@gajae-code/coding-agent 0.11.11 → 0.12.1

package/src/internal-urls/local-root-gc.ts

@@ -0,0 +1,127 @@
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { isEnoent } from "@gajae-code/utils";
+import type { GcCollectResult, GcContext, GcError, GcRecord, GcStoreAdapter } from "../gjc-runtime/gc-runtime";
+
+/**
+ * GC for `local://` session roots.
+ *
+ * `resolveLocalRoot` gives every session its own `<tmp>/gjc-local/<session-id>`
+ * directory, and the first `local://` resolution seeds it with a migration
+ * marker. Nothing ever removes those directories, so a machine accumulates one
+ * per session indefinitely — and the overwhelming majority only ever hold the
+ * marker, because most sessions never write a `local://` file.
+ *
+ * Only marker-only directories are eligible, and only after a grace period.
+ * That keeps the rule provably safe without needing a session-liveness oracle:
+ * a directory holding real content is never touched, and a session that just
+ * started is still inside its grace window.
+ */
+
+const LOCAL_ROOT_PARENT = "gjc-local";
+const LEGACY_MIGRATION_MARKER = ".gjc-local-legacy-migrated-v1";
+
+/** Directories younger than this are left alone so a live session is never raced. */
+const GRACE_MS = 24 * 60 * 60 * 1000;
+
+/** Bound the scan so a pathological directory cannot stall `gjc gc`. */
+const MAX_ENTRIES = 20_000;
+
+function localRootParent(env: NodeJS.ProcessEnv): string {
+	return path.join(env.TMPDIR?.trim() || os.tmpdir(), LOCAL_ROOT_PARENT);
+}
+
+/** A root is prunable only when the marker is the single thing inside it. */
+async function classify(dir: string, now: number): Promise<{ status: string; stale: boolean; reason: string } | null> {
+	let entries: string[];
+	try {
+		entries = await fs.readdir(dir);
+	} catch (error) {
+		if (isEnoent(error)) return null;
+		throw error;
+	}
+
+	const extra = entries.filter(name => name !== LEGACY_MIGRATION_MARKER);
+	if (extra.length > 0)
+		return {
+			status: "in_use",
+			stale: false,
+			reason: `Holds ${extra.length} entr${extra.length === 1 ? "y" : "ies"} beyond the marker`,
+		};
+
+	const stat = await fs.stat(dir);
+	if (now - stat.mtimeMs < GRACE_MS) return { status: "recent", stale: false, reason: "Inside the grace window" };
+	return { status: "marker_only", stale: true, reason: "Only the migration marker, past the grace window" };
+}
+
+export const localRootsGcAdapter: GcStoreAdapter = {
+	store: "local_roots",
+	async collect(ctx: GcContext): Promise<GcCollectResult> {
+		const records: GcRecord[] = [];
+		const errors: GcError[] = [];
+		const parent = localRootParent(ctx.env);
+		const now = Date.now();
+
+		let dirents: string[];
+		try {
+			dirents = await fs.readdir(parent);
+		} catch (error) {
+			if (isEnoent(error)) return { records, errors };
+			errors.push({ store: "local_roots", scope: parent, message: (error as Error).message });
+			return { records, errors };
+		}
+
+		for (const name of dirents.slice(0, MAX_ENTRIES)) {
+			const dir = path.join(parent, name);
+			try {
+				const classified = await classify(dir, now);
+				if (!classified) continue;
+				records.push({
+					store: "local_roots",
+					id: name,
+					path: dir,
+					status: classified.status,
+					stale: classified.stale,
+					removable: classified.stale,
+					action: classified.stale ? "would_remove" : "none",
+					reason: classified.reason,
+				});
+			} catch (error) {
+				errors.push({ store: "local_roots", scope: dir, message: (error as Error).message });
+			}
+		}
+
+		if (dirents.length > MAX_ENTRIES) {
+			errors.push({
+				store: "local_roots",
+				scope: parent,
+				message: `Scan truncated at ${MAX_ENTRIES} entries`,
+			});
+		}
+
+		return { records, errors };
+	},
+	async prune(record: GcRecord) {
+		const dir = record.path;
+		if (!dir) return { removed: false, error: "Missing local root path" };
+
+		// Re-validate immediately before removing: the session may have written a
+		// file between collect and prune.
+		let classified: Awaited<ReturnType<typeof classify>>;
+		try {
+			classified = await classify(dir, Date.now());
+		} catch (error) {
+			return { removed: false, error: (error as Error).message };
+		}
+		if (!classified) return { removed: false, skipped: "Local root disappeared" };
+		if (!classified.stale) return { removed: false, skipped: `Local root no longer eligible (${classified.status})` };
+
+		try {
+			await fs.rm(dir, { recursive: true, force: true });
+			return { removed: true };
+		} catch (error) {
+			return { removed: false, error: (error as Error).message };
+		}
+	},
+};

package/src/main.ts

@@ -698,7 +698,7 @@ async function promptForkSession(session: SessionInfo): Promise<boolean> {
 	}
 }
 
-async function getChangelogForDisplay(parsed: Args): Promise<string | undefined> {
+export async function getChangelogForDisplay(parsed: Args): Promise<string | undefined> {
 	if (parsed.continue || parsed.resume) {
 		return undefined;
 	}
@@ -710,15 +710,19 @@ async function getChangelogForDisplay(parsed: Args): Promise<string | undefined>
 
 	const lastVersion = settings.get("lastChangelogVersion");
 	if (!lastVersion) {
-		settings.set("lastChangelogVersion", VERSION);
-		await flushChangelogVersion();
+		if (settings.canWriteDurableConfig()) {
+			settings.set("lastChangelogVersion", VERSION);
+			await flushChangelogVersion();
+		}
 		return getInstalledVersionChangelogEntry(entries, VERSION)?.content;
 	}
 
 	if (lastVersion !== VERSION) {
 		const newEntries = getNewEntries(entries, lastVersion);
-		settings.set("lastChangelogVersion", VERSION);
-		await flushChangelogVersion();
+		if (settings.canWriteDurableConfig()) {
+			settings.set("lastChangelogVersion", VERSION);
+			await flushChangelogVersion();
+		}
 		if (newEntries.length > 0) {
 			return newEntries.map(e => e.content).join("\n\n");
 		}

package/src/memories/index.ts

@@ -976,6 +976,11 @@ function redactSecrets(input: string): string {
 		/(?:sk|pk|rk|tok|key|secret|token|password)[-_A-Za-z0-9]{12,}/g,
 		/[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g,
 		/(?:AKIA|ASIA)[A-Z0-9]{16}/g,
+		// GitHub tokens carry no keyword the first pattern recognizes, so without
+		// this they reached MEMORY.md and memory_summary.md verbatim — and the
+		// summary is injected into every later session. Same shapes the
+		// contribution-prep scrubber already covers.
+		/\b(?:gh[opsur]_[A-Za-z0-9_]{12,}|github_pat_[A-Za-z0-9_]{12,})\b/g,
 	];
 	for (const pattern of patterns) {
 		out = out.replace(pattern, "[REDACTED]");
@@ -983,6 +988,11 @@ function redactSecrets(input: string): string {
 	return out;
 }
 
+/** Secret scrubbing applied to every phase-2 consolidation output. Test seam. */
+export function redactMemorySecretsForTesting(input: string): string {
+	return redactSecrets(input);
+}
+
 function sanitizeSkillName(name: string): string {
 	return name
 		.toLowerCase()

package/src/modes/DESIGN.md

@@ -261,3 +261,101 @@ record both manifest counts as 108 plus CJK review results.
 
 No raw third-party design corpus, screenshot, or reference asset is stored by
 this workflow.
+
+## Sticky transcript viewport contract
+
+Live mode remains in natural terminal flow. Entering manual history makes the
+application-owned transcript lane scrollable while the status line and every
+later direct composer child are a fixed suffix at the bottom. PageUp/PageDown
+move by the transcript capacity; the wheel remains three rows. A focused editor
+keeps focus, and ordinary editor input or paste follows live before processing
+that input.
+
+Manual output has one bounded boolean indication, exactly **`New output — type
+to follow`**. It is not a count. New visible agent/tool/extension output may set
+it while manual; reflow, transient chrome, reconciliation, and user input may
+not. Following clears it only after a successful live repaint. Manual-era output
+is authoritative in the application transcript but is never retroactively
+replayed into native host scrollback; subsequent ordinary live output follows
+normal host behavior.
+
+The transcript is the only selectable coordinate space. Pinned status/composer
+chrome, notices, blank rows, and overlays never enter selection or copied text;
+CJK selection clamping remains directional and grapheme/cell aware. Under
+constrained height the notice drops first, then decorative pet and low-priority
+hooks. Focused editor/cursor, status, and normal hooks outrank those rows; zero
+transcript capacity is valid and must not corrupt cursor geometry.
+
+At narrow widths use ANSI-aware terminal-cell measurement. ASCII/no-color keeps
+textual state without SGR. Korean, Japanese, Chinese, and mixed CJK/Latin prose
+must wrap at semantic phrase boundaries, never through an action/status label or
+short identifier; a semantic CJK break is a visual-QA failure.
+
+### Sticky viewport deterministic visual QA
+
+`test/fixtures/tui/sticky-viewport-showcase.ts` is a fixed-clock, no-network,
+first-party harness that starts the production `TUI` over a `VirtualTerminal`.
+It constructs transcript, status, hooks, and the real composer as children,
+then drives the live/manual viewport path before capturing the terminal frame.
+Capture with `bun packages/coding-agent/scripts/capture-sticky-viewport-showcase.ts
+--out .gjc/qa/sticky-viewport-<run>` and verify with the paired `--root` script.
+The immutable matrix has exactly 20 keys: `live-overflow`, `manual-history`,
+`manual-new-output`, `multiline-editor-hooks-pet`, `capacity-many`,
+`capacity-one`, `capacity-zero`, and `selection-boundary` at both 80x24 and
+120x36 Unicode/color; plus `manual-new-output/80x24/ascii-no-color`,
+`capacity-zero/48x10/ascii-no-color`,
+`multiline-editor-hooks-pet/48x10/unicode-color`, and
+`narrow-cjk/48x10/unicode-color`. Do not add or replace a manual-follow case.
+
+Each key has only `terminal.txt`, ANSI-preserving `terminal-ansi.txt`, `terminal.html`, and `metadata.json`; the manifest records SHA-256 and byte length. Per-key metadata binds immutable font/render assumptions and the ANSI-aware wrapping/truncation policy. `VirtualTerminal` reconstructs ANSI from visible xterm cells, including cell padding, palette/RGB colors, attributes, and inverse video; plain text is always the stripped reconstruction. The verifier owns an independent literal 20-key oracle and fails closed unless stripped ANSI equals text, `terminal.html` equals the exported canonical `ansiToHtml(terminal-ansi.txt)` byte-for-byte (including its complete document envelope and global CSS), HTML independently preserves the ANSI style-run text, every retained row has the exact `Bun.stringWidth` cell width (including trailing spaces), and `ansi_mode` agrees with required Unicode color SGR or ASCII/no-color output. Every metadata entry has exact CJK phrase-boundary metadata: the narrow-CJK key has only the three canonical boundaries in order and every other key has `[]`. Manual captures prove successful production wheel and PageUp paths and retain observable historical transcript-row evidence. It validates exact payload paths (no duplicates or traversal), immutable source/output revisions, state/status/suffix order, notice cardinality, capacity, actual mouse-copied transcript-only selection, composer, CJK, and provenance invariants. `review-input.json` binds the exact manifest digest, capture author/executor identity, acceptance/design versions, required artifacts, narrow-CJK boundaries, and deterministic host matrix. `--require-independent-review` requires an attestation with an exact root key set; exact per-key result and artifact-check key sets; exact defect `{ description, accepted }` keys with a trimmed, nonblank description; canonical trimmed reviewer identity distinct from both bound identities; the independent-terminal-reviewer role; fixture revision; expected and observed counts of 20; exact checked keys; accepted per-key artifact-check/notes results; accepted artifact/CJK/host decisions; bound digest; and final `accept`. Any malformed, incomplete, or extra attestation content fails closed.
+## GJC Bundles
+
+GJC Bundles is a directly hosted Settings surface using the existing framed-list
+grammar. A bundle identity is always displayed as its name plus `(user)` or
+`(project)`. Same-name rows in opposite scopes are distinct identities and are
+never merged, selected together, or mutated through one another.
+
+Only safe source presentation is permitted. Never render or retain a raw source
+locator, userinfo, query, fragment, token, authentication material, or a full
+parent path in labels, descriptions, status, confirmation, errors, or evidence.
+
+Persisted enablement is user intent: bundle and eligible-surface enabled or
+disabled state. Effective runtime status is advisory display evidence only and
+never acts as hidden authorization. Deterministic quarantine blocks an enable
+action; disable is always available. Runtime evidence does not alter either
+rule.
+
+Focus, cursor, wrapping, ANSI-aware cell measurement, CJK semantic wrapping,
+and list scrolling follow the existing settings contracts above. Up/Down wrap
+within lists. A non-cancellable bundle mutation visibly locks navigation,
+including Escape and tab changes, until it completes; the lock names its
+reason. Long names and descriptions wrap in allocated content regions without
+hiding scope identity, CJK text breaks only at semantic boundaries, ANSI styles
+do not affect width measurement, and long surface lists scroll while retaining
+the focused row and scroll position.
+
+This Settings surface does not install or uninstall bundles, edit sources, or
+repair quarantine. It supports only list/detail, update review/apply,
+bundle-toggle, and eligible-surface-toggle actions.
+
+### Create-only refusal and source reachability
+
+An already-installed target is refused with `already_installed_use_upgrade`,
+independently of `--force`, and the refusal performs no filesystem mutation:
+it is decided before any registry lock is acquired, because acquiring a lock
+itself creates the scope root.
+
+Refusal is bound to the bundle name declared in the manifest, because that name
+*is* the identity component. When the source is a local directory the name is
+read without resolving, so a deleted-and-recreated or offline-but-present source
+still refuses correctly.
+
+When the source cannot be read at all — a deleted directory, an unreachable git
+remote, a missing tarball — the target's identity is genuinely unknowable before
+resolution, so the operation resolves and reports the source failure instead of
+refusing. Matching on the stored locator was tried and rejected as unsound: one
+locator can resolve to different content over time, the same URI can back two
+differently named bundles, and a stored `uri#ref` differs from a bare `uri`, so
+locator-based refusal would refuse installs that should proceed. Refusing on a
+guess is worse than reporting the real failure, so identity must be readable for
+refusal to apply.