@gajae-code/coding-agent 0.18.12 → 0.19.0

package/src/customization/inventory.ts

@@ -6,9 +6,10 @@
  *   discovery/policy model (trust, include/ignore, disabledExtensions,
  *   bundled-name protection). A narrow supplemental scan flags SKILL.md files
  *   the management loader rejects as `invalid` rows.
- * - Hooks: canonical `<root>/hooks/<pre|post>/` layout with the runtime's
- *   project-first, first-wins dedupe key (`<type>:<tool>:<name>`); losers are
- *   shown as `shadowed`.
+ * - Hooks: canonical `<root>/hooks/<pre|post>/` layout. Project hooks are
+ *   stored-only and do not shadow user hooks because sessions never load
+ *   repository hook modules. User-scope collisions follow the runtime's
+ *   first-wins dedupe key (`<type>:<tool>:<name>`); losers are `shadowed`.
  * - MCPs: canonical config files for both scopes with the runtime's
  *   project-first precedence and the union of disabled markers; malformed
  *   files surface as `invalid` rows without leaking raw JSON.
@@ -173,7 +174,8 @@ const HOOK_PHASES = ["pre", "post"] as const;
 
 async function loadHookRows(options: LoadCustomizationInventoryOptions, _warnings: string[]): Promise<InventoryRow[]> {
 	const rows: InventoryRow[] = [];
-	// Runtime semantics: project-first, first-wins on `<type>:<tool>:<name>`.
+	// Repository hooks are deliberately excluded by session startup. They stay
+	// visible for management, but are stored-only and cannot shadow user hooks.
 	const seen = new Set<string>();
 	for (const scope of ["project", "global"] as const) {
 		const hooksDir = resolveScopePaths(scope, options.cwd).hooksDir;
@@ -190,19 +192,33 @@ async function loadHookRows(options: LoadCustomizationInventoryOptions, _warning
 				const hookPath = path.join(phaseDir, entry.name);
 				const baseName = entry.name.includes(".") ? entry.name.slice(0, entry.name.lastIndexOf(".")) : entry.name;
 				const key = `${phase}:${baseName}:${entry.name}`;
-				const shadowed = seen.has(key);
-				seen.add(key);
+				const storedOnly = scope === "project";
+				const shadowed = !storedOnly && seen.has(key);
+				if (!storedOnly) seen.add(key);
+				let status: InventoryStatus;
+				let diagnostics: string[] | undefined;
+				if (storedOnly) {
+					status = "stored-only";
+					diagnostics = [
+						"project hooks are stored only; sessions do not load repository hook modules automatically",
+					];
+				} else if (shadowed) {
+					status = "shadowed";
+					diagnostics = ["shadowed by the same hook at higher-precedence scope"];
+				} else {
+					status = "enabled";
+				}
 				rows.push({
 					id: inventoryRowId("hooks", scope, hookPath),
 					surface: "hooks",
 					name: entry.name,
 					displayName: `${phase}/${entry.name}`,
-					status: shadowed ? "shadowed" : "enabled",
+					status,
 					provenance: `${scopeLabel(scope)} hooks/${phase}`,
 					path: hookPath,
 					scope,
 					description: `${phase}-tool hook for ${baseName}`,
-					diagnostics: shadowed ? ["shadowed by the same hook at higher-precedence scope"] : undefined,
+					diagnostics,
 					raw: { name: entry.name, type: phase, tool: baseName },
 				});
 			}

package/src/customization/types.ts

@@ -119,6 +119,7 @@ export function sourceConfigDir(
 
 export type InventoryStatus =
 	| "enabled"
+	| "stored-only"
 	| "disabled"
 	| "invalid"
 	| "shadowed"

package/src/dap/client.ts

@@ -1,6 +1,7 @@
 import { existsSync } from "node:fs";
 import * as fs from "node:fs/promises";
 import { logger } from "@gajae-code/utils";
+import { projectSafeSpawnEnv } from "@gajae-code/utils/shell-config";
 import { formatCrashDiagnosticNotice, writeCrashReport } from "../debug/crash-diagnostics";
 import { NON_INTERACTIVE_ENV } from "../exec/non-interactive-env";
 import { type OwnedProcess, spawnOwnedProcess } from "../runtime/process-lifecycle";
@@ -134,7 +135,7 @@ export class DapClient {
 		// debuggee children can reach /dev/tty and trigger SIGTTIN, suspending
 		// the parent harness under shell job control.
 		const env = {
-			...Bun.env,
+			...projectSafeSpawnEnv(),
 			...NON_INTERACTIVE_ENV,
 		};
 		const owner = spawnOwnedProcess([adapter.resolvedCommand, ...adapter.args], {
@@ -159,7 +160,7 @@ export class DapClient {
 	 */
 	static async #spawnSocket({ adapter, cwd }: DapSpawnOptions): Promise<DapClient> {
 		const env = {
-			...Bun.env,
+			...projectSafeSpawnEnv(),
 			...NON_INTERACTIVE_ENV,
 		};
 		const isLinux = process.platform === "linux";

package/src/dap/session.ts

@@ -1,6 +1,8 @@
+import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import * as timers from "node:timers/promises";
 import { logger, untilAborted } from "@gajae-code/utils";
+import { projectSafeSpawnEnv } from "@gajae-code/utils/shell-config";
 import { NON_INTERACTIVE_ENV } from "../exec/non-interactive-env";
 import { type OwnedProcess, spawnOwnedProcess } from "../runtime/process-lifecycle";
 import { DapClient } from "./client";
@@ -106,9 +108,19 @@ interface DapSession {
 	initializedSeen: boolean;
 	needsConfigurationDone: boolean;
 	configurationDoneSent: boolean;
+	/** Containment root. Distinct from `cwd`, which is the caller execution directory. */
+	workspace: string;
+	closing: boolean;
+	disposed: boolean;
+	inflightTerminal: number;
+	terminalIdle?: Promise<void>;
+	resolveTerminalIdle?: () => void;
 	runInTerminalProcesses: Set<OwnedProcess>;
 }
 
+/** Test seam: pauses after cwd containment and before the debuggee spawn. */
+export const runInTerminalTestHooks: { beforeSpawn?: () => Promise<void> } = {};
+
 export interface DapOutputSnapshot {
 	snapshot: DapSessionSummary;
 	output: string;
@@ -210,6 +222,53 @@ function buildSummary(session: DapSession): DapSessionSummary {
 	};
 }
 
+function isEnoent(error: unknown): boolean {
+	return (error as NodeJS.ErrnoException | undefined)?.code === "ENOENT";
+}
+
+/** Walk missing leaves so a not-yet-created debug cwd can still be contained. */
+async function canonicalizeRunInTerminalCwd(absolute: string): Promise<string> {
+	try {
+		return await fs.realpath(absolute);
+	} catch (error) {
+		if (!isEnoent(error)) throw error;
+	}
+	const missing: string[] = [];
+	let cursor = absolute;
+	for (;;) {
+		const parent = path.dirname(cursor);
+		if (parent === cursor) throw new Error("runInTerminal cwd escapes the workspace");
+		missing.unshift(path.basename(cursor));
+		cursor = parent;
+		try {
+			return path.join(await fs.realpath(cursor), ...missing);
+		} catch (error) {
+			if (!isEnoent(error)) throw error;
+		}
+	}
+}
+
+export function cwdEscapesWorkspace(root: string, candidate: string): boolean {
+	const relative = path.relative(root, candidate);
+	return relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative);
+}
+
+/**
+ * The validated cwd is the cwd that is spawned. Relative paths resolve against
+ * the session workspace, then both sides are canonicalized before containment.
+ */
+async function resolveRunInTerminalCwd(workspace: string, requested: string | undefined): Promise<string> {
+	if (typeof requested === "string" && requested.trim() === "") {
+		throw new Error("runInTerminal cwd escapes the workspace");
+	}
+	const root = await fs.realpath(workspace);
+	const candidate = await canonicalizeRunInTerminalCwd(path.resolve(workspace, requested ?? workspace));
+	if (cwdEscapesWorkspace(root, candidate)) {
+		throw new Error("runInTerminal cwd escapes the workspace");
+	}
+	return candidate;
+}
+
 export class DapSessionManager {
 	#sessions = new Map<string, DapSession>();
 	#activeSessionId: string | null = null;
@@ -234,13 +293,19 @@ export class DapSessionManager {
 	}
 
 	async launch(
-		options: DapLaunchSessionOptions,
+		options: DapLaunchSessionOptions & { workspace?: string },
 		signal?: AbortSignal,
 		timeoutMs: number = 30_000,
 	): Promise<DapSessionSummary> {
 		await this.#ensureLaunchSlot();
 		const client = await DapClient.spawn({ adapter: options.adapter, cwd: options.cwd });
-		const session = this.#registerSession(client, options.adapter, options.cwd, options.program);
+		const session = this.#registerSession(
+			client,
+			options.adapter,
+			options.cwd,
+			options.workspace ?? options.cwd,
+			options.program,
+		);
 		try {
 			session.capabilities = await client.initialize(
 				this.#buildInitializeArguments(options.adapter),
@@ -299,13 +364,13 @@ export class DapSessionManager {
 	}
 
 	async attach(
-		options: DapAttachSessionOptions,
+		options: DapAttachSessionOptions & { workspace?: string },
 		signal?: AbortSignal,
 		timeoutMs: number = 30_000,
 	): Promise<DapSessionSummary> {
 		await this.#ensureLaunchSlot();
 		const client = await DapClient.spawn({ adapter: options.adapter, cwd: options.cwd });
-		const session = this.#registerSession(client, options.adapter, options.cwd);
+		const session = this.#registerSession(client, options.adapter, options.cwd, options.workspace ?? options.cwd);
 		try {
 			session.capabilities = await client.initialize(
 				this.#buildInitializeArguments(options.adapter),
@@ -886,24 +951,29 @@ export class DapSessionManager {
 		const session = this.#getActiveSessionOrNull();
 		if (!session) return null;
 		session.lastUsedAt = Date.now();
-		if (session.status !== "terminated") {
-			if (session.capabilities?.supportsTerminateRequest) {
+		// Close before the first await. A runInTerminal paused on cwd resolution
+		// must not spawn while terminate or disconnect is still outstanding.
+		session.closing = true;
+		try {
+			if (session.status !== "terminated") {
+				if (session.capabilities?.supportsTerminateRequest) {
+					await untilAborted(
+						signal,
+						session.client.sendRequest("terminate", undefined, signal, timeoutMs).catch(() => undefined),
+					);
+				}
 				await untilAborted(
 					signal,
-					session.client.sendRequest("terminate", undefined, signal, timeoutMs).catch(() => undefined),
+					session.client
+						.sendRequest("disconnect", { terminateDebuggee: true }, signal, timeoutMs)
+						.catch(() => undefined),
 				);
 			}
-			await untilAborted(
-				signal,
-				session.client
-					.sendRequest("disconnect", { terminateDebuggee: true }, signal, timeoutMs)
-					.catch(() => undefined),
-			);
+			session.status = "terminated";
+			return buildSummary(session);
+		} finally {
+			await this.#disposeSession(session);
 		}
-		session.status = "terminated";
-		const summary = buildSummary(session);
-		await this.#disposeSession(session);
-		return summary;
 	}
 
 	#startCleanupTimer(): void {
@@ -945,12 +1015,22 @@ export class DapSessionManager {
 		throw new Error(`Debug session ${active.id} is still active. Terminate it before launching another.`);
 	}
 
-	#registerSession(client: DapClient, adapter: DapResolvedAdapter, cwd: string, program?: string): DapSession {
+	#registerSession(
+		client: DapClient,
+		adapter: DapResolvedAdapter,
+		cwd: string,
+		workspace: string,
+		program?: string,
+	): DapSession {
 		const session: DapSession = {
 			id: `debug-${++this.#nextId}`,
 			adapter,
 			cwd,
+			workspace,
 			program,
+			closing: false,
+			disposed: false,
+			inflightTerminal: 0,
 			client,
 			status: "launching",
 			launchedAt: Date.now(),
@@ -975,24 +1055,40 @@ export class DapSessionManager {
 			if (!Array.isArray(args.args) || args.args.length === 0) {
 				throw new Error("runInTerminal request did not include a command");
 			}
-			const env = Object.fromEntries(
-				Object.entries(args.env ?? {}).filter((entry): entry is [string, string] => entry[1] !== null),
-			);
-			const owner = spawnOwnedProcess(args.args, {
-				cwd: args.cwd ?? session.cwd,
-				stdin: "ignore",
-				env: {
-					...Bun.env,
-					...NON_INTERACTIVE_ENV,
-					...env,
-				},
-				name: `dap:${session.id}:runInTerminal`,
-			});
-			drainStream(owner.child.stdout);
-			drainStream(owner.child.stderr);
-			session.runInTerminalProcesses.add(owner);
-			owner.exited.finally(() => session.runInTerminalProcesses.delete(owner));
-			return { processId: owner.pid } satisfies DapRunInTerminalResponse;
+			if (session.closing) throw new Error("runInTerminal session is closed");
+			this.#beginTerminal(session);
+			try {
+				if (session.closing) throw new Error("runInTerminal session is closed");
+				const env = Object.fromEntries(
+					Object.entries(args.env ?? {}).filter((entry): entry is [string, string] => entry[1] !== null),
+				);
+				const cwd = await resolveRunInTerminalCwd(session.workspace, args.cwd ?? session.cwd);
+				await runInTerminalTestHooks.beforeSpawn?.();
+				if (session.closing || !this.#sessions.has(session.id)) {
+					throw new Error("runInTerminal session is closed");
+				}
+				const owner = spawnOwnedProcess(args.args, {
+					cwd,
+					stdin: "ignore",
+					env: {
+						...projectSafeSpawnEnv(),
+						...NON_INTERACTIVE_ENV,
+						...env,
+					},
+					name: `dap:${session.id}:runInTerminal`,
+				});
+				if (session.closing || !this.#sessions.has(session.id)) {
+					await owner.dispose();
+					throw new Error("runInTerminal session is closed");
+				}
+				drainStream(owner.child.stdout);
+				drainStream(owner.child.stderr);
+				session.runInTerminalProcesses.add(owner);
+				owner.exited.finally(() => session.runInTerminalProcesses.delete(owner));
+				return { processId: owner.pid } satisfies DapRunInTerminalResponse;
+			} finally {
+				this.#endTerminal(session);
+			}
 		});
 		client.onReverseRequest("startDebugging", async rawArgs => {
 			const startArgs = (rawArgs ?? {}) as Partial<DapStartDebuggingArguments>;
@@ -1319,7 +1415,36 @@ export class DapSessionManager {
 		return session;
 	}
 
+	#beginTerminal(session: DapSession): void {
+		session.inflightTerminal++;
+		if (session.inflightTerminal !== 1) return;
+		session.terminalIdle = new Promise(resolve => {
+			session.resolveTerminalIdle = resolve;
+		});
+	}
+
+	#endTerminal(session: DapSession): void {
+		session.inflightTerminal = Math.max(0, session.inflightTerminal - 1);
+		if (session.inflightTerminal !== 0) return;
+		session.resolveTerminalIdle?.();
+		session.resolveTerminalIdle = undefined;
+		session.terminalIdle = undefined;
+	}
+
+	async #waitTerminalIdle(session: DapSession): Promise<void> {
+		while (session.inflightTerminal > 0 && session.terminalIdle) {
+			await session.terminalIdle;
+		}
+	}
+
 	async #disposeSession(session: DapSession) {
+		session.closing = true;
+		if (session.disposed) {
+			await this.#waitTerminalIdle(session);
+			return;
+		}
+		session.disposed = true;
+		await this.#waitTerminalIdle(session);
 		if (this.#activeSessionId === session.id) {
 			this.#activeSessionId = null;
 		}

package/src/debug/crash-diagnostics.ts

@@ -1,3 +1,4 @@
+import { constants as fsConstants } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -180,10 +181,10 @@ export async function writeCrashReport(
 	}
 
 	try {
-		const dir = getCrashDiagnosticsDirectory(options.env);
-		await ensurePrivateDiagnosticsDirectory(dir);
+		const directory = diagnosticsDirectoryPath(getCrashDiagnosticsDirectory(options.env));
+		await ensurePrivateDiagnosticsDirectory(directory);
 		const filename = `${report.createdAt.replace(/[:.]/g, "-")}-${report.kind}-${report.class}-${process.pid}.json`;
-		const reportPath = path.join(dir, filename);
+		const reportPath = path.join(directory, filename);
 		await writePrivateCrashReport(reportPath, `${JSON.stringify(report, null, 2)}\n`);
 		return { report, path: reportPath, enabled };
 	} catch {
@@ -197,19 +198,100 @@ export function formatCrashDiagnosticNotice(result: CrashReportWriteResult): str
 	return `[crash:${result.report.kind}:${result.report.class}] ${result.report.reason}${location}`;
 }
 
+const POSIX_NOFOLLOW = process.platform === "win32" ? 0 : (fsConstants.O_NOFOLLOW ?? 0);
+
+function isFilesystemRoot(dir: string): boolean {
+	const root = path.parse(dir).root;
+	return root.length > 0 && dir === root;
+}
+
+/** Drop trailing platform separators and "." segments. A backslash stays in the name on POSIX. ".." is unchanged. */
+function diagnosticsDirectoryPath(dir: string): string {
+	const sep = path.sep;
+	let current = dir;
+	while (!isFilesystemRoot(current)) {
+		let end = current.length;
+		while (end > 0 && current[end - 1] === sep) end -= 1;
+		if (end !== current.length) {
+			const stripped = current.slice(0, end);
+			if (stripped === "" || isFilesystemRoot(stripped)) return path.parse(current).root || current;
+			if (process.platform === "win32" && /^[A-Za-z]:$/.test(stripped)) return `${stripped}\\`;
+			current = stripped;
+			continue;
+		}
+		const dotSuffix = `${sep}.`;
+		if (current.endsWith(dotSuffix) && !current.endsWith(`${sep}..`)) {
+			const parent = current.slice(0, -dotSuffix.length);
+			if (parent === "" || isFilesystemRoot(parent)) {
+				return parent === "" ? path.parse(current).root || current : parent;
+			}
+			if (process.platform === "win32" && /^[A-Za-z]:$/.test(parent)) return `${parent}\\`;
+			current = parent;
+			continue;
+		}
+		return current;
+	}
+	return current;
+}
+
 async function ensurePrivateDiagnosticsDirectory(dir: string): Promise<void> {
+	await assertRealDiagnosticsDirectory(dir);
 	await fs.mkdir(dir, { recursive: true, mode: DIRECTORY_MODE });
+	await assertRealDiagnosticsDirectory(dir);
+	await chmodRealDiagnosticsDirectory(dir);
+}
+
+async function assertRealDiagnosticsDirectory(dir: string): Promise<void> {
+	let stat: Awaited<ReturnType<typeof fs.lstat>>;
+	try {
+		stat = await fs.lstat(dir);
+	} catch (error) {
+		if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT") return;
+		throw error;
+	}
+	if (stat.isSymbolicLink() || !stat.isDirectory()) {
+		throw new Error("crash diagnostics path is not a private directory");
+	}
+}
+
+async function chmodRealDiagnosticsDirectory(dir: string): Promise<void> {
+	const stat = await fs.lstat(dir);
+	if (stat.isSymbolicLink() || !stat.isDirectory()) {
+		throw new Error("crash diagnostics path is not a private directory");
+	}
+	// macOS lchmod sets the mode without read permission and without following a symlink.
+	// Linux has no equivalent here, so an unreadable directory is left unchanged. A path chmod would follow a swapped symlink.
+	if (process.platform === "darwin" && typeof fs.lchmod === "function") {
+		await fs.lchmod(dir, DIRECTORY_MODE);
+		return;
+	}
+	const directoryFlag = fsConstants.O_DIRECTORY ?? 0;
+	const pathFlag = (fsConstants as { O_PATH?: number }).O_PATH ?? 0;
+	if (POSIX_NOFOLLOW !== 0 && directoryFlag !== 0) {
+		const openFlag = pathFlag !== 0 ? pathFlag : fsConstants.O_RDONLY;
+		const handle = await fs.open(dir, openFlag | directoryFlag | POSIX_NOFOLLOW);
+		try {
+			await handle.chmod(DIRECTORY_MODE);
+		} finally {
+			await handle.close();
+		}
+		return;
+	}
 	await fs.chmod(dir, DIRECTORY_MODE);
 }
 
 async function writePrivateCrashReport(reportPath: string, contents: string): Promise<void> {
-	const file = await fs.open(reportPath, "wx", REPORT_FILE_MODE);
+	const file = await fs.open(
+		reportPath,
+		fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | POSIX_NOFOLLOW,
+		REPORT_FILE_MODE,
+	);
 	try {
 		await file.writeFile(contents);
+		await file.chmod(REPORT_FILE_MODE);
 	} finally {
 		await file.close();
 	}
-	await fs.chmod(reportPath, REPORT_FILE_MODE);
 }
 
 function stringifyError(error: unknown): string {

package/src/debug/report-bundle.ts

@@ -3,6 +3,7 @@
  *
  * Creates a .tar.gz archive with session data, logs, system info, and optional profiling data.
  */
+import { constants as fsConstants } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type { WorkProfile } from "@gajae-code/natives";
@@ -13,6 +14,7 @@ import {
 	getLogPath,
 	getLogsDir,
 	getReportsDir,
+	hasFsCode,
 	isEnoent,
 	redactCrashSecrets,
 	resolveEquivalentPath,
@@ -133,6 +135,72 @@ export interface DebugLogSource {
 	loadOlderLogs(limitDays?: number): Promise<string>;
 }
 
+/** Owner-only mode. umask cannot widen this, and fchmod repeats it after open. */
+const REPORT_BUNDLE_MODE = 0o600;
+
+/**
+ * Open the archive path without following a final symlink.
+ * A missing path is created with O_EXCL. An existing regular file is replaced.
+ * A symlink fails the open (ELOOP, or EEXIST on macOS with O_EXCL) and is left in place.
+ */
+async function openReportBundleForWrite(outputPath: string): Promise<fs.FileHandle> {
+	const noFollow = process.platform === "win32" ? 0 : (fsConstants.O_NOFOLLOW ?? 0);
+	const createFlags = fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | noFollow;
+	const replaceFlags = fsConstants.O_WRONLY | noFollow;
+
+	const openRegular = async (): Promise<fs.FileHandle> => {
+		const current = await fs.lstat(outputPath);
+		if (current.isSymbolicLink() || !current.isFile()) {
+			throw new Error("report bundle output is not a regular file");
+		}
+		try {
+			return await fs.open(outputPath, replaceFlags, REPORT_BUNDLE_MODE);
+		} catch (error) {
+			if (hasFsCode(error, "ELOOP")) throw new Error("report bundle output is not a regular file");
+			throw error;
+		}
+	};
+
+	let missing = false;
+	try {
+		await fs.lstat(outputPath);
+	} catch (error) {
+		if (!isEnoent(error)) throw error;
+		missing = true;
+	}
+	if (!missing) return openRegular();
+
+	try {
+		return await fs.open(outputPath, createFlags, REPORT_BUNDLE_MODE);
+	} catch (error) {
+		if (hasFsCode(error, "ELOOP")) throw new Error("report bundle output is not a regular file");
+		if (!hasFsCode(error, "EEXIST")) throw error;
+	}
+	return openRegular();
+}
+
+async function writeReportBundleFile(outputPath: string, bytes: Uint8Array): Promise<void> {
+	const handle = await openReportBundleForWrite(outputPath);
+	try {
+		const opened = await handle.stat();
+		const current = await fs.lstat(outputPath);
+		if (
+			current.isSymbolicLink() ||
+			!opened.isFile() ||
+			!current.isFile() ||
+			opened.dev !== current.dev ||
+			opened.ino !== current.ino
+		) {
+			throw new Error("report bundle output is not a regular file");
+		}
+		if (process.platform !== "win32") await handle.chmod(REPORT_BUNDLE_MODE);
+		await handle.truncate(0);
+		await handle.writeFile(bytes);
+	} finally {
+		await handle.close();
+	}
+}
+
 /**
  * Create a debug report bundle.
  *
@@ -237,8 +305,9 @@ export async function createReportBundle(options: ReportBundleOptions): Promise<
 		data[archivePath] = redactCrashSecrets(content);
 	}
 
-	// Write archive
-	await Bun.Archive.write(outputPath, data, { compress: "gzip" });
+	// Write archive. Bytes are built in memory so the path open can refuse a symlink.
+	const archiveBytes = await new Bun.Archive(data, { compress: "gzip" }).bytes();
+	await writeReportBundleFile(outputPath, archiveBytes);
 
 	return { path: outputPath, files };
 }

package/src/discovery/builtin.ts

@@ -399,10 +399,11 @@ async function loadSlashCommands(ctx: LoadContext): Promise<LoadResult<SlashComm
 		const commandsDir = path.join(dir, "commands");
 		const result = await loadFilesFromDir<SlashCommand>(ctx, commandsDir, PROVIDER_ID, level, {
 			extensions: ["md"],
+			recursive: true,
 			scope: readScopeForLevel(level),
-			transform: (name, content, path, source) => ({
-				name: name.replace(/\.md$/, ""),
-				path,
+			transform: (_name, content, filePath, source) => ({
+				name: path.relative(commandsDir, filePath).replace(/\.md$/, "").split(path.sep).join(":"),
+				path: filePath,
 				content,
 				level,
 				_source: source,