@gajae-code/coding-agent 0.18.12 → 0.19.0

package/src/sdk/bus/session-control.ts

@@ -1,3 +1,4 @@
+import { setSessionOutboundRedact } from "../host/events";
 import {
 	type GenericNotificationSessionSource,
 	getCurrentTelegramActivationMarker,
@@ -480,6 +481,7 @@ export class NotificationSessionController {
 		policy: Omit<NotificationRuntimePolicy, "mode">,
 		mode: NotificationRuntimePolicy["mode"],
 	): void {
+		setSessionOutboundRedact(binding.sessionId, policy.redact);
 		runtime?.refreshPolicy?.(binding, { ...policy, mode });
 	}
 

package/src/sdk/bus/slack-daemon.ts

@@ -58,6 +58,7 @@ function slackPublicationClientMsgId(publicationId: string): string {
 
 // Durable filesystem publication leases must outlast one event-loop and persistence turn.
 const MIN_PUBLICATION_LEASE_MS = 100;
+const ROOT_PUBLICATION_POLL_MS = 50;
 const INBOUND_REACTION_DEADLINE_MS = 5_000;
 const RETIREMENT_DRAIN_MS = 5_000;
 const INBOUND_REACTION = "eyes";
@@ -800,6 +801,7 @@ export class SlackNotificationDaemon {
 		endpointGeneration?: number,
 		requestedClientMsgId?: string,
 	): Promise<SlackRootPublication> {
+		const lifecycleGeneration = this.#lifecycleGeneration;
 		const endpoint = await this.#resolveAttachment(sessionId);
 		if (!endpoint || (endpointGeneration !== undefined && endpoint.generation !== endpointGeneration))
 			throw new SlackEndpointBindingError("Slack root publication requires the current session endpoint.");
@@ -816,7 +818,14 @@ export class SlackNotificationDaemon {
 			)
 				return current;
 			if (current?.state === "posting_root") {
-				if (current.rootPublicationOwner === this.#publicationOwnerId) return current;
+				// A live lease of our own belongs to an in-flight post; an expired one is
+				// reclaimed under a new fence exactly like a crashed peer's, otherwise the
+				// root waiter would re-enter postRoot forever.
+				if (
+					current.rootPublicationOwner === this.#publicationOwnerId &&
+					!this.#leaseExpired(current.rootPublicationLeaseExpiresAt, now)
+				)
+					return current;
 				claimed = true;
 				return nextRecord(current, {
 					rootPublicationOwner: this.#publicationOwnerId,
@@ -859,7 +868,17 @@ export class SlackNotificationDaemon {
 		}
 		if (!pending?.clientMsgId) throw new Error("Unable to persist Slack root post intent");
 		if (!claimed)
-			return { conversation: await this.#waitForRoot(pendingKey, sessionId, body, generation), created: false };
+			return {
+				conversation: await this.#waitForRoot(
+					pendingKey,
+					sessionId,
+					body,
+					generation,
+					lifecycleGeneration,
+					endpoint.authorityId,
+				),
+				created: false,
+			};
 		if (pending.endpointGeneration !== generation) throw new SlackEndpointBindingError();
 		const clientMsgId = pending.clientMsgId;
 		const fence = pending.rootPublicationFence;
@@ -907,7 +926,7 @@ export class SlackNotificationDaemon {
 		// dispatch; resume performs any required replacement after reconciliation.
 		const active = await this.store.transact(pendingKey, current => {
 			if (
-				!current ||
+				current?.state !== "posting_root" ||
 				current.clientMsgId !== clientMsgId ||
 				current.rootPublicationOwner !== this.#publicationOwnerId ||
 				current.rootPublicationFence !== fence
@@ -926,7 +945,17 @@ export class SlackNotificationDaemon {
 		});
 		if (!active) throw new Error("Slack root mapping disappeared");
 		if (active.state !== "active")
-			return { conversation: await this.#waitForRoot(pendingKey, sessionId, body, generation), created: false };
+			return {
+				conversation: await this.#waitForRoot(
+					pendingKey,
+					sessionId,
+					body,
+					generation,
+					lifecycleGeneration,
+					endpoint.authorityId,
+				),
+				created: false,
+			};
 		return { conversation: active, created: createdRootEffect };
 	}
 
@@ -1267,8 +1296,12 @@ export class SlackNotificationDaemon {
 				)
 					return record;
 				inboundDispatches = [...(record.inboundDispatches ?? [])];
+				// Fence the publisher before an abort-ignoring provider can renew or reactivate this mapping.
 				return nextRecord(record, {
 					state: "closed_marker",
+					rootPublicationOwner: undefined,
+					rootPublicationLeaseExpiresAt: undefined,
+					rootPublicationFence: (record.rootPublicationFence ?? 0) + 1,
 					pendingActionId: undefined,
 					cleanupEffectId: undefined,
 					inboundDispatches: [],
@@ -3105,7 +3138,7 @@ export class SlackNotificationDaemon {
 			let renewed = false;
 			await this.store.transact(key, current => {
 				if (
-					!current ||
+					current?.state !== "posting_root" ||
 					current.clientMsgId !== clientMsgId ||
 					current.rootPublicationOwner !== this.#publicationOwnerId ||
 					current.rootPublicationFence !== fence
@@ -3269,18 +3302,82 @@ export class SlackNotificationDaemon {
 		sessionId: string,
 		body: string,
 		endpointGeneration: number,
+		lifecycleGeneration: number,
+		attachmentAuthorityId?: string,
 	): Promise<SlackConversation> {
-		for (let attempt = 0; attempt < 100; attempt++) {
-			await Bun.sleep(10);
+		// Another owner may renew this lease while provider work is active, so wait for the durable transition.
+		while (true) {
+			if (lifecycleGeneration !== this.#lifecycleGeneration)
+				throw new Error("Slack daemon stopped while waiting for root publication");
+			await Bun.sleep(ROOT_PUBLICATION_POLL_MS);
+			if (lifecycleGeneration !== this.#lifecycleGeneration)
+				throw new Error("Slack daemon stopped while waiting for root publication");
 			const current = await this.store.read(key);
+			if (lifecycleGeneration !== this.#lifecycleGeneration)
+				throw new Error("Slack daemon stopped while waiting for root publication");
 			if (current?.state === "active") {
 				const currentGeneration = this.#requireEndpointGeneration(current);
-				if (currentGeneration === endpointGeneration) return current;
+				if (currentGeneration === endpointGeneration) {
+					const endpoint = await this.#resolveAttachment(sessionId);
+					if (lifecycleGeneration !== this.#lifecycleGeneration)
+						throw new Error("Slack daemon stopped while waiting for root publication");
+					if (
+						!endpoint?.isCurrent() ||
+						endpoint.sessionId !== sessionId ||
+						endpoint.generation !== endpointGeneration ||
+						endpoint.authorityId !== attachmentAuthorityId ||
+						current.attachmentAuthorityId !== attachmentAuthorityId
+					)
+						throw new SlackEndpointBindingError("Slack root publication was retired before completion.");
+					return current;
+				}
 				if (currentGeneration > endpointGeneration)
 					throw new SlackEndpointBindingError("Slack root belongs to a newer endpoint generation.");
 				return await this.resume(sessionId, body, endpointGeneration);
 			}
+			if (current?.state === "closed_marker") {
+				const currentGeneration = this.#requireEndpointGeneration(current);
+				if (currentGeneration > endpointGeneration)
+					throw new SlackEndpointBindingError("Slack root belongs to a newer endpoint generation.");
+				const endpoint = await this.#resolveAttachment(sessionId);
+				if (lifecycleGeneration !== this.#lifecycleGeneration)
+					throw new Error("Slack daemon stopped while waiting for root publication");
+				if (
+					!endpoint?.isCurrent() ||
+					endpoint.sessionId !== sessionId ||
+					endpoint.generation !== endpointGeneration ||
+					endpoint.authorityId !== attachmentAuthorityId
+				)
+					throw new SlackEndpointBindingError("Slack root publication was retired before completion.");
+				if (currentGeneration === endpointGeneration) {
+					if (!current.rootTs)
+						throw new SlackEndpointBindingError("Slack root publication was retired before completion.");
+					if (
+						current.rootPublicationOwner !== undefined &&
+						!this.#leaseExpired(current.rootPublicationLeaseExpiresAt, this.#now())
+					)
+						continue;
+					return await this.postRoot(sessionId, body, endpointGeneration);
+				}
+				if (
+					current.rootPublicationOwner !== undefined &&
+					!this.#leaseExpired(current.rootPublicationLeaseExpiresAt, this.#now())
+				)
+					continue;
+				return await this.resume(sessionId, body, endpointGeneration);
+			}
+			if (current?.state === "resumed_root") {
+				const currentGeneration = this.#requireEndpointGeneration(current);
+				if (currentGeneration > endpointGeneration)
+					throw new SlackEndpointBindingError("Slack root belongs to a newer endpoint generation.");
+				if (
+					current.rootPublicationOwner === undefined ||
+					this.#leaseExpired(current.rootPublicationLeaseExpiresAt, this.#now())
+				)
+					return await this.resume(sessionId, body, endpointGeneration);
+			}
 			if (
+				current === undefined ||
 				current?.state === "error" ||
 				(current?.state === "posting_root" &&
 					this.#leaseExpired(current.rootPublicationLeaseExpiresAt, this.#now())) ||
@@ -3291,7 +3388,6 @@ export class SlackNotificationDaemon {
 				return await this.postRoot(sessionId, body, endpointGeneration);
 			}
 		}
-		throw new Error("Slack root post is still pending");
 	}
 
 	async #waitForAction(key: string, sessionId: string, body: string, actionId: string): Promise<SlackConversation> {

package/src/sdk/bus/telegram-daemon-contract.ts

@@ -303,8 +303,14 @@ export const SDK_LIFECYCLE_ROUTER_PROTOCOL_VERSION = 1;
  * before its terminal record is durable.
  * Generation 203 replaces owners that still treat a project `.gjc` file as an
  * explicit deadline-autosave opt-in for a primary checkout.
+ * Generation 205 replaces owners whose process descendant walk can adopt
+ * children of a recycled PID. Generation 206 verifies macOS descendant
+ * identities and parentage before retaining PTY termination authority, and
+ * reaps adopted Linux PTY descendants when GJC is a child reaper.
+ * Generation 209 installs connection-owned private SDK image staging with
+ * execution-owned reservations, replacing hosts without that lifecycle contract.
  */
-export const DAEMON_GENERATION = 204;
+export const DAEMON_GENERATION = 209;
 
 /**
  * Serving-compatibility boundary for daemon lifecycle requests. Epoch 7

package/src/sdk/bus/telegram-daemon.ts

@@ -302,6 +302,8 @@ export const ASK_SELECTED_ACK_CAPABILITY = "ask_selected_ack_v1";
 export const ASK_CONTROLS_CAPABILITY = "ask_controls_v1";
 /** Capability for the closed tool phase set: started, completed, failed, and cancelled. */
 export const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v2";
+/** Receive content-free notifications when a running command needs host-side authentication. */
+export const AWAITING_INPUT_CAPABILITY = "awaiting_input_v1";
 /** Receive-only compatibility capability for pre-v2 hosts. */
 export const LEGACY_TOOL_ACTIVITY_CAPABILITY = "tool_activity_v1";
 /** Public `sdk/bus/telegram-daemon` path for the canonical `sdk/host` capability token. */
@@ -5428,6 +5430,7 @@ export class TelegramNotificationDaemon {
 					ASK_CONTROLS_CAPABILITY,
 					ASK_SELECTED_ACK_CAPABILITY,
 					TOOL_ACTIVITY_CAPABILITY,
+					AWAITING_INPUT_CAPABILITY,
 					LEGACY_TOOL_ACTIVITY_CAPABILITY,
 					POSITIONED_NOTIFICATION_EFFECTS_CAPABILITY,
 					"ephemeral_turn_v1",
@@ -7255,6 +7258,7 @@ export class TelegramNotificationDaemon {
 		"config_update",
 		"control_command_result",
 		"tool_activity",
+		"awaiting_input",
 		"reasoning_summary",
 	]);
 
@@ -10874,8 +10878,12 @@ export class TelegramNotificationDaemon {
 				this.failLegacyToolStart(toolActivity);
 				await this.#failPublicationPreSend(publicationId, "topic authority is inactive or malformed");
 			}
+			const flatSend =
+				threadedFrame.type === "awaiting_input"
+					? { ...send, text: `${send.text} · ${sessionTag(logicalSessionId)}` }
+					: send;
 			if (!send.identity && !existingTopic && !this.flatIdentitySent.has(logicalSessionId)) {
-				await this.deliverFlatFallback(logicalSessionId, send, toolActivity, socketLease, publicationId);
+				await this.deliverFlatFallback(logicalSessionId, flatSend, toolActivity, socketLease, publicationId);
 				return;
 			}
 			const topicId =
@@ -10896,7 +10904,7 @@ export class TelegramNotificationDaemon {
 					abandonStaleToolStart();
 					return;
 				}
-				await this.deliverFlatFallback(logicalSessionId, send, toolActivity, socketLease, publicationId);
+				await this.deliverFlatFallback(logicalSessionId, flatSend, toolActivity, socketLease, publicationId);
 				return;
 			}
 			if (send.identity) {

package/src/sdk/bus/threaded-render.ts

@@ -2,7 +2,7 @@
  * Pure rendering of threaded-session frames into Telegram send specs.
  *
  * The daemon receives the additive `ServerMessage` frames (identity_header,
- * context_update, turn_stream, image_attachment, config_update) over the session
+ * context_update, turn_stream, image_attachment, config_update, awaiting_input) over the session
  * WS and must turn each into a Bot API call scoped to the session's forum topic
  * (`message_thread_id`), throttled through the shared rate-limit pool. This
  * module is the pure frame→send mapping (including the priority lane and live-
@@ -80,6 +80,7 @@ interface ThreadedFrame {
 	// tool_activity
 	toolCallId?: unknown;
 	toolName?: unknown;
+	kind?: unknown;
 	argsSummary?: unknown;
 	resultSummary?: unknown;
 	isError?: unknown;
@@ -261,6 +262,24 @@ export function renderThreadedFrame(frame: ThreadedFrame): ThreadedSend | undefi
 				terminal: phase !== "started",
 			};
 		}
+		case "awaiting_input": {
+			const toolCallId = str(frame.toolCallId);
+			if (!toolCallId) return undefined;
+			let text: string;
+			switch (frame.kind) {
+				case "browser_auth":
+					text =
+						"⏳ A running command is waiting for browser sign-in. Finish it on the host; the agent continues when the command does.";
+					break;
+				case "device_code":
+					text =
+						"⏳ A running command is waiting for a device-code sign-in. Finish it on the host; the agent continues when the command does.";
+					break;
+				default:
+					return undefined;
+			}
+			return { method: "sendMessage", lane: "ask", text, coalesceKey: `awaiting:${toolCallId}` };
+		}
 		case "reasoning_summary": {
 			const text = str(frame.text);
 			if (!text) return undefined;

package/src/sdk/cli/session-cli.ts

@@ -279,6 +279,8 @@ export function lifecyclePublicFailure(outcome: Extract<SessionLifecycleResult,
 	let diagnostic: PublicCommandDiagnosticCode | undefined;
 	if (outcome.error.code === "idempotency_conflict") {
 		diagnostic = "lifecycle_idempotency_conflict";
+	} else if (outcome.error.code === "legacy_lifecycle_ambiguous") {
+		diagnostic = "lifecycle_legacy_history_ambiguous";
 	} else if (LIFECYCLE_INPUT_REFUSAL_CODES.has(outcome.error.code)) {
 		diagnostic = "lifecycle_input_refused";
 	}

package/src/sdk/host/control/dispatch.ts

@@ -256,7 +256,19 @@ function invoke(
 ): Promise<ControlValue> | ControlValue {
 	switch (operation) {
 		case "turn.prompt":
-			return surface.prompt(text(input), input.images, input.clientRef as string | undefined);
+			return surface.prompt(text(input), input.images, input.clientRef as string | undefined, input.stagedImages);
+		case "turn.image.begin":
+			if (!surface.imageBegin) invalidInput("Image uploads are not installed for this session.");
+			return surface.imageBegin(input);
+		case "turn.image.append":
+			if (!surface.imageAppend) invalidInput("Image uploads are not installed for this session.");
+			return surface.imageAppend(input);
+		case "turn.image.finish":
+			if (!surface.imageFinish) invalidInput("Image uploads are not installed for this session.");
+			return surface.imageFinish(input);
+		case "turn.image.discard":
+			if (!surface.imageDiscard) invalidInput("Image uploads are not installed for this session.");
+			return surface.imageDiscard(input);
 		case "turn.steer":
 			return surface.steer(
 				text(input),

package/src/sdk/host/control/operations.ts

@@ -21,7 +21,16 @@ export type ControlInput = Record<string, unknown>;
  * AgentSession and its controllers without exposing those concrete types here.
  */
 export interface ControlSurface {
-	prompt(text: string, images?: ControlValue, clientRef?: string): Promise<ControlValue> | ControlValue;
+	prompt(
+		text: string,
+		images?: ControlValue,
+		clientRef?: string,
+		stagedImages?: ControlValue,
+	): Promise<ControlValue> | ControlValue;
+	imageBegin?(input: ControlValue): Promise<ControlValue> | ControlValue;
+	imageAppend?(input: ControlValue): Promise<ControlValue> | ControlValue;
+	imageFinish?(input: ControlValue): Promise<ControlValue> | ControlValue;
+	imageDiscard?(input: ControlValue): Promise<ControlValue> | ControlValue;
 	steer(text: string, clientRef?: string, expectedSdkRunToken?: string): Promise<ControlValue> | ControlValue;
 	followUp(text: string): Promise<ControlValue> | ControlValue;
 	abort(): Promise<ControlValue> | ControlValue;

package/src/sdk/host/events.ts

@@ -26,10 +26,37 @@ export interface EventReplay {
 	gap?: EventReplayGap;
 }
 
+/** Kinds emit sites suppress once notification redaction is on. */
+const REDACTED_REPLAY_KINDS: ReadonlySet<string> = new Set([
+	"turn_stream",
+	"context_update",
+	"image_attachment",
+	"file_attachment",
+	"reasoning_summary",
+	"tool_activity",
+]);
+
+const outboundRedactBySession = new Map<string, boolean>();
+
+/** Notification policy refresh records the live redaction bit for one session ring. */
+export function setSessionOutboundRedact(sessionId: string, enabled: boolean): void {
+	outboundRedactBySession.set(sessionId, enabled);
+}
+
+function frameSessionId(frame: SdkFrame): string | undefined {
+	if (typeof frame.sessionId === "string") return frame.sessionId;
+	const payload = frame.payload;
+	if (!payload || typeof payload !== "object") return undefined;
+	const sessionId = (payload as { sessionId?: unknown }).sessionId;
+	return typeof sessionId === "string" ? sessionId : undefined;
+}
+
 export class SessionEventStream {
 	#generation = 0;
 	#seq = 0;
 	#frames: EventFrame[] = [];
+	#outboundRedact = false;
+	#sessionId: string | undefined;
 	readonly #ringSize: number;
 	readonly #resyncQueries: string[];
 	readonly #revisionProvider: (() => number | undefined) | undefined;
@@ -55,6 +82,12 @@ export class SessionEventStream {
 		return this.#seq;
 	}
 
+	/** Follow the session redaction bit. Replay then drops kinds emit sites already suppress. */
+	setOutboundRedact(enabled: boolean): void {
+		this.#outboundRedact = enabled;
+		if (this.#sessionId !== undefined) outboundRedactBySession.set(this.#sessionId, enabled);
+	}
+
 	restart(): number {
 		this.#generation += 1;
 		this.#seq = 0;
@@ -63,6 +96,8 @@ export class SessionEventStream {
 	}
 
 	emit(frame: SdkFrame): EventFrame {
+		this.#noteSession(frame);
+		this.#noteConfigRedact(frame);
 		const suppliedRevision = frame.revision;
 		const providedRevision = this.#revisionProvider?.();
 		const revision =
@@ -85,10 +120,9 @@ export class SessionEventStream {
 
 	/** Replays retained current-generation events and reports any required resynchronization. */
 	replay(lastSeq: number, generation = this.#generation): EventReplay {
-		const events = this.#frames.filter(frame => frame.seq > lastSeq);
 		if (generation !== this.#generation) {
 			return {
-				events: [...this.#frames],
+				events: this.#visible(this.#frames),
 				gap: {
 					kind: "generation_reset",
 					fromGeneration: generation,
@@ -101,7 +135,7 @@ export class SessionEventStream {
 		const replayFrom = lastSeq + 1;
 		if (replayFrom < oldest) {
 			return {
-				events: this.#frames.filter(frame => frame.seq >= oldest),
+				events: this.#visible(this.#frames.filter(frame => frame.seq >= oldest)),
 				gap: {
 					kind: "sequence_gap",
 					fromSeq: replayFrom,
@@ -110,6 +144,35 @@ export class SessionEventStream {
 				},
 			};
 		}
-		return { events };
+		return { events: this.#visible(this.#frames.filter(frame => frame.seq > lastSeq)) };
+	}
+
+	#noteSession(frame: SdkFrame): void {
+		if (this.#sessionId !== undefined) return;
+		this.#sessionId = frameSessionId(frame);
+	}
+
+	#noteConfigRedact(frame: SdkFrame): void {
+		if (frame.kind !== "config_update") return;
+		const payload = frame.payload;
+		if (!payload || typeof payload !== "object") return;
+		const redact = (payload as { redact?: unknown }).redact;
+		if (typeof redact !== "boolean") return;
+		this.setOutboundRedact(redact);
+	}
+
+	#replayRedact(): boolean {
+		if (this.#sessionId !== undefined) {
+			const noted = outboundRedactBySession.get(this.#sessionId);
+			if (noted !== undefined) return noted;
+		}
+		return this.#outboundRedact;
+	}
+
+	#visible(frames: readonly EventFrame[]): EventFrame[] {
+		const retained = this.#replayRedact()
+			? frames.filter(frame => !REDACTED_REPLAY_KINDS.has(String(frame.kind)))
+			: frames;
+		return [...retained];
 	}
 }

package/src/sdk/host/host.ts

@@ -103,6 +103,7 @@ export interface SessionSdkHostOptions extends HostEndpointAdapters {
  *  must see the same capability-gated event kinds on both legs, or live and
  *  replay delivery diverge for the same subscriber. */
 export const TOOL_ACTIVITY_CAPABILITY = "tool_activity_v2";
+export const AWAITING_INPUT_CAPABILITY = "awaiting_input_v1";
 /** Capability for non-replayable streamed turn content. */
 export const TURN_STREAM_CAPABILITY = "turn_stream";
 /** Capability used by notification adapters that observe a host without owning its work. */
@@ -113,12 +114,17 @@ export const SESSION_HOST_OBSERVER_CAPABILITY = "session_host_observer_v1";
  * of every frame its positioned envelope already reached.
  */
 export const POSITIONED_NOTIFICATION_EFFECTS_CAPABILITY = "positioned_notification_effects_v1";
-export const CAP_GATED_FRAME_KINDS: ReadonlySet<string> = new Set(["tool_activity", "reasoning_summary"]);
+export const CAP_GATED_FRAME_KINDS: ReadonlyMap<string, string> = new Map([
+	["tool_activity", TOOL_ACTIVITY_CAPABILITY],
+	["reasoning_summary", TOOL_ACTIVITY_CAPABILITY],
+	["awaiting_input", AWAITING_INPUT_CAPABILITY],
+]);
 const EMPTY_CAPABILITIES: ReadonlySet<string> = new Set();
 
 /** Keep live delivery and replay on one capability gate. */
 export function canDeliverSdkEvent(kind: string, capabilities: ReadonlySet<string> | undefined): boolean {
-	return !CAP_GATED_FRAME_KINDS.has(kind) || capabilities?.has(TOOL_ACTIVITY_CAPABILITY) === true;
+	const requiredCapability = CAP_GATED_FRAME_KINDS.get(kind);
+	return requiredCapability === undefined || capabilities?.has(requiredCapability) === true;
 }
 
 /** Safe, identifier-free explanations for every refused activation status. */