@gajae-code/coding-agent 0.11.9 → 0.11.10

package/src/sdk/protocol/operation-inventory.generated.json

@@ -2659,6 +2659,17 @@
 			"testIds": "not_applicable"
 		}
 	},
+	{
+		"sourceId": "agent_session:getToolForExecution",
+		"sourceFile": "packages/coding-agent/src/session/agent-session.ts",
+		"sourceKind": "agent_session",
+		"decision": "exclude",
+		"rationale": "internal accessor/plumbing, not a user-facing control seam",
+		"exclusionMetadata": {
+			"adapterMappings": "not_applicable",
+			"testIds": "not_applicable"
+		}
+	},
 	{
 		"sourceId": "agent_session:registerForegroundBashBackgroundRequestHandler",
 		"sourceFile": "packages/coding-agent/src/session/agent-session.ts",

package/src/sdk/session.ts

@@ -428,6 +428,13 @@ export interface CreateAgentSessionOptions {
 	goalToolAllowedOps?: readonly ("create" | "get" | "complete" | "resume" | "drop" | "pause")[];
 	/** Optional per-session allowlist for tools exposed through search_tool_bm25. */
 	discoverableToolAllowedNames?: readonly string[];
+	/**
+	 * Discoverable built-in tools that must stay in the initial active set even when
+	 * `tools.discoveryMode === "all"` would otherwise hide them behind `search_tool_bm25`.
+	 * Used for coordination tools (e.g. `irc`) that a subagent must be able to use
+	 * immediately without first spending a discovery round-trip to find them.
+	 */
+	alwaysActiveToolNames?: readonly string[];
 	/** Optional shared agent registry for IRC routing. Default: AgentRegistry.global(). */
 	agentRegistry?: AgentRegistry;
 	/** Parent task ID prefix for nested artifact naming (e.g., "6-Extensions") */
@@ -1542,6 +1549,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			goalToolAllowedOps: options.goalToolAllowedOps,
 			discoverableToolAllowedNames: options.discoverableToolAllowedNames,
 			getToolByName: name => session?.getToolByName(name),
+			getToolForExecution: name => session?.getToolForExecution(name),
 			agentRegistry,
 			getSessionSpawns: () => options.spawns ?? "*",
 			getModelString: () => (hasExplicitModel && model ? formatModelString(model) : undefined),
@@ -2329,6 +2337,9 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 		// from the initial set unless they were explicitly requested or restored from persistence.
 		// The model finds them via search_tool_bm25 and activates them on demand.
 		if (effectiveDiscoveryMode === "all") {
+			const alwaysActiveDiscoveredBuiltinNames = new Set(
+				(options.alwaysActiveToolNames ?? []).map(name => name.toLowerCase()),
+			);
 			const essentialBuiltinNames = new Set(computeEssentialBuiltinNames(settings));
 			const allowedDiscoveredBuiltinNames = options.discoverableToolAllowedNames
 				? new Set(options.discoverableToolAllowedNames.map(name => name.toLowerCase()))
@@ -2337,6 +2348,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				const tool = toolRegistry.get(name);
 				if (!tool?.loadMode) return true; // not a built-in — leave MCP/custom/extension to existing logic
 				if (tool.loadMode === "essential") return true;
+				if (alwaysActiveDiscoveredBuiltinNames.has(name)) return true;
 				return essentialBuiltinNames.has(name);
 			});
 			explicitlyRequestedDiscoveredBuiltinToolNames = selectRestorableDiscoveredBuiltinToolNames(

package/src/session/agent-session.ts

@@ -1048,12 +1048,16 @@ function createHandoffContext(document: string): string {
 // ============================================================================
 
 /** Tools that require user permission before execution when an ACP client is connected. */
-const PERMISSION_REQUIRED_TOOLS = new Set(["bash", "monitor", "edit", "delete", "move"]);
+const PERMISSION_REQUIRED_TOOLS = new Set(["bash", "monitor", "eval", "edit", "delete", "move"]);
 
 function isShellExecutionPermissionTool(toolName: string): boolean {
 	return toolName === "bash" || toolName === "monitor";
 }
 
+function isExecutionPermissionTool(toolName: string): boolean {
+	return isShellExecutionPermissionTool(toolName) || toolName === "eval";
+}
+
 /** Permission options presented to the client on each gated tool call. */
 const PERMISSION_OPTIONS: ClientBridgePermissionOption[] = [
 	{ optionId: "allow_once", name: "Allow once", kind: "allow_once" },
@@ -1121,6 +1125,18 @@ function getPermissionIntent(
 		const cmd = getStringProperty(a, "command")?.slice(0, 80);
 		return { toolName, title: cmd || toolName, cacheKey: toolName };
 	}
+	if (toolName === "eval") {
+		const cells = Array.isArray(a.cells) ? a.cells : [];
+		const firstCell = cells.find(cell => cell && typeof cell === "object" && !Array.isArray(cell));
+		const cell = firstCell as Record<string, unknown> | undefined;
+		const title = cell ? getStringProperty(cell, "title") : undefined;
+		const language = cell ? getStringProperty(cell, "language") : undefined;
+		return {
+			toolName,
+			title: title ?? (language ? `Eval ${language}` : "eval"),
+			cacheKey: toolName,
+		};
+	}
 	if (toolName === "delete") {
 		const p = getStringProperty(a, "path");
 		return { toolName, title: p ? `Delete ${p}` : toolName, paths: p ? [p] : undefined, cacheKey: toolName };
@@ -5502,6 +5518,12 @@ export class AgentSession {
 		return undefined;
 	}
 
+	/** Get a registered tool with the same guards used for model-facing execution. */
+	getToolForExecution(name: string): AgentTool | undefined {
+		const tool = this.getToolByName(name);
+		return tool ? this.#prepareToolForExecution(tool) : undefined;
+	}
+
 	/**
 	 * Register a UI/control-plane request handler for a currently foregrounded
 	 * managed bash execution. This is intentionally narrower than generic
@@ -5766,6 +5788,7 @@ export class AgentSession {
 						return await target.execute(toolCallId, args as never, signal, onUpdate, ctx);
 					}
 					const isShellExecutionTool = isShellExecutionPermissionTool(target.name);
+					const isExecutionTool = isExecutionPermissionTool(target.name);
 					const command =
 						isShellExecutionTool && args && typeof args === "object" && !Array.isArray(args)
 							? getStringProperty(args as Record<string, unknown>, "command")
@@ -5808,7 +5831,7 @@ export class AgentSession {
 								toolCallId,
 								toolName: target.name,
 								title: permissionIntent.title,
-								...(isShellExecutionTool ? { kind: "execute" } : {}),
+								...(isExecutionTool ? { kind: "execute" } : {}),
 								status: "pending",
 								rawInput: args,
 								...(commandContent ? { content: commandContent } : {}),
@@ -7530,7 +7553,11 @@ export class AgentSession {
 			}
 
 			// Validate API key
-			const apiKey = await this.#modelRegistry.getApiKey(this.model, this.sessionId);
+			const apiKey = await this.#awaitPromptPreflight(
+				generation,
+				preflightSignal,
+				this.#modelRegistry.getApiKey(this.model, this.sessionId, { signal: preflightSignal }),
+			);
 			if (!apiKey) {
 				throw new Error(formatNoCredentialOnboardingError(this.model.provider));
 			}
@@ -9013,6 +9040,10 @@ export class AgentSession {
 			this.agent.reset();
 			if (!options?.drop) await this.sessionManager.flush();
 			await this.sessionManager.newSession(options);
+			// Gate the successor local:// root before the successor identity is
+			// published to the agent, the workflow-gate emitter, hooks, or any
+			// synchronous resolver (#2797 / #2925).
+			await initializeLocalRoot(this.#localProtocolOptions());
 			this.setTodoPhases([]);
 			this.#syncAgentSessionId();
 			this.#bindWorkflowGateEmitter(previousWorkflowGateSessionId);
@@ -9080,6 +9111,10 @@ export class AgentSession {
 			this.#rebindProviderSessionState(new Map());
 			this.agent.reset();
 			await this.sessionManager.newSession(options);
+			// Gate the successor local:// root before the successor identity is
+			// published to the agent, the workflow-gate emitter, hooks, or any
+			// synchronous resolver (#2797 / #2925).
+			await initializeLocalRoot(this.#localProtocolOptions());
 			this.setTodoPhases([]);
 			this.#syncAgentSessionId();
 			this.#bindWorkflowGateEmitter(previousWorkflowGateSessionId);
@@ -9223,6 +9258,9 @@ export class AgentSession {
 				return false;
 			}
 
+			// Fork rotates the session identity (and copies artifacts); gate the
+			// successor local:// root before that identity is published (#2797 / #2925).
+			await initializeLocalRoot(this.#localProtocolOptions());
 			// Update agent session ID
 			this.#syncAgentSessionId();
 			this.#bindWorkflowGateEmitter(previousWorkflowGateSessionId);
@@ -10630,6 +10668,10 @@ export class AgentSession {
 					previousSessionFile ? { parentSession: previousSessionFile } : undefined,
 				);
 				successorSessionFile = this.sessionFile;
+				// Gate the successor local:// root inside the reversible prepare
+				// window, before the successor identity is published; a gate failure
+				// here rolls back (#2797 / #2925).
+				await initializeLocalRoot(this.#localProtocolOptions());
 				this.agent.reset();
 				this.#syncAgentSessionId();
 				this.#rekeyHindsightMemoryForCurrentSessionId();
@@ -14557,6 +14599,10 @@ export class AgentSession {
 
 			try {
 				await this.sessionManager.setSessionFile(sessionPath);
+				// The successor identity is already rotated in the manager but not yet
+				// published; gate its local:// root before publication so no observer
+				// can resolve against an ungated root (#2797 / #2925).
+				if (switchingToDifferentSession) await initializeLocalRoot(this.#localProtocolOptions());
 				this.#syncAgentSessionId();
 				this.#rekeyHindsightMemoryForCurrentSessionId();
 
@@ -14633,13 +14679,8 @@ export class AgentSession {
 				await this.sessionManager.ensureOnDisk();
 
 				if (switchingToDifferentSession) {
-					// Interactive /resume (and any other switchSession identity change) must
-					// await verified legacy local:// migration for the *new* session before
-					// post-commit session_switch / local path resolution. createAgentSession
-					// already does this at cold start (#2797); switchSession previously omitted
-					// it, so resolving local:// after /resume could fail-closed with
-					// "legacy migration must complete before path resolution" (#2925).
-					await initializeLocalRoot(this.#localProtocolOptions());
+					// The local:// migration gate for this successor already ran above,
+					// before the identity was published (#2797 / #2925).
 					this.#resetHindsightConversationTrackingIfHindsight();
 					this.#resetIrcRosterDeliveryState();
 				}
@@ -14771,6 +14812,9 @@ export class AgentSession {
 			} else {
 				this.sessionManager.createBranchedSession(selectedEntry.parentId);
 			}
+			// Branch/tree-jump establishes a new session identity; gate the successor
+			// local:// root before that identity is published (#2797 / #2925).
+			await initializeLocalRoot(this.#localProtocolOptions());
 			this.#syncTodoPhasesFromBranch();
 			this.#syncAgentSessionId();
 			this.#bindWorkflowGateEmitter(previousWorkflowGateSessionId);

package/src/session/internal/managed-session-scope.ts

@@ -8,7 +8,7 @@ import {
 	verifyOwnerOnlyPathSecurity,
 	verifyOwnerOnlyPathSecurityExpected,
 } from "@gajae-code/natives";
-import { pathIsWithin } from "@gajae-code/utils";
+import { logger, pathIsWithin } from "@gajae-code/utils";
 import type { ResumeSessionIdentity } from "../session-manager";
 import {
 	FileSessionStorage,
@@ -2789,7 +2789,10 @@ function validateCandidateForScope(scope: ManagedScope, candidate: ManagedCandid
 }
 
 /** Resume tombstoned cleanup under its original operation lease without restoring retired candidates. */
-export async function reconcileManagedTombstones(scope: ManagedScope): Promise<void> {
+export async function reconcileManagedTombstones(
+	scope: ManagedScope,
+	expectedCandidate?: ManagedCandidate,
+): Promise<void> {
 	const directory = path.join(managedInternalDirectory(scope), MANAGED_TOMBSTONES_DIRECTORY);
 	for (const name of fs.readdirSync(directory)) {
 		const tombstone = path.join(directory, name);
@@ -2807,135 +2810,148 @@ export async function reconcileManagedTombstones(scope: ManagedScope): Promise<v
 			for (const target of lockedTargets) {
 				lock.assertOwned();
 				if (cleanupCompleted(scope, tombstone, target)) continue;
-				const pending = pendingCleanupReceipt(scope, tombstone, target);
-				const observedPending = pending ? probePlannedCleanupDetach(target, pending) : undefined;
 				try {
-					fs.lstatSync(target.path);
-				} catch (error) {
-					if ((error as NodeJS.ErrnoException).code === "ENOENT") {
-						if (!observedPending) continue;
-						if (
-							cleanupArtifactsRemoved(scope, tombstone, target, observedPending.attempt) &&
-							cleanupRootsAbsent(tombstone, target, observedPending)
-						) {
-							fsyncManagedParent(target.path);
-							await publishCleanupCompleted(scope, tombstone, target, lock);
-							continue;
-						}
-					} else throw error;
-				}
-				const verified = observedPending ? target : validateCandidateForScope(scope, target);
-				if (!verified || !sameCandidate(verified, target)) throw new Error("source_changed");
-				const discoveredDetach =
-					!!observedPending &&
-					(observedPending.detachedArtifactsPath !== pending?.detachedArtifactsPath ||
-						observedPending.detachedTranscriptPath !== pending?.detachedTranscriptPath);
-				const active =
-					discoveredDetach || (observedPending && requiresFreshCleanupPlan(observedPending))
-						? nextCleanupReceipt(target, observedPending)
-						: (observedPending ?? nextCleanupReceipt(target, undefined));
-				if (!observedPending || discoveredDetach || requiresFreshCleanupPlan(observedPending))
-					await publishCleanupPending(scope, tombstone, active, lock);
-				let deletion = await new FileSessionStorage().deleteSessionVerified({
-					sessionsRoot: scope.sessionsRoot,
-					transcriptPath: target.path,
-					sessionId: target.sessionId,
-					cwd: target.cwd,
-					transcriptIdentity: target.identity,
-					expectedArtifactsIdentity: active.expectedArtifactsIdentity,
-					expectedArtifactsTree: active.expectedArtifactsTree,
-					detachedArtifactsPath:
-						active.detachedArtifactsPath ??
-						observedPending?.detachedArtifactsPath ??
-						(fs.existsSync(active.plannedArtifactsPath) ? active.plannedArtifactsPath : undefined),
-					detachedTranscriptPath:
-						active.detachedTranscriptPath ??
-						observedPending?.detachedTranscriptPath ??
-						(pending && fs.existsSync(pending.plannedTranscriptPath)
-							? pending.plannedTranscriptPath
-							: undefined) ??
-						(fs.existsSync(active.plannedTranscriptPath) ? active.plannedTranscriptPath : undefined),
-					retainedArtifactsSuccessorPath: active.retainedArtifactsSuccessorPath,
-					retainedArtifactsPlaceholderPath: active.retainedArtifactsPlaceholderPath,
-					retainedArtifactsUnknownPath: active.retainedArtifactsUnknownPath,
-					retainedTranscriptSuccessorPath: active.retainedTranscriptSuccessorPath,
-					retainedTranscriptPlaceholderPath: active.retainedTranscriptPlaceholderPath,
-					retainedTranscriptUnknownPath: active.retainedTranscriptUnknownPath,
-					plannedArtifactsPath: active.plannedArtifactsPath,
-					plannedTranscriptPath: active.plannedTranscriptPath,
-					...(cleanupArtifactsRemoved(scope, tombstone, target, pending?.attempt ?? active.attempt)
-						? { artifactsRemoved: true as const }
-						: {}),
-				});
-				if (deletion.kind === "artifacts_removed") {
-					await publishCleanupArtifactsRemoved(scope, tombstone, active, lock);
-					deletion = await new FileSessionStorage().deleteSessionVerified({
+					const pending = pendingCleanupReceipt(scope, tombstone, target);
+					const observedPending = pending ? probePlannedCleanupDetach(target, pending) : undefined;
+					try {
+						fs.lstatSync(target.path);
+					} catch (error) {
+						if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+							if (!observedPending) continue;
+							if (
+								cleanupArtifactsRemoved(scope, tombstone, target, observedPending.attempt) &&
+								cleanupRootsAbsent(tombstone, target, observedPending)
+							) {
+								fsyncManagedParent(target.path);
+								await publishCleanupCompleted(scope, tombstone, target, lock);
+								continue;
+							}
+						} else throw error;
+					}
+					const verified = observedPending ? target : validateCandidateForScope(scope, target);
+					if (!verified || !sameCandidate(verified, target)) throw new Error("source_changed");
+					const discoveredDetach =
+						!!observedPending &&
+						(observedPending.detachedArtifactsPath !== pending?.detachedArtifactsPath ||
+							observedPending.detachedTranscriptPath !== pending?.detachedTranscriptPath);
+					const active =
+						discoveredDetach || (observedPending && requiresFreshCleanupPlan(observedPending))
+							? nextCleanupReceipt(target, observedPending)
+							: (observedPending ?? nextCleanupReceipt(target, undefined));
+					if (!observedPending || discoveredDetach || requiresFreshCleanupPlan(observedPending))
+						await publishCleanupPending(scope, tombstone, active, lock);
+					let deletion = await new FileSessionStorage().deleteSessionVerified({
 						sessionsRoot: scope.sessionsRoot,
 						transcriptPath: target.path,
 						sessionId: target.sessionId,
 						cwd: target.cwd,
 						transcriptIdentity: target.identity,
-						plannedArtifactsPath: active.plannedArtifactsPath,
-						plannedTranscriptPath: active.plannedTranscriptPath,
-						detachedTranscriptPath: active.detachedTranscriptPath ?? observedPending?.detachedTranscriptPath,
-
+						expectedArtifactsIdentity: active.expectedArtifactsIdentity,
+						expectedArtifactsTree: active.expectedArtifactsTree,
+						detachedArtifactsPath:
+							active.detachedArtifactsPath ??
+							observedPending?.detachedArtifactsPath ??
+							(fs.existsSync(active.plannedArtifactsPath) ? active.plannedArtifactsPath : undefined),
+						detachedTranscriptPath:
+							active.detachedTranscriptPath ??
+							observedPending?.detachedTranscriptPath ??
+							(pending && fs.existsSync(pending.plannedTranscriptPath)
+								? pending.plannedTranscriptPath
+								: undefined) ??
+							(fs.existsSync(active.plannedTranscriptPath) ? active.plannedTranscriptPath : undefined),
 						retainedArtifactsSuccessorPath: active.retainedArtifactsSuccessorPath,
 						retainedArtifactsPlaceholderPath: active.retainedArtifactsPlaceholderPath,
 						retainedArtifactsUnknownPath: active.retainedArtifactsUnknownPath,
 						retainedTranscriptSuccessorPath: active.retainedTranscriptSuccessorPath,
 						retainedTranscriptPlaceholderPath: active.retainedTranscriptPlaceholderPath,
 						retainedTranscriptUnknownPath: active.retainedTranscriptUnknownPath,
-						artifactsRemoved: true,
+						plannedArtifactsPath: active.plannedArtifactsPath,
+						plannedTranscriptPath: active.plannedTranscriptPath,
+						...(cleanupArtifactsRemoved(scope, tombstone, target, pending?.attempt ?? active.attempt)
+							? { artifactsRemoved: true as const }
+							: {}),
 					});
-				}
-				if (deletion.kind === "cleanup_pending") {
-					const retry = nextCleanupReceipt(target, active);
-					await publishCleanupPending(
-						scope,
+					if (deletion.kind === "artifacts_removed") {
+						await publishCleanupArtifactsRemoved(scope, tombstone, active, lock);
+						deletion = await new FileSessionStorage().deleteSessionVerified({
+							sessionsRoot: scope.sessionsRoot,
+							transcriptPath: target.path,
+							sessionId: target.sessionId,
+							cwd: target.cwd,
+							transcriptIdentity: target.identity,
+							plannedArtifactsPath: active.plannedArtifactsPath,
+							plannedTranscriptPath: active.plannedTranscriptPath,
+							detachedTranscriptPath: active.detachedTranscriptPath ?? observedPending?.detachedTranscriptPath,
+
+							retainedArtifactsSuccessorPath: active.retainedArtifactsSuccessorPath,
+							retainedArtifactsPlaceholderPath: active.retainedArtifactsPlaceholderPath,
+							retainedArtifactsUnknownPath: active.retainedArtifactsUnknownPath,
+							retainedTranscriptSuccessorPath: active.retainedTranscriptSuccessorPath,
+							retainedTranscriptPlaceholderPath: active.retainedTranscriptPlaceholderPath,
+							retainedTranscriptUnknownPath: active.retainedTranscriptUnknownPath,
+							artifactsRemoved: true,
+						});
+					}
+					if (deletion.kind === "cleanup_pending") {
+						const retry = nextCleanupReceipt(target, active);
+						await publishCleanupPending(
+							scope,
+							tombstone,
+							{
+								...retry,
+								expectedArtifactsIdentity:
+									deletion.phase === "artifacts"
+										? deletion.artifactsIdentity
+										: active.expectedArtifactsIdentity,
+								expectedArtifactsTree:
+									deletion.phase === "artifacts" ? deletion.artifactsTree : active.expectedArtifactsTree,
+								detachedArtifactsPath:
+									deletion.phase === "artifacts"
+										? deletion.detachedArtifactsPath
+										: active.detachedArtifactsPath,
+								detachedTranscriptPath:
+									deletion.phase === "transcript"
+										? deletion.detachedTranscriptPath
+										: active.detachedTranscriptPath,
+								retainedArtifactsSuccessorPath:
+									deletion.phase === "artifacts"
+										? deletion.retainedSuccessorPath
+										: active.retainedArtifactsSuccessorPath,
+								retainedArtifactsPlaceholderPath:
+									deletion.phase === "artifacts"
+										? deletion.retainedPlaceholderPath
+										: active.retainedArtifactsPlaceholderPath,
+								retainedArtifactsUnknownPath:
+									deletion.phase === "artifacts"
+										? deletion.retainedUnknownPath
+										: active.retainedArtifactsUnknownPath,
+								retainedTranscriptSuccessorPath:
+									deletion.phase === "transcript"
+										? deletion.retainedSuccessorPath
+										: active.retainedTranscriptSuccessorPath,
+								retainedTranscriptPlaceholderPath:
+									deletion.phase === "transcript"
+										? deletion.retainedPlaceholderPath
+										: active.retainedTranscriptPlaceholderPath,
+								retainedTranscriptUnknownPath:
+									deletion.phase === "transcript"
+										? deletion.retainedUnknownPath
+										: active.retainedTranscriptUnknownPath,
+							},
+							lock,
+						);
+						continue;
+					}
+					fsyncManagedParent(target.path);
+					await publishCleanupCompleted(scope, tombstone, target, lock);
+				} catch (error) {
+					if (!expectedCandidate || target.sessionId === expectedCandidate.sessionId) throw error;
+					logger.warn("Tombstone reconciliation failed for one target; will retry on a future scope open", {
 						tombstone,
-						{
-							...retry,
-							expectedArtifactsIdentity:
-								deletion.phase === "artifacts" ? deletion.artifactsIdentity : active.expectedArtifactsIdentity,
-							expectedArtifactsTree:
-								deletion.phase === "artifacts" ? deletion.artifactsTree : active.expectedArtifactsTree,
-							detachedArtifactsPath:
-								deletion.phase === "artifacts" ? deletion.detachedArtifactsPath : active.detachedArtifactsPath,
-							detachedTranscriptPath:
-								deletion.phase === "transcript"
-									? deletion.detachedTranscriptPath
-									: active.detachedTranscriptPath,
-							retainedArtifactsSuccessorPath:
-								deletion.phase === "artifacts"
-									? deletion.retainedSuccessorPath
-									: active.retainedArtifactsSuccessorPath,
-							retainedArtifactsPlaceholderPath:
-								deletion.phase === "artifacts"
-									? deletion.retainedPlaceholderPath
-									: active.retainedArtifactsPlaceholderPath,
-							retainedArtifactsUnknownPath:
-								deletion.phase === "artifacts"
-									? deletion.retainedUnknownPath
-									: active.retainedArtifactsUnknownPath,
-							retainedTranscriptSuccessorPath:
-								deletion.phase === "transcript"
-									? deletion.retainedSuccessorPath
-									: active.retainedTranscriptSuccessorPath,
-							retainedTranscriptPlaceholderPath:
-								deletion.phase === "transcript"
-									? deletion.retainedPlaceholderPath
-									: active.retainedTranscriptPlaceholderPath,
-							retainedTranscriptUnknownPath:
-								deletion.phase === "transcript"
-									? deletion.retainedUnknownPath
-									: active.retainedTranscriptUnknownPath,
-						},
-						lock,
-					);
-					continue;
+						sessionId: target.sessionId,
+						error: String(error),
+					});
 				}
-				fsyncManagedParent(target.path);
-				await publishCleanupCompleted(scope, tombstone, target, lock);
 			}
 		} finally {
 			if (lock) await lock.release().catch(() => undefined);
@@ -2962,7 +2978,7 @@ export async function prepareManagedSessionScopeForWrite(
 		ensureManagedDirectory(path.join(internal, MANAGED_LOCKS_DIRECTORY), root, policy);
 		ensureManagedDirectory(path.join(internal, MANAGED_RECEIPTS_DIRECTORY), root, policy);
 		ensureManagedDirectory(path.join(internal, MANAGED_TOMBSTONES_DIRECTORY), root, policy);
-		await reconcileManagedTombstones(scope);
+		await reconcileManagedTombstones(scope, expectedCandidate);
 		return { kind: "resolved", scope };
 	} catch (error) {
 		const publication = error instanceof ManagedPublishError ? error : undefined;

package/src/skill-state/workflow-mutation-guard.ts

@@ -35,17 +35,28 @@ function planningPhaseBlockMessage(skill: CanonicalGjcWorkflowSkill): string {
 }
 
 const BLOCKED_TOOL_NAMES = new Set(["edit", "write", "ast_edit", "bash"]);
+/**
+ * Only `/dev/null` is exempt. `/dev/stdout`, `/dev/stderr`, and `/dev/fd/<n>` are descriptor
+ * aliases: `exec 1<>src/product.ts; printf x >/dev/stdout` reaches a real repository file
+ * through a rebound descriptor, so they must stay blocked.
+ */
+const DEVICE_SINK_PATHS = new Set(["/dev/null"]);
+/** Bash write forms the plain `>`/`>>` scanner misses: clobber, dup-to-path, and read-write open. */
+const BASH_EXTENDED_WRITE_RE = /(?:>\||<>|>&(?![\s;&|]*(?:\d+|-)(?:[\s;&|]|$)))\s*([^\s;&|]+)/g;
+/** Descriptor rebinding is not statically resolvable; any `exec` redirection forces a fail-closed verdict. */
+const BASH_EXEC_REDIRECT_RE = /(?:^|[;&|\n])\s*(?:sudo\s+)?exec\b[^;&|\n]*[<>]/i;
+
 const ARCHIVE_OR_SQLITE_BASE_RE = /^(.+?\.(?:tar\.gz|sqlite3|sqlite|db3|zip|tgz|tar|db))(?:$|:)/i;
 const INTERNAL_SCHEME_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
 const VIM_FILE_SWITCH_RE = /^\s*:(?:e|e!|edit|edit!)(?:\s+([^<\r\n]+))?(?:<CR>|\r|\n|$)/i;
 const BASH_MUTATION_COMMAND_RE =
-	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:tee|touch|rm|mkdir|cp|mv|install|truncate)\b([^;&|\n]*)|(?:^|[^<>])(?:>>?|\d>>?)\s*([^\s;&|]+)/gi;
+	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:[^\s;&|]*\/)?(?:tee|touch|rm|mkdir|cp|mv|install|truncate)\b([^;&|\n]*)|(?:^|[^<>])(?:>>?|\d>>?)\s*([^\s;&|]+)/gi;
 const BASH_IN_PLACE_MUTATION_COMMAND_RE = /(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:sed|perl)\b([^;&|\n]*)/gi;
 const BASH_OPAQUE_INTERPRETER_WRITE_RE =
 	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:python3?|node|ruby)\b[^;&|\n]*(?:-c|-e)\b[^;&|\n]*(?:open\s*\(|writeFile(?:Sync)?\s*\(|\.write\s*\()/i;
 const BASH_HEREDOC_OPAQUE_INTERPRETER_WRITE_RE =
 	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:python3?|node|ruby)\b[^;&|\n]*(?:<<[-]?\s*['"]?\w+['"]?)[\s\S]*(?:open\s*\(|writeFile(?:Sync)?\s*\(|\.write\s*\()/i;
-const BASH_DD_OUTPUT_RE = /(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?dd\b([^;&|\n]*)/gi;
+const BASH_DD_OUTPUT_RE = /(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:[^\s;&|]*\/)?dd\b([^;&|\n]*)/gi;
 
 type ToolWithEditMode = AgentTool & {
 	mode?: unknown;
@@ -371,6 +382,10 @@ function cleanShellWord(value: string): string {
 	return value.replace(/^['"]|['"]$/g, "");
 }
 
+function isDeviceSinkPath(value: string): boolean {
+	return DEVICE_SINK_PATHS.has(cleanShellWord(value));
+}
+
 function extractBashTargets(args: unknown): ExtractedTargets {
 	const record = getRecord(args);
 	const command = safeString(record?.command);
@@ -382,11 +397,25 @@ function extractBashTargets(args: unknown): ExtractedTargets {
 	if (BASH_OPAQUE_INTERPRETER_WRITE_RE.test(command) || BASH_HEREDOC_OPAQUE_INTERPRETER_WRITE_RE.test(command)) {
 		targets.unknown = true;
 	}
+	// `exec 1<>file` rebinds a descriptor, so a later `>/dev/null` may not reach the device at all.
+	if (BASH_EXEC_REDIRECT_RE.test(command)) {
+		targets.unknown = true;
+	}
+	for (const match of command.matchAll(BASH_EXTENDED_WRITE_RE)) {
+		const cleaned = cleanShellWord(match[1] ?? "");
+		if (!cleaned) targets.unknown = true;
+		else if (!isDeviceSinkPath(cleaned)) addPath(targets, cleaned);
+	}
 	for (const match of command.matchAll(BASH_DD_OUTPUT_RE)) {
 		const parts = shellWords(match[1] ?? "").map(cleanShellWord);
-		const output = parts.find(part => part.startsWith("of="));
-		if (output) addPath(targets, output.slice(3));
-		else targets.unknown = true;
+		// Every `of=` counts: GNU dd honors the last one, so `of=/dev/null of=real.ts` writes real.ts.
+		const outputs = parts.filter(part => part.startsWith("of="));
+		if (outputs.length === 0) targets.unknown = true;
+		for (const output of outputs) {
+			const outputPath = cleanShellWord(output.slice(3));
+			if (!outputPath) targets.unknown = true;
+			else if (!isDeviceSinkPath(outputPath)) addPath(targets, outputPath);
+		}
 	}
 	for (const match of command.matchAll(BASH_IN_PLACE_MUTATION_COMMAND_RE)) {
 		const parts = shellWords(match[1] ?? "").map(cleanShellWord);
@@ -399,12 +428,17 @@ function extractBashTargets(args: unknown): ExtractedTargets {
 	for (const match of command.matchAll(BASH_MUTATION_COMMAND_RE)) {
 		const redirected = match[2]?.trim();
 		if (redirected) {
-			addPath(targets, cleanShellWord(redirected));
+			const cleaned = cleanShellWord(redirected);
+			// A capture that dequotes to nothing (e.g. `>" src.ts"`) is a truncated parse, not a safe no-op.
+			if (!cleaned) targets.unknown = true;
+			else if (!isDeviceSinkPath(cleaned)) addPath(targets, cleaned);
 			continue;
 		}
 		const parts = shellWords(match[1] ?? "");
 		const commandName = match[0]
-			?.match(/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(tee|touch|rm|mkdir|cp|mv|install|truncate)\b/i)?.[1]
+			?.match(
+				/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:[^\s;&|]*\/)?(tee|touch|rm|mkdir|cp|mv|install|truncate)\b/i,
+			)?.[1]
 			?.toLowerCase();
 		const targetParts =
 			commandName === "cp" || commandName === "mv" || commandName === "install" || commandName === "truncate"