@gajae-code/coding-agent 0.5.1 → 0.5.2

package/src/lsp/defaults.json

@@ -4,6 +4,7 @@
 		"args": [],
 		"fileTypes": [".rs"],
 		"rootMarkers": ["Cargo.toml", "rust-analyzer.toml"],
+		"warmupTimeoutMs": 30000,
 		"initOptions": {},
 		"settings": {
 			"rust-analyzer": {

package/src/main.ts

@@ -977,10 +977,20 @@ export async function runRootCommand(
 		}
 
 		if (mode === "rpc" || mode === "rpc-ui") {
-			const { runRpcMode } = await import("./modes/rpc/rpc-mode");
-			await runRpcMode(session, mode === "rpc-ui" ? setToolUIContext : undefined, {
-				listen: parsedArgs.rpcListen,
-			});
+			const { RpcListenRefusedError, runRpcMode } = await import("./modes/rpc/rpc-mode");
+			try {
+				await runRpcMode(session, mode === "rpc-ui" ? setToolUIContext : undefined, {
+					listen: parsedArgs.rpcListen,
+				});
+			} catch (error) {
+				if (!(error instanceof RpcListenRefusedError)) throw error;
+				logger.setTransports({ console: true, file: true });
+				logger.error(error.message);
+				await session.dispose();
+				stopThemeWatcher();
+				await postmortem.quit(1);
+				process.exit(1);
+			}
 		} else if (mode === "bridge") {
 			const { runBridgeMode } = await import("./modes/bridge/bridge-mode");
 			await runBridgeMode(session, setToolUIContext);

package/src/modes/acp/acp-agent.ts

@@ -43,7 +43,8 @@ import {
 	type Usage,
 } from "@agentclientprotocol/sdk";
 import type { AssistantMessage, Model } from "@gajae-code/ai";
-import { logger, VERSION } from "@gajae-code/utils";
+import { logger } from "@gajae-code/utils";
+import packageJson from "../../../package.json" with { type: "json" };
 import { disableProvider, enableProvider, reset as resetCapabilities } from "../../capability";
 import { Settings } from "../../config/settings";
 import { clearPluginRootsAndCaches, resolveActiveProjectRegistryPath } from "../../discovery/helpers";
@@ -98,6 +99,7 @@ const SESSION_PAGE_SIZE = 50;
  * wait past this guard without hard-coding the literal.
  */
 export const ACP_BOOTSTRAP_RACE_GUARD_MS = 50;
+const CODING_AGENT_VERSION: string = packageJson.version;
 const ACP_CANCEL_CLEANUP_TIMEOUT_MS = 5_000;
 const ACP_ASYNC_DELIVERY_DRAIN_TIMEOUT_MS = 250;
 const ACP_ASYNC_DELIVERY_DRAIN_MAX_PASSES = 3;
@@ -414,7 +416,7 @@ export class AcpAgent implements Agent {
 			agentInfo: {
 				name: "gajae-code",
 				title: "Gajae Code",
-				version: VERSION,
+				version: CODING_AGENT_VERSION,
 			},
 			authMethods,
 			agentCapabilities: {

package/src/modes/bridge/bridge-mode.ts

@@ -29,7 +29,7 @@ import {
 import { UiRequestBroker } from "../shared/agent-wire/ui-request-broker";
 import type { BridgeUiResult } from "../shared/agent-wire/ui-result";
 import { defaultAuditPath, UnattendedAuditLog } from "../shared/agent-wire/unattended-audit";
-import { UnattendedSessionControlPlane } from "../shared/agent-wire/unattended-session";
+import { modelSupportsTokenCostMetrics, UnattendedSessionControlPlane } from "../shared/agent-wire/unattended-session";
 import { FileGateStore } from "../shared/agent-wire/workflow-gate-broker";
 import { assertSafeBridgeBind, isBridgeTokenAuthorized } from "./auth";
 import { type BridgePermissionRequestPayload, createBridgeClientBridge } from "./bridge-client-bridge";
@@ -599,6 +599,7 @@ export async function runBridgeMode(
 		emitFrame: gate => eventStream.publish(toBridgeWorkflowGateFrame(gate, sequencer)),
 		store: gateStore,
 		audit: recordAudit,
+		providerSupportsTokenCostMetrics: modelSupportsTokenCostMetrics(session.model),
 		getUsageSnapshot: () => {
 			const stats = session.getSessionStats();
 			return { tokens: stats.tokens.total, costUsd: stats.cost };

package/src/modes/components/history-search.ts

@@ -10,6 +10,7 @@ import {
 	truncateToWidth,
 	visibleWidth,
 } from "@gajae-code/tui";
+import { getProjectDir } from "@gajae-code/utils";
 import { theme } from "../../modes/theme/theme";
 import { matchesAppInterrupt } from "../../modes/utils/keybinding-matchers";
 import type { HistoryEntry, HistoryStorage } from "../../session/history-storage";
@@ -72,6 +73,7 @@ class HistoryResultsList implements Component {
 
 export class HistorySearchComponent extends Container {
 	#historyStorage: HistoryStorage;
+	#cwd: string;
 	#searchInput: Input;
 	#results: HistoryEntry[] = [];
 	#selectedIndex = 0;
@@ -83,6 +85,7 @@ export class HistorySearchComponent extends Container {
 	constructor(historyStorage: HistoryStorage, onSelect: (prompt: string) => void, onCancel: () => void) {
 		super();
 		this.#historyStorage = historyStorage;
+		this.#cwd = getProjectDir();
 		this.#onSelect = onSelect;
 		this.#onCancel = onCancel;
 
@@ -150,8 +153,8 @@ export class HistorySearchComponent extends Container {
 	#updateResults(): void {
 		const query = this.#searchInput.getValue().trim();
 		this.#results = query
-			? this.#historyStorage.search(query, this.#resultLimit)
-			: this.#historyStorage.getRecent(this.#resultLimit);
+			? this.#historyStorage.search(query, this.#resultLimit, this.#cwd)
+			: this.#historyStorage.getRecent(this.#resultLimit, this.#cwd);
 		this.#selectedIndex = 0;
 		this.#resultsList.setResults(this.#results, this.#selectedIndex);
 	}

package/src/modes/components/model-selector.ts

@@ -154,6 +154,20 @@ interface PresetBrowseRow {
 
 type PresetLandingRow = PresetGroupRow | PresetProfileRow | PresetBrowseRow;
 
+// Stable logical identity for a preset landing row, independent of its current
+// list position. Used to relocate the cursor after the expanded group changes so
+// navigation does not silently overshoot the destination group header/profiles.
+function presetRowIdentity(row: PresetLandingRow): string {
+	switch (row.kind) {
+		case "group":
+			return `group:${row.groupId}`;
+		case "profile":
+			return `profile:${row.groupId}:${row.profile.name}`;
+		case "browse":
+			return "browse";
+	}
+}
+
 const PROFILE_ROLE_PREVIEW_ORDER: GjcModelAssignmentTargetId[] = [
 	"default",
 	"executor",
@@ -739,6 +753,18 @@ export class ModelSelectorComponent extends Container {
 		if (selected?.kind === "group") this.#expandedPresetProviderId = selected.groupId;
 		if (selected?.kind === "profile") this.#expandedPresetProviderId = selected.groupId;
 		const rows = this.#getPresetRows();
+		// Expanding/collapsing a group shifts row positions. Relocate the cursor by
+		// the selected row's logical identity so crossing a provider group boundary
+		// keeps it on the same logical row instead of overshooting into the
+		// destination group's profiles (or off the end of the list).
+		if (selected) {
+			const targetIdentity = presetRowIdentity(selected);
+			const relocated = rows.findIndex(row => presetRowIdentity(row) === targetIdentity);
+			if (relocated >= 0) {
+				this.#presetCursor = relocated;
+				return;
+			}
+		}
 		this.#presetCursor = Math.min(this.#presetCursor, Math.max(0, rows.length - 1));
 	}
 

package/src/modes/components/provider-onboarding-selector.ts

@@ -4,7 +4,7 @@ import { matchesSelectCancel } from "../../modes/utils/keybinding-matchers";
 import { formatModelOnboardingGuidance } from "../../setup/model-onboarding-guidance";
 import { DynamicBorder } from "./dynamic-border";
 
-export type ProviderOnboardingAction = "custom-provider-wizard" | "oauth-login" | "api-guide";
+export type ProviderOnboardingAction = "custom-provider-wizard" | "oauth-login" | "import-credentials" | "api-guide";
 
 interface ProviderOnboardingOption {
 	label: string;
@@ -28,6 +28,11 @@ const PROVIDER_ONBOARDING_OPTIONS: ProviderOnboardingOption[] = [
 		description: "Show the /provider add and gjc setup provider commands.",
 		action: "api-guide",
 	},
+	{
+		label: "Import existing credentials",
+		description: "Detect and import Claude Code / Codex CLI logins already on this machine.",
+		action: "import-credentials",
+	},
 ];
 
 export class ProviderOnboardingSelectorComponent extends Container {

package/src/modes/controllers/selector-controller.ts

@@ -32,13 +32,20 @@ import {
 import type { InteractiveModeContext } from "../../modes/types";
 import { type SessionInfo, SessionManager } from "../../session/session-manager";
 import { FileSessionStorage } from "../../session/session-storage";
+import { discoverExternalCredentials, formatDiscoverySummary, importCredentials } from "../../setup/credential-import";
 import {
 	MODEL_ONBOARDING_API_PROVIDER_COMMAND,
 	MODEL_ONBOARDING_PROVIDER_PRESET_COMMAND,
 	MODEL_ONBOARDING_SETUP_COMMAND,
 } from "../../setup/model-onboarding-guidance";
 import { addApiCompatibleProvider, formatProviderSetupResult } from "../../setup/provider-onboarding";
-import { isSearchProviderPreference, setPreferredImageProvider, setPreferredSearchProvider } from "../../tools";
+import {
+	isConfigurableSearchProviderId,
+	isSearchProviderPreference,
+	setPreferredImageProvider,
+	setPreferredSearchProvider,
+	setSearchFallbackProviders,
+} from "../../tools";
 import { setSessionTerminalTitle } from "../../utils/title-generator";
 import { AgentDashboard } from "../components/agent-dashboard";
 import { AssistantMessageComponent } from "../components/assistant-message";
@@ -128,6 +135,8 @@ export class SelectorController {
 						this.showCustomProviderWizard();
 					} else if (action === "oauth-login") {
 						void this.showOAuthSelector("login");
+					} else if (action === "import-credentials") {
+						void this.#handleCredentialImport();
 					} else {
 						this.ctx.showStatus(formatProviderOnboardingCommandGuide());
 					}
@@ -141,6 +150,69 @@ export class SelectorController {
 		});
 	}
 
+	async #handleCredentialImport(): Promise<void> {
+		this.ctx.showStatus("Scanning for existing Claude Code / Codex CLI credentials…");
+		const result = await discoverExternalCredentials();
+		const summaryLines = formatDiscoverySummary(result);
+
+		if (result.importable.length === 0) {
+			this.ctx.chatContainer.addChild(new Spacer(1));
+			for (const line of summaryLines) {
+				this.ctx.chatContainer.addChild(new Text(theme.fg("dim", line), 1, 0));
+			}
+			this.ctx.chatContainer.addChild(
+				new Text(
+					theme.fg(
+						"warning",
+						"No importable Claude/Codex credentials found. Use /login or add a custom provider.",
+					),
+					1,
+					0,
+				),
+			);
+			this.ctx.ui.requestRender();
+			return;
+		}
+
+		const confirmed = await this.ctx.showHookConfirm(
+			`Import ${result.importable.length} credential(s)?`,
+			summaryLines.join("\n"),
+		);
+		if (!confirmed) {
+			this.ctx.showStatus("Credential import cancelled.");
+			return;
+		}
+
+		const summary = await importCredentials(result.importable, (provider, credential) =>
+			this.ctx.session.modelRegistry.authStorage.upsertCredential(provider, credential),
+		);
+		await this.ctx.session.modelRegistry.refresh();
+
+		this.ctx.chatContainer.addChild(new Spacer(1));
+		for (const credential of summary.imported) {
+			this.ctx.chatContainer.addChild(
+				new Text(
+					theme.fg("success", `${theme.status.success} Imported ${credential.provider} (${credential.source})`),
+					1,
+					0,
+				),
+			);
+		}
+		for (const failure of summary.failed) {
+			this.ctx.chatContainer.addChild(
+				new Text(
+					theme.fg("error", `${theme.status.error} Failed ${failure.credential.provider}: ${failure.error}`),
+					1,
+					0,
+				),
+			);
+		}
+		if (summary.imported.length > 0) {
+			this.ctx.chatContainer.addChild(new Text(theme.fg("dim", `Credentials saved to ${getAgentDbPath()}`), 1, 0));
+		}
+		this.ctx.ui.requestRender();
+	}
+
 	showCustomProviderWizard(): void {
 		this.showSelector(done => {
 			let wizard: CustomProviderWizardComponent;
@@ -507,6 +579,13 @@ export class SelectorController {
 					setPreferredSearchProvider(value);
 				}
 				break;
+			case "web_search.fallback":
+				if (Array.isArray(value)) {
+					setSearchFallbackProviders(
+						value.filter(item => typeof item === "string" && isConfigurableSearchProviderId(item)),
+					);
+				}
+				break;
 			case "providers.image":
 				if (
 					value === "auto" ||

package/src/modes/interactive-mode.ts

@@ -283,7 +283,7 @@ export class InteractiveMode implements InteractiveModeContext {
 	}
 	autoCompactionEscapeHandler?: () => void;
 	retryEscapeHandler?: () => void;
-	retryCountdownTimer?: ReturnType<typeof setInterval>;
+	retryCountdownTimer?: NodeJS.Timeout;
 	unsubscribe?: () => void;
 	onInputCallback?: (input: SubmittedUserInput) => void;
 	optimisticUserMessageSignature: string | undefined = undefined;
@@ -709,6 +709,16 @@ export class InteractiveMode implements InteractiveModeContext {
 			if (this.#pendingSubmittedInput) return;
 			if (this.editor.getText().trim().length > 0) return;
 			if ((this.pendingImages?.length ?? 0) > 0) return;
+			// Never fire an autonomous continuation prompt() while the session is
+			// busy. A wedged/orphaned subagent turn can leave isStreaming stuck true;
+			// firing prompt() here throws AgentBusyError, which submitInteractiveInput
+			// surfaces as a red "Error: Agent is already processing…" and then loops
+			// back to getUserInput(), re-arming this timer — an infinite error spam.
+			// Re-arm and only fire once the session returns to idle.
+			if (this.session.isStreaming || this.session.isCompacting) {
+				this.#scheduleGoalContinuation();
+				return;
+			}
 			const latestState = this.session.getGoalModeState();
 			if (!latestState?.enabled || latestState.goal.status !== "active") return;
 			this.#goalContinuationTurnInFlight = true;

package/src/modes/rpc/rpc-mode.ts

@@ -13,7 +13,7 @@
 
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { $pickenv, readLines, Snowflake } from "@gajae-code/utils";
+import { $pickenv, logger, readLines, Snowflake } from "@gajae-code/utils";
 import type {
 	ExtensionUIContext,
 	ExtensionUIDialogOptions,
@@ -27,7 +27,7 @@ import { AgentWireFrameSequencer, toAgentWireEventFrame } from "../shared/agent-
 import { rpcError as error } from "../shared/agent-wire/responses";
 import { registerRpcSession, unregisterRpcSession } from "../shared/agent-wire/session-registry";
 import { defaultAuditPath, UnattendedAuditLog } from "../shared/agent-wire/unattended-audit";
-import { UnattendedSessionControlPlane } from "../shared/agent-wire/unattended-session";
+import { modelSupportsTokenCostMetrics, UnattendedSessionControlPlane } from "../shared/agent-wire/unattended-session";
 import { FileGateStore } from "../shared/agent-wire/workflow-gate-broker";
 import { isRpcHostToolResult, isRpcHostToolUpdate, RpcHostToolBridge } from "./host-tools";
 import { isRpcHostUriResult, RpcHostUriBridge } from "./host-uris";
@@ -82,6 +82,82 @@ export function shouldEmitRpcTitlesForTest(): boolean {
 
 const shouldEmitRpcTitles = shouldEmitRpcTitlesForTest;
 
+/**
+ * Cancellation commands bypass the ordered serial chain because they must
+ * interrupt in-flight work — they cannot wait behind the very command they are
+ * meant to abort.
+ */
+export const RPC_CANCELLATION_COMMANDS: ReadonlySet<RpcCommand["type"]> = new Set<RpcCommand["type"]>([
+	"abort",
+	"abort_bash",
+	"abort_retry",
+]);
+
+/**
+ * Safe read-only commands that bypass the ordered serial chain so they never
+ * head-of-line-block behind a long-running ordered command like
+ * `bash`/`compact`/`handoff`/`login` (#606, issue 13 — the partial fix only
+ * fast-laned cancellation).
+ *
+ * Every command listed here has a dispatch handler that is **fully synchronous
+ * and side-effect-free**: on the single-threaded event loop it runs to
+ * completion between the await points of any in-flight ordered command, reading
+ * live state without mutating it. Because such a read performs no causal write,
+ * jumping ahead of an earlier *queued* ordered command is observably harmless —
+ * there is no state change to reorder. Read payloads are additionally
+ * snapshotted inside the handler (e.g. `get_messages` returns a shallow copy of
+ * `session.messages`) so a fast-lane read can never serialize a half-mutated
+ * array that an ordered turn/compaction is rewriting in place.
+ *
+ * Deliberately excluded (kept ordered): every async/long command and every
+ * mutating command. In particular the control-flag setters (`set_thinking_level`,
+ * `cycle_thinking_level`, `set_steering_mode`, `set_follow_up_mode`,
+ * `set_interrupt_mode`, `set_auto_compaction`, `set_auto_retry`) stay ordered.
+ * Their handlers are synchronous, so fast-laning one ahead of an already-queued
+ * `prompt`/`bash` would apply the new mode *before* that earlier command runs —
+ * the earlier command would then observe the later setter's value, a
+ * causal-order (arrival-order) regression. Mutations therefore stay on the
+ * chain, and new command types default to ordered (fail-safe).
+ */
+export const RPC_SAFE_READ_CONTROL_COMMANDS: ReadonlySet<RpcCommand["type"]> = new Set<RpcCommand["type"]>([
+	// Pure synchronous reads — snapshot live state at processing time, never mutate.
+	"get_state",
+	"get_session_stats",
+	"get_available_models",
+	"get_branch_messages",
+	"get_last_assistant_text",
+	"get_messages",
+	"get_login_providers",
+]);
+
+/** True when a command may bypass the ordered serial chain and run immediately. */
+export function isFastLaneRpcCommand(type: RpcCommand["type"]): boolean {
+	return RPC_CANCELLATION_COMMANDS.has(type) || RPC_SAFE_READ_CONTROL_COMMANDS.has(type);
+}
+
+/**
+ * Schedules inbound RPC commands: fast-lane commands run immediately while
+ * everything else runs through a serial chain so causal order is preserved. The
+ * read loop never blocks, which is what lets a fast-lane command reach a
+ * long-running ordered command instead of being head-of-line-blocked behind it.
+ */
+export function createRpcCommandScheduler(
+	run: (command: RpcCommand) => Promise<void>,
+	track: (task: Promise<void>) => void,
+): { dispatch: (command: RpcCommand) => void } {
+	let orderedChain: Promise<void> = Promise.resolve();
+	return {
+		dispatch(command: RpcCommand): void {
+			if (isFastLaneRpcCommand(command.type)) {
+				track(run(command));
+				return;
+			}
+			orderedChain = orderedChain.then(() => run(command));
+			track(orderedChain);
+		},
+	};
+}
+
 function auditOutcomeFor(event: string): "accepted" | "rejected" | "denied" | "exceeded" | "aborted" | "info" {
 	if (event.includes("denied")) return "denied";
 	if (event.includes("exceeded")) return "exceeded";
@@ -91,6 +167,43 @@ function auditOutcomeFor(event: string): "accepted" | "rejected" | "denied" | "e
 	return "info";
 }
 
+export class RpcListenRefusedError extends Error {
+	constructor(socketPath: string) {
+		super(
+			`RPC --listen refused: a live server is already listening on ${socketPath}. ` +
+				"Stop it first or choose a different --listen path.",
+		);
+		this.name = "RpcListenRefusedError";
+	}
+}
+
+/**
+ * Probe whether a unix-domain socket path has a live server accepting
+ * connections. Returns `true` when a connection succeeds (a previous owner is
+ * still alive), and returns `false` only for known missing/stale endpoints
+ * (ENOENT / ECONNREFUSED). Unexpected probe failures fail closed as "alive" so
+ * `--listen` startup refuses to unlink a path it could not safely classify.
+ */
+export async function isUnixSocketAlive(socketPath: string): Promise<boolean> {
+	try {
+		const socket = await Bun.connect({
+			unix: socketPath,
+			socket: { data() {}, open() {}, error() {}, close() {} },
+		});
+		socket.end();
+		return true;
+	} catch (err) {
+		const code = err && typeof err === "object" ? (err as { code?: unknown }).code : undefined;
+		if (code === "ENOENT" || code === "ECONNREFUSED") return false;
+		logger.warn("RPC --listen socket probe failed closed", {
+			socketPath,
+			code: typeof code === "string" ? code : undefined,
+			error: err instanceof Error ? err.message : String(err),
+		});
+		return true;
+	}
+}
+
 export function requestRpcEditor(
 	pendingRequests: Map<string, PendingExtensionRequest>,
 	output: RpcOutput,
@@ -230,6 +343,7 @@ export async function runRpcMode(
 		emitFrame: gate => output(gate),
 		store: gateStore,
 		audit: recordAudit,
+		providerSupportsTokenCostMetrics: modelSupportsTokenCostMetrics(session.model),
 		getUsageSnapshot: () => {
 			const stats = session.getSessionStats();
 			return { tokens: stats.tokens.total, costUsd: stats.cost };
@@ -537,14 +651,13 @@ export async function runRpcMode(
 			unattendedControlPlane,
 		});
 
-	// Cancellation commands must interrupt in-flight work, so they bypass the ordered
-	// queue and run immediately. Everything else runs through a serial chain so causal
-	// order is preserved (e.g. `get_state` after `bash` still observes the bash result)
-	// while the read loop itself never blocks — that is what lets a cancellation command
-	// reach a long-running `bash`/`compact`/`handoff`/`login` instead of being
-	// head-of-line-blocked behind it (issue 13).
-	const CANCELLATION_COMMANDS = new Set<RpcCommand["type"]>(["abort", "abort_bash", "abort_retry"]);
-	let orderedChain: Promise<void> = Promise.resolve();
+	// Fast-lane commands (cancellation + safe read/control, see
+	// isFastLaneRpcCommand) bypass the ordered serial chain and run immediately;
+	// everything else runs through a serial chain so causal order is preserved
+	// (e.g. an ordered `set_model` after `bash` still applies after the bash
+	// result) while the read loop itself never blocks — that is what lets a
+	// fast-lane command reach a long-running `bash`/`compact`/`handoff`/`login`
+	// instead of being head-of-line-blocked behind it (issue 13).
 	const runCommand = async (command: RpcCommand): Promise<void> => {
 		try {
 			output(await handleCommand(command));
@@ -556,14 +669,7 @@ export async function runRpcMode(
 		inFlightCommands.add(task);
 		void task.finally(() => inFlightCommands.delete(task));
 	};
-	const dispatchCommand = (command: RpcCommand): void => {
-		if (CANCELLATION_COMMANDS.has(command.type)) {
-			trackCommand(runCommand(command));
-			return;
-		}
-		orderedChain = orderedChain.then(() => runCommand(command));
-		trackCommand(orderedChain);
-	};
+	const { dispatch: dispatchCommand } = createRpcCommandScheduler(runCommand, trackCommand);
 
 	/**
 	 * Check if shutdown was requested and perform shutdown if so.
@@ -620,6 +726,14 @@ export async function runRpcMode(
 	if (options?.listen) {
 		const socketPath = options.listen;
 		await fs.mkdir(path.dirname(socketPath), { recursive: true }).catch(() => {});
+		// Refuse to clobber a live previous owner: probe the path first and only
+		// unlink a stale endpoint. A second `--listen` on the same path must not
+		// remove the socket another running server is still serving (#606).
+		// Unexpected probe failures are treated as alive, so this also refuses
+		// rather than unlinking a socket path we could not safely classify.
+		if (await isUnixSocketAlive(socketPath)) {
+			throw new RpcListenRefusedError(socketPath);
+		}
 		await fs.rm(socketPath, { force: true }).catch(() => {});
 		await registerRpcSession({
 			sessionId: session.sessionId,

package/src/modes/shared/agent-wire/command-dispatch.ts

@@ -363,7 +363,10 @@ export async function dispatchRpcCommand(
 			}
 
 			case "get_messages": {
-				return rpcSuccess(id, "get_messages", { messages: session.messages });
+				// Fast-lane read: snapshot the live array so a concurrent ordered
+				// turn/compaction mutating session.messages in place cannot make this
+				// response serialize a half-rewritten array (#606, issue 13).
+				return rpcSuccess(id, "get_messages", { messages: [...session.messages] });
 			}
 
 			case "get_login_providers": {
@@ -447,7 +450,7 @@ export async function dispatchRpcCommand(
 
 			default: {
 				const unknownCommand = command as { type: string };
-				return rpcError(undefined, unknownCommand.type, `Unknown command: ${unknownCommand.type}`);
+				return rpcError(id, unknownCommand.type, `Unknown command: ${unknownCommand.type}`);
 			}
 		}
 	} catch (err) {

package/src/modes/shared/agent-wire/host-tool-bridge.ts

@@ -93,6 +93,9 @@ export class RpcHostToolBridge {
 	}
 
 	setTools(tools: RpcHostToolDefinition[]): AgentTool[] {
+		if (tools.some(tool => tool.name === "ask")) {
+			throw new Error('RPC host tool "ask" is reserved and cannot be supplied by the host');
+		}
 		this.#definitions = new Map(tools.map(tool => [tool.name, tool]));
 		return tools.map(tool => new RpcHostToolAdapter(tool, this));
 	}

package/src/modes/shared/agent-wire/unattended-session.ts

@@ -14,6 +14,7 @@
  * Also implements the dispatch-facing {@link RpcUnattendedControlPlane} so the
  * RPC server can route `negotiate_unattended` + `workflow_gate_response` here.
  */
+import type { Model } from "@gajae-code/ai";
 import type {
 	RpcCommand,
 	RpcUnattendedAccepted,
@@ -38,6 +39,20 @@ import { type GateStore, MemoryGateStore, type OpenGateInput, WorkflowGateBroker
  */
 const CHARGED_COMMAND_TYPES = new Set<RpcCommand["type"]>(["bash", "prompt", "steer", "follow_up", "abort_and_prompt"]);
 
+/**
+ * Derive an explicit `providerSupportsTokenCostMetrics` capability from the
+ * active model so unattended negotiation fails closed when token/cost usage
+ * cannot be accounted for (#606). Callers that omit a model — or whose model is
+ * configured to suppress streaming usage (`compat.supportsUsageInStreaming:
+ * false`) — get `false`, which the controller refuses with
+ * `unsupported_budget_metric`.
+ */
+export function modelSupportsTokenCostMetrics(model: Model | undefined): boolean {
+	if (!model) return false;
+	const compat = model.compat as { supportsUsageInStreaming?: boolean } | undefined;
+	return compat?.supportsUsageInStreaming !== false;
+}
+
 /** Minimal surface a skill runtime / ask tool uses to emit a gate and await its answer. */
 export interface WorkflowGateEmitter {
 	/** True only when unattended mode has been negotiated. */
@@ -92,7 +107,7 @@ export class UnattendedSessionControlPlane implements RpcUnattendedControlPlane,
 					this.#rejectAllPending(new Error(`unattended run aborted: ${reason}`));
 				},
 			},
-			providerSupportsTokenCostMetrics: this.opts.providerSupportsTokenCostMetrics ?? true,
+			providerSupportsTokenCostMetrics: this.opts.providerSupportsTokenCostMetrics,
 		});
 		this.#controller = controller;
 		this.#broker = new WorkflowGateBroker(this.opts.runId, this.opts.store ?? new MemoryGateStore(), {