@oh-my-pi/pi-coding-agent 17.1.2 → 17.1.4

package/src/modes/utils/context-usage.ts

@@ -56,6 +56,22 @@ const EMPTY_STRING_PARTS: string[] = [];
 const EMPTY_TOOLS: ReadonlyArray<Pick<Tool, "name" | "description" | "parameters">> = [];
 const EMPTY_SKILLS: readonly Skill[] = [];
 
+/**
+ * Skills actually rendered into the system prompt, mirroring the filter in
+ * `buildSystemPrompt` (`system-prompt.ts`): the `read` tool must be present so
+ * the model can fetch skill content, and skills with frontmatter `hide: true`
+ * (or `disable-model-invocation`, normalized onto `hide`) are excluded.
+ * Accounting must count only these so the Skills category and the System-prompt
+ * subtraction stay aligned with the provider-facing prompt.
+ */
+function renderedSkills(
+	skills: readonly Skill[],
+	tools: ReadonlyArray<Pick<Tool, "name" | "description" | "parameters">>,
+): readonly Skill[] {
+	if (!tools.some(tool => tool.name === "read")) return EMPTY_SKILLS;
+	return skills.filter(skill => skill.hide !== true);
+}
+
 export function estimateSkillsTokens(skills: readonly Skill[]): number {
 	const fragments: string[] = [];
 	for (const skill of skills) {
@@ -171,8 +187,9 @@ export function computeNonMessageBreakdown(session: NonMessageTokenSource): {
 } {
 	const entry = nonMessageTokenCacheEntry(session);
 	if (entry.breakdown) return entry.breakdown;
-	const skillsTokens = estimateSkillsTokens(session.skills ?? EMPTY_SKILLS);
-	const toolsTokens = estimateToolSchemaTokens(session.agent?.state?.tools ?? EMPTY_TOOLS);
+	const tools = session.agent?.state?.tools ?? EMPTY_TOOLS;
+	const skillsTokens = estimateSkillsTokens(renderedSkills(session.skills ?? EMPTY_SKILLS, tools));
+	const toolsTokens = estimateToolSchemaTokens(tools);
 	const systemPromptParts = session.systemPrompt ?? EMPTY_STRING_PARTS;
 	const systemContextTokens = countTokens(systemPromptParts.slice(1));
 	const systemPromptTokens = Math.max(0, countTokens(systemPromptParts[0] ?? "") - skillsTokens);

package/src/modes/utils/interactive-context-helpers.ts

@@ -25,5 +25,6 @@ export function createAssistantMessageComponent(
 		ctx.proseOnlyThinking,
 	);
 	component.setImagesVisible(ctx.settings.get("terminal.showImages"));
+	component.setExpanded(ctx.toolOutputExpanded);
 	return component;
 }

package/src/plan-mode/approved-plan.ts

@@ -1,3 +1,4 @@
+import { normalizeLocalScheme } from "../tools/path-utils";
 import { ToolError } from "../tools/tool-errors";
 
 /** Shape forwarded from the plan-proposal handler to InteractiveMode's
@@ -149,8 +150,9 @@ export interface ResolvedApprovedPlan {
 
 /** Locate the plan file the agent wrote and finalize its title — without
  *  renaming anything. Tries, in order: the slug derived from `extra.title`
- *  (`local://<slug>-plan.md`), the plan path from plan-mode state, then a scan
- *  of recent plan files. Throws a `ToolError` guiding the agent when none exist. */
+ *  (`local://<slug>-plan.md`), a state plan that the artifact scan can't see,
+ *  scanned plan files newest-to-oldest, then the state plan path as a final
+ *  fallback. Throws a `ToolError` guiding the agent when none exist. */
 export async function resolveApprovedPlan(input: ResolveApprovedPlanInput): Promise<ResolvedApprovedPlan> {
 	const ordered: string[] = [];
 	const consider = (url: string | undefined): void => {
@@ -159,6 +161,20 @@ export async function resolveApprovedPlan(input: ResolveApprovedPlanInput): Prom
 
 	const slug = planSlugFromSupplied(input.suppliedTitle);
 	consider(slug ? planFileUrlForSlug(slug) : undefined);
+
+	const listed = input.listPlanFiles ? await input.listPlanFiles() : [];
+	// A state plan the scan cannot surface (cwd-relative, or a local file whose
+	// name does not end in `plan.md`) has no mtime in `listed` to compete on, so
+	// it keeps precedence over scanned artifacts — otherwise a stale older draft
+	// could shadow the deliberately-set current plan. A state plan already inside
+	// the scan competes purely on the newest-first ordering below (issue #6569).
+	// Compare canonical `local://` spellings so a resumed `local:/…` state path
+	// still matches the scanner's `local://…` entry (normalizeLocalScheme).
+	const canonicalListed = new Set(listed.map(normalizeLocalScheme));
+	if (input.statePlanFilePath && !canonicalListed.has(normalizeLocalScheme(input.statePlanFilePath))) {
+		consider(input.statePlanFilePath);
+	}
+	for (const url of listed) consider(url);
 	consider(input.statePlanFilePath);
 
 	for (const url of ordered) {
@@ -166,14 +182,6 @@ export async function resolveApprovedPlan(input: ResolveApprovedPlanInput): Prom
 		if (content !== null) return finalizeApprovedPlan(url, content, input.suppliedTitle);
 	}
 
-	if (input.listPlanFiles) {
-		for (const url of await input.listPlanFiles()) {
-			if (ordered.includes(url)) continue;
-			const content = await input.readPlan(url);
-			if (content !== null) return finalizeApprovedPlan(url, content, input.suppliedTitle);
-		}
-	}
-
 	const target = ordered[0] ?? input.statePlanFilePath;
 	throw new ToolError(
 		`Plan file not found at ${target}. Write the finalized plan to ${target} before requesting approval.`,

package/src/prompts/system/custom-system-prompt.md

@@ -59,6 +59,6 @@ Rules are local constraints. You MUST read `rule://<name>` when working in that
 {{/if}}
 {{#if secretsEnabled}}
 <redacted-content>
-Some values in tool output are redacted for security. They appear as placeholder tokens such as `#HASH#`, `#HASH:CASE#`, or `#NAME_HASH:CASE#` (uppercase-alphanumeric digest, optional case hint, optional friendly-name prefix). These are **not errors** — they are intentional placeholders for sensitive values (API keys, passwords, tokens). Treat them as opaque strings. NEVER attempt to decode, fix, or report them as problems.
+Some values in tool output are redacted for security. They appear as placeholder tokens such as `$$HASH$$`, `$$HASH:CASE$$`, or `$$NAME_HASH:CASE$$` (uppercase-alphanumeric digest, optional case hint, optional friendly-name prefix). These are **not errors** — they are intentional placeholders for sensitive values (API keys, passwords, tokens). Treat them as opaque strings. NEVER attempt to decode, fix, or report them as problems.
 </redacted-content>
 {{/if}}

package/src/prompts/system/system-prompt.md

@@ -79,6 +79,15 @@ Special URLs for internal resources; with most FS/bash tools they auto-resolve t
 {{/if}}
 {{/if}}
 
+{{#has tools "computer"}}
+# Computer Use
+The `{{toolRefs.computer}}` tool is explicitly enabled and available in this session.
+- MUST use `{{toolRefs.computer}}` for requests to view or control host desktop applications.
+- NEVER claim Computer Use is unavailable while `{{toolRefs.computer}}` appears in the tool inventory.
+- While fulfilling host-desktop requests, NEVER substitute Browser, Bash, Eval, AppleScript, accessibility commands, or `screencapture` unless the user explicitly requests that mechanism or `{{toolRefs.computer}}` returns an error.
+- Inspect the fresh screenshot returned by every successful `{{toolRefs.computer}}` call before choosing the next action.
+{{/has}}
+
 {{#if xdevTools.length}}
 # xd:// Tool Devices
 Additional tools are mounted as virtual devices, executed by writing a JSON args object as `content` to `xd://<tool>` via `{{toolRefs.write}}`.
@@ -101,7 +110,7 @@ Use tools whenever they improve correctness, completeness, or grounding.
 # Tool I/O
 - Prefer relative paths for `path`-like fields.
 {{#if intentTracing}}- Most tools take `{{intentField}}`: a concise intent, present participle, 2–6 words, no period, capitalized.{{/if}}
-{{#if secretsEnabled}}- Redacted `#HASH#`, `#HASH:CASE#`, or `#NAME_HASH:CASE#` tokens in output are opaque strings.{{/if}}
+{{#if secretsEnabled}}- Redacted `$$HASH$$`, `$$HASH:CASE$$`, or `$$NAME_HASH:CASE$$` tokens in output are opaque strings.{{/if}}
 {{#has tools "inspect_image"}}- Image tasks: prefer `{{toolRefs.inspect_image}}` over `{{toolRefs.read}}` to spare session context.{{/has}}
 
 # Specialized Tools

package/src/prompts/tools/ast-edit.md

@@ -1,4 +1,4 @@
-Structural AST-aware rewrites via ast-grep. Use for codemods where text replace is unsafe. Narrow each call to one language.
+Structural AST-aware rewrites via ast-grep. Use for codemods where text replace is unsafe. Mixed-language paths are fine: each file is parsed in its own language, and a pattern only rewrites files it parses in.
 
 - Metavariables in `pat` (`$A`, `$$$ARGS`) substitute into `out`.
 - **Patterns match AST structure, not text.** `$NAME` = one node; `$_` = unbound; `$$$NAME` = zero-or-more.

package/src/sdk.ts

@@ -201,6 +201,7 @@ import { getImageGenTools } from "./tools/image-gen";
 import { wrapToolWithMetaNotice } from "./tools/output-meta";
 import { isAutoQaEnabled } from "./tools/report-tool-issue";
 import { queueResolveHandler } from "./tools/resolve";
+import { USER_TODO_EDIT_CUSTOM_TYPE } from "./tools/todo";
 import { ttsTool } from "./tools/tts";
 import { resolveActiveRepoContext } from "./utils/active-repo-context";
 import { EventBus } from "./utils/event-bus";
@@ -2609,6 +2610,9 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			getTool: resolveDeviceTool,
 			getToolContext: () => toolContextStore.getContext(),
 			emitEvent: event => cursorEventEmitter?.(event),
+			getTodoPhases: () => session.getTodoPhases(),
+			setTodoPhases: phases => session.setTodoPhases(phases),
+			persistTodoPhases: phases => sessionManager.appendCustomEntry(USER_TODO_EDIT_CUSTOM_TYPE, { phases }),
 		});
 
 		// Resolve the inline-descriptors setting against the session-start model.

package/src/secrets/obfuscator.ts

@@ -243,11 +243,6 @@ const HASH_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
 // base. A collision would let a persisted placeholder deobfuscate to the wrong
 // secret when the configured secret set or its ordering changes across sessions.
 const HASH_LEN = 12;
-// Pre-friendly-name sessions persisted a 4-char, index-derived token; reproduce
-// that exact legacy format so old session text still deobfuscates. The legacy
-// token is keyed on the entry index, not the secret value, so it leaks nothing.
-const LEGACY_HASH_LEN = 4;
-const LEGACY_HASH_SEED = 0x5345_4352;
 const MAX_FRIENDLY_NAME_LEN = 32;
 // Plain/regex obfuscate matches shorter than this are toned down (never placed
 // behind a reversible placeholder) to avoid redacting small words/fragments.
@@ -458,17 +453,6 @@ function buildKeyedReplacementRun(key: string, length: number): string {
 	return out;
 }
 
-/** Build the pre-friendly-name index-derived placeholder for session resume compatibility. */
-function buildLegacyPlaceholder(index: number): string {
-	let v = Bun.hash.xxHash32(String(index), LEGACY_HASH_SEED);
-	let tag = "#";
-	for (let i = 0; i < LEGACY_HASH_LEN; i++) {
-		tag += HASH_CHARS[v % HASH_CHARS.length];
-		v = Math.floor(v / HASH_CHARS.length);
-	}
-	return `${tag}#`;
-}
-
 function inferCaseHint(secret: string): PlaceholderCaseHint | undefined {
 	let hasCased = false;
 	let hasUpper = false;
@@ -502,21 +486,21 @@ function inferCaseHint(secret: string): PlaceholderCaseHint | undefined {
 
 function buildPlaceholder(hint: PlaceholderCaseHint | undefined, base: string, friendlyName?: string): string {
 	const prefix = friendlyName ? `${friendlyName}_` : "";
-	return hint ? `#${prefix}${base}:${hint}#` : `#${prefix}${base}#`;
+	return hint ? `$$${prefix}${base}:${hint}$$` : `$$${prefix}${base}$$`;
 }
 
-/** Regex to match #HASH#, #HASH:U#, and #FRIENDLY_HASH(:hint)# placeholders. */
-const PLACEHOLDER_RE = /#(?:[A-Z0-9]+_)?[A-Z0-9]{4,}(?::[ULCM])?#/g;
+/** Regex matching `$$HASH$$`, `$$HASH:U$$`, and `$$FRIENDLY_HASH(:hint)$$` placeholders. */
+const PLACEHOLDER_RE = /\$\$(?:[A-Z0-9]+_)?[A-Z0-9]{4,}(?::[ULCM])?\$\$/g;
 
 function resumePlaceholderScanAfterRejectedCandidate(match: RegExpExecArray): void {
 	// RegExp#exec does not find overlapping matches. Restart at the rejected
-	// candidate's closing `#`, which can open an immediately adjacent placeholder.
-	PLACEHOLDER_RE.lastIndex = match.index + match[0].length - 1;
+	// candidate's closing delimiter, which can open an immediately adjacent placeholder.
+	PLACEHOLDER_RE.lastIndex = match.index + match[0].length - 2;
 }
 
 function placeholderWithoutFriendlyName(placeholder: string): string | undefined {
-	const match = /^#[A-Z0-9]+_([A-Z0-9]{4,}(?::[ULCM])?)#$/.exec(placeholder);
-	return match ? `#${match[1]}#` : undefined;
+	const match = /^\$\$[A-Z0-9]+_([A-Z0-9]{4,}(?::[ULCM])?)\$\$$/.exec(placeholder);
+	return match ? `$$${match[1]}$$` : undefined;
 }
 
 function lookupFriendlyPlaceholderAlias(
@@ -529,14 +513,12 @@ function lookupFriendlyPlaceholderAlias(
 	return unprefixed !== undefined ? deobfuscateMap.get(unprefixed) : undefined;
 }
 
-const PENDING_PLACEHOLDER_SUFFIX_RE = /#(?:[A-Z0-9]+_)?[A-Z0-9]*(?::[ULCM]?)?$/;
+const PENDING_PLACEHOLDER_SUFFIX_RE = /(?:\$\$(?:[A-Z0-9]+_)?[A-Z0-9]*(?::[ULCM]?)?|\$)$/;
 
 // Withhold a trailing run that could be the start of a placeholder from streamed
 // deltas, so a partial token is never emitted before deobfuscation can replace
-// it. A lone trailing `#` is always buffered, even right after an alnum/`:`
-// (e.g. `ID#`), because that `#` can open a placeholder; emitting it would
-// corrupt the length-sliced live draft once the token completes. The final
-// non-streamed flush re-emits any buffered tail, so nothing is lost.
+// it. A lone trailing delimiter character is always buffered because it can open
+// a placeholder; the final non-streamed flush re-emits it when no token follows.
 export function stripPendingSecretPlaceholderSuffix(text: string): string {
 	const pendingPlaceholderStart = text.match(PENDING_PLACEHOLDER_SUFFIX_RE);
 	if (pendingPlaceholderStart?.index === undefined) return text;
@@ -582,13 +564,6 @@ export class SecretObfuscator {
 	 *  one without the key. */
 	#deobfuscateMap = new Map<string, { secret: string; recursive: boolean }>();
 
-	/** Legacy index-derived aliases (unkeyed `#XRRS#`), honored ONLY when replaying
-	 *  stored session content. They are deterministic and trivially guessable, so
-	 *  accepting them on live provider/tool-call paths would let a prompt-injected
-	 *  model synthesize one to exfiltrate a secret; they exist solely so sessions
-	 *  persisted before keyed placeholders still deobfuscate on resume/display. */
-	#legacyDeobfuscateMap = new Map<string, { secret: string; recursive: boolean }>();
-
 	/** Exact placeholder tokens generated by this obfuscator revision (no aliases). */
 	#generatedPlaceholders = new Set<string>();
 
@@ -669,7 +644,6 @@ export class SecretObfuscator {
 			}
 		}
 		let index = 0;
-		let legacyIndex = 0;
 		let hasRealSec = this.#regexEntries.length > 0;
 		for (const entry of entries) {
 			if (entry.type !== "plain") continue;
@@ -680,11 +654,6 @@ export class SecretObfuscator {
 					continue;
 				}
 				const placeholder = this.#createPlaceholder(entry.content, entry.friendlyName);
-				this.#legacyDeobfuscateMap.set(buildLegacyPlaceholder(legacyIndex), {
-					secret: entry.content,
-					recursive: false,
-				});
-				legacyIndex++;
 				this.#plainMappings.set(entry.content, index);
 				this.#obfuscateMappings.set(index, { secret: entry.content, placeholder });
 				this.#generatedPlaceholders.add(placeholder);
@@ -706,11 +675,6 @@ export class SecretObfuscator {
 		return this.#hasAny;
 	}
 
-	/** Whether stored-session restoration can resolve keyed or legacy placeholders. */
-	hasStoredSecrets(): boolean {
-		return this.#hasAny || this.#legacyDeobfuscateMap.size > 0;
-	}
-
 	/** Obfuscate all secrets in text. Bidirectional placeholders for obfuscate mode, one-way for replace. */
 	obfuscate(text: string, sharedRegexSecretValues?: ReadonlySet<string>): string {
 		if (!this.#hasAny) return text;
@@ -904,24 +868,9 @@ export class SecretObfuscator {
 		return result;
 	}
 
-	/**
-	 * Deobfuscate keyed placeholders back to original secrets for LIVE paths
-	 * (provider output, tool-call arguments). Replace-mode is NOT reversed, and
-	 * legacy index-derived aliases are intentionally ignored so a prompt-injected
-	 * model cannot synthesize one to recover a secret.
-	 */
+	/** Deobfuscate keyed placeholders for provider output, tool-call arguments, replay, and display. */
 	deobfuscate(text: string): string {
-		return this.#deobfuscate(text, false);
-	}
-
-	/**
-	 * Deobfuscate stored session content for replay/display. Identical to
-	 * {@link deobfuscate} but additionally honors legacy index-derived aliases so
-	 * sessions persisted before keyed placeholders still resume correctly. Use
-	 * only for trusted on-disk session content, never for live model output.
-	 */
-	deobfuscateStored(text: string): string {
-		return this.#deobfuscate(text, true);
+		return this.#deobfuscate(text);
 	}
 
 	// Reverse-direction counterpart to `#isGeneratedPlaceholder`'s guard: the
@@ -929,7 +878,7 @@ export class SecretObfuscator {
 	// placeholder minted under a renamed friendly name still deobfuscates
 	// (see `#prefixIsSecretShaped`'s docstring for why), but unconditionally
 	// stripping and ignoring an attacker-authored prefix would let a forged
-	// token like `#GITHUBPATABC123_<suffix-copied-from-any-real-placeholder>#`
+	// token like `$$GITHUBPATABC123_<suffix-copied-from-any-real-placeholder>$$`
 	// restore to that OTHER secret's raw value with no check at all — worse
 	// than the obfuscate-direction leak, since deobfuscation is what feeds
 	// tool-call arguments and provider-output restoration. Refuse the
@@ -939,14 +888,14 @@ export class SecretObfuscator {
 	#lookupLiveAlias(placeholder: string): { secret: string; recursive: boolean } | undefined {
 		const direct = this.#deobfuscateMap.get(placeholder);
 		if (direct !== undefined) return direct;
-		const match = /^#([A-Z0-9]+)_([A-Z0-9]{4,}(?::[ULCM])?)#$/.exec(placeholder);
+		const body = placeholder.slice(2, -2);
+		const match = /^([A-Z0-9]+)_([A-Z0-9]{4,}(?::[ULCM])?)$/.exec(body);
 		if (match === null || this.#prefixIsSecretShaped(match[1]!)) return undefined;
-		return this.#deobfuscateMap.get(`#${match[2]}#`);
+		return this.#deobfuscateMap.get(`$$${match[2]}$$`);
 	}
 
-	#deobfuscate(text: string, allowLegacy: boolean): string {
-		if ((!this.#hasAny && (!allowLegacy || this.#legacyDeobfuscateMap.size === 0)) || !text.includes("#"))
-			return text;
+	#deobfuscate(text: string): string {
+		if (!this.#hasAny || !text.includes("$$")) return text;
 		let result = text;
 		for (;;) {
 			let shouldContinue = false;
@@ -956,16 +905,9 @@ export class SecretObfuscator {
 					shouldContinue ||= mapped.recursive;
 					return mapped.secret;
 				}
-				if (allowLegacy) {
-					const legacy = this.#legacyDeobfuscateMap.get(match);
-					if (legacy !== undefined) {
-						shouldContinue ||= legacy.recursive;
-						return legacy.secret;
-					}
-				}
 				return match;
 			});
-			if (next === result || !shouldContinue || !next.includes("#")) return next;
+			if (next === result || !shouldContinue || !next.includes("$$")) return next;
 			result = next;
 		}
 	}
@@ -976,12 +918,6 @@ export class SecretObfuscator {
 		return deepWalkStrings(obj, s => this.deobfuscate(s));
 	}
 
-	/** Deep-walk stored session content, deobfuscating string values incl. legacy aliases. */
-	deobfuscateStoredObject<T>(obj: T): T {
-		if (!this.hasStoredSecrets()) return obj;
-		return deepWalkStrings(obj, s => this.deobfuscateStored(s));
-	}
-
 	/** Deep-walk an object, obfuscating all string values. */
 	obfuscateObject<T>(obj: T): T {
 		if (!this.#hasAny) return obj;
@@ -1390,7 +1326,7 @@ export class SecretObfuscator {
 	#placeholderForCurrentInput(placeholder: string): string {
 		const unprefixed = placeholderWithoutFriendlyName(placeholder);
 		if (unprefixed === undefined) return placeholder;
-		const match = /^#([A-Z0-9]+)_/.exec(placeholder);
+		const match = /^([A-Z0-9]+)_/.exec(placeholder.slice(2, -2));
 		if (match === null || !this.#prefixIsSecretShaped(match[1]!)) return placeholder;
 		return unprefixed;
 	}
@@ -1492,10 +1428,10 @@ export class SecretObfuscator {
 	// deobfuscate-direction check in `#deobfuscate`.
 	#isGeneratedPlaceholder(placeholder: string): boolean {
 		if (this.#deobfuscateMap.has(placeholder)) return true;
-		const match = /^#([A-Z0-9]+)_([A-Z0-9]{4,}(?::[ULCM])?)#$/.exec(placeholder);
+		const match = /^([A-Z0-9]+)_([A-Z0-9]{4,}(?::[ULCM])?)$/.exec(placeholder.slice(2, -2));
 		if (match === null) return false;
 		if (this.#prefixIsSecretShaped(match[1]!)) return false;
-		return this.#deobfuscateMap.has(`#${match[2]}#`);
+		return this.#deobfuscateMap.has(`$$${match[2]}$$`);
 	}
 
 	// Replace `search` with `replacement` outside known generated placeholders while
@@ -1865,40 +1801,25 @@ export class SecretObfuscator {
  * Restore secret placeholders for local display. Only message kinds the model
  * itself authored from obfuscated context carry placeholders — assistant
  * content and the LLM-written branch/compaction summaries. User, developer, and
- * tool-result messages are persisted with their literal text, so a literal
- * `#ABCD#` the operator typed must survive untouched; those roles are never
- * walked.
- *
- * Legacy index-derived aliases (`#XXXX#`) are unkeyed and trivially guessable,
- * so a prompt-injected model can plant one in any record it influences. Every
- * agent-feeding path (resume, history rewrite, branch switch) therefore restores
- * keyed placeholders ONLY (`allowLegacyAliases` false), leaving legacy tokens
- * inert; display-only transcripts that are never re-obfuscated opt in via
- * `allowLegacyAliases`.
+ * tool-result messages are persisted with their literal text, so operator-authored
+ * placeholder-shaped text must survive untouched; those roles are never walked.
  */
 export function deobfuscateSessionContext(
 	sessionContext: SessionContext,
 	obfuscator: SecretObfuscator | undefined,
-	allowLegacyAliases = false,
 ): SessionContext {
-	if (!obfuscator || !(allowLegacyAliases ? obfuscator.hasStoredSecrets() : obfuscator.hasSecrets()))
-		return sessionContext;
-	const messages = deobfuscateAgentMessages(obfuscator, sessionContext.messages, allowLegacyAliases);
+	if (!obfuscator?.hasSecrets()) return sessionContext;
+	const messages = deobfuscateAgentMessages(obfuscator, sessionContext.messages);
 	return messages === sessionContext.messages ? sessionContext : { ...sessionContext, messages };
 }
 
-export function deobfuscateAgentMessages(
-	obfuscator: SecretObfuscator,
-	messages: AgentMessage[],
-	allowLegacyAliases = false,
-): AgentMessage[] {
-	const deob = (text: string): string =>
-		allowLegacyAliases ? obfuscator.deobfuscateStored(text) : obfuscator.deobfuscate(text);
+export function deobfuscateAgentMessages(obfuscator: SecretObfuscator, messages: AgentMessage[]): AgentMessage[] {
+	const deob = (text: string): string => obfuscator.deobfuscate(text);
 	let changed = false;
 	const result = messages.map((message): AgentMessage => {
 		switch (message.role) {
 			case "assistant": {
-				const content = deobfuscateAssistantContent(obfuscator, message.content, allowLegacyAliases);
+				const content = deobfuscateAssistantContent(obfuscator, message.content);
 				if (content === message.content) return message;
 				changed = true;
 				return { ...message, content };
@@ -1912,10 +1833,7 @@ export function deobfuscateAgentMessages(
 			case "compactionSummary": {
 				const summary = deob(message.summary);
 				const shortSummary = message.shortSummary === undefined ? undefined : deob(message.shortSummary);
-				const blocks =
-					message.blocks === undefined
-						? undefined
-						: deobfuscateTextBlocks(obfuscator, message.blocks, allowLegacyAliases);
+				const blocks = message.blocks === undefined ? undefined : deobfuscateTextBlocks(obfuscator, message.blocks);
 				if (summary === message.summary && shortSummary === message.shortSummary && blocks === message.blocks) {
 					return message;
 				}
@@ -1937,11 +1855,9 @@ export function deobfuscateAgentMessages(
 export function deobfuscateAssistantContent(
 	obfuscator: SecretObfuscator,
 	content: AssistantMessage["content"],
-	allowLegacyAliases = false,
 ): AssistantMessage["content"] {
-	if (!(allowLegacyAliases ? obfuscator.hasStoredSecrets() : obfuscator.hasSecrets())) return content;
-	const deob = (text: string): string =>
-		allowLegacyAliases ? obfuscator.deobfuscateStored(text) : obfuscator.deobfuscate(text);
+	if (!obfuscator.hasSecrets()) return content;
+	const deob = (text: string): string => obfuscator.deobfuscate(text);
 	let changed = false;
 	const result = content.map((block): AssistantMessage["content"][number] => {
 		if (block.type === "text") {
@@ -1952,7 +1868,7 @@ export function deobfuscateAssistantContent(
 		}
 
 		if (block.type === "toolCall") {
-			const args = deobfuscateToolArguments(obfuscator, block.arguments, allowLegacyAliases);
+			const args = deobfuscateToolArguments(obfuscator, block.arguments);
 			const intent = block.intent === undefined ? undefined : deob(block.intent);
 			const rawBlock = block.rawBlock === undefined ? undefined : deob(block.rawBlock);
 			if (args === block.arguments && intent === block.intent && rawBlock === block.rawBlock) return block;
@@ -1972,12 +1888,9 @@ export function deobfuscateAssistantContent(
 export function deobfuscateToolArguments(
 	obfuscator: SecretObfuscator,
 	args: Record<string, unknown>,
-	allowLegacyAliases = false,
 ): Record<string, unknown> {
-	if (!(allowLegacyAliases ? obfuscator.hasStoredSecrets() : obfuscator.hasSecrets())) return args;
-	const deob = (text: string): string =>
-		allowLegacyAliases ? obfuscator.deobfuscateStored(text) : obfuscator.deobfuscate(text);
-	return mapJsonStrings(args as JsonValue, deob) as Record<string, unknown>;
+	if (!obfuscator.hasSecrets()) return args;
+	return mapJsonStrings(args as JsonValue, s => obfuscator.deobfuscate(s)) as Record<string, unknown>;
 }
 
 /** Redact secrets inside a tool call's arguments (same JSON-walk exception as {@link deobfuscateToolArguments}). */
@@ -2018,14 +1931,11 @@ function obfuscateTextBlocks(
 function deobfuscateTextBlocks(
 	obfuscator: SecretObfuscator,
 	content: (TextContent | ImageContent)[],
-	allowLegacyAliases = false,
 ): (TextContent | ImageContent)[] {
-	const deob = (text: string): string =>
-		allowLegacyAliases ? obfuscator.deobfuscateStored(text) : obfuscator.deobfuscate(text);
 	let changed = false;
 	const result = content.map((block): TextContent | ImageContent => {
 		if (block.type !== "text") return block;
-		const text = deob(block.text);
+		const text = obfuscator.deobfuscate(block.text);
 		if (text === block.text) return block;
 		changed = true;
 		return { ...block, text };