@oh-my-pi/pi-coding-agent 17.1.3 → 17.1.4

package/src/secrets/obfuscator.ts

@@ -243,11 +243,6 @@ const HASH_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
 // base. A collision would let a persisted placeholder deobfuscate to the wrong
 // secret when the configured secret set or its ordering changes across sessions.
 const HASH_LEN = 12;
-// Pre-friendly-name sessions persisted a 4-char, index-derived token; reproduce
-// that exact legacy format so old session text still deobfuscates. The legacy
-// token is keyed on the entry index, not the secret value, so it leaks nothing.
-const LEGACY_HASH_LEN = 4;
-const LEGACY_HASH_SEED = 0x5345_4352;
 const MAX_FRIENDLY_NAME_LEN = 32;
 // Plain/regex obfuscate matches shorter than this are toned down (never placed
 // behind a reversible placeholder) to avoid redacting small words/fragments.
@@ -458,17 +453,6 @@ function buildKeyedReplacementRun(key: string, length: number): string {
 	return out;
 }
 
-/** Build the pre-friendly-name index-derived placeholder for session resume compatibility. */
-function buildLegacyPlaceholder(index: number): string {
-	let v = Bun.hash.xxHash32(String(index), LEGACY_HASH_SEED);
-	let tag = "#";
-	for (let i = 0; i < LEGACY_HASH_LEN; i++) {
-		tag += HASH_CHARS[v % HASH_CHARS.length];
-		v = Math.floor(v / HASH_CHARS.length);
-	}
-	return `${tag}#`;
-}
-
 function inferCaseHint(secret: string): PlaceholderCaseHint | undefined {
 	let hasCased = false;
 	let hasUpper = false;
@@ -502,21 +486,21 @@ function inferCaseHint(secret: string): PlaceholderCaseHint | undefined {
 
 function buildPlaceholder(hint: PlaceholderCaseHint | undefined, base: string, friendlyName?: string): string {
 	const prefix = friendlyName ? `${friendlyName}_` : "";
-	return hint ? `#${prefix}${base}:${hint}#` : `#${prefix}${base}#`;
+	return hint ? `$$${prefix}${base}:${hint}$$` : `$$${prefix}${base}$$`;
 }
 
-/** Regex to match #HASH#, #HASH:U#, and #FRIENDLY_HASH(:hint)# placeholders. */
-const PLACEHOLDER_RE = /#(?:[A-Z0-9]+_)?[A-Z0-9]{4,}(?::[ULCM])?#/g;
+/** Regex matching `$$HASH$$`, `$$HASH:U$$`, and `$$FRIENDLY_HASH(:hint)$$` placeholders. */
+const PLACEHOLDER_RE = /\$\$(?:[A-Z0-9]+_)?[A-Z0-9]{4,}(?::[ULCM])?\$\$/g;
 
 function resumePlaceholderScanAfterRejectedCandidate(match: RegExpExecArray): void {
 	// RegExp#exec does not find overlapping matches. Restart at the rejected
-	// candidate's closing `#`, which can open an immediately adjacent placeholder.
-	PLACEHOLDER_RE.lastIndex = match.index + match[0].length - 1;
+	// candidate's closing delimiter, which can open an immediately adjacent placeholder.
+	PLACEHOLDER_RE.lastIndex = match.index + match[0].length - 2;
 }
 
 function placeholderWithoutFriendlyName(placeholder: string): string | undefined {
-	const match = /^#[A-Z0-9]+_([A-Z0-9]{4,}(?::[ULCM])?)#$/.exec(placeholder);
-	return match ? `#${match[1]}#` : undefined;
+	const match = /^\$\$[A-Z0-9]+_([A-Z0-9]{4,}(?::[ULCM])?)\$\$$/.exec(placeholder);
+	return match ? `$$${match[1]}$$` : undefined;
 }
 
 function lookupFriendlyPlaceholderAlias(
@@ -529,14 +513,12 @@ function lookupFriendlyPlaceholderAlias(
 	return unprefixed !== undefined ? deobfuscateMap.get(unprefixed) : undefined;
 }
 
-const PENDING_PLACEHOLDER_SUFFIX_RE = /#(?:[A-Z0-9]+_)?[A-Z0-9]*(?::[ULCM]?)?$/;
+const PENDING_PLACEHOLDER_SUFFIX_RE = /(?:\$\$(?:[A-Z0-9]+_)?[A-Z0-9]*(?::[ULCM]?)?|\$)$/;
 
 // Withhold a trailing run that could be the start of a placeholder from streamed
 // deltas, so a partial token is never emitted before deobfuscation can replace
-// it. A lone trailing `#` is always buffered, even right after an alnum/`:`
-// (e.g. `ID#`), because that `#` can open a placeholder; emitting it would
-// corrupt the length-sliced live draft once the token completes. The final
-// non-streamed flush re-emits any buffered tail, so nothing is lost.
+// it. A lone trailing delimiter character is always buffered because it can open
+// a placeholder; the final non-streamed flush re-emits it when no token follows.
 export function stripPendingSecretPlaceholderSuffix(text: string): string {
 	const pendingPlaceholderStart = text.match(PENDING_PLACEHOLDER_SUFFIX_RE);
 	if (pendingPlaceholderStart?.index === undefined) return text;
@@ -582,13 +564,6 @@ export class SecretObfuscator {
 	 *  one without the key. */
 	#deobfuscateMap = new Map<string, { secret: string; recursive: boolean }>();
 
-	/** Legacy index-derived aliases (unkeyed `#XRRS#`), honored ONLY when replaying
-	 *  stored session content. They are deterministic and trivially guessable, so
-	 *  accepting them on live provider/tool-call paths would let a prompt-injected
-	 *  model synthesize one to exfiltrate a secret; they exist solely so sessions
-	 *  persisted before keyed placeholders still deobfuscate on resume/display. */
-	#legacyDeobfuscateMap = new Map<string, { secret: string; recursive: boolean }>();
-
 	/** Exact placeholder tokens generated by this obfuscator revision (no aliases). */
 	#generatedPlaceholders = new Set<string>();
 
@@ -669,7 +644,6 @@ export class SecretObfuscator {
 			}
 		}
 		let index = 0;
-		let legacyIndex = 0;
 		let hasRealSec = this.#regexEntries.length > 0;
 		for (const entry of entries) {
 			if (entry.type !== "plain") continue;
@@ -680,11 +654,6 @@ export class SecretObfuscator {
 					continue;
 				}
 				const placeholder = this.#createPlaceholder(entry.content, entry.friendlyName);
-				this.#legacyDeobfuscateMap.set(buildLegacyPlaceholder(legacyIndex), {
-					secret: entry.content,
-					recursive: false,
-				});
-				legacyIndex++;
 				this.#plainMappings.set(entry.content, index);
 				this.#obfuscateMappings.set(index, { secret: entry.content, placeholder });
 				this.#generatedPlaceholders.add(placeholder);
@@ -706,11 +675,6 @@ export class SecretObfuscator {
 		return this.#hasAny;
 	}
 
-	/** Whether stored-session restoration can resolve keyed or legacy placeholders. */
-	hasStoredSecrets(): boolean {
-		return this.#hasAny || this.#legacyDeobfuscateMap.size > 0;
-	}
-
 	/** Obfuscate all secrets in text. Bidirectional placeholders for obfuscate mode, one-way for replace. */
 	obfuscate(text: string, sharedRegexSecretValues?: ReadonlySet<string>): string {
 		if (!this.#hasAny) return text;
@@ -904,24 +868,9 @@ export class SecretObfuscator {
 		return result;
 	}
 
-	/**
-	 * Deobfuscate keyed placeholders back to original secrets for LIVE paths
-	 * (provider output, tool-call arguments). Replace-mode is NOT reversed, and
-	 * legacy index-derived aliases are intentionally ignored so a prompt-injected
-	 * model cannot synthesize one to recover a secret.
-	 */
+	/** Deobfuscate keyed placeholders for provider output, tool-call arguments, replay, and display. */
 	deobfuscate(text: string): string {
-		return this.#deobfuscate(text, false);
-	}
-
-	/**
-	 * Deobfuscate stored session content for replay/display. Identical to
-	 * {@link deobfuscate} but additionally honors legacy index-derived aliases so
-	 * sessions persisted before keyed placeholders still resume correctly. Use
-	 * only for trusted on-disk session content, never for live model output.
-	 */
-	deobfuscateStored(text: string): string {
-		return this.#deobfuscate(text, true);
+		return this.#deobfuscate(text);
 	}
 
 	// Reverse-direction counterpart to `#isGeneratedPlaceholder`'s guard: the
@@ -929,7 +878,7 @@ export class SecretObfuscator {
 	// placeholder minted under a renamed friendly name still deobfuscates
 	// (see `#prefixIsSecretShaped`'s docstring for why), but unconditionally
 	// stripping and ignoring an attacker-authored prefix would let a forged
-	// token like `#GITHUBPATABC123_<suffix-copied-from-any-real-placeholder>#`
+	// token like `$$GITHUBPATABC123_<suffix-copied-from-any-real-placeholder>$$`
 	// restore to that OTHER secret's raw value with no check at all — worse
 	// than the obfuscate-direction leak, since deobfuscation is what feeds
 	// tool-call arguments and provider-output restoration. Refuse the
@@ -939,14 +888,14 @@ export class SecretObfuscator {
 	#lookupLiveAlias(placeholder: string): { secret: string; recursive: boolean } | undefined {
 		const direct = this.#deobfuscateMap.get(placeholder);
 		if (direct !== undefined) return direct;
-		const match = /^#([A-Z0-9]+)_([A-Z0-9]{4,}(?::[ULCM])?)#$/.exec(placeholder);
+		const body = placeholder.slice(2, -2);
+		const match = /^([A-Z0-9]+)_([A-Z0-9]{4,}(?::[ULCM])?)$/.exec(body);
 		if (match === null || this.#prefixIsSecretShaped(match[1]!)) return undefined;
-		return this.#deobfuscateMap.get(`#${match[2]}#`);
+		return this.#deobfuscateMap.get(`$$${match[2]}$$`);
 	}
 
-	#deobfuscate(text: string, allowLegacy: boolean): string {
-		if ((!this.#hasAny && (!allowLegacy || this.#legacyDeobfuscateMap.size === 0)) || !text.includes("#"))
-			return text;
+	#deobfuscate(text: string): string {
+		if (!this.#hasAny || !text.includes("$$")) return text;
 		let result = text;
 		for (;;) {
 			let shouldContinue = false;
@@ -956,16 +905,9 @@ export class SecretObfuscator {
 					shouldContinue ||= mapped.recursive;
 					return mapped.secret;
 				}
-				if (allowLegacy) {
-					const legacy = this.#legacyDeobfuscateMap.get(match);
-					if (legacy !== undefined) {
-						shouldContinue ||= legacy.recursive;
-						return legacy.secret;
-					}
-				}
 				return match;
 			});
-			if (next === result || !shouldContinue || !next.includes("#")) return next;
+			if (next === result || !shouldContinue || !next.includes("$$")) return next;
 			result = next;
 		}
 	}
@@ -976,12 +918,6 @@ export class SecretObfuscator {
 		return deepWalkStrings(obj, s => this.deobfuscate(s));
 	}
 
-	/** Deep-walk stored session content, deobfuscating string values incl. legacy aliases. */
-	deobfuscateStoredObject<T>(obj: T): T {
-		if (!this.hasStoredSecrets()) return obj;
-		return deepWalkStrings(obj, s => this.deobfuscateStored(s));
-	}
-
 	/** Deep-walk an object, obfuscating all string values. */
 	obfuscateObject<T>(obj: T): T {
 		if (!this.#hasAny) return obj;
@@ -1390,7 +1326,7 @@ export class SecretObfuscator {
 	#placeholderForCurrentInput(placeholder: string): string {
 		const unprefixed = placeholderWithoutFriendlyName(placeholder);
 		if (unprefixed === undefined) return placeholder;
-		const match = /^#([A-Z0-9]+)_/.exec(placeholder);
+		const match = /^([A-Z0-9]+)_/.exec(placeholder.slice(2, -2));
 		if (match === null || !this.#prefixIsSecretShaped(match[1]!)) return placeholder;
 		return unprefixed;
 	}
@@ -1492,10 +1428,10 @@ export class SecretObfuscator {
 	// deobfuscate-direction check in `#deobfuscate`.
 	#isGeneratedPlaceholder(placeholder: string): boolean {
 		if (this.#deobfuscateMap.has(placeholder)) return true;
-		const match = /^#([A-Z0-9]+)_([A-Z0-9]{4,}(?::[ULCM])?)#$/.exec(placeholder);
+		const match = /^([A-Z0-9]+)_([A-Z0-9]{4,}(?::[ULCM])?)$/.exec(placeholder.slice(2, -2));
 		if (match === null) return false;
 		if (this.#prefixIsSecretShaped(match[1]!)) return false;
-		return this.#deobfuscateMap.has(`#${match[2]}#`);
+		return this.#deobfuscateMap.has(`$$${match[2]}$$`);
 	}
 
 	// Replace `search` with `replacement` outside known generated placeholders while
@@ -1865,40 +1801,25 @@ export class SecretObfuscator {
  * Restore secret placeholders for local display. Only message kinds the model
  * itself authored from obfuscated context carry placeholders — assistant
  * content and the LLM-written branch/compaction summaries. User, developer, and
- * tool-result messages are persisted with their literal text, so a literal
- * `#ABCD#` the operator typed must survive untouched; those roles are never
- * walked.
- *
- * Legacy index-derived aliases (`#XXXX#`) are unkeyed and trivially guessable,
- * so a prompt-injected model can plant one in any record it influences. Every
- * agent-feeding path (resume, history rewrite, branch switch) therefore restores
- * keyed placeholders ONLY (`allowLegacyAliases` false), leaving legacy tokens
- * inert; display-only transcripts that are never re-obfuscated opt in via
- * `allowLegacyAliases`.
+ * tool-result messages are persisted with their literal text, so operator-authored
+ * placeholder-shaped text must survive untouched; those roles are never walked.
  */
 export function deobfuscateSessionContext(
 	sessionContext: SessionContext,
 	obfuscator: SecretObfuscator | undefined,
-	allowLegacyAliases = false,
 ): SessionContext {
-	if (!obfuscator || !(allowLegacyAliases ? obfuscator.hasStoredSecrets() : obfuscator.hasSecrets()))
-		return sessionContext;
-	const messages = deobfuscateAgentMessages(obfuscator, sessionContext.messages, allowLegacyAliases);
+	if (!obfuscator?.hasSecrets()) return sessionContext;
+	const messages = deobfuscateAgentMessages(obfuscator, sessionContext.messages);
 	return messages === sessionContext.messages ? sessionContext : { ...sessionContext, messages };
 }
 
-export function deobfuscateAgentMessages(
-	obfuscator: SecretObfuscator,
-	messages: AgentMessage[],
-	allowLegacyAliases = false,
-): AgentMessage[] {
-	const deob = (text: string): string =>
-		allowLegacyAliases ? obfuscator.deobfuscateStored(text) : obfuscator.deobfuscate(text);
+export function deobfuscateAgentMessages(obfuscator: SecretObfuscator, messages: AgentMessage[]): AgentMessage[] {
+	const deob = (text: string): string => obfuscator.deobfuscate(text);
 	let changed = false;
 	const result = messages.map((message): AgentMessage => {
 		switch (message.role) {
 			case "assistant": {
-				const content = deobfuscateAssistantContent(obfuscator, message.content, allowLegacyAliases);
+				const content = deobfuscateAssistantContent(obfuscator, message.content);
 				if (content === message.content) return message;
 				changed = true;
 				return { ...message, content };
@@ -1912,10 +1833,7 @@ export function deobfuscateAgentMessages(
 			case "compactionSummary": {
 				const summary = deob(message.summary);
 				const shortSummary = message.shortSummary === undefined ? undefined : deob(message.shortSummary);
-				const blocks =
-					message.blocks === undefined
-						? undefined
-						: deobfuscateTextBlocks(obfuscator, message.blocks, allowLegacyAliases);
+				const blocks = message.blocks === undefined ? undefined : deobfuscateTextBlocks(obfuscator, message.blocks);
 				if (summary === message.summary && shortSummary === message.shortSummary && blocks === message.blocks) {
 					return message;
 				}
@@ -1937,11 +1855,9 @@ export function deobfuscateAgentMessages(
 export function deobfuscateAssistantContent(
 	obfuscator: SecretObfuscator,
 	content: AssistantMessage["content"],
-	allowLegacyAliases = false,
 ): AssistantMessage["content"] {
-	if (!(allowLegacyAliases ? obfuscator.hasStoredSecrets() : obfuscator.hasSecrets())) return content;
-	const deob = (text: string): string =>
-		allowLegacyAliases ? obfuscator.deobfuscateStored(text) : obfuscator.deobfuscate(text);
+	if (!obfuscator.hasSecrets()) return content;
+	const deob = (text: string): string => obfuscator.deobfuscate(text);
 	let changed = false;
 	const result = content.map((block): AssistantMessage["content"][number] => {
 		if (block.type === "text") {
@@ -1952,7 +1868,7 @@ export function deobfuscateAssistantContent(
 		}
 
 		if (block.type === "toolCall") {
-			const args = deobfuscateToolArguments(obfuscator, block.arguments, allowLegacyAliases);
+			const args = deobfuscateToolArguments(obfuscator, block.arguments);
 			const intent = block.intent === undefined ? undefined : deob(block.intent);
 			const rawBlock = block.rawBlock === undefined ? undefined : deob(block.rawBlock);
 			if (args === block.arguments && intent === block.intent && rawBlock === block.rawBlock) return block;
@@ -1972,12 +1888,9 @@ export function deobfuscateAssistantContent(
 export function deobfuscateToolArguments(
 	obfuscator: SecretObfuscator,
 	args: Record<string, unknown>,
-	allowLegacyAliases = false,
 ): Record<string, unknown> {
-	if (!(allowLegacyAliases ? obfuscator.hasStoredSecrets() : obfuscator.hasSecrets())) return args;
-	const deob = (text: string): string =>
-		allowLegacyAliases ? obfuscator.deobfuscateStored(text) : obfuscator.deobfuscate(text);
-	return mapJsonStrings(args as JsonValue, deob) as Record<string, unknown>;
+	if (!obfuscator.hasSecrets()) return args;
+	return mapJsonStrings(args as JsonValue, s => obfuscator.deobfuscate(s)) as Record<string, unknown>;
 }
 
 /** Redact secrets inside a tool call's arguments (same JSON-walk exception as {@link deobfuscateToolArguments}). */
@@ -2018,14 +1931,11 @@ function obfuscateTextBlocks(
 function deobfuscateTextBlocks(
 	obfuscator: SecretObfuscator,
 	content: (TextContent | ImageContent)[],
-	allowLegacyAliases = false,
 ): (TextContent | ImageContent)[] {
-	const deob = (text: string): string =>
-		allowLegacyAliases ? obfuscator.deobfuscateStored(text) : obfuscator.deobfuscate(text);
 	let changed = false;
 	const result = content.map((block): TextContent | ImageContent => {
 		if (block.type !== "text") return block;
-		const text = deob(block.text);
+		const text = obfuscator.deobfuscate(block.text);
 		if (text === block.text) return block;
 		changed = true;
 		return { ...block, text };

package/src/session/agent-session.ts

@@ -71,7 +71,7 @@ import type {
 	ToolResultMessage,
 	UsageReport,
 } from "@oh-my-pi/pi-ai";
-import { deriveClaudeDeviceId, type Effort, streamSimple } from "@oh-my-pi/pi-ai";
+import { type Effort, streamSimple } from "@oh-my-pi/pi-ai";
 import * as AIError from "@oh-my-pi/pi-ai/error";
 import { resetOpenAICodexHistoryAfterCompaction } from "@oh-my-pi/pi-ai/providers/openai-codex-responses";
 import { toolWireSchema } from "@oh-my-pi/pi-ai/utils/schema";
@@ -81,7 +81,6 @@ import {
 	escapeXmlText,
 	formatDuration,
 	getAgentDbPath,
-	getInstallId,
 	isBunTestRuntime,
 	isEnoent,
 	isInteractiveHost,
@@ -229,7 +228,6 @@ import {
 	type AsyncResultEntry,
 	buildAsyncResultBatchMessage,
 } from "./async-job-delivery";
-import type { AuthStorage } from "./auth-storage";
 import { BashRunner, type BashRunnerHost } from "./bash-runner";
 import {
 	checkpointStartedAtFromEntry,
@@ -304,6 +302,7 @@ import {
 } from "./session-maintenance";
 import { cleanupEmptyMoveSession, type SessionManager } from "./session-manager";
 import { SessionMemory, type SessionMemoryHost } from "./session-memory";
+import { buildSessionMetadata } from "./session-metadata";
 import { SessionProviderBoundary, type SessionProviderBoundaryHost } from "./session-provider-boundary";
 import { SessionStatsTracker, type SessionStatsTrackerHost } from "./session-stats";
 import { SessionTools, type SessionToolsHost } from "./session-tools";
@@ -330,53 +329,6 @@ const PLAN_MODE_REMINDER_MAX = 3;
 // Constants
 // ============================================================================
 
-/** Standard thinking levels */
-
-/**
- * Build the per-request `metadata` payload for the Anthropic provider, shaped
- * like real Claude Code's `getAPIMetadata` output (`{ session_id, account_uuid,
- * device_id }`) so the backend buckets requests under one session and attributes
- * them to the authenticated OAuth account when available. Resolved at request
- * time so token refreshes and login/logout transitions don't strand a stale
- * account UUID in memory. `account_uuid` and `device_id` are omitted for
- * non-Anthropic providers to avoid leaking the user's Claude identity to
- * third-party APIs (including Anthropic-format-compatible proxies such as
- * cloudflare-ai-gateway or gitlab-duo).
- *
- * `provider` is the target provider string (e.g. `"anthropic"`) and gates the
- * `account_uuid` and `device_id` lookups — only `"anthropic"` requests carry them.
- *
- * `sessionId` is forwarded to the auth-storage session-sticky lookup so that
- * multi-credential setups attribute to the same OAuth account used for the
- * actual API request rather than always picking the first credential.
- *
- * `authStorage` is treated as optional so test fixtures that stub `modelRegistry`
- * without a real storage layer still work; the resolver simply skips the lookup
- * and emits `{ session_id }` alone, matching the no-OAuth-credential path.
- */
-function buildSessionMetadata(
-	sessionId: string,
-	provider: string,
-	authStorage: AuthStorage | undefined,
-): Record<string, unknown> {
-	const userId: Record<string, string> = { session_id: sessionId };
-	// Only look up account_uuid when the request is going to Anthropic. Injecting
-	// a Claude OAuth account_uuid into requests bound for other providers (including
-	// Anthropic-format-compatible proxies like cloudflare-ai-gateway or gitlab-duo)
-	// would leak the user's Anthropic identity to unrelated third-party APIs.
-	if (provider === "anthropic") {
-		const accountUuid = authStorage?.getOAuthAccountId("anthropic", sessionId);
-		if (typeof accountUuid === "string" && accountUuid.length > 0) {
-			userId.account_uuid = accountUuid;
-			// Claude Code's `device_id` is a stable 64-hex account-scoped install
-			// identifier. Include both omp's persistent install id and the Claude
-			// account UUID so two accounts on the same install do not share a device.
-			userId.device_id = deriveClaudeDeviceId(getInstallId(), accountUuid);
-		}
-	}
-	return { user_id: JSON.stringify(userId) };
-}
-
 const noOpUIContext: ExtensionUIContext = {
 	select: async (_title, _options, _dialogOptions) => undefined,
 	confirm: async (_title, _message, _dialogOptions) => false,
@@ -901,6 +853,7 @@ export class AgentSession {
 			agent: this.agent,
 			sessionManager: this.sessionManager,
 			model: () => this.model,
+			configuredThinkingLevel: () => this.configuredThinkingLevel(),
 			emitNotice: (level, message, source) => this.emitNotice(level, message, source),
 			setModelTemporary: (model, thinkingLevel, options) => this.setModelTemporary(model, thinkingLevel, options),
 			setActiveToolsByName: names => this.setActiveToolsByName(names),
@@ -2249,7 +2202,7 @@ export class AgentSession {
 		// Deobfuscate assistant message content for display emission — the LLM echoes back
 		// obfuscated placeholders, but listeners (TUI, extensions, exporters) must see real
 		// values. The original event.message stays obfuscated so the persistence path below
-		// writes `#HASH#` tokens to the session file; convertToLlm re-obfuscates outbound
+		// writes `$$HASH$$` tokens to the session file; convertToLlm re-obfuscates outbound
 		// traffic on the next turn. Walks text, thinking, and toolCall arguments/intent.
 		let displayEvent: AgentEvent = event;
 		const obfuscator = this.#obfuscator;
@@ -2632,8 +2585,14 @@ export class AgentSession {
 				return;
 			}
 
-			if (this.#recovery.isRetryableReasonlessAbort(msg)) {
-				const didRetry = await this.#recovery.handleRetryableError(msg, { allowModelFallback: false });
+			const resolvedInterruptedToolTurn = this.#recovery.classifyResolvedInterruptedToolTurn(msg);
+			if (this.#recovery.isRetryableReasonlessAbort(msg) || resolvedInterruptedToolTurn === "reasonless-abort") {
+				const didRetry = await this.#recovery.handleRetryableError(
+					msg,
+					resolvedInterruptedToolTurn === "reasonless-abort"
+						? { allowModelFallback: false, preserveFailedTurn: true }
+						: { allowModelFallback: false },
+				);
 				if (didRetry) {
 					await emitAgentEndNotification({ willContinue: true });
 					return;
@@ -2659,7 +2618,7 @@ export class AgentSession {
 					return;
 				}
 			}
-			const resumeResolvedStreamStall = this.#recovery.canResumeResolvedStreamStall(msg);
+			const resumeResolvedStreamStall = resolvedInterruptedToolTurn === "stream-stall";
 			if (resumeResolvedStreamStall || this.#recovery.isRetryableError(msg)) {
 				const didRetry = await this.#recovery.handleRetryableError(
 					msg,
@@ -3078,6 +3037,7 @@ export class AgentSession {
 			session_id: this.sessionId,
 			session_file: this.sessionFile,
 			stop_hook_active: this.#sessionStopHookActive,
+			signal: this.#postPromptTasksAbortController.signal,
 		});
 		if (this.#promptGeneration !== generation || this.#abortInProgress || this.#isDisposed) {
 			this.#resetSessionStopContinuationState();
@@ -3336,6 +3296,12 @@ export class AgentSession {
 		this.agent.setMetadataResolver((provider: string) =>
 			buildSessionMetadata(sid, provider, this.#modelRegistry.authStorage),
 		);
+		// Keep every live advisor's provider identity in lockstep with the primary's
+		// across every session-boundary transition — including branch paths that
+		// skip conversation restore — so advisors never emit the previous
+		// conversation's session id/metadata (issue #6625). Guarded because this
+		// runs once during construction before the advisor controller exists.
+		if (this.#advisors) this.#advisors.refreshProviderIdentity();
 	}
 
 	/** Run one abortable auto-learn capture outside the primary agent loop. */
@@ -4097,10 +4063,7 @@ export class AgentSession {
 	 * Transcript for TUI display. Full history is kept for export/resume-style
 	 * callers; live chat can collapse compacted history to keep the hot render
 	 * surface bounded. Display-only — NEVER feed the result to
-	 * `agent.replaceMessages` or a provider. Because it is never re-obfuscated,
-	 * it opts into legacy index-derived alias restoration so pre-keyed sessions
-	 * still render their secrets; the agent-feeding paths
-	 * (`buildDisplaySessionContext`) keep the keyed-only default.
+	 * `agent.replaceMessages` or a provider.
 	 */
 	buildTranscriptSessionContext(
 		options?: Pick<BuildSessionContextOptions, "collapseCompactedHistory" | "keepDanglingToolCalls">,
@@ -7373,6 +7336,14 @@ export class AgentSession {
 		 * (issue #5642).
 		 */
 		reopenAsk?: { toolCallId: string; questions: AskToolInput["questions"] };
+		/**
+		 * `true` when this call committed a new sibling answer for an `ask`
+		 * re-answer (`reanswerAskResult` was applied). The interactive caller
+		 * resumes the agent via {@link resumeAfterAskReanswer} *after* rebuilding
+		 * its transcript, so the resumed turn never renders against the stale
+		 * pre-rebuild UI (issue #6483).
+		 */
+		askReanswerCommitted?: boolean;
 	}> {
 		await this.#bash.flushPending();
 		const oldLeafId = this.sessionManager.getLeafId();
@@ -7523,6 +7494,10 @@ export class AgentSession {
 		// Determine the new leaf position based on target type
 		let newLeafId: string | null;
 		let editorText: string | undefined;
+		// Set when the second-pass `ask` re-answer branch below actually commits a
+		// new sibling answer — the trigger for resuming the agent afterwards so the
+		// model consumes it, mirroring a live `ask` completion (issue #6483).
+		let isAskReanswerCompletion = false;
 
 		if (targetEntry.type === "message" && targetEntry.message.role === "user") {
 			// User message: leaf = parent (null if root), text goes to editor
@@ -7559,6 +7534,7 @@ export class AgentSession {
 				timestamp: Date.now(),
 			};
 			newLeafId = this.sessionManager.appendMessageToBranch(toolResultMessage, targetEntry.parentId);
+			isAskReanswerCompletion = true;
 		} else {
 			// Non-user message (or a user-invoked skill-prompt injection): land the
 			// leaf on the selected node so it stays on the active branch. Skill
@@ -7604,6 +7580,14 @@ export class AgentSession {
 
 		this.#branchSummaryAbortController = undefined;
 
+		// Report a committed `ask` re-answer so the interactive caller can resume
+		// the agent via `resumeAfterAskReanswer()` *after* rebuilding its
+		// transcript. Scheduling the continue here instead would start a fresh
+		// streaming turn whose `agent_start`/`turn_start` events could render
+		// against the stale pre-rebuild UI and then be clobbered by the caller's
+		// `renderInitialMessages(...)` (issue #6483). Plain leaf moves and the
+		// read-only `reopenAsk` probe leave the flag unset.
+
 		// Emit session_tree event; only handlers can mutate session entries, so skip
 		// the emit and the context rebuild when no handlers are registered (mirrors
 		// the session_before_tree guard above).
@@ -7616,9 +7600,34 @@ export class AgentSession {
 				fromExtension: summaryText ? fromExtension : undefined,
 			});
 			const rawContext = this.sessionManager.buildSessionContext();
-			return { editorText, cancelled: false, summaryEntry, sessionContext: rawContext };
+			return {
+				editorText,
+				cancelled: false,
+				summaryEntry,
+				sessionContext: rawContext,
+				askReanswerCommitted: isAskReanswerCompletion,
+			};
 		}
-		return { editorText, cancelled: false, summaryEntry, sessionContext: stateContext };
+		return {
+			editorText,
+			cancelled: false,
+			summaryEntry,
+			sessionContext: stateContext,
+			askReanswerCommitted: isAskReanswerCompletion,
+		};
+	}
+
+	/**
+	 * Resume the agent after the interactive `/tree` caller has committed an
+	 * `ask` re-answer (`navigateTree` returned `askReanswerCommitted`) and
+	 * rebuilt its transcript. Mirrors how a live `ask` completion drives a
+	 * follow-up turn, but is deferred to the caller so the resumed turn renders
+	 * against the rebuilt UI rather than the stale pre-navigation transcript
+	 * (issue #6483). The scheduled continue honors the same disposed/compacting
+	 * guards as every other post-prompt continuation.
+	 */
+	resumeAfterAskReanswer(): void {
+		this.#scheduleAgentContinue();
 	}
 
 	/**

package/src/session/prewalk.ts

@@ -1,7 +1,6 @@
 import type { Agent, AgentMessage, AgentToolResult, AgentTurnEndContext } from "@oh-my-pi/pi-agent-core";
 import { invalidateMessageCache } from "@oh-my-pi/pi-agent-core/compaction";
 import type { Model } from "@oh-my-pi/pi-ai";
-import { modelsAreEqual } from "@oh-my-pi/pi-catalog/models";
 import { prompt } from "@oh-my-pi/pi-utils";
 import type { LocalProtocolOptions } from "../internal-urls";
 import { resolveApprovedPlan } from "../plan-mode/approved-plan";
@@ -11,7 +10,7 @@ import planYoloHandoffPrompt from "../prompts/system/plan-yolo-handoff.md" with
 import prewalkChecklistPrompt from "../prompts/system/prewalk-checklist.md" with { type: "text" };
 import prewalkContinuePrompt from "../prompts/system/prewalk-continue.md" with { type: "text" };
 import prewalkPlanPrompt from "../prompts/system/prewalk-plan.md" with { type: "text" };
-import type { ConfiguredThinkingLevel } from "../thinking";
+import { type ConfiguredThinkingLevel, prewalkWouldBeNoop } from "../thinking";
 import type { PlanProposalHandler } from "../tools/resolve";
 import { ToolError } from "../tools/tool-errors";
 import type { PlanYolo, Prewalk } from "./agent-session-types";
@@ -31,6 +30,7 @@ export interface PrewalkCoordinatorHost {
 	agent: Agent;
 	sessionManager: SessionManager;
 	model(): Model | undefined;
+	configuredThinkingLevel(): ConfiguredThinkingLevel | undefined;
 	emitNotice(level: "info" | "warning" | "error", message: string, source?: string): void;
 	setModelTemporary(
 		model: Model,
@@ -126,8 +126,13 @@ export class PrewalkCoordinator {
 		this.#scrubPlanNudge(liveMessages);
 		const target = prewalk.target;
 		const currentModel = this.#host.model();
-		if (currentModel && modelsAreEqual(currentModel, target)) {
+		if (prewalkWouldBeNoop(currentModel, this.#host.configuredThinkingLevel(), target, prewalk.thinkingLevel)) {
 			this.#prewalk = undefined;
+			this.#host.emitNotice(
+				"info",
+				`Prewalk: target ${target.provider}/${target.id} already matches the active model and thinking level; nothing to switch.`,
+				"prewalk",
+			);
 			return;
 		}
 		await this.#host.setModelTemporary(target, prewalk.thinkingLevel, { ephemeral: true });