@gajae-code/coding-agent 0.17.6 → 0.17.7

package/src/sdk/session.ts

@@ -236,6 +236,9 @@ import {
 
 export type { AutomationToolName, AutomationTools } from "../tools";
 
+const MAX_STARTUP_CREDENTIAL_DISABLED_EVENT_BUFFER = 32;
+const startupCredentialDisabledEventsByAuthStorage = new WeakMap<AuthStorage, CredentialDisabledEvent[]>();
+
 type AsyncResultEntry = {
 	jobId: string;
 	generation: string;
@@ -753,17 +756,7 @@ export async function discoverAuthStorage(
 			sourceLabel: `broker ${brokerConfig.url}`,
 			credentialRankingMode,
 		});
-		try {
-			await storage.reload();
-		} catch (error) {
-			try {
-				storage.close();
-			} catch {
-				// Preserve the initial reload failure.
-			}
-			throw error;
-		}
-		return storage;
+		return await reloadDiscoveredAuthStorage(storage);
 	}
 	const dbPath = getAgentDbPath(agentDir);
 	const storage = await AuthStorage.create(dbPath, {
@@ -771,13 +764,17 @@ export async function discoverAuthStorage(
 		sourceLabel: `local ${dbPath}`,
 		credentialRankingMode,
 	});
+	return await reloadDiscoveredAuthStorage(storage);
+}
+
+async function reloadDiscoveredAuthStorage(storage: AuthStorage): Promise<AuthStorage> {
 	try {
 		await storage.reload();
 	} catch (error) {
 		try {
 			storage.close();
-		} catch {
-			// Preserve the initial reload failure.
+		} catch (cleanupError) {
+			throw attachStartupCleanupDiagnostic(error, cleanupError);
 		}
 		throw error;
 	}
@@ -1396,6 +1393,31 @@ function attachMcpCleanupDiagnostic(primary: unknown, cleanup: unknown): unknown
 	return new McpManagerCleanupDiagnosticError(primary, cleanup);
 }
 
+function attachStartupCleanupDiagnostic(primary: unknown, cleanup: unknown): unknown {
+	const diagnostic = { code: "STARTUP_RESOURCE_CLEANUP_FAILED" as const, cause: cleanup };
+	if (primary && (typeof primary === "object" || typeof primary === "function")) {
+		try {
+			Object.defineProperty(primary, "startupCleanupDiagnostic", {
+				value: diagnostic,
+				enumerable: false,
+				configurable: true,
+			});
+			if ((primary as { startupCleanupDiagnostic?: unknown }).startupCleanupDiagnostic === diagnostic)
+				if ((primary as { startupCleanupDiagnostic?: unknown }).startupCleanupDiagnostic === diagnostic)
+					return primary;
+		} catch {
+			// Frozen or hostile proxy errors retain their original message in this typed wrapper.
+		}
+	}
+	const wrapped = new AggregateError([primary, cleanup], safeErrorDescription(primary), { cause: primary });
+	Object.defineProperty(wrapped, "startupCleanupDiagnostic", {
+		value: diagnostic,
+		enumerable: false,
+		configurable: true,
+	});
+	return wrapped;
+}
+
 function findExactMcpToolNameCollisions(
 	exactMcpToolNames: readonly string[],
 	catalogToolNames: Iterable<string>,
@@ -1540,29 +1562,161 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 	// / session would silently miss credential_disabled events.
 	// Injected auth is the caller's authority. Only the CLI root can hand off its
 	// explicit startup snapshot; never discover global config for injected SDK auth.
-	const startupAuthConfig = hasInjectedAuth
-		? options.modelRegistryStartupMutation?.owner === "cli-root"
-			? options.startupAuthConfig
-			: undefined
-		: (options.startupAuthConfig ?? (await resolveStartupAuthConfig(agentDir)));
 	const ownsModelRegistry = options.modelRegistry === undefined;
 	const ownsAuthStorage = options.modelRegistry === undefined && options.authStorage === undefined;
-	const modelRegistry =
-		options.modelRegistry ??
-		new ModelRegistry(
-			options.authStorage ??
-				(await logger.time("discoverModels", () => discoverAuthStorage(agentDir, startupAuthConfig))),
-			path.join(agentDir, "models.yml"),
-			undefined,
-			{ agentDir },
-		);
-	const authStorage = modelRegistry.authStorage;
-	const authStorageOwner = modelRegistry.getAuthStorageOwner();
-	if (options.authStorage && options.authStorage !== authStorage) {
+	const ownsScopedSettings = options.settings === undefined;
+	if (options.modelRegistry && options.authStorage && options.authStorage !== options.modelRegistry.authStorage) {
 		throw new Error(
 			"options.authStorage and options.modelRegistry.authStorage must be the same instance when both are provided",
 		);
 	}
+	const settingsPromise =
+		options.settings === undefined
+			? logger.time("settings", Settings.loadForScope, { cwd, agentDir })
+			: Promise.resolve(options.settings);
+	type StartupValue<T> = { ok: true; value: T } | { ok: false; error: unknown };
+	const captureStartupValue = <T>(pending: Promise<T>): Promise<StartupValue<T>> =>
+		pending.then(
+			value => ({ ok: true as const, value }),
+			error => ({ ok: false as const, error }),
+		);
+	const settingsOutcome = captureStartupValue(settingsPromise);
+	const startupAuthConfigPromise = Promise.resolve(
+		hasInjectedAuth
+			? options.modelRegistryStartupMutation?.owner === "cli-root"
+				? options.startupAuthConfig
+				: undefined
+			: (options.startupAuthConfig ?? resolveStartupAuthConfig(agentDir)),
+	);
+	const startupAuthConfigOutcome = captureStartupValue(startupAuthConfigPromise);
+	const authStoragePromise = options.modelRegistry
+		? Promise.resolve(options.modelRegistry.authStorage)
+		: options.authStorage
+			? Promise.resolve(options.authStorage)
+			: startupAuthConfigPromise.then(startupAuthConfig =>
+					logger.time("discoverModels", () => discoverAuthStorage(agentDir, startupAuthConfig)),
+				);
+	const authStorageOutcome = captureStartupValue(authStoragePromise);
+	const discoveredAuthStorage = await authStorageOutcome;
+	if (!discoveredAuthStorage.ok) {
+		const loadedSettings = await settingsOutcome;
+		const cleanupErrors: unknown[] = [];
+		if (loadedSettings.ok && ownsScopedSettings) {
+			try {
+				await loadedSettings.value.close();
+			} catch (cleanupError) {
+				cleanupErrors.push(cleanupError);
+			}
+			try {
+				releaseSettingsScope(loadedSettings.value);
+			} catch (cleanupError) {
+				cleanupErrors.push(cleanupError);
+			}
+		}
+		if (cleanupErrors.length > 0)
+			throw attachStartupCleanupDiagnostic(
+				discoveredAuthStorage.error,
+				new AggregateError(cleanupErrors, "Failed to release scoped settings after auth storage setup failure."),
+			);
+		throw discoveredAuthStorage.error;
+	}
+	const authStorage = discoveredAuthStorage.value;
+	const startupCredentialDisabledEvents = startupCredentialDisabledEventsByAuthStorage.get(authStorage) ?? [];
+	startupCredentialDisabledEventsByAuthStorage.delete(authStorage);
+	const preserveCredentialDisabledEventsForRetry = (): void => {
+		if (ownsAuthStorage || startupCredentialDisabledEvents.length === 0) return;
+		const pending = startupCredentialDisabledEventsByAuthStorage.get(authStorage) ?? [];
+		pending.push(...startupCredentialDisabledEvents.splice(0));
+		if (pending.length > MAX_STARTUP_CREDENTIAL_DISABLED_EVENT_BUFFER)
+			pending.splice(0, pending.length - MAX_STARTUP_CREDENTIAL_DISABLED_EVENT_BUFFER);
+		startupCredentialDisabledEventsByAuthStorage.set(authStorage, pending);
+	};
+	let credentialDisabledTarget: ExtensionRunner | undefined;
+	let unsubscribeCredentialDisabled: (() => void) | undefined;
+	const releaseCredentialDisabledSubscription = (): void => {
+		const unsubscribe = unsubscribeCredentialDisabled;
+		unsubscribeCredentialDisabled = undefined;
+		unsubscribe?.();
+	};
+	const failInitialSetup = async (primary: unknown, scopedSettings?: Settings): Promise<never> => {
+		const cleanupErrors: unknown[] = [];
+		preserveCredentialDisabledEventsForRetry();
+		try {
+			releaseCredentialDisabledSubscription();
+		} catch (cleanupError) {
+			cleanupErrors.push(cleanupError);
+		}
+		if (scopedSettings && ownsScopedSettings) {
+			try {
+				await scopedSettings.close();
+			} catch (cleanupError) {
+				cleanupErrors.push(cleanupError);
+			}
+			try {
+				releaseSettingsScope(scopedSettings);
+			} catch (cleanupError) {
+				cleanupErrors.push(cleanupError);
+			}
+		}
+		if (ownsAuthStorage) {
+			try {
+				authStorage.close();
+			} catch (cleanupError) {
+				cleanupErrors.push(cleanupError);
+			}
+		}
+		if (cleanupErrors.length > 0)
+			throw attachStartupCleanupDiagnostic(
+				primary,
+				new AggregateError(cleanupErrors, "Failed to release resources after initial session setup failure."),
+			);
+		throw primary;
+	};
+	// Subscribe before owned-registry construction as its first catalog pass may
+	// probe credentials. Preserve the listener cleanup contract if scoped settings
+	// loading fails after the storage has been acquired.
+	try {
+		unsubscribeCredentialDisabled = authStorage.onCredentialDisabled(event => {
+			if (credentialDisabledTarget) {
+				void credentialDisabledTarget.emitCredentialDisabled(event);
+			} else {
+				startupCredentialDisabledEvents.push(event);
+			}
+		});
+	} catch (error) {
+		const settingsAfterSubscriptionFailure = await settingsOutcome;
+		if (!settingsAfterSubscriptionFailure.ok)
+			return await failInitialSetup(
+				new AggregateError(
+					[error, settingsAfterSubscriptionFailure.error],
+					"Credential listener registration and scoped settings initialization both failed.",
+				),
+			);
+		return await failInitialSetup(error, settingsAfterSubscriptionFailure.value);
+	}
+	const settingsResult = await settingsOutcome;
+	if (!settingsResult.ok) return await failInitialSetup(settingsResult.error);
+	const settings = settingsResult.value;
+	const closeOwnedSettings = async (): Promise<void> => {
+		if (!ownsScopedSettings) return;
+		try {
+			await settings.close();
+		} finally {
+			releaseSettingsScope(settings);
+		}
+	};
+	const startupAuthConfigResult = await startupAuthConfigOutcome;
+	if (!startupAuthConfigResult.ok) return await failInitialSetup(startupAuthConfigResult.error, settings);
+	const startupAuthConfig = startupAuthConfigResult.value;
+	let modelRegistry: ModelRegistry;
+	try {
+		modelRegistry =
+			options.modelRegistry ??
+			new ModelRegistry(authStorage, path.join(agentDir, "models.yml"), settings, { agentDir });
+	} catch (error) {
+		return await failInitialSetup(error, settings);
+	}
+	const authStorageOwner = modelRegistry.getAuthStorageOwner();
 
 	let agent: Agent;
 	let sessionAgent: Agent | undefined;
@@ -1622,22 +1776,34 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 	let authStorageClosed = false;
 	let credentialScopeId: string | undefined;
 	let credentialScopeLeased = false;
-	let closeOwnedSettings: () => Promise<void> = async () => {};
 	const closeOwnedAuthStorage = async (): Promise<void> => {
-		if (ownsModelRegistry) await modelRegistry.dispose();
+		const cleanupErrors: unknown[] = [];
+		if (ownsModelRegistry) {
+			try {
+				await modelRegistry.dispose();
+			} catch (error) {
+				cleanupErrors.push(error);
+			}
+		}
 		if (!hasSession && credentialScopeLeased && credentialScopeId) {
-			authStorage.releaseCredentialScope(credentialScopeId);
-			credentialScopeLeased = false;
+			try {
+				authStorage.releaseCredentialScope(credentialScopeId);
+				credentialScopeLeased = false;
+			} catch (error) {
+				cleanupErrors.push(error);
+			}
 		}
-		if (!ownsAuthStorage || authStorageClosed) return;
-		authStorageClosed = true;
-		authStorage.close();
-	};
-	let unsubscribeCredentialDisabled: (() => void) | undefined;
-	const releaseCredentialDisabledSubscription = (): void => {
-		const unsubscribe = unsubscribeCredentialDisabled;
-		unsubscribeCredentialDisabled = undefined;
-		unsubscribe?.();
+		if (ownsAuthStorage && !authStorageClosed) {
+			authStorageClosed = true;
+			try {
+				authStorage.close();
+			} catch (error) {
+				cleanupErrors.push(error);
+			}
+		}
+		if (cleanupErrors.length === 1) throw cleanupErrors[0];
+		if (cleanupErrors.length > 1)
+			throw new AggregateError(cleanupErrors, "Failed to close owned model registry and auth storage.");
 	};
 	let inheritedMcpToolsPublisher: ((tools: readonly CustomTool[]) => void) | undefined;
 	let inheritedMcpToolsUnsubscribe: (() => void) | undefined;
@@ -1649,36 +1815,11 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 	};
 
 	try {
-		// Subscribe before any getApiKey() call so startup model probes can't fire a
-		// credential_disabled event past us. An embedder's constructor handler makes the
-		// listener set non-empty from construction, which defeats AuthStorage's no-listener
-		// buffer — so we can't rely on it to catch startup events for the extension runner.
-		const startupCredentialDisabledEvents: CredentialDisabledEvent[] = [];
-		let credentialDisabledTarget: ExtensionRunner | undefined;
-		unsubscribeCredentialDisabled = authStorage.onCredentialDisabled(event => {
-			if (credentialDisabledTarget) {
-				// Discard return: any handler error is routed through runner.onError listeners.
-				void credentialDisabledTarget.emitCredentialDisabled(event);
-			} else {
-				startupCredentialDisabledEvents.push(event);
-			}
-		});
 		const applyCredentialSelector = (scopeId: string, provider: string, selector: AuthCredentialSelector): void => {
 			authStorage.setSessionCredentialSelector(scopeId, provider, selector, authStorageOwner);
 		};
-		const ownsScopedSettings = options.settings === undefined;
-		const settings = options.settings ?? (await logger.time("settings", Settings.loadForScope, { cwd, agentDir }));
-		if (ownsModelRegistry) modelRegistry.setScopedSettings(settings);
 		const autoroutingInactive =
 			settings.get("task.autorouting.enabled") === true && !settings.getEffectiveAutorouting().active;
-		closeOwnedSettings = async (): Promise<void> => {
-			if (!ownsScopedSettings) return;
-			try {
-				await settings.close();
-			} finally {
-				releaseSettingsScope(settings);
-			}
-		};
 		// Cwd-derived runtime state must follow a rescope (`move_session`, `/move`),
 		// so services resolve the LIVE session cwd per activation instead of
 		// capturing the launch root. Before the manager exists the launch cwd is the
@@ -5825,67 +5966,102 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			gjcRuntimeSnapshot: gjcRuntimeStore,
 		};
 	} catch (error) {
-		// Release the subscription if the throw happened after install but before the
-		// dispose-wrap took ownership.
-		stopInheritedMcpToolsSubscription();
-		releaseCredentialDisabledSubscription();
 		let cleanupDiagnostic: unknown;
-		try {
-			if (hasSession) {
+		let ownedMcpCleanupFailed = false;
+		let ownedMcpCleanupError: unknown;
+		const recordCleanupFailure = (cleanupError: unknown): void => {
+			cleanupDiagnostic =
+				cleanupDiagnostic === undefined
+					? cleanupError
+					: new AggregateError([cleanupDiagnostic, cleanupError], "Multiple startup cleanup operations failed.");
+		};
+		const attemptCleanup = async (
+			cleanup: () => void | Promise<void>,
+			onFailure?: (cleanupError: unknown) => void,
+		): Promise<void> => {
+			try {
+				await cleanup();
+			} catch (cleanupError) {
+				recordCleanupFailure(cleanupError);
+				onFailure?.(cleanupError);
+			}
+		};
+		// Release the subscription if the throw happened after install but before the
+		// dispose-wrap took ownership. Each independent cleanup still runs if another
+		// teardown reports an error, and every failure is retained for lifecycle proof.
+		if (!hasSession) preserveCredentialDisabledEventsForRetry();
+		await attemptCleanup(stopInheritedMcpToolsSubscription);
+		await attemptCleanup(releaseCredentialDisabledSubscription);
+		if (hasSession) {
+			await attemptCleanup(async () => {
 				try {
 					await session.dispose();
 				} catch (disposeError) {
-					if (!isSessionDisposalIncompleteError(disposeError)) {
-						throw disposeError;
-					}
+					if (!isSessionDisposalIncompleteError(disposeError)) throw disposeError;
 					// The first call is intentionally bounded for startup callers. Join the
 					// retained teardown before releasing the resources it still owns.
 					await session.awaitDisposeCompletion();
 				}
-			} else {
-				if (hasRegistered) agentRegistry.unregister(resolvedAgentId);
-				// Admission happens before session construction. Any later startup
-				// failure must eventually release THIS manager's endpoint mapping
-				// through disposal and restore the prior global only when this manager
-				// is still global: otherwise a retry under the same endpoint is falsely
-				// rejected and an orphan redirects global-manager consumers away from
-				// the live session (review thread P1).
-				if (asyncJobManagerOwned && asyncJobManager) {
-					if (asyncJobManagerAdmitted) {
-						if (AsyncJobManager.instance() === asyncJobManager) {
+			});
+		} else {
+			if (hasRegistered)
+				await attemptCleanup(() => {
+					agentRegistry.unregister(resolvedAgentId);
+				});
+			// Admission happens before session construction. Any later startup failure
+			// must release this manager's endpoint mapping; a failed restoration cannot
+			// prevent disposal of the owned manager or other startup resources.
+			if (asyncJobManagerOwned && asyncJobManager) {
+				const ownedAsyncJobManager = asyncJobManager;
+				if (asyncJobManagerAdmitted)
+					await attemptCleanup(() => {
+						if (AsyncJobManager.instance() === ownedAsyncJobManager)
 							AsyncJobManager.setInstance(priorAsyncJobManager);
-						}
-					}
-					await asyncJobManager.dispose({ timeoutMs: 100 });
-				}
-				await cleanupOwnedMcpManager?.();
-				const [{ disposeKernelSessionsByOwner }, { disposeVmContextsByOwner }] = await Promise.all([
-					import("../eval/py/executor"),
-					import("../eval/js/context-manager"),
-				]);
-				await disposeKernelSessionsByOwner(evalKernelOwnerId);
-				await disposeVmContextsByOwner(evalKernelOwnerId);
-				await closeOwnedSettings();
+					});
+				await attemptCleanup(async () => {
+					await ownedAsyncJobManager.dispose({ timeoutMs: 100 });
+				});
 			}
-		} catch (cleanupError) {
-			cleanupDiagnostic = cleanupError;
+			if (cleanupOwnedMcpManager)
+				await attemptCleanup(cleanupOwnedMcpManager, cleanupError => {
+					ownedMcpCleanupFailed = true;
+					ownedMcpCleanupError = cleanupError;
+				});
+			const evalCleanup = Promise.all([import("../eval/py/executor"), import("../eval/js/context-manager")]);
+			let evalCleanupModules: Awaited<typeof evalCleanup> | undefined;
+			try {
+				evalCleanupModules = await evalCleanup;
+			} catch (cleanupError) {
+				recordCleanupFailure(cleanupError);
+			}
+			if (evalCleanupModules) {
+				const [kernelExecutor, contextManager] = evalCleanupModules;
+				await attemptCleanup(() => kernelExecutor.disposeKernelSessionsByOwner(evalKernelOwnerId));
+				await attemptCleanup(() => contextManager.disposeVmContextsByOwner(evalKernelOwnerId));
+			}
+			await attemptCleanup(closeOwnedSettings);
+		}
+		if (processCwdClaimed)
+			await attemptCleanup(() => {
+				SessionManager.releaseProcessCwdOwnership(sessionManager);
+				processCwdClaimed = false;
+			});
+		await attemptCleanup(releaseLocalProtocolOverride);
+		await attemptCleanup(closeOwnedAuthStorage);
+		if (cleanupDiagnostic !== undefined) {
 			logger.warn("Failed to clean up createAgentSession resources after startup error", {
 				error: safeErrorForLog(error),
-				cleanupDiagnostic: safeCleanupDiagnosticForLog(cleanupDiagnostic),
+				cleanupDiagnostic: ownedMcpCleanupFailed
+					? safeCleanupDiagnosticForLog({ code: "MCP_MANAGER_CLEANUP_FAILED", cause: ownedMcpCleanupError })
+					: safeErrorForLog(cleanupDiagnostic),
 			});
-		} finally {
-			if (processCwdClaimed) {
-				SessionManager.releaseProcessCwdOwnership(sessionManager);
-				processCwdClaimed = false;
-			}
-			releaseLocalProtocolOverride();
-			try {
-				await closeOwnedAuthStorage();
-			} catch (authCleanupError) {
-				logger.warn("Failed to close owned auth storage after startup error", { error: authCleanupError });
+			if (ownedMcpCleanupFailed) {
+				const withMcpCleanupDiagnostic = attachMcpCleanupDiagnostic(error, ownedMcpCleanupError);
+				if (cleanupDiagnostic === ownedMcpCleanupError) throw withMcpCleanupDiagnostic;
+				throw attachStartupCleanupDiagnostic(withMcpCleanupDiagnostic, cleanupDiagnostic);
 			}
+			throw attachStartupCleanupDiagnostic(error, cleanupDiagnostic);
 		}
-		if (cleanupDiagnostic !== undefined) throw attachMcpCleanupDiagnostic(error, cleanupDiagnostic);
 		throw error;
 	}
 }

package/src/sdk/startup-capability.ts

@@ -177,8 +177,9 @@ export class SdkStartupCapability {
 		return this.#cancelled;
 	}
 
-	cancel(): void {
+	cancel(failure?: SdkStartupFailure): void {
 		this.#cancelled = true;
+		if (failure) this.settleFailure(failure);
 	}
 
 	/**