@gajae-code/coding-agent 0.18.7 → 0.18.9

package/src/tools/eval.ts

@@ -20,7 +20,7 @@ import {
 } from "./output-meta";
 import { formatTitle, replaceTabs, shortenPath, truncateToWidth, wrapBrackets } from "./render-utils";
 import { evalToolDescriptionForSession } from "./session-descriptions";
-import { ToolAbortError, ToolError } from "./tool-errors";
+import { ToolError, throwIfAborted } from "./tool-errors";
 import { toolResult } from "./tool-result";
 import { clampTimeout } from "./tool-timeouts";
 
@@ -233,24 +233,23 @@ export class EvalTool implements AgentTool<typeof evalSchema> {
 			throw new ToolError("Eval tool requires a session when not using proxy executor");
 		}
 		const session = this.session;
-
-		const cells: ResolvedEvalCell[] = [];
-		for (let i = 0; i < params.cells.length; i++) {
-			const cell = params.cells[i];
-			const language: EvalLanguage = cell.language === "py" ? "python" : "js";
-			const resolved = await resolveBackend(session, language);
-			cells.push({
-				index: i,
-				title: cell.title,
-				code: cell.code,
-				timeoutMs: (cell.timeout ?? 30) * 1000,
-				reset: cell.reset ?? false,
-				resolved,
-			});
-		}
-		const languages = uniqueEvalLanguages(cells);
-		const notice = detailsNotice(cells);
+		session.assertEvalExecutionAllowed?.();
+		const cwd = session.cwd;
+		const settings = session.settings;
+		const sessionFile = session.getSessionFile?.() ?? null;
+		const kernelOwnerId = session.getEvalKernelOwnerId?.() ?? null;
+		const sessionId = sessionFile ? `session:${sessionFile}:cwd:${cwd}` : `cwd:${cwd}`;
+		const evalSession = {
+			...session,
+			cwd,
+			settings,
+			getSessionFile: () => sessionFile,
+			getEvalKernelOwnerId: () => kernelOwnerId,
+		};
 		const sessionAbortController = new AbortController();
+		const abortFromCaller = (): void => sessionAbortController.abort(signal?.reason);
+		if (signal?.aborted) abortFromCaller();
+		else signal?.addEventListener("abort", abortFromCaller, { once: true });
 		let outputSink: OutputSink | undefined;
 		let outputSummary: OutputSummary | undefined;
 		let outputDumped = false;
@@ -261,12 +260,30 @@ export class EvalTool implements AgentTool<typeof evalSchema> {
 			return outputSummary;
 		};
 
-		const execution = (async (): Promise<AgentToolResult<EvalToolDetails | undefined>> => {
+		const execution = Promise.resolve().then(async (): Promise<AgentToolResult<EvalToolDetails | undefined>> => {
 			try {
-				if (signal?.aborted) {
-					throw new ToolAbortError();
-				}
+				throwIfAborted(sessionAbortController.signal);
 				session.assertEvalExecutionAllowed?.();
+				const cells: ResolvedEvalCell[] = [];
+				for (let i = 0; i < params.cells.length; i++) {
+					throwIfAborted(sessionAbortController.signal);
+					session.assertEvalExecutionAllowed?.();
+					const cell = params.cells[i];
+					const language: EvalLanguage = cell.language === "py" ? "python" : "js";
+					const resolved = await resolveBackend(evalSession, language);
+					throwIfAborted(sessionAbortController.signal);
+					session.assertEvalExecutionAllowed?.();
+					cells.push({
+						index: i,
+						title: cell.title,
+						code: cell.code,
+						timeoutMs: (cell.timeout ?? 30) * 1000,
+						reset: cell.reset ?? false,
+						resolved,
+					});
+				}
+				const languages = uniqueEvalLanguages(cells);
+				const notice = detailsNotice(cells);
 
 				const tailBuffer = new TailBuffer(DEFAULT_MAX_BYTES * 2);
 				const jsonOutputs: unknown[] = [];
@@ -320,31 +337,28 @@ export class EvalTool implements AgentTool<typeof evalSchema> {
 					});
 				};
 
-				const sessionFile = session.getSessionFile?.() ?? undefined;
-				const kernelOwnerId = session.getEvalKernelOwnerId?.() ?? undefined;
+				throwIfAborted(sessionAbortController.signal);
+				session.assertEvalExecutionAllowed?.();
 				const { path: artifactPath, id: artifactId } = (await session.allocateOutputArtifact?.("eval")) ?? {};
+				throwIfAborted(sessionAbortController.signal);
 				session.assertEvalExecutionAllowed?.();
 				outputSink = new OutputSink({
 					artifactPath,
 					artifactId,
-					headBytes: resolveOutputSinkHeadBytes(session.settings),
-					maxColumns: resolveOutputMaxColumns(session.settings),
+					headBytes: resolveOutputSinkHeadBytes(settings),
+					maxColumns: resolveOutputMaxColumns(settings),
 					onChunk: chunk => {
 						appendTail(chunk);
 						pushUpdate();
 					},
 				});
-				const sessionId = sessionFile ? `session:${sessionFile}:cwd:${session.cwd}` : `cwd:${session.cwd}`;
-
 				for (let i = 0; i < cells.length; i++) {
 					const cell = cells[i];
 					const backend = cell.resolved.backend;
 					const timeoutSec = timeoutSecondsFromMs(cell.timeoutMs);
 					const deadlineMs = Date.now() + timeoutSec * 1000;
 					const timeoutSignal = AbortSignal.timeout(Math.max(0, deadlineMs - Date.now()));
-					const combinedSignal = signal
-						? AbortSignal.any([signal, timeoutSignal, sessionAbortController.signal])
-						: AbortSignal.any([timeoutSignal, sessionAbortController.signal]);
+					const combinedSignal = AbortSignal.any([timeoutSignal, sessionAbortController.signal]);
 
 					const cellResult = cellResults[i];
 					cellResult.status = "running";
@@ -353,15 +367,17 @@ export class EvalTool implements AgentTool<typeof evalSchema> {
 					cellResult.exitCode = undefined;
 					cellResult.durationMs = undefined;
 					pushUpdate();
+					throwIfAborted(sessionAbortController.signal);
+					session.assertEvalExecutionAllowed?.();
 
 					const startTime = Date.now();
 					const result = await backend.execute(cell.code, {
-						cwd: session.cwd,
+						cwd,
 						sessionId,
 						sessionFile: sessionFile ?? undefined,
-						kernelOwnerId,
+						kernelOwnerId: kernelOwnerId ?? undefined,
 						signal: combinedSignal,
-						session,
+						session: evalSession,
 						deadlineMs,
 						reset: cell.reset,
 						artifactPath,
@@ -511,9 +527,13 @@ export class EvalTool implements AgentTool<typeof evalSchema> {
 					} catch {}
 				}
 			}
-		})();
+		});
 
-		return await (session.trackEvalExecution?.(execution, sessionAbortController) ?? execution);
+		try {
+			return await (session.trackEvalExecution?.(execution, sessionAbortController) ?? execution);
+		} finally {
+			signal?.removeEventListener("abort", abortFromCaller);
+		}
 	}
 }
 

package/src/tools/gh.ts

@@ -8,10 +8,12 @@ import { getWorktreeDir, hashPath, isEnoent, prompt, untilAborted } from "@gajae
 import * as z from "zod/v4";
 import type { Settings } from "../config/settings";
 import githubDescription from "../prompts/tools/github.md" with { type: "text" };
+import { assertWorkflowMutationAllowed } from "../skill-state/workflow-mutation-guard";
 import * as git from "../utils/git";
 import type { ToolSession } from ".";
 import { formatShortSha } from "./gh-format";
 import { type CacheStatus, getOrFetchView, resolveGithubCacheAuthKey } from "./github-cache";
+import { githubMutationTool, isGithubReadOnlyOp } from "./github-side-effect";
 import type { OutputMeta } from "./output-meta";
 import { ToolError, throwIfAborted } from "./tool-errors";
 import { toolResult } from "./tool-result";
@@ -2591,6 +2593,14 @@ export class GithubTool implements AgentTool<typeof githubSchema, GhToolDetails>
 		_context?: AgentToolContext,
 	): Promise<AgentToolResult<GhToolDetails>> {
 		return untilAborted(signal, async () => {
+			if (!isGithubReadOnlyOp(params.op)) {
+				await assertWorkflowMutationAllowed({
+					cwd: this.session.cwd,
+					sessionId: this.session.getSessionId?.() ?? undefined,
+					tool: githubMutationTool,
+					args: params,
+				});
+			}
 			switch (params.op) {
 				case "repo_view":
 					return executeRepoView(this.session, params, signal);

package/src/tools/github-side-effect.ts

@@ -0,0 +1,112 @@
+/**
+ * Classify `github` tool operations for the approval gate and the planning
+ * mutation guard. Read-only ops stay available. Every other op, including a
+ * missing or unrecognized one, is a side effect and fails closed.
+ */
+import type { AgentTool } from "@gajae-code/agent-core";
+
+/** Name-only tool the planning guard uses when `GithubTool.execute` checks itself. */
+export const githubMutationTool = {
+	name: "github",
+	label: "GitHub",
+	description: "github",
+	parameters: {},
+	execute: async () => ({ content: [] }),
+} as AgentTool;
+
+const GITHUB_READ_ONLY_OPS = new Set([
+	"repo_view",
+	"search_issues",
+	"search_prs",
+	"search_code",
+	"search_commits",
+	"search_repos",
+	"run_watch",
+]);
+
+const GITHUB_SIDE_EFFECT_OPS = new Set(["pr_create", "pr_checkout", "pr_push"]);
+
+const TITLE_MAX = 160;
+
+function recordOf(args: unknown): Record<string, unknown> | undefined {
+	if (!args || typeof args !== "object" || Array.isArray(args)) return undefined;
+	return args as Record<string, unknown>;
+}
+
+function stringField(record: Record<string, unknown> | undefined, key: string): string | undefined {
+	const value = record?.[key];
+	if (typeof value !== "string") return undefined;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : undefined;
+}
+
+function clip(value: string): string {
+	const cleaned = value
+		.replace(/[\u0000-\u001f\u007f]/g, " ")
+		.replace(/\s+/g, " ")
+		.trim();
+	if (cleaned.length <= TITLE_MAX) return cleaned;
+	return `${cleaned.slice(0, TITLE_MAX - 1)}…`;
+}
+
+function formatPr(value: unknown): string {
+	if (typeof value === "string" && value.trim()) return value.trim();
+	if (!Array.isArray(value)) return "the current pull request";
+	const parts = value.filter((item): item is string => typeof item === "string" && item.trim().length > 0);
+	return parts.length > 0 ? parts.join(", ") : "the current pull request";
+}
+
+export function githubOp(args: unknown): string | undefined {
+	const op = recordOf(args)?.op;
+	return typeof op === "string" ? op : undefined;
+}
+
+/** True only for a known read-only github op. Missing and unknown ops are not read-only. */
+export function isGithubReadOnlyArgs(args: unknown): boolean {
+	const op = githubOp(args);
+	return op !== undefined && GITHUB_READ_ONLY_OPS.has(op);
+}
+
+export function isGithubReadOnlyOp(op: string): boolean {
+	return GITHUB_READ_ONLY_OPS.has(op);
+}
+
+/**
+ * Approval summary for a side-effect github call. The PR body is omitted so a
+ * token pasted into `body` is not copied into the permission title.
+ */
+export function describeGithubSideEffect(args: unknown): string {
+	const record = recordOf(args);
+	const op = githubOp(args) ?? "";
+	if (op === "pr_push") {
+		const branch = stringField(record, "branch") ?? "the current branch";
+		const lease = record?.forceWithLease === true ? " with --force-with-lease" : "";
+		return clip(`Push ${branch} to its pull request branch${lease} using stored git credentials`);
+	}
+	if (op === "pr_checkout") {
+		const force = record?.force === true ? " and reset the local branch" : "";
+		return clip(
+			`Check out ${formatPr(record?.pr)} into ~/.gjc/wt, write branch git config, and may add a remote${force}`,
+		);
+	}
+	if (op === "pr_create") {
+		const repo = stringField(record, "repo") ?? "the current repository";
+		const head = stringField(record, "head") ?? "the current branch";
+		const base = stringField(record, "base") ?? "the default base";
+		return clip(`Create a pull request on ${repo} from ${head} into ${base} with gh`);
+	}
+	return "Run a github operation that is not read-only";
+}
+
+export function githubPermissionIntent(
+	args: unknown,
+): { toolName: string; title: string; cacheKey: string } | undefined {
+	if (isGithubReadOnlyArgs(args)) return undefined;
+	const op = githubOp(args);
+	const cacheOp = op && GITHUB_SIDE_EFFECT_OPS.has(op) ? op : "unspecified";
+	return {
+		toolName: "github",
+		title: describeGithubSideEffect(args),
+		cacheKey: `github:${cacheOp}`,
+	};
+}

package/src/tools/image-gen.ts

@@ -1273,7 +1273,7 @@ function buildOpenAIImageHeaders(model: Model, apiKey: string, sessionId: string
 		headers.set(OPENAI_HEADERS.ORIGINATOR, OPENAI_HEADER_VALUES.ORIGINATOR_CODEX);
 		headers.set(
 			"User-Agent",
-			`pi/${packageJson.version} (${sanitizeHeaderComponent(os.platform())} ${sanitizeHeaderComponent(os.release())}; ${sanitizeHeaderComponent(os.arch())})`,
+			`${OPENAI_HEADER_VALUES.ORIGINATOR_CODEX}/${packageJson.version} (${sanitizeHeaderComponent(os.platform())} ${sanitizeHeaderComponent(os.release())}; ${sanitizeHeaderComponent(os.arch())})`,
 		);
 		if (sessionId) {
 			headers.set(OPENAI_HEADERS.CONVERSATION_ID, sessionId);

package/src/tools/index.ts

@@ -19,6 +19,7 @@ import type { ArtifactManager } from "../session/artifacts";
 import type { ClientBridge } from "../session/client-bridge";
 import type { FoldAdapter } from "../session/fold-coordinator";
 import type { CustomMessage } from "../session/messages";
+import type { SessionArtifactPublication } from "../session/session-manager";
 import type { ToolChoiceQueue } from "../session/tool-choice-queue";
 import type { SkillActiveEntry } from "../skill-state/active-state";
 import type { AgentOutputManager } from "../task/output-manager";
@@ -308,6 +309,8 @@ export interface ToolSession {
 	registerSessionCleanup?: (cleanup: () => Promise<void> | void) => () => void;
 	/** Allocate a new artifact path and ID for session-scoped truncated output. */
 	allocateOutputArtifact?: (toolType: string) => Promise<{ id?: string; path?: string }>;
+	/** Capture owner-bound artifact publication authority for one session lifecycle. */
+	captureArtifactPublication?: () => SessionArtifactPublication;
 	/** Get session spawns */
 	getSessionSpawns: () => string | null;
 	/** Get resolved model string if explicitly set for this session */

package/src/tools/monitor-mutation.ts

@@ -0,0 +1,27 @@
+import type { AgentTool } from "@gajae-code/agent-core";
+import { assertWorkflowMutationAllowed } from "../skill-state/workflow-mutation-guard";
+
+const bashShapedTool = {
+	name: "bash",
+	label: "bash",
+	description: "bash",
+	parameters: {},
+	execute: async () => ({ content: [] }),
+} as AgentTool;
+
+/**
+ * Judge a monitor command with the same mutation rules as bash. Monitor is a
+ * background shell, so a planning-phase mutation must fail before the job starts.
+ */
+export async function assertMonitorMutationAllowed(input: {
+	cwd: string;
+	sessionId?: string;
+	command: string;
+}): Promise<void> {
+	await assertWorkflowMutationAllowed({
+		cwd: input.cwd,
+		sessionId: input.sessionId,
+		tool: bashShapedTool,
+		args: { command: input.command },
+	});
+}

package/src/tools/monitor.ts

@@ -7,6 +7,7 @@ import { truncateTail } from "../session/streaming-output";
 import { lookupOwnedRegistration } from "../session/terminal-abort";
 import { BashTool } from "./bash";
 import type { ToolSession } from "./index";
+import { assertMonitorMutationAllowed } from "./monitor-mutation";
 import { ToolError } from "./tool-errors";
 import { TOOL_TIMEOUTS } from "./tool-timeouts";
 
@@ -137,6 +138,12 @@ export class MonitorTool implements AgentTool<typeof monitorSchema, MonitorToolD
 			throw new ToolError("Async execution is disabled; the monitor tool is unavailable in this session.");
 		}
 
+		await assertMonitorMutationAllowed({
+			cwd: this.session.cwd,
+			sessionId: this.session.getSessionId?.() ?? undefined,
+			command: params.command,
+		});
+
 		const persistent = params.persistent ?? false;
 		const label = buildMonitorLabel(params);
 		const ownerId = this.session.getAgentId?.() ?? undefined;