@gajae-code/coding-agent 0.18.11 → 0.18.12

package/src/eval/py/runner.py

@@ -29,6 +29,7 @@ import asyncio
 import ast
 import base64
 import builtins
+import codecs
 import inspect
 import io
 import json
@@ -49,9 +50,14 @@ from typing import Any, Callable
 # Frame writer
 # ---------------------------------------------------------------------------
 
-_RAW_STDOUT = sys.__stdout__
 _RAW_STDERR = sys.__stderr__
 _OUT_LOCK = threading.Lock()
+_PROTO_FD: int | None = None
+_CAP_LOCK = threading.Lock()
+_FLUSH_EVENT = threading.Event()
+_FLUSH_TOKEN: bytes | None = None
+_CAPTURED = b""
+_CAPTURE_DECODER = codecs.getincrementaldecoder("utf-8")(errors="replace")
 
 
 def _json_default(o: Any) -> Any:
@@ -61,13 +67,141 @@ def _json_default(o: Any) -> Any:
         return f"<unrepr {type(o).__name__}>"
 
 
+def _write_all(fd: int, data: bytes) -> None:
+    view = memoryview(data)
+    while len(view):
+        written = os.write(fd, view)
+        if written <= 0:
+            raise OSError(0, "protocol write returned no bytes")
+        view = view[written:]
+
+
 def _emit(frame: dict) -> None:
     """Serialize a frame and write it to the host as a single NDJSON line."""
-    line = json.dumps(frame, ensure_ascii=False, default=_json_default)
+    payload = (json.dumps(frame, ensure_ascii=False, default=_json_default) + "\n").encode("utf-8")
+    fd = _PROTO_FD if _PROTO_FD is not None else 1
     with _OUT_LOCK:
-        _RAW_STDOUT.write(line)
-        _RAW_STDOUT.write("\n")
-        _RAW_STDOUT.flush()
+        _write_all(fd, payload)
+
+
+def _token_suffix_len(buf: bytes, token: bytes) -> int:
+    max_n = min(len(buf), len(token) - 1)
+    for size in range(max_n, 0, -1):
+        if buf.endswith(token[:size]):
+            return size
+    return 0
+
+
+def _take_captured_locked() -> tuple[list[bytes], bool]:
+    """Split captured fd-1 bytes. A flush token is a delimiter, not output."""
+    global _CAPTURED, _FLUSH_TOKEN
+    pieces: list[bytes] = []
+    flushed = False
+    while True:
+        token = _FLUSH_TOKEN
+        if token is None:
+            if _CAPTURED:
+                pieces.append(_CAPTURED)
+                _CAPTURED = b""
+            return pieces, flushed
+        idx = _CAPTURED.find(token)
+        if idx < 0:
+            keep = _token_suffix_len(_CAPTURED, token)
+            if len(_CAPTURED) > keep:
+                pieces.append(_CAPTURED[: len(_CAPTURED) - keep])
+                _CAPTURED = _CAPTURED[-keep:] if keep else b""
+            return pieces, flushed
+        if idx:
+            pieces.append(_CAPTURED[:idx])
+        _CAPTURED = _CAPTURED[idx + len(token) :]
+        _FLUSH_TOKEN = None
+        flushed = True
+
+
+def _publish_captured(pieces: list[bytes], flushed: bool) -> None:
+    global _CAPTURE_DECODER
+    for piece in pieces:
+        text = _CAPTURE_DECODER.decode(piece)
+        if text:
+            _forward_captured_stdout(text)
+    if not flushed:
+        return
+    tail = _CAPTURE_DECODER.decode(b"", final=True)
+    if tail:
+        _forward_captured_stdout(tail)
+    _CAPTURE_DECODER = codecs.getincrementaldecoder("utf-8")(errors="replace")
+
+
+def _forward_captured_stdout(text: str) -> None:
+    rid = _STATE.current_id
+    if not text:
+        return
+    if rid is None:
+        _RAW_STDERR.write(text)
+        _RAW_STDERR.flush()
+        return
+    _emit({"type": "stdout", "id": rid, "data": text})
+
+
+def _pump_captured_stdout(read_fd: int) -> None:
+    global _CAPTURED
+    while True:
+        try:
+            chunk = os.read(read_fd, 65536)
+        except OSError:
+            return
+        if not chunk:
+            return
+        with _CAP_LOCK:
+            _CAPTURED += chunk
+            pieces, flushed = _take_captured_locked()
+        _publish_captured(pieces, flushed)
+        if flushed:
+            _FLUSH_EVENT.set()
+
+
+def _capture_user_stdout() -> None:
+    """Move the host pipe off fd 1 so raw user writes are cell output."""
+    global _PROTO_FD
+    if _PROTO_FD is not None:
+        return
+    try:
+        sys.__stdout__.flush()
+    except Exception:
+        pass
+    proto = os.dup(1)
+    os.set_inheritable(proto, False)
+    _PROTO_FD = proto
+    read_fd, write_fd = os.pipe()
+    os.set_inheritable(read_fd, False)
+    os.dup2(write_fd, 1, inheritable=True)
+    os.close(write_fd)
+    threading.Thread(
+        target=_pump_captured_stdout,
+        args=(read_fd,),
+        name="gjc-stdout-capture",
+        daemon=True,
+    ).start()
+
+
+def _flush_captured_stdout() -> None:
+    if _PROTO_FD is None:
+        return
+    token = b"\0gjcfd1:" + os.urandom(8).hex().encode("ascii") + b"\0"
+    with _CAP_LOCK:
+        global _FLUSH_TOKEN
+        _FLUSH_EVENT.clear()
+        _FLUSH_TOKEN = token
+    _write_all(1, token)
+    if _FLUSH_EVENT.wait(5):
+        return
+    with _CAP_LOCK:
+        if _FLUSH_TOKEN == token:
+            _FLUSH_TOKEN = None
+            pieces, flushed = _take_captured_locked()
+        else:
+            pieces, flushed = [], False
+    _publish_captured(pieces, flushed)
 
 
 # ---------------------------------------------------------------------------
@@ -902,6 +1036,10 @@ def _handle_request(req: dict) -> None:
             _flush_matplotlib_figures()
         except Exception:
             pass
+        try:
+            _flush_captured_stdout()
+        except Exception:
+            pass
 
     _emit({
         "type": "done",
@@ -930,6 +1068,7 @@ def _emit_error(rid: str, exc: BaseException) -> None:
 
 
 def main() -> None:
+    _capture_user_stdout()
     sys.stdout = _StreamProxy("stdout")
     sys.stderr = _StreamProxy("stderr")
     _install_idle_sigint()

package/src/exec/bash-executor.ts

@@ -12,6 +12,7 @@ import type {
 	ShellRunResult,
 } from "@gajae-code/natives";
 import { postmortem } from "@gajae-code/utils";
+import { projectDeclaredSpawnHookNames, stripProjectSpawnHooks } from "@gajae-code/utils/shell-config";
 import { Settings, type ShellMinimizerSettings } from "../config/settings";
 import { formatCrashDiagnosticNotice, writeCrashReport } from "../debug/crash-diagnostics";
 import {
@@ -93,6 +94,20 @@ export function setShellFactoryForTests(factory: ShellFactory | undefined): void
 	shellFactoryForTests = factory;
 }
 
+function projectHookUnsetEnv(
+	unsetEnv: string[] | undefined,
+	env: Record<string, string> | undefined,
+	sessionEnv: Record<string, string>,
+): string[] | undefined {
+	// Keys present in `sessionEnv` (e.g. the trusted HOME replacement) already
+	// override the ambient import, so only shadow the ones it does not carry.
+	const hooks = projectDeclaredSpawnHookNames().filter(
+		name => !Object.hasOwn(env ?? {}, name) && !Object.hasOwn(sessionEnv, name),
+	);
+	if (hooks.length === 0) return unsetEnv;
+	return [...(unsetEnv ?? []), ...hooks.filter(name => !unsetEnv?.includes(name))];
+}
+
 async function createShell(
 	options?: ShellOptions,
 	onTerminal?: (shell: Shell) => void,
@@ -414,13 +429,67 @@ async function resolveShellCwd(cwd: string | undefined): Promise<string | undefi
 	}
 }
 
+function presentMinimizerString(value: unknown): string | undefined {
+	return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+
+type ShellMinimizerSource = {
+	getGroup(prefix: "shellMinimizer"): ShellMinimizerSettings;
+	getGlobal?(path: "shellMinimizer.settingsPath" | "shellMinimizer.settingsHash"): unknown;
+	getOverride?(path: "shellMinimizer.settingsPath"): unknown;
+};
+
+/**
+ * A repo `.gjc/settings.json` must not point the minimizer at a TOML file.
+ * The native gate loads that file only when `settingsHash` matches, and the
+ * pin is the user/global value. A user path or a runtime override is still
+ * passed through. A project path is passed only together with that pin.
+ */
+export function resolveTrustedShellMinimizer(settings: ShellMinimizerSource): ShellMinimizerSettings {
+	const group = settings.getGroup("shellMinimizer");
+	const globalPath =
+		typeof settings.getGlobal === "function"
+			? presentMinimizerString(settings.getGlobal("shellMinimizer.settingsPath"))
+			: undefined;
+	const globalHash =
+		typeof settings.getGlobal === "function"
+			? presentMinimizerString(settings.getGlobal("shellMinimizer.settingsHash"))
+			: undefined;
+	const overridePath =
+		typeof settings.getOverride === "function"
+			? presentMinimizerString(settings.getOverride("shellMinimizer.settingsPath"))
+			: undefined;
+	const effectivePath = presentMinimizerString(group.settingsPath);
+
+	let settingsPath: string | undefined;
+	if (overridePath && effectivePath === overridePath) {
+		settingsPath = overridePath;
+	} else if (globalPath) {
+		settingsPath = globalPath;
+	} else if (effectivePath && globalHash) {
+		settingsPath = effectivePath;
+	}
+
+	// A runtime override of a different path is operator input, not the file the
+	// user hash pins. Every other admitted path is checked with that pin.
+	const unpinnedOverride = overridePath !== undefined && settingsPath === overridePath && settingsPath !== globalPath;
+	return {
+		...group,
+		settingsPath,
+		settingsHash: globalHash && settingsPath && !unpinnedOverride ? globalHash : undefined,
+	};
+}
+
 /** Translate `ShellMinimizerSettings` into native `MinimizerOptions`, or `undefined` when disabled. */
 export function buildMinimizerOptions(group: ShellMinimizerSettings): MinimizerOptions | undefined {
 	if (!group.enabled) return undefined;
 	const maxCaptureBytes = Math.min(4 * 1024 * 1024, Math.max(1024, Math.trunc(group.maxCaptureBytes)));
+	const settingsPath = group.settingsPath || undefined;
+	const settingsHash = settingsPath && group.settingsHash ? group.settingsHash : undefined;
 	return {
 		enabled: true,
-		settingsPath: group.settingsPath || undefined,
+		settingsPath,
+		...(settingsHash ? { settingsHash } : {}),
 		only: group.only.length > 0 ? group.only : undefined,
 		except: group.except.length > 0 ? group.except : undefined,
 		maxCaptureBytes,
@@ -429,12 +498,16 @@ export function buildMinimizerOptions(group: ShellMinimizerSettings): MinimizerO
 
 export async function executeBash(command: string, options?: BashExecutorOptions): Promise<BashResult> {
 	const settings = options?.settings ?? (await Settings.init());
-	const { shell, env: shellEnv, prefix } = settings.getShellConfig();
+	const { shell, env: configEnv, prefix } = settings.getShellConfig();
+	// The shell config env is shared with other consumers (Python kernels keep
+	// their own documented allowlist). Only the bash tool's shell must not see
+	// project hook variables such as BASH_ENV or GIT_CONFIG_*.
+	const shellEnv = stripProjectSpawnHooks({ ...configEnv });
 	const configuredPrefix = options?.ignoreShellPrefix ? undefined : prefix;
 	const snapshotPath =
 		!options?.disableShellSnapshot && shell.includes("bash") ? await getOrCreateSnapshot(shell, shellEnv) : null;
 
-	const minimizer = buildMinimizerOptions(settings.getGroup("shellMinimizer"));
+	const minimizer = buildMinimizerOptions(resolveTrustedShellMinimizer(settings));
 
 	const commandCwd = await resolveShellCwd(options?.cwd);
 	const commandEnv = options?.env ? { ...NON_INTERACTIVE_ENV, ...options.env } : NON_INTERACTIVE_ENV;
@@ -580,7 +653,11 @@ export async function executeBash(command: string, options?: BashExecutorOptions
 			command: finalCommand,
 			cwd: commandCwd,
 			env: commandEnv,
-			unsetEnv: options?.unsetEnv,
+			// The native shell imports the host process environment before
+			// `sessionEnv`, and where it runs in-process (Windows) that environment
+			// holds the autoloaded project `.env`. Shadow project hook variables per
+			// run unless this call sets them explicitly.
+			unsetEnv: projectHookUnsetEnv(options?.unsetEnv, options?.env, shellEnv),
 			timeoutMs: executionTimeoutMs,
 			signal: runAbortController.signal,
 		};

package/src/exec/bash-shell-guardian.ts

@@ -8,6 +8,7 @@ import * as path from "node:path";
 import * as readline from "node:readline";
 import type { Process as NativeProcess } from "@gajae-code/natives";
 import { isCompiledBinary } from "@gajae-code/utils/env";
+import { projectSafeSpawnEnv } from "@gajae-code/utils/shell-config";
 import { BASH_SHELL_SUPERVISOR_ARG, type BashShellWorkerRequest } from "./bash-shell-worker-protocol";
 
 type NativeProcessBindings = { Process: typeof NativeProcess };
@@ -401,7 +402,9 @@ export async function runBashShellGuardian(): Promise<void> {
 	const [executable, ...args] = supervisorArgv();
 	const supervisor = childProcess.spawn(executable!, args, {
 		detached: process.platform !== "win32",
-		env: process.env,
+		// This process reloaded the project `.env` on startup; keep project hook
+		// variables out of the supervisor -> runtime -> native shell chain.
+		env: projectSafeSpawnEnv(),
 		stdio: ["pipe", "inherit", "inherit"],
 		windowsHide: true,
 	});

package/src/exec/bash-shell-supervisor.ts

@@ -8,6 +8,7 @@ import * as path from "node:path";
 import * as readline from "node:readline";
 import type { Process as NativeProcess } from "@gajae-code/natives";
 import { isCompiledBinary } from "@gajae-code/utils/env";
+import { projectSafeSpawnEnv } from "@gajae-code/utils/shell-config";
 import { parseLinuxProcParentPid, parseLinuxProcStartTime, parseLinuxProcState } from "../gjc-runtime/linux-proc";
 import { processIncarnation } from "../sdk/broker/process-incarnation";
 import { fatalCatchableSignals, signalExitCode } from "./bash-shell-signals";
@@ -39,9 +40,10 @@ function darwinUniqueProcessId(pid: number, incarnation: string): string | undef
 }
 
 function runtimeArgv(): string[] {
-	return isCompiledBinary()
-		? [process.execPath, BASH_SHELL_RUNTIME_ARG]
-		: [process.execPath, path.join(import.meta.dir, "bash-shell-runtime-entry.ts")];
+	if (isCompiledBinary()) return [process.execPath, BASH_SHELL_RUNTIME_ARG];
+	// The supervisor already sanitized this environment. Do not let the source
+	// runtime reload a cwd `.env` that may have changed since the snapshot.
+	return [process.execPath, "--no-env-file", path.join(import.meta.dir, "bash-shell-runtime-entry.ts")];
 }
 
 function enableLinuxChildSubreaper(): void {
@@ -264,7 +266,9 @@ export async function runBashShellSupervisor(): Promise<void> {
 	const worker = childProcess.spawn(command!, args, {
 		cwd: process.cwd(),
 		detached: false,
-		env: { ...process.env, GJC_ISOLATED_SHELL_RUNTIME: "1" },
+		// This process reloaded the project `.env` on startup; the runtime's native
+		// shell imports its environment wholesale, so drop project hook variables.
+		env: { ...projectSafeSpawnEnv(), GJC_ISOLATED_SHELL_RUNTIME: "1" },
 		stdio: ["pipe", "pipe", "pipe"],
 		windowsHide: true,
 	});

package/src/exec/isolated-shell.ts

@@ -5,6 +5,7 @@ import * as path from "node:path";
 import * as readline from "node:readline";
 import type { ShellRunOptions } from "@gajae-code/natives";
 import { isCompiledBinary } from "@gajae-code/utils/env";
+import { projectSafeSpawnEnv } from "@gajae-code/utils/shell-config";
 import {
 	BASH_SHELL_WORKER_ARG,
 	type BashShellWorkerRequest,
@@ -84,7 +85,10 @@ export class IsolatedShell {
 		this.#child = childProcess.spawn(command!, args, {
 			cwd: process.cwd(),
 			detached: process.platform !== "win32",
-			env: process.env,
+			// The worker chain (guardian -> supervisor -> runtime) inherits this env and
+			// the native shell imports it wholesale, so project hook variables must be
+			// gone here, not only from the per-session overlay.
+			env: projectSafeSpawnEnv(),
 			stdio: ["pipe", "pipe", "pipe"],
 			windowsHide: true,
 		});

package/src/export/html/index.ts

@@ -2,7 +2,7 @@ import * as syncFs from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type { AgentState } from "@gajae-code/agent-core";
-import { APP_NAME, isEnoent } from "@gajae-code/utils";
+import { APP_NAME, isEnoent, redactCrashSecrets } from "@gajae-code/utils";
 import { getResolvedThemeColors, getThemeExportColors } from "../../modes/theme/theme";
 import { SessionManager } from "../../session/session-manager";
 // Pre-generated template (created by scripts/generate-template.ts at publish time)
@@ -226,18 +226,18 @@ async function writeSessionHtml(
 	};
 	try {
 		sink.write(themedTemplate.slice(0, markerOffset));
-		writeEncoded(`{"header":${JSON.stringify(sm.getHeader())},"entries":[`);
+		writeEncoded(`{"header":${sessionEmbedJson(sm.getHeader())},"entries":[`);
 		let first = true;
 		sm.visitEntriesForExport(entry => {
-			writeEncoded(`${first ? "" : ","}${JSON.stringify(entry)}`);
+			writeEncoded(`${first ? "" : ","}${sessionEmbedJson(entry)}`);
 			first = false;
 		});
-		writeEncoded(`],"leafId":${JSON.stringify(sm.getLeafId())}`);
+		writeEncoded(`],"leafId":${sessionEmbedJson(sm.getLeafId())}`);
 		if (state?.systemPrompt !== undefined)
-			writeEncoded(`,"systemPrompt":${JSON.stringify(state.systemPrompt.join("\n\n"))}`);
+			writeEncoded(`,"systemPrompt":${sessionEmbedJson(state.systemPrompt.join("\n\n"))}`);
 		if (state?.tools !== undefined)
 			writeEncoded(
-				`,"tools":${JSON.stringify(state.tools.map(tool => ({ name: tool.name, description: tool.description })))}`,
+				`,"tools":${sessionEmbedJson(state.tools.map(tool => ({ name: tool.name, description: tool.description })))}`,
 			);
 		writeEncoded("}");
 		const final = encoder.finish();
@@ -253,6 +253,46 @@ async function writeSessionHtml(
 	}
 }
 
+/**
+ * Own `__proto__` stays a data property; a normal object would turn that assignment into the prototype.
+ * Each field is redacted together with its key. A detached leaf such as `abcdefgh1234` under `password`
+ * would otherwise miss the key-aware rule. If that serialized field does not parse, the value is
+ * redacted on its own so a quotation mark inside a labeled secret cannot break the export.
+ */
+function redactJsonValue(value: unknown): unknown {
+	if (typeof value === "string") return redactCrashSecrets(value);
+	if (Array.isArray(value)) return value.map(item => redactJsonValue(item));
+	if (value === null || typeof value !== "object") return value;
+	const source = value as Record<string, unknown>;
+	const redacted = Object.create(null) as Record<string, unknown>;
+	for (const key of Object.keys(source)) redacted[key] = redactKeyedValue(key, source[key]);
+	return redacted;
+}
+
+const CREDENTIAL_JSON_KEY =
+	/^(?:api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?id|session[_-]?token|client[_-]?secret|secret[_-]?key|aws[_-]?secret[_-]?access[_-]?key|secret[_-]?access[_-]?key|password|passwd|authorization)$/i;
+
+function redactKeyedValue(key: string, value: unknown): unknown {
+	// A recognized key is authoritative for every JSON type, including a short
+	// string, a number, an array, or a nested object.
+	if (CREDENTIAL_JSON_KEY.test(key)) return "«redacted»";
+	if (typeof value !== "string") return redactJsonValue(value);
+	const encoded = JSON.stringify({ [key]: value });
+	try {
+		const parsed = JSON.parse(redactCrashSecrets(encoded)) as Record<string, unknown>;
+		if (parsed !== null && typeof parsed === "object" && Object.hasOwn(parsed, key)) return parsed[key];
+	} catch {
+		// A quote inside a credential field can make the redacted JSON invalid.
+		// Mask that field instead of exporting the raw value without its key.
+		if (CREDENTIAL_JSON_KEY.test(key)) return "«redacted»";
+	}
+	return redactCrashSecrets(value);
+}
+
+function sessionEmbedJson(value: unknown): string {
+	return JSON.stringify(redactJsonValue(JSON.parse(JSON.stringify(value))));
+}
+
 /** Export session to HTML using SessionManager and AgentState. */
 export async function exportSessionToHtml(
 	sm: SessionManager,

package/src/extensibility/custom-tools/wrapper.ts

@@ -21,9 +21,11 @@ export class CustomToolAdapter<TParams extends TSchema = TSchema, TDetails = any
 		private tool: CustomTool<TParams, TDetails>,
 		private getContext: () => CustomToolContext,
 	) {
-		applyToolProxy(tool, this);
+		// Own these before proxying: with useDefineForClassFields off, the uninitialized fields do not
+		// exist yet, so applyToolProxy would install getter-only accessors that reject assignment.
 		this.strict = tool.strict;
 		this.concurrency = tool.concurrency;
+		applyToolProxy(tool, this);
 	}
 
 	execute(

package/src/extensibility/extensions/loader.ts

@@ -791,7 +791,14 @@ export async function discoverAndLoadExtensions(
 		...(options.profileAuthority === undefined ? {} : { profileAuthority: options.profileAuthority }),
 		...(options.settings === undefined ? {} : { settings: options.settings }),
 	});
-	for (const ext of discovered.items) {
+	// Filter project modules before first-wins name deduplication. `items` has
+	// already deduplicated, so a project module could otherwise shadow the
+	// same-named user module before being rejected here.
+	const seenDiscoveredNames = new Set<string>();
+	for (const ext of discovered.all) {
+		if (ext._source.provider === "native" && ext.level === "project") continue;
+		if (seenDiscoveredNames.has(ext.name)) continue;
+		seenDiscoveredNames.add(ext.name);
 		if (ext._source.provider !== "native") continue;
 		addPath(ext.path);
 	}

package/src/extensibility/plugins/marketplace/fetcher.ts

@@ -10,7 +10,7 @@ import * as https from "node:https";
 import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
-import { isEnoent, logger } from "@gajae-code/utils";
+import { isEnoent, logger, redactCrashSecrets } from "@gajae-code/utils";
 import * as git from "../../../utils/git";
 import { isPrivateOrSpecialAddress, validatePublicHttpUrl } from "../../../web/insane/url-guard";
 
@@ -461,7 +461,7 @@ async function cloneAndReadCatalog(url: string, cacheDir: string): Promise<Fetch
 	const tmpDir = path.join(cacheDir, `.tmp-clone-${Date.now()}`);
 	await fs.mkdir(cacheDir, { recursive: true });
 
-	logger.debug(`[marketplace] cloning ${url} → ${tmpDir}`);
+	logger.debug(redactCrashSecrets(`[marketplace] cloning ${url} → ${tmpDir}`));
 	await git.clone(url, tmpDir);
 
 	const catalogPath = path.join(tmpDir, CATALOG_RELATIVE_PATH);

package/src/gjc-runtime/gc-runtime.ts

@@ -18,7 +18,15 @@ import * as fsp from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
 import { exactRemoveDirectoryTree, exactUnlink, snapshotDirectoryTree } from "@gajae-code/natives";
-import { getAgentDir, getBlobsDir, getSessionsDir, isEnoent, VERSION } from "@gajae-code/utils";
+import {
+	getAgentDir,
+	getBlobsDir,
+	getSessionsDir,
+	isEnoent,
+	loadedProjectEnvSnapshot,
+	VERSION,
+} from "@gajae-code/utils";
+import { type ProjectEnvSnapshot, projectEnvSnapshot } from "@gajae-code/utils/env-file";
 import { getDefault } from "../config/settings-schema";
 import { listHarnessRootRegistriesForGc } from "../harness-control-plane/storage";
 import { SessionIndex } from "../sdk/broker/session-index";
@@ -54,6 +62,7 @@ import {
 } from "./empty-delete-gc";
 import { buildGcReportText } from "./gc-render";
 import { collectSessionScopeUsage, type GcSessionScopeUsage, shouldReportSessionScope } from "./gc-session-scope";
+import { trustedCoordinatorEnv } from "./sidecar-bootstrap-env";
 
 export type GcStore = "harness_leases" | "file_locks" | "tmux_sessions" | "registry_entries" | "local_roots";
 
@@ -456,8 +465,21 @@ export function computeExitCode(report: GcReport): number {
 	return 0;
 }
 
-function resolveGcAgentDir(env: NodeJS.ProcessEnv): string {
-	return env.GJC_CODING_AGENT_DIR?.trim() || env.PI_CODING_AGENT_DIR?.trim() || getAgentDir();
+/**
+ * Operator override only. Same project-dotenv rule as `getAgentDir()`: a value
+ * the checkout declares is ignored, and an operator value it does not declare
+ * is kept. A repository `.env` must not choose the tree `gjc gc` reclaims.
+ *
+ * `snapshot` is the dotenv provenance from when that environment was loaded.
+ * `process.env` uses the module-load snapshot. A separate env map uses the
+ * snapshot taken with it before awaited GC work. Neither path rereads files later.
+ */
+function resolveGcAgentDir(env: NodeJS.ProcessEnv, snapshot: ProjectEnvSnapshot): string {
+	return (
+		trustedCoordinatorEnv("GJC_CODING_AGENT_DIR", env, snapshot) ||
+		trustedCoordinatorEnv("PI_CODING_AGENT_DIR", env, snapshot) ||
+		getAgentDir()
+	);
 }
 
 /**
@@ -572,6 +594,10 @@ export async function runGjcGcCommand(
 	adapters?: GcStoreAdapter[],
 	diskPolicy?: Partial<GcDiskPolicy>,
 ): Promise<GcRunResult> {
+	// process.env was loaded before this module. Reusing that snapshot keeps a
+	// project value rejected after its declaration is removed or changed.
+	// A caller-supplied env is not that load: bind its cwd files once, here.
+	const loadedProjectEnv = env === process.env ? loadedProjectEnvSnapshot() : projectEnvSnapshot(cwd);
 	let parsed: ParsedGcArgs;
 	try {
 		parsed = parseGcArgs(argv);
@@ -656,17 +682,18 @@ export async function runGjcGcCommand(
 	const ordinaryPrune = parsed.prune && (emptyDeleteReceipts?.errors.length ?? 0) === 0;
 	const report = await collectGcReport(resolvedAdapters, ctx, ordinaryPrune);
 	report.operation = parsed.repairSessionIndex ? "repair_session_index" : parsed.prune ? "prune" : "dry_run";
-	report.session_index = await collectSessionIndexHealth(parsed.repairSessionIndex, resolveGcAgentDir(env));
+	const agentDir = resolveGcAgentDir(env, loadedProjectEnv);
+	report.session_index = await collectSessionIndexHealth(parsed.repairSessionIndex, agentDir);
 	if (parsed.disk) {
 		report.disk = await collectGcDiskReport({
-			agentDir: resolveGcAgentDir(env),
+			agentDir,
 			env,
 			policy: resolveGcDiskPolicy(diskPolicy),
 			prune: ordinaryPrune,
 		});
 	}
 	if (emptyDeleteReceipts) report.empty_delete_receipts = emptyDeleteReceipts;
-	const scopeUsage = await collectGcSessionScope(cwd, resolveGcAgentDir(env));
+	const scopeUsage = await collectGcSessionScope(cwd, agentDir);
 	if (scopeUsage && shouldReportSessionScope(scopeUsage)) report.session_scope = scopeUsage;
 	const sessionIndexFailed =
 		report.session_index?.status === "corrupt" ||

package/src/gjc-runtime/launch-tmux.ts

@@ -13,6 +13,7 @@ import {
 	MANAGED_OWNER_PREDECESSOR_RUN_ID_ENV,
 	MANAGED_OWNER_PREDECESSOR_TOKEN_ENV,
 	MANAGED_OWNER_TRANSCRIPT_PATH_ENV,
+	trustedManagedOwnerLaunchSessionFile,
 } from "./managed-owner-admission";
 import {
 	MANAGED_OWNER_INCARNATION_ENV,
@@ -1249,8 +1250,12 @@ function prepareManagedOwnerLifecycle(plan: TmuxLaunchPlan, context: TmuxLaunchC
 							[MANAGED_OWNER_PREDECESSOR_GENERATION_ENV]: replacement.generation,
 							[MANAGED_OWNER_PREDECESSOR_RUN_ID_ENV]: replacement.runId,
 							[MANAGED_OWNER_PREDECESSOR_INCARNATION_ENV]: replacement.incarnation,
-							[MANAGED_OWNER_TRANSCRIPT_PATH_ENV]:
-								context.env?.GJC_SESSION_FILE ?? process.env.GJC_SESSION_FILE ?? "",
+							[MANAGED_OWNER_TRANSCRIPT_PATH_ENV]: trustedManagedOwnerLaunchSessionFile(
+								{
+									GJC_SESSION_FILE: context.env?.GJC_SESSION_FILE ?? process.env.GJC_SESSION_FILE,
+								},
+								plan.cwd,
+							),
 						}
 					: {}),
 			},