@gajae-code/coding-agent 0.18.5 → 0.18.6

package/src/config/file-lock.ts

@@ -610,7 +610,7 @@ async function classifyFileLockRemovalTransition(
 	if (!observation) return "active";
 	const info = parseLockInfoBytes(observation.bytes);
 	if (info) {
-		const stale = await staleLockSnapshot(transitionPath, 0, ownerHostId, previousOwnerHostIds);
+		const stale = await staleLockSnapshot(transitionPath, 0, ownerHostId, previousOwnerHostIds, undefined, true);
 		return stale.stale ? "abandoned" : "active";
 	}
 
@@ -698,6 +698,74 @@ async function adoptOrphanedFileLockRemovalTransition(lockPath: string, orphanAg
 	return false;
 }
 
+async function adoptAbandonedFileLockRemovalTransition(
+	lockPath: string,
+	ownerHostId?: string,
+	previousOwnerHostIds: readonly string[] = [],
+): Promise<boolean> {
+	const transitionPath = fileLockRemovalTransitionPath(lockPath);
+	const stale = await staleLockSnapshot(transitionPath, 0, ownerHostId, previousOwnerHostIds, undefined, true);
+	if (!stale.stale || !stale.identity) return false;
+	if (!(await isNativeExactRemovalUsable())) return false;
+
+	let captured: NativeDirectoryTreeResult;
+	try {
+		captured = nativeFileLockBindings().snapshotDirectoryTree(transitionPath);
+	} catch (error) {
+		if (isTransientReleaseError(error)) return false;
+		throw error;
+	}
+	if (!captured.ok || !captured.snapshot) return false;
+	const snapshot = captured.snapshot;
+	const root = snapshot.entries.find(entry => entry.relativePath === "");
+	const infoEntry = snapshot.entries.find(entry => entry.relativePath === "info");
+	if (
+		root?.kind !== "directory" ||
+		infoEntry?.kind !== "file" ||
+		snapshot.entries.some(
+			entry =>
+				entry.relativePath !== "" &&
+				entry.relativePath !== "info" &&
+				entry.kind !== "directory" &&
+				(entry.kind !== "file" || entry.size !== "0"),
+		)
+	)
+		return false;
+	const currentIdentity = await captureFileLockDirIdentity(transitionPath);
+	if (!currentIdentity || !sameStableFileLockIdentity(currentIdentity, stale.identity)) return false;
+	if (
+		!nativeFileLockInfoMatchesStableIdentity(snapshot.rootDev, snapshot.rootIno, infoEntry, stale.identity) ||
+		!nativeFileLockInfoMatchesContentEvidence(infoEntry, stale.identity)
+	)
+		return false;
+
+	let removal: NativeExactUnlinkResult;
+	try {
+		removal = nativeFileLockBindings().exactRemoveDirectoryTree(transitionPath, snapshot);
+	} catch (error) {
+		if (isTransientReleaseError(error)) return false;
+		throw error;
+	}
+	if (removal.ok === true) return removal.code === undefined && Object.keys(removal).every(key => key === "ok");
+	if (
+		removal.ok === false &&
+		removal.code === "cleanup_pending" &&
+		removal.payloadDurable === true &&
+		removal.detachedPath !== undefined &&
+		path.resolve(removal.detachedPath) === path.resolve(transitionPath) &&
+		removal.retainedSuccessorPath === undefined &&
+		removal.retainedPlaceholderPath === undefined &&
+		removal.retainedUnknownPath === undefined &&
+		Object.keys(removal).every(key => ["ok", "code", "payloadDurable", "detachedPath"].includes(key))
+	)
+		return await removeDetachedLockQuarantineOnDisk(transitionPath, snapshot.rootDev, snapshot.rootIno);
+	return (
+		removal.ok === false &&
+		removal.code === "not_found" &&
+		Object.keys(removal).every(key => key === "ok" || key === "code")
+	);
+}
+
 function sameFileLockTreeAfterPublication(
 	staged: NativeDirectoryTreeSnapshot,
 	published: NativeDirectoryTreeSnapshot,
@@ -1488,6 +1556,14 @@ async function staleLockSnapshot(
 	ownerHostId?: string,
 	previousOwnerHostIds: readonly string[] = [],
 	startTimeCache?: Map<string, string | null>,
+	// `.removing` transitions are internal cleanup state this codebase's own removal
+	// machinery produced, never a live holder's public identity: a hostless transition
+	// record predates host-id stamping and is reclaimable by local liveness proof alone,
+	// regardless of the acquirer's own host id. Active `<file>.lock` holders keep the
+	// stricter fail-closed rule (see `lockRecordIsForeignHost`) because that record can
+	// belong to a genuinely foreign process; only the two transition-specific callers
+	// below set this.
+	hostlessTransitionIsLocal = false,
 ): Promise<LockStaleSnapshot> {
 	// Capture the root and info inode BEFORE asking whether the owner is stale. A later
 	// snapshot alone would let a copied successor inherit the stale verdict's authority.
@@ -1521,7 +1597,8 @@ async function staleLockSnapshot(
 	// A host-qualified lock may only be reclaimed after proving that its owner is
 	// local. Foreign and malformed host-qualified records fail closed: PID values
 	// and clocks are not meaningful across hosts.
-	if (lockRecordIsForeignHost(info, ownerHostId, previousOwnerHostIds)) return { stale: false };
+	const foreignCheckHostId = hostlessTransitionIsLocal && info.owner_host_id === undefined ? undefined : ownerHostId;
+	if (lockRecordIsForeignHost(info, foreignCheckHostId, previousOwnerHostIds)) return { stale: false };
 	if (ownerIncarnationChanged(info, startTimeCache)) {
 		if (!judgedIdentity) return { stale: false };
 		let currentIdentity: GenericFileLockDirIdentity | null;
@@ -1752,6 +1829,18 @@ async function tryAcquireLock(
 			}
 			if (transitionState === "orphan_transition")
 				return { kind: "orphan_transition", path: fileLockRemovalTransitionPath(destinationPath) };
+			if (transitionState === "abandoned") {
+				if (await adoptAbandonedFileLockRemovalTransition(destinationPath, ownerHostId, previousOwnerHostIds)) {
+					transitionState = await classifyFileLockRemovalTransition(
+						destinationPath,
+						orphanTransitionAgeMs,
+						ownerHostId,
+						previousOwnerHostIds,
+					);
+				} else {
+					return null;
+				}
+			}
 			if (transitionState !== null) return null;
 			const staged = snapshotDirectoryTree(canonicalPendingPath);
 			if (!staged.ok || !staged.snapshot) {

package/src/config/model-profile-activation.ts

@@ -115,6 +115,7 @@ export interface PrepareModelProfileActivationOptions {
 			>
 		> & {
 			getError?: ModelRegistry["getError"];
+			authStorage?: ModelRegistry["authStorage"];
 		};
 	settings: Pick<Settings, "get" | "getGlobal" | "getOverride">;
 	profileName: string;
@@ -475,6 +476,53 @@ export class ModelProfileCredentialError extends Error {
 	}
 }
 
+interface SessionPinRegistry {
+	authStorage?: {
+		hasRuntimeApiKey(provider: string): boolean;
+		hasLiteralConfigApiKey(provider: string, owner?: object): boolean;
+		hasSessionCredentialUnavailable(provider: string, scopeId?: string): boolean;
+	};
+	getAuthStorageOwner?(): object;
+}
+
+/**
+ * Whether an unavailable session credential pin blocks `provider`.
+ *
+ * Mirrors `AuthStorage.getApiKey` precedence: a runtime `--api-key` override or a literal
+ * `models.yml` `apiKey` registered for this registry's owner is resolved before the
+ * unavailable-pin marker, so either one keeps the provider usable. An `apiKeyEnv` key does
+ * not: `getApiKey` prefers another stored api_key account over it, which would silently
+ * retarget the unavailable pin.
+ */
+export function isSessionCredentialPinBlocking(
+	registry: SessionPinRegistry,
+	provider: string,
+	sessionId: string | undefined,
+): boolean {
+	const authStorage = registry.authStorage;
+	if (!authStorage) return false;
+	if (authStorage.hasRuntimeApiKey(provider)) return false;
+	if (authStorage.hasLiteralConfigApiKey(provider, registry.getAuthStorageOwner?.())) return false;
+	return authStorage.hasSessionCredentialUnavailable(provider, sessionId);
+}
+
+async function getProfileProviderApiKey(
+	registry: PrepareModelProfileActivationOptions["modelRegistry"],
+	provider: string,
+	sessionId: string,
+	profileLabel: string,
+): Promise<string | undefined> {
+	const pinBlocking = () => isSessionCredentialPinBlocking(registry, provider, sessionId);
+	if (pinBlocking()) throw new ModelProfileCredentialError(profileLabel, [provider]);
+	try {
+		return await registry.getApiKeyForProvider(provider, sessionId);
+	} catch (error) {
+		// OAuth selection can invalidate a pin while the credential probe is running.
+		if (pinBlocking()) throw new ModelProfileCredentialError(profileLabel, [provider]);
+		throw error;
+	}
+}
+
 export function formatModelProfileCredentialError(profileLabel: string, providers: readonly string[]): string {
 	return `Model profile "${profileLabel}" requires credentials for: ${providers.join(", ")}. Run /login and configure the missing provider(s), then retry.`;
 }
@@ -762,7 +810,12 @@ export async function resolveModelProfileDefaultChain(options: {
 	])) {
 		let apiKey: string | undefined;
 		try {
-			apiKey = await options.modelRegistry.getApiKeyForProvider(provider, options.credentialSessionId);
+			apiKey = await getProfileProviderApiKey(
+				options.modelRegistry,
+				provider,
+				options.credentialSessionId,
+				profileLabel,
+			);
 		} catch (error) {
 			if (requiredProviderSet.has(provider) && !alternativeSet.has(provider)) throw error;
 			continue;
@@ -787,7 +840,12 @@ export async function resolveModelProfileDefaultChain(options: {
 	const proxyApiKey =
 		proxyProvider === undefined
 			? undefined
-			: await options.modelRegistry.getApiKeyForProvider(proxyProvider, options.credentialSessionId);
+			: await getProfileProviderApiKey(
+					options.modelRegistry,
+					proxyProvider,
+					options.credentialSessionId,
+					profileLabel,
+				);
 	if (
 		proxyProvider !== undefined &&
 		!isModelProfileProxyConfigured(proxyProvider, configuredProviderIds, proxyApiKey === kNoAuth)
@@ -886,6 +944,8 @@ export async function resolveModelProfileDefaultChain(options: {
 			aliasIntent: "preset-equivalent",
 			canonicalSessionId: null,
 			credentialSessionId: options.credentialSessionId,
+			isCredentialUnavailable: provider =>
+				isSessionCredentialPinBlocking(options.modelRegistry, provider, options.credentialSessionId),
 		},
 	);
 	return { profileName, entries: defaultChain, ...resolution };
@@ -1083,6 +1143,8 @@ async function resolveAndClampSelectorValue(
 					aliasIntent: options.aliasIntent,
 					canonicalSessionId: options.sessionId,
 					credentialSessionId: options.credentialSessionId,
+					isCredentialUnavailable: provider =>
+						isSessionCredentialPinBlocking(options.modelRegistry, provider, options.credentialSessionId),
 				},
 			);
 			resolved = {
@@ -1213,6 +1275,8 @@ async function concretizeProfileSelectorValue(
 							aliasIntent: "preset-equivalent",
 							canonicalSessionId: prepared.session.sessionId,
 							credentialSessionId,
+							isCredentialUnavailable: provider =>
+								isSessionCredentialPinBlocking(prepared.modelRegistry, provider, credentialSessionId),
 						},
 					)
 				: resolveModelRoleValue(selector, candidates, {
@@ -1322,7 +1386,7 @@ export async function prepareModelProfileActivation(
 		for (const provider of authenticationProbeProviders) {
 			let apiKey: string | undefined;
 			try {
-				apiKey = await options.modelRegistry.getApiKeyForProvider(provider, credentialSessionId);
+				apiKey = await getProfileProviderApiKey(options.modelRegistry, provider, credentialSessionId, profileLabel);
 			} catch (error) {
 				if (requiredProviderSet.has(provider) && !alternativeSet.has(provider)) throw error;
 				continue;
@@ -1357,7 +1421,7 @@ export async function prepareModelProfileActivation(
 		const proxyApiKey =
 			proxyProvider === undefined
 				? undefined
-				: await options.modelRegistry.getApiKeyForProvider(proxyProvider, credentialSessionId);
+				: await getProfileProviderApiKey(options.modelRegistry, proxyProvider, credentialSessionId, profileLabel);
 		if (proxyProvider !== undefined) {
 			const configuredProxyProviders = options.modelRegistry.getConfiguredProviderIds?.();
 			if (!isModelProfileProxyConfigured(proxyProvider, configuredProxyProviders, proxyApiKey === kNoAuth)) {
@@ -1462,6 +1526,8 @@ export async function prepareModelProfileActivation(
 				aliasIntent: "preset-equivalent",
 				canonicalSessionId: options.session.sessionId,
 				credentialSessionId,
+				isCredentialUnavailable: provider =>
+					isSessionCredentialPinBlocking(options.modelRegistry, provider, credentialSessionId),
 			},
 		);
 		const defaultModel = defaultResolution.model;

package/src/config/model-profile-contract.ts

@@ -4,7 +4,10 @@ export const MODEL_PROFILE_DISCOVERY_QUERY = "models.profiles.list";
 export const MODEL_PROFILE_ERROR_DETAIL_MAX_BYTES = 2048;
 const REQUESTED_PROFILE_MAX_BYTES = 256;
 
-const LEGACY_MODEL_PROFILE_ALIASES: ReadonlyMap<string, string> = new Map([["codex-standard", "codex-medium"]]);
+const LEGACY_MODEL_PROFILE_ALIASES: ReadonlyMap<string, string> = new Map([
+	["codex-standard", "codex-medium"],
+	["codex-sol61", "codex-pro"],
+]);
 
 export interface ModelProfileCatalogItem {
 	id: string;

package/src/config/model-profiles.ts

@@ -73,32 +73,25 @@ const profile = (
 
 export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 	profile("codex-eco", ["openai-codex"], {
-		default: "openai-codex/gpt-5.6-terra:low",
+		default: "openai-codex/gpt-6-luna:low",
 		executor: "openai-codex/gpt-6-luna:low",
 		planner: "openai-codex/gpt-6-luna:high",
-		critic: "openai-codex/gpt-5.6-terra:xhigh",
-		architect: "openai-codex/gpt-5.6-terra:high",
+		critic: "openai-codex/gpt-6-luna:xhigh",
+		architect: "openai-codex/gpt-6-luna:high",
 	}),
 	profile("codex-medium", ["openai-codex"], {
-		default: "openai-codex/gpt-6-sol:low",
-		executor: "openai-codex/gpt-5.6-terra:low",
-		planner: "openai-codex/gpt-5.6-terra:high",
-		critic: "openai-codex/gpt-6-sol:xhigh",
-		architect: "openai-codex/gpt-6-sol:high",
+		default: "openai-codex/gpt-6.1-sol:low",
+		executor: "openai-codex/gpt-6.1-sol:low",
+		planner: "openai-codex/gpt-6.1-sol:high",
+		critic: "openai-codex/gpt-6.1-sol:xhigh",
+		architect: "openai-codex/gpt-6.1-sol:high",
 	}),
 	profile("codex-pro", ["openai-codex"], {
-		default: "openai-codex/gpt-6-sol:medium",
-		executor: "openai-codex/gpt-5.6-terra:medium",
-		planner: "openai-codex/gpt-6-sol:high",
-		critic: "openai-codex/gpt-6-sol:max",
-		architect: "openai-codex/gpt-6-sol:xhigh",
-	}),
-	profile("codex-sol61", ["openai-codex"], {
 		default: "openai-codex/gpt-6.1-sol:medium",
 		executor: "openai-codex/gpt-6.1-sol:medium",
 		planner: "openai-codex/gpt-6.1-sol:high",
-		critic: "openai-codex/gpt-6.1-sol:xhigh",
-		architect: "openai-codex/gpt-6-astra:xhigh",
+		critic: "openai-codex/gpt-6.1-sol:max",
+		architect: "openai-codex/gpt-6.1-sol:xhigh",
 	}),
 	profile("lunamaxxing", ["openai-codex"], {
 		default: "openai-codex/gpt-6-luna:medium",
@@ -111,20 +104,20 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 		default: "openai-codex/gpt-6-astra:medium",
 		executor: "openai-codex/gpt-6-luna:xhigh",
 		planner: "openai-codex/gpt-6-astra:xhigh",
-		critic: "openai-codex/gpt-6-sol:high",
-		architect: "openai-codex/gpt-5.6-terra:xhigh",
+		critic: "openai-codex/gpt-6.1-sol:high",
+		architect: "openai-codex/gpt-6.1-sol:xhigh",
 	}),
 	profile("astra-default", ["openai-codex"], {
 		default: "openai-codex/gpt-6-astra:medium",
 		executor: "openai-codex/gpt-6-luna:max",
 		planner: "openai-codex/gpt-6-astra:xhigh",
-		critic: "openai-codex/gpt-6-sol:xhigh",
-		architect: "openai-codex/gpt-5.6-terra:xhigh",
+		critic: "openai-codex/gpt-6.1-sol:xhigh",
+		architect: "openai-codex/gpt-6.1-sol:xhigh",
 	}),
 	profile("astra-heavy", ["openai-codex"], {
 		default: "openai-codex/gpt-6-astra:medium",
-		executor: "openai-codex/gpt-6-sol:max",
-		planner: "openai-codex/gpt-6-sol:max",
+		executor: "openai-codex/gpt-6.1-sol:max",
+		planner: "openai-codex/gpt-6.1-sol:max",
 		critic: "openai-codex/gpt-6-astra:max",
 		architect: "openai-codex/gpt-6-astra:max",
 	}),
@@ -497,24 +490,24 @@ export const BUILTIN_MODEL_PROFILES: readonly ModelProfileDefinition[] = [
 	}),
 	profile("opus-codex", ["anthropic", "openai-codex"], {
 		default: "anthropic/claude-opus-5-5:medium",
-		executor: "openai-codex/gpt-5.6-terra:low",
+		executor: "openai-codex/gpt-6.1-sol:low",
 		planner: "anthropic/claude-sonnet-5-5",
-		critic: "openai-codex/gpt-6-sol:xhigh",
-		architect: "openai-codex/gpt-6-sol:high",
+		critic: "openai-codex/gpt-6.1-sol:xhigh",
+		architect: "openai-codex/gpt-6.1-sol:high",
 	}),
 	profile("codex-opencodego", ["openai-codex", "opencode-go"], {
-		default: "openai-codex/gpt-6-sol:low",
+		default: "openai-codex/gpt-6.1-sol:low",
 		executor: "opencode-go/deepseek-v4-pro",
 		planner: "opencode-go/kimi-k3",
 		critic: "opencode-go/mimo-v2.5-pro",
-		architect: "openai-codex/gpt-6-sol:high",
+		architect: "openai-codex/gpt-6.1-sol:high",
 	}),
 	profile("fable-opus-codex", ["anthropic", "openai-codex"], {
 		default: "anthropic/claude-fable-5-1:high",
-		executor: "openai-codex/gpt-5.6-terra:medium",
+		executor: "openai-codex/gpt-6.1-sol:medium",
 		planner: "anthropic/claude-opus-5-5:medium",
 		critic: "anthropic/claude-opus-5-5:high",
-		architect: "openai-codex/gpt-6-sol:xhigh",
+		architect: "openai-codex/gpt-6.1-sol:xhigh",
 	}),
 	profile("astra-fable", ["openai-codex", "anthropic"], {
 		default: "openai-codex/gpt-6-astra:medium",
@@ -562,7 +555,6 @@ const PROFILE_PRESENTATION: Record<string, ModelProfilePresentation> = {
 	"codex-eco": { displayName: "Codex Eco", providerGroup: "CODEX" },
 	"codex-medium": { displayName: "Codex Medium", providerGroup: "CODEX" },
 	"codex-pro": { displayName: "Codex Pro", providerGroup: "CODEX" },
-	"codex-sol61": { displayName: "Codex Sol 6.1", providerGroup: "CODEX" },
 	lunamaxxing: { displayName: "LunaMaxxing", providerGroup: "CODEX" },
 	"astra-lite": { displayName: "ASTRA-Lite", providerGroup: "CODEX" },
 	"astra-default": { displayName: "ASTRA-Default", providerGroup: "CODEX" },

package/src/config/model-resolver.ts

@@ -1189,7 +1189,15 @@ async function resolveModelChainEntries(
 				skips.push({ selector, reason: "credential_unavailable" });
 				break;
 			}
-			const key = await modelRegistry.getApiKey(candidate.model, credentialSessionId, { signal: options?.signal });
+			let key: string | undefined;
+			try {
+				key = await modelRegistry.getApiKey(candidate.model, credentialSessionId, { signal: options?.signal });
+			} catch (error) {
+				// OAuth selection can invalidate a pin after the preflight check.
+				if (!options?.isCredentialUnavailable?.(candidate.model.provider)) throw error;
+				skips.push({ selector, reason: "credential_unavailable" });
+				break;
+			}
 			if (isAuthenticatedOrKeyless(key)) {
 				return { ...candidate, activeIndex, skips };
 			}

package/src/coordinator-mcp/event-webhook.ts

@@ -116,6 +116,17 @@ function webhookEnvValue(explicitEnv: NodeJS.ProcessEnv | undefined, name: strin
 	return $credentialEnv(name)?.trim() || undefined;
 }
 
+// Number.parseInt reads a leading digit prefix ("1.5" -> 1, "1e4" -> 1,
+// "10s" -> 10), which would silently turn a timeout into one millisecond or a
+// retry budget into a single attempt. Only plain decimal digits count; anything
+// else falls back to the default, matching the coordinator policy env values.
+function boundedWebhookEnvInt(raw: string | undefined, fallback: number, max: number): number {
+	if (raw === undefined || !/^\d+$/.test(raw)) return fallback;
+	const parsed = Number.parseInt(raw, 10);
+	// An oversized digit string still means "as large as allowed", so it caps.
+	return parsed > 0 ? Math.min(parsed, max) : fallback;
+}
+
 export function parseEventWebhookConfig(explicitEnv?: NodeJS.ProcessEnv): EventWebhookConfig | null {
 	const rawUrl = webhookEnvValue(explicitEnv, "GJC_COORDINATOR_MCP_EVENT_WEBHOOK_URL");
 	if (!rawUrl) return null;
@@ -139,22 +150,16 @@ export function parseEventWebhookConfig(explicitEnv?: NodeJS.ProcessEnv): EventW
 		: null;
 	const tokenFile = webhookEnvValue(explicitEnv, "GJC_COORDINATOR_MCP_EVENT_WEBHOOK_TOKEN_FILE") ?? "";
 	if (tokenFile !== "" && !path.isAbsolute(tokenFile)) throw new Error("coordinator_event_webhook_token_file_invalid");
-	const timeoutRaw = Number.parseInt(
-		webhookEnvValue(explicitEnv, "GJC_COORDINATOR_MCP_EVENT_WEBHOOK_TIMEOUT_MS") ?? "",
-		10,
+	const timeoutMs = boundedWebhookEnvInt(
+		webhookEnvValue(explicitEnv, "GJC_COORDINATOR_MCP_EVENT_WEBHOOK_TIMEOUT_MS"),
+		DEFAULT_EVENT_WEBHOOK_TIMEOUT_MS,
+		MAX_EVENT_WEBHOOK_TIMEOUT_MS,
 	);
-	const timeoutMs =
-		Number.isFinite(timeoutRaw) && timeoutRaw > 0
-			? Math.min(timeoutRaw, MAX_EVENT_WEBHOOK_TIMEOUT_MS)
-			: DEFAULT_EVENT_WEBHOOK_TIMEOUT_MS;
-	const attemptsRaw = Number.parseInt(
-		webhookEnvValue(explicitEnv, "GJC_COORDINATOR_MCP_EVENT_WEBHOOK_MAX_ATTEMPTS") ?? "",
-		10,
+	const maxAttempts = boundedWebhookEnvInt(
+		webhookEnvValue(explicitEnv, "GJC_COORDINATOR_MCP_EVENT_WEBHOOK_MAX_ATTEMPTS"),
+		DEFAULT_EVENT_WEBHOOK_MAX_ATTEMPTS,
+		MAX_EVENT_WEBHOOK_MAX_ATTEMPTS,
 	);
-	const maxAttempts =
-		Number.isFinite(attemptsRaw) && attemptsRaw > 0
-			? Math.min(attemptsRaw, MAX_EVENT_WEBHOOK_MAX_ATTEMPTS)
-			: DEFAULT_EVENT_WEBHOOK_MAX_ATTEMPTS;
 	return { url: rawUrl, tokenFile: tokenFile || null, sessionIds, timeoutMs, maxAttempts };
 }
 

package/src/coordinator-mcp/policy.ts

@@ -86,9 +86,19 @@ const LEGACY_MUTATION_CLASS_ALIASES = new Map<string, CoordinatorMutationClass>(
 	["report", "reports"],
 ]);
 
+// Number.parseInt reads a leading digit prefix ("64KB" -> 64, "1e6" -> 1,
+// "1.5" -> 1), which would silently shrink a cap or TTL to a tiny value. Only
+// plain decimal digits count; anything else falls back to the default.
+function parsePositiveInt(value: string | undefined): number | undefined {
+	const trimmed = (value ?? "").trim();
+	if (!/^\d+$/.test(trimmed)) return undefined;
+	const parsed = Number.parseInt(trimmed, 10);
+	return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : undefined;
+}
+
 function parsePositiveIntMs(value: string | undefined, fallback: number, floor: number): number {
-	const parsed = Number.parseInt((value ?? "").trim(), 10);
-	if (!Number.isFinite(parsed) || parsed <= 0) return fallback;
+	const parsed = parsePositiveInt(value);
+	if (parsed === undefined) return fallback;
 	return Math.max(floor, parsed);
 }
 
@@ -133,8 +143,8 @@ function parseMutationClasses(value: string | undefined): Set<CoordinatorMutatio
 }
 
 function parseByteCap(value: string | undefined): number {
-	const parsed = Number.parseInt(value ?? "", 10);
-	if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_ARTIFACT_BYTE_CAP;
+	const parsed = parsePositiveInt(value);
+	if (parsed === undefined) return DEFAULT_ARTIFACT_BYTE_CAP;
 	return Math.min(parsed, MAX_ARTIFACT_BYTE_CAP);
 }