@gajae-code/coding-agent 0.18.11 → 0.18.12

package/src/session/internal/managed-session-scope.ts

@@ -299,6 +299,7 @@ export type ManagedScopeErrorCode =
 	| "managed_gc_journal_capacity_exceeded"
 	| "atomic_unavailable"
 	| "invalid_request"
+	| "permission_denied"
 	| "durability_failed"
 	| "durability_not_provable"
 	| "capacity_exceeded";
@@ -342,6 +343,7 @@ const managedScopeErrnoFailureCodes = new Set([
 const managedScopeFailureCodes = new Set<ManagedScopeErrorCode>([
 	"atomic_unavailable",
 	"invalid_request",
+	"permission_denied",
 	"durability_failed",
 	"durability_not_provable",
 	"migration_busy",
@@ -441,6 +443,7 @@ export type ManagedOpenFailure =
 	| "managed_gc_journal_capacity_exceeded"
 	| "durability_failed"
 	| "atomic_unavailable"
+	| "permission_denied"
 	| "invalid_request"
 	| "durability_not_provable"
 	| "migration_retired"
@@ -1166,7 +1169,8 @@ function listDirectoryCandidates(
 	try {
 		directoryStat = fs.lstatSync(directory);
 	} catch (error) {
-		if ((error as NodeJS.ErrnoException).code === "ENOENT") return [];
+		const code = (error as NodeJS.ErrnoException).code;
+		if (code === "ENOENT" || (provenance === "legacy" && code === "ENAMETOOLONG")) return [];
 		throw error;
 	}
 	if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) throw new Error("unsafe directory");
@@ -1970,7 +1974,8 @@ export function listManagedCandidates(scope: ManagedScope): ManagedCandidateList
 				}
 			}
 		}
-		const visible = owned.filter(candidate => !isRetired(scope, candidate));
+		const retired = owned.length > 0 ? retiredTargetKeys(scope) : new Set<string>();
+		const visible = owned.filter(candidate => !isRetiredIn(retired, candidate));
 		const active = visible.filter(
 			candidate =>
 				candidate.provenance === "v2" ||
@@ -2041,6 +2046,7 @@ function expectedFailure(error: unknown): ManagedOpenFailure {
 		message === "managed_gc_journal_capacity_exceeded" ||
 		message === "durability_failed" ||
 		message === "atomic_unavailable" ||
+		message === "permission_denied" ||
 		message === "invalid_request" ||
 		message === "durability_not_provable" ||
 		message === "migration_retired"
@@ -2692,11 +2698,14 @@ function managedGcStreamDirectoryInventory(
 	countEntry: (entry: fs.Dirent) => boolean,
 	retain: (entry: fs.Dirent) => boolean,
 	operation: ManagedGcInventoryOperation,
+	verificationBaseline?: ManagedGcDirectoryInventory,
 ): ManagedGcDirectoryInventory {
 	managedGcReserveInventoryWork(operation);
 	const beforeStat = fs.lstatSync(pathname, { bigint: true });
 	if (!beforeStat.isDirectory() || beforeStat.isSymbolicLink()) throw new Error("managed_gc_scope_authority_mismatch");
 	const before = managedGcDirectoryEvidence(beforeStat);
+	if (verificationBaseline && !managedGcSameDirectoryEvidence(before, verificationBaseline.evidence))
+		throw new Error("managed_gc_scope_authority_mismatch");
 	const scan = (collect: boolean): { count: number; physicalEntryCount: number; entries: fs.Dirent[] } => {
 		managedGcReserveInventoryWork(operation);
 		const entries: fs.Dirent[] = [];
@@ -2742,7 +2751,9 @@ function managedGcStreamDirectoryInventory(
 		managedGcReserveInventoryWork(operation);
 		return { count, physicalEntryCount, entries };
 	};
-	const counted = scan(false);
+	const counted = verificationBaseline
+		? { count: verificationBaseline.entryCount, physicalEntryCount: verificationBaseline.physicalEntryCount }
+		: scan(false);
 	managedGcReserveInventoryWork(operation);
 	const afterCount = fs.lstatSync(pathname, { bigint: true });
 	if (
@@ -2776,6 +2787,7 @@ function managedGcReceiptDirectoryInventory(
 	scope: ManagedScope,
 	store: ManagedSessionDescendantStore,
 	operation: ManagedGcInventoryOperation,
+	verificationBaseline?: ManagedGcDirectoryInventory,
 ): ManagedGcDirectoryInventory {
 	const relativePath = MANAGED_GC_RETIREMENT_RECEIPTS;
 	managedGcReserveInventoryWork(
@@ -2789,6 +2801,7 @@ function managedGcReceiptDirectoryInventory(
 		entry => entry.name.startsWith(MANAGED_GC_RETIREMENT_PREFIX),
 		entry => entry.name.startsWith(MANAGED_GC_RETIREMENT_PREFIX),
 		operation,
+		verificationBaseline,
 	);
 	managedGcReserveInventoryWork(operation);
 	const after = store.captureDirectoryIdentity(relativePath);
@@ -3606,14 +3619,20 @@ export async function readManagedGcSessionRetirementReceiptReadOnly(
 			if (!hasFsCode(error, "ENOENT")) throw error;
 			receiptDirectoryPresent = false;
 		}
-		if (receiptDirectoryPresent)
+		if (receiptDirectoryPresent) {
+			const inventory = managedGcReceiptDirectoryInventory(scope, store, operation);
 			receipt = readManagedGcSessionRetirementReceiptUnlocked(
 				scope,
 				transcriptPath,
 				trusted,
 				store,
 				operation,
+				inventory,
 			).receipt;
+			const after = managedGcReceiptDirectoryInventory(scope, store, operation, inventory);
+			if (!managedGcSameReceiptDirectoryInventory(inventory, after))
+				throw new Error("task_artifact_owner_continuation_authority_mismatch");
+		}
 	} catch (error) {
 		primaryError = error;
 		hasPrimaryError = true;
@@ -6282,8 +6301,96 @@ function tombstonePathContaining(scope: ManagedScope, candidate: ManagedCandidat
 	return undefined;
 }
 
-function isRetired(scope: ManagedScope, candidate: ManagedCandidate): boolean {
+/**
+ * Identity fields a retired tombstone target must match exactly for a candidate
+ * to be hidden. `dev`, `ino`, and `mtimeNs` are persisted as decimal strings.
+ */
+type RetiredTargetIdentity = readonly [
+	path: string,
+	sessionId: string,
+	cwd: string,
+	canonicalPath: string,
+	dev: string,
+	ino: string,
+	size: number,
+	mtimeNs: string,
+	sha256: string,
+];
+
+function candidateRetiredIdentity(candidate: ManagedCandidate): RetiredTargetIdentity {
+	return [
+		candidate.path,
+		candidate.sessionId,
+		candidate.cwd,
+		candidate.identity.canonicalPath,
+		String(candidate.identity.dev),
+		String(candidate.identity.ino),
+		candidate.identity.size,
+		String(candidate.identity.mtimeNs),
+		candidate.identity.sha256,
+	];
+}
+
+/** Returns the target's identity only when every field has the type a candidate can carry. */
+function parseRetiredTargetIdentity(target: unknown): RetiredTargetIdentity | undefined {
+	if (!target || typeof target !== "object") return undefined;
+	const value = target as { path?: unknown; sessionId?: unknown; cwd?: unknown; identity?: unknown };
+	if (!value.identity || typeof value.identity !== "object") return undefined;
+	const identity = value.identity as {
+		canonicalPath?: unknown;
+		dev?: unknown;
+		ino?: unknown;
+		size?: unknown;
+		mtimeNs?: unknown;
+		sha256?: unknown;
+	};
+	if (
+		typeof value.path !== "string" ||
+		typeof value.sessionId !== "string" ||
+		typeof value.cwd !== "string" ||
+		typeof identity.canonicalPath !== "string" ||
+		typeof identity.dev !== "string" ||
+		typeof identity.ino !== "string" ||
+		typeof identity.size !== "number" ||
+		typeof identity.mtimeNs !== "string" ||
+		typeof identity.sha256 !== "string"
+	)
+		return undefined;
+	return [
+		value.path,
+		value.sessionId,
+		value.cwd,
+		identity.canonicalPath,
+		identity.dev,
+		identity.ino,
+		identity.size,
+		identity.mtimeNs,
+		identity.sha256,
+	];
+}
+
+/**
+ * Key equality matches strict equality of every member: strings and finite
+ * numbers encode distinctly. A non-finite tombstone `size` encodes as `null`,
+ * which no candidate produces.
+ */
+function retiredIdentityKey(identity: RetiredTargetIdentity): string {
+	return JSON.stringify(identity);
+}
+
+/**
+ * Snapshot of the identities retired by a scope's tombstones.
+ *
+ * Tombstones are visited in directory order and the walk stops at the first
+ * unreadable or malformed one: it grants no retirement authority, and neither do
+ * the tombstones after it. Listing builds this once and checks every candidate
+ * against it, so its cost is linear in tombstones rather than in
+ * candidates x tombstones.
+ */
+function retiredTargetKeys(scope: ManagedScope): ReadonlySet<string> {
+	const keys = new Set<string>();
 	const directory = path.join(managedInternalDirectory(scope), MANAGED_TOMBSTONES_DIRECTORY);
+	const digest = scopeDigest(scope.platform, scope.canonicalCwd);
 	try {
 		for (const name of fs.readdirSync(directory)) {
 			const pathname = path.join(directory, name);
@@ -6293,47 +6400,27 @@ function isRetired(scope: ManagedScope, candidate: ManagedCandidate): boolean {
 			if (
 				record.schemaVersion !== 2 ||
 				record.state !== "retired" ||
-				record.scope !== scopeDigest(scope.platform, scope.canonicalCwd) ||
+				record.scope !== digest ||
 				!Array.isArray(record.targets)
 			)
 				continue;
-			if (
-				record.targets.some(target => {
-					if (!target || typeof target !== "object") return false;
-					const value = target as {
-						path?: unknown;
-						sessionId?: unknown;
-						cwd?: unknown;
-						identity?: {
-							canonicalPath?: unknown;
-							dev?: unknown;
-							ino?: unknown;
-							size?: unknown;
-							mtimeNs?: unknown;
-							sha256?: unknown;
-						};
-					};
-					const identity = value.identity;
-					if (!identity) return false;
-					return (
-						value.path === candidate.path &&
-						value.sessionId === candidate.sessionId &&
-						value.cwd === candidate.cwd &&
-						identity.canonicalPath === candidate.identity.canonicalPath &&
-						identity.dev === String(candidate.identity.dev) &&
-						identity.ino === String(candidate.identity.ino) &&
-						identity.size === candidate.identity.size &&
-						identity.mtimeNs === String(candidate.identity.mtimeNs) &&
-						identity.sha256 === candidate.identity.sha256
-					);
-				})
-			)
-				return true;
+			for (const target of record.targets) {
+				const identity = parseRetiredTargetIdentity(target);
+				if (identity) keys.add(retiredIdentityKey(identity));
+			}
 		}
 	} catch {
 		/* a missing/malformed tombstone grants no retirement authority */
 	}
-	return false;
+	return keys;
+}
+
+function isRetiredIn(retired: ReadonlySet<string>, candidate: ManagedCandidate): boolean {
+	return retired.has(retiredIdentityKey(candidateRetiredIdentity(candidate)));
+}
+
+function isRetired(scope: ManagedScope, candidate: ManagedCandidate): boolean {
+	return isRetiredIn(retiredTargetKeys(scope), candidate);
 }
 
 type ArtifactManifestEntry =

package/src/session/internal/managed-session-storage.ts

@@ -80,6 +80,7 @@ export class ManagedPublishError extends Error {
 		| "invalid_request"
 		| "durability_not_provable"
 		| "identity_mismatch"
+		| "permission_denied"
 		| "io_error"
 		| "durability_failed";
 	readonly diagnostic: string;
@@ -141,17 +142,19 @@ function publishFailure(outcome: NativePublishOutcome): ManagedPublishError {
 	const classification =
 		outcome.reason === "destination_exists"
 			? "destination_conflict"
-			: outcome.reason === "atomic_unavailable"
-				? "atomic_unavailable"
-				: outcome.reason === "invalid_request"
-					? "invalid_request"
-					: outcome.reason === "durability_not_provable"
-						? "durability_not_provable"
-						: outcome.reason === "identity_violation"
-							? "identity_mismatch"
-							: outcome.reason === "io_failure"
-								? "io_error"
-								: "durability_failed";
+			: outcome.reason === "access_denied" || outcome.reason === "permission_denied"
+				? "permission_denied"
+				: outcome.reason === "atomic_unavailable"
+					? "atomic_unavailable"
+					: outcome.reason === "invalid_request"
+						? "invalid_request"
+						: outcome.reason === "durability_not_provable"
+							? "durability_not_provable"
+							: outcome.reason === "identity_violation"
+								? "identity_mismatch"
+								: outcome.reason === "io_failure"
+									? "io_error"
+									: "durability_failed";
 	return new ManagedPublishError(classification, outcome);
 }
 

package/src/session/internal/native-publish-outcome.ts

@@ -6,6 +6,7 @@ export type NativePublishReason =
 	| "atomic_unavailable"
 	| "cross_device"
 	| "permission_denied"
+	| "access_denied"
 	| "io_failure"
 	| "interrupted"
 	| "invalid_request"
@@ -77,6 +78,7 @@ const reasons = new Set<NativePublishReason>([
 	"atomic_unavailable",
 	"cross_device",
 	"permission_denied",
+	"access_denied",
 	"io_failure",
 	"interrupted",
 	"invalid_request",
@@ -109,6 +111,7 @@ const preMutationReasons = new Set<NativePublishReason>([
 	"atomic_unavailable",
 	"cross_device",
 	"permission_denied",
+	"access_denied",
 	"io_failure",
 	"interrupted",
 	"invalid_request",
@@ -184,11 +187,12 @@ function legalOutcome(outcome: NativePublishOutcome): boolean {
 					"atomic_unavailable",
 					"cross_device",
 					"permission_denied",
+					"access_denied",
 					"io_failure",
 					"interrupted",
 				].includes(outcome.reason)) ||
 				(outcome.phase === "preflight" &&
-					!["atomic_unavailable", "cross_device", "interrupted"].includes(outcome.reason)) ||
+					!["atomic_unavailable", "cross_device", "interrupted", "access_denied"].includes(outcome.reason)) ||
 				(outcome.phase === "file_sync" && outcome.reason === "io_failure"))
 		);
 	if (outcome.mutationState === "unknown")

package/src/session/messages.ts

@@ -158,6 +158,34 @@ function getPrunedToolResultContent(message: ToolResultMessage): (TextContent |
 export const PRE_ADMISSION_ARTIFACT_SPILL_HEAD_BYTES = 4096;
 export const PRE_ADMISSION_ARTIFACT_SPILL_TAIL_BYTES = 4096;
 
+/**
+ * Keep an authenticated `#GJC1_` placeholder whole when the byte cut lands
+ * inside it. Short inputs whose head and tail already overlap stay on the
+ * original byte limits.
+ */
+function retainStraddlingPlaceholders(text: string, head: string, tail: string): { head: string; tail: string } {
+	const headEnd = head.length;
+	const tailStart = text.length - tail.length;
+	if (headEnd > tailStart) return { head, tail };
+
+	let nextHeadEnd = headEnd;
+	let nextTailStart = tailStart;
+	const placeholder = /#GJC1_[A-Za-z0-9_-]{22}#/g;
+	for (;;) {
+		const match = placeholder.exec(text);
+		if (match === null) break;
+		const start = match.index;
+		const stop = start + match[0].length;
+		if (start < headEnd && stop > headEnd) nextHeadEnd = Math.max(nextHeadEnd, stop);
+		if (start < tailStart && stop > tailStart) nextTailStart = Math.min(nextTailStart, start);
+	}
+	if (nextHeadEnd > nextTailStart) return { head, tail };
+	return {
+		head: nextHeadEnd === headEnd ? head : text.slice(0, nextHeadEnd),
+		tail: nextTailStart === tailStart ? tail : text.slice(nextTailStart),
+	};
+}
+
 function utf8Prefix(text: string, maxBytes: number): string {
 	if (Buffer.byteLength(text, "utf-8") <= maxBytes) return text;
 	let bytes = 0;
@@ -193,15 +221,28 @@ function utf8Suffix(text: string, maxBytes: number): string {
  * Build the deterministic inline receipt for a tool result saved before the
  * next provider context is constructed. Byte boundaries never split UTF-8
  * code points, so head/tail recovery remains readable for emoji and CJK text.
+ *
+ * `redact` runs on the complete text before the cut. The digest stays the
+ * caller's hash of the stored artifact; the omitted count is the redacted
+ * preview's omitted bytes.
  */
-export function createPreAdmissionArtifactSpillPreview(fullText: string, artifactId: string, digest: string): string {
-	const totalBytes = Buffer.byteLength(fullText, "utf-8");
-	const head = utf8Prefix(fullText, PRE_ADMISSION_ARTIFACT_SPILL_HEAD_BYTES);
-	const tail = utf8Suffix(fullText, PRE_ADMISSION_ARTIFACT_SPILL_TAIL_BYTES);
-	const retainedBytes = Buffer.byteLength(head, "utf-8") + Buffer.byteLength(tail, "utf-8");
+export function createPreAdmissionArtifactSpillPreview(
+	fullText: string,
+	artifactId: string,
+	digest: string,
+	redact?: (text: string) => string,
+): string {
+	const source = redact ? redact(fullText) : fullText;
+	const totalBytes = Buffer.byteLength(source, "utf-8");
+	const head = utf8Prefix(source, PRE_ADMISSION_ARTIFACT_SPILL_HEAD_BYTES);
+	const tail = utf8Suffix(source, PRE_ADMISSION_ARTIFACT_SPILL_TAIL_BYTES);
+	// Without redaction the cut stays on the historical byte limits, including
+	// when the tool text itself contains a placeholder-shaped string.
+	const retained = redact ? retainStraddlingPlaceholders(source, head, tail) : { head, tail };
+	const retainedBytes = Buffer.byteLength(retained.head, "utf-8") + Buffer.byteLength(retained.tail, "utf-8");
 	const omittedBytes = Math.max(0, totalBytes - retainedBytes);
 	const receipt = `[${omittedBytes} bytes omitted; sha256:${digest}; full output: artifact://${artifactId}]`;
-	return `${head}\n\n${receipt}\n\n${tail}`;
+	return `${retained.head}\n\n${receipt}\n\n${retained.tail}`;
 }
 
 /**