@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/internal-urls/local-protocol.ts

@@ -179,6 +179,109 @@ async function assertDirectoryNotSymlink(directoryPath: string): Promise<void> {
 	}
 }
 
+/** Group-write and world-write bits. Either one lets another user rename the session directory. */
+const GROUP_OR_WORLD_WRITABLE = 0o022;
+
+interface DirectoryIdentityStat {
+	isDirectory(): boolean;
+	isSymbolicLink(): boolean;
+	dev: number;
+	ino: number;
+	uid: number;
+	mode: number;
+}
+
+interface ManagedRootIdentity {
+	readonly dev: number;
+	readonly ino: number;
+	readonly uid: number;
+}
+
+function isUnsafeDirectory(stat: DirectoryIdentityStat): boolean {
+	return !stat.isDirectory() || stat.isSymbolicLink();
+}
+
+function managedRootIdentity(stat: DirectoryIdentityStat): ManagedRootIdentity {
+	return { dev: stat.dev, ino: stat.ino, uid: stat.uid };
+}
+
+function sameManagedRoot(stat: DirectoryIdentityStat, recorded: ManagedRootIdentity): boolean {
+	if (isUnsafeDirectory(stat) || stat.dev !== recorded.dev || stat.ino !== recorded.ino) return false;
+	// A later chmod to 0755 keeps the same directory. Only a writable bit, a new
+	// inode, or a different owner means the root was replaced or opened up.
+	if (process.platform === "win32") return true;
+	return stat.uid === recorded.uid && (stat.mode & GROUP_OR_WORLD_WRITABLE) === 0;
+}
+
+/**
+ * An existing managed session directory is adopted only when this user owns it
+ * and the group and world cannot write it. Windows has no POSIX owner bits.
+ */
+function assertAdoptedManagedRoot(stat: DirectoryIdentityStat): void {
+	if (isUnsafeDirectory(stat)) throw new Error("Unsafe local:// root");
+	if (process.platform === "win32") return;
+	const uid = process.getuid?.();
+	if (uid === undefined || stat.uid !== uid || (stat.mode & GROUP_OR_WORLD_WRITABLE) !== 0) {
+		throw new Error("Unsafe local:// root");
+	}
+}
+
+function assertManagedParentSync(localRoot: string): void {
+	let parentStat: fsSync.Stats;
+	try {
+		parentStat = fsSync.lstatSync(path.dirname(localRoot));
+	} catch {
+		throw new Error("Unsafe local:// root");
+	}
+	assertAdoptedManagedRoot(parentStat);
+}
+
+/**
+ * Keep a pinned root unless a changed inode is validated as a settled
+ * recreation. A root created by this call may be rebound after migration.
+ */
+function acceptManagedRootForInit(
+	localRoot: string,
+	rootStat: DirectoryIdentityStat,
+	recorded: ManagedRootIdentity | undefined,
+	adoptedExisting: boolean,
+): void {
+	if (recorded && adoptedExisting) {
+		if (sameManagedRoot(rootStat, recorded)) return;
+		const pending = pendingCreatedRoots.get(localRoot);
+		if (pending && sameManagedRoot(rootStat, pending)) return;
+		if (isSettledRecreatedManagedRoot(localRoot, rootStat)) return;
+		throw new Error("Unsafe local:// root");
+	}
+	if (recorded || adoptedExisting) {
+		assertAdoptedManagedRoot(rootStat);
+		return;
+	}
+	if (isUnsafeDirectory(rootStat)) throw new Error("Unsafe local:// root");
+}
+
+/**
+ * A pinned root whose inode changed is still ours when a gjc initializer
+ * completed it: the temp sweeper (or `gjc gc`) removed the directory and
+ * another process for the same session recreated it, writing a settled
+ * migration marker. POSIX owner and write-bit checks on the root and parent
+ * protect this exception. Windows changed-inode adoption stays fail-closed
+ * until this path validates the replacement's identity and ACLs.
+ */
+function isSettledRecreatedManagedRoot(localRoot: string, rootStat: DirectoryIdentityStat): boolean {
+	if (process.platform === "win32") return false;
+	try {
+		assertAdoptedManagedRoot(rootStat);
+		assertManagedParentSync(localRoot);
+		const marker = path.join(localRoot, LEGACY_MIGRATION_MARKER);
+		const markerStat = fsSync.lstatSync(marker);
+		if (!markerStat.isFile() || markerStat.isSymbolicLink()) return false;
+		return isSettledMigrationMarkerValue(fsSync.readFileSync(marker, "utf8"));
+	} catch {
+		return false;
+	}
+}
+
 const LEGACY_MIGRATION_MARKER = ".gjc-local-legacy-migrated-v1";
 const MAX_LEGACY_LOCAL_BYTES = 64 * 1024 * 1024;
 
@@ -508,9 +611,33 @@ async function migrateLegacyLocal(
 	}
 }
 
-const initializedLocalRoots = new Set<string>();
+const initializedLocalRoots = new Map<string, ManagedRootIdentity>();
+/** A directory this process created and has not finished migrating. */
+const pendingCreatedRoots = new Map<string, ManagedRootIdentity>();
 const initializingLocalRoots = new Map<string, Promise<string>>();
 
+function assertRememberedManagedRoot(localRoot: string, recorded: ManagedRootIdentity): void {
+	let stat: fsSync.Stats;
+	try {
+		stat = fsSync.lstatSync(localRoot);
+	} catch {
+		throw new Error("Unsafe local:// root");
+	}
+	if (!sameManagedRoot(stat, recorded)) throw new Error("Unsafe local:// root");
+}
+
+function rememberManagedRoot(localRoot: string, expected: ManagedRootIdentity): void {
+	let stat: fsSync.Stats;
+	try {
+		stat = fsSync.lstatSync(localRoot);
+	} catch {
+		throw new Error("Unsafe local:// root");
+	}
+	if (!sameManagedRoot(stat, expected)) throw new Error("Unsafe local:// root");
+	initializedLocalRoots.set(localRoot, managedRootIdentity(stat));
+	pendingCreatedRoots.delete(localRoot);
+}
+
 /**
  * Completes the mandatory legacy migration gate for a local root.
  * Call and await this before using the synchronous path resolver for reads or writes.
@@ -559,16 +686,21 @@ async function initializeManagedLocalRoot(options: LocalProtocolOptions, localRo
 
 	await fs.mkdir(scratchParent, { recursive: true, mode: 0o700 });
 	await assertDirectoryNotSymlink(scratchParent);
+	assertAdoptedManagedRoot(await fs.lstat(scratchParent));
+	let adoptedExisting = false;
 	try {
 		await fs.mkdir(localRoot, { mode: 0o700 });
 	} catch (error) {
 		if (error instanceof Error && "code" in error && error.code === "EEXIST") {
-			await assertDirectoryNotSymlink(localRoot);
+			adoptedExisting = true;
 		} else {
 			throw error;
 		}
 	}
-	await assertDirectoryNotSymlink(localRoot);
+	const rootStat = await fs.lstat(localRoot);
+	const recorded = initializedLocalRoots.get(localRoot);
+	acceptManagedRootForInit(localRoot, rootStat, recorded, adoptedExisting);
+	if (!adoptedExisting) pendingCreatedRoots.set(localRoot, managedRootIdentity(rootStat));
 	await migrateLegacyLocal(options, localRoot, scratchParent);
 
 	const resolvedScratchParent = await fs.realpath(scratchParent);
@@ -577,7 +709,10 @@ async function initializeManagedLocalRoot(options: LocalProtocolOptions, localRo
 	if (resolvedLocalRoot === resolvedScratchParent) {
 		throw new Error("Unsafe local:// root");
 	}
-	initializedLocalRoots.add(resolvedLocalRoot);
+	// Key the lexical path the sync resolver checks. realpath(/var -> /private/var)
+	// is a different string for the same directory, so caching only the real path
+	// let a later rename-swap skip this identity check.
+	rememberManagedRoot(localRoot, managedRootIdentity(rootStat));
 	return resolvedLocalRoot;
 }
 
@@ -587,18 +722,41 @@ function initializeLocalRootSyncWhenLegacyAbsent(options: LocalProtocolOptions,
 		initializeExplicitLocalRootSync(explicitRoot);
 		return;
 	}
-	if (initializedLocalRoots.has(localRoot)) return;
+	const recorded = initializedLocalRoots.get(localRoot);
+	if (recorded) {
+		assertManagedParentSync(localRoot);
+		let present: fsSync.Stats | undefined;
+		try {
+			present = fsSync.lstatSync(localRoot);
+		} catch (error) {
+			if (!isEnoent(error)) throw new Error("Unsafe local:// root");
+		}
+		if (present) {
+			if (sameManagedRoot(present, recorded)) {
+				assertRememberedManagedRoot(localRoot, recorded);
+				return;
+			}
+			const pending = pendingCreatedRoots.get(localRoot);
+			if (!(pending && sameManagedRoot(present, pending)) && !isSettledRecreatedManagedRoot(localRoot, present)) {
+				throw new Error("Unsafe local:// root");
+			}
+		}
+	}
 	const scratchParent = path.dirname(localRoot);
 	fsSync.mkdirSync(scratchParent, { recursive: true, mode: 0o700 });
 	const parentStat = fsSync.lstatSync(scratchParent);
 	if (!parentStat.isDirectory() || parentStat.isSymbolicLink()) throw new Error("Unsafe local:// root");
+	assertAdoptedManagedRoot(parentStat);
+	let adoptedExisting = false;
 	try {
 		fsSync.mkdirSync(localRoot, { mode: 0o700 });
 	} catch (error) {
 		if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+		adoptedExisting = true;
 	}
 	const rootStat = fsSync.lstatSync(localRoot);
-	if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) throw new Error("Unsafe local:// root");
+	acceptManagedRootForInit(localRoot, rootStat, recorded, adoptedExisting);
+	if (!adoptedExisting) pendingCreatedRoots.set(localRoot, managedRootIdentity(rootStat));
 	const marker = path.join(localRoot, LEGACY_MIGRATION_MARKER);
 	try {
 		// Accept exactly the marker states the async gate treats as settled. A
@@ -608,7 +766,7 @@ function initializeLocalRootSyncWhenLegacyAbsent(options: LocalProtocolOptions,
 		// async gate had already completed.
 		if (!isSettledMigrationMarkerValue(fsSync.readFileSync(marker, "utf8")))
 			throw new Error("Unsafe local:// migration marker");
-		initializedLocalRoots.add(localRoot);
+		rememberManagedRoot(localRoot, managedRootIdentity(rootStat));
 		return;
 	} catch (error) {
 		if (!isEnoent(error)) throw error;
@@ -629,7 +787,7 @@ function initializeLocalRootSyncWhenLegacyAbsent(options: LocalProtocolOptions,
 		if (!isSettledMigrationMarkerValue(fsSync.readFileSync(marker, "utf8")))
 			throw new Error("Unsafe local:// migration marker");
 	}
-	initializedLocalRoots.add(localRoot);
+	rememberManagedRoot(localRoot, managedRootIdentity(rootStat));
 }
 
 export function resolveLocalRoot(options: LocalProtocolOptions): string {
@@ -696,6 +854,7 @@ export class LocalProtocolHandler implements ProtocolHandler {
 		LocalProtocolHandler.#override = undefined;
 		LocalProtocolHandler.#ownedOverrides = [];
 		initializedLocalRoots.clear();
+		pendingCreatedRoots.clear();
 		initializingLocalRoots.clear();
 	}
 

package/src/internal-urls/types.ts

@@ -21,6 +21,8 @@ export interface InternalResource {
 	size?: number;
 	/** Underlying filesystem path (for debugging, not exposed to agent) */
 	sourcePath?: string;
+	/** True when model-facing reads must wrap the selected content as untrusted. */
+	untrusted?: boolean;
 	/** Additional notes about resolution */
 	notes?: string[];
 	/**

package/src/lsp/client.ts

@@ -1,4 +1,5 @@
 import { isEnoent, isKnownSinkPeerClosedError, logger, untilAborted } from "@gajae-code/utils";
+import { projectSafeSpawnEnv } from "@gajae-code/utils/shell-config";
 import { formatCrashDiagnosticNotice, writeCrashReport } from "../debug/crash-diagnostics";
 import { registerResourceOwner, spawnOwnedProcess } from "../runtime/process-lifecycle";
 import { ToolAbortError, throwIfAborted } from "../tools/tool-errors";
@@ -538,7 +539,7 @@ export async function getOrCreateClient(config: ServerConfig, cwd: string, initT
 		const owner = spawnOwnedProcess([command, ...args], {
 			cwd,
 			stdin: "pipe",
-			env: env ? { ...Bun.env, ...env } : undefined,
+			env: { ...projectSafeSpawnEnv(), ...env },
 			name: `lsp:${config.command}`,
 		});
 		const proc = owner.child;

package/src/lsp/clients/biome-client.ts

@@ -3,6 +3,7 @@
  * Uses Biome's CLI with JSON output instead of LSP (which has stale diagnostics issues).
  */
 import path from "node:path";
+import { projectSafeSpawnEnv } from "@gajae-code/utils/shell-config";
 import type { Diagnostic, DiagnosticSeverity, LinterClient, ServerConfig } from "../../lsp/types";
 
 // =============================================================================
@@ -84,6 +85,7 @@ async function runBiome(
 	try {
 		const proc = Bun.spawn([command, ...args], {
 			cwd,
+			env: projectSafeSpawnEnv(),
 			stdout: "pipe",
 			stderr: "pipe",
 			windowsHide: true,

package/src/lsp/clients/swiftlint-client.ts

@@ -2,6 +2,7 @@
  * SwiftLint CLI-based linter client.
  * Parses SwiftLint's JSON reporter output into LSP Diagnostic format.
  */
+import { projectSafeSpawnEnv } from "@gajae-code/utils/shell-config";
 import type { Diagnostic, DiagnosticSeverity, LinterClient, ServerConfig } from "../../lsp/types";
 
 /** Shape of a single violation from `swiftlint lint --reporter json`. */
@@ -36,6 +37,7 @@ async function runSwiftLint(
 	try {
 		const proc = Bun.spawn([command, ...args], {
 			cwd,
+			env: projectSafeSpawnEnv(),
 			stdout: "pipe",
 			stderr: "pipe",
 			windowsHide: true,

package/src/lsp/index.ts

@@ -77,6 +77,7 @@ import {
 	symbolKindToIcon,
 	uriToFile,
 } from "./utils";
+import { assertInsideWorkspace } from "./workspace-path";
 
 export type { LspServerStatus } from "./client";
 export type { LspToolDetails } from "./types";
@@ -347,6 +348,17 @@ interface FileRenamePair {
  * For files this is a single pair. For directories this walks every regular file underneath
  * and produces a parallel pair anchored at the new directory root.
  */
+/**
+ * POSIX `/` contains every absolute path, and the shared helper's prefix for
+ * it is `//`, so skip containment there. A Windows drive root is only that
+ * volume, so it is checked. Any other platform root keeps the previous skip.
+ */
+function workspaceRootSkipsContainment(root: string): boolean {
+	if (root === "/") return true;
+	if (/^[A-Za-z]:[\\/]$/.test(root)) return false;
+	return root === path.parse(root).root;
+}
+
 async function enumerateRenamePairs(
 	source: string,
 	dest: string,
@@ -1525,6 +1537,23 @@ export class LspTool implements AgentTool<typeof lspSchema, LspToolDetails, Them
 				}
 			}
 
+			// Reject every path this rename will write before the first write. Check the
+			// caller signal after each await, including the last one.
+			const cwd = this.session.cwd;
+			throwIfAborted(signal);
+			const workspaceRoot = await fs.promises.realpath(cwd);
+			throwIfAborted(signal);
+			if (!workspaceRootSkipsContainment(workspaceRoot)) {
+				await assertInsideWorkspace(cwd, source);
+				throwIfAborted(signal);
+				await assertInsideWorkspace(cwd, dest);
+				throwIfAborted(signal);
+				for (const uri of acceptedByUri.keys()) {
+					await assertInsideWorkspace(cwd, uriToFile(uri));
+					throwIfAborted(signal);
+				}
+			}
+
 			for (const [uri, bucket] of acceptedByUri) {
 				const filePath = uriToFile(uri);
 				await applyTextEdits(filePath, bucket.edits);

package/src/lsp/workspace-path.ts

@@ -6,7 +6,30 @@ function isEnoent(error: unknown): boolean {
 	return (error as NodeJS.ErrnoException).code === "ENOENT";
 }
 
+/** Drive-letter root such as `C:\`. A UNC share root is not a drive root. */
+function windowsDriveLetter(root: string): string | null {
+	const match = /^([A-Za-z]):[\\/]$/.exec(root);
+	return match ? match[1].toLowerCase() : null;
+}
+
+/**
+ * A Windows drive root already ends in a separator. Prefixing another one
+ * (`C:\` + `\`) matches nothing on that volume, so compare the drive letter.
+ * Same-volume paths stay inside, including `\\?\C:\`. Other drives and UNC
+ * shares do not.
+ */
+function sameWindowsDrive(driveRoot: string, candidate: string): boolean {
+	const letter = windowsDriveLetter(driveRoot);
+	if (!letter) return false;
+	const normalized = candidate.replace(/\//g, "\\");
+	const extended = /^\\\\\?\\([A-Za-z]):\\/.exec(normalized);
+	if (extended) return extended[1].toLowerCase() === letter;
+	if (normalized.startsWith("\\\\")) return false;
+	return path.win32.parse(normalized).root.toLowerCase() === `${letter}:\\`;
+}
+
 function escapes(root: string, candidate: string): boolean {
+	if (windowsDriveLetter(root)) return !sameWindowsDrive(root, candidate);
 	return candidate !== root && !candidate.startsWith(`${root}${path.sep}`);
 }