@cjhyy/code-shell-core 0.5.0-rc.0 → 0.5.0-rc.2

package/dist/run/RunQueue.d.ts

@@ -11,6 +11,7 @@ export type RunQueueExecutor = (runId: string) => Promise<void>;
 export declare class RunQueue {
     private readonly concurrency;
     private readonly pending;
+    private readonly pendingSet;
     private readonly active;
     private executor;
     private draining;

package/dist/run/RunQueue.js

@@ -6,7 +6,10 @@
  */
 export class RunQueue {
     concurrency;
+    // `pending` keeps FIFO order; `pendingSet` mirrors its membership for O(1)
+    // dedup/lookup (the array's includes() was O(n)).
     pending = [];
+    pendingSet = new Set();
     active = new Set();
     executor = null;
     draining = false;
@@ -17,15 +20,17 @@ export class RunQueue {
         this.executor = fn;
     }
     enqueue(runId) {
-        if (this.pending.includes(runId) || this.active.has(runId))
+        if (this.pendingSet.has(runId) || this.active.has(runId))
             return;
         this.pending.push(runId);
+        this.pendingSet.add(runId);
         this.drain();
     }
     cancel(runId) {
         const idx = this.pending.indexOf(runId);
         if (idx !== -1) {
             this.pending.splice(idx, 1);
+            this.pendingSet.delete(runId);
             return true;
         }
         return false;
@@ -34,7 +39,7 @@ export class RunQueue {
         return this.active.has(runId);
     }
     isPending(runId) {
-        return this.pending.includes(runId);
+        return this.pendingSet.has(runId);
     }
     get activeCount() {
         return this.active.size;
@@ -57,6 +62,7 @@ export class RunQueue {
             return;
         while (this.active.size < this.concurrency && this.pending.length > 0) {
             const runId = this.pending.shift();
+            this.pendingSet.delete(runId);
             this.active.add(runId);
             this.executor(runId)
                 .catch((err) => {

package/dist/run/factory.d.ts

@@ -56,6 +56,13 @@ export interface CreateRunManagerOptions {
     defaultTags?: string[];
     /** Metadata merged into every submitted run. Submit input wins on conflicts. */
     defaultMetadata?: Record<string, unknown>;
+    /**
+     * Override the approval backend for every run. Used by unattended hosts
+     * (automation/cron) that must auto-decide without a UI — e.g.
+     * `new HeadlessApprovalBackend("approve-read-only")`. When unset, runs use
+     * the interactive run-aware backend.
+     */
+    approvalBackend?: import("../tool-system/permission.js").ApprovalBackend;
 }
 /**
  * Create a fully configured RunManager with one call.

package/dist/run/factory.js

@@ -41,6 +41,7 @@ export function createRunManager(options) {
             customSystemPrompt: options.customSystemPrompt,
             appendSystemPrompt: options.appendSystemPrompt,
             hooks: options.hooks,
+            ...(options.approvalBackend ? { approvalBackend: options.approvalBackend } : {}),
         },
         concurrency: options.concurrency ?? 1,
         runsDir,

package/dist/run/index.d.ts

@@ -9,9 +9,9 @@ export { RunQueue } from "./RunQueue.js";
 export { RunApprovalBackend, createRunAskUserFn, type RunLifecycleHooks, type PendingApproval, type PendingInput, } from "./RunApprovalBackend.js";
 export { CheckpointWriter, type CheckpointWriterConfig } from "./CheckpointWriter.js";
 export { ArtifactTracker, type ArtifactTrackerConfig } from "./ArtifactTracker.js";
-export { RunLock, type RunLockConfig } from "./RunLock.js";
+export { RunLock, type RunLockConfig, type RunLockAcquireResult } from "./RunLock.js";
 export { Heartbeat, type HeartbeatConfig, type HeartbeatData } from "./Heartbeat.js";
 export { NoopEvaluator, CompositeEvaluator, type Evaluator, type EvaluatorResult, type EvaluatorVerdict, type EvaluatorContext, } from "./Evaluator.js";
-export { EngineRunner, type EngineRunnerConfig, type RunExecutionHandle, type RunExecutor, type CustomToolEntry, } from "./EngineRunner.js";
+export { EngineRunner, AUTOMATION_PROMPT_NOTE, AUTOMATION_RUN_SOURCE, type EngineRunnerConfig, type RunExecutionHandle, type RunExecutor, type CustomToolEntry, } from "./EngineRunner.js";
 export { RunManager, type RunManagerConfig } from "./RunManager.js";
 export { createRunManager, type CreateRunManagerOptions } from "./factory.js";

package/dist/run/index.js

@@ -16,7 +16,7 @@ export { Heartbeat } from "./Heartbeat.js";
 // Evaluator
 export { NoopEvaluator, CompositeEvaluator, } from "./Evaluator.js";
 // Runner
-export { EngineRunner, } from "./EngineRunner.js";
+export { EngineRunner, AUTOMATION_PROMPT_NOTE, AUTOMATION_RUN_SOURCE, } from "./EngineRunner.js";
 // Manager
 export { RunManager } from "./RunManager.js";
 // Factory

package/dist/run/redirect-target.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Extract the file target of a trailing shell redirect (`> file` / `>> file`).
+ * Handles quoted paths with spaces — the old /> \s*(\S+)\s*$/ matched only the
+ * first non-whitespace run, so `> "my file.txt"` yielded `"my`
+ * (review-2026-05-30). Returns undefined when there's no trailing redirect.
+ */
+export declare function parseRedirectTarget(command: string): string | undefined;

package/dist/run/redirect-target.js

@@ -0,0 +1,13 @@
+/**
+ * Extract the file target of a trailing shell redirect (`> file` / `>> file`).
+ * Handles quoted paths with spaces — the old /> \s*(\S+)\s*$/ matched only the
+ * first non-whitespace run, so `> "my file.txt"` yielded `"my`
+ * (review-2026-05-30). Returns undefined when there's no trailing redirect.
+ */
+export function parseRedirectTarget(command) {
+    // Optional quote captured in group 1; body in group 2 (or unquoted in 3).
+    const m = command.match(/>>?\s*(?:(['"])(.*?)\1|(\S+))\s*$/);
+    if (!m)
+        return undefined;
+    return m[2] !== undefined ? m[2] : m[3];
+}

package/dist/run/types.js

@@ -10,7 +10,7 @@
  * Key = current status, Value = allowed next statuses.
  */
 export const VALID_TRANSITIONS = {
-    queued: ["running", "cancelled"],
+    queued: ["running", "blocked", "cancelled"],
     running: [
         "waiting_input",
         "waiting_approval",

package/dist/services/browser-open.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Build the argv to open a URL in the system browser, per platform. Returned
+ * as { cmd, args } for execFile (no shell), so the URL is a single literal
+ * argument and can't be shell-interpreted — the old code interpolated it into
+ * an exec() shell string (review-2026-05-30, security).
+ *
+ * Windows uses `cmd /c start "" <url>`: `start`'s first quoted arg is the
+ * window title, so an empty title slot keeps the URL from being read as one.
+ */
+export declare function browserOpenCommand(platform: NodeJS.Platform, url: string): {
+    cmd: string;
+    args: string[];
+};

package/dist/services/browser-open.js

@@ -0,0 +1,16 @@
+/**
+ * Build the argv to open a URL in the system browser, per platform. Returned
+ * as { cmd, args } for execFile (no shell), so the URL is a single literal
+ * argument and can't be shell-interpreted — the old code interpolated it into
+ * an exec() shell string (review-2026-05-30, security).
+ *
+ * Windows uses `cmd /c start "" <url>`: `start`'s first quoted arg is the
+ * window title, so an empty title slot keeps the URL from being read as one.
+ */
+export function browserOpenCommand(platform, url) {
+    if (platform === "darwin")
+        return { cmd: "open", args: [url] };
+    if (platform === "win32")
+        return { cmd: "cmd", args: ["/c", "start", "", url] };
+    return { cmd: "xdg-open", args: [url] };
+}

package/dist/services/dream-consolidation.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Dream consolidation — the LLM tool-call loop that cleans up the `dream`
+ * memory scope (deduplicate, merge, drop stale, improve descriptions).
+ *
+ * This logic used to live as two private methods on Engine
+ * (`runDreamLoop` + `dispatchDreamTool`). It was extracted here so it can be
+ * driven from two places:
+ *   - the end-of-session auto-dream pipeline (Engine.runDreamLoop delegates here)
+ *   - a manual "整理 / Dream" trigger from the desktop host, which constructs a
+ *     seed Engine purely to obtain a toolRegistry + LLM client and then calls
+ *     this directly (it never runs a turn).
+ *
+ * The loop is intentionally small and offline:
+ *   - No streaming, no UI events — it runs in the background.
+ *   - No permission prompts — there is no interactive backend on this path, so
+ *     we hard-reject any attempt to Save/Delete in the "user" scope before
+ *     dispatching. The "dream" scope is the LLM's workspace and goes through
+ *     freely.
+ *   - Capped at MAX_TURNS LLM round-trips and MAX_WRITES total mutations to
+ *     bound damage on misbehavior.
+ */
+import type { LLMClientBase } from "../llm/client-base.js";
+import type { ToolRegistry } from "../tool-system/registry.js";
+import type { ToolContext } from "../tool-system/context.js";
+export interface DreamConsolidationInput {
+    /** LLM client for the consolidation calls. */
+    llmClient: LLMClientBase;
+    /** Tool registry that must contain the four Memory* tools. */
+    toolRegistry: ToolRegistry;
+    /**
+     * Base tool context. `cwd` is overridden with `projectDir` (or process.cwd())
+     * so the memory tools resolve the right memory directory. Callers with an
+     * Engine pass `engine.buildToolContext()`.
+     */
+    toolContext: ToolContext;
+    /** Project root; when set, memories are scoped per-project. */
+    projectDir?: string;
+    /** For log attribution. */
+    sessionId?: string;
+}
+export interface DreamConsolidationResult {
+    /** True if the loop ran (with or without writes); false if it bailed early. */
+    ran: boolean;
+    /** The LLM's final one-paragraph summary of what it changed (may be empty). */
+    summary: string;
+}
+/**
+ * Drive the dream-scope consolidation tool-call loop.
+ *
+ * Loads both scopes (user is read-only context; dream is the workspace),
+ * builds the dream prompts, and runs the LLM with a whitelisted subset of
+ * memory tools until it stops calling tools or hits the turn cap.
+ *
+ * Returns `ran: false` if the registry is missing the memory tools (nothing
+ * happened); otherwise `ran: true` with the final summary text.
+ */
+export declare function runDreamConsolidation(input: DreamConsolidationInput): Promise<DreamConsolidationResult>;

package/dist/services/dream-consolidation.js

@@ -0,0 +1,151 @@
+/**
+ * Dream consolidation — the LLM tool-call loop that cleans up the `dream`
+ * memory scope (deduplicate, merge, drop stale, improve descriptions).
+ *
+ * This logic used to live as two private methods on Engine
+ * (`runDreamLoop` + `dispatchDreamTool`). It was extracted here so it can be
+ * driven from two places:
+ *   - the end-of-session auto-dream pipeline (Engine.runDreamLoop delegates here)
+ *   - a manual "整理 / Dream" trigger from the desktop host, which constructs a
+ *     seed Engine purely to obtain a toolRegistry + LLM client and then calls
+ *     this directly (it never runs a turn).
+ *
+ * The loop is intentionally small and offline:
+ *   - No streaming, no UI events — it runs in the background.
+ *   - No permission prompts — there is no interactive backend on this path, so
+ *     we hard-reject any attempt to Save/Delete in the "user" scope before
+ *     dispatching. The "dream" scope is the LLM's workspace and goes through
+ *     freely.
+ *   - Capped at MAX_TURNS LLM round-trips and MAX_WRITES total mutations to
+ *     bound damage on misbehavior.
+ */
+import { MemoryManager } from "../session/memory.js";
+import { buildDreamSystemPrompt, buildDreamUserPrompt, } from "./auto-dream.js";
+import { logger } from "../logging/logger.js";
+const MAX_TURNS = 8;
+const MAX_WRITES = 10;
+const MEMORY_TOOL_NAMES = ["MemoryList", "MemoryRead", "MemorySave", "MemoryDelete"];
+/**
+ * Drive the dream-scope consolidation tool-call loop.
+ *
+ * Loads both scopes (user is read-only context; dream is the workspace),
+ * builds the dream prompts, and runs the LLM with a whitelisted subset of
+ * memory tools until it stops calling tools or hits the turn cap.
+ *
+ * Returns `ran: false` if the registry is missing the memory tools (nothing
+ * happened); otherwise `ran: true` with the final summary text.
+ */
+export async function runDreamConsolidation(input) {
+    const { llmClient, toolRegistry, projectDir, sessionId } = input;
+    const memoryTools = MEMORY_TOOL_NAMES
+        .map((n) => toolRegistry.getTool(n))
+        .filter((t) => t != null);
+    if (memoryTools.length < MEMORY_TOOL_NAMES.length) {
+        logger.warn("memory.dream_missing_tools", {
+            sessionId,
+            found: memoryTools.map((t) => t.name),
+        });
+        return { ran: false, summary: "" };
+    }
+    // Dream sees BOTH scopes — user/ is read-only context so it can spot
+    // duplicates spanning scopes, dream/ is the workspace it edits.
+    const mm = new MemoryManager({ projectDir });
+    const userMems = mm.loadScope("user");
+    const dreamMems = mm.loadScope("dream");
+    const systemPrompt = buildDreamSystemPrompt();
+    const userPrompt = buildDreamUserPrompt(userMems, dreamMems);
+    // Strip RegisteredTool down to the shape createMessage expects.
+    const toolDefs = memoryTools.map((t) => ({
+        name: t.name,
+        description: t.description,
+        inputSchema: t.inputSchema,
+    }));
+    const toolCtx = {
+        ...input.toolContext,
+        cwd: projectDir ?? process.cwd(),
+    };
+    const messages = [{ role: "user", content: userPrompt }];
+    let writeBudget = MAX_WRITES;
+    for (let turn = 0; turn < MAX_TURNS; turn++) {
+        const resp = await llmClient.createMessage({
+            systemPrompt,
+            messages,
+            tools: toolDefs,
+            maxTokens: 2048,
+            recordUsage: false,
+            reasoning: { mode: "off" },
+        });
+        if (resp.toolCalls.length === 0) {
+            logger.info("memory.dream_finished", {
+                sessionId,
+                turn,
+                finalText: resp.text.slice(0, 500),
+            });
+            return { ran: true, summary: resp.text };
+        }
+        // Echo the assistant turn back so subsequent turns see the tool_use ids.
+        const assistantContent = [];
+        if (resp.text)
+            assistantContent.push({ type: "text", text: resp.text });
+        for (const tc of resp.toolCalls) {
+            assistantContent.push({
+                type: "tool_use",
+                id: tc.id,
+                name: tc.toolName,
+                input: tc.args,
+            });
+        }
+        messages.push({ role: "assistant", content: assistantContent });
+        // Dispatch every tool call requested in this turn.
+        const toolResults = [];
+        for (const tc of resp.toolCalls) {
+            const result = await dispatchDreamTool(tc, toolRegistry, toolCtx, () => {
+                if (writeBudget <= 0)
+                    return false;
+                writeBudget--;
+                return true;
+            });
+            toolResults.push({
+                type: "tool_result",
+                tool_use_id: tc.id,
+                content: result,
+            });
+        }
+        messages.push({ role: "user", content: toolResults });
+    }
+    logger.warn("memory.dream_hit_turn_cap", { sessionId, maxTurns: MAX_TURNS });
+    return { ran: true, summary: "" };
+}
+/**
+ * Execute one memory tool call inside the dream loop. Enforces the two
+ * dream-loop invariants the prompt also states:
+ *   - Only the 4 memory tools are dispatchable.
+ *   - Save/Delete in "user" scope is refused (returned as a tool error)
+ *     because dream runs without an interactive permission backend.
+ */
+async function dispatchDreamTool(tc, toolRegistry, ctx, consumeWriteBudget) {
+    const allowed = new Set(MEMORY_TOOL_NAMES);
+    if (!allowed.has(tc.toolName)) {
+        return `Error: tool "${tc.toolName}" is not available in the dream loop`;
+    }
+    const isWrite = tc.toolName === "MemorySave" || tc.toolName === "MemoryDelete";
+    if (isWrite) {
+        const scope = tc.args?.scope;
+        if (scope !== "dream") {
+            return (`Error: dream loop may only write to scope "dream", got "${scope}". ` +
+                `User-scope changes require interactive permission, which is not available here.`);
+        }
+        if (!consumeWriteBudget()) {
+            return "Error: dream write budget exhausted — stop calling write tools and summarize instead.";
+        }
+    }
+    try {
+        const result = await toolRegistry.executeTool(tc.toolName, tc.args, { ctx });
+        if (result.isError)
+            return result.error ?? `Error executing ${tc.toolName}`;
+        return result.result ?? "";
+    }
+    catch (err) {
+        return `Error executing ${tc.toolName}: ${err.message}`;
+    }
+}

package/dist/services/memory-orchestrator.js

@@ -36,10 +36,19 @@ export class MemoryOrchestrator {
         // --------------- 1. Extract durable memories ---------------
         let extracted = 0;
         try {
+            let t = Date.now();
             const existing = mm.loadAll();
+            const loadMs = Date.now() - t;
+            t = Date.now();
             const extractionPrompt = buildExtractionPrompt(transcript, existing);
+            const promptMs = Date.now() - t;
+            t = Date.now();
             const response = await this.options.callLLM("You are a memory extraction assistant. Extract only durable, reusable information worth carrying into future sessions.", extractionPrompt);
+            const llmMs = Date.now() - t;
+            t = Date.now();
             const entries = parseExtractionResponse(response);
+            const parseMs = Date.now() - t;
+            t = Date.now();
             for (const entry of entries) {
                 mm.save({
                     type: entry.type,
@@ -48,11 +57,20 @@ export class MemoryOrchestrator {
                     content: entry.content,
                 });
             }
+            const saveMs = Date.now() - t;
             extracted = entries.length;
             logger.info("memory.extraction_done", {
                 sessionId,
                 extracted,
                 elapsedMs: Date.now() - startTime,
+                loadMs,
+                promptMs,
+                llmMs,
+                parseMs,
+                saveMs,
+                existingCount: existing.length,
+                transcriptMessages: transcript.length,
+                responseChars: response.length,
             });
         }
         catch (err) {

package/dist/services/notifier.d.ts

@@ -15,6 +15,14 @@ export interface NotificationOptions {
  * Send a desktop notification.
  */
 export declare function notify(options: NotificationOptions): void;
+/** Escape a string for embedding inside an AppleScript double-quoted literal. */
+export declare function escapeAppleScriptString(str: string): string;
+/** Build the osascript argv (a single `-e <script>` pair). */
+export declare function buildOsascriptArgs(title: string, message: string, sound: boolean): string[];
+/** Build the notify-send argv with title/message as separate tokens. */
+export declare function buildNotifySendArgs(title: string, message: string, urgency: "low" | "normal" | "critical"): string[];
+/** Build the powershell.exe argv (a single `-Command <script>` element). */
+export declare function buildPowershellArgs(title: string, message: string): string[];
 /**
  * Send a notification that a task/agent has completed.
  */

package/dist/services/notifier.js

@@ -4,7 +4,7 @@
  * Sends notifications when tasks complete, agents finish, or errors occur.
  * Falls back gracefully when no notification system is available.
  */
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 /**
  * Send a desktop notification.
  */
@@ -12,37 +12,54 @@ export function notify(options) {
     const { title, message, sound = false, urgency = "normal" } = options;
     try {
         if (process.platform === "darwin") {
-            // macOS: osascript
-            const soundFlag = sound ? 'sound name "default"' : "";
-            execSync(`osascript -e 'display notification "${escape(message)}" with title "${escape(title)}" ${soundFlag}'`, { timeout: 5000 });
+            // macOS: osascript. Pass the script as a single -e argv element via
+            // execFileSync (no shell), so title/message are never seen by the shell.
+            execFileSync("osascript", buildOsascriptArgs(title, message, sound), { timeout: 5000 });
         }
         else if (process.platform === "linux") {
-            // Linux: notify-send
-            const urgencyFlag = urgency === "critical" ? "-u critical" : urgency === "low" ? "-u low" : "-u normal";
-            execSync(`notify-send ${urgencyFlag} "${escape(title)}" "${escape(message)}"`, {
-                timeout: 5000,
-            });
+            // Linux: notify-send. argv keeps title/message as separate tokens.
+            execFileSync("notify-send", buildNotifySendArgs(title, message, urgency), { timeout: 5000 });
         }
         else if (process.platform === "win32") {
-            // Windows: PowerShell toast
-            const ps = `
-        [Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null
-        $xml = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent([Windows.UI.Notifications.ToastTemplateType]::ToastText02)
-        $text = $xml.GetElementsByTagName('text')
-        $text[0].AppendChild($xml.CreateTextNode('${escape(title)}')) | Out-Null
-        $text[1].AppendChild($xml.CreateTextNode('${escape(message)}')) | Out-Null
-        $toast = [Windows.UI.Notifications.ToastNotification]::new($xml)
-        [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('CodeShell').Show($toast)
-      `.trim();
-            execSync(`powershell.exe -NoProfile -Command "${ps.replace(/\n/g, "; ")}"`, {
-                timeout: 5000,
-            });
+            // Windows: PowerShell toast. The script is one -Command argv element
+            // (no outer shell); title/message are escaped for PowerShell single
+            // quotes (' → '').
+            execFileSync("powershell.exe", buildPowershellArgs(title, message), { timeout: 5000 });
         }
     }
     catch {
         // Silently fail — notifications are best-effort
     }
 }
+/** Escape a string for embedding inside an AppleScript double-quoted literal. */
+export function escapeAppleScriptString(str) {
+    return str.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, " ");
+}
+/** Build the osascript argv (a single `-e <script>` pair). */
+export function buildOsascriptArgs(title, message, sound) {
+    const soundClause = sound ? ' sound name "default"' : "";
+    const script = `display notification "${escapeAppleScriptString(message)}"` +
+        ` with title "${escapeAppleScriptString(title)}"${soundClause}`;
+    return ["-e", script];
+}
+/** Build the notify-send argv with title/message as separate tokens. */
+export function buildNotifySendArgs(title, message, urgency) {
+    return ["-u", urgency, title, message];
+}
+/** Build the powershell.exe argv (a single `-Command <script>` element). */
+export function buildPowershellArgs(title, message) {
+    const esc = (s) => s.replace(/'/g, "''").replace(/\n/g, " ");
+    const ps = [
+        "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null",
+        "$xml = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent([Windows.UI.Notifications.ToastTemplateType]::ToastText02)",
+        "$text = $xml.GetElementsByTagName('text')",
+        `$text[0].AppendChild($xml.CreateTextNode('${esc(title)}')) | Out-Null`,
+        `$text[1].AppendChild($xml.CreateTextNode('${esc(message)}')) | Out-Null`,
+        "$toast = [Windows.UI.Notifications.ToastNotification]::new($xml)",
+        "[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('CodeShell').Show($toast)",
+    ].join("; ");
+    return ["-NoProfile", "-Command", ps];
+}
 /**
  * Send a notification that a task/agent has completed.
  */
@@ -64,6 +81,3 @@ export function notifyError(context, error) {
         urgency: "critical",
     });
 }
-function escape(str) {
-    return str.replace(/['"\\]/g, "\\$&").replace(/\n/g, " ");
-}

package/dist/services/oauth.js

@@ -5,7 +5,8 @@
  */
 import { createServer } from "node:http";
 import { randomBytes, createHash } from "node:crypto";
-import { exec } from "node:child_process";
+import { execFile } from "node:child_process";
+import { browserOpenCommand } from "./browser-open.js";
 /**
  * Generate PKCE code verifier and challenge.
  */
@@ -18,12 +19,9 @@ function generatePKCE() {
  * Open a URL in the system browser.
  */
 function openBrowser(url) {
-    const cmd = process.platform === "darwin"
-        ? `open "${url}"`
-        : process.platform === "win32"
-            ? `start "${url}"`
-            : `xdg-open "${url}"`;
-    exec(cmd, () => { });
+    // execFile with an argv array — no shell, so the URL can't be interpreted.
+    const { cmd, args } = browserOpenCommand(process.platform, url);
+    execFile(cmd, args, () => { });
 }
 /**
  * Run the OAuth authorization code flow.

package/dist/services/session-memory-sort.d.ts

@@ -0,0 +1,8 @@
+import type { SessionMemoryEntry } from "./session-memory.js";
+/**
+ * Order session memories most-recent-first by their `createdAt` field. The
+ * caller previously sorted by filename (= sessionId), which has no
+ * chronological meaning (review-2026-05-30). Returns a new array; input is not
+ * mutated.
+ */
+export declare function sortSessionMemoriesByRecency(entries: SessionMemoryEntry[]): SessionMemoryEntry[];

package/dist/services/session-memory-sort.js

@@ -0,0 +1,9 @@
+/**
+ * Order session memories most-recent-first by their `createdAt` field. The
+ * caller previously sorted by filename (= sessionId), which has no
+ * chronological meaning (review-2026-05-30). Returns a new array; input is not
+ * mutated.
+ */
+export function sortSessionMemoriesByRecency(entries) {
+    return [...entries].sort((a, b) => (a.createdAt < b.createdAt ? 1 : a.createdAt > b.createdAt ? -1 : 0));
+}

package/dist/services/session-memory.js

@@ -7,6 +7,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
+import { sortSessionMemoriesByRecency } from "./session-memory-sort.js";
 const MEMORY_DIR = join(homedir(), ".code-shell", "session-memories");
 /**
  * Save a session memory entry.
@@ -36,20 +37,18 @@ export function loadSessionMemory(sessionId) {
 export function listSessionMemories(limit = 50) {
     if (!existsSync(MEMORY_DIR))
         return [];
-    const files = readdirSync(MEMORY_DIR)
-        .filter((f) => f.endsWith(".json"))
-        .sort()
-        .reverse()
-        .slice(0, limit);
+    // Read all entries, then order by createdAt (not by filename — the filename
+    // is the sessionId, which has no chronological meaning), then take `limit`.
     const entries = [];
-    for (const file of files) {
+    for (const file of readdirSync(MEMORY_DIR)) {
+        if (!file.endsWith(".json"))
+            continue;
         try {
-            const entry = JSON.parse(readFileSync(join(MEMORY_DIR, file), "utf-8"));
-            entries.push(entry);
+            entries.push(JSON.parse(readFileSync(join(MEMORY_DIR, file), "utf-8")));
         }
         catch { }
     }
-    return entries;
+    return sortSessionMemoriesByRecency(entries).slice(0, limit);
 }
 /**
  * Search session memories by keyword.

package/dist/session/file-history.js

@@ -29,10 +29,17 @@ export class FileHistory {
             const existing = this.snapshots.find((s) => s.filePath === absPath && s.hash === hash);
             if (existing)
                 return existing;
-            // Create backup
+            // Create backup. The filename must uniquely identify (path, content): a
+            // bare 100-char tail of the path can collide for two different files
+            // whose tails coincide, and with the same ms timestamp the second
+            // copyFileSync would silently overwrite the first backup while both
+            // index entries point to it (restore would then return the wrong file's
+            // content). Fold a full-path hash and the content hash into the name so
+            // distinct (path, content) pairs never share a backup file.
             const timestamp = Date.now();
-            const safeName = absPath.replace(/[/\\:]/g, "_").slice(-100);
-            const backupPath = join(this.historyDir, `${timestamp}_${safeName}`);
+            const pathHash = createHash("md5").update(absPath).digest("hex").slice(0, 8);
+            const safeName = absPath.replace(/[/\\:]/g, "_").slice(-80);
+            const backupPath = join(this.historyDir, `${timestamp}_${pathHash}_${hash.slice(0, 8)}_${safeName}`);
             copyFileSync(absPath, backupPath);
             const snapshot = {
                 filePath: absPath,