@gajae-code/coding-agent 0.17.6 → 0.17.7

package/src/config/model-profile-ownership.ts

@@ -0,0 +1,303 @@
+import * as util from "node:util";
+import { resolveModelProfileName } from "./model-profile-contract";
+import type { SettingsAtomicPatch } from "./settings";
+
+const OWNERSHIP_PROJECTION_PATHS = new Set(["modelProfile.ownership", "modelProfile.default"]);
+
+export type ModelProfileOwnershipMarker =
+	| { kind: "inherit" }
+	| { kind: "cleared" }
+	| { kind: "profile"; profile: string };
+
+export interface DurableModelProfileOwnership {
+	schemaVersion: 1;
+	version: number;
+	marker: ModelProfileOwnershipMarker;
+}
+
+export interface ModelProfileOwnershipSettings {
+	getGlobal(path: "modelProfile.ownership" | "modelProfile.default"): unknown;
+}
+
+export interface DurableModelProfileOwnershipCommit {
+	ownership: DurableModelProfileOwnership;
+	wrote: boolean;
+}
+
+export interface DurableModelProfileOwnershipStore extends ModelProfileOwnershipSettings {
+	commitAtomicBatchWithCurrent(
+		buildPatches: (
+			current: Readonly<Record<string, unknown>>,
+		) => Promise<readonly SettingsAtomicPatch[]> | readonly SettingsAtomicPatch[],
+	): Promise<unknown>;
+}
+
+export const MODEL_PROFILE_OWNERSHIP_ENTRY = "model_profile_ownership";
+
+export function validateModelProfileOwnershipMarker(value: unknown): ModelProfileOwnershipMarker | undefined {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+	const marker = value as Record<string, unknown>;
+	if (marker.kind === "inherit" || marker.kind === "cleared") {
+		return Object.keys(marker).length === 1 ? { kind: marker.kind } : undefined;
+	}
+	if (marker.kind === "profile" && typeof marker.profile === "string" && marker.profile.trim() !== "") {
+		return Object.keys(marker).length === 2 ? { kind: "profile", profile: marker.profile } : undefined;
+	}
+	return undefined;
+}
+
+export function validateDurableModelProfileOwnership(value: unknown): DurableModelProfileOwnership | undefined {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+	const record = value as Record<string, unknown>;
+	const marker = validateModelProfileOwnershipMarker(record.marker);
+	if (
+		record.schemaVersion !== 1 ||
+		!Number.isSafeInteger(record.version) ||
+		(record.version as number) < 0 ||
+		!marker ||
+		Object.keys(record).some(key => !["schemaVersion", "version", "marker"].includes(key))
+	) {
+		return undefined;
+	}
+	return { schemaVersion: 1, version: record.version as number, marker };
+}
+
+function markersEqual(left: ModelProfileOwnershipMarker, right: ModelProfileOwnershipMarker): boolean {
+	if (left.kind !== right.kind) return false;
+	return left.kind !== "profile" || (right.kind === "profile" && left.profile === right.profile);
+}
+
+function rawValueAtPath(raw: Readonly<Record<string, unknown>>, path: string): unknown {
+	const dotted = raw[path];
+	if (dotted !== undefined) return dotted;
+	let current: unknown = raw;
+	for (const segment of path.split(".")) {
+		if (!current || typeof current !== "object" || Array.isArray(current)) return undefined;
+		current = (current as Record<string, unknown>)[segment];
+	}
+	return current;
+}
+
+function extraPatchesAlreadyApplied(
+	current: Readonly<Record<string, unknown>>,
+	patches: readonly SettingsAtomicPatch[],
+): boolean {
+	return patches.every(patch => {
+		const actual = rawValueAtPath(current, patch.path);
+		return patch.op === "unset" ? actual === undefined : util.isDeepStrictEqual(actual, patch.value);
+	});
+}
+
+function assertLegacyDefaultMatchesOwnership(marker: ModelProfileOwnershipMarker, legacyProfile: unknown): void {
+	const expected = marker.kind === "profile" ? marker.profile : undefined;
+	if (legacyProfile !== expected) throw new InvalidModelProfileOwnershipError();
+}
+
+export class InvalidModelProfileOwnershipError extends Error {
+	readonly code = "model_profile_ownership_invalid";
+
+	constructor() {
+		super("Persisted model-profile ownership state is invalid; refusing to infer an owner.");
+		this.name = "InvalidModelProfileOwnershipError";
+	}
+}
+
+export class UnresolvedModelProfileOwnershipError extends Error {
+	readonly code = "model_profile_unresolved";
+
+	constructor(readonly profileName: string) {
+		super(
+			`Model profile "${profileName}" is referenced by this session but no longer exists. Choose a replacement profile explicitly.`,
+		);
+		this.name = "UnresolvedModelProfileOwnershipError";
+	}
+}
+
+export class ModelProfileReplacementRequiredError extends Error {
+	readonly code = "model_profile_replacement_required";
+
+	constructor(readonly profileName: string) {
+		super(`Choose a replacement profile before deleting the active profile "${profileName}".`);
+		this.name = "ModelProfileReplacementRequiredError";
+	}
+}
+
+export class ModelProfileOwnershipConflictError extends Error {
+	readonly code = "model_profile_ownership_conflict";
+
+	constructor(
+		readonly expectedVersion: number,
+		readonly actualVersion: number,
+		readonly actualMarker?: ModelProfileOwnershipMarker,
+	) {
+		super(
+			`Model-profile ownership changed concurrently (expected version ${expectedVersion}, found ${actualVersion}).`,
+		);
+		this.name = "ModelProfileOwnershipConflictError";
+	}
+}
+
+export class ModelProfileApplyCommittedError extends Error {
+	readonly code = "model_profile_apply_committed";
+
+	constructor(
+		readonly profileName: string,
+		readonly committedVersion: number,
+		cause: unknown,
+	) {
+		super(
+			`Model-profile ownership for "${profileName}" was durably committed at version ${committedVersion}, but could not be applied. The requesting session is fail-closed; the durable version was not compensated.`,
+			{ cause },
+		);
+		this.name = "ModelProfileApplyCommittedError";
+	}
+}
+
+export interface ProfileOwnershipChangedEvent {
+	type: "profile_ownership_changed";
+	transitionId: string;
+	source: "session" | "durable" | "recovery";
+	oldMarker: ModelProfileOwnershipMarker;
+	newMarker: ModelProfileOwnershipMarker;
+	oldSessionId: string;
+	sessionId: string;
+	observedDurableVersion: number;
+	committedDurableVersion?: number;
+	outcome: "committed" | "failed" | "reconciled";
+}
+
+export function readDurableModelProfileOwnership(
+	settings: ModelProfileOwnershipSettings,
+): DurableModelProfileOwnership {
+	const configured = settings.getGlobal("modelProfile.ownership");
+	if (configured !== undefined) {
+		const validated = validateDurableModelProfileOwnership(configured);
+		if (!validated) throw new InvalidModelProfileOwnershipError();
+		assertLegacyDefaultMatchesOwnership(validated.marker, settings.getGlobal("modelProfile.default"));
+		return validated;
+	}
+	const legacyProfile = settings.getGlobal("modelProfile.default");
+	return {
+		schemaVersion: 1,
+		version: 0,
+		marker:
+			typeof legacyProfile === "string" && legacyProfile.trim() !== ""
+				? { kind: "profile", profile: legacyProfile }
+				: { kind: "inherit" },
+	};
+}
+
+export function readDurableModelProfileOwnershipFromRaw(
+	raw: Readonly<Record<string, unknown>>,
+): DurableModelProfileOwnership {
+	const configured = rawValueAtPath(raw, "modelProfile.ownership");
+	if (configured !== undefined) {
+		const validated = validateDurableModelProfileOwnership(configured);
+		if (!validated) throw new InvalidModelProfileOwnershipError();
+		assertLegacyDefaultMatchesOwnership(validated.marker, rawValueAtPath(raw, "modelProfile.default"));
+		return validated;
+	}
+	const legacyProfile = rawValueAtPath(raw, "modelProfile.default");
+	return {
+		schemaVersion: 1,
+		version: 0,
+		marker:
+			typeof legacyProfile === "string" && legacyProfile.trim() !== ""
+				? { kind: "profile", profile: legacyProfile }
+				: { kind: "inherit" },
+	};
+}
+
+export function resolveEffectiveModelProfileMarker(
+	sessionMarker: ModelProfileOwnershipMarker | undefined,
+	durable: DurableModelProfileOwnership,
+): ModelProfileOwnershipMarker {
+	const session = sessionMarker ?? { kind: "inherit" as const };
+	return session.kind === "inherit" ? durable.marker : session;
+}
+
+export function resolveOwnedModelProfileName(
+	marker: ModelProfileOwnershipMarker,
+	profiles: ReadonlyMap<string, unknown>,
+): string | undefined {
+	if (marker.kind !== "profile") return undefined;
+	const resolvedName = resolveModelProfileName(marker.profile, profiles);
+	if (!profiles.has(resolvedName)) throw new UnresolvedModelProfileOwnershipError(marker.profile);
+	return resolvedName;
+}
+
+export function nextDurableModelProfileOwnership(
+	current: DurableModelProfileOwnership,
+	marker: ModelProfileOwnershipMarker,
+): DurableModelProfileOwnership {
+	if (current.version === Number.MAX_SAFE_INTEGER)
+		throw new RangeError("Model-profile ownership version is exhausted.");
+	return { schemaVersion: 1, version: current.version + 1, marker };
+}
+
+export async function commitDurableModelProfileOwnershipWithResult(
+	settings: DurableModelProfileOwnershipStore,
+	marker: ModelProfileOwnershipMarker,
+	extraPatches: readonly SettingsAtomicPatch[] = [],
+	validateCurrent?: () => Promise<void> | void,
+	observedOwnership?: DurableModelProfileOwnership,
+): Promise<DurableModelProfileOwnershipCommit> {
+	const requestedMarker = validateModelProfileOwnershipMarker(marker);
+	if (!requestedMarker) throw new InvalidModelProfileOwnershipError();
+	if (extraPatches.some(patch => OWNERSHIP_PROJECTION_PATHS.has(patch.path))) {
+		throw new Error("Durable ownership extra patches cannot target modelProfile.ownership or modelProfile.default.");
+	}
+	const expected = observedOwnership ?? readDurableModelProfileOwnership(settings);
+	let result = expected;
+	let wrote = false;
+	await settings.commitAtomicBatchWithCurrent(async current => {
+		const actual = readDurableModelProfileOwnershipFromRaw(current);
+		if (actual.version !== expected.version || !markersEqual(actual.marker, expected.marker)) {
+			throw new ModelProfileOwnershipConflictError(expected.version, actual.version, actual.marker);
+		}
+		await validateCurrent?.();
+		if (
+			actual.version > 0 &&
+			markersEqual(actual.marker, requestedMarker) &&
+			extraPatchesAlreadyApplied(current, extraPatches)
+		) {
+			result = actual;
+			return [];
+		}
+		result = nextDurableModelProfileOwnership(actual, requestedMarker);
+		wrote = true;
+		return [
+			{ path: "modelProfile.ownership", op: "set", value: result },
+			requestedMarker.kind === "profile"
+				? { path: "modelProfile.default", op: "set", value: requestedMarker.profile }
+				: { path: "modelProfile.default", op: "unset" },
+			...extraPatches,
+		];
+	});
+	return { ownership: result, wrote };
+}
+
+export async function commitDurableModelProfileOwnership(
+	settings: DurableModelProfileOwnershipStore,
+	marker: ModelProfileOwnershipMarker,
+	extraPatches: readonly SettingsAtomicPatch[] = [],
+	validateCurrent?: () => Promise<void> | void,
+	observedOwnership?: DurableModelProfileOwnership,
+): Promise<DurableModelProfileOwnership> {
+	return (
+		await commitDurableModelProfileOwnershipWithResult(
+			settings,
+			marker,
+			extraPatches,
+			validateCurrent,
+			observedOwnership,
+		)
+	).ownership;
+}
+
+export function modelProfileOwnershipMarkersEqual(
+	left: ModelProfileOwnershipMarker | undefined,
+	right: ModelProfileOwnershipMarker | undefined,
+): boolean {
+	return markersEqual(left ?? { kind: "inherit" }, right ?? { kind: "inherit" });
+}

package/src/config/model-registry.ts

@@ -87,6 +87,11 @@ import {
 	refreshModelPresetRegistry,
 	refreshModelPresetRegistryInBackground,
 } from "./model-preset-registry";
+import {
+	ModelProfileReplacementRequiredError,
+	readDurableModelProfileOwnershipFromRaw,
+	UnresolvedModelProfileOwnershipError,
+} from "./model-profile-ownership";
 
 export type { ProviderDiscoveryState, ProviderDiscoveryStatus } from "./model-discovery-manager";
 
@@ -1747,6 +1752,7 @@ export class ModelRegistry {
 	#configError: ConfigError | undefined = undefined;
 	#modelsConfigFile: ConfigFile<ModelsConfig>;
 	#settings: Pick<Settings, "get" | "getGlobal">;
+	#ownershipSettings: Pick<Settings, "commitAtomicBatchWithCurrent"> | undefined;
 	readonly #authStorageConfigOwner: object = {};
 	#disposeAuthStorageFallbackResolver: (() => void) | undefined;
 	#lastStaticLoadMtime: number | null = null;
@@ -1795,10 +1801,15 @@ export class ModelRegistry {
 	constructor(
 		readonly authStorage: AuthStorage,
 		modelsPath?: string,
-		registrySettings?: Pick<Settings, "get" | "getGlobal">,
+		registrySettings?: Pick<Settings, "get" | "getGlobal"> & Partial<Pick<Settings, "commitAtomicBatchWithCurrent">>,
 		modelPresetRegistryDependencies: ModelPresetRegistryDependencies = {},
 	) {
 		this.#settings = registrySettings ?? settings;
+		this.#ownershipSettings = registrySettings
+			? typeof registrySettings.commitAtomicBatchWithCurrent === "function"
+				? (registrySettings as Pick<Settings, "commitAtomicBatchWithCurrent">)
+				: undefined
+			: settings;
 		const configuredAgentDir = path.resolve(modelPresetRegistryDependencies.agentDir ?? getAgentDir());
 		this.#modelsConfigFile = ModelsConfigFile.relocate(modelsPath);
 		this.#modelPresetRegistryAgentDir = modelPresetRegistryDependencies.agentDir
@@ -3005,6 +3016,18 @@ export class ModelRegistry {
 		return new Map(this.#modelProfiles);
 	}
 
+	assertCurrentModelProfileExists(name: string): void {
+		const loaded = this.#modelsConfigFile.tryLoad();
+		if (loaded.status === "error") {
+			throw new Error(
+				`Cannot validate durable model-profile ownership because ${this.#modelsConfigFile.path()} is invalid.`,
+			);
+		}
+		if (mergeModelProfiles(loaded.value?.profiles).has(name)) return;
+		if (this.#modelProfiles.get(name)?.source === "registry") return;
+		throw new UnresolvedModelProfileOwnershipError(name);
+	}
+
 	getModelProfile(name: string): ModelProfileDefinition | undefined {
 		return this.#modelProfiles.get(name);
 	}
@@ -3090,20 +3113,36 @@ export class ModelRegistry {
 	async deleteCustomModelProfile(name: string): Promise<ModelProfileConfig> {
 		const normalizedName = name.trim();
 		if (!normalizedName) throw new Error("Profile name is required.");
-		const { current, profile } = this.#loadCustomProfileForMutation(normalizedName, "delete");
-		const nextProfiles = { ...(current.profiles ?? {}) };
-		delete nextProfiles[normalizedName];
-		const checkedConfig = ModelsConfigSchema.safeParse({
-			...current,
-			profiles: Object.keys(nextProfiles).length > 0 ? nextProfiles : undefined,
+		const ownershipSettings = this.#ownershipSettings;
+		if (!ownershipSettings) {
+			throw new Error("Profile deletion requires a settings store with ownership transaction support.");
+		}
+		let deletedProfile: ModelProfileConfig | undefined;
+		await ownershipSettings.commitAtomicBatchWithCurrent(async currentSettings => {
+			const durableOwnership = readDurableModelProfileOwnershipFromRaw(currentSettings);
+			if (durableOwnership.marker.kind === "profile" && durableOwnership.marker.profile === normalizedName) {
+				throw new ModelProfileReplacementRequiredError(normalizedName);
+			}
+			const { current, profile } = this.#loadCustomProfileForMutation(normalizedName, "delete");
+			const nextProfiles = { ...(current.profiles ?? {}) };
+			delete nextProfiles[normalizedName];
+			const checkedConfig = ModelsConfigSchema.safeParse({
+				...current,
+				profiles: Object.keys(nextProfiles).length > 0 ? nextProfiles : undefined,
+			});
+			if (!checkedConfig.success) {
+				const first = checkedConfig.error.issues[0];
+				const where = first?.path.length ? `/${first.path.map(String).join("/")}` : "root";
+				throw new Error(
+					`Generated models config is invalid at ${where}: ${first?.message ?? "unknown schema error"}`,
+				);
+			}
+			await this.#writeCheckedModelsConfig(checkedConfig.data);
+			deletedProfile = profile;
+			return [];
 		});
-		if (!checkedConfig.success) {
-			const first = checkedConfig.error.issues[0];
-			const where = first?.path.length ? `/${first.path.map(String).join("/")}` : "root";
-			throw new Error(`Generated models config is invalid at ${where}: ${first?.message ?? "unknown schema error"}`);
-		}
-		await this.#writeCheckedModelsConfig(checkedConfig.data);
-		return profile;
+		if (!deletedProfile) throw new Error(`Model profile "${normalizedName}" was not deleted.`);
+		return deletedProfile;
 	}
 
 	#loadCustomProfileForMutation(

package/src/config/settings-schema.ts

@@ -16,6 +16,7 @@ import {
 	validateAutoroutingProvenance,
 	validateAutoroutingSetup,
 } from "./autorouting-contract";
+import { type DurableModelProfileOwnership, validateDurableModelProfileOwnership } from "./model-profile-ownership";
 import type { ModelSelectorValue } from "./model-selector-value";
 import { UPDATE_CHANNELS } from "./update-channel";
 
@@ -369,6 +370,42 @@ const AUTOROUTING_PROVENANCE_JSON_SCHEMA: JsonSchemaObject = {
 	required: ["schema", "source", "declarationFingerprint", "tiersFingerprint"],
 };
 
+const MODEL_PROFILE_OWNERSHIP_JSON_SCHEMA: JsonSchemaObject = {
+	type: "object",
+	properties: {
+		schemaVersion: { type: "integer", const: 1 },
+		version: { type: "integer", minimum: 0, maximum: Number.MAX_SAFE_INTEGER },
+		marker: {
+			type: "object",
+			oneOf: [
+				{
+					type: "object",
+					properties: { kind: { type: "string", const: "inherit" } },
+					required: ["kind"],
+					additionalProperties: false,
+				},
+				{
+					type: "object",
+					properties: { kind: { type: "string", const: "cleared" } },
+					required: ["kind"],
+					additionalProperties: false,
+				},
+				{
+					type: "object",
+					properties: {
+						kind: { type: "string", const: "profile" },
+						profile: { type: "string", minLength: 1 },
+					},
+					required: ["kind", "profile"],
+					additionalProperties: false,
+				},
+			],
+		},
+	},
+	required: ["schemaVersion", "version", "marker"],
+	additionalProperties: false,
+};
+
 // SDK prompt deadline defaults. The `sdk.promptDeadlineMs` /
 // `sdk.promptMaxRuntimeMs` schema entries below and the SDK bus/host lease
 // fallbacks read these same constants, so a Settings lookup that misses — no
@@ -684,6 +721,23 @@ export const SETTINGS_SCHEMA = {
 			options: "runtime",
 		},
 	},
+	"modelProfile.ownership": {
+		type: "optional-object",
+		default: undefined,
+		jsonSchema: MODEL_PROFILE_OWNERSHIP_JSON_SCHEMA,
+		validate: (value: unknown) =>
+			validateDurableModelProfileOwnership(value)
+				? []
+				: [
+						{
+							path: "modelProfile.ownership",
+							code: "config_invalid",
+							reason: "config_invalid",
+							detail: "Expected a versioned ownership record with a valid inherit, cleared, or profile marker.",
+						},
+					],
+		_value: undefined as unknown as DurableModelProfileOwnership,
+	},
 	"modelProfile.proxyProvider": {
 		type: "string",
 		default: undefined,
@@ -3636,6 +3690,25 @@ export const SETTINGS_SCHEMA = {
 				"Encourage the agent to delegate work to subagents unless changes are trivial (on by default when executor/planner run on a different provider than the default role)",
 		},
 	},
+	"task.delegationHint.mode": {
+		type: "enum",
+		values: ["off", "hint"] as const,
+		default: "off",
+		ui: {
+			tab: "tasks",
+			label: "Delegation Decision Hint",
+			description:
+				"Opt in to transient local-only Kev advice after observable edit activity. Notices never alter prompts, task arguments, or saved sessions.",
+			options: [
+				{ value: "off", label: "Off", description: "Do not request decision hints (default)" },
+				{
+					value: "hint",
+					label: "Hint",
+					description: "Show ephemeral user-facing advice from the local Kev service",
+				},
+			],
+		},
+	},
 
 	"task.simple": {
 		type: "enum",
@@ -4303,6 +4376,14 @@ export function validateSettingPatch(patch: Record<string, unknown>): Array<{ pa
 	const issues: Array<{ path: string; detail: string }> = [];
 	const knownPaths = new Set(Object.keys(SETTINGS_SCHEMA));
 	for (const [path, value] of Object.entries(patch)) {
+		// Keep the legacy projection writable until every durable writer uses ownership CAS.
+		if (path === "modelProfile.ownership") {
+			issues.push({
+				path,
+				detail: "The versioned model-profile ownership record is internal and cannot be patched generically.",
+			});
+			continue;
+		}
 		const definition = SETTINGS_SCHEMA[path as SettingPath];
 		if (!definition) {
 			const recordParent = [...knownPaths].find(known => known !== path && path.startsWith(`${known}.`));