@gajae-code/coding-agent 0.15.4 → 0.15.5

package/src/session/internal/managed-session-storage.ts

@@ -242,9 +242,8 @@ export interface ManagedFileSnapshot {
 	};
 }
 /**
- * Descriptor identity of one managed file object. Deliberately excludes the
- * content sha256: append receipts must bind the post-operation object without
- * re-reading the whole payload.
+ * Descriptor identity of one managed file object. Append receipts include a
+ * content digest when the append implementation has already computed it.
  */
 export interface ManagedFileIdentity {
 	dev: bigint;
@@ -253,6 +252,7 @@ export interface ManagedFileIdentity {
 	size: number;
 	mtimeNs: bigint;
 	ctimeNs: bigint;
+	sha256?: string;
 }
 
 /**
@@ -281,6 +281,7 @@ function sameManagedIdentity(left: ManagedFileIdentity, right: ManagedFileIdenti
 export interface ManagedBoundedAppendExpectation {
 	readonly dev: string;
 	readonly ino: string;
+	readonly nlink: string;
 	readonly size: string;
 	readonly mtimeNs: string;
 	readonly ctimeNs: string;
@@ -295,6 +296,7 @@ function managedFileIdentityFromNative(identity: RecoveryFsIdentity): ManagedFil
 		size: Number(identity.size),
 		mtimeNs: BigInt(identity.mtimeNs),
 		ctimeNs: BigInt(identity.ctimeNs),
+		...(identity.sha256 ? { sha256: identity.sha256 } : {}),
 	};
 }
 
@@ -1704,6 +1706,7 @@ export class ManagedSessionDescendantStore {
 		return {
 			dev: identity.dev.toString(),
 			ino: identity.ino.toString(),
+			nlink: identity.nlink.toString(),
 			size: identity.size.toString(),
 			mtimeNs: identity.mtimeNs.toString(),
 			ctimeNs: identity.ctimeNs.toString(),
@@ -1718,17 +1721,20 @@ export class ManagedSessionDescendantStore {
 	): ManagedAppendReceipt {
 		this.#beforeMutation();
 		this.#assertBound();
+		let appendExpectation = expected;
 		if (!this.#authority) {
 			const current = captureManagedFileIdentityStreamingNoFollow(this.#resolve(relativePath));
-			if (
-				current.dev.toString() !== expected.dev ||
-				current.ino.toString() !== expected.ino ||
-				current.size.toString() !== expected.size ||
-				current.mtimeNs.toString() !== expected.mtimeNs ||
-				current.ctimeNs.toString() !== expected.ctimeNs ||
-				current.sha256 !== expected.sha256
-			)
+			const identityMatches =
+				current.dev.toString() === expected.dev &&
+				current.ino.toString() === expected.ino &&
+				current.nlink.toString() === expected.nlink &&
+				current.size.toString() === expected.size &&
+				current.sha256 === expected.sha256;
+			if (!identityMatches) {
 				throw new Error("managed_append_identity_mismatch");
+			}
+			// mtime/ctime drift on the same file object is harmless. The append
+			// helper performs its own descriptor-bound mutation check.
 			const appended = appendManagedFileStreamingSync(
 				this.#resolve(relativePath),
 				bytes,
@@ -1738,16 +1744,35 @@ export class ManagedSessionDescendantStore {
 			this.#assertBound();
 			return managedAppendReceiptFromIdentity(appended);
 		}
+		const current = this.captureBoundedAppendExpectation(relativePath);
+		if (!current) throw new Error("managed_append_identity_mismatch");
+		if (
+			current.dev !== expected.dev ||
+			current.ino !== expected.ino ||
+			current.nlink !== expected.nlink ||
+			current.size !== expected.size ||
+			current.sha256 !== expected.sha256
+		)
+			throw new Error("managed_append_identity_mismatch");
+		const descriptorMatches =
+			current.dev === expected.dev &&
+			current.ino === expected.ino &&
+			current.nlink === expected.nlink &&
+			current.size === expected.size &&
+			current.mtimeNs === expected.mtimeNs &&
+			current.ctimeNs === expected.ctimeNs &&
+			current.sha256 === expected.sha256;
+		if (!descriptorMatches) appendExpectation = current;
 		const relative = this.#relative(this.#resolve(relativePath));
 		const appended = this.#authority.appendManaged(
 			relative,
 			bytes,
-			expected.dev,
-			expected.ino,
-			expected.size,
-			expected.mtimeNs,
-			expected.ctimeNs,
-			expected.sha256,
+			appendExpectation.dev,
+			appendExpectation.ino,
+			appendExpectation.size,
+			appendExpectation.mtimeNs,
+			appendExpectation.ctimeNs,
+			appendExpectation.sha256,
 		);
 		if (!appended.ok) throw managedAppendFailure(appended.code);
 		if (!appended.identity)
@@ -1762,15 +1787,28 @@ export class ManagedSessionDescendantStore {
 		expected: ManagedFileIdentity,
 	): ManagedAppendReceipt {
 		const bounded = this.captureBoundedAppendExpectation(relativePath);
-		if (
-			!bounded ||
-			bounded.dev !== expected.dev.toString() ||
-			bounded.ino !== expected.ino.toString() ||
-			bounded.size !== String(expected.size) ||
-			bounded.mtimeNs !== expected.mtimeNs.toString() ||
-			bounded.ctimeNs !== expected.ctimeNs.toString()
-		)
-			throw new Error("managed_append_identity_mismatch");
+		if (!bounded) throw new Error("managed_append_identity_mismatch");
+		const descriptorMatches =
+			bounded.dev === expected.dev.toString() &&
+			bounded.ino === expected.ino.toString() &&
+			bounded.nlink === expected.nlink.toString() &&
+			bounded.size === String(expected.size) &&
+			bounded.mtimeNs === expected.mtimeNs.toString() &&
+			bounded.ctimeNs === expected.ctimeNs.toString();
+		if (!descriptorMatches) {
+			// Metadata-only drift is safe only when the same unlinked file object and
+			// byte-exact predecessor are independently proven. Never accept a changed
+			// object, length, link count, or digest as a benign touch.
+			if (
+				!expected.sha256 ||
+				bounded.dev !== expected.dev.toString() ||
+				bounded.ino !== expected.ino.toString() ||
+				bounded.nlink !== expected.nlink.toString() ||
+				bounded.size !== String(expected.size) ||
+				bounded.sha256 !== expected.sha256
+			)
+				throw new Error("managed_append_identity_mismatch");
+		}
 		return this.appendExpectedSync(relativePath, bytes, bounded);
 	}
 

package/src/session/session-manager.ts

@@ -8385,7 +8385,7 @@ export class SessionManager {
 			this.#usageStatistics = commit.usageStatistics;
 			this.#flushed = true;
 			this.#ensuredOnDisk = true;
-			this.#managedPersistExpectedIdentity = managedIdentityFromDescriptor(terminalDescriptor);
+			this.#managedPersistExpectedIdentity = this.#captureManagedPersistIdentity(sessionFile);
 			this.#lazyReopenSucceeded = true;
 			this.#lazyReopenFallbackReason = undefined;
 			initialized = true;
@@ -8572,7 +8572,7 @@ export class SessionManager {
 				this.#lazyReopenFallbackReason = "bounded_first_open_descriptor_changed";
 				return false;
 			}
-			this.#managedPersistExpectedIdentity = managedIdentityFromDescriptor(finalDescriptor);
+			this.#managedPersistExpectedIdentity = this.#captureManagedPersistIdentity(sessionFile);
 			this.#sessionId = discovery.header.id;
 			this.#sessionName = discovery.header.title;
 			this.#titleSource = discovery.header.titleSource;
@@ -14945,9 +14945,27 @@ export class SessionManager {
 			this.#managedPersistExpectedIdentity = undefined;
 			return;
 		}
-		const descriptor = this.#managedTranscriptStore(sessionFile).descriptorExpected(path.basename(sessionFile));
-		if (!descriptor) throw new Error("managed_persist_identity_unavailable");
-		this.#managedPersistExpectedIdentity = managedIdentityFromDescriptor(descriptor);
+		this.#managedPersistExpectedIdentity = this.#captureManagedPersistIdentity(sessionFile);
+	}
+
+	/** Capture one descriptor-bound digest for a future metadata-drift comparison. */
+	#captureManagedPersistIdentity(sessionFile: string): ManagedFileIdentity {
+		const store = this.#managedTranscriptStore(sessionFile);
+		const relativePath = path.basename(sessionFile);
+		const bounded = store.captureBoundedAppendExpectation(relativePath);
+		const descriptor = store.descriptorExpected(relativePath);
+		if (!bounded || !descriptor) throw new Error("managed_persist_identity_unavailable");
+		const identity = managedIdentityFromDescriptor(descriptor);
+		if (
+			bounded.dev !== identity.dev.toString() ||
+			bounded.ino !== identity.ino.toString() ||
+			bounded.nlink !== identity.nlink.toString() ||
+			bounded.size !== String(identity.size) ||
+			bounded.mtimeNs !== identity.mtimeNs.toString() ||
+			bounded.ctimeNs !== identity.ctimeNs.toString()
+		)
+			throw new Error("managed_persist_identity_unavailable");
+		return { ...identity, sha256: bounded.sha256 };
 	}
 	/** Current transcript descriptor, or null when unavailable. */
 	#managedDescriptorSnapshotOrNull(): DescriptorSnapshot | null {
@@ -14997,7 +15015,7 @@ export class SessionManager {
 				} else store.replaceSync(relativePath, bytes);
 				const descriptor = store.descriptorExpected(relativePath);
 				if (!descriptor) throw new Error("managed_replace_identity_unavailable");
-				this.#managedPersistExpectedIdentity = managedIdentityFromDescriptor(descriptor);
+				this.#managedPersistExpectedIdentity = this.#captureManagedPersistIdentity(sessionFile);
 				this.#publishCommitMarkerFromCurrentTranscriptSync();
 				return;
 			}
@@ -19961,7 +19979,7 @@ export class SessionManager {
 				const returnManagedDescriptor = managedInspectionStore?.descriptorExpected(path.basename(filePath));
 				if (!returnManagedDescriptor || !sameDescriptor(managedBoundedDescriptor, returnManagedDescriptor))
 					throw new Error("Could not open session: unstable");
-				manager.#managedPersistExpectedIdentity = managedIdentityFromDescriptor(returnManagedDescriptor);
+				manager.#managedPersistExpectedIdentity = manager.#captureManagedPersistIdentity(filePath);
 				const header = manager.#fileEntries.find(entry => entry.type === "session") as SessionHeader | undefined;
 				if (header?.cwd) manager.cwd = header.cwd;
 				manager.buildSessionContext();
@@ -20079,7 +20097,7 @@ export class SessionManager {
 					const finalDescriptor = store.descriptorExpected(path.basename(resolved));
 					if (!finalDescriptor || !sameDescriptor(capturedDescriptor, finalDescriptor))
 						throw new Error("source_changed");
-					boundedManager.#managedPersistExpectedIdentity = managedIdentityFromDescriptor(finalDescriptor);
+					boundedManager.#managedPersistExpectedIdentity = boundedManager.#captureManagedPersistIdentity(resolved);
 					boundedManager.buildSessionContext();
 					return boundedManager;
 				}

package/src/tools/bash.ts

@@ -59,6 +59,7 @@ import {
 } from "./output-meta";
 import { resolveToCwd } from "./path-utils";
 import { formatToolWorkingDirectory, replaceTabs } from "./render-utils";
+import { checkTmuxSelfInjection } from "./tmux-self-injection-guard";
 import { ToolAbortError, ToolError } from "./tool-errors";
 import { toolResult } from "./tool-result";
 import { clampTimeout, TOOL_TIMEOUTS } from "./tool-timeouts";
@@ -1053,6 +1054,19 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			...internalUrlOptions,
 			ensureLocalParentDirs: this.session.bashRestrictionProfile !== "read-only",
 		});
+		// Issue #5039: refuse tmux write verbs whose target resolves to this
+		// agent's own tmux pane — such bytes forge a human `user` turn in the
+		// transcript. This is after command expansion but before any spawn, so
+		// blocked attempts inject no bytes and create no transcript turn.
+		if (this.session.bashRestrictionProfile !== "read-only") {
+			const injection = await checkTmuxSelfInjection(command, {
+				env: process.env,
+				cwd: this.session.cwd,
+			});
+			if (injection.block) {
+				throw new ToolError(injection.reason ?? "Blocked: tmux self-pane injection.");
+			}
+		}
 		const expandedEnv = env
 			? Object.fromEntries(
 					await Promise.all(

package/src/tools/path-utils.ts

@@ -11,17 +11,20 @@ const UNICODE_SPACES = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g;
 const FILE_LINE_RANGE_RE = /^(?:L?\d+(?:[-+]L?\d+|-)?(?:,L?\d+(?:[-+]L?\d+|-)?)*|raw|conflicts)$/i;
 const FILE_LINE_RANGE_ONLY_RE = /^L?\d+(?:[-+]L?\d+|-)?(?:,L?\d+(?:[-+]L?\d+|-)?)*$/i;
 const FILE_RAW_ONLY_RE = /^raw$/i;
-// Schemes whose authority grammar is identifier-shaped and may therefore carry
-// a read selector immediately after the authority. Colons in a path, query, or
-// fragment remain part of the URL and are never considered selectors.
-const INTERNAL_SCHEMES_WITH_SELECTORS: Record<string, true> = {
+// Schemes whose authority grammar is identifier-shaped and cannot contain a
+// literal colon. Colons in a path, query, or fragment remain part of the URL
+// and are never considered selectors.
+const INTERNAL_SCHEMES_WITH_UNAMBIGUOUS_AUTHORITIES: Record<string, true> = {
 	agent: true,
 	artifact: true,
-	issue: true,
-	local: true,
 	memory: true,
-	gjc: true,
+	issue: true,
 	pr: true,
+};
+const INTERNAL_SCHEMES_WITH_SELECTORS: Record<string, true> = {
+	...INTERNAL_SCHEMES_WITH_UNAMBIGUOUS_AUTHORITIES,
+	gjc: true,
+	local: true,
 	rule: true,
 	skill: true,
 };
@@ -33,6 +36,18 @@ function normalizeUnicodeSpaces(str: string): string {
 	return str.replace(UNICODE_SPACES, " ");
 }
 
+function rawSkillPrefixForName(authority: string, skillName: string): string | undefined {
+	for (let index = 1; index < authority.length; index++) {
+		if (authority[index] !== ":") continue;
+		try {
+			if (decodeURIComponent(authority.slice(0, index)) === skillName) return authority.slice(0, index);
+		} catch {
+			return undefined;
+		}
+	}
+	return undefined;
+}
+
 function tryMacOSScreenshotPath(filePath: string): string {
 	// macOS writes a narrow no-break space before AM/PM, but the model normalizes it
 	// to a plain space. The original name is not always `…PM.png`: attachment paths
@@ -149,12 +164,11 @@ export function splitPathAndSel(rawPath: string): { path: string; sel?: string }
 /**
  * Variant of {@link splitPathAndSel} for internal URLs (`scheme://...`).
  *
- * Artifact authorities are generated identifiers, so their complete tail is
- * unambiguously a selector and malformed selectors can be rejected before
- * resolving the artifact. Other resources may legitimately use colons in
- * their identities, so they only lose strict, recognized selector suffixes.
- * Skill authorities additionally use the active registry to distinguish a
- * skill name from its selector without making path-utils depend on skills.
+ * Selector-capable internal authorities use identifier-shaped resource names,
+ * so an authority-only `:<tail>` is an explicit read selector even when the
+ * selector is malformed. Skill authorities are the exception: namespaced
+ * skill names already contain a colon, so the active registry gets first
+ * refusal and the fallback recognizes a later colon as the selector boundary.
  */
 export function splitInternalUrlSel(
 	rawPath: string,
@@ -167,32 +181,66 @@ export function splitInternalUrlSel(
 
 	const schemeEnd = schemeMatch[0].length;
 	const authorityTerminator = rawPath.slice(schemeEnd).search(/[/?#]/);
-	if (authorityTerminator !== -1) return { path: rawPath };
-	const authority = rawPath.slice(schemeEnd);
+	const authorityEnd = authorityTerminator === -1 ? rawPath.length : schemeEnd + authorityTerminator;
+	const authority = rawPath.slice(schemeEnd, authorityEnd);
+	const authoritySuffix = rawPath.slice(authorityEnd);
 	const firstColon = authority.indexOf(":");
 	if (firstColon === -1) return { path: rawPath };
-
-	if (scheme === "artifact") {
-		return { path: rawPath.slice(0, schemeEnd + firstColon), sel: authority.slice(firstColon + 1) };
-	}
+	if (firstColon === 0) return { path: rawPath };
 
 	if (scheme === "skill") {
 		const activeSkillNames = options.activeSkillNames ?? [];
-		if (activeSkillNames.includes(authority)) return { path: rawPath };
-		const skillName = activeSkillNames
-			.filter(name => authority.startsWith(`${name}:`))
-			.sort((a, b) => b.length - a.length)[0];
-		if (skillName) {
+		let decodedAuthority: string | undefined;
+		try {
+			decodedAuthority = decodeURIComponent(authority);
+		} catch {
+			// Let the resolver report malformed URL encoding when no selector boundary
+			// can be established from the raw authority.
+		}
+		if (decodedAuthority !== undefined && activeSkillNames.includes(decodedAuthority)) return { path: rawPath };
+		const rawSkillPrefix = activeSkillNames
+			.map(name => ({ name, prefix: rawSkillPrefixForName(authority, name) }))
+			.filter(item => item.prefix !== undefined)
+			.sort((a, b) => b.name.length - a.name.length)[0]?.prefix;
+		if (rawSkillPrefix) {
 			return {
-				path: `${rawPath.slice(0, schemeEnd)}${skillName}`,
-				sel: authority.slice(skillName.length + 1),
+				path: `${rawPath.slice(0, schemeEnd)}${rawSkillPrefix}${authoritySuffix}`,
+				sel: authority.slice(rawSkillPrefix.length + 1),
 			};
 		}
+		const strict = splitPathAndSel(authority);
+		if (strict.sel !== undefined) {
+			return { path: `${rawPath.slice(0, schemeEnd)}${strict.path}${authoritySuffix}`, sel: strict.sel };
+		}
+		const firstTail = authority.slice(firstColon + 1);
+		if (FILE_LINE_RANGE_RE.test(firstTail)) {
+			return { path: `${rawPath.slice(0, schemeEnd + firstColon)}${authoritySuffix}`, sel: firstTail };
+		}
+		const selectorColon = authority.indexOf(":", firstColon + 1);
+		if (selectorColon === -1) return { path: rawPath };
+		return {
+			path: `${rawPath.slice(0, schemeEnd + selectorColon)}${authoritySuffix}`,
+			sel: authority.slice(selectorColon + 1),
+		};
+	}
+
+	if (!INTERNAL_SCHEMES_WITH_UNAMBIGUOUS_AUTHORITIES[scheme]) {
+		// A path/query/fragment after a path-like authority makes a colon-bearing
+		// resource identity indistinguishable from an authority selector. Preserve
+		// the complete URL; path-like selectors are accepted only on authority-only
+		// URLs, where the existing strict grammar is the sole interpretation.
+		if (authoritySuffix !== "") return { path: rawPath };
+		const strict = splitPathAndSel(authority);
+		if (strict.sel !== undefined) {
+			return { path: `${rawPath.slice(0, schemeEnd)}${strict.path}`, sel: strict.sel };
+		}
+		return { path: rawPath };
 	}
 
-	const strict = splitPathAndSel(authority);
-	if (strict.sel === undefined) return { path: rawPath };
-	return { path: `${rawPath.slice(0, schemeEnd)}${strict.path}`, sel: strict.sel };
+	return {
+		path: `${rawPath.slice(0, schemeEnd + firstColon)}${authoritySuffix}`,
+		sel: authority.slice(firstColon + 1),
+	};
 }
 
 function assertNotInternalUrl(expanded: string, original: string): void {