@gajae-code/coding-agent 0.16.4 → 0.16.6

package/src/session/agent-session.ts

@@ -439,6 +439,7 @@ import {
 	type ConfiguredFallbackChain,
 	cappedExponentialWithFullJitter,
 	compactionRetryDelay,
+	describeCompactionCandidateFailures,
 	effectiveFallbackDelay,
 	FallbackChainController,
 	type FallbackChainRuntimeState,
@@ -2791,7 +2792,7 @@ export class AgentSession {
 		this.#activeAttemptScope = undefined;
 		this.#activeLogicalRunId = undefined;
 	}
-	#acceptSdkAttemptRun(handle: AttemptRunHandle, sdkRunToken?: string): void {
+	#acceptSdkAttemptRun(handle: AttemptRunHandle, sdkRunToken?: string, sdkRunTokens?: string[]): void {
 		const predecessorScope = this.#activeAttemptScope;
 		const predecessorSdkRunToken =
 			predecessorScope === undefined ? undefined : this.#sdkRunTokensByAttemptScope.get(predecessorScope);
@@ -2804,6 +2805,11 @@ export class AgentSession {
 		if (sdkRunToken !== undefined) {
 			this.#activeSdkRunToken = sdkRunToken;
 			this.#sdkRunTokensByAttemptScope.set(handle.scope, sdkRunToken);
+			const inheritedCohort =
+				predecessorScope !== undefined && predecessorSdkRunToken === sdkRunToken
+					? this.#sdkRunCohortsByAttemptScope.get(predecessorScope)
+					: undefined;
+			this.#sdkRunCohortsByAttemptScope.set(handle.scope, sdkRunTokens ?? inheritedCohort ?? [sdkRunToken]);
 		}
 		if (carryRecoverySkip) this.#skipPostPromptRecoveryWaitByAttemptScope.add(handle.scope);
 	}
@@ -3108,6 +3114,7 @@ export class AgentSession {
 	#sdkRunTokensByQueuedMessage = new WeakMap<AgentMessage, string>();
 	#skipPostPromptRecoveryWaitByAttemptScope = new WeakSet<AttemptScope>();
 	#sdkRunTokensByAttemptScope = new WeakMap<AttemptScope, string>();
+	#sdkRunCohortsByAttemptScope = new WeakMap<AttemptScope, string[]>();
 	#activeSdkRunToken: string | undefined;
 	#activeAttemptScope: AttemptScope | undefined;
 	#attemptAuthority!: AttemptScopeAuthority;
@@ -4578,7 +4585,7 @@ export class AgentSession {
 		this.#transformContext = config.transformContext ?? (messages => messages);
 		const configuredOnPayload = config.onPayload;
 		this.#onPayload = configuredOnPayload
-			? (payload, model, scope) => configuredOnPayload(payload, model, scope)
+			? (payload, model, scope, signal) => configuredOnPayload(payload, model, scope, signal)
 			: undefined;
 		this.rawSseDebugBuffer = config.rawSseDebugBuffer ?? new RawSseDebugBuffer();
 		// Avoid wrapping in an `async` closure when no user callback is configured: the
@@ -4587,9 +4594,9 @@ export class AgentSession {
 		// shows up as ~3.5% self time in streaming profiles.
 		const configuredOnResponse = config.onResponse;
 		this.#onResponse = configuredOnResponse
-			? async (response, model, scope) => {
+			? async (response, model, scope, signal) => {
 					this.rawSseDebugBuffer.recordResponse(response, model);
-					await configuredOnResponse(response, model, scope);
+					await configuredOnResponse(response, model, scope, signal);
 				}
 			: (response, model, _scope) => {
 					this.rawSseDebugBuffer.recordResponse(response, model);
@@ -6925,12 +6932,15 @@ export class AgentSession {
 					assistantMsg.stopReason !== "aborted" &&
 					this.#retryAttempt > 0
 				) {
+					// Clear ownership before notifying observers: agent_end may run while
+					// the success event is awaiting its subscribers.
+					const attempt = this.#retryAttempt;
+					this.#retryAttempt = 0;
 					await this.#emitSessionEvent({
 						type: "auto_retry_end",
 						success: true,
-						attempt: this.#retryAttempt,
+						attempt,
 					});
-					this.#retryAttempt = 0;
 					// Settle the retry gate here, colocated with the success event, rather
 					// than relying on the generic #resolveRetry() at the end of the
 					// agent_end branch. That tail resolver is bypassed by every early
@@ -7530,15 +7540,19 @@ export class AgentSession {
 												const inheritedSdkRunToken = options?.continueQueuedOnly
 													? undefined
 													: (options?.sdkRunToken ?? scheduledSdkRunToken);
-												const consumedSdkRunToken = acceptance.consumedQueuedMessages
+												const consumedSdkRunTokens = acceptance.consumedQueuedMessages
 													.map(message => this.#sdkRunTokensByQueuedMessage.get(message))
-													.find((token): token is string => token !== undefined);
-												const sdkRunToken = consumedSdkRunToken ?? inheritedSdkRunToken;
+													.filter((token): token is string => token !== undefined);
+												const sdkRunToken = consumedSdkRunTokens[0] ?? inheritedSdkRunToken;
 												this.#fireQueuedPromotionHooks(acceptance.consumedQueuedMessages, {
 													startsOwnRun: startsOwn,
 												});
 												if (startsOwn) this.#activeSdkRunToken = sdkRunToken;
-												this.#acceptSdkAttemptRun(handle, sdkRunToken);
+												this.#acceptSdkAttemptRun(
+													handle,
+													sdkRunToken,
+													consumedSdkRunTokens.length > 0 ? consumedSdkRunTokens : undefined,
+												);
 												options?.onRunAccepted?.(handle);
 												// Keep the queued token available through the acceptance callback;
 												// SDK follow-up owners bind it to the new attempt scope there.
@@ -8674,6 +8688,9 @@ export class AgentSession {
 					{
 						type: "agent_start",
 						...(sdkRunToken ? { sdkRunToken } : {}),
+						...(deliveryScope
+							? { sdkRunTokens: this.#sdkRunCohortsByAttemptScope.get(deliveryScope as AttemptScope) }
+							: {}),
 					},
 					undefined,
 					deliveryScope,
@@ -9549,6 +9566,11 @@ export class AgentSession {
 		});
 	}
 
+	/** Test seam: await all currently admitted coordinator sidecar writes. */
+	async awaitCoordinatorRuntimeStatePersistenceForTests(): Promise<void> {
+		await this.#coordinatorPersistQueue;
+		await this.#drainUnbarrieredCoordinatorPersists();
+	}
 	queueCoordinatorRuntimeStatePersistForTests(event: AgentSessionEvent, gate: Promise<void>): Promise<void> {
 		this.#agentEventAdmission.set(event, {
 			persistGeneration: this.#coordinatorPersistGeneration,
@@ -10275,11 +10297,12 @@ export class AgentSession {
 		let wrappersByVersion = this.#guardedToolWrapperCache.get(tool);
 		const cached = wrappersByVersion?.get(cacheKey);
 		if (cached) return cached as T;
-		const wrapped = this.#wrapToolForCwdTransitionFence(
+		const innerTool = tool instanceof ExtensionToolWrapper ? tool.getInnerTool() : tool;
+		const guarded = this.#wrapToolForCwdTransitionFence(
 			this.#wrapToolForWorkflowMutationGuard(
 				this.#wrapToolForAcpPermission(
 					guardToolForUltragoalAsk(
-						tool,
+						innerTool,
 						() => this.sessionManager.getCwd(),
 						() => ({
 							activeSkillState: this.getActiveSkillState(),
@@ -10290,6 +10313,7 @@ export class AgentSession {
 				),
 			),
 		);
+		const wrapped = (this.#extensionRunner ? new ExtensionToolWrapper(guarded, this.#extensionRunner) : guarded) as T;
 		// The object published into `agent.state.tools` — and therefore the object the
 		// agent loop actually dispatches to — is this guard wrapper, not the registry
 		// entry. A wrapper built from a proven built-in inherits that proof; one built
@@ -10970,10 +10994,10 @@ export class AgentSession {
 				preparedOptions.onPayload = sessionOnPayload;
 			} else {
 				const requestOnPayload = options.onPayload;
-				preparedOptions.onPayload = async (payload, model, callbackScope) => {
-					const sessionPayload = await sessionOnPayload(payload, model, callbackScope);
+				preparedOptions.onPayload = async (payload, model, callbackScope, signal) => {
+					const sessionPayload = await sessionOnPayload(payload, model, callbackScope, signal);
 					const sessionResolvedPayload = sessionPayload ?? payload;
-					const requestPayload = await requestOnPayload(sessionResolvedPayload, model, callbackScope);
+					const requestPayload = await requestOnPayload(sessionResolvedPayload, model, callbackScope, signal);
 					return requestPayload ?? sessionResolvedPayload;
 				};
 			}
@@ -10984,9 +11008,9 @@ export class AgentSession {
 				preparedOptions.onResponse = sessionOnResponse;
 			} else {
 				const requestOnResponse = options.onResponse;
-				preparedOptions.onResponse = async (response, model, callbackScope) => {
-					await sessionOnResponse(response, model, callbackScope);
-					await requestOnResponse(response, model, callbackScope);
+				preparedOptions.onResponse = async (response, model, callbackScope, signal) => {
+					await sessionOnResponse(response, model, callbackScope, signal);
+					await requestOnResponse(response, model, callbackScope, signal);
 				};
 			}
 		}
@@ -11867,6 +11891,11 @@ export class AgentSession {
 		const releaseStartupPromptWaiter = this.#reserveStartupPromptWaiter();
 		try {
 			await this.#promptInternal(text, options, releaseStartupPromptWaiter);
+			// Agent-core converts listener failures into an aborted response. Keep a
+			// rejected persistence fence typed at the public prompt boundary instead
+			// of reporting the misleading provider-level "Request was aborted".
+			const appendRejection = this.sessionManager.getAppendIdentityMismatch();
+			if (appendRejection) throw appendRejection;
 		} finally {
 			releaseStartupPromptWaiter();
 		}
@@ -12458,6 +12487,14 @@ export class AgentSession {
 			hasPendingNextTurnMessages = pendingNextTurnMessageCount > 0;
 			const promptAttribution: "user" | "agent" | undefined =
 				"attribution" in message ? message.attribution : undefined;
+			let effectivePrompt = expandedText;
+			const messageImages =
+				"content" in message && Array.isArray(message.content)
+					? message.content.filter((content): content is ImageContent => content.type === "image")
+					: undefined;
+			let effectiveImages =
+				options?.images ?? (messageImages && messageImages.length > 0 ? messageImages : undefined);
+			let promptMessage = message;
 			let phaseACompleted = false;
 			let fileMentionMessages: AgentMessage[] = [];
 			let beforeAgentStartResultMessages: BeforeAgentStartInternalMessage[] = [];
@@ -12478,7 +12515,49 @@ export class AgentSession {
 				if (!phaseACompleted) {
 					phaseACompleted = true;
 					// Phase A (one-time side-effectful products; runs once).
-					const fileMentions = extractFileMentions(expandedText);
+					const beforeAgentStartSystemPrompt = await this.#buildSystemPromptForAgentStart(effectivePrompt);
+					hindsightRecall = this.getHindsightSessionState()?.getRecallSnippetForInjection();
+					planReferenceMessage = await this.#buildPlanReferenceMessage();
+					// Emit before_agent_start extension event. Race hook completion with
+					// prompt cancellation so a wedged hook cannot retain SDK prompt authority.
+					if (this.#extensionRunner?.hasHandlers("before_agent_start")) this.#markRetryReplayUnsafe();
+					if (this.#extensionRunner) {
+						const result = await this.#awaitPromptPreflight(
+							generation,
+							preflightSignal,
+							this.#extensionRunner.emitBeforeAgentStart(
+								effectivePrompt,
+								effectiveImages,
+								beforeAgentStartSystemPrompt,
+								preflightSignal,
+							),
+						);
+						if (result?.messages) beforeAgentStartResultMessages = [...result.messages];
+						if (result?.prompt !== undefined) effectivePrompt = result.prompt;
+						if (result && Object.hasOwn(result, "images")) effectiveImages = result.images;
+						if (result?.prompt !== undefined || (result && Object.hasOwn(result, "images"))) {
+							if (
+								promptMessage.role === "user" ||
+								promptMessage.role === "developer" ||
+								promptMessage.role === "custom"
+							) {
+								promptMessage = {
+									...promptMessage,
+									content: [{ type: "text", text: effectivePrompt }, ...(effectiveImages ?? [])],
+								};
+							}
+						}
+						if (result?.systemPrompt !== undefined) {
+							this.agent.setSystemPrompt(result.systemPrompt);
+						} else if (result?.prompt !== undefined) {
+							this.agent.setSystemPrompt(await this.#buildSystemPromptForAgentStart(effectivePrompt));
+						} else {
+							this.agent.setSystemPrompt(beforeAgentStartSystemPrompt);
+						}
+					} else {
+						this.agent.setSystemPrompt(beforeAgentStartSystemPrompt);
+					}
+					const fileMentions = extractFileMentions(effectivePrompt);
 					if (fileMentions.length > 0) {
 						const cwd = this.sessionManager.getCwd();
 						// Collect resolved paths already shown (read or mentioned) in the
@@ -12506,31 +12585,6 @@ export class AgentSession {
 							recentlyShownPaths,
 						});
 					}
-					const beforeAgentStartSystemPrompt = await this.#buildSystemPromptForAgentStart(expandedText);
-					hindsightRecall = this.getHindsightSessionState()?.getRecallSnippetForInjection();
-					planReferenceMessage = await this.#buildPlanReferenceMessage();
-					// Emit before_agent_start extension event. Race hook completion with
-					// prompt cancellation so a wedged hook cannot retain SDK prompt authority.
-					if (this.#extensionRunner?.hasHandlers("before_agent_start")) this.#markRetryReplayUnsafe();
-					if (this.#extensionRunner) {
-						const result = await this.#awaitPromptPreflight(
-							generation,
-							preflightSignal,
-							this.#extensionRunner.emitBeforeAgentStart(
-								expandedText,
-								options?.images,
-								beforeAgentStartSystemPrompt,
-							),
-						);
-						if (result?.messages) beforeAgentStartResultMessages = [...result.messages];
-						if (result?.systemPrompt !== undefined) {
-							this.agent.setSystemPrompt(result.systemPrompt);
-						} else {
-							this.agent.setSystemPrompt(beforeAgentStartSystemPrompt);
-						}
-					} else {
-						this.agent.setSystemPrompt(beforeAgentStartSystemPrompt);
-					}
 					// Invoke first-party internal before-agent-start contributors. These
 					// run alongside the extension runner (not via user-loaded hooks) and
 					// append through the same custom-message attribution path. Errors are nonfatal.
@@ -12541,8 +12595,8 @@ export class AgentSession {
 									generation,
 									preflightSignal,
 									contributor({
-										prompt: expandedText,
-										images: options?.images,
+										prompt: effectivePrompt,
+										images: effectiveImages,
 										sessionId: this.sessionId,
 									}),
 								);
@@ -12600,7 +12654,7 @@ export class AgentSession {
 				}
 
 				const promptIndex = messages.length;
-				messages.push(message);
+				messages.push(promptMessage);
 
 				// Re-present captured pending next-turn messages (never drained here).
 				// Reclassify deferred envelopes before injecting them into the new
@@ -19435,10 +19489,10 @@ export class AgentSession {
 					isError: message.isError,
 					content: this.#normalizeProviderReplayValue(message.content),
 				};
-			case "bashExecution":
+			case "pythonExecution":
 				return {
 					role: message.role,
-					command: message.command,
+					code: message.code,
 					output: message.output,
 					exitCode: message.exitCode,
 					cancelled: message.cancelled,
@@ -19456,12 +19510,13 @@ export class AgentSession {
 						: undefined,
 					excludeFromContext: message.excludeFromContext,
 				};
-			case "pythonExecution":
+			case "bashExecution":
 				return {
 					role: message.role,
-					code: message.code,
+					command: message.command,
 					output: message.output,
 					exitCode: message.exitCode,
+					signal: message.signal,
 					cancelled: message.cancelled,
 					meta: message.meta
 						? {
@@ -20160,6 +20215,10 @@ export class AgentSession {
 				const telemetry = resolveTelemetry(this.agent.telemetry, this.sessionId);
 				let compactResult: CompactionResult | undefined;
 				let lastError: unknown;
+				// Every candidate that was tried and failed, in order. Only the last failure
+				// used to reach the user, which named whichever same-provider fallback the
+				// chain ended on and hid that the session model itself had already failed.
+				const candidateFailures: Array<{ model: string; message: string }> = [];
 
 				for (const candidate of candidates) {
 					const apiKey = await this.#modelRegistry.getApiKey(candidate, this.credentialSessionId);
@@ -20193,6 +20252,7 @@ export class AgentSession {
 							const message = error instanceof Error ? error.message : String(error);
 							if (this.#isCompactionAuthFailure(error)) {
 								lastError = this.#buildCompactionAuthError();
+								candidateFailures.push({ model: `${candidate.provider}/${candidate.id}`, message });
 								break;
 							}
 							const retryAfterMs = this.#parseRetryAfterMsFromError(message);
@@ -20205,6 +20265,7 @@ export class AgentSession {
 									isUsageLimitError(message));
 							if (!shouldRetry) {
 								lastError = error;
+								candidateFailures.push({ model: `${candidate.provider}/${candidate.id}`, message });
 								break;
 							}
 
@@ -20229,6 +20290,7 @@ export class AgentSession {
 										model: `${candidate.provider}/${candidate.id}`,
 									});
 									lastError = error;
+									candidateFailures.push({ model: `${candidate.provider}/${candidate.id}`, message });
 									break; // Exit retry loop, continue to next candidate
 								}
 								// No more candidates - we have to wait
@@ -20254,7 +20316,9 @@ export class AgentSession {
 
 				if (!compactResult) {
 					if (lastError) {
-						throw lastError;
+						throw candidateFailures.length > 1
+							? describeCompactionCandidateFailures(candidateFailures, lastError)
+							: lastError;
 					}
 					throw new Error("Compaction failed: no available model");
 				}
@@ -22329,6 +22393,7 @@ export class AgentSession {
 			command,
 			output: result.output,
 			exitCode: result.exitCode,
+			signal: result.signal,
 			cancelled: result.cancelled,
 			truncated: result.truncated,
 			meta,

package/src/session/fallback-chain-controller.ts

@@ -1,3 +1,4 @@
+import { cleanReason } from "@gajae-code/ai/auth-broker/redact";
 import type { FallbackTriggerClass } from "@gajae-code/ai/utils/fallback-transport";
 
 /** Immutable configured fallback intent. Transient attempt state never belongs here. */
@@ -265,6 +266,43 @@ export function compactionRetryDelay(
 	return Math.max(0, bounded);
 }
 
+export interface CompactionCandidateFailure {
+	readonly model: string;
+	readonly message: string;
+}
+
+function sanitizeCompactionCandidateFailureMessage(message: string): string {
+	const cleaned = cleanReason(message) ?? "Compaction candidate failed.";
+	return cleaned.replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s<>'"]+/gi, "[redacted URL]");
+}
+
+/**
+ * Error for an auto-compaction run whose every candidate failed.
+ *
+ * The candidate chain starts at the session model and ends on a same-provider
+ * largest-context fallback, so surfacing only the final error named a model
+ * the user never chose and hid that their own model had already failed the
+ * same way. The message leads with the first failure (the one the user can act
+ * on), then lists every candidate that was tried with its own error. `cause`
+ * is the final error so callers that classify by type keep the same object.
+ */
+export function describeCompactionCandidateFailures(
+	failures: readonly CompactionCandidateFailure[],
+	lastError: unknown,
+): Error {
+	if (failures.length === 0)
+		return new Error("Compaction failed: no candidate failure details available.", { cause: lastError });
+	const first = failures[0]!;
+	const firstMessage = sanitizeCompactionCandidateFailureMessage(first.message);
+	const lines = failures.map(
+		failure => `  ${failure.model}: ${sanitizeCompactionCandidateFailureMessage(failure.message)}`,
+	);
+	return new Error(
+		`${firstMessage} (${first.model}); ${failures.length} compaction candidates failed:\n${lines.join("\n")}`,
+		{ cause: lastError },
+	);
+}
+
 /** Retry-After is intentionally uncapped. */
 export function effectiveFallbackDelay(
 	baseDelayMs: number,

package/src/session/internal/managed-session-storage.ts

@@ -52,6 +52,20 @@ const LOCK_LEASE_MS = 60_000;
 const LOCK_HEARTBEAT_MS = 10_000;
 const LOCK_WAIT_MS = 5_000;
 
+/** A pre-mutation append fence rejection: no bytes from this append were written. */
+export class ManagedAppendIdentityMismatchError extends Error {
+	readonly code = "managed_append_identity_mismatch";
+	readonly relativePath: string;
+	readonly operatorMessage =
+		"Session was resumed by another process; this resume did not run. Retry, or resume a different session.";
+
+	constructor(relativePath: string) {
+		super("managed_append_identity_mismatch");
+		this.name = "ManagedAppendIdentityMismatchError";
+		this.relativePath = relativePath;
+	}
+}
+
 export class ManagedPublishError extends Error {
 	readonly classification:
 		| "destination_conflict"
@@ -1806,7 +1820,7 @@ export class ManagedSessionDescendantStore {
 				current.size.toString() === expected.size &&
 				current.sha256 === expected.sha256;
 			if (!identityMatches) {
-				throw new Error("managed_append_identity_mismatch");
+				throw new ManagedAppendIdentityMismatchError(relativePath);
 			}
 			// mtime/ctime drift on the same file object is harmless. The append
 			// helper performs its own descriptor-bound mutation check.
@@ -1820,7 +1834,7 @@ export class ManagedSessionDescendantStore {
 			return managedAppendReceiptFromIdentity(appended);
 		}
 		const current = this.captureBoundedAppendExpectation(relativePath);
-		if (!current) throw new Error("managed_append_identity_mismatch");
+		if (!current) throw new ManagedAppendIdentityMismatchError(relativePath);
 		if (
 			current.dev !== expected.dev ||
 			current.ino !== expected.ino ||
@@ -1828,7 +1842,7 @@ export class ManagedSessionDescendantStore {
 			current.size !== expected.size ||
 			current.sha256 !== expected.sha256
 		)
-			throw new Error("managed_append_identity_mismatch");
+			throw new ManagedAppendIdentityMismatchError(relativePath);
 		const descriptorMatches =
 			current.dev === expected.dev &&
 			current.ino === expected.ino &&
@@ -1862,7 +1876,7 @@ export class ManagedSessionDescendantStore {
 		expected: ManagedFileIdentity,
 	): ManagedAppendReceipt {
 		const bounded = this.captureBoundedAppendExpectation(relativePath);
-		if (!bounded) throw new Error("managed_append_identity_mismatch");
+		if (!bounded) throw new ManagedAppendIdentityMismatchError(relativePath);
 		const descriptorMatches =
 			bounded.dev === expected.dev.toString() &&
 			bounded.ino === expected.ino.toString() &&
@@ -1882,7 +1896,7 @@ export class ManagedSessionDescendantStore {
 				bounded.size !== String(expected.size) ||
 				bounded.sha256 !== expected.sha256
 			)
-				throw new Error("managed_append_identity_mismatch");
+				throw new ManagedAppendIdentityMismatchError(relativePath);
 		}
 		return this.appendExpectedSync(relativePath, bytes, bounded);
 	}

package/src/session/messages.ts

@@ -212,6 +212,7 @@ export interface BashExecutionMessage {
 	command: string;
 	output: string;
 	exitCode: number | undefined;
+	signal?: string;
 	cancelled: boolean;
 	truncated: boolean;
 	meta?: OutputMeta;
@@ -313,6 +314,10 @@ export function bashExecutionToText(msg: BashExecutionMessage): string {
 	}
 	if (msg.cancelled) {
 		text += "\n\n(command cancelled)";
+	} else if (msg.signal) {
+		text += `\n\nCommand terminated by ${msg.signal}${
+			msg.exitCode !== null && msg.exitCode !== undefined ? ` (exit code ${msg.exitCode})` : ""
+		}`;
 	} else if (msg.exitCode !== null && msg.exitCode !== undefined && msg.exitCode !== 0) {
 		text += `\n\nCommand exited with code ${msg.exitCode}`;
 	}

package/src/session/session-manager.ts

@@ -112,6 +112,7 @@ import {
 	captureManagedFileNoFollow,
 	fsyncManagedArtifactTree,
 	MANAGED_ARTIFACT_MAX_FILE_BYTES,
+	ManagedAppendIdentityMismatchError,
 	type ManagedAppendReceipt,
 	type ManagedBoundedAppendExpectation,
 	ManagedCommittedMutationError,
@@ -11873,6 +11874,10 @@ export class SessionManager {
 		return false;
 	}
 
+	/** Ownership loss remains observable even when an agent event listener aborts the turn. */
+	getAppendIdentityMismatch(): ManagedAppendIdentityMismatchError | undefined {
+		return this.#persistError instanceof ManagedAppendIdentityMismatchError ? this.#persistError : undefined;
+	}
 	#recordPersistError(err: unknown): Error {
 		const normalized = toError(err);
 		if (!this.#persistError) this.#persistError = normalized;
@@ -16255,7 +16260,11 @@ export class SessionManager {
 			}
 		}
 		const outcome = await this.closeStrict();
-		return priorFlushError && outcome.kind === "closed" ? { kind: "close_unknown", error: priorFlushError } : outcome;
+		return priorFlushError &&
+			!(priorFlushError instanceof ManagedAppendIdentityMismatchError) &&
+			outcome.kind === "closed"
+			? { kind: "close_unknown", error: priorFlushError }
+			: outcome;
 	}
 
 	/**
@@ -16280,6 +16289,21 @@ export class SessionManager {
 			});
 		}
 		if (preparedCleanupError) return { kind: "close_failed_retryable", error: preparedCleanupError };
+		await this.#persistChain;
+		// Managed appends are synchronous and reject identity drift before writing.
+		// Disown the stale transcript, not an uncertain OS writer: never rewrite a
+		// successor owned by another process while disposing this rejected resume.
+		if (
+			this.destination.kind === "managed" &&
+			!this.#persistWriter &&
+			this.#persistError instanceof ManagedAppendIdentityMismatchError
+		) {
+			this.#needsFullRewriteOnNextPersist = false;
+			this.#strictResumeMutationPending = false;
+			this.#managedPersistExpectedIdentity = undefined;
+			this.#persistError = undefined;
+			this.#persistErrorReported = false;
+		}
 		let priorPersistError = this.#persistError;
 		if (this.#needsFullRewriteOnNextPersist && (!this.#readOnlyResume || this.#strictResumeMutationPending)) {
 			await this.#persistChain.catch(() => {});
@@ -17379,10 +17403,7 @@ export class SessionManager {
 					receipt = store.appendExpectedIdentitySync(relativePath, bytes, this.#managedPersistExpectedIdentity);
 				} catch (err) {
 					const predecessorMissing = store.descriptorExpected(relativePath) === null;
-					if (
-						!isEnoent(err) &&
-						(!(err instanceof Error) || err.message !== "managed_append_identity_mismatch" || !predecessorMissing)
-					)
+					if (!isEnoent(err) && (!(err instanceof ManagedAppendIdentityMismatchError) || !predecessorMissing))
 						throw err;
 					// Appending only the new records would create a truncated transcript.
 					// Recreate the missing file from the complete resident entry set instead.
@@ -17724,6 +17745,9 @@ export class SessionManager {
 			if (entry.type === "label") this.#labelRevision++;
 			if (sidecarAppendCharge > 0) activeRuntime?.accountant.release(sidecarAppendCharge);
 			if (sidecarTailCharge > 0) activeRuntime?.tailCache.release(sidecarTailCharge);
+			// The pre-write fence is an expected ownership loss, not an uncertain
+			// append. Preserve its type after rolling back the rejected entry.
+			if (error instanceof ManagedAppendIdentityMismatchError) throw error;
 			throw new SessionAppendPersistenceError(
 				priorPersistenceError ? "prior_failure" : "current_append",
 				residentEntry.id,

package/src/session-import/redact.ts

@@ -59,7 +59,11 @@ const REDACTION_RULES: readonly RedactionRule[] = [
 	// Long hex secrets (64+ hex chars: webhook secrets, signing keys).
 	{ id: "hex-secret", pattern: new RegExp(`\\b${HEX}{64,}\\b`, "g") },
 	// Basic-auth credentials embedded in URLs (https://user:pass@host).
-	{ id: "url-credential", pattern: /([a-z][a-z0-9+.-]*:\/\/)[^/\s:@]{1,256}:[^/\s@]{1,256}@/gi },
+	// The scheme repetition is bounded. Unbounded `[a-z0-9+.-]*` in front of the
+	// literal `://` re-tries every prefix of a long alphabetic run before failing,
+	// which is quadratic in the input length: 200 KB of ordinary prose costs ~10s.
+	// IANA's longest registered scheme is well under 16 characters.
+	{ id: "url-credential", pattern: /([a-z][a-z0-9+.-]{0,15}:\/\/)[^/\s:@]{1,256}:[^/\s@]{1,256}@/gi },
 	// Sensitive env/KEY assignments: OPENAI_API_KEY=..., token: ..., password = ...
 	// The name prefix is optional so a bare sensitive name (`password: …`) also matches.
 	{