@gajae-code/coding-agent 0.18.12 → 0.19.0

package/src/cli/update-cli.ts

@@ -10,7 +10,7 @@ import { randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { exactReplaceRetained, exactUnlink } from "@gajae-code/natives";
+import { exactReplaceRetained, exactUnlink, exactUnlinkDirect } from "@gajae-code/natives";
 import { $which, APP_NAME, isCompiledBinary, isEnoent, logger, redactCrashSecrets, VERSION } from "@gajae-code/utils";
 import { $ } from "bun";
 import chalk from "chalk";
@@ -287,6 +287,40 @@ function resolveNpmManagedTarget(
 	return undefined;
 }
 
+/**
+ * Detect a project-local package install: `<...>/node_modules/.bin/<name>` with
+ * or without an executable extension.
+ *
+ * On Windows a dependency-installed CLI is a real `.exe` copied into
+ * `node_modules/.bin`, so the `.cmd`/`.ps1` shim rules never match it and
+ * `gjc update` used to treat it as a standalone binary and try to replace it
+ * (#6842). That file belongs to the package manager and to the project's
+ * dependency tree: replacing it breaks the lockfile contract and, on Windows,
+ * fails on the file's ACL. The caller must redirect to the package manager
+ * instead of downloading a replacement.
+ */
+function resolveProjectLocalPackageInstall(
+	ompPath: string,
+	platform: PathPlatform = process.platform,
+): { packageRoot: string } | undefined {
+	const pathApi = pathApiForPlatform(platform);
+	const resolved = pathApi.normalize(ompPath);
+	const binDir = pathApi.dirname(resolved);
+	if (pathApi.basename(binDir).toLowerCase() !== ".bin") return undefined;
+	if (pathApi.basename(pathApi.dirname(binDir)).toLowerCase() !== "node_modules") return undefined;
+	const extension = pathApi.extname(resolved).toLowerCase();
+	const basename = extension ? pathApi.basename(resolved, extension) : pathApi.basename(resolved);
+	if (basename.toLowerCase() !== APP_NAME.toLowerCase()) return undefined;
+	return { packageRoot: pathApi.dirname(binDir) };
+}
+
+export function resolveProjectLocalPackageInstallForTest(
+	ompPath: string,
+	platform: PathPlatform,
+): { packageRoot: string } | undefined {
+	return resolveProjectLocalPackageInstall(ompPath, platform);
+}
+
 function resolveUpdateMethod(ompPath: string, bunBinDir: string | undefined): "bun" | "npm" | "binary" {
 	if (resolveNpmManagedTarget(ompPath)) return "npm";
 	if (!bunBinDir) return "binary";
@@ -401,6 +435,15 @@ async function resolveUpdateTarget(): Promise<UpdateTarget> {
 		);
 	}
 
+	const projectLocalInstall = ompPath ? resolveProjectLocalPackageInstall(ompPath) : undefined;
+	if (ompPath && projectLocalInstall) {
+		throw new Error(
+			formatUnsupportedTargetMessage(
+				`${APP_NAME} at ${ompPath} is installed by a package manager in this project's node_modules; update the dependency instead of replacing that file`,
+			),
+		);
+	}
+
 	if (ompPath && isShimPath(ompPath, bunBinDir)) {
 		if (isProtectedSourcePath(userPath)) {
 			throw new Error(formatUnsupportedTargetMessage(`Refusing to install over a source checkout at ${userPath}`));
@@ -1351,14 +1394,179 @@ function binaryStagingPath(targetPath: string, stamp: string): string {
 	return `${targetPath.slice(0, -extension.length)}.new.${stamp}${extension}`;
 }
 
+const UPDATE_FILE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u;
+const EXACT_REPLACE_DESTINATION_NAME = /^\.gjc-exact-replace-destination-([0-9a-f]+)-([0-9a-f]+)$/u;
+// Do not race a separate process that is still completing a native replacement in this directory.
+const EXACT_REPLACE_CLEANUP_GRACE_MS = 10 * 60 * 1000;
+
+function isUpdateStagingName(targetPath: string, name: string): boolean {
+	const extension = path.extname(targetPath);
+	const prefix = `${path.basename(targetPath, extension)}.new.`;
+	if (!name.startsWith(prefix)) return false;
+	const suffix = name.slice(prefix.length);
+	if (extension && !suffix.endsWith(extension)) return false;
+	const id = extension ? suffix.slice(0, -extension.length) : suffix;
+	return UPDATE_FILE_ID.test(id);
+}
+
+function isUpdateBackupName(targetPath: string, name: string): boolean {
+	const prefix = `${path.basename(targetPath)}.bak.`;
+	if (name.startsWith(prefix) && UPDATE_FILE_ID.test(name.slice(prefix.length))) return true;
+	const legacyPrefix = `${path.basename(targetPath)}-`;
+	if (!name.startsWith(legacyPrefix)) return false;
+	const legacyName = name.slice(legacyPrefix.length);
+	const marker = legacyName.indexOf(".bak.");
+	if (marker < 0) return false;
+	const version = legacyName.slice(0, marker);
+	const timestamp = legacyName.slice(marker + ".bak.".length);
+	return (
+		/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u.test(version) && /^[0-9A-Za-z._-]+$/u.test(timestamp)
+	);
+}
+
+export function isUpdateStagingNameForTest(targetPath: string, name: string): boolean {
+	return isUpdateStagingName(targetPath, name);
+}
+
+export function isUpdateBackupNameForTest(targetPath: string, name: string): boolean {
+	return isUpdateBackupName(targetPath, name);
+}
+
+async function removeExactUpdateArtifact(filePath: string, parent: DirectoryIdentity): Promise<string | undefined> {
+	try {
+		const snapshot = await snapshotRegularFile(filePath);
+		if (!snapshot) return undefined;
+		if (snapshot.identity.parentDev !== parent.dev || snapshot.identity.parentIno !== parent.ino)
+			return `parent_identity_changed:${filePath}`;
+		const removed = exactUnlinkDirect(
+			filePath,
+			toNativeIdentity(snapshot.identity, `.gjc-update-cleanup-${randomUUID()}`),
+		);
+		if (removed.ok || removed.code === "not_found") return undefined;
+		const retained = [
+			removed.detachedPath ? `detached=${removed.detachedPath}` : undefined,
+			removed.retainedPlaceholderPath ? `placeholder=${removed.retainedPlaceholderPath}` : undefined,
+			removed.retainedUnknownPath ? `unknown=${removed.retainedUnknownPath}` : undefined,
+			removed.retainedSuccessorPath ? `successor=${removed.retainedSuccessorPath}` : undefined,
+		].filter((entry): entry is string => entry !== undefined);
+		return `exact_unlink_${removed.code ?? "failed"}:${filePath}${retained.length ? `|${retained.join("|")}` : ""}`;
+	} catch (error) {
+		return `snapshot_failed:${filePath}:${error instanceof Error ? error.message : String(error)}`;
+	}
+}
+
+/**
+ * Reclaim only generated update artifacts while holding the install lock.
+ * Keep a stage only while an active activation record owns it, and retain at
+ * most the rollback backup the record can still need.
+ */
+async function cleanupBinaryUpdateArtifacts(
+	targetPath: string,
+	originalParent: DirectoryIdentity,
+	retainedRetryCandidatePath?: string,
+): Promise<string | undefined> {
+	const parentPath = path.dirname(path.resolve(targetPath));
+	const warnings: string[] = [];
+	try {
+		const currentParent = await snapshotDirectory(parentPath);
+		if (!sameDirectoryIdentity(originalParent, currentParent)) return "installation_parent_changed";
+		const entries = await fs.promises.readdir(parentPath, { withFileTypes: true });
+		const activation = await readActivationRecord(targetPath);
+		if (activation.status === "malformed" || activation.status === "foreign") {
+			warnings.push(`activation_record_untrusted:${activation.reason}`);
+		} else {
+			const record = activation.status === "valid" ? activation.record : undefined;
+			const terminal = record?.phase === "verified" || record?.phase === "rolled_back";
+			const pinnedStages = new Set<string>();
+			if (record && !terminal) pinnedStages.add(path.resolve(record.stagingPath));
+			if (retainedRetryCandidatePath) pinnedStages.add(path.resolve(retainedRetryCandidatePath));
+			for (const entry of entries) {
+				if (!isUpdateStagingName(targetPath, entry.name)) continue;
+				const stagingPath = path.join(parentPath, entry.name);
+				if (pinnedStages.has(stagingPath)) continue;
+				const warning = await removeExactUpdateArtifact(stagingPath, originalParent);
+				if (warning) warnings.push(warning);
+			}
+
+			const recognizedBackup = record && isUpdateBackupName(targetPath, record.backupName);
+			let preserveBackup: string | undefined;
+			let mayPruneBackups = activation.status === "missing";
+			if (record && recognizedBackup) {
+				if (record.phase === "rolled_back" || !record.baseline.exists) {
+					mayPruneBackups = true;
+				} else if (record.phase === "verified" || record.phase === "published" || record.phase === "uncertain") {
+					if (record.backupIdentity) {
+						const baseline = await snapshotRegularFile(path.join(parentPath, record.backupName));
+						if (baseline && sameFileIdentity(record.backupIdentity, baseline.identity)) {
+							preserveBackup = record.backupName;
+							mayPruneBackups = true;
+						}
+					}
+				} else if (record.phase === "staged" || record.phase === "pending_activation") {
+					const current = await snapshotRegularFile(targetPath);
+					const baselineUnchanged = record.baseline.exists
+						? !!current && !!record.targetIdentity && sameFileIdentity(record.targetIdentity, current.identity)
+						: current === undefined;
+					if (baselineUnchanged) {
+						const transactionBackup = await snapshotRegularFile(path.join(parentPath, record.backupName));
+						if (!transactionBackup) mayPruneBackups = true;
+						else if (
+							record.backupIdentity &&
+							sameFileIdentity(record.backupIdentity, transactionBackup.identity)
+						) {
+							preserveBackup = record.backupName;
+							mayPruneBackups = true;
+						}
+					}
+				}
+			}
+			if (mayPruneBackups) {
+				for (const entry of entries) {
+					if (!isUpdateBackupName(targetPath, entry.name) || entry.name === preserveBackup) continue;
+					const warning = await removeExactUpdateArtifact(path.join(parentPath, entry.name), originalParent);
+					if (warning) warnings.push(warning);
+				}
+			}
+		}
+
+		if (process.platform !== "win32") {
+			const staleBefore = BigInt(Date.now() - EXACT_REPLACE_CLEANUP_GRACE_MS) * 1_000_000n;
+			for (const entry of entries) {
+				const match = EXACT_REPLACE_DESTINATION_NAME.exec(entry.name);
+				if (!match) continue;
+				const placeholderPath = path.join(parentPath, entry.name);
+				const placeholder = await snapshotRegularFile(placeholderPath);
+				if (!placeholder) continue;
+				const { identity } = placeholder;
+				if (
+					identity.parentDev !== originalParent.dev ||
+					identity.parentIno !== originalParent.ino ||
+					identity.size !== "0" ||
+					identity.nlink !== "1" ||
+					BigInt(identity.ino).toString(16) !== match[1]
+				)
+					continue;
+				// The current flow has returned from its synchronous native calls; older
+				// process IDs get the grace window above before their residue is reaped.
+				if (match[2] !== process.pid.toString(16) && BigInt(identity.mtimeNs) >= staleBefore) continue;
+				const warning = await removeExactUpdateArtifact(placeholderPath, originalParent);
+				if (warning) warnings.push(warning);
+			}
+		}
+	} catch (error) {
+		warnings.push(error instanceof Error ? error.message : String(error));
+	}
+	return warnings.length > 0 ? warnings.join("\n") : undefined;
+}
+
 /**
  * Orchestrate download → fsync → replace → verify with a strict ordering
  * contract: the downloaded temp binary MUST be flushed to stable storage
  * before it is published (renamed into place) or exec'd for verification.
  *
  * If fsync fails the temp bytes are not durable, so we abort before
- * replacement/verification and retain the staging artifact rather than risk
- * deleting a substituted pathname or installing a possibly-truncated binary.
+ * replacement/verification. Final cleanup removes the exact staging identity
+ * only when no activation record still owns it.
  */
 export async function runBinaryUpdateFlow(
 	targetPath: string,
@@ -1370,15 +1578,19 @@ export async function runBinaryUpdateFlow(
 	const tempPath = binaryStagingPath(targetPath, stamp);
 	const backupPath = `${targetPath}.bak.${stamp}`;
 	const releaseLock = await acquireBinaryUpdateLock(targetPath);
+	let originalParent: DirectoryIdentity | undefined;
+	let verification: InstalledVersionVerification | undefined;
+	let failed = false;
+	let failure: unknown;
 	try {
 		const originalTarget = await snapshotRegularFile(targetPath);
-		const originalParent = await snapshotDirectory(path.dirname(targetPath));
+		originalParent = await snapshotDirectory(path.dirname(targetPath));
 		if (!originalParent) throw new Error("installation_parent_unavailable");
 		await flow.download(url, tempPath);
 		await flow.fsync(tempPath);
 
 		flow.beforeReplace?.();
-		return await flow.replace({
+		verification = await flow.replace({
 			targetPath,
 			tempPath,
 			backupPath,
@@ -1387,9 +1599,38 @@ export async function runBinaryUpdateFlow(
 			originalParent,
 			verifyInstalledVersion: flow.verifyInstalledVersion,
 		});
-	} finally {
+	} catch (error) {
+		failed = true;
+		failure = error;
+	}
+	const retainedRetryCandidatePath =
+		failure instanceof ActivationRetryCandidateRepointError ? failure.candidatePath : undefined;
+	const cleanupWarning = originalParent
+		? await cleanupBinaryUpdateArtifacts(targetPath, originalParent, retainedRetryCandidatePath)
+		: undefined;
+	try {
 		await releaseLock();
+	} catch (error) {
+		if (!failed) {
+			failed = true;
+			failure = error;
+		} else {
+			logger.warn("Update install lock cleanup failed", {
+				warning: error instanceof Error ? error.message : String(error),
+			});
+		}
 	}
+	if (failed) {
+		if (cleanupWarning)
+			logger.warn("Update artifact cleanup failed after unsuccessful update", { warning: cleanupWarning });
+		throw failure;
+	}
+	if (!verification) throw new Error("binary_update_verification_missing");
+	if (!cleanupWarning) return verification;
+	return {
+		...verification,
+		cleanupWarning: [verification.cleanupWarning, cleanupWarning].filter(Boolean).join("\n"),
+	};
 }
 
 export async function acquireBinaryUpdateLock(targetPath: string): Promise<() => Promise<void>> {

package/src/commands/harness.ts

@@ -47,7 +47,11 @@ import {
 } from "../harness-control-plane/lifecycle-reconciliation";
 import { type ResolvedOwner, RuntimeOwner, resolveOwner, resolveOwnerLive } from "../harness-control-plane/owner";
 import { preserveDirtyWorktree } from "../harness-control-plane/preserve";
-import { RECEIPT_SPOOL_DIR_ENV } from "../harness-control-plane/receipt-spool";
+import {
+	RECEIPT_SPOOL_DIR_ENV,
+	resolveReceiptSpoolDir,
+	trustedReceiptSpoolDir,
+} from "../harness-control-plane/receipt-spool";
 import { buildReceipt, requiresVanishBeforeAction, type VanishEvidence } from "../harness-control-plane/receipts";
 import { createSdkSessionTransport, spawnNormalHarnessSession } from "../harness-control-plane/sdk-transport";
 import { classifyLeaseStatus, readLease } from "../harness-control-plane/session-lease";
@@ -1004,8 +1008,9 @@ export default class Harness extends Command {
 			`${GJC_TMUX_OWNER_STATE_DIR_ENV}=${shellQuote(ownerStateDir)}`,
 			`${GJC_TMUX_OWNER_SERVER_KEY_ENV}=${shellQuote(socketKey)}`,
 		];
-		if (process.env[RECEIPT_SPOOL_DIR_ENV])
-			envAssignments.push(`${RECEIPT_SPOOL_DIR_ENV}=${shellQuote(process.env[RECEIPT_SPOOL_DIR_ENV])}`);
+		const trustedSpoolDir = resolveReceiptSpoolDir();
+		if (trustedSpoolDir) envAssignments.push(`${RECEIPT_SPOOL_DIR_ENV}=${shellQuote(trustedSpoolDir)}`);
+		else envAssignments.unshift(`-u ${RECEIPT_SPOOL_DIR_ENV}`);
 		if (process.env.GJC_HARNESS_TEST_NODE_MODULES)
 			envAssignments.push(`GJC_HARNESS_TEST_NODE_MODULES=${shellQuote(process.env.GJC_HARNESS_TEST_NODE_MODULES)}`);
 		if (process.env.GJC_SDK_DISABLE)
@@ -1203,19 +1208,20 @@ export default class Harness extends Command {
 		}
 		const fallbackReason = tmux.reason;
 		const cmd = this.#buildOwnerCommand(sessionId);
+		const trustedSpoolDir = resolveReceiptSpoolDir();
+		const childEnv: NodeJS.ProcessEnv = {
+			...process.env,
+			GJC_HARNESS_STATE_ROOT: root,
+			...(process.env.GJC_HARNESS_TEST_NODE_MODULES
+				? { GJC_HARNESS_TEST_NODE_MODULES: process.env.GJC_HARNESS_TEST_NODE_MODULES }
+				: {}),
+			...(process.env.GJC_SDK_DISABLE ? { GJC_SDK_DISABLE: process.env.GJC_SDK_DISABLE } : {}),
+		};
+		if (trustedSpoolDir) childEnv[RECEIPT_SPOOL_DIR_ENV] = trustedSpoolDir;
+		else delete childEnv[RECEIPT_SPOOL_DIR_ENV];
 		const child = Bun.spawn(cmd, {
 			cwd,
-			env: {
-				...process.env,
-				GJC_HARNESS_STATE_ROOT: root,
-				...(process.env[RECEIPT_SPOOL_DIR_ENV]
-					? { [RECEIPT_SPOOL_DIR_ENV]: process.env[RECEIPT_SPOOL_DIR_ENV] }
-					: {}),
-				...(process.env.GJC_HARNESS_TEST_NODE_MODULES
-					? { GJC_HARNESS_TEST_NODE_MODULES: process.env.GJC_HARNESS_TEST_NODE_MODULES }
-					: {}),
-				...(process.env.GJC_SDK_DISABLE ? { GJC_SDK_DISABLE: process.env.GJC_SDK_DISABLE } : {}),
-			},
+			env: childEnv,
 			stdout: "ignore",
 			stderr: "ignore",
 			stdin: "ignore",
@@ -1374,7 +1380,11 @@ export default class Harness extends Command {
 		if (!owner.live || !owner.socketPath) return false;
 		const priorSpoolDir = input[RECEIPT_SPOOL_DIR_ENV];
 		try {
-			if (process.env[RECEIPT_SPOOL_DIR_ENV]) input[RECEIPT_SPOOL_DIR_ENV] = process.env[RECEIPT_SPOOL_DIR_ENV];
+			const fromEnv = resolveReceiptSpoolDir();
+			const fromInput = trustedReceiptSpoolDir(typeof priorSpoolDir === "string" ? priorSpoolDir : undefined);
+			const trustedSpoolDir = fromEnv ?? fromInput;
+			if (trustedSpoolDir) input[RECEIPT_SPOOL_DIR_ENV] = trustedSpoolDir;
+			else delete input[RECEIPT_SPOOL_DIR_ENV];
 			const res = (await callEndpoint(owner.socketPath, { verb, input })) as { ok?: boolean };
 			writeJson(res);
 			if (res?.ok === false) process.exitCode = 1;

package/src/commands/migrate.ts

@@ -1,11 +1,11 @@
 /**
- * Import MCP servers, skills, and instructions from other coding agents into GJC.
+ * Import MCP servers, skills, slash commands, and instructions from other coding agents into GJC.
  */
 import { Command, Flags } from "@gajae-code/utils/cli";
 import { type MigrateCommandArgs, runMigrateCommand } from "../cli/migrate-cli";
 
 export default class Migrate extends Command {
-	static description = "Import MCP servers and skills, plus Claude Code/Codex instructions";
+	static description = "Import MCP servers, skills, slash commands, and instructions from other coding agents";
 
 	static examples = [
 		"gjc migrate --from claude-code",
@@ -25,7 +25,7 @@ export default class Migrate extends Command {
 			default: false,
 		}),
 		force: Flags.boolean({
-			description: "Overwrite existing skills, MCP servers, or instruction files instead of skipping them",
+			description: "Overwrite existing skills, commands, MCP servers, or instruction files instead of skipping them",
 			default: false,
 		}),
 		"dry-run": Flags.boolean({ description: "Preview the migration without writing anything", default: false }),

package/src/commands/sdk.ts

@@ -12,11 +12,12 @@ import {
 } from "@gajae-code/natives";
 import { getAgentDir, logger, postmortem } from "@gajae-code/utils";
 import { CliParseError, Command } from "@gajae-code/utils/cli";
-import { projectEnvSnapshot } from "@gajae-code/utils/env-file";
+import { startupProjectEnvSnapshot } from "@gajae-code/utils/env";
+import { type ProjectEnvSnapshot, projectEnvSnapshot } from "@gajae-code/utils/env-file";
 import type { Args as ParsedArgs } from "../cli/args";
 import { isSafeSdkInternalAgentDir, scanPublicCommand } from "../cli/public-command-entry";
 import { PublicCommandFailure } from "../cli/public-command-errors";
-import { FileLockAcquireError } from "../config/file-lock";
+import { FileLockAcquireError, isFileLockAcquireTimeout } from "../config/file-lock";
 import { parseModelString } from "../config/model-resolver";
 import { Settings } from "../config/settings";
 import { trustedCoordinatorEnv } from "../gjc-runtime/sidecar-bootstrap-env";
@@ -561,6 +562,65 @@ export function startMemoryBackendAfterReadiness(start: () => Promise<void>): vo
 	});
 }
 
+const SDK_CWD_EQUALITY_TEST_SEAMS = [
+	"GJC_SDK_TEST_HANG_MODEL_PROFILE",
+	"GJC_SDK_TEST_FAIL_AFTER_REGISTRATION",
+	"GJC_SDK_TEST_EXIT_AFTER_READY",
+	"GJC_SDK_TEST_REJECT_AFTER_READY",
+] as const;
+
+type SdkCwdEqualityTestSeam = (typeof SDK_CWD_EQUALITY_TEST_SEAMS)[number];
+
+function isSdkCwdEqualityTestSeam(name: string): name is SdkCwdEqualityTestSeam {
+	return (SDK_CWD_EQUALITY_TEST_SEAMS as readonly string[]).includes(name);
+}
+
+function sdkCwdEqualitySnapshots(cwd: string): ProjectEnvSnapshot[] {
+	// The startup snapshot keeps a declaration Bun loaded before a later chdir.
+	return [projectEnvSnapshot(cwd), startupProjectEnvSnapshot()];
+}
+
+/**
+ * Cwd-equality test seams accept only an operator value. A project dotenv line,
+ * including one Bun expands from `$PWD`, never arms the seam.
+ */
+export function sdkCwdEqualityTestSeamActive(
+	name: string,
+	cwd: string,
+	env: NodeJS.ProcessEnv = process.env,
+	snapshots: readonly ProjectEnvSnapshot[] = sdkCwdEqualitySnapshots(cwd),
+): boolean {
+	if (!isSdkCwdEqualityTestSeam(name) || env[name] !== cwd) return false;
+	// Provenance only. trustedCoordinatorEnv trims, so a second compare to cwd
+	// would drop a trusted path that still matches exactly, including trailing space.
+	return snapshots.every(snapshot => trustedCoordinatorEnv(name, env, snapshot) !== undefined);
+}
+
+/** Copy `env` without project-dotenv values for the four cwd-equality seams. */
+export function omitUntrustedSdkCwdEqualitySeams(
+	env: NodeJS.ProcessEnv,
+	snapshots: readonly ProjectEnvSnapshot[],
+): NodeJS.ProcessEnv {
+	const denied: string[] = [];
+	for (const name of SDK_CWD_EQUALITY_TEST_SEAMS) {
+		const raw = env[name];
+		if (typeof raw !== "string" || raw.length === 0) continue;
+		if (snapshots.some(snapshot => trustedCoordinatorEnv(name, env, snapshot) === undefined)) denied.push(name);
+	}
+	if (denied.length === 0) return env;
+	const next: NodeJS.ProcessEnv = { ...env };
+	for (const name of denied) delete next[name];
+	return next;
+}
+
+function dropUntrustedSdkCwdEqualitySeams(env: NodeJS.ProcessEnv, snapshots: readonly ProjectEnvSnapshot[]): void {
+	const next = omitUntrustedSdkCwdEqualitySeams(env, snapshots);
+	if (next === env) return;
+	for (const name of SDK_CWD_EQUALITY_TEST_SEAMS) {
+		if (next[name] === undefined) delete env[name];
+	}
+}
+
 /** Runs the same persisted AgentSession bootstrap used by the production CLI. */
 export async function runSessionHost(
 	timing: {
@@ -592,6 +652,11 @@ export async function runSessionHost(
 	const agentDir = process.env.GJC_AGENT_DIR;
 	if (!agentDir) throw new Error("GJC_AGENT_DIR is required for sdk session-host-internal.");
 	const cwd = timing.cwd ?? process.cwd();
+	const cwdSeamSnapshots = sdkCwdEqualitySnapshots(cwd);
+	// Drop rejected copies before startup work can spawn a child that inherits them.
+	dropUntrustedSdkCwdEqualitySeams(process.env, cwdSeamSnapshots);
+	const cwdEqualitySeam = (name: SdkCwdEqualityTestSeam): boolean =>
+		sdkCwdEqualityTestSeamActive(name, cwd, process.env, cwdSeamSnapshots);
 	if ((await fs.realpath(request.cwd)) !== (await fs.realpath(cwd)))
 		throw new Error(`Lifecycle worktree mismatch: expected ${request.cwd}, got ${cwd}.`);
 	if (
@@ -1423,7 +1488,7 @@ export async function runSessionHost(
 	try {
 		const startupThinkingLevel = request.modelId ? parseModelString(request.modelId)?.thinkingLevel : undefined;
 		await beforeCutoff(() =>
-			process.env.GJC_SDK_TEST_HANG_MODEL_PROFILE === cwd
+			cwdEqualitySeam("GJC_SDK_TEST_HANG_MODEL_PROFILE")
 				? new Promise<void>(() => {})
 				: applyModelProfiles({
 						session,
@@ -1450,7 +1515,7 @@ export async function runSessionHost(
 		const startup = await beforeCutoff<SdkStartupResult>(() => capability.promise);
 		if (startup.status !== "started") throw startup.failure;
 		throwIfStartupInterrupted();
-		if (process.env.GJC_SDK_TEST_FAIL_AFTER_REGISTRATION === cwd)
+		if (cwdEqualitySeam("GJC_SDK_TEST_FAIL_AFTER_REGISTRATION"))
 			throw new Error("Lifecycle test failure after SDK host registration.");
 
 		await beforeCutoff(() => session.sessionManager.ensureOnDisk());
@@ -1519,11 +1584,11 @@ export async function runSessionHost(
 	// Readiness is published; the session is live. Memory startup issues one LLM
 	// request per queued rollout, so it must run outside the readiness window and
 	// its failure must never take the session down.
-	if (process.env.GJC_SDK_TEST_EXIT_AFTER_READY === cwd) {
+	if (cwdEqualitySeam("GJC_SDK_TEST_EXIT_AFTER_READY")) {
 		process.stderr.write("GJC_SDK_TEST_EXIT_AFTER_READY\n");
 		process.exit(7);
 	}
-	if (process.env.GJC_SDK_TEST_REJECT_AFTER_READY === cwd) {
+	if (cwdEqualitySeam("GJC_SDK_TEST_REJECT_AFTER_READY")) {
 		// Simulates the post-readiness liveness watcher rejecting. With the
 		// post-ready startup receipt removed, this unhandled rejection kills the
 		// host without writing any startup receipt; the broker must classify the
@@ -1768,6 +1833,7 @@ async function runSdkInternal(internal: SdkInternalArgv, publicBrokerRun = false
 		const command = resolveSdkInternalSpawnCommand("broker-internal");
 		const brokerEnvironment = { ...command.env };
 		delete brokerEnvironment.GJC_BROKER_TRAMPOLINE_RETAIN_UNTIL_PUBLICATION;
+		dropUntrustedSdkCwdEqualitySeams(brokerEnvironment, sdkCwdEqualitySnapshots(process.cwd()));
 		let child: ChildProcess;
 		try {
 			child = spawn(command.file, [...command.args, "--agent-dir", internal.agentDir], {
@@ -1990,9 +2056,8 @@ async function runSdkInternal(internal: SdkInternalArgv, publicBrokerRun = false
 					return await singleStartupAttempt(deadline);
 				} catch (error) {
 					if (
-						!(error instanceof FileLockAcquireError) ||
+						!isFileLockAcquireTimeout(error) ||
 						!startupFenceAcquired ||
-						error.code !== "acquire_timeout" ||
 						path.resolve(error.filePath) !==
 							path.resolve(path.join(agentDir, "sdk", "sessions", "index.jsonl")) ||
 						sessionIndexTimeoutRetries >= MAX_SESSION_INDEX_TIMEOUT_RETRIES
@@ -2172,14 +2237,19 @@ async function runSdkInternal(internal: SdkInternalArgv, publicBrokerRun = false
 								}
 							}
 						: undefined;
+				const brokerSettings = await Settings.loadForScope({ cwd: process.cwd(), agentDir });
 				const candidate = new Broker({
 					agentDir,
 					startupAbortSignal: startupAbortController.signal,
 					startupCheckpointDeadline: effectiveCheckpointDeadline,
 					onStartupReady: () => clearTimeout(startupWatchdog),
-					masterOrphanGraceMs: (await Settings.loadForScope({ cwd: process.cwd(), agentDir })).get(
-						"sdk.masterOrphanGraceMs",
-					),
+					masterOrphanGraceMs: brokerSettings.get("sdk.masterOrphanGraceMs"),
+					abandonedGraceMs: brokerSettings.get("sdk.brokerAbandonedGraceMs"),
+					// Only the detached autostart entry retires itself when nobody is left to
+					// use it. A supervised `gjc sdk broker run` service is owned by its
+					// operator's process manager, which reads an owned-root completion as a
+					// clean exit and would not restart it.
+					reapWhenAbandoned: !publicBrokerRun,
 					resolveDirectoryMigration: async cwd => {
 						const settings = await Settings.loadForScope({ cwd, agentDir });
 						try {

package/src/commit/agentic/agent.ts

@@ -1,7 +1,7 @@
 import { INTENT_FIELD, type ThinkingLevel } from "@gajae-code/agent-core";
 import type { Api, Model } from "@gajae-code/ai/core";
 import { Markdown } from "@gajae-code/tui";
-import { prompt } from "@gajae-code/utils";
+import { prompt, sanitizeText } from "@gajae-code/utils";
 import chalk from "chalk";
 import typesDescriptionPrompt from "../../commit/prompts/types-description.md" with { type: "text" };
 import type { ModelRegistry } from "../../config/model-registry";
@@ -81,7 +81,7 @@ export async function runCommitAgentSession(input: CommitAgentInput): Promise<Co
 	const toolArgsById = new Map<string, { name: string; args?: Record<string, unknown> }>();
 	const writeThinkingLine = (text: string) => {
 		if (!process.stdout.isTTY) return;
-		const line = chalk.dim(`… ${text}`);
+		const line = chalk.dim(`… ${sanitizeText(text)}`);
 		process.stdout.write(`\r\x1b[2K${line}`);
 		thinkingLineActive = true;
 	};
@@ -118,7 +118,7 @@ export async function runCommitAgentSession(input: CommitAgentInput): Promise<Co
 					clearThinkingLine();
 					const assistantMessage = event.message as { stopReason?: string; errorMessage?: string };
 					if (assistantMessage.stopReason === "error" && assistantMessage.errorMessage) {
-						process.stdout.write(`● Error: ${assistantMessage.errorMessage}\n`);
+						process.stdout.write(`● Error: ${sanitizeText(assistantMessage.errorMessage)}\n`);
 					}
 					const messageText = extractMessageText(event.message?.content ?? []);
 					if (messageText) {
@@ -131,10 +131,10 @@ export async function runCommitAgentSession(input: CommitAgentInput): Promise<Co
 				const stored = toolArgsById.get(event.toolCallId) ?? { name: event.toolName };
 				toolArgsById.delete(event.toolCallId);
 				clearThinkingLine();
-				const toolLabel = formatToolLabel(stored.name);
+				const toolLabel = sanitizeText(formatToolLabel(stored.name));
 				const symbol = event.isError ? "" : "";
 				process.stdout.write(`${symbol} ${toolLabel}\n`);
-				const argsLines = formatToolArgs(stored.args);
+				const argsLines = formatToolArgs(stored.args).map(line => sanitizeText(line));
 				if (argsLines.length > 0) {
 					process.stdout.write(`${formatToolArgsBlock(argsLines)}\n`);
 				}
@@ -201,7 +201,7 @@ function extractMessageText(content: Array<{ type: string; text?: string }>): st
 }
 
 function writeAssistantMessage(message: string): void {
-	const lines = renderMarkdownLines(message);
+	const lines = renderMarkdownLines(sanitizeText(message));
 	if (lines.length === 0) return;
 	let firstContentIndex = lines.findIndex(line => line.trim().length > 0);
 	if (firstContentIndex === -1) {

package/src/commit/analysis/conventional.ts

@@ -5,6 +5,7 @@ import { prompt } from "@gajae-code/utils";
 import analysisSystemPrompt from "../../commit/prompts/analysis-system.md" with { type: "text" };
 import analysisUserPrompt from "../../commit/prompts/analysis-user.md" with { type: "text" };
 import type { ConventionalAnalysis } from "../../commit/types";
+import { escapePromptMetadata } from "../../session/messages";
 import { toReasoningEffort } from "../../thinking";
 import { createConventionalAnalysisTool, parseConventionalAnalysisResponse } from "../shared-llm";
 
@@ -41,13 +42,21 @@ export async function generateConventionalAnalysis({
 	diff,
 }: ConventionalAnalysisInput): Promise<ConventionalAnalysis> {
 	const userContent = prompt.render(analysisUserPrompt, {
-		context_files: contextFiles && contextFiles.length > 0 ? contextFiles : undefined,
+		context_files:
+			contextFiles && contextFiles.length > 0
+				? contextFiles.map(file => ({
+						path: escapePromptMetadata(file.path),
+						content: escapePromptMetadata(file.content, { preserveNewlines: true }),
+					}))
+				: undefined,
 		user_context: userContext,
 		types_description: typesDescription,
-		recent_commits: recentCommits?.join("\n"),
-		scope_candidates: scopeCandidates,
-		stat,
-		diff,
+		recent_commits: recentCommits
+			?.map(subject => escapePromptMetadata(subject, { preserveNewlines: true }))
+			.join("\n"),
+		scope_candidates: escapePromptMetadata(scopeCandidates, { preserveNewlines: true }),
+		stat: escapePromptMetadata(stat, { preserveNewlines: true }),
+		diff: escapePromptMetadata(diff, { preserveNewlines: true }),
 	});
 
 	const response = await completeSimple(