@gajae-code/coding-agent 0.5.0 → 0.5.2

package/src/tools/subagent-render.ts

@@ -12,7 +12,7 @@ import { Text } from "@gajae-code/tui";
 import type { RenderResultOptions } from "../extensibility/custom-tools/types";
 import type { Theme } from "../modes/theme/theme";
 import { renderSubagentLiveProgress } from "../task/render";
-import { Ellipsis, Hasher, type RenderCache, renderStatusLine } from "../tui";
+import { Ellipsis, Hasher, renderStatusLine } from "../tui";
 import {
 	formatDuration,
 	formatStatusIcon,
@@ -21,12 +21,87 @@ import {
 	type ToolUIStatus,
 	truncateToWidth,
 } from "./render-utils";
-import type { SubagentSnapshot, SubagentToolDetails } from "./subagent";
+import { type SubagentSnapshot, type SubagentToolDetails, subagentAwaitRenderedStateSignature } from "./subagent";
 
 const PREVIEW_LINES_COLLAPSED = 1;
 const PREVIEW_LINES_EXPANDED = 4;
 const PREVIEW_LINE_WIDTH = 80;
 
+/**
+ * Bounded, content-addressed cache for each subagent's heavy body lines (the
+ * indented receipt fields + `renderSubagentLiveProgress` -> `renderAgentProgress`
+ * output). It is module-level so it survives the built-in renderer recreating the
+ * result component on every partial update (`tool-execution.ts` clears the content
+ * box and re-invokes `renderResult`), which a per-component `let cached` cannot.
+ *
+ * The cached body is a PURE function of its key: the per-subagent rendered-state
+ * signature (reused from the producer; excludes time-derived churn), expanded
+ * state, width, and the actual Theme instance identity. `spinnerFrame` and all
+ * wall-clock displays are deliberately kept OUT of the cached body — the animated
+ * spinner and the fresh duration live in the cheap per-subagent status line, and
+ * `renderSubagentLiveProgress` is invoked with `staticTime` so current-tool elapsed
+ * and retry countdowns are never baked into cached lines.
+ */
+const SUBAGENT_BODY_CACHE_MAX = 128;
+const subagentBodyCache = new Map<bigint, string[]>();
+let subagentBodyRenderCount = 0;
+
+// Stable identity per Theme instance so a theme change (preview, symbol preset,
+// color-blind reload, custom-theme reload, or in-memory swap) never reuses stale
+// ANSI/glyph strings — distinct Theme objects get distinct ids even when the theme
+// name is unchanged (e.g. the "<in-memory>" name).
+const themeIdentity = new WeakMap<Theme, number>();
+let nextThemeId = 1;
+function themeIdentityId(theme: Theme): number {
+	let id = themeIdentity.get(theme);
+	if (id === undefined) {
+		id = nextThemeId++;
+		themeIdentity.set(theme, id);
+	}
+	return id;
+}
+
+/** Test-only seam (PR3 deterministic cache-hit assertions). */
+export const subagentBodyCacheTestHooks = {
+	get bodyRenders(): number {
+		return subagentBodyRenderCount;
+	},
+	get size(): number {
+		return subagentBodyCache.size;
+	},
+	reset(): void {
+		subagentBodyRenderCount = 0;
+		subagentBodyCache.clear();
+	},
+};
+
+function renderCachedSubagentBody(
+	snapshot: SubagentSnapshot,
+	signature: string,
+	expanded: boolean,
+	width: number,
+	theme: Theme,
+): string[] {
+	const key = new Hasher().str(signature).bool(expanded).u32(width).u32(themeIdentityId(theme)).digest();
+	const hit = subagentBodyCache.get(key);
+	if (hit) {
+		// Refresh LRU recency.
+		subagentBodyCache.delete(key);
+		subagentBodyCache.set(key, hit);
+		return hit;
+	}
+	const lines = renderSubagentSnapshotBody(snapshot, expanded, theme).map(line =>
+		line.length > 0 ? truncateToWidth(line, width, Ellipsis.Omit) : "",
+	);
+	subagentBodyRenderCount += 1;
+	subagentBodyCache.set(key, lines);
+	if (subagentBodyCache.size > SUBAGENT_BODY_CACHE_MAX) {
+		const oldest = subagentBodyCache.keys().next().value;
+		if (oldest !== undefined) subagentBodyCache.delete(oldest);
+	}
+	return lines;
+}
+
 function statusIconKind(status: SubagentSnapshot["status"]): ToolUIStatus {
 	switch (status) {
 		case "completed":
@@ -44,13 +119,10 @@ function statusIconKind(status: SubagentSnapshot["status"]): ToolUIStatus {
 	}
 }
 
-function renderSubagentSnapshot(
-	snapshot: SubagentSnapshot,
-	expanded: boolean,
-	theme: Theme,
-	spinnerFrame: number | undefined,
-): string[] {
-	const lines: string[] = [];
+// Cheap, dynamic per-subagent status line: the spinner may animate and the duration
+// is the snapshot's own (fresh) value, so this line is rebuilt every frame and is
+// NOT part of the cached body.
+function renderSubagentStatusLine(snapshot: SubagentSnapshot, theme: Theme, spinnerFrame: number | undefined): string {
 	const icon = formatStatusIcon(
 		statusIconKind(snapshot.status),
 		theme,
@@ -59,13 +131,29 @@ function renderSubagentSnapshot(
 	const id = theme.fg("muted", snapshot.id);
 	const status = theme.fg("dim", snapshot.status);
 	const duration = theme.fg("dim", formatDuration(snapshot.durationMs));
-	lines.push(`${icon} ${id} ${status} ${duration}`);
+	return `${icon} ${id} ${status} ${duration}`;
+}
+
+// Heavy, cacheable per-subagent body: a pure function of (snapshot content, expanded,
+// theme). No spinner frame and no wall-clock displays leak in (live progress uses
+// `staticTime`), so the module body cache can never serve stale or frozen-ticking lines.
+function renderSubagentSnapshotBody(snapshot: SubagentSnapshot, expanded: boolean, theme: Theme): string[] {
+	const lines: string[] = [];
 
 	// Static receipt fields (parity with the markdown content for non-await actions).
 	if (snapshot.jobId !== snapshot.id) lines.push(`  ${theme.fg("dim", `Job: ${snapshot.jobId}`)}`);
 	if (snapshot.agent && snapshot.agent !== "unknown") {
 		lines.push(`  ${theme.fg("dim", `Agent: ${snapshot.agent} (${snapshot.agentSource})`)}`);
 	}
+	if (snapshot.effectiveModel) {
+		if (snapshot.modelFellBack && snapshot.requestedModel) {
+			lines.push(
+				`  ${theme.fg("warning", `Model: ${snapshot.effectiveModel} (requested ${snapshot.requestedModel}, fell back — no credentials)`)}`,
+			);
+		} else {
+			lines.push(`  ${theme.fg("dim", `Model: ${snapshot.effectiveModel}`)}`);
+		}
+	}
 	if (snapshot.description) lines.push(`  ${theme.fg("dim", `Description: ${snapshot.description}`)}`);
 	if (snapshot.outputRef) lines.push(`  ${theme.fg("dim", `Output: ${snapshot.outputRef}`)}`);
 	if (snapshot.assignment) {
@@ -73,13 +161,13 @@ function renderSubagentSnapshot(
 		for (const al of snapshot.assignment.split("\n")) lines.push(`    ${theme.fg("toolOutput", replaceTabs(al))}`);
 	}
 
-	// Defense in depth: the producer only attaches `progress` when a live
-	// producer exists (subagent.ts #liveProgressFields), but the renderer
-	// also honors an explicit `liveProgressAvailable: false` so stale retained
-	// progress can never resurrect a live panel (AC5).
+	// Defense in depth: the producer only attaches `progress` when a live producer
+	// exists (subagent.ts #liveProgressFields), but the renderer also honors an
+	// explicit `liveProgressAvailable: false` so stale retained progress can never
+	// resurrect a live panel (AC5). `staticTime` keeps wall-clock displays out of
+	// these cached lines.
 	if (snapshot.progress && snapshot.liveProgressAvailable !== false) {
-		// Live streaming panel (full task-panel parity), indented under the header.
-		for (const pl of renderSubagentLiveProgress(snapshot.progress, expanded, theme, spinnerFrame)) {
+		for (const pl of renderSubagentLiveProgress(snapshot.progress, expanded, theme, undefined, true)) {
 			lines.push(`  ${pl}`);
 		}
 	} else if (snapshot.liveProgressAvailable && (snapshot.status === "running" || snapshot.status === "queued")) {
@@ -124,14 +212,17 @@ export const subagentToolRenderer = {
 
 		const runningCount = subagents.filter(s => s.status === "running").length;
 
-		let cached: RenderCache | undefined;
+		// Each snapshot's rendered-state signature is constant for this component
+		// instance, so compute them at most once; the heavy per-subagent bodies are
+		// cached module-side and keyed by that signature.
+		let snapshotSignatures: string[] | undefined;
 		return {
 			render(width: number): string[] {
 				const expanded = options.expanded;
-				const spinnerFrame = options.spinnerFrame ?? 0;
-				const key = new Hasher().bool(expanded).u32(width).u32(spinnerFrame).digest();
-				if (cached?.key === key) return cached.lines;
 
+				// Cheap dynamic header: may animate with `spinnerFrame` and is rebuilt
+				// every frame, but it is a single status line plus an optional hint, so
+				// it is never gated by the heavy body cache.
 				const header = renderStatusLine(
 					{
 						icon: runningCount > 0 ? "info" : "success",
@@ -144,23 +235,31 @@ export const subagentToolRenderer = {
 					},
 					theme,
 				);
-
-				const lines: string[] = [header];
+				const out: string[] = [truncateToWidth(header, width, Ellipsis.Omit)];
 				// Discoverability: the inline panel is a bounded preview; the session
 				// observer (ctrl+s) streams the full per-subagent message history.
 				if (runningCount > 0) {
-					lines.push(`  ${theme.fg("dim", "(ctrl+s to observe sessions)")}`);
-				}
-				for (const snapshot of subagents) {
-					lines.push(...renderSubagentSnapshot(snapshot, expanded, theme, options.spinnerFrame));
+					out.push(truncateToWidth(`  ${theme.fg("dim", "(ctrl+s to observe sessions)")}`, width, Ellipsis.Omit));
 				}
 
-				const out = lines.map(l => (l.length > 0 ? truncateToWidth(l, width, Ellipsis.Omit) : ""));
-				cached = { key, lines: out };
+				snapshotSignatures ??= subagents.map(snapshot => subagentAwaitRenderedStateSignature([snapshot]));
+				subagents.forEach((snapshot, index) => {
+					// Fresh per-subagent status line (cheap), then the cached heavy body.
+					out.push(
+						truncateToWidth(
+							renderSubagentStatusLine(snapshot, theme, options.spinnerFrame),
+							width,
+							Ellipsis.Omit,
+						),
+					);
+					out.push(...renderCachedSubagentBody(snapshot, snapshotSignatures![index]!, expanded, width, theme));
+				});
 				return out;
 			},
 			invalidate() {
-				cached = undefined;
+				// The heavy body cache is content-addressed (keyed by the rendered-state
+				// signature, width, expanded, and theme), so there is no instance-local
+				// state to clear here.
 			},
 		};
 	},

package/src/tools/subagent.ts

@@ -2,9 +2,9 @@ import * as path from "node:path";
 import type { AgentTool, AgentToolContext, AgentToolResult, AgentToolUpdateCallback } from "@gajae-code/agent-core";
 import { prompt } from "@gajae-code/utils";
 import * as z from "zod/v4";
-import { type AsyncJob, AsyncJobManager, type SubagentRecord } from "../async";
+import { type AsyncJob, AsyncJobManager, jobElapsedMs, type SubagentRecord } from "../async";
 import subagentDescription from "../prompts/tools/subagent.md" with { type: "text" };
-import type { AgentProgress, AgentSource } from "../task/types";
+import type { AgentProgress, AgentSource, TaskToolDetails } from "../task/types";
 import { Ellipsis, truncateToWidth } from "../tui";
 import type { ToolSession } from "./index";
 import { replaceTabs } from "./render-utils";
@@ -67,6 +67,12 @@ export interface SubagentSnapshot {
 	progress?: AgentProgress;
 	/** True when a live in-session progress producer exists for this subagent. */
 	liveProgressAvailable?: boolean;
+	/** Model the subagent actually runs on (after any auth fallback). */
+	effectiveModel?: string;
+	/** Model originally requested via role/preset mapping; differs from effective on fallback. */
+	requestedModel?: string;
+	/** True when the requested model lacked credentials and fell back to the parent model. */
+	modelFellBack?: boolean;
 }
 
 export interface SubagentToolDetails {
@@ -324,12 +330,21 @@ export class SubagentTool implements AgentTool<typeof subagentSchema, SubagentTo
 		);
 		const watchedJobIds = runningJobs.map(job => job.id);
 		manager.watchJobs(watchedJobIds);
-		const progressTimer = onUpdate
-			? setInterval(() => {
-					onUpdate(this.#progressResult(manager, records, true));
-				}, 500)
-			: undefined;
-		onUpdate?.(this.#progressResult(manager, records, true));
+		let lastEmittedSignature: string | undefined;
+		const emitIfChanged = (force: boolean): void => {
+			if (!onUpdate) return;
+			const result = this.#progressResult(manager, records, true);
+			const signature = subagentAwaitRenderedStateSignature(result.details?.subagents ?? []);
+			if (!force && signature === lastEmittedSignature) return;
+			lastEmittedSignature = signature;
+			onUpdate(result);
+		};
+		const progressTimer = onUpdate ? setInterval(() => emitIfChanged(false), 500) : undefined;
+		// Initial emission so the panel appears immediately; later idle ticks are
+		// gated on a value-based rendered-state signature so unchanged progress no
+		// longer rebuilds the renderer component or mutates transcript lines above
+		// the viewport (the source of the await-panel repaint storms).
+		emitIfChanged(true);
 
 		let timedOut = false;
 		try {
@@ -508,6 +523,13 @@ export class SubagentTool implements AgentTool<typeof subagentSchema, SubagentTo
 			lines.push(`### ${snapshot.id} — ${snapshot.status}`);
 			if (snapshot.jobId !== snapshot.id) lines.push(`Job: ${snapshot.jobId}`);
 			if (snapshot.agent) lines.push(`Agent: ${snapshot.agent} (${snapshot.agentSource})`);
+			if (snapshot.effectiveModel) {
+				lines.push(
+					snapshot.modelFellBack && snapshot.requestedModel
+						? `Model: ${snapshot.effectiveModel} (requested ${snapshot.requestedModel}, fell back — no credentials)`
+						: `Model: ${snapshot.effectiveModel}`,
+				);
+			}
 			if (snapshot.description) lines.push(`Description: ${snapshot.description}`);
 			if (snapshot.outputRef) lines.push(`Output: ${snapshot.outputRef}`);
 			if (snapshot.assignment) lines.push("Assignment:", "```", snapshot.assignment, "```");
@@ -584,9 +606,19 @@ export class SubagentTool implements AgentTool<typeof subagentSchema, SubagentTo
 			durationMs: 0,
 			...(verifiedOutputIds.has(record.subagentId) ? { outputRef: `agent://${record.subagentId}` } : {}),
 			...liveFields,
+			...this.#modelFields(record),
 		};
 	}
 
+	#modelFields(record?: SubagentRecord): Partial<SubagentSnapshot> {
+		if (!record) return {};
+		const fields: Partial<SubagentSnapshot> = {};
+		if (record.effectiveModel) fields.effectiveModel = record.effectiveModel;
+		if (record.requestedModel) fields.requestedModel = record.requestedModel;
+		if (record.modelFellBack) fields.modelFellBack = true;
+		return fields;
+	}
+
 	#snapshot(
 		job: AsyncJob,
 		timedOut = false,
@@ -608,7 +640,7 @@ export class SubagentTool implements AgentTool<typeof subagentSchema, SubagentTo
 			label: sanitizeText(job.label, RECEIPT_PREVIEW_WIDTH),
 			agent: subagent?.agent ?? "unknown",
 			agentSource: subagent?.agentSource ?? "bundled",
-			durationMs: Math.max(0, Date.now() - job.startTime),
+			durationMs: jobElapsedMs(job),
 			...(subagent?.description ? { description: sanitizeText(subagent.description, RECEIPT_PREVIEW_WIDTH) } : {}),
 			...(verbosity === "full" && subagent?.assignment
 				? { assignment: sanitizeText(subagent.assignment, FULL_PREVIEW_WIDTH) }
@@ -622,6 +654,7 @@ export class SubagentTool implements AgentTool<typeof subagentSchema, SubagentTo
 				: {}),
 			...(outputRef ? { outputRef } : {}),
 			...(runningTimeoutGuidance ? { guidance: runningTimeoutGuidance } : {}),
+			...this.#modelFields(record),
 		};
 	}
 
@@ -696,3 +729,134 @@ function previewJobOutput(
 	const preview = truncateToWidth(normalized, width, Ellipsis.Unicode);
 	return { type: source.type, preview, truncated: preview !== normalized };
 }
+
+/**
+ * Canonical, value-based rendered-state signature for the `subagent` await panel.
+ *
+ * Producer-side await gating compares this signature against the last emitted one
+ * and only fires `onUpdate` when the *rendered* state actually changed. Unchanged
+ * idle ticks therefore stop rebuilding the renderer component and stop mutating
+ * transcript lines above the viewport, which is what triggers TUI full-redraw
+ * storms (`tui.ts` `firstChanged < viewportTop`).
+ *
+ * It is deliberately value-based, never object identity: `AsyncJobManager.record-
+ * SubagentProgress` stores a `structuredClone` but `getSubagentProgress` returns
+ * the retained object by reference, so identity comparison would be both noisy and
+ * unsafe.
+ *
+ * Time-derived fields are intentionally excluded so the panel does not churn while
+ * idle: raw durations (`durationMs`), current-tool elapsed (`currentToolStartMs`),
+ * and retry countdowns (`retryState.startedAtMs`) are omitted. Idle duration and
+ * countdown ticking is sacrificed by design; every real transition still changes
+ * the signature.
+ */
+export function subagentAwaitRenderedStateSignature(subagents: readonly SubagentSnapshot[]): string {
+	return JSON.stringify(subagents.map(canonicalizeSnapshotForSignature));
+}
+
+function canonicalizeSnapshotForSignature(snapshot: SubagentSnapshot): unknown {
+	return {
+		id: snapshot.id,
+		jobId: snapshot.jobId,
+		status: snapshot.status,
+		label: snapshot.label,
+		agent: snapshot.agent,
+		agentSource: snapshot.agentSource,
+		description: snapshot.description ?? null,
+		assignment: snapshot.assignment ?? null,
+		resultText: snapshot.resultText ?? null,
+		errorText: snapshot.errorText ?? null,
+		resultPreview: snapshot.resultPreview ?? null,
+		outputRef: snapshot.outputRef ?? null,
+		truncated: snapshot.truncated ?? false,
+		guidance: snapshot.guidance ?? null,
+		liveProgressAvailable: snapshot.liveProgressAvailable ?? null,
+		effectiveModel: snapshot.effectiveModel ?? null,
+		requestedModel: snapshot.requestedModel ?? null,
+		modelFellBack: snapshot.modelFellBack ?? false,
+		// durationMs intentionally excluded (time-derived; would defeat idle gating).
+		progress: snapshot.progress ? canonicalizeProgressForSignature(snapshot.progress) : null,
+	};
+}
+
+function canonicalizeProgressForSignature(progress: AgentProgress): unknown {
+	return {
+		id: progress.id,
+		agent: progress.agent,
+		agentSource: progress.agentSource,
+		status: progress.status,
+		task: progress.task,
+		assignment: progress.assignment ?? null,
+		description: progress.description ?? null,
+		lastIntent: progress.lastIntent ?? null,
+		currentTool: progress.currentTool ?? null,
+		currentToolArgs: progress.currentToolArgs ?? null,
+		// currentToolStartMs intentionally excluded (only drives elapsed rendering).
+		recentTools: progress.recentTools.map(tool => ({ tool: tool.tool, args: tool.args })),
+		recentOutput: progress.recentOutput,
+		toolCount: progress.toolCount,
+		tokens: progress.tokens,
+		contextTokens: progress.contextTokens ?? null,
+		contextWindow: progress.contextWindow ?? null,
+		cost: progress.cost,
+		modelOverride: progress.modelOverride ?? null,
+		modelSubstitutionWarning: progress.modelSubstitutionWarning ?? null,
+		// durationMs intentionally excluded (time-derived).
+		extractedToolData: progress.extractedToolData
+			? canonicalizeExtractedToolDataForSignature(progress.extractedToolData)
+			: null,
+		retryState: progress.retryState
+			? {
+					attempt: progress.retryState.attempt,
+					maxAttempts: progress.retryState.maxAttempts,
+					unbounded: progress.retryState.unbounded ?? false,
+					delayMs: progress.retryState.delayMs,
+					errorMessage: progress.retryState.errorMessage,
+					// startedAtMs intentionally excluded (drives countdown only).
+				}
+			: null,
+		retryFailure: progress.retryFailure ?? null,
+		inflightTaskDetails: progress.inflightTaskDetails
+			? canonicalizeTaskDetailsForSignature(progress.inflightTaskDetails)
+			: null,
+	};
+}
+
+/**
+ * Nested `task` data (`extractedToolData.task` and `inflightTaskDetails`) is the
+ * one place the await signature reaches into a live, ticking structure: nested
+ * `AgentProgress` carries the same time-derived fields excluded above, and
+ * `TaskToolDetails` adds `totalDurationMs` / per-result `durationMs`. Signing it
+ * wholesale would defeat idle gating whenever an awaited subagent is itself inside
+ * a live `task` call, so these helpers canonicalize the rendered, non-time subset
+ * recursively (mutually recursive with `canonicalizeProgressForSignature`).
+ */
+function canonicalizeExtractedToolDataForSignature(data: Record<string, unknown[]>): Record<string, unknown> {
+	const out: Record<string, unknown> = {};
+	for (const key of Object.keys(data)) {
+		// Only the `task` key holds time-ticking `TaskToolDetails`; other handler
+		// data (yield/report_finding/generic) is stable and passes through as-is.
+		out[key] = key === "task" ? (data[key] as TaskToolDetails[]).map(canonicalizeTaskDetailsForSignature) : data[key];
+	}
+	return out;
+}
+
+function canonicalizeTaskDetailsForSignature(details: TaskToolDetails): unknown {
+	// `extractedToolData` is an untyped boundary (`Record<string, unknown[]>`), so
+	// guard each field instead of trusting the `TaskToolDetails` cast.
+	return {
+		// totalDurationMs intentionally excluded (time-derived).
+		results: Array.isArray(details.results) ? details.results.map(canonicalizeTaskResultForSignature) : null,
+		progress: Array.isArray(details.progress) ? details.progress.map(canonicalizeProgressForSignature) : null,
+		async: details.async
+			? { state: details.async.state, jobId: details.async.jobId, type: details.async.type }
+			: null,
+	};
+}
+
+function canonicalizeTaskResultForSignature(result: TaskToolDetails["results"][number]): unknown {
+	// Completed results do not tick, but drop `durationMs` so the only time-derived
+	// field in the receipt can never reintroduce idle churn.
+	const { durationMs: _durationMs, ...rest } = result;
+	return rest;
+}

package/src/tools/ultragoal-ask-guard.ts

@@ -0,0 +1,39 @@
+import type { AgentTool } from "@gajae-code/agent-core";
+import { isUltragoalAskBlocked, type UltragoalAskBlockDiagnostic } from "../gjc-runtime/ultragoal-guard";
+import { ToolError } from "./tool-errors";
+
+const ULTRAGOAL_ASK_GUARD = Symbol.for("gajae-code.ultragoalAskGuard");
+
+type GuardedTool = AgentTool & { [ULTRAGOAL_ASK_GUARD]?: true };
+
+export function formatUltragoalAskBlockMessage(diagnostic: UltragoalAskBlockDiagnostic): string {
+	return [
+		diagnostic.message,
+		`Ultragoal ask guard blocked ask (source: ${diagnostic.source}; reason: ${diagnostic.reason}).`,
+		"Use `gjc ultragoal record-review-blockers` to record the blocker instead of asking the user.",
+	].join("\n");
+}
+
+export async function assertUltragoalAskAllowed(cwd: string): Promise<void> {
+	const diagnostic = await isUltragoalAskBlocked(cwd);
+	if (!diagnostic.active) return;
+	throw new ToolError(formatUltragoalAskBlockMessage(diagnostic));
+}
+
+export function guardToolForUltragoalAsk<T extends AgentTool>(tool: T, getCwd: () => string): T {
+	if (tool.name !== "ask") return tool;
+	const candidate = tool as GuardedTool;
+	if (candidate[ULTRAGOAL_ASK_GUARD]) return tool;
+	const wrapped = new Proxy(tool, {
+		get(target, prop, receiver) {
+			if (prop === ULTRAGOAL_ASK_GUARD) return true;
+			if (prop !== "execute") return Reflect.get(target, prop, receiver);
+			return async (...args: unknown[]): Promise<unknown> => {
+				await assertUltragoalAskAllowed(getCwd());
+				return Reflect.apply(target.execute, target, args);
+			};
+		},
+	}) as T & GuardedTool;
+	wrapped[ULTRAGOAL_ASK_GUARD] = true;
+	return wrapped as T;
+}

package/src/web/search/index.ts

@@ -8,7 +8,6 @@ import type { AgentTool, AgentToolContext, AgentToolResult, AgentToolUpdateCallb
 import type { AuthStorage } from "@gajae-code/ai";
 import { prompt } from "@gajae-code/utils";
 import * as z from "zod/v4";
-import { parseModelString } from "../../config/model-resolver";
 import type { CustomTool, CustomToolContext, RenderResultOptions } from "../../extensibility/custom-tools/types";
 import type { Theme } from "../../modes/theme/theme";
 import webSearchSystemPrompt from "../../prompts/system/web-search.md" with { type: "text" };
@@ -19,7 +18,7 @@ import { formatAge } from "../../tools/render-utils";
 import { throwIfAborted } from "../../tools/tool-errors";
 import { getSearchProviderLabel, resolveProviderChain, type SearchProvider } from "./provider";
 import { renderSearchCall, renderSearchResult, type SearchRenderDetails } from "./render";
-import type { SearchProviderId, SearchResponse } from "./types";
+import type { ActiveSearchModelContext, SearchProviderId, SearchResponse } from "./types";
 import { SearchProviderError } from "./types";
 
 /** Web search tool parameters schema */
@@ -116,21 +115,11 @@ function formatForLLM(response: SearchResponse): string {
 	return parts.join("\n");
 }
 
-/** Best-effort active model provider: prefer the resolved Model, fall back to parsing the model string. */
-function resolveActiveModelProvider(
-	modelProvider: string | undefined,
-	modelString: string | undefined,
-): string | undefined {
-	if (modelProvider) return modelProvider;
-	if (modelString) return parseModelString(modelString)?.provider;
-	return undefined;
-}
-
 interface ExecuteSearchOptions {
 	authStorage: AuthStorage;
 	sessionId?: string;
 	signal?: AbortSignal;
-	activeModelProvider?: string;
+	activeModelContext?: ActiveSearchModelContext;
 }
 
 /** Execute web search */
@@ -139,11 +128,17 @@ async function executeSearch(
 	params: SearchQueryParams,
 	options: ExecuteSearchOptions,
 ): Promise<{ content: Array<{ type: "text"; text: string }>; details: SearchRenderDetails }> {
-	const { authStorage, sessionId, signal, activeModelProvider } = options;
+	const { authStorage, sessionId, signal, activeModelContext } = options;
 	// Pass `params.provider` straight through: when omitted (the normal model-facing
 	// path) it is `undefined`, so `resolveProviderChain` applies the settings-configured
 	// preferred provider. Coalescing to "auto" here would silently bypass that preference.
-	const providers = await resolveProviderChain(authStorage, params.provider, activeModelProvider);
+	const providers = await resolveProviderChain({
+		authStorage,
+		sessionId,
+		signal,
+		preferredProvider: params.provider,
+		activeModelContext,
+	});
 
 	const failures: Array<{ provider: SearchProvider; error: unknown }> = [];
 	let lastProvider = providers[0];
@@ -161,6 +156,7 @@ async function executeSearch(
 				signal,
 				authStorage,
 				sessionId,
+				activeModelContext,
 			});
 
 			const text = formatForLLM(response);
@@ -210,14 +206,19 @@ async function executeSearch(
  */
 export async function runSearchQuery(
 	params: SearchQueryParams,
-	options: { authStorage?: AuthStorage; sessionId?: string; signal?: AbortSignal; activeModelProvider?: string } = {},
+	options: {
+		authStorage?: AuthStorage;
+		sessionId?: string;
+		signal?: AbortSignal;
+		activeModelContext?: ActiveSearchModelContext;
+	} = {},
 ): Promise<{ content: Array<{ type: "text"; text: string }>; details: SearchRenderDetails }> {
 	const authStorage = options.authStorage ?? (await discoverAuthStorage());
 	return executeSearch("cli-web-search", params, {
 		authStorage,
 		sessionId: options.sessionId,
 		signal: options.signal,
-		activeModelProvider: options.activeModelProvider,
+		activeModelContext: options.activeModelContext,
 	});
 }
 
@@ -251,11 +252,10 @@ export class WebSearchTool implements AgentTool<typeof webSearchSchema, SearchRe
 	): Promise<AgentToolResult<SearchRenderDetails>> {
 		const authStorage = this.#session.authStorage ?? (await discoverAuthStorage());
 		const sessionId = this.#session.getSessionId?.() ?? undefined;
-		const activeModelProvider = resolveActiveModelProvider(
-			this.#session.model?.provider,
-			this.#session.getActiveModelString?.(),
-		);
-		return executeSearch(_toolCallId, params, { authStorage, sessionId, signal, activeModelProvider });
+		const activeModelContext = this.#session.model
+			? this.#session.modelRegistry?.getActiveSearchModelContext(this.#session.model)
+			: undefined;
+		return executeSearch(_toolCallId, params, { authStorage, sessionId, signal, activeModelContext });
 	}
 }
 
@@ -279,7 +279,7 @@ export const webSearchCustomTool: CustomTool<typeof webSearchSchema, SearchRende
 			authStorage,
 			sessionId,
 			signal,
-			activeModelProvider: ctx.model?.provider,
+			activeModelContext: ctx.model ? ctx.modelRegistry?.getActiveSearchModelContext(ctx.model) : undefined,
 		});
 	},
 
@@ -296,6 +296,6 @@ export function getSearchTools(): CustomTool<any, any>[] {
 	return [webSearchCustomTool];
 }
 
-export { getSearchProvider, setPreferredSearchProvider } from "./provider";
+export { getSearchProvider, setPreferredSearchProvider, setSearchFallbackProviders } from "./provider";
 export type { SearchProviderId as SearchProvider, SearchResponse } from "./types";
-export { isSearchProviderPreference } from "./types";
+export { isConfigurableSearchProviderId, isSearchProviderPreference } from "./types";