutingInFlight) throw new Error("Another smart-routing operation is already in progress.");
+		const task = (async () => {
+			this.ctx.showStatus(`${label} smart-routing settings…`);
+			try {
+				const result = await operation();
+				await this.ctx.notifyConfigChanged?.();
+				this.ctx.showStatus(`${label} smart-routing settings saved.`);
+				this.ctx.ui.requestRender();
+				return result;
+			} catch (error) {
+				this.ctx.showError(error instanceof Error ? error.message : String(error));
+				this.ctx.ui.requestRender();
+				throw error;
+			} finally {
+				this.#smartRoutingInFlight = undefined;
+			}
+		})();
+		this.#smartRoutingInFlight = task;
+		return task;
+	}
+	#reportSmartRoutingValidationError(error: unknown): never {
+		this.ctx.showError(error instanceof Error ? error.message : String(error));
+		this.ctx.ui.requestRender();
+		throw error;
+	}
+
+	async applySmartRouting(
+		draft: AutoroutingSetup,
+		options?: { preview?: SmartRoutingPreview; confirmHandEdit?: boolean },
+	): Promise<SmartRoutingPreview> {
+		let preview: SmartRoutingPreview;
+		try {
+			this.#assertSmartRoutingWritable();
+			const issues = validateAutoroutingSetup(draft);
+			if (issues.length > 0) {
+				throw new Error(issues.map(issue => `${issue.path || "setup"}: ${issue.detail}`).join("; "));
+			}
+			preview = options?.preview ?? this.previewSmartRouting(draft);
+			const regenerated = this.previewSmartRouting(draft);
+			if (!sameCanonicalAutoroutingValue(preview.setup, regenerated.setup)) {
+				throw new Error("Smart-routing preview does not match the draft being applied.");
+			}
+			if (
+				!sameCanonicalAutoroutingValue(preview.tiers, regenerated.tiers) ||
+				!sameCanonicalAutoroutingValue(preview.provenance, regenerated.provenance)
+			) {
+				// Never persist caller-supplied tier/provenance bytes that diverge from
+				// the declaration. Continue with the fresh canonical payload so Apply
+				// remains exactly the generated preview for legitimate callers.
+				preview = regenerated;
+			}
+			this.#assertSmartRoutingNotHandEdited(preview, options?.confirmHandEdit === true);
+		} catch (error) {
+			return this.#reportSmartRoutingValidationError(error);
+		}
+		return this.#runSmartRoutingIntent("Apply", async () => {
+			await this.ctx.settings.commitAtomicBatchWithCurrent(current => {
+				this.#assertSmartRoutingNotHandEdited(
+					preview,
+					options?.confirmHandEdit === true,
+					rawAutoroutingState(current),
+				);
+				return buildAutoroutingSettingsBatch({
+					tiers: preview.tiers,
+					setup: preview.setup,
+					provenance: preview.provenance,
+				});
+			});
+			return preview;
+		});
+	}
+
+	/**
+	 * Reorder a recorded declaration into current provider priority and drop entries
+	 * the catalog no longer offers. Comparison uses normalized ids while the result
+	 * keeps the catalog's spelling, because the generator matches provider prefixes
+	 * case-sensitively.
+	 */
+	#reseedProvidersFromPolicy(setup: AutoroutingSetup): AutoroutingSetup {
+		const order = this.ctx.session.modelRegistry.autoroutingProviderOrder();
+		const declared = new Set(setup.providers.map(provider => provider.trim().toLowerCase()));
+		const providers = order.filter(provider => declared.has(provider.trim().toLowerCase()));
+		return { ...structuredClone(setup), providers };
+	}
+
+	async refreshSmartRouting(options?: { confirmHandEdit?: boolean }): Promise<SmartRoutingPreview> {
+		let preview: SmartRoutingPreview;
+		let expectedSetup: AutoroutingSetup;
+		try {
+			this.#assertSmartRoutingWritable();
+			const setup = this.ctx.settings.get("task.autorouting.setup");
+			const issues = validateAutoroutingSetup(setup);
+			if (issues.length > 0 || setup === undefined) {
+				throw new Error("Cannot refresh smart routing without a valid recorded setup.");
+			}
+			expectedSetup = setup;
+			// Reseed the recorded declaration against the current provider priority:
+			// reorder to policy order and drop providers the catalog no longer offers.
+			// Refusing an empty result keeps a dead declaration from being persisted.
+			const reseeded = this.#reseedProvidersFromPolicy(setup);
+			if (reseeded.providers.length === 0) {
+				throw new Error("No declared providers remain in the catalog; smart routing was not updated.");
+			}
+			preview = this.previewSmartRouting(reseeded);
+			this.#assertSmartRoutingNotHandEdited(preview, options?.confirmHandEdit === true);
+		} catch (error) {
+			return this.#reportSmartRoutingValidationError(error);
+		}
+		return this.#runSmartRoutingIntent("Refresh", async () => {
+			await this.ctx.settings.commitAtomicBatchWithCurrent(current => {
+				const currentState = rawAutoroutingState(current);
+				if (!sameCanonicalAutoroutingValue(currentState.setup, expectedSetup)) {
+					throw new Error(
+						"Smart-routing setup changed while refresh was preparing; refresh again to use current settings.",
+					);
+				}
+				this.#assertSmartRoutingNotHandEdited(preview, options?.confirmHandEdit === true, currentState);
+				return buildAutoroutingSettingsBatch({
+					tiers: preview.tiers,
+					setup: preview.setup,
+					provenance: preview.provenance,
+				});
+			});
+			return preview;
+		});
+	}
+
+	async clearGeneratedSetup(): Promise<void> {
+		try {
+			this.#assertSmartRoutingWritable();
+		} catch (error) {
+			return this.#reportSmartRoutingValidationError(error);
+		}
+		return this.#runSmartRoutingIntent("Clear", async () => {
+			await this.ctx.settings.commitAtomicBatchWithCurrent(() => buildAutoroutingSettingsBatch({ clear: true }));
+		});
+	}
+
+	async setAutoroutingEnabled(enabled: boolean): Promise<void> {
+		try {
+			this.#assertSmartRoutingWritable();
+		} catch (error) {
+			return this.#reportSmartRoutingValidationError(error);
+		}
+		return this.#runSmartRoutingIntent("Toggle", async () => {
+			await this.ctx.settings.commitAtomicBatchWithCurrent(() => [buildAutoroutingEnabledPatch(enabled)]);
+		});
+	}
+
+	showModelSelector(options?: { temporaryOnly?: boolean; smartRoutingOnly?: boolean }): void {
 		this.showSelector(done => {
 			let modelSelector: ModelSelectorComponent;
 			const refreshRoleAssignments = () => {
@@ -2292,6 +2536,27 @@ export class SelectorController {
 				this.ctx.session.modelRegistry,
 				this.ctx.session.scopedModels,
 				async selection => {
+					if (selection.kind === "smartRouting") {
+						switch (selection.intent.kind) {
+							case "apply":
+								await this.applySmartRouting(selection.intent.draft, {
+									preview: selection.intent.preview,
+									confirmHandEdit: selection.intent.confirmHandEdit,
+								});
+								break;
+							case "refresh":
+								await this.refreshSmartRouting({ confirmHandEdit: selection.intent.confirmHandEdit });
+								break;
+							case "clear":
+								await this.clearGeneratedSetup();
+								break;
+							case "toggle":
+								await this.setAutoroutingEnabled(selection.intent.enabled);
+								break;
+						}
+						modelSelector.refreshSmartRoutingState();
+						return;
+					}
 					const isTrackedSingleAssignment =
 						selection.kind === "assignment" && selection.role !== null && selection.roles === undefined;
 					try {
@@ -2525,6 +2790,8 @@ export class SelectorController {
 					isFastForSubagentProvider: (provider, supportsServiceTier) =>
 						this.ctx.session.isFastForSubagentProvider(provider, supportsServiceTier),
 					isCurrentModelFastModeActive: () => this.ctx.session.isFastModeActive(),
+					smartRoutingPreview: draft => this.previewSmartRouting(draft),
+					smartRoutingOnly: options?.smartRoutingOnly,
 				},
 			);
 			return { component: modelSelector, focus: modelSelector };
@@ -3161,6 +3428,10 @@ export class SelectorController {
 							this.ctx.ui.setFocus(this.ctx.editor);
 							resolve(code);
 						};
+						// The composer is reusable across overlays; detach it before
+						// clearing so clear() disposes only the transient code input,
+						// not the editor's tab-width listener (disposal is terminal).
+						this.ctx.editorContainer.detachChild(this.ctx.editor);
 						this.ctx.editorContainer.clear();
 						this.ctx.editorContainer.addChild(codeInput);
 						this.ctx.ui.setFocus(codeInput);
@@ -3198,51 +3469,29 @@ export class SelectorController {
 		}
 	}
 
-	async #handleOAuthLogout(providerId: string, targets?: readonly CredentialRemovalTarget[]): Promise<void> {
+	async #handleLogout(providerId: string, targets?: readonly CredentialRemovalTarget[]): Promise<void> {
 		try {
 			const authStorage = this.ctx.session.modelRegistry.authStorage;
-			const inventory = authStorage.listCredentialInventory(providerId);
-			const oauthRows = inventory.filter(row => row.provider === providerId && row.credentialKind === "oauth");
+			const inventory = authStorage.listCredentialInventory(providerId).filter(row => row.provider === providerId);
 			const removalTargetsById = new Map(
 				authStorage.listCredentialRemovalTargets(providerId).map(target => [target.id, target]),
 			);
-			const oauthRemovalTargets = oauthRows
+			const removable = inventory
 				.map(row => removalTargetsById.get(row.id))
 				.filter((target): target is CredentialRemovalTarget => target !== undefined);
-			if (oauthRows.length > 0 && oauthRemovalTargets.length === 0) {
+			// Credentials stored locally but not removable locally are broker-managed.
+			if (inventory.length > 0 && removable.length === 0) {
 				this.ctx.showError(
 					`Logout is broker-managed for ${providerId}; run \`gjc auth-broker logout ${providerId}\` on the broker host.`,
 				);
 				return;
 			}
-			if (targets) {
-				if (targets.length === 0) {
-					this.ctx.showError(
-						`No OAuth accounts to remove for ${providerId}; API-key credentials are not managed here.`,
-					);
-					return;
-				}
-				const result = authStorage.removeAuthCredentialsHard(providerId, targets);
-				if (result.kind !== "removed") {
-					this.ctx.showError(
-						"Logout failed: account inventory changed; no credentials were removed. Retry /logout.",
-					);
-					return;
-				}
-				await clearPersistentPinForRemovedRows(this.ctx.settings, providerId, inventory, result.ids);
-				await this.ctx.session.modelRegistry.refresh();
-				this.ctx.showStatus(
-					`Successfully removed ${result.ids.length} OAuth account${result.ids.length === 1 ? "" : "s"} from ${providerId}.`,
-				);
+			const selected = targets ? targets : removable;
+			if (selected.length === 0) {
+				this.ctx.showError(`No stored credentials to remove for ${providerId}.`);
 				return;
 			}
-			if (oauthRemovalTargets.length === 0) {
-				this.ctx.showError(
-					`No OAuth accounts to remove for ${providerId}; API-key credentials are not managed here.`,
-				);
-				return;
-			}
-			const result = authStorage.removeAuthCredentialsHard(providerId, oauthRemovalTargets);
+			const result = authStorage.removeAuthCredentialsHard(providerId, selected);
 			if (result.kind !== "removed") {
 				this.ctx.showError("Logout failed: account inventory changed; no credentials were removed. Retry /logout.");
 				return;
@@ -3250,7 +3499,7 @@ export class SelectorController {
 			await clearPersistentPinForRemovedRows(this.ctx.settings, providerId, inventory, result.ids);
 			await this.ctx.session.modelRegistry.refresh();
 			this.ctx.showStatus(
-				`Successfully removed ${result.ids.length} OAuth account${result.ids.length === 1 ? "" : "s"} from ${providerId}.`,
+				`Successfully removed ${result.ids.length} stored credential${result.ids.length === 1 ? "" : "s"} from ${providerId}.`,
 			);
 		} catch (error: unknown) {
 			this.ctx.showError(`Logout failed: ${error instanceof Error ? error.message : String(error)}`);
@@ -3273,11 +3522,11 @@ export class SelectorController {
 			const hasOAuthInventory = authStorage
 				.listCredentialInventory(selectedProviderId)
 				.some(row => row.provider === selectedProviderId && row.credentialKind === "oauth");
-			const hasRemovableOAuth = authStorage
+			const hasRemovableCredential = authStorage
 				.listCredentialRemovalTargets(selectedProviderId)
 				.some(target => target.provider === selectedProviderId);
-			if (mode === "logout" && hasOAuthInventory && !hasRemovableOAuth) {
-				await this.#handleOAuthLogout(selectedProviderId);
+			if (mode === "logout" && hasOAuthInventory && !hasRemovableCredential) {
+				await this.#handleLogout(selectedProviderId);
 				return;
 			}
 			if (hasOAuthInventory && !options?.manualCode) {
@@ -3312,7 +3561,7 @@ export class SelectorController {
 								await this.#handleOAuthLogin(selectedProviderId, options);
 							},
 							onAccountRemove: async targets => {
-								await this.#handleOAuthLogout(selectedProviderId, targets);
+								await this.#handleLogout(selectedProviderId, targets);
 								selector.stopValidation();
 								done();
 							},
@@ -3326,32 +3575,8 @@ export class SelectorController {
 				await this.#handleOAuthLogin(selectedProviderId, options);
 				return;
 			}
-			if (!hasRemovableOAuth) {
-				await this.#handleOAuthLogout(selectedProviderId);
-				return;
-			}
-			this.showSelector(done => {
-				let selector: OAuthSelectorComponent;
-				selector = new OAuthSelectorComponent(
-					"logout",
-					authStorage,
-					() => undefined,
-					() => {
-						selector.stopValidation();
-						done();
-						this.ctx.ui.requestRender();
-					},
-					{
-						accountProviderId: selectedProviderId,
-						onAccountRemove: async targets => {
-							await this.#handleOAuthLogout(selectedProviderId, targets);
-							selector.stopValidation();
-							done();
-						},
-					},
-				);
-				return { component: selector, focus: selector };
-			});
+			// mode === "logout" with no OAuth accounts: remove stored api-key credentials directly.
+			await this.#handleLogout(selectedProviderId);
 			return;
 		}
 
@@ -3662,6 +3887,10 @@ export class SelectorController {
 				this.ctx.ui.requestRender();
 			},
 		});
+		// The composer is reusable across overlays; detach it before clearing so
+		// clear() disposes only the transient overlay, not the editor's
+		// tab-width listener / paste state (disposal is terminal).
+		this.ctx.editorContainer.detachChild(this.ctx.editor);
 		this.ctx.editorContainer.clear();
 		this.ctx.editorContainer.addChild(overlay);
 		this.ctx.ui.setFocus(overlay.getFocus());
@@ -3692,6 +3921,10 @@ export class SelectorController {
 			},
 		});
 		unsubscribe = aggregator.onChange(() => this.#tasksPane?.refresh());
+		// The composer is reusable across overlays; detach it before clearing so
+		// clear() disposes only the transient pane, not the editor's
+		// tab-width listener / paste state (disposal is terminal).
+		this.ctx.editorContainer.detachChild(this.ctx.editor);
 		this.ctx.editorContainer.clear();
 		this.ctx.editorContainer.addChild(this.#tasksPane);
 		this.ctx.ui.setFocus(this.#tasksPane.getFocus());

package/src/modes/interactive-mode.ts

@@ -1255,6 +1255,9 @@ export class InteractiveMode implements InteractiveModeContext {
 		this.ui.requestRender();
 		return true;
 	}
+	hasPendingSubmission(): boolean {
+		return this.#pendingSubmittedInput !== undefined;
+	}
 
 	markPendingSubmissionStarted(input: SubmittedUserInput): boolean {
 		if (this.#pendingSubmittedInput !== input || input.cancelled) {
@@ -2348,10 +2351,14 @@ export class InteractiveMode implements InteractiveModeContext {
 		void this.#selectorController.showAgentsDashboard();
 	}
 
-	showModelSelector(options?: { temporaryOnly?: boolean }): void {
+	showModelSelector(options?: { temporaryOnly?: boolean; smartRoutingOnly?: boolean }): void {
 		this.#selectorController.showModelSelector(options);
 	}
 
+	setAutoroutingEnabled(enabled: boolean): Promise<void> {
+		return this.#selectorController.setAutoroutingEnabled(enabled);
+	}
+
 	showEffortSelector(): void {
 		this.#selectorController.showEffortSelector();
 	}

package/src/modes/shared/agent-wire/workflow-gate-types.ts

@@ -9,7 +9,7 @@ export type WorkflowStage = "deep-interview" | "ralplan" | "ultragoal";
 export const WORKFLOW_GATE_V1_STAGES: readonly WorkflowStage[] = ["deep-interview", "ralplan", "ultragoal"];
 
 /** Reserved stage names that are explicitly not part of the v1 contract. */
-export const RESERVED_WORKFLOW_STAGES: readonly string[] = ["team"];
+export const RESERVED_WORKFLOW_STAGES: readonly string[] = ["autoresearch"];
 
 export type WorkflowGateKind = "question" | "approval" | "execution";
 

package/src/modes/types.ts

@@ -302,6 +302,13 @@ export interface InteractiveModeContext {
 		options?: ComposerSubmissionOptions,
 	): SubmittedUserInput;
 	cancelPendingSubmission(): boolean;
+	/**
+	 * True while a submission is pending: not yet started, or started but still
+	 * awaiting prompt delivery (`session.prompt()` has not flipped streaming yet).
+	 * Interrupt handling uses this to keep a started-preflight submission
+	 * cancellable instead of misclassifying its loader as stale (#4741).
+	 */
+	hasPendingSubmission(): boolean;
 	markPendingSubmissionStarted(input: SubmittedUserInput): boolean;
 	finishPendingSubmission(input: SubmittedUserInput): void;
 	/**
@@ -404,7 +411,8 @@ export interface InteractiveModeContext {
 	showExtensionsDashboard(): void;
 	showCustomizationDashboard(): void;
 	showAgentsDashboard(): void;
-	showModelSelector(options?: { temporaryOnly?: boolean }): void;
+	showModelSelector(options?: { temporaryOnly?: boolean; smartRoutingOnly?: boolean }): void;
+	setAutoroutingEnabled(enabled: boolean): Promise<void>;
 	showEffortSelector(): void;
 	showProviderOnboarding(): void;
 	showPluginSelector(mode?: "install" | "uninstall"): void;

package/src/prompts/agents/planner.md

@@ -43,7 +43,7 @@ Inspect relevant files, classify the task, identify resources/constraints/depend
 - Codebase facts are backed by inspected files.
 - Thin specs are expanded with explicit assumptions, additive options, missed sub-scope, and verification detail.
 - Risks and verification commands are concrete.
-- Handoff identifies when to use executor, architect, critic, team, or ultragoal.
+- Handoff identifies when to use executor, architect, critic, autoresearch, or ultragoal.
 </success_criteria>
 
 <output_contract>

package/src/prompts/system/system-prompt.md

@@ -28,7 +28,7 @@ Optimize for correctness first, maintainability second, and brevity third. Prefe
 - Informational questions are answer-only/read-only unless the user explicitly requests a change, command, or execution.
 - Vague or underspecified requirements: recommend `/skill:deep-interview` via `ask` (options: run the interview / proceed with stated assumptions) before mutating anything. Deep-interview is requirements-only and must not mutate product code. Its spec hands off as deep-interview → ralplan consensus → final receipt → approval or valid non-off runtime admission → separately authorized execution.
 - Clear work with demonstrated architecture or sequencing risk suggests `/skill:ralplan --deliberate`; reconciliation must persist its final receipt before choosing approval or an admitted handoff. A valid non-off final runtime receipt enters the existing handoff chain; otherwise it stops pending approval.
-- Use `/skill:ultragoal` for durable goal ledgers and `/skill:team` for approved coordinated persistent work.
+- Use `/skill:ultragoal` for durable goal ledgers and `/skill:autoresearch` for goal-directed research missions that end on a structured verdict rather than an implementation.
 - Delegate large implementation slices to `executor`; use `planner`, `architect`, or `critic` for bounded planning and review.
 - An explicit user request to use a worktree (for example, "use worktree") overrides direct editing: delegate implementation through `task` with `isolated: true`. This is the in-session counterpart of launching `gjc --worktree`; if task isolation is unavailable, report that conflict instead of editing in the parent session.
 - Active skills are authoritative: never ignore an invoked skill; read the full skill text and follow it exactly.

package/src/prompts/system/volatile-project-context.md

@@ -6,5 +6,6 @@ Working directory layout (sorted by mtime, recent first; depth ≤ 3):
 (some entries elided to keep the tree short — use `find`/`read` to drill in)
 {{/if}}
 </workspace-tree>
-{{/if}}Today is {{date}}, and the current working directory is '{{cwd}}'.
+{{/if}}Today is {{date}}, the local time is {{localTime}}, and the current working directory is '{{cwd}}'.
+Timestamps in files, logs, git history, and API responses are often UTC; convert timestamps that are explicitly UTC to the local timezone above when reporting times to the user. Preserve timestamps that already include an explicit offset or timezone, and do not treat this host wall clock as authenticated event-time evidence. The timezone follows the runtime's process timezone configuration (which may include project environment settings), so treat it as display context rather than trusted location evidence. The full IANA zone may reveal geographic information; do not infer more about the user than the displayed context states.
 </system-reminder>

package/src/prompts/tools/move-session.md

@@ -0,0 +1,15 @@
+Rescope the session to a narrower working directory.
+
+Use this only when the session's working directory is a broad launcher root (for example a
+multi-repo workspace like `~/Projects`) and the task has clearly converged on one subdirectory
+or repository: after this call, every later turn resolves relative paths and the bash default
+cwd from the new directory, and project-scoped plugins/capabilities reload for it.
+
+- `path` must be an existing directory; relative paths resolve against the current session cwd.
+  The canonical target must be strictly inside the current session directory — moves to a
+  parent, a sibling project, or an unrelated absolute path are refused.
+- A session can be moved this way at most once, and never while another move is running; a
+  rejected call does not consume the move. Use it once the target repo is identified — not
+  speculatively — because the session file and caches move with the session.
+- This tool is unavailable in subagent sessions and restricted profiles; ask the top-level
+  session to rescope instead.

package/src/prompts/tools/python.md

@@ -0,0 +1,12 @@
+Execute Python in a persistent per-session REPL kernel.
+
+Variables, imports, and loaded data persist across calls in the current GJC session. The kernel runs in the session working directory. Each `execute` call is appended to a JSONL transcript under `.gjc/_session-{sessionid}/ipykernels/`; display artifacts are stored under `.gjc/_session-{sessionid}/ipykernels/artifacts/`.
+
+## Actions
+
+- `execute` (default) — run `code` in the persistent REPL. Requires `code`.
+- `clear` — dispose this session's Python kernel. The next `execute` starts a fresh kernel with no retained state.
+
+## Use
+
+Use this tool for stateful Python work. It is distinct from `eval`: each has a separate kernel and owner, so state is not shared between them.

package/src/prompts/tools/skill-discovery.md

@@ -1,7 +1,7 @@
 Discover project and user runtime skills without loading full skill content.
 
 <instruction>
-- Searches canonical GJC skill locations in precedence order: project `.gjc/skills` (ancestors from cwd to repo root, closest first), then user locations under the home directory: canonical `<config>/agent/skills`, configured legacy `<config>/skills`, and historical legacy `.gjc/skills`. `<config>` is the home-relative directory name from `GJC_CONFIG_DIR`, then `PI_CONFIG_DIR`, then `.gjc`; even an absolute-looking configured name is joined beneath `<home>`. Project scope shadows user scope; within a scope, earlier locations above win. Bundled GJC workflow skills (`deep-interview`, `ralplan`, `team`, `ultragoal`) are always available and cannot be replaced by filesystem skills.
+- Searches canonical GJC skill locations in precedence order: project `.gjc/skills` (ancestors from cwd to repo root, closest first), then user locations under the home directory: canonical `<config>/agent/skills`, configured legacy `<config>/skills`, and historical legacy `.gjc/skills`. `<config>` is the home-relative directory name from `GJC_CONFIG_DIR`, then `PI_CONFIG_DIR`, then `.gjc`; even an absolute-looking configured name is joined beneath `<home>`. Project scope shadows user scope; within a scope, earlier locations above win. Bundled GJC workflow skills (`autoresearch`, `deep-interview`, `ralplan`, `ultragoal`) are always available and cannot be replaced by filesystem skills.
 - Returns thin metadata only: name, description, source scope, path, and use conditions when present.
 - Claude Code (`.claude/skills`) and Codex (`.codex/skills`) layouts are explicit import sources into `.gjc`, never invokable candidates. They are not returned as candidates; instead, each convention skill found in a trusted scope is reported in `diagnostics` with the exact copy command that enables it (copy into `.gjc/skills`), so a skill placed in a documented convention location is discoverable in a normal session without being silently loaded.
 - Discovery is on by default in a normal session. When zero candidates are returned because discovery config is disabled (`skills.enabled` master switch, or `skills.trustProjectSkills` / `skills.trustUserSkills` scope trust), the result carries a `notice` explaining which setting blocked the search — an empty result without a `notice` means the searched scopes genuinely contain no matching skills.

package/src/prompts/tools/skill.md

@@ -6,10 +6,10 @@ Invoke another available skill in the current turn.
 </conditions>
 
 <instruction>
-- `name` is the skill name as it appears in `/skill:<name>` (e.g. `ralplan`, `ultragoal`, `team`, `deep-interview`)
+- `name` is the skill name as it appears in `/skill:<name>` (e.g. `ralplan`, `ultragoal`, `autoresearch`, `deep-interview`)
 - `args` is the free-form argument string the skill would receive after `/skill:<name>` on the command line
 - The tool loads the callee's SKILL.md into the current turn and handles native workflow caller→callee state handoff when the caller is one of the built-in GJC workflows.
-- The chain is refused while a native workflow caller is still active. If your current skill is one of `deep-interview`, `ralplan`, `ultragoal`, or `team` and has not yet reached a terminal phase, prepare it first with `gjc state <skill> write --input '{"current_phase":"handoff"}' --json`; no other handoff command is needed. Runtime project/user skills do not use `gjc state <skill>`.
+- The chain is refused while a native workflow caller is still mid-flight. `autoresearch` chains from any of its phases (`intake`/`research`/`verdict`) — a research mission is always handoff-ready. `deep-interview` chains once its final spec is persisted (phase `handoff`), and `ralplan` chains from `final` or `handoff`. Only a mid-flight `ralplan` or `ultragoal` needs preparation first: `gjc state <skill> write --input '{"current_phase":"handoff"}' --json`; no other handoff command is needed. Runtime project/user skills do not use `gjc state <skill>`.
 - Call once per chain step. To chain `A → B → C`, A calls `skill(B)`; B's next agent turn calls `skill(C)`.
 </instruction>