@gajae-code/coding-agent 0.11.7 → 0.11.8

package/src/session/session-storage.ts

@@ -259,6 +259,19 @@ export interface VerifiedSessionDeleteTarget {
 	detachedArtifactsPath?: string;
 	/** Identity-bound quarantine path retained when transcript unlink deferred cleanup. */
 	detachedTranscriptPath?: string;
+	/** Native-retained publisher successor observed during transcript cleanup. */
+	retainedTranscriptSuccessorPath?: string;
+	/** Native-retained exchange placeholder observed during transcript cleanup. */
+	retainedTranscriptPlaceholderPath?: string;
+	/** Native-retained transcript entry whose identity could not be verified. */
+	retainedTranscriptUnknownPath?: string;
+	/** Native-retained publisher successor observed during cleanup. */
+	retainedArtifactsSuccessorPath?: string;
+	/** Native-retained exchange placeholder observed during cleanup. */
+	retainedArtifactsPlaceholderPath?: string;
+	/** Native-retained entry whose identity could not be verified. */
+	retainedArtifactsUnknownPath?: string;
+
 	/** Caller-published, no-replace quarantine pathname for the next artifact detach. */
 	plannedArtifactsPath?: string;
 	/** Caller-published, no-replace quarantine pathname for the next transcript detach. */
@@ -288,6 +301,9 @@ export type VerifiedSessionDeleteResult =
 			artifactsTree: NativeDirectoryTreeSnapshot;
 			/** Transcript identity (unchanged) for retry binding. */
 			transcriptIdentity: SessionStorageFileIdentity;
+			retainedSuccessorPath?: string;
+			retainedPlaceholderPath?: string;
+			retainedUnknownPath?: string;
 	  }
 	| {
 			kind: "cleanup_pending";
@@ -297,6 +313,9 @@ export type VerifiedSessionDeleteResult =
 			transcriptIdentity: SessionStorageFileIdentity;
 			/** Optional identity-bound transcript quarantine path for restart cleanup. */
 			detachedTranscriptPath?: string;
+			retainedSuccessorPath?: string;
+			retainedPlaceholderPath?: string;
+			retainedUnknownPath?: string;
 	  };
 
 /** Default OS-close dispatcher: a direct `fs.closeSync`. */
@@ -306,7 +325,22 @@ const defaultCloseAdapter: SessionStorageWriterCloseAdapter = {
 	},
 };
 
-type NativeExactUnlinkResult = { ok: true; detachedPath?: string } | { ok: false; code: string; detachedPath?: string };
+type NativeExactUnlinkResult =
+	| {
+			ok: true;
+			detachedPath?: string;
+			retainedSuccessorPath?: string;
+			retainedPlaceholderPath?: string;
+			retainedUnknownPath?: string;
+	  }
+	| {
+			ok: false;
+			code: string;
+			detachedPath?: string;
+			retainedSuccessorPath?: string;
+			retainedPlaceholderPath?: string;
+			retainedUnknownPath?: string;
+	  };
 type NativeExactUnlink = (
 	path: string,
 	identity: {
@@ -766,7 +800,13 @@ export class FileSessionStorage implements SessionStorage {
 			expectedArtifactsIdentity,
 			expectedArtifactsTree,
 			detachedArtifactsPath,
+			retainedArtifactsSuccessorPath,
+			retainedArtifactsPlaceholderPath,
+			retainedArtifactsUnknownPath,
 			detachedTranscriptPath,
+			retainedTranscriptSuccessorPath,
+			retainedTranscriptPlaceholderPath,
+			retainedTranscriptUnknownPath,
 			plannedArtifactsPath,
 			plannedTranscriptPath,
 			artifactsRemoved,
@@ -847,7 +887,8 @@ export class FileSessionStorage implements SessionStorage {
 			if (
 				!expectedArtifactsIdentity ||
 				path.dirname(detachedArtifactsPath) !== path.dirname(transcriptPath) ||
-				!path.basename(detachedArtifactsPath).startsWith(".gjc-delete-")
+				(!path.basename(detachedArtifactsPath).startsWith(".gjc-delete-") &&
+					!detachedArtifactsPath.endsWith(".removing"))
 			) {
 				throw new SessionDeleteVerificationError("artifacts", "Detached artifact cleanup evidence is invalid");
 			}
@@ -882,17 +923,20 @@ export class FileSessionStorage implements SessionStorage {
 					artifactsIdentity: expectedArtifactsIdentity,
 					detachedArtifactsPath: retainedRoot,
 					artifactsTree: expectedArtifactsTree,
+					...((removal.retainedSuccessorPath ?? retainedArtifactsSuccessorPath)
+						? { retainedSuccessorPath: removal.retainedSuccessorPath ?? retainedArtifactsSuccessorPath }
+						: {}),
+					...((removal.retainedPlaceholderPath ?? retainedArtifactsPlaceholderPath)
+						? { retainedPlaceholderPath: removal.retainedPlaceholderPath ?? retainedArtifactsPlaceholderPath }
+						: {}),
+					...((removal.retainedUnknownPath ?? retainedArtifactsUnknownPath)
+						? { retainedUnknownPath: removal.retainedUnknownPath ?? retainedArtifactsUnknownPath }
+						: {}),
 					transcriptIdentity,
 				};
 			}
 		}
 
-		if (artifactsRemoved && (detachedArtifactsPath || expectedArtifactsIdentity)) {
-			throw new SessionDeleteVerificationError(
-				"artifacts",
-				"Artifact phase receipt conflicts with pending artifact cleanup",
-			);
-		}
 		const artifactsDir = transcriptPath.slice(0, -6);
 		const artifactsIdentity = this.#optionalDirectoryIdentity(artifactsDir);
 		if (artifactsRemoved && artifactsIdentity) {
@@ -947,12 +991,48 @@ export class FileSessionStorage implements SessionStorage {
 				directory: true,
 				quarantineName: path.basename(plannedArtifactsPath),
 			});
-			if (!detach.ok || !detach.detachedPath) {
+			if (!detach.detachedPath) {
 				throw new SessionDeleteVerificationError(
 					"artifacts",
 					`Exact artifact detach rejected: ${detach.ok ? "missing_path" : detach.code}`,
 				);
 			}
+			if (!detach.ok && process.platform !== "win32") {
+				let descriptor: number | undefined;
+				try {
+					descriptor = fs.openSync(
+						path.dirname(transcriptPath),
+						fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW,
+					);
+					const durableParent = fs.fstatSync(descriptor, { bigint: true });
+					if (
+						!durableParent.isDirectory() ||
+						durableParent.dev !== parentIdentity.dev ||
+						durableParent.ino !== parentIdentity.ino
+					)
+						throw new Error("parent_changed");
+					fs.fsyncSync(descriptor);
+				} catch (error) {
+					throw new SessionDeleteVerificationError("artifacts", "durability_failed", { cause: toError(error) });
+				} finally {
+					if (descriptor !== undefined) fs.closeSync(descriptor);
+				}
+			}
+			if (!detach.ok) {
+				return {
+					kind: "cleanup_pending",
+					phase: "artifacts",
+					error: new SessionDeleteVerificationError("artifacts", `Exact artifact detach retained: ${detach.code}`),
+					artifactsIdentity,
+					detachedArtifactsPath: detach.detachedPath,
+					artifactsTree,
+					...(detach.retainedSuccessorPath ? { retainedSuccessorPath: detach.retainedSuccessorPath } : {}),
+					...(detach.retainedPlaceholderPath ? { retainedPlaceholderPath: detach.retainedPlaceholderPath } : {}),
+					...(detach.retainedUnknownPath ? { retainedUnknownPath: detach.retainedUnknownPath } : {}),
+
+					transcriptIdentity,
+				};
+			}
 			const removal = removeDirectoryTreeExact(detach.detachedPath, artifactsTree);
 			if (!removal.ok) {
 				const retainedRoot = removal.detachedPath ?? detach.detachedPath;
@@ -971,6 +1051,15 @@ export class FileSessionStorage implements SessionStorage {
 					artifactsIdentity,
 					detachedArtifactsPath: retainedRoot,
 					artifactsTree,
+					...((removal.retainedSuccessorPath ?? retainedArtifactsSuccessorPath)
+						? { retainedSuccessorPath: removal.retainedSuccessorPath ?? retainedArtifactsSuccessorPath }
+						: {}),
+					...((removal.retainedPlaceholderPath ?? retainedArtifactsPlaceholderPath)
+						? { retainedPlaceholderPath: removal.retainedPlaceholderPath ?? retainedArtifactsPlaceholderPath }
+						: {}),
+					...((removal.retainedUnknownPath ?? retainedArtifactsUnknownPath)
+						? { retainedUnknownPath: removal.retainedUnknownPath ?? retainedArtifactsUnknownPath }
+						: {}),
 					transcriptIdentity,
 				};
 			}
@@ -1010,13 +1099,27 @@ export class FileSessionStorage implements SessionStorage {
 			});
 			if (!deletion.ok) {
 				const error = exactUnlinkFailure(deletion);
-				if (error.kind === "identity" || error.kind === "symlink") throw error;
+				const retainedAuthority =
+					deletion.detachedPath ||
+					deletion.retainedSuccessorPath ||
+					deletion.retainedPlaceholderPath ||
+					deletion.retainedUnknownPath;
+				if ((error.kind === "identity" || error.kind === "symlink") && !retainedAuthority) throw error;
 				return {
 					kind: "cleanup_pending",
 					phase: "transcript",
 					error,
 					transcriptIdentity,
 					detachedTranscriptPath: deletion.detachedPath ?? detachedTranscriptPath,
+					...((deletion.retainedSuccessorPath ?? retainedTranscriptSuccessorPath)
+						? { retainedSuccessorPath: deletion.retainedSuccessorPath ?? retainedTranscriptSuccessorPath }
+						: {}),
+					...((deletion.retainedPlaceholderPath ?? retainedTranscriptPlaceholderPath)
+						? { retainedPlaceholderPath: deletion.retainedPlaceholderPath ?? retainedTranscriptPlaceholderPath }
+						: {}),
+					...((deletion.retainedUnknownPath ?? retainedTranscriptUnknownPath)
+						? { retainedUnknownPath: deletion.retainedUnknownPath ?? retainedTranscriptUnknownPath }
+						: {}),
 				};
 			}
 			return { kind: "deleted" };
@@ -1058,13 +1161,27 @@ export class FileSessionStorage implements SessionStorage {
 		});
 		if (!deletion.ok) {
 			const error = exactUnlinkFailure(deletion);
-			if (error.kind === "identity" || error.kind === "symlink") throw error;
+			const retainedAuthority =
+				deletion.detachedPath ||
+				deletion.retainedSuccessorPath ||
+				deletion.retainedPlaceholderPath ||
+				deletion.retainedUnknownPath;
+			if ((error.kind === "identity" || error.kind === "symlink") && !retainedAuthority) throw error;
 			return {
 				kind: "cleanup_pending",
 				phase: "transcript",
 				error,
 				transcriptIdentity,
 				detachedTranscriptPath: deletion.detachedPath,
+				...((deletion.retainedSuccessorPath ?? retainedTranscriptSuccessorPath)
+					? { retainedSuccessorPath: deletion.retainedSuccessorPath ?? retainedTranscriptSuccessorPath }
+					: {}),
+				...((deletion.retainedPlaceholderPath ?? retainedTranscriptPlaceholderPath)
+					? { retainedPlaceholderPath: deletion.retainedPlaceholderPath ?? retainedTranscriptPlaceholderPath }
+					: {}),
+				...((deletion.retainedUnknownPath ?? retainedTranscriptUnknownPath)
+					? { retainedUnknownPath: deletion.retainedUnknownPath ?? retainedTranscriptUnknownPath }
+					: {}),
 			};
 		}
 		return { kind: "deleted" };

package/src/task/gjc-command.ts

@@ -1,6 +1,6 @@
 import process from "node:process";
 
-import { $env } from "@gajae-code/utils";
+import { $pickenv } from "@gajae-code/utils";
 
 interface GjcCommand {
 	cmd: string;
@@ -12,7 +12,7 @@ const DEFAULT_CMD = process.platform === "win32" ? "gjc.cmd" : "gjc";
 const DEFAULT_SHELL = process.platform === "win32";
 
 export function resolveGjcCommand(): GjcCommand {
-	const envCmd = $env.PI_SUBPROCESS_CMD;
+	const envCmd = $pickenv("GJC_SUBPROCESS_CMD", "PI_SUBPROCESS_CMD");
 	if (envCmd?.trim()) {
 		return { cmd: envCmd, args: [], shell: DEFAULT_SHELL };
 	}

package/src/task/index.ts

@@ -17,7 +17,7 @@ import * as os from "node:os";
 import path from "node:path";
 import type { AgentTool, AgentToolResult, AgentToolUpdateCallback } from "@gajae-code/agent-core";
 import type { Model, Usage } from "@gajae-code/ai";
-import { $env, prompt, Snowflake } from "@gajae-code/utils";
+import { $pickenv, prompt, Snowflake } from "@gajae-code/utils";
 import type { ToolSession } from "..";
 import { AsyncJobManager, OwnerSubagentShutdownError, type ResumeRunner } from "../async";
 import { resolveAgentModelPatterns } from "../config/model-resolver";
@@ -43,6 +43,15 @@ import {
 
 // Import review tools for side effects (registers subagent tool handlers)
 import "../tools/review";
+import {
+	assertExecutionRootMatchesRepositoryBinding,
+	assertPathUnderRepositoryBinding,
+	captureRepositoryBinding,
+	publicRepositoryBinding,
+	type RepositoryBinding,
+	RepositoryBindingError,
+	resolveTaskRepositoryBinding,
+} from "../gjc-runtime/repository-binding";
 import { initializeLocalRoot, type LocalProtocolOptions, resolveLocalUrlToPath } from "../internal-urls";
 import { generateCommitMessage } from "../utils/commit-message-generator";
 import * as git from "../utils/git";
@@ -128,6 +137,43 @@ function addUsageTotals(target: Usage, usage: Partial<Usage>): void {
 	target.cost.total += cost.total;
 }
 
+/**
+ * Stamp/resolve repository authority for every task before agent discovery or spawn.
+ * Omitted bindings inherit the session worktree; declared ones must match it.
+ */
+async function resolveTaskItemsWithRepositoryBindings(
+	cwd: string,
+	tasks: readonly TaskItem[],
+): Promise<{ tasks: TaskItem[]; error?: string }> {
+	const resolved: TaskItem[] = [];
+	for (const task of tasks) {
+		try {
+			const binding = await resolveTaskRepositoryBinding(cwd, task.repositoryBinding);
+			if (binding.relativeSubdir) {
+				assertPathUnderRepositoryBinding(binding, ".");
+			}
+			resolved.push({
+				...task,
+				repositoryBinding: binding,
+			});
+		} catch (error) {
+			const id = task.id?.trim() ? task.id : "(missing-id)";
+			if (error instanceof RepositoryBindingError) {
+				return { tasks: [], error: `Task "${id}" repository binding rejected: ${error.message}` };
+			}
+			return {
+				tasks: [],
+				error: `Task "${id}" repository binding rejected: ${error instanceof Error ? error.message : String(error)}`,
+			};
+		}
+	}
+	return { tasks: resolved };
+}
+
+function repositoryBindingFromTask(task: TaskItem): RepositoryBinding | undefined {
+	return task.repositoryBinding ? publicRepositoryBinding(task.repositoryBinding as RepositoryBinding) : undefined;
+}
+
 function validateTaskIdsForScheduling(tasks: readonly TaskItem[]): string | undefined {
 	const invalid: string[] = [];
 	for (let i = 0; i < tasks.length; i++) {
@@ -399,12 +445,16 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 			this.session.getSessionSpawns() ?? "*",
 		);
 	}
+	readonly #sessionRepositoryBinding: RepositoryBinding;
+
 	private constructor(
 		private readonly session: ToolSession,
 		discoveredAgents: AgentDefinition[],
+		sessionRepositoryBinding: RepositoryBinding,
 	) {
-		this.#blockedAgent = $env.PI_BLOCKED_AGENT;
+		this.#blockedAgent = $pickenv("GJC_BLOCKED_AGENT", "PI_BLOCKED_AGENT");
 		this.#discoveredAgents = discoveredAgents;
+		this.#sessionRepositoryBinding = sessionRepositoryBinding;
 	}
 
 	#getTaskSimpleMode(): TaskSimpleMode {
@@ -412,11 +462,16 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 	}
 
 	/**
-	 * Create a TaskTool instance with async agent discovery.
+	 * Create a TaskTool instance.
+	 * Repository authority is captured from session cwd *before* agent discovery so
+	 * multi-repo workspaces fail closed prior to context/discovery (#2901).
 	 */
 	static async create(session: ToolSession): Promise<TaskTool> {
+		const sessionRepositoryBinding = await captureRepositoryBinding(session.cwd, { displayPath: session.cwd });
+		// Authority check before discovery: session cwd must resolve to a stable binding.
+		await assertExecutionRootMatchesRepositoryBinding(session.cwd, sessionRepositoryBinding);
 		const { agents } = await discoverAgents(session.cwd);
-		return new TaskTool(session, agents);
+		return new TaskTool(session, agents, publicRepositoryBinding(sessionRepositoryBinding));
 	}
 
 	async execute(
@@ -432,13 +487,32 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 			return createTaskModeError(validationError);
 		}
 
-		const taskItems = params.tasks ?? [];
-		const taskIdValidationError = validateTaskIdsForScheduling(taskItems);
+		// Re-verify session authority before using any discovered agents or scheduling work.
+		try {
+			await assertExecutionRootMatchesRepositoryBinding(this.session.cwd, this.#sessionRepositoryBinding);
+		} catch (error) {
+			const message =
+				error instanceof RepositoryBindingError
+					? error.message
+					: error instanceof Error
+						? error.message
+						: String(error);
+			return createTaskModeError(`Session repository binding rejected before task discovery: ${message}`);
+		}
+
+		const rawTaskItems = params.tasks ?? [];
+		const taskIdValidationError = validateTaskIdsForScheduling(rawTaskItems);
 		if (taskIdValidationError) {
 			return createTaskModeError(taskIdValidationError);
 		}
+		const bindingResolution = await resolveTaskItemsWithRepositoryBindings(this.session.cwd, rawTaskItems);
+		if (bindingResolution.error) {
+			return createTaskModeError(bindingResolution.error);
+		}
+		const taskItems = bindingResolution.tasks;
+		const paramsWithBindings: TaskParams = { ...params, tasks: taskItems };
 		if (taskItems.length === 0) {
-			return this.#executeSync(_toolCallId, params, signal, onUpdate);
+			return this.#executeSync(_toolCallId, paramsWithBindings, signal, onUpdate);
 		}
 		const agent = getAgent(this.#discoveredAgents, params.agent);
 		if (!agent) {
@@ -926,13 +1000,31 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 		},
 	): Promise<AgentToolResult<TaskToolDetails>> {
 		const startTime = Date.now();
+		// Pre-discovery authority: session cwd must still match the capture from create().
+		try {
+			await assertExecutionRootMatchesRepositoryBinding(this.session.cwd, this.#sessionRepositoryBinding);
+		} catch (error) {
+			const message =
+				error instanceof RepositoryBindingError
+					? error.message
+					: error instanceof Error
+						? error.message
+						: String(error);
+			return createTaskModeError(`Session repository binding rejected before task discovery: ${message}`);
+		}
+		const bindingResolution = await resolveTaskItemsWithRepositoryBindings(this.session.cwd, params.tasks ?? []);
+		if (bindingResolution.error) {
+			return createTaskModeError(bindingResolution.error);
+		}
+		const boundParams: TaskParams = { ...params, tasks: bindingResolution.tasks };
+
 		const { agents, projectAgentsDir } = await discoverAgents(this.session.cwd);
-		const { agent: agentName, context, schema: outputSchema } = params;
+		const { agent: agentName, context, schema: outputSchema } = boundParams;
 		const simpleMode = this.#getTaskSimpleMode();
 		const { contextEnabled, customSchemaEnabled } = getTaskSimpleModeCapabilities(simpleMode);
 		const sharedContext = contextEnabled ? context?.trim() : undefined;
 		const isolationMode = this.session.settings.get("task.isolation.mode");
-		const isolationRequested = "isolated" in params ? params.isolated === true : false;
+		const isolationRequested = "isolated" in boundParams ? boundParams.isolated === true : false;
 		const isIsolated = isolationMode !== "none" && isolationRequested;
 		const mergeMode = this.session.settings.get("task.isolation.merge");
 		const commitStyle = this.session.settings.get("task.isolation.commits");
@@ -940,7 +1032,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 		const taskDepth = this.session.taskDepth ?? 0;
 		const subagentLspEnabled = (this.session.enableLsp ?? true) && this.session.settings.get("task.enableLsp");
 
-		if (isolationMode === "none" && "isolated" in params) {
+		if (isolationMode === "none" && "isolated" in boundParams) {
 			return {
 				content: [
 					{
@@ -1000,7 +1092,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 		}
 
 		const forkContextValidationError = validateForkContextRequests(
-			params.tasks ?? [],
+			boundParams.tasks ?? [],
 			agent,
 			this.session.settings.get("task.forkContext.enabled"),
 		);
@@ -1039,7 +1131,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 			: (effectiveAgent.output ?? this.session.outputSchema);
 
 		// Handle empty or missing tasks
-		if (!params.tasks || params.tasks.length === 0) {
+		if (!boundParams.tasks || boundParams.tasks.length === 0) {
 			return {
 				content: [
 					{
@@ -1057,7 +1149,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 			};
 		}
 
-		const tasks = params.tasks;
+		const tasks = boundParams.tasks;
 		const missingTaskIndexes: number[] = [];
 		const idIndexes = new Map<string, number[]>();
 
@@ -1173,7 +1265,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 		const emitProgress = () => {
 			const progress = Array.from(progressMap.values()).sort((a, b) => a.index - b.index);
 			onUpdate?.({
-				content: [{ type: "text", text: `Running ${params.tasks.length} agents...` }],
+				content: [{ type: "text", text: `Running ${tasks.length} agents...` }],
 				details: {
 					projectAgentsDir,
 					results: [],
@@ -1342,7 +1434,13 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 				const taskSessionFile = managedPersistence
 					? null
 					: (overrides?.sessionFile ?? executionOverrides?.sessionFiles?.get(task.id) ?? null);
+				const taskRepositoryBinding = repositoryBindingFromTask(task) ?? this.#sessionRepositoryBinding;
+				// Declared paths (relativeSubdir) must stay under the bound root before spawn.
+				if (taskRepositoryBinding.relativeSubdir) {
+					assertPathUnderRepositoryBinding(taskRepositoryBinding, ".");
+				}
 				if (!isIsolated) {
+					await assertExecutionRootMatchesRepositoryBinding(this.session.cwd, taskRepositoryBinding);
 					const result = await runSubprocess({
 						cwd: this.session.cwd,
 						agent: effectiveAgent,
@@ -1393,7 +1491,12 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 						parentTelemetry: this.session.getTelemetry?.(),
 						forkContextSeed,
 					});
-					return { ...result, ...(forkContext ? { forkContext } : {}), forkContextAdvisory };
+					return {
+						...result,
+						...(forkContext ? { forkContext } : {}),
+						forkContextAdvisory,
+						repositoryBinding: publicRepositoryBinding(taskRepositoryBinding),
+					};
 				}
 
 				const taskStart = Date.now();
@@ -1406,6 +1509,8 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 
 					isolationHandle = await ensureIsolation(repoRoot, task.id, preferredIsolationBackend);
 					const isolationDir = isolationHandle.mergedDir;
+					// Isolated worktrees must preserve the source repository identity (#2901).
+					await assertExecutionRootMatchesRepositoryBinding(isolationDir, taskRepositoryBinding);
 
 					const result = await runSubprocess({
 						cwd: this.session.cwd,
@@ -1462,6 +1567,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 						...result,
 						...(forkContext ? { forkContext } : {}),
 						forkContextAdvisory,
+						repositoryBinding: publicRepositoryBinding(taskRepositoryBinding),
 					};
 					if (mergeMode === "branch" && resultWithForkContext.exitCode === 0) {
 						try {

package/src/task/receipt.ts

@@ -48,6 +48,8 @@ export interface TaskResultReceipt {
 	extractedToolCounts?: Record<string, number>;
 	forkContext?: SingleResult["forkContext"];
 	forkContextAdvisory?: SingleResult["forkContextAdvisory"];
+	/** Resolved repository identity for this delegated lane (#2901). */
+	repositoryBinding?: SingleResult["repositoryBinding"];
 	roi?: TaskRoi;
 }
 
@@ -262,6 +264,7 @@ export function buildTaskReceipt(raw: SingleResult): TaskResultReceipt {
 		extractedToolCounts,
 		forkContext: raw.forkContext,
 		forkContextAdvisory: raw.forkContextAdvisory,
+		repositoryBinding: raw.repositoryBinding,
 		roi: buildTaskRoi(raw),
 	};
 }

package/src/task/types.ts

@@ -1,6 +1,6 @@
 import type { ThinkingLevel } from "@gajae-code/agent-core";
 import type { Usage } from "@gajae-code/ai";
-import { $env } from "@gajae-code/utils";
+import { $pickenv } from "@gajae-code/utils";
 import * as z from "zod/v4";
 import { isValidTaskId, TASK_ID_DESCRIPTION } from "./id";
 import type { TaskResultReceipt } from "./receipt";
@@ -27,10 +27,10 @@ const parseNumber = (value: string | undefined, defaultValue: number): number =>
 };
 
 /** Maximum output bytes per agent */
-export const MAX_OUTPUT_BYTES = parseNumber($env.PI_TASK_MAX_OUTPUT_BYTES, 500_000);
+export const MAX_OUTPUT_BYTES = parseNumber($pickenv("GJC_TASK_MAX_OUTPUT_BYTES", "PI_TASK_MAX_OUTPUT_BYTES"), 500_000);
 
 /** Maximum output lines per agent */
-export const MAX_OUTPUT_LINES = parseNumber($env.PI_TASK_MAX_OUTPUT_LINES, 5000);
+export const MAX_OUTPUT_LINES = parseNumber($pickenv("GJC_TASK_MAX_OUTPUT_LINES", "PI_TASK_MAX_OUTPUT_LINES"), 5000);
 
 /** EventBus channel for raw subagent events */
 export const TASK_SUBAGENT_EVENT_CHANNEL = "task:subagent:event";
@@ -74,6 +74,19 @@ const spawnPlanSchema = z
 	})
 	.describe("justification required before spawning more than four tasks");
 
+const repositoryBindingSchema = z
+	.object({
+		schema: z.literal("gjc.repository_binding.v1"),
+		worktreeRoot: z.string().min(1).describe("canonical git worktree root"),
+		commonDir: z.string().min(1).nullable().describe("git common dir, or null outside a git checkout"),
+		relativeSubdir: z.string().min(1).optional().describe("optional repo-relative subdirectory; not an absolute cwd"),
+		displayPath: z.string().min(1).optional().describe("human-facing path; never used for authority"),
+		head: z.string().min(1).optional(),
+		branch: z.string().min(1).optional(),
+	})
+	.strict()
+	.describe("authoritative repository identity for multi-repo fail-closed spawn");
+
 const createTaskItemSchema = (_contextEnabled: boolean) =>
 	z.object({
 		id: z.string().max(48).refine(isValidTaskId, TASK_ID_DESCRIPTION).describe("filesystem-safe task identifier"),
@@ -85,6 +98,11 @@ const createTaskItemSchema = (_contextEnabled: boolean) =>
 			.describe(
 				"fork-context mode: none/omitted copies no parent context; receipt copies a minimal receipt-sized snapshot; last-turn copies only the latest exchange; bounded copies the bounded default snapshot; full copies a larger sanitized snapshot up to the configured/model token cap",
 			),
+		repositoryBinding: repositoryBindingSchema
+			.optional()
+			.describe(
+				"authoritative repository identity; omitted items are stamped from session cwd before discovery/spawn and still fail closed on sibling drift",
+			),
 	});
 
 /** Single task item for parallel execution (default shape with context enabled). */
@@ -353,6 +371,19 @@ export interface SingleResult {
 	 * never changes the actual mode selection).
 	 */
 	forkContextAdvisory?: { recommendedMode: ForkContextMode; reasons: string[] };
+	/**
+	 * Resolved repository identity used for this task after pre-discovery stamping
+	 * and fail-closed validation (#2901).
+	 */
+	repositoryBinding?: {
+		schema: "gjc.repository_binding.v1";
+		worktreeRoot: string;
+		commonDir: string | null;
+		relativeSubdir?: string;
+		displayPath?: string;
+		head?: string;
+		branch?: string;
+	};
 }
 
 /** True only for complete, factual five-bucket cost accounting. */