@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/export/ttsr.ts

@@ -4,7 +4,12 @@
  * Manages rules that get injected mid-stream when their condition pattern matches
  * the agent's output. When a match occurs, the stream is aborted, the rule is
  * injected as a system reminder, and the request is retried.
+ *
+ * Rules may also carry `astCondition` ast-grep patterns, which are evaluated
+ * against the source a write/edit tool call introduces, before it executes.
  */
+import * as path from "node:path";
+import { AstMatchStrictness, astMatch } from "@gajae-code/natives";
 import { logger } from "@gajae-code/utils";
 import type { Rule } from "../capability/rule";
 import type { TtsrSettings } from "../config/settings";
@@ -22,6 +27,14 @@ export interface TtsrMatchContext {
 	streamKey?: string;
 }
 
+/** An astCondition pattern parse issue observed while checking a target language. */
+export interface TtsrAstConditionDiagnostic {
+	ruleName: string;
+	lang: string;
+	patterns: string[];
+	parseErrors: string[];
+}
+
 interface ToolScope {
 	toolName?: string;
 	pathGlob?: Bun.Glob;
@@ -39,6 +52,7 @@ interface TtsrEntry {
 	rule: Rule;
 	conditions: RegExp[];
 	conditionWindows: Array<number | undefined>;
+	astConditions?: string[];
 
 	scope: TtsrScope;
 	globalPathGlobs?: Bun.Glob[];
@@ -69,6 +83,7 @@ const DEFAULT_SETTINGS: Required<TtsrSettings> = {
 
 const SAFE_REGEX_WINDOW_CAP = 4096;
 const SAFE_REGEX_WINDOW_MULTIPLIER = 4;
+const SOURCE_SYNTAX_PARSE_ERROR = "parse error (syntax tree contains error nodes)";
 
 const DEFAULT_SCOPE: TtsrScope = {
 	allowText: true,
@@ -81,7 +96,9 @@ export class TtsrManager {
 	readonly #settings: Required<TtsrSettings>;
 	readonly #rules = new Map<string, TtsrEntry>();
 	readonly #injectionRecords = new Map<string, InjectionRecord>();
+	readonly #astConditionDiagnostics = new Map<string, TtsrAstConditionDiagnostic>();
 	readonly #buffers = new Map<string, string>();
+	readonly #lastAstSnapshots = new Map<string, string>();
 	#messageCount = 0;
 
 	constructor(settings?: Partial<TtsrSettings>) {
@@ -339,7 +356,10 @@ export class TtsrManager {
 		}
 
 		const conditions = this.#compileConditions(rule);
-		if (conditions.length === 0) {
+		const astConditions = rule.astCondition ?? [];
+
+		// Rule must have either regex or AST conditions
+		if (conditions.length === 0 && astConditions.length === 0) {
 			return false;
 		}
 
@@ -357,6 +377,7 @@ export class TtsrManager {
 			rule,
 			conditions,
 			conditionWindows,
+			astConditions: astConditions.length > 0 ? astConditions : undefined,
 			scope,
 			globalPathGlobs,
 		});
@@ -364,6 +385,7 @@ export class TtsrManager {
 		logger.debug("TTSR rule registered", {
 			ruleName: rule.name,
 			conditions: rule.condition,
+			astConditions: rule.astCondition,
 			scope: rule.scope,
 			globs: rule.globs,
 		});
@@ -446,6 +468,25 @@ export class TtsrManager {
 		return Array.from(this.#injectionRecords.keys());
 	}
 
+	/**
+	 * Undo a provisional claim whose reminder was never delivered: restore the
+	 * record the rule had before the claim, or forget it when it had none, so the
+	 * rule is eligible again exactly as before.
+	 */
+	releaseInjected(ruleName: string, previous: TtsrInjectionRecord | undefined): void {
+		const name = ruleName.trim();
+		if (name.length === 0) return;
+		if (!previous) {
+			this.#injectionRecords.delete(name);
+			return;
+		}
+		this.#injectionRecords.set(name, {
+			lastInjectedAt: previous.lastInjectedAt,
+			repeatMode: previous.repeatMode,
+			repeatGap: previous.repeatGap,
+		});
+	}
+
 	/** Get full injected rule records (for persistence). */
 	getInjectedRecords(): TtsrInjectionRecord[] {
 		return Array.from(this.#injectionRecords, ([name, record]) => ({ name, ...record }));
@@ -477,6 +518,7 @@ export class TtsrManager {
 	/** Reset stream buffers (called on new turn). */
 	resetBuffer(): void {
 		this.#buffers.clear();
+		this.#lastAstSnapshots.clear();
 	}
 
 	/** Check if any TTSR rules are registered. */
@@ -509,4 +551,137 @@ export class TtsrManager {
 	getSettings(): Required<TtsrSettings> {
 		return this.#settings;
 	}
+
+	/** Check if any registered rule carries an `astCondition`. */
+	hasAstRules(): boolean {
+		if (this.#isDisabled()) {
+			return false;
+		}
+		for (const entry of this.#rules.values()) {
+			if (entry.astConditions) {
+				return true;
+			}
+		}
+		return false;
+	}
+
+	/** Get observed astCondition pattern parse issues for rule diagnostics. */
+	getAstConditionDiagnostics(): TtsrAstConditionDiagnostic[] {
+		return Array.from(this.#astConditionDiagnostics.values(), diagnostic => ({
+			...diagnostic,
+			patterns: [...diagnostic.patterns],
+			parseErrors: [...diagnostic.parseErrors],
+		}));
+	}
+
+	/** Derive an ast-grep language alias from the candidate file extensions. */
+	#deriveLang(filePaths: string[] | undefined): string | undefined {
+		for (const filePath of filePaths ?? []) {
+			const ext = path.extname(this.#normalizePath(filePath));
+			if (ext.length > 1) return ext.slice(1).toLowerCase();
+		}
+		return undefined;
+	}
+
+	/** Match the source introduced by finalized tool arguments, before execution. */
+	async checkAstSnapshot(snapshot: string, context: TtsrMatchContext, signal?: AbortSignal): Promise<Rule[]> {
+		if (this.#isDisabled() || context.source !== "tool" || signal?.aborted) {
+			return [];
+		}
+		const lang = this.#deriveLang(context.filePaths);
+		if (!lang) return [];
+
+		const candidates: TtsrEntry[] = [];
+		for (const [name, entry] of this.#rules) {
+			if (!entry.astConditions?.length) continue;
+			if (
+				!this.#canTrigger(name) ||
+				!this.#matchesScope(entry, context) ||
+				!this.#matchesGlobalPaths(entry, context)
+			) {
+				continue;
+			}
+			candidates.push(entry);
+		}
+		if (candidates.length === 0) return [];
+
+		const bufferKey = this.#bufferKey(context);
+		if (this.#lastAstSnapshots.get(bufferKey) === snapshot) return [];
+		this.#lastAstSnapshots.set(bufferKey, snapshot);
+
+		const matches: Rule[] = [];
+		for (const entry of candidates) {
+			if (!entry.astConditions) continue;
+			const matched = await this.#astConditionsMatch(entry.rule.name, entry.astConditions, snapshot, lang, signal);
+			if (signal?.aborted) return [];
+			if (matched) {
+				matches.push(entry.rule);
+				logger.debug("TTSR ast condition matched", {
+					ruleName: entry.rule.name,
+					astConditions: entry.rule.astCondition,
+					toolName: context.toolName,
+					filePaths: context.filePaths,
+				});
+			}
+		}
+		return matches;
+	}
+
+	#recordAstConditionDiagnostics(
+		ruleName: string,
+		patterns: string[],
+		lang: string,
+		parseErrors: string[] | undefined,
+	): void {
+		const patternParseErrors = parseErrors?.filter(parseError => parseError !== SOURCE_SYNTAX_PARSE_ERROR) ?? [];
+		if (patternParseErrors.length === 0) return;
+
+		const key = JSON.stringify([ruleName, lang]);
+		if (this.#astConditionDiagnostics.has(key)) return;
+
+		const diagnostic: TtsrAstConditionDiagnostic = {
+			ruleName,
+			lang,
+			patterns: [...patterns],
+			parseErrors: patternParseErrors,
+		};
+		this.#astConditionDiagnostics.set(key, diagnostic);
+		logger.warn("TTSR astCondition pattern is invalid for target language", {
+			ruleName,
+			lang,
+			patterns: diagnostic.patterns,
+			parseErrors: diagnostic.parseErrors,
+		});
+	}
+
+	async #astConditionsMatch(
+		ruleName: string,
+		patterns: string[],
+		source: string,
+		lang: string,
+		signal?: AbortSignal,
+	): Promise<boolean> {
+		try {
+			const result = await astMatch({
+				patterns,
+				source,
+				lang,
+				strictness: AstMatchStrictness.Smart,
+				limit: 1,
+				signal,
+			});
+			if (!signal?.aborted) {
+				this.#recordAstConditionDiagnostics(ruleName, patterns, lang, result.parseErrors);
+			}
+			return result.totalMatches > 0;
+		} catch (error) {
+			logger.warn("TTSR ast match failed, treating as no match", {
+				ruleName,
+				patterns,
+				lang,
+				error: error instanceof Error ? error.message : String(error),
+			});
+			return false;
+		}
+	}
 }

package/src/extensibility/custom-tools/wrapper.ts

@@ -21,9 +21,11 @@ export class CustomToolAdapter<TParams extends TSchema = TSchema, TDetails = any
 		private tool: CustomTool<TParams, TDetails>,
 		private getContext: () => CustomToolContext,
 	) {
-		applyToolProxy(tool, this);
+		// Own these before proxying: with useDefineForClassFields off, the uninitialized fields do not
+		// exist yet, so applyToolProxy would install getter-only accessors that reject assignment.
 		this.strict = tool.strict;
 		this.concurrency = tool.concurrency;
+		applyToolProxy(tool, this);
 	}
 
 	execute(

package/src/extensibility/extensions/loader.ts

@@ -15,6 +15,7 @@ import { loadCapability } from "../../discovery";
 import { getExtensionNameFromPath } from "../../discovery/helpers";
 import type { ExecOptions } from "../../exec/exec";
 import { execCommand } from "../../exec/exec";
+import type { QueuedRunStartFailure } from "../../session/agent-session";
 import type { CustomMessage } from "../../session/messages";
 import { EventBus } from "../../utils/event-bus";
 import { installLegacyPiSpecifierShim, loadLegacyPiModule } from "../plugins/legacy-pi-compat";
@@ -394,6 +395,7 @@ class ConcreteExtensionAPI implements ExtensionAPI {
 			onPreflightAccepted?: () => void;
 			onPreflightAcceptCommit?: () => void | Promise<void>;
 			onQueuedPromoted?: (promotion: { startsOwnRun?: boolean; removed?: boolean }) => void;
+			onQueuedRunStartFailed?: (failure: QueuedRunStartFailure) => void;
 			onDispatchDisposition?: (promotion: { startsOwnRun: boolean }) => void;
 			preflightSignal?: AbortSignal;
 		},
@@ -791,7 +793,14 @@ export async function discoverAndLoadExtensions(
 		...(options.profileAuthority === undefined ? {} : { profileAuthority: options.profileAuthority }),
 		...(options.settings === undefined ? {} : { settings: options.settings }),
 	});
-	for (const ext of discovered.items) {
+	// Filter project modules before first-wins name deduplication. `items` has
+	// already deduplicated, so a project module could otherwise shadow the
+	// same-named user module before being rejected here.
+	const seenDiscoveredNames = new Set<string>();
+	for (const ext of discovered.all) {
+		if (ext._source.provider === "native" && ext.level === "project") continue;
+		if (seenDiscoveredNames.has(ext.name)) continue;
+		seenDiscoveredNames.add(ext.name);
 		if (ext._source.provider !== "native") continue;
 		addPath(ext.path);
 	}

package/src/extensibility/extensions/ouroboros-ooo-bridge.ts

@@ -1,9 +1,14 @@
+import { ptree } from "@gajae-code/utils";
+import { $credentialEnv, startupProjectEnvSnapshot } from "@gajae-code/utils/env";
+import { canonicalEnvKey } from "@gajae-code/utils/env-file";
+import type { ExecResult } from "../../exec/exec";
 import type { MCPServerConnection, MCPToolCallResult } from "../../runtime-mcp";
 import { callTool, connectToServer, disconnectServer } from "../../runtime-mcp";
 import { createExactPrefixCommandBridge } from "./prefix-command-bridge";
 import type { ExtensionContext, InputEvent, InputEventResult } from "./types";
 
 const OUROBOROS_CLI_ENV = "OUROBOROS_CLI";
+const DEFAULT_OUROBOROS_COMMAND = "ouroboros";
 const INTERVIEW_COMMAND = "ooo interview";
 const INTERVIEW_TOOL = "ouroboros_interview";
 const INTERVIEW_SESSION_PATTERN = /^interview_[A-Za-z0-9_-]+$/;
@@ -23,8 +28,64 @@ interface OuroborosOooBridgeHandler {
 	reset(): Promise<void>;
 }
 
+function projectSuppliedOuroborosCli(): boolean {
+	const snapshot = startupProjectEnvSnapshot();
+	const key = canonicalEnvKey(OUROBOROS_CLI_ENV);
+	return Object.hasOwn(snapshot.values, key) || snapshot.dynamic.has(key);
+}
+
+/**
+ * Executable for `ooo` dispatch and the interview MCP server.
+ *
+ * The string is spawned directly, so a repository `.env` must not choose it.
+ * `$credentialEnv` keeps a launching-shell or user-owned setting and ignores
+ * the project dotenv, including a dynamic declaration. Anything else stays the
+ * default command name. A rejected project value is removed from `process.env`
+ * before either spawn. Prefix dispatch also passes that cleaned object: Bun
+ * keeps the startup environment for a spawn that omits `env`, so deleting the
+ * key alone would still hand the project value to the child.
+ */
 function resolveOuroborosCommand(): string {
-	return process.env[OUROBOROS_CLI_ENV]?.trim() || "ouroboros";
+	const trusted = $credentialEnv(OUROBOROS_CLI_ENV)?.trim();
+	if (trusted) {
+		const live = process.env[OUROBOROS_CLI_ENV];
+		if (live !== undefined && live.trim() !== trusted) process.env[OUROBOROS_CLI_ENV] = trusted;
+		return trusted;
+	}
+	if (projectSuppliedOuroborosCli()) delete process.env[OUROBOROS_CLI_ENV];
+	return DEFAULT_OUROBOROS_COMMAND;
+}
+
+function ouroborosSpawnEnv(): Record<string, string> {
+	resolveOuroborosCommand();
+	const env: Record<string, string> = {};
+	for (const key of Object.keys(process.env)) {
+		const value = process.env[key];
+		if (typeof value === "string") env[key] = value;
+	}
+	return env;
+}
+
+async function dispatchOuroborosCommand(
+	command: string,
+	args: string[],
+	ctx: ExtensionContext,
+	execOptions: { timeout?: number },
+): Promise<ExecResult> {
+	const result = await ptree.exec([command, ...args], {
+		cwd: ctx.cwd,
+		timeout: execOptions.timeout,
+		allowNonZero: true,
+		allowAbort: true,
+		stderr: "full",
+		env: ouroborosSpawnEnv(),
+	});
+	return {
+		stdout: result.stdout,
+		stderr: result.stderr,
+		code: result.exitCode ?? 0,
+		killed: Boolean(result.exitError?.aborted),
+	};
 }
 
 function interviewArgument(text: string): string | undefined {
@@ -89,6 +150,7 @@ export function createOuroborosOooBridge(options: OuroborosOooBridgeOptions = {}
 		prefix: "ooo",
 		command: resolveOuroborosCommand(),
 		args: ["dispatch", "--runtime", "gjc"],
+		dispatch: dispatchOuroborosCommand,
 	});
 
 	function assertCurrent(generation: number, signal: AbortSignal | undefined): void {

package/src/extensibility/extensions/types.ts

@@ -50,7 +50,7 @@ import type { CustomEditor } from "../../modes/components/custom-editor";
 import type { WorkflowGateEmitter } from "../../modes/shared/agent-wire/workflow-gate-broker";
 import type { Theme } from "../../modes/theme/theme";
 import type { ProjectProgressSnapshot } from "../../progress/progress-contract";
-import type { AgentSessionEventListener } from "../../session/agent-session";
+import type { AgentSessionEventListener, QueuedRunStartFailure } from "../../session/agent-session";
 import type {
 	ClientBridge,
 	ClientBridgePermissionOption,
@@ -1347,6 +1347,8 @@ export interface ExtensionAPI {
 			onPreflightAccepted?: () => void;
 			onPreflightAcceptCommit?: () => void | Promise<void>;
 			onQueuedPromoted?: (promotion: { startsOwnRun?: boolean; removed?: boolean }) => void;
+			/** Internal positive refusal before an exact queued invocation can start. */
+			onQueuedRunStartFailed?: (failure: QueuedRunStartFailure) => void;
 			onDispatchDisposition?: (promotion: { startsOwnRun: boolean }) => void;
 			preflightSignal?: AbortSignal;
 			/** Internal SDK correlation owner for an exact queued follow-up. */
@@ -1577,6 +1579,8 @@ export type SendUserMessageHandler = (
 		 * grants root abort ownership.
 		 */
 		onQueuedPromoted?: (promotion: { startsOwnRun?: boolean; removed?: boolean }) => void;
+		/** Internal positive refusal, not an inference from a dispatch error or missing event. */
+		onQueuedRunStartFailed?: (failure: QueuedRunStartFailure) => void;
 		/**
 		 * Fired synchronously when a plain prompt's dispatch resolves at queue
 		 * time instead of run end (diverted into an in-flight run's steering).

package/src/extensibility/hooks/loader.ts

@@ -346,9 +346,17 @@ export async function discoverAndLoadHooks(configuredPaths: string[], cwd: strin
 	};
 
 	// 1. Discover hooks via capability API and validate the provider descriptor
-	// against the canonical model before importing project-controlled code.
+	// against the canonical model before importing. A repository
+	// `<cwd>/.gjc/hooks` module is not imported. Skip those entries before
+	// dedup so a same-named user-agent hook still loads. An explicit path
+	// below remains a consent path.
 	const discovered = await loadCapability<Hook>(hookCapability.id, { cwd, providers: ["native"] });
-	for (const hook of discovered.items) {
+	const seenHookKeys = new Set<string>();
+	for (const hook of discovered.all) {
+		if (hook.level === "project") continue;
+		const hookKey = `${hook.type}:${hook.tool}:${hook.name}`;
+		if (seenHookKeys.has(hookKey)) continue;
+		seenHookKeys.add(hookKey);
 		const convention =
 			hook._source.provider === "native"
 				? HookSourceConvention.NativeGjc

package/src/extensibility/plugins/marketplace/fetcher.ts

@@ -10,7 +10,7 @@ import * as https from "node:https";
 import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
-import { isEnoent, logger } from "@gajae-code/utils";
+import { isEnoent, logger, redactCrashSecrets } from "@gajae-code/utils";
 import * as git from "../../../utils/git";
 import { isPrivateOrSpecialAddress, validatePublicHttpUrl } from "../../../web/insane/url-guard";
 
@@ -461,7 +461,7 @@ async function cloneAndReadCatalog(url: string, cacheDir: string): Promise<Fetch
 	const tmpDir = path.join(cacheDir, `.tmp-clone-${Date.now()}`);
 	await fs.mkdir(cacheDir, { recursive: true });
 
-	logger.debug(`[marketplace] cloning ${url} → ${tmpDir}`);
+	logger.debug(redactCrashSecrets(`[marketplace] cloning ${url} → ${tmpDir}`));
 	await git.clone(url, tmpDir);
 
 	const catalogPath = path.join(tmpDir, CATALOG_RELATIVE_PATH);

package/src/extensibility/plugins/marketplace/manager.ts

@@ -15,6 +15,7 @@ import {
 	type NativeDirectoryTreeSnapshot,
 	type NativeExactUnlinkResult,
 	renameDirectoryNoReplacePathAsync,
+	renameNoReplacePathAsync,
 	snapshotDirectoryTree,
 } from "@gajae-code/natives";
 import { isEnoent, logger, pathIsWithin } from "@gajae-code/utils";
@@ -175,6 +176,13 @@ async function snapshotIfPresent(targetPath: string): Promise<NativeDirectoryTre
 	return snapshot.ok ? snapshot.snapshot : undefined;
 }
 
+/** Windows supports directory no-replace through the handle-based path API, not the POSIX directory fallback. */
+function renameDirectoryNoReplace(sourcePath: string, destinationPath: string) {
+	return process.platform === "win32"
+		? renameNoReplacePathAsync(sourcePath, destinationPath)
+		: renameDirectoryNoReplacePathAsync(sourcePath, destinationPath);
+}
+
 /**
  * Full identity comparison between two directory tree snapshots. A same-
  * filesystem `renameat`-class namespace operation changes neither the root's
@@ -850,9 +858,10 @@ export class MarketplaceManager {
 			});
 			if (finalStat?.isSymbolicLink()) throw new MarketplaceRestoreError("final_path_is_symlink");
 			const hadFinal = finalStat !== undefined;
-			// Single-component name; never renamed elsewhere on collision since the
-			// native no-replace primitive is what actually refuses an occupied slot.
-			const backup = `${finalPath}.restore-backup-${process.pid}-${randomBytes(6).toString("hex")}`;
+			// Keep the private backup component bounded independently of the canonical
+			// cache basename, which can itself be near NAME_MAX through a long version.
+			const backupName = `.gjc-restore-backup-${createHash("sha256").update(finalPath).digest("hex")}-${randomBytes(12).toString("hex")}`;
+			const backup = path.join(pluginsCacheDir, backupName);
 
 			const parentRecheck = await fs.lstat(pluginsCacheDir, { bigint: true }).catch(() => undefined);
 			if (!parentRecheck || parentRecheck.dev !== parentBefore.dev || parentRecheck.ino !== parentBefore.ino)
@@ -878,12 +887,29 @@ export class MarketplaceManager {
 				// merely a decision about whether it is safe to proceed. sideEffectStarted
 				// stays false — effects are physical, not procedural.
 				if (!finalSnapshotBefore) throw new MarketplaceRestoreError("final_path_snapshot_unavailable");
-				const detached = exactRemoveDirectoryTree(finalPath, finalSnapshotBefore, {
-					dev: parentBefore.dev,
-					ino: parentBefore.ino,
-				});
+				const detached = exactRemoveDirectoryTree(
+					finalPath,
+					finalSnapshotBefore,
+					{
+						dev: parentBefore.dev,
+						ino: parentBefore.ino,
+					},
+					true,
+				);
 				const detachedPath = detachedTree(detached);
 				if (!detachedPath) {
+					if (detached.code === "restore_failed" && detached.detachedPath) {
+						const retainedSnapshot = await snapshotIfPresent(detached.detachedPath).catch(() => undefined);
+						const retainedBackupPath =
+							retainedSnapshot && sameDirectoryTreeIdentity(finalSnapshotBefore, retainedSnapshot)
+								? detached.detachedPath
+								: undefined;
+						throw new MarketplaceRestoreError("backup_detach_unverified", {
+							sideEffectStarted: true,
+							outcome: "uncertain",
+							...(retainedBackupPath ? { retainedBackupPath } : {}),
+						});
+					}
 					// identity_mismatch means finalPath already changed before we ever
 					// touched it — exactRemoveDirectoryTree refused the mutation entirely,
 					// so this is a pure precheck refusal: nothing moved, sideEffectStarted
@@ -906,7 +932,7 @@ export class MarketplaceManager {
 				// later detach of the same canonical path inside this same transaction (the
 				// rollback path) collides with our own leftover and is misread as a foreign
 				// claim. The rename below is what vacates it; failure is reported, never assumed.
-				const backupPublish = await renameDirectoryNoReplacePathAsync(detachedPath, backup);
+				const backupPublish = await renameDirectoryNoReplace(detachedPath, backup);
 				if (!backupPublish.ok) {
 					// mutationState "not_committed" proves the rename never moved the
 					// object; it is still at the detached path, so that path is real
@@ -962,7 +988,7 @@ export class MarketplaceManager {
 				// devices on cross_device, the dev/ino-stability assumption behind
 				// `stagedSnapshot` breaks silently and every identity-bound check in this
 				// method becomes unsound.
-				const publish = await renameDirectoryNoReplacePathAsync(token.stagedArtifactPath, finalPath);
+				const publish = await renameDirectoryNoReplace(token.stagedArtifactPath, finalPath);
 				// Test seam only (no-op in production): lets a test deterministically
 				// simulate a concurrent second writer republishing finalPath here,
 				// exercising the foreign-owner branch below without weakening it.
@@ -1233,7 +1259,7 @@ export class MarketplaceManager {
 						);
 					}
 				}
-				const restorePublish = await renameDirectoryNoReplacePathAsync(backup, finalPath);
+				const restorePublish = await renameDirectoryNoReplace(backup, finalPath);
 				if (!restorePublish.ok) {
 					// Restore failed: confirm what actually remains at `backup` right now
 					// (the no-replace rename may have left it there proven-untouched, or

package/src/extensibility/slash-commands.ts

@@ -116,6 +116,11 @@ export const BUILTIN_SLASH_COMMANDS: ReadonlyArray<
 	return cmd;
 });
 
+export function getBuiltinSlashCommandsForSession(hasExactMcpControls: boolean): typeof BUILTIN_SLASH_COMMANDS {
+	if (hasExactMcpControls) return BUILTIN_SLASH_COMMANDS;
+	return BUILTIN_SLASH_COMMANDS.filter(command => command.name !== "mcp");
+}
+
 /**
  * Represents a custom slash command loaded from a file
  */

package/src/gjc-runtime/gc-runtime.ts

@@ -18,7 +18,15 @@ import * as fsp from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
 import { exactRemoveDirectoryTree, exactUnlink, snapshotDirectoryTree } from "@gajae-code/natives";
-import { getAgentDir, getBlobsDir, getSessionsDir, isEnoent, VERSION } from "@gajae-code/utils";
+import {
+	getAgentDir,
+	getBlobsDir,
+	getSessionsDir,
+	isEnoent,
+	loadedProjectEnvSnapshot,
+	VERSION,
+} from "@gajae-code/utils";
+import { type ProjectEnvSnapshot, projectEnvSnapshot } from "@gajae-code/utils/env-file";
 import { getDefault } from "../config/settings-schema";
 import { listHarnessRootRegistriesForGc } from "../harness-control-plane/storage";
 import { SessionIndex } from "../sdk/broker/session-index";
@@ -54,6 +62,7 @@ import {
 } from "./empty-delete-gc";
 import { buildGcReportText } from "./gc-render";
 import { collectSessionScopeUsage, type GcSessionScopeUsage, shouldReportSessionScope } from "./gc-session-scope";
+import { trustedCoordinatorEnv } from "./sidecar-bootstrap-env";
 
 export type GcStore = "harness_leases" | "file_locks" | "tmux_sessions" | "registry_entries" | "local_roots";
 
@@ -456,8 +465,21 @@ export function computeExitCode(report: GcReport): number {
 	return 0;
 }
 
-function resolveGcAgentDir(env: NodeJS.ProcessEnv): string {
-	return env.GJC_CODING_AGENT_DIR?.trim() || env.PI_CODING_AGENT_DIR?.trim() || getAgentDir();
+/**
+ * Operator override only. Same project-dotenv rule as `getAgentDir()`: a value
+ * the checkout declares is ignored, and an operator value it does not declare
+ * is kept. A repository `.env` must not choose the tree `gjc gc` reclaims.
+ *
+ * `snapshot` is the dotenv provenance from when that environment was loaded.
+ * `process.env` uses the module-load snapshot. A separate env map uses the
+ * snapshot taken with it before awaited GC work. Neither path rereads files later.
+ */
+function resolveGcAgentDir(env: NodeJS.ProcessEnv, snapshot: ProjectEnvSnapshot): string {
+	return (
+		trustedCoordinatorEnv("GJC_CODING_AGENT_DIR", env, snapshot) ||
+		trustedCoordinatorEnv("PI_CODING_AGENT_DIR", env, snapshot) ||
+		getAgentDir()
+	);
 }
 
 /**
@@ -572,6 +594,10 @@ export async function runGjcGcCommand(
 	adapters?: GcStoreAdapter[],
 	diskPolicy?: Partial<GcDiskPolicy>,
 ): Promise<GcRunResult> {
+	// process.env was loaded before this module. Reusing that snapshot keeps a
+	// project value rejected after its declaration is removed or changed.
+	// A caller-supplied env is not that load: bind its cwd files once, here.
+	const loadedProjectEnv = env === process.env ? loadedProjectEnvSnapshot() : projectEnvSnapshot(cwd);
 	let parsed: ParsedGcArgs;
 	try {
 		parsed = parseGcArgs(argv);
@@ -656,17 +682,18 @@ export async function runGjcGcCommand(
 	const ordinaryPrune = parsed.prune && (emptyDeleteReceipts?.errors.length ?? 0) === 0;
 	const report = await collectGcReport(resolvedAdapters, ctx, ordinaryPrune);
 	report.operation = parsed.repairSessionIndex ? "repair_session_index" : parsed.prune ? "prune" : "dry_run";
-	report.session_index = await collectSessionIndexHealth(parsed.repairSessionIndex, resolveGcAgentDir(env));
+	const agentDir = resolveGcAgentDir(env, loadedProjectEnv);
+	report.session_index = await collectSessionIndexHealth(parsed.repairSessionIndex, agentDir);
 	if (parsed.disk) {
 		report.disk = await collectGcDiskReport({
-			agentDir: resolveGcAgentDir(env),
+			agentDir,
 			env,
 			policy: resolveGcDiskPolicy(diskPolicy),
 			prune: ordinaryPrune,
 		});
 	}
 	if (emptyDeleteReceipts) report.empty_delete_receipts = emptyDeleteReceipts;
-	const scopeUsage = await collectGcSessionScope(cwd, resolveGcAgentDir(env));
+	const scopeUsage = await collectGcSessionScope(cwd, agentDir);
 	if (scopeUsage && shouldReportSessionScope(scopeUsage)) report.session_scope = scopeUsage;
 	const sessionIndexFailed =
 		report.session_index?.status === "corrupt" ||
@@ -2272,7 +2299,10 @@ async function removeGcDiskEntry(
 		return { removed: false, reason: "entry_changed" };
 	}
 	const retainedAtOriginal = !removal.detachedPath || path.resolve(removal.detachedPath) === path.resolve(target);
-	if ((removal.code === "permission_denied" || removal.code === "io_error") && retainedAtOriginal) {
+	if (
+		(removal.code === "permission_denied" || removal.code === "access_denied" || removal.code === "io_error") &&
+		retainedAtOriginal
+	) {
 		return { removed: false, reason: "withheld_evidence_incomplete: tree_unreadable", withheld: true };
 	}
 	return {