@gajae-code/coding-agent 0.18.10 → 0.18.12

package/src/tools/ast-edit-write-path.ts

@@ -66,3 +66,67 @@ export async function resolveAstEditPreviewWritePaths(
 	}
 	return resolved;
 }
+
+/** Refusal prefix when a single-file real path leaves its reference root. */
+export const AST_EDIT_OUTSIDE_ROOT_MESSAGE = "AST edit target resolves outside its root";
+
+function isEnoent(error: unknown): boolean {
+	return (error as NodeJS.ErrnoException | undefined)?.code === "ENOENT";
+}
+
+function staysInside(root: string, target: string): boolean {
+	const relative = path.relative(root, target);
+	return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+
+async function realOrLexical(target: string): Promise<string> {
+	try {
+		return await fs.realpath(target);
+	} catch (error) {
+		if (isEnoent(error)) return path.resolve(target);
+		throw error;
+	}
+}
+
+/**
+ * Native astEdit canonicalizes one file and writes that real path. Directory
+ * scans do not follow links. A lexical path inside cwd uses the real cwd as
+ * the reference root; an explicit path outside cwd uses its real parent, so a
+ * direct file there still applies. Returns the lexical path that would leave
+ * that root, if any.
+ */
+export async function astEditSingleFileOutsideReferenceRoot(
+	cwd: string,
+	candidatePaths: readonly string[],
+	signal?: AbortSignal,
+): Promise<string | undefined> {
+	signal?.throwIfAborted();
+	const resolvedCwd = path.resolve(cwd);
+	const realCwd = await realOrLexical(resolvedCwd);
+	for (const candidate of candidatePaths) {
+		signal?.throwIfAborted();
+		const lexical = path.resolve(resolvedCwd, candidate);
+		let followed: string;
+		try {
+			followed = await fs.realpath(lexical);
+		} catch (error) {
+			if (isEnoent(error)) continue;
+			throw error;
+		}
+		let stat: Awaited<ReturnType<typeof fs.stat>>;
+		try {
+			stat = await fs.stat(followed);
+		} catch (error) {
+			if (isEnoent(error)) continue;
+			throw error;
+		}
+		if (!stat.isFile()) continue;
+		const root =
+			staysInside(resolvedCwd, lexical) || staysInside(realCwd, lexical)
+				? realCwd
+				: await realOrLexical(path.dirname(lexical));
+		signal?.throwIfAborted();
+		if (!staysInside(root, followed)) return lexical;
+	}
+	return undefined;
+}

package/src/tools/ast-edit.ts

@@ -13,7 +13,11 @@ import { assertWorkflowMutationRawPathsAllowed } from "../skill-state/workflow-m
 import { Ellipsis, fileHyperlink, renderStatusLine, renderTreeList, truncateToWidth } from "../tui";
 import { resolveFileDisplayMode } from "../utils/file-display-mode";
 import type { ToolSession } from ".";
-import { resolveAstEditPreviewWritePaths } from "./ast-edit-write-path";
+import {
+	AST_EDIT_OUTSIDE_ROOT_MESSAGE,
+	astEditSingleFileOutsideReferenceRoot,
+	resolveAstEditPreviewWritePaths,
+} from "./ast-edit-write-path";
 import { assertEditableFile } from "./auto-generated-guard";
 import { createFileRecorder, formatResultPath } from "./file-recorder";
 import { formatGroupedFiles } from "./grouped-file-output";
@@ -220,6 +224,18 @@ export class AstEditTool implements AgentTool<typeof astEditSchema, AstEditToolD
 			});
 			const { searchPath: resolvedSearchPath, scopePath, isDirectory, multiTargets, globFilter } = scope;
 
+			const assertSingleFileReferenceRoot = async (flowSignal?: AbortSignal): Promise<void> => {
+				const nativeWritePaths = multiTargets ? multiTargets.map(target => target.basePath) : [resolvedSearchPath];
+				const outsideRoot = await astEditSingleFileOutsideReferenceRoot(
+					this.session.cwd,
+					nativeWritePaths,
+					flowSignal,
+				);
+				if (outsideRoot) {
+					throw new ToolError(`${AST_EDIT_OUTSIDE_ROOT_MESSAGE}: ${outsideRoot}`);
+				}
+			};
+
 			const result = await runAstEditOnce(multiTargets, resolvedSearchPath, globFilter, {
 				rewrites: normalizedRewrites,
 				dryRun: true,
@@ -351,6 +367,7 @@ export class AstEditTool implements AgentTool<typeof astEditSchema, AstEditToolD
 						for (const filePath of previewedFiles) {
 							await assertEditableFile(resolvePlanPath(this.session, filePath), filePath, this.session.settings);
 						}
+						await assertSingleFileReferenceRoot();
 						const applyResult = await runAstEditOnce(multiTargets, resolvedSearchPath, globFilter, {
 							rewrites: normalizedRewrites,
 							dryRun: false,

package/src/tools/atomic-file-write.ts

@@ -25,10 +25,11 @@
  *
  * Destination symlinks are followed: the referent is replaced, the link stays.
  * The referent is re-resolved immediately before publication so a retargeted
- * link cannot silently repoint the write, and when the lexical destination
- * sits inside a session-scoped `gjc-local` root the resolved referent and its
- * parent must remain inside that root (a link there must not redirect the
- * write out of the trust boundary).
+ * link cannot silently repoint the write. When the lexical destination sits
+ * inside the active explicit artifacts local root (`<artifacts>/local`) or a
+ * session-scoped `gjc-local` root, the resolved referent and its parent must
+ * remain inside that root (a link there must not redirect the write out of
+ * the trust boundary).
  *
  * Staging uses exclusive create (`wx`) so a colliding leftover temp is never
  * truncated or unlinked; only the temp this call created is cleaned on failure.
@@ -44,6 +45,7 @@ import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
 import { hasFsCode, isEacces, isEisdir, isEnoent, isFsError } from "@gajae-code/utils";
+import { LocalProtocolHandler } from "../internal-urls/local-protocol";
 
 const TEMP_CREATE_ATTEMPTS = 8;
 const DEFAULT_FILE_MODE = 0o666;
@@ -111,9 +113,10 @@ export function formatFileWriteError(error: unknown, dest: string, options: { de
 export interface WriteFileAtomicallyOptions {
 	/**
 	 * Trusted root that a resolved symlink referent and its parent must not
-	 * leave. When omitted, the helper still enforces the session-scoped
-	 * `gjc-local` boundary implied by a lexical destination under
-	 * `<tmpdir>/gjc-local/<session-id>`.
+	 * leave. When omitted, a destination inside the active explicit artifacts
+	 * local root (`<artifacts>/local`) uses that root. Otherwise the helper
+	 * still enforces the session-scoped `gjc-local` boundary implied by a
+	 * lexical destination under `<tmpdir>/gjc-local/<session-id>`.
 	 */
 	trustBoundary?: string;
 	/** Platform override used by deterministic retry tests. */
@@ -170,11 +173,20 @@ function pathIsWithin(target: string, root: string): boolean {
 }
 
 async function realpathOrSelf(p: string): Promise<string> {
-	try {
-		return await fs.realpath(p);
-	} catch (error) {
-		if (!isEnoent(error)) throw error;
-		return path.resolve(p);
+	const resolved = path.resolve(p);
+	const missing: string[] = [];
+	let cursor = resolved;
+	for (;;) {
+		try {
+			const real = await fs.realpath(cursor);
+			return missing.length === 0 ? real : path.join(real, ...missing.reverse());
+		} catch (error) {
+			if (!isEnoent(error)) throw error;
+			const parent = path.dirname(cursor);
+			if (parent === cursor) return resolved;
+			missing.push(path.basename(cursor));
+			cursor = parent;
+		}
 	}
 }
 
@@ -193,6 +205,25 @@ function sessionLocalRootFor(lexicalDest: string): string | undefined {
 	return path.join(localParent, sessionSegment);
 }
 
+/**
+ * Active explicit artifacts root (`<artifacts>/local`) when `lexicalDest` is
+ * inside it. That root is not under `<tmpdir>/gjc-local`, so the tmp helper
+ * above would leave the write unbounded. Managed sessions keep the tmp root.
+ */
+function explicitLocalRootFor(lexicalDest: string): string | undefined {
+	const options = LocalProtocolHandler.resolveOptions();
+	if (!options || options.isManagedDestination?.()) return undefined;
+	const artifactsDir = options.getArtifactsDir?.();
+	if (!artifactsDir) return undefined;
+	const root = path.resolve(artifactsDir, "local");
+	if (!pathIsWithin(path.resolve(lexicalDest), root)) return undefined;
+	return root;
+}
+
+function trustBoundaryForDestination(lexicalDest: string): string | undefined {
+	return explicitLocalRootFor(lexicalDest) ?? sessionLocalRootFor(lexicalDest);
+}
+
 /**
  * Reject publication when the resolved referent's real parent (and therefore
  * the referent itself) leaves the trust boundary. The boundary root is
@@ -201,8 +232,8 @@ function sessionLocalRootFor(lexicalDest: string): string | undefined {
  * This must run before any directory is created. A dangling symlink inside a
  * trusted root resolves to a path outside it, so creating parents first would
  * let an attacker-selected directory tree be materialized outside the sandbox
- * before publication is refused. Missing ancestors therefore resolve
- * lexically (`realpathOrSelf` tolerates ENOENT) and are still boundary-checked.
+ * before publication is refused. A missing path is resolved through the
+ * nearest existing ancestor's realpath, then the missing suffix is appended.
  */
 async function assertWithinTrustBoundary(publishPath: string, trustBoundary: string): Promise<void> {
 	const boundary = path.resolve(trustBoundary);
@@ -502,7 +533,7 @@ export async function writeFileAtomically(
 	try {
 		const platform = options.platform ?? process.platform;
 		const sleep = options.sleep ?? (async (delayMs: number): Promise<void> => await Bun.sleep(delayMs));
-		const trustBoundary = options.trustBoundary ?? sessionLocalRootFor(dest);
+		const trustBoundary = options.trustBoundary ?? trustBoundaryForDestination(dest);
 		const resolved = await resolvePublishPath(dest);
 		publishPath = resolved.publishPath;
 		// Boundary first, then create parents. A dangling symlink inside a trusted

package/src/tools/auto-generated-guard.ts

@@ -36,6 +36,8 @@ const AUTO_GENERATED_HEADER_MARKERS: readonly RegExp[] = [
 	/\bcode\s+generated\s+by\s+[a-z0-9_.-]+/i,
 	/\bthis\s+file\s+was\s+automatically\s+generated\b/i,
 	new RegExp(`\\bgenerated\\s+by\\s+${KNOWN_GENERATOR_PATTERN}\\b`, "i"),
+	/\bgenerated\s+by\s+scripts\/[a-z0-9_./-]+/i,
+	/\bauto-generated\s+by\s+[a-z0-9_./-]+/i,
 ];
 
 type CommentStyle = "slash" | "hash" | "sql" | "html";
@@ -100,6 +102,7 @@ const AUTO_GENERATED_FILENAME_PATTERNS = [
 	/_pb2\.py$/,
 	/_pb2_grpc\.py$/,
 	/\.gen\.(go|ts|js|py)$/,
+	/\.generated\.ts$/,
 	/^generated\.(go|ts|js|py)$/,
 	/\.swagger\.json$/,
 	/\.openapi\.json$/,

package/src/tools/bash-allowed-prefixes.ts

@@ -1,3 +1,5 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
 import {
 	classifyStateArgv,
 	STATE_ACTION_NAMES,
@@ -13,8 +15,20 @@ export interface BashAllowedPrefixesCheck {
 
 export type BashRestrictionProfile = "workflow" | "read-only";
 
+/** Session identities and workspace the restricted `gjc` command may name. */
+export interface GjcSessionBinding {
+	sessionId?: string | null;
+	/** Owner identity already on the tool session. Role-agent ralplan writes use it. */
+	credentialSessionId?: string | null;
+	/** Session workspace. A `--worktree-root` must be this repo, not a foreign one. */
+	worktreeRoot: string;
+	/** Child cwd. Relative `--worktree-root` resolves against it, as ralplan does. */
+	invocationCwd: string;
+}
+
 export interface BashRestrictionOptions {
 	profile?: BashRestrictionProfile;
+	gjcSessionBinding?: GjcSessionBinding;
 }
 
 const SHELL_CONTROL_CHARS = new Set([";", "|", "&", "<", ">", "(", ")"]);
@@ -231,6 +245,33 @@ function isLongOption(word: string, option: string): boolean {
 	return word === option || word.startsWith(`${option}=`);
 }
 
+function fileCompilesMagic(words: readonly string[]): boolean {
+	const valueOptions = ["--exclude", "--exclude-quiet", "--files-from", "--separator", "--magic-file", "--parameter"];
+	for (let index = 1; index < words.length; index += 1) {
+		const word = words[index]!;
+		if (word === "--") break;
+		if (word.startsWith("--")) {
+			const equalsAt = word.indexOf("=");
+			const name = equalsAt === -1 ? word : word.slice(0, equalsAt);
+			if (name.length > 2 && "--compile".startsWith(name)) return true;
+			if (equalsAt === -1 && valueOptions.some(option => name.length > 2 && option.startsWith(name))) {
+				index += 1;
+			}
+		} else if (word.startsWith("-")) {
+			for (let offset = 1; offset < word.length; offset += 1) {
+				const flag = word[offset]!;
+				if (flag === "C") return true;
+				// Required arguments consume the rest of the cluster, or the next word (even `--`).
+				if ("eFfmMP".includes(flag)) {
+					if (offset === word.length - 1) index += 1;
+					break;
+				}
+			}
+		}
+	}
+	return false;
+}
+
 function hasShortOption(word: string, option: string): boolean {
 	return word.startsWith("-") && !word.startsWith("--") && word.slice(1).includes(option);
 }
@@ -254,6 +295,9 @@ function validateReadOnlyCommand(words: readonly string[]): BashAllowedPrefixesC
 			if (isLongOption(option, "--pre") || isLongOption(option, "--pre-glob")) {
 				return { allowed: false, reason: "read-only bash does not allow ripgrep preprocessors" };
 			}
+			if (isLongOption(option, "--hostname-bin")) {
+				return { allowed: false, reason: "read-only bash does not allow ripgrep hostname commands" };
+			}
 			if (isLongOption(option, "--search-zip") || hasShortOption(option, "z")) {
 				return { allowed: false, reason: "read-only bash does not allow ripgrep compressed-file subprocesses" };
 			}
@@ -268,6 +312,10 @@ function validateReadOnlyCommand(words: readonly string[]): BashAllowedPrefixesC
 		}
 	}
 
+	if (command === "file" && fileCompilesMagic(words)) {
+		return { allowed: false, reason: "read-only bash does not allow file magic compilation" };
+	}
+
 	const gitWrite = rejectGitHostAccess(words);
 	if (gitWrite) return gitWrite;
 
@@ -284,7 +332,107 @@ function rejectGitHostAccess(words: readonly string[]): BashAllowedPrefixesCheck
 	return undefined;
 }
 
-function validateMatchedGjcCommand(words: readonly string[]): BashAllowedPrefixesCheck {
+const GJC_SESSION_BIND_REASON = "restricted role-agent bash binds gjc to the current session";
+const GJC_WORKTREE_BIND_REASON = "restricted role-agent bash binds gjc --worktree-root to the current repository";
+
+function separateFlagValues(words: readonly string[], flag: string): string[] {
+	const values: string[] = [];
+	for (let index = 0; index < words.length; index += 1) {
+		if (words[index] !== flag) continue;
+		values.push(words[index + 1] ?? "");
+		index += 1;
+	}
+	return values;
+}
+
+function boundSessionIds(binding: GjcSessionBinding): ReadonlySet<string> {
+	const ids = new Set<string>();
+	for (const value of [binding.sessionId, binding.credentialSessionId]) {
+		if (typeof value !== "string") continue;
+		const trimmed = value.trim();
+		if (trimmed) ids.add(trimmed);
+	}
+	return ids;
+}
+
+function inlineStateSessionIds(words: readonly string[]): string[] {
+	if (words[1] !== "state") return [];
+	const ids: string[] = [];
+	for (const input of classifyStateArgv(words.slice(2)).inputs) {
+		if (input.kind !== "inline") continue;
+		let payload: unknown;
+		try {
+			payload = JSON.parse(input.raw);
+		} catch {
+			continue;
+		}
+		if (!payload || typeof payload !== "object" || Array.isArray(payload)) continue;
+		const sessionId = (payload as Record<string, unknown>).session_id;
+		if (typeof sessionId === "string") ids.push(sessionId);
+	}
+	return ids;
+}
+
+function gitCommonDir(directory: string): string | undefined {
+	const result = Bun.spawnSync(["git", "-C", directory, "rev-parse", "--git-common-dir"], {
+		stdout: "pipe",
+		stderr: "ignore",
+	});
+	if (result.exitCode !== 0) return undefined;
+	const text = result.stdout.toString().trim();
+	if (!text) return undefined;
+	const absolute = path.isAbsolute(text) ? text : path.resolve(directory, text);
+	try {
+		return fs.realpathSync(absolute);
+	} catch {
+		return undefined;
+	}
+}
+
+/** Same directory, or another worktree of the same git common dir (isolated tasks). */
+function sameRepository(workspace: string, target: string): boolean {
+	let workspaceReal: string;
+	let targetReal: string;
+	try {
+		workspaceReal = fs.realpathSync(workspace);
+		targetReal = fs.realpathSync(target);
+	} catch {
+		return false;
+	}
+	if (workspaceReal === targetReal) return true;
+	const workspaceCommon = gitCommonDir(workspaceReal);
+	const targetCommon = gitCommonDir(targetReal);
+	return workspaceCommon !== undefined && workspaceCommon === targetCommon;
+}
+
+function worktreeSelectorAllowed(binding: GjcSessionBinding, rawTarget: string): boolean {
+	const trimmed = rawTarget.trim();
+	if (!trimmed) return false;
+	const resolved = path.isAbsolute(trimmed) ? trimmed : path.resolve(binding.invocationCwd, trimmed);
+	return sameRepository(binding.worktreeRoot, resolved);
+}
+
+function rejectUnboundGjcCommand(
+	words: readonly string[],
+	options: BashRestrictionOptions,
+): BashAllowedPrefixesCheck | undefined {
+	const binding = options.gjcSessionBinding;
+	if (!binding) return undefined;
+	const allowed = boundSessionIds(binding);
+	const sessionSelectors = [...separateFlagValues(words, "--session-id"), ...inlineStateSessionIds(words)];
+	if (sessionSelectors.some(value => !allowed.has(value.trim()))) {
+		return { allowed: false, reason: GJC_SESSION_BIND_REASON };
+	}
+	if (separateFlagValues(words, "--worktree-root").some(value => !worktreeSelectorAllowed(binding, value))) {
+		return { allowed: false, reason: GJC_WORKTREE_BIND_REASON };
+	}
+	return undefined;
+}
+
+function validateMatchedGjcCommand(
+	words: readonly string[],
+	options: BashRestrictionOptions,
+): BashAllowedPrefixesCheck {
 	const gitWrite = rejectGitHostAccess(words);
 	if (gitWrite) return gitWrite;
 	if (words[0] !== "gjc") return { allowed: true };
@@ -293,7 +441,7 @@ function validateMatchedGjcCommand(words: readonly string[]): BashAllowedPrefixe
 		if (!words.includes("--write")) {
 			return { allowed: false, reason: "restricted role-agent bash only allows `gjc ralplan --write ...`" };
 		}
-		return { allowed: true };
+		return rejectUnboundGjcCommand(words, options) ?? { allowed: true };
 	}
 
 	if (words[1] === "state") {
@@ -311,10 +459,10 @@ function validateMatchedGjcCommand(words: readonly string[]): BashAllowedPrefixe
 				reason: `restricted role-agent bash does not allow \`gjc state ${classification.parsed.action}\``,
 			};
 		}
-		return { allowed: true };
+		return rejectUnboundGjcCommand(words, options) ?? { allowed: true };
 	}
 
-	return { allowed: true };
+	return rejectUnboundGjcCommand(words, options) ?? { allowed: true };
 }
 
 function commandAllowedPrefixesReason(normalizedPrefixes: readonly string[], options: BashRestrictionOptions): string {
@@ -360,5 +508,5 @@ export function checkBashAllowedPrefixes(
 	if (options.profile === "read-only") {
 		return validateReadOnlyCommand(parsed.words);
 	}
-	return validateMatchedGjcCommand(parsed.words);
+	return validateMatchedGjcCommand(parsed.words, options);
 }

package/src/tools/bash-interactive.ts

@@ -12,6 +12,7 @@ import {
 	visibleWidth,
 } from "@gajae-code/tui";
 import { logger, sanitizeText } from "@gajae-code/utils";
+import { projectDeclaredSpawnHookNames, projectSafeHomeOverride } from "@gajae-code/utils/shell-config";
 import type { Terminal as XtermTerminalType } from "@xterm/headless";
 import { Settings } from "../config/settings";
 import { NON_INTERACTIVE_ENV } from "../exec/non-interactive-env";
@@ -323,6 +324,14 @@ export interface InteractivePtyControls {
 	detachForegroundCancellation: () => void;
 }
 
+function ptyUnsetHookNames(explicit: Record<string, string> | undefined): string[] {
+	return projectDeclaredSpawnHookNames().filter(name => !Object.hasOwn(explicit ?? {}, name));
+}
+
+function ptyHomeOverride(explicit: Record<string, string> | undefined): Record<string, string> {
+	return projectSafeHomeOverride(explicit);
+}
+
 export async function runInteractiveBashPty(
 	ui: NonNullable<AgentToolContext["ui"]>,
 	options: {
@@ -422,8 +431,11 @@ export async function runInteractiveBashPty(
 				command: options.command,
 				cwd: options.cwd,
 				timeoutMs: options.timeoutMs,
-				env: { ...NON_INTERACTIVE_ENV, ...options.env },
-				unsetEnv: options.unsetEnv,
+				// The PTY child inherits the process env; drop project hook variables
+				// unless this call sets them explicitly. A dropped HOME is replaced by
+				// the trusted account home so the shell and git still have one.
+				env: { ...ptyHomeOverride(options.env), ...NON_INTERACTIVE_ENV, ...options.env },
+				unsetEnv: [...(options.unsetEnv ?? []), ...ptyUnsetHookNames(options.env)],
 				signal: processAbortController.signal,
 				cols: initialPtySize.cols,
 				rows: initialPtySize.rows,

package/src/tools/bash.ts

@@ -1379,9 +1379,23 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 		}
 		if (allowedPrefixes && allowedPrefixes.length > 0) {
 			const commandsToCheck = rawCommand === command ? [command] : [rawCommand, command];
+			const invocationCwd =
+				cwd && !cwd.includes("://") && !cwd.includes("local:/")
+					? resolveToCwd(cwd, this.session.cwd)
+					: this.session.cwd;
 			for (const commandToCheck of commandsToCheck) {
 				const allowlist = checkBashAllowedPrefixes(commandToCheck, allowedPrefixes, {
 					profile: this.session.bashRestrictionProfile,
+					...(this.session.bashRestrictionProfile === "read-only"
+						? {}
+						: {
+								gjcSessionBinding: {
+									sessionId: this.session.getSessionId?.() ?? null,
+									credentialSessionId: this.session.getCredentialSessionId?.() ?? null,
+									worktreeRoot: this.session.cwd,
+									invocationCwd,
+								},
+							}),
 				});
 				if (!allowlist.allowed) {
 					throw new ToolError(allowlist.reason ?? "Command blocked by restricted role-agent bash allowlist.");

package/src/tools/debug.ts

@@ -466,8 +466,8 @@ function buildOutcomeText(outcome: DapContinueOutcome, timeoutSec: number, verb:
 	return lines.join("\n");
 }
 
-function getConfiguredAdapters(cwd: string): string {
-	const adapters = getAvailableAdapters(cwd).map(adapter => adapter.name);
+function getConfiguredAdapters(cwd: string, trustCwds?: readonly string[]): string {
+	const adapters = getAvailableAdapters(cwd, trustCwds).map(adapter => adapter.name);
 	return adapters.length > 0 ? adapters.join(", ") : "none";
 }
 async function validateLaunchProgram(program: string, cwd: string): Promise<void> {
@@ -637,6 +637,7 @@ export class DebugTool implements AgentTool<typeof debugSchema, DebugToolDetails
 		const combinedSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
 		const details: DebugToolDetails = { action: params.action, success: true };
 		const result = toolResult(details);
+		const trustCwds = [this.session.cwd];
 		switch (params.action) {
 			case "launch": {
 				if (!params.program) {
@@ -645,10 +646,10 @@ export class DebugTool implements AgentTool<typeof debugSchema, DebugToolDetails
 				const commandCwd = params.cwd ? resolveToCwd(params.cwd, this.session.cwd) : this.session.cwd;
 				const program = resolveToCwd(params.program, commandCwd);
 				await validateLaunchProgram(program, commandCwd);
-				const adapter = selectLaunchAdapter(program, commandCwd, params.adapter);
+				const adapter = selectLaunchAdapter(program, commandCwd, params.adapter, trustCwds);
 				if (!adapter) {
 					throw new ToolError(
-						`No debugger adapter available. Installed adapters: ${getConfiguredAdapters(commandCwd)}`,
+						`No debugger adapter available. Installed adapters: ${getConfiguredAdapters(commandCwd, trustCwds)}`,
 					);
 				}
 				const snapshot = await dapSessionManager.launch(
@@ -665,10 +666,10 @@ export class DebugTool implements AgentTool<typeof debugSchema, DebugToolDetails
 					throw new ToolError("attach requires pid or port");
 				}
 				const commandCwd = params.cwd ? resolveToCwd(params.cwd, this.session.cwd) : this.session.cwd;
-				const adapter = selectAttachAdapter(commandCwd, params.adapter, params.port);
+				const adapter = selectAttachAdapter(commandCwd, params.adapter, params.port, trustCwds);
 				if (!adapter) {
 					throw new ToolError(
-						`No debugger adapter available. Installed adapters: ${getConfiguredAdapters(commandCwd)}`,
+						`No debugger adapter available. Installed adapters: ${getConfiguredAdapters(commandCwd, trustCwds)}`,
 					);
 				}
 				const snapshot = await dapSessionManager.attach(

package/src/tools/descriptors.test.ts

@@ -35,6 +35,7 @@ function makeSession(overrides: Record<string, unknown> = {}): any {
 		"astGrep.enabled": true,
 		"astEdit.enabled": true,
 		"renderMermaid.enabled": true,
+		"reportIssue.enabled": true,
 		"web_search.enabled": true,
 		"calc.enabled": true,
 		"skill.enabled": true,
@@ -128,6 +129,7 @@ describe("tool descriptor compatibility gate", () => {
 			"skill",
 			"goal",
 			"move_session",
+			"report_issue",
 		];
 		expect(Object.keys(BUILTIN_TOOLS)).toEqual(expectedBuiltin);
 		expect(Object.keys(BUILTIN_TOOL_DESCRIPTORS)).toEqual(expectedBuiltin);
@@ -291,6 +293,7 @@ describe("tool descriptor compatibility gate", () => {
 			"astGrep.enabled": false,
 			"astEdit.enabled": false,
 			"renderMermaid.enabled": false,
+			"reportIssue.enabled": false,
 			"web_search.enabled": false,
 			"calc.enabled": false,
 			"skill.enabled": false,
@@ -313,6 +316,7 @@ describe("tool descriptor compatibility gate", () => {
 			"ast_grep",
 			"ast_edit",
 			"render_mermaid",
+			"report_issue",
 			"web_search",
 			"calc",
 			"skill",
@@ -961,6 +965,46 @@ describe("tool descriptor compatibility gate", () => {
 		expect((normalizedBisect.parameters as any).properties?._i).toBeUndefined();
 		expect((normalizedWrite.parameters as any).properties?._i).toBeDefined();
 	});
+	for (const staleOutcome of ["resolved", "rejected"] as const) {
+		test(`session move invalidation keeps a newer load when the old load ${staleOutcome}`, async () => {
+			const first = Promise.withResolvers<AgentTool>();
+			const second = Promise.withResolvers<AgentTool>();
+			const oldTool = syntheticTool();
+			const newTool = syntheticTool();
+			let loads = 0;
+			const session = makeSession();
+			const descriptor: ToolDescriptor = {
+				metadata: { name: "synthetic" },
+				presentation: { label: "Synthetic" },
+				isAvailable: () => true,
+				load: () => (++loads === 1 ? first.promise : second.promise),
+			};
+			const lazy = new LazyAgentTool(descriptor, undefined, () => descriptor.load(session), session);
+			const oldLoad = lazy.materializeForTests().then(
+				tool => ({ tool, error: undefined }),
+				error => ({ tool: undefined, error }),
+			);
+			await Promise.resolve();
+			expect(loads).toBe(1);
+			lazy.invalidateForSessionMove();
+			const newLoad = lazy.materializeForTests();
+			await Promise.resolve();
+			expect(loads).toBe(2);
+			if (staleOutcome === "resolved") first.resolve(oldTool);
+			else first.reject(new Error("old context load failed"));
+			const oldResult = await oldLoad;
+			if (staleOutcome === "resolved") expect(oldResult.tool).toBe(oldTool);
+			else expect(String(oldResult.error)).toContain("old context load failed");
+			const joinedLoad = lazy.materializeForTests();
+			await Promise.resolve();
+			expect(loads).toBe(2);
+			second.resolve(newTool);
+			expect(await newLoad).toBe(newTool);
+			expect(await joinedLoad).toBe(newTool);
+			expect(await lazy.materializeForTests()).toBe(newTool);
+		});
+	}
+
 	test("concurrent lazy first use shares one load and cleanup registration", async () => {
 		let loads = 0;
 		let cleanupRegistrations = 0;