@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/stt/recorder.ts

@@ -1,7 +1,7 @@
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
-import { $which, logger, Snowflake } from "@gajae-code/utils";
+import { $which, logger } from "@gajae-code/utils";
 import { $ } from "bun";
 
 export interface RecordingHandle {
@@ -212,10 +212,29 @@ if (Test-Path $outPath) {
 }
 `;
 
+async function writePowerShellRecordingScript(): Promise<{ tempDir: string; scriptPath: string }> {
+	// Random directory plus an exclusive create: a preexisting symlink under the
+	// shared temp directory is not opened, and the script is not left world-readable.
+	const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "gjc-stt-record-"));
+	try {
+		if (process.platform !== "win32") await fs.chmod(tempDir, 0o700);
+		const scriptPath = path.join(tempDir, "record.ps1");
+		const handle = await fs.open(scriptPath, "wx", 0o600);
+		try {
+			await handle.writeFile(PS_RECORD_SCRIPT);
+		} finally {
+			await handle.close();
+		}
+		if (process.platform !== "win32") await fs.chmod(scriptPath, 0o600);
+		return { tempDir, scriptPath };
+	} catch (error) {
+		await fs.rm(tempDir, { recursive: true, force: true });
+		throw error;
+	}
+}
+
 async function startPowerShellRecording(outputPath: string): Promise<RecordingHandle> {
-	// Write script to temp file — avoids quoting/escaping issues with -Command
-	const scriptPath = path.join(os.tmpdir(), `gjc-stt-record-${Snowflake.next()}.ps1`);
-	await Bun.write(scriptPath, PS_RECORD_SCRIPT);
+	const { tempDir, scriptPath } = await writePowerShellRecordingScript();
 
 	const proc = Bun.spawn(["powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", scriptPath, outputPath], {
 		stdin: "pipe",
@@ -224,7 +243,7 @@ async function startPowerShellRecording(outputPath: string): Promise<RecordingHa
 	});
 
 	proc.exited.then(() => {
-		fs.unlink(scriptPath).catch(() => {});
+		fs.rm(tempDir, { recursive: true, force: true }).catch(() => {});
 	});
 
 	// Wait for "RECORDING" on stdout to confirm it started
@@ -250,8 +269,7 @@ async function startPowerShellRecording(outputPath: string): Promise<RecordingHa
 		if (proc.stderr && typeof proc.stderr !== "number") {
 			stderrText = await new Response(proc.stderr as ReadableStream).text();
 		}
-		// Clean up temp script
-		fs.unlink(scriptPath).catch(() => {});
+		fs.rm(tempDir, { recursive: true, force: true }).catch(() => {});
 		throw new Error(
 			`PowerShell audio recording failed to start: ${stderrText.trim() || output.trim() || "(no output)"}`,
 		);
@@ -269,8 +287,7 @@ async function startPowerShellRecording(outputPath: string): Promise<RecordingHa
 			const killTimer = setTimeout(() => proc.kill(), 8000);
 			await proc.exited;
 			clearTimeout(killTimer);
-			// Clean up temp script
-			fs.unlink(scriptPath).catch(() => {});
+			fs.rm(tempDir, { recursive: true, force: true }).catch(() => {});
 		},
 	};
 }

package/src/system-prompt.ts

@@ -75,6 +75,31 @@ function sanitizeEmbeddedPromptContent(content: string): string {
 	return escapePromptMetadata(content, { preserveNewlines: true });
 }
 
+const UNTRUSTED_CONTENT_OPEN_LINE = "<untrusted-content>\n";
+const UNTRUSTED_CONTENT_CLOSE_LINE = "\n</untrusted-content>";
+
+/**
+ * Encode an inventory description. MCP descriptions already include a host-owned
+ * untrusted-content fence; keep those delimiters and encode only the body.
+ * A body that still contains a closing fence is not that wrapper, so encode the whole value.
+ */
+function escapeInventoryDescription(description: string): string {
+	const openLength = UNTRUSTED_CONTENT_OPEN_LINE.length;
+	const closeLength = UNTRUSTED_CONTENT_CLOSE_LINE.length;
+	if (
+		description.startsWith(UNTRUSTED_CONTENT_OPEN_LINE) &&
+		description.endsWith(UNTRUSTED_CONTENT_CLOSE_LINE) &&
+		description.length >= openLength + closeLength
+	) {
+		const body = description.slice(openLength, -closeLength);
+		if (!/<\/untrusted-content>/i.test(body)) {
+			const encodedBody = escapePromptMetadata(body, { preserveNewlines: true });
+			return `${UNTRUSTED_CONTENT_OPEN_LINE}${encodedBody}${UNTRUSTED_CONTENT_CLOSE_LINE}`;
+		}
+	}
+	return escapePromptMetadata(description, { preserveNewlines: true });
+}
+
 function firstNonEmpty(...values: (string | undefined | null)[]): string | null {
 	for (const value of values) {
 		const trimmed = value?.trim();
@@ -345,8 +370,9 @@ export async function loadProjectContextFiles(
 }
 
 /**
- * Load the effective system prompt customization from SYSTEM.md.
- * Project-level SYSTEM.md overrides user-level SYSTEM.md.
+ * Load the user system prompt customization from SYSTEM.md.
+ * A repository SYSTEM.md is untrusted project text. It must not replace the
+ * user file or become the customization block.
  */
 export async function loadSystemPromptFiles(options: LoadContextFilesOptions = {}): Promise<string | null> {
 	const resolvedCwd = options.cwd ?? getProjectDir();
@@ -359,11 +385,6 @@ export async function loadSystemPromptFiles(options: LoadContextFilesOptions = {
 
 	if (result.items.length === 0) return null;
 
-	const projectLevel = result.items.find(item => item.level === "project");
-	if (projectLevel) {
-		return projectLevel.content;
-	}
-
 	const userLevel = result.items.find(item => item.level === "user");
 	return userLevel?.content ?? null;
 }
@@ -745,18 +766,31 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 	const toolPromptNames = new Map<string, string>(toolNames.map(name => [name, tools?.get(name)?.wireName ?? name]));
 	const toolRefs = Object.fromEntries(toolPromptNames.entries());
 	const hasHiddenToolDiscoveryTool = Object.hasOwn(toolRefs, "search_tool_bm25");
-	const toolInfo = toolNames.map(name => ({
-		name: toolPromptNames.get(name) ?? name,
-		internalName: name,
-		label: tools?.get(name)?.label ?? "",
-		description: tools?.get(name)?.description ?? "",
-	}));
+	// The inventory template is compiled with noEscape. Encode tool metadata here so a
+	// tools/list label or description cannot close <inventory> or insert a system block.
+	// Repeated MCP descriptions keep the host <untrusted-content> fence; only the body is encoded.
+	// The `tools` list stays raw so {{#has}} still matches the call name.
+	const toolInfo = toolNames.map(name => {
+		const meta = tools?.get(name);
+		return {
+			name: escapePromptMetadata(toolPromptNames.get(name) ?? name),
+			internalName: escapePromptMetadata(name),
+			label: escapePromptMetadata(meta?.label ?? ""),
+			description: escapeInventoryDescription(meta?.description ?? ""),
+		};
+	});
 
-	const effectiveSystemPromptCustomization = dedupePromptSource(systemPromptCustomization, [
+	const rawSystemPromptCustomization = dedupePromptSource(systemPromptCustomization, [
 		resolvedCustomPrompt,
 		resolvedAppendPrompt,
 	]);
-	const promptSources = [effectiveSystemPromptCustomization, resolvedCustomPrompt, resolvedAppendPrompt];
+	// Encode after dedupe so rule matching still sees the file text. The customization
+	// template is noEscape; the same encoder used for context files keeps a file from
+	// closing <system-prompt-customization> or forging a sibling marker.
+	const effectiveSystemPromptCustomization = rawSystemPromptCustomization
+		? sanitizeEmbeddedPromptContent(rawSystemPromptCustomization)
+		: "";
+	const promptSources = [rawSystemPromptCustomization, resolvedCustomPrompt, resolvedAppendPrompt];
 	const injectedAlwaysApplyRules = dedupeAlwaysApplyRules(alwaysApplyRules, promptSources);
 
 	const environment = await logger.time("getEnvironmentInfo", getEnvironmentInfo);
@@ -771,6 +805,17 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		path: escapePromptMetadata(rule.path),
 		content: sanitizeEmbeddedPromptContent(rule.content),
 	}));
+	// Both rulebook templates compile with noEscape. Encode the fields they interpolate
+	// so repository frontmatter cannot close <rules> or the name attribute.
+	const sanitizedRulebookRules = (rules ?? []).map(rule => ({
+		...rule,
+		name: escapePromptMetadata(rule.name),
+		description:
+			rule.description === undefined
+				? undefined
+				: escapePromptMetadata(rule.description, { preserveNewlines: true }),
+		globs: rule.globs?.map(glob => escapePromptMetadata(glob)),
+	}));
 	const data = {
 		systemPromptCustomization: effectiveSystemPromptCustomization,
 		customPrompt: resolvedCustomPrompt,
@@ -784,7 +829,7 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		contextFiles: sanitizedContextFiles,
 		agentsMdSearch: { files: agentsMdFiles.map(file => escapePromptMetadata(file)) },
 		workspaceTree,
-		rules: rules ?? [],
+		rules: sanitizedRulebookRules,
 		alwaysApplyRules: sanitizedAlwaysApplyRules,
 		cwd: promptCwd,
 		intentTracing: !!intentField,

package/src/task/executor.ts

@@ -51,6 +51,7 @@ import { buildSkillPromptMessage, type Skill } from "../extensibility/skills";
 import { sessionRoot } from "../gjc-runtime/session-layout";
 import type { HindsightSessionState } from "../hindsight/state";
 import type { LocalProtocolOptions } from "../internal-urls";
+import type { PlanModeState } from "../plan-mode/state";
 import subagentSystemPromptTemplate from "../prompts/system/subagent-system-prompt.md" with { type: "text" };
 import subagentUserPromptTemplate from "../prompts/system/subagent-user-prompt.md" with { type: "text" };
 import submitReminderTemplate from "../prompts/system/subagent-yield-reminder.md" with { type: "text" };
@@ -59,6 +60,7 @@ import { discoverAuthStorage } from "../sdk";
 import type { AgentSession, AgentSessionEvent, ForkContextSeed } from "../session/agent-session";
 import { ArtifactManager } from "../session/artifacts";
 import type { AuthStorage } from "../session/auth-storage";
+import type { ClientBridge } from "../session/client-bridge";
 import { SKILL_PROMPT_MESSAGE_TYPE } from "../session/messages";
 import { SessionManager, type SessionMemoryMode } from "../session/session-manager";
 import { FileSessionStorage } from "../session/session-storage";
@@ -74,6 +76,7 @@ import { buildNamedToolChoiceResult } from "../utils/tool-choice";
 import type { WorkspaceTree } from "../workspace-tree";
 import { validateAllocatedTaskId } from "./id";
 import { classifyProviderRetryFromTransport, providerNameFromModel } from "./provider-retry-status";
+import { containSubagentRoleBody } from "./role-body";
 import { subprocessToolRegistry } from "./subprocess-tool-registry";
 import { persistTaskTokenLog, taskTokenLogFromUsage } from "./token-log";
 import {
@@ -300,6 +303,21 @@ export interface ExecutorOptions {
 	 * the same immutable child settings snapshot.
 	 */
 	inheritedServiceTier?: ServiceTier;
+	/**
+	 * Parent ACP/SDK approval mode. `deny` and `prompt` replace the child
+	 * default (`allow`) before the first prompt. `allow` is that default.
+	 */
+	sdkPermissionMode?: "prompt" | "allow" | "deny";
+	/**
+	 * Parent plan-mode state. Copied onto the child before the first prompt so
+	 * `enforcePlanModeWrite` still refuses product-file writes.
+	 */
+	planModeState?: PlanModeState;
+	/**
+	 * Parent client bridge. Only `requestPermission` is copied onto the child.
+	 * Terminal, filesystem, and deferAgentInitiatedTurns stay on the parent.
+	 */
+	clientBridge?: ClientBridge;
 	/** Override local:// protocol options so subagent shares parent's local:// root */
 	localProtocolOptions?: LocalProtocolOptions;
 	/**
@@ -342,28 +360,32 @@ export interface ExecutorOptions {
 export class ManagedTaskPersistence {
 	readonly #artifacts: ArtifactManager;
 	readonly #taskId: string;
+	readonly #getArtifacts: () => ArtifactManager;
 
-	constructor(artifacts: ArtifactManager, taskId: string) {
+	constructor(artifacts: ArtifactManager, taskId: string, getArtifacts: () => ArtifactManager = () => artifacts) {
 		this.#artifacts = artifacts;
 		this.#taskId = validateAllocatedTaskId(taskId);
+		this.#getArtifacts = getArtifacts;
 		if (!artifacts.getManagedSubtreeRootAuthority())
 			throw new Error("Managed task persistence authority is unavailable");
 	}
 
 	async openSession(cwd: string, sessionMemoryMode: SessionMemoryMode = "shadow"): Promise<SessionManager> {
-		const store = this.#artifacts.getManagedStore();
+		const artifacts = this.#getArtifacts();
+		const store = artifacts.getManagedStore();
 		if (!store) throw new Error("Managed task persistence authority is unavailable");
-		this.#artifacts.assertManagedBinding();
-		const sessionFile = path.join(this.#artifacts.dir, `${this.#taskId}.jsonl`);
+		artifacts.assertManagedBinding();
+		const sessionFile = path.join(artifacts.dir, `${this.#taskId}.jsonl`);
 		const session = await SessionManager.openNestedManaged(
 			sessionFile,
-			SessionManager.nestedManagedDestination(store, this.#artifacts.dir),
+			SessionManager.nestedManagedDestination(store, artifacts.dir),
 			store,
 			undefined,
 			cwd,
 			sessionMemoryMode,
 		);
-		this.#artifacts.assertManagedBinding();
+		artifacts.assertManagedBinding();
+		session.registerManagedTranscriptRelocationResolver(this.#getArtifacts);
 		return session;
 	}
 	async openStagedSession(attemptId = this.#taskId): Promise<SessionManager> {
@@ -385,8 +407,10 @@ export class ManagedTaskPersistence {
 	}
 
 	async publishOutput(rawOutput: string, metadata: Uint8Array): Promise<void> {
-		await withArtifactManagerFinalizationTurn(this.#artifacts, () =>
-			this.#artifacts.publishManagedOutputGeneration(
+		const artifacts = this.#getArtifacts();
+		artifacts.assertManagedBinding();
+		await withArtifactManagerFinalizationTurn(artifacts, () =>
+			artifacts.publishManagedOutputGeneration(
 				`${this.#taskId}.md.selector.json`,
 				`${this.#taskId}.md`,
 				Buffer.from(rawOutput, "utf8"),
@@ -396,8 +420,12 @@ export class ManagedTaskPersistence {
 	}
 }
 
-export function createManagedTaskPersistence(artifacts: ArtifactManager, taskId: string): ManagedTaskPersistence {
-	return new ManagedTaskPersistence(artifacts, taskId);
+export function createManagedTaskPersistence(
+	artifacts: ArtifactManager,
+	taskId: string,
+	getArtifacts?: () => ArtifactManager,
+): ManagedTaskPersistence {
+	return new ManagedTaskPersistence(artifacts, taskId, getArtifacts);
 }
 
 const MAX_REVIEW_FINDINGS_ARTIFACT_BYTES = 16 * 1024 * 1024;
@@ -1006,6 +1034,16 @@ function autoroutingAttemptDisposition(failure: AutoroutingPreflightFailure): {
 	return { code: "unclassified_terminal", advance: false };
 }
 
+/** Permission callback only. Terminal, filesystem, and defer flags stay on the parent. */
+function permissionOnlyBridge(bridge: ClientBridge | undefined): ClientBridge | undefined {
+	if (!bridge?.requestPermission || bridge.capabilities.requestPermission !== true) return undefined;
+	const requestPermission = bridge.requestPermission.bind(bridge);
+	return {
+		capabilities: { requestPermission: true },
+		requestPermission: (toolCall, options, signal) => requestPermission(toolCall, options, signal),
+	};
+}
+
 export async function runSubprocessOnce(options: ExecutorOptions): Promise<SingleResult> {
 	const {
 		cwd,
@@ -1739,9 +1777,14 @@ export async function runSubprocessOnce(options: ExecutorOptions): Promise<Singl
 					});
 			let modelRegistry = options.modelRegistry ?? ownedModelRegistry!;
 			const authStorage = modelRegistry.authStorage;
-			if (options.authStorage && options.authStorage !== authStorage) {
+			// Reject if both authStorage and modelRegistry are provided with different instances.
+			if (
+				options.authStorage !== undefined &&
+				options.modelRegistry !== undefined &&
+				options.authStorage !== authStorage
+			) {
 				throw new Error(
-					"options.authStorage and options.modelRegistry.authStorage must be the same instance when both are provided",
+					"options.authStorage and options.modelRegistry.authStorage must be the same instance or one must be omitted",
 				);
 			}
 			checkAbort();
@@ -2044,14 +2087,15 @@ export async function runSubprocessOnce(options: ExecutorOptions): Promise<Singl
 					promptTemplates: options.promptTemplates,
 					workspaceTree: options.workspaceTree,
 					systemPrompt: defaultPrompt => {
-						const subagentPrompt = prompt.render(subagentSystemPromptTemplate, {
-							agent: prompt.render(agent.systemPrompt, {
-								// Typed executionMode wins; assignment text is compatibility-only (#2698 / #2456).
-								ultragoalRedTeam: resolveUltragoalRedTeamActivation({
-									executionMode: options.executionMode,
-									assignment: options.assignment ?? task,
-								}),
+						const renderedRole = prompt.render(agent.systemPrompt, {
+							// Typed executionMode wins; assignment text is compatibility-only (#2698 / #2456).
+							ultragoalRedTeam: resolveUltragoalRedTeamActivation({
+								executionMode: options.executionMode,
+								assignment: options.assignment ?? task,
 							}),
+						});
+						const subagentPrompt = prompt.render(subagentSystemPromptTemplate, {
+							agent: containSubagentRoleBody(renderedRole),
 							context: options.context?.trim() ?? "",
 							worktree: worktree ?? "",
 							outputSchema: normalizedOutputSchema,
@@ -2101,6 +2145,22 @@ export async function runSubprocessOnce(options: ExecutorOptions): Promise<Singl
 			);
 
 			activeSession = session;
+			// Plan mode is session state, not a tool-list filter. Copy it before the
+			// first prompt so product writes hit the same read-only guard as the parent.
+			if (options.planModeState?.enabled) {
+				session.setPlanModeState({
+					enabled: true,
+					planFilePath: options.planModeState.planFilePath,
+					...(options.planModeState.workflow ? { workflow: options.planModeState.workflow } : {}),
+					...(options.planModeState.reentry !== undefined ? { reentry: options.planModeState.reentry } : {}),
+				});
+			}
+			// `allow` is the child default. deny/prompt must be copied before the first prompt.
+			if (options.sdkPermissionMode === "deny" || options.sdkPermissionMode === "prompt") {
+				session.setSdkPermissionMode(options.sdkPermissionMode);
+			}
+			const approvalBridge = permissionOnlyBridge(options.clientBridge);
+			if (approvalBridge) session.setClientBridge(approvalBridge);
 			const configuredChildChain = parentFallbackSelector ? [parentFallbackSelector] : modelPatterns;
 			session.setConfiguredModelChain("default", configuredChildChain, "subagent", agent.name, true);
 			if (!parentFallbackSelector) {
@@ -2151,7 +2211,9 @@ export async function runSubprocessOnce(options: ExecutorOptions): Promise<Singl
 			const parentOwnedToolNames = new Set(["todo_write"]);
 			const filteredSubagentTools = subagentToolNames.filter(name => !parentOwnedToolNames.has(name));
 			if (filteredSubagentTools.length !== subagentToolNames.length) {
-				await awaitAbortable(session.setActiveToolsByName(filteredSubagentTools));
+				await awaitAbortable(
+					session.setActiveToolsByName(filteredSubagentTools, { explicit: false, persistMCPSelection: false }),
+				);
 			}
 
 			if (!options.preflightProbe && !options.preflightDurable) {
@@ -2881,6 +2943,39 @@ function preflightTerminalResult(
 
 /** Run routed initial tasks through the bounded probe/durable candidate ledger. */
 export async function runSubprocess(options: ExecutorOptions): Promise<SingleResult> {
+	// Resume routing resolves credentials before dispatch; do not let an unexpected
+	// lookup exception bypass terminalization just because the initial probe ledger is off.
+	if (
+		(options.runMode ?? "initial") !== "initial" &&
+		options.autoroutingCandidates &&
+		options.autoroutingPreflightErrors
+	) {
+		const failedSelector = options.autoroutingCandidates.find(selector =>
+			options.autoroutingPreflightErrors?.has(selector),
+		);
+		if (failedSelector) {
+			const preflightError = options.autoroutingPreflightErrors.get(failedSelector);
+			const failure = classifyAutoroutingPreflightFailure(preflightError, "auth_resolve");
+			const { code } = autoroutingAttemptDisposition(failure);
+			const skips = buildBoundedRoutingSkips(options.autoroutingSkips);
+			const routedOptions = options.routing ? { ...options.routing, ...skips } : options.routing;
+			return preflightTerminalResult(
+				{ ...options, routing: routedOptions },
+				[{ selector: failedSelector, phase: "probe", code }],
+				"preflight_exhausted",
+			);
+		}
+	}
+	if ((options.runMode ?? "initial") !== "initial" && options.autoroutingCandidates?.length === 0 && options.routing) {
+		const skippedCandidates = options.autoroutingSkips?.filter(skip => skip.code === "credential_unavailable") ?? [];
+		return preflightTerminalResult(
+			{ ...options, routing: { ...options.routing, ...buildBoundedRoutingSkips(options.autoroutingSkips) } },
+			skippedCandidates
+				.slice(0, 6)
+				.map(skip => ({ selector: skip.selector, phase: "probe", code: "credential_unavailable" })),
+			"all_candidates_skipped",
+		);
+	}
 	if (
 		!options.autoroutingPreflight ||
 		(options.runMode ?? "initial") !== "initial" ||