@gajae-code/coding-agent 0.16.1 → 0.16.4

package/src/config/file-lock.ts

@@ -2,8 +2,19 @@ import * as crypto from "node:crypto";
 import type { BigIntStats } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import type { NativeDirectoryTreeResult, NativeExactUnlinkResult, NativeNoReplaceResult } from "@gajae-code/natives";
-import { renameDirectoryNoReplacePathAsync, renameNoReplacePathAsync } from "@gajae-code/natives";
+import type {
+	NativeDirectoryTreeResult,
+	NativeDirectoryTreeSnapshot,
+	NativeExactUnlinkResult,
+	NativeNoReplaceResult,
+	RecoveryFsPublishResult,
+} from "@gajae-code/natives";
+import {
+	openRecoveryFsRoot,
+	renameDirectoryNoReplacePathAsync,
+	renameNoReplacePathAsync,
+	snapshotDirectoryTree,
+} from "@gajae-code/natives";
 import { isEnoent } from "@gajae-code/utils/fs-error";
 import { nativeProcessBindings } from "@gajae-code/utils/native-process";
 
@@ -397,11 +408,114 @@ export interface FileLockOwnerToken {
  * another process may copy into a new lock generation.
  */
 const fileLockDirIdentities = new WeakMap<object, GenericFileLockDirIdentity>();
+const pendingDetachedLockCleanups = new WeakMap<object, { path: string; rootDev: string; rootIno: string }>();
+
+async function finishDetachedLockCleanup(owner: FileLockOwnerToken): Promise<boolean> {
+	const pending = pendingDetachedLockCleanups.get(owner);
+	if (!pending) return false;
+	try {
+		const current = await fs.lstat(pending.path, { bigint: true });
+		if (
+			!current.isDirectory() ||
+			current.isSymbolicLink() ||
+			current.dev.toString() !== pending.rootDev ||
+			current.ino.toString() !== pending.rootIno
+		) {
+			throw new Error("Detached file lock cleanup identity changed; refusing removal");
+		}
+		await fs.rm(pending.path, { recursive: true, force: true });
+	} catch (error) {
+		if (!isEnoent(error)) throw error;
+	}
+	pendingDetachedLockCleanups.delete(owner);
+	return true;
+}
 
 function getLockPath(filePath: string): string {
 	return `${filePath}.lock`;
 }
 
+function fileLockRemovalTransitionPath(lockPath: string): string {
+	return `${lockPath}.removing`;
+}
+
+async function fileLockRemovalTransitionExists(lockPath: string): Promise<boolean> {
+	try {
+		await fs.lstat(fileLockRemovalTransitionPath(lockPath));
+		return true;
+	} catch (error) {
+		if (isEnoent(error)) return false;
+		throw error;
+	}
+}
+
+function sameFileLockTreeAfterPublication(
+	staged: NativeDirectoryTreeSnapshot,
+	published: NativeDirectoryTreeSnapshot,
+): boolean {
+	return (
+		staged.rootDev === published.rootDev &&
+		staged.rootIno === published.rootIno &&
+		staged.entries.length === published.entries.length &&
+		staged.entries.every((entry, index) => {
+			const current = published.entries[index];
+			return (
+				current !== undefined &&
+				entry.relativePath === current.relativePath &&
+				entry.kind === current.kind &&
+				entry.dev === current.dev &&
+				entry.ino === current.ino &&
+				entry.nlink === current.nlink &&
+				entry.size === current.size &&
+				entry.mtimeNs === current.mtimeNs &&
+				(entry.relativePath === "" || entry.ctimeNs === current.ctimeNs) &&
+				entry.sha256 === current.sha256
+			);
+		})
+	);
+}
+
+function rollbackPublishedFileLock(
+	canonicalParent: string,
+	lockPath: string,
+	pendingPath: string,
+	stagedSnapshot: NativeDirectoryTreeSnapshot,
+): void {
+	const authority = openRecoveryFsRoot(canonicalParent);
+	let rollback: RecoveryFsPublishResult | undefined;
+	const errors: unknown[] = [];
+	try {
+		rollback = authority.renameManagedTreeNoReplace(
+			path.basename(lockPath),
+			path.basename(pendingPath),
+			stagedSnapshot,
+		);
+	} catch (error) {
+		errors.push(error);
+	}
+	if (rollback && !rollback.ok) {
+		const failure = new Error(
+			`Failed to roll back file lock published during removal transition: ${rollback.code ?? "unknown"}.`,
+		) as NodeJS.ErrnoException;
+		if (rollback.code) failure.code = rollback.code;
+		errors.push(failure);
+	}
+	try {
+		const closed = authority.close();
+		if (!closed.ok && closed.code !== "closed") {
+			const failure = new Error(
+				`Failed to close file lock rollback authority: ${closed.code ?? "unknown"}.`,
+			) as NodeJS.ErrnoException;
+			if (closed.code) failure.code = closed.code;
+			errors.push(failure);
+		}
+	} catch (error) {
+		errors.push(error);
+	}
+	if (errors.length > 0) throw new AggregateError(errors, "File lock rollback authority failed");
+	if (!rollback) throw new Error("File lock rollback returned no result");
+}
+
 async function ensureLockParent(directory: string): Promise<void> {
 	const missing: string[] = [];
 	let current = path.resolve(directory);
@@ -704,17 +818,12 @@ export async function removeFileLockDirForGc(
 		removed.retainedPlaceholderPath === undefined &&
 		removed.retainedUnknownPath === undefined;
 	if (verifiedDetach && detachedPath !== undefined) {
-		// The security-critical phase is done: the verified tree was detached from
-		// the canonical name and durably parked under the no-replace quarantine
-		// name with no successor retained. Finish that replay deterministically by
-		// deleting the retained quarantine — the same completion contract gc-runtime
-		// applies to its own exact removals — then report the release as done.
-		try {
-			await fs.rm(detachedPath, { recursive: true, force: true });
-		} catch {
-			// The canonical pathname is free either way; a retained quarantine is
-			// recoverable debris, not a live lock.
-		}
+		pendingDetachedLockCleanups.set(expected, {
+			path: detachedPath,
+			rootDev: captured.snapshot.rootDev,
+			rootIno: captured.snapshot.rootIno,
+		});
+		await finishDetachedLockCleanup(expected);
 		return "removed";
 	}
 	if (removed.code === "not_found") return "removed";
@@ -880,8 +989,10 @@ async function tryAcquireLock(
 	if (afterParentMkdir) await afterParentMkdir(lockPath);
 	const pendingPath = `${lockPath}.pending.${process.pid}.${crypto.randomUUID()}`;
 	const owner = lockInfo(ownerHostId, ownerToken);
+	let removePending = false;
 	try {
 		await fs.mkdir(pendingPath, { mode: 0o700 });
+		removePending = true;
 		await fs.chmod(pendingPath, 0o700);
 		await writeLockInfo(pendingPath, owner);
 		// A plain POSIX rename replaces an existing empty directory. The legacy
@@ -896,6 +1007,22 @@ async function tryAcquireLock(
 		// component would follow an attacker-replaced symlink before native no-follow
 		// validation gets a chance to reject it.
 		const canonicalPendingPath = path.join(canonicalParent, path.basename(pendingPath));
+		let stagedSnapshot: NativeDirectoryTreeSnapshot | undefined;
+		if (process.platform === "linux") {
+			// Linux exact tree removal owns this deterministic sibling from detach
+			// until cleanup. The outer acquisition loop supplies the existing bounded
+			// contention wait while the predecessor retains that namespace.
+			if (await fileLockRemovalTransitionExists(destinationPath)) return null;
+			const staged = snapshotDirectoryTree(canonicalPendingPath);
+			if (!staged.ok || !staged.snapshot) {
+				const failure = new Error(
+					`Failed to snapshot staged file lock: ${staged.code ?? "unknown"}.`,
+				) as NodeJS.ErrnoException;
+				if (staged.code) failure.code = staged.code;
+				throw failure;
+			}
+			stagedSnapshot = staged.snapshot;
+		}
 		const publication = FileLockTestHooks.nativePublicationBindings?.() ?? {
 			renameNoReplacePathAsync,
 			renameDirectoryNoReplacePathAsync,
@@ -924,12 +1051,34 @@ async function tryAcquireLock(
 			if (published.code) failure.code = published.code;
 			throw failure;
 		}
-		// Published above, so an onAcquired failure must propagate instead of
-		// retrying an acquisition that already owns the lock.
+		removePending = false;
+		// The transition can appear after the pre-publication check only when the
+		// predecessor atomically detaches its lock before this no-replace publish.
+		// Roll this exact staged tree back to its UUID path before reporting
+		// contention; never delete or rename the predecessor's `.removing` tree.
+		if (stagedSnapshot && (await fileLockRemovalTransitionExists(destinationPath))) {
+			const publishedSnapshot = snapshotDirectoryTree(destinationPath);
+			if (
+				!publishedSnapshot.ok ||
+				!publishedSnapshot.snapshot ||
+				!sameFileLockTreeAfterPublication(stagedSnapshot, publishedSnapshot.snapshot)
+			) {
+				const failure = new Error(
+					`Failed to verify published file lock before transition rollback: ${publishedSnapshot.code ?? "identity_mismatch"}.`,
+				) as NodeJS.ErrnoException;
+				if (publishedSnapshot.code) failure.code = publishedSnapshot.code;
+				throw failure;
+			}
+			rollbackPublishedFileLock(canonicalParent, destinationPath, canonicalPendingPath, publishedSnapshot.snapshot);
+			removePending = true;
+			return null;
+		}
+		// Published and transition-free above, so an onAcquired failure must
+		// propagate instead of retrying an acquisition that already owns the lock.
 		onAcquired?.();
 		return owner;
 	} finally {
-		await fs.rm(pendingPath, { recursive: true, force: true }).catch(() => undefined);
+		if (removePending) await fs.rm(pendingPath, { recursive: true, force: true }).catch(() => undefined);
 	}
 }
 
@@ -1025,7 +1174,12 @@ async function quarantineReleasedLock(
 			return false;
 		} catch (error) {
 			if (isEnoent(error)) {
-				nativeFileLockBindings().exactRemoveDirectoryTree(removed.detachedPath, captured.snapshot);
+				pendingDetachedLockCleanups.set(owner, {
+					path: removed.detachedPath,
+					rootDev: captured.snapshot.rootDev,
+					rootIno: captured.snapshot.rootIno,
+				});
+				await finishDetachedLockCleanup(owner);
 				return true;
 			}
 			throw error;
@@ -1035,6 +1189,7 @@ async function quarantineReleasedLock(
 }
 
 async function releaseOwnedLock(lockPath: string, owner: FileLockOwnerToken): Promise<void> {
+	if (await finishDetachedLockCleanup(owner)) return;
 	let preVerdictIdentity: GenericFileLockDirIdentity | undefined;
 	try {
 		preVerdictIdentity = (await captureFileLockDirIdentity(lockPath)) ?? undefined;
@@ -1045,6 +1200,7 @@ async function releaseOwnedLock(lockPath: string, owner: FileLockOwnerToken): Pr
 	let lastTransientError: unknown;
 	for (let attempt = 0; attempt < FILE_LOCK_RELEASE_RETRY_ATTEMPTS; attempt++) {
 		try {
+			if (await finishDetachedLockCleanup(owner)) return;
 			const outcome = await removeFileLockDirForGc(lockPath, owner, preVerdictIdentity);
 			if (outcome === "removed" || outcome === "missing") {
 				if (outcome === "missing") throw new Error("Failed to release file lock: missing.");
@@ -1134,6 +1290,9 @@ async function releaseLock(lockPath: string, owner: FileLockOwnerToken, knownKey
  */
 async function lockHolderDescription(lockPath: string): Promise<string> {
 	try {
+		if (process.platform === "linux" && (await fileLockRemovalTransitionExists(lockPath))) {
+			return "blocked by retained removal transition; retry the owning process cleanup or inspect the exact orphan manually; unproven transition ownership is never removed";
+		}
 		const info = await readLockInfo(lockPath);
 		if (info) {
 			// A lock record carrying a foreign owner_host_id belongs to another
@@ -1190,6 +1349,11 @@ async function acquireLock(filePath: string, options: FileLockOptions = {}): Pro
 	for (let attempt = 0; attempt < opts.retries; attempt++) {
 		if (opts.signal?.aborted) throw opts.signal.reason ?? new Error("File lock acquisition aborted");
 		const localKey = await localLockKey(lockPath);
+		const priorRelease = localLockStates.get(localKey);
+		if (priorRelease && priorRelease.status !== "held" && pendingDetachedLockCleanups.has(priorRelease.owner)) {
+			await retryPendingLocalRelease(lockPath, localKey);
+			continue;
+		}
 		const owner = await tryAcquireLock(lockPath, opts.ownerHostId, ownerToken, opts.onAcquired);
 		if (owner) {
 			localLockStates.set(localKey, { owner, status: "held" });

package/src/config/model-preset-registry.ts

@@ -4,7 +4,7 @@ import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type { Api, Model } from "@gajae-code/ai/core";
 import type { NativeExactFileIdentity, NativeExactUnlinkResult } from "@gajae-code/natives";
-import { getAgentDir, isEnoent } from "@gajae-code/utils";
+import { $credentialEnv, getAgentDir, isEnoent } from "@gajae-code/utils";
 import * as z from "zod/v4";
 import { splitSelectorThinkingSuffix } from "../thinking";
 import { withFileLock } from "./file-lock";
@@ -1444,10 +1444,12 @@ function effectiveTrustedKeys(
 	return getModelPresetRegistryTestTrustedKeys(agentDir) ?? MODEL_PRESET_REGISTRY_TRUSTED_KEYS;
 }
 function effectiveManifestUrl(dependencies: ModelPresetRegistryDependencies): string {
-	return dependencies.manifestUrl ?? process.env.GJC_MODEL_PRESET_REGISTRY_URL ?? DEFAULT_MODEL_PRESET_REGISTRY_URL;
+	return (
+		dependencies.manifestUrl ?? $credentialEnv("GJC_MODEL_PRESET_REGISTRY_URL") ?? DEFAULT_MODEL_PRESET_REGISTRY_URL
+	);
 }
 function environmentDisabled(): boolean {
-	return /^(?:1|true|yes|on)$/i.test(process.env.GJC_MODEL_PRESET_REGISTRY_DISABLED ?? "");
+	return /^(?:1|true|yes|on)$/i.test($credentialEnv("GJC_MODEL_PRESET_REGISTRY_DISABLED") ?? "");
 }
 function assertHttpsUrl(raw: string, description: string): URL {
 	let url: URL;

package/src/config/model-profiles.ts

@@ -100,6 +100,27 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		critic: "openai-codex/gpt-5.6-luna:max",
 		architect: "openai-codex/gpt-5.6-luna:max",
 	}),
+	profile("astra-lite", ["openai-codex"], {
+		default: "openai-codex/gpt-6-astra:medium",
+		executor: "openai-codex/gpt-5.6-luna:xhigh",
+		planner: "openai-codex/gpt-6-astra:xhigh",
+		critic: "openai-codex/gpt-5.6-sol:high",
+		architect: "openai-codex/gpt-5.6-terra:xhigh",
+	}),
+	profile("astra-default", ["openai-codex"], {
+		default: "openai-codex/gpt-6-astra:medium",
+		executor: "openai-codex/gpt-5.6-luna:max",
+		planner: "openai-codex/gpt-6-astra:xhigh",
+		critic: "openai-codex/gpt-5.6-sol:xhigh",
+		architect: "openai-codex/gpt-5.6-terra:xhigh",
+	}),
+	profile("astra-heavy", ["openai-codex"], {
+		default: "openai-codex/gpt-6-astra:medium",
+		executor: "openai-codex/gpt-5.6-sol:max",
+		planner: "openai-codex/gpt-5.6-sol:max",
+		critic: "openai-codex/gpt-6-astra:max",
+		architect: "openai-codex/gpt-6-astra:max",
+	}),
 	profile("macos-omlx-fast", ["omlx"], {
 		default: "omlx/Qwen3.6-35B-A3B-4bit:low",
 		executor: "omlx/Qwen3.6-35B-A3B-4bit:low",
@@ -488,6 +509,20 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		critic: "anthropic/claude-opus-5:high",
 		architect: "openai-codex/gpt-5.6-sol:xhigh",
 	}),
+	profile("astra-fable", ["openai-codex", "anthropic"], {
+		default: "openai-codex/gpt-6-astra:medium",
+		executor: "openai-codex/gpt-5.6-luna:max",
+		planner: "openai-codex/gpt-6-astra:xhigh",
+		critic: "anthropic/claude-fable-5-1:xhigh",
+		architect: "anthropic/claude-fable-5-1:xhigh",
+	}),
+	profile("astra-fable-opus", ["openai-codex", "anthropic"], {
+		default: "openai-codex/gpt-6-astra:medium",
+		executor: "openai-codex/gpt-5.6-luna:max",
+		planner: "anthropic/claude-opus-5:medium",
+		critic: "anthropic/claude-fable-5-1:xhigh",
+		architect: "anthropic/claude-fable-5-1:xhigh",
+	}),
 ];
 
 /**
@@ -521,6 +556,9 @@ const PROFILE_PRESENTATION: Record<string, ModelProfilePresentation> = {
 	"codex-medium": { displayName: "Codex Medium", providerGroup: "CODEX" },
 	"codex-pro": { displayName: "Codex Pro", providerGroup: "CODEX" },
 	lunamaxxing: { displayName: "LunaMaxxing", providerGroup: "CODEX" },
+	"astra-lite": { displayName: "ASTRA-Lite", providerGroup: "CODEX" },
+	"astra-default": { displayName: "ASTRA-Default", providerGroup: "CODEX" },
+	"astra-heavy": { displayName: "ASTRA-Heavy", providerGroup: "CODEX" },
 	opencodego: { displayName: "OpenCodeGo", providerGroup: "OPENCODEGO" },
 	"commandcode-goat": { displayName: "Command Code GOAT", providerGroup: "COMMAND CODE GOAT" },
 	"open-weights-glm": { displayName: "GLM", providerGroup: "OPEN WEIGHT MODELS (PROVIDER AGNOSTIC)" },
@@ -594,6 +632,8 @@ const PROFILE_PRESENTATION: Record<string, ModelProfilePresentation> = {
 	"opus-codex": { displayName: "Opus + Codex", providerGroup: "COMBOS" },
 	"codex-opencodego": { displayName: "Codex + OpenCodeGo", providerGroup: "COMBOS" },
 	"fable-opus-codex": { displayName: "Fable + Opus + Codex", providerGroup: "COMBOS" },
+	"astra-fable": { displayName: "ASTRA + Fable (5.1)", providerGroup: "COMBOS" },
+	"astra-fable-opus": { displayName: "ASTRA + Fable (5.1) + Opus", providerGroup: "COMBOS" },
 	"macos-omlx-fast": { displayName: "4-bit Fast (MoE measured 93.5 tok/s)", providerGroup: "macOS Local (oMLX)" },
 	"macos-omlx-balanced": {
 		displayName: "8-bit Balanced (MoE measured 71.1 tok/s)",

package/src/config/model-registry.ts

@@ -40,6 +40,7 @@ import {
 	unregisterCustomApis,
 } from "@gajae-code/ai/core";
 import { fetchModelsDevPayload } from "@gajae-code/ai/provider-models/openai-compat";
+import { isDirectXaiReasoningEffortModel } from "@gajae-code/ai/providers/openai-completions-compat";
 import {
 	detectDiscoveredApiFamily,
 	resolveLoopbackOpenAIBaseUrl,
@@ -279,11 +280,7 @@ export const GJC_MODEL_ASSIGNMENT_TARGETS: Record<GjcModelAssignmentTargetId, Gj
 
 export function requiresExplicitThinkingChoice(model: Model, role: GjcModelAssignmentTargetId | null): boolean {
 	if (!modelSupportsReasoningControl(model)) return false;
-	if (
-		model.provider === "openai" ||
-		model.provider === "openai-codex" ||
-		(model.provider === "xai" && (model.id === "grok-4.5" || model.id === "grok-4.6"))
-	)
+	if (model.provider === "openai" || model.provider === "openai-codex" || isDirectXaiReasoningEffortModel(model))
 		return true;
 	if (role === null) return false;
 	if (role === "default") return true;
@@ -1835,6 +1832,25 @@ export class ModelRegistry {
 	/**
 	 * Reload models from disk (embedded + accepted registry + custom from models.yml).
 	 */
+	async refreshStatic(): Promise<void> {
+		if (this.#disposed) return;
+		await this.#enqueueCatalogMutation(async () => {
+			if (this.#disposed) return;
+			this.#catalogRefreshGeneration++;
+			this.#suspendRebuild();
+			try {
+				this.#reloadStaticModels();
+				this.#suppressedSelectors.clear();
+				this.#modelBindingsApplier.apply();
+			} finally {
+				this.#resumeRebuild();
+			}
+		});
+	}
+
+	/**
+	 * Reload models from disk and refresh runtime provider discovery state.
+	 */
 	async refresh(strategy: ModelRefreshStrategy = "online-if-uncached"): Promise<void> {
 		if (this.#disposed) return;
 		await this.#enqueueCatalogMutation(async () => {
@@ -1882,7 +1898,8 @@ export class ModelRegistry {
 			const refreshGeneration = this.#catalogRefreshGeneration;
 			this.#suspendRebuild();
 			try {
-				this.#reloadStaticModels();
+				// A provider refresh only updates discovery for this provider.
+				// Static catalog changes are serialized through refresh().
 				for (const selector of this.#suppressedSelectors.keys()) {
 					if (selector.startsWith(`${providerId}/`)) {
 						this.#suppressedSelectors.delete(selector);
@@ -3026,6 +3043,7 @@ export class ModelRegistry {
 		refreshGeneration = this.#catalogRefreshGeneration,
 		providerRefresh?: ProviderRefreshFence,
 	): Promise<void> {
+		const profileAvailabilityEvidenceBefore = this.#profileAvailabilityEvidenceFingerprint();
 		const disabledProviders = getDisabledProviderIdsFromSettings(this.#settings);
 		const selectedDiscoverableProviders = (
 			providerFilter
@@ -3232,7 +3250,10 @@ export class ModelRegistry {
 			});
 		}
 		if (discovered.length === 0) {
-			if (clearPublishedModelIds.size > 0) {
+			if (
+				clearPublishedModelIds.size > 0 ||
+				profileAvailabilityEvidenceBefore !== this.#profileAvailabilityEvidenceFingerprint()
+			) {
 				this.#rebuildCanonicalIndex();
 			}
 			return;
@@ -3240,6 +3261,23 @@ export class ModelRegistry {
 		this.#mergeDiscoveredModels(discovered);
 	}
 
+	#profileAvailabilityEvidenceFingerprint(): string {
+		return JSON.stringify(
+			[...this.#descriptorDiscoveryEvidence.entries()]
+				.sort(([left], [right]) => left.localeCompare(right))
+				.map(([provider, evidence]) => [
+					provider,
+					evidence.fresh,
+					evidence.profileFresh,
+					evidence.authGeneration,
+					evidence.endpoint,
+					evidence.profileEndpoint,
+					[...evidence.modelIds].sort(),
+					evidence.profileModelIds === undefined ? undefined : [...evidence.profileModelIds].sort(),
+				]),
+		);
+	}
+
 	#mergeDiscoveredModels(discovered: readonly Model<Api>[]): void {
 		const discoveredModels = this.#applyHardcodedModelPolicies(
 			discovered.map(model =>
@@ -3537,8 +3575,9 @@ export class ModelRegistry {
 		// through discovery.type.
 		if (this.#configuredProviderIds.has("vllm")) configuredDiscoveryProviders.add("vllm");
 		if (this.#configuredProviderIds.has("sglang")) configuredDiscoveryProviders.add("sglang");
-		const managerOptions = (await this.#collectBuiltInModelManagerOptions(configuredDiscoveryProviders)).filter(
-			entry => (providerFilter ? providerFilter.has(entry.options.providerId) : true),
+		const managerOptions = await this.#collectBuiltInModelManagerOptions(
+			configuredDiscoveryProviders,
+			providerFilter,
 		);
 		if (managerOptions.length === 0) {
 			return [];
@@ -3551,6 +3590,7 @@ export class ModelRegistry {
 
 	async #collectBuiltInModelManagerOptions(
 		excludedProviderIds: ReadonlySet<string> = new Set(),
+		providerFilter?: ReadonlySet<string>,
 	): Promise<ModelManagerDiscoveryOptions[]> {
 		const specialProviderDescriptors: Array<{
 			providerId: string;
@@ -3594,10 +3634,16 @@ export class ModelRegistry {
 		];
 		const disabledProviders = getDisabledProviderIdsFromSettings(this.#settings);
 		const standardProviderDescriptors = PROVIDER_DESCRIPTORS.filter(
-			descriptor => !disabledProviders.has(descriptor.providerId) && !excludedProviderIds.has(descriptor.providerId),
+			descriptor =>
+				!disabledProviders.has(descriptor.providerId) &&
+				!excludedProviderIds.has(descriptor.providerId) &&
+				(providerFilter === undefined || providerFilter.has(descriptor.providerId)),
 		);
 		const enabledSpecialProviderDescriptors = specialProviderDescriptors.filter(
-			descriptor => !disabledProviders.has(descriptor.providerId) && !excludedProviderIds.has(descriptor.providerId),
+			descriptor =>
+				!disabledProviders.has(descriptor.providerId) &&
+				!excludedProviderIds.has(descriptor.providerId) &&
+				(providerFilter === undefined || providerFilter.has(descriptor.providerId)),
 		);
 		for (const descriptor of standardProviderDescriptors) {
 			if (!descriptor.allowUnauthenticated) continue;

package/src/config/model-resolver.ts

@@ -62,6 +62,54 @@ export function parseModelString(
 		: { provider, id: modelStr.slice(slashIdx + 1) };
 }
 
+export function resolveStartupModelRefreshSelectors(
+	options: {
+		model?: string;
+		provider?: string;
+		credential?: string;
+		continue?: boolean;
+		resume?: string | boolean;
+		hasStartupProfile: boolean;
+	},
+	settings: ModelRoleSettings,
+): ModelSelectorValue | undefined {
+	if (options.credential) return undefined;
+	if (options.model) {
+		return options.provider && !options.model.toLowerCase().startsWith(`${options.provider.toLowerCase()}/`)
+			? `${options.provider}/${options.model}`
+			: options.model;
+	}
+	if (options.hasStartupProfile) return undefined;
+	if (options.continue || options.resume) return undefined;
+	return resolveConfiguredModelPatterns(settings.getModelRole("default"), settings);
+}
+
+export async function refreshMissingQualifiedModelProviders(
+	selectors: ModelSelectorValue | undefined,
+	modelRegistry: Pick<ModelRegistry, "getAvailable" | "getDiscoverableProviders" | "refreshProvider">,
+): Promise<boolean> {
+	const refreshedProviders = new Set<string>();
+	for (const selector of normalizeModelSelectorValue(selectors)) {
+		const parsedSelector = parseModelString(selector);
+		if (!parsedSelector) continue;
+		const provider = modelRegistry
+			.getDiscoverableProviders()
+			.find(candidate => candidate.toLowerCase() === parsedSelector.provider.toLowerCase());
+		if (!provider || refreshedProviders.has(provider)) continue;
+		const availableModels = modelRegistry.getAvailable();
+		const rawModelId = selector.slice(selector.indexOf("/") + 1);
+		if (
+			resolveProviderModelReference(provider, rawModelId, availableModels) ||
+			resolveProviderModelReference(provider, parsedSelector.id, availableModels)
+		)
+			continue;
+
+		await modelRegistry.refreshProvider(provider, "online-if-uncached");
+		refreshedProviders.add(provider);
+	}
+	return refreshedProviders.size > 0;
+}
+
 /**
  * Format a model as "provider/modelId" string.
  */

package/src/config/settings-schema.ts

@@ -111,7 +111,8 @@ export type StatusLineSegmentId =
 	| "cache_read"
 	| "cache_write"
 	| "session_name"
-	| "usage";
+	| "usage"
+	| "command";
 
 /** Submenu choice metadata. */
 export type SubmenuOption<V extends string = string> = {
@@ -1242,6 +1243,26 @@ export const SETTINGS_SCHEMA = {
 		},
 	},
 
+	reasoningLanguage: {
+		type: "enum",
+		values: ["off", "english"] as const,
+		default: "off",
+		ui: {
+			tab: "model",
+			label: "Reasoning Language",
+			description:
+				"Optionally reason through development work in English while preserving the user's response language",
+			options: [
+				{ value: "off", label: "Off", description: "Do not add reasoning-language guidance" },
+				{
+					value: "english",
+					label: "English",
+					description: "Reason through technical work in English and answer in the user's language",
+				},
+			],
+		},
+	},
+
 	hideThinkingBlock: {
 		type: "boolean",
 		default: false,
@@ -1749,6 +1770,17 @@ export const SETTINGS_SCHEMA = {
 		},
 	},
 
+	"paseo.autoImport": {
+		type: "boolean",
+		default: false,
+		ui: {
+			tab: "interaction",
+			label: "Announce Sessions to Paseo",
+			description:
+				"Global-only operator opt-in. When enabled, and only when a GJC ACP provider is already registered in Paseo and its daemon is already running, import each interactive session into Paseo so it can be driven from there. Project settings cannot enable it. Never starts the Paseo daemon or removes imported entries; stale entries must be pruned in Paseo. Never runs when Paseo is absent.",
+		},
+	},
+
 	"crashReport.nudge": {
 		type: "boolean",
 		default: true,

package/src/config/settings.ts

@@ -333,6 +333,7 @@ const PATH_SCOPED_ARRAY_SETTINGS = new Set<SettingPath>(["enabledModels", "disab
 const GLOBAL_ONLY_SETTINGS = new Set<SettingPath>([
 	"crashReport.upstream",
 	"crashReport.upstreamDsn",
+	"paseo.autoImport",
 	"ui.language",
 	"telemetry.enabled",
 ]);

package/src/defaults/gjc/extensions/grok-cli-vendor/src/models/catalog.ts

@@ -73,6 +73,7 @@ const FALLBACK_MODELS: GrokCliModelConfig[] = [
     cost: COST_43,
     contextWindow: 1_000_000,
     maxTokens: 30_000,
+    maxReasoningEffort: Effort.High,
   },
   {
     // Official metadata and pricing: https://docs.x.ai/developers/models/grok-4.6
@@ -158,23 +159,22 @@ function matchesModelFamily(name: string, modelId: string): boolean {
   return name.startsWith(`${modelId}-`) && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(suffix);
 }
 
+const REASONING_EFFORT_CAPS = [
+  { prefix: 'grok-3-mini', max: Effort.High },
+  { prefix: 'grok-4.3', max: Effort.High },
+  { prefix: 'grok-4.5', max: Effort.High },
+  { prefix: 'grok-4.6', max: Effort.XHigh },
+  { prefix: 'grok-4.20-multi-agent', max: Effort.XHigh },
+] as const;
+
 export function getMaxReasoningEffort(modelId: string): Effort | undefined {
   const name = getCanonicalModelName(modelId);
-  return FALLBACK_MODELS.find((model) => matchesModelFamily(name, model.id.toLowerCase()))
-    ?.maxReasoningEffort;
+  return REASONING_EFFORT_CAPS.find(({ prefix }) => matchesModelFamily(name, prefix))?.max;
 }
 
-const EFFORT_CAPABLE_PREFIXES = [
-  'grok-3-mini',
-  'grok-4.20-multi-agent',
-  'grok-4.3',
-  'grok-4.5',
-  'grok-4.6',
-];
-
 export function supportsReasoningEffort(modelId: string): boolean {
   const name = getCanonicalModelName(modelId);
-  if (!EFFORT_CAPABLE_PREFIXES.some((prefix) => matchesModelFamily(name, prefix))) {
+  if (!REASONING_EFFORT_CAPS.some(({ prefix }) => matchesModelFamily(name, prefix))) {
     return false;
   }
   const model = resolveModels().find((entry) => getCanonicalModelName(entry.id) === name);