@gajae-code/coding-agent 0.11.8 → 0.11.10

package/src/session/internal/managed-session-storage.ts

@@ -26,9 +26,10 @@ import {
 } from "./native-publish-outcome";
 
 export const MANAGED_ARTIFACT_MAX_DEPTH = 32;
-export const MANAGED_ARTIFACT_MAX_FILES = 10_000;
+export const MANAGED_ARTIFACT_MAX_FILES = 50_000;
 export const MANAGED_ARTIFACT_MAX_FILE_BYTES = 64 * 1024 * 1024;
 export const MANAGED_ARTIFACT_MAX_TOTAL_BYTES = 512 * 1024 * 1024;
+export const MANAGED_ARTIFACT_COPY_BATCH_SIZE = 256;
 const LOCK_LEASE_MS = 60_000;
 const LOCK_HEARTBEAT_MS = 10_000;
 const LOCK_WAIT_MS = 5_000;
@@ -120,6 +121,7 @@ export type ManagedStorageFailure =
 	| "destination_conflict"
 	| "source_changed"
 	| "unsafe_artifacts"
+	| "artifact_capacity_exceeded"
 	| "durability_failed"
 	| "atomic_unavailable"
 	| "durability_not_provable"
@@ -1638,8 +1640,20 @@ export async function acquireManagedLock(
 	}
 }
 
+export interface ManagedArtifactTreeLimits {
+	maxFiles?: number;
+	maxTotalBytes?: number;
+}
+
 /** Bounds a no-follow artifact tree before it can be copied or deleted. */
-export function validateManagedArtifactTree(root: string): void {
+export function validateManagedArtifactTree(root: string, limits: ManagedArtifactTreeLimits = {}): void {
+	const clampLimit = (limit: number | undefined, maximum: number): number => {
+		if (limit === undefined) return maximum;
+		if (!Number.isFinite(limit) || !Number.isInteger(limit) || limit <= 0) throw new Error("unsafe_artifacts");
+		return Math.min(limit, maximum);
+	};
+	const maxFiles = clampLimit(limits.maxFiles, MANAGED_ARTIFACT_MAX_FILES);
+	const maxTotalBytes = clampLimit(limits.maxTotalBytes, MANAGED_ARTIFACT_MAX_TOTAL_BYTES);
 	let files = 0;
 	let bytes = 0;
 	const visit = (directory: string, depth: number): void => {
@@ -1656,8 +1670,7 @@ export function validateManagedArtifactTree(root: string): void {
 			if (!stat.isFile() || stat.size > MANAGED_ARTIFACT_MAX_FILE_BYTES) throw new Error("unsafe_artifacts");
 			files++;
 			bytes += stat.size;
-			if (files > MANAGED_ARTIFACT_MAX_FILES || bytes > MANAGED_ARTIFACT_MAX_TOTAL_BYTES)
-				throw new Error("unsafe_artifacts");
+			if (files > maxFiles || bytes > maxTotalBytes) throw new Error("artifact_capacity_exceeded");
 		}
 	};
 	const rootStat = fs.lstatSync(root);

package/src/session/session-manager.ts

@@ -547,6 +547,13 @@ export class SessionMigrationPolicyError extends Error {
 	}
 }
 
+export class SessionArtifactCapacityError extends Error {
+	constructor(message: string) {
+		super(message);
+		this.name = "SessionArtifactCapacityError";
+	}
+}
+
 export type ResumeTailInspection = ResumeTailResumable | ResumeTailTerminal | ResumeTailError;
 export interface StrictSessionOpenSuccess {
 	kind: "opened";
@@ -555,7 +562,8 @@ export interface StrictSessionOpenSuccess {
 
 export interface StrictSessionOpenFailure {
 	kind: "error";
-	reason: ResumeTailError["reason"] | "identity-mismatch" | "migration-required";
+	reason: ResumeTailError["reason"] | "identity-mismatch" | "migration-required" | "artifact_capacity_exceeded";
+	message?: string;
 }
 
 /** Exact transcript bytes and authority captured from one descriptor-bound read. */
@@ -2110,41 +2118,90 @@ export async function recoverOrphanedBackups(sessionDir: string, storage: Sessio
 }
 
 /**
- * Reads all session files from the directory and returns them sorted by mtime (newest first).
- * Uses low-level file I/O to efficiently read only the first 4KB of each file
- * to extract the JSON header and first user message without loading entire session logs into memory.
+ * Returns session metadata sorted by mtime (newest first).
+ *
+ * Directory entries are cheap to stat, but opening every transcript before applying a
+ * small caller limit makes welcome-screen startup scale with the entire session history.
+ * Rank paths first, then read bounded batches until the requested number of valid
+ * sessions has been found. Invalid or future-version files do not prevent older valid
+ * sessions from filling the result.
  */
-async function getSortedSessions(sessionDir: string, storage: SessionStorage): Promise<RecentSessionInfo[]> {
+async function getSortedSessions(
+	sessionDir: string,
+	storage: SessionStorage,
+	limit?: number,
+): Promise<RecentSessionInfo[]> {
 	await recoverOrphanedBackups(sessionDir, storage);
 	try {
-		const files: string[] = storage.listFilesSync(sessionDir, "*.jsonl");
+		let candidates: Array<{ path: string; mtime: number }> | undefined;
+		if (storage.listFilesByMtime) {
+			try {
+				candidates = (await storage.listFilesByMtime(sessionDir, "*.jsonl")).map(candidate => ({
+					path: candidate.path,
+					mtime: candidate.mtimeMs,
+				}));
+			} catch (error) {
+				logger.warn("Native session mtime listing failed; using JavaScript fallback", {
+					sessionDir,
+					error: toError(error).message,
+				});
+			}
+		} else {
+			logger.debug("Native session mtime listing unavailable; using JavaScript fallback", { sessionDir });
+		}
+		candidates ??= storage.listFilesSync(sessionDir, "*.jsonl").flatMap(path => {
+			try {
+				return [{ path, mtime: storage.statSync(path).mtimeMs }];
+			} catch {
+				return [];
+			}
+		});
+		candidates.sort((left, right) => {
+			if (left.mtime !== right.mtime) return right.mtime - left.mtime;
+			return left.path < right.path ? -1 : left.path > right.path ? 1 : 0;
+		});
+
 		const sessions: RecentSessionInfo[] = [];
-		await Promise.all(
-			files.map(async (path: string) => {
-				try {
-					const buffer = Buffer.allocUnsafe(SESSION_LIST_PREFIX_BYTES);
-					const content = await readSessionListPrefix(path, storage, buffer);
-					const entries = parseJsonlLenient<Record<string, unknown>>(content);
-					if (entries.length === 0) return;
-					const header = entries[0] as Record<string, unknown>;
-					if (
-						header.type !== "session" ||
-						typeof header.id !== "string" ||
-						!isSupportedSessionVersion(header.version)
-					)
-						return;
-					if (typeof header.version === "number" && header.version >= 4) {
-						for (const patch of await readSessionListTrailingPatches(path, storage, buffer)) {
-							applySessionListHeaderPatch(header as unknown as SessionListHeader, patch);
+		const batchSize = Math.max(32, limit ?? 0);
+
+		for (
+			let offset = 0;
+			offset < candidates.length && (limit === undefined || sessions.length < limit);
+			offset += batchSize
+		) {
+			const batch = candidates.slice(offset, offset + batchSize);
+			const parsed = await Promise.all(
+				batch.map(async candidate => {
+					try {
+						const buffer = Buffer.allocUnsafe(SESSION_LIST_PREFIX_BYTES);
+						const content = await readSessionListPrefix(candidate.path, storage, buffer);
+						const entries = parseJsonlLenient<Record<string, unknown>>(content);
+						if (entries.length === 0) return undefined;
+						const header = entries[0] as Record<string, unknown>;
+						if (
+							header.type !== "session" ||
+							typeof header.id !== "string" ||
+							!isSupportedSessionVersion(header.version)
+						)
+							return undefined;
+						if (typeof header.version === "number" && header.version >= 4) {
+							for (const patch of await readSessionListTrailingPatches(candidate.path, storage, buffer)) {
+								applySessionListHeaderPatch(header as unknown as SessionListHeader, patch);
+							}
 						}
+						const firstPrompt = header.title ? undefined : extractFirstUserPrompt(entries);
+						return new RecentSessionInfo(candidate.path, candidate.mtime, header, firstPrompt);
+					} catch {
+						return undefined;
 					}
-					const mtime = storage.statSync(path).mtimeMs;
-					const firstPrompt = header.title ? undefined : extractFirstUserPrompt(entries);
-					sessions.push(new RecentSessionInfo(path, mtime, header, firstPrompt));
-				} catch {}
-			}),
-		);
-		return sessions.sort((a, b) => b.mtime - a.mtime);
+				}),
+			);
+			for (const session of parsed) {
+				if (session) sessions.push(session);
+				if (limit !== undefined && sessions.length >= limit) break;
+			}
+		}
+		return sessions;
 	} catch {
 		return [];
 	}
@@ -2155,7 +2212,7 @@ export async function findMostRecentSession(
 	sessionDir: string,
 	storage: SessionStorage = new FileSessionStorage(),
 ): Promise<string | null> {
-	const sessions = await getSortedSessions(sessionDir, storage);
+	const sessions = await getSortedSessions(sessionDir, storage, 1);
 	return sessions[0]?.path || null;
 }
 
@@ -3427,8 +3484,7 @@ export async function getRecentSessions(
 	limit = DEFAULT_WELCOME_RECENT_SESSION_LIMIT,
 	storage: SessionStorage = new FileSessionStorage(),
 ): Promise<RecentSessionInfo[]> {
-	const sessions = await getSortedSessions(sessionDir, storage);
-	return sessions.slice(0, limit);
+	return getSortedSessions(sessionDir, storage, limit);
 }
 
 /**
@@ -7299,6 +7355,7 @@ export class SessionManager {
 		if (opened.kind === "error") {
 			managedDestinationStore.assertBound();
 			if (opened.code === "legacy_migration_disabled") throw new SessionMigrationPolicyError();
+			if (opened.code === "artifact_capacity_exceeded") throw new SessionArtifactCapacityError(opened.message);
 			throw new Error(`Could not open managed session: ${opened.message}`);
 		}
 		assertManagedDestinationBound();
@@ -7809,6 +7866,8 @@ export class SessionManager {
 			} catch (error) {
 				if (error instanceof SessionMigrationPolicyError)
 					return { kind: "error", reason: "legacy_migration_disabled" };
+				if (error instanceof SessionArtifactCapacityError)
+					return { kind: "error", reason: "artifact_capacity_exceeded", message: error.message };
 				if (
 					error instanceof Error &&
 					(error.message.includes("source_changed") || error.message.includes("changed before migration"))
@@ -7867,6 +7926,10 @@ export class SessionManager {
 			);
 			if (opened.kind === "error") {
 				if (opened.reason === "legacy_migration_disabled") throw new SessionMigrationPolicyError();
+				if (opened.reason === "artifact_capacity_exceeded")
+					throw new SessionArtifactCapacityError(
+						opened.message ?? "Session artifacts exceed the migration capacity.",
+					);
 				return undefined;
 			}
 			return opened.manager;

package/src/session/session-storage.ts

@@ -167,6 +167,8 @@ export interface SessionStorage {
 	readSnapshotSync?(path: string): SessionStorageSnapshot;
 	statSync(path: string): SessionStorageStat;
 	listFilesSync(dir: string, pattern: string): string[];
+	/** List matching files with mtimes without issuing one JavaScript stat call per path. */
+	listFilesByMtime?(dir: string, pattern: string): Promise<Array<{ path: string; mtimeMs: number }>>;
 	/**
 	 * Strict directory scan that never suppresses scan/root errors. Used by strict
 	 * authorization inventory; the forgiving {@link listFilesSync} stays display-only.
@@ -705,6 +707,21 @@ export class FileSessionStorage implements SessionStorage {
 			return [];
 		}
 	}
+	async listFilesByMtime(dir: string, pattern: string): Promise<Array<{ path: string; mtimeMs: number }>> {
+		const result = await native.glob({
+			path: dir,
+			pattern,
+			fileType: native.FileType.File,
+			recursive: false,
+			hidden: false,
+			gitignore: false,
+			sortByMtime: true,
+		});
+		return result.matches.map(match => ({
+			path: path.join(dir, match.path),
+			mtimeMs: match.mtime ?? 0,
+		}));
+	}
 
 	listFilesStrictSync(dir: string, pattern: string): string[] {
 		// Strict: never suppress scan/root errors. Authorization inventory depends on
@@ -1470,6 +1487,12 @@ export class MemorySessionStorage implements SessionStorage {
 		}
 		return files;
 	}
+	listFilesByMtime(dir: string, pattern: string): Promise<Array<{ path: string; mtimeMs: number }>> {
+		const files = this.listFilesSync(dir, pattern)
+			.map(path => ({ path, mtimeMs: this.statSync(path).mtimeMs }))
+			.sort((a, b) => b.mtimeMs - a.mtimeMs);
+		return Promise.resolve(files);
+	}
 	listFilesStrictSync(dir: string, pattern: string): string[] {
 		// In-memory scan never suppresses; identical to the display scan.
 		return this.listFilesSync(dir, pattern);

package/src/skill-state/active-state.ts

@@ -71,6 +71,8 @@ export interface SkillActiveEntry {
 	handoff_at?: string;
 	active_subskills?: ActiveSubskillEntry[];
 	source_state_revision?: number;
+	/** Durable ordering token from the source workflow mode-state, not this cache file's revision. */
+	committed_mode_state_revision?: number;
 }
 
 export interface SkillActiveState {
@@ -114,6 +116,8 @@ export interface SyncSkillActiveStateOptions {
 	handoff_at?: string;
 	active_subskills?: ActiveSubskillEntry[];
 	sourceRevision?: number;
+	/** Durable ordering token from the source workflow mode-state, not this cache file's revision. */
+	committedModeRevision?: number;
 }
 
 const HUD_TEXT_LIMIT = 80;
@@ -785,6 +789,9 @@ async function persistActiveEntry(
 		await writeActiveEntry(cwd, sessionScope, entry.skill, entry, {
 			cwd,
 			audit: activeStateWriterAudit("write-active-entry", sessionScope),
+			...(typeof entry.committed_mode_state_revision === "number"
+				? { orderingRevision: entry.committed_mode_state_revision }
+				: {}),
 		});
 	}
 }
@@ -863,6 +870,9 @@ export async function syncSkillActiveState(options: SyncSkillActiveStateOptions)
 				? { active_subskills: preservedActiveSubskills }
 				: {}),
 		...(typeof options.sourceRevision === "number" ? { source_state_revision: options.sourceRevision } : {}),
+		...(typeof options.committedModeRevision === "number"
+			? { committed_mode_state_revision: options.committedModeRevision }
+			: {}),
 	};
 	const sessionScope = { sessionId: options.sessionId };
 	await removeSupersededPlanningPipelineEntries(options.cwd, sessionScope, entry);

package/src/skill-state/workflow-mutation-guard.ts

@@ -35,17 +35,28 @@ function planningPhaseBlockMessage(skill: CanonicalGjcWorkflowSkill): string {
 }
 
 const BLOCKED_TOOL_NAMES = new Set(["edit", "write", "ast_edit", "bash"]);
+/**
+ * Only `/dev/null` is exempt. `/dev/stdout`, `/dev/stderr`, and `/dev/fd/<n>` are descriptor
+ * aliases: `exec 1<>src/product.ts; printf x >/dev/stdout` reaches a real repository file
+ * through a rebound descriptor, so they must stay blocked.
+ */
+const DEVICE_SINK_PATHS = new Set(["/dev/null"]);
+/** Bash write forms the plain `>`/`>>` scanner misses: clobber, dup-to-path, and read-write open. */
+const BASH_EXTENDED_WRITE_RE = /(?:>\||<>|>&(?![\s;&|]*(?:\d+|-)(?:[\s;&|]|$)))\s*([^\s;&|]+)/g;
+/** Descriptor rebinding is not statically resolvable; any `exec` redirection forces a fail-closed verdict. */
+const BASH_EXEC_REDIRECT_RE = /(?:^|[;&|\n])\s*(?:sudo\s+)?exec\b[^;&|\n]*[<>]/i;
+
 const ARCHIVE_OR_SQLITE_BASE_RE = /^(.+?\.(?:tar\.gz|sqlite3|sqlite|db3|zip|tgz|tar|db))(?:$|:)/i;
 const INTERNAL_SCHEME_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
 const VIM_FILE_SWITCH_RE = /^\s*:(?:e|e!|edit|edit!)(?:\s+([^<\r\n]+))?(?:<CR>|\r|\n|$)/i;
 const BASH_MUTATION_COMMAND_RE =
-	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:tee|touch|rm|mkdir|cp|mv|install|truncate)\b([^;&|\n]*)|(?:^|[^<>])(?:>>?|\d>>?)\s*([^\s;&|]+)/gi;
+	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:[^\s;&|]*\/)?(?:tee|touch|rm|mkdir|cp|mv|install|truncate)\b([^;&|\n]*)|(?:^|[^<>])(?:>>?|\d>>?)\s*([^\s;&|]+)/gi;
 const BASH_IN_PLACE_MUTATION_COMMAND_RE = /(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:sed|perl)\b([^;&|\n]*)/gi;
 const BASH_OPAQUE_INTERPRETER_WRITE_RE =
 	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:python3?|node|ruby)\b[^;&|\n]*(?:-c|-e)\b[^;&|\n]*(?:open\s*\(|writeFile(?:Sync)?\s*\(|\.write\s*\()/i;
 const BASH_HEREDOC_OPAQUE_INTERPRETER_WRITE_RE =
 	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:python3?|node|ruby)\b[^;&|\n]*(?:<<[-]?\s*['"]?\w+['"]?)[\s\S]*(?:open\s*\(|writeFile(?:Sync)?\s*\(|\.write\s*\()/i;
-const BASH_DD_OUTPUT_RE = /(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?dd\b([^;&|\n]*)/gi;
+const BASH_DD_OUTPUT_RE = /(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:[^\s;&|]*\/)?dd\b([^;&|\n]*)/gi;
 
 type ToolWithEditMode = AgentTool & {
 	mode?: unknown;
@@ -371,6 +382,10 @@ function cleanShellWord(value: string): string {
 	return value.replace(/^['"]|['"]$/g, "");
 }
 
+function isDeviceSinkPath(value: string): boolean {
+	return DEVICE_SINK_PATHS.has(cleanShellWord(value));
+}
+
 function extractBashTargets(args: unknown): ExtractedTargets {
 	const record = getRecord(args);
 	const command = safeString(record?.command);
@@ -382,11 +397,25 @@ function extractBashTargets(args: unknown): ExtractedTargets {
 	if (BASH_OPAQUE_INTERPRETER_WRITE_RE.test(command) || BASH_HEREDOC_OPAQUE_INTERPRETER_WRITE_RE.test(command)) {
 		targets.unknown = true;
 	}
+	// `exec 1<>file` rebinds a descriptor, so a later `>/dev/null` may not reach the device at all.
+	if (BASH_EXEC_REDIRECT_RE.test(command)) {
+		targets.unknown = true;
+	}
+	for (const match of command.matchAll(BASH_EXTENDED_WRITE_RE)) {
+		const cleaned = cleanShellWord(match[1] ?? "");
+		if (!cleaned) targets.unknown = true;
+		else if (!isDeviceSinkPath(cleaned)) addPath(targets, cleaned);
+	}
 	for (const match of command.matchAll(BASH_DD_OUTPUT_RE)) {
 		const parts = shellWords(match[1] ?? "").map(cleanShellWord);
-		const output = parts.find(part => part.startsWith("of="));
-		if (output) addPath(targets, output.slice(3));
-		else targets.unknown = true;
+		// Every `of=` counts: GNU dd honors the last one, so `of=/dev/null of=real.ts` writes real.ts.
+		const outputs = parts.filter(part => part.startsWith("of="));
+		if (outputs.length === 0) targets.unknown = true;
+		for (const output of outputs) {
+			const outputPath = cleanShellWord(output.slice(3));
+			if (!outputPath) targets.unknown = true;
+			else if (!isDeviceSinkPath(outputPath)) addPath(targets, outputPath);
+		}
 	}
 	for (const match of command.matchAll(BASH_IN_PLACE_MUTATION_COMMAND_RE)) {
 		const parts = shellWords(match[1] ?? "").map(cleanShellWord);
@@ -399,12 +428,17 @@ function extractBashTargets(args: unknown): ExtractedTargets {
 	for (const match of command.matchAll(BASH_MUTATION_COMMAND_RE)) {
 		const redirected = match[2]?.trim();
 		if (redirected) {
-			addPath(targets, cleanShellWord(redirected));
+			const cleaned = cleanShellWord(redirected);
+			// A capture that dequotes to nothing (e.g. `>" src.ts"`) is a truncated parse, not a safe no-op.
+			if (!cleaned) targets.unknown = true;
+			else if (!isDeviceSinkPath(cleaned)) addPath(targets, cleaned);
 			continue;
 		}
 		const parts = shellWords(match[1] ?? "");
 		const commandName = match[0]
-			?.match(/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(tee|touch|rm|mkdir|cp|mv|install|truncate)\b/i)?.[1]
+			?.match(
+				/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:[^\s;&|]*\/)?(tee|touch|rm|mkdir|cp|mv|install|truncate)\b/i,
+			)?.[1]
 			?.toLowerCase();
 		const targetParts =
 			commandName === "cp" || commandName === "mv" || commandName === "install" || commandName === "truncate"