@gajae-code/coding-agent 0.15.4 → 0.15.6

package/src/tools/index.ts

@@ -17,6 +17,7 @@ import type {
 } from "../session/agent-session";
 import type { ArtifactManager } from "../session/artifacts";
 import type { ClientBridge } from "../session/client-bridge";
+import type { FoldAdapter } from "../session/fold-coordinator";
 import type { CustomMessage } from "../session/messages";
 import type { ToolChoiceQueue } from "../session/tool-choice-queue";
 import type { SkillActiveEntry } from "../skill-state/active-state";
@@ -235,12 +236,13 @@ export interface ToolSession {
 	assertEvalExecutionAllowed?: () => void;
 	/** Track tool-owned eval work so session disposal can await/abort it like direct session eval runs. */
 	trackEvalExecution?<T>(execution: Promise<T>, abortController: AbortController): Promise<T>;
-	/** Register a safe request handler that asks a managed foreground bash call to fold into a background job. */
-	registerForegroundBashBackgroundRequestHandler?: (handler: () => void) => () => void;
-	/** Whether a managed foreground bash call is currently foldable into a background job. */
+	/** Register a foldable foreground wait so the fold chord can move it into a background job. */
+	registerForegroundFoldParticipant?: (adapter: FoldAdapter) => () => void;
+	/** Whether a foreground wait is currently foldable into a background job. */
 	hasForegroundBashBackgroundRequestHandler?: () => boolean;
-	/** Request that the active managed foreground bash call fold into a background job, if supported. */
-	requestForegroundBashBackground?: () => boolean;
+	/** Request that the active foreground wait fold into a background job, if supported. */
+	requestForegroundBashBackground?: () => Promise<boolean>;
+
 	/** Get the session-owned or inherited async job manager. */
 	getAsyncJobManager?: () => AsyncJobManager | undefined;
 	/** Resolves when the session queues user steering (or `signal` aborts) without consuming it; wait-style tools use this to end their observation early. */

package/src/tools/path-utils.ts

@@ -11,17 +11,20 @@ const UNICODE_SPACES = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g;
 const FILE_LINE_RANGE_RE = /^(?:L?\d+(?:[-+]L?\d+|-)?(?:,L?\d+(?:[-+]L?\d+|-)?)*|raw|conflicts)$/i;
 const FILE_LINE_RANGE_ONLY_RE = /^L?\d+(?:[-+]L?\d+|-)?(?:,L?\d+(?:[-+]L?\d+|-)?)*$/i;
 const FILE_RAW_ONLY_RE = /^raw$/i;
-// Schemes whose authority grammar is identifier-shaped and may therefore carry
-// a read selector immediately after the authority. Colons in a path, query, or
-// fragment remain part of the URL and are never considered selectors.
-const INTERNAL_SCHEMES_WITH_SELECTORS: Record<string, true> = {
+// Schemes whose authority grammar is identifier-shaped and cannot contain a
+// literal colon. Colons in a path, query, or fragment remain part of the URL
+// and are never considered selectors.
+const INTERNAL_SCHEMES_WITH_UNAMBIGUOUS_AUTHORITIES: Record<string, true> = {
 	agent: true,
 	artifact: true,
-	issue: true,
-	local: true,
 	memory: true,
-	gjc: true,
+	issue: true,
 	pr: true,
+};
+const INTERNAL_SCHEMES_WITH_SELECTORS: Record<string, true> = {
+	...INTERNAL_SCHEMES_WITH_UNAMBIGUOUS_AUTHORITIES,
+	gjc: true,
+	local: true,
 	rule: true,
 	skill: true,
 };
@@ -33,6 +36,18 @@ function normalizeUnicodeSpaces(str: string): string {
 	return str.replace(UNICODE_SPACES, " ");
 }
 
+function rawSkillPrefixForName(authority: string, skillName: string): string | undefined {
+	for (let index = 1; index < authority.length; index++) {
+		if (authority[index] !== ":") continue;
+		try {
+			if (decodeURIComponent(authority.slice(0, index)) === skillName) return authority.slice(0, index);
+		} catch {
+			return undefined;
+		}
+	}
+	return undefined;
+}
+
 function tryMacOSScreenshotPath(filePath: string): string {
 	// macOS writes a narrow no-break space before AM/PM, but the model normalizes it
 	// to a plain space. The original name is not always `…PM.png`: attachment paths
@@ -149,12 +164,11 @@ export function splitPathAndSel(rawPath: string): { path: string; sel?: string }
 /**
  * Variant of {@link splitPathAndSel} for internal URLs (`scheme://...`).
  *
- * Artifact authorities are generated identifiers, so their complete tail is
- * unambiguously a selector and malformed selectors can be rejected before
- * resolving the artifact. Other resources may legitimately use colons in
- * their identities, so they only lose strict, recognized selector suffixes.
- * Skill authorities additionally use the active registry to distinguish a
- * skill name from its selector without making path-utils depend on skills.
+ * Selector-capable internal authorities use identifier-shaped resource names,
+ * so an authority-only `:<tail>` is an explicit read selector even when the
+ * selector is malformed. Skill authorities are the exception: namespaced
+ * skill names already contain a colon, so the active registry gets first
+ * refusal and the fallback recognizes a later colon as the selector boundary.
  */
 export function splitInternalUrlSel(
 	rawPath: string,
@@ -167,32 +181,66 @@ export function splitInternalUrlSel(
 
 	const schemeEnd = schemeMatch[0].length;
 	const authorityTerminator = rawPath.slice(schemeEnd).search(/[/?#]/);
-	if (authorityTerminator !== -1) return { path: rawPath };
-	const authority = rawPath.slice(schemeEnd);
+	const authorityEnd = authorityTerminator === -1 ? rawPath.length : schemeEnd + authorityTerminator;
+	const authority = rawPath.slice(schemeEnd, authorityEnd);
+	const authoritySuffix = rawPath.slice(authorityEnd);
 	const firstColon = authority.indexOf(":");
 	if (firstColon === -1) return { path: rawPath };
-
-	if (scheme === "artifact") {
-		return { path: rawPath.slice(0, schemeEnd + firstColon), sel: authority.slice(firstColon + 1) };
-	}
+	if (firstColon === 0) return { path: rawPath };
 
 	if (scheme === "skill") {
 		const activeSkillNames = options.activeSkillNames ?? [];
-		if (activeSkillNames.includes(authority)) return { path: rawPath };
-		const skillName = activeSkillNames
-			.filter(name => authority.startsWith(`${name}:`))
-			.sort((a, b) => b.length - a.length)[0];
-		if (skillName) {
+		let decodedAuthority: string | undefined;
+		try {
+			decodedAuthority = decodeURIComponent(authority);
+		} catch {
+			// Let the resolver report malformed URL encoding when no selector boundary
+			// can be established from the raw authority.
+		}
+		if (decodedAuthority !== undefined && activeSkillNames.includes(decodedAuthority)) return { path: rawPath };
+		const rawSkillPrefix = activeSkillNames
+			.map(name => ({ name, prefix: rawSkillPrefixForName(authority, name) }))
+			.filter(item => item.prefix !== undefined)
+			.sort((a, b) => b.name.length - a.name.length)[0]?.prefix;
+		if (rawSkillPrefix) {
 			return {
-				path: `${rawPath.slice(0, schemeEnd)}${skillName}`,
-				sel: authority.slice(skillName.length + 1),
+				path: `${rawPath.slice(0, schemeEnd)}${rawSkillPrefix}${authoritySuffix}`,
+				sel: authority.slice(rawSkillPrefix.length + 1),
 			};
 		}
+		const strict = splitPathAndSel(authority);
+		if (strict.sel !== undefined) {
+			return { path: `${rawPath.slice(0, schemeEnd)}${strict.path}${authoritySuffix}`, sel: strict.sel };
+		}
+		const firstTail = authority.slice(firstColon + 1);
+		if (FILE_LINE_RANGE_RE.test(firstTail)) {
+			return { path: `${rawPath.slice(0, schemeEnd + firstColon)}${authoritySuffix}`, sel: firstTail };
+		}
+		const selectorColon = authority.indexOf(":", firstColon + 1);
+		if (selectorColon === -1) return { path: rawPath };
+		return {
+			path: `${rawPath.slice(0, schemeEnd + selectorColon)}${authoritySuffix}`,
+			sel: authority.slice(selectorColon + 1),
+		};
+	}
+
+	if (!INTERNAL_SCHEMES_WITH_UNAMBIGUOUS_AUTHORITIES[scheme]) {
+		// A path/query/fragment after a path-like authority makes a colon-bearing
+		// resource identity indistinguishable from an authority selector. Preserve
+		// the complete URL; path-like selectors are accepted only on authority-only
+		// URLs, where the existing strict grammar is the sole interpretation.
+		if (authoritySuffix !== "") return { path: rawPath };
+		const strict = splitPathAndSel(authority);
+		if (strict.sel !== undefined) {
+			return { path: `${rawPath.slice(0, schemeEnd)}${strict.path}`, sel: strict.sel };
+		}
+		return { path: rawPath };
 	}
 
-	const strict = splitPathAndSel(authority);
-	if (strict.sel === undefined) return { path: rawPath };
-	return { path: `${rawPath.slice(0, schemeEnd)}${strict.path}`, sel: strict.sel };
+	return {
+		path: `${rawPath.slice(0, schemeEnd + firstColon)}${authoritySuffix}`,
+		sel: authority.slice(firstColon + 1),
+	};
 }
 
 function assertNotInternalUrl(expanded: string, original: string): void {

package/src/tools/tmux-self-injection-guard.ts

@@ -0,0 +1,359 @@
+/**
+ * Prevent agent-authored tmux input from being delivered to the agent pane.
+ *
+ * This check runs before bash spawns anything. It is intentionally limited to
+ * tmux input verbs; inspection and control of another pane remain available.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+const INPUT_VERBS = new Set(["send-keys", "paste-buffer", "send-prefix"]);
+const SHELL_RUNNERS = new Set(["sh", "bash", "dash", "zsh", "ksh", "busybox"]);
+const COMMAND_WRAPPERS = new Set(["eval", "exec", "command", "builtin", "nohup", "time"]);
+const CONTROL_WORDS = new Set(["then", "do", "else", "fi", "done", "esac"]);
+const MAX_INDIRECTION_DEPTH = 4;
+
+export interface TmuxSelfInjectionResult {
+	block: boolean;
+	reason?: string;
+}
+
+export type TmuxPaneResolver = (options: {
+	socketArgs: string[];
+	target: string;
+	env: Record<string, string>;
+}) => Promise<string | undefined>;
+
+export interface TmuxSelfInjectionOptions {
+	env?: Record<string, string | undefined>;
+	cwd?: string;
+	resolvePaneId?: TmuxPaneResolver;
+}
+
+interface Token {
+	text: string;
+	quoted: boolean;
+	commandStart: boolean;
+}
+
+function isSeparator(ch: string): boolean {
+	return ch === ";" || ch === "&" || ch === "|" || ch === "(" || ch === ")" || ch === "\n";
+}
+
+function isAssignment(text: string): boolean {
+	return /^[A-Za-z_][A-Za-z0-9_]*=.*/.test(text);
+}
+
+/** Small quote-aware lexer. Unknown shell syntax is represented conservatively. */
+function tokenize(command: string): Token[] {
+	const tokens: Token[] = [];
+	let text = "";
+	let quoted = false;
+	let quote: "'" | '"' | undefined;
+	let atCommandStart = true;
+	let wrapperPending = false;
+	let previous = "";
+
+	const flush = () => {
+		if (text.length === 0) return;
+		const token: Token = { text, quoted, commandStart: atCommandStart };
+		tokens.push(token);
+		if (atCommandStart) {
+			if (isAssignment(text) || CONTROL_WORDS.has(text) || wrapperPending) {
+				atCommandStart = true;
+			} else if (COMMAND_WRAPPERS.has(text)) {
+				atCommandStart = true;
+				wrapperPending = true;
+			} else if (text === "sudo" || text === "env") {
+				atCommandStart = true;
+				wrapperPending = true;
+			} else {
+				atCommandStart = false;
+				wrapperPending = false;
+			}
+		} else if (wrapperPending) {
+			// A wrapper's options and option arguments are not command names.
+			// The first ordinary word after them is handled by the special case
+			// below when the next token is seen.
+			atCommandStart = false;
+		}
+		text = "";
+		quoted = false;
+	};
+
+	for (let index = 0; index < command.length; index++) {
+		const ch = command[index];
+		if (quote !== undefined) {
+			if (ch === quote) {
+				quote = undefined;
+				continue;
+			}
+			if (quote === '"' && ch === "\\" && index + 1 < command.length) {
+				text += command[++index];
+				continue;
+			}
+			text += ch;
+			continue;
+		}
+		if (ch === "'" || ch === '"') {
+			quote = ch;
+			quoted = true;
+			continue;
+		}
+		if (ch === "\\" && index + 1 < command.length) {
+			text += command[++index];
+			quoted = true;
+			continue;
+		}
+		if (/\s/.test(ch)) {
+			flush();
+			previous = ch;
+			continue;
+		}
+		if (isSeparator(ch)) {
+			flush();
+			atCommandStart = true;
+			wrapperPending = false;
+			previous = ch;
+			continue;
+		}
+		// `sudo -u user tmux` and `env FOO=bar tmux` need the wrapped command
+		// recognized. Options, option arguments, and environment assignments
+		// stay outside command position.
+		if (text.length === 0 && wrapperPending && previous && /\s/.test(previous)) {
+			if (text.length === 0 && ch === "-") {
+				// The option itself is not a command; its argument is also skipped.
+				atCommandStart = false;
+			}
+		}
+		if (text.length === 0 && wrapperPending && atCommandStart) {
+			atCommandStart = true;
+		}
+		text += ch;
+	}
+	flush();
+	return tokens;
+}
+
+interface Invocation {
+	verb: string;
+	args: string[];
+	socketArgs: string[];
+	socket?: { flag: "-L" | "-S"; value: string };
+}
+
+function parseInvocation(tokens: Token[]): Invocation | undefined {
+	let index = 0;
+	const socketArgs: string[] = [];
+	let socket: Invocation["socket"];
+	while (index < tokens.length && !tokens[index].commandStart) {
+		const option = tokens[index].text;
+		if (option === "--") {
+			index++;
+			break;
+		}
+		if (option === "-L" || option === "-S") {
+			const value = tokens[index + 1];
+			if (!value || value.commandStart) return undefined;
+			socket = { flag: option, value: value.text };
+			socketArgs.push(option, value.text);
+			index += 2;
+			continue;
+		}
+		if (option.startsWith("-L") || option.startsWith("-S")) {
+			const flag = option.slice(0, 2) as "-L" | "-S";
+			const value = option.slice(2);
+			if (!value) return undefined;
+			socket = { flag, value };
+			socketArgs.push(flag, value);
+			index++;
+			continue;
+		}
+		if (option.startsWith("-")) {
+			index++;
+			continue;
+		}
+		break;
+	}
+	const verb = tokens[index];
+	if (!verb || verb.commandStart) return undefined;
+	const args: string[] = [];
+	for (index++; index < tokens.length && !tokens[index].commandStart; index++) args.push(tokens[index].text);
+	return { verb: verb.text, args, socketArgs, socket };
+}
+
+function targetFromArgs(args: string[]): string | undefined {
+	for (let index = 0; index < args.length; index++) {
+		if (args[index] === "-t") return args[index + 1];
+		if (args[index].startsWith("-t") && args[index].length > 2) return args[index].slice(2);
+	}
+	return undefined;
+}
+
+function collectShellPayloads(tokens: Token[]): string[] {
+	const payloads: string[] = [];
+	for (let index = 0; index < tokens.length; index++) {
+		const token = tokens[index];
+		if (!token.commandStart || !SHELL_RUNNERS.has(token.text)) continue;
+		for (let cursor = index + 1; cursor < tokens.length && !tokens[cursor].commandStart; cursor++) {
+			if (tokens[cursor].text === "-c" && tokens[cursor + 1]?.quoted) {
+				payloads.push(tokens[cursor + 1].text);
+				break;
+			}
+		}
+	}
+	return payloads;
+}
+
+function collectShellScripts(tokens: Token[], cwd: string): string[] {
+	const scripts: string[] = [];
+	for (let index = 0; index < tokens.length; index++) {
+		const token = tokens[index];
+		if (token.commandStart && (token.text.startsWith("./") || token.text.startsWith("/"))) {
+			scripts.push(path.resolve(cwd, token.text));
+			continue;
+		}
+		if (!token.commandStart || !SHELL_RUNNERS.has(token.text)) continue;
+		for (let cursor = index + 1; cursor < tokens.length && !tokens[cursor].commandStart; cursor++) {
+			const argument = tokens[cursor].text;
+			if (argument === "-c") break;
+			if (argument.startsWith("-")) continue;
+			scripts.push(path.resolve(cwd, argument));
+			break;
+		}
+	}
+	return scripts;
+}
+
+interface Identity {
+	socketPath: string;
+	paneId: string;
+}
+
+function currentIdentity(env: Record<string, string | undefined>): Identity | undefined {
+	const tmux = env.TMUX;
+	const paneId = env.TMUX_PANE;
+	const socketPath = tmux?.split(",")[0];
+	return socketPath && paneId ? { socketPath, paneId } : undefined;
+}
+
+function socketPathFor(
+	socket: NonNullable<Invocation["socket"]>,
+	env: Record<string, string | undefined>,
+	cwd: string,
+	uid: number,
+): string {
+	if (socket.flag === "-S") return path.isAbsolute(socket.value) ? socket.value : path.resolve(cwd, socket.value);
+	return path.join(env.TMUX_TMPDIR ?? "/tmp", `tmux-${uid}`, socket.value);
+}
+
+function sameSocket(left: string, right: string): boolean {
+	if (left === right) return true;
+	try {
+		return fs.realpathSync(left) === fs.realpathSync(right);
+	} catch {
+		return false;
+	}
+}
+
+function assignedTmuxSocket(tokens: Token[], commandIndex: number): string | undefined {
+	for (let index = commandIndex - 1; index >= 0 && commandIndex - index <= 4; index--) {
+		const assignment = tokens[index].text.match(/^TMUX=([^,\s]+)/);
+		if (assignment) return assignment[1];
+		if (!tokens[index].commandStart) break;
+	}
+	return undefined;
+}
+
+const defaultResolvePaneId: TmuxPaneResolver = async ({ socketArgs, target, env }) => {
+	const processHandle = Bun.spawn(["tmux", ...socketArgs, "display-message", "-p", "-t", target, "#{pane_id}"], {
+		env,
+		stdin: "ignore",
+		stdout: "pipe",
+		stderr: "ignore",
+	});
+	const killTimer = setTimeout(() => processHandle.kill(), 2_000);
+	try {
+		const output = await new Response(processHandle.stdout).text();
+		await processHandle.exited;
+		const paneId = output.trim().split("\n")[0];
+		return paneId?.startsWith("%") ? paneId : undefined;
+	} finally {
+		clearTimeout(killTimer);
+	}
+};
+
+export async function checkTmuxSelfInjection(
+	command: string,
+	options: TmuxSelfInjectionOptions = {},
+	depth = 0,
+): Promise<TmuxSelfInjectionResult> {
+	const env = options.env ?? process.env;
+	const identity = currentIdentity(env);
+	if (!identity) return { block: false };
+	const cwd = options.cwd ?? env.PWD ?? ".";
+	const uid = typeof process.getuid === "function" ? process.getuid() : 0;
+	const resolvePaneId = options.resolvePaneId ?? defaultResolvePaneId;
+	const tokens = tokenize(command);
+
+	for (let index = 0; index < tokens.length; index++) {
+		if (!tokens[index].commandStart || (tokens[index].text !== "tmux" && !tokens[index].text.endsWith("/tmux")))
+			continue;
+		const invocation = parseInvocation(tokens.slice(index + 1));
+		if (!invocation || !INPUT_VERBS.has(invocation.verb)) continue;
+		const assignedSocket = assignedTmuxSocket(tokens, index);
+		const commandSocket = invocation.socket ? socketPathFor(invocation.socket, env, cwd, uid) : assignedSocket;
+		if (commandSocket && !sameSocket(commandSocket, identity.socketPath)) continue;
+
+		const target = targetFromArgs(invocation.args);
+		if (target === undefined) {
+			return {
+				block: true,
+				reason: `Blocked: ${invocation.verb} without a target would inject keystrokes into this agent pane (${identity.paneId}).`,
+			};
+		}
+		if (target === identity.paneId) {
+			return {
+				block: true,
+				reason: `Blocked: ${invocation.verb} targets this agent pane (${identity.paneId}); injected bytes would become a forged user turn.`,
+			};
+		}
+		if (!target.startsWith("%")) {
+			const resolved = await resolvePaneId({
+				socketArgs: invocation.socketArgs,
+				target,
+				env: { ...env, TMUX: `${identity.socketPath},0,0` } as Record<string, string>,
+			});
+			if (resolved !== undefined && resolved !== identity.paneId) continue;
+			if (resolved === identity.paneId || resolved === undefined) {
+				return {
+					block: true,
+					reason:
+						resolved === identity.paneId
+							? `Blocked: ${invocation.verb} target ${target} resolves to this agent pane (${identity.paneId}); injected bytes would become a forged user turn.`
+							: `Blocked: could not verify that ${invocation.verb} target ${target} is a different pane on the current tmux server; refusing fail-closed.`,
+				};
+			}
+		}
+	}
+
+	if (depth < MAX_INDIRECTION_DEPTH) {
+		for (const payload of collectShellPayloads(tokens)) {
+			const result = await checkTmuxSelfInjection(payload, options, depth + 1);
+			if (result.block) return result;
+		}
+		for (const scriptPath of collectShellScripts(tokens, cwd)) {
+			try {
+				const file = Bun.file(scriptPath);
+				if (!(await file.exists()) || file.size > 1_000_000) continue;
+				const script = await file.text();
+				const result = await checkTmuxSelfInjection(script, options, depth + 1);
+				if (result.block) return result;
+			} catch {
+				// An unreadable or missing script is not itself evidence that it
+				// targets this pane; let the shell report the normal file error.
+			}
+		}
+	}
+	return { block: false };
+}

package/src/tools/tool-catalog.generated.ts

@@ -2319,7 +2319,7 @@ export const TOOL_CATALOG: Readonly<Record<string, ToolCatalogEntry>> = {
 	"job": {
 		"name": "job",
 		"label": "Job",
-		"description": "Inspects, waits, or cancels async jobs.\n\nBackground job results are delivered automatically when complete. Jobs that back task subagents should be controlled via the `subagent` tool when it is available; use `job` for non-subagent jobs (async bash, monitors) and as a compatibility fallback. Running job output stays quiet by default to avoid flooding the conversation; use `tail` when you explicitly want to show/reopen retained output. Reach for this tool only when you need to inspect or intervene.\n\nIn the interactive TUI, supported managed foreground bash can be folded into a background job by pressing `Ctrl+B` twice while it is running. Raw shell `Ctrl+Z`/`bg` is not the supported path inside GJC because it bypasses job ownership and output-routing contracts.\n\n# Operations\n\n## `list: true`\nUse to inspect what's running.\n\n## `tail: [id, …]`\nShow the retained output buffer for one or more background jobs without waiting.\n- Use this to reopen/tail a backgrounded long-running bash/tool output after folding it away.\n- Output is bounded by the manager retention window; stale cursors may report that only the retained tail is available.\n- Prefer `tail` over polling when you only need to peek at progress, so the conversation can continue without flooding the TUI.\n\n## `poll: [id, …]`\nBlock until the specified jobs finish or the wait window (~30 s, not configurable) elapses.\n- Use when you are genuinely blocked on a result and have no other work to do.\n- Returns the current snapshot when the timer elapses; running jobs remain running.\n- Completed jobs include their final output in the returned snapshot.\n\n## `cancel: [id, …]`\nStop running jobs.\n- Use when a job is stalled, hung, or no longer needed.\n- Returns immediately after cancelling.",
+		"description": "Inspects, waits, or cancels async jobs.\n\nBackground job results are delivered automatically when complete. Jobs that back task subagents should be controlled via the `subagent` tool when it is available; use `job` for non-subagent jobs (async bash, monitors) and as a compatibility fallback. Running job output stays quiet by default to avoid flooding the conversation; use `tail` when you explicitly want to show/reopen retained output. Reach for this tool only when you need to inspect or intervene.\n\nIn the interactive TUI, a running foreground command can be folded into a background job by pressing the fold chord twice (default `Alt+Shift+B`, plus `Cmd+B` on macOS; remappable via `app.tool.backgroundFold`). This covers managed non-PTY bash, editor/ACP client-terminal commands, and PTY-mode commands. A folded job keeps its original deadline, is never killed or restarted by folding, and its result wakes a later turn automatically; a folded PTY continues output-only and no longer accepts input. `task`/`subagent` waits are not foldable. Raw shell `Ctrl+Z`/`bg` is not the supported path inside GJC because it bypasses job ownership and output-routing contracts.\n\n# Operations\n\n## `list: true`\nUse to inspect what's running.\n\n## `tail: [id, …]`\nShow the retained output buffer for one or more background jobs without waiting.\n- Use this to reopen/tail a backgrounded long-running bash/tool output after folding it away.\n- Output is bounded by the manager retention window; stale cursors may report that only the retained tail is available.\n- Prefer `tail` over polling when you only need to peek at progress, so the conversation can continue without flooding the TUI.\n\n## `poll: [id, …]`\nBlock until the specified jobs finish or the wait window (~30 s, not configurable) elapses.\n- Use when you are genuinely blocked on a result and have no other work to do.\n- Returns the current snapshot when the timer elapses; running jobs remain running.\n- Completed jobs include their final output in the returned snapshot.\n\n## `cancel: [id, …]`\nStop running jobs.\n- Use when a job is stalled, hung, or no longer needed.\n- Returns immediately after cancelling.",
 		"parameters": {
 			"type": "object",
 			"properties": {