@phnx-labs/agents-cli 1.22.8 → 1.22.10

package/dist/lib/resources/workflows.js

@@ -3,12 +3,12 @@
  *
  * Workflows are directory bundles with a WORKFLOW.md containing YAML frontmatter.
  * They optionally contain subagents/, skills/, and plugins/ subdirectories.
- * Resolution order: project > user > system.
+ * Resolution order (docs/07-entrypoints): project > user > plugin > extra > system.
  */
 import * as fs from 'fs';
 import * as path from 'path';
 import { getProjectAgentsDir, getUserWorkflowsDir, getSystemWorkflowsDir, getEnabledExtraRepos, } from '../state.js';
-import { parseWorkflowFrontmatter, countWorkflowSubagents } from '../workflows.js';
+import { parseWorkflowFrontmatter, countWorkflowSubagents, listPluginWorkflowDirs, isBareWorkflowName, } from '../workflows.js';
 function getLayerDirs(cwd) {
     const projectDir = getProjectAgentsDir(cwd);
     const extraRepos = getEnabledExtraRepos();
@@ -32,20 +32,27 @@ function listWorkflowsInDir(dir) {
         return [];
     }
 }
+/** Precedence-ordered (dir, layer) pairs for name lookup / listing. */
+function orderedWorkflowSearchDirs(cwd) {
+    const dirs = getLayerDirs(cwd);
+    const out = [];
+    if (dirs.project)
+        out.push({ dir: dirs.project, layer: 'project' });
+    out.push({ dir: dirs.user, layer: 'user' });
+    for (const pluginDir of listPluginWorkflowDirs(cwd ?? process.cwd())) {
+        out.push({ dir: pluginDir, layer: 'plugin' });
+    }
+    for (const extraDir of dirs.extra)
+        out.push({ dir: extraDir, layer: 'system' });
+    out.push({ dir: dirs.system, layer: 'system' });
+    return out;
+}
 class WorkflowsHandlerImpl {
     kind = 'workflow';
     listAll(_agent, cwd) {
-        const dirs = getLayerDirs(cwd);
         const seen = new Set();
         const results = [];
-        const layerDirs = [];
-        if (dirs.project)
-            layerDirs.push({ dir: dirs.project, layer: 'project' });
-        layerDirs.push({ dir: dirs.user, layer: 'user' });
-        layerDirs.push({ dir: dirs.system, layer: 'system' });
-        for (const extraDir of dirs.extra)
-            layerDirs.push({ dir: extraDir, layer: 'system' });
-        for (const { dir, layer } of layerDirs) {
+        for (const { dir, layer } of orderedWorkflowSearchDirs(cwd)) {
             for (const { name, path: workflowPath } of listWorkflowsInDir(dir)) {
                 if (seen.has(name))
                     continue;
@@ -69,15 +76,10 @@ class WorkflowsHandlerImpl {
         return results.sort((a, b) => a.name.localeCompare(b.name));
     }
     resolve(_agent, name, cwd) {
-        const dirs = getLayerDirs(cwd);
-        const searchDirs = [];
-        if (dirs.project)
-            searchDirs.push({ dir: dirs.project, layer: 'project' });
-        searchDirs.push({ dir: dirs.user, layer: 'user' });
-        searchDirs.push({ dir: dirs.system, layer: 'system' });
-        for (const extraDir of dirs.extra)
-            searchDirs.push({ dir: extraDir, layer: 'system' });
-        for (const { dir, layer } of searchDirs) {
+        // Same bare-name gate as resolveWorkflowRef — never path-join traversal refs.
+        if (!isBareWorkflowName(name))
+            return null;
+        for (const { dir, layer } of orderedWorkflowSearchDirs(cwd)) {
             const workflowPath = path.join(dir, name);
             const fm = parseWorkflowFrontmatter(workflowPath);
             if (fm) {

package/dist/lib/secrets/bundles.d.ts

@@ -23,6 +23,8 @@
 import { type BundleValue, type SecretRef } from './index.js';
 /** Which store carries a bundle's items. */
 export type SecretsBackend = 'keychain' | 'file' | 'vault';
+/** Disable the broker-only guard for in-memory keychain tests. */
+export declare function setKeychainAgentOnlyBypassForTest(bypass: boolean): void;
 /**
  * Discover a bundle's backend by location: a file-backed bundle's metadata
  * item exists in the encrypted-file store. This is a plain file-existence
@@ -184,6 +186,13 @@ export declare function deleteBundle(name: string): boolean;
  * extra keychain read is issued. Exported for tests. Returns the count healed.
  */
 export declare function healKeychainBundleMetadata(metaJsonByName: Map<string, string>): number;
+/**
+ * One-time driver around healKeychainBundleMetadata (RUSH-1759). macOS + real
+ * keychain only — libsecret/CredMan have no biometry ACL to shed, and a test
+ * backend has no real keychain — and gated by a sentinel so it runs at most
+ * once. Best-effort: a heal failure never breaks bundle listing.
+ */
+export declare function healKeychainBundleMetadataAclOnce(metaJsonByName: Map<string, string>): void;
 export declare function listBundles(): SecretsBundle[];
 export interface BundleEntryInfo {
     key: string;

package/dist/lib/secrets/bundles.js

@@ -86,6 +86,11 @@ const vaultStore = {
     delete: vaultDeleteItem,
     list: vaultListItems,
 };
+let keychainAgentOnlyBypassForTest = false;
+/** Disable the broker-only guard for in-memory keychain tests. */
+export function setKeychainAgentOnlyBypassForTest(bypass) {
+    keychainAgentOnlyBypassForTest = bypass;
+}
 function itemStore(backend) {
     if (backend === 'file')
         return fileItemStore;
@@ -606,7 +611,7 @@ export function healKeychainBundleMetadata(metaJsonByName) {
  * backend has no real keychain — and gated by a sentinel so it runs at most
  * once. Best-effort: a heal failure never breaks bundle listing.
  */
-function healKeychainBundleMetadataAclOnce(metaJsonByName) {
+export function healKeychainBundleMetadataAclOnce(metaJsonByName) {
     if (metaJsonByName.size === 0)
         return;
     if (process.platform !== 'darwin')
@@ -684,7 +689,6 @@ export function listBundles() {
                 // still prompt once; it heals on the next interactive scan.)
                 const fetched = getKeychainTokens(keychainServices, { silentNoAcl: true });
                 const keychainBundles = [];
-                const metaJsonByName = new Map();
                 for (const service of keychainServices) {
                     const json = fetched.get(service);
                     if (json === undefined)
@@ -695,7 +699,6 @@ export function listBundles() {
                     const bundle = parseBundleMeta(nameHint, json, 'keychain');
                     if (bundle) {
                         keychainBundles.push(bundle);
-                        metaJsonByName.set(bundle.name, json);
                     }
                 }
                 for (const bundle of keychainBundles)
@@ -707,13 +710,6 @@ export function listBundles() {
                 if (useAgent && keychainBundles.length > 0) {
                     agentAutoLoadMetaSync(nameSetHash, keychainBundles, secretsHoldMs());
                 }
-                // One-time RUSH-1759 heal: bundles written before the metadata-no-ACL
-                // change carry an ACL'd metadata item, so this fresh read (a broker miss)
-                // popped Touch ID just to enumerate them. Re-home each metadata item
-                // no-ACL now — reusing the JSON we just read, so the heal adds no extra
-                // prompt — and every later enumeration is silent. Runs at most once (a
-                // sentinel under the regenerable helpers dir).
-                healKeychainBundleMetadataAclOnce(metaJsonByName);
             }
         }
     }
@@ -1099,24 +1095,14 @@ export function readAndResolveBundleEnv(name, opts = {}) {
             return filtered;
         }
     }
-    // Never/no-ACL bundles remain prompt-free regardless. No agent launch — harness,
-    // teammate, routine, or the always-on daemon — may raise the sheet itself.
-    // Explicit opt-in ONLY — a deliberate NARROWING of the agent-triggered approval
-    // added in RUSH-2032 (b99796f8 removed this throw so an agent could raise the
-    // sheet itself; 4eeada68 generalized the daemon rule into `!interactiveUnlock`).
-    // That default — true whenever an agent name was present — was the spec, not a
-    // bug. It is unwanted: each keychain read runs in its own helper process, so the
-    // biometric assertion never reuses and one agent launch meant one sheet per
-    // bundle. `agentOnly` decides alone now; a human in a plain shell carries no
-    // AGENTS_RUNTIME, so isHeadlessSecretsContext() is false, agentOnly is false, the
-    // guard never fires, and they still get their prompt. No caller passes this flag;
-    // it remains the seam for a future unlock path that wants the sheet on purpose.
+    // Never/no-ACL bundles remain prompt-free regardless. Every ordinary caller
+    // sets agentOnly; only the unlock handler opts into interactive authentication.
     const interactiveUnlock = opts.interactiveUnlock ?? false;
     // A `never`-policy bundle's items carry no biometry ACL, so once the policy
     // check below proves that, the batch read is silent even in a headless
     // context — attest it to the raw-read storm guard via `silentNoAcl`.
     let verifiedNoAclBundle = false;
-    if (opts.agentOnly && backend === 'keychain' && !interactiveUnlock) {
+    if (opts.agentOnly && backend === 'keychain' && !interactiveUnlock && !keychainAgentOnlyBypassForTest) {
         try {
             verifiedNoAclBundle = bundlePolicy(readBundle(name)) === 'never';
         }

package/dist/lib/secrets/headless.d.ts

@@ -5,22 +5,13 @@
  * importing bundles.ts (which already imports index.ts).
  */
 /**
- * True when the current process is a background / non-interactive context that
- * must NEVER raise a Keychain biometry prompt on the interactive user's screen —
- * a prompt nobody is watching. Two signals, either sufficient:
+ * True when the current process was structurally launched by an agent runtime
+ * that must NEVER raise a Keychain biometry prompt on the user's screen:
  *   - `AGENTS_RUNTIME` is `headless`, `teams`, or `terminal` — i.e. ANY agent
  *     launch, interactive included, and inherited by everything spawned beneath
  *     one (set on the child env by `agents run --headless`, scheduled routines,
  *     teammates, and interactive runs — see exec.ts:430, runner.ts,
  *     teams/agents.ts).
- *   - neither stdin nor stdout is a TTY (a detached/backgrounded task whose
- *     stdio is redirected to a log — e.g. a release script run in the
- *     background as `( ... ) >log 2>&1 </dev/null`).
- * `AGENTS_SECRETS_NO_PROMPT=1` forces headless-safe; `=0` force-allows a prompt
- * even in a non-TTY context. An `eval "$(agents secrets export X)"` typed in a
- * PLAIN shell has no AGENTS_RUNTIME, so it is not classified headless and still
- * prompts. Run beneath an agent it inherits AGENTS_RUNTIME and resolves
- * broker-only — the agent, not the human, is the caller there.
  *
  * Only **macOS keychain** reads pop an interactive Touch ID sheet — the secrets
  * broker itself is a no-op off darwin (see agent.ts), and libsecret (Linux) /
@@ -33,7 +24,4 @@
  * fast with an actionable error instead of hijacking Touch ID. This generalizes
  * the per-caller broker-only pattern used across the headless secrets readers.
  */
-export declare function isHeadlessSecretsContext(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, tty?: {
-    stdin?: boolean;
-    stdout?: boolean;
-}): boolean;
+export declare function isHeadlessSecretsContext(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): boolean;

package/dist/lib/secrets/headless.js

@@ -5,22 +5,13 @@
  * importing bundles.ts (which already imports index.ts).
  */
 /**
- * True when the current process is a background / non-interactive context that
- * must NEVER raise a Keychain biometry prompt on the interactive user's screen —
- * a prompt nobody is watching. Two signals, either sufficient:
+ * True when the current process was structurally launched by an agent runtime
+ * that must NEVER raise a Keychain biometry prompt on the user's screen:
  *   - `AGENTS_RUNTIME` is `headless`, `teams`, or `terminal` — i.e. ANY agent
  *     launch, interactive included, and inherited by everything spawned beneath
  *     one (set on the child env by `agents run --headless`, scheduled routines,
  *     teammates, and interactive runs — see exec.ts:430, runner.ts,
  *     teams/agents.ts).
- *   - neither stdin nor stdout is a TTY (a detached/backgrounded task whose
- *     stdio is redirected to a log — e.g. a release script run in the
- *     background as `( ... ) >log 2>&1 </dev/null`).
- * `AGENTS_SECRETS_NO_PROMPT=1` forces headless-safe; `=0` force-allows a prompt
- * even in a non-TTY context. An `eval "$(agents secrets export X)"` typed in a
- * PLAIN shell has no AGENTS_RUNTIME, so it is not classified headless and still
- * prompts. Run beneath an agent it inherits AGENTS_RUNTIME and resolves
- * broker-only — the agent, not the human, is the caller there.
  *
  * Only **macOS keychain** reads pop an interactive Touch ID sheet — the secrets
  * broker itself is a no-op off darwin (see agent.ts), and libsecret (Linux) /
@@ -33,31 +24,12 @@
  * fast with an actionable error instead of hijacking Touch ID. This generalizes
  * the per-caller broker-only pattern used across the headless secrets readers.
  */
-export function isHeadlessSecretsContext(env = process.env, platform = process.platform, 
-// Injected so the TTY branch below is testable: it is the branch that decides a
-// plain human shell still prompts, which is this guard's entire safety argument,
-// and reading process.* directly made it unreachable from a test.
-tty = { stdin: process.stdin.isTTY, stdout: process.stdout.isTTY }) {
+export function isHeadlessSecretsContext(env = process.env, platform = process.platform) {
     if (platform !== 'darwin')
         return false; // no biometry prompt to suppress off-darwin
-    const override = env.AGENTS_SECRETS_NO_PROMPT;
-    if (override === '1')
-        return true;
-    if (override === '0')
-        return false;
-    // Every AGENT-LAUNCH runtime resolves broker-only, interactive included.
-    // `terminal` was missing, which made an agent terminal the one launch path
-    // still allowed to pop Touch ID: exec.ts sets AGENTS_RUNTIME='terminal' for an
-    // interactive run (exec.ts:430), that fell through to the TTY check below, and
-    // a TTY meant "a human is watching, so prompting is fine". It is not fine —
-    // opening a terminal is not a request to authenticate, and a launch that needs
-    // a locked bundle should say so and point at `agents secrets unlock`, not grab
-    // the fingerprint sensor. AGENTS_RUNTIME is INHERITED by everything spawned under
-    // an agent, so `agents secrets export` run beneath one resolves broker-only too —
-    // correctly: there the agent, not the human, is the caller. A plain shell carries
-    // no AGENTS_RUNTIME, so a person running it themselves still gets the sheet.
+    // Every agent-launch runtime resolves broker-only, interactive included.
     const runtime = env.AGENTS_RUNTIME;
     if (runtime === 'headless' || runtime === 'teams' || runtime === 'terminal')
         return true;
-    return !tty.stdin && !tty.stdout;
+    return false;
 }

package/dist/lib/secrets/index.d.ts

@@ -143,6 +143,14 @@ export declare function healHmacKeyNoAclOnce(rec: HmacKeyRecord): boolean;
  * see readAndResolveBundleEnv.
  */
 export declare function keychainServiceAlias(item: string): string;
+/**
+ * One-shot per process: activate hashing on machines with nothing to move,
+ * finish a crash-interrupted delete phase (silent), and run the interactive
+ * one-time re-key when cleartext-named items exist and a human is present.
+ * Never throws — a failed attempt leaves the process on cleartext names
+ * (exact pre-#316 behavior) and the next process retries.
+ */
+export declare function maybeAutoRekey(): void;
 /** One re-keyed (or failed) item, by its old cleartext service name. */
 export interface RekeyPlanItem {
     oldService: string;

package/dist/lib/secrets/index.js

@@ -247,30 +247,7 @@ export function readHmacKeyRecord() {
     catch {
         return null;
     }
-    const record = parseHmacKeyRecord(raw);
-    // Converge a stale-ACL'd hmackey to silent, on the HOT read path. An old helper
-    // (pre the metadata/hmackey no-ACL migration fix) re-stamped this
-    // contractually-no-ACL item with a biometry ACL, so the read just above pops the
-    // generic "Agents CLI needs to authenticate" sheet on EVERY hashed lookup — the
-    // `agents devices list` stats probe the SessionStart hook runs, and every other
-    // background hashed read. `maybeAutoRekey`'s one-shot heal only fires on a
-    // cleartext-bundle resolve and is bypassed for the hmackey/hashed-name path
-    // (prepareServiceName returns early for HMAC_KEY_ITEM before maybeAutoRekey), so
-    // it never converged exactly these reads and the machine prompted forever.
-    // Re-store the record no-ACL once per machine here (the read that produced it has
-    // already happened — and already prompted if the item was ACL'd); every
-    // subsequent read, in this process and all future ones, is silent.
-    if (record && !record.healedNoAcl) {
-        try {
-            healHmacKeyNoAclOnce(record);
-            record.healedNoAcl = true;
-        }
-        catch {
-            // A failed no-ACL re-store leaves the item still ACL'd (a still-prompting
-            // read) rather than a silent wrong state; the next process retries.
-        }
-    }
-    return record;
+    return parseHmacKeyRecord(raw);
 }
 function writeHmacKeyRecord(rec) {
     // JSON.stringify drops undefined fields (used to clear pendingDeletes).
@@ -325,15 +302,13 @@ function resolveHashState() {
 export function keychainServiceAlias(item) {
     return prepareServiceName(item);
 }
-function prepareServiceName(item, opts) {
+function prepareServiceName(item) {
     if (rawScopeDepth > 0)
         return item;
     if (!isOurItem(item))
         return item;
     if (item === HMAC_KEY_ITEM || item.startsWith(HASHED_SERVICE_PREFIX))
         return item;
-    if (opts?.autoRekey)
-        maybeAutoRekey();
     const st = resolveHashState();
     if (!st.active || !st.key)
         return item;
@@ -354,7 +329,6 @@ function prepareListPrefix(prefix) {
         return { prefix };
     if (prefix.startsWith(HASHED_SERVICE_PREFIX))
         return { prefix };
-    maybeAutoRekey();
     const st = resolveHashState();
     if (!st.active || !st.key)
         return { prefix };
@@ -429,7 +403,7 @@ function finishPendingDeletes(rec) {
  * Never throws — a failed attempt leaves the process on cleartext names
  * (exact pre-#316 behavior) and the next process retries.
  */
-function maybeAutoRekey() {
+export function maybeAutoRekey() {
     if (autoRekeyAttempted || rekeyRunning || rawScopeDepth > 0)
         return;
     autoRekeyAttempted = true;
@@ -446,10 +420,14 @@ function maybeAutoRekey() {
         return;
     const st = resolveHashState();
     if (st.active) {
-        // The stale-ACL'd-hmackey heal now runs on the hot read path
-        // (readHmacKeyRecord), which the resolveHashState() above just went through —
-        // so st.record is already healed here regardless of how this machine reached
-        // "hashing active". Nothing to do but finish any pending deletes.
+        if (st.record && !st.record.healedNoAcl) {
+            try {
+                healHmacKeyNoAclOnce(st.record);
+            }
+            catch {
+                /* the next explicit unlock retries */
+            }
+        }
         if (st.record?.pendingDeletes?.length) {
             try {
                 finishPendingDeletes(st.record);
@@ -820,7 +798,7 @@ export function getKeychainToken(item, context = {}) {
     // Errors keep the requested (human-readable) name; the storage name may be
     // an opaque hash.
     const requested = item;
-    item = prepareServiceName(item, { autoRekey: true });
+    item = prepareServiceName(item);
     if (backend)
         return backend.get(item);
     assertRawKeychainReadAllowed(requested, context);
@@ -848,6 +826,7 @@ export function getKeychainToken(item, context = {}) {
             ...process.env,
             AGENTS_KEYCHAIN_PROMPT: keychainOperationPrompt(context),
             AGENTS_KEYCHAIN_PROMPT_BASE: keychainOperationPrompt({ ...context, duration: undefined }),
+            AGENTS_KEYCHAIN_SKIP_AUTH_UI: context.silentNoAcl ? '1' : '0',
         },
         stdio: ['ignore', 'pipe', 'pipe'],
     });
@@ -890,7 +869,7 @@ export function getKeychainTokens(items, context = {}) {
     // whether those were cleartext (hashed here) or already-hashed (enumerated).
     const requestedByStorage = new Map();
     const storageItems = items.map((item) => {
-        const storage = prepareServiceName(item, { autoRekey: true });
+        const storage = prepareServiceName(item);
         if (!requestedByStorage.has(storage))
             requestedByStorage.set(storage, item);
         return storage;
@@ -939,6 +918,7 @@ export function getKeychainTokens(items, context = {}) {
             ...process.env,
             AGENTS_KEYCHAIN_PROMPT: keychainOperationPrompt(context),
             AGENTS_KEYCHAIN_PROMPT_BASE: keychainOperationPrompt({ ...context, duration: undefined }),
+            AGENTS_KEYCHAIN_SKIP_AUTH_UI: context.silentNoAcl ? '1' : '0',
             // The signed helper's own vocabulary is unchanged (it predates the rename
             // and ships as a separately-versioned binary), so map to its legacy token.
             AGENTS_KEYCHAIN_DEFAULT_POLICY: (context.defaultPolicy ?? 'hold') === 'hold' ? 'daily' : context.defaultPolicy,
@@ -1037,7 +1017,7 @@ export function setKeychainToken(item, value, opts) {
     if (/[\x00=\r\n]/.test(item))
         throw new Error('Secret item name contains invalid characters.');
     const requested = item;
-    item = prepareServiceName(item, { autoRekey: true });
+    item = prepareServiceName(item);
     if (backend) {
         backend.set(item, value, opts);
         return;

package/dist/lib/session/parse.d.ts

@@ -31,7 +31,11 @@ export declare function safeReadSessionFile(filePath: string, maxBytes?: number)
 /**
  * Auto-detect agent type from file path and parse the session.
  */
-export declare function parseSession(filePath: string, agent?: SessionAgentId): SessionEvent[];
+export interface ParseSessionOptions {
+    /** Keep normalized tool results compact by default; renderers can request full output. */
+    maxToolOutputChars?: number;
+}
+export declare function parseSession(filePath: string, agent?: SessionAgentId, opts?: ParseSessionOptions): SessionEvent[];
 /** Infer the agent type from a session file path using known directory conventions. */
 export declare function detectAgent(filePath: string): SessionAgentId | null;
 /**

package/dist/lib/session/parse.js

@@ -112,10 +112,12 @@ export function safeReadSessionFile(filePath, maxBytes = SESSION_FILE_MAX_BYTES)
     }
     return fs.readFileSync(filePath, 'utf-8');
 }
-/**
- * Auto-detect agent type from file path and parse the session.
- */
-export function parseSession(filePath, agent) {
+function truncateNormalizedToolOutput(output, maxChars) {
+    if (!Number.isFinite(maxChars) || output.length <= maxChars)
+        return output;
+    return `${output.slice(0, maxChars)}\n\n[Output truncated: ${output.length - maxChars} characters omitted.]`;
+}
+export function parseSession(filePath, agent, opts = {}) {
     const detected = agent || detectAgent(filePath);
     if (!detected) {
         throw new Error(`Cannot detect agent type from path: ${filePath}`);
@@ -166,7 +168,11 @@ export function parseSession(filePath, agent) {
     // from `!`-prefix runs, `<system-reminder>`, etc.) as `_synthetic` so turn
     // slicing and `--include user` count only genuine user intent — one place,
     // every harness, instead of per-consumer regex.
+    const maxToolOutputChars = opts.maxToolOutputChars ?? 500;
     for (const e of events) {
+        if (e.type === 'tool_result' && e.output) {
+            e.output = truncateNormalizedToolOutput(e.output, maxToolOutputChars);
+        }
         sanitizeEvent(e);
         if (e.type === 'message' && e.role === 'user' && isSyntheticUserMessage(e.content)) {
             e._synthetic = true;
@@ -496,7 +502,11 @@ export function parseClaudeContent(content) {
                                 exitCode: structured.exitCode,
                                 statusCode: structured.statusCode,
                                 errorCode: structured.errorCode,
-                                output: output.length > 500 ? output.slice(0, 497) + '...' : output,
+                                // Not truncated here: `parseSession` caps every event's `output`
+                                // centrally via `maxToolOutputChars` (default 500, the same
+                                // bound this site used to hardcode), so the render path can ask
+                                // for the full text with `Infinity`.
+                                output,
                             });
                         }
                         if (toolId)
@@ -686,7 +696,7 @@ export function parseCodexContent(content) {
                     exitCode: result.exitCode,
                     statusCode: result.statusCode,
                     errorCode: result.errorCode,
-                    output: result.text.length > 500 ? result.text.slice(0, 497) + '...' : result.text,
+                    output: result.text,
                 });
                 if (callId)
                     callMap.delete(callId);
@@ -741,7 +751,7 @@ export function parseCodexContent(content) {
                     exitCode: result.exitCode,
                     statusCode: result.statusCode,
                     errorCode: result.errorCode,
-                    output: result.text.length > 500 ? result.text.slice(0, 497) + '...' : result.text,
+                    output: result.text,
                 });
                 if (callId)
                     callMap.delete(callId);
@@ -865,7 +875,7 @@ export function parseGemini(filePath) {
                             tool: toolName,
                             callId: typeof tc.id === 'string' ? tc.id : undefined,
                             success: tc.status === 'success',
-                            output: output.length > 500 ? output.slice(0, 497) + '...' : output,
+                            output,
                         });
                     }
                 }
@@ -1242,7 +1252,7 @@ export function parseGrok(filePath) {
                 callId,
                 success: structuredError ? false : structuredSuccess ? true : undefined,
                 outcome: structuredError ? 'error' : structuredSuccess ? 'ok' : 'unknown',
-                output: output.length > 500 ? output.slice(0, 497) + '...' : output,
+                output: output,
             });
             if (callId)
                 toolCallMap.delete(callId);
@@ -1360,7 +1370,7 @@ export function parseOpenCode(filePath) {
                             tool: toolName,
                             callId,
                             success: state.status === 'completed',
-                            output: outputStr.length > 500 ? outputStr.slice(0, 497) + '...' : outputStr,
+                            output: outputStr,
                         });
                     }
                     break;
@@ -1470,7 +1480,7 @@ export function parseRush(filePath) {
                 tool: info?.tool ?? (typeof raw.name === 'string' ? raw.name : 'unknown'),
                 callId,
                 success,
-                output: outputStr.length > 500 ? outputStr.slice(0, 497) + '...' : outputStr,
+                output: outputStr,
             });
             if (callId)
                 toolCallMap.delete(callId);
@@ -1680,7 +1690,7 @@ export function parseKimi(filePath) {
                     callId,
                     success: structuredError ? false : structuredSuccess ? true : undefined,
                     outcome: structuredError ? 'error' : structuredSuccess ? 'ok' : 'unknown',
-                    output: output.length > 500 ? output.slice(0, 497) + '...' : output,
+                    output: output,
                 });
                 if (callId) {
                     toolCallMap.delete(callId);
@@ -1825,7 +1835,7 @@ function parseAnthropicMessageJsonl(filePath, agent) {
                 else {
                     events.push({
                         type: 'tool_result', agent, timestamp, tool: toolInfo?.tool, callId: toolId, success: true,
-                        output: output.length > 500 ? output.slice(0, 497) + '...' : output,
+                        output: output,
                     });
                 }
                 if (toolId)

package/dist/lib/session/prompt.js

@@ -46,6 +46,11 @@ const SYNTHETIC_USER_MESSAGE_PATTERNS = [
     /^\s*<\/?user-prompt-submit-hook>/i,
     /^\s*<\/?persisted-output>/i,
     /^\s*<permissions instructions>/i,
+    /^\s*<(?:apps|plugins|skills)_instructions>/i,
+    /^\s*<(?:multi_agent_mode|environment_context)>/i,
+    /^\s*## (?:In-flight in this repo|Host & Fleet)/i,
+    /^\s*Your current session id is\b/i,
+    /^\s*Linear context skipped:/i,
     /^\s*<collaboration_mode>/i,
     /^\s*Caveat: The messages below were generated by the user while running/i,
     /^\s*\[Request interrupted/i,

package/dist/lib/session/render.d.ts

@@ -108,6 +108,9 @@ export declare function filterEvents(events: SessionEvent[], opts: FilterOptions
  */
 export interface RenderConversationMarkdownOptions {
     redact?: boolean;
+    knownSecrets?: readonly string[];
+    reasoning?: 'omit' | 'fold' | 'include';
+    maxToolOutputChars?: number;
 }
 export declare function renderConversationMarkdown(events: SessionEvent[], opts?: RenderConversationMarkdownOptions): string;
 /**

package/dist/lib/session/render.js

@@ -923,10 +923,23 @@ export function filterEvents(events, opts) {
     const sliced = applyTurnSlice(events, opts);
     return applyRoleFilter(sliced, opts);
 }
+function markdownFence(content, language = '') {
+    const fence = content.includes('```') ? '````' : '```';
+    return `${fence}${language}\n${content}\n${fence}`;
+}
+function truncateToolOutput(content, maxChars) {
+    if (content.length <= maxChars)
+        return content;
+    return `${content.slice(0, maxChars)}\n\n[Output truncated: ${content.length - maxChars} characters omitted.]`;
+}
 export function renderConversationMarkdown(events, opts = {}) {
     const parts = [];
     const shouldRedact = opts.redact !== false;
-    const sanitize = (text) => shouldRedact ? redactSecrets(text) : text;
+    const sanitize = (text) => shouldRedact ? redactSecrets(text, opts.knownSecrets) : text;
+    // Preserve the long-standing `sessions <id> --markdown` full-fidelity default.
+    // The shareable `sessions render` surface passes `omit` explicitly.
+    const reasoning = opts.reasoning ?? 'include';
+    const maxToolOutputChars = opts.maxToolOutputChars ?? 4000;
     for (const event of events) {
         if (event.type === 'message') {
             if (event.role === 'user') {
@@ -937,27 +950,37 @@ export function renderConversationMarkdown(events, opts = {}) {
             }
         }
         else if (event.type === 'thinking') {
-            if (event.content)
-                parts.push(`### Thinking\n\n${sanitize(event.content)}`);
+            if (event.content && reasoning === 'include') {
+                parts.push(`### Reasoning\n\n${sanitize(event.content)}`);
+            }
+            else if (event.content && reasoning === 'fold') {
+                parts.push(`<details>\n<summary>Reasoning</summary>\n\n${sanitize(event.content)}\n\n</details>`);
+            }
         }
         else if (event.type === 'tool_use') {
             const tool = event.tool || 'unknown';
             if (event.command) {
-                parts.push(`### Tool: ${tool}\n\n\`\`\`bash\n${sanitize(event.command)}\n\`\`\``);
+                const args = event.args && Object.keys(event.args).length > 0
+                    ? `\n\nArguments:\n\n${markdownFence(sanitize(JSON.stringify(event.args, null, 2)), 'json')}`
+                    : '';
+                parts.push(`### Tool: ${tool}\n\n${markdownFence(sanitize(event.command), 'bash')}${args}`);
+            }
+            else if (event.args && Object.keys(event.args).length > 0) {
+                parts.push(`### Tool: ${tool}\n\nArguments:\n\n${markdownFence(sanitize(JSON.stringify(event.args, null, 2)), 'json')}`);
             }
             else if (event.path) {
-                parts.push(`### Tool: ${tool}\n\n\`${shortenPathTrace(event.path)}\``);
+                parts.push(`### Tool: ${tool}\n\n\`${sanitize(shortenPathTrace(event.path))}\``);
             }
             else {
                 const summary = summarizeToolUse(tool, event.args);
-                parts.push(`### Tool: ${tool}\n\n${summary}`);
+                parts.push(`### Tool: ${tool}\n\n${sanitize(summary)}`);
             }
         }
         else if (event.type === 'tool_result') {
-            if (event.content) {
-                const truncated = event.content.length > 2000 ? event.content.slice(0, 2000) + '\n…' : event.content;
-                const body = sanitize(truncated);
-                parts.push(`### Tool Result\n\n\`\`\`\n${body}\n\`\`\``);
+            const output = event.content || event.output;
+            if (output) {
+                const body = sanitize(truncateToolOutput(output, maxToolOutputChars));
+                parts.push(`### Tool Result${event.tool ? `: ${event.tool}` : ''}\n\n${markdownFence(body)}`);
             }
         }
         else if (event.type === 'error') {