@gajae-code/coding-agent 0.15.6 → 0.16.1

package/src/sdk/session.ts

@@ -17,6 +17,8 @@ import {
 	type AuthCredentialSelector,
 	type CredentialDisabledEvent,
 	codexToolWireName,
+	DEFAULT_MODEL_PER_PROVIDER,
+	type KnownProvider,
 	type Message,
 	type Model,
 	type ProviderSessionState,
@@ -49,6 +51,7 @@ import {
 	isBackgroundJobSupportEnabled,
 	jobElapsedMs,
 } from "../async";
+import { resolveBrowserBackend } from "../browser-backend";
 import { loadCapability, reset as resetCapabilities } from "../capability";
 import { type Rule, ruleCapability, setActiveRules } from "../capability/rule";
 import type { SourceMeta } from "../capability/types";
@@ -65,11 +68,13 @@ import {
 	resolveModelRoleValue,
 	type ScopedModelSelection,
 } from "../config/model-resolver";
+import { normalizeModelSelectorValue } from "../config/model-selector-value";
 import { loadPromptTemplates as loadPromptTemplatesInternal, type PromptTemplate } from "../config/prompt-templates";
 import { Settings, type SkillsSettings } from "../config/settings";
 import { resolveEagerTaskDelegation } from "../config/task-delegation";
 import { CursorExecHandlers } from "../cursor";
 import { EditTool } from "../edit";
+import type { MasterModeContext } from "../master-mode/context";
 import { describeFoldReceipt } from "../session/fold-coordinator";
 import type { BashRestrictionProfile } from "../tools/bash-allowed-prefixes";
 import { SearchTool } from "../tools/search";
@@ -120,7 +125,9 @@ import { normalizePluginHook } from "../hooks/normalize";
 import { initializeLocalRoot, LocalProtocolHandler, type LocalProtocolOptions } from "../internal-urls";
 import type { LspStartupServerInfo } from "../lsp";
 import { shutdownAll as shutdownAllLspClients } from "../lsp/client";
+import { createMasterPeerSnapshotContributor, MASTER_PEER_SNAPSHOT_CUSTOM_TYPE } from "../master-mode/first-request";
 import btwUserPrompt from "../prompts/system/btw-user.md" with { type: "text" };
+import masterModeTemplate from "../prompts/system/master-mode.md" with { type: "text" };
 import asyncResultTemplate from "../prompts/tools/async-result.md" with { type: "text" };
 import { AgentRegistry, MAIN_AGENT_ID } from "../registry/agent-registry";
 import { createLazyService } from "../runtime/lazy-service";
@@ -144,7 +151,7 @@ import { markAutoroutingInactive } from "../sdk/host/internal-autorouting-state"
 import { createSdkSessionRuntimeExtension, registerSdkOnlyNotificationCommand } from "../sdk/host/session-runtime";
 import { createSdkWebSocketTransport } from "../sdk/host/websocket-transport";
 import type { SecretObfuscator } from "../secrets";
-import { AgentSession, type ForkContextSeed } from "../session/agent-session";
+import { AgentSession, type ForkContextSeed, isSessionDisposalIncompleteError } from "../session/agent-session";
 import { AuthBrokerClient, AuthStorage, RemoteAuthCredentialStore } from "../session/auth-storage";
 import { type CustomMessage, convertToLlm } from "../session/messages";
 import { createReadonlySessionManager, SessionManager } from "../session/session-manager";
@@ -189,6 +196,7 @@ import { guardToolForUltragoalAsk } from "../tools/ultragoal-ask-guard";
 import { EventBus } from "../utils/event-bus";
 import { buildNamedToolChoice, buildNamedToolChoiceResult } from "../utils/tool-choice";
 import type { WorkspaceTree } from "../workspace-tree";
+import { createSessionLifecycleService } from "./lifecycle/client";
 import {
 	attachLifecycleStartupCapability,
 	lifecycleMcpStartupTimeoutOption,
@@ -525,6 +533,8 @@ export interface CreateAgentSessionOptions {
 	 * @internal CLI-only startup optimization; SDK callers retain synchronous loading by default.
 	 */
 	deferMcpConfigStartup?: boolean;
+	/** Process-local master authority. Never persist or pass to lifecycle children. */
+	masterModeContext?: MasterModeContext;
 	/**
 	 * Defer memory backend startup until the caller has applied startup model profiles.
 	 * @internal CLI-only ordering guard; SDK callers retain immediate startup by default.
@@ -1095,12 +1105,16 @@ function buildMCPPromptCommands(manager: MCPManager): LoadedCustomCommand[] {
  */
 
 function withEmbeddedDefaultGjcSkills(skills: Skill[]): Skill[] {
-	const byName = new Map(skills.map(skill => [skill.name, skill]));
+	const byName = new Map<string, Skill>();
+	for (const skill of skills) {
+		const key = skill.name.toLowerCase();
+		if (!byName.has(key)) byName.set(key, skill);
+	}
 	// The four public GJC workflow skills are a product invariant: even if a
 	// caller-supplied or filesystem skill shares a name, the bundled definition
 	// wins so workflow routing can never be silently hijacked.
 	for (const defaultSkill of getEmbeddedDefaultGjcSkills()) {
-		byName.set(defaultSkill.name, defaultSkill);
+		byName.set(defaultSkill.name.toLowerCase(), defaultSkill);
 	}
 	return [...byName.values()];
 }
@@ -1282,6 +1296,45 @@ function findDeferredExactMcpToolNameCollisions(
 	return [...collisions];
 }
 
+/**
+ * Order candidates so each known provider's curated default model is tried
+ * before the rest of the catalog.
+ *
+ * Provider catalogs are not ranked by fitness — a withdrawn model whose ID
+ * carries an older date suffix sorts ahead of its current replacement — so
+ * picking the first credentialed entry can start an unconfigured install on a
+ * model the provider no longer serves. `DEFAULT_MODEL_PER_PROVIDER` is the
+ * curated table `findInitialModel` already sweeps for the same purpose;
+ * reusing it keeps both unconfigured paths on one source of truth. Candidates
+ * that are not a provider default keep their original relative order.
+ */
+export function orderByProviderDefaultFirst(
+	candidates: readonly Model[],
+	providerOrder: readonly string[] = Object.keys(DEFAULT_MODEL_PER_PROVIDER),
+): Model[] {
+	const preferred: Model[] = [];
+	const rest: Model[] = [];
+	const preferredCandidates = new Set<Model>();
+	const seenProviders = new Set<string>();
+	for (const rawProvider of [...providerOrder, ...Object.keys(DEFAULT_MODEL_PER_PROVIDER)]) {
+		const provider = rawProvider.trim().toLowerCase();
+		if (!provider || seenProviders.has(provider) || !(provider in DEFAULT_MODEL_PER_PROVIDER)) continue;
+		seenProviders.add(provider);
+		const defaultId = DEFAULT_MODEL_PER_PROVIDER[provider as KnownProvider];
+		for (const candidate of candidates) {
+			if (candidate.provider.trim().toLowerCase() === provider && candidate.id === defaultId) {
+				preferred.push(candidate);
+				preferredCandidates.add(candidate);
+			}
+		}
+	}
+	if (preferred.length === 0) return [...candidates];
+	for (const candidate of candidates) {
+		if (!preferredCandidates.has(candidate)) rest.push(candidate);
+	}
+	return [...preferred, ...rest];
+}
+
 const AUTOMATION_TOOL_NAMES = new Set<AutomationToolName>(["browser", "computer"]);
 
 function validateAutomationTools(options: CreateAgentSessionOptions): AutomationTools {
@@ -1307,6 +1360,7 @@ function validateAutomationTools(options: CreateAgentSessionOptions): Automation
 
 export async function createAgentSession(options: CreateAgentSessionOptions = {}): Promise<CreateAgentSessionResult> {
 	const automationTools = validateAutomationTools(options);
+	const masterModeContext = options.masterModeContext;
 	const lifecycleStartupCapability = (
 		options as CreateAgentSessionOptions & { [lifecycleStartupCapabilityOption]?: SdkStartupCapability }
 	)[lifecycleStartupCapabilityOption];
@@ -1366,6 +1420,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 	}
 
 	let agent: Agent;
+	let sessionAgent: Agent | undefined;
 	let session!: AgentSession;
 	let sessionManager!: SessionManager;
 	let hasSession = false;
@@ -1783,8 +1838,12 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				credentialSessionId,
 			}),
 		);
+		const configuredDefaultPatterns = normalizeModelSelectorValue(settings.getModelRole("default"));
 		let model = options.model;
 		let modelFallbackMessage: string | undefined;
+		if (!hasExplicitModel && configuredDefaultPatterns.length > 0 && !defaultRoleSpec.model) {
+			modelFallbackMessage = `Model ${configuredDefaultPatterns.join(" -> ")} not found`;
+		}
 		const resumeModelBehavior = settings.get("session.resumeModelBehavior");
 		const persistedDefaultChain = existingSession.configuredModelChains.default;
 		const defaultModelEntries =
@@ -2384,7 +2443,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 										"Cannot rescope a session with caller-owned MCP authority; recreate the session at the target cwd.",
 									);
 								}
-								return sessionManager.runExclusiveCwdTransition(async () => {
+								return sessionManager.runExclusiveCwdMoveTransition(async () => {
 									if (moveConsumed) {
 										throw new Error(
 											"This session has already been rescoped; only one agent-invoked move is allowed per session.",
@@ -2396,174 +2455,240 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 										);
 									}
 									const from = sessionManager.getCwd();
-									const resolvedPath = path.resolve(from, target);
-									let canonicalFrom: string;
-									let canonicalTarget: string;
-									try {
-										canonicalFrom = await fs.realpath(from);
-										canonicalTarget = await fs.realpath(resolvedPath);
-									} catch {
-										throw new Error(`Directory does not exist or is not a directory: ${resolvedPath}`);
-									}
-									if (!(await fs.stat(canonicalTarget)).isDirectory()) {
-										throw new Error(`Directory does not exist or is not a directory: ${resolvedPath}`);
-									}
-									const relative = path.relative(canonicalFrom, canonicalTarget);
-									if (relative === "") {
-										throw new Error(
-											`Target ${canonicalTarget} is the current session directory; nothing to move.`,
-										);
+									const sourceHandle = await SessionManager.openNoFollowDirectory(from);
+									const sourceOpened = await sourceHandle.stat({ bigint: true });
+									if (!sourceOpened.isDirectory()) {
+										await sourceHandle.close().catch(() => {});
+										throw new Error(`Current session directory is no longer a directory: ${from}`);
 									}
-									if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
-										throw new Error(
-											`Refusing to rescope outside the current session directory: ${canonicalTarget} is not within ${canonicalFrom}. move_session only narrows the session scope; ask the user to restart or /move for a broader relocation.`,
-										);
-									}
-									let targetHandle: nodeFs.promises.FileHandle | undefined;
-									let expectedIdentity: { dev: bigint; ino: bigint };
 									try {
-										targetHandle = await SessionManager.openNoFollowDirectory(canonicalTarget);
-										const opened = await targetHandle.stat({ bigint: true });
-										if (!opened.isDirectory()) {
+										const resolvedPath = path.resolve(from, target);
+										let canonicalFrom: string;
+										let canonicalTarget: string;
+										try {
+											canonicalFrom = await fs.realpath(from);
+											canonicalTarget = await fs.realpath(resolvedPath);
+										} catch (error) {
+											// macOS `realpath(3)` reports EACCES on an unreadable
+											// directory where Linux succeeds and fails later at the
+											// `access` probe; keep both platforms on the access message.
+											const code = (error as NodeJS.ErrnoException)?.code;
+											if (code === "EACCES" || code === "EPERM") {
+												throw new Error(
+													`Directory identity or access unavailable: ${resolvedPath}${
+														error instanceof Error ? ` (${error.message})` : ""
+													}`,
+												);
+											}
 											throw new Error(`Directory does not exist or is not a directory: ${resolvedPath}`);
 										}
-										expectedIdentity = { dev: opened.dev, ino: opened.ino };
-										await fs.access(canonicalTarget, nodeFs.constants.R_OK | nodeFs.constants.X_OK);
-									} catch (error) {
-										await targetHandle?.close().catch(() => {});
-										if (error instanceof Error && error.message.startsWith("Directory does not exist")) {
-											throw error;
+										if (!(await fs.stat(canonicalTarget)).isDirectory()) {
+											throw new Error(`Directory does not exist or is not a directory: ${resolvedPath}`);
 										}
-										throw new Error(
-											`Directory identity or access unavailable: ${canonicalTarget}${
-												error instanceof Error ? ` (${error.message})` : ""
-											}`,
-										);
-									}
-									// Process-cwd authority is an explicit claim, never inferred from
-									// `process.cwd() === from`: sibling sessions launched at the same
-									// root both satisfy that, so acting on it would chdir the process
-									// and clear process-global caches underneath the sibling.
-									const ownsProcessCwd = SessionManager.isProcessCwdOwner(sessionManager);
-									const restoreLaunchRoot = async (failure: unknown): Promise<never> => {
-										const restoreErrors: Error[] = [];
-										if (ownsProcessCwd) {
-											try {
-												setProjectDir(canonicalFrom);
-												if (path.resolve(process.cwd()) !== path.resolve(canonicalFrom)) {
-													throw new Error("Process cwd did not restore to the launch root.");
-												}
-											} catch (error) {
-												restoreErrors.push(error instanceof Error ? error : new Error(String(error)));
+										const relative = path.relative(canonicalFrom, canonicalTarget);
+										if (relative === "") {
+											throw new Error(
+												`Target ${canonicalTarget} is the current session directory; nothing to move.`,
+											);
+										}
+										if (
+											relative === ".." ||
+											relative.startsWith(`..${path.sep}`) ||
+											path.isAbsolute(relative)
+										) {
+											throw new Error(
+												`Refusing to rescope outside the current session directory: ${canonicalTarget} is not within ${canonicalFrom}. move_session only narrows the session scope; ask the user to restart or /move for a broader relocation.`,
+											);
+										}
+										let targetHandle: nodeFs.promises.FileHandle | undefined;
+										let expectedIdentity: { dev: bigint; ino: bigint };
+										try {
+											targetHandle = await SessionManager.openNoFollowDirectory(canonicalTarget);
+											const opened = await targetHandle.stat({ bigint: true });
+											if (!opened.isDirectory()) {
+												throw new Error(`Directory does not exist or is not a directory: ${resolvedPath}`);
 											}
-											try {
-												resetCapabilities();
-												const restoreRegistry = await resolveActiveProjectRegistryPath(canonicalFrom).catch(
-													() => undefined,
+											const revalidatedFrom = await fs.realpath(from);
+											const revalidatedTarget = await fs.realpath(resolvedPath);
+											const revalidatedRelative = path.relative(revalidatedFrom, revalidatedTarget);
+											if (
+												revalidatedFrom !== canonicalFrom ||
+												revalidatedTarget !== canonicalTarget ||
+												revalidatedRelative === "" ||
+												revalidatedRelative === ".." ||
+												revalidatedRelative.startsWith(`..${path.sep}`) ||
+												path.isAbsolute(revalidatedRelative)
+											) {
+												throw new Error(
+													`Directory identity changed during confinement validation: ${resolvedPath}`,
 												);
-												clearPluginRootsAndCaches(restoreRegistry ? [restoreRegistry] : undefined);
-											} catch (error) {
-												restoreErrors.push(error instanceof Error ? error : new Error(String(error)));
 											}
-										}
-										try {
-											await rebindCwdCapturingAuthority(canonicalFrom);
+											const named = await fs.lstat(revalidatedTarget, { bigint: true });
+											const namedSource = await fs.lstat(revalidatedFrom, { bigint: true });
+											if (
+												!namedSource.isDirectory() ||
+												namedSource.isSymbolicLink() ||
+												namedSource.dev !== sourceOpened.dev ||
+												namedSource.ino !== sourceOpened.ino ||
+												!named.isDirectory() ||
+												named.isSymbolicLink() ||
+												named.dev !== opened.dev ||
+												named.ino !== opened.ino
+											) {
+												throw new Error(
+													`Directory identity changed during confinement validation: ${resolvedPath}`,
+												);
+											}
+											expectedIdentity = { dev: opened.dev, ino: opened.ino };
+											await fs.access(canonicalTarget, nodeFs.constants.R_OK | nodeFs.constants.X_OK);
 										} catch (error) {
-											restoreErrors.push(error instanceof Error ? error : new Error(String(error)));
-										}
-										if (restoreErrors.length > 0) {
-											throw new AggregateError(
-												restoreErrors,
-												"Failed to restore launch-root rescope authority.",
-												{
-													cause: failure,
-												},
+											await targetHandle?.close().catch(() => {});
+											if (error instanceof Error && error.message.startsWith("Directory does not exist")) {
+												throw error;
+											}
+											throw new Error(
+												`Directory identity or access unavailable: ${canonicalTarget}${
+													error instanceof Error ? ` (${error.message})` : ""
+												}`,
 											);
 										}
-										throw failure;
-									};
-									try {
-										// Every fallible step that the moved session depends on runs
-										// BEFORE the session-file commit, so a failure here leaves the
-										// session exactly where it was and the tool call is a clean
-										// rejection rather than a half-moved session.
-										if (ownsProcessCwd) {
-											setProjectDir(canonicalTarget);
+										// Process-cwd authority is an explicit claim, never inferred from
+										// `process.cwd() === from`: sibling sessions launched at the same
+										// root both satisfy that, so acting on it would chdir the process
+										// and clear process-global caches underneath the sibling.
+										const ownsProcessCwd = SessionManager.isProcessCwdOwner(sessionManager);
+										const restoreLaunchRoot = async (failure: unknown): Promise<never> => {
+											const restoreErrors: Error[] = [];
+											if (ownsProcessCwd) {
+												try {
+													setProjectDir(canonicalFrom);
+													if (path.resolve(process.cwd()) !== path.resolve(canonicalFrom)) {
+														throw new Error("Process cwd did not restore to the launch root.");
+													}
+													await SessionManager.assertProcessCwdIdentity({
+														dev: sourceOpened.dev,
+														ino: sourceOpened.ino,
+													});
+												} catch (error) {
+													restoreErrors.push(error instanceof Error ? error : new Error(String(error)));
+												}
+												try {
+													resetCapabilities();
+													const restoreRegistry = await resolveActiveProjectRegistryPath(
+														canonicalFrom,
+													).catch(() => undefined);
+													clearPluginRootsAndCaches(restoreRegistry ? [restoreRegistry] : undefined);
+												} catch (error) {
+													restoreErrors.push(error instanceof Error ? error : new Error(String(error)));
+												}
+											}
 											try {
-												// `setProjectDir` chdirs a NAME. Confirm the process actually
-												// landed on the pinned directory, so a path replaced after
-												// the name checks cannot escape the validated descendant.
-												await SessionManager.assertProcessCwdIdentity(expectedIdentity);
+												await rebindCwdCapturingAuthority(canonicalFrom);
 											} catch (error) {
-												setProjectDir(canonicalFrom);
-												throw error;
+												restoreErrors.push(error instanceof Error ? error : new Error(String(error)));
 											}
-										}
-										let rescopeFailure: unknown;
+											if (restoreErrors.length > 0) {
+												throw new AggregateError(
+													restoreErrors,
+													"Failed to restore launch-root rescope authority.",
+													{
+														cause: failure,
+													},
+												);
+											}
+											throw failure;
+										};
 										try {
+											// Every fallible step that the moved session depends on runs
+											// BEFORE the session-file commit, so a failure here leaves the
+											// session exactly where it was and the tool call is a clean
+											// rejection rather than a half-moved session.
 											if (ownsProcessCwd) {
-												resetCapabilities();
-												const projectRegistry = await resolveActiveProjectRegistryPath(canonicalTarget);
-												clearPluginRootsAndCaches(projectRegistry ? [projectRegistry] : undefined);
+												setProjectDir(canonicalTarget);
+												try {
+													// `setProjectDir` chdirs a NAME. Confirm the process actually
+													// landed on the pinned directory, so a path replaced after
+													// the name checks cannot escape the validated descendant.
+													await SessionManager.assertProcessCwdIdentity(expectedIdentity);
+												} catch (error) {
+													setProjectDir(canonicalFrom);
+													await SessionManager.assertProcessCwdIdentity({
+														dev: sourceOpened.dev,
+														ino: sourceOpened.ino,
+													});
+													throw error;
+												}
+											}
+											let rescopeFailure: unknown;
+											try {
+												if (ownsProcessCwd) {
+													resetCapabilities();
+													const projectRegistry = await resolveActiveProjectRegistryPath(canonicalTarget);
+													clearPluginRootsAndCaches(projectRegistry ? [projectRegistry] : undefined);
+												}
+												// Plugin/MCP/Python authority must be rebound successfully
+												// before committing; swallowing a failure here is what leaves
+												// a moved session holding launch-root tool authority.
+												await rebindCwdCapturingAuthority(canonicalTarget);
+											} catch (error) {
+												rescopeFailure = error;
+											}
+											if (rescopeFailure !== undefined) {
+												await restoreLaunchRoot(rescopeFailure);
+											}
+											try {
+												await sessionManager.flush();
+												// Commit last: `moveTo` re-validates the pinned identity through
+												// the still-open handle at the state-changing boundary.
+												await sessionManager.moveTo(canonicalTarget, {
+													expectedIdentity,
+													targetHandle,
+													expectedSourceIdentity: { dev: sourceOpened.dev, ino: sourceOpened.ino },
+													sourceHandle,
+												});
+											} catch (error) {
+												const committedCwd = sessionManager.getCwd();
+												const stayedAtLaunchRoot = path.resolve(committedCwd) === path.resolve(from);
+												if (stayedAtLaunchRoot) await restoreLaunchRoot(error);
+												// SessionManager can publish the durable move before a later metadata
+												// write fails. Treat that state as committed rather than reporting a
+												// rejection after the session has moved.
+												moveConsumed = true;
+												logger.warn("Session rescope committed before finalization failed", {
+													error: safeErrorForLog(error),
+													cwd: committedCwd,
+												});
 											}
-											// Plugin/MCP/Python authority must be rebound successfully
-											// before committing; swallowing a failure here is what leaves
-											// a moved session holding launch-root tool authority.
-											await rebindCwdCapturingAuthority(canonicalTarget);
-										} catch (error) {
-											rescopeFailure = error;
-										}
-										if (rescopeFailure !== undefined) {
-											await restoreLaunchRoot(rescopeFailure);
-										}
-										try {
-											await sessionManager.flush();
-											// Commit last: `moveTo` re-validates the pinned identity through
-											// the still-open handle at the state-changing boundary.
-											await sessionManager.moveTo(canonicalTarget, {
-												expectedIdentity,
-												targetHandle,
-											});
-										} catch (error) {
-											const committedCwd = sessionManager.getCwd();
-											const stayedAtLaunchRoot = path.resolve(committedCwd) === path.resolve(from);
-											if (stayedAtLaunchRoot) await restoreLaunchRoot(error);
-											// SessionManager can publish the durable move before a later metadata
-											// write fails. Treat that state as committed rather than reporting a
-											// rejection after the session has moved.
 											moveConsumed = true;
-											logger.warn("Session rescope committed before finalization failed", {
-												error: safeErrorForLog(error),
-												cwd: committedCwd,
-											});
-										}
-										moveConsumed = true;
-										if (ownsProcessCwd) {
+											if (ownsProcessCwd) {
+												try {
+													await shutdownAllLspClients();
+												} catch (error) {
+													logger.warn("Failed to reset launch-root LSP clients after session rescope", {
+														error: safeErrorForLog(error),
+													});
+												}
+											}
+											// Cwd-derived read-only state the prompt and subagents consume.
+											// Best-effort by design: the move is committed, and a failed
+											// re-discovery must not present a committed move as a failure.
+											await applyRescopedReadState(sessionManager.getCwd());
 											try {
-												await shutdownAllLspClients();
+												await session?.refreshSshTool({ activateIfAvailable: true });
 											} catch (error) {
-												logger.warn("Failed to reset launch-root LSP clients after session rescope", {
+												// Non-fatal: the session has moved; the SSH tool refreshes
+												// on its next activation attempt.
+												logger.warn("Committed session rescope could not refresh the SSH tool", {
 													error: safeErrorForLog(error),
+													cwd: sessionManager.getCwd(),
 												});
 											}
+											return { from, to: sessionManager.getCwd() };
+										} finally {
+											await targetHandle.close().catch(() => {});
 										}
-										// Cwd-derived read-only state the prompt and subagents consume.
-										// Best-effort by design: the move is committed, and a failed
-										// re-discovery must not present a committed move as a failure.
-										await applyRescopedReadState(sessionManager.getCwd());
-										try {
-											await session?.refreshSshTool({ activateIfAvailable: true });
-										} catch (error) {
-											// Non-fatal: the session has moved; the SSH tool refreshes
-											// on its next activation attempt.
-											logger.warn("Committed session rescope could not refresh the SSH tool", {
-												error: safeErrorForLog(error),
-												cwd: sessionManager.getCwd(),
-											});
-										}
-										return { from, to: sessionManager.getCwd() };
 									} finally {
-										await targetHandle.close().catch(() => {});
+										await sourceHandle.close().catch(() => {});
 									}
 								});
 							};
@@ -2593,7 +2718,9 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			registerForegroundFoldParticipant: adapter =>
 				session?.registerForegroundFoldParticipant(adapter) ?? (() => {}),
 			hasForegroundBashBackgroundRequestHandler: () => session?.hasForegroundBashBackgroundRequestHandler() ?? false,
-			requestForegroundBashBackground: () => Promise.resolve(session?.requestForegroundBashBackground() ?? false),
+			requestForegroundBashBackground: (reason, adapter) =>
+				Promise.resolve(session?.requestForegroundBashBackground(reason, adapter) ?? false),
+			getToolInterruptPolicy: () => agent?.getToolInterruptPolicy() ?? "abort_tools",
 
 			getCredentialSessionId: () => session?.credentialSessionId ?? credentialSessionId,
 			getMcpManager: () => mcpManager ?? options.inheritedMcpManager,
@@ -2623,6 +2750,8 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			getToolForExecution: name => session?.getToolForExecution(name),
 			agentRegistry,
 			getSessionSpawns: () => options.spawns ?? "*",
+			getMasterBashCapability: () => masterModeContext?.getCapability(),
+			getMasterOwnerSessionId: () => masterModeContext?.ownerSessionId,
 			getModelString: () => (hasExplicitModel && model ? formatModelString(model) : undefined),
 			getActiveModelString,
 			getPlanModeState: () => session?.getPlanModeState(),
@@ -2648,16 +2777,6 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				return m ? buildNamedToolChoice(name, m) : undefined;
 			},
 			buildToolChoiceResult: name => buildNamedToolChoiceResult(name, session.model),
-			steer: msg =>
-				session.agent.steer({
-					role: "custom",
-					customType: msg.customType,
-					content: msg.content,
-					display: false,
-					details: msg.details,
-					attribution: "agent",
-					timestamp: Date.now(),
-				}),
 			sendCustomMessage: (msg, opts) => session.sendCustomMessage(msg, opts),
 			purgeQueuedCustomMessages: predicate => session.purgeQueuedCustomMessages(predicate),
 			peekQueueInvoker: () => session.peekQueueInvoker(),
@@ -3171,6 +3290,13 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 							controller: notificationSessionController,
 							spawnedByGjc,
 							sdkHostModeSupported: options.sdkHostModeSupported,
+							...(masterModeContext
+								? {
+										masterCapability: masterModeContext.getCapability(),
+										masterAttestationEpoch: masterModeContext.attestationEpoch,
+										masterOwnerSessionId: masterModeContext.ownerSessionId,
+									}
+								: {}),
 							// INTERNAL terminal-abort seams, threaded directly from the
 							// owning session (NOT on the public extension context).
 							terminalAbortSeams: {
@@ -3218,9 +3344,19 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 						createSdkSessionRuntimeExtension(api, {
 							agentDir,
 							brokerRegistrationRequired: lifecycleStartupCapability !== undefined,
+							...(lifecycleStartupCapability?.lifecycleRequestId
+								? { lifecycleRequestId: lifecycleStartupCapability.lifecycleRequestId }
+								: {}),
 							createTransport: input => createSdkWebSocketTransport(input),
 							settings,
 							configOverrides: new Map(),
+							...(masterModeContext
+								? {
+										masterCapability: masterModeContext.getCapability(),
+										masterAttestationEpoch: masterModeContext.attestationEpoch,
+										masterOwnerSessionId: masterModeContext.ownerSessionId,
+									}
+								: {}),
 							// INTERNAL terminal-abort seams, threaded directly from the
 							// owning session (NOT on the public extension context).
 							terminalAbortSeams: {
@@ -3419,11 +3555,38 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 		// Fall back to first available model with a valid API key, honoring the
 		// path-scoped `enabledModels` allow-list when configured. Skip when the
 		// user explicitly requested a model via --model that wasn't found.
-		if (!model && !options.modelPattern && !startupCredentialModelRejected) {
+		if (
+			!model &&
+			!options.modelPattern &&
+			!startupCredentialModelRejected &&
+			(configuredDefaultPatterns.length === 0 || preferredCredentialProvider !== undefined)
+		) {
 			// Re-resolve the allowed set: extension factories above may have
 			// registered providers/models that weren't visible at startup.
-			const fallbackCandidates = await resolveAllowedModels(modelRegistry, settings, modelMatchPreferences);
-			for (const candidate of fallbackCandidates) {
+			const allowedFallbackCandidates = await resolveAllowedModels(modelRegistry, settings, modelMatchPreferences);
+			// A fresh provider discovery can disprove a bundled model while the
+			// general available catalog retains it for offline/profile compatibility.
+			// Exclude only those positively disproved bundled entries from the
+			// unconfigured startup path; explicit model/profile resolution above keeps
+			// its existing precedence and semantics.
+			const profileAvailableKeys = new Set(
+				modelRegistry
+					.getAvailableForProfileActivation()
+					.map(candidate => `${candidate.provider}\u0000${candidate.id}`),
+			);
+			const fallbackCandidates = allowedFallbackCandidates.filter(candidate =>
+				profileAvailableKeys.has(`${candidate.provider}\u0000${candidate.id}`),
+			);
+			// Candidate order is not a quality signal: catalogs sort retired models
+			// ahead of current ones whenever their IDs carry older date suffixes, so
+			// an unconfigured install would otherwise start on a model its provider
+			// has already withdrawn. Sweep each known provider's curated default
+			// first — the same table `findInitialModel` consults — and only then fall
+			// back to catalog order.
+			for (const candidate of orderByProviderDefaultFirst(
+				fallbackCandidates,
+				modelRegistry.automaticProviderOrder(credentialSessionId),
+			)) {
 				if (await hasModelApiKey(candidate)) {
 					model = candidate;
 					break;
@@ -3730,7 +3893,9 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				? await memoryBackend.buildDeveloperInstructions(agentDir, settings, session)
 				: undefined;
 
-			const appendPrompt: string | undefined = memoryInstructions ?? undefined;
+			const browserBackend = resolveBrowserBackend(settings);
+			const appendPrompt =
+				[memoryInstructions, browserBackend.developerInstructions].filter(Boolean).join("\n\n") || undefined;
 			let pluginSystemAppendices = "";
 			try {
 				pluginSystemAppendices = await renderAlwaysOnSystemAppendices({ cwd: getLiveCwd() });
@@ -3775,16 +3940,20 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				if (hasSession) session.configWarnings.push(warning);
 				logger.warn("Context file discovery warning", { warning });
 			}
+			// The master doctrine block is appended exactly once, AFTER any custom
+			// system-prompt transformation, and only for the master session itself.
+			const withMasterGuidance = (built: BuildSystemPromptResult): BuildSystemPromptResult =>
+				masterModeContext ? { ...built, systemPrompt: [...built.systemPrompt, masterModeTemplate.trim()] } : built;
 			if (options.systemPrompt === undefined) {
-				return defaultPrompt;
+				return withMasterGuidance(defaultPrompt);
 			}
 			if (Array.isArray(options.systemPrompt)) {
-				return { systemPrompt: options.systemPrompt, warnings: defaultPrompt.warnings };
+				return withMasterGuidance({ systemPrompt: options.systemPrompt, warnings: defaultPrompt.warnings });
 			}
-			return {
+			return withMasterGuidance({
 				systemPrompt: options.systemPrompt(defaultPrompt.systemPrompt),
 				warnings: defaultPrompt.warnings,
-			};
+			});
 		};
 
 		const toolNamesFromRegistry = Array.from(toolRegistry.keys());
@@ -4107,7 +4276,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			transformContext,
 			steeringMode: settings.get("steeringMode") ?? "one-at-a-time",
 			followUpMode: settings.get("followUpMode") ?? "one-at-a-time",
-			interruptMode: settings.get("interruptMode") ?? "immediate",
+			toolInterruptPolicy: settings.get("toolInterruptPolicy") ?? "abort_tools",
 			thinkingBudgets: settings.getGroup("thinkingBudgets"),
 			temperature: settings.get("temperature") >= 0 ? settings.get("temperature") : undefined,
 			topP: settings.get("topP") >= 0 ? settings.get("topP") : undefined,
@@ -4128,13 +4297,19 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			preferWebsockets: preferOpenAICodexWebsockets,
 			getToolContext: tc => toolContextStore.getContext(tc),
 			getApiKey: async provider => {
-				// Read agent.sessionId at call time so credential selection stays aligned
-				// with metadataResolver after /new, fork, resume, or branch switches.
-				const key = await modelRegistry.getApiKeyForProvider(provider, credentialSessionId);
-				if (!key) {
+				// AgentLoop asks by provider, but the active model carries the
+				// model-scoped credential selector. Read it at call time so model
+				// changes are honored after /new, fork, resume, or branch switches.
+				const liveModel = sessionAgent?.state.model ?? model;
+				const key =
+					liveModel?.provider === provider
+						? await modelRegistry.getApiKey(liveModel, credentialSessionId)
+						: undefined;
+				const providerKey = key ?? (await modelRegistry.getApiKeyForProvider(provider, credentialSessionId));
+				if (!providerKey) {
 					throw new Error(`No API key found for provider "${provider}"`);
 				}
-				return key;
+				return providerKey;
 			},
 			getAuthCredentialType: provider => modelRegistry.getSessionCredentialType(provider, credentialSessionId),
 			streamFn: async (streamModel, context, streamOptions) => {
@@ -4221,6 +4396,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			telemetry: options.telemetry,
 			appendOnlyContext,
 		});
+		sessionAgent = agent;
 
 		cursorEventEmitter = event => agent.emitExternalEvent(event);
 
@@ -4343,6 +4519,31 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 		// carried by the host replay ring through the internal runtime seam above.
 		if (autoroutingInactive) session.configWarnings.push(AUTOROUTING_INACTIVE_WARNING);
 		hasSession = true;
+		if (masterModeContext) {
+			// One scoped, no-probe peer snapshot immediately before the FIRST accepted
+			// provider request; see createMasterPeerSnapshotContributor for the
+			// discard/reuse/no-duplicate semantics.
+			const capturedSession = session;
+			session.registerBeforeAgentStartContributor(
+				createMasterPeerSnapshotContributor({
+					lifecycle: createSessionLifecycleService(agentDir),
+					ownerSessionId: masterModeContext.ownerSessionId,
+					getSessionId: () => sessionManager.getSessionId(),
+					scope: masterModeContext.scope,
+					getCwd: getLiveCwd,
+					hasPersistedInjection: () =>
+						capturedSession.sessionManager
+							.getBranch()
+							.some(
+								entry =>
+									entry.type === "message" &&
+									(entry.message as { customType?: string }).customType === MASTER_PEER_SNAPSHOT_CUSTOM_TYPE,
+							),
+					onError: error =>
+						logger.debug("master peer snapshot injection failed", { error: safeErrorForLog(error) }),
+				}),
+			);
+		}
 		const sessionAsyncJobManager = asyncJobManager;
 		if (sessionAsyncJobManager) {
 			session.yieldQueue.register<AsyncResultEntry>("async-result", {
@@ -4373,38 +4574,49 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 
 		// Attach the live session to the pre-registered ref so peers can route IRC
 		// messages here. Refresh sessionFile in case it was unavailable at pre-register
-		// time. The dispose wrapper below unregisters on teardown.
+		// time. The registered terminal cleanup below unregisters on teardown.
 		agentRegistry.attachSession(resolvedAgentId, session, sessionManager.getSessionFile() ?? null);
 		{
-			const originalDispose = session.dispose.bind(session);
-			session.dispose = async () => {
-				try {
-					await originalDispose();
-				} finally {
+			let cleanupPromise: Promise<void> | undefined;
+			const finishCleanup = async (): Promise<void> => {
+				if (cleanupPromise) return cleanupPromise;
+				const cleanup = (async () => {
+					const failures: unknown[] = [];
 					try {
 						agentRegistry.unregister(resolvedAgentId);
 						releaseCredentialDisabledSubscription();
 						releaseLocalProtocolOverride();
+					} catch (error) {
+						failures.push(error);
 					} finally {
-						// The endpoint is gone: its owned registrations can never
-						// reach a delivery settlement boundary, and foreign-endpoint
-						// tuples are deliberately never classified terminal by other
-						// managers — retire them before unregistering the manager so
-						// repeated session churn cannot saturate the registry
-						// (review thread P2). The endpoint is the manager's live
-						// registration key, which survives newSession/switchSession
-						// rekeying and may differ from the persisted logical session id.
-						if (!options.parentTaskPrefix) {
-							retireOwnedRegistrationsForEndpoint(
-								AsyncJobManager.endpointIdOf(asyncJobManager) ?? asyncJobEndpointId,
-							);
-							AsyncJobManager.unregisterManager(asyncJobManager);
+						try {
+							if (!options.parentTaskPrefix) {
+								retireOwnedRegistrationsForEndpoint(
+									AsyncJobManager.endpointIdOf(asyncJobManager) ?? asyncJobEndpointId,
+								);
+								AsyncJobManager.unregisterManager(asyncJobManager);
+							}
+						} catch (error) {
+							failures.push(error);
+						}
+						try {
+							await closeOwnedAuthStorage();
+						} catch (error) {
+							failures.push(error);
+						}
+						try {
+							await closeOwnedSettings();
+						} catch (error) {
+							failures.push(error);
 						}
-						await closeOwnedAuthStorage();
-						await closeOwnedSettings();
 					}
-				}
+					if (failures.length > 0) throw new AggregateError(failures, "SDK disposal cleanup failed.");
+				})();
+				cleanupPromise = cleanup;
+				void cleanup.catch(() => {});
+				return cleanup;
 			};
+			session.registerToolSessionCleanup(finishCleanup);
 		}
 
 		if (model?.api === "openai-codex-responses") {
@@ -4632,7 +4844,16 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 		let cleanupDiagnostic: unknown;
 		try {
 			if (hasSession) {
-				await session.dispose();
+				try {
+					await session.dispose();
+				} catch (disposeError) {
+					if (!isSessionDisposalIncompleteError(disposeError)) {
+						throw disposeError;
+					}
+					// The first call is intentionally bounded for startup callers. Join the
+					// retained teardown before releasing the resources it still owns.
+					await session.awaitDisposeCompletion();
+				}
 			} else {
 				if (hasRegistered) agentRegistry.unregister(resolvedAgentId);
 				// Admission happens before session construction. Any later startup