@gajae-code/coding-agent 0.15.5 → 0.16.0

package/dist/types/session/session-manager.d.ts

@@ -1175,7 +1175,63 @@ export declare class SessionManager {
     runWithCwdReadLease<T>(fn: () => Promise<T>): Promise<T>;
     /** Wait for any in-flight exclusive cwd transition to settle. */
     joinCwdTransition(): Promise<void>;
+    closeCwdMoveAdmission(): Promise<void>;
     getCwdGeneration(): number;
+    /**
+     * Register a listener invoked after every committed `moveTo`. Returns an idempotent
+     * unregister handle. Every move surface funnels through `moveTo`, so a single
+     * registration covers `move_session`, `/move`, and SDK/ACP `session.cwd.move`.
+     */
+    registerAfterMoveListener(listener: (move: {
+        previousCwd: string;
+        newCwd: string;
+        previousSessionFile: string | undefined;
+    }) => void | Promise<void>): () => void;
+    registerBeforeMoveListener(listener: (move: {
+        previousCwd: string;
+        newCwd: string;
+        previousSessionFile: string | undefined;
+        newSessionFile: string | undefined;
+        previousCwdIdentity: {
+            dev: bigint;
+            ino: bigint;
+        };
+        newCwdIdentity: {
+            dev: bigint;
+            ino: bigint;
+        };
+        preserveRecoveryJournal?: boolean;
+    }) => void | Promise<void>): () => void;
+    registerMovePublicationListener(listener: (move: {
+        previousCwd: string;
+        newCwd: string;
+        previousSessionFile: string | undefined;
+        newSessionFile: string | undefined;
+        previousCwdIdentity: {
+            dev: bigint;
+            ino: bigint;
+        };
+        newCwdIdentity: {
+            dev: bigint;
+            ino: bigint;
+        };
+        preserveRecoveryJournal?: boolean;
+    }) => void | Promise<void>): () => void;
+    registerMoveAbortListener(listener: (move: {
+        previousCwd: string;
+        newCwd: string;
+        previousSessionFile: string | undefined;
+        newSessionFile: string | undefined;
+        previousCwdIdentity: {
+            dev: bigint;
+            ino: bigint;
+        };
+        newCwdIdentity: {
+            dev: bigint;
+            ino: bigint;
+        };
+        preserveRecoveryJournal?: boolean;
+    }) => void | Promise<void>): () => void;
     static openNoFollowDirectory(dir: string): Promise<fs.promises.FileHandle>;
     /**
      * Claim process-cwd authority for `manager` when it is unowned or the prior
@@ -1215,6 +1271,15 @@ export declare class SessionManager {
                 bigint: true;
             }) => Promise<fs.BigIntStats>;
         };
+        expectedSourceIdentity?: {
+            dev: bigint;
+            ino: bigint;
+        };
+        sourceHandle?: {
+            stat: (opts: {
+                bigint: true;
+            }) => Promise<fs.BigIntStats>;
+        };
     }): Promise<void>;
     isPersisted(): boolean;
     stageDefaultModelSelection(model: string, thinkingLevel: string | undefined, options?: {

package/dist/types/session/yield-queue.d.ts

@@ -15,8 +15,9 @@ export interface YieldDispatcher<P> {
 export interface YieldQueueOptions {
     isStreaming: () => boolean;
     injectStreaming(msg: AgentMessage): void;
-    injectIdle(messages: AgentMessage[]): Promise<void>;
-    scheduleIdleFlush(run: () => Promise<void>): void;
+    injectIdle(messages: AgentMessage[], signal?: AbortSignal): Promise<void>;
+    scheduleIdleFlush(run: (signal?: AbortSignal) => Promise<void>, onSkip: () => void): void;
+    getIdleFlushSignal?(): AbortSignal | undefined;
 }
 type YieldFlushMode = "streaming" | "idle";
 export declare class YieldQueue {
@@ -25,8 +26,8 @@ export declare class YieldQueue {
     register<P>(kind: string, dispatcher: YieldDispatcher<P>): () => void;
     enqueue<P>(kind: string, entry: P): void;
     has(kind?: string): boolean;
-    flush(mode: YieldFlushMode): Promise<void>;
-    clear(): void;
+    flush(mode: YieldFlushMode, signal?: AbortSignal): Promise<void>;
+    clear(onDrop?: (kind: string, entries: readonly unknown[]) => void): void;
     /** Drop only the queued entries of a single kind, leaving other kinds intact. */
     clearKind(kind: string): void;
     /**

package/dist/types/setup/frictionless-onboarding.d.ts

@@ -68,6 +68,7 @@ export declare function hasCorroboratedRecentEvidence(evidence: readonly Onboard
 export declare function shouldOfferOnboarding(state: FrictionlessOnboardingState): boolean;
 export interface AutomaticOnboardingInput {
     normalInteractive: boolean;
+    automation?: boolean;
     initialMessage?: string;
     initialMessages: readonly string[];
     initialImages?: readonly unknown[];

package/dist/types/telemetry/control.d.ts

@@ -0,0 +1,11 @@
+/** Process-wide emergency stop; it cannot be enabled by project dotenv files. */
+export declare const TELEMETRY_KILL_SWITCH_ENV: "GJC_DISABLE_TELEMETRY";
+export interface TelemetryStatus {
+    enabled: boolean;
+    disabledByKillSwitch: boolean;
+    reason: "enabled" | "setting_disabled" | "kill_switch";
+}
+export interface TelemetrySettingsReader {
+    get(path: "telemetry.enabled"): boolean;
+}
+export declare function getTelemetryStatus(settings: TelemetrySettingsReader): TelemetryStatus;

package/dist/types/telemetry/events.d.ts

@@ -0,0 +1,20 @@
+export declare const TELEMETRY_SCHEMA_VERSION: 1;
+export declare const TELEMETRY_INSTALL_ID_FILE: "telemetry-install-id";
+export declare const TELEMETRY_EVENT_NAMES: readonly ["update_check_started", "update_check_completed", "update_install_started", "update_install_completed", "update_install_failed"];
+export type TelemetryEventName = (typeof TELEMETRY_EVENT_NAMES)[number];
+export interface TelemetryEvent {
+    schemaVersion: typeof TELEMETRY_SCHEMA_VERSION;
+    event: TelemetryEventName;
+    installId: string;
+    occurredAt: string;
+    channel?: "stable" | "nightly";
+    result?: "available" | "up_to_date" | "installed" | "failed" | "skipped";
+    installMethod?: "bun" | "npm" | "binary" | "migrate";
+}
+/**
+ * Serialize only the versioned telemetry allowlist. Unknown fields are never
+ * emitted; forbidden fields anywhere in the input fail closed.
+ */
+export declare function serializeTelemetryEvent(input: unknown): string;
+/** Load or create a random UUIDv4 that is not derived from machine data. */
+export declare function getTelemetryInstallId(filePath?: string): Promise<string>;

package/dist/types/telemetry/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./control";
+export * from "./events";
+export * from "./transport";

package/dist/types/telemetry/transport.d.ts

@@ -0,0 +1,22 @@
+import { getTelemetryStatus } from "./control";
+import { type TelemetryEvent, type TelemetryEventName } from "./events";
+export declare const TELEMETRY_ENDPOINT: "https://telemetry.gajae.dev/v1/events";
+export declare const TELEMETRY_MAX_IN_FLIGHT: 2;
+export declare const TELEMETRY_TIMEOUT_MS: 1500;
+export declare const TELEMETRY_FLUSH_TIMEOUT_MS: 2000;
+interface TelemetryTransportDependencies {
+    fetchImpl?: (input: string | URL, init?: RequestInit) => Promise<Response>;
+    endpoint?: string;
+}
+export type TelemetryDetails = Pick<TelemetryEvent, "channel" | "result" | "installMethod">;
+/**
+ * Best-effort transport. The caller only schedules work; disabled telemetry,
+ * queue saturation, network errors, and non-2xx responses are all ignored.
+ */
+export declare function sendTelemetryEvent(settings: Parameters<typeof getTelemetryStatus>[0], event: TelemetryEvent, deps?: TelemetryTransportDependencies): Promise<void>;
+export declare function resetTelemetryTransportForTest(): Promise<void>;
+/** Schedule an event without making telemetry part of the caller's lifecycle. */
+export declare function recordTelemetryEvent(event: TelemetryEventName, details: TelemetryDetails): Promise<void>;
+/** Wait briefly for accepted events so explicit process exits do not drop them. */
+export declare function flushTelemetryEvents(timeoutMs?: 2000): Promise<void>;
+export {};

package/dist/types/tools/bash-interactive.d.ts

@@ -6,6 +6,24 @@ export interface BashInteractiveResult extends OutputSummary {
     cancelled: boolean;
     timedOut: boolean;
 }
+/** Live controls handed to the caller once the PTY run owns its session. */
+export interface InteractivePtyControls {
+    /**
+     * Detach the overlay and settle the foreground call with `foldResult`, leaving
+     * the process running and still writing into the sink. Idempotent.
+     */
+    detachObserver: (foldResult: BashInteractiveResult) => "resolved" | "already-settled";
+    /**
+     * Resolves with the run's real summary when the process actually ends,
+     * regardless of whether the foreground was folded. A folded run is delivered
+     * from this, so its result can never be silently dropped.
+     */
+    terminalCompletion: Promise<BashInteractiveResult>;
+    /** Kill the owned process during owner teardown; the observer never calls this. */
+    kill: () => void;
+    /** Stop forwarding the foreground abort signal after ownership transfers on fold. */
+    detachForegroundCancellation: () => void;
+}
 export declare function runInteractiveBashPty(ui: NonNullable<AgentToolContext["ui"]>, options: {
     command: string;
     cwd: string;
@@ -18,4 +36,9 @@ export declare function runInteractiveBashPty(ui: NonNullable<AgentToolContext["
     spillThreshold?: number;
     headBytes?: number;
     settings?: Settings;
+    /** Receives live controls once the session is running; used to register a fold. */
+    onControls?: (controls: InteractivePtyControls) => void;
+    onFoldKey?: () => boolean;
+    onDismiss?: () => void;
+    onOutput?: (chunk: string) => void;
 }): Promise<BashInteractiveResult>;

package/dist/types/tools/bash.d.ts

@@ -4,6 +4,7 @@ import * as z from "zod/v4";
 import { type BashArtifactSaveResult } from "../exec/bash-executor";
 import type { RenderResultOptions } from "../extensibility/custom-tools/types";
 import { type Theme } from "../modes/theme/theme";
+import { type SdkSpawnArgs } from "../sdk/cli/master-cli";
 import type { ToolSession } from ".";
 import { type OutputMeta } from "./output-meta";
 export declare const BASH_DEFAULT_PREVIEW_LINES = 10;
@@ -48,6 +49,9 @@ export interface BashToolDetails {
 export declare function summarizeBashToolActivity(kind: "args" | "result", value: unknown): string | undefined;
 export interface BashToolOptions {
 }
+export declare function isStrictDirectSdkSpawnCommand(command: string): boolean;
+export declare function parseDirectSdkSpawnArgs(command: string): SdkSpawnArgs;
+export declare function masterCommandEnvOverrides(env: Record<string, string> | undefined, directMasterSpawn: boolean): Record<string, string>;
 export declare class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
     #private;
     private readonly session;

package/dist/types/tools/gh.d.ts

@@ -322,6 +322,14 @@ export interface PrDiffFile {
     changeType: "modified" | "added" | "deleted" | "renamed" | "binary";
     /** Pre-image path for renames/deletes; same as `path` otherwise. */
     oldPath?: string;
+    /**
+     * Set when `path` kept its C-style escaped source form because the quoted
+     * token held invalid UTF-8 or a malformed escape; distinguishes it from a
+     * valid path whose decoded text looks identical.
+     */
+    pathEscaped?: boolean;
+    /** Same as {@link PrDiffFile.pathEscaped}, for `oldPath`. */
+    oldPathEscaped?: boolean;
     /** Byte offset of the section's `diff --git` line in the unified diff. */
     startOffset: number;
     /** Byte offset of the next section (or end-of-text). */

package/dist/types/tools/index.d.ts

@@ -12,6 +12,7 @@ import type { AgentRegistry } from "../registry/agent-registry";
 import type { ForkContextSeed, ForkContextSeedOptions, PurgeQueuedCustomMessagesResult } from "../session/agent-session";
 import type { ArtifactManager } from "../session/artifacts";
 import type { ClientBridge } from "../session/client-bridge";
+import type { FoldAdapter } from "../session/fold-coordinator";
 import type { CustomMessage } from "../session/messages";
 import type { ToolChoiceQueue } from "../session/tool-choice-queue";
 import type { SkillActiveEntry } from "../skill-state/active-state";
@@ -184,12 +185,12 @@ export interface ToolSession {
     assertEvalExecutionAllowed?: () => void;
     /** Track tool-owned eval work so session disposal can await/abort it like direct session eval runs. */
     trackEvalExecution?<T>(execution: Promise<T>, abortController: AbortController): Promise<T>;
-    /** Register a safe request handler that asks a managed foreground bash call to fold into a background job. */
-    registerForegroundBashBackgroundRequestHandler?: (handler: () => void) => () => void;
-    /** Whether a managed foreground bash call is currently foldable into a background job. */
+    /** Register a foldable foreground wait so the fold chord can move it into a background job. */
+    registerForegroundFoldParticipant?: (adapter: FoldAdapter) => () => void;
+    /** Whether a foreground wait is currently foldable into a background job. */
     hasForegroundBashBackgroundRequestHandler?: () => boolean;
-    /** Request that the active managed foreground bash call fold into a background job, if supported. */
-    requestForegroundBashBackground?: () => boolean;
+    /** Request that the active foreground wait fold into a background job, if supported. */
+    requestForegroundBashBackground?: () => Promise<boolean>;
     /** Get the session-owned or inherited async job manager. */
     getAsyncJobManager?: () => AsyncJobManager | undefined;
     /** Resolves when the session queues user steering (or `signal` aborts) without consuming it; wait-style tools use this to end their observation early. */
@@ -218,6 +219,10 @@ export interface ToolSession {
     bashAllowedPrefixes?: string[];
     /** Restriction policy for sessions that deliberately expose a narrow bash surface. */
     bashRestrictionProfile?: BashRestrictionProfile;
+    /** Process-local master capability injected into direct Bash children only. */
+    getMasterBashCapability?: () => string | undefined;
+    /** Stable master lineage identity used across session switches and branches. */
+    getMasterOwnerSessionId?: () => string | undefined;
     /** Optional per-session allowlist for tools exposed through search_tool_bm25. */
     discoverableToolAllowedNames?: readonly string[];
     /** Throw instead of warn when toolNames contains an unknown name. */

package/dist/types/web/search/providers/base.d.ts

@@ -17,7 +17,10 @@ export declare const SEARXNG_BEARER_CREDENTIAL_PREFIX = "gjc-searxng-bearer:";
 /**
  * Shared web search parameters passed to providers.
  *
- * `authStorage` is the **only** credential source providers may consult.
+ * `authStorage` is the credential source for canonical providers. Native
+ * active-model search may instead use `activeModelContext.resolveCredentials`,
+ * which is supplied by ModelRegistry so rotating config credentials and
+ * generated headers are refreshed before the request.
  * Opening a sibling SQLite handle or calling provider-direct refresh helpers
  * (e.g. `refreshOpenAIOpenAI code backendToken`, `refreshGoogleCloudToken`) is prohibited:
  * it races the broker's per-credential refresh and POSTs the broker sentinel
@@ -72,8 +75,8 @@ export interface SearchParams {
     codeExecution?: Record<string, unknown>;
     urlContext?: Record<string, unknown>;
     /**
-     * The single source of truth for credentials. Providers MUST consult this
-     * handle exclusively (`getApiKey` for bearer-style auth, `getOAuthAccess`
+     * The canonical source of truth for credentials. Providers MUST consult this
+     * handle (`getApiKey` for bearer-style auth, `getOAuthAccess`
      * when identity metadata is required). Do not open `AgentStorage` or any
      * `AuthCredentialStore` directly — that bypasses the broker pipeline and
      * the per-credential single-flight refresh.
@@ -102,7 +105,9 @@ export declare abstract class SearchProvider {
      */
     abstract isAvailable(authStorage: AuthStorage, settings?: SearchProviderSettings): Promise<boolean> | boolean;
     /**
-     * Execute a search. Credentials MUST be resolved through `params.authStorage`.
+     * Execute a search. Canonical credentials MUST be resolved through
+     * `params.authStorage`; active-model credentials MUST use the injected
+     * resolver when one is present.
      */
     abstract search(params: SearchParams): Promise<SearchResponse>;
 }

package/dist/types/web/search/providers/xai.d.ts

@@ -5,7 +5,7 @@
  * Endpoint: POST https://api.x.ai/v1/responses
  */
 import type { AuthStorage } from "@gajae-code/ai/core";
-import type { SearchCitation, SearchResponse } from "../../../web/search/types";
+import type { ActiveSearchModelContext, SearchCitation, SearchResponse } from "../../../web/search/types";
 import type { SearchParams } from "./base";
 import { SearchProvider } from "./base";
 declare const XAI_SEARCH_MODES: readonly ["web", "x", "web_and_x"];
@@ -31,6 +31,7 @@ export interface XaiSearchParams {
     signal?: AbortSignal;
     authStorage: AuthStorage;
     sessionId?: string;
+    activeModelContext?: ActiveSearchModelContext;
 }
 /** Test seam: the xAI search base URL as resolved from trusted env. */
 export declare function resolveXaiSearchBaseUrlForTest(): string;

package/dist/types/web/search/types.d.ts

@@ -6,6 +6,16 @@
 /** Supported web search providers */
 export type SearchProviderId = "duckduckgo" | "insane" | "exa" | "brave" | "jina" | "kimi" | "zai" | "anthropic" | "perplexity" | "gemini" | "codex" | "xai" | "tavily" | "parallel" | "kagi" | "synthetic" | "searxng" | "openai-compatible";
 export type WebSearchMode = "on" | "off" | "auto";
+/** Credentials and request headers resolved for the active model. */
+export interface ActiveSearchModelCredentials {
+    apiKey?: string;
+    headers?: Record<string, string>;
+}
+/** Refresh-aware resolver supplied by the model registry for native search. */
+export type ActiveSearchModelCredentialResolver = (options: {
+    sessionId?: string;
+    signal?: AbortSignal;
+}) => Promise<ActiveSearchModelCredentials>;
 export interface ActiveSearchModelContext {
     provider: string;
     modelId: string;
@@ -13,6 +23,10 @@ export interface ActiveSearchModelContext {
     api: string;
     baseUrl?: string;
     headers?: Record<string, string>;
+    /** Resolve the active model key and current headers before each native search. */
+    resolveCredentials?: ActiveSearchModelCredentialResolver;
+    /** True when registry-owned auth or transport overrides this active model. */
+    ownerAuthOverride?: boolean;
     webSearch?: WebSearchMode;
 }
 export declare const CONFIGURABLE_SEARCH_PROVIDER_IDS: readonly ["duckduckgo", "insane", "exa", "brave", "jina", "kimi", "zai", "anthropic", "perplexity", "gemini", "codex", "xai", "tavily", "parallel", "kagi", "synthetic", "searxng"];

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.15.5",
+	"version": "0.16.0",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -56,12 +56,12 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.15.5",
-		"@gajae-code/agent-core": "0.15.5",
-		"@gajae-code/ai": "0.15.5",
-		"@gajae-code/natives": "0.15.5",
-		"@gajae-code/tui": "0.15.5",
-		"@gajae-code/utils": "0.15.5",
+		"@gajae-code/stats": "0.16.0",
+		"@gajae-code/agent-core": "0.16.0",
+		"@gajae-code/ai": "0.16.0",
+		"@gajae-code/natives": "0.16.0",
+		"@gajae-code/tui": "0.16.0",
+		"@gajae-code/utils": "0.16.0",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",
@@ -128,6 +128,8 @@
 		"./slash-commands/helpers/mcp": null,
 		"./session/session-manager-internal": null,
 		"./session/session-manager-internal.js": null,
+		"./session/sdk-run-capability": null,
+		"./session/sdk-run-capability.js": null,
 		"./sdk": {
 			"types": "./dist/types/sdk/index.d.ts",
 			"import": "./src/sdk/index.ts"
@@ -275,6 +277,7 @@
 			"types": "./dist/types/commit/utils/*.d.ts",
 			"import": "./src/commit/utils/*.ts"
 		},
+		"./config/internal/*": null,
 		"./config/*": {
 			"types": "./dist/types/config/*.d.ts",
 			"import": "./src/config/*.ts"

package/scripts/generate-hotkeys-docs.ts

@@ -2,6 +2,7 @@ import { readFileSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
 import {
 	defaultClipboardPasteImageKeysForPlatform,
+	defaultForegroundFoldKeysForPlatform,
 	defaultMessageQueueKeysForPlatform,
 	KEYBINDINGS,
 } from "../src/config/keybindings";
@@ -27,6 +28,9 @@ function defaultKeys(
 			case "app.clipboard.pasteImage":
 				keys = defaultClipboardPasteImageKeysForPlatform(platform);
 				break;
+			case "app.tool.backgroundFold":
+				keys = defaultForegroundFoldKeysForPlatform(platform);
+				break;
 			default:
 				keys = value.defaultKeys;
 		}

package/scripts/generate-sdk-operation-inventory.ts

@@ -107,6 +107,12 @@ const LOCKED_EXCLUSIONS: Readonly<Record<string, string>> = {
 	"agent_session:activeMidRunBarrierCountForTests": "read-only test seam, not a user-facing SDK control seam",
 	"agent_session:activeMidRunMaintenanceCountForTests": "read-only test seam, not a user-facing SDK control seam",
 	"agent_session:getPendingNextTurnMessagesForTests": "read-only test seam, not a user-facing SDK control seam",
+	"agent_session:queueCoordinatorRuntimeStatePersistForTests":
+		"test-only coordinator persistence ordering seam, not a user-facing SDK control seam",
+	"agent_session:parkAgentEndForCoordinatorPersistForTests":
+		"test-only parked terminal persistence seam, not a user-facing SDK control seam",
+	"agent_session:flushParkedAgentEndForCoordinatorPersistForTests":
+		"test-only parked terminal flush seam, not a user-facing SDK control seam",
 	"agent_session:setCancelAndSubmitAbortOutcomeProviderForTests":
 		"test-only cancellation seam, not a user-facing SDK control seam",
 	"agent_session:getAgentId": "internal accessor/plumbing, not a user-facing control seam",
@@ -127,11 +133,11 @@ const LOCKED_EXCLUSIONS: Readonly<Record<string, string>> = {
 		"internal ACP lifecycle quiescence plumbing, not a user-facing control seam",
 	"agent_session:getToolByName": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:getToolForExecution": "internal accessor/plumbing, not a user-facing control seam",
-	"agent_session:registerForegroundBashBackgroundRequestHandler":
-		"internal accessor/plumbing, not a user-facing control seam",
+	"agent_session:registerForegroundFoldParticipant": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:hasForegroundBashBackgroundRequestHandler":
 		"internal accessor/plumbing, not a user-facing control seam",
-	"agent_session:requestForegroundBashBackground": "internal accessor/plumbing, not a user-facing control seam",
+	"agent_session:requestForegroundBashBackground": "internal accessor/plumbing, not a user-facing SDK control seam",
+
 	"agent_session:getSelectedMCPToolNames": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:isToolDiscoveryEnabled": "internal accessor/plumbing, not a user-facing control seam",
 	"agent_session:getDiscoverableToolSearchIndex": "internal accessor/plumbing, not a user-facing control seam",

package/scripts/verify-gjc-sdk-canonicalization.ts

@@ -1567,6 +1567,24 @@ function isTypeOnlyTmuxPrimitiveOccurrence(contents: string, occurrence: TmuxPri
 	return /^\s*(?:export\s+)?type\b/.test(contents.slice(lineStart, lineEnd === -1 ? contents.length : lineEnd));
 }
 
+function isExactTmuxSelfInjectionGuardVerb(
+	file: string,
+	contents: string,
+	occurrence: TmuxPrimitiveOccurrence,
+): boolean {
+	if (file !== "packages/coding-agent/src/tools/tmux-self-injection-guard.ts") return false;
+	const declaration = 'const INPUT_VERBS = new Set(["send-keys", "paste-buffer", "send-prefix"]);';
+	const declarationStart = contents.indexOf(declaration);
+	if (declarationStart === -1 || contents.indexOf(declaration, declarationStart + 1) !== -1) return false;
+	const references = [...contents.matchAll(/\bINPUT_VERBS\b/g)];
+	if (references.length !== 2) return false;
+	const guardUse = "INPUT_VERBS.has(invocation.verb)";
+	const guardUseStart = contents.indexOf(guardUse);
+	if (guardUseStart === -1 || contents.indexOf(guardUse, guardUseStart + 1) !== -1) return false;
+	if (!references.some(reference => reference.index === guardUseStart)) return false;
+	return occurrence.start >= declarationStart && occurrence.end <= declarationStart + declaration.length;
+}
+
 function tmuxMachineBusViolations(file: string, contents: string): string[] {
 	if (isGeneratedDocumentationIndex(file)) return [];
 	const allowedTeamFallbackRanges =
@@ -1581,7 +1599,8 @@ function tmuxMachineBusViolations(file: string, contents: string): string[] {
 		if (
 			isExactTeamFallback ||
 			isExactTmuxScrollCopyModeSendKeys(file, contents, occurrence) ||
-			isTypeOnlyTmuxPrimitiveOccurrence(contents, occurrence)
+			isTypeOnlyTmuxPrimitiveOccurrence(contents, occurrence) ||
+			isExactTmuxSelfInjectionGuardVerb(file, contents, occurrence)
 		)
 			continue;
 		const detail =
@@ -3147,6 +3166,21 @@ fi
 		1,
 		"tmux send-keys content injection is outside sanctioned process lifecycle",
 	);
+	await runSelfTestFixture(
+		{
+			"packages/coding-agent/src/tools/tmux-self-injection-guard.ts":
+				'const INPUT_VERBS = new Set(["send-keys", "paste-buffer", "send-prefix"]);\nfunction guarded(invocation: { verb: string }): void { if (!INPUT_VERBS.has(invocation.verb)) return; }\n',
+		},
+		0,
+	);
+	await runSelfTestFixture(
+		{
+			"packages/coding-agent/src/tools/tmux-self-injection-guard.ts":
+				'const INPUT_VERBS = new Set(["send-keys", "paste-buffer", "send-prefix"]);\nfunction guarded(invocation: { verb: string }): void { if (!INPUT_VERBS.has(invocation.verb)) return; }\nfor (const verb of INPUT_VERBS) Bun.spawnSync(["tmux", verb, "-t", pane, prompt]);\n',
+		},
+		1,
+		"tmux send-keys content injection is outside sanctioned process lifecycle",
+	);
 	await runSelfTestFixture(
 		{
 			"packages/coding-agent/src/gjc-runtime/team-runtime.ts":