@gajae-code/coding-agent 0.18.7 → 0.18.9

package/src/skill-state/active-state.ts

@@ -11,10 +11,13 @@ import { resolveGjcSessionForRead, SessionResolutionError } from "../gjc-runtime
 import {
 	type ActiveSessionScope,
 	type GuardedWriteResult,
+	persistedStateRevision,
 	readActiveEntries,
+	readActiveEntriesStrict,
 	rebuildActiveSnapshot,
 	removeActiveEntry,
 	setActiveStateCacheInvalidator,
+	workflowEnvelopeChecksumStatus,
 	writeActiveEntry,
 } from "../gjc-runtime/state-writer";
 import { getSkillManifest } from "../gjc-runtime/workflow-manifest";
@@ -517,6 +520,18 @@ async function readModeStatePhase(
 		const phase = safeString(record.current_phase).trim();
 		if (!phase) return undefined;
 		if (record.active === false && !getSkillManifest("ralplan").canonicalOverrides.includes(phase)) return undefined;
+		const claimedSession = safeString(record.session_id).trim();
+		if (claimedSession && claimedSession !== sessionId) return undefined;
+		// A mode-state phase may replace the active entry only when the writer
+		// stamp still matches. A checksum mismatch is an out-of-band edit. An
+		// unsigned releasing phase is not a seal and must not paint "complete"
+		// onto a planning entry. Non-releasing canonical phases (final, handoff)
+		// still overlay, and a matching stamp still overlays a releasing phase.
+		const checksum = workflowEnvelopeChecksumStatus(record);
+		if (checksum === "mismatch") return undefined;
+		if (checksum === "absent" && getSkillManifest(skill).stopReleasingPhases.includes(phase.trim().toLowerCase())) {
+			return undefined;
+		}
 		return phase;
 	} catch {
 		return undefined;
@@ -667,13 +682,17 @@ async function mergeVisibleEntries(
 	cwd: string,
 	sessionState: SkillActiveState | null,
 	sessionId: string,
+	perSkillEntries?: readonly SkillActiveEntry[],
 ): Promise<SkillActiveEntry[]> {
 	// Use the raw (active + inactive) rows so a handoff demotion stays visible
 	// long enough to supersede a stale same-skill row before the active filter.
 	// Per-skill files in active/<skill>.json are authoritative and are merged
 	// after the derived snapshot cache, so a stale skill-active-state.json row
 	// cannot override the latest entry file.
-	const entries = [...rawActiveEntries(sessionState), ...(await readActiveEntries(cwd, { sessionId }))];
+	const entries = [
+		...rawActiveEntries(sessionState),
+		...(perSkillEntries ?? (await readActiveEntries(cwd, { sessionId }))),
+	];
 	const merged = new Map(entries.map(entry => [entryKey(entry), entry]));
 	const canonicalRalplanPhase = await readModeStatePhase(cwd, sessionId, "ralplan");
 	const visibleEntries = dedupeVisibleBySkill([...merged.values()], sessionId)
@@ -788,7 +807,16 @@ async function readVisibleSkillActiveStateUncached(
 ): Promise<SkillActiveState | null> {
 	const { sessionPath } = getSkillActiveStatePaths(cwd, resolvedSessionId);
 	const sessionState = await readRawActiveStateForHandoff(sessionPath, false);
-	const activeSkills = await mergeVisibleEntries(cwd, sessionState, resolvedSessionId);
+	return await buildVisibleSkillActiveState(cwd, sessionState, resolvedSessionId);
+}
+
+async function buildVisibleSkillActiveState(
+	cwd: string,
+	sessionState: SkillActiveState | null,
+	resolvedSessionId: string,
+	perSkillEntries?: readonly SkillActiveEntry[],
+): Promise<SkillActiveState | null> {
+	const activeSkills = await mergeVisibleEntries(cwd, sessionState, resolvedSessionId, perSkillEntries);
 	if (activeSkills.length === 0) return null;
 	const primary = activeSkills[0];
 	return {
@@ -805,6 +833,121 @@ async function readVisibleSkillActiveStateUncached(
 
 setActiveStateCacheInvalidator(invalidateVisibleSkillActiveStateCache);
 
+/**
+ * Outcome of a failure-observable workflow-state read:
+ * - `absent`: neither a session snapshot nor a per-skill entry is recorded.
+ * - `read`: every recorded source was read and no snapshot row lacks authority.
+ * - `recovered`: the session snapshot was unreadable, but authoritative per-skill
+ *   entries (which the snapshot is rebuilt from) supplied the visible state.
+ * - `discarded`: the snapshot is a derived cache that still lists active workflows
+ *   whose per-skill entry is gone or inactive (e.g. a deactivation whose snapshot
+ *   rebuild never ran); those stale rows were dropped and the visible state comes
+ *   from the per-skill entries alone.
+ * - `unresolved`: the snapshot lists active workflows without an active per-skill
+ *   entry, but it cannot be shown to be a derived cache, so those rows may be legacy
+ *   authority or stale cache; they are excluded without confirming their absence.
+ * - `failed`: the session snapshot was unreadable and no per-skill entry could
+ *   replace it (e.g. a corrupt legacy root-only record), so the state is unknown.
+ */
+export type VisibleSkillActiveStateReadStatus = "absent" | "read" | "recovered" | "discarded" | "unresolved" | "failed";
+
+export interface VisibleSkillActiveStateRead {
+	status: VisibleSkillActiveStateReadStatus;
+	/** Visible active state; `null` when nothing is active or the read failed. */
+	state: SkillActiveState | null;
+}
+
+/** Strict snapshot read: `undefined` when absent; throws on I/O errors, invalid JSON, or a non-object record. */
+async function readSessionSnapshotStrict(filePath: string): Promise<SkillActiveState | undefined> {
+	let raw: string;
+	try {
+		raw = await Bun.file(filePath).text();
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+		throw error;
+	}
+	const parsed: unknown = JSON.parse(raw);
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+		throw new Error(`skill-active-state at ${filePath} is not a JSON object`);
+	return parsed as SkillActiveState;
+}
+
+/**
+ * Whether a readable session snapshot can carry workflow authority of its own.
+ *
+ * - `legacy`: a root-only record (no `active_skills` array). The derived-cache
+ *   writers (`rebuildActiveSnapshot` and the activation seed) always persist an
+ *   `active_skills` array, so this shape predates per-skill entries and its row
+ *   stays visible.
+ * - `derived`: an `active_skills` snapshot stamped by the guarded state writer.
+ *   Every stamped producer persists the per-skill entry before the snapshot, so
+ *   the per-skill entries are the only authority for its rows.
+ * - `indeterminate`: an unstamped `active_skills` snapshot. Unstamped derived
+ *   rebuilds and unstamped authoritative activation seeds were both written before
+ *   the guarded writer, so the record cannot establish which one it is.
+ */
+function classifySnapshotAuthority(snapshot: SkillActiveState): "legacy" | "derived" | "indeterminate" {
+	if (!Array.isArray(snapshot.active_skills)) return "legacy";
+	return persistedStateRevision(snapshot) > 0 ? "derived" : "indeterminate";
+}
+
+/**
+ * Uncached, failure-observable counterpart of `readVisibleSkillActiveState` for
+ * read-only projections that must not present unreadable state as absence. The
+ * tolerant reader keeps mapping an unreadable session snapshot to `null` for
+ * HUD and guard callers; this variant reports `failed` or `recovered` instead.
+ *
+ * Unlike the tolerant reader, a snapshot row never survives without authority: an
+ * active row with no active per-skill entry is dropped as stale (`discarded`) when
+ * the snapshot is provably derived, or excluded as `unresolved` when it is not.
+ * Only a legacy root-only record keeps its own row. Per-skill entry read failures
+ * propagate, as they do from the tolerant reader, and so does an entry file that
+ * exists but holds no usable skill entry (e.g. `{}`): the tolerant reader skips
+ * it, which would make it indistinguishable from a deleted entry and let it pass
+ * as proof that a snapshot row is stale. The read never repairs state.
+ */
+export async function readVisibleSkillActiveStateWithStatus(
+	cwd: string,
+	sessionId: string,
+): Promise<VisibleSkillActiveStateRead> {
+	const resolvedCwd = path.resolve(cwd);
+	const { sessionPath } = getSkillActiveStatePaths(resolvedCwd, sessionId);
+	let sessionState: SkillActiveState | undefined;
+	let snapshotUnreadable = false;
+	try {
+		sessionState = await readSessionSnapshotStrict(sessionPath);
+	} catch {
+		snapshotUnreadable = true;
+	}
+	const perSkillEntries = await readActiveEntriesStrict(resolvedCwd, { sessionId });
+	const fromEntries = () => buildVisibleSkillActiveState(resolvedCwd, null, sessionId, perSkillEntries);
+	if (snapshotUnreadable) {
+		if (perSkillEntries.length === 0) return { status: "failed", state: null };
+		return { status: "recovered", state: await fromEntries() };
+	}
+	if (sessionState === undefined) {
+		return perSkillEntries.length === 0
+			? { status: "absent", state: null }
+			: { status: "read", state: await fromEntries() };
+	}
+	const authority = classifySnapshotAuthority(sessionState);
+	if (authority === "legacy") {
+		return {
+			status: "read",
+			state: await buildVisibleSkillActiveState(resolvedCwd, sessionState, sessionId, perSkillEntries),
+		};
+	}
+	const activeEntrySkills = new Set(
+		perSkillEntries.filter(entry => entry.active !== false).map(entry => safeString(entry.skill).trim()),
+	);
+	const hasUnbackedRow = rawActiveEntries(sessionState).some(
+		entry => entry.active !== false && !activeEntrySkills.has(entry.skill),
+	);
+	const state = await fromEntries();
+	if (!hasUnbackedRow) return { status: "read", state };
+	return { status: authority === "derived" ? "discarded" : "unresolved", state };
+}
+
 export async function readVisibleSkillActiveState(
 	cwd: string,
 	sessionId?: string,

package/src/skill-state/workflow-mutation-guard.ts

@@ -8,8 +8,10 @@ import { expandApplyPatchToEntries } from "../edit/modes/apply-patch";
 import { GJC_SESSION_PREFIX, modeStatePath as sessionModeStatePath } from "../gjc-runtime/session-layout";
 import { resolveGjcSessionForRead } from "../gjc-runtime/session-resolution";
 import { ModeStateSchema } from "../gjc-runtime/state-schema";
+import { workflowEnvelopeChecksumStatus } from "../gjc-runtime/state-writer";
 import { getSkillManifest } from "../gjc-runtime/workflow-manifest";
 import { LocalProtocolHandler, resolveLocalUrlToPath } from "../internal-urls/local-protocol";
+import { isGithubReadOnlyArgs } from "../tools/github-side-effect";
 import { resolveToCwd } from "../tools/path-utils";
 import { ToolError } from "../tools/tool-errors";
 import { listActiveSkills, readVisibleSkillActiveState, type SkillActiveEntry } from "./active-state";
@@ -38,7 +40,14 @@ function planningPhaseBlockMessage(skill: CanonicalGjcWorkflowSkill): string {
 	return DEEP_INTERVIEW_MUTATION_BLOCK_MESSAGE;
 }
 
-const BLOCKED_TOOL_NAMES = new Set(["edit", "write", "ast_edit", "bash"]);
+/** Tools whose execute path can mutate product state. `github` is included so side-effect ops share this guard. */
+export const WORKFLOW_MUTATION_TOOL_NAMES = ["edit", "write", "ast_edit", "bash", "github"] as const;
+
+const BLOCKED_TOOL_NAMES = new Set<string>(WORKFLOW_MUTATION_TOOL_NAMES);
+
+export function isWorkflowMutationTool(name: string): boolean {
+	return BLOCKED_TOOL_NAMES.has(name);
+}
 /**
  * Only `/dev/null` is exempt. `/dev/stdout`, `/dev/stderr`, and `/dev/fd/<n>` are descriptor
  * aliases: `exec 1<>src/product.ts; printf x >/dev/stdout` reaches a real repository file
@@ -317,10 +326,20 @@ function resolveCurrentWorkflowEntry(entries: SkillActiveEntry[], topLevelSkill:
  * governs, so a stale planning entry can never block while an executor runs and
  * a resumed planning phase reliably re-blocks.
  *
- * Fail-open contract: a missing or invalid durable mode-state releases the block
- * (a corrupt state file must not lock all mutation), matching the guard's
- * historical behavior — this is intentionally looser than the Stop hook, which
- * fails closed for handoff-required skills.
+ * Fail-open contract: a missing or schema-invalid durable mode-state releases
+ * the block (a corrupt state file must not lock all mutation), matching the
+ * guard's historical behavior — this is intentionally looser than the Stop
+ * hook, which fails closed for handoff-required skills. A checksum mismatch is
+ * not that case: the file is still schema-valid, and the CLI already refuses
+ * it as an out-of-band edit. The guard keeps the active entry's phase instead
+ * of letting the forged `current_phase` or `active: false` release the block.
+ * An unsigned envelope may restate that entry, but it may not release a block
+ * the entry still holds. It may still name a stricter blocking phase: the
+ * pre-fix guard honored that phase, and dropping it would allow an edit the
+ * base rejected. A `session_id` or `thread_id` that does not match this
+ * session is the same kind of claim: it does not make the file someone else's,
+ * and it does not open the block. A matching `content_sha256` whose context
+ * also matches is the existing writer stamp and is trusted.
  */
 async function getActivePlanningSkill(
 	cwd: string,
@@ -343,11 +362,73 @@ async function getActivePlanningSkill(
 	const modeState = guardContext.modeStates.get(current.skill) ?? null;
 
 	if (!modeState) return null;
-	if (modeState.active !== true) return null;
-	if (!modeStateMatchesContext(modeState, resolvedSessionId, threadId)) return null;
-	const phase = String(modeState.current_phase ?? current.phase ?? "").trim();
-	if (!isBlockingPlanningPhase(current.skill, phase)) return null;
-	return { skill: current.skill, phase };
+	const activePhase = String(current.phase ?? "").trim();
+	const posture = planningPostureFromModeState(current.skill, activePhase, modeState, resolvedSessionId, threadId);
+	if (posture.tampered) {
+		warnInvalidModeState(
+			modeStatePath(cwd, current.skill, resolvedSessionId),
+			"out-of-band edit detected (content_sha256 mismatch)",
+		);
+	}
+	if (!posture.blocking) return null;
+	return { skill: current.skill, phase: posture.phase };
+}
+
+/**
+ * Decide whether `modeState` may release the planning block.
+ *
+ * The active entry is the seal. A mode-state file releases that seal only when
+ * its writer-stamped `content_sha256` matches and its session context matches,
+ * or when an unsigned file in the same context does not claim a looser posture
+ * than the entry. An unsigned file may still impose a stricter blocking phase.
+ * Checksum mismatch ignores the file. A context mismatch does not release the
+ * entry's block: the file was read from this session's path.
+ */
+function planningPostureFromModeState(
+	skill: MutationGatedSkill,
+	activePhase: string,
+	modeState: ModeState,
+	sessionId?: string,
+	threadId?: string,
+): { blocking: boolean; phase: string; tampered: boolean } {
+	const status = workflowEnvelopeChecksumStatus(modeState);
+	if (status === "mismatch") {
+		return {
+			blocking: isBlockingPlanningPhase(skill, activePhase),
+			phase: activePhase,
+			tampered: true,
+		};
+	}
+	if (!modeStateMatchesContext(modeState, sessionId, threadId)) {
+		return {
+			blocking: isBlockingPlanningPhase(skill, activePhase),
+			phase: activePhase,
+			tampered: false,
+		};
+	}
+	if (status === "match") {
+		if (modeState.active !== true) return { blocking: false, phase: activePhase, tampered: false };
+		const phase = String(modeState.current_phase ?? activePhase).trim();
+		return { blocking: isBlockingPlanningPhase(skill, phase), phase, tampered: false };
+	}
+	if (!isBlockingPlanningPhase(skill, activePhase)) {
+		const stricterPhase = String(modeState.current_phase ?? "").trim();
+		if (modeState.active === true && stricterPhase && isBlockingPlanningPhase(skill, stricterPhase)) {
+			return { blocking: true, phase: stricterPhase, tampered: false };
+		}
+		return { blocking: false, phase: activePhase, tampered: false };
+	}
+	if (modeState.active !== true) return { blocking: true, phase: activePhase, tampered: false };
+	const modePhase = String(modeState.current_phase ?? "").trim();
+	if (
+		modePhase &&
+		!isBlockingPlanningPhase(skill, modePhase) &&
+		modePhase.trim().toLowerCase() !== activePhase.trim().toLowerCase()
+	) {
+		return { blocking: true, phase: activePhase, tampered: false };
+	}
+	const phase = modePhase || activePhase;
+	return { blocking: isBlockingPlanningPhase(skill, phase), phase, tampered: false };
 }
 
 function normalizePosix(value: string): string {
@@ -1607,11 +1688,22 @@ function extractBashTargets(args: unknown, depth = 0): ExtractedTargets {
 	}
 	return targets;
 }
+/**
+ * Read-only github ops extract no mutation. Every other op fails closed during
+ * planning: remote push, PR creation, and worktree/config writes are not a
+ * filesystem path the planning allowlist can clear.
+ */
+function extractGithubTargets(args: unknown): ExtractedTargets {
+	if (isGithubReadOnlyArgs(args)) return { paths: [], unknown: false };
+	return { paths: [], unknown: true, explicitMutation: true };
+}
+
 function extractTargets(tool: ToolWithEditMode, args: unknown): ExtractedTargets {
 	if (tool.name === "write") return extractWriteTargets(args);
 	if (tool.name === "ast_edit") return extractAstEditTargets(args);
 	if (tool.name === "edit") return extractEditTargets(args, tool);
 	if (tool.name === "bash") return extractBashTargets(args);
+	if (tool.name === "github") return extractGithubTargets(args);
 	return { paths: [], unknown: true };
 }
 

package/src/slash-commands/builtin-registry.ts

@@ -31,6 +31,8 @@ import {
 	type InteractiveModeContext,
 } from "../modes/types";
 import { parseUiLanguage, resolveUiLanguage, UI_LANGUAGE_LABELS, UI_LANGUAGES, uiString } from "../modes/ui-language";
+import { buildSessionProjectProgress } from "../progress/collect-project-progress";
+import { PROGRESS_COMMAND_ACP_DESCRIPTION } from "../progress/render-progress";
 // W1b/W5b: notification-service and daemon controllers stay off the static
 // import graph; the /notify handlers import them lazily at first use.
 import type { NotificationProvider } from "../sdk/bus/config";
@@ -63,6 +65,7 @@ import { switchSessionCredentialCommand } from "./helpers/credential-switch";
 import { buildFastStatusReport } from "./helpers/fast-status-report";
 import { formatDuration } from "./helpers/format";
 import { commandConsumed, errorMessage, parseSlashCommand, parseSubcommand, usage } from "./helpers/parse";
+import { renderProgressReportLines, renderProgressReportText } from "./helpers/progress-report";
 import { handleSshAcp } from "./helpers/ssh";
 import { buildUsageReportText, collectCachedUsageReports } from "./helpers/usage-report";
 import type {
@@ -1059,14 +1062,17 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 							const profileLabel = formatModelProfileDisplayLabel(
 								runtime.session.modelRegistry.getModelProfile(presetName) ?? { name: presetName },
 							);
-							await activateModelProfile(
-								{
-									session: runtime.session,
-									modelRegistry: runtime.session.modelRegistry,
-									settings: runtime.settings,
-									profileName: presetName,
-								},
-								{ persistDefault: false },
+							runtime.session.markUserModelSelection();
+							await runtime.session.withSdkControlMutation(() =>
+								activateModelProfile(
+									{
+										session: runtime.session,
+										modelRegistry: runtime.session.modelRegistry,
+										settings: runtime.settings,
+										profileName: presetName,
+									},
+									{ persistDefault: false },
+								),
 							);
 							await runtime.output(`Model profile: ${profileLabel}`);
 							await runtime.notifyTitleChanged?.();
@@ -1106,6 +1112,7 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 							throw new Error(`No API key for ${selection.model.provider}/${selection.model.id}`);
 						}
 					}
+					if (includesRoleAgent && !includesDefault) runtime.session.markUserModelSelection();
 
 					const overrides = runtime.settings.get("task.agentModelOverrides");
 					const assignments = new Map<GjcModelAssignmentTargetId, string>();
@@ -1136,7 +1143,6 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 							runtime.session.setThinkingLevel(existingDefaultThinkingLevel);
 						}
 					}
-
 					const materializedProfile = materializeActiveModelProfileAssignments({
 						session: runtime.session,
 						settings: runtime.settings,
@@ -1584,6 +1590,30 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 			runtime.ctx.editor.setText("");
 		},
 	},
+	{
+		name: "progress",
+		description:
+			"Show a read-only project progress overview from durable goal, todo, workflow, agent, and verification state",
+		// Production ACP advertises and dispatches `/progress` itself over the
+		// `session.progress` SDK query (modes/acp/acp-agent.ts) with the same copy.
+		acpDescription: PROGRESS_COMMAND_ACP_DESCRIPTION,
+		allowArgs: false,
+		handle: async (_command, runtime) => {
+			const report = await buildSessionProjectProgress(runtime.session, runtime.sessionManager);
+			await runtime.output(renderProgressReportText(report));
+			return commandConsumed();
+		},
+		handleTui: async (_command, runtime) => {
+			const ctx = runtime.ctx;
+			const report = await buildSessionProjectProgress(ctx.session, ctx.sessionManager);
+			ctx.chatContainer.addChild(new Spacer(1));
+			ctx.chatContainer.addChild(new DynamicBorder());
+			ctx.chatContainer.addChild(new Text(renderProgressReportLines(report, theme).join("\n"), 1, 0));
+			ctx.chatContainer.addChild(new DynamicBorder());
+			ctx.ui.requestRender();
+			ctx.editor.setText("");
+		},
+	},
 	{
 		name: "usage",
 		description: "Show provider usage and limits",

package/src/slash-commands/helpers/mcp.ts

@@ -9,6 +9,7 @@ import {
 	updateMCPServer,
 } from "../../runtime-mcp/config-writer";
 import { MCPManager } from "../../runtime-mcp/manager";
+import { nativeMcpSource } from "../../runtime-mcp/project-host-values";
 import { getSmitheryApiKey } from "../../runtime-mcp/smithery-auth";
 import { searchSmitheryRegistry } from "../../runtime-mcp/smithery-registry";
 import type { MCPServerConfig, MCPServerConnection } from "../../runtime-mcp/types";
@@ -199,6 +200,7 @@ async function withPreparedMcpConnection<T>(
 	runtime: SlashCommandRuntime,
 	name: string,
 	config: MCPServerConfig,
+	scope: AcpMcpScope,
 	fn: (connection: MCPServerConnection) => Promise<T>,
 ): Promise<T> {
 	const manager = new MCPManager(runtime.cwd, null, {
@@ -207,7 +209,9 @@ async function withPreparedMcpConnection<T>(
 	// Auth storage must be wired in before the prepared lease so OAuth-backed
 	// servers can refresh credentials and inject Authorization headers.
 	manager.setAuthStorage(runtime.session.modelRegistry.authStorage);
-	return manager.withPreparedLease(name, config, lease => fn(lease.connectionForLease()));
+	return manager.withPreparedLease(name, config, lease => fn(lease.connectionForLease()), {
+		source: nativeMcpSource(scope, getMCPConfigPath(scope, runtime.cwd)),
+	});
 }
 
 async function collectConnectedMcpLines(
@@ -218,9 +222,9 @@ async function collectConnectedMcpLines(
 	if (servers.length === 0) return undefined;
 
 	const lines: string[] = [];
-	for (const { name, config } of servers) {
+	for (const { name, config, scope } of servers) {
 		try {
-			const collected = await withPreparedMcpConnection(runtime, name, config, connection =>
+			const collected = await withPreparedMcpConnection(runtime, name, config, scope, connection =>
 				collect(name, connection),
 			);
 			lines.push(...collected);
@@ -265,7 +269,7 @@ async function handleTestCommand(rest: string, runtime: SlashCommandRuntime): Pr
 	if (!server) return usage(`Server "${name}" not found. Run /mcp list to see configured servers.`, runtime);
 
 	try {
-		return await withPreparedMcpConnection(runtime, name, server.config, async connection => {
+		return await withPreparedMcpConnection(runtime, name, server.config, server.scope, async connection => {
 			const tools = await listTools(connection);
 			const lines = [`Server "${name}" connected (${tools.length} tools).`];
 			for (const tool of tools) lines.push(`  - ${tool.name}`);

package/src/slash-commands/helpers/progress-report.ts

@@ -0,0 +1,23 @@
+import { replaceTabs, truncateToWidth } from "@gajae-code/tui";
+import { sanitizeDisplayLine } from "@gajae-code/utils";
+import { toProjectProgressSnapshot } from "../../progress/progress-snapshot";
+import type { ProjectProgressReport } from "../../progress/project-progress";
+import { type ProgressRenderStyle, renderProgressSnapshot } from "../../progress/render-progress";
+
+/** Bound untrusted durable text (objectives, titles, HUD values) to one sanitized display line of `max` columns. */
+export function clipProgressText(text: string, max: number): string {
+	return truncateToWidth(sanitizeDisplayLine(replaceTabs(text)).trim(), max);
+}
+
+/** TUI view: the `session.progress` snapshot rendered with column-aware clipping and theme colours. */
+export function renderProgressReportLines(report: ProjectProgressReport, style?: ProgressRenderStyle): string[] {
+	return renderProgressSnapshot(toProjectProgressSnapshot(report), {
+		clip: clipProgressText,
+		...(style ? { style } : {}),
+	});
+}
+
+/** Plain text view: identical to what production ACP renders from the `session.progress` query. */
+export function renderProgressReportText(report: ProjectProgressReport): string {
+	return renderProgressSnapshot(toProjectProgressSnapshot(report)).join("\n");
+}

package/src/stt/setup.ts

@@ -1,3 +1,4 @@
+import { macosOptionForwardingInstruction } from "../modes/utils/macos-option-forwarding";
 import { detectRecordingTools } from "./recorder";
 import { resolvePython } from "./transcriber";
 
@@ -20,11 +21,8 @@ export function formatSTTUsage(
 	];
 	if (platform === "darwin") {
 		lines.push("On macOS, Alt+H is Option+H. Your terminal must forward Option as Meta/Esc.");
-		if (terminalProgram?.toLowerCase().includes("ghostty")) {
-			lines.push(
-				"Ghostty: set macos-option-as-alt = true in its config, then reload the config or restart Ghostty.",
-			);
-		}
+		const instruction = macosOptionForwardingInstruction(terminalProgram);
+		if (instruction) lines.push(instruction);
 	}
 	lines.push("Run /hotkeys inside GJC to confirm the active shortcut.");
 	return lines.join("\n");

package/src/task/commands.ts

@@ -120,7 +120,9 @@ export function getCommand(commands: WorkflowCommand[], name: string): WorkflowC
  * Replaces $@ with the provided input.
  */
 export function expandCommand(command: WorkflowCommand, input: string): string {
-	return command.instructions.replace(/\$@/g, input);
+	// Function replacer: `input` is user text and must be inserted verbatim, not
+	// parsed for `$&`, `$$`, `` $` `` or `$'` replacement patterns.
+	return command.instructions.replace(/\$@/g, () => input);
 }
 
 /**

package/src/task/executor.ts

@@ -33,6 +33,7 @@ import * as canonicalSdk from "@gajae-code/coding-agent/sdk";
 import { logger, prompt, untilAborted } from "@gajae-code/utils";
 import { AsyncJobManager } from "../async";
 import { AUTOROUTING_SELECTOR_MAX_LENGTH, type AutoroutingReasonCode } from "../config/autorouting-contract";
+import type { ModelProfileOwnershipMarker } from "../config/model-profile-ownership";
 import { ModelRegistry } from "../config/model-registry";
 import {
 	formatModelString,
@@ -262,6 +263,8 @@ export interface ExecutorOptions {
 	 * Manual/direct parents (no active profile) keep exact resolution.
 	 */
 	parentActiveModelProfile?: string;
+	/** Parent session's model profile ownership marker for propagating to subagent sessions. */
+	parentModelProfileOwnershipMarker?: ModelProfileOwnershipMarker;
 	parentSessionId?: string;
 	parentCredentialSessionId?: string;
 	thinkingLevel?: ThinkingLevel;
@@ -2026,6 +2029,7 @@ export async function runSubprocessOnce(options: ExecutorOptions): Promise<Singl
 					model,
 					thinkingLevel: effectiveThinkingLevel,
 					activeModelProfile: options.parentActiveModelProfile,
+					modelProfileOwnershipMarker: options.parentModelProfileOwnershipMarker,
 					credentialSessionId: options.parentCredentialSessionId ?? options.parentSessionId,
 					modelSubstitution:
 						modelSubstitutionWarning?.reason === "auth_unavailable" && requestedModel

package/src/task/index.ts

@@ -1738,6 +1738,10 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 		const parentActiveModelProfile = (
 			this.session as { getActiveModelProfile?: () => string | undefined }
 		).getActiveModelProfile?.();
+		// Propagate the parent session's ownership marker when a session-local profile is active.
+		const parentModelProfileOwnershipMarker = (
+			this.session as { sessionManager?: { getModelProfileOwnershipMarker?: () => unknown } }
+		).sessionManager?.getModelProfileOwnershipMarker?.();
 		const parentProfileDefinition = parentActiveModelProfile
 			? this.session.modelRegistry?.getModelProfile?.(parentActiveModelProfile)
 			: undefined;
@@ -2273,6 +2277,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 						modelOverride: effectivePatterns(index),
 						parentActiveModelPattern,
 						parentActiveModelProfile: parentOwnedModelProfile,
+						parentModelProfileOwnershipMarker: parentModelProfileOwnershipMarker as any,
 						parentSessionId: this.session.getSessionId?.() ?? undefined,
 						parentCredentialSessionId:
 							this.session.getCredentialSessionId?.() ?? this.session.getSessionId?.() ?? undefined,
@@ -2360,6 +2365,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 						modelOverride: effectivePatterns(index),
 						parentActiveModelPattern,
 						parentActiveModelProfile: parentOwnedModelProfile,
+						parentModelProfileOwnershipMarker: parentModelProfileOwnershipMarker as any,
 						parentSessionId: this.session.getSessionId?.() ?? undefined,
 						parentCredentialSessionId:
 							this.session.getCredentialSessionId?.() ?? this.session.getSessionId?.() ?? undefined,