@sayknow-cli/coding-agent 0.5.1 → 0.5.6

package/src/sdk/session.ts

@@ -2272,13 +2272,14 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			};
 		};
 
+		const explicitlyDisabledTools = options.toolNames?.length === 0;
 		const toolNamesFromRegistry = Array.from(toolRegistry.keys());
 		const hasExplicitToolNames = options.toolNames !== undefined;
 		const requestedToolNames = hasExplicitToolNames
 			? [
 					...new Set([
 						...options.toolNames!.map(name => name.toLowerCase()),
-						...(settings.get("goal.enabled") ? ["goal"] : []),
+						...(settings.get("goal.enabled") && !explicitlyDisabledTools ? ["goal"] : []),
 					]),
 				]
 			: toolNamesFromRegistry;
@@ -2298,7 +2299,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			registeredTools.filter(tool => tool.definition.defaultInactive).map(tool => tool.definition.name),
 		);
 		const requestedActiveToolNames = normalizedRequested;
-		const initialRequestedActiveToolNames = options.toolNames
+		const initialRequestedActiveToolNames = hasExplicitToolNames
 			? requestedActiveToolNames
 			: requestedActiveToolNames.filter(name => !defaultInactiveToolNames.has(name));
 		const discoverableMCPToolNames = new Set<string>();
@@ -2348,11 +2349,13 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			];
 			hasExplicitMCPToolSelection =
 				hasExplicitToolNames && (options.toolNames!.length === 0 || selectableExplicitMCPToolNames.length > 0);
-			initialSelectedMCPToolNames = existingSession.hasPersistedMCPToolSelection
-				? restoredSelectedMCPToolNames
-				: hasExplicitMCPToolSelection
-					? selectableExplicitMCPToolNames
-					: defaultSelectedMCPToolNames;
+			initialSelectedMCPToolNames = explicitlyDisabledTools
+				? []
+				: existingSession.hasPersistedMCPToolSelection
+					? restoredSelectedMCPToolNames
+					: hasExplicitMCPToolSelection
+						? selectableExplicitMCPToolNames
+						: defaultSelectedMCPToolNames;
 			initialToolNames = [
 				...new Set([
 					...initialRequestedActiveToolNames.filter(name => !discoverableMCPToolNames.has(name)),
@@ -2361,14 +2364,15 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			];
 		}
 
-		// Custom, extension-registered, and plugin-bundle MCP tools are always
-		// included regardless of the caller's built-in tool filter. Plugin MCPs
-		// remain always-on even when generic MCP discovery is disabled.
-		const alwaysInclude: string[] = [
-			...(options.customTools?.map(t => (isCustomTool(t) ? t.name : t.name)) ?? []),
-			...registeredTools.filter(t => !t.definition.defaultInactive).map(t => t.definition.name),
-			...pluginMcpToolNames,
-		];
+		// Custom, extension-registered, and plugin-bundle MCP tools bypass
+		// built-in filtering, but not an explicit zero-tool selection.
+		const alwaysInclude: string[] = explicitlyDisabledTools
+			? []
+			: [
+					...(options.customTools?.map(t => (isCustomTool(t) ? t.name : t.name)) ?? []),
+					...registeredTools.filter(t => !t.definition.defaultInactive).map(t => t.definition.name),
+					...pluginMcpToolNames,
+				];
 		const pluginMcpToolNameSet = new Set(pluginMcpToolNames);
 		for (const name of alwaysInclude) {
 			if (mcpDiscoveryEnabled && discoverableMCPToolNames.has(name) && !pluginMcpToolNameSet.has(name)) {
@@ -2414,9 +2418,11 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 				allowedDiscoveredBuiltinNames,
 				essentialBuiltinNames,
 			);
-			initialSelectedDiscoveredBuiltinToolNames = existingSession.hasPersistedDiscoveredBuiltinToolSelection
-				? restoredDiscoveredNames
-				: explicitlyRequestedDiscoveredBuiltinToolNames;
+			initialSelectedDiscoveredBuiltinToolNames = explicitlyDisabledTools
+				? []
+				: existingSession.hasPersistedDiscoveredBuiltinToolSelection
+					? restoredDiscoveredNames
+					: explicitlyRequestedDiscoveredBuiltinToolNames;
 			initialToolNames = [...new Set([...baselineInitialToolNames, ...initialSelectedDiscoveredBuiltinToolNames])];
 			hasExplicitDiscoveredBuiltinToolSelection =
 				hasExplicitToolNames &&
@@ -2717,6 +2723,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 			workspaceTree: resolvedWorkspaceTree,
 			reloadSshTool,
 			requestedToolNames: requestedToolNameSet,
+			explicitlyDisabledTools,
 			discoverableToolAllowedNames: options.discoverableToolAllowedNames,
 			mcpDiscoveryEnabled,
 			discoveryMode: effectiveDiscoveryMode,

package/src/session/agent-session.ts

@@ -545,6 +545,8 @@ export interface AgentSessionConfig {
 	/** Rebuild the SSH tool from current capability discovery results. */
 	reloadSshTool?: () => Promise<AgentTool | null>;
 	requestedToolNames?: ReadonlySet<string>;
+	/** True only when the caller explicitly selected no tools. */
+	explicitlyDisabledTools?: boolean;
 	/** Optional per-session allowlist for tools exposed through search_tool_bm25. */
 	discoverableToolAllowedNames?: readonly string[];
 	/** Optional accessor for live MCP server instructions, injected as untrusted user-role request data. */
@@ -1547,6 +1549,27 @@ type SessionAdmissionLease = {
 	release(): void;
 };
 
+const TODO_WRITE_INFRASTRUCTURE_ERROR =
+	/(?:HTTP2StreamReset|ECONNRESET|ECONNREFUSED|ETIMEDOUT|network error|transport error|connection reset|stream reset|timed out|timeout|fetching https?:)/iu;
+const TODO_WRITE_ERROR_CONTEXT_LIMIT = 1_000;
+
+export function buildTodoWriteFailureReminder(errorText: string | undefined, failureCount: number): string {
+	const normalizedError = errorText?.trim().slice(0, TODO_WRITE_ERROR_CONTEXT_LIMIT);
+	const shouldRetry =
+		failureCount === 1 && (!normalizedError || !TODO_WRITE_INFRASTRUCTURE_ERROR.test(normalizedError));
+	const directive = shouldRetry
+		? "Correct the todo_write payload and retry once with a minimal argument object. If that retry fails, do not call todo_write again in this user turn; continue the requested work using a checklist in reasoning."
+		: "Do not call todo_write again in this user turn. Continue the requested work now, track the remaining steps in reasoning, and report progress directly.";
+
+	return [
+		"<system-reminder>",
+		"todo_write failed, so todo progress is not visible to the user.",
+		normalizedError ? `Failure: ${normalizedError}` : "Failure: todo_write returned an error.",
+		directive,
+		"</system-reminder>",
+	].join("\n");
+}
+
 export class AgentSession {
 	readonly agent: Agent;
 	readonly sessionManager: SessionManager;
@@ -1727,6 +1750,7 @@ export class AgentSession {
 	// Handoff state
 	#handoffAbortController: AbortController | undefined = undefined;
 	#skipPostTurnMaintenanceAssistantTimestamp: number | undefined = undefined;
+	#suppressNextPostTurnMaintenanceAfterAutoHandoff = false;
 
 	// Retry state
 	#retryAbortController: AbortController | undefined = undefined;
@@ -1738,8 +1762,10 @@ export class AgentSession {
 	#overflowMaintenanceAttempts = 0;
 	#defaultFallbackExhaustedLastTurn = false;
 	#fallbackInvocationId = 0;
+	#fallbackSuppressedSelectors = new Set<string>();
 	// Todo completion reminder state
 	#todoReminderCount = 0;
+	#todoWriteFailureCount = 0;
 	#deepInterviewUserIntentEpoch = 0;
 	#deepInterviewTurnOwnerEpoch = 0;
 	#deepInterviewGenuineUserMessageEpochs = new WeakMap<object, number>();
@@ -1831,6 +1857,7 @@ export class AgentSession {
 	#getMcpServerInstructions: (() => Map<string, string> | undefined) | undefined;
 	#reloadSshTool: (() => Promise<AgentTool | null>) | undefined;
 	#requestedToolNames: ReadonlySet<string> | undefined;
+	#explicitlyDisabledTools: boolean;
 	#baseSystemPrompt: string[];
 	#initialWorkspaceTree: WorkspaceTree | undefined;
 	/** Throttle cache for the per-turn volatile workspace-tree scan (see #buildVolatileProjectContextMessage). */
@@ -2021,6 +2048,12 @@ export class AgentSession {
 		});
 	}
 
+	#sessionTransitionAdmissionBusyError(): AgentBusyError {
+		return Object.assign(new AgentBusyError("Cannot start a turn while a session transition is in progress."), {
+			code: "busy",
+		});
+	}
+
 	/**
 	 * Reject a turn start while a handoff transition owns the session. Handoff never
 	 * routes its own generation/injection through these turn-start chokepoints, and
@@ -2046,6 +2079,7 @@ export class AgentSession {
 	 * orchestrator does not hold it), so there is no self-deadlock.
 	 */
 	#sessionTransitionKind: string | undefined;
+	#sessionTurnAdmissionFenced = false;
 
 	#beginSessionTransition(kind: string): void {
 		if (this.#sessionTransitionKind !== undefined) {
@@ -2086,6 +2120,7 @@ export class AgentSession {
 				code: "busy",
 			});
 		}
+		if (this.#sessionTurnAdmissionFenced) throw this.#sessionTransitionAdmissionBusyError();
 
 		const entry: SessionAdmissionEntry = {
 			kind,
@@ -2114,6 +2149,13 @@ export class AgentSession {
 				code: "busy",
 			});
 		}
+		if (this.#sessionTurnAdmissionFenced) {
+			entry.released = true;
+			entry.settled.resolve();
+			if (this.#activeSessionAdmission === entry) this.#activeSessionAdmission = undefined;
+			this.#activateNextSessionAdmission();
+			throw this.#sessionTransitionAdmissionBusyError();
+		}
 
 		const release = () => {
 			if (entry.released) return;
@@ -2350,6 +2392,7 @@ export class AgentSession {
 		this.#toolRegistry = config.toolRegistry ?? new Map();
 		this.#workflowGateToolSession = config.workflowGateToolSession;
 		this.#requestedToolNames = config.requestedToolNames;
+		this.#explicitlyDisabledTools = config.explicitlyDisabledTools === true;
 		this.#transformContext = config.transformContext ?? (messages => messages);
 		this.#onPayload = config.onPayload;
 		this.rawSseDebugBuffer = config.rawSseDebugBuffer ?? new RawSseDebugBuffer();
@@ -3757,8 +3800,9 @@ export class AgentSession {
 					this.#resolveTtsrResume();
 				}
 				this.#queueDeferredTtsrInjectionIfNeeded(assistantMsg);
-				if (this.#handoffAbortController) {
+				if (this.#handoffAbortController || this.#suppressNextPostTurnMaintenanceAfterAutoHandoff) {
 					this.#skipPostTurnMaintenanceAssistantTimestamp = assistantMsg.timestamp;
+					this.#suppressNextPostTurnMaintenanceAfterAutoHandoff = false;
 				}
 				if (
 					assistantMsg.stopReason !== "error" &&
@@ -3794,24 +3838,21 @@ export class AgentSession {
 				if (toolName === "edit" && details?.path) {
 					this.#invalidateFileCacheForPath(details.path);
 				}
-				if (toolName === "todo_write" && !isError && Array.isArray(details?.phases)) {
-					this.setTodoPhases(details.phases);
+				if (toolName === "todo_write" && !isError) {
+					this.#todoWriteFailureCount = 0;
+					if (Array.isArray(details?.phases)) {
+						this.setTodoPhases(details.phases);
+					}
 				}
 				if (toolName === "todo_write" && isError) {
+					this.#todoWriteFailureCount++;
 					const errorText = content?.find(part => part.type === "text")?.text;
-					const reminderText = [
-						"<system-reminder>",
-						"todo_write failed, so todo progress is not visible to the user.",
-						errorText ? `Failure: ${errorText}` : "Failure: todo_write returned an error.",
-						"Fix the todo payload and call todo_write again before continuing.",
-						"</system-reminder>",
-					].join("\n");
 					await this.sendCustomMessage(
 						{
 							customType: "todo-write-error-reminder",
-							content: reminderText,
+							content: buildTodoWriteFailureReminder(errorText, this.#todoWriteFailureCount),
 							display: false,
-							details: { toolName, errorText },
+							details: { toolName, errorText, failureCount: this.#todoWriteFailureCount },
 						},
 						{ deliverAs: "nextTurn" },
 					);
@@ -5853,6 +5894,7 @@ export class AgentSession {
 	}
 
 	async activateDiscoveredTools(toolNames: string[]): Promise<string[]> {
+		if (this.#explicitlyDisabledTools) return [];
 		const previousSelectedMCPToolNames = this.getSelectedMCPToolNames();
 		const previousSelectedDiscoveredBuiltinToolNames = this.#getSelectedDiscoveredBuiltinToolNames();
 		const nextActiveToolNames = this.getActiveToolNames();
@@ -6080,7 +6122,9 @@ export class AgentSession {
 			nextSelectedDiscoveredBuiltinToolNames?: string[];
 		},
 	): Promise<void> {
-		toolNames = [...new Set([...toolNames.map(name => name.toLowerCase()), ...this.#mandatoryMCPToolNames])];
+		toolNames = this.#explicitlyDisabledTools
+			? []
+			: [...new Set([...toolNames.map(name => name.toLowerCase()), ...this.#mandatoryMCPToolNames])];
 		const previousSelectedMCPToolNames = options?.previousSelectedMCPToolNames ?? this.getSelectedMCPToolNames();
 		const previousSelectedDiscoveredBuiltinToolNames =
 			options?.previousSelectedDiscoveredBuiltinToolNames ?? this.#getSelectedDiscoveredBuiltinToolNames();
@@ -6190,6 +6234,11 @@ export class AgentSession {
 		await this.#applyActiveToolsByName(nextActive);
 	}
 
+	/** Whether the caller explicitly selected no tools for this session. */
+	hasExplicitlyDisabledTools(): boolean {
+		return this.#explicitlyDisabledTools;
+	}
+
 	/**
 	 * Set active tools by name.
 	 * Only tools in the registry can be enabled. Unknown tool names are ignored.
@@ -6201,6 +6250,11 @@ export class AgentSession {
 	}
 
 	async #restoreMCPSelectionsForSessionContext(sessionContext: SessionContext): Promise<void> {
+		if (this.#explicitlyDisabledTools) {
+			this.#selectedDiscoveredToolNames.clear();
+			await this.#applyActiveToolsByName([], { persistMCPSelection: false });
+			return;
+		}
 		if (!this.#mcpDiscoveryEnabled && this.#resolveEffectiveDiscoveryMode() !== "all") {
 			await this.#attachAskToolIfWorkflowActive();
 			return;
@@ -7054,6 +7108,7 @@ export class AgentSession {
 			this.#toolRegistry.set(askTool.name, askTool);
 		}
 
+		if (this.#explicitlyDisabledTools) return;
 		try {
 			if ((this.#workflowGateEmitter?.listPendingGates?.().length ?? 0) > 0) {
 				this.#attachAskTool();
@@ -7099,6 +7154,7 @@ export class AgentSession {
 	}
 
 	#attachAskTool(): void {
+		if (this.#explicitlyDisabledTools) return;
 		const askTool = this.#toolRegistry.get("ask");
 		if (!askTool || this.getActiveToolNames().includes(askTool.name)) return;
 		this.#setGuardedAgentTools([...this.agent.state.tools, askTool]);
@@ -7181,6 +7237,7 @@ export class AgentSession {
 	}
 
 	async #activatePendingSkcGoalModeRequest(): Promise<boolean> {
+		if (this.#explicitlyDisabledTools) return false;
 		if (!this.settings.get("goal.enabled")) return false;
 		const pendingGoal = await consumePendingGoalModeRequest(
 			this.sessionManager.getCwd(),
@@ -7193,9 +7250,10 @@ export class AgentSession {
 		}
 
 		const previousTools = this.getActiveToolNames();
-		const goalTools = [...new Set([...previousTools, "goal"])];
 		await this.#goalRuntime.createGoal({ objective: pendingGoal.objective, provenance: pendingGoal.provenance });
-		await this.setActiveToolsByName(goalTools);
+		if (!this.#explicitlyDisabledTools) {
+			await this.setActiveToolsByName([...new Set([...previousTools, "goal"])]);
+		}
 		if (this.isStreaming) {
 			await this.sendGoalModeContext({ deliverAs: "steer" });
 		}
@@ -7793,6 +7851,7 @@ export class AgentSession {
 				this.#defaultFallbackChain().resetAttemptBudget();
 				this.#overflowMaintenanceAttempts = 0;
 				this.#throwIfPromptPreflightCancelled(generation, preflightSignal);
+				this.#todoWriteFailureCount = 0;
 			}
 			// Flush any pending bash messages before the new prompt
 			this.#flushPendingBashMessages();
@@ -9452,7 +9511,6 @@ export class AgentSession {
 					persistMCPSelection: false,
 					nextSelectedDiscoveredBuiltinToolNames: [],
 				});
-			} else {
 			}
 		}
 		this.#todoReminderCount = 0;
@@ -10046,7 +10104,13 @@ export class AgentSession {
 			});
 			if (!resolved.model) continue;
 
-			if (roleModels.some(candidate => modelsAreEqual(candidate.model, resolved.model))) continue;
+			if (
+				roleModels.some(
+					candidate =>
+						modelsAreEqual(candidate.model, resolved.model) && candidate.thinkingLevel === resolved.thinkingLevel,
+				)
+			)
+				continue;
 			roleModels.push({
 				role,
 				model: resolved.model,
@@ -11606,6 +11670,11 @@ export class AgentSession {
 		this.#resourceSampler = sampler;
 	}
 
+	/** Test seam: drive the pre-prompt emergency/threshold check directly. */
+	runPrePromptContextCheckForTests(pendingMessages: readonly AgentMessage[] = []): Promise<void> {
+		return this.#checkEstimatedContextBeforePrompt(pendingMessages);
+	}
+
 	setRetainedMemorySampler(sampler: (() => RetainedMemorySample) | undefined): void {
 		this.#retainedMemorySampler = sampler;
 	}
@@ -11639,26 +11708,31 @@ export class AgentSession {
 			materializedResidentBytes: this.#streamingEditFileCache.totalBytes,
 			tuiChatChildren: retainedMemory.tuiChatChildren ?? 0,
 			tuiCachedRenderBytes: retainedMemory.tuiCachedRenderBytes ?? 0,
+			transcriptFileBytes: this.sessionManager.getTranscriptFileBytes(),
 		};
 	}
 
 	async #checkEstimatedContextBeforePromptOnce(pendingMessages: readonly AgentMessage[]): Promise<void> {
 		const model = this.model;
 		if (!model) return;
-		const contextWindow = model.contextWindow ?? 0;
-		if (contextWindow <= 0) return;
 		// F6: non-disableable emergency floor — compact before OOM even when token-based
 		// compaction is disabled or its threshold is set too high (weak-hardware protection).
 		const emergencyReason = emergencyCompactionReason(this.#resourceSampler());
 		if (emergencyReason) {
 			logger.warn("Emergency compaction triggered (resource floor exceeded)", { reason: emergencyReason });
-			await this.#runAutoCompaction("overflow", false, false, {
+			const status = await this.#runAutoCompaction("overflow", false, false, {
 				continueAfterMaintenance: false,
 				deferHandoffMaintenance: false,
 				force: true,
 			});
+			if (emergencyReason === "transcriptFile" && status.kind === "skipped") {
+				logger.warn("Transcript emergency compaction was skipped; rewriting exact live entries");
+				await this.sessionManager.rewriteEntries();
+			}
 			return;
 		}
+		const contextWindow = model.contextWindow ?? 0;
+		if (contextWindow <= 0) return;
 		const compactionSettings = this.settings.getGroup("compaction");
 		if (!compactionSettings.enabled || compactionSettings.strategy === "off") return;
 
@@ -11692,6 +11766,7 @@ export class AgentSession {
 			await this.#runAutoCompaction("threshold", false, false, {
 				continueAfterMaintenance: false,
 				deferHandoffMaintenance: false,
+				suppressNextPostTurnMaintenanceAfterHandoff: true,
 			});
 		}
 	}
@@ -11783,6 +11858,7 @@ export class AgentSession {
 			return;
 		}
 
+		if (this.#explicitlyDisabledTools) return;
 		this.#attachAskTool();
 
 		const reminder = prompt.render(planModeToolDecisionReminderPrompt, {
@@ -12682,6 +12758,7 @@ export class AgentSession {
 			force?: boolean;
 			signal?: AbortSignal;
 			beforeTerminalOverflowNoop?: () => void;
+			suppressNextPostTurnMaintenanceAfterHandoff?: boolean;
 		},
 	): Promise<AutoCompactionTerminalStatus> {
 		const compactionSettings = this.settings.getGroup("compaction");
@@ -12763,6 +12840,9 @@ export class AgentSession {
 				if (autoCompactionSignal.aborted) return await emitAborted();
 
 				if (handoffResult) {
+					if (options?.suppressNextPostTurnMaintenanceAfterHandoff) {
+						this.#suppressNextPostTurnMaintenanceAfterAutoHandoff = true;
+					}
 					await this.#emitSessionEvent({
 						type: "auto_compaction_end",
 						action,
@@ -13482,12 +13562,15 @@ export class AgentSession {
 			if (controller.chain.entries.length > 1) await this.#advanceDefaultFallback(controller, "new_turn", 0);
 			return;
 		}
+		const primarySelector = controller.chain.entries[0];
 		if (
 			this.settings.get("retry.fallbackRevertPolicy") === "cooldown-expiry" &&
-			controller.activeIndex > 0
-			// TODO(upstream-v0.11): ModelRegistry.getSelectorSuppressionStatus was removed;
-			// rewire the cooldown-expiry revert policy to the new suppression API when available.
+			controller.activeIndex > 0 &&
+			primarySelector &&
+			this.#fallbackSuppressedSelectors.has(primarySelector) &&
+			!this.#modelRegistry.isSelectorSuppressed(primarySelector)
 		) {
+			this.#fallbackSuppressedSelectors.delete(primarySelector);
 			controller.resetForNewTurn();
 		}
 	}
@@ -13540,7 +13623,9 @@ export class AgentSession {
 		const existing = this.#defaultFallbackController;
 		if (
 			existing &&
-			(existing.chain.origin === "runtime" || existing.chain.entries.join("\u0000") === chain.entries.join("\u0000"))
+			(existing.chain.origin === "runtime" ||
+				(existing.activeIndex > 0 && existing.chain.entries.length > 1) ||
+				existing.chain.entries.join("\u0000") === chain.entries.join("\u0000"))
 		) {
 			return existing;
 		}
@@ -13826,6 +13911,7 @@ export class AgentSession {
 
 		if (managedFallback && trigger.class === "rate_limit" && trigger.retryAfterMs !== undefined && failedSelector) {
 			this.#modelRegistry.suppressSelector(failedSelector, Date.now() + trigger.retryAfterMs);
+			this.#fallbackSuppressedSelectors.add(failedSelector);
 		}
 
 		const retry = async (ownership?: ManagedAttemptContinuationOwnership): Promise<void> => {
@@ -15054,14 +15140,22 @@ export class AgentSession {
 	 * Switch to a different session file.
 	 * Aborts current operation, loads messages, restores model/thinking.
 	 * Listeners are preserved and will continue receiving events.
+	 * `requireIdle` rejects an active turn and fences new admissions for the transition.
 	 * @returns true if switch completed, false if cancelled by hook
 	 */
 	async switchSession(
 		sessionPath: string,
-		options?: { transition?: SessionSwitchEvent["transition"] },
+		options?: { transition?: SessionSwitchEvent["transition"]; requireIdle?: boolean },
 	): Promise<boolean> {
 		this.#beginSessionTransition("switch-session");
 		try {
+			if (options?.requireIdle) {
+				this.#sessionTurnAdmissionFenced = true;
+				if (this.isStreaming || this.#activeSessionAdmission !== undefined)
+					throw Object.assign(new AgentBusyError("Cannot switch sessions while a response or turn is active."), {
+						code: "busy",
+					});
+			}
 			const previousSessionFile = this.sessionManager.getSessionFile();
 			const switchingToDifferentSession = previousSessionFile
 				? path.resolve(previousSessionFile) !== path.resolve(sessionPath)
@@ -15287,6 +15381,7 @@ export class AgentSession {
 				throw error;
 			}
 		} finally {
+			this.#sessionTurnAdmissionFenced = false;
 			this.#endSessionTransition();
 		}
 	}

package/src/session/internal/managed-session-scope.ts

@@ -702,7 +702,7 @@ function inspectCandidate(filePath: string, provenance: "v2" | "legacy"): Manage
 			provenance,
 			migrationState: provenance === "v2" ? "native_v2" : "legacy_unmigrated",
 			identity: {
-				canonicalPath: path.resolve(filePath),
+				canonicalPath: canonicalizeTrustedPath(filePath),
 				sessionId: header.id,
 				...snapshot.identity,
 				mtimeMs: Number(named.mtimeMs),
@@ -740,6 +740,7 @@ function listDirectoryCandidates(
 	directory: string,
 	provenance: "v2" | "legacy",
 	scope: ManagedScope,
+	maxCandidates?: number,
 ): readonly CandidateInspection[] {
 	let directoryStat: fs.Stats;
 	try {
@@ -749,8 +750,28 @@ function listDirectoryCandidates(
 		throw error;
 	}
 	if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) throw new Error("unsafe directory");
-	return fs
-		.readdirSync(directory, { withFileTypes: true })
+	let entries: fs.Dirent[];
+	if (maxCandidates === undefined) {
+		entries = fs.readdirSync(directory, { withFileTypes: true });
+	} else {
+		entries = [];
+		let scannedEntries = 0;
+		const handle = fs.opendirSync(directory);
+		try {
+			for (;;) {
+				const entry = handle.readSync();
+				if (!entry) break;
+				scannedEntries++;
+				if (scannedEntries > maxCandidates * 4 + 128) throw new Error("candidate_capacity_exceeded");
+				if (!entry.name.endsWith(".jsonl")) continue;
+				entries.push(entry);
+				if (entries.length > maxCandidates) throw new Error("candidate_capacity_exceeded");
+			}
+		} finally {
+			handle.closeSync();
+		}
+	}
+	return entries
 		.filter(entry => entry.name.endsWith(".jsonl"))
 		.map(entry => {
 			const filePath = path.join(directory, entry.name);
@@ -967,7 +988,10 @@ export function prepareManagedSessionScopeForWriteSync(
 	}
 }
 
-export function listManagedCandidates(scope: ManagedScope): ManagedCandidateListing {
+export function listManagedCandidates(
+	scope: ManagedScope,
+	options?: { maxCandidates?: number },
+): ManagedCandidateListing {
 	try {
 		let root: fs.Stats;
 		try {
@@ -990,8 +1014,19 @@ export function listManagedCandidates(scope: ManagedScope): ManagedCandidateList
 			})),
 		];
 		const seen = new Set<string>();
+		let inspectedCandidates = 0;
 		for (const directory of directories) {
-			for (const candidate of listDirectoryCandidates(directory.path, directory.provenance, scope)) {
+			const remainingCandidates =
+				options?.maxCandidates === undefined ? undefined : options.maxCandidates - inspectedCandidates;
+			for (const candidate of listDirectoryCandidates(
+				directory.path,
+				directory.provenance,
+				scope,
+				remainingCandidates,
+			)) {
+				inspectedCandidates++;
+				if (options?.maxCandidates !== undefined && inspectedCandidates > options.maxCandidates)
+					throw new Error("candidate_capacity_exceeded");
 				if ("code" in candidate) {
 					invalid.push({ code: candidate.code });
 					continue;
@@ -1108,7 +1143,7 @@ function sameCandidate(left: ManagedCandidate, right: ManagedCandidate): boolean
 
 function matchesExpectedResumeIdentity(candidate: ManagedCandidate, expected: ResumeSessionIdentity): boolean {
 	return (
-		path.resolve(candidate.identity.canonicalPath) === path.resolve(expected.canonicalPath) &&
+		canonicalizeTrustedPath(candidate.identity.canonicalPath) === canonicalizeTrustedPath(expected.canonicalPath) &&
 		candidate.identity.sessionId === expected.sessionId &&
 		candidate.identity.dev === expected.dev &&
 		candidate.identity.ino === expected.ino &&

package/src/session/internal/managed-session-storage.ts

@@ -880,6 +880,20 @@ export class ManagedSessionDescendantStore {
 		};
 	}
 
+	/** Read only the exact managed file size through the retained root authority. */
+	sizeSync(relativePath: string): number | null {
+		this.#assertBound();
+		if (!this.#authority) throw new Error("managed_size_authority_unavailable");
+		const relative = this.#relative(this.#resolve(relativePath));
+		const result = this.#authority.stat(relative);
+		if (!result.ok) {
+			if (result.code === "not_found") return null;
+			throw new Error(result.code ?? "managed_size_failed");
+		}
+		if (!result.identity) throw new Error("Managed descendant identity is unavailable");
+		return Number(result.identity.size);
+	}
+
 	/** Remove an exact captured file without reopening its pathname as authority. */
 	removeExpected(relativePath: string, expected: ManagedFileSnapshot): void {
 		this.#assertBound();