@oh-my-pi/pi-coding-agent 16.1.19 → 16.1.20

package/src/task/executor.ts

@@ -7,7 +7,7 @@
 import path from "node:path";
 import type { AgentEvent, AgentIdentity, AgentTelemetryConfig, ThinkingLevel } from "@oh-my-pi/pi-agent-core";
 import { recordHandoff, resolveTelemetry } from "@oh-my-pi/pi-agent-core";
-import type { Api, Model, Usage } from "@oh-my-pi/pi-ai";
+import type { Api, Model, ServiceTier, Usage } from "@oh-my-pi/pi-ai";
 import { logger, popLoopPhase, prompt, pushLoopPhase, untilAborted } from "@oh-my-pi/pi-utils";
 import type { Rule } from "../capability/rule";
 import { ModelRegistry } from "../config/model-registry";
@@ -18,6 +18,7 @@ import {
 	resolveModelOverrideWithAuthFallback,
 } from "../config/model-resolver";
 import type { PromptTemplate } from "../config/prompt-templates";
+import { resolveSubagentServiceTier } from "../config/service-tier";
 import { Settings } from "../config/settings";
 import { SETTINGS_SCHEMA, type SettingPath } from "../config/settings-schema";
 import type { ToolPathWithSource } from "../extensibility/custom-tools";
@@ -50,12 +51,12 @@ import {
 	type OutputValidator,
 	summarizeValidationFailure,
 } from "../tools/output-schema-validator";
-
 import { type ReportFindingDetails, toReviewFinding } from "../tools/review";
 import { ToolAbortError } from "../tools/tool-errors";
 import type { EventBus } from "../utils/event-bus";
 import { buildNamedToolChoice } from "../utils/tool-choice";
 import type { WorkspaceTree } from "../workspace-tree";
+import { Semaphore } from "./parallel";
 import { subprocessToolRegistry } from "./subprocess-tool-registry";
 import {
 	type AgentDefinition,
@@ -194,6 +195,51 @@ function installSubagentRetryFallbackChain(args: {
 	return role;
 }
 
+const PROVIDER_MAX_CONCURRENCY_SETTINGS: Record<string, SettingPath> = {
+	"ollama-cloud": "providers.ollama-cloud.maxConcurrency",
+};
+
+interface ProviderSemaphoreEntry {
+	limit: number;
+	semaphore: Semaphore;
+}
+
+const providerSemaphores = new Map<string, ProviderSemaphoreEntry>();
+
+/**
+ * Resolve the configured concurrency ceiling for a provider, or `undefined`
+ * when the provider has no cap concept at all. A configured value `<= 0` means
+ * "unlimited" and maps to `Infinity` — still a tracked ceiling, so every run
+ * holds a slot and a later finite resize counts work started while unlimited.
+ */
+function getProviderConcurrencyLimit(settings: Settings, provider: string): number | undefined {
+	const settingPath = PROVIDER_MAX_CONCURRENCY_SETTINGS[provider];
+	if (!settingPath) return undefined;
+	const raw = settings.get(settingPath);
+	const limit = Number.isFinite(raw) ? Math.trunc(raw) : 0;
+	return limit > 0 ? limit : Number.POSITIVE_INFINITY;
+}
+
+function getProviderSemaphore(settings: Settings, provider: string): Semaphore | undefined {
+	const limit = getProviderConcurrencyLimit(settings, provider);
+	if (limit === undefined) return undefined;
+	// Always hand out (and acquire on) the single shared limiter, even when
+	// unlimited (Infinity). Resizing it in place — rather than replacing it —
+	// keeps every in-flight slot counted, so a runtime or mixed limit change can
+	// never push concurrency past the cap (issue #3464 review feedback).
+	const existing = providerSemaphores.get(provider);
+	if (existing) {
+		if (existing.limit !== limit) {
+			existing.limit = limit;
+			existing.semaphore.resize(limit);
+		}
+		return existing.semaphore;
+	}
+	const semaphore = new Semaphore(limit);
+	providerSemaphores.set(provider, { limit, semaphore });
+	return semaphore;
+}
+
 function renderIrcPeerRoster(selfId: string): string {
 	const peers = AgentRegistry.global()
 		.list()
@@ -339,6 +385,13 @@ export interface ExecutorOptions {
 	authStorage?: AuthStorage;
 	modelRegistry?: ModelRegistry;
 	settings?: Settings;
+	/**
+	 * Parent session's live effective service tier, the source of truth for a
+	 * subagent whose `serviceTierSubagent` is `"inherit"`. `null` = the parent
+	 * explicitly has no tier (e.g. `/fast off`); omitted = no live session, so
+	 * inherit falls back to the configured `serviceTier` setting.
+	 */
+	parentServiceTier?: ServiceTier | null;
 	/** Override local:// protocol options so subagent shares parent's local:// root */
 	localProtocolOptions?: LocalProtocolOptions;
 	/**
@@ -732,11 +785,21 @@ export function createMCPProxyTools(mcpManager: MCPManager): CustomTool[] {
 export function createSubagentSettings(
 	baseSettings: Settings,
 	overrides?: Partial<Record<SettingPath, unknown>>,
+	inheritedServiceTier?: ServiceTier | null,
 ): Settings {
 	const snapshot: Partial<Record<SettingPath, unknown>> = {};
 	for (const key of Object.keys(SETTINGS_SCHEMA) as SettingPath[]) {
 		snapshot[key] = baseSettings.get(key);
 	}
+	// Resolve the subagent's service tier from `serviceTierSubagent` ("inherit" =
+	// match the parent's live tier when a live session supplied one, else the
+	// configured `serviceTier`). The result is stamped back onto the snapshot so
+	// createAgentSession's `settings.get("serviceTier")` read picks it up.
+	snapshot.serviceTier = resolveSubagentServiceTier(
+		baseSettings.get("serviceTierSubagent"),
+		baseSettings.get("serviceTier"),
+		inheritedServiceTier,
+	);
 	return Settings.isolated({
 		...snapshot,
 		"async.enabled": false,
@@ -1747,6 +1810,7 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 	const subagentSettings = createSubagentSettings(
 		settings,
 		agent.readSummarize === false ? { "read.summarize.enabled": false } : undefined,
+		options.parentServiceTier,
 	);
 	const maxRecursionDepth = settings.get("task.maxRecursionDepth") ?? 2;
 	// Tailored specialist identity for this spawn. `subagentRole` is the full
@@ -1889,6 +1953,8 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 		let sessionOpenedAt: number | undefined;
 		let sessionCreatedAt: number | undefined;
 		let readyAt: number | undefined;
+		let providerSemaphore: Semaphore | undefined;
+		let providerSemaphoreAcquired = false;
 
 		try {
 			checkAbort();
@@ -1957,6 +2023,13 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 				? resolvedThinkingLevel
 				: (thinkingLevel ?? resolvedThinkingLevel);
 			resolvedAt = performance.now();
+			if (model) {
+				providerSemaphore = getProviderSemaphore(settings, model.provider);
+				if (providerSemaphore) {
+					await providerSemaphore.acquire(abortSignal);
+					providerSemaphoreAcquired = true;
+				}
+			}
 
 			const effectiveCwd = worktree ?? cwd;
 			const sessionManager = sessionFile
@@ -2247,6 +2320,10 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 				}
 				if (exitCode === 0) exitCode = 1;
 			}
+			if (providerSemaphoreAcquired) {
+				providerSemaphore?.release();
+				providerSemaphoreAcquired = false;
+			}
 			sessionAbortController.abort();
 			if (unsubscribe) {
 				try {

package/src/task/index.ts

@@ -798,13 +798,13 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 					onSettled?.(true);
 					throw new Error("Aborted before execution");
 				}
-				markRunning();
-				progress.status = "running";
-				await reportProgress(
-					`Running background task ${agentId}...`,
-					buildDetails("running", ownJobId) as unknown as Record<string, unknown>,
-				);
 				try {
+					markRunning();
+					progress.status = "running";
+					await reportProgress(
+						`Running background task ${agentId}...`,
+						buildDetails("running", ownJobId) as unknown as Record<string, unknown>,
+					);
 					const result = await this.#executeSync(
 						toolCallId,
 						spawnParams,
@@ -1296,6 +1296,11 @@ export class TaskTool implements AgentTool<TaskToolSchemaInstance, TaskToolDetai
 				parentTelemetry: this.session.getTelemetry?.(),
 				parentEvalSessionId,
 				parentAgentId: this.session.getAgentId?.() ?? MAIN_AGENT_ID,
+				// Live source of truth for `serviceTierSubagent: inherit`. When the
+				// session exposes a tier accessor, pass tier-or-null (null = explicit
+				// none, e.g. /fast off); otherwise leave undefined so inherit falls
+				// back to the configured serviceTier setting.
+				parentServiceTier: this.session.getServiceTier ? (this.session.getServiceTier() ?? null) : undefined,
 			};
 
 			const runTask = async (): Promise<SingleResult> => {

package/src/task/parallel.ts

@@ -100,22 +100,74 @@ export class Semaphore {
 		this.#max = normalizedMax > 0 ? normalizedMax : Number.POSITIVE_INFINITY;
 	}
 
-	async acquire(): Promise<void> {
+	/**
+	 * Resolves when a slot is available. Pass an `AbortSignal` so callers that
+	 * stop waiting (parent task cancelled, wall-clock budget elapsed) also stop
+	 * occupying a queue slot — otherwise a later `release()` would resolve the
+	 * abandoned waiter, permanently shrinking effective concurrency for the
+	 * remaining lifetime of the process (issue #3464 review feedback).
+	 */
+	async acquire(signal?: AbortSignal): Promise<void> {
+		if (signal?.aborted) {
+			throw semaphoreAbortReason(signal);
+		}
 		if (this.#current < this.#max) {
 			this.#current++;
 			return;
 		}
-		const { promise, resolve } = Promise.withResolvers<void>();
-		this.#queue.push(resolve);
+		const { promise, resolve, reject } = Promise.withResolvers<void>();
+		const queue = this.#queue;
+		let waiter: () => void = resolve;
+		if (signal) {
+			const onAbort = () => {
+				const index = queue.indexOf(waiter);
+				if (index >= 0) queue.splice(index, 1);
+				reject(semaphoreAbortReason(signal));
+			};
+			waiter = () => {
+				signal.removeEventListener("abort", onAbort);
+				resolve();
+			};
+			signal.addEventListener("abort", onAbort, { once: true });
+		}
+		queue.push(waiter);
 		return promise;
 	}
 
 	release(): void {
-		const next = this.#queue.shift();
-		if (next) {
+		if (this.#current > 0) this.#current--;
+		// Admit the next waiter only if we are under the (possibly just-lowered) ceiling.
+		if (this.#current < this.#max) {
+			const next = this.#queue.shift();
+			if (next) {
+				this.#current++;
+				next();
+			}
+		}
+	}
+
+	/**
+	 * Adjust the maximum concurrency in place. Raising the ceiling immediately
+	 * admits queued waiters that now fit; lowering it lets in-flight holders
+	 * drain naturally (new acquires keep blocking until `#current` falls below
+	 * the new max). Resizing the single shared instance — instead of replacing
+	 * it — keeps in-flight slots counted, so a runtime or mixed limit change can
+	 * never push concurrency past the cap (issue #3464 review feedback).
+	 */
+	resize(max: number): void {
+		const normalizedMax = Number.isFinite(max) ? Math.trunc(max) : 0;
+		this.#max = normalizedMax > 0 ? normalizedMax : Number.POSITIVE_INFINITY;
+		while (this.#current < this.#max) {
+			const next = this.#queue.shift();
+			if (!next) break;
+			this.#current++;
 			next();
-		} else {
-			this.#current--;
 		}
 	}
 }
+
+function semaphoreAbortReason(signal: AbortSignal): unknown {
+	const reason = signal.reason;
+	if (reason !== undefined) return reason;
+	return new Error("Semaphore acquire aborted");
+}

package/src/tools/index.ts

@@ -1,6 +1,6 @@
 import type { InMemorySnapshotStore } from "@oh-my-pi/hashline";
 import type { AgentTelemetryConfig, AgentTool } from "@oh-my-pi/pi-agent-core";
-import type { FetchImpl, ImageContent, Model, ToolChoice } from "@oh-my-pi/pi-ai";
+import type { FetchImpl, ImageContent, Model, ServiceTier, ToolChoice } from "@oh-my-pi/pi-ai";
 import { logger } from "@oh-my-pi/pi-utils";
 import type { AsyncJobManager } from "../async/job-manager";
 import type { Rule } from "../capability/rule";
@@ -240,6 +240,8 @@ export interface ToolSession {
 	getActiveModelString?: () => string | undefined;
 	/** Get the current session model object (provider/api capabilities), regardless of how it was chosen. */
 	getActiveModel?: () => Model | undefined;
+	/** Get the session's live effective service tier (undefined = none). Source of truth for subagent `serviceTierSubagent: inherit`. */
+	getServiceTier?: () => ServiceTier | undefined;
 	/** Auth storage for passing to subagents (avoids re-discovery) */
 	authStorage?: import("../session/auth-storage").AuthStorage;
 	/** Model registry for passing to subagents (avoids re-discovery) */

package/src/tools/irc.ts

@@ -514,6 +514,18 @@ function callMeta(args: IrcRenderArgs | undefined): string[] {
 	return meta;
 }
 
+function renderErrorResult(
+	result: { content: Array<{ type: string; text?: string }> },
+	args: IrcRenderArgs | undefined,
+	theme: Theme,
+): string[] {
+	const text = textContent(result) || "IRC call failed.";
+	return [
+		renderStatusLine({ icon: "error", title: callTitle(args, theme), meta: callMeta(args) }, theme),
+		formatErrorDetail(text, theme),
+	];
+}
+
 /**
  * Display-only transcript card for live IRC traffic: `irc:incoming` DMs
  * delivered to this session, `irc:autoreply` side-channel replies sent on
@@ -743,9 +755,11 @@ function buildResultLines(
 		case "wait":
 			return renderWaitResult(result, details, args, expanded, theme);
 		case "inbox":
-			return renderInboxResult(details, args, expanded, theme);
+			return result.isError
+				? renderErrorResult(result, args, theme)
+				: renderInboxResult(details, args, expanded, theme);
 		case "list":
-			return renderListResult(details, expanded, theme);
+			return result.isError ? renderErrorResult(result, args, theme) : renderListResult(details, expanded, theme);
 		default: {
 			const text = textContent(result) || (result.isError ? "IRC call failed." : "Done.");
 			return [

package/src/utils/shell-snapshot-fn-env.sh

@@ -0,0 +1,60 @@
+# Helpers inlined into `generateSnapshotScript` (shell-snapshot.ts).
+#
+# Activation idioms like `mise activate` install a shell function whose body
+# expands a sidecar env var (e.g. `mise() { command "$__MISE_EXE" "$@"; }`).
+# The function survives `declare -f`/`typeset -f` capture, but the helper var
+# is set on the rc-sourced shell and lost when only PATH gets re-exported.
+# The replay shell then calls `command "" …` and dies with
+# `command: command not found:` (issue #3470).
+#
+# `__omp_emit_referenced_exports` reads captured function bodies from stdin,
+# extracts every `$VAR` / `${VAR…}` reference, and emits a single
+# `export VAR='value'` line to stdout for each referenced var that
+# (a) is currently set in this shell and (b) is not a shell-internal name.
+# The script bodies are scanned, not interpreted — over-inclusion (refs inside
+# comments / heredocs) is harmless because we only emit names that are set.
+#
+# Pure POSIX so the same helper works under bash and zsh.
+
+# Wrap $1 in single quotes, escaping every embedded `'` as `'\''`.
+__omp_sq_quote() {
+	__omp_qbuf=$1
+	__omp_qout=
+	__omp_sq=\'
+	while case "$__omp_qbuf" in *$__omp_sq*) true ;; *) false ;; esac; do
+		__omp_qout=$__omp_qout${__omp_qbuf%%$__omp_sq*}"'\\''"
+		__omp_qbuf=${__omp_qbuf#*$__omp_sq}
+	done
+	__omp_qout=$__omp_qout$__omp_qbuf
+	printf "'%s'" "$__omp_qout"
+}
+
+# Emit `export NAME='value'` for $1 unless the name is a shell-internal we
+# must never overwrite, a likely secret (token / key / password / credential
+# patterns — kept conservative, since `__MISE_EXE` and `FOO_DIR` style helper
+# vars never carry secrets), or the var is unset. POSIX `case` patterns are
+# byte-exact so we list common uppercase variants; lowercase secret vars are
+# rare and out of scope.
+__omp_emit_export_for() {
+	case "$1" in
+		_|PATH|HOME|USER|LOGNAME|PWD|OLDPWD|SHELL|SHLVL|TERM|TERMINFO|TERMCAP|IFS|TMPDIR|TMOUT|LANG|RANDOM|LINENO|SECONDS|FUNCNAME|HISTFILE|HISTSIZE|HISTFILESIZE|HISTCMD|PS1|PS2|PS3|PS4|UID|EUID|GROUPS|HOSTNAME|HOSTTYPE|OSTYPE|MACHTYPE|PIPESTATUS|BASH|ZSH|argv|PROMPT|RPROMPT|RPS1|RPS2|status|pipestatus|COLUMNS|LINES|COLORTERM|FUNCNEST) return ;;
+		LC_*|BASH_*|ZSH_*) return ;;
+		# Common secret-name patterns — never materialise these into the
+		# snapshot file even though it's now created 0600 (defence in depth
+		# against the file ending up in a backup, tarball, or NFS share).
+		*TOKEN*|*SECRET*|*PASSWORD*|*PASSWD*|*API_KEY*|*PRIVATE_KEY*|*ACCESS_KEY*|*CREDENTIAL*|*SESSION_KEY*) return ;;
+	esac
+	eval "[ \"\${$1+x}\" = x ]" 2>/dev/null || return
+	eval "__omp_xv=\"\${$1}\"" 2>/dev/null || return
+	printf 'export %s=%s\n' "$1" "$(__omp_sq_quote "$__omp_xv")"
+}
+
+# Read function bodies on stdin, emit dedup'd export lines on stdout.
+__omp_emit_referenced_exports() {
+	grep -oE '\$\{?[A-Za-z_][A-Za-z0-9_]*' \
+		| sed -E 's/^\$\{?//' \
+		| sort -u \
+		| while IFS= read -r __omp_name; do
+			__omp_emit_export_for "$__omp_name"
+		done
+}

package/src/utils/shell-snapshot.ts

@@ -9,6 +9,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { logger, postmortem } from "@oh-my-pi/pi-utils";
+import fnEnvHelper from "./shell-snapshot-fn-env.sh" with { type: "text" };
 
 const cachedSnapshotPaths = new Map<string, string>();
 const SNAPSHOT_TIMEOUT_MS = 2_000;
@@ -83,9 +84,13 @@ function sanitizeSnapshotEnv(env: Record<string, string | undefined>): Record<st
 
 /**
  * Get the user's shell config file path.
+ *
+ * Honours `env.HOME` when present so a caller can target a sandboxed/test
+ * home, falling back to `os.homedir()` (which Bun resolves once at startup
+ * and caches — `process.env.HOME` overrides don't affect it).
  */
-function getShellConfigFile(shell: string): string {
-	const home = os.homedir();
+function getShellConfigFile(shell: string, env: Record<string, string | undefined>): string {
+	const home = env.HOME || os.homedir();
 	if (shell.includes("zsh")) return path.join(home, ".zshrc");
 	if (shell.includes("bash")) return path.join(home, ".bashrc");
 	return path.join(home, ".profile");
@@ -105,26 +110,22 @@ function generateSnapshotScript(shell: string, snapshotPath: string, rcFile: str
 	// Escape the snapshot path for shell
 	const escapedPath = snapshotPath.replace(/'/g, "'\\''");
 
-	// Function extraction differs between bash and zsh
-	const functionScript = isZsh
-		? `
-echo "# Functions" >> "$SNAPSHOT_FILE"
-# Force autoload all functions first
+	// Function extraction differs between bash and zsh. Each form prints function
+	// bodies on stdout so we can both persist them AND scan their bodies for
+	// referenced env vars (issue #3470).
+	const functionExtractor = isZsh
+		? `# Force autoload all functions first
 typeset -f > /dev/null 2>&1
 # Get user function names - filter system/private ones
 typeset +f 2>/dev/null | grep -vE '^(_|__)' | grep -vE '${commonToolsRegex}' | while read func; do
-   typeset -f "$func" >> "$SNAPSHOT_FILE" 2>/dev/null
-done
-`
-		: `
-echo "# Functions" >> "$SNAPSHOT_FILE"
-# Force autoload all functions first
+   typeset -f "$func" 2>/dev/null
+done`
+		: `# Force autoload all functions first
 declare -f > /dev/null 2>&1
 # Get user function names - filter system/private ones
 declare -F 2>/dev/null | cut -d' ' -f3 | grep -vE '^(_|__)' | grep -vE '${commonToolsRegex}' | while read func; do
-   declare -f "$func" >> "$SNAPSHOT_FILE" 2>/dev/null
-done
-`;
+   declare -f "$func" 2>/dev/null
+done`;
 
 	// Shell options extraction
 	const optionsScript = isZsh
@@ -142,16 +143,45 @@ echo "shopt -s expand_aliases" >> "$SNAPSHOT_FILE"
 	return `
 SNAPSHOT_FILE='${escapedPath}'
 
+# Snapshot may inline env-var values referenced by captured functions (#3470).
+# Defence in depth: (a) JS caller pre-creates the file at 0600 so the shell's
+# \`>|\`/\`>>\` redirections truncate/append without changing the inode mode,
+# (b) we \`umask 077\` before AND after sourcing the rc so any other file the
+# script creates is private even when the rc resets umask to 022, (c) JS
+# caller chmods file + dir after the script exits.
+umask 077
+
 # Source user's rc file if it exists
 ${hasRcFile ? `source "${rcFile}" < /dev/null 2>/dev/null` : "# No user config file to source"}
 
+# Re-tighten umask in case the rc reset it (common \`.bashrc\`/\`.zshrc\` set
+# \`umask 022\` for the interactive shell).
+umask 077
+
 # Create/clear the snapshot file
 echo "# Shell snapshot - generated by omp agent" >| "$SNAPSHOT_FILE"
 
 # Unalias everything first to avoid conflicts when sourced
 echo "unalias -a 2>/dev/null || true" >> "$SNAPSHOT_FILE"
 
-${functionScript}
+# Capture function definitions into a variable so we can both persist them
+# and scan their bodies for env-var references (issue #3470).
+__omp_funcs=$(
+${functionExtractor}
+)
+echo "# Functions" >> "$SNAPSHOT_FILE"
+printf '%s\\n' "$__omp_funcs" >> "$SNAPSHOT_FILE"
+
+# Re-export uppercase identifiers referenced by snapshotted functions whose
+# value is set in the rc-sourced shell. Without this, activation idioms like
+# mise's \`mise()\` -> \`command "$__MISE_EXE" "$@"\` blow up because the helper
+# var is lost (issue #3470). Helper definitions are POSIX-shell so the same
+# block works for both bash and zsh.
+echo "# Captured function environment" >> "$SNAPSHOT_FILE"
+${fnEnvHelper}
+printf '%s\\n' "$__omp_funcs" | __omp_emit_referenced_exports >> "$SNAPSHOT_FILE"
+unset -f __omp_sq_quote __omp_emit_export_for __omp_emit_referenced_exports 2>/dev/null
+unset __omp_funcs __omp_qbuf __omp_qout __omp_sq __omp_xv __omp_name 2>/dev/null
 
 ${optionsScript}
 
@@ -198,16 +228,35 @@ export async function getOrCreateSnapshot(
 		return null;
 	}
 
-	const rcFile = getShellConfigFile(shell);
+	const rcFile = getShellConfigFile(shell, env);
 
-	// Create snapshot directory
+	// Create snapshot directory with owner-only perms — the script may inline
+	// env vars referenced by captured functions (#3470) and `os.tmpdir()` is
+	// shared on Linux. `mode: 0o700` applies to a fresh mkdir; an existing dir
+	// keeps its mode, so chmod it defensively. Ignore EPERM (dir owned by
+	// another user on a shared box).
 	const snapshotDir = path.join(os.tmpdir(), "omp-shell-snapshots");
-	fs.mkdirSync(snapshotDir, { recursive: true });
+	fs.mkdirSync(snapshotDir, { recursive: true, mode: 0o700 });
+	try {
+		fs.chmodSync(snapshotDir, 0o700);
+	} catch {
+		// best-effort
+	}
 
 	// Generate unique snapshot path
 	const shellName = shell.includes("zsh") ? "zsh" : shell.includes("bash") ? "bash" : "sh";
 	const snapshotPath = path.join(snapshotDir, `snapshot-${shellName}-${crypto.randomUUID()}.sh`);
 
+	// Pre-create the snapshot file at 0600 so the shell's `>|` (truncate) and
+	// `>>` (append) redirections inside `generateSnapshotScript` operate on an
+	// existing inode and preserve the private mode, regardless of the umask
+	// state inside the spawned shell. Without this, a `.bashrc` that sets
+	// `umask 022` (the typical interactive default) before the script's first
+	// redirection would create the file world-readable; the JS-side post-spawn
+	// chmod would tighten it, but only after the shell finished writing every
+	// captured env value to disk.
+	fs.writeFileSync(snapshotPath, "", { mode: 0o600 });
+
 	// Generate and execute snapshot script
 	const script = generateSnapshotScript(shell, snapshotPath, rcFile);
 
@@ -230,6 +279,14 @@ export async function getOrCreateSnapshot(
 
 		await child.exited;
 		if (child.exitCode === 0 && fs.existsSync(snapshotPath)) {
+			// Defence-in-depth: the script's `umask 077` already locks the file at
+			// first write, but chmod again in case the umask didn't take (exotic
+			// shells) or a postmortem-restored file ended up looser.
+			try {
+				fs.chmodSync(snapshotPath, 0o600);
+			} catch {
+				// best-effort
+			}
 			scrubSnapshotInPlace(snapshotPath);
 			cachedSnapshotPaths.set(cacheKey, snapshotPath);
 			return snapshotPath;