@gajae-code/coding-agent 0.17.2 → 0.17.4

package/src/internal-urls/embedded-protocol.ts

@@ -0,0 +1,83 @@
+/**
+ * Protocol handler for `embedded:` URLs.
+ *
+ * Bundled GJC skills and skill fragments have no filesystem home: the skill
+ * tool, skill discovery, and the skill registry all report the stable
+ * identifier `embedded:gjc/<catalog relative path>` (for example
+ * `embedded:gjc/skills/ultragoal/SKILL.md`). This handler resolves exactly
+ * those identifiers back to the bundled catalog content so the path a tool
+ * prints is a path `read` can open.
+ *
+ * URL forms (the `embedded:` and `embedded://` spellings are equivalent):
+ * - `embedded:gjc/skills/<name>/SKILL.md` — bundled skill body
+ * - `embedded:gjc/skills/<name>` — skill baseDir, resolves to its SKILL.md
+ * - `embedded:gjc/skill-fragments/<parent>/<fragment>.md` — bundled fragment
+ */
+import { BUNDLED_GJC_SKILL_CATALOG, type BundledGjcSkillCatalogEntry } from "../defaults/gjc-skills.generated";
+import type { InternalResource, InternalUrl, ProtocolHandler } from "./types";
+
+const GJC_NAMESPACE = "gjc";
+
+function normalizeRelativePath(relativePath: string): string {
+	return relativePath.replace(/^\/+/, "").replace(/\/+$/, "");
+}
+
+function findCatalogEntry(relativePath: string): BundledGjcSkillCatalogEntry | undefined {
+	const direct = BUNDLED_GJC_SKILL_CATALOG.find(entry => entry.relativePath === relativePath);
+	if (direct) return direct;
+	// `baseDir` identifiers point at the skill directory, not the body file.
+	return BUNDLED_GJC_SKILL_CATALOG.find(entry => entry.relativePath === `${relativePath}/SKILL.md`);
+}
+
+function availablePaths(): string {
+	return BUNDLED_GJC_SKILL_CATALOG.map(entry => `embedded:${GJC_NAMESPACE}/${entry.relativePath}`).join(", ");
+}
+
+/**
+ * Handler for `embedded:` URLs.
+ */
+export class EmbeddedProtocolHandler implements ProtocolHandler {
+	readonly scheme = "embedded";
+	readonly immutable = true;
+
+	async resolve(url: InternalUrl): Promise<InternalResource> {
+		const namespace = (url.rawHost || url.hostname || "").toLowerCase();
+		if (namespace !== GJC_NAMESPACE) {
+			throw new Error(
+				`Unknown embedded namespace: ${namespace || "(empty)"}\nOnly embedded:${GJC_NAMESPACE}/... is resolvable.`,
+			);
+		}
+
+		let rawRelativePath = url.rawPathname ?? url.pathname ?? "";
+		try {
+			rawRelativePath = decodeURIComponent(rawRelativePath);
+		} catch {
+			// Leave the raw form in place; the lookup below reports it verbatim.
+		}
+		const relativePath = normalizeRelativePath(rawRelativePath);
+		if (!relativePath) {
+			throw new Error(
+				`embedded:${GJC_NAMESPACE}/ URL requires a bundled resource path, e.g. embedded:${GJC_NAMESPACE}/skills/ultragoal/SKILL.md`,
+			);
+		}
+		if (relativePath.split("/").includes("..")) {
+			throw new Error("Path traversal (..) is not allowed in embedded: URLs");
+		}
+
+		const entry = findCatalogEntry(relativePath);
+		if (!entry) {
+			throw new Error(
+				`Unknown embedded resource: embedded:${GJC_NAMESPACE}/${relativePath}\nAvailable: ${availablePaths()}`,
+			);
+		}
+
+		const content = await entry.loadContent();
+		return {
+			url: url.href,
+			content,
+			contentType: "text/markdown",
+			size: Buffer.byteLength(content, "utf-8"),
+			notes: [],
+		};
+	}
+}

package/src/internal-urls/index.ts

@@ -10,6 +10,7 @@
 
 export * from "./agent-protocol";
 export * from "./artifact-protocol";
+export * from "./embedded-protocol";
 export * from "./gjc-protocol";
 export * from "./issue-pr-protocol";
 export * from "./json-query";

package/src/internal-urls/parse.ts

@@ -13,6 +13,25 @@ import type { InternalUrl } from "./types";
 
 const SCHEME_HOST_RE = /^([a-z][a-z0-9+.-]*):\/\/([^/?#]*)/i;
 const PATHNAME_RE = /^[a-z][a-z0-9+.-]*:\/\/[^/?#]*(\/[^?#]*)?/i;
+// Schemes whose canonical spelling omits the authority slashes. `embedded:` is
+// the identifier tools print for bundled (non-filesystem) resources, so both
+// `embedded:gjc/...` and `embedded://gjc/...` must route to the same handler.
+const SLASHLESS_SCHEMES = new Set(["embedded"]);
+const SLASHLESS_SCHEME_RE = /^([a-z][a-z0-9+.-]*):(?!\/\/)(.*)$/is;
+
+/**
+ * Canonicalize an internal URL so slashless schemes carry an authority.
+ *
+ * Every entry point that inspects or routes an internal URL (router,
+ * read/write tools, selector splitting) MUST normalize first, so handlers only
+ * ever see the `scheme://authority/path` form.
+ */
+export function normalizeInternalUrlInput(input: string): string {
+	const match = input.match(SLASHLESS_SCHEME_RE);
+	if (!match) return input;
+	if (!SLASHLESS_SCHEMES.has(match[1].toLowerCase())) return input;
+	return `${match[1].toLowerCase()}://${match[2]}`;
+}
 
 /**
  * Parse an internal URL into an InternalUrl.
@@ -20,7 +39,8 @@ const PATHNAME_RE = /^[a-z][a-z0-9+.-]*:\/\/[^/?#]*(\/[^?#]*)?/i;
  * Handles URLs where `new URL()` would fail (e.g., `skill://plugin:name`
  * where the colon is not a port separator).
  */
-export function parseInternalUrl(input: string): InternalUrl {
+export function parseInternalUrl(rawInput: string): InternalUrl {
+	const input = normalizeInternalUrlInput(rawInput);
 	const hostMatch = input.match(SCHEME_HOST_RE);
 	const pathMatch = input.match(PATHNAME_RE);
 

package/src/internal-urls/router.ts

@@ -7,11 +7,12 @@
  */
 import { AgentProtocolHandler } from "./agent-protocol";
 import { ArtifactProtocolHandler } from "./artifact-protocol";
+import { EmbeddedProtocolHandler } from "./embedded-protocol";
 import { GjcProtocolHandler } from "./gjc-protocol";
 import { IssueProtocolHandler, PrProtocolHandler } from "./issue-pr-protocol";
 import { LocalProtocolHandler } from "./local-protocol";
 import { MemoryProtocolHandler } from "./memory-protocol";
-import { parseInternalUrl } from "./parse";
+import { normalizeInternalUrlInput, parseInternalUrl } from "./parse";
 import { RuleProtocolHandler } from "./rule-protocol";
 import type { InternalResource, InternalUrl, ProtocolHandler, ResolveContext } from "./types";
 
@@ -29,6 +30,7 @@ export class InternalUrlRouter {
 		this.register(new RuleProtocolHandler());
 		this.register(new IssueProtocolHandler());
 		this.register(new PrProtocolHandler());
+		this.register(new EmbeddedProtocolHandler());
 	}
 
 	/** Process-global router instance. */
@@ -55,7 +57,7 @@ export class InternalUrlRouter {
 	}
 
 	canHandle(input: string): boolean {
-		const match = input.match(/^([a-z][a-z0-9+.-]*):\/\//i);
+		const match = normalizeInternalUrlInput(input).match(/^([a-z][a-z0-9+.-]*):\/\//i);
 		if (!match) return false;
 		return this.#handlers.has(match[1].toLowerCase());
 	}

package/src/main.ts

@@ -29,7 +29,11 @@ import { resolveLaunchDisposition } from "./cli/launch-disposition";
 import { runListModelsCommand } from "./cli/list-models";
 import { selectSession } from "./cli/session-picker";
 import { findConfigFile } from "./config";
-import { activateModelProfile, ModelProfileCredentialError } from "./config/model-profile-activation";
+import {
+	activateModelProfile,
+	applyModelProfileRuntimeBindings,
+	ModelProfileCredentialError,
+} from "./config/model-profile-activation";
 import { ModelRegistry, ModelsConfigFile } from "./config/model-registry";
 import {
 	parseModelString,
@@ -59,6 +63,9 @@ import type { SubmittedUserInput } from "./modes/types";
 import { applyCliRuntimeApiKeyOverride } from "./runtime-api-key";
 import { type CliCredentialSelector, parseCliCredentialSelector } from "./runtime-credential-selector";
 import type { MCPManager } from "./runtime-mcp";
+// Leaf path, not the barrel: the capability registry must stay out of the
+// runtime-mcp import graph that every root command would otherwise load.
+import { attachExactMcpControls } from "./runtime-mcp/redaction";
 import {
 	type CreateAgentSessionOptions,
 	type CreateAgentSessionResult,
@@ -477,13 +484,23 @@ async function applyStartupModelProfilesWithPolicy(
 		options: {
 			thinkingLevelOverride?: CreateAgentSessionOptions["thinkingLevel"];
 			tolerateCredentialError?: boolean;
+			runtimeBindingsOnly?: boolean;
 		} = {},
 	): Promise<boolean> => {
 		try {
-			await activateModelProfile(
-				{ session: args.session, modelRegistry: args.modelRegistry, settings: args.settings, profileName },
-				{ persistDefault, thinkingLevelOverride: options.thinkingLevelOverride },
-			);
+			if (options.runtimeBindingsOnly) {
+				await applyModelProfileRuntimeBindings({
+					session: args.session,
+					modelRegistry: args.modelRegistry,
+					settings: args.settings,
+					profileName,
+				});
+			} else {
+				await activateModelProfile(
+					{ session: args.session, modelRegistry: args.modelRegistry, settings: args.settings, profileName },
+					{ persistDefault, thinkingLevelOverride: options.thinkingLevelOverride },
+				);
+			}
 			return true;
 		} catch (error) {
 			if (error instanceof ModelProfileCredentialError && (onCredentialError || options.tolerateCredentialError)) {
@@ -519,6 +536,7 @@ async function applyStartupModelProfilesWithPolicy(
 						? args.settings.get("defaultThinkingLevel")
 						: undefined,
 					tolerateCredentialError: tolerateDefaultProfileFailure,
+					runtimeBindingsOnly: args.session.hasRecoveredDefaultFallbackChain(),
 				})) && applied;
 		}
 		if (args.parsedArgs.mpreset) {
@@ -780,6 +798,10 @@ function hasResumePickerTerminal(): boolean {
 	return process.stdin.isTTY === true && process.stdout.isTTY === true;
 }
 
+export function shouldNotifyModelFallback(authBootstrap: boolean | undefined, isInteractive: boolean): boolean {
+	return !(authBootstrap === true && isInteractive);
+}
+
 export async function runInteractiveMode(
 	session: AgentSession,
 	version: string,
@@ -1405,6 +1427,80 @@ export interface RunRootCommandDependencies {
 	loadSettingsForScope?: typeof Settings.loadForScope;
 }
 
+type DirectSessionManager = Pick<SessionManager, "getCwd" | "getSessionFile" | "getSessionId">;
+
+/**
+ * Direct CLI liveness is meaningful only for sessions with a durable transcript.
+ * An in-memory manager has no artifacts for GC to fence and must not touch the
+ * shared SDK session-index lock.
+ */
+export function directSessionRegistrationId(
+	sessionManager: DirectSessionManager | undefined,
+	lifecycleRequestId: string | undefined,
+): string | undefined {
+	if (lifecycleRequestId || sessionManager?.getSessionFile() === undefined) return undefined;
+	return sessionManager.getSessionId();
+}
+
+interface DirectSessionRegistrationDependencies {
+	createIndex?: (agentDir: string) => SessionIndex;
+	processIncarnation?: typeof processIncarnation;
+	registerPostmortem?: typeof postmortem.register;
+	masterRole?: { ownerSessionId: string; attestationEpoch: string };
+}
+
+/** Register a durable direct CLI session while leaving ephemeral sessions lock-free. */
+export async function registerDirectSession(
+	sessionManager: DirectSessionManager | undefined,
+	agentDir: string,
+	lifecycleRequestId: string | undefined,
+	dependencies: DirectSessionRegistrationDependencies = {},
+): Promise<void> {
+	const directSessionId = directSessionRegistrationId(sessionManager, lifecycleRequestId);
+	if (!directSessionId || !sessionManager) return;
+	const sessionIndex = dependencies.createIndex?.(agentDir) ?? new SessionIndex(agentDir);
+	const locator = await resolveSessionLocator(sessionManager.getCwd(), agentDir);
+	const directSessionIncarnation = (dependencies.processIncarnation ?? processIncarnation)(process.pid);
+	await sessionIndex.append({
+		type: "host_registered",
+		sessionId: directSessionId,
+		locator,
+		endpointGeneration: 0,
+		pid: process.pid,
+		...(directSessionIncarnation ? { processIncarnation: directSessionIncarnation } : {}),
+		...(dependencies.masterRole && directSessionIncarnation
+			? {
+					masterRole: {
+						version: 2 as const,
+						ownerSessionId: dependencies.masterRole.ownerSessionId,
+						launchPid: process.pid,
+						launchProcessIncarnation: directSessionIncarnation,
+						role: "master" as const,
+						attestationEpoch: dependencies.masterRole.attestationEpoch,
+					},
+				}
+			: {}),
+	});
+	if (locator.worktreeRoot !== null) {
+		try {
+			await releaseLaunchWorktreeReservationAfterRegistration(agentDir, locator.worktreeRoot);
+		} catch (error) {
+			logger.warn("Failed to release launch worktree reservation after host registration", {
+				error: error instanceof Error ? error.message : String(error),
+			});
+		}
+	}
+	(dependencies.registerPostmortem ?? postmortem.register)("direct-session-index", async _reason => {
+		await sessionIndex.append({
+			type: "host_unregistered",
+			sessionId: directSessionId,
+			locator,
+			endpointGeneration: 0,
+			pid: process.pid,
+		});
+	});
+}
+
 export interface ModelRoleOverrides {
 	smol?: string;
 	slow?: string;
@@ -1987,55 +2083,15 @@ export async function runRootCommand(
 	}
 	// Register a resumed direct session before constructing the agent: GC holds the
 	// same index lock while deleting artifacts, so startup and deletion are fenced.
-	const directSessionId = process.env.GJC_LIFECYCLE_REQUEST_ID ? undefined : sessionManager?.getSessionId();
-	if (directSessionId) {
-		const sessionIndex = new SessionIndex(settingsInstance.getAgentDir());
-		const locator = await resolveSessionLocator(sessionManager?.getCwd() ?? cwd, settingsInstance.getAgentDir());
-		// A pid is reusable, so the broker's teardown fence needs this session's OS
-		// start incarnation recorded alongside the pid it publishes.
-		const directSessionIncarnation = processIncarnation(process.pid);
-		await sessionIndex.append({
-			type: "host_registered",
-			sessionId: directSessionId,
-			locator,
-			endpointGeneration: 0,
-			pid: process.pid,
-			...(directSessionIncarnation ? { processIncarnation: directSessionIncarnation } : {}),
-			...(masterModeContext && directSessionIncarnation
-				? {
-						masterRole: {
-							version: 2,
-							ownerSessionId: masterModeContext.ownerSessionId,
-							launchPid: process.pid,
-							launchProcessIncarnation: directSessionIncarnation,
-							role: "master" as const,
-							attestationEpoch: masterModeContext.attestationEpoch,
-						},
-					}
-				: {}),
-		});
-		if (locator.worktreeRoot !== null) {
-			try {
-				await releaseLaunchWorktreeReservationAfterRegistration(
-					settingsInstance.getAgentDir(),
-					locator.worktreeRoot,
-				);
-			} catch (error) {
-				logger.warn("Failed to release launch worktree reservation after host registration", {
-					error: error instanceof Error ? error.message : String(error),
-				});
-			}
-		}
-		postmortem.register("direct-session-index", async () => {
-			await sessionIndex.append({
-				type: "host_unregistered",
-				sessionId: directSessionId,
-				locator,
-				endpointGeneration: 0,
-				pid: process.pid,
-			});
-		});
-	}
+	// Ephemeral sessions have no durable artifacts or liveness authority to fence.
+	await registerDirectSession(sessionManager, settingsInstance.getAgentDir(), process.env.GJC_LIFECYCLE_REQUEST_ID, {
+		masterRole: masterModeContext
+			? {
+					ownerSessionId: masterModeContext.ownerSessionId,
+					attestationEpoch: masterModeContext.attestationEpoch,
+				}
+			: undefined,
+	});
 
 	const createAgentSessionImpl = deps.createAgentSession ?? createAgentSession;
 	const createSession: CreateSessionForMain = async (options, context): Promise<CreateAgentSessionResult> => {
@@ -2076,6 +2132,18 @@ export async function runRootCommand(
 		// Herdr integration: report gjc lifecycle state when running in a Herdr pane.
 		installHerdrReporter(listener => session.subscribe(listener));
 
+		// Exact MCP capability attaches at the root interactive entry point.
+		// Granted by creation path, not by call order:
+		// only a session this root command built for an interactive run with an
+		// explicit --mcp-config gets one. Sessions built through createAgentSession
+		// directly, sub-sessions, ACP, and print/text/json runs never reach here.
+		if (isInteractive && sessionOptions.mcpConfigPath) {
+			attachExactMcpControls(session, {
+				grantSource: "root-interactive-exact-config",
+				configPath: sessionOptions.mcpConfigPath,
+			});
+		}
+
 		let startDeferredModelProfiles: DeferredModelProfileStartup | undefined;
 		if (!(parsedArgs.authBootstrap === true && isInteractive)) {
 			const profileArgs = {
@@ -2114,7 +2182,7 @@ export async function runRootCommand(
 			}
 		}
 
-		if (modelFallbackMessage) {
+		if (modelFallbackMessage && shouldNotifyModelFallback(parsedArgs.authBootstrap, isInteractive)) {
 			notifs.push({ kind: "warn", message: modelFallbackMessage });
 		}