@gajae-code/coding-agent 0.18.12 → 0.19.0

package/src/session/history-storage.ts

@@ -1,6 +1,5 @@
 import { Database, type Statement } from "bun:sqlite";
 import * as fs from "node:fs";
-import * as fsPromises from "node:fs/promises";
 import * as path from "node:path";
 import { getHistoryDbPath, logger } from "@gajae-code/utils";
 
@@ -26,6 +25,155 @@ function escapeLikePattern(text: string): string {
 	return text.replace(/[\\%_]/g, "\\$&");
 }
 
+const HISTORY_SUFFIXES = ["", "-wal", "-shm"] as const;
+let openingHistory: Database | undefined;
+
+function secureHistoryPath(pathname: string, kind: "directory" | "file"): void {
+	if (process.platform !== "win32") return;
+	const native = require("@gajae-code/natives") as typeof import("@gajae-code/natives");
+	const applied = native.applyOwnerOnlyPathSecurity(pathname, kind);
+	const verified = native.verifyOwnerOnlyPathSecurity(pathname, kind);
+	if (applied?.ok !== true || verified?.ok !== true) {
+		throw new Error("history database owner-only protection could not be established");
+	}
+}
+
+function historyErrno(error: unknown): string | undefined {
+	return (error as NodeJS.ErrnoException | undefined)?.code;
+}
+
+function historyLeaf(dbPath: string, suffix: string): fs.BigIntStats | undefined {
+	try {
+		return fs.lstatSync(`${dbPath}${suffix}`, { bigint: true });
+	} catch (error) {
+		if (historyErrno(error) !== "ENOENT") throw error;
+		return undefined;
+	}
+}
+
+function assertRegularHistoryLeaf(existing: fs.BigIntStats | undefined): void {
+	if (existing && (existing.isSymbolicLink() || !existing.isFile())) {
+		throw new Error("history database path is not a regular file");
+	}
+}
+
+function assertHistoryLeaves(dbPath: string): Set<string> {
+	const present = new Set<string>();
+	for (const suffix of HISTORY_SUFFIXES) {
+		const existing = historyLeaf(dbPath, suffix);
+		assertRegularHistoryLeaf(existing);
+		if (existing) present.add(suffix);
+	}
+	return present;
+}
+
+function removeNewHistoryLeaves(): void {
+	// A WAL reader can stay live while BEGIN EXCLUSIVE succeeds, so failure
+	// cleanup must not unlink a database another opener has adopted.
+	try {
+		openingHistory?.close();
+	} catch {
+		// The caller reports the original open failure.
+	}
+	openingHistory = undefined;
+}
+
+function readHistoryDirectory(dir: string): fs.Stats | undefined {
+	let existing: fs.Stats;
+	try {
+		existing = fs.lstatSync(dir);
+	} catch (error) {
+		if (historyErrno(error) !== "ENOENT") throw error;
+		return undefined;
+	}
+	if (existing.isSymbolicLink() || !existing.isDirectory()) {
+		throw new Error("history database directory is not a real directory");
+	}
+	return existing;
+}
+
+function tightenHistoryDirectory(dir: string): void {
+	let existing = readHistoryDirectory(dir);
+	if (!existing) {
+		try {
+			fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+		} catch (error) {
+			if (historyErrno(error) !== "EEXIST") throw error;
+		}
+		existing = readHistoryDirectory(dir);
+		if (!existing) throw new Error("history database directory is not a real directory");
+	}
+	secureHistoryPath(dir, "directory");
+	if (process.platform === "win32") return;
+	// 0300/0700 are already owner-only. Sticky directories are shared and stay as they are.
+	// chmod(2) needs no read bit, so mode 0333 becomes 0700. A symlink swap is
+	// followed by chmod; the recheck then refuses and no database file is created.
+	if ((existing.mode & 0o077) === 0 || (existing.mode & 0o1000) !== 0) return;
+	try {
+		fs.chmodSync(dir, 0o700);
+	} catch (error) {
+		if (historyErrno(error) === "ELOOP") throw new Error("history database directory is not a real directory");
+		throw error;
+	}
+	const after = readHistoryDirectory(dir);
+	if (!after || (after.mode & 0o077) !== 0) {
+		throw new Error("history database directory could not be tightened to mode 0700");
+	}
+}
+
+function sameHistoryFile(left: fs.BigIntStats, right: fs.BigIntStats): boolean {
+	return left.dev === right.dev && left.ino === right.ino && left.nlink === right.nlink;
+}
+
+function restrictHistoryFiles(dbPath: string, createMissingDb: boolean): void {
+	const noFollow = process.platform === "win32" ? 0 : (fs.constants.O_NOFOLLOW ?? 0);
+	for (const suffix of HISTORY_SUFFIXES) {
+		const target = `${dbPath}${suffix}`;
+		let existing = historyLeaf(dbPath, suffix);
+		assertRegularHistoryLeaf(existing);
+		if (!existing && suffix === "" && createMissingDb) {
+			let created: number | undefined;
+			try {
+				created = fs.openSync(
+					target,
+					fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | noFollow,
+					0o600,
+				);
+				fs.fchmodSync(created, 0o600);
+			} catch (error) {
+				if (historyErrno(error) === "ELOOP") throw new Error("history database path is not a regular file");
+				if (historyErrno(error) !== "EEXIST") throw error;
+			} finally {
+				if (created !== undefined) fs.closeSync(created);
+			}
+			existing = historyLeaf(dbPath, suffix);
+			assertRegularHistoryLeaf(existing);
+			if (!existing) throw new Error("history database path is not a regular file");
+		}
+		if (!existing) continue;
+		secureHistoryPath(target, "file");
+		if (process.platform === "win32" || (Number(existing.mode) & 0o077) === 0) continue;
+		let fd: number | undefined;
+		try {
+			fd = fs.openSync(target, fs.constants.O_RDONLY | noFollow);
+			const opened = fs.fstatSync(fd, { bigint: true });
+			const again = historyLeaf(dbPath, suffix);
+			if (!again || !opened.isFile() || !sameHistoryFile(existing, opened) || !sameHistoryFile(opened, again)) {
+				throw new Error("history database path is not a regular file");
+			}
+			fs.fchmodSync(fd, 0o600);
+			if ((Number(fs.fstatSync(fd, { bigint: true }).mode) & 0o777) !== 0o600) {
+				throw new Error("history database path could not be tightened to mode 0600");
+			}
+		} catch (error) {
+			if (historyErrno(error) === "ELOOP") throw new Error("history database path is not a regular file");
+			throw error;
+		} finally {
+			if (fd !== undefined) fs.closeSync(fd);
+		}
+	}
+}
+
 class AsyncDrain<T> {
 	#queue?: T[];
 	#promise = Promise.resolve();
@@ -83,6 +231,7 @@ export class HistoryStorage {
 
 	private constructor(dbPath: string) {
 		this.#db = new Database(dbPath);
+		openingHistory = this.#db;
 
 		const hasFts = this.#db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='history_fts'").get();
 
@@ -137,12 +286,32 @@ CREATE TRIGGER IF NOT EXISTS history_ai AFTER INSERT ON history BEGIN
 
 		const last = this.#lastPromptStmt.get() as { prompt?: string } | undefined;
 		this.#lastPromptCache = last?.prompt ?? null;
+		try {
+			restrictHistoryFiles(dbPath, false);
+		} catch (error) {
+			this.#db.close();
+			throw error;
+		}
+		openingHistory = undefined;
+	}
+
+	static #openNew(dbPath: string): HistoryStorage {
+		openingHistory = undefined;
+		assertHistoryLeaves(dbPath);
+		try {
+			tightenHistoryDirectory(path.dirname(dbPath));
+			assertHistoryLeaves(dbPath);
+			restrictHistoryFiles(dbPath, true);
+			return new HistoryStorage(dbPath);
+		} catch (error) {
+			removeNewHistoryLeaves();
+			throw error;
+		}
 	}
 
 	static open(dbPath: string = getHistoryDbPath()): HistoryStorage {
 		if (!HistoryStorage.#instance) {
-			fs.mkdirSync(path.dirname(dbPath), { recursive: true });
-			HistoryStorage.#instance = new HistoryStorage(dbPath);
+			HistoryStorage.#instance = HistoryStorage.#openNew(dbPath);
 		}
 		return HistoryStorage.#instance;
 	}
@@ -150,16 +319,17 @@ CREATE TRIGGER IF NOT EXISTS history_ai AFTER INSERT ON history BEGIN
 	static async openAsync(dbPath: string = getHistoryDbPath()): Promise<HistoryStorage> {
 		if (HistoryStorage.#instance) return HistoryStorage.#instance;
 		if (!HistoryStorage.#opening) {
-			HistoryStorage.#opening = (async () => {
-				await fsPromises.mkdir(path.dirname(dbPath), { recursive: true });
-				const storage = new HistoryStorage(dbPath);
-				HistoryStorage.#instance ??= storage;
-				return HistoryStorage.#instance;
-			})().finally(() => {
-				HistoryStorage.#opening = undefined;
-			});
+			HistoryStorage.#opening = Promise.resolve()
+				.then(() => {
+					const storage = HistoryStorage.#openNew(dbPath);
+					HistoryStorage.#instance ??= storage;
+					return HistoryStorage.#instance;
+				})
+				.finally(() => {
+					HistoryStorage.#opening = undefined;
+				});
 		}
-		return await HistoryStorage.#opening;
+		return HistoryStorage.#opening;
 	}
 
 	/** @internal Reset the singleton — test-only. */

package/src/session/internal/managed-session-scope.ts

@@ -228,14 +228,22 @@ function bindManagedWriteAuthority(scope: ManagedScope, authority: ManagedCandid
 function assertRetainedManagedDirectoryIdentity(scope: ManagedScope): void {
 	const expected = managedDirectoryIdentities.get(scope);
 	if (!expected) return;
-	const current = fs.lstatSync(scope.directoryPath, { bigint: true });
-	if (
-		!current.isDirectory() ||
-		current.isSymbolicLink() ||
-		current.dev !== expected.dev ||
-		current.ino !== expected.ino
-	)
-		throw new Error("Managed session directory changed");
+	assertSameManagedDirectoryIdentity(fs.lstatSync(scope.directoryPath, { bigint: true }), expected);
+}
+
+/**
+ * Fence a managed directory to the identity it was bound with. The decision is
+ * the same for every mismatch; only the reported reason differs. The same
+ * inode on a different `dev` is the shape a remount, drive-letter change or
+ * volume-serial change leaves behind (#6750). It is still refused, because an
+ * inode is only unique within one volume, but it is named so an operator is
+ * not sent looking for a corrupted binding.
+ */
+function assertSameManagedDirectoryIdentity(current: fs.BigIntStats, expected: { dev: bigint; ino: bigint }): void {
+	if (!current.isDirectory() || current.isSymbolicLink()) throw new Error("Managed session directory changed");
+	if (current.dev === expected.dev && current.ino === expected.ino) return;
+	if (current.ino === expected.ino) throw new Error("volume_identity_changed");
+	throw new Error("Managed session directory changed");
 }
 
 export function managedDirectoryAuthorityForScope(scope: ManagedScope): RecoveryFsRoot | undefined {
@@ -319,7 +327,22 @@ export type ManagedScopeResolution =
  * propagating them keeps startup redaction intact while telling the operator
  * which invariant actually failed instead of a blanket `binding_invalid`.
  */
-const managedScopeIdentityFailureCodes = new Set(["identity_mismatch", "reparse_point", "not_directory", "not_file"]);
+const managedScopeIdentityFailureCodes = new Set([
+	"identity_mismatch",
+	"volume_identity_changed",
+	"reparse_point",
+	"not_directory",
+	"not_file",
+]);
+
+/**
+ * Fixed, path-free tokens from the replacement-cleanup receipt preflight that
+ * runs before every no-replace publish. A stale receipt the preflight refuses
+ * (for example one whose filename encodes a device number that changed after a
+ * reboot, #6820) blocks an otherwise healthy binding publish; reporting it as
+ * `binding_invalid` sends operators to the binding instead of the receipt.
+ */
+const managedScopeReceiptFailureCodes = new Set(["managed_replace_cleanup_receipt_invalid"]);
 
 /**
  * Fixed, path-free errno tokens. A managed scope that fails to prepare because
@@ -376,6 +399,7 @@ function isManagedScopeCapacityMessage(message: string): boolean {
 function managedScopeResidualClassification(error: unknown): string | undefined {
 	if (!(error instanceof Error)) return undefined;
 	if (managedScopeIdentityFailureCodes.has(error.message)) return error.message;
+	if (managedScopeReceiptFailureCodes.has(error.message)) return error.message;
 	const errno = (error as NodeJS.ErrnoException).code;
 	return errno !== undefined && managedScopeErrnoFailureCodes.has(errno) ? errno : undefined;
 }
@@ -508,6 +532,7 @@ type NativeIdentity =
 type CanonicalNativeIdentity = Extract<NativeIdentity, { ok: true }>;
 
 type NativeIdentityFailureCode =
+	| "access_denied"
 	| "not_found"
 	| "not_directory"
 	| "not_utf8"
@@ -618,6 +643,12 @@ function nativeFailure(code: NativeIdentityFailureCode): ManagedScopeResolution
 		return { kind: "error", code: "cwd_missing", message: "The workspace directory does not exist." };
 	if (code === "not_directory")
 		return { kind: "error", code: "cwd_not_directory", message: "The workspace path is not a directory." };
+	if (code === "access_denied")
+		return {
+			kind: "error",
+			code: "permission_denied",
+			message: "Permission was denied while identifying the workspace directory.",
+		};
 	if (code === "network_unsupported") {
 		return {
 			kind: "error",
@@ -628,6 +659,10 @@ function nativeFailure(code: NativeIdentityFailureCode): ManagedScopeResolution
 	return { kind: "error", code: "identity_unavailable", message: "Workspace directory identity is unavailable." };
 }
 
+function nativeIdentityDiagnosticCode(code: NativeIdentityFailureCode): string {
+	return code === "access_denied" ? "permission_denied" : `cwd_${code}`;
+}
+
 function bindingFor(scope: ManagedScope): Binding {
 	return {
 		schemaVersion: 1,
@@ -1107,7 +1142,7 @@ function inspectCandidate(
 		if (header.type !== "session" || typeof header.id !== "string" || typeof header.cwd !== "string")
 			return { code: "invalid_header" };
 		const cwdIdentity = identityFor(header.cwd);
-		if (!cwdIdentity.ok) return { code: `cwd_${cwdIdentity.code}` };
+		if (!cwdIdentity.ok) return { code: nativeIdentityDiagnosticCode(cwdIdentity.code) };
 		const named = fs.lstatSync(filePath, { bigint: true });
 		if (
 			!named.isFile() ||
@@ -1872,13 +1907,7 @@ export function prepareManagedSessionScopeForWriteSync(
 		managedDirectoryAuthorities.set(scope, retainedAuthority);
 		stage = "scope_revalidate";
 		const directoryStat = fs.lstatSync(scope.directoryPath, { bigint: true });
-		if (
-			!directoryStat.isDirectory() ||
-			directoryStat.isSymbolicLink() ||
-			directoryStat.dev !== preparedDirectory.dev ||
-			directoryStat.ino !== preparedDirectory.ino
-		)
-			throw new Error("Managed session directory changed");
+		assertSameManagedDirectoryIdentity(directoryStat, preparedDirectory);
 		managedDirectoryIdentities.set(scope, { dev: preparedDirectory.dev, ino: preparedDirectory.ino });
 		if (validated) {
 			if (validated.kind !== "error") throw new Error("Unexpected managed scope binding result");
@@ -1954,7 +1983,7 @@ export function listManagedCandidates(scope: ManagedScope): ManagedCandidateList
 				const candidateIdentity = identityFor(candidate.cwd);
 				if (!candidateIdentity.ok) {
 					invalid.push({
-						code: `cwd_${candidateIdentity.code}`,
+						code: nativeIdentityDiagnosticCode(candidateIdentity.code),
 						...(safeManagedCandidateSessionId(candidate.sessionId) === undefined
 							? {}
 							: { sessionId: candidate.sessionId }),

package/src/session/internal/managed-session-storage.ts

@@ -170,7 +170,11 @@ function exactUnlinkCompleted(result: NativeExactUnlinkResult): boolean {
 }
 
 function isRetryableReplacementReceiptCleanupError(error: unknown): boolean {
-	return error instanceof Error && error.message === "managed_replace_receipt_cleanup_pending:io_error";
+	return (
+		error instanceof Error &&
+		(error.message === "managed_replace_receipt_cleanup_pending:io_error" ||
+			error.message === "managed_replace_receipt_cleanup_pending:access_denied")
+	);
 }
 
 /**
@@ -450,6 +454,17 @@ function replacementReceiptIsOwned(bytes: Uint8Array): boolean {
 	return observed.status !== "present" || observed.incarnation === publisher.incarnation;
 }
 
+/** Only positive local process-incarnation evidence proves a mismatched receipt's publisher is stale. */
+function replacementReceiptPublisherIsVerifiedDead(bytes: Uint8Array): boolean {
+	const publisher = replacementReceiptPublisher(bytes);
+	if (!publisher || publisher.host !== os.hostname()) return false;
+	if (publisher.pid === process.pid && publisher.ownerId === replacementPublisherOwnerId) return false;
+	const observed = observeProcessIncarnation(publisher.pid);
+	return (
+		observed.status === "absent" || (observed.status === "present" && observed.incarnation !== publisher.incarnation)
+	);
+}
+
 type LegacyReplacementCleanupIdentity = {
 	dev: bigint;
 	ino: bigint;
@@ -1100,6 +1115,7 @@ const GENERAL_FAILURE_CODES = new Set([
 	"identity_unavailable",
 	"identity_mismatch",
 	"owner_mismatch",
+	"access_denied",
 	"mode_mismatch",
 	"io_error",
 ]);
@@ -1964,6 +1980,59 @@ export class ManagedSessionDescendantStore {
 		return true;
 	}
 
+	#recoverRenumberedReplacementCleanupReceipt(
+		receiptPath: string,
+		binding: { predecessor: { dev: bigint; ino: bigint }; receipt: { dev: bigint; ino: bigint } },
+		receipt: ManagedFileSnapshot,
+	): boolean {
+		const parsed = parseReplacementCleanupReceipt(receipt.bytes);
+		const predecessor = parsed ? parseReplacementIdentity(parsed.predecessor) : undefined;
+		if (
+			receipt.identity.dev === binding.receipt.dev ||
+			receipt.identity.ino !== binding.receipt.ino ||
+			!parsed ||
+			!predecessor ||
+			predecessor.dev !== binding.predecessor.dev ||
+			predecessor.ino !== binding.predecessor.ino ||
+			!replacementReceiptPublisherIsVerifiedDead(receipt.bytes)
+		)
+			return false;
+
+		// The filename's device is the only identity component allowed to drift.
+		// The no-follow snapshot supplies the exact current size and digest, and
+		// detachOnly preserves those bytes under a non-canonical quarantine name.
+		const quarantineName = replacementReceiptRetirementName(receipt.identity, binding.predecessor);
+		const detached = nativeSessionStorage().exactUnlink(receiptPath, {
+			dev: receipt.identity.dev,
+			ino: receipt.identity.ino,
+			nlink: receipt.identity.nlink,
+			parentDev: this.#subtreeRoot.dev,
+			parentIno: this.#subtreeRoot.ino,
+			size: BigInt(receipt.identity.size),
+			mtimeNs: receipt.identity.mtimeNs,
+			sha256: receipt.identity.sha256,
+			detachOnly: true,
+			quarantineName,
+		});
+		if (isPeerOwnedReceiptRetirement(detached)) return true;
+		if (
+			!detached.ok &&
+			detached.code === "not_found" &&
+			detached.retainedSuccessorPath === undefined &&
+			detached.retainedUnknownPath === undefined
+		)
+			return true;
+		if (
+			(!detached.ok && detached.code !== "cleanup_pending") ||
+			detached.detachedPath !== path.join(this.#baseDir, quarantineName) ||
+			detached.retainedSuccessorPath ||
+			detached.retainedUnknownPath
+		)
+			throw new Error(`managed_replace_receipt_cleanup_pending:${detached.code ?? "unknown"}`);
+		fsyncDirectory(this.#baseDir);
+		return true;
+	}
+
 	#detachReplacementCleanupReceipt(receiptPath: string): void {
 		const binding = replacementCleanupReceiptBinding(path.basename(receiptPath));
 		if (!binding) throw new Error("managed_replace_cleanup_receipt_invalid");
@@ -1975,6 +2044,7 @@ export class ManagedSessionDescendantStore {
 			throw error;
 		}
 		if (receipt.identity.dev !== binding.receipt.dev || receipt.identity.ino !== binding.receipt.ino) {
+			if (this.#recoverRenumberedReplacementCleanupReceipt(receiptPath, binding, receipt)) return;
 			if (this.#recoverReplacementCleanupPlaceholder(receiptPath, binding, receipt)) return;
 			throw new Error("managed_replace_cleanup_receipt_invalid");
 		}

package/src/session/session-manager.ts

@@ -540,6 +540,76 @@ function isUnwritableResidentCacheFailure(error: unknown): boolean {
 	);
 }
 
+/** Nearest real directory at or above `start`. A file or missing path is not a root. */
+function nearestExistingDirectory(start: string): string | null {
+	let current = path.resolve(start);
+	for (let depth = 0; depth < 64; depth++) {
+		try {
+			if (fs.lstatSync(current).isDirectory()) return current;
+		} catch {
+			// Missing components are not worktree roots.
+		}
+		const parent = path.dirname(current);
+		if (parent === current) return null;
+		current = parent;
+	}
+	return null;
+}
+
+/**
+ * Canonical path of `start`, following a symlink ancestor.
+ * The unmatched suffix is appended so a not-yet-created cache root classifies
+ * the directory `openVerifiedResidentCacheInstanceDir` would create it in.
+ */
+function canonicalCachePath(start: string): string | null {
+	let current = path.resolve(start);
+	const pending: string[] = [];
+	for (let depth = 0; depth < 64; depth++) {
+		try {
+			const stat = fs.lstatSync(current);
+			if (stat.isDirectory() || stat.isSymbolicLink()) {
+				const real = fs.realpathSync(current);
+				return pending.length === 0 ? real : path.join(real, ...pending.reverse());
+			}
+		} catch {
+			// Missing components are resolved from the nearest existing ancestor.
+		}
+		const parent = path.dirname(current);
+		if (parent === current) return null;
+		pending.push(path.basename(current));
+		current = parent;
+	}
+	return null;
+}
+
+function cacheDirectoryInsideGitWorktree(directory: string): boolean {
+	return git.repo.resolveSync(directory) !== null;
+}
+
+/**
+ * Resident text is a second plaintext copy of assistant and tool output.
+ * A cache root inside a Git worktree can be staged by a later `git add`, so
+ * that root stays in memory. Both the lexical directory and the canonical
+ * directory are classified: a symlink outside the worktree must not hide a
+ * target inside it, and a lexical worktree path stays refused when its
+ * canonical target is outside. A missing or non-directory root still reaches
+ * the resident-cache trust check when both views are outside a worktree.
+ * No existing directory within 64 ancestors, or a resolver error, stays in memory.
+ */
+export function residentTextCacheRootAllowsDisk(cacheRoot: string): boolean {
+	try {
+		const lexical = nearestExistingDirectory(cacheRoot);
+		if (lexical === null || cacheDirectoryInsideGitWorktree(lexical)) return false;
+		const canonical = canonicalCachePath(cacheRoot);
+		if (canonical === null) return false;
+		const canonicalDirectory = nearestExistingDirectory(canonical);
+		if (canonicalDirectory === null || cacheDirectoryInsideGitWorktree(canonicalDirectory)) return false;
+		return true;
+	} catch {
+		return false;
+	}
+}
+
 export interface SessionEntryBase {
 	type: string;
 	id: string;
@@ -7311,6 +7381,17 @@ function sessionMatchesResumeArg(session: SessionInfo, sessionArg: string): bool
 	return fileSessionId.startsWith(normalizedArg);
 }
 
+/**
+ * Equal session id first, the same `id ===` check managed resume already uses.
+ * Prefix matching stays for every other argument, in list order.
+ */
+export function pickResumableSession(sessions: readonly SessionInfo[], sessionArg: string): SessionInfo | undefined {
+	return (
+		sessions.find(session => session.id === sessionArg) ??
+		sessions.find(session => sessionMatchesResumeArg(session, sessionArg))
+	);
+}
+
 export async function resolveResumableSession(
 	sessionArg: string,
 	cwd: string,
@@ -7321,7 +7402,7 @@ export async function resolveResumableSession(
 	const localSessions = sessionDir
 		? await SessionManager.list(cwd, sessionDir, storage)
 		: await SessionManager.listManagedForResumePickerReadOnly(cwd, managedAgentDir, storage);
-	const localMatch = localSessions.find(session => sessionMatchesResumeArg(session, sessionArg));
+	const localMatch = pickResumableSession(localSessions, sessionArg);
 	if (localMatch) {
 		return { session: localMatch, scope: "local" };
 	}
@@ -7331,7 +7412,7 @@ export async function resolveResumableSession(
 	}
 
 	const globalSessions = await SessionManager.listAll(storage, managedAgentDir);
-	const globalMatch = globalSessions.find(session => sessionMatchesResumeArg(session, sessionArg));
+	const globalMatch = pickResumableSession(globalSessions, sessionArg);
 	if (!globalMatch) {
 		return undefined;
 	}
@@ -8092,9 +8173,13 @@ export class SessionManager {
 			this.#residentCacheWin32FallbackCount++;
 			return { store: this.#newCanonicalResidentTextStore(), ownsStore: false };
 		}
-		const instanceDir = openVerifiedResidentCacheInstanceDir(
-			getResidentCacheRootDir(this.#residentCacheProfileAgentDir()),
-		);
+		const cacheRoot = getResidentCacheRootDir(this.#residentCacheProfileAgentDir());
+		// Not a provisioning failure: retain-and-throw must still commit, with no file to stage.
+		if (!residentTextCacheRootAllowsDisk(cacheRoot)) {
+			this.#residentCacheAdoptFallbackCount++;
+			return { store: this.#newCanonicalResidentTextStore(), ownsStore: false };
+		}
+		const instanceDir = openVerifiedResidentCacheInstanceDir(cacheRoot);
 		return { store: EphemeralBlobStore.adoptVerifiedDir(instanceDir), ownsStore: true };
 	}
 

package/src/session-import/redact.ts

@@ -11,7 +11,6 @@ export const IMPORT_REDACTED_PLACEHOLDER = "[REDACTED]";
 /** Bumped when patterns change; persisted in import provenance. */
 export const IMPORT_SANITIZER_VERSION = 2;
 
-const ANSI_ESCAPE = /\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07]*(?:\x07|\x1b\\))/gu;
 const UNSAFE_CONTROL =
 	/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f\u200b-\u200f\u202a-\u202e\u2060\u2066-\u2069\ufeff]/gu;
 const HEADER_CREDENTIAL = /(\b(?:authorization|cookie|set-cookie)\b[ \t]*:[ \t]*)([^\r\n]*)/giu;
@@ -80,6 +79,58 @@ const REDACTION_RULES: readonly RedactionRule[] = [
 	},
 ];
 
+/**
+ * Linear CSI/OSC strip. An unterminated `ESC ]` used to make the global
+ * replace rescan every later suffix, which is quadratic in the prefix count.
+ */
+function stripImportedAnsiEscapes(input: string): string {
+	if (!input.includes("\u001b")) return input;
+	const parts: string[] = [];
+	let from = 0;
+	let i = 0;
+	let oscLive = true;
+	const n = input.length;
+	while (i < n) {
+		const esc = input.indexOf("\u001b", i);
+		if (esc < 0 || esc + 1 >= n) break;
+		const kind = input.charCodeAt(esc + 1);
+		let end = -1;
+		if (kind === 0x5b) end = csiSequenceEnd(input, esc + 2);
+		else if (kind === 0x5d && oscLive) end = oscSequenceEnd(input, esc + 2);
+		// No BEL and no ST anywhere after this prefix, so later OSC cannot terminate.
+		if (kind === 0x5d && end < 0) oscLive = false;
+		if (end < 0) {
+			i = esc + 1;
+			continue;
+		}
+		if (esc > from) parts.push(input.slice(from, esc));
+		from = end;
+		i = end;
+	}
+	if (from === 0) return input;
+	if (from < n) parts.push(input.slice(from));
+	return parts.join("");
+}
+
+function csiSequenceEnd(input: string, j: number): number {
+	const n = input.length;
+	while (j < n && input.charCodeAt(j) >= 0x30 && input.charCodeAt(j) <= 0x3f) j++;
+	while (j < n && input.charCodeAt(j) >= 0x20 && input.charCodeAt(j) <= 0x2f) j++;
+	const finalByte = input.charCodeAt(j);
+	return finalByte >= 0x40 && finalByte <= 0x7e ? j + 1 : -1;
+}
+
+function oscSequenceEnd(input: string, index: number): number {
+	// One forward scan. A second search to the end of the suffix is quadratic for repeated OSC sequences.
+	const n = input.length;
+	for (let j = index; j < n; j++) {
+		const code = input.charCodeAt(j);
+		if (code === 0x07) return j + 1;
+		if (code === 0x1b && j + 1 < n && input.charCodeAt(j + 1) === 0x5c) return j + 2;
+	}
+	return -1;
+}
+
 export interface ImportRedactionResult {
 	value: string;
 	redacted: number;
@@ -91,7 +142,7 @@ export interface ImportRedactionResult {
  * is used for all kinds so a partial pattern overlap cannot leak fragments.
  */
 export function redactImportedText(input: string): ImportRedactionResult {
-	let value = input.replace(ANSI_ESCAPE, "").replace(UNSAFE_CONTROL, "");
+	let value = stripImportedAnsiEscapes(input).replace(UNSAFE_CONTROL, "");
 	let redacted = 0;
 	const kinds = new Set<string>();
 	value = value.replace(HEADER_CREDENTIAL, (_match, prefix: string, raw: string) => {