@gajae-code/coding-agent 0.15.5 → 0.16.0

package/src/cli/model-presets-cli.ts

@@ -0,0 +1,100 @@
+import { getAgentDir } from "@gajae-code/utils";
+import {
+	getModelPresetRegistryStatus,
+	type ModelPresetRegistryStatus,
+	refreshModelPresetRegistry,
+	rollbackModelPresetRegistry,
+	setModelPresetRegistryDisabled,
+	setModelPresetRegistryPin,
+} from "../config/model-preset-registry";
+
+export const MODEL_PRESETS_ACTIONS = ["status", "refresh", "rollback", "pin", "unpin", "disable", "enable"] as const;
+export type ModelPresetsAction = (typeof MODEL_PRESETS_ACTIONS)[number];
+
+export interface ModelPresetsCommandArgs {
+	action: ModelPresetsAction;
+	revision?: string;
+	json?: boolean;
+	agentDir?: string;
+}
+
+function parseRevision(value: string | undefined, action: "rollback" | "pin"): number {
+	if (!value || !/^\d+$/.test(value)) throw new Error(`${action} requires a positive accepted revision.`);
+	const revision = Number(value);
+	if (!Number.isSafeInteger(revision) || revision <= 0)
+		throw new Error(`${action} requires a positive accepted revision.`);
+	return revision;
+}
+
+function humanStatus(status: ModelPresetRegistryStatus): string {
+	const lines = [
+		`source: ${status.source}`,
+		`cache: ${status.cacheHealth}`,
+		`contract: ${status.contractVersion}`,
+		`active revision: ${status.activeRevisionId ?? status.activeRevision ?? "none"}`,
+		`highest seen revision: ${status.highestSeenRevision ?? "none"}`,
+		`pinned revision: ${status.pinnedRevision ?? "none"}`,
+		`disabled: ${status.disabled ? "yes" : "no"}`,
+		`profiles: ${status.profileCount}`,
+		`model presets: ${status.presetCount}`,
+		`history: ${status.historyRevisions.length > 0 ? status.historyRevisions.join(", ") : "none"}`,
+	];
+	if (status.manifestSha256) lines.push(`manifest sha256: ${status.manifestSha256}`);
+	if (status.snapshotSha256) lines.push(`snapshot sha256: ${status.snapshotSha256}`);
+	if (status.profilesSha256) lines.push(`profiles sha256: ${status.profilesSha256}`);
+	if (status.presetsSha256) lines.push(`presets sha256: ${status.presetsSha256}`);
+	if (status.keyId) lines.push(`signature key: ${status.keyId}`);
+	if (status.sourceRevision) lines.push(`source revision: ${status.sourceRevision}`);
+	if (status.acceptedAt) lines.push(`accepted: ${status.acceptedAt}`);
+	if (status.lastCheckedAt) lines.push(`last checked: ${status.lastCheckedAt}`);
+	if (status.retainedProfiles.length > 0)
+		lines.push(`retained removed profiles: ${status.retainedProfiles.join(", ")}`);
+	if (status.retainedPresets.length > 0) lines.push(`retained removed presets: ${status.retainedPresets.join(", ")}`);
+	if (status.lastError) lines.push(`last error: ${status.lastError}`);
+	return `${lines.join("\n")}\n`;
+}
+
+function writeStatus(status: ModelPresetRegistryStatus, json: boolean): void {
+	process.stdout.write(json ? `${JSON.stringify(status)}\n` : humanStatus(status));
+}
+
+export async function runModelPresetsCommand(args: ModelPresetsCommandArgs): Promise<void> {
+	const agentDir = args.agentDir ?? getAgentDir();
+	const dependencies = { agentDir };
+	switch (args.action) {
+		case "status":
+			writeStatus(getModelPresetRegistryStatus(dependencies), args.json === true);
+			return;
+		case "refresh": {
+			const result = await refreshModelPresetRegistry(dependencies);
+			if (args.json) {
+				process.stdout.write(`${JSON.stringify({ result, status: getModelPresetRegistryStatus(dependencies) })}\n`);
+			} else {
+				process.stdout.write(
+					result.status === "updated"
+						? `Accepted preset registry revision ${result.revision}.\n`
+						: result.status === "not_modified"
+							? "Preset registry is already current.\n"
+							: "Preset registry refresh is disabled.\n",
+				);
+			}
+			return;
+		}
+		case "rollback":
+			await rollbackModelPresetRegistry({ ...dependencies, revision: parseRevision(args.revision, "rollback") });
+			break;
+		case "pin":
+			await setModelPresetRegistryPin({ ...dependencies, revision: parseRevision(args.revision, "pin") });
+			break;
+		case "unpin":
+			await setModelPresetRegistryPin(dependencies);
+			break;
+		case "disable":
+			await setModelPresetRegistryDisabled({ ...dependencies, disabled: true });
+			break;
+		case "enable":
+			await setModelPresetRegistryDisabled({ ...dependencies, disabled: false });
+			break;
+	}
+	writeStatus(getModelPresetRegistryStatus(dependencies), args.json === true);
+}

package/src/cli/root-flags.ts

@@ -73,6 +73,11 @@ export const ROOT_LAUNCH_FLAGS = {
 		optionalValue: true,
 	}),
 	"no-title": Flags.boolean({ description: "Disable title auto-generation" }),
+	master: Flags.boolean({ description: "Launch an interactive master session" }),
+	scope: Flags.string({
+		description: "Master scope: repo (default), pwd, or global",
+		options: ["repo", "pwd", "global"],
+	}),
 };
 
 export type ConsumerLaunchFlagName = "hook" | "extension" | "no-extensions" | "no-skills" | "skills";

package/src/cli/update-cli.ts

@@ -9,7 +9,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { pipeline } from "node:stream/promises";
-import { $which, APP_NAME, isCompiledBinary, isEnoent, VERSION } from "@gajae-code/utils";
+import { $which, APP_NAME, isCompiledBinary, isEnoent, redactCrashSecrets, VERSION } from "@gajae-code/utils";
 import { $ } from "bun";
 import chalk from "chalk";
 import { Settings } from "../config/settings";
@@ -17,6 +17,8 @@ import { isUpdateChannel, UPDATE_CHANNELS, type UpdateChannel } from "../config/
 import { installDefaultGjcDefinitions } from "../defaults/gjc-defaults";
 import { theme } from "../modes/theme/theme";
 import { getNotificationConfig, type NotificationProvider, resolveNotificationProvider } from "../sdk/bus/config";
+import type { TelemetryDetails, TelemetryEventName } from "../telemetry";
+import { recordTelemetryEvent } from "../telemetry";
 import { runDaemonCommand } from "./daemon-cli";
 import {
 	fetchGithubChannelRelease,
@@ -53,6 +55,7 @@ export interface InstalledVersionVerification {
 	ok: boolean;
 	actual?: string;
 	path?: string;
+	versionOutput?: string;
 	smokeTestFailed?: boolean;
 	smokeTestOutput?: string;
 	cleanupWarning?: string;
@@ -460,6 +463,71 @@ export function parseReportedVersionForTest(output: string): string | undefined
 	return parseReportedVersion(output);
 }
 
+const VERIFICATION_OUTPUT_MAX_LENGTH = 512;
+const ANSI_ESCAPE = /\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07]*(?:\x07|\x1b\\))/gu;
+const UNSAFE_CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/gu;
+
+function sanitizeVerificationOutput(...streams: Array<string | undefined>): string | undefined {
+	const output = streams
+		.map(stream => stream?.replace(ANSI_ESCAPE, "").replace(UNSAFE_CONTROL, " ").replace(/\s+/g, " ").trim() ?? "")
+		.filter(Boolean)
+		.filter((stream, index, all) => all.indexOf(stream) === index)
+		.join(" ");
+	if (!output) return undefined;
+	const redacted = redactCrashSecrets(output);
+	if (redacted.length <= VERIFICATION_OUTPUT_MAX_LENGTH) return redacted;
+	return `${redacted.slice(0, VERIFICATION_OUTPUT_MAX_LENGTH - 3)}...`;
+}
+
+export function sanitizeVerificationOutputForTest(
+	stderr: string | undefined,
+	stdout: string | undefined,
+): string | undefined {
+	return sanitizeVerificationOutput(stderr, stdout);
+}
+
+interface InstalledVersionCommandResult {
+	exitCode: number | null;
+	stdout: string;
+	stderr: string;
+}
+
+type InstalledVersionCommandRunner = (runtimePath: string) => Promise<InstalledVersionCommandResult>;
+
+async function verifyInstalledVersionWith(
+	expectedVersion: string,
+	runtimePath: string | undefined,
+	runVersion: InstalledVersionCommandRunner,
+): Promise<InstalledVersionVerification> {
+	if (!runtimePath) return { ok: false };
+	try {
+		const result = await runVersion(runtimePath);
+		if (result.exitCode !== 0) {
+			return {
+				ok: false,
+				path: runtimePath,
+				versionOutput: sanitizeVerificationOutput(result.stderr, result.stdout),
+			};
+		}
+		const actual = parseReportedVersion(result.stdout);
+		return { ok: actual === expectedVersion, actual, path: runtimePath };
+	} catch (error) {
+		return {
+			ok: false,
+			path: runtimePath,
+			versionOutput: sanitizeVerificationOutput(error instanceof Error ? error.message : String(error)),
+		};
+	}
+}
+
+export async function verifyInstalledVersionForTest(options: {
+	expectedVersion: string;
+	runtimePath: string | undefined;
+	runVersion: InstalledVersionCommandRunner;
+}): Promise<InstalledVersionVerification> {
+	return await verifyInstalledVersionWith(options.expectedVersion, options.runtimePath, options.runVersion);
+}
+
 /**
  * Run the resolved gjc binary and check if it reports the expected version.
  */
@@ -467,15 +535,14 @@ async function verifyInstalledVersion(
 	expectedVersion: string,
 	runtimePath: string | undefined = resolveGjcPath(),
 ): Promise<InstalledVersionVerification> {
-	if (!runtimePath) return { ok: false };
-	try {
-		const result = await $`${runtimePath} --version`.quiet().nothrow();
-		if (result.exitCode !== 0) return { ok: false, path: runtimePath };
-		const actual = parseReportedVersion(result.text());
-		return { ok: actual === expectedVersion, actual, path: runtimePath };
-	} catch {
-		return { ok: false, path: runtimePath };
-	}
+	return await verifyInstalledVersionWith(expectedVersion, runtimePath, async resolvedPath => {
+		const result = await $`${resolvedPath} --version`.quiet().nothrow();
+		return {
+			exitCode: result.exitCode,
+			stdout: result.stdout.toString(),
+			stderr: result.stderr.toString(),
+		};
+	});
 }
 
 async function verifyInstalledRuntime(
@@ -663,7 +730,8 @@ function formatVerificationFailure(result: InstalledVersionVerification, expecte
 	if (result.actual) {
 		return `${APP_NAME} at ${result.path} still reports ${result.actual} (expected ${expectedVersion})`;
 	}
-	return `could not verify updated version${result.path ? ` at ${result.path}` : ""}`;
+	const outputSuffix = result.versionOutput ? `: ${result.versionOutput}` : "";
+	return `could not verify updated version${result.path ? ` at ${result.path}` : ""}${outputSuffix}`;
 }
 
 export function formatVerificationFailureForTest(
@@ -1142,6 +1210,7 @@ export interface UpdateCommandDependencies {
 	restartDaemon?: (settings: Settings) => Promise<void>;
 	recoverNotifications?: (settings: Settings) => Promise<void>;
 	runPostUpdateRecovery?: (runtimePath: string) => Promise<void>;
+	recordTelemetryEvent?: (event: TelemetryEventName, details: TelemetryDetails) => unknown;
 	exit?: (code: number) => never;
 }
 
@@ -1363,6 +1432,24 @@ export async function runUpdateCommand(
 	const update = deps.performUpdate ?? performUpdate;
 	const refreshDefaults = deps.refreshInstalledDefaultSkills ?? refreshInstalledDefaultSkills;
 	const exit = deps.exit ?? process.exit;
+	const recordEvent = deps.recordTelemetryEvent ?? ((event, details) => recordTelemetryEvent(event, details));
+	const pendingTelemetry = new Set<Promise<void>>();
+	const record = (event: TelemetryEventName, details: TelemetryDetails): void => {
+		const result = recordEvent(event, details);
+		if (result !== null && (typeof result === "object" || typeof result === "function") && "then" in result) {
+			const pending = Promise.resolve(result as PromiseLike<unknown>).then(
+				() => undefined,
+				() => undefined,
+			);
+			pendingTelemetry.add(pending);
+			void pending.finally(() => pendingTelemetry.delete(pending));
+		}
+	};
+	const flushTelemetryBeforeExit = async (): Promise<never> => {
+		await Promise.race([Promise.allSettled([...pendingTelemetry]), Bun.sleep(2000)]);
+		return exit(1);
+	};
+	record("update_check_started", { channel });
 
 	console.log(chalk.dim(`Current version: ${VERSION}`));
 	if (channel !== "stable") {
@@ -1373,16 +1460,18 @@ export async function runUpdateCommand(
 	try {
 		target = await resolveTarget();
 	} catch (err) {
+		record("update_check_completed", { channel, result: "failed" });
 		console.error(chalk.red(err instanceof Error ? err.message : String(err)));
-		return exit(1);
+		return flushTelemetryBeforeExit();
 	}
 
 	let release: ReleaseInfo;
 	try {
 		release = await lookupRelease({ channel });
 	} catch (err) {
+		record("update_check_completed", { channel, result: "failed" });
 		console.error(chalk.red(`Failed to check for updates: ${err}`));
-		return exit(1);
+		return flushTelemetryBeforeExit();
 	}
 
 	// A config file that exists but could not be read changes which registry
@@ -1395,12 +1484,13 @@ export async function runUpdateCommand(
 	try {
 		comparison = compareVersions(release.version, VERSION);
 	} catch (err) {
+		record("update_check_completed", { channel, result: "failed" });
 		console.error(
 			chalk.red(
 				`Failed to check for updates: the ${channel} channel reported an unparseable version "${release.version}": ${err instanceof Error ? err.message : String(err)}`,
 			),
 		);
-		return exit(1);
+		return flushTelemetryBeforeExit();
 	}
 
 	const decision = resolveUpdateDecision({
@@ -1416,7 +1506,10 @@ export async function runUpdateCommand(
 		try {
 			const verification = await verifyTarget(release, target.path);
 			if (verification.ok) {
+				record("update_check_completed", { channel, result: "available" });
+				record("update_install_started", { channel, installMethod: target.method });
 				printVerifiedMigrationTarget(target, release.version);
+				record("update_install_completed", { channel, result: "installed", installMethod: target.method });
 				return;
 			}
 		} finally {
@@ -1425,6 +1518,7 @@ export async function runUpdateCommand(
 	}
 
 	if (!decision.install) {
+		record("update_check_completed", { channel, result: "up_to_date" });
 		console.log(chalk.green(`${theme.status.success} Already up to date`));
 		return;
 	}
@@ -1439,9 +1533,14 @@ export async function runUpdateCommand(
 		console.log(chalk.yellow(`Forcing reinstall of ${release.version}`));
 	}
 
-	if (opts.check) return;
+	record("update_check_completed", { channel, result: "available" });
+	if (opts.check) {
+		record("update_install_completed", { channel, result: "skipped" });
+		return;
+	}
 
 	let installedVersion: string | undefined;
+	record("update_install_started", { channel, installMethod: target.method });
 	try {
 		const resolved = target ?? (await resolveTarget());
 		const verification = await update(resolved, release.version, release.registry);
@@ -1450,16 +1549,18 @@ export async function runUpdateCommand(
 			await (deps.runPostUpdateRecovery ?? runPostUpdateRecovery)(verification.path);
 		} else if (!deps.performUpdate) throw new Error("verified installed runtime path is unavailable");
 	} catch (err) {
+		record("update_install_failed", { channel, result: "failed", installMethod: target.method });
 		const prefix = installedVersion
 			? `Updated to ${installedVersion}, but post-update recovery failed`
 			: "Update failed";
 		console.error(chalk.red(`${prefix}: ${err}`));
-		return exit(1);
+		return flushTelemetryBeforeExit();
 	}
 
 	// The installed runtime completes recovery before this old updater process
 	// refreshes opt-in local definitions, avoiding stale-module daemon control.
 	await refreshDefaults();
+	record("update_install_completed", { channel, result: "installed", installMethod: target.method });
 }
 
 /**

package/src/cli.ts

@@ -54,6 +54,7 @@ export const commands: CommandEntry[] = [
 	{ name: "daemon", load: () => import("./commands/daemon").then(m => m.default) },
 	{ name: "web-search", aliases: ["q"], load: () => import("./commands/web-search").then(m => m.default) },
 	{ name: "local-provider", load: () => import("./commands/local-provider").then(m => m.default) },
+	{ name: "model-presets", load: () => import("./commands/model-presets").then(m => m.default) },
 	{ name: "mcp-serve", load: () => import("./commands/mcp-serve").then(m => m.default) },
 	{ name: "mcp", load: () => import("./commands/mcp").then(m => m.default) },
 	{
@@ -364,6 +365,7 @@ function routeLegacyRootArgv(argv: readonly string[]): string[] | undefined {
 export function routeModelsAlias(argv: readonly string[]): string[] | undefined {
 	if (argv[0] !== "models") return undefined;
 	const rest = argv.slice(1);
+	if (rest[0] === "presets") return ["model-presets", ...rest.slice(1)];
 	if (rest.length === 0) return ["launch", "--list-models"];
 	// Pure search tokens become a single fuzzy pattern (matches --list-models).
 	if (rest.every(token => !token.startsWith("-") && !token.startsWith("@"))) {
@@ -461,7 +463,9 @@ export async function runCli(argv: string[]): Promise<void> {
 	}
 	const normalizedArgv = normalizeResumeAlias(argv);
 	const legacyArgv = routeLegacyRootArgv(normalizedArgv);
-	if (!legacyArgv && hasRootHelpFlag(normalizedArgv)) {
+	const modelPresetsArgv =
+		normalizedArgv[0] === "models" && normalizedArgv[1] === "presets" ? routeModelsAlias(normalizedArgv) : undefined;
+	if (!legacyArgv && !modelPresetsArgv && hasRootHelpFlag(normalizedArgv)) {
 		const { renderRootHelp } = await import("@gajae-code/utils/cli");
 		const { getExtraHelpText } = await import("./cli/fast-help");
 		renderRootHelp({ bin: APP_NAME, version: VERSION, commands: new Map([["launch", RootHelpCommand]]) });
@@ -475,7 +479,7 @@ export async function runCli(argv: string[]): Promise<void> {
 		process.stdout.write(`${APP_NAME}/${VERSION}\n`);
 		return;
 	}
-	const runArgv = legacyArgv ?? routeRootArgv(normalizedArgv);
+	const runArgv = legacyArgv ?? modelPresetsArgv ?? routeRootArgv(normalizedArgv);
 	if (isStatsHelpFastPath(runArgv)) {
 		showStatsFastHelp();
 		return;

package/src/commands/auth-gateway.ts

@@ -22,24 +22,27 @@ export default class AuthGateway extends Command {
 	};
 
 	static flags = {
-		json: Flags.boolean({ description: "Output JSON (token/status)" }),
+		json: Flags.boolean({ description: "Output JSON (token/status/check)" }),
 		bind: Flags.string({ description: "Bind address for `serve` (host:port)", char: "b" }),
+		provider: Flags.string({
+			description: "Required provider scope for `serve`; also filters `status` and `check`",
+		}),
 		regenerate: Flags.boolean({ description: "Regenerate the gateway bearer token (token)" }),
 		"no-auth": Flags.boolean({
 			description:
-				"Disable inbound bearer-token auth (serve). Useful when bound to loopback — any caller is allowed.",
+				"Disable inbound bearer-token auth (serve). Loopback non-browser clients without an Origin header are allowed.",
 		}),
 	};
 
 	static examples = [
-		"# Boot the gateway against the configured broker\n  gjc auth-gateway serve",
-		"# Boot on a non-default port\n  gjc auth-gateway serve --bind=127.0.0.1:4000",
+		"# Boot a provider-scoped gateway against the configured broker\n  gjc auth-gateway serve --provider=openai-codex",
+		"# Boot on a non-default port\n  gjc auth-gateway serve --provider=openai-codex --bind=127.0.0.1:4000",
 		"# Print the gateway bearer token (creates one on first run)\n  gjc auth-gateway token",
 		"# Rotate the gateway bearer token\n  gjc auth-gateway token --regenerate",
-		"# Run on loopback without any bearer (anyone on this host can call)\n  gjc auth-gateway serve --no-auth",
-		"# Show local gateway + broker config status\n  gjc auth-gateway status",
-		"# Probe each broker credential to see which one is producing 401s\n  gjc auth-gateway check",
-		"# Same, machine-readable for scripts\n  gjc auth-gateway check --json",
+		"# Run the scoped gateway on loopback for non-browser local clients without a bearer\n  gjc auth-gateway serve --provider=openai-codex --no-auth",
+		"# Show scoped local gateway + broker config status\n  gjc auth-gateway status --provider=openai-codex",
+		"# Probe credentials for one gateway scope\n  gjc auth-gateway check --provider=openai-codex",
+		"# Same, machine-readable for scripts\n  gjc auth-gateway check --provider=openai-codex --json",
 	];
 
 	async run(): Promise<void> {
@@ -53,6 +56,7 @@ export default class AuthGateway extends Command {
 			flags: {
 				json: flags.json,
 				bind: flags.bind,
+				provider: flags.provider,
 				regenerate: flags.regenerate,
 				noAuth: flags["no-auth"],
 			},

package/src/commands/gc.ts

@@ -20,6 +20,11 @@ function resolveDiskPolicyFromSettings(): Partial<GcDiskPolicy> | undefined {
 export default class Gc extends Command {
 	static description = "Garbage-collect stale GJC session/PID records (dry-run by default)";
 	static strict = false;
+	// The hand parser in gc-runtime owns the real syntax (repeatable space-form
+	// operands, dash-prefix rejection, orphan-operand rules); delegate help so the
+	// public output is the authoritative gcHelpText() instead of generic flag
+	// metadata that would advertise unsupported `--flag=<value>` forms.
+	static delegateHelp = true;
 	static flags = {
 		json: Flags.boolean({ char: "j", description: "Emit machine-readable JSON", default: false }),
 		prune: Flags.boolean({ description: "Remove stale records (default: report only)", default: false }),
@@ -33,6 +38,18 @@ export default class Gc extends Command {
 			description: "Quarantine a corrupt session-index suffix and retain its valid prefix",
 			default: false,
 		}),
+		"empty-delete-receipts": Flags.boolean({
+			description: "Report (and with --prune, prune) empty .gjc-delete-* receipts under --root/--manifest",
+			default: false,
+		}),
+		root: Flags.string({
+			description: "Operand root for --empty-delete-receipts (repeatable)",
+			multiple: true,
+		}),
+		manifest: Flags.string({
+			description: 'JSON {"roots":[...]} file for --empty-delete-receipts (repeatable)',
+			multiple: true,
+		}),
 	};
 
 	static examples = [
@@ -44,6 +61,8 @@ export default class Gc extends Command {
 		"gjc gc --disk --json",
 		"gjc gc --disk --prune",
 		"gjc gc --repair-session-index --json",
+		"gjc gc --empty-delete-receipts --root ~/.gjc/agent/session-states",
+		"gjc gc --empty-delete-receipts --manifest receipts-manifest.json --prune --json",
 	];
 
 	async run(): Promise<void> {

package/src/commands/launch.ts

@@ -2,20 +2,30 @@
  * Root command for the coding agent CLI.
  */
 
-import { APP_NAME, setProjectDir } from "@gajae-code/utils";
+import { APP_NAME, getAgentDir, setProjectDir } from "@gajae-code/utils";
 import { Args, Command } from "@gajae-code/utils/cli";
 import { assertLocalLaunchArgs, parseArgs } from "../cli/args";
 import { ROOT_LAUNCH_FLAGS } from "../cli/root-flags";
 import { writeCoordinatorAtomic } from "../coordinator-mcp/durability";
 import { launchDefaultTmuxIfNeeded } from "../gjc-runtime/launch-tmux";
-import { type PreparedLaunchWorktree, prepareLaunchWorktree } from "../gjc-runtime/launch-worktree";
+import {
+	type GjcLaunchWorktreePlan,
+	type PreparedLaunchWorktree,
+	parseLaunchWorktreeMode,
+	planLaunchWorktree,
+	prepareLaunchWorktree,
+} from "../gjc-runtime/launch-worktree";
+import { type LaunchWorktreeReservation, reserveLaunchWorktree } from "../gjc-runtime/launch-worktree-reservation";
 import {
 	GJC_COORDINATOR_SESSION_ID_ENV,
 	GJC_COORDINATOR_SESSION_STATE_FILE_ENV,
 	GJC_TMUX_OWNER_GENERATION_ENV,
 } from "../gjc-runtime/session-state-sidecar";
 import { runRootCommand } from "../main";
+import { assertMasterLaunchArgs } from "../master-mode/context";
 import { prepareAcpTerminalAuthArgs } from "../modes/acp/terminal-auth";
+import { type IndexedSession, SessionIndex } from "../sdk/broker/session-index";
+import { worktreeOccupant } from "../sdk/broker/worktree-occupancy";
 
 export async function persistCoordinatorLaunchFailure(
 	error: unknown,
@@ -56,6 +66,54 @@ export async function persistCoordinatorLaunchFailure(
 	await writeCoordinatorAtomic(stateFile, `${JSON.stringify(payload, null, 2)}\n`);
 }
 
+function worktreeInUseError(worktreePath: string, occupant?: string): Error {
+	const holder = occupant ? `session ${occupant}` : "another launch";
+	return new Error(
+		`worktree_in_use:${worktreePath} is already held by ${holder}. ` +
+			"Use gjc --worktree <name> for a separate checkout, or stop that session.",
+	);
+}
+
+async function reserveLaunchWorktreeOrFail(agentDir: string, worktreePath: string): Promise<LaunchWorktreeReservation> {
+	const reservation = await reserveLaunchWorktree(agentDir, worktreePath);
+	if (!reservation) throw worktreeInUseError(worktreePath);
+	return reservation;
+}
+
+/** Test seam for the path-keyed atomic reservation. */
+export async function reserveLaunchWorktreeForTest(
+	agentDir: string,
+	worktreePath: string,
+): Promise<LaunchWorktreeReservation> {
+	return await reserveLaunchWorktreeOrFail(agentDir, worktreePath);
+}
+
+async function assertLaunchWorktreeUnoccupied(worktree: GjcLaunchWorktreePlan | { enabled: false }): Promise<void> {
+	if (!worktree.enabled) return;
+	let sessions: readonly IndexedSession[];
+	try {
+		sessions = (await new SessionIndex(getAgentDir()).open()).listSessionIdentities();
+	} catch {
+		throw new Error(`worktree_occupancy_unavailable:${worktree.worktreePath}`);
+	}
+	const occupant = worktreeOccupant(sessions, worktree.worktreePath);
+	if (occupant) throw worktreeInUseError(worktree.worktreePath, occupant);
+}
+
+async function reserveLaunchWorktreePreflight(
+	worktree: GjcLaunchWorktreePlan | { enabled: false },
+): Promise<LaunchWorktreeReservation | undefined> {
+	if (!worktree.enabled) return undefined;
+	const reservation = await reserveLaunchWorktreeOrFail(getAgentDir(), worktree.worktreePath);
+	try {
+		await assertLaunchWorktreeUnoccupied(worktree);
+		return reservation;
+	} catch (error) {
+		await reservation.release();
+		throw error;
+	}
+}
+
 export default class Index extends Command {
 	static description = "Red-claw AI coding assistant";
 	static hidden = true;
@@ -93,34 +151,44 @@ export default class Index extends Command {
 		const { args } = prepareAcpTerminalAuthArgs(this.argv);
 		const parsed = parseArgs([...args], "deferred");
 		if (parsed.mode !== "acp") assertLocalLaunchArgs(parsed);
+		assertMasterLaunchArgs(parsed);
 		if (parsed.help || parsed.version) {
 			await runRootCommand(parsed, args);
 			return;
 		}
 
 		let launch: PreparedLaunchWorktree;
+		let reservation: LaunchWorktreeReservation | undefined;
 		try {
+			const plannedWorktree = planLaunchWorktree(process.cwd(), parseLaunchWorktreeMode(args).mode);
+			reservation = await reserveLaunchWorktreePreflight(plannedWorktree);
 			launch = prepareLaunchWorktree(process.cwd(), args);
 		} catch (error) {
+			await reservation?.release();
 			await persistCoordinatorLaunchFailure(error, process.cwd());
 			throw error;
 		}
-		if (launch.worktree.enabled) {
-			process.chdir(launch.cwd);
-			setProjectDir(launch.cwd);
+		try {
+			if (launch.worktree.enabled) {
+				process.chdir(launch.cwd);
+				setProjectDir(launch.cwd);
+			}
+			const launchParsed = parseArgs(launch.args, "deferred");
+			if (launchParsed.mode !== "acp") assertLocalLaunchArgs(launchParsed);
+			assertMasterLaunchArgs(launchParsed);
+			if (
+				launchDefaultTmuxIfNeeded({
+					parsed: launchParsed,
+					rawArgs: launch.args,
+					cwd: launch.cwd,
+					worktreeBranch: launch.worktree.enabled && !launch.worktree.detached ? launch.worktree.branchName : null,
+					project: launch.cwd,
+				})
+			)
+				return;
+			await runRootCommand(launchParsed, launch.args);
+		} finally {
+			await reservation?.release();
 		}
-		const launchParsed = parseArgs(launch.args, "deferred");
-		if (launchParsed.mode !== "acp") assertLocalLaunchArgs(launchParsed);
-		if (
-			launchDefaultTmuxIfNeeded({
-				parsed: launchParsed,
-				rawArgs: launch.args,
-				cwd: launch.cwd,
-				worktreeBranch: launch.worktree.enabled && !launch.worktree.detached ? launch.worktree.branchName : null,
-				project: launch.cwd,
-			})
-		)
-			return;
-		await runRootCommand(launchParsed, launch.args);
 	}
 }

package/src/commands/model-presets.ts

@@ -0,0 +1,24 @@
+import { Args, Command, Flags } from "@gajae-code/utils/cli";
+import { MODEL_PRESETS_ACTIONS, type ModelPresetsAction, runModelPresetsCommand } from "../cli/model-presets-cli";
+
+export default class ModelPresets extends Command {
+	static description = "Manage the signed model preset registry";
+
+	static args = {
+		action: Args.string({ description: "Action", required: false, options: MODEL_PRESETS_ACTIONS }),
+		revision: Args.string({ description: "Accepted revision for pin or rollback", required: false }),
+	};
+
+	static flags = {
+		json: Flags.boolean({ description: "Output JSON" }),
+	};
+
+	async run(): Promise<void> {
+		const { args, flags } = await this.parse(ModelPresets);
+		await runModelPresetsCommand({
+			action: (args.action ?? "status") as ModelPresetsAction,
+			revision: args.revision,
+			json: flags.json,
+		});
+	}
+}