@gajae-code/coding-agent 0.5.1 → 0.5.3

package/src/session/agent-session.ts

@@ -41,6 +41,8 @@ import {
 	calculatePromptTokens,
 	collectEntriesForBranchSummary,
 	compact,
+	type EmergencyCompactionSample,
+	emergencyCompactionReason,
 	estimateMessageTokensHeuristic,
 	estimateTokens,
 	generateBranchSummary,
@@ -142,6 +144,7 @@ import { onAppendOnlyModeChanged } from "../config/settings";
 import { RawSseDebugBuffer } from "../debug/raw-sse-buffer";
 import { loadCapability } from "../discovery";
 import { expandApplyPatchToEntries, normalizeDiff, normalizeToLF, ParseError, previewPatch, stripBom } from "../edit";
+import { disposeVmContextsByOwner } from "../eval/js/context-manager";
 import {
 	disposeKernelSessionsByOwner,
 	executePython as executePythonCommand,
@@ -234,12 +237,14 @@ import {
 import type { ToolSession } from "../tools";
 import { AskTool } from "../tools/ask";
 import { assertEditableFile } from "../tools/auto-generated-guard";
+import { releaseTabsForOwner } from "../tools/browser/tab-supervisor";
 import type { CheckpointState } from "../tools/checkpoint";
 import { outputMeta, wrapToolWithMetaNotice } from "../tools/output-meta";
 import { normalizeLocalScheme, resolveToCwd } from "../tools/path-utils";
 import { getLatestTodoPhasesFromEntries, type TodoItem, type TodoPhase } from "../tools/todo-write";
 import { ToolAbortError, ToolError } from "../tools/tool-errors";
 import { clampTimeout } from "../tools/tool-timeouts";
+import { guardToolForUltragoalAsk } from "../tools/ultragoal-ask-guard";
 import { parseCommandArgs } from "../utils/command-args";
 import { type EditMode, resolveEditMode } from "../utils/edit-mode";
 import { resolveFileDisplayMode } from "../utils/file-display-mode";
@@ -906,6 +911,7 @@ export class AgentSession {
 	// Compaction state
 	#compactionAbortController: AbortController | undefined = undefined;
 	#autoCompactionAbortController: AbortController | undefined = undefined;
+	#resourceSampler: () => EmergencyCompactionSample = () => this.#defaultResourceSample();
 	#prePromptContextCheckPromise: Promise<void> | undefined = undefined;
 
 	// Branch summarization state
@@ -1186,6 +1192,7 @@ export class AgentSession {
 				};
 		this.agent.setProviderResponseInterceptor(this.#onResponse);
 		this.agent.setRawSseEventInterceptor(this.#onSseEvent);
+		this.#setGuardedAgentTools(this.agent.state.tools);
 		this.yieldQueue = new YieldQueue({
 			isStreaming: () => this.isStreaming,
 			injectStreaming: message => this.agent.followUp(message),
@@ -3185,6 +3192,13 @@ export class AgentSession {
 			}
 		}
 		await shutdownAllLspClients();
+		// F13: release only THIS session's browser tabs on dispose (kill:false → remote
+		// browsers disconnect, headless close gracefully). Scoped by the session id the
+		// browser tool tagged tabs with, so other live sessions' tabs are untouched.
+		// No-op when this session opened no tabs. Failure is logged, not thrown.
+		await releaseTabsForOwner(this.sessionManager.getSessionId()).catch((error: unknown) =>
+			logger.warn("session dispose: releaseTabsForOwner failed", { error }),
+		);
 		const pythonExecutionsSettled = await this.#prepareEvalExecutionsForDispose();
 		if (!pythonExecutionsSettled) {
 			logger.warn(
@@ -3192,6 +3206,7 @@ export class AgentSession {
 			);
 		}
 		await disposeKernelSessionsByOwner(this.#evalKernelOwnerId);
+		await disposeVmContextsByOwner(this.#evalKernelOwnerId);
 		this.#releasePowerAssertion();
 		await this.sessionManager.close();
 		this.#closeAllProviderSessions("dispose");
@@ -3690,6 +3705,16 @@ export class AgentSession {
 		}) as T;
 	}
 
+	#prepareToolForExecution<T extends AgentTool>(tool: T): T {
+		return this.#wrapToolForDeepInterviewMutationGuard(
+			this.#wrapToolForAcpPermission(guardToolForUltragoalAsk(tool, () => this.sessionManager.getCwd())),
+		);
+	}
+
+	#setGuardedAgentTools(tools: AgentTool[]): void {
+		this.agent.setTools(tools.map(tool => this.#prepareToolForExecution(tool)));
+	}
+
 	async #applyActiveToolsByName(
 		toolNames: string[],
 		options?: { persistMCPSelection?: boolean; previousSelectedMCPToolNames?: string[] },
@@ -3701,7 +3726,7 @@ export class AgentSession {
 		for (const name of toolNames) {
 			const tool = this.#toolRegistry.get(name);
 			if (tool) {
-				tools.push(this.#wrapToolForDeepInterviewMutationGuard(this.#wrapToolForAcpPermission(tool)));
+				tools.push(tool);
 				validToolNames.push(name);
 			}
 		}
@@ -3718,7 +3743,7 @@ export class AgentSession {
 				this.#selectedDiscoveredToolNames.delete(name);
 			}
 		}
-		this.agent.setTools(tools);
+		this.#setGuardedAgentTools(tools);
 
 		// Active tool set changed → discoverable tool list (which excludes already-active tools)
 		// is now stale. Invalidate before any prompt-template hook reads the discovery list.
@@ -3976,6 +4001,9 @@ export class AgentSession {
 		if (uniqueToolNames.size !== nextToolNames.length) {
 			throw new Error("RPC host tool names must be unique");
 		}
+		if (uniqueToolNames.has("ask")) {
+			throw new Error('RPC host tool "ask" is reserved and cannot be supplied by the host');
+		}
 
 		for (const name of uniqueToolNames) {
 			if (this.#toolRegistry.has(name) && !this.#rpcHostToolNames.has(name)) {
@@ -4303,11 +4331,8 @@ export class AgentSession {
 		this.#toolRegistry.set(finalTool.name, finalTool);
 
 		if (!this.getActiveToolNames().includes(finalTool.name)) {
-			const activeTools = [
-				...this.agent.state.tools,
-				this.#wrapToolForDeepInterviewMutationGuard(this.#wrapToolForAcpPermission(finalTool)),
-			];
-			this.agent.setTools(activeTools);
+			const activeTools = [...this.agent.state.tools, finalTool];
+			this.#setGuardedAgentTools(activeTools);
 			this.#invalidateDiscoveryCaches();
 			void this.refreshBaseSystemPrompt().catch(error => {
 				logger.warn("Failed to refresh system prompt after workflow gate ask tool registration", {
@@ -4339,9 +4364,8 @@ export class AgentSession {
 		const activeToolNames = this.getActiveToolNames();
 		const activeTools = activeToolNames
 			.map(name => this.#toolRegistry.get(name))
-			.filter((tool): tool is AgentTool => tool !== undefined)
-			.map(tool => this.#wrapToolForAcpPermission(tool));
-		this.agent.setTools(activeTools);
+			.filter((tool): tool is AgentTool => tool !== undefined);
+		this.#setGuardedAgentTools(activeTools);
 	}
 
 	getCheckpointState(): CheckpointState | undefined {
@@ -6005,6 +6029,44 @@ export class AgentSession {
 		);
 	}
 
+	/**
+	 * True when the configured `serviceTier` resolves to `"priority"` for the
+	 * given model `provider`. Returns false for scoped tiers that don't match
+	 * (e.g. `"openai-only"` on an anthropic provider) and when `provider` is
+	 * undefined. This is the canonical provider-aware fast-mode predicate.
+	 */
+	isFastForProvider(provider?: string): boolean {
+		// Fast mode applies to a concrete model's provider. With no provider
+		// (no model selected) it cannot apply, even under an unscoped `priority`
+		// tier that `resolveServiceTier` would otherwise pass through.
+		if (provider === undefined) return false;
+		return resolveServiceTier(this.serviceTier, provider) === "priority";
+	}
+
+	/**
+	 * Effective service tier applied to task-tool subagent sessions
+	 * (executor/architect/planner/critic). They run under `task.serviceTier`
+	 * unless it is `"inherit"`, in which case they inherit the main session
+	 * tier — mirroring `createSubagentSettings`.
+	 */
+	#subagentServiceTier(): ServiceTier | undefined {
+		const configured = this.settings.get("task.serviceTier");
+		if (configured === "inherit") return this.serviceTier;
+		if (configured === "none") return undefined;
+		return configured;
+	}
+
+	/**
+	 * Provider-aware fast-mode predicate for task-tool subagent roles, evaluated
+	 * against the effective subagent tier (`task.serviceTier`) rather than the
+	 * main session tier. Use this for `task.agentModelOverrides` role rows so the
+	 * ⚡ glyph reflects the tier the subagent actually runs under.
+	 */
+	isFastForSubagentProvider(provider?: string): boolean {
+		if (provider === undefined) return false;
+		return resolveServiceTier(this.#subagentServiceTier(), provider) === "priority";
+	}
+
 	/**
 	 * True when the configured `serviceTier` resolves to `"priority"` for the
 	 * *currently selected model's provider*. Returns false for scoped tiers
@@ -6012,7 +6074,7 @@ export class AgentSession {
 	 * no model is selected.
 	 */
 	isFastModeActive(): boolean {
-		return resolveServiceTier(this.serviceTier, this.model?.provider) === "priority";
+		return this.isFastForProvider(this.model?.provider);
 	}
 
 	setServiceTier(serviceTier: ServiceTier | undefined): void {
@@ -6576,11 +6638,55 @@ export class AgentSession {
 		}
 	}
 
+	/** Test seam: override the emergency-compaction resource sampler so tests never read real RSS. */
+	setResourceSampler(sampler: () => EmergencyCompactionSample): void {
+		this.#resourceSampler = sampler;
+	}
+
+	#defaultResourceSample(): EmergencyCompactionSample {
+		let providerBytes = 0;
+		let imageBytes = 0;
+		for (const message of this.state.messages) {
+			const content = (message as { content?: unknown }).content;
+			if (typeof content === "string") {
+				providerBytes += content.length;
+			} else if (Array.isArray(content)) {
+				for (const block of content) {
+					if (!block || typeof block !== "object") continue;
+					const typed = block as { text?: unknown; data?: unknown };
+					if (typeof typed.text === "string") providerBytes += typed.text.length;
+					if (typeof typed.data === "string") {
+						imageBytes += typed.data.length;
+						providerBytes += typed.data.length;
+					}
+				}
+			}
+		}
+		return {
+			heapUsedBytes: process.memoryUsage().heapUsed,
+			providerBytes,
+			messageCount: this.state.messages.length,
+			imageBytes,
+		};
+	}
+
 	async #checkEstimatedContextBeforePromptOnce(pendingMessages: readonly AgentMessage[]): Promise<void> {
 		const model = this.model;
 		if (!model) return;
 		const contextWindow = model.contextWindow ?? 0;
 		if (contextWindow <= 0) return;
+		// F6: non-disableable emergency floor — compact before OOM even when token-based
+		// compaction is disabled or its threshold is set too high (weak-hardware protection).
+		const emergencyReason = emergencyCompactionReason(this.#resourceSampler());
+		if (emergencyReason) {
+			logger.warn("Emergency compaction triggered (resource floor exceeded)", { reason: emergencyReason });
+			await this.#runAutoCompaction("overflow", false, false, {
+				continueAfterMaintenance: false,
+				deferHandoffMaintenance: false,
+				force: true,
+			});
+			return;
+		}
 		const compactionSettings = this.settings.getGroup("compaction");
 		if (!compactionSettings.enabled || compactionSettings.strategy === "off") return;
 
@@ -7232,7 +7338,17 @@ export class AgentSession {
 			addCandidate(this.#resolveRoleModelFull(role, availableModels, currentModel).model);
 		}
 
-		const sortedByContext = [...availableModels].sort((a, b) => b.contextWindow - a.contextWindow);
+		// Last-resort fallback: the largest-context model that shares the ACTIVE
+		// model's provider. Scoping this to the current provider keeps auto-
+		// compaction on the user's configured/custom route instead of silently
+		// defaulting to an unrelated provider (e.g. a stray OpenAI credential
+		// with no remaining credit) just because it happens to be in the bundled
+		// catalog. Cross-provider compaction stays possible, but only when the
+		// user opts in explicitly via modelRoles (handled by the loop above).
+		const fallbackProvider = currentModel?.provider;
+		const sortedByContext = [...availableModels]
+			.filter(model => fallbackProvider === undefined || model.provider === fallbackProvider)
+			.sort((a, b) => b.contextWindow - a.contextWindow);
 		for (const model of sortedByContext) {
 			if (!seen.has(this.#getModelKey(model))) {
 				addCandidate(model);
@@ -7356,11 +7472,13 @@ export class AgentSession {
 		reason: "overflow" | "threshold" | "idle",
 		willRetry: boolean,
 		deferred = false,
-		options?: { continueAfterMaintenance?: boolean; deferHandoffMaintenance?: boolean },
+		options?: { continueAfterMaintenance?: boolean; deferHandoffMaintenance?: boolean; force?: boolean },
 	): Promise<void> {
 		const compactionSettings = this.settings.getGroup("compaction");
-		if (compactionSettings.strategy === "off") return;
-		if (reason !== "idle" && !compactionSettings.enabled) return;
+		// `force` is the non-disableable emergency floor (F6): it bypasses the user's
+		// disabled/off settings so a resource-floor breach still compacts before OOM.
+		if (!options?.force && compactionSettings.strategy === "off") return;
+		if (!options?.force && reason !== "idle" && !compactionSettings.enabled) return;
 		const generation = this.#promptGeneration;
 		if (
 			options?.deferHandoffMaintenance !== false &&
@@ -9174,7 +9292,7 @@ export class AgentSession {
 					error: String(mcpError),
 				});
 				this.#selectedMCPToolNames = new Set(previousSelectedMCPToolNames);
-				this.agent.setTools(previousTools);
+				this.#setGuardedAgentTools(previousTools);
 				this.#baseSystemPrompt = previousBaseSystemPrompt;
 				this.agent.setSystemPrompt(previousSystemPrompt);
 			}
@@ -9497,17 +9615,15 @@ export class AgentSession {
 	 */
 	getSessionStats(): SessionStats {
 		const state = this.state;
-		const userMessages = state.messages.filter(m => m.role === "user").length;
-		const assistantMessages = state.messages.filter(m => m.role === "assistant").length;
-		const toolResults = state.messages.filter(m => m.role === "toolResult").length;
-
+		let userMessages = 0;
+		let assistantMessages = 0;
+		let toolResults = 0;
 		let toolCalls = 0;
 		let totalInput = 0;
 		let totalOutput = 0;
 		let totalCacheRead = 0;
 		let totalCacheWrite = 0;
 		let totalCost = 0;
-
 		let totalPremiumRequests = 0;
 		const getTaskToolUsage = (details: unknown): Usage | undefined => {
 			if (!details || typeof details !== "object") return undefined;
@@ -9517,8 +9633,13 @@ export class AgentSession {
 			return usage as Usage;
 		};
 
+		// Single pass over messages (replaces three role filters plus a separate usage
+		// loop) so per-turn stats stay O(messages + assistant content blocks), not O(4N).
 		for (const message of state.messages) {
-			if (message.role === "assistant") {
+			if (message.role === "user") {
+				userMessages += 1;
+			} else if (message.role === "assistant") {
+				assistantMessages += 1;
 				const assistantMsg = message as AssistantMessage;
 				toolCalls += assistantMsg.content.filter(c => c.type === "toolCall").length;
 				totalInput += assistantMsg.usage.input;
@@ -9527,17 +9648,18 @@ export class AgentSession {
 				totalCacheWrite += assistantMsg.usage.cacheWrite;
 				totalPremiumRequests += assistantMsg.usage.premiumRequests ?? 0;
 				totalCost += assistantMsg.usage.cost.total;
-			}
-
-			if (message.role === "toolResult" && message.toolName === "task") {
-				const usage = getTaskToolUsage(message.details);
-				if (usage) {
-					totalInput += usage.input;
-					totalOutput += usage.output;
-					totalCacheRead += usage.cacheRead;
-					totalCacheWrite += usage.cacheWrite;
-					totalPremiumRequests += usage.premiumRequests ?? 0;
-					totalCost += usage.cost.total;
+			} else if (message.role === "toolResult") {
+				toolResults += 1;
+				if (message.toolName === "task") {
+					const usage = getTaskToolUsage(message.details);
+					if (usage) {
+						totalInput += usage.input;
+						totalOutput += usage.output;
+						totalCacheRead += usage.cacheRead;
+						totalCacheWrite += usage.cacheWrite;
+						totalPremiumRequests += usage.premiumRequests ?? 0;
+						totalCost += usage.cost.total;
+					}
 				}
 			}
 		}
@@ -9698,11 +9820,46 @@ export class AgentSession {
 		return tokens;
 	}
 
+	#nativeTokenCache = new WeakMap<AgentMessage, { len: number; tokens: number }>();
+
+	/** Cheap content-size signal to invalidate the native token cache on mutation (growth). */
+	/**
+	 * Cheap content-size signal to invalidate the native token cache on mutation. Recursively
+	 * sums string lengths across the whole message (depth-bounded), so it covers every
+	 * provider-visible shape (text/thinking/tool args, toolResult output, tool names, etc.)
+	 * without allocating a serialized copy. A size-preserving in-place edit yields only a
+	 * benign estimate drift.
+	 */
+	#messageTokenSize(value: unknown, depth = 0): number {
+		if (depth > 6) return 0;
+		if (typeof value === "string") return value.length;
+		if (typeof value === "number" || typeof value === "boolean") return 8;
+		if (Array.isArray(value)) {
+			let size = 0;
+			for (const item of value) size += this.#messageTokenSize(item, depth + 1);
+			return size;
+		}
+		if (value && typeof value === "object") {
+			let size = 0;
+			for (const item of Object.values(value)) size += this.#messageTokenSize(item, depth + 1);
+			return size;
+		}
+		return 0;
+	}
+
 	#estimateMessageNativeContextTokens(message: AgentMessage): number {
+		// F10/F22: cache the expensive native token count per message object, invalidated by a
+		// cheap content-size signal, so unchanged (stable-size) messages are not re-tokenized on
+		// every pre-prompt estimate. A rare size-preserving in-place edit yields only a benign
+		// token-estimate drift, never wrong output.
+		const len = this.#messageTokenSize(message);
+		const cached = this.#nativeTokenCache.get(message);
+		if (cached && cached.len === len) return cached.tokens;
 		let tokens = 0;
 		for (const llmMessage of convertToLlm([message])) {
 			tokens += estimateTokens(llmMessage);
 		}
+		this.#nativeTokenCache.set(message, { len, tokens });
 		return tokens;
 	}
 

package/src/session/artifacts.ts

@@ -7,6 +7,11 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 
+import { DEFAULT_ARTIFACT_MAX_BYTES, truncateHeadBytes } from "./streaming-output";
+export interface ArtifactSaveOptions {
+	maxBytes?: number;
+}
+
 /**
  * Manages artifact storage for a session.
  *
@@ -94,9 +99,19 @@ export class ArtifactManager {
 	 * @param toolType Tool name for file extension (e.g., "bash", "read")
 	 * @returns Artifact ID (numeric string)
 	 */
-	async save(content: string, toolType: string): Promise<string> {
+	async save(content: string, toolType: string, options: ArtifactSaveOptions = {}): Promise<string> {
 		const { id, path } = await this.allocatePath(toolType);
-		await Bun.write(path, content);
+		const maxBytes = Math.max(0, options.maxBytes ?? DEFAULT_ARTIFACT_MAX_BYTES);
+		const contentBytes = Buffer.byteLength(content, "utf-8");
+		if (contentBytes > maxBytes) {
+			const truncated = truncateHeadBytes(content, maxBytes);
+			await Bun.write(
+				path,
+				`${truncated.text}\n[artifact truncated after ${truncated.bytes} bytes; omitted at least ${contentBytes - truncated.bytes} bytes]\n`,
+			);
+		} else {
+			await Bun.write(path, content);
+		}
 		return id;
 	}
 

package/src/session/blob-store.ts

@@ -167,19 +167,49 @@ export class EphemeralBlobStore extends BlobStore {
 }
 
 export class MemoryBlobStore extends BlobStore {
+	/**
+	 * Generous byte/count LRU bound (F8). Content-addressed resident blobs are fail-closed
+	 * on miss (callers raise/handle {@link ResidentBlobMissingError}), so evicting the
+	 * least-recently-used entry on an extremely large session is preferable to unbounded
+	 * RAM growth. The caps sit well above normal usage and only trip on pathological sizes.
+	 */
+	static readonly #MAX_BYTES = 64 * 1024 * 1024;
+	static readonly #MAX_COUNT = 4096;
+
 	#blobs = new Map<string, Buffer>();
+	#bytes = 0;
 
 	constructor() {
 		super(":memory:");
 	}
 
+	#store(hash: string, data: Buffer): void {
+		const existing = this.#blobs.get(hash);
+		if (existing) {
+			this.#blobs.delete(hash);
+			this.#bytes -= existing.byteLength;
+		}
+		this.#blobs.set(hash, data);
+		this.#bytes += data.byteLength;
+		while (
+			(this.#bytes > MemoryBlobStore.#MAX_BYTES || this.#blobs.size > MemoryBlobStore.#MAX_COUNT) &&
+			this.#blobs.size > 1
+		) {
+			const oldest = this.#blobs.keys().next().value;
+			if (oldest === undefined) break;
+			const evicted = this.#blobs.get(oldest);
+			this.#blobs.delete(oldest);
+			if (evicted) this.#bytes -= evicted.byteLength;
+		}
+	}
+
 	async put(data: Buffer): Promise<BlobPutResult> {
 		return this.putSync(data);
 	}
 
 	putSync(data: Buffer): BlobPutResult {
 		const hash = new Bun.SHA256().update(data).digest("hex");
-		this.#blobs.set(hash, Buffer.from(data));
+		this.#store(hash, Buffer.from(data));
 		return {
 			hash,
 			path: `memory:${hash}`,
@@ -195,7 +225,11 @@ export class MemoryBlobStore extends BlobStore {
 
 	getSync(hash: string): Buffer | null {
 		const data = this.#blobs.get(hash);
-		return data ? Buffer.from(data) : null;
+		if (!data) return null;
+		// Refresh LRU recency on hit so hot blobs survive eviction.
+		this.#blobs.delete(hash);
+		this.#blobs.set(hash, data);
+		return Buffer.from(data);
 	}
 
 	async has(hash: string): Promise<boolean> {

package/src/session/history-storage.ts

@@ -67,10 +67,14 @@ export class HistoryStorage {
 	// Prepared statements
 	#insertRowStmt: Statement;
 	#recentStmt: Statement;
+	#recentByCwdStmt: Statement;
 	#searchStmt: Statement;
+	#searchByCwdStmt: Statement;
 	#lastPromptStmt: Statement;
 	// Cache substring-fallback prepared statements keyed by token count.
 	#substringStmts = new Map<number, Statement>();
+	// Cache cwd-filtered substring-fallback statements keyed by token count.
+	#substringCwdStmts = new Map<number, Statement>();
 
 	// In-memory cache of last prompt to avoid sync DB reads on add
 	#lastPromptCache: string | null = null;
@@ -94,6 +98,7 @@ CREATE TABLE IF NOT EXISTS history (
 	cwd TEXT
 );
 CREATE INDEX IF NOT EXISTS idx_history_created_at ON history(created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_history_cwd_created_at ON history(cwd, created_at DESC);
 
 CREATE VIRTUAL TABLE IF NOT EXISTS history_fts USING fts5(prompt, content='history', content_rowid='id');
 
@@ -117,9 +122,15 @@ CREATE TRIGGER IF NOT EXISTS history_ai AFTER INSERT ON history BEGIN
 		this.#recentStmt = this.#db.prepare(
 			"SELECT id, prompt, created_at, cwd FROM history ORDER BY created_at DESC, id DESC LIMIT ?",
 		);
+		this.#recentByCwdStmt = this.#db.prepare(
+			"SELECT id, prompt, created_at, cwd FROM history WHERE cwd = ? ORDER BY created_at DESC, id DESC LIMIT ?",
+		);
 		this.#searchStmt = this.#db.prepare(
 			"SELECT h.id, h.prompt, h.created_at, h.cwd FROM history_fts f JOIN history h ON h.id = f.rowid WHERE history_fts MATCH ? ORDER BY h.created_at DESC, h.id DESC LIMIT ?",
 		);
+		this.#searchByCwdStmt = this.#db.prepare(
+			"SELECT h.id, h.prompt, h.created_at, h.cwd FROM history_fts f JOIN history h ON h.id = f.rowid WHERE history_fts MATCH ? AND h.cwd = ? ORDER BY h.created_at DESC, h.id DESC LIMIT ?",
+		);
 		this.#lastPromptStmt = this.#db.prepare("SELECT prompt FROM history ORDER BY id DESC LIMIT 1");
 
 		this.#insertRowStmt = this.#db.prepare("INSERT INTO history (prompt, cwd) VALUES (?, ?)");
@@ -158,12 +169,14 @@ CREATE TRIGGER IF NOT EXISTS history_ai AFTER INSERT ON history BEGIN
 		});
 	}
 
-	getRecent(limit: number): HistoryEntry[] {
+	getRecent(limit: number, cwd?: string): HistoryEntry[] {
 		const safeLimit = this.#normalizeLimit(limit);
 		if (safeLimit === 0) return [];
 
 		try {
-			const rows = this.#recentStmt.all(safeLimit) as HistoryRow[];
+			const rows = (
+				cwd === undefined ? this.#recentStmt.all(safeLimit) : this.#recentByCwdStmt.all(cwd, safeLimit)
+			) as HistoryRow[];
 			return rows.map(row => this.#toEntry(row));
 		} catch (error) {
 			logger.error("HistoryStorage getRecent failed", { error: String(error) });
@@ -171,7 +184,7 @@ CREATE TRIGGER IF NOT EXISTS history_ai AFTER INSERT ON history BEGIN
 		}
 	}
 
-	search(query: string, limit: number): HistoryEntry[] {
+	search(query: string, limit: number, cwd?: string): HistoryEntry[] {
 		const safeLimit = this.#normalizeLimit(limit);
 		if (safeLimit === 0) return [];
 
@@ -184,7 +197,11 @@ CREATE TRIGGER IF NOT EXISTS history_ai AFTER INSERT ON history BEGIN
 		const ftsQuery = tokens.map(tok => `"${tok.replace(/"/g, '""')}"*`).join(" ");
 		let ftsRows: HistoryRow[] = [];
 		try {
-			ftsRows = this.#searchStmt.all(ftsQuery, safeLimit) as HistoryRow[];
+			ftsRows = (
+				cwd === undefined
+					? this.#searchStmt.all(ftsQuery, safeLimit)
+					: this.#searchByCwdStmt.all(ftsQuery, cwd, safeLimit)
+			) as HistoryRow[];
 		} catch (error) {
 			// Malformed FTS expression - fall through to substring path.
 			logger.debug("HistoryStorage FTS query failed, using substring only", { error: String(error) });
@@ -199,7 +216,7 @@ CREATE TRIGGER IF NOT EXISTS history_ai AFTER INSERT ON history BEGIN
 		//    by safeLimit, ordered by recency - no full-table load into JS.
 		let subRows: HistoryRow[] = [];
 		try {
-			subRows = this.#searchSubstring(tokens, safeLimit);
+			subRows = this.#searchSubstring(tokens, safeLimit, cwd);
 		} catch (error) {
 			logger.error("HistoryStorage substring search failed", { error: String(error) });
 		}
@@ -250,6 +267,7 @@ CREATE TABLE history (
 	cwd TEXT
 );
 CREATE INDEX IF NOT EXISTS idx_history_created_at ON history(created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_history_cwd_created_at ON history(cwd, created_at DESC);
 INSERT INTO history (id, prompt, created_at, cwd)
 SELECT id, prompt, created_at, cwd
 FROM history_legacy;
@@ -282,21 +300,24 @@ END;
 			.filter(tok => tok.length > 0);
 	}
 
-	#searchSubstring(tokens: string[], limit: number): HistoryRow[] {
-		const stmt = this.#getSubstringStmt(tokens.length);
+	#searchSubstring(tokens: string[], limit: number, cwd?: string): HistoryRow[] {
+		const stmt = this.#getSubstringStmt(tokens.length, cwd !== undefined);
 		const params: unknown[] = tokens.map(tok => `%${escapeLikePattern(tok)}%`);
+		if (cwd !== undefined) params.push(cwd);
 		params.push(limit);
 		return stmt.all(...(params as [string, ...unknown[]])) as HistoryRow[];
 	}
 
-	#getSubstringStmt(tokenCount: number): Statement {
-		let stmt = this.#substringStmts.get(tokenCount);
+	#getSubstringStmt(tokenCount: number, withCwd: boolean): Statement {
+		const cache = withCwd ? this.#substringCwdStmts : this.#substringStmts;
+		let stmt = cache.get(tokenCount);
 		if (stmt) return stmt;
 		const whereClause = Array(tokenCount).fill("prompt LIKE ? ESCAPE '\\' COLLATE NOCASE").join(" AND ");
+		const cwdClause = withCwd ? " AND cwd = ?" : "";
 		stmt = this.#db.prepare(
-			`SELECT id, prompt, created_at, cwd FROM history WHERE ${whereClause} ORDER BY created_at DESC, id DESC LIMIT ?`,
+			`SELECT id, prompt, created_at, cwd FROM history WHERE ${whereClause}${cwdClause} ORDER BY created_at DESC, id DESC LIMIT ?`,
 		);
-		this.#substringStmts.set(tokenCount, stmt);
+		cache.set(tokenCount, stmt);
 		return stmt;
 	}