@gajae-code/coding-agent 0.11.11 → 0.12.1

package/src/tools/browser/launch.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { getPuppeteerDir } from "@gajae-code/utils/dirs";
+import { $credentialEnv } from "@gajae-code/utils/env";
 import * as logger from "@gajae-code/utils/logger";
 import { $which } from "@gajae-code/utils/which";
 import * as browsers from "@puppeteer/browsers";
@@ -80,6 +81,42 @@ export async function loadPuppeteerInWorker(safeDir: string): Promise<typeof Pup
 	}
 }
 
+/**
+ * Browser launch overrides resolved from trusted environment sources only.
+ *
+ * These choose the browser binary and route/verify its traffic, so whatever can
+ * set them controls what runs and who sees the session. `$env` merges the
+ * caller's `cwd/.env` into `process.env`, so reading them directly would let
+ * repository content pick the executable, point every request at an attacker's
+ * proxy, or disable certificate validation. Resolve them the same way provider
+ * credentials are: launching shell plus GJC/user-owned `.env` files, never the
+ * project `.env`.
+ */
+function trustedBrowserEnv(name: string): string | undefined {
+	return $credentialEnv(name);
+}
+
+/** Boolean-like trusted browser env knob (`true`/`1`/`yes`/`on`). */
+function browserLaunchFlagEnabled(name: string): boolean {
+	const value = trustedBrowserEnv(name)?.toLowerCase();
+	return value === "true" || value === "1" || value === "yes" || value === "on";
+}
+
+/** Test seam: the browser launch overrides as resolved from trusted env. */
+export function resolveBrowserEnvOverridesForTest(): {
+	executablePath: string | undefined;
+	proxy: string | undefined;
+	proxyBypassLoopback: boolean;
+	ignoreCertErrors: boolean;
+} {
+	return {
+		executablePath: trustedBrowserEnv("PUPPETEER_EXECUTABLE_PATH"),
+		proxy: trustedBrowserEnv("PUPPETEER_PROXY"),
+		proxyBypassLoopback: browserLaunchFlagEnabled("PUPPETEER_PROXY_BYPASS_LOOPBACK"),
+		ignoreCertErrors: browserLaunchFlagEnabled("PUPPETEER_PROXY_IGNORE_CERT_ERRORS"),
+	};
+}
+
 /**
  * Lazily download Chromium on first browser launch via @puppeteer/browsers.
  * Skipped when a system Chromium (NixOS) or PUPPETEER_EXECUTABLE_PATH is set.
@@ -89,7 +126,7 @@ let chromiumExecutablePromise: Promise<string | undefined> | undefined;
 async function ensureChromiumExecutable(): Promise<string | undefined> {
 	const sysChrome = resolveSystemChromium();
 	if (sysChrome) return sysChrome;
-	const envPath = process.env.PUPPETEER_EXECUTABLE_PATH;
+	const envPath = trustedBrowserEnv("PUPPETEER_EXECUTABLE_PATH");
 	if (envPath) return envPath;
 	if (chromiumExecutablePromise) return chromiumExecutablePromise;
 
@@ -272,13 +309,12 @@ export async function launchHeadlessBrowser(opts: LaunchHeadlessOptions): Promis
 		// Isolated copy only (caller guarantees). Never point this at a live profile.
 		launchArgs.push(`--user-data-dir=${opts.profileWarmupDir}`);
 	}
-	const proxy = process.env.PUPPETEER_PROXY;
+	const proxy = trustedBrowserEnv("PUPPETEER_PROXY");
 	if (proxy) {
 		launchArgs.push(`--proxy-server=${proxy}`);
 		// Chrome (since v72) bypasses proxies for localhost by default. When PUPPETEER_PROXY_BYPASS_LOOPBACK
 		// is true, add <-loopback> so traffic to localhost reaches the proxy (e.g. for mitmdump/auth capture).
-		const bypassLoopback = process.env.PUPPETEER_PROXY_BYPASS_LOOPBACK?.toLowerCase();
-		if (bypassLoopback === "true" || bypassLoopback === "1" || bypassLoopback === "yes" || bypassLoopback === "on") {
+		if (browserLaunchFlagEnabled("PUPPETEER_PROXY_BYPASS_LOOPBACK")) {
 			launchArgs.push("--proxy-bypass-list=<-loopback>");
 		}
 	}
@@ -287,8 +323,7 @@ export async function launchHeadlessBrowser(opts: LaunchHeadlessOptions): Promis
 	if (opts.geo?.locale) {
 		launchArgs.push(`--lang=${opts.geo.locale}`);
 	}
-	const ignoreCert = process.env.PUPPETEER_PROXY_IGNORE_CERT_ERRORS?.toLowerCase();
-	if (ignoreCert === "true" || ignoreCert === "1" || ignoreCert === "yes" || ignoreCert === "on") {
+	if (browserLaunchFlagEnabled("PUPPETEER_PROXY_IGNORE_CERT_ERRORS")) {
 		launchArgs.push("--ignore-certificate-errors");
 	}
 	const launchEnv = opts.geo?.timezone ? { ...process.env, TZ: opts.geo.timezone } : undefined;

package/src/tools/fetch.ts

@@ -10,7 +10,7 @@ import type { RenderResultOptions } from "../extensibility/custom-tools/types";
 import { type Theme, theme } from "../modes/theme/theme";
 import type { ToolSession } from "../sdk";
 import type { AgentStorage } from "../session/agent-storage";
-import { DEFAULT_MAX_BYTES, truncateHead } from "../session/streaming-output";
+import { DEFAULT_MAX_BYTES, type TruncationDirection, truncateContent } from "../session/streaming-output";
 import { renderStatusLine } from "../tui";
 import { CachedOutputBlock } from "../tui/output-block";
 import { formatDimensionNote, resizeImage } from "../utils/image-resize";
@@ -1146,7 +1146,12 @@ interface ReadUrlCacheEntry {
 	artifactId?: string;
 	details: ReadUrlToolDetails;
 	image?: FetchImagePayload;
+	/** Complete URL output, including its preamble and body. */
 	output: string;
+	/** UTF-16 code-unit offset of the preamble in `output`. */
+	preambleChars: number;
+	/** Offset of the preamble after `wrapUntrustedContent(output)` is persisted. */
+	wrappedPreambleChars?: number;
 }
 
 const readUrlCache = new Map<string, ReadUrlCacheEntry>();
@@ -1178,7 +1183,13 @@ async function materializeReadUrlCacheEntry(
 	if (entry.artifactId) {
 		const artifactOutput = await readArtifactOutput(session, entry.artifactId);
 		if (artifactOutput !== null) {
-			return { ...entry, output: artifactOutput };
+			// Artifacts retain their trust-boundary wrapper. Keep the raw preamble
+			// coordinate alongside the escaped coordinate for live/rehydrated parity.
+			return {
+				...entry,
+				output: artifactOutput,
+				...(entry.wrappedPreambleChars !== undefined ? { wrappedPreambleChars: entry.wrappedPreambleChars } : {}),
+			};
 		}
 	}
 	return null;
@@ -1218,8 +1229,8 @@ async function buildReadUrlCacheEntry(
 
 	const storage = session.settings.getStorage();
 	const result = await renderUrl(url, effectiveTimeout, raw, session.settings, signal, storage);
-	const output = buildUrlReadOutput(result, result.content);
-	const artifactId = options?.ensureArtifact ? await persistReadUrlArtifact(session, output) : undefined;
+	const built = buildUrlReadOutput(result, result.content);
+	const artifactId = options?.ensureArtifact ? await persistReadUrlArtifact(session, built.output) : undefined;
 
 	return {
 		artifactId,
@@ -1233,7 +1244,9 @@ async function buildReadUrlCacheEntry(
 			notes: result.notes,
 		},
 		image: result.image,
-		output,
+		output: built.output,
+		preambleChars: built.preambleChars,
+		wrappedPreambleChars: built.wrappedPreambleChars,
 	};
 }
 
@@ -1263,60 +1276,138 @@ export async function loadReadUrlCacheEntry(
 
 const UNTRUSTED_CONTENT_OPEN = "<untrusted-content>";
 const UNTRUSTED_CONTENT_CLOSE = "</untrusted-content>";
+export const WRAP_PREFIX_CHARS = `${UNTRUSTED_CONTENT_OPEN}\n`.length;
+const WRAP_SUFFIX = `\n${UNTRUSTED_CONTENT_CLOSE}`;
+
+export function escapeUntrustedContent(content: string): string {
+	return content.replace(/<\/untrusted-content>/gi, "&lt;/untrusted-content>");
+}
 
 export function wrapUntrustedContent(content: string): string {
-	return `${UNTRUSTED_CONTENT_OPEN}\n${content.replace(/<\/untrusted-content>/gi, "&lt;/untrusted-content>")}\n${UNTRUSTED_CONTENT_CLOSE}`;
+	return `${UNTRUSTED_CONTENT_OPEN}\n${escapeUntrustedContent(content)}${WRAP_SUFFIX}`;
+}
+
+function isWrappedReadUrlOutput(output: string): boolean {
+	return output.startsWith(`${UNTRUSTED_CONTENT_OPEN}\n`) && output.endsWith(WRAP_SUFFIX);
+}
+
+/**
+ * Remove only the outer URL-output wrapper before line pagination. The content
+ * remains escaped exactly as persisted; it is deliberately never unescaped.
+ */
+export function prepareReadUrlSelectorInput(
+	output: string,
+	preambleChars: number,
+	wrappedPreambleChars?: number,
+): { text: string; preambleChars: number } {
+	if (!isWrappedReadUrlOutput(output)) return { text: output, preambleChars };
+	const bodyEnd = output.length - WRAP_SUFFIX.length;
+	return {
+		text: output.slice(WRAP_PREFIX_CHARS, Math.max(WRAP_PREFIX_CHARS, bodyEnd)),
+		preambleChars: Math.max(0, (wrappedPreambleChars ?? preambleChars) - WRAP_PREFIX_CHARS),
+	};
+}
+interface BuiltUrlReadOutput {
+	output: string;
+	preambleChars: number;
+	wrappedPreambleChars: number;
 }
 
-function buildUrlReadOutput(result: FetchRenderResult, content: string): string {
-	let output = "";
-	output += `URL: ${result.finalUrl}\n`;
-	output += `Content-Type: ${result.contentType}\n`;
-	output += `Method: ${result.method}\n`;
+function buildReadUrlPreamble(
+	result: Pick<FetchRenderResult, "finalUrl" | "contentType" | "method" | "notes">,
+): string {
+	let preamble = "";
+	preamble += `URL: ${result.finalUrl}\n`;
+	preamble += `Content-Type: ${result.contentType}\n`;
+	preamble += `Method: ${result.method}\n`;
 	if (result.notes.length > 0) {
-		output += `Notes: ${result.notes.join("; ")}\n`;
+		preamble += `Notes: ${result.notes.join("; ")}\n`;
 	}
-	output += `\n---\n\n`;
-	output += content;
-	return output;
+	preamble += "\n---\n\n";
+	return preamble;
+}
+
+function buildUrlReadOutput(result: FetchRenderResult, content: string): BuiltUrlReadOutput {
+	const preamble = buildReadUrlPreamble(result);
+	const preambleChars = preamble.length;
+	const output = `${preamble}${content}`;
+	return {
+		output,
+		preambleChars,
+		wrappedPreambleChars: WRAP_PREFIX_CHARS + escapeUntrustedContent(preamble).length,
+	};
 }
 
 export async function executeReadUrl(
 	session: ToolSession,
 	params: { path: string; raw?: boolean },
 	signal?: AbortSignal,
+	direction: TruncationDirection = "head",
 ): Promise<AgentToolResult<ReadUrlToolDetails>> {
 	let cacheEntry = await loadReadUrlCacheEntry(session, params, signal, { preferCached: true });
-	const truncation = truncateHead(cacheEntry.output, {
+	// `head` intentionally retains the historical whole-output accounting so the
+	// existing URL golden remains byte-identical. Non-head directions account for
+	// and truncate only the body; preamble bytes/chars are never part of that cap.
+	const effectiveDirection =
+		direction !== "head" && cacheEntry.wrappedPreambleChars === undefined ? "head" : direction;
+	const isWrappedOutput = isWrappedReadUrlOutput(cacheEntry.output);
+	const preambleChars = isWrappedOutput
+		? (cacheEntry.wrappedPreambleChars ??
+			WRAP_PREFIX_CHARS + escapeUntrustedContent(buildReadUrlPreamble(cacheEntry.details)).length)
+		: cacheEntry.preambleChars;
+	const wrappedPrefix = isWrappedOutput ? WRAP_PREFIX_CHARS : 0;
+	const wrappedSuffix = isWrappedOutput ? `\n${UNTRUSTED_CONTENT_CLOSE}` : "";
+	const bodyEnd = cacheEntry.output.length - wrappedSuffix.length;
+	const unwrappedOutput = isWrappedOutput
+		? cacheEntry.output.slice(wrappedPrefix, Math.max(wrappedPrefix, bodyEnd))
+		: cacheEntry.output;
+	const truncationInput =
+		effectiveDirection === "head"
+			? unwrappedOutput
+			: cacheEntry.output.slice(preambleChars, Math.max(preambleChars, bodyEnd));
+	const truncation = truncateContent(truncationInput, {
 		maxBytes: DEFAULT_MAX_BYTES,
 		maxLines: FETCH_DEFAULT_MAX_LINES,
+		direction: effectiveDirection,
 	});
 	const needsArtifact = truncation.truncated;
 	if (needsArtifact && !cacheEntry.artifactId) {
 		cacheEntry = await ensureReadUrlCacheArtifact(session, cacheEntry);
 		cacheReadUrlEntry(session, params.path, params.raw ?? false, cacheEntry);
 	}
-	const output = needsArtifact ? truncation.content : cacheEntry.output;
+	const output =
+		effectiveDirection !== "head"
+			? needsArtifact
+				? `${cacheEntry.output.slice(0, preambleChars)}${truncation.content}${wrappedSuffix}`
+				: cacheEntry.output
+			: truncation.content;
 	const details: ReadUrlToolDetails = {
 		...cacheEntry.details,
 		truncated: Boolean(cacheEntry.details.truncated || needsArtifact),
 	};
 
-	const contentBlocks: Array<TextContent | ImageContent> = [{ type: "text", text: wrapUntrustedContent(output) }];
+	const contentBlocks: Array<TextContent | ImageContent> = [
+		{ type: "text", text: isWrappedOutput && effectiveDirection !== "head" ? output : wrapUntrustedContent(output) },
+	];
 	if (cacheEntry.image) {
 		contentBlocks.push({ type: "image", data: cacheEntry.image.data, mimeType: cacheEntry.image.mimeType });
 	}
 
 	const resultBuilder = toolResult(details).content(contentBlocks).sourceUrl(details.finalUrl);
 	if (needsArtifact) {
-		resultBuilder.truncation(truncation, { direction: "head", artifactId: cacheEntry.artifactId });
+		resultBuilder.truncation(truncation, {
+			direction: effectiveDirection === "both" ? "middle" : effectiveDirection === "last" ? "tail" : "head",
+			artifactId: cacheEntry.artifactId,
+			...(effectiveDirection !== "head" ? { maxBytes: DEFAULT_MAX_BYTES } : {}),
+		});
 	} else if (cacheEntry.details.truncated) {
-		const outputLines = cacheEntry.output.split("\n").length;
-		const outputBytes = Buffer.byteLength(cacheEntry.output, "utf-8");
+		const reportedText = effectiveDirection === "head" ? cacheEntry.output : truncationInput;
+		const outputLines = reportedText.split("\n").length;
+		const outputBytes = Buffer.byteLength(reportedText, "utf-8");
 		const totalBytes = Math.max(outputBytes + 1, MAX_OUTPUT_CHARS + 1);
 		const totalLines = outputLines + 1;
-		resultBuilder.truncationFromText(cacheEntry.output, {
-			direction: "tail",
+		resultBuilder.truncationFromText(reportedText, {
+			direction: effectiveDirection === "both" ? "middle" : effectiveDirection === "last" ? "tail" : "head",
 			totalLines,
 			totalBytes,
 			maxBytes: MAX_OUTPUT_CHARS,

package/src/tools/find.ts

@@ -158,6 +158,7 @@ export class FindTool implements AgentTool<typeof findSchema, FindToolDetails> {
 				const resource = await internalRouter.resolve(rawPattern, {
 					cwd: this.session.cwd,
 					getArtifactsDir: this.session.getArtifactsDir,
+					getAuthorizedArtifactsDirs: this.session.getAuthorizedArtifactsDirs,
 				});
 				if (!resource.sourcePath) {
 					throw new ToolError(`Cannot find internal URL without a backing file: ${rawPattern}`);

package/src/tools/image-gen.ts

@@ -12,7 +12,7 @@ import {
 	URL_PATHS,
 } from "@gajae-code/ai/providers/openai-codex/constants";
 import {
-	$env,
+	$credentialEnv,
 	isEnoent,
 	parseImageMetadata,
 	prompt,
@@ -794,6 +794,23 @@ async function findAlibabaImageCredentials(
 	return { provider: "alibaba", apiKey };
 }
 
+/**
+ * Google image-provider key fallback, from trusted environment sources only.
+ *
+ * `$env` merges the caller's `cwd/.env`, so reading the key there would let
+ * repository content supply the credential these image requests authenticate
+ * with. Provider credentials resolve from the launching shell plus GJC/user-owned
+ * `.env` files, never the project `.env`.
+ */
+function googleImageApiKeyFromEnv(): string | undefined {
+	return $credentialEnv("GOOGLE_API_KEY");
+}
+
+/** Test seam: the Google image key fallback as resolved from trusted env. */
+export function googleImageApiKeyFromEnvForTest(): string | undefined {
+	return googleImageApiKeyFromEnv();
+}
+
 async function findImageApiKey(
 	modelRegistry?: ModelRegistry,
 	activeModel?: Model,
@@ -827,7 +844,7 @@ async function findImageApiKey(
 		if (config.provider === "gemini") {
 			const geminiKey = getEnvApiKey("google");
 			if (geminiKey) return { provider: "gemini", apiKey: geminiKey };
-			const googleKey = $env.GOOGLE_API_KEY;
+			const googleKey = googleImageApiKeyFromEnv();
 			return googleKey ? { provider: "gemini", apiKey: googleKey } : null;
 		}
 		if (config.provider === "openrouter") {
@@ -850,7 +867,7 @@ async function findImageApiKey(
 	} else if (preferredImageProvider === "gemini") {
 		const geminiKey = getEnvApiKey("google");
 		if (geminiKey) return { provider: "gemini", apiKey: geminiKey };
-		const googleKey = $env.GOOGLE_API_KEY;
+		const googleKey = googleImageApiKeyFromEnv();
 		return googleKey ? { provider: "gemini", apiKey: googleKey } : null;
 	} else if (preferredImageProvider === "openrouter") {
 		const openRouterKey = getEnvApiKey("openrouter");
@@ -874,7 +891,7 @@ async function findImageApiKey(
 	const geminiKey = getEnvApiKey("google");
 	if (geminiKey) return { provider: "gemini", apiKey: geminiKey };
 
-	const googleKey = $env.GOOGLE_API_KEY;
+	const googleKey = googleImageApiKeyFromEnv();
 	if (googleKey) return { provider: "gemini", apiKey: googleKey };
 
 	const alibaba = await findAlibabaImageCredentials(modelRegistry, sessionId);
@@ -1106,7 +1123,9 @@ function getOpenAIBaseUrl(model: Model, authCredentialType?: "api_key" | "oauth"
 		return (model.baseUrl || CODEX_BASE_URL).replace(/\/+$/, "");
 	}
 	if (authCredentialType === "oauth") return DEFAULT_OPENAI_BASE_URL;
-	const envBaseUrl = $env.OPENAI_BASE_URL?.trim();
+	// Trusted sources only: this base URL becomes the endpoint for authenticated
+	// image requests, and `$env` merges the caller's `cwd/.env`.
+	const envBaseUrl = $credentialEnv("OPENAI_BASE_URL");
 	const configuredBaseUrl = model.baseUrl?.trim();
 	if (envBaseUrl && (!configuredBaseUrl || configuredBaseUrl.toLowerCase().includes("api.openai.com"))) {
 		return envBaseUrl.replace(/\/+$/, "");
@@ -1114,6 +1133,11 @@ function getOpenAIBaseUrl(model: Model, authCredentialType?: "api_key" | "oauth"
 	return (configuredBaseUrl || envBaseUrl || DEFAULT_OPENAI_BASE_URL).replace(/\/+$/, "");
 }
 
+/** Test seam: the image-request base URL as resolved from trusted env. */
+export function getOpenAIImageBaseUrlForTest(model: Model, authCredentialType?: "api_key" | "oauth"): string {
+	return getOpenAIBaseUrl(model, authCredentialType);
+}
+
 function getOpenAIResponsesUrl(model: Model, authCredentialType?: "api_key" | "oauth"): string {
 	const baseUrl = getOpenAIBaseUrl(model, authCredentialType);
 	if (model.api !== "openai-codex-responses" && model.provider !== "openai-codex") {

package/src/tools/index.ts

@@ -292,6 +292,8 @@ export interface ToolSession {
 	strictToolNames?: boolean;
 	/** Get artifacts directory for artifact:// URLs */
 	getArtifactsDir?: () => string | null;
+	/** Additional artifacts directories explicitly authorized for this session's tree (parent/child/sibling reads). Derived only from the explicitly adopted/shared `ArtifactManager`; never enumerates unrelated live sessions. */
+	getAuthorizedArtifactsDirs?: () => readonly string[];
 	/** Get the ArtifactManager backing this session (shared across parent + subagents). */
 	getArtifactManager?: () => ArtifactManager | null;
 	/** Allocate a new artifact path and ID for session-scoped truncated output. */
@@ -314,6 +316,8 @@ export interface ToolSession {
 	settings: Settings;
 	/** Live service-tier intent of the parent session, inherited by `inherit` subagents. */
 	serviceTier?: ServiceTier;
+	/** Whether the effective subagent tier grants fast mode for a resolved provider. */
+	isFastForSubagentProvider?: (provider?: string) => boolean;
 	/** Plan mode state (if active) */
 	getPlanModeState?: () => PlanModeState | undefined;
 	/** Goal mode state (if active or paused) */