@gajae-code/coding-agent 0.10.2 → 0.11.1

package/src/gjc-runtime/ultragoal-runtime.ts

@@ -9,6 +9,7 @@ import { DEFAULT_ULTRAGOAL_OBJECTIVE } from "./goal-mode-request";
 import {
 	computeUltragoalPlanGeneration,
 	findFreshBatchCloseReceipt,
+	findLedgerReceiptEvent,
 	requiredUltragoalGoals,
 	validateDeferredMemberReceiptFresh,
 	validateReceiptFreshBase,
@@ -572,16 +573,32 @@ async function writePlan(cwd: string, plan: UltragoalPlan, sessionId?: string |
 
 function chooseReceiptKind(
 	plan: UltragoalPlan,
+	ledger: readonly UltragoalLedgerEvent[],
 	goal: UltragoalGoal,
 	status: UltragoalGoalStatus,
 ): UltragoalReceiptKind {
 	if (plan.gjcGoalMode === "per-story") return "per-goal";
 	if (status !== "complete") return "per-goal";
+	// A non-final validation-batch member must always carry a per-goal
+	// deferred receipt; only the batch's final goal may close the batch and
+	// (in aggregate mode) carry the final-aggregate receipt. Without this, a
+	// context-stale re-verification replay of a member could mint an invalid
+	// final-aggregate receipt with validationBatch.role "deferred-member".
+	if (goal.validationBatch && goal.validationBatch.finalGoalId !== goal.id) return "per-goal";
 	const requiredGoals = requiredUltragoalGoals(plan);
-	const existingFinalAggregateGoal = requiredGoals.find(
-		item => item.id !== goal.id && item.completionVerification?.receiptKind === "final-aggregate",
-	);
-	if (existingFinalAggregateGoal) return "per-goal";
+	// Only a still-fresh final-aggregate receipt on another goal defers this
+	// checkpoint to per-goal. A stale one (e.g. staled by `steer add_subgoal`
+	// appending goals after a terminal run) must not suppress re-minting,
+	// otherwise the run can never regain a verifiable final-aggregate receipt:
+	// the completion guard demands a fresh final-aggregate receipt while this
+	// gate would keep answering per-goal forever.
+	const existingFreshFinalAggregateGoal = requiredGoals.find(item => {
+		if (item.id === goal.id) return false;
+		const receipt = item.completionVerification;
+		if (receipt?.receiptKind !== "final-aggregate") return false;
+		return validateReceiptFreshBase({ plan, ledger, goal: item, receipt, receiptKind: "final-aggregate" }) === null;
+	});
+	if (existingFreshFinalAggregateGoal) return "per-goal";
 	const unfinishedRequiredGoals = requiredGoals.filter(
 		item => item.id !== goal.id && !TERMINAL_OR_SKIPPED_STATUSES.has(item.status),
 	);
@@ -3451,7 +3468,12 @@ function canonicalChangeSetRows(value: unknown, fieldName: string): UltragoalCha
 		if ("goalId" in record) throw new Error(`${fieldName}[${index}] must not contain goalId attribution`);
 		const status = nonEmptyString(record.status);
 		if (!status) throw new Error(`${fieldName}[${index}].status is required`);
-		return { path: normalizeRepoPath(pathValue), status: status as UltragoalChangeStatus };
+		const oldPath = nonEmptyString(record.oldPath);
+		return {
+			path: normalizeRepoPath(pathValue),
+			status: status as UltragoalChangeStatus,
+			...(oldPath ? { oldPath: normalizeRepoPath(oldPath) } : {}),
+		};
 	});
 }
 
@@ -3711,6 +3733,140 @@ function validateBatchCloseQualityGate(
 		throw new Error("validationBatchClose.unionChangeSet.unionHash does not match declared union");
 	requireNonEmptyString(close.coverageEvidence, "validationBatchClose.coverageEvidence");
 }
+
+function hydrateReviewedBatchReplacementClose(input: {
+	gate: JsonObject;
+	plan: UltragoalPlan;
+	goal: UltragoalGoal;
+	metadata: UltragoalValidationBatchMetadata;
+	ledger: readonly UltragoalLedgerEvent[];
+	changeSet?: UltragoalChangeSet;
+}): JsonObject {
+	const requested = qualityGateObject(input.gate.validationBatchClose);
+	if (requested?.kind !== "review-blocker-replacement-close") return input.gate;
+	const expectedKeys = new Set(["schemaVersion", "kind", "replacementGoalId", "coverageEvidence"]);
+	if (Object.keys(requested).some(key => !expectedKeys.has(key)))
+		throw new Error("review-blocker replacement close contains unsupported fields");
+	const replacementGoalId = nonEmptyString(requested.replacementGoalId);
+	const coverageEvidence = nonEmptyString(requested.coverageEvidence);
+	if (requested.schemaVersion !== 1 || !replacementGoalId || !coverageEvidence)
+		throw new Error("review-blocker replacement close is malformed");
+	if (input.goal.status !== "active" || input.metadata.finalGoalId !== input.goal.id)
+		throw new Error("review-blocker replacement close requires the active durable validation-batch final goal");
+	if (!input.changeSet) throw new Error("review-blocker replacement close requires a current cumulative change set");
+
+	const replacements = input.plan.goals.filter(
+		goal => goal.steering?.kind === "review_blocker" && goal.steering.blockedGoalId === input.goal.id,
+	);
+	if (replacements.length !== 1 || replacements[0]?.id !== replacementGoalId)
+		throw new Error("review-blocker replacement close requires exactly the declared replacement");
+	const replacement = replacements[0]!;
+	const replacementReceipt = replacement.completionVerification;
+	if (replacement.status !== "complete" || replacementReceipt?.receiptKind !== "per-goal")
+		throw new Error("review-blocker replacement close requires a completed per-goal replacement receipt");
+	const replacementDiagnostic = validateReceiptFreshBase({
+		plan: input.plan,
+		ledger: input.ledger,
+		goal: replacement,
+		receipt: replacementReceipt,
+		receiptKind: "per-goal",
+	});
+	if (replacementDiagnostic) throw new Error(`review-blocker replacement close ${replacementDiagnostic.message}`);
+	const replacementCheckpointIndex = input.ledger.findIndex(
+		event => event.eventId === replacementReceipt.checkpointLedgerEventId,
+	);
+	const reviewRecordedIndex = input.ledger.findIndex(
+		event =>
+			event.event === "review_blockers_recorded" &&
+			event.goalId === input.goal.id &&
+			event.blockerGoalId === replacement.id,
+	);
+	const reactivatedIndex = input.ledger.findIndex(
+		(event, index) =>
+			index > replacementCheckpointIndex &&
+			event.event === "goal_checkpointed" &&
+			event.goalId === input.goal.id &&
+			event.status === "active",
+	);
+	if (reviewRecordedIndex < 0 || reviewRecordedIndex >= replacementCheckpointIndex || reactivatedIndex < 0)
+		throw new Error("review-blocker replacement close lacks durable supersession and reopening evidence");
+
+	const historicalRequiredGoalIds = input.plan.goals
+		.filter(goal => goal.id !== input.goal.id && goal.status !== "superseded")
+		.map(goal => goal.id);
+	const aggregateGoals = input.plan.goals.filter(goal => {
+		const receipt = goal.completionVerification;
+		return goal.status === "complete" && receipt?.receiptKind === "final-aggregate";
+	});
+	const aggregateGoal = aggregateGoals.find(goal => {
+		const receipt = goal.completionVerification!;
+		const event = findLedgerReceiptEvent(input.ledger, receipt);
+		return (
+			event !== null &&
+			hashStructuredValue(event.qualityGateJson) === receipt.qualityGateHash &&
+			goal.updatedAt === receipt.verifiedAt &&
+			receipt.basis.relevantGoalIdsBeforeCheckpoint.length === historicalRequiredGoalIds.length &&
+			receipt.basis.relevantGoalIdsBeforeCheckpoint.every(
+				(goalId, index) => goalId === historicalRequiredGoalIds[index],
+			)
+		);
+	});
+	if (!aggregateGoal)
+		throw new Error(
+			"review-blocker replacement close requires a fresh final-aggregate receipt covering required goals",
+		);
+
+	const memberMetadataHashes: Record<string, string> = {};
+	const memberChangeSetHashes: Record<string, string> = {};
+	const memberReceipts: JsonObject[] = [];
+	for (const memberId of input.metadata.memberIds) {
+		const member = input.plan.goals.find(goal => goal.id === memberId);
+		if (!member?.validationBatch)
+			throw new Error(`review-blocker replacement close references missing batch member ${memberId}`);
+		memberMetadataHashes[memberId] = member.validationBatch.metadataHash;
+		if (memberId === input.goal.id) continue;
+		const receipt = requireDeferredMemberReceiptFresh(
+			input.plan,
+			input.ledger,
+			member,
+			"review-blocker replacement close",
+		);
+		memberChangeSetHashes[memberId] = receipt.validationBatch.changeSetHash;
+		memberReceipts.push({
+			goalId: memberId,
+			receiptId: receipt.receiptId,
+			checkpointLedgerEventId: receipt.checkpointLedgerEventId,
+			qualityGateHash: receipt.qualityGateHash,
+			changeSetHash: receipt.validationBatch.changeSetHash,
+			role: "deferred-member",
+		});
+	}
+	const paths = input.changeSet.paths.map(row => ({ ...row }));
+	memberChangeSetHashes[input.goal.id] = changeSetHashForPaths(paths);
+	const unionHash = hashStructuredValue({
+		memberChangeSetHashes,
+		paths: paths.map(row => ({ path: row.path, status: row.status, oldPath: row.oldPath })),
+	});
+	return {
+		...input.gate,
+		validationBatchClose: {
+			schemaVersion: 1,
+			kind: "validation-batch-close",
+			batchId: input.metadata.batchId,
+			finalGoalId: input.metadata.finalGoalId,
+			memberIds: [...input.metadata.memberIds],
+			memberMetadataHashes,
+			memberReceipts,
+			unionChangeSet: {
+				source: "validation-batch",
+				memberChangeSetHashes,
+				paths,
+				unionHash,
+			},
+			coverageEvidence,
+		},
+	};
+}
 async function readRequiredCompletionQualityGate(
 	cwd: string,
 	value: string | undefined,
@@ -3729,13 +3885,25 @@ async function readRequiredCompletionQualityGate(
 	const gate = await readStructuredValue(cwd, value);
 	const gateObject = qualityGateObject(gate);
 	if (!gateObject) throw new Error("qualityGate must be a JSON object");
-	await validateCompletionQualityGate(cwd, gateObject, {
+	const validationBatch = options.goal ? requireFreshValidationBatchMetadata(options.goal) : undefined;
+	const hydratedGate =
+		validationBatch && options.plan && options.goal && options.ledger
+			? hydrateReviewedBatchReplacementClose({
+					gate: gateObject,
+					plan: options.plan,
+					goal: options.goal,
+					metadata: validationBatch,
+					ledger: options.ledger,
+					changeSet: options.changeSet,
+				})
+			: gateObject;
+	await validateCompletionQualityGate(cwd, hydratedGate, {
 		changeSet: options.changeSet,
 		plan: options.plan,
 		goal: options.goal,
 		ledger: options.ledger,
 	});
-	return gate;
+	return hydratedGate;
 }
 
 function validatePipelineCheckpointSafety(
@@ -3812,13 +3980,21 @@ export async function checkpointUltragoalGoal(input: {
 	const evidence = input.evidence.trim();
 	if (!evidence) throw new Error("checkpoint evidence is required");
 	const ledgerBefore = await readUltragoalLedger(input.cwd);
-	const matchingIdempotentEvent = ledgerBefore.find(
+	const matchingIdempotentEvents = ledgerBefore.filter(
 		event =>
 			event.event === "goal_checkpointed" &&
 			event.goalId === goal.id &&
 			event.status === input.status &&
 			event.evidence === evidence,
 	);
+	// Re-verification replays legitimately append repeated same-status,
+	// same-evidence checkpoint events for one goal. The recorded receipt must
+	// be compared against ITS OWN checkpoint event — resolved by the receipt's
+	// checkpointLedgerEventId, falling back to the latest match — never the
+	// oldest duplicate, which would wrongly report the current receipt stale.
+	const matchingIdempotentEvent =
+		matchingIdempotentEvents.find(event => event.eventId === goal.completionVerification?.checkpointLedgerEventId) ??
+		matchingIdempotentEvents.at(-1);
 	const batchMetadata = input.status === "complete" ? requireFreshValidationBatchMetadata(goal) : undefined;
 	if (batchMetadata && goal.completionVerification?.validationBatch) {
 		const receiptBatch = goal.completionVerification.validationBatch;
@@ -3835,7 +4011,35 @@ export async function checkpointUltragoalGoal(input: {
 	if (input.status === "complete" && goal.completionVerification?.validationBatch && !batchMetadata) {
 		throw new Error(`Goal ${goal.id} has stale validation batch completion receipt`);
 	}
-	if (goal.status === input.status && goal.evidence === evidence && matchingIdempotentEvent) {
+	// An identical-evidence complete replay is only a no-op while the recorded
+	// receipt still validates fresh. When the goal row itself is untouched
+	// (updatedAt still matches the receipt's verifiedAt) but later goal-tagged
+	// ledger events (e.g. blocker classifications) or plan growth staled the
+	// receipt, the replay is a genuine re-verification: it must run the full
+	// quality gate and mint a fresh receipt, otherwise a completed goal with a
+	// context-staled receipt can never be repaired (different evidence is
+	// rejected on complete goals by design). A mutated goal row keeps the
+	// fail-loud tamper handling in the idempotent branch below.
+	const staleCompleteReceiptReplay =
+		input.status === "complete" &&
+		goal.status === "complete" &&
+		goal.evidence === evidence &&
+		Boolean(matchingIdempotentEvent) &&
+		(!goal.completionVerification ||
+			(goal.completionVerification.verifiedAt === goal.updatedAt &&
+				validateReceiptFreshBase({
+					plan,
+					ledger: ledgerBefore,
+					goal,
+					receipt: goal.completionVerification,
+					receiptKind: goal.completionVerification.receiptKind,
+				}) !== null));
+	if (
+		goal.status === input.status &&
+		goal.evidence === evidence &&
+		matchingIdempotentEvent &&
+		!staleCompleteReceiptReplay
+	) {
 		if (batchMetadata) {
 			const receipt = goal.completionVerification;
 			const receiptBatch = receipt?.validationBatch;
@@ -3857,6 +4061,18 @@ export async function checkpointUltragoalGoal(input: {
 			)
 				throw new Error(`Goal ${goal.id} has stale validation batch metadata hash in close receipt`);
 		}
+		// A complete goal whose row changed after its receipt was verified is
+		// neither a clean no-op nor a repairable context-stale replay: fail loud
+		// instead of silently laundering a tampered/inconsistent durable row.
+		if (
+			input.status === "complete" &&
+			goal.completionVerification &&
+			goal.completionVerification.verifiedAt !== goal.updatedAt
+		) {
+			throw new Error(
+				`Goal ${goal.id} changed after its completion receipt was verified; refusing idempotent replay. Investigate the durable goals.json row before re-checkpointing.`,
+			);
+		}
 		// Idempotent re-checkpoint: this goal is already recorded in the target status with the same
 		// evidence, so skip the plan rewrite and ledger append to avoid duplicate goal_checkpointed
 		// events. The ledger is the dedup source of truth because it is exactly what a duplicate write
@@ -3868,7 +4084,7 @@ export async function checkpointUltragoalGoal(input: {
 	const changeSet = input.status === "complete" ? await computeCheckpointChangeSet(input.cwd) : undefined;
 	if (input.status === "complete") {
 		validatePipelineCheckpointSafety(plan, goal, changeSet);
-		validateCompleteCheckpointTargetGoal(goal);
+		if (!staleCompleteReceiptReplay) validateCompleteCheckpointTargetGoal(goal);
 	}
 	const qualityGateJson =
 		input.status === "complete"
@@ -3895,7 +4111,7 @@ export async function checkpointUltragoalGoal(input: {
 			blockedGoal.updatedAt = now;
 		}
 	}
-	const receiptKind = input.status === "complete" ? chooseReceiptKind(plan, goal, input.status) : null;
+	const receiptKind = input.status === "complete" ? chooseReceiptKind(plan, ledgerBefore, goal, input.status) : null;
 	const pendingCheckpointEventId = crypto.randomUUID();
 	if (input.status === "complete" && receiptKind && qualityGateJson && !Array.isArray(qualityGateJson)) {
 		goal.completionVerification = buildCompletionReceipt({

package/src/gjc-runtime/windows-powershell-command.ts

@@ -0,0 +1,58 @@
+import { Buffer } from "node:buffer";
+import * as path from "node:path";
+
+export const GJC_TMUX_LAUNCHED_ENV = "GJC_TMUX_LAUNCHED";
+
+export interface WindowsPowerShellInnerCommandOptions {
+	command: readonly string[];
+	args?: readonly string[];
+	environment?: Record<string, string>;
+	tmuxExitMarkerPath?: string;
+}
+
+function powershellQuote(value: string): string {
+	return `'${value.replace(/'/g, "''")}'`;
+}
+
+function buildPowerShellTmuxExitMarkerFinally(markerPath: string): string {
+	const markerDir = path.win32.dirname(markerPath);
+	return [
+		"} finally {",
+		"\ttry {",
+		`\t\tNew-Item -ItemType Directory -Force -Path ${powershellQuote(markerDir)} -ErrorAction Stop | Out-Null`,
+		"\t\t$__gjcTmuxExitMarker = @{ schema_version = 1; source = 'tmux_inner_shell'; ended_at = (Get-Date).ToUniversalTime().ToString('o'); exit_code = $__gjcTmuxExitCode } | ConvertTo-Json -Compress",
+		`\t\tSet-Content -LiteralPath ${powershellQuote(markerPath)} -Value $__gjcTmuxExitMarker -Encoding UTF8 -ErrorAction Stop`,
+		"\t} catch {",
+		"\t}",
+		"}",
+	].join("\n");
+}
+
+/** Builds the shared BOM-free UTF-16LE command for native Windows tmux-compatible panes. */
+export function buildWindowsPowerShellInnerCommand({
+	command,
+	args = [],
+	environment,
+	tmuxExitMarkerPath,
+}: WindowsPowerShellInnerCommandOptions): string {
+	const envLines = Object.entries({ [GJC_TMUX_LAUNCHED_ENV]: "1", ...(environment ?? {}) }).map(
+		([key, value]) => `$env:${key} = ${powershellQuote(value)}`,
+	);
+	const resolvedCommand = command.map(powershellQuote).join(" ");
+	const innerArgs = args.map(powershellQuote).join(" ");
+	const invocation = `& ${resolvedCommand} ${innerArgs}`;
+	const exitLine = "if ($null -ne $LASTEXITCODE) { exit $LASTEXITCODE } else { exit 1 }";
+	const script = tmuxExitMarkerPath
+		? [
+				...envLines,
+				"$__gjcTmuxExitCode = 1",
+				"try {",
+				`\t${invocation}`,
+				"\tif ($null -ne $LASTEXITCODE) { $__gjcTmuxExitCode = $LASTEXITCODE } else { $__gjcTmuxExitCode = 1 }",
+				buildPowerShellTmuxExitMarkerFinally(tmuxExitMarkerPath),
+				"exit $__gjcTmuxExitCode",
+			].join("\n")
+		: [...envLines, invocation, exitLine].join("\n");
+	const encodedCommand = Buffer.from(script, "utf16le").toString("base64");
+	return `pwsh -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encodedCommand}`;
+}

package/src/harness-control-plane/operate.ts

@@ -19,7 +19,7 @@ import {
 	type VanishEvidence,
 	validateReceipt,
 } from "./receipts";
-import { type HarnessRpc, singleFlightAccept } from "./rpc-adapter";
+import { type HarnessSessionTransport, singleFlightAccept } from "./session-transport";
 import { writeReceiptImmutable } from "./storage";
 import {
 	DEFAULT_RETRY_BUDGET,
@@ -35,10 +35,10 @@ export interface OperateOptions {
 	sessionId: string;
 	workspace: string;
 	branch: string;
-	rpc: HarnessRpc;
-	/** Factory used to (re)create the RPC subprocess on restart recovery. Defaults to reusing `rpc`. */
-	rpcFactory?: () => HarnessRpc;
-	/** Bounded observation provider (scripted in tests; real = git + rpc state). */
+	transport: HarnessSessionTransport;
+	/** Factory used to recreate an SDK transport on restart recovery. Defaults to reusing `transport`. */
+	transportFactory?: () => HarnessSessionTransport;
+	/** Bounded observation provider (scripted in tests; real = git + SDK session state). */
 	observe: () => Promise<Observation>;
 	/** Real dirty-worktree preservation; injectable for tests. Defaults to git stash/diff capture. */
 	preserve?: (workspace: string) => PreserveResult;
@@ -71,7 +71,7 @@ export async function operate(goal: string, opts: OperateOptions): Promise<Opera
 	const vanishReceiptIds: string[] = [];
 	const blockers: string[] = [];
 
-	let rpc = opts.rpc;
+	let transport = opts.transport;
 
 	const now = (): string => new Date(opts.clock ? opts.clock() : Date.now()).toISOString();
 	let lifecycle: HarnessLifecycle = "started";
@@ -118,7 +118,7 @@ export async function operate(goal: string, opts: OperateOptions): Promise<Opera
 	};
 
 	const submit = async (): Promise<boolean> => {
-		const acc = await singleFlightAccept(rpc, goal, acceptanceTimeoutMs);
+		const acc = await singleFlightAccept(transport, goal, acceptanceTimeoutMs);
 		await emit(acc.accepted ? "info" : "warn", acc.accepted ? "prompt_accepted" : "prompt_not_accepted", {
 			reason: acc.reason,
 		});
@@ -160,11 +160,11 @@ export async function operate(goal: string, opts: OperateOptions): Promise<Opera
 			accepted = await submit();
 		} else if (decision.classification === "restart-clean") {
 			budget.zeroDeltaVanish = Math.max(0, budget.zeroDeltaVanish - 1);
-			rpc = opts.rpcFactory ? opts.rpcFactory() : rpc;
+			transport = opts.transportFactory ? opts.transportFactory() : transport;
 			accepted = await submit();
 		} else if (decision.classification === "restart-preserve-delta") {
 			budget.dirtyVanishPreserve = Math.max(0, budget.dirtyVanishPreserve - 1);
-			rpc = opts.rpcFactory ? opts.rpcFactory() : rpc;
+			transport = opts.transportFactory ? opts.transportFactory() : transport;
 			accepted = await submit();
 		} else if (decision.classification === "fallback-codex-exec") {
 			lifecycle = "blocked";