@gajae-code/coding-agent 0.11.4 → 0.11.6

package/src/tool-discovery/tool-index.ts

@@ -65,6 +65,24 @@ export function isMCPToolName(name: string): boolean {
 	return name.startsWith("mcp__");
 }
 
+/** Select persisted built-in discoveries that remain eligible in the current registry, allowlist, and baseline policy. */
+export function selectRestorableDiscoveredBuiltinToolNames(
+	toolNames: Iterable<string>,
+	toolRegistry: ReadonlyMap<string, AgentTool>,
+	allowedNames?: ReadonlySet<string>,
+	excludedNames?: ReadonlySet<string>,
+): string[] {
+	const selected: string[] = [];
+	for (const name of toolNames) {
+		const tool = toolRegistry.get(name);
+		if (tool?.loadMode !== "discoverable") continue;
+		if (allowedNames && !allowedNames.has(name)) continue;
+		if (excludedNames?.has(name)) continue;
+		if (!selected.includes(name)) selected.push(name);
+	}
+	return selected;
+}
+
 export function isMCPBridgeTool(tool: { name: string; mcpServerName?: unknown; mcpToolName?: unknown }): boolean {
 	return (
 		isMCPToolName(tool.name) &&

package/src/tools/ask-answer-registry.ts

@@ -7,6 +7,7 @@
  * source; registering returns a disposer.
  */
 
+import { logger } from "@gajae-code/utils";
 import type { WorkflowGateEmitter } from "../modes/shared/agent-wire/workflow-gate-broker";
 import type { AskAnswerSource } from "./index";
 
@@ -31,7 +32,20 @@ export function getAskAnswerSource(sessionId: string): AskAnswerSource | undefin
 export function notifyWorkflowGateEmitterChanged(sessionId: string, emitter: WorkflowGateEmitter | undefined): void {
 	if (emitter) workflowGateEmitters.set(sessionId, emitter);
 	else workflowGateEmitters.delete(sessionId);
-	for (const listener of workflowGateListeners.get(sessionId) ?? []) listener(emitter);
+	for (const listener of workflowGateListeners.get(sessionId) ?? []) {
+		// Isolate each listener: a throwing observer must never escape into an
+		// emitter suspend/bind/restore step, which runs inside session-transition
+		// transactions (e.g. handoff) whose rollback/commit correctness depends on
+		// this notification being no-throw.
+		try {
+			listener(emitter);
+		} catch (error) {
+			logger.warn("Workflow-gate emitter listener threw during notification", {
+				sessionId,
+				error: error instanceof Error ? error.message : String(error),
+			});
+		}
+	}
 }
 
 /** Observe workflow-gate emitter installation even when it occurs after session_start. */

package/src/tools/ask.ts

@@ -37,11 +37,18 @@ import {
 import type { RenderResultOptions } from "../extensibility/custom-tools/types";
 import { appendOrMergeDeepInterviewRound, syncDeepInterviewRecorderHud } from "../gjc-runtime/deep-interview-recorder";
 import { deepInterviewStatePath } from "../gjc-runtime/deep-interview-runtime";
+import {
+	assertDeepInterviewInputWithinLimit,
+	assertDeepInterviewStructuredResponseWithinLimit,
+	deepInterviewCharacterCount,
+	MAX_USER_RESPONSE_LENGTH,
+} from "../gjc-runtime/deep-interview-state";
 import {
 	type AskGateQuestion,
 	gateAnswerToResult,
 	questionToGate,
 } from "../modes/shared/agent-wire/deep-interview-gate";
+
 import { getMarkdownTheme, type Theme, theme } from "../modes/theme/theme";
 import askDescription from "../prompts/tools/ask.md" with { type: "text" };
 import { renderStatusLine } from "../tui";
@@ -63,15 +70,35 @@ import { assertUltragoalAskAllowed } from "./ultragoal-ask-guard";
 // Types
 // =============================================================================
 
+function deepInterviewBoundedString(maximum: number) {
+	return z.string().superRefine((value, context) => {
+		if (deepInterviewCharacterCount(value) > maximum)
+			context.addIssue({
+				code: "too_big",
+				maximum,
+				inclusive: true,
+				origin: "string",
+				message: `Too big: expected string to have <=${maximum} characters`,
+			});
+	});
+}
+
 const OptionItem = z.object({
 	label: z.string().describe("display label"),
 });
 
+const DEEP_INTERVIEW_INTENT_ID_PATTERN = /^(artifact|surface|integration|constraint):[a-z0-9][a-z0-9._/-]{0,127}$/;
+
+const DeepInterviewReferenceId = z.string().superRefine((value, context) => {
+	if (!DEEP_INTERVIEW_INTENT_ID_PATTERN.test(value))
+		context.addIssue({ code: "custom", message: "invalid deep-interview intent ID" });
+});
+
 const DeepInterviewIntentItem = z
 	.object({
-		id: z.string().regex(/^(artifact|surface|integration|constraint):[a-z0-9][a-z0-9._/-]{0,127}$/),
+		id: z.string().regex(DEEP_INTERVIEW_INTENT_ID_PATTERN),
 		category: z.enum(["artifact", "surface", "integration", "constraint"]),
-		statement: z.string().min(1).max(1_000),
+		statement: deepInterviewBoundedString(1_000).min(1),
 	})
 	.strict()
 	.superRefine((value, context) => {
@@ -82,7 +109,7 @@ const DeepInterviewIntentItem = z
 const DeepInterviewIntentContract = z
 	.object({
 		items: z.array(DeepInterviewIntentItem).min(1).max(64),
-		confirmation_options: z.array(z.string().min(1).max(200)).min(1).max(5),
+		confirmation_options: z.array(deepInterviewBoundedString(200).min(1)).min(1).max(5),
 	})
 	.strict();
 
@@ -93,43 +120,57 @@ const DeepInterviewIntentReview = z
 			.array(
 				z
 					.object({
-						removed_id: z
-							.string()
-							.regex(/^(artifact|surface|integration|constraint):[a-z0-9][a-z0-9._/-]{0,127}$/),
-						replacement_ids: z
-							.array(z.string().regex(/^(artifact|surface|integration|constraint):[a-z0-9][a-z0-9._/-]{0,127}$/))
-							.min(1)
-							.max(64),
-						rationale: z.string().min(1).max(500),
+						removed_id: DeepInterviewReferenceId,
+						replacement_ids: z.array(DeepInterviewReferenceId).min(1).max(64),
+						rationale: deepInterviewBoundedString(500).min(1),
 					})
 					.strict(),
 			)
 			.max(64),
-		approval_options: z.array(z.string().min(1).max(200)).min(1).max(5),
+		approval_options: z.array(deepInterviewBoundedString(200).min(1)).min(1).max(5),
 	})
 	.strict();
 
 /** Optional structured deep-interview round metadata; when present the round is recorded automatically. */
 const DeepInterviewMetadata = z.object({
-	round_id: z.string().max(128).describe("stable optional round identity").optional(),
+	round_id: deepInterviewBoundedString(128).describe("stable optional round identity").optional(),
 	round: z.number().int().nonnegative().describe("round number"),
-	component: z.string().min(1).max(128).describe("targeted topology component"),
-	dimension: z.string().min(1).max(128).describe("targeted clarity dimension"),
+	component: deepInterviewBoundedString(128).min(1).describe("targeted topology component"),
+	dimension: deepInterviewBoundedString(128).min(1).describe("targeted clarity dimension"),
 	ambiguity: z.number().min(0).max(1).describe("ambiguity at ask time (0..1)"),
+	confused_terms: z
+		.array(deepInterviewBoundedString(256).min(1))
+		.max(32)
+		.describe("explicit terms the user does not understand; glossary help only, never inferred")
+		.optional(),
+	references: z
+		.array(
+			z
+				.object({
+					reference_id: deepInterviewBoundedString(256).min(1),
+					label: deepInterviewBoundedString(256).min(1),
+					origin: deepInterviewBoundedString(256).min(1),
+					url: deepInterviewBoundedString(2048).min(1).optional(),
+					excerpt: deepInterviewBoundedString(2048).min(1).optional(),
+				})
+				.strict(),
+		)
+		.max(32)
+		.describe("inert reference context for contrast questions only; url/excerpt are never auto-fetched")
+		.optional(),
 });
 
-/** Provider-visible branches keep ordinary, contract, and review metadata mutually exclusive. */
 const DeepInterviewMeta = z.union([
 	DeepInterviewMetadata.strict(),
 	DeepInterviewMetadata.extend({
-		round: z.literal(0).describe("round number"),
-		component: z.literal("review-topology").describe("targeted topology component"),
-		dimension: z.literal("topology").describe("targeted clarity dimension"),
-		intent_contract: DeepInterviewIntentContract.describe("Round-0 locked intent contract"),
+		round: z.literal(0),
+		component: z.literal("review-topology"),
+		dimension: z.literal("topology"),
+		intent_contract: DeepInterviewIntentContract,
 	}).strict(),
 	DeepInterviewMetadata.extend({
-		round: z.number().int().positive().describe("round number"),
-		intent_review: DeepInterviewIntentReview.describe("Locked-intent reduction review"),
+		round: z.number().int().positive(),
+		intent_review: DeepInterviewIntentReview,
 	}).strict(),
 ]);
 
@@ -164,6 +205,29 @@ const QuestionItem = z
 		const labels = new Set(value.options.map(option => option.label));
 		const contract = intentContract(value.deepInterview);
 		const review = intentReview(value.deepInterview);
+		if (contract && review)
+			context.addIssue({
+				code: "custom",
+				message: "intent contract and review are mutually exclusive",
+				path: ["deepInterview"],
+			});
+		if (
+			contract &&
+			(value.deepInterview?.round !== 0 ||
+				value.deepInterview.component !== "review-topology" ||
+				value.deepInterview.dimension !== "topology")
+		)
+			context.addIssue({
+				code: "custom",
+				message: "intent contract requires round-0 review topology metadata",
+				path: ["deepInterview"],
+			});
+		if (review && (value.deepInterview?.round ?? 0) <= 0)
+			context.addIssue({
+				code: "custom",
+				message: "intent review requires a positive round",
+				path: ["deepInterview", "round"],
+			});
 		if ((contract || review) && value.multi === true)
 			context.addIssue({ code: "custom", message: "intent gates must be single-select", path: ["multi"] });
 		const confirmationOptions = contract?.confirmation_options ?? [];
@@ -211,7 +275,11 @@ function isPlainRecord(value: unknown): value is Record<string, unknown> {
 }
 
 function isOnlyPlainData(value: unknown): boolean {
-	if (Array.isArray(value)) return value.every(isOnlyPlainData);
+	if (Array.isArray(value))
+		return (
+			Reflect.ownKeys(value).length === value.length + 1 &&
+			value.every((item, index) => Object.hasOwn(value, index) && isOnlyPlainData(item))
+		);
 	if (typeof value !== "object" || value === null) return true;
 	return isPlainRecord(value) && Object.values(value).every(isOnlyPlainData);
 }
@@ -270,11 +338,27 @@ function normalizeRoundZeroOptionalNulls(arguments_: Record<string, unknown>): R
 		}
 	}
 	const normalizedDeepInterview = { ...question.deepInterview };
-	if (Object.hasOwn(normalizedDeepInterview, "round_id") && normalizedDeepInterview.round_id === null) {
-		delete normalizedDeepInterview.round_id;
-		normalizedQuestion.deepInterview = normalizedDeepInterview;
-		changed = true;
+	for (const key of ["round_id", "confused_terms", "references"] as const) {
+		if (Object.hasOwn(normalizedDeepInterview, key) && normalizedDeepInterview[key] === null) {
+			delete normalizedDeepInterview[key];
+			changed = true;
+		}
 	}
+	if (Array.isArray(normalizedDeepInterview.references)) {
+		const references = normalizedDeepInterview.references.map(reference => {
+			if (!isPlainRecord(reference)) return reference;
+			const normalizedReference = { ...reference };
+			for (const key of ["url", "excerpt"] as const) {
+				if (Object.hasOwn(normalizedReference, key) && normalizedReference[key] === null) {
+					delete normalizedReference[key];
+					changed = true;
+				}
+			}
+			return normalizedReference;
+		});
+		normalizedDeepInterview.references = references;
+	}
+	if (changed) normalizedQuestion.deepInterview = normalizedDeepInterview;
 	return changed ? { ...arguments_, questions: [normalizedQuestion] } : arguments_;
 }
 function recoverRoundZeroIntentContract(arguments_: Record<string, unknown>): RawArgumentValidationResult {
@@ -332,6 +416,8 @@ function recoverRoundZeroIntentContract(arguments_: Record<string, unknown>): Ra
 		"component",
 		"dimension",
 		"ambiguity",
+		"confused_terms",
+		"references",
 		"intent_contract",
 		"intent_review",
 	];
@@ -986,7 +1072,9 @@ export class AskTool implements AgentTool<typeof askSchema, AskToolDetails> {
 	}
 
 	static createIf(session: ToolSession): AskTool | null {
-		return session.hasUI || session.getWorkflowGateEmitter?.() ? new AskTool(session) : null;
+		return session.hasUI || session.workflowGateEligible || session.getWorkflowGateEmitter?.()
+			? new AskTool(session)
+			: null;
 	}
 
 	/** Send terminal notification when ask tool is waiting for input */
@@ -1007,6 +1095,8 @@ export class AskTool implements AgentTool<typeof askSchema, AskToolDetails> {
 		customInput: string | undefined,
 	): Promise<void> {
 		const meta = q.deepInterview;
+		if (customInput !== undefined && (meta || isDeepInterviewAskQuestion(q.question)))
+			assertDeepInterviewInputWithinLimit(customInput, MAX_USER_RESPONSE_LENGTH, "user_response");
 		if (!meta) return;
 		const cwd = this.session.cwd;
 		const sessionId = this.session.getSessionId?.() ?? undefined;
@@ -1047,6 +1137,7 @@ export class AskTool implements AgentTool<typeof askSchema, AskToolDetails> {
 			activeSkillState: this.session.getActiveSkillState?.(),
 			sessionId: this.session.getSessionId?.() ?? null,
 		});
+		assertDeepInterviewStructuredResponseWithinLimit(params);
 		let activeRemoteReceipt: AskRemoteReceipt | undefined;
 		let activeRemoteRequest: AskAnswerRequest | undefined;
 		let remoteGeneration = 0;
@@ -1391,6 +1482,8 @@ export class AskTool implements AgentTool<typeof askSchema, AskToolDetails> {
 							return displayIndex >= 0 ? (rawOptionLabels[displayIndex] ?? selected) : selected;
 						})
 					: displaySelectedOptions;
+				if ((isDeepInterviewQuestion || isDeepInterviewAskQuestion(q.question)) && customInput !== undefined)
+					assertDeepInterviewInputWithinLimit(customInput, MAX_USER_RESPONSE_LENGTH, "user_response");
 				if (activeRemoteReceipt) {
 					const settlement: AskSettlement =
 						clarificationQuestion !== undefined
@@ -1425,10 +1518,14 @@ export class AskTool implements AgentTool<typeof askSchema, AskToolDetails> {
 					timedOut,
 				};
 			} catch (error) {
-				await settleActiveRemote({
-					kind: "resolve_without_commit",
-					reason: error instanceof Error && error.name === "AbortError" ? "aborted" : "exception",
-				});
+				await settleActiveRemote(
+					error instanceof Error && error.message.includes("exceeds max length")
+						? { kind: "invalid", reason: "invalid_structured_answer" }
+						: {
+								kind: "resolve_without_commit",
+								reason: error instanceof Error && error.name === "AbortError" ? "aborted" : "exception",
+							},
+				);
 				activeRemoteRequest = undefined;
 				if (error instanceof Error && error.name === "AbortError") {
 					throw new ToolAbortError("Ask input was cancelled");

package/src/tools/bash-skill-urls.ts

@@ -1,7 +1,7 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type { Skill } from "../extensibility/skills";
-import { type LocalProtocolOptions, resolveLocalUrlToPath } from "../internal-urls";
+import { initializeLocalRoot, type LocalProtocolOptions, resolveLocalUrlToPath } from "../internal-urls";
 import { validateRelativePath } from "../internal-urls/skill-protocol";
 import type { InternalResource } from "../internal-urls/types";
 import { normalizeLocalScheme } from "./path-utils";
@@ -162,12 +162,23 @@ async function resolveInternalUrlToPath(
 		return resolveSkillUrlToPath(url, skills);
 	}
 
+	// Managed artifact and agent resources carry session authority. Expanding
+	// either into a subprocess command would let that subprocess reopen, replace,
+	// or unlink the managed object by pathname. Keep those resources behind the
+	// internal reader boundary.
+	if (scheme === "artifact" || scheme === "agent") {
+		throw new ToolError(
+			`${scheme}:// URLs cannot be expanded in bash commands; read them through the internal reader instead.`,
+		);
+	}
+
 	if (scheme === "local") {
 		if (!localOptions) {
 			throw new ToolError(
 				"Cannot resolve local:// URL in bash command: local protocol options are unavailable for this session.",
 			);
 		}
+		await initializeLocalRoot(localOptions);
 		const resolvedLocalPath = resolveLocalUrlToPath(url, localOptions);
 		if (ensureLocalParentDirs) {
 			await fs.mkdir(path.dirname(resolvedLocalPath), { recursive: true });
@@ -215,8 +226,8 @@ export function expandSkillUrls(command: string, skills: readonly Skill[]): stri
 }
 
 /**
- * Expand supported internal URLs in a bash command string to shell-escaped absolute paths.
- * Supported schemes: skill://, agent://, artifact://, memory://, rule://, local://
+ * Expand filesystem-safe internal URLs in a bash command string. `agent://` and
+ * `artifact://` remain internal-reader-only and are rejected before resolution.
  */
 export async function expandInternalUrls(command: string, options: InternalUrlExpansionOptions): Promise<string> {
 	if (!command.includes("://") && !command.includes("local:/")) return command;

package/src/tools/bash.ts

@@ -636,6 +636,7 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			internalRouter: InternalUrlRouter.instance(),
 			localOptions: {
 				getArtifactsDir: this.session.getArtifactsDir,
+				isManagedDestination: this.session.isManagedSessionDestination,
 				getSessionId: this.session.getSessionId,
 			},
 		};
@@ -643,7 +644,6 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			...internalUrlOptions,
 			ensureLocalParentDirs: this.session.bashRestrictionProfile !== "read-only",
 		});
-		const sessionFile = this.session.getSessionFile?.() ?? null;
 		const expandedEnv = env
 			? Object.fromEntries(
 					await Promise.all(
@@ -662,7 +662,7 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			: undefined;
 		const resolvedEnv = {
 			...buildGjcRuntimeSessionEnv({
-				sessionFile,
+				sessionFile: null,
 				sessionId: this.session.getSessionId?.(),
 				cwd: this.session.cwd,
 			}),

package/src/tools/index.ts

@@ -216,6 +216,8 @@ export interface ToolSession {
 	cwd: string;
 	/** Whether UI is available */
 	hasUI: boolean;
+	/** Whether this session will bind a workflow-gate emitter after tool construction. */
+	workflowGateEligible?: boolean;
 	/** Skip Python kernel availability check and warmup */
 	skipPythonPreflight?: boolean;
 	/** Pre-loaded context files (AGENTS.md, etc) */
@@ -262,6 +264,8 @@ export interface ToolSession {
 	requestForegroundBashBackground?: () => boolean;
 	/** Get session ID */
 	getSessionId?: () => string | null;
+	/** Whether local:// must use external managed scratch instead of artifacts/local. */
+	isManagedSessionDestination?: () => boolean;
 	/** Get Hindsight runtime state for this agent session. */
 	getHindsightSessionState?: () => HindsightSessionState | undefined;
 	/** Agent identity used for IRC routing. Returns the registry id (e.g. "0-Main", "0-AuthLoader"). */

package/src/tools/plan-mode-guard.ts

@@ -11,6 +11,7 @@ function resolveRawPath(session: ToolSession, targetPath: string): string {
 	if (normalized.startsWith(LOCAL_SCHEME_PREFIX)) {
 		return resolveLocalUrlToPath(normalized, {
 			getArtifactsDir: session.getArtifactsDir,
+			isManagedDestination: session.isManagedSessionDestination,
 			getSessionId: session.getSessionId,
 		});
 	}

package/src/tools/sqlite-reader.ts

@@ -12,6 +12,7 @@ const MAX_QUERY_LIMIT = 500;
 const MAX_RENDER_WIDTH = 120;
 const MAX_COLUMN_WIDTH = 40;
 const MIN_COLUMN_WIDTH = 1;
+const SQLITE_USER_TABLE_PREDICATE = "name NOT LIKE 'sqlite!_%' ESCAPE '!'";
 
 type SqliteBinding = Exclude<SQLQueryBindings, Record<string, unknown>>;
 
@@ -182,7 +183,7 @@ function getTableMasterRow(db: Database, table: string): SqliteMasterRow {
 	const row =
 		db
 			.prepare<SqliteMasterRow, [string]>(
-				"SELECT name, sql FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' AND name = ?",
+				`SELECT name, sql FROM sqlite_master WHERE type = 'table' AND ${SQLITE_USER_TABLE_PREDICATE} AND name = ?`,
 			)
 			.get(table) ?? null;
 	if (!row) {
@@ -502,7 +503,7 @@ export function parseSqliteSelector(subPath: string, queryString: string): Sqlit
 export function listTables(db: Database): { name: string; rowCount: number }[] {
 	const names = db
 		.prepare<Pick<SqliteMasterRow, "name">, []>(
-			"SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name COLLATE NOCASE",
+			`SELECT name FROM sqlite_master WHERE type = 'table' AND ${SQLITE_USER_TABLE_PREDICATE} ORDER BY name COLLATE NOCASE`,
 		)
 		.all();
 

package/src/tools/subagent.ts

@@ -227,6 +227,8 @@ export class SubagentTool implements AgentTool<typeof subagentSchema, SubagentTo
 				if (!result.ok && result.reason === "context_unavailable") throw new ToolError("context unavailable");
 				if (!result.ok && result.reason === "not_found") {
 					missing.push(this.#missingSnapshot(id, "not_found", "No visible detached subagent matches this id."));
+				} else if (!result.ok) {
+					throw new ToolError(`Failed to resume subagent ${record.subagentId}: ${result.reason ?? "unknown"}.`);
 				} else {
 					records.push(manager.getSubagentRecord(record.subagentId, ownerFilter) ?? record);
 				}