@gajae-code/coding-agent 0.17.1 → 0.17.2

package/src/async/job-manager.ts

@@ -569,14 +569,22 @@ export class AsyncJobManager {
 	 *  instead of the last-created process-global instance (review thread P1).
 	 *  Returns TRUE when the mapping was installed (or already held by this
 	 *  manager); returns FALSE when the endpoint id is already held by a
-	 *  FOREIGN live manager — a second top-level session constructed or
-	 *  resumed under that endpoint must then fail construction instead of
-	 *  silently replacing the first manager, which would make the first
-	 *  session's tools resolve the second manager and let same-id jobs be
-	 *  queried, registered, or cancelled across sessions (review thread P1). */
+	 *  FOREIGN manager whose authority has not fully settled — a second
+	 *  top-level session constructed or resumed under that endpoint must then
+	 *  fail construction instead of silently replacing the first manager, which
+	 *  would make the first session's tools resolve the second manager and let
+	 *  same-id jobs be queried, registered, or cancelled across sessions
+	 *  (review thread P1). */
 	static registerForEndpoint(endpointId: string, manager: AsyncJobManager): boolean {
 		const holder = AsyncJobManager.#byEndpoint.get(endpointId);
-		if (holder !== undefined && holder !== manager) return false;
+		if (manager.#disposed || manager.#registrationClosed) return false;
+		if (holder !== undefined && holder !== manager) {
+			// A manager remains the endpoint owner until all authority retained
+			// past its disposal deadline has physically settled. Logical shutdown
+			// alone must not admit a replacement while late callbacks can still run.
+			if (!holder.#disposed || !holder.#disposalSettled) return false;
+			AsyncJobManager.#byEndpoint.delete(endpointId);
+		}
 		AsyncJobManager.#byEndpoint.set(endpointId, manager);
 		return true;
 	}
@@ -586,7 +594,8 @@ export class AsyncJobManager {
 		return AsyncJobManager.#byEndpoint.get(endpointId);
 	}
 
-	static unregisterForEndpoint(endpointId: string): void {
+	static unregisterForEndpoint(endpointId: string, manager?: AsyncJobManager): void {
+		if (manager !== undefined && AsyncJobManager.#byEndpoint.get(endpointId) !== manager) return;
 		AsyncJobManager.#byEndpoint.delete(endpointId);
 	}
 
@@ -619,9 +628,13 @@ export class AsyncJobManager {
 		manager: AsyncJobManager | undefined,
 	): boolean {
 		if (!manager || predecessorEndpointId === successorEndpointId) return true;
+		if (manager.#disposed || manager.#registrationClosed) return false;
 		if (AsyncJobManager.#byEndpoint.get(predecessorEndpointId) !== manager) return true;
 		const successorOwner = AsyncJobManager.#byEndpoint.get(successorEndpointId);
-		if (successorOwner !== undefined && successorOwner !== manager) return false;
+		if (successorOwner !== undefined && successorOwner !== manager) {
+			if (!successorOwner.#disposed || !successorOwner.#disposalSettled) return false;
+			AsyncJobManager.#byEndpoint.delete(successorEndpointId);
+		}
 		AsyncJobManager.#byEndpoint.delete(predecessorEndpointId);
 		AsyncJobManager.#byEndpoint.set(successorEndpointId, manager);
 		return true;
@@ -651,6 +664,7 @@ export class AsyncJobManager {
 
 	readonly #jobs = new Map<string, AsyncJob>();
 	#retainedDisposalCompletion: Promise<void> = Promise.resolve();
+	#disposePromise: Promise<boolean> | undefined;
 	readonly #deliveries: AsyncJobDelivery[] = [];
 	readonly #inFlightDeliveries: AsyncJobDelivery[] = [];
 	readonly #suppressedDeliveries = new Set<string>();
@@ -674,6 +688,8 @@ export class AsyncJobManager {
 	readonly #maxDeadLetterOverflowOwners: number;
 	#deliveryLoop: Promise<void> | undefined;
 	#disposed = false;
+	/** Set only after all authority retained past a disposal deadline settles. */
+	#disposalSettled = false;
 	#runningOwnerCleanups = false;
 	readonly #subagentRecords = new Map<string, SubagentRecord>();
 	readonly #terminalEvents = new Map<string, TerminalEvent>();
@@ -2773,6 +2789,13 @@ export class AsyncJobManager {
 	}
 
 	async dispose(options?: { timeoutMs?: number }): Promise<boolean> {
+		if (this.#disposePromise) return this.#disposePromise;
+		const disposal = this.#disposeInternal(options);
+		this.#disposePromise = disposal;
+		return disposal;
+	}
+
+	async #disposeInternal(options?: { timeoutMs?: number }): Promise<boolean> {
 		// Close registration FIRST, then run owner cleanups, and only then mark the
 		// manager disposed. Setting #disposed before the cleanups made
 		// #ensureDeliveryLoop a no-op, so a failure an owner cleanup settled through
@@ -2865,6 +2888,13 @@ export class AsyncJobManager {
 		this.#notifyChange();
 		this.#changeListeners.clear();
 		this.#foldListeners.clear();
+		const releaseEndpointOwnership = (): void => {
+			this.#disposalSettled = true;
+			AsyncJobManager.unregisterManager(this);
+			if (AsyncJobManager.instance() === this) AsyncJobManager.setInstance(undefined);
+		};
+		if (disposalCompleted) releaseEndpointOwnership();
+		else void this.#retainedDisposalCompletion.then(releaseEndpointOwnership);
 		return disposalCompleted;
 	}
 

package/src/commands/sdk.ts

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import * as nodeFs from "node:fs";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -13,7 +14,11 @@ import { initTheme } from "../modes/theme/theme";
 import { ACP_MCP_REQUEST_TIMEOUT_MS, ACP_MCP_STARTUP_HEADROOM_MS } from "../sdk/acp/mcp";
 import { Broker } from "../sdk/broker/broker";
 import { readBrokerDiscovery } from "../sdk/broker/discovery";
-import { reconcileBrokerGenerationForStartup, withBrokerStartupLock } from "../sdk/broker/ensure";
+import {
+	emitBrokerStartupTestSignal,
+	reconcileBrokerGenerationForStartup,
+	withBrokerStartupLock,
+} from "../sdk/broker/ensure";
 import { completeBrokerProcess } from "../sdk/broker/internal";
 import {
 	type LifecycleTranscriptEvidence,
@@ -39,7 +44,7 @@ import {
 	type SdkStartupRollbackResult,
 	SdkStartupRollbackTracker,
 } from "../sdk/startup-capability";
-import { runSdkServe } from "../sdk/transport/serve-cli";
+import { runSdkServe, SdkServeError } from "../sdk/transport/serve-cli";
 import { isSessionDisposalIncompleteError } from "../session/agent-session";
 import {
 	type CapturedSessionTranscriptSnapshot,
@@ -94,6 +99,43 @@ export async function lifecycleArgs(
 export const SESSION_HOST_BROKER_ABSENCE_GRACE_MS = 10 * 60_000;
 const SESSION_HOST_BROKER_POLL_MS = 15_000;
 
+async function waitForBrokerStartupTestGate(gateFile: string): Promise<void> {
+	if (await Bun.file(gateFile).exists()) return;
+	const directory = path.dirname(gateFile);
+	const filename = path.basename(gateFile);
+	await new Promise<void>((resolve, reject) => {
+		let settled = false;
+		let watcher: nodeFs.FSWatcher | undefined;
+		const finish = (error?: unknown): void => {
+			if (settled) return;
+			settled = true;
+			watcher?.close();
+			if (error === undefined) resolve();
+			else reject(error);
+		};
+		try {
+			watcher = nodeFs.watch(directory, (_eventType, changed) => {
+				if (String(changed) !== filename) return;
+				void Bun.file(gateFile)
+					.exists()
+					.then(exists => {
+						if (exists) finish();
+					})
+					.catch(finish);
+			});
+		} catch (error) {
+			finish(error);
+			return;
+		}
+		void Bun.file(gateFile)
+			.exists()
+			.then(exists => {
+				if (exists) finish();
+			})
+			.catch(finish);
+	});
+}
+
 /**
  * Identity of the broker incarnation an observation describes, or `null` when
  * it carries no usable identity.
@@ -1115,7 +1157,29 @@ export default class Sdk extends Command {
 			return;
 		}
 		if (action === "serve") {
-			await runSdkServe(this.argv.slice(1));
+			try {
+				await runSdkServe(this.argv.slice(1));
+			} catch (error) {
+				if (!(error instanceof SdkServeError)) throw error;
+				// stdout is the frame channel in --stdio mode, so the envelope goes to
+				// stderr; returning instead of rethrowing is what keeps a session-selection
+				// failure from reaching the embedder as an uncaught exception.
+				process.stderr.write(
+					`${JSON.stringify({
+						ok: false,
+						error: {
+							code: error.code,
+							message: error.message,
+							...(error.details === undefined ? {} : { details: error.details }),
+							// A broker teardown that failed alongside the primary failure is
+							// recorded on the error; dropping it here would hide from the
+							// embedder that the session may not have been released cleanly.
+							...(error.cleanupError === undefined ? {} : { cleanupError: error.cleanupError }),
+						},
+					})}\n`,
+				);
+				process.exitCode = error.exitCode;
+			}
 			return;
 		}
 		if (action !== "broker-internal" && action !== "session-host-internal")
@@ -1128,7 +1192,7 @@ export default class Sdk extends Command {
 		const agentDir = path.resolve(internal.agentDir);
 		let broker: Broker | undefined;
 		try {
-			broker = await withBrokerStartupLock(agentDir, async deadline => {
+			const startupOperation = async (deadline: number): Promise<Broker | undefined> => {
 				const remainingMs = Math.max(1, deadline - Date.now());
 				const testWatchdogMs = Number(process.env.GJC_SDK_TEST_BROKER_STARTUP_WATCHDOG_MS ?? 0);
 				const watchdogMs =
@@ -1145,6 +1209,12 @@ export default class Sdk extends Command {
 						const stalled = Promise.withResolvers<void>();
 						await stalled.promise;
 					}
+					const startupGateFile = process.env.GJC_SDK_TEST_BROKER_STARTUP_GATE_FILE;
+					if (startupGateFile) {
+						await emitBrokerStartupTestSignal("startup-gate-waiting");
+						await waitForBrokerStartupTestGate(startupGateFile);
+						await emitBrokerStartupTestSignal("startup-gate-released");
+					}
 					const startupDelayMs = Number(process.env.GJC_SDK_TEST_BROKER_STARTUP_DELAY_MS ?? 0);
 					if (Number.isSafeInteger(startupDelayMs) && startupDelayMs > 0 && startupDelayMs <= 10_000)
 						await Bun.sleep(startupDelayMs);
@@ -1179,6 +1249,10 @@ export default class Sdk extends Command {
 				} finally {
 					clearTimeout(startupWatchdog);
 				}
+			};
+			broker = await withBrokerStartupLock(agentDir, startupOperation, {
+				onAcquired: () => void emitBrokerStartupTestSignal("fence-acquired"),
+				onContended: () => void emitBrokerStartupTestSignal("fence-contended"),
 			});
 		} catch (error) {
 			if (broker) {

package/src/config/autorouting-tier-map.ts

@@ -378,11 +378,13 @@ export const TIER_MAP_SKIP_LIST = {
 	},
 	"opencode-go/qwen3.8-flash": { rationale: "post-rebase catalog addition from dev; not yet curated" },
 	"opencode-go/qwen3.8-max": { rationale: "post-rebase catalog addition from dev; not yet curated" },
+	"opencode-go/union-alpha": { rationale: "stealth model; capability tier not yet independently reviewed" },
 	"opencode-zen/grok-4.6": { rationale: "post-rebase catalog addition from dev; not yet curated" },
 	"opencode-zen/hy3-free": { rationale: "post-rebase catalog addition from dev; not yet curated" },
 	"opencode-zen/kimi-k3": { rationale: "post-rebase catalog addition from dev; not yet curated" },
 	"opencode-zen/ling-3.0-tiny-free": { rationale: "post-rebase catalog addition from dev; not yet curated" },
 	"opencode-zen/nemotron-3.5-lightning-free": { rationale: "post-rebase catalog addition from dev; not yet curated" },
+	"opencode-zen/union-alpha": { rationale: "stealth model; capability tier not yet independently reviewed" },
 	"openrouter/anthropic/claude-fable-5:batch": { rationale: "post-rebase catalog addition from dev; not yet curated" },
 	"openrouter/anthropic/claude-haiku-4.5:batch": {
 		rationale: "post-rebase catalog addition from dev; not yet curated",

package/src/config/file-lock.ts

@@ -27,6 +27,7 @@ export interface FileLockOptions {
 	retryDelayMs?: number;
 	signal?: AbortSignal;
 	onAcquired?: () => void;
+	onContended?: () => void;
 	/** Stable host identity required to safely reclaim locks on a shared volume. */
 	ownerHostId?: string;
 	/** Previous local host identities accepted only when deciding stale-owner reclamation. */
@@ -84,7 +85,7 @@ export function isFileLockAcquireTimeout(error: unknown): error is FileLockAcqui
 }
 
 const DEFAULT_OPTIONS: Required<
-	Omit<FileLockOptions, "ownerHostId" | "previousOwnerHostIds" | "signal" | "onAcquired">
+	Omit<FileLockOptions, "ownerHostId" | "previousOwnerHostIds" | "signal" | "onAcquired" | "onContended">
 > = {
 	staleMs: 10_000,
 	retries: 50,
@@ -1363,6 +1364,28 @@ function ownerLiveness(pid: number): OwnerLiveness {
 	}
 }
 
+/**
+ * Does this owner record belong to a machine other than the acquirer's?
+ *
+ * A host-qualified record is foreign unless the acquirer can prove it is its own:
+ * either the identity matches, or it matches an identity this installation used
+ * before. An acquirer carrying no host identity can prove nothing, so every
+ * host-qualified record stays foreign to it. Foreign records fail closed — their
+ * PID values and clocks are not meaningful here, so they are neither reclaimable
+ * nor locally probeable for liveness.
+ *
+ * Shared by the reclamation verdict and the exhaustion diagnostic so the two can
+ * never disagree about whose pid a record names.
+ */
+function lockRecordIsForeignHost(
+	info: LockInfo,
+	ownerHostId: string | undefined,
+	previousOwnerHostIds: readonly string[],
+): boolean {
+	if (ownerHostId === undefined) return info.owner_host_id !== undefined;
+	return info.owner_host_id !== ownerHostId && !previousOwnerHostIds.includes(info.owner_host_id ?? "");
+}
+
 async function staleLockSnapshot(
 	lockPath: string,
 	_staleMs: number,
@@ -1402,13 +1425,7 @@ async function staleLockSnapshot(
 	// A host-qualified lock may only be reclaimed after proving that its owner is
 	// local. Foreign and malformed host-qualified records fail closed: PID values
 	// and clocks are not meaningful across hosts.
-	if (
-		ownerHostId !== undefined &&
-		info.owner_host_id !== ownerHostId &&
-		!previousOwnerHostIds.includes(info.owner_host_id ?? "")
-	)
-		return { stale: false };
-	if (ownerHostId === undefined && info.owner_host_id !== undefined) return { stale: false };
+	if (lockRecordIsForeignHost(info, ownerHostId, previousOwnerHostIds)) return { stale: false };
 	if (ownerIncarnationChanged(info, startTimeCache)) {
 		if (!judgedIdentity) return { stale: false };
 		let currentIdentity: GenericFileLockDirIdentity | null;
@@ -1962,14 +1979,22 @@ async function lockHolderDescription(
 			info = bytes === null ? null : parseLockInfoBytes(bytes);
 		}
 		if (info) {
-			// A lock record carrying a foreign owner_host_id belongs to another
+			// A lock record carrying a FOREIGN owner_host_id belongs to another
 			// machine (shared-volume topic registry): its pid is meaningful only
 			// on that host, so probing the same numeric pid here could mislabel a
 			// coincident local process as the holder. Report the owner host with
-			// unknown liveness instead.
-			if (info.owner_host_id !== undefined) {
+			// unknown liveness instead. The same predicate that decides whether
+			// the record is reclaimable decides whether its pid is probeable, so a
+			// holder this acquirer *may* reclaim is never described as opaque.
+			if (lockRecordIsForeignHost(info, ownerHostId, previousOwnerHostIds)) {
+				// An unqualified record carries no host provenance at all. A host-aware
+				// acquirer still fails closed on it — its pid is never probed and its
+				// lock is never reclaimed — but the diagnostic must say the provenance
+				// is missing instead of naming a host it does not have.
+				const provenance =
+					info.owner_host_id === undefined ? "on an unrecorded host" : `on host ${info.owner_host_id}`;
 				return (
-					`held by pid ${info.pid} on host ${info.owner_host_id} (liveness unknown from this host)` +
+					`held by pid ${info.pid} ${provenance} (liveness unknown from this host)` +
 					` since ${new Date(info.timestamp).toISOString()}`
 				);
 			}
@@ -1977,13 +2002,18 @@ async function lockHolderDescription(
 			// record carries a start_time, the start-time identity match) so a dead
 			// holder whose pid was already reused is not mislabeled "(live)".
 			const alive = ownerIsAlive(info);
+			const liveness = alive
+				? "live"
+				: ownerLiveness(info.pid) === "dead"
+					? "dead but not reaped"
+					: "liveness unknown";
 			return (
 				`held by pid ${info.pid}` +
-				(alive
-					? " (live)"
-					: ownerLiveness(info.pid) === "dead"
-						? " (dead but not reaped)"
-						: " (liveness unknown)") +
+				// Keep the host on a host-qualified local record: on a shared volume the
+				// same pathname is contended from several hosts, so naming the one whose
+				// pid space this verdict came from is what makes it actionable.
+				(info.owner_host_id === undefined ? "" : " on this host") +
+				` (${liveness})` +
 				` since ${new Date(info.timestamp).toISOString()}`
 			);
 		}
@@ -2022,6 +2052,7 @@ export async function acquireFileLock(filePath: string, options: FileLockOptions
 	}
 	const ownerToken = crypto.randomUUID();
 	const contentionStartTimes = new Map<string, string | null>();
+	let contentionObserved = false;
 	let staleRemovalFailure: RecordedStaleRemovalFailure | undefined;
 	for (let attempt = 0; attempt < opts.retries; attempt++) {
 		if (opts.signal?.aborted) throw opts.signal.reason ?? new Error("File lock acquisition aborted");
@@ -2052,6 +2083,10 @@ export async function acquireFileLock(filePath: string, options: FileLockOptions
 			localLockStates.set(localKey, { owner: result, status: "held" });
 			return () => releaseLock(lockPath, result, localKey);
 		}
+		if (!contentionObserved) {
+			contentionObserved = true;
+			opts.onContended?.();
+		}
 		const pendingKey = await pendingLocalReleaseKey(lockPath, localKey);
 		const localState = localLockStates.get(pendingKey ?? localKey);
 		if (pendingKey !== undefined && localState?.status !== "held" && localState?.owner.owner_token !== undefined) {

package/src/config/model-profile-activation.ts

@@ -1,5 +1,5 @@
 import { ThinkingLevel } from "@gajae-code/agent-core";
-import type { Api, Model } from "@gajae-code/ai/core";
+import { type Api, isKnownProvider, type Model } from "@gajae-code/ai/core";
 import { logger } from "@gajae-code/utils";
 import type { AgentSession, DefaultFallbackRuntimeState } from "../session/agent-session";
 import { clampExplicitThinkingLevelForModel, formatClampedModelSelector } from "../thinking";
@@ -105,6 +105,7 @@ export interface PrepareModelProfileActivationOptions {
 				| "getSessionCanonicalVariant"
 				| "restoreSessionCanonicalVariant"
 				| "getConfiguredProviderIds"
+				| "isKnownProvider"
 			>
 		> & {
 			getError?: ModelRegistry["getError"];
@@ -449,7 +450,7 @@ export function materializeActiveModelProfileAssignments(options: MaterializeMod
 }
 
 export class ModelProfileCredentialError extends Error {
-	readonly code = "authentication_failed";
+	readonly code: string = "authentication_failed";
 	readonly profileLabel: string;
 	readonly providers: readonly string[];
 	readonly role: string | undefined;
@@ -466,6 +467,28 @@ export class ModelProfileCredentialError extends Error {
 export function formatModelProfileCredentialError(profileLabel: string, providers: readonly string[]): string {
 	return `Model profile "${profileLabel}" requires credentials for: ${providers.join(", ")}. Run /login and configure the missing provider(s), then retry.`;
 }
+export function formatModelProfileUnknownProviderError(profileLabel: string, providers: readonly string[]): string {
+	return `Model profile "${profileLabel}" requires provider(s) this build does not know: ${providers.join(", ")}. The profile likely targets a newer or custom build; declare the provider(s) in models.yml or use a build that ships them.`;
+}
+
+/**
+ * A required profile provider that this build cannot know: it is neither a
+ * built-in provider id nor declared in models.yml. That is a build/config
+ * mismatch (for example a profile authored on a newer or custom build), not a
+ * credential gap, so the diagnosis must not send the user to /login.
+ *
+ * Extends {@link ModelProfileCredentialError} so existing startup recovery
+ * (interactive toast-and-continue) keeps working with the sharper message.
+ */
+export class ModelProfileUnknownProviderError extends ModelProfileCredentialError {
+	readonly code = "unknown_provider";
+
+	constructor(profileLabel: string, providers: readonly string[], role?: string) {
+		super(profileLabel, providers, role);
+		this.name = "ModelProfileUnknownProviderError";
+		this.message = formatModelProfileUnknownProviderError(profileLabel, providers);
+	}
+}
 
 /**
  * Rewrite a selector only within the selector provider's own alternative group.
@@ -534,6 +557,14 @@ function rewriteBindingsProviders(
 		),
 	};
 }
+export function isModelProfileProxyConfigured(
+	provider: string,
+	configuredProviders: readonly string[] | undefined,
+	credentialless: boolean,
+): boolean {
+	return configuredProviders?.includes(provider) === true || (provider === "opencodex" && credentialless);
+}
+
 /**
  * Resolve the explicitly configured OpenAI-compatible proxy provider id for a
  * preset. Returns undefined when unset or empty. Passwords/labels are never
@@ -620,9 +651,13 @@ export function rewriteSelectorForProxy(
 	const baseSelector = suffix.selector;
 	const slash = baseSelector.indexOf("/");
 	const proxyModels = allModels.filter(model => model.provider === proxyProvider);
+	const matchingProxyModels = (id: string): Model<Api>[] => {
+		const publicMatches = proxyModels.filter(model => model.id === id);
+		return publicMatches.length > 0 ? publicMatches : proxyModels.filter(model => model.wireModelId === id);
+	};
 	if (slash < 0) {
 		if (proxyMode === "fallback") return selector;
-		const exactMatches = proxyModels.filter(model => model.id === baseSelector);
+		const exactMatches = matchingProxyModels(baseSelector);
 		const finalSegmentMatches = proxyModels.filter(model => model.id.split("/").at(-1) === baseSelector);
 		const matches = exactMatches.length > 0 ? exactMatches : finalSegmentMatches;
 		if (matches.length !== 1) {
@@ -640,8 +675,8 @@ export function rewriteSelectorForProxy(
 		throw new Error(`Configured proxy "${proxyProvider}" cannot route its own direct selector "${baseSelector}"`);
 	}
 	const directModelId = baseSelector.substring(slash + 1);
-	const exactMatches = proxyModels.filter(model => model.id === `${directProvider}/${directModelId}`);
-	const flatMatches = proxyModels.filter(model => model.id === directModelId);
+	const exactMatches = matchingProxyModels(`${directProvider}/${directModelId}`);
+	const flatMatches = matchingProxyModels(directModelId);
 	const matches = exactMatches.length > 0 ? exactMatches : flatMatches;
 	if (matches.length === 0) {
 		throw new Error(`Configured proxy "${proxyProvider}" does not expose a model for "${baseSelector}"`);
@@ -957,6 +992,33 @@ export async function prepareModelProfileActivation(
 			...alternativeSet,
 			...deriveModelProfileMappedProviders(profile),
 		]);
+		// A required provider this build cannot know is a build/config mismatch,
+		// not a credential gap: diagnose it before any auth probing so the user
+		// is never sent to /login for a provider this binary cannot serve (for
+		// example a models.yml profile authored on a newer or custom build). A
+		// registry without provider visibility keeps the legacy
+		// credential diagnosis.
+		const configuredProviderIds = options.modelRegistry.getConfiguredProviderIds?.();
+		if (configuredProviderIds !== undefined || options.modelRegistry.isKnownProvider !== undefined) {
+			const isProviderKnown = (provider: string): boolean =>
+				(options.modelRegistry.isKnownProvider?.(provider) ?? false) ||
+				isKnownProvider(provider) ||
+				configuredProviderIds?.includes(provider) === true;
+			const unknownRequiredProviders = new Set<string>();
+			for (const provider of requiredProviders) {
+				if (!alternativeSet.has(provider) && !isProviderKnown(provider)) unknownRequiredProviders.add(provider);
+			}
+			for (const group of alternativeGroups) {
+				if (group.some(isProviderKnown)) continue;
+				for (const provider of group) {
+					if (!isProviderKnown(provider)) unknownRequiredProviders.add(provider);
+				}
+			}
+			const unknownProviderIds = [...unknownRequiredProviders].sort();
+			if (unknownProviderIds.length > 0) {
+				throw new ModelProfileUnknownProviderError(profileLabel, unknownProviderIds);
+			}
+		}
 
 		const missingProviders: string[] = [];
 		const authenticatedProviders: string[] = [];
@@ -995,18 +1057,18 @@ export async function prepareModelProfileActivation(
 		if (proxyMode === "always" && proxyProvider === undefined) {
 			throw new Error('modelProfile.proxyMode "always" requires modelProfile.proxyProvider');
 		}
+		const proxyApiKey =
+			proxyProvider === undefined
+				? undefined
+				: await options.modelRegistry.getApiKeyForProvider(proxyProvider, credentialSessionId);
 		if (proxyProvider !== undefined) {
 			const configuredProxyProviders = options.modelRegistry.getConfiguredProviderIds?.();
-			if (!configuredProxyProviders?.includes(proxyProvider)) {
+			if (!isModelProfileProxyConfigured(proxyProvider, configuredProxyProviders, proxyApiKey === kNoAuth)) {
 				throw new Error(
 					`modelProfile.proxyProvider "${proxyProvider}" is not configured. Configure it with \`gjc setup provider\` before activating a preset.`,
 				);
 			}
 		}
-		const proxyApiKey =
-			proxyProvider === undefined
-				? undefined
-				: await options.modelRegistry.getApiKeyForProvider(proxyProvider, credentialSessionId);
 		const proxyAuthenticated =
 			proxyProvider !== undefined &&
 			proxyApiKey !== undefined &&

package/src/config/model-registry.ts

@@ -18,6 +18,7 @@ import {
 	getBundledModels,
 	getBundledProviders,
 	getEnvApiKey,
+	getMiniMaxThinkingMode,
 	googleAntigravityModelManagerOptions,
 	googleGeminiCliModelManagerOptions,
 	isCodexGpt56Tier,
@@ -280,6 +281,7 @@ export const GJC_MODEL_ASSIGNMENT_TARGETS: Record<GjcModelAssignmentTargetId, Gj
 
 export function requiresExplicitThinkingChoice(model: Model, role: GjcModelAssignmentTargetId | null): boolean {
 	if (!modelSupportsReasoningControl(model)) return false;
+	if (getMiniMaxThinkingMode(model) === "toggle") return true;
 	if (model.provider === "openai" || model.provider === "openai-codex" || isDirectXaiReasoningEffortModel(model))
 		return true;
 	if (role === null) return false;
@@ -4770,6 +4772,25 @@ export class ModelRegistry {
 		return [...this.#configuredProviderIds];
 	}
 
+	/**
+	 * Whether this registry can serve a provider id from any active source.
+	 *
+	 * Built-in providers are backed by the bundled AI catalog, configured
+	 * providers come from models.yml, and extension registrations are retained
+	 * in the runtime provider stores below. Runtime model/override state is
+	 * included for direct registrations that do not have an extension source id.
+	 */
+	isKnownProvider(provider: string): boolean {
+		return (
+			isKnownProvider(provider) ||
+			this.#configuredProviderIds.has(provider) ||
+			this.#runtimeProviderSourceByName.has(provider) ||
+			this.#runtimeModelOverlays.some(model => model.provider === provider) ||
+			this.#runtimeProviderApiKeys.has(provider) ||
+			this.#runtimeProviderOverrides.has(provider)
+		);
+	}
+
 	#isModelAvailable(model: Model<Api>, disabledProviders?: ReadonlySet<string>): boolean {
 		const disabled = disabledProviders ?? getDisabledProviderIdsFromSettings(this.#settings);
 		return (

package/src/coordinator-mcp/server.ts

@@ -307,6 +307,9 @@ interface CoordinatorServices {
 	canonicalizePath?: (value: string) => Promise<string>;
 	codexTransportFactory?: CodexTransportFactory;
 	eventWebhookDelivery?: WebhookDelivery;
+	/** Observable transitions for consumers coordinating with the filesystem-backed event wait. */
+	onCoordinatorEventWatchReady?: () => void;
+	onCoordinatorEventWake?: () => void;
 	/** Test barrier invoked after an accepted prompt receipt is durable and before turn finalization. */
 	afterPromptReceiptPersisted?: (sessionId: string) => void | Promise<void>;
 	/** Test barrier invoked after an answer dispatch is claimed and before its final admission check. */
@@ -3188,18 +3191,24 @@ function waitForTurnStateChange(namespaceDir: string, turn: TurnRecord, timeoutM
 	return deferred.promise;
 }
 
-async function waitForCoordinatorEvents(namespaceDir: string, timeoutMs: number): Promise<void> {
+async function waitForCoordinatorEvents(
+	namespaceDir: string,
+	timeoutMs: number,
+	onWatchReady?: () => void,
+	onWake?: () => void,
+): Promise<void> {
 	const deferred = Promise.withResolvers<void>();
 	const watchers: nodeFs.FSWatcher[] = [];
 	let settled = false;
-	const finish = () => {
+	const finish = (woke: boolean) => {
 		if (settled) return;
 		settled = true;
 		for (const watcher of watchers) watcher.close();
 		clearTimeout(timer);
+		if (woke) onWake?.();
 		deferred.resolve();
 	};
-	const timer = setTimeout(finish, Math.max(timeoutMs, 0));
+	const timer = setTimeout(() => finish(false), Math.max(timeoutMs, 0));
 	timer.unref?.();
 	const eventDir = eventsDir(namespaceDir);
 	const watchedDirs = [
@@ -3213,16 +3222,17 @@ async function waitForCoordinatorEvents(namespaceDir: string, timeoutMs: number)
 		try {
 			const watcher = nodeFs.watch(dir, (_eventType, filename) => {
 				if (dir === eventDir) {
-					if (filename === "event-journal.jsonl" || filename === "latest-seq.json") finish();
+					if (filename === "event-journal.jsonl" || filename === "latest-seq.json") finish(true);
 					return;
 				}
-				if (typeof filename === "string" && filename.endsWith(".json")) finish();
+				if (typeof filename === "string" && filename.endsWith(".json")) finish(true);
 			});
 			watchers.push(watcher);
 		} catch {
 			// Directory may not be watchable on this platform; the timeout remains a bounded fallback.
 		}
 	}
+	onWatchReady?.();
 	return deferred.promise;
 }
 
@@ -8645,7 +8655,12 @@ export function createCoordinatorMcpServer(options: CoordinatorMcpServerOptions
 				if (matched.length === 0 && timeoutMs > 0) {
 					const deadline = absoluteDeadline;
 					while (matched.length === 0 && Date.now() < deadline && !watchController.signal.aborted) {
-						await waitForCoordinatorEvents(namespaceDir, Math.min(50, Math.max(1, deadline - Date.now())));
+						await waitForCoordinatorEvents(
+							namespaceDir,
+							Math.min(50, Math.max(1, deadline - Date.now())),
+							services.onCoordinatorEventWatchReady,
+							services.onCoordinatorEventWake,
+						);
 						if (Date.now() >= deadline || watchController.signal.aborted) break;
 						try {
 							await exportRetainedDeliveries(32, watchController.signal);