@gajae-code/coding-agent 0.16.7 → 0.17.1

package/src/session/internal/managed-session-storage.ts

@@ -3565,11 +3565,13 @@ export async function acquireManagedLock(
 					descriptorClosed = true;
 				}
 			};
-			const assertOwned = (): void => {
+			const assertOwnedWithDescriptor = (ownedFd: number): void => {
 				const current = parseLock(lockPath);
 				let named: fs.BigIntStats;
+				let opened: fs.BigIntStats;
 				try {
 					named = fs.lstatSync(lockPath, { bigint: true });
+					opened = fs.fstatSync(ownedFd, { bigint: true });
 				} catch {
 					throw new Error("migration_busy");
 				}
@@ -3579,18 +3581,22 @@ export async function acquireManagedLock(
 					!current ||
 					current.released === true ||
 					!sameFileIdentity(lockIdentity, named) ||
+					!named.isFile() ||
+					named.isSymbolicLink() ||
+					!sameFileIdentity(lockIdentity, opened) ||
 					current.attemptId !== attemptId
 				)
 					throw new Error("migration_busy");
 				const now = Date.now();
 				if (current.leaseExpiresAt < now + LOCK_HEARTBEAT_MS) {
-					writeLockDescriptor(fd, {
+					writeLockDescriptor(ownedFd, {
 						...record,
 						heartbeatAt: now,
 						leaseExpiresAt: now + LOCK_LEASE_MS,
 					});
 				}
 			};
+			const assertOwned = (): void => assertOwnedWithDescriptor(fd);
 			const heartbeat = setInterval(() => {
 				try {
 					assertOwned();
@@ -3603,13 +3609,29 @@ export async function acquireManagedLock(
 				attemptId,
 				assertOwned,
 				async release(): Promise<void> {
+					if (released) return;
 					clearInterval(heartbeat);
 					let releaseFd = fd;
 					let replacementFd: number | undefined;
 					try {
-						assertOwned();
+						// A named successor means ownership was already lost. Do not let
+						// Linux descriptor recovery mask that condition as a security error.
+						let named: fs.BigIntStats;
+						try {
+							named = fs.lstatSync(lockPath, { bigint: true });
+						} catch (error) {
+							if ((error as NodeJS.ErrnoException).code === "ENOENT") throw new Error("migration_busy");
+							throw error;
+						}
+						if (!named.isFile() || named.isSymbolicLink() || !sameFileIdentity(lockIdentity, named))
+							throw new Error("migration_busy");
+						// Check the descriptor before native security verification: native failures
+						// do not preserve Node's EBADF code for a closed retained descriptor.
 						ManagedLockTestHooks.beforeReleaseDescriptorVerification?.({ path: lockPath, fd });
 						try {
+							const opened = fs.fstatSync(fd, { bigint: true });
+							if (!sameFileIdentity(lockIdentity, opened))
+								throw securityError(lockPath, { ok: false, code: "identity_mismatch" });
 							secureFileDescriptor(lockPath, fd, "verify", true);
 						} catch (error) {
 							const descriptorUnavailable = (error as NodeJS.ErrnoException).code === "EBADF";
@@ -3618,9 +3640,16 @@ export async function acquireManagedLock(
 								(!descriptorUnavailable && managedSecurityFailureClassification(error) !== "identity_mismatch")
 							)
 								throw error;
-							replacementFd = openVerifiedLockReleaseDescriptor(lockPath, lockIdentity);
+							try {
+								replacementFd = openVerifiedLockReleaseDescriptor(lockPath, lockIdentity);
+							} catch (replacementError) {
+								if (managedSecurityFailureClassification(replacementError) === "identity_mismatch")
+									throw new Error("migration_busy");
+								throw replacementError;
+							}
 							releaseFd = replacementFd;
 						}
+						assertOwnedWithDescriptor(releaseFd);
 						const now = Date.now();
 						// A released record is the only live-process reclaim authority. Expiry alone
 						// never authorizes stealing from a holder whose process is still present.
@@ -3638,9 +3667,12 @@ export async function acquireManagedLock(
 						}
 						fsyncDirectory(locksDirectory);
 					} finally {
-						if (replacementFd !== undefined) fs.closeSync(replacementFd);
 						released = true;
-						closeDescriptor();
+						try {
+							if (replacementFd !== undefined) fs.closeSync(replacementFd);
+						} finally {
+							closeDescriptor();
+						}
 					}
 				},
 			};

package/src/session/primary-control-surface.ts

@@ -0,0 +1,12 @@
+export type PrimaryControlSurface = "cli" | "sdk";
+
+const primaryControlSurfaceByOptions = new WeakMap<object, PrimaryControlSurface>();
+
+/** @internal Trusted CLI bootstrap hook; ordinary SDK callers remain SDK-owned. */
+export function setPrimaryControlSurface(options: object, surface: PrimaryControlSurface): void {
+	primaryControlSurfaceByOptions.set(options, surface);
+}
+
+export function primaryControlSurfaceFor(options: object): PrimaryControlSurface {
+	return primaryControlSurfaceByOptions.get(options) ?? "sdk";
+}

package/src/session/session-manager.ts

@@ -18927,10 +18927,8 @@ export class SessionManager {
 	 * cap are weakly held so a GC cycle can reclaim them between reads.
 	 */
 	#getSessionContextForRead(): Readonly<SessionContext> {
-		const hasResidentSentinel = this.#fileEntries.some(entry => containsResidentSentinel(entry));
 		const cached = dereferenceMaterializedCache(this.#sessionContextCache);
 		if (
-			!hasResidentSentinel &&
 			cached &&
 			this.#sessionContextEntryRevision === this.#entryRevision &&
 			this.#sessionContextLeafRevision === this.#leafRevision &&
@@ -18938,6 +18936,8 @@ export class SessionManager {
 		) {
 			return cached;
 		}
+		// Only sentinel-free contexts are cached; revisions guard warm reads.
+		const hasResidentSentinel = this.#fileEntries.some(entry => containsResidentSentinel(entry));
 		this.#pathOnlyContextBuildCount++;
 		let resolvedProviderState: SessionEntry[] = [];
 		if (this.#coldSidecarActive() && this.#sidecarRuntime) {
@@ -21886,6 +21886,12 @@ export class SessionManager {
 
 	/**
 	 * List all sessions across all project directories.
+	 *
+	 * Scope re-derivation is an enrichment pass, not an admission gate: a seeded
+	 * transcript stays listed even when its recorded workspace no longer resolves
+	 * (deleted, renamed, unmounted, or recorded by another platform's checkout).
+	 * Dropping those would hide readable sessions from `--resume` with no recovery
+	 * path, which is exactly when a global lookup matters most.
 	 */
 	static async listAll(
 		storage: SessionStorage = new FileSessionStorage(),
@@ -21899,7 +21905,9 @@ export class SessionManager {
 				.filter(entry => entry.isDirectory())
 				.flatMap(entry => storage.listFilesSync(path.join(sessionsRoot, entry.name), "*.jsonl"));
 			const seedSessions = await collectSessionsFromFiles(seedFiles, storage);
-			const logicalFiles = new Set<string>();
+			const logicalFiles = new Set<string>(
+				seedSessions.map(session => session.path).filter(sessionPath => !isStagedSessionPath(sessionPath)),
+			);
 			for (const cwd of new Set(seedSessions.map(session => session.cwd).filter(Boolean))) {
 				const scope = resolveManagedScope({
 					cwd,

package/src/session/session-storage.ts

@@ -706,7 +706,7 @@ function secureOwnerOnlyFileDescriptor(
 				throw new Error("Managed writer descriptor escaped retained authority");
 		}
 	}
-	if (process.platform !== "linux" || !securityContext) {
+	if ((process.platform !== "linux" && process.platform !== "darwin") || !securityContext) {
 		if (operation === "apply") {
 			const applied = validateNativeSecurityResult(
 				nativeSessionStorage().applyOwnerOnlyPathSecurity(pathname, "file"),

package/src/session-import/codex.ts

@@ -31,7 +31,12 @@ const JWT_VALUE = /\b[A-Za-z0-9_-]{8,2048}\.[A-Za-z0-9_-]{8,8192}\.[A-Za-z0-9_-]
 const SECRET_ASSIGNMENT =
 	/(\b(?:password|passwd|secret|token|api[-_]?key|access[-_]?key)\b\s*[:=]\s*)(?:"[^"\r\n]{4,4096}"|'[^'\r\n]{4,4096}'|[^\s,;]{4,4096})/giu;
 const PRIVATE_KEY = /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]{1,65536}?-----END [A-Z ]*PRIVATE KEY-----/gu;
-const URL_CREDENTIAL = /([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/giu;
+// The scheme-character run is boundary anchored, so the unbounded suffix is
+// attempted once per maximal run instead of once at every prefix. Keeping the
+// leading non-letter characters in the capture preserves redaction for URLs
+// embedded after digits or scheme punctuation without imposing an arbitrary
+// scheme-length cap.
+const URL_CREDENTIAL = /(?<![A-Za-z0-9+.-])([0-9+.-]*[a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/giu;
 const HEADER_CREDENTIAL = /(\b(authorization|cookie|set-cookie)\b[ \t]*:[ \t]*)([^\r\n]*)/giu;
 const JSON_AUTHORIZATION_CREDENTIAL = /((?:\\?")authorization(?:\\?")\s*:\s*(?:\\?")?)([^\\",}\r\n]+)/giu;
 

package/src/session-import/redact.ts

@@ -44,6 +44,13 @@ const REDACTION_RULES: readonly RedactionRule[] = [
 	{ id: "openai-key", pattern: /sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9]{20,}/g },
 	// Slack tokens.
 	{ id: "slack-token", pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
+	// The four shapes `crash/upstream/envelope.ts` classifies as credential-like
+	// and refuses to transmit. Stripe and Hugging Face separate with `_`, so the
+	// `sk-` rules above never matched them.
+	{ id: "npm-token", pattern: /npm_[A-Za-z0-9]{20,}/g },
+	{ id: "gitlab-token", pattern: /glpat-[A-Za-z0-9_-]{20,}/g },
+	{ id: "stripe-key", pattern: /(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}/g },
+	{ id: "huggingface-token", pattern: /hf_[A-Za-z0-9]{20,}/g },
 	// Google API keys.
 	{ id: "google-api-key", pattern: /AIza[0-9A-Za-z_-]{35}/g },
 	// Bearer tokens carried in Authorization text.