@gajae-code/coding-agent 0.5.2 → 0.5.4

package/src/tools/browser/tab-supervisor.ts

@@ -55,6 +55,8 @@ export interface TabSession {
 	pending: Map<string, PendingRun>;
 	dialogPolicy?: DialogPolicy;
 	kindTag: BrowserKindTag;
+	/** Session that acquired this tab; used for session-scoped teardown (F13). */
+	ownerId?: string;
 }
 
 export interface AcquireTabOptions {
@@ -65,6 +67,8 @@ export interface AcquireTabOptions {
 	signal?: AbortSignal;
 	timeoutMs: number;
 	dialogs?: DialogPolicy;
+	/** Owning session id so dispose can release only this session's tabs (F13). */
+	ownerId?: string;
 }
 
 export interface AcquireTabResult {
@@ -161,6 +165,7 @@ export async function acquireTab(
 		pending: new Map(),
 		dialogPolicy: opts.dialogs,
 		kindTag: browser.kind.kind,
+		ownerId: opts.ownerId,
 	};
 	worker.onMessage(msg => handleTabMessage(tab, msg));
 	tabs.set(name, tab);
@@ -254,6 +259,23 @@ export async function releaseAllTabs(opts: ReleaseTabOptions = {}): Promise<numb
 	return count;
 }
 
+/**
+ * Release only the tabs owned by `ownerId` (F13 session-scoped teardown). Tabs acquired
+ * by other sessions (or with no owner) are left untouched. No-op for a null/empty owner.
+ */
+export async function releaseTabsForOwner(
+	ownerId: string | null | undefined,
+	opts: ReleaseTabOptions = {},
+): Promise<number> {
+	if (!ownerId) return 0;
+	const names = [...tabs.entries()].filter(([, tab]) => tab.ownerId === ownerId).map(([name]) => name);
+	let count = 0;
+	for (const name of names) {
+		if (await releaseTab(name, opts)) count++;
+	}
+	return count;
+}
+
 export async function dropHeadlessTabs(): Promise<void> {
 	const names = [...tabs.values()].filter(tab => tab.kindTag === "headless").map(tab => tab.name);
 	for (const name of names) await releaseTab(name);

package/src/tools/browser.ts

@@ -213,6 +213,7 @@ export class BrowserTool implements AgentTool<typeof browserSchema, BrowserToolD
 
 		const result = await untilAborted(signal, () =>
 			acquireTab(name, browser, {
+				ownerId: this.session.getSessionId?.() ?? undefined,
 				url: params.url,
 				waitUntil: params.wait_until,
 				viewport: params.viewport
@@ -381,11 +382,44 @@ function sameBrowserKind(a: BrowserKind, b: BrowserKind): boolean {
 	return false;
 }
 
+/** Max chars of a browser return value surfaced into the tool result (F22). */
+const MAX_BROWSER_RETURN_CHARS = 256 * 1024;
+
+const BROWSER_RETURN_BUDGET_EXCEEDED = Symbol("browser-return-budget-exceeded");
+
+/** Hard-cap any surfaced browser return string at the byte/char limit with a notice. */
+function capBrowserReturn(text: string): string {
+	if (text.length <= MAX_BROWSER_RETURN_CHARS) return text;
+	return `${text.slice(0, MAX_BROWSER_RETURN_CHARS)}\n\n[Browser return value truncated: ${text.length} chars exceeds the ${MAX_BROWSER_RETURN_CHARS}-char cap.]`;
+}
+
 function stringifyReturnValue(value: unknown): string {
-	if (typeof value === "string") return value;
+	if (typeof value === "string") return capBrowserReturn(value);
+	// F22: bound the serialization itself — the replacer tracks running size and aborts early so a
+	// huge object/array cannot build megabytes before truncation — AND hard-cap the final string,
+	// since pretty-print structural overhead (indent/braces/commas) is not counted by the budget.
+	let budget = MAX_BROWSER_RETURN_CHARS;
 	try {
-		return JSON.stringify(value, null, 2) ?? String(value);
-	} catch {
-		return String(value);
+		const text = JSON.stringify(
+			value,
+			(_key, val) => {
+				if (typeof val === "string") budget -= val.length + 4;
+				else if (typeof val === "number" || typeof val === "boolean") budget -= 8;
+				else budget -= 2;
+				if (budget < 0) throw BROWSER_RETURN_BUDGET_EXCEEDED;
+				return val;
+			},
+			2,
+		);
+		return text === undefined ? capBrowserReturn(String(value)) : capBrowserReturn(text);
+	} catch (error) {
+		if (error === BROWSER_RETURN_BUDGET_EXCEEDED) {
+			return `[Browser return value too large to serialize (exceeds the ${MAX_BROWSER_RETURN_CHARS}-char cap). Return a smaller or summarized value from the page script.]`;
+		}
+		try {
+			return capBrowserReturn(String(value));
+		} catch {
+			return "[unserializable browser return value]";
+		}
 	}
 }

package/src/tools/cron.ts

@@ -700,13 +700,9 @@ export class CronDeleteTool implements AgentTool<typeof cronDeleteSchema, CronDe
 	): Promise<AgentToolResult<CronDeleteToolDetails>> {
 		const ownerId = this.session.getAgentId?.() ?? undefined;
 		const deleted = deleteRecord(ownerId, params.id);
+		const text = deleted ? `Cancelled ${params.id}` : `No scheduled task '${params.id}' found; nothing to cancel.`;
 		return {
-			content: [
-				{
-					type: "text",
-					text: deleted ? `Cancelled ${params.id}` : `Failed to remove scheduled task '${params.id}'`,
-				},
-			],
+			content: [{ type: "text", text }],
 			details: { id: params.id, deleted },
 		};
 	}

package/src/tools/read.ts

@@ -1270,19 +1270,18 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 				}
 				case "raw": {
 					const result = executeReadQuery(db, selector.sql);
+					const table = renderTable(result.columns, result.rows, {
+						totalCount: result.rows.length,
+						offset: 0,
+						limit: result.rows.length || DEFAULT_MAX_LINES,
+						table: "query",
+						dbPath: resolvedSqlitePath.absolutePath,
+					});
+					const body = result.truncated
+						? `${table}\n\n[Output truncated to the first ${result.rows.length} rows; add a LIMIT clause to the query to bound or page the result.]`
+						: table;
 					return toolResult<ReadToolDetails>(details)
-						.text(
-							prependSuffixResolutionNotice(
-								renderTable(result.columns, result.rows, {
-									totalCount: result.rows.length,
-									offset: 0,
-									limit: result.rows.length || DEFAULT_MAX_LINES,
-									table: "query",
-									dbPath: resolvedSqlitePath.absolutePath,
-								}),
-								resolvedSqlitePath.suffixResolution,
-							),
-						)
+						.text(prependSuffixResolutionNotice(body, resolvedSqlitePath.suffixResolution))
 						.sourcePath(resolvedSqlitePath.absolutePath)
 						.done();
 				}

package/src/tools/sqlite-reader.ts

@@ -590,15 +590,29 @@ export function getRowByRowId(db: Database, table: string, key: string): Record<
 		.get(binding);
 }
 
-export function executeReadQuery(db: Database, sql: string): { columns: string[]; rows: Record<string, unknown>[] } {
+const MAX_RAW_QUERY_ROWS = 1000;
+
+export function executeReadQuery(
+	db: Database,
+	sql: string,
+	maxRows: number = MAX_RAW_QUERY_ROWS,
+): { columns: string[]; rows: Record<string, unknown>[]; truncated: boolean } {
 	const statement = db.prepare<SqliteRow, []>(sql);
 	if (statement.paramsCount > 0) {
 		throw new ToolError("SQLite raw queries do not support bound parameters");
 	}
-	return {
-		columns: [...statement.columnNames],
-		rows: statement.all(),
-	};
+	// Stream rows and stop at the cap (F20): a raw `q=SELECT ...` over a huge table
+	// must not materialize every row into memory via statement.all().
+	const rows: Record<string, unknown>[] = [];
+	let truncated = false;
+	for (const row of statement.iterate()) {
+		if (rows.length >= maxRows) {
+			truncated = true;
+			break;
+		}
+		rows.push(row as Record<string, unknown>);
+	}
+	return { columns: [...statement.columnNames], rows, truncated };
 }
 
 export function insertRow(db: Database, table: string, data: Record<string, unknown>): void {

package/src/web/search/providers/codex.ts

@@ -19,8 +19,9 @@ import { classifyProviderHttpError, withHardTimeout } from "./utils";
 
 const CODEX_BASE_URL = "https://chatgpt.com/backend-api";
 const CODEX_RESPONSES_PATH = "/codex/responses";
-const FALLBACK_MODEL = "gpt-5.4";
+const FALLBACK_MODEL = "gpt-5.5";
 const DEFAULT_MODEL_PREFERENCES = [
+	"gpt-5.5",
 	"gpt-5.4",
 	"gpt-5-codex",
 	"gpt-5",
@@ -453,12 +454,12 @@ async function callCodexSearch(
  * Executes a web search using OpenAI code provider's built-in web search tool.
  *
  * Default-model behavior:
- * - If `PI_OPENAI_CODE_WEB_SEARCH_MODEL` is set, use it exactly once and surface any
+ * - If `PI_CODEX_WEB_SEARCH_MODEL` is set, use it exactly once and surface any
  *   upstream error verbatim.
- * - Otherwise prefer ChatGPT-account-safe bundled defaults (GPT-5.4, GPT-5
- *   OpenAI code backend, GPT-5, …) and retry the next candidate only when OpenAI code backend returns the
+ * - Otherwise prefer ChatGPT-account-safe bundled defaults (GPT-5.5, GPT-5.4,
+ *   GPT-5 code backend, …) and retry the next candidate only when OpenAI code backend returns the
  *   known 400 "model is not supported" family. This avoids selecting
- *   `gpt-5-OpenAI code backend-mini` first on ChatGPT accounts, which OpenAI rejects.
+ *   `gpt-5-codex-mini` first on ChatGPT accounts, which OpenAI rejects.
  */
 export async function searchCodex(params: SearchParams): Promise<SearchResponse> {
 	const auth = await findCodexAuth(params.authStorage, params.sessionId, params.signal);