@gajae-code/coding-agent 0.11.5 → 0.11.7

package/src/session/session-manager.ts

@@ -18,7 +18,6 @@ import * as native from "@gajae-code/natives";
 import { getTerminalId } from "@gajae-code/tui";
 import {
 	getBlobsDir,
-	getAgentDir as getDefaultAgentDir,
 	getProjectDir,
 	getSessionsDir,
 	getTerminalSessionsDir,
@@ -58,6 +57,7 @@ import {
 	canonicalizeTrustedPath,
 	deleteManagedSessionCandidate,
 	listManagedCandidates,
+	type ManagedCandidateWriteAuthority,
 	type ManagedMigrationPolicy,
 	type ManagedScope,
 	managedDirectoryAuthorityForScope,
@@ -65,11 +65,14 @@ import {
 	openManagedCandidateForWrite,
 	prepareManagedSessionScopeForWriteSync,
 	resolveManagedScope,
+	resolveManagedScopeForWrite,
 } from "./internal/managed-session-scope";
 import {
+	assertManagedDirectoryRoot,
 	type ManagedDirectoryRoot,
 	type ManagedFileSnapshot,
 	ManagedSessionDescendantStore,
+	type ManagedSessionSecurityPolicy,
 	retainManagedDirectoryAuthority,
 } from "./internal/managed-session-storage";
 
@@ -853,6 +856,32 @@ function resolveManagedSessionRoot(sessionDir: string, cwd: string): string | un
 	return path.resolve(sessionDir) === path.resolve(resolved.scope.directoryPath) ? sessionsRoot : undefined;
 }
 
+/**
+ * Resolve `target` through the real path of its nearest existing ancestor,
+ * re-appending any not-yet-created trailing segments. Symlink/reparse components
+ * in the existing prefix are canonicalized (so aliases cannot escape a containment
+ * check or alias another file), while a missing leaf (e.g. an uncommitted session
+ * transcript) is still resolved deterministically. Non-ENOENT errors (ELOOP,
+ * EACCES, ...) surface rather than silently falling back to the lexical path.
+ */
+function canonicalizeThroughExistingAncestor(target: string): string {
+	const resolved = path.resolve(target);
+	const tail: string[] = [];
+	let current = resolved;
+	while (true) {
+		try {
+			const real = fs.realpathSync(current);
+			return tail.length === 0 ? real : path.join(real, ...tail.reverse());
+		} catch (err) {
+			if (!isEnoent(err)) throw err;
+			const parent = path.dirname(current);
+			if (parent === current) return resolved;
+			tail.push(path.basename(current));
+			current = parent;
+		}
+	}
+}
+
 function isSupportedSessionVersion(version: unknown): boolean {
 	return (
 		version === undefined ||
@@ -1298,9 +1327,12 @@ function computeDefaultSessionDir(
 	sessionsRoot: string = getSessionsDir(),
 ): string {
 	if (!(storage instanceof FileSessionStorage)) throw new SessionManagedStorageError();
-	const resolved = resolveManagedScope({ cwd, agentDir: path.resolve(sessionsRoot, ".."), sessionsRoot });
+	const resolved = resolveManagedScopeForWrite({ cwd, agentDir: path.resolve(sessionsRoot, ".."), sessionsRoot });
 	if (resolved.kind === "error") throw new Error(`Could not resolve managed session scope: ${resolved.message}`);
-	const prepared = prepareManagedSessionScopeForWriteSync(resolved.scope);
+	const prepared = prepareManagedSessionScopeForWriteSync(
+		resolved.scope,
+		process.platform === "win32" ? "windows-existing-verify-first" : "default",
+	);
 	if (prepared.kind === "error") throw new Error(`Could not prepare managed session scope: ${prepared.message}`);
 	return prepared.scope.directoryPath;
 }
@@ -1382,6 +1414,13 @@ function managedFileSnapshotEquals(left: ManagedFileSnapshot | null, right: Mana
 	);
 }
 const trustedSessionDestinations = new WeakSet<SessionDestination>();
+const managedSecurityPolicies = new WeakMap<ManagedSessionSecurityContext, ManagedSessionSecurityPolicy>();
+
+function managedSecurityPolicyForContext(securityContext: ManagedSessionSecurityContext): ManagedSessionSecurityPolicy {
+	const policy = managedSecurityPolicies.get(securityContext);
+	if (!policy) throw new Error("Managed session security policy unavailable");
+	return policy;
+}
 
 function managedStoreFromContext(
 	securityContext: ManagedSessionSecurityContext,
@@ -1393,6 +1432,7 @@ function managedStoreFromContext(
 		securityContext.retainedAuthority
 			? { authority: securityContext.retainedAuthority, authorityBaseDir: directory }
 			: undefined,
+		managedSecurityPolicyForContext(securityContext),
 	);
 }
 
@@ -1405,6 +1445,10 @@ function freezeManagedDestination(scope: ManagedScope): SessionDestination {
 		rootAuthority,
 		retainedAuthority: managedDirectoryAuthorityForScope(scope),
 	});
+	managedSecurityPolicies.set(
+		securityContext,
+		scope.platform === "win32" ? "windows-existing-verify-first" : "default",
+	);
 	const destination = Object.freeze({ kind: "managed" as const, directory: scope.directoryPath, securityContext });
 	trustedSessionDestinations.add(destination);
 	return destination;
@@ -1419,9 +1463,16 @@ function explicitDestination(directory: string): SessionDestination {
 function managedDestination(cwd: string, storage: SessionStorage, agentDir?: string): SessionDestination {
 	if (!(storage instanceof FileSessionStorage)) throw new SessionManagedStorageError();
 	const sessionsRoot = getSessionsDir(agentDir);
-	const resolved = resolveManagedScope({ cwd, agentDir: agentDir ?? path.resolve(sessionsRoot, ".."), sessionsRoot });
+	const resolved = resolveManagedScopeForWrite({
+		cwd,
+		agentDir: agentDir ?? path.resolve(sessionsRoot, ".."),
+		sessionsRoot,
+	});
 	if (resolved.kind === "error") throw new Error(`Could not resolve managed session scope: ${resolved.message}`);
-	const prepared = prepareManagedSessionScopeForWriteSync(resolved.scope);
+	const prepared = prepareManagedSessionScopeForWriteSync(
+		resolved.scope,
+		process.platform === "win32" ? "windows-existing-verify-first" : "default",
+	);
 	if (prepared.kind === "error") throw new Error(`Could not prepare managed session scope: ${prepared.message}`);
 	return freezeManagedDestination(prepared.scope);
 }
@@ -1788,12 +1839,46 @@ function inspectResumeSessionFile(
 			mtimeNs: snapshot.mtimeNs,
 			sha256: crypto.createHash("sha256").update(bytes).digest("hex"),
 		};
-		return { identity, content: Uint8Array.from(bytes), entries, context, migrationApplied };
+		return { identity, content: bytes, entries, context, migrationApplied };
 	} catch {
 		return { kind: "error", reason: "malformed" };
 	}
 }
 
+/** Revalidate previously parsed authority without another decode, parse, migration, or context build. */
+function revalidateResumeSessionIdentity(
+	filePath: string,
+	storage: SessionStorage,
+	expected: ResumeSessionIdentity,
+): StrictSessionOpenFailure | { kind: "valid" } {
+	const canonicalPath = resolveEquivalentPath(path.resolve(filePath));
+	let before: SessionStorageStat;
+	let snapshot: SessionStorageSnapshot;
+	let after: SessionStorageStat;
+	try {
+		before = storage.statSync(canonicalPath);
+		if (!before.isFile || !storage.readSnapshotSync) return { kind: "error", reason: "read-failed" };
+		snapshot = storage.readSnapshotSync(canonicalPath);
+		after = storage.statSync(canonicalPath);
+	} catch (error) {
+		return resumeReadFailure(error, storage, canonicalPath);
+	}
+	if (!sameResumeStat(before, snapshot.stat) || !sameResumeStat(snapshot.stat, after)) {
+		return { kind: "error", reason: "unstable" };
+	}
+	const observed: ResumeSessionIdentity = {
+		canonicalPath,
+		sessionId: expected.sessionId,
+		dev: snapshot.stat.dev,
+		ino: snapshot.stat.ino,
+		size: snapshot.stat.size,
+		mtimeMs: snapshot.stat.mtimeMs,
+		mtimeNs: snapshot.stat.mtimeNs,
+		sha256: crypto.createHash("sha256").update(snapshot.bytes).digest("hex"),
+	};
+	return sameResumeIdentity(expected, observed) ? { kind: "valid" } : { kind: "error", reason: "identity-mismatch" };
+}
+
 /**
  * Convert legacy persisted blob references in loaded entries into resident sentinels.
  * Images then materialize lazily at provider/display/export chokepoints instead of
@@ -3841,9 +3926,11 @@ export async function resolveResumableSession(
 	cwd: string,
 	sessionDir?: string,
 	storage: SessionStorage = new FileSessionStorage(),
+	managedAgentDir?: string,
 ): Promise<ResolvedSessionMatch | undefined> {
-	const localSessionDir = sessionDir ?? SessionManager.getDefaultSessionDir(cwd, undefined, storage);
-	const localSessions = await SessionManager.list(cwd, localSessionDir, storage);
+	const localSessions = sessionDir
+		? await SessionManager.list(cwd, sessionDir, storage)
+		: await SessionManager.listManagedForResumePickerReadOnly(cwd, managedAgentDir, storage);
 	const localMatch = localSessions.find(session => sessionMatchesResumeArg(session, sessionArg));
 	if (localMatch) {
 		return { session: localMatch, scope: "local" };
@@ -3853,7 +3940,7 @@ export async function resolveResumableSession(
 		return undefined;
 	}
 
-	const globalSessions = await SessionManager.listAll(storage);
+	const globalSessions = await SessionManager.listAll(storage, managedAgentDir);
 	const globalMatch = globalSessions.find(session => sessionMatchesResumeArg(session, sessionArg));
 	if (!globalMatch) {
 		return undefined;
@@ -3885,6 +3972,7 @@ export class SessionManager {
 	#ensuredOnDisk: boolean = false;
 	#recoveryHydrationContext: RecoveryHydrationContext | undefined;
 	#fileEntries: FileEntry[] = [];
+	#pendingStrictAdoption: { canonicalPath: string; identity: ResumeSessionIdentity } | undefined;
 	#byId: Map<string, SessionEntry> = new Map();
 	#labelsById: Map<string, string> = new Map();
 	#leafId: string | null = null;
@@ -4131,15 +4219,16 @@ export class SessionManager {
 	}
 
 	async #hydrateExistingSession(sessionFile: string, entries: FileEntry[], migrationApplied: boolean): Promise<void> {
-		const ownedEntries = structuredClone(entries) as FileEntry[];
-		const header = ownedEntries[0] as SessionHeader;
+		// Strict inspection creates these entries solely for this hydration path. Adopt that
+		// final, validated representation instead of cloning the complete transcript again.
+		const header = entries[0] as SessionHeader;
 		this.#sessionFile = this.storage instanceof FileSessionStorage ? path.resolve(sessionFile) : sessionFile;
 		this.#sessionId = header.id;
 		this.#sessionName = header.title;
 		this.#titleSource = header.titleSource;
 		this.#needsFullRewriteOnNextPersist = migrationApplied;
-		await resolveBlobRefsInEntries(ownedEntries, this.#blobStore);
-		this.#fileEntries = ownedEntries;
+		await resolveBlobRefsInEntries(entries, this.#blobStore);
+		this.#fileEntries = entries;
 		this.#resetResidentTextBlobStore();
 		this.#fileEntries = this.#fileEntries.map(entry =>
 			prepareEntryForResidentSync(entry, this.#residentBlobStores()),
@@ -4158,12 +4247,25 @@ export class SessionManager {
 
 	/** Switch to a different session file (used for resume and branching) */
 	async setSessionFile(sessionFile: string): Promise<void> {
+		const resolvedSessionFile = this.storage instanceof FileSessionStorage ? path.resolve(sessionFile) : sessionFile;
+		const strictAdoption = this.#pendingStrictAdoption;
+		this.#pendingStrictAdoption = undefined;
+		if (strictAdoption && resolvedSessionFile === strictAdoption.canonicalPath) {
+			const inspected = inspectResumeSessionFile(resolvedSessionFile, this.storage);
+			if ("kind" in inspected || !sameResumeIdentity(strictAdoption.identity, inspected.identity))
+				throw new Error("Prepared managed session changed before strict adoption.");
+		}
 		await this.#closePersistWriter();
 		this.#persistError = undefined;
 		this.#persistErrorReported = false;
-		this.#sessionFile = this.storage instanceof FileSessionStorage ? path.resolve(sessionFile) : sessionFile;
+		this.#sessionFile = resolvedSessionFile;
 		writeTerminalBreadcrumb(this.cwd, this.#sessionFile);
 		this.#fileEntries = await loadEntriesFromFile(this.#sessionFile, this.storage);
+		if (strictAdoption) {
+			const inspected = inspectResumeSessionFile(this.#sessionFile, this.storage);
+			if ("kind" in inspected || !sameResumeIdentity(strictAdoption.identity, inspected.identity))
+				throw new Error("Prepared managed session changed during strict adoption.");
+		}
 		if (this.#fileEntries.length > 0) {
 			const header = this.#fileEntries.find(e => e.type === "session") as SessionHeader | undefined;
 			this.#sessionId = header?.id ?? createSessionId();
@@ -4239,6 +4341,46 @@ export class SessionManager {
 		}
 	}
 
+	/**
+	 * Exact-delete a session transcript and its artifacts by path WITHOUT requiring
+	 * managed logical authorization. This is only for discarding an UNCOMMITTED
+	 * successor that a transaction (e.g. handoff) created via `newSession()` but
+	 * never durably authorized — such a session has no managed candidate listing
+	 * yet, so `dropSession` would refuse it and leak its resident-cache/artifact
+	 * root. Bounded to this manager's configured session root and refuses to touch
+	 * the active session; tolerates missing files.
+	 */
+	async discardUncommittedSession(sessionPath: string): Promise<void> {
+		// Close the writer FIRST so the canonical checks and the delete run with no
+		// intervening await, eliminating the check/use window in which a parent
+		// directory could be swapped for a symlink between authorization and deletion.
+		await this.#closePersistWriter();
+		// Canonicalize the candidate (and the active file / configured dir) through
+		// their nearest existing ancestor so symlink/reparse components cannot alias
+		// the active session or escape the configured session directory, even when
+		// the successor transcript itself does not yet exist.
+		const canonicalCandidate = canonicalizeThroughExistingAncestor(path.resolve(sessionPath));
+		if (this.#sessionFile) {
+			const canonicalActive = canonicalizeThroughExistingAncestor(path.resolve(this.#sessionFile));
+			if (canonicalActive === canonicalCandidate) {
+				throw new Error("Refusing to discard the active session as uncommitted.");
+			}
+		}
+		// Least-authority containment: only within this manager's configured session
+		// directory (canonical), where newSession() allocates the successor. The
+		// broader managed root (parent of sessionDir) is deliberately NOT accepted.
+		const canonicalSessionDir = canonicalizeThroughExistingAncestor(path.resolve(this.sessionDir));
+		if (!pathIsWithin(canonicalSessionDir, canonicalCandidate)) {
+			throw new Error("Uncommitted session discard is limited to this manager's configured session directory.");
+		}
+		try {
+			await this.storage.deleteSessionWithArtifacts(canonicalCandidate);
+		} catch (err) {
+			if (isEnoent(err)) return;
+			throw err;
+		}
+	}
+
 	/**
 	 * Fork the current session, creating a new session file with the same entries.
 	 * Returns both the old and new session file paths for artifact copying.
@@ -4467,17 +4609,14 @@ export class SessionManager {
 		const previousDestination = this.destination;
 		const previousArtifactDir = previousSessionFile?.slice(0, -6);
 
-		const nextDestination = (() => {
-			if (this.destination.kind === "managed") {
-				return managedDestination(resolvedCwd, this.storage, this.destination.securityContext.agentDir);
-			}
-			if (!(this.storage instanceof FileSessionStorage)) return this.destination;
-			const managedSessionsRoot = resolveManagedSessionRoot(this.sessionDir, this.cwd);
-			const directory = managedSessionsRoot
-				? computeDefaultSessionDir(resolvedCwd, this.storage, managedSessionsRoot)
-				: computeDefaultSessionDir(resolvedCwd, this.storage);
-			return explicitDestination(directory);
-		})();
+		const nextDestination =
+			this.storage instanceof FileSessionStorage
+				? managedDestination(
+						resolvedCwd,
+						this.storage,
+						this.destination.kind === "managed" ? this.destination.securityContext.agentDir : undefined,
+					)
+				: this.destination;
 		const newSessionDir = nextDestination.directory;
 		let hadSessionFile = false;
 		const managedMove = this.destination.kind === "managed" && nextDestination.kind === "managed";
@@ -5457,6 +5596,17 @@ export class SessionManager {
 		return this.sessionDir;
 	}
 
+	/** Lists picker candidates within this manager's captured destination authority. */
+	async listForResumePickerReadOnly(): Promise<SessionInfo[]> {
+		return this.destination.kind === "managed"
+			? await SessionManager.listManagedForResumePickerReadOnly(
+					this.cwd,
+					this.destination.securityContext.agentDir,
+					this.storage,
+				)
+			: await SessionManager.listForResumePickerReadOnly(this.cwd, this.destination.directory, this.storage);
+	}
+
 	getSessionId(): string {
 		return this.#sessionId;
 	}
@@ -5486,13 +5636,22 @@ export class SessionManager {
 	getManagedLegacyLocalMigrationSource(): ManagedLegacyLocalMigrationSource | null {
 		if (this.destination.kind !== "managed" || !this.#sessionFile || this.#adoptedArtifactManager) return null;
 		const store = this.#managedTranscriptStore();
+		const legacyArtifactsRoot = path.basename(this.#sessionFile.slice(0, -6));
+		const legacyLocalRoot = path.posix.join(legacyArtifactsRoot, "local");
 		return {
 			capture: async () => {
 				let snapshot: native.NativeDirectoryTreeSnapshot;
 				try {
-					snapshot = store.captureTree("local");
+					snapshot = store.captureTree(legacyLocalRoot);
 				} catch (error) {
 					if (error instanceof Error && error.message === "not_found") return null;
+					if (error instanceof Error && error.message === "reparse_point") {
+						try {
+							store.captureTree(legacyArtifactsRoot);
+						} catch (artifactsError) {
+							if (artifactsError instanceof Error && artifactsError.message === "not_found") return null;
+						}
+					}
 					throw error;
 				}
 				let totalBytes = 0;
@@ -5500,7 +5659,7 @@ export class SessionManager {
 				if (totalBytes > 64 * 1024 * 1024) throw new Error("Legacy local:// migration exceeds the safe size limit");
 				const entries = snapshot.entries.map(entry => {
 					if (entry.kind === "directory") return { relativePath: entry.relativePath, kind: "directory" as const };
-					const captured = store.readExpected(path.posix.join("local", entry.relativePath));
+					const captured = store.readExpected(path.posix.join(legacyLocalRoot, entry.relativePath));
 					if (
 						!captured ||
 						captured.identity.dev.toString() !== entry.dev ||
@@ -5516,12 +5675,12 @@ export class SessionManager {
 						sha256: entry.sha256,
 					};
 				});
-				const verified = store.captureTree("local");
+				const verified = store.captureTree(legacyLocalRoot);
 				if (JSON.stringify(verified) !== JSON.stringify(snapshot))
 					throw new Error("Legacy local:// migration source changed during capture");
 				return { snapshot, entries };
 			},
-			retire: snapshot => store.removeTreeExpected("local", snapshot),
+			retire: snapshot => store.removeTreeExpected(legacyLocalRoot, snapshot),
 		};
 	}
 
@@ -7014,6 +7173,12 @@ export class SessionManager {
 			authority instanceof ManagedSessionDescendantStore
 				? authority.retainAuthority()
 				: retainManagedDirectoryAuthority(rootAuthority, directory);
+		const policy =
+			authority instanceof ManagedSessionDescendantStore
+				? authority.securityPolicy
+				: process.platform === "win32"
+					? "windows-existing-verify-first"
+					: "default";
 		const securityContext = createManagedSessionSecurityContext({
 			agentDir: rootAuthority.canonicalPath,
 			sessionsRoot: rootAuthority.canonicalPath,
@@ -7021,6 +7186,7 @@ export class SessionManager {
 			rootAuthority,
 			retainedAuthority,
 		});
+		managedSecurityPolicies.set(securityContext, policy);
 		const destination = Object.freeze({ kind: "managed" as const, directory, securityContext });
 		trustedSessionDestinations.add(destination);
 		return destination;
@@ -7049,20 +7215,59 @@ export class SessionManager {
 		return manager;
 	}
 
+	/** Prepare a selected candidate using this manager's captured managed destination authority. */
+	async prepareManagedCandidateForWrite(
+		filePath: string,
+		migrationPolicy: SessionDirectoryMigrationPolicy,
+		expectedIdentity?: ResumeSessionIdentity,
+	): Promise<string> {
+		return SessionManager.prepareManagedCandidateForWrite(
+			filePath,
+			migrationPolicy,
+			this.destination,
+			expectedIdentity,
+		);
+	}
+
+	/** Prepare a managed candidate and retain its exact post-preparation identity for the next adoption. */
+	async prepareManagedCandidateForStrictAdoption(
+		filePath: string,
+		migrationPolicy: SessionDirectoryMigrationPolicy,
+		expectedIdentity: ResumeSessionIdentity,
+	): Promise<string> {
+		const preparedPath = await this.prepareManagedCandidateForWrite(filePath, migrationPolicy, expectedIdentity);
+		const inspected = inspectResumeSessionFile(preparedPath, this.storage);
+		if ("kind" in inspected) throw new Error(`Could not inspect prepared managed session: ${inspected.reason}`);
+		this.#pendingStrictAdoption = { canonicalPath: inspected.identity.canonicalPath, identity: inspected.identity };
+		return preparedPath;
+	}
+
 	/** Resolve a default-managed candidate through binding validation and copy-retain migration before mutation. */
 	static async prepareManagedCandidateForWrite(
 		filePath: string,
 		migrationPolicy: SessionDirectoryMigrationPolicy,
+		destination: SessionDestination,
+		expectedIdentity?: ResumeSessionIdentity,
 	): Promise<string> {
+		if (!trustedSessionDestinations.has(destination) || destination.kind !== "managed")
+			throw new Error("Managed candidate preparation requires a trusted managed destination authority");
 		const storage = new FileSessionStorage();
+		const managedDestinationStore = managedStoreFromContext(destination.securityContext, destination.directory);
+		const assertManagedDestinationBound = (): void => {
+			assertManagedDirectoryRoot(destination.securityContext.rootAuthority);
+			managedDestinationStore.assertBound();
+		};
+		assertManagedDestinationBound();
 		const inspected = inspectResumeSessionFile(filePath, storage);
 		if ("kind" in inspected) {
 			if (inspected.reason === "missing") return filePath;
 			throw new Error(`Could not inspect managed session: ${inspected.reason}`);
 		}
+		if (expectedIdentity && !sameResumeIdentity(expectedIdentity, inspected.identity))
+			throw new Error("Managed session changed before migration authority was adopted.");
 		const header = inspected.entries.find(entry => entry.type === "session") as SessionHeader | undefined;
 		if (!header?.cwd) return filePath;
-		const sessionsRoot = getSessionsDir();
+		const sessionsRoot = destination.securityContext.sessionsRoot;
 		const resolvedPath = path.resolve(filePath);
 		const relativeToManagedRoot = path.relative(sessionsRoot, resolvedPath);
 		const isManagedPath =
@@ -7070,14 +7275,17 @@ export class SessionManager {
 			(!relativeToManagedRoot.startsWith("..") && !path.isAbsolute(relativeToManagedRoot));
 
 		if (!isManagedPath) return filePath;
+		assertManagedDestinationBound();
 		const resolved = resolveManagedScope({
 			cwd: header.cwd,
-			agentDir: path.resolve(sessionsRoot, ".."),
+			agentDir: destination.securityContext.agentDir,
 			sessionsRoot,
 		});
 		if (resolved.kind === "error") throw new Error(`Could not resolve managed session scope: ${resolved.message}`);
 
+		assertManagedDestinationBound();
 		const listing = listManagedCandidates(resolved.scope);
+		assertManagedDestinationBound();
 		if (listing.kind !== "complete") throw new Error(`Managed session scan failed: ${listing.message}`);
 
 		const candidate = listing.owned.find(item => path.resolve(item.path) === resolvedPath);
@@ -7094,7 +7302,24 @@ export class SessionManager {
 			candidate.identity.sha256 !== inspected.identity.sha256
 		)
 			throw new Error("Managed session changed before migration authority was adopted.");
-		const opened = await openManagedCandidateForWrite(resolved.scope, candidate, migrationPolicy);
+		assertManagedDestinationBound();
+		const authority: ManagedCandidateWriteAuthority = {
+			rootAuthority: destination.securityContext.rootAuthority,
+			...(path.resolve(destination.directory) === path.resolve(resolved.scope.directoryPath)
+				? {
+						retainedAuthority: destination.securityContext.retainedAuthority,
+						retainedDirectory: destination.directory,
+					}
+				: {}),
+		};
+		const opened = await openManagedCandidateForWrite(
+			resolved.scope,
+			candidate,
+			expectedIdentity ?? inspected.identity,
+			migrationPolicy,
+			authority,
+		);
+		assertManagedDestinationBound();
 		if (opened.kind === "error") {
 			if (opened.code === "legacy_migration_disabled") throw new SessionMigrationPolicyError();
 			throw new Error(`Could not open managed session: ${opened.message}`);
@@ -7116,7 +7341,7 @@ export class SessionManager {
 		const destination = destinationFor(cwd, destinationInput, storage);
 		const managedSourcePath =
 			destination.kind === "managed" && storage instanceof FileSessionStorage
-				? await SessionManager.prepareManagedCandidateForWrite(sourcePath, migrationPolicy)
+				? await SessionManager.prepareManagedCandidateForWrite(sourcePath, migrationPolicy, destination)
 				: sourcePath;
 		const dir = destination.directory;
 		const manager = new SessionManager(cwd, dir, true, storage, destination);
@@ -7180,10 +7405,9 @@ export class SessionManager {
 			return manager;
 		}
 
-		const managedPath = await SessionManager.prepareManagedCandidateForWrite(filePath, migrationPolicy);
-		const inspected = inspectResumeSessionFile(managedPath, storage);
+		const inspected = inspectResumeSessionFile(filePath, storage);
 		if ("kind" in inspected) {
-			if (inspected.reason === "missing" && path.resolve(managedPath) === path.resolve(filePath)) {
+			if (inspected.reason === "missing") {
 				const manager = new SessionManager(getProjectDir(), destination.directory, true, storage, destination);
 				await manager.#initSessionFile(filePath);
 				return manager;
@@ -7251,46 +7475,47 @@ export class SessionManager {
 		return manager;
 	}
 	/**
-	 * List sessions for the resume picker without recovery or other maintenance writes.
+	 * List default-managed sessions for the resume picker without recovery or other
+	 * maintenance writes. This is the only picker inventory that includes legacy
+	 * sibling directories.
+	 */
+	static async listManagedForResumePickerReadOnly(
+		cwd: string,
+		managedAgentDir?: string,
+		storage: SessionStorage = new FileSessionStorage(),
+	): Promise<SessionInfo[]> {
+		if (!(storage instanceof FileSessionStorage)) return [];
+		const sessionsRoot = getSessionsDir(managedAgentDir);
+		const resolved = resolveManagedScope({
+			cwd,
+			agentDir: managedAgentDir ?? path.resolve(sessionsRoot, ".."),
+			sessionsRoot,
+		});
+		if (resolved.kind === "error") return [];
+		const listing = listManagedCandidates(resolved.scope);
+		if (listing.kind === "error") return [];
+		return await collectSessionsFromFiles(
+			listing.owned.map(candidate => candidate.path),
+			storage,
+		);
+	}
+
+	/**
+	 * List sessions from an explicitly supplied picker directory without recovery
+	 * or other maintenance writes. Unlike managed inventory, this never scans
+	 * legacy sibling directories.
 	 */
 	static async listForResumePickerReadOnly(
 		cwd: string,
 		sessionDir?: string,
 		storage: SessionStorage = new FileSessionStorage(),
 	): Promise<SessionInfo[]> {
-		if (!sessionDir && !(storage instanceof FileSessionStorage)) return [];
-		if (sessionDir && !resolveManagedSessionRoot(sessionDir, cwd)) {
-			try {
-				return await collectSessionsFromFiles(storage.listFilesSync(sessionDir, "*.jsonl"), storage);
-			} catch {
-				return [];
-			}
-		}
-		const sessionsRoot = sessionDir
-			? (resolveManagedSessionRoot(sessionDir, cwd) ?? getSessionsDir())
-			: getSessionsDir();
-		const resolved = resolveManagedScope({ cwd, agentDir: path.resolve(sessionsRoot, ".."), sessionsRoot });
-		if (resolved.kind === "error") return [];
-		if (storage instanceof FileSessionStorage) {
-			const listing = listManagedCandidates(resolved.scope);
-			if (listing.kind === "error") return [];
-			return await collectSessionsFromFiles(
-				listing.owned.map(candidate => candidate.path),
-				storage,
-			);
-		}
-		const legacyDirectory = `--${resolved.scope.canonicalCwd.replace(/^[/\\]/, "").replace(/[/\\:]/g, "-")}--`;
-		const files = new Set<string>();
+		if (!sessionDir) return await SessionManager.listManagedForResumePickerReadOnly(cwd, undefined, storage);
 		try {
-			for (const directory of [resolved.scope.directoryPath, path.join(sessionsRoot, legacyDirectory)]) {
-				for (const file of storage.listFilesSync(directory, "*.jsonl")) files.add(file);
-			}
+			return await collectSessionsFromFiles(storage.listFilesSync(sessionDir, "*.jsonl"), storage);
 		} catch {
 			return [];
 		}
-		return (await collectSessionsFromFiles([...files], storage)).filter(
-			session => resolveEquivalentPath(session.cwd) === resolved.scope.canonicalCwd,
-		);
 	}
 
 	/** Tombstone and exact-delete a default-managed candidate. */
@@ -7592,36 +7817,39 @@ export class SessionManager {
 		let sessionPath = identity.canonicalPath;
 		if (destination.kind === "managed" && storage instanceof FileSessionStorage) {
 			try {
-				sessionPath = await SessionManager.prepareManagedCandidateForWrite(sessionPath, migrationPolicy);
+				sessionPath = await SessionManager.prepareManagedCandidateForWrite(
+					sessionPath,
+					migrationPolicy,
+					destination,
+					identity,
+				);
 			} catch (error) {
 				if (error instanceof SessionMigrationPolicyError)
 					return { kind: "error", reason: "legacy_migration_disabled" };
+				if (
+					error instanceof Error &&
+					(error.message.includes("source_changed") || error.message.includes("changed before migration"))
+				)
+					return { kind: "error", reason: "identity-mismatch" };
 				throw error;
 			}
 		}
 		const inspected = inspectResumeSessionFile(sessionPath, storage);
 		if ("kind" in inspected) return inspected;
-		if (
-			(sessionPath === identity.canonicalPath && !sameResumeIdentity(identity, inspected.identity)) ||
-			(sessionPath !== identity.canonicalPath &&
-				(identity.sessionId !== inspected.identity.sessionId || identity.sha256 !== inspected.identity.sha256))
-		) {
+		if (sessionPath === identity.canonicalPath && !sameResumeIdentity(identity, inspected.identity)) {
 			return { kind: "error", reason: "identity-mismatch" };
 		}
+
 		const entries = inspected.entries;
 		const header = entries[0] as SessionHeader;
 		const dir = destination.directory;
 		const manager = new SessionManager(header.cwd || getProjectDir(), dir, true, storage, destination);
 		await manager.#hydrateExistingSession(sessionPath, entries, inspected.migrationApplied);
-		const ownershipInspection = inspectResumeSessionFile(sessionPath, storage);
-		if ("kind" in ownershipInspection) {
+		const ownershipInspection = revalidateResumeSessionIdentity(sessionPath, storage, inspected.identity);
+		if (ownershipInspection.kind === "error") {
 			await manager.close();
 			return ownershipInspection;
 		}
-		if (!sameResumeIdentity(inspected.identity, ownershipInspection.identity)) {
-			await manager.close();
-			return { kind: "error", reason: "identity-mismatch" };
-		}
 		try {
 			await manager.#sanitizeLoadedOpenAIResponsesReplayMetadataAndPersist();
 			writeTerminalBreadcrumb(manager.cwd, sessionPath);
@@ -7665,9 +7893,20 @@ export class SessionManager {
 		const managedCandidates =
 			destination.kind === "explicit"
 				? []
-				: await SessionManager.listForResumePickerReadOnly(cwd, destination.directory, storage);
+				: await SessionManager.listManagedForResumePickerReadOnly(
+						cwd,
+						destination.securityContext.agentDir,
+						storage,
+					);
+
 		const terminalSession = await readTerminalBreadcrumb(cwd);
-		if (terminalSession) {
+		const terminalSessionIsInExplicitRoot = (() => {
+			if (destination.kind === "managed" || !terminalSession) return destination.kind === "managed";
+			const canonicalRoot = canonicalizeTrustedPath(destination.directory);
+			const canonicalSessionPath = canonicalizeTrustedPath(terminalSession);
+			return pathIsWithin(canonicalRoot, canonicalSessionPath);
+		})();
+		if (terminalSession && terminalSessionIsInExplicitRoot) {
 			const opened = await openSelectedStrictly(terminalSession);
 			if (opened) return opened;
 		}
@@ -7705,7 +7944,7 @@ export class SessionManager {
 		sessionDir?: string,
 		storage: SessionStorage = new FileSessionStorage(),
 	): Promise<SessionInfo[]> {
-		if (!sessionDir) return await SessionManager.listForResumePickerReadOnly(cwd, undefined, storage);
+		if (!sessionDir) return await SessionManager.listManagedForResumePickerReadOnly(cwd, undefined, storage);
 		try {
 			await recoverOrphanedBackups(sessionDir, storage);
 			return await collectSessionsFromFiles(storage.listFilesSync(sessionDir, "*.jsonl"), storage);
@@ -7717,9 +7956,12 @@ export class SessionManager {
 	/**
 	 * List all sessions across all project directories.
 	 */
-	static async listAll(storage: SessionStorage = new FileSessionStorage()): Promise<SessionInfo[]> {
+	static async listAll(
+		storage: SessionStorage = new FileSessionStorage(),
+		managedAgentDir?: string,
+	): Promise<SessionInfo[]> {
 		if (!(storage instanceof FileSessionStorage)) return [];
-		const sessionsRoot = path.join(getDefaultAgentDir(), "sessions");
+		const sessionsRoot = getSessionsDir(managedAgentDir);
 		try {
 			const directories = await fs.promises.readdir(sessionsRoot, { withFileTypes: true });
 			const seedFiles = directories
@@ -7755,6 +7997,19 @@ export class SessionManager {
 			return [];
 		}
 	}
+	/**
+	 * Strict inventory bound to this manager's captured session authority. Managed
+	 * managers include authorized legacy and current candidates; explicit managers
+	 * authorize only their exact directory.
+	 */
+	inventorySessionsStrict(): StrictInventoryResult {
+		return SessionManager.inventorySessionsStrict(this.cwd, {
+			sessionDir: this.destination.kind === "explicit" ? this.destination.directory : undefined,
+			storage: this.storage,
+			destination: this.destination,
+		});
+	}
+
 	/**
 	 * Strict raw scoped inventory for ACP authorization. Enumerates the scoped
 	 * session directory without suppressing any root/scan/lstat/read/parse/stat/
@@ -7764,10 +8019,55 @@ export class SessionManager {
 	 */
 	static inventorySessionsStrict(
 		cwd: string,
-		options?: { sessionDir?: string; storage?: SessionStorage },
+		options?: { sessionDir?: string; storage?: SessionStorage; destination?: SessionDestination },
 	): StrictInventoryResult {
 		const storage = options?.storage ?? new FileSessionStorage();
-		const dir = options?.sessionDir ?? SessionManager.getDefaultSessionDir(cwd, undefined, storage);
+		const destination = options?.destination;
+		const dir =
+			options?.sessionDir ?? destination?.directory ?? SessionManager.getDefaultSessionDir(cwd, undefined, storage);
+		if (destination?.kind === "managed") {
+			if (!trustedSessionDestinations.has(destination) || !(storage instanceof FileSessionStorage)) {
+				return {
+					kind: "failure",
+					failures: [{ kind: "scan", message: "Managed strict inventory authority is unavailable", path: dir }],
+				};
+			}
+			try {
+				const store = managedStoreFromContext(destination.securityContext, destination.directory);
+				assertManagedDirectoryRoot(destination.securityContext.rootAuthority);
+				store.assertBound();
+				const resolved = resolveManagedScope({
+					cwd,
+					agentDir: destination.securityContext.agentDir,
+					sessionsRoot: destination.securityContext.sessionsRoot,
+				});
+				if (resolved.kind === "error")
+					return { kind: "failure", failures: [{ kind: "root", message: resolved.message, path: dir }] };
+				const listing = listManagedCandidates(resolved.scope);
+				if (listing.kind === "error")
+					return { kind: "failure", failures: [{ kind: "scan", message: listing.message, path: dir }] };
+				const failures: StrictInventoryFailure[] = [];
+				const candidates: StrictInventoryCandidate[] = [];
+				for (const managedCandidate of listing.owned) {
+					const candidate = inventoryReadCandidate(
+						storage,
+						managedCandidate.path,
+						cwd,
+						path.dirname(managedCandidate.path),
+					);
+					if ("failures" in candidate) failures.push(...candidate.failures);
+					else candidates.push(candidate.candidate);
+				}
+				assertManagedDirectoryRoot(destination.securityContext.rootAuthority);
+				store.assertBound();
+				return failures.length > 0 ? { kind: "failure", failures } : { kind: "complete", candidates };
+			} catch {
+				return {
+					kind: "failure",
+					failures: [{ kind: "root", message: "Managed strict inventory authority changed", path: dir }],
+				};
+			}
+		}
 		if (!storage.listFilesStrictSync) {
 			return {
 				kind: "failure",