@gajae-code/coding-agent 0.11.7 → 0.11.9

package/src/runtime-mcp/redaction.ts

@@ -0,0 +1,30 @@
+const REDACTED = "<redacted>";
+const SENSITIVE_KEY_PATTERN = /(?:token|secret|key|credential|password|authorization|auth|bearer|cookie|session)/i;
+
+export function redactMCPEndpoint(value: string | undefined): string | undefined {
+	if (!value) return value;
+	try {
+		const url = new URL(value);
+		if (url.username) url.username = REDACTED;
+		if (url.password) url.password = REDACTED;
+		if (url.pathname !== "/") url.pathname = `/${REDACTED}`;
+		for (const key of Array.from(url.searchParams.keys())) {
+			url.searchParams.set(key, REDACTED);
+		}
+		url.hash = "";
+		return url.toString();
+	} catch {
+		return REDACTED;
+	}
+}
+
+export function redactMCPDiagnosticValue(value: unknown): unknown {
+	if (Array.isArray(value)) return value.map(redactMCPDiagnosticValue);
+	if (!value || typeof value !== "object") return value;
+	return Object.fromEntries(
+		Object.entries(value).map(([key, entry]) => [
+			key,
+			SENSITIVE_KEY_PATTERN.test(key) ? REDACTED : redactMCPDiagnosticValue(entry),
+		]),
+	);
+}

package/src/runtime-mcp/transports/http.ts

@@ -24,6 +24,7 @@ import {
 	MCP_MAX_SSE_REQUEST_MESSAGES,
 	readMCPResponseText,
 } from "../content-limits";
+import { fetchPluginMcpRequest, isPluginMcpPublicNetworkBound } from "../plugin-network-boundary";
 
 /**
  * HTTP transport for MCP servers.
@@ -62,6 +63,12 @@ export class HttpTransport implements MCPTransport {
 		this.#connected = true;
 	}
 
+	#fetch(init: BunFetchRequestInit): Promise<Response> {
+		return isPluginMcpPublicNetworkBound(this.config)
+			? fetchPluginMcpRequest(this.config.url, init)
+			: fetch(this.config.url, init);
+	}
+
 	#trackReader(promise: Promise<void>, controller?: AbortController): void {
 		if (controller) this.#streamControllers.add(controller);
 		this.#streamReaders.add(promise);
@@ -96,7 +103,7 @@ export class HttpTransport implements MCPTransport {
 
 		let response: Response;
 		try {
-			response = await fetch(this.config.url, {
+			response = await this.#fetch({
 				method: "GET",
 				headers,
 				signal: AbortSignal.any([sseConnection.signal, headerController.signal]),
@@ -227,7 +234,7 @@ export class HttpTransport implements MCPTransport {
 			: abortController.signal;
 
 		try {
-			const response = await fetch(this.config.url, {
+			const response = await this.#fetch({
 				method: "POST",
 				headers,
 				body: JSON.stringify(body),
@@ -423,7 +430,7 @@ export class HttpTransport implements MCPTransport {
 			headers["Mcp-Session-Id"] = this.#sessionId;
 		}
 		try {
-			const resp = await fetch(this.config.url, {
+			const resp = await this.#fetch({
 				method: "POST",
 				headers,
 				body: JSON.stringify(body),
@@ -437,7 +444,7 @@ export class HttpTransport implements MCPTransport {
 					this.config.headers ??= {};
 					Object.assign(this.config.headers, newHeaders);
 					Object.assign(headers, newHeaders);
-					const retry = await fetch(this.config.url, {
+					const retry = await this.#fetch({
 						method: "POST",
 						headers,
 						body: JSON.stringify(body),
@@ -480,7 +487,7 @@ export class HttpTransport implements MCPTransport {
 		const timeoutId = setTimeout(() => abortController.abort(), timeout);
 
 		try {
-			const response = await fetch(this.config.url, {
+			const response = await this.#fetch({
 				method: "POST",
 				headers,
 				body: JSON.stringify(body),
@@ -542,7 +549,7 @@ export class HttpTransport implements MCPTransport {
 					"Mcp-Session-Id": this.#sessionId,
 				};
 
-				await fetch(this.config.url, {
+				await this.#fetch({
 					method: "DELETE",
 					headers,
 					signal: AbortSignal.timeout(timeout),

package/src/sdk/broker/broker.ts

@@ -1,7 +1,9 @@
 import { createHash, randomBytes } from "node:crypto";
+import type { BigIntStats } from "node:fs";
 import * as fs from "node:fs/promises";
 import path from "node:path";
 import type { NativeDirectoryTreeSnapshot } from "@gajae-code/natives";
+import type { ModelProfileErrorDetails } from "../../config/model-profile-contract";
 import {
 	type DirectoryMigrationPolicy,
 	listManagedSessionCandidates,
@@ -141,6 +143,7 @@ export type BrokerResponse =
 			error: {
 				code: BrokerErrorCode;
 				message: string;
+				details?: ModelProfileErrorDetails;
 				endpoint?: "unavailable";
 				cleanup?: BrokerCleanupEvidence;
 			};
@@ -362,6 +365,7 @@ type BrokerLockSnapshot = {
 	ownerId?: string;
 	pid: number;
 	identity: string;
+	lockIdentity: string;
 };
 
 const BROKER_PUBLICATION_CADENCE_MS = 5_000;
@@ -415,7 +419,7 @@ export class Broker {
 	#lockRecordPath(): string {
 		return path.join(this.#lock, BROKER_LOCK_RECORD);
 	}
-	#lockSnapshot(raw: string): BrokerLockSnapshot {
+	async #lockSnapshot(raw: string, lockIdentity: string): Promise<BrokerLockSnapshot> {
 		try {
 			const lock = JSON.parse(raw) as { ownerId?: unknown; pid?: unknown };
 			if (
@@ -425,32 +429,37 @@ export class Broker {
 				Number.isInteger(lock.pid) &&
 				lock.pid > 0
 			)
-				return { ownerId: lock.ownerId, pid: lock.pid, identity: `owner:${lock.ownerId}` };
+				return { ownerId: lock.ownerId, pid: lock.pid, identity: `owner:${lock.ownerId}`, lockIdentity };
 		} catch {}
-		return { pid: 0, identity: `contents:${createHash("sha256").update(raw).digest("hex")}` };
+		return { pid: 0, identity: `contents:${createHash("sha256").update(raw).digest("hex")}`, lockIdentity };
 	}
 	async #readLock(): Promise<BrokerLockSnapshot | null> {
+		let lock: BigIntStats;
 		try {
-			return this.#lockSnapshot(await fs.readFile(this.#lockRecordPath(), "utf8"));
+			lock = await fs.lstat(this.#lock, { bigint: true });
 		} catch (e) {
-			const code = (e as NodeJS.ErrnoException).code;
-			if (code === "ENOTDIR") {
-				try {
-					return this.#lockSnapshot(await fs.readFile(this.#lock, "utf8"));
-				} catch (legacyError) {
-					if ((legacyError as NodeJS.ErrnoException).code === "ENOENT") return null;
-					throw legacyError;
-				}
-			}
-			if (code !== "ENOENT") throw e;
+			if ((e as NodeJS.ErrnoException).code === "ENOENT") return null;
+			throw e;
 		}
+		const lockIdentity = `${lock.dev}:${lock.ino}`;
+		let raw: string;
 		try {
-			const lock = await fs.stat(this.#lock);
-			return lock.isDirectory() ? { pid: 0, identity: `directory:${lock.dev}:${lock.ino}` } : null;
+			raw = lock.isDirectory()
+				? await fs.readFile(path.join(this.#lock, BROKER_LOCK_RECORD), "utf8")
+				: await fs.readFile(this.#lock, "utf8");
+		} catch (e) {
+			if ((e as NodeJS.ErrnoException).code !== "ENOENT") throw e;
+			raw = "";
+		}
+		try {
+			const current = await fs.lstat(this.#lock, { bigint: true });
+			if (`${current.dev}:${current.ino}` !== lockIdentity || current.isDirectory() !== lock.isDirectory())
+				return null;
 		} catch (e) {
 			if ((e as NodeJS.ErrnoException).code === "ENOENT") return null;
 			throw e;
 		}
+		return this.#lockSnapshot(raw, lockIdentity);
 	}
 	async #createLock(): Promise<void> {
 		await fs.mkdir(this.#lock, { mode: 0o700 });
@@ -478,13 +487,18 @@ export class Broker {
 	}
 	async #reclaimStaleLock(snapshot: BrokerLockSnapshot): Promise<void> {
 		const current = await this.#readLock();
-		if (!current || current.identity !== snapshot.identity || (current.pid > 0 && isPidAlive(current.pid))) return;
+		if (
+			!current ||
+			current.identity !== snapshot.identity ||
+			current.lockIdentity !== snapshot.lockIdentity ||
+			(current.pid > 0 && isPidAlive(current.pid))
+		)
+			return;
 
-		// Keep the tombstone: its immutable-owner-derived pathname prevents a contender
-		// holding an old snapshot from renaming a newly-created directory lock.
+		// Snapshot validation and the deterministic instance suffix protect successor locks.
 		const tombstone = path.join(
 			path.dirname(this.#lock),
-			`.broker.lock.stale-${createHash("sha256").update(snapshot.identity).digest("hex")}`,
+			`.broker.lock.stale-${createHash("sha256").update(snapshot.lockIdentity).digest("hex")}`,
 		);
 		try {
 			await fs.rename(this.#lock, tombstone);

package/src/sdk/broker/lifecycle.ts

@@ -7,6 +7,13 @@ import type { NativeExactUnlinkResult } from "@gajae-code/natives";
 import * as native from "@gajae-code/natives";
 import { resolveEquivalentPath } from "@gajae-code/utils";
 
+import {
+	isModelProfileError,
+	type ModelProfileErrorDetails,
+	validateModelProfileName,
+} from "../../config/model-profile-contract";
+import { mergeModelProfiles } from "../../config/model-profiles";
+import { ModelsConfigFile } from "../../config/model-registry";
 import {
 	ensureLaunchWorktree,
 	ensureReusableNodeModules,
@@ -326,14 +333,36 @@ function serializeCleanupIdentity(identity: CleanupIdentity): BrokerCleanupIdent
 	};
 }
 
-const fail = (code: string, message: string, cleanup?: CleanupEvidence): BrokerResponse => ({
+const fail = (
+	code: string,
+	message: string,
+	cleanup?: CleanupEvidence,
+	details?: ModelProfileErrorDetails,
+): BrokerResponse => ({
 	ok: false,
-	error: { code: code as never, message, ...(cleanup ? { cleanup } : {}) },
+	error: { code: code as never, message, ...(details ? { details } : {}), ...(cleanup ? { cleanup } : {}) },
 });
 function text(value: unknown): string | undefined {
 	return typeof value === "string" && value ? value : undefined;
 }
 
+function validateBrokerModelPreset(agentDir: string, requestedProfile: string): string | BrokerResponse {
+	const modelsConfigFile = ModelsConfigFile.relocate(path.join(agentDir, "models.yml"));
+	modelsConfigFile.invalidate();
+	const loaded = modelsConfigFile.tryLoad();
+	const profiles = mergeModelProfiles(loaded.status === "ok" ? loaded.value.profiles : undefined);
+	try {
+		return validateModelProfileName(requestedProfile, profiles, loaded.status === "error" ? loaded.error : undefined);
+	} catch (error) {
+		if (isModelProfileError(error)) return fail(error.code, error.message, undefined, error.details);
+		throw error;
+	}
+}
+
+export function validateBrokerModelPresetForTest(agentDir: string, requestedProfile: string): string | BrokerResponse {
+	return validateBrokerModelPreset(agentDir, requestedProfile);
+}
+
 function readinessTimeout(input: Input): number | BrokerResponse {
 	const value = input.readinessTimeoutMs;
 	if (value === undefined) return READY_TIMEOUT_MS;
@@ -624,7 +653,7 @@ type ReadyAuthority = {
 };
 type ReadinessResult =
 	| { kind: "ready"; authority: ReadyAuthority }
-	| { kind: "startup_failed"; message: string }
+	| { kind: "startup_failed"; failure: SdkStartupFailure }
 	| { kind: "child_exited" }
 	| { kind: "timeout" };
 const processIncarnationReadersForTest = new WeakMap<Broker, (pid: number) => string | undefined>();
@@ -797,19 +826,25 @@ function isLifecycleTranscriptEvidence(value: unknown): value is LifecycleTransc
 function isSdkStartupFailure(value: unknown): value is SdkStartupFailure {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
 	const failure = value as Record<string, unknown>;
-	return (
-		Object.keys(failure).length === 3 &&
-		(failure.phase === "registration" || failure.phase === "startup") &&
-		(failure.reason === "disabled" ||
-			failure.reason === "ineligible" ||
-			failure.reason === "factory_absent" ||
-			failure.reason === "runner_absent" ||
-			failure.reason === "pending" ||
-			failure.reason === "failed") &&
-		typeof failure.message === "string" &&
-		Buffer.byteLength(failure.message) > 0 &&
-		Buffer.byteLength(failure.message) <= 512
-	);
+	const keys = Object.keys(failure);
+	if (
+		!keys.every(
+			key => key === "phase" || key === "reason" || key === "message" || key === "code" || key === "details",
+		) ||
+		(failure.phase !== "registration" && failure.phase !== "startup") ||
+		(failure.reason !== "disabled" &&
+			failure.reason !== "ineligible" &&
+			failure.reason !== "factory_absent" &&
+			failure.reason !== "runner_absent" &&
+			failure.reason !== "pending" &&
+			failure.reason !== "failed") ||
+		typeof failure.message !== "string" ||
+		Buffer.byteLength(failure.message) === 0 ||
+		Buffer.byteLength(failure.message) > 512
+	)
+		return false;
+	if (failure.code === undefined && failure.details === undefined) return keys.length === 3;
+	return keys.length === 5 && isModelProfileError(failure);
 }
 
 function isLifecycleFailureArtifact(value: unknown): value is LifecycleFailureArtifact {
@@ -818,8 +853,14 @@ function isLifecycleFailureArtifact(value: unknown): value is LifecycleFailureAr
 	if (!isEffectMarker(record)) return false;
 	const artifact = value as LifecycleFailureArtifact;
 	return (
-		Object.keys(record).length === (artifact.transcript === undefined ? 7 : 8) &&
-		isSdkStartupFailure({ phase: artifact.phase, reason: artifact.reason, message: artifact.message }) &&
+		Object.keys(record).length ===
+			7 + (artifact.code === undefined ? 0 : 2) + (artifact.transcript === undefined ? 0 : 1) &&
+		isSdkStartupFailure({
+			phase: artifact.phase,
+			reason: artifact.reason,
+			message: artifact.message,
+			...(artifact.code === undefined ? {} : { code: artifact.code, details: artifact.details }),
+		}) &&
 		isRollbackResult(artifact.rollback) &&
 		(artifact.transcript === undefined || isLifecycleTranscriptEvidence(artifact.transcript))
 	);
@@ -865,6 +906,8 @@ export async function writeSessionLifecycleFailure(
 		...(transcript ? { transcript } : {}),
 	};
 	const bytes = Buffer.from(canonicalJson(artifact), "utf8");
+	if (bytes.length > MAX_LIFECYCLE_METADATA_BYTES)
+		throw new Error("Lifecycle startup failure exceeds the metadata size ceiling.");
 	const target = lifecycleFailurePath(root, id, effectMarker);
 	const temporary = path.join(directory, `.${id}.lifecycle.failure.${effectMarker}.${randomUUID()}.tmp`);
 	let published = false;
@@ -1241,6 +1284,10 @@ function validateLifecycleMetadataReplay(cleanup: CleanupEvidence): BrokerRespon
 			if (!current) continue;
 			if (!sameLifecycleCleanupIdentity(current.identity, file.identity))
 				return fail("terminal_uncertain", "Lifecycle metadata candidate lacks exact replay authority.");
+			// A completed file's recorded retained quarantine is receipt-bound durable
+			// evidence; anything else that remains is an active survivor.
+			if (file.completed && file.detachedPath && path.resolve(candidate) === path.resolve(file.detachedPath))
+				continue;
 			activeCandidates++;
 		}
 		if (file.completed && activeCandidates > 0)
@@ -1289,7 +1336,21 @@ function lifecycleMetadataReplayAbsent(cleanup: CleanupEvidence): boolean {
 	const id = cleanup.sessionId!;
 	const required = new Set<string>([lifecycleMarkerPath(root, id), lifecycleReadyPath(root, id)]);
 	for (const file of files) for (const candidate of lifecycleCleanupCandidates(file)) required.add(candidate);
-	return [...required].every(absentLifecyclePath);
+	for (const candidate of required) {
+		if (absentLifecyclePath(candidate)) continue;
+		// A completed file's recorded retained quarantine is durable evidence, not a
+		// survivor — accept it only at its receipt-bound path and identity.
+		const owner = files.find(
+			file =>
+				file.completed === true &&
+				file.detachedPath !== undefined &&
+				path.resolve(file.detachedPath) === path.resolve(candidate),
+		);
+		if (!owner) return false;
+		const current = captureLifecycleFile(candidate, true, true);
+		if (!current || !sameLifecycleCleanupIdentity(current.identity, owner.identity)) return false;
+	}
+	return true;
 }
 
 /**
@@ -1552,16 +1613,28 @@ async function reconcileLifecycleCleanup(
 		const candidates = lifecycleCleanupCandidates(file);
 		if (file.completed) {
 			for (const candidate of candidates) {
+				let stat: ReturnType<typeof fsSync.lstatSync>;
 				try {
-					fsSync.lstatSync(candidate);
-					return fail(
-						"terminal_uncertain",
-						"Lifecycle cleanup receipt marks a target complete while an authorized candidate remains.",
-					);
+					stat = fsSync.lstatSync(candidate);
 				} catch (error) {
-					if ((error as NodeJS.ErrnoException).code !== "ENOENT")
-						return fail("terminal_uncertain", "Lifecycle cleanup completion could not be safely inspected.");
+					if ((error as NodeJS.ErrnoException).code === "ENOENT") continue;
+					return fail("terminal_uncertain", "Lifecycle cleanup completion could not be safely inspected.");
+				}
+				// A completed file's recorded retained quarantine is durable evidence,
+				// not a survivor — accept it only at its receipt-bound path and identity.
+				if (
+					file.detachedPath &&
+					path.resolve(candidate) === path.resolve(file.detachedPath) &&
+					stat.isFile() &&
+					!stat.isSymbolicLink()
+				) {
+					const current = captureLifecycleFile(candidate, true, true);
+					if (current && sameLifecycleCleanupIdentity(current.identity, file.identity)) continue;
 				}
+				return fail(
+					"terminal_uncertain",
+					"Lifecycle cleanup receipt marks a target complete while an authorized candidate remains.",
+				);
 			}
 			continue;
 		}
@@ -1631,6 +1704,22 @@ async function reconcileLifecycleCleanup(
 			quarantineName: path.basename(currentFile.plannedPath),
 		});
 		if (!result.ok) {
+			if (result.code === "cleanup_pending" && result.detachedPath === currentFile.plannedPath) {
+				// Typed retained authority: the native verified the exact identity-bound
+				// detach and retained the quarantine as durable evidence. Record the
+				// evidence and advance — never claim a terminal byte deletion.
+				const lifecycleFiles = activeCleanup.lifecycleFiles!.map((candidate, candidateIndex) =>
+					candidateIndex === index
+						? { ...candidate, detachedPath: result.detachedPath, completed: true as const }
+						: candidate,
+				);
+				activeCleanup = { ...activeCleanup, lifecycleFiles };
+				await broker.ledger.transition(identity, "effect_started", {
+					response: fail("cleanup_pending", "Lifecycle cleanup completion was durably reconciled.", activeCleanup),
+				});
+				lifecycleCleanupHooksForTest.get(broker)?.();
+				continue;
+			}
 			const lifecycleFiles = activeCleanup.lifecycleFiles!.map((candidate, candidateIndex) =>
 				candidateIndex === index && result.detachedPath
 					? { ...candidate, detachedPath: result.detachedPath }
@@ -1665,6 +1754,22 @@ async function readSessionLifecycleFailure(
 		?.artifact;
 }
 
+export async function readSessionLifecycleFailureForTest(
+	root: string,
+	id: string,
+	expected: { pid: number; effectMarker: string; incarnation: string },
+): Promise<SdkStartupFailure | undefined> {
+	const artifact = await readSessionLifecycleFailure(root, id, expected);
+	return artifact
+		? {
+				phase: artifact.phase,
+				reason: artifact.reason,
+				message: artifact.message,
+				...(artifact.code === undefined ? {} : { code: artifact.code, details: artifact.details }),
+			}
+		: undefined;
+}
+
 async function hasDurableProcessIdentity(
 	root: string,
 	id: string,
@@ -2056,14 +2161,14 @@ async function waitForReady(
 ): Promise<ReadinessResult> {
 	while (timing.now() < deadline) {
 		const startupFailure = await readSessionLifecycleFailure(root, id, expected);
-		if (startupFailure) return { kind: "startup_failed", message: startupFailure.message };
+		if (startupFailure) return { kind: "startup_failed", failure: startupFailure };
 		if (
 			observeProcess(expected.pid, expected.incarnation, value => processIncarnationForBroker(broker, value)) ===
 			"exited"
 		) {
 			const finalStartupFailure = await readSessionLifecycleFailure(root, id, expected);
 			return finalStartupFailure
-				? { kind: "startup_failed", message: finalStartupFailure.message }
+				? { kind: "startup_failed", failure: finalStartupFailure }
 				: { kind: "child_exited" };
 		}
 		try {
@@ -2191,6 +2296,8 @@ async function launchInput(
 	const requested = sessionId(input);
 	if (requested !== undefined && !isCanonicalSessionId(requested))
 		return fail("invalid_input", "sessionId must be a canonical safe identifier.");
+	if (input.modelPreset !== undefined && (typeof input.modelPreset !== "string" || input.modelPreset.length === 0))
+		return fail("invalid_input", "modelPreset must be a non-empty exact profile ID.");
 	const modelPreset = text(input.modelPreset);
 
 	if (operation === "session.create")
@@ -2615,6 +2722,11 @@ async function executeLifecycleResponse(
 
 		const launch = await launchInput(broker, operation, input);
 		if ("ok" in launch) return launch;
+		if (launch.modelPreset) {
+			const validatedModelPreset = validateBrokerModelPreset(broker.settings.agentDir, launch.modelPreset);
+			if (typeof validatedModelPreset !== "string") return validatedModelPreset;
+			launch.modelPreset = validatedModelPreset;
+		}
 		if (!hasProcessIncarnationAuthority())
 			return fail(
 				"incarnation_unavailable",
@@ -2768,7 +2880,12 @@ async function executeLifecycleResponse(
 					`Session ${launch.id} did not become ready and its spawned process could not be verified dead.`,
 				);
 			return readiness.kind === "startup_failed"
-				? fail("spawn_failed", readiness.message)
+				? fail(
+						readiness.failure.code ?? "spawn_failed",
+						readiness.failure.message,
+						undefined,
+						readiness.failure.details,
+					)
 				: readiness.kind === "child_exited"
 					? fail("spawn_failed", `Session ${launch.id} exited before registering readiness.`)
 					: fail(
@@ -3043,11 +3160,26 @@ async function executeLifecycleResponse(
 				`Unable to delete saved session artifacts: ${error instanceof Error ? error.message : String(error)}`,
 			);
 		}
-		if (deleted.kind === "artifacts_removed") {
+		const retainedArtifactsCleanup =
+			deleted.kind === "cleanup_pending" &&
+			deleted.phase === "artifacts" &&
+			deleted.detachedArtifactsPath !== undefined &&
+			cleanupTarget.plannedArtifactsPath !== undefined &&
+			(deleted.detachedArtifactsPath === cleanupTarget.plannedArtifactsPath ||
+				deleted.detachedArtifactsPath === `${cleanupTarget.plannedArtifactsPath}.removing`);
+		if (deleted.kind === "artifacts_removed" || retainedArtifactsCleanup) {
 			const transcriptPhaseCleanup = {
 				...preauthorizedCleanup,
 				phase: "transcript" as const,
 				artifactsRemoved: true,
+				...(deleted.kind === "cleanup_pending" && deleted.phase === "artifacts"
+					? {
+							detachedArtifactsPath: deleted.detachedArtifactsPath,
+							...(deleted.artifactsIdentity
+								? { artifactsIdentity: serializeCleanupIdentity(deleted.artifactsIdentity) }
+								: {}),
+						}
+					: {}),
 				...(preauthorizedCleanup.artifactTree
 					? { artifactTree: { ...preauthorizedCleanup.artifactTree, completed: true as const } }
 					: {}),
@@ -3068,7 +3200,14 @@ async function executeLifecycleResponse(
 				artifactsRemoved: true,
 			});
 		}
-		if (deleted.kind === "cleanup_pending")
+		if (
+			deleted.kind === "cleanup_pending" &&
+			!(
+				deleted.phase === "transcript" &&
+				deleted.detachedTranscriptPath !== undefined &&
+				deleted.detachedTranscriptPath === cleanupTarget.plannedTranscriptPath
+			)
+		)
 			return fail(
 				"cleanup_pending",
 				`Saved session cleanup is pending in ${deleted.phase}: ${deleted.error.message}`,
@@ -3323,6 +3462,9 @@ export async function executeLifecycle(
 				phase: evidence.artifact.phase,
 				reason: evidence.artifact.reason,
 				message: evidence.artifact.message,
+				...(evidence.artifact.code === undefined
+					? {}
+					: { code: evidence.artifact.code, details: evidence.artifact.details }),
 				rollback: {
 					endpointGeneration: evidence.artifact.rollback.endpointGeneration,
 					fenced: evidence.artifact.rollback.fenced,
@@ -3387,11 +3529,18 @@ export async function executeLifecycle(
 				: startupFailure && cleanupProof
 					? {
 							ok: false,
-							error: {
-								code: "spawn_failed",
-								message: "No ready SDK endpoint remains available.",
-								endpoint: "unavailable",
-							},
+							error: startupFailure.code
+								? {
+										code: startupFailure.code,
+										message: startupFailure.message,
+										details: startupFailure.details!,
+										endpoint: "unavailable" as const,
+									}
+								: {
+										code: "spawn_failed",
+										message: "No ready SDK endpoint remains available.",
+										endpoint: "unavailable" as const,
+									},
 							...(durableEffects ? { durableEffects } : {}),
 							startupFailure,
 						}

package/src/sdk/broker/session-index.ts

@@ -131,6 +131,7 @@ function compactEvents(events: SessionIndexEvent[]): SessionIndexEvent[] {
 
 async function appendSync(file: string, value: string): Promise<void> {
 	const h = await fs.open(file, "a", 0o600);
+	let failure: { error: unknown } | undefined;
 	try {
 		const data = Buffer.from(`${value}\n`);
 		for (let offset = 0; offset < data.length; ) {
@@ -139,9 +140,18 @@ async function appendSync(file: string, value: string): Promise<void> {
 			offset += bytesWritten;
 		}
 		await h.sync();
-	} finally {
+	} catch (error) {
+		failure = { error };
+	}
+	try {
 		await h.close();
+	} catch (error) {
+		// Bun may report EBADF when concurrent child-pipe teardown has already
+		// released a fully written and fsynced append handle. The descriptor is
+		// closed in that case; every other close failure remains fatal.
+		if ((error as NodeJS.ErrnoException).code !== "EBADF" && failure === undefined) failure = { error };
 	}
+	if (failure !== undefined) throw failure.error;
 }
 
 async function syncDirectory(file: string): Promise<void> {

package/src/sdk/bus/chat-daemon-control.ts

@@ -28,11 +28,17 @@ export type ChatDaemonAction = "stop" | "reload";
  * Generation 7 restores macOS daemon signaling (kill(2) with a start-time
  * incarnation recheck) so a live/hung owner can be replaced without an external
  * `kill -9`. Generation 8 adopts Windows expected-identity ACL verification and
- * repair for shared native authority.
+ * repair for shared native authority. Generation 9 refreshes the shared native
+ * authority declaration contract with bounded frame-delivery acknowledgement.
+ * Generation 11 accepts typed retained exact-unlink cleanup authority — a
+ * concrete detached quarantine plus a proven-absent canonical lock pathname —
+ * when deleting an observed owner-lock lease. Generation 12 refreshes retained
+ * native path and process authority semantics. Generation 13 rejects special
+ * files before retained native authority opens.
  */
 export const CHAT_DAEMON_GENERATIONS: Readonly<Record<ChatDaemonKind, number>> = {
-	discord: 8,
-	slack: 8,
+	discord: 13,
+	slack: 13,
 };
 
 export function chatDaemonGeneration(kind: ChatDaemonKind): number {
@@ -938,10 +944,19 @@ async function ownsChatDaemonOwnerLock(lock: string, lease: ChatDaemonOwnerLockL
 /** Deletes only the exact lease observed by this contender; a successor is retained. */
 function unlinkExactChatDaemonOwnerLock(lock: string, lease: ChatDaemonOwnerLockLease): boolean {
 	try {
-		return native.exactUnlink(lock, {
+		const removed = native.exactUnlink(lock, {
 			...lease,
 			quarantineName: `.gjc-delete-chat-daemon-lock-${crypto.randomUUID()}`,
-		}).ok;
+		});
+		if (removed.ok) return true;
+		// Accept only typed retained authority: a concrete detached quarantine plus
+		// a proven-absent canonical lock pathname. Anything else stays fail-closed.
+		return (
+			removed.code === "cleanup_pending" &&
+			typeof removed.detachedPath === "string" &&
+			removed.detachedPath.length > 0 &&
+			!fs.existsSync(lock)
+		);
 	} catch {
 		return false;
 	}

package/src/sdk/bus/config-commands.ts

@@ -5,8 +5,8 @@
  * removed), but the user can still adjust per-surface behaviour from inside a
  * session thread with small slash commands:
  *
- * - `/verbose`            switch the mirror to bounded tool-owned summaries + provider-displayable reasoning summaries
- * - `/lean`               switch back to lean (assistant text + tool names)
+ * - `/verbose`            switch the mirror to per-turn assistant text + tool summaries + reasoning summaries
+ * - `/lean`               settled assistant answer at idle + immediate ask lead-ins (no intermediate tool-turn flood)
  * - `/verbosity lean|verbose`
  * - `/redact on|off`      toggle redaction of streamed content
  *