@gajae-code/coding-agent 0.16.1 → 0.16.4

package/src/session/agent-session.ts

@@ -36,6 +36,7 @@ import {
 	canContinuePersistedHistory,
 	dispatchedToolIdentity,
 	getAgentTerminalOwnerContext,
+	isContinuingMidRunMaintenanceOutcome,
 	isNonDispatchedToolEvent,
 	type ManagedAttemptContinuationOwnership,
 	type ManagedAttemptDecision,
@@ -882,6 +883,10 @@ export interface AgentSessionConfig {
 	skills?: Skill[];
 	/** Skill loading warnings (already captured by SDK) */
 	skillWarnings?: SkillWarning[];
+	/** Re-enumerate filesystem and marketplace skills after plugin lifecycle changes. */
+	reloadSkills?: (cwd: string) => Promise<{ skills: Skill[]; warnings: SkillWarning[] }>;
+	/** Publish a successfully committed skill catalog to SDK/process snapshots. */
+	onSkillsReloaded?: (skills: Skill[], warnings: SkillWarning[]) => void;
 	/** Custom commands (TypeScript slash commands) */
 	customCommands?: LoadedCustomCommand[];
 	skillsSettings?: SkillsSettings;
@@ -1044,7 +1049,7 @@ type AutoCompactionTerminalStatus =
 	| { kind: "compacted"; continuationScheduled?: boolean }
 	| { kind: "aborted"; source: "signal" | "hook" }
 	| { kind: "skipped"; continuationScheduled?: boolean }
-	| { kind: "failed" };
+	| { kind: "failed"; errorMessage: string };
 
 type ToolOutputPruneResult = {
 	prunedCount: number;
@@ -3124,6 +3129,8 @@ export class AgentSession {
 
 	#skills: Skill[];
 	#skillWarnings: SkillWarning[];
+	#reloadSkills: AgentSessionConfig["reloadSkills"];
+	#onSkillsReloaded: AgentSessionConfig["onSkillsReloaded"];
 
 	// Custom commands (TypeScript slash commands)
 	#customCommands: LoadedCustomCommand[] = [];
@@ -4556,6 +4563,8 @@ export class AgentSession {
 		this.agent.setMainAttemptScopeObserver(scope => this.#bindAttemptScope(scope));
 		this.#skills = config.skills ?? [];
 		this.#skillWarnings = config.skillWarnings ?? [];
+		this.#reloadSkills = config.reloadSkills;
+		this.#onSkillsReloaded = config.onSkillsReloaded;
 		this.#customCommands = config.customCommands ?? [];
 		this.#skillsSettings = config.skillsSettings;
 		this.#modelRegistry = config.modelRegistry;
@@ -5638,6 +5647,27 @@ export class AgentSession {
 		if (failures.length > 0) throw new AggregateError(failures, "Tool session cleanup failed.");
 	}
 
+	#claimToolSessionTransitionCleanups(): Promise<void> {
+		const cleanups = Array.from(this.#toolSessionTransitionCleanups);
+		this.#toolSessionTransitionCleanups.clear();
+		return this.#settleClaimedToolSessionCleanups(cleanups, "Tool session transition cleanup failed.");
+	}
+
+	#claimToolSessionCleanups(): Promise<void> {
+		const cleanups = Array.from(this.#toolSessionCleanups);
+		this.#toolSessionCleanups.clear();
+		return this.#settleClaimedToolSessionCleanups(cleanups, "Tool session cleanup failed.");
+	}
+
+	async #settleClaimedToolSessionCleanups(
+		cleanups: readonly (() => Promise<void> | void)[],
+		message: string,
+	): Promise<void> {
+		const results = await Promise.allSettled(cleanups.map(async cleanup => await cleanup()));
+		const failures = results.flatMap(result => (result.status === "rejected" ? [result.reason] : []));
+		if (failures.length > 0) throw new AggregateError(failures, message);
+	}
+
 	getAsyncJobSnapshot(options?: { recentLimit?: number }): AsyncJobSnapshot | null {
 		// The session's OWNED manager first: /jobs, the status header, and the
 		// active-background count must reflect THIS session's jobs — with
@@ -5918,7 +5948,9 @@ export class AgentSession {
 		const canonicalAdmission = this.#reserveCanonicalMessageAdmission(event);
 		const terminalOwner = event.type === "agent_end" ? getAgentTerminalOwnerContext(event) : undefined;
 		const maintenanceCheckpoint =
-			event.type === "agent_end" && event.stopReason === "maintenance" && event.maintenanceOutcome !== "aborted";
+			event.type === "agent_end" &&
+			event.stopReason === "maintenance" &&
+			isContinuingMidRunMaintenanceOutcome(event.maintenanceOutcome);
 		const terminalClaim =
 			maintenanceCheckpoint || !terminalOwner
 				? undefined
@@ -6196,9 +6228,13 @@ export class AgentSession {
 			this.#requestWorkerIntegrationAttempt();
 		}
 		// A maintenance agent_end is an internal checkpoint only while another
-		// continuation will follow. An aborted maintenance run is its terminal
-		// settlement and must reach public subscribers.
-		if (event.type === "agent_end" && event.stopReason === "maintenance" && event.maintenanceOutcome !== "aborted")
+		// continuation will follow. Failed or aborted maintenance is terminal and
+		// must reach public subscribers.
+		if (
+			event.type === "agent_end" &&
+			event.stopReason === "maintenance" &&
+			isContinuingMidRunMaintenanceOutcome(event.maintenanceOutcome)
+		)
 			return;
 
 		// Hold agent_end until the prompt's finally and all earlier async event work
@@ -6983,7 +7019,7 @@ export class AgentSession {
 
 		if (
 			event.type === "agent_end" &&
-			!(event.stopReason === "maintenance" && event.maintenanceOutcome !== "aborted")
+			!(event.stopReason === "maintenance" && isContinuingMidRunMaintenanceOutcome(event.maintenanceOutcome))
 		) {
 			this.#releaseDeferredSdkFollowUps();
 		}
@@ -6996,28 +7032,33 @@ export class AgentSession {
 			// the same run on the rewritten context (no synthetic prompt), skipping
 			// the goal-runtime / skill-state / retry / compaction finalization a
 			// normal agent_end runs — none of that applies to an in-progress run.
-			// "aborted" settles without resuming; the generation guard drops the
-			// continuation if a newer prompt/abort has moved the run on.
+			// Failed and aborted outcomes fall through to terminal handling. The
+			// generation guard drops a successful continuation if a newer prompt/abort
+			// has moved the run on.
 			if (event.stopReason === "maintenance") {
-				this.#lastAssistantMessage = undefined;
-				const outcome = event.maintenanceOutcome;
-				if (
-					outcome &&
-					outcome !== "aborted" &&
-					!maintenanceWasDisposed &&
-					!this.#isDisposed &&
-					maintenanceGeneration !== undefined &&
-					this.#promptGeneration === maintenanceGeneration
-				) {
-					this.#scheduleAgentContinue({
-						generation: maintenanceGeneration,
-						skipCompactionCheck: true,
-						resourceRunId: activePromptHandle,
-						maintenanceContinuation: true,
-						sdkRunToken: attemptScope ? this.#sdkRunTokensByAttemptScope.get(attemptScope) : undefined,
-					});
+				if (isContinuingMidRunMaintenanceOutcome(event.maintenanceOutcome)) {
+					this.#lastAssistantMessage = undefined;
+					if (
+						!maintenanceWasDisposed &&
+						!this.#isDisposed &&
+						maintenanceGeneration !== undefined &&
+						this.#promptGeneration === maintenanceGeneration
+					) {
+						this.#scheduleAgentContinue({
+							generation: maintenanceGeneration,
+							skipCompactionCheck: true,
+							resourceRunId: activePromptHandle,
+							maintenanceContinuation: true,
+							sdkRunToken: attemptScope ? this.#sdkRunTokensByAttemptScope.get(attemptScope) : undefined,
+						});
+					}
+					return;
 				}
-				return;
+				// Cancellation already owns teardown and terminal publication. Running
+				// normal post-turn finalization here can deadlock abort/dispose while the
+				// maintenance barrier is unwinding. Failed maintenance alone carries the
+				// synthetic assistant error that must flow through terminal handling.
+				if (event.maintenanceOutcome === "aborted") return;
 			}
 			const usage = this.getSessionStats().tokens;
 			await this.#goalRuntime.onAgentEnd({
@@ -7083,6 +7124,13 @@ export class AgentSession {
 				return;
 			}
 			this.#lastSuccessfulYieldToolCallId = undefined;
+			if (event.stopReason === "maintenance" && event.maintenanceOutcome === "failed") {
+				// The maintenance error already terminalized the run. Retrying this
+				// synthetic assistant failure would resubmit the unchanged context that
+				// maintenance failed to rewrite.
+				this.#resolveRetry();
+				return;
+			}
 
 			// Check for retryable errors first (overloaded, rate limit, server errors)
 			if (this.#isRetryableError(msg)) {
@@ -8580,7 +8628,8 @@ export class AgentSession {
 					? this.#sdkRunTokensByAttemptScope.get(deliveryScope as AttemptScope)
 					: undefined;
 		const isTerminalAgentEnd =
-			event.type === "agent_end" && !(event.stopReason === "maintenance" && event.maintenanceOutcome !== "aborted");
+			event.type === "agent_end" &&
+			!(event.stopReason === "maintenance" && isContinuingMidRunMaintenanceOutcome(event.maintenanceOutcome));
 		const finishAttempt = () => {
 			if (!isTerminalAgentEnd) return;
 			// A merged wake batch whose flush fired while still streaming cleared its
@@ -9371,10 +9420,10 @@ export class AgentSession {
 			// one here left signal exit orphaning the subprocess. Each runner clears
 			// its set, so a graceful dispose running first makes this a no-op rather
 			// than a double free.
-			this.#runToolSessionCleanups().catch((error: unknown) =>
+			this.#claimToolSessionCleanups().catch((error: unknown) =>
 				logger.warn("signal teardown: tool session cleanups failed", { error }),
 			),
-			this.#runToolSessionTransitionCleanups().catch((error: unknown) =>
+			this.#claimToolSessionTransitionCleanups().catch((error: unknown) =>
 				logger.warn("signal teardown: tool session transition cleanups failed", { error }),
 			),
 		]);
@@ -14200,6 +14249,25 @@ export class AgentSession {
 		await this.refreshBaseSystemPrompt();
 	}
 
+	/** Refresh the live registered-skill catalog after install/remove/reload. */
+	async reloadSkills(cwd = this.sessionManager.getCwd()): Promise<void> {
+		if (!this.#reloadSkills) return;
+		const reloaded = await this.#reloadSkills(cwd);
+		const previousSkills = this.#skills;
+		const previousWarnings = this.#skillWarnings;
+		this.#skills = reloaded.skills;
+		this.#skillWarnings = reloaded.warnings;
+		try {
+			await this.refreshBaseSystemPrompt();
+		} catch (error) {
+			this.#skills = previousSkills;
+			this.#skillWarnings = previousWarnings;
+			await this.refreshBaseSystemPrompt().catch(() => {});
+			throw error;
+		}
+		this.#onSkillsReloaded?.(reloaded.skills, reloaded.warnings);
+	}
+
 	/**
 	 * Retire the cached workspace tree after a rescope so the next turn re-scans
 	 * at the new cwd instead of re-presenting the abandoned launcher root.
@@ -18407,18 +18475,23 @@ export class AgentSession {
 	 * prune → promote → compact machinery and returns an explicit outcome.
 	 *
 	 * A non-"not-needed" outcome ends the current run losslessly
-	 * (`agent_end.stopReason === "maintenance"`); the `agent_end` handler is the
-	 * single continuation owner that resumes the run with no synthetic prompt.
-	 * This method never self-continues, runs goal-runtime hooks, clears skill
-	 * state, or emits a user-facing pause.
+	 * (`agent_end.stopReason === "maintenance"`). The `agent_end` handler resumes
+	 * committed maintenance with no synthetic prompt and terminalizes failed or
+	 * aborted maintenance. This method never self-continues, runs goal-runtime
+	 * hooks, clears skill state, or emits a user-facing pause.
 	 */
 	async #runMidRunMaintenance(
 		context: AgentContext,
 		lifecycle: MidRunMaintenanceLifecycle,
 	): Promise<ContextMaintenanceResult> {
-		const result = (outcome: MidRunMaintenanceOutcome, releaseCurrentContext = false): ContextMaintenanceResult => ({
+		const result = (
+			outcome: MidRunMaintenanceOutcome,
+			releaseCurrentContext = false,
+			errorMessage?: string,
+		): ContextMaintenanceResult => ({
 			outcome,
 			...(releaseCurrentContext ? { releaseCurrentContext: true } : {}),
+			...(errorMessage ? { errorMessage } : {}),
 		});
 		if (this.#isDisposed) return { outcome: "aborted" };
 		const invocationController = new AbortController();
@@ -18529,7 +18602,13 @@ export class AgentSession {
 			if (compactionStatus.kind === "aborted") {
 				return compactionStatus.source === "hook" ? result("not-needed") : result("aborted");
 			}
-			return result("failed");
+			return result(
+				"failed",
+				false,
+				compactionStatus.kind === "failed"
+					? compactionStatus.errorMessage
+					: "Context maintenance could not commit a compaction before the next model request.",
+			);
 		} finally {
 			this.#activeMidRunBarrierControllers.delete(invocationController);
 		}
@@ -19643,12 +19722,15 @@ export class AgentSession {
 	 */
 	#maintenanceProviderTransport(): {
 		sessionId: string | undefined;
+		providerSessionId: string | undefined;
 		providerSessionState: Map<string, ProviderSessionState>;
 		preferWebsockets: boolean | undefined;
 		remoteCompactionFallbackHealth: RemoteCompactionFallbackHealthHooks;
 	} {
+		const providerSessionId = this.agent.providerSessionId ?? this.agent.sessionId;
 		return {
-			sessionId: this.agent.providerSessionId ?? this.agent.sessionId,
+			sessionId: providerSessionId,
+			providerSessionId,
 			providerSessionState: this.#providerSessionState,
 			preferWebsockets: this.agent.preferWebsockets,
 			remoteCompactionFallbackHealth: this.#remoteCompactionFallbackHealth,
@@ -20286,7 +20368,7 @@ export class AgentSession {
 						? `Context overflow recovery failed: ${errorMessage}`
 						: `Auto-compaction failed: ${errorMessage}`,
 			});
-			return { kind: "failed" };
+			return { kind: "failed", errorMessage };
 		} finally {
 			if (this.#autoCompactionAbortController === autoCompactionAbortController) {
 				this.#autoCompactionAbortController = undefined;
@@ -22350,7 +22432,10 @@ export class AgentSession {
 				onChunk,
 				signal: abortController.signal,
 			});
-			this.recordPythonResult(code, result, options);
+			// A retained kernel can finish after strict session close has fenced
+			// persistence. The caller still receives its completed result, but it
+			// must not reopen a closing session to append history.
+			if (!this.#evalExecutionDisposing) this.recordPythonResult(code, result, options);
 			return result;
 		})();
 		return await this.trackEvalExecution(execution, abortController);

package/src/session/contribution-prep.ts

@@ -3,7 +3,6 @@ import * as os from "node:os";
 import * as path from "node:path";
 import type { AgentMessage } from "@gajae-code/agent-core";
 import type { AssistantMessage, ToolResultMessage, UserMessage } from "@gajae-code/ai/core";
-import { $ } from "bun";
 import { resolveGjcCommand } from "../task/gjc-command";
 import { shortenPath } from "../tools/render-utils";
 
@@ -12,6 +11,12 @@ export const CONTRIBUTION_PREP_SCHEMA_VERSION = 1;
 const MAX_TRANSCRIPT_MESSAGES = 20;
 const MAX_TEXT_CHARS = 12000;
 const MAX_GIT_OUTPUT_CHARS = 60000;
+const MAX_REDACTION_INPUT_CHARS = 1_000_000;
+// Keep whole Git captures within the redactor's input budget; discard an overrun
+// instead of emitting a prefix.
+const MAX_GIT_RAW_OUTPUT_BYTES = MAX_REDACTION_INPUT_CHARS;
+const MAX_JSON_TOKENS = 20_000;
+const MAX_JSON_REPLACEMENTS = 10_000;
 
 export interface ContributionPrepArtifact {
 	path: string;
@@ -72,12 +77,133 @@ function replaceRegex(text: string, regex: RegExp, replacement: string, state: R
 	return text.replace(regex, replacement);
 }
 
+function redactAwsAccessKeyIds(text: string, state: RedactionState): string {
+	return replaceRegex(
+		text,
+		/(^|[^0-9A-Za-z])(?:AKIA|ASIA)[0-9A-Z]{16}(?![0-9A-Za-z])/g,
+		"$1[REDACTED_AWS_KEY_ID]",
+		state,
+		"aws_keys",
+	);
+}
+
+function isAwsSecretField(value: string): boolean {
+	const normalized = value.toLowerCase().replaceAll(/[_-]/g, "");
+	return (
+		normalized === "secretaccesskey" ||
+		normalized === "sessiontoken" ||
+		normalized === "awssecretaccesskey" ||
+		normalized === "awssessiontoken" ||
+		normalized === "xamzsecuritytoken"
+	);
+}
+
+function redactAwsLabeledValues(text: string, state: RedactionState): string {
+	let redacted = redactAwsAccessKeyIds(text, state);
+	redacted = replaceRegex(
+		redacted,
+		// STS XML responses are commonly pretty-printed, so the value sits on its own
+		// line between the tags. `[^<]` still refuses to cross into another element,
+		// while the call-wide input bound caps work without imposing a credential-size
+		// assumption. The lower bound leaves empty or whitespace-only bodies alone.
+		/(<((?:[A-Za-z_][\w.-]*:)?(?:SecretAccessKey|SessionToken))>)[^<]{8,1000000}(<\/\2>)/gi,
+		"$1[REDACTED_SECRET]$3",
+		state,
+		"aws_keys",
+	);
+	redacted = replaceRegex(
+		redacted,
+		/(^|[^A-Za-z0-9_-])(["']?(?:(?:aws[_-]?)?secret[_-]?access[_-]?key|(?:aws[_-]?)?session[_-]?token|x[_-]?amz[_-]?security[_-]?token)["']?\s*[=:]\s*)(\$?)(["'`])([^"'`\r\n]{8,})\4/gi,
+		"$1$2$3$4[REDACTED_SECRET]$4",
+		state,
+		"aws_keys",
+	);
+	return replaceRegex(
+		redacted,
+		/(^|[^A-Za-z0-9_-])(["']?(?:(?:aws[_-]?)?secret[_-]?access[_-]?key|(?:aws[_-]?)?session[_-]?token|x[_-]?amz[_-]?security[_-]?token)["']?\s*[=:]\s*)[^\s"'`,;{}[\]()&<>#]{8,}/gi,
+		"$1$2[REDACTED_SECRET]",
+		state,
+		"aws_keys",
+	);
+}
+
+function redactAwsJsonStrings(text: string, state: RedactionState, depth = 0): string {
+	const tokens = [...text.matchAll(/"(?:\\(?:["\\/bfnrt]|u[0-9A-Fa-f]{4})|[^"\\\r\n])*"/g)].map(match => ({
+		start: match.index,
+		end: match.index + match[0].length,
+		raw: match[0],
+	}));
+	if (tokens.length > MAX_JSON_TOKENS) {
+		state.labels.add("oversized_content");
+		return "[REDACTED_OVERSIZED_CONTENT]";
+	}
+	const replacements = new Map<number, { end: number; value: string }>();
+
+	for (const [index, token] of tokens.entries()) {
+		let decoded: string;
+		try {
+			decoded = JSON.parse(token.raw) as string;
+		} catch {
+			continue;
+		}
+
+		if (isAwsSecretField(decoded)) {
+			const separator = /^\s*:\s*/.exec(text.slice(token.end));
+			const valueToken = tokens[index + 1];
+			if (separator && valueToken?.start === token.end + separator[0].length) {
+				let value: string;
+				try {
+					value = JSON.parse(valueToken.raw) as string;
+				} catch {
+					value = "";
+				}
+				if (value.length >= 8)
+					replacements.set(valueToken.start, { end: valueToken.end, value: JSON.stringify("[REDACTED_SECRET]") });
+			}
+		}
+
+		const nestedRedacted = depth >= 3 ? "[REDACTED_NESTED_CONTENT]" : redactAwsJsonStrings(decoded, state, depth + 1);
+		const redacted = redactAwsLabeledValues(nestedRedacted, state);
+		if (redacted !== decoded && !replacements.has(token.start)) {
+			replacements.set(token.start, { end: token.end, value: JSON.stringify(redacted) });
+		}
+	}
+
+	if (replacements.size === 0) return text;
+	if (replacements.size > MAX_JSON_REPLACEMENTS) {
+		state.labels.add("oversized_content");
+		return "[REDACTED_OVERSIZED_CONTENT]";
+	}
+	state.labels.add("aws_keys");
+	const chunks: string[] = [];
+	let cursor = 0;
+	for (const [start, replacement] of [...replacements.entries()].sort(([left], [right]) => left - right)) {
+		chunks.push(text.slice(cursor, start), replacement.value);
+		cursor = replacement.end;
+	}
+	chunks.push(text.slice(cursor));
+	return chunks.join("");
+}
+
+function assertSafeArtifactPath(artifactDir: string): void {
+	const state: RedactionState = { labels: new Set() };
+	redactContributionPrepText(artifactDir, path.join(artifactDir, "__gjc_path_probe__"), state);
+	if (["tokens", "aws_keys", "provider_keys", "auth_headers", "cookies"].some(label => state.labels.has(label))) {
+		throw new Error("Contribution prep artifact path contains credential-like material.");
+	}
+}
+
 export function redactContributionPrepText(
 	text: string,
 	cwd: string,
 	state: RedactionState = { labels: new Set() },
 ): string {
-	let redacted = text;
+	if (text.length > MAX_REDACTION_INPUT_CHARS) {
+		state.labels.add("oversized_content");
+		return "[REDACTED_OVERSIZED_CONTENT]";
+	}
+	let redacted = redactAwsJsonStrings(text, state);
+	redacted = redactAwsLabeledValues(redacted, state);
 	redacted = replaceRegex(
 		redacted,
 		/\b(?:sk|pk|rk|xox[baprs])-[-_A-Za-z0-9]{12,}\b/g,
@@ -150,17 +276,73 @@ function formatMessage(message: AgentMessage): string {
 	return `## ${message.role}\n\n${JSON.stringify(message)}\n`;
 }
 
-async function gitOutput(cwd: string, args: string[], maxChars = MAX_GIT_OUTPUT_CHARS): Promise<string> {
+interface BoundedGitOutput {
+	text: string;
+	oversized: boolean;
+}
+
+async function readBoundedGitOutput(stream: ReadableStream<Uint8Array>, maxBytes: number): Promise<BoundedGitOutput> {
+	const reader = stream.getReader();
+	const chunks: Uint8Array[] = [];
+	let totalBytes = 0;
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			totalBytes += value.byteLength;
+			if (totalBytes > maxBytes) return { text: "", oversized: true };
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+
+	const bytes = new Uint8Array(totalBytes);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return { text: new TextDecoder().decode(bytes), oversized: false };
+}
+
+async function gitOutput(
+	cwd: string,
+	args: string[],
+	state: RedactionState,
+	maxChars = MAX_GIT_OUTPUT_CHARS,
+): Promise<string> {
 	try {
-		const output = await $`git ${args}`.cwd(cwd).quiet().text();
-		return limitText(output.trim(), maxChars);
+		const proc = Bun.spawn(["git", ...args], { cwd, stdin: "ignore", stdout: "pipe", stderr: "ignore" });
+		const stop = (): void => {
+			try {
+				proc.kill();
+			} catch {
+				// The process already exited.
+			}
+		};
+		try {
+			const output = await readBoundedGitOutput(proc.stdout, MAX_GIT_RAW_OUTPUT_BYTES);
+			if (output.oversized) {
+				stop();
+				await proc.exited;
+				state.labels.add("oversized_content");
+				return "[REDACTED_OVERSIZED_CONTENT]";
+			}
+			if ((await proc.exited) !== 0) return "";
+			return limitText(redactContributionPrepText(output.text.trim(), cwd, state), maxChars);
+		} catch {
+			stop();
+			await proc.exited;
+			return "";
+		}
 	} catch {
 		return "";
 	}
 }
 
-async function changedFiles(cwd: string): Promise<string[]> {
-	const output = await gitOutput(cwd, ["status", "--short"]);
+async function changedFiles(cwd: string, state: RedactionState): Promise<string[]> {
+	const output = await gitOutput(cwd, ["status", "--short"], state);
 	return output
 		.split("\n")
 		.map(line => line.trim())
@@ -180,15 +362,23 @@ async function writeArtifact(
 }
 
 export function buildContributionPrepWorkerPrompt(manifestPath: string): string {
+	const manifestName = path.basename(manifestPath);
 	return [
 		"Prepare a maintainer-friendly contribution draft from the redacted context dump.",
-		"Read the manifest and referenced artifact file pointers. Do not assume transcript context was inlined here.",
-		`Manifest: ${manifestPath}`,
+		"Read the manifest beside this worker prompt and its relative artifact file pointers. Do not assume transcript context was inlined here.",
+		`Manifest: ${manifestName}`,
 		"Produce structured markdown with: title, problem summary, reproduction/context, proposed fix or implementation plan, affected files, tests to run, and uncertainty/remaining risks.",
 		"Do not create GitHub issues, open PRs, push branches, or perform remote writes unless the user explicitly confirms that action in this fresh session.",
 	].join("\n");
 }
 
+function safeWorkspaceLabel(cwd: string): string {
+	const resolved = path.resolve(cwd);
+	const home = os.homedir();
+	if (home && (resolved === home || resolved.startsWith(`${home}${path.sep}`))) return shortenPath(resolved);
+	return path.basename(resolved) || ".";
+}
+
 export async function prepareContributionPrep(
 	context: ContributionPrepContext,
 	options: ContributionPrepOptions = {},
@@ -199,12 +389,14 @@ export async function prepareContributionPrep(
 		options.artifactRoot ?? path.join(context.cwd, ".gjc", "contribution-prep"),
 		safeTimestamp,
 	);
+	assertSafeArtifactPath(artifactDir);
 	await fs.mkdir(artifactDir, { recursive: true });
 
 	const redactions: RedactionState = { labels: new Set() };
 	const recentMessages = context.messages.slice(-MAX_TRANSCRIPT_MESSAGES);
 	const artifacts: ContributionPrepArtifact[] = [];
 	const redact = (text: string) => redactContributionPrepText(text, context.cwd, redactions);
+	const workspaceLabel = safeWorkspaceLabel(context.cwd);
 
 	artifacts.push(
 		await writeArtifact(
@@ -223,8 +415,8 @@ export async function prepareContributionPrep(
 				[
 					`# Contribution prep context`,
 					`Source session: ${context.sessionId}`,
-					`Session file: ${context.sessionFile ?? "(none)"}`,
-					`Working directory: ${context.cwd}`,
+					`Session file: ${context.sessionFile ? path.basename(context.sessionFile) : "(none)"}`,
+					`Working directory: ${workspaceLabel}`,
 					options.customInstructions || context.customInstructions
 						? `Custom instructions: ${options.customInstructions ?? context.customInstructions}`
 						: "Custom instructions: (none)",
@@ -233,8 +425,8 @@ export async function prepareContributionPrep(
 		),
 	);
 
-	const gitHead = (await gitOutput(context.cwd, ["rev-parse", "HEAD"])) || null;
-	const files = await changedFiles(context.cwd);
+	const gitHead = (await gitOutput(context.cwd, ["rev-parse", "HEAD"], redactions)) || null;
+	const files = await changedFiles(context.cwd, redactions);
 	artifacts.push(
 		await writeArtifact(artifactDir, "changed-files.txt", "Changed files from git status", redact(files.join("\n"))),
 	);
@@ -243,7 +435,7 @@ export async function prepareContributionPrep(
 			artifactDir,
 			"git-diff.patch",
 			"Bounded redacted git diff",
-			redact(await gitOutput(context.cwd, ["diff", "--no-ext-diff"])),
+			await gitOutput(context.cwd, ["diff", "--no-ext-diff"], redactions),
 		),
 	);
 	artifacts.push(
@@ -253,7 +445,7 @@ export async function prepareContributionPrep(
 			"Redacted environment and reproduction metadata",
 			redact(
 				[
-					`cwd: ${context.cwd}`,
+					`cwd: ${workspaceLabel}`,
 					`git_head: ${gitHead ?? "unknown"}`,
 					`platform: ${process.platform}`,
 					`arch: ${process.arch}`,
@@ -266,15 +458,16 @@ export async function prepareContributionPrep(
 	const manifestPath = path.join(artifactDir, "manifest.json");
 	const workerPromptPath = path.join(artifactDir, "worker-prompt.md");
 	await Bun.write(workerPromptPath, `${buildContributionPrepWorkerPrompt(manifestPath)}\n`);
+	const manifestArtifacts = artifacts.map(artifact => ({ ...artifact, path: path.basename(artifact.path) }));
 
 	const manifest: ContributionPrepManifest = {
 		schema_version: CONTRIBUTION_PREP_SCHEMA_VERSION,
-		source_session_id: context.sessionId,
+		source_session_id: redact(context.sessionId),
 		created_at: createdAt,
-		cwd: redact(context.cwd),
+		cwd: redact(workspaceLabel),
 		git_head: gitHead,
 		changed_files: files.map(redact),
-		artifacts,
+		artifacts: manifestArtifacts,
 		redactions: [...redactions.labels].sort(),
 		recommended_output: [
 			"title",
@@ -285,7 +478,7 @@ export async function prepareContributionPrep(
 			"tests to run",
 			"uncertainty / remaining risks",
 		],
-		worker_prompt_path: workerPromptPath,
+		worker_prompt_path: path.basename(workerPromptPath),
 	};
 	await Bun.write(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
 
@@ -309,8 +502,8 @@ export async function prepareContributionPrep(
 			});
 		const command = resolveGjcCommand();
 		await spawn(
-			[command.cmd, ...command.args, "--no-skills", "--", `@${workerPromptPath}`],
-			context.cwd,
+			[command.cmd, ...command.args, "--no-skills", "--", `@${path.basename(workerPromptPath)}`],
+			artifactDir,
 			command.shell,
 		);
 		spawned = true;