@gajae-code/coding-agent 0.14.2 → 0.15.0

package/src/defaults/gjc/skills/ultragoal/SKILL.md

@@ -50,6 +50,7 @@ gjc ultragoal create-goals --brief "<brief>"
 gjc ultragoal create-goals --brief-file <path>
 gjc ultragoal complete-goals
 gjc ultragoal complete-goals --retry-failed
+gjc ultragoal quality-gate source-hash --json
 gjc ultragoal quality-gate validate --quality-gate-json <quality-gate-json-or-path> [--goal-id <id>] [--json]
 gjc ultragoal checkpoint --goal-id <id> --status complete --evidence "<evidence>" --quality-gate-json <quality-gate-json-or-path>
 gjc ultragoal checkpoint --goal-id <id> --status failed --evidence "<blocker/evidence>"
@@ -230,17 +231,17 @@ The Ultragoal leader owns `.gjc/_session-{sessionid}/ultragoal/goals.json` and `
 
 ### Native executor parallelism contract
 
-Native subagent parallelism is a contract for bounded `executor` delegation, not a runtime scheduler and not a Team-mode rule:
+Native subagent parallelism is a contract for bounded `executor` delegation, not a runtime scheduler:
 
 - **Use native `executor` parallelism only** when a story's expected diffs fall in genuinely different sub-domains/modules/systems, each boundable by a per-slice coordination contract.
 - **Default to direct leader edits** otherwise; sequence any work with real dependencies, shared-file overlap, or a single-domain footprint, and never parallelize work that lacks a safe contract.
 - Worker agents **MUST NOT mutate `.gjc/_session-{sessionid}/ultragoal`**, call goal tools, make checkpoint decisions, own integration, or own final verification. The Ultragoal leader keeps those responsibilities.
+- Workers must not run `gjc ultragoal checkpoint`: checkpoint authority stays with the leader after worker tasks are terminal. The leader checkpoints from worker evidence plus the current-session GJC goal snapshot, and performs no hidden goal mutation.
 
 Before workers start, each per-slice coordination contract MUST name the target files/surfaces, independence assumptions, allowed coordination channel, conflict-escalation rule, expected evidence, and terminal status. Conflict or assignment changes remain leader-owned and must be auditable through durable ledger evidence.
 
 For failed, timed-out, or contract-violating slices, record durable ledger evidence; preserve successful terminal slices only when safe; and reassign, retry, or collapse the invalid work to serial execution under an updated contract. Completion after parallel work still requires terminal worker evidence, leader integration, targeted verification, and the existing cleaner + architect + executor QA/red-team gate before checkpoint complete.
 
-Team remains explicit and separate: Team is not auto-launched, not a hidden pipeline scheduler, and never owns Ultragoal goals, checkpoints, or ledger state.
 
 ## Boundary verification (aggregate default)
 
@@ -282,18 +283,6 @@ Checkpoint contract summary — the full contract lives in the `validation-batch
 
 Cohort lanes are parallel by construction: the boundary gate freezes one `sourceHash` first, so `cleaner`, `architect`, and `qa` can run concurrently against the identical immutable snapshot and then join. Fall back to **sequential** lanes only when code is still changing (nothing can be frozen yet), when the red-team lane depends on architect fixes, or when architect findings gate the QA scope. Either way the lanes must **join before checkpoint** — no lane checkpoints independently, and repair work starts only after the join.
 
-## Use Ultragoal and Team together
-
-Use ultragoal and team together for a durable Ultragoal story that benefits from one visible tmux worker session. Ultragoal remains leader-owned: `.gjc/_session-{sessionid}/ultragoal/goals.json` stores the story plan and `.gjc/_session-{sessionid}/ultragoal/ledger.jsonl` stores checkpoints. Team is the single-worker tmux execution engine and returns task/evidence status to the leader.
-
-The leader checkpoints Ultragoal from Team evidence plus the current-session GJC goal snapshot; durable state remains leader-owned in `goals.json` and `ledger.jsonl`:
-
-```sh
-gjc ultragoal checkpoint --goal-id <id> --status complete --evidence "<team evidence mentioning .gjc/_session-{sessionid}/ultragoal and <id>>" --quality-gate-json <quality-gate-json-or-path>
-```
-
-Workers do not own ultragoal goal state, do not create worker ultragoal ledgers, and do not checkpoint Ultragoal. Workers must not run `gjc ultragoal checkpoint`; checkpoint authority stays with the leader after worker tasks are terminal. Team launch remains explicit; Ultragoal does not auto-launch Team and performs no hidden goal mutation.
-
 ## Internal Ultragoal sub-skill fragments
 
 The completion-gate cleanup sweep is driven by `ai-slop-cleaner`, an internal Ultragoal sub-skill bundled as a `kind: "skill-fragment"` prompt with parent skill `ultragoal` (installed at `skill-fragments/ultragoal/ai-slop-cleaner.md`). It is analogous to deep-interview's auto-research fragment: loaded on demand for one specific hook, never a user-facing skill.
@@ -302,7 +291,7 @@ The completion-gate cleanup sweep is driven by `ai-slop-cleaner`, an internal Ul
 - It is a read-only detector+reporter over the active story's changed files only: it never edits code, writes files, mutates `.gjc/`, checkpoints, calls goal tools, or spawns workflows.
 - It classifies every finding as blocking or advisory across the full taxonomy (fallback-like masking vs. grounded, duplication, dead code, needless abstraction, boundary violations, UI/design slop, missing tests).
 - The leader and a leader-spawned `executor` own all fixes; the cleaner reruns until zero blocking findings remain. Advisory findings live in the gate report only.
-- Recursion guard: it must not spawn nested `ralplan`/`team`/`deep-interview`/`ultragoal`; broad or architectural findings are handed back to the leader as review blockers.
+- Recursion guard: it must not spawn nested `ralplan`/`deep-interview`/`ultragoal`; broad or architectural findings are handed back to the leader as review blockers.
 
 ## Boundary completion cohort gate
 
@@ -311,7 +300,7 @@ The heavyweight gate runs **once per boundary generation**, not once per story a
 One generation freezes the change set and reviews it exactly once:
 
 1. Run implementation verification for the boundary's cumulative change set.
-2. **Freeze the change set.** Compute one immutable `sourceHash` over the reviewed source. Every lane in this generation inspects that same frozen snapshot; a lane verdict carrying a different `sourceHash` is rejected.
+2. **Freeze the change set.** Run `gjc ultragoal quality-gate source-hash --json` on the clean reviewed snapshot and use its `sourceHash` exactly. The runtime binds this digest to the integration base, merge base, normalized changed paths, captured diff, and untracked-content digest. Every lane in this generation inspects that same frozen snapshot; a lane verdict carrying a different `sourceHash` is rejected. Any later source or base change requires rerunning this command and starting a new generation.
 3. **Run the cohort lanes on the frozen snapshot** — at most one `cleaner`, one `architect`, and one `qa` lane per generation. They may run in parallel because they share the frozen source; a second architect or QA lane in the same generation is rejected. The `cleaner` lane is the internal ai-slop-cleaner skill fragment run over the frozen change set: a read-only detector that emits an `AI SLOP CLEANUP REPORT`, and it still runs and records a passed/no-op report when there are no relevant edits. Its BLOCKING findings join the cohort findings rather than starting their own fix loop; advisory findings are included in the gate report only and are not written to the Ultragoal ledger.
 4. Delegate an `architect` review covering all three lanes:
    - architecture-side: system boundaries, layering, data/control flow, operational risks.
@@ -429,7 +418,7 @@ The critic must verify that the `human_blocked` classification is genuine, inclu
 
 ### Invocation and containment
 
-At each terminus, the leader gives the read-only `critic` role agent `brief.md`, `goals.json`, `ledger.jsonl`, and the cumulative change set. For completion, invoke it before assembling the final-aggregate gate JSON. For pause, invoke it after the `human_blocked` classification and before `goal({"op":"pause"})`. The terminal critic must not spawn nested `ralplan`, `team`, `deep-interview`, or `ultragoal` workflows. This creates no interactive surface: `ask` remains blocked while an Ultragoal run is active.
+At each terminus, the leader gives the read-only `critic` role agent `brief.md`, `goals.json`, `ledger.jsonl`, and the cumulative change set. For completion, invoke it before assembling the final-aggregate gate JSON. For pause, invoke it after the `human_blocked` classification and before `goal({"op":"pause"})`. The terminal critic must not spawn nested `ralplan`, `deep-interview`, or `ultragoal` workflows. This creates no interactive surface: `ask` remains blocked while an Ultragoal run is active.
 
 On repeat terminus attempts within the same run (after an `ITERATE`/`REJECT` reopen cycle or a superseded pause classification), **resume the prior terminal-critic subagent when resumable** instead of freshly spawning one: the critic already holds `brief.md`, `goals.json`, the ledger history, and its own prior findings, so re-invocation only needs the delta (new ledger events, the updated cumulative change set, and evidence addressing the prior blockers). Resume via existing `subagent` resume/steer controls; on `context_unavailable`, `not_found`, `no_runner`, or `resume_failed` — or after a process restart — fall back to a fresh `critic` spawn with the full context bundle. A resumed terminal critic remains read-only, keeps the same containment rules, and must issue a fresh verdict against the current state — a prior `ITERATE` is never carried forward as pre-judged, and each verdict is still recorded through `gjc ultragoal record-critic-verdict`.
 

package/src/defaults/gjc/skills/ultragoal/ai-slop-cleaner.md

@@ -9,7 +9,7 @@ You are a **read-only detector and reporter**. You never edit code, write files,
 - Inspect ONLY the active Ultragoal story's changed-files list. No broad rewrites, no inspection outside that scope, no new dependencies.
 - Allow only narrow supporting reads needed to understand the contracts of changed files; if you need broader context, report that need to the leader instead of expanding scope.
 - If there are no relevant edits, emit a passed/no-op report (`Gate Result: PASS`, `Changed Files Reviewed` listing the files as "no relevant edits").
-- Recursion guard: you are already inside an Ultragoal workflow. Do NOT spawn nested `ralplan`, `team`, `deep-interview`, or `ultragoal` workflows. Broad, ambiguous, cross-layer, or architectural findings are handed to the leader as review blockers, not resolved here.
+- Recursion guard: you are already inside an Ultragoal workflow. Do NOT spawn nested `ralplan`, `autoresearch`, `deep-interview`, or `ultragoal` workflows. Broad, ambiguous, cross-layer, or architectural findings are handed to the leader as review blockers, not resolved here.
 
 ## Taxonomy
 
@@ -46,7 +46,7 @@ Advisory Findings: [none, or numbered findings with file, category, evidence, wh
 Fallback Findings: [none, or finding -> masking fallback slop / grounded compatibility/fail-safe fallback -> blocking/advisory]
 UI/Design Findings: [none/N/A, or signal -> blocking/advisory -> rationale]
 Missing Test Findings: [none, or gap -> blocking/advisory -> required coverage]
-Recursion Guard: [confirmed no nested ralplan/team/deep-interview/ultragoal spawned; broad findings handed to leader]
+Recursion Guard: [confirmed no nested ralplan/autoresearch/deep-interview/ultragoal spawned; broad findings handed to leader]
 Changed Files Reviewed:
 - [path] - [reviewed / no relevant edits]
 

package/src/defaults/gjc-defaults.ts

@@ -1,9 +1,10 @@
 import { readFileSync } from "node:fs";
+import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { getAgentDir, isEnoent } from "@gajae-code/utils";
 import { BUNDLED_GJC_SKILL_CATALOG, type BundledGjcSkillCatalogEntry } from "./gjc-skills.generated";
 
-export const DEFAULT_GJC_DEFINITION_NAMES = ["deep-interview", "ralplan", "team", "ultragoal"] as const;
+export const DEFAULT_GJC_DEFINITION_NAMES = ["autoresearch", "deep-interview", "ralplan", "ultragoal"] as const;
 export type DefaultGjcDefinitionName = (typeof DEFAULT_GJC_DEFINITION_NAMES)[number];
 export type DefaultGjcDefinitionKind = "skill" | "skill-fragment";
 export type EmbeddedDefaultGjcSkill = {
@@ -64,6 +65,32 @@ export type DefaultGjcDefinitionInstallFile =
 			status: DefaultGjcInstallStatus;
 	  };
 
+/**
+ * Bundled workflow definitions that GJC used to ship and no longer does.
+ *
+ * Installing defaults only ever wrote the CURRENT set, so a definition dropped
+ * from the bundle stayed on disk under the agent dir forever — where
+ * filesystem skill discovery still found it and `/skill:<name>` still resolved.
+ * `team` was the first removal, so it was the first to expose that gap.
+ *
+ * Retirement QUARANTINES rather than deletes: the directory is moved aside to
+ * `<targetRoot>/retired/<name>.<timestamp>/`. A user who customized the skill
+ * keeps their content, and nothing is destroyed to satisfy a rename.
+ */
+export const RETIRED_GJC_DEFINITION_NAMES = ["team"] as const;
+export type RetiredGjcDefinitionName = (typeof RETIRED_GJC_DEFINITION_NAMES)[number];
+
+export type RetiredGjcDefinitionStatus = "absent" | "quarantined";
+
+export interface RetiredGjcDefinitionFile {
+	name: RetiredGjcDefinitionName;
+	/** Directory that held the retired definition. */
+	path: string;
+	/** Where it was moved, when quarantined. */
+	quarantinedTo?: string;
+	status: RetiredGjcDefinitionStatus;
+}
+
 export interface DefaultGjcDefinitionInstallResult {
 	targetRoot: string;
 	total: number;
@@ -73,6 +100,8 @@ export interface DefaultGjcDefinitionInstallResult {
 	missing: number;
 	different: number;
 	files: DefaultGjcDefinitionInstallFile[];
+	/** Retired bundled definitions found under `targetRoot`, and what happened to them. */
+	retired: RetiredGjcDefinitionFile[];
 }
 function sourcePathForBundledEntry(entry: BundledGjcSkillCatalogEntry): string {
 	const relative = entry.kind === "skill" ? entry.relativePath : entry.relativePath.replace(/^skill-fragments\//, "");
@@ -236,7 +265,63 @@ export async function installDefaultGjcDefinitions(
 		}
 	}
 
-	return summarizeInstallResult(targetRoot, files);
+	const retired = await retireRemovedGjcDefinitions(targetRoot, { check: options.check === true });
+	return summarizeInstallResult(targetRoot, files, retired);
+}
+
+/**
+ * Quarantine any retired bundled definition still present under `targetRoot`.
+ *
+ * `check` reports what WOULD move without touching the filesystem, so
+ * `--check` callers stay read-only.
+ */
+export async function retireRemovedGjcDefinitions(
+	targetRoot: string,
+	options: { check?: boolean } = {},
+): Promise<RetiredGjcDefinitionFile[]> {
+	const results: RetiredGjcDefinitionFile[] = [];
+	for (const name of RETIRED_GJC_DEFINITION_NAMES) {
+		const directory = path.join(targetRoot, "skills", name);
+		if (!(await directoryExists(directory))) {
+			results.push({ name, path: directory, status: "absent" });
+			continue;
+		}
+		if (options.check) {
+			results.push({ name, path: directory, status: "quarantined" });
+			continue;
+		}
+		const quarantinedTo = await reserveQuarantinePath(path.join(targetRoot, "retired"), name);
+		await fs.rename(directory, quarantinedTo);
+		results.push({ name, path: directory, quarantinedTo, status: "quarantined" });
+	}
+	return results;
+}
+
+/**
+ * Reserve a unique quarantine directory.
+ *
+ * A timestamp alone is not enough: two retirements inside the same millisecond
+ * resolve to the same path, which would silently overwrite the earlier
+ * quarantine. Disambiguate with a counter until an unused path is found.
+ */
+async function reserveQuarantinePath(retiredRoot: string, name: string): Promise<string> {
+	const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+	await fs.mkdir(retiredRoot, { recursive: true });
+	const base = path.join(retiredRoot, `${name}.${stamp}`);
+	if (!(await directoryExists(base))) return base;
+	for (let attempt = 2; ; attempt += 1) {
+		const candidate = `${base}-${attempt}`;
+		if (!(await directoryExists(candidate))) return candidate;
+	}
+}
+
+async function directoryExists(candidate: string): Promise<boolean> {
+	try {
+		return (await fs.stat(candidate)).isDirectory();
+	} catch (error) {
+		if (isEnoent(error)) return false;
+		throw error;
+	}
 }
 
 async function readExistingText(filePath: string): Promise<string | undefined> {
@@ -251,6 +336,7 @@ async function readExistingText(filePath: string): Promise<string | undefined> {
 function summarizeInstallResult(
 	targetRoot: string,
 	files: DefaultGjcDefinitionInstallFile[],
+	retired: RetiredGjcDefinitionFile[],
 ): DefaultGjcDefinitionInstallResult {
 	return {
 		targetRoot,
@@ -261,6 +347,7 @@ function summarizeInstallResult(
 		missing: countStatus(files, "missing"),
 		different: countStatus(files, "different"),
 		files,
+		retired,
 	};
 }
 

package/src/defaults/gjc-skills.generated.ts

@@ -4,7 +4,7 @@
  * Keep this module metadata-only: skill bodies are loaded through literal
  * dynamic imports only when a caller asks for their content.
  */
-export type BundledGjcSkillName = "deep-interview" | "ralplan" | "team" | "ultragoal";
+export type BundledGjcSkillName = "autoresearch" | "deep-interview" | "ralplan" | "ultragoal";
 
 export interface BundledGjcSkillCatalogEntry {
 	readonly kind: "skill" | "skill-fragment";
@@ -19,17 +19,14 @@ const deepInterview = () =>
 	import("./gjc/skills/deep-interview/SKILL.md", { with: { type: "text" } }).then(module => module.default);
 const ralplan = () =>
 	import("./gjc/skills/ralplan/SKILL.md", { with: { type: "text" } }).then(module => module.default);
-const team = () => import("./gjc/skills/team/SKILL.md", { with: { type: "text" } }).then(module => module.default);
+const autoresearch = () =>
+	import("./gjc/skills/autoresearch/SKILL.md", { with: { type: "text" } }).then(module => module.default);
 const ultragoal = () =>
 	import("./gjc/skills/ultragoal/SKILL.md", { with: { type: "text" } }).then(module => module.default);
 const autoAnswerUncertain = () =>
 	import("./gjc/skills/deep-interview/auto-answer-uncertain.md", { with: { type: "text" } }).then(
 		module => module.default,
 	);
-const autoResearchGreenfield = () =>
-	import("./gjc/skills/deep-interview/auto-research-greenfield.md", { with: { type: "text" } }).then(
-		module => module.default,
-	);
 const lateralReviewPanel = () =>
 	import("./gjc/skills/deep-interview/lateral-review-panel.md", { with: { type: "text" } }).then(
 		module => module.default,
@@ -40,6 +37,10 @@ const validationBatchContracts = () =>
 	import("./gjc/skills/ultragoal/validation-batch-contracts.md", { with: { type: "text" } }).then(
 		module => module.default,
 	);
+const autoresearchIterate = () =>
+	import("./gjc/skills/autoresearch/auto-iterate.md", { with: { type: "text" } }).then(module => module.default);
+const autoresearchCritic = () =>
+	import("./gjc/skills/autoresearch/auto-critic.md", { with: { type: "text" } }).then(module => module.default);
 
 export const BUNDLED_GJC_SKILL_CATALOG: readonly BundledGjcSkillCatalogEntry[] = [
 	{
@@ -53,15 +54,15 @@ export const BUNDLED_GJC_SKILL_CATALOG: readonly BundledGjcSkillCatalogEntry[] =
 		kind: "skill",
 		name: "ralplan",
 		relativePath: "skills/ralplan/SKILL.md",
-		description: "Consensus planning entrypoint that auto-gates vague team/ultragoal requests before execution",
+		description: "Consensus planning entrypoint that auto-gates vague ultragoal requests before execution",
 		loadContent: ralplan,
 	},
 	{
 		kind: "skill",
-		name: "team",
-		relativePath: "skills/team/SKILL.md",
-		description: "Multi-worker GJC tmux team orchestration",
-		loadContent: team,
+		name: "autoresearch",
+		relativePath: "skills/autoresearch/SKILL.md",
+		description: "Goal-directed research missions interleaving web and data evidence into a structured verdict",
+		loadContent: autoresearch,
 	},
 	{
 		kind: "skill",
@@ -70,12 +71,6 @@ export const BUNDLED_GJC_SKILL_CATALOG: readonly BundledGjcSkillCatalogEntry[] =
 		description: "Create and execute durable repo-native multi-goal plans over GJC goal mode artifacts.",
 		loadContent: ultragoal,
 	},
-	{
-		kind: "skill-fragment",
-		parentSkillName: "deep-interview",
-		relativePath: "skill-fragments/deep-interview/auto-research-greenfield.md",
-		loadContent: autoResearchGreenfield,
-	},
 	{
 		kind: "skill-fragment",
 		parentSkillName: "deep-interview",
@@ -100,4 +95,16 @@ export const BUNDLED_GJC_SKILL_CATALOG: readonly BundledGjcSkillCatalogEntry[] =
 		relativePath: "skill-fragments/ultragoal/validation-batch-contracts.md",
 		loadContent: validationBatchContracts,
 	},
+	{
+		kind: "skill-fragment",
+		parentSkillName: "autoresearch",
+		relativePath: "skill-fragments/autoresearch/auto-iterate.md",
+		loadContent: autoresearchIterate,
+	},
+	{
+		kind: "skill-fragment",
+		parentSkillName: "autoresearch",
+		relativePath: "skill-fragments/autoresearch/auto-critic.md",
+		loadContent: autoresearchCritic,
+	},
 ];

package/src/discovery/builtin.ts

@@ -4,7 +4,7 @@
  * Primary provider for GJC native configs. Supports all capabilities.
  */
 import * as path from "node:path";
-import { logger, parseFrontmatter, tryParseJson } from "@gajae-code/utils";
+import { getAgentDir, logger, parseFrontmatter, tryParseJson } from "@gajae-code/utils";
 import { YAML } from "bun";
 import { registerProvider } from "../capability";
 import { type ContextFile, contextFileCapability } from "../capability/context-file";
@@ -45,6 +45,20 @@ function getUserAgentDirs(): string[] {
 	return [PATHS.userAgent];
 }
 
+/**
+ * GJC's user-scope config directory.
+ *
+ * Home-relative `<home>/.gjc/agent` is only its default location: an agent
+ * directory profile (`--agent-dir`, `GJC_CODING_AGENT_DIR`, `setAgentDir()`)
+ * moves the whole user scope, and the writers (`getMCPConfigPath("user")` and
+ * everything `gjc mcp add` reaches) already follow it. Resolving from the home
+ * default instead would hide a profile's own registrations and load the default
+ * profile's servers into it.
+ */
+function resolveUserAgentDir(ctx: LoadContext): string {
+	return ctx.userAgentDir ?? getAgentDir();
+}
+
 function getProjectConfigDirs(): string[] {
 	return [PATHS.projectDir];
 }
@@ -226,15 +240,14 @@ async function loadMCPServers(ctx: LoadContext): Promise<LoadResult<MCPServer>>
 		return result;
 	};
 
+	const userAgentDir = resolveUserAgentDir(ctx);
 	const paths = [
 		...getProjectConfigDirs().flatMap(projectConfigDir => [
 			{ path: path.join(ctx.cwd, projectConfigDir, "mcp.json"), level: "project" as const },
 			{ path: path.join(ctx.cwd, projectConfigDir, ".mcp.json"), level: "project" as const },
 		]),
-		...getUserAgentDirs().flatMap(userAgentDir => [
-			{ path: path.join(ctx.home, userAgentDir, "mcp.json"), level: "user" as const },
-			{ path: path.join(ctx.home, userAgentDir, ".mcp.json"), level: "user" as const },
-		]),
+		{ path: path.join(userAgentDir, "mcp.json"), level: "user" as const },
+		{ path: path.join(userAgentDir, ".mcp.json"), level: "user" as const },
 	];
 
 	const contents = await Promise.allSettled(

package/src/discovery/helpers.ts

@@ -1,5 +1,4 @@
 import * as fs from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
 import type { ThinkingLevel } from "@gajae-code/agent-core";
 import type { FileType as FileTypeEnum, glob as globFn } from "@gajae-code/natives";
@@ -8,6 +7,7 @@ import {
 	getConfigDirName,
 	getPluginsDir,
 	getProjectDir,
+	getTrustedHomeDir,
 	logger,
 	parseFrontmatter,
 	tryParseJson,
@@ -795,8 +795,8 @@ export function parseClaudePluginsRegistry(content: string): ClaudePluginsRegist
  */
 export async function resolveActiveProjectRegistryPath(cwd: string): Promise<string | null> {
 	// Pass 1: walk up looking for an existing .gjc/ directory (nearest wins).
-	// Stop before os.homedir() — ~/.gjc/ is the user-level config dir, not a project root.
-	const homeDir = os.homedir();
+	// Stop before the provenance-checked home — ~/.gjc/ is the user-level config dir, not a project root.
+	const homeDir = getTrustedHomeDir();
 	let dir = path.resolve(cwd);
 	while (dir !== homeDir) {
 		try {
@@ -837,7 +837,7 @@ export async function resolveActiveProjectRegistryPath(cwd: string): Promise<str
  * bootstrapped directory (no .gjc/ or .git/ yet) works: writeInstalledPluginsRegistry auto-creates
  * the directory tree on first write.
  *
- * Returns undefined when cwd is os.homedir() — that path is already the user registry and must
+ * Returns undefined when cwd is the trusted home — that path is already the user registry and must
  * never alias as the project registry.
  */
 export async function resolveOrDefaultProjectRegistryPath(cwd: string): Promise<string | undefined> {
@@ -846,7 +846,7 @@ export async function resolveOrDefaultProjectRegistryPath(cwd: string): Promise<
 	// Home directory must not be treated as a project root: the fallback path would alias
 	// getInstalledPluginsRegistryPath(), causing MarketplaceManager to load the same file
 	// as both user and project registry and producing duplicates / disambiguation errors.
-	if (path.resolve(cwd) === os.homedir()) return undefined;
+	if (path.resolve(cwd) === getTrustedHomeDir()) return undefined;
 	return path.join(cwd, getConfigDirName(), "plugins", "installed_plugins.json");
 }
 
@@ -873,7 +873,7 @@ export async function listClaudePluginRoots(
 	const projectRoots: ClaudePluginRoot[] = [];
 
 	// ── GJC installed plugins registry ───────────────────────────────────────
-	// In production `home` is `os.homedir()`, so `getPluginsDir(home)` resolves to the
+	// In production `home` is the provenance-checked home, so `getPluginsDir(home)` resolves to the
 	// same XDG-aware path the marketplace writer uses (reads and writes always agree).
 	// Tests pass a temp dir, which short-circuits the resolver for deterministic isolation.
 	const gjcRegistryPath = path.join(getPluginsDir(home), "installed_plugins.json");

package/src/edit/index.ts

@@ -337,7 +337,10 @@ export class EditTool implements AgentTool<TInput> {
 	readonly #vimTool: VimTool;
 	readonly #pendingDeferredFetches = new Map<string, AbortController>();
 
-	constructor(private readonly session: ToolSession) {
+	constructor(
+		private readonly session: ToolSession,
+		private readonly modeOverride?: EditMode,
+	) {
 		const { PI_EDIT_FUZZY: editFuzzy = "auto", PI_EDIT_FUZZY_THRESHOLD: editFuzzyThreshold = "auto" } = Bun.env;
 
 		// Fail fast on an invalid forced env variant; the shared resolver owns
@@ -350,7 +353,7 @@ export class EditTool implements AgentTool<TInput> {
 	}
 
 	get mode(): EditMode {
-		return resolveEditMode(this.session);
+		return this.modeOverride ?? resolveEditMode(this.session);
 	}
 
 	get description(): string {

package/src/eval/py/executor.ts

@@ -35,6 +35,8 @@ export interface PythonExecutorOptions {
 	kernelOwnerId?: string;
 	/** Kernel mode (session reuse vs per-call) */
 	kernelMode?: PythonKernelMode;
+	/** Called when a retained session kernel is acquired or replaced. */
+	onKernelStart?: (kernelInstanceId: string) => void;
 	/** Restart the kernel before executing */
 	reset?: boolean;
 	/** Session file path for accessing task outputs */
@@ -107,6 +109,7 @@ export interface PythonResult {
 interface PythonSession {
 	sessionId: string;
 	kernel: PythonKernel;
+	kernelInstanceId: string;
 	bridgeCapability?: string;
 	ownerIds: Set<string>;
 	hasFallbackOwner: boolean;
@@ -365,6 +368,7 @@ async function acquireSession(sessionId: string, cwd: string, options: PythonExe
 			const session: PythonSession = {
 				sessionId,
 				kernel,
+				kernelInstanceId: crypto.randomUUID(),
 				bridgeCapability: options.bridge?.capability,
 				ownerIds: new Set(),
 				hasFallbackOwner: false,
@@ -447,6 +451,7 @@ async function replaceSessionKernel(
 			throw new PythonExecutionCancelledError(false);
 		}
 		session.kernel = next;
+		session.kernelInstanceId = crypto.randomUUID();
 		session.bridgeCapability = nextCapability;
 	} catch (err) {
 		await next?.shutdown().catch(() => undefined);
@@ -716,6 +721,7 @@ async function executeOnSession(code: string, cwd: string, options: PythonExecut
 	if (options.bridge && session.bridgeCapability) {
 		options.bridge.capability = session.bridgeCapability;
 	}
+	options.onKernelStart?.(session.kernelInstanceId);
 	return await runQueued(session, options, async () => {
 		if (options.signal?.aborted) {
 			throw new PythonExecutionCancelledError(isTimedOutCancellation(options.signal.reason, options.signal));
@@ -728,6 +734,7 @@ async function executeOnSession(code: string, cwd: string, options: PythonExecut
 			if (sessions.get(session.sessionId) !== session) {
 				throw new PythonExecutionCancelledError(false);
 			}
+			options.onKernelStart?.(session.kernelInstanceId);
 		}
 		try {
 			return await executeWithKernel(session.kernel, code, options);
@@ -742,6 +749,7 @@ async function executeOnSession(code: string, cwd: string, options: PythonExecut
 			if (sessions.get(session.sessionId) !== session) {
 				throw new PythonExecutionCancelledError(false);
 			}
+			options.onKernelStart?.(session.kernelInstanceId);
 			return await executeWithKernel(session.kernel, code, options);
 		}
 	});