@gajae-code/coding-agent 0.18.8 → 0.18.10

package/CHANGELOG.md

@@ -2,6 +2,106 @@
 
 ## [Unreleased]
 
+## [0.18.10] - 2026-10-12
+
+## [0.18.9] - 2026-10-11
+
+### Added
+
+- Added attach-only SDK client mode: with `GJC_SDK_BROKER_AUTOSTART=0` or `--attach-only` (on `gjc sdk session`, `gjc sdk search`, `gjc sdk spawn` and `gjc mcp-serve`), every SDK client entry point (session CLI, search, spawn, SDK and coordinator MCP servers, ACP, session hosts) attaches only to a live, reusable broker and fails with `broker_unavailable` instead of spawning, retiring, or restarting one, so a supervisor-owned broker has a single owner. `gjc doctor` broker restart refuses with `attach_only_refused`, and the SDK broker restart script refuses before closing hosts or stopping the broker.
+
+- Added `gjc sdk broker run [--agent-dir <dir>]`, a stable foreground broker command for supervisors (systemd, launchd). It never detaches, stops gracefully on SIGTERM or SIGINT and exits with the signal status, exits 1 instead of serving when another live broker already owns the agent directory (never retiring it), and exits 1 if it loses its discovery root while serving.
+
+### Fixed
+
+- Prevented deferred startup profile recovery from replacing newer model or role selections during credential refresh or settings flush; rejected model selections no longer cancel recovery, and canceled recovery restores session-owned alias and fallback state (#6380).
+
+- Match Windows session paths by filesystem identity without rewriting canonical paths or conflating distinct case-sensitive files. Managed-root containment canonicalizes aliases above the root and rejects symlink components below it.
+- Reject managed descendant symlinks before canonicalizing paths, preventing a replaced scope directory from redirecting access to a sibling session.
+- Keep native-backed endpoint key derivation out of the broadly imported async barrel so idle startup does not load path identity bindings.
+
+- The Bash tool now counts characters instead of UTF-8 bytes for `${#var}`, so negative substring offsets such as `${var: -2}` select the right characters in non-ASCII values (#6544).
+- A negative substring length now marks where the slice ends, as in bash (`${v:2:-2}` on `abcdefgh` is `cdef`), and an end before the offset or a negative length on an array fails with `substring expression < 0` instead of slicing the wrong range.
+
+- `ast_edit` apply refuses auto-generated files when that edit guard is on, the same as write and vim.
+
+- `ast_edit` apply checks the real write path and the original preview path, so a directory symlink such as `src` → `.gjc` cannot bypass the `.gjc/**` block, and a `.gjc` directory that points at another in-workspace directory stays blocked.
+
+- Enroll async-job delivery and loop completion futures before callbacks and change notifications so drains and bounded disposal cannot mistake in-flight work for settled delivery.
+
+- Contain rejections from `async` agent-session event subscribers, so a failed subscriber write (for example the `managed_append_identity_mismatch` fence after another process resumed the same session) is logged instead of terminating the interactive process with an unhandled rejection.
+
+- `app.cdp_url` is refused unless its host is loopback.
+
+- Debug adapter lookup uses the same trusted `$PATH` rule as LSP auto-detection, so a repository `bin/`, `node_modules/.bin`, or virtualenv binary is no longer spawned as a debugger.
+
+- Managed-session descriptor preflight and bounded range reads now preserve their original metadata, pathname, or range error when descriptor close also fails; close-only errors after a successful read still propagate.
+
+- Reusing a detached launch worktree now refuses to check out a new source HEAD when the worktree commit is not an ancestor of that HEAD, so committed work is not silently dropped.
+
+- Explicit session directories create fork and branch transcripts and unsent drafts with the same native owner-only security as the primary transcript.
+
+- A project `.env` declaration of `VISUAL` or `EDITOR` no longer selects the external editor that GJC executes on your draft; values inherited from the launching shell or GJC/user-owned env files are still honored.
+
+- Temp directory cleanup on Windows: sessions now properly release managed sidecar cache file handles during `closeStrict()`, preventing "directory in use" errors when deleting temporary session directories in tests. The root cause was unconditional resource retention when close succeeded; the fix ensures file handles are released even when resident blob cleanup is skipped (#6566).
+
+- Side-effect `github` operations (`pr_create`, `pr_checkout`, `pr_push`) now go through the session approval gate and the planning-phase mutation guard, while read-only operations stay available.
+
+- HTML session export creates and replaces its output file as owner-only (`0600`).
+
+- Keep bundled Grok Build request hooks scoped to their provider so unrelated SDK sessions retain replay-safe empty-response fallback. Cover the production SDK observer, accepted-only lifecycle, managed transcript persistence, and billed empty stops without changing deadline reconciliation or admitting rejected attempts.
+
+- Preserve clean managed-session fallback admission when the SDK observes the run start, while keeping user extension execution replay-unsafe. Successful empty stops with nonzero usage no longer trigger legacy proxy-overflow retries in session-owned turns.
+
+- Plugin MCP policy denies the shared CGNAT range 100.64.0.0/10, matching the public URL address check.
+
+- Remote MCP HTTP no longer follows a redirect onto another origin, so custom credential headers, the MCP session id, and the JSON-RPC body stay on the configured server.
+
+- A modern MCP `roots/list` input request uses the connection's request handler, so a tools-only session does not answer with the project URI.
+
+- Project MCP config no longer runs shell substitutions or copies secret-named environment variables into server environment and headers.
+
+- Local memory consolidation (phase 2) no longer runs out of room under a fixed 8192-token response cap that, on adaptive-thinking and reasoning-effort models, also had to hold the reasoning; on large memories the rewritten `MEMORY.md`, summary and skills were cut off, failed as `phase2 JSON parse failure`, and `MEMORY.md` / `memory_summary.md` silently stopped updating. The response budget is now the model's output limit capped at 64k, clamped so input, response and any provider-added thinking budget fit the context window (inputs are shrunk on small-context models rather than dropping below the old 8192 budget), and phase 2 requests low reasoning effort like phase 1. A length-truncated response is recorded as `phase2 output truncated …` and a response with no text as `phase2 returned no text (stopReason=…, … output tokens, … thinking blocks)` instead of a JSON parse failure. A job that already exhausted its retries runs again once new sessions advance its input.
+
+- The workflow mutation guard no longer treats an out-of-band mode-state phase as permission to edit product code while the active planning skill is still sealed.
+
+- `monitor` commands are checked by the same planning-phase mutation guard as `bash` before a background job starts.
+
+- The MCP OAuth client_id probe does not GET a non-public authorization URL: the request is pinned to the validated address and the flow abort signal reaches that DNS lookup. The shared address check rejects 192.88.99.0/24, including the non-global 6a44 relay 192.88.99.2.
+
+- OAuth dynamic registration metadata is fetched only from a public URL, and that fetch does not follow redirects.
+
+- Plugin MCP launchers no longer trust startup `node` executables located under temporary roots, even when the GJC checkout is also under `/tmp`; transient first-use digest failures can be retried against the original startup identity.
+
+- The Python tool bridge checks that its registration is still current and not aborted after the request body arrives.
+
+- Register spawned Python kernels before startup callbacks and retain failed or unconfirmed cleanup resources for an explicit retry instead of losing or replacing them.
+- Separate cancelled requests from shared kernel initialization while preserving captured cleanup joins and removing failed provisional acquisitions.
+- Preserve direct-start recovery handles and execution/cleanup error precedence, revalidate cancelled retry acquisitions, and keep active fallback owners through failed explicit preflight.
+
+- Enroll the original Python tool invocation before external execution tracking, so reentrant clear and registered cleanup join its transcript and result finalization without clearing an independent generation.
+
+- Remove temporary deadline-recovery stderr diagnostics so SDK prompt bookkeeping stays within centralized logging and does not expose correlation identifiers through debug prints.
+
+- A retained managed session directory replaced by a symlink is now refused as a changed root binding, and the newly retained child store is closed.
+
+- Bound shared GC count/collect inventories across each read-only receipt read, discovery call and protocol inspection, including unrelated entries and repeated passes. Preserve genuine leased publication quotas, authority fences and descriptor admission; report capacity refusal rather than omitting targets. This does not establish full GC traversal/read/hash admission or writer quiescence.
+
+- The coordinator sidecar ignores a signing-key URL or key that the project dotenv declares, so a repository `.env` cannot supply the signing key.
+
+- Task isolation directories are unique per attempt, so one session can no longer delete another session's live worktree when both reuse the same task id.
+
+- A project `.env` declaration of `GJC_TMUX_COMMAND`, including a dynamic one, no longer selects the tmux binary; the default `tmux` path is used instead, while an operator value the project does not declare is kept.
+
+- Preserve trusted user-skill symlink provenance in isolated-home discovery, honor the effective scope trust policy, and reuse scanner-validated import metadata in customization inventory.
+
+- Fixed Windows CI task cache key test cleanup failures (EBUSY/EPERM) by adding exponential backoff retry logic to temporary directory removal. File handles on Windows may remain open during deletion, causing removal to fail; retrying with increasing delays resolves the locking issue.
+
+- A project `.env` declaration of `GJC_WORKTREE_DIR`, including a dynamic one, no longer selects the launch worktree bucket; the default `{repo}/.worktrees` path is used instead, while an operator value the project does not declare is kept.
+
+- Zero-usage empty stops from context-overflow proxies trigger context promotion and overflow recovery again; only successful empty stops with nonzero usage stay terminal in session-owned turns.
+- Total-token-only empty stops (from OpenAI-compatible endpoints returning only `usage.total_tokens`) are now correctly classified as nonzero usage and remain terminal, preventing unnecessary promotion or retry.
+
 ## [0.18.8] - 2026-10-08
 
 ### Added

package/dist/types/async/endpoint-id.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Single source of truth for the AsyncJobManager endpoint key.
+ *
+ * A session with an explicit provider session id is keyed by (provider id,
+ * transcript path); everything else is keyed by its logical session id. The
+ * transcript component uses a stable path key so a path alias — symlink,
+ * casing difference on a case-insensitive Windows directory, or `..` segment —
+ * cannot register the manager under one key at construction and look it up
+ * under another across a session-identity transition, stranding ownership.
+ * The key remains stable when a transcript is created or atomically replaced,
+ * and case-sensitive Windows paths remain distinct.
+ *
+ * This module is deliberately not re-exported from the broadly imported async
+ * barrel: importing the path identity helper loads native bindings.
+ */
+export declare function asyncJobEndpointId(providerSessionId: string | undefined, sessionId: string, sessionFile: string | undefined): string;

package/dist/types/async/support.d.ts

@@ -1,16 +1,2 @@
 import type { Settings } from "../config/settings";
 export declare function isBackgroundJobSupportEnabled(settings: Pick<Settings, "get">): boolean;
-/**
- * Single source of truth for the AsyncJobManager endpoint key.
- *
- * A session with an explicit provider session id is keyed by (provider id,
- * transcript path); everything else is keyed by its logical session id. The
- * transcript component is canonicalized so a path alias — symlink, `..`
- * segment, or unresolved relative path — cannot register the manager under one
- * key at construction and look it up under another across a session-identity
- * transition, stranding ownership.
- *
- * Both the SDK constructor and AgentSession's transition rekeying must derive
- * the key here; duplicating the shape lets the two drift apart silently.
- */
-export declare function asyncJobEndpointId(providerSessionId: string | undefined, sessionId: string, sessionFile: string | undefined): string;

package/dist/types/commands/mcp-serve.d.ts

@@ -52,6 +52,10 @@ export default class McpServe extends Command {
             description: string;
             default: boolean;
         };
+        "attach-only": import("@gajae-code/utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+            default: boolean;
+        };
     };
     run(): Promise<void>;
 }

package/dist/types/discovery/mcp-json.d.ts

@@ -11,4 +11,5 @@ export declare function loadMCPJsonFile(filePath: string, level: "user" | "proje
     quiet?: boolean;
     useCache?: boolean;
     readOptions?: ReadFileOptions;
+    skipSensitiveEnvNames?: boolean;
 }): Promise<MCPJsonLoadResult>;

package/dist/types/eval/py/kernel.d.ts

@@ -42,6 +42,24 @@ interface KernelStartOptions extends KernelLifecycleOptions {
     env?: Record<string, string | undefined>;
     runtimeOptions?: PythonRuntimeOptions;
     settings?: Settings;
+    /** @internal Synchronously registers the actual spawned kernel before startup callbacks run. */
+    onKernelCreated?: (kernel: PythonKernel) => void;
+    /** @internal Routes partial-start cleanup through the executor's retained ownership. */
+    onStartupFailure?: (kernel: PythonKernel) => Promise<void>;
+}
+export type PythonKernelStartupCleanupFailure = {
+    kind: "unconfirmed";
+    result: KernelShutdownResult;
+} | {
+    kind: "rejected";
+    error: unknown;
+};
+/** Startup failed after a real runner was created and physical cleanup failed. */
+export declare class PythonKernelStartError extends Error {
+    readonly kernel: PythonKernel;
+    readonly startupError: unknown;
+    readonly cleanupFailure: PythonKernelStartupCleanupFailure;
+    constructor(kernel: PythonKernel, startupError: unknown, cleanupFailure: PythonKernelStartupCleanupFailure);
 }
 interface KernelShutdownOptions {
     signal?: AbortSignal;

package/dist/types/export/html/html-export-destination.d.ts

@@ -0,0 +1,2 @@
+/** Owner-only HTML export. A replaced file is locked down on the opened descriptor. */
+export declare function openHtmlExportDestination(outputPath: string): number;

package/dist/types/extensibility/extensions/function-hooks-internal.d.ts

@@ -1,5 +1,10 @@
 import { type FunctionHookRegistration } from "./function-hooks";
 export type TaggedFunctionHookHandler = (...args: unknown[]) => Promise<unknown>;
+/** Host-owned provider adapters must not consume replay authority for other providers. */
+export declare function tagProviderRequestHandler<T extends (...args: never[]) => unknown>(provider: string, handler: T): T;
+export declare function getProviderRequestHandlerProvider(handler: (...args: never[]) => unknown): string | undefined;
+export declare function tagSdkLifecycleObserver<T extends (...args: never[]) => unknown>(handler: T): T;
+export declare function isSdkLifecycleObserver(handler: (...args: never[]) => unknown): boolean;
 export declare function tagExtensionHandlerRegistrationOrder<T extends (...args: never[]) => unknown>(handler: T, registrationOrder: number): T;
 export declare function wrapExtensionHandlerRegistration<T extends (...args: never[]) => unknown>(handler: T, registrationOrder: number): T;
 export declare function getExtensionHandlerRegistrationOrder(value: unknown): number | undefined;

package/dist/types/extensibility/skill-management.d.ts

@@ -13,6 +13,7 @@ export type SkillDisabledReason = "protected" | "scope-trust" | "ignored" | "inc
 export interface ManagedSkillRecord {
     name: string;
     description: string;
+    importedFrom?: string;
     path: string;
     scope: SkillScope;
     /** Canonical source label, e.g. "project .gjc/skills" or "user ~/.gjc/agent/skills". */

package/dist/types/gjc-runtime/psmux-detect.d.ts

@@ -64,9 +64,9 @@ export interface ResolvedTmuxBinary {
     viaExplicitOverride: boolean;
 }
 /**
- * Resolve the tmux command GJC should invoke. Honors the existing
- * GJC_TMUX_COMMAND override; on Windows when no
- * override is set, psmux (installed as psmux, pmux, or tmux) is picked
+ * Resolve the tmux command GJC should invoke. Honors an operator
+ * GJC_TMUX_COMMAND override; a project dotenv value is ignored. On Windows
+ * when no override is set, psmux (installed as psmux, pmux, or tmux) is picked
  * automatically so the default gjc --tmux flow lands on a real multiplexer.
  */
 export declare function resolveGjcTmuxBinary(options?: ResolveGjcTmuxBinaryOptions): ResolvedTmuxBinary;

package/dist/types/gjc-runtime/sidecar-bootstrap-env.d.ts

@@ -0,0 +1,6 @@
+import { type ProjectEnvSnapshot } from "@gajae-code/utils/env-file";
+/**
+ * Operator environment only. A value that matches the project dotenv snapshot
+ * was loaded by Bun from the repository and must not become signing material.
+ */
+export declare function trustedCoordinatorEnv(name: string, env?: NodeJS.ProcessEnv, snapshot?: ProjectEnvSnapshot): string | undefined;

package/dist/types/gjc-runtime/state-writer.d.ts

@@ -168,6 +168,9 @@ export type StrictMutationReadResult = {
 export declare function readExistingStateForMutation(filePath: string): Promise<StrictMutationReadResult>;
 export declare function workflowEnvelopeContentSha256(value: unknown): string;
 export declare function stampWorkflowEnvelopeChecksum<T>(value: T, filePath: string, computedAt?: string): T;
+export type WorkflowEnvelopeChecksumStatus = "absent" | "match" | "mismatch";
+/** Compare a parsed envelope to its writer-stamped `content_sha256`, when one is present. */
+export declare function workflowEnvelopeChecksumStatus(value: unknown): WorkflowEnvelopeChecksumStatus;
 export declare function detectWorkflowEnvelopeIntegrityMismatch(filePath: string): Promise<WorkflowEnvelopeIntegrityMismatch | undefined>;
 type ActiveStateCacheInvalidator = (cwd?: string, sessionId?: string) => void;
 export declare function setActiveStateCacheInvalidator(invalidator: ActiveStateCacheInvalidator): void;

package/dist/types/gjc-runtime/tmux-common.d.ts

@@ -40,11 +40,14 @@ export declare function envDisabled(value: string | undefined): boolean;
  * failure mode where `gjc --tmux` creates a psmux-backed session and then
  * `gjc session status` fails because it queries literal `tmux` is closed off.
  *
- * Explicit `GJC_TMUX_COMMAND` overrides are honored on
- * every platform. On native Windows without an override the resolver walks
- * `psmux`, then `pmux`, then `tmux` and uses the first binary present on PATH.
- * On POSIX the resolver returns `tmux` (the historical default) and only
- * falls through to the platform-aware walker if the caller opts in.
+ * An operator `GJC_TMUX_COMMAND` is honored on every platform. A value that
+ * matches the project dotenv snapshot, including a dynamic declaration, is
+ * ignored so a repository cannot choose the binary, and the resolver uses the
+ * same default as when the variable is unset. On native Windows without an
+ * override the resolver walks `psmux`, then `pmux`, then `tmux` and uses the
+ * first binary present on PATH. On POSIX the resolver returns `tmux` (the
+ * historical default) and only falls through to the platform-aware walker if
+ * the caller opts in.
  */
 export declare function resolveGjcTmuxCommand(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string;
 export type { PsmuxProbe, ResolvedTmuxBinary, ResolveGjcTmuxBinaryOptions } from "./psmux-detect";

package/dist/types/lsp/config.d.ts

@@ -9,13 +9,16 @@ export interface LspConfig {
  */
 export declare function hasRootMarkers(cwd: string, markers: string[]): boolean;
 /**
- * Resolve a command to an executable path.
- * Checks project-local bin directories first, then falls back to $PATH.
+ * Resolve a host-spawn executable from $PATH without consulting project-controlled bin directories.
+ * LSP auto-detection and DAP adapter launch both use this rule.
  *
- * @param command - The command name (e.g., "typescript-language-server")
- * @param cwd - Working directory to search from
- * @returns Absolute path to the executable, or null if not found
+ * Trust is evaluated on both the discovered and canonical paths, but the returned
+ * path is the discovered one: multiplexed launchers such as rustup pick the proxied
+ * tool from argv[0], so `~/.cargo/bin/rust-analyzer -> rustup` must be spawned as
+ * `rust-analyzer`, not as the resolved `rustup` binary.
  */
+export declare function resolveTrustedCommand(command: string, cwd: string): string | null;
+/** Same rule as `resolveTrustedCommand`: project-local bin directories are never searched. */
 export declare function resolveCommand(command: string, cwd: string): string | null;
 /**
  * Load LSP configuration.

package/dist/types/runtime-mcp/manager.d.ts

@@ -257,10 +257,11 @@ export declare class MCPManager {
     /**
      * Resolve auth and shell-command substitutions in config before connecting.
      */
-    prepareConfig(config: MCPServerConfig): Promise<MCPServerConfig>;
+    prepareConfig(config: MCPServerConfig, source?: SourceMeta): Promise<MCPServerConfig>;
     /** Acquire a prepared, pool-owned lease for a scoped transient operation. */
     withPreparedLease<T>(name: string, config: MCPServerConfig, fn: (lease: MCPPoolLease) => Promise<T> | T, options?: {
         signal?: AbortSignal;
+        source?: SourceMeta;
     }): Promise<T>;
     /** Read-only test seam for pending retired lease-release records. */
     get retiredLeaseReleaseCountForTests(): number;

package/dist/types/runtime-mcp/mcp-redirect.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Follow same-origin MCP redirects only.
+ *
+ * A cross-origin 307/308 would carry custom credential headers, `Mcp-Session-Id`,
+ * and the JSON-RPC body. The first request uses `rawUrl` unchanged so a caller
+ * that cannot be parsed (diagnostic redaction) still reaches fetch, but with
+ * `redirect: "manual"` so that hop is not followed either.
+ */
+export declare function fetchMcpRespectingOrigin(rawUrl: string, init: BunFetchRequestInit): Promise<Response>;

package/dist/types/runtime-mcp/oauth-public-url.d.ts

@@ -1 +1,3 @@
-export declare function assertPublicOAuthUrl(url: string): Promise<void>;
+export declare function assertPublicOAuthUrl(url: string, options?: {
+    signal?: AbortSignal;
+}): Promise<void>;

package/dist/types/runtime-mcp/project-host-values.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Host-value policy for MCP config that comes from an untrusted project file.
+ *
+ * User mcp.json and an explicit `--mcp-config` file may still substitute
+ * secret-named environment variables and run `!` shell commands. A project
+ * file (native `.gjc/mcp.json` or a repo-root `mcp.json`) uses the same
+ * sensitive-name rule as project `ssh.json`: do not copy those host values
+ * into server env or headers, and do not execute `!`.
+ */
+import type { SourceMeta } from "../capability/types";
+export declare function nativeMcpSource(level: "user" | "project", filePath: string): SourceMeta;
+/** True when this server was loaded from untrusted project MCP config. */
+export declare function isUntrustedProjectMcpSource(source: SourceMeta | undefined, toolsOnly: boolean): boolean;
+export type ProjectHostValueDecision = {
+    action: "resolve";
+} | {
+    action: "drop";
+} | {
+    action: "literal";
+    value: string;
+};
+/**
+ * Decide how to interpret one env or header value.
+ * `drop` means "do not run the shell, and omit the value".
+ * `literal` means "do not read process.env".
+ */
+export declare function decideUntrustedProjectConfigValue(value: string, untrusted: boolean): ProjectHostValueDecision;

package/dist/types/sdk/broker/broker.d.ts

@@ -3,7 +3,7 @@ import type { ModelProfileErrorDetails } from "../../config/model-profile-contra
 import type { TaskArtifactOwnerDeletionEvidence, TaskArtifactOwnerRetirementContinuation } from "../../session/task-artifact-owner-codec";
 import { type SdkHostModelResolver } from "../host/model-pin";
 import { type DirectoryMigrationPolicy } from "../session-directory";
-import { type BrokerStopRequest } from "./broker-exit";
+import { type BrokerExitMode, type BrokerExitReason, type BrokerStopRequest } from "./broker-exit";
 import { type BrokerDiscovery, type BrokerPublicationObservation, type RedactedBrokerDiscovery } from "./discovery";
 import { type LifecycleDurableEffectsReceipt, LifecycleLedger, type LifecycleStartupFailureReceipt } from "./lifecycle-ledger";
 import { type IndexedSession, SessionIndex } from "./session-index";
@@ -373,6 +373,11 @@ export declare class Broker {
     start(): Promise<BrokerDiscovery>;
     get ownsDiscovery(): boolean;
     get completion(): Promise<void>;
+    /** Why this broker completed, or null while it is still running. */
+    get terminalExit(): {
+        readonly mode: BrokerExitMode;
+        readonly reason: BrokerExitReason;
+    } | null;
     prepareRestart(options: BrokerRestartPrepareOptions): Promise<BrokerRestartResult>;
     commitRestart(options: BrokerRestartCommitOptions): Promise<BrokerRestartResult>;
     cancelRestart(requestId: string): Promise<BrokerRestartResult>;

package/dist/types/sdk/broker/doctor-restart.d.ts

@@ -23,6 +23,11 @@ export type DoctorBrokerRestartOutcome = {
 } | {
     kind: "owner_unavailable";
     reason: "no_discovery" | "owner_not_confirmed_live";
+}
+/** Attach-only mode: the broker belongs to an external supervisor, so restart through it. */
+ | {
+    kind: "attach_only_refused";
+    reason: "supervisor_owned";
 } | {
     kind: "prepare_refused";
     code: string;

package/dist/types/sdk/broker/ensure.d.ts

@@ -152,7 +152,20 @@ export declare function closeBrokerClientBeforeDeadline(client: {
 }, deadline: number): Promise<void>;
 /** Reconcile an observed broker generation before entering a startup critical section. */
 export declare function reconcileBrokerGenerationForStartup(settings: EnsureBrokerSettings, deadline?: number): Promise<BrokerDiscovery | undefined>;
-/** Starts the detached broker entrypoint when discovery has no live owner. */
+/**
+ * Attach-only client mode. When `GJC_SDK_BROKER_AUTOSTART=0`, `ensureBroker`
+ * never spawns, retires or restarts a broker: it returns a live, reusable
+ * discovery or fails with `broker_unavailable`. Hosts that supervise their own
+ * broker (for example a system service) set it for every client they run. The
+ * broker entrypoints never call `ensureBroker`, so they ignore the variable and
+ * their descendants may inherit it.
+ */
+export declare const SDK_BROKER_AUTOSTART_ENV = "GJC_SDK_BROKER_AUTOSTART";
+export declare function isBrokerAttachOnly(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Starts the detached broker entrypoint when discovery has no live owner. In
+ * attach-only mode (`SDK_BROKER_AUTOSTART_ENV`) it only attaches.
+ */
 export declare function ensureBroker(settings: EnsureBrokerSettings): Promise<BrokerDiscovery>;
 /** Starts one fresh fixture broker and returns its sole exact-child close lease. */
 export declare function startFixtureBrokerWithLeaseForTest(settings: EnsureBrokerSettings): Promise<StartedFixtureBroker>;

package/dist/types/session/session-storage.d.ts

@@ -444,6 +444,13 @@ export type NativeDirectoryTreeSnapshot = {
     rootIno: string;
     entries: NativeDirectoryTreeEntry[];
 };
+/**
+ * Replace an explicit session file. Creation mode `0600` does not install a
+ * Windows owner-only DACL, so this applies and verifies the same native path a
+ * primary transcript uses when it has no managed security context. POSIX mode
+ * stays `0600`.
+ */
+export declare function writeExplicitOwnerOnlyTextSync(pathname: string, content: string): void;
 /** Physically observed commit-marker state; corrupt JSON is still `present`. */
 export type SessionCommitMarkerState = {
     kind: "missing";

package/dist/types/skill-state/workflow-mutation-guard.d.ts

@@ -5,6 +5,9 @@ export declare const WORKFLOW_STATE_MUTATION_BLOCK_MESSAGE = ".gjc workflow stat
 export declare const RALPLAN_MUTATION_BLOCK_MESSAGE = "Ralplan planning phase boundary: keep refining the consensus plan and persist plan artifacts through `gjc ralplan --write` (stage scratch files under a temp dir if needed). Product-code mutation tools and patch execution are blocked while ralplan is active; mutate only after the plan is approved and execution begins.";
 export declare const ULTRAGOAL_GOAL_PLANNING_MUTATION_BLOCK_MESSAGE = "Ultragoal goal-planning phase boundary: finish goal planning and record goals through `gjc ultragoal` before editing code. Product-code mutation tools and patch execution are blocked until goal planning completes and execution begins.";
 export declare const AUTORESEARCH_MUTATION_BLOCK_MESSAGE = "Autoresearch research-only boundary: this workflow produces findings, evidence, and a verdict \u2014 never product code. Product-code mutation tools and patch execution are blocked everywhere, on every branch. Mission research artifacts (`autoresearch.sh` at the workdir root and mission state through the sanctioned `gjc autoresearch` CLI) stay writable; run experiments through the `python` tool, or finish the mission and hand off to an approved implementation workflow.";
+/** Tools whose execute path can mutate product state. `github` is included so side-effect ops share this guard. */
+export declare const WORKFLOW_MUTATION_TOOL_NAMES: readonly ["edit", "write", "ast_edit", "bash", "github"];
+export declare function isWorkflowMutationTool(name: string): boolean;
 type ToolWithEditMode = AgentTool & {
     mode?: unknown;
     customWireName?: unknown;

package/dist/types/task/isolation-dir.d.ts

@@ -0,0 +1,26 @@
+import * as path from "node:path";
+type PathApi = Pick<typeof path, "dirname" | "isAbsolute" | "relative" | "resolve" | "sep">;
+/**
+ * Parent directory of `mergedDir`, but only when it is a single entry inside
+ * `worktreeRoot`. Root, empty, nested, and escaped paths are refused so
+ * cleanup cannot delete the worktree root or another session's tree by
+ * walking up.
+ */
+export declare function resolveIsolationRemovalTarget(mergedDir: string, worktreeRoot: string, pathApi?: PathApi): string;
+/**
+ * Create an exclusive directory next to `canonicalBaseDir`. Never removes
+ * `canonicalBaseDir` or any path that already exists.
+ */
+export declare function allocateDisjointIsolationDir(canonicalBaseDir: string, tokenFactory?: () => string): Promise<string>;
+/**
+ * Confirm native teardown may see `mergedDir`.
+ *
+ * `isoStop` deletes that path. The parent entry and `merged` itself must
+ * already be real directories, because native removal follows symlinks.
+ * A missing parent means there is nothing to stop. This does not close a
+ * replacement that happens after the lstat returns.
+ */
+export declare function assertIsolationTeardownTarget(mergedDir: string, worktreeRoot: string): Promise<"stop" | "skip">;
+/** Remove the isolation directory that owns `mergedDir`. Missing directories are ignored. */
+export declare function removeIsolationDirectory(mergedDir: string, worktreeRoot: string): Promise<void>;
+export {};

package/dist/types/tools/ast-edit-write-path.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Path the native writer will mutate: realpath of an existing file, or realpath
+ * of the nearest existing ancestor plus the missing tail.
+ */
+export declare function canonicalizeAstEditWritePath(absolutePath: string): Promise<string>;
+/**
+ * Preview paths as the workflow guard must see them.
+ *
+ * The guard compares lexically against the session cwd. A raw realpath misses
+ * `.gjc/**` when that cwd is not already canonical (`/var` vs `/private/var`,
+ * or a symlinked workspace), so an in-workspace real path is reattached to `cwd`.
+ */
+export declare function resolveAstEditPreviewWritePaths(cwd: string, previewedPaths: readonly string[]): Promise<string[]>;

package/dist/types/tools/browser/cdp-url.d.ts

@@ -0,0 +1,2 @@
+/** Require an http(s) CDP URL whose host is loopback. */
+export declare function assertLoopbackCdpUrl(cdpUrl: string): string;

package/dist/types/tools/github-side-effect.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Classify `github` tool operations for the approval gate and the planning
+ * mutation guard. Read-only ops stay available. Every other op, including a
+ * missing or unrecognized one, is a side effect and fails closed.
+ */
+import type { AgentTool } from "@gajae-code/agent-core";
+/** Name-only tool the planning guard uses when `GithubTool.execute` checks itself. */
+export declare const githubMutationTool: AgentTool;
+export declare function githubOp(args: unknown): string | undefined;
+/** True only for a known read-only github op. Missing and unknown ops are not read-only. */
+export declare function isGithubReadOnlyArgs(args: unknown): boolean;
+export declare function isGithubReadOnlyOp(op: string): boolean;
+/**
+ * Approval summary for a side-effect github call. The PR body is omitted so a
+ * token pasted into `body` is not copied into the permission title.
+ */
+export declare function describeGithubSideEffect(args: unknown): string;
+export declare function githubPermissionIntent(args: unknown): {
+    toolName: string;
+    title: string;
+    cacheKey: string;
+} | undefined;

package/dist/types/tools/monitor-mutation.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Judge a monitor command with the same mutation rules as bash. Monitor is a
+ * background shell, so a planning-phase mutation must fail before the job starts.
+ */
+export declare function assertMonitorMutationAllowed(input: {
+    cwd: string;
+    sessionId?: string;
+    command: string;
+}): Promise<void>;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/coding-agent",
-	"version": "0.18.8",
+	"version": "0.18.10",
 	"description": "Gajae Code CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -57,12 +57,12 @@
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@gajae-code/stats": "0.18.8",
-		"@gajae-code/agent-core": "0.18.8",
-		"@gajae-code/ai": "0.18.8",
-		"@gajae-code/natives": "0.18.8",
-		"@gajae-code/tui": "0.18.8",
-		"@gajae-code/utils": "0.18.8",
+		"@gajae-code/stats": "0.18.10",
+		"@gajae-code/agent-core": "0.18.10",
+		"@gajae-code/ai": "0.18.10",
+		"@gajae-code/natives": "0.18.10",
+		"@gajae-code/tui": "0.18.10",
+		"@gajae-code/utils": "0.18.10",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/src/async/endpoint-id.ts

@@ -0,0 +1,26 @@
+import { stablePathKey } from "@gajae-code/utils/path-identity";
+
+/**
+ * Single source of truth for the AsyncJobManager endpoint key.
+ *
+ * A session with an explicit provider session id is keyed by (provider id,
+ * transcript path); everything else is keyed by its logical session id. The
+ * transcript component uses a stable path key so a path alias — symlink,
+ * casing difference on a case-insensitive Windows directory, or `..` segment —
+ * cannot register the manager under one key at construction and look it up
+ * under another across a session-identity transition, stranding ownership.
+ * The key remains stable when a transcript is created or atomically replaced,
+ * and case-sensitive Windows paths remain distinct.
+ *
+ * This module is deliberately not re-exported from the broadly imported async
+ * barrel: importing the path identity helper loads native bindings.
+ */
+export function asyncJobEndpointId(
+	providerSessionId: string | undefined,
+	sessionId: string,
+	sessionFile: string | undefined,
+): string {
+	return providerSessionId !== undefined && sessionFile !== undefined
+		? JSON.stringify(["async-job-endpoint", providerSessionId, stablePathKey(sessionFile)])
+		: sessionId;
+}