@gajae-code/coding-agent 0.16.3 → 0.16.6

package/src/config/model-preset-registry.ts

@@ -1,10 +1,11 @@
 import * as crypto from "node:crypto";
 import * as fsSync from "node:fs";
+import type { FileHandle } from "node:fs/promises";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type { Api, Model } from "@gajae-code/ai/core";
 import type { NativeExactFileIdentity, NativeExactUnlinkResult } from "@gajae-code/natives";
-import { getAgentDir, isEnoent } from "@gajae-code/utils";
+import { $credentialEnv, getAgentDir, isEnoent } from "@gajae-code/utils";
 import * as z from "zod/v4";
 import { splitSelectorThinkingSuffix } from "../thinking";
 import { withFileLock } from "./file-lock";
@@ -939,16 +940,80 @@ function validateGeneration(
 	return generation;
 }
 
-function readJsonSync(file: string): unknown | undefined {
+type RegistryFileStat = {
+	dev: number | bigint;
+	ino: number | bigint;
+	size: number | bigint;
+	isFile(): boolean;
+	isSymbolicLink(): boolean;
+};
+
+function registryFileOpenFlags(): number {
+	return (
+		fsSync.constants.O_RDONLY |
+		(process.platform === "win32" ? 0 : (fsSync.constants.O_NOFOLLOW ?? 0) | (fsSync.constants.O_NONBLOCK ?? 0))
+	);
+}
+
+function sameRegistryFileIdentity(left: RegistryFileStat, right: RegistryFileStat): boolean {
+	return (
+		left.isFile() &&
+		!left.isSymbolicLink() &&
+		right.isFile() &&
+		!right.isSymbolicLink() &&
+		left.dev === right.dev &&
+		left.ino === right.ino
+	);
+}
+
+function readBoundedRegistryFdSync(fd: number): Buffer {
+	const chunks: Buffer[] = [];
+	const buffer = Buffer.allocUnsafe(64 * 1024);
+	let total = 0;
+	for (;;) {
+		const length = Math.min(buffer.length, MODEL_PRESET_REGISTRY_MAX_STATE_BYTES + 1 - total);
+		const bytesRead = fsSync.readSync(fd, buffer, 0, length, null);
+		if (bytesRead === 0) return Buffer.concat(chunks, total);
+		total += bytesRead;
+		chunks.push(Buffer.from(buffer.subarray(0, bytesRead)));
+		if (total > MODEL_PRESET_REGISTRY_MAX_STATE_BYTES) throw new Error("Registry cache is oversized.");
+	}
+}
+
+function readRegistryBytesSync(file: string): Buffer | undefined {
+	let before: fsSync.Stats;
 	try {
-		const stat = fsSync.lstatSync(file);
-		if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("Registry cache path is not a regular file.");
-		if (stat.size > MODEL_PRESET_REGISTRY_MAX_STATE_BYTES) throw new Error("Registry cache is oversized.");
-		return JSON.parse(fsSync.readFileSync(file, "utf8"));
+		before = fsSync.lstatSync(file);
 	} catch (error) {
 		if (isEnoent(error)) return undefined;
 		throw error;
 	}
+	if (!before.isFile() || before.isSymbolicLink()) throw new Error("Registry cache path is not a regular file.");
+	if (before.size > MODEL_PRESET_REGISTRY_MAX_STATE_BYTES) throw new Error("Registry cache is oversized.");
+	let fd: number | undefined;
+	try {
+		fd = fsSync.openSync(file, registryFileOpenFlags());
+		const opened = fsSync.fstatSync(fd);
+		if (!sameRegistryFileIdentity(before, opened)) throw new Error("Registry cache path changed while opening.");
+		const bytes = readBoundedRegistryFdSync(fd);
+		const finalOpened = fsSync.fstatSync(fd);
+		let after: fsSync.Stats;
+		try {
+			after = fsSync.lstatSync(file);
+		} catch (error) {
+			throw new Error("Registry cache path changed while reading.", { cause: error });
+		}
+		if (!sameRegistryFileIdentity(opened, finalOpened) || !sameRegistryFileIdentity(opened, after))
+			throw new Error("Registry cache path changed while reading.");
+		return bytes;
+	} finally {
+		if (fd !== undefined) fsSync.closeSync(fd);
+	}
+}
+
+function readJsonSync(file: string): unknown | undefined {
+	const bytes = readRegistryBytesSync(file);
+	return bytes === undefined ? undefined : JSON.parse(bytes.toString("utf8"));
 }
 
 /**
@@ -956,16 +1021,44 @@ function readJsonSync(file: string): unknown | undefined {
  * Keep the synchronous reader above for legacy startup paths until their
  * constructor-wide migration can be completed without changing public APIs.
  */
-async function readJsonBun(file: string): Promise<unknown | undefined> {
+async function readRegistryBytesBun(file: string): Promise<Buffer | undefined> {
+	let before: fsSync.BigIntStats;
 	try {
-		const stat = await fs.lstat(file, { bigint: true });
-		if (!stat.isFile() || stat.isSymbolicLink()) throw new Error("Registry cache path is not a regular file.");
-		if (stat.size > BigInt(MODEL_PRESET_REGISTRY_MAX_STATE_BYTES)) throw new Error("Registry cache is oversized.");
-		return JSON.parse(await Bun.file(file).text());
+		before = await fs.lstat(file, { bigint: true });
 	} catch (error) {
 		if (isEnoent(error)) return undefined;
 		throw error;
 	}
+	if (!before.isFile() || before.isSymbolicLink()) throw new Error("Registry cache path is not a regular file.");
+	if (before.size > BigInt(MODEL_PRESET_REGISTRY_MAX_STATE_BYTES)) throw new Error("Registry cache is oversized.");
+	let handle: FileHandle | undefined;
+	try {
+		handle = await fs.open(file, registryFileOpenFlags());
+		const opened = await handle.stat({ bigint: true });
+		if (!sameRegistryFileIdentity(before, opened)) throw new Error("Registry cache path changed while opening.");
+		const bunFileFromDescriptor = (Bun.file as unknown as (descriptor: number) => Bun.BunFile)(handle.fd);
+		const bytes = Buffer.from(
+			await bunFileFromDescriptor.slice(0, MODEL_PRESET_REGISTRY_MAX_STATE_BYTES + 1).arrayBuffer(),
+		);
+		if (bytes.length > MODEL_PRESET_REGISTRY_MAX_STATE_BYTES) throw new Error("Registry cache is oversized.");
+		const finalOpened = await handle.stat({ bigint: true });
+		let after: fsSync.BigIntStats;
+		try {
+			after = await fs.lstat(file, { bigint: true });
+		} catch (error) {
+			throw new Error("Registry cache path changed while reading.", { cause: error });
+		}
+		if (!sameRegistryFileIdentity(opened, finalOpened) || !sameRegistryFileIdentity(opened, after))
+			throw new Error("Registry cache path changed while reading.");
+		return bytes;
+	} finally {
+		await handle?.close();
+	}
+}
+
+async function readJsonBun(file: string): Promise<unknown | undefined> {
+	const bytes = await readRegistryBytesBun(file);
+	return bytes === undefined ? undefined : JSON.parse(bytes.toString("utf8"));
 }
 
 function parseState(value: unknown): RegistryState {
@@ -1444,10 +1537,12 @@ function effectiveTrustedKeys(
 	return getModelPresetRegistryTestTrustedKeys(agentDir) ?? MODEL_PRESET_REGISTRY_TRUSTED_KEYS;
 }
 function effectiveManifestUrl(dependencies: ModelPresetRegistryDependencies): string {
-	return dependencies.manifestUrl ?? process.env.GJC_MODEL_PRESET_REGISTRY_URL ?? DEFAULT_MODEL_PRESET_REGISTRY_URL;
+	return (
+		dependencies.manifestUrl ?? $credentialEnv("GJC_MODEL_PRESET_REGISTRY_URL") ?? DEFAULT_MODEL_PRESET_REGISTRY_URL
+	);
 }
 function environmentDisabled(): boolean {
-	return /^(?:1|true|yes|on)$/i.test(process.env.GJC_MODEL_PRESET_REGISTRY_DISABLED ?? "");
+	return /^(?:1|true|yes|on)$/i.test($credentialEnv("GJC_MODEL_PRESET_REGISTRY_DISABLED") ?? "");
 }
 function assertHttpsUrl(raw: string, description: string): URL {
 	let url: URL;
@@ -1574,9 +1669,10 @@ function cloneAcceptedModelPresetRegistry(value: AcceptedModelPresetRegistry): A
 
 function registryFileFingerprint(file: string): string {
 	try {
-		return sha256(fsSync.readFileSync(file));
-	} catch {
-		return "absent";
+		const bytes = readRegistryBytesSync(file);
+		return bytes === undefined ? "absent" : sha256(bytes);
+	} catch (error) {
+		return isEnoent(error) ? "absent" : "rejected";
 	}
 }
 
@@ -1593,9 +1689,10 @@ function acceptedRegistryFingerprint(
 
 async function registryFileFingerprintAsync(file: string): Promise<string> {
 	try {
-		return sha256(new Uint8Array(await Bun.file(file).arrayBuffer()));
-	} catch {
-		return "absent";
+		const bytes = await readRegistryBytesBun(file);
+		return bytes === undefined ? "absent" : sha256(bytes);
+	} catch (error) {
+		return isEnoent(error) ? "absent" : "rejected";
 	}
 }
 
@@ -1622,6 +1719,8 @@ export function loadAcceptedModelPresetRegistry(
 	if (!acceptedRegistryReadIsCacheable(dependencies) || environmentDisabled())
 		return loadAcceptedModelPresetRegistryUncached(agentDir, dependencies);
 	const fingerprint = acceptedRegistryFingerprint(agentDir, dependencies);
+	if (fingerprint.split("|").includes("rejected"))
+		return loadAcceptedModelPresetRegistryUncached(agentDir, dependencies);
 	const cached = acceptedRegistryReadCache.get(agentDir);
 	if (cached && cached.fingerprint === fingerprint) return cloneAcceptedModelPresetRegistry(cached.value);
 	const value = loadAcceptedModelPresetRegistryUncached(agentDir, dependencies);
@@ -1698,6 +1797,8 @@ export async function loadAcceptedModelPresetRegistryAsync(
 	if (!acceptedRegistryReadIsCacheable(dependencies) || environmentDisabled())
 		return loadAcceptedModelPresetRegistryAsyncUncached(agentDir, dependencies);
 	const fingerprint = await acceptedRegistryFingerprintAsync(agentDir, dependencies);
+	if (fingerprint.split("|").includes("rejected"))
+		return loadAcceptedModelPresetRegistryAsyncUncached(agentDir, dependencies);
 	const cached = acceptedRegistryReadCache.get(agentDir);
 	if (cached && cached.fingerprint === fingerprint) return cloneAcceptedModelPresetRegistry(cached.value);
 	const value = await loadAcceptedModelPresetRegistryAsyncUncached(agentDir, dependencies);

package/src/config/model-profiles.ts

@@ -100,6 +100,27 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		critic: "openai-codex/gpt-5.6-luna:max",
 		architect: "openai-codex/gpt-5.6-luna:max",
 	}),
+	profile("astra-lite", ["openai-codex"], {
+		default: "openai-codex/gpt-6-astra:medium",
+		executor: "openai-codex/gpt-5.6-luna:xhigh",
+		planner: "openai-codex/gpt-6-astra:xhigh",
+		critic: "openai-codex/gpt-5.6-sol:high",
+		architect: "openai-codex/gpt-5.6-terra:xhigh",
+	}),
+	profile("astra-default", ["openai-codex"], {
+		default: "openai-codex/gpt-6-astra:medium",
+		executor: "openai-codex/gpt-5.6-luna:max",
+		planner: "openai-codex/gpt-6-astra:xhigh",
+		critic: "openai-codex/gpt-5.6-sol:xhigh",
+		architect: "openai-codex/gpt-5.6-terra:xhigh",
+	}),
+	profile("astra-heavy", ["openai-codex"], {
+		default: "openai-codex/gpt-6-astra:medium",
+		executor: "openai-codex/gpt-5.6-sol:max",
+		planner: "openai-codex/gpt-5.6-sol:max",
+		critic: "openai-codex/gpt-6-astra:max",
+		architect: "openai-codex/gpt-6-astra:max",
+	}),
 	profile("macos-omlx-fast", ["omlx"], {
 		default: "omlx/Qwen3.6-35B-A3B-4bit:low",
 		executor: "omlx/Qwen3.6-35B-A3B-4bit:low",
@@ -488,6 +509,20 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		critic: "anthropic/claude-opus-5:high",
 		architect: "openai-codex/gpt-5.6-sol:xhigh",
 	}),
+	profile("astra-fable", ["openai-codex", "anthropic"], {
+		default: "openai-codex/gpt-6-astra:medium",
+		executor: "openai-codex/gpt-5.6-luna:max",
+		planner: "openai-codex/gpt-6-astra:xhigh",
+		critic: "anthropic/claude-fable-5-1:xhigh",
+		architect: "anthropic/claude-fable-5-1:xhigh",
+	}),
+	profile("astra-fable-opus", ["openai-codex", "anthropic"], {
+		default: "openai-codex/gpt-6-astra:medium",
+		executor: "openai-codex/gpt-5.6-luna:max",
+		planner: "anthropic/claude-opus-5:medium",
+		critic: "anthropic/claude-fable-5-1:xhigh",
+		architect: "anthropic/claude-fable-5-1:xhigh",
+	}),
 ];
 
 /**
@@ -521,6 +556,9 @@ const PROFILE_PRESENTATION: Record<string, ModelProfilePresentation> = {
 	"codex-medium": { displayName: "Codex Medium", providerGroup: "CODEX" },
 	"codex-pro": { displayName: "Codex Pro", providerGroup: "CODEX" },
 	lunamaxxing: { displayName: "LunaMaxxing", providerGroup: "CODEX" },
+	"astra-lite": { displayName: "ASTRA-Lite", providerGroup: "CODEX" },
+	"astra-default": { displayName: "ASTRA-Default", providerGroup: "CODEX" },
+	"astra-heavy": { displayName: "ASTRA-Heavy", providerGroup: "CODEX" },
 	opencodego: { displayName: "OpenCodeGo", providerGroup: "OPENCODEGO" },
 	"commandcode-goat": { displayName: "Command Code GOAT", providerGroup: "COMMAND CODE GOAT" },
 	"open-weights-glm": { displayName: "GLM", providerGroup: "OPEN WEIGHT MODELS (PROVIDER AGNOSTIC)" },
@@ -594,6 +632,8 @@ const PROFILE_PRESENTATION: Record<string, ModelProfilePresentation> = {
 	"opus-codex": { displayName: "Opus + Codex", providerGroup: "COMBOS" },
 	"codex-opencodego": { displayName: "Codex + OpenCodeGo", providerGroup: "COMBOS" },
 	"fable-opus-codex": { displayName: "Fable + Opus + Codex", providerGroup: "COMBOS" },
+	"astra-fable": { displayName: "ASTRA + Fable (5.1)", providerGroup: "COMBOS" },
+	"astra-fable-opus": { displayName: "ASTRA + Fable (5.1) + Opus", providerGroup: "COMBOS" },
 	"macos-omlx-fast": { displayName: "4-bit Fast (MoE measured 93.5 tok/s)", providerGroup: "macOS Local (oMLX)" },
 	"macos-omlx-balanced": {
 		displayName: "8-bit Balanced (MoE measured 71.1 tok/s)",

package/src/config/model-registry.ts

@@ -40,6 +40,7 @@ import {
 	unregisterCustomApis,
 } from "@gajae-code/ai/core";
 import { fetchModelsDevPayload } from "@gajae-code/ai/provider-models/openai-compat";
+import { isDirectXaiReasoningEffortModel } from "@gajae-code/ai/providers/openai-completions-compat";
 import {
 	detectDiscoveredApiFamily,
 	resolveLoopbackOpenAIBaseUrl,
@@ -279,11 +280,7 @@ export const GJC_MODEL_ASSIGNMENT_TARGETS: Record<GjcModelAssignmentTargetId, Gj
 
 export function requiresExplicitThinkingChoice(model: Model, role: GjcModelAssignmentTargetId | null): boolean {
 	if (!modelSupportsReasoningControl(model)) return false;
-	if (
-		model.provider === "openai" ||
-		model.provider === "openai-codex" ||
-		(model.provider === "xai" && (model.id === "grok-4.5" || model.id === "grok-4.6"))
-	)
+	if (model.provider === "openai" || model.provider === "openai-codex" || isDirectXaiReasoningEffortModel(model))
 		return true;
 	if (role === null) return false;
 	if (role === "default") return true;
@@ -1835,6 +1832,25 @@ export class ModelRegistry {
 	/**
 	 * Reload models from disk (embedded + accepted registry + custom from models.yml).
 	 */
+	async refreshStatic(): Promise<void> {
+		if (this.#disposed) return;
+		await this.#enqueueCatalogMutation(async () => {
+			if (this.#disposed) return;
+			this.#catalogRefreshGeneration++;
+			this.#suspendRebuild();
+			try {
+				this.#reloadStaticModels();
+				this.#suppressedSelectors.clear();
+				this.#modelBindingsApplier.apply();
+			} finally {
+				this.#resumeRebuild();
+			}
+		});
+	}
+
+	/**
+	 * Reload models from disk and refresh runtime provider discovery state.
+	 */
 	async refresh(strategy: ModelRefreshStrategy = "online-if-uncached"): Promise<void> {
 		if (this.#disposed) return;
 		await this.#enqueueCatalogMutation(async () => {
@@ -1882,7 +1898,8 @@ export class ModelRegistry {
 			const refreshGeneration = this.#catalogRefreshGeneration;
 			this.#suspendRebuild();
 			try {
-				this.#reloadStaticModels();
+				// A provider refresh only updates discovery for this provider.
+				// Static catalog changes are serialized through refresh().
 				for (const selector of this.#suppressedSelectors.keys()) {
 					if (selector.startsWith(`${providerId}/`)) {
 						this.#suppressedSelectors.delete(selector);
@@ -3026,6 +3043,7 @@ export class ModelRegistry {
 		refreshGeneration = this.#catalogRefreshGeneration,
 		providerRefresh?: ProviderRefreshFence,
 	): Promise<void> {
+		const profileAvailabilityEvidenceBefore = this.#profileAvailabilityEvidenceFingerprint();
 		const disabledProviders = getDisabledProviderIdsFromSettings(this.#settings);
 		const selectedDiscoverableProviders = (
 			providerFilter
@@ -3232,7 +3250,10 @@ export class ModelRegistry {
 			});
 		}
 		if (discovered.length === 0) {
-			if (clearPublishedModelIds.size > 0) {
+			if (
+				clearPublishedModelIds.size > 0 ||
+				profileAvailabilityEvidenceBefore !== this.#profileAvailabilityEvidenceFingerprint()
+			) {
 				this.#rebuildCanonicalIndex();
 			}
 			return;
@@ -3240,6 +3261,23 @@ export class ModelRegistry {
 		this.#mergeDiscoveredModels(discovered);
 	}
 
+	#profileAvailabilityEvidenceFingerprint(): string {
+		return JSON.stringify(
+			[...this.#descriptorDiscoveryEvidence.entries()]
+				.sort(([left], [right]) => left.localeCompare(right))
+				.map(([provider, evidence]) => [
+					provider,
+					evidence.fresh,
+					evidence.profileFresh,
+					evidence.authGeneration,
+					evidence.endpoint,
+					evidence.profileEndpoint,
+					[...evidence.modelIds].sort(),
+					evidence.profileModelIds === undefined ? undefined : [...evidence.profileModelIds].sort(),
+				]),
+		);
+	}
+
 	#mergeDiscoveredModels(discovered: readonly Model<Api>[]): void {
 		const discoveredModels = this.#applyHardcodedModelPolicies(
 			discovered.map(model =>
@@ -3537,8 +3575,9 @@ export class ModelRegistry {
 		// through discovery.type.
 		if (this.#configuredProviderIds.has("vllm")) configuredDiscoveryProviders.add("vllm");
 		if (this.#configuredProviderIds.has("sglang")) configuredDiscoveryProviders.add("sglang");
-		const managerOptions = (await this.#collectBuiltInModelManagerOptions(configuredDiscoveryProviders)).filter(
-			entry => (providerFilter ? providerFilter.has(entry.options.providerId) : true),
+		const managerOptions = await this.#collectBuiltInModelManagerOptions(
+			configuredDiscoveryProviders,
+			providerFilter,
 		);
 		if (managerOptions.length === 0) {
 			return [];
@@ -3551,6 +3590,7 @@ export class ModelRegistry {
 
 	async #collectBuiltInModelManagerOptions(
 		excludedProviderIds: ReadonlySet<string> = new Set(),
+		providerFilter?: ReadonlySet<string>,
 	): Promise<ModelManagerDiscoveryOptions[]> {
 		const specialProviderDescriptors: Array<{
 			providerId: string;
@@ -3594,10 +3634,16 @@ export class ModelRegistry {
 		];
 		const disabledProviders = getDisabledProviderIdsFromSettings(this.#settings);
 		const standardProviderDescriptors = PROVIDER_DESCRIPTORS.filter(
-			descriptor => !disabledProviders.has(descriptor.providerId) && !excludedProviderIds.has(descriptor.providerId),
+			descriptor =>
+				!disabledProviders.has(descriptor.providerId) &&
+				!excludedProviderIds.has(descriptor.providerId) &&
+				(providerFilter === undefined || providerFilter.has(descriptor.providerId)),
 		);
 		const enabledSpecialProviderDescriptors = specialProviderDescriptors.filter(
-			descriptor => !disabledProviders.has(descriptor.providerId) && !excludedProviderIds.has(descriptor.providerId),
+			descriptor =>
+				!disabledProviders.has(descriptor.providerId) &&
+				!excludedProviderIds.has(descriptor.providerId) &&
+				(providerFilter === undefined || providerFilter.has(descriptor.providerId)),
 		);
 		for (const descriptor of standardProviderDescriptors) {
 			if (!descriptor.allowUnauthenticated) continue;
@@ -4514,10 +4560,10 @@ export class ModelRegistry {
 			.get(model.provider.toLowerCase())
 			?.get(model.id.toLowerCase())?.thinking;
 		if (overrideThinking !== undefined) return { ...model, thinking: overrideThinking as ThinkingConfig };
-		const overlay = [...this.#runtimeModelOverlays, ...this.#customModelOverlays].find(
-			candidate =>
-				candidate.provider === model.provider && candidate.id === model.id && candidate.thinking !== undefined,
-		);
+		const hasDeclaredThinking = (candidate: CustomModelOverlay) =>
+			candidate.provider === model.provider && candidate.id === model.id && candidate.thinking !== undefined;
+		const overlay =
+			this.#runtimeModelOverlays.find(hasDeclaredThinking) ?? this.#customModelOverlays.find(hasDeclaredThinking);
 		return overlay?.thinking === undefined ? model : { ...model, thinking: overlay.thinking };
 	}
 	/**
@@ -5169,15 +5215,20 @@ export class ModelRegistry {
 	 * usable until live catalog evidence exists so offline startup is unchanged.
 	 */
 	getAvailableForProfileActivation(): Model<Api>[] {
+		const bundledIdsByProvider = new Map<string, Set<string>>();
 		return this.getAvailable().filter(model => {
 			const evidence = this.#descriptorDiscoveryEvidence.get(model.provider);
 			if (!evidence?.profileFresh || evidence.profileModelIds === undefined) return true;
 			if (this.#hasCustomModelOverlay(model.provider, model.id)) return true;
-			const bundledModelIds = new Set(
-				(getBundledModels(model.provider as Parameters<typeof getBundledModels>[0]) as Model<Api>[]).map(
-					candidate => candidate.id,
-				),
-			);
+			let bundledModelIds = bundledIdsByProvider.get(model.provider);
+			if (!bundledModelIds) {
+				bundledModelIds = new Set(
+					(getBundledModels(model.provider as Parameters<typeof getBundledModels>[0]) as Model<Api>[]).map(
+						candidate => candidate.id,
+					),
+				);
+				bundledIdsByProvider.set(model.provider, bundledModelIds);
+			}
 			if (!bundledModelIds.has(model.id)) return true;
 			if (
 				evidence.authGeneration !== this.#getProviderEvidenceGeneration(model.provider) ||
@@ -5190,9 +5241,8 @@ export class ModelRegistry {
 	}
 
 	#hasCustomModelOverlay(provider: string, id: string): boolean {
-		return [...this.#customModelOverlays, ...this.#runtimeModelOverlays].some(
-			overlay => overlay.provider === provider && overlay.id === id,
-		);
+		const matches = (overlay: CustomModelOverlay) => overlay.provider === provider && overlay.id === id;
+		return this.#customModelOverlays.some(matches) || this.#runtimeModelOverlays.some(matches);
 	}
 
 	#hasFreshOrStaticModelEvidence(model: Model<Api>): boolean {

package/src/config/model-resolver.ts

@@ -62,6 +62,54 @@ export function parseModelString(
 		: { provider, id: modelStr.slice(slashIdx + 1) };
 }
 
+export function resolveStartupModelRefreshSelectors(
+	options: {
+		model?: string;
+		provider?: string;
+		credential?: string;
+		continue?: boolean;
+		resume?: string | boolean;
+		hasStartupProfile: boolean;
+	},
+	settings: ModelRoleSettings,
+): ModelSelectorValue | undefined {
+	if (options.credential) return undefined;
+	if (options.model) {
+		return options.provider && !options.model.toLowerCase().startsWith(`${options.provider.toLowerCase()}/`)
+			? `${options.provider}/${options.model}`
+			: options.model;
+	}
+	if (options.hasStartupProfile) return undefined;
+	if (options.continue || options.resume) return undefined;
+	return resolveConfiguredModelPatterns(settings.getModelRole("default"), settings);
+}
+
+export async function refreshMissingQualifiedModelProviders(
+	selectors: ModelSelectorValue | undefined,
+	modelRegistry: Pick<ModelRegistry, "getAvailable" | "getDiscoverableProviders" | "refreshProvider">,
+): Promise<boolean> {
+	const refreshedProviders = new Set<string>();
+	for (const selector of normalizeModelSelectorValue(selectors)) {
+		const parsedSelector = parseModelString(selector);
+		if (!parsedSelector) continue;
+		const provider = modelRegistry
+			.getDiscoverableProviders()
+			.find(candidate => candidate.toLowerCase() === parsedSelector.provider.toLowerCase());
+		if (!provider || refreshedProviders.has(provider)) continue;
+		const availableModels = modelRegistry.getAvailable();
+		const rawModelId = selector.slice(selector.indexOf("/") + 1);
+		if (
+			resolveProviderModelReference(provider, rawModelId, availableModels) ||
+			resolveProviderModelReference(provider, parsedSelector.id, availableModels)
+		)
+			continue;
+
+		await modelRegistry.refreshProvider(provider, "online-if-uncached");
+		refreshedProviders.add(provider);
+	}
+	return refreshedProviders.size > 0;
+}
+
 /**
  * Format a model as "provider/modelId" string.
  */

package/src/config/settings-schema.ts

@@ -111,7 +111,8 @@ export type StatusLineSegmentId =
 	| "cache_read"
 	| "cache_write"
 	| "session_name"
-	| "usage";
+	| "usage"
+	| "command";
 
 /** Submenu choice metadata. */
 export type SubmenuOption<V extends string = string> = {
@@ -1242,6 +1243,26 @@ export const SETTINGS_SCHEMA = {
 		},
 	},
 
+	reasoningLanguage: {
+		type: "enum",
+		values: ["off", "english"] as const,
+		default: "off",
+		ui: {
+			tab: "model",
+			label: "Reasoning Language",
+			description:
+				"Optionally reason through development work in English while preserving the user's response language",
+			options: [
+				{ value: "off", label: "Off", description: "Do not add reasoning-language guidance" },
+				{
+					value: "english",
+					label: "English",
+					description: "Reason through technical work in English and answer in the user's language",
+				},
+			],
+		},
+	},
+
 	hideThinkingBlock: {
 		type: "boolean",
 		default: false,
@@ -1749,6 +1770,17 @@ export const SETTINGS_SCHEMA = {
 		},
 	},
 
+	"paseo.autoImport": {
+		type: "boolean",
+		default: false,
+		ui: {
+			tab: "interaction",
+			label: "Announce Sessions to Paseo",
+			description:
+				"Global-only operator opt-in. When enabled, and only when a GJC ACP provider is already registered in Paseo and its daemon is already running, import each interactive session into Paseo so it can be driven from there. Project settings cannot enable it. Never starts the Paseo daemon or removes imported entries; stale entries must be pruned in Paseo. Never runs when Paseo is absent.",
+		},
+	},
+
 	"crashReport.nudge": {
 		type: "boolean",
 		default: true,

package/src/config/settings.ts

@@ -333,6 +333,7 @@ const PATH_SCOPED_ARRAY_SETTINGS = new Set<SettingPath>(["enabledModels", "disab
 const GLOBAL_ONLY_SETTINGS = new Set<SettingPath>([
 	"crashReport.upstream",
 	"crashReport.upstreamDsn",
+	"paseo.autoImport",
 	"ui.language",
 	"telemetry.enabled",
 ]);

package/src/coordinator-mcp/question-state.ts

@@ -163,6 +163,8 @@ export interface PromptRequestV1 {
 	phase: "claimed" | "remote_started" | "accepted" | "linked" | "terminal" | "completed" | "uncertain";
 	runtime_receipt?: { accepted: true; command_id: string; turn_id: string };
 	coordinator_turn_id?: string;
+	/** Retain prompt and source turn until the delegate's outer response is durable. */
+	delegate_response_pending?: boolean;
 	safe_response?: Record<string, unknown>;
 	error_code?: PublicReason | "idempotency_conflict";
 	created_at: string;
@@ -244,7 +246,12 @@ export interface CoordinatorSessionTransactionV1 {
 		scheduler_applied_revision?: number;
 		scheduler_digest?: string;
 	};
-	recovery: { prompt_watermark_at: string | null; last_repaired_at: string | null };
+	recovery: {
+		prompt_watermark_at: string | null;
+		last_repaired_at: string | null;
+		/** One-shot authority for the initial delegate prompt, consumed atomically with its claim. */
+		initial_delegate_request?: { key_digest: string; request_digest: string };
+	};
 }
 interface CoordinatorSessionHistoryV1 {
 	schema_version: 1;
@@ -815,6 +822,7 @@ function assertTransaction(transaction: CoordinatorSessionTransactionV1, namespa
 		typeof request.canonical_prompt.text !== "string" ||
 		!safeId(request.sdk_idempotency_key) ||
 		!promptPhases.has(String(request.phase)) ||
+		(request.delegate_response_pending !== undefined && typeof request.delegate_response_pending !== "boolean") ||
 		!isTime(request.created_at) ||
 		!isTime(request.updated_at) ||
 		(request.coordinator_turn_id !== undefined &&
@@ -1194,6 +1202,12 @@ function assertTransaction(transaction: CoordinatorSessionTransactionV1, namespa
 			(typeof projection.scheduler_digest !== "string" || projection.scheduler_digest.length === 0)) ||
 		(recovery.prompt_watermark_at !== null && !isTime(recovery.prompt_watermark_at)) ||
 		(recovery.last_repaired_at !== null && !isTime(recovery.last_repaired_at)) ||
+		(recovery.initial_delegate_request !== undefined &&
+			(!isRecord(recovery.initial_delegate_request) ||
+				typeof recovery.initial_delegate_request.key_digest !== "string" ||
+				!/^[a-f0-9]{64}$/.test(recovery.initial_delegate_request.key_digest) ||
+				typeof recovery.initial_delegate_request.request_digest !== "string" ||
+				!/^[a-f0-9]{64}$/.test(recovery.initial_delegate_request.request_digest))) ||
 		(queue.selected_promotion !== null &&
 			(!isRecord(queue.selected_promotion) ||
 				!safeId(queue.selected_promotion.from_turn_id) ||
@@ -1837,7 +1851,15 @@ export async function commitCreationWal(
 					scheduler_applied_revision: 0,
 					scheduler_digest: digest(JSON.stringify({ session_id: session.session_id, revision: 1 })),
 				},
-				recovery: { prompt_watermark_at: null, last_repaired_at: null },
+				recovery: {
+					prompt_watermark_at: null,
+					last_repaired_at: null,
+					// Only a newly created WAL may grant pre-dispatch authority. An
+					// existing WAL above must never replenish a consumed/compacted claim.
+					...(intent.kind === "delegate"
+						? { initial_delegate_request: { key_digest: keyDigest, request_digest: request.request_digest } }
+						: {}),
+				},
 			};
 			assertTransaction(transaction, session.namespace_id, session.session_id);
 			await writeAtomic(transactionPath(paths, session.session_id), transaction);
@@ -2320,6 +2342,13 @@ export async function enumeratePublicDeliveries(
 export function compactTransaction(transaction: CoordinatorSessionTransactionV1, now = Date.now()): void {
 	normalizeOutbox(transaction);
 	const old = (time: string): boolean => Date.parse(time) + RETENTION_MS < now;
+	// Prompt acceptance/canonical finalization precedes the outer delegate receipt.
+	// Neither retention nor pressure compaction may erase that recovery authority.
+	const pinnedPrompts = Object.values(transaction.requests.prompts).filter(
+		request => request.delegate_response_pending === true,
+	);
+	const pinnedRequests = new Set<object>(pinnedPrompts);
+	const pinnedTurns = new Set(pinnedPrompts.map(request => request.coordinator_turn_id));
 	for (const [id, event] of Object.entries(transaction.outbox))
 		if (
 			event.emitted &&
@@ -2332,6 +2361,7 @@ export function compactTransaction(transaction: CoordinatorSessionTransactionV1,
 		for (const [id, request] of Object.entries(group))
 			if (
 				request.phase === "completed" &&
+				!pinnedRequests.has(request) &&
 				old(request.updated_at) &&
 				JSON.stringify(transaction.canonical).includes(id) === false
 			)
@@ -2347,6 +2377,7 @@ export function compactTransaction(transaction: CoordinatorSessionTransactionV1,
 		for (const turnId of terminalTurnIds) {
 			const turn = transaction.canonical.turns[turnId];
 			if (!turn) continue;
+			if (pinnedTurns.has(turnId)) continue;
 			// Both promotion endpoints stay addressable for later projection repair;
 			// deleting either would corrupt the WAL instead of completing at capacity.
 			if (