@gajae-code/coding-agent 0.18.6 → 0.18.8

package/src/extensibility/extensions/runner.ts

@@ -325,6 +325,7 @@ export class ExtensionRunner {
 	#getArtifactRangeFn: ExtensionContextActions["getArtifactRange"] = undefined;
 
 	#getJobsFn: ExtensionContextActions["getJobs"] = undefined;
+	#getProjectProgressFn: ExtensionContextActions["getProjectProgress"] = undefined;
 	#onJobFoldFn: ExtensionContextActions["onJobFold"] = undefined;
 	#onSessionEventFn: ExtensionContextActions["onSessionEvent"] = undefined;
 	#sdkControlFn: ExtensionContextActions["sdkControl"] = undefined;
@@ -482,6 +483,7 @@ export class ExtensionRunner {
 		this.#getArtifactRangeFn = contextActions.getArtifactRange;
 
 		this.#getJobsFn = contextActions.getJobs;
+		this.#getProjectProgressFn = contextActions.getProjectProgress;
 		this.#onJobFoldFn = contextActions.onJobFold;
 		this.#onSessionEventFn = contextActions.onSessionEvent;
 		this.#sdkControlFn = contextActions.sdkControl;
@@ -848,6 +850,7 @@ export class ExtensionRunner {
 			getArtifactRange: (id, offset, length) => this.#getArtifactRangeFn?.(id, offset, length),
 
 			getJobs: () => this.#getJobsFn?.(),
+			...(this.#getProjectProgressFn ? { getProjectProgress: this.#getProjectProgressFn } : {}),
 			onJobFold: listener => this.#onJobFoldFn?.(listener) ?? (() => {}),
 			onSessionEvent: listener => this.#onSessionEventFn?.(listener) ?? (() => {}),
 			sdkControl: (operation, input) => this.#sdkControlFn?.(operation, input),
@@ -867,6 +870,7 @@ export class ExtensionRunner {
 				...(this.#getExtensionsFn ? ["getExtensions"] : []),
 				...(this.#getArtifactRangeFn ? ["getArtifactRange"] : []),
 				...(this.#getJobsFn ? ["getJobs"] : []),
+				...(this.#getProjectProgressFn ? ["getProjectProgress"] : []),
 				...(this.#onJobFoldFn ? ["onJobFold"] : []),
 				...(this.#sdkControlFn ? ["sdkControl"] : []),
 				...(this.#invokeSkillFn ? ["invokeSkill"] : []),

package/src/extensibility/extensions/types.ts

@@ -49,6 +49,7 @@ import type { ExecOptions, ExecResult } from "../../exec/exec";
 import type { CustomEditor } from "../../modes/components/custom-editor";
 import type { WorkflowGateEmitter } from "../../modes/shared/agent-wire/workflow-gate-broker";
 import type { Theme } from "../../modes/theme/theme";
+import type { ProjectProgressSnapshot } from "../../progress/progress-contract";
 import type { AgentSessionEventListener } from "../../session/agent-session";
 import type {
 	ClientBridge,
@@ -538,6 +539,8 @@ export interface ExtensionContext {
 		| Promise<{ bytes: Uint8Array; totalBytes: number } | undefined>;
 
 	getJobs(): unknown;
+	/** Read-only project progress snapshot (`session.progress`), derived from durable session state. */
+	getProjectProgress?(): Promise<ProjectProgressSnapshot>;
 	/** Subscribe to foreground-wait folds (`bash_folded`). Returns an unsubscribe function. */
 	onJobFold?(listener: (event: JobFoldEvent) => void): () => void;
 	/** Observe session events synchronously in producer order. Returns an unsubscribe function. */
@@ -764,6 +767,8 @@ export interface AgentStartEvent extends SharedAgentStartEvent {
 	sdkRunToken?: string;
 	/** Complete set of SDK queue owners consumed together by this run. */
 	sdkRunTokens?: string[];
+	/** Internal public lifecycle boundary; accepted retries with a suppressed predecessor end retain it. */
+	lifecycleScope?: AttemptScope;
 }
 
 /** Fired when an agent run fails before emitting agent_end. The error is the
@@ -1723,6 +1728,8 @@ export interface ExtensionContextActions {
 		| undefined
 		| Promise<{ bytes: Uint8Array; totalBytes: number } | undefined>;
 	getJobs?: () => unknown;
+	/** Read-only project progress snapshot backing the `session.progress` SDK query. */
+	getProjectProgress?: () => Promise<ProjectProgressSnapshot>;
 	/** Subscribe to foreground-wait folds so the SDK host can publish `bash_folded`. Returns an unsubscribe. */
 	onJobFold?: (listener: (event: JobFoldEvent) => void) => () => void;
 	/** Ordered, synchronous AgentSession subscription, independent of async extension hooks. */

package/src/extensibility/gjc-plugins/runtime-adapters.ts

@@ -149,22 +149,70 @@ const initialTemporaryRoots = initialProcessEnvironment.then(async environment =
 	}
 	return [...roots];
 });
-const initialNodeAuthorities = initialProcessEnvironment.then(async environment => {
-	const authorities = new Map<string, string>();
+
+/** Startup identity of a file: the object `hashStableFile` must still be reading. */
+export interface StableFileIdentity {
+	dev: number;
+	ino: number;
+	size: number;
+	mtimeMs: number;
+	ctimeMs: number;
+}
+
+/**
+ * Startup identity of every canonical `node` on PATH, keyed by realpath. Only
+ * `stat` runs at startup; the digest is computed on first use from a descriptor
+ * whose identity must still match this snapshot, so a later replacement cannot
+ * become launch authority.
+ */
+const initialNodeIdentities = initialProcessEnvironment.then(async environment => {
+	const identities = new Map<string, StableFileIdentity>();
 	const temporaryRoots = await initialTemporaryRoots;
 	for (const pathEntry of (environment.get("PATH") ?? "").split(path.delimiter).filter(path.isAbsolute)) {
 		const lexical = path.join(pathEntry, process.platform === "win32" ? "node.exe" : "node");
 		try {
 			const real = await fs.realpath(lexical);
 			if (temporaryRoots.some(root => isWithin(root, real))) continue;
-			authorities.set(real, await hashStableFile(real, "Initial Node executable", MCP_LAUNCHER_MAX_BYTES));
+			if (identities.has(real)) continue;
+			const stat = await fs.stat(real);
+			identities.set(real, {
+				dev: stat.dev,
+				ino: stat.ino,
+				size: stat.size,
+				mtimeMs: stat.mtimeMs,
+				ctimeMs: stat.ctimeMs,
+			});
 		} catch {
-			// Missing or unstable startup candidates do not become authority.
+			// Missing startup candidates do not become authority.
 		}
 	}
-	return authorities;
+	return identities;
 });
 
+/** First-use digests of startup Node candidates, keyed by realpath; failures are cached as `undefined`. */
+const initialNodeHashes = new Map<string, Promise<string | undefined>>();
+
+/**
+ * Digest of a `node` that was on PATH at startup, or `undefined` when the path
+ * was not a startup candidate or no longer is the startup file object.
+ */
+export function getInitialNodeHash(realPath: string): Promise<string | undefined> {
+	let digest = initialNodeHashes.get(realPath);
+	if (!digest) {
+		digest = initialNodeIdentities.then(async identities => {
+			const identity = identities.get(realPath);
+			if (!identity) return undefined;
+			try {
+				return await hashStableFile(realPath, "Initial Node executable", MCP_LAUNCHER_MAX_BYTES, identity);
+			} catch {
+				return undefined;
+			}
+		});
+		initialNodeHashes.set(realPath, digest);
+	}
+	return digest;
+}
+
 async function snapshotExistingFile(filePath: string): Promise<FileSnapshot | null> {
 	try {
 		const stat = await fs.stat(filePath);
@@ -416,11 +464,28 @@ const STABLE_HASH_CHUNK_BYTES = 1024 * 1024;
  * on PATH; buffering each interpreter (~120 MiB) held its full bytes in the
  * session process until exit.
  */
-export async function hashStableFile(filePath: string, label: string, maxBytes: number): Promise<string> {
+export async function hashStableFile(
+	filePath: string,
+	label: string,
+	maxBytes: number,
+	expected?: StableFileIdentity,
+): Promise<string> {
 	const handle = await fs.open(filePath, fs.constants.O_RDONLY);
 	try {
 		const before = await handle.stat();
 		if (!before.isFile()) throw new Error(`${label} is not a regular file`);
+		// Checked on the opened descriptor, so the digest belongs to the expected
+		// file object even if the path is swapped around the open.
+		if (
+			expected &&
+			(before.dev !== expected.dev ||
+				before.ino !== expected.ino ||
+				before.size !== expected.size ||
+				before.mtimeMs !== expected.mtimeMs ||
+				before.ctimeMs !== expected.ctimeMs)
+		) {
+			throw new Error(`${label} is not the expected file`);
+		}
 		if (before.size > maxBytes) throw new Error(`${label} exceeds its byte limit`);
 		const hash = createHash("sha256");
 		const chunk = Buffer.allocUnsafe(STABLE_HASH_CHUNK_BYTES);
@@ -515,7 +580,7 @@ async function isInitialManagedNodeLauncherPath(
 	const real = await fs.realpath(executablePath);
 	if (untrustedRoots.some(root => isWithin(root, real))) return false;
 	if ((await initialTemporaryRoots).some(root => isWithin(root, real))) return false;
-	const expected = (await initialNodeAuthorities).get(real);
+	const expected = await getInitialNodeHash(real);
 	if (!expected) return false;
 	return (await hashStableFile(real, "Initial Node executable", MCP_LAUNCHER_MAX_BYTES)) === expected;
 }
@@ -671,7 +736,7 @@ async function prepareVerifiedStdioLaunch(input: {
 		true,
 	);
 	const launcherReal = await fs.realpath(input.launcherPath);
-	const expectedLauncherHash = (await initialNodeAuthorities).get(launcherReal);
+	const expectedLauncherHash = await getInitialNodeHash(launcherReal);
 	if (!expectedLauncherHash || sha256(launcherBytes) !== expectedLauncherHash) {
 		throw new Error("Plugin MCP Node interpreter drifted from startup authority");
 	}

package/src/extensibility/plugins/manager.ts

@@ -12,6 +12,7 @@ import {
 } from "@gajae-code/utils";
 import { withFileLock } from "../../config/file-lock";
 import { extractPackageName, parsePluginSpec } from "./parser";
+import { resolvePluginLinkPath } from "./plugin-link-path";
 import type {
 	DoctorCheck,
 	DoctorOptions,
@@ -535,11 +536,11 @@ export class PluginManager {
 
 		await this.#ensurePluginsDir();
 
-		const linkPath = path.join(getPluginsNodeModules(), pkg.name);
+		const linkPath = resolvePluginLinkPath(getPluginsNodeModules(), pkg.name);
 
 		// Handle scoped packages
 		if (pkg.name.startsWith("@")) {
-			const scopeDir = path.join(getPluginsNodeModules(), pkg.name.split("/")[0]);
+			const scopeDir = path.dirname(linkPath);
 			await fs.promises.mkdir(scopeDir, { recursive: true });
 		}
 

package/src/extensibility/plugins/marketplace/cache.ts

@@ -87,6 +87,21 @@ export async function cachePlugin(
 	return targetPath;
 }
 
+/** Write a regular file. A symlink at the destination is removed, not followed. */
+export async function writeCachedRegularFile(targetPath: string, content: string): Promise<void> {
+	try {
+		const stat = await fs.lstat(targetPath);
+		if (stat.isSymbolicLink()) {
+			await fs.unlink(targetPath);
+		} else if (!stat.isFile()) {
+			throw new Error("unsafe cache artifact");
+		}
+	} catch (error) {
+		if (!isEnoent(error)) throw error;
+	}
+	await Bun.write(targetPath, content);
+}
+
 export async function stageCachedPlugin(sourcePath: string, stagingPath: string): Promise<string> {
 	await fs.rm(stagingPath, { recursive: true, force: true });
 	await fs.cp(sourcePath, stagingPath, { recursive: true, errorOnExist: true, verbatimSymlinks: true });

package/src/extensibility/plugins/marketplace/manager.ts

@@ -19,7 +19,13 @@ import {
 } from "@gajae-code/natives";
 import { isEnoent, logger, pathIsWithin } from "@gajae-code/utils";
 import { withFileLock } from "../../../config/file-lock";
-import { cachePlugin, getCachedPluginPath, inspectCachedPlugin, stageCachedPlugin } from "./cache";
+import {
+	cachePlugin,
+	getCachedPluginPath,
+	inspectCachedPlugin,
+	stageCachedPlugin,
+	writeCachedRegularFile,
+} from "./cache";
 import { classifySource, fetchMarketplace, parseMarketplaceCatalog, promoteCloneToCache } from "./fetcher";
 import {
 	addInstalledPlugin,
@@ -1430,12 +1436,14 @@ export class MarketplaceManager {
 			if (!pathIsWithin(cachePath, sourcePath)) {
 				throw new Error(`Plugin "${entry.name}" lspServers path escapes the plugin directory`);
 			}
+			const sourceStat = await fs.lstat(sourcePath);
+			if (sourceStat.isSymbolicLink()) throw new Error(`Plugin "${entry.name}" lspServers path is a symlink`);
 			const content = await Bun.file(sourcePath).text();
-			await Bun.write(targetPath, content);
+			await writeCachedRegularFile(targetPath, content);
 			return;
 		}
 
-		await Bun.write(targetPath, `${JSON.stringify({ servers: lspServers }, null, 2)}\n`);
+		await writeCachedRegularFile(targetPath, `${JSON.stringify({ servers: lspServers }, null, 2)}\n`);
 	}
 
 	/**

package/src/extensibility/plugins/plugin-link-path.ts

@@ -0,0 +1,12 @@
+import path from "node:path";
+
+/** Resolve a package.json name under the plugins node_modules root, or throw. */
+export function resolvePluginLinkPath(root: string, name: string): string {
+	const base = path.resolve(root);
+	const destination = path.resolve(base, name);
+	const relative = path.relative(base, destination);
+	if (relative === "" || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+		throw new Error(`package.json name is not a safe plugin link path: ${name}`);
+	}
+	return destination;
+}

package/src/extensibility/runtime-skill-discovery.ts

@@ -9,7 +9,7 @@ import {
 import { findRepoRoot } from "../capability/fs";
 import type { Skill as CapabilitySkill } from "../capability/skill";
 import type { SkillsSettings } from "../config/settings-schema";
-import { resolveSkillScopeTrust } from "../config/skill-settings-defaults";
+import { resolveGlobalUserSkillLinkTrust, resolveSkillScopeTrust } from "../config/skill-settings-defaults";
 import { BUNDLED_GJC_SKILL_CATALOG } from "../defaults/gjc-skills.generated";
 import { scanClaudeProjectSkills, scanClaudeUserSkills } from "../discovery/claude";
 import { loadMarketplaceSkills } from "../discovery/claude-plugins";
@@ -79,6 +79,8 @@ export interface DiscoverRuntimeSkillsOptions {
 	offset?: number;
 	source?: RuntimeSkillDiscoveryScope | "all";
 	policy?: SkillsSettings;
+	/** User-owned permission to read external user skill symlinks; defaults to the direct policy value. */
+	allowExternalUserSkillSymlinks?: boolean;
 }
 
 function getRuntimeHome(): string {
@@ -296,6 +298,7 @@ async function scanProjectOrUserDir(
 	source: RuntimeSkillDiscoveryScope,
 	providerPriority: number,
 	authorityRoot?: string,
+	allowExternalUserSkillSymlinks?: boolean,
 ): Promise<ScanJobResult> {
 	const result = await scanSkillsFromDir(ctx, {
 		dir,
@@ -304,6 +307,7 @@ async function scanProjectOrUserDir(
 		providerId: "runtime",
 		level,
 		requireDescription: true,
+		allowExternalUserSkillSymlinks,
 	});
 	return {
 		items: result.items.map(skill => ({ skill, source, providerPriority })),
@@ -449,6 +453,8 @@ export async function discoverRuntimeSkills(
 	const home = options.home ?? getRuntimeHome();
 	const source = options.source ?? "all";
 	const policy = options.policy;
+	const allowExternalUserSkillSymlinks =
+		options.allowExternalUserSkillSymlinks ?? resolveGlobalUserSkillLinkTrust(policy ?? {});
 	const diagnostics: string[] = [];
 	const agentDir = resolveRuntimeAgentDir(home, options.agentDir, hasExplicitHome);
 	const profileAuthority =
@@ -478,6 +484,7 @@ export async function discoverRuntimeSkills(
 					"user",
 					100,
 					path.resolve(dir) === path.resolve(agentDir, "skills") ? agentDir : undefined,
+					allowExternalUserSkillSymlinks,
 				),
 			);
 		}
@@ -485,7 +492,16 @@ export async function discoverRuntimeSkills(
 	if ((source === "all" || source === "user") && policy?.enabled === true) {
 		for (const dir of getCustomSkillDirs(policy, home)) {
 			scanJobs.push(
-				scanProjectOrUserDir({ cwd: options.cwd, home, repoRoot: home }, dir, "user", `custom ${dir}`, "user", 0),
+				scanProjectOrUserDir(
+					{ cwd: options.cwd, home, repoRoot: home },
+					dir,
+					"user",
+					`custom ${dir}`,
+					"user",
+					0,
+					undefined,
+					allowExternalUserSkillSymlinks,
+				),
 			);
 		}
 	}
@@ -630,6 +646,7 @@ export async function findRuntimeSkillByName(
 	home?: string,
 	agentDir?: string,
 	profileAuthority?: "default" | "custom",
+	allowExternalUserSkillSymlinks?: boolean,
 ): Promise<Skill | undefined> {
 	const normalized = name.trim();
 	if (!normalized) return undefined;
@@ -650,6 +667,7 @@ export async function findRuntimeSkillByName(
 		home: resolvedHome,
 		agentDir: resolvedAgentDir,
 		profileAuthority: resolvedProfileAuthority,
+		allowExternalUserSkillSymlinks: allowExternalUserSkillSymlinks ?? resolveGlobalUserSkillLinkTrust(policy ?? {}),
 	});
 	return loaded.skills.find(skill => skill.name === normalized);
 }

package/src/extensibility/skill-management.ts

@@ -299,8 +299,10 @@ export async function listNativeSkillsForManagement(options: {
 	cwd: string;
 	home?: string;
 	agentDir?: string;
-	/** Resolver-owned profile classification; unlike path comparison, this survives HOME refreshes. */
+	/** Resolver-owned profile classification; unlike path comparison, this survives HOME/config refreshes. */
 	profileAuthority?: "default" | "custom";
+	/** User-owned permission to follow symlinks outside user skill scan roots. */
+	allowExternalUserSkillSymlinks?: boolean;
 	policy?: SkillManagementPolicy;
 }): Promise<ManagedSkillRecord[]> {
 	const homeWasInjected = options.home !== undefined;
@@ -321,6 +323,7 @@ export async function listNativeSkillsForManagement(options: {
 	const policy = options.policy;
 	const projectTrusted = resolveSkillScopeTrust(policy ?? {}, "project");
 	const userTrusted = resolveSkillScopeTrust(policy ?? {}, "user");
+	const allowExternalUserSkillSymlinks = options.allowExternalUserSkillSymlinks ?? userTrusted;
 
 	const scanJobs: Array<Promise<{ dir: string; scope: SkillScope; items: CapabilitySkill[] }>> = [];
 	const projectDirs = await getProjectSkillDirs(options.cwd, home);
@@ -351,6 +354,7 @@ export async function listNativeSkillsForManagement(options: {
 						providerId: "runtime",
 						level: "user",
 						requireDescription: true,
+						allowExternalUserSkillSymlinks,
 					},
 				).then(result => ({ dir, scope: "user" as const, items: result.items })),
 			);
@@ -391,7 +395,7 @@ export async function listNativeSkillsForManagement(options: {
 				records.push({
 					name: skill.name,
 					description: typeof skill.frontmatter?.description === "string" ? skill.frontmatter.description : "",
-					path: skill.path,
+					path: skill.discoveryPath ?? skill.path,
 					scope,
 					source,
 					hidden: skill.frontmatter?.hide === true,

package/src/extensibility/skills.ts

@@ -125,6 +125,8 @@ export interface LoadSkillsOptions extends SkillsSettings {
 	agentDir?: string;
 	/** Resolver-owned classification for the selected agent directory. */
 	profileAuthority?: "default" | "custom";
+	/** User-owned permission to follow symlinks outside user skill scan roots. */
+	allowExternalUserSkillSymlinks?: boolean;
 }
 
 /**
@@ -167,6 +169,7 @@ export async function loadSkills(options: LoadSkillsOptions = {}): Promise<LoadS
 
 	const projectTrusted = resolveSkillScopeTrust(options, "project");
 	const userTrusted = resolveSkillScopeTrust(options, "user");
+	const allowExternalUserSkillSymlinks = options.allowExternalUserSkillSymlinks ?? userTrusted;
 
 	// Skill scope trust decides which canonical locations are loaded: project
 	// scope covers `.gjc/skills` (walk-up), user scope covers `~/.gjc/agent/skills`
@@ -197,6 +200,7 @@ export async function loadSkills(options: LoadSkillsOptions = {}): Promise<LoadS
 		userAgentDir: agentDir,
 		profileAuthority,
 		repoRoot: await findRepoRoot(cwd),
+		allowExternalUserSkillSymlinks,
 	};
 	const providerResults = await Promise.all(
 		providers.map(async provider => {
@@ -311,12 +315,13 @@ export async function loadSkills(options: LoadSkillsOptions = {}): Promise<LoadS
 		customDirectories.map(async dir => {
 			const expandedDir = expandTilde(dir, home);
 			const scanResult = await scanSkillsFromDir(
-				{ cwd, home, repoRoot: null },
+				{ cwd, home, repoRoot: null, allowExternalUserSkillSymlinks },
 				{
 					dir: expandedDir,
 					providerId: "custom",
 					level: "user",
 					requireDescription: true,
+					allowExternalUserSkillSymlinks,
 				},
 			);
 			return { expandedDir, scanResult };