@gajae-code/coding-agent 0.18.12 → 0.19.0

package/src/tools/tool-catalog.generated.ts

@@ -2509,7 +2509,7 @@ export const TOOL_CATALOG: Readonly<Record<string, ToolCatalogEntry>> = {
 	"irc": {
 		"name": "irc",
 		"label": "IRC",
-		"description": "Sends short text messages to other live agents in this process and receives their prose replies.\n\n<instruction>\n- The main agent is addressable as `0-Main`. Subagents reuse their task id (e.g. `0-AuthLoader`).\n- `op: \"list\"` returns the current set of visible peers. Use it before sending if you are not sure who is live.\n- `op: \"send\"` delivers `message` to `to`. `to` may be a specific id or `\"all\"` to broadcast.\n- `awaitReply` (optional): wait for a prose reply. Defaults to `true` for DMs and `false` for `to: \"all\"` broadcasts.\n- The recipient generates the reply via an ephemeral side-channel turn that uses their current model, system prompt, and history — it does **not** wait for the recipient's main loop to be free, so it is safe to IRC an agent that is currently inside a long-running tool call.\n- The exchange (incoming question + auto-reply) is queued for injection into the recipient's persisted history; the recipient sees it on its next turn and can follow up if needed.\n</instruction>\n\n<conditions>\nYou SHOULD reach for `irc` proactively when continuing alone is wasteful or wrong. When in doubt, prefer messaging.\n- **Unexpected state.** You hit something the original task did not describe — a missing file, a config that contradicts the assignment, an API behaving differently than you were told, a tool failing in a way that suggests the spec is wrong. DM `0-Main` (or the spawning agent) for guidance instead of guessing.\n- **Blocked by another agent.** A peer holds the file/branch/resource you need, has already started the change you are about to make, or owns a decision you depend on. DM that peer (or broadcast to discover who) before duplicating or stepping on work.\n- **Decision points outside your scope.** A genuine fork in the road that the assignment did not pre-decide (e.g. which of two viable APIs to use, whether to refactor adjacent code). Ask the requester rather than picking unilaterally.\n- **Coordination opportunities.** Before editing a shared file or relying on another agent's in-flight API, message the relevant peer; proactively share state that affects their work.\n\nDo **not** use `irc` for: routine progress updates, things you can verify with a tool call, or questions whose answer is already in your assignment / repo / docs.\n</conditions>\n\n<etiquette>\nThese rules apply to both sending and replying.\n- **Plain prose only.** Do not send structured JSON status payloads (e.g. `{\"type\":\"task_completed\",…}`). Write a normal sentence: \"Done with the auth refactor — left a TODO in `src/server/auth.ts` for the rate limiter.\"\n- **Do not quote the message you are replying to.** The sender already saw it; the TUI already renders it. Lead with the answer.\n- **Use IRC, not terminal tools, to learn about peers.** Do not `search` artifacts, read other sessions' JSONL files, or shell-poke around to figure out what another agent is doing. DM them — they have the live answer and you do not.\n- **One round-trip is enough.** Replies arrive synchronously when the recipient is reachable. Do not follow up with \"did you get my message?\" — they did. If `delivered` is empty or the result was `failed`, the peer is unavailable; move on or report the blocker, do not retry in a loop.\n- **Stay terse.** A DM is a chat message, not a memo. One question per send when you can. Share file paths and artifacts via `local://` / `artifact://` URLs instead of pasting blobs.\n- **Address peers by id.** Use the exact id from `op: \"list\"` (e.g. `0-AuthLoader`, `0-Main`). Do not invent friendly names.\n- **Do not IRC for things a tool would answer.** If a `read`, `search`, or build command would resolve the question, do that first.\n- **When you receive an IRC message, answer it before continuing.** The recipient injects the question + your auto-reply into your history; address it directly, do not repeat it back to the user.\n</etiquette>\n\n<output>\n- `send`: returns each recipient that received the message and any prose replies that arrived.\n- `list`: returns peers and channels visible to the caller.\n</output>\n\n<examples>\n# List peers\n`{\"op\": \"list\"}`\n# Direct message to the main agent (waits for prose reply)\n`{\"op\": \"send\", \"to\": \"0-Main\", \"message\": \"Should I prefer JWT or session cookies for the auth flow?\"}`\n# Unexpected state — ask the originator\n`{\"op\": \"send\", \"to\": \"0-Main\", \"message\": \"Assignment says edit src/auth/jwt.ts but the file does not exist. Is the new path src/server/auth/jwt.ts?\"}`\n# Blocked by a peer — ask them directly\n`{\"op\": \"send\", \"to\": \"0-AuthLoader\", \"message\": \"Are you still touching src/server/auth.ts? I need to add a 401 path; OK to proceed or should I wait?\"}`\n# Broadcast to discover who owns something (no replies, just informs them)\n`{\"op\": \"send\", \"to\": \"all\", \"message\": \"About to refactor src/server/middleware/*. Anyone already in there?\", \"awaitReply\": false}`\n</examples>",
+		"description": "Sends short text messages to other live agents in this process and receives their prose replies.\n\n<instruction>\n- The main agent is addressable as `0-Main`. Subagents reuse their task id (e.g. `0-AuthLoader`).\n- `op: \"list\"` returns the current set of visible peers. Use it before sending if you are not sure who is live.\n- `op: \"send\"` delivers `message` to `to`. `to` may be a specific id or `\"all\"` to broadcast.\n- `awaitReply` (optional): wait for a prose reply. Defaults to `true` for DMs and `false` for `to: \"all\"` broadcasts.\n- The recipient generates the reply via an ephemeral side-channel turn that uses their current model, system prompt, and history — it does **not** wait for the recipient's main loop to be free, so it is safe to IRC an agent that is currently inside a long-running tool call.\n- The exchange (incoming question + auto-reply) is injected into the recipient's persisted history as soon as it can be delivered: an idle recipient gets it immediately, and a recipient that is already streaming receives it at its next step boundary instead of at the end of its turn. The recipient can then follow up if needed.\n</instruction>\n\n<conditions>\nYou SHOULD reach for `irc` proactively when continuing alone is wasteful or wrong. When in doubt, prefer messaging.\n- **Unexpected state.** You hit something the original task did not describe — a missing file, a config that contradicts the assignment, an API behaving differently than you were told, a tool failing in a way that suggests the spec is wrong. DM `0-Main` (or the spawning agent) for guidance instead of guessing.\n- **Blocked by another agent.** A peer holds the file/branch/resource you need, has already started the change you are about to make, or owns a decision you depend on. DM that peer (or broadcast to discover who) before duplicating or stepping on work.\n- **Decision points outside your scope.** A genuine fork in the road that the assignment did not pre-decide (e.g. which of two viable APIs to use, whether to refactor adjacent code). Ask the requester rather than picking unilaterally.\n- **Coordination opportunities.** Before editing a shared file or relying on another agent's in-flight API, message the relevant peer; proactively share state that affects their work.\n\nDo **not** use `irc` for: routine progress updates, things you can verify with a tool call, or questions whose answer is already in your assignment / repo / docs.\n</conditions>\n\n<etiquette>\nThese rules apply to both sending and replying.\n- **Plain prose only.** Do not send structured JSON status payloads (e.g. `{\"type\":\"task_completed\",…}`). Write a normal sentence: \"Done with the auth refactor — left a TODO in `src/server/auth.ts` for the rate limiter.\"\n- **Do not quote the message you are replying to.** The sender already saw it; the TUI already renders it. Lead with the answer.\n- **Use IRC, not terminal tools, to learn about peers.** Do not `search` artifacts, read other sessions' JSONL files, or shell-poke around to figure out what another agent is doing. DM them — they have the live answer and you do not.\n- **One round-trip is enough.** Replies arrive synchronously when the recipient is reachable. Do not follow up with \"did you get my message?\" — they did. If `delivered` is empty or the result was `failed`, the peer is unavailable; move on or report the blocker, do not retry in a loop.\n- **Stay terse.** A DM is a chat message, not a memo. One question per send when you can. Share file paths and artifacts via `local://` / `artifact://` URLs instead of pasting blobs.\n- **Address peers by id.** Use the exact id from `op: \"list\"` (e.g. `0-AuthLoader`, `0-Main`). Do not invent friendly names.\n- **Do not IRC for things a tool would answer.** If a `read`, `search`, or build command would resolve the question, do that first.\n- **When you receive an IRC message, answer it before continuing.** The recipient injects the question + your auto-reply into your history; address it directly, do not repeat it back to the user.\n</etiquette>\n\n<output>\n- `send`: returns each recipient that received the message and any prose replies that arrived.\n- `list`: returns peers and channels visible to the caller.\n</output>\n\n<examples>\n# List peers\n`{\"op\": \"list\"}`\n# Direct message to the main agent (waits for prose reply)\n`{\"op\": \"send\", \"to\": \"0-Main\", \"message\": \"Should I prefer JWT or session cookies for the auth flow?\"}`\n# Unexpected state — ask the originator\n`{\"op\": \"send\", \"to\": \"0-Main\", \"message\": \"Assignment says edit src/auth/jwt.ts but the file does not exist. Is the new path src/server/auth/jwt.ts?\"}`\n# Blocked by a peer — ask them directly\n`{\"op\": \"send\", \"to\": \"0-AuthLoader\", \"message\": \"Are you still touching src/server/auth.ts? I need to add a 401 path; OK to proceed or should I wait?\"}`\n# Broadcast to discover who owns something (no replies, just informs them)\n`{\"op\": \"send\", \"to\": \"all\", \"message\": \"About to refactor src/server/middleware/*. Anyone already in there?\", \"awaitReply\": false}`\n</examples>",
 		"parameters": {
 			"type": "object",
 			"properties": {

package/src/tools/ultragoal-ask-guard.ts

@@ -1,4 +1,5 @@
 import type { AgentTool } from "@gajae-code/agent-core";
+import { resolveRalplanCurrentFinal, selectsRalplanApprovalGate } from "../gjc-runtime/ralplan-current-final";
 import {
 	consumeUltragoalAskNudge,
 	isUltragoalAskBlocked,
@@ -33,6 +34,7 @@ export async function assertUltragoalAskAllowed(
 	cwd: string,
 	context: UltragoalAskGuardContext = {},
 	agentDir?: string,
+	pendingQuestions?: unknown,
 ): Promise<void> {
 	// Durable Ultragoal state is session-scoped, so only the caller's own run may
 	// block `ask`. An anonymous caller has no run attributable to it, so the guard
@@ -43,6 +45,16 @@ export async function assertUltragoalAskAllowed(
 	if (!sessionId) return;
 	const diagnostic = await isUltragoalAskBlocked(cwd, { sessionId });
 	if (!diagnostic.active) return;
+	// The one ask that may proceed while a goal is blocked is the execution
+	// approval for an authenticated current ralplan final (issue #6578). The
+	// request must select that gate and the final must validate on disk; a
+	// caller-declared tag alone never lifts the guard. AskTool still captures and
+	// authenticates the publication it records consent against.
+	if (selectsRalplanApprovalGate(pendingQuestions)) {
+		const resolution = await resolveRalplanCurrentFinal({ cwd, sessionId, agentDir });
+		if (resolution.ok) return;
+		throw new ToolError(`Ultragoal ask guard refused the ralplan execution approval: ${resolution.refusal.reason}`);
+	}
 	const nudge = await consumeUltragoalAskNudge(cwd, sessionId, agentDir);
 	if (nudge.nudged) throw new ToolError(nudge.message);
 	throw new ToolError(formatUltragoalAskBlockMessage(diagnostic));
@@ -66,7 +78,7 @@ export function guardToolForUltragoalAsk<T extends AgentTool>(
 				// budget against the SESSION profile, never the process-global one.
 				// The caller session id is the only binding, so a foreign session's
 				// durable run can never gate this ask.
-				await assertUltragoalAskAllowed(getCwd(), getContext(), getSessionAgentDir());
+				await assertUltragoalAskAllowed(getCwd(), getContext(), getSessionAgentDir(), args[1]);
 				return Reflect.apply(target.execute, target, args);
 			};
 		},

package/src/tools/write.ts

@@ -218,6 +218,13 @@ export class WriteTool implements AgentTool<typeof writeSchema, WriteToolDetails
 	readonly loadMode = "discoverable";
 	readonly summary = "Write content to a file (creates or overwrites)";
 
+	/** Stream matchers should see the real file content, not its JSON-escaped argument encoding. */
+	matcherDigest(args: unknown): string | undefined {
+		if (!args || typeof args !== "object" || Array.isArray(args)) return undefined;
+		const content = (args as Partial<WriteParams>).content;
+		return typeof content === "string" ? content : undefined;
+	}
+
 	readonly #writethrough: WritethroughCallback;
 
 	constructor(private readonly session: ToolSession) {

package/src/tui/tree-list.ts

@@ -3,11 +3,25 @@
  */
 
 import { replaceTabs } from "@gajae-code/tui";
+import { sanitizeText } from "@gajae-code/utils";
 import type { Theme } from "../modes/theme/theme";
 import { formatMoreItems } from "../tools/render-utils";
 import type { TreeContext } from "./types";
 import { getTreeBranch, getTreeContinuePrefix } from "./utils";
 
+/**
+ * Tool renderers pass raw match lines or line groups into `renderItem`, which
+ * then applies theme colors. Strip controls first so OSC bytes are not wrapped
+ * into the styled string. Objects (file entries, todos) are left unchanged.
+ */
+function sanitizeTreeItem<T>(item: T): T {
+	if (typeof item === "string") return sanitizeText(item) as T;
+	if (Array.isArray(item)) {
+		return item.map(part => (typeof part === "string" ? sanitizeText(part) : part)) as T;
+	}
+	return item;
+}
+
 export interface TreeListOptions<T> {
 	items: T[];
 	expanded?: boolean;
@@ -32,7 +46,7 @@ export function renderTreeList<T>(options: TreeListOptions<T>, theme: Theme): st
 	// renderItem implementations MUST NOT vary line count based on isLast.
 	const preRendered: string[][] = [];
 	for (let i = 0; i < maxItems; i++) {
-		const rendered = renderItem(items[i], {
+		const rendered = renderItem(sanitizeTreeItem(items[i]!), {
 			index: i,
 			isLast: false,
 			depth: 0,

package/src/utils/commit-message-generator.ts

@@ -44,8 +44,9 @@ function redactCommitMessageText(text: string): string {
 function getModelCandidates(
 	registry: ModelRegistry,
 	settings: Settings,
+	credentialSessionId?: string,
 ): Array<{ model: Model<Api>; thinkingLevel?: ThinkingLevel }> {
-	const availableModels = registry.getAvailable();
+	const availableModels = registry.getAvailable(credentialSessionId);
 	if (availableModels.length === 0) return [];
 
 	const candidates: Array<{ model: Model<Api>; thinkingLevel?: ThinkingLevel }> = [];
@@ -80,7 +81,7 @@ export async function generateCommitMessage(
 	settings: Settings,
 	sessionId?: string,
 ): Promise<string | null> {
-	const candidates = getModelCandidates(registry, settings);
+	const candidates = getModelCandidates(registry, settings, sessionId);
 	if (candidates.length === 0) {
 		logger.debug("commit-msg-generator: no model found");
 		return null;

package/src/utils/external-editor.ts

@@ -6,7 +6,7 @@ import { spawn } from "node:child_process";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
-import { $pickCredentialEnv, Snowflake } from "@gajae-code/utils";
+import { $pickCredentialEnv } from "@gajae-code/utils";
 
 /** Returns the user's preferred editor command, or undefined if not configured. */
 export function getEditorCommand(): string | undefined {
@@ -119,10 +119,22 @@ export async function openInEditor(
 	options?: OpenInEditorOptions,
 ): Promise<string | null> {
 	const ext = options?.extension ?? ".md";
-	const tmpFile = path.join(os.tmpdir(), `gjc-editor-${Snowflake.next()}${ext}`);
+	// Random directory plus an exclusive create: a preexisting symlink under the
+	// temp directory is not opened, and the draft is not left world-readable.
+	let tempDir: string | undefined;
+	let tmpFile = "";
 
 	try {
-		await Bun.write(tmpFile, content);
+		tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "gjc-editor-"));
+		if (process.platform !== "win32") await fs.chmod(tempDir, 0o700);
+		tmpFile = path.join(tempDir, `draft${ext}`);
+		const handle = await fs.open(tmpFile, "wx", 0o600);
+		try {
+			await handle.writeFile(content);
+		} finally {
+			await handle.close();
+		}
+		if (process.platform !== "win32") await fs.chmod(tmpFile, 0o600);
 
 		const [editor, ...editorArgs] = editorCmd.split(" ");
 		const stdio = options?.stdio ?? ["inherit", "inherit", "inherit"];
@@ -147,10 +159,12 @@ export async function openInEditor(
 		}
 		return null;
 	} finally {
-		try {
-			await fs.rm(tmpFile, { force: true });
-		} catch {
-			// Ignore cleanup errors
+		if (tempDir) {
+			try {
+				await fs.rm(tempDir, { recursive: true, force: true });
+			} catch {
+				// Ignore cleanup errors
+			}
 		}
 	}
 }

package/src/utils/file-mentions.ts

@@ -11,7 +11,7 @@ import type { AgentMessage } from "@gajae-code/agent-core";
 import type { ImageContent } from "@gajae-code/ai/core";
 import type { glob as globFn } from "@gajae-code/natives";
 import { fuzzyMatch } from "@gajae-code/tui";
-import { formatAge, formatBytes, readImageMetadata } from "@gajae-code/utils";
+import { formatAge, formatBytes, pathIsWithin, readImageMetadata, resolveEquivalentPath } from "@gajae-code/utils";
 import { formatHashLines } from "../hashline/hash";
 import type { FileMentionMessage } from "../session/messages";
 import {
@@ -313,6 +313,26 @@ export function extractFileMentions(text: string): string[] {
 	return [...new Set(mentions)];
 }
 
+/**
+ * Compare canonical Windows paths without folding directory names: individual
+ * directories can opt into case-sensitive names.
+ */
+export function isCanonicalWindowsPathWithin(root: string, candidate: string): boolean {
+	if (!path.win32.isAbsolute(root) || !path.win32.isAbsolute(candidate)) return false;
+
+	const canonicalRoot = path.win32.resolve(root);
+	const canonicalCandidate = path.win32.resolve(candidate);
+	const rootParts = path.win32.parse(canonicalRoot);
+	const candidateParts = path.win32.parse(canonicalCandidate);
+	if (rootParts.root.toLowerCase() !== candidateParts.root.toLowerCase()) return false;
+
+	const rootSegments = canonicalRoot.slice(rootParts.root.length).split(path.win32.sep).filter(Boolean);
+	const candidateSegments = canonicalCandidate.slice(candidateParts.root.length).split(path.win32.sep).filter(Boolean);
+	if (candidateSegments.length < rootSegments.length) return false;
+
+	return rootSegments.every((segment, index) => segment === candidateSegments[index]);
+}
+
 /**
  * Generate a FileMentionMessage containing the contents of mentioned files.
  * Returns empty array if no files could be read.
@@ -336,6 +356,8 @@ export async function generateFileMentionMessages(
 	if (filePaths.length === 0) return [];
 
 	const autoResizeImages = options?.autoResizeImages ?? true;
+	const canonicalWindowsCwd = process.platform === "win32" ? await fs.realpath(cwd).catch(() => undefined) : undefined;
+	if (process.platform === "win32" && canonicalWindowsCwd === undefined) return [];
 
 	const files: FileMentionMessage["files"] = [];
 	let mentionCandidatesPromise: Promise<MentionCandidate[]> | null = null;
@@ -351,6 +373,24 @@ export async function generateFileMentionMessages(
 			continue;
 		}
 		const absolutePath = resolveReadPath(resolvedPath, cwd);
+		// Skip `..`, `~`, and outside absolute paths. On Windows, realpath both
+		// paths and compare exact components because directories can be case-sensitive.
+		// Fail closed if either real path is unavailable. Read the canonical path so
+		// replacing the original mention symlink does not retarget this read.
+		const canonicalPath =
+			process.platform === "win32"
+				? await fs.realpath(absolutePath).catch(() => undefined)
+				: resolveEquivalentPath(absolutePath);
+		if (!canonicalPath) {
+			continue;
+		}
+		const staysWithinSession =
+			process.platform === "win32"
+				? canonicalWindowsCwd !== undefined && isCanonicalWindowsPathWithin(canonicalWindowsCwd, canonicalPath)
+				: pathIsWithin(cwd, canonicalPath);
+		if (!staysWithinSession) {
+			continue;
+		}
 		// Duplicate suppression, keyed by absolute path: same path shown earlier this
 		// batch or recently in the conversation → compact note, no re-read (the path
 		// stays referenced so the model can re-fetch via the read tool).
@@ -364,14 +404,14 @@ export async function generateFileMentionMessages(
 		}
 		shownInBatch.add(absolutePath);
 		try {
-			const stat = await Bun.file(absolutePath).stat();
+			const stat = await Bun.file(canonicalPath).stat();
 			if (stat.isDirectory()) {
-				const { output, lineCount } = await buildDirectoryListing(absolutePath);
+				const { output, lineCount } = await buildDirectoryListing(canonicalPath);
 				files.push({ path: resolvedPath, content: output, lineCount });
 				continue;
 			}
 
-			const imageMetadata = await readImageMetadata(absolutePath);
+			const imageMetadata = await readImageMetadata(canonicalPath);
 			const mimeType = imageMetadata?.mimeType;
 			if (mimeType) {
 				if (stat.size > MAX_AUTO_READ_IMAGE_BYTES) {
@@ -383,7 +423,7 @@ export async function generateFileMentionMessages(
 					});
 					continue;
 				}
-				const buffer = await fs.readFile(absolutePath);
+				const buffer = await fs.readFile(canonicalPath);
 				if (buffer.length === 0) {
 					continue;
 				}
@@ -420,7 +460,7 @@ export async function generateFileMentionMessages(
 				continue;
 			}
 
-			const content = await Bun.file(absolutePath).text();
+			const content = await Bun.file(canonicalPath).text();
 			let { output, lineCount } = buildTextOutput(content, options?.maxInlineBytes);
 			if (options?.useHashLines) {
 				output = formatHashLines(output);

package/src/utils/git.ts

@@ -1,7 +1,8 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { $which, hasFsCode, isEnoent, Snowflake } from "@gajae-code/utils";
+import { $which, hasFsCode, isEnoent } from "@gajae-code/utils";
+import { projectSafeSpawnEnv } from "@gajae-code/utils/shell-config";
 import {
 	parseDiffHunks as parseCommitDiffHunks,
 	parseFileDiffs,
@@ -198,7 +199,10 @@ async function runCommand(
 	const commandArgs = withShortLivedGitConfig(options.readOnly ? withNoOptionalLocks(args) : [...args]);
 	const child = Bun.spawn(["git", ...commandArgs], {
 		cwd,
-		env: options.env ? { ...process.env, GIT_OPTIONAL_LOCKS: "0", ...options.env } : undefined,
+		// The inherited environment holds the autoloaded project `.env`; without
+		// filtering, a repository could set e.g. `GIT_CONFIG_*` (`core.hooksPath`)
+		// or `GIT_SSH_COMMAND` and have GJC's own commit/fetch/push run its code.
+		env: options.env ? { ...projectSafeSpawnEnv(), GIT_OPTIONAL_LOCKS: "0", ...options.env } : projectSafeSpawnEnv(),
 		signal: options.signal,
 		stdin: normalizeStdin(options.stdin),
 		stdout: "pipe",
@@ -365,9 +369,24 @@ function buildApplyArgs(patchPath: string, options: PatchOptions): string[] {
 }
 
 async function writeTempPatch(content: string): Promise<string> {
-	const tempPath = path.join(os.tmpdir(), `gjc-git-patch-${Snowflake.next()}.patch`);
-	await Bun.write(tempPath, content);
-	return tempPath;
+	// Random directory plus an exclusive create: a preexisting symlink under the
+	// shared temp directory is not opened, and the patch is not left world-readable.
+	const tempDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "gjc-git-patch-"));
+	try {
+		if (process.platform !== "win32") await fs.promises.chmod(tempDir, 0o700);
+		const tempPath = path.join(tempDir, "patch");
+		const handle = await fs.promises.open(tempPath, "wx", 0o600);
+		try {
+			await handle.writeFile(content);
+		} finally {
+			await handle.close();
+		}
+		if (process.platform !== "win32") await fs.promises.chmod(tempPath, 0o600);
+		return tempPath;
+	} catch (error) {
+		await fs.promises.rm(tempDir, { recursive: true, force: true });
+		throw error;
+	}
 }
 
 // ════════════════════════════════════════════════════════════════════════════
@@ -1232,7 +1251,7 @@ export const patch = {
 		try {
 			await patch.apply(cwd, tempPath, options);
 		} finally {
-			await fs.promises.rm(tempPath, { force: true });
+			await fs.promises.rm(path.dirname(tempPath), { recursive: true, force: true });
 		}
 	},
 
@@ -1253,7 +1272,7 @@ export const patch = {
 		try {
 			return await patch.canApply(cwd, tempPath, options);
 		} finally {
-			await fs.promises.rm(tempPath, { force: true });
+			await fs.promises.rm(path.dirname(tempPath), { recursive: true, force: true });
 		}
 	},
 
@@ -1594,6 +1613,14 @@ function formatGhFailure(args: readonly string[], stdout: string, stderr: string
 	return `GitHub CLI command failed: gh ${args.join(" ")}`;
 }
 
+/** Captured `gh` output never wants a pager or forced-terminal behavior. */
+function ghSpawnEnv(): Record<string, string> {
+	const env = projectSafeSpawnEnv();
+	delete env.GH_FORCE_TTY;
+	env.GH_PAGER = "cat";
+	return env;
+}
+
 export const github = {
 	/** Check if `gh` CLI is installed. */
 	available(): boolean {
@@ -1609,6 +1636,10 @@ export const github = {
 		try {
 			const child = Bun.spawn(["gh", ...args], {
 				cwd,
+				// Same project-dotenv filtering as git: `gh` runs git for checkout
+				// and push. Output is captured, so gh must never page or act as if
+				// on a terminal; pin both so a project `.env` cannot select a pager.
+				env: ghSpawnEnv(),
 				stdin: "ignore",
 				stdout: "pipe",
 				stderr: "pipe",

package/src/utils/image-limits.ts

@@ -0,0 +1,8 @@
+// Shared input policy must remain independent of file loading, tools and sessions.
+export const MAX_IMAGE_INPUT_BYTES = 20 * 1024 * 1024;
+export const MAX_STAGED_PROMPT_IMAGES = 16;
+export const MAX_PASTED_IMAGE_SOURCE_BYTES = 64 * 1024 * 1024;
+export const MAX_PASTED_IMAGE_OUTPUT_BYTES = 64 * 1024 * 1024;
+export const MAX_PASTED_IMAGE_DIMENSION = 20_000;
+export const MAX_PASTED_IMAGE_PIXELS = 40_000_000;
+export const MAX_PASTED_IMAGE_DECODED_BYTES = 160 * 1024 * 1024;

package/src/utils/image-loading.ts

@@ -2,9 +2,9 @@ import * as fs from "node:fs/promises";
 import type { ImageContent } from "@gajae-code/ai/core";
 import { formatBytes, readImageMetadata, SUPPORTED_IMAGE_MIME_TYPES } from "@gajae-code/utils";
 import { resolveReadPath } from "../tools/path-utils";
+import { MAX_IMAGE_INPUT_BYTES } from "./image-limits";
 import { formatDimensionNote, resizeImageBuffer } from "./image-resize";
 
-export const MAX_IMAGE_INPUT_BYTES = 20 * 1024 * 1024;
 export const SUPPORTED_INPUT_IMAGE_MIME_TYPES = SUPPORTED_IMAGE_MIME_TYPES;
 
 const SVG_MIME_TYPE = "image/svg+xml";

package/src/utils/open.ts

@@ -1,15 +1,84 @@
-/** Open a URL or file path in the default browser/application. Best-effort, never throws. */
+/** Open an http(s) URL or local path. Best-effort, never throws. */
+const ALLOWED_OPEN_PROTOCOLS = new Set(["http:", "https:"]);
+
+/**
+ * Zero-width and non-ASCII spaces. ASCII controls are rejected, not stripped:
+ * the URL parser drops some of them and would turn a hostile string into a clean href.
+ */
+const OUTER_FORMAT = /[\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000\uFEFF\u200B\u2060]/;
+
+function hasAsciiControl(value: string): boolean {
+	for (let i = 0; i < value.length; i++) {
+		const code = value.charCodeAt(i);
+		if (code <= 0x1f || code === 0x7f) return true;
+	}
+	return false;
+}
+
+function isOuterPadding(ch: string): boolean {
+	return ch.trim() === "" || OUTER_FORMAT.test(ch);
+}
+
+/** Drop every outer space or format character. Classification only; local paths stay raw. */
+function peelPadding(value: string): string {
+	let start = 0;
+	let end = value.length;
+	while (start < end && isOuterPadding(value.charAt(start))) start++;
+	while (end > start && isOuterPadding(value.charAt(end - 1))) end--;
+	return start === 0 && end === value.length ? value : value.slice(start, end);
+}
+
+/** Drive paths parse as one-letter schemes (`c:`). Recognize them before that check. */
+function isWindowsDrivePath(value: string): boolean {
+	return /^[A-Za-z]:[\\/]/.test(value);
+}
+
+const SCHEME_PREFIX = /^[A-Za-z][A-Za-z0-9+.-]*:/;
+
+/** http(s) href, "reject" for any other URL, or undefined when `value` is not a URL. */
+function classifyUrl(value: string): string | "reject" | undefined {
+	if (isWindowsDrivePath(value) || isWindowsDrivePath(value.trim())) return undefined;
+	try {
+		const parsed = new URL(value);
+		if (!ALLOWED_OPEN_PROTOCOLS.has(parsed.protocol) || hasAsciiControl(parsed.href)) return "reject";
+		return parsed.href;
+	} catch {
+		return undefined;
+	}
+}
+
+function resolveOpenTarget(raw: string): string | undefined {
+	if (hasAsciiControl(raw) || raw.length === 0) return undefined;
+	// Local paths, including surrounding spaces, are spawned unchanged.
+	if (isWindowsDrivePath(raw)) return raw;
+	const direct = classifyUrl(raw);
+	if (direct === "reject") return undefined;
+	if (direct !== undefined) return direct;
+
+	const peeled = peelPadding(raw);
+	if (peeled.length === 0) return undefined;
+	// Padding can hide a scheme or a flag. Refuse that instead of opening a different string.
+	if (peeled !== raw && !isWindowsDrivePath(peeled)) {
+		const hidden = classifyUrl(peeled);
+		if (hidden !== undefined || peeled.startsWith("-") || SCHEME_PREFIX.test(peeled)) return undefined;
+	}
+	if (raw.startsWith("-") || SCHEME_PREFIX.test(raw)) return undefined;
+	return raw;
+}
+
 export function openPath(urlOrPath: string): void {
+	const target = resolveOpenTarget(urlOrPath);
+	if (target === undefined) return;
 	let cmd: string[];
 	switch (process.platform) {
 		case "darwin":
-			cmd = ["open", urlOrPath];
+			cmd = ["open", target];
 			break;
 		case "win32":
-			cmd = ["rundll32", "url.dll,FileProtocolHandler", urlOrPath];
+			cmd = ["rundll32", "url.dll,FileProtocolHandler", target];
 			break;
 		default:
-			cmd = ["xdg-open", urlOrPath];
+			cmd = ["xdg-open", target];
 			break;
 	}
 	try {

package/src/utils/pasted-image-loading.ts

@@ -4,10 +4,17 @@ import * as os from "node:os";
 import * as path from "node:path";
 import type { ImageContent } from "@gajae-code/ai/core";
 import { formatBytes, parseImageMetadata } from "@gajae-code/utils";
+import {
+	MAX_IMAGE_INPUT_BYTES,
+	MAX_PASTED_IMAGE_DECODED_BYTES,
+	MAX_PASTED_IMAGE_DIMENSION,
+	MAX_PASTED_IMAGE_OUTPUT_BYTES,
+	MAX_PASTED_IMAGE_PIXELS,
+	MAX_PASTED_IMAGE_SOURCE_BYTES,
+} from "./image-limits";
 import {
 	ImageInputTooLargeError,
 	type LoadedImageInput,
-	MAX_IMAGE_INPUT_BYTES,
 	materializeImageInput,
 	type TransformedImageInput,
 	transformImageInputBytes,
@@ -15,12 +22,6 @@ import {
 import { DEFAULT_IMAGE_RESIZE_MAX_BYTES } from "./image-resize";
 import { MAX_PASTED_IMAGE_COUNT } from "./pasted-image-path";
 
-export const MAX_PASTED_IMAGE_SOURCE_BYTES = 64 * 1024 * 1024;
-export const MAX_PASTED_IMAGE_OUTPUT_BYTES = 64 * 1024 * 1024;
-export const MAX_PASTED_IMAGE_DIMENSION = 20_000;
-export const MAX_PASTED_IMAGE_PIXELS = 40_000_000;
-export const MAX_PASTED_IMAGE_DECODED_BYTES = 160 * 1024 * 1024;
-
 export type PastedImageBatchErrorCode =
 	| "too-many"
 	| "unsafe-path"
@@ -319,7 +320,7 @@ function hasWebpAnimation(bytes: Buffer): boolean {
 	return false;
 }
 
-function isAnimatedImage(bytes: Buffer, mimeType: string): boolean | undefined {
+export function isAnimatedImage(bytes: Buffer, mimeType: string): boolean | undefined {
 	if (mimeType === "image/gif") {
 		const frames = gifFrameCount(bytes);
 		return frames === undefined ? undefined : frames > 1;

package/src/utils/prompt-suggestion.ts

@@ -1,6 +1,6 @@
 /**
- * Predict the user's likely next prompt after an agent turn using a smol,
- * fast model. Native GJC port of the ghost-text prompt-suggestion behavior
+ * Predict the user's likely next prompt after an agent turn with the `default`
+ * model role. Native GJC port of the ghost-text prompt-suggestion behavior
  * from Claude Code: the prediction renders as dim ghost text in the empty
  * composer and Tab accepts it.
  */
@@ -169,8 +169,9 @@ function getSuggestionModel(
 	registry: ModelRegistry,
 	settings: Settings,
 	currentModel?: Model<Api>,
+	credentialSessionId?: string,
 ): Model<Api> | undefined {
-	const availableModels = registry.getAvailable();
+	const availableModels = registry.getAvailable(credentialSessionId);
 	if (availableModels.length === 0) return undefined;
 	const model = resolveRoleSelection(["default"], settings, availableModels, registry)?.model;
 	if (model) return model;
@@ -203,7 +204,7 @@ export async function generatePromptSuggestion(
 	const context = buildPromptSuggestionContext(messages);
 	if (!context) return null;
 
-	const model = getSuggestionModel(registry, settings, currentModel);
+	const model = getSuggestionModel(registry, settings, currentModel, sessionId);
 	if (!model) {
 		logger.debug("prompt-suggestion: no model available");
 		return null;

package/src/utils/shell-snapshot.ts

@@ -31,6 +31,11 @@ function getShellConfigFile(shell: string, home: string): string {
 	return path.join(home, ".profile");
 }
 
+/** One POSIX shell word. Double quotes would still run `$()` and backticks. */
+export function quotePosixShell(value: string): string {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
 /**
  * Generate the snapshot creation script.
  * This script sources the user's rc file and extracts functions, aliases, and options.
@@ -43,6 +48,9 @@ function generateSnapshotScript(shell: string, snapshotPath: string, rcFile: str
 
 	// Escape the snapshot path for shell
 	const escapedPath = snapshotPath.replace(/'/g, "'\\''");
+	const rcSource = hasRcFile
+		? `source ${quotePosixShell(rcFile)} < /dev/null 2>/dev/null`
+		: "# No user config file to source";
 
 	// Function extraction differs between bash and zsh
 	const functionScript = isZsh
@@ -83,7 +91,7 @@ umask 077
 SNAPSHOT_FILE='${escapedPath}'
 
 # Source user's rc file if it exists
-${hasRcFile ? `source "${rcFile}" < /dev/null 2>/dev/null` : "# No user config file to source"}
+${rcSource}
 
 # Create/clear the snapshot file
 echo "# Shell snapshot - generated by gjc agent" >| "$SNAPSHOT_FILE"