@gajae-code/coding-agent 0.15.2 → 0.15.4

package/src/runtime-mcp/oauth-flow.ts

@@ -192,9 +192,11 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 	}
 
 	async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
+		this.ctrl.signal?.throwIfAborted();
 		if (!this.#resolvedClientId) {
-			await this.#tryRegisterClient(redirectUri);
+			await this.#tryRegisterClient(redirectUri, this.ctrl.signal);
 		}
+		this.ctrl.signal?.throwIfAborted();
 
 		const authUrl = new URL(this.config.authorizationUrl);
 		const params = authUrl.searchParams;
@@ -226,13 +228,14 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 		this.#codeVerifier = codeVerifier;
 
 		if (!params.get("client_id")) {
-			await this.#assertClientIdNotRequired(authUrl.toString());
+			await this.#assertClientIdNotRequired(authUrl.toString(), this.ctrl.signal);
 		}
 
 		return { url: authUrl.toString() };
 	}
 
 	async exchangeToken(code: string, _state: string, redirectUri: string): Promise<OAuthCredentials> {
+		this.ctrl.signal?.throwIfAborted();
 		const params = new URLSearchParams({
 			grant_type: "authorization_code",
 			code,
@@ -264,7 +267,9 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 				"Content-Type": "application/x-www-form-urlencoded",
 			},
 			body: params.toString(),
+			signal: this.ctrl.signal,
 		});
+		this.ctrl.signal?.throwIfAborted();
 
 		if (!response.ok) {
 			const errorText = await response.text();
@@ -330,8 +335,8 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 	/**
 	 * Try OAuth dynamic client registration when provider requires a client_id.
 	 */
-	async #tryRegisterClient(redirectUri: string): Promise<void> {
-		const registrationEndpoint = await this.#resolveRegistrationEndpoint();
+	async #tryRegisterClient(redirectUri: string, signal?: AbortSignal): Promise<void> {
+		const registrationEndpoint = await this.#resolveRegistrationEndpoint(signal);
 		if (!registrationEndpoint) return;
 
 		try {
@@ -349,6 +354,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 					token_endpoint_auth_method: "none",
 					application_type: "native",
 				}),
+				signal,
 			});
 
 			if (!response.ok) return;
@@ -364,18 +370,20 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 			if (data.client_secret && data.client_secret.trim() !== "") {
 				this.#registeredClientSecret = data.client_secret;
 			}
-		} catch {
+		} catch (error) {
+			if (signal?.aborted) throw error;
 			// Ignore registration failures and continue without client registration.
 		}
 	}
 
-	async #resolveRegistrationEndpoint(): Promise<string | null> {
+	async #resolveRegistrationEndpoint(signal?: AbortSignal): Promise<string | null> {
 		try {
 			const authorizationEndpoint = new URL(this.config.authorizationUrl);
 			const metadataUrl = new URL("/.well-known/oauth-authorization-server", authorizationEndpoint.origin);
 			const response = await fetch(metadataUrl.toString(), {
 				method: "GET",
 				headers: { Accept: "application/json" },
+				signal,
 			});
 
 			if (!response.ok) return null;
@@ -383,19 +391,21 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 			if (metadata.registration_endpoint && metadata.registration_endpoint.trim() !== "") {
 				return metadata.registration_endpoint;
 			}
-		} catch {
+		} catch (error) {
+			if (signal?.aborted) throw error;
 			// Ignore metadata discovery failures.
 		}
 
 		return null;
 	}
 
-	async #assertClientIdNotRequired(authorizationUrl: string): Promise<void> {
+	async #assertClientIdNotRequired(authorizationUrl: string, signal?: AbortSignal): Promise<void> {
 		try {
 			const response = await fetch(authorizationUrl, {
 				method: "GET",
 				redirect: "manual",
 				headers: { Accept: "text/plain,text/html,application/json" },
+				signal,
 			});
 			if (response.status < 400) return;
 			const body = await response.text();
@@ -403,6 +413,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 				throw new Error("OAuth provider requires client_id");
 			}
 		} catch (error) {
+			if (signal?.aborted) throw error;
 			if (error instanceof Error && /client[_-]?id/i.test(error.message)) {
 				throw error;
 			}

package/src/runtime-mcp/transports/stdio.ts

@@ -239,8 +239,15 @@ export class StdioTransport implements MCPTransport {
 		const response = error
 			? { jsonrpc: "2.0" as const, id, error }
 			: { jsonrpc: "2.0" as const, id, result: result ?? {} };
-		stdin.write(`${JSON.stringify(response)}\n`);
-		stdin.flush();
+		// FileSink.write()/flush() return `number | Promise<number>` (flush may
+		// also return undefined): under backpressure a write returns a promise
+		// whose rejection — e.g. EPIPE when the server dies mid-write — must
+		// not escape as an unhandled rejection. Best-effort, like the caller.
+		Promise.resolve(stdin.write(`${JSON.stringify(response)}\n`))
+			.then(() => stdin.flush())
+			.catch(() => {
+				// Best-effort — process may have exited
+			});
 	}
 
 	#handleClose(failure?: MCPExpectedFailure): void {
@@ -276,6 +283,7 @@ export class StdioTransport implements MCPTransport {
 		}
 
 		const { promise, resolve, reject } = Promise.withResolvers<T>();
+		void promise.catch(() => {});
 		let timer: NodeJS.Timeout | undefined;
 		let settled = false;
 
@@ -319,14 +327,18 @@ export class StdioTransport implements MCPTransport {
 		}, timeout);
 
 		const message = `${JSON.stringify(request)}\n`;
-		try {
-			// Bun's FileSink has write() method directly
-			stdin.write(message);
-			stdin.flush();
-		} catch (error: unknown) {
-			cleanup();
-			reject(new MCPExpectedFailure(error));
-		}
+		void (async () => {
+			try {
+				// Bun's FileSink has write() method directly. Await both write and
+				// flush: under backpressure write() returns a promise, and either
+				// call can fail with EPIPE when the server dies mid-write.
+				await stdin.write(message);
+				await stdin.flush();
+			} catch (error: unknown) {
+				cleanup();
+				reject(new MCPExpectedFailure(error));
+			}
+		})();
 
 		return promise;
 	}
@@ -345,9 +357,11 @@ export class StdioTransport implements MCPTransport {
 
 		const message = `${JSON.stringify(notification)}\n`;
 		try {
-			// Bun's FileSink has write() method directly
-			stdin.write(message);
-			stdin.flush();
+			// Bun's FileSink has write() method directly. Await both write and
+			// flush: under backpressure write() returns a promise, and either
+			// call can fail with EPIPE when the server dies mid-write.
+			await stdin.write(message);
+			await stdin.flush();
 		} catch (error) {
 			throw new MCPExpectedFailure(error);
 		}

package/src/sdk/acp/adapter.ts

@@ -2,9 +2,13 @@ import { randomUUID } from "node:crypto";
 import { logger } from "@gajae-code/utils";
 import { lifecycleRequestTimeoutMs } from "../broker/startup-budget";
 import { type SdkClient, SdkClientError } from "../client";
-
 import type { AbortScope } from "../host/control/operations";
 import { assertReverseResponseFrame, ReverseLeaseError } from "../host/reverse-leases";
+import {
+	SessionLifecycleService,
+	type SessionReconcileUncertainTarget,
+	validateSessionReconcileUncertainTarget,
+} from "../lifecycle/service";
 import { validateAdapterControl, validateAdapterSecretFields } from "../protocol/adapter-validation";
 import { OPERATIONS } from "../protocol/operation-registry";
 import { type SessionAttachment, type SessionRouter, SessionRouterError } from "../router";
@@ -132,7 +136,8 @@ function isLifecycleOperation(operation: string): boolean {
 		operation === "session.fork" ||
 		operation === "session.resume" ||
 		operation === "session.close" ||
-		operation === "session.delete"
+		operation === "session.delete" ||
+		operation === "session.reconcile_uncertain"
 	);
 }
 
@@ -449,8 +454,30 @@ export class AcpSdkAdapter {
 		this.#assertGenericDisposition("global", operation);
 		if (isLifecycleOperation(operation) && !idempotencyKey)
 			throw new AcpSdkAdapterError("invalid_input", "idempotencyKey is required for lifecycle operations.");
+		if (operation === "session.reconcile_uncertain" && !validateSessionReconcileUncertainTarget(input))
+			throw new AcpSdkAdapterError(
+				"invalid_input",
+				"session.reconcile_uncertain requires complete identity-bound retirement proof.",
+			);
 		if (!this.#client)
 			throw new AcpSdkAdapterError("operation_prohibited", "Lifecycle operations require the Broker connection.");
+		const client = this.#client;
+		if (operation === "session.reconcile_uncertain") {
+			const outcome = await new SessionLifecycleService({
+				global: (lifecycleOperation, lifecycleInput, options) =>
+					client.global(lifecycleOperation, lifecycleInput, options),
+			}).executeWithIdempotencyKey(
+				{
+					operation,
+					actor: { id: "acp", namespace: "sdk:acp" },
+					capability: operation,
+					requestKey: idempotencyKey!,
+					target: input as unknown as SessionReconcileUncertainTarget,
+				},
+				idempotencyKey!,
+			);
+			return outcome.ok ? { ok: true, result: outcome.result } : { ok: false, error: outcome.error };
+		}
 		// The broker may hold a startup in its admission queue before the readiness
 		// clock even starts, so the caller deadline covers the queue wait too; sizing
 		// it on readiness alone times out requests the broker is still running. A

package/src/sdk/broker/broker.ts

@@ -190,15 +190,27 @@ export type BrokerResponse =
 const error = (code: BrokerErrorCode, message: string): BrokerResponse => ({ ok: false, error: { code, message } });
 
 function isCleanupPending(response: BrokerResponse): boolean {
-	return !response.ok && response.error.code === "cleanup_pending" && response.error.cleanup !== undefined;
+	if (response.ok) return false;
+	const error = (response as { error?: unknown }).error;
+	if (typeof error !== "object" || error === null) return false;
+	const value = error as { code?: unknown; cleanup?: unknown };
+	return value.code === "cleanup_pending" && value.cleanup !== undefined;
 }
 
 function cleanupFromResponse(response: unknown): BrokerCleanupEvidence | undefined {
-	return isBrokerResponse(response) && !response.ok ? response.error.cleanup : undefined;
+	if (!isBrokerResponse(response) || response.ok) return undefined;
+	const error = (response as { error?: unknown }).error;
+	if (typeof error !== "object" || error === null) return undefined;
+	const cleanup = (error as { cleanup?: unknown }).cleanup;
+	return cleanup && typeof cleanup === "object" ? (cleanup as BrokerCleanupEvidence) : undefined;
 }
 function pendingCleanupSessionId(response: BrokerResponse): string | undefined {
-	if (response.ok || response.error.code !== "cleanup_pending") return undefined;
-	return typeof response.error.cleanup?.sessionId === "string" ? response.error.cleanup.sessionId : undefined;
+	if (response.ok) return undefined;
+	const error = (response as { error?: unknown }).error;
+	if (typeof error !== "object" || error === null) return undefined;
+	const value = error as { code?: unknown; cleanup?: { sessionId?: unknown } };
+	if (value.code !== "cleanup_pending") return undefined;
+	return typeof value.cleanup?.sessionId === "string" ? value.cleanup.sessionId : undefined;
 }
 
 const LIFECYCLE_OPERATIONS = new Set([
@@ -207,6 +219,7 @@ const LIFECYCLE_OPERATIONS = new Set([
 	"session.resume",
 	"session.close",
 	"session.delete",
+	"session.reconcile_uncertain",
 ]);
 
 /** Bootstrap signing material and its public candidate id authorize a launch but are not lifecycle request identity. */
@@ -225,7 +238,10 @@ function lifecycleFingerprint(operation: string, input: Record<string, unknown>)
 function lifecycleResponseState(response: BrokerResponse): LifecycleState {
 	if (response.ok) return "terminal_ok";
 	if (isCleanupPending(response)) return "effect_started";
-	return response.error.code === "terminal_uncertain" ? "terminal_uncertain" : "terminal_error";
+	const error = (response as { error?: unknown }).error;
+	return typeof error === "object" && error !== null && (error as { code?: unknown }).code === "terminal_uncertain"
+		? "terminal_uncertain"
+		: "terminal_error";
 }
 
 type InputNormalization = { input: Record<string, unknown> } | BrokerResponse;
@@ -307,7 +323,8 @@ function normalizeBrokerInput(operation: string, input: Record<string, unknown>)
 		operation !== "session.fork" &&
 		operation !== "session.resume" &&
 		operation !== "session.close" &&
-		operation !== "session.delete"
+		operation !== "session.delete" &&
+		operation !== "session.reconcile_uncertain"
 	)
 		return { input: normalized };
 
@@ -469,6 +486,7 @@ function lifecycleTarget(operation: string, input: Record<string, unknown>): unk
 		case "session.resume":
 		case "session.close":
 		case "session.delete":
+		case "session.reconcile_uncertain":
 			return { sessionId: id };
 		default:
 			return { operation, root, sessionId: id };
@@ -1575,6 +1593,8 @@ export class Broker {
 		}
 
 		if (!idempotencyKey) return error("invalid_input", "idempotencyKey is required for lifecycle operations");
+		if (idempotencyKey.length > 256 || /[\u0000-\u001f\u007f]/u.test(idempotencyKey))
+			return error("invalid_input", "idempotencyKey must be a bounded non-empty string");
 		const target = createHash("sha256")
 			.update(canonicalJson(lifecycleTarget(operation, input)))
 			.digest("hex");

package/src/sdk/broker/lifecycle-ledger.ts

@@ -161,6 +161,7 @@ function isLifecycleLedgerEntry(value: unknown): value is LifecycleLedgerEntry {
 	);
 }
 function canonicalJson(value: unknown): string {
+	if (typeof value === "bigint") return JSON.stringify(value.toString());
 	if (value === null || typeof value !== "object") return JSON.stringify(value);
 	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
 	const record = value as Record<string, unknown>;
@@ -698,7 +699,9 @@ export class LifecycleLedger {
 		return this.#warnings;
 	}
 	async #append(entry: LifecycleLedgerEntry): Promise<LifecycleLedgerEntry> {
-		const line = Buffer.from(`${JSON.stringify(entry)}\n`);
+		const line = Buffer.from(
+			`${JSON.stringify(entry, (_key, value: unknown) => (typeof value === "bigint" ? value.toString() : value))}\n`,
+		);
 		if (line.length - 1 > this.#limits.maxLineBytes)
 			throw new Error("Lifecycle ledger row exceeds the maximum byte length.");
 		let replacementCompacted = false;
@@ -907,6 +910,30 @@ export class LifecycleLedger {
 		return this.#byIdentity.get(identity);
 	}
 
+	listUncertainCreatesBySessionId(
+		sessionId: string,
+		effectMarker?: string,
+		remoteCreateKey?: string,
+	): LifecycleLedgerEntry[] {
+		const matches: LifecycleLedgerEntry[] = [];
+		for (const current of this.#byIdentity.values()) {
+			const effectIntent = current.effectIntent;
+			if (
+				current.state === "terminal_uncertain" &&
+				current.intendedSessionId === sessionId &&
+				current.operationKey?.startsWith("session.create\u0000") &&
+				effectIntent?.sessionId === sessionId &&
+				typeof effectIntent.stateRoot === "string" &&
+				path.isAbsolute(effectIntent.stateRoot) &&
+				effectIntent.childOwnershipEstablished === true &&
+				(effectMarker === undefined || current.effectMarker === effectMarker) &&
+				(remoteCreateKey === undefined || current.operationKey === `session.create\u0000${remoteCreateKey}`)
+			)
+				matches.push(current);
+		}
+		return matches;
+	}
+
 	findPendingCleanupByTarget(
 		sessionId: string,
 		cwd: string,