@gajae-code/coding-agent 0.18.12 → 0.19.0

package/src/harness-control-plane/storage.ts

@@ -293,11 +293,131 @@ export function sessionPaths(root: string, sessionId: string): SessionPaths {
 	};
 }
 
+const NO_FOLLOW = process.platform === "win32" ? 0 : (fsSync.constants.O_NOFOLLOW ?? 0);
+
+function errnoCode(error: unknown): string | undefined {
+	return error instanceof Error && "code" in error ? (error as NodeJS.ErrnoException).code : undefined;
+}
+
+function sameInode(left: fsSync.BigIntStats, right: fsSync.BigIntStats): boolean {
+	return left.dev === right.dev && left.ino === right.ino && left.nlink === right.nlink;
+}
+
+/**
+ * Leaf directory mode 0700. `lstat` plus `chmod` does not need read permission, so a
+ * mode 0300 directory stays writable. A symlink leaf is refused before chmod.
+ * This does not pin the directory against a later rename in a writable parent.
+ */
+async function ensureOwnerDirectory(dir: string): Promise<void> {
+	await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+	let current: fsSync.Stats;
+	try {
+		current = await fs.lstat(dir);
+	} catch (error) {
+		const code = errnoCode(error);
+		if (code === "ELOOP" || code === "ENOTDIR") throw new Error("harness state directory is not a directory");
+		throw error;
+	}
+	if (current.isSymbolicLink() || !current.isDirectory())
+		throw new Error("harness state directory is not a directory");
+	if (process.platform === "win32" || (current.mode & 0o077) === 0) return;
+	await fs.chmod(dir, 0o700);
+	const tightened = await fs.lstat(dir);
+	if (tightened.isSymbolicLink() || !tightened.isDirectory() || (tightened.mode & 0o777) !== 0o700) {
+		throw new Error("harness state directory could not be tightened to mode 0700");
+	}
+}
+
+async function assertRegularOrMissing(file: string): Promise<void> {
+	try {
+		const existing = await fs.lstat(file);
+		if (existing.isSymbolicLink() || !existing.isFile()) throw new Error("harness state path is not a regular file");
+	} catch (error) {
+		if (errnoCode(error) !== "ENOENT") throw error;
+	}
+}
+
+/**
+ * Append like the workflow owner-only writer: mode 0600, `O_NOFOLLOW` when the file
+ * exists, `O_EXCL` when it does not, and chmod to 0600 when group or other bits are set.
+ */
+async function appendOwnerOnly(filePath: string, text: string): Promise<void> {
+	await ensureOwnerDirectory(path.dirname(filePath));
+	let handle: fs.FileHandle | undefined;
+	let initial: fsSync.BigIntStats | undefined;
+	for (let attempt = 0; attempt < 2; attempt++) {
+		initial = undefined;
+		try {
+			initial = await fs.lstat(filePath, { bigint: true });
+			if (initial.isSymbolicLink() || !initial.isFile()) throw new Error("harness state path is not a regular file");
+		} catch (error) {
+			if (errnoCode(error) !== "ENOENT") throw error;
+		}
+		const flags = initial
+			? fsSync.constants.O_WRONLY | fsSync.constants.O_APPEND | NO_FOLLOW
+			: fsSync.constants.O_WRONLY | fsSync.constants.O_APPEND | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL;
+		try {
+			handle = await fs.open(filePath, flags, 0o600);
+			break;
+		} catch (error) {
+			const code = errnoCode(error);
+			if (code === "ELOOP") throw new Error("harness state path is not a regular file");
+			if (initial === undefined && code === "EEXIST" && attempt === 0) continue;
+			throw error;
+		}
+	}
+	if (!handle) throw new Error("harness state path identity changed before append");
+	try {
+		const opened = await handle.stat({ bigint: true });
+		const named = await fs.lstat(filePath, { bigint: true });
+		if (
+			opened.isSymbolicLink() ||
+			!opened.isFile() ||
+			named.isSymbolicLink() ||
+			!named.isFile() ||
+			(initial !== undefined && !sameInode(initial, opened)) ||
+			!sameInode(opened, named)
+		) {
+			throw new Error("harness state path identity changed before append");
+		}
+		if (process.platform !== "win32" && (Number(opened.mode) & 0o077) !== 0) {
+			await handle.chmod(0o600);
+			const tightened = await handle.stat({ bigint: true });
+			if ((Number(tightened.mode) & 0o777) !== 0o600) {
+				throw new Error("harness state path could not be tightened to mode 0600");
+			}
+		}
+		await handle.writeFile(text, "utf8");
+	} finally {
+		await handle.close();
+	}
+}
+
 async function writeJsonAtomic(file: string, value: unknown): Promise<void> {
-	await fs.mkdir(path.dirname(file), { recursive: true });
+	await ensureOwnerDirectory(path.dirname(file));
+	await assertRegularOrMissing(file);
 	const tmp = `${file}.tmp-${randomBytes(4).toString("hex")}`;
-	await fs.writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`, "utf8");
-	await fs.rename(tmp, file);
+	const flags = fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL | NO_FOLLOW;
+	const handle = await fs.open(tmp, flags, 0o600);
+	try {
+		if (process.platform !== "win32") {
+			await handle.chmod(0o600);
+			const created = await handle.stat();
+			if (!created.isFile() || (created.mode & 0o777) !== 0o600) {
+				throw new Error("harness state path could not be tightened to mode 0600");
+			}
+		}
+		await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+	} finally {
+		await handle.close();
+	}
+	try {
+		await assertRegularOrMissing(file);
+		await fs.rename(tmp, file);
+	} catch (error) {
+		await fs.rm(tmp, { force: true }).catch(() => undefined);
+		throw error;
+	}
 }
 
 async function readJson<T>(file: string): Promise<T | null> {
@@ -396,7 +516,6 @@ export async function resolveHarnessSessionRoot(
 
 export async function writeSessionState(root: string, state: SessionState): Promise<void> {
 	const paths = sessionPaths(root, state.sessionId);
-	await fs.mkdir(paths.dir, { recursive: true });
 	await writeJsonAtomic(paths.state, state);
 }
 
@@ -407,8 +526,7 @@ export async function sessionExists(root: string, sessionId: string): Promise<bo
 /** Append a single severity envelope to events.jsonl. Single-writer discipline is the owner's job (M3). */
 export async function appendEvent(root: string, sessionId: string, envelope: EventEnvelope): Promise<void> {
 	const paths = sessionPaths(root, sessionId);
-	await fs.mkdir(paths.dir, { recursive: true });
-	await fs.appendFile(paths.events, `${JSON.stringify(envelope)}\n`, "utf8");
+	await appendOwnerOnly(paths.events, `${JSON.stringify(envelope)}\n`);
 }
 
 /** Read events from cursor (exclusive). Tail-only: never mutates the log. */

package/src/hindsight/content.ts

@@ -20,27 +20,126 @@ export interface RecallResultLike {
 	mentioned_at?: string | null;
 }
 
-const MEMORIES_REGEX = /<memories>[\s\S]*?<\/memories>/g;
-const LEGACY_HINDSIGHT_MEMORIES_REGEX = /<hindsight_memories>[\s\S]*?<\/hindsight_memories>/g;
-const LEGACY_RELEVANT_MEMORIES_REGEX = /<relevant_memories>[\s\S]*?<\/relevant_memories>/g;
-const MENTAL_MODELS_REGEX = /<mental_models>[\s\S]*?<\/mental_models>/g;
+const MEMORY_TAG_NAMES = ["memories", "hindsight_memories", "relevant_memories", "mental_models"] as const;
+
+function memoryTagExpression(name: string): RegExp {
+	return new RegExp(`<\\s*\\/?\\s*${name}\\s*>`, "gi");
+}
+
+interface MemoryTagSpan {
+	start: number;
+	end: number;
+	close: boolean;
+	paired: boolean;
+	absorbed: boolean;
+}
+
+function findMemoryTagSpans(content: string, name: string): MemoryTagSpan[] {
+	const spans: MemoryTagSpan[] = [];
+	for (const match of content.matchAll(memoryTagExpression(name))) {
+		const raw = match[0];
+		const start = match.index ?? 0;
+		spans.push({
+			start,
+			end: start + raw.length,
+			close: raw.includes("/"),
+			paired: false,
+			absorbed: false,
+		});
+	}
+	return spans;
+}
+
+function mergeSpans(ranges: Array<[number, number]>): Array<[number, number]> {
+	const sorted = ranges.filter(([start, end]) => end > start).sort((a, b) => a[0] - b[0] || b[1] - a[1]);
+	const merged: Array<[number, number]> = [];
+	for (const [start, end] of sorted) {
+		const last = merged[merged.length - 1];
+		if (!last || start > last[1]) merged.push([start, end]);
+		else last[1] = Math.max(last[1], end);
+	}
+	return merged;
+}
+
+/**
+ * Remove one memory-tag family.
+ *
+ * A matched block is removed whole. An extra closer after that block is the
+ * recall frame ending early: the escaped text through that closer is removed
+ * so it is not retained as instructions. A closer or opener with no block
+ * before it is removed as a token only, and the surrounding prose stays.
+ */
+function stripMemoryTagFamily(content: string, name: string): string {
+	const tags = findMemoryTagSpans(content, name);
+	if (tags.length === 0) return content;
+
+	const ranges: Array<[number, number]> = [];
+	const stack: MemoryTagSpan[] = [];
+	for (const tag of tags) {
+		if (!tag.close) {
+			stack.push(tag);
+			continue;
+		}
+		const open = stack.pop();
+		if (!open) continue;
+		open.paired = true;
+		tag.paired = true;
+		ranges.push([open.start, tag.end]);
+	}
+
+	for (const tag of tags) {
+		if (!tag.close || tag.paired) continue;
+		let previous: MemoryTagSpan | undefined;
+		for (const candidate of tags) {
+			if (candidate.end <= tag.start) previous = candidate;
+			else break;
+		}
+		const followsClosedBlock = Boolean(previous?.close && (previous.paired || previous.absorbed));
+		if (followsClosedBlock && previous) {
+			ranges.push([previous.end, tag.end]);
+			tag.absorbed = true;
+		} else {
+			ranges.push([tag.start, tag.end]);
+		}
+	}
+
+	for (const tag of tags) {
+		if (!tag.close && !tag.paired) ranges.push([tag.start, tag.end]);
+	}
+
+	let out = content;
+	for (const [start, end] of mergeSpans(ranges).reverse()) {
+		out = out.slice(0, start) + out.slice(end);
+	}
+	return out;
+}
+
+/** Escape recognized tag delimiters so recalled text cannot close the outer frame. */
+function stripMemoryTagTokens(text: string): string {
+	let out = text;
+	for (const name of MEMORY_TAG_NAMES) {
+		out = out.replace(memoryTagExpression(name), tag => tag.replace("<", "&lt;"));
+	}
+	return out;
+}
 
 /**
  * Strip `<memories>`, `<mental_models>`, and legacy memory blocks.
  *
- * Both `<memories>` (per-turn recall) and `<mental_models>` (curated semantic
- * memory) are injected into the system prompt. If either leaks into the
- * retention transcript, every retain becomes a tighter feedback loop —
- * paraphrased memories feed the next consolidation, which feeds the next
- * mental-model refresh, which feeds the next retain. Always strip before
- * retaining.
+ * Matching is case-insensitive and allows whitespace inside the tag.
+ * Both per-turn recall and curated mental models are injected around the
+ * prompt. If a closer, a case variant, or an early-ended frame leaks into
+ * the retention transcript, the next retain stores the breakout as a new
+ * memory. Always strip before retaining.
  */
 export function stripMemoryTags(content: string): string {
-	return content
-		.replace(MEMORIES_REGEX, "")
-		.replace(MENTAL_MODELS_REGEX, "")
-		.replace(LEGACY_HINDSIGHT_MEMORIES_REGEX, "")
-		.replace(LEGACY_RELEVANT_MEMORIES_REGEX, "");
+	let out = content;
+	while (true) {
+		let stripped = out;
+		for (const name of MEMORY_TAG_NAMES) stripped = stripMemoryTagFamily(stripped, name);
+		if (stripped === out) return out;
+		out = stripped;
+	}
 }
 
 /** Format recall results into a bullet list for context injection. */
@@ -50,7 +149,8 @@ export function formatMemories(results: RecallResultLike[]): string {
 		.map(r => {
 			const typeStr = r.type ? ` [${r.type}]` : "";
 			const dateStr = r.mentioned_at ? ` (${r.mentioned_at})` : "";
-			return `- ${r.text}${typeStr}${dateStr}`;
+			const text = stripMemoryTagTokens(r.text);
+			return `- ${text}${typeStr}${dateStr}`;
 		})
 		.join("\n\n");
 }

package/src/hindsight/mental-models.ts

@@ -219,6 +219,17 @@ const TRUNCATION_MARKER = "\n\n…[mental-model snapshot truncated at render bud
  */
 const MIN_CONTENT_ROOM_CHARS = 64;
 
+const MEMORY_FRAME_NAMES = ["memories", "hindsight_memories", "relevant_memories", "mental_models"] as const;
+
+/** Escape the same frame tokens as recalled memory text so a stored closer cannot end this block early. */
+function escapeMemoryFrameTokens(text: string): string {
+	let out = text;
+	for (const name of MEMORY_FRAME_NAMES) {
+		out = out.replace(new RegExp(`<\\s*\\/?\\s*${name}\\s*>`, "gi"), tag => tag.replace("<", "&lt;"));
+	}
+	return out;
+}
+
 /** Smallest budget that can yield a usable block (wrapper + preamble + marker + a few chars of content). */
 function minRenderBudgetChars(): number {
 	const cleanOverhead = `<mental_models>\n${PREAMBLE}\n\n\n</mental_models>`.length;
@@ -235,7 +246,6 @@ export function renderMentalModelsBlock(models: MentalModelSummary[], budgetChar
 	if (budgetChars < minRenderBudgetChars()) return "";
 
 	const truncatedOverhead = `<mental_models>\n${PREAMBLE}\n\n${TRUNCATION_MARKER}\n</mental_models>`.length;
-	const cleanOverhead = `<mental_models>\n${PREAMBLE}\n\n\n</mental_models>`.length;
 	const innerBudget = Math.max(0, budgetChars - truncatedOverhead);
 	const perModelBudget = Math.max(120, Math.floor(innerBudget / Math.max(1, models.length)));
 
@@ -260,18 +270,20 @@ export function renderMentalModelsBlock(models: MentalModelSummary[], budgetChar
 		consumed += sectionCost;
 	}
 
+	// Escape after the heading/body join. A closer split across that newline
+	// (`</mental_models` + `>`) is not visible in either field alone.
+	// The wrapper is added after this step and is not escaped.
+	let inner = escapeMemoryFrameTokens(sections.join("\n\n"));
 	const tail = truncated ? TRUNCATION_MARKER : "";
-	let assembled = `<mental_models>\n${PREAMBLE}\n\n${sections.join("\n\n")}${tail}\n</mental_models>`;
+	let assembled = `<mental_models>\n${PREAMBLE}\n\n${inner}${tail}\n</mental_models>`;
 
-	// Final hard-cap: if the careful per-model budgeting still slips past the
-	// requested ceiling (small budgets, fat preambles, etc.), brutally truncate
-	// the body region while keeping the wrapper intact so `stripMemoryTags` can
-	// still find the closing tag.
+	// Final hard-cap: slice the already escaped body so a cut cannot restore a raw closer.
+	// The marker is always appended on this path, so reserve its overhead.
+	// Escaped tags are longer than the raw text the per-model budget measured.
 	if (assembled.length > budgetChars) {
-		const overhead = truncated ? truncatedOverhead : cleanOverhead;
-		const room = Math.max(0, budgetChars - overhead);
-		const body = sections.join("\n\n").slice(0, room).trimEnd();
-		assembled = `<mental_models>\n${PREAMBLE}\n\n${body}${TRUNCATION_MARKER}\n</mental_models>`;
+		const room = Math.max(0, budgetChars - truncatedOverhead);
+		inner = inner.slice(0, room).trimEnd();
+		assembled = `<mental_models>\n${PREAMBLE}\n\n${inner}${TRUNCATION_MARKER}\n</mental_models>`;
 	}
 	return assembled;
 }

package/src/hindsight/state.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 
 import { logger } from "@gajae-code/utils";
+import { redactMemorySecretsForTesting as redactMemorySecrets } from "../memories";
 import type { AgentSession } from "../session/agent-session";
 import { type BankScope, ensureBankMission } from "./bank";
 import type { HindsightApi, MemoryItemInput } from "./client";
@@ -149,8 +150,8 @@ export class HindsightRetainQueue {
 		try {
 			await ensureBankMission(state.client, state.bankId, state.config, state.missionsSet);
 			const batch: MemoryItemInput[] = items.map(item => ({
-				content: item.content,
-				context: item.context ?? state.config.retainContext,
+				content: redactMemorySecrets(item.content),
+				context: item.context === undefined ? state.config.retainContext : redactMemorySecrets(item.context),
 				metadata: { session_id: sessionId },
 				tags: state.retainTags,
 			}));
@@ -316,8 +317,10 @@ export class HindsightSessionState {
 			documentId = `${this.sessionId}-${Date.now()}`;
 		}
 
-		const { transcript } = prepareRetentionTranscript(target, true);
-		if (!transcript) return false;
+		const prepared = prepareRetentionTranscript(target, true);
+		if (!prepared.transcript) return false;
+		// Same scrub the local memory backend applies before it stores consolidation text.
+		const transcript = redactMemorySecrets(prepared.transcript);
 
 		await ensureBankMission(this.client, this.bankId, this.config, this.missionsSet);
 		await this.client.retain(this.bankId, transcript, {

package/src/hooks/native-skill-hook.ts

@@ -427,7 +427,9 @@ async function readStdinJson(): Promise<{ payload: HookPayload; parseError: Erro
 }
 
 async function logHookError(cwd: string, type: string, error: unknown): Promise<void> {
-	const gjcSessionId = process.env.GJC_SESSION_ID?.trim();
+	// Bun has already copied the project dotenv into the environment. A value
+	// that matches that snapshot must not select another session's log directory.
+	const gjcSessionId = trustedCoordinatorEnv("GJC_SESSION_ID", process.env, projectEnvSnapshot(cwd));
 	if (!gjcSessionId) {
 		console.error(
 			JSON.stringify({

package/src/internal-urls/artifact-protocol.ts

@@ -2,7 +2,8 @@
  * Protocol handler for artifact:// URLs.
  *
  * Resolves artifact IDs only against artifacts directories explicitly authorized
- * by the caller's ResolveContext. Unlike agent://, artifacts are raw text.
+ * by the caller's ResolveContext. SSH output artifacts are marked untrusted so
+ * ReadTool wraps the selected text after applying selectors and truncation.
  *
  * URL form:
  * - artifact://<id> - Full artifact content
@@ -97,6 +98,7 @@ export class ArtifactProtocolHandler implements ProtocolHandler {
 			contentType: "text/plain",
 			size: Buffer.byteLength(content, "utf-8"),
 			sourcePath: foundPath,
+			untrusted: path.basename(foundPath).endsWith(".ssh.log"),
 		};
 	}
 }