@gajae-code/coding-agent 0.18.11 → 0.18.12

package/src/dap/config.ts

@@ -1,6 +1,7 @@
 import * as path from "node:path";
 import { isRecord } from "@gajae-code/utils";
 import { hasRootMarkers, resolveTrustedCommand } from "../lsp/config";
+import { isProjectControlledPath } from "../lsp/path-trust";
 import DEFAULTS from "./defaults.json" with { type: "json" };
 import type { DapAdapterConfig, DapResolvedAdapter } from "./types";
 
@@ -48,11 +49,20 @@ export function getAdapterConfigs(): Record<string, DapAdapterConfig> {
 	return { ...DEFAULT_ADAPTERS };
 }
 
-export function resolveAdapter(adapterName: string, cwd: string): DapResolvedAdapter | null {
+/**
+ * `trustCwds` are extra trust roots, such as the session workspace when the command
+ * cwd is a different directory. A command controlled by any of them is refused.
+ */
+export function resolveAdapter(
+	adapterName: string,
+	cwd: string,
+	trustCwds?: readonly string[],
+): DapResolvedAdapter | null {
 	const config = DEFAULT_ADAPTERS[adapterName];
 	if (!config) return null;
 	const resolvedCommand = resolveTrustedCommand(config.command, cwd);
 	if (!resolvedCommand) return null;
+	if (trustCwds?.some(root => isProjectControlledPath(resolvedCommand, root))) return null;
 	return {
 		name: adapterName,
 		command: config.command,
@@ -67,15 +77,15 @@ export function resolveAdapter(adapterName: string, cwd: string): DapResolvedAda
 	};
 }
 
-export function getAvailableAdapters(cwd: string): DapResolvedAdapter[] {
+export function getAvailableAdapters(cwd: string, trustCwds?: readonly string[]): DapResolvedAdapter[] {
 	return Object.keys(DEFAULT_ADAPTERS)
-		.map(name => resolveAdapter(name, cwd))
+		.map(name => resolveAdapter(name, cwd, trustCwds))
 		.filter((adapter): adapter is DapResolvedAdapter => adapter !== null);
 }
 
-function getMatchingAdapters(program: string, cwd: string): DapResolvedAdapter[] {
+function getMatchingAdapters(program: string, cwd: string, trustCwds?: readonly string[]): DapResolvedAdapter[] {
 	const extension = path.extname(program).toLowerCase();
-	const available = getAvailableAdapters(cwd);
+	const available = getAvailableAdapters(cwd, trustCwds);
 	if (!extension) {
 		// For extensionless binaries, only consider native debuggers (gdb, lldb-dap)
 		// or adapters that match by root markers. Don't silently fall back to
@@ -124,20 +134,30 @@ function sortAdaptersForLaunch(program: string, cwd: string, adapters: DapResolv
 	return rootAware.map(entry => entry.adapter);
 }
 
-export function selectLaunchAdapter(program: string, cwd: string, adapterName?: string): DapResolvedAdapter | null {
+export function selectLaunchAdapter(
+	program: string,
+	cwd: string,
+	adapterName?: string,
+	trustCwds?: readonly string[],
+): DapResolvedAdapter | null {
 	if (adapterName) {
-		return resolveAdapter(adapterName, cwd);
+		return resolveAdapter(adapterName, cwd, trustCwds);
 	}
-	const matches = getMatchingAdapters(program, cwd);
+	const matches = getMatchingAdapters(program, cwd, trustCwds);
 	const sorted = sortAdaptersForLaunch(program, cwd, matches);
 	return sorted[0] ?? null;
 }
 
-export function selectAttachAdapter(cwd: string, adapterName?: string, port?: number): DapResolvedAdapter | null {
+export function selectAttachAdapter(
+	cwd: string,
+	adapterName?: string,
+	port?: number,
+	trustCwds?: readonly string[],
+): DapResolvedAdapter | null {
 	if (adapterName) {
-		return resolveAdapter(adapterName, cwd);
+		return resolveAdapter(adapterName, cwd, trustCwds);
 	}
-	const available = getAvailableAdapters(cwd);
+	const available = getAvailableAdapters(cwd, trustCwds);
 	if (port !== undefined) {
 		const debugpy = available.find(adapter => adapter.name === "debugpy");
 		if (debugpy) return debugpy;

package/src/dap/defaults.json

@@ -44,7 +44,7 @@
 	},
 	"debugpy": {
 		"command": "python",
-		"args": ["-m", "debugpy.adapter"],
+		"args": ["-I", "-m", "debugpy.adapter"],
 		"languages": ["python"],
 		"fileTypes": [".py"],
 		"rootMarkers": ["pyproject.toml", "setup.py", "requirements.txt", "Pipfile"],

package/src/debug/crash-diagnostics.ts

@@ -1,6 +1,7 @@
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
+import { redactCrashSecrets } from "@gajae-code/utils";
 
 const CRASH_DIAGNOSTICS_ENV = "GJC_CRASH_DIAGNOSTICS";
 const CRASH_DIAGNOSTICS_DIR_ENV = "GJC_CRASH_DIAGNOSTICS_DIR";
@@ -169,7 +170,7 @@ export async function writeCrashReport(
 		pid: process.pid,
 		cwd: options.cwd ?? process.cwd(),
 		...classification,
-		stderrPreview: input.stderr ? trimStartBytes(input.stderr, STDERR_PREVIEW_BYTES) : undefined,
+		stderrPreview: input.stderr ? trimStartBytes(redactCrashSecrets(input.stderr), STDERR_PREVIEW_BYTES) : undefined,
 		spawnError: input.spawnError === undefined ? undefined : stringifyError(input.spawnError),
 	};
 	const enabled = crashDiagnosticsEnabled(options.env);

package/src/debug/report-bundle.ts

@@ -14,6 +14,7 @@ import {
 	getLogsDir,
 	getReportsDir,
 	isEnoent,
+	redactCrashSecrets,
 	resolveEquivalentPath,
 } from "@gajae-code/utils";
 import type { CpuProfile, HeapSnapshot } from "./profiler";
@@ -228,12 +229,30 @@ export async function createReportBundle(options: ReportBundleOptions): Promise<
 		}
 	}
 
+	// Scrub the transcript copies only. Settings, system info, and profiles are
+	// separate payloads and stay as collected. Sources on disk are not rewritten.
+	for (const archivePath of Object.keys(data)) {
+		const content = data[archivePath];
+		if (content === undefined || !reportEntryCarriesUserText(archivePath)) continue;
+		data[archivePath] = redactCrashSecrets(content);
+	}
+
 	// Write archive
 	await Bun.Archive.write(outputPath, data, { compress: "gzip" });
 
 	return { path: outputPath, files };
 }
 
+/** Session, log, artifact, and subagent copies are the transcript the user may attach. */
+function reportEntryCarriesUserText(archivePath: string): boolean {
+	return (
+		archivePath === "logs.txt" ||
+		archivePath === "session.jsonl" ||
+		archivePath.startsWith("artifacts/") ||
+		archivePath.startsWith("subagents/")
+	);
+}
+
 /** Add all files from a directory to the archive */
 async function addDirectoryToArchive(
 	data: Record<string, string>,

package/src/debug/system-info.ts

@@ -3,7 +3,7 @@
  */
 
 import * as os from "node:os";
-import { APP_NAME, formatBytes, getProjectDir, VERSION } from "@gajae-code/utils";
+import { APP_NAME, formatBytes, getProjectDir, redactCrashSecrets, VERSION } from "@gajae-code/utils";
 
 export interface SystemInfo {
 	os: string;
@@ -97,7 +97,12 @@ export function formatSystemInfo(info: SystemInfo): string {
 	return lines.join("\n");
 }
 
-/** Sanitize environment variables by redacting sensitive values */
+/**
+ * Sanitize environment variables for a debug report.
+ * Sensitive names stay fully replaced. Other values keep their text, with the
+ * same credential shapes removed that crash records already scrub before they
+ * are written to disk.
+ */
 export function sanitizeEnv(env: Record<string, string | undefined>): Record<string, string> {
 	const SENSITIVE_PATTERNS = [
 		/key/i,
@@ -117,7 +122,7 @@ export function sanitizeEnv(env: Record<string, string | undefined>): Record<str
 	for (const [k, v] of Object.entries(env)) {
 		if (v === undefined) continue;
 		const isSensitive = SENSITIVE_PATTERNS.some(p => p.test(k));
-		result[k] = isSensitive ? "[REDACTED]" : v;
+		result[k] = isSensitive ? "[REDACTED]" : redactCrashSecrets(v);
 	}
 	return result;
 }

package/src/defaults/gjc/extensions/grok-cli-vendor/src/shared/base-url.ts

@@ -1,5 +1,8 @@
+import { $credentialEnv, $pickCredentialEnv } from '@gajae-code/utils';
+
 const DEFAULT_GROK_BUILD_BASE_URL = 'https://cli-chat-proxy.grok.com/v1';
 const ALLOWED_GROK_BUILD_HOSTS = new Set(['cli-chat-proxy.grok.com']);
+const UNSAFE_BASE_URL_ENV = 'GJC_GROK_CLI_ALLOW_UNSAFE_BASE_URL';
 
 function normalizeBaseUrl(baseUrl: string): string {
   return baseUrl.trim().replace(/\/+$/, '');
@@ -14,23 +17,34 @@ function isAllowedCredentialHost(baseUrl: string): boolean {
   }
 }
 
+/**
+ * Operator environment only. `$credentialEnv` already drops a cwd dotenv value,
+ * including a dynamic declaration, using the snapshot taken when the env module
+ * loaded. A repository `.env` therefore cannot name the Grok Build base URL or
+ * approve that URL with the unsafe opt-in.
+ */
+function trustedConfiguredBaseUrl(): string | undefined {
+  return $pickCredentialEnv('GJC_GROK_CLI_BASE_URL', 'GROK_CLI_BASE_URL');
+}
+
+function unsafeOverrideAllowed(): boolean {
+  return $credentialEnv(UNSAFE_BASE_URL_ENV) === '1';
+}
+
 export function getBaseUrl(): string {
-  const configured = process.env.GJC_GROK_CLI_BASE_URL || process.env.GROK_CLI_BASE_URL;
+  const configured = trustedConfiguredBaseUrl();
   if (!configured) return DEFAULT_GROK_BUILD_BASE_URL;
 
   const normalized = normalizeBaseUrl(configured);
   if (isAllowedCredentialHost(normalized)) return normalized;
-
-  if (process.env.GJC_GROK_CLI_ALLOW_UNSAFE_BASE_URL === '1') return normalized;
+  if (unsafeOverrideAllowed()) return normalized;
 
   return DEFAULT_GROK_BUILD_BASE_URL;
 }
 
 export function isGrokBuildBaseUrlOverrideIgnored(): boolean {
-  const configured = process.env.GJC_GROK_CLI_BASE_URL || process.env.GROK_CLI_BASE_URL;
+  const configured = trustedConfiguredBaseUrl();
   if (!configured) return false;
   const normalized = normalizeBaseUrl(configured);
-  return (
-    !isAllowedCredentialHost(normalized) && process.env.GJC_GROK_CLI_ALLOW_UNSAFE_BASE_URL !== '1'
-  );
+  return !isAllowedCredentialHost(normalized) && !unsafeOverrideAllowed();
 }

package/src/discovery/agents-md.ts

@@ -43,7 +43,7 @@ async function readBoundedAgentsMdFile(
 	const homeIsStable = async (): Promise<boolean> => {
 		if (!options?.home || !options.homeIdentity) return true;
 		try {
-			const current = await fs.stat(options.home);
+			const current = await fs.stat(options.home, { bigint: true });
 			return current.dev === options.homeIdentity.dev && current.ino === options.homeIdentity.ino;
 		} catch {
 			return false;

package/src/discovery/helpers.ts

@@ -1005,8 +1005,7 @@ export async function readContainedFile(
 		rootIdentity = capturedRoot;
 		if (
 			expectedRootIdentity !== undefined &&
-			(rootIdentity.dev !== BigInt(expectedRootIdentity.dev) ||
-				rootIdentity.ino !== BigInt(expectedRootIdentity.ino))
+			(rootIdentity.dev !== expectedRootIdentity.dev || rootIdentity.ino !== expectedRootIdentity.ino)
 		)
 			return null;
 		await SkillDiscoveryTestHooks.afterContainedRootValidated?.(root);

package/src/discovery/mcp-compat.ts

@@ -110,23 +110,63 @@ interface CodexMcpServerConfig {
 	command?: string;
 	args?: string[];
 	env?: Record<string, string>;
-	env_vars?: string[];
+	/** List of env-var names, or `{ name }` entries. Not a value table. */
+	env_vars?: unknown;
 	url?: string;
 	http_headers?: Record<string, string>;
-	env_http_headers?: Record<string, string>;
-	bearer_token_env_var?: string;
+	/** Header name to env-var name. Not a header value. */
+	env_http_headers?: unknown;
+	/** Env-var name whose value is the bearer token. Not the token. */
+	bearer_token_env_var?: unknown;
 	cwd?: string;
 	startup_timeout_sec?: number;
 	tool_timeout_sec?: number;
 }
 
+/** POSIX env-var name. Rejects values that are not names so they are not stored. */
+function isEnvVarName(value: string): boolean {
+	return /^[A-Za-z_][A-Za-z0-9_]*$/.test(value);
+}
+
+/** `${NAME}` keeps the indirection. Callers must not read the process environment. */
+function envVarReference(name: string): string {
+	return `\${${name}}`;
+}
+
+function codexEnvVarEntry(entry: unknown): { name: string; source: string | undefined } | undefined {
+	if (typeof entry === "string") return isEnvVarName(entry) ? { name: entry, source: undefined } : undefined;
+	if (isRecord(entry) && typeof entry.name === "string" && isEnvVarName(entry.name)) {
+		return { name: entry.name, source: typeof entry.source === "string" ? entry.source : undefined };
+	}
+	return undefined;
+}
+
+/** Codex remote-executor sources have no local GJC equivalent. */
+function isUnsupportedEnvSource(source: string | undefined): boolean {
+	return source !== undefined && source !== "local";
+}
+
 /**
  * Extract normalized MCP servers from a Codex `config.toml` `[mcp_servers.*]`
  * section. Codex's config does not carry an `enabled` concept; imported servers
  * default to autoload (startup) behavior after import. Bounded to the supplied
  * content: no filesystem scanning, no user-home reads.
+ *
+ * `env_vars`, `env_http_headers`, and `bearer_token_env_var` name variables.
+ * The process environment is not read. A local name is stored as `${NAME}`
+ * only when the destination keeps operator config. A project destination omits
+ * the reference: project mcp.json is expanded on a later run, and a name such
+ * as `CI_JOB_JWT_V2` is not treated as sensitive, so persisting it would
+ * forward a host value. The source level is metadata and does not decide this.
+ * A static `env` or `http_headers` value is copied. An entry whose source is
+ * not `local` is skipped.
  */
-function extractCodexMcpServers(toml: Record<string, unknown>): Record<string, Partial<MCPServer>> {
+function extractCodexMcpServers(
+	toml: Record<string, unknown>,
+	warnings: string[],
+	sourcePath: string,
+	omitEnvReferences: boolean,
+): Record<string, Partial<MCPServer>> {
 	if (!toml.mcp_servers || !isRecord(toml.mcp_servers)) return {};
 
 	const codexServers = toml.mcp_servers as Record<string, CodexMcpServerConfig>;
@@ -146,11 +186,38 @@ function extractCodexMcpServers(toml: Record<string, unknown>): Record<string, P
 		};
 
 		const env: Record<string, string> = { ...(isStringRecord(serverConfig.env) ? serverConfig.env : {}) };
-		if (Array.isArray(serverConfig.env_vars)) {
-			for (const varName of serverConfig.env_vars) {
-				if (typeof varName !== "string") continue;
-				const value = Bun.env[varName];
-				if (value !== undefined) env[varName] = value;
+		if (serverConfig.env_vars !== undefined && !Array.isArray(serverConfig.env_vars)) {
+			warnings.push(
+				`skipped env_vars for "${name}" in ${sourcePath} because it is not a list of environment variable names`,
+			);
+		} else if (Array.isArray(serverConfig.env_vars)) {
+			for (const entry of serverConfig.env_vars) {
+				const parsed = codexEnvVarEntry(entry);
+				if (!parsed) {
+					warnings.push(
+						`skipped env_vars entry for "${name}" in ${sourcePath} because it is not an environment variable name`,
+					);
+					continue;
+				}
+				if (isUnsupportedEnvSource(parsed.source)) {
+					warnings.push(
+						`skipped env_vars entry ${parsed.name} for "${name}" in ${sourcePath} because source "${parsed.source}" is not executed locally`,
+					);
+					continue;
+				}
+				if (Object.hasOwn(env, parsed.name)) {
+					warnings.push(
+						`kept static env ${parsed.name} for "${name}" in ${sourcePath} and did not read the environment`,
+					);
+					continue;
+				}
+				if (omitEnvReferences) {
+					warnings.push(
+						`skipped project-scope environment reference ${parsed.name} for "${name}" in ${sourcePath} so a later load cannot expand a host value`,
+					);
+					continue;
+				}
+				env[parsed.name] = envVarReference(parsed.name);
 			}
 		}
 		if (Object.keys(env).length > 0) server.env = env;
@@ -158,16 +225,50 @@ function extractCodexMcpServers(toml: Record<string, unknown>): Record<string, P
 		const headers: Record<string, string> = {
 			...(isStringRecord(serverConfig.http_headers) ? serverConfig.http_headers : {}),
 		};
-		if (isRecord(serverConfig.env_http_headers)) {
+		if (serverConfig.env_http_headers !== undefined && !isRecord(serverConfig.env_http_headers)) {
+			warnings.push(
+				`skipped env_http_headers for "${name}" in ${sourcePath} because it is not a table of environment variable names`,
+			);
+		} else if (isRecord(serverConfig.env_http_headers)) {
 			for (const [headerName, envVarName] of Object.entries(serverConfig.env_http_headers)) {
-				if (typeof envVarName !== "string") continue;
-				const value = Bun.env[envVarName];
-				if (value !== undefined) headers[headerName] = value;
+				if (typeof envVarName !== "string" || !isEnvVarName(envVarName)) {
+					warnings.push(
+						`skipped env_http_headers entry for "${name}" in ${sourcePath} because its value is not an environment variable name`,
+					);
+					continue;
+				}
+				if (Object.hasOwn(headers, headerName)) {
+					warnings.push(
+						`kept static header ${headerName} for "${name}" in ${sourcePath} and did not read ${envVarName}`,
+					);
+					continue;
+				}
+				if (omitEnvReferences) {
+					warnings.push(
+						`skipped project-scope environment reference ${envVarName} for "${name}" in ${sourcePath} so a later load cannot expand a host value`,
+					);
+					continue;
+				}
+				headers[headerName] = envVarReference(envVarName);
 			}
 		}
-		if (typeof serverConfig.bearer_token_env_var === "string") {
-			const token = Bun.env[serverConfig.bearer_token_env_var];
-			if (token) headers.Authorization = `Bearer ${token}`;
+		if (serverConfig.bearer_token_env_var !== undefined) {
+			const bearerName = serverConfig.bearer_token_env_var;
+			if (typeof bearerName !== "string" || !isEnvVarName(bearerName)) {
+				warnings.push(
+					`skipped bearer_token_env_var for "${name}" in ${sourcePath} because it is not an environment variable name`,
+				);
+			} else if (Object.hasOwn(headers, "Authorization")) {
+				warnings.push(
+					`kept static Authorization for "${name}" in ${sourcePath} and did not read bearer_token_env_var ${bearerName}`,
+				);
+			} else if (omitEnvReferences) {
+				warnings.push(
+					`skipped project-scope environment reference ${bearerName} for "${name}" in ${sourcePath} so a later load cannot expand a host value`,
+				);
+			} else {
+				headers.Authorization = `Bearer ${envVarReference(bearerName)}`;
+			}
 		}
 		if (Object.keys(headers).length > 0) server.headers = headers;
 
@@ -192,6 +293,7 @@ export function normalizeCodexMcpToml(
 	content: string,
 	sourcePath: string,
 	level: "project" | "user" = "project",
+	options?: { omitEnvReferences?: boolean },
 ): MCPCompatNormalizeResult {
 	const items: MCPServer[] = [];
 	const warnings: string[] = [];
@@ -212,7 +314,8 @@ export function normalizeCodexMcpToml(
 			}
 		}
 	}
-	const servers = extractCodexMcpServers(parsed);
+	const omitEnvReferences = options?.omitEnvReferences ?? level === "project";
+	const servers = extractCodexMcpServers(parsed, warnings, sourcePath, omitEnvReferences);
 	for (const [name, config] of Object.entries(servers)) {
 		items.push({
 			name,

package/src/edit/apply-patch/index.ts

@@ -12,7 +12,13 @@
  */
 
 import { ApplyPatchError } from "../diff";
-import { type ApplyPatchOptions, type ApplyPatchResult, applyPatch, type PatchInput } from "../modes/patch";
+import {
+	type ApplyPatchOptions,
+	type ApplyPatchResult,
+	applyPatch,
+	type PatchInput,
+	preflightPatchMkdir,
+} from "../modes/patch";
 import { parseApplyPatch } from "./parser";
 
 export * from "./parser";
@@ -48,6 +54,11 @@ export async function applyCodexPatch(patchText: string, options: ApplyPatchOpti
 		deleted: [] as string[],
 	};
 
+	// Containment is checked for every hunk before the first write. A later
+	// I/O failure still leaves earlier hunks applied, per spec §6.1.
+	for (const hunk of hunks) {
+		await preflightPatchMkdir(hunk, options);
+	}
 	for (const hunk of hunks) {
 		const result = await applyPatch(hunk, options);
 		results.push(result);

package/src/edit/index.ts

@@ -27,7 +27,7 @@ import type { VimToolDetails } from "../vim/types";
 import { type ApplyPatchParams, applyPatchSchema, expandApplyPatchToEntries } from "./modes/apply-patch";
 import applyPatchGrammar from "./modes/apply-patch.lark" with { type: "text" };
 import { executePatchSingle, type PatchEditEntry, type PatchParams, patchEditSchema } from "./modes/patch";
-import { executeReplaceSingle, type ReplaceEditEntry, type ReplaceParams, replaceEditSchema } from "./modes/replace";
+import { executeReplaceEntries, type ReplaceEditEntry, type ReplaceParams, replaceEditSchema } from "./modes/replace";
 import { type EditToolDetails, type EditToolPerFileResult, getLspBatchRequest, type LspBatchRequest } from "./renderer";
 
 export { DEFAULT_EDIT_MODE, type EditMode, normalizeEditMode } from "../utils/edit-mode";
@@ -490,24 +490,20 @@ export class EditTool implements AgentTool<TInput> {
 					params: EditParams,
 					signal: AbortSignal | undefined,
 					batchRequest: LspBatchRequest | undefined,
-					onUpdate?: (partialResult: AgentToolResult<EditToolDetails, TInput>) => void,
+					_onUpdate?: (partialResult: AgentToolResult<EditToolDetails, TInput>) => void,
 				) => {
 					const { edits, path } = params as ReplaceParams;
-					const runs = (edits as ReplaceEditEntry[]).map(
-						entry => (br: LspBatchRequest | undefined) =>
-							executeReplaceSingle({
-								session: tool.session,
-								path,
-								params: entry,
-								signal,
-								batchRequest: br,
-								allowFuzzy: tool.#allowFuzzy,
-								fuzzyThreshold: tool.#fuzzyThreshold,
-								writethrough: tool.#writethrough,
-								beginDeferredDiagnosticsForPath: p => tool.#beginDeferredDiagnosticsForPath(p),
-							}),
-					);
-					return executeSinglePathEntries(path, runs, batchRequest, onUpdate);
+					return executeReplaceEntries({
+						session: tool.session,
+						path,
+						edits: edits as ReplaceEditEntry[],
+						signal,
+						batchRequest,
+						allowFuzzy: tool.#allowFuzzy,
+						fuzzyThreshold: tool.#fuzzyThreshold,
+						writethrough: tool.#writethrough,
+						beginDeferredDiagnosticsForPath: p => tool.#beginDeferredDiagnosticsForPath(p),
+					});
 				},
 			},
 			vim: {