@gajae-code/coding-agent 0.15.2 → 0.15.4

package/src/gjc-runtime/session-state-lock.ts

@@ -662,12 +662,20 @@ async function openOwnerIdentity(handle: fs.FileHandle): Promise<OpenOwnerIdenti
  * the compare-and-delete cannot object — the capture and the authorization would be the
  * same foreign object.
  *
- * So the created descriptor is still open here, and it stays open: it is what makes the
- * comparison sound instead of merely likely, because the created inode cannot be recycled
+ * So on POSIX the created descriptor is still open here, and it stays open: it is what makes
+ * the comparison sound instead of merely likely, because the created inode cannot be recycled
  * underneath a successor while this process holds it. Only when a fresh no-follow capture
  * of the pathname proves to be that same still-open object is the existing exact unlink
  * allowed to run — and it then closes the remaining capture-to-unlink race on the bytes.
  *
+ * Windows inverts that order. Opening the object for DELETE while this descriptor pins it
+ * fails (the create descriptor grants no share-delete), so the descriptor cannot outlive the
+ * proof there. It has already vouched for the object identity before it closes; afterwards
+ * the compare-and-delete itself re-proves the FULL recorded identity — dev/ino, link count,
+ * size, mtime, and payload hash — against whatever the pathname names at delete time. A
+ * successor that takes the pathname in the close-to-delete window fails that compare and is
+ * left alone, which keeps the retraction fail-closed without the descriptor.
+ *
  * Anything short of that proof — a descriptor that no longer answers, a capture that
  * refuses or reports a type swap, a different object at the path — leaves the pathname
  * exactly as it is for the normal stale protocol.
@@ -680,6 +688,7 @@ async function retractFailedOwnerRecord(
 	if (!created) return;
 	const stillOpen = await openOwnerIdentity(handle);
 	if (!stillOpen || stillOpen.dev !== created.dev || stillOpen.ino !== created.ino) return;
+	if (ownerAccessStrategy() === "windows-validated") await handle.close().catch(() => undefined);
 	const current = await captureRegularLockOwner(file).catch(() => null);
 	if (!current || current.dev !== created.dev || current.ino !== created.ino) return;
 	exactUnlinkOwnerRecord(file, current);

package/src/gjc-runtime/ultragoal-runtime.ts

@@ -86,6 +86,7 @@ import {
 	type UltragoalValidationLaneSelection,
 	validationLaneSelectionFor,
 } from "./ultragoal-validation-policy";
+import { isWorkflowPlaceholderText, WORKFLOW_PLACEHOLDER_CORRECTION } from "./workflow-placeholder";
 import { resolveWorkflowSetting } from "./workflow-settings";
 
 export {
@@ -1166,6 +1167,9 @@ function parseGoalsFromBrief(brief: string): ParsedGoal[] {
 		if (!title && !body) {
 			throw new Error(`ultragoal @goal block ${index + 1} has no title or objective`);
 		}
+		if (isWorkflowPlaceholderText(body || title)) {
+			throw new Error(`ultragoal @goal block ${index + 1} requires ${WORKFLOW_PLACEHOLDER_CORRECTION}`);
+		}
 		return { title: clampTitle(title), objective: body || title };
 	});
 }
@@ -1180,6 +1184,7 @@ export async function createUltragoalPlan(input: {
 }): Promise<UltragoalPlan> {
 	const brief = input.brief.trim();
 	if (!brief) throw new Error("ultragoal brief is required");
+	if (isWorkflowPlaceholderText(brief)) throw new Error(`ultragoal brief requires ${WORKFLOW_PLACEHOLDER_CORRECTION}`);
 	const now = new Date().toISOString();
 	// Parse the untrimmed brief so the raw-line delimiter contract holds: a
 	// leading-indented `@goal` on the first line must stay objective text rather

package/src/gjc-runtime/workflow-placeholder.ts

@@ -0,0 +1,33 @@
+/** Shared placeholder semantics for model-authored workflow content. */
+
+const WORKFLOW_PLACEHOLDER_TOKENS = new Set([
+	"empty",
+	"n/a",
+	"n-a",
+	"na",
+	"none",
+	"placeholder",
+	"stub",
+	"tbd",
+	"todo",
+	"unused",
+]);
+
+export const WORKFLOW_PLACEHOLDER_CORRECTION =
+	"provide a specific, non-placeholder question or objective instead of empty, whitespace, unused, TODO, TBD, N/A, N-A, NA, none, placeholder, or stub";
+
+/** Exact, case-insensitive placeholder detection; meaningful sentences remain valid. */
+export function isWorkflowPlaceholderText(value: unknown): boolean {
+	if (typeof value !== "string") return false;
+	const normalized = value.trim().toLowerCase();
+	return normalized.length === 0 || WORKFLOW_PLACEHOLDER_TOKENS.has(normalized);
+}
+
+/** Detect a legacy formatted deep-interview ask whose visible body is a placeholder. */
+export function isLegacyDeepInterviewPlaceholder(value: unknown): boolean {
+	if (typeof value !== "string") return false;
+	const lines = value.trim().split(/\r?\n/);
+	const headerIndex = lines.findIndex(line => /^Round\s+\d+\s+\|.*\bAmbiguity\b/i.test(line.trim()));
+	if (headerIndex < 0) return false;
+	return isWorkflowPlaceholderText(lines.slice(headerIndex + 1).join("\n"));
+}