@gajae-code/coding-agent 0.18.0 → 0.18.5

package/src/exa/mcp-client.ts

@@ -187,7 +187,16 @@ export function formatSearchResults(data: ExaSearchResponse): string {
  * Format a non-search MCP response as human-readable text.
  * Handles objects, arrays, primitives, and common MCP response shapes.
  */
-export function formatGenericResponse(data: unknown): string {
+// Nesting depth is bounded. Each object level re-indents the entire formatted
+// subtree, so cost grows super-linearly with depth: 500/1000/2000/4000/8000
+// levels cost 60ms/227ms/730ms/5.9s/94s. A tool-call payload is whatever the
+// remote MCP server returned, and `MCP_MAX_CONTENT_BYTES` does not bound depth
+// — 8000 levels of `{"a":` is under 47 KB. The limit matches the one the
+// session-import walker already applies (`sanitizeImportedValue`, depth > 64).
+const MAX_GENERIC_RESPONSE_DEPTH = 64;
+
+export function formatGenericResponse(data: unknown, depth = 0): string {
+	if (depth > MAX_GENERIC_RESPONSE_DEPTH) return "[depth-limit]";
 	if (data === null || data === undefined) return "No result.";
 	if (typeof data === "string") return data;
 	if (typeof data === "number" || typeof data === "boolean") return String(data);
@@ -199,14 +208,22 @@ export function formatGenericResponse(data: unknown): string {
 			const item = data[i];
 			if (typeof item === "object" && item !== null) {
 				const record = item as Record<string, unknown>;
-				const title = (record.title ?? record.name ?? record.id ?? `Item ${i + 1}`) as string;
+				const rawTitle = record.title ?? record.name ?? record.id;
+				// A remote title is unvalidated JSON: stringify non-strings through the
+				// depth-bounded path instead of template coercion, which recurses unbounded.
+				const title =
+					rawTitle === undefined || rawTitle === null
+						? `Item ${i + 1}`
+						: typeof rawTitle === "string"
+							? rawTitle
+							: formatValue(rawTitle, depth + 2);
 				parts.push(`\n### ${title}`);
 				for (const [k, v] of Object.entries(record)) {
 					if (["title", "name", "id"].includes(k)) continue;
-					parts.push(`- **${k}:** ${formatValue(v)}`);
+					parts.push(`- **${k}:** ${formatValue(v, depth + 2)}`);
 				}
 			} else {
-				parts.push(`- ${formatValue(item)}`);
+				parts.push(`- ${formatValue(item, depth + 1)}`);
 			}
 		}
 		return parts.join("\n");
@@ -231,10 +248,10 @@ export function formatGenericResponse(data: unknown): string {
 			if (k === "content") continue; // handled above
 			if (v === null || v === undefined) continue;
 			if (typeof v === "object") {
-				const formatted = formatGenericResponse(v);
+				const formatted = formatGenericResponse(v, depth + 1);
 				if (formatted) lines.push(`- **${k}:**\n${indent(formatted, 2)}`);
 			} else {
-				lines.push(`- **${k}:** ${formatValue(v)}`);
+				lines.push(`- **${k}:** ${formatValue(v, depth + 1)}`);
 			}
 		}
 		return lines.join("\n") || "(empty)";
@@ -243,12 +260,28 @@ export function formatGenericResponse(data: unknown): string {
 	return String(data);
 }
 
-function formatValue(v: unknown): string {
+function formatValue(v: unknown, depth: number): string {
 	if (v === null || v === undefined) return "—";
-	if (typeof v === "object") return JSON.stringify(v);
+	if (typeof v === "object") return JSON.stringify(truncateDepth(v, depth));
 	return String(v);
 }
 
+/**
+ * Copies a value, replacing anything nested past MAX_GENERIC_RESPONSE_DEPTH with
+ * "[depth-limit]", so JSON.stringify never recurses through a remote payload's
+ * unbounded structure.
+ */
+function truncateDepth(value: unknown, depth: number): unknown {
+	if (value === null || typeof value !== "object") return value;
+	if (depth > MAX_GENERIC_RESPONSE_DEPTH) return "[depth-limit]";
+	if (Array.isArray(value)) return value.map(item => truncateDepth(item, depth + 1));
+	// Null prototype: an own "__proto__" key from a parsed payload must stay an
+	// own data property instead of hitting the Object.prototype setter.
+	const copy: Record<string, unknown> = Object.create(null);
+	for (const [key, child] of Object.entries(value)) copy[key] = truncateDepth(child, depth + 1);
+	return copy;
+}
+
 function indent(text: string, spaces: number): string {
 	const pad = " ".repeat(spaces);
 	return text

package/src/exec/bash-shell-guardian.ts

@@ -1,6 +1,7 @@
 import { dlopen, FFIType, ptr } from "bun:ffi";
 import * as childProcess from "node:child_process";
 import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+import * as fsSync from "node:fs";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -63,10 +64,10 @@ export function extendOwnedDarwinAncestry<T extends { uniqueId: bigint; parentUn
 	return addedPids;
 }
 
-function authenticateOwnershipRecord(
+export function authenticateOwnershipRecord(
 	line: string,
 	ledgerToken: string,
-): { processRef?: NativeProcess; darwinUniqueId?: bigint } | undefined {
+): { processRef?: NativeProcess; darwinUniqueId?: bigint; pending?: true } | undefined {
 	const record = parseOwnershipRecord(line);
 	if (!record) return undefined;
 	const uniqueId = record.darwinUniqueId ?? "";
@@ -80,15 +81,20 @@ function authenticateOwnershipRecord(
 		return undefined;
 	}
 	if (received.byteLength !== expected.byteLength || !timingSafeEqual(received, expected)) return undefined;
-	if (process.platform === "darwin" && !record.darwinUniqueId) return undefined;
 	const { Process } = require("@gajae-code/natives") as NativeProcessBindings;
 	const owned = Process.fromPid(record.pid);
-	return {
-		...(owned?.incarnation === record.incarnation ? { processRef: owned } : {}),
-		...(record.darwinUniqueId ? { darwinUniqueId: BigInt(record.darwinUniqueId) } : {}),
-	};
+	const darwinUniqueId = record.darwinUniqueId ? { darwinUniqueId: BigInt(record.darwinUniqueId) } : {};
+	if (owned?.incarnation === record.incarnation) return { processRef: owned, ...darwinUniqueId };
+	// fromPid() conflates death with an inconclusive lookup. Only a confirmed
+	// absence or a different incarnation settles the record; an unknown result
+	// keeps it pending so the caller retries the line on the next scan.
+	if (!owned && Process.observe(record.pid).status === "unknown") return { pending: true, ...darwinUniqueId };
+	return darwinUniqueId;
 }
 
+/** Scans an inconclusive ledger record may stay pending before tracking fails closed. */
+const MAX_PENDING_LEDGER_ATTEMPTS = 50;
+
 function enableLinuxChildSubreaper(): boolean {
 	if (process.platform !== "linux") return true;
 	try {
@@ -157,14 +163,27 @@ function findDarwinLedgerHolders(device: number, inode: bigint): NativeProcess[]
 	}
 }
 
-type DarwinAncestryTracker = {
+export type DarwinAncestryTracker = {
 	seed(uniqueId: bigint): void;
 	track(processRef: NativeProcess, uniqueId?: bigint): boolean;
+	trackGuardian(processRef: NativeProcess, uniqueId?: bigint): boolean;
 	poll(): boolean;
 	close(): void;
 };
 
-function createDarwinAncestryTracker(owned: Map<string, NativeProcess>): DarwinAncestryTracker | undefined {
+export type DarwinIdentity = { uniqueId: bigint; parentUniqueId: bigint };
+
+/** Test seams for the Darwin tracker; production uses libproc and the natives binding. */
+export type DarwinAncestryTrackerDeps = {
+	uniqueIdentity?: (pid: number) => DarwinIdentity | undefined;
+	fromPid?: (pid: number) => NativeProcess | null | undefined;
+	observe?: (pid: number) => { status: "present" | "absent" | "unknown"; incarnation?: string };
+};
+
+export function createDarwinAncestryTracker(
+	owned: Map<string, NativeProcess>,
+	deps: DarwinAncestryTrackerDeps = {},
+): DarwinAncestryTracker | undefined {
 	if (process.platform !== "darwin") return undefined;
 	try {
 		const proc = dlopen("/usr/lib/libproc.dylib", {
@@ -175,18 +194,113 @@ function createDarwinAncestryTracker(owned: Map<string, NativeProcess>): DarwinA
 			},
 		});
 		const knownUniqueIds = new Set<bigint>();
+		// Ancestry evidence (knownUniqueIds) and successful retention are tracked
+		// separately: a descendant whose process validation fails stays known, so its
+		// own children still chain, but it is retried on every poll until retained.
+		const retainedUniqueIds = new Set<bigint>();
 		const { Process } = require("@gajae-code/natives") as NativeProcessBindings;
-		const uniqueIdentity = (pid: number): { uniqueId: bigint; parentUniqueId: bigint } | undefined => {
-			const info = new Uint8Array(56);
-			if (proc.symbols.proc_pidinfo(pid, 17, 0, ptr(info), info.byteLength) !== info.byteLength) return undefined;
-			const view = new DataView(info.buffer);
-			return { uniqueId: view.getBigUint64(16, true), parentUniqueId: view.getBigUint64(24, true) };
+		const fromPid = deps.fromPid ?? ((pid: number) => Process.fromPid(pid));
+		const observe = deps.observe ?? ((pid: number) => Process.observe(pid));
+		// Reuse buffer across poll iterations to avoid allocations inside the loop.
+		const identityBuffer = new Uint8Array(56);
+		const identityView = new DataView(identityBuffer.buffer);
+		const defaultUniqueIdentity = (pid: number): { uniqueId: bigint; parentUniqueId: bigint } | undefined => {
+			const bytes = proc.symbols.proc_pidinfo(pid, 17, 0, ptr(identityBuffer), identityBuffer.byteLength);
+			if (bytes !== identityBuffer.byteLength) return undefined;
+			return {
+				uniqueId: identityView.getBigUint64(16, true),
+				parentUniqueId: identityView.getBigUint64(24, true),
+			};
+		};
+		const uniqueIdentity = deps.uniqueIdentity ?? defaultUniqueIdentity;
+		const incarnationOnlyAnchors: NativeProcess[] = [];
+		const anchorKeys = new Set<string>();
+		const addIncarnationOnlyAnchor = (processRef: NativeProcess): void => {
+			const key = `${processRef.pid}:${processRef.incarnation}`;
+			if (anchorKeys.has(key)) return;
+			anchorKeys.add(key);
+			incarnationOnlyAnchors.push(processRef);
+		};
+		// children() validates its parent and then snapshots the process table; the
+		// parent can exit and its pid be reused in between, returning a stranger's
+		// children. Only trust a snapshot if the parent still holds its incarnation
+		// after it was taken.
+		const childrenOf = (parent: NativeProcess): NativeProcess[] => {
+			const children = parent.children();
+			return fromPid(parent.pid)?.incarnation === parent.incarnation ? children : [];
+		};
+		const seedAnchorDescendants = (anchor: NativeProcess): void => {
+			const pending = [...childrenOf(anchor)];
+			while (pending.length > 0) {
+				const child = pending.pop()!;
+				retainOwnedProcess(owned, child);
+				// The unique id is read from a bare pid, so bracket it with incarnation
+				// checks against this handle: a pid reused in between would otherwise
+				// seed an unrelated process (and its descendants) as owned.
+				if (fromPid(child.pid)?.incarnation === child.incarnation) {
+					const childId = uniqueIdentity(child.pid)?.uniqueId;
+					if (fromPid(child.pid)?.incarnation === child.incarnation) {
+						if (childId !== undefined) {
+							knownUniqueIds.add(childId);
+							retainedUniqueIds.add(childId);
+						} else {
+							// Its flavor-17 query is denied too: without a unique id the
+							// ancestry walk can never reach its subtree, so it must outlive
+							// this anchor's pruning as an incarnation-only anchor itself.
+							addIncarnationOnlyAnchor(child);
+						}
+					}
+				}
+				pending.push(...childrenOf(child));
+			}
 		};
 		const track = (processRef: NativeProcess, signedUniqueId?: bigint): boolean => {
+			// The bare-pid unique-id query is only trusted if the same incarnation
+			// holds on both sides of it; otherwise a pid reused after the record was
+			// authenticated would seed the replacement's ancestry as owned.
+			let identity: { uniqueId: bigint; parentUniqueId: bigint } | undefined;
+			if (signedUniqueId === undefined) {
+				const queried = uniqueIdentity(processRef.pid);
+				const after = observe(processRef.pid);
+				if (
+					after.status === "absent" ||
+					(after.status === "present" && after.incarnation !== processRef.incarnation)
+				) {
+					// Confirmed exited or reused since authentication: retain nothing new.
+					return true;
+				}
+				// Present with the same incarnation keeps the queried id. An
+				// inconclusive lookup cannot vouch for it, so the record falls through
+				// as incarnation-only and is kept as an anchor rather than dropped.
+				identity = after.status === "present" ? queried : undefined;
+			}
+			const uniqueId = signedUniqueId ?? identity?.uniqueId;
+			if (uniqueId === undefined) {
+				// Incarnation-only record: the child has no unique id to anchor the
+				// ancestry graph. Keep it as an anchor whose live descendants poll()
+				// seeds by unique id, so their subtrees stay tracked after the child
+				// exits and they reparent (PPID discovery alone would lose them).
+				// Residual gap (accepted over #6085's exit 70): if the child forks a
+				// descendant that leaves the supervisor process group, then exits before
+				// this record is scanned, nothing links that descendant back to us. The
+				// ledger watcher scans on append to keep that window minimal.
+				retainOwnedProcess(owned, processRef);
+				addIncarnationOnlyAnchor(processRef);
+				seedAnchorDescendants(processRef);
+				return true;
+			}
+			knownUniqueIds.add(uniqueId);
+			retainedUniqueIds.add(uniqueId);
+			retainOwnedProcess(owned, processRef);
+			return true;
+		};
+		const trackGuardian = (processRef: NativeProcess, signedUniqueId?: bigint): boolean => {
 			const identity = signedUniqueId === undefined ? uniqueIdentity(processRef.pid) : undefined;
 			const uniqueId = signedUniqueId ?? identity?.uniqueId;
+			// Guardian registration is strict: must have a unique id
 			if (uniqueId === undefined) return false;
 			knownUniqueIds.add(uniqueId);
+			retainedUniqueIds.add(uniqueId);
 			retainOwnedProcess(owned, processRef);
 			return true;
 		};
@@ -195,28 +309,46 @@ function createDarwinAncestryTracker(owned: Map<string, NativeProcess>): DarwinA
 				knownUniqueIds.add(uniqueId);
 			},
 			track,
+			trackGuardian,
 			poll() {
+				// Re-seed live anchors, then drop exited ones: their descendants were
+				// seeded by unique id while the anchor was alive, and ancestry now
+				// carries them, so re-walking a dead anchor only costs time.
+				for (let index = incarnationOnlyAnchors.length - 1; index >= 0; index--) {
+					const anchor = incarnationOnlyAnchors[index]!;
+					seedAnchorDescendants(anchor);
+					if (fromPid(anchor.pid)?.incarnation !== anchor.incarnation) {
+						incarnationOnlyAnchors.splice(index, 1);
+						anchorKeys.delete(`${anchor.pid}:${anchor.incarnation}`);
+					}
+				}
 				const capacity = proc.symbols.proc_listallpids(null, 0);
 				if (capacity <= 0) return false;
 				const pids = new Int32Array(capacity + 64);
 				const count = proc.symbols.proc_listallpids(ptr(pids), pids.byteLength);
 				if (count <= 0) return false;
-				const candidates = new Map<
-					number,
-					{ uniqueId: bigint; parentUniqueId: bigint; processRef: NativeProcess }
-				>();
+				// First pass: collect identities for all pids, avoiding Process.fromPid calls.
+				const identities = new Map<number, { uniqueId: bigint; parentUniqueId: bigint }>();
 				for (let index = 0; index < count; index++) {
 					const pid = pids[index]!;
-					const processRef = Process.fromPid(pid);
-					if (!processRef) continue;
 					const identity = uniqueIdentity(pid);
-					const after = Process.fromPid(pid);
-					if (identity && after?.incarnation === processRef.incarnation) {
-						candidates.set(pid, { ...identity, processRef });
-					}
+					if (identity) identities.set(pid, identity);
 				}
-				for (const pid of extendOwnedDarwinAncestry(knownUniqueIds, candidates)) {
-					retainOwnedProcess(owned, candidates.get(pid)!.processRef);
+				// Extend ancestry evidence, then validate every listed pid that is known but
+				// not yet retained: new descendants plus earlier ones whose Process.fromPid
+				// check failed (it can return null for a live pid it could not query). A pid
+				// whose identity changed between the listing and the check was reused; skip it.
+				extendOwnedDarwinAncestry(knownUniqueIds, identities);
+				for (const [pid, listed] of identities) {
+					if (!knownUniqueIds.has(listed.uniqueId) || retainedUniqueIds.has(listed.uniqueId)) continue;
+					const before = fromPid(pid);
+					if (!before) continue;
+					const identity = uniqueIdentity(pid);
+					const after = fromPid(pid);
+					if (identity?.uniqueId === listed.uniqueId && after?.incarnation === before.incarnation) {
+						retainOwnedProcess(owned, after);
+						retainedUniqueIds.add(listed.uniqueId);
+					}
 				}
 				return true;
 			},
@@ -259,7 +391,7 @@ export async function runBashShellGuardian(): Promise<void> {
 	if (darwinTracker) {
 		const { Process } = require("@gajae-code/natives") as NativeProcessBindings;
 		const guardian = Process.fromPid(process.pid);
-		if (!guardian || !darwinTracker.track(guardian)) {
+		if (!guardian || !darwinTracker.trackGuardian(guardian)) {
 			darwinTracker.close();
 			await ledger.close();
 			await fs.rm(ownershipFilePath, { force: true });
@@ -290,6 +422,8 @@ export async function runBashShellGuardian(): Promise<void> {
 	input.once("close", () => supervisor.stdin.end());
 	let cleaning: Promise<void> | undefined;
 	let ledgerBuffer = "";
+	let pendingLedgerLines: string[] = [];
+	const pendingAttempts = new Map<string, number>();
 	let ownershipScan = Promise.resolve(true);
 	const scanOwnership = (): Promise<boolean> => {
 		ownershipScan = ownershipScan.then(async previousOk => {
@@ -301,11 +435,23 @@ export async function runBashShellGuardian(): Promise<void> {
 				return false;
 			}
 			ledgerBuffer += content;
-			const lines = ledgerBuffer.split("\n");
-			ledgerBuffer = lines.pop() ?? "";
+			const fresh = ledgerBuffer.split("\n");
+			ledgerBuffer = fresh.pop() ?? "";
+			const lines = [...pendingLedgerLines, ...fresh];
+			pendingLedgerLines = [];
 			for (const line of lines) {
 				if (!line) continue;
 				const owned = authenticateOwnershipRecord(line, ledgerToken);
+				if (owned?.pending) {
+					// Inconclusive lookup: retry next scan, bounded so a pid stuck in an
+					// unknown state cannot grow the queue or starve cleanup forever.
+					const attempts = (pendingAttempts.get(line) ?? 0) + 1;
+					if (attempts > MAX_PENDING_LEDGER_ATTEMPTS) return false;
+					pendingAttempts.set(line, attempts);
+					pendingLedgerLines.push(line);
+				} else {
+					pendingAttempts.delete(line);
+				}
 				if (owned?.darwinUniqueId && darwinTracker) darwinTracker.seed(owned.darwinUniqueId);
 				if (owned?.processRef && darwinTracker && !darwinTracker.track(owned.processRef, owned.darwinUniqueId))
 					return false;
@@ -319,28 +465,48 @@ export async function runBashShellGuardian(): Promise<void> {
 		return ownershipScan;
 	};
 	let periodicScanActive = false;
-	const ownershipScanTimer = darwinTracker
-		? setInterval(() => {
-				if (periodicScanActive) return;
-				periodicScanActive = true;
-				void scanOwnership()
-					.then(ok => {
-						if (ok || supervisor.exitCode !== null || supervisor.signalCode !== null) return;
-						if (supervisor.pid) {
-							try {
-								process.kill(-supervisor.pid, "SIGKILL");
-							} catch {}
-						}
-						supervisor.kill("SIGKILL");
-					})
-					.finally(() => {
-						periodicScanActive = false;
-					});
-			}, 100)
-		: undefined;
+	let periodicScanRequested = false;
+	const runPeriodicScan = (): void => {
+		if (periodicScanActive) {
+			periodicScanRequested = true;
+			return;
+		}
+		periodicScanActive = true;
+		void scanOwnership()
+			.then(ok => {
+				if (ok || supervisor.exitCode !== null || supervisor.signalCode !== null) return;
+				if (supervisor.pid) {
+					try {
+						process.kill(-supervisor.pid, "SIGKILL");
+					} catch {}
+				}
+				supervisor.kill("SIGKILL");
+			})
+			.finally(() => {
+				periodicScanActive = false;
+				if (periodicScanRequested && !cleaning) {
+					periodicScanRequested = false;
+					runPeriodicScan();
+				}
+			});
+	};
+	const ownershipScanTimer = darwinTracker ? setInterval(runPeriodicScan, 100) : undefined;
+	// Scan as soon as the supervisor appends a ledger record instead of waiting
+	// for the next tick. An incarnation-only record's descendants are only
+	// reachable while that child is alive, so the anchor must be taken promptly.
+	let ledgerWatcher: fsSync.FSWatcher | undefined;
+	if (darwinTracker) {
+		try {
+			ledgerWatcher = fsSync.watch(ownershipFilePath, runPeriodicScan);
+			ledgerWatcher.on("error", () => {});
+		} catch {
+			ledgerWatcher = undefined;
+		}
+	}
 	const cleanup = (): Promise<void> => {
 		cleaning ??= (async () => {
 			if (ownershipScanTimer) clearInterval(ownershipScanTimer);
+			ledgerWatcher?.close();
 			let trackingOk = await scanOwnership();
 			if (supervisor.exitCode === null && supervisor.signalCode === null) {
 				if (process.platform !== "win32" && supervisor.pid) {

package/src/gjc-runtime/session-state-sidecar.ts

@@ -12,6 +12,7 @@ import {
 import { normalizePathForComparison, postmortem } from "@gajae-code/utils";
 import { withFileLock } from "../config/file-lock";
 import {
+	type CoordinatorAtomicWriteOptions,
 	ensureCoordinatorDirectory,
 	syncCoordinatorDirectory,
 	syncCoordinatorFile,
@@ -177,8 +178,25 @@ export const __sessionStateSidecarTestHooks: {
 	beforeRescopeJournalWrite?: (cwd: string) => void | Promise<void>;
 	beforePersistFromEvent?: (eventType: string, cwd: string) => void | Promise<void>;
 	beforeRescopePublish?: () => void | Promise<void>;
+	disableCoordinatorFileSyncForTests?: boolean;
 } = {};
 
+/** Create coordinator atomic write options with test hook support for disabling fsync. */
+function coordinatorAtomicWriteOptionsForTests<T extends CoordinatorAtomicWriteOptions>(
+	overrides?: T,
+): CoordinatorAtomicWriteOptions {
+	const options = overrides ?? ({} as T);
+	if (!__sessionStateSidecarTestHooks.disableCoordinatorFileSyncForTests) {
+		return options;
+	}
+	return {
+		...options,
+		syncFile: async () => {
+			/* skip fsync in tests */
+		},
+	};
+}
+
 interface RuntimeStateEvent {
 	type: string;
 	messages?: unknown[];
@@ -1806,35 +1824,39 @@ async function writeStateFileSyncConditional(
 	expectedDestination: NativeExactFileIdentity | null,
 ): Promise<void> {
 	const contents = `${JSON.stringify(finalizeSidecarPayload(payload, keyId))}\n`;
-	await writeCoordinatorAtomic(stateFile, contents, {
-		rename: async (source, destination) => {
-			if (!expectedDestination) {
-				const published = renameNoReplacePath(source, destination);
-				if (!published.ok) throw new PreviousRuntimeStateReadError();
-				return;
-			}
-			const stat = fsSync.lstatSync(source, { bigint: true });
-			const parent = fsSync.lstatSync(path.dirname(source), { bigint: true });
-			if (!stat.isFile() || stat.isSymbolicLink() || !parent.isDirectory() || parent.isSymbolicLink())
-				throw new PreviousRuntimeStateReadError();
-			const replaced = exactReplacePath(
-				source,
-				destination,
-				{
-					dev: stat.dev,
-					ino: stat.ino,
-					nlink: stat.nlink,
-					parentDev: parent.dev,
-					parentIno: parent.ino,
-					size: stat.size,
-					mtimeNs: stat.mtimeNs,
-					sha256: createHash("sha256").update(contents).digest("hex"),
-				},
-				expectedDestination,
-			);
-			if (!replaced.ok) throw new PreviousRuntimeStateReadError();
-		},
-	});
+	await writeCoordinatorAtomic(
+		stateFile,
+		contents,
+		coordinatorAtomicWriteOptionsForTests({
+			rename: async (source: string, destination: string) => {
+				if (!expectedDestination) {
+					const published = renameNoReplacePath(source, destination);
+					if (!published.ok) throw new PreviousRuntimeStateReadError();
+					return;
+				}
+				const stat = fsSync.lstatSync(source, { bigint: true });
+				const parent = fsSync.lstatSync(path.dirname(source), { bigint: true });
+				if (!stat.isFile() || stat.isSymbolicLink() || !parent.isDirectory() || parent.isSymbolicLink())
+					throw new PreviousRuntimeStateReadError();
+				const replaced = exactReplacePath(
+					source,
+					destination,
+					{
+						dev: stat.dev,
+						ino: stat.ino,
+						nlink: stat.nlink,
+						parentDev: parent.dev,
+						parentIno: parent.ino,
+						size: stat.size,
+						mtimeNs: stat.mtimeNs,
+						sha256: createHash("sha256").update(contents).digest("hex"),
+					},
+					expectedDestination,
+				);
+				if (!replaced.ok) throw new PreviousRuntimeStateReadError();
+			},
+		}),
+	);
 }
 
 /**
@@ -1967,7 +1989,7 @@ async function withStateFileLocks<T>(stateFiles: readonly string[], operation: (
 }
 
 async function writeStateFile(stateFile: string, payload: Record<string, unknown>): Promise<void> {
-	await writeCoordinatorAtomic(stateFile, `${JSON.stringify(payload)}\n`);
+	await writeCoordinatorAtomic(stateFile, `${JSON.stringify(payload)}\n`, coordinatorAtomicWriteOptionsForTests());
 }
 
 function contextWithManagedOwnerGeneration(context: RuntimeStateContext): RuntimeStateContext {
@@ -2471,12 +2493,16 @@ export async function prepareCoordinatorRuntimeStateRescope(input: {
 					).toString("base64");
 				}
 				const writeJournal = async (journalFile: string): Promise<void> => {
-					await writeCoordinatorAtomic(journalFile, `${JSON.stringify(journal)}\n`, {
-						rename: async (source, destination) => {
-							const published = renameNoReplacePath(source, destination);
-							if (!published.ok) throw new PreviousRuntimeStateReadError();
-						},
-					});
+					await writeCoordinatorAtomic(
+						journalFile,
+						`${JSON.stringify(journal)}\n`,
+						coordinatorAtomicWriteOptionsForTests({
+							rename: async (source: string, destination: string) => {
+								const published = renameNoReplacePath(source, destination);
+								if (!published.ok) throw new PreviousRuntimeStateReadError();
+							},
+						}),
+					);
 				};
 				await __sessionStateSidecarTestHooks.beforeRescopeJournalWrite?.(previousCwd);
 				assertPinnedDirectoryIdentity(input.previousCwd, previousCwdIdentity);
@@ -2532,28 +2558,32 @@ export async function markCoordinatorRuntimeStateRescopePublishing(
 			).toString("base64");
 		}
 		const contents = `${JSON.stringify(journal)}\n`;
-		await writeCoordinatorAtomic(journalFile, contents, {
-			rename: async (source, destination) => {
-				const sourceStat = fsSync.lstatSync(source, { bigint: true });
-				const sourceParent = fsSync.lstatSync(path.dirname(source), { bigint: true });
-				const replaced = exactReplacePath(
-					source,
-					destination,
-					{
-						dev: sourceStat.dev,
-						ino: sourceStat.ino,
-						nlink: sourceStat.nlink,
-						parentDev: sourceParent.dev,
-						parentIno: sourceParent.ino,
-						size: sourceStat.size,
-						mtimeNs: sourceStat.mtimeNs,
-						sha256: createHash("sha256").update(contents).digest("hex"),
-					},
-					observed.identity,
-				);
-				if (!replaced.ok) throw new PreviousRuntimeStateReadError();
-			},
-		});
+		await writeCoordinatorAtomic(
+			journalFile,
+			contents,
+			coordinatorAtomicWriteOptionsForTests({
+				rename: async (source: string, destination: string) => {
+					const sourceStat = fsSync.lstatSync(source, { bigint: true });
+					const sourceParent = fsSync.lstatSync(path.dirname(source), { bigint: true });
+					const replaced = exactReplacePath(
+						source,
+						destination,
+						{
+							dev: sourceStat.dev,
+							ino: sourceStat.ino,
+							nlink: sourceStat.nlink,
+							parentDev: sourceParent.dev,
+							parentIno: sourceParent.ino,
+							size: sourceStat.size,
+							mtimeNs: sourceStat.mtimeNs,
+							sha256: createHash("sha256").update(contents).digest("hex"),
+						},
+						observed.identity,
+					);
+					if (!replaced.ok) throw new PreviousRuntimeStateReadError();
+				},
+			}),
+		);
 	}
 }