@gajae-code/coding-agent 0.18.6 → 0.18.7

package/src/modes/acp/acp-agent.ts

@@ -1426,6 +1426,21 @@ const THINKING_CONFIG_OPTIONS = ["off", "minimal", "low", "medium", "high", "xhi
 	name: value,
 }));
 
+function thinkingConfigOptions(query: unknown, currentModel: string | undefined): { value: string; name: string }[] {
+	if (!currentModel) return THINKING_CONFIG_OPTIONS;
+	const separator = currentModel.indexOf("/");
+	if (separator <= 0 || separator === currentModel.length - 1) return THINKING_CONFIG_OPTIONS;
+	const provider = currentModel.slice(0, separator);
+	const id = currentModel.slice(separator + 1);
+	const model = pageItems(query)
+		.map(item => object(item))
+		.find(item => item?.provider === provider && item.id === id);
+	const validLevels = object(model?.thinking)?.validLevels;
+	if (!Array.isArray(validLevels) || validLevels.length === 0) return THINKING_CONFIG_OPTIONS;
+	const levels = validLevels.filter((value): value is string => typeof value === "string");
+	return levels.length === 0 ? THINKING_CONFIG_OPTIONS : levels.map(value => ({ value, name: value }));
+}
+
 /** Maps live canonical SDK config and the selected model catalog into the ACP 1.2.1 session state surface. */
 export function acpSessionStateFromConfig(
 	query: unknown,
@@ -1436,6 +1451,7 @@ export function acpSessionStateFromConfig(
 	const values = configValues(query);
 	const useModelPresets = modelPreset !== undefined;
 	const currentModeId = values.get(MODE_CONFIG_ID) === ACP_PLAN_MODE_ID ? ACP_PLAN_MODE_ID : ACP_DEFAULT_MODE_ID;
+	const thinkingOptions = thinkingConfigOptions(modelCatalogQuery, values.get(MODEL_CONFIG_ID));
 	return {
 		configOptions: [
 			{
@@ -1461,7 +1477,7 @@ export function acpSessionStateFromConfig(
 							? modelPresetConfigOptions(modelCatalogQuery, value)
 							: modelConfigOptions(modelCatalogQuery, value, activeProviders)
 						: option.id === THINKING_CONFIG_ID
-							? THINKING_CONFIG_OPTIONS
+							? thinkingOptions
 							: [...option.options];
 				return [
 					{
@@ -1798,11 +1814,13 @@ export class AcpAgent implements Agent {
 					if (adapter) adapter.acceptFrame(acpFrame);
 					else this.#pendingRouterFrames.get(attachment.sessionId)?.push(acpFrame);
 				},
-				onSessionRemoved: attachment => {
+				onSessionRemoved: (attachment, removalReason) => {
 					const adapter =
 						this.#sessions.get(attachment.sessionId)?.adapter ??
 						this.#pendingRouterAdapters.get(attachment.sessionId);
 					adapter?.revokeAttachment(attachment);
+					if (adapter && removalReason !== "replaced_same_generation")
+						this.#settlePromptAfterHostClose(attachment.sessionId, removalReason ?? "host_exit");
 				},
 			},
 		});
@@ -2158,7 +2176,22 @@ export class AcpAgent implements Agent {
 				}
 				break;
 			case THINKING_CONFIG_ID:
-				await this.#adapter(params.sessionId).control("thinking.set", { level: params.value });
+				{
+					const before = await this.#sessionState(params.sessionId);
+					const thinkingOption = before.configOptions?.find(option => option.id === THINKING_CONFIG_ID);
+					if (
+						thinkingOption?.type !== "select" ||
+						!thinkingOption.options.some(option => "value" in option && option.value === params.value)
+					)
+						throw new Error(`Unsupported thinking level: ${params.value}`);
+					await this.#adapter(params.sessionId).control("thinking.set", { level: params.value });
+					const after = await this.#sessionState(params.sessionId);
+					const currentValue = after.configOptions?.find(option => option.id === THINKING_CONFIG_ID)?.currentValue;
+					if (currentValue !== params.value)
+						throw new Error(
+							`Thinking level was not applied: requested ${params.value}, current ${currentValue ?? "unknown"}`,
+						);
+				}
 				break;
 			default: {
 				const operation = ACP_CONFIG_CONTROL_OPERATIONS[params.configId];
@@ -4459,6 +4492,37 @@ export class AcpAgent implements Agent {
 		return undefined;
 	}
 
+	/** Settles the active prompt when the host explicitly reports that its session closed. */
+	#settlePromptAfterHostClose(id: string, reason: string): void {
+		const record = this.#sessions.get(id);
+		if (!record) return;
+		const waiter = record.activePrompt;
+		if (!waiter || waiter.settled || waiter.terminalReserved) return;
+		if (record.cancelRequested && waiter.cancelAcknowledged) {
+			void this.#settleCancelledPrompt(id, record, waiter);
+			return;
+		}
+		// An accepted mutation without its acknowledgement remains uncertain. Keep the
+		// existing reconciliation path so a host exit never turns an ambiguous prompt
+		// into a retryable failure.
+		if (waiter.dispatched && !waiter.acknowledged) {
+			this.#startUncertainPromptRecovery(id, record, waiter);
+			return;
+		}
+		record.busy = record.backgroundBusy;
+		void this.#rejectPrompt(
+			record,
+			id,
+			waiter,
+			new AcpPromptAbandonedError(
+				"prompt_abandoned",
+				`ACP prompt was abandoned because the SDK session host closed (${reason}). The turn was settled so the ` +
+					`client stops waiting; a new prompt requires a valid or re-established session attachment.`,
+				waiter.planSnapshot,
+			),
+		);
+	}
+
 	/**
 	 * Settles the ACP prompt only. The agent's own work is left alone: this reports that the
 	 * turn can no longer be observed, it does not cancel or tear down the session.
@@ -4532,6 +4596,14 @@ export class AcpAgent implements Agent {
 			else logger.warn(`ACP session ${id} dropped an event from a foreign session identity.`);
 			return;
 		}
+		if (ingressEvent?.type === "session_closed" || ingressEvent?.type === "session_terminated") {
+			const reason =
+				typeof ingressEvent.reason === "string" && ingressEvent.reason.length > 0
+					? ingressEvent.reason
+					: ingressEvent.type;
+			this.#settlePromptAfterHostClose(id, reason);
+			return;
+		}
 		if (frame.type !== "hello" && frame.type !== "server_hello" && typeof frame.connectionId === "string")
 			record.connectionId = frame.connectionId;
 		// Ingress ordering is recorded before queued work begins.

package/src/runtime-mcp/client.ts

@@ -451,6 +451,9 @@ function isModernMethodNotFound(error: unknown): boolean {
  * The original request is retried with `inputResponses` and a verbatim
  * `requestState` echo under a fresh JSON-RPC id, at most MAX_MRTR_RETRIES times;
  * the retry is fenced to the originating exchange by a stable correlation id.
+ * `roots/list` input requests are answered locally; every other input request
+ * requires `options.inputHandler`, and its absence fails the exchange before any
+ * retry is sent (no write replay, no implicit accept).
  */
 async function requestWithInputHandling<T>(
 	connection: MCPServerConnection,
@@ -474,17 +477,20 @@ async function requestWithInputHandling<T>(
 	if (!inputRequired) return stripResultType(initial);
 
 	const handler = options?.inputHandler;
-	if (!handler) {
-		throw new MCPExpectedFailure(
+	const correlationId = crypto.randomUUID();
+
+	const missingHandler = () =>
+		new MCPExpectedFailure(
 			new Error(
 				`MCP server "${connection.name}" requested additional input (input_required) for ${method}, but no interactive input handler is available`,
 			),
 		);
-	}
-	const correlationId = crypto.randomUUID();
 
 	for (let attempt = 0; attempt < MAX_MRTR_RETRIES; attempt++) {
 		const inputResponses: Record<string, unknown> = {};
+		// A requestState-only round has no local answer to give; without an
+		// interactive handler it is never replayed unattended.
+		if (!handler && Object.keys(inputRequired.inputRequests).length === 0) throw missingHandler();
 		for (const [key, request] of Object.entries(inputRequired.inputRequests)) {
 			if (options?.signal?.aborted) {
 				throw options.signal.reason instanceof Error ? options.signal.reason : new Error("Aborted");
@@ -494,6 +500,9 @@ async function requestWithInputHandling<T>(
 				inputResponses[key] = await defaultRequestHandler("roots/list", undefined);
 				continue;
 			}
+			// Everything else (elicitation, sampling, ...) needs a real interactive
+			// handler. It is never answered implicitly; fail before any retry is sent.
+			if (!handler) throw missingHandler();
 			const outcome = await handler(key, request, {
 				serverName: connection.name,
 				originMethod: method,

package/src/runtime-mcp/elicitation.ts

@@ -0,0 +1,142 @@
+import { untilAborted } from "@gajae-code/utils";
+import type { ExtensionUIContext } from "../extensibility/extensions/types";
+import type { AskAnswerSource, AskRemoteReceipt } from "../tools";
+import type { MCPInputRequestHandler } from "./types";
+
+export interface MCPFormInputDependencies {
+	getUi(): { ui?: Pick<ExtensionUIContext, "select" | "input">; hasUI: boolean };
+	getAskAnswerSource(): AskAnswerSource | undefined;
+}
+
+interface FormField {
+	key: string;
+	label: string;
+	type: "string" | "boolean";
+	choices?: string[];
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function displayText(value: string): string {
+	return value.replace(/[\p{Cc}\p{Cf}\u2028\u2029]/gu, " ").slice(0, 4000);
+}
+
+/** Unsupported constraints are rejected, never silently discarded. */
+function decodeField(schema: unknown): FormField | undefined {
+	if (!isRecord(schema) || schema.type !== "object" || !isRecord(schema.properties)) return undefined;
+	const allowed = new Set(["type", "properties", "required", "additionalProperties", "title", "description"]);
+	if (Object.keys(schema).some(key => !allowed.has(key))) return undefined;
+	if (schema.additionalProperties !== undefined && typeof schema.additionalProperties !== "boolean") return undefined;
+	const entries = Object.entries(schema.properties);
+	if (entries.length !== 1) return undefined;
+	const [key, property] = entries[0]!;
+	if (!isRecord(property) || (property.type !== "string" && property.type !== "boolean")) return undefined;
+	if (
+		schema.required !== undefined &&
+		(!Array.isArray(schema.required) || schema.required.some(value => value !== key))
+	)
+		return undefined;
+	const propertyKeys = new Set(["type", "title", "description", "enum"]);
+	if (Object.keys(property).some(name => !propertyKeys.has(name))) return undefined;
+	if (property.title !== undefined && typeof property.title !== "string") return undefined;
+	if (property.description !== undefined && typeof property.description !== "string") return undefined;
+	let choices: string[] | undefined;
+	if (property.enum !== undefined) {
+		if (
+			property.type !== "string" ||
+			!Array.isArray(property.enum) ||
+			property.enum.length === 0 ||
+			!property.enum.every(value => typeof value === "string") ||
+			new Set(property.enum).size !== property.enum.length ||
+			property.enum.some(value => displayText(value) !== value)
+		)
+			return undefined;
+		choices = property.enum;
+	}
+	const description = typeof property.description === "string" ? ` — ${property.description}` : "";
+	return { key, label: displayText(`${property.title ?? key}${description}`), type: property.type, choices };
+}
+
+/** Register on an owned manager; dependencies are resolved per call for late UI registration. */
+export function createMCPFormInputHandler(deps: MCPFormInputDependencies): MCPInputRequestHandler {
+	return async (_key, request, context) => {
+		if (context.signal?.aborted) return { kind: "failed", reason: "cancelled" };
+		if (request.method !== "elicitation/create") return { kind: "failed", reason: "unavailable" };
+		const params = request.params;
+		if (!params || typeof params.message !== "string" || (params.mode !== undefined && params.mode !== "form"))
+			return { kind: "failed", reason: "unavailable", message: "Unsupported MCP form request" };
+		const field = decodeField(params.requestedSchema);
+		if (!field) return { kind: "failed", reason: "unavailable", message: "Unsupported MCP form schema" };
+		const local = deps.getUi();
+		const ui = local.hasUI ? local.ui : undefined;
+		const source = ui ? undefined : deps.getAskAnswerSource();
+		if (!ui && !source)
+			return { kind: "failed", reason: "unavailable", message: "No user input surface is available" };
+		const signal = context.signal;
+		const ask = async (question: string, choices?: string[]): Promise<string | undefined> => {
+			return untilAborted(signal, async () => {
+				if (ui)
+					return choices ? ui.select(question, choices, { signal }) : ui.input(question, undefined, { signal });
+				if (!source) return undefined;
+				const answer = source.awaitAnswerRequest
+					? await source.awaitAnswerRequest(
+							{
+								question,
+								options: choices ?? [],
+								interaction: choices ? "selector" : "custom_editor",
+								controls: [],
+							},
+							signal,
+						)
+					: await source.awaitAnswer(question, choices ?? [], signal);
+				let receipt: AskRemoteReceipt | undefined;
+				let value: string | undefined;
+				if (typeof answer === "string") value = answer;
+				else if (answer) {
+					receipt = answer;
+					if (answer.interaction.kind === "value") value = answer.interaction.value;
+				}
+				if (signal?.aborted) {
+					await receipt?.settle({ kind: "resolve_without_commit", reason: "aborted" });
+					return undefined;
+				}
+				if (receipt?.interaction.kind === "control") {
+					await receipt.settle({ kind: "invalid", reason: "invalid_control" });
+					throw new Error("Invalid MCP form control");
+				}
+				if (value !== undefined && choices && !choices.includes(value)) {
+					await receipt?.settle({ kind: "invalid", reason: "invalid_option" });
+					throw new Error("Invalid MCP form answer");
+				}
+				const settlement = await receipt?.settle(
+					value === undefined ? { kind: "resolve_without_commit", reason: "cancelled" } : { kind: "commit" },
+				);
+				if (receipt && value !== undefined && settlement?.kind !== "committed") return undefined;
+				return value;
+			});
+		};
+		try {
+			const title = `MCP server ${displayText(context.serverName)} requests input (untrusted server text): ${displayText(params.message)}`;
+			const action = await ask(title, ["Accept", "Decline"]);
+			if (signal?.aborted) return { kind: "failed", reason: "cancelled" };
+			if (action === undefined) return { kind: "result", result: { action: "cancel" } };
+			if (action === "Decline") return { kind: "result", result: { action: "decline" } };
+			if (action !== "Accept") return { kind: "failed", reason: "error", message: "Invalid MCP form action" };
+			const choices = field.type === "boolean" ? ["Yes", "No"] : field.choices;
+			const answer = await ask(
+				`MCP server ${displayText(context.serverName)} (untrusted server text): ${field.label}`,
+				choices,
+			);
+			if (signal?.aborted) return { kind: "failed", reason: "cancelled" };
+			if (answer === undefined) return { kind: "result", result: { action: "cancel" } };
+			if (choices && !choices.includes(answer))
+				return { kind: "failed", reason: "error", message: "Invalid MCP form answer" };
+			const value = field.type === "boolean" ? answer === "Yes" : answer;
+			return { kind: "result", result: { action: "accept", content: { [field.key]: value } } };
+		} catch {
+			return { kind: "failed", reason: signal?.aborted ? "cancelled" : "error" };
+		}
+	};
+}

package/src/sdk/broker/broker.ts

@@ -1525,6 +1525,7 @@ export class Broker {
 	#publishedAt: bigint | null = null;
 	#startedAt: bigint | null = null;
 	#watchInFlight = false;
+	#checkpointInFlight = false;
 	#stopping = false;
 	#transport: BrokerTransport | null = null;
 	#heartbeatTimer: NodeJS.Timeout | null = null;
@@ -3786,6 +3787,7 @@ export class Broker {
 		this.#publishedAt = null;
 		this.#startedAt = process.hrtime.bigint();
 		this.#watchInFlight = false;
+		this.#checkpointInFlight = false;
 		this.#throwIfStartupAborted();
 		await Promise.all([this.ledger.assertSupportedStateVersions(), readBrokerDiscovery(this.settings.agentDir)]);
 		this.#throwIfStartupAborted();
@@ -4192,7 +4194,7 @@ export class Broker {
 					return;
 			}
 			this.#startupAdmissions.reopen();
-			if (this.#publicationState === "healthy-owned") await this.#checkpointSessionHeartbeats();
+			if (this.#publicationState === "healthy-owned") void this.#checkpointSessionHeartbeats();
 			return;
 		}
 		this.#fence(observation === "ambiguous" ? "observation-ambiguous" : "suspect-unpublished");
@@ -4233,10 +4235,14 @@ export class Broker {
 		return await this.index.checkpointLiveHeartbeats(now);
 	}
 	async #checkpointSessionHeartbeats(): Promise<void> {
+		if (this.#checkpointInFlight || this.#stopping) return;
+		this.#checkpointInFlight = true;
 		try {
 			await this.heartbeatSessions();
 		} catch (error) {
 			logger.warn(`sdk broker: session heartbeat checkpoint failed: ${String(error)}`);
+		} finally {
+			this.#checkpointInFlight = false;
 		}
 	}
 	async #complete(
@@ -4260,6 +4266,7 @@ export class Broker {
 		};
 		(mode === "lost-root" ? logger.warn : logger.info)("sdk broker: exiting", exitRecord);
 		this.#stopping = true;
+		this.#checkpointInFlight = false;
 		this.#publicationState = "stopping";
 		// A lost-root broker has been fenced: it no longer owns the published root, and
 		// its settlement is bounded, so any startup still queued behind it would be

package/src/sdk/broker/lifecycle.ts

@@ -1667,9 +1667,9 @@ export async function reapDeadLifecycleMarkers(
 	let inspected = 0;
 	for await (const entry of directoryHandle) {
 		if (inspected >= inspectionLimit) break;
-		inspected += 1;
 		const name = entry.name;
 		if (!entry.isFile() || !name.endsWith(".lifecycle.json")) continue;
+		inspected += 1;
 		const id = name.slice(0, -".lifecycle.json".length);
 		if (!isCanonicalSessionId(id)) continue;
 		const markerPath = path.join(directory, name);
@@ -1741,6 +1741,108 @@ export async function reapDeadLifecycleMarkers(
 	return reaped;
 }
 
+/**
+ * Retires one launch id's lifecycle marker pair after its recorded owner has
+ * exited. Unlike the bounded background sweep, this launch-local repair is
+ * not age-gated and does not require the ready sibling to contain the same
+ * effect marker: the primary marker is the owner authority for this id.
+ */
+type RetireExitedLifecycleMarkerPairHook = () => void | Promise<void>;
+
+async function retireExitedLifecycleMarkerPairImpl(
+	root: string,
+	id: string,
+	afterObservation?: RetireExitedLifecycleMarkerPairHook,
+): Promise<boolean> {
+	if (!isCanonicalSessionId(id)) return false;
+	let directory: string;
+	let directoryIdentity: { dev: bigint; ino: bigint };
+	try {
+		const canonicalRoot = fsSync.realpathSync(root);
+		directory = path.join(canonicalRoot, "sdk");
+		const directoryStat = fsSync.lstatSync(directory, { bigint: true });
+		if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) return false;
+		directoryIdentity = { dev: directoryStat.dev, ino: directoryStat.ino };
+	} catch {
+		return false;
+	}
+	const markerPath = lifecycleMarkerPath(path.dirname(directory), id);
+	const primary = captureLifecycleFile(markerPath, true, true);
+	if (!primary) return false;
+	let marker: EffectMarker;
+	try {
+		const parsed = parseLifecycleJson(primary.bytes);
+		if (!isExactEffectMarker(parsed)) return false;
+		marker = parsed;
+	} catch {
+		return false;
+	}
+	if (observeProcess(marker.pid, marker.incarnation) !== "exited") return false;
+	await afterObservation?.();
+	const readyPath = lifecycleReadyPath(path.dirname(directory), id);
+	const ready = captureLifecycleFile(readyPath, true, true);
+	try {
+		const currentParent = lifecycleParentIdentity(directory);
+		if (
+			!currentParent ||
+			BigInt(currentParent.dev) !== directoryIdentity.dev ||
+			BigInt(currentParent.ino) !== directoryIdentity.ino
+		)
+			return false;
+		const currentPrimary = captureLifecycleFile(markerPath, true, true);
+		await afterObservation?.();
+		if (
+			!currentPrimary ||
+			!sameLifecycleCleanupIdentity(
+				currentPrimary.identity,
+				serializeCleanupIdentity({ ...primary.identity, size: Number(primary.identity.size) }),
+			)
+		)
+			return false;
+		const currentMarker = parseLifecycleJson(currentPrimary.bytes);
+		if (!isExactEffectMarker(currentMarker) || !sameEffectMarker(currentMarker, marker)) return false;
+		if (ready) {
+			const currentReady = captureLifecycleFile(readyPath, true, true);
+			if (
+				!currentReady ||
+				!sameLifecycleCleanupIdentity(
+					currentReady.identity,
+					serializeCleanupIdentity({ ...ready.identity, size: Number(ready.identity.size) }),
+				)
+			)
+				return false;
+			const removedReady = nativeLifecycle().exactUnlinkDirect(readyPath, {
+				...ready.identity,
+				parentDev: directoryIdentity.dev,
+				parentIno: directoryIdentity.ino,
+				quarantineName: `.gjc-reap-${randomUUID()}-${path.basename(readyPath)}`,
+			});
+			if (!removedReady.ok && removedReady.code !== "not_found") return false;
+		}
+		const removedMarker = nativeLifecycle().exactUnlinkDirect(markerPath, {
+			...primary.identity,
+			parentDev: directoryIdentity.dev,
+			parentIno: directoryIdentity.ino,
+			quarantineName: `.gjc-reap-${randomUUID()}-${path.basename(markerPath)}`,
+		});
+		return removedMarker.ok || removedMarker.code === "not_found";
+	} catch {
+		return false;
+	}
+}
+
+export async function retireExitedLifecycleMarkerPair(root: string, id: string): Promise<boolean> {
+	return retireExitedLifecycleMarkerPairImpl(root, id);
+}
+
+export async function retireExitedLifecycleMarkerPairForTest(
+	root: string,
+	id: string,
+	afterObservation: RetireExitedLifecycleMarkerPairHook,
+): Promise<boolean> {
+	return retireExitedLifecycleMarkerPairImpl(root, id, afterObservation);
+}
+
 export async function writeEffectMarker(root: string, id: string, marker: EffectMarker): Promise<void> {
 	const directory = path.join(root, "sdk");
 	await fs.mkdir(directory, { recursive: true, mode: 0o700 });
@@ -5392,12 +5494,11 @@ async function currentReadyAuthority(
 			token?: unknown;
 			pid?: unknown;
 		};
-		// Native-alive owned readiness is the admission authority. `record.live`
-		// also requires a fresh index heartbeat projection, which can lag a just-
-		// registered detached Windows host. Never admit a terminal/uncertain or
-		// native-dead child; do not refuse a native-alive ready host for a stale live bit.
-		await broker.heartbeatSessions();
-		await broker.index.refresh();
+		// Native-alive owned readiness is the admission authority. The indexed
+		// projection can lag a just-registered detached Windows host, so the
+		// change-stamp refresh is deliberately separate from heartbeat liveness.
+		// Never admit a terminal/uncertain or native-dead child.
+		await broker.index.refreshIfChanged();
 		const record = broker.index
 			.listSessions()
 			.sessions.find(
@@ -6650,6 +6751,7 @@ async function executeLifecycleResponse(
 				terminationStartDeadline = childDeadlines.terminationStartDeadlineAt;
 				lifecycleDeadline = childDeadlines.lifecycleCleanupDeadlineAt;
 			}
+			await retireExitedLifecycleMarkerPair(launch.root, launch.id);
 			await reapDeadLifecycleMarkers(launch.root);
 		} catch (error) {
 			if (launch.worktreePlan && worktreeReceipt?.created && !worktreeReceipt.reused) {