fix(gjc): upgrade to SDK 0.16.4 with workflow identity regression coverage - #30
Merged
Merged
Conversation
… key Regression test for issue #18: an app-shaped SDK session (explicit providerSessionId, persisted transcript) must expose the logical, path-safe session id through getSessionId() while the async endpoint key lives on getAsyncEndpointId(), and no encoded _session-["async-job-endpoint",...] tree may appear. RED on the current 0.15.6 pin (getSessionId() returns the JSON tuple, reproducing the issue); turns GREEN once the pin carries Yeachan-Heo/gajae-code#5282.
This was referenced Sep 4, 2026
devswha
changed the title
devswha
marked this pull request as ready for review
September 5, 2026 17:26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upgrade the app SDK from 0.15.6 to 0.16.4, which separates workflow session identity from the async endpoint key. The regression retains the former explicit-provider-ID input and now verifies a path-safe logical ID, the dedicated async accessor and deep-interview state placement. Closes #18.
Regenerate the macOS arm64 and Linux x64 native closures, command catalog and shipped notices. Use a deterministic user profile in the adapter test so upstream built-in profile model changes do not invalidate the fixture. Preserve the app's existing redundant-ID mitigation.
Validation: full
npm run verifypassed; GJC E2E 8/8 passed without skips; isolated credentialed Astra/xhigh response and abort smoke passed. The dependency gate reports no unexpected high/critical advisories (the existing extract-zip exception remains).Issue #3 is separate: the real SDK child permission-bypass regression still reproduces on 0.16.4, so unrestricted built-in delegation remains disabled pending the policy-preserving app executor.