@gajae-code/coding-agent 0.11.5 → 0.11.6

package/src/session/session-manager.ts

@@ -853,6 +853,32 @@ function resolveManagedSessionRoot(sessionDir: string, cwd: string): string | un
 	return path.resolve(sessionDir) === path.resolve(resolved.scope.directoryPath) ? sessionsRoot : undefined;
 }
 
+/**
+ * Resolve `target` through the real path of its nearest existing ancestor,
+ * re-appending any not-yet-created trailing segments. Symlink/reparse components
+ * in the existing prefix are canonicalized (so aliases cannot escape a containment
+ * check or alias another file), while a missing leaf (e.g. an uncommitted session
+ * transcript) is still resolved deterministically. Non-ENOENT errors (ELOOP,
+ * EACCES, ...) surface rather than silently falling back to the lexical path.
+ */
+function canonicalizeThroughExistingAncestor(target: string): string {
+	const resolved = path.resolve(target);
+	const tail: string[] = [];
+	let current = resolved;
+	while (true) {
+		try {
+			const real = fs.realpathSync(current);
+			return tail.length === 0 ? real : path.join(real, ...tail.reverse());
+		} catch (err) {
+			if (!isEnoent(err)) throw err;
+			const parent = path.dirname(current);
+			if (parent === current) return resolved;
+			tail.push(path.basename(current));
+			current = parent;
+		}
+	}
+}
+
 function isSupportedSessionVersion(version: unknown): boolean {
 	return (
 		version === undefined ||
@@ -4239,6 +4265,46 @@ export class SessionManager {
 		}
 	}
 
+	/**
+	 * Exact-delete a session transcript and its artifacts by path WITHOUT requiring
+	 * managed logical authorization. This is only for discarding an UNCOMMITTED
+	 * successor that a transaction (e.g. handoff) created via `newSession()` but
+	 * never durably authorized — such a session has no managed candidate listing
+	 * yet, so `dropSession` would refuse it and leak its resident-cache/artifact
+	 * root. Bounded to this manager's configured session root and refuses to touch
+	 * the active session; tolerates missing files.
+	 */
+	async discardUncommittedSession(sessionPath: string): Promise<void> {
+		// Close the writer FIRST so the canonical checks and the delete run with no
+		// intervening await, eliminating the check/use window in which a parent
+		// directory could be swapped for a symlink between authorization and deletion.
+		await this.#closePersistWriter();
+		// Canonicalize the candidate (and the active file / configured dir) through
+		// their nearest existing ancestor so symlink/reparse components cannot alias
+		// the active session or escape the configured session directory, even when
+		// the successor transcript itself does not yet exist.
+		const canonicalCandidate = canonicalizeThroughExistingAncestor(path.resolve(sessionPath));
+		if (this.#sessionFile) {
+			const canonicalActive = canonicalizeThroughExistingAncestor(path.resolve(this.#sessionFile));
+			if (canonicalActive === canonicalCandidate) {
+				throw new Error("Refusing to discard the active session as uncommitted.");
+			}
+		}
+		// Least-authority containment: only within this manager's configured session
+		// directory (canonical), where newSession() allocates the successor. The
+		// broader managed root (parent of sessionDir) is deliberately NOT accepted.
+		const canonicalSessionDir = canonicalizeThroughExistingAncestor(path.resolve(this.sessionDir));
+		if (!pathIsWithin(canonicalSessionDir, canonicalCandidate)) {
+			throw new Error("Uncommitted session discard is limited to this manager's configured session directory.");
+		}
+		try {
+			await this.storage.deleteSessionWithArtifacts(canonicalCandidate);
+		} catch (err) {
+			if (isEnoent(err)) return;
+			throw err;
+		}
+	}
+
 	/**
 	 * Fork the current session, creating a new session file with the same entries.
 	 * Returns both the old and new session file paths for artifact copying.

package/src/session/yield-queue.ts

@@ -107,6 +107,26 @@ export class YieldQueue {
 		this.#idleFlushPending = false;
 	}
 
+	/** Drop only the queued entries of a single kind, leaving other kinds intact. */
+	clearKind(kind: string): void {
+		this.#entries.delete(kind);
+	}
+
+	/**
+	 * Re-schedule an idle flush if work remains and the session is idle. Used after
+	 * a transition (e.g. handoff) releases a delivery fence so entries queued while
+	 * fenced are not stranded until an unrelated enqueue or agent yield.
+	 */
+	rearmIdle(): void {
+		if (this.#options.isStreaming()) return;
+		for (const entries of this.#entries.values()) {
+			if (entries.length > 0) {
+				this.#scheduleIdleFlush();
+				return;
+			}
+		}
+	}
+
 	#scheduleIdleFlush(): void {
 		if (this.#idleFlushPending) return;
 		this.#idleFlushPending = true;

package/src/slash-commands/builtin-registry.ts

@@ -1435,6 +1435,42 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 			await runtime.ctx.handleCompactCommand(customInstructions);
 		},
 	},
+	{
+		name: "handoff",
+		priority: 71,
+		description: "Generate a handoff and continue in a new session",
+		acpDescription: "Generate a handoff document and start a new session",
+		inlineHint: "[focus instructions]",
+		acpInputHint: "[focus instructions]",
+		allowArgs: true,
+		handle: async (command, runtime) => {
+			let result: Awaited<ReturnType<typeof runtime.session.handoff>>;
+			try {
+				result = await runtime.session.handoff(command.args || undefined);
+			} catch (err) {
+				// Handoff precondition failures (nothing to hand off, streaming),
+				// cancellation, and provider errors propagate as plain Errors; the
+				// switch is non-destructive so the current session is unchanged.
+				return usage(`Handoff failed: ${errorMessage(err)}; current session is unchanged.`, runtime);
+			}
+			if (!result) {
+				return usage(
+					"Handoff not created (cancelled or nothing to hand off); current session is unchanged.",
+					runtime,
+				);
+			}
+			await runtime.output(
+				result.savedPath
+					? `Handoff created; new session started. Handoff document saved to: ${result.savedPath}`
+					: "Handoff created; new session started with handoff context.",
+			);
+			return commandConsumed();
+		},
+		handleTui: async (command, runtime) => {
+			runtime.ctx.editor.setText("");
+			await runtime.ctx.handleHandoffCommand(command.args || undefined);
+		},
+	},
 	{
 		name: "contribute-pr",
 		aliases: ["contribution-prep"],

package/src/tools/ask-answer-registry.ts

@@ -7,6 +7,7 @@
  * source; registering returns a disposer.
  */
 
+import { logger } from "@gajae-code/utils";
 import type { WorkflowGateEmitter } from "../modes/shared/agent-wire/workflow-gate-broker";
 import type { AskAnswerSource } from "./index";
 
@@ -31,7 +32,20 @@ export function getAskAnswerSource(sessionId: string): AskAnswerSource | undefin
 export function notifyWorkflowGateEmitterChanged(sessionId: string, emitter: WorkflowGateEmitter | undefined): void {
 	if (emitter) workflowGateEmitters.set(sessionId, emitter);
 	else workflowGateEmitters.delete(sessionId);
-	for (const listener of workflowGateListeners.get(sessionId) ?? []) listener(emitter);
+	for (const listener of workflowGateListeners.get(sessionId) ?? []) {
+		// Isolate each listener: a throwing observer must never escape into an
+		// emitter suspend/bind/restore step, which runs inside session-transition
+		// transactions (e.g. handoff) whose rollback/commit correctness depends on
+		// this notification being no-throw.
+		try {
+			listener(emitter);
+		} catch (error) {
+			logger.warn("Workflow-gate emitter listener threw during notification", {
+				sessionId,
+				error: error instanceof Error ? error.message : String(error),
+			});
+		}
+	}
 }
 
 /** Observe workflow-gate emitter installation even when it occurs after session_start. */