@gajae-code/coding-agent 0.17.1 → 0.17.2

package/src/sdk/transport/serve-cli.ts

@@ -1,6 +1,7 @@
 import { getAgentDir } from "@gajae-code/utils";
 import { CliParseError } from "@gajae-code/utils/cli";
-import { readSdkBrokerDiscovery, SdkClient, SdkClientError } from "../client";
+import type { BrokerDiscovery } from "../broker/discovery";
+import { readSdkBrokerDiscovery, SdkClient, SdkClientError, SdkDiscoveryError } from "../client";
 import { SessionListTraversalError, sessionListPageFromResponse, traverseSessionList } from "../session-list";
 import { DEFAULT_PENDING_CEILING_BYTES, MIN_PENDING_CEILING_BYTES, startSocketServe, startStdioServe } from "./index";
 
@@ -16,6 +17,88 @@ function usageError(message: string): never {
 	throw new CliParseError(`gjc sdk serve: ${message}`);
 }
 
+/**
+ * A `gjc sdk serve` operational failure with a stable machine-readable code and a
+ * documented exit code, mirroring `SdkSessionCliError`. Usage errors keep their own
+ * `CliParseError` path; this type covers only failures an embedder must branch on.
+ */
+export class SdkServeError extends Error {
+	/**
+	 * Diagnostics for a broker-teardown failure that happened alongside this primary
+	 * failure. It rides beside `details` rather than inside it because `details`
+	 * carries the broker's own error payload verbatim and embedders already read it.
+	 */
+	cleanupError?: { code: string; message: string };
+
+	constructor(
+		readonly code: string,
+		message: string,
+		readonly exitCode: 1,
+		readonly details?: unknown,
+	) {
+		super(message);
+		this.name = "SdkServeError";
+	}
+}
+
+/** Normalizes a serve-path failure into a typed error so nothing escapes untyped. */
+function toServeError(error: unknown): Error {
+	if (error instanceof SdkServeError || error instanceof CliParseError) return error;
+	if (error instanceof SdkClientError) return new SdkServeError(error.code, error.message, 1, error.details);
+	return new SdkServeError("serve_failed", error instanceof Error ? error.message : "SDK serve failed.", 1);
+}
+
+/**
+ * Reads the broker discovery record so an unreadable one — a permission or file-kind
+ * failure, or a record from a newer state version — fails as a typed serve error
+ * instead of escaping the command boundary untyped. A missing record still reads as
+ * `null`, which the caller reports as `broker_unavailable`.
+ */
+async function readServeDiscovery(agentDir: string): Promise<BrokerDiscovery | null> {
+	try {
+		return await readSdkBrokerDiscovery(agentDir);
+	} catch (error) {
+		// The path is a local file inside the agent dir, already named by this
+		// command's other diagnostics; the broker token is never surfaced.
+		const details =
+			error instanceof SdkDiscoveryError
+				? { code: error.code, message: error.message, path: error.path }
+				: { code: "discovery_error", message: error instanceof Error ? error.message : String(error) };
+		throw new SdkServeError("broker_discovery_unreadable", "SDK broker discovery record is unreadable", 1, details);
+	}
+}
+
+/** Reduces a teardown failure to the code and message an embedder can branch on. */
+function cleanupDiagnostics(error: Error): { code: string; message: string } {
+	return { code: error instanceof SdkClientError ? error.code : "serve_cleanup_failed", message: error.message };
+}
+
+/** Runs broker teardown to completion, handing back its failure instead of throwing it. */
+async function brokerCloseFailure(broker: SdkClient): Promise<Error | undefined> {
+	try {
+		await broker.close();
+		return undefined;
+	} catch (error) {
+		return error instanceof Error ? error : new Error(String(error));
+	}
+}
+
+/**
+ * Combines the serve body's failure with the broker-teardown failure. The primary
+ * failure always wins — a rejected teardown only ever rides along as diagnostics, it
+ * never replaces the error an embedder branches on — and a teardown that fails on its
+ * own still leaves typed. Exported for tests.
+ */
+export function resolveServeOutcome(primary: Error | undefined, cleanup: Error | undefined): Error | undefined {
+	if (primary) {
+		if (cleanup && primary instanceof SdkServeError) primary.cleanupError = cleanupDiagnostics(cleanup);
+		return primary;
+	}
+	if (!cleanup) return undefined;
+	const diagnostics = cleanupDiagnostics(cleanup);
+	return new SdkServeError("serve_cleanup_failed", `SDK broker cleanup failed: ${cleanup.message}`, 1, diagnostics);
+}
+
 function readFlagValue(argv: string[], index: number, flag: string): string {
 	const value = argv[index + 1];
 	if (value === undefined || value.startsWith("-")) usageError(`${flag} requires a value`);
@@ -113,14 +196,15 @@ export async function listBrokerSessions(broker: SdkClient, explicitSessionId?:
 export function selectBrokerSession(sessions: BrokerSessionRow[], explicitSessionId: string | undefined): string {
 	if (explicitSessionId !== undefined) {
 		const row = sessions.find(session => session.sessionId === explicitSessionId);
-		if (!row) throw new Error(`not_found: session ${explicitSessionId} is not indexed by the broker`);
-		if (row.ambiguous) throw new Error("ambiguous_session: session id maps to more than one state root");
-		if (!row.live) throw new Error(`endpoint_stale: session ${explicitSessionId} endpoint is not live`);
+		if (!row) throw new SdkServeError("not_found", `session ${explicitSessionId} is not indexed by the broker`, 1);
+		if (row.ambiguous) throw new SdkServeError("ambiguous_session", "session id maps to more than one state root", 1);
+		if (!row.live) throw new SdkServeError("endpoint_stale", `session ${explicitSessionId} endpoint is not live`, 1);
 		return row.sessionId;
 	}
 	const live = sessions.filter(session => session.live && !session.ambiguous);
-	if (live.length === 0) throw new Error("no_live_endpoint: no live session endpoint");
-	if (live.length > 1) throw new Error("multiple_live_endpoints: more than one live session; specify --session <id>");
+	if (live.length === 0) throw new SdkServeError("no_live_endpoint", "no live session endpoint", 1);
+	if (live.length > 1)
+		throw new SdkServeError("multiple_live_endpoints", "more than one live session; specify --session <id>", 1);
 	return live[0]!.sessionId;
 }
 
@@ -133,25 +217,29 @@ export function selectBrokerSession(sessions: BrokerSessionRow[], explicitSessio
 export async function runSdkServe(argv: string[]): Promise<void> {
 	const parsed = parseServeArguments(argv);
 	if (parsed.mode.kind === "socket" && process.platform === "win32")
-		throw new Error("unsupported_platform: --socket is unavailable on Windows.");
+		throw new SdkServeError("unsupported_platform", "--socket is unavailable on Windows.", 1);
 	const pendingCeilingBytes = resolveServePendingCeiling(
 		parsed.pendingCeiling,
 		process.env.GJC_SDK_SERVE_PENDING_CEILING_BYTES,
 	);
-	const discovery = await readSdkBrokerDiscovery(getAgentDir());
-	if (!discovery) throw new Error("broker_unavailable: SDK broker is not running");
+	const discovery = await readServeDiscovery(getAgentDir());
+	if (!discovery) throw new SdkServeError("broker_unavailable", "SDK broker is not running", 1);
 	let broker: SdkClient;
 	try {
 		broker = await SdkClient.connect(discovery.url, discovery.token);
 	} catch {
-		throw new Error("broker_unavailable: SDK broker is not reachable");
+		throw new SdkServeError("broker_unavailable", "SDK broker is not reachable", 1);
 	}
+	let primary: Error | undefined;
 	try {
 		const sessionId = selectBrokerSession(await listBrokerSessions(broker, parsed.sessionId), parsed.sessionId);
 		const endpoint = brokerResult(await broker.global("session.get_endpoint", { sessionId }));
 		const url = typeof endpoint.url === "string" && endpoint.url ? endpoint.url : undefined;
-		const token = typeof endpoint.token === "string" ? endpoint.token : "";
-		if (!url) throw new Error("unavailable: broker returned an invalid endpoint record");
+		const token = typeof endpoint.token === "string" && endpoint.token ? endpoint.token : undefined;
+		// An empty credential has to die here rather than at the transport: the relay
+		// writes it straight into the upstream URL, where it resurfaces as a generic
+		// connection failure and this stable malformed-endpoint code is lost.
+		if (!url || !token) throw new SdkServeError("unavailable", "broker returned an invalid endpoint record", 1);
 		const options = { url, token, pendingCeilingBytes };
 		const handle =
 			parsed.mode.kind === "stdio"
@@ -169,8 +257,10 @@ export async function runSdkServe(argv: string[]): Promise<void> {
 			process.removeListener("SIGTERM", stop);
 		}
 	} catch (error) {
-		throw error instanceof SdkClientError ? new Error(`${error.code}: ${error.message}`) : error;
-	} finally {
-		await broker.close();
+		primary = toServeError(error);
 	}
+	// Teardown always runs, but never through a `finally` throw: a rejected
+	// `broker.close()` there would replace the typed failure with its own.
+	const failure = resolveServeOutcome(primary, await brokerCloseFailure(broker));
+	if (failure) throw failure;
 }

package/src/session-import/codex.ts

@@ -25,8 +25,18 @@ const MAX_SESSION_INDEX_LINE_BYTES = 64 * 1024;
 const MAX_SESSION_TITLE_CHARACTERS = 200;
 const SENSITIVE_KEY = /(?:api[-_]?key|authorization|cookie|credential|password|secret|token)/iu;
 const CODEX_SESSION_ID = /^[A-Za-z0-9-]{1,128}$/u;
+// Kept in step with the shape catalogue the sibling importer scrubber carries
+// (`./redact.ts`). Both read the same class of external transcript, so a shape
+// either importer recognizes has to be recognized by the other.
+// Stripe restricted keys use `rk_`, which no other alternative reaches: the
+// generic `sk[-_]` branch covers `sk_live_`/`sk_test_` only because they share
+// the `sk` prefix. The sibling lists `(?:sk|rk)_(?:live|test)_` explicitly.
 const SECRET_VALUE =
-	/(?:Bearer\s+[A-Za-z0-9._~+/=-]{8,}|\b(?:sk[-_]|ghp_|github_pat_)[A-Za-z0-9_-]{12,}|\bAKIA[A-Z0-9]{16}\b)/giu;
+	/(?:Bearer\s+[A-Za-z0-9._~+/=-]{8,}|\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b|\b(?:sk[-_]|gh[opsur]_|github_pat_)[A-Za-z0-9_-]{12,}|\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b|\bAIza[0-9A-Za-z_-]{35}\b|\bxox[baprs]-[A-Za-z0-9-]{10,}|\bnpm_[A-Za-z0-9]{20,}\b|\bglpat-[A-Za-z0-9_-]{20,}|\bhf_[A-Za-z0-9]{20,}\b)/giu;
+// Cheap pre-check that gates the scan above. It must stay a superset of
+// SECRET_VALUE's prefixes or a widened pattern would never run.
+const SECRET_VALUE_HINT =
+	/(?:Bearer\s|sk[-_]|rk_(?:live|test)_|gh[opsur]_|github_pat_|AKIA|ASIA|ABIA|ACCA|AIza|xox[baprs]-|npm_|glpat-|hf_)/iu;
 const JWT_VALUE = /\b[A-Za-z0-9_-]{8,2048}\.[A-Za-z0-9_-]{8,8192}\.[A-Za-z0-9_-]{8,2048}\b/gu;
 const SECRET_ASSIGNMENT =
 	/(\b(?:password|passwd|secret|token|api[-_]?key|access[-_]?key)\b\s*[:=]\s*)(?:"[^"\r\n]{4,4096}"|'[^'\r\n]{4,4096}'|[^\s,;]{4,4096})/giu;
@@ -181,8 +191,7 @@ export function sanitizeImportedString(value: string): { value: string; redacted
 			return `${prefix}${scheme ? `${scheme} ${REDACTED_CREDENTIAL}` : REDACTED_CREDENTIAL}`;
 		});
 	}
-	if (/(?:Bearer\s|(?:sk[-_]|ghp_|github_pat_)|AKIA[A-Z0-9]{16})/iu.test(next))
-		next = replace(next, SECRET_VALUE, "[redacted-secret]");
+	if (SECRET_VALUE_HINT.test(next)) next = replace(next, SECRET_VALUE, "[redacted-secret]");
 	if (next.includes(".")) next = replace(next, JWT_VALUE, "[redacted-secret]");
 	if (/(?:password|passwd|secret|token|api[-_]?key|access[-_]?key)\s*[:=]/iu.test(next)) {
 		next = next.replace(SECRET_ASSIGNMENT, (_match, prefix: string) => {

package/src/thinking.ts

@@ -1,8 +1,27 @@
 import { type ResolvedThinkingLevel, ThinkingLevel } from "@gajae-code/agent-core/thinking";
-import { clampThinkingLevelForModel, type Effort, THINKING_EFFORTS } from "@gajae-code/ai/model-thinking";
+import {
+	clampThinkingLevelForModel,
+	type Effort,
+	getMiniMaxThinkingMode,
+	THINKING_EFFORTS,
+} from "@gajae-code/ai/model-thinking";
 import type { Model } from "@gajae-code/ai/types";
+import { getThinkingLevelMetadata as getLevelMetadata, type ThinkingLevelMetadata } from "./thinking-metadata";
 
-export { getThinkingLevelMetadata, type ThinkingLevelMetadata } from "./thinking-metadata";
+export type { ThinkingLevelMetadata } from "./thinking-metadata";
+
+export function getThinkingLevelMetadata(level: ThinkingLevel, model?: Model): ThinkingLevelMetadata {
+	const mode = model && getMiniMaxThinkingMode(model);
+	if (mode === "always-on") {
+		return { value: level, label: "always on", description: "Reasoning is always on; effort control is unsupported" };
+	}
+	if (mode === "toggle" && level !== ThinkingLevel.Inherit) {
+		return level === ThinkingLevel.Off
+			? { value: level, label: "off", description: "Disable thinking (disabled)" }
+			: { value: level, label: "on", description: "Enable thinking (adaptive); no effort or token budget" };
+	}
+	return getLevelMetadata(level);
+}
 
 const THINKING_LEVELS = new Set<string>([ThinkingLevel.Inherit, ThinkingLevel.Off, ...THINKING_EFFORTS]);
 const EFFORT_LEVELS = new Set<string>(THINKING_EFFORTS);

package/src/utils/mupdf-wasm-embedded.ts

@@ -0,0 +1,3 @@
+import mupdfWasmPath from "../../../../node_modules/mupdf/dist/mupdf-wasm.wasm" with { type: "file" };
+
+export default mupdfWasmPath;

package/src/utils/mupdf-wasm.ts

@@ -14,13 +14,35 @@
  * read the wasm from the bunfs directly — no disk sidecar needed.
  *
  * This must run before the first `import("mupdf")` anywhere in the process.
+ *
+ * The embedded asset lives behind a separate module (#5663) so that an
+ * npm-installed source tree never resolves the monorepo-only
+ * `node_modules/mupdf/...` specifier at import time. That module is pulled in
+ * with a synchronous `require`, NOT a top-level `await import(...)`: a
+ * top-level await here makes this module async, and bun 1.4.0 fails to
+ * propagate that async-ness through the `model-registry` <-> `model-resolver`
+ * import cycle. The resulting bundle emits a non-async `__esm(() => { ...
+ * await init_model_registry(); ... })` wrapper, so every compiled binary died
+ * at parse time with `SyntaxError: Unexpected identifier
+ * 'init_model_registry'` (#5674). Keep this resolution synchronous.
  */
-import mupdfWasmPath from "../../../../node_modules/mupdf/dist/mupdf-wasm.wasm" with { type: "file" };
+import { isCompiledBinary } from "@gajae-code/utils/env";
 
 const MODULE_CONFIG_KEY = "$libmupdf_wasm_Module";
 
+function loadEmbeddedMupdfWasmPath(): string | undefined {
+	if (!isCompiledBinary()) return undefined;
+	// Only reached inside a compiled binary, where the embedded module — and
+	// therefore the bunfs asset it points at — is always bundled in.
+	const embedded = require("./mupdf-wasm-embedded") as { default?: unknown };
+	const embeddedPath = embedded.default;
+	return typeof embeddedPath === "string" ? embeddedPath : undefined;
+}
+
+const mupdfWasmPath = loadEmbeddedMupdfWasmPath();
+
 export function ensureMupdfWasmResolution(): void {
 	const globalScope = globalThis as typeof globalThis & Record<string, unknown>;
-	if (globalScope[MODULE_CONFIG_KEY] !== undefined) return;
+	if (globalScope[MODULE_CONFIG_KEY] !== undefined || mupdfWasmPath === undefined) return;
 	globalScope[MODULE_CONFIG_KEY] = { locateFile: () => String(mupdfWasmPath) };
 }