@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/tools/ask.ts

@@ -953,6 +953,7 @@ export class AskTool implements AgentTool<AskParametersSchema, AskToolDetails> {
 			this.session.cwd,
 			{ sessionId: this.session.getSessionId?.() ?? null },
 			this.session.getSessionAgentDir?.() ?? this.session.settings.getAgentDir(),
+			params,
 		);
 		assertDeepInterviewStructuredResponseWithinLimit(params);
 		// Recheck at execution time as well: direct SDK callers and a phase change

package/src/tools/ast-edit-write-path.ts

@@ -66,3 +66,67 @@ export async function resolveAstEditPreviewWritePaths(
 	}
 	return resolved;
 }
+
+/** Refusal prefix when a single-file real path leaves its reference root. */
+export const AST_EDIT_OUTSIDE_ROOT_MESSAGE = "AST edit target resolves outside its root";
+
+function isEnoent(error: unknown): boolean {
+	return (error as NodeJS.ErrnoException | undefined)?.code === "ENOENT";
+}
+
+function staysInside(root: string, target: string): boolean {
+	const relative = path.relative(root, target);
+	return relative === "" || (relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+
+async function realOrLexical(target: string): Promise<string> {
+	try {
+		return await fs.realpath(target);
+	} catch (error) {
+		if (isEnoent(error)) return path.resolve(target);
+		throw error;
+	}
+}
+
+/**
+ * Native astEdit canonicalizes one file and writes that real path. Directory
+ * scans do not follow links. A lexical path inside cwd uses the real cwd as
+ * the reference root; an explicit path outside cwd uses its real parent, so a
+ * direct file there still applies. Returns the lexical path that would leave
+ * that root, if any.
+ */
+export async function astEditSingleFileOutsideReferenceRoot(
+	cwd: string,
+	candidatePaths: readonly string[],
+	signal?: AbortSignal,
+): Promise<string | undefined> {
+	signal?.throwIfAborted();
+	const resolvedCwd = path.resolve(cwd);
+	const realCwd = await realOrLexical(resolvedCwd);
+	for (const candidate of candidatePaths) {
+		signal?.throwIfAborted();
+		const lexical = path.resolve(resolvedCwd, candidate);
+		let followed: string;
+		try {
+			followed = await fs.realpath(lexical);
+		} catch (error) {
+			if (isEnoent(error)) continue;
+			throw error;
+		}
+		let stat: Awaited<ReturnType<typeof fs.stat>>;
+		try {
+			stat = await fs.stat(followed);
+		} catch (error) {
+			if (isEnoent(error)) continue;
+			throw error;
+		}
+		if (!stat.isFile()) continue;
+		const root =
+			staysInside(resolvedCwd, lexical) || staysInside(realCwd, lexical)
+				? realCwd
+				: await realOrLexical(path.dirname(lexical));
+		signal?.throwIfAborted();
+		if (!staysInside(root, followed)) return lexical;
+	}
+	return undefined;
+}

package/src/tools/ast-edit.ts

@@ -13,7 +13,11 @@ import { assertWorkflowMutationRawPathsAllowed } from "../skill-state/workflow-m
 import { Ellipsis, fileHyperlink, renderStatusLine, renderTreeList, truncateToWidth } from "../tui";
 import { resolveFileDisplayMode } from "../utils/file-display-mode";
 import type { ToolSession } from ".";
-import { resolveAstEditPreviewWritePaths } from "./ast-edit-write-path";
+import {
+	AST_EDIT_OUTSIDE_ROOT_MESSAGE,
+	astEditSingleFileOutsideReferenceRoot,
+	resolveAstEditPreviewWritePaths,
+} from "./ast-edit-write-path";
 import { assertEditableFile } from "./auto-generated-guard";
 import { createFileRecorder, formatResultPath } from "./file-recorder";
 import { formatGroupedFiles } from "./grouped-file-output";
@@ -220,6 +224,18 @@ export class AstEditTool implements AgentTool<typeof astEditSchema, AstEditToolD
 			});
 			const { searchPath: resolvedSearchPath, scopePath, isDirectory, multiTargets, globFilter } = scope;
 
+			const assertSingleFileReferenceRoot = async (flowSignal?: AbortSignal): Promise<void> => {
+				const nativeWritePaths = multiTargets ? multiTargets.map(target => target.basePath) : [resolvedSearchPath];
+				const outsideRoot = await astEditSingleFileOutsideReferenceRoot(
+					this.session.cwd,
+					nativeWritePaths,
+					flowSignal,
+				);
+				if (outsideRoot) {
+					throw new ToolError(`${AST_EDIT_OUTSIDE_ROOT_MESSAGE}: ${outsideRoot}`);
+				}
+			};
+
 			const result = await runAstEditOnce(multiTargets, resolvedSearchPath, globFilter, {
 				rewrites: normalizedRewrites,
 				dryRun: true,
@@ -351,6 +367,7 @@ export class AstEditTool implements AgentTool<typeof astEditSchema, AstEditToolD
 						for (const filePath of previewedFiles) {
 							await assertEditableFile(resolvePlanPath(this.session, filePath), filePath, this.session.settings);
 						}
+						await assertSingleFileReferenceRoot();
 						const applyResult = await runAstEditOnce(multiTargets, resolvedSearchPath, globFilter, {
 							rewrites: normalizedRewrites,
 							dryRun: false,

package/src/tools/ast-grep.ts

@@ -11,6 +11,7 @@ import astGrepDescription from "../prompts/tools/ast-grep.md" with { type: "text
 import { Ellipsis, fileHyperlink, renderStatusLine, renderTreeList, truncateToWidth } from "../tui";
 import { resolveFileDisplayMode } from "../utils/file-display-mode";
 import type { ToolSession } from ".";
+import { wrapUntrustedContent } from "./fetch";
 import { createFileRecorder, formatResultPath } from "./file-recorder";
 import { formatGroupedFiles } from "./grouped-file-output";
 import { formatMatchLine } from "./match-line-format";
@@ -221,7 +222,9 @@ export class AstGrepTool implements AgentTool<typeof astGrepSchema, AstGrepToolD
 				const parseMessage = cappedParseErrors.length
 					? `\n${formatParseErrors(cappedParseErrors, parseErrorsTotal).join("\n")}`
 					: "";
-				return toolResult(baseDetails).text(`${noMatchMessage}${parseMessage}`).done();
+				return toolResult(baseDetails)
+					.text(wrapUntrustedContent(`${noMatchMessage}${parseMessage}`))
+					.done();
 			}
 
 			const useHashLines = resolveFileDisplayMode(this.session).hashLines;
@@ -291,7 +294,9 @@ export class AstGrepTool implements AgentTool<typeof astGrepSchema, AstGrepToolD
 				outputLines.push("", ...formatParseErrors(cappedParseErrors, parseErrorsTotal));
 			}
 
-			return toolResult(details).text(outputLines.join("\n")).done();
+			return toolResult(details)
+				.text(wrapUntrustedContent(outputLines.join("\n")))
+				.done();
 		});
 	}
 }

package/src/tools/atomic-file-write.ts

@@ -25,10 +25,11 @@
  *
  * Destination symlinks are followed: the referent is replaced, the link stays.
  * The referent is re-resolved immediately before publication so a retargeted
- * link cannot silently repoint the write, and when the lexical destination
- * sits inside a session-scoped `gjc-local` root the resolved referent and its
- * parent must remain inside that root (a link there must not redirect the
- * write out of the trust boundary).
+ * link cannot silently repoint the write. When the lexical destination sits
+ * inside the active explicit artifacts local root (`<artifacts>/local`) or a
+ * session-scoped `gjc-local` root, the resolved referent and its parent must
+ * remain inside that root (a link there must not redirect the write out of
+ * the trust boundary).
  *
  * Staging uses exclusive create (`wx`) so a colliding leftover temp is never
  * truncated or unlinked; only the temp this call created is cleaned on failure.
@@ -44,6 +45,7 @@ import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
 import { hasFsCode, isEacces, isEisdir, isEnoent, isFsError } from "@gajae-code/utils";
+import { LocalProtocolHandler } from "../internal-urls/local-protocol";
 
 const TEMP_CREATE_ATTEMPTS = 8;
 const DEFAULT_FILE_MODE = 0o666;
@@ -111,9 +113,10 @@ export function formatFileWriteError(error: unknown, dest: string, options: { de
 export interface WriteFileAtomicallyOptions {
 	/**
 	 * Trusted root that a resolved symlink referent and its parent must not
-	 * leave. When omitted, the helper still enforces the session-scoped
-	 * `gjc-local` boundary implied by a lexical destination under
-	 * `<tmpdir>/gjc-local/<session-id>`.
+	 * leave. When omitted, a destination inside the active explicit artifacts
+	 * local root (`<artifacts>/local`) uses that root. Otherwise the helper
+	 * still enforces the session-scoped `gjc-local` boundary implied by a
+	 * lexical destination under `<tmpdir>/gjc-local/<session-id>`.
 	 */
 	trustBoundary?: string;
 	/** Platform override used by deterministic retry tests. */
@@ -170,11 +173,20 @@ function pathIsWithin(target: string, root: string): boolean {
 }
 
 async function realpathOrSelf(p: string): Promise<string> {
-	try {
-		return await fs.realpath(p);
-	} catch (error) {
-		if (!isEnoent(error)) throw error;
-		return path.resolve(p);
+	const resolved = path.resolve(p);
+	const missing: string[] = [];
+	let cursor = resolved;
+	for (;;) {
+		try {
+			const real = await fs.realpath(cursor);
+			return missing.length === 0 ? real : path.join(real, ...missing.reverse());
+		} catch (error) {
+			if (!isEnoent(error)) throw error;
+			const parent = path.dirname(cursor);
+			if (parent === cursor) return resolved;
+			missing.push(path.basename(cursor));
+			cursor = parent;
+		}
 	}
 }
 
@@ -193,6 +205,25 @@ function sessionLocalRootFor(lexicalDest: string): string | undefined {
 	return path.join(localParent, sessionSegment);
 }
 
+/**
+ * Active explicit artifacts root (`<artifacts>/local`) when `lexicalDest` is
+ * inside it. That root is not under `<tmpdir>/gjc-local`, so the tmp helper
+ * above would leave the write unbounded. Managed sessions keep the tmp root.
+ */
+function explicitLocalRootFor(lexicalDest: string): string | undefined {
+	const options = LocalProtocolHandler.resolveOptions();
+	if (!options || options.isManagedDestination?.()) return undefined;
+	const artifactsDir = options.getArtifactsDir?.();
+	if (!artifactsDir) return undefined;
+	const root = path.resolve(artifactsDir, "local");
+	if (!pathIsWithin(path.resolve(lexicalDest), root)) return undefined;
+	return root;
+}
+
+function trustBoundaryForDestination(lexicalDest: string): string | undefined {
+	return explicitLocalRootFor(lexicalDest) ?? sessionLocalRootFor(lexicalDest);
+}
+
 /**
  * Reject publication when the resolved referent's real parent (and therefore
  * the referent itself) leaves the trust boundary. The boundary root is
@@ -201,8 +232,8 @@ function sessionLocalRootFor(lexicalDest: string): string | undefined {
  * This must run before any directory is created. A dangling symlink inside a
  * trusted root resolves to a path outside it, so creating parents first would
  * let an attacker-selected directory tree be materialized outside the sandbox
- * before publication is refused. Missing ancestors therefore resolve
- * lexically (`realpathOrSelf` tolerates ENOENT) and are still boundary-checked.
+ * before publication is refused. A missing path is resolved through the
+ * nearest existing ancestor's realpath, then the missing suffix is appended.
  */
 async function assertWithinTrustBoundary(publishPath: string, trustBoundary: string): Promise<void> {
 	const boundary = path.resolve(trustBoundary);
@@ -502,7 +533,7 @@ export async function writeFileAtomically(
 	try {
 		const platform = options.platform ?? process.platform;
 		const sleep = options.sleep ?? (async (delayMs: number): Promise<void> => await Bun.sleep(delayMs));
-		const trustBoundary = options.trustBoundary ?? sessionLocalRootFor(dest);
+		const trustBoundary = options.trustBoundary ?? trustBoundaryForDestination(dest);
 		const resolved = await resolvePublishPath(dest);
 		publishPath = resolved.publishPath;
 		// Boundary first, then create parents. A dangling symlink inside a trusted

package/src/tools/auto-generated-guard.ts

@@ -36,6 +36,8 @@ const AUTO_GENERATED_HEADER_MARKERS: readonly RegExp[] = [
 	/\bcode\s+generated\s+by\s+[a-z0-9_.-]+/i,
 	/\bthis\s+file\s+was\s+automatically\s+generated\b/i,
 	new RegExp(`\\bgenerated\\s+by\\s+${KNOWN_GENERATOR_PATTERN}\\b`, "i"),
+	/\bgenerated\s+by\s+scripts\/[a-z0-9_./-]+/i,
+	/\bauto-generated\s+by\s+[a-z0-9_./-]+/i,
 ];
 
 type CommentStyle = "slash" | "hash" | "sql" | "html";
@@ -100,6 +102,7 @@ const AUTO_GENERATED_FILENAME_PATTERNS = [
 	/_pb2\.py$/,
 	/_pb2_grpc\.py$/,
 	/\.gen\.(go|ts|js|py)$/,
+	/\.generated\.ts$/,
 	/^generated\.(go|ts|js|py)$/,
 	/\.swagger\.json$/,
 	/\.openapi\.json$/,
@@ -209,8 +212,14 @@ function extractLeadingHeaderCommentText(content: string, commentStyles: readonl
  * Check if a file name indicates it might be auto-generated.
  * This is a quick pre-check before reading file content.
  */
+function guardFileName(filePath: string): string {
+	// resolvePlanPath keeps the platform separator. Anchored patterns such as
+	// zz_generated.* and generated.ts must see that basename on Windows too.
+	return path.win32.basename(filePath);
+}
+
 function isAutoGeneratedFileName(filePath: string): boolean {
-	const fileName = filePath.split("/").pop() ?? "";
+	const fileName = guardFileName(filePath);
 	return AUTO_GENERATED_FILENAME_PATTERNS.some(pattern => pattern.test(fileName));
 }
 
@@ -251,11 +260,14 @@ const autoGeneratedMap = new LRUCache<string, { marker: string | undefined }>({
 
 async function getAutoGeneratedMarker(filePath: string): Promise<string | undefined> {
 	if (isAutoGeneratedFileName(filePath)) {
-		return filePath.split("/").pop() ?? "";
+		return guardFileName(filePath);
 	}
 
 	const cached = autoGeneratedMap.get(filePath);
-	if (cached) return cached.marker;
+	// A cached miss only means the file was handwritten at the last read.
+	// An earlier patch entry can write a generated header before a later
+	// rename checks the same destination, so do not trust that miss.
+	if (cached && cached.marker !== undefined) return cached.marker;
 
 	let marker: string | undefined;
 	try {

package/src/tools/awaiting-input.ts

@@ -0,0 +1,114 @@
+/**
+ * Detects a running command that printed an interactive auth prompt and is now
+ * waiting for a human (browser sign-in URL or device code).
+ *
+ * The agent cannot see this on its own: the tool call is simply still running.
+ * The detector watches the streamed output tail and fires once per command when
+ * all of these hold:
+ *   - a known auth-prompt signature is present in the recent output tail;
+ *   - the command is still running (the caller stops feeding it on exit);
+ *   - no new output arrived for `quietMs` after the match.
+ *
+ * Requiring the quiet window keeps `cat README.md` or `grep` over docs that
+ * merely mention "enter the code" from firing: those commands exit or keep
+ * printing. The signal carries only the prompt kind, never the URL or code,
+ * because both are short-lived credential-equivalent values.
+ */
+import { stripVTControlCharacters } from "node:util";
+
+export type AwaitingInputKind = "browser_auth" | "device_code";
+
+export interface AwaitingInputSignal {
+	kind: AwaitingInputKind;
+	/** Epoch milliseconds when the quiet window elapsed after the match. */
+	detectedAt: number;
+}
+
+/** Cancels a scheduled callback. */
+export type CancelScheduled = () => void;
+
+export interface AwaitingInputDetectorOptions {
+	onDetect: (signal: AwaitingInputSignal) => void;
+	/** Quiet window after a match before the signal fires. */
+	quietMs?: number;
+	/** Injectable scheduler; defaults to `setTimeout`. */
+	schedule?: (callback: () => void, ms: number) => CancelScheduled;
+	/** Injectable clock; defaults to `Date.now`. */
+	now?: () => number;
+}
+
+export const AWAITING_INPUT_QUIET_MS = 3_000;
+
+/** Only the most recent output can be the prompt the process is blocked on. */
+const TAIL_CHARS = 2_048;
+
+const URL_PATTERN = /\bhttps?:\/\/\S+/i;
+
+const DEVICE_CODE_PATTERNS: readonly RegExp[] = [
+	/\bone-time code\b/i,
+	/\benter the code\b/i,
+	/\benter code\b/i,
+	/\buser_code=/i,
+];
+
+const BROWSER_AUTH_PATTERNS: readonly RegExp[] = [
+	/\bto authenticate,? visit\b/i,
+	/\blogin\.tailscale\.com\/a\//i,
+	/\bgo to the following link in your browser\b/i,
+	/\bopen the following url\b/i,
+	/\bvisit this url to authori[sz]e\b/i,
+	/\bopen (?:this|the) (?:url|link) in (?:a|your) browser\b/i,
+];
+
+/** Classify an output tail; `undefined` when it does not look like an auth prompt. */
+export function classifyAwaitingInput(tail: string): AwaitingInputKind | undefined {
+	const text = stripVTControlCharacters(tail);
+	if (DEVICE_CODE_PATTERNS.some(pattern => pattern.test(text))) return "device_code";
+	if (URL_PATTERN.test(text) && BROWSER_AUTH_PATTERNS.some(pattern => pattern.test(text))) return "browser_auth";
+	return undefined;
+}
+
+function defaultSchedule(callback: () => void, ms: number): CancelScheduled {
+	const timer = setTimeout(callback, ms);
+	return () => clearTimeout(timer);
+}
+
+export class AwaitingInputDetector {
+	readonly #onDetect: (signal: AwaitingInputSignal) => void;
+	readonly #quietMs: number;
+	readonly #schedule: (callback: () => void, ms: number) => CancelScheduled;
+	readonly #now: () => number;
+	#tail = "";
+	#cancel: CancelScheduled | undefined;
+	#done = false;
+
+	constructor(options: AwaitingInputDetectorOptions) {
+		this.#onDetect = options.onDetect;
+		this.#quietMs = options.quietMs ?? AWAITING_INPUT_QUIET_MS;
+		this.#schedule = options.schedule ?? defaultSchedule;
+		this.#now = options.now ?? Date.now;
+	}
+
+	/** Feed one streamed output chunk. Any new output restarts the quiet window. */
+	push(chunk: string): void {
+		if (this.#done || chunk.length === 0) return;
+		this.#cancel?.();
+		this.#cancel = undefined;
+		this.#tail = (this.#tail + chunk).slice(-TAIL_CHARS);
+		const kind = classifyAwaitingInput(this.#tail);
+		if (!kind) return;
+		this.#cancel = this.#schedule(() => {
+			this.#cancel = undefined;
+			if (this.#done) return;
+			this.#done = true;
+			this.#onDetect({ kind, detectedAt: this.#now() });
+		}, this.#quietMs);
+	}
+
+	/** Stop watching; the command exited or was folded. Never fires afterwards. */
+	dispose(): void {
+		this.#done = true;
+		this.#cancel?.();
+		this.#cancel = undefined;
+	}
+}