@gajae-code/coding-agent 0.18.12 → 0.19.0

package/src/modes/controllers/command-controller.ts

@@ -5,7 +5,7 @@ import { CompactionCancelledError, type CompactionOutcome } from "@gajae-code/ag
 import { getEnvApiKey, type ToolCall, type UsageLimit, type UsageReport } from "@gajae-code/ai/core";
 import type { ProviderDetails } from "@gajae-code/ai/provider-details";
 import { type Keybinding, Loader, Markdown, padding, Spacer, Text, visibleWidth } from "@gajae-code/tui";
-import { formatBytes, formatDuration, Snowflake, setProjectDir } from "@gajae-code/utils";
+import { formatBytes, formatDuration, setProjectDir } from "@gajae-code/utils";
 import { canonicalEnvKey, projectEnvSnapshot } from "@gajae-code/utils/env-file";
 import { resolveAppendOnlyMode } from "../../append-only-mode";
 import { jobElapsedMs } from "../../async";
@@ -48,6 +48,7 @@ import {
 	buildConversationTitleInput,
 	generateSessionTitle,
 	setSessionTerminalTitle,
+	titleInputObfuscator,
 } from "../../utils/title-generator";
 import { addChatChild, prepareTranscriptRebuild, syncPendingExecutionComponents } from "../utils/ui-helpers";
 
@@ -108,7 +109,117 @@ export function buildHelpMarkdown(keybindings: Pick<KeybindingsManager, "getAcce
 	].join("\n");
 }
 
-const GH_SHARE_DESTINATION_KEYS = ["GH_HOST", "GH_CONFIG_DIR"] as const;
+const GH_SHARE_TRUST_KEYS = [
+	"GH_HOST",
+	"GH_CONFIG_DIR",
+	"GH_TOKEN",
+	"GITHUB_TOKEN",
+	"GH_ENTERPRISE_TOKEN",
+	"GITHUB_ENTERPRISE_TOKEN",
+	"XDG_CONFIG_HOME",
+	"HOME",
+	"USERPROFILE",
+	"APPDATA",
+	"BASH_ENV",
+	"BUN_OPTIONS",
+	"ENV",
+	"ZDOTDIR",
+	"NODE_OPTIONS",
+	"NODE_PATH",
+	"PYTHONHOME",
+	"PYTHONPATH",
+	"PYTHONUSERBASE",
+	"PYTHONSTARTUP",
+	"JULIA_DEPOT_PATH",
+	"JULIA_LOAD_PATH",
+	"JULIA_PROJECT",
+	"TCL_LIBRARY",
+	"TCLLIBPATH",
+	"LUA_INIT",
+	"LUA_INIT_5_1",
+	"LUA_INIT_5_2",
+	"LUA_INIT_5_3",
+	"LUA_INIT_5_4",
+	"LUA_INIT_5_5",
+	"LUA_PATH",
+	"LUA_CPATH",
+	"LUA_PATH_5_1",
+	"LUA_PATH_5_2",
+	"LUA_PATH_5_3",
+	"LUA_PATH_5_4",
+	"LUA_PATH_5_5",
+	"LUA_CPATH_5_1",
+	"LUA_CPATH_5_2",
+	"LUA_CPATH_5_3",
+	"LUA_CPATH_5_4",
+	"LUA_CPATH_5_5",
+	"R_ENVIRON",
+	"R_ENVIRON_USER",
+	"R_PROFILE",
+	"R_PROFILE_USER",
+	"ELIXIR_ERL_OPTIONS",
+	"ERL_AFLAGS",
+	"ERL_FLAGS",
+	"ERL_ZFLAGS",
+	"BUNDLER_SETUP",
+	"BUNDLE_GEMFILE",
+	"GEM_HOME",
+	"GEM_PATH",
+	"RUBYGEMS_GEMDEPS",
+	"RUBYOPT",
+	"RUBYLIB",
+	"PERL5OPT",
+	"PERL5LIB",
+	"PERLLIB",
+	"JAVA_HOME",
+	"JAVA_TOOL_OPTIONS",
+	"JDK_JAVA_OPTIONS",
+	"_JAVA_OPTIONS",
+	"CLASSPATH",
+	"PHPRC",
+	"PHP_INI_SCAN_DIR",
+	"DOTNET_STARTUP_HOOKS",
+	"DOTNET_ROOT",
+	"DOTNET_ROOT_X86",
+	"DOTNET_ROOT_X64",
+	"DOTNET_ROOT_ARM",
+	"DOTNET_ROOT_ARM64",
+	"CORECLR_ENABLE_PROFILING",
+	"DOTNET_ENABLE_PROFILING",
+	"CORECLR_PROFILER",
+	"DOTNET_PROFILER",
+	"CORECLR_PROFILER_PATH",
+	"CORECLR_PROFILER_PATH_32",
+	"CORECLR_PROFILER_PATH_64",
+	"CORECLR_PROFILER_PATH_ARM32",
+	"CORECLR_PROFILER_PATH_ARM64",
+	"DOTNET_PROFILER_PATH",
+	"DOTNET_PROFILER_PATH_32",
+	"DOTNET_PROFILER_PATH_64",
+	"DOTNET_PROFILER_PATH_ARM32",
+	"DOTNET_PROFILER_PATH_ARM64",
+	"PATH",
+	"HTTP_PROXY",
+	"HTTPS_PROXY",
+	"ALL_PROXY",
+	"NO_PROXY",
+	"OPENSSL_CONF",
+	"OPENSSL_CONF_INCLUDE",
+	"OPENSSL_MODULES",
+	"OPENSSL_ENGINES",
+	"SSL_CERT_FILE",
+	"SSL_CERT_DIR",
+	"LD_PRELOAD",
+	"LD_LIBRARY_PATH",
+	"LD_AUDIT",
+	"DYLD_INSERT_LIBRARIES",
+	"DYLD_LIBRARY_PATH",
+	"DYLD_FRAMEWORK_PATH",
+	"DYLD_FALLBACK_LIBRARY_PATH",
+	"DYLD_FALLBACK_FRAMEWORK_PATH",
+	"DYLD_ROOT_PATH",
+] as const;
+const GH_SHARE_TRUST_KEY_SET = new Set(GH_SHARE_TRUST_KEYS.map(name => name.toUpperCase()));
 
 /**
  * Project dotenv at import, before `/move` changes cwd. Those declarations are
@@ -116,22 +227,101 @@ const GH_SHARE_DESTINATION_KEYS = ["GH_HOST", "GH_CONFIG_DIR"] as const;
  * remove them.
  */
 const ghShareProjectSnapshot = projectEnvSnapshot();
+const ghShareOperatorPath = process.env.PATH;
+const ghShareLaunchRoot = path.resolve(process.cwd());
+
+function isInsideDirectory(root: string, candidate: string): boolean {
+	const relative = path.relative(root, candidate);
+	return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+
+async function findCheckoutRoots(directory: string): Promise<string[] | undefined> {
+	const resolvedDirectory = await fs.realpath(directory).catch(() => undefined);
+	if (!resolvedDirectory) return undefined;
+	const roots: string[] = [];
+	let ancestor = resolvedDirectory;
+	while (true) {
+		try {
+			await fs.lstat(path.join(ancestor, ".git"));
+			roots.push(ancestor);
+		} catch (error) {
+			if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") return undefined;
+		}
+		const parent = path.dirname(ancestor);
+		if (parent === ancestor) break;
+		ancestor = parent;
+	}
+	return roots;
+}
+
+function isInsideAnyDirectory(roots: readonly string[], candidate: string): boolean {
+	return roots.some(root => isInsideDirectory(root, candidate));
+}
+
+async function resolveGhShareExecutable(): Promise<{ executable: string; searchPath: string } | undefined> {
+	const operatorPath = ghShareOperatorPath;
+	const key = canonicalEnvKey("PATH");
+	const declared = ghShareProjectSnapshot.values[key];
+	if (
+		!operatorPath ||
+		(declared !== undefined && (ghShareProjectSnapshot.dynamic.has(key) || declared.trim() === operatorPath.trim()))
+	)
+		return undefined;
+	const checkoutRoots = new Set<string>();
+	for (const directory of new Set([ghShareLaunchRoot, path.resolve(process.cwd())])) {
+		const roots = await findCheckoutRoots(directory);
+		if (!roots) return undefined;
+		for (const root of roots) checkoutRoots.add(root);
+	}
+	const untrustedDirectories = [...checkoutRoots];
+	const trustedDirectories: string[] = [];
+	const seenDirectories = new Set<string>();
+	let executable: string | undefined;
+	for (const directory of operatorPath.split(path.delimiter)) {
+		if (!path.isAbsolute(directory)) continue;
+		const absoluteDirectory = path.resolve(directory);
+		if (isInsideAnyDirectory(untrustedDirectories, absoluteDirectory)) continue;
+		const realDirectory = await fs.realpath(absoluteDirectory).catch(() => undefined);
+		if (
+			!realDirectory ||
+			isInsideAnyDirectory(untrustedDirectories, realDirectory) ||
+			seenDirectories.has(realDirectory)
+		)
+			continue;
+		const candidate = Bun.which("gh", { PATH: realDirectory });
+		if (candidate) {
+			const absoluteCandidate = path.resolve(candidate);
+			if (isInsideAnyDirectory(untrustedDirectories, absoluteCandidate)) continue;
+			const realExecutable = await fs.realpath(absoluteCandidate).catch(() => undefined);
+			if (!realExecutable || isInsideAnyDirectory(untrustedDirectories, realExecutable)) continue;
+			executable ??= realExecutable;
+		}
+		seenDirectories.add(realDirectory);
+		trustedDirectories.push(realDirectory);
+	}
+	return executable ? { executable, searchPath: trustedDirectories.join(path.delimiter) } : undefined;
+}
 
 /**
- * Environment for the default `/share` `gh` children. A `GH_HOST` or
- * `GH_CONFIG_DIR` that matches the project dotenv is omitted so the repository
- * cannot retarget gist upload or point `gh` at a config directory it shipped.
- * An operator value the project does not declare is kept.
+ * Environment for the default `/share` `gh` children. GitHub CLI routing,
+ * config, authentication, proxy, certificate, shell/runtime startup, executable-search,
+ * and dynamic loader overrides that match the project dotenv are omitted so a repository
+ * cannot redirect the upload, substitute the `gh` binary, authenticate with a
+ * project-provided token, or intercept its HTTPS request. The executable itself
+ * and its child search path use absolute operator PATH directories whose real
+ * paths are outside actual launch and active checkout roots. Operator values the project
+ * does not declare are kept.
  */
-function ghShareChildEnv(env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+function ghShareChildEnv(trustedPath: string, env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
 	const child: NodeJS.ProcessEnv = { ...env };
-	for (const name of GH_SHARE_DESTINATION_KEYS) {
+	for (const name of Object.keys(child)) {
+		if (!GH_SHARE_TRUST_KEY_SET.has(name.toUpperCase())) continue;
 		const raw = child[name];
 		if (typeof raw !== "string") continue;
 		const key = canonicalEnvKey(name);
 		const declared = ghShareProjectSnapshot.values[key];
 		if (declared === undefined) continue;
-		if (!(ghShareProjectSnapshot.dynamic.has(key) || declared === raw || declared === raw.trim())) continue;
+		if (!(ghShareProjectSnapshot.dynamic.has(key) || declared.trim() === raw.trim())) continue;
 		delete child[name];
 		if (process.platform === "win32") {
 			for (const present of Object.keys(child)) {
@@ -139,6 +329,43 @@ function ghShareChildEnv(env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEn
 			}
 		}
 	}
+	const ghConfigDirKey = canonicalEnvKey("GH_CONFIG_DIR");
+	const xdgConfigHomeKey = canonicalEnvKey("XDG_CONFIG_HOME");
+	for (const name of Object.keys(child)) {
+		const key = canonicalEnvKey(name);
+		if (key !== ghConfigDirKey && key !== xdgConfigHomeKey) continue;
+		const value = child[name];
+		if (typeof value !== "string" || value.length === 0 || path.isAbsolute(value)) continue;
+		// `gh` children use the filesystem root as cwd to avoid project Bun
+		// preloads, so retain the launch-directory meaning of relative config paths.
+		child[name] = path.resolve(ghShareLaunchRoot, value);
+	}
+	const certFileKey = canonicalEnvKey("SSL_CERT_FILE");
+	const certDirKey = canonicalEnvKey("SSL_CERT_DIR");
+	for (const name of Object.keys(child)) {
+		const key = canonicalEnvKey(name);
+		const value = child[name];
+		if (typeof value !== "string" || value.length === 0) continue;
+		if (key === certFileKey && !path.isAbsolute(value)) {
+			// Certificate overrides retain their launch-directory meaning even
+			// though `gh` children run from the filesystem root.
+			child[name] = path.resolve(ghShareLaunchRoot, value);
+		} else if (key === certDirKey) {
+			child[name] = value
+				.split(path.delimiter)
+				.map(directory =>
+					directory.length > 0 && !path.isAbsolute(directory)
+						? path.resolve(ghShareLaunchRoot, directory)
+						: directory,
+				)
+				.join(path.delimiter);
+		}
+	}
+	const pathKey = canonicalEnvKey("PATH");
+	for (const name of Object.keys(child)) {
+		if (canonicalEnvKey(name) === pathKey) delete child[name];
+	}
+	child.PATH = trustedPath;
 	return child;
 }
 
@@ -182,6 +409,7 @@ export class CommandController {
 	}
 
 	async handleDebugTranscriptCommand(): Promise<void> {
+		let tempDir: string | undefined;
 		try {
 			const width = Math.max(1, this.ctx.ui.terminal.columns);
 			const renderedLines = this.ctx.chatContainer.render(width).map(line => replaceTabs(Bun.stripANSI(line)));
@@ -190,10 +418,22 @@ export class CommandController {
 				this.ctx.showError("No messages to dump yet.");
 				return;
 			}
-			const tmpPath = path.join(os.tmpdir(), `${Snowflake.next()}-tmp.txt`);
-			await Bun.write(tmpPath, `${rendered}\n`);
+			// Random directory plus an exclusive create: a preexisting symlink under the
+			// shared temp directory is not opened, and the transcript is not left world-readable.
+			tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "gjc-debug-transcript-"));
+			if (process.platform !== "win32") await fs.chmod(tempDir, 0o700);
+			const tmpPath = path.join(tempDir, "transcript.txt");
+			const handle = await fs.open(tmpPath, "wx", 0o600);
+			try {
+				await handle.writeFile(`${rendered}\n`);
+			} finally {
+				await handle.close();
+			}
+			if (process.platform !== "win32") await fs.chmod(tmpPath, 0o600);
 			this.ctx.showStatus(`Debug transcript written to:\n${tmpPath}`);
+			tempDir = undefined;
 		} catch (error: unknown) {
+			if (tempDir) await fs.rm(tempDir, { recursive: true, force: true }).catch(() => {});
 			this.ctx.showError(
 				`Failed to write debug transcript: ${error instanceof Error ? error.message : "Unknown error"}`,
 			);
@@ -277,9 +517,20 @@ export class CommandController {
 			return;
 		}
 
-		const ghEnv = ghShareChildEnv();
+		const ghShare = await resolveGhShareExecutable();
+		if (!ghShare) {
+			this.ctx.showError(
+				"GitHub CLI (gh) is not installed on the trusted operator PATH. Install it from https://cli.github.com/",
+			);
+			return;
+		}
+		const ghShareExecutable = ghShare.executable;
+		// Bun wrappers load project bunfig.toml preloads from their working directory.
+		const ghShareCwd = path.parse(ghShareLaunchRoot).root;
+		const ghEnv = ghShareChildEnv(ghShare.searchPath);
 		try {
-			const authProcess = Bun.spawn(["gh", "auth", "status"], {
+			const authProcess = Bun.spawn([ghShareExecutable, "auth", "status"], {
+				cwd: ghShareCwd,
 				env: ghEnv,
 				stdin: "ignore",
 				stdout: "ignore",
@@ -313,7 +564,8 @@ export class CommandController {
 
 		let cancellationRequested = false;
 		try {
-			const gistProcess = Bun.spawn(["gh", "gist", "create", "--public=false", tmpFile], {
+			const gistProcess = Bun.spawn([ghShareExecutable, "gist", "create", "--public=false", tmpFile], {
+				cwd: ghShareCwd,
 				env: ghEnv,
 				stdin: "ignore",
 				stdout: "pipe",
@@ -1212,7 +1464,9 @@ export class CommandController {
 		try {
 			if (!title?.trim()) {
 				const generation = beginSessionTitleGeneration(this.ctx.sessionManager);
-				const input = buildConversationTitleInput(this.ctx.session.messages);
+				const activeCwd = this.ctx.sessionManager.getCwd();
+				const obfuscateText = await titleInputObfuscator(this.ctx.settings, activeCwd);
+				const input = buildConversationTitleInput(this.ctx.session.messages, obfuscateText);
 				if (!input) {
 					this.ctx.showError("Nothing to summarize yet — pass a title: /rename <title>");
 					return;
@@ -1225,10 +1479,11 @@ export class CommandController {
 					this.ctx.session.credentialSessionId,
 					this.ctx.session.model,
 					provider => this.ctx.session.agent.metadataForProvider(provider),
+					activeCwd,
 				);
 				if (
 					!isSessionTitleGenerationCurrent(this.ctx.sessionManager, generation) ||
-					buildConversationTitleInput(this.ctx.session.messages) !== input
+					buildConversationTitleInput(this.ctx.session.messages, obfuscateText) !== input
 				)
 					return;
 				if (!generated) {

package/src/modes/controllers/event-controller.ts

@@ -716,7 +716,7 @@ export class EventController {
 	): Promise<void> {
 		this.ctx.showStatus(`Fallback model: ${event.from} → ${event.to}`);
 		this.ctx.statusLine.invalidate();
-		this.ctx.ui.requestRender();
+		this.ctx.updateEditorBorderColor();
 	}
 
 	async #handleNotice(event: Extract<AgentSessionEvent, { type: "notice" }>): Promise<void> {

package/src/modes/controllers/extension-ui-controller.ts

@@ -84,6 +84,7 @@ const EXTENSION_CONTEXT_MUTATIONS: ReadonlySet<PropertyKey> = new Set([
 	"clearContext",
 	"cycleModel",
 	"setModelProfile",
+	"setDefaultModelProfile",
 	"cycleThinkingLevel",
 	"setQueueMode",
 	"invokeSkill",
@@ -93,6 +94,14 @@ const EXTENSION_CONTEXT_MUTATIONS: ReadonlySet<PropertyKey> = new Set([
 	"setSdkClientBridge",
 	"sdkControl",
 ]);
+const MODEL_CHANGE_MUTATIONS: ReadonlySet<PropertyKey> = new Set([
+	"setModel",
+	"setModelTemporaryForControl",
+	"cycleModel",
+	"setModelProfile",
+	"setDefaultModelProfile",
+	"sdkControl",
+]);
 const EXTENSION_COMMAND_MUTATIONS: ReadonlySet<PropertyKey> = new Set([
 	"reload",
 	"newSession",
@@ -250,7 +259,11 @@ export class ExtensionUiController {
 				const slashIndex = selector.indexOf("/");
 				const model =
 					slashIndex > 0
-						? session.modelRegistry.find(selector.slice(0, slashIndex), selector.slice(slashIndex + 1))
+						? session.modelRegistry.find(
+								selector.slice(0, slashIndex),
+								selector.slice(slashIndex + 1),
+								session.credentialSessionId,
+							)
 						: undefined;
 				if (!model || !thinkingLevel || thinkingLevel === ThinkingLevel.Inherit)
 					throw Object.assign(new Error("model.set requires a valid model id and concrete thinkingLevel."), {
@@ -442,6 +455,14 @@ export class ExtensionUiController {
 		return this.ctx.isStopped?.() === true;
 	}
 
+	async #withModelChangeRefresh<T>(changeModel: () => Promise<T>): Promise<T> {
+		try {
+			return await changeModel();
+		} finally {
+			if (!this.#isStopped()) this.ctx.updateEditorChrome();
+		}
+	}
+
 	#assertActive(): void {
 		if (this.#isStopped()) throw Object.assign(new Error("Interactive mode stopped"), { code: "cancelled" });
 	}
@@ -453,6 +474,9 @@ export class ExtensionUiController {
 				if (!mutationNames.has(property) || typeof member !== "function") return member;
 				return (...args: unknown[]) => {
 					this.#assertActive();
+					if (MODEL_CHANGE_MUTATIONS.has(property)) {
+						return this.#withModelChangeRefresh(async () => Reflect.apply(member, current, args));
+					}
 					return Reflect.apply(member, current, args);
 				};
 			},
@@ -646,6 +670,7 @@ export class ExtensionUiController {
 			branch: async () => prohibitBrokerLifecycleOperation("session.branch"),
 			navigateTree: async (targetId, navOptions) => {
 				const result = await this.ctx.session.navigateTree(targetId, { summarize: navOptions?.summarize });
+				if (!result.cancelled) await this.ctx.session.notifySessionIdentityChanged();
 				return { cancelled: result.cancelled };
 			},
 			switchSession: async () => prohibitBrokerLifecycleOperation("session.switch"),
@@ -653,6 +678,8 @@ export class ExtensionUiController {
 				const previousSessionId = this.ctx.sessionManager.getSessionId();
 				await this.ctx.session.reload();
 				if (this.#isStopped()) return;
+				await this.ctx.session.notifySessionIdentityChanged();
+				if (this.#isStopped()) return;
 				const sessionIdentityChanged = previousSessionId !== this.ctx.sessionManager.getSessionId();
 				if (sessionIdentityChanged) this.ctx.resetIrcSidebarSession();
 				this.ctx.rebuildInitialMessages(sessionIdentityChanged ? "replace-identity" : "reconcile-same-transcript");
@@ -876,6 +903,7 @@ export class ExtensionUiController {
 			branch: async () => prohibitBrokerLifecycleOperation("session.branch"),
 			navigateTree: async (targetId, navOptions) => {
 				const result = await this.ctx.session.navigateTree(targetId, { summarize: navOptions?.summarize });
+				if (!result.cancelled) await this.ctx.session.notifySessionIdentityChanged();
 				return { cancelled: result.cancelled };
 			},
 			switchSession: async () => prohibitBrokerLifecycleOperation("session.switch"),
@@ -886,6 +914,8 @@ export class ExtensionUiController {
 				const previousSessionId = this.ctx.sessionManager.getSessionId();
 				await this.ctx.session.reload();
 				if (this.#isStopped()) return;
+				await this.ctx.session.notifySessionIdentityChanged();
+				if (this.#isStopped()) return;
 				const sessionIdentityChanged = previousSessionId !== this.ctx.sessionManager.getSessionId();
 				if (sessionIdentityChanged) this.ctx.resetIrcSidebarSession();
 				this.ctx.rebuildInitialMessages(sessionIdentityChanged ? "replace-identity" : "reconcile-same-transcript");

package/src/modes/controllers/goal-mode-controller.ts

@@ -54,6 +54,7 @@ export class GoalModeController {
 	#enabled = false;
 	#paused = false;
 	#previousTools: string[] | undefined;
+	#previousMCPToolNames: string[] | undefined;
 	#continuationTimer: NodeJS.Timeout | undefined;
 	#turnHadToolCalls = false;
 	#continuationTurnInFlight = false;
@@ -264,8 +265,13 @@ export class GoalModeController {
 			if (this.#enabled || this.#paused) this.ctx.modeGate.enter("goal");
 			if (restored?.goal) {
 				this.#previousTools = this.ctx.session.getActiveToolNames();
+				this.#previousMCPToolNames = this.ctx.session.getActiveMCPToolNames();
 				if (!this.ctx.session.isExplicitEmptyToolSelection()) {
-					await this.ctx.session.setActiveToolsByName([...new Set([...this.#previousTools, "goal"])]);
+					await this.ctx.session.setActiveToolsByName([...new Set([...this.#previousTools, "goal"])], {
+						explicit: false,
+						persistMCPSelection: false,
+						retryOnMcpCatalogChange: true,
+					});
 				}
 			}
 			this.#updateStatus();
@@ -316,16 +322,63 @@ export class GoalModeController {
 	}): Promise<void> {
 		if (this.#enabled) return;
 		if (!this.ctx.modeGate.enter("goal")) return this.ctx.showWarning("Exit plan mode first.");
+		const previousGoalState = this.ctx.session.getGoalModeState();
 		this.#previousTools = this.ctx.session.getActiveToolNames();
+		this.#previousMCPToolNames = this.ctx.session.getActiveMCPToolNames();
 		this.#paused = false;
-		const state = options.resume
-			? await this.ctx.session.goalRuntime.resumeGoal()
-			: await this.ctx.session.goalRuntime.createGoal({
-					objective: options.objective ?? "",
-					provenance: options.provenance,
-				});
-		if (!this.ctx.session.isExplicitEmptyToolSelection()) {
-			await this.ctx.session.setActiveToolsByName([...new Set([...this.#previousTools, "goal"])]);
+		let state: GoalModeState;
+		try {
+			state = options.resume
+				? await this.ctx.session.goalRuntime.resumeGoal()
+				: await this.ctx.session.goalRuntime.createGoal({
+						objective: options.objective ?? "",
+						provenance: options.provenance,
+					});
+			if (!this.ctx.session.isExplicitEmptyToolSelection()) {
+				await this.ctx.session.setActiveToolsByName(
+					[...new Set([...this.#restoreToolsWithCurrentMCPSelection(this.#previousTools), "goal"])],
+					{
+						explicit: false,
+						persistMCPSelection: false,
+						retryOnMcpCatalogChange: true,
+					},
+				);
+			}
+		} catch (error) {
+			const currentGoalState = this.ctx.session.getGoalModeState();
+			const goalWasActivated =
+				currentGoalState?.enabled === true &&
+				currentGoalState.goal.status === "active" &&
+				(options.resume
+					? previousGoalState?.goal.status === "paused" && currentGoalState.goal.id === previousGoalState.goal.id
+					: currentGoalState.goal.id !== previousGoalState?.goal.id);
+			let rollbackError: unknown;
+			if (goalWasActivated) {
+				try {
+					if (options.resume) await this.ctx.session.goalRuntime.pauseGoal();
+					else await this.ctx.session.goalRuntime.dropGoal();
+				} catch (goalRollbackError) {
+					rollbackError = goalRollbackError;
+				}
+			}
+			const rollbackState = this.ctx.session.getGoalModeState();
+			this.#enabled = rollbackState?.enabled === true;
+			this.#paused = rollbackState?.enabled !== true && rollbackState?.goal.status === "paused";
+			this.#previousTools = undefined;
+			this.#previousMCPToolNames = undefined;
+			this.#continuationTurnInFlight = false;
+			this.#resetContinuationSuppression();
+			this.cancelContinuation();
+			if (this.#enabled || this.#paused) this.ctx.modeGate.enter("goal");
+			else this.ctx.modeGate.exit("goal");
+			this.#updateStatus();
+			if (rollbackError !== undefined) {
+				throw new AggregateError(
+					[error, rollbackError],
+					"Goal-mode entry failed and goal state rollback also failed",
+				);
+			}
+			throw error;
 		}
 		this.ctx.session.setGoalModeState(state);
 		this.#enabled = true;
@@ -344,7 +397,12 @@ export class GoalModeController {
 			this.#previousTools &&
 			options?.reason !== "dropped" &&
 			(this.#enabled || options?.reason === "completed" || options?.paused);
-		if (shouldRestoreTools && this.#previousTools) await this.ctx.session.setActiveToolsByName(this.#previousTools);
+		if (shouldRestoreTools && this.#previousTools)
+			await this.ctx.session.setActiveToolsByName(this.#restoreToolsWithCurrentMCPSelection(this.#previousTools), {
+				explicit: false,
+				persistMCPSelection: false,
+				retryOnMcpCatalogChange: true,
+			});
 		const currentState = this.ctx.session.getGoalModeState();
 		if (options?.reason === "completed") {
 			this.ctx.session.setGoalModeState(undefined);
@@ -358,6 +416,7 @@ export class GoalModeController {
 		this.#enabled = false;
 		this.#paused = options?.paused ?? false;
 		this.#previousTools = undefined;
+		this.#previousMCPToolNames = undefined;
 		this.#continuationTurnInFlight = false;
 		this.#resetContinuationSuppression();
 		this.cancelContinuation();
@@ -375,6 +434,16 @@ export class GoalModeController {
 			);
 	}
 
+	#restoreToolsWithCurrentMCPSelection(previousTools: readonly string[]): string[] {
+		const previousMCPToolNames = new Set(this.#previousMCPToolNames ?? []);
+		return [
+			...new Set([
+				...previousTools.filter(name => !previousMCPToolNames.has(name)),
+				...this.ctx.session.getActiveMCPToolNames(),
+			]),
+		];
+	}
+
 	#getPausedState(): GoalModeState | undefined {
 		const state = this.ctx.session.getGoalModeState();
 		return state?.goal && !state.enabled && state.goal.status === "paused" ? state : undefined;

package/src/modes/controllers/input-controller.ts

@@ -1642,6 +1642,7 @@ export class InputController {
 		// Keep locally intercepted command arguments away from the title model.
 		if (this.ctx.session.isLocallyHandledSlashCommand(text)) return;
 		this.#autoTitleInFlightSessionId = sessionId;
+		const activeCwd = this.ctx.sessionManager.getCwd();
 		generateSessionTitle(
 			text,
 			this.ctx.session.modelRegistry,
@@ -1649,6 +1650,7 @@ export class InputController {
 			this.ctx.session.credentialSessionId,
 			this.ctx.session.model,
 			provider => this.ctx.session.agent.metadataForProvider(provider),
+			activeCwd,
 		)
 			.then(async title => {
 				if (!title || this.ctx.sessionManager.getSessionId() !== sessionId) return;