codeep 3.4.0 → 3.5.0

package/dist/acp/commands.d.ts

@@ -28,6 +28,21 @@ export interface AcpSession {
 export type AcpAgentRunOptions = Pick<AgentSessionOptions, 'onRequestPermission' | 'extraDangerousTools' | 'onExecuteCommand' | 'fs'> & {
     /** Ask the user a yes/no question. Unset: the mode runs without asking. */
     confirm?: (message: string) => Promise<boolean>;
+    /**
+     * Auto mode's answer to the agent's permission gate: yes to everything
+     * except a write to a file that decides what runs later, which is asked
+     * about in every mode. A command that runs the agent passes it in place of
+     * the missing `onRequestPermission`, because the agent refuses those writes
+     * outright when it has nobody to ask — so without this, /go and a skill's
+     * agent step could not touch `.git/config` at all in auto mode, while a
+     * plain prompt could after a confirmation.
+     *
+     * Kept under its own key rather than set on `onRequestPermission`, which
+     * this file reads as "this session asks the user" when it decides whether
+     * to gate a skill's shell lines. Auto mode runs those without asking, as
+     * that mode promises.
+     */
+    onAutoModePermission?: AgentSessionOptions['onRequestPermission'];
 };
 export interface CommandResult {
     /** true if the input was a slash command (even if it failed) */

package/dist/acp/commands.js

@@ -4,7 +4,7 @@
 // responses (no TUI) suitable for streaming back via session/update.
 import { config, getCurrentProvider, getModelsForCurrentProvider, setProvider, setApiKey, isConfigured, listSessionsWithInfo, startNewSession, loadSession, saveSession, initializeAsProject, isManuallyInitializedProject, setProjectPermission, hasWritePermission, hasReadPermission, sessionNameProblem, sessionNameTaken, } from '../config/index.js';
 import { symlinkedCodeepNotice } from '../utils/projectPaths.js';
-import { getProviderList, getProvider } from '../config/providers.js';
+import { getProviderList, getProvider, replacementModelFor } from '../config/providers.js';
 import { telemetryCommand } from '../commands/core/telemetry.js';
 import { keysyncCommand } from '../commands/core/keysync.js';
 import { getProjectContext } from '../utils/project.js';
@@ -15,6 +15,8 @@ import { existsSync, mkdirSync } from 'fs';
 import { join } from 'path';
 import { chat } from '../api/index.js';
 import { runAgent, classifyPermissionOutcome, buildDangerousTools } from '../utils/agent.js';
+import { forgetHooksDirectory } from '../utils/toolExecution.js';
+import { shellCommandEnv } from '../utils/shell.js';
 import { beginTurn } from './turns.js';
 /** Pending plans a /go is executing right now. */
 const plansRunning = new Set();
@@ -1385,20 +1387,25 @@ Anything else the agent should know — edge cases, gotchas, things to double-ch
             saveSession(session.codeepSessionId, session.history, session.workspaceRoot);
             // If the checkpoint captured a different provider/model, switch back.
             // configOptionsChanged signals the client to refresh its dropdowns.
+            // A checkpoint predates any later retirement, so its model goes through
+            // the same map as a stored config (`gpt-6-astra` comes back as
+            // `gpt-6-sol`), looked up on the provider actually active after the switch.
             let providerChanged = false;
             if (cp.provider && cp.provider !== getCurrentProvider().id) {
                 setProvider(cp.provider);
                 providerChanged = true;
             }
-            if (cp.model && cp.model !== config.get('model')) {
-                config.set('model', cp.model);
+            const cpModel = cp.model && (replacementModelFor(config.get('provider'), cp.model) ?? cp.model);
+            if (cpModel && cpModel !== config.get('model')) {
+                config.set('model', cpModel);
                 providerChanged = true;
             }
+            const movedNote = cpModel !== cp.model ? ` (the checkpoint's \`${cp.model}\` is no longer offered)` : '';
             const lines = [
                 `## Rewound to ${cp.name ? `**${cp.name}**` : `\`${cp.id}\``}`,
                 '',
                 `Restored ${cp.messages.length} message${cp.messages.length === 1 ? '' : 's'} (was ${replacedCount}).`,
-                cp.provider && cp.model ? `Provider: \`${cp.provider}\` · Model: \`${cp.model}\`` : '',
+                cp.provider && cpModel ? `Provider: \`${cp.provider}\` · Model: \`${cpModel}\`${movedNote}` : '',
                 '',
                 buildRewindGitHint(cp),
             ].filter(Boolean);
@@ -1535,12 +1542,35 @@ Anything else the agent should know — edge cases, gotchas, things to double-ch
                             stopIfCancelled();
                         }
                     }
+                    // A raw process.env here handed the repository's own `.git/config`
+                    // back to git: `/commit` runs `git commit`, and a repo-scope
+                    // `gpg.program` that Codeep's own commit path neutralises executed
+                    // through this spawn instead.
+                    //
+                    // Built before the spawn, and caught: shellCommandEnv() refuses a
+                    // git line in a repository whose config names a program no override
+                    // switches off, and a refusal that escaped here would abort the
+                    // whole skill from inside executeSkill's callback. Failing the step
+                    // with the refusal's own wording is what a step that cannot run
+                    // looks like everywhere else in this handler.
+                    let env;
+                    try {
+                        env = shellCommandEnv(shellCmd, session.workspaceRoot);
+                    }
+                    catch (error) {
+                        throw new Error(`\`${shellCmd}\` was not run: ${error instanceof Error ? error.message : String(error)}`);
+                    }
+                    // A command line is the one thing in a skill that can move this
+                    // repository's hooks (`git config core.hooksPath .evil`), and the
+                    // write gate caches where they are for the run.
+                    forgetHooksDirectory();
                     const proc = spawnSync(shellCmd, {
                         cwd: session.workspaceRoot,
                         encoding: 'utf-8',
                         timeout: 60_000,
                         shell: true,
                         stdio: ['pipe', 'pipe', 'pipe'],
+                        env,
                     });
                     const out = ((proc.stdout || '') + (proc.stderr || '')).trim();
                     const block = `\`${shellCmd}\`\n\`\`\`\n${out || '(no output)'}\n\`\`\`\n`;
@@ -1603,7 +1633,11 @@ async function runCommandAgent(task, session, onChunk, abortSignal, agentRun) {
         abortSignal,
         onIteration: (_i, msg) => { onChunk(msg + '\n'); },
         onThinking: (text) => { onChunk(text); },
-        onRequestPermission: agentRun?.onRequestPermission,
+        // Manual mode's dialog, or — in auto mode, where there is none — the
+        // answer that mode gives. Passing nothing would leave the run with no way
+        // to confirm a write to a file that decides what runs later, and the agent
+        // refuses those rather than doing them unasked.
+        onRequestPermission: agentRun?.onRequestPermission ?? agentRun?.onAutoModePermission,
         extraDangerousTools: agentRun?.extraDangerousTools,
         onExecuteCommand: agentRun?.onExecuteCommand,
         fs: agentRun?.fs,

package/dist/acp/server.d.ts

@@ -79,4 +79,17 @@ export declare function exitCodeFromWaitResult(result: unknown): number | null;
  * Exported for unit testing (see server.command.test.ts).
  */
 export declare function executeAcpCommand(command: string, args: string[], cwd: string, ctx: AcpCommandContext): Promise<AcpCommandOutcome>;
+/**
+ * What to tell the user when a prompt fails on authentication, or null when
+ * the failure is about something else.
+ *
+ * Every 401 used to read "No API key configured", key or no key. Kimi Code
+ * answers 401 for its plan limits — no K3 on the plan, K3 past 256K on
+ * Plus/Moderato, High-Speed below Pro/Allegretto, an unknown model id
+ * (kimi.com/code/docs/en/kimi-code/error-reference.html) — so a subscriber with
+ * a perfectly good key was sent to /login when the fix was another model. With
+ * a key configured, a 401 now says what else it can mean and quotes the
+ * provider.
+ */
+export declare function authFailureNotice(err: Error, providerId: string, keyConfigured: boolean): string | null;
 export declare function startAcpServer(transport?: StdioTransport): Promise<void>;

package/dist/acp/server.js

@@ -10,9 +10,10 @@ import { loadCustomCommands } from '../utils/customCommands.js';
 import { registerSessionServers, disposeAllSessions as disposeAllMcpSessions } from '../utils/mcpRegistry.js';
 import { selectSessionMcpServers } from '../utils/mcpConfig.js';
 import { handleMcpSamplingRequest } from '../utils/mcpSamplingBridge.js';
-import { executeCommandAsync, validateCommandAsync } from '../utils/shell.js';
+import { executeCommandAsync, validateCommandAsync, commandEnv } from '../utils/shell.js';
 import { checkCommandRateLimit } from '../utils/ratelimit.js';
 import { recordCommand } from '../utils/history.js';
+import { trustBearingWrite } from '../utils/toolExecution.js';
 import { initWorkspace, loadWorkspace, handleCommand } from './commands.js';
 import { beginTurn } from './turns.js';
 import { handleSetMode as handleSetModeExternal, handleSetConfigOption as handleSetConfigOptionExternal, handleSessionList as handleSessionListExternal, handleSessionDelete as handleSessionDeleteExternal, handleListProviders as handleListProvidersExternal, } from './serverHandlers.js';
@@ -421,6 +422,158 @@ export function exitCodeFromWaitResult(result) {
         return 1;
     return null;
 }
+/**
+ * `GIT_CONFIG_COUNT` and the `GIT_CONFIG_KEY_<n>` / `GIT_CONFIG_VALUE_<n>`
+ * pairs it counts — the numbered half of what hardenedGitEnv() produces.
+ */
+const GIT_CONFIG_ENV_NAME = /^GIT_CONFIG_(?:COUNT|KEY_\d+|VALUE_\d+)$/;
+/**
+ * The rest of what the terminal has to be given by name — see acpEnvList().
+ *
+ * `GIT_PAGER` and `GIT_TERMINAL_PROMPT` are hardenedGitEnv()'s two
+ * non-numbered outputs. `GIT_CONFIG_GLOBAL` / `GIT_CONFIG_SYSTEM` /
+ * `GIT_CONFIG_NOSYSTEM` are the variables the SCAN itself read the config
+ * through: leaving them behind would let the terminal's git resolve a
+ * different global config than the one Codeep just decided was safe.
+ *
+ * Everything after them is there for a client that REPLACES its environment
+ * with this list rather than extending it, and it is the half the first cut
+ * of this hotfix got wrong: the list was `PATH` and `HOME` — enough for the
+ * hardened `git status` it was written for — while acpEnvList() is applied
+ * to EVERY command handed to terminal/create. Against a replacing client
+ * that cost an ordinary command things that are not secrets and that it had
+ * in the user's own shell: `git push` over SSH had no agent socket to sign
+ * with and fell back to asking for a password on a terminal whose
+ * GIT_TERMINAL_PROMPT is `0`, which fails it outright; a test that sorts
+ * strings or formats a date ran under the C locale instead of the user's; a
+ * build had nowhere but the default /tmp to put its temporaries; anything
+ * behind a corporate proxy could not reach the network at all; and a
+ * toolchain installed under a version manager lost the variable its shim
+ * reads to pick a version.
+ *
+ * It stays an ALLOWLIST rather than becoming "process.env minus the names
+ * that look like credentials", because what made the change necessary is
+ * that `env` is not a private channel (see acpEnvList) and a name-shaped
+ * denylist does not recognise `DATABASE_URL`, a company's own `ACME_CREDS`,
+ * or anything else whose name does not say what it holds. A name gets in
+ * here only when it is known not to hold one.
+ *
+ * The one value below that CAN carry a credential is a proxy URL
+ * (`https_proxy=http://user:pass@proxy`), which is why redactCredentials()
+ * in src/acp/transport.ts has a rule for that exact shape. A command behind
+ * a proxy cannot reach the network without it.
+ */
+const ACP_TERMINAL_ENV_NAMES = new Set([
+    // hardenedGitEnv()'s own, and what the scan read the config through.
+    'GIT_PAGER',
+    'GIT_TERMINAL_PROMPT',
+    'GIT_CONFIG_GLOBAL',
+    'GIT_CONFIG_SYSTEM',
+    'GIT_CONFIG_NOSYSTEM',
+    // Where programs are found, and whose account runs them. No `PWD`: the
+    // terminal's working directory is the `cwd` of the terminal/create, and
+    // this process's would tell a shell script it is somewhere it is not.
+    'PATH',
+    'HOME',
+    'SHELL',
+    'USER',
+    'LOGNAME',
+    // The agent socket `git push` and `git fetch` over SSH sign with.
+    'SSH_AUTH_SOCK',
+    // Where a build puts its temporaries.
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    // The locale a test that sorts strings or formats a date asserts against.
+    'LANG',
+    'LANGUAGE',
+    // What the command may draw with, and what it thinks the time is.
+    'TERM',
+    'COLORTERM',
+    'TERM_PROGRAM',
+    'TZ',
+    // Toolchains under a version manager: the shim is on PATH, but the shim
+    // reads one of these to find the version to run.
+    'ASDF_DIR',
+    'ASDF_DATA_DIR',
+    'NVM_DIR',
+    'NVM_BIN',
+    'PYENV_ROOT',
+    'RBENV_ROOT',
+    'SDKMAN_DIR',
+    'VOLTA_HOME',
+    'PNPM_HOME',
+    'BUN_INSTALL',
+    'VIRTUAL_ENV',
+    'CONDA_PREFIX',
+    'CARGO_HOME',
+    'RUSTUP_HOME',
+    'GOPATH',
+    'GOROOT',
+    'JAVA_HOME',
+]);
+/**
+ * The same allowlist for the two families whose members cannot be listed:
+ * the locale categories (`LC_ALL`, `LC_TIME`, `LC_COLLATE`, …), and the
+ * proxy variables, which every tool spells in whichever case it was written
+ * in — curl and most of Unix read the lowercase ones, Windows-born tools the
+ * uppercase, and a machine behind a proxy usually sets both.
+ */
+const ACP_TERMINAL_ENV_FAMILY = /^(?:LC_[A-Z]+|(?:HTTP|HTTPS|FTP|ALL|NO)_PROXY|(?:http|https|ftp|all|no)_proxy)$/;
+/**
+ * An environment in the shape `terminal/create` takes it: ACP spells it as a
+ * list of `{ name, value }`, not as the map Node keeps in `process.env`.
+ *
+ * An allowlist goes in it — the hardening's own variables and the shell
+ * essentials above — and not the WHOLE of `process.env`, which is what this
+ * used to serialise. `env` is not a private channel: src/acp/transport.ts
+ * mirrors every outbound frame verbatim into ~/.cache/codeep/acp-debug.log
+ * when CODEEP_ACP_DEBUG is set, so every `ANTHROPIC_API_KEY`,
+ * `GITHUB_TOKEN`, `AWS_SECRET_ACCESS_KEY` and session cookie in the user's
+ * shell was written to a plaintext file on disk — and handed to the editor,
+ * which is free to log the protocol traffic itself. None of them makes the
+ * hardening work; the numbered GIT_CONFIG_* pairs do.
+ *
+ * What else the terminal inherits is the CLIENT's decision, not ours: ACP
+ * does not say whether `env` extends the client's environment or replaces it.
+ * A client that extends gives the command the user's shell environment
+ * anyway; a client that replaces gives it only this list — which is why the
+ * list has to cover what an ORDINARY command needs to run at all and not
+ * only what a hardened git spawn does. A terminal that got `GIT_CONFIG_COUNT`
+ * and nothing else would be running without a PATH.
+ *
+ * Unset variables are dropped rather than sent as `value: undefined` — that
+ * is what `process.env` holds for a variable that is not set, and JSON has no
+ * way to carry it.
+ *
+ * `hardened` says whether commandEnv() actually hardened this spawn, which it
+ * does for `git` and for nothing else. It only decides the last entry below:
+ * a command that cannot reach git is left with the environment it would have
+ * had, which is the same line the refusal path draws.
+ */
+function acpEnvList(env, hardened) {
+    const list = Object.entries(env)
+        .filter((entry) => typeof entry[1] === 'string')
+        .filter(([name]) => ACP_TERMINAL_ENV_NAMES.has(name)
+        || ACP_TERMINAL_ENV_FAMILY.test(name)
+        || GIT_CONFIG_ENV_NAME.test(name))
+        .map(([name, value]) => ({ name, value }));
+    // The one thing this list cannot express is a REMOVAL — an absent name is
+    // not a request to unset one — and hardenedGitEnv() removes exactly one
+    // variable, so it is sent EMPTY instead.
+    //
+    // `GIT_CONFIG_PARAMETERS` is read after the numbered `GIT_CONFIG_*` pairs
+    // and beats them: with `GIT_CONFIG_KEY_0=core.fsmonitor` and an empty value
+    // right there, a `GIT_CONFIG_PARAMETERS='core.fsmonitor=<program>'` still
+    // ran the program on `git status` (verified, git 2.54). So against a client
+    // that EXTENDS its own environment rather than replacing it, one variable
+    // the editor happened to inherit switched this whole hardening off. Git
+    // parses an empty value as no parameters at all (verified, same version),
+    // which is the unset this list has no other way to ask for.
+    if (hardened)
+        list.push({ name: 'GIT_CONFIG_PARAMETERS', value: '' });
+    return list;
+}
 /**
  * Run an execute_command tool call for an ACP session, in the client's
  * terminal when it offers one, otherwise locally.
@@ -461,6 +614,33 @@ export async function executeAcpCommand(command, args, cwd, ctx) {
     // capability in initialize. Otherwise execute locally.
     if (!ctx.clientSupportsTerminal)
         return runLocally();
+    // The client's terminal is a spawn like any other, and it inherits none of
+    // the hardening executeCommandAsync puts on the local one — so over ACP,
+    // which is how Zed runs Codeep, a `git status` in a hostile repository ran
+    // that repository's `core.fsmonitor` and `filter.<d>.clean` exactly as it
+    // did before this hotfix. The validation above stops the argv forms that
+    // redirect git, but nothing was stopping its config.
+    //
+    // Same helper as the local runner, so there is one answer to "what does a
+    // spawn that may reach git run with" — see commandEnv(). A refusal fails
+    // the command with git's own wording rather than handing it to a terminal
+    // this process cannot harden.
+    //
+    // commandEnv() and NOT shellCommandEnv(): this call site has the argv, and
+    // shellCommandEnv() can only scan the spawn's `cwd`. That made one argument
+    // the whole difference between the two runners — `git -C vendor/lib status`
+    // over ACP got the outer project scanned, so the nested checkout was left
+    // with only the always-on GIT_EXECUTING_CONFIG pairs behind it and its
+    // `filter.<driver>.clean` still ran (proven, git 2.54), while the same
+    // command locally reads `-C` out of the argv and scans where git will
+    // actually run.
+    let env;
+    try {
+        env = commandEnv(command, args, cwd);
+    }
+    catch (error) {
+        return fail(error instanceof Error ? error.message : String(error));
+    }
     const { transport, sessionId, signal } = ctx;
     let terminalId;
     try {
@@ -469,6 +649,7 @@ export async function executeAcpCommand(command, args, cwd, ctx) {
             command,
             args,
             cwd,
+            env: acpEnvList(env, command === 'git'),
             outputByteLimit: 1_000_000,
         });
         if (!created || typeof created.terminalId !== 'string') {
@@ -547,6 +728,43 @@ function persistSessionHistory(session) {
         return;
     saveSession(session.codeepSessionId, session.history, session.workspaceRoot);
 }
+/** The provider's own words from an `API error: 401 - …` message, if any. */
+function providerErrorDetail(message) {
+    const body = message.replace(/^[\s\S]*?\b401\s*-\s*/, '').trim();
+    let detail = body;
+    try {
+        const json = JSON.parse(body);
+        detail = json?.error?.message ?? json?.message ?? body;
+    }
+    catch {
+        // Not JSON — the text is the detail.
+    }
+    const text = String(detail).trim();
+    return text.length > 300 ? `${text.slice(0, 300)}…` : text;
+}
+/**
+ * What to tell the user when a prompt fails on authentication, or null when
+ * the failure is about something else.
+ *
+ * Every 401 used to read "No API key configured", key or no key. Kimi Code
+ * answers 401 for its plan limits — no K3 on the plan, K3 past 256K on
+ * Plus/Moderato, High-Speed below Pro/Allegretto, an unknown model id
+ * (kimi.com/code/docs/en/kimi-code/error-reference.html) — so a subscriber with
+ * a perfectly good key was sent to /login when the fix was another model. With
+ * a key configured, a 401 now says what else it can mean and quotes the
+ * provider.
+ */
+export function authFailureNotice(err, providerId, keyConfigured) {
+    const is401 = err instanceof ApiError && err.status === 401;
+    if (!is401 && !err.message?.includes('API key'))
+        return null;
+    if (is401 && keyConfigured) {
+        const name = PROVIDERS[providerId]?.name ?? providerId;
+        const detail = providerErrorDetail(err.message ?? '');
+        return `❌ ${name} refused the request (401)${detail ? `: ${detail}` : ''}. A key is configured, so this is not a missing key: the key may be invalid or revoked, or your plan may not include this model or limit (Kimi Code, for one, answers 401 when a plan lacks K3, K3's 1M context or High-Speed). Pick another model with /model, or re-enter the key with /login.`;
+    }
+    return `❌ No API key configured. Use /login <provider> <key> or set the environment variable (e.g. ZAI_API_KEY, ANTHROPIC_API_KEY).`;
+}
 export function startAcpServer(transport = new StdioTransport()) {
     // ACP sessionId → full AcpSession (includes history + codeep session tracking)
     const sessions = new Map();
@@ -1186,6 +1404,11 @@ export function startAcpServer(transport = new StdioTransport()) {
                 },
             });
         };
+        // Read when the prompt fails, not now: /login during the turn counts.
+        const authNotice = (err) => {
+            const providerId = config.get('provider');
+            return authFailureNotice(err, providerId, Boolean(getApiKey(providerId)));
+        };
         // Ask the user through the client. A person answers this: wait as long
         // as the dialog is open. Only cancelling the prompt stops the wait. No
         // answer (error, cancelled prompt, a reply without an outcome) is null,
@@ -1205,6 +1428,55 @@ export function startAcpServer(transport = new StdioTransport()) {
         // run the agent (/go, custom commands, skill agent steps) run it exactly
         // like a plain prompt.
         const manualMode = session.currentModeId === 'manual';
+        // The one permission dialog this session puts in front of the user.
+        const askAboutToolCall = async (toolCall, 
+        // What the agent gate already worked out about this call. Passed rather
+        // than worked out again: trustBearingWrite() stats the path, resolves a
+        // symlinked ancestor and may ask git where this repository keeps its
+        // hooks. `null` is an answer ("writes no such file"); undefined means
+        // the question came from somewhere that has not looked, which is the
+        // only case that pays for the lookup here.
+        known) => {
+            // A write to a file that decides what runs later says so in the
+            // dialog — the editor shows `toolInput`, and "this file controls what
+            // commands git runs" is the part that makes the answer an informed one.
+            const trustBearing = known !== undefined ? known : trustBearingWrite(toolCall, session.workspaceRoot);
+            const result = await askUser({
+                toolCallId: `perm_${randomUUID()}`,
+                toolName: toolCall.tool,
+                toolInput: {
+                    ...formatToolInputForPermission(toolCall.tool, toolCall.parameters),
+                    ...(trustBearing ? { warning: trustBearing.reason } : {}),
+                },
+                status: 'pending',
+                content: [],
+            }, [
+                { optionId: 'allow_once', name: 'Allow once', kind: 'allow_once' },
+                // No "always" for one of those files: the agent answers about this
+                // file only and would not remember the answer anyway.
+                ...(trustBearing ? [] : [{ optionId: 'allow_always', name: 'Allow always', kind: 'allow_always' }]),
+                { optionId: 'reject_once', name: 'Reject once', kind: 'reject_once' },
+                { optionId: 'reject_always', name: 'Reject always', kind: 'reject_always' },
+            ]);
+            // Map ACP outcome back to PermissionOutcome. No answer
+            // (error, cancelled prompt) denies.
+            if (!result || result.outcome.type === 'cancelled')
+                return 'reject_once';
+            return result.outcome.optionId;
+        };
+        // Auto mode's answer to the agent's permission gate: yes to everything
+        // except a write to a file that decides what runs later, which is asked
+        // about in every mode. Without it the agent would have to refuse those
+        // writes outright, having nobody to ask. It travels under its own key on
+        // `agentRun` and never as `onRequestPermission`: a slash command reads
+        // that key being set as "this session asks the user" (see
+        // acp/commands.ts), and auto mode still runs a skill's shell lines
+        // without asking, as it promises.
+        const autoModeAnswer = async (toolCall, known) => {
+            const trustBearing = known !== undefined ? known : trustBearingWrite(toolCall, session.workspaceRoot);
+            // Handed on, so the dialog does not look the same file up a third time.
+            return trustBearing ? askAboutToolCall(toolCall, trustBearing) : 'allow_once';
+        };
         const agentRun = {
             // Manual mode gates write_file/edit_file for this run only, per call —
             // NOT by mutating the global `agentConfirmWriteFile` config, which
@@ -1212,27 +1484,11 @@ export function startAcpServer(transport = new StdioTransport()) {
             // a non-atomic restore.
             extraDangerousTools: manualMode ? ['write_file', 'edit_file'] : undefined,
             // Only request permission in Manual mode
-            onRequestPermission: manualMode
-                ? async (toolCall) => {
-                    const result = await askUser({
-                        toolCallId: `perm_${randomUUID()}`,
-                        toolName: toolCall.tool,
-                        toolInput: formatToolInputForPermission(toolCall.tool, toolCall.parameters),
-                        status: 'pending',
-                        content: [],
-                    }, [
-                        { optionId: 'allow_once', name: 'Allow once', kind: 'allow_once' },
-                        { optionId: 'allow_always', name: 'Allow always', kind: 'allow_always' },
-                        { optionId: 'reject_once', name: 'Reject once', kind: 'reject_once' },
-                        { optionId: 'reject_always', name: 'Reject always', kind: 'reject_always' },
-                    ]);
-                    // Map ACP outcome back to PermissionOutcome. No answer
-                    // (error, cancelled prompt) denies.
-                    if (!result || result.outcome.type === 'cancelled')
-                        return 'reject_once';
-                    return result.outcome.optionId;
-                }
-                : undefined,
+            onRequestPermission: manualMode ? askAboutToolCall : undefined,
+            // …and in auto mode, the answer a command that runs the agent uses in
+            // its place, so /go and a skill's agent step get the same one prompt a
+            // plain prompt gets instead of a refusal.
+            onAutoModePermission: manualMode ? undefined : autoModeAnswer,
             // A skill's confirm step ("Deploy to production?") — a one-off
             // question, so no "always" answers.
             confirm: manualMode
@@ -1395,7 +1651,7 @@ export function startAcpServer(transport = new StdioTransport()) {
                             }
                         }
                     },
-                    onRequestPermission: agentRun.onRequestPermission,
+                    onRequestPermission: agentRun.onRequestPermission ?? agentRun.onAutoModePermission,
                     extraDangerousTools: agentRun.extraDangerousTools,
                     fs: agentRun.fs,
                     onExecuteCommand: agentRun.onExecuteCommand,
@@ -1460,8 +1716,8 @@ export function startAcpServer(transport = new StdioTransport()) {
                         }
                         transport.respond(msg.id, { stopReason: 'cancelled' });
                     }
-                    else if (err.message?.includes('API key not configured') || err.message?.includes('API key') || (err instanceof ApiError && err.status === 401)) {
-                        sendChunk(`❌ No API key configured. Use /login <provider> <key> or set the environment variable (e.g. ZAI_API_KEY, ANTHROPIC_API_KEY).`);
+                    else if (authNotice(err)) {
+                        sendChunk(authNotice(err));
                         transport.respond(msg.id, { stopReason: 'end_turn' });
                     }
                     else if (err instanceof ApiError && err.status >= 500) {
@@ -1482,8 +1738,8 @@ export function startAcpServer(transport = new StdioTransport()) {
                 if (err.name === 'AbortError' || abortController.signal.aborted) {
                     transport.respond(msg.id, { stopReason: 'cancelled' });
                 }
-                else if (err.message?.includes('API key not configured') || err.message?.includes('API key') || (err instanceof ApiError && err.status === 401)) {
-                    sendChunk(`❌ No API key configured. Use /login <provider> <key> or set the environment variable (e.g. ZAI_API_KEY, ANTHROPIC_API_KEY).`);
+                else if (authNotice(err)) {
+                    sendChunk(authNotice(err));
                     transport.respond(msg.id, { stopReason: 'end_turn' });
                 }
                 else if (err instanceof ApiError && err.status >= 500) {

package/dist/acp/serverHandlers.js

@@ -17,6 +17,7 @@
 // is "look up the session, mutate config or session state, acknowledge".
 import { AGENT_MODES, buildConfigOptions } from './server.js';
 import { config, setProvider, setApiKey, listSessionsWithInfo, deleteSession as deleteSessionFile, } from '../config/index.js';
+import { replacementModelFor } from '../config/providers.js';
 import { disposeSession as disposeMcpSession } from '../utils/mcpRegistry.js';
 import { clearPendingPlan } from '../utils/planMode.js';
 // ─── session/set_mode ─────────────────────────────────────────────────────────
@@ -99,17 +100,16 @@ export function handleSetConfigOption(msg, deps) {
  */
 export function applyConfigOption(configId, value) {
     if (configId === 'model' && typeof value === 'string') {
-        // value is "providerId/modelId" — split and switch both
+        // value is "providerId/modelId" — split and switch both. An editor setting
+        // pinned before a retirement (`openai/gpt-6-astra`) names an id the picker
+        // no longer has, so the model goes through the same map as a stored config,
+        // looked up on the provider actually active: setProvider refuses an unknown
+        // id and leaves the old one in place.
         const slashIdx = value.indexOf('/');
-        if (slashIdx !== -1) {
-            const providerId = value.slice(0, slashIdx);
-            const modelId = value.slice(slashIdx + 1);
-            setProvider(providerId); // sets provider + defaultModel + protocol
-            config.set('model', modelId);
-        }
-        else {
-            config.set('model', value);
-        }
+        const modelId = slashIdx !== -1 ? value.slice(slashIdx + 1) : value;
+        if (slashIdx !== -1)
+            setProvider(value.slice(0, slashIdx)); // sets provider + defaultModel + protocol
+        config.set('model', replacementModelFor(config.get('provider'), modelId) ?? modelId);
     }
     else if (configId === 'provider' && typeof value === 'string') {
         // Switch provider without specifying a model — picks the provider's

package/dist/acp/session.d.ts

@@ -1,7 +1,7 @@
 import { PermissionOutcome } from '../utils/agent.js';
 import { ProjectContext } from '../utils/project.js';
 import { ToolCall } from '../utils/tools.js';
-import type { FsCallbacks } from '../utils/toolExecution.js';
+import type { FsCallbacks, TrustBearingWrite } from '../utils/toolExecution.js';
 import type { Message } from '../config/index.js';
 export interface AgentSessionOptions {
     prompt: string;
@@ -11,7 +11,18 @@ export interface AgentSessionOptions {
     onChunk: (text: string) => void;
     onThought?: (text: string) => void;
     onToolCall?: (toolCallId: string, toolName: string, kind: string, title: string, status: 'pending' | 'running' | 'finished' | 'error', locations?: string[], rawOutput?: string) => void;
-    onRequestPermission?: (toolCall: ToolCall) => Promise<PermissionOutcome>;
+    /**
+     * Ask the user about one tool call. Handed straight to runAgent, so the
+     * signature is runAgent's: `trustBearing` is what the agent's own gate
+     * already worked out about the call — the file it would write that decides
+     * what runs later, or null when it writes no such file — and the dialog
+     * words itself from that instead of resolving the path a second time.
+     *
+     * Declared with one parameter, this type said the second argument did not
+     * exist while runAgent passed it on every call, so the one caller that
+     * needs it had to cast its way back to the truth.
+     */
+    onRequestPermission?: (toolCall: ToolCall, trustBearing?: TrustBearingWrite | null) => Promise<PermissionOutcome>;
     /** Tools to force into the per-run dangerous set (ACP manual mode). */
     extraDangerousTools?: string[];
     onExecuteCommand?: (command: string, args: string[], cwd: string) => Promise<{

package/dist/acp/transport.d.ts

@@ -1,4 +1,10 @@
 import { JsonRpcRequest, JsonRpcResponse, JsonRpcNotification } from './protocol.js';
+/**
+ * A frame with its obvious credentials blanked.
+ *
+ * Exported for unit testing (see transport.test.ts).
+ */
+export declare function redactCredentials(frame: string): string;
 type MessageHandler = (msg: JsonRpcRequest | JsonRpcNotification) => void | Promise<unknown>;
 export interface RequestOptions {
     /**