@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/utils/file-mentions.ts

@@ -11,7 +11,7 @@ import type { AgentMessage } from "@gajae-code/agent-core";
 import type { ImageContent } from "@gajae-code/ai/core";
 import type { glob as globFn } from "@gajae-code/natives";
 import { fuzzyMatch } from "@gajae-code/tui";
-import { formatAge, formatBytes, readImageMetadata } from "@gajae-code/utils";
+import { formatAge, formatBytes, pathIsWithin, readImageMetadata, resolveEquivalentPath } from "@gajae-code/utils";
 import { formatHashLines } from "../hashline/hash";
 import type { FileMentionMessage } from "../session/messages";
 import {
@@ -80,6 +80,7 @@ type MentionCandidate = {
 	path: string;
 	pathLower: string;
 	normalizedPath: string;
+	segments: string[];
 };
 
 function normalizeMentionQuery(query: string): string {
@@ -117,11 +118,37 @@ async function listMentionCandidates(cwd: string): Promise<MentionCandidate[]> {
 		if (normalizedPath.length === 0) {
 			continue;
 		}
-		candidates.push({ path: entry, pathLower, normalizedPath });
+		const segments = pathLower.split(PATH_SEPARATOR_REGEX).filter(segment => segment.length > 0);
+		candidates.push({ path: entry, pathLower, normalizedPath, segments });
 	}
 	return candidates;
 }
 
+/**
+ * True when `query` can be spelled as prefixes of path segments taken in order
+ * (segments may be skipped), e.g. `httpserap` → `http_server_api_tests`.
+ * Plain subsequence matching would also accept letters scattered mid-word across
+ * any long path, so a stray `@handle` or `@word` would resolve to an unrelated file.
+ */
+function matchesSegmentPrefixes(query: string, segments: string[]): boolean {
+	const failed = new Set<number>();
+	const visit = (segmentIndex: number, queryIndex: number): boolean => {
+		if (queryIndex === query.length) return true;
+		if (segmentIndex === segments.length) return false;
+		const key = segmentIndex * (query.length + 1) + queryIndex;
+		if (failed.has(key)) return false;
+		const segment = segments[segmentIndex]!;
+		for (let taken = 1; taken <= segment.length && queryIndex + taken <= query.length; taken++) {
+			if (segment[taken - 1] !== query[queryIndex + taken - 1]) break;
+			if (visit(segmentIndex + 1, queryIndex + taken)) return true;
+		}
+		if (visit(segmentIndex + 1, queryIndex)) return true;
+		failed.add(key);
+		return false;
+	};
+	return visit(0, 0);
+}
+
 async function resolveMentionPath(
 	filePath: string,
 	cwd: string,
@@ -148,6 +175,7 @@ async function resolveMentionPath(
 	}
 
 	const scored = candidates
+		.filter(candidate => matchesSegmentPrefixes(normalizedQuery, candidate.segments))
 		.map(candidate => ({ candidate, match: fuzzyMatch(normalizedQuery, candidate.normalizedPath) }))
 		.filter(entry => entry.match.matches)
 		.sort((a, b) => {
@@ -285,6 +313,26 @@ export function extractFileMentions(text: string): string[] {
 	return [...new Set(mentions)];
 }
 
+/**
+ * Compare canonical Windows paths without folding directory names: individual
+ * directories can opt into case-sensitive names.
+ */
+export function isCanonicalWindowsPathWithin(root: string, candidate: string): boolean {
+	if (!path.win32.isAbsolute(root) || !path.win32.isAbsolute(candidate)) return false;
+
+	const canonicalRoot = path.win32.resolve(root);
+	const canonicalCandidate = path.win32.resolve(candidate);
+	const rootParts = path.win32.parse(canonicalRoot);
+	const candidateParts = path.win32.parse(canonicalCandidate);
+	if (rootParts.root.toLowerCase() !== candidateParts.root.toLowerCase()) return false;
+
+	const rootSegments = canonicalRoot.slice(rootParts.root.length).split(path.win32.sep).filter(Boolean);
+	const candidateSegments = canonicalCandidate.slice(candidateParts.root.length).split(path.win32.sep).filter(Boolean);
+	if (candidateSegments.length < rootSegments.length) return false;
+
+	return rootSegments.every((segment, index) => segment === candidateSegments[index]);
+}
+
 /**
  * Generate a FileMentionMessage containing the contents of mentioned files.
  * Returns empty array if no files could be read.
@@ -308,6 +356,8 @@ export async function generateFileMentionMessages(
 	if (filePaths.length === 0) return [];
 
 	const autoResizeImages = options?.autoResizeImages ?? true;
+	const canonicalWindowsCwd = process.platform === "win32" ? await fs.realpath(cwd).catch(() => undefined) : undefined;
+	if (process.platform === "win32" && canonicalWindowsCwd === undefined) return [];
 
 	const files: FileMentionMessage["files"] = [];
 	let mentionCandidatesPromise: Promise<MentionCandidate[]> | null = null;
@@ -323,6 +373,24 @@ export async function generateFileMentionMessages(
 			continue;
 		}
 		const absolutePath = resolveReadPath(resolvedPath, cwd);
+		// Skip `..`, `~`, and outside absolute paths. On Windows, realpath both
+		// paths and compare exact components because directories can be case-sensitive.
+		// Fail closed if either real path is unavailable. Read the canonical path so
+		// replacing the original mention symlink does not retarget this read.
+		const canonicalPath =
+			process.platform === "win32"
+				? await fs.realpath(absolutePath).catch(() => undefined)
+				: resolveEquivalentPath(absolutePath);
+		if (!canonicalPath) {
+			continue;
+		}
+		const staysWithinSession =
+			process.platform === "win32"
+				? canonicalWindowsCwd !== undefined && isCanonicalWindowsPathWithin(canonicalWindowsCwd, canonicalPath)
+				: pathIsWithin(cwd, canonicalPath);
+		if (!staysWithinSession) {
+			continue;
+		}
 		// Duplicate suppression, keyed by absolute path: same path shown earlier this
 		// batch or recently in the conversation → compact note, no re-read (the path
 		// stays referenced so the model can re-fetch via the read tool).
@@ -336,14 +404,14 @@ export async function generateFileMentionMessages(
 		}
 		shownInBatch.add(absolutePath);
 		try {
-			const stat = await Bun.file(absolutePath).stat();
+			const stat = await Bun.file(canonicalPath).stat();
 			if (stat.isDirectory()) {
-				const { output, lineCount } = await buildDirectoryListing(absolutePath);
+				const { output, lineCount } = await buildDirectoryListing(canonicalPath);
 				files.push({ path: resolvedPath, content: output, lineCount });
 				continue;
 			}
 
-			const imageMetadata = await readImageMetadata(absolutePath);
+			const imageMetadata = await readImageMetadata(canonicalPath);
 			const mimeType = imageMetadata?.mimeType;
 			if (mimeType) {
 				if (stat.size > MAX_AUTO_READ_IMAGE_BYTES) {
@@ -355,7 +423,7 @@ export async function generateFileMentionMessages(
 					});
 					continue;
 				}
-				const buffer = await fs.readFile(absolutePath);
+				const buffer = await fs.readFile(canonicalPath);
 				if (buffer.length === 0) {
 					continue;
 				}
@@ -392,7 +460,7 @@ export async function generateFileMentionMessages(
 				continue;
 			}
 
-			const content = await Bun.file(absolutePath).text();
+			const content = await Bun.file(canonicalPath).text();
 			let { output, lineCount } = buildTextOutput(content, options?.maxInlineBytes);
 			if (options?.useHashLines) {
 				output = formatHashLines(output);

package/src/utils/git.ts

@@ -1,7 +1,8 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { $which, hasFsCode, isEnoent, Snowflake } from "@gajae-code/utils";
+import { $which, hasFsCode, isEnoent } from "@gajae-code/utils";
+import { projectSafeSpawnEnv } from "@gajae-code/utils/shell-config";
 import {
 	parseDiffHunks as parseCommitDiffHunks,
 	parseFileDiffs,
@@ -198,7 +199,10 @@ async function runCommand(
 	const commandArgs = withShortLivedGitConfig(options.readOnly ? withNoOptionalLocks(args) : [...args]);
 	const child = Bun.spawn(["git", ...commandArgs], {
 		cwd,
-		env: options.env ? { ...process.env, GIT_OPTIONAL_LOCKS: "0", ...options.env } : undefined,
+		// The inherited environment holds the autoloaded project `.env`; without
+		// filtering, a repository could set e.g. `GIT_CONFIG_*` (`core.hooksPath`)
+		// or `GIT_SSH_COMMAND` and have GJC's own commit/fetch/push run its code.
+		env: options.env ? { ...projectSafeSpawnEnv(), GIT_OPTIONAL_LOCKS: "0", ...options.env } : projectSafeSpawnEnv(),
 		signal: options.signal,
 		stdin: normalizeStdin(options.stdin),
 		stdout: "pipe",
@@ -365,9 +369,24 @@ function buildApplyArgs(patchPath: string, options: PatchOptions): string[] {
 }
 
 async function writeTempPatch(content: string): Promise<string> {
-	const tempPath = path.join(os.tmpdir(), `gjc-git-patch-${Snowflake.next()}.patch`);
-	await Bun.write(tempPath, content);
-	return tempPath;
+	// Random directory plus an exclusive create: a preexisting symlink under the
+	// shared temp directory is not opened, and the patch is not left world-readable.
+	const tempDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "gjc-git-patch-"));
+	try {
+		if (process.platform !== "win32") await fs.promises.chmod(tempDir, 0o700);
+		const tempPath = path.join(tempDir, "patch");
+		const handle = await fs.promises.open(tempPath, "wx", 0o600);
+		try {
+			await handle.writeFile(content);
+		} finally {
+			await handle.close();
+		}
+		if (process.platform !== "win32") await fs.promises.chmod(tempPath, 0o600);
+		return tempPath;
+	} catch (error) {
+		await fs.promises.rm(tempDir, { recursive: true, force: true });
+		throw error;
+	}
 }
 
 // ════════════════════════════════════════════════════════════════════════════
@@ -1232,7 +1251,7 @@ export const patch = {
 		try {
 			await patch.apply(cwd, tempPath, options);
 		} finally {
-			await fs.promises.rm(tempPath, { force: true });
+			await fs.promises.rm(path.dirname(tempPath), { recursive: true, force: true });
 		}
 	},
 
@@ -1253,7 +1272,7 @@ export const patch = {
 		try {
 			return await patch.canApply(cwd, tempPath, options);
 		} finally {
-			await fs.promises.rm(tempPath, { force: true });
+			await fs.promises.rm(path.dirname(tempPath), { recursive: true, force: true });
 		}
 	},
 
@@ -1594,6 +1613,14 @@ function formatGhFailure(args: readonly string[], stdout: string, stderr: string
 	return `GitHub CLI command failed: gh ${args.join(" ")}`;
 }
 
+/** Captured `gh` output never wants a pager or forced-terminal behavior. */
+function ghSpawnEnv(): Record<string, string> {
+	const env = projectSafeSpawnEnv();
+	delete env.GH_FORCE_TTY;
+	env.GH_PAGER = "cat";
+	return env;
+}
+
 export const github = {
 	/** Check if `gh` CLI is installed. */
 	available(): boolean {
@@ -1609,6 +1636,10 @@ export const github = {
 		try {
 			const child = Bun.spawn(["gh", ...args], {
 				cwd,
+				// Same project-dotenv filtering as git: `gh` runs git for checkout
+				// and push. Output is captured, so gh must never page or act as if
+				// on a terminal; pin both so a project `.env` cannot select a pager.
+				env: ghSpawnEnv(),
 				stdin: "ignore",
 				stdout: "pipe",
 				stderr: "pipe",

package/src/utils/image-limits.ts

@@ -0,0 +1,8 @@
+// Shared input policy must remain independent of file loading, tools and sessions.
+export const MAX_IMAGE_INPUT_BYTES = 20 * 1024 * 1024;
+export const MAX_STAGED_PROMPT_IMAGES = 16;
+export const MAX_PASTED_IMAGE_SOURCE_BYTES = 64 * 1024 * 1024;
+export const MAX_PASTED_IMAGE_OUTPUT_BYTES = 64 * 1024 * 1024;
+export const MAX_PASTED_IMAGE_DIMENSION = 20_000;
+export const MAX_PASTED_IMAGE_PIXELS = 40_000_000;
+export const MAX_PASTED_IMAGE_DECODED_BYTES = 160 * 1024 * 1024;

package/src/utils/image-loading.ts

@@ -2,9 +2,9 @@ import * as fs from "node:fs/promises";
 import type { ImageContent } from "@gajae-code/ai/core";
 import { formatBytes, readImageMetadata, SUPPORTED_IMAGE_MIME_TYPES } from "@gajae-code/utils";
 import { resolveReadPath } from "../tools/path-utils";
+import { MAX_IMAGE_INPUT_BYTES } from "./image-limits";
 import { formatDimensionNote, resizeImageBuffer } from "./image-resize";
 
-export const MAX_IMAGE_INPUT_BYTES = 20 * 1024 * 1024;
 export const SUPPORTED_INPUT_IMAGE_MIME_TYPES = SUPPORTED_IMAGE_MIME_TYPES;
 
 const SVG_MIME_TYPE = "image/svg+xml";

package/src/utils/open.ts

@@ -1,15 +1,84 @@
-/** Open a URL or file path in the default browser/application. Best-effort, never throws. */
+/** Open an http(s) URL or local path. Best-effort, never throws. */
+const ALLOWED_OPEN_PROTOCOLS = new Set(["http:", "https:"]);
+
+/**
+ * Zero-width and non-ASCII spaces. ASCII controls are rejected, not stripped:
+ * the URL parser drops some of them and would turn a hostile string into a clean href.
+ */
+const OUTER_FORMAT = /[\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000\uFEFF\u200B\u2060]/;
+
+function hasAsciiControl(value: string): boolean {
+	for (let i = 0; i < value.length; i++) {
+		const code = value.charCodeAt(i);
+		if (code <= 0x1f || code === 0x7f) return true;
+	}
+	return false;
+}
+
+function isOuterPadding(ch: string): boolean {
+	return ch.trim() === "" || OUTER_FORMAT.test(ch);
+}
+
+/** Drop every outer space or format character. Classification only; local paths stay raw. */
+function peelPadding(value: string): string {
+	let start = 0;
+	let end = value.length;
+	while (start < end && isOuterPadding(value.charAt(start))) start++;
+	while (end > start && isOuterPadding(value.charAt(end - 1))) end--;
+	return start === 0 && end === value.length ? value : value.slice(start, end);
+}
+
+/** Drive paths parse as one-letter schemes (`c:`). Recognize them before that check. */
+function isWindowsDrivePath(value: string): boolean {
+	return /^[A-Za-z]:[\\/]/.test(value);
+}
+
+const SCHEME_PREFIX = /^[A-Za-z][A-Za-z0-9+.-]*:/;
+
+/** http(s) href, "reject" for any other URL, or undefined when `value` is not a URL. */
+function classifyUrl(value: string): string | "reject" | undefined {
+	if (isWindowsDrivePath(value) || isWindowsDrivePath(value.trim())) return undefined;
+	try {
+		const parsed = new URL(value);
+		if (!ALLOWED_OPEN_PROTOCOLS.has(parsed.protocol) || hasAsciiControl(parsed.href)) return "reject";
+		return parsed.href;
+	} catch {
+		return undefined;
+	}
+}
+
+function resolveOpenTarget(raw: string): string | undefined {
+	if (hasAsciiControl(raw) || raw.length === 0) return undefined;
+	// Local paths, including surrounding spaces, are spawned unchanged.
+	if (isWindowsDrivePath(raw)) return raw;
+	const direct = classifyUrl(raw);
+	if (direct === "reject") return undefined;
+	if (direct !== undefined) return direct;
+
+	const peeled = peelPadding(raw);
+	if (peeled.length === 0) return undefined;
+	// Padding can hide a scheme or a flag. Refuse that instead of opening a different string.
+	if (peeled !== raw && !isWindowsDrivePath(peeled)) {
+		const hidden = classifyUrl(peeled);
+		if (hidden !== undefined || peeled.startsWith("-") || SCHEME_PREFIX.test(peeled)) return undefined;
+	}
+	if (raw.startsWith("-") || SCHEME_PREFIX.test(raw)) return undefined;
+	return raw;
+}
+
 export function openPath(urlOrPath: string): void {
+	const target = resolveOpenTarget(urlOrPath);
+	if (target === undefined) return;
 	let cmd: string[];
 	switch (process.platform) {
 		case "darwin":
-			cmd = ["open", urlOrPath];
+			cmd = ["open", target];
 			break;
 		case "win32":
-			cmd = ["rundll32", "url.dll,FileProtocolHandler", urlOrPath];
+			cmd = ["rundll32", "url.dll,FileProtocolHandler", target];
 			break;
 		default:
-			cmd = ["xdg-open", urlOrPath];
+			cmd = ["xdg-open", target];
 			break;
 	}
 	try {

package/src/utils/pasted-image-loading.ts

@@ -4,10 +4,17 @@ import * as os from "node:os";
 import * as path from "node:path";
 import type { ImageContent } from "@gajae-code/ai/core";
 import { formatBytes, parseImageMetadata } from "@gajae-code/utils";
+import {
+	MAX_IMAGE_INPUT_BYTES,
+	MAX_PASTED_IMAGE_DECODED_BYTES,
+	MAX_PASTED_IMAGE_DIMENSION,
+	MAX_PASTED_IMAGE_OUTPUT_BYTES,
+	MAX_PASTED_IMAGE_PIXELS,
+	MAX_PASTED_IMAGE_SOURCE_BYTES,
+} from "./image-limits";
 import {
 	ImageInputTooLargeError,
 	type LoadedImageInput,
-	MAX_IMAGE_INPUT_BYTES,
 	materializeImageInput,
 	type TransformedImageInput,
 	transformImageInputBytes,
@@ -15,12 +22,6 @@ import {
 import { DEFAULT_IMAGE_RESIZE_MAX_BYTES } from "./image-resize";
 import { MAX_PASTED_IMAGE_COUNT } from "./pasted-image-path";
 
-export const MAX_PASTED_IMAGE_SOURCE_BYTES = 64 * 1024 * 1024;
-export const MAX_PASTED_IMAGE_OUTPUT_BYTES = 64 * 1024 * 1024;
-export const MAX_PASTED_IMAGE_DIMENSION = 20_000;
-export const MAX_PASTED_IMAGE_PIXELS = 40_000_000;
-export const MAX_PASTED_IMAGE_DECODED_BYTES = 160 * 1024 * 1024;
-
 export type PastedImageBatchErrorCode =
 	| "too-many"
 	| "unsafe-path"
@@ -319,7 +320,7 @@ function hasWebpAnimation(bytes: Buffer): boolean {
 	return false;
 }
 
-function isAnimatedImage(bytes: Buffer, mimeType: string): boolean | undefined {
+export function isAnimatedImage(bytes: Buffer, mimeType: string): boolean | undefined {
 	if (mimeType === "image/gif") {
 		const frames = gifFrameCount(bytes);
 		return frames === undefined ? undefined : frames > 1;

package/src/utils/prompt-suggestion.ts

@@ -1,6 +1,6 @@
 /**
- * Predict the user's likely next prompt after an agent turn using a smol,
- * fast model. Native GJC port of the ghost-text prompt-suggestion behavior
+ * Predict the user's likely next prompt after an agent turn with the `default`
+ * model role. Native GJC port of the ghost-text prompt-suggestion behavior
  * from Claude Code: the prediction renders as dim ghost text in the empty
  * composer and Tab accepts it.
  */
@@ -169,8 +169,9 @@ function getSuggestionModel(
 	registry: ModelRegistry,
 	settings: Settings,
 	currentModel?: Model<Api>,
+	credentialSessionId?: string,
 ): Model<Api> | undefined {
-	const availableModels = registry.getAvailable();
+	const availableModels = registry.getAvailable(credentialSessionId);
 	if (availableModels.length === 0) return undefined;
 	const model = resolveRoleSelection(["default"], settings, availableModels, registry)?.model;
 	if (model) return model;
@@ -203,7 +204,7 @@ export async function generatePromptSuggestion(
 	const context = buildPromptSuggestionContext(messages);
 	if (!context) return null;
 
-	const model = getSuggestionModel(registry, settings, currentModel);
+	const model = getSuggestionModel(registry, settings, currentModel, sessionId);
 	if (!model) {
 		logger.debug("prompt-suggestion: no model available");
 		return null;

package/src/utils/shell-snapshot.ts

@@ -31,6 +31,11 @@ function getShellConfigFile(shell: string, home: string): string {
 	return path.join(home, ".profile");
 }
 
+/** One POSIX shell word. Double quotes would still run `$()` and backticks. */
+export function quotePosixShell(value: string): string {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
 /**
  * Generate the snapshot creation script.
  * This script sources the user's rc file and extracts functions, aliases, and options.
@@ -43,6 +48,9 @@ function generateSnapshotScript(shell: string, snapshotPath: string, rcFile: str
 
 	// Escape the snapshot path for shell
 	const escapedPath = snapshotPath.replace(/'/g, "'\\''");
+	const rcSource = hasRcFile
+		? `source ${quotePosixShell(rcFile)} < /dev/null 2>/dev/null`
+		: "# No user config file to source";
 
 	// Function extraction differs between bash and zsh
 	const functionScript = isZsh
@@ -83,7 +91,7 @@ umask 077
 SNAPSHOT_FILE='${escapedPath}'
 
 # Source user's rc file if it exists
-${hasRcFile ? `source "${rcFile}" < /dev/null 2>/dev/null` : "# No user config file to source"}
+${rcSource}
 
 # Create/clear the snapshot file
 echo "# Shell snapshot - generated by gjc agent" >| "$SNAPSHOT_FILE"

package/src/utils/title-generator.ts

@@ -1,15 +1,16 @@
 /**
- * Generate session titles using a smol, fast model.
+ * Generate session titles with the `default` model role.
  */
 import * as path from "node:path";
 
 import type { AgentMessage } from "@gajae-code/agent-core";
 import { type Api, type AssistantMessage, completeSimple, type Model, type Tool } from "@gajae-code/ai/core";
-import { logger, prompt } from "@gajae-code/utils";
+import { logger, prompt, redactCrashSecrets } from "@gajae-code/utils";
 import type { ModelRegistry } from "../config/model-registry";
 import { resolveRoleSelection } from "../config/model-resolver";
 import type { Settings } from "../config/settings";
 import titleSystemPrompt from "../prompts/system/title-system.md" with { type: "text" };
+import { collectEnvSecrets, createSecretObfuscator, loadSecrets } from "../secrets";
 import { syncCmuxWorkspaceTitle } from "./cmux-workspace";
 import { syncHerdrPaneTitle } from "./herdr-pane";
 
@@ -37,8 +38,13 @@ const MAX_TITLE_WORDS = 12;
  * Build a bounded conversation digest for title regeneration. Regeneration
  * reads several messages so a throwaway first prompt can be corrected, while
  * the automatic first-message path intentionally uses only its initial input.
+ * `obfuscateText`, when set, runs on each kept message's full text before the
+ * per-message character cut so a secret cannot be split by that cut.
  */
-export function buildConversationTitleInput(messages: readonly AgentMessage[]): string | undefined {
+export function buildConversationTitleInput(
+	messages: readonly AgentMessage[],
+	obfuscateText?: (text: string) => string,
+): string | undefined {
 	const userMessages: string[] = [];
 	for (const message of messages) {
 		if (message.role !== "user") continue;
@@ -51,7 +57,10 @@ export function buildConversationTitleInput(messages: readonly AgentMessage[]):
 						.map(block => block.text)
 						.join("\n");
 		const trimmed = text.trim();
-		if (trimmed) userMessages.push(trimmed);
+		if (!trimmed) continue;
+		// Emptiness uses the trimmed text. With an obfuscator, keep the original
+		// so a secret that includes edge whitespace still matches, then trim.
+		userMessages.push(obfuscateText ? text : trimmed);
 	}
 
 	if (userMessages.length === 0) return undefined;
@@ -60,13 +69,19 @@ export function buildConversationTitleInput(messages: readonly AgentMessage[]):
 		userMessages.length > MAX_TITLE_CONVERSATION_MESSAGES
 			? [userMessages[0]!, ...userMessages.slice(-(MAX_TITLE_CONVERSATION_MESSAGES - 1))]
 			: userMessages;
+	// Obfuscate the full kept text first. The 400-character cut below, and the
+	// later 2,000-character cap, then keep their existing limits.
+	const preparedMessages = obfuscateText
+		? keptMessages.map(message => obfuscateText(message).trim()).filter(message => message.length > 0)
+		: keptMessages;
+	if (preparedMessages.length === 0) return undefined;
 	// Reserve separator and ellipsis room so the digest is already within the
 	// generator's MAX_INPUT_CHARS bound; its existing truncation is a no-op here.
 	const maxMessageChars = Math.min(
 		MAX_TITLE_MESSAGE_CHARS,
-		Math.floor((MAX_INPUT_CHARS - (keptMessages.length - 1) - keptMessages.length) / keptMessages.length),
+		Math.floor((MAX_INPUT_CHARS - (preparedMessages.length - 1) - preparedMessages.length) / preparedMessages.length),
 	);
-	return keptMessages
+	return preparedMessages
 		.map(message => (message.length > maxMessageChars ? `${message.slice(0, maxMessageChars)}…` : message))
 		.join("\n");
 }
@@ -87,8 +102,13 @@ const setTitleTool: Tool = {
 	},
 };
 
-function getTitleModel(registry: ModelRegistry, settings: Settings, currentModel?: Model<Api>): Model<Api> | undefined {
-	const availableModels = registry.getAvailable();
+function getTitleModel(
+	registry: ModelRegistry,
+	settings: Settings,
+	currentModel?: Model<Api>,
+	credentialSessionId?: string,
+): Model<Api> | undefined {
+	const availableModels = registry.getAvailable(credentialSessionId);
 	if (availableModels.length === 0) return undefined;
 
 	const titleModel = resolveRoleSelection(["default"], settings, availableModels, registry)?.model;
@@ -99,6 +119,32 @@ function getTitleModel(registry: ModelRegistry, settings: Settings, currentModel
 	return undefined;
 }
 
+/**
+ * Obfuscate the full title input, then truncate, then wrap.
+ * A secret that crosses the character cap is replaced before the cut, and the
+ * `<user-message>` fence stays outside the truncated body.
+ */
+export function prepareTitleOutboundText(firstMessage: string, obfuscateText?: (text: string) => string): string {
+	const source = obfuscateText ? obfuscateText(firstMessage) : firstMessage;
+	const truncated = source.length > MAX_INPUT_CHARS ? `${source.slice(0, MAX_INPUT_CHARS)}…` : source;
+	return `<user-message>\n${truncated}\n</user-message>`;
+}
+
+export async function titleInputObfuscator(
+	settings: Settings,
+	activeCwd?: string,
+): Promise<((text: string) => string) | undefined> {
+	const reader = settings as Partial<Pick<Settings, "get" | "getCwd" | "getAgentDir">>;
+	if (typeof reader.get !== "function" || reader.get("secrets.enabled") !== true) return undefined;
+	const cwd = activeCwd ?? (typeof reader.getCwd === "function" ? reader.getCwd() : process.cwd());
+	const agentDir = typeof reader.getAgentDir === "function" ? reader.getAgentDir() : cwd;
+	const entries = [...collectEnvSecrets(), ...(await loadSecrets(cwd, agentDir))];
+	if (entries.length === 0) return undefined;
+	const obfuscator = createSecretObfuscator(entries);
+	if (!obfuscator.hasSecrets()) return undefined;
+	return text => obfuscator.obfuscate(text);
+}
+
 /**
  * Generate a title for a session based on the provided user-message input.
  * Automatic titles pass the first user message; regeneration passes a bounded
@@ -106,13 +152,14 @@ function getTitleModel(registry: ModelRegistry, settings: Settings, currentModel
  *
  * @param firstMessage The first user message or bounded conversation digest
  * @param registry Model registry
- * @param settings Settings used to resolve the smol role
+ * @param settings Settings used to resolve the `default` model role
  * @param sessionId Optional session id for sticky API key selection
  * @param currentModel Current model (used to derive title model)
  * @param metadataResolver Optional resolver evaluated after credential selection
  *   to produce request metadata (e.g. user_id for session attribution). Using a
  *   resolver instead of a pre-evaluated value ensures the metadata's account_uuid
  *   reflects the credential actually selected for this request.
+ * @param activeCwd Active session cwd for project-scoped secret lookup.
  */
 export async function generateSessionTitle(
 	firstMessage: string,
@@ -121,23 +168,17 @@ export async function generateSessionTitle(
 	sessionId?: string,
 	currentModel?: Model<Api>,
 	metadataResolver?: (provider: string) => Record<string, unknown> | undefined,
+	activeCwd?: string,
 ): Promise<string | null> {
-	const model = getTitleModel(registry, settings, currentModel);
+	const model = getTitleModel(registry, settings, currentModel, sessionId);
 	if (!model) {
 		logger.debug("title-generator: no title model found");
 		return null;
 	}
 
-	// Truncate message if too long
-	const truncatedMessage =
-		firstMessage.length > MAX_INPUT_CHARS ? `${firstMessage.slice(0, MAX_INPUT_CHARS)}…` : firstMessage;
-	const userMessage = `<user-message>
-${truncatedMessage}
-</user-message>`;
-
 	const apiKey = await registry.getApiKey(model, sessionId);
 	if (!apiKey) {
-		logger.debug("title-generator: no API key for smol model", {
+		logger.debug("title-generator: no API key for title model", {
 			provider: model.provider,
 			id: model.id,
 		});
@@ -147,6 +188,7 @@ ${truncatedMessage}
 	// request is already recorded; metadataResolver can then return the correct
 	// account_uuid rather than the snapshot-at-call-site value.
 	const metadata = metadataResolver?.(model.provider);
+	const userMessage = prepareTitleOutboundText(firstMessage, await titleInputObfuscator(settings, activeCwd));
 
 	// Title generation is a 3-6 word task, but some reasoning backends ignore
 	// disableReasoning. Keep the normal cheap budget for non-reasoning models
@@ -159,7 +201,12 @@ ${truncatedMessage}
 		userMessage,
 		maxTokens,
 	};
-	logger.debug("title-generator: request", request);
+	logger.debug("title-generator: request", {
+		model: request.model,
+		systemPrompt: request.systemPrompt,
+		userMessage: redactCrashSecrets(request.userMessage),
+		maxTokens: request.maxTokens,
+	});
 
 	try {
 		const response = await completeSimple(
@@ -182,7 +229,10 @@ ${truncatedMessage}
 			logger.debug("title-generator: response error", {
 				model: request.model,
 				stopReason: response.stopReason,
-				errorMessage: response.errorMessage,
+				errorMessage:
+					typeof response.errorMessage === "string"
+						? redactCrashSecrets(response.errorMessage)
+						: response.errorMessage,
 			});
 			return null;
 		}
@@ -191,7 +241,7 @@ ${truncatedMessage}
 
 		logger.debug("title-generator: response", {
 			model: request.model,
-			title,
+			title: redactCrashSecrets(title),
 			usage: response.usage,
 			stopReason: response.stopReason,
 		});
@@ -204,7 +254,7 @@ ${truncatedMessage}
 	} catch (err) {
 		logger.debug("title-generator: error", {
 			model: request.model,
-			error: err instanceof Error ? err.message : String(err),
+			error: redactCrashSecrets(err instanceof Error ? err.message : String(err)),
 		});
 		return null;
 	}