@sayknow-cli/coding-agent 0.5.2 → 0.5.6

package/src/session/agent-session.ts

@@ -545,6 +545,8 @@ export interface AgentSessionConfig {
 	/** Rebuild the SSH tool from current capability discovery results. */
 	reloadSshTool?: () => Promise<AgentTool | null>;
 	requestedToolNames?: ReadonlySet<string>;
+	/** True only when the caller explicitly selected no tools. */
+	explicitlyDisabledTools?: boolean;
 	/** Optional per-session allowlist for tools exposed through search_tool_bm25. */
 	discoverableToolAllowedNames?: readonly string[];
 	/** Optional accessor for live MCP server instructions, injected as untrusted user-role request data. */
@@ -1748,6 +1750,7 @@ export class AgentSession {
 	// Handoff state
 	#handoffAbortController: AbortController | undefined = undefined;
 	#skipPostTurnMaintenanceAssistantTimestamp: number | undefined = undefined;
+	#suppressNextPostTurnMaintenanceAfterAutoHandoff = false;
 
 	// Retry state
 	#retryAbortController: AbortController | undefined = undefined;
@@ -1759,6 +1762,7 @@ export class AgentSession {
 	#overflowMaintenanceAttempts = 0;
 	#defaultFallbackExhaustedLastTurn = false;
 	#fallbackInvocationId = 0;
+	#fallbackSuppressedSelectors = new Set<string>();
 	// Todo completion reminder state
 	#todoReminderCount = 0;
 	#todoWriteFailureCount = 0;
@@ -1853,6 +1857,7 @@ export class AgentSession {
 	#getMcpServerInstructions: (() => Map<string, string> | undefined) | undefined;
 	#reloadSshTool: (() => Promise<AgentTool | null>) | undefined;
 	#requestedToolNames: ReadonlySet<string> | undefined;
+	#explicitlyDisabledTools: boolean;
 	#baseSystemPrompt: string[];
 	#initialWorkspaceTree: WorkspaceTree | undefined;
 	/** Throttle cache for the per-turn volatile workspace-tree scan (see #buildVolatileProjectContextMessage). */
@@ -2043,6 +2048,12 @@ export class AgentSession {
 		});
 	}
 
+	#sessionTransitionAdmissionBusyError(): AgentBusyError {
+		return Object.assign(new AgentBusyError("Cannot start a turn while a session transition is in progress."), {
+			code: "busy",
+		});
+	}
+
 	/**
 	 * Reject a turn start while a handoff transition owns the session. Handoff never
 	 * routes its own generation/injection through these turn-start chokepoints, and
@@ -2068,6 +2079,7 @@ export class AgentSession {
 	 * orchestrator does not hold it), so there is no self-deadlock.
 	 */
 	#sessionTransitionKind: string | undefined;
+	#sessionTurnAdmissionFenced = false;
 
 	#beginSessionTransition(kind: string): void {
 		if (this.#sessionTransitionKind !== undefined) {
@@ -2108,6 +2120,7 @@ export class AgentSession {
 				code: "busy",
 			});
 		}
+		if (this.#sessionTurnAdmissionFenced) throw this.#sessionTransitionAdmissionBusyError();
 
 		const entry: SessionAdmissionEntry = {
 			kind,
@@ -2136,6 +2149,13 @@ export class AgentSession {
 				code: "busy",
 			});
 		}
+		if (this.#sessionTurnAdmissionFenced) {
+			entry.released = true;
+			entry.settled.resolve();
+			if (this.#activeSessionAdmission === entry) this.#activeSessionAdmission = undefined;
+			this.#activateNextSessionAdmission();
+			throw this.#sessionTransitionAdmissionBusyError();
+		}
 
 		const release = () => {
 			if (entry.released) return;
@@ -2372,6 +2392,7 @@ export class AgentSession {
 		this.#toolRegistry = config.toolRegistry ?? new Map();
 		this.#workflowGateToolSession = config.workflowGateToolSession;
 		this.#requestedToolNames = config.requestedToolNames;
+		this.#explicitlyDisabledTools = config.explicitlyDisabledTools === true;
 		this.#transformContext = config.transformContext ?? (messages => messages);
 		this.#onPayload = config.onPayload;
 		this.rawSseDebugBuffer = config.rawSseDebugBuffer ?? new RawSseDebugBuffer();
@@ -3779,8 +3800,9 @@ export class AgentSession {
 					this.#resolveTtsrResume();
 				}
 				this.#queueDeferredTtsrInjectionIfNeeded(assistantMsg);
-				if (this.#handoffAbortController) {
+				if (this.#handoffAbortController || this.#suppressNextPostTurnMaintenanceAfterAutoHandoff) {
 					this.#skipPostTurnMaintenanceAssistantTimestamp = assistantMsg.timestamp;
+					this.#suppressNextPostTurnMaintenanceAfterAutoHandoff = false;
 				}
 				if (
 					assistantMsg.stopReason !== "error" &&
@@ -5872,6 +5894,7 @@ export class AgentSession {
 	}
 
 	async activateDiscoveredTools(toolNames: string[]): Promise<string[]> {
+		if (this.#explicitlyDisabledTools) return [];
 		const previousSelectedMCPToolNames = this.getSelectedMCPToolNames();
 		const previousSelectedDiscoveredBuiltinToolNames = this.#getSelectedDiscoveredBuiltinToolNames();
 		const nextActiveToolNames = this.getActiveToolNames();
@@ -6099,7 +6122,9 @@ export class AgentSession {
 			nextSelectedDiscoveredBuiltinToolNames?: string[];
 		},
 	): Promise<void> {
-		toolNames = [...new Set([...toolNames.map(name => name.toLowerCase()), ...this.#mandatoryMCPToolNames])];
+		toolNames = this.#explicitlyDisabledTools
+			? []
+			: [...new Set([...toolNames.map(name => name.toLowerCase()), ...this.#mandatoryMCPToolNames])];
 		const previousSelectedMCPToolNames = options?.previousSelectedMCPToolNames ?? this.getSelectedMCPToolNames();
 		const previousSelectedDiscoveredBuiltinToolNames =
 			options?.previousSelectedDiscoveredBuiltinToolNames ?? this.#getSelectedDiscoveredBuiltinToolNames();
@@ -6209,6 +6234,11 @@ export class AgentSession {
 		await this.#applyActiveToolsByName(nextActive);
 	}
 
+	/** Whether the caller explicitly selected no tools for this session. */
+	hasExplicitlyDisabledTools(): boolean {
+		return this.#explicitlyDisabledTools;
+	}
+
 	/**
 	 * Set active tools by name.
 	 * Only tools in the registry can be enabled. Unknown tool names are ignored.
@@ -6220,6 +6250,11 @@ export class AgentSession {
 	}
 
 	async #restoreMCPSelectionsForSessionContext(sessionContext: SessionContext): Promise<void> {
+		if (this.#explicitlyDisabledTools) {
+			this.#selectedDiscoveredToolNames.clear();
+			await this.#applyActiveToolsByName([], { persistMCPSelection: false });
+			return;
+		}
 		if (!this.#mcpDiscoveryEnabled && this.#resolveEffectiveDiscoveryMode() !== "all") {
 			await this.#attachAskToolIfWorkflowActive();
 			return;
@@ -7073,6 +7108,7 @@ export class AgentSession {
 			this.#toolRegistry.set(askTool.name, askTool);
 		}
 
+		if (this.#explicitlyDisabledTools) return;
 		try {
 			if ((this.#workflowGateEmitter?.listPendingGates?.().length ?? 0) > 0) {
 				this.#attachAskTool();
@@ -7118,6 +7154,7 @@ export class AgentSession {
 	}
 
 	#attachAskTool(): void {
+		if (this.#explicitlyDisabledTools) return;
 		const askTool = this.#toolRegistry.get("ask");
 		if (!askTool || this.getActiveToolNames().includes(askTool.name)) return;
 		this.#setGuardedAgentTools([...this.agent.state.tools, askTool]);
@@ -7200,6 +7237,7 @@ export class AgentSession {
 	}
 
 	async #activatePendingSkcGoalModeRequest(): Promise<boolean> {
+		if (this.#explicitlyDisabledTools) return false;
 		if (!this.settings.get("goal.enabled")) return false;
 		const pendingGoal = await consumePendingGoalModeRequest(
 			this.sessionManager.getCwd(),
@@ -7212,9 +7250,10 @@ export class AgentSession {
 		}
 
 		const previousTools = this.getActiveToolNames();
-		const goalTools = [...new Set([...previousTools, "goal"])];
 		await this.#goalRuntime.createGoal({ objective: pendingGoal.objective, provenance: pendingGoal.provenance });
-		await this.setActiveToolsByName(goalTools);
+		if (!this.#explicitlyDisabledTools) {
+			await this.setActiveToolsByName([...new Set([...previousTools, "goal"])]);
+		}
 		if (this.isStreaming) {
 			await this.sendGoalModeContext({ deliverAs: "steer" });
 		}
@@ -9472,7 +9511,6 @@ export class AgentSession {
 					persistMCPSelection: false,
 					nextSelectedDiscoveredBuiltinToolNames: [],
 				});
-			} else {
 			}
 		}
 		this.#todoReminderCount = 0;
@@ -10066,7 +10104,13 @@ export class AgentSession {
 			});
 			if (!resolved.model) continue;
 
-			if (roleModels.some(candidate => modelsAreEqual(candidate.model, resolved.model))) continue;
+			if (
+				roleModels.some(
+					candidate =>
+						modelsAreEqual(candidate.model, resolved.model) && candidate.thinkingLevel === resolved.thinkingLevel,
+				)
+			)
+				continue;
 			roleModels.push({
 				role,
 				model: resolved.model,
@@ -11626,6 +11670,11 @@ export class AgentSession {
 		this.#resourceSampler = sampler;
 	}
 
+	/** Test seam: drive the pre-prompt emergency/threshold check directly. */
+	runPrePromptContextCheckForTests(pendingMessages: readonly AgentMessage[] = []): Promise<void> {
+		return this.#checkEstimatedContextBeforePrompt(pendingMessages);
+	}
+
 	setRetainedMemorySampler(sampler: (() => RetainedMemorySample) | undefined): void {
 		this.#retainedMemorySampler = sampler;
 	}
@@ -11659,26 +11708,31 @@ export class AgentSession {
 			materializedResidentBytes: this.#streamingEditFileCache.totalBytes,
 			tuiChatChildren: retainedMemory.tuiChatChildren ?? 0,
 			tuiCachedRenderBytes: retainedMemory.tuiCachedRenderBytes ?? 0,
+			transcriptFileBytes: this.sessionManager.getTranscriptFileBytes(),
 		};
 	}
 
 	async #checkEstimatedContextBeforePromptOnce(pendingMessages: readonly AgentMessage[]): Promise<void> {
 		const model = this.model;
 		if (!model) return;
-		const contextWindow = model.contextWindow ?? 0;
-		if (contextWindow <= 0) return;
 		// F6: non-disableable emergency floor — compact before OOM even when token-based
 		// compaction is disabled or its threshold is set too high (weak-hardware protection).
 		const emergencyReason = emergencyCompactionReason(this.#resourceSampler());
 		if (emergencyReason) {
 			logger.warn("Emergency compaction triggered (resource floor exceeded)", { reason: emergencyReason });
-			await this.#runAutoCompaction("overflow", false, false, {
+			const status = await this.#runAutoCompaction("overflow", false, false, {
 				continueAfterMaintenance: false,
 				deferHandoffMaintenance: false,
 				force: true,
 			});
+			if (emergencyReason === "transcriptFile" && status.kind === "skipped") {
+				logger.warn("Transcript emergency compaction was skipped; rewriting exact live entries");
+				await this.sessionManager.rewriteEntries();
+			}
 			return;
 		}
+		const contextWindow = model.contextWindow ?? 0;
+		if (contextWindow <= 0) return;
 		const compactionSettings = this.settings.getGroup("compaction");
 		if (!compactionSettings.enabled || compactionSettings.strategy === "off") return;
 
@@ -11712,6 +11766,7 @@ export class AgentSession {
 			await this.#runAutoCompaction("threshold", false, false, {
 				continueAfterMaintenance: false,
 				deferHandoffMaintenance: false,
+				suppressNextPostTurnMaintenanceAfterHandoff: true,
 			});
 		}
 	}
@@ -11803,6 +11858,7 @@ export class AgentSession {
 			return;
 		}
 
+		if (this.#explicitlyDisabledTools) return;
 		this.#attachAskTool();
 
 		const reminder = prompt.render(planModeToolDecisionReminderPrompt, {
@@ -12702,6 +12758,7 @@ export class AgentSession {
 			force?: boolean;
 			signal?: AbortSignal;
 			beforeTerminalOverflowNoop?: () => void;
+			suppressNextPostTurnMaintenanceAfterHandoff?: boolean;
 		},
 	): Promise<AutoCompactionTerminalStatus> {
 		const compactionSettings = this.settings.getGroup("compaction");
@@ -12783,6 +12840,9 @@ export class AgentSession {
 				if (autoCompactionSignal.aborted) return await emitAborted();
 
 				if (handoffResult) {
+					if (options?.suppressNextPostTurnMaintenanceAfterHandoff) {
+						this.#suppressNextPostTurnMaintenanceAfterAutoHandoff = true;
+					}
 					await this.#emitSessionEvent({
 						type: "auto_compaction_end",
 						action,
@@ -13502,12 +13562,15 @@ export class AgentSession {
 			if (controller.chain.entries.length > 1) await this.#advanceDefaultFallback(controller, "new_turn", 0);
 			return;
 		}
+		const primarySelector = controller.chain.entries[0];
 		if (
 			this.settings.get("retry.fallbackRevertPolicy") === "cooldown-expiry" &&
-			controller.activeIndex > 0
-			// TODO(upstream-v0.11): ModelRegistry.getSelectorSuppressionStatus was removed;
-			// rewire the cooldown-expiry revert policy to the new suppression API when available.
+			controller.activeIndex > 0 &&
+			primarySelector &&
+			this.#fallbackSuppressedSelectors.has(primarySelector) &&
+			!this.#modelRegistry.isSelectorSuppressed(primarySelector)
 		) {
+			this.#fallbackSuppressedSelectors.delete(primarySelector);
 			controller.resetForNewTurn();
 		}
 	}
@@ -13560,7 +13623,9 @@ export class AgentSession {
 		const existing = this.#defaultFallbackController;
 		if (
 			existing &&
-			(existing.chain.origin === "runtime" || existing.chain.entries.join("\u0000") === chain.entries.join("\u0000"))
+			(existing.chain.origin === "runtime" ||
+				(existing.activeIndex > 0 && existing.chain.entries.length > 1) ||
+				existing.chain.entries.join("\u0000") === chain.entries.join("\u0000"))
 		) {
 			return existing;
 		}
@@ -13846,6 +13911,7 @@ export class AgentSession {
 
 		if (managedFallback && trigger.class === "rate_limit" && trigger.retryAfterMs !== undefined && failedSelector) {
 			this.#modelRegistry.suppressSelector(failedSelector, Date.now() + trigger.retryAfterMs);
+			this.#fallbackSuppressedSelectors.add(failedSelector);
 		}
 
 		const retry = async (ownership?: ManagedAttemptContinuationOwnership): Promise<void> => {
@@ -15074,14 +15140,22 @@ export class AgentSession {
 	 * Switch to a different session file.
 	 * Aborts current operation, loads messages, restores model/thinking.
 	 * Listeners are preserved and will continue receiving events.
+	 * `requireIdle` rejects an active turn and fences new admissions for the transition.
 	 * @returns true if switch completed, false if cancelled by hook
 	 */
 	async switchSession(
 		sessionPath: string,
-		options?: { transition?: SessionSwitchEvent["transition"] },
+		options?: { transition?: SessionSwitchEvent["transition"]; requireIdle?: boolean },
 	): Promise<boolean> {
 		this.#beginSessionTransition("switch-session");
 		try {
+			if (options?.requireIdle) {
+				this.#sessionTurnAdmissionFenced = true;
+				if (this.isStreaming || this.#activeSessionAdmission !== undefined)
+					throw Object.assign(new AgentBusyError("Cannot switch sessions while a response or turn is active."), {
+						code: "busy",
+					});
+			}
 			const previousSessionFile = this.sessionManager.getSessionFile();
 			const switchingToDifferentSession = previousSessionFile
 				? path.resolve(previousSessionFile) !== path.resolve(sessionPath)
@@ -15307,6 +15381,7 @@ export class AgentSession {
 				throw error;
 			}
 		} finally {
+			this.#sessionTurnAdmissionFenced = false;
 			this.#endSessionTransition();
 		}
 	}

package/src/session/internal/managed-session-scope.ts

@@ -702,7 +702,7 @@ function inspectCandidate(filePath: string, provenance: "v2" | "legacy"): Manage
 			provenance,
 			migrationState: provenance === "v2" ? "native_v2" : "legacy_unmigrated",
 			identity: {
-				canonicalPath: path.resolve(filePath),
+				canonicalPath: canonicalizeTrustedPath(filePath),
 				sessionId: header.id,
 				...snapshot.identity,
 				mtimeMs: Number(named.mtimeMs),
@@ -740,6 +740,7 @@ function listDirectoryCandidates(
 	directory: string,
 	provenance: "v2" | "legacy",
 	scope: ManagedScope,
+	maxCandidates?: number,
 ): readonly CandidateInspection[] {
 	let directoryStat: fs.Stats;
 	try {
@@ -749,8 +750,28 @@ function listDirectoryCandidates(
 		throw error;
 	}
 	if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) throw new Error("unsafe directory");
-	return fs
-		.readdirSync(directory, { withFileTypes: true })
+	let entries: fs.Dirent[];
+	if (maxCandidates === undefined) {
+		entries = fs.readdirSync(directory, { withFileTypes: true });
+	} else {
+		entries = [];
+		let scannedEntries = 0;
+		const handle = fs.opendirSync(directory);
+		try {
+			for (;;) {
+				const entry = handle.readSync();
+				if (!entry) break;
+				scannedEntries++;
+				if (scannedEntries > maxCandidates * 4 + 128) throw new Error("candidate_capacity_exceeded");
+				if (!entry.name.endsWith(".jsonl")) continue;
+				entries.push(entry);
+				if (entries.length > maxCandidates) throw new Error("candidate_capacity_exceeded");
+			}
+		} finally {
+			handle.closeSync();
+		}
+	}
+	return entries
 		.filter(entry => entry.name.endsWith(".jsonl"))
 		.map(entry => {
 			const filePath = path.join(directory, entry.name);
@@ -967,7 +988,10 @@ export function prepareManagedSessionScopeForWriteSync(
 	}
 }
 
-export function listManagedCandidates(scope: ManagedScope): ManagedCandidateListing {
+export function listManagedCandidates(
+	scope: ManagedScope,
+	options?: { maxCandidates?: number },
+): ManagedCandidateListing {
 	try {
 		let root: fs.Stats;
 		try {
@@ -990,8 +1014,19 @@ export function listManagedCandidates(scope: ManagedScope): ManagedCandidateList
 			})),
 		];
 		const seen = new Set<string>();
+		let inspectedCandidates = 0;
 		for (const directory of directories) {
-			for (const candidate of listDirectoryCandidates(directory.path, directory.provenance, scope)) {
+			const remainingCandidates =
+				options?.maxCandidates === undefined ? undefined : options.maxCandidates - inspectedCandidates;
+			for (const candidate of listDirectoryCandidates(
+				directory.path,
+				directory.provenance,
+				scope,
+				remainingCandidates,
+			)) {
+				inspectedCandidates++;
+				if (options?.maxCandidates !== undefined && inspectedCandidates > options.maxCandidates)
+					throw new Error("candidate_capacity_exceeded");
 				if ("code" in candidate) {
 					invalid.push({ code: candidate.code });
 					continue;
@@ -1108,7 +1143,7 @@ function sameCandidate(left: ManagedCandidate, right: ManagedCandidate): boolean
 
 function matchesExpectedResumeIdentity(candidate: ManagedCandidate, expected: ResumeSessionIdentity): boolean {
 	return (
-		path.resolve(candidate.identity.canonicalPath) === path.resolve(expected.canonicalPath) &&
+		canonicalizeTrustedPath(candidate.identity.canonicalPath) === canonicalizeTrustedPath(expected.canonicalPath) &&
 		candidate.identity.sessionId === expected.sessionId &&
 		candidate.identity.dev === expected.dev &&
 		candidate.identity.ino === expected.ino &&

package/src/session/internal/managed-session-storage.ts

@@ -880,6 +880,20 @@ export class ManagedSessionDescendantStore {
 		};
 	}
 
+	/** Read only the exact managed file size through the retained root authority. */
+	sizeSync(relativePath: string): number | null {
+		this.#assertBound();
+		if (!this.#authority) throw new Error("managed_size_authority_unavailable");
+		const relative = this.#relative(this.#resolve(relativePath));
+		const result = this.#authority.stat(relative);
+		if (!result.ok) {
+			if (result.code === "not_found") return null;
+			throw new Error(result.code ?? "managed_size_failed");
+		}
+		if (!result.identity) throw new Error("Managed descendant identity is unavailable");
+		return Number(result.identity.size);
+	}
+
 	/** Remove an exact captured file without reopening its pathname as authority. */
 	removeExpected(relativePath: string, expected: ManagedFileSnapshot): void {
 		this.#assertBound();

package/src/session/session-manager.ts

@@ -4350,6 +4350,7 @@ export class SessionManager {
 	#sessionName: string | undefined;
 	#titleSource: "auto" | "user" | undefined;
 	#sessionFile: string | undefined;
+	#transcriptStatFailureReported = false;
 	#flushed: boolean = false;
 	#needsFullRewriteOnNextPersist: boolean = false;
 	#ensuredOnDisk: boolean = false;
@@ -6573,6 +6574,28 @@ export class SessionManager {
 	getSessionFile(): string | undefined {
 		return this.#sessionFile;
 	}
+	/**
+	 * Managed on-disk transcript size in bytes. Returns undefined when the
+	 * destination is explicit, the file does not exist yet, or its identity
+	 * cannot be verified.
+	 */
+	getTranscriptFileBytes(): number | undefined {
+		if (this.destination.kind !== "managed" || !this.#sessionFile) return undefined;
+		try {
+			const size = this.#managedTranscriptStore().sizeSync(path.basename(this.#sessionFile));
+			this.#transcriptStatFailureReported = false;
+			return size ?? undefined;
+		} catch (error) {
+			if (!this.#transcriptStatFailureReported) {
+				this.#transcriptStatFailureReported = true;
+				logger.warn("Managed transcript size sampling failed", {
+					sessionFile: this.#sessionFile,
+					error: toError(error).message,
+				});
+			}
+			return undefined;
+		}
+	}
 
 	acquireMemoryGuardParticipantIngressLease(): MemoryGuardParticipantIngressLease {
 		if (this.#memoryGuardParticipantIngressToken)
@@ -7093,7 +7116,17 @@ export class SessionManager {
 					new Map(),
 				);
 				const persistedEntry = prepareEntryForPersistenceSync(materializedEntry, this.#blobStore);
-				this.#appendManagedRecordSync(persistedEntry);
+				try {
+					this.#appendManagedRecordSync(persistedEntry);
+				} catch (appendError) {
+					// A managed append-only transcript can hit the per-file limit
+					// even after compaction reduced the live entries. Only the
+					// authority-bound append error may authorize a full rewrite.
+					if (!(appendError instanceof Error) || appendError.message !== "content_too_large") {
+						throw appendError;
+					}
+					this.#rewriteFileSync();
+				}
 				return;
 			}
 			const writer = this.#ensurePersistWriter();
@@ -7119,16 +7152,29 @@ export class SessionManager {
 	}
 
 	#appendEntry(entry: SessionEntry): void {
+		if (this.#persistError) throw this.#persistError;
 		this.#assertRecoveryHydrationWritable();
 		const normalizedEntry = normalizeSessionEntryForStorage(entry);
 		const residentEntry = prepareEntryForResidentSync(normalizedEntry, this.#residentBlobStores()) as SessionEntry;
+		const previousLeafId = this.#leafId;
 		this.#fileEntries.push(residentEntry);
 		this.#byId.set(residentEntry.id, residentEntry);
 		this.#leafId = residentEntry.id;
 		this.#bumpEntryRevision();
 		this.#leafRevision++;
 		if (entry.type === "label") this.#labelRevision++;
-		this._persist(residentEntry);
+		try {
+			this._persist(residentEntry);
+		} catch (error) {
+			this.#fileEntries.pop();
+			this.#byId.delete(residentEntry.id);
+			this.#leafId = previousLeafId;
+			this.#entryRevision--;
+			this.#leafRevision--;
+			if (entry.type === "label") this.#labelRevision--;
+			this.#resetMaterializedCaches();
+			throw error;
+		}
 		// Same validated, overflow-guarded aggregation as the resume path (#buildIndex): a
 		// malformed task-result or assistant usage shape reaching the append path must not
 		// crash or poison getUsageStatistics() either.
@@ -9395,7 +9441,14 @@ export class SessionManager {
 	 */
 	static inventorySessionsStrict(
 		cwd: string,
-		options?: { sessionDir?: string; storage?: SessionStorage; destination?: SessionDestination },
+		options?: {
+			sessionDir?: string;
+			storage?: SessionStorage;
+			destination?: SessionDestination;
+			maxCandidates?: number;
+			maxTotalBytes?: number;
+			filterOtherWorkspaces?: boolean;
+		},
 	): StrictInventoryResult {
 		const storage = options?.storage ?? new FileSessionStorage();
 		const destination = options?.destination;
@@ -9419,20 +9472,27 @@ export class SessionManager {
 				});
 				if (resolved.kind === "error")
 					return { kind: "failure", failures: [{ kind: "root", message: resolved.message, path: dir }] };
-				const listing = listManagedCandidates(resolved.scope);
+				const listing = listManagedCandidates(resolved.scope, { maxCandidates: options?.maxCandidates });
 				if (listing.kind === "error")
 					return { kind: "failure", failures: [{ kind: "scan", message: listing.message, path: dir }] };
 				const failures: StrictInventoryFailure[] = [];
 				const candidates: StrictInventoryCandidate[] = [];
+				let remainingBytes = options?.maxTotalBytes;
 				for (const managedCandidate of listing.owned) {
 					const candidate = inventoryReadCandidate(
 						storage,
 						managedCandidate.path,
 						cwd,
 						path.dirname(managedCandidate.path),
+						remainingBytes,
+						options?.filterOtherWorkspaces,
 					);
 					if ("failures" in candidate) failures.push(...candidate.failures);
-					else candidates.push(candidate.candidate);
+					else {
+						if (remainingBytes !== undefined) remainingBytes -= candidate.bytes;
+						if ("filtered" in candidate) continue;
+						candidates.push(candidate.candidate);
+					}
 				}
 				assertManagedDirectoryRoot(destination.securityContext.rootAuthority);
 				store.assertBound();
@@ -9450,11 +9510,27 @@ export class SessionManager {
 				failures: [{ kind: "scan", message: "Strict scoped session scan is unavailable", path: dir }],
 			};
 		}
-		const strictScan = storage.listFilesStrictSync.bind(storage);
 
 		let files: string[];
 		try {
-			files = strictScan(dir, "*.jsonl");
+			if (options?.maxCandidates !== undefined) {
+				if (!storage.listFilesStrictBoundedSync) {
+					return {
+						kind: "failure",
+						failures: [{ kind: "scan", message: "Bounded strict session scan is unavailable", path: dir }],
+					};
+				}
+				const bounded = storage.listFilesStrictBoundedSync(dir, "*.jsonl", options.maxCandidates);
+				if (bounded.truncated) {
+					return {
+						kind: "failure",
+						failures: [{ kind: "scan", message: "Strict session candidate limit exceeded", path: dir }],
+					};
+				}
+				files = bounded.files;
+			} else {
+				files = storage.listFilesStrictSync(dir, "*.jsonl");
+			}
 		} catch (err) {
 			const code = (err as NodeJS.ErrnoException)?.code;
 			// Only a confirmed ENOENT proves the scoped root is genuinely absent,
@@ -9487,12 +9563,22 @@ export class SessionManager {
 
 		const failures: StrictInventoryFailure[] = [];
 		const candidates: StrictInventoryCandidate[] = [];
+		let remainingBytes = options?.maxTotalBytes;
 		for (const file of files) {
-			const candidate = inventoryReadCandidate(storage, file, cwd, dir);
+			const candidate = inventoryReadCandidate(
+				storage,
+				file,
+				cwd,
+				dir,
+				remainingBytes,
+				options?.filterOtherWorkspaces,
+			);
 			if ("failures" in candidate) {
 				failures.push(...candidate.failures);
 				continue;
 			}
+			if (remainingBytes !== undefined) remainingBytes -= candidate.bytes;
+			if ("filtered" in candidate) continue;
 			candidates.push(candidate.candidate);
 		}
 		if (failures.length > 0) {
@@ -9521,7 +9607,12 @@ function inventoryReadCandidate(
 	file: string,
 	expectedCwd: string,
 	sessionDir: string,
-): { candidate: StrictInventoryCandidate } | { failures: StrictInventoryFailure[] } {
+	maxBytes?: number,
+	filterOtherWorkspaces = false,
+):
+	| { candidate: StrictInventoryCandidate; bytes: number }
+	| { filtered: true; bytes: number }
+	| { failures: StrictInventoryFailure[] } {
 	const failures: StrictInventoryFailure[] = [];
 	const resolvedFile = path.resolve(file);
 	if (!pathIsWithin(path.resolve(sessionDir), resolvedFile)) {
@@ -9534,7 +9625,14 @@ function inventoryReadCandidate(
 	}
 	let snapshot: SessionStorageSnapshot;
 	try {
-		snapshot = storage.readSnapshotSync(file);
+		if (maxBytes !== undefined) {
+			if (maxBytes < 0 || !storage.readSnapshotBoundedSync) {
+				return { failures: [{ kind: "read", message: "Bounded exact session read is unavailable", path: file }] };
+			}
+			snapshot = storage.readSnapshotBoundedSync(file, maxBytes);
+		} else {
+			snapshot = storage.readSnapshotSync(file);
+		}
 	} catch (err) {
 		const code = (err as NodeJS.ErrnoException)?.code;
 		if (code === "ELOOP" || code === "SYMLINK") {
@@ -9576,8 +9674,12 @@ function inventoryReadCandidate(
 	}
 	const canonicalHeaderCwd = resolveEquivalentPath(header.cwd);
 	if (canonicalHeaderCwd !== resolveEquivalentPath(expectedCwd)) {
+		if (filterOtherWorkspaces) return { filtered: true, bytes: snapshot.bytes.byteLength };
 		failures.push({ kind: "cwd", message: "Candidate cwd does not match the scoped workspace", path: file });
 		return { failures };
 	}
-	return { candidate: { path: resolvedFile, id: header.id, cwd: header.cwd, identity: snapshot.stat } };
+	return {
+		candidate: { path: resolvedFile, id: header.id, cwd: header.cwd, identity: snapshot.stat },
+		bytes: snapshot.bytes.byteLength,
+	};
 }