@gajae-code/coding-agent 0.11.6 → 0.11.8

package/src/extensibility/plugins/marketplace/fetcher.ts

@@ -5,10 +5,14 @@
  */
 
 import * as fs from "node:fs/promises";
+import * as http from "node:http";
+import * as https from "node:https";
+import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
 import { isEnoent, logger } from "@gajae-code/utils";
 import * as git from "../../../utils/git";
+import { isPrivateOrSpecialAddress, validatePublicHttpUrl } from "../../../web/insane/url-guard";
 
 import type { MarketplaceCatalog, MarketplaceSourceType } from "./types";
 import { isValidNameSegment } from "./types";
@@ -194,6 +198,192 @@ export function parseMarketplaceCatalog(content: string, filePath: string): Mark
 
 /** Relative path from a marketplace root to its catalog file. */
 const CATALOG_RELATIVE_PATH = path.join(".claude-plugin", "marketplace.json");
+const URL_FETCH_TIMEOUT_MS = 60_000;
+const URL_FETCH_MAX_REDIRECTS = 5;
+const URL_FETCH_MAX_HEADER_BYTES = 16 * 1024;
+/** Direct JSON catalogs are metadata; 2 MiB leaves ample room without permitting unbounded buffering. */
+const URL_FETCH_MAX_BYTES = 2 * 1024 * 1024;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+
+function withAbortSignal<T>(operation: Promise<T>, signal: AbortSignal): Promise<T> {
+	if (signal.aborted) return Promise.reject(signal.reason);
+	const deferred = Promise.withResolvers<T>();
+	const abort = () => deferred.reject(signal.reason);
+	signal.addEventListener("abort", abort, { once: true });
+	operation.then(deferred.resolve, deferred.reject).finally(() => signal.removeEventListener("abort", abort));
+	return deferred.promise;
+}
+
+function normalizePeerAddress(address: string): string {
+	const normalized = address.toLowerCase();
+	return normalized.startsWith("::ffff:") ? normalized.slice(7) : normalized;
+}
+
+function normalizeUrlHostname(hostname: string): string {
+	return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+
+async function validateCatalogUrl(rawUrl: string, signal: AbortSignal) {
+	const url = new URL(rawUrl);
+	const hostname = normalizeUrlHostname(url.hostname);
+	// URL.hostname retains IPv6 brackets in Node/Bun, while net.isIP expects the bare literal.
+	if (net.isIP(hostname) === 6) {
+		if (url.protocol !== "http:" && url.protocol !== "https:")
+			return { ok: false as const, reason: `unsupported scheme ${url.protocol}` };
+		if (url.username || url.password) return { ok: false as const, reason: "URL credentials are not allowed" };
+		if (isPrivateOrSpecialAddress(hostname))
+			return { ok: false as const, reason: "private, loopback, link-local, or reserved IP literal" };
+		return { ok: true as const, url, addresses: [hostname] };
+	}
+	return withAbortSignal(validatePublicHttpUrl(rawUrl), signal);
+}
+
+function openCatalogResponse(url: URL, addresses: string[], signal: AbortSignal): Promise<http.IncomingMessage> {
+	const hostname = normalizeUrlHostname(url.hostname);
+	const approved = addresses.map(address => ({ address, family: net.isIP(address) }));
+	const approvedPeers = new Set(approved.map(record => normalizePeerAddress(record.address)));
+	const lookup: net.LookupFunction = (requestedHostname, options, callback) => {
+		const requestedFamily = options.family === "IPv4" ? 4 : options.family === "IPv6" ? 6 : (options.family ?? 0);
+		const matching = approved.filter(record => requestedFamily === 0 || record.family === requestedFamily);
+		if (normalizeUrlHostname(requestedHostname) !== hostname || matching.length === 0) {
+			const error = Object.assign(new Error("No approved address for marketplace host"), { code: "ENOTFOUND" });
+			callback(error, options.all ? [] : "", 0);
+			return;
+		}
+		if (options.all) callback(null, matching);
+		else callback(null, matching[0].address, matching[0].family);
+	};
+	const deferred = Promise.withResolvers<http.IncomingMessage>();
+	const options: https.RequestOptions = {
+		protocol: url.protocol,
+		hostname,
+		port: url.port || undefined,
+		path: `${url.pathname}${url.search}`,
+		method: "GET",
+		headers: { Accept: "application/json", "Accept-Encoding": "identity", Connection: "close", Host: url.host },
+		agent: false,
+		insecureHTTPParser: false,
+		lookup,
+		maxHeaderSize: URL_FETCH_MAX_HEADER_BYTES,
+		signal,
+		...(url.protocol === "https:"
+			? { rejectUnauthorized: true, servername: net.isIP(hostname) === 0 ? hostname : undefined }
+			: {}),
+	};
+	const requestFn = url.protocol === "https:" ? https.request : http.request;
+	const request = requestFn(options, response => {
+		const peer = response.socket.remoteAddress;
+		if (!peer || isPrivateOrSpecialAddress(peer) || !approvedPeers.has(normalizePeerAddress(peer))) {
+			response.destroy();
+			deferred.reject(
+				new Error(`Refusing marketplace catalog response from unapproved connected peer ${peer ?? "unknown"}`),
+			);
+			return;
+		}
+		deferred.resolve(response);
+	});
+	request.once("error", deferred.reject);
+	const abort = () => {
+		request.destroy(signal.reason);
+		deferred.reject(signal.reason);
+	};
+	if (signal.aborted) abort();
+	else signal.addEventListener("abort", abort, { once: true });
+	request.once("close", () => signal.removeEventListener("abort", abort));
+	request.end();
+	return deferred.promise;
+}
+
+async function readCatalogResponse(
+	response: http.IncomingMessage,
+	source: string,
+	signal: AbortSignal,
+): Promise<string> {
+	const rawContentLengths: string[] = [];
+	let hasTransferEncoding = false;
+	for (let index = 0; index < response.rawHeaders.length; index += 2) {
+		const name = response.rawHeaders[index]?.toLowerCase();
+		if (name === "content-length") rawContentLengths.push(response.rawHeaders[index + 1] ?? "");
+		if (name === "transfer-encoding") hasTransferEncoding = true;
+	}
+	if (rawContentLengths.length > 1 || (rawContentLengths.length > 0 && hasTransferEncoding)) {
+		response.destroy();
+		throw new Error(`Marketplace catalog from ${source} has ambiguous response framing`);
+	}
+	const contentLength = response.headers["content-length"];
+	if (contentLength !== undefined) {
+		const declaredBytes =
+			typeof contentLength === "string" && /^\d+$/.test(contentLength) ? Number(contentLength) : NaN;
+		if (!Number.isSafeInteger(declaredBytes)) {
+			response.destroy();
+			throw new Error(`Marketplace catalog from ${source} has an invalid Content-Length`);
+		}
+		if (declaredBytes > URL_FETCH_MAX_BYTES) {
+			response.destroy();
+			throw new Error(`Marketplace catalog from ${source} exceeds the maximum size of 2 MiB`);
+		}
+	}
+
+	const abort = () => response.destroy(signal.reason);
+	if (signal.aborted) {
+		abort();
+		throw signal.reason;
+	}
+	signal.addEventListener("abort", abort, { once: true });
+	const chunks: Buffer[] = [];
+	let receivedBytes = 0;
+	try {
+		for await (const chunk of response) {
+			const bytes = Buffer.from(chunk);
+			receivedBytes += bytes.byteLength;
+			if (receivedBytes > URL_FETCH_MAX_BYTES) {
+				response.destroy();
+				throw new Error(`Marketplace catalog from ${source} exceeds the maximum size of 2 MiB`);
+			}
+			chunks.push(bytes);
+		}
+		return Buffer.concat(chunks, receivedBytes).toString("utf8");
+	} finally {
+		signal.removeEventListener("abort", abort);
+	}
+}
+
+async function fetchMarketplaceCatalogUrl(source: string): Promise<string> {
+	const deadline = AbortSignal.timeout(URL_FETCH_TIMEOUT_MS);
+	let currentUrl = source;
+	try {
+		for (let redirectCount = 0; ; redirectCount++) {
+			const guard = await validateCatalogUrl(currentUrl, deadline);
+			if (!guard.ok) {
+				throw new Error(`Refusing marketplace catalog URL: target URL is not public HTTP(S): ${guard.reason}`);
+			}
+			const response = await openCatalogResponse(guard.url, guard.addresses, deadline);
+			const status = response.statusCode ?? 0;
+			if (REDIRECT_STATUSES.has(status)) {
+				if (redirectCount >= URL_FETCH_MAX_REDIRECTS) {
+					response.destroy();
+					throw new Error(`Too many redirects fetching marketplace catalog from ${source}`);
+				}
+				const location = response.headers.location;
+				response.destroy();
+				if (!location)
+					throw new Error(`Marketplace catalog redirect from ${currentUrl} is missing a Location header`);
+				currentUrl = new URL(location, guard.url).toString();
+				continue;
+			}
+			if (status < 200 || status >= 300) {
+				response.destroy();
+				throw new Error(
+					`Failed to fetch marketplace catalog from ${currentUrl}: HTTP ${status} ${response.statusMessage ?? ""}`,
+				);
+			}
+			return await readCatalogResponse(response, currentUrl, deadline);
+		}
+	} catch (err) {
+		if (deadline.aborted) throw new Error(`Timed out fetching marketplace catalog from ${source}`);
+		throw err;
+	}
+}
 
 /**
  * Expand a `~/...` path to an absolute path using os.homedir().
@@ -249,13 +439,7 @@ export async function fetchMarketplace(source: string, cacheDir: string): Promis
 	}
 
 	// type === "url"
-	const response = await fetch(source, { signal: AbortSignal.timeout(60_000) });
-	if (!response.ok) {
-		throw new Error(
-			`Failed to fetch marketplace catalog from ${source}: HTTP ${response.status} ${response.statusText}`,
-		);
-	}
-	const text = await response.text();
+	const text = await fetchMarketplaceCatalogUrl(source);
 	const catalog = parseMarketplaceCatalog(text, source);
 
 	const catalogDir = path.join(cacheDir, catalog.name);

package/src/gjc-runtime/launch-tmux.ts

@@ -705,7 +705,7 @@ function applyGjcTmuxRootTerminalTitleProfile(context: {
 }
 
 function shouldSetGjcTmuxRootTerminalTitle(parsed: Args, env: NodeJS.ProcessEnv): boolean {
-	return !parsed.noTitle && !env.PI_NO_TITLE;
+	return !parsed.noTitle && !(env.GJC_NO_TITLE || env.PI_NO_TITLE);
 }
 
 function buildTmuxRenameWindowArgs(title: string, target?: string): string[] {

package/src/gjc-runtime/managed-owner-supervisor.ts

@@ -1,9 +1,11 @@
 import * as crypto from "node:crypto";
+import * as fsSync from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { Process } from "@gajae-code/natives";
 import { readLinuxProcStartTime } from "./linux-proc";
 import { assertSafePathComponent } from "./session-layout";
-import { lifecyclePaths } from "./tmux-owner-isolation";
+import { lifecyclePaths, type OwnerIntent, observeOwnerTerminal } from "./tmux-owner-isolation";
 
 export const MANAGED_OWNER_SUPERVISOR_ARG = "--internal-managed-owner-supervisor";
 export const MANAGED_OWNER_CHILD_TOKEN_ENV = "GJC_MANAGED_OWNER_CHILD_TOKEN";
@@ -14,6 +16,15 @@ export const MANAGED_OWNER_STATE_DIR_ENV = "GJC_TMUX_OWNER_STATE_DIR";
 export const MANAGED_OWNER_RUN_ID_ENV = "GJC_MANAGED_OWNER_RUN_ID";
 export const MANAGED_OWNER_INCARNATION_ENV = "GJC_MANAGED_OWNER_INCARNATION";
 
+let bootstrapSigtermPending = false;
+const captureBootstrapSigterm = () => {
+	bootstrapSigtermPending = true;
+};
+if (process.argv.includes(MANAGED_OWNER_SUPERVISOR_ARG)) {
+	process.removeAllListeners("SIGTERM");
+	process.on("SIGTERM", captureBootstrapSigterm);
+}
+
 export interface ManagedOwnerBinding {
 	schema_version: 2;
 	generation: string;
@@ -52,7 +63,14 @@ function requiredEnvironment(name: string): string {
 	return value;
 }
 
-function lifecycleRoot(): { root: string; generation: string; sessionId: string; runId: string; incarnation: string } {
+function lifecycleRoot(): {
+	root: string;
+	stateDir: string;
+	generation: string;
+	sessionId: string;
+	runId: string;
+	incarnation: string;
+} {
 	const stateDir = requiredEnvironment(MANAGED_OWNER_STATE_DIR_ENV);
 	const sessionId = requiredEnvironment(MANAGED_OWNER_SESSION_ID_ENV);
 	const generation = requiredEnvironment(MANAGED_OWNER_GENERATION_ENV);
@@ -68,7 +86,7 @@ function lifecycleRoot(): { root: string; generation: string; sessionId: string;
 	if (!path.isAbsolute(stateDir)) throw new Error("managed_owner_lifecycle_path_unsafe");
 	const root = lifecyclePaths(stateDir, sessionId, generation).root;
 	if (!root.startsWith(`${path.resolve(stateDir)}${path.sep}`)) throw new Error("managed_owner_lifecycle_path_unsafe");
-	return { root, generation, sessionId, runId, incarnation };
+	return { root, stateDir, generation, sessionId, runId, incarnation };
 }
 
 function commandDigest(command: readonly string[]): string {
@@ -106,8 +124,14 @@ export function isManagedOwnerSupervisorArgv(args: readonly string[]): boolean {
 
 /** Runs one exact child and publishes authority only for a directly observed Linux signal 6. */
 export async function runManagedOwnerSupervisor(): Promise<void> {
-	const { root, generation, sessionId, runId, incarnation } = lifecycleRoot();
+	const { root, stateDir, generation, sessionId, runId, incarnation } = lifecycleRoot();
 	const command = childCommand();
+	let sigtermPending = bootstrapSigtermPending;
+	const captureEarlySigterm = () => {
+		sigtermPending = true;
+	};
+	process.removeAllListeners("SIGTERM");
+	process.on("SIGTERM", captureEarlySigterm);
 	const supervisorStartTime = await readLinuxProcStartTime(process.pid);
 	if (!supervisorStartTime) throw new Error("managed_owner_supervisor_start_time_unavailable");
 	await fs.mkdir(root, { recursive: true, mode: 0o700 });
@@ -135,7 +159,62 @@ export async function runManagedOwnerSupervisor(): Promise<void> {
 	});
 	const childStartTime = await readLinuxProcStartTime(child.pid);
 	if (!childStartTime) throw new Error("managed_owner_child_start_time_unavailable");
+	const childProcess = Process.fromPid(child.pid);
+	if (!childProcess) throw new Error("managed_owner_child_reference_unavailable");
+	if (process.platform === "linux" && childProcess.incarnation !== `linux:${childStartTime}`)
+		throw new Error("managed_owner_child_incarnation_mismatch");
+	let childExited = false;
+	let sigtermRelayed = false;
+	let relayedIntent: OwnerIntent | null = null;
+	let relayedAt: string | null = null;
+	const relaySigterm = () => {
+		if (childExited || sigtermRelayed) return;
+		let candidateIntent: OwnerIntent | null = null;
+		try {
+			const candidate = JSON.parse(
+				fsSync.readFileSync(lifecyclePaths(stateDir, sessionId, generation).intentFile, "utf8"),
+			) as Partial<OwnerIntent>;
+			candidateIntent = typeof candidate.dispatch_id === "string" ? (candidate as OwnerIntent) : null;
+		} catch {
+			candidateIntent = null;
+		}
+		try {
+			if (!childProcess.signalRoot(15)) return;
+		} catch {
+			// The child exited between intent capture and delivery.
+			return;
+		}
+		sigtermRelayed = true;
+		relayedAt = new Date().toISOString();
+		relayedIntent = candidateIntent;
+	};
+	sigtermPending ||= bootstrapSigtermPending;
+	process.removeListener("SIGTERM", captureBootstrapSigterm);
+	process.removeListener("SIGTERM", captureEarlySigterm);
+	process.on("SIGTERM", relaySigterm);
+	if (sigtermPending) relaySigterm();
 	const exitCode = await child.exited;
+	childExited = true;
+	process.removeListener("SIGTERM", relaySigterm);
+	const terminalIntent = relayedIntent as OwnerIntent | null;
+	const terminalObservedAt = relayedAt as string | null;
+	if (sigtermRelayed && terminalObservedAt && terminalIntent) {
+		await observeOwnerTerminal({
+			schema_version: 1,
+			op: "observe_terminal",
+			session_id: sessionId,
+			owner_generation: generation,
+			state_dir: stateDir,
+			socket_key: process.env.GJC_TMUX_OWNER_SERVER_KEY ?? "",
+			observer: "raw_monitor",
+			observed_at: terminalObservedAt,
+			signal: "SIGTERM",
+			exit_code: exitCode,
+			exit_kind: "supervisor_child_exit",
+			reason: "managed_owner_supervisor_exit",
+			operator_dispatch_id: terminalIntent.dispatch_id,
+		});
+	}
 	if (child.signalCode === "SIGABRT") {
 		const receipt: ManagedOwnerSigabrtReceipt = {
 			schema_version: 2,

package/src/gjc-runtime/ralplan-runtime.ts

@@ -11,6 +11,15 @@ import {
 	type RalplanIndexRow,
 	summarizeRalplanIndex,
 } from "./ledger-event-renderer";
+import {
+	assertCwdMatchesRepositoryBinding,
+	assertPathUnderRepositoryBinding,
+	captureRepositoryBinding,
+	parseRepositoryBinding,
+	publicRepositoryBinding,
+	type RepositoryBinding,
+	RepositoryBindingError,
+} from "./repository-binding";
 import { GJC_RALPLAN_ARTIFACT_ENV, isRestrictedRoleAgentBash } from "./restricted-role-agent-bash";
 import { modeStatePath, sessionPlansDir } from "./session-layout";
 import { resolveGjcSessionForWrite, writeSessionActivityMarker } from "./session-resolution";
@@ -179,6 +188,43 @@ async function readActiveRunId(cwd: string, sessionId: string): Promise<string |
 	return candidate;
 }
 
+/**
+ * Read the authoritative repository binding from ralplan run state and fail closed
+ * when the active cwd no longer matches (handoff / QA / stage write) (#2901).
+ */
+async function enforceRalplanRepositoryBinding(cwd: string, sessionId: string): Promise<RepositoryBinding> {
+	const statePath = ralplanStatePath(cwd, sessionId);
+	const existingRead = await readExistingStateForMutation(statePath);
+	if (existingRead.kind === "corrupt") {
+		throw new RalplanCommandError(
+			2,
+			`existing ralplan state is corrupt or tampered (${existingRead.error}); refusing to proceed at ${statePath}`,
+		);
+	}
+	if (existingRead.kind === "absent") {
+		// No prior seed — capture live authority so subsequent handoffs still have a stamp.
+		return publicRepositoryBinding(await captureRepositoryBinding(cwd, { displayPath: cwd }));
+	}
+	const raw = existingRead.value.repository_binding ?? existingRead.value.repositoryBinding;
+	try {
+		if (raw === undefined) {
+			// Legacy seeds without a field: stamp current cwd and require future writes match it.
+			return publicRepositoryBinding(await captureRepositoryBinding(cwd, { displayPath: cwd }));
+		}
+		const binding = parseRepositoryBinding(raw);
+		await assertCwdMatchesRepositoryBinding(cwd, binding);
+		return publicRepositoryBinding(binding);
+	} catch (error) {
+		if (error instanceof RepositoryBindingError) {
+			throw new RalplanCommandError(2, `ralplan repository binding rejected: ${error.message}`);
+		}
+		throw new RalplanCommandError(
+			2,
+			`ralplan repository binding rejected: ${error instanceof Error ? error.message : String(error)}`,
+		);
+	}
+}
+
 /**
  * Run-state phases that an artifact write must never reopen. Once ralplan has
  * reached a terminal/handed-off phase, a stray `--write` must not regress
@@ -651,6 +697,24 @@ async function buildRalplanHud(options: {
 async function handleArtifactWrite(args: readonly string[], cwd: string): Promise<RalplanCommandResult> {
 	const plannerState = parsePlannerStateArgs(args);
 	const resolved = await resolveArtifactArgs(args, cwd);
+	// Fail closed before stage persistence / path writes when cwd drifted to a sibling repo.
+	const repositoryBinding = await enforceRalplanRepositoryBinding(cwd, resolved.sessionId);
+	// Artifact file paths (when --artifact points at a file) must stay under the bound root.
+	const rawArtifact = flagValue(args, "--artifact");
+	if (rawArtifact && !isRestrictedRoleAgentBash()) {
+		const candidate = path.isAbsolute(rawArtifact) ? rawArtifact : path.resolve(cwd, rawArtifact);
+		try {
+			const stat = await fs.stat(candidate);
+			if (stat.isFile()) {
+				assertPathUnderRepositoryBinding(repositoryBinding, candidate);
+			}
+		} catch (error) {
+			if (error instanceof RepositoryBindingError) {
+				throw new RalplanCommandError(2, `ralplan repository binding rejected: ${error.message}`);
+			}
+			// Non-file / missing path is inline content; resolveArtifactContent already handled it.
+		}
+	}
 	const content = resolved.artifact.endsWith("\n") ? resolved.artifact : `${resolved.artifact}\n`;
 	const sha256 = createHash("sha256").update(content).digest("hex");
 
@@ -696,6 +760,7 @@ async function handleArtifactWrite(args: readonly string[], cwd: string): Promis
 		stage: persisted.stage,
 		stage_n: persisted.stageN,
 		sha256: persisted.sha256,
+		repository_binding: repositoryBinding,
 		created_at: persisted.createdAt,
 	};
 	if (persisted.pendingApprovalPath) payload.pending_approval_path = persisted.pendingApprovalPath;
@@ -809,7 +874,7 @@ function resolveConsensusArgs(args: readonly string[], cwd: string): ConsensusHa
 async function seedRalplanState(
 	cwd: string,
 	resolved: ConsensusHandoffArgs,
-): Promise<{ statePath: string; runId: string }> {
+): Promise<{ statePath: string; runId: string; repositoryBinding: RepositoryBinding }> {
 	const statePath = ralplanStatePath(cwd, resolved.sessionId);
 	// Reuse an existing run id when present so a re-invocation of `gjc ralplan "task"` doesn't
 	// orphan in-progress artifacts under a fresh run id.
@@ -817,6 +882,11 @@ async function seedRalplanState(
 	const runId = existingRunId ?? resolved.sessionId ?? defaultRunId();
 	assertSafePathComponent(runId, "run-id");
 	const now = new Date().toISOString();
+	// When an active seed already carries authority, re-entry must match it (fail closed).
+	// Otherwise stamp the current cwd as the durable binding for this run.
+	const repositoryBinding = existingRunId
+		? await enforceRalplanRepositoryBinding(cwd, resolved.sessionId)
+		: publicRepositoryBinding(await captureRepositoryBinding(cwd, { displayPath: cwd }));
 	const payload: Record<string, unknown> = {
 		active: true,
 		current_phase: "planner",
@@ -827,6 +897,7 @@ async function seedRalplanState(
 		task: resolved.task,
 		run_id: runId,
 		updated_at: now,
+		repository_binding: repositoryBinding,
 	};
 	if (resolved.architectKind) payload.architect_kind = resolved.architectKind;
 	if (resolved.criticKind) payload.critic_kind = resolved.criticKind;
@@ -849,7 +920,7 @@ async function seedRalplanState(
 		},
 	});
 	await writeSessionActivityMarker(cwd, resolved.sessionId, { writer: "ralplan-runtime", path: statePath });
-	return { statePath, runId };
+	return { statePath, runId, repositoryBinding };
 }
 
 async function handleConsensusHandoff(args: readonly string[], cwd: string): Promise<RalplanCommandResult> {
@@ -857,7 +928,7 @@ async function handleConsensusHandoff(args: readonly string[], cwd: string): Pro
 	if (!resolved.task) {
 		throw new RalplanCommandError(2, 'gjc ralplan requires a task description, e.g. `gjc ralplan "<task>"`.');
 	}
-	const { statePath, runId } = await seedRalplanState(cwd, resolved);
+	const { statePath, runId, repositoryBinding } = await seedRalplanState(cwd, resolved);
 	const mode = resolved.deliberate ? "deliberate" : "short";
 	await syncRalplanHud({
 		cwd,
@@ -875,6 +946,7 @@ async function handleConsensusHandoff(args: readonly string[], cwd: string): Pro
 		state_path: statePath,
 		run_id: runId,
 		handoff: "/skill:ralplan",
+		repository_binding: repositoryBinding,
 	};
 	const stdout = resolved.json
 		? renderCliWriteReceipt({ ok: true, ...summary })