@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/harness-control-plane/receipt-spool.ts

@@ -1,6 +1,8 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { constants as fsConstants } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
+import { canonicalEnvKey, loadedProjectEnvSnapshot } from "@gajae-code/utils/dirs";
 import { withFileLock } from "../config/file-lock";
 import type { ReceiptEnvelope } from "./receipts";
 
@@ -21,6 +23,42 @@ export interface ReceiptSpoolAppendResult {
 const receiptSpoolDirStorage = new AsyncLocalStorage<string | undefined>();
 const spoolQueues = new Map<string, Promise<void>>();
 const noop = (): void => undefined;
+const NOFOLLOW = fsConstants.O_NOFOLLOW ?? 0;
+
+/** True only when an exception's `code` is `ENOENT`. Other codes propagate. */
+export function isEnoent(error: unknown): boolean {
+	return (error as NodeJS.ErrnoException).code === "ENOENT";
+}
+
+/**
+ * Bun copies the cwd dotenv into `process.env` before module init. The startup
+ * project snapshot is the declaration set trusted directory overrides use: a
+ * path that resolves like that declaration, or a dynamic declaration, is not a
+ * spool directory. A shell or `--receipt-spool-dir` value that resolves
+ * somewhere else is kept.
+ */
+function projectDeclaredReceiptSpoolDir(raw: string): boolean {
+	const snapshot = loadedProjectEnvSnapshot();
+	const key = canonicalEnvKey(RECEIPT_SPOOL_DIR_ENV);
+	const projectValue = snapshot.values[key];
+	if (projectValue === undefined) return false;
+	if (snapshot.dynamic.has(key)) return true;
+	const declared = projectValue.trim();
+	const candidate = raw.trim();
+	if (!declared || !candidate) return declared === candidate;
+	return path.resolve(declared) === path.resolve(candidate);
+}
+
+function adoptReceiptSpoolDir(raw: string | undefined): string | undefined {
+	if (raw === undefined || projectDeclaredReceiptSpoolDir(raw)) return undefined;
+	const trimmed = raw.trim();
+	return trimmed ? path.resolve(trimmed) : undefined;
+}
+
+/** A spool directory the startup project snapshot does not declare. */
+export function trustedReceiptSpoolDir(raw: string | undefined): string | undefined {
+	return adoptReceiptSpoolDir(raw);
+}
 
 interface ReceiptSpoolCursorCache {
 	mtimeMs: number;
@@ -44,10 +82,15 @@ export function resetReceiptSpoolCursorCacheForTesting(): void {
 
 async function spoolStat(spoolFile: string): Promise<{ mtimeMs: number; size: number } | undefined> {
 	try {
-		const stats = await fs.stat(spoolFile);
-		return { mtimeMs: stats.mtimeMs, size: stats.size };
+		const handle = await fs.open(spoolFile, fsConstants.O_RDONLY | NOFOLLOW);
+		try {
+			const stats = await handle.stat();
+			return { mtimeMs: stats.mtimeMs, size: stats.size };
+		} finally {
+			await handle.close();
+		}
 	} catch (error) {
-		if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+		if (isEnoent(error)) return undefined;
 		throw error;
 	}
 }
@@ -64,15 +107,17 @@ async function cacheHighestCursor(spoolFile: string, highest: bigint): Promise<v
 export async function withReceiptSpoolDir<T>(spoolDir: string, fn: () => Promise<T>): Promise<T> {
 	const trimmed = spoolDir.trim();
 	if (!trimmed) throw new Error("receipt_spool_dir_empty");
-	const resolved = path.resolve(trimmed);
+	const resolved = adoptReceiptSpoolDir(trimmed);
+	// Owner input repeats process.env. A project-declared directory must not
+	// become the active spool via that copy.
+	if (!resolved) return fn();
 	return receiptSpoolDirStorage.run(resolved, fn);
 }
 
 export function resolveReceiptSpoolDir(env: NodeJS.ProcessEnv = process.env): string | undefined {
 	const active = receiptSpoolDirStorage.getStore();
 	if (active !== undefined) return active;
-	const raw = env[RECEIPT_SPOOL_DIR_ENV]?.trim();
-	return raw ? path.resolve(raw) : undefined;
+	return adoptReceiptSpoolDir(env[RECEIPT_SPOOL_DIR_ENV]);
 }
 
 export function receiptSpoolPath(spoolDir: string): string {
@@ -95,30 +140,56 @@ export function formatReceiptSpoolCursor(cursor: bigint): string {
 
 export async function readHighestReceiptSpoolCursor(spoolDir: string): Promise<bigint> {
 	const spoolFile = receiptSpoolPath(spoolDir);
-	const revision = await spoolStat(spoolFile);
-	if (!revision) {
-		cursorCache.delete(spoolFile);
-		return 0n;
+	let handle: fs.FileHandle;
+	try {
+		handle = await fs.open(spoolFile, fsConstants.O_RDONLY | NOFOLLOW);
+	} catch (error) {
+		if (isEnoent(error)) {
+			cursorCache.delete(spoolFile);
+			return 0n;
+		}
+		throw error;
 	}
-	const cached = cursorCache.get(spoolFile);
-	if (cached && sameSpoolRevision(cached, revision)) return cached.highest;
-
-	fullScanCount++;
-	const raw = await fs.readFile(spoolFile, "utf8");
-	let highest = 0n;
-	for (const line of raw.split("\n")) {
-		const trimmed = line.trim();
-		if (!trimmed) continue;
-		try {
-			const parsed = JSON.parse(trimmed) as { cursor?: unknown };
-			const cursor = parseCursor(parsed.cursor);
-			if (cursor !== undefined && cursor > highest) highest = cursor;
-		} catch {
-			// A crash may leave a torn tail; a full scan ignores it and re-establishes the cache.
+	try {
+		const stats = await handle.stat();
+		const revision = { mtimeMs: stats.mtimeMs, size: stats.size };
+		const cached = cursorCache.get(spoolFile);
+		if (cached && sameSpoolRevision(cached, revision)) return cached.highest;
+
+		fullScanCount++;
+		const raw = await handle.readFile({ encoding: "utf8" });
+		let highest = 0n;
+		for (const line of raw.split("\n")) {
+			const trimmed = line.trim();
+			if (!trimmed) continue;
+			try {
+				const parsed = JSON.parse(trimmed) as { cursor?: unknown };
+				const cursor = parseCursor(parsed.cursor);
+				if (cursor !== undefined && cursor > highest) highest = cursor;
+			} catch {
+				// A crash may leave a torn tail; a full scan ignores it and re-establishes the cache.
+			}
 		}
+		cursorCache.set(spoolFile, { ...revision, highest });
+		return highest;
+	} finally {
+		await handle.close();
+	}
+}
+
+async function tightenSpoolDir(dir: string): Promise<void> {
+	if (process.platform === "win32") return;
+	let handle: fs.FileHandle;
+	try {
+		handle = await fs.open(dir, fsConstants.O_RDONLY | (fsConstants.O_DIRECTORY ?? 0) | NOFOLLOW);
+	} catch {
+		return;
+	}
+	try {
+		await handle.chmod(0o700);
+	} finally {
+		await handle.close();
 	}
-	cursorCache.set(spoolFile, { ...revision, highest });
-	return highest;
 }
 
 async function enqueueSpoolAppend<T>(spoolFile: string, task: () => Promise<T>): Promise<T> {
@@ -142,13 +213,19 @@ export async function appendReceiptToSpool(
 	const spoolFile = receiptSpoolPath(resolvedDir);
 	return enqueueSpoolAppend(spoolFile, async () => {
 		await fs.mkdir(resolvedDir, { recursive: true, mode: 0o700 });
+		await tightenSpoolDir(resolvedDir);
 		return withFileLock(
 			spoolFile,
 			async () => {
 				const cursor = formatReceiptSpoolCursor((await readHighestReceiptSpoolCursor(resolvedDir)) + 1n);
 				const record: ReceiptSpoolRecord = { cursor, envelope };
-				const handle = await fs.open(spoolFile, "a", 0o600);
+				const handle = await fs.open(
+					spoolFile,
+					fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_APPEND | NOFOLLOW,
+					0o600,
+				);
 				try {
+					if (process.platform !== "win32") await handle.chmod(0o600);
 					await handle.writeFile(`${JSON.stringify(record)}\n`, "utf8");
 					await handle.sync();
 				} finally {

package/src/harness-control-plane/storage.ts

@@ -293,11 +293,131 @@ export function sessionPaths(root: string, sessionId: string): SessionPaths {
 	};
 }
 
+const NO_FOLLOW = process.platform === "win32" ? 0 : (fsSync.constants.O_NOFOLLOW ?? 0);
+
+function errnoCode(error: unknown): string | undefined {
+	return error instanceof Error && "code" in error ? (error as NodeJS.ErrnoException).code : undefined;
+}
+
+function sameInode(left: fsSync.BigIntStats, right: fsSync.BigIntStats): boolean {
+	return left.dev === right.dev && left.ino === right.ino && left.nlink === right.nlink;
+}
+
+/**
+ * Leaf directory mode 0700. `lstat` plus `chmod` does not need read permission, so a
+ * mode 0300 directory stays writable. A symlink leaf is refused before chmod.
+ * This does not pin the directory against a later rename in a writable parent.
+ */
+async function ensureOwnerDirectory(dir: string): Promise<void> {
+	await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+	let current: fsSync.Stats;
+	try {
+		current = await fs.lstat(dir);
+	} catch (error) {
+		const code = errnoCode(error);
+		if (code === "ELOOP" || code === "ENOTDIR") throw new Error("harness state directory is not a directory");
+		throw error;
+	}
+	if (current.isSymbolicLink() || !current.isDirectory())
+		throw new Error("harness state directory is not a directory");
+	if (process.platform === "win32" || (current.mode & 0o077) === 0) return;
+	await fs.chmod(dir, 0o700);
+	const tightened = await fs.lstat(dir);
+	if (tightened.isSymbolicLink() || !tightened.isDirectory() || (tightened.mode & 0o777) !== 0o700) {
+		throw new Error("harness state directory could not be tightened to mode 0700");
+	}
+}
+
+async function assertRegularOrMissing(file: string): Promise<void> {
+	try {
+		const existing = await fs.lstat(file);
+		if (existing.isSymbolicLink() || !existing.isFile()) throw new Error("harness state path is not a regular file");
+	} catch (error) {
+		if (errnoCode(error) !== "ENOENT") throw error;
+	}
+}
+
+/**
+ * Append like the workflow owner-only writer: mode 0600, `O_NOFOLLOW` when the file
+ * exists, `O_EXCL` when it does not, and chmod to 0600 when group or other bits are set.
+ */
+async function appendOwnerOnly(filePath: string, text: string): Promise<void> {
+	await ensureOwnerDirectory(path.dirname(filePath));
+	let handle: fs.FileHandle | undefined;
+	let initial: fsSync.BigIntStats | undefined;
+	for (let attempt = 0; attempt < 2; attempt++) {
+		initial = undefined;
+		try {
+			initial = await fs.lstat(filePath, { bigint: true });
+			if (initial.isSymbolicLink() || !initial.isFile()) throw new Error("harness state path is not a regular file");
+		} catch (error) {
+			if (errnoCode(error) !== "ENOENT") throw error;
+		}
+		const flags = initial
+			? fsSync.constants.O_WRONLY | fsSync.constants.O_APPEND | NO_FOLLOW
+			: fsSync.constants.O_WRONLY | fsSync.constants.O_APPEND | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL;
+		try {
+			handle = await fs.open(filePath, flags, 0o600);
+			break;
+		} catch (error) {
+			const code = errnoCode(error);
+			if (code === "ELOOP") throw new Error("harness state path is not a regular file");
+			if (initial === undefined && code === "EEXIST" && attempt === 0) continue;
+			throw error;
+		}
+	}
+	if (!handle) throw new Error("harness state path identity changed before append");
+	try {
+		const opened = await handle.stat({ bigint: true });
+		const named = await fs.lstat(filePath, { bigint: true });
+		if (
+			opened.isSymbolicLink() ||
+			!opened.isFile() ||
+			named.isSymbolicLink() ||
+			!named.isFile() ||
+			(initial !== undefined && !sameInode(initial, opened)) ||
+			!sameInode(opened, named)
+		) {
+			throw new Error("harness state path identity changed before append");
+		}
+		if (process.platform !== "win32" && (Number(opened.mode) & 0o077) !== 0) {
+			await handle.chmod(0o600);
+			const tightened = await handle.stat({ bigint: true });
+			if ((Number(tightened.mode) & 0o777) !== 0o600) {
+				throw new Error("harness state path could not be tightened to mode 0600");
+			}
+		}
+		await handle.writeFile(text, "utf8");
+	} finally {
+		await handle.close();
+	}
+}
+
 async function writeJsonAtomic(file: string, value: unknown): Promise<void> {
-	await fs.mkdir(path.dirname(file), { recursive: true });
+	await ensureOwnerDirectory(path.dirname(file));
+	await assertRegularOrMissing(file);
 	const tmp = `${file}.tmp-${randomBytes(4).toString("hex")}`;
-	await fs.writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`, "utf8");
-	await fs.rename(tmp, file);
+	const flags = fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL | NO_FOLLOW;
+	const handle = await fs.open(tmp, flags, 0o600);
+	try {
+		if (process.platform !== "win32") {
+			await handle.chmod(0o600);
+			const created = await handle.stat();
+			if (!created.isFile() || (created.mode & 0o777) !== 0o600) {
+				throw new Error("harness state path could not be tightened to mode 0600");
+			}
+		}
+		await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+	} finally {
+		await handle.close();
+	}
+	try {
+		await assertRegularOrMissing(file);
+		await fs.rename(tmp, file);
+	} catch (error) {
+		await fs.rm(tmp, { force: true }).catch(() => undefined);
+		throw error;
+	}
 }
 
 async function readJson<T>(file: string): Promise<T | null> {
@@ -396,7 +516,6 @@ export async function resolveHarnessSessionRoot(
 
 export async function writeSessionState(root: string, state: SessionState): Promise<void> {
 	const paths = sessionPaths(root, state.sessionId);
-	await fs.mkdir(paths.dir, { recursive: true });
 	await writeJsonAtomic(paths.state, state);
 }
 
@@ -407,8 +526,7 @@ export async function sessionExists(root: string, sessionId: string): Promise<bo
 /** Append a single severity envelope to events.jsonl. Single-writer discipline is the owner's job (M3). */
 export async function appendEvent(root: string, sessionId: string, envelope: EventEnvelope): Promise<void> {
 	const paths = sessionPaths(root, sessionId);
-	await fs.mkdir(paths.dir, { recursive: true });
-	await fs.appendFile(paths.events, `${JSON.stringify(envelope)}\n`, "utf8");
+	await appendOwnerOnly(paths.events, `${JSON.stringify(envelope)}\n`);
 }
 
 /** Read events from cursor (exclusive). Tail-only: never mutates the log. */

package/src/hindsight/content.ts

@@ -20,27 +20,126 @@ export interface RecallResultLike {
 	mentioned_at?: string | null;
 }
 
-const MEMORIES_REGEX = /<memories>[\s\S]*?<\/memories>/g;
-const LEGACY_HINDSIGHT_MEMORIES_REGEX = /<hindsight_memories>[\s\S]*?<\/hindsight_memories>/g;
-const LEGACY_RELEVANT_MEMORIES_REGEX = /<relevant_memories>[\s\S]*?<\/relevant_memories>/g;
-const MENTAL_MODELS_REGEX = /<mental_models>[\s\S]*?<\/mental_models>/g;
+const MEMORY_TAG_NAMES = ["memories", "hindsight_memories", "relevant_memories", "mental_models"] as const;
+
+function memoryTagExpression(name: string): RegExp {
+	return new RegExp(`<\\s*\\/?\\s*${name}\\s*>`, "gi");
+}
+
+interface MemoryTagSpan {
+	start: number;
+	end: number;
+	close: boolean;
+	paired: boolean;
+	absorbed: boolean;
+}
+
+function findMemoryTagSpans(content: string, name: string): MemoryTagSpan[] {
+	const spans: MemoryTagSpan[] = [];
+	for (const match of content.matchAll(memoryTagExpression(name))) {
+		const raw = match[0];
+		const start = match.index ?? 0;
+		spans.push({
+			start,
+			end: start + raw.length,
+			close: raw.includes("/"),
+			paired: false,
+			absorbed: false,
+		});
+	}
+	return spans;
+}
+
+function mergeSpans(ranges: Array<[number, number]>): Array<[number, number]> {
+	const sorted = ranges.filter(([start, end]) => end > start).sort((a, b) => a[0] - b[0] || b[1] - a[1]);
+	const merged: Array<[number, number]> = [];
+	for (const [start, end] of sorted) {
+		const last = merged[merged.length - 1];
+		if (!last || start > last[1]) merged.push([start, end]);
+		else last[1] = Math.max(last[1], end);
+	}
+	return merged;
+}
+
+/**
+ * Remove one memory-tag family.
+ *
+ * A matched block is removed whole. An extra closer after that block is the
+ * recall frame ending early: the escaped text through that closer is removed
+ * so it is not retained as instructions. A closer or opener with no block
+ * before it is removed as a token only, and the surrounding prose stays.
+ */
+function stripMemoryTagFamily(content: string, name: string): string {
+	const tags = findMemoryTagSpans(content, name);
+	if (tags.length === 0) return content;
+
+	const ranges: Array<[number, number]> = [];
+	const stack: MemoryTagSpan[] = [];
+	for (const tag of tags) {
+		if (!tag.close) {
+			stack.push(tag);
+			continue;
+		}
+		const open = stack.pop();
+		if (!open) continue;
+		open.paired = true;
+		tag.paired = true;
+		ranges.push([open.start, tag.end]);
+	}
+
+	for (const tag of tags) {
+		if (!tag.close || tag.paired) continue;
+		let previous: MemoryTagSpan | undefined;
+		for (const candidate of tags) {
+			if (candidate.end <= tag.start) previous = candidate;
+			else break;
+		}
+		const followsClosedBlock = Boolean(previous?.close && (previous.paired || previous.absorbed));
+		if (followsClosedBlock && previous) {
+			ranges.push([previous.end, tag.end]);
+			tag.absorbed = true;
+		} else {
+			ranges.push([tag.start, tag.end]);
+		}
+	}
+
+	for (const tag of tags) {
+		if (!tag.close && !tag.paired) ranges.push([tag.start, tag.end]);
+	}
+
+	let out = content;
+	for (const [start, end] of mergeSpans(ranges).reverse()) {
+		out = out.slice(0, start) + out.slice(end);
+	}
+	return out;
+}
+
+/** Escape recognized tag delimiters so recalled text cannot close the outer frame. */
+function stripMemoryTagTokens(text: string): string {
+	let out = text;
+	for (const name of MEMORY_TAG_NAMES) {
+		out = out.replace(memoryTagExpression(name), tag => tag.replace("<", "&lt;"));
+	}
+	return out;
+}
 
 /**
  * Strip `<memories>`, `<mental_models>`, and legacy memory blocks.
  *
- * Both `<memories>` (per-turn recall) and `<mental_models>` (curated semantic
- * memory) are injected into the system prompt. If either leaks into the
- * retention transcript, every retain becomes a tighter feedback loop —
- * paraphrased memories feed the next consolidation, which feeds the next
- * mental-model refresh, which feeds the next retain. Always strip before
- * retaining.
+ * Matching is case-insensitive and allows whitespace inside the tag.
+ * Both per-turn recall and curated mental models are injected around the
+ * prompt. If a closer, a case variant, or an early-ended frame leaks into
+ * the retention transcript, the next retain stores the breakout as a new
+ * memory. Always strip before retaining.
  */
 export function stripMemoryTags(content: string): string {
-	return content
-		.replace(MEMORIES_REGEX, "")
-		.replace(MENTAL_MODELS_REGEX, "")
-		.replace(LEGACY_HINDSIGHT_MEMORIES_REGEX, "")
-		.replace(LEGACY_RELEVANT_MEMORIES_REGEX, "");
+	let out = content;
+	while (true) {
+		let stripped = out;
+		for (const name of MEMORY_TAG_NAMES) stripped = stripMemoryTagFamily(stripped, name);
+		if (stripped === out) return out;
+		out = stripped;
+	}
 }
 
 /** Format recall results into a bullet list for context injection. */
@@ -50,7 +149,8 @@ export function formatMemories(results: RecallResultLike[]): string {
 		.map(r => {
 			const typeStr = r.type ? ` [${r.type}]` : "";
 			const dateStr = r.mentioned_at ? ` (${r.mentioned_at})` : "";
-			return `- ${r.text}${typeStr}${dateStr}`;
+			const text = stripMemoryTagTokens(r.text);
+			return `- ${text}${typeStr}${dateStr}`;
 		})
 		.join("\n\n");
 }

package/src/hindsight/mental-models.ts

@@ -219,6 +219,17 @@ const TRUNCATION_MARKER = "\n\n…[mental-model snapshot truncated at render bud
  */
 const MIN_CONTENT_ROOM_CHARS = 64;
 
+const MEMORY_FRAME_NAMES = ["memories", "hindsight_memories", "relevant_memories", "mental_models"] as const;
+
+/** Escape the same frame tokens as recalled memory text so a stored closer cannot end this block early. */
+function escapeMemoryFrameTokens(text: string): string {
+	let out = text;
+	for (const name of MEMORY_FRAME_NAMES) {
+		out = out.replace(new RegExp(`<\\s*\\/?\\s*${name}\\s*>`, "gi"), tag => tag.replace("<", "&lt;"));
+	}
+	return out;
+}
+
 /** Smallest budget that can yield a usable block (wrapper + preamble + marker + a few chars of content). */
 function minRenderBudgetChars(): number {
 	const cleanOverhead = `<mental_models>\n${PREAMBLE}\n\n\n</mental_models>`.length;
@@ -235,7 +246,6 @@ export function renderMentalModelsBlock(models: MentalModelSummary[], budgetChar
 	if (budgetChars < minRenderBudgetChars()) return "";
 
 	const truncatedOverhead = `<mental_models>\n${PREAMBLE}\n\n${TRUNCATION_MARKER}\n</mental_models>`.length;
-	const cleanOverhead = `<mental_models>\n${PREAMBLE}\n\n\n</mental_models>`.length;
 	const innerBudget = Math.max(0, budgetChars - truncatedOverhead);
 	const perModelBudget = Math.max(120, Math.floor(innerBudget / Math.max(1, models.length)));
 
@@ -260,18 +270,20 @@ export function renderMentalModelsBlock(models: MentalModelSummary[], budgetChar
 		consumed += sectionCost;
 	}
 
+	// Escape after the heading/body join. A closer split across that newline
+	// (`</mental_models` + `>`) is not visible in either field alone.
+	// The wrapper is added after this step and is not escaped.
+	let inner = escapeMemoryFrameTokens(sections.join("\n\n"));
 	const tail = truncated ? TRUNCATION_MARKER : "";
-	let assembled = `<mental_models>\n${PREAMBLE}\n\n${sections.join("\n\n")}${tail}\n</mental_models>`;
+	let assembled = `<mental_models>\n${PREAMBLE}\n\n${inner}${tail}\n</mental_models>`;
 
-	// Final hard-cap: if the careful per-model budgeting still slips past the
-	// requested ceiling (small budgets, fat preambles, etc.), brutally truncate
-	// the body region while keeping the wrapper intact so `stripMemoryTags` can
-	// still find the closing tag.
+	// Final hard-cap: slice the already escaped body so a cut cannot restore a raw closer.
+	// The marker is always appended on this path, so reserve its overhead.
+	// Escaped tags are longer than the raw text the per-model budget measured.
 	if (assembled.length > budgetChars) {
-		const overhead = truncated ? truncatedOverhead : cleanOverhead;
-		const room = Math.max(0, budgetChars - overhead);
-		const body = sections.join("\n\n").slice(0, room).trimEnd();
-		assembled = `<mental_models>\n${PREAMBLE}\n\n${body}${TRUNCATION_MARKER}\n</mental_models>`;
+		const room = Math.max(0, budgetChars - truncatedOverhead);
+		inner = inner.slice(0, room).trimEnd();
+		assembled = `<mental_models>\n${PREAMBLE}\n\n${inner}${TRUNCATION_MARKER}\n</mental_models>`;
 	}
 	return assembled;
 }

package/src/hindsight/state.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 
 import { logger } from "@gajae-code/utils";
+import { redactMemorySecretsForTesting as redactMemorySecrets } from "../memories";
 import type { AgentSession } from "../session/agent-session";
 import { type BankScope, ensureBankMission } from "./bank";
 import type { HindsightApi, MemoryItemInput } from "./client";
@@ -149,8 +150,8 @@ export class HindsightRetainQueue {
 		try {
 			await ensureBankMission(state.client, state.bankId, state.config, state.missionsSet);
 			const batch: MemoryItemInput[] = items.map(item => ({
-				content: item.content,
-				context: item.context ?? state.config.retainContext,
+				content: redactMemorySecrets(item.content),
+				context: item.context === undefined ? state.config.retainContext : redactMemorySecrets(item.context),
 				metadata: { session_id: sessionId },
 				tags: state.retainTags,
 			}));
@@ -316,8 +317,10 @@ export class HindsightSessionState {
 			documentId = `${this.sessionId}-${Date.now()}`;
 		}
 
-		const { transcript } = prepareRetentionTranscript(target, true);
-		if (!transcript) return false;
+		const prepared = prepareRetentionTranscript(target, true);
+		if (!prepared.transcript) return false;
+		// Same scrub the local memory backend applies before it stores consolidation text.
+		const transcript = redactMemorySecrets(prepared.transcript);
 
 		await ensureBankMission(this.client, this.bankId, this.config, this.missionsSet);
 		await this.client.retain(this.bankId, transcript, {

package/src/hooks/native-skill-hook.ts

@@ -1,10 +1,12 @@
 import { appendFile, mkdir, stat } from "node:fs/promises";
 import * as path from "node:path";
 import { getAgentDir, getConfigDirName } from "@gajae-code/utils";
+import { projectEnvSnapshot } from "@gajae-code/utils/env-file";
 import { YAML } from "bun";
 import type { SkillDiscoverySettings } from "../config/skill-settings-defaults";
 import { DEFAULT_DISABLED_EXTENSIONS, DEFAULT_SKILL_DISCOVERY_SETTINGS } from "../config/skill-settings-defaults";
 import { sessionLogsDir } from "../gjc-runtime/session-layout";
+import { trustedCoordinatorEnv } from "../gjc-runtime/sidecar-bootstrap-env";
 import {
 	detectMcpDelegateFlowActivation,
 	type McpDelegateHostContextV1,
@@ -281,14 +283,14 @@ function readTurnId(payload: HookPayload): string | undefined {
 	return safeString(payload.turn_id ?? payload.turnId).trim() || undefined;
 }
 
-function readSessionFile(payload: HookPayload): string | undefined {
-	return (
-		safeString(
-			payload.session_file ?? payload.sessionFile ?? payload.transcript_path ?? payload.transcriptPath,
-		).trim() ||
-		process.env.GJC_SESSION_FILE?.trim() ||
-		undefined
-	);
+function readSessionFile(payload: HookPayload, cwd: string): string | undefined {
+	const explicit = safeString(
+		payload.session_file ?? payload.sessionFile ?? payload.transcript_path ?? payload.transcriptPath,
+	).trim();
+	if (explicit) return explicit;
+	// Bun has already copied the project dotenv into the environment. A value
+	// that matches that snapshot must not select another transcript.
+	return trustedCoordinatorEnv("GJC_SESSION_FILE", process.env, projectEnvSnapshot(cwd));
 }
 
 export async function dispatchGjcNativeSkillHook(
@@ -297,6 +299,7 @@ export async function dispatchGjcNativeSkillHook(
 ): Promise<GjcNativeHookDispatchResult> {
 	const hookEventName = readHookEventName(payload);
 	const cwd = (options.cwd ?? safeString(payload.cwd).trim()) || process.cwd();
+	const sessionFile = readSessionFile(payload, cwd);
 	if (hookEventName === "UserPromptSubmit") {
 		const recoveryDiagnostics = await collectUserPromptStateRecoveryDiagnostics({
 			cwd,
@@ -304,7 +307,7 @@ export async function dispatchGjcNativeSkillHook(
 			threadId: readThreadId(payload),
 			stateDir: options.stateDir,
 			prompt: readPromptText(payload),
-			sessionFile: readSessionFile(payload),
+			sessionFile,
 		});
 		const recoveryContext = buildStateRecoveryDiagnosticsContext(recoveryDiagnostics);
 		const prompt = readPromptText(payload);
@@ -346,7 +349,7 @@ export async function dispatchGjcNativeSkillHook(
 					threadId: readThreadId(payload),
 					stateDir: options.stateDir,
 					prompt,
-					sessionFile: readSessionFile(payload),
+					sessionFile,
 				});
 		if (activeUltragoalContext?.startsWith("BLOCK_ULTRAGOAL_COMPLETION:")) {
 			return {
@@ -390,7 +393,7 @@ export async function dispatchGjcNativeSkillHook(
 				sessionId: readSessionId(payload),
 				threadId: readThreadId(payload),
 				stateDir: options.stateDir,
-				sessionFile: readSessionFile(payload),
+				sessionFile,
 			}),
 		};
 	}
@@ -424,7 +427,9 @@ async function readStdinJson(): Promise<{ payload: HookPayload; parseError: Erro
 }
 
 async function logHookError(cwd: string, type: string, error: unknown): Promise<void> {
-	const gjcSessionId = process.env.GJC_SESSION_ID?.trim();
+	// Bun has already copied the project dotenv into the environment. A value
+	// that matches that snapshot must not select another session's log directory.
+	const gjcSessionId = trustedCoordinatorEnv("GJC_SESSION_ID", process.env, projectEnvSnapshot(cwd));
 	if (!gjcSessionId) {
 		console.error(
 			JSON.stringify({