@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/gjc-runtime/state-runtime.ts

@@ -1896,10 +1896,10 @@ const EXECUTION_APPROVAL_TRANSCRIPT_MAX_BYTES = 128 * 1024 * 1024;
 const DEEP_INTERVIEW_EXECUTION_APPROVAL_RECORD_MAX_BYTES = 16 * 1024;
 const DEEP_INTERVIEW_EXECUTION_APPROVAL_ID_MAX_LENGTH = 256;
 
+// The boundary binds approval to transcript content (prefix length/sha256, leaf, Ask call), not to
+// the file's inode: SessionManager persists full rewrites by atomic rename, which replaces the inode.
 export interface ExecutionApprovalTranscriptBoundary {
 	byte_length: number;
-	device: string;
-	inode: string;
 	leaf_id: string | null;
 	approval_tool_call_id: string;
 }
@@ -1909,10 +1909,6 @@ function isExecutionApprovalTranscriptBoundary(value: unknown): value is Executi
 		isPlainObject(value) &&
 		Number.isSafeInteger(value.byte_length) &&
 		(value.byte_length as number) > 0 &&
-		typeof value.device === "string" &&
-		/^\d+$/.test(value.device) &&
-		typeof value.inode === "string" &&
-		/^\d+$/.test(value.inode) &&
 		(value.leaf_id === null || isExecutionApprovalId(value.leaf_id)) &&
 		isExecutionApprovalId(value.approval_tool_call_id)
 	);
@@ -2037,8 +2033,6 @@ export async function captureExecutionApprovalTranscriptBoundary(
 		throw new StateCommandError(2, "execution approval transcript boundary lacks the current Ask call");
 	return {
 		byte_length: Buffer.byteLength(text),
-		device: after.dev.toString(),
-		inode: after.ino.toString(),
 		leaf_id: prefix.leaf,
 		approval_tool_call_id: approvalToolCallId,
 	};
@@ -2062,13 +2056,8 @@ export async function assertExecutionApprovalTranscriptBoundary(
 	const after = await fs.lstat(transcriptPath, { bigint: true });
 	if ((await fs.realpath(transcriptPath)) !== path.resolve(transcriptPath))
 		throw new StateCommandError(2, "execution approval transcript path is not canonical");
-	if (
-		!sameBoundedFileIdentity(before, after) ||
-		after.dev.toString() !== boundary.device ||
-		after.ino.toString() !== boundary.inode ||
-		text === undefined
-	)
-		throw new StateCommandError(2, "execution approval transcript identity changed");
+	if (!sameBoundedFileIdentity(before, after) || text === undefined)
+		throw new StateCommandError(2, "execution approval transcript changed while it was read");
 	const bytes = Buffer.from(text);
 	const prefix = bytes.subarray(0, boundary.byte_length);
 	if (prefix.length !== boundary.byte_length || createHash("sha256").update(prefix).digest("hex") !== transcriptSha256)
@@ -3222,6 +3211,21 @@ async function assertSanctionedExecutionApprovalAudit(
 	)
 		throw new StateCommandError(2, "deep-interview execution approval lacks sanctioned transition provenance");
 
+	// The approval index is written only after the append-only ledger entry.
+	// A pending journal means that append did not finish, so the index must
+	// not authorize execution handoff.
+	let approvalJournal: WorkflowTransactionJournal | undefined;
+	try {
+		approvalJournal = await readWorkflowTransactionJournal(cwd, sessionId, mutationId);
+	} catch (error) {
+		throw new StateCommandError(
+			2,
+			`failed to read execution approval journal: ${error instanceof Error ? error.message : String(error)}`,
+		);
+	}
+	if (approvalJournal?.status === "pending")
+		throw new StateCommandError(2, "deep-interview execution approval journal is incomplete");
+
 	const indexedApprovalPath = path.join(sessionStateDir(cwd, sessionId), "deep-interview-approval-audit.json");
 	let indexedRaw = "";
 	try {
@@ -5067,8 +5071,6 @@ async function appendExecutionApprovalAudit(
 	} = {},
 ): Promise<void> {
 	const entry = buildExecutionApprovalAuditEntry(options);
-	await writeExecutionApprovalIndex(options, entry);
-	await hooks.afterIndex?.();
 	const filePath = auditPath(options.cwd, options.sessionId);
 	await withWorkflowStateLock(
 		filePath,
@@ -5089,6 +5091,8 @@ async function appendExecutionApprovalAudit(
 		},
 		{ cwd: options.cwd },
 	);
+	await writeExecutionApprovalIndex(options, entry);
+	await hooks.afterIndex?.();
 	await hooks.afterAudit?.();
 }
 
@@ -5296,8 +5300,6 @@ async function handleApproveExecutionRecordLocked(
 				indexedMatches = isPlainObject(parsed) && JSON.stringify(parsed) === JSON.stringify(expectedApprovalEntry);
 			} catch {}
 		}
-		if (!indexedMatches) await writeExecutionApprovalIndex(approvalOptions, expectedApprovalEntry);
-		recoverySteps.add("approval-index");
 		let approvalAuditOffset = pendingJournal.approval_audit_offset;
 		if (!recoverySteps.has("approval-audit")) {
 			approvalAuditOffset = await appendExecutionApprovalAuditIdempotent(
@@ -5312,6 +5314,8 @@ async function handleApproveExecutionRecordLocked(
 			);
 			recoverySteps.add("approval-audit");
 		}
+		if (!indexedMatches) await writeExecutionApprovalIndex(approvalOptions, expectedApprovalEntry);
+		recoverySteps.add("approval-index");
 		await updateWorkflowTransactionJournal(cwd, selectors.gjcSessionId, existingReceipt.mutation_id, {
 			steps: [...recoverySteps],
 			approval_audit_offset: approvalAuditOffset,

package/src/gjc-runtime/state-writer.ts

@@ -1158,10 +1158,113 @@ export async function updateJsonAtomic<T = unknown>(
 	);
 }
 
+async function assertAppendRegularFile(filePath: string): Promise<void> {
+	try {
+		const stat = await fs.lstat(filePath);
+		if (stat.isSymbolicLink() || !stat.isFile()) throw new Error("state append path is not a regular file");
+	} catch (error) {
+		if (!isErrno(error, "ENOENT")) throw error;
+	}
+}
+
+/**
+ * Append bytes the same way `appendAuditEntry` opens its log: mode 0600, `O_NOFOLLOW`
+ * when the path already exists, and `O_EXCL` when it does not. An existing mode 0666
+ * file, and any other group or other permission bits, is tightened to 0600 before the write.
+ */
+async function tightenReadOnlyAppendMode(filePath: string): Promise<void> {
+	if (process.platform === "win32") return;
+	const noFollow = fsConstants.O_NOFOLLOW ?? 0;
+	const initialStat = await fs.lstat(filePath, { bigint: true });
+	if (initialStat.isSymbolicLink() || !initialStat.isFile())
+		throw new Error("state append path is not a regular file");
+	// A duplicate idempotent append must not require a writable file. Owner-only
+	// modes such as 0400 stay as they are; only group or other bits are tightened.
+	const handle = await fs.open(filePath, fsConstants.O_RDONLY | noFollow);
+	try {
+		const openedStat = await handle.stat({ bigint: true });
+		const pathStat = await fs.lstat(filePath, { bigint: true });
+		const sameObject = (left: nodeFs.BigIntStats, right: nodeFs.BigIntStats) =>
+			left.dev === right.dev && left.ino === right.ino && left.nlink === right.nlink;
+		if (
+			openedStat.isSymbolicLink() ||
+			!openedStat.isFile() ||
+			pathStat.isSymbolicLink() ||
+			!pathStat.isFile() ||
+			!sameObject(initialStat, openedStat) ||
+			!sameObject(openedStat, pathStat)
+		)
+			throw new Error("state append path identity changed before append");
+		if ((Number(openedStat.mode) & 0o077) === 0) return;
+		await handle.chmod(0o600);
+		const tightened = await handle.stat({ bigint: true });
+		if ((Number(tightened.mode) & 0o777) !== 0o600)
+			throw new Error("state append path could not be tightened to mode 0600");
+	} finally {
+		await handle.close();
+	}
+}
+
+async function appendOwnerOnlyText(filePath: string, text: string): Promise<void> {
+	await fs.mkdir(path.dirname(filePath), { recursive: true });
+	await assertAppendRegularFile(filePath);
+	const noFollow = process.platform === "win32" ? 0 : (fsConstants.O_NOFOLLOW ?? 0);
+	let handle: fs.FileHandle | undefined;
+	let initialStat: nodeFs.BigIntStats | undefined;
+	// O_EXCL matches appendAuditEntry for a missing path. Concurrent appends can
+	// create the same file together, so an EEXIST loser retries the existing-file
+	// open, which carries O_NOFOLLOW and will not follow a symlink.
+	for (let attempt = 0; attempt < 2; attempt++) {
+		initialStat = undefined;
+		try {
+			initialStat = await fs.lstat(filePath, { bigint: true });
+			if (initialStat.isSymbolicLink() || !initialStat.isFile())
+				throw new Error("state append path is not a regular file");
+		} catch (error) {
+			if (!isErrno(error, "ENOENT")) throw error;
+		}
+		const flags = initialStat
+			? fsConstants.O_WRONLY | fsConstants.O_APPEND | noFollow
+			: fsConstants.O_WRONLY | fsConstants.O_APPEND | fsConstants.O_CREAT | fsConstants.O_EXCL;
+		try {
+			handle = await fs.open(filePath, flags, 0o600);
+			break;
+		} catch (error) {
+			if (isErrno(error, "ELOOP")) throw new Error("state append path is not a regular file");
+			if (initialStat === undefined && isErrno(error, "EEXIST") && attempt === 0) continue;
+			throw error;
+		}
+	}
+	if (!handle) throw new Error("state append path identity changed before append");
+	try {
+		const openedStat = await handle.stat({ bigint: true });
+		const pathStat = await fs.lstat(filePath, { bigint: true });
+		const sameObject = (left: nodeFs.BigIntStats, right: nodeFs.BigIntStats) =>
+			left.dev === right.dev && left.ino === right.ino && left.nlink === right.nlink;
+		if (
+			openedStat.isSymbolicLink() ||
+			!openedStat.isFile() ||
+			pathStat.isSymbolicLink() ||
+			!pathStat.isFile() ||
+			(initialStat !== undefined && !sameObject(initialStat, openedStat)) ||
+			!sameObject(openedStat, pathStat)
+		)
+			throw new Error("state append path identity changed before append");
+		if (process.platform !== "win32" && (Number(openedStat.mode) & 0o077) !== 0) {
+			await handle.chmod(0o600);
+			const tightened = await handle.stat({ bigint: true });
+			if ((Number(tightened.mode) & 0o777) !== 0o600)
+				throw new Error("state append path could not be tightened to mode 0600");
+		}
+		await handle.writeFile(text, "utf-8");
+	} finally {
+		await handle?.close();
+	}
+}
+
 export async function appendJsonl(targetPath: string, entry: unknown, options?: StateWriterOptions): Promise<string> {
 	const filePath = resolveGjcTarget(targetPath, cwdForOptions(options));
-	await fs.mkdir(path.dirname(filePath), { recursive: true });
-	await fs.appendFile(filePath, `${JSON.stringify(entry)}\n`, "utf-8");
+	await appendOwnerOnlyText(filePath, `${JSON.stringify(entry)}\n`);
 	await maybeAudit(filePath, options);
 	return filePath;
 }
@@ -1259,12 +1362,14 @@ export async function appendJsonlIdempotent(
 	return lockResolvedWorkflowTarget(
 		filePath,
 		async () => {
+			await assertAppendRegularFile(filePath);
 			const existing = await readJsonlEntries(filePath);
 			const duplicate = findJsonlDuplicate(existing, entry, options);
 			if (duplicate !== undefined) {
+				await tightenReadOnlyAppendMode(filePath);
 				return { path: filePath, appended: false, duplicate };
 			}
-			await fs.appendFile(filePath, `${JSON.stringify(entry)}\n`, "utf-8");
+			await appendOwnerOnlyText(filePath, `${JSON.stringify(entry)}\n`);
 			await maybeAudit(filePath, options);
 			return { path: filePath, appended: true };
 		},
@@ -1274,8 +1379,7 @@ export async function appendJsonlIdempotent(
 
 export async function appendText(targetPath: string, text: string, options?: StateWriterOptions): Promise<string> {
 	const filePath = resolveGjcTarget(targetPath, cwdForOptions(options));
-	await fs.mkdir(path.dirname(filePath), { recursive: true });
-	await fs.appendFile(filePath, text, "utf-8");
+	await appendOwnerOnlyText(filePath, text);
 	await maybeAudit(filePath, options);
 	return filePath;
 }

package/src/gjc-runtime/tmux-sessions.ts

@@ -4,6 +4,8 @@ import * as fsSync from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type { Process } from "@gajae-code/natives";
+import { startupProjectEnvSnapshot } from "@gajae-code/utils/env";
+import { canonicalEnvKey, type ProjectEnvSnapshot, projectEnvSnapshot } from "@gajae-code/utils/env-file";
 import { nativeProcessBindings } from "@gajae-code/utils/native-process";
 import { managedSecurityFailureClassification } from "../session/internal/managed-session-storage";
 import { readLinuxProcStartTime, readLinuxProcStartTimeSync } from "./linux-proc";
@@ -23,6 +25,7 @@ import {
 	GJC_TMUX_OWNER_SERVER_KEY_ENV,
 	GJC_TMUX_OWNER_STATE_DIR_ENV,
 } from "./session-state-sidecar";
+import { trustedCoordinatorEnv } from "./sidecar-bootstrap-env";
 import {
 	assertGjcTmuxMutationAuthoritySync,
 	bindGjcTmuxProviderAuthority,
@@ -247,6 +250,81 @@ export function __setMutationServerProofForTests(
 	mutationServerProofTestDependency = dependency;
 }
 
+const TMUX_LAUNCH_IDENTITY_ENV_NAMES = [
+	"GJC_SESSION_ID",
+	GJC_COORDINATOR_SESSION_ID_ENV,
+	GJC_COORDINATOR_SESSION_STATE_FILE_ENV,
+	"GJC_TMUX_SESSION",
+] as const;
+
+/**
+ * Drop project-dotenv copies of the tmux session name, coordinator id, and
+ * state-file path. A pin is kept only when every snapshot accepts it, so a
+ * declaration Bun loaded before `chdir` is refused even if the launch cwd no
+ * longer contains that file. Acceptance uses the shared helper, but the
+ * original string stays: callers trim at use, and a later check must see the
+ * same value that was accepted.
+ */
+export function trustedTmuxLaunchIdentityEnv(
+	env: NodeJS.ProcessEnv,
+	snapshots: readonly ProjectEnvSnapshot[],
+): NodeJS.ProcessEnv {
+	const denied: string[] = [];
+	for (const name of TMUX_LAUNCH_IDENTITY_ENV_NAMES) {
+		if (!env[name]) continue;
+		for (const snapshot of snapshots) {
+			if (trustedCoordinatorEnv(name, env, snapshot) === undefined) {
+				denied.push(name);
+				break;
+			}
+		}
+	}
+	if (denied.length === 0) return env;
+	const next: NodeJS.ProcessEnv = { ...env };
+	for (const name of denied) delete next[name];
+	return next;
+}
+
+export function tmuxLaunchIdentityEnv(env: NodeJS.ProcessEnv, cwd: string): NodeJS.ProcessEnv {
+	return trustedTmuxLaunchIdentityEnv(env, [projectEnvSnapshot(cwd), startupProjectEnvSnapshot()]);
+}
+
+/**
+ * Session id the launched child must see. A trusted pin is passed through.
+ * A rejected project pin is replaced by the same fallback the launch plan uses
+ * for the session root, which also stops Bun from reloading that dotenv value
+ * (`GJC_TMUX_LAUNCHED=1` skips the planner filter). An omitted id stays omitted.
+ */
+export function resolvedChildGjcSessionId(input: {
+	trusted: string | undefined;
+	inherited: string | undefined;
+	projectDeclared: boolean;
+	fallback: string;
+}): string | undefined {
+	const trusted = input.trusted?.trim();
+	if (trusted) return trusted;
+	if (!input.inherited?.trim() && !input.projectDeclared) return undefined;
+	const fallback = input.fallback.trim();
+	return fallback.length > 0 ? fallback : undefined;
+}
+
+export function childGjcSessionIdAssignment(
+	env: NodeJS.ProcessEnv,
+	identityEnv: NodeJS.ProcessEnv,
+	cwd: string,
+	fallbackSessionId: string,
+): Record<string, string> {
+	const snapshot = projectEnvSnapshot(cwd);
+	const key = canonicalEnvKey("GJC_SESSION_ID");
+	const value = resolvedChildGjcSessionId({
+		trusted: identityEnv.GJC_SESSION_ID,
+		inherited: env.GJC_SESSION_ID,
+		projectDeclared: snapshot.values[key] !== undefined || snapshot.dynamic.has(key),
+		fallback: fallbackSessionId,
+	});
+	return value === undefined ? {} : { GJC_SESSION_ID: value };
+}
+
 function psmuxAuthorityFromEnv(env: NodeJS.ProcessEnv): ProviderAuthority | null {
 	const stateDir = env[GJC_TMUX_OWNER_STATE_DIR_ENV]?.trim();
 	const sessionId = env[GJC_COORDINATOR_SESSION_ID_ENV]?.trim();
@@ -515,11 +593,14 @@ function canonicalProviderStateDirs(cwd: string): string[] {
 }
 
 function psmuxAuthorityEnvironments(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv[] {
-	const explicitAuthority = psmuxAuthorityFromEnv(env);
+	const identityEnv = tmuxLaunchIdentityEnv(env, process.cwd());
+	const explicitAuthority = psmuxAuthorityFromEnv(identityEnv);
 	if (explicitAuthority) return [environmentForProviderAuthority(env, explicitAuthority)];
 	const explicitStateDir =
-		env[GJC_TMUX_OWNER_STATE_DIR_ENV]?.trim() ??
-		(env[GJC_COORDINATOR_SESSION_STATE_FILE_ENV] ? path.dirname(env[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]) : "");
+		identityEnv[GJC_TMUX_OWNER_STATE_DIR_ENV]?.trim() ??
+		(identityEnv[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]
+			? path.dirname(identityEnv[GJC_COORDINATOR_SESSION_STATE_FILE_ENV])
+			: "");
 	const ambient = resolveGjcTmuxBinary({ env });
 	if (gjcTmuxAuthorityPlatform() === "win32") {
 		const ambientAvailable = path.isAbsolute(ambient.command)
@@ -669,17 +750,15 @@ export function createGjcTmuxSession(
 	if (launch && !validManagedLaunchSpec(launch, platform)) throw new Error("gjc_tmux_managed_launch_spec_invalid");
 	const provider = resolveGjcTmuxProviderContext({ env, platform });
 	const tmuxCommand = provider.command;
-	const launchEnvironment = launch ? { ...env, GJC_TMUX_SESSION: launch.childSessionId } : env;
-	const sessionName = buildGjcTmuxSessionName(launchEnvironment);
 	const cwd = launch?.cwd ?? process.cwd();
-	const sessionId = launch?.childSessionId ?? (env[GJC_COORDINATOR_SESSION_ID_ENV]?.trim() || sessionName);
+	const identityEnv = tmuxLaunchIdentityEnv(env, cwd);
+	const launchEnvironment = launch ? { ...identityEnv, GJC_TMUX_SESSION: launch.childSessionId } : identityEnv;
+	const sessionName = buildGjcTmuxSessionName(launchEnvironment);
+	const sessionId = launch?.childSessionId ?? (identityEnv[GJC_COORDINATOR_SESSION_ID_ENV]?.trim() || sessionName);
+	const filteredGjcSessionId = identityEnv.GJC_SESSION_ID?.trim() || sessionId;
 	const stateFile =
-		(!launch ? env[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]?.trim() : undefined) ||
-		tmuxRuntimeSessionPath(
-			cwd,
-			launch?.childSessionId ?? (env.GJC_SESSION_ID?.trim() || sessionId),
-			buildGjcTmuxSessionSlug(sessionName),
-		);
+		(!launch ? identityEnv[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]?.trim() : undefined) ||
+		tmuxRuntimeSessionPath(cwd, launch?.childSessionId ?? filteredGjcSessionId, buildGjcTmuxSessionSlug(sessionName));
 	const stateDir = (platform === "win32" ? path.win32 : path).dirname(stateFile);
 	const generation = crypto.randomUUID();
 	const authority = bindGjcTmuxProviderAuthority(provider, { stateDir, sessionId, generation });
@@ -690,6 +769,7 @@ export function createGjcTmuxSession(
 		[GJC_TMUX_OWNER_SERVER_KEY_ENV]: tmuxCommand,
 		[GJC_COORDINATOR_SESSION_ID_ENV]: sessionId,
 		[GJC_COORDINATOR_SESSION_STATE_FILE_ENV]: stateFile,
+		...childGjcSessionIdAssignment(env, identityEnv, cwd, filteredGjcSessionId),
 		...(launch
 			? {
 					[MANAGED_OWNER_RUN_ID_ENV]: crypto.randomUUID(),
@@ -699,7 +779,7 @@ export function createGjcTmuxSession(
 			: {}),
 	};
 	const childEnvironment: Record<string, string> = { ...(launch?.env ?? {}), ...managedEnvironment };
-	const executionEnv = { ...env, ...managedEnvironment };
+	const executionEnv = { ...identityEnv, ...managedEnvironment };
 	const shellQuote = (value: string): string => `'${value.replace(/'/g, `'\\''`)}'`;
 	const command =
 		platform === "win32"

package/src/gjc-runtime/ultragoal-change-set.ts

@@ -128,15 +128,30 @@ async function hashAddedFiles(cwd: string, paths: readonly UltragoalChangeSetPat
 
 export async function spawnText(
 	command: string[],
-	options: { cwd: string; timeoutMs?: number },
+	options: { cwd: string; timeoutMs?: number; stdin?: string },
 ): Promise<{ ok: boolean; stdout: string; stderr: string }> {
 	try {
-		const proc = Bun.spawn(command, { cwd: options.cwd, stdout: "pipe", stderr: "pipe" });
+		const proc = Bun.spawn(command, { cwd: options.cwd, stdin: "pipe", stdout: "pipe", stderr: "pipe" });
 		const timeout = setTimeout(() => proc.kill(), options.timeoutMs ?? 5000);
+		// Drain both pipes while the stdin write runs: a child that never reads
+		// stdin blocks the write, and a child that fills stdout before draining
+		// stdin blocks the read.
+		const stdinWrite = (async () => {
+			const stdin = proc.stdin;
+			if (!stdin || options.stdin === undefined) return;
+			try {
+				stdin.write(options.stdin);
+				await stdin.end();
+			} catch {
+				// The child closed stdin or the timer killed it; the exit code
+				// already reports the failure.
+			}
+		})();
 		const [stdoutBytes, stderrBytes, exitCode] = await Promise.all([
 			new Response(proc.stdout).arrayBuffer(),
 			new Response(proc.stderr).arrayBuffer(),
 			proc.exited,
+			stdinWrite,
 		]);
 		clearTimeout(timeout);
 		let stdout: string;
@@ -152,6 +167,37 @@ export async function spawnText(
 	}
 }
 
+/**
+ * Derive the empty tree object ID for the given repository, which depends on the
+ * repository's object format (SHA-1 vs SHA-256). A repository with no commits has
+ * no refs and no merge base, so the empty tree is the only authoritative baseline:
+ * every tracked, staged, and untracked file is an addition on top of it.
+ *
+ * @param cwd The repository root directory
+ * @returns The empty tree object ID (format-specific), or the SHA-1 ID if derivation fails
+ */
+async function getEmptyTreeId(cwd: string): Promise<string> {
+	// Compute the empty tree object ID by hashing an empty tree.
+	// This respects the repository's object format (SHA-1 or SHA-256).
+	const result = await spawnText(["git", "hash-object", "-t", "tree", "--stdin"], {
+		cwd,
+		timeoutMs: 3000,
+		stdin: "", // Empty input for empty tree
+	});
+	if (result.ok && result.stdout.trim()) {
+		return result.stdout.trim();
+	}
+	// Fallback to SHA-1 empty tree ID if derivation fails
+	// (e.g., git command not available, permission denied, etc.)
+	return "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+}
+
+/**
+ * The canonical empty tree object for SHA-1 repositories. Use getEmptyTreeId()
+ * to derive the format-specific ID for a given repository.
+ */
+export const GIT_EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+
 export async function resolveGitBase(cwd: string, branch?: string): Promise<string> {
 	if (branch) {
 		const exists = await spawnText(["git", "rev-parse", "--verify", branch], { cwd, timeoutMs: 3000 });
@@ -163,11 +209,31 @@ export async function resolveGitBase(cwd: string, branch?: string): Promise<stri
 		// and mis-attributes other people's changes to this story (e.g. falsely
 		// tripping change-scoped gates). Among existing candidates, pick the one
 		// whose merge-base with HEAD is closest to HEAD (fewest commits ahead).
-		const candidates = ["origin/dev", "dev", "origin/main", "origin/master", "main", "master"];
+		const candidates = [
+			"origin/dev",
+			"dev",
+			"origin/develop",
+			"develop",
+			"origin/main",
+			"origin/master",
+			"main",
+			"master",
+		];
+		const currentBranch = await spawnText(["git", "symbolic-ref", "--quiet", "HEAD"], { cwd, timeoutMs: 3000 });
+		const currentRef = currentBranch.ok ? currentBranch.stdout.trim() : undefined;
 		let best: { ref: string; ahead: number } | undefined;
+
 		for (const candidate of candidates) {
-			const exists = await spawnText(["git", "rev-parse", "--verify", candidate], { cwd, timeoutMs: 3000 });
+			const exists = await spawnText(["git", "rev-parse", "--symbolic-full-name", "--verify", candidate], {
+				cwd,
+				timeoutMs: 3000,
+			});
 			if (!exists.ok) continue;
+			// Exclude only the checked-out local ref, not distinct refs at the same
+			// commit or remote-tracking refs with the same branch name. Comparing
+			// the checked-out ref to HEAD hides committed work as a complete empty
+			// capture; without an independent baseline, resolution must fail closed.
+			if (currentRef && exists.stdout.trim() === currentRef) continue;
 			const mergeBase = await spawnText(["git", "merge-base", "HEAD", candidate], { cwd, timeoutMs: 3000 });
 			if (!mergeBase.ok || !mergeBase.stdout.trim()) continue;
 			const count = await spawnText(["git", "rev-list", "--count", `${mergeBase.stdout.trim()}..HEAD`], {
@@ -285,16 +351,26 @@ export async function computeCheckpointChangeSet(cwd: string): Promise<Ultragoal
 	}
 	const captureWitness = await repositoryStateWitness(cwd);
 	await repositoryStateWitnessTestHook?.("after-initial", cwd);
-	const baseRef = await resolveGitBase(cwd);
+	// A freshly initialized repository has no commits, so `HEAD`, every branch
+	// candidate, and any merge base are unresolvable. The empty tree is the only
+	// authoritative baseline there; refusing outright would strand a run whose
+	// implementation is entirely untracked. Everything on disk then counts as an
+	// addition, which is hashed like any other added file and never committed.
+	const headPresent = await spawnText(["git", "rev-parse", "--verify", "HEAD"], { cwd, timeoutMs: 3000 });
+	const unborn = !headPresent.ok;
+	const baseRef = unborn ? await getEmptyTreeId(cwd) : await resolveGitBase(cwd);
 	const base = baseRef;
-	const mergeBase = await spawnText(["git", "merge-base", "HEAD", baseRef], { cwd, timeoutMs: 3000 });
+	const mergeBase = unborn
+		? { ok: false, stdout: "", stderr: "repository has no commits" }
+		: await spawnText(["git", "merge-base", "HEAD", baseRef], { cwd, timeoutMs: 3000 });
+	const diffRange = unborn ? baseRef : `${base}...HEAD`;
 	const [committed, unstaged, staged, untracked, stat, committedDiff, unstagedDiff, stagedDiff] = await Promise.all([
-		spawnText(["git", "diff", "--name-status", "-z", `${base}...HEAD`], { cwd, timeoutMs: 5000 }),
+		spawnText(["git", "diff", "--name-status", "-z", unborn ? baseRef : diffRange], { cwd, timeoutMs: 5000 }),
 		spawnText(["git", "diff", "--name-status", "-z"], { cwd, timeoutMs: 5000 }),
 		spawnText(["git", "diff", "--cached", "--name-status", "-z"], { cwd, timeoutMs: 5000 }),
 		spawnText(["git", "ls-files", "--others", "--exclude-standard", "-z"], { cwd, timeoutMs: 5000 }),
-		spawnText(["git", "diff", "--stat", `${base}...HEAD`], { cwd, timeoutMs: 5000 }),
-		spawnText(["git", "diff", `${base}...HEAD`], { cwd, timeoutMs: 5000 }),
+		spawnText(["git", "diff", "--stat", diffRange], { cwd, timeoutMs: 5000 }),
+		spawnText(["git", "diff", diffRange], { cwd, timeoutMs: 5000 }),
 		spawnText(["git", "diff"], { cwd, timeoutMs: 5000 }),
 		spawnText(["git", "diff", "--cached"], { cwd, timeoutMs: 5000 }),
 	]);
@@ -382,7 +458,10 @@ async function repositoryStateWitness(cwd: string): Promise<string | undefined>
 		spawnText(["git", "ls-files", "-z"], { cwd, timeoutMs: 5000 }),
 		spawnText(["git", "ls-files", "--others", "--exclude-standard", "-z"], { cwd, timeoutMs: 5000 }),
 	]);
-	if (!head.ok || !status.ok || !tracked.ok || !untracked.ok) return undefined;
+	// An unborn repository has no HEAD yet; the remaining reads still describe its
+	// full state, so witness it as an empty head rather than failing the capture.
+	if (!status.ok || !tracked.ok || !untracked.ok) return undefined;
+	const headToken = head.ok ? head.stdout.trim() : "unborn";
 	const paths = [
 		...new Set([
 			...parseGitUntrackedPaths(tracked.stdout).map(row => row.path),
@@ -417,7 +496,7 @@ async function repositoryStateWitness(cwd: string): Promise<string | undefined>
 	} catch {
 		return undefined;
 	}
-	return `${head.stdout.trim()}\u0000${status.stdout}\u0000sha256:${content.digest("hex")}`;
+	return `${headToken}\u0000${status.stdout}\u0000sha256:${content.digest("hex")}`;
 }
 
 export function parseUnifiedDiffPaths(diff: string): UltragoalChangeSetPath[] {

package/src/gjc-runtime/ultragoal-guard.ts

@@ -25,6 +25,7 @@ import {
 	type UltragoalPlan,
 	type UltragoalReceiptKind,
 } from "./ultragoal-runtime";
+import { readUltragoalSuccessionFence } from "./ultragoal-succession";
 
 export type UltragoalGuardState =
 	| "inactive"
@@ -823,7 +824,14 @@ async function consumeUltragoalNudge(input: {
 	if (!sessionId) return { nudged: false };
 	const plan = await readUltragoalPlan(input.cwd, sessionId);
 	if (!plan) return { nudged: false };
-	const target = selectUltragoalNudgeTarget(plan, { currentGoalObjective: input.currentGoal?.objective });
+	const fence = await readUltragoalSuccessionFence(input.cwd, sessionId);
+	// A goal handed off to a successor run is not this run's resolvable work. Skip
+	// fenced goals while selecting, so a retained source-owned goal can still receive
+	// the nudge (and keep aggregate drop guarded) without spending budget on the handoff.
+	const target = selectUltragoalNudgeTarget(plan, {
+		currentGoalObjective: input.currentGoal?.objective,
+		excludedGoalIds: fence?.selectedGoalIds,
+	});
 	if (!target) return { nudged: false };
 	const { budget } = await resolveUltragoalNudgeBudget(input.cwd, input.agentDir);
 	const outcome = await recordUltragoalNudgeIfBudgetRemaining({

package/src/gjc-runtime/ultragoal-runtime.ts

@@ -82,6 +82,7 @@ import {
 import {
 	assertUltragoalAdoptionPublished,
 	assertUltragoalGoalNotFenced,
+	readUltragoalSuccessionFence,
 	runUltragoalSuccessionCommand,
 } from "./ultragoal-succession";
 import {
@@ -472,22 +473,27 @@ export async function resolveUltragoalNudgeBudget(
  */
 export function selectUltragoalNudgeTarget(
 	plan: UltragoalPlan,
-	options: { currentGoalObjective?: string; retryFailed?: boolean } = {},
+	options: { currentGoalObjective?: string; retryFailed?: boolean; excludedGoalIds?: readonly string[] } = {},
 ): UltragoalNudgeTarget | null {
 	const objective = options.currentGoalObjective?.trim();
+	const isExcluded = (goalId: string): boolean => options.excludedGoalIds?.includes(goalId) ?? false;
 	if (objective) {
 		const matched = plan.goals.find(
-			goal => goal.objective.trim() === objective && SCHEDULABLE_STATUSES.has(goal.status),
+			goal => goal.objective.trim() === objective && SCHEDULABLE_STATUSES.has(goal.status) && !isExcluded(goal.id),
 		);
 		if (matched) return { goalId: matched.id, targetKind: "story" };
 	}
-	const next = chooseNextGoal(plan, options.retryFailed === true);
+	const schedulableGoals = options.excludedGoalIds?.length
+		? plan.goals.filter(goal => !isExcluded(goal.id))
+		: plan.goals;
+	const next = selectNextSchedulableGoal(schedulableGoals, options.retryFailed === true);
 	if (next) return { goalId: next.id, targetKind: "story" };
 	const completion = getUltragoalRunCompletionState(plan, { retryFailed: options.retryFailed });
 	if (completion.needsFinalAggregateReceipt) {
 		const required = requiredUltragoalGoals(plan);
 		const finalGoal = required.at(-1);
-		if (finalGoal) return { goalId: finalGoal.id, targetKind: "final_aggregate_receipt" };
+		if (finalGoal && !isExcluded(finalGoal.id))
+			return { goalId: finalGoal.id, targetKind: "final_aggregate_receipt" };
 	}
 	return null;
 }
@@ -1125,7 +1131,11 @@ export async function getUltragoalStatus(
 	else if (counts.active > 0) status = "active";
 	else if (counts.failed > 0) status = "failed";
 	else if (counts.blocked > 0 || counts.review_blocked > 0) status = "blocked";
-	const nudgeTarget = selectUltragoalNudgeTarget(plan, { currentGoalObjective: currentGoal?.objective });
+	const fence = await readUltragoalSuccessionFence(cwd, resolvedSessionId);
+	const nudgeTarget = selectUltragoalNudgeTarget(plan, {
+		currentGoalObjective: currentGoal?.objective,
+		excludedGoalIds: fence?.selectedGoalIds,
+	});
 	let nudgeFields: Partial<UltragoalStatusSummary> = {};
 	if (nudgeTarget) {
 		const { budget } = await resolveUltragoalNudgeBudget(cwd, agentDir);

package/src/harness-control-plane/finalize.ts

@@ -14,6 +14,7 @@ import { randomBytes } from "node:crypto";
 import { readdirSync, readFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { type LinuxProcPidProbeResult, probeLinuxProcPidSync } from "../gjc-runtime/linux-proc";
+import { checkTmuxSelfInjection } from "../tools/tmux-self-injection-guard";
 import {
 	buildReceipt,
 	type CompletionEvidence,
@@ -558,6 +559,16 @@ export function defaultFinalizeChecks(
 	return {
 		async runValidation(spec, signal) {
 			if (signal?.aborted) throw new ValidationObservationUncertainError(spec.command, workspace, signal.reason);
+			// Same preflight as BashTool: refuse before spawn so a plan command cannot type into this pane.
+			const injection = await checkTmuxSelfInjection(spec.command, {
+				env: process.env,
+				cwd: workspace,
+				executionEnv: process.env,
+			});
+			if (signal?.aborted) throw new ValidationObservationUncertainError(spec.command, workspace, signal.reason);
+			if (injection.block) {
+				return { exactCommand: spec.command, cwd: workspace, exitStatus: 1, pass: false };
+			}
 			let proc: Bun.Subprocess<"ignore", "pipe", "pipe">;
 			try {
 				proc = Bun.spawn(["bash", "-lc", spec.command], {