@gajae-code/coding-agent 0.12.2 → 0.12.4

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [0.12.4] - 2026-07-30
+
+## [0.12.3] - 2026-07-30
+
+### Fixed
+
+- The release cut no longer deletes previously released changelog headings whose body is empty. `releasedChangelogContent` ran `removeEmptyVersionEntries` before transforming `## [Unreleased]`, so cutting a release replaced the prior empty semver heading instead of inserting the new one above it — v0.12.2 dropped the `## [0.12.1] - 2026-07-29` heading from four package changelogs. Released sections are now immutable history and are always preserved.
+
 ## [0.12.2] - 2026-07-30
 
 ### Added
@@ -15,8 +23,9 @@
 ### Fixed
 
 - Terminal input now normalizes Option/Meta navigation and psmux modified-Enter encodings through the native key parser, keeping legacy, Kitty CSI-u, and modifyOtherKeys behavior consistent.
-- Ultragoal CLI replay evidence now accepts any argv `command` instead of a small conservative executable allowlist. Proving a CLI-surface change with the project's own test runner (e.g. `bun test <file>`) was impossible: the allowlist only permitted `--version` probes, `bun/node -e "console.log(...)"` literals, read-only `git`, and `gjc read|status`, so real verification commands were rejected and forced agents into `replayExempt` metadata that additionally demanded a screenshot/automation/PTY fallback artifact. `replaySafe: true` is now the gating attestation, backed by the existing sandbox (subprocess isolation with explicit argv and no shell, timeout kill, 1 MiB output cap, env scrubbing). Every other rail is unchanged and still fails closed: shell-string commands, `replaySafe` not true, dangerous env vars, stdout/`recordedStdout` mismatch, and unexpected exit codes are all still rejected (#3533).
-- Ultragoal CLI replay evidence now reads the replay file referenced by an `executorQa.artifactRefs` entry whose `kind` is `cli-replay`. Such a row short-circuited as an *inline* replay record, so its `path` was never read and validation failed with a confusing `schemaVersion must be 1` diagnostic pointing at the ref instead of the file — forcing an undocumented workaround of renaming the ref's `kind`. A row is now treated as inline only when it actually carries replay fields (#3533).
+- Ultragoal CLI replay no longer executes model-authored test source or trusts `replaySafe: true` as arbitrary command authority. Runtime replay is limited to the pinned Bun runtime for `--version` and literal `-e "console.log(...)"`; shells, interpreter code strings, path-qualified executables, tests, install/publish/network/git mutation commands, and arbitrary argv are rejected. Replay cwd/artifact files are realpath-confined, ambiguous rows fail closed, stdout and stderr are checked, and POSIX timeout cleanup signals the process group. Structured test-report fallback remains deliberately unsupported pending a separate trusted-provenance design (#3533).
+- Ultragoal CLI replay evidence now reads the replay file referenced by an `executorQa.artifactRefs` entry whose `kind` is `cli-replay`. Inline, nested, and file-backed replay forms are disambiguated explicitly; mixed or malformed rows fail closed (#3533).
+
 - Broker artifact cleanup no longer promotes a non-empty `cleanup_pending` quarantine to transcript-phase completion. The broker advances only when the retained quarantine is root-only/empty or when the lower layer returns `artifacts_removed`, so artifact bytes cannot vanish behind a success receipt (#3489).
 - `gjc --worktree` / `gjc -w` launch no longer crashes with a raw uncaught `EEXIST` when the worktree bucket directory (`<repo>.gajae-code-worktrees`) is a broken symbolic link to unmounted or offloaded cold storage. The launch distinguishes dangling links and non-directory entries from valid directory symlinks or Windows junctions, reclassifies mkdir races, avoids disclosing raw link targets or unsafe shell commands, and never deletes or replaces an obstructing entry.
 - POSIX parent identity reproof/fsync is now centralized before every promotable artifact-phase result, preventing a crash-window where a rename is lost after durable retirement is recorded (#3489).

package/dist/types/gjc-runtime/ultragoal-evidence.d.ts

@@ -17,12 +17,16 @@ export declare function validateStructuralArtifact(cwd: string, row: JsonObject,
     live: boolean;
 }): Promise<boolean>;
 export declare function isAllowedGitReplayCommand(args: readonly string[]): boolean;
+export declare function resolveCliReplayCommand(command: string[], options?: {
+    compiled?: boolean;
+}): string[];
 export declare function readCliReplayRecord(cwd: string, row: JsonObject, fieldName: string): Promise<JsonObject | null>;
 export interface ReplayProcessHandle {
     readonly exited: Promise<number>;
+    readonly pid?: number;
     kill(signal?: number | NodeJS.Signals): void;
 }
-export declare function waitForReplayProcessWithTimeout(process: ReplayProcessHandle, timeoutMs: number, graceMs?: number): Promise<number>;
+export declare function waitForReplayProcessWithTimeout(handle: ReplayProcessHandle, timeoutMs: number, graceMs?: number): Promise<number>;
 export declare function validateReplayExemptFallback(cwd: string, record: JsonObject, fieldName: string, artifactRefs: Map<string, JsonObject>, options: {
     surfaceFamily: SurfaceFamily;
     live: boolean;

package/dist/types/gjc-runtime/ultragoal-runtime.d.ts

@@ -315,9 +315,9 @@ export declare function isSubstantiveEvidence(value: unknown): boolean;
 export declare function hasTypedVerifiedReceipt(value: unknown): boolean;
 export declare function hasExistingNonEmptyArtifact(cwd: string, value: unknown): Promise<boolean>;
 export declare function readArtifactBytes(cwd: string, row: JsonObject, fieldName: string): Promise<Buffer | null>;
-import { validateArtifactProof, validateCliReplay, validateLiveSurfaceProofPresence, validateReplayExemptFallback, validateStructuralArtifact, validateSurfaceStructuralRequirement, waitForReplayProcessWithTimeout } from "./ultragoal-evidence";
+import { resolveCliReplayCommand, validateArtifactProof, validateCliReplay, validateLiveSurfaceProofPresence, validateReplayExemptFallback, validateStructuralArtifact, validateSurfaceStructuralRequirement, waitForReplayProcessWithTimeout } from "./ultragoal-evidence";
 export type { ReplayProcessHandle } from "./ultragoal-evidence";
-export { validateArtifactProof, validateCliReplay, validateLiveSurfaceProofPresence, validateReplayExemptFallback, validateStructuralArtifact, validateSurfaceStructuralRequirement, waitForReplayProcessWithTimeout, };
+export { resolveCliReplayCommand, validateArtifactProof, validateCliReplay, validateLiveSurfaceProofPresence, validateReplayExemptFallback, validateStructuralArtifact, validateSurfaceStructuralRequirement, waitForReplayProcessWithTimeout, };
 export declare function validateExecutorQaRedTeamEvidenceForReview(cwd: string, executorQa: Record<string, unknown>, options?: {
     mode?: "review";
     changeSet?: UltragoalChangeSet;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.12.2",
+	"version": "0.12.4",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -53,13 +53,13 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.12.2",
-		"@gajae-code/agent-core": "0.12.2",
-		"@gajae-code/ai": "0.12.2",
-		"@gajae-code/bridge-client": "0.12.2",
-		"@gajae-code/natives": "0.12.2",
-		"@gajae-code/tui": "0.12.2",
-		"@gajae-code/utils": "0.12.2",
+		"@gajae-code/stats": "0.12.4",
+		"@gajae-code/agent-core": "0.12.4",
+		"@gajae-code/ai": "0.12.4",
+		"@gajae-code/bridge-client": "0.12.4",
+		"@gajae-code/natives": "0.12.4",
+		"@gajae-code/tui": "0.12.4",
+		"@gajae-code/utils": "0.12.4",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/src/config/provider-ranking.ts

@@ -53,6 +53,7 @@ export const FAMOUS_PROVIDER_ORDER: readonly string[] = [
 	"xiaomi-token-plan-cn",
 	"opengateway",
 	"bizrouter",
+	"mara",
 	"github-copilot",
 	"cursor",
 ];

package/src/defaults/gjc/skills/ultragoal/SKILL.md

@@ -230,9 +230,22 @@ Team remains explicit and separate: Team is not auto-launched, not a hidden pipe
 
 Heavyweight review runs **once per boundary**, not once per story. In aggregate mode the whole required-goal set is one implicit boundary by default: every checkpoint before the run's final required goal may present the lightweight `deferredToBatch` gate, and only the final goal carries the full strict gate. Nothing needs to be declared to get this — it is the default.
 
-Per-subgoal verification is **agent-chosen**. The runtime does not dictate which lanes an intermediate story runs; it enforces only that the declaration matches the evidence. List the lanes you actually ran in `deferredToBatch.ranLanes` (`targetedVerification`, and optionally `aiSlopCleaner` / `iteration`). A declared lane with no evidence is rejected, submitted evidence for an undeclared lane is rejected, and `ranLanes` can never claim `architectReview` or `executorQa` — a deferred gate structurally cannot carry review evidence, so those lanes always belong to the boundary. `targetedVerification` remains mandatory; the ai-slop-cleaner pass and a full verification rerun are boundary duties, not per-subgoal duties.
+A deferred gate is just the proof the runtime cannot know: that targeted verification ran. Everything mechanical — `kind`, the batch tuple, `deferredLanes`, and the whole `changeSet` block (`paths`, `changeSetHash`) — is auto-filled from durable state and the computed cumulative git diff. Never hand-compute a hash. The minimal valid gate:
 
-Deferring never manufactures approvals: a `deferredToBatch` gate still cannot contain `architectReview`, `executorQa`, or `validationBatchClose`, and the boundary gate keeps every existing fail-closed rule.
+```json
+{
+  "deferredToBatch": {
+    "ranLanes": ["targetedVerification"],
+    "targetedVerification": {
+      "status": "passed",
+      "commands": ["bun test <targeted suite>"],
+      "evidence": "what was verified and how it passed"
+    }
+  }
+}
+```
+
+`deferredToBatch.ranLanes` lists the lanes you actually ran (`targetedVerification`, plus optionally `aiSlopCleaner` / `iteration`); declaration and evidence must match in both directions. `ranLanes` can never claim `architectReview` or `executorQa`, and a deferred gate can never contain `architectReview`, `executorQa`, or `validationBatchClose` — review always belongs to the boundary, and deferring never manufactures approvals. Any optional field you do supply must match reality; a wrong value fails closed. Check with `gjc ultragoal quality-gate validate` before checkpointing.
 
 ### Validation batches (explicit phase/module boundaries)
 
@@ -247,7 +260,7 @@ gjc ultragoal create-goals --brief-file <path> --validation-batch-json '[{"schem
 Checkpoint contract summary — the full contract lives in the `validation-batch-contracts` fragment (`skill-fragments/ultragoal/validation-batch-contracts.md`); load it before checkpointing any batch member:
 
 - **Non-final members** checkpoint `complete` with a single top-level `deferredToBatch` quality gate (kind `validation-batch-deferred`) proving targeted verification, a declaration-matched lane set, and a cumulative-since-base change set — never `architectReview`, `executorQa`, or `validationBatchClose`; deferring never manufactures fake review approvals.
-- **The final member** (`finalGoalId`) checkpoints `complete` with the normal full strict gate PLUS a top-level `validationBatchClose` proof covering all members; out-of-order close is rejected, close state is append-only proof on the final member only, and batch invalidation is fail-closed.
+- **The final member** (`finalGoalId`) checkpoints `complete` with the normal full strict gate PLUS a top-level `validationBatchClose` proof covering all members; out-of-order close is rejected, close state is append-only proof on the final member only, and batch invalidation is fail-closed. Like the deferred gate, every close field except `coverageEvidence` is auto-filled from durable receipts and the computed diff — the minimal close is `{"validationBatchClose":{"coverageEvidence":"..."}}` alongside the strict gate.
 
 ### Intra-goal validation-lane parallelism
 
@@ -291,7 +304,7 @@ One generation freezes the change set and reviews it exactly once:
 5. Delegate an `executor` QA/red-team lane with typed `executionMode: "ultragoal-red-team"` (preferred) — or assignment text that explicitly labels Ultragoal completion QA/red-team — to build and run the e2e/red-teaming QA suite appropriate for the story. A bare `executorQa` field-name mention is not enough to activate the mode. This lane must try to break the change, not just confirm the happy path. It must start from the approved plan/spec/acceptance criteria, then user-facing contracts, and only then implementation code as supporting evidence. Plan/code mismatches are blockers, not items to paper over with implementation intent.
 6. The executor QA/red-team lane must prove evidence by the real surface under test:
    - GUI/web surfaces require a valid automation transcript plus a non-uniform screenshot. Bare `inlineEvidence` text or typed receipts never prove live GUI/web execution.
-   - CLI surfaces require runtime argv replay: `schemaVersion: 1`, `kind: "cli-replay"`, `replaySafe: true`, an argv `command` (any executable — no command allowlist), and replayed output validation. The complete field-by-field replay schema, safe `env` constraints, and `replayExempt` audit contract are specified once in the "For CLI replay artifacts" paragraph below the quality-gate JSON; follow it exactly.
+   - CLI surfaces require a safe runtime argv replay (`schemaVersion: 1`, `kind: "cli-replay"`, `replaySafe: true`) or the existing audited `replayExempt` path with a screenshot, automation, or PTY structural fallback. Runtime replay is limited to the pinned Bun runtime for `bun --version` or literal `bun -e "console.log(...)"`; the gate never executes model-authored test files. Shells, interpreters with code strings, path-qualified executables, package/git/network mutation commands, `bun test`, and arbitrary argv are rejected. Structured `test-report` fallback remains unsupported pending a separately reviewed provenance design.
    - Native/desktop/tui surfaces require a structurally valid screenshot, PTY capture with terminal control codes, or app-automation transcript.
    - API/package surfaces require a real artifact file or typed receipt whose artifact `kind` contains one of `api`, `package`, `consumer`, `black-box`, or `test-report`; examples: `api-package-test-report`, `package-consumer-report`, `black-box-api-receipt`. Algorithm/math surfaces require a real artifact file or typed receipt whose artifact `kind` contains one of `property`, `boundary`, `edge`, `adversarial`, `failure`, `math`, `algorithm`, or `test-report`; examples: `property-test-report`, `algorithm-boundary-report`. Bare `inlineEvidence` text alone is not sufficient for any surface.
    - The mandatory **computer-use** red-team suite (`kill-switch-bypass`, `suspended-enforcement`, `permission-revoked`, …) is conditional, not universal: require it only when computer/desktop control is genuinely part of the product surface being dogfooded. For every other product type, prove the change through the matching live surface instead — browser-use automation for web/GUI, bash/CLI live invocation or argv replay for CLI, and real artifacts or typed receipts for API/package/algorithm/math. Editing docs, prompts, or skills that merely mention computer-use does not by itself make the computer-use suite applicable; pick the red-team surface that matches what the change actually ships.
@@ -364,7 +377,11 @@ Validate before you checkpoint. `gjc ultragoal quality-gate validate --quality-g
 
 Provide one `artifactRefs` entry per live surface actually exercised, using the surface-appropriate `kind` and evidence rules from steps 6–7 above; the CLI rejects missing or shallow gates. `status: "not_applicable"` rows are allowed only in `contractCoverage` and `surfaceEvidence` and each requires `contractRef` plus `reason`.
 
-For CLI replay artifacts, the JSON at `path` must be an object like `{"schemaVersion":1,"kind":"cli-replay","replaySafe":true,"command":["bun","-e","console.log(\"ultragoal-cli-ok\")"],"cwd":".","env":{"LC_ALL":"C"},"timeoutMs":30000,"expectedExitCode":0,"recordedStdout":"ultragoal-cli-ok\n","recordedStderr":"","invariants":[{"type":"substring","value":"ultragoal-cli-ok"},{"type":"not-substring","value":"error"}]}`. Accepted replay fields are `command` (string array — any executable is allowed; there is no command allowlist), optional `cwd`, safe `env`, `timeoutMs`, `expectedExitCode`, `recordedStdout`, `recordedStderr`, `normalization`, and `invariants`. The replay sandbox already isolates the command as a subprocess with a timeout, 1 MiB output cap, and env scrubbing, so `replaySafe: true` is the gating attestation rather than an executable allowlist. `env` must contain only safe deterministic variables (`LANG`, `LC_ALL`, `LC_CTYPE`, `TZ`), never credentials or machine/user-specific secrets. `normalization` is optional and, when provided, must be exactly the string `"default"` (the built-in normalizer already strips ANSI codes, normalizes line endings, scrubs paths, and trims trailing whitespace); object-shaped normalization is rejected. Invariants may be substring, regex, or not-substring checks; when present, they replace exact `recordedStdout` equality — without `invariants`, replayed normalized stdout must match `recordedStdout` exactly. Commands that cannot be replayed deterministically (non-zero side effects, require credentials, require network, interactive, platform-unavailable, destructive) may instead use audited `replayExempt` metadata with exact fields `reasonCode`, `reason`, `approvedBy`, and `fallbackArtifactRefs` plus a structurally valid same-surface fallback artifact. `reason` must be substantive and audited, and `approvedBy` must identify the verifier. Allowed `reasonCode` values are exactly `unsafe_side_effect`, `requires_credentials`, `requires_network`, `non_deterministic_external`, `destructive`, `interactive_only`, and `platform_unavailable`.
+For safe CLI replay artifacts, the JSON at `path` must be an object like `{"schemaVersion":1,"kind":"cli-replay","replaySafe":true,"command":["bun","-e","console.log(\"ultragoal-cli-ok\")"],"cwd":".","env":{"LC_ALL":"C"},"timeoutMs":30000,"expectedExitCode":0,"recordedStdout":"ultragoal-cli-ok\n","recordedStderr":"","invariants":[{"type":"substring","value":"ultragoal-cli-ok"},{"type":"not_substring","value":"error"}]}`. `replaySafe: true` is required but is never authority by itself: executable replay is limited to the pinned Bun runtime for `bun --version` or deterministic literal `bun -e "console.log(...)"`. Shells, nested interpreters, path-qualified executables, test source, install/publish commands, git mutation, network clients, and every other argv are rejected. The declared cwd and artifact files are realpath-confined beneath the repository, but the safe probe itself runs from a fresh empty temporary cwd/home so repository `bunfig.toml` preloads and user configuration cannot execute. Mixed inline/nested/file-backed rows fail closed, POSIX timeout cleanup signals the replay process group, stdout and stderr are validated after normalization, output is capped at 1 MiB, and the child environment is scrubbed to `CI`, `NO_COLOR`, `GJC_ULTRAGOAL_REPLAY`, trusted temporary `HOME`/`TMPDIR`, plus optional `LANG`, `LC_ALL`, `LC_CTYPE`, and `TZ`.
+
+Compiled GJC binaries fail executable replay closed because their `process.execPath` launches GJC rather than a Bun CLI. Those runs must use the existing audited `replayExempt` structural fallback; the validator never resolves an untrusted `bun` from `PATH`.
+
+Focused `bun test` execution is blocked because repository test source is still arbitrary host code without an operating-system sandbox. The current `replayExempt` contract continues to require an existing screenshot, automation transcript, or PTY structural fallback; a `test-report` or `bun-test-report` JSON file is intentionally not accepted yet. Keep that design work open until test-result provenance, output binding, and consumer authority can be made fail-closed. Allowed `reasonCode` values remain `unsafe_side_effect`, `requires_credentials`, `requires_network`, `non_deterministic_external`, `destructive`, `interactive_only`, and `platform_unavailable`.
 
 ## Terminal critic gate
 

package/src/defaults/gjc/skills/ultragoal/validation-batch-contracts.md

@@ -6,7 +6,8 @@ Internal Ultragoal sub-skill fragment (`kind: "skill-fragment"`, parent skill `u
 
 - **Non-final members** checkpoint `complete` with a single top-level `deferredToBatch` quality gate (kind `validation-batch-deferred`): a passing `targetedVerification` lane plus a cumulative-since-base change set. An ai-slop-cleaner pass and a full verification rerun are boundary duties and are optional here; when either is supplied it must pass and be blocker-free. A `deferredToBatch` gate must NOT contain `architectReview`, `executorQa`, or `validationBatchClose` — deferring never manufactures fake review approvals.
 - **Lane declaration is fail-closed.** `deferredToBatch.ranLanes` declares which lanes actually ran. A declared lane whose evidence is missing is rejected, evidence for an undeclared lane is rejected, `targetedVerification` must always be declared when `ranLanes` is present, and `ranLanes` can never declare `architectReview` or `executorQa`. Omitting `ranLanes` is allowed only for a gate that carries the mandatory targeted lane alone.
-- **The final member** (`finalGoalId`) checkpoints `complete` with the normal full strict gate PLUS a top-level `validationBatchClose` proof that covers all member IDs, member metadata hashes, member receipt/checkpoint-ledger-event IDs, per-member change-set hashes, and union change-set coverage. The final close only starts once every non-final member is already `complete` with a structurally fresh deferred receipt (out-of-order close is rejected).
+- **Derivable fields are auto-filled — never hand-compute a hash.** When omitted, the runtime fills `kind`, the batch tuple, `deferredLanes`, and the whole `changeSet` block (`memberGoalId`, `cumulativeFromBase`, `paths` from the computed cumulative diff, `changeSetHash`); the minimal deferred gate is `{"deferredToBatch":{"targetedVerification":{"status":"passed","commands":["..."],"evidence":"..."}}}`. A supplied value must still match reality; `changeSet.paths` rows may be plain path strings or `{path, status}` objects.
+- **The final member** (`finalGoalId`) checkpoints `complete` with the normal full strict gate PLUS a top-level `validationBatchClose` proof that covers all member IDs, member metadata hashes, member receipt/checkpoint-ledger-event IDs, per-member change-set hashes, and union change-set coverage. Every close field except `coverageEvidence` is auto-filled from durable receipts and the computed cumulative diff when omitted — the minimal close is `{"validationBatchClose":{"coverageEvidence":"..."}}` alongside the strict gate, and a supplied value must still match durable state. The final close only starts once every non-final member is already `complete` with a structurally fresh deferred receipt (out-of-order close is rejected).
 - Close state is append-only proof: it lives in the final member's checkpoint receipt and matching `goal_checkpointed` ledger row only. Never stamp `closedReceiptId`/`closedAt` or any close-state field onto member goals, and never append a separate close ledger event.
 - Change sets are cumulative-since-base: each member's `changeSet.paths` is the whole-worktree diff vs base (`cumulativeFromBase: true`), `memberGoalId` is a label not a per-path attribution, and `unionChangeSet.paths` carries no per-goal attribution.
 - Batch invalidation is fail-closed: steering mutations that would invalidate a batch are rejected while any member holds a fresh deferred receipt.

package/src/gjc-runtime/ultragoal-evidence.ts

@@ -1,5 +1,8 @@
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
 import * as path from "node:path";
 import { inflateSync } from "node:zlib";
+import { isCompiledBinary } from "@gajae-code/utils/env";
 import {
 	evidenceKindMatches,
 	hasExistingNonEmptyArtifact,
@@ -382,6 +385,25 @@ function clampCliReplayTimeout(value: unknown): number {
 function basenameCommand(value: string): string {
 	return path.basename(value).toLowerCase();
 }
+
+function isDeterministicConsoleLogReplay(code: string): boolean {
+	let remaining = code.trim();
+	if (remaining.length === 0) return false;
+	let matched = false;
+	while (remaining.length > 0) {
+		const match =
+			/^console\.log\(\s*("(?:\\[\s\S]|[^"\\])*"|'(?:\\[\s\S]|[^'\\])*'|`(?:\\[\s\S]|[^`\\$])*`)\s*\)\s*;?\s*/.exec(
+				remaining,
+			);
+		if (!match) return false;
+		const statement = match[0]!;
+		const literal = match[1]!;
+		if (literal.startsWith("`") && literal.includes("${")) return false;
+		matched = true;
+		remaining = remaining.slice(statement.length);
+	}
+	return matched;
+}
 function hasShellRedirectionToken(value: string): boolean {
 	return /^(?:[<>]|\d?[<>]|\d?>&\d|\|\|?|&&|;)$/.test(value) || /(?:^|[^\w])-?>/.test(value);
 }
@@ -413,19 +435,73 @@ export function isAllowedGitReplayCommand(args: readonly string[]): boolean {
 	return true;
 }
 
-function resolveCliReplayCommand(command: string[]): string[] {
-	if (basenameCommand(command[0]!) === "bun") return [process.execPath, ...command.slice(1)];
-	return command;
+function isBareExecutableName(value: string): boolean {
+	return (
+		value.length > 0 &&
+		!value.includes("/") &&
+		!value.includes("\\") &&
+		value === path.basename(value) &&
+		value === value.toLowerCase()
+	);
+}
+
+function isAllowedCliReplayCommand(command: readonly string[]): boolean {
+	if (
+		command.length === 0 ||
+		command.some(arg => arg.trim() !== arg || arg.length === 0 || hasShellRedirectionToken(arg))
+	)
+		return false;
+	if (!isBareExecutableName(command[0]!) || command[0] !== "bun") return false;
+	const args = command.slice(1);
+	if (args.length === 1 && args[0] === "--version") return true;
+	return args.length === 2 && args[0] === "-e" && isDeterministicConsoleLogReplay(args[1]!);
 }
 
-function resolveUnderCwd(cwd: string, replayCwd: unknown, fieldName: string): string {
+function summarizeBlockedCliReplayCommand(command: readonly string[]): string {
+	const executable = command[0] ? basenameCommand(command[0]) : "<missing>";
+	const argCount = Math.max(0, command.length - 1);
+	return `${JSON.stringify(executable)} with ${argCount} arg${argCount === 1 ? "" : "s"}`;
+}
+
+function cliReplayAllowlistDescription(): string {
+	return '`bun --version` or deterministic `bun -e "console.log(...)"`; focused bun test execution is blocked and replayExempt still requires an existing screenshot, automation, or PTY structural fallback';
+}
+
+export function resolveCliReplayCommand(command: string[], options?: { compiled?: boolean }): string[] {
+	if (options?.compiled ?? isCompiledBinary()) {
+		throw new Error(
+			"CLI replay execution is unavailable in the compiled GJC runtime because process.execPath is the GJC application, not a Bun CLI executable",
+		);
+	}
+	return [process.execPath, ...command.slice(1)];
+}
+
+async function resolveUnderCwd(cwd: string, replayCwd: unknown, fieldName: string): Promise<string> {
 	const relative = replayCwd === undefined ? "." : nonEmptyString(replayCwd);
 	if (!relative) throw new Error(`qualityGate ${fieldName}.cwd must be a non-empty string when provided`);
-	const root = path.resolve(cwd);
-	const resolved = path.resolve(root, relative);
+	const lexicalRoot = path.resolve(cwd);
+	const lexical = path.resolve(lexicalRoot, relative);
+	const relativeToLexicalRoot = path.relative(lexicalRoot, lexical);
+	if (
+		relativeToLexicalRoot === ".." ||
+		relativeToLexicalRoot.startsWith(`..${path.sep}`) ||
+		path.isAbsolute(relativeToLexicalRoot)
+	) {
+		throw new Error(`qualityGate ${fieldName}.cwd must resolve under the repository cwd`);
+	}
+	let root: string;
+	let resolved: string;
+	try {
+		[root, resolved] = await Promise.all([fs.realpath(lexicalRoot), fs.realpath(lexical)]);
+	} catch {
+		throw new Error(`qualityGate ${fieldName}.cwd must reference an existing directory under the repository cwd`);
+	}
 	const relativeToRoot = path.relative(root, resolved);
 	if (relativeToRoot === ".." || relativeToRoot.startsWith(`..${path.sep}`) || path.isAbsolute(relativeToRoot)) {
-		throw new Error(`qualityGate ${fieldName}.cwd must resolve under the repository cwd`);
+		throw new Error(`qualityGate ${fieldName}.cwd must resolve under the repository cwd without symlink escape`);
+	}
+	if (!(await fs.stat(resolved)).isDirectory()) {
+		throw new Error(`qualityGate ${fieldName}.cwd must reference a directory`);
 	}
 	return resolved;
 }
@@ -467,16 +543,40 @@ function normalizeCliReplayOutput(value: string, cwd: string): string {
 }
 
 export async function readCliReplayRecord(cwd: string, row: JsonObject, fieldName: string): Promise<JsonObject | null> {
-	// A row is an inline replay record only when it actually carries replay fields.
-	// `kind: "cli-replay"` alone is the natural kind for an artifactRef that *points*
-	// at a replay file, so treating that as inline meant the referenced `path` was
-	// never read and surfaced a confusing `schemaVersion must be 1` error on the ref.
-	const inline =
-		qualityGateObject(row.replay) ?? (row.kind === "cli-replay" && row.command !== undefined ? row : null);
-	if (inline) return inline;
+	const nestedReplay = row.replay === undefined ? null : qualityGateObject(row.replay);
+	if (row.replay !== undefined && !nestedReplay) {
+		throw new Error(`qualityGate ${fieldName}.replay must be an object when provided`);
+	}
+	const inlineFieldNames = [
+		"schemaVersion",
+		"replaySafe",
+		"command",
+		"cwd",
+		"env",
+		"timeoutMs",
+		"expectedExitCode",
+		"recordedStdout",
+		"recordedStderr",
+		"normalization",
+		"invariants",
+		"replayExempt",
+	];
+	const hasTopLevelInlineFields = inlineFieldNames.some(name => row[name] !== undefined);
+	const hasPath = row.path !== undefined;
+	if (nestedReplay && (hasPath || hasTopLevelInlineFields)) {
+		throw new Error(`qualityGate ${fieldName} must not mix nested replay, artifact path, or top-level replay fields`);
+	}
+	if (hasTopLevelInlineFields && hasPath) {
+		throw new Error(`qualityGate ${fieldName} must not mix inline replay fields with an artifact path`);
+	}
+	if (nestedReplay) return nestedReplay;
+	if (row.kind === "cli-replay" && hasTopLevelInlineFields) return row;
 	if (!evidenceKindMatches(normalizedEvidenceKind(row), ["cli-replay", "command-replay"])) return null;
+	if (!hasPath) {
+		throw new Error(`qualityGate ${fieldName} CLI replay artifact must provide either replay fields or path`);
+	}
 	const bytes = await readArtifactBytes(cwd, row, fieldName);
-	if (!bytes) return null;
+	if (!bytes) throw new Error(`qualityGate ${fieldName} CLI replay artifact path must reference a readable file`);
 	try {
 		return requireQualityGateObject(JSON.parse(bytes.toString("utf8")), `${fieldName}.replay`);
 	} catch (error) {
@@ -494,6 +594,7 @@ function parseCliReplayRecord(
 	timeoutMs: number;
 	expectedExitCode: number;
 	recordedStdout: string;
+	recordedStderr: string;
 	invariants: JsonObject[];
 } {
 	if (record.schemaVersion !== 1) throw new Error(`qualityGate ${fieldName}.schemaVersion must be 1`);
@@ -505,6 +606,11 @@ function parseCliReplayRecord(
 	if (!command) throw new Error(`qualityGate ${fieldName}.command must be a non-empty string array`);
 	if (record.replaySafe !== true)
 		throw new Error(`qualityGate ${fieldName}.replaySafe must be true before CLI replay executes`);
+	if (!isAllowedCliReplayCommand(command)) {
+		throw new Error(
+			`qualityGate ${fieldName}.command is not in the deterministic CLI replay allowlist; command ${summarizeBlockedCliReplayCommand(command)} is blocked. Allowed replay commands: ${cliReplayAllowlistDescription()}. For other commands, provide audited replayExempt metadata with reasonCode, reason, approvedBy, and fallbackArtifactRefs that point to a structurally valid fallback artifact.`,
+		);
+	}
 	if (record.normalization !== undefined && record.normalization !== "default") {
 		throw new Error(`qualityGate ${fieldName}.normalization must be default when provided`);
 	}
@@ -526,6 +632,7 @@ function parseCliReplayRecord(
 		timeoutMs: clampCliReplayTimeout(record.timeoutMs),
 		expectedExitCode,
 		recordedStdout: record.recordedStdout,
+		recordedStderr: typeof record.recordedStderr === "string" ? record.recordedStderr : "",
 		invariants,
 	};
 }
@@ -597,11 +704,24 @@ async function collectCliReplayOutput(
 
 export interface ReplayProcessHandle {
 	readonly exited: Promise<number>;
+	readonly pid?: number;
 	kill(signal?: number | NodeJS.Signals): void;
 }
 
+function signalReplayProcessTree(handle: ReplayProcessHandle, signal: NodeJS.Signals): void {
+	if (process.platform !== "win32" && Number.isInteger(handle.pid) && (handle.pid ?? 0) > 0) {
+		try {
+			process.kill(-handle.pid!, signal);
+			return;
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code === "ESRCH") return;
+		}
+	}
+	handle.kill(signal);
+}
+
 export async function waitForReplayProcessWithTimeout(
-	process: ReplayProcessHandle,
+	handle: ReplayProcessHandle,
 	timeoutMs: number,
 	graceMs = 2000,
 ): Promise<number> {
@@ -611,21 +731,21 @@ export async function waitForReplayProcessWithTimeout(
 	const timeout = new Promise<typeof timedOut>(resolve => {
 		timeoutTimer = setTimeout(() => resolve(timedOut), timeoutMs);
 	});
-	const first = await Promise.race([process.exited, timeout]);
+	const first = await Promise.race([handle.exited, timeout]);
 	if (first !== timedOut) {
 		if (timeoutTimer) clearTimeout(timeoutTimer);
 		return first;
 	}
-	process.kill("SIGTERM");
+	signalReplayProcessTree(handle, "SIGTERM");
 	const killed = Symbol("killed");
 	const grace = new Promise<typeof killed>(resolve => {
 		graceTimer = setTimeout(() => {
-			process.kill("SIGKILL");
+			signalReplayProcessTree(handle, "SIGKILL");
 			resolve(killed);
 		}, graceMs);
 	});
-	await Promise.race([process.exited, grace]);
-	await process.exited.catch(() => undefined);
+	await Promise.race([handle.exited, grace]);
+	await handle.exited.catch(() => undefined);
 	if (timeoutTimer) clearTimeout(timeoutTimer);
 	if (graceTimer) clearTimeout(graceTimer);
 	throw new Error("timeout");
@@ -684,18 +804,20 @@ export async function validateCliReplay(
 	}
 	void options.live;
 	const replay = parseCliReplayRecord(record, fieldName);
-	const replayCwd = resolveUnderCwd(cwd, replay.replayCwd, fieldName);
-	const process = Bun.spawn(resolveCliReplayCommand(replay.command), {
-		cwd: replayCwd,
-		env: replay.env,
-		stdout: "pipe",
-		stderr: "pipe",
-	});
+	await resolveUnderCwd(cwd, replay.replayCwd, fieldName);
+	const executionCwd = await fs.mkdtemp(path.join(os.tmpdir(), "gjc-cli-replay-"));
 	try {
+		const subprocess = Bun.spawn(resolveCliReplayCommand(replay.command), {
+			cwd: executionCwd,
+			env: { ...replay.env, HOME: executionCwd, TMPDIR: executionCwd },
+			stdout: "pipe",
+			stderr: "pipe",
+			detached: process.platform !== "win32",
+		});
 		const [stdout, stderr, exitCode] = await Promise.all([
-			collectCliReplayOutput(process.stdout),
-			collectCliReplayOutput(process.stderr),
-			waitForReplayProcessWithTimeout(process, replay.timeoutMs),
+			collectCliReplayOutput(subprocess.stdout),
+			collectCliReplayOutput(subprocess.stderr),
+			waitForReplayProcessWithTimeout(subprocess, replay.timeoutMs),
 		]);
 		if (stdout.truncated || stderr.truncated)
 			throw new Error(`qualityGate ${fieldName} CLI replay output exceeded 1 MiB buffer cap`);
@@ -706,6 +828,11 @@ export async function validateCliReplay(
 		}
 		const actualStdout = normalizeCliReplayOutput(stdout.text, cwd);
 		const recordedStdout = normalizeCliReplayOutput(replay.recordedStdout, cwd);
+		const actualStderr = normalizeCliReplayOutput(stderr.text, cwd);
+		const recordedStderr = normalizeCliReplayOutput(replay.recordedStderr, cwd);
+		if (actualStderr !== recordedStderr) {
+			throw new Error(`qualityGate ${fieldName} CLI replay stderr did not match recordedStderr after normalization`);
+		}
 		if (!replay.invariants.length || !validateCliReplayInvariants(replay.invariants, actualStdout, fieldName)) {
 			if (actualStdout !== recordedStdout) {
 				throw new Error(
@@ -719,6 +846,8 @@ export async function validateCliReplay(
 			throw new Error(`qualityGate ${fieldName} CLI replay timed out after ${replay.timeoutMs}ms`);
 		}
 		throw error;
+	} finally {
+		await fs.rm(executionCwd, { recursive: true, force: true }).catch(() => undefined);
 	}
 }