@gajae-code/coding-agent 0.18.12 → 0.19.0

package/src/config/model-resolver.ts

@@ -97,7 +97,7 @@ export async function refreshMissingQualifiedModelProviders(
 			.getRefreshableProviders()
 			.find(candidate => candidate.toLowerCase() === parsedSelector.provider.toLowerCase());
 		if (!provider || refreshedProviders.has(provider)) continue;
-		const availableModels = modelRegistry.getAvailable();
+		const availableModels = modelRegistry.getAvailable(credentialSessionId);
 		const rawModelId = selector.slice(selector.indexOf("/") + 1);
 		if (
 			resolveProviderModelReference(provider, rawModelId, availableModels) ||
@@ -1047,9 +1047,10 @@ export function resolveModelOverride(
 	settings?: Settings,
 	sessionId?: string,
 	aliasIntent?: "preset-equivalent" | "reject",
+	credentialSessionId?: string,
 ): { model?: Model<Api>; thinkingLevel?: ThinkingLevel; explicitThinkingLevel: boolean } {
 	if (modelPatterns.length === 0) return { explicitThinkingLevel: false };
-	const availableModels = modelRegistry.getAvailable();
+	const availableModels = modelRegistry.getAvailable(credentialSessionId);
 	const matchPreferences = { usageOrder: settings?.getStorage()?.getModelUsageOrder() };
 	for (const pattern of modelPatterns) {
 		const { model, thinkingLevel, explicitThinkingLevel } = resolveModelRoleValue(pattern, availableModels, {
@@ -1141,13 +1142,13 @@ async function resolveModelChainEntries(
 	startIndex: number,
 	circuitPolicy: { skipOpenCircuits: boolean },
 ): Promise<ModelChainResolution & { firstOpenCircuit?: { index: number; skipCount: number } }> {
-	const availableModels = modelRegistry.getAvailable();
-	const matchPreferences = { usageOrder: settings?.getStorage()?.getModelUsageOrder() };
-	const skips: Array<{ selector: string; reason: string }> = [];
-	const authFailedModels = new Set<string>();
 	const canonicalSessionId =
 		options?.canonicalSessionId === null ? undefined : (options?.canonicalSessionId ?? sessionId);
 	const credentialSessionId = options?.credentialSessionId ?? sessionId;
+	const availableModels = modelRegistry.getAvailable(credentialSessionId);
+	const matchPreferences = { usageOrder: settings?.getStorage()?.getModelUsageOrder() };
+	const skips: Array<{ selector: string; reason: string }> = [];
+	const authFailedModels = new Set<string>();
 	let firstOpenCircuit: { index: number; skipCount: number } | undefined;
 	for (let activeIndex = startIndex; activeIndex < modelPatterns.length; activeIndex += 1) {
 		const selector = modelPatterns[activeIndex];
@@ -1279,7 +1280,8 @@ export async function resolveModelOverrideWithAuthFallback(
 	parentFallbackSelector?: string;
 	skips: Array<{ selector: string; reason: string }>;
 }> {
-	const availableModels = modelRegistry.getAvailable();
+	const credentialSessionId = options?.credentialSessionId ?? authSessionId;
+	const availableModels = modelRegistry.getAvailable(credentialSessionId);
 	const matchPreferences = { usageOrder: settings?.getStorage()?.getModelUsageOrder() };
 	let requestedModel: Model<Api> | undefined;
 	let requestedResolution: ResolvedModelRoleValue | undefined;
@@ -1294,6 +1296,7 @@ export async function resolveModelOverrideWithAuthFallback(
 			settings,
 			undefined,
 			options?.aliasIntent,
+			credentialSessionId,
 		).model;
 		if (parentActiveModel) {
 			modelRegistry.seedCanonicalVariant?.(canonicalScope, parentActiveModel);
@@ -1315,7 +1318,7 @@ export async function resolveModelOverrideWithAuthFallback(
 			matchPreferences,
 			modelRegistry,
 			sessionId: canonicalScope,
-			credentialSessionId: authSessionId,
+			credentialSessionId,
 			aliasIntent: options?.aliasIntent,
 		});
 		if (!requestedModel && candidate.model) {
@@ -1335,7 +1338,7 @@ export async function resolveModelOverrideWithAuthFallback(
 				continue;
 			}
 		}
-		const key = await modelRegistry.getApiKey(candidate.model, authSessionId);
+		const key = await modelRegistry.getApiKey(candidate.model, credentialSessionId);
 		if (isAuthenticatedOrKeyless(key)) {
 			return { ...candidate, requestedModel: candidate.model, authFallbackUsed: false, activeIndex, skips };
 		}
@@ -1345,8 +1348,9 @@ export async function resolveModelOverrideWithAuthFallback(
 		) {
 			const equivalentRetry = await resolveModelChainWithAuth([pattern], modelRegistry, settings, authSessionId, {
 				managedFallback: options.managedFallback,
-				aliasIntent: options.aliasIntent,
+				aliasIntent: options?.aliasIntent,
 				canonicalSessionId: canonicalScope,
+				credentialSessionId,
 			});
 			if (equivalentRetry.model) {
 				return {
@@ -1367,10 +1371,17 @@ export async function resolveModelOverrideWithAuthFallback(
 		return { explicitThinkingLevel: false, requestedModel, authFallbackUsed: false, activeIndex, skips };
 	}
 	const fallback = parentActiveModelPattern
-		? resolveModelOverride([parentActiveModelPattern], modelRegistry, settings, authSessionId, options?.aliasIntent)
+		? resolveModelOverride(
+				[parentActiveModelPattern],
+				modelRegistry,
+				settings,
+				credentialSessionId,
+				options?.aliasIntent,
+				credentialSessionId,
+			)
 		: { explicitThinkingLevel: false };
 	if (fallback.model) {
-		const fallbackKey = await modelRegistry.getApiKey(fallback.model, authSessionId);
+		const fallbackKey = await modelRegistry.getApiKey(fallback.model, credentialSessionId);
 		if (isAuthenticatedOrKeyless(fallbackKey)) {
 			const isParentSubstitution = requestedModel === undefined || !modelsAreEqual(fallback.model, requestedModel);
 			return {
@@ -1452,8 +1463,9 @@ export async function resolveModelScope(
 	patterns: string[],
 	modelRegistry: Pick<ModelRegistry, "getAvailable" | "getCanonicalVariants">,
 	preferences?: ModelMatchPreferences,
+	credentialSessionId?: string,
 ): Promise<ScopedModel[]> {
-	const availableModels = modelRegistry.getAvailable();
+	const availableModels = modelRegistry.getAvailable(credentialSessionId);
 
 	const scopedModels: ScopedModel[] = [];
 	const addScopedModel = (selection: ScopedModel): void => {
@@ -1558,13 +1570,14 @@ export async function resolveAllowedModels(
 	modelRegistry: Pick<ModelRegistry, "getAvailable" | "getCanonicalVariants">,
 	settings: Settings | undefined,
 	preferences?: ModelMatchPreferences,
+	credentialSessionId?: string,
 ): Promise<Model<Api>[]> {
-	const available = modelRegistry.getAvailable();
+	const available = modelRegistry.getAvailable(credentialSessionId);
 	const patterns = settings?.get("enabledModels");
 	if (!patterns || patterns.length === 0) {
 		return available;
 	}
-	const scoped = await resolveModelScope(patterns, modelRegistry, preferences);
+	const scoped = await resolveModelScope(patterns, modelRegistry, preferences, credentialSessionId);
 	if (scoped.length === 0) {
 		return [];
 	}
@@ -1688,6 +1701,7 @@ export async function findInitialModel(options: {
 	defaultModelId?: string;
 	defaultThinkingSelector?: ThinkingLevel;
 	modelRegistry: InitialModelRegistry;
+	credentialSessionId?: string;
 }): Promise<InitialModelResult> {
 	const {
 		cliProvider,
@@ -1698,6 +1712,7 @@ export async function findInitialModel(options: {
 		defaultModelId,
 		defaultThinkingSelector,
 		modelRegistry,
+		credentialSessionId,
 	} = options;
 
 	let model: Model<Api> | undefined;
@@ -1705,7 +1720,11 @@ export async function findInitialModel(options: {
 
 	// 1. CLI args take priority
 	if (cliProvider && cliModel) {
-		const found = resolveProviderModelReference(cliProvider, cliModel, modelRegistry.getAvailable());
+		const found = resolveProviderModelReference(
+			cliProvider,
+			cliModel,
+			modelRegistry.getAvailable(credentialSessionId),
+		);
 
 		if (!found) {
 			console.error(chalk.red(`Model ${cliProvider}/${cliModel} not found`));
@@ -1730,7 +1749,11 @@ export async function findInitialModel(options: {
 
 	// 3. Try saved default from settings
 	if (defaultProvider && defaultModelId) {
-		const found = resolveProviderModelReference(defaultProvider, defaultModelId, modelRegistry.getAvailable());
+		const found = resolveProviderModelReference(
+			defaultProvider,
+			defaultModelId,
+			modelRegistry.getAvailable(credentialSessionId),
+		);
 
 		if (found) {
 			model = found;
@@ -1745,7 +1768,7 @@ export async function findInitialModel(options: {
 	}
 
 	// 4. Try first available model with valid API key
-	const availableModels = modelRegistry.getAvailable();
+	const availableModels = modelRegistry.getAvailable(credentialSessionId);
 
 	if (availableModels.length > 0) {
 		// Try to find a default model from known providers
@@ -1774,11 +1797,16 @@ export async function restoreModelFromSession(
 	currentModel: Model<Api> | undefined,
 	shouldPrintMessages: boolean,
 	modelRegistry: RestorableModelRegistry,
+	credentialSessionId?: string,
 ): Promise<{ model: Model<Api> | undefined; fallbackMessage: string | undefined }> {
-	const restoredModel = resolveProviderModelReference(savedProvider, savedModelId, modelRegistry.getAvailable());
+	const restoredModel = resolveProviderModelReference(
+		savedProvider,
+		savedModelId,
+		modelRegistry.getAvailable(credentialSessionId),
+	);
 
 	// Check if restored model exists and has a valid API key
-	const hasApiKey = restoredModel ? !!(await modelRegistry.getApiKey(restoredModel)) : false;
+	const hasApiKey = restoredModel ? !!(await modelRegistry.getApiKey(restoredModel, credentialSessionId)) : false;
 
 	if (restoredModel && hasApiKey) {
 		if (shouldPrintMessages) {
@@ -1806,7 +1834,7 @@ export async function restoreModelFromSession(
 	}
 
 	// Try to find any available model
-	const availableModels = modelRegistry.getAvailable();
+	const availableModels = modelRegistry.getAvailable(credentialSessionId);
 
 	if (availableModels.length > 0) {
 		// Try to find a default model from known providers

package/src/config/settings-schema.ts

@@ -505,6 +505,13 @@ export const SETTINGS_SCHEMA = {
 		description: "Grace period before a master-spawned child orphaned by confirmed master loss is closed.",
 		validate: (value: number) => Number.isSafeInteger(value) && value >= 60_000 && value <= 3_600_000,
 	},
+	"sdk.brokerAbandonedGraceMs": {
+		type: "number",
+		default: 120_000,
+		description:
+			"Grace before a detached broker with no client connection, no live session host, and no open spawn authority exits on its own. A supervised `gjc sdk broker run` service never reaps itself.",
+		validate: (value: number) => Number.isSafeInteger(value) && value >= 60_000 && value <= 3_600_000,
+	},
 
 	// Notifications (shared daemon with Telegram/Discord/Slack presentation adapters)
 	"notifications.enabled": { type: "boolean", default: false },
@@ -1803,7 +1810,7 @@ export const SETTINGS_SCHEMA = {
 			tab: "interaction",
 			label: "Prompt Suggestions",
 			description:
-				"Predict your likely next prompt after each turn (smol-model call) and show it as ghost text; Tab accepts",
+				"Predict your likely next prompt after each turn (one extra default-role model call) and show it as ghost text; Tab accepts",
 		},
 	},
 
@@ -3596,6 +3603,11 @@ export const SETTINGS_SCHEMA = {
 		default: [] as string[],
 	},
 
+	"mcp.discoveryDeferAutoload": {
+		type: "boolean",
+		default: false,
+	},
+
 	"mcp.notifications": {
 		type: "boolean",
 		default: false,

package/src/config/settings.ts

@@ -392,6 +392,8 @@ const GLOBAL_ONLY_SETTINGS = new Set<SettingPath>([
 	"telemetry.enabled",
 	// Destination of the operator Hindsight server. A project file must not redirect it.
 	"hindsight.apiUrl",
+	// Destination of generic remote compaction. A project file must not redirect the transcript POST.
+	"compaction.remoteEndpoint",
 	// Operator consent for repository skills. A project file must not flip it.
 	"skills.trustProjectSkills",
 	"skills.enablePiProject",

package/src/coordinator-mcp/server.ts

@@ -2157,19 +2157,54 @@ const eventWebhookTails = new Map<string, Promise<void>>();
 const eventWebhookStartupTails = new Map<string, Promise<void>>();
 const EVENT_WEBHOOK_ERROR_CAP = 240;
 
+const EVENT_WEBHOOK_DIAGNOSTIC_CAP = 512;
+
+/** Printable ASCII only, so a journal id cannot inject another diagnostic line. */
+function webhookEventDiagnosticToken(eventId: string, maxLength: number): string {
+	if (maxLength <= 0) return "";
+	let token = "";
+	for (let index = 0; index < eventId.length && token.length < maxLength; index += 1) {
+		const code = eventId.charCodeAt(index);
+		if (code >= 0x20 && code <= 0x7e) token += eventId[index];
+	}
+	return token;
+}
+
+/** Test-only access for generated normalization and truncation properties. */
+export function webhookEventDiagnosticTokenForTest(eventId: string, maxLength: number): string {
+	return webhookEventDiagnosticToken(eventId, maxLength);
+}
+
 async function appendEventWebhookDiagnostic(namespaceDir: string, eventId: string, error: unknown): Promise<void> {
 	const code =
 		error instanceof Error && /^[a-z0-9_]+$/.test(error.message)
 			? error.message.slice(0, EVENT_WEBHOOK_ERROR_CAP)
 			: "event_webhook_delivery_failed";
-	const line = `${new Date().toISOString()} event=${eventId} error=${code}\n`;
+	const timestamp = new Date().toISOString();
+	const prefix = `${timestamp} event=`;
+	const suffix = ` error=${code}\n`;
+	const token = webhookEventDiagnosticToken(eventId, EVENT_WEBHOOK_DIAGNOSTIC_CAP - prefix.length - suffix.length);
+	const line = `${prefix}${token}${suffix}`;
 	try {
-		await fs.appendFile(path.join(namespaceDir, "event-webhook-errors.log"), line.slice(0, 512), { mode: 0o600 });
+		await fs.appendFile(
+			path.join(namespaceDir, "event-webhook-errors.log"),
+			line.slice(0, EVENT_WEBHOOK_DIAGNOSTIC_CAP),
+			{ mode: 0o600 },
+		);
 	} catch {
 		// Diagnostics are best-effort; sink problems must never propagate upward.
 	}
 }
 
+/** Test-only access for diagnostic record boundary coverage. */
+export async function appendEventWebhookDiagnosticForTest(
+	namespaceDir: string,
+	eventId: string,
+	error: unknown,
+): Promise<void> {
+	await appendEventWebhookDiagnostic(namespaceDir, eventId, error);
+}
+
 function enqueueEventWebhook(namespaceDir: string, event: CoordinatorEvent): void {
 	const config = eventWebhookConfigs.get(namespaceDir);
 	if (config === null || config === undefined) return;

package/src/crash/sanitize.ts

@@ -99,8 +99,10 @@ export function sanitizeExternalCrashV1(text: string, maxBytes: number = CRASH_F
 	let value = text.replace(/\r\n?/g, "\n");
 	value = value.replace(OSC_PATTERN, " ").replace(CSI_PATTERN, "");
 	value = value.replace(CONTROL_PATTERN, "").replace(INVISIBLE_PATTERN, "");
+	// Redact each URL separately so an unquoted query value cannot absorb prose
+	// after the URL; then sanitize the remaining crash text normally.
+	value = value.replace(URL_PATTERN, match => sanitizeUrl(redactCrashSecrets(match)));
 	value = redactCrashSecrets(value);
-	value = value.replace(URL_PATTERN, match => sanitizeUrl(match));
 	value = replaceAbsolutePaths(value);
 	value = value.replace(UUID_PATTERN, "<uuid>");
 	value = value.replace(HEX_RUN_PATTERN, match => (/[a-fA-F]/.test(match) ? "<hex>" : "<num>"));

package/src/customization/import.ts

@@ -8,7 +8,8 @@
  * - Hooks: Claude `.claude/hooks/<pre|post>/<file>` and Codex flat
  *   `.codex/hooks/<phase>-<tool>.ts|js` conventions, normalized through the
  *   canonical hook IR (`normalizeDirectoryHook`, #4286/#4289) and written to
- *   the runtime-discovered `<root>/hooks/<pre|post>/` layout.
+ *   the canonical `<root>/hooks/<pre|post>/` layout. Project-scope hooks are
+ *   stored-only; ordinary sessions do not load repository hook modules.
  * - MCPs: `normalizeClaudeMcpJson` / `normalizeCodexMcpToml` plus
  *   `validateMCPCompatServer` (#4284 bounded compatibility adapters), merged
  *   through the canonical atomic config writer.
@@ -17,12 +18,16 @@
  * secret values live only in the separate `ImportPlan`. `applyImport` runs as
  * a validated transaction: every destination path is containment- and
  * symlink-checked before any write, destinations are revalidated against the
- * preview decisions, files are published with same-directory temp+rename, and
- * any failure restores exactly the files this transaction wrote (pre-existing
- * symlinks are never touched). Verification failures roll back too.
+ * preview decisions, and skill/hook files are published through a no-follow
+ * directory descriptor with same-directory temp+rename. Any failure restores
+ * exactly the files this transaction wrote (pre-existing symlinks are never
+ * touched). Verification failures roll back too.
  */
+import { dlopen, FFIType, read } from "bun:ffi";
 import type { Dirent } from "node:fs";
+import * as fsSync from "node:fs";
 import * as fs from "node:fs/promises";
+import * as os from "node:os";
 import * as path from "node:path";
 import { parseFrontmatter, tryParseJson } from "@gajae-code/utils";
 import { YAML } from "bun";
@@ -351,6 +356,11 @@ export async function buildImportPreview(options: BuildImportPreviewOptions): Pr
 	const entries: ImportPreviewEntry[] = [];
 	const payloads: (NormalizedPayload | undefined)[] = [];
 	const warnings: string[] = [];
+	if (surfaces.includes("hooks") && options.destinationScope === "project") {
+		warnings.push(
+			"Project-scope hooks are stored-only: ordinary sessions do not load repository hook modules. Import hooks into Global .gjc or configure an explicit hook path to activate them.",
+		);
+	}
 	const productName = productLabel(options.product);
 	const sourceLabel = `${productName} ${sourceScopeLabel(options.sourceScope)}`;
 
@@ -636,6 +646,9 @@ interface FileSnapshot {
 	path: string;
 	/** Previous content, or null when the file did not exist. */
 	previous: string | null;
+	/** Set when publication was bound to this directory descriptor. */
+	parentFd?: number;
+	name?: string;
 }
 
 interface PlannedFileWrite {
@@ -675,6 +688,13 @@ async function findSymlinkedAncestor(root: string, target: string): Promise<stri
 
 /** Remove stale staging temp files from an interrupted earlier apply. */
 async function sweepStagingTemps(dir: string): Promise<void> {
+	try {
+		const stat = await fs.lstat(dir);
+		// readdir follows a swapped directory symlink; never clean through one.
+		if (stat.isSymbolicLink() || !stat.isDirectory()) return;
+	} catch {
+		return;
+	}
 	let names: string[];
 	try {
 		names = await fs.readdir(dir);
@@ -687,6 +707,209 @@ async function sweepStagingTemps(dir: string): Promise<void> {
 	}
 }
 
+const { ENOENT, EEXIST, ELOOP, ENOTDIR } = os.constants.errno;
+const CLOEXEC = (fsSync.constants as { O_CLOEXEC?: number }).O_CLOEXEC ?? 0;
+const NOFOLLOW = fsSync.constants.O_NOFOLLOW ?? 0;
+const DIR_FLAGS = fsSync.constants.O_RDONLY | (fsSync.constants.O_DIRECTORY ?? 0) | NOFOLLOW | CLOEXEC;
+const READ_FLAGS = fsSync.constants.O_RDONLY | (fsSync.constants.O_NONBLOCK ?? 0) | NOFOLLOW | CLOEXEC;
+const WRITE_FLAGS = fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL | NOFOLLOW | CLOEXEC;
+const MAX_PINNED_IMPORT_PARENTS = 128;
+
+interface PinnedDestination {
+	fds: number[];
+	parentFd: number;
+	name: string;
+}
+
+type DirectoryOps = {
+	mkdirat: (dirfd: number, name: string, mode: number) => number;
+	openat: (dirfd: number, name: string, flags: number, mode: number) => number;
+	renameat: (fromfd: number, from: string, tofd: number, to: string) => number;
+	unlinkat: (dirfd: number, name: string, flags: number) => number;
+	errno: () => number;
+};
+
+let directoryOpsCache: DirectoryOps | undefined;
+
+/** POSIX only. Windows has no O_NOFOLLOW, so publication keeps the lexical recheck. */
+function pinnedPublicationAvailable(): boolean {
+	return (
+		process.platform !== "win32" &&
+		fsSync.constants.O_NOFOLLOW !== undefined &&
+		fsSync.constants.O_DIRECTORY !== undefined
+	);
+}
+
+function directoryOps(): DirectoryOps {
+	if (directoryOpsCache) return directoryOpsCache;
+	const darwin = process.platform === "darwin";
+	const lib = dlopen(darwin ? "/usr/lib/libSystem.B.dylib" : "libc.so.6", {
+		mkdirat: { args: [FFIType.i32, FFIType.cstring, FFIType.u32], returns: FFIType.i32 },
+		openat: { args: [FFIType.i32, FFIType.cstring, FFIType.i32, FFIType.u32], returns: FFIType.i32 },
+		renameat: { args: [FFIType.i32, FFIType.cstring, FFIType.i32, FFIType.cstring], returns: FFIType.i32 },
+		unlinkat: { args: [FFIType.i32, FFIType.cstring, FFIType.i32], returns: FFIType.i32 },
+		...(darwin
+			? { __error: { args: [], returns: FFIType.ptr } }
+			: { __errno_location: { args: [], returns: FFIType.ptr } }),
+	});
+	const symbols = lib.symbols as unknown as DirectoryOps & {
+		__error?: () => Parameters<typeof read.i32>[0];
+		__errno_location?: () => Parameters<typeof read.i32>[0];
+	};
+	directoryOpsCache = {
+		mkdirat: symbols.mkdirat,
+		openat: symbols.openat,
+		renameat: symbols.renameat,
+		unlinkat: symbols.unlinkat,
+		errno: () => read.i32(darwin ? symbols.__error!() : symbols.__errno_location!()),
+	};
+	return directoryOpsCache;
+}
+
+function closeRawFds(fds: number[]): void {
+	for (const fd of fds.splice(0).reverse()) fsSync.closeSync(fd);
+}
+
+function symlinkRefusal(location: string): Error {
+	return new Error(`refusing to write through symlinked ancestor: ${location}`);
+}
+
+/** Lexical shape of an import destination. Symlink checks are separate. */
+export function importDestinationShapeAllowed(root: string, target: string): boolean {
+	const relative = path.relative(root, path.dirname(target));
+	if (relative.startsWith("..") || path.isAbsolute(relative)) return false;
+	const segments = relative === "" ? [] : relative.split(path.sep);
+	return [...segments, path.basename(target)].every(isSafeName);
+}
+
+/** Walk from `root` with openat/mkdirat and retain only the final parent descriptor. */
+function pinImportParent(root: string, target: string): PinnedDestination {
+	if (!importDestinationShapeAllowed(root, target)) throw new Error(`refusing unsafe import destination: ${target}`);
+	const relative = path.relative(root, path.dirname(target));
+	const segments = relative === "" ? [] : relative.split(path.sep);
+	const name = path.basename(target);
+	const ops = directoryOps();
+	const fds: number[] = [];
+	try {
+		let parentFd: number;
+		try {
+			parentFd = fsSync.openSync(root, DIR_FLAGS);
+		} catch (error) {
+			const code = (error as NodeJS.ErrnoException).code;
+			if (code === "ELOOP" || code === "ENOTDIR") throw symlinkRefusal(root);
+			throw error;
+		}
+		fds.push(parentFd);
+		let cursor = root;
+		for (const segment of segments) {
+			cursor = path.join(cursor, segment);
+			let fd = ops.openat(parentFd, segment, DIR_FLAGS, 0);
+			if (fd < 0 && ops.errno() === ENOENT) {
+				if (ops.mkdirat(parentFd, segment, 0o700) < 0 && ops.errno() !== EEXIST) {
+					throw new Error(`cannot create import directory ${cursor}: errno ${ops.errno()}`);
+				}
+				fd = ops.openat(parentFd, segment, DIR_FLAGS, 0);
+			}
+			if (fd < 0) {
+				const err = ops.errno();
+				if (err === ELOOP || err === ENOTDIR) throw symlinkRefusal(cursor);
+				throw new Error(`cannot open import directory ${cursor}: errno ${err}`);
+			}
+			let isDirectory: boolean;
+			try {
+				isDirectory = fsSync.fstatSync(fd).isDirectory();
+			} catch (error) {
+				fsSync.closeSync(fd);
+				throw error;
+			}
+			if (!isDirectory) {
+				fsSync.closeSync(fd);
+				throw symlinkRefusal(cursor);
+			}
+			closeRawFds(fds);
+			fds.push(fd);
+			parentFd = fd;
+		}
+		const named = fsSync.lstatSync(path.dirname(target));
+		const opened = fsSync.fstatSync(parentFd);
+		if (named.isSymbolicLink() || !named.isDirectory() || named.dev !== opened.dev || named.ino !== opened.ino) {
+			throw symlinkRefusal(path.dirname(target));
+		}
+		return { fds, parentFd, name };
+	} catch (error) {
+		closeRawFds(fds);
+		throw error;
+	}
+}
+
+function readRegularAt(parentFd: number, name: string, lexicalPath: string): string | null {
+	const ops = directoryOps();
+	const fd = ops.openat(parentFd, name, READ_FLAGS, 0);
+	if (fd < 0) {
+		const err = ops.errno();
+		if (err === ENOENT) return null;
+		if (err === ELOOP || err === ENOTDIR) throw new Error(`refusing to write through symlink: ${lexicalPath}`);
+		throw new Error(`cannot read ${lexicalPath}: errno ${err}`);
+	}
+	try {
+		if (!fsSync.fstatSync(fd).isFile()) throw new Error(`not a regular file: ${lexicalPath}`);
+		return fsSync.readFileSync(fd, "utf-8");
+	} finally {
+		fsSync.closeSync(fd);
+	}
+}
+
+function writeRegularAt(parentFd: number, name: string, content: string, index: number, lexicalPath: string): void {
+	const ops = directoryOps();
+	const tmp = `.gjc-import-${process.pid}-${index}-${name}.tmp`;
+	const fd = ops.openat(parentFd, tmp, WRITE_FLAGS, 0o600);
+	if (fd < 0) throw new Error(`cannot stage import file ${lexicalPath}: errno ${ops.errno()}`);
+	try {
+		fsSync.writeFileSync(fd, content, "utf-8");
+		fsSync.fchmodSync(fd, 0o600);
+	} finally {
+		fsSync.closeSync(fd);
+	}
+	if (ops.renameat(parentFd, tmp, parentFd, name) < 0) {
+		const err = ops.errno();
+		ops.unlinkat(parentFd, tmp, 0);
+		throw new Error(`cannot publish import file ${lexicalPath}: errno ${err}`);
+	}
+}
+
+/** The lexical parent must still be the directory the descriptor published into. */
+function assertPinnedParentStillAt(parentFd: number, lexicalParent: string, lexicalPath: string): void {
+	let named: fsSync.Stats;
+	try {
+		named = fsSync.lstatSync(lexicalParent);
+	} catch {
+		throw new Error(`post-import verification failed: ${lexicalPath} was not persisted`);
+	}
+	const opened = fsSync.fstatSync(parentFd);
+	if (named.isSymbolicLink() || !named.isDirectory() || named.dev !== opened.dev || named.ino !== opened.ino) {
+		throw new Error(`post-import verification failed: ${lexicalPath} was not persisted`);
+	}
+	try {
+		const leaf = fsSync.lstatSync(lexicalPath);
+		if (leaf.isSymbolicLink() || !leaf.isFile()) {
+			throw new Error(`post-import verification failed: ${lexicalPath} was not persisted`);
+		}
+	} catch (error) {
+		if (error instanceof Error && error.message.startsWith("post-import verification failed:")) throw error;
+		throw new Error(`post-import verification failed: ${lexicalPath} was not persisted`);
+	}
+}
+
+function restoreRegularAt(parentFd: number, name: string, previous: string | null, lexicalPath: string): void {
+	if (previous === null) {
+		if (directoryOps().unlinkat(parentFd, name, 0) < 0 && directoryOps().errno() !== ENOENT) {
+			throw new Error(`cannot remove ${lexicalPath}: errno ${directoryOps().errno()}`);
+		}
+		return;
+	}
+	writeRegularAt(parentFd, name, previous, 1_000_000 + process.pid, lexicalPath);
+}
+
 /**
  * Apply a confirmed plan. The transaction contract:
  *
@@ -850,12 +1073,44 @@ export async function applyImport(plan: ImportPlan, options: { cwd: string }): P
 
 	// --- Phase 2: publication ------------------------------------------------
 	const snapshots: FileSnapshot[] = [];
+	const pins: PinnedDestination[] = [];
+	const pinsByParent = new Map<string, PinnedDestination>();
 	for (const dir of [destination.skillsDir, destination.hooksDir]) {
 		await sweepStagingTemps(dir).catch(() => {});
 	}
 
 	try {
+		if (fileWrites.length > 0 && pinnedPublicationAvailable()) {
+			// Scope root only. Children are created with mkdirat on the pinned fd.
+			await fs.mkdir(destination.root, { recursive: true, mode: 0o700 });
+			for (const write of fileWrites) {
+				const parentPath = path.dirname(write.path);
+				if (pinsByParent.has(parentPath)) continue;
+				if (pinsByParent.size >= MAX_PINNED_IMPORT_PARENTS) {
+					throw new Error(
+						`import batch exceeds the limit of ${MAX_PINNED_IMPORT_PARENTS} distinct destination directories`,
+					);
+				}
+				const pin = pinImportParent(destination.root, write.path);
+				pins.push(pin);
+				pinsByParent.set(parentPath, pin);
+			}
+			// Fail before publishing anything if pinned directories leave no
+			// descriptor available for staging or rollback.
+			const descriptorProbe = fsSync.openSync(os.devNull, fsSync.constants.O_RDONLY | CLOEXEC);
+			fsSync.closeSync(descriptorProbe);
+		}
 		for (const [index, write] of fileWrites.entries()) {
+			if (pinnedPublicationAvailable()) {
+				const pin = pinsByParent.get(path.dirname(write.path));
+				if (!pin) throw new Error(`cannot pin import destination directory: ${path.dirname(write.path)}`);
+				const previous = readRegularAt(pin.parentFd, pin.name, write.path);
+				writeRegularAt(pin.parentFd, pin.name, write.content, index, write.path);
+				snapshots.push({ path: write.path, previous, parentFd: pin.parentFd, name: pin.name });
+				continue;
+			}
+			const symlinked = await findSymlinkedAncestor(destination.root, write.path);
+			if (symlinked) throw new Error(`refusing to write through symlinked ancestor: ${symlinked}`);
 			await fs.mkdir(path.dirname(write.path), { recursive: true, mode: 0o700 });
 			const stat = await fs.lstat(write.path).catch(() => null);
 			if (stat?.isSymbolicLink()) throw new Error(`refusing to write through symlink: ${write.path}`);
@@ -891,8 +1146,18 @@ export async function applyImport(plan: ImportPlan, options: { cwd: string }): P
 
 		// --- Phase 3: verification (inside the transaction) ------------------
 		for (const write of fileWrites) {
-			const persisted = await readStructured(write.path);
-			if (persisted.kind !== "value" || persisted.content !== write.content) {
+			const pinned = snapshots.find(snapshot => snapshot.path === write.path && snapshot.parentFd !== undefined);
+			let persisted: string | null;
+			if (pinned?.parentFd !== undefined && pinned.name) {
+				assertPinnedParentStillAt(pinned.parentFd, path.dirname(write.path), write.path);
+				persisted = readRegularAt(pinned.parentFd, pinned.name, write.path);
+				assertPinnedParentStillAt(pinned.parentFd, path.dirname(write.path), write.path);
+			} else {
+				persisted = await readStructured(write.path).then(result =>
+					result.kind === "value" ? result.content : null,
+				);
+			}
+			if (persisted !== write.content) {
 				throw new Error(`post-import verification failed: ${write.path} was not persisted`);
 			}
 		}
@@ -910,7 +1175,9 @@ export async function applyImport(plan: ImportPlan, options: { cwd: string }): P
 		const rollbackErrors: string[] = [];
 		for (const snapshot of snapshots.reverse()) {
 			try {
-				if (snapshot.previous === null) {
+				if (snapshot.parentFd !== undefined && snapshot.name) {
+					restoreRegularAt(snapshot.parentFd, snapshot.name, snapshot.previous, snapshot.path);
+				} else if (snapshot.previous === null) {
 					await fs.rm(snapshot.path, { force: true });
 				} else {
 					const staged = `${snapshot.path}.gjc-rollback-${process.pid}.tmp`;
@@ -928,6 +1195,8 @@ export async function applyImport(plan: ImportPlan, options: { cwd: string }): P
 			`import failed and was rolled back: ${reason}` +
 				(rollbackErrors.length > 0 ? `; ROLLBACK ERRORS (manual repair needed): ${rollbackErrors.join("; ")}` : ""),
 		);
+	} finally {
+		for (const pin of pins) closeRawFds(pin.fds);
 	}
 
 	for (const { entry } of writable) {