@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/gjc-runtime/launch-tmux.ts

@@ -13,6 +13,7 @@ import {
 	MANAGED_OWNER_PREDECESSOR_RUN_ID_ENV,
 	MANAGED_OWNER_PREDECESSOR_TOKEN_ENV,
 	MANAGED_OWNER_TRANSCRIPT_PATH_ENV,
+	trustedManagedOwnerLaunchSessionFile,
 } from "./managed-owner-admission";
 import {
 	MANAGED_OWNER_INCARNATION_ENV,
@@ -70,11 +71,13 @@ import {
 } from "./tmux-owner-isolation";
 import { assertGjcTmuxStagedMutationAuthoritySync } from "./tmux-provider-context";
 import {
+	childGjcSessionIdAssignment,
 	findGjcTmuxSessionByName,
 	findGjcTmuxSessionByScope,
 	type GjcTmuxSessionStatus,
 	type ProvenTmuxSessionIdentity,
 	proveGjcTmuxSessionMutationTarget,
+	tmuxLaunchIdentityEnv,
 } from "./tmux-sessions";
 import {
 	buildWindowsPowerShellInnerCommand,
@@ -432,6 +435,8 @@ function stripRootTmuxFlag(rawArgs: string[]): string[] {
 
 export function applyGjcTmuxProfile(context: GjcTmuxProfileContext): GjcTmuxProfileResult {
 	const env = context.env ?? process.env;
+	const cwd = context.cwd ?? process.cwd();
+	const identityEnv = tmuxLaunchIdentityEnv(env, cwd);
 	const branchSlug = context.branch ? buildGjcTmuxSessionSlug(context.branch) : (context.branchSlug ?? null);
 	// The psmux UX filter (mouse / set-clipboard / mode-style /
 	// set-window-option) now lives in buildGjcTmuxProfileCommands so every
@@ -447,8 +452,8 @@ export function applyGjcTmuxProfile(context: GjcTmuxProfileContext): GjcTmuxProf
 			branch: context.branch ?? null,
 			branchSlug,
 			project: context.project ?? null,
-			sessionId: context.sessionId ?? env[GJC_COORDINATOR_SESSION_ID_ENV] ?? null,
-			sessionStateFile: context.sessionStateFile ?? env[GJC_COORDINATOR_SESSION_STATE_FILE_ENV] ?? null,
+			sessionId: context.sessionId ?? identityEnv[GJC_COORDINATOR_SESSION_ID_ENV] ?? null,
+			sessionStateFile: context.sessionStateFile ?? identityEnv[GJC_COORDINATOR_SESSION_STATE_FILE_ENV] ?? null,
 			ownerGeneration: context.ownerGeneration ?? null,
 			ownerServerKey: context.ownerServerKey ?? null,
 			version: context.version ?? null,
@@ -462,7 +467,6 @@ export function applyGjcTmuxProfile(context: GjcTmuxProfileContext): GjcTmuxProf
 		});
 	if (commands.length === 0) return { skipped: true, commands: [], failures: [] };
 	const spawnSync = context.spawnSync ?? defaultSpawnSync;
-	const cwd = context.cwd ?? process.cwd();
 	const options: TmuxSpawnOptions = {
 		cwd,
 		env,
@@ -1105,22 +1109,24 @@ export function buildDefaultTmuxLaunchPlan(context: TmuxLaunchContext): TmuxLaun
 	if (policy === "tmux" && !isInteractiveRootLaunch(context.parsed, tty)) return undefined;
 
 	const cwd = context.cwd ?? process.cwd();
+	const identityEnv = tmuxLaunchIdentityEnv(env, cwd);
 	const branch = context.worktreeBranch ?? context.currentBranch ?? readCurrentBranch(cwd);
 	const project = context.project ?? cwd;
-	const sessionName = buildGjcTmuxSessionName(env, { branch });
+	const sessionName = buildGjcTmuxSessionName(identityEnv, { branch });
 	// Pick the most appropriate tmux binary for this platform. On native Windows
 	// the resolver walks psmux / pmux / tmux and uses the first one present on
 	// PATH, so the default `gjc --tmux` flow lands on a real multiplexer even
 	// without an explicit GJC_TMUX_COMMAND override.
 	const resolvedBinary = resolveGjcTmuxBinary({ platform, env });
 	const tmuxCommand = resolvedBinary.command;
-	const sessionId = env[GJC_COORDINATOR_SESSION_ID_ENV]?.trim() || sessionName;
+	const sessionId = identityEnv[GJC_COORDINATOR_SESSION_ID_ENV]?.trim() || sessionName;
 	// The session ROOT is keyed by the active GJC session (GJC_SESSION_ID), NOT the
 	// coordinator/tmux identity. Fall back to the coordinator id only for standalone
-	// tmux launches with no GJC session context.
-	const gjcSessionId = env.GJC_SESSION_ID?.trim() || sessionId;
+	// tmux launches with no GJC session context. Project dotenv pins are already
+	// removed from identityEnv.
+	const gjcSessionId = identityEnv.GJC_SESSION_ID?.trim() || sessionId;
 	const sessionStateFile =
-		env[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]?.trim() ||
+		identityEnv[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]?.trim() ||
 		tmuxRuntimeSessionPath(cwd, gjcSessionId, buildGjcTmuxSessionSlug(sessionName));
 	const signingEnv = coordinatorSidecarSigningEnv(env);
 	// Stage only the one-shot channel descriptor (path + key id). The PKCS#8 key
@@ -1135,13 +1141,13 @@ export function buildDefaultTmuxLaunchPlan(context: TmuxLaunchContext): TmuxLaun
 		(context.diagnosticWriter ?? safeStderrWrite)(formatTmuxUnavailableDiagnostic(platform));
 		return undefined;
 	}
-	const existingSessionName = allowsExistingTmuxAttach(context.parsed, env)
+	const existingSessionName = allowsExistingTmuxAttach(context.parsed, identityEnv)
 		? "existingBranchSessionName" in context
 			? (context.existingBranchSessionName ?? undefined)
 			: resolvedBinary.isPsmux && platform === "win32"
-				? explicitTmuxSessionName(env)
+				? explicitTmuxSessionName(identityEnv)
 				: findExistingSessionForLaunch({
-						env,
+						env: identityEnv,
 						project,
 						branch,
 					})
@@ -1153,6 +1159,7 @@ export function buildDefaultTmuxLaunchPlan(context: TmuxLaunchContext): TmuxLaun
 			execPath: context.execPath ?? process.execPath,
 			extraEnv: {
 				...childSigningEnv,
+				...childGjcSessionIdAssignment(env, identityEnv, cwd, gjcSessionId),
 				[GJC_COORDINATOR_SESSION_ID_ENV]: sessionId,
 				[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]: sessionStateFile,
 				// Carry the GJC-managed session name into the child so tmux-backed
@@ -1209,6 +1216,9 @@ function trustedReplacementAuthority(
 function prepareManagedOwnerLifecycle(plan: TmuxLaunchPlan, context: TmuxLaunchContext): void {
 	if (plan.ownerGeneration) return;
 	const sessionId = plan.sessionId ?? plan.sessionName;
+	const launchEnv = context.env ?? process.env;
+	const identityEnv = tmuxLaunchIdentityEnv(launchEnv, plan.cwd);
+	const gjcSessionId = identityEnv.GJC_SESSION_ID?.trim() || sessionId;
 	const stateDir = path.dirname(plan.sessionStateFile ?? path.join(plan.cwd, ".gjc", "runtime"));
 	const baseline = captureOwnerGenerationBaselineSync(stateDir, sessionId);
 	const replacement = trustedReplacementAuthority(stateDir, sessionId, baseline);
@@ -1233,6 +1243,7 @@ function prepareManagedOwnerLifecycle(plan: TmuxLaunchPlan, context: TmuxLaunchC
 							[GJC_COORDINATOR_SIDECAR_KEY_ID_ENV]: plan.coordinatorSidecarBootstrap.keyId,
 						}
 					: {}),
+				...childGjcSessionIdAssignment(launchEnv, identityEnv, plan.cwd, gjcSessionId),
 				[GJC_COORDINATOR_SESSION_ID_ENV]: sessionId,
 				[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]: plan.sessionStateFile ?? "",
 				// The tmux server inherits the bootstrap secret as child environment;
@@ -1249,8 +1260,12 @@ function prepareManagedOwnerLifecycle(plan: TmuxLaunchPlan, context: TmuxLaunchC
 							[MANAGED_OWNER_PREDECESSOR_GENERATION_ENV]: replacement.generation,
 							[MANAGED_OWNER_PREDECESSOR_RUN_ID_ENV]: replacement.runId,
 							[MANAGED_OWNER_PREDECESSOR_INCARNATION_ENV]: replacement.incarnation,
-							[MANAGED_OWNER_TRANSCRIPT_PATH_ENV]:
-								context.env?.GJC_SESSION_FILE ?? process.env.GJC_SESSION_FILE ?? "",
+							[MANAGED_OWNER_TRANSCRIPT_PATH_ENV]: trustedManagedOwnerLaunchSessionFile(
+								{
+									GJC_SESSION_FILE: context.env?.GJC_SESSION_FILE ?? process.env.GJC_SESSION_FILE,
+								},
+								plan.cwd,
+							),
 						}
 					: {}),
 			},
@@ -1522,7 +1537,7 @@ export function launchDefaultTmuxIfNeeded(context: TmuxLaunchContext): boolean {
 		try {
 			if (plan.attachSessionName) {
 				const stateDir = env[GJC_TMUX_OWNER_STATE_DIR_ENV]?.trim();
-				const sessionId = env[GJC_COORDINATOR_SESSION_ID_ENV]?.trim();
+				const sessionId = tmuxLaunchIdentityEnv(env, plan.cwd)[GJC_COORDINATOR_SESSION_ID_ENV]?.trim();
 				const generation = env[GJC_TMUX_OWNER_GENERATION_ENV]?.trim();
 				if (!stateDir || !sessionId || !generation) throw new Error("gjc_tmux_provider_authority_unavailable");
 				plan.authority = readGjcTmuxProviderAuthoritySync({ stateDir, sessionId, generation });
@@ -1591,7 +1606,7 @@ export function launchDefaultTmuxIfNeeded(context: TmuxLaunchContext): boolean {
 		}
 	};
 	const creationSpawn = plan.authority ? spawnSync : rawSpawnSync;
-	const spawnEnv = { ...env };
+	const spawnEnv = { ...tmuxLaunchIdentityEnv(env, plan.cwd) };
 	delete spawnEnv[GJC_COORDINATOR_SIDECAR_SIGNING_KEY_ENV];
 	const signingEnv = coordinatorSidecarSigningEnv(env);
 	Object.assign(spawnEnv, signingEnv);

package/src/gjc-runtime/launch-worktree.test.ts

@@ -9,6 +9,7 @@ import {
 	ensureLaunchWorktree,
 	evacuatePreWorktreeTarget,
 	isReplaceableWorktreeTarget,
+	removeOwnedLaunchWorktree,
 	restorePreWorktreeGjc,
 } from "./launch-worktree";
 
@@ -246,3 +247,150 @@ describe("acquireTargetLock", () => {
 		expect(fs.existsSync(path.join(worktreePath, ".git"))).toBe(true);
 	});
 });
+
+function ownedReceipt(): { created: true; reused: false; createdBranch: false } {
+	return { created: true, reused: false, createdBranch: false };
+}
+
+function detachedPlan(repoRoot: string, worktreePath: string): GjcLaunchWorktreePlan {
+	return {
+		enabled: true,
+		repoRoot,
+		worktreePath,
+		detached: true,
+		baseRef: "HEAD",
+		branchName: null,
+	};
+}
+
+/** Replace a real worktree directory with a symlink to a directory that copies its `.git` file. */
+function swapWorktreeForForgedGitdir(worktreePath: string, forgeDir: string): void {
+	const gitFile = fs.readFileSync(path.join(worktreePath, ".git"), "utf8");
+	fs.mkdirSync(forgeDir, { recursive: true });
+	fs.writeFileSync(path.join(forgeDir, ".git"), gitFile.endsWith("\n") ? gitFile : `${gitFile}\n`);
+	fs.writeFileSync(path.join(forgeDir, "needle.txt"), "KEEP-NEEDLE\n");
+	fs.rmSync(worktreePath, { recursive: true, force: true });
+	fs.symlinkSync(forgeDir, worktreePath, "dir");
+}
+
+describe("removeOwnedLaunchWorktree", () => {
+	test("still removes a real directory worktree", () => {
+		const repo = initRepo("gjc-rm-real-repo-");
+		const bucket = makeTempDir("gjc-rm-real-bucket-");
+		const worktreePath = path.join(bucket, "wt");
+		git(repo, ["worktree", "add", "-q", "--detach", worktreePath, "HEAD"]);
+		fs.writeFileSync(path.join(worktreePath, "needle.txt"), "inside\n");
+
+		removeOwnedLaunchWorktree(detachedPlan(repo, worktreePath), ownedReceipt());
+
+		expect(fs.existsSync(worktreePath)).toBe(false);
+		expect(countRegisteredWorktrees(repo)).toBe(1);
+	});
+
+	test("still removes a worktree reached through an in-repo directory symlink", () => {
+		const repo = initRepo("gjc-rm-inside-link-repo-");
+		const inside = path.join(repo, "inside");
+		fs.mkdirSync(inside);
+		fs.symlinkSync(inside, path.join(repo, ".worktrees"), "dir");
+		const worktreePath = path.join(repo, ".worktrees", "wt");
+		git(repo, ["worktree", "add", "-q", "--detach", worktreePath, "HEAD"]);
+
+		removeOwnedLaunchWorktree(detachedPlan(repo, worktreePath), ownedReceipt());
+
+		expect(fs.existsSync(path.join(inside, "wt"))).toBe(false);
+		expect(fs.lstatSync(path.join(repo, ".worktrees")).isSymbolicLink()).toBe(true);
+		expect(countRegisteredWorktrees(repo)).toBe(1);
+	});
+
+	test("does not delete the referent when the worktree path is a symlink to a forged gitdir", () => {
+		const repo = initRepo("gjc-rm-forge-repo-");
+		const bucket = makeTempDir("gjc-rm-forge-bucket-");
+		const worktreePath = path.join(bucket, "wt");
+		git(repo, ["worktree", "add", "-q", "--detach", worktreePath, "HEAD"]);
+		const forge = makeTempDir("gjc-rm-forge-target-");
+		swapWorktreeForForgedGitdir(worktreePath, forge);
+
+		removeOwnedLaunchWorktree(detachedPlan(repo, worktreePath), ownedReceipt());
+
+		expect(fs.readFileSync(path.join(forge, "needle.txt"), "utf8")).toBe("KEEP-NEEDLE\n");
+		expect(fs.lstatSync(path.join(forge, ".git")).isFile()).toBe(true);
+		expect(fs.existsSync(worktreePath)).toBe(false);
+	});
+
+	test("still leaves an outside symlink when an in-repo bucket is retargeted", () => {
+		const repo = initRepo("gjc-rm-outlink-repo-");
+		const bucket = path.join(repo, ".worktrees");
+		fs.mkdirSync(bucket);
+		const worktreePath = path.join(bucket, "wt");
+		git(repo, ["worktree", "add", "-q", "--detach", worktreePath, "HEAD"]);
+		fs.rmSync(bucket, { recursive: true, force: true });
+		const outside = makeTempDir("gjc-rm-outlink-outside-");
+		const vault = makeTempDir("gjc-rm-outlink-vault-");
+		fs.writeFileSync(path.join(vault, "needle.txt"), "KEEP-NEEDLE\n");
+		const outsideLink = path.join(outside, "wt");
+		fs.symlinkSync(vault, outsideLink, "dir");
+		fs.symlinkSync(outside, bucket, "dir");
+
+		removeOwnedLaunchWorktree(detachedPlan(repo, worktreePath), ownedReceipt());
+
+		expect(fs.lstatSync(outsideLink).isSymbolicLink()).toBe(true);
+		expect(fs.readlinkSync(outsideLink)).toBe(vault);
+		expect(fs.readFileSync(path.join(vault, "needle.txt"), "utf8")).toBe("KEEP-NEEDLE\n");
+		expect(fs.lstatSync(bucket).isSymbolicLink()).toBe(true);
+	});
+
+	test("does not delete a directory outside the repo when an in-repo bucket symlink is retargeted", () => {
+		const repo = initRepo("gjc-rm-retarget-repo-");
+		const bucket = path.join(repo, ".worktrees");
+		fs.mkdirSync(bucket);
+		const worktreePath = path.join(bucket, "wt");
+		git(repo, ["worktree", "add", "-q", "--detach", worktreePath, "HEAD"]);
+		const gitFile = fs.readFileSync(path.join(worktreePath, ".git"), "utf8");
+		fs.rmSync(bucket, { recursive: true, force: true });
+		const outside = makeTempDir("gjc-rm-retarget-outside-");
+		const outsideWt = path.join(outside, "wt");
+		fs.mkdirSync(outsideWt);
+		fs.writeFileSync(path.join(outsideWt, ".git"), gitFile.endsWith("\n") ? gitFile : `${gitFile}\n`);
+		fs.writeFileSync(path.join(outsideWt, "needle.txt"), "KEEP-NEEDLE\n");
+		fs.symlinkSync(outside, bucket, "dir");
+
+		removeOwnedLaunchWorktree(detachedPlan(repo, worktreePath), ownedReceipt());
+
+		expect(fs.readFileSync(path.join(outsideWt, "needle.txt"), "utf8")).toBe("KEEP-NEEDLE\n");
+		expect(fs.lstatSync(bucket).isSymbolicLink()).toBe(true);
+	});
+});
+
+describe("commitPreWorktreeRestore symlink rollback", () => {
+	test("rolls back a symlinked worktree without deleting the forged referent", () => {
+		const repo = initRepo("gjc-rb-forge-repo-");
+		const bucket = makeTempDir("gjc-rb-forge-bucket-");
+		const worktreePath = path.join(bucket, "wt");
+		git(repo, ["worktree", "add", "-q", "--detach", worktreePath, "HEAD"]);
+		const forge = makeTempDir("gjc-rb-forge-target-");
+		swapWorktreeForForgedGitdir(worktreePath, forge);
+		const stashPath = path.join(bucket, ".gjc-pre-wt-wt");
+		fs.mkdirSync(stashPath, { recursive: true });
+		fs.writeFileSync(path.join(stashPath, "launcher.txt"), "config");
+
+		let message = "";
+		try {
+			commitPreWorktreeRestore(
+				{
+					restore: () => {
+						throw new Error("overlay exploded");
+					},
+					stashPath,
+				},
+				detachedPlan(repo, worktreePath),
+			);
+			throw new Error("expected commitPreWorktreeRestore to throw");
+		} catch (error) {
+			message = error instanceof Error ? error.message : String(error);
+		}
+
+		expect(message).toMatch(/worktree_gjc_restore_failed/);
+		expect(fs.readFileSync(path.join(forge, "needle.txt"), "utf8")).toBe("KEEP-NEEDLE\n");
+		expect(fs.existsSync(path.join(stashPath, "launcher.txt"))).toBe(true);
+	});
+});

package/src/gjc-runtime/launch-worktree.ts

@@ -244,9 +244,34 @@ function resolveWorktreeBucket(repoRoot: string): string {
 	return resolveWorktreeBucketForPath(repoRoot, trustedWorktreeBucketEnv(process.env), os.homedir(), path);
 }
 
+function throwIfBucketRealpathEscapesRepository(repoRoot: string, bucketPath: string): void {
+	let realBucket: string;
+	try {
+		realBucket = fs.realpathSync(bucketPath);
+	} catch (error) {
+		// A missing bucket is created later. A dangling link is classified by inspectBucketDir.
+		if (fileSystemErrorCode(error) === "ENOENT") return;
+		throw error;
+	}
+	const relativeReal = path.relative(fs.realpathSync(repoRoot), realBucket);
+	if (relativeReal.startsWith(`..${path.sep}`) || relativeReal === ".." || path.isAbsolute(relativeReal)) {
+		throw new Error(
+			[
+				"worktree_bucket_escapes_repository",
+				"The GJC launch worktree bucket resolves outside the repository.",
+				`Path: ${formatBucketPath(bucketPath)}`,
+				"Safe remediation: replace the path with a real directory inside the repository, or set GJC_WORKTREE_DIR to a directory outside the repository. GJC did not create a worktree.",
+			].join("\n"),
+		);
+	}
+}
+
 function ensureRepositoryBucketIgnored(repoRoot: string, bucketPath: string): void {
 	const relativeBucket = path.relative(repoRoot, bucketPath);
+	// Lexical paths outside the repo are the operator override and stay allowed.
 	if (relativeBucket.startsWith(`..${path.sep}`) || relativeBucket === ".." || path.isAbsolute(relativeBucket)) return;
+	// git check-ignore accepts a gitignored symlink without looking at its target.
+	throwIfBucketRealpathEscapesRepository(repoRoot, bucketPath);
 	const ignoreProbe = path.join(relativeBucket, ".gjc-worktree-probe");
 	for (const candidate of [relativeBucket, ignoreProbe]) {
 		const result = Bun.spawnSync(["git", "check-ignore", "--quiet", "--", candidate], {
@@ -702,17 +727,87 @@ function tryRestore(restore: () => void): void {
 	}
 }
 
-/** Best-effort removal of a worktree GJC just created, used when a later step must roll it back. */
-function rollbackCreatedWorktree(plan: GjcLaunchWorktreePlan): void {
+function lexicalPathInsideRepository(repoRoot: string, targetPath: string): boolean {
+	const relative = path.relative(path.resolve(repoRoot), path.resolve(targetPath));
+	return !(relative.startsWith(`..${path.sep}`) || relative === ".." || path.isAbsolute(relative));
+}
+
+function realpathEscapesRepository(repoRoot: string, targetPath: string): boolean {
+	let realTarget: string;
+	try {
+		realTarget = fs.realpathSync(targetPath);
+	} catch (error) {
+		// A missing path is not an escape. Anything else is not safe to hand to remove --force.
+		if (fileSystemErrorCode(error) === "ENOENT") return false;
+		return true;
+	}
+	const relativeReal = path.relative(fs.realpathSync(repoRoot), realTarget);
+	return relativeReal.startsWith(`..${path.sep}`) || relativeReal === ".." || path.isAbsolute(relativeReal);
+}
+
+function pruneWorktreeRegistration(repoRoot: string): void {
 	try {
-		runGit(plan.repoRoot, ["worktree", "remove", "--force", plan.worktreePath]);
+		runGit(repoRoot, ["worktree", "prune"]);
 	} catch {
+		// Best-effort. Callers report their own failure.
+	}
+}
+
+/**
+ * Remove a launch worktree this process just created.
+ *
+ * `git worktree remove --force` follows a symlink and deletes the referent when a
+ * copied `.git` gitdir file passes validation. Unlink that link only when its
+ * parent stays inside the repository, or when the path is an explicit external
+ * worktree. An in-repo path whose parent resolves outside the repository is
+ * left untouched. A real directory is still removed with `--force`.
+ */
+function removeCreatedWorktree(repoRoot: string, worktreePath: string): void {
+	let stat: fs.Stats | undefined;
+	try {
+		stat = fs.lstatSync(worktreePath);
+	} catch (error) {
+		if (fileSystemErrorCode(error) !== "ENOENT") {
+			pruneWorktreeRegistration(repoRoot);
+			return;
+		}
+	}
+	// A retargeted in-repo bucket can place this path's parent outside the repository.
+	// Do not unlink that outside entry. An explicit external worktree is not this case.
+	if (
+		lexicalPathInsideRepository(repoRoot, worktreePath) &&
+		realpathEscapesRepository(repoRoot, path.dirname(worktreePath))
+	) {
+		pruneWorktreeRegistration(repoRoot);
+		return;
+	}
+	if (stat?.isSymbolicLink()) {
 		try {
-			runGit(plan.repoRoot, ["worktree", "prune"]);
+			fs.unlinkSync(worktreePath);
 		} catch {
-			// Best-effort rollback; the restore failure below is the actionable error.
+			// The link may already be gone.
 		}
+		pruneWorktreeRegistration(repoRoot);
+		return;
+	}
+	if (
+		stat?.isDirectory() &&
+		lexicalPathInsideRepository(repoRoot, worktreePath) &&
+		realpathEscapesRepository(repoRoot, worktreePath)
+	) {
+		pruneWorktreeRegistration(repoRoot);
+		return;
 	}
+	try {
+		runGit(repoRoot, ["worktree", "remove", "--force", worktreePath]);
+	} catch {
+		pruneWorktreeRegistration(repoRoot);
+	}
+}
+
+/** Best-effort removal of a worktree GJC just created, used when a later step must roll it back. */
+function rollbackCreatedWorktree(plan: GjcLaunchWorktreePlan): void {
+	removeCreatedWorktree(plan.repoRoot, plan.worktreePath);
 }
 
 /**
@@ -1205,15 +1300,7 @@ export function removeOwnedLaunchWorktree(
 	receipt: { created: boolean; reused: boolean; createdBranch: boolean },
 ): void {
 	if (!receipt.created || receipt.reused) return;
-	try {
-		runGit(plan.repoRoot, ["worktree", "remove", "--force", plan.worktreePath]);
-	} catch {
-		try {
-			runGit(plan.repoRoot, ["worktree", "prune"]);
-		} catch {
-			// Proof stays on the ledger; leftover classify is best-effort after abort.
-		}
-	}
+	removeCreatedWorktree(plan.repoRoot, plan.worktreePath);
 	if (receipt.createdBranch && plan.branchName) {
 		try {
 			runGit(plan.repoRoot, ["branch", "-D", plan.branchName]);

package/src/gjc-runtime/managed-owner-admission.ts

@@ -2,8 +2,10 @@ import { Buffer } from "node:buffer";
 import * as crypto from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { canonicalEnvKey, type ProjectEnvSnapshot, projectEnvSnapshot } from "@gajae-code/utils/env-file";
 import type { ManagedOwnerBinding, ManagedOwnerSigabrtReceipt } from "./managed-owner-supervisor";
 import { assertSafePathComponent } from "./session-layout";
+import { trustedCoordinatorEnv } from "./sidecar-bootstrap-env";
 import { lifecyclePaths } from "./tmux-owner-isolation";
 import {
 	persistUltragoalRecoveryDecision,
@@ -23,6 +25,48 @@ export const MANAGED_OWNER_PREDECESSOR_GENERATION_ENV = "GJC_MANAGED_OWNER_PREDE
 export const MANAGED_OWNER_PREDECESSOR_RUN_ID_ENV = "GJC_MANAGED_OWNER_PREDECESSOR_RUN_ID";
 export const MANAGED_OWNER_PREDECESSOR_INCARNATION_ENV = "GJC_MANAGED_OWNER_PREDECESSOR_INCARNATION";
 export const MANAGED_OWNER_TRANSCRIPT_PATH_ENV = "GJC_MANAGED_OWNER_TRANSCRIPT_PATH";
+const MANAGED_OWNER_SESSION_FILE_ENV = "GJC_SESSION_FILE";
+
+/**
+ * Operator environment only. A project dotenv value, including a dynamic
+ * declaration, must not choose the recovery transcript. A static
+ * `GJC_SESSION_FILE` declaration is the same source: the launcher copies it
+ * into the transcript variable. The operator bytes are kept, including
+ * surrounding whitespace; provenance is not path normalization.
+ */
+function operatorOwnedEnvValue(name: string, raw: string | undefined, snapshot: ProjectEnvSnapshot): string {
+	if (!raw) return "";
+	const key = canonicalEnvKey(name);
+	const declared = snapshot.values[key];
+	if (declared !== undefined && (snapshot.dynamic.has(key) || declared === raw)) return "";
+	const verdict = trustedCoordinatorEnv(name, { [name]: raw }, snapshot);
+	if (verdict === undefined && raw.trim().length > 0) return "";
+	return raw;
+}
+
+export function trustedManagedOwnerTranscriptPath(env: NodeJS.ProcessEnv = process.env, cwd = process.cwd()): string {
+	const snapshot = projectEnvSnapshot(cwd);
+	const raw = operatorOwnedEnvValue(
+		MANAGED_OWNER_TRANSCRIPT_PATH_ENV,
+		env[MANAGED_OWNER_TRANSCRIPT_PATH_ENV],
+		snapshot,
+	);
+	if (!raw) return "";
+	const sessionKey = canonicalEnvKey(MANAGED_OWNER_SESSION_FILE_ENV);
+	if (snapshot.dynamic.has(sessionKey)) return raw;
+	const declared = snapshot.values[sessionKey];
+	if (declared !== undefined && raw === declared) return "";
+	return raw;
+}
+
+/** Session file forwarded to a replacement child. Same provenance rule. */
+export function trustedManagedOwnerLaunchSessionFile(env: NodeJS.ProcessEnv, cwd: string): string {
+	return operatorOwnedEnvValue(
+		MANAGED_OWNER_SESSION_FILE_ENV,
+		env[MANAGED_OWNER_SESSION_FILE_ENV],
+		projectEnvSnapshot(cwd),
+	);
+}
 
 export interface ManagedOwnerRecoveryContext {
 	root: string;
@@ -295,7 +339,7 @@ export async function admitManagedOwnerBeforeCli(): Promise<ManagedOwnerAdmissio
 		},
 		receipt,
 		admission,
-		transcriptPath: process.env[MANAGED_OWNER_TRANSCRIPT_PATH_ENV] ?? "",
+		transcriptPath: trustedManagedOwnerTranscriptPath(),
 	});
 	await persistUltragoalRecoveryDecision({
 		cwd: process.cwd(),
@@ -330,7 +374,7 @@ export async function completeManagedOwnerRecovery(
 		binding: recoveryBinding,
 		receipt: context.receipt,
 		admission: context.admission,
-		transcriptPath: process.env[MANAGED_OWNER_TRANSCRIPT_PATH_ENV] ?? "",
+		transcriptPath: trustedManagedOwnerTranscriptPath(),
 		protectedPaths: context.decision.snapshot?.protectedPaths,
 		sanctionedDeltas: context.decision.snapshot?.sanctionedDeltas,
 		absentArtifacts: context.decision.snapshot?.absentArtifacts,