@gajae-code/coding-agent 0.7.5 → 0.7.7

package/src/modes/controllers/selector-controller.ts

@@ -51,6 +51,7 @@ import {
 	setPreferredImageProvider,
 	setPreferredSearchProvider,
 	setSearchFallbackProviders,
+	setSearchHardTimeoutMs,
 } from "../../tools";
 import { setSessionTerminalTitle } from "../../utils/title-generator";
 import { AgentDashboard } from "../components/agent-dashboard";
@@ -641,6 +642,11 @@ export class SelectorController {
 					);
 				}
 				break;
+			case "web_search.timeout":
+				if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+					setSearchHardTimeoutMs(value * 1000);
+				}
+				break;
 			case "providers.image":
 				if (
 					value === "auto" ||

package/src/notifications/lifecycle-commands.ts

@@ -11,6 +11,7 @@
  * prompt text ever enters a frame, audit, log, or response until daemon-owned
  * 0600 prompt refs are designed.
  */
+import * as os from "node:os";
 import type { SessionCloseTarget, SessionCreateTarget, SessionLifecycleResponse, SessionResumeTarget } from "./index";
 
 export type LifecycleCommandVerb = "session_create" | "session_close" | "session_resume";
@@ -94,22 +95,21 @@ export function parseLifecycleCommand(text: string | undefined): ParsedLifecycle
 	const kind = args[0];
 	if (kind === "path") {
 		if (args.length !== 2) return { kind: "usage", message: USAGE };
-		const p = args[1]!;
-		if (!isSafePath(p)) return { kind: "reject", reason: "invalid_target", message: `Invalid path.\n\n${USAGE}` };
+		const p = normalizeLifecyclePath(args[1]!);
+		if (!p) return { kind: "reject", reason: "invalid_target", message: `Invalid path.\n\n${USAGE}` };
 		return { kind: "create", target: { kind: "existing_path", path: p } };
 	}
 	if (kind === "dir") {
 		if (args.length !== 2) return { kind: "usage", message: USAGE };
-		const p = args[1]!;
-		if (!isSafePath(p)) return { kind: "reject", reason: "invalid_target", message: `Invalid dir.\n\n${USAGE}` };
+		const p = normalizeLifecyclePath(args[1]!);
+		if (!p) return { kind: "reject", reason: "invalid_target", message: `Invalid dir.\n\n${USAGE}` };
 		return { kind: "create", target: { kind: "plain_dir", path: p } };
 	}
 	if (kind === "worktree") {
 		if (args.length !== 3) return { kind: "usage", message: USAGE };
-		const repo = args[1]!;
+		const repo = normalizeLifecyclePath(args[1]!);
 		const branch = args[2]!;
-		if (!isSafePath(repo))
-			return { kind: "reject", reason: "invalid_target", message: `Invalid repo path.\n\n${USAGE}` };
+		if (!repo) return { kind: "reject", reason: "invalid_target", message: `Invalid repo path.\n\n${USAGE}` };
 		if (!isSafeBranch(branch)) {
 			return { kind: "reject", reason: "invalid_target", message: `Invalid branch name.\n\n${USAGE}` };
 		}
@@ -137,10 +137,10 @@ export function validateLifecycleTarget(
 	if (verb === "session_create") {
 		const t = target as SessionCreateTarget;
 		if (t.kind === "existing_path" || t.kind === "plain_dir") {
-			return isSafePath(t.path) ? { ok: true } : bad("invalid path");
+			return normalizeLifecyclePath(t.path) ? { ok: true } : bad("invalid path");
 		}
 		if (t.kind === "worktree") {
-			if (!isSafePath(t.repo)) return bad("invalid repo path");
+			if (!normalizeLifecyclePath(t.repo)) return bad("invalid repo path");
 			return isSafeBranch(t.branch) ? { ok: true } : bad("invalid branch");
 		}
 		return bad("unknown create target");
@@ -156,6 +156,16 @@ export function validateLifecycleTarget(
 // --- Safety primitives (defensive; the full-trust paired chat is accepted, but
 // we still reject obviously malformed/injection-shaped inputs early). ---
 
+export function normalizeLifecyclePath(value: string): string | undefined {
+	if (!isSafePath(value)) return undefined;
+	if (value === "~") return os.homedir() || undefined;
+	if (value.startsWith("~/")) {
+		const home = os.homedir();
+		return home ? `${home}${value.slice(1)}` : undefined;
+	}
+	if (value.startsWith("~")) return undefined;
+	return value;
+}
 function isSafeIdentifier(value: string): boolean {
 	return /^[A-Za-z0-9._-]{1,128}$/.test(value);
 }

package/src/notifications/lifecycle-control-runtime.ts

@@ -22,6 +22,7 @@ import {
 	statusGjcTmuxSession,
 } from "../gjc-runtime/tmux-sessions";
 import type { ResumeCandidate, SessionCreateFrame, SessionLifecycleRequest, SessionLifecycleResponse } from "./index";
+import { normalizeLifecyclePath } from "./lifecycle-commands";
 import {
 	type AuditEvent,
 	type CreateEffectResult,
@@ -132,12 +133,16 @@ export function buildCreateArgv(
 	_ids: { intendedSessionId: string; startupPromptRef?: string },
 ): { cwd: string; args: string[] } {
 	if (frame.target.kind === "worktree") {
+		const cwd = normalizeLifecyclePath(frame.target.repo);
+		if (!cwd) throw new Error("invalid_lifecycle_repo_path");
 		// Use the `--worktree=<branch>` form so the branch is a single argv token:
 		// a flag-shaped branch (e.g. `-x`) can never be mis-parsed as a separate
 		// launcher flag / detached-mode trigger.
-		return { cwd: frame.target.repo, args: [`--worktree=${frame.target.branch}`] };
+		return { cwd, args: [`--worktree=${frame.target.branch}`] };
 	}
-	return { cwd: frame.target.path, args: [] };
+	const cwd = normalizeLifecyclePath(frame.target.path);
+	if (!cwd) throw new Error("invalid_lifecycle_path");
+	return { cwd, args: [] };
 }
 
 /** Real daemon-safe tmux launcher: detached `tmux new-session -d` + GJC tags. */

package/src/prompts/system/system-prompt.md

@@ -194,9 +194,9 @@ Delegate by default for multi-file changes, refactors, new features, tests, and
 </detached-subagents>
 {{/has}}
 
-{{#has tools "inspect_image"}}
+{{#has tools "read"}}
 <images>
-For image understanding, use `{{toolRefs.inspect_image}}` with a specific question instead of reading raw image metadata only.
+For image understanding, call `{{toolRefs.read}}` on the image path; the image is returned inline for direct visual inspection.
 </images>
 {{/has}}
 

package/src/prompts/tools/cron.md

@@ -1,12 +1,14 @@
 Schedule a prompt to fire on a recurring cron schedule, or one-shot at the next match. Cron tasks let you re-run a prompt automatically on an interval — poll a deployment, babysit a PR, check back on a long-running build, or remind yourself to do something later in the session.
 
-`CronCreate` accepts a standard 5-field cron expression in your local timezone, the prompt to run, and whether the job recurs or fires once. It returns an 8-character job id you can pass to `CronDelete`. Each session can hold up to 50 scheduled tasks. Recurring tasks auto-expire 7 days after creation; one-shot tasks self-delete after firing.
+Use a single `op` field to select the operation:
 
-`CronList` enumerates every scheduled task in the session. `CronDelete` cancels a task by id.
+- `op: "create"` accepts a standard 5-field `cron_expression` in your local timezone, the `prompt` to run, and `recurring` (whether the job recurs or fires once). It returns an 8-character job id you can pass to `op: "delete"`. Each session can hold up to 50 scheduled tasks. Recurring tasks auto-expire 7 days after creation; one-shot tasks self-delete after firing.
+- `op: "list"` enumerates every scheduled task in the session.
+- `op: "delete"` cancels a task by `id`.
 
 ## Cron expressions
 
-`CronCreate` accepts 5-field cron: `minute hour day-of-month month day-of-week`. All fields support `*`, single values (`5`), steps (`*/15`), ranges (`1-5`), and comma lists (`1,15,30`). Day-of-week uses `0`/`7` for Sunday through `6` for Saturday. Extended syntax like `L`, `W`, `?`, or month/weekday names is not supported.
+`op: "create"` accepts 5-field cron: `minute hour day-of-month month day-of-week`. All fields support `*`, single values (`5`), steps (`*/15`), ranges (`1-5`), and comma lists (`1,15,30`). Day-of-week uses `0`/`7` for Sunday through `6` for Saturday. Extended syntax like `L`, `W`, `?`, or month/weekday names is not supported.
 
 | Example       | Meaning                      |
 | :------------ | :--------------------------- |

package/src/prompts/tools/read.md

@@ -46,7 +46,7 @@ Extracts text from PDF, Word, PowerPoint, Excel, RTF, and EPUB. Notebooks (`.ipy
 
 # Images
 
-Reading an image path returns metadata (mime, bytes, dimensions, channels, alpha). For actual visual analysis, call `inspect_image` with the path and a question describing what to inspect.
+Reading an image path returns the image itself for visual inspection by a vision-capable model.
 
 # Archives
 

package/src/sdk.ts

@@ -140,6 +140,7 @@ import {
 	setPreferredImageProvider,
 	setPreferredSearchProvider,
 	setSearchFallbackProviders,
+	setSearchHardTimeoutMs,
 	type Tool,
 	type ToolSession,
 	WebSearchTool,
@@ -941,6 +942,10 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			webSearchFallback.filter(value => typeof value === "string" && isConfigurableSearchProviderId(value)),
 		);
 	}
+	const webSearchTimeout = settings.get("web_search.timeout");
+	if (typeof webSearchTimeout === "number" && Number.isFinite(webSearchTimeout) && webSearchTimeout > 0) {
+		setSearchHardTimeoutMs(webSearchTimeout * 1000);
+	}
 
 	const imageProvider = settings.get("providers.image");
 	if (

package/src/session/agent-session.ts

@@ -250,6 +250,7 @@ import { releaseTabsForOwner } from "../tools/browser/tab-supervisor";
 import type { CheckpointState } from "../tools/checkpoint";
 import { outputMeta, wrapToolWithMetaNotice } from "../tools/output-meta";
 import { normalizeLocalScheme, resolveToCwd } from "../tools/path-utils";
+import { registerResourceGcSession } from "../tools/resource-gc";
 import { getLatestTodoPhasesFromEntries, type TodoItem, type TodoPhase } from "../tools/todo-write";
 import { ToolAbortError, ToolError } from "../tools/tool-errors";
 import { clampTimeout } from "../tools/tool-timeouts";
@@ -964,6 +965,8 @@ export class AgentSession {
 	// Python execution state
 	#evalAbortControllers = new Set<AbortController>();
 	#evalKernelOwnerId: string;
+	/** Idempotent unregister handle for this session's resource-GC registration. */
+	#unregisterResourceGc?: () => void;
 	/**
 	 * AsyncJobManager owned by this session (top-level only). Subagents leave
 	 * this undefined and **MUST NOT** dispose the global instance on teardown.
@@ -1180,6 +1183,15 @@ export class AgentSession {
 		this.sessionManager = config.sessionManager;
 		this.settings = config.settings;
 		this.taskDepth = config.taskDepth ?? 0;
+		// Register this session with the process-wide resource GC (idle/RSS browser-tab eviction
+		// + stale screenshot cleanup). Session-keyed so concurrent sessions share one timer safely.
+		const resourceGcSessionId = this.sessionManager.getSessionId();
+		if (resourceGcSessionId) {
+			this.#unregisterResourceGc = registerResourceGcSession({
+				sessionId: resourceGcSessionId,
+				settings: this.settings,
+			});
+		}
 		// Power assertions are taken per turn (see #beginInFlight); nothing acquired here.
 		this.#evalKernelOwnerId = config.evalKernelOwnerId ?? `agent-session:${Snowflake.next()}`;
 		this.#ownedAsyncJobManager = config.ownedAsyncJobManager;
@@ -3285,6 +3297,8 @@ export class AgentSession {
 		// browsers disconnect, headless close gracefully). Scoped by the session id the
 		// browser tool tagged tabs with, so other live sessions' tabs are untouched.
 		// No-op when this session opened no tabs. Failure is logged, not thrown.
+		this.#unregisterResourceGc?.();
+		this.#unregisterResourceGc = undefined;
 		await releaseTabsForOwner(this.sessionManager.getSessionId()).catch((error: unknown) =>
 			logger.warn("session dispose: releaseTabsForOwner failed", { error }),
 		);
@@ -3324,6 +3338,8 @@ export class AgentSession {
 	async disposeChildSubprocesses(timeoutMs = SIGNAL_TEARDOWN_TIMEOUT_MS): Promise<void> {
 		const sessionId = this.sessionManager.getSessionId();
 		const kernelOwnerId = this.#evalKernelOwnerId;
+		this.#unregisterResourceGc?.();
+		this.#unregisterResourceGc = undefined;
 		const work = Promise.allSettled([
 			// kill:true so a forced exit also reaps spawned-app Chrome we own (headless
 			// always closes; connected/attached browsers only disconnect — never killed).
@@ -5231,6 +5247,19 @@ export class AgentSession {
 			attribution: "user",
 			timestamp: Date.now(),
 		});
+		// A live agent loop polls the steering queue at every tool/turn boundary
+		// and consumes this message on its own. But when a steer is queued while no
+		// loop is actively running — e.g. the session still reports busy only
+		// because a finished prompt is unwinding (deferred agent_end / post-prompt
+		// work) — nothing delivers it until the next explicit prompt or a
+		// user-interrupt abort, so it stalls until the user presses Esc. Schedule a
+		// continue so the steer is delivered promptly. A live loop (or an
+		// already-drained queue) makes the scheduled continue a no-op.
+		if (this.#canAutoContinueForSteer()) {
+			this.#scheduleAgentContinue({
+				shouldContinue: () => this.#canAutoContinueForSteer() && this.agent.hasQueuedSteering(),
+			});
+		}
 	}
 
 	/**
@@ -5275,6 +5304,21 @@ export class AgentSession {
 		return last?.role === "assistant";
 	}
 
+	/**
+	 * Gate for idle / winding-down steer auto-continue. Unlike the follow-up gate
+	 * this checks `agent.state.isStreaming` (a live agent loop) rather than the
+	 * public `isStreaming` (which stays true while a finished prompt unwinds), so a
+	 * steer queued during the unwind window is still delivered. A live loop returns
+	 * false here because it polls the steering queue itself.
+	 */
+	#canAutoContinueForSteer(): boolean {
+		if (this.agent.state.isStreaming) return false;
+		if (this.isRetrying) return false;
+		const messages = this.agent.state.messages;
+		const last = messages[messages.length - 1];
+		return last?.role === "assistant";
+	}
+
 	queueDeferredMessage(message: CustomMessage): void {
 		this.#queueHiddenNextTurnMessage(message, true);
 	}

package/src/session/session-manager.ts

@@ -1324,6 +1324,8 @@ const RESIDENT_EXTERNALIZE_STRING_EXCLUDED_KEYS = new Set([
 	"toolName",
 	"targetId",
 	"firstKeptEntryId",
+	"encrypted_content",
+	"reasoning_encrypted_content",
 ]);
 
 function shouldExternalizeResidentString(key: string | undefined): boolean {
@@ -1515,6 +1517,40 @@ function cloneSessionEntry(entry: SessionEntry): SessionEntry {
 	return { ...entry, message: cloneAgentMessage(entry.message) } as SessionEntry;
 }
 
+function materializeProviderVisibleEntrySync(entry: SessionEntry, stores: ResidentBlobStores): SessionEntry {
+	if (entry.type === "compaction") {
+		const cache = new Map<string, string>();
+		const summary = materializeResidentValueSync(entry.summary, stores, "summary", cache);
+		const shortSummary = materializeResidentValueSync(entry.shortSummary, stores, "shortSummary", cache);
+		const remote = entry.preserveData?.openaiRemoteCompaction;
+		const remoteRecord = isRecord(remote) ? remote : undefined;
+		const replacementHistory = remoteRecord
+			? materializeResidentValueSync(remoteRecord.replacementHistory, stores, "replacementHistory", cache)
+			: undefined;
+		const preserveData =
+			remoteRecord && replacementHistory !== undefined && replacementHistory !== remoteRecord.replacementHistory
+				? {
+						...entry.preserveData,
+						openaiRemoteCompaction: {
+							...remoteRecord,
+							replacementHistory,
+						},
+					}
+				: entry.preserveData;
+		return {
+			...entry,
+			summary: typeof summary === "string" ? summary : entry.summary,
+			shortSummary: typeof shortSummary === "string" ? shortSummary : entry.shortSummary,
+			preserveData,
+		};
+	}
+	if (entry.type === "branch_summary") {
+		const summary = materializeResidentValueSync(entry.summary, stores, "summary", new Map<string, string>());
+		return typeof summary === "string" ? { ...entry, summary } : { ...entry };
+	}
+	return cloneSessionEntry(entry);
+}
+
 const COLD_SPILL_NOTICE = "[Compacted history content evicted to durable cold storage]";
 const COLD_SPILL_ARGUMENTS_SENTINEL_KEY = "__gjcColdSpillArguments";
 const COLD_SPILL_MIN_CHARS = 1024;
@@ -1533,19 +1569,6 @@ type ColdSpillResidentPromotion = {
 function isRecord(value: unknown): value is Record<string, unknown> {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-
-function isColdSpillRef(value: unknown): value is ColdSpillRef {
-	return (
-		isRecord(value) &&
-		value.kind === "cold_spill" &&
-		typeof value.ref === "string" &&
-		(value.encoding === "utf8" || value.encoding === "json") &&
-		typeof value.originalChars === "number" &&
-		typeof value.sha256 === "string" &&
-		typeof value.bytes === "number"
-	);
-}
-
 function isColdSpillArgumentsSentinel(value: unknown): value is Record<string, unknown> {
 	return isRecord(value) && value[COLD_SPILL_ARGUMENTS_SENTINEL_KEY] === true;
 }
@@ -4008,8 +4031,7 @@ export class SessionManager {
 		const firstKept = this.#byId.get(firstKeptEntryId);
 		const compaction = this.#byId.get(compactionEntryId);
 		if (!firstKept) throw new Error(`Entry ${firstKeptEntryId} not found`);
-		if (!compaction || compaction.type !== "compaction")
-			throw new Error(`Compaction entry ${compactionEntryId} not found`);
+		if (compaction?.type !== "compaction") throw new Error(`Compaction entry ${compactionEntryId} not found`);
 		const ids: string[] = [];
 		const visited = new Set<string>();
 		let current: SessionEntry | undefined = compaction;
@@ -4351,7 +4373,8 @@ export class SessionManager {
 		if (coldSpillPolicy === "covered" && (entry.type === "message" || entry.type === "custom_message")) {
 			return cloneSessionEntry(entry);
 		}
-		if (entry.type !== "message" && entry.type !== "custom_message") return cloneSessionEntry(entry);
+		if (entry.type !== "message" && entry.type !== "custom_message")
+			return materializeProviderVisibleEntrySync(entry, this.#residentBlobStores());
 		const materialized = materializeResidentEntrySync(entry, this.#residentBlobStores(), new Map());
 		const rehydrated = rehydrateColdSpillEntry(
 			materialized,

package/src/tools/browser/tab-supervisor.ts

@@ -57,6 +57,10 @@ export interface TabSession {
 	kindTag: BrowserKindTag;
 	/** Session that acquired this tab; used for session-scoped teardown (F13). */
 	ownerId?: string;
+	/** Unix-ms timestamp of the last acquire/run activity; drives GC idle + LRU ordering. */
+	lastUsedAt: number;
+	/** Set synchronously by the shared begin-release guard so concurrent release is a no-op. */
+	releasing?: boolean;
 }
 
 export interface AcquireTabOptions {
@@ -94,6 +98,76 @@ export function getTab(name: string): TabSession | undefined {
 	return tabs.get(name);
 }
 
+/**
+ * Shared synchronous begin-release guard. Returns true for the first caller (which then
+ * owns teardown) and false for any concurrent/repeat caller, so `releaseBrowser` and the
+ * `BrowserHandle.refCount` decrement happen exactly once even when the idle sweep, the RSS
+ * sweep, a manual close, and `forceKillTab` race on the same tab.
+ */
+function beginRelease(tab: TabSession): boolean {
+	if (tab.releasing) return false;
+	tab.releasing = true;
+	return true;
+}
+
+/** Read-only, GC-facing projection of a live tab. Never exposes the mutable `tabs` map. */
+export interface TabGcSnapshot {
+	name: string;
+	ownerId?: string;
+	state: TabSession["state"];
+	pendingCount: number;
+	kindTag: BrowserKindTag;
+	lastUsedAt: number;
+	browserRefCount: number;
+}
+
+export interface BrowserGcEligibilityPolicy {
+	now: () => number;
+	idleMs: number;
+}
+
+/** Snapshot every live tab for GC ordering/diagnostics. */
+export function listTabsForGc(): TabGcSnapshot[] {
+	return [...tabs.values()].map(tab => ({
+		name: tab.name,
+		ownerId: tab.ownerId,
+		state: tab.state,
+		pendingCount: tab.pending.size,
+		kindTag: tab.kindTag,
+		lastUsedAt: tab.lastUsedAt,
+		browserRefCount: tab.browser.refCount,
+	}));
+}
+
+/**
+ * Evict a tab only if it is still GC-eligible against the LIVE supervisor state. The full
+ * predicate is checked synchronously and `releaseTab` is invoked with no intervening await,
+ * so a tab that became busy after a GC snapshot cannot be closed (its run rejected). Returns
+ * true only when the tab was actually released.
+ */
+export async function releaseTabIfGcEligible(name: string, policy: BrowserGcEligibilityPolicy): Promise<boolean> {
+	const tab = tabs.get(name);
+	if (!tab) return false;
+	if (tab.releasing) return false;
+	if (tab.state !== "alive") return false;
+	if (tab.pending.size !== 0) return false;
+	if (tab.kindTag !== "headless" && tab.kindTag !== "spawned") return false;
+	if (policy.now() - tab.lastUsedAt <= policy.idleMs) return false;
+	// All predicates passed synchronously; releaseTab applies the shared begin-release guard
+	// on the same microtask, so no other code runs between the check and the state transition.
+	return await releaseTab(name, { kill: false });
+}
+
+/** Test-only: install a fabricated tab session. */
+export function setTabForTest(tab: TabSession): void {
+	tabs.set(tab.name, tab);
+}
+
+/** Test-only: clear the tab registry between cases. */
+export function clearTabsForTest(): void {
+	tabs.clear();
+}
+
 export async function acquireTab(
 	name: string,
 	browser: BrowserHandle,
@@ -105,6 +179,7 @@ export async function acquireTab(
 			if (opts.dialogs !== undefined && opts.dialogs !== existing.dialogPolicy) {
 				await releaseTab(name, { kill: false });
 			} else {
+				existing.lastUsedAt = Date.now();
 				if (opts.url) {
 					await runInTabWithSnapshot(
 						name,
@@ -166,6 +241,7 @@ export async function acquireTab(
 		dialogPolicy: opts.dialogs,
 		kindTag: browser.kind.kind,
 		ownerId: opts.ownerId,
+		lastUsedAt: Date.now(),
 	};
 	worker.onMessage(msg => handleTabMessage(tab, msg));
 	tabs.set(name, tab);
@@ -188,6 +264,7 @@ async function runInTabWithSnapshot(
 	const tab = tabs.get(name);
 	if (!tab || tab.state === "dead") throw new ToolError(`Tab ${JSON.stringify(name)} is not alive. Reopen it.`);
 	if (tab.pending.size > 0) throw new ToolError(`Tab ${JSON.stringify(name)} is busy`);
+	tab.lastUsedAt = Date.now();
 	const id = Snowflake.next();
 	const { promise, resolve, reject } = Promise.withResolvers<RunResultOk>();
 	const pending: PendingRun = {
@@ -224,6 +301,10 @@ export async function releaseTab(name: string, opts: ReleaseTabOptions = {}): Pr
 		logger.debug("releaseTab: unknown tab", { name });
 		return false;
 	}
+	if (!beginRelease(tab)) {
+		logger.debug("releaseTab: already releasing", { name });
+		return false;
+	}
 	const wasAlive = tab.state === "alive";
 	tab.state = "dead";
 	const closeError = new ToolError(`Tab ${JSON.stringify(name)} was closed`);
@@ -246,7 +327,9 @@ export async function releaseTab(name: string, opts: ReleaseTabOptions = {}): Pr
 	await tab.worker.terminate().catch(() => undefined);
 	if (forced && tab.kindTag === "headless") await closeOrphanTarget(tab);
 	await releaseBrowser(tab.browser, { kill: opts.kill ?? false });
-	tabs.delete(name);
+	// Only delete if the map still holds THIS tab: a same-name reacquire during our async
+	// teardown may have installed a fresh tab that we must not evict.
+	if (tabs.get(name) === tab) tabs.delete(name);
 	return true;
 }
 
@@ -392,6 +475,7 @@ function toErrorPayload(error: unknown): RunErrorPayload {
 async function forceKillTab(name: string, reason: string): Promise<void> {
 	const tab = tabs.get(name);
 	if (!tab) return;
+	if (!beginRelease(tab)) return;
 	tab.state = "dead";
 	const error = new ToolError(reason);
 	for (const pending of tab.pending.values()) pending.reject(error);
@@ -399,7 +483,7 @@ async function forceKillTab(name: string, reason: string): Promise<void> {
 	await tab.worker.terminate().catch(() => undefined);
 	if (tab.kindTag === "headless") await closeOrphanTarget(tab);
 	await releaseBrowser(tab.browser, { kill: false });
-	tabs.delete(name);
+	if (tabs.get(name) === tab) tabs.delete(name);
 }
 
 async function closeOrphanTarget(tab: TabSession): Promise<void> {

package/src/tools/computer-gc.ts

@@ -0,0 +1,66 @@
+import type { Dirent } from "node:fs";
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { logger } from "@gajae-code/utils";
+
+/** Prefix of every computer-use screenshot fallback directory created under the OS temp dir. */
+export const SCREENSHOT_FALLBACK_DIR_PREFIX = "gjc-computer-screenshots-";
+
+let screenshotFallbackDirsCreated = false;
+
+/** Lazy-arm marker: called when the first screenshot fallback dir is created this process. */
+export function markScreenshotFallbackDirCreatedForGc(): void {
+	screenshotFallbackDirsCreated = true;
+}
+
+/** Whether any screenshot fallback dir has been created this process (GC lazy-arm gate). */
+export function hasCreatedScreenshotFallbackDir(): boolean {
+	return screenshotFallbackDirsCreated;
+}
+
+/** Test-only: reset the lazy-arm marker between cases. */
+export function resetScreenshotFallbackGcForTest(): void {
+	screenshotFallbackDirsCreated = false;
+}
+
+export interface ScreenshotGcOptions {
+	now: () => number;
+	staleMs: number;
+	/** Base dir to scan; defaults to os.tmpdir(). Injectable for tests. */
+	tmpDir?: string;
+}
+
+/**
+ * Disk-only GC for stale computer-use screenshot fallback directories. Scans the temp dir for
+ * `gjc-computer-screenshots-*` directories and removes those whose mtime is older than `staleMs`.
+ * Never throws on a per-directory failure; the whole sweep is best-effort.
+ */
+export async function cleanupStaleScreenshotFallbackDirs(
+	options: ScreenshotGcOptions,
+): Promise<{ scanned: number; removed: number }> {
+	const base = options.tmpDir ?? os.tmpdir();
+	const entries: Dirent[] = await fs.readdir(base, { withFileTypes: true }).catch(err => {
+		logger.debug("screenshot GC: failed to read temp dir", { base, error: (err as Error).message });
+		return [] as Dirent[];
+	});
+
+	const now = options.now();
+	let scanned = 0;
+	let removed = 0;
+	for (const entry of entries) {
+		if (!entry.isDirectory()) continue;
+		if (!entry.name.startsWith(SCREENSHOT_FALLBACK_DIR_PREFIX)) continue;
+		scanned++;
+		const dir = path.join(base, entry.name);
+		try {
+			const stat = await fs.stat(dir);
+			if (now - stat.mtimeMs <= options.staleMs) continue;
+			await fs.rm(dir, { recursive: true, force: true });
+			removed++;
+		} catch (err) {
+			logger.debug("screenshot GC: failed to remove stale dir", { dir, error: (err as Error).message });
+		}
+	}
+	return { scanned, removed };
+}

package/src/tools/computer.ts

@@ -7,6 +7,7 @@ import { prompt } from "@gajae-code/utils";
 import * as z from "zod/v4";
 import computerDescription from "../prompts/tools/computer.md" with { type: "text" };
 import { resizeImage } from "../utils/image-resize";
+import { markScreenshotFallbackDirCreatedForGc } from "./computer-gc";
 import type { ToolSession } from "./index";
 import type { OutputMeta } from "./output-meta";
 import { ToolAbortError, ToolError, throwIfAborted } from "./tool-errors";
@@ -547,6 +548,7 @@ function getScreenshotFallbackDir(session: ToolSession): Promise<string> {
 async function createScreenshotFallbackDir(): Promise<string> {
 	const dir = await fs.mkdtemp(path.join(os.tmpdir(), "gjc-computer-screenshots-"));
 	await fs.chmod(dir, 0o700);
+	markScreenshotFallbackDirCreatedForGc();
 	return dir;
 }