@gajae-code/coding-agent 0.16.7 → 0.17.1

package/src/slash-commands/builtin-registry.ts

@@ -436,7 +436,11 @@ async function resolveModelCommandSelection(
 	const providerRef = parseProviderQualifiedSelector(selector);
 	const discoverableProviders = runtime.session.modelRegistry?.getDiscoverableProviders?.() ?? [];
 	if (providerRef && discoverableProviders.includes(providerRef.provider)) {
-		await runtime.session.modelRegistry.refreshProvider?.(providerRef.provider, "online");
+		await runtime.session.modelRegistry.refreshProvider?.(
+			providerRef.provider,
+			"online",
+			runtime.session.credentialSessionId,
+		);
 		availableModels = runtime.session.getAvailableModels?.() ?? [];
 		const refreshedSelection = resolveModelCommandSelectionFromAvailable(
 			runtime,
@@ -1699,7 +1703,7 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 					models: parsed.models,
 					force: parsed.force,
 				});
-				await runtime.session.modelRegistry.refresh("offline");
+				await runtime.session.modelRegistry.refresh("offline", runtime.session.credentialSessionId);
 				await runtime.output(formatProviderSetupResult(result));
 				await runtime.notifyConfigChanged?.();
 				return commandConsumed();
@@ -1740,7 +1744,7 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 						models: parsed.models,
 						force: parsed.force,
 					});
-					await runtime.ctx.session.modelRegistry.refresh("offline");
+					await runtime.ctx.session.modelRegistry.refresh("offline", runtime.ctx.session.credentialSessionId);
 					runtime.ctx.showStatus(formatProviderSetupResult(result));
 				} catch (err) {
 					runtime.ctx.showError(`Provider setup failed: ${errorMessage(err)}`);

package/src/system-prompt.ts

@@ -406,6 +406,12 @@ export interface BuildSystemPromptOptions {
 	alwaysApplyRules?: AlwaysApplyRule[];
 	/** Whether secret obfuscation is active. When true, explains the redaction format in the prompt. */
 	secretsEnabled?: boolean;
+	/**
+	 * Whether the `task` tool advertises the `isolated` parameter in this session
+	 * (`task.isolation.mode !== "none"`). Worktree routing guidance depends on it:
+	 * without isolation the agent must use a plain `git worktree`, never refuse.
+	 */
+	taskIsolationEnabled?: boolean;
 	/** Pre-loaded workspace tree (skips discovery if provided). May be a Promise to allow early kick-off. */
 	workspaceTree?: WorkspaceTree | Promise<WorkspaceTree>;
 	/**
@@ -570,6 +576,7 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		toolDiscoveryActive = false,
 		eagerTasks = false,
 		secretsEnabled = false,
+		taskIsolationEnabled = false,
 		workspaceTree: providedWorkspaceTree,
 		subagent = false,
 	} = options;
@@ -749,6 +756,7 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		toolDiscoveryActive: toolDiscoveryActive && hasHiddenToolDiscoveryTool,
 		eagerTasks,
 		secretsEnabled,
+		taskIsolationEnabled,
 		subagent,
 	};
 	const rendered = prompt.render(resolvedCustomPrompt ? customSystemPromptTemplate : systemPromptTemplate, data);

package/src/task/executor.ts

@@ -34,7 +34,11 @@ import { logger, prompt, untilAborted } from "@gajae-code/utils";
 import { AsyncJobManager } from "../async";
 import { AUTOROUTING_SELECTOR_MAX_LENGTH, type AutoroutingReasonCode } from "../config/autorouting-contract";
 import { ModelRegistry } from "../config/model-registry";
-import { formatModelString, resolveModelOverrideWithAuthFallback } from "../config/model-resolver";
+import {
+	formatModelString,
+	isExplicitProviderModelOverride,
+	resolveModelOverrideWithAuthFallback,
+} from "../config/model-resolver";
 import type { PromptTemplate } from "../config/prompt-templates";
 import { Settings } from "../config/settings";
 import { SETTINGS_SCHEMA, type SettingPath } from "../config/settings-schema";
@@ -921,7 +925,13 @@ function formatExecutionError(error: unknown): string {
 		const causes = error.errors.map(cause => (cause instanceof Error ? cause.message : String(cause))).join("; ");
 		return causes ? `${error.message}: ${causes}` : error.message;
 	}
-	return error instanceof Error ? error.stack || error.message : String(error);
+	if (!(error instanceof Error)) return String(error);
+	const message = error.message;
+	const stack = error.stack;
+	if (!stack) return message;
+	const stackHeadline = stack.split(/\r?\n/u, 1)[0] ?? "";
+	if (!message || stackHeadline.includes(message)) return stack;
+	return `${error.name || "Error"}: ${message}\n${stack}`;
 }
 
 function transportFactsFromError(error: unknown): TransportFailureFacts | undefined {
@@ -1730,7 +1740,12 @@ export async function runSubprocessOnce(options: ExecutorOptions): Promise<Singl
 			}
 			checkAbort();
 			if (!registryFromParent) {
-				await awaitAbortable(modelRegistry.refresh());
+				await awaitAbortable(
+					modelRegistry.refresh(
+						"online-if-uncached",
+						options.parentCredentialSessionId ?? options.parentSessionId,
+					),
+				);
 			} else {
 				logger.debug("runSubagent: reusing parent modelRegistry; skipping refresh");
 			}
@@ -1763,6 +1778,24 @@ export async function runSubprocessOnce(options: ExecutorOptions): Promise<Singl
 					canonicalChildScope,
 				),
 			);
+			if (!model && isExplicitProviderModelOverride(modelPatterns)) {
+				const skipReasons = [...new Set(skips.map(skip => skip.reason))];
+				if ((options.preflightProbe || options.preflightDurable) && skipReasons.includes("unauthenticated")) {
+					preflightOperation = "auth_resolve";
+					throw Object.assign(new Error("autorouting credential unavailable"), {
+						transient: false,
+						credentialMissing: true,
+					});
+				}
+				const reason = skipReasons.includes("unauthenticated")
+					? "authentication failed"
+					: skipReasons.includes("unknown_model")
+						? "is missing from the catalog"
+						: "could not be resolved";
+				throw new Error(
+					`Requested model ${modelPatterns.join(", ")} ${reason}. Explicit provider/model selectors fail closed and do not fall back to the parent session model.`,
+				);
+			}
 			if (
 				(options.preflightProbe || options.preflightDurable) &&
 				model &&

package/src/task/types.ts

@@ -92,7 +92,9 @@ const repositoryBindingSchema = z
 		branch: z.string().min(1).optional(),
 	})
 	.strict()
-	.describe("authoritative repository identity for multi-repo fail-closed spawn");
+	.describe(
+		"authoritative repository identity for multi-repo fail-closed spawn; must match the active session worktree. To target another approved repository, start a new session there (for example, gjc --cwd <approved-worktree>); changing tasks[].repositoryBinding cannot authorize a foreign repository.",
+	);
 
 const createTaskItemSchema = (_contextEnabled: boolean) =>
 	z.object({
@@ -118,7 +120,7 @@ const createTaskItemSchema = (_contextEnabled: boolean) =>
 		repositoryBinding: repositoryBindingSchema
 			.optional()
 			.describe(
-				"authoritative repository identity; omitted items are stamped from session cwd before discovery/spawn and still fail closed on sibling drift",
+				"authoritative repository identity; omitted items are stamped from session cwd before discovery/spawn and still fail closed on sibling drift. A declared binding must match the active session; use a new session rooted in the approved worktree (for example, gjc --cwd <approved-worktree>) for another repository.",
 			),
 		duplicate_policy: z.enum(["warn", "supersede"]).optional().describe("duplicate launch policy; defaults to warn"),
 	});
@@ -352,12 +354,31 @@ const SETUP_FAILURE_SUMMARY_MAX_CHARS = 280;
 const SETUP_FAILURE_SUMMARY_MAX_BYTES = 1_024;
 const AUTHORIZATION_HEADER_VALUE_PATTERN = /(["']?(?:Proxy-)?Authorization\b["']?\s*:\s*)[^\r\n]*/gi;
 const COOKIE_HEADER_VALUE_PATTERN = /(["']?(?:Set-)?Cookie\b["']?\s*:\s*)[^\r\n]*/gi;
-const URL_CREDENTIAL_PATTERN = /([a-z][a-z0-9+.-]*:\/\/)[^/?#\s:@]+:[^@/?#\s]+@/gi;
+// The scheme-character run is boundary anchored, so the unbounded suffix is
+// attempted once per maximal run instead of once at every prefix. Keeping the
+// leading non-letter characters in the capture preserves redaction for URLs
+// embedded after digits or scheme punctuation without imposing an arbitrary
+// scheme-length cap.
+const URL_CREDENTIAL_PATTERN = /(?<![A-Za-z0-9+.-])([0-9+.-]*[a-z][a-z0-9+.-]*:\/\/)[^/?#\s:@]+:[^@/?#\s]+@/gi;
 const API_KEY_LABEL_VALUE_PATTERN = /(["']?api\s+key["']?\s*:\s*)(?:"[^"]*"|'[^']*'|[^\s&]+)/gi;
+// Both name-prefix repetitions are bounded. `(?:[A-Za-z][A-Za-z0-9]*[_.-])*?`
+// nests an unbounded quantifier inside an unbounded quantified group, so at every
+// offset of a long identifier run the inner class scans to the end of the run
+// before backtracking to look for a separator. That is quadratic in the length of
+// the failure text: 50 KB cost ~1.7s. Sixteen segments of at most 64 characters is
+// far past any real credential name, and the suffix group below still absorbs
+// arbitrary trailing segments.
 const SENSITIVE_SETUP_FAILURE_VALUE_PATTERN =
-	/(["']?(?:(?:[A-Za-z][A-Za-z0-9]*[_.-])*?)(?:access[_-]?token|refresh[_-]?token|session[_-]?token|id[_-]?token|api[_-]?key|client[_-]?secret|private[_-]?key|signing[_-]?key|secret|password|passwd|pwd|authorization|credential|token)(?:[_.-][A-Za-z0-9]+)*["']?)(\s*[=:]\s*)(?:"[^"]*"|'[^']*'|[^\s&]+)/gi;
+	/(["']?(?:[A-Za-z][A-Za-z0-9]{0,63}[_.-]){0,16}?(?:access[_-]?token|refresh[_-]?token|session[_-]?token|id[_-]?token|api[_-]?key|client[_-]?secret|private[_-]?key|signing[_-]?key|secret|password|passwd|pwd|authorization|credential|token)(?:[_.-][A-Za-z0-9]+)*["']?)(\s*[=:]\s*)(?:"[^"]*"|'[^']*'|[^\s&]+)/gi;
+// `AKIA` is only one of four AWS access-key id prefixes, and the npm, GitLab,
+// Stripe and Hugging Face shapes are the ones `crash/upstream/envelope.ts`
+// already classifies as credential-like. Stripe and Hugging Face separate with
+// `_`, so the `sk-` alternatives above never matched them.
 const BARE_PROVIDER_TOKEN_PATTERN =
-	/\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|sk-(?:proj-)?[A-Za-z0-9_-]{20,}|sk-ant-[A-Za-z0-9_-]{20,}|AIza[A-Za-z0-9_-]{35}|AKIA[A-Z0-9]{16})\b/g;
+	/\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|sk-(?:proj-)?[A-Za-z0-9_-]{20,}|sk-ant-[A-Za-z0-9_-]{20,}|AIza[A-Za-z0-9_-]{35}|(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}|npm_[A-Za-z0-9]{20,}|glpat-[A-Za-z0-9_-]{20,}|(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}|hf_[A-Za-z0-9]{20,})\b/g;
+// A PEM block carries the key material itself and is redacted whole, before the
+// narrower rules can consume its base64 body and leave a truncated key behind.
+const PEM_PRIVATE_KEY_PATTERN = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 const LOCAL_ABSOLUTE_PATH_PATTERN = /(^|[\s("'`=])((?:\/(?!\/)[^\s/:?"'`()[\]{},;<>]+){2,})/g;
 const WINDOWS_ABSOLUTE_PATH_PATTERN =
 	/(^|[\s("'`=])([A-Za-z]:\\(?:[^\\/:?"'`()[\]{},;<>\s]+\\)+[^\\/:?"'`()[\]{},;<>\s]+)/g;
@@ -417,6 +438,7 @@ function capSetupFailureSummary(value: string): string {
 export function createSetupFailureSummary(error: unknown): SetupFailureSummary {
 	const message = normalizeSetupFailureText(error instanceof Error ? error.message : String(error));
 	const summary = message
+		.replace(PEM_PRIVATE_KEY_PATTERN, "[redacted]")
 		.replace(AUTHORIZATION_HEADER_VALUE_PATTERN, "$1[redacted]")
 		.replace(COOKIE_HEADER_VALUE_PATTERN, "$1[redacted]")
 		.replace(URL_CREDENTIAL_PATTERN, "$1[redacted]@")

package/src/tools/ask.ts

@@ -109,6 +109,37 @@ export interface AskToolDetails {
 export const OTHER_OPTION = "Other (type your own)";
 export const ASK_CLARIFICATION_OPTION = "Ask about these choices";
 export const RECOMMENDED_SUFFIX = " (Recommended)";
+/**
+ * Environment override bounding how long a headless ask waits for its answer, in
+ * milliseconds. Unset, empty, non-positive, non-integer, or larger than
+ * {@link MAX_ASK_ANSWER_DEADLINE_MS} disables the bound.
+ */
+export const GJC_ASK_ANSWER_DEADLINE_MS_ENV = "GJC_ASK_ANSWER_DEADLINE_MS";
+/**
+ * Largest deadline the runtime timer can represent. `setTimeout` silently clamps
+ * a longer delay to one millisecond, which would invert the contract and abort a
+ * headless ask almost immediately, so a value beyond this is not a usable bound
+ * and is treated as disabled exactly like any other invalid value.
+ */
+export const MAX_ASK_ANSWER_DEADLINE_MS = 2_147_483_647;
+
+/**
+ * How long a headless ask may wait for an answer before it gives up.
+ *
+ * A headless ask has no local selector, so it is answered only by a remote
+ * answer source or by a workflow gate waiting for a remote responder. Neither
+ * channel reports that the question was taken up, so the only observable event
+ * is the answer itself: this is an answer deadline, not an acknowledgement.
+ * `GJC_ASK_ANSWER_DEADLINE_MS` arms it. It stays disabled by default: an
+ * attended remote responder may legitimately answer arbitrarily late, and
+ * silently cutting such a wait short would corrupt a real answer into an abort.
+ */
+export function resolveAskAnswerDeadlineMs(env: Record<string, string | undefined> = process.env): number | null {
+	const raw = env[GJC_ASK_ANSWER_DEADLINE_MS_ENV];
+	if (raw === undefined) return null;
+	const parsed = Number(raw);
+	return Number.isSafeInteger(parsed) && parsed > 0 && parsed <= MAX_ASK_ANSWER_DEADLINE_MS ? parsed : null;
+}
 const REMOTE_NAVIGATION_FORWARD = "\u0000ask-navigation-forward";
 const HEADLESS_CHECKBOX_CHECKED = "[x]";
 const HEADLESS_CHECKBOX_UNCHECKED = "[ ]";
@@ -825,10 +856,7 @@ export class AskTool implements AgentTool<AskParametersSchema, AskToolDetails> {
 	): Promise<AgentToolResult<AskToolDetails>> {
 		await assertUltragoalAskAllowed(
 			this.session.cwd,
-			{
-				activeSkillState: this.session.getActiveSkillState?.(),
-				sessionId: this.session.getSessionId?.() ?? null,
-			},
+			{ sessionId: this.session.getSessionId?.() ?? null },
 			this.session.getSessionAgentDir?.() ?? this.session.settings.getAgentDir(),
 		);
 		assertDeepInterviewStructuredResponseWithinLimit(params);
@@ -871,7 +899,55 @@ export class AskTool implements AgentTool<AskParametersSchema, AskToolDetails> {
 			throw new ToolAbortError("Ask tool requires interactive mode");
 		}
 
+		// Only a headless ask needs an answer deadline: an interactive UI answers
+		// locally, and its own `ask.timeout` already applies there.
+		const askAnswerDeadlineMs = hasInteractiveUi ? null : resolveAskAnswerDeadlineMs();
+		const askDeadlineExpired = Symbol("ask-deadline-expired");
+		/**
+		 * Bound one headless answer wait. No answer source reports that it has taken
+		 * the question, so the only observable event is the answer itself; on expiry
+		 * the ask must fail with a distinguishable origin instead of degrading into
+		 * the empty answer the model would otherwise read as "the user declined",
+		 * and the enclosing turn is aborted so the stall cannot outlive the call.
+		 */
+		const awaitAskAnswer = async <T>(work: () => Promise<T>): Promise<T> => {
+			if (askAnswerDeadlineMs === null) return await work();
+			const expired = Promise.withResolvers<typeof askDeadlineExpired>();
+			const timer = setTimeout(() => expired.resolve(askDeadlineExpired), askAnswerDeadlineMs);
+			try {
+				const settled = await Promise.race([work(), expired.promise]);
+				if (settled !== askDeadlineExpired) return settled;
+				logger.warn("ask_answer_deadline_exceeded", {
+					sessionId: this.session.getSessionId?.() ?? null,
+					// Re-derive the routed channel at expiry: the answer source can be
+					// registered or removed after the ask entered `execute`.
+					answerSource:
+						!this.session.getAskAnswerSource?.() && gateEmitter?.supportsRemoteGateAnswers() === true
+							? "workflow_gate"
+							: "remote",
+					deadlineMs: askAnswerDeadlineMs,
+				});
+				await settleActiveRemote({ kind: "resolve_without_commit", reason: "aborted" });
+				activeRemoteRequest = undefined;
+				context?.abort();
+				throw new ToolAbortError(
+					`Ask was aborted: no answer was received within ${askAnswerDeadlineMs / 1000}s of the headless ask answer deadline`,
+				);
+			} finally {
+				clearTimeout(timer);
+			}
+		};
+
 		const extensionUi = context?.ui;
+		const throwRemoteCancellation = (remoteSignal: AbortSignal, toolSignal?: AbortSignal): never => {
+			// A headless remote answer source owns the only interactive surface. When it
+			// explicitly closes the ask, abort the enclosing turn as well; otherwise the
+			// tool throws while the foreground prompt keeps running and the next client
+			// prompt is rejected as already active. An abort already initiated by the
+			// caller must not be reported as a second, remote cancellation.
+			if (!extensionUi && !remoteSignal.aborted && !toolSignal?.aborted) context?.abort();
+			throw new ToolAbortError("Ask was cancelled by the remote client");
+		};
 		const ui: UIContext = {
 			select: (prompt, options, dialogOptions) => {
 				const source = this.session.getAskAnswerSource?.();
@@ -908,7 +984,7 @@ export class AskTool implements AgentTool<AskParametersSchema, AskToolDetails> {
 				)
 					.then((answer): RemoteRaceResult | Promise<RemoteRaceResult> => {
 						if (answer === undefined) {
-							if (!extensionUi) throw new ToolAbortError("Ask was cancelled by the remote client");
+							if (!extensionUi) return throwRemoteCancellation(remoteController.signal, toolSignal);
 							return new Promise<never>(() => {});
 						}
 						const receipt = typeof answer === "string" ? legacyAskReceipt(answer) : answer;
@@ -989,20 +1065,22 @@ export class AskTool implements AgentTool<AskParametersSchema, AskToolDetails> {
 				// The losing selector may reject when aborted after the race already settled;
 				// swallow that so it is not an unhandled rejection (the race result is unaffected).
 				void local.catch(() => undefined);
-				return Promise.race([local, remote])
-					.then(async result => {
-						if (result.winner === "remote") {
-							localController.abort();
-							if (result.settlement) await result.receipt.settle(result.settlement);
-							else activeRemoteReceipt = result.receipt;
-						} else {
-							void remote.then(remoteResult =>
-								remoteResult.receipt.settle({ kind: "resolve_without_commit", reason: "aborted" }),
-							);
-						}
-						return result.value;
-					})
-					.finally(() => toolSignal?.removeEventListener("abort", abortRace));
+				return awaitAskAnswer(() =>
+					Promise.race([local, remote])
+						.then(async result => {
+							if (result.winner === "remote") {
+								localController.abort();
+								if (result.settlement) await result.receipt.settle(result.settlement);
+								else activeRemoteReceipt = result.receipt;
+							} else {
+								void remote.then(remoteResult =>
+									remoteResult.receipt.settle({ kind: "resolve_without_commit", reason: "aborted" }),
+								);
+							}
+							return result.value;
+						})
+						.finally(() => toolSignal?.removeEventListener("abort", abortRace)),
+				);
 			},
 			editor: (title, prefill, dialogOptions, editorOptions) => {
 				const source = this.session.getAskAnswerSource?.();
@@ -1041,7 +1119,7 @@ export class AskTool implements AgentTool<AskParametersSchema, AskToolDetails> {
 				)
 					.then((answer): RemoteRaceResult | Promise<RemoteRaceResult> => {
 						if (answer === undefined) {
-							if (!extensionUi) throw new ToolAbortError("Ask was cancelled by the remote client");
+							if (!extensionUi) return throwRemoteCancellation(remoteController.signal, toolSignal);
 							return new Promise<never>(() => {});
 						}
 						const receipt = typeof answer === "string" ? legacyAskReceipt(answer) : answer;
@@ -1078,19 +1156,21 @@ export class AskTool implements AgentTool<AskParametersSchema, AskToolDetails> {
 							})
 					: new Promise<never>(() => {});
 				void local.catch(() => undefined);
-				return Promise.race([local, remote])
-					.then(result => {
-						if (result.winner === "remote") {
-							activeRemoteReceipt = result.receipt;
-							localController.abort();
-						} else {
-							void remote.then(remoteResult =>
-								remoteResult.receipt.settle({ kind: "resolve_without_commit", reason: "aborted" }),
-							);
-						}
-						return result.value;
-					})
-					.finally(() => toolSignal?.removeEventListener("abort", abortRace));
+				return awaitAskAnswer(() =>
+					Promise.race([local, remote])
+						.then(result => {
+							if (result.winner === "remote") {
+								activeRemoteReceipt = result.receipt;
+								localController.abort();
+							} else {
+								void remote.then(remoteResult =>
+									remoteResult.receipt.settle({ kind: "resolve_without_commit", reason: "aborted" }),
+								);
+							}
+							return result.value;
+						})
+						.finally(() => toolSignal?.removeEventListener("abort", abortRace)),
+				);
 			},
 		};
 
@@ -1137,7 +1217,7 @@ export class AskTool implements AgentTool<AskParametersSchema, AskToolDetails> {
 					allowEmpty: q.multi === true && params.questions.length > 1,
 					navigationLabel: questionIndex === params.questions.length - 1 ? "Done" : "Next",
 				};
-				const answer = await gateEmitter.emitGate(questionToGate(gateQuestion));
+				const answer = await awaitAskAnswer(() => gateEmitter.emitGate(questionToGate(gateQuestion)));
 				const decoded = gateAnswerToResult(gateQuestion, answer);
 				return {
 					optionLabels: rawOptionLabels,

package/src/tools/browser/actions.ts

@@ -154,7 +154,7 @@ for (const s of __steps) {
 			__results.push({ verb: "select", selected: await tab.select(s.selector, ...(s.values || [])) });
 			break;
 		case "press":
-			await tab.press(s.key, s.selector ? { selector: s.selector } : undefined);
+			await tab.press(s.key, s.selector !== undefined ? { selector: s.selector } : undefined);
 			__results.push({ verb: "press", key: s.key });
 			break;
 		case "scroll":
@@ -166,7 +166,7 @@ for (const s of __steps) {
 			__results.push({ verb: "back" });
 			break;
 		case "wait":
-			if (s.selector) { await tab.waitFor(s.selector); }
+			if (s.selector !== undefined) { await tab.waitFor(s.selector); }
 			else { await new Promise(r => setTimeout(r, s.ms)); }
 			__results.push({ verb: "wait", selector: s.selector ?? null, ms: s.ms ?? null });
 			break;

package/src/tools/browser/tab-worker.ts

@@ -137,8 +137,12 @@ interface TabApi {
 	id(n: number): Promise<ElementHandle>;
 }
 
-function normalizeSelector(selector: string): string {
-	if (!selector) return selector;
+function normalizeSelector(selector: unknown): string {
+	if (typeof selector !== "string" || selector.trim().length === 0) {
+		throw new ToolError(
+			"Selector must be a non-empty string (CSS or a Puppeteer query handler). For numeric observation ids, use (await tab.id(id)).click() instead of tab.click(id).",
+		);
+	}
 	if (selector.startsWith("p-") && !LEGACY_SELECTOR_PREFIXES.some(prefix => selector.startsWith(prefix))) {
 		throw new ToolError(
 			`Unsupported selector prefix. Use CSS or puppeteer query handlers (aria/, text/, xpath/, pierce/). Got: ${selector}`,
@@ -735,7 +739,7 @@ export class WorkerCore {
 			},
 			press: async (key, opts) => {
 				const selector = opts?.selector;
-				if (selector) await untilAborted(signal, () => page.focus(normalizeSelector(selector)));
+				if (selector !== undefined) await untilAborted(signal, () => page.focus(normalizeSelector(selector)));
 				await untilAborted(signal, () => page.keyboard.press(key));
 			},
 			scroll: async (deltaX, deltaY) => {
@@ -829,12 +833,11 @@ export class WorkerCore {
 		opts: ScreenshotOptions = {},
 	): Promise<ScreenshotResult> {
 		const page = this.#requirePage();
-		const fullPage = opts.selector ? false : (opts.fullPage ?? false);
+		const selector = opts.selector === undefined ? undefined : normalizeSelector(opts.selector);
+		const fullPage = selector !== undefined ? false : (opts.fullPage ?? false);
 		let buffer: Buffer;
-		if (opts.selector) {
-			const handle = (await untilAborted(signal, () =>
-				page.$(normalizeSelector(opts.selector!)),
-			)) as ElementHandle | null;
+		if (selector !== undefined) {
+			const handle = (await untilAborted(signal, () => page.$(selector))) as ElementHandle | null;
 			if (!handle) throw new ToolError("Screenshot selector did not resolve to an element");
 			try {
 				buffer = (await untilAborted(signal, () => handle.screenshot({ type: "png" }))) as Buffer;

package/src/tools/descriptors.ts

@@ -452,7 +452,12 @@ const names: Array<[name: string, label: string, summary: string | undefined, lo
 		["todo_write", "Todo Write", "Write a structured todo list", "discoverable"],
 		["web_search", "Web Search", "Search the web for up-to-date information", "discoverable"],
 		["search_tool_bm25", "SearchTools", undefined, "essential"],
-		["skill_discovery", "SkillDiscovery", "Discover project and user runtime skills by thin metadata", "essential"],
+		[
+			"skill_discovery",
+			"SkillDiscovery",
+			"Discover bundled GJC workflow, project, and user runtime skills by thin metadata",
+			"essential",
+		],
 		["telegram_send", "TelegramSend", "Send a workspace file to Telegram", "discoverable"],
 		["write", "Write", "Write content to a file", "discoverable"],
 		["skill", "Skill", "Chain into another available skill", "essential"],

package/src/tools/fetch.ts

@@ -764,7 +764,9 @@ async function renderUrl(
 				let convertedText: string | null = null;
 				const converted = await convertWithMarkit(binary.buffer, conversionExtension, timeout, signal);
 				if (converted.ok) {
-					if (converted.content.trim().length > 50) {
+					// See the non-empty conversion note near the document path
+					// below (#5433): short conversions still beat raw fallback.
+					if (converted.content.trim().length > 0) {
 						notes.push("Converted with markit");
 						convertedText = converted.content;
 					} else {
@@ -872,7 +874,10 @@ async function renderUrl(
 			const ext = getExtensionHint(finalUrl, binary.contentDisposition) || extHint;
 			const converted = await convertWithMarkit(binary.buffer, ext, timeout, signal);
 			if (converted.ok) {
-				if (converted.content.trim().length > 50) {
+				// Any non-empty markit conversion is preferable to a raw-bytes
+				// fallback (#5433): short documents like the W3C dummy.pdf
+				// ("Dummy PDF file", 14 chars) are legitimately converted text.
+				if (converted.content.trim().length > 0) {
 					notes.push("Converted with markit");
 					const output = finalizeOutput(converted.content);
 					return {

package/src/tools/image-gen.ts

@@ -31,7 +31,6 @@ import imageGenDescription from "../prompts/tools/image-gen.md" with { type: "te
 import { isPrivateOrSpecialAddress, validatePublicHttpUrl } from "../web/insane/url-guard";
 import { resolveReadPath } from "./path-utils";
 
-const DEFAULT_MODEL = "gemini-3-pro-image-preview";
 const IMAGE_TIMEOUT = 3 * 60 * 1000; // 3 minutes
 const MAX_IMAGE_SIZE = 35 * 1024 * 1024;
 const MAX_IMAGE_REDIRECTS = 5;
@@ -70,7 +69,35 @@ export function redactImageProviderText(value: unknown, activeApiKey?: string):
 			/(?:\b|["'])(?:authorization|api[-_ ]?key|access[-_ ]?token|refresh[-_ ]?token|token)["']?\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;}]+)/gi,
 			match => match.replace(/([:=]\s*).*/, `$1${REDACTED_PROVIDER_SECRET}`),
 		)
-		.replace(/\b(?:sk|rk|pk|sess|ghp|gho|github_pat|xox[baprs])-[-A-Za-z0-9._]{8,}\b/gi, REDACTED_PROVIDER_SECRET)
+		// A PEM block is redacted whole and runs before the narrower rules, which
+		// would otherwise consume its base64 body and leave a truncated key behind.
+		.replace(
+			/-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g,
+			REDACTED_PROVIDER_SECRET,
+		)
+		.replace(/\b(?:sk|rk|pk|sess|xox[baprs])-[-A-Za-z0-9._]{8,}\b/gi, REDACTED_PROVIDER_SECRET)
+		// GitHub tokens separate with `_`, not the `-` the rule above requires, so
+		// listing `ghp`/`gho`/`github_pat` there never matched one. Short tokens
+		// then fell through the 40-character catch-all below entirely.
+		.replace(/\b(?:gh[opsur]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{12,})\b/g, REDACTED_PROVIDER_SECRET)
+		// The shapes `crash/upstream/envelope.ts` classifies as credential-like.
+		// A GitLab PAT and a Hugging Face token are both shorter than the 40-character
+		// catch-all below, and Stripe separates with `_` so the `sk|rk|pk`-hyphen rule
+		// above never matched one.
+		.replace(
+			/\b(?:npm_[A-Za-z0-9]{20,}|glpat-[A-Za-z0-9_-]{20,}|(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}|hf_[A-Za-z0-9]{20,})\b/g,
+			REDACTED_PROVIDER_SECRET,
+		)
+		// AWS access-key ids are 20 characters, so the catch-all never reached them.
+		.replace(/\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/g, REDACTED_PROVIDER_SECRET)
+		// A Google API key is exactly 39 characters — one short of the catch-all.
+		.replace(/\bAIza[0-9A-Za-z_-]{35}\b/g, REDACTED_PROVIDER_SECRET)
+		// Basic-auth credentials in a URL. The scheme repetition is bounded so a
+		// long alphabetic run cannot be re-tried at every prefix (#5346).
+		.replace(
+			/(?<![A-Za-z0-9+.-])([a-z][a-z0-9+.-]{0,15}:\/\/)[^/\s:@]{1,256}:[^/\s@]{1,256}@/gi,
+			`$1${REDACTED_PROVIDER_SECRET}@`,
+		)
 		.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, REDACTED_PROVIDER_SECRET)
 		.replace(/\b[A-Za-z0-9+/_-]{40,}={0,2}\b/g, REDACTED_PROVIDER_SECRET);
 	return text.length > MAX_PROVIDER_TEXT_LENGTH ? `${text.slice(0, MAX_PROVIDER_TEXT_LENGTH - 1)}…` : text;
@@ -815,16 +842,6 @@ function extractOpenRouterImageUrls(message: OpenRouterMessage | undefined): str
 	return urls;
 }
 
-/** Provider → default image model mapping for fallbacks */
-export const IMAGE_PROVIDER_DEFAULTS: Record<string, string> = {
-	openai: "gpt-image-2",
-	alibaba: "wan2.7-image",
-	"openai-codex": "gpt-image-2",
-	antigravity: "gemini-3-pro-image",
-	gemini: "gemini-3-pro-image-preview",
-	openrouter: "google/gemini-3-pro-image-preview",
-};
-
 /**
  * Resolve the image-generation model from the `modelRoles.image` settings entry.
  * Returns the resolved Model (with provider identity) or undefined when no
@@ -847,12 +864,6 @@ export function resolveImageRoleModel(
 	return resolved.model;
 }
 
-/** Resolve the effective image model for a configured provider */
-export function resolveImageModel(provider: string, modelOverride: string | null): string {
-	if (modelOverride) return modelOverride;
-	return IMAGE_PROVIDER_DEFAULTS[provider] ?? DEFAULT_MODEL;
-}
-
 interface ParsedAntigravityCredentials {
 	accessToken: string;
 	projectId?: string;
@@ -941,10 +952,11 @@ async function findImageApiKey(
 	settings: ModelRoleSettings,
 	sessionId?: string,
 	credentialSessionId?: string,
-): Promise<ImageApiKey | null> {
+): Promise<(ImageApiKey & { model: Model }) | null> {
 	const imageModel = resolveImageRoleModel(settings, modelRegistry, { sessionId, credentialSessionId });
 	if (!imageModel) return null;
-	return resolveCredentialsForImageModel(imageModel, modelRegistry, sessionId);
+	const credentials = await resolveCredentialsForImageModel(imageModel, modelRegistry, sessionId);
+	return credentials ? { ...credentials, model: imageModel } : null;
 }
 
 /**
@@ -1492,16 +1504,7 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 			}
 
 			const provider = apiKey.provider;
-			const imageModel = apiKey.model;
-			const model = imageModel
-				? imageModel.id
-				: provider === "antigravity"
-					? resolveImageModel("antigravity", null)
-					: provider === "alibaba"
-						? resolveImageModel("alibaba", null)
-						: provider === "openrouter"
-							? resolveImageModel("openrouter", null)
-							: resolveImageModel("gemini", null);
+			const model = apiKey.model.id;
 			const resolvedModel = provider === "openrouter" ? resolveOpenRouterModel(model) : model;
 			const cwd = ctx.sessionManager.getCwd();
 
@@ -1515,10 +1518,6 @@ export const imageGenTool: CustomTool<typeof imageGenSchema, ImageGenToolDetails
 			const requestSignal = ptree.combineSignals(signal, IMAGE_TIMEOUT);
 
 			if (provider === "openai" || provider === "openai-codex") {
-				if (!apiKey.model) {
-					throw new Error("Missing active GPT model for OpenAI image generation");
-				}
-
 				const parsed = await generateOpenAIHostedImage(
 					apiKey.apiKey,
 					apiKey.model,