@oh-my-pi/pi-coding-agent 16.1.10 → 16.1.12

package/src/discovery/opencode.ts

@@ -91,15 +91,55 @@ async function loadContextFiles(ctx: LoadContext): Promise<LoadResult<ContextFil
 /** OpenCode MCP server config (from opencode.json "mcp" key) */
 interface OpenCodeMCPConfig {
 	type?: "local" | "remote";
-	command?: string;
+	command?: string | string[];
 	args?: string[];
 	env?: Record<string, string>;
+	environment?: Record<string, string>;
 	url?: string;
 	headers?: Record<string, string>;
 	enabled?: boolean;
 	timeout?: number;
 }
 
+function stringArray(value: unknown): string[] | undefined {
+	if (!Array.isArray(value)) return undefined;
+	for (const item of value) {
+		if (typeof item !== "string") return undefined;
+	}
+	return value;
+}
+
+function stringRecord(value: unknown): Record<string, string> | undefined {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+
+	const record: Record<string, string> = {};
+	for (const [key, item] of Object.entries(value)) {
+		if (typeof item !== "string") return undefined;
+		record[key] = item;
+	}
+	return record;
+}
+
+function normalizeCommand(
+	commandValue: string | string[] | undefined,
+	argsValue: unknown,
+): { command: string | undefined; args: string[] | undefined } {
+	const configuredArgs = stringArray(argsValue);
+	if (Array.isArray(commandValue)) {
+		const [command, ...commandArgs] = commandValue;
+		const args = configuredArgs ? [...commandArgs, ...configuredArgs] : commandArgs;
+		return {
+			command: typeof command === "string" ? command : undefined,
+			args: args.length > 0 ? args : undefined,
+		};
+	}
+
+	return {
+		command: typeof commandValue === "string" ? commandValue : undefined,
+		args: configuredArgs && configuredArgs.length > 0 ? configuredArgs : undefined,
+	};
+}
+
 async function loadMCPServers(ctx: LoadContext): Promise<LoadResult<MCPServer>> {
 	const items: MCPServer[] = [];
 	const warnings: string[] = [];
@@ -161,11 +201,14 @@ function extractMCPServers(
 			transport = "stdio";
 		}
 
+		const command = normalizeCommand(serverConfig.command, serverConfig.args);
+		const env = stringRecord(serverConfig.environment) ?? stringRecord(serverConfig.env);
+
 		items.push({
 			name,
-			command: serverConfig.command,
-			args: Array.isArray(serverConfig.args) ? (serverConfig.args as string[]) : undefined,
-			env: serverConfig.env && typeof serverConfig.env === "object" ? serverConfig.env : undefined,
+			command: command.command,
+			args: command.args,
+			env,
 			url: typeof serverConfig.url === "string" ? serverConfig.url : undefined,
 			headers: serverConfig.headers && typeof serverConfig.headers === "object" ? serverConfig.headers : undefined,
 			enabled: serverConfig.enabled,

package/src/edit/hashline/filesystem.ts

@@ -20,6 +20,7 @@ import { Filesystem, NotFoundError, type WriteResult } from "@oh-my-pi/hashline"
 import { isEnoent } from "@oh-my-pi/pi-utils";
 import type { FileDiagnosticsResult, WritethroughCallback, WritethroughDeferredHandle } from "../../lsp";
 import type { ToolSession } from "../../tools";
+import { routeWriteThroughBridge } from "../../tools/acp-bridge";
 import { assertEditableFileContent } from "../../tools/auto-generated-guard";
 import { invalidateFsScanAfterWrite } from "../../tools/fs-cache-invalidation";
 import { enforcePlanModeWrite, resolvePlanPath } from "../../tools/plan-mode-guard";
@@ -110,6 +111,13 @@ export class HashlineFilesystem extends Filesystem {
 		await this.preflightWrite(relativePath);
 		const absolutePath = this.resolveAbsolute(relativePath);
 		const finalContent = await serializeEditFileText(absolutePath, relativePath, content);
+
+		// Route through ACP bridge when available; skips internal artifacts.
+		if (await routeWriteThroughBridge(this.session, relativePath, absolutePath, finalContent)) {
+			this.#diagnosticsByPath.set(relativePath, undefined);
+			return { text: finalContent };
+		}
+
 		const diagnostics = await this.#writethrough(
 			absolutePath,
 			finalContent,

package/src/edit/modes/patch.ts

@@ -17,6 +17,7 @@ import {
 	type WritethroughDeferredHandle,
 } from "../../lsp";
 import type { ToolSession } from "../../tools";
+import { routeWriteThroughBridge } from "../../tools/acp-bridge";
 import { assertEditableFile } from "../../tools/auto-generated-guard";
 import {
 	invalidateFsScanAfterDelete,
@@ -1663,6 +1664,8 @@ class LspFileSystem implements FileSystem {
 	#fileCache: Record<string, Bun.BunFile> = {};
 
 	constructor(
+		private readonly session: ToolSession,
+		private readonly requestedPath: string,
 		private readonly writethrough: WritethroughCallback,
 		private readonly signal?: AbortSignal,
 		private readonly batchRequest?: LspBatchRequest,
@@ -1692,8 +1695,14 @@ class LspFileSystem implements FileSystem {
 	}
 
 	async write(path: string, content: string): Promise<void> {
-		const file = this.#getFile(path);
 		const finalContent = await serializeEditFileText(path, path, content);
+
+		// Route through ACP bridge when available; skips internal artifacts and local:// paths.
+		if (await routeWriteThroughBridge(this.session, this.requestedPath, path, finalContent)) {
+			return;
+		}
+
+		const file = this.#getFile(path);
 		const deferredForPath = this.deferredForPath;
 		const result = await this.writethrough(
 			path,
@@ -1785,7 +1794,14 @@ export async function executePatchSingle(
 	}
 
 	const input: PatchInput = { path: resolvedPath, op, rename: resolvedRename, diff };
-	const patchFileSystem = new LspFileSystem(writethrough, signal, batchRequest, beginDeferredDiagnosticsForPath);
+	const patchFileSystem = new LspFileSystem(
+		session,
+		path, // original user-provided path for bridge guard (may be local://, vault://, etc.)
+		writethrough,
+		signal,
+		batchRequest,
+		beginDeferredDiagnosticsForPath,
+	);
 	const result = await applyPatch(input, {
 		cwd: session.cwd,
 		fs: patchFileSystem,

package/src/edit/modes/replace.ts

@@ -6,8 +6,9 @@
  */
 import type { AgentToolResult } from "@oh-my-pi/pi-agent-core";
 import { type } from "arktype";
-import type { WritethroughCallback, WritethroughDeferredHandle } from "../../lsp";
+import type { FileDiagnosticsResult, WritethroughCallback, WritethroughDeferredHandle } from "../../lsp";
 import type { ToolSession } from "../../tools";
+import { routeWriteThroughBridge } from "../../tools/acp-bridge";
 import { invalidateFsScanAfterWrite } from "../../tools/fs-cache-invalidation";
 import { outputMeta } from "../../tools/output-meta";
 import { enforcePlanModeWrite, resolvePlanPath } from "../../tools/plan-mode-guard";
@@ -1098,15 +1099,17 @@ export async function executeReplaceSingle(
 		path,
 		bom + restoreLineEndings(result.content, originalEnding),
 	);
-	const diagnostics = await writethrough(
-		absolutePath,
-		finalContent,
-		signal,
-		Bun.file(absolutePath),
-		batchRequest,
-		dst => (dst === absolutePath ? beginDeferredDiagnosticsForPath(absolutePath) : undefined),
-	);
-	invalidateFsScanAfterWrite(absolutePath);
+
+	// Route through ACP bridge when available; skips internal artifacts.
+	let diagnostics: FileDiagnosticsResult | undefined;
+	if (await routeWriteThroughBridge(session, path, absolutePath, finalContent)) {
+		// bridge handled the write; diagnostics not available via writethrough
+	} else {
+		diagnostics = await writethrough(absolutePath, finalContent, signal, Bun.file(absolutePath), batchRequest, dst =>
+			dst === absolutePath ? beginDeferredDiagnosticsForPath(absolutePath) : undefined,
+		);
+		invalidateFsScanAfterWrite(absolutePath);
+	}
 
 	const diffResult = generateDiffString(normalizedContent, result.content, undefined, { path });
 	const resultText =

package/src/export/html/index.ts

@@ -12,6 +12,7 @@ import templateJs from "./template.js" with { type: "text" };
 // Pre-built React tool renderers: built by `bun --cwd=packages/collab-web run build:tool-views`,
 // run automatically by root `prepare` on install and by `prepack` at publish.
 import toolViewsJs from "./tool-views.generated.js" with { type: "text" };
+import { webExportThemeVars } from "./web-palette";
 
 let cachedTemplate: string | undefined;
 
@@ -36,6 +37,19 @@ export function getTemplate(): string {
 
 export interface ExportOptions {
 	outputPath?: string;
+	/**
+	 * Which color palette the export ships with.
+	 * - `"web"` (default) — the omp brand identity (collab-web pink/purple),
+	 *   so public HTML exports and the `/s/<id>` share viewer match the live
+	 *   `my.omp.sh` client. See `web-palette.ts`.
+	 * - `"theme"` — derive from `themeName` (or the active TUI theme), preserving
+	 *   the pre-15.12 behavior where an export mirrored the user's terminal.
+	 */
+	palette?: "web" | "theme";
+	/**
+	 * TUI theme to derive colors from when `palette: "theme"`. Ignored for the
+	 * default `"web"` palette. Resolves to the active TUI theme when omitted.
+	 */
 	themeName?: string;
 	/** Embed subagent session transcripts found next to the session file (default true). */
 	includeSubSessions?: boolean;
@@ -101,12 +115,38 @@ function deriveExportColors(baseColor: string): { pageBg: string; cardBg: string
 	};
 }
 
-/** Generate CSS custom properties for theme. Exported for the share-viewer build script. */
-export async function generateThemeVars(themeName?: string): Promise<string> {
+/**
+ * Generate CSS custom properties for the export `:root`.
+ *
+ * Two call shapes:
+ *   • `generateThemeVars("web" | "theme", themeName?)` — explicit palette.
+ *     `"web"` (the default for public artifacts) returns the fixed omp brand
+ *     palette from `web-palette.ts` — collab-web pink/purple identity, shared
+ *     with the live `my.omp.sh` client, so exports and the share viewer render
+ *     identically to it. `"theme"` derives from the TUI theme via
+ *     `getResolvedThemeColors(themeName)` plus the three
+ *     `export.{pageBg,cardBg,infoBg}` surface overrides.
+ *   • `generateThemeVars(themeName)` — legacy single-arg form: derive from the
+ *     named TUI theme. Kept so existing callers (and the theme-islight test)
+ *     keep working; equivalent to `generateThemeVars("theme", themeName)`.
+ *
+ * Exported for the share-viewer build script.
+ */
+export async function generateThemeVars(
+	palette: "web" | "theme" | (string & {}) = "web",
+	themeName?: string,
+): Promise<string> {
+	// Legacy single-arg form: `generateThemeVars("my-theme")` — the first arg
+	// is a theme name, not a palette. Route it to the themed path.
+	if (palette !== "web" && palette !== "theme") {
+		return generateThemeVars("theme", palette);
+	}
+	if (palette === "web") return webExportThemeVars();
+
 	const colors = await getResolvedThemeColors(themeName);
 	const lines: string[] = [];
-	for (const [key, value] of Object.entries(colors)) {
-		lines.push(`--${key}: ${value};`);
+	for (const key in colors) {
+		lines.push(`--${key}: ${colors[key]};`);
 	}
 
 	const themeExport = await getThemeExportColors(themeName);
@@ -200,8 +240,8 @@ async function collectSubSessionsFromDir(
 }
 
 /** Generate HTML from bundled template with runtime substitutions. */
-async function generateHtml(sessionData: SessionData, themeName?: string): Promise<string> {
-	const themeVars = await generateThemeVars(themeName);
+async function generateHtml(sessionData: SessionData, palette: "web" | "theme", themeName?: string): Promise<string> {
+	const themeVars = await generateThemeVars(palette, themeName);
 	const sessionDataBase64 = Buffer.from(JSON.stringify(sessionData)).toBase64();
 
 	// Use function replacements so `$'`, `$&`, `$$`, `$n`, etc. in the
@@ -229,7 +269,8 @@ export async function exportSessionToHtml(
 		if (Object.keys(subSessions).length > 0) sessionData.subSessions = subSessions;
 	}
 
-	const html = await generateHtml(sessionData, opts.themeName);
+	const palette = opts.palette ?? (opts.themeName ? "theme" : "web");
+	const html = await generateHtml(sessionData, palette, opts.themeName);
 	const outputPath = opts.outputPath || `${APP_NAME}-session-${path.basename(sessionFile, ".jsonl")}.html`;
 
 	await Bun.write(outputPath, html);
@@ -258,7 +299,8 @@ export async function exportFromFile(inputPath: string, options?: ExportOptions
 		if (Object.keys(subSessions).length > 0) sessionData.subSessions = subSessions;
 	}
 
-	const html = await generateHtml(sessionData, opts.themeName);
+	const palette = opts.palette ?? (opts.themeName ? "theme" : "web");
+	const html = await generateHtml(sessionData, palette, opts.themeName);
 	const outputPath = opts.outputPath || `${APP_NAME}-session-${path.basename(inputPath, ".jsonl")}.html`;
 
 	await Bun.write(outputPath, html);

package/src/export/html/web-palette.ts

@@ -0,0 +1,142 @@
+/**
+ * Web/export palette — the omp brand identity shared by the collab-web live
+ * client (`my.omp.sh/`) and every public HTML export / share viewer (`/s/<id>`).
+ *
+ * Why this exists separately from `modes/theme/dark.json`: the `dark` theme is
+ * the **default TUI theme** — its amber accent (`#febc38`) drives the terminal
+ * status line, syntax highlighting, thinking levels, and bash/python mode
+ * colors for every omp user. The public web artifacts want the collab-web
+ * pink/purple identity instead, so they pin this palette rather than inheriting
+ * the TUI's. Editing `dark.json` to repurpose it for the web would repaint
+ * every terminal; this file keeps the two surfaces decoupled.
+ *
+ * Token layout — emitted as CSS custom properties on `:root`:
+ *   • Legacy export names consumed by `template.css` / `template.js`
+ *     (`--text`, `--body-bg`, `--container-bg`, `--info-bg`, `--accent`,
+ *      `--border`, `--success`, `--error`, `--warning`, `--muted`, `--dim`,
+ *      `--borderAccent`, `--selectedBg`, `--userMessageBg`, `--customMessageBg`,
+ *      `--customMessageLabel`, `--mdHeading`, `--mdLink`, `--mdCode`,
+ *      `--mdListBullet`, `--toolOutput`, `--thinkingText`, syntax*, …).
+ *   • collab-web-native aliases consumed by the `tv-` tool-render bridge
+ *     (`tool-render.css`: `var(--bg-inset, …)`, `var(--fg, …)`, …) so embedded
+ *     tool cards resolve to the *real* collab-web tokens and render
+ *     pixel-identical to the live client.
+ *
+ * Alpha-bearing tokens (`--border`, `--ring`, `--accent-muted`, …) keep their
+ * `oklch(… / N%)` form — flattening them to opaque hex would produce harsh
+ * white borders and non-matching translucent focus rings. Opaque surfaces are
+ * sRGB hex (the collab-web `tokens.css` OKLCH dark-theme tokens converted via
+ * the standard OKLab→linear-sRGB→gamma path); if the live client palette
+ * changes, regenerate those from there.
+ */
+export const WEB_EXPORT_PALETTE = {
+	// --- collab-web-native aliases (tv- bridge) ---
+	"--bg": "#0f0b14",
+	"--bg-raised": "#16111c",
+	"--bg-inset": "#09060c",
+	"--bg-overlay": "#211b28",
+	"--fg": "#e6e3ea",
+	"--fg-muted": "#a49faa",
+	"--fg-faint": "#6e6974",
+	"--accent": "#ed4abf",
+	"--accent-muted": "oklch(0.674 0.23 341 / 18%)",
+	"--ok": "#68ca80",
+	"--err": "#f05653",
+	"--warn": "#e4b33f",
+	"--ring": "oklch(0.817 0.112 205 / 70%)",
+	"--font-mono": 'ui-monospace, "SF Mono", "JetBrains Mono", "Cascadia Mono", Menlo, Consolas, monospace',
+
+	// --- legacy export names (template.css / template.js) ---
+	// surfaces — map onto the collab-web purple ramp
+	"--body-bg": "#0f0b14", // = --bg
+	"--container-bg": "#16111c", // = --bg-raised
+	"--info-bg": "#09060c", // = --bg-inset (recessed wells: code blocks, tool output)
+	// text
+	"--text": "#e6e3ea", // = --fg
+	"--muted": "#a49faa", // = --fg-muted
+	"--dim": "#6e6974", // = --fg-faint
+	"--thinkingText": "#a49faa",
+	// hairlines — white-alpha, matching collab-web's --border/--border-strong
+	"--border": "oklch(1 0 0 / 9%)",
+	"--borderMuted": "oklch(1 0 0 / 6%)",
+	// accent + brand purple (the gradient's mid stop) for secondary highlights
+	"--borderAccent": "#945ff9",
+	"--selectedBg": "#2d2535",
+	// status — semantic, used sparingly (cancelled / exit-code / success dots)
+	"--success": "#68ca80", // = --ok
+	"--error": "#f05653", // = --err
+	"--warning": "#e4b33f", // = --warn
+	// message bubbles
+	"--userMessageBg": "oklch(0.674 0.23 341 / 6%)", // accent-tinted, like template.css user-message
+	"--userMessageText": "#e6e3ea",
+	"--customMessageBg": "#211b28", // = --bg-overlay
+	"--customMessageText": "#a49faa", // = --fg-muted
+	"--customMessageLabel": "#b281d6", // lilac, matching dark.json's label hue
+	// tool surfaces
+	"--toolPendingBg": "#16111c",
+	"--toolSuccessBg": "#09060c",
+	"--toolErrorBg": "oklch(0.66 0.19 25 / 14%)",
+	"--toolTitle": "#e6e3ea",
+	"--toolOutput": "#a49faa", // = --fg-muted
+	// markdown
+	"--mdHeading": "#ed4abf", // accent — headings carry the brand
+	"--mdLink": "#5ad8e5", // ring cyan — links distinct from the pink accent
+	"--mdLinkUrl": "#6e6974", // = --fg-faint
+	"--mdCode": "#e6e3ea",
+	"--mdCodeBlock": "#e6e3ea",
+	"--mdCodeBlockBorder": "oklch(1 0 0 / 9%)",
+	"--mdQuote": "#a49faa",
+	"--mdQuoteBorder": "oklch(1 0 0 / 13%)",
+	"--mdHr": "oklch(1 0 0 / 9%)",
+	"--mdListBullet": "#ed4abf", // accent — bullets carry the brand
+	// diff
+	"--toolDiffAdded": "#68ca80",
+	"--toolDiffRemoved": "#f05653",
+	"--toolDiffContext": "#6e6974",
+	// syntax — cool-neutral with pink/purple accents for keywords/types
+	"--syntaxComment": "#6e6974", // = --fg-faint
+	"--syntaxKeyword": "#945ff9", // brand purple
+	"--syntaxFunction": "#e4b33f", // warn amber (analog of dark.json's DCDCAA)
+	"--syntaxVariable": "#5ad8e5", // ring cyan
+	"--syntaxString": "#68ca80", // ok green
+	"--syntaxNumber": "#ed4abf", // accent
+	"--syntaxType": "#b281d6", // lilac
+	"--syntaxOperator": "#e6e3ea",
+	"--syntaxPunctuation": "#a49faa",
+	// thinking-level ramp — purple → lilac, matching the brand gradient
+	"--thinkingOff": "#6e6974",
+	"--thinkingMinimal": "#6e6974",
+	"--thinkingLow": "#945ff9",
+	"--thinkingMedium": "#b281d6",
+	"--thinkingHigh": "#ed4abf",
+	"--thinkingXhigh": "#e4b33f",
+	// mode tints (sidebar/role tags) — not surfaced in the export tree but
+	// emitted for completeness so template.js role classes resolve cleanly
+	"--bashMode": "#5ad8e5",
+	"--pythonMode": "#e4b33f",
+	// status-line tokens are TUI-only; not consumed by the export template, but
+	// emitted so any future surface that reads them inherits the brand.
+	"--statusLineBg": "#0f0b14",
+	"--statusLineSep": "#6e6974",
+	"--statusLineModel": "#ed4abf",
+	"--statusLinePath": "#5ad8e5",
+	"--statusLineGitClean": "#68ca80",
+	"--statusLineGitDirty": "#e4b33f",
+	"--statusLineContext": "#a49faa",
+	"--statusLineSpend": "#5ad8e5",
+	"--statusLineStaged": "#68ca80",
+	"--statusLineDirty": "#e4b33f",
+	"--statusLineUntracked": "#945ff9",
+	"--statusLineOutput": "#b281d6",
+	"--statusLineCost": "#b281d6",
+	"--statusLineSubagents": "#ed4abf",
+} as const satisfies Record<string, string>;
+
+/** Serialize the palette as `--key: value;` declarations for `:root { … }`. */
+export function webExportThemeVars(): string {
+	let out = "";
+	for (const k in WEB_EXPORT_PALETTE) {
+		out += `${k}: ${WEB_EXPORT_PALETTE[k as keyof typeof WEB_EXPORT_PALETTE]}; `;
+	}
+	return out.trimEnd();
+}

package/src/export/share.ts

@@ -19,13 +19,16 @@
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
-import type { AgentState } from "@oh-my-pi/pi-agent-core";
+import type { AgentMessage, AgentState } from "@oh-my-pi/pi-agent-core";
+import type { AssistantMessage, ImageContent, TextContent } from "@oh-my-pi/pi-ai";
 import { $which, logger } from "@oh-my-pi/pi-utils";
 import { DEFAULT_SHARE_URL } from "@oh-my-pi/pi-wire";
 import { $ } from "bun";
-import type { SecretObfuscator } from "../secrets/obfuscator";
+import { obfuscateToolArguments, type SecretObfuscator } from "../secrets/obfuscator";
+import type { SessionEntry, SessionHeader } from "../session/session-entries";
 import type { SessionManager } from "../session/session-manager";
-import { buildSessionData, type SessionData } from "./html";
+import type { OutputMeta } from "../tools/output-meta";
+import { buildSessionData, type SessionData, type SubSession } from "./html";
 
 export { DEFAULT_SHARE_URL };
 
@@ -53,10 +56,15 @@ export interface ShareSessionOptions {
 	/** Agent state for system prompt + tool descriptions in the snapshot. */
 	state?: AgentState;
 	/**
-	 * Redacts the snapshot before sealing: deep-walks every string (entries,
-	 * header, system prompt, tool descriptions) through the obfuscator, so
-	 * secrets that landed in persisted entries (tool outputs reading .env,
-	 * etc.) never leave the machine. Pass undefined to skip.
+	 * Redacts the snapshot before sealing via a typed, per-field walk over the
+	 * session (header title/cwd, system prompt, tool descriptions, entry summaries,
+	 * labels, and message text — including tool-result output and `@file` mentions),
+	 * so secrets that landed in persisted entries (tool outputs reading .env, etc.)
+	 * never leave the machine. Inline image bytes are preserved (size-trimmed
+	 * separately); opaque provider-replay blobs (`providerPayload`,
+	 * `redactedThinking`, `compaction.preserveData`) and untyped extension payloads
+	 * (`details`/`data`/`outputSchema`) are dropped rather than walked. Pass
+	 * undefined to skip redaction entirely.
 	 */
 	obfuscator?: SecretObfuscator;
 }
@@ -75,7 +83,189 @@ export interface ShareSessionResult {
 /** Build the snapshot that gets sealed and uploaded, redacted when an obfuscator is provided. */
 export function buildShareSnapshot(sm: SessionManager, options?: ShareSessionOptions): SessionData {
 	const data = buildSessionData(sm, options?.state);
-	return options?.obfuscator?.hasSecrets() ? options.obfuscator.obfuscateObject(data) : data;
+	return options?.obfuscator?.hasSecrets() ? redactSessionDataForShare(options.obfuscator, data) : data;
+}
+
+/**
+ * Redact secrets from a share snapshot. A share blob leaves the machine, so
+ * every text-bearing field is rewritten through the obfuscator. The walk is
+ * typed end-to-end (no generic object traversal): inline image bytes are left
+ * intact (size-trimmed later by {@link stripImagePayloads}) and opaque,
+ * untyped payloads we cannot redact field-by-field (`compaction.preserveData`,
+ * extension `details`/`data`, `mode_change.data`, structured output schemas)
+ * are dropped so they cannot leak.
+ */
+function redactShareHeader(o: SecretObfuscator, header: SessionHeader | null): SessionHeader | null {
+	if (!header) return header;
+	return {
+		...header,
+		title: header.title === undefined ? undefined : o.obfuscate(header.title),
+		cwd: o.obfuscate(header.cwd),
+	};
+}
+
+function redactSessionDataForShare(o: SecretObfuscator, data: SessionData): SessionData {
+	return {
+		...data,
+		header: redactShareHeader(o, data.header),
+		systemPrompt: data.systemPrompt === undefined ? undefined : o.obfuscate(data.systemPrompt),
+		tools: data.tools?.map(tool => ({ ...tool, description: o.obfuscate(tool.description) })),
+		entries: data.entries.map(entry => redactShareEntry(o, entry)),
+		subSessions: data.subSessions
+			? Object.fromEntries(
+					Object.entries(data.subSessions).map(([key, sub]) => [key, redactShareSubSession(o, sub)]),
+				)
+			: data.subSessions,
+	};
+}
+
+function redactShareSubSession(o: SecretObfuscator, sub: SubSession): SubSession {
+	return {
+		...sub,
+		header: redactShareHeader(o, sub.header),
+		entries: sub.entries.map(entry => redactShareEntry(o, entry)),
+	};
+}
+
+function redactShareEntry(o: SecretObfuscator, entry: SessionEntry): SessionEntry {
+	switch (entry.type) {
+		case "message":
+			return { ...entry, message: redactShareMessage(o, entry.message) };
+		case "compaction":
+			return {
+				...entry,
+				summary: o.obfuscate(entry.summary),
+				shortSummary: entry.shortSummary === undefined ? undefined : o.obfuscate(entry.shortSummary),
+				details: undefined,
+				preserveData: undefined,
+			};
+		case "branch_summary":
+			return { ...entry, summary: o.obfuscate(entry.summary), details: undefined };
+		case "custom_message":
+			return { ...entry, content: redactShareContent(o, entry.content), details: undefined };
+		case "custom":
+			return { ...entry, data: undefined };
+		case "mode_change":
+			return { ...entry, data: undefined };
+		case "session_init":
+			return {
+				...entry,
+				systemPrompt: o.obfuscate(entry.systemPrompt),
+				task: o.obfuscate(entry.task),
+				outputSchema: undefined,
+			};
+		case "label":
+			return { ...entry, label: entry.label === undefined ? undefined : o.obfuscate(entry.label) };
+		default:
+			return entry;
+	}
+}
+
+function redactShareContent(
+	o: SecretObfuscator,
+	content: string | (TextContent | ImageContent)[],
+): string | (TextContent | ImageContent)[] {
+	if (typeof content === "string") return o.obfuscate(content);
+	return content.map(block => (block.type === "text" ? { ...block, text: o.obfuscate(block.text) } : block));
+}
+
+/** Redact freeform strings in tool output metadata (source path/URL, diagnostics); numeric truncation info is preserved. */
+function redactShareOutputMeta(o: SecretObfuscator, meta: OutputMeta | undefined): OutputMeta | undefined {
+	if (!meta) return meta;
+	return {
+		...meta,
+		source: meta.source ? { ...meta.source, value: o.obfuscate(meta.source.value) } : meta.source,
+		diagnostics: meta.diagnostics
+			? {
+					summary: o.obfuscate(meta.diagnostics.summary),
+					messages: meta.diagnostics.messages.map(message => o.obfuscate(message)),
+				}
+			: meta.diagnostics,
+	};
+}
+
+function redactShareMessage(o: SecretObfuscator, message: AgentMessage): AgentMessage {
+	switch (message.role) {
+		case "user":
+		case "developer":
+			return {
+				...message,
+				providerPayload: undefined,
+				content: redactShareContent(o, message.content),
+			} as AgentMessage;
+		case "custom":
+		case "hookMessage":
+			return { ...message, details: undefined, content: redactShareContent(o, message.content) } as AgentMessage;
+		case "toolResult":
+			return {
+				...message,
+				details: undefined,
+				content: redactShareContent(o, message.content) as (TextContent | ImageContent)[],
+			};
+		case "assistant":
+			// Drop opaque provider-replay state (encrypted reasoning / native history) the viewer
+			// never reads and we cannot redact field-by-field: `providerPayload` and any
+			// `redactedThinking` blocks.
+			return {
+				...message,
+				providerPayload: undefined,
+				errorMessage: message.errorMessage === undefined ? undefined : o.obfuscate(message.errorMessage),
+				content: message.content.flatMap((block): AssistantMessage["content"] => {
+					if (block.type === "redactedThinking") return [];
+					if (block.type === "text") return [{ ...block, text: o.obfuscate(block.text) }];
+					if (block.type === "thinking") return [{ ...block, thinking: o.obfuscate(block.thinking) }];
+					if (block.type === "toolCall") {
+						return [
+							{
+								...block,
+								arguments: obfuscateToolArguments(o, block.arguments),
+								intent: block.intent === undefined ? undefined : o.obfuscate(block.intent),
+								rawBlock: block.rawBlock === undefined ? undefined : o.obfuscate(block.rawBlock),
+							},
+						];
+					}
+					return [block];
+				}),
+			};
+		case "bashExecution":
+			return {
+				...message,
+				command: o.obfuscate(message.command),
+				output: o.obfuscate(message.output),
+				meta: redactShareOutputMeta(o, message.meta),
+			};
+		case "pythonExecution":
+			return {
+				...message,
+				code: o.obfuscate(message.code),
+				output: o.obfuscate(message.output),
+				meta: redactShareOutputMeta(o, message.meta),
+			};
+		case "branchSummary":
+			return { ...message, summary: o.obfuscate(message.summary) };
+		case "compactionSummary":
+			return {
+				...message,
+				providerPayload: undefined,
+				summary: o.obfuscate(message.summary),
+				shortSummary: message.shortSummary === undefined ? undefined : o.obfuscate(message.shortSummary),
+				blocks:
+					message.blocks === undefined
+						? undefined
+						: (redactShareContent(o, message.blocks) as (TextContent | ImageContent)[]),
+			};
+		case "fileMention":
+			return {
+				...message,
+				files: message.files.map(file => ({
+					...file,
+					path: o.obfuscate(file.path),
+					content: o.obfuscate(file.content),
+				})),
+			};
+		default:
+			return message;
+	}
 }
 
 /** Share the session; tries a secret gist first, then the share server. */