@gajae-code/coding-agent 0.16.1 → 0.16.4

package/src/sdk/protocol/operation-inventory.generated.json

@@ -2841,6 +2841,50 @@
 			"testIds": "not_applicable"
 		}
 	},
+	{
+		"sourceId": "agent_session:awaitDisposeCompletion",
+		"sourceFile": "packages/coding-agent/src/session/agent-session.ts",
+		"sourceKind": "agent_session",
+		"decision": "exclude",
+		"rationale": "test-only disposal completion seam, not a user-facing SDK control seam",
+		"exclusionMetadata": {
+			"adapterMappings": "not_applicable",
+			"testIds": "not_applicable"
+		}
+	},
+	{
+		"sourceId": "agent_session:setDisposeTimeoutForTests",
+		"sourceFile": "packages/coding-agent/src/session/agent-session.ts",
+		"sourceKind": "agent_session",
+		"decision": "exclude",
+		"rationale": "test-only disposal timeout seam, not a user-facing SDK control seam",
+		"exclusionMetadata": {
+			"adapterMappings": "not_applicable",
+			"testIds": "not_applicable"
+		}
+	},
+	{
+		"sourceId": "agent_session:trackPostPromptTaskForTests",
+		"sourceFile": "packages/coding-agent/src/session/agent-session.ts",
+		"sourceKind": "agent_session",
+		"decision": "exclude",
+		"rationale": "test-only post-prompt task seam, not a user-facing SDK control seam",
+		"exclusionMetadata": {
+			"adapterMappings": "not_applicable",
+			"testIds": "not_applicable"
+		}
+	},
+	{
+		"sourceId": "agent_session:requestWorkerIntegrationForTests",
+		"sourceFile": "packages/coding-agent/src/session/agent-session.ts",
+		"sourceKind": "agent_session",
+		"decision": "exclude",
+		"rationale": "test-only worker integration seam, not a user-facing SDK control seam",
+		"exclusionMetadata": {
+			"adapterMappings": "not_applicable",
+			"testIds": "not_applicable"
+		}
+	},
 	{
 		"sourceId": "agent_session:closeWriterStrict",
 		"sourceFile": "packages/coding-agent/src/session/agent-session.ts",
@@ -2885,6 +2929,17 @@
 			"testIds": "not_applicable"
 		}
 	},
+	{
+		"sourceId": "agent_session:runWithPromptAdmissionForTests",
+		"sourceFile": "packages/coding-agent/src/session/agent-session.ts",
+		"sourceKind": "agent_session",
+		"decision": "exclude",
+		"rationale": "test-only prompt admission seam, not a user-facing SDK control seam",
+		"exclusionMetadata": {
+			"adapterMappings": "not_applicable",
+			"testIds": "not_applicable"
+		}
+	},
 	{
 		"sourceId": "agent_session:queueCoordinatorRuntimeStatePersistForTests",
 		"sourceFile": "packages/coding-agent/src/session/agent-session.ts",
@@ -3912,6 +3967,17 @@
 			"testIds": "not_applicable"
 		}
 	},
+	{
+		"sourceId": "agent_session:reloadSkills",
+		"sourceFile": "packages/coding-agent/src/session/agent-session.ts",
+		"sourceKind": "agent_session",
+		"decision": "exclude",
+		"rationale": "internal marketplace lifecycle refresh for the session skill catalog; not an independent SDK ingress operation",
+		"exclusionMetadata": {
+			"adapterMappings": "not_applicable",
+			"testIds": "not_applicable"
+		}
+	},
 	{
 		"sourceId": "agent_session:retireWorkspaceTreeForRescope",
 		"sourceFile": "packages/coding-agent/src/session/agent-session.ts",

package/src/sdk/router/session-router.ts

@@ -338,6 +338,8 @@ type AttachedSession = {
 	replayPending: boolean;
 	replayPendingSince?: number;
 	replayPendingToken?: object;
+	drainingHeldSeq?: number;
+	drainingHeldBatch?: HeldFrame[];
 	readyTail: Promise<void>;
 	readonly publication: { promise: Promise<void>; resolve: () => void; reject: (reason?: unknown) => void };
 	dispose: () => void;
@@ -1899,44 +1901,53 @@ export class SessionRouter {
 	}
 
 	async #reinitializeAttachment(attached: AttachedSession): Promise<void> {
-		const previous = attached.readyTail;
+		// A prior ready tail may be waiting for publication work carried by the dead
+		// socket. Chaining the reconnect behind it prevents the replacement from even
+		// issuing replay. Replace its hold-array identity to fence that tail, but carry
+		// forward frames it had not started draining; the active draining sequence is
+		// already represented by the independent frame tail.
+		if (attached.barrier.held) {
+			const carried = [...(attached.drainingHeldBatch ?? []), ...attached.barrier.held];
+			attached.drainingHeldBatch = undefined;
+			attached.barrier.held = carried
+				.filter(entry => entry.seq !== attached.drainingHeldSeq)
+				.filter((entry, index, entries) => entries.findIndex(candidate => candidate.seq === entry.seq) === index);
+		}
 		const replayToken = {};
 		attached.replayPending = true;
 		attached.replayPendingSince = Date.now();
 		attached.replayPendingToken = replayToken;
-		const current = previous
-			.catch(() => undefined)
-			.then(async () => {
-				if (!this.#attachmentLive(attached)) return;
-				const proven = await this.#readProvenEndpoint(attached.indexed);
-				if (
-					!proven ||
-					proven.endpoint.url !== attached.endpoint.url ||
-					proven.endpoint.token !== attached.endpoint.token ||
-					proven.endpoint.pid !== attached.pid ||
-					!sameEndpointIdentity(attached.endpointIdentity, proven.identity)
-				) {
-					await this.#retireAttachment(attached, proven ? "replaced_same_generation" : undefined);
-					return;
-				}
-				attached.initializingPublication = true;
-				try {
-					void Promise.resolve()
-						.then(() => this.#deps.onNotificationSubscriptionReady?.(attached.notificationSubscription))
-						.catch(error => {
-							this.#detachNotification(attached, "cancelled");
-							logger.warn(`SDK notification subscription reconnect hook failed locally: ${String(error)}`);
-						});
-					await this.#deps.onAttachmentReady?.(attached.capability);
-					await this.#deps.onReplayReady?.();
-				} catch {
-					await this.#retireAttachment(attached);
-					return;
-				} finally {
-					attached.initializingPublication = false;
-				}
-				if (this.#attachmentLive(attached)) await this.#replayAttachment(attached, attached.cursor.seq);
-			});
+		const current = Promise.resolve().then(async () => {
+			if (!this.#attachmentLive(attached)) return;
+			const proven = await this.#readProvenEndpoint(attached.indexed);
+			if (
+				!proven ||
+				proven.endpoint.url !== attached.endpoint.url ||
+				proven.endpoint.token !== attached.endpoint.token ||
+				proven.endpoint.pid !== attached.pid ||
+				!sameEndpointIdentity(attached.endpointIdentity, proven.identity)
+			) {
+				await this.#retireAttachment(attached, proven ? "replaced_same_generation" : undefined);
+				return;
+			}
+			attached.initializingPublication = true;
+			try {
+				void Promise.resolve()
+					.then(() => this.#deps.onNotificationSubscriptionReady?.(attached.notificationSubscription))
+					.catch(error => {
+						this.#detachNotification(attached, "cancelled");
+						logger.warn(`SDK notification subscription reconnect hook failed locally: ${String(error)}`);
+					});
+				await this.#deps.onAttachmentReady?.(attached.capability);
+				await this.#deps.onReplayReady?.();
+			} catch {
+				await this.#retireAttachment(attached);
+				return;
+			} finally {
+				attached.initializingPublication = false;
+			}
+			if (this.#attachmentLive(attached)) await this.#replayAttachment(attached, attached.cursor.seq);
+		});
 		attached.readyTail = current.finally(() => {
 			if (attached.replayPendingToken === replayToken) {
 				attached.replayPending = false;
@@ -2294,7 +2305,19 @@ export class SessionRouter {
 				return;
 			}
 			const batch = held.splice(0, held.length).sort((left, right) => left.seq - right.seq);
-			for (const entry of batch) await this.#enqueueFrame(attached, entry.frame, "ordered");
+			attached.drainingHeldBatch = batch;
+			for (;;) {
+				const entry = batch.shift();
+				if (!entry) break;
+				attached.drainingHeldSeq = entry.seq;
+				try {
+					await this.#enqueueFrame(attached, entry.frame, "ordered");
+				} finally {
+					if (attached.drainingHeldSeq === entry.seq) attached.drainingHeldSeq = undefined;
+				}
+				if (attached.barrier.held !== held) return;
+			}
+			if (attached.drainingHeldBatch === batch) attached.drainingHeldBatch = undefined;
 		}
 	}
 
@@ -2374,7 +2397,7 @@ export class SessionRouter {
 				this.#failBarrier(attached, "replay response contained a malformed event");
 				return;
 			}
-			let previousSeq = sinceSeq;
+			let previousSeq = -1;
 			for (const event of events) {
 				if (event.type !== "event") {
 					this.#failBarrier(attached, "replay response contained a non-event frame");
@@ -2411,7 +2434,7 @@ export class SessionRouter {
 				}
 				const retained = events
 					.map(event => readSequence(event.seq))
-					.find(seq => seq !== undefined && seq <= gap.toSeq);
+					.find(seq => seq !== undefined && seq >= gap.fromSeq && seq <= gap.toSeq);
 				if (retained !== undefined) {
 					this.#failBarrier(
 						attached,

package/src/sdk/session-api-key.ts

@@ -0,0 +1,94 @@
+/**
+ * AgentLoop calls `getApiKey(provider)` before `streamFn`.
+ * Resolve/stream already use `getApiKey(model)`. If those two lookups diverge,
+ * the child dies locally (~8ms, 0 tokens, sanitized "Agent run failed.")
+ * and never reaches the working model-scoped path (#5081).
+ */
+export type SessionApiKeyModel = {
+	provider: string;
+	baseUrl?: string;
+};
+
+export type SessionApiKeyRegistry = {
+	getApiKey(
+		model: SessionApiKeyModel,
+		sessionId?: string,
+		options?: { signal?: AbortSignal },
+	): Promise<string | undefined>;
+	getApiKeyForProvider(
+		provider: string,
+		sessionId?: string,
+		baseUrl?: string,
+		options?: { signal?: AbortSignal },
+	): Promise<string | undefined>;
+};
+
+export type SessionApiKeyResolution = {
+	apiKey: string;
+	credentialSessionId: string | undefined;
+};
+
+export type SessionApiKeyCredentialType = "api_key" | "oauth" | undefined;
+
+export function isStableSessionApiKeyCredentialType(
+	previous: SessionApiKeyCredentialType,
+	replacement: SessionApiKeyCredentialType,
+): boolean {
+	return previous === replacement;
+}
+
+export function resolveLiveSessionApiKeyModel(
+	live: SessionApiKeyModel | undefined,
+	captured: SessionApiKeyModel | undefined,
+	provider: string,
+): SessionApiKeyModel | undefined {
+	if (live?.provider === provider) return live;
+	if (captured?.provider === provider) return captured;
+	return undefined;
+}
+
+async function lookupOnce(
+	registry: SessionApiKeyRegistry,
+	provider: string,
+	sessionId: string | undefined,
+	model: SessionApiKeyModel | undefined,
+	signal: AbortSignal | undefined,
+): Promise<string | undefined> {
+	signal?.throwIfAborted();
+	const matchingModel = model?.provider === provider ? model : undefined;
+	const options = signal ? { signal } : undefined;
+	let key: string | undefined;
+	if (matchingModel) {
+		key = await registry.getApiKey(matchingModel, sessionId, options);
+		signal?.throwIfAborted();
+	}
+	if (!key) {
+		key = await registry.getApiKeyForProvider(provider, sessionId, matchingModel?.baseUrl, options);
+		signal?.throwIfAborted();
+	}
+	return key;
+}
+
+export async function lookupSessionApiKey(
+	registry: SessionApiKeyRegistry,
+	provider: string,
+	sessionId: string | undefined,
+	model: SessionApiKeyModel | undefined,
+	allowUnscopedRetry = true,
+	signal?: AbortSignal,
+): Promise<SessionApiKeyResolution> {
+	let key = await lookupOnce(registry, provider, sessionId, model, signal);
+	// Architect children inherit the parent SID. Direct `-p --no-session` does
+	// not. Scoped miss then global/broker hit is the remaining 0-token death
+	// after #5105 (jsonl: Agent run failed / output 0).
+	if (!key && sessionId && allowUnscopedRetry) {
+		key = await lookupOnce(registry, provider, undefined, model, signal);
+		if (key) return { apiKey: key, credentialSessionId: undefined };
+	}
+	if (!key) {
+		throw Object.assign(new Error(`No API key found for provider "${provider}"`), {
+			code: "provider_unavailable",
+		});
+	}
+	return { apiKey: key, credentialSessionId: sessionId };
+}

package/src/sdk/session.ts

@@ -197,6 +197,11 @@ import { EventBus } from "../utils/event-bus";
 import { buildNamedToolChoice, buildNamedToolChoiceResult } from "../utils/tool-choice";
 import type { WorkspaceTree } from "../workspace-tree";
 import { createSessionLifecycleService } from "./lifecycle/client";
+import {
+	isStableSessionApiKeyCredentialType,
+	lookupSessionApiKey,
+	resolveLiveSessionApiKeyModel,
+} from "./session-api-key";
 import {
 	attachLifecycleStartupCapability,
 	lifecycleMcpStartupTimeoutOption,
@@ -2338,15 +2343,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			}
 			if (options.skills === undefined && settings.get("skills.enabled")) {
 				try {
-					const reloaded = await loadSkills({
-						...settings.getGroup("skills"),
-						agentDir,
-						cwd: to,
-						disabledExtensions: settings.get("disabledExtensions"),
-					});
-					skills = withEmbeddedDefaultGjcSkills(reloaded.skills);
-					if (!options.parentTaskPrefix) setActiveSkills(skills);
-					await session?.replaceSkills(skills);
+					await session?.reloadSkills(to);
 				} catch (error) {
 					logger.warn("Failed to reload skills after session rescope", { error: safeErrorForLog(error) });
 				}
@@ -2708,19 +2705,19 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				else signal.addEventListener("abort", () => resolve(), { once: true });
 				return promise;
 			},
+			getSessionId: () => sessionManager.getSessionId(),
 			// Subagents inherit the parent's manager; its registered endpoint is
 			// authoritative for owned-registration keying and endpoint-first
 			// manager lookup (the child's own id is never registered), so tools
 			// pass the same endpoint the manager's completion callback resolves
 			// (review thread P1). For a top-level session this equals the
 			// session id.
-			getSessionId: () => AsyncJobManager.endpointIdOf(asyncJobManager) ?? asyncJobEndpointId,
+			getAsyncEndpointId: () => AsyncJobManager.endpointIdOf(asyncJobManager) ?? asyncJobEndpointId,
 			registerForegroundFoldParticipant: adapter =>
 				session?.registerForegroundFoldParticipant(adapter) ?? (() => {}),
 			hasForegroundBashBackgroundRequestHandler: () => session?.hasForegroundBashBackgroundRequestHandler() ?? false,
 			requestForegroundBashBackground: (reason, adapter) =>
 				Promise.resolve(session?.requestForegroundBashBackground(reason, adapter) ?? false),
-			getToolInterruptPolicy: () => agent?.getToolInterruptPolicy() ?? "abort_tools",
 
 			getCredentialSessionId: () => session?.credentialSessionId ?? credentialSessionId,
 			getMcpManager: () => mcpManager ?? options.inheritedMcpManager,
@@ -3925,6 +3922,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				appendSystemPrompt: appendPrompt,
 				pluginAppendices: pluginSystemAppendices,
 				repeatToolDescriptions,
+				reasoningLanguage: settings.get("reasoningLanguage"),
 				intentField,
 				toolDiscoveryActive: effectiveDiscoveryMode === "all" || mcpDiscoveryEnabled,
 				eagerTasks: resolveEagerTasks(),
@@ -4258,6 +4256,32 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			).seedNormalizedMessages(options.forkContextSeed.messages);
 		}
 
+		const resolvedCredentialScopes = new Map<string, string | undefined>();
+		const resolveAgentApiKey = async (provider: string, signal?: AbortSignal): Promise<string> => {
+			const liveModel = resolveLiveSessionApiKeyModel(sessionAgent?.state.model, model, provider);
+			const hasExplicitScopePolicy =
+				modelRegistry.authStorage.hasSessionCredentialSelector(provider, credentialSessionId) ||
+				modelRegistry.authStorage.hasSessionCredentialAuto(provider, credentialSessionId);
+			const resolution = await lookupSessionApiKey(
+				modelRegistry,
+				provider,
+				credentialSessionId,
+				liveModel,
+				!hasExplicitScopePolicy,
+				signal,
+			);
+			resolvedCredentialScopes.set(provider, resolution.credentialSessionId);
+			return resolution.apiKey;
+		};
+		const resolvedCredentialType = (provider: string): "api_key" | "oauth" | undefined => {
+			const scope = resolvedCredentialScopes.has(provider)
+				? resolvedCredentialScopes.get(provider)
+				: credentialSessionId;
+			return modelRegistry.authStorage.getEffectiveCredentialType(provider, scope, {
+				owner: modelRegistry.getAuthStorageOwner(),
+			});
+		};
+
 		agent = new Agent({
 			initialState: {
 				systemPrompt,
@@ -4296,44 +4320,42 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			shouldPause: options.shouldPause,
 			preferWebsockets: preferOpenAICodexWebsockets,
 			getToolContext: tc => toolContextStore.getContext(tc),
-			getApiKey: async provider => {
+			getApiKey: provider => {
 				// AgentLoop asks by provider, but the active model carries the
 				// model-scoped credential selector. Read it at call time so model
 				// changes are honored after /new, fork, resume, or branch switches.
-				const liveModel = sessionAgent?.state.model ?? model;
-				const key =
-					liveModel?.provider === provider
-						? await modelRegistry.getApiKey(liveModel, credentialSessionId)
-						: undefined;
-				const providerKey = key ?? (await modelRegistry.getApiKeyForProvider(provider, credentialSessionId));
-				if (!providerKey) {
-					throw new Error(`No API key found for provider "${provider}"`);
-				}
-				return providerKey;
+				return resolveAgentApiKey(provider);
 			},
-			getAuthCredentialType: provider => modelRegistry.getSessionCredentialType(provider, credentialSessionId),
+			getAuthCredentialType: resolvedCredentialType,
 			streamFn: async (streamModel, context, streamOptions) => {
 				const requestStartedAt = performance.now();
 				let stream: Awaited<ReturnType<typeof streamSimple>>;
 				try {
-					const effectiveApiKey = await modelRegistry.getApiKey(streamModel, credentialSessionId);
 					stream = await streamSimple(streamModel, context, {
 						...streamOptions,
-						apiKey: effectiveApiKey,
-						authCredentialType: modelRegistry.getSessionCredentialType(streamModel.provider, credentialSessionId),
 						onAuthError: async (provider, oldKey, error) => {
+							const resolvedScope = resolvedCredentialScopes.has(provider)
+								? resolvedCredentialScopes.get(provider)
+								: credentialSessionId;
 							await modelRegistry.authStorage.invalidateCredentialMatching(provider, oldKey, {
 								signal: streamOptions?.signal,
-								sessionId: credentialSessionId,
+								sessionId: resolvedScope,
 								owner: modelRegistry.getAuthStorageOwner(),
 							});
 							logger.debug("Retrying provider request after credential invalidation", {
 								provider,
 								error: error instanceof Error ? error.message : String(error),
 							});
-							return modelRegistry.getApiKey(streamModel, credentialSessionId, {
-								signal: streamOptions?.signal,
-							});
+							const replacementApiKey = await resolveAgentApiKey(provider, streamOptions?.signal);
+							if (
+								!isStableSessionApiKeyCredentialType(
+									streamOptions?.authCredentialType,
+									resolvedCredentialType(provider),
+								)
+							) {
+								return undefined;
+							}
+							return replacementApiKey;
 						},
 					});
 				} catch (error) {
@@ -4460,6 +4482,27 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			customCommands: customCommandsResult.commands,
 			skills,
 			skillWarnings,
+			reloadSkills:
+				options.skills === undefined
+					? async reloadCwd => {
+							if (!settings.get("skills.enabled")) {
+								return { skills: getEmbeddedDefaultGjcSkills(), warnings: [] };
+							} else {
+								const reloaded = await loadSkills({
+									...settings.getGroup("skills"),
+									agentDir,
+									cwd: reloadCwd,
+									disabledExtensions: settings.get("disabledExtensions"),
+								});
+								return { skills: withEmbeddedDefaultGjcSkills(reloaded.skills), warnings: reloaded.warnings };
+							}
+						}
+					: undefined,
+			onSkillsReloaded: (reloadedSkills, reloadedWarnings) => {
+				skills = reloadedSkills;
+				skillWarnings = reloadedWarnings;
+				if (!options.parentTaskPrefix) setActiveSkills(reloadedSkills);
+			},
 			skillsSettings: settings.getGroup("skills"),
 			modelRegistry,
 			taskDepth,

package/src/sdk/transport/serve-cli.ts

@@ -92,10 +92,10 @@ function brokerSessionRows(sessions: readonly unknown[]): BrokerSessionRow[] {
 }
 
 /** Exhausts strict broker `session.list` pages into one full session snapshot. */
-export async function listBrokerSessions(broker: SdkClient): Promise<BrokerSessionRow[]> {
+export async function listBrokerSessions(broker: SdkClient, explicitSessionId?: string): Promise<BrokerSessionRow[]> {
 	try {
 		const pages = await traverseSessionList(
-			{},
+			{ ...(explicitSessionId ? { resolveSessionId: explicitSessionId } : {}) },
 			async input => await broker.global("session.list", input),
 			response => {
 				brokerResult(response);
@@ -147,7 +147,7 @@ export async function runSdkServe(argv: string[]): Promise<void> {
 		throw new Error("broker_unavailable: SDK broker is not reachable");
 	}
 	try {
-		const sessionId = selectBrokerSession(await listBrokerSessions(broker), parsed.sessionId);
+		const sessionId = selectBrokerSession(await listBrokerSessions(broker, parsed.sessionId), parsed.sessionId);
 		const endpoint = brokerResult(await broker.global("session.get_endpoint", { sessionId }));
 		const url = typeof endpoint.url === "string" && endpoint.url ? endpoint.url : undefined;
 		const token = typeof endpoint.token === "string" ? endpoint.token : "";