@gajae-code/coding-agent 0.16.7 → 0.17.1

package/src/config/mcp-schema.json

@@ -92,7 +92,7 @@
           "type": "string"
         }
       },
-      "description": "Explicit OAuth client settings for servers that need them during /mcp reauth or initial connect."
+      "description": "Client settings for an explicit MCP OAuth authorization consumer. These fields do not define a public standalone or ACP slash-command flow: those sessions do not expose /mcp reauth, /mcp test, or /mcp reconnect, and no public MCP OAuth authorization or reauthorization entry path is provided. Refreshing an already-stored credential does not read these: it uses the separate `auth` binding's clientId/clientSecret."
     },
     "serverBase": {
       "type": "object",
@@ -103,7 +103,7 @@
         },
         "autoload": {
           "type": "boolean",
-          "description": "Whether an explicit runtime MCP consumer should connect this server automatically when that consumer starts (default: true). Ordinary standalone gjc, gjc --tmux, and print-mode sessions honor autoload for conventional registrations; false keeps the server configured for on-demand /mcp connection, and --no-mcp opts a session out."
+          "description": "Whether an explicit runtime MCP consumer should connect this server automatically when that consumer starts (default: true). Ordinary standalone gjc, gjc --tmux, and print-mode sessions honor autoload for conventional registrations, and --no-mcp opts a session out. false keeps the server stored but unloaded at startup: startup loading never connects it, and naming the file with --mcp-config does not override it, so set autoload to true or remove the key and start a new session. Autoload is necessary but not sufficient — enabled: false and disabledServers still block the server."
         },
         "sharing": {
           "type": "string",
@@ -112,7 +112,7 @@
             "shared"
           ],
           "default": "per-session",
-          "description": "MCP connection pool identity mode; W2 defaults to one connection per session."
+          "description": "MCP connection pool identity mode; W2 defaults to one connection per session. Sharing is scoped to a single consumer process: separate processes never join the same pooled connection."
         },
         "timeout": {
           "type": "number",

package/src/config/model-preset-registry.ts

@@ -374,6 +374,7 @@ const RegistryPresetSchema = z
 			"azure-openai-responses",
 			"bedrock-converse-stream",
 			"cursor-agent",
+			"devin-acp",
 			"google-gemini-cli",
 			"google-generative-ai",
 			"google-vertex",

package/src/config/model-registry.ts

@@ -777,6 +777,11 @@ function filterMaterializedRegistryProfiles(
 	}
 	return filtered;
 }
+type SpecialProviderDescriptor = {
+	providerId: string;
+	resolveKey: (value: string | undefined) => string | undefined;
+	createOptions: (key: string) => ModelManagerOptions<Api>;
+};
 
 const PROVIDER_BASE_URL_ENV_ALIASES: Record<string, readonly string[]> = {
 	anthropic: ["ANTHROPIC_BASE_URL"],
@@ -1098,9 +1103,10 @@ function resolveOAuthAccountIdForAccessToken(
 	authStorage: AuthStorage,
 	provider: string,
 	accessToken: string,
+	sessionId?: string,
 	owner?: object,
 ): string | undefined {
-	if (authStorage.getEffectiveCredentialType(provider, undefined, owner ? { owner } : undefined) !== "oauth") {
+	if (authStorage.getEffectiveCredentialType(provider, sessionId, owner ? { owner } : undefined) !== "oauth") {
 		return undefined;
 	}
 	const oauthCredentials = getOAuthCredentialsForProvider(authStorage, provider);
@@ -1851,7 +1857,7 @@ export class ModelRegistry {
 	/**
 	 * Reload models from disk and refresh runtime provider discovery state.
 	 */
-	async refresh(strategy: ModelRefreshStrategy = "online-if-uncached"): Promise<void> {
+	async refresh(strategy: ModelRefreshStrategy = "online-if-uncached", credentialSessionId?: string): Promise<void> {
 		if (this.#disposed) return;
 		await this.#enqueueCatalogMutation(async () => {
 			if (this.#disposed) return;
@@ -1863,7 +1869,13 @@ export class ModelRegistry {
 			try {
 				this.#reloadStaticModels();
 				this.#suppressedSelectors.clear();
-				await this.#refreshRuntimeDiscoveries(strategy, undefined, refreshGeneration, providerRefreshFence);
+				await this.#refreshRuntimeDiscoveries(
+					strategy,
+					undefined,
+					refreshGeneration,
+					providerRefreshFence,
+					credentialSessionId,
+				);
 				if (refreshGeneration === this.#catalogRefreshGeneration) this.#modelBindingsApplier.apply();
 			} finally {
 				this.#resumeRebuild();
@@ -1871,11 +1883,11 @@ export class ModelRegistry {
 		});
 	}
 
-	refreshInBackground(strategy: ModelRefreshStrategy = "online-if-uncached"): void {
+	refreshInBackground(strategy: ModelRefreshStrategy = "online-if-uncached", credentialSessionId?: string): void {
 		if (this.#backgroundRefresh) {
 			return;
 		}
-		const refreshPromise = this.refresh(strategy)
+		const refreshPromise = this.refresh(strategy, credentialSessionId)
 			.catch(error => {
 				logger.warn("background model refresh failed", {
 					error: error instanceof Error ? error.message : String(error),
@@ -1889,7 +1901,11 @@ export class ModelRegistry {
 		this.#backgroundRefresh = refreshPromise;
 	}
 
-	async refreshProvider(providerId: string, strategy: ModelRefreshStrategy = "online"): Promise<void> {
+	async refreshProvider(
+		providerId: string,
+		strategy: ModelRefreshStrategy = "online",
+		credentialSessionId?: string,
+	): Promise<void> {
 		if (this.#disposed) return;
 		const providerRefreshGeneration = (this.#providerRefreshGenerations.get(providerId) ?? 0) + 1;
 		this.#providerRefreshGenerations.set(providerId, providerRefreshGeneration);
@@ -1905,10 +1921,16 @@ export class ModelRegistry {
 						this.#suppressedSelectors.delete(selector);
 					}
 				}
-				await this.#refreshRuntimeDiscoveries(strategy, new Set([providerId]), refreshGeneration, {
-					providerId,
-					generation: providerRefreshGeneration,
-				});
+				await this.#refreshRuntimeDiscoveries(
+					strategy,
+					new Set([providerId]),
+					refreshGeneration,
+					{
+						providerId,
+						generation: providerRefreshGeneration,
+					},
+					credentialSessionId,
+				);
 				if (
 					refreshGeneration === this.#catalogRefreshGeneration &&
 					this.#providerRefreshGenerations.get(providerId) === providerRefreshGeneration
@@ -3042,6 +3064,7 @@ export class ModelRegistry {
 		providerFilter?: ReadonlySet<string>,
 		refreshGeneration = this.#catalogRefreshGeneration,
 		providerRefresh?: ProviderRefreshFence,
+		credentialSessionId?: string,
 	): Promise<void> {
 		const profileAvailabilityEvidenceBefore = this.#profileAvailabilityEvidenceFingerprint();
 		const disabledProviders = getDisabledProviderIdsFromSettings(this.#settings);
@@ -3055,12 +3078,12 @@ export class ModelRegistry {
 				? Promise.resolve([] as ConfiguredDiscoveryResult[])
 				: Promise.all(
 						selectedDiscoverableProviders.map(provider =>
-							this.#discoverProviderModels(provider, strategy, providerRefresh),
+							this.#discoverProviderModels(provider, strategy, providerRefresh, credentialSessionId),
 						),
 					);
 		const [configuredDiscoveryResults, builtInDiscovered] = await Promise.all([
 			configuredDiscoveriesPromise,
-			this.#discoverBuiltInProviderModels(strategy, providerFilter, providerRefresh),
+			this.#discoverBuiltInProviderModels(strategy, providerFilter, providerRefresh, credentialSessionId),
 		]);
 		if (
 			refreshGeneration !== this.#catalogRefreshGeneration ||
@@ -3301,6 +3324,7 @@ export class ModelRegistry {
 		providerConfig: DiscoveryProviderConfig,
 		strategy: ModelRefreshStrategy,
 		providerRefresh?: ProviderRefreshFence,
+		credentialSessionId?: string,
 	): Promise<ConfiguredDiscoveryResult> {
 		const provider = providerConfig.provider;
 		const preflightEpoch = this.#optionalAuthPreflightEpoch;
@@ -3330,6 +3354,7 @@ export class ModelRegistry {
 						ignoreCredentiallessFallback: optionalAuth,
 						refreshOAuth: true,
 						baseUrl: providerConfig.baseUrl,
+						credentialSessionId,
 					}),
 				);
 				const currentAuthConfigurationGeneration = this.authStorage.getProviderConfigurationGeneration(provider);
@@ -3459,6 +3484,7 @@ export class ModelRegistry {
 					: this.#peekApiKeyForProvider(provider.provider, {
 							refreshOAuth: true,
 							baseUrl: provider.baseUrl,
+							credentialSessionId,
 						}),
 			isAuthenticated,
 			fetchModels: async (provider, apiKey) => {
@@ -3565,6 +3591,7 @@ export class ModelRegistry {
 		strategy: ModelRefreshStrategy,
 		providerFilter?: ReadonlySet<string>,
 		providerRefresh?: ProviderRefreshFence,
+		credentialSessionId?: string,
 	): Promise<Model<Api>[]> {
 		// Skip providers already handled by configured discovery (e.g. user-configured ollama with discovery.type)
 		const configuredDiscoveryProviders = new Set(this.#discoveryManager.providers.map(p => p.provider));
@@ -3578,6 +3605,7 @@ export class ModelRegistry {
 		const managerOptions = await this.#collectBuiltInModelManagerOptions(
 			configuredDiscoveryProviders,
 			providerFilter,
+			credentialSessionId,
 		);
 		if (managerOptions.length === 0) {
 			return [];
@@ -3588,15 +3616,8 @@ export class ModelRegistry {
 		return discoveries.flat();
 	}
 
-	async #collectBuiltInModelManagerOptions(
-		excludedProviderIds: ReadonlySet<string> = new Set(),
-		providerFilter?: ReadonlySet<string>,
-	): Promise<ModelManagerDiscoveryOptions[]> {
-		const specialProviderDescriptors: Array<{
-			providerId: string;
-			resolveKey: (value: string | undefined) => string | undefined;
-			createOptions: (key: string) => ModelManagerOptions<Api>;
-		}> = [
+	#specialProviderDescriptors(credentialSessionId?: string): SpecialProviderDescriptor[] {
+		return [
 			{
 				providerId: "google-antigravity",
 				resolveKey: extractGoogleOAuthToken,
@@ -3623,6 +3644,7 @@ export class ModelRegistry {
 						this.authStorage,
 						"openai-codex",
 						accessToken,
+						credentialSessionId,
 						this.#authStorageConfigOwner,
 					);
 					return openaiCodexModelManagerOptions({
@@ -3632,6 +3654,14 @@ export class ModelRegistry {
 				},
 			},
 		];
+	}
+
+	async #collectBuiltInModelManagerOptions(
+		excludedProviderIds: ReadonlySet<string> = new Set(),
+		providerFilter?: ReadonlySet<string>,
+		credentialSessionId?: string,
+	): Promise<ModelManagerDiscoveryOptions[]> {
+		const specialProviderDescriptors = this.#specialProviderDescriptors(credentialSessionId);
 		const disabledProviders = getDisabledProviderIdsFromSettings(this.#settings);
 		const standardProviderDescriptors = PROVIDER_DESCRIPTORS.filter(
 			descriptor =>
@@ -3655,7 +3685,7 @@ export class ModelRegistry {
 		// and failures there are handled gracefully.
 		const peekKey = async (descriptor: { providerId: string }) => {
 			const configurationGeneration = this.authStorage.getProviderConfigurationGeneration(descriptor.providerId);
-			const apiKey = await this.#peekApiKeyForProvider(descriptor.providerId);
+			const apiKey = await this.#peekApiKeyForProvider(descriptor.providerId, { credentialSessionId });
 			if (configurationGeneration !== this.authStorage.getProviderConfigurationGeneration(descriptor.providerId)) {
 				return { apiKey: undefined, authGeneration: undefined };
 			}
@@ -5387,6 +5417,27 @@ export class ModelRegistry {
 			.map(provider => provider.provider);
 	}
 
+	/**
+	 * Providers whose catalogs can be filled by bounded official refresh:
+	 * configured discovery, built-in special OAuth dynamics, and standard
+	 * descriptor-backed providers. Unknown ids stay excluded. Disabled
+	 * providers are omitted. UI tabs still use getDiscoverableProviders.
+	 */
+	getRefreshableProviders(): string[] {
+		const disabledProviders = getDisabledProviderIdsFromSettings(this.#settings);
+		const providers: string[] = [];
+		const seen = new Set<string>();
+		const add = (providerId: string) => {
+			if (disabledProviders.has(providerId) || seen.has(providerId)) return;
+			seen.add(providerId);
+			providers.push(providerId);
+		};
+		for (const provider of this.#discoveryManager.providers) add(provider.provider);
+		for (const descriptor of PROVIDER_DESCRIPTORS) add(descriptor.providerId);
+		for (const descriptor of this.#specialProviderDescriptors()) add(descriptor.providerId);
+		return providers;
+	}
+
 	getProviderDiscoveryState(provider: string): ProviderDiscoveryState | undefined {
 		return this.#discoveryManager.getState(provider);
 	}
@@ -5645,6 +5696,7 @@ export class ModelRegistry {
 			ignoreCredentiallessFallback?: boolean;
 			refreshOAuth?: boolean;
 			baseUrl?: string;
+			credentialSessionId?: string;
 		} = {},
 	): Promise<string | undefined> {
 		this.#refreshRotatingConfigApiKey(provider);
@@ -5657,16 +5709,17 @@ export class ModelRegistry {
 			return undefined;
 		}
 		if (options.refreshOAuth && this.authStorage.hasOAuth(provider)) {
-			return this.authStorage.getApiKey(provider, undefined, {
+			return this.authStorage.getApiKey(provider, options.credentialSessionId, {
 				baseUrl: options.baseUrl,
 				owner: this.#authStorageConfigOwner,
 			});
 		}
+		const peekOptions = options.credentialSessionId
+			? { owner: this.#authStorageConfigOwner, sessionId: options.credentialSessionId }
+			: { owner: this.#authStorageConfigOwner };
 		return options.ignoreCredentiallessFallback
-			? this.authStorage.peekApiKey(provider, { owner: this.#authStorageConfigOwner })
-			: this.#getApiKeyOrNoAuth(provider, () =>
-					this.authStorage.peekApiKey(provider, { owner: this.#authStorageConfigOwner }),
-				);
+			? this.authStorage.peekApiKey(provider, peekOptions)
+			: this.#getApiKeyOrNoAuth(provider, () => this.authStorage.peekApiKey(provider, peekOptions));
 	}
 
 	/**

package/src/config/model-resolver.ts

@@ -86,14 +86,14 @@ export function resolveStartupModelRefreshSelectors(
 
 export async function refreshMissingQualifiedModelProviders(
 	selectors: ModelSelectorValue | undefined,
-	modelRegistry: Pick<ModelRegistry, "getAvailable" | "getDiscoverableProviders" | "refreshProvider">,
+	modelRegistry: Pick<ModelRegistry, "getAvailable" | "getRefreshableProviders" | "refreshProvider">,
 ): Promise<boolean> {
 	const refreshedProviders = new Set<string>();
 	for (const selector of normalizeModelSelectorValue(selectors)) {
 		const parsedSelector = parseModelString(selector);
 		if (!parsedSelector) continue;
 		const provider = modelRegistry
-			.getDiscoverableProviders()
+			.getRefreshableProviders()
 			.find(candidate => candidate.toLowerCase() === parsedSelector.provider.toLowerCase());
 		if (!provider || refreshedProviders.has(provider)) continue;
 		const availableModels = modelRegistry.getAvailable();
@@ -1143,10 +1143,25 @@ export async function resolveModelChainWithAuth(
 	}
 	return { explicitThinkingLevel: false, activeIndex: modelPatterns.length, skips };
 }
+export function isExplicitProviderModelSelector(pattern: string): boolean {
+	const normalized = pattern.trim();
+	if (!normalized || isSessionInheritedAgentPattern(normalized)) return false;
+	const suffix = splitSelectorThinkingSuffix(normalized);
+	const selector = suffix.thinkingLevel ? suffix.selector : normalized;
+	if (getModelRoleAlias(selector)) return false;
+	if (/[*?[]/.test(selector)) return false;
+	const parsed = parseModelString(selector);
+	return parsed !== undefined && parsed.provider.length > 0 && parsed.id.length > 0;
+}
+
+export function isExplicitProviderModelOverride(modelPatterns: readonly string[]): boolean {
+	return modelPatterns.length > 0 && modelPatterns.every(isExplicitProviderModelSelector);
+}
 
 /**
  * Resolve a list of override patterns to the first matching model, with an
- * auth-aware fallback to the parent session's active model.
+ * auth-aware fallback to the parent session's active model for unqualified
+ * aliases and role patterns.
  *
  * If the resolved subagent model has no working credentials (provider has no
  * usable auth), and the parent's active model resolves with working auth,
@@ -1155,6 +1170,14 @@ export async function resolveModelChainWithAuth(
  * `modelRoles.task` pointing at an unqualified id whose only available
  * provider variant has no configured credentials — see #985).
  *
+ * Explicit `provider/model` selectors (including user-specified chains of
+ * them) fail closed instead: a missing catalog entry or authentication
+ * failure must not substitute the parent session's model or another
+ * provider. Intentional chain tails still apply in order. Mixed chains that
+ * include any unqualified/role entry keep parent fallback for the whole
+ * chain, including explicit heads. Glob selectors (`*`, `?`, `[`) are not
+ * exact pins.
+ *
  * Keyless-by-design providers (llama.cpp, ollama, lm-studio) advertise the
  * `kNoAuth` sentinel from `getApiKey` to signal that they do not require
  * credentials. Those are treated as authenticated here so an explicitly
@@ -1163,7 +1186,9 @@ export async function resolveModelChainWithAuth(
  *
  * If neither the subagent nor the parent has working auth, returns the
  * primary resolution unchanged so the existing error path still surfaces
- * a meaningful failure downstream.
+ * a meaningful failure downstream. Explicit-only chains return no model
+ * so callers can surface an actionable error. Canonical parent seeding is
+ * independent of that fail-closed substitution guard.
  */
 export async function resolveModelOverrideWithAuthFallback(
 	modelPatterns: string[],
@@ -1191,6 +1216,7 @@ export async function resolveModelOverrideWithAuthFallback(
 	const skips: Array<{ selector: string; reason: string }> = [];
 	let activeIndex = 0;
 	const canonicalScope = canonicalSessionId ?? authSessionId;
+	const explicitExactOnly = isExplicitProviderModelOverride(modelPatterns);
 	if (canonicalScope && parentActiveModelPattern) {
 		const parentActiveModel = resolveModelOverride(
 			[parentActiveModelPattern],
@@ -1257,6 +1283,9 @@ export async function resolveModelOverrideWithAuthFallback(
 		skips.push({ selector: pattern, reason: "unauthenticated" });
 		activeIndex += 1;
 	}
+	if (explicitExactOnly) {
+		return { explicitThinkingLevel: false, requestedModel, authFallbackUsed: false, activeIndex, skips };
+	}
 	const fallback = parentActiveModelPattern
 		? resolveModelOverride([parentActiveModelPattern], modelRegistry, settings, authSessionId, options?.aliasIntent)
 		: { explicitThinkingLevel: false };

package/src/config/models-config-schema.ts

@@ -141,6 +141,7 @@ const ModelDefinitionSchema = z
 				"google-gemini-cli",
 				"ollama-chat",
 				"cursor-agent",
+				"devin-acp",
 			])
 			.optional(),
 		baseUrl: z.string().min(1).optional(),
@@ -234,6 +235,7 @@ const ProviderConfigSchema = z
 				"google-gemini-cli",
 				"ollama-chat",
 				"cursor-agent",
+				"devin-acp",
 			])
 			.optional(),
 		headers: z.record(z.string(), z.string()).optional(),

package/src/config/settings-schema.ts

@@ -309,7 +309,11 @@ export const DEFAULT_BASH_INTERCEPTOR_RULES: BashInterceptorRule[] = [
 		message: "Use the `edit` tool instead of awk -i inplace. It provides diff preview and fuzzy matching.",
 	},
 	{
-		pattern: "^\\s*(echo|printf|cat\\s*<<)\\s+.*[^|]>\\s*\\S",
+		// The redirection must belong to the leading echo/printf/heredoc itself:
+		// `(?!&&)[^;|\n]` keeps the scan inside that one command, `(?<![02-9])`
+		// skips fd redirections like `2>/dev/null`, and `<<\S*` accepts the usual
+		// `<<EOF` / `<<'EOF'` heredoc spelling that has no space after `<<`.
+		pattern: "^\\s*(echo|printf|cat\\s*<<\\S*)\\s+(?:(?!&&)[^;|\\n])*(?<![02-9])>{1,2}\\s*\\S",
 		tool: "write",
 		message: "Use the `write` tool instead of echo/cat redirection. It handles encoding and provides confirmation.",
 	},
@@ -412,7 +416,7 @@ export const SETTINGS_SCHEMA = {
 	// SDK-owned prompt deadline. Hidden from the UI; ACP has no separate timeout.
 	"sdk.promptDeadlineMs": {
 		type: "number",
-		default: 1_800_000,
+		default: 3_600_000,
 		description: "SDK-owned prompt deadline; ACP has no separate timeout.",
 		validate: (value: number) => Number.isSafeInteger(value) && value >= 60_000 && value <= 86_400_000,
 	},

package/src/coordinator-mcp/question-gate-codec.ts

@@ -9,6 +9,7 @@ export type PublicReason =
 	| "pagination_malformed"
 	| "row_unrepresentable"
 	| "missing_runtime_turn"
+	| "pending_registration"
 	| "invalid_runtime_turn"
 	| "invalid_gate_row"
 	| "wrong_session"