@gajae-code/coding-agent 0.18.8 → 0.18.9

package/src/runtime-mcp/mcp-redirect.ts

@@ -0,0 +1,73 @@
+import { cancelMCPStream } from "./content-limits";
+
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const MAX_REDIRECTS = 20;
+const REQUEST_BODY_HEADERS = [
+	"content-encoding",
+	"content-language",
+	"content-length",
+	"content-location",
+	"content-type",
+] as const;
+
+function rewritesToGet(status: number, method: string): boolean {
+	return (
+		((status === 301 || status === 302) && method === "POST") ||
+		(status === 303 && method !== "GET" && method !== "HEAD")
+	);
+}
+
+/**
+ * Follow same-origin MCP redirects only.
+ *
+ * A cross-origin 307/308 would carry custom credential headers, `Mcp-Session-Id`,
+ * and the JSON-RPC body. The first request uses `rawUrl` unchanged so a caller
+ * that cannot be parsed (diagnostic redaction) still reaches fetch, but with
+ * `redirect: "manual"` so that hop is not followed either.
+ */
+export async function fetchMcpRespectingOrigin(rawUrl: string, init: BunFetchRequestInit): Promise<Response> {
+	let currentUrl: URL;
+	try {
+		currentUrl = new URL(rawUrl);
+	} catch {
+		return fetch(rawUrl, { ...init, redirect: "manual" });
+	}
+
+	let requestTarget = rawUrl;
+	let currentInit: BunFetchRequestInit = { ...init, redirect: "manual" };
+	for (let redirectCount = 0; ; redirectCount++) {
+		const response = await fetch(requestTarget, currentInit);
+		if (!REDIRECT_STATUSES.has(response.status)) return response;
+
+		const location = response.headers.get("location");
+		if (!location) return response;
+		if (redirectCount >= MAX_REDIRECTS) {
+			cancelMCPStream(response.body);
+			throw new Error("MCP redirect limit exceeded");
+		}
+
+		let nextUrl: URL;
+		try {
+			nextUrl = new URL(location, currentUrl);
+		} catch (error) {
+			cancelMCPStream(response.body);
+			throw error;
+		}
+		if (nextUrl.origin !== currentUrl.origin) {
+			cancelMCPStream(response.body);
+			throw new Error("cross-origin redirects are not allowed");
+		}
+
+		const headers = new Headers(currentInit.headers);
+		const method = (currentInit.method ?? "GET").toUpperCase();
+		if (rewritesToGet(response.status, method)) {
+			for (const name of REQUEST_BODY_HEADERS) headers.delete(name);
+			currentInit = { ...currentInit, method: "GET", headers, body: undefined, redirect: "manual" };
+		} else {
+			currentInit = { ...currentInit, headers, redirect: "manual" };
+		}
+		currentUrl = nextUrl;
+		requestTarget = nextUrl.toString();
+		cancelMCPStream(response.body);
+	}
+}

package/src/runtime-mcp/oauth-flow.ts

@@ -8,6 +8,7 @@
 import type { OAuthCallbackFlowOptions } from "@gajae-code/ai/utils/oauth/callback-server";
 import { OAuthCallbackFlow } from "@gajae-code/ai/utils/oauth/callback-server";
 import type { OAuthController, OAuthCredentials } from "@gajae-code/ai/utils/oauth/types";
+import { guardedPublicFetch } from "../web/insane/url-guard";
 import { assertPublicOAuthUrl } from "./oauth-public-url";
 
 const DEFAULT_PORT = 3000;
@@ -262,7 +263,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 			params.set("client_secret", clientSecret);
 		}
 
-		await assertPublicOAuthUrl(this.config.tokenUrl);
+		await assertPublicOAuthUrl(this.config.tokenUrl, { signal: this.ctrl.signal });
 		const response = await fetch(this.config.tokenUrl, {
 			method: "POST",
 			redirect: "error",
@@ -343,7 +344,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 		if (!registrationEndpoint) return;
 
 		try {
-			await assertPublicOAuthUrl(registrationEndpoint);
+			await assertPublicOAuthUrl(registrationEndpoint, { signal });
 			const response = await fetch(registrationEndpoint, {
 				method: "POST",
 				redirect: "error",
@@ -385,8 +386,10 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 		try {
 			const authorizationEndpoint = new URL(this.config.authorizationUrl);
 			const metadataUrl = new URL("/.well-known/oauth-authorization-server", authorizationEndpoint.origin);
+			await assertPublicOAuthUrl(metadataUrl.toString(), { signal });
 			const response = await fetch(metadataUrl.toString(), {
 				method: "GET",
+				redirect: "error",
 				headers: { Accept: "application/json" },
 				signal,
 			});
@@ -406,12 +409,16 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 
 	async #assertClientIdNotRequired(authorizationUrl: string, signal?: AbortSignal): Promise<void> {
 		try {
-			const response = await fetch(authorizationUrl, {
+			// Pin the GET to the addresses that passed validation. A plain fetch would
+			// resolve the hostname again. Skip the probe when that route cannot be
+			// established; the flow signal cancels the DNS lookup.
+			const probed = await guardedPublicFetch(authorizationUrl, {
 				method: "GET",
-				redirect: "manual",
 				headers: { Accept: "text/plain,text/html,application/json" },
 				signal,
 			});
+			if (!probed.ok) return;
+			const response = probed.response;
 			if (response.status < 400) return;
 			const body = await response.text();
 			if (/client[_-]?id/i.test(body) && /(required|missing|invalid)/i.test(body)) {

package/src/runtime-mcp/oauth-public-url.ts

@@ -1,8 +1,14 @@
 import { validatePublicHttpUrl } from "../web/insane/url-guard";
 
-export async function assertPublicOAuthUrl(url: string): Promise<void> {
-	const checked = await validatePublicHttpUrl(url);
+export async function assertPublicOAuthUrl(url: string, options: { signal?: AbortSignal } = {}): Promise<void> {
+	if (options.signal?.aborted) throw abortReason(options.signal);
+	const checked = await validatePublicHttpUrl(url, { signal: options.signal });
+	if (options.signal?.aborted) throw abortReason(options.signal);
 	if (!checked.ok) {
 		throw new Error(`Refusing non-public OAuth endpoint: ${checked.reason ?? url}`);
 	}
 }
+
+function abortReason(signal: AbortSignal): Error {
+	return signal.reason instanceof Error ? signal.reason : new Error("OAuth URL validation aborted");
+}

package/src/runtime-mcp/pool.ts

@@ -307,6 +307,12 @@ class MCPPoolLeaseImpl implements MCPPoolLease {
 				notify: (method, params) => lease.notify(method, params),
 				close: () => lease.release(),
 				closeBeforeReconnect: physical.transport.closeBeforeReconnect,
+				get onRequest() {
+					return physical.transport.onRequest;
+				},
+				set onRequest(handler) {
+					physical.transport.onRequest = handler;
+				},
 			};
 			const facade = { ...physical, transport };
 			for (const property of ["tools", "resources", "resourceTemplates", "prompts"] as const) {

package/src/runtime-mcp/project-host-values.ts

@@ -0,0 +1,46 @@
+/**
+ * Host-value policy for MCP config that comes from an untrusted project file.
+ *
+ * User mcp.json and an explicit `--mcp-config` file may still substitute
+ * secret-named environment variables and run `!` shell commands. A project
+ * file (native `.gjc/mcp.json` or a repo-root `mcp.json`) uses the same
+ * sensitive-name rule as project `ssh.json`: do not copy those host values
+ * into server env or headers, and do not execute `!`.
+ */
+
+import type { SourceMeta } from "../capability/types";
+import { isSensitiveEnvName } from "../discovery/helpers";
+
+const UNTRUSTED_PROJECT_MCP_PROVIDERS = new Set(["native", "mcp-json"]);
+
+export function nativeMcpSource(level: "user" | "project", filePath: string): SourceMeta {
+	return {
+		provider: "native",
+		providerName: "GJC",
+		path: filePath,
+		level,
+	};
+}
+
+/** True when this server was loaded from untrusted project MCP config. */
+export function isUntrustedProjectMcpSource(source: SourceMeta | undefined, toolsOnly: boolean): boolean {
+	if (toolsOnly || !source || source.level !== "project") return false;
+	return UNTRUSTED_PROJECT_MCP_PROVIDERS.has(source.provider);
+}
+
+export type ProjectHostValueDecision =
+	| { action: "resolve" }
+	| { action: "drop" }
+	| { action: "literal"; value: string };
+
+/**
+ * Decide how to interpret one env or header value.
+ * `drop` means "do not run the shell, and omit the value".
+ * `literal` means "do not read process.env".
+ */
+export function decideUntrustedProjectConfigValue(value: string, untrusted: boolean): ProjectHostValueDecision {
+	if (!untrusted) return { action: "resolve" };
+	if (value.startsWith("!")) return { action: "drop" };
+	if (isSensitiveEnvName(value)) return { action: "literal", value };
+	return { action: "resolve" };
+}

package/src/runtime-mcp/transports/http.ts

@@ -28,6 +28,7 @@ import {
 	MCP_MAX_SSE_REQUEST_MESSAGES,
 	readMCPResponseText,
 } from "../content-limits";
+import { fetchMcpRespectingOrigin } from "../mcp-redirect";
 import { fetchPluginMcpRequest, usesPublicNetworkMcpFetch } from "../plugin-network-boundary";
 import { buildModernMcpHeaders, type MCPModernClientContext, type MCPProtocolEra, withModernMeta } from "../protocol";
 
@@ -157,7 +158,7 @@ export class HttpTransport implements MCPTransport {
 	#fetch(init: BunFetchRequestInit): Promise<Response> {
 		return usesPublicNetworkMcpFetch(this.config)
 			? fetchPluginMcpRequest(this.config.url, init)
-			: fetch(this.config.url, init);
+			: fetchMcpRespectingOrigin(this.config.url, init);
 	}
 
 	#trackReader(promise: Promise<void>, controller?: AbortController): void {

package/src/sdk/acp/adapter.ts

@@ -150,6 +150,8 @@ const ACP_MCP_PRESERVED_LAUNCH_CODES = new Set([
 	"spawn_failed",
 	"worktree_in_use",
 	"uncertain_after_send",
+	// Attach-only refusal: raised by ensureBroker before any lifecycle request or MCP server.
+	"broker_unavailable",
 ]);
 
 /**

package/src/sdk/broker/broker.ts

@@ -1581,6 +1581,7 @@ export class Broker {
 	#startupAfterDiscoveryWriteTestHook: (() => Promise<void>) | undefined;
 	#startupPostPublicationDelayMs: number;
 	#completionTask: Promise<void> | null = null;
+	#terminalExit: { mode: BrokerExitMode; reason: BrokerExitReason } | null = null;
 	#completion!: Promise<void>;
 	#resolveCompletion!: () => void;
 	#rejectCompletion!: (error: unknown) => void;
@@ -4019,6 +4020,10 @@ export class Broker {
 	get completion(): Promise<void> {
 		return this.#completion;
 	}
+	/** Why this broker completed, or null while it is still running. */
+	get terminalExit(): { readonly mode: BrokerExitMode; readonly reason: BrokerExitReason } | null {
+		return this.#terminalExit;
+	}
 	#restartIdentity(): BrokerRestartOwnerIdentity | undefined {
 		const d = this.discovery;
 		if (!d?.incarnation) return undefined;
@@ -4312,6 +4317,7 @@ export class Broker {
 		blockingLockPath?: string,
 	): Promise<void> {
 		if (this.#completionTask) return this.#completionTask;
+		this.#terminalExit = { mode, reason };
 		const now = process.hrtime.bigint();
 		const fenceStartedAt = this.#lossAt ?? this.#ambiguousAt;
 		const exitRecord: BrokerExitRecord & Record<string, unknown> = {

package/src/sdk/broker/doctor-restart.ts

@@ -9,6 +9,7 @@ import type {
 } from "./broker";
 import { launchAuthorizedBrokerSuccessor, oldOwnerConfirmedExited } from "./daemon-entry";
 import { type BrokerDiscovery, readBrokerDiscovery } from "./discovery";
+import { isBrokerAttachOnly } from "./ensure";
 
 export interface DoctorBrokerRestartOptions {
 	agentDir: string;
@@ -33,6 +34,8 @@ export type DoctorBrokerRestartOutcome =
 			adopted: boolean;
 	  }
 	| { kind: "owner_unavailable"; reason: "no_discovery" | "owner_not_confirmed_live" }
+	/** Attach-only mode: the broker belongs to an external supervisor, so restart through it. */
+	| { kind: "attach_only_refused"; reason: "supervisor_owned" }
 	| { kind: "prepare_refused"; code: string; message: string }
 	| { kind: "commit_refused"; code: string; message: string }
 	| { kind: "old_owner_exit_timeout"; requestId: string; oldOwner: BrokerRestartOwnerIdentity }
@@ -163,6 +166,7 @@ const OLD_OWNER_EXIT_POLL_MS = 50;
  * proven it owns the root -- never here, and never before that proof exists.
  */
 export async function restartBrokerForDoctor(options: DoctorBrokerRestartOptions): Promise<DoctorBrokerRestartOutcome> {
+	if (isBrokerAttachOnly()) return { kind: "attach_only_refused", reason: "supervisor_owned" };
 	const old = await readBrokerDiscovery(options.agentDir);
 	if (!old) return { kind: "owner_unavailable", reason: "no_discovery" };
 	const oldOwner = identity(old);

package/src/sdk/broker/ensure.ts

@@ -6,7 +6,7 @@ import path from "node:path";
 import packageJson from "../../../package.json" with { type: "json" };
 import { acquireFileLock, type FileLockOptions, withFileLock } from "../../config/file-lock";
 import { loadInstallationHostId, loadLegacyInstallationHostId } from "../../config/machine-identity";
-import { SdkClient } from "../client/client";
+import { SdkClient, SdkClientError } from "../client/client";
 import { type BrokerStartupExitRecord, clearBrokerStartupExitRecord, readBrokerStartupExitRecord } from "./broker-exit";
 import {
 	type BrokerDiscovery,
@@ -1003,9 +1003,36 @@ function startEnsure(settings: EnsureBrokerSettings, initiator: EnsureInitiator)
 	return entry;
 }
 
-/** Starts the detached broker entrypoint when discovery has no live owner. */
+/**
+ * Attach-only client mode. When `GJC_SDK_BROKER_AUTOSTART=0`, `ensureBroker`
+ * never spawns, retires or restarts a broker: it returns a live, reusable
+ * discovery or fails with `broker_unavailable`. Hosts that supervise their own
+ * broker (for example a system service) set it for every client they run. The
+ * broker entrypoints never call `ensureBroker`, so they ignore the variable and
+ * their descendants may inherit it.
+ */
+export const SDK_BROKER_AUTOSTART_ENV = "GJC_SDK_BROKER_AUTOSTART";
+
+export function isBrokerAttachOnly(env: NodeJS.ProcessEnv = process.env): boolean {
+	return env[SDK_BROKER_AUTOSTART_ENV] === "0";
+}
+
+async function attachExistingBroker(settings: EnsureBrokerSettings): Promise<BrokerDiscovery> {
+	const discovery = await readBrokerDiscovery(settings.agentDir, settings.heartbeatTtlMs);
+	if (discovery && (await isBrokerReusable(discovery))) return discovery;
+	throw new SdkClientError(
+		"broker_unavailable",
+		`SDK broker is not running and ${SDK_BROKER_AUTOSTART_ENV}=0 forbids starting one.`,
+	);
+}
+
+/**
+ * Starts the detached broker entrypoint when discovery has no live owner. In
+ * attach-only mode (`SDK_BROKER_AUTOSTART_ENV`) it only attaches.
+ */
 export function ensureBroker(settings: EnsureBrokerSettings): Promise<BrokerDiscovery> {
 	const resolvedSettings = { ...settings, agentDir: path.resolve(settings.agentDir) };
+	if (isBrokerAttachOnly()) return attachExistingBroker(resolvedSettings);
 	const inFlight = ensureInFlight.get(resolvedSettings.agentDir) ?? startEnsure(resolvedSettings, "discovery");
 	return inFlight.discovery;
 }

package/src/sdk/host/session-runtime.test.ts

@@ -5378,19 +5378,18 @@ async function settledStatus(
 	harness: InvocationHarness,
 	name: string,
 	input: Record<string, unknown>,
+	timeoutMs = 10_000,
 ): Promise<NonNullable<ResponseFrame["result"]>> {
 	// Wall-clock budget instead of a fixed poll count: CI runners can starve the
-	// event loop long enough to exhaust 200 ~1ms polls before a 25ms deadline
-	// timer is dispatched, failing a correct implementation on timing alone.
-	// The contract is unchanged — the status must still reach a terminal
-	// reconciliation state with the asserted shape within a bounded horizon.
-	const budgetEndsAt = Date.now() + 10_000;
+	// event loop and delay deadline timers. Polling every 10ms avoids flooding
+	// reconciliation queries while preserving the asserted terminal contract.
+	const budgetEndsAt = Date.now() + timeoutMs;
 	for (;;) {
 		const frame = await harness.query(name, input);
 		const result = frame.result;
 		if (result && (result.status === "failed" || result.status === "terminal_ok")) return result;
 		if (Date.now() > budgetEndsAt) throw new Error(`${name} never reported a terminal reconciliation status`);
-		await Bun.sleep(1);
+		await Bun.sleep(10);
 	}
 }
 
@@ -5842,6 +5841,48 @@ test("SDK turn.steer preserves its expected run token and propagates a stale-run
 });
 
 describe("post-acceptance invocation terminalization", () => {
+	test("completion fallback and a held lifecycle end publish one terminal boundary", async () => {
+		const cwd = await mkdtemp(path.join(os.tmpdir(), "gjc-completion-lifecycle-race-"));
+		const completion = Promise.withResolvers<string>();
+		const terminalEntered = Promise.withResolvers<void>();
+		const releaseTerminal = Promise.withResolvers<void>();
+		const completionReconciled = Promise.withResolvers<void>();
+		let harness: InvocationHarness | undefined;
+		try {
+			harness = await invocationHarness("completion-lifecycle-race", cwd, {
+				sendUserMessage: async (_content, options) => {
+					await options?.onPreflightAcceptCommit?.();
+					return completion.promise;
+				},
+				persistInterceptor: () => {},
+				agentFailedWriteFailures: 0,
+				persistHold: { type: "agent_end", onEntered: terminalEntered.resolve, release: releaseTerminal.promise },
+				onInvocationCompletionReconciled: () => completionReconciled.resolve(),
+			});
+			const accepted = await harness.control("turn.prompt", { text: "complete once" });
+			expect(accepted.ok).toBe(true);
+			const correlation = { commandId: accepted.result?.commandId, turnId: accepted.result?.turnId };
+			await harness.emit("agent_start");
+			completion.resolve("completed");
+			await terminalEntered.promise;
+			const end = harness.emit("agent_end", {
+				messages: [{ role: "assistant", stopReason: "stop", content: "completed" }],
+			});
+			await Bun.sleep(0);
+			releaseTerminal.resolve();
+			await Promise.all([end, completionReconciled.promise]);
+			expect(await settledStatus(harness, "turn.result", { kind: "prompt", ...correlation })).toMatchObject({
+				status: "terminal_ok",
+				content: { text: "completed" },
+			});
+			expect(harness.broadcasts.filter(frame => frame.kind === "agent_end")).toHaveLength(1);
+		} finally {
+			completion.resolve("completed");
+			releaseTerminal.resolve();
+			await harness?.stop();
+			await rm(cwd, { recursive: true, force: true });
+		}
+	});
 	test.each([
 		false,
 		true,
@@ -8488,8 +8529,15 @@ describe("accepted-control zero-execution bound (#4668)", () => {
 		try {
 			harness = await invocationHarness(sessionId, cwd, {
 				settings: {
+					// This test covers deferred terminal recovery, not deadline-triggered worktree persistence.
 					get: (key: string) =>
-						key === "sdk.promptDeadlineMs" ? 150 : key === "sdk.promptMaxRuntimeMs" ? 60_000 : undefined,
+						key === "sdk.promptDeadlineMs"
+							? 150
+							: key === "sdk.promptMaxRuntimeMs"
+								? 60_000
+								: key === "sdk.flushWorktreeOnDeadline"
+									? false
+									: undefined,
 				} as unknown as Settings,
 				sendUserMessage: async (_content, options) => {
 					await options?.onPreflightAcceptCommit?.();
@@ -8549,7 +8597,8 @@ describe("accepted-control zero-execution bound (#4668)", () => {
 			});
 
 			activeTools.clear();
-			expect(await settledStatus(harness, "turn.prompt_status", correlation)).toMatchObject({
+			// Keep this inside the 60s hard-runtime budget while tolerating a slow CI retry tick.
+			expect(await settledStatus(harness, "turn.prompt_status", correlation, 30_000)).toMatchObject({
 				status: "terminal_ok",
 				outcome: { kind: "stopped", reason: "cancelled" },
 			});
@@ -8559,7 +8608,7 @@ describe("accepted-control zero-execution bound (#4668)", () => {
 			await Bun.sleep(10);
 			await rm(cwd, { recursive: true, force: true });
 		}
-	});
+	}, 60_000);
 
 	test("an unproven real end stays private until exact settlement evidence exists", async () => {
 		// A matching lifecycle end still cannot settle a recovered deadline record

package/src/sdk/host/session-runtime.ts

@@ -35,6 +35,7 @@ import {
 	validateSettingPatch,
 } from "../../config/settings";
 import type { ExtensionAPI, ExtensionCommandContext, ExtensionContext } from "../../extensibility/extensions";
+import { tagSdkLifecycleObserver } from "../../extensibility/extensions/function-hooks-internal";
 import type { AgentEndEvent } from "../../extensibility/shared-events";
 import { normalizeGoal } from "../../goals/state";
 import { toAgentWireEventPayload } from "../../modes/shared/agent-wire/event-envelope";
@@ -6046,40 +6047,43 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 			resolveTerminalPublicationWaiters(observed, terminalPublicationByCorrelation);
 		}
 	};
-	api.on("agent_start", (event, ctx) => {
-		const owner = lifecycleStateForEvent(ctx, "agent_start", event.sdkRunToken);
-		// The activity checkpoint is already fire-and-forget and does not depend on
-		// the handler awaiting trackLifecycle, so it composes with #5683 unchanged.
-		void (owner?.runtime ?? lifecycleStateForContext(ctx, "agent_start")?.runtime)
-			?.reportActivity("active")
-			.catch(error => logger.warn(`sdk: active activity checkpoint failed: ${String(error)}`));
-		// Interactive/skill turns must not wait on durable start persist. Keep
-		// trackLifecycle so drain, persist-then-publish, content-hold release, and
-		// shutdown still run; do not return that promise to the extension runner
-		// (EXTENSION_HANDLER_TIMEOUT_MS would otherwise stall the prompt).
-		void trackLifecycle(
-			async () =>
-				emitLifecycle(
-					"agent_start",
-					ctx,
-					undefined,
-					undefined,
-					owner ? { state: owner, sessionId: owner.sessionId } : undefined,
-					undefined,
-					false,
-					undefined,
-					undefined,
-					typeof event.sdkRunToken === "string" ? event.sdkRunToken : undefined,
-					event.sdkRunTokens,
-					event.lifecycleScope,
-				),
-			owner,
-		).catch(error => {
-			logger.error("SDK agent_start lifecycle task failed", {
-				error: sanitizePromptFailure(error),
+	api.on(
+		"agent_start",
+		tagSdkLifecycleObserver((event, ctx) => {
+			const owner = lifecycleStateForEvent(ctx, "agent_start", event.sdkRunToken);
+			// The activity checkpoint is already fire-and-forget and does not depend on
+			// the handler awaiting trackLifecycle, so it composes with #5683 unchanged.
+			void (owner?.runtime ?? lifecycleStateForContext(ctx, "agent_start")?.runtime)
+				?.reportActivity("active")
+				.catch(error => logger.warn(`sdk: active activity checkpoint failed: ${String(error)}`));
+			// Interactive/skill turns must not wait on durable start persist. Keep
+			// trackLifecycle so drain, persist-then-publish, content-hold release, and
+			// shutdown still run; do not return that promise to the extension runner
+			// (EXTENSION_HANDLER_TIMEOUT_MS would otherwise stall the prompt).
+			void trackLifecycle(
+				async () =>
+					emitLifecycle(
+						"agent_start",
+						ctx,
+						undefined,
+						undefined,
+						owner ? { state: owner, sessionId: owner.sessionId } : undefined,
+						undefined,
+						false,
+						undefined,
+						undefined,
+						typeof event.sdkRunToken === "string" ? event.sdkRunToken : undefined,
+						event.sdkRunTokens,
+						event.lifecycleScope,
+					),
+				owner,
+			).catch(error => {
+				logger.error("SDK agent_start lifecycle task failed", {
+					error: sanitizePromptFailure(error),
+				});
 			});
-		});
-	});
+		}),
+	);
 	api.on("agent_end", (event, ctx) => {
 		const tokenBinding =
 			typeof event.sdkRunToken === "string" ? lifecycleRunOwners.get(event.sdkRunToken) : undefined;
@@ -6444,7 +6448,7 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 				const seams = options.terminalAbortSeams;
 				const handle = seams?.getActivePromptHandle();
 				const epoch = seams?.getTerminalTurnEpoch();
-				if (!seams || !handle || epoch === undefined || !seams.pendingToolExecutions) return;
+				if (!seams || !handle || epoch === undefined) return;
 				const existing = deadlineTerminalizationObservations.get(key);
 				if (existing) return () => cleanupDeadlineTerminalizationObservation(key, existing);
 
@@ -7075,7 +7079,33 @@ export function createSdkSessionRuntimeExtension(api: ExtensionAPI, options: Cre
 			() => acceptingGateResolutions,
 			trackGateResolution,
 			options.onInvocationCompletionReconciledForTests,
-			frame => runtime.emitEvent(frame),
+			frame => {
+				// Completion can win the durable transaction while a lifecycle end is
+				// still waiting on it. Both publishers must share the same claim.
+				if (typeof frame.commandId !== "string" || typeof frame.turnId !== "string") return;
+				const correlation = { commandId: frame.commandId, turnId: frame.turnId };
+				if (frame.type !== "agent_end") {
+					if (!hasClaimedTerminalBoundary(correlation)) runtime.emitEvent(frame);
+					return;
+				}
+				const key = lifecycleCorrelationKey(correlation);
+				if (!claimTerminalBoundary(correlation)) {
+					const previouslyPublished = terminalBoundaryClaims.publicationResult(key) === true;
+					if (previouslyPublished) return;
+					terminalBoundaryClaims.releaseClaim(key);
+					if (!claimTerminalBoundary(correlation)) return;
+				}
+				const sequenceBefore = runtime.host.events.sequence;
+				try {
+					runtime.emitEvent(frame);
+					terminalBoundaryClaims.setPublicationResult(key, true);
+				} catch (error) {
+					if (runtime.host.events.sequence > sequenceBefore)
+						terminalBoundaryClaims.setPublicationResult(key, true);
+					else terminalBoundaryClaims.releaseClaim(key);
+					throw error;
+				}
+			},
 			acceptedQueueCancellations,
 		);
 		const installProviderDefinitions = (capability: string, definitions: unknown): void => {

package/src/sdk/router/session-router.ts

@@ -1,7 +1,7 @@
 import * as crypto from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { logger, resolveEquivalentPath } from "@gajae-code/utils";
+import { logger, pathIdentityKey } from "@gajae-code/utils";
 import { endpointIncarnation, matchesIndexedEndpointFile } from "../broker/endpoint-authority";
 import {
 	canonicalSessionCwd,
@@ -1532,13 +1532,14 @@ export class SessionRouter {
 		const cwd = indexed.locator.cwd;
 		const defaultStateRoot = path.join(cwd, ".gjc", "state");
 		// Locator cwd is already canonical. `stateRoot` remains the host-provided
-		// authority path, so this comparison resolves equivalent paths only for the
-		// state-root identity boundary; cwd never retains lexical symlink spellings.
-		const indexedStateRoot = resolveEquivalentPath(indexed.locator.stateRoot);
+		// authority path, so compare filesystem identity here: case-insensitive
+		// Windows aliases match without rewriting I/O paths, while case-sensitive
+		// directories remain distinct.
+		const indexedStateRoot = pathIdentityKey(indexed.locator.stateRoot);
 		const scope =
-			indexedStateRoot === resolveEquivalentPath(defaultStateRoot)
+			indexedStateRoot === pathIdentityKey(defaultStateRoot)
 				? "default"
-				: indexedStateRoot === resolveEquivalentPath(path.join(defaultStateRoot, "chat"))
+				: indexedStateRoot === pathIdentityKey(path.join(defaultStateRoot, "chat"))
 					? "chat"
 					: undefined;
 		if (!scope || indexed.endpointMtimeMs === undefined || !Number.isFinite(indexed.endpointMtimeMs)) return null;

package/src/sdk/session.ts

@@ -47,13 +47,8 @@ import {
 	providerSupportsAppendOnlyAuto,
 	resolveAppendOnlyMode,
 } from "../append-only-mode";
-import {
-	type AsyncJob,
-	AsyncJobManager,
-	asyncJobEndpointId as deriveAsyncJobEndpointId,
-	isBackgroundJobSupportEnabled,
-	jobElapsedMs,
-} from "../async";
+import { type AsyncJob, AsyncJobManager, isBackgroundJobSupportEnabled, jobElapsedMs } from "../async";
+import { asyncJobEndpointId as deriveAsyncJobEndpointId } from "../async/endpoint-id";
 import { resolveBrowserBackend } from "../browser-backend";
 import { loadCapability, reset as resetCapabilities } from "../capability";
 import { type Rule, ruleCapability, setActiveRules } from "../capability/rule";