@aiwg/cli 2026.10.1 → 2026.10.4

package/dist/src/sessions/importer.js

@@ -1,18 +1,20 @@
-import { SESSION_CONTRACT_VERSION, SessionEventSchema, SessionSchema, assertSupportedSchemaMajor, sha256, stableEventId, stableSessionId, SessionContractError, } from './contracts.js';
-import { redactSessionText, sanitizeNativeExtensions } from './policy.js';
+import { SESSION_CONTRACT_VERSION, SessionEventSchema, SessionSchema, assertSupportedSchemaMajor, sha256, stableEventId, stableSessionId, SessionContractError, schemaIssueDetail, assertSessionResourceLimit, } from './contracts.js';
+import { assertImportByteLimit, DEFAULT_IMPORT_BYTE_LIMITS, resolveImportLimits } from './import-limits.js';
+import { redactSessionValue, sanitizeSessionEvent, sanitizeNativeExtensions } from './policy.js';
 import { fingerprintSourcePrefix } from './readers.js';
+import { DEFAULT_INACTIVITY_THRESHOLD_MS } from './lifecycle.js';
 import { classifySessionEventOrigin, deriveSessionIntent, } from './origin.js';
-const DEFAULT_LIMITS = {
+export const DEFAULT_IMPORT_LIMITS = {
     maxRecords: 1_000_000,
-    maxRecordBytes: 8 * 1024 * 1024,
-    maxTotalBytes: 1024 * 1024 * 1024,
+    ...DEFAULT_IMPORT_BYTE_LIMITS,
     batchSize: 1_000,
 };
 export class SessionImportFailure extends SessionContractError {
     failureReceipt;
     constructor(failureReceipt, cause) {
-        super(cause instanceof SessionContractError ? cause.code : 'IMPORT_INTERRUPTED', cause instanceof Error ? cause.message : 'session import failed');
+        super(cause instanceof SessionContractError ? cause.code : 'IMPORT_INTERRUPTED', cause instanceof Error ? cause.message : 'session import failed', cause instanceof SessionContractError ? cause.detail : undefined);
         this.failureReceipt = failureReceipt;
+        this.failureReceipt = redactSessionValue(failureReceipt).value;
         this.name = 'SessionImportFailure';
     }
 }
@@ -30,7 +32,9 @@ export class IncrementalSessionImporter {
         if (request.workspaceId !== request.selectedSource.authorizedScope.workspaceId) {
             throw new SessionContractError('SOURCE_NOT_AUTHORIZED', 'session import workspace is outside the authorized source scope');
         }
-        const limits = { ...DEFAULT_LIMITS, ...request.limits };
+        const limits = { ...DEFAULT_IMPORT_LIMITS, ...resolveImportLimits(undefined, {
+                maxRecordBytes: request.limits?.maxRecordBytes, maxSourceBytes: request.limits?.maxTotalBytes,
+            }), ...request.limits };
         const previous = request.batchRunId
             ? this.repository.getBatchCheckpoint(request.source.sourceId, request.adapter.adapterVersion, request.batchRunId) ?? this.repository.getCheckpoint(request.source.sourceId, request.adapter.adapterVersion)
             : this.repository.getCheckpoint(request.source.sourceId, request.adapter.adapterVersion);
@@ -40,17 +44,17 @@ export class IncrementalSessionImporter {
             : undefined;
         const sourceGeneration = continuity?.sourceGeneration ?? sourceGenerationDigest(request);
         if (previous?.sourceGeneration && previous.sourceGeneration !== sourceGeneration) {
-            throw new SessionContractError('SCHEMA_DRIFT', 'session source generation changed; explicit restart or migration is required');
+            throw new SessionContractError('SCHEMA_DRIFT', 'session source generation changed; explicit restart or migration is required', schemaIssueDetail('sourceGeneration'));
         }
         if (previous?.adapterVersion && previous.adapterVersion !== request.adapter.adapterVersion) {
-            throw new SessionContractError('SCHEMA_DRIFT', 'session checkpoint adapter version changed; checkpoint migration is required');
+            throw new SessionContractError('SCHEMA_DRIFT', 'session checkpoint adapter version changed; checkpoint migration is required', schemaIssueDetail('adapterVersion'));
         }
         if (previous?.sourceSchemaVersion
             && previous.sourceSchemaVersion !== request.source.sourceSchemaVersion) {
-            throw new SessionContractError('SCHEMA_DRIFT', 'session checkpoint source schema changed; checkpoint migration is required');
+            throw new SessionContractError('SCHEMA_DRIFT', 'session checkpoint source schema changed; checkpoint migration is required', schemaIssueDetail('sourceSchemaVersion'));
         }
         if (previous?.policyVersion && previous.policyVersion !== request.policyVersion) {
-            throw new SessionContractError('SCHEMA_DRIFT', 'session checkpoint policy version changed; checkpoint migration is required');
+            throw new SessionContractError('SCHEMA_DRIFT', 'session checkpoint policy version changed; checkpoint migration is required', schemaIssueDetail('policyVersion'));
         }
         const checkpoint = {
             cursor: previous?.cursor ?? '',
@@ -65,6 +69,7 @@ export class IncrementalSessionImporter {
             policyVersion: request.policyVersion,
             continuity: continuity
                 ? (!previous || previous.positionKind === 'byte-offset'
+                    || previous.positionKind === 'provider-native'
                     ? continuity.outcome
                     : 'unverified')
                 : (previous ? 'unverified' : 'new-generation'),
@@ -75,6 +80,7 @@ export class IncrementalSessionImporter {
         };
         const receipts = [];
         let batch = [];
+        let batchBytes = 0;
         let batchStart = checkpoint.recordsRead;
         let durableCheckpoint = { ...checkpoint };
         const importStarted = performance.now();
@@ -86,12 +92,14 @@ export class IncrementalSessionImporter {
             if (request.signal?.aborted) {
                 throw new SessionContractError('IMPORT_INTERRUPTED', 'session import was cancelled at a durable batch boundary');
             }
+            const identities = batch.map(recordIdentity);
+            const batchDigests = identities.map(identity => identity.digest);
             const runId = sha256([
                 request.source.sourceId, request.adapter.adapterVersion,
                 batchStart, checkpoint.recordsRead,
-                ...batch.map((record) => sha256(JSON.stringify(record))),
+                ...batchDigests,
             ].join('\0'));
-            const normalized = normalizeBatch(request, batch, runId, sourceObservedAt);
+            const normalized = normalizeBatch(request, batch, batchDigests, runId, sourceObservedAt);
             const run = {
                 contractVersion: SESSION_CONTRACT_VERSION,
                 importRunId: runId,
@@ -122,7 +130,7 @@ export class IncrementalSessionImporter {
             receipt.metrics = {
                 records: batch.length,
                 normalizedEvents: normalized.events.length,
-                normalizedBytes: batch.reduce((total, record) => total + Buffer.byteLength(JSON.stringify(record)), 0),
+                normalizedBytes: identities.reduce((bytes, identity) => bytes + identity.bytes, 0),
                 durationMs: performance.now() - importStarted,
                 batchLatencyMs: performance.now() - flushStarted,
                 heapUsedBytes: peakHeap,
@@ -132,26 +140,40 @@ export class IncrementalSessionImporter {
             receipts.push(receipt);
             durableCheckpoint = { ...checkpoint };
             batch = [];
+            batchBytes = 0;
             batchStart = checkpoint.recordsRead;
         };
         try {
+            if (continuity)
+                assertImportByteLimit('maxTotalBytes', limits, continuity.size);
             for await (const record of request.adapter.stream(request.selectedSource, previous ? { value: previous.cursor } : undefined)) {
                 if (request.signal?.aborted) {
                     throw new SessionContractError('IMPORT_INTERRUPTED', 'session import was cancelled and can resume from its durable checkpoint');
                 }
-                const bytes = Buffer.byteLength(JSON.stringify(record));
-                if (bytes > limits.maxRecordBytes
-                    || checkpoint.bytesRead + bytes > limits.maxTotalBytes
-                    || checkpoint.recordsRead + 1 > limits.maxRecords) {
-                    throw new SessionContractError('RESOURCE_LIMIT_EXCEEDED', 'session import exceeded an authorized resource limit');
-                }
+                const bytes = recordBytes(record);
+                assertImportByteLimit('maxRecordBytes', limits, bytes);
+                if (!continuity)
+                    assertImportByteLimit('maxTotalBytes', limits, checkpoint.bytesRead + bytes);
+                assertSessionResourceLimit('maxRecords', limits.maxRecords, checkpoint.recordsRead + 1);
+                // Bound batches by bytes as well as record count for large records.
+                if (batchBytes + bytes > 4 * 1024 * 1024)
+                    flush();
                 batch.push(record);
+                batchBytes += bytes;
                 checkpoint.recordsRead += 1;
                 if (record.sourceCursor?.startsWith('byte:')) {
                     checkpoint.positionKind = 'byte-offset';
                     checkpoint.cursor = record.sourceCursor;
                     checkpoint.bytesRead = Number(record.sourceCursor.slice(5));
                 }
+                else if (record.sourceCursor?.startsWith('native:')) {
+                    // An opaque provider-native resume token (e.g. a monotonic native
+                    // sequence) — never a byte offset. Stored verbatim; `bytesRead`
+                    // still accumulates so resource limits remain meaningful.
+                    checkpoint.positionKind = 'provider-native';
+                    checkpoint.cursor = record.sourceCursor;
+                    checkpoint.bytesRead += bytes;
+                }
                 else {
                     checkpoint.bytesRead += bytes;
                     checkpoint.cursor = String(checkpoint.recordsRead);
@@ -186,6 +208,7 @@ export class IncrementalSessionImporter {
                     : durableCheckpoint,
                 errorCode: error instanceof SessionContractError
                     ? error.code : 'IMPORT_INTERRUPTED',
+                detail: error instanceof SessionContractError ? error.detail : undefined,
             }, error);
         }
         if (request.publish !== false && request.source.consistency === 'complete') {
@@ -198,20 +221,30 @@ export class IncrementalSessionImporter {
         return receipts;
     }
 }
-function normalizeBatch(request, records, importRunId, sourceObservedAt) {
+/** Keep large temporary JSON strings out of the asynchronous import frame. */
+function recordBytes(record) {
+    return Buffer.byteLength(JSON.stringify(record));
+}
+/** Compute flush-time identity once, preserving adapters that mutate yielded objects. */
+function recordIdentity(record) {
+    const serialized = JSON.stringify(record);
+    return { bytes: Buffer.byteLength(serialized), digest: sha256(serialized) };
+}
+function normalizeBatch(request, records, digests, importRunId, sourceObservedAt) {
     const sessions = new Map();
-    const events = records.map((record) => {
+    const events = records.map((record, index) => {
         const sessionId = stableSessionId(request.source.provider, request.source.sourceId, record.nativeSessionId);
-        const redacted = redactSessionText(record.text);
         const native = sanitizeNativeExtensions(record.extensions ?? {});
-        const digest = sha256(JSON.stringify(record));
+        const lineage = request.source.provider === 'codex' && native.value.lineage
+            ? { lineage: native.value.lineage } : {};
+        const digest = digests[index];
         const origin = classifySessionEventOrigin(request.source.provider, record);
         const lifecycle = sessionLifecycle(request, record, sourceObservedAt);
         const lifecycleEvidence = sessionLifecycleEvidence(request, record, sourceObservedAt);
         const extensions = {
-            [`native.${request.source.provider}`]: native.value,
+            [`native.${request.source.provider}`]: record.extensions ?? {},
         };
-        const event = SessionEventSchema.parse({
+        const event = sanitizeSessionEvent(SessionEventSchema.parse({
             contractVersion: SESSION_CONTRACT_VERSION,
             eventId: stableEventId(request.source.provider, request.source.sourceId, record, digest),
             sessionId, sourceId: request.source.sourceId, importRunId,
@@ -229,17 +262,13 @@ function normalizeBatch(request, records, importRunId, sourceObservedAt) {
             model: record.model ?? null,
             entities: record.entities ?? [],
             extractionState: record.extractionState ?? null,
-            searchableText: redacted.text, digest, rawReference: record.rawReference,
+            searchableText: record.text, digest, rawReference: record.rawReference,
             adapterVersion: request.adapter.adapterVersion,
             consistency: request.source.consistency,
-            sensitivity: {
-                classification: redacted.sensitivity === 'sensitive' || native.sensitivity === 'sensitive'
-                    ? 'sensitive' : 'none',
-                classes: [...new Set([...redacted.classes, ...native.classes])].sort(),
-            },
+            sensitivity: { classification: 'none', classes: [] },
             opaque: !isKnownEventKind(record.kind),
             extensions,
-        });
+        }));
         if (!sessions.has(sessionId)) {
             sessions.set(sessionId, SessionSchema.parse({
                 contractVersion: SESSION_CONTRACT_VERSION,
@@ -251,6 +280,7 @@ function normalizeBatch(request, records, importRunId, sourceObservedAt) {
                 sourceDigest: sha256(`${sourceGenerationDigest(request)}\0${record.nativeSessionId}`),
                 extensions: {
                     [`native.${request.source.provider}`]: {
+                        ...lineage,
                         lifecycleEvidence,
                     },
                 },
@@ -270,6 +300,7 @@ function normalizeBatch(request, records, importRunId, sourceObservedAt) {
             session.lifecycle = selected.lifecycle;
             session.extensions[nativeKey] = {
                 ...nativeRecord,
+                ...lineage,
                 lifecycleEvidence: selected.evidence,
             };
         }
@@ -278,7 +309,7 @@ function normalizeBatch(request, records, importRunId, sourceObservedAt) {
     for (const session of sessions.values()) {
         session.intent = deriveSessionIntent(events.filter((event) => event.sessionId === session.sessionId));
     }
-    return { sessions: [...sessions.values()], events };
+    return { sessions: redactSessionValue([...sessions.values()]).value, events };
 }
 const KNOWN_EVENT_KINDS = new Set(['message', 'tool-call', 'tool-result', 'artifact', 'attachment', 'summary']);
 function isKnownEventKind(kind) {
@@ -354,6 +385,7 @@ function sessionLifecycleEvidence(request, record, sourceObservedAt) {
         state: 'active',
         observedAt: observedAt ?? request.source.authorizedAt,
         confidence: 'provisional',
+        thresholdMs,
     };
 }
 function nativeLifecycle(extensions) {
@@ -407,7 +439,6 @@ function evidenceTimestamp(value) {
     const parsed = Date.parse(String(value.observedAt ?? ''));
     return Number.isFinite(parsed) ? parsed : Number.NEGATIVE_INFINITY;
 }
-const DEFAULT_INACTIVITY_THRESHOLD_MS = 24 * 60 * 60 * 1000;
 function inactivityThresholdMs(request) {
     return request.inactivityThresholdMs ?? DEFAULT_INACTIVITY_THRESHOLD_MS;
 }
@@ -435,33 +466,40 @@ async function sourceContinuity(request, previous) {
         selectedPath: request.selectedSource.locator,
         allowedRoots: request.selectedSource.authorizedScope.allowedRoots,
     };
+    // Snapshot sources are rewritten wholesale on every save (no stable
+    // append-only byte region, and the file identity may legitimately change
+    // via rename-swap): skip the shrink, file-identity, and prefix-rewrite
+    // throws below. Idempotency instead rests on the adapter's own monotonic
+    // native cursor plus the catalog's identity-keyed inserts.
+    const isSnapshot = request.adapter.sourceContinuity === 'snapshot';
     const skipPrefixBytes = await request.adapter.mutablePrefixBytes?.(request.selectedSource) ?? 0;
     const metadata = await fingerprintSourcePrefix(authorization, 0);
-    if (previous?.sourceSize !== undefined) {
+    if (!isSnapshot && previous?.sourceSize !== undefined) {
         if (metadata.size < previous.sourceSize) {
-            throw new SessionContractError('SCHEMA_DRIFT', 'session source was truncated before its durable checkpoint');
+            throw new SessionContractError('SCHEMA_DRIFT', 'session source was truncated before its durable checkpoint', schemaIssueDetail('sourceSize'));
         }
         if (previous.sourceFileIdentity
             && previous.sourceFileIdentity !== metadata.fileIdentity) {
-            throw new SessionContractError('SCHEMA_DRIFT', 'session source file generation was replaced or rotated');
+            throw new SessionContractError('SCHEMA_DRIFT', 'session source file generation was replaced or rotated', schemaIssueDetail('sourceFileIdentity'));
         }
         const priorPrefix = await fingerprintSourcePrefix(authorization, previous.sourceSize, skipPrefixBytes);
         if (previous.prefixDigest && priorPrefix.digest !== previous.prefixDigest) {
-            throw new SessionContractError('SCHEMA_DRIFT', 'session source prefix was rewritten before its durable checkpoint');
+            throw new SessionContractError('SCHEMA_DRIFT', 'session source prefix was rewritten before its durable checkpoint', schemaIssueDetail('prefixDigest'));
         }
     }
     const current = await fingerprintSourcePrefix(authorization, metadata.size, skipPrefixBytes);
-    const generation = previous?.sourceGeneration ?? sha256([
-        sourceGenerationDigest(request),
-        metadata.fileIdentity,
-    ].join('\0'));
+    const generation = previous?.sourceGeneration ?? (isSnapshot
+        ? sourceGenerationDigest(request)
+        : sha256([sourceGenerationDigest(request), metadata.fileIdentity].join('\0')));
     return {
         sourceGeneration: generation,
         outcome: !previous
             ? 'new-generation'
-            : metadata.size === previous.sourceSize
-                && current.digest === previous.prefixDigest
-                ? 'unchanged-replay' : 'validated-append',
+            : isSnapshot
+                ? (current.digest === previous.prefixDigest ? 'unchanged-replay' : 'validated-append')
+                : metadata.size === previous.sourceSize
+                    && current.digest === previous.prefixDigest
+                    ? 'unchanged-replay' : 'validated-append',
         size: metadata.size,
         mtimeMs: metadata.mtimeMs,
         fileIdentity: metadata.fileIdentity,

package/dist/src/sessions/index.js

@@ -42,4 +42,6 @@ export * from './adapters/warp.js';
 export * from './adapters/windsurf.js';
 export * from './adapters/muse.js';
 export * from './adapters/omp.js';
+export * from './adapter-registry.js';
+export * from './coverage-preflight.js';
 //# sourceMappingURL=index.js.map

package/dist/src/sessions/lifecycle.js

@@ -0,0 +1,45 @@
+export const DEFAULT_INACTIVITY_THRESHOLD_MS = 24 * 60 * 60 * 1000;
+export function effectiveSessionLifecycle(session) {
+    if (session.lifecycle !== 'active' && session.lifecycle !== 'inactive')
+        return session;
+    const nativeKey = `native.${session.provider}`;
+    const native = objectRecord(session.extensions[nativeKey]);
+    const evidence = objectRecord(native.lifecycleEvidence);
+    if (evidence.basis !== 'open-provisional-source'
+        && evidence.basis !== 'inactivity-threshold')
+        return session;
+    const observedAt = session.updatedAt ?? evidence.observedAt;
+    const timestamp = typeof observedAt === 'string' ? Date.parse(observedAt) : NaN;
+    if (!Number.isFinite(timestamp))
+        return session;
+    const thresholdMs = typeof evidence.thresholdMs === 'number'
+        && Number.isFinite(evidence.thresholdMs)
+        && evidence.thresholdMs >= 0
+        ? evidence.thresholdMs : DEFAULT_INACTIVITY_THRESHOLD_MS;
+    const inactive = Date.now() - timestamp > thresholdMs;
+    const lifecycle = inactive ? 'inactive' : 'active';
+    return {
+        ...session,
+        lifecycle,
+        extensions: {
+            ...session.extensions,
+            [nativeKey]: {
+                ...native,
+                lifecycleEvidence: {
+                    ...evidence,
+                    basis: inactive ? 'inactivity-threshold' : 'open-provisional-source',
+                    state: lifecycle,
+                    observedAt,
+                    confidence: inactive ? 'medium' : 'provisional',
+                    thresholdMs,
+                },
+            },
+        },
+    };
+}
+function objectRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+//# sourceMappingURL=lifecycle.js.map

package/dist/src/sessions/policy.js

@@ -27,7 +27,9 @@ export async function authorizeSourceFile(input) {
         throw new SessionContractError('SOURCE_NOT_REGULAR_FILE', 'session source must be a regular file');
     }
     if (input.maxBytes !== undefined && stat.size > input.maxBytes) {
-        throw new SessionContractError('RESOURCE_LIMIT_EXCEEDED', 'session source exceeds the authorized byte limit');
+        throw new SessionContractError('RESOURCE_LIMIT_EXCEEDED', 'session source exceeds the authorized byte limit', {
+            limit: 'maxBytes', configured: input.maxBytes, observed: stat.size,
+        });
     }
     return {
         canonicalPath,
@@ -54,21 +56,51 @@ async function safeRealpath(path, root = false) {
         throw new SessionContractError('SOURCE_NOT_AUTHORIZED', root ? 'an authorized source root is inaccessible' : 'selected session source is inaccessible');
     }
 }
+// Ambiguous token components are bounded; whitespace and key blocks use disjoint scans.
 const SECRET_PATTERNS = [
-    ['private-key', /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g],
-    ['bearer-token', /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/gi],
-    ['authorization', /\bAuthorization\s*:\s*[^\r\n]+/gi],
-    ['cookie', /\b(?:Cookie|Set-Cookie)\s*:\s*[^\r\n]+/gi],
-    ['credential', /\b(?:api[_-]?key|token|password|secret)\s*(?:[:=]|\s)\s*["']?[^\s"',;]{6,}/gi],
-    ['provider-token', /\b(?:sk-(?:proj-)?|gh[pousr]_|github_pat_|xox[baprs]-|AKIA)[A-Za-z0-9._~+/=-]{8,}\b/g],
+    ['bearer-token', /\bBearer[ \t]+[A-Za-z0-9._~+/=-]{12,}/gi],
+    ['authorization', /\bAuthorization[ \t]*:[ \t]*[^\r\n]+/gi],
+    ['cookie', /\b(?:Cookie|Set-Cookie)[ \t]*:[ \t]*[^\r\n]+/gi],
+    ['environment-assignment', /\b(?:AWS_SECRET_ACCESS_KEY|[A-Z][A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|API_KEY))[ \t]*=[ \t]*(?:"[^"\r\n]+"|'[^'\r\n]+'|[^\s]+)/gi],
+    ['credential', /\b(?:api[_-]?key|token|password|secret)[ \t]*[:=][ \t]*["']?[^\s"',;]{6,}/gi],
+    ['credential', /^[ \t]*password[ \t]+[^\s]+[ \t]*$/gim],
+    // Space-separated values only when they look generated (20+ chars, letters and digits), so prose stays.
+    ['credential', /\b(?:api[_-]?key|token|secret)[ \t]+(?=[A-Za-z0-9._~+/=-]*[0-9])(?=[A-Za-z0-9._~+/=-]*[A-Za-z])[A-Za-z0-9._~+/=-]{20,}/gi],
+    ['provider-token', /\b(?:sk-(?:ant-|proj-)?|[sr]k_(?:live|test)_|gh[pousr]_|github_pat_|glpat-|xai-|npm_|hf_|xox[baprs]-|AKIA|AIza)[A-Za-z0-9._~+/=-]{8,}/g],
+    ['provider-token', /https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9_-]+\/[A-Za-z0-9_-]+\/[A-Za-z0-9_-]+/g],
     ['connection-string', /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis):\/\/[^\s]+/gi],
     ['credential-url', /\bhttps?:\/\/[^/\s:@]+:[^/\s@]+@[^\s]+/gi],
-    ['environment-assignment', /\b[A-Z][A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|API_KEY)\s*=\s*(?:"[^"]+"|'[^']+'|[^\s]+)/g],
     ['fixture-credential', /\bredaction-canary-[A-Za-z0-9_-]+\b/gi],
-    ['email', /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi],
+    ['email', /\b[A-Z0-9._%+-]{1,64}@[A-Z0-9.-]{1,253}\.[A-Z]{2,63}\b/gi],
 ];
+function redactJwts(input, mark) {
+    // Consume even incomplete candidates. Retrying at each inner `eyJ` in an
+    // unterminated segment would repeatedly scan the remainder of a large record.
+    return input.replace(/\beyJ[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+){0,2}/g, (candidate) => {
+        const parts = candidate.split('.');
+        return parts.length === 3 && parts[0].length >= 8 && parts[1].length >= 2 && parts[2].length >= 8
+            ? mark('provider-token') : candidate;
+    });
+}
+const PRIVATE_KEY_BEGIN = /-----BEGIN ((?:(?:RSA|EC|DSA|OPENSSH|ENCRYPTED) )?PRIVATE KEY|PGP PRIVATE KEY BLOCK)-----/g;
+function redactPrivateKeys(input, mark) {
+    const parts = [];
+    let cursor = 0;
+    PRIVATE_KEY_BEGIN.lastIndex = 0;
+    let match;
+    while ((match = PRIVATE_KEY_BEGIN.exec(input))) {
+        parts.push(input.slice(cursor, match.index), mark('private-key'));
+        const endMarker = `-----END ${match[1]}-----`;
+        const end = input.indexOf(endMarker, PRIVATE_KEY_BEGIN.lastIndex);
+        // An unfinished key block is sensitive through the end of the record.
+        cursor = end < 0 ? input.length : end + endMarker.length;
+        PRIVATE_KEY_BEGIN.lastIndex = cursor;
+    }
+    parts.push(input.slice(cursor));
+    return parts.join('');
+}
 const SENSITIVE_KEY = /(?:authorization|auth[_-]?header|cookie|credential|password|passwd|secret|token|api[_-]?key|private[_-]?key|connection[_-]?string)/i;
-const CONTENT_KEY = /(?:^|[_-])(?:text|content|prompt|command|arguments?|args|result|output|body|request|response|source|code|query)(?:$|[_-])/i;
+const CONTENT_KEY = /(?:^|[_-])(?:data|text|content|prompt|command|arguments?|args|result|output|body|request|response|source|code|query)(?:$|[_-])/i;
 const PATH_KEY = /(?:^|[_-])(?:path|cwd|directory|filename|file)(?:$|[_-])/i;
 const SAFE_STRING_KEY = /(?:^|[_-])(?:id|kind|type|role|status|state|lifecycle|reason|name|product|provider|version|schema|model|format|class|mode|event|operation|tool|method|language|scope|consistency|disposition|phase|visibility|protocol|category|classification|decision|capability|permission|transition|hash|digest)(?:$|[_-])/i;
 const CONTROL_CHARACTERS = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g;
@@ -103,23 +135,28 @@ export function sanitizeNativeExtensions(input, overrides = {}) {
             return marker('depth-limit');
         if (value === null || typeof value === 'boolean' || typeof value === 'number')
             return value;
+        if (typeof value === 'string' && /^\[REDACTED:[a-z-]+\]$/.test(value))
+            return value;
+        if (SENSITIVE_KEY.test(classifiedKey))
+            return marker('sensitive-field');
+        if (CONTENT_KEY.test(classifiedKey))
+            return marker('content');
+        if (PATH_KEY.test(classifiedKey))
+            return marker('path');
         if (typeof value === 'bigint')
             return String(value);
         if (typeof value !== 'string' && typeof value !== 'object') {
             return marker('unsupported-value');
         }
         if (typeof value === 'string') {
-            if (SENSITIVE_KEY.test(classifiedKey))
-                return marker('sensitive-field');
-            if (CONTENT_KEY.test(classifiedKey))
-                return marker('content');
-            if (PATH_KEY.test(classifiedKey))
-                return marker('path');
             if (Buffer.byteLength(value) > limits.maxStringBytes)
                 return marker('string-limit');
             const redacted = redactSessionText(value);
             for (const classification of redacted.classes)
                 classes.add(classification);
+            for (const [classification, count] of Object.entries(redacted.decisions)) {
+                decisions[classification] = (decisions[classification] ?? 0) + count;
+            }
             if (redacted.classes.length) {
                 decisions['classified-value'] = (decisions['classified-value'] ?? 0) + 1;
                 return redacted.text.replace(CONTROL_CHARACTERS, ' ');
@@ -142,8 +179,15 @@ export function sanitizeNativeExtensions(input, overrides = {}) {
             const output = {};
             const entries = Object.entries(value);
             for (const [childKey, childValue] of entries.slice(0, limits.maxObjectKeys)) {
-                output[childKey.replace(/\r?\n/g, ' ').replace(CONTROL_CHARACTERS, '')] =
-                    visit(childValue, childKey, depth + 1);
+                const safeKey = redactSessionText(childKey);
+                for (const classification of safeKey.classes)
+                    classes.add(classification);
+                for (const [classification, count] of Object.entries(safeKey.decisions)) {
+                    decisions[classification] = (decisions[classification] ?? 0) + count;
+                }
+                Object.defineProperty(output, safeKey.text.replace(/\r?\n/g, ' ').replace(CONTROL_CHARACTERS, ''), {
+                    value: visit(childValue, childKey, depth + 1), enumerable: true, configurable: true, writable: true,
+                });
             }
             if (entries.length > limits.maxObjectKeys)
                 output.__truncated__ = marker('object-key-limit');
@@ -165,15 +209,79 @@ export function sanitizeNativeExtensions(input, overrides = {}) {
     };
 }
 export function redactSessionText(input) {
-    const classes = new Set();
-    let text = input;
+    const decisions = {};
+    const mark = (classification) => {
+        decisions[classification] = (decisions[classification] ?? 0) + 1;
+        return `[REDACTED:${classification}]`;
+    };
+    let text = redactJwts(redactPrivateKeys(input, mark), mark);
     for (const [classification, pattern] of SECRET_PATTERNS) {
-        text = text.replace(pattern, () => {
-            classes.add(classification);
-            return `[REDACTED:${classification}]`;
-        });
+        // Every email match requires an at-sign. Avoid costly bounded local-part
+        // backtracking on large records containing only email-shaped near matches.
+        if (classification === 'email' && !text.includes('@'))
+            continue;
+        text = text.replace(pattern, () => mark(classification));
     }
-    return { text, sensitivity: classes.size ? 'sensitive' : 'none', classes: [...classes].sort() };
+    const classes = Object.keys(decisions).sort();
+    return { text, sensitivity: classes.length ? 'sensitive' : 'none', classes, decisions };
+}
+/** Redact every string, including object keys, without changing canonical field shapes. */
+export function redactSessionValue(input) {
+    const decisions = {};
+    const active = new WeakSet();
+    const text = (value) => {
+        const result = redactSessionText(value);
+        for (const [key, count] of Object.entries(result.decisions)) {
+            decisions[key] = (decisions[key] ?? 0) + count;
+        }
+        return result.text;
+    };
+    const visit = (value, depth) => {
+        if (typeof value === 'string')
+            return text(value);
+        if (!value || typeof value !== 'object')
+            return value;
+        if (depth > 64 || active.has(value))
+            return '[REDACTED:structure-limit]';
+        active.add(value);
+        try {
+            return Array.isArray(value)
+                ? value.map((item) => visit(item, depth + 1))
+                : Object.fromEntries(Object.entries(value).map(([key, item]) => [text(key), visit(item, depth + 1)]));
+        }
+        finally {
+            active.delete(value);
+        }
+    };
+    const value = visit(input, 0);
+    return { value, classes: Object.keys(decisions).sort(), decisions };
+}
+/** Shared import boundary for canonical text, metadata and bounded native attributes. */
+export function sanitizeSessionEvent(input) {
+    const native = sanitizeNativeExtensions(input.extensions);
+    const result = redactSessionValue({ ...input, extensions: native.value });
+    const event = result.value;
+    const classes = [...new Set([...event.sensitivity.classes, ...native.classes, ...result.classes])].sort();
+    event.sensitivity = {
+        classification: classes.length ? 'sensitive' : 'none', classes,
+    };
+    // Counts contain classifications only, never matched input or excerpts.
+    const prior = event.extensions['native.redaction'];
+    const counts = {};
+    for (const item of Array.isArray(prior?.decisions) ? prior.decisions : []) {
+        if (item && typeof item.classification === 'string' && Number.isSafeInteger(item.count) && item.count >= 0) {
+            counts[item.classification] = item.count;
+        }
+    }
+    for (const decisions of [native.decisions, result.decisions]) {
+        for (const [key, count] of Object.entries(decisions)) {
+            counts[key] = (counts[key] ?? 0) + count;
+        }
+    }
+    event.extensions['native.redaction'] = {
+        decisions: Object.entries(counts).map(([classification, count]) => ({ classification, count })),
+    };
+    return event;
 }
 export function contentFreeAuditEvent(event) {
     return Object.freeze({ ...event, counts: { ...event.counts } });