@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/tools/browser/tab-worker.ts

@@ -3,7 +3,6 @@ import * as os from "node:os";
 import * as path from "node:path";
 
 import { untilAborted } from "@gajae-code/utils/abortable";
-import { Snowflake } from "@gajae-code/utils/snowflake";
 import type { HTMLElement } from "linkedom";
 import type {
 	Browser,
@@ -414,6 +413,31 @@ interface ActiveRun {
 	pendingTools: Map<string, { resolve(value: unknown): void; reject(error: Error): void }>;
 }
 
+async function writePrivateScreenshot(bytes: Uint8Array): Promise<string> {
+	// Random directory plus an exclusive create: a preexisting symlink under the
+	// shared temp directory is not opened, and the screenshot is not left world-readable.
+	// Create the temp root first: base created it with a recursive mkdir, and
+	// mkdtemp fails when that root does not exist yet. Do not change the root's mode.
+	const root = os.tmpdir();
+	await fs.promises.mkdir(root, { recursive: true });
+	const tempDir = await fs.promises.mkdtemp(path.join(root, "gjc-sshots-"));
+	try {
+		if (process.platform !== "win32") await fs.promises.chmod(tempDir, 0o700);
+		const dest = path.join(tempDir, "screenshot.png");
+		const handle = await fs.promises.open(dest, "wx", 0o600);
+		try {
+			await handle.writeFile(bytes);
+		} finally {
+			await handle.close();
+		}
+		if (process.platform !== "win32") await fs.promises.chmod(dest, 0o600);
+		return dest;
+	} catch (error) {
+		await fs.promises.rm(tempDir, { recursive: true, force: true });
+		throw error;
+	}
+}
+
 export class WorkerCore {
 	#transport: Transport;
 	#browser?: Browser;
@@ -852,20 +876,22 @@ export class WorkerCore {
 			{ maxWidth: 1024, maxHeight: 1024, maxBytes: 150 * 1024, jpegQuality: 70 },
 		);
 		const explicitPath = opts.save ? resolveTabWorkerPath(opts.save, session.cwd) : undefined;
-
-		const dest =
-			explicitPath ??
-			(session.browserScreenshotDir
-				? path.join(
-						session.browserScreenshotDir,
-						`screenshot-${new Date().toISOString().replace(/[:.]/g, "-").slice(0, -1)}.png`,
-					)
-				: path.join(os.tmpdir(), `gjc-sshots-${Snowflake.next()}.png`));
-		await fs.promises.mkdir(path.dirname(dest), { recursive: true });
-		const saveFullRes = !!(explicitPath || session.browserScreenshotDir);
+		const configuredDir = session.browserScreenshotDir;
+		const saveFullRes = !!(explicitPath || configuredDir);
 		const savedBuffer = saveFullRes ? buffer : resized.buffer;
 		const savedMimeType = saveFullRes ? "image/png" : resized.mimeType;
-		await Bun.write(dest, savedBuffer);
+		// Caller-chosen destinations stay as they were. Only the shared temp
+		// fallback is an exclusive private file: a preexisting symlink at the old
+		// predictable name is not opened, and the bytes are not left world-readable.
+		const dest = explicitPath
+			? explicitPath
+			: configuredDir
+				? path.join(configuredDir, `screenshot-${new Date().toISOString().replace(/[:.]/g, "-").slice(0, -1)}.png`)
+				: await writePrivateScreenshot(savedBuffer);
+		if (explicitPath || configuredDir) {
+			await fs.promises.mkdir(path.dirname(dest), { recursive: true });
+			await Bun.write(dest, savedBuffer);
+		}
 		const info: ScreenshotResult = {
 			dest,
 			mimeType: savedMimeType,

package/src/tools/browser.ts

@@ -10,8 +10,9 @@ import { assertLoopbackCdpUrl } from "./browser/cdp-url";
 import { isChromeProfileExecutableForLaunch, isEdgeExecutable, resolveSystemChromeForProfile } from "./browser/launch";
 import { chromeUserDataRoots, type DiscoveryEnv, defaultDiscoveryEnv } from "./browser/profile-discovery";
 import { acquireBrowser, type BrowserHandle, type BrowserKind, type BrowserKindTag } from "./browser/registry";
-import type { Observation, ScreenshotResult } from "./browser/tab-protocol";
+import type { Observation, RunResultOk, ScreenshotResult } from "./browser/tab-protocol";
 import { acquireTab, dropHeadlessTabs, getTab, releaseAllTabs, releaseTab, runInTab } from "./browser/tab-supervisor";
+import { wrapUntrustedContent } from "./fetch";
 import type { OutputMeta } from "./output-meta";
 import { resolveToCwd } from "./path-utils";
 import { ToolAbortError, ToolError, throwIfAborted } from "./tool-errors";
@@ -392,8 +393,8 @@ export class BrowserTool implements AgentTool<typeof browserSchema, BrowserToolD
 		const verb = result.created ? "Opened" : "Reused";
 		const lines = [
 			`${verb} tab ${JSON.stringify(name)} on ${describeBrowser(browser)}`,
-			`URL: ${url}`,
-			title ? `Title: ${title}` : null,
+			`URL: ${frameBrowserPageText(url)}`,
+			title ? `Title: ${frameBrowserPageText(title)}` : null,
 		].filter((l): l is string => typeof l === "string");
 		details.result = lines.join("\n");
 		return toolResult(details).text(lines.join("\n")).done();
@@ -446,9 +447,9 @@ export class BrowserTool implements AgentTool<typeof browserSchema, BrowserToolD
 
 		if (screenshots.length) details.screenshots = screenshots;
 
-		const content = [...displays];
+		const content = frameBrowserPageDisplays(displays);
 		if (returnValue !== undefined) {
-			content.push({ type: "text", text: stringifyReturnValue(returnValue) });
+			content.push({ type: "text", text: frameBrowserPageText(stringifyReturnValue(returnValue)) });
 		}
 		if (!content.length) {
 			content.push({ type: "text", text: `Ran code on tab ${JSON.stringify(name)}` });
@@ -496,9 +497,9 @@ export class BrowserTool implements AgentTool<typeof browserSchema, BrowserToolD
 		});
 
 		if (screenshots.length) details.screenshots = screenshots;
-		const content = [...displays];
+		const content = frameBrowserPageDisplays(displays);
 		if (returnValue !== undefined) {
-			content.push({ type: "text", text: stringifyReturnValue(returnValue) });
+			content.push({ type: "text", text: frameBrowserPageText(stringifyReturnValue(returnValue)) });
 		}
 		if (!content.length) {
 			content.push({ type: "text", text: `Ran ${steps.length} action(s) on tab ${JSON.stringify(name)}` });
@@ -549,6 +550,15 @@ function sameBrowserKind(a: BrowserKind, b: BrowserKind): boolean {
 	return false;
 }
 
+/** Page URL, title, extract/observe text, and script return values are external content. */
+function frameBrowserPageText(text: string): string {
+	return wrapUntrustedContent(text);
+}
+
+function frameBrowserPageDisplays(displays: RunResultOk["displays"]): RunResultOk["displays"] {
+	return displays.map(block => (block.type === "text" ? { ...block, text: frameBrowserPageText(block.text) } : block));
+}
+
 /** Max chars of a browser return value surfaced into the tool result (F22). */
 const MAX_BROWSER_RETURN_CHARS = 256 * 1024;
 

package/src/tools/cron.ts

@@ -443,7 +443,16 @@ function toCronListJobDetails(snapshot: CronJobSnapshot): CronListJobDetails {
 }
 
 function formatCronFireContent(snapshot: CronJobSnapshot): string {
-	return `<task-notification>\nScheduled task ${snapshot.id} fired (${snapshot.humanSchedule}).\n\n${snapshot.prompt}\n</task-notification>`;
+	// A fired cron prompt is an instruction to execute, not a notification to
+	// acknowledge. Wrapping it in a notification-only envelope made models
+	// restate the prompt and end the turn without calling a tool.
+	return [
+		"<system-reminder>",
+		`Scheduled task ${snapshot.id} fired (${snapshot.humanSchedule}). The text below is this turn's task instruction: execute it now, using tools as needed. Do not merely restate, summarize, or acknowledge it.`,
+		"</system-reminder>",
+		"",
+		snapshot.prompt,
+	].join("\n");
 }
 
 function deliverCronFire(record: CronScheduleRecord): Promise<void> | undefined {

package/src/tools/debug.ts

@@ -466,8 +466,8 @@ function buildOutcomeText(outcome: DapContinueOutcome, timeoutSec: number, verb:
 	return lines.join("\n");
 }
 
-function getConfiguredAdapters(cwd: string): string {
-	const adapters = getAvailableAdapters(cwd).map(adapter => adapter.name);
+function getConfiguredAdapters(cwd: string, trustCwds?: readonly string[]): string {
+	const adapters = getAvailableAdapters(cwd, trustCwds).map(adapter => adapter.name);
 	return adapters.length > 0 ? adapters.join(", ") : "none";
 }
 async function validateLaunchProgram(program: string, cwd: string): Promise<void> {
@@ -637,6 +637,7 @@ export class DebugTool implements AgentTool<typeof debugSchema, DebugToolDetails
 		const combinedSignal = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
 		const details: DebugToolDetails = { action: params.action, success: true };
 		const result = toolResult(details);
+		const trustCwds = [this.session.cwd];
 		switch (params.action) {
 			case "launch": {
 				if (!params.program) {
@@ -645,14 +646,14 @@ export class DebugTool implements AgentTool<typeof debugSchema, DebugToolDetails
 				const commandCwd = params.cwd ? resolveToCwd(params.cwd, this.session.cwd) : this.session.cwd;
 				const program = resolveToCwd(params.program, commandCwd);
 				await validateLaunchProgram(program, commandCwd);
-				const adapter = selectLaunchAdapter(program, commandCwd, params.adapter);
+				const adapter = selectLaunchAdapter(program, commandCwd, params.adapter, trustCwds);
 				if (!adapter) {
 					throw new ToolError(
-						`No debugger adapter available. Installed adapters: ${getConfiguredAdapters(commandCwd)}`,
+						`No debugger adapter available. Installed adapters: ${getConfiguredAdapters(commandCwd, trustCwds)}`,
 					);
 				}
 				const snapshot = await dapSessionManager.launch(
-					{ adapter, program, args: params.args, cwd: commandCwd },
+					{ adapter, program, args: params.args, cwd: commandCwd, workspace: this.session.cwd },
 					combinedSignal,
 					timeoutSec * 1000,
 				);
@@ -665,14 +666,21 @@ export class DebugTool implements AgentTool<typeof debugSchema, DebugToolDetails
 					throw new ToolError("attach requires pid or port");
 				}
 				const commandCwd = params.cwd ? resolveToCwd(params.cwd, this.session.cwd) : this.session.cwd;
-				const adapter = selectAttachAdapter(commandCwd, params.adapter, params.port);
+				const adapter = selectAttachAdapter(commandCwd, params.adapter, params.port, trustCwds);
 				if (!adapter) {
 					throw new ToolError(
-						`No debugger adapter available. Installed adapters: ${getConfiguredAdapters(commandCwd)}`,
+						`No debugger adapter available. Installed adapters: ${getConfiguredAdapters(commandCwd, trustCwds)}`,
 					);
 				}
 				const snapshot = await dapSessionManager.attach(
-					{ adapter, cwd: commandCwd, pid: params.pid, port: params.port, host: params.host },
+					{
+						adapter,
+						cwd: commandCwd,
+						workspace: this.session.cwd,
+						pid: params.pid,
+						port: params.port,
+						host: params.host,
+					},
 					combinedSignal,
 					timeoutSec * 1000,
 				);

package/src/tools/descriptors.test.ts

@@ -35,6 +35,7 @@ function makeSession(overrides: Record<string, unknown> = {}): any {
 		"astGrep.enabled": true,
 		"astEdit.enabled": true,
 		"renderMermaid.enabled": true,
+		"reportIssue.enabled": true,
 		"web_search.enabled": true,
 		"calc.enabled": true,
 		"skill.enabled": true,
@@ -128,6 +129,7 @@ describe("tool descriptor compatibility gate", () => {
 			"skill",
 			"goal",
 			"move_session",
+			"report_issue",
 		];
 		expect(Object.keys(BUILTIN_TOOLS)).toEqual(expectedBuiltin);
 		expect(Object.keys(BUILTIN_TOOL_DESCRIPTORS)).toEqual(expectedBuiltin);
@@ -291,6 +293,7 @@ describe("tool descriptor compatibility gate", () => {
 			"astGrep.enabled": false,
 			"astEdit.enabled": false,
 			"renderMermaid.enabled": false,
+			"reportIssue.enabled": false,
 			"web_search.enabled": false,
 			"calc.enabled": false,
 			"skill.enabled": false,
@@ -313,6 +316,7 @@ describe("tool descriptor compatibility gate", () => {
 			"ast_grep",
 			"ast_edit",
 			"render_mermaid",
+			"report_issue",
 			"web_search",
 			"calc",
 			"skill",
@@ -961,6 +965,46 @@ describe("tool descriptor compatibility gate", () => {
 		expect((normalizedBisect.parameters as any).properties?._i).toBeUndefined();
 		expect((normalizedWrite.parameters as any).properties?._i).toBeDefined();
 	});
+	for (const staleOutcome of ["resolved", "rejected"] as const) {
+		test(`session move invalidation keeps a newer load when the old load ${staleOutcome}`, async () => {
+			const first = Promise.withResolvers<AgentTool>();
+			const second = Promise.withResolvers<AgentTool>();
+			const oldTool = syntheticTool();
+			const newTool = syntheticTool();
+			let loads = 0;
+			const session = makeSession();
+			const descriptor: ToolDescriptor = {
+				metadata: { name: "synthetic" },
+				presentation: { label: "Synthetic" },
+				isAvailable: () => true,
+				load: () => (++loads === 1 ? first.promise : second.promise),
+			};
+			const lazy = new LazyAgentTool(descriptor, undefined, () => descriptor.load(session), session);
+			const oldLoad = lazy.materialize().then(
+				tool => ({ tool, error: undefined }),
+				error => ({ tool: undefined, error }),
+			);
+			await Promise.resolve();
+			expect(loads).toBe(1);
+			lazy.invalidateForSessionMove();
+			const newLoad = lazy.materialize();
+			await Promise.resolve();
+			expect(loads).toBe(2);
+			if (staleOutcome === "resolved") first.resolve(oldTool);
+			else first.reject(new Error("old context load failed"));
+			const oldResult = await oldLoad;
+			if (staleOutcome === "resolved") expect(oldResult.tool).toBe(oldTool);
+			else expect(String(oldResult.error)).toContain("old context load failed");
+			const joinedLoad = lazy.materialize();
+			await Promise.resolve();
+			expect(loads).toBe(2);
+			second.resolve(newTool);
+			expect(await newLoad).toBe(newTool);
+			expect(await joinedLoad).toBe(newTool);
+			expect(await lazy.materialize()).toBe(newTool);
+		});
+	}
+
 	test("concurrent lazy first use shares one load and cleanup registration", async () => {
 		let loads = 0;
 		let cleanupRegistrations = 0;

package/src/tools/descriptors.ts

@@ -84,6 +84,9 @@ export class LazyAgentTool implements AgentTool<any, any, any> {
 	#loader?: () => ToolDescriptorLoadResult;
 	#session?: ToolSession;
 	#loadPromise?: Promise<AgentTool<any, any, any>>;
+	#loadGeneration = 0;
+	#loadToken?: object;
+	#expectedCwd?: string;
 
 	constructor(
 		descriptor: ToolDescriptor,
@@ -97,9 +100,31 @@ export class LazyAgentTool implements AgentTool<any, any, any> {
 		this.#session = session;
 	}
 
+	/** Clear a session-bound materialization after its owning session moves. */
+	invalidateForSessionMove(expectedCwd?: string): void {
+		this.#loadGeneration++;
+		this.#tool = undefined;
+		this.#loadPromise = undefined;
+		this.#loadToken = undefined;
+		this.#expectedCwd = expectedCwd;
+		if (!this.#loader && this.#session) {
+			const session = this.#session;
+			this.#loader = () => this.descriptor.load(session);
+		}
+	}
+
 	async #get(): Promise<AgentTool<any, any, any>> {
+		const sessionCwd = this.#session?.cwd;
+		if (this.#expectedCwd !== undefined && sessionCwd !== this.#expectedCwd) {
+			throw new ToolError(
+				`Tool "${this.descriptor.metadata.name}" session cwd changed outside a committed move (expected ${this.#expectedCwd}, got ${sessionCwd ?? "unknown"})`,
+			);
+		}
 		if (this.#tool) return this.#tool;
 		if (!this.#loadPromise) {
+			const generation = this.#loadGeneration;
+			const token = {};
+			this.#loadToken = token;
 			const load = this.#loader;
 			this.#loadPromise = Promise.resolve()
 				.then(() => {
@@ -108,11 +133,14 @@ export class LazyAgentTool implements AgentTool<any, any, any> {
 				})
 				.then(tool => {
 					if (!tool) throw new ToolError(`Tool "${this.descriptor.metadata.name}" failed to load`);
-					this.#tool = tool;
+					if (generation === this.#loadGeneration && this.#loadToken === token) this.#tool = tool;
 					return tool;
 				})
 				.catch(error => {
-					this.#loadPromise = undefined;
+					if (generation === this.#loadGeneration && this.#loadToken === token) {
+						this.#loadPromise = undefined;
+						this.#loadToken = undefined;
+					}
 					if (error instanceof ToolError) throw error;
 					throw new ToolError(
 						`Tool "${this.descriptor.metadata.name}" failed to load implementation: ${error instanceof Error ? error.message : String(error)}`,
@@ -123,10 +151,14 @@ export class LazyAgentTool implements AgentTool<any, any, any> {
 		return this.#loadPromise;
 	}
 
-	/** Materialize this facade for contract tests without exposing it in production dispatch. */
-	async materializeForTests(): Promise<AgentTool<any, any, any>> {
-		return await this.#get();
-	}
+	/**
+	 * Resolve the underlying implementation. Pre-dispatch hooks (TTSR `astCondition`
+	 * matching) call this to read implementation-only members such as the matcher
+	 * hooks before the first `execute` would otherwise load the tool.
+	 * An arrow property (like `execute`) so session guard proxies can forward it
+	 * without losing access to the private loader state.
+	 */
+	readonly materialize = async (): Promise<AgentTool<any, any, any>> => await this.#get();
 
 	get name(): string {
 		return this.#tool?.name ?? this.descriptor.metadata.name;
@@ -219,6 +251,14 @@ export class LazyAgentTool implements AgentTool<any, any, any> {
 	get mode() {
 		return (this.#tool as any)?.mode;
 	}
+	get matcherDigest() {
+		const digest = this.#tool?.matcherDigest;
+		return digest ? digest.bind(this.#tool) : undefined;
+	}
+	get matcherEntries() {
+		const entries = this.#tool?.matcherEntries;
+		return entries ? entries.bind(this.#tool) : undefined;
+	}
 
 	readonly execute: AgentTool<any, any, any>["execute"] = async (...args) => {
 		const tool = await this.#get();
@@ -270,6 +310,7 @@ function availableFor(name: string, session: ToolSession, context = defaultAvail
 	if (name === "ast_grep") return Boolean(session.settings.get("astGrep.enabled"));
 	if (name === "ast_edit") return Boolean(session.settings.get("astEdit.enabled"));
 	if (name === "render_mermaid") return Boolean(session.settings.get("renderMermaid.enabled"));
+	if (name === "report_issue") return Boolean(session.settings.get("reportIssue.enabled"));
 	if (name === "web_search") return Boolean(session.settings.get("web_search.enabled"));
 	if (name === "search_tool_bm25") return context.discoveryActive ?? resolveDiscoveryActive(session);
 	if (name === "calc") return Boolean(session.settings.get("calc.enabled"));
@@ -389,6 +430,8 @@ const loaders: Record<string, Loader> = {
 		cached("goal", () => import("../goals/tools/goal-tool")).then(module => new module.GoalTool(session)),
 	move_session: session =>
 		cached("move_session", () => import("./move-session")).then(module => new module.MoveSessionTool(session)),
+	report_issue: session =>
+		cached("report_issue", () => import("./report-issue")).then(module => new module.ReportIssueTool(session)),
 	yield: session => cached("yield", () => import("./yield")).then(module => new module.YieldTool(session)),
 	report_finding: _session => cached("review", () => import("./review")).then(module => module.reportFindingTool),
 	resolve: session => cached("resolve", () => import("./resolve")).then(module => new module.ResolveTool(session)),
@@ -481,6 +524,7 @@ const names: Array<[name: string, label: string, summary: string | undefined, lo
 		["skill", "Skill", "Chain into another available skill", "essential"],
 		["goal", "Goal", undefined, "essential"],
 		["move_session", "Move Session", undefined, "essential"],
+		["report_issue", "Report Issue", "Record a tool that behaved inconsistently with its description", "essential"],
 	];
 
 const sessionDescriptions: Readonly<Record<string, ToolDescriptorMetadata["descriptionForSession"]>> = {

package/src/tools/eval.ts

@@ -139,6 +139,18 @@ export interface EvalToolOptions {
 	proxyExecutor?: EvalProxyExecutor;
 }
 
+/**
+ * In-process eval is not a shell command, so a bash allowlist cannot authorize it.
+ * The same flags that turn the bash tool's allowlist on refuse eval outright.
+ * Blank prefixes match `checkBashAllowedPrefixes`: they do not restrict.
+ */
+function bashRestrictionBlocksEval(
+	session: Pick<ToolSession, "bashAllowedPrefixes" | "bashRestrictionProfile">,
+): boolean {
+	if (session.bashRestrictionProfile === "read-only") return true;
+	return (session.bashAllowedPrefixes ?? []).some(prefix => prefix.trim().length > 0);
+}
+
 interface ResolvedBackend {
 	backend: ExecutorBackend;
 	notice?: string;
@@ -225,6 +237,9 @@ export class EvalTool implements AgentTool<typeof evalSchema> {
 		onUpdate?: AgentToolUpdateCallback,
 		_ctx?: AgentToolContext,
 	): Promise<AgentToolResult<EvalToolDetails | undefined>> {
+		if (this.session && bashRestrictionBlocksEval(this.session)) {
+			throw new ToolError("Eval is unavailable while this session's bash allowlist or read-only profile is active.");
+		}
 		if (this.#proxyExecutor) {
 			return this.#proxyExecutor(params, signal);
 		}

package/src/tools/fetch.ts

@@ -1,3 +1,5 @@
+import { randomUUID } from "node:crypto";
+import * as nodeFs from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type { AgentToolResult } from "@gajae-code/agent-core";
@@ -677,12 +679,13 @@ async function handleSpecialUrls(
 	timeout: number,
 	signal: AbortSignal | undefined,
 	storage: AgentStorage | null,
+	settings: Settings,
 ): Promise<FetchRenderResult | null> {
 	for (const handler of getSpecialHandlers()) {
 		if (signal?.aborted) {
 			throw new ToolAbortError();
 		}
-		const result = await handler(url, timeout, signal, storage);
+		const result = await handler(url, timeout, signal, storage, settings);
 		if (result) return result;
 	}
 	return null;
@@ -766,7 +769,7 @@ async function renderUrl(
 
 	// Step 1: Try special handlers for known sites (unless raw mode)
 	if (!raw) {
-		const specialResult = await handleSpecialUrls(url, timeout, signal, storage);
+		const specialResult = await handleSpecialUrls(url, timeout, signal, storage, settings);
 		if (specialResult) return specialResult;
 	}
 
@@ -1384,10 +1387,93 @@ async function materializeReadUrlCacheEntry(
 	return null;
 }
 
+const ARTIFACT_NOFOLLOW = process.platform === "win32" ? 0 : (nodeFs.constants.O_NOFOLLOW ?? 0);
+
+async function unlinkOwnedStaging(staging: string, dev: bigint, ino: bigint): Promise<void> {
+	try {
+		const stat = await fs.lstat(staging, { bigint: true });
+		if (!stat.isFile() || stat.isSymbolicLink() || stat.dev !== dev || stat.ino !== ino) return;
+		await fs.unlink(staging);
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+	}
+}
+
+/**
+ * Publish text at an explicit artifact path the way `ArtifactManager.save` does:
+ * a temp file opened with `O_NOFOLLOW` and mode 0600, then rename. A symlink is
+ * not followed. A pre-existing regular file is replaced, so mode 0644 is not kept.
+ */
+export async function publishExplicitArtifactText(destination: string, text: string): Promise<void> {
+	const bytes = Buffer.from(text, "utf8");
+	const parent = path.dirname(destination);
+	// Bun.write created a missing parent. Match that when the allocated path's
+	// directory does not exist yet.
+	try {
+		await fs.lstat(parent);
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+		await fs.mkdir(parent, { recursive: true, mode: 0o700 });
+	}
+	// Keep the staging component a fixed length. A destination basename near NAME_MAX
+	// plus a UUID would make the temp name longer than the filesystem allows.
+	const staging = path.join(parent, `.artifact-${randomUUID()}.staging`);
+	let handle: fs.FileHandle | undefined;
+	let stagedDev: bigint | undefined;
+	let stagedIno: bigint | undefined;
+	let published = false;
+	try {
+		handle = await fs.open(
+			staging,
+			nodeFs.constants.O_CREAT | nodeFs.constants.O_EXCL | nodeFs.constants.O_WRONLY | ARTIFACT_NOFOLLOW,
+			0o600,
+		);
+		const opened = await handle.stat({ bigint: true });
+		stagedDev = opened.dev;
+		stagedIno = opened.ino;
+		if (process.platform !== "win32") await handle.chmod(0o600);
+		await handle.writeFile(bytes);
+		await handle.sync();
+		const staged = await handle.stat({ bigint: true });
+		if (process.platform !== "win32" && (Number(staged.mode) & 0o777) !== 0o600) {
+			throw new Error("artifact_publish_mode");
+		}
+		await handle.close();
+		handle = undefined;
+
+		let existing: nodeFs.Stats | undefined;
+		try {
+			existing = await fs.lstat(destination);
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+		}
+		if (existing?.isSymbolicLink()) throw new Error("artifact_destination_symlink");
+		if (existing && !existing.isFile()) throw new Error("artifact_destination_not_file");
+
+		await fs.rename(staging, destination);
+		const named = await fs.lstat(destination, { bigint: true });
+		if (
+			!named.isFile() ||
+			named.isSymbolicLink() ||
+			named.dev !== stagedDev ||
+			named.ino !== stagedIno ||
+			(process.platform !== "win32" && (Number(named.mode) & 0o777) !== 0o600)
+		) {
+			throw new Error("artifact_destination_identity_changed");
+		}
+		published = true;
+	} finally {
+		if (handle) await handle.close().catch(() => undefined);
+		if (!published && stagedDev !== undefined && stagedIno !== undefined) {
+			await unlinkOwnedStaging(staging, stagedDev, stagedIno);
+		}
+	}
+}
+
 async function persistReadUrlArtifact(session: ToolSession, output: string): Promise<string | undefined> {
 	const { path: artifactPath, id } = (await session.allocateOutputArtifact?.("read")) ?? {};
 	if (!artifactPath) return undefined;
-	await Bun.write(artifactPath, wrapUntrustedContent(output));
+	await publishExplicitArtifactText(artifactPath, wrapUntrustedContent(output));
 	return id;
 }
 
@@ -1474,7 +1560,10 @@ export const WRAP_PREFIX_CHARS = `${UNTRUSTED_CONTENT_OPEN}\n`.length;
 const WRAP_SUFFIX = `\n${UNTRUSTED_CONTENT_CLOSE}`;
 
 export function escapeUntrustedContent(content: string): string {
-	return content.replace(/<\/untrusted-content>/gi, "&lt;/untrusted-content>");
+	// HTML and XML accept whitespace between the tag name and ">".
+	return content
+		.replace(/<\/untrusted-content>/gi, "&lt;/untrusted-content>")
+		.replace(/<\/untrusted-content[ \t\n\r\f]+>/gi, "&lt;/untrusted-content>");
 }
 
 export function wrapUntrustedContent(content: string): string {