@gajae-code/coding-agent 0.15.4 → 0.15.6

package/src/sdk/broker/broker.ts

@@ -46,6 +46,8 @@ export interface BrokerSettings {
 	heartbeatTtlMs?: number;
 	/** Broker-owned migration policy. Client lifecycle frames cannot select it. */
 	resolveDirectoryMigration?: (_cwd: string) => Promise<DirectoryMigrationPolicy>;
+	/** Host model resolver override for lifecycle tests and embedders. */
+	resolveModelPin?: SdkHostModelResolver;
 }
 
 type ResolvedBrokerSettings = {
@@ -863,7 +865,8 @@ export class Broker {
 	#completion!: Promise<void>;
 	#resolveCompletion!: () => void;
 	#rejectCompletion!: (error: unknown) => void;
-	readonly #resolveModelPin: SdkHostModelResolver;
+	#resolveModelPin: SdkHostModelResolver;
+	#ownsResolveModelPin: boolean;
 	constructor(settings: BrokerSettings) {
 		this.settings = {
 			agentDir: settings.agentDir,
@@ -874,7 +877,8 @@ export class Broker {
 		};
 		this.index = new SessionIndex(settings.agentDir);
 		this.ledger = new LifecycleLedger(settings.agentDir);
-		this.#resolveModelPin = createDefaultSdkHostModelResolver(this.settings.agentDir);
+		this.#ownsResolveModelPin = settings.resolveModelPin === undefined;
+		this.#resolveModelPin = settings.resolveModelPin ?? createDefaultSdkHostModelResolver(this.settings.agentDir);
 		this.#lock = path.join(settings.agentDir, "sdk", "broker.lock");
 		const completion = Promise.withResolvers<void>();
 		this.#completion = completion.promise;
@@ -1023,6 +1027,8 @@ export class Broker {
 			this.#resolveCompletion = completion.resolve;
 			this.#rejectCompletion = completion.reject;
 			this.#completionTask = null;
+			if (this.#ownsResolveModelPin)
+				this.#resolveModelPin = createDefaultSdkHostModelResolver(this.settings.agentDir);
 			// A drained queue refuses every later startup by design, so a restarted broker
 			// needs a new one or it would admit nothing for the rest of the process.
 			this.#startupAdmissions = new StartupAdmissionQueue(sdkHostStartupConcurrency());
@@ -1285,25 +1291,35 @@ export class Broker {
 		if (this.#heartbeatTimer) clearInterval(this.#heartbeatTimer);
 		this.#heartbeatTimer = null;
 		this.#completionTask = (async () => {
-			await this.#transport?.stop();
-			this.#transport = null;
-			if (mode === "lost-root")
-				await Promise.race([Promise.allSettled(this.#admitted), Bun.sleep(BROKER_SETTLEMENT_MS)]);
-			else await Promise.allSettled(this.#admitted);
-			this.#publication?.close();
-			this.#publication = null;
-			if (mode === "owned-root" && this.discovery?.ownerId === this.#owner) {
-				try {
-					const disk = JSON.parse(await fs.readFile(brokerDiscoveryPath(this.settings.agentDir), "utf8")) as {
-						ownerId?: string;
-					};
-					if (disk.ownerId === this.#owner) await fs.unlink(brokerDiscoveryPath(this.settings.agentDir));
-				} catch (e) {
-					if ((e as NodeJS.ErrnoException).code !== "ENOENT") throw e;
+			try {
+				await this.#transport?.stop();
+				this.#transport = null;
+				if (mode === "lost-root")
+					await Promise.race([Promise.allSettled(this.#admitted), Bun.sleep(BROKER_SETTLEMENT_MS)]);
+				else await Promise.allSettled(this.#admitted);
+				this.#publication?.close();
+				this.#publication = null;
+				if (mode === "owned-root" && this.discovery?.ownerId === this.#owner) {
+					try {
+						const disk = JSON.parse(await fs.readFile(brokerDiscoveryPath(this.settings.agentDir), "utf8")) as {
+							ownerId?: string;
+						};
+						if (disk.ownerId === this.#owner) await fs.unlink(brokerDiscoveryPath(this.settings.agentDir));
+					} catch (e) {
+						if ((e as NodeJS.ErrnoException).code !== "ENOENT") throw e;
+					}
+					await this.#releaseOwnedLock();
+				}
+			} finally {
+				const disposeModelPin = this.#ownsResolveModelPin ? this.#resolveModelPin.dispose?.() : undefined;
+				if (mode === "lost-root" && disposeModelPin !== undefined) {
+					void disposeModelPin.catch(() => undefined);
+					await Promise.race([disposeModelPin, Bun.sleep(BROKER_SETTLEMENT_MS)]);
+				} else {
+					await disposeModelPin;
 				}
-				await this.#releaseOwnedLock();
+				this.discovery = null;
 			}
-			this.discovery = null;
 		})();
 		void this.#completionTask.then(this.#resolveCompletion, this.#rejectCompletion);
 		return this.#completionTask;
@@ -1417,14 +1433,25 @@ export class Broker {
 
 		try {
 			const endpointPath = path.join(record.locator.stateRoot, "sdk", `${record.sessionId}.json`);
-			const [source, metadata] = await Promise.all([fs.readFile(endpointPath, "utf8"), fs.stat(endpointPath)]);
+			const before = await fs.lstat(endpointPath, { bigint: true });
+			if (!before.isFile()) return error("endpoint_stale", "session endpoint is not a regular file");
+			const source = await fs.readFile(endpointPath, "utf8");
+			const metadata = await fs.lstat(endpointPath, { bigint: true });
+			if (
+				before.dev !== metadata.dev ||
+				before.ino !== metadata.ino ||
+				before.size !== metadata.size ||
+				before.mtimeNs !== metadata.mtimeNs ||
+				before.ctimeNs !== metadata.ctimeNs
+			)
+				return error("endpoint_stale", "session endpoint changed during read");
 			const endpoint = JSON.parse(source) as Record<string, unknown>;
 			if (
 				endpoint.sessionId !== record.sessionId ||
 				endpoint.pid !== record.pid ||
 				endpoint.stale === true ||
 				record.endpointMtimeMs === undefined ||
-				Math.abs(metadata.mtimeMs - record.endpointMtimeMs) > 0.001
+				Math.abs(Number(metadata.mtimeNs) / 1_000_000 - record.endpointMtimeMs) > 0.001
 			)
 				return error("endpoint_stale", "session endpoint is stale");
 			await this.index.refresh();

package/src/sdk/broker/lifecycle.ts

@@ -14,7 +14,10 @@ function nativeLifecycle(): typeof import("@gajae-code/natives") {
 }
 
 import { $credentialEnv, logger, resolveEquivalentPath } from "@gajae-code/utils";
-
+import {
+	loadAcceptedModelPresetRegistry,
+	loadAcceptedModelPresetRegistryAsync,
+} from "../../config/model-preset-registry";
 import {
 	isModelProfileError,
 	type ModelProfileErrorDetails,
@@ -609,13 +612,36 @@ function text(value: unknown): string | undefined {
 	return typeof value === "string" && value ? value : undefined;
 }
 
-function validateBrokerModelPreset(agentDir: string, requestedProfile: string): string | BrokerResponse {
+function validateBrokerModelPresetSync(agentDir: string, requestedProfile: string): string | BrokerResponse {
+	const modelsConfigFile = ModelsConfigFile.relocate(path.join(agentDir, "models.yml"));
+	modelsConfigFile.invalidate();
+	const loaded = modelsConfigFile.tryLoad();
+	const accepted = loadAcceptedModelPresetRegistry(agentDir);
+	const profiles = mergeModelProfiles(loaded.status === "ok" ? loaded.value.profiles : undefined, accepted.profiles);
+	try {
+		return validateModelProfileName(
+			requestedProfile,
+			profiles,
+			accepted.error ?? (loaded.status === "error" ? loaded.error : undefined),
+		);
+	} catch (error) {
+		if (isModelProfileError(error)) return fail(error.code, error.message, undefined, error.details);
+		throw error;
+	}
+}
+
+async function validateBrokerModelPreset(agentDir: string, requestedProfile: string): Promise<string | BrokerResponse> {
 	const modelsConfigFile = ModelsConfigFile.relocate(path.join(agentDir, "models.yml"));
 	modelsConfigFile.invalidate();
 	const loaded = modelsConfigFile.tryLoad();
-	const profiles = mergeModelProfiles(loaded.status === "ok" ? loaded.value.profiles : undefined);
+	const accepted = await loadAcceptedModelPresetRegistryAsync(agentDir);
+	const profiles = mergeModelProfiles(loaded.status === "ok" ? loaded.value.profiles : undefined, accepted.profiles);
 	try {
-		return validateModelProfileName(requestedProfile, profiles, loaded.status === "error" ? loaded.error : undefined);
+		return validateModelProfileName(
+			requestedProfile,
+			profiles,
+			accepted.error ?? (loaded.status === "error" ? loaded.error : undefined),
+		);
 	} catch (error) {
 		if (isModelProfileError(error)) return fail(error.code, error.message, undefined, error.details);
 		throw error;
@@ -623,7 +649,7 @@ function validateBrokerModelPreset(agentDir: string, requestedProfile: string):
 }
 
 export function validateBrokerModelPresetForTest(agentDir: string, requestedProfile: string): string | BrokerResponse {
-	return validateBrokerModelPreset(agentDir, requestedProfile);
+	return validateBrokerModelPresetSync(agentDir, requestedProfile);
 }
 
 function readinessTimeout(input: Input): number | BrokerResponse {
@@ -4030,7 +4056,7 @@ async function launchInput(
 	if (input.modelPreset !== undefined && (typeof input.modelPreset !== "string" || input.modelPreset.length === 0))
 		return fail("invalid_input", "modelPreset must be a non-empty exact profile ID.");
 	if (modelPreset !== undefined) {
-		const validatedModelPreset = validateBrokerModelPreset(broker.settings.agentDir, modelPreset);
+		const validatedModelPreset = await validateBrokerModelPreset(broker.settings.agentDir, modelPreset);
 		if (typeof validatedModelPreset !== "string") return validatedModelPreset;
 		modelPreset = validatedModelPreset;
 	}

package/src/sdk/bus/chat-daemon-control.ts

@@ -132,8 +132,8 @@ export type ChatDaemonAction = "stop" | "reload";
  * would retain the old hot polling loop, so replacement is required.
  */
 export const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>> = {
-	discord: 69,
-	slack: 72,
+	discord: 71,
+	slack: 74,
 };
 
 export function chatDaemonGeneration(kind: ChatDaemonKind): number {

package/src/sdk/bus/chat-daemon-runtime.ts

@@ -114,6 +114,10 @@ function readGeneration(value: unknown): number | undefined {
 	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
 }
 
+function readSequence(value: unknown): number | undefined {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+}
+
 /**
  * What one representation of a frame states about an identity it owns.
  *
@@ -138,7 +142,7 @@ const ABSENT_IDENTITY: IdentityClaim<never> = { state: "absent" };
  */
 function identityClaim<T>(
 	frame: Record<string, unknown> | undefined,
-	key: "sessionId" | "generation" | "name" | "kind",
+	key: "sessionId" | "generation" | "name" | "kind" | "seq",
 	read: (value: unknown) => T | undefined,
 ): IdentityClaim<T> {
 	if (!frame || !Object.hasOwn(frame, key)) return ABSENT_IDENTITY;
@@ -232,11 +236,17 @@ function correlateFrame(frame: Record<string, unknown>): CorrelatedFrame | undef
 		identityClaim(payload, "generation", readGeneration),
 	);
 	if (!generation.ok) return undefined;
+	const seq = reconcileIdentity(
+		identityClaim(frame, "seq", readSequence),
+		identityClaim(payload, "seq", readSequence),
+	);
+	if (!seq.ok) return undefined;
 	return {
 		body,
 		name: envelopeName.value ?? bodyName,
 		sessionId: sessionId.value,
 		generation: generation.value,
+		seq: seq.value,
 	};
 }
 

package/src/sdk/bus/kind-aware-reconciliation.ts

@@ -21,6 +21,8 @@ import type {
 	ReconciliationStore,
 } from "./reconciliation-store";
 
+const EMPTY_PROMPT_FAILURE = { code: "prompt_failed", message: "Prompt submission failed." } as const;
+
 export type { ReconciliationKind };
 
 export interface KindCorrelation extends PromptCorrelation {
@@ -51,8 +53,13 @@ export interface KindAwareReconciliation {
 		kind: ReconciliationKind,
 		correlation: PromptCorrelation | undefined,
 		frame:
-			| { type: "agent_start" | "agent_end"; content?: TurnResultContent }
-			| { type: "agent_failed"; error: unknown; content?: TurnResultContent },
+			| {
+					type: "agent_start" | "agent_end";
+					content?: TurnResultContent;
+					hasActivity?: boolean;
+					outcome?: SdkPromptTerminalOutcome;
+			  }
+			| { type: "agent_failed"; error: unknown; content?: TurnResultContent; hasActivity?: boolean },
 	): Promise<void>;
 	claimPendingOutcome(
 		kind: ReconciliationKind,
@@ -340,8 +347,13 @@ export function createKindAwareReconciliation(
 		kind: ReconciliationKind,
 		correlation: PromptCorrelation | undefined,
 		frame:
-			| { type: "agent_start" | "agent_end"; content?: TurnResultContent }
-			| { type: "agent_failed"; error: unknown; content?: TurnResultContent },
+			| {
+					type: "agent_start" | "agent_end";
+					content?: TurnResultContent;
+					hasActivity?: boolean;
+					outcome?: SdkPromptTerminalOutcome;
+			  }
+			| { type: "agent_failed"; error: unknown; content?: TurnResultContent; hasActivity?: boolean },
 	) => {
 		if (!correlation) return;
 		await queueMutation(candidate => {
@@ -355,7 +367,13 @@ export function createKindAwareReconciliation(
 				// as-is (cleanupRecords is intentionally not re-run). First reason wins: a
 				// late generic frame never overwrites a specific one. Persisted so the reason
 				// survives reconnect/restart reconciliation.
-				if (frame.type === "agent_failed" && record.error === undefined) {
+				if (frame.type === "agent_failed") {
+					const failure = sanitizePromptFailure(frame.error);
+					if (
+						record.error !== undefined &&
+						!(record.error.code === "agent_failed" && failure.code !== "agent_failed")
+					)
+						return { value: undefined, changed: false };
 					record.error = sanitizePromptFailure(frame.error);
 					return { value: undefined, changed: true };
 				}
@@ -373,7 +391,9 @@ export function createKindAwareReconciliation(
 			if (frame.type === "agent_failed") {
 				// agent_failed is additive diagnostics; agent_end remains the sole
 				// terminal lifecycle boundary for the correlated invocation.
-				record.error ??= sanitizePromptFailure(frame.error);
+				const failure = sanitizePromptFailure(frame.error);
+				if (record.error === undefined || (record.error.code === "agent_failed" && failure.code !== "agent_failed"))
+					record.error = failure;
 				delete record.deadlineRecoveryPending;
 				delete record.deadlineMaxAt;
 				return { value: undefined, changed: true };
@@ -404,7 +424,17 @@ export function createKindAwareReconciliation(
 				record.receiptState = record.pendingReceiptState ?? "missing";
 				record.pendingReceiptState = undefined;
 			} else {
-				record.status = record.error === undefined ? "terminal_ok" : "failed";
+				if (
+					kind === "prompt" &&
+					record.error === undefined &&
+					frame.type === "agent_end" &&
+					frame.outcome?.kind !== "stopped" &&
+					!frame.content?.text.trim() &&
+					!frame.hasActivity
+				) {
+					record.status = "failed";
+					record.error = EMPTY_PROMPT_FAILURE;
+				} else record.status = record.error === undefined ? "terminal_ok" : "failed";
 				record.receiptState = frame.content?.text?.trim() ? "present" : "missing";
 			}
 			cleanupRecords(candidate);
@@ -445,6 +475,7 @@ export function createKindAwareReconciliation(
 					: undefined;
 		const content =
 			typeof arg4 === "function" ? arg6 : typeof arg5 === "object" && arg5 !== null && "code" in arg5 ? arg6 : arg5;
+		const sanitizedContent = sanitizeTurnResultContent(content);
 		await queueMutation(candidate => {
 			if (isCurrent !== undefined && !isCurrent()) return { value: undefined, changed: false };
 			const record = candidate.get(keyOf(kind, correlation));
@@ -455,8 +486,15 @@ export function createKindAwareReconciliation(
 			if (finalOutcome?.kind === "failed") {
 				record.status = "failed";
 				record.error = recordError ?? { code: finalOutcome.code, message: finalOutcome.message };
+			} else if (
+				kind === "prompt" &&
+				((finalOutcome === undefined && !sanitizedContent?.text.trim()) ||
+					(finalOutcome?.kind !== "stopped" && content !== undefined && !sanitizedContent?.text.trim()))
+			) {
+				record.status = "failed";
+				record.error = EMPTY_PROMPT_FAILURE;
 			} else record.status = "terminal_ok";
-			record.content = sanitizeTurnResultContent(content);
+			record.content = sanitizedContent;
 			record.outcome = finalOutcome;
 			record.receiptState = record.pendingReceiptState ?? "unknown";
 			record.pendingOutcome = undefined;

package/src/sdk/bus/prompt-reconciliation.ts

@@ -23,11 +23,13 @@
  */
 
 import { PROMPT_FAILURE_CODE_MAX, sanitizePromptFailure } from "../prompt-failure";
+import type { SdkPromptTerminalOutcome } from "../prompt-status";
 import type { ReceiptState } from "../receipt-state";
 
 export { PROMPT_FAILURE_CODE_MAX, sanitizePromptFailure };
 export const PROMPT_RECONCILIATION_ACTIVE_CAPACITY = 128;
 export const PROMPT_RECONCILIATION_TERMINAL_CAPACITY = 256;
+const EMPTY_PROMPT_FAILURE = { code: "prompt_failed", message: "Prompt submission failed." } as const;
 
 export type PromptReconciliationStatus = "accepted" | "in_flight" | "terminal_ok" | "failed";
 
@@ -101,8 +103,13 @@ export interface PromptReconciliation {
 		correlation: PromptCorrelation | undefined,
 		frame:
 			| { type: "agent_start" }
-			| { type: "agent_end"; finalText?: string }
-			| { type: "agent_failed"; error: unknown; finalText?: string },
+			| {
+					type: "agent_end";
+					finalText?: string;
+					hasActivity?: boolean;
+					outcome?: SdkPromptTerminalOutcome;
+			  }
+			| { type: "agent_failed"; error: unknown; finalText?: string; hasActivity?: boolean },
 	): void;
 	lookup(selector: { commandId?: string; turnId?: string; clientRef?: string }): TurnPromptReconciliation;
 	cleanup(): void;
@@ -190,8 +197,13 @@ export function createPromptReconciliation(options: { now?: () => number } = {})
 		correlation: PromptCorrelation | undefined,
 		frame:
 			| { type: "agent_start" }
-			| { type: "agent_end"; finalText?: string }
-			| { type: "agent_failed"; error: unknown; finalText?: string },
+			| {
+					type: "agent_end";
+					finalText?: string;
+					hasActivity?: boolean;
+					outcome?: SdkPromptTerminalOutcome;
+			  }
+			| { type: "agent_failed"; error: unknown; finalText?: string; hasActivity?: boolean },
 	) => {
 		if (!correlation) return;
 		const record = records.get(keyOf(correlation));
@@ -202,8 +214,11 @@ export function createPromptReconciliation(options: { now?: () => number } = {})
 			// the settled record instead of being dropped; it must not resurrect it,
 			// so status, terminalAt, retention order, and clientRefIndex stay as-is.
 			// First reason wins: a late generic frame never overwrites a specific one.
-			if (frame.type === "agent_failed" && record.error === undefined)
-				record.error = sanitizePromptFailure(frame.error);
+			if (frame.type === "agent_failed") {
+				const failure = sanitizePromptFailure(frame.error);
+				if (record.error === undefined || (record.error.code === "agent_failed" && failure.code !== "agent_failed"))
+					record.error = failure;
+			}
 			return;
 		}
 		if (frame.type === "agent_start") {
@@ -218,6 +233,18 @@ export function createPromptReconciliation(options: { now?: () => number } = {})
 		if (frame.type === "agent_failed") {
 			record.status = "failed";
 			record.error = sanitizePromptFailure(frame.error);
+		} else if (record.error !== undefined) {
+			// Preserve an actionable provider failure already recorded before a late
+			// empty agent_end; the empty frame cannot downgrade or replace its cause.
+			record.status = "failed";
+		} else if (frame.type === "agent_end" && frame.outcome?.kind === "stopped") {
+			record.status = "terminal_ok";
+		} else if (!frame.finalText?.trim() && !frame.hasActivity) {
+			// A prompt cannot claim successful completion without assistant content.
+			// Keep the terminal transition first-wins, but fail closed instead of
+			// exposing an empty zero-token turn as terminal_ok.
+			record.status = "failed";
+			record.error = EMPTY_PROMPT_FAILURE;
 		} else {
 			record.status = "terminal_ok";
 		}

package/src/sdk/bus/slack-conversation.ts

@@ -74,5 +74,9 @@ export function normalizeSlackConversation(record: SlackConversation): SlackConv
 }
 
 export function acceptsSlackInbound(record: SlackConversation, rootTs: string, endpointGeneration: number): boolean {
-	return record.state === "active" && record.rootTs === rootTs && record.endpointGeneration === endpointGeneration;
+	return (
+		(record.state === "active" || record.state === "resumed_root") &&
+		record.rootTs === rootTs &&
+		record.endpointGeneration === endpointGeneration
+	);
 }

package/src/sdk/bus/telegram-daemon-contract.ts

@@ -283,8 +283,15 @@ export const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * Generation 177 consumes an exact same-window lean settlement receipt only
  * after its autonomous ask lead-in publishes successfully, preventing idle
  * replay without changing the serving protocol.
+ * Generation 178: idle publication waits for positioned identity delivery to
+ * cross the native writer barrier before the independent broadcast lane.
+ * Generation 179 tolerates a bounded consecutive run of refused notification
+ * publications in the router instead of cancelling the subscription on the
+ * first refusal, so an owner still running the generation-178 router keeps
+ * killing a session's mirroring after one transient rejection and must be
+ * replaced across this upgrade.
  */
-export const DAEMON_GENERATION = 178;
+export const DAEMON_GENERATION = 179;
 
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7