@gajae-code/coding-agent 0.18.7 → 0.18.9

package/src/tools/python.ts

@@ -22,12 +22,20 @@ export function pythonKernelOwnerId(sessionId: string): string {
 export interface SessionPythonToolInput {
 	/** Working directory for kernel execution (session cwd). */
 	cwd: string;
+	/** Resolve the current working directory for each admitted invocation. */
+	getCwd?: () => string;
 	/** Session settings used for Python runtime policy. */
 	settings?: SettingsType;
+	/** Resolve the session file associated with each admitted invocation. */
+	getSessionFile?: () => string | null;
 	/** Resolve the GJC session id used for the kernel owner and transcript paths. */
 	getSessionId: () => string | null;
 	/** Register cleanup with the current logical session lifecycle. */
-	registerSessionCleanup: (cleanup: () => Promise<void> | void) => void;
+	registerSessionCleanup: (cleanup: () => Promise<void> | void) => (() => void) | void;
+	/** Reject execution after the owning session has begun disposal. */
+	assertEvalExecutionAllowed?: () => void;
+	/** Track this whole invocation through its transcript append. */
+	trackEvalExecution?: <T>(execution: Promise<T>, abortController: AbortController) => Promise<T>;
 }
 
 const paramsSchema = z.object({
@@ -52,6 +60,25 @@ interface TranscriptExecutionResult {
 	truncated: boolean;
 }
 
+interface PythonGeneration {
+	readonly sessionId: string;
+	readonly ownerId: string;
+	readonly abortControllers: Set<AbortController>;
+	readonly completions: Set<Promise<void>>;
+	readonly transcripts: Map<string, PythonKernelTranscript>;
+	unregisterCleanup?: () => void;
+	cleanupPromise?: Promise<void>;
+}
+
+interface PythonInvocationContext {
+	readonly cwd: string;
+	readonly sessionFile: string | null;
+	readonly sessionId: string;
+	readonly ownerId: string;
+	readonly settings: SettingsType;
+	readonly generation: PythonGeneration;
+}
+
 function errorMessage(error: unknown): string {
 	return error instanceof Error ? error.message : String(error);
 }
@@ -71,33 +98,87 @@ function appendFailureTrailer(output: string, appendFailure: string | undefined)
 }
 
 export function createSessionPythonTool(input: SessionPythonToolInput): AgentTool {
-	let armedForSession: string | null = null;
-	const seenOwnerIds = new Set<string>();
-	let currentTranscript: PythonKernelTranscript | null = null;
-
-	const armCleanupForSession = (sessionId: string): void => {
-		if (armedForSession === sessionId) return;
-		input.registerSessionCleanup(async () => {
-			await Promise.all([...seenOwnerIds].map(ownerId => disposeKernelSessionsByOwner(ownerId)));
-			seenOwnerIds.clear();
-			currentTranscript = null;
-			armedForSession = null;
+	const activeGenerations = new Map<string, PythonGeneration>();
+
+	const transcriptFor = (
+		generation: PythonGeneration,
+		context: Pick<PythonInvocationContext, "cwd" | "sessionId">,
+		kernelInstanceId: string,
+	): PythonKernelTranscript => {
+		const key = JSON.stringify([context.cwd, context.sessionId, kernelInstanceId]);
+		let transcript = generation.transcripts.get(key);
+		if (!transcript) {
+			transcript = openPythonKernelTranscript({
+				cwd: context.cwd,
+				sessionId: context.sessionId,
+				kernelInstanceId,
+			});
+			generation.transcripts.set(key, transcript);
+		}
+		return transcript;
+	};
+
+	const retireGeneration = (generation: PythonGeneration): Promise<void> => {
+		if (generation.cleanupPromise) return generation.cleanupPromise;
+		const cleanup = Promise.withResolvers<void>();
+		generation.cleanupPromise = cleanup.promise;
+		const completions = [...generation.completions];
+		const controllers = [...generation.abortControllers];
+		if (activeGenerations.get(generation.sessionId) === generation) {
+			activeGenerations.delete(generation.sessionId);
+		}
+
+		let ownerCleanup: Promise<void>;
+		try {
+			// Core registers pending operations by this existing owner label before
+			// availability work begins, so this synchronous call also captures work
+			// that has not acquired a kernel yet.
+			ownerCleanup = disposeKernelSessionsByOwner(generation.ownerId);
+		} catch (error) {
+			ownerCleanup = Promise.reject(error);
+		}
+		for (const controller of controllers) controller.abort();
+		void (async () => {
+			const results = await Promise.allSettled([ownerCleanup, ...completions]);
+			const coreResult = results[0]!;
+			if (coreResult.status === "rejected") throw coreResult.reason;
+			generation.unregisterCleanup?.();
+			generation.unregisterCleanup = undefined;
+			generation.transcripts.clear();
+		})().then(cleanup.resolve, error => {
+			if (generation.cleanupPromise === cleanup.promise) generation.cleanupPromise = undefined;
+			cleanup.reject(error);
 		});
-		armedForSession = sessionId;
+		return cleanup.promise;
+	};
+
+	const generationFor = (sessionId: string): PythonGeneration => {
+		const current = activeGenerations.get(sessionId);
+		if (current) return current;
+		const generation: PythonGeneration = {
+			sessionId,
+			ownerId: pythonKernelOwnerId(sessionId),
+			abortControllers: new Set(),
+			completions: new Set(),
+			transcripts: new Map(),
+		};
+		activeGenerations.set(sessionId, generation);
+		try {
+			const unregister = input.registerSessionCleanup(() => retireGeneration(generation));
+			if (typeof unregister === "function") generation.unregisterCleanup = unregister;
+		} catch (error) {
+			activeGenerations.delete(sessionId);
+			throw error;
+		}
+		return generation;
 	};
 
 	const appendTranscript = async (
-		sessionId: string,
+		context: PythonInvocationContext,
+		transcript: PythonKernelTranscript | undefined,
 		code: string,
 		result: TranscriptExecutionResult,
 	): Promise<string | undefined> => {
-		if (currentTranscript === null) {
-			currentTranscript = openPythonKernelTranscript({
-				cwd: input.cwd,
-				sessionId,
-				kernelInstanceId: crypto.randomUUID(),
-			});
-		}
 		const record: PythonTranscriptRecord = {
 			timestamp: new Date().toISOString(),
 			code,
@@ -107,11 +188,12 @@ export function createSessionPythonTool(input: SessionPythonToolInput): AgentToo
 			truncated: result.truncated,
 		};
 		try {
-			await currentTranscript.append(record);
+			const target = transcript ?? transcriptFor(context.generation, context, crypto.randomUUID());
+			await target.append(record);
 			return undefined;
 		} catch (error) {
 			const message = errorMessage(error);
-			logger.warn("Python transcript append failed", { sessionId, error: message });
+			logger.warn("Python transcript append failed", { sessionId: context.sessionId, error: message });
 			return message;
 		}
 	};
@@ -135,11 +217,9 @@ export function createSessionPythonTool(input: SessionPythonToolInput): AgentToo
 					isError: true,
 				};
 			}
-			armCleanupForSession(sessionId);
-			const ownerId = pythonKernelOwnerId(sessionId);
 			if (params.action === "clear") {
-				await disposeKernelSessionsByOwner(ownerId);
-				currentTranscript = null;
+				const generation = generationFor(sessionId);
+				await retireGeneration(generation);
 				return {
 					content: [{ type: "text", text: "Python kernel cleared; the next execute starts a fresh kernel." }],
 				};
@@ -152,48 +232,90 @@ export function createSessionPythonTool(input: SessionPythonToolInput): AgentToo
 				};
 			}
 
-			seenOwnerIds.add(ownerId);
-			try {
-				const activeSettings = input.settings ?? Settings.instance;
-				const result = await executePython(code, {
-					cwd: input.cwd,
-					settings: activeSettings,
-					kernelMode: "session",
-					sessionId: ownerId,
-					kernelOwnerId: ownerId,
-					artifactsDir: sessionIpykernelsArtifactsDir(input.cwd, sessionId),
-					signal,
-					onKernelStart: kernelInstanceId => {
-						if (currentTranscript?.kernelInstanceId !== kernelInstanceId) {
-							currentTranscript = openPythonKernelTranscript({
-								cwd: input.cwd,
-								sessionId,
-								kernelInstanceId,
-							});
-						}
-					},
-				});
-				const appendFailure = await appendTranscript(sessionId, code, {
-					output: result.output,
-					exitCode: result.exitCode ?? null,
-					cancelled: result.cancelled,
-					truncated: result.truncated,
+			const cwd = input.getCwd?.() ?? input.cwd;
+			const sessionFile = input.getSessionFile?.() ?? null;
+			const settings = input.settings ?? Settings.instance;
+			input.assertEvalExecutionAllowed?.();
+			const contextGeneration = generationFor(sessionId);
+			const context: PythonInvocationContext = {
+				cwd,
+				sessionFile,
+				sessionId,
+				ownerId: contextGeneration.ownerId,
+				settings,
+				generation: contextGeneration,
+			};
+			const abortController = new AbortController();
+			const abortFromCaller = (): void => abortController.abort(signal?.reason);
+			if (signal?.aborted) abortFromCaller();
+			else signal?.addEventListener("abort", abortFromCaller, { once: true });
+			contextGeneration.abortControllers.add(abortController);
+
+			let trackingAccepted = false;
+			const execution = Promise.resolve()
+				.then(async (): Promise<AgentToolResult> => {
+					if (!trackingAccepted) throw new Error("Python execution was not admitted by its owning session.");
+					input.assertEvalExecutionAllowed?.();
+					let transcript: PythonKernelTranscript | undefined;
+					try {
+						const result = await executePython(code, {
+							cwd: context.cwd,
+							settings: context.settings,
+							sessionFile: context.sessionFile ?? undefined,
+							kernelMode: "session",
+							sessionId: context.ownerId,
+							kernelOwnerId: context.ownerId,
+							artifactsDir: sessionIpykernelsArtifactsDir(context.cwd, context.sessionId),
+							signal: abortController.signal,
+							onKernelStart: kernelInstanceId => {
+								transcript = transcriptFor(context.generation, context, kernelInstanceId);
+							},
+						});
+						const appendFailure = await appendTranscript(context, transcript, code, {
+							output: result.output,
+							exitCode: result.exitCode ?? null,
+							cancelled: result.cancelled,
+							truncated: result.truncated,
+						});
+						const output = result.output.length > 0 ? result.output : "(no output)";
+						return { content: [{ type: "text", text: appendFailureTrailer(output, appendFailure) }] };
+					} catch (error) {
+						const output = errorMessage(error);
+						const appendFailure = await appendTranscript(context, transcript, code, {
+							output,
+							exitCode: null,
+							cancelled: isCancellationError(error, abortController.signal),
+							truncated: false,
+						});
+						return {
+							content: [{ type: "text", text: appendFailureTrailer(output, appendFailure) }],
+							isError: true,
+						};
+					}
+				})
+				.finally(() => {
+					signal?.removeEventListener("abort", abortFromCaller);
+					contextGeneration.abortControllers.delete(abortController);
 				});
-				const output = result.output.length > 0 ? result.output : "(no output)";
-				return { content: [{ type: "text", text: appendFailureTrailer(output, appendFailure) }] };
+			const settled = execution.then(
+				() => {},
+				() => {},
+			);
+			contextGeneration.completions.add(settled);
+			void settled.then(() => contextGeneration.completions.delete(settled));
+
+			let completion: Promise<AgentToolResult>;
+			try {
+				completion = input.trackEvalExecution ? input.trackEvalExecution(execution, abortController) : execution;
+				trackingAccepted = true;
 			} catch (error) {
-				const output = errorMessage(error);
-				const appendFailure = await appendTranscript(sessionId, code, {
-					output,
-					exitCode: null,
-					cancelled: isCancellationError(error, signal),
-					truncated: false,
-				});
-				return {
-					content: [{ type: "text", text: appendFailureTrailer(output, appendFailure) }],
-					isError: true,
-				};
+				abortController.abort(error);
+				signal?.removeEventListener("abort", abortFromCaller);
+				contextGeneration.abortControllers.delete(abortController);
+				void execution.catch(() => {});
+				throw error;
 			}
+			return await completion;
 		},
 	};
 	const agentTool = {

package/src/tools/recipe/index.ts

@@ -7,6 +7,7 @@ import type { Theme } from "../../modes/theme/theme";
 import recipeDescription from "../../prompts/tools/recipe.md" with { type: "text" };
 import type { ToolSession } from "..";
 import { type BashRenderContext, BashTool, type BashToolDetails } from "../bash";
+import { assertRecipeCommandAllowed } from "./recipe-guard";
 import { createRecipeToolRenderer, type RecipeRenderArgs } from "./render";
 import { buildPromptModel, type DetectedRunner, resolveCommand } from "./runner";
 import { RUNNERS } from "./runners";
@@ -48,8 +49,10 @@ export class RecipeTool implements AgentTool<typeof recipeSchema, BashToolDetail
 
 	readonly #bash: BashTool;
 	readonly #runners: DetectedRunner[];
+	readonly #session: ToolSession;
 
 	constructor(session: ToolSession, runners: DetectedRunner[]) {
+		this.#session = session;
 		this.#runners = runners;
 		this.#bash = new BashTool(session);
 		this.description = prompt.render(recipeDescription, buildPromptModel(runners));
@@ -75,6 +78,12 @@ export class RecipeTool implements AgentTool<typeof recipeSchema, BashToolDetail
 		ctx?: AgentToolContext,
 	): Promise<AgentToolResult<BashToolDetails>> {
 		const { command, cwd } = resolveCommand(op, this.#runners);
+		await assertRecipeCommandAllowed({
+			cwd: this.#session.cwd,
+			sessionId: this.#session.getSessionId?.() ?? undefined,
+			command,
+			commandCwd: cwd,
+		});
 		return await this.#bash.execute(toolCallId, { command, cwd }, signal, onUpdate, ctx);
 	}
 }

package/src/tools/recipe/recipe-guard.ts

@@ -0,0 +1,19 @@
+import type { AgentTool } from "@gajae-code/agent-core";
+import { assertWorkflowMutationAllowed } from "../../skill-state/workflow-mutation-guard";
+
+const BASH_GUARD_TOOL = { name: "bash" } as AgentTool;
+
+/** Apply the session bash planning guard to a recipe command before it runs. */
+export async function assertRecipeCommandAllowed(input: {
+	cwd: string;
+	sessionId?: string;
+	command: string;
+	commandCwd?: string;
+}): Promise<void> {
+	await assertWorkflowMutationAllowed({
+		cwd: input.cwd,
+		sessionId: input.sessionId,
+		tool: BASH_GUARD_TOOL,
+		args: { command: input.command, cwd: input.commandCwd },
+	});
+}

package/src/tools/restricted-cwd.ts

@@ -0,0 +1,10 @@
+import * as fs from "node:fs/promises";
+import path from "node:path";
+
+export async function assertCwdInsideWorkspace(workspace: string, commandCwd: string): Promise<void> {
+	const realWorkspace = await fs.realpath(workspace);
+	const realCwd = await fs.realpath(commandCwd);
+	if (realCwd !== realWorkspace && !realCwd.startsWith(`${realWorkspace}${path.sep}`)) {
+		throw new Error("restricted bash cwd must stay inside the workspace");
+	}
+}

package/src/tools/skill-discovery.ts

@@ -1,6 +1,7 @@
 import type { AgentTool, AgentToolResult } from "@gajae-code/agent-core";
 import { prompt, untilAborted } from "@gajae-code/utils";
 import * as z from "zod/v4";
+import { resolveGlobalUserSkillLinkTrust } from "../config/skill-settings-defaults";
 import {
 	describeDisabledSkillScopes,
 	describeNoSkillMatch,
@@ -93,6 +94,10 @@ export class SkillDiscoveryTool implements AgentTool<typeof skillDiscoverySchema
 				source,
 				limit: input.limit,
 				policy: this.#getRuntimeSkillPolicy(),
+				allowExternalUserSkillSymlinks: resolveGlobalUserSkillLinkTrust({
+					trustUserSkills: this.#session.settings.getGlobal("skills.trustUserSkills"),
+					enablePiUser: this.#session.settings.getGlobal("skills.enablePiUser"),
+				}),
 			});
 			const details: SkillDiscoveryToolDetails = {
 				candidates: result.candidates,

package/src/tools/skill.ts

@@ -24,10 +24,15 @@
 import type { AgentTool, AgentToolResult } from "@gajae-code/agent-core";
 import { prompt, untilAborted } from "@gajae-code/utils";
 import * as z from "zod/v4";
+import { resolveGlobalUserSkillLinkTrust } from "../config/skill-settings-defaults";
 import { resolveSubskillActivationForSkillInvocation } from "../extensibility/gjc-plugins";
 import { findRuntimeSkillByName } from "../extensibility/runtime-skill-discovery";
 import { buildSkillPromptMessage } from "../extensibility/skills";
-import { runNativeStateCommand } from "../gjc-runtime/state-runtime";
+import {
+	executionApprovalLineage,
+	hasSanctionedRalplanFinalAdmissionForHandoff,
+	runNativeStateCommand,
+} from "../gjc-runtime/state-runtime";
 import { getSkillManifest } from "../gjc-runtime/workflow-manifest";
 import skillDescription from "../prompts/tools/skill.md" with { type: "text" };
 import { SKILL_PROMPT_MESSAGE_TYPE } from "../session/messages";
@@ -187,6 +192,10 @@ export class SkillTool implements AgentTool<typeof skillSchema, SkillToolDetails
 					this.#session.home,
 					agentDir,
 					this.#session.profileAuthority,
+					resolveGlobalUserSkillLinkTrust({
+						trustUserSkills: this.#session.settings.getGlobal("skills.trustUserSkills"),
+						enablePiUser: this.#session.settings.getGlobal("skills.enablePiUser"),
+					}),
 				));
 			if (!skill) {
 				const available = formatAvailableSkills(skills);
@@ -209,6 +218,24 @@ export class SkillTool implements AgentTool<typeof skillSchema, SkillToolDetails
 				}
 				const cwd = this.#session.cwd;
 				const sessionId = activeState?.session_id?.trim();
+				if (activeSkill === "ralplan" && requestedName === "ultragoal") {
+					if (!sessionId) {
+						throw new ToolError("skill tool: Ralplan to Ultragoal handoff requires a session id");
+					}
+					if (!(await hasSanctionedRalplanFinalAdmissionForHandoff(this.#session.cwd, sessionId))) {
+						const lineage = await executionApprovalLineage(this.#session.cwd, sessionId, "ralplan");
+						const approvalMode = lineage === "crystal" ? "deep-interview" : "ralplan";
+						const approval = await runNativeStateCommand(
+							["approve-execution", "--mode", approvalMode, "--session-id", sessionId, "--json"],
+							this.#session.cwd,
+						);
+						if (approval.status !== 0) {
+							throw new ToolError(
+								`skill tool: Ralplan execution approval failed (status=${approval.status}): ${(approval.stderr ?? "").trim() || "no detail"}`,
+							);
+						}
+					}
+				}
 				const handoffArgs = ["handoff", "--mode", activeSkill, "--to", requestedName, "--json"];
 				if (sessionId) {
 					handoffArgs.push("--session-id", sessionId);

package/src/tools/todo-write.ts

@@ -135,6 +135,15 @@ function normalizeInProgressTask(phases: TodoPhase[]): void {
 export const USER_TODO_EDIT_CUSTOM_TYPE = "user_todo_edit";
 
 export function getLatestTodoPhasesFromEntries(entries: SessionEntry[]): TodoPhase[] {
+	return findLatestTodoPhasesFromEntries(entries) ?? [];
+}
+
+/**
+ * Latest persisted todo list on the branch, terminal items included. `undefined`
+ * means no todo state was ever persisted; an empty array is an authoritative
+ * empty list (for example after a bare `/todo rm`).
+ */
+export function findLatestTodoPhasesFromEntries(entries: SessionEntry[]): TodoPhase[] | undefined {
 	for (let i = entries.length - 1; i >= 0; i--) {
 		const entry = entries[i];
 		if (entry.type === "custom" && entry.customType === USER_TODO_EDIT_CUSTOM_TYPE) {
@@ -154,7 +163,7 @@ export function getLatestTodoPhasesFromEntries(entries: SessionEntry[]): TodoPha
 		return clonePhases(details.phases as TodoPhase[]);
 	}
 
-	return [];
+	return undefined;
 }
 
 function resolveTaskOrError(

package/src/tools/tool-catalog.generated.ts

@@ -2783,7 +2783,7 @@ export const TOOL_CATALOG: Readonly<Record<string, ToolCatalogEntry>> = {
 	"skill_discovery": {
 		"name": "skill_discovery",
 		"label": "SkillDiscovery",
-		"description": "Discover bundled GJC workflow, project, and user runtime skills without loading full skill content.\n\n<instruction>\n- Includes the four bundled GJC workflow skills (`autoresearch`, `deep-interview`, `ralplan`, `ultragoal`) as `source: \"bundled\"` candidates from the generated bundled catalog; they are always available, cannot be replaced by filesystem copies, and are included for `source: \"all\"` but excluded by explicit `source: \"project\"`/`\"user\"` requests.\n- Returns thin metadata only: name, description, source scope, path, and use conditions when present. Bundled paths are stable catalog identifiers, not filesystem paths.\n- In trusted Git projects, `.gjc/skills` may be a symlink to a directory inside the same repository (for example `../.agents/skills`). Link and target identities remain checked through body loading; external targets and symlinked user/profile roots are refused. Do not replace a safe project link with copied files to make discovery work.\n- Claude Code (`.claude/skills`) and Codex (`.codex/skills`) layouts are explicit import sources into `.gjc`, never invokable candidates. They are not returned as candidates; instead, each convention skill found in a trusted scope is reported in `diagnostics` with the exact copy command that enables it (copy into `.gjc/skills`), so a skill placed in a documented convention location is discoverable in a normal session without being silently loaded.\n- Discovery is on by default in a normal session. `query` matching is conjunctive substring: every whitespace-separated term must appear in a skill's name, description, source, or use conditions, unless a term equals the exact skill name — one keyword that appears nowhere in the candidate's metadata drops every candidate, so query with exact names or few terms known to appear literally, not topic keyword lists. When zero candidates are returned, the result carries a `notice` if discovery config disabled a requested scope, a non-empty query filtered out scanned skills, or diagnostics explain observed skills that were skipped or filtered. Only an empty result without a `notice` means no skills were scanned and no diagnostics were produced; never report a zero-candidate result as proof no skill exists.\n- When skills were scanned but not advertised (protected-name collision with a bundled workflow skill, include/ignore/disable policy filters, invalid frontmatter, shadowing), the result carries a bounded `diagnostics` list explaining why.\n- To load a selected skill's full `SKILL.md`, invoke it through the existing `skill` tool with the exact `name` returned here.\n</instruction>\n\nInput:\n- `query` (optional): words to match against skill name, description, source, or use conditions. Every term must appear (conjunctive substring), or one term must equal the exact skill name.\n- `source` (optional): `all`, `project`, or `user`.\n- `limit` (optional): maximum results, 1-50.",
+		"description": "Discover bundled GJC workflow, project, and user runtime skills without loading full skill content.\n\n<instruction>\n- Includes the four bundled GJC workflow skills (`autoresearch`, `deep-interview`, `ralplan`, `ultragoal`) as `source: \"bundled\"` candidates from the generated bundled catalog; they are always available, cannot be replaced by filesystem copies, and are included for `source: \"all\"` but excluded by explicit `source: \"project\"`/`\"user\"` requests.\n- Returns thin metadata only: name, description, source scope, path, and use conditions when present. Bundled paths are stable catalog identifiers, not filesystem paths.\n- In trusted Git projects, `.gjc/skills` may be a symlink to a directory inside the same repository (for example `../.agents/skills`). Project link and target identities remain checked through body loading; external project targets are refused. An individual user-scope skill symlink inside `~/.gjc/agent/skills` or a configured custom directory may resolve outside its scan root when user/global `skills.trustUserSkills` is enabled; project settings cannot grant this permission. Its link and target identities remain checked through body loading. Symlinked user/profile authority roots remain refused. Do not replace a safe project link with copied files to make discovery work.\n- Claude Code (`.claude/skills`) and Codex (`.codex/skills`) layouts are explicit import sources into `.gjc`, never invokable candidates. They are not returned as candidates; instead, each convention skill found in a trusted scope is reported in `diagnostics` with the exact copy command that enables it (copy into `.gjc/skills`), so a skill placed in a documented convention location is discoverable in a normal session without being silently loaded.\n- Discovery is on by default in a normal session. `query` matching is conjunctive substring: every whitespace-separated term must appear in a skill's name, description, source, or use conditions, unless a term equals the exact skill name — one keyword that appears nowhere in the candidate's metadata drops every candidate, so query with exact names or few terms known to appear literally, not topic keyword lists. When zero candidates are returned, the result carries a `notice` if discovery config disabled a requested scope, a non-empty query filtered out scanned skills, or diagnostics explain observed skills that were skipped or filtered. Only an empty result without a `notice` means no skills were scanned and no diagnostics were produced; never report a zero-candidate result as proof no skill exists.\n- When skills were scanned but not advertised (protected-name collision with a bundled workflow skill, include/ignore/disable policy filters, invalid frontmatter, shadowing), the result carries a bounded `diagnostics` list explaining why.\n- To load a selected skill's full `SKILL.md`, invoke it through the existing `skill` tool with the exact `name` returned here.\n</instruction>\n\nInput:\n- `query` (optional): words to match against skill name, description, source, or use conditions. Every term must appear (conjunctive substring), or one term must equal the exact skill name.\n- `source` (optional): `all`, `project`, or `user`.\n- `limit` (optional): maximum results, 1-50.",
 		"parameters": {
 			"type": "object",
 			"properties": {

package/src/tools/write.ts

@@ -462,6 +462,7 @@ export class WriteTool implements AgentTool<typeof writeSchema, WriteToolDetails
 		context: AgentToolContext | undefined,
 	): Promise<AgentToolResult<WriteToolDetails>> {
 		const absolutePath = entry.absolutePath;
+		enforcePlanModeWrite(this.session, absolutePath, { op: "update" });
 		if (!(await fs.exists(absolutePath))) {
 			throw new ToolError(`Conflict #${entry.id} target '${entry.displayPath}' no longer exists.`);
 		}

package/src/utils/external-editor.ts

@@ -6,11 +6,12 @@ import { spawn } from "node:child_process";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
-import { $env, Snowflake } from "@gajae-code/utils";
+import { $pickCredentialEnv, Snowflake } from "@gajae-code/utils";
 
 /** Returns the user's preferred editor command, or undefined if not configured. */
 export function getEditorCommand(): string | undefined {
-	return $env.VISUAL || $env.EDITOR || undefined;
+	// The editor is executed, so a repository `.env` must not be able to choose it.
+	return $pickCredentialEnv("VISUAL", "EDITOR");
 }
 
 export interface OpenInEditorOptions {

package/src/utils/tools-checksum.ts

@@ -0,0 +1,34 @@
+import { createHash } from "node:crypto";
+import * as fs from "node:fs/promises";
+
+const SHA256_DIGEST_RE = /^sha256:([a-fA-F0-9]{64})$/;
+
+export interface ReleaseAssetDigest {
+	name?: string;
+	digest?: string | null;
+}
+
+export function sha256FromReleaseDigest(digest: string | null | undefined): string | null {
+	if (typeof digest !== "string") return null;
+	const match = SHA256_DIGEST_RE.exec(digest.trim());
+	return match ? match[1].toLowerCase() : null;
+}
+
+export function requireAssetSha256(assets: readonly ReleaseAssetDigest[], assetName: string): string {
+	const asset = assets.find(entry => entry.name === assetName);
+	const sha256 = sha256FromReleaseDigest(asset?.digest);
+	if (!sha256) {
+		throw new Error(`Release asset ${assetName} has no sha256 digest; refusing to install an unverified binary`);
+	}
+	return sha256;
+}
+
+export async function assertFileMatchesSha256(filePath: string, expectedSha256: string): Promise<void> {
+	const actual = createHash("sha256")
+		.update(await fs.readFile(filePath))
+		.digest("hex");
+	if (actual !== expectedSha256.toLowerCase()) {
+		await fs.rm(filePath, { force: true });
+		throw new Error(`Checksum mismatch for ${filePath}`);
+	}
+}

package/src/utils/tools-manager.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { $which, APP_NAME, getToolsDir, logger, ptree, TempDir } from "@gajae-code/utils";
+import { assertFileMatchesSha256, requireAssetSha256 } from "./tools-checksum";
 
 const TOOLS_DIR = getToolsDir();
 const TOOL_DOWNLOAD_TIMEOUT_MS = 120_000;
@@ -112,8 +113,18 @@ export function getToolPath(tool: ToolName): string | null {
 	return $which(config.binaryName);
 }
 
-// Fetch latest release version from GitHub
-async function getLatestVersion(repo: string, signal?: AbortSignal): Promise<string> {
+interface GithubReleaseAsset {
+	name?: string;
+	digest?: string | null;
+}
+
+interface GithubRelease {
+	version: string;
+	assets: GithubReleaseAsset[];
+}
+
+// Fetch latest release metadata from GitHub, including asset digests.
+async function getLatestRelease(repo: string, signal?: AbortSignal): Promise<GithubRelease> {
 	let response: Response;
 	try {
 		response = await fetch(`https://api.github.com/repos/${repo}/releases/latest`, {
@@ -131,8 +142,11 @@ async function getLatestVersion(repo: string, signal?: AbortSignal): Promise<str
 		throw new Error(`GitHub API error: ${response.status}`);
 	}
 
-	const data = (await response.json()) as { tag_name: string };
-	return data.tag_name.replace(/^v/, "");
+	const data = (await response.json()) as { tag_name?: string; assets?: GithubReleaseAsset[] };
+	if (!data.tag_name) {
+		throw new Error("GitHub API error: missing tag_name");
+	}
+	return { version: data.tag_name.replace(/^v/, ""), assets: data.assets ?? [] };
 }
 
 // Download a file from URL
@@ -164,14 +178,16 @@ async function downloadTool(tool: ToolName, signal?: AbortSignal): Promise<strin
 	const plat = os.platform();
 	const architecture = os.arch();
 
-	// Get latest version
-	const version = await getLatestVersion(config.repo, signal);
+	// Get latest version and the published digest for this asset.
+	const release = await getLatestRelease(config.repo, signal);
+	const version = release.version;
 
 	// Get asset name for this platform
 	const assetName = config.getAssetName(version, plat, architecture);
 	if (!assetName) {
 		throw new Error(`Unsupported platform: ${plat}/${architecture}`);
 	}
+	const expectedSha256 = requireAssetSha256(release.assets, assetName);
 
 	// Create tools directory
 	await fs.promises.mkdir(TOOLS_DIR, { recursive: true });
@@ -183,6 +199,7 @@ async function downloadTool(tool: ToolName, signal?: AbortSignal): Promise<strin
 	// Handle direct binary downloads (no archive extraction needed)
 	if (config.isDirectBinary) {
 		await downloadFile(downloadUrl, binaryPath, signal);
+		await assertFileMatchesSha256(binaryPath, expectedSha256);
 		if (plat !== "win32") {
 			await fs.promises.chmod(binaryPath, 0o755);
 		}
@@ -192,6 +209,7 @@ async function downloadTool(tool: ToolName, signal?: AbortSignal): Promise<strin
 	// Download archive
 	const archivePath = path.join(TOOLS_DIR, assetName);
 	await downloadFile(downloadUrl, archivePath, signal);
+	await assertFileMatchesSha256(archivePath, expectedSha256);
 
 	// Extract
 	const tmp = await TempDir.create("@gjc-tools-extract-");

package/src/web/insane/url-guard.ts

@@ -74,7 +74,7 @@ function isBlockedHostname(hostname: string): boolean {
 function isPrivateIPv4(address: string): boolean {
 	const parts = address.split(".").map(part => Number.parseInt(part, 10));
 	if (parts.length !== 4 || parts.some(part => !Number.isInteger(part) || part < 0 || part > 255)) return true;
-	const [a, b] = parts;
+	const [a, b, c] = parts;
 	return (
 		a === 0 || // unspecified / "this network"
 		a === 10 || // RFC1918
@@ -83,6 +83,7 @@ function isPrivateIPv4(address: string): boolean {
 		(a === 169 && b === 254) || // link-local
 		(a === 172 && b >= 16 && b <= 31) || // RFC1918
 		(a === 192 && b === 0) || // 192.0.0/24 & 192.0.2/24 (documentation/reserved)
+		(a === 192 && b === 88 && c === 99) || // 192.88.99.0/24 deprecated 6to4 anycast; 192.88.99.2/32 is not globally reachable
 		(a === 192 && b === 168) || // RFC1918
 		(a === 198 && (b === 18 || b === 19)) || // benchmarking 198.18/15
 		(a === 198 && b === 51) || // 198.51.100/24 documentation