@gajae-code/coding-agent 0.17.2 → 0.17.5

package/src/config/model-registry.ts

@@ -44,6 +44,9 @@ import { fetchModelsDevPayload } from "@gajae-code/ai/provider-models/openai-com
 import { isDirectXaiReasoningEffortModel } from "@gajae-code/ai/providers/openai-completions-compat";
 import {
 	detectDiscoveredApiFamily,
+	isSafeCatalogModelId,
+	MODELS_LIST_REQUEST_TIMEOUT_MS,
+	readBoundedModelsJson,
 	resolveLoopbackOpenAIBaseUrl,
 } from "@gajae-code/ai/utils/discovery/openai-compatible";
 
@@ -80,6 +83,8 @@ import { ModelDiscoveryManager, type ProviderDiscoveryState } from "./model-disc
 import {
 	loadAcceptedModelPresetProfiles,
 	type ModelPresetRegistryDependencies,
+	type ModelPresetRegistryRefreshResult,
+	refreshModelPresetRegistry,
 	refreshModelPresetRegistryInBackground,
 } from "./model-preset-registry";
 
@@ -144,6 +149,36 @@ function redactDiscoveryUrl(value: string | URL): string {
 	}
 }
 
+/**
+ * Scrub resolved credential material from a discovery failure before it is
+ * published to discovery state, cache provenance, or the logger. Mutates
+ * Error messages and stacks in place to preserve class/identity; wraps non-Errors.
+ */
+export function scrubDiscoveryError(error: unknown, secrets: ReadonlyArray<string | undefined>): unknown {
+	const redact = (text: string): string => {
+		let scrubbed = text;
+		for (const secret of secrets) {
+			if (secret) scrubbed = scrubbed.split(secret).join("[redacted]");
+		}
+		return scrubbed;
+	};
+	if (error instanceof Error) {
+		const seen = new Set<Error>();
+		const scrubError = (current: Error): void => {
+			if (seen.has(current)) return;
+			seen.add(current);
+			current.message = redact(current.message);
+			if (typeof current.stack === "string") current.stack = redact(current.stack);
+			if (current.cause instanceof Error) scrubError(current.cause);
+			else if (typeof current.cause === "string") current.cause = redact(current.cause);
+		};
+		scrubError(error);
+		return error;
+	}
+	if (typeof error === "string") return redact(error);
+	return error;
+}
+
 /** Whether a structured transport code proves that no listener accepted the connection. */
 function isConnectionRefusedDiscoveryCode(value: unknown): boolean {
 	if (typeof value === "string") {
@@ -742,13 +777,26 @@ function registryModelMetadataWithoutApiSpecificFields(model: Model<Api>): Parti
 	return metadata;
 }
 
-function registrySelectorResolvesToModel(selector: string, models: readonly Model<Api>[]): boolean {
-	if (models.some(model => model.id === selector || `${model.provider}/${model.id}` === selector)) return true;
-	const suffix = splitSelectorThinkingSuffix(selector);
-	const baseSelector = suffix.thinkingLevel === undefined ? selector : suffix.selector;
+export function registrySelectorResolvesToModel(selector: string, models: readonly Model<Api>[]): boolean {
+	const normalizedSelector = selector.trim().toLowerCase();
+	if (
+		models.some(
+			model =>
+				model.id.toLowerCase() === normalizedSelector ||
+				`${model.provider}/${model.id}`.toLowerCase() === normalizedSelector,
+		)
+	)
+		return true;
+	const suffix = splitSelectorThinkingSuffix(normalizedSelector);
+	const baseSelector = suffix.thinkingLevel === undefined ? normalizedSelector : suffix.selector;
 	const parsed = parseModelString(baseSelector);
-	if (parsed) return models.some(model => model.provider === parsed.provider && model.id === parsed.id);
-	return models.some(model => model.id === baseSelector || model.id.endsWith(`/${baseSelector}`));
+	if (parsed)
+		return models.some(
+			model => model.provider.toLowerCase() === parsed.provider && model.id.toLowerCase() === parsed.id,
+		);
+	return models.some(
+		model => model.id.toLowerCase() === baseSelector || model.id.toLowerCase().endsWith(`/${baseSelector}`),
+	);
 }
 
 function filterMaterializedRegistryProfiles(
@@ -1856,6 +1904,17 @@ export class ModelRegistry {
 		});
 	}
 
+	/** Refresh the signed profile catalog online, then publish its accepted snapshot. */
+	async refreshModelPresetProfilesFromRegistry(): Promise<ModelPresetRegistryRefreshResult> {
+		const result = await refreshModelPresetRegistry({
+			...this.#modelPresetRegistryDependencies,
+			agentDir: this.#modelPresetRegistryAgentDir,
+			knownManifestSha256: this.#loadedModelPresetRegistryManifestSha256,
+		});
+		await this.refreshStatic();
+		return result;
+	}
+
 	/**
 	 * Reload models from disk and refresh runtime provider discovery state.
 	 */
@@ -2501,12 +2560,20 @@ export class ModelRegistry {
 		for (const providerConfig of this.#discoveryManager.providers) {
 			if (providerId && providerConfig.provider !== providerId) continue;
 			let expectedProvenance: string | undefined;
+			let effectiveConfig: DiscoveryProviderConfig | undefined;
+			let expectedAuthGeneration: string | undefined;
+			let expectedEndpoint: string | undefined;
 			try {
-				const effectiveConfig = this.#effectiveDiscoveryProviderConfig(providerConfig);
+				effectiveConfig = this.#effectiveDiscoveryProviderConfig(providerConfig);
+				const effectiveAuthGeneration =
+					authEvidence ?? this.#getProviderEvidenceGeneration(effectiveConfig.provider);
+				const effectiveEndpoint = this.#normalizeDiscoveryEvidenceEndpoint(effectiveConfig.baseUrl ?? "");
+				expectedAuthGeneration = effectiveAuthGeneration;
+				expectedEndpoint = effectiveEndpoint;
 				expectedProvenance = fingerprintConfiguredDiscoveryRequestShape(
 					effectiveConfig,
-					authEvidence ?? this.#getProviderEvidenceGeneration(effectiveConfig.provider),
-					this.#normalizeDiscoveryEvidenceEndpoint(effectiveConfig.baseUrl ?? ""),
+					effectiveAuthGeneration,
+					effectiveEndpoint,
 				);
 			} catch {
 				// A context that cannot be fully derived cannot vouch for a cache row.
@@ -2515,6 +2582,30 @@ export class ModelRegistry {
 			const models = publishDiscoveryState
 				? this.#discoveryManager.loadCached(providerConfig, this.#cacheDbPath, expectedProvenance)
 				: this.#readCachedDiscoverableModels(providerConfig, expectedProvenance);
+			if (publishDiscoveryState) {
+				const cache =
+					effectiveConfig !== undefined
+						? readModelCache<Api>(effectiveConfig.provider, 24 * 60 * 60 * 1000, Date.now, this.#cacheDbPath)
+						: null;
+				if (
+					effectiveConfig !== undefined &&
+					expectedAuthGeneration !== undefined &&
+					expectedEndpoint !== undefined &&
+					expectedProvenance !== undefined &&
+					cache?.fresh === true &&
+					cache.authoritative === true &&
+					cache.dynamicModelIds !== undefined &&
+					cache.dynamicModelProvenance === expectedProvenance
+				) {
+					this.#configuredDiscoveryEvidence.set(effectiveConfig.provider, {
+						authGeneration: expectedAuthGeneration,
+						endpoint: expectedEndpoint,
+						modelIds: new Set(cache.dynamicModelIds),
+					});
+				} else {
+					this.#configuredDiscoveryEvidence.delete(providerConfig.provider);
+				}
+			}
 			// Cache rows persist sanitized transport metadata (no headers), so a
 			// rebooted registry re-derives the provider transport override from the
 			// same source the live publish path uses — mirroring the cached
@@ -3247,16 +3338,24 @@ export class ModelRegistry {
 			const currentEndpoint = this.#normalizeDiscoveryEvidenceEndpoint(
 				this.#effectiveDiscoveryProviderConfig(provider).baseUrl ?? "",
 			);
+			const authoritativeState =
+				state !== undefined &&
+				state.error === undefined &&
+				!state.stale &&
+				((state.status === "ok" && discovery.fetched) ||
+					state.status === "empty" ||
+					(state.status === "ok" && !discovery.fetched));
 			if (
 				evidence !== undefined &&
-				state?.status === "ok" &&
-				discovery.fetched &&
+				authoritativeState &&
 				currentAuthGeneration === evidence.authGeneration &&
 				currentEndpoint === evidence.endpoint
 			) {
 				this.#configuredDiscoveryEvidence.set(provider.provider, evidence);
 			} else if (
-				(state?.status !== "cached" && !(state?.status === "ok" && !discovery.fetched)) ||
+				(state?.status !== "cached" &&
+					state?.status !== "empty" &&
+					!(state?.status === "ok" && !discovery.fetched)) ||
 				state.error !== undefined ||
 				this.#configuredDiscoveryEvidence.get(provider.provider)?.authGeneration !== currentAuthGeneration ||
 				this.#configuredDiscoveryEvidence.get(provider.provider)?.endpoint !== currentEndpoint
@@ -3287,8 +3386,8 @@ export class ModelRegistry {
 	}
 
 	#profileAvailabilityEvidenceFingerprint(): string {
-		return JSON.stringify(
-			[...this.#descriptorDiscoveryEvidence.entries()]
+		return JSON.stringify({
+			descriptor: [...this.#descriptorDiscoveryEvidence.entries()]
 				.sort(([left], [right]) => left.localeCompare(right))
 				.map(([provider, evidence]) => [
 					provider,
@@ -3300,7 +3399,15 @@ export class ModelRegistry {
 					[...evidence.modelIds].sort(),
 					evidence.profileModelIds === undefined ? undefined : [...evidence.profileModelIds].sort(),
 				]),
-		);
+			configured: [...this.#configuredDiscoveryEvidence.entries()]
+				.sort(([left], [right]) => left.localeCompare(right))
+				.map(([provider, evidence]) => [
+					provider,
+					evidence.authGeneration,
+					evidence.endpoint,
+					[...evidence.modelIds].sort(),
+				]),
+		});
 	}
 
 	#mergeDiscoveredModels(discovered: readonly Model<Api>[]): void {
@@ -3496,8 +3603,14 @@ export class ModelRegistry {
 						await this.#discoverModelsByProviderType(provider, apiKey),
 					);
 				} catch (error) {
-					discoveryFailureEvidence = error;
-					throw error;
+					// ONE credential-safe discovery error boundary: transport
+					// layers may echo request details (including the bearer)
+					// in failure text. Scrub resolved credential material
+					// before the error reaches discovery state, cache
+					// provenance, or the logger below.
+					const scrubbedError = scrubDiscoveryError(error, [apiKey, preflightApiKey]);
+					discoveryFailureEvidence = scrubbedError;
+					throw scrubbedError;
 				}
 			},
 			getEvidenceGeneration: provider => this.#getProviderEvidenceGeneration(provider.provider, preflightApiKey),
@@ -3569,24 +3682,35 @@ export class ModelRegistry {
 		};
 	}
 
-	#discoverModelsByProviderType(
+	async #discoverModelsByProviderType(
 		providerConfig: DiscoveryProviderConfig,
 		apiKey: string | undefined,
 	): Promise<Model<Api>[]> {
+		let models: Model<Api>[];
 		switch (providerConfig.discovery.type) {
 			case "ollama":
-				return this.#discoverOllamaModels(providerConfig, apiKey);
+				models = await this.#discoverOllamaModels(providerConfig, apiKey);
+				break;
 			case "llama.cpp":
-				return this.#discoverLlamaCppModels(providerConfig, apiKey);
+				models = await this.#discoverLlamaCppModels(providerConfig, apiKey);
+				break;
 			case "lm-studio":
 			case "omlx":
 			case "vllm":
 			case "sglang":
 			case "openai-models-list":
-				return this.#discoverOpenAIModelsList(providerConfig, apiKey);
+				models = await this.#discoverOpenAIModelsList(providerConfig, apiKey);
+				break;
 			case "models-dev":
-				return this.#discoverModelsDevProvider(providerConfig);
+				models = await this.#discoverModelsDevProvider(providerConfig);
+				break;
 		}
+		if (providerConfig.discovery.type === "openai-models-list" && models.length === 0) {
+			throw new Error(
+				`Model discovery for ${redactDiscoveryUrl(providerConfig.baseUrl ?? "")} returned no models; add --model <id> or fix the endpoint catalog.`,
+			);
+		}
+		return models;
 	}
 
 	async #discoverBuiltInProviderModels(
@@ -4222,7 +4346,7 @@ export class ModelRegistry {
 			...(providerConfig.discovery.type === "vllm" || providerConfig.discovery.type === "sglang"
 				? { redirect: "error" as const }
 				: {}),
-			signal: AbortSignal.timeout(hardenedLocalDiscovery ? 500 : 5_000),
+			signal: AbortSignal.timeout(hardenedLocalDiscovery ? 500 : MODELS_LIST_REQUEST_TIMEOUT_MS),
 		});
 		if (!response.ok) {
 			if (response.status === 401 || response.status === 403) {
@@ -4234,16 +4358,31 @@ export class ModelRegistry {
 			}
 			throw new Error(`HTTP ${response.status} from ${redactDiscoveryUrl(modelsUrl)}`);
 		}
-		const payload: unknown = await response.json();
+		// Shared 1MB bounded reader (same as the setup probe): a timeout
+		// bounds wall clock, not bytes buffered.
+		let payload: unknown;
+		try {
+			payload = await readBoundedModelsJson(response);
+		} catch {
+			throw new Error(`Malformed OpenAI models-list response from ${redactDiscoveryUrl(modelsUrl)}`);
+		}
 		if (!isRecord(payload) || !Array.isArray(payload.data)) {
 			throw new Error(`Malformed OpenAI models-list response from ${redactDiscoveryUrl(modelsUrl)}`);
 		}
 		const models = payload.data;
 		const discovered: Model<Api>[] = [];
 		for (const item of models) {
-			if (!isRecord(item) || typeof item.id !== "string" || !item.id.trim()) continue;
-			const id = item.id;
+			// Shared catalog admission: the setup probe applies the same
+			// check, so IDs that appear only between requests cannot enter
+			// the live catalog or cache unsanitized.
+			if (!isRecord(item) || !isSafeCatalogModelId(item.id)) continue;
+			const id = item.id.trim();
 			const referenceModel = resolveCustomModelReference(id);
+			// Names render directly in the model selector: apply the same
+			// text-safety admission, falling back to the reference name or
+			// the safe ID.
+			const rawName = typeof item.name === "string" ? item.name.trim() : "";
+			const name = rawName && isSafeCatalogModelId(rawName) ? rawName : (referenceModel?.name ?? id);
 			const discoveredMaxTokens = firstPositiveDiscoveryNumber(
 				item.max_completion_tokens,
 				item.max_tokens,
@@ -4253,7 +4392,7 @@ export class ModelRegistry {
 			discovered.push(
 				enrichModelThinking({
 					id,
-					name: typeof item.name === "string" ? item.name : (referenceModel?.name ?? id),
+					name,
 					api,
 					provider: providerConfig.provider,
 					baseUrl: requestBaseUrl,
@@ -5226,8 +5365,10 @@ export class ModelRegistry {
 	}
 
 	/**
-	 * Get only models that have auth configured.
-	 * This is a fast check that doesn't refresh OAuth tokens.
+	 * Get selectable models with auth configured.
+	 * This is a fast check that doesn't refresh OAuth tokens. A current,
+	 * authoritative live catalog also limits each provider to its enrolled ids;
+	 * bundled entries remain the fallback until that evidence exists.
 	 */
 	getAvailable(): Model<Api>[] {
 		this.#synchronizeEnvironmentCredentials();
@@ -5241,12 +5382,82 @@ export class ModelRegistry {
 		) {
 			return this.#availableModelsCache;
 		}
-		this.#availableModelsCache = this.#models.filter(model => this.#isModelAvailable(model, disabledProviders));
+		const authoritativeDiscoveryIds = new Map<string, ReadonlySet<string> | undefined>();
+		const bundledIdsByProvider = new Map<string, Set<string>>();
+		this.#availableModelsCache = this.#models.filter(model => {
+			if (!this.#isModelAvailable(model, disabledProviders)) return false;
+
+			let liveIds = authoritativeDiscoveryIds.get(model.provider);
+			if (!authoritativeDiscoveryIds.has(model.provider)) {
+				liveIds = this.#getAuthoritativeDiscoveredModelIds(model.provider);
+				authoritativeDiscoveryIds.set(model.provider, liveIds);
+			}
+			// Undefined means discovery has not run successfully for the current
+			// provider context. Keep the bundled catalog as the explicit fallback.
+			if (liveIds === undefined) return true;
+			if (this.#hasCustomModelOverlay(model.provider, model.id)) return true;
+
+			const activity = this.#providerActivity.get(model.provider);
+			if (!activity?.staticModelIds.has(model.id)) return liveIds.has(model.id);
+
+			let bundledIds = bundledIdsByProvider.get(model.provider);
+			if (!bundledIds) {
+				bundledIds = new Set(
+					(getBundledModels(model.provider as Parameters<typeof getBundledModels>[0]) as Model<Api>[]).map(
+						candidate => candidate.id,
+					),
+				);
+				bundledIdsByProvider.set(model.provider, bundledIds);
+			}
+			return !bundledIds.has(model.id) || liveIds.has(model.id);
+		});
 		this.#availableModelsDisabledProviders = disabledProviderKey;
 		this.#availableModelsEnvFingerprint = envFingerprint;
 		return this.#availableModelsCache;
 	}
 
+	/**
+	 * Return the current live model ids only when discovery produced an
+	 * authoritative catalog for the provider and endpoint. An unavailable or
+	 * failed discovery returns undefined so callers retain the bundled fallback.
+	 */
+	#getAuthoritativeDiscoveredModelIds(provider: string): ReadonlySet<string> | undefined {
+		const descriptorEvidence = this.#descriptorDiscoveryEvidence.get(provider);
+		if (descriptorEvidence?.profileFresh && descriptorEvidence.profileModelIds !== undefined) {
+			try {
+				if (
+					descriptorEvidence.authGeneration === this.#getProviderEvidenceGeneration(provider) &&
+					descriptorEvidence.profileEndpoint ===
+						this.#normalizeDiscoveryEvidenceEndpoint(this.#getProviderBaseUrlForDiscovery(provider) ?? "")
+				) {
+					return descriptorEvidence.profileModelIds;
+				}
+			} catch {
+				// A provider context that can no longer be verified must use its fallback.
+			}
+		}
+
+		const configuredEvidence = this.#configuredDiscoveryEvidence.get(provider);
+		if (!configuredEvidence) return undefined;
+		const discoveryState = this.#discoveryManager.getState(provider);
+		if (
+			discoveryState?.status !== "ok" &&
+			discoveryState?.status !== "cached" &&
+			discoveryState?.status !== "empty"
+		) {
+			return undefined;
+		}
+		try {
+			return configuredEvidence.authGeneration === this.#getProviderEvidenceGeneration(provider) &&
+				configuredEvidence.endpoint ===
+					this.#normalizeDiscoveryEvidenceEndpoint(this.#getProviderBaseUrlForDiscovery(provider) ?? "")
+				? configuredEvidence.modelIds
+				: undefined;
+		} catch {
+			return undefined;
+		}
+	}
+
 	#synchronizeEnvironmentCredentials(): void {
 		// Runtime registrations own a provider while their credential is present.
 		// Refresh them first so a missing runtime env key can hand ownership back to
@@ -5267,6 +5478,10 @@ export class ModelRegistry {
 	 */
 	getAvailableForProfileActivation(): Model<Api>[] {
 		const bundledIdsByProvider = new Map<string, Set<string>>();
+		// Evidence staleness depends only on the provider, and resolving it scans the
+		// catalog for the provider base URL. Decide it once per provider per call so a
+		// multi-thousand-model catalog is not rescanned for every model.
+		const staleEvidenceByProvider = new Map<string, boolean>();
 		return this.getAvailable().filter(model => {
 			const evidence = this.#descriptorDiscoveryEvidence.get(model.provider);
 			if (!evidence?.profileFresh || evidence.profileModelIds === undefined) return true;
@@ -5281,12 +5496,15 @@ export class ModelRegistry {
 				bundledIdsByProvider.set(model.provider, bundledModelIds);
 			}
 			if (!bundledModelIds.has(model.id)) return true;
-			if (
-				evidence.authGeneration !== this.#getProviderEvidenceGeneration(model.provider) ||
-				evidence.profileEndpoint !==
-					this.#normalizeDiscoveryEvidenceEndpoint(this.#getProviderBaseUrlForDiscovery(model.provider) ?? "")
-			)
-				return true;
+			let staleEvidence = staleEvidenceByProvider.get(model.provider);
+			if (staleEvidence === undefined) {
+				staleEvidence =
+					evidence.authGeneration !== this.#getProviderEvidenceGeneration(model.provider) ||
+					evidence.profileEndpoint !==
+						this.#normalizeDiscoveryEvidenceEndpoint(this.#getProviderBaseUrlForDiscovery(model.provider) ?? "");
+				staleEvidenceByProvider.set(model.provider, staleEvidence);
+			}
+			if (staleEvidence) return true;
 			return evidence.profileModelIds.has(model.id);
 		});
 	}

package/src/config/model-resolver.ts

@@ -87,6 +87,7 @@ export function resolveStartupModelRefreshSelectors(
 export async function refreshMissingQualifiedModelProviders(
 	selectors: ModelSelectorValue | undefined,
 	modelRegistry: Pick<ModelRegistry, "getAvailable" | "getRefreshableProviders" | "refreshProvider">,
+	credentialSessionId?: string,
 ): Promise<boolean> {
 	const refreshedProviders = new Set<string>();
 	for (const selector of normalizeModelSelectorValue(selectors)) {
@@ -104,7 +105,11 @@ export async function refreshMissingQualifiedModelProviders(
 		)
 			continue;
 
-		await modelRegistry.refreshProvider(provider, "online-if-uncached");
+		if (credentialSessionId === undefined) {
+			await modelRegistry.refreshProvider(provider, "online-if-uncached");
+		} else {
+			await modelRegistry.refreshProvider(provider, "online-if-uncached", credentialSessionId);
+		}
 		refreshedProviders.add(provider);
 	}
 	return refreshedProviders.size > 0;

package/src/config/settings-schema.ts

@@ -369,6 +369,24 @@ const AUTOROUTING_PROVENANCE_JSON_SCHEMA: JsonSchemaObject = {
 	required: ["schema", "source", "declarationFingerprint", "tiersFingerprint"],
 };
 
+// SDK prompt deadline defaults. The `sdk.promptDeadlineMs` /
+// `sdk.promptMaxRuntimeMs` schema entries below and the SDK bus/host lease
+// fallbacks read these same constants, so a Settings lookup that misses — no
+// settings object, an unwritten key, a non-finite value — cannot arm a deadline
+// that disagrees with the declared default (#5583).
+export const DEFAULT_SDK_PROMPT_DEADLINE_MS = 3_600_000;
+export const DEFAULT_SDK_PROMPT_MAX_RUNTIME_MS = 21_600_000;
+
+/** Resolve a `sdk.promptDeadlineMs` lookup, falling back on any non-finite value. */
+export function resolveSdkPromptDeadlineMs(value: unknown): number {
+	return typeof value === "number" && Number.isFinite(value) ? value : DEFAULT_SDK_PROMPT_DEADLINE_MS;
+}
+
+/** Resolve a `sdk.promptMaxRuntimeMs` lookup, falling back on any non-finite value. */
+export function resolveSdkPromptMaxRuntimeMs(value: unknown): number {
+	return typeof value === "number" && Number.isFinite(value) ? value : DEFAULT_SDK_PROMPT_MAX_RUNTIME_MS;
+}
+
 export const SETTINGS_SCHEMA = {
 	// ────────────────────────────────────────────────────────────────────────
 	// General settings (no UI)
@@ -416,16 +434,22 @@ export const SETTINGS_SCHEMA = {
 	// SDK-owned prompt deadline. Hidden from the UI; ACP has no separate timeout.
 	"sdk.promptDeadlineMs": {
 		type: "number",
-		default: 3_600_000,
+		default: DEFAULT_SDK_PROMPT_DEADLINE_MS,
 		description: "SDK-owned prompt deadline; ACP has no separate timeout.",
 		validate: (value: number) => Number.isSafeInteger(value) && value >= 60_000 && value <= 86_400_000,
 	},
 	"sdk.promptMaxRuntimeMs": {
 		type: "number",
-		default: 21_600_000,
+		default: DEFAULT_SDK_PROMPT_MAX_RUNTIME_MS,
 		description: "Hard maximum runtime for an SDK prompt from acceptance, bounding progress-aware renewals.",
 		validate: (value: number) => Number.isSafeInteger(value) && value >= 60_000 && value <= 86_400_000,
 	},
+	"sdk.flushWorktreeOnDeadline": {
+		type: "boolean",
+		default: true,
+		description:
+			"Autosave uncommitted changes in the session's linked worktree by default as a WIP commit when a prompt deadline retires a prompt; primary checkouts require an explicit true opt-in.",
+	},
 	"sdk.masterOrphanGraceMs": {
 		type: "number",
 		default: 120_000,

package/src/coordinator-mcp/policy.ts

@@ -275,11 +275,16 @@ export async function assertCoordinatorSessionLocations(
 	]);
 	// Reauthorize both persisted locations independently. A managed worktree may
 	// differ from the requested cwd, but neither may escape the current roots.
-	if (
-		!roots.some(root => isInsideCanonicalRoot(canonicalCwd, root, platform)) ||
-		!roots.some(root => isInsideCanonicalRoot(canonicalWorkspace, root, platform))
-	)
-		throw new Error("coordinator_workdir_outside_allowed_roots");
+	const escaped: string[] = [];
+	if (!roots.some(root => isInsideCanonicalRoot(canonicalCwd, root, platform))) escaped.push(`cwd ${canonicalCwd}`);
+	if (!roots.some(root => isInsideCanonicalRoot(canonicalWorkspace, root, platform)))
+		escaped.push(`workspace ${canonicalWorkspace}`);
+	if (escaped.length > 0)
+		// The message stays exact because isSessionAuthorityError() in server.ts matches it
+		// verbatim; the escaping location rides in `cause` so a caller that logs can name it.
+		throw new Error("coordinator_workdir_outside_allowed_roots", {
+			cause: new Error(`outside allowed roots: ${escaped.join(", ")}`),
+		});
 }
 
 export async function assertCoordinatorArtifactPath(

package/src/coordinator-mcp/question-gate-codec.ts

@@ -184,6 +184,23 @@ export function buildCoordinatorAskAnswerSchema(
 	return {
 		title: "CoordinatorQuestionAnswerV1",
 		type: "object",
+		// `additionalProperties: false` is scoped by the SIBLING `properties` map, not by
+		// the `oneOf` branches: a standards-compliant validator evaluates the keyword
+		// against this node alone. Without this map every answer field was "additional",
+		// so selection, custom-answer, and clarification payloads were all rejected
+		// client-side before the server saw them (#5801). Each branch stays closed too,
+		// so the union still rejects field combinations this map alone would allow.
+		properties: {
+			selected: selectedBase,
+			other: { type: "boolean", description: "set true to provide a free-text answer in `custom`" },
+			custom: boundedAnswerText("free-text answer; required when `other` is true"),
+			action: {
+				type: "string",
+				enum: ["answer", "clarify"],
+				description: "set to `clarify` to ask about the choices without answering the round",
+			},
+			question: boundedAnswerText("clarification question; required when action is `clarify`"),
+		},
 		additionalProperties: false,
 		oneOf: [
 			{