@gajae-code/coding-agent 0.18.6 → 0.18.7

package/src/session/agent-session.ts

@@ -127,6 +127,7 @@ import {
 	streamSimple,
 } from "@gajae-code/ai/core";
 import { normalizeAnthropicBaseUrl } from "@gajae-code/ai/providers/anthropic";
+import { isExplicitCodexTerminalVeto } from "@gajae-code/ai/providers/openai-codex-responses";
 import {
 	type AuthDisposition,
 	beginAttempt,
@@ -1426,6 +1427,8 @@ const PROVIDER_FIRST_EVENT_TIMEOUT_WITHOUT_ARTICLE_ERROR = "Provider stream time
 const BARE_DEFAULT_CODEX_RETRYABLE_ERROR =
 	/^Codex error event(?:: .*)? \(code=(?:server_is_overloaded|server_error|internal_error)(?:, [^)]+)*\)$/;
 const BARE_DEFAULT_CODEX_RETRYABLE_CODES = new Set(["server_is_overloaded", "server_error", "internal_error"]);
+const BARE_DEFAULT_CODEX_OVERLOAD_ERROR =
+	/^Codex error event(?:: .*)? \(code=server_is_overloaded(?:, [^)]+)*\)$/;
 const BARE_DEFAULT_OVERLOAD_CODES = new Set([SERVER_OVERLOADED_PROVIDER_CODE]);
 /** Anthropic's typed capacity-overload `error.type`, the only Anthropic overload code admitted below. */
 const ANTHROPIC_OVERLOADED_ERROR_TYPE = "overloaded_error";
@@ -1555,9 +1558,38 @@ function isStatuslessTypedOverloadFacts(facts: TransportFailureFacts | undefined
 	);
 }
 
+// Deterministic auth/request/model diagnostics must surface even when a provider
+// labels the failure with a transient code.
+const TERMINAL_ERROR_MESSAGE =
+	/unauthorized|forbidden|authentication_error|permission_error|permission denied|invalid api key|invalid_request_error|invalid request|bad request|bad_request|validation_error|unprocessable|payload too large|payment required|insufficient_quota|insufficient credits|missing required (parameter|field)|invalid schema|invalid tool_choice|unsupported (parameter|value|model)|model_not_found|no such model|unknown model|does not (exist|support)|request was aborted|request aborted|the user aborted/i;
+
+function isTerminalCodexProviderFailure(message: AssistantMessage): boolean {
+	if (message.api !== "openai-codex-responses") return false;
+	if (isExplicitCodexTerminalVeto(message.transportFailure?.providerCode, message.errorMessage)) return true;
+	return (
+		(BARE_DEFAULT_CODEX_RETRYABLE_CODES.has(message.transportFailure?.providerCode ?? "") ||
+			BARE_DEFAULT_CODEX_RETRYABLE_ERROR.test(message.errorMessage ?? "")) &&
+		TERMINAL_ERROR_MESSAGE.test(message.errorMessage ?? "")
+	);
+}
+
 function isBareDefaultCodexOverload(message: AssistantMessage): boolean {
 	return (
 		message.api === "openai-codex-responses" &&
+		!TERMINAL_ERROR_MESSAGE.test(message.errorMessage ?? "") &&
+		!isExplicitCodexTerminalVeto(undefined, message.errorMessage) &&
+		(isExactTypedOverloadFacts(message, BARE_DEFAULT_OVERLOAD_CODES) ||
+			(BARE_DEFAULT_CODEX_OVERLOAD_ERROR.test(message.errorMessage ?? "") &&
+				!hasBareDefaultRetryDisqualifyingFacts(message))) &&
+		!assistantMessageHasVisibleOrToolContent(message)
+	);
+}
+
+function isBareDefaultCodexProviderFailure(message: AssistantMessage): boolean {
+	return (
+		message.api === "openai-codex-responses" &&
+		!TERMINAL_ERROR_MESSAGE.test(message.errorMessage ?? "") &&
+		!isExplicitCodexTerminalVeto(message.transportFailure?.providerCode, message.errorMessage) &&
 		(isExactTypedOverloadFacts(message, BARE_DEFAULT_CODEX_RETRYABLE_CODES) ||
 			(BARE_DEFAULT_CODEX_RETRYABLE_ERROR.test(message.errorMessage ?? "") &&
 				!hasBareDefaultRetryDisqualifyingFacts(message))) &&
@@ -1620,7 +1652,10 @@ function isBareDefaultAnthropicOverload(message: AssistantMessage): boolean {
 function assistantMessageHasVisibleOrToolContent(message: AssistantMessage): boolean {
 	return message.content.some(content => {
 		if (content.type === "text") return content.text.length > 0;
-		return content.type === "thinking" || content.type === "redactedThinking" || content.type === "toolCall";
+		if (content.type === "thinking") {
+			return content.thinking.length > 0 || (content.thinkingSignature?.length ?? 0) > 0;
+		}
+		return content.type === "redactedThinking" || content.type === "toolCall";
 	});
 }
 
@@ -22994,6 +23029,7 @@ export class AgentSession {
 	}
 
 	#isRetryableError(message: AssistantMessage): boolean {
+		if (isTerminalCodexProviderFailure(message)) return false;
 		if (this.#isTerminalProviderFirstEventTimeout(message)) return false;
 		if (message.errorMessage?.startsWith("Model fallback chain exhausted;")) return false;
 		if (message.errorMessage?.startsWith("Managed fallback retried the escaped non-ASCII")) return false;
@@ -23004,7 +23040,11 @@ export class AgentSession {
 			return false;
 		const contextWindow = this.model?.contextWindow ?? 0;
 		if (classifyContextOverflow(message, transportFailure, contextWindow)) return false;
-		if (isBareDefaultCodexOverload(message) && this.settings.get("retry.enabled") !== false) return true;
+		if (
+			(isBareDefaultCodexOverload(message) || isBareDefaultCodexProviderFailure(message)) &&
+			this.settings.get("retry.enabled") !== false
+		)
+			return true;
 		const managedFallback = this.#defaultFallbackChain().chain.entries.length > 1;
 		// An account-specific model rejection that cannot rotate to another
 		// credential stays terminal only on the session's own retry path; managed
@@ -23117,9 +23157,7 @@ export class AgentSession {
 		// Errors that will never succeed on retry (auth/permission, malformed
 		// request, unknown/unsupported model). These surface immediately rather
 		// than retry forever.
-		return /unauthorized|forbidden|authentication_error|permission_error|permission denied|invalid api key|invalid_request_error|invalid request|bad request|bad_request|validation_error|unprocessable|payload too large|payment required|insufficient_quota|insufficient credits|missing required (parameter|field)|invalid schema|invalid tool_choice|unsupported (parameter|value|model)|model_not_found|no such model|unknown model|does not (exist|support)|request was aborted|request aborted|the user aborted/i.test(
-			errorMessage,
-		);
+		return TERMINAL_ERROR_MESSAGE.test(errorMessage);
 	}
 
 	#extractExplicitHttpStatusFromErrorMessage(errorMessage: string): number | undefined {
@@ -24308,6 +24346,13 @@ export class AgentSession {
 		const classification = this.#classifyErrorForRetry(message);
 		const localSnapshot = classification === "local_snapshot";
 		const localBufferOverflow = classification === "local_buffer_overflow";
+		// Managed outcomes can reach retry handling without the ordinary admission
+		// check. Do not let retained transport facts bypass the same terminal veto.
+		if (isTerminalCodexProviderFailure(message)) {
+			return managedOutcome
+				? { type: "terminal", terminal: { stopReason: "error", messages: [message] } }
+				: false;
+		}
 		if (retryCancelled()) {
 			return managedOutcome ? { type: "terminal", terminal: { stopReason: "cancelled" } } : false;
 		}
@@ -24369,6 +24414,8 @@ export class AgentSession {
 			isBareDefaultCodexOverload(message) ||
 			isBareDefaultAnthropicOverload(message) ||
 			isBareDefaultOpenAIResponsesOverload(message);
+		const canReplayBareDefaultCodexFailure = isBareDefaultCodexProviderFailure(message);
+		const boundBareDefaultCodexFailure = canReplayBareDefaultCodexFailure && !legacyRetryConfigured;
 		const canReplayCodexProviderOverload = isBareDefaultCodexOverload(message);
 		const reportedRetryMaxAttempts = transportFailure?.retryMaxAttempts;
 		if (reportedRetryMaxAttempts !== undefined) {
@@ -24412,7 +24459,9 @@ export class AgentSession {
 		const fallbackTrigger = this.#fallbackTriggerFor(message, !managedFallback, transportFailure);
 		const trigger:
 			| { class: FallbackTriggerClass; retryAfterMs?: number; authDisposition?: AuthDisposition }
-			| undefined = canReplayCodexProviderOverload ? { class: "server" } : fallbackTrigger;
+			| undefined = canReplayCodexProviderOverload || canReplayBareDefaultCodexFailure
+				? { class: "server" }
+				: fallbackTrigger;
 		// OpenAI's typed statusless capacity-overload code (issue #5018) must not
 		// gain managed-chain retry/advance authority from its new facts. Before
 		// the code survived transport, this failure reached the session as an
@@ -24516,6 +24565,7 @@ export class AgentSession {
 		if (!managedFallback && !legacyRetryConfigured && !canReplayRotatedCredential && !canReplayEmptyResponse) {
 			if (
 				(!canReplayProviderOverload &&
+					!canReplayBareDefaultCodexFailure &&
 					!canReplayUnexpectedSocketClose &&
 					!this.#isTypedFirstEventTimeout(message) &&
 					!messageOnlyWatchdogTimeout &&
@@ -24534,6 +24584,7 @@ export class AgentSession {
 			!managedFallback &&
 			classification === "transient" &&
 			!canReplayProviderOverload &&
+			!boundBareDefaultCodexFailure &&
 			!canReplayUnexpectedSocketClose &&
 			!this.#isIdleStreamStallErrorMessage(message.errorMessage ?? "");
 

package/src/session/internal/managed-session-storage.ts

@@ -1474,6 +1474,7 @@ export class ManagedSessionDescendantStore {
 		retained?: { authority: RecoveryFsRoot; authorityBaseDir: string },
 		policy?: ManagedSessionSecurityPolicy,
 		profileAgentDir?: string,
+		expectedSubtreeRoot?: ManagedDirectoryRoot,
 	) {
 		managedRelativePath(root, baseDir);
 
@@ -1512,13 +1513,46 @@ export class ManagedSessionDescendantStore {
 				});
 			}
 			this.#authority = retained.authority;
+			if (
+				expectedSubtreeRoot &&
+				(expectedSubtreeRoot.canonicalPath !== this.#baseDir ||
+					expectedSubtreeRoot.dev !== this.#subtreeRoot.dev ||
+					expectedSubtreeRoot.ino !== this.#subtreeRoot.ino)
+			)
+				throw new Error("Managed subtree authority changed during establishment");
 			this.#assertBound();
 
 			return;
 		}
 		assertManagedDirectoryRoot(root);
-		ensureManagedDirectory(this.#baseDir, root, this.#policy);
+		if (expectedSubtreeRoot) {
+			if (expectedSubtreeRoot.canonicalPath !== this.#baseDir)
+				throw new Error("Managed subtree authority path mismatch");
+			assertManagedDirectoryRoot(expectedSubtreeRoot);
+			const verified = validateNativeSecurityResult(
+				process.platform === "win32"
+					? nativeSessionStorage().verifyOwnerOnlyPathSecurityExpected(
+							this.#baseDir,
+							"directory",
+							expectedSubtreeRoot.dev,
+							expectedSubtreeRoot.ino,
+						)
+					: nativeSessionStorage().verifyOwnerOnlyPathSecurity(this.#baseDir, "directory"),
+				"verify",
+				"directory",
+			);
+			if (!verified.ok) throw securityError(this.#baseDir, verified);
+			assertManagedDirectoryRoot(expectedSubtreeRoot);
+		} else {
+			ensureManagedDirectory(this.#baseDir, root, this.#policy);
+		}
 		const subtreeStat = fs.lstatSync(this.#baseDir, { bigint: true });
+		if (
+			expectedSubtreeRoot &&
+			(canonicalFileId(subtreeStat.dev) !== expectedSubtreeRoot.dev ||
+				canonicalFileId(subtreeStat.ino) !== expectedSubtreeRoot.ino)
+		)
+			throw new Error("Managed subtree authority changed during establishment");
 		this.#subtreeRoot = Object.freeze({
 			canonicalPath: this.#baseDir,
 			dev: canonicalFileId(subtreeStat.dev),
@@ -1634,6 +1668,50 @@ export class ManagedSessionDescendantStore {
 		}
 		this.#assertBound();
 	}
+
+	/** Capture a directory identity through this store's retained managed root without repairing it. */
+	captureDirectoryIdentity(relativePath: string): { dev: string; ino: string } {
+		this.#assertBound();
+		const resolved = this.#resolve(relativePath);
+		if (!this.#authority) this.#assertPathBackedDirectoryChain(resolved);
+		const named = fs.lstatSync(resolved, { bigint: true });
+		if (!named.isDirectory() || named.isSymbolicLink()) throw new Error("managed_directory_identity_unavailable");
+		const dev = canonicalFileId(named.dev);
+		const ino = canonicalFileId(named.ino);
+		if (dev !== this.#subtreeRoot.dev) throw new Error("managed_directory_identity_unavailable");
+		if (this.#authority) {
+			const retainedRelative = this.#relative(resolved);
+			if (retainedRelative === "") {
+				if (dev !== this.#subtreeRoot.dev || ino !== this.#subtreeRoot.ino)
+					throw new Error("Managed descendant root binding changed");
+			} else {
+				const retained = this.#authority.retainManagedDirectory(retainedRelative, dev.toString(), ino.toString());
+				try {
+					const identity = retained.identity();
+					if (
+						!identity.ok ||
+						!identity.identity ||
+						identity.identity.dev !== dev.toString() ||
+						identity.identity.ino !== ino.toString()
+					)
+						throw new Error(identity.code ?? "managed_directory_identity_unavailable");
+				} finally {
+					retained.close();
+				}
+			}
+		}
+		const after = fs.lstatSync(resolved, { bigint: true });
+		if (
+			!after.isDirectory() ||
+			after.isSymbolicLink() ||
+			canonicalFileId(after.dev) !== dev ||
+			canonicalFileId(after.ino) !== ino
+		)
+			throw new Error("managed_directory_identity_changed");
+		this.#assertBound();
+		return { dev: dev.toString(), ino: ino.toString() };
+	}
+
 	#assertBound(): void {
 		if (!this.#authority) {
 			const named = fs.statSync(this.#baseDir, { bigint: true });
@@ -3019,6 +3097,34 @@ export class ManagedSessionDescendantStore {
 		if (!removed.ok) throw new Error(removed.code ?? "managed_remove_failed");
 		this.#assertBound();
 	}
+
+	/** Remove one exact managed tree through the parent-identity-bound native protocol. */
+	removeTreeExpectedWithParentIdentity(
+		relativePath: string,
+		expected: NativeDirectoryTreeSnapshot,
+		parentIdentity: { dev: bigint; ino: bigint },
+	): NativeExactUnlinkResult {
+		this.#beforeMutation();
+		this.#assertBound();
+		const resolved = this.#resolve(relativePath);
+		const parentPath = path.dirname(resolved);
+		const parentRelative = path.relative(this.#baseDir, parentPath);
+		if (path.isAbsolute(parentRelative) || parentRelative === ".." || parentRelative.startsWith(`..${path.sep}`))
+			throw new Error("managed_remove_parent_outside_store");
+		const currentParent = this.captureDirectoryIdentity(parentRelative);
+		if (
+			currentParent.dev !== canonicalFileId(parentIdentity.dev).toString() ||
+			currentParent.ino !== canonicalFileId(parentIdentity.ino).toString()
+		)
+			throw new Error("managed_remove_parent_identity_mismatch");
+		const removed = nativeSessionStorage().exactRemoveDirectoryTree(resolved, expected, {
+			dev: BigInt(currentParent.dev),
+			ino: BigInt(currentParent.ino),
+		});
+		this.#assertBound();
+		return removed;
+	}
+
 	fsyncTree(): NativeDirectoryTreeSnapshot {
 		this.#beforeMutation();
 		this.#assertBound();

package/src/session/internal/task-artifact-owner-access.ts

@@ -0,0 +1,229 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import type { NativeDirectoryTreeSnapshot } from "@gajae-code/natives";
+import {
+	assertSafeRelativePath,
+	assertSessionRoot,
+	freezeTreeSnapshot,
+	immutableDeletionEvidence,
+	isOwnerRetainedRoot,
+	manifestRelativePath,
+	OWNER_DIRECTORY,
+	OWNER_MANIFEST,
+	OWNER_SCHEMA_VERSION,
+	ownerIdForSession,
+	ownerRelativePath,
+	parseTaskArtifactOwnerLocator,
+	sameOwnerParentIdentity,
+	type TaskArtifactOwnerDeletionEvidence,
+	type TaskArtifactOwnerLocator,
+	type TaskArtifactOwnerParentIdentity,
+	type TaskArtifactOwnerStorageContext,
+} from "../task-artifact-owner-codec";
+import { ManagedSessionDescendantStore } from "./managed-session-storage";
+
+export interface OwnerManifest extends TaskArtifactOwnerLocator {
+	readonly sessionId: string;
+}
+
+export function newSessionRootStore(context: TaskArtifactOwnerStorageContext): ManagedSessionDescendantStore {
+	assertSessionRoot(context);
+	if (path.resolve(context.profileAgentDir) !== context.profileAgentDir)
+		throw new Error("task_artifact_owner_profile_invalid");
+	const profile = fs.lstatSync(context.profileAgentDir, { bigint: true });
+	if (!profile.isDirectory() || profile.isSymbolicLink()) throw new Error("task_artifact_owner_profile_invalid");
+	const stat = fs.lstatSync(context.sessionsRoot, { bigint: true });
+	if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("task_artifact_owner_root_invalid");
+	return new ManagedSessionDescendantStore(
+		context.rootAuthority,
+		context.sessionsRoot,
+		undefined,
+		context.securityPolicy,
+		context.profileAgentDir,
+		{
+			canonicalPath: context.sessionsRoot,
+			dev: BigInt.asUintN(64, stat.dev),
+			ino: BigInt.asUintN(64, stat.ino),
+		},
+	);
+}
+
+function parseOwnerManifest(bytes: Uint8Array): OwnerManifest {
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(Buffer.from(bytes).toString("utf8"));
+	} catch {
+		throw new Error("task_artifact_owner_manifest_invalid");
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || Object.keys(parsed).length !== 5)
+		throw new Error("task_artifact_owner_manifest_invalid");
+	const record = parsed as Record<string, unknown>;
+	if (typeof record.sessionId !== "string" || record.sessionId.length === 0)
+		throw new Error("task_artifact_owner_manifest_invalid");
+	let locator: TaskArtifactOwnerLocator | undefined;
+	try {
+		locator = parseTaskArtifactOwnerLocator({
+			schemaVersion: record.schemaVersion,
+			ownerId: record.ownerId,
+			directoryDev: record.directoryDev,
+			directoryIno: record.directoryIno,
+		});
+	} catch {
+		throw new Error("task_artifact_owner_manifest_invalid");
+	}
+	if (!locator) throw new Error("task_artifact_owner_manifest_invalid");
+	return { ...locator, sessionId: record.sessionId };
+}
+
+export function readOwnerManifest(
+	store: ManagedSessionDescendantStore,
+	locator: TaskArtifactOwnerLocator,
+	relativePath = manifestRelativePath(locator.ownerId),
+): OwnerManifest {
+	const manifest = store.readExpected(relativePath);
+	if (!manifest) throw new Error("task_artifact_owner_manifest_missing");
+	const parsed = parseOwnerManifest(manifest.bytes);
+	if (
+		parsed.ownerId !== locator.ownerId ||
+		parsed.directoryDev !== locator.directoryDev ||
+		parsed.directoryIno !== locator.directoryIno
+	)
+		throw new Error("task_artifact_owner_manifest_mismatch");
+	return parsed;
+}
+
+export function assertOwnerDirectoryExists(context: TaskArtifactOwnerStorageContext, ownerId: string): void {
+	const parent = path.join(context.sessionsRoot, OWNER_DIRECTORY);
+	const owner = path.join(parent, ownerId);
+	for (const candidate of [parent, owner]) {
+		let stat: fs.BigIntStats;
+		try {
+			stat = fs.lstatSync(candidate, { bigint: true });
+		} catch (error) {
+			if ((error as NodeJS.ErrnoException).code === "ENOENT") throw new Error("task_artifact_owner_missing");
+			throw error;
+		}
+		if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("task_artifact_owner_replaced");
+	}
+}
+
+export function assertOwnerIdentity(store: ManagedSessionDescendantStore, locator: TaskArtifactOwnerLocator): void {
+	const identity = store.subtreeRootAuthority;
+	if (identity.dev.toString() !== locator.directoryDev || identity.ino.toString() !== locator.directoryIno)
+		throw new Error("task_artifact_owner_identity_mismatch");
+}
+
+export function openOwnerStore(
+	context: TaskArtifactOwnerStorageContext,
+	rootStore: ManagedSessionDescendantStore,
+	locator: TaskArtifactOwnerLocator,
+	sessionId: string,
+): ManagedSessionDescendantStore {
+	if (locator.ownerId !== ownerIdForSession(sessionId)) throw new Error("task_artifact_owner_session_mismatch");
+	assertOwnerDirectoryExists(context, locator.ownerId);
+	const manifest = readOwnerManifest(rootStore, locator);
+	if (manifest.sessionId !== sessionId) throw new Error("task_artifact_owner_session_mismatch");
+	const identity = rootStore.captureDirectoryIdentity(ownerRelativePath(locator.ownerId));
+	if (identity.dev !== locator.directoryDev || identity.ino !== locator.directoryIno)
+		throw new Error("task_artifact_owner_identity_mismatch");
+	const ownerPath = path.join(context.sessionsRoot, ownerRelativePath(locator.ownerId));
+	const ownerStore = new ManagedSessionDescendantStore(
+		context.rootAuthority,
+		ownerPath,
+		undefined,
+		context.securityPolicy,
+		context.profileAgentDir,
+		{
+			canonicalPath: ownerPath,
+			dev: BigInt(locator.directoryDev),
+			ino: BigInt(locator.directoryIno),
+		},
+	);
+	try {
+		assertOwnerIdentity(ownerStore, locator);
+		readOwnerManifest(ownerStore, locator, OWNER_MANIFEST);
+		return ownerStore;
+	} catch (error) {
+		ownerStore.close();
+		throw error;
+	}
+}
+
+export function locatorFromManifest(manifest: OwnerManifest): TaskArtifactOwnerLocator {
+	return {
+		schemaVersion: OWNER_SCHEMA_VERSION,
+		ownerId: manifest.ownerId,
+		directoryDev: manifest.directoryDev,
+		directoryIno: manifest.directoryIno,
+	};
+}
+
+export function captureValidatedOwnerTree(
+	context: TaskArtifactOwnerStorageContext,
+	rootStore: ManagedSessionDescendantStore,
+	sessionId: string,
+	locator: TaskArtifactOwnerLocator,
+): NativeDirectoryTreeSnapshot {
+	if (locator.ownerId !== ownerIdForSession(sessionId)) throw new Error("task_artifact_owner_session_mismatch");
+	assertOwnerDirectoryExists(context, locator.ownerId);
+	const manifest = readOwnerManifest(rootStore, locator);
+	if (manifest.sessionId !== sessionId) throw new Error("task_artifact_owner_session_mismatch");
+	const tree = rootStore.captureTree(ownerRelativePath(locator.ownerId));
+	if (tree.rootDev !== locator.directoryDev || tree.rootIno !== locator.directoryIno)
+		throw new Error("task_artifact_owner_identity_mismatch");
+	return tree;
+}
+
+export function captureOwnerTreeIfPresent(
+	context: TaskArtifactOwnerStorageContext,
+	rootStore: ManagedSessionDescendantStore,
+	ownerId: string,
+	pathname: string,
+): NativeDirectoryTreeSnapshot | undefined {
+	if (!isOwnerRetainedRoot(context, ownerId, pathname))
+		throw new Error("task_artifact_owner_retained_root_unrecognized");
+	let named: fs.BigIntStats;
+	try {
+		named = fs.lstatSync(pathname, { bigint: true });
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+		throw error;
+	}
+	if (!named.isDirectory() || named.isSymbolicLink()) throw new Error("task_artifact_owner_retained_root_replaced");
+	const relative = path.relative(context.sessionsRoot, pathname).split(path.sep).join("/");
+	assertSafeRelativePath(relative);
+	return freezeTreeSnapshot(rootStore.captureTree(relative));
+}
+
+export function ownerTreeHasPendingManagedPublication(snapshot: NativeDirectoryTreeSnapshot): boolean {
+	return snapshot.entries.some(entry =>
+		/^\..+\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.(?:staging|replacement)$/u.test(
+			path.posix.basename(entry.relativePath),
+		),
+	);
+}
+
+/** Capture exact owner evidence without repairing its security, timestamps, or namespace. */
+export function captureTaskArtifactOwnerDeletionEvidence(
+	context: TaskArtifactOwnerStorageContext,
+	sessionId: string,
+	locatorValue: unknown,
+): TaskArtifactOwnerDeletionEvidence | undefined {
+	const locator = parseTaskArtifactOwnerLocator(locatorValue);
+	if (!locator) return undefined;
+	const rootStore = newSessionRootStore(context);
+	try {
+		rootStore.verifyRootSecurity();
+		const parentIdentity: TaskArtifactOwnerParentIdentity = rootStore.captureDirectoryIdentity(OWNER_DIRECTORY);
+		const treeSnapshot = captureValidatedOwnerTree(context, rootStore, sessionId, locator);
+		// This refuses to capture during publication; it does not revoke independent open descriptors.
+		if (ownerTreeHasPendingManagedPublication(treeSnapshot))
+			throw new Error("task_artifact_owner_writer_not_quiescent");
+		const parentAfter = rootStore.captureDirectoryIdentity(OWNER_DIRECTORY);
+		if (!sameOwnerParentIdentity(parentIdentity, parentAfter))
+			throw new Error("task_artifact_owner_parent_changed_during_capture");
+		return immutableDeletionEvidence(sessionId, locator, parentIdentity, treeSnapshot);
+	} finally {
+		rootStore.close();
+	}
+}

package/src/session/internal/task-artifact-owner-transcript.ts

@@ -0,0 +1,68 @@
+import { parseFirstJsonlLine } from "../session-transcript-header";
+import { parseTaskArtifactOwnerLocator, type TaskArtifactOwnerLocator } from "../task-artifact-owner-codec";
+
+const transcriptDecoder = new TextDecoder("utf-8", { fatal: true });
+
+/** Resolve the path-free owner locator using transcript replay's header-patch semantics. */
+export function taskArtifactOwnerLocatorFromTranscriptBytes(
+	bytes: Uint8Array,
+	expectedSessionId: string,
+): TaskArtifactOwnerLocator | undefined {
+	const header = parseFirstJsonlLine(bytes);
+	if (header?.type !== "session" || header.id !== expectedSessionId)
+		throw new Error("task_artifact_owner_transcript_header_invalid");
+	let locator = parseTaskArtifactOwnerLocator(header.taskArtifactOwner);
+	if (typeof header.version !== "number" || header.version < 4) return locator;
+	const firstEnd = bytes.indexOf(0x0a);
+	let start = firstEnd < 0 ? bytes.byteLength : firstEnd + 1;
+	while (start < bytes.byteLength) {
+		const newline = bytes.indexOf(0x0a, start);
+		const end = newline < 0 ? bytes.byteLength : newline;
+		const line = bytes.subarray(start, end);
+		let record: Record<string, unknown> | undefined;
+		try {
+			if (line.byteLength > 0) {
+				const parsed: unknown = JSON.parse(transcriptDecoder.decode(line));
+				if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed))
+					record = parsed as Record<string, unknown>;
+			}
+		} catch {
+			const text = Buffer.from(line).toString("utf8");
+			if (text.includes("header_patch") && text.includes("taskArtifactOwner"))
+				throw new Error("task_artifact_owner_patch_invalid");
+		}
+		if (
+			record?.type === "header_patch" &&
+			typeof record.patch === "object" &&
+			record.patch !== null &&
+			!Array.isArray(record.patch) &&
+			Object.hasOwn(record.patch, "taskArtifactOwner")
+		) {
+			const patch = record.patch as Record<string, unknown>;
+			if (
+				!Object.keys(record).every(key => key === "type" || key === "patch") ||
+				!Object.keys(patch).every(
+					key =>
+						key === "cwd" ||
+						key === "title" ||
+						key === "titleSource" ||
+						key === "starred" ||
+						key === "taskArtifactOwner",
+				) ||
+				(patch.cwd !== undefined && typeof patch.cwd !== "string") ||
+				(patch.title !== undefined && typeof patch.title !== "string") ||
+				(patch.titleSource !== undefined && patch.titleSource !== "auto" && patch.titleSource !== "user") ||
+				(patch.starred !== undefined && typeof patch.starred !== "boolean")
+			)
+				throw new Error("task_artifact_owner_patch_invalid");
+			try {
+				locator = parseTaskArtifactOwnerLocator(patch.taskArtifactOwner);
+			} catch {
+				throw new Error("task_artifact_owner_patch_invalid");
+			}
+		}
+		if (newline < 0) break;
+		start = newline + 1;
+	}
+	return locator;
+}