@gajae-code/coding-agent 0.11.4 → 0.11.6

package/src/extensibility/plugins/marketplace/manager.ts

@@ -12,12 +12,11 @@ import * as path from "node:path";
 
 import { isEnoent, logger, pathIsWithin } from "@gajae-code/utils";
 
-import { cachePlugin } from "./cache";
+import { cachePlugin, getCachedPluginPath } from "./cache";
 import { classifySource, fetchMarketplace, parseMarketplaceCatalog, promoteCloneToCache } from "./fetcher";
 import {
 	addInstalledPlugin,
 	addMarketplaceEntry,
-	collectReferencedPaths,
 	getInstalledPlugin,
 	getMarketplaceEntry,
 	readInstalledPluginsRegistry,
@@ -255,6 +254,7 @@ export class MarketplaceManager {
 		if (existing && existing.length > 0 && !force) {
 			throw new Error(`Plugin "${pluginId}" is already installed. Use force option to reinstall.`);
 		}
+		const existingCachePaths = existing ? await this.#validateCacheDeletionTargets(pluginId, existing) : [];
 
 		// 4. Resolve source path.
 		// marketplaceClonePath is the marketplace root — the directory containing .Anthropic model-plugin/
@@ -289,6 +289,9 @@ export class MarketplaceManager {
 		let cachePath!: string;
 		try {
 			version = await this.#resolvePluginVersion(pluginEntry, sourcePath);
+			if ([marketplace, name, version].some(component => /[. ]$/.test(component))) {
+				throw new Error(`Invalid cache identity for plugin "${pluginId}"`);
+			}
 			cachePath = await cachePlugin(sourcePath, this.#opts.pluginsCacheDir, marketplace, name, version);
 			await this.#writeEmbeddedLspConfig(pluginEntry, cachePath);
 		} finally {
@@ -311,11 +314,13 @@ export class MarketplaceManager {
 					? readInstalledPluginsRegistry(this.#opts.projectInstalledRegistryPath)
 					: Promise.resolve({ version: 2 as const, plugins: {} as Record<string, InstalledPluginEntry[]> }),
 			]);
-			const referenced = collectReferencedPaths(userReg, projectReg);
+			const referenced = this.#collectReferencedCacheIdentities(userReg, projectReg);
+			const cachePathIdentity = this.#cacheDeletionIdentity(cachePath);
 
-			for (const entry of existing) {
-				if (entry.installPath !== cachePath && !referenced.has(entry.installPath)) {
-					await fs.rm(entry.installPath, { recursive: true, force: true });
+			for (const existingCachePath of existingCachePaths) {
+				const existingIdentity = this.#cacheDeletionIdentity(existingCachePath);
+				if (existingIdentity !== cachePathIdentity && !referenced.has(existingIdentity)) {
+					await fs.rm(existingCachePath, { recursive: true, force: true });
 				}
 			}
 		}
@@ -395,6 +400,84 @@ export class MarketplaceManager {
 		return "0.0.0";
 	}
 
+	async #validateCacheDeletionTargets(pluginId: string, entries: readonly InstalledPluginEntry[]): Promise<string[]> {
+		const parsed = parsePluginId(pluginId);
+		if (!parsed) {
+			throw new Error(`Invalid plugin ID format: "${pluginId}". Expected "name@marketplace".`);
+		}
+
+		const targets: string[] = [];
+		for (const entry of entries) {
+			if ([parsed.marketplace, parsed.name, entry.version].some(component => /[. ]$/.test(component))) {
+				throw new Error(`Refusing to remove plugin "${pluginId}": invalid recorded cache identity`);
+			}
+
+			let targetPath: string;
+			try {
+				targetPath = getCachedPluginPath(
+					this.#opts.pluginsCacheDir,
+					parsed.marketplace,
+					parsed.name,
+					entry.version,
+				);
+			} catch (error) {
+				throw new Error(`Refusing to remove plugin "${pluginId}": invalid recorded cache identity`, {
+					cause: error,
+				});
+			}
+
+			if (entry.installPath !== targetPath) {
+				throw new Error(`Refusing to remove plugin "${pluginId}": recorded install path is not its cache path`);
+			}
+
+			try {
+				const stat = await fs.lstat(targetPath);
+				if (stat.isSymbolicLink()) {
+					throw new Error(`Refusing to remove plugin "${pluginId}": cache path is a symbolic link or junction`);
+				}
+			} catch (error) {
+				if (!isEnoent(error)) throw error;
+			}
+
+			targets.push(targetPath);
+		}
+		return targets;
+	}
+
+	#cacheDeletionIdentity(cachePath: string): string {
+		// Model Windows path identity on every host so reference protection is
+		// deterministic: case is ignored and trailing dots/spaces are discarded.
+		return path
+			.resolve(cachePath)
+			.split(path.sep)
+			.map(component => component.replace(/[. ]+$/, "").toLowerCase())
+			.join(path.sep);
+	}
+
+	#collectReferencedCacheIdentities(...registries: InstalledPluginsRegistry[]): Set<string> {
+		const identities = new Set<string>();
+		for (const registry of registries) {
+			for (const [pluginId, entries] of Object.entries(registry.plugins)) {
+				const parsed = parsePluginId(pluginId);
+				if (!parsed) continue;
+				for (const entry of entries) {
+					try {
+						const cachePath = getCachedPluginPath(
+							this.#opts.pluginsCacheDir,
+							parsed.marketplace,
+							parsed.name,
+							entry.version,
+						);
+						identities.add(this.#cacheDeletionIdentity(cachePath));
+					} catch {
+						// Invalid registry entries cannot identify a permitted cache target.
+					}
+				}
+			}
+		}
+		return identities;
+	}
+
 	async uninstallPlugin(pluginId: string, scope?: "user" | "project"): Promise<void> {
 		const parsed = parsePluginId(pluginId);
 		if (!parsed) {
@@ -434,6 +517,7 @@ export class MarketplaceManager {
 		const targetEntries = targetScope === "project" ? projectEntries! : userEntries!;
 		const targetReg = targetScope === "project" ? projectReg : userReg;
 		const registryPath = this.#registryPath(targetScope);
+		const targetCachePaths = await this.#validateCacheDeletionTargets(pluginId, targetEntries);
 
 		const updatedReg = removeInstalledPlugin(targetReg, pluginId);
 		await writeInstalledPluginsRegistry(registryPath, updatedReg);
@@ -445,11 +529,11 @@ export class MarketplaceManager {
 				? readInstalledPluginsRegistry(this.#opts.projectInstalledRegistryPath)
 				: Promise.resolve({ version: 2 as const, plugins: {} as Record<string, InstalledPluginEntry[]> }),
 		]);
-		const referenced = collectReferencedPaths(freshUserReg, freshProjectReg);
+		const referenced = this.#collectReferencedCacheIdentities(freshUserReg, freshProjectReg);
 
-		for (const entry of targetEntries) {
-			if (!referenced.has(entry.installPath)) {
-				await fs.rm(entry.installPath, { recursive: true, force: true });
+		for (const targetCachePath of targetCachePaths) {
+			if (!referenced.has(this.#cacheDeletionIdentity(targetCachePath))) {
+				await fs.rm(targetCachePath, { recursive: true, force: true });
 			}
 		}
 

package/src/gjc-runtime/deep-interview-recorder.ts

@@ -8,7 +8,9 @@ import {
 } from "./deep-interview-ambiguity";
 import {
 	answerHash,
+	assertDeepInterviewInputWithinLimit,
 	assertDeepInterviewIntentManifest,
+	assertDeepInterviewStructuredResponseWithinLimit,
 	createDeepInterviewIntentManifest,
 	type DeepInterviewEstablishedFact,
 	type DeepInterviewIntentItem,
@@ -17,6 +19,7 @@ import {
 	type DeepInterviewStateEnvelope,
 	type DeepInterviewTriggerMetadata,
 	deriveRoundKey,
+	MAX_USER_RESPONSE_LENGTH,
 	normalizeDeepInterviewEnvelope,
 	questionHash,
 	reviewDeepInterviewIntent,
@@ -426,6 +429,9 @@ export async function appendOrMergeDeepInterviewRound(
 	input: DeepInterviewAnswerInput,
 	options: { sessionId?: string } = {},
 ): Promise<{ action: AppendOrMergeAction; record: DeepInterviewRoundRecord; disputedFactIds?: string[] }> {
+	assertDeepInterviewStructuredResponseWithinLimit(input);
+	if (input.customInput !== undefined)
+		assertDeepInterviewInputWithinLimit(input.customInput, MAX_USER_RESPONSE_LENGTH, "user_response");
 	const envelope = await readEnvelope(statePath);
 	const interviewId = input.interviewId ?? interviewIdOf(envelope);
 	const shell = buildAnswerShell({
@@ -547,6 +553,7 @@ export async function enrichDeepInterviewRoundScoring(
 	input: DeepInterviewScoringInput,
 	options: { sessionId?: string } = {},
 ): Promise<{ record: DeepInterviewRoundRecord }> {
+	assertDeepInterviewStructuredResponseWithinLimit(input);
 	const envelope = await readEnvelope(statePath);
 	const interviewId = input.interviewId ?? interviewIdOf(envelope);
 	const rounds = readRounds(envelope);

package/src/gjc-runtime/deep-interview-runtime.ts

@@ -7,11 +7,14 @@ import { syncSkillActiveState } from "../skill-state/active-state";
 import { deriveDeepInterviewHud } from "../skill-state/workflow-hud";
 import { WORKFLOW_STATE_VERSION } from "../skill-state/workflow-state-contract";
 import {
+	assertDeepInterviewInputWithinLimit,
 	assertDeepInterviewIntentReview,
 	type DeepInterviewIntentCategory,
 	type DeepInterviewIntentItem,
 	type DeepInterviewIntentManifest,
 	type DeepInterviewIntentReview,
+	MAX_DEEP_INTERVIEW_STRUCTURED_RESPONSE_LENGTH,
+	MAX_INITIAL_CONTEXT_LENGTH,
 	normalizeDeepInterviewEnvelope,
 	reviewDeepInterviewIntent,
 } from "./deep-interview-state";
@@ -559,6 +562,7 @@ async function resolveDeepInterviewArgs(args: readonly string[], cwd: string): P
 		ideaParts.push(arg);
 	}
 	const idea = ideaParts.join(" ").trim();
+	assertDeepInterviewInputWithinLimit(idea, MAX_INITIAL_CONTEXT_LENGTH, "initial_idea");
 	const effectiveResolution: DeepInterviewResolution = resolution ?? "standard";
 	const trace = hasFlag(args, "--trace") && idea ? await buildDeepInterviewTraceSummary(cwd, idea) : undefined;
 	return {
@@ -632,6 +636,11 @@ export async function persistDeepInterviewSpec(
 	cwd: string,
 	resolved: ResolvedDeepInterviewSpecWriteArgs,
 ): Promise<PersistedDeepInterviewSpec> {
+	assertDeepInterviewInputWithinLimit(
+		resolved.spec,
+		MAX_DEEP_INTERVIEW_STRUCTURED_RESPONSE_LENGTH,
+		"structured deep-interview response",
+	);
 	const statePath = deepInterviewStatePath(cwd, resolved.sessionId);
 	const existingRead = await readExistingStateForMutation(statePath);
 	if (existingRead.kind === "corrupt" && !resolved.force) {
@@ -731,6 +740,7 @@ export async function persistDeepInterviewSpec(
 
 async function seedDeepInterviewState(cwd: string, resolved: ResolvedDeepInterviewArgs): Promise<string> {
 	const statePath = deepInterviewStatePath(cwd, resolved.sessionId);
+	assertDeepInterviewInputWithinLimit(resolved.idea, MAX_INITIAL_CONTEXT_LENGTH, "initial_idea");
 	const now = new Date().toISOString();
 	const payload: Record<string, unknown> = {
 		active: true,

package/src/gjc-runtime/deep-interview-state.ts

@@ -397,6 +397,126 @@ const MAX_INTENT_STATEMENT_LENGTH = 1_000;
 const MAX_INTENT_RATIONALE_LENGTH = 500;
 const MAX_INTENT_EVIDENCE_LENGTH = 80;
 
+// =============================================================================
+// Input validation: free-text field allowlist + size limits (ouroboros parity)
+// =============================================================================
+
+/**
+ * User-input fields that legitimately carry prose (goals, prompts, descriptions,
+ * answers). Shell metacharacters (`;`, `|`, `&`, backticks, `$()`) are valid prose
+ * here and must NOT be rejected as structural injection. Structural fields (ids,
+ * categories, hashes) stay strictly validated by their own guards.
+ */
+export const DEEP_INTERVIEW_FREETEXT_FIELDS: ReadonlySet<string> = new Set([
+	"initial_context",
+	"initial_idea",
+	"initial_context_summary",
+	"user_response",
+	"answer",
+	"goal",
+	"objective",
+	"prompt",
+	"description",
+	"statement",
+	"restated_goal",
+	"evidence",
+	"excerpt",
+]);
+
+/** DoS-prevention character-count caps, matching ask-schema string-length semantics. */
+export const MAX_INITIAL_CONTEXT_LENGTH = 50_000;
+export const MAX_USER_RESPONSE_LENGTH = 10_000;
+/** Maximum serialized JavaScript-string length for one LLM-produced structured response. */
+export const MAX_DEEP_INTERVIEW_STRUCTURED_RESPONSE_LENGTH = 100_000;
+
+/** Count Unicode code points without allocating an intermediate character array. */
+export function deepInterviewCharacterCount(value: string): number {
+	let count = 0;
+	for (const _character of value) count++;
+	return count;
+}
+
+export function isDeepInterviewFreeTextField(name: string): boolean {
+	return DEEP_INTERVIEW_FREETEXT_FIELDS.has(name);
+}
+
+/**
+ * Assert that one structured deep-interview response is JSON-serializable and
+ * bounded by JavaScript string length. This deliberately does not measure or
+ * cap accumulated persisted interview state.
+ */
+export function assertDeepInterviewStructuredResponseWithinLimit(value: unknown): void {
+	let serialized: string | undefined;
+	try {
+		serialized = JSON.stringify(value, (_key, nestedValue: unknown) => {
+			if (
+				typeof nestedValue === "bigint" ||
+				typeof nestedValue === "function" ||
+				typeof nestedValue === "symbol" ||
+				(typeof nestedValue === "number" && !Number.isFinite(nestedValue))
+			)
+				throw new Error("invalid structured deep-interview response");
+			return nestedValue;
+		});
+	} catch {
+		throw new Error("invalid structured deep-interview response");
+	}
+	if (typeof serialized !== "string") throw new Error("invalid structured deep-interview response");
+	if (deepInterviewCharacterCount(serialized) > MAX_DEEP_INTERVIEW_STRUCTURED_RESPONSE_LENGTH)
+		throw new Error(
+			`structured deep-interview response exceeds max length ${MAX_DEEP_INTERVIEW_STRUCTURED_RESPONSE_LENGTH}`,
+		);
+}
+
+/**
+ * Assert a free-text input is within its size cap. Never inspects content for shell
+ * metacharacters — free-text fields accept prose verbatim; this only bounds length.
+ */
+export function assertDeepInterviewInputWithinLimit(value: string, max: number, fieldName = "input"): void {
+	if (typeof value !== "string") throw new Error(`${fieldName} must be a string`);
+	if (deepInterviewCharacterCount(value) > max) throw new Error(`${fieldName} exceeds max length ${max}`);
+}
+
+/** Validate user-supplied deep-interview prose before an envelope is persisted. */
+export function assertDeepInterviewEnvelopeInputLimits(envelope: Record<string, unknown>): void {
+	const state =
+		typeof envelope.state === "object" && envelope.state !== null && !Array.isArray(envelope.state)
+			? (envelope.state as Record<string, unknown>)
+			: {};
+	for (const field of ["initial_idea", "initial_context", "initial_context_summary"] as const) {
+		const nestedValue = state[field];
+		if (nestedValue !== undefined)
+			assertDeepInterviewInputWithinLimit(nestedValue as string, MAX_INITIAL_CONTEXT_LENGTH, `state.${field}`);
+		const topLevelValue = envelope[field];
+		if (topLevelValue !== undefined)
+			assertDeepInterviewInputWithinLimit(topLevelValue as string, MAX_INITIAL_CONTEXT_LENGTH, field);
+	}
+	for (const field of ["user_response", "answer"] as const) {
+		const nestedValue = state[field];
+		if (nestedValue !== undefined)
+			assertDeepInterviewInputWithinLimit(nestedValue as string, MAX_USER_RESPONSE_LENGTH, `state.${field}`);
+		const topLevelValue = envelope[field];
+		if (topLevelValue !== undefined)
+			assertDeepInterviewInputWithinLimit(topLevelValue as string, MAX_USER_RESPONSE_LENGTH, field);
+	}
+	if (!Array.isArray(state.rounds)) return;
+	for (const [index, round] of state.rounds.entries()) {
+		if (typeof round !== "object" || round === null || Array.isArray(round)) continue;
+		const record = round as Record<string, unknown>;
+		for (const field of ["custom_input", "customInput", "user_response", "answer"] as const) {
+			const value = record[field];
+			// A structured scorer may use an unrelated object-valued `answer`; only prose
+			// values in a legacy answer slot are user input subject to this cap.
+			if (value === undefined || (field === "answer" && typeof value !== "string")) continue;
+			assertDeepInterviewInputWithinLimit(
+				value as string,
+				MAX_USER_RESPONSE_LENGTH,
+				`state.rounds[${index}].${field}`,
+			);
+		}
+	}
+}
+
 export interface DeepInterviewIntentItem {
 	id: string;
 	category: DeepInterviewIntentCategory;
@@ -437,7 +557,7 @@ export function isCanonicalDeepInterviewAnswerHash(value: unknown): value is str
 function isEvidenceReference(value: unknown, answerHashValue: string): value is string {
 	return (
 		typeof value === "string" &&
-		value.length <= MAX_INTENT_EVIDENCE_LENGTH &&
+		deepInterviewCharacterCount(value) <= MAX_INTENT_EVIDENCE_LENGTH &&
 		value === `answer_hash:${answerHashValue}`
 	);
 }
@@ -451,7 +571,11 @@ function assertIntentItem(value: unknown): asserts value is DeepInterviewIntentI
 		!id.startsWith(`${category}:`)
 	)
 		throw new Error("invalid intent category");
-	if (typeof statement !== "string" || !statement.trim() || statement.length > MAX_INTENT_STATEMENT_LENGTH)
+	if (
+		typeof statement !== "string" ||
+		!statement.trim() ||
+		deepInterviewCharacterCount(statement) > MAX_INTENT_STATEMENT_LENGTH
+	)
 		throw new Error(`intent item ${id} requires a bounded statement`);
 }
 
@@ -541,7 +665,7 @@ export function reviewDeepInterviewIntent(
 			substitution.replacement_ids.some(id => typeof id !== "string" || !observedIds.has(id)) ||
 			typeof substitution.rationale !== "string" ||
 			!substitution.rationale.trim() ||
-			substitution.rationale.length > MAX_INTENT_RATIONALE_LENGTH
+			deepInterviewCharacterCount(substitution.rationale) > MAX_INTENT_RATIONALE_LENGTH
 		)
 			throw new Error("invalid intent substitution");
 	}

package/src/gjc-runtime/launch-tmux.ts

@@ -1,4 +1,3 @@
-import { Buffer } from "node:buffer";
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -6,6 +5,18 @@ import { VERSION } from "@gajae-code/utils/dirs";
 import { safeStderrWrite } from "@gajae-code/utils/safe-stderr";
 import type { Args } from "../cli/args";
 import { readLinuxProcStartTimeSync } from "./linux-proc";
+import {
+	MANAGED_OWNER_PREDECESSOR_GENERATION_ENV,
+	MANAGED_OWNER_PREDECESSOR_INCARNATION_ENV,
+	MANAGED_OWNER_PREDECESSOR_RUN_ID_ENV,
+	MANAGED_OWNER_PREDECESSOR_TOKEN_ENV,
+	MANAGED_OWNER_TRANSCRIPT_PATH_ENV,
+} from "./managed-owner-admission";
+import {
+	MANAGED_OWNER_INCARNATION_ENV,
+	MANAGED_OWNER_RUN_ID_ENV,
+	MANAGED_OWNER_SUPERVISOR_ARG,
+} from "./managed-owner-supervisor";
 import { tmuxRuntimeSessionPath } from "./session-layout";
 import {
 	GJC_COORDINATOR_SESSION_BRANCH_ENV,
@@ -42,6 +53,7 @@ import {
 	type OwnerIsolationProbeSync,
 	planTmuxOwnerIsolationSync,
 	replaceOwnerGenerationSync,
+	resolveManagedOwnerPredecessorSync,
 	type TmuxServerProof,
 } from "./tmux-owner-isolation";
 import {
@@ -152,6 +164,9 @@ export interface TmuxLaunchPlan {
 	sessionStateFile?: string | null;
 	/** Immutable Linux-managed owner provenance, assigned immediately before creation. */
 	ownerGeneration?: string;
+	/** Immutable run and endpoint identities bound into the supervised command. */
+	ownerRunId?: string;
+	ownerIncarnation?: string;
 	/** Generation state captured before owner-isolation planning; required for publication CAS. */
 	ownerGenerationBaseline?: import("./tmux-owner-isolation").OwnerGenerationBaseline;
 	/** Native tmux session identity emitted atomically by `new-session -P -F`. */
@@ -334,6 +349,7 @@ interface CommandResolutionContext {
 	extraEnv?: Record<string, string>;
 	tmuxExitMarkerPath?: string;
 	platform?: NodeJS.Platform;
+	managedOwnerSupervisor?: boolean;
 }
 
 function parseLaunchPolicy(env: NodeJS.ProcessEnv): LaunchPolicy {
@@ -553,8 +569,15 @@ function buildInnerCommand(context: CommandResolutionContext, rawArgs: string[])
 			tmuxExitMarkerPath: context.tmuxExitMarkerPath,
 		});
 	const command = resolveCurrentGjcCommand(context);
-	const quoted = [...command, ...stripRootTmuxFlag(rawArgs)].map(shellQuote).join(" ");
-	const invocation = `env ${GJC_TMUX_LAUNCHED_ENV}=1${buildEnvAssignments(context.extraEnv)} ${quoted}`;
+	const childArgs = stripRootTmuxFlag(rawArgs);
+	const supervisorEnv: Record<string, string> = context.managedOwnerSupervisor
+		? { GJC_MANAGED_OWNER_COMMAND_JSON: JSON.stringify([...command, ...childArgs]) }
+		: {};
+	const invocationArgs = context.managedOwnerSupervisor
+		? [...command, MANAGED_OWNER_SUPERVISOR_ARG]
+		: [...command, ...childArgs];
+	const quoted = invocationArgs.map(shellQuote).join(" ");
+	const invocation = `env ${GJC_TMUX_LAUNCHED_ENV}=1${buildEnvAssignments({ ...context.extraEnv, ...supervisorEnv })} ${quoted}`;
 	if (!context.tmuxExitMarkerPath) return `exec ${invocation}`;
 	return `${buildPosixTmuxExitMarkerPrefix(context.tmuxExitMarkerPath)}; ${invocation}; exit $?`;
 }
@@ -1026,15 +1049,29 @@ export function buildDefaultTmuxLaunchPlan(context: TmuxLaunchContext): TmuxLaun
 	};
 }
 
+function trustedReplacementAuthority(
+	stateDir: string,
+	sessionId: string,
+	baseline: ReturnType<typeof captureOwnerGenerationBaselineSync>,
+): ReturnType<typeof resolveManagedOwnerPredecessorSync> {
+	return resolveManagedOwnerPredecessorSync(stateDir, sessionId, baseline);
+}
+
 function prepareManagedOwnerLifecycle(plan: TmuxLaunchPlan, context: TmuxLaunchContext): void {
 	if (plan.ownerGeneration) return;
 	const sessionId = plan.sessionId ?? plan.sessionName;
 	const stateDir = path.dirname(plan.sessionStateFile ?? path.join(plan.cwd, ".gjc", "runtime"));
+	const baseline = captureOwnerGenerationBaselineSync(stateDir, sessionId);
+	const replacement = trustedReplacementAuthority(stateDir, sessionId, baseline);
 	const generation = crypto.randomUUID();
-	// Stage the generation in the child command. It becomes current only after
+	const runId = crypto.randomUUID();
+	const incarnation = crypto.randomUUID();
+	plan.ownerGenerationBaseline = baseline;
+	// Stage immutable identity in the child command. It becomes current only after
 	// immutable creation proof and ownership tagging complete.
-
 	plan.ownerGeneration = generation;
+	plan.ownerRunId = runId;
+	plan.ownerIncarnation = incarnation;
 	const innerCommand = buildInnerCommand(
 		{
 			cwd: plan.cwd,
@@ -1047,11 +1084,24 @@ function prepareManagedOwnerLifecycle(plan: TmuxLaunchPlan, context: TmuxLaunchC
 				[GJC_TMUX_OWNER_GENERATION_ENV]: generation,
 				[GJC_TMUX_OWNER_STATE_DIR_ENV]: stateDir,
 				[GJC_TMUX_OWNER_SERVER_KEY_ENV]: plan.tmuxCommand,
+				[MANAGED_OWNER_RUN_ID_ENV]: runId,
+				[MANAGED_OWNER_INCARNATION_ENV]: incarnation,
+				...(replacement
+					? {
+							[MANAGED_OWNER_PREDECESSOR_TOKEN_ENV]: replacement.predecessorToken,
+							[MANAGED_OWNER_PREDECESSOR_GENERATION_ENV]: replacement.generation,
+							[MANAGED_OWNER_PREDECESSOR_RUN_ID_ENV]: replacement.runId,
+							[MANAGED_OWNER_PREDECESSOR_INCARNATION_ENV]: replacement.incarnation,
+							[MANAGED_OWNER_TRANSCRIPT_PATH_ENV]:
+								context.env?.GJC_SESSION_FILE ?? process.env.GJC_SESSION_FILE ?? "",
+						}
+					: {}),
 			},
 			// Linux managed owner close signals the pane PID. Do not place the exit-marker shell
 			// in front of it; `buildInnerCommand` therefore execs the GJC owner directly.
 			tmuxExitMarkerPath: plan.platform === "linux" ? undefined : tmuxExitMarkerPath(plan.sessionStateFile ?? ""),
 			platform: plan.platform,
+			managedOwnerSupervisor: plan.platform === "linux",
 		},
 		context.rawArgs,
 	);
@@ -1182,7 +1232,7 @@ function createIsolatedTmuxSession(
 ): TmuxSpawnResult {
 	const sessionId = plan.sessionId ?? plan.sessionName;
 	const stateDir = path.dirname(plan.sessionStateFile ?? path.join(plan.cwd, ".gjc", "runtime"));
-	const baseline = captureOwnerGenerationBaselineSync(stateDir, sessionId);
+	const baseline = plan.ownerGenerationBaseline ?? captureOwnerGenerationBaselineSync(stateDir, sessionId);
 	plan.ownerGenerationBaseline = baseline;
 	const ownerPlan = planTmuxOwnerIsolationSync(
 		{
@@ -1572,6 +1622,11 @@ export function launchDefaultTmuxIfNeeded(context: TmuxLaunchContext): boolean {
 		return true;
 	}
 	try {
+		resolveManagedOwnerPredecessorSync(
+			path.dirname(plan.sessionStateFile!),
+			plan.sessionId!,
+			plan.ownerGenerationBaseline!,
+		);
 		replaceOwnerGenerationSync(
 			path.dirname(plan.sessionStateFile!),
 			plan.sessionId!,