@gajae-code/coding-agent 0.11.7 → 0.11.9

package/src/session/session-storage.ts

@@ -167,6 +167,8 @@ export interface SessionStorage {
 	readSnapshotSync?(path: string): SessionStorageSnapshot;
 	statSync(path: string): SessionStorageStat;
 	listFilesSync(dir: string, pattern: string): string[];
+	/** List matching files with mtimes without issuing one JavaScript stat call per path. */
+	listFilesByMtime?(dir: string, pattern: string): Promise<Array<{ path: string; mtimeMs: number }>>;
 	/**
 	 * Strict directory scan that never suppresses scan/root errors. Used by strict
 	 * authorization inventory; the forgiving {@link listFilesSync} stays display-only.
@@ -259,6 +261,19 @@ export interface VerifiedSessionDeleteTarget {
 	detachedArtifactsPath?: string;
 	/** Identity-bound quarantine path retained when transcript unlink deferred cleanup. */
 	detachedTranscriptPath?: string;
+	/** Native-retained publisher successor observed during transcript cleanup. */
+	retainedTranscriptSuccessorPath?: string;
+	/** Native-retained exchange placeholder observed during transcript cleanup. */
+	retainedTranscriptPlaceholderPath?: string;
+	/** Native-retained transcript entry whose identity could not be verified. */
+	retainedTranscriptUnknownPath?: string;
+	/** Native-retained publisher successor observed during cleanup. */
+	retainedArtifactsSuccessorPath?: string;
+	/** Native-retained exchange placeholder observed during cleanup. */
+	retainedArtifactsPlaceholderPath?: string;
+	/** Native-retained entry whose identity could not be verified. */
+	retainedArtifactsUnknownPath?: string;
+
 	/** Caller-published, no-replace quarantine pathname for the next artifact detach. */
 	plannedArtifactsPath?: string;
 	/** Caller-published, no-replace quarantine pathname for the next transcript detach. */
@@ -288,6 +303,9 @@ export type VerifiedSessionDeleteResult =
 			artifactsTree: NativeDirectoryTreeSnapshot;
 			/** Transcript identity (unchanged) for retry binding. */
 			transcriptIdentity: SessionStorageFileIdentity;
+			retainedSuccessorPath?: string;
+			retainedPlaceholderPath?: string;
+			retainedUnknownPath?: string;
 	  }
 	| {
 			kind: "cleanup_pending";
@@ -297,6 +315,9 @@ export type VerifiedSessionDeleteResult =
 			transcriptIdentity: SessionStorageFileIdentity;
 			/** Optional identity-bound transcript quarantine path for restart cleanup. */
 			detachedTranscriptPath?: string;
+			retainedSuccessorPath?: string;
+			retainedPlaceholderPath?: string;
+			retainedUnknownPath?: string;
 	  };
 
 /** Default OS-close dispatcher: a direct `fs.closeSync`. */
@@ -306,7 +327,22 @@ const defaultCloseAdapter: SessionStorageWriterCloseAdapter = {
 	},
 };
 
-type NativeExactUnlinkResult = { ok: true; detachedPath?: string } | { ok: false; code: string; detachedPath?: string };
+type NativeExactUnlinkResult =
+	| {
+			ok: true;
+			detachedPath?: string;
+			retainedSuccessorPath?: string;
+			retainedPlaceholderPath?: string;
+			retainedUnknownPath?: string;
+	  }
+	| {
+			ok: false;
+			code: string;
+			detachedPath?: string;
+			retainedSuccessorPath?: string;
+			retainedPlaceholderPath?: string;
+			retainedUnknownPath?: string;
+	  };
 type NativeExactUnlink = (
 	path: string,
 	identity: {
@@ -671,6 +707,21 @@ export class FileSessionStorage implements SessionStorage {
 			return [];
 		}
 	}
+	async listFilesByMtime(dir: string, pattern: string): Promise<Array<{ path: string; mtimeMs: number }>> {
+		const result = await native.glob({
+			path: dir,
+			pattern,
+			fileType: native.FileType.File,
+			recursive: false,
+			hidden: false,
+			gitignore: false,
+			sortByMtime: true,
+		});
+		return result.matches.map(match => ({
+			path: path.join(dir, match.path),
+			mtimeMs: match.mtime ?? 0,
+		}));
+	}
 
 	listFilesStrictSync(dir: string, pattern: string): string[] {
 		// Strict: never suppress scan/root errors. Authorization inventory depends on
@@ -766,7 +817,13 @@ export class FileSessionStorage implements SessionStorage {
 			expectedArtifactsIdentity,
 			expectedArtifactsTree,
 			detachedArtifactsPath,
+			retainedArtifactsSuccessorPath,
+			retainedArtifactsPlaceholderPath,
+			retainedArtifactsUnknownPath,
 			detachedTranscriptPath,
+			retainedTranscriptSuccessorPath,
+			retainedTranscriptPlaceholderPath,
+			retainedTranscriptUnknownPath,
 			plannedArtifactsPath,
 			plannedTranscriptPath,
 			artifactsRemoved,
@@ -847,7 +904,8 @@ export class FileSessionStorage implements SessionStorage {
 			if (
 				!expectedArtifactsIdentity ||
 				path.dirname(detachedArtifactsPath) !== path.dirname(transcriptPath) ||
-				!path.basename(detachedArtifactsPath).startsWith(".gjc-delete-")
+				(!path.basename(detachedArtifactsPath).startsWith(".gjc-delete-") &&
+					!detachedArtifactsPath.endsWith(".removing"))
 			) {
 				throw new SessionDeleteVerificationError("artifacts", "Detached artifact cleanup evidence is invalid");
 			}
@@ -882,17 +940,20 @@ export class FileSessionStorage implements SessionStorage {
 					artifactsIdentity: expectedArtifactsIdentity,
 					detachedArtifactsPath: retainedRoot,
 					artifactsTree: expectedArtifactsTree,
+					...((removal.retainedSuccessorPath ?? retainedArtifactsSuccessorPath)
+						? { retainedSuccessorPath: removal.retainedSuccessorPath ?? retainedArtifactsSuccessorPath }
+						: {}),
+					...((removal.retainedPlaceholderPath ?? retainedArtifactsPlaceholderPath)
+						? { retainedPlaceholderPath: removal.retainedPlaceholderPath ?? retainedArtifactsPlaceholderPath }
+						: {}),
+					...((removal.retainedUnknownPath ?? retainedArtifactsUnknownPath)
+						? { retainedUnknownPath: removal.retainedUnknownPath ?? retainedArtifactsUnknownPath }
+						: {}),
 					transcriptIdentity,
 				};
 			}
 		}
 
-		if (artifactsRemoved && (detachedArtifactsPath || expectedArtifactsIdentity)) {
-			throw new SessionDeleteVerificationError(
-				"artifacts",
-				"Artifact phase receipt conflicts with pending artifact cleanup",
-			);
-		}
 		const artifactsDir = transcriptPath.slice(0, -6);
 		const artifactsIdentity = this.#optionalDirectoryIdentity(artifactsDir);
 		if (artifactsRemoved && artifactsIdentity) {
@@ -947,12 +1008,48 @@ export class FileSessionStorage implements SessionStorage {
 				directory: true,
 				quarantineName: path.basename(plannedArtifactsPath),
 			});
-			if (!detach.ok || !detach.detachedPath) {
+			if (!detach.detachedPath) {
 				throw new SessionDeleteVerificationError(
 					"artifacts",
 					`Exact artifact detach rejected: ${detach.ok ? "missing_path" : detach.code}`,
 				);
 			}
+			if (!detach.ok && process.platform !== "win32") {
+				let descriptor: number | undefined;
+				try {
+					descriptor = fs.openSync(
+						path.dirname(transcriptPath),
+						fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW,
+					);
+					const durableParent = fs.fstatSync(descriptor, { bigint: true });
+					if (
+						!durableParent.isDirectory() ||
+						durableParent.dev !== parentIdentity.dev ||
+						durableParent.ino !== parentIdentity.ino
+					)
+						throw new Error("parent_changed");
+					fs.fsyncSync(descriptor);
+				} catch (error) {
+					throw new SessionDeleteVerificationError("artifacts", "durability_failed", { cause: toError(error) });
+				} finally {
+					if (descriptor !== undefined) fs.closeSync(descriptor);
+				}
+			}
+			if (!detach.ok) {
+				return {
+					kind: "cleanup_pending",
+					phase: "artifacts",
+					error: new SessionDeleteVerificationError("artifacts", `Exact artifact detach retained: ${detach.code}`),
+					artifactsIdentity,
+					detachedArtifactsPath: detach.detachedPath,
+					artifactsTree,
+					...(detach.retainedSuccessorPath ? { retainedSuccessorPath: detach.retainedSuccessorPath } : {}),
+					...(detach.retainedPlaceholderPath ? { retainedPlaceholderPath: detach.retainedPlaceholderPath } : {}),
+					...(detach.retainedUnknownPath ? { retainedUnknownPath: detach.retainedUnknownPath } : {}),
+
+					transcriptIdentity,
+				};
+			}
 			const removal = removeDirectoryTreeExact(detach.detachedPath, artifactsTree);
 			if (!removal.ok) {
 				const retainedRoot = removal.detachedPath ?? detach.detachedPath;
@@ -971,6 +1068,15 @@ export class FileSessionStorage implements SessionStorage {
 					artifactsIdentity,
 					detachedArtifactsPath: retainedRoot,
 					artifactsTree,
+					...((removal.retainedSuccessorPath ?? retainedArtifactsSuccessorPath)
+						? { retainedSuccessorPath: removal.retainedSuccessorPath ?? retainedArtifactsSuccessorPath }
+						: {}),
+					...((removal.retainedPlaceholderPath ?? retainedArtifactsPlaceholderPath)
+						? { retainedPlaceholderPath: removal.retainedPlaceholderPath ?? retainedArtifactsPlaceholderPath }
+						: {}),
+					...((removal.retainedUnknownPath ?? retainedArtifactsUnknownPath)
+						? { retainedUnknownPath: removal.retainedUnknownPath ?? retainedArtifactsUnknownPath }
+						: {}),
 					transcriptIdentity,
 				};
 			}
@@ -1010,13 +1116,27 @@ export class FileSessionStorage implements SessionStorage {
 			});
 			if (!deletion.ok) {
 				const error = exactUnlinkFailure(deletion);
-				if (error.kind === "identity" || error.kind === "symlink") throw error;
+				const retainedAuthority =
+					deletion.detachedPath ||
+					deletion.retainedSuccessorPath ||
+					deletion.retainedPlaceholderPath ||
+					deletion.retainedUnknownPath;
+				if ((error.kind === "identity" || error.kind === "symlink") && !retainedAuthority) throw error;
 				return {
 					kind: "cleanup_pending",
 					phase: "transcript",
 					error,
 					transcriptIdentity,
 					detachedTranscriptPath: deletion.detachedPath ?? detachedTranscriptPath,
+					...((deletion.retainedSuccessorPath ?? retainedTranscriptSuccessorPath)
+						? { retainedSuccessorPath: deletion.retainedSuccessorPath ?? retainedTranscriptSuccessorPath }
+						: {}),
+					...((deletion.retainedPlaceholderPath ?? retainedTranscriptPlaceholderPath)
+						? { retainedPlaceholderPath: deletion.retainedPlaceholderPath ?? retainedTranscriptPlaceholderPath }
+						: {}),
+					...((deletion.retainedUnknownPath ?? retainedTranscriptUnknownPath)
+						? { retainedUnknownPath: deletion.retainedUnknownPath ?? retainedTranscriptUnknownPath }
+						: {}),
 				};
 			}
 			return { kind: "deleted" };
@@ -1058,13 +1178,27 @@ export class FileSessionStorage implements SessionStorage {
 		});
 		if (!deletion.ok) {
 			const error = exactUnlinkFailure(deletion);
-			if (error.kind === "identity" || error.kind === "symlink") throw error;
+			const retainedAuthority =
+				deletion.detachedPath ||
+				deletion.retainedSuccessorPath ||
+				deletion.retainedPlaceholderPath ||
+				deletion.retainedUnknownPath;
+			if ((error.kind === "identity" || error.kind === "symlink") && !retainedAuthority) throw error;
 			return {
 				kind: "cleanup_pending",
 				phase: "transcript",
 				error,
 				transcriptIdentity,
 				detachedTranscriptPath: deletion.detachedPath,
+				...((deletion.retainedSuccessorPath ?? retainedTranscriptSuccessorPath)
+					? { retainedSuccessorPath: deletion.retainedSuccessorPath ?? retainedTranscriptSuccessorPath }
+					: {}),
+				...((deletion.retainedPlaceholderPath ?? retainedTranscriptPlaceholderPath)
+					? { retainedPlaceholderPath: deletion.retainedPlaceholderPath ?? retainedTranscriptPlaceholderPath }
+					: {}),
+				...((deletion.retainedUnknownPath ?? retainedTranscriptUnknownPath)
+					? { retainedUnknownPath: deletion.retainedUnknownPath ?? retainedTranscriptUnknownPath }
+					: {}),
 			};
 		}
 		return { kind: "deleted" };
@@ -1353,6 +1487,12 @@ export class MemorySessionStorage implements SessionStorage {
 		}
 		return files;
 	}
+	listFilesByMtime(dir: string, pattern: string): Promise<Array<{ path: string; mtimeMs: number }>> {
+		const files = this.listFilesSync(dir, pattern)
+			.map(path => ({ path, mtimeMs: this.statSync(path).mtimeMs }))
+			.sort((a, b) => b.mtimeMs - a.mtimeMs);
+		return Promise.resolve(files);
+	}
 	listFilesStrictSync(dir: string, pattern: string): string[] {
 		// In-memory scan never suppresses; identical to the display scan.
 		return this.listFilesSync(dir, pattern);

package/src/skill-state/active-state.ts

@@ -71,6 +71,8 @@ export interface SkillActiveEntry {
 	handoff_at?: string;
 	active_subskills?: ActiveSubskillEntry[];
 	source_state_revision?: number;
+	/** Durable ordering token from the source workflow mode-state, not this cache file's revision. */
+	committed_mode_state_revision?: number;
 }
 
 export interface SkillActiveState {
@@ -114,6 +116,8 @@ export interface SyncSkillActiveStateOptions {
 	handoff_at?: string;
 	active_subskills?: ActiveSubskillEntry[];
 	sourceRevision?: number;
+	/** Durable ordering token from the source workflow mode-state, not this cache file's revision. */
+	committedModeRevision?: number;
 }
 
 const HUD_TEXT_LIMIT = 80;
@@ -785,6 +789,9 @@ async function persistActiveEntry(
 		await writeActiveEntry(cwd, sessionScope, entry.skill, entry, {
 			cwd,
 			audit: activeStateWriterAudit("write-active-entry", sessionScope),
+			...(typeof entry.committed_mode_state_revision === "number"
+				? { orderingRevision: entry.committed_mode_state_revision }
+				: {}),
 		});
 	}
 }
@@ -863,6 +870,9 @@ export async function syncSkillActiveState(options: SyncSkillActiveStateOptions)
 				? { active_subskills: preservedActiveSubskills }
 				: {}),
 		...(typeof options.sourceRevision === "number" ? { source_state_revision: options.sourceRevision } : {}),
+		...(typeof options.committedModeRevision === "number"
+			? { committed_mode_state_revision: options.committedModeRevision }
+			: {}),
 	};
 	const sessionScope = { sessionId: options.sessionId };
 	await removeSupersededPlanningPipelineEntries(options.cwd, sessionScope, entry);

package/src/task/executor.ts

@@ -486,11 +486,12 @@ function buildSchemaViolationOutcome(
 		missing.length > 0
 			? `schema_violation: missing required fields: ${missing.join(", ")}`
 			: `schema_violation: ${failure.message}`;
+	const dataPreview = previewOffendingData(data);
 	const payload = {
 		error: "schema_violation",
 		message: failure.message,
 		missingRequired: missing,
-		data: previewOffendingData(data),
+		data,
 	};
 	let rawOutput: string;
 	try {
@@ -498,7 +499,7 @@ function buildSchemaViolationOutcome(
 	} catch {
 		rawOutput = `{"error":"schema_violation","message":${JSON.stringify(headline)}}`;
 	}
-	return { rawOutput, stderr: headline, exitCode: 1 };
+	return { rawOutput, stderr: `${headline}. Offending data preview: ${dataPreview}`, exitCode: 1 };
 }
 
 function buildPlaceholderYieldOutcome(
@@ -541,9 +542,16 @@ export function finalizeSubprocessOutput(args: FinalizeSubprocessOutputArgs): Fi
 				const completeData = normalizeCompleteData(submitData, reportFindings);
 				const { validator, error: schemaError } = buildOutputValidator(outputSchema);
 				if (schemaError) {
-					rawOutput = `{"error":"schema_violation","message":"invalid output schema: ${schemaError.replace(/"/g, '\\"')}"}`;
-					stderr = `schema_violation: invalid output schema: ${schemaError}`;
-					exitCode = 1;
+					const outcome = buildSchemaViolationOutcome(
+						{
+							message: `invalid output schema: ${schemaError}`,
+							missingRequired: [],
+						},
+						completeData,
+					);
+					rawOutput = outcome.rawOutput;
+					stderr = outcome.stderr;
+					exitCode = outcome.exitCode;
 				} else {
 					const placeholderPath = findPlaceholderYieldPath(completeData);
 					if (placeholderPath) {

package/src/task/gjc-command.ts

@@ -1,6 +1,6 @@
 import process from "node:process";
 
-import { $env } from "@gajae-code/utils";
+import { $pickenv } from "@gajae-code/utils";
 
 interface GjcCommand {
 	cmd: string;
@@ -12,7 +12,7 @@ const DEFAULT_CMD = process.platform === "win32" ? "gjc.cmd" : "gjc";
 const DEFAULT_SHELL = process.platform === "win32";
 
 export function resolveGjcCommand(): GjcCommand {
-	const envCmd = $env.PI_SUBPROCESS_CMD;
+	const envCmd = $pickenv("GJC_SUBPROCESS_CMD", "PI_SUBPROCESS_CMD");
 	if (envCmd?.trim()) {
 		return { cmd: envCmd, args: [], shell: DEFAULT_SHELL };
 	}

package/src/task/index.ts

@@ -17,7 +17,7 @@ import * as os from "node:os";
 import path from "node:path";
 import type { AgentTool, AgentToolResult, AgentToolUpdateCallback } from "@gajae-code/agent-core";
 import type { Model, Usage } from "@gajae-code/ai";
-import { $env, prompt, Snowflake } from "@gajae-code/utils";
+import { $pickenv, prompt, Snowflake } from "@gajae-code/utils";
 import type { ToolSession } from "..";
 import { AsyncJobManager, OwnerSubagentShutdownError, type ResumeRunner } from "../async";
 import { resolveAgentModelPatterns } from "../config/model-resolver";
@@ -43,6 +43,15 @@ import {
 
 // Import review tools for side effects (registers subagent tool handlers)
 import "../tools/review";
+import {
+	assertExecutionRootMatchesRepositoryBinding,
+	assertPathUnderRepositoryBinding,
+	captureRepositoryBinding,
+	publicRepositoryBinding,
+	type RepositoryBinding,
+	RepositoryBindingError,
+	resolveTaskRepositoryBinding,
+} from "../gjc-runtime/repository-binding";
 import { initializeLocalRoot, type LocalProtocolOptions, resolveLocalUrlToPath } from "../internal-urls";
 import { generateCommitMessage } from "../utils/commit-message-generator";
 import * as git from "../utils/git";
@@ -128,6 +137,43 @@ function addUsageTotals(target: Usage, usage: Partial<Usage>): void {
 	target.cost.total += cost.total;
 }
 
+/**
+ * Stamp/resolve repository authority for every task before agent discovery or spawn.
+ * Omitted bindings inherit the session worktree; declared ones must match it.
+ */
+async function resolveTaskItemsWithRepositoryBindings(
+	cwd: string,
+	tasks: readonly TaskItem[],
+): Promise<{ tasks: TaskItem[]; error?: string }> {
+	const resolved: TaskItem[] = [];
+	for (const task of tasks) {
+		try {
+			const binding = await resolveTaskRepositoryBinding(cwd, task.repositoryBinding);
+			if (binding.relativeSubdir) {
+				assertPathUnderRepositoryBinding(binding, ".");
+			}
+			resolved.push({
+				...task,
+				repositoryBinding: binding,
+			});
+		} catch (error) {
+			const id = task.id?.trim() ? task.id : "(missing-id)";
+			if (error instanceof RepositoryBindingError) {
+				return { tasks: [], error: `Task "${id}" repository binding rejected: ${error.message}` };
+			}
+			return {
+				tasks: [],
+				error: `Task "${id}" repository binding rejected: ${error instanceof Error ? error.message : String(error)}`,
+			};
+		}
+	}
+	return { tasks: resolved };
+}
+
+function repositoryBindingFromTask(task: TaskItem): RepositoryBinding | undefined {
+	return task.repositoryBinding ? publicRepositoryBinding(task.repositoryBinding as RepositoryBinding) : undefined;
+}
+
 function validateTaskIdsForScheduling(tasks: readonly TaskItem[]): string | undefined {
 	const invalid: string[] = [];
 	for (let i = 0; i < tasks.length; i++) {
@@ -399,12 +445,16 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 			this.session.getSessionSpawns() ?? "*",
 		);
 	}
+	readonly #sessionRepositoryBinding: RepositoryBinding;
+
 	private constructor(
 		private readonly session: ToolSession,
 		discoveredAgents: AgentDefinition[],
+		sessionRepositoryBinding: RepositoryBinding,
 	) {
-		this.#blockedAgent = $env.PI_BLOCKED_AGENT;
+		this.#blockedAgent = $pickenv("GJC_BLOCKED_AGENT", "PI_BLOCKED_AGENT");
 		this.#discoveredAgents = discoveredAgents;
+		this.#sessionRepositoryBinding = sessionRepositoryBinding;
 	}
 
 	#getTaskSimpleMode(): TaskSimpleMode {
@@ -412,11 +462,16 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 	}
 
 	/**
-	 * Create a TaskTool instance with async agent discovery.
+	 * Create a TaskTool instance.
+	 * Repository authority is captured from session cwd *before* agent discovery so
+	 * multi-repo workspaces fail closed prior to context/discovery (#2901).
 	 */
 	static async create(session: ToolSession): Promise<TaskTool> {
+		const sessionRepositoryBinding = await captureRepositoryBinding(session.cwd, { displayPath: session.cwd });
+		// Authority check before discovery: session cwd must resolve to a stable binding.
+		await assertExecutionRootMatchesRepositoryBinding(session.cwd, sessionRepositoryBinding);
 		const { agents } = await discoverAgents(session.cwd);
-		return new TaskTool(session, agents);
+		return new TaskTool(session, agents, publicRepositoryBinding(sessionRepositoryBinding));
 	}
 
 	async execute(
@@ -432,13 +487,32 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 			return createTaskModeError(validationError);
 		}
 
-		const taskItems = params.tasks ?? [];
-		const taskIdValidationError = validateTaskIdsForScheduling(taskItems);
+		// Re-verify session authority before using any discovered agents or scheduling work.
+		try {
+			await assertExecutionRootMatchesRepositoryBinding(this.session.cwd, this.#sessionRepositoryBinding);
+		} catch (error) {
+			const message =
+				error instanceof RepositoryBindingError
+					? error.message
+					: error instanceof Error
+						? error.message
+						: String(error);
+			return createTaskModeError(`Session repository binding rejected before task discovery: ${message}`);
+		}
+
+		const rawTaskItems = params.tasks ?? [];
+		const taskIdValidationError = validateTaskIdsForScheduling(rawTaskItems);
 		if (taskIdValidationError) {
 			return createTaskModeError(taskIdValidationError);
 		}
+		const bindingResolution = await resolveTaskItemsWithRepositoryBindings(this.session.cwd, rawTaskItems);
+		if (bindingResolution.error) {
+			return createTaskModeError(bindingResolution.error);
+		}
+		const taskItems = bindingResolution.tasks;
+		const paramsWithBindings: TaskParams = { ...params, tasks: taskItems };
 		if (taskItems.length === 0) {
-			return this.#executeSync(_toolCallId, params, signal, onUpdate);
+			return this.#executeSync(_toolCallId, paramsWithBindings, signal, onUpdate);
 		}
 		const agent = getAgent(this.#discoveredAgents, params.agent);
 		if (!agent) {
@@ -926,13 +1000,31 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 		},
 	): Promise<AgentToolResult<TaskToolDetails>> {
 		const startTime = Date.now();
+		// Pre-discovery authority: session cwd must still match the capture from create().
+		try {
+			await assertExecutionRootMatchesRepositoryBinding(this.session.cwd, this.#sessionRepositoryBinding);
+		} catch (error) {
+			const message =
+				error instanceof RepositoryBindingError
+					? error.message
+					: error instanceof Error
+						? error.message
+						: String(error);
+			return createTaskModeError(`Session repository binding rejected before task discovery: ${message}`);
+		}
+		const bindingResolution = await resolveTaskItemsWithRepositoryBindings(this.session.cwd, params.tasks ?? []);
+		if (bindingResolution.error) {
+			return createTaskModeError(bindingResolution.error);
+		}
+		const boundParams: TaskParams = { ...params, tasks: bindingResolution.tasks };
+
 		const { agents, projectAgentsDir } = await discoverAgents(this.session.cwd);
-		const { agent: agentName, context, schema: outputSchema } = params;
+		const { agent: agentName, context, schema: outputSchema } = boundParams;
 		const simpleMode = this.#getTaskSimpleMode();
 		const { contextEnabled, customSchemaEnabled } = getTaskSimpleModeCapabilities(simpleMode);
 		const sharedContext = contextEnabled ? context?.trim() : undefined;
 		const isolationMode = this.session.settings.get("task.isolation.mode");
-		const isolationRequested = "isolated" in params ? params.isolated === true : false;
+		const isolationRequested = "isolated" in boundParams ? boundParams.isolated === true : false;
 		const isIsolated = isolationMode !== "none" && isolationRequested;
 		const mergeMode = this.session.settings.get("task.isolation.merge");
 		const commitStyle = this.session.settings.get("task.isolation.commits");
@@ -940,7 +1032,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 		const taskDepth = this.session.taskDepth ?? 0;
 		const subagentLspEnabled = (this.session.enableLsp ?? true) && this.session.settings.get("task.enableLsp");
 
-		if (isolationMode === "none" && "isolated" in params) {
+		if (isolationMode === "none" && "isolated" in boundParams) {
 			return {
 				content: [
 					{
@@ -1000,7 +1092,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 		}
 
 		const forkContextValidationError = validateForkContextRequests(
-			params.tasks ?? [],
+			boundParams.tasks ?? [],
 			agent,
 			this.session.settings.get("task.forkContext.enabled"),
 		);
@@ -1039,7 +1131,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 			: (effectiveAgent.output ?? this.session.outputSchema);
 
 		// Handle empty or missing tasks
-		if (!params.tasks || params.tasks.length === 0) {
+		if (!boundParams.tasks || boundParams.tasks.length === 0) {
 			return {
 				content: [
 					{
@@ -1057,7 +1149,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 			};
 		}
 
-		const tasks = params.tasks;
+		const tasks = boundParams.tasks;
 		const missingTaskIndexes: number[] = [];
 		const idIndexes = new Map<string, number[]>();
 
@@ -1173,7 +1265,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 		const emitProgress = () => {
 			const progress = Array.from(progressMap.values()).sort((a, b) => a.index - b.index);
 			onUpdate?.({
-				content: [{ type: "text", text: `Running ${params.tasks.length} agents...` }],
+				content: [{ type: "text", text: `Running ${tasks.length} agents...` }],
 				details: {
 					projectAgentsDir,
 					results: [],
@@ -1342,7 +1434,13 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 				const taskSessionFile = managedPersistence
 					? null
 					: (overrides?.sessionFile ?? executionOverrides?.sessionFiles?.get(task.id) ?? null);
+				const taskRepositoryBinding = repositoryBindingFromTask(task) ?? this.#sessionRepositoryBinding;
+				// Declared paths (relativeSubdir) must stay under the bound root before spawn.
+				if (taskRepositoryBinding.relativeSubdir) {
+					assertPathUnderRepositoryBinding(taskRepositoryBinding, ".");
+				}
 				if (!isIsolated) {
+					await assertExecutionRootMatchesRepositoryBinding(this.session.cwd, taskRepositoryBinding);
 					const result = await runSubprocess({
 						cwd: this.session.cwd,
 						agent: effectiveAgent,
@@ -1393,7 +1491,12 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 						parentTelemetry: this.session.getTelemetry?.(),
 						forkContextSeed,
 					});
-					return { ...result, ...(forkContext ? { forkContext } : {}), forkContextAdvisory };
+					return {
+						...result,
+						...(forkContext ? { forkContext } : {}),
+						forkContextAdvisory,
+						repositoryBinding: publicRepositoryBinding(taskRepositoryBinding),
+					};
 				}
 
 				const taskStart = Date.now();
@@ -1406,6 +1509,8 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 
 					isolationHandle = await ensureIsolation(repoRoot, task.id, preferredIsolationBackend);
 					const isolationDir = isolationHandle.mergedDir;
+					// Isolated worktrees must preserve the source repository identity (#2901).
+					await assertExecutionRootMatchesRepositoryBinding(isolationDir, taskRepositoryBinding);
 
 					const result = await runSubprocess({
 						cwd: this.session.cwd,
@@ -1462,6 +1567,7 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 						...result,
 						...(forkContext ? { forkContext } : {}),
 						forkContextAdvisory,
+						repositoryBinding: publicRepositoryBinding(taskRepositoryBinding),
 					};
 					if (mergeMode === "branch" && resultWithForkContext.exitCode === 0) {
 						try {

package/src/task/receipt.ts

@@ -48,6 +48,8 @@ export interface TaskResultReceipt {
 	extractedToolCounts?: Record<string, number>;
 	forkContext?: SingleResult["forkContext"];
 	forkContextAdvisory?: SingleResult["forkContextAdvisory"];
+	/** Resolved repository identity for this delegated lane (#2901). */
+	repositoryBinding?: SingleResult["repositoryBinding"];
 	roi?: TaskRoi;
 }
 
@@ -262,6 +264,7 @@ export function buildTaskReceipt(raw: SingleResult): TaskResultReceipt {
 		extractedToolCounts,
 		forkContext: raw.forkContext,
 		forkContextAdvisory: raw.forkContextAdvisory,
+		repositoryBinding: raw.repositoryBinding,
 		roi: buildTaskRoi(raw),
 	};
 }