@gajae-code/coding-agent 0.18.8 → 0.18.9

package/src/async/job-manager.ts

@@ -3443,16 +3443,22 @@ export class AsyncJobManager {
 			return;
 		}
 
-		this.#deliveryLoop = this.#runDeliveryLoop()
+		const completion = Promise.withResolvers<void>();
+		const promise = completion.promise;
+		this.#deliveryLoop = promise;
+		const operation = this.#runDeliveryLoop()
 			.catch(error => {
 				logger.error("Async job delivery loop crashed", { error: String(error) });
 			})
 			.finally(() => {
-				this.#deliveryLoop = undefined;
-				if (!this.#disposed && this.#hasDeliverable()) {
-					this.#ensureDeliveryLoop();
+				if (this.#deliveryLoop === promise) {
+					this.#deliveryLoop = undefined;
+					if (!this.#disposed && this.#hasDeliverable()) {
+						this.#ensureDeliveryLoop();
+					}
 				}
 			});
+		void operation.then(completion.resolve, completion.reject);
 	}
 
 	async #runDeliveryLoop(): Promise<void> {
@@ -3472,14 +3478,15 @@ export class AsyncJobManager {
 				continue;
 
 			this.#deliveries.splice(index, 1);
-			this.#notifyChange();
 			await this.#deliverDelivery(delivery);
 		}
 	}
 
 	#deliverDelivery(delivery: AsyncJobDelivery): Promise<void> {
-		const promise = (async () => {
-			this.#inFlightDeliveries.push(delivery);
+		const completion = Promise.withResolvers<void>();
+		delivery.promise = completion.promise;
+		this.#inFlightDeliveries.push(delivery);
+		const operation = (async () => {
 			this.#notifyChange();
 			try {
 				const currentJob = this.#jobs.get(delivery.jobId);
@@ -3532,12 +3539,14 @@ export class AsyncJobManager {
 				if (!this.#disposed && this.#hasDeliverable()) this.#ensureDeliveryLoop();
 			}
 		})();
-		delivery.promise = promise;
-		return promise;
+		void operation.then(completion.resolve, completion.reject);
+		return completion.promise;
 	}
 
 	async #waitForDeliveryPromise(promise: Promise<void> | undefined, deadline: number): Promise<boolean> {
-		if (!promise) return true;
+		// Missing an enrolled in-flight future is uncertainty, never evidence of
+		// successful settlement.
+		if (!promise) return false;
 		if (deadline === Number.POSITIVE_INFINITY) {
 			await promise;
 			return true;

package/src/async/support.ts

@@ -1,31 +1,6 @@
-import * as path from "node:path";
-import { resolveEquivalentPath } from "@gajae-code/utils";
 import type { Settings } from "../config/settings";
 
 export function isBackgroundJobSupportEnabled(settings: Pick<Settings, "get">): boolean {
 	void settings;
 	return true;
 }
-
-/**
- * Single source of truth for the AsyncJobManager endpoint key.
- *
- * A session with an explicit provider session id is keyed by (provider id,
- * transcript path); everything else is keyed by its logical session id. The
- * transcript component is canonicalized so a path alias — symlink, `..`
- * segment, or unresolved relative path — cannot register the manager under one
- * key at construction and look it up under another across a session-identity
- * transition, stranding ownership.
- *
- * Both the SDK constructor and AgentSession's transition rekeying must derive
- * the key here; duplicating the shape lets the two drift apart silently.
- */
-export function asyncJobEndpointId(
-	providerSessionId: string | undefined,
-	sessionId: string,
-	sessionFile: string | undefined,
-): string {
-	return providerSessionId !== undefined && sessionFile !== undefined
-		? JSON.stringify(["async-job-endpoint", providerSessionId, resolveEquivalentPath(path.resolve(sessionFile))])
-		: sessionId;
-}

package/src/capability/index.ts

@@ -22,7 +22,7 @@ import {
 } from "@gajae-code/utils";
 
 import type { Settings } from "../config/settings";
-import { resolveGlobalUserSkillLinkTrust } from "../config/skill-settings-defaults";
+import { resolveGlobalUserSkillLinkTrust, resolveSkillScopeTrust } from "../config/skill-settings-defaults";
 import { clearCache as clearFsCache, findRepoRoot, cacheStats as fsCacheStats, invalidate as invalidateFs } from "./fs";
 import type {
 	Capability,
@@ -74,6 +74,17 @@ const EXPLICIT_HOME_PROVIDER_ROOTS = [
 
 const ANCESTOR_SCOPED_PROJECT_PROVIDERS = new Set(["agents", "agents-md", "cline"]);
 
+function resolveExternalUserSkillSymlinkTrust(settings: Settings | undefined): boolean {
+	const userOwnedTrust = resolveGlobalUserSkillLinkTrust({
+		trustUserSkills:
+			typeof settings?.getGlobal === "function" ? settings.getGlobal("skills.trustUserSkills") : undefined,
+		enablePiUser: typeof settings?.getGlobal === "function" ? settings.getGlobal("skills.enablePiUser") : undefined,
+	});
+	const effectiveScopeTrust =
+		typeof settings?.getGroup === "function" ? resolveSkillScopeTrust(settings.getGroup("skills"), "user") : true;
+	return userOwnedTrust && effectiveScopeTrust;
+}
+
 function isWithinOrEqual(root: string, candidate: string): boolean {
 	const relative = path.relative(root, candidate);
 	return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
@@ -415,7 +426,6 @@ export async function loadCapability<T>(capabilityId: string, options: LoadOptio
 	const cwd = ordinaryOptions.cwd ?? getProjectDir();
 	const home = getTrustedHomeDir();
 	const activeSettings = ordinaryOptions.settings ?? settingsByCwd.get(path.normalize(cwd));
-	const globalSettings = typeof activeSettings?.getGlobal === "function" ? activeSettings : undefined;
 	const userAgentDir = ordinaryOptions.agentDir ? path.resolve(ordinaryOptions.agentDir) : getAgentDir();
 	const profileAuthority =
 		ordinaryOptions.profileAuthority ??
@@ -432,10 +442,7 @@ export async function loadCapability<T>(capabilityId: string, options: LoadOptio
 		repoRoot,
 		isolatedHome: false,
 		settings: ordinaryOptions.settings,
-		allowExternalUserSkillSymlinks: resolveGlobalUserSkillLinkTrust({
-			trustUserSkills: globalSettings?.getGlobal("skills.trustUserSkills"),
-			enablePiUser: globalSettings?.getGlobal("skills.enablePiUser"),
-		}),
+		allowExternalUserSkillSymlinks: resolveExternalUserSkillSymlinkTrust(activeSettings),
 		bypassCache: ordinaryOptions.bypassCache,
 	};
 	const providers = filterProviders(capability, ordinaryOptions);
@@ -528,16 +535,7 @@ export async function loadCapabilityForHome<T>(
 		isolatedHome,
 		homeIdentity,
 		settings: isolatedOptions.settings,
-		allowExternalUserSkillSymlinks: resolveGlobalUserSkillLinkTrust({
-			trustUserSkills:
-				typeof isolatedOptions.settings?.getGlobal === "function"
-					? isolatedOptions.settings.getGlobal("skills.trustUserSkills")
-					: undefined,
-			enablePiUser:
-				typeof isolatedOptions.settings?.getGlobal === "function"
-					? isolatedOptions.settings.getGlobal("skills.enablePiUser")
-					: undefined,
-		}),
+		allowExternalUserSkillSymlinks: resolveExternalUserSkillSymlinkTrust(isolatedOptions.settings),
 	};
 
 	return await loadImpl(capability, providers, ctx, isolatedOptions);

package/src/cli/doctor/repairs.ts

@@ -954,7 +954,10 @@ export async function executeSelectedDoctorRepair(
 					},
 					afterChecks,
 				};
-			const preEffect = outcome.kind === "owner_unavailable" || outcome.kind === "prepare_refused";
+			const preEffect =
+				outcome.kind === "owner_unavailable" ||
+				outcome.kind === "prepare_refused" ||
+				outcome.kind === "attach_only_refused";
 			return {
 				repair: {
 					...plan,

package/src/cli/doctor-supervisor.ts

@@ -74,6 +74,9 @@ const WORKER_ENV_KEYS = [
 	"XDG_DATA_HOME",
 	"XDG_STATE_HOME",
 	"XDG_CACHE_HOME",
+	// SDK_BROKER_AUTOSTART_ENV (sdk/broker/ensure.ts), kept literal so this supervisor stays
+	// import-light. A supervisor-owned broker must stay unrestartable from the doctor worker.
+	"GJC_SDK_BROKER_AUTOSTART",
 ] as const;
 
 const COMPILED = /(?:\/\$bunfs\/|\/~BUN\/|\/%7EBUN\/)/i.test(import.meta.url);

package/src/cli/public-command-registry.ts

@@ -81,6 +81,9 @@ const argument = (description: string, extra: Partial<PublicArgumentDescriptor>
 	...extra,
 });
 const agentDir = stringFlag("SDK broker/state directory (default: the configured agent directory).");
+const attachOnly = booleanFlag(
+	"Attach only to a live SDK broker; never start, retire or restart one (same as GJC_SDK_BROKER_AUTOSTART=0).",
+);
 const repo = stringFlag("Workspace directory for scope or saved-session resolution (default: current directory).");
 const exactSessionRepo = stringFlag(
 	"Accepted for compatibility only; ignored because the exact session ID selects the broker target.",
@@ -187,7 +190,8 @@ function node(path: string, input: NodeInput): PublicCommandDescriptor {
 		examples: [{ syntax: example ?? `gjc ${path} --help --json`, executable: false }],
 	};
 }
-const sessionFlags = { "agent-dir": agentDir };
+const guideFlags = { "agent-dir": agentDir };
+const sessionFlags = { "agent-dir": agentDir, "attach-only": attachOnly };
 const observeDaemonFlags = {
 	all: booleanFlag("Target all registered daemon kinds."),
 	verbose: booleanFlag("Show runtime detail and the full roots list.", { char: "v" }),
@@ -212,7 +216,7 @@ const daemonArgs = {
 export const PUBLIC_COMMANDS: readonly PublicCommandDescriptor[] = [
 	node("sdk", {
 		description: "Discover SDK transports, sessions, search, spawn and advisory guides.",
-		children: ["serve", "search", "spawn", "session", "guides"],
+		children: ["serve", "broker", "search", "spawn", "session", "guides"],
 		syntax: "<command>",
 		constraints: [
 			"A public child command is required unless requesting help or root evidence retrieval.",
@@ -242,6 +246,24 @@ export const PUBLIC_COMMANDS: readonly PublicCommandDescriptor[] = [
 		],
 		example: "gjc sdk serve --stdio",
 	}),
+	node("sdk broker", {
+		description: "Run the SDK broker under an external supervisor.",
+		children: ["run"],
+		syntax: "<command>",
+	}),
+	node("sdk broker run", {
+		description:
+			"Run the SDK broker in the foreground for a supervisor (systemd, launchd); stable contract, never detaches.",
+		flags: { "agent-dir": agentDir },
+		syntax: "[--agent-dir <dir>]",
+		risk: "Owns the broker for the agent directory; clients should run attach-only (GJC_SDK_BROKER_AUTOSTART=0) so they never start a competing one.",
+		constraints: [
+			"Stays in the foreground until SIGTERM or SIGINT, stops gracefully, then exits with the signal status (143 or 130).",
+			"Exits 1 without serving when another live broker owns the agent directory (it never retires it) or startup fails.",
+			"Exits 1 if it loses its discovery root or cannot renew its heartbeat while serving; a broker.shutdown request exits 0.",
+		],
+		example: "gjc sdk broker run --agent-dir ~/.gjc/agent",
+	}),
 	node("sdk search", {
 		description: "Search broker-visible sessions in an exact repo, pwd or global scope.",
 		syntax: "[--scope repo|pwd|global] [--repo <dir>] [--limit <N>] [--cursor <cursor>]",
@@ -442,7 +464,7 @@ export const PUBLIC_COMMANDS: readonly PublicCommandDescriptor[] = [
 	node("sdk guides refresh", {
 		description: "Fetch and verify an allowlisted HTTPS guide manifest and advisory cache.",
 		flags: {
-			...sessionFlags,
+			...guideFlags,
 			url: stringFlag("HTTPS allowlisted manifest URL.", { required: true }),
 			"timeout-ms": positive("Bounded refresh timeout in milliseconds."),
 		},
@@ -451,14 +473,14 @@ export const PUBLIC_COMMANDS: readonly PublicCommandDescriptor[] = [
 			"A fallback cache or bundled selection is an operational refresh failure, not online refresh success.",
 		],
 	}),
-	node("sdk guides list", { description: "List guides from the verified advisory selection.", flags: sessionFlags }),
+	node("sdk guides list", { description: "List guides from the verified advisory selection.", flags: guideFlags }),
 	node("sdk guides show", {
 		description: "Read a verified guide by ID.",
 		args: { guideId: argument("Exact guide ID from guides list.") },
-		flags: sessionFlags,
+		flags: guideFlags,
 		syntax: "<guideId>",
 	}),
-	node("sdk guides status", { description: "Report guide cache and selection status.", flags: sessionFlags }),
+	node("sdk guides status", { description: "Report guide cache and selection status.", flags: guideFlags }),
 	node("sdk guides trust", { description: "Show the static guide trust policy; no refresh or cache mutation." }),
 	node("daemon", {
 		description: "Manage Telegram, Discord and Slack background daemons, not the SDK broker.",

package/src/commands/mcp-serve.ts

@@ -7,6 +7,7 @@ import {
 } from "../coordinator/contract";
 import { runCoordinatorMcpStdio } from "../coordinator-mcp/server";
 import { type BrokerDiscovery, readBrokerDiscovery } from "../sdk/broker/discovery";
+import { SDK_BROKER_AUTOSTART_ENV } from "../sdk/broker/ensure";
 import { UnsupportedStateVersionError } from "../sdk/broker/state-version";
 import { runSdkMcpStdio, SDK_MCP_TOOL_NAMES } from "../sdk/mcp/server";
 
@@ -104,6 +105,10 @@ export default class McpServe extends Command {
 	static flags = {
 		json: Flags.boolean({ char: "j", description: "Emit machine-readable JSON", default: false }),
 		check: Flags.boolean({ description: "Validate server configuration and print a smoke summary", default: false }),
+		"attach-only": Flags.boolean({
+			description: "Attach only to a live SDK broker; never start one (same as GJC_SDK_BROKER_AUTOSTART=0)",
+			default: false,
+		}),
 	};
 
 	async run(): Promise<void> {
@@ -122,6 +127,8 @@ export default class McpServe extends Command {
 			return;
 		}
 
+		if (flags["attach-only"]) process.env[SDK_BROKER_AUTOSTART_ENV] = "0";
+
 		if (flags.check) {
 			if (!flags.json) {
 				const serverName = server === "sdk" ? "gjc-sdk-mcp" : COORDINATOR_MCP_SERVER_NAME;