@gajae-code/coding-agent 0.11.1 → 0.11.3

package/src/gjc-runtime/goal-mode-request.ts

@@ -1,7 +1,8 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { Snowflake } from "@gajae-code/utils";
-import { type Goal, type GoalModeState, normalizeGoal } from "../goals/state";
+import { type Goal, type GoalModeState, type GoalProvenance, normalizeGoal } from "../goals/state";
+
 import {
 	buildSessionContext,
 	loadEntriesFromFile,
@@ -27,6 +28,8 @@ export interface PendingGoalModeRequest {
 	objective: string;
 	createdAt: string;
 	goalsPath?: string;
+	provenance: Extract<GoalProvenance, { source: "ultragoal" }>;
+
 	/**
 	 * Session id that produced this request (from GJC_SESSION_ID). When present,
 	 * only the originating session may consume it, so concurrent sessions sharing
@@ -42,6 +45,7 @@ export type CurrentSessionGoalModeWriteResult =
 
 interface UltragoalPlanShape {
 	gjcObjective?: unknown;
+	goals?: Array<{ id?: unknown }>;
 }
 
 function isEnoent(error: unknown): boolean {
@@ -70,7 +74,7 @@ export function isUltragoalCreateGoalsInvocation(args: readonly string[]): boole
 export async function readUltragoalGjcObjective(
 	cwd: string,
 	sessionId?: string | null,
-): Promise<{ objective: string; goalsPath: string }> {
+): Promise<{ objective: string; goalsPath: string; provenance: Extract<GoalProvenance, { source: "ultragoal" }> }> {
 	const session = sessionId?.trim()
 		? { gjcSessionId: sessionId.trim() }
 		: await resolveGjcSessionForRead(cwd, { envSessionId: process.env.GJC_SESSION_ID });
@@ -78,11 +82,21 @@ export async function readUltragoalGjcObjective(
 	try {
 		const plan = (await Bun.file(goalsPath).json()) as UltragoalPlanShape;
 		const objective = typeof plan.gjcObjective === "string" ? plan.gjcObjective.trim() : "";
-		return { objective: objective || DEFAULT_ULTRAGOAL_OBJECTIVE, goalsPath };
+		const goalId = typeof plan.goals?.[0]?.id === "string" ? plan.goals[0].id : "aggregate";
+		return {
+			objective: objective || DEFAULT_ULTRAGOAL_OBJECTIVE,
+			goalsPath,
+			provenance: { source: "ultragoal", runId: session.gjcSessionId, goalId },
+		};
 	} catch (error) {
 		if (isEnoent(error)) {
-			return { objective: DEFAULT_ULTRAGOAL_OBJECTIVE, goalsPath };
+			return {
+				objective: DEFAULT_ULTRAGOAL_OBJECTIVE,
+				goalsPath,
+				provenance: { source: "ultragoal", runId: session.gjcSessionId, goalId: "aggregate" },
+			};
 		}
+
 		throw error;
 	}
 }
@@ -92,6 +106,7 @@ export async function writePendingGoalModeRequest(input: {
 	objective: string;
 	goalsPath?: string;
 	sessionId?: string | null;
+	provenance?: Extract<GoalProvenance, { source: "ultragoal" }>;
 }): Promise<PendingGoalModeRequest> {
 	const objective = input.objective.trim();
 	if (!objective) throw new Error("goal objective is required");
@@ -106,6 +121,8 @@ export async function writePendingGoalModeRequest(input: {
 		objective,
 		createdAt: new Date().toISOString(),
 		goalsPath: input.goalsPath,
+		provenance: input.provenance ?? { source: "ultragoal", runId: sessionId, goalId: "aggregate" },
+
 		...(sessionId ? { sessionId } : {}),
 	};
 	const filePath = requestPath(input.cwd, sessionId);
@@ -125,7 +142,26 @@ function isNonTerminalGoal(goal: Goal | null): goal is Goal {
 	return goal !== null && goal.status !== "complete" && goal.status !== "dropped";
 }
 
-function createGoalModeState(objective: string): GoalModeState {
+function matchesGoalModeRequest(existingGoal: Goal, objective: string, provenance: Goal["provenance"]): boolean {
+	const existingProvenance = existingGoal.provenance;
+	if (existingProvenance?.source === "ultragoal" && provenance?.source === "ultragoal") {
+		return existingProvenance.runId === provenance.runId && existingProvenance.goalId === provenance.goalId;
+	}
+	// Legacy goals have no durable identity. Only an exact normalized objective can
+	// establish that they are the same goal.
+	return existingGoal.objective.trim() === objective;
+}
+
+function hasProvenDifferentDurablePlan(existingGoal: Goal, provenance: Goal["provenance"]): boolean {
+	const existingProvenance = existingGoal.provenance;
+	return (
+		existingProvenance?.source === "ultragoal" &&
+		provenance?.source === "ultragoal" &&
+		existingProvenance.runId !== provenance.runId
+	);
+}
+
+function createGoalModeState(objective: string, provenance: Goal["provenance"]): GoalModeState {
 	const now = Date.now();
 	const goal: Goal = {
 		id: String(Snowflake.next()),
@@ -135,6 +171,7 @@ function createGoalModeState(objective: string): GoalModeState {
 		timeUsedSeconds: 0,
 		createdAt: now,
 		updatedAt: now,
+		...(provenance ? { provenance } : {}),
 	};
 	return { enabled: true, mode: "active", goal };
 }
@@ -151,6 +188,7 @@ function nextSessionEntryId(entries: readonly SessionEntry[]): string {
 export async function writeCurrentSessionGoalModeState(input: {
 	sessionFile?: string | null;
 	objective: string;
+	provenance?: Goal["provenance"];
 }): Promise<CurrentSessionGoalModeWriteResult> {
 	const sessionFile = input.sessionFile?.trim();
 	if (!sessionFile) return { status: "unavailable", reason: "missing_session_file" };
@@ -162,13 +200,22 @@ export async function writeCurrentSessionGoalModeState(input: {
 	const entries = fileEntries.filter((entry): entry is SessionEntry => entry.type !== "session");
 	if (fileEntries.length === 0) return { status: "unavailable", reason: "empty_session_file" };
 
+	const requestedProvenance = input.provenance;
 	const context = buildSessionContext(entries);
 	const existingGoal = goalFromModeData(context.modeData);
 	if ((context.mode === "goal" || context.mode === "goal_paused") && isNonTerminalGoal(existingGoal)) {
-		return { status: "existing_goal", goal: existingGoal };
+		if (matchesGoalModeRequest(existingGoal, objective, requestedProvenance)) {
+			return { status: "existing_goal", goal: existingGoal };
+		}
+		// A legacy or user goal cannot establish that the incoming ultragoal request
+		// belongs to a different durable plan. Preserve it rather than overwriting
+		// active user work; only a distinct ultragoal run ID may replace it.
+		if (!hasProvenDifferentDurablePlan(existingGoal, requestedProvenance)) {
+			return { status: "existing_goal", goal: existingGoal };
+		}
 	}
 
-	const state = createGoalModeState(objective);
+	const state = createGoalModeState(objective, requestedProvenance);
 	const entry: ModeChangeEntry = {
 		type: "mode_change",
 		id: nextSessionEntryId(entries),
@@ -213,7 +260,7 @@ export async function consumePendingGoalModeRequest(
 	// (do not delete it) so its rightful owner can still pick it up. Legacy/unscoped
 	// requests (no sessionId) remain consumable by any session in this cwd.
 	const ownerSessionId = typeof candidate.sessionId === "string" ? candidate.sessionId.trim() : "";
-	if (ownerSessionId && ownerSessionId !== (currentSessionId?.trim() ?? "")) {
+	if (ownerSessionId && ownerSessionId !== session.gjcSessionId) {
 		return null;
 	}
 	await removeFileAudited(filePath, {

package/src/gjc-runtime/launch-tmux.ts

@@ -5,6 +5,7 @@ import * as path from "node:path";
 import { VERSION } from "@gajae-code/utils/dirs";
 import { safeStderrWrite } from "@gajae-code/utils/safe-stderr";
 import type { Args } from "../cli/args";
+import { readLinuxProcStartTimeSync } from "./linux-proc";
 import { tmuxRuntimeSessionPath } from "./session-layout";
 import {
 	GJC_COORDINATOR_SESSION_BRANCH_ENV,
@@ -1108,11 +1109,7 @@ function defaultOwnerIsolationProbe(
 		let startTime: string | undefined;
 		let cgroupText: string | null = null;
 		try {
-			const stat = fs.readFileSync(`/proc/${pid}/stat`, "utf8");
-			startTime = stat
-				.slice(stat.lastIndexOf(")") + 2)
-				.trim()
-				.split(/\s+/)[19];
+			startTime = readLinuxProcStartTimeSync(pid) ?? undefined;
 			cgroupText = fs.readFileSync(`/proc/${pid}/cgroup`, "utf8");
 		} catch {}
 		if (!startTime) return { state: "unverifiable" };

package/src/gjc-runtime/launch-worktree.ts

@@ -299,14 +299,14 @@ export function ensureReusableNodeModules(sourceRoot: string, worktreePath: stri
 	return "symlink";
 }
 
-export function prepareLaunchWorktree(
-	cwd: string,
-	args: string[],
-): {
+/** Result of {@link prepareLaunchWorktree}: the effective working directory, remaining args, and resolved worktree plan. */
+export interface PreparedLaunchWorktree {
 	cwd: string;
 	args: string[];
 	worktree: GjcLaunchWorktreeResult | { enabled: false };
-} {
+}
+
+export function prepareLaunchWorktree(cwd: string, args: string[]): PreparedLaunchWorktree {
 	const parsed = parseLaunchWorktreeMode(args);
 	const planned = planLaunchWorktree(cwd, parsed.mode);
 	const ensured = ensureLaunchWorktree(planned);

package/src/gjc-runtime/linux-proc.ts

@@ -0,0 +1,71 @@
+/**
+ * Shared helpers for reading Linux `/proc/<pid>/stat` process start time.
+ *
+ * The `comm` field (field 2, wrapped in parentheses) may itself contain spaces
+ * and parentheses, so the only robust anchor is the *last* `)` in the stat
+ * string. Field 22 (the process start time in clock ticks since boot) is the
+ * 20th whitespace-separated token after that closing paren (index 19).
+ *
+ * Every caller previously parsed this format independently, with subtly
+ * different failure handling. This module fails closed: any malformed input
+ * (missing `)`, non-numeric field 22, unreadable `/proc` file, non-Linux
+ * platform) yields `null` rather than an inconsistent sentinel.
+ */
+
+import * as nodeFsSync from "node:fs";
+import * as nodeFs from "node:fs/promises";
+
+/**
+ * Parse field 22 (process start time, in clock ticks since boot) from one
+ * `/proc/<pid>/stat` record. Returns the raw numeric token, or `null` when the
+ * record shape is malformed or field 22 is absent/non-numeric.
+ */
+export function parseLinuxProcStartTime(stat: string | null | undefined): string | null {
+	if (!stat || stat.includes("\0") || stat.includes("\r")) return null;
+	const record = stat.endsWith("\n") ? stat.slice(0, -1) : stat;
+	if (!record || record.includes("\n")) return null;
+
+	const open = record.indexOf(" (");
+	const close = record.lastIndexOf(")");
+	if (open < 1 || close <= open + 1 || !/^[1-9]\d*$/.test(record.slice(0, open))) return null;
+
+	const suffix = record.slice(close + 1);
+	if (!/^[ \t]+/.test(suffix)) return null;
+	const fields = suffix.trim().split(/[ \t]+/);
+	if (fields.length < 20 || !/^[RSDTtXZPI]$/.test(fields[0])) return null;
+
+	const startTime = fields[19];
+	return /^\d+$/.test(startTime) ? startTime : null;
+}
+
+/**
+ * Read `/proc/<pid>/stat` synchronously and return the parsed start time.
+ * Returns `null` on non-Linux platforms, unreadable files, or malformed input.
+ */
+export function readLinuxProcStartTimeSync(pid: number): string | null {
+	if (process.platform !== "linux") return null;
+	if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+	let stat: string;
+	try {
+		stat = nodeFsSync.readFileSync(`/proc/${pid}/stat`, "utf8");
+	} catch {
+		return null;
+	}
+	return parseLinuxProcStartTime(stat);
+}
+
+/**
+ * Read `/proc/<pid>/stat` asynchronously and return the parsed start time.
+ * Returns `null` on non-Linux platforms, unreadable files, or malformed input.
+ */
+export async function readLinuxProcStartTime(pid: number): Promise<string | null> {
+	if (process.platform !== "linux") return null;
+	if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+	let stat: string;
+	try {
+		stat = await nodeFs.readFile(`/proc/${pid}/stat`, "utf8");
+	} catch {
+		return null;
+	}
+	return parseLinuxProcStartTime(stat);
+}

package/src/gjc-runtime/ralplan-runtime.ts

@@ -19,9 +19,12 @@ import { runNativeStateCommand } from "./state-runtime";
 import {
 	appendJsonlIdempotent,
 	readExistingStateForMutation,
+	withWorkflowStateLock,
 	writeArtifact,
 	writeWorkflowEnvelopeAtomic,
 } from "./state-writer";
+import { assertSafePathComponent, CommandError, flagValue, hasFlag } from "./workflow-cli-common";
+import { getSkillManifest } from "./workflow-manifest";
 
 /**
  * Native implementation of `gjc ralplan`.
@@ -55,8 +58,6 @@ type RalplanStage = (typeof KNOWN_STAGES)[number];
 const KNOWN_ARCHITECT_KINDS = new Set(["openai-code"]);
 const KNOWN_CRITIC_KINDS = new Set(["openai-code"]);
 
-const PATH_COMPONENT_RE = /^[A-Za-z0-9_-][A-Za-z0-9._-]{0,63}$/;
-
 const SUBAGENT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 
 const KNOWN_FALLBACK_REASONS = new Set([
@@ -68,12 +69,9 @@ const KNOWN_FALLBACK_REASONS = new Set([
 	"missing_record",
 ]);
 
-class RalplanCommandError extends Error {
-	constructor(
-		public readonly exitStatus: number,
-		message: string,
-	) {
-		super(message);
+class RalplanCommandError extends CommandError {
+	constructor(exitStatus: number, message: string) {
+		super(exitStatus, message);
 		this.name = "RalplanCommandError";
 	}
 }
@@ -95,16 +93,6 @@ const VALUE_FLAGS = new Set([
 	"--fallback-receipt-path",
 ]);
 
-function flagValue(args: readonly string[], flag: string): string | undefined {
-	const index = args.indexOf(flag);
-	if (index < 0) return undefined;
-	return args[index + 1];
-}
-
-function hasFlag(args: readonly string[], flag: string): boolean {
-	return args.includes(flag);
-}
-
 export function isRalplanArtifactWriteInvocation(args: readonly string[]): boolean {
 	return hasFlag(args, "--write");
 }
@@ -113,12 +101,6 @@ function isRalplanDoctorInvocation(args: readonly string[]): boolean {
 	return args[0] === "doctor";
 }
 
-function assertSafePathComponent(value: string, label: string): void {
-	if (!PATH_COMPONENT_RE.test(value) || value.includes("..")) {
-		throw new RalplanCommandError(2, `invalid path component for --${label}: ${value}`);
-	}
-}
-
 function assertKnownStage(stage: string): asserts stage is RalplanStage {
 	if (!(KNOWN_STAGES as readonly string[]).includes(stage)) {
 		throw new RalplanCommandError(2, `unknown --stage: ${stage}. Expected one of: ${KNOWN_STAGES.join(", ")}.`);
@@ -204,61 +186,57 @@ async function readActiveRunId(cwd: string, sessionId: string): Promise<string |
  * undo Stop semantics. Every other phase advances to track the stage just
  * persisted so run-state stays coherent with the active ralplan stage.
  */
-const PHASE_LOCK = new Set([
-	"final",
-	"handoff",
-	"complete",
-	"completed",
-	"failed",
-	"cancelled",
-	"canceled",
-	"inactive",
-]);
 
 /** Phase that keeps run-state coherent with the stage just written, preserving locked phases. */
 function advanceCurrentPhase(existingPhase: unknown, stage: RalplanStage): string {
 	const current = typeof existingPhase === "string" ? existingPhase.trim() : "";
-	if (current && PHASE_LOCK.has(current)) return current;
+	if (current && getSkillManifest("ralplan").phaseLock.includes(current)) return current;
 	return stage;
 }
 
 async function persistActiveRunId(cwd: string, sessionId: string, runId: string, stage: RalplanStage): Promise<void> {
 	const statePath = ralplanStatePath(cwd, sessionId);
-	const existingRead = await readExistingStateForMutation(statePath);
-	if (existingRead.kind === "corrupt") {
-		throw new RalplanCommandError(
-			2,
-			`existing ralplan state is corrupt or tampered (${existingRead.error}); refusing to overwrite ${statePath}`,
-		);
-	}
-	let existing: Record<string, unknown> = existingRead.kind === "valid" ? existingRead.value : {};
-
-	// A new run_id is a fresh run, not a stray write on the prior run: never inherit a
-	// previous run's terminal/locked phase (which would start the new run already
-	// "complete"/"handoff" and disarm the Stop hook). PHASE_LOCK only guards same-run writes.
-	const isNewRun = existing.run_id !== runId;
-	const nextPhase = isNewRun ? stage : advanceCurrentPhase(existing.current_phase, stage);
-	if (
-		existing.run_id === runId &&
-		existing.version === WORKFLOW_STATE_VERSION &&
-		existing.current_phase === nextPhase &&
-		(existing.active === true || PHASE_LOCK.has(nextPhase))
-	) {
-		return;
-	}
-	existing.run_id = runId;
-	if (typeof existing.skill !== "string") existing.skill = "ralplan";
-	// A successful persist means ralplan is actively writing this run's artifacts, so always
-	// re-assert active. Fallback-only init left active:false after a clear (#644, sibling of #638).
-	existing.active = true;
-	existing.current_phase = nextPhase;
-	existing = migrateWorkflowState(existing, "ralplan").state;
-	existing.updated_at = new Date().toISOString();
-	await writeWorkflowEnvelopeAtomic(statePath, existing, {
-		cwd,
-		receipt: { cwd, skill: "ralplan", owner: "gjc-runtime", command: "gjc ralplan persist-run-id", sessionId },
-		audit: { category: "state", verb: "write", owner: "gjc-runtime", skill: "ralplan", sessionId },
-	});
+	return await withWorkflowStateLock(
+		statePath,
+		async () => {
+			const existingRead = await readExistingStateForMutation(statePath);
+			if (existingRead.kind === "corrupt") {
+				throw new RalplanCommandError(
+					2,
+					`existing ralplan state is corrupt or tampered (${existingRead.error}); refusing to overwrite ${statePath}`,
+				);
+			}
+			let existing: Record<string, unknown> = existingRead.kind === "valid" ? existingRead.value : {};
+
+			// A new run_id is a fresh run, not a stray write on the prior run: never inherit a
+			// previous run's terminal/locked phase (which would start the new run already
+			// "complete"/"handoff" and disarm the Stop hook). PHASE_LOCK only guards same-run writes.
+			const isNewRun = existing.run_id !== runId;
+			const nextPhase = isNewRun ? stage : advanceCurrentPhase(existing.current_phase, stage);
+			if (
+				existing.run_id === runId &&
+				existing.version === WORKFLOW_STATE_VERSION &&
+				existing.current_phase === nextPhase &&
+				(existing.active === true || getSkillManifest("ralplan").phaseLock.includes(nextPhase))
+			) {
+				return;
+			}
+			existing.run_id = runId;
+			if (typeof existing.skill !== "string") existing.skill = "ralplan";
+			// A successful persist means ralplan is actively writing this run's artifacts, so always
+			// re-assert active. Fallback-only init left active:false after a clear (#644, sibling of #638).
+			existing.active = true;
+			existing.current_phase = nextPhase;
+			existing = migrateWorkflowState(existing, "ralplan").state;
+			existing.updated_at = new Date().toISOString();
+			await writeWorkflowEnvelopeAtomic(statePath, existing, {
+				cwd,
+				receipt: { cwd, skill: "ralplan", owner: "gjc-runtime", command: "gjc ralplan persist-run-id", sessionId },
+				audit: { category: "state", verb: "write", owner: "gjc-runtime", skill: "ralplan", sessionId },
+			});
+		},
+		{ cwd },
+	);
 }
 
 /* --------------------------- planner run-state --------------------------- */
@@ -382,25 +360,31 @@ function plannerStatePayload(update: PlannerStateUpdate): Record<string, unknown
  */
 async function applyPlannerStateUpdate(cwd: string, sessionId: string, update: PlannerStateUpdate): Promise<void> {
 	const statePath = ralplanStatePath(cwd, sessionId);
-	const existingRead = await readExistingStateForMutation(statePath);
-	if (existingRead.kind === "corrupt") {
-		throw new RalplanCommandError(
-			2,
-			`existing ralplan state is corrupt or tampered (${existingRead.error}); refusing to overwrite ${statePath}`,
-		);
-	}
-	let existing: Record<string, unknown> = existingRead.kind === "valid" ? existingRead.value : {};
-	Object.assign(existing, plannerStatePayload(update));
-	if (typeof existing.skill !== "string") existing.skill = "ralplan";
-	if (typeof existing.active !== "boolean") existing.active = true;
-	if (typeof existing.current_phase !== "string") existing.current_phase = "planner";
-	existing = migrateWorkflowState(existing, "ralplan").state;
-	existing.updated_at = new Date().toISOString();
-	await writeWorkflowEnvelopeAtomic(statePath, existing, {
-		cwd,
-		receipt: { cwd, skill: "ralplan", owner: "gjc-runtime", command: "gjc ralplan planner-state", sessionId },
-		audit: { category: "state", verb: "write", owner: "gjc-runtime", skill: "ralplan", sessionId },
-	});
+	return await withWorkflowStateLock(
+		statePath,
+		async () => {
+			const existingRead = await readExistingStateForMutation(statePath);
+			if (existingRead.kind === "corrupt") {
+				throw new RalplanCommandError(
+					2,
+					`existing ralplan state is corrupt or tampered (${existingRead.error}); refusing to overwrite ${statePath}`,
+				);
+			}
+			let existing: Record<string, unknown> = existingRead.kind === "valid" ? existingRead.value : {};
+			Object.assign(existing, plannerStatePayload(update));
+			if (typeof existing.skill !== "string") existing.skill = "ralplan";
+			if (typeof existing.active !== "boolean") existing.active = true;
+			if (typeof existing.current_phase !== "string") existing.current_phase = "planner";
+			existing = migrateWorkflowState(existing, "ralplan").state;
+			existing.updated_at = new Date().toISOString();
+			await writeWorkflowEnvelopeAtomic(statePath, existing, {
+				cwd,
+				receipt: { cwd, skill: "ralplan", owner: "gjc-runtime", command: "gjc ralplan planner-state", sessionId },
+				audit: { category: "state", verb: "write", owner: "gjc-runtime", skill: "ralplan", sessionId },
+			});
+		},
+		{ cwd },
+	);
 }
 
 async function resolveArtifactArgs(args: readonly string[], cwd: string): Promise<ResolvedArtifactArgs> {
@@ -916,7 +900,7 @@ export async function runNativeRalplanCommand(args: string[], cwd = process.cwd(
 		if (isRalplanArtifactWriteInvocation(args)) return await handleArtifactWrite(args, cwd);
 		return await handleConsensusHandoff(args, cwd);
 	} catch (error) {
-		if (error instanceof RalplanCommandError) return { status: error.exitStatus, stderr: `${error.message}\n` };
+		if (error instanceof CommandError) return { status: error.exitStatus, stderr: `${error.message}\n` };
 		return { status: 1, stderr: `${error instanceof Error ? error.message : String(error)}\n` };
 	}
 }

package/src/gjc-runtime/session-resolution.ts

@@ -39,13 +39,22 @@ export interface SessionIdSources {
 export class SessionResolutionError extends Error {
 	constructor(
 		message: string,
-		readonly code: "blank_flag" | "no_session" | "ambiguous" | "missing_for_write",
+		readonly code: "blank_flag" | "unsafe_session" | "no_session" | "ambiguous" | "missing_for_write",
 	) {
 		super(message);
 		this.name = "SessionResolutionError";
 	}
 }
 
+function assertSafeResolvedSessionId(sessionId: string): void {
+	if (sessionId === "." || sessionId === ".." || /[/\\]/.test(sessionId)) {
+		throw new SessionResolutionError(
+			"session id must be a single path component (no separators or traversal)",
+			"unsafe_session",
+		);
+	}
+}
+
 interface ResolvedFromSources {
 	gjcSessionId: string;
 	source: GjcSessionSource;
@@ -65,13 +74,18 @@ export function resolveSessionIdFromSources(sources: SessionIdSources): Resolved
 				"blank_flag",
 			);
 		}
+		assertSafeResolvedSessionId(trimmed);
 		return { gjcSessionId: trimmed, source: "flag" };
 	}
 	if (typeof payloadSessionId === "string" && payloadSessionId.trim() !== "") {
-		return { gjcSessionId: payloadSessionId.trim(), source: "payload" };
+		const trimmed = payloadSessionId.trim();
+		assertSafeResolvedSessionId(trimmed);
+		return { gjcSessionId: trimmed, source: "payload" };
 	}
 	if (typeof envSessionId === "string" && envSessionId.trim() !== "") {
-		return { gjcSessionId: envSessionId.trim(), source: "env" };
+		const trimmed = envSessionId.trim();
+		assertSafeResolvedSessionId(trimmed);
+		return { gjcSessionId: trimmed, source: "env" };
 	}
 	return undefined;
 }
@@ -155,6 +169,7 @@ async function collectActiveSessionCandidates(cwd: string): Promise<SessionCandi
 		if (!entry.isDirectory()) continue;
 		const gjcSessionId = sessionIdFromDirName(entry.name);
 		if (!gjcSessionId) continue;
+		assertSafeResolvedSessionId(gjcSessionId);
 		const dir = path.join(root, entry.name);
 		const activityMs = await readActivityMs(path.join(dir, GJC_SESSION_ACTIVITY_FILE));
 		// Sessions with no readable activity marker are considered inactive and