@gajae-code/coding-agent 0.12.11 → 0.12.13

package/src/sdk/bus/index.ts

@@ -79,6 +79,7 @@ import {
 	getCurrentTelegramActivationMarker,
 	getNotificationConfig,
 	isProviderEffectivelyEnabled,
+	isSlackComplete,
 	type NotificationConfig,
 	type NotificationSettingsReader,
 	resolveGenericNotificationSessionEligibility,
@@ -90,6 +91,12 @@ import {
 	runIdentityControlSuccessPath,
 	type TerminalSendOutcome,
 } from "./control-drain-lease";
+import { ConversationStore } from "./conversation-store";
+import {
+	createSlackBindingActivationGate,
+	EXISTING_THREAD_BIND_ENV,
+	isExistingThreadBindingRequested,
+} from "./existing-thread-readiness";
 import { imageAttachmentsFromMessage, notificationActionPayload, summaryFromMessage, truncate } from "./helpers";
 import { createKindAwareReconciliation } from "./kind-aware-reconciliation";
 import { assertNativeRuntimeCompatibility } from "./native-runtime-compatibility";
@@ -97,6 +104,7 @@ import { proposedTelegramIdentity } from "./notification-orchestration";
 import { createPromptReconciliation, sanitizePromptFailure } from "./prompt-reconciliation";
 import { createReconciliationStore } from "./reconciliation-store";
 import { NotificationSessionController, type NotificationSessionRuntime } from "./session-control";
+import type { SlackConversation } from "./slack-conversation";
 import {
 	ASK_SELECTED_ACK_CAPABILITY,
 	type EnsureDaemonResult,
@@ -829,16 +837,22 @@ export class PresentationArbiter {
 							...(presentation.recommendedIndex === undefined
 								? {}
 								: { recommendedIndex: presentation.recommendedIndex }),
-							controls: presentation.multi
-								? [
-										{
-											id: "navigation_forward",
-											kind: "navigation",
-											label: presentation.navigationLabel ?? "Done",
-											enabled: presentation.allowEmpty || presentation.selectedOptions.length > 0,
-										},
-									]
-								: presentation.controls,
+							// A presentation that carries its own controls (the ask tool's
+							// Next/Done) keeps them; a durable workflow gate presents none,
+							// so its navigation control is synthesized here.
+							controls:
+								presentation.controls.length > 0
+									? presentation.controls
+									: presentation.multi
+										? [
+												{
+													id: "navigation_forward",
+													kind: "navigation",
+													label: presentation.navigationLabel ?? "Done",
+													enabled: presentation.allowEmpty || presentation.selectedOptions.length > 0,
+												},
+											]
+										: [],
 						},
 						{ redact: this.redact(), sessionTag: this.tag },
 					),
@@ -1816,9 +1830,12 @@ function registerInteractiveAnswerSource(
 					options: request.options,
 					controls: request.controls,
 					recommendedIndex: request.recommendedIndex,
-					multi: false,
+					// The ask tool owns the multi-select loop and re-issues one request per
+					// toggle; carrying its selection here is what makes the toggle visible
+					// on a remote transport instead of an identical repeated prompt.
+					multi: request.multi === true,
 					allowEmpty: false,
-					selectedOptions: [],
+					selectedOptions: [...(request.selectedOptions ?? [])],
 					onActivated: (actionId, lease) => {
 						if (pending.actionId && pendingInteractive.get(pending.actionId) === pending)
 							pendingInteractive.delete(pending.actionId);
@@ -3514,6 +3531,8 @@ export function createNotificationsExtension(
 		const sdkEnabledForSession =
 			(options.sdkHostModeSupported ?? true) && shouldHostSdk(settings, isNotificationEligibleContext(ctx));
 		const lifecycleRequired = lifecycleStartupCapability !== undefined;
+		/** The broker-issued readiness intent for this exact lifecycle-managed session. */
+		const lifecycleReadiness = lifecycleStartupCapability?.readiness ?? "immediate";
 		const failLifecycleStartup = (
 			reason: "disabled" | "ineligible" | "failed",
 			error?: unknown,
@@ -4277,10 +4296,70 @@ export function createNotificationsExtension(
 			}
 		};
 
+		/**
+		 * Existing-thread preparation.
+		 *
+		 * A prepared session withholds its readiness signal so
+		 * `gjc notify bind-thread` can adopt an operator-supplied Slack root before
+		 * any stock root is published; activation then publishes readiness once and
+		 * the daemon adopts that root.
+		 *
+		 * Preparation has exactly two authorities, and they never overlap. A
+		 * broker lifecycle-managed session is prepared only by the broker-issued,
+		 * session-scoped readiness intent on its launch request, which the
+		 * lifecycle wait completes on the prepared signal instead of readiness. A
+		 * manual/source session keeps the explicit `GJC_NOTIFY_BIND_EXISTING_THREAD`
+		 * opt-in, which is refused for lifecycle-managed sessions so an inherited
+		 * process-global flag can never silently defer a broker-created session.
+		 *
+		 * The activation gate is the existing-thread bind authority itself: it
+		 * proves a daemon-owned mapping exists at this exact endpoint generation,
+		 * so activation before a binding fails closed with no grace period. It can
+		 * only be built from a configured, enabled Slack target plus the agent
+		 * directory holding that mapping, so a preparation request that cannot
+		 * produce one has no bind authority at all and is refused here. Degrading
+		 * such a request to ordinary immediate readiness would answer "prepare" with
+		 * a session that publishes its own root anyway, and preparing without the
+		 * gate would hand back a prepared session that activates with no binding.
+		 */
+		const preparationAgentDir = settings?.getAgentDir?.();
+		const slackBindTarget =
+			notificationsEnabledForSession && isSlackComplete(cfg)
+				? { teamId: cfg.slack.workspaceId, channelId: cfg.slack.channelId }
+				: undefined;
+		const envRequestsPreparation = isExistingThreadBindingRequested(process.env);
+		if (envRequestsPreparation && lifecycleRequired)
+			return failLifecycleStartup(
+				"failed",
+				`${EXISTING_THREAD_BIND_ENV}=1 is not supported for broker lifecycle-managed sessions; use the broker readiness intent.`,
+			);
+		const preparesExistingThread = lifecycleRequired ? lifecycleReadiness === "deferred" : envRequestsPreparation;
+		const activationGate =
+			preparesExistingThread && preparationAgentDir && slackBindTarget
+				? createSlackBindingActivationGate({
+						store: new ConversationStore<SlackConversation>({ agentDir: preparationAgentDir, kind: "slack" }),
+						teamId: slackBindTarget.teamId,
+						channelId: slackBindTarget.channelId,
+					})
+				: undefined;
+		if (preparesExistingThread && !activationGate) {
+			const missing = slackBindTarget
+				? "an agent directory"
+				: "a configured Slack notification target for this session";
+			if (lifecycleRequired)
+				return failLifecycleStartup(
+					"failed",
+					`Existing-thread preparation requires ${missing} to prove the existing-thread binding.`,
+				);
+			throw new Error(`${EXISTING_THREAD_BIND_ENV}=1 requires ${missing} to prove the existing-thread binding.`);
+		}
+
 		host = new SessionSdkHost({
 			sessionId: id,
 			stateRoot,
 			token,
+			...(preparesExistingThread ? { readiness: "deferred" as const } : {}),
+			...(activationGate ? { activationGate } : {}),
 			sendFrame: (connectionId, frame) => sendSdkFrame(connectionId, frame),
 			connectionCapabilities: connectionId => hostCapCache.get(connectionId),
 			installProviderDefinitions,

package/src/sdk/bus/notification-service.ts

@@ -182,12 +182,39 @@ export async function readNotificationEndpointFile(file: string): Promise<Notifi
 /** Bump when the native exact-deletion identity contract changes. */
 export const NATIVE_PATH_IDENTITY_CONTRACT_VERSION = 1;
 
+/**
+ * Remove exactly the inspected regular file.
+ *
+ * Intermediate directory symlinks (e.g. multi-account layouts that share
+ * `notifications/` via a directory symlink) are resolved before the native
+ * no-follow unlink. Only the parent path is canonicalized; the final basename
+ * is rejoined so native exact_unlink still applies AT_SYMLINK_NOFOLLOW to the
+ * final path component at mutation time. A final-component file symlink stays
+ * `reparse_point` (including TOCTOU replacement after JS preflight).
+ */
 export function exactUnlinkNotificationFile(
 	file: string,
 	identity: NotificationEndpointFileIdentity,
 	quarantineName: string,
 ): NotificationExactUnlinkResult {
-	const result = native.exactUnlink(file, { ...identity, quarantineName });
+	let target = file;
+	try {
+		const st = fsSync.lstatSync(file);
+		if (st.isSymbolicLink()) {
+			return { ok: false, code: "reparse_point" };
+		}
+		// Native exact_unlink walks every path component with O_NOFOLLOW and
+		// rejects intermediate directory reparse points. Resolve only the
+		// directory prefix so a shared notifications dir still unlinks by
+		// inode, while the final basename remains subject to no-follow.
+		const parent = path.dirname(file);
+		const base = path.basename(file);
+		const resolvedParent = fsSync.realpathSync(parent);
+		target = path.join(resolvedParent, base);
+	} catch {
+		// Missing/unreadable paths fall through; the native call reports the failure.
+	}
+	const result = native.exactUnlink(target, { ...identity, quarantineName });
 	return {
 		ok: result.ok,
 		code: result.code,

package/src/sdk/bus/rich-render.ts

@@ -124,8 +124,9 @@ export async function deliverRichActionWithFallback(
 			const fallbackId = await htmlFallback();
 			return { messageId: fallbackId, usedRich: false, usedFallback: true };
 		}
-		const candidate = (res as { result?: { message_id?: unknown } } | null)?.result?.message_id;
-		if (validMessageId(candidate)) return { messageId: candidate, usedRich: true, usedFallback: false };
+		const candidate = (res as { ok?: unknown; result?: { message_id?: unknown } } | null)?.result?.message_id;
+		if ((res as { ok?: unknown } | null)?.ok === true && validMessageId(candidate))
+			return { messageId: candidate, usedRich: true, usedFallback: false };
 		log?.warn("notifications: sendRichMessage(action) outcome ambiguous; not falling back to HTML");
 	} catch (err) {
 		const failure = err instanceof Error ? err.message : String(err);

package/src/sdk/bus/slack-daemon.ts

@@ -11,6 +11,11 @@ import {
 	slackConversationKey,
 } from "./slack-conversation";
 
+import { assertBoundedSlackRootTs, claimSlackThreadBinding, SlackThreadBindingError } from "./slack-thread-binding";
+
+export type { SlackThreadBindingErrorCode } from "./slack-thread-binding";
+export { SlackThreadBindingError } from "./slack-thread-binding";
+
 export class SlackEndpointBindingError extends Error {
 	constructor(message = "Slack session endpoint changed before dispatch.") {
 		super(message);
@@ -32,7 +37,12 @@ class SlackReconciledAbsentEffectError extends Error {
 
 import { type ChatEffect, ChatEffectJournal, type ChatEffectLease } from "./chat-effect-journal";
 import { SlackProviderError } from "./slack-live-provider";
-import type { SlackPostedMessage, SlackProvider, SlackSocketEnvelope } from "./slack-provider";
+import type {
+	SlackMessageSearchResult,
+	SlackPostedMessage,
+	SlackProvider,
+	SlackSocketEnvelope,
+} from "./slack-provider";
 
 // Durable filesystem publication leases must outlast one event-loop and persistence turn.
 const MIN_PUBLICATION_LEASE_MS = 100;
@@ -45,6 +55,12 @@ export interface SlackSdkClient {
 	send(frame: Record<string, unknown>): void;
 }
 
+/** Proven right to bind one session at one endpoint generation. */
+export interface SlackBindingAuthority {
+	sessionId: string;
+	endpointGeneration: number;
+}
+
 export interface SlackNotificationDaemonOptions {
 	agentDir: string;
 	repo: string;
@@ -62,6 +78,12 @@ export interface SlackNotificationDaemonOptions {
 	publicationLeaseMs?: number;
 
 	resolveEndpoint?: (sessionId: string) => Promise<SlackEndpoint | null>;
+	/**
+	 * Exact discovery/attachment authority for adopting an existing root. The
+	 * runtime supplies index, endpoint, and attachment proof; without it only the
+	 * resolvable endpoint generation can be proven.
+	 */
+	resolveBindingAuthority?: (sessionId: string) => Promise<SlackBindingAuthority | undefined>;
 	createClient: (endpoint: SlackEndpoint) => SlackSdkClient;
 	onCommand?: (
 		sessionId: string,
@@ -348,6 +370,76 @@ export class SlackNotificationDaemon {
 		return (await this.#postRoot(sessionId, body, endpointGeneration)).conversation;
 	}
 
+	/**
+	 * Adopt an operator-supplied root in the configured workspace and channel
+	 * without publishing a replacement root.
+	 *
+	 * The root is verified against the provider before any lock is taken, and the
+	 * claim re-proves session authority inside the store lock. When the caller is
+	 * the daemon command channel it also supplies `commitAuthority`, which
+	 * re-proves the exact daemon owner tuple and takes terminal request
+	 * authority in the same fence, so an ownership change or a cancellation
+	 * between dispatch and commit leaves the store untouched. The claim targets
+	 * the same session key stock publication uses, so a concurrent first
+	 * notification observes the adopted root instead of posting a second one.
+	 */
+	async bindExistingRoot(
+		sessionId: string,
+		rootTs: string,
+		commitAuthority?: () => Promise<boolean>,
+	): Promise<SlackConversation> {
+		assertBoundedSlackRootTs(rootTs);
+		const authority = await this.#bindingAuthority(sessionId);
+		if (!authority)
+			throw new SlackThreadBindingError(
+				"session_not_live",
+				"Slack thread binding requires an exact live session endpoint.",
+			);
+		await this.#verifyExistingRoot(rootTs);
+		return await claimSlackThreadBinding({
+			store: this.store,
+			key: this.#intentKey(sessionId),
+			teamId: this.options.teamId,
+			channelId: this.options.channelId,
+			sessionId,
+			rootTs,
+			endpointGeneration: authority.endpointGeneration,
+			revalidate: async () => {
+				if ((await this.#bindingAuthority(sessionId))?.endpointGeneration !== authority.endpointGeneration)
+					return false;
+				return commitAuthority ? await commitAuthority() : true;
+			},
+			now: this.#now,
+		});
+	}
+
+	/**
+	 * Endpoint authority for a binding. The runtime injects exact discovery and
+	 * attachment authority; the fallback accepts only a resolvable endpoint with a
+	 * usable generation, which is all a directly constructed daemon can prove.
+	 */
+	async #bindingAuthority(sessionId: string): Promise<SlackBindingAuthority | undefined> {
+		if (this.options.resolveBindingAuthority) return await this.options.resolveBindingAuthority(sessionId);
+		const endpoint = await this.#resolveEndpoint(sessionId);
+		if (!endpoint || !Number.isSafeInteger(endpoint.generation) || endpoint.generation <= 0) return undefined;
+		return { sessionId, endpointGeneration: endpoint.generation };
+	}
+
+	/** Prove the operator-supplied root exists in the configured channel before persisting anything. */
+	async #verifyExistingRoot(rootTs: string): Promise<void> {
+		let found: SlackMessageSearchResult | null;
+		try {
+			found = await this.options.provider.findMessageByTimestamp({ channel: this.options.channelId, ts: rootTs });
+		} catch {
+			throw new SlackThreadBindingError(
+				"provider_unavailable",
+				"Slack could not be reached to verify the existing thread root.",
+			);
+		}
+		if (!found || found.ts !== rootTs || found.channel !== this.options.channelId)
+			throw new SlackThreadBindingError("root_not_found", "The Slack root was not found in the configured channel.");
+	}
+
 	async #postRoot(sessionId: string, body: string, endpointGeneration?: number): Promise<SlackRootPublication> {
 		const endpoint = await this.#resolveEndpoint(sessionId);
 		if (!endpoint || (endpointGeneration !== undefined && endpoint.generation !== endpointGeneration))
@@ -394,11 +486,14 @@ export class SlackNotificationDaemon {
 				inboundDispatches: current?.inboundDispatches ?? [],
 			};
 		});
-		if (!pending?.clientMsgId) throw new Error("Unable to persist Slack root post intent");
-		if (pending.state === "active") {
+		// An already-active session root is authoritative whether this daemon
+		// published it or adopted an operator-supplied one, so it is checked before
+		// the publication identity a claim of our own would have written.
+		if (pending?.state === "active" && pending.rootTs) {
 			if (pending.endpointGeneration !== generation) throw new SlackEndpointBindingError();
 			return { conversation: pending, created: false };
 		}
+		if (!pending?.clientMsgId) throw new Error("Unable to persist Slack root post intent");
 		if (!claimed)
 			return { conversation: await this.#waitForRoot(pendingKey, sessionId, body, generation), created: false };
 		if (pending.endpointGeneration !== generation) throw new SlackEndpointBindingError();
@@ -498,7 +593,7 @@ export class SlackNotificationDaemon {
 			bodyWasUsedAsRoot = publication.created;
 		}
 		if (!conversation.rootTs) return conversation;
-		const key = this.#intentKey(sessionId);
+		const key = usedExistingRoot && existing ? existing.key : this.#intentKey(sessionId);
 		const conversationGeneration = this.#requireEndpointGeneration(conversation);
 		if (conversationGeneration !== generation) throw new SlackEndpointBindingError();
 		if (bodyWasUsedAsRoot) {

package/src/sdk/bus/slack-live-provider.ts

@@ -97,6 +97,17 @@ function socketFromGlobal(url: string): SlackWebSocket {
 	return new WebSocket(url);
 }
 
+/**
+ * Slack's Web API rejects JSON bodies for read methods such as conversations.replies
+ * with `invalid_arguments`, so every call is encoded as a form body with undefined
+ * parameters omitted rather than serialized.
+ */
+function formBody(body: Record<string, string | undefined>): string {
+	const parameters = new URLSearchParams();
+	for (const [key, value] of Object.entries(body)) if (value !== undefined) parameters.set(key, value);
+	return parameters.toString();
+}
+
 /**
  * Production Socket Mode and Web API client. It keeps all connection state in
  * memory and deliberately never maintains a Slack cursor.
@@ -270,6 +281,22 @@ export class SlackLiveProvider implements SlackProviderClient, SlackDiagnosticPr
 		return this.#findMessage(replies, input.clientMsgId, input.channel);
 	}
 
+	/**
+	 * Confirm that `ts` addresses a real message in `channel`. Slack answers
+	 * `conversations.replies` with the addressed message first; a timestamp that
+	 * is unknown, deleted, or lives in another channel produces a Web API error
+	 * instead, which surfaces as a `SlackProviderError` the caller treats as an
+	 * unverified root.
+	 */
+	async findMessageByTimestamp(input: { channel: string; ts: string }): Promise<SlackMessageSearchResult | null> {
+		const response = await this.#api("conversations.replies", { channel: input.channel, ts: input.ts, limit: "1" });
+		for (const candidate of messages(response.messages)) {
+			if (string(candidate.ts) !== input.ts) continue;
+			return { channel: string(candidate.channel) ?? input.channel, ts: input.ts, client_msg_id: undefined };
+		}
+		return null;
+	}
+
 	async #connect(generation = this.#lifecycleGeneration): Promise<void> {
 		const opened = await this.#openSocketUrl();
 		if (this.#stopped || generation !== this.#lifecycleGeneration) return;
@@ -385,8 +412,11 @@ export class SlackLiveProvider implements SlackProviderClient, SlackDiagnosticPr
 			try {
 				response = await this.#fetch(`${SLACK_API}/${operation}`, {
 					method: "POST",
-					headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json; charset=utf-8" },
-					body: JSON.stringify(body),
+					headers: {
+						Authorization: `Bearer ${token}`,
+						"Content-Type": "application/x-www-form-urlencoded; charset=utf-8",
+					},
+					body: formBody(body),
 					signal,
 				});
 			} catch {

package/src/sdk/bus/slack-provider.ts

@@ -55,6 +55,12 @@ export interface SlackProviderClient {
 		clientMsgId: string;
 		threadTs?: string;
 	}): Promise<SlackMessageSearchResult | null>;
+	/**
+	 * Prove that an operator-supplied timestamp addresses a real message in the
+	 * requested channel. Adoption of an existing root is refused when a client
+	 * cannot answer this, so verification is never silently skipped.
+	 */
+	findMessageByTimestamp?(input: { channel: string; ts: string }): Promise<SlackMessageSearchResult | null>;
 	readonly transportHealthy?: boolean;
 }
 
@@ -97,4 +103,9 @@ export class SlackProvider {
 	}): Promise<SlackMessageSearchResult | null> {
 		return (await this.client.findMessageByClientMsgId?.(input)) ?? null;
 	}
+
+	/** Fail-closed root verification: a client without this capability can never confirm a root. */
+	async findMessageByTimestamp(input: { channel: string; ts: string }): Promise<SlackMessageSearchResult | null> {
+		return (await this.client.findMessageByTimestamp?.(input)) ?? null;
+	}
 }