@gajae-code/coding-agent 0.7.10 → 0.8.0

package/src/tools/bash.ts

@@ -8,7 +8,10 @@ import { AsyncJobManager } from "../async";
 import { type BashResult, executeBash } from "../exec/bash-executor";
 import type { RenderResultOptions } from "../extensibility/custom-tools/types";
 import { buildGjcRuntimeSessionEnv } from "../gjc-runtime/goal-mode-request";
-import { GJC_RESTRICTED_ROLE_AGENT_BASH_ENV } from "../gjc-runtime/restricted-role-agent-bash";
+import {
+	GJC_RALPLAN_ARTIFACT_ENV,
+	GJC_RESTRICTED_ROLE_AGENT_BASH_ENV,
+} from "../gjc-runtime/restricted-role-agent-bash";
 import { InternalUrlRouter } from "../internal-urls";
 import { truncateToVisualLines } from "../modes/components/visual-truncate";
 import { highlightCode, type Theme } from "../modes/theme/theme";
@@ -530,13 +533,24 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 
 		const rawCommand = input.command;
 		const allowedPrefixes = this.session.bashAllowedPrefixes;
+		const isRestrictedRalplanArtifactEnv =
+			allowedPrefixes &&
+			allowedPrefixes.length > 0 &&
+			this.session.bashRestrictionProfile !== "read-only" &&
+			env &&
+			Object.keys(env).length === 1 &&
+			Object.hasOwn(env, GJC_RALPLAN_ARTIFACT_ENV) &&
+			rawCommand.includes(`--artifact-env ${GJC_RALPLAN_ARTIFACT_ENV}`);
 		if (
 			(this.session.bashRestrictionProfile === "read-only" || (allowedPrefixes && allowedPrefixes.length > 0)) &&
 			env &&
-			Object.keys(env).length > 0
+			Object.keys(env).length > 0 &&
+			!isRestrictedRalplanArtifactEnv
 		) {
 			const mode = this.session.bashRestrictionProfile === "read-only" ? "Read-only" : "Restricted role-agent";
-			throw new ToolError(`${mode} bash does not allow per-command env overrides.`);
+			throw new ToolError(
+				`${mode} bash only allows the ${GJC_RALPLAN_ARTIFACT_ENV} env override for --artifact-env.`,
+			);
 		}
 		if (allowedPrefixes && allowedPrefixes.length > 0) {
 			const commandsToCheck = rawCommand === command ? [command] : [rawCommand, command];
@@ -597,11 +611,13 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 					await Promise.all(
 						Object.entries(env).map(async ([key, value]) => [
 							key,
-							await expandInternalUrls(value, {
-								...internalUrlOptions,
-								ensureLocalParentDirs: true,
-								noEscape: true,
-							}),
+							key === GJC_RALPLAN_ARTIFACT_ENV
+								? value
+								: await expandInternalUrls(value, {
+										...internalUrlOptions,
+										ensureLocalParentDirs: true,
+										noEscape: true,
+									}),
 						]),
 					),
 				)
@@ -817,9 +833,22 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			});
 		}
 
+		// Route through the client terminal when the client advertises the terminal capability.
+		// Skip when pty=true (PTY needs the local terminal UI).
+		const clientBridge =
+			this.session.bashRestrictionProfile === "read-only" ? undefined : this.session.getClientBridge?.();
+		const clientTerminalActive = Boolean(clientBridge?.capabilities.terminal && clientBridge.createTerminal && !pty);
+
 		const autoBgManager = AsyncJobManager.instance();
-		if (this.#autoBackgroundEnabled && !pty && autoBgManager) {
-			const autoBackgroundWaitMs = this.#resolveAutoBackgroundWaitMs(timeoutMs);
+		// Run non-PTY bash through the managed job path so Ctrl+B-twice fold-on-demand works
+		// even when auto-background is disabled. When a client terminal will handle the
+		// command, keep the existing bridge path unless auto-background is enabled.
+		if (!pty && autoBgManager && (this.#autoBackgroundEnabled || !clientTerminalActive)) {
+			// With auto-background off, wait past the command's own timeout so the job only
+			// leaves the foreground on an explicit Ctrl+B fold, never on an auto-background timer.
+			const autoBackgroundWaitMs = this.#autoBackgroundEnabled
+				? this.#resolveAutoBackgroundWaitMs(timeoutMs)
+				: timeoutMs + 1_000;
 			const startBackgrounded = autoBackgroundWaitMs === 0;
 			const job = this.#startManagedBashJob({
 				command,
@@ -875,10 +904,6 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			});
 		}
 
-		// Route through the client terminal when the client advertises the terminal capability.
-		// Skip when pty=true (PTY needs the local terminal UI).
-		const clientBridge =
-			this.session.bashRestrictionProfile === "read-only" ? undefined : this.session.getClientBridge?.();
 		if (clientBridge?.capabilities.terminal && clientBridge.createTerminal && !pty) {
 			const handle = await clientBridge.createTerminal({
 				command,

package/src/tools/index.ts

@@ -325,7 +325,14 @@ export type ToolFactory = (session: ToolSession) => Tool | null | Promise<Tool |
 export type BuiltinToolLoadMode = "essential" | "discoverable";
 
 /** Default essential tool names when tools.essentialOverride is empty. */
-export const DEFAULT_ESSENTIAL_TOOL_NAMES: readonly string[] = ["read", "bash", "edit"] as const;
+export const DEFAULT_ESSENTIAL_TOOL_NAMES: readonly string[] = [
+	"read",
+	"bash",
+	"edit",
+	"write",
+	"search",
+	"find",
+] as const;
 
 /**
  * Resolve the active essential built-in tool names from settings.

package/src/utils/cmux-workspace.ts

@@ -2,14 +2,25 @@ import { logger } from "@gajae-code/utils";
 
 const CMUX_COMMAND = "cmux";
 const CMUX_WORKSPACE_ID_ENV = "CMUX_WORKSPACE_ID";
+const CMUX_NO_RENAME_ENV = "GJC_NO_CMUX_RENAME";
 const CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/g;
+const CMUX_WORKSPACE_TITLE_PREFIX = "GJC: ";
 const CMUX_WORKSPACE_RENAME_TIMEOUT_MS = 1500;
+const CMUX_WORKSPACE_LIST_TIMEOUT_MS = 1500;
 
 export interface CmuxWorkspaceRenameCommand {
 	command: string;
 	args: string[];
 }
 
+/** Current ownership state of a cmux workspace, read back from `cmux workspace list`. */
+export interface CmuxWorkspaceOwnership {
+	/** cmux marks a workspace `has_custom_title` once an explicit title is set (by the user or by GJC). */
+	hasCustomTitle: boolean;
+	/** The workspace's current display title. */
+	title: string;
+}
+
 export interface CmuxWorkspaceRenameProcess {
 	exited: Promise<number>;
 	kill(): void;
@@ -24,6 +35,12 @@ export interface CmuxWorkspaceTitleSyncOptions {
 		command: string[],
 		options: { env: NodeJS.ProcessEnv; stdin: "ignore"; stdout: "ignore"; stderr: "ignore" },
 	) => CmuxWorkspaceRenameProcess;
+	/** Reads the current ownership state of `workspaceId`. Injectable for tests. */
+	readOwnership?: (
+		cmuxCommand: string,
+		workspaceId: string,
+		env: NodeJS.ProcessEnv,
+	) => Promise<CmuxWorkspaceOwnership | null>;
 }
 
 function defaultSpawn(
@@ -33,12 +50,24 @@ function defaultSpawn(
 	return Bun.spawn(command, options);
 }
 
+function isEnvSet(value: string | undefined): boolean {
+	if (!value) return false;
+	const normalized = value.trim().toLowerCase();
+	return normalized !== "" && normalized !== "0" && normalized !== "false";
+}
+
 export function sanitizeCmuxWorkspaceTitle(title: string | undefined): string | undefined {
 	if (!title) return undefined;
 	const sanitized = title.replace(CONTROL_CHARS, " ").replace(/\s+/g, " ").trim();
 	return sanitized || undefined;
 }
 
+export function formatCmuxWorkspaceTitle(title: string | undefined): string | undefined {
+	const sanitized = sanitizeCmuxWorkspaceTitle(title);
+	if (!sanitized) return undefined;
+	return sanitized.startsWith(CMUX_WORKSPACE_TITLE_PREFIX) ? sanitized : `${CMUX_WORKSPACE_TITLE_PREFIX}${sanitized}`;
+}
+
 export function buildCmuxWorkspaceRenameCommand(
 	sessionName: string | undefined,
 	env: NodeJS.ProcessEnv = process.env,
@@ -46,7 +75,7 @@ export function buildCmuxWorkspaceRenameCommand(
 	const workspaceId = env[CMUX_WORKSPACE_ID_ENV]?.trim();
 	if (!workspaceId) return null;
 
-	const title = sanitizeCmuxWorkspaceTitle(sessionName);
+	const title = formatCmuxWorkspaceTitle(sessionName);
 	if (!title) return null;
 
 	return {
@@ -55,27 +84,125 @@ export function buildCmuxWorkspaceRenameCommand(
 	};
 }
 
-export function syncCmuxWorkspaceTitle(
+/** Parse `cmux workspace list --json --id-format both` output and return the
+ * ownership state of the workspace matching `workspaceId` (by UUID `id` or `ref`). */
+export function parseCmuxWorkspaceOwnership(jsonText: string, workspaceId: string): CmuxWorkspaceOwnership | null {
+	const target = workspaceId.trim().toLowerCase();
+	if (!target) return null;
+
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(jsonText);
+	} catch {
+		return null;
+	}
+
+	const workspaces = (parsed as { workspaces?: unknown }).workspaces;
+	if (!Array.isArray(workspaces)) return null;
+
+	for (const entry of workspaces) {
+		if (!entry || typeof entry !== "object") continue;
+		const record = entry as Record<string, unknown>;
+		const id = typeof record.id === "string" ? record.id.toLowerCase() : "";
+		const ref = typeof record.ref === "string" ? record.ref.toLowerCase() : "";
+		if (id !== target && ref !== target) continue;
+		return {
+			hasCustomTitle: record.has_custom_title === true,
+			title: typeof record.title === "string" ? record.title : "",
+		};
+	}
+	return null;
+}
+
+/** Only rename when GJC owns the name:
+ * - unknown ownership (read failed) → skip (fail safe, never clobber)
+ * - already the desired title → skip (no-op)
+ * - workspace still on its default title → rename
+ * - any custom title (user- or peer-set) → skip
+ * This makes GJC name a fresh workspace once and then leave it alone, so it
+ * never overwrites a user-pinned name and multiple sessions sharing one
+ * CMUX_WORKSPACE_ID do not thrash the workspace title. */
+export function shouldRenameCmuxWorkspace(ownership: CmuxWorkspaceOwnership | null, desiredTitle: string): boolean {
+	if (!ownership) return false;
+	if ((sanitizeCmuxWorkspaceTitle(ownership.title) ?? "") === desiredTitle) return false;
+	return !ownership.hasCustomTitle;
+}
+
+async function defaultReadOwnership(
+	cmuxCommand: string,
+	workspaceId: string,
+	env: NodeJS.ProcessEnv,
+): Promise<CmuxWorkspaceOwnership | null> {
+	try {
+		const proc = Bun.spawn([cmuxCommand, "workspace", "list", "--json", "--id-format", "both"], {
+			env: { ...env, CMUX_QUIET: "1" },
+			stdin: "ignore",
+			stdout: "pipe",
+			stderr: "ignore",
+		});
+		const timer = setTimeout(() => {
+			try {
+				proc.kill();
+			} catch {}
+		}, CMUX_WORKSPACE_LIST_TIMEOUT_MS);
+		timer.unref?.();
+		const text = await new Response(proc.stdout).text();
+		await proc.exited;
+		clearTimeout(timer);
+		return parseCmuxWorkspaceOwnership(text, workspaceId);
+	} catch (error) {
+		logger.debug("cmux workspace list failed", { error: String(error) });
+		return null;
+	}
+}
+
+/**
+ * Best-effort sync of the containing cmux workspace title to the current GJC
+ * session name. Ownership-guarded: GJC reads the current workspace title and
+ * only renames a workspace that still has its default title, so it never
+ * overwrites a name the user pinned or a name a peer session (sharing the same
+ * CMUX_WORKSPACE_ID) set. Opt out with GJC_NO_CMUX_RENAME.
+ */
+export async function syncCmuxWorkspaceTitle(
 	sessionName: string | undefined,
 	options: CmuxWorkspaceTitleSyncOptions = {},
-): void {
+): Promise<void> {
+	const env = options.env ?? process.env;
+	if (isEnvSet(env[CMUX_NO_RENAME_ENV])) return;
+
 	const isTty = options.isTty ?? process.stdout.isTTY === true;
 	if (!isTty) return;
 
-	const env = options.env ?? process.env;
-	const plan = buildCmuxWorkspaceRenameCommand(sessionName, env);
-	if (!plan) return;
+	const workspaceId = env[CMUX_WORKSPACE_ID_ENV]?.trim();
+	if (!workspaceId) return;
+
+	const desired = formatCmuxWorkspaceTitle(sessionName);
+	if (!desired) return;
 
 	const which = options.which ?? Bun.which;
 	let resolvedCommand: string | null;
 	try {
-		resolvedCommand = which(plan.command);
+		resolvedCommand = which(CMUX_COMMAND);
 	} catch (error) {
 		logger.debug("cmux workspace rename command lookup failed", { error: String(error) });
 		return;
 	}
 	if (!resolvedCommand) return;
 
+	let ownership: CmuxWorkspaceOwnership | null;
+	try {
+		const readOwnership = options.readOwnership ?? defaultReadOwnership;
+		ownership = await readOwnership(resolvedCommand, workspaceId, env);
+	} catch (error) {
+		logger.debug("cmux workspace ownership read failed", { error: String(error) });
+		return;
+	}
+
+	if (!shouldRenameCmuxWorkspace(ownership, desired)) return;
+
+	const plan = buildCmuxWorkspaceRenameCommand(sessionName, env);
+	if (!plan) return;
+
 	const spawn = options.spawn ?? defaultSpawn;
 	try {
 		const proc = spawn([resolvedCommand, ...plan.args], {

package/src/utils/title-generator.ts

@@ -219,7 +219,7 @@ export function setTerminalTitle(title: string): void {
 
 export function setSessionTerminalTitle(sessionName: string | undefined, cwd?: string): void {
 	setTerminalTitle(formatSessionTerminalTitle(sessionName, cwd));
-	syncCmuxWorkspaceTitle(sessionName);
+	void syncCmuxWorkspaceTitle(sessionName);
 }
 
 /**

package/src/web/kagi.ts

@@ -147,7 +147,7 @@ export async function searchWithKagi(
 
 	const response = await fetch(requestUrl, {
 		headers: getAuthHeaders(apiKey),
-		signal: withHardTimeout(options.signal),
+		signal: withHardTimeout(options.signal, "api"),
 	});
 	if (!response.ok) {
 		throw parseKagiErrorResponse(response.status, await response.text());

package/src/web/parallel.ts

@@ -306,7 +306,7 @@ export async function searchWithParallel(
 				max_chars_per_result: options.maxCharsPerResult ?? 10_000,
 			},
 		}),
-		signal: withHardTimeout(options.signal),
+		signal: withHardTimeout(options.signal, "api"),
 	});
 	if (!response.ok) {
 		throw parseParallelErrorResponse(response.status, await response.text());
@@ -338,7 +338,7 @@ export async function extractWithParallel(
 			excerpts: options.excerpts ?? true,
 			full_content: options.fullContent ?? false,
 		}),
-		signal: withHardTimeout(options.signal),
+		signal: withHardTimeout(options.signal, "api"),
 	});
 	if (!response.ok) {
 		throw parseParallelErrorResponse(response.status, await response.text());

package/src/web/search/index.ts

@@ -16,7 +16,7 @@ import { discoverAuthStorage } from "../../sdk";
 import type { ToolSession } from "../../tools";
 import { formatAge } from "../../tools/render-utils";
 import { throwIfAborted } from "../../tools/tool-errors";
-import { getSearchProviderLabel, resolveProviderChain, type SearchProvider } from "./provider";
+import { getSearchProviderLabel, prewarmSearchProviders, resolveProviderChain, type SearchProvider } from "./provider";
 import { renderSearchCall, renderSearchResult, type SearchRenderDetails } from "./render";
 import type { ActiveSearchModelContext, SearchProviderId, SearchResponse } from "./types";
 import { SearchProviderError } from "./types";
@@ -148,6 +148,22 @@ interface ExecuteSearchOptions {
 	activeModelContext?: ActiveSearchModelContext;
 }
 
+/**
+ * Delay before the keyless DuckDuckGo hedge fires while a slower primary is
+ * still in flight. Chosen to be comfortably above DDG's typical ~1-2s
+ * round-trip cost budget yet far below LLM-mediated primary latency, so a
+ * failing primary can fall back to an already-completed hedge result instead
+ * of paying primary-failure time plus DDG time sequentially.
+ */
+const DDG_HEDGE_DELAY_MS = 3_000;
+
+let ddgHedgeDelayMs = DDG_HEDGE_DELAY_MS;
+
+/** Override the hedge delay (tests). Non-finite/non-positive resets to default. */
+export function setDdgHedgeDelayMs(ms: number | undefined): void {
+	ddgHedgeDelayMs = typeof ms === "number" && Number.isFinite(ms) && ms > 0 ? ms : DDG_HEDGE_DELAY_MS;
+}
+
 /** Execute web search */
 async function executeSearch(
 	_toolCallId: string,
@@ -166,52 +182,91 @@ async function executeSearch(
 		activeModelContext,
 	});
 
+	const baseSearchParams = {
+		query: params.query.replace(/202\d/g, String(new Date().getFullYear())), // LUL
+		limit: params.limit,
+		recency: params.recency,
+		systemPrompt: webSearchSystemPrompt,
+		maxOutputTokens: params.max_tokens,
+		numSearchResults: params.num_search_results,
+		temperature: params.temperature,
+		xaiSearchMode: params.xai_search_mode,
+		allowedDomains: params.allowed_domains,
+		excludedDomains: params.excluded_domains,
+		allowedXHandles: params.allowed_x_handles,
+		excludedXHandles: params.excluded_x_handles,
+		fromDate: params.from_date,
+		toDate: params.to_date,
+		enableImageUnderstanding: params.enable_image_understanding,
+		enableImageSearch: params.enable_image_search,
+		enableVideoUnderstanding: params.enable_video_understanding,
+		noInlineCitations: params.no_inline_citations,
+		authStorage,
+		sessionId,
+		activeModelContext,
+	};
+
+	// Hedged fallback: when DuckDuckGo (keyless, cheap) is a non-primary member
+	// of the chain, start it in the background after a short delay. If the
+	// primary succeeds first the hedge is aborted; if the primary fails, the
+	// hedge result is typically already available, collapsing the fallback
+	// latency from `t(primary failure) + t(ddg)` to `max(t(primary failure), t(ddg))`.
+	const ddgIndex = providers.findIndex(p => p.id === "duckduckgo");
+	const hedgeCtl = new AbortController();
+	const onUpstreamAbort = () => hedgeCtl.abort();
+	signal?.addEventListener("abort", onUpstreamAbort, { once: true });
+	let hedgePromise: Promise<SearchResponse> | undefined;
+	let hedgeTimer: NodeJS.Timeout | undefined;
+	if (ddgIndex > 0) {
+		const ddg = providers[ddgIndex]!;
+		hedgeTimer = setTimeout(() => {
+			hedgePromise = ddg.search({ ...baseSearchParams, signal: hedgeCtl.signal });
+			// Failures are consumed when (and if) the loop reaches DuckDuckGo;
+			// never let a losing hedge become an unhandled rejection.
+			hedgePromise.catch(() => {});
+		}, ddgHedgeDelayMs);
+	}
+	const cancelHedge = () => {
+		if (hedgeTimer !== undefined) clearTimeout(hedgeTimer);
+		hedgeCtl.abort();
+		signal?.removeEventListener("abort", onUpstreamAbort);
+	};
+
 	const failures: Array<{ provider: SearchProvider; error: unknown }> = [];
 	let lastProvider = providers[0];
-	for (const provider of providers) {
-		lastProvider = provider;
-		try {
-			const response = await provider.search({
-				query: params.query.replace(/202\d/g, String(new Date().getFullYear())), // LUL
-				limit: params.limit,
-				recency: params.recency,
-				systemPrompt: webSearchSystemPrompt,
-				maxOutputTokens: params.max_tokens,
-				numSearchResults: params.num_search_results,
-				temperature: params.temperature,
-				xaiSearchMode: params.xai_search_mode,
-				allowedDomains: params.allowed_domains,
-				excludedDomains: params.excluded_domains,
-				allowedXHandles: params.allowed_x_handles,
-				excludedXHandles: params.excluded_x_handles,
-				fromDate: params.from_date,
-				toDate: params.to_date,
-				enableImageUnderstanding: params.enable_image_understanding,
-				enableImageSearch: params.enable_image_search,
-				enableVideoUnderstanding: params.enable_video_understanding,
-				noInlineCitations: params.no_inline_citations,
-				signal,
-				authStorage,
-				sessionId,
-				activeModelContext,
-			});
-
-			const text = formatForLLM(response);
-			const warning = failures.length > 0 ? formatFallbackWarning(failures, provider) : undefined;
-
-			return {
-				content: [{ type: "text" as const, text: warning ? `Warning: ${warning}\n\n${text}` : text }],
-				details: { response, ...(warning ? { warning } : {}) },
-			};
-		} catch (error) {
-			// Surface user-initiated cancellation immediately so the session sees
-			// a clean abort instead of a generic "all providers failed" message.
-			// Without this, an AbortError from `fetch()` is treated as a provider
-			// failure and the loop falls through to the next provider (or to the
-			// summary error), masking the cancellation.
-			throwIfAborted(signal);
-			failures.push({ provider, error });
+	try {
+		for (const provider of providers) {
+			lastProvider = provider;
+			try {
+				let response: SearchResponse;
+				if (provider.id === "duckduckgo" && hedgePromise) {
+					// Reuse the in-flight (often already-settled) hedge request.
+					if (hedgeTimer !== undefined) clearTimeout(hedgeTimer);
+					response = await hedgePromise;
+				} else {
+					if (provider.id === "duckduckgo" && hedgeTimer !== undefined) clearTimeout(hedgeTimer);
+					response = await provider.search({ ...baseSearchParams, signal });
+				}
+
+				const text = formatForLLM(response);
+				const warning = failures.length > 0 ? formatFallbackWarning(failures, provider) : undefined;
+
+				return {
+					content: [{ type: "text" as const, text: warning ? `Warning: ${warning}\n\n${text}` : text }],
+					details: { response, ...(warning ? { warning } : {}) },
+				};
+			} catch (error) {
+				// Surface user-initiated cancellation immediately so the session sees
+				// a clean abort instead of a generic "all providers failed" message.
+				// Without this, an AbortError from `fetch()` is treated as a provider
+				// failure and the loop falls through to the next provider (or to the
+				// summary error), masking the cancellation.
+				throwIfAborted(signal);
+				failures.push({ provider, error });
+			}
 		}
+	} finally {
+		cancelHedge();
 	}
 
 	const lastFailure = failures[failures.length - 1];
@@ -273,6 +328,24 @@ export class WebSearchTool implements AgentTool<typeof webSearchSchema, SearchRe
 	constructor(session: ToolSession) {
 		this.#session = session;
 		this.description = prompt.render(webSearchDescription);
+		// Prewarm: resolve the provider chain once in the background so the
+		// provider modules are imported and the chain cache is primed before
+		// the first user-visible search. Best-effort only.
+		const authStorage = session.authStorage;
+		if (authStorage) {
+			try {
+				const activeModelContext = session.model
+					? session.modelRegistry?.getActiveSearchModelContext(session.model)
+					: undefined;
+				prewarmSearchProviders({
+					authStorage,
+					sessionId: session.getSessionId?.() ?? undefined,
+					activeModelContext,
+				});
+			} catch {
+				// Never let prewarming break tool construction.
+			}
+		}
 	}
 
 	async execute(
@@ -334,6 +407,6 @@ export {
 	setPreferredSearchProvider,
 	setSearchFallbackProviders,
 } from "./provider";
-export { setSearchHardTimeoutMs } from "./providers/utils";
+export { applyConfiguredSearchTimeout, setSearchHardTimeoutMs } from "./providers/utils";
 export type { SearchProviderId as SearchProvider, SearchResponse } from "./types";
 export { isConfigurableSearchProviderId, isSearchProviderPreference } from "./types";

package/src/web/search/provider.ts

@@ -141,12 +141,63 @@ const MODEL_PROVIDER_TO_SEARCH: Record<string, SearchProviderId> = {
 let preferredProvId: SearchProviderId | "auto" = "auto";
 let fallbackProvIds: SearchProviderId[] = [];
 
+/**
+ * Resolved-chain cache. Chain resolution probes provider availability
+ * (credential lookups, potentially an OAuth refresh through the broker) on
+ * every web_search call even though the result only changes when the active
+ * model, provider preference, or credentials change. Cache the resolved
+ * provider-id list per AuthStorage instance for a short TTL.
+ *
+ * Keyed by AuthStorage identity (WeakMap) so tests and short-lived CLI calls
+ * with fresh storage handles never see another handle's chain. The TTL keeps
+ * a login/logout mid-session from being masked for more than a minute.
+ */
+const CHAIN_CACHE_TTL_MS = 60_000;
+let chainCache = new WeakMap<AuthStorage, Map<string, { ids: SearchProviderId[]; expires: number }>>();
+
+/** Drop every cached resolved chain (settings changed, tests). */
+export function clearResolvedChainCache(): void {
+	chainCache = new WeakMap();
+}
+
+function chainCacheKey(
+	preferred: SearchProviderId | "auto" | undefined,
+	fallbacks: readonly SearchProviderId[],
+	ctx: ActiveSearchModelContext | undefined,
+	authStorage: AuthStorage,
+): string {
+	// Include the AuthStorage generation so credential changes (login/logout,
+	// key rotation) invalidate cached chains immediately instead of being
+	// masked for up to the TTL. Stubs without getGeneration() key as 0.
+	const generation = (authStorage as { getGeneration?: () => number }).getGeneration?.() ?? 0;
+	return JSON.stringify([
+		generation,
+		preferred ?? null,
+		fallbacks,
+		ctx
+			? [ctx.provider, ctx.modelId, ctx.wireModelId ?? null, ctx.api, ctx.baseUrl ?? null, ctx.webSearch ?? null]
+			: null,
+	]);
+}
+
 export function setPreferredSearchProvider(provider: SearchProviderId | "auto"): void {
 	preferredProvId = provider;
+	clearResolvedChainCache();
 }
 
 export function setSearchFallbackProviders(ids: readonly string[]): void {
 	fallbackProvIds = ids.filter(isConfigurableSearchProviderId);
+	clearResolvedChainCache();
+}
+
+/**
+ * Fire-and-forget warm-up: resolve the provider chain once so the provider
+ * modules are imported and the chain cache is primed before the first
+ * user-visible search. Errors are intentionally swallowed — prewarming must
+ * never surface a failure the real search path would handle itself.
+ */
+export function prewarmSearchProviders(options: ResolveProviderChainOptions): void {
+	void resolveProviderChain(options).catch(() => {});
 }
 
 export interface SearchProviderPreferenceSource {
@@ -357,6 +408,16 @@ export async function resolveProviderChain(options: ResolveProviderChainOptions)
 		activeModelContext,
 		fallbackProviders = fallbackProvIds,
 	} = options;
+
+	const cacheKey = chainCacheKey(preferredProvider, fallbackProviders, activeModelContext, authStorage);
+	const perStorage = chainCache.get(authStorage);
+	const cached = perStorage?.get(cacheKey);
+	if (cached && cached.expires > Date.now()) {
+		const cachedProviders: SearchProvider[] = [];
+		for (const id of cached.ids) cachedProviders.push(await getSearchProvider(id));
+		return cachedProviders;
+	}
+
 	const chain: SearchProviderId[] = [];
 
 	// A forced primary is honored only when it is a user-configurable provider.
@@ -392,6 +453,10 @@ export async function resolveProviderChain(options: ResolveProviderChainOptions)
 	}
 	appendDeduped(chain, "duckduckgo");
 
+	const storageEntry = chainCache.get(authStorage) ?? new Map<string, { ids: SearchProviderId[]; expires: number }>();
+	storageEntry.set(cacheKey, { ids: [...chain], expires: Date.now() + CHAIN_CACHE_TTL_MS });
+	chainCache.set(authStorage, storageEntry);
+
 	const providers: SearchProvider[] = [];
 	for (const id of chain) providers.push(await getSearchProvider(id));
 	return providers;

package/src/web/search/providers/anthropic.ts

@@ -119,7 +119,7 @@ async function callSearch(
 		method: "POST",
 		headers,
 		body: JSON.stringify(body),
-		signal: withHardTimeout(signal),
+		signal: withHardTimeout(signal, "llm"),
 	});
 
 	if (!response.ok) {

package/src/web/search/providers/brave.ts

@@ -85,7 +85,7 @@ async function callBraveSearch(
 			Accept: "application/json",
 			"X-Subscription-Token": apiKey,
 		},
-		signal: withHardTimeout(params.signal),
+		signal: withHardTimeout(params.signal, "api"),
 	});
 
 	if (!response.ok) {

package/src/web/search/providers/codex.ts

@@ -216,7 +216,7 @@ async function callCodexSearch(
 		method: "POST",
 		headers,
 		body: JSON.stringify(body),
-		signal: withHardTimeout(options.signal),
+		signal: withHardTimeout(options.signal, "llm"),
 	});
 
 	if (!response.ok) {