@gajae-code/coding-agent 0.16.3 → 0.16.6

package/src/session/contribution-prep.ts

@@ -3,7 +3,6 @@ import * as os from "node:os";
 import * as path from "node:path";
 import type { AgentMessage } from "@gajae-code/agent-core";
 import type { AssistantMessage, ToolResultMessage, UserMessage } from "@gajae-code/ai/core";
-import { $ } from "bun";
 import { resolveGjcCommand } from "../task/gjc-command";
 import { shortenPath } from "../tools/render-utils";
 
@@ -12,6 +11,12 @@ export const CONTRIBUTION_PREP_SCHEMA_VERSION = 1;
 const MAX_TRANSCRIPT_MESSAGES = 20;
 const MAX_TEXT_CHARS = 12000;
 const MAX_GIT_OUTPUT_CHARS = 60000;
+const MAX_REDACTION_INPUT_CHARS = 1_000_000;
+// Keep whole Git captures within the redactor's input budget; discard an overrun
+// instead of emitting a prefix.
+const MAX_GIT_RAW_OUTPUT_BYTES = MAX_REDACTION_INPUT_CHARS;
+const MAX_JSON_TOKENS = 20_000;
+const MAX_JSON_REPLACEMENTS = 10_000;
 
 export interface ContributionPrepArtifact {
 	path: string;
@@ -72,12 +77,133 @@ function replaceRegex(text: string, regex: RegExp, replacement: string, state: R
 	return text.replace(regex, replacement);
 }
 
+function redactAwsAccessKeyIds(text: string, state: RedactionState): string {
+	return replaceRegex(
+		text,
+		/(^|[^0-9A-Za-z])(?:AKIA|ASIA)[0-9A-Z]{16}(?![0-9A-Za-z])/g,
+		"$1[REDACTED_AWS_KEY_ID]",
+		state,
+		"aws_keys",
+	);
+}
+
+function isAwsSecretField(value: string): boolean {
+	const normalized = value.toLowerCase().replaceAll(/[_-]/g, "");
+	return (
+		normalized === "secretaccesskey" ||
+		normalized === "sessiontoken" ||
+		normalized === "awssecretaccesskey" ||
+		normalized === "awssessiontoken" ||
+		normalized === "xamzsecuritytoken"
+	);
+}
+
+function redactAwsLabeledValues(text: string, state: RedactionState): string {
+	let redacted = redactAwsAccessKeyIds(text, state);
+	redacted = replaceRegex(
+		redacted,
+		// STS XML responses are commonly pretty-printed, so the value sits on its own
+		// line between the tags. `[^<]` still refuses to cross into another element,
+		// while the call-wide input bound caps work without imposing a credential-size
+		// assumption. The lower bound leaves empty or whitespace-only bodies alone.
+		/(<((?:[A-Za-z_][\w.-]*:)?(?:SecretAccessKey|SessionToken))>)[^<]{8,1000000}(<\/\2>)/gi,
+		"$1[REDACTED_SECRET]$3",
+		state,
+		"aws_keys",
+	);
+	redacted = replaceRegex(
+		redacted,
+		/(^|[^A-Za-z0-9_-])(["']?(?:(?:aws[_-]?)?secret[_-]?access[_-]?key|(?:aws[_-]?)?session[_-]?token|x[_-]?amz[_-]?security[_-]?token)["']?\s*[=:]\s*)(\$?)(["'`])([^"'`\r\n]{8,})\4/gi,
+		"$1$2$3$4[REDACTED_SECRET]$4",
+		state,
+		"aws_keys",
+	);
+	return replaceRegex(
+		redacted,
+		/(^|[^A-Za-z0-9_-])(["']?(?:(?:aws[_-]?)?secret[_-]?access[_-]?key|(?:aws[_-]?)?session[_-]?token|x[_-]?amz[_-]?security[_-]?token)["']?\s*[=:]\s*)[^\s"'`,;{}[\]()&<>#]{8,}/gi,
+		"$1$2[REDACTED_SECRET]",
+		state,
+		"aws_keys",
+	);
+}
+
+function redactAwsJsonStrings(text: string, state: RedactionState, depth = 0): string {
+	const tokens = [...text.matchAll(/"(?:\\(?:["\\/bfnrt]|u[0-9A-Fa-f]{4})|[^"\\\r\n])*"/g)].map(match => ({
+		start: match.index,
+		end: match.index + match[0].length,
+		raw: match[0],
+	}));
+	if (tokens.length > MAX_JSON_TOKENS) {
+		state.labels.add("oversized_content");
+		return "[REDACTED_OVERSIZED_CONTENT]";
+	}
+	const replacements = new Map<number, { end: number; value: string }>();
+
+	for (const [index, token] of tokens.entries()) {
+		let decoded: string;
+		try {
+			decoded = JSON.parse(token.raw) as string;
+		} catch {
+			continue;
+		}
+
+		if (isAwsSecretField(decoded)) {
+			const separator = /^\s*:\s*/.exec(text.slice(token.end));
+			const valueToken = tokens[index + 1];
+			if (separator && valueToken?.start === token.end + separator[0].length) {
+				let value: string;
+				try {
+					value = JSON.parse(valueToken.raw) as string;
+				} catch {
+					value = "";
+				}
+				if (value.length >= 8)
+					replacements.set(valueToken.start, { end: valueToken.end, value: JSON.stringify("[REDACTED_SECRET]") });
+			}
+		}
+
+		const nestedRedacted = depth >= 3 ? "[REDACTED_NESTED_CONTENT]" : redactAwsJsonStrings(decoded, state, depth + 1);
+		const redacted = redactAwsLabeledValues(nestedRedacted, state);
+		if (redacted !== decoded && !replacements.has(token.start)) {
+			replacements.set(token.start, { end: token.end, value: JSON.stringify(redacted) });
+		}
+	}
+
+	if (replacements.size === 0) return text;
+	if (replacements.size > MAX_JSON_REPLACEMENTS) {
+		state.labels.add("oversized_content");
+		return "[REDACTED_OVERSIZED_CONTENT]";
+	}
+	state.labels.add("aws_keys");
+	const chunks: string[] = [];
+	let cursor = 0;
+	for (const [start, replacement] of [...replacements.entries()].sort(([left], [right]) => left - right)) {
+		chunks.push(text.slice(cursor, start), replacement.value);
+		cursor = replacement.end;
+	}
+	chunks.push(text.slice(cursor));
+	return chunks.join("");
+}
+
+function assertSafeArtifactPath(artifactDir: string): void {
+	const state: RedactionState = { labels: new Set() };
+	redactContributionPrepText(artifactDir, path.join(artifactDir, "__gjc_path_probe__"), state);
+	if (["tokens", "aws_keys", "provider_keys", "auth_headers", "cookies"].some(label => state.labels.has(label))) {
+		throw new Error("Contribution prep artifact path contains credential-like material.");
+	}
+}
+
 export function redactContributionPrepText(
 	text: string,
 	cwd: string,
 	state: RedactionState = { labels: new Set() },
 ): string {
-	let redacted = text;
+	if (text.length > MAX_REDACTION_INPUT_CHARS) {
+		state.labels.add("oversized_content");
+		return "[REDACTED_OVERSIZED_CONTENT]";
+	}
+	let redacted = redactAwsJsonStrings(text, state);
+	redacted = redactAwsLabeledValues(redacted, state);
 	redacted = replaceRegex(
 		redacted,
 		/\b(?:sk|pk|rk|xox[baprs])-[-_A-Za-z0-9]{12,}\b/g,
@@ -150,17 +276,73 @@ function formatMessage(message: AgentMessage): string {
 	return `## ${message.role}\n\n${JSON.stringify(message)}\n`;
 }
 
-async function gitOutput(cwd: string, args: string[], maxChars = MAX_GIT_OUTPUT_CHARS): Promise<string> {
+interface BoundedGitOutput {
+	text: string;
+	oversized: boolean;
+}
+
+async function readBoundedGitOutput(stream: ReadableStream<Uint8Array>, maxBytes: number): Promise<BoundedGitOutput> {
+	const reader = stream.getReader();
+	const chunks: Uint8Array[] = [];
+	let totalBytes = 0;
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			totalBytes += value.byteLength;
+			if (totalBytes > maxBytes) return { text: "", oversized: true };
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+
+	const bytes = new Uint8Array(totalBytes);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return { text: new TextDecoder().decode(bytes), oversized: false };
+}
+
+async function gitOutput(
+	cwd: string,
+	args: string[],
+	state: RedactionState,
+	maxChars = MAX_GIT_OUTPUT_CHARS,
+): Promise<string> {
 	try {
-		const output = await $`git ${args}`.cwd(cwd).quiet().text();
-		return limitText(output.trim(), maxChars);
+		const proc = Bun.spawn(["git", ...args], { cwd, stdin: "ignore", stdout: "pipe", stderr: "ignore" });
+		const stop = (): void => {
+			try {
+				proc.kill();
+			} catch {
+				// The process already exited.
+			}
+		};
+		try {
+			const output = await readBoundedGitOutput(proc.stdout, MAX_GIT_RAW_OUTPUT_BYTES);
+			if (output.oversized) {
+				stop();
+				await proc.exited;
+				state.labels.add("oversized_content");
+				return "[REDACTED_OVERSIZED_CONTENT]";
+			}
+			if ((await proc.exited) !== 0) return "";
+			return limitText(redactContributionPrepText(output.text.trim(), cwd, state), maxChars);
+		} catch {
+			stop();
+			await proc.exited;
+			return "";
+		}
 	} catch {
 		return "";
 	}
 }
 
-async function changedFiles(cwd: string): Promise<string[]> {
-	const output = await gitOutput(cwd, ["status", "--short"]);
+async function changedFiles(cwd: string, state: RedactionState): Promise<string[]> {
+	const output = await gitOutput(cwd, ["status", "--short"], state);
 	return output
 		.split("\n")
 		.map(line => line.trim())
@@ -180,15 +362,23 @@ async function writeArtifact(
 }
 
 export function buildContributionPrepWorkerPrompt(manifestPath: string): string {
+	const manifestName = path.basename(manifestPath);
 	return [
 		"Prepare a maintainer-friendly contribution draft from the redacted context dump.",
-		"Read the manifest and referenced artifact file pointers. Do not assume transcript context was inlined here.",
-		`Manifest: ${manifestPath}`,
+		"Read the manifest beside this worker prompt and its relative artifact file pointers. Do not assume transcript context was inlined here.",
+		`Manifest: ${manifestName}`,
 		"Produce structured markdown with: title, problem summary, reproduction/context, proposed fix or implementation plan, affected files, tests to run, and uncertainty/remaining risks.",
 		"Do not create GitHub issues, open PRs, push branches, or perform remote writes unless the user explicitly confirms that action in this fresh session.",
 	].join("\n");
 }
 
+function safeWorkspaceLabel(cwd: string): string {
+	const resolved = path.resolve(cwd);
+	const home = os.homedir();
+	if (home && (resolved === home || resolved.startsWith(`${home}${path.sep}`))) return shortenPath(resolved);
+	return path.basename(resolved) || ".";
+}
+
 export async function prepareContributionPrep(
 	context: ContributionPrepContext,
 	options: ContributionPrepOptions = {},
@@ -199,12 +389,14 @@ export async function prepareContributionPrep(
 		options.artifactRoot ?? path.join(context.cwd, ".gjc", "contribution-prep"),
 		safeTimestamp,
 	);
+	assertSafeArtifactPath(artifactDir);
 	await fs.mkdir(artifactDir, { recursive: true });
 
 	const redactions: RedactionState = { labels: new Set() };
 	const recentMessages = context.messages.slice(-MAX_TRANSCRIPT_MESSAGES);
 	const artifacts: ContributionPrepArtifact[] = [];
 	const redact = (text: string) => redactContributionPrepText(text, context.cwd, redactions);
+	const workspaceLabel = safeWorkspaceLabel(context.cwd);
 
 	artifacts.push(
 		await writeArtifact(
@@ -223,8 +415,8 @@ export async function prepareContributionPrep(
 				[
 					`# Contribution prep context`,
 					`Source session: ${context.sessionId}`,
-					`Session file: ${context.sessionFile ?? "(none)"}`,
-					`Working directory: ${context.cwd}`,
+					`Session file: ${context.sessionFile ? path.basename(context.sessionFile) : "(none)"}`,
+					`Working directory: ${workspaceLabel}`,
 					options.customInstructions || context.customInstructions
 						? `Custom instructions: ${options.customInstructions ?? context.customInstructions}`
 						: "Custom instructions: (none)",
@@ -233,8 +425,8 @@ export async function prepareContributionPrep(
 		),
 	);
 
-	const gitHead = (await gitOutput(context.cwd, ["rev-parse", "HEAD"])) || null;
-	const files = await changedFiles(context.cwd);
+	const gitHead = (await gitOutput(context.cwd, ["rev-parse", "HEAD"], redactions)) || null;
+	const files = await changedFiles(context.cwd, redactions);
 	artifacts.push(
 		await writeArtifact(artifactDir, "changed-files.txt", "Changed files from git status", redact(files.join("\n"))),
 	);
@@ -243,7 +435,7 @@ export async function prepareContributionPrep(
 			artifactDir,
 			"git-diff.patch",
 			"Bounded redacted git diff",
-			redact(await gitOutput(context.cwd, ["diff", "--no-ext-diff"])),
+			await gitOutput(context.cwd, ["diff", "--no-ext-diff"], redactions),
 		),
 	);
 	artifacts.push(
@@ -253,7 +445,7 @@ export async function prepareContributionPrep(
 			"Redacted environment and reproduction metadata",
 			redact(
 				[
-					`cwd: ${context.cwd}`,
+					`cwd: ${workspaceLabel}`,
 					`git_head: ${gitHead ?? "unknown"}`,
 					`platform: ${process.platform}`,
 					`arch: ${process.arch}`,
@@ -266,15 +458,16 @@ export async function prepareContributionPrep(
 	const manifestPath = path.join(artifactDir, "manifest.json");
 	const workerPromptPath = path.join(artifactDir, "worker-prompt.md");
 	await Bun.write(workerPromptPath, `${buildContributionPrepWorkerPrompt(manifestPath)}\n`);
+	const manifestArtifacts = artifacts.map(artifact => ({ ...artifact, path: path.basename(artifact.path) }));
 
 	const manifest: ContributionPrepManifest = {
 		schema_version: CONTRIBUTION_PREP_SCHEMA_VERSION,
-		source_session_id: context.sessionId,
+		source_session_id: redact(context.sessionId),
 		created_at: createdAt,
-		cwd: redact(context.cwd),
+		cwd: redact(workspaceLabel),
 		git_head: gitHead,
 		changed_files: files.map(redact),
-		artifacts,
+		artifacts: manifestArtifacts,
 		redactions: [...redactions.labels].sort(),
 		recommended_output: [
 			"title",
@@ -285,7 +478,7 @@ export async function prepareContributionPrep(
 			"tests to run",
 			"uncertainty / remaining risks",
 		],
-		worker_prompt_path: workerPromptPath,
+		worker_prompt_path: path.basename(workerPromptPath),
 	};
 	await Bun.write(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
 
@@ -309,8 +502,8 @@ export async function prepareContributionPrep(
 			});
 		const command = resolveGjcCommand();
 		await spawn(
-			[command.cmd, ...command.args, "--no-skills", "--", `@${workerPromptPath}`],
-			context.cwd,
+			[command.cmd, ...command.args, "--no-skills", "--", `@${path.basename(workerPromptPath)}`],
+			artifactDir,
 			command.shell,
 		);
 		spawned = true;

package/src/session/fallback-chain-controller.ts

@@ -1,3 +1,4 @@
+import { cleanReason } from "@gajae-code/ai/auth-broker/redact";
 import type { FallbackTriggerClass } from "@gajae-code/ai/utils/fallback-transport";
 
 /** Immutable configured fallback intent. Transient attempt state never belongs here. */
@@ -265,6 +266,43 @@ export function compactionRetryDelay(
 	return Math.max(0, bounded);
 }
 
+export interface CompactionCandidateFailure {
+	readonly model: string;
+	readonly message: string;
+}
+
+function sanitizeCompactionCandidateFailureMessage(message: string): string {
+	const cleaned = cleanReason(message) ?? "Compaction candidate failed.";
+	return cleaned.replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s<>'"]+/gi, "[redacted URL]");
+}
+
+/**
+ * Error for an auto-compaction run whose every candidate failed.
+ *
+ * The candidate chain starts at the session model and ends on a same-provider
+ * largest-context fallback, so surfacing only the final error named a model
+ * the user never chose and hid that their own model had already failed the
+ * same way. The message leads with the first failure (the one the user can act
+ * on), then lists every candidate that was tried with its own error. `cause`
+ * is the final error so callers that classify by type keep the same object.
+ */
+export function describeCompactionCandidateFailures(
+	failures: readonly CompactionCandidateFailure[],
+	lastError: unknown,
+): Error {
+	if (failures.length === 0)
+		return new Error("Compaction failed: no candidate failure details available.", { cause: lastError });
+	const first = failures[0]!;
+	const firstMessage = sanitizeCompactionCandidateFailureMessage(first.message);
+	const lines = failures.map(
+		failure => `  ${failure.model}: ${sanitizeCompactionCandidateFailureMessage(failure.message)}`,
+	);
+	return new Error(
+		`${firstMessage} (${first.model}); ${failures.length} compaction candidates failed:\n${lines.join("\n")}`,
+		{ cause: lastError },
+	);
+}
+
 /** Retry-After is intentionally uncapped. */
 export function effectiveFallbackDelay(
 	baseDelayMs: number,

package/src/session/internal/managed-session-storage.ts

@@ -52,6 +52,20 @@ const LOCK_LEASE_MS = 60_000;
 const LOCK_HEARTBEAT_MS = 10_000;
 const LOCK_WAIT_MS = 5_000;
 
+/** A pre-mutation append fence rejection: no bytes from this append were written. */
+export class ManagedAppendIdentityMismatchError extends Error {
+	readonly code = "managed_append_identity_mismatch";
+	readonly relativePath: string;
+	readonly operatorMessage =
+		"Session was resumed by another process; this resume did not run. Retry, or resume a different session.";
+
+	constructor(relativePath: string) {
+		super("managed_append_identity_mismatch");
+		this.name = "ManagedAppendIdentityMismatchError";
+		this.relativePath = relativePath;
+	}
+}
+
 export class ManagedPublishError extends Error {
 	readonly classification:
 		| "destination_conflict"
@@ -1806,7 +1820,7 @@ export class ManagedSessionDescendantStore {
 				current.size.toString() === expected.size &&
 				current.sha256 === expected.sha256;
 			if (!identityMatches) {
-				throw new Error("managed_append_identity_mismatch");
+				throw new ManagedAppendIdentityMismatchError(relativePath);
 			}
 			// mtime/ctime drift on the same file object is harmless. The append
 			// helper performs its own descriptor-bound mutation check.
@@ -1820,7 +1834,7 @@ export class ManagedSessionDescendantStore {
 			return managedAppendReceiptFromIdentity(appended);
 		}
 		const current = this.captureBoundedAppendExpectation(relativePath);
-		if (!current) throw new Error("managed_append_identity_mismatch");
+		if (!current) throw new ManagedAppendIdentityMismatchError(relativePath);
 		if (
 			current.dev !== expected.dev ||
 			current.ino !== expected.ino ||
@@ -1828,7 +1842,7 @@ export class ManagedSessionDescendantStore {
 			current.size !== expected.size ||
 			current.sha256 !== expected.sha256
 		)
-			throw new Error("managed_append_identity_mismatch");
+			throw new ManagedAppendIdentityMismatchError(relativePath);
 		const descriptorMatches =
 			current.dev === expected.dev &&
 			current.ino === expected.ino &&
@@ -1862,7 +1876,7 @@ export class ManagedSessionDescendantStore {
 		expected: ManagedFileIdentity,
 	): ManagedAppendReceipt {
 		const bounded = this.captureBoundedAppendExpectation(relativePath);
-		if (!bounded) throw new Error("managed_append_identity_mismatch");
+		if (!bounded) throw new ManagedAppendIdentityMismatchError(relativePath);
 		const descriptorMatches =
 			bounded.dev === expected.dev.toString() &&
 			bounded.ino === expected.ino.toString() &&
@@ -1882,7 +1896,7 @@ export class ManagedSessionDescendantStore {
 				bounded.size !== String(expected.size) ||
 				bounded.sha256 !== expected.sha256
 			)
-				throw new Error("managed_append_identity_mismatch");
+				throw new ManagedAppendIdentityMismatchError(relativePath);
 		}
 		return this.appendExpectedSync(relativePath, bytes, bounded);
 	}

package/src/session/messages.ts

@@ -212,6 +212,7 @@ export interface BashExecutionMessage {
 	command: string;
 	output: string;
 	exitCode: number | undefined;
+	signal?: string;
 	cancelled: boolean;
 	truncated: boolean;
 	meta?: OutputMeta;
@@ -313,6 +314,10 @@ export function bashExecutionToText(msg: BashExecutionMessage): string {
 	}
 	if (msg.cancelled) {
 		text += "\n\n(command cancelled)";
+	} else if (msg.signal) {
+		text += `\n\nCommand terminated by ${msg.signal}${
+			msg.exitCode !== null && msg.exitCode !== undefined ? ` (exit code ${msg.exitCode})` : ""
+		}`;
 	} else if (msg.exitCode !== null && msg.exitCode !== undefined && msg.exitCode !== 0) {
 		text += `\n\nCommand exited with code ${msg.exitCode}`;
 	}

package/src/session/session-manager.ts

@@ -112,6 +112,7 @@ import {
 	captureManagedFileNoFollow,
 	fsyncManagedArtifactTree,
 	MANAGED_ARTIFACT_MAX_FILE_BYTES,
+	ManagedAppendIdentityMismatchError,
 	type ManagedAppendReceipt,
 	type ManagedBoundedAppendExpectation,
 	ManagedCommittedMutationError,
@@ -11873,6 +11874,10 @@ export class SessionManager {
 		return false;
 	}
 
+	/** Ownership loss remains observable even when an agent event listener aborts the turn. */
+	getAppendIdentityMismatch(): ManagedAppendIdentityMismatchError | undefined {
+		return this.#persistError instanceof ManagedAppendIdentityMismatchError ? this.#persistError : undefined;
+	}
 	#recordPersistError(err: unknown): Error {
 		const normalized = toError(err);
 		if (!this.#persistError) this.#persistError = normalized;
@@ -16255,7 +16260,11 @@ export class SessionManager {
 			}
 		}
 		const outcome = await this.closeStrict();
-		return priorFlushError && outcome.kind === "closed" ? { kind: "close_unknown", error: priorFlushError } : outcome;
+		return priorFlushError &&
+			!(priorFlushError instanceof ManagedAppendIdentityMismatchError) &&
+			outcome.kind === "closed"
+			? { kind: "close_unknown", error: priorFlushError }
+			: outcome;
 	}
 
 	/**
@@ -16280,6 +16289,21 @@ export class SessionManager {
 			});
 		}
 		if (preparedCleanupError) return { kind: "close_failed_retryable", error: preparedCleanupError };
+		await this.#persistChain;
+		// Managed appends are synchronous and reject identity drift before writing.
+		// Disown the stale transcript, not an uncertain OS writer: never rewrite a
+		// successor owned by another process while disposing this rejected resume.
+		if (
+			this.destination.kind === "managed" &&
+			!this.#persistWriter &&
+			this.#persistError instanceof ManagedAppendIdentityMismatchError
+		) {
+			this.#needsFullRewriteOnNextPersist = false;
+			this.#strictResumeMutationPending = false;
+			this.#managedPersistExpectedIdentity = undefined;
+			this.#persistError = undefined;
+			this.#persistErrorReported = false;
+		}
 		let priorPersistError = this.#persistError;
 		if (this.#needsFullRewriteOnNextPersist && (!this.#readOnlyResume || this.#strictResumeMutationPending)) {
 			await this.#persistChain.catch(() => {});
@@ -17379,10 +17403,7 @@ export class SessionManager {
 					receipt = store.appendExpectedIdentitySync(relativePath, bytes, this.#managedPersistExpectedIdentity);
 				} catch (err) {
 					const predecessorMissing = store.descriptorExpected(relativePath) === null;
-					if (
-						!isEnoent(err) &&
-						(!(err instanceof Error) || err.message !== "managed_append_identity_mismatch" || !predecessorMissing)
-					)
+					if (!isEnoent(err) && (!(err instanceof ManagedAppendIdentityMismatchError) || !predecessorMissing))
 						throw err;
 					// Appending only the new records would create a truncated transcript.
 					// Recreate the missing file from the complete resident entry set instead.
@@ -17724,6 +17745,9 @@ export class SessionManager {
 			if (entry.type === "label") this.#labelRevision++;
 			if (sidecarAppendCharge > 0) activeRuntime?.accountant.release(sidecarAppendCharge);
 			if (sidecarTailCharge > 0) activeRuntime?.tailCache.release(sidecarTailCharge);
+			// The pre-write fence is an expected ownership loss, not an uncertain
+			// append. Preserve its type after rolling back the rejected entry.
+			if (error instanceof ManagedAppendIdentityMismatchError) throw error;
 			throw new SessionAppendPersistenceError(
 				priorPersistenceError ? "prior_failure" : "current_append",
 				residentEntry.id,

package/src/session-import/redact.ts

@@ -59,7 +59,11 @@ const REDACTION_RULES: readonly RedactionRule[] = [
 	// Long hex secrets (64+ hex chars: webhook secrets, signing keys).
 	{ id: "hex-secret", pattern: new RegExp(`\\b${HEX}{64,}\\b`, "g") },
 	// Basic-auth credentials embedded in URLs (https://user:pass@host).
-	{ id: "url-credential", pattern: /([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]{1,256}:[^/\s@]{1,256}@/gi },
+	// The scheme repetition is bounded. Unbounded `[a-z0-9+.-]*` in front of the
+	// literal `://` re-tries every prefix of a long alphabetic run before failing,
+	// which is quadratic in the input length: 200 KB of ordinary prose costs ~10s.
+	// IANA's longest registered scheme is well under 16 characters.
+	{ id: "url-credential", pattern: /([a-z][a-z0-9+.-]{0,15}:\/\/)[^/\s:@]{1,256}:[^/\s@]{1,256}@/gi },
 	// Sensitive env/KEY assignments: OPENAI_API_KEY=..., token: ..., password = ...
 	// The name prefix is optional so a bare sensitive name (`password: …`) also matches.
 	{