@wrongstack/core 0.273.0 → 0.274.0

package/dist/defaults/index.js

@@ -1,6 +1,6 @@
 import * as crypto2 from 'crypto';
 import { randomBytes, createCipheriv, createDecipheriv, randomUUID, scryptSync, createHash } from 'crypto';
-import * as fsp2 from 'fs/promises';
+import * as fsp3 from 'fs/promises';
 import { readFile, writeFile, mkdir } from 'fs/promises';
 import * as path4 from 'path';
 import { isAbsolute, join, resolve, sep } from 'path';
@@ -37,16 +37,16 @@ __export(atomic_write_exports, {
 });
 async function atomicWrite(targetPath, content, opts = {}) {
   const dir = path4.dirname(targetPath);
-  await fsp2.mkdir(dir, { recursive: true });
+  await fsp3.mkdir(dir, { recursive: true });
   const tmp = path4.join(dir, `.${path4.basename(targetPath)}.${randomBytes(6).toString("hex")}.tmp`);
   try {
     if (typeof content === "string") {
-      await fsp2.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
+      await fsp3.writeFile(tmp, content, { flag: "wx", encoding: opts.encoding ?? "utf8" });
     } else {
-      await fsp2.writeFile(tmp, content, { flag: "wx" });
+      await fsp3.writeFile(tmp, content, { flag: "wx" });
     }
     try {
-      const fh = await fsp2.open(tmp, "r+");
+      const fh = await fsp3.open(tmp, "r+");
       try {
         await fh.sync();
       } finally {
@@ -56,29 +56,29 @@ async function atomicWrite(targetPath, content, opts = {}) {
     }
     let mode;
     try {
-      const stat6 = await fsp2.stat(targetPath);
-      mode = stat6.mode & 511;
+      const stat8 = await fsp3.stat(targetPath);
+      mode = stat8.mode & 511;
     } catch {
       mode = opts.mode;
     }
     if (mode !== void 0) {
-      await fsp2.chmod(tmp, mode);
+      await fsp3.chmod(tmp, mode);
     }
     await renameWithRetry(tmp, targetPath);
   } catch (err) {
     try {
-      await fsp2.unlink(tmp);
+      await fsp3.unlink(tmp);
     } catch {
     }
     throw err;
   }
 }
 async function ensureDir(dir) {
-  await fsp2.mkdir(dir, { recursive: true });
+  await fsp3.mkdir(dir, { recursive: true });
 }
 async function withFileLock(targetPath, fn, opts = {}) {
   const dir = path4.dirname(targetPath);
-  await fsp2.mkdir(dir, { recursive: true });
+  await fsp3.mkdir(dir, { recursive: true });
   const lockPath = path4.join(dir, `.${path4.basename(targetPath)}.lock`);
   const timeoutMs = opts.timeoutMs ?? 5e3;
   const staleMs = opts.staleMs ?? 3e4;
@@ -86,20 +86,20 @@ async function withFileLock(targetPath, fn, opts = {}) {
   let handle;
   for (; ; ) {
     try {
-      handle = await fsp2.open(lockPath, "wx");
+      handle = await fsp3.open(lockPath, "wx");
       await handle.writeFile(`${process.pid}:${Date.now()}`);
       break;
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
-        await fsp2.mkdir(dir, { recursive: true });
+        await fsp3.mkdir(dir, { recursive: true });
         continue;
       }
       if (code !== "EEXIST") throw err;
       try {
-        const stat6 = await fsp2.stat(lockPath);
-        if (Date.now() - stat6.mtimeMs > staleMs) {
-          await fsp2.unlink(lockPath);
+        const stat8 = await fsp3.stat(lockPath);
+        if (Date.now() - stat8.mtimeMs > staleMs) {
+          await fsp3.unlink(lockPath);
           continue;
         }
       } catch {
@@ -119,21 +119,21 @@ async function withFileLock(targetPath, fn, opts = {}) {
     } catch {
     }
     try {
-      await fsp2.unlink(lockPath);
+      await fsp3.unlink(lockPath);
     } catch {
     }
   }
 }
 async function renameWithRetry(from, to) {
   if (process.platform !== "win32") {
-    await fsp2.rename(from, to);
+    await fsp3.rename(from, to);
     return;
   }
   const delays = [10, 25, 60, 120, 250];
   let lastErr;
   for (let i = 0; i <= delays.length; i++) {
     try {
-      await fsp2.rename(from, to);
+      await fsp3.rename(from, to);
       return;
     } catch (err) {
       lastErr = err;
@@ -181,7 +181,7 @@ function envFlag(value) {
   return !/^(0|false|no|off)$/i.test(value.trim());
 }
 var COLOR = isColorTty();
-var wrap = (open3, close) => (s) => COLOR ? `\x1B[${open3}m${s}\x1B[${close}m` : s;
+var wrap = (open4, close) => (s) => COLOR ? `\x1B[${open4}m${s}\x1B[${close}m` : s;
 var color = {
   reset: wrap("0", "0"),
   bold: wrap("1", "22"),
@@ -772,7 +772,7 @@ async function expandGlob(pattern) {
   async function walk3(dir, pat) {
     let entries;
     try {
-      entries = await fsp2.readdir(dir);
+      entries = await fsp3.readdir(dir);
     } catch {
       return;
     }
@@ -794,8 +794,8 @@ async function expandGlob(pattern) {
       for (const e of entries) {
         const full = `${dir}${SEP}${e}`;
         try {
-          const stat6 = await fsp2.stat(full);
-          if (stat6.isDirectory()) await walk3(full, rest);
+          const stat8 = await fsp3.stat(full);
+          if (stat8.isDirectory()) await walk3(full, rest);
         } catch {
         }
       }
@@ -812,8 +812,8 @@ async function expandGlob(pattern) {
       if (entries.includes(seg)) {
         const full = `${dir}${SEP}${seg}`;
         try {
-          const stat6 = await fsp2.stat(full);
-          if (stat6.isDirectory()) await walk3(full, rest);
+          const stat8 = await fsp3.stat(full);
+          if (stat8.isDirectory()) await walk3(full, rest);
         } catch {
         }
       }
@@ -1003,11 +1003,11 @@ function validateAgainstSchema(value, schema) {
   walk(value, schema, "", errors);
   return { ok: errors.length === 0, errors };
 }
-function walk(value, schema, path23, errors) {
+function walk(value, schema, path25, errors) {
   if (schema.enum !== void 0) {
     if (!schema.enum.some((e) => deepEqual(e, value))) {
       errors.push({
-        path: path23 || "<root>",
+        path: path25 || "<root>",
         message: `expected one of ${JSON.stringify(schema.enum)}, got ${JSON.stringify(value)}`
       });
       return;
@@ -1016,7 +1016,7 @@ function walk(value, schema, path23, errors) {
   if (typeof schema.type === "string") {
     if (!checkType(value, schema.type)) {
       errors.push({
-        path: path23 || "<root>",
+        path: path25 || "<root>",
         message: `expected ${schema.type}, got ${describeType(value)}`
       });
       return;
@@ -1026,20 +1026,20 @@ function walk(value, schema, path23, errors) {
     const obj = value;
     for (const req of schema.required ?? []) {
       if (!(req in obj)) {
-        errors.push({ path: joinPath(path23, req), message: "required property missing" });
+        errors.push({ path: joinPath(path25, req), message: "required property missing" });
       }
     }
     if (schema.properties) {
       for (const [key, subSchema] of Object.entries(schema.properties)) {
         if (key in obj) {
-          walk(obj[key], subSchema, joinPath(path23, key), errors);
+          walk(obj[key], subSchema, joinPath(path25, key), errors);
         }
       }
     }
   }
   if (schema.type === "array" && Array.isArray(value) && schema.items) {
     for (let i = 0; i < value.length; i++) {
-      walk(value[i], schema.items, `${path23}[${i}]`, errors);
+      walk(value[i], schema.items, `${path25}[${i}]`, errors);
     }
   }
 }
@@ -2205,1456 +2205,1677 @@ function resolveWstackPaths(opts) {
     projectStatus: (projectHash2) => path4.join(globalRoot, "projects", projectHash2, "status.json")
   };
 }
-function sanitizeModel(model) {
-  return model.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 40);
-}
-function generateSessionId(startedAt, model) {
-  const date = startedAt.slice(0, 10);
-  const time = startedAt.slice(11, 19).replace(/:/g, "-");
-  const suffix = randomBytes(2).toString("hex");
-  const modelPart = model ? `_${sanitizeModel(model)}` : "";
-  return `${date}/${time}Z${modelPart}_${suffix}`;
+
+// src/storage/file-session-writer.ts
+init_atomic_write();
+
+// src/storage/session-helpers.ts
+function userInputTitle(content) {
+  const text = typeof content === "string" ? content : content.filter((b) => b.type === "text").map((b) => b.text).join(" ");
+  return (text || "(non-text input)").slice(0, 60);
 }
 
-// src/storage/session-store.ts
-var DefaultSessionStore = class _DefaultSessionStore {
-  dir;
+// src/storage/file-session-writer.ts
+var FileSessionWriter = class _FileSessionWriter {
+  constructor(id, handle, startedAt, meta, events, opts = {}, traceId) {
+    this.id = id;
+    this.handle = handle;
+    this.startedAt = startedAt;
+    this.meta = meta;
+    this.events = events;
+    this.resumed = opts.resumed ?? false;
+    this.manifestFile = opts.dir ? path4.join(opts.dir, `${path4.basename(id)}.summary.json`) : "";
+    this.filePath = opts.filePath ?? "";
+    this.secretScrubber = opts.secretScrubber;
+    this.onCloseCb = opts.onClose;
+    this.summary = {
+      id,
+      title: "(empty session)",
+      startedAt,
+      model: meta.model ?? "unknown",
+      provider: meta.provider ?? "unknown",
+      tokenTotal: 0
+    };
+    this.traceId = traceId;
+  }
+  id;
+  handle;
+  startedAt;
+  meta;
   events;
-  secretScrubber;
+  closed = false;
+  closePromise = null;
+  manifestFile;
+  summary;
+  tokenIn = 0;
+  tokenOut = 0;
+  filePath;
+  get transcriptPath() {
+    return this.filePath || void 0;
+  }
   /**
-   * In-memory cache for load() results, keyed by session ID. The cache is
-   * invalidated when the file's mtimeMs or size changes (indicating the
-   * file was written to). This eliminates redundant full-file reads and
-   * JSON parses when the same session is loaded multiple times within the
-   * store's lifetime (e.g., webui session detail views, list() fallbacks).
-   *
-   * Max size is capped to prevent unbounded memory growth in long-running
-   * processes. When the limit is reached, the oldest entry is evicted.
+   * Lazy session_start/session_resumed init, shared by all appenders.
+   * A single promise (not a boolean) so a second append racing the first
+   * can't push its event into the buffer BEFORE the first append's event —
+   * every appender awaits the same init and resumes in FIFO call order.
    */
-  _loadCache = /* @__PURE__ */ new Map();
-  _indexCache = null;
-  static LOAD_CACHE_MAX_ENTRIES = 50;
-  static LIST_SCAN_CONCURRENCY = 32;
-  constructor(opts) {
-    this.dir = opts.dir;
-    this.events = opts.events;
-    this.secretScrubber = opts.secretScrubber;
+  initPromise = null;
+  ensureInit() {
+    if (!this.initPromise) this.initPromise = this.writeSessionStartLazy();
+    return this.initPromise;
+  }
+  resumed;
+  appendFailCount = 0;
+  lastAppendWarnAt = 0;
+  secretScrubber;
+  onCloseCb;
+  /** Implements SessionWriter.traceId — propagated from ContextInit.traceId. */
+  traceId;
+  // ── Write buffer — batches events to reduce per-event disk I/O ──────────────
+  //
+  // Every append() pushes the scrubbed event into an in-memory buffer instead
+  // of calling handle.appendFile() synchronously. The buffer flushes to disk
+  // when it reaches FLUSH_SIZE events OR after FLUSH_INTERVAL_MS of inactivity.
+  // This cuts the number of disk writes by ~95% without changing the on-disk
+  // format — the JSONL is still one JSON object per line.
+  writeBuffer = [];
+  flushTimer = null;
+  static FLUSH_INTERVAL_MS = 500;
+  static FLUSH_SIZE = 50;
+  // ── Write serialization ─────────────────────────────────────────────────────
+  //
+  // All disk writes are funneled through a FIFO promise chain. Without it,
+  // a timer-driven flush racing an explicit flush()/close() issues two
+  // concurrent appendFile() calls on the shared O_APPEND handle — the kernel
+  // may complete them out of order (chronology breaks) or, for large
+  // batches, interleave partial writes (torn JSONL lines). The chain keeps
+  // exactly one write in flight; failures don't break the chain.
+  writeChain = Promise.resolve();
+  /** Enqueue a write on the FIFO chain. Resolves/rejects with that write. */
+  enqueueWrite(data) {
+    const write = this.writeChain.then(() => this.handle.appendFile(data, "utf8"));
+    this.writeChain = write.then(
+      () => void 0,
+      () => void 0
+    );
+    return write;
   }
+  // ── Enriched summary tracking ───────────────────────────────────────────────
+  iterationCount = 0;
+  toolCallCount = 0;
+  toolErrorCount = 0;
+  toolBreakdown = {};
+  fileChangeCount = 0;
+  compactionCount = 0;
+  outcome = void 0;
   /**
-   * Clear the load() cache. Useful for testing or when the caller knows
-   * the file has changed externally (e.g., another process wrote to it).
+   * Scrub secrets out of conversation-turn events before they are observed
+   * for the summary, written to the JSONL log, or surfaced on resume. Only
+   * `user_input` / `llm_response` carry free-form user/model text; other event
+   * types either have no secret-bearing content or are already scrubbed
+   * upstream (tool results). Returns the event unchanged when no scrubber is
+   * configured.
    */
-  clearLoadCache(sessionId) {
-    if (sessionId !== void 0) {
-      this._loadCache.delete(sessionId);
-    } else {
-      this._loadCache.clear();
+  scrubEvent(event) {
+    const s = this.secretScrubber;
+    if (!s) return event;
+    if (event.type === "user_input") {
+      return {
+        ...event,
+        content: typeof event.content === "string" ? s.scrub(event.content) : s.scrubObject(event.content)
+      };
+    }
+    if (event.type === "llm_response") {
+      return { ...event, content: s.scrubObject(event.content) };
     }
+    return event;
   }
-  // ── Storage event helpers ───────────────────────────────────────────────────
-  emitRead(sessionId, filePath, operation, outcome, durationMs, error) {
-    this.events?.emit("storage.read", {
-      sessionId,
-      store: "session",
-      filePath,
-      operation,
-      outcome,
-      durationMs,
-      ...error !== void 0 ? { error } : {}
-    });
+  pendingFileSnapshots = [];
+  /** Tracks open tool_use IDs during the current run to serialize on close for resume. */
+  openToolUses = /* @__PURE__ */ new Set();
+  recordFileChange(input) {
+    this.pendingFileSnapshots.push(input);
   }
-  emitWrite(sessionId, filePath, operation, outcome, durationMs, eventCount, error) {
-    this.events?.emit("storage.write", {
-      sessionId,
-      store: "session",
-      filePath,
-      operation,
-      outcome,
-      durationMs,
-      ...eventCount !== void 0 ? { eventCount } : {},
-      ...error !== void 0 ? { error } : {}
-    });
+  get pendingToolUses() {
+    return Array.from(this.openToolUses);
   }
-  emitError(sessionId, filePath, operation, error, recoverable) {
-    this.events?.emit("storage.error", {
-      sessionId,
-      store: "session",
-      filePath,
-      operation,
-      error,
-      recoverable
-    });
+  async writeSessionStartLazy() {
+    const record = `${JSON.stringify({
+      type: this.resumed ? "session_resumed" : "session_start",
+      ts: this.startedAt,
+      id: this.id,
+      model: this.meta.model ?? "unknown",
+      provider: this.meta.provider ?? "unknown"
+    })}
+`;
+    try {
+      await this.enqueueWrite(record);
+    } catch {
+    }
   }
-  /** Absolute path to the session index file. */
-  get indexFile() {
-    return path4.join(this.dir, "_index.jsonl");
+  async append(event) {
+    if (this.closed) return;
+    await this.ensureInit();
+    const scrubbed = this.scrubEvent(event);
+    this.observeForSummary(scrubbed);
+    this.writeBuffer.push(scrubbed);
+    if (this.writeBuffer.length >= _FileSessionWriter.FLUSH_SIZE) {
+      if (this.flushTimer) {
+        clearTimeout(this.flushTimer);
+        this.flushTimer = null;
+      }
+      await this.flushBuffer();
+    } else {
+      this.scheduleFlush();
+    }
   }
-  /** Join session ID to its absolute path within the store directory. */
-  sessionPath(id, ext) {
-    return path4.join(this.dir, `${id}${ext}`);
+  async appendBatch(events) {
+    if (this.closed || events.length === 0) return;
+    await this.ensureInit();
+    for (const event of events) {
+      const scrubbed = this.scrubEvent(event);
+      this.observeForSummary(scrubbed);
+      this.writeBuffer.push(scrubbed);
+    }
+    if (this.writeBuffer.length >= _FileSessionWriter.FLUSH_SIZE) {
+      if (this.flushTimer) {
+        clearTimeout(this.flushTimer);
+        this.flushTimer = null;
+      }
+      await this.flushBuffer();
+    } else {
+      this.scheduleFlush();
+    }
   }
   /**
-   * Ensure the directory implied by the session ID exists. When the ID
-   * contains a date prefix like `2026-06-06/...`, this creates the date
-   * subdirectory so sessions group naturally by day.
+   * Flush buffered events to disk immediately. Critical events
+   * (user_input, llm_response) call this so they survive SIGKILL/crash
+   * instead of sitting in the in-memory buffer for up to 500ms.
+   *
+   * Idempotent — cancels any pending timer and writes whatever has
+   * accumulated in the buffer. Safe to call even when the buffer
+   * is empty (no-op).
    */
-  async ensureShardDir(id) {
-    const dirPath = path4.dirname(path4.join(this.dir, id));
-    await ensureDir(dirPath);
-    return dirPath;
+  async flush() {
+    if (this.flushTimer) {
+      clearTimeout(this.flushTimer);
+      this.flushTimer = null;
+    }
+    await this.flushBuffer();
   }
-  async create(meta) {
-    const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-    const id = meta.id && meta.id.length > 0 ? meta.id : generateSessionId(startedAt, meta.model ?? meta.provider);
-    const shardDir = await this.ensureShardDir(id);
-    const file = path4.join(shardDir, `${path4.basename(id)}.jsonl`);
-    const t0 = Date.now();
-    let handle;
-    try {
-      handle = await fsp2.open(file, "a", 384);
-    } catch (err) {
-      this.emitError(id, file, "create", toErrorMessage(err), false);
-      throw new Error(
-        `Failed to open session file: ${toErrorMessage(err)}`,
-        { cause: err }
-      );
-    }
-    try {
-      const writer = new FileSessionWriter(id, handle, startedAt, meta, this.events, {
-        dir: shardDir,
-        filePath: file,
-        secretScrubber: this.secretScrubber,
-        onClose: (s) => this.appendToIndex(s)
+  /** Schedule a deferred flush. No-op if a timer is already pending. */
+  scheduleFlush() {
+    if (this.flushTimer) return;
+    this.flushTimer = setTimeout(() => {
+      this.flushTimer = null;
+      this.flushBuffer().catch(() => {
       });
-      this.emitWrite(id, file, "create", "success", Date.now() - t0);
-      return writer;
-    } catch (err) {
-      await handle.close().catch((e) => console.warn(JSON.stringify({
-        level: "warn",
-        event: "session_store.handle_close_failed",
-        message: e instanceof Error ? e.message : String(e),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })));
-      this.emitError(id, file, "create", toErrorMessage(err), true);
-      throw err;
-    }
-  }
-  async resume(id) {
-    const file = this.sessionPath(id, ".jsonl");
-    const t0 = Date.now();
-    const data = await this.load(id);
-    let handle;
-    try {
-      handle = await fsp2.open(file, "a", 384);
-    } catch (err) {
-      this.emitError(id, file, "resume", toErrorMessage(err), false);
-      throw new Error(
-        `Failed to open session "${id}" for append: ${toErrorMessage(err)}`,
-        { cause: err }
-      );
-    }
-    try {
-      const writer = new FileSessionWriter(
-        id,
-        handle,
-        (/* @__PURE__ */ new Date()).toISOString(),
-        {
-          id,
-          model: data.metadata.model,
-          provider: data.metadata.provider
-        },
-        this.events,
-        {
-          resumed: true,
-          // Shard directory (sessions/<date>/) — must match create() so the
-          // .summary.json sidecar lands next to the JSONL instead of the
-          // sessions root (where summaryFor() would never find it).
-          dir: path4.dirname(file),
-          filePath: file,
-          secretScrubber: this.secretScrubber,
-          onClose: (s) => this.appendToIndex(s)
-        }
-      );
-      this.emitWrite(id, file, "resume", "success", Date.now() - t0);
-      return { writer, data };
-    } catch (err) {
-      await handle.close().catch((e) => console.warn(JSON.stringify({
-        level: "warn",
-        event: "session_store.handle_close_failed",
-        message: e instanceof Error ? e.message : String(e),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })));
-      this.emitError(id, file, "resume", toErrorMessage(err), true);
-      throw err;
-    }
+    }, _FileSessionWriter.FLUSH_INTERVAL_MS);
   }
-  async load(id) {
-    const file = this.sessionPath(id, ".jsonl");
+  /**
+   * Flush all buffered events to disk as a single appendFile call.
+   * Errors use the same throttled-warning pattern the old per-event
+   * append path used — one warning every 5s with a suppressed count.
+   * On failure the buffer is cleared (events are best-effort, same as
+   * the old per-event path where a failed write was silently dropped).
+   */
+  async flushBuffer() {
+    if (this.writeBuffer.length === 0) return;
+    const eventCount = this.writeBuffer.length;
+    const batch = this.writeBuffer.map((e) => JSON.stringify(e)).join("\n") + "\n";
+    this.writeBuffer = [];
     const t0 = Date.now();
     let outcome = "success";
     let errorMsg;
-    let cacheHit = false;
     try {
-      const s = await fsp2.stat(file);
-      const stat6 = { mtimeMs: s.mtimeMs, size: s.size };
-      const cached = this._loadCache.get(id);
-      if (cached && cached.mtimeMs === stat6.mtimeMs && cached.size === stat6.size) {
-        cacheHit = true;
-        this._loadCache.delete(id);
-        this._loadCache.set(id, cached);
-        return cached.data;
-      }
-      const raw = await fsp2.readFile(file, "utf8");
-      const lines = raw.split("\n").filter((l) => l.trim());
-      const events = [];
-      let sessionStartEvent;
-      let sessionEndEvent;
-      let sessionModel;
-      let sessionProvider;
-      let sessionPendingToolUses;
-      const messages = [];
-      const openToolUses = /* @__PURE__ */ new Set();
-      let usage = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
-      for (const line of lines) {
-        try {
-          const parsed = JSON.parse(line);
-          if (parsed !== null && typeof parsed === "object" && typeof parsed.type === "string" && typeof parsed.ts === "string") {
-            const ev = parsed;
-            events.push(ev);
-            if (ev.type === "session_start" && !sessionStartEvent) {
-              sessionStartEvent = ev;
-              sessionModel = ev.model;
-              sessionProvider = ev.provider;
-            }
-            if (ev.type === "session_end") {
-              sessionEndEvent = ev;
-              sessionPendingToolUses = ev.pendingToolUses;
-            }
-            if (ev.type === "user_input") {
-              openToolUses.clear();
-              messages.push({ role: "user", content: ev.content, ts: ev.ts });
-            } else if (ev.type === "llm_response") {
-              messages.push({ role: "assistant", content: ev.content, ts: ev.ts });
-              for (const b of ev.content) {
-                if (b.type === "tool_use") openToolUses.add(b.id);
-              }
-              usage = {
-                input: usage.input + (ev.usage.input ?? 0),
-                output: usage.output + (ev.usage.output ?? 0),
-                cacheRead: (usage.cacheRead ?? 0) + (ev.usage.cacheRead ?? 0),
-                cacheWrite: (usage.cacheWrite ?? 0) + (ev.usage.cacheWrite ?? 0)
-              };
-            } else if (ev.type === "tool_result") {
-              if (!openToolUses.has(ev.id)) {
-                this.events?.emit("session.damaged", {
-                  sessionId: id,
-                  detail: `Orphan tool_result "${ev.id}" has no matching tool_use`
-                });
-                continue;
-              }
-              openToolUses.delete(ev.id);
-              const resultBlock = {
-                type: "tool_result",
-                tool_use_id: ev.id,
-                content: typeof ev.content === "string" ? ev.content : JSON.stringify(ev.content),
-                is_error: ev.isError
-              };
-              const last = messages[messages.length - 1];
-              const lastIsToolResultUser = last?.role === "user" && Array.isArray(last.content) && last.content.every((b) => b.type === "tool_result");
-              if (lastIsToolResultUser && Array.isArray(last.content)) {
-                last.content.push(resultBlock);
-              } else {
-                messages.push({ role: "user", content: [resultBlock], ts: ev.ts });
-              }
-            }
-          }
-        } catch {
-        }
-      }
-      if (openToolUses.size > 0) {
-        this.events?.emit("session.damaged", {
-          sessionId: id,
-          detail: `${openToolUses.size} tool_use blocks without matching results - replay repaired`
-        });
-      }
-      const repaired = repairToolUseAdjacency(messages);
-      if (repaired.report.changed) {
-        this.events?.emit("session.damaged", {
-          sessionId: id,
-          detail: `Repaired replay adjacency: removed ${repaired.report.removedToolUses.length} tool_use, ${repaired.report.removedToolResults.length} tool_result, ${repaired.report.removedMessages} empty messages`
-        });
-      }
-      const meta = {
-        id,
-        startedAt: sessionStartEvent?.ts ?? (/* @__PURE__ */ new Date(0)).toISOString(),
-        endedAt: sessionEndEvent?.ts,
-        model: sessionModel,
-        provider: sessionProvider,
-        pendingToolUses: sessionPendingToolUses
-      };
-      const toolCallEnds = extractToolCallEnds(events);
-      const data = { metadata: meta, events, messages: repaired.messages, usage, toolCallEnds };
-      if (this._loadCache.size >= _DefaultSessionStore.LOAD_CACHE_MAX_ENTRIES) {
-        const oldest = this._loadCache.keys().next().value;
-        if (oldest !== void 0) {
-          this._loadCache.delete(oldest);
-        }
-      }
-      this._loadCache.set(id, { mtimeMs: stat6.mtimeMs, size: stat6.size, data });
-      return data;
+      await this.enqueueWrite(batch);
     } catch (err) {
       outcome = "failure";
       errorMsg = toErrorMessage(err);
-      throw err;
-    } finally {
-      this.emitRead(id, file, "load", outcome, Date.now() - t0, errorMsg);
-      if (cacheHit) {
-        this.events?.emit("storage.cache_hit", {
-          sessionId: id,
-          store: "session",
-          filePath: file,
-          operation: "load",
-          durationMs: Date.now() - t0
-        });
+      this.appendFailCount += eventCount;
+      const now = Date.now();
+      if (now - this.lastAppendWarnAt > 5e3) {
+        const suppressed = this.appendFailCount - 1;
+        const tail = suppressed > 0 ? ` (+${suppressed} suppressed)` : "";
+        console.warn(
+          "[session] flush failed:",
+          toErrorMessage(err),
+          tail
+        );
+        this.lastAppendWarnAt = now;
+        this.appendFailCount = 0;
       }
+    } finally {
+      this.events?.emit("storage.write", {
+        sessionId: this.id,
+        store: "session",
+        filePath: this.filePath,
+        operation: "flush",
+        outcome,
+        durationMs: Date.now() - t0,
+        ...errorMsg !== void 0 ? { error: errorMsg } : {},
+        ...eventCount !== void 0 ? { eventCount } : {},
+        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+      });
     }
   }
-  async list(limit = 20) {
-    try {
-      await ensureDir(this.dir);
-      const indexed = await this.readIndex();
-      if (indexed.length > 0) {
-        indexed.sort((a, b) => {
-          if (a.startedAt < b.startedAt) return 1;
-          if (a.startedAt > b.startedAt) return -1;
-          return a.id.localeCompare(b.id);
-        });
-        return indexed.slice(0, limit);
+  observeForSummary(event) {
+    if (event.type === "llm_response") {
+      for (const block of event.content) {
+        if (block.type === "tool_use") this.openToolUses.add(block.id);
       }
-      return await this.listFromDirectoryScan(limit);
-    } catch {
-      return [];
     }
-  }
-  // ── Session index (_index.jsonl) ─────────────────────────────────────────
-  //
-  // One JSON line per closed session, appended atomically on close().
-  // When a session is deleted, a tombstone {action:"delete",id:"..."} is
-  // appended. On read, tombstones filter out matching session entries.
-  // This keeps listing O(lines-in-index) instead of O(files-on-disk).
-  //
-  // The index auto-compacts every N appends to prevent unbounded growth
-  // from tombstones and duplicate entries (resume cycles).
-  indexAppendCount = 0;
-  static COMPACT_EVERY = 30;
-  /** Append a session summary to the index. */
-  async appendToIndex(summary) {
-    try {
-      await ensureDir(this.dir);
-      const line = JSON.stringify(summary) + "\n";
-      await fsp2.appendFile(this.indexFile, line, "utf8");
-      this._indexCache = null;
-      this.indexAppendCount++;
-      if (this.indexAppendCount >= _DefaultSessionStore.COMPACT_EVERY) {
-        await this.compactIndex();
-        this.indexAppendCount = 0;
+    if (event.type === "tool_use") {
+      this.openToolUses.add(event.id);
+    } else if (event.type === "tool_call_start") {
+      this.toolCallCount++;
+      this.toolBreakdown[event.name] = (this.toolBreakdown[event.name] ?? 0) + 1;
+    } else if (event.type === "tool_result") {
+      this.openToolUses.delete(event.id);
+      if (event.isError) {
+        this.toolErrorCount++;
+        this.outcome = "error";
       }
-    } catch {
+    } else if (event.type === "file_snapshot") {
+      this.fileChangeCount += event.files.length;
+    } else if (event.type === "compaction") {
+      this.compactionCount++;
     }
-  }
-  /** Append a tombstone entry for a deleted session. */
-  async writeTombstone(id) {
-    try {
-      await ensureDir(this.dir);
-      const line = JSON.stringify({ action: "delete", id }) + "\n";
-      await fsp2.appendFile(this.indexFile, line, "utf8");
-      this._indexCache = null;
-      this.indexAppendCount++;
-    } catch {
+    if (event.type === "error" || event.type === "provider_error") {
+      this.outcome = "error";
+    }
+    if (event.type === "user_input" && this.summary.title === "(empty session)") {
+      this.summary = { ...this.summary, title: userInputTitle(event.content) };
+    } else if (event.type === "llm_response") {
+      this.tokenIn += event.usage.input;
+      this.tokenOut += event.usage.output;
+      this.summary = { ...this.summary, tokenTotal: this.tokenIn + this.tokenOut };
+    } else if (event.type === "session_end") {
+      const total = event.usage.input + event.usage.output;
+      if (total > 0) this.summary = { ...this.summary, tokenTotal: total };
+    } else if (event.type === "in_flight_start") {
+      this.iterationCount++;
     }
   }
-  /**
-   * Compact the index: read all entries, drop tombstones, deduplicate
-   * (keep latest per session), and rewrite. Atomic via temp+rename.
-   */
-  async compactIndex() {
-    const t0 = Date.now();
-    let outcome = "success";
-    let errorMsg;
+  async close() {
+    if (this.closePromise) return this.closePromise;
+    this.closePromise = this.doClose();
+    return this.closePromise;
+  }
+  async doClose() {
+    this.closed = true;
+    if (this.flushTimer) {
+      clearTimeout(this.flushTimer);
+      this.flushTimer = null;
+    }
+    await this.flushBuffer();
+    await this.writeChain;
+    this.summary = {
+      ...this.summary,
+      endedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      iterationCount: this.iterationCount,
+      toolCallCount: this.toolCallCount,
+      toolErrorCount: this.toolErrorCount,
+      fileChangeCount: this.fileChangeCount,
+      compactionCount: this.compactionCount > 0 ? this.compactionCount : void 0,
+      toolBreakdown: { ...this.toolBreakdown },
+      outcome: this.outcome ?? "completed"
+    };
+    if (this.manifestFile) {
+      const t0 = Date.now();
+      let outcome = "success";
+      let errorMsg;
+      try {
+        await atomicWrite(this.manifestFile, JSON.stringify(this.summary), { mode: 384 });
+      } catch (err) {
+        outcome = "failure";
+        errorMsg = toErrorMessage(err);
+      } finally {
+        this.events?.emit("storage.write", {
+          sessionId: this.id,
+          store: "session",
+          filePath: this.manifestFile,
+          operation: "close",
+          outcome,
+          durationMs: Date.now() - t0,
+          ...errorMsg !== void 0 ? { error: errorMsg } : {},
+          ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+        });
+      }
+    }
+    const idxT0 = Date.now();
+    let idxOutcome = "success";
+    let idxError;
     try {
-      const entries = await this.readIndex();
-      if (entries.length === 0) return;
-      const tmp = `${this.indexFile}.compact.tmp`;
-      const lines = entries.map((s) => JSON.stringify(s)).join("\n") + "\n";
-      await fsp2.writeFile(tmp, lines, "utf8");
-      await fsp2.rename(tmp, this.indexFile);
-      this._indexCache = null;
+      await this.onCloseCb?.(this.summary);
     } catch (err) {
-      outcome = "failure";
-      errorMsg = toErrorMessage(err);
+      idxOutcome = "failure";
+      idxError = toErrorMessage(err);
     } finally {
-      this.emitWrite("~compact~", this.indexFile, "compact", outcome, Date.now() - t0, void 0, errorMsg);
+      this.events?.emit("storage.write", {
+        sessionId: this.summary.id,
+        store: "session",
+        filePath: this.filePath,
+        operation: "index_append",
+        outcome: idxOutcome,
+        durationMs: Date.now() - idxT0,
+        ...idxError !== void 0 ? { error: idxError } : {},
+        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+      });
     }
-  }
-  /**
-   * Read the index file and return deduplicated session summaries.
-   * Entries with a matching tombstone are filtered out.
-   * Returns empty array when the index doesn't exist or is corrupt.
-   */
-  async readIndex() {
-    let stat6;
     try {
-      const s = await fsp2.stat(this.indexFile);
-      stat6 = { mtimeMs: s.mtimeMs, size: s.size };
+      await this.handle.close();
     } catch {
-      this._indexCache = null;
-      return [];
     }
-    if (this._indexCache !== null && this._indexCache.mtimeMs === stat6.mtimeMs && this._indexCache.size === stat6.size) {
-      return [...this._indexCache.summaries];
+  }
+  async writeCheckpoint(promptIndex, promptPreview) {
+    const fileCount = this.pendingFileSnapshots.length;
+    if (fileCount > 0) {
+      await this.writeFileSnapshot(promptIndex, [...this.pendingFileSnapshots]);
+      this.pendingFileSnapshots = [];
     }
-    let raw;
-    try {
-      raw = await fsp2.readFile(this.indexFile, "utf8");
-    } catch {
-      this._indexCache = null;
-      return [];
+    await this.append({
+      type: "checkpoint",
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      promptIndex,
+      promptPreview
+    });
+    this.events?.emit("checkpoint.written", {
+      promptIndex,
+      promptPreview,
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      fileCount
+    });
+  }
+  async writeFileSnapshot(promptIndex, files) {
+    await this.append({
+      type: "file_snapshot",
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      promptIndex,
+      files
+    });
+  }
+  /**
+   * Truncate the session file to the checkpoint with the given promptIndex,
+   * removing all events that follow it. Uses a single-pass byte-offset scan
+   * so post-checkpoint content is never read or parsed — O(1) memory instead
+   * of O(N) JSON.parse calls over the full file.
+   */
+  async truncateToCheckpoint(targetPromptIndex) {
+    if (!this.filePath) return 0;
+    if (this.flushTimer) {
+      clearTimeout(this.flushTimer);
+      this.flushTimer = null;
     }
-    const deleted = /* @__PURE__ */ new Set();
-    const seen = /* @__PURE__ */ new Map();
-    for (const line of raw.split("\n")) {
-      if (!line.trim()) continue;
-      try {
-        const entry = JSON.parse(line);
-        if (entry.action === "delete" && entry.id) {
-          deleted.add(entry.id);
-          seen.delete(entry.id);
-          continue;
+    await this.flushBuffer();
+    await this.writeChain;
+    const CHUNK_SIZE = 65536;
+    let fd;
+    let fileOffset = 0;
+    let lineStartOffset = 0;
+    let checkpointByteOffset = -1;
+    let removedCount = 0;
+    let targetCheckpointSeen = false;
+    try {
+      fd = await fsp3.open(this.filePath, "r", 384);
+      while (true) {
+        const buf = Buffer.alloc(CHUNK_SIZE);
+        const { bytesRead } = await fd.read(buf, 0, CHUNK_SIZE, fileOffset);
+        if (bytesRead === 0) break;
+        let chunkPos = 0;
+        while (chunkPos < bytesRead) {
+          const idx = buf.indexOf("\n", chunkPos);
+          if (idx === -1) {
+            lineStartOffset = fileOffset + chunkPos;
+            break;
+          }
+          if (checkpointByteOffset !== -1) {
+            removedCount++;
+          } else {
+            const lineBytes = buf.subarray(chunkPos, idx);
+            const line = new TextDecoder("utf-8", { fatal: false }).decode(lineBytes);
+            if (line.trim()) {
+              try {
+                const event = JSON.parse(line);
+                if (event.type === "checkpoint") {
+                  if (event.promptIndex === targetPromptIndex) {
+                    checkpointByteOffset = lineStartOffset;
+                    targetCheckpointSeen = true;
+                  } else if (event.promptIndex !== void 0 && event.promptIndex > targetPromptIndex) {
+                    checkpointByteOffset = lineStartOffset;
+                  }
+                } else if (targetCheckpointSeen && event.promptIndex !== void 0 && event.promptIndex > targetPromptIndex) {
+                  removedCount++;
+                } else if (targetCheckpointSeen && event.promptIndex === void 0) {
+                  removedCount++;
+                } else if (!targetCheckpointSeen && event.promptIndex === void 0) {
+                  removedCount++;
+                } else if (!targetCheckpointSeen && event.promptIndex !== void 0 && event.promptIndex > targetPromptIndex) {
+                  removedCount++;
+                }
+              } catch {
+              }
+            }
+          }
+          chunkPos = idx + 1;
+          lineStartOffset = fileOffset + chunkPos;
         }
-        if (entry.id && !deleted.has(entry.id)) {
-          seen.set(entry.id, entry);
+        fileOffset += bytesRead;
+        if (chunkPos >= bytesRead) {
+          lineStartOffset = fileOffset;
         }
-      } catch {
       }
+    } finally {
+      await fd?.close();
     }
-    const summaries = Array.from(seen.values());
-    this._indexCache = { ...stat6, summaries };
-    return [...summaries];
-  }
-  /**
-   * Rebuild the index from disk by scanning all sessions and writing a
-   * fresh _index.jsonl. Useful after manual cleanup or index corruption.
-   */
-  async rebuildIndex() {
-    const ids = await this.collectSessionIds(this.dir);
-    const summaries = await Promise.all(ids.map((id) => this.summaryFor(id).catch(() => null)));
-    const valid = summaries.filter((s) => s !== null);
-    const tmp = `${this.indexFile}.tmp`;
-    const lines = valid.map((s) => JSON.stringify(s)).join("\n") + "\n";
-    await fsp2.writeFile(tmp, lines, "utf8");
-    await fsp2.rename(tmp, this.indexFile);
-    this._indexCache = null;
-    return valid.length;
-  }
-  async listFromDirectoryScan(limit) {
-    const refs = await this.collectSessionFiles(this.dir);
-    const candidates = await mapWithConcurrency(
-      refs,
-      _DefaultSessionStore.LIST_SCAN_CONCURRENCY,
-      async (ref) => {
-        const manifest = await this.readSummaryManifest(ref.id);
-        if (manifest) return { summary: manifest, needsBackfill: false };
-        const summary = await this.summaryHeaderFor(ref);
-        return summary ? { summary, needsBackfill: true } : null;
-      }
-    );
-    const out = candidates.filter((s) => s !== null);
-    out.sort((a, b) => compareSessionSummaries(a.summary, b.summary));
-    const selected = out.slice(0, limit);
-    const summaries = await mapWithConcurrency(
-      selected,
-      Math.min(_DefaultSessionStore.LIST_SCAN_CONCURRENCY, Math.max(1, limit)),
-      async (candidate) => {
-        if (!candidate.needsBackfill) return candidate.summary;
-        return await this.summaryFor(candidate.summary.id).catch(() => candidate.summary);
-      }
-    );
-    return summaries.filter((s) => s !== null);
-  }
-  async collectSessionFiles(dir, prefix = "", depth = 0) {
-    let entries;
+    if (checkpointByteOffset === -1) return 0;
+    await this.writeChain;
+    await this.handle.close();
+    const tmpPath = `${this.filePath}.rewind.tmp`;
+    const src = await fsp3.open(this.filePath, "r", 384);
     try {
-      entries = await fsp2.readdir(dir, { withFileTypes: true });
-    } catch {
-      return [];
-    }
-    const dirEntries = [];
-    const files = [];
-    for (const entry of entries) {
-      if (entry.name.startsWith(".") && entry.name !== ".wrongstack") continue;
-      if (entry.name === "shared" || entry.name === "subagents" || entry.name === "attachments")
-        continue;
-      if (entry.isDirectory()) {
-        dirEntries.push(entry);
-      } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
-        if (entry.name === "_index.jsonl") continue;
-        const base = entry.name.replace(/\.jsonl$/, "");
-        const id = prefix ? `${prefix}/${base}` : base;
-        files.push({ id, filePath: path4.join(dir, entry.name) });
+      const statResult = await src.stat();
+      const totalSize = statResult.size;
+      const prefixBytes = checkpointByteOffset;
+      let newlineAfterCheckpoint = prefixBytes;
+      if (prefixBytes < totalSize) {
+        const probeBuf = Buffer.alloc(Math.min(CHUNK_SIZE, totalSize - prefixBytes));
+        const { bytesRead: probeRead } = await src.read(probeBuf, 0, probeBuf.length, prefixBytes);
+        if (probeRead > 0) {
+          const nl = probeBuf.indexOf("\n");
+          newlineAfterCheckpoint = nl !== -1 ? prefixBytes + nl + 1 : totalSize;
+        }
+      } else {
+        newlineAfterCheckpoint = totalSize;
       }
-    }
-    const childFileArrays = await Promise.all(
-      dirEntries.map((entry) => {
-        const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
-        return this.collectSessionFiles(path4.join(dir, entry.name), childPrefix, depth + 1);
-      })
-    );
-    return [...childFileArrays.flat(), ...files];
-  }
-  /** Recursively collect session IDs from date-shard subdirectories.
-   *  IDs include the date-prefix path (e.g. "2026-06-06/17-46-57Z_…").
-   *  Skips `.jsonl`/`.summary.json` root files, dot-files, and
-   *  sub-directories that belong to fleet/subagent sessions. */
-  async collectSessionIds(dir, prefix = "", depth = 0) {
-    let entries;
-    try {
-      entries = await fsp2.readdir(dir, { withFileTypes: true });
-    } catch {
-      return [];
-    }
-    const dirEntries = [];
-    const fileIds = [];
-    for (const entry of entries) {
-      if (entry.name.startsWith(".") && entry.name !== ".wrongstack") continue;
-      if (entry.name === "shared" || entry.name === "subagents" || entry.name === "attachments")
-        continue;
-      if (entry.isDirectory()) {
-        dirEntries.push(entry);
-      } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
-        if (entry.name === "_index.jsonl") continue;
-        const base = entry.name.replace(/\.jsonl$/, "");
-        fileIds.push(prefix ? `${prefix}/${base}` : base);
+      const writeFd = await fsp3.open(tmpPath, "w", 384);
+      try {
+        let readOffset = 0;
+        while (readOffset < newlineAfterCheckpoint) {
+          const toCopy = Math.min(CHUNK_SIZE, newlineAfterCheckpoint - readOffset);
+          const copyBuf = Buffer.alloc(toCopy);
+          const { bytesRead: r } = await src.read(copyBuf, 0, toCopy, readOffset);
+          if (r === 0) break;
+          await writeFd.write(copyBuf, 0, r);
+          readOffset += r;
+        }
+        let tailOffset = newlineAfterCheckpoint;
+        let leftover = "";
+        while (tailOffset < totalSize) {
+          const toRead = Math.min(CHUNK_SIZE, totalSize - tailOffset);
+          const tailBuf = Buffer.alloc(toRead);
+          const { bytesRead: tr } = await src.read(tailBuf, 0, toRead, tailOffset);
+          if (tr === 0) break;
+          const chunk = leftover + tailBuf.subarray(0, tr).toString("utf8");
+          const lastNl = chunk.lastIndexOf("\n");
+          if (lastNl === -1) {
+            leftover = chunk;
+          } else {
+            for (const line of chunk.slice(0, lastNl + 1).split("\n")) {
+              if (!line.trim()) continue;
+              try {
+                JSON.parse(line);
+              } catch {
+                await writeFd.write(`${line}
+`, void 0, "utf8");
+              }
+            }
+            leftover = chunk.slice(lastNl + 1);
+          }
+          tailOffset += tr;
+        }
+        if (leftover.trim()) {
+          try {
+            JSON.parse(leftover);
+          } catch {
+            await writeFd.write(`${leftover}
+`, void 0, "utf8");
+          }
+        }
+      } finally {
+        await writeFd.close();
       }
-    }
-    const childIdArrays = await Promise.all(
-      dirEntries.map((entry) => {
-        const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
-        return this.collectSessionIds(path4.join(dir, entry.name), childPrefix, depth + 1);
-      })
-    );
-    return [...childIdArrays.flat(), ...fileIds];
-  }
-  async summaryFor(id) {
-    const manifest = this.sessionPath(id, ".summary.json");
-    const t0 = Date.now();
-    let outcome = "success";
-    let errorMsg;
-    const fromManifest = await this.readSummaryManifest(id, t0);
-    if (fromManifest) return fromManifest;
-    try {
-      const full = this.sessionPath(id, ".jsonl");
-      const stat6 = await fsp2.stat(full);
-      const summary = await this.summarize(id, stat6.mtime.toISOString());
-      await atomicWrite(manifest, JSON.stringify(summary), { mode: 384 }).catch((err) => {
-        const msg = toErrorMessage(err);
-        this.emitError(id, manifest, "summary_fallback", msg, true);
-        console.warn(JSON.stringify({
-          level: "warn",
-          event: "session_store.manifest_write_failed",
-          sessionId: id,
-          message: msg,
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        }));
-      });
-      outcome = "failure";
-      errorMsg = "summary fallback \xE2\u20AC\u201D manifest rebuilt";
-      this.emitRead(id, manifest, "summary", outcome, Date.now() - t0, errorMsg);
-      return summary;
+      await src.close();
+      await fsp3.rename(tmpPath, this.filePath);
+      this.handle = await fsp3.open(this.filePath, "a", 384);
     } catch (err) {
-      outcome = "failure";
-      errorMsg = toErrorMessage(err);
-      this.emitRead(id, manifest, "summary", outcome, Date.now() - t0, errorMsg);
-      return {
-        id,
-        title: "(damaged)",
-        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        model: "unknown",
-        provider: "unknown",
-        tokenTotal: 0
-      };
+      await fsp3.unlink(tmpPath).catch(() => void 0);
+      this.handle = await fsp3.open(this.filePath, "a", 384).catch(() => this.handle);
+      throw err;
     }
+    await this.append({
+      type: "rewound",
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      toPromptIndex: targetPromptIndex,
+      revertedFiles: []
+    });
+    this.events?.emit("session.rewound", {
+      toPromptIndex: targetPromptIndex,
+      revertedFiles: [],
+      removedEvents: removedCount
+    });
+    return removedCount;
   }
-  async readSummaryManifest(id, startTime = Date.now()) {
-    const manifest = this.sessionPath(id, ".summary.json");
-    try {
-      const raw = await fsp2.readFile(manifest, "utf8");
-      this.emitRead(id, manifest, "summary", "success", Date.now() - startTime);
-      return JSON.parse(raw);
-    } catch {
-      return null;
+  async clearSession() {
+    if (!this.filePath) return;
+    if (this.flushTimer) {
+      clearTimeout(this.flushTimer);
+      this.flushTimer = null;
     }
+    this.writeBuffer = [];
+    await this.writeChain;
+    const record = `${JSON.stringify({
+      type: "session_start",
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      id: this.id,
+      model: this.meta.model ?? "unknown",
+      provider: this.meta.provider ?? "unknown"
+    })}
+`;
+    await fsp3.writeFile(this.filePath, record, "utf8");
   }
-  async summaryHeaderFor(ref) {
-    let mtime = (/* @__PURE__ */ new Date(0)).toISOString();
-    try {
-      const stat6 = await fsp2.stat(ref.filePath);
-      if (!stat6.isFile()) {
-        return {
-          id: ref.id,
-          title: "(damaged)",
-          startedAt: stat6.mtime.toISOString(),
-          model: "unknown",
-          provider: "unknown",
-          tokenTotal: 0
-        };
-      }
-      mtime = stat6.mtime.toISOString();
-    } catch {
-      return null;
-    }
-    try {
-      for await (const event of this.iterSessionEvents(ref.filePath)) {
-        if (event.type === "session_start") {
-          return {
-            id: ref.id,
-            title: "(empty session)",
-            startedAt: event.ts,
-            model: event.model ?? "unknown",
-            provider: event.provider ?? "unknown",
-            tokenTotal: 0
-          };
-        }
-      }
-      return {
-        id: ref.id,
-        title: "(empty session)",
-        startedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
-        model: "unknown",
-        provider: "unknown",
-        tokenTotal: 0
-      };
-    } catch {
-      return {
-        id: ref.id,
-        title: "(damaged)",
-        startedAt: mtime,
-        model: "unknown",
-        provider: "unknown",
-        tokenTotal: 0
-      };
+  /**
+   * Write an in-flight marker. The agent loop should call
+   * this at the start of each long-running operation; a matching
+   * `clearInFlightMarker` follows on clean exit. A stale marker
+   * (no end) is what `SessionRecovery.detectStale` looks for.
+   */
+  async writeInFlightMarker(context) {
+    if (!context || context.length > 500) {
+      throw new Error("In-flight context must be 1..500 chars");
     }
+    await this.append({
+      type: "in_flight_start",
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      context
+    });
+    this.events?.emit("in_flight.started", { context, ts: (/* @__PURE__ */ new Date()).toISOString() });
   }
   /**
-   * Delete a session and all associated files: JSONL, summary, plan/todos
-   * sidecars, and the session directory (fleet.json, shared/, subagents/).
+   * Close the in-flight marker. Idempotent in spirit
+   * (you can call it after a successful iteration even if you
+   * didn't open one this round) — but the session log records
+   * every call so postmortem tooling can see "the agent finished
+   * cleanly X times, then died without finishing Y".
+   */
+  async clearInFlightMarker(reason) {
+    await this.append({
+      type: "in_flight_end",
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      reason
+    });
+    this.events?.emit("in_flight.ended", { reason, ts: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+};
+function sanitizeModel(model) {
+  return model.replace(/[^a-zA-Z0-9_-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 40);
+}
+function generateSessionId(startedAt, model) {
+  const date = startedAt.slice(0, 10);
+  const time = startedAt.slice(11, 19).replace(/:/g, "-");
+  const suffix = randomBytes(2).toString("hex");
+  const modelPart = model ? `_${sanitizeModel(model)}` : "";
+  return `${date}/${time}Z${modelPart}_${suffix}`;
+}
+
+// src/storage/session-store.ts
+var DefaultSessionStore = class _DefaultSessionStore {
+  dir;
+  events;
+  secretScrubber;
+  /**
+   * In-memory cache for load() results, keyed by session ID. The cache is
+   * invalidated when the file's mtimeMs or size changes (indicating the
+   * file was written to). This eliminates redundant full-file reads and
+   * JSON parses when the same session is loaded multiple times within the
+   * store's lifetime (e.g., webui session detail views, list() fallbacks).
    *
-   * Individual file deletions are best-effort (logged as structured warnings),
-   * but a tombstone is always written so readIndex() filters this session out.
-   * If the session directory itself can't be removed, the error is surfaced
-   * to the caller so prune() can report it.
+   * Max size is capped to prevent unbounded memory growth in long-running
+   * processes. When the limit is reached, the oldest entry is evicted.
    */
-  async deleteSession(id) {
-    const jsonlPath = this.sessionPath(id, ".jsonl");
-    const summaryPath = this.sessionPath(id, ".summary.json");
-    const shardDir = path4.dirname(path4.join(this.dir, id));
-    const base = path4.basename(id);
-    const sessDir = path4.join(shardDir, base);
-    const deletions = [
-      fsp2.unlink(jsonlPath),
-      fsp2.unlink(summaryPath),
-      fsp2.unlink(path4.join(shardDir, `${base}.plan.json`)),
-      fsp2.unlink(path4.join(shardDir, `${base}.todos.json`))
-    ];
-    const results = await Promise.allSettled(deletions);
-    for (const r of results) {
-      if (r.status === "rejected") {
-        const msg = r.reason instanceof Error ? r.reason.message : String(r.reason);
-        if (r.reason?.code !== "ENOENT") {
-          console.warn(JSON.stringify({
-            level: "warn",
-            event: "session_store.delete_failed",
-            sessionId: id,
-            message: msg,
-            timestamp: (/* @__PURE__ */ new Date()).toISOString()
-          }));
-        }
-      }
+  _loadCache = /* @__PURE__ */ new Map();
+  _indexCache = null;
+  shardManifestCache = /* @__PURE__ */ new Map();
+  static LOAD_CACHE_MAX_ENTRIES = 50;
+  static LIST_SCAN_CONCURRENCY = 32;
+  constructor(opts) {
+    this.dir = opts.dir;
+    this.events = opts.events;
+    this.secretScrubber = opts.secretScrubber;
+  }
+  /**
+   * Clear the load() cache. Useful for testing or when the caller knows
+   * the file has changed externally (e.g., another process wrote to it).
+   */
+  clearLoadCache(sessionId) {
+    if (sessionId !== void 0) {
+      this._loadCache.delete(sessionId);
+    } else {
+      this._loadCache.clear();
     }
-    await fsp2.rm(sessDir, { recursive: true, force: true }).catch((err) => {
-      console.warn(JSON.stringify({
-        level: "warn",
-        event: "session_store.rmdir_failed",
-        sessionId: id,
-        message: toErrorMessage(err),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }));
+  }
+  // ── Storage event helpers ───────────────────────────────────────────────────
+  emitRead(sessionId, filePath, operation, outcome, durationMs, error) {
+    this.events?.emit("storage.read", {
+      sessionId,
+      store: "session",
+      filePath,
+      operation,
+      outcome,
+      durationMs,
+      ...error !== void 0 ? { error } : {}
+    });
+  }
+  emitWrite(sessionId, filePath, operation, outcome, durationMs, eventCount, error) {
+    this.events?.emit("storage.write", {
+      sessionId,
+      store: "session",
+      filePath,
+      operation,
+      outcome,
+      durationMs,
+      ...eventCount !== void 0 ? { eventCount } : {},
+      ...error !== void 0 ? { error } : {}
     });
-    await this.writeTombstone(id);
   }
-  async delete(id) {
-    await this.deleteSession(id);
+  emitError(sessionId, filePath, operation, error, recoverable) {
+    this.events?.emit("storage.error", {
+      sessionId,
+      store: "session",
+      filePath,
+      operation,
+      error,
+      recoverable
+    });
   }
-  async prune(maxAgeDays = 30) {
-    const cutoff = Date.now() - maxAgeDays * 864e5;
-    let deleted = 0;
-    let activeSessionId = null;
+  /** Absolute path to the session index file. */
+  get indexFile() {
+    return path4.join(this.dir, "_index.jsonl");
+  }
+  /** Join session ID to its absolute path within the store directory. */
+  sessionPath(id, ext) {
+    return path4.join(this.dir, `${id}${ext}`);
+  }
+  shardManifestPath(shardKey) {
+    return shardKey ? path4.join(this.dir, shardKey, "_manifest.json") : path4.join(this.dir, "_manifest.json");
+  }
+  shardKeyForSessionId(id) {
+    const dirName = path4.dirname(id);
+    return dirName === "." ? "" : dirName;
+  }
+  invalidateShardManifestBySessionId(id) {
+    this.shardManifestCache.delete(this.shardKeyForSessionId(id));
+  }
+  /**
+   * Ensure the directory implied by the session ID exists. When the ID
+   * contains a date prefix like `2026-06-06/...`, this creates the date
+   * subdirectory so sessions group naturally by day.
+   */
+  async ensureShardDir(id) {
+    const dirPath = path4.dirname(path4.join(this.dir, id));
+    await ensureDir(dirPath);
+    return dirPath;
+  }
+  async create(meta) {
+    const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const id = meta.id && meta.id.length > 0 ? meta.id : generateSessionId(startedAt, meta.model ?? meta.provider);
+    const shardDir = await this.ensureShardDir(id);
+    const file = path4.join(shardDir, `${path4.basename(id)}.jsonl`);
+    const t0 = Date.now();
+    let handle;
     try {
-      const raw = await fsp2.readFile(path4.join(this.dir, "active.json"), "utf8");
-      const active = JSON.parse(raw);
-      activeSessionId = active.sessionId ?? null;
-    } catch {
+      handle = await fsp3.open(file, "a", 384);
+    } catch (err) {
+      this.emitError(id, file, "create", toErrorMessage(err), false);
+      throw new Error(
+        `Failed to open session file: ${toErrorMessage(err)}`,
+        { cause: err }
+      );
     }
-    const isPrunableJsonl = (name) => name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
-    const pruneFile = async (dir, name, prefix) => {
-      const jsonlPath = path4.join(dir, name);
-      try {
-        const stat6 = await fsp2.stat(jsonlPath);
-        if (stat6.mtimeMs >= cutoff) return;
-      } catch {
-        return;
-      }
-      const base = name.replace(/\.jsonl$/, "");
-      const id = prefix ? `${prefix}/${base}` : base;
-      if (activeSessionId && id === activeSessionId) return;
-      await this.deleteSession(id);
-      deleted++;
-    };
-    const entries = await fsp2.readdir(this.dir, { withFileTypes: true }).catch(() => []);
-    for (const entry of entries) {
-      if (entry.isFile()) {
-        if (isPrunableJsonl(entry.name)) await pruneFile(this.dir, entry.name, "");
-        continue;
-      }
-      if (!entry.isDirectory()) continue;
-      const dateDir = path4.join(this.dir, entry.name);
-      const files = await fsp2.readdir(dateDir, { withFileTypes: true }).catch(() => []);
-      for (const file of files) {
-        if (!file.isFile() || !isPrunableJsonl(file.name)) continue;
-        await pruneFile(dateDir, file.name, entry.name);
-      }
+    try {
+      const writer = new FileSessionWriter(id, handle, startedAt, meta, this.events, {
+        dir: shardDir,
+        filePath: file,
+        secretScrubber: this.secretScrubber,
+        onClose: (s) => this.appendToIndex(s)
+      });
+      this.emitWrite(id, file, "create", "success", Date.now() - t0);
+      return writer;
+    } catch (err) {
+      await handle.close().catch((e) => console.warn(JSON.stringify({
+        level: "warn",
+        event: "session_store.handle_close_failed",
+        message: e instanceof Error ? e.message : String(e),
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })));
+      this.emitError(id, file, "create", toErrorMessage(err), true);
+      throw err;
     }
-    if (deleted > 0) {
-      await this.compactIndex().catch(() => void 0);
+  }
+  async resume(id) {
+    const file = this.sessionPath(id, ".jsonl");
+    const t0 = Date.now();
+    const data = await this.load(id);
+    let handle;
+    try {
+      handle = await fsp3.open(file, "a", 384);
+    } catch (err) {
+      this.emitError(id, file, "resume", toErrorMessage(err), false);
+      throw new Error(
+        `Failed to open session "${id}" for append: ${toErrorMessage(err)}`,
+        { cause: err }
+      );
     }
-    for (const entry of entries) {
-      if (!entry.isDirectory()) continue;
-      const dateDir = path4.join(this.dir, entry.name);
-      try {
-        const remaining = await fsp2.readdir(dateDir);
-        if (remaining.length === 0) {
-          await fsp2.rmdir(dateDir).catch(() => void 0);
+    try {
+      const writer = new FileSessionWriter(
+        id,
+        handle,
+        (/* @__PURE__ */ new Date()).toISOString(),
+        {
+          id,
+          model: data.metadata.model,
+          provider: data.metadata.provider
+        },
+        this.events,
+        {
+          resumed: true,
+          // Shard directory (sessions/<date>/) — must match create() so the
+          // .summary.json sidecar lands next to the JSONL instead of the
+          // sessions root (where summaryFor() would never find it).
+          dir: path4.dirname(file),
+          filePath: file,
+          secretScrubber: this.secretScrubber,
+          onClose: (s) => this.appendToIndex(s)
         }
-      } catch {
-      }
+      );
+      this.emitWrite(id, file, "resume", "success", Date.now() - t0);
+      return { writer, data };
+    } catch (err) {
+      await handle.close().catch((e) => console.warn(JSON.stringify({
+        level: "warn",
+        event: "session_store.handle_close_failed",
+        message: e instanceof Error ? e.message : String(e),
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })));
+      this.emitError(id, file, "resume", toErrorMessage(err), true);
+      throw err;
     }
-    return deleted;
   }
-  async clearHistory(id) {
-    await this.ensureShardDir(id);
+  async load(id) {
     const file = this.sessionPath(id, ".jsonl");
-    const meta = this.sessionPath(id, ".summary.json");
-    const record = `${JSON.stringify({
-      type: "session_start",
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      id,
-      model: "unknown",
-      provider: "unknown"
-    })}
-`;
-    await fsp2.writeFile(file, record, "utf8");
-    await fsp2.unlink(meta).catch(() => void 0);
-  }
-  async summarize(id, mtime) {
+    const t0 = Date.now();
+    let outcome = "success";
+    let errorMsg;
+    let cacheHit = false;
     try {
-      const file = this.sessionPath(id, ".jsonl");
-      let title = "(empty session)";
-      let startedAt = (/* @__PURE__ */ new Date(0)).toISOString();
-      let endedAt;
-      let model = "unknown";
-      let provider = "unknown";
-      let tokenIn = 0;
-      let tokenOut = 0;
-      let iterationCount = 0;
-      let toolCallCount = 0;
-      let toolErrorCount = 0;
-      let fileChangeCount = 0;
-      const toolBreakdown = {};
-      let outcome;
-      let lastEventType;
-      let hasError = false;
-      let sawStart = false;
-      for await (const e of this.iterSessionEvents(file)) {
-        lastEventType = e.type;
-        if (e.type === "session_start") {
-          if (!sawStart) {
-            sawStart = true;
-            startedAt = e.ts;
-            model = e.model ?? "unknown";
-            provider = e.provider ?? "unknown";
+      const s = await fsp3.stat(file);
+      const stat8 = { mtimeMs: s.mtimeMs, size: s.size };
+      const cached = this._loadCache.get(id);
+      if (cached && cached.mtimeMs === stat8.mtimeMs && cached.size === stat8.size) {
+        cacheHit = true;
+        this._loadCache.delete(id);
+        this._loadCache.set(id, cached);
+        return cached.data;
+      }
+      const raw = await fsp3.readFile(file, "utf8");
+      const lines = raw.split("\n").filter((l) => l.trim());
+      const events = [];
+      let sessionStartEvent;
+      let sessionEndEvent;
+      let sessionModel;
+      let sessionProvider;
+      let sessionPendingToolUses;
+      const messages = [];
+      const openToolUses = /* @__PURE__ */ new Set();
+      let usage = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+      for (const line of lines) {
+        try {
+          const parsed = JSON.parse(line);
+          if (parsed !== null && typeof parsed === "object" && typeof parsed.type === "string" && typeof parsed.ts === "string") {
+            const ev = parsed;
+            events.push(ev);
+            if (ev.type === "session_start" && !sessionStartEvent) {
+              sessionStartEvent = ev;
+              sessionModel = ev.model;
+              sessionProvider = ev.provider;
+            }
+            if (ev.type === "session_end") {
+              sessionEndEvent = ev;
+              sessionPendingToolUses = ev.pendingToolUses;
+            }
+            if (ev.type === "user_input") {
+              openToolUses.clear();
+              messages.push({ role: "user", content: ev.content, ts: ev.ts });
+            } else if (ev.type === "llm_response") {
+              messages.push({ role: "assistant", content: ev.content, ts: ev.ts });
+              for (const b of ev.content) {
+                if (b.type === "tool_use") openToolUses.add(b.id);
+              }
+              usage = {
+                input: usage.input + (ev.usage.input ?? 0),
+                output: usage.output + (ev.usage.output ?? 0),
+                cacheRead: (usage.cacheRead ?? 0) + (ev.usage.cacheRead ?? 0),
+                cacheWrite: (usage.cacheWrite ?? 0) + (ev.usage.cacheWrite ?? 0)
+              };
+            } else if (ev.type === "tool_result") {
+              if (!openToolUses.has(ev.id)) {
+                this.events?.emit("session.damaged", {
+                  sessionId: id,
+                  detail: `Orphan tool_result "${ev.id}" has no matching tool_use`
+                });
+                continue;
+              }
+              openToolUses.delete(ev.id);
+              const resultBlock = {
+                type: "tool_result",
+                tool_use_id: ev.id,
+                content: typeof ev.content === "string" ? ev.content : JSON.stringify(ev.content),
+                is_error: ev.isError
+              };
+              const last = messages[messages.length - 1];
+              const lastIsToolResultUser = last?.role === "user" && Array.isArray(last.content) && last.content.every((b) => b.type === "tool_result");
+              if (lastIsToolResultUser && Array.isArray(last.content)) {
+                last.content.push(resultBlock);
+              } else {
+                messages.push({ role: "user", content: [resultBlock], ts: ev.ts });
+              }
+            }
           }
-        } else if (e.type === "session_end") {
-          endedAt = e.ts;
-        } else if (e.type === "user_input") {
-          if (title === "(empty session)") title = userInputTitle(e.content);
-        } else if (e.type === "llm_response") {
-          tokenIn += e.usage.input ?? 0;
-          tokenOut += e.usage.output ?? 0;
-        } else if (e.type === "in_flight_start") iterationCount++;
-        else if (e.type === "tool_call_start") {
-          toolCallCount++;
-          toolBreakdown[e.name] = (toolBreakdown[e.name] ?? 0) + 1;
-        } else if (e.type === "tool_result" && e.isError) toolErrorCount++;
-        else if (e.type === "file_snapshot") fileChangeCount += e.files.length;
-        else if (e.type === "error" || e.type === "provider_error") hasError = true;
+        } catch {
+        }
       }
-      if (lastEventType === "session_end") {
-        outcome = "completed";
-      } else if (lastEventType === "in_flight_start") {
-        outcome = "aborted";
-      } else if (hasError) {
-        outcome = "error";
+      if (openToolUses.size > 0) {
+        this.events?.emit("session.damaged", {
+          sessionId: id,
+          detail: `${openToolUses.size} tool_use blocks without matching results - replay repaired`
+        });
       }
-      return {
-        id,
-        title,
-        startedAt,
-        endedAt,
-        model,
-        provider,
-        tokenTotal: tokenIn + tokenOut,
-        iterationCount: iterationCount > 0 ? iterationCount : void 0,
-        toolCallCount: toolCallCount > 0 ? toolCallCount : void 0,
-        toolErrorCount: toolErrorCount > 0 ? toolErrorCount : void 0,
-        fileChangeCount: fileChangeCount > 0 ? fileChangeCount : void 0,
-        toolBreakdown: Object.keys(toolBreakdown).length > 0 ? toolBreakdown : {},
-        outcome
-      };
-    } catch {
-      return {
+      const repaired = repairToolUseAdjacency(messages);
+      if (repaired.report.changed) {
+        this.events?.emit("session.damaged", {
+          sessionId: id,
+          detail: `Repaired replay adjacency: removed ${repaired.report.removedToolUses.length} tool_use, ${repaired.report.removedToolResults.length} tool_result, ${repaired.report.removedMessages} empty messages`
+        });
+      }
+      const meta = {
         id,
-        title: "(damaged)",
-        startedAt: mtime,
-        model: "unknown",
-        provider: "unknown",
-        tokenTotal: 0
+        startedAt: sessionStartEvent?.ts ?? (/* @__PURE__ */ new Date(0)).toISOString(),
+        endedAt: sessionEndEvent?.ts,
+        model: sessionModel,
+        provider: sessionProvider,
+        pendingToolUses: sessionPendingToolUses
       };
+      const toolCallEnds = extractToolCallEnds(events);
+      const data = { metadata: meta, events, messages: repaired.messages, usage, toolCallEnds };
+      if (this._loadCache.size >= _DefaultSessionStore.LOAD_CACHE_MAX_ENTRIES) {
+        const oldest = this._loadCache.keys().next().value;
+        if (oldest !== void 0) {
+          this._loadCache.delete(oldest);
+        }
+      }
+      this._loadCache.set(id, { mtimeMs: stat8.mtimeMs, size: stat8.size, data });
+      return data;
+    } catch (err) {
+      outcome = "failure";
+      errorMsg = toErrorMessage(err);
+      throw err;
+    } finally {
+      this.emitRead(id, file, "load", outcome, Date.now() - t0, errorMsg);
+      if (cacheHit) {
+        this.events?.emit("storage.cache_hit", {
+          sessionId: id,
+          store: "session",
+          filePath: file,
+          operation: "load",
+          durationMs: Date.now() - t0
+        });
+      }
     }
   }
-  async *iterSessionEvents(file) {
-    const stream = createReadStream(file, { encoding: "utf8" });
-    const lines = createInterface({ input: stream, crlfDelay: Infinity });
+  /**
+   * Streaming search over a session's JSONL. Walks the file once, parses
+   * each event lazily, and yields only the events that match `predicate`.
+   * Stops as soon as `opts.limit` matches are collected.
+   *
+   * Why this exists: `load()` parses the entire file into memory and
+   * rebuilds `messages`/`toolCallEnds` for every caller. `search()` only
+   * needs to know which events contain matching text — a per-line
+   * predicate is enough. The full parse work (and the `_loadCache` poll)
+   * is wasted in that case.
+   *
+   * Memory: O(hits) regardless of file size. Disk: one linear scan,
+   * terminated at `limit` if the caller asked for one.
+   *
+   * Errors: missing file yields []. Corrupt lines are skipped (same
+   * policy as `load()`). Aborting via `signal` rejects with `AbortError`.
+   */
+  async searchEvents(id, predicate, opts) {
+    const file = this.sessionPath(id, ".jsonl");
+    const limit = opts?.limit;
+    const signal = opts?.signal;
+    const out = [];
+    let stat8;
     try {
-      for await (const line of lines) {
-        if (!line.trim()) continue;
+      stat8 = await fsp3.stat(file);
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      throw err;
+    }
+    if (stat8.size === 0) return [];
+    let fh;
+    try {
+      fh = await fsp3.open(file, "r");
+      const CHUNK = 64 * 1024;
+      const buf = Buffer.alloc(CHUNK);
+      let leftover = "";
+      let eventIndex = 0;
+      for (let position = 0; ; position += buf.byteLength) {
+        if (signal?.aborted) {
+          const reason = signal.reason ?? new DOMException("Aborted", "AbortError");
+          throw reason;
+        }
+        const { bytesRead } = await fh.read(buf, 0, CHUNK, position);
+        if (bytesRead === 0) break;
+        const text = leftover + buf.subarray(0, bytesRead).toString("utf8");
+        const parts = text.split("\n");
+        leftover = parts.pop() ?? "";
+        for (const line of parts) {
+          if (!line) continue;
+          let ev;
+          try {
+            const parsed = JSON.parse(line);
+            if (parsed === null || typeof parsed !== "object" || typeof parsed.type !== "string" || typeof parsed.ts !== "string") {
+              continue;
+            }
+            ev = parsed;
+          } catch {
+            continue;
+          }
+          if (predicate(ev, eventIndex, ev.ts)) {
+            out.push({ event: ev, eventIndex, ts: ev.ts });
+            if (limit !== void 0 && out.length >= limit) {
+              return out;
+            }
+          }
+          eventIndex++;
+        }
+      }
+      if (leftover.trim()) {
         try {
-          const parsed = JSON.parse(line);
+          const parsed = JSON.parse(leftover);
           if (parsed !== null && typeof parsed === "object" && typeof parsed.type === "string" && typeof parsed.ts === "string") {
-            yield parsed;
+            const ev = parsed;
+            if (predicate(ev, eventIndex, ev.ts)) {
+              out.push({ event: ev, eventIndex, ts: ev.ts });
+            }
           }
         } catch {
         }
       }
+      return out;
     } finally {
-      lines.close();
-      stream.destroy();
+      if (fh) await fh.close().catch(() => void 0);
     }
   }
-};
-function extractToolCallEnds(events) {
-  const result = [];
-  for (const e of events) {
-    if (e.type === "tool_call_end") {
-      result.push({
-        name: e.name,
-        id: e.id,
-        durationMs: e.durationMs,
-        ok: e.ok ?? false,
-        outputBytes: e.outputBytes,
-        outputTokens: e.outputTokens,
-        outputLines: e.outputLines
+  async list(limit = 20) {
+    try {
+      await ensureDir(this.dir);
+      const indexed = await this.readIndex();
+      if (indexed.length > 0) {
+        indexed.sort((a, b) => {
+          if (a.startedAt < b.startedAt) return 1;
+          if (a.startedAt > b.startedAt) return -1;
+          return a.id.localeCompare(b.id);
+        });
+        return indexed.slice(0, limit);
+      }
+      return await this.listFromDirectoryScan(limit);
+    } catch {
+      return [];
+    }
+  }
+  /**
+   * List sessions matching filter criteria, using the cached index.
+   * Filters are applied BEFORE sorting and slicing, so the caller gets
+   * exactly `limit` matching sessions — not a slice of a larger fetch.
+   *
+   * This avoids the DefaultSessionReader pattern of fetching 1000 sessions
+   * then linear-filtering: the index is already in memory (readIndex
+   * caches it), and the filter runs over the cached array without any
+   * additional disk I/O.
+   */
+  async listFiltered(criteria) {
+    const limit = criteria.limit ?? 100;
+    try {
+      await ensureDir(this.dir);
+      const indexed = await this.readIndex();
+      if (indexed.length === 0) {
+        const raw = await this.list(Math.max(limit, 100));
+        return raw.filter((s) => matchesSessionFilter(s, criteria)).slice(0, limit);
+      }
+      const filtered = indexed.filter((s) => matchesSessionFilter(s, criteria));
+      filtered.sort((a, b) => {
+        if (a.startedAt < b.startedAt) return 1;
+        if (a.startedAt > b.startedAt) return -1;
+        return a.id.localeCompare(b.id);
       });
+      return filtered.slice(0, limit);
+    } catch {
+      return [];
+    }
+  }
+  // ── Session index (_index.jsonl) ─────────────────────────────────────────
+  //
+  // One JSON line per closed session, appended atomically on close().
+  // When a session is deleted, a tombstone {action:"delete",id:"..."} is
+  // appended. On read, tombstones filter out matching session entries.
+  // This keeps listing O(lines-in-index) instead of O(files-on-disk).
+  //
+  // The index auto-compacts every N appends to prevent unbounded growth
+  // from tombstones and duplicate entries (resume cycles).
+  indexAppendCount = 0;
+  static COMPACT_EVERY = 30;
+  /** Append a session summary to the index. */
+  async appendToIndex(summary) {
+    try {
+      await ensureDir(this.dir);
+      const line = JSON.stringify(summary) + "\n";
+      await fsp3.appendFile(this.indexFile, line, "utf8");
+      this._indexCache = null;
+      this.invalidateShardManifestBySessionId(summary.id);
+      this.indexAppendCount++;
+      if (this.indexAppendCount >= _DefaultSessionStore.COMPACT_EVERY) {
+        await this.compactIndex();
+        this.indexAppendCount = 0;
+      }
+    } catch {
+    }
+  }
+  /** Append a tombstone entry for a deleted session. */
+  async writeTombstone(id) {
+    try {
+      await ensureDir(this.dir);
+      const line = JSON.stringify({ action: "delete", id }) + "\n";
+      await fsp3.appendFile(this.indexFile, line, "utf8");
+      this._indexCache = null;
+      this.invalidateShardManifestBySessionId(id);
+      this.indexAppendCount++;
+    } catch {
+    }
+  }
+  /**
+   * Compact the index: read all entries, drop tombstones, deduplicate
+   * (keep latest per session), and rewrite. Atomic via temp+rename.
+   */
+  async compactIndex() {
+    const t0 = Date.now();
+    let outcome = "success";
+    let errorMsg;
+    try {
+      const entries = await this.readIndex();
+      if (entries.length === 0) return;
+      const tmp = `${this.indexFile}.compact.tmp`;
+      const lines = entries.map((s) => JSON.stringify(s)).join("\n") + "\n";
+      await fsp3.writeFile(tmp, lines, "utf8");
+      await fsp3.rename(tmp, this.indexFile);
+      this._indexCache = null;
+    } catch (err) {
+      outcome = "failure";
+      errorMsg = toErrorMessage(err);
+    } finally {
+      this.emitWrite("~compact~", this.indexFile, "compact", outcome, Date.now() - t0, void 0, errorMsg);
+    }
+  }
+  /**
+   * Read the index file and return deduplicated session summaries.
+   * Entries with a matching tombstone are filtered out.
+   * Returns empty array when the index doesn't exist or is corrupt.
+   */
+  async readIndex() {
+    let stat8;
+    try {
+      const s = await fsp3.stat(this.indexFile);
+      stat8 = { mtimeMs: s.mtimeMs, size: s.size };
+    } catch {
+      this._indexCache = null;
+      return [];
+    }
+    if (this._indexCache !== null && this._indexCache.mtimeMs === stat8.mtimeMs && this._indexCache.size === stat8.size) {
+      return [...this._indexCache.summaries];
+    }
+    let raw;
+    try {
+      raw = await fsp3.readFile(this.indexFile, "utf8");
+    } catch {
+      this._indexCache = null;
+      return [];
+    }
+    const deleted = /* @__PURE__ */ new Set();
+    const seen = /* @__PURE__ */ new Map();
+    for (const line of raw.split("\n")) {
+      if (!line.trim()) continue;
+      try {
+        const entry = JSON.parse(line);
+        if (entry.action === "delete" && entry.id) {
+          deleted.add(entry.id);
+          seen.delete(entry.id);
+          continue;
+        }
+        if (entry.id && !deleted.has(entry.id)) {
+          seen.set(entry.id, entry);
+        }
+      } catch {
+      }
     }
-  }
-  return result;
-}
-var FileSessionWriter = class _FileSessionWriter {
-  constructor(id, handle, startedAt, meta, events, opts = {}, traceId) {
-    this.id = id;
-    this.handle = handle;
-    this.startedAt = startedAt;
-    this.meta = meta;
-    this.events = events;
-    this.resumed = opts.resumed ?? false;
-    this.manifestFile = opts.dir ? path4.join(opts.dir, `${path4.basename(id)}.summary.json`) : "";
-    this.filePath = opts.filePath ?? "";
-    this.secretScrubber = opts.secretScrubber;
-    this.onCloseCb = opts.onClose;
-    this.summary = {
-      id,
-      title: "(empty session)",
-      startedAt,
-      model: meta.model ?? "unknown",
-      provider: meta.provider ?? "unknown",
-      tokenTotal: 0
-    };
-    this.traceId = traceId;
-  }
-  id;
-  handle;
-  startedAt;
-  meta;
-  events;
-  closed = false;
-  closePromise = null;
-  manifestFile;
-  summary;
-  tokenIn = 0;
-  tokenOut = 0;
-  filePath;
-  get transcriptPath() {
-    return this.filePath || void 0;
+    const summaries = Array.from(seen.values());
+    this._indexCache = { ...stat8, summaries };
+    return [...summaries];
   }
   /**
-   * Lazy session_start/session_resumed init, shared by all appenders.
-   * A single promise (not a boolean) so a second append racing the first
-   * can't push its event into the buffer BEFORE the first append's event —
-   * every appender awaits the same init and resumes in FIFO call order.
+   * Rebuild the index from disk by scanning all sessions and writing a
+   * fresh _index.jsonl. Useful after manual cleanup or index corruption.
    */
-  initPromise = null;
-  ensureInit() {
-    if (!this.initPromise) this.initPromise = this.writeSessionStartLazy();
-    return this.initPromise;
+  async rebuildIndex() {
+    const ids = await this.collectSessionIds(this.dir);
+    const summaries = await Promise.all(ids.map((id) => this.summaryFor(id).catch(() => null)));
+    const valid = summaries.filter((s) => s !== null);
+    const tmp = `${this.indexFile}.tmp`;
+    const lines = valid.map((s) => JSON.stringify(s)).join("\n") + "\n";
+    await fsp3.writeFile(tmp, lines, "utf8");
+    await fsp3.rename(tmp, this.indexFile);
+    this._indexCache = null;
+    return valid.length;
   }
-  resumed;
-  appendFailCount = 0;
-  lastAppendWarnAt = 0;
-  secretScrubber;
-  onCloseCb;
-  /** Implements SessionWriter.traceId — propagated from ContextInit.traceId. */
-  traceId;
-  // ── Write buffer — batches events to reduce per-event disk I/O ─────────
-  //
-  // Every append() pushes the scrubbed event into an in-memory buffer instead
-  // of calling handle.appendFile() synchronously. The buffer flushes to disk
-  // when it reaches FLUSH_SIZE events OR after FLUSH_INTERVAL_MS of inactivity.
-  // This cuts the number of disk writes by ~95% without changing the on-disk
-  // format — the JSONL is still one JSON object per line.
-  writeBuffer = [];
-  flushTimer = null;
-  static FLUSH_INTERVAL_MS = 500;
-  static FLUSH_SIZE = 50;
-  // ── Write serialization ─────────────────────────────────────────────────
-  //
-  // All disk writes are funneled through a FIFO promise chain. Without it,
-  // a timer-driven flush racing an explicit flush()/close() issues two
-  // concurrent appendFile() calls on the shared O_APPEND handle — the kernel
-  // may complete them out of order (chronology breaks) or, for large
-  // batches, interleave partial writes (torn JSONL lines). The chain keeps
-  // exactly one write in flight; failures don't break the chain.
-  writeChain = Promise.resolve();
-  /** Enqueue a write on the FIFO chain. Resolves/rejects with that write. */
-  enqueueWrite(data) {
-    const write = this.writeChain.then(() => this.handle.appendFile(data, "utf8"));
-    this.writeChain = write.then(
-      () => void 0,
-      () => void 0
+  async listFromDirectoryScan(limit) {
+    const shardKeys = await this.collectShardKeys();
+    const shardEntries = await mapWithConcurrency(
+      shardKeys,
+      _DefaultSessionStore.LIST_SCAN_CONCURRENCY,
+      async (shardKey) => await this.readOrBuildShardManifest(shardKey)
     );
-    return write;
+    const out = [];
+    for (const entry of shardEntries) {
+      for (const summary of entry.summaries) {
+        out.push({ summary, needsBackfill: false });
+      }
+    }
+    out.sort((a, b) => compareSessionSummaries(a.summary, b.summary));
+    const selected = out.slice(0, limit);
+    const summaries = await mapWithConcurrency(
+      selected,
+      Math.min(_DefaultSessionStore.LIST_SCAN_CONCURRENCY, Math.max(1, limit)),
+      async (candidate) => candidate.summary
+    );
+    return summaries.filter((s) => s !== null);
   }
-  // ── Enriched summary tracking ──────────────────────────────────────────
-  iterationCount = 0;
-  toolCallCount = 0;
-  toolErrorCount = 0;
-  toolBreakdown = {};
-  fileChangeCount = 0;
-  compactionCount = 0;
-  outcome = void 0;
-  /**
-   * Scrub secrets out of conversation-turn events before they are observed
-   * for the summary, written to the JSONL log, or surfaced on resume. Only
-   * `user_input` / `llm_response` carry free-form user/model text; other event
-   * types either have no secret-bearing content or are already scrubbed
-   * upstream (tool results). Returns the event unchanged when no scrubber is
-   * configured.
-   */
-  scrubEvent(event) {
-    const s = this.secretScrubber;
-    if (!s) return event;
-    if (event.type === "user_input") {
-      return {
-        ...event,
-        content: typeof event.content === "string" ? s.scrub(event.content) : s.scrubObject(event.content)
-      };
+  async collectShardKeys() {
+    let entries;
+    try {
+      entries = await fsp3.readdir(this.dir, { withFileTypes: true });
+    } catch {
+      return [""];
     }
-    if (event.type === "llm_response") {
-      return { ...event, content: s.scrubObject(event.content) };
+    const shardKeys = [""];
+    for (const entry of entries) {
+      if (entry.name.startsWith(".") && entry.name !== ".wrongstack") continue;
+      if (entry.name === "shared" || entry.name === "subagents" || entry.name === "attachments") continue;
+      if (entry.isDirectory()) shardKeys.push(entry.name);
     }
-    return event;
-  }
-  pendingFileSnapshots = [];
-  /** Tracks open tool_use IDs during the current run to serialize on close for resume. */
-  openToolUses = /* @__PURE__ */ new Set();
-  recordFileChange(input) {
-    this.pendingFileSnapshots.push(input);
-  }
-  get pendingToolUses() {
-    return Array.from(this.openToolUses);
+    return shardKeys;
   }
-  async writeSessionStartLazy() {
-    const record = `${JSON.stringify({
-      type: this.resumed ? "session_resumed" : "session_start",
-      ts: this.startedAt,
-      id: this.id,
-      model: this.meta.model ?? "unknown",
-      provider: this.meta.provider ?? "unknown"
-    })}
-`;
+  async readOrBuildShardManifest(shardKey) {
+    const cached = this.shardManifestCache.get(shardKey);
+    if (cached) return cached;
+    const manifestPath = this.shardManifestPath(shardKey);
     try {
-      await this.enqueueWrite(record);
+      const raw = await fsp3.readFile(manifestPath, "utf8");
+      const parsed = JSON.parse(raw);
+      const entry2 = {
+        summaries: Array.isArray(parsed.summaries) ? parsed.summaries : [],
+        ids: Array.isArray(parsed.ids) ? parsed.ids : []
+      };
+      this.shardManifestCache.set(shardKey, entry2);
+      return entry2;
     } catch {
     }
-  }
-  async append(event) {
-    if (this.closed) return;
-    await this.ensureInit();
-    const scrubbed = this.scrubEvent(event);
-    this.observeForSummary(scrubbed);
-    this.writeBuffer.push(scrubbed);
-    if (this.writeBuffer.length >= _FileSessionWriter.FLUSH_SIZE) {
-      if (this.flushTimer) {
-        clearTimeout(this.flushTimer);
-        this.flushTimer = null;
+    const refs = await this.collectSessionFilesInShard(shardKey);
+    const candidates = await mapWithConcurrency(
+      refs,
+      _DefaultSessionStore.LIST_SCAN_CONCURRENCY,
+      async (ref) => {
+        const manifest = await this.readSummaryManifest(ref.id);
+        if (manifest) return { summary: manifest, needsBackfill: false };
+        const summary = await this.summaryHeaderFor(ref);
+        if (!summary) return null;
+        const hydrated = await this.summaryFor(summary.id).catch(() => summary);
+        return { summary: hydrated, needsBackfill: false };
       }
-      await this.flushBuffer();
-    } else {
-      this.scheduleFlush();
-    }
+    );
+    const summaries = candidates.filter((candidate) => candidate !== null).map((candidate) => candidate.summary);
+    summaries.sort(compareSessionSummaries);
+    const entry = { summaries, ids: summaries.map((summary) => summary.id) };
+    this.shardManifestCache.set(shardKey, entry);
+    await atomicWrite(manifestPath, JSON.stringify(entry), { mode: 384 }).catch(() => void 0);
+    return entry;
+  }
+  async collectSessionFilesInShard(shardKey) {
+    const dir = shardKey ? path4.join(this.dir, shardKey) : this.dir;
+    const entries = await this.collectSessionFiles(dir, shardKey);
+    return shardKey ? entries.filter((entry) => entry.id.startsWith(`${shardKey}/`)) : entries.filter((entry) => !entry.id.includes("/"));
   }
-  async appendBatch(events) {
-    if (this.closed || events.length === 0) return;
-    await this.ensureInit();
-    for (const event of events) {
-      const scrubbed = this.scrubEvent(event);
-      this.observeForSummary(scrubbed);
-      this.writeBuffer.push(scrubbed);
+  async collectSessionFiles(dir, prefix = "", depth = 0) {
+    let entries;
+    try {
+      entries = await fsp3.readdir(dir, { withFileTypes: true });
+    } catch {
+      return [];
     }
-    if (this.writeBuffer.length >= _FileSessionWriter.FLUSH_SIZE) {
-      if (this.flushTimer) {
-        clearTimeout(this.flushTimer);
-        this.flushTimer = null;
+    const dirEntries = [];
+    const files = [];
+    for (const entry of entries) {
+      if (entry.name.startsWith(".") && entry.name !== ".wrongstack") continue;
+      if (entry.name === "shared" || entry.name === "subagents" || entry.name === "attachments")
+        continue;
+      if (entry.isDirectory()) {
+        dirEntries.push(entry);
+      } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
+        if (entry.name === "_index.jsonl") continue;
+        const base = entry.name.replace(/\.jsonl$/, "");
+        const id = prefix ? `${prefix}/${base}` : base;
+        files.push({ id, filePath: path4.join(dir, entry.name) });
       }
-      await this.flushBuffer();
-    } else {
-      this.scheduleFlush();
     }
+    const childFileArrays = await Promise.all(
+      dirEntries.map((entry) => {
+        const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
+        return this.collectSessionFiles(path4.join(dir, entry.name), childPrefix, depth + 1);
+      })
+    );
+    return [...childFileArrays.flat(), ...files];
   }
-  /**
-   * Flush buffered events to disk immediately. Critical events
-   * (user_input, llm_response) call this so they survive SIGKILL/crash
-   * instead of sitting in the in-memory buffer for up to 500ms.
-   *
-   * Idempotent — cancels any pending timer and writes whatever has
-   * accumulated in the buffer. Safe to call even when the buffer
-   * is empty (no-op).
-   */
-  async flush() {
-    if (this.flushTimer) {
-      clearTimeout(this.flushTimer);
-      this.flushTimer = null;
+  /** Recursively collect session IDs from date-shard subdirectories.
+   *  IDs include the date-prefix path (e.g. "2026-06-06/17-46-57Z_…").
+   *  Skips `.jsonl`/`.summary.json` root files, dot-files, and
+   *  sub-directories that belong to fleet/subagent sessions. */
+  async collectSessionIds(dir, prefix = "", depth = 0) {
+    let entries;
+    try {
+      entries = await fsp3.readdir(dir, { withFileTypes: true });
+    } catch {
+      return [];
     }
-    await this.flushBuffer();
-  }
-  /** Schedule a deferred flush. No-op if a timer is already pending. */
-  scheduleFlush() {
-    if (this.flushTimer) return;
-    this.flushTimer = setTimeout(() => {
-      this.flushTimer = null;
-      this.flushBuffer().catch(() => {
-      });
-    }, _FileSessionWriter.FLUSH_INTERVAL_MS);
+    const dirEntries = [];
+    const fileIds = [];
+    for (const entry of entries) {
+      if (entry.name.startsWith(".") && entry.name !== ".wrongstack") continue;
+      if (entry.name === "shared" || entry.name === "subagents" || entry.name === "attachments")
+        continue;
+      if (entry.isDirectory()) {
+        dirEntries.push(entry);
+      } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
+        if (entry.name === "_index.jsonl") continue;
+        const base = entry.name.replace(/\.jsonl$/, "");
+        fileIds.push(prefix ? `${prefix}/${base}` : base);
+      }
+    }
+    const childIdArrays = await Promise.all(
+      dirEntries.map((entry) => {
+        const childPrefix = depth === 0 ? entry.name : `${prefix}/${entry.name}`;
+        return this.collectSessionIds(path4.join(dir, entry.name), childPrefix, depth + 1);
+      })
+    );
+    return [...childIdArrays.flat(), ...fileIds];
   }
-  /**
-   * Flush all buffered events to disk as a single appendFile call.
-   * Errors use the same throttled-warning pattern the old per-event
-   * append path used — one warning every 5s with a suppressed count.
-   * On failure the buffer is cleared (events are best-effort, same as
-   * the old per-event path where a failed write was silently dropped).
-   */
-  async flushBuffer() {
-    if (this.writeBuffer.length === 0) return;
-    const eventCount = this.writeBuffer.length;
-    const batch = this.writeBuffer.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    this.writeBuffer = [];
+  async summaryFor(id) {
+    const manifest = this.sessionPath(id, ".summary.json");
     const t0 = Date.now();
     let outcome = "success";
     let errorMsg;
+    const fromManifest = await this.readSummaryManifest(id, t0);
+    if (fromManifest) return fromManifest;
     try {
-      await this.enqueueWrite(batch);
+      const full = this.sessionPath(id, ".jsonl");
+      const stat8 = await fsp3.stat(full);
+      const summary = await this.summarize(id, stat8.mtime.toISOString());
+      await atomicWrite(manifest, JSON.stringify(summary), { mode: 384 }).catch((err) => {
+        const msg = toErrorMessage(err);
+        this.emitError(id, manifest, "summary_fallback", msg, true);
+        console.warn(JSON.stringify({
+          level: "warn",
+          event: "session_store.manifest_write_failed",
+          sessionId: id,
+          message: msg,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        }));
+      });
+      outcome = "failure";
+      errorMsg = "summary fallback \xE2\u20AC\u201D manifest rebuilt";
+      this.emitRead(id, manifest, "summary", outcome, Date.now() - t0, errorMsg);
+      return summary;
     } catch (err) {
       outcome = "failure";
       errorMsg = toErrorMessage(err);
-      this.appendFailCount += eventCount;
-      const now = Date.now();
-      if (now - this.lastAppendWarnAt > 5e3) {
-        const suppressed = this.appendFailCount - 1;
-        const tail = suppressed > 0 ? ` (+${suppressed} suppressed)` : "";
-        console.warn(
-          "[session] flush failed:",
-          toErrorMessage(err),
-          tail
-        );
-        this.lastAppendWarnAt = now;
-        this.appendFailCount = 0;
-      }
-    } finally {
-      this.events?.emit("storage.write", {
-        sessionId: this.id,
-        store: "session",
-        filePath: this.filePath,
-        operation: "flush",
-        outcome,
-        durationMs: Date.now() - t0,
-        ...errorMsg !== void 0 ? { error: errorMsg } : {},
-        ...eventCount !== void 0 ? { eventCount } : {},
-        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-      });
+      this.emitRead(id, manifest, "summary", outcome, Date.now() - t0, errorMsg);
+      return {
+        id,
+        title: "(damaged)",
+        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        model: "unknown",
+        provider: "unknown",
+        tokenTotal: 0
+      };
     }
   }
-  observeForSummary(event) {
-    if (event.type === "llm_response") {
-      for (const block of event.content) {
-        if (block.type === "tool_use") this.openToolUses.add(block.id);
-      }
+  async readSummaryManifest(id, startTime = Date.now()) {
+    const manifest = this.sessionPath(id, ".summary.json");
+    try {
+      const raw = await fsp3.readFile(manifest, "utf8");
+      this.emitRead(id, manifest, "summary", "success", Date.now() - startTime);
+      return JSON.parse(raw);
+    } catch {
+      return null;
     }
-    if (event.type === "tool_use") {
-      this.openToolUses.add(event.id);
-    } else if (event.type === "tool_call_start") {
-      this.toolCallCount++;
-      this.toolBreakdown[event.name] = (this.toolBreakdown[event.name] ?? 0) + 1;
-    } else if (event.type === "tool_result") {
-      this.openToolUses.delete(event.id);
-      if (event.isError) {
-        this.toolErrorCount++;
-        this.outcome = "error";
+  }
+  async summaryHeaderFor(ref) {
+    let mtime = (/* @__PURE__ */ new Date(0)).toISOString();
+    try {
+      const stat8 = await fsp3.stat(ref.filePath);
+      if (!stat8.isFile()) {
+        return {
+          id: ref.id,
+          title: "(damaged)",
+          startedAt: stat8.mtime.toISOString(),
+          model: "unknown",
+          provider: "unknown",
+          tokenTotal: 0
+        };
       }
-    } else if (event.type === "file_snapshot") {
-      this.fileChangeCount += event.files.length;
-    } else if (event.type === "compaction") {
-      this.compactionCount++;
-    }
-    if (event.type === "error" || event.type === "provider_error") {
-      this.outcome = "error";
+      mtime = stat8.mtime.toISOString();
+    } catch {
+      return null;
     }
-    if (event.type === "user_input" && this.summary.title === "(empty session)") {
-      this.summary = { ...this.summary, title: userInputTitle(event.content) };
-    } else if (event.type === "llm_response") {
-      this.tokenIn += event.usage.input;
-      this.tokenOut += event.usage.output;
-      this.summary = { ...this.summary, tokenTotal: this.tokenIn + this.tokenOut };
-    } else if (event.type === "session_end") {
-      const total = event.usage.input + event.usage.output;
-      if (total > 0) this.summary = { ...this.summary, tokenTotal: total };
-    } else if (event.type === "in_flight_start") {
-      this.iterationCount++;
+    try {
+      for await (const event of this.iterSessionEvents(ref.filePath)) {
+        if (event.type === "session_start") {
+          return {
+            id: ref.id,
+            title: "(empty session)",
+            startedAt: event.ts,
+            model: event.model ?? "unknown",
+            provider: event.provider ?? "unknown",
+            tokenTotal: 0
+          };
+        }
+      }
+      return {
+        id: ref.id,
+        title: "(empty session)",
+        startedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
+        model: "unknown",
+        provider: "unknown",
+        tokenTotal: 0
+      };
+    } catch {
+      return {
+        id: ref.id,
+        title: "(damaged)",
+        startedAt: mtime,
+        model: "unknown",
+        provider: "unknown",
+        tokenTotal: 0
+      };
     }
   }
-  async close() {
-    if (this.closePromise) return this.closePromise;
-    this.closePromise = this.doClose();
-    return this.closePromise;
-  }
-  async doClose() {
-    this.closed = true;
-    if (this.flushTimer) {
-      clearTimeout(this.flushTimer);
-      this.flushTimer = null;
-    }
-    await this.flushBuffer();
-    await this.writeChain;
-    this.summary = {
-      ...this.summary,
-      endedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      iterationCount: this.iterationCount,
-      toolCallCount: this.toolCallCount,
-      toolErrorCount: this.toolErrorCount,
-      fileChangeCount: this.fileChangeCount,
-      compactionCount: this.compactionCount > 0 ? this.compactionCount : void 0,
-      toolBreakdown: { ...this.toolBreakdown },
-      outcome: this.outcome ?? "completed"
-    };
-    if (this.manifestFile) {
-      const t0 = Date.now();
-      let outcome = "success";
-      let errorMsg;
-      try {
-        await atomicWrite(this.manifestFile, JSON.stringify(this.summary), { mode: 384 });
-      } catch (err) {
-        outcome = "failure";
-        errorMsg = toErrorMessage(err);
-      } finally {
-        this.events?.emit("storage.write", {
-          sessionId: this.id,
-          store: "session",
-          filePath: this.manifestFile,
-          operation: "close",
-          outcome,
-          durationMs: Date.now() - t0,
-          ...errorMsg !== void 0 ? { error: errorMsg } : {},
-          ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-        });
+  /**
+   * Delete a session and all associated files: JSONL, summary, plan/todos
+   * sidecars, and the session directory (fleet.json, shared/, subagents/).
+   *
+   * Individual file deletions are best-effort (logged as structured warnings),
+   * but a tombstone is always written so readIndex() filters this session out.
+   * If the session directory itself can't be removed, the error is surfaced
+   * to the caller so prune() can report it.
+   */
+  async deleteSession(id) {
+    const jsonlPath = this.sessionPath(id, ".jsonl");
+    const summaryPath = this.sessionPath(id, ".summary.json");
+    const shardDir = path4.dirname(path4.join(this.dir, id));
+    const base = path4.basename(id);
+    const sessDir = path4.join(shardDir, base);
+    const deletions = [
+      fsp3.unlink(jsonlPath),
+      fsp3.unlink(summaryPath),
+      fsp3.unlink(path4.join(shardDir, `${base}.plan.json`)),
+      fsp3.unlink(path4.join(shardDir, `${base}.todos.json`))
+    ];
+    const results = await Promise.allSettled(deletions);
+    for (const r of results) {
+      if (r.status === "rejected") {
+        const msg = r.reason instanceof Error ? r.reason.message : String(r.reason);
+        if (r.reason?.code !== "ENOENT") {
+          console.warn(JSON.stringify({
+            level: "warn",
+            event: "session_store.delete_failed",
+            sessionId: id,
+            message: msg,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          }));
+        }
       }
     }
-    const idxT0 = Date.now();
-    let idxOutcome = "success";
-    let idxError;
-    try {
-      await this.onCloseCb?.(this.summary);
-    } catch (err) {
-      idxOutcome = "failure";
-      idxError = toErrorMessage(err);
-    } finally {
-      this.events?.emit("storage.write", {
-        sessionId: this.summary.id,
-        store: "session",
-        filePath: this.filePath,
-        operation: "index_append",
-        outcome: idxOutcome,
-        durationMs: Date.now() - idxT0,
-        ...idxError !== void 0 ? { error: idxError } : {},
-        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
-      });
-    }
+    await fsp3.rm(sessDir, { recursive: true, force: true }).catch((err) => {
+      console.warn(JSON.stringify({
+        level: "warn",
+        event: "session_store.rmdir_failed",
+        sessionId: id,
+        message: toErrorMessage(err),
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      }));
+    });
+    await this.writeTombstone(id);
+  }
+  async delete(id) {
+    await this.deleteSession(id);
+  }
+  async prune(maxAgeDays = 30) {
+    const cutoff = Date.now() - maxAgeDays * 864e5;
+    let deleted = 0;
+    let activeSessionId = null;
     try {
-      await this.handle.close();
+      const raw = await fsp3.readFile(path4.join(this.dir, "active.json"), "utf8");
+      const active = JSON.parse(raw);
+      activeSessionId = active.sessionId ?? null;
     } catch {
     }
-  }
-  async writeCheckpoint(promptIndex, promptPreview) {
-    const fileCount = this.pendingFileSnapshots.length;
-    if (fileCount > 0) {
-      await this.writeFileSnapshot(promptIndex, [...this.pendingFileSnapshots]);
-      this.pendingFileSnapshots = [];
+    const isPrunableJsonl = (name) => name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
+    const pruneFile = async (dir, name, prefix) => {
+      const jsonlPath = path4.join(dir, name);
+      try {
+        const stat8 = await fsp3.stat(jsonlPath);
+        if (stat8.mtimeMs >= cutoff) return;
+      } catch {
+        return;
+      }
+      const base = name.replace(/\.jsonl$/, "");
+      const id = prefix ? `${prefix}/${base}` : base;
+      if (activeSessionId && id === activeSessionId) return;
+      await this.deleteSession(id);
+      deleted++;
+    };
+    const entries = await fsp3.readdir(this.dir, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries) {
+      if (entry.isFile()) {
+        if (isPrunableJsonl(entry.name)) await pruneFile(this.dir, entry.name, "");
+        continue;
+      }
+      if (!entry.isDirectory()) continue;
+      const dateDir = path4.join(this.dir, entry.name);
+      const files = await fsp3.readdir(dateDir, { withFileTypes: true }).catch(() => []);
+      for (const file of files) {
+        if (!file.isFile() || !isPrunableJsonl(file.name)) continue;
+        await pruneFile(dateDir, file.name, entry.name);
+      }
     }
-    await this.append({
-      type: "checkpoint",
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      promptIndex,
-      promptPreview
-    });
-    this.events?.emit("checkpoint.written", {
-      promptIndex,
-      promptPreview,
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      fileCount
-    });
+    if (deleted > 0) {
+      await this.compactIndex().catch(() => void 0);
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const dateDir = path4.join(this.dir, entry.name);
+      try {
+        const remaining = await fsp3.readdir(dateDir);
+        if (remaining.length === 0) {
+          await fsp3.rmdir(dateDir).catch(() => void 0);
+        }
+      } catch {
+      }
+    }
+    return deleted;
   }
-  async writeFileSnapshot(promptIndex, files) {
-    await this.append({
-      type: "file_snapshot",
+  async clearHistory(id) {
+    await this.ensureShardDir(id);
+    const file = this.sessionPath(id, ".jsonl");
+    const meta = this.sessionPath(id, ".summary.json");
+    const record = `${JSON.stringify({
+      type: "session_start",
       ts: (/* @__PURE__ */ new Date()).toISOString(),
-      promptIndex,
-      files
-    });
+      id,
+      model: "unknown",
+      provider: "unknown"
+    })}
+`;
+    await fsp3.writeFile(file, record, "utf8");
+    await fsp3.unlink(meta).catch(() => void 0);
   }
-  /**
-   * Truncate the session file to the checkpoint with the given promptIndex,
-   * removing all events that follow it. Uses a single-pass byte-offset scan
-   * so post-checkpoint content is never read or parsed — O(1) memory instead
-   * of O(N) JSON.parse calls over the full file.
-   */
-  async truncateToCheckpoint(targetPromptIndex) {
-    if (!this.filePath) return 0;
-    if (this.flushTimer) {
-      clearTimeout(this.flushTimer);
-      this.flushTimer = null;
-    }
-    await this.flushBuffer();
-    await this.writeChain;
-    const CHUNK_SIZE = 65536;
-    let fd;
-    let fileOffset = 0;
-    let lineStartOffset = 0;
-    let checkpointByteOffset = -1;
-    let removedCount = 0;
-    let targetCheckpointSeen = false;
+  async summarize(id, mtime) {
     try {
-      fd = await fsp2.open(this.filePath, "r", 384);
-      while (true) {
-        const buf = Buffer.alloc(CHUNK_SIZE);
-        const { bytesRead } = await fd.read(buf, 0, CHUNK_SIZE, fileOffset);
-        if (bytesRead === 0) break;
-        let chunkPos = 0;
-        while (chunkPos < bytesRead) {
-          const idx = buf.indexOf("\n", chunkPos);
-          if (idx === -1) {
-            lineStartOffset = fileOffset + chunkPos;
-            break;
-          }
-          if (checkpointByteOffset !== -1) {
-            removedCount++;
-          } else {
-            const lineBytes = buf.subarray(chunkPos, idx);
-            const line = new TextDecoder("utf-8", { fatal: false }).decode(lineBytes);
-            if (line.trim()) {
-              try {
-                const event = JSON.parse(line);
-                if (event.type === "checkpoint") {
-                  if (event.promptIndex === targetPromptIndex) {
-                    checkpointByteOffset = lineStartOffset;
-                    targetCheckpointSeen = true;
-                  } else if (event.promptIndex !== void 0 && event.promptIndex > targetPromptIndex) {
-                    checkpointByteOffset = lineStartOffset;
-                  }
-                } else if (targetCheckpointSeen && event.promptIndex !== void 0 && event.promptIndex > targetPromptIndex) {
-                  removedCount++;
-                } else if (targetCheckpointSeen && event.promptIndex === void 0) {
-                  removedCount++;
-                } else if (!targetCheckpointSeen && event.promptIndex === void 0) {
-                  removedCount++;
-                } else if (!targetCheckpointSeen && event.promptIndex !== void 0 && event.promptIndex > targetPromptIndex) {
-                  removedCount++;
-                }
-              } catch {
-              }
-            }
+      const file = this.sessionPath(id, ".jsonl");
+      let title = "(empty session)";
+      let startedAt = (/* @__PURE__ */ new Date(0)).toISOString();
+      let endedAt;
+      let model = "unknown";
+      let provider = "unknown";
+      let tokenIn = 0;
+      let tokenOut = 0;
+      let iterationCount = 0;
+      let toolCallCount = 0;
+      let toolErrorCount = 0;
+      let fileChangeCount = 0;
+      const toolBreakdown = {};
+      let outcome;
+      let lastEventType;
+      let hasError = false;
+      let sawStart = false;
+      for await (const e of this.iterSessionEvents(file)) {
+        lastEventType = e.type;
+        if (e.type === "session_start") {
+          if (!sawStart) {
+            sawStart = true;
+            startedAt = e.ts;
+            model = e.model ?? "unknown";
+            provider = e.provider ?? "unknown";
           }
-          chunkPos = idx + 1;
-          lineStartOffset = fileOffset + chunkPos;
-        }
-        fileOffset += bytesRead;
-        if (chunkPos >= bytesRead) {
-          lineStartOffset = fileOffset;
-        }
+        } else if (e.type === "session_end") {
+          endedAt = e.ts;
+        } else if (e.type === "user_input") {
+          if (title === "(empty session)") title = userInputTitle(e.content);
+        } else if (e.type === "llm_response") {
+          tokenIn += e.usage.input ?? 0;
+          tokenOut += e.usage.output ?? 0;
+        } else if (e.type === "in_flight_start") iterationCount++;
+        else if (e.type === "tool_call_start") {
+          toolCallCount++;
+          toolBreakdown[e.name] = (toolBreakdown[e.name] ?? 0) + 1;
+        } else if (e.type === "tool_result" && e.isError) toolErrorCount++;
+        else if (e.type === "file_snapshot") fileChangeCount += e.files.length;
+        else if (e.type === "error" || e.type === "provider_error") hasError = true;
       }
-    } finally {
-      await fd?.close();
-    }
-    if (checkpointByteOffset === -1) return 0;
-    await this.writeChain;
-    await this.handle.close();
-    const tmpPath = `${this.filePath}.rewind.tmp`;
-    const src = await fsp2.open(this.filePath, "r", 384);
-    try {
-      const statResult = await src.stat();
-      const totalSize = statResult.size;
-      const prefixBytes = checkpointByteOffset;
-      let newlineAfterCheckpoint = prefixBytes;
-      if (prefixBytes < totalSize) {
-        const probeBuf = Buffer.alloc(Math.min(CHUNK_SIZE, totalSize - prefixBytes));
-        const { bytesRead: probeRead } = await src.read(probeBuf, 0, probeBuf.length, prefixBytes);
-        if (probeRead > 0) {
-          const nl = probeBuf.indexOf("\n");
-          newlineAfterCheckpoint = nl !== -1 ? prefixBytes + nl + 1 : totalSize;
-        }
-      } else {
-        newlineAfterCheckpoint = totalSize;
+      if (lastEventType === "session_end") {
+        outcome = "completed";
+      } else if (lastEventType === "in_flight_start") {
+        outcome = "aborted";
+      } else if (hasError) {
+        outcome = "error";
       }
-      const writeFd = await fsp2.open(tmpPath, "w", 384);
-      try {
-        let readOffset = 0;
-        while (readOffset < newlineAfterCheckpoint) {
-          const toCopy = Math.min(CHUNK_SIZE, newlineAfterCheckpoint - readOffset);
-          const copyBuf = Buffer.alloc(toCopy);
-          const { bytesRead: r } = await src.read(copyBuf, 0, toCopy, readOffset);
-          if (r === 0) break;
-          await writeFd.write(copyBuf, 0, r);
-          readOffset += r;
-        }
-        const raw = await fsp2.readFile(this.filePath);
-        const tail = raw.subarray(newlineAfterCheckpoint).toString("utf8");
-        for (const line of tail.split("\n")) {
-          if (!line.trim()) continue;
-          try {
-            JSON.parse(line);
-          } catch {
-            await writeFd.write(`${line}
-`, void 0, "utf8");
+      return {
+        id,
+        title,
+        startedAt,
+        endedAt,
+        model,
+        provider,
+        tokenTotal: tokenIn + tokenOut,
+        iterationCount: iterationCount > 0 ? iterationCount : void 0,
+        toolCallCount: toolCallCount > 0 ? toolCallCount : void 0,
+        toolErrorCount: toolErrorCount > 0 ? toolErrorCount : void 0,
+        fileChangeCount: fileChangeCount > 0 ? fileChangeCount : void 0,
+        toolBreakdown: Object.keys(toolBreakdown).length > 0 ? toolBreakdown : {},
+        outcome
+      };
+    } catch {
+      return {
+        id,
+        title: "(damaged)",
+        startedAt: mtime,
+        model: "unknown",
+        provider: "unknown",
+        tokenTotal: 0
+      };
+    }
+  }
+  async *iterSessionEvents(file) {
+    const stream = createReadStream(file, { encoding: "utf8" });
+    const lines = createInterface({ input: stream, crlfDelay: Infinity });
+    try {
+      for await (const line of lines) {
+        if (!line.trim()) continue;
+        try {
+          const parsed = JSON.parse(line);
+          if (parsed !== null && typeof parsed === "object" && typeof parsed.type === "string" && typeof parsed.ts === "string") {
+            yield parsed;
           }
+        } catch {
         }
-      } finally {
-        await writeFd.close();
       }
-      await src.close();
-      await fsp2.rename(tmpPath, this.filePath);
-      this.handle = await fsp2.open(this.filePath, "a", 384);
-    } catch (err) {
-      await fsp2.unlink(tmpPath).catch(() => void 0);
-      this.handle = await fsp2.open(this.filePath, "a", 384).catch(() => this.handle);
-      throw err;
-    }
-    await this.append({
-      type: "rewound",
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      toPromptIndex: targetPromptIndex,
-      revertedFiles: []
-    });
-    this.events?.emit("session.rewound", {
-      toPromptIndex: targetPromptIndex,
-      revertedFiles: [],
-      removedEvents: removedCount
-    });
-    return removedCount;
-  }
-  async clearSession() {
-    if (!this.filePath) return;
-    if (this.flushTimer) {
-      clearTimeout(this.flushTimer);
-      this.flushTimer = null;
+    } finally {
+      lines.close();
+      stream.destroy();
     }
-    this.writeBuffer = [];
-    await this.writeChain;
-    const record = `${JSON.stringify({
-      type: "session_start",
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      id: this.id,
-      model: this.meta.model ?? "unknown",
-      provider: this.meta.provider ?? "unknown"
-    })}
-`;
-    await fsp2.writeFile(this.filePath, record, "utf8");
   }
-  /**
-   * Idea #1 — write an in-flight marker. The agent loop should call
-   * this at the start of each long-running operation; a matching
-   * `clearInFlightMarker` follows on clean exit. A stale marker
-   * (no end) is what `SessionRecovery.detectStale` looks for.
-   */
-  async writeInFlightMarker(context) {
-    if (!context || context.length > 500) {
-      throw new Error("In-flight context must be 1..500 chars");
+};
+function extractToolCallEnds(events) {
+  const result = [];
+  for (const e of events) {
+    if (e.type === "tool_call_end") {
+      result.push({
+        name: e.name,
+        id: e.id,
+        durationMs: e.durationMs,
+        ok: e.ok ?? false,
+        outputBytes: e.outputBytes,
+        outputTokens: e.outputTokens,
+        outputLines: e.outputLines
+      });
     }
-    await this.append({
-      type: "in_flight_start",
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      context
-    });
-    this.events?.emit("in_flight.started", { context, ts: (/* @__PURE__ */ new Date()).toISOString() });
-  }
-  /**
-   * Idea #1 — close the in-flight marker. Idempotent in spirit
-   * (you can call it after a successful iteration even if you
-   * didn't open one this round) — but the session log records
-   * every call so postmortem tooling can see "the agent finished
-   * cleanly X times, then died without finishing Y".
-   */
-  async clearInFlightMarker(reason) {
-    await this.append({
-      type: "in_flight_end",
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      reason
-    });
-    this.events?.emit("in_flight.ended", { reason, ts: (/* @__PURE__ */ new Date()).toISOString() });
   }
-};
-function userInputTitle(content) {
-  const text = typeof content === "string" ? content : content.filter((b) => b.type === "text").map((b) => b.text).join(" ");
-  return (text || "(non-text input)").slice(0, 60);
+  return result;
 }
 function compareSessionSummaries(a, b) {
   if (a.startedAt < b.startedAt) return 1;
   if (a.startedAt > b.startedAt) return -1;
   return a.id.localeCompare(b.id);
 }
+function matchesSessionFilter(s, criteria) {
+  if (criteria.since && s.startedAt < criteria.since) return false;
+  if (criteria.until && s.startedAt > criteria.until) return false;
+  if (criteria.provider && s.provider !== criteria.provider) return false;
+  if (criteria.model && s.model !== criteria.model) return false;
+  if (criteria.minTokens !== void 0 && s.tokenTotal < criteria.minTokens) return false;
+  if (criteria.titleContains) {
+    const needle = criteria.titleContains.toLowerCase();
+    if (!s.title.toLowerCase().includes(needle)) return false;
+  }
+  return true;
+}
 async function mapWithConcurrency(items, concurrency, fn) {
   if (items.length === 0) return [];
   const out = new Array(items.length);
@@ -3726,7 +3947,7 @@ var QueueStore = class {
     const t0 = Date.now();
     let raw;
     try {
-      raw = await fsp2.readFile(this.file, "utf8");
+      raw = await fsp3.readFile(this.file, "utf8");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
@@ -3807,7 +4028,7 @@ var QueueStore = class {
   async clear() {
     const t0 = Date.now();
     try {
-      await fsp2.unlink(this.file);
+      await fsp3.unlink(this.file);
       this.events?.emit("storage.write", {
         sessionId: this.traceId ?? "~boot~",
         store: "queue",
@@ -3867,7 +4088,7 @@ var DefaultAttachmentStore = class {
     let spooledPath;
     let data = input.data;
     if (this.spoolDir && bytes >= this.spoolThreshold) {
-      await fsp2.mkdir(this.spoolDir, { recursive: true });
+      await fsp3.mkdir(this.spoolDir, { recursive: true });
       spooledPath = path4.join(this.spoolDir, `${id}.bin`);
       await atomicWrite(spooledPath, input.data, {
         encoding: input.kind === "image" ? "base64" : "utf8"
@@ -3930,7 +4151,7 @@ var DefaultAttachmentStore = class {
       for (const att of this.items.values()) {
         if (att.path) toDelete.push(att.path);
       }
-      await Promise.all(toDelete.map((p) => fsp2.unlink(p).catch(() => void 0)));
+      await Promise.all(toDelete.map((p) => fsp3.unlink(p).catch(() => void 0)));
     }
     this.items.clear();
     this.refs.length = 0;
@@ -3938,7 +4159,7 @@ var DefaultAttachmentStore = class {
   }
   async toBlock(att) {
     if (att.kind === "image") {
-      const data = att.data ?? (att.path ? await fsp2.readFile(att.path, { encoding: "base64" }) : "");
+      const data = att.data ?? (att.path ? await fsp3.readFile(att.path, { encoding: "base64" }) : "");
       return {
         type: "image",
         source: {
@@ -3948,7 +4169,7 @@ var DefaultAttachmentStore = class {
         }
       };
     }
-    const raw = att.data ?? (att.path ? await fsp2.readFile(att.path, "utf8") : "");
+    const raw = att.data ?? (att.path ? await fsp3.readFile(att.path, "utf8") : "");
     const label = att.meta.filename ? `<file path="${att.meta.filename}">` : "<pasted>";
     const close = att.meta.filename ? "</file>" : "</pasted>";
     return { type: "text", text: `${label}
@@ -4084,7 +4305,7 @@ var FileMemoryBackend = class {
     await ensureDir(path4.dirname(file));
     let existing = "";
     try {
-      existing = await fsp2.readFile(file, "utf8");
+      existing = await fsp3.readFile(file, "utf8");
     } catch {
     }
     const id = `mem_${Date.now()}_${randomUUID().slice(0, 8)}`;
@@ -4101,7 +4322,7 @@ ${line}`;
     return withFileLock(file, async () => {
       let existing;
       try {
-        existing = await fsp2.readFile(file, "utf8");
+        existing = await fsp3.readFile(file, "utf8");
       } catch {
         return 0;
       }
@@ -4137,7 +4358,7 @@ ${line}`;
   async readAll(scope, filePath) {
     const file = this.resolveFile(filePath, scope);
     try {
-      return await fsp2.readFile(file, "utf8");
+      return await fsp3.readFile(file, "utf8");
     } catch {
       return "";
     }
@@ -4172,7 +4393,7 @@ ${line}`;
     const file = this.resolveFile(filePath, scope);
     let existing;
     try {
-      existing = await fsp2.readFile(file, "utf8");
+      existing = await fsp3.readFile(file, "utf8");
     } catch {
       return 0;
     }
@@ -4192,7 +4413,7 @@ ${line}`;
     const next = lines.join("\n");
     const backup = `${file}.bak.${Date.now()}`;
     try {
-      await fsp2.copyFile(file, backup);
+      await fsp3.copyFile(file, backup);
       await pruneConsolidateBackups(file);
     } catch {
     }
@@ -4208,11 +4429,11 @@ async function pruneConsolidateBackups(file) {
   const dir = path4.dirname(file);
   const base = path4.basename(file);
   const prefix = `${base}.bak.`;
-  const backups = (await fsp2.readdir(dir)).filter((name) => name.startsWith(prefix)).sort().reverse();
+  const backups = (await fsp3.readdir(dir)).filter((name) => name.startsWith(prefix)).sort().reverse();
   await Promise.all(
     backups.slice(MAX_MEMORY_CONSOLIDATE_BACKUPS).map(async (name) => {
       try {
-        await fsp2.unlink(path4.join(dir, name));
+        await fsp3.unlink(path4.join(dir, name));
       } catch {
       }
     })
@@ -4767,9 +4988,9 @@ ${body.trim()}`);
     if (!this.persistBackup || scope === "project-agents") return;
     try {
       const content = await this.backend.readAll(scope, this.files[scope]);
-      const { writeFile: writeFile7, mkdir: mkdir8 } = await import('fs/promises');
+      const { writeFile: writeFile8, mkdir: mkdir8 } = await import('fs/promises');
       await mkdir8(this.backupDir, { recursive: true });
-      await writeFile7(`${this.backupDir}/${scope}.md`, content, "utf8");
+      await writeFile8(`${this.backupDir}/${scope}.md`, content, "utf8");
     } catch {
     }
   }
@@ -5103,8 +5324,8 @@ function unwrapDataKey(buf, keyFile) {
 function checkKeyFilePermissions(keyFile) {
   if (process.platform === "win32") return;
   try {
-    const stat6 = fs4.statSync(keyFile);
-    const actualMode = stat6.mode & 511;
+    const stat8 = fs4.statSync(keyFile);
+    const actualMode = stat8.mode & 511;
     if (actualMode !== KEY_FILE_MODE) {
       console.warn(JSON.stringify({
         level: "warn",
@@ -5369,20 +5590,20 @@ function isSecretField(name) {
 async function rewriteConfigEncrypted(configPath, vault, patch) {
   let current = {};
   try {
-    const raw = await fsp2.readFile(configPath, "utf8");
+    const raw = await fsp3.readFile(configPath, "utf8");
     current = JSON.parse(raw);
   } catch {
   }
   const merged = deepMerge(current, patch ?? {});
   const encrypted = encryptConfigSecrets(merged, vault);
-  await fsp2.mkdir(path4.dirname(configPath), { recursive: true });
+  await fsp3.mkdir(path4.dirname(configPath), { recursive: true });
   await atomicWrite(configPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
   await restrictFilePermissions(configPath);
 }
 async function migratePlaintextSecrets(configPath, vault, logger) {
   let raw;
   try {
-    raw = await fsp2.readFile(configPath, "utf8");
+    raw = await fsp3.readFile(configPath, "utf8");
   } catch {
     return { migrated: 0, file: configPath };
   }
@@ -5424,7 +5645,7 @@ async function restrictFilePermissions(filePath, opts) {
     }
   } else {
     try {
-      await fsp2.chmod(filePath, 384);
+      await fsp3.chmod(filePath, 384);
     } catch {
     }
   }
@@ -5510,6 +5731,9 @@ function isContextWindowModeId(id) {
   return CONTEXT_WINDOW_MODES.some((m) => m.id === id);
 }
 
+// src/types/config.ts
+var DEFAULT_TUI_THINKING_WORD = "thinking";
+
 // src/types/default-config.ts
 var DEFAULT_TOOLS_CONFIG = Object.freeze({
   defaultExecutionStrategy: "smart",
@@ -5528,6 +5752,10 @@ var DEFAULT_CONTEXT_CONFIG = Object.freeze({
 var DEFAULT_AUTONOMY_CONFIG = Object.freeze({
   autoProceedDelayMs: 45e3
 });
+var DEFAULT_CIRCUIT_BREAKER_CONFIG = Object.freeze({
+  enabled: false,
+  autoKillResetMs: 6e4
+});
 var DEFAULT_SESSION_LOGGING_CONFIG = Object.freeze({
   auditLevel: "standard",
   sampling: {
@@ -5554,7 +5782,8 @@ var BEHAVIOR_DEFAULTS = {
     hardThreshold: 0.9,
     autoCompact: true,
     preserveK: DEFAULT_CONTEXT_CONFIG.preserveK,
-    eliseThreshold: DEFAULT_CONTEXT_CONFIG.eliseThreshold
+    eliseThreshold: DEFAULT_CONTEXT_CONFIG.eliseThreshold,
+    strategy: "hybrid"
   },
   tools: {
     defaultExecutionStrategy: DEFAULT_TOOLS_CONFIG.defaultExecutionStrategy,
@@ -5577,6 +5806,13 @@ var BEHAVIOR_DEFAULTS = {
     allowOutsideProjectRoot: true
   },
   mcpServers: {},
+  fallbackAuto: true,
+  maxConcurrent: 4,
+  yolo: false,
+  nextPrediction: false,
+  hints: true,
+  debugStream: false,
+  configScope: "global",
   indexing: {
     onSessionStart: true,
     onEdit: true,
@@ -5584,8 +5820,60 @@ var BEHAVIOR_DEFAULTS = {
     debounceMs: 400
   },
   session: { ...DEFAULT_SESSION_LOGGING_CONFIG },
-  autonomy: { autoProceedDelayMs: DEFAULT_AUTONOMY_CONFIG.autoProceedDelayMs }
+  autonomy: {
+    defaultMode: "off",
+    autoProceedDelayMs: DEFAULT_AUTONOMY_CONFIG.autoProceedDelayMs,
+    autoProceedMaxIterations: 50,
+    autonomyNextPrompt: "auto {{suggestion}}",
+    terminalTitleAnimation: true,
+    yolo: false,
+    streamFleet: true,
+    chime: false,
+    confirmExit: true,
+    mouseMode: false,
+    enhance: true,
+    enhanceDelayMs: 6e4,
+    enhanceLanguage: "original",
+    statuslineMode: "detailed",
+    thinkingWord: DEFAULT_TUI_THINKING_WORD
+  },
+  circuitBreaker: { ...DEFAULT_CIRCUIT_BREAKER_CONFIG },
+  modelRuntime: {
+    // `effort` is intentionally undefined by default. Leaving it unset lets
+    // each model use its provider-recommended reasoning effort (or none at
+    // all) instead of forcing an opinionated value that may be unsupported,
+    // silently omitted, and surfaced as a per-request warning. Users who
+    // want a specific effort can opt in via `/settings` or the WebUI panel.
+    reasoning: { mode: "auto" },
+    cache: {}
+  }
 };
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function cloneJsonValue(value) {
+  return structuredClone(value);
+}
+function fillMissingDefaults(target, defaults) {
+  const value = cloneJsonValue(target);
+  const changed = fillMissingDefaultsInPlace(value, defaults);
+  return { value, changed };
+}
+function fillMissingDefaultsInPlace(target, defaults) {
+  let changed = false;
+  for (const [key, defaultValue] of Object.entries(defaults)) {
+    if (!Object.prototype.hasOwnProperty.call(target, key)) {
+      target[key] = cloneJsonValue(defaultValue);
+      changed = true;
+      continue;
+    }
+    const current = target[key];
+    if (isPlainRecord(current) && isPlainRecord(defaultValue)) {
+      changed = fillMissingDefaultsInPlace(current, defaultValue) || changed;
+    }
+  }
+  return changed;
+}
 function envBool(v) {
   return !/^(0|false|no|off)$/i.test(v.trim());
 }
@@ -5637,27 +5925,139 @@ var defaultIndexing = {
   watchExternal: true,
   debounceMs: 400
 };
-var IN_PROJECT_FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
+var IN_PROJECT_ALLOWED_KEYS = /* @__PURE__ */ new Set([
+  "version",
+  "model",
+  "cwd",
+  "context",
+  "tools",
+  "features",
+  "autonomy",
+  "indexing",
+  "session",
+  "log",
+  "launch",
+  "nextPrediction",
+  "hints",
+  "debugStream",
+  "configScope",
+  "maxConcurrent",
+  "fallbackModels",
+  "fallbackAuto",
+  "models",
+  "modelMatrix",
+  "circuitBreaker",
+  "adaptiveConcurrency",
+  "modelRuntime"
+]);
+var KNOWN_DENIED_IN_PROJECT = [
+  { key: "provider", reason: "Provider id override; can intercept prompts/responses." },
+  { key: "apiKey", reason: "Overrides user API key; exfiltrates prompts." },
+  { key: "baseUrl", reason: "Redirects provider endpoint; leaks real API key." },
+  { key: "providers", reason: "Per-provider apiKey/baseUrl/oauthConfig; same redirect/exfil." },
+  { key: "mcpServers", reason: "Arbitrary command/args/env spawned at boot (RCE)." },
+  { key: "hooks", reason: "Shell command arrays on lifecycle events (RCE)." },
+  { key: "plugins", reason: "Dynamic npm package load at boot (RCE)." },
+  { key: "sync", reason: "Carries githubToken credential and target repo." },
+  { key: "yolo", reason: "Disables all permission confirmation prompts." },
+  { key: "extensions", reason: "Per-plugin config can carry command/credential fields." },
+  { key: "hq", reason: "Carries HQ client token credential and endpoint URL." }
+];
+var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
+  "version",
   "provider",
+  "model",
   "apiKey",
   "baseUrl",
+  "maxConcurrent",
   "providers",
+  "models",
+  "modelMatrix",
+  "context",
+  "tools",
   "mcpServers",
+  "fallbackModels",
+  "fallbackAuto",
   "hooks",
   "plugins",
-  "sync",
+  "log",
+  "features",
   "yolo",
+  "nextPrediction",
+  "cwd",
+  "autonomy",
+  "hints",
+  "debugStream",
+  "configScope",
+  "indexing",
+  "circuitBreaker",
+  "adaptiveConcurrency",
+  "launch",
+  "session",
+  "modelRuntime",
+  "hq",
+  "sync",
   "extensions"
 ]);
+function assertInProjectAllowListComplete() {
+  const missingFromBoth = [];
+  for (const key of KNOWN_CONFIG_TOP_LEVEL_KEYS) {
+    if (IN_PROJECT_ALLOWED_KEYS.has(key)) continue;
+    const denied = KNOWN_DENIED_IN_PROJECT.find((d) => d.key === key);
+    if (!denied) missingFromBoth.push(key);
+  }
+  const staleDenials = KNOWN_DENIED_IN_PROJECT.filter((d) => !KNOWN_CONFIG_TOP_LEVEL_KEYS.has(d.key)).map((d) => d.key);
+  const duplicate = KNOWN_DENIED_IN_PROJECT.filter((d) => IN_PROJECT_ALLOWED_KEYS.has(d.key)).map((d) => d.key);
+  const problems = [];
+  if (missingFromBoth.length > 0) {
+    problems.push(
+      `new Config field(s) not classified as allowed or denied for in-project config: ` + missingFromBoth.join(", ") + ". Add each to IN_PROJECT_ALLOWED_KEYS (if safe) or KNOWN_DENIED_IN_PROJECT (with a reason)."
+    );
+  }
+  if (staleDenials.length > 0) {
+    problems.push(
+      `KNOWN_DENIED_IN_PROJECT references keys that no longer exist on Config: ` + staleDenials.join(", ") + ". Remove them or restore the field on Config."
+    );
+  }
+  if (duplicate.length > 0) {
+    problems.push(
+      `field(s) appear in BOTH IN_PROJECT_ALLOWED_KEYS and KNOWN_DENIED_IN_PROJECT: ` + duplicate.join(", ") + ". The allow-list wins at runtime; remove from one of the two."
+    );
+  }
+  if (problems.length > 0) {
+    throw new Error(
+      `stripUnsafeInProjectFields drift check failed:
+  - ${problems.join("\n  - ")}`
+    );
+  }
+}
+var driftChecked = false;
 function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => console.warn(msg)) {
+  if (!driftChecked) {
+    assertInProjectAllowListComplete();
+    driftChecked = true;
+  }
   const stripped = [];
   const out = {};
   for (const [k, v] of Object.entries(inProject)) {
-    if (IN_PROJECT_FORBIDDEN_KEYS.has(k)) {
-      stripped.push(k);
+    if (IN_PROJECT_ALLOWED_KEYS.has(k)) {
+      out[k] = v;
       continue;
     }
-    out[k] = v;
+    stripped.push(k);
+  }
+  const outTools = out["tools"];
+  if (outTools && typeof outTools === "object") {
+    const execCfg = outTools["exec"];
+    if (execCfg && typeof execCfg === "object" && "allow" in execCfg) {
+      const clonedExec = { ...execCfg };
+      delete clonedExec["allow"];
+      out["tools"] = {
+        ...outTools,
+        exec: clonedExec
+      };
+      stripped.push("tools.exec.allow");
+    }
   }
   if (stripped.length > 0) {
     warn(
@@ -5666,7 +6066,7 @@ function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => conso
         event: "config.in_project_unsafe_fields_ignored",
         path: sourcePath,
         ignoredKeys: stripped,
-        message: `Ignored ${stripped.length} unsafe field(s) from the repo-committed config "${sourcePath}": ${stripped.join(", ")}. These can only be set in your personal ~/.wrongstack/config.json, not in a project-committed file.`,
+        message: `Ignored ${stripped.length} field(s) from the repo-committed config "${sourcePath}": ${stripped.join(", ")}. Only a small allow-list of benign preferences (model, context, tools limits, features, \u2026) may be set by <project>/.wrongstack/config.json. Everything else must live in your personal ~/.wrongstack/config.json.`,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       })
     );
@@ -5700,6 +6100,7 @@ var DefaultConfigLoader = class {
   extraSources;
   events;
   traceId;
+  jsonCache = /* @__PURE__ */ new Map();
   constructor(opts) {
     this.paths = opts.paths;
     this.strict = opts.strict ?? false;
@@ -5710,6 +6111,7 @@ var DefaultConfigLoader = class {
   }
   async load(opts = {}) {
     let cfg = { ...BEHAVIOR_DEFAULTS };
+    await this.ensureGlobalDefaults();
     const inProjectCollides = samePath(this.paths.inProjectConfig, this.paths.globalConfig) || samePath(this.paths.inProjectConfig, this.paths.projectLocalConfig);
     const [global, local, inProject] = await Promise.all([
       this.readJson(this.paths.globalConfig),
@@ -5774,6 +6176,80 @@ var DefaultConfigLoader = class {
     }
     return Object.freeze(cfg);
   }
+  async ensureGlobalDefaults() {
+    const fp = this.paths.globalConfig;
+    const t0 = Date.now();
+    try {
+      await withFileLock(fp, async () => {
+        let parsed;
+        try {
+          const raw = await fsp3.readFile(fp, "utf8");
+          const result = safeParse(raw);
+          if (!result.ok || !isPlainRecord(result.value)) {
+            return;
+          }
+          parsed = result.value;
+        } catch (err) {
+          if (err.code !== "ENOENT") {
+            this.events?.emit("storage.error", {
+              sessionId: "~config~",
+              store: "config",
+              filePath: fp,
+              operation: "ensure_defaults",
+              outcome: "failure",
+              error: storageErrorString(err),
+              recoverable: false,
+              durationMs: Date.now() - t0,
+              ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+            });
+            console.warn(JSON.stringify({
+              level: "warn",
+              event: "config.defaults_read_failed",
+              path: fp,
+              message: toErrorMessage(err),
+              timestamp: (/* @__PURE__ */ new Date()).toISOString()
+            }));
+            return;
+          }
+          parsed = {};
+        }
+        const { value, changed } = fillMissingDefaults(
+          parsed,
+          BEHAVIOR_DEFAULTS
+        );
+        if (!changed) return;
+        await atomicWrite(fp, JSON.stringify(value, null, 2), { mode: 384 });
+        this.events?.emit("storage.write", {
+          sessionId: "~config~",
+          store: "config",
+          filePath: fp,
+          operation: "ensure_defaults",
+          outcome: "success",
+          durationMs: Date.now() - t0,
+          ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+        });
+      });
+    } catch (err) {
+      this.events?.emit("storage.error", {
+        sessionId: "~config~",
+        store: "config",
+        filePath: fp,
+        operation: "ensure_defaults",
+        outcome: "failure",
+        error: storageErrorString(err),
+        recoverable: false,
+        durationMs: Date.now() - t0,
+        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+      });
+      console.warn(JSON.stringify({
+        level: "warn",
+        event: "config.defaults_write_failed",
+        path: fp,
+        message: toErrorMessage(err),
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      }));
+    }
+  }
   /**
    * Persist a sync config to ~/.wrongstack/sync.json, with the token encrypted
    * by the vault (if provided). The file is isolated from the main config
@@ -5822,7 +6298,7 @@ var DefaultConfigLoader = class {
     const fp = this.paths.syncConfig;
     const t0 = Date.now();
     try {
-      const raw = await fsp2.readFile(fp, "utf8");
+      const raw = await fsp3.readFile(fp, "utf8");
       const parsed = safeParse(raw);
       if (!parsed.ok || !parsed.value) {
         this.events?.emit("storage.read", {
@@ -5883,10 +6359,42 @@ var DefaultConfigLoader = class {
     }
   }
   async readJson(file) {
-    let raw;
     const t0 = Date.now();
+    let mtimeMs = null;
+    try {
+      const stat8 = await fsp3.stat(file);
+      mtimeMs = stat8.mtimeMs;
+      const cached = this.jsonCache.get(file);
+      if (cached && cached.mtimeMs === mtimeMs) {
+        return structuredClone(cached.value);
+      }
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        this.jsonCache.set(file, { mtimeMs: null, value: {} });
+        return {};
+      }
+      this.events?.emit("storage.read", {
+        sessionId: "~config~",
+        store: "config",
+        filePath: file,
+        operation: "read_json",
+        outcome: "failure",
+        durationMs: Date.now() - t0,
+        error: storageErrorString(err),
+        ...this.traceId !== void 0 ? { traceId: this.traceId } : {}
+      });
+      console.warn(JSON.stringify({
+        level: "warn",
+        event: "config.read_failed",
+        path: file,
+        message: toErrorMessage(err),
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      }));
+      return {};
+    }
+    let raw;
     try {
-      raw = await fsp2.readFile(file, "utf8");
+      raw = await fsp3.readFile(file, "utf8");
     } catch (err) {
       if (err.code !== "ENOENT") {
         this.events?.emit("storage.read", {
@@ -5907,6 +6415,7 @@ var DefaultConfigLoader = class {
           timestamp: (/* @__PURE__ */ new Date()).toISOString()
         }));
       }
+      this.jsonCache.set(file, { mtimeMs: null, value: {} });
       return {};
     }
     const parsed = safeParse(raw);
@@ -5930,6 +6439,7 @@ var DefaultConfigLoader = class {
       }));
       return {};
     }
+    this.jsonCache.set(file, { mtimeMs, value: structuredClone(parsed.value) });
     return parsed.value;
   }
   validateBehavior(cfg) {
@@ -6127,7 +6637,7 @@ var RecoveryLock = class {
       startedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     try {
-      await fsp2.writeFile(this.file, JSON.stringify(lock), { flag: "wx", mode: 384 });
+      await fsp3.writeFile(this.file, JSON.stringify(lock), { flag: "wx", mode: 384 });
     } catch (err) {
       const code = err.code;
       if (code === "EEXIST") {
@@ -6143,7 +6653,7 @@ var RecoveryLock = class {
    */
   async clear() {
     try {
-      await fsp2.unlink(this.file);
+      await fsp3.unlink(this.file);
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") return;
@@ -6153,7 +6663,7 @@ var RecoveryLock = class {
   async readLock() {
     let raw;
     try {
-      raw = await fsp2.readFile(this.file, "utf8");
+      raw = await fsp3.readFile(this.file, "utf8");
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") return null;
@@ -6184,26 +6694,82 @@ function defaultIsPidAlive(pid) {
     return false;
   }
 }
-
-// src/storage/session-reader.ts
-var DefaultSessionReader = class {
+var DefaultSessionReader = class _DefaultSessionReader {
   store;
+  eventCache = /* @__PURE__ */ new Map();
+  eventCacheMtimes = /* @__PURE__ */ new Map();
+  static EVENT_CACHE_MAX_ENTRIES = 32;
   constructor(opts) {
     this.store = opts.store;
   }
+  async loadCachedSessionData(sessionId) {
+    const storeWithPath = this.store;
+    const rootDir = storeWithPath.dir;
+    if (!rootDir) {
+      return await this.store.load(sessionId);
+    }
+    const sessionPath = path4.join(rootDir, `${sessionId}.jsonl`);
+    let mtimeMs = null;
+    try {
+      const stat8 = await fsp3.stat(sessionPath);
+      mtimeMs = stat8.mtimeMs;
+    } catch {
+      this.eventCache.delete(sessionId);
+      this.eventCacheMtimes.delete(sessionId);
+      return await this.store.load(sessionId);
+    }
+    const cachedMtime = this.eventCacheMtimes.get(sessionId);
+    const cachedData = this.eventCache.get(sessionId);
+    if (cachedData && cachedMtime === mtimeMs) {
+      this.eventCache.delete(sessionId);
+      this.eventCacheMtimes.delete(sessionId);
+      this.eventCache.set(sessionId, cachedData);
+      this.eventCacheMtimes.set(sessionId, mtimeMs);
+      return cachedData;
+    }
+    const data = await this.store.load(sessionId);
+    this.eventCache.delete(sessionId);
+    this.eventCacheMtimes.delete(sessionId);
+    this.eventCache.set(sessionId, data);
+    this.eventCacheMtimes.set(sessionId, mtimeMs);
+    while (this.eventCache.size > _DefaultSessionReader.EVENT_CACHE_MAX_ENTRIES) {
+      const oldest = this.eventCache.keys().next().value;
+      if (oldest === void 0) break;
+      this.eventCache.delete(oldest);
+      this.eventCacheMtimes.delete(oldest);
+    }
+    if (data.metadata.endedAt) {
+      storeWithPath.clearLoadCache?.(sessionId);
+    }
+    return data;
+  }
   async query(q = {}) {
-    const raw = await this.store.list(q.limit ? Math.max(q.limit, 100) : 1e3);
-    const titleNeedle = q.titleContains?.toLowerCase();
-    const filtered = raw.filter((s) => {
-      if (q.since && s.startedAt < q.since) return false;
-      if (q.until && s.startedAt > q.until) return false;
-      if (q.provider && s.provider !== q.provider) return false;
-      if (q.model && s.model !== q.model) return false;
-      if (q.minTokens !== void 0 && s.tokenTotal < q.minTokens) return false;
-      if (titleNeedle && !s.title.toLowerCase().includes(titleNeedle)) return false;
-      return true;
-    });
-    const out = filtered.map((s) => ({
+    const storeWithFilter = this.store;
+    let raw;
+    if (typeof storeWithFilter.listFiltered === "function") {
+      raw = await storeWithFilter.listFiltered({
+        since: q.since,
+        until: q.until,
+        provider: q.provider,
+        model: q.model,
+        minTokens: q.minTokens,
+        titleContains: q.titleContains,
+        limit: q.limit
+      });
+    } else {
+      const fetched = await this.store.list(q.limit ? Math.max(q.limit, 100) : 1e3);
+      const titleNeedle = q.titleContains?.toLowerCase();
+      raw = fetched.filter((s) => {
+        if (q.since && s.startedAt < q.since) return false;
+        if (q.until && s.startedAt > q.until) return false;
+        if (q.provider && s.provider !== q.provider) return false;
+        if (q.model && s.model !== q.model) return false;
+        if (q.minTokens !== void 0 && s.tokenTotal < q.minTokens) return false;
+        if (titleNeedle && !s.title.toLowerCase().includes(titleNeedle)) return false;
+        return true;
+      });
+    }
+    const out = raw.map((s) => ({
       id: s.id,
       title: s.title,
       startedAt: s.startedAt,
@@ -6214,7 +6780,7 @@ var DefaultSessionReader = class {
     return q.limit ? out.slice(0, q.limit) : out;
   }
   async *replay(sessionId) {
-    const data = await this.store.load(sessionId);
+    const data = await this.loadCachedSessionData(sessionId);
     for (const e of data.events) yield e;
   }
   async search(q, sessionId, sessionQuery) {
@@ -6225,24 +6791,66 @@ var DefaultSessionReader = class {
     if (sessionId) {
       ids = [sessionId];
     } else {
-      const sessions = await this.store.list(1e3);
-      const titleNeedle = sessionQuery?.titleContains?.toLowerCase();
-      const filtered = sessions.filter((s) => {
-        if (sessionQuery?.since && s.startedAt < sessionQuery.since) return false;
-        if (sessionQuery?.until && s.startedAt > sessionQuery.until) return false;
-        if (sessionQuery?.provider && s.provider !== sessionQuery.provider) return false;
-        if (sessionQuery?.model && s.model !== sessionQuery.model) return false;
-        if (sessionQuery?.minTokens !== void 0 && s.tokenTotal < sessionQuery.minTokens) return false;
-        if (titleNeedle && !s.title.toLowerCase().includes(titleNeedle)) return false;
-        return true;
-      });
-      ids = filtered.map((s) => s.id);
+      const storeWithFilter = this.store;
+      let sessions;
+      if (typeof storeWithFilter.listFiltered === "function") {
+        sessions = await storeWithFilter.listFiltered({
+          since: sessionQuery?.since,
+          until: sessionQuery?.until,
+          provider: sessionQuery?.provider,
+          model: sessionQuery?.model,
+          minTokens: sessionQuery?.minTokens,
+          titleContains: sessionQuery?.titleContains,
+          limit: 1e3
+        });
+      } else {
+        sessions = await this.store.list(1e3);
+        const titleNeedle = sessionQuery?.titleContains?.toLowerCase();
+        sessions = sessions.filter((s) => {
+          if (sessionQuery?.since && s.startedAt < sessionQuery.since) return false;
+          if (sessionQuery?.until && s.startedAt > sessionQuery.until) return false;
+          if (sessionQuery?.provider && s.provider !== sessionQuery.provider) return false;
+          if (sessionQuery?.model && s.model !== sessionQuery.model) return false;
+          if (sessionQuery?.minTokens !== void 0 && s.tokenTotal < sessionQuery.minTokens) return false;
+          if (titleNeedle && !s.title.toLowerCase().includes(titleNeedle)) return false;
+          return true;
+        });
+      }
+      ids = sessions.map((s) => s.id);
     }
     const hits = [];
+    const streaming = this.store.searchEvents?.bind(this.store);
+    if (streaming) {
+      for (const id of ids) {
+        const matched = await streaming(
+          id,
+          (ev) => {
+            if (allowedTypes && !allowedTypes.has(ev.type)) return false;
+            const text = eventText(ev);
+            if (text === null) return false;
+            return matcher(text) !== null;
+          },
+          { limit: limit - hits.length }
+        );
+        for (const m of matched) {
+          const text = expectDefined(eventText(m.event));
+          const hit = expectDefined(matcher(text));
+          hits.push({
+            sessionId: id,
+            eventIndex: m.eventIndex,
+            ts: m.ts,
+            type: m.event.type,
+            snippet: snippetOf(text, hit.start, hit.end)
+          });
+          if (hits.length >= limit) return hits;
+        }
+      }
+      return hits;
+    }
     for (const id of ids) {
       let data;
       try {
-        data = await this.store.load(id);
+        data = await this.loadCachedSessionData(id);
       } catch {
         continue;
       }
@@ -6266,7 +6874,7 @@ var DefaultSessionReader = class {
     return hits;
   }
   async export(sessionId, opts) {
-    const data = await this.store.load(sessionId);
+    const data = await this.loadCachedSessionData(sessionId);
     const includeTools = opts.includeTools ?? true;
     const includeDiagnostics = opts.includeDiagnostics ?? true;
     const filtered = data.events.filter((e) => {
@@ -6287,7 +6895,7 @@ var DefaultSessionReader = class {
     return renderMarkdown(data.metadata, filtered);
   }
   async metadata(sessionId) {
-    const data = await this.store.load(sessionId);
+    const data = await this.loadCachedSessionData(sessionId);
     return data.metadata;
   }
 };
@@ -6681,7 +7289,7 @@ async function loadTodosCheckpoint(filePath, events, traceId) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp2.readFile(filePath, "utf8");
+    raw = await fsp3.readFile(filePath, "utf8");
   } catch (err) {
     events?.emit("storage.error", {
       sessionId: traceId ?? "~boot~",
@@ -6823,7 +7431,7 @@ async function loadPlan(filePath, events) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp2.readFile(filePath, "utf8");
+    raw = await fsp3.readFile(filePath, "utf8");
   } catch (err) {
     events?.emit("storage.error", {
       sessionId: "~boot~",
@@ -7117,7 +7725,7 @@ init_atomic_write();
 async function loadDirectorState(filePath) {
   let raw;
   try {
-    raw = await fsp2.readFile(filePath, "utf8");
+    raw = await fsp3.readFile(filePath, "utf8");
   } catch {
     return null;
   }
@@ -7132,7 +7740,7 @@ async function loadDirectorState(filePath) {
 async function acquireDirectorStateLock(lockPath, processId = process.pid) {
   let existing;
   try {
-    existing = await fsp2.readFile(lockPath, "utf8");
+    existing = await fsp3.readFile(lockPath, "utf8");
   } catch {
   }
   if (existing) {
@@ -7156,7 +7764,7 @@ async function acquireDirectorStateLock(lockPath, processId = process.pid) {
 }
 async function releaseDirectorStateLock(lockPath) {
   try {
-    await fsp2.unlink(lockPath);
+    await fsp3.unlink(lockPath);
   } catch {
   }
 }
@@ -7701,7 +8309,7 @@ var DefaultPermissionPolicy = class {
   }
   async reload() {
     try {
-      const raw = await fsp2.readFile(this.trustFile, "utf8");
+      const raw = await fsp3.readFile(this.trustFile, "utf8");
       const parsed = safeParse(raw);
       if (parsed.ok && parsed.value) this.policy = parsed.value;
     } catch {
@@ -8187,12 +8795,12 @@ var DefaultSkillLoader = class {
     const seen = /* @__PURE__ */ new Set();
     for (const { dir, source } of this.dirs) {
       try {
-        const entries = await fsp2.readdir(dir, { withFileTypes: true });
+        const entries = await fsp3.readdir(dir, { withFileTypes: true });
         for (const e of entries) {
           if (!e.isDirectory()) continue;
           const skillFile = path4.join(dir, e.name, "SKILL.md");
           try {
-            const raw = await fsp2.readFile(skillFile, "utf8");
+            const raw = await fsp3.readFile(skillFile, "utf8");
             const meta = parseFrontmatter(raw);
             if (!meta.name || !meta.description) continue;
             if (seen.has(meta.name)) continue;
@@ -8251,7 +8859,7 @@ var DefaultSkillLoader = class {
     if (cached !== void 0) return cached;
     const m = await this.find(name);
     if (!m) throw new Error(`Skill "${name}" not found`);
-    const body = await fsp2.readFile(m.path, "utf8");
+    const body = await fsp3.readFile(m.path, "utf8");
     this.bodyCache.set(key, body);
     return body;
   }
@@ -8264,9 +8872,9 @@ var DefaultSkillLoader = class {
     const savePath = path4.join(path4.dirname(m.path), "SKILL.save.md");
     let result;
     try {
-      result = await fsp2.readFile(savePath, "utf8");
+      result = await fsp3.readFile(savePath, "utf8");
     } catch {
-      const full = await fsp2.readFile(m.path, "utf8");
+      const full = await fsp3.readFile(m.path, "utf8");
       const body = stripFrontmatter(full);
       const compact = compactSkillBody(body);
       if (compact) {
@@ -10052,6 +10660,7 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         level,
         tokens,
         load,
+        hardThreshold: adaptiveThresholds.hard,
         budget,
         signals: { repeatedReadCount: repetition }
       });
@@ -10099,6 +10708,7 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
     }
   }
   async compact(ctx, aggressive, pressure) {
+    let postCompactionOverflow = null;
     try {
       const report = await this.compactor.compact(ctx, { aggressive });
       this.recordAttempt(pressure.level, pressure.tokens, report);
@@ -10128,6 +10738,38 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         ...report.collapsedDigest ? { digest: truncateDigest(report.collapsedDigest) } : {}
       });
       ctx.clearFileTracking();
+      const afterTokens = report.fullRequestTokensAfter ?? report.after;
+      const afterLoad = this._maxContext > 0 ? afterTokens / this._maxContext : 0;
+      const stillHard = afterLoad >= pressure.hardThreshold;
+      const fatal = stillHard && (this.failureMode === "throw" || this.failureMode === "throw_on_hard" && pressure.level === "hard");
+      if (stillHard) {
+        const error = new Error(
+          `Auto-compaction left context above the hard threshold after ${pressure.level} compaction`
+        );
+        this.events?.emit("compaction.failed", {
+          err: error,
+          aggressive,
+          level: pressure.level,
+          tokens: afterTokens,
+          maxContext: this._maxContext,
+          budget: computeContextWindowBudget(ctx, afterTokens, this._maxContext),
+          signals: pressure.signals,
+          load: afterLoad,
+          fatal
+        });
+        if (fatal) {
+          postCompactionOverflow = new AgentError({
+            message: `Auto-compaction did not reduce context below hard threshold`,
+            code: ERROR_CODES.AGENT_CONTEXT_OVERFLOW,
+            recoverable: true,
+            context: {
+              level: pressure.level,
+              tokens: afterTokens,
+              maxContext: this._maxContext
+            }
+          });
+        }
+      }
     } catch (err) {
       const error = err instanceof Error ? err : new Error(String(err));
       const fatal = this.failureMode === "throw" || this.failureMode === "throw_on_hard" && pressure.level === "hard";
@@ -10156,6 +10798,7 @@ var AutoCompactionMiddleware = class _AutoCompactionMiddleware {
         });
       }
     }
+    if (postCompactionOverflow) throw postCompactionOverflow;
   }
 };
 function computeContextWindowBudget(ctx, inputTokens, maxContext) {
@@ -10324,7 +10967,7 @@ ${errorDetails}`,
         "tool.name": tool.name,
         "tool.mutating": tool.mutating,
         "tool.permission": tool.permission,
-        "tool.capabilities": JSON.stringify(tool.capabilities ?? []),
+        "tool.capabilities": toolCapsForAudit.length > 0 ? JSON.stringify(tool.capabilities ?? []) : "[]",
         "tool.has_dangerous_capabilities": toolCapsForAudit.length > 0
       });
       try {
@@ -10680,11 +11323,11 @@ async function maybePersistLargeToolOutput(toolName, content, budget) {
   }
   try {
     const dir = path4.join(wstackGlobalRoot(), "tool-output");
-    await fsp2.mkdir(dir, { recursive: true });
+    await fsp3.mkdir(dir, { recursive: true });
     const safeTool = toolName.replace(/[^a-zA-Z0-9._-]+/g, "_").slice(0, 40) || "tool";
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
     const filePath = path4.join(dir, `${stamp}-${safeTool}-${randomUUID()}.log`);
-    await fsp2.writeFile(filePath, content, "utf8");
+    await fsp3.writeFile(filePath, content, "utf8");
     return content + `
 [full tool output: ${bytes} bytes at ${filePath}; read/grep that file selectively instead of re-running or requesting more output]`;
   } catch {
@@ -10879,7 +11522,7 @@ async function loadGoal(filePath, events) {
   const t0 = Date.now();
   let raw;
   try {
-    raw = await fsp2.readFile(filePath, "utf8");
+    raw = await fsp3.readFile(filePath, "utf8");
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -11629,8 +12272,8 @@ ${recentJournal}` : "No prior iterations.",
       await saveGoal(this.goalPath, abandoned, this.opts.events);
     }
     try {
-      const { unlink: unlink13 } = await import('fs/promises');
-      await unlink13(this.goalPath);
+      const { unlink: unlink14 } = await import('fs/promises');
+      await unlink14(this.goalPath);
     } catch {
     }
     this.opts.onEternalStop?.();
@@ -17292,9 +17935,9 @@ var CollabSession = class extends EventEmitter {
     }
     for (const filePath of allFiles) {
       try {
-        const [content, stat6] = await Promise.all([
-          fsp2.readFile(filePath, "utf8"),
-          fsp2.stat(filePath)
+        const [content, stat8] = await Promise.all([
+          fsp3.readFile(filePath, "utf8"),
+          fsp3.stat(filePath)
         ]);
         const ext = filePath.split(".").pop() ?? "";
         const language = ext === "ts" || ext === "tsx" ? "typescript" : ext === "js" || ext === "jsx" ? "javascript" : ext === "md" ? "markdown" : ext === "json" ? "json" : void 0;
@@ -17302,8 +17945,8 @@ var CollabSession = class extends EventEmitter {
           path: filePath,
           content,
           language,
-          snapshotMtimeMs: stat6.mtimeMs,
-          snapshotSizeBytes: stat6.size
+          snapshotMtimeMs: stat8.mtimeMs,
+          snapshotSizeBytes: stat8.size
         });
       } catch {
         this.snapshot.files.push({ path: filePath, content: "", language: void 0 });
@@ -17716,9 +18359,9 @@ Emit each evaluation immediately. Do not wait until you have read all reports.`;
     for (const file of this.snapshot.files) {
       if (file.snapshotMtimeMs === void 0 && file.snapshotSizeBytes === void 0) continue;
       try {
-        const stat6 = await fsp2.stat(file.path);
-        const mtimeChanged = file.snapshotMtimeMs !== void 0 && stat6.mtimeMs > file.snapshotMtimeMs + 1;
-        const sizeChanged = file.snapshotSizeBytes !== void 0 && stat6.size !== file.snapshotSizeBytes;
+        const stat8 = await fsp3.stat(file.path);
+        const mtimeChanged = file.snapshotMtimeMs !== void 0 && stat8.mtimeMs > file.snapshotMtimeMs + 1;
+        const sizeChanged = file.snapshotSizeBytes !== void 0 && stat8.size !== file.snapshotSizeBytes;
         if (mtimeChanged || sizeChanged) {
           warnings.push(`${file.path} changed after the collab snapshot was captured.`);
         }
@@ -18920,7 +19563,7 @@ var Director = class _Director {
     this.fleetManager = opts.fleetManager;
     this.logger = opts.logger;
     if (this.sharedScratchpadPath) {
-      void fsp2.mkdir(this.sharedScratchpadPath, { recursive: true }).catch((err) => this.logShutdownError("shared_scratchpad_mkdir", err));
+      void fsp3.mkdir(this.sharedScratchpadPath, { recursive: true }).catch((err) => this.logShutdownError("shared_scratchpad_mkdir", err));
     }
     this.transport = new InMemoryBridgeTransport();
     this.bridge = new InMemoryAgentBridge(
@@ -19520,7 +20163,7 @@ var Director = class _Director {
       })),
       usage: this.usage.snapshot()
     };
-    await fsp2.mkdir(path4.dirname(this.manifestPath), { recursive: true });
+    await fsp3.mkdir(path4.dirname(this.manifestPath), { recursive: true });
     await atomicWrite(this.manifestPath, JSON.stringify(manifest, null, 2), { mode: 384 });
     return this.manifestPath;
   }
@@ -19754,7 +20397,7 @@ var Director = class _Director {
     const filePath = path4.join(this.sessionsRoot, this.directorRunId, `${subagentId}.jsonl`);
     let raw;
     try {
-      raw = await fsp2.readFile(filePath, "utf8");
+      raw = await fsp3.readFile(filePath, "utf8");
     } catch {
       return null;
     }
@@ -20284,7 +20927,7 @@ async function readSubagentPartial(opts, subagentId) {
     candidates.push(path4.join(opts.sessionsRoot, opts.directorRunId, `${subagentId}.jsonl`));
   } else {
     try {
-      const entries = await fsp2.readdir(opts.sessionsRoot, { withFileTypes: true });
+      const entries = await fsp3.readdir(opts.sessionsRoot, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory()) {
           candidates.push(path4.join(opts.sessionsRoot, entry.name, `${subagentId}.jsonl`));
@@ -20297,7 +20940,7 @@ async function readSubagentPartial(opts, subagentId) {
   for (const file of candidates) {
     let raw;
     try {
-      raw = await fsp2.readFile(file, "utf8");
+      raw = await fsp3.readFile(file, "utf8");
     } catch {
       continue;
     }
@@ -20627,7 +21270,7 @@ var DefaultModelsRegistry = class {
   async readOverlayFile() {
     if (!this.overlayFile) return void 0;
     try {
-      const raw = await fsp2.readFile(this.overlayFile, "utf8");
+      const raw = await fsp3.readFile(this.overlayFile, "utf8");
       return JSON.parse(raw);
     } catch {
       return void 0;
@@ -20706,7 +21349,7 @@ var DefaultModelsRegistry = class {
   }
   async readCacheAt(file) {
     try {
-      const raw = await fsp2.readFile(file, "utf8");
+      const raw = await fsp3.readFile(file, "utf8");
       return JSON.parse(raw);
     } catch {
       return void 0;
@@ -21092,7 +21735,7 @@ var DefaultModeStore = class {
   async loadActiveMode() {
     try {
       const configPath = path4.join(this.configDir, "mode.json");
-      const content = await fsp2.readFile(configPath, "utf8");
+      const content = await fsp3.readFile(configPath, "utf8");
       const data = JSON.parse(content);
       this.activeModeId = data.activeMode ?? null;
     } catch {
@@ -21101,7 +21744,7 @@ var DefaultModeStore = class {
   }
   async saveActiveMode() {
     try {
-      await fsp2.mkdir(this.configDir, { recursive: true });
+      await fsp3.mkdir(this.configDir, { recursive: true });
       const configPath = path4.join(this.configDir, "mode.json");
       await atomicWrite(
         configPath,
@@ -21114,13 +21757,13 @@ var DefaultModeStore = class {
 async function loadProjectModes(modesDir) {
   const modes = [];
   try {
-    const entries = await fsp2.readdir(modesDir);
+    const entries = await fsp3.readdir(modesDir);
     for (const entry of entries) {
       if (!entry.endsWith(".md") && !entry.endsWith(".txt")) continue;
       const filePath = path4.join(modesDir, entry);
-      const stat6 = await fsp2.stat(filePath);
-      if (!stat6.isFile()) continue;
-      const content = await fsp2.readFile(filePath, "utf8");
+      const stat8 = await fsp3.stat(filePath);
+      if (!stat8.isFile()) continue;
+      const content = await fsp3.readFile(filePath, "utf8");
       const id = path4.basename(entry, path4.extname(entry));
       modes.push({
         id,
@@ -21138,7 +21781,7 @@ async function loadUserModes(modesDir) {
   const modes = [];
   try {
     const manifestPath = path4.join(modesDir, "modes.json");
-    const content = await fsp2.readFile(manifestPath, "utf8");
+    const content = await fsp3.readFile(manifestPath, "utf8");
     const manifest = JSON.parse(content);
     for (const mode of manifest.modes) {
       modes.push(mode);
@@ -21148,11 +21791,41 @@ async function loadUserModes(modesDir) {
   return modes;
 }
 
+// src/models/codex-catalog.ts
+var CODEX_MODELS = [
+  {
+    id: "gpt-5.5",
+    name: "GPT-5.5",
+    description: "Frontier model for complex coding, research, and real-world work.",
+    current: true
+  },
+  {
+    id: "gpt-5.4",
+    name: "GPT-5.4",
+    description: "Strong model for everyday coding."
+  },
+  {
+    id: "gpt-5.4-mini",
+    name: "GPT-5.4 Mini",
+    description: "Small, fast, and cost-efficient model for simpler coding tasks."
+  },
+  {
+    id: "gpt-5.3-codex-spark",
+    name: "GPT-5.3 Codex Spark",
+    description: "Ultra-fast coding model."
+  }
+];
+var BY_ID = new Map(CODEX_MODELS.map((m) => [m.id, m]));
+function codexModelMeta(id) {
+  return BY_ID.get(id);
+}
+
 // src/models/provider-model-resolve.ts
 function describeCatalogModel(m) {
   return {
     id: m.id,
     name: m.name,
+    ...m.description !== void 0 ? { description: m.description } : {},
     releaseDate: m.release_date,
     contextWindow: m.limit?.context,
     inputCost: m.cost?.input,
@@ -21169,8 +21842,16 @@ function resolveProviderModelList(savedModels, catalog) {
   if (savedModels && savedModels.length > 0) {
     const byId = new Map((catalog?.models ?? []).map((m) => [m.id, m]));
     return savedModels.map((id) => {
+      const codex = codexModelMeta(id);
       const hit = byId.get(id);
-      return hit ? describeCatalogModel(hit) : { id, name: id, capabilities: [] };
+      if (hit) {
+        const described = describeCatalogModel(hit);
+        return codex ? { ...described, description: codex.description } : described;
+      }
+      if (codex) {
+        return { id, name: codex.name, description: codex.description, capabilities: [] };
+      }
+      return { id, name: id, capabilities: [] };
     });
   }
   if (catalog) return catalog.models.map(describeCatalogModel);
@@ -22241,7 +22922,7 @@ var SpecStore = class {
   }
   async load(id) {
     try {
-      const raw = await fsp2.readFile(this.filePath(id), "utf8");
+      const raw = await fsp3.readFile(this.filePath(id), "utf8");
       return JSON.parse(raw);
     } catch {
       return null;
@@ -22253,7 +22934,7 @@ var SpecStore = class {
   }
   async delete(id) {
     try {
-      await fsp2.unlink(this.filePath(id));
+      await fsp3.unlink(this.filePath(id));
       await this.removeFromIndex(id);
       return true;
     } catch {
@@ -22262,7 +22943,7 @@ var SpecStore = class {
   }
   async exists(id) {
     try {
-      await fsp2.access(this.filePath(id));
+      await fsp3.access(this.filePath(id));
       return true;
     } catch {
       return false;
@@ -22304,7 +22985,7 @@ var SpecStore = class {
   }
   async readIndex() {
     try {
-      const raw = await fsp2.readFile(this.indexPath, "utf8");
+      const raw = await fsp3.readFile(this.indexPath, "utf8");
       const parsed = JSON.parse(raw);
       if (parsed?.version === 1) return parsed;
     } catch {
@@ -22367,7 +23048,7 @@ var TaskGraphStore = class {
   }
   async load(id) {
     try {
-      const raw = await fsp2.readFile(this.filePath(id), "utf8");
+      const raw = await fsp3.readFile(this.filePath(id), "utf8");
       return graphFromJSON(raw);
     } catch {
       return null;
@@ -22379,7 +23060,7 @@ var TaskGraphStore = class {
   }
   async delete(id) {
     try {
-      await fsp2.unlink(this.filePath(id));
+      await fsp3.unlink(this.filePath(id));
       await this.removeFromIndex(id);
       return true;
     } catch {
@@ -22388,7 +23069,7 @@ var TaskGraphStore = class {
   }
   async exists(id) {
     try {
-      await fsp2.access(this.filePath(id));
+      await fsp3.access(this.filePath(id));
       return true;
     } catch {
       return false;
@@ -22399,7 +23080,7 @@ var TaskGraphStore = class {
   }
   async readIndex() {
     try {
-      const raw = await fsp2.readFile(this.indexPath, "utf8");
+      const raw = await fsp3.readFile(this.indexPath, "utf8");
       const parsed = JSON.parse(raw);
       if (parsed?.version === 1) return parsed;
     } catch {
@@ -22471,6 +23152,9 @@ function buildQuestioningPrompt(session, min, max) {
     "- Adapt based on previous answers",
     "- Cover: scope, constraints, edge cases, integrations, security, performance as relevant",
     "- When you have enough info, respond with the full specification in JSON format",
+    "- This is a planning interview: respond with TEXT ONLY (a question, or the spec JSON).",
+    "  Do NOT write or edit files, and do NOT run shell/terminal commands \u2014 the code is",
+    "  written later, after the plan is approved.",
     "",
     `**Question budget:** ${budget}/${max} remaining`,
     `**Minimum required:** ${remaining > 0 ? remaining : "met"}`
@@ -22538,6 +23222,9 @@ function buildImplementationPrompt(session) {
     "",
     "**Instructions for AI:**",
     "Generate a detailed implementation plan for this specification.",
+    "This is a PLANNING step \u2014 describe the plan and emit the task JSON as TEXT. Do NOT",
+    "create or edit files and do NOT run shell/terminal commands here; the tasks you list",
+    "are executed later, one by one, after you approve them.",
     "Include:",
     "1. Architecture decisions",
     "2. File structure changes",
@@ -22649,10 +23336,10 @@ var AISpecBuilder = class {
   async saveSession() {
     if (!this.sessionPath) return;
     try {
-      const fsp18 = await import('fs/promises');
-      const path23 = await import('path');
+      const fsp19 = await import('fs/promises');
+      const path25 = await import('path');
       const { atomicWrite: atomicWrite2 } = await Promise.resolve().then(() => (init_atomic_write(), atomic_write_exports));
-      await fsp18.mkdir(path23.dirname(this.sessionPath), { recursive: true });
+      await fsp19.mkdir(path25.dirname(this.sessionPath), { recursive: true });
       await atomicWrite2(this.sessionPath, JSON.stringify(this.session, null, 2));
     } catch {
     }
@@ -22661,8 +23348,8 @@ var AISpecBuilder = class {
   async loadSession() {
     if (!this.sessionPath) return false;
     try {
-      const fsp18 = await import('fs/promises');
-      const raw = await fsp18.readFile(this.sessionPath, "utf8");
+      const fsp19 = await import('fs/promises');
+      const raw = await fsp19.readFile(this.sessionPath, "utf8");
       const loaded = JSON.parse(raw);
       if (loaded?.id && loaded?.phase && loaded?.title) {
         this.session = loaded;
@@ -22676,8 +23363,8 @@ var AISpecBuilder = class {
   async deleteSession() {
     if (!this.sessionPath) return;
     try {
-      const fsp18 = await import('fs/promises');
-      await fsp18.unlink(this.sessionPath);
+      const fsp19 = await import('fs/promises');
+      await fsp19.unlink(this.sessionPath);
     } catch {
     }
   }
@@ -23379,15 +24066,15 @@ function computeCriticalPath(graph, _topoOrder, blockedByMap) {
       maxId = id;
     }
   }
-  const path23 = [];
+  const path25 = [];
   let current = maxId;
   const visited = /* @__PURE__ */ new Set();
   while (current && !visited.has(current)) {
     visited.add(current);
-    path23.unshift(current);
+    path25.unshift(current);
     current = prev.get(current) ?? null;
   }
-  return path23;
+  return path25;
 }
 function computeParallelGroups(graph, blockedByMap) {
   const groups = [];
@@ -25154,7 +25841,7 @@ var SddBoardStore = class {
   }
   async load(runId) {
     try {
-      const raw = await fsp2.readFile(this.snapshotPath(runId), "utf8");
+      const raw = await fsp3.readFile(this.snapshotPath(runId), "utf8");
       return JSON.parse(raw);
     } catch {
       return null;
@@ -25172,7 +25859,7 @@ var SddBoardStore = class {
   async appendEvent(runId, event) {
     try {
       await ensureDir(this.baseDir);
-      await fsp2.appendFile(this.eventsPath(runId), `${JSON.stringify(event)}
+      await fsp3.appendFile(this.eventsPath(runId), `${JSON.stringify(event)}
 `, { mode: 384 });
     } catch {
     }
@@ -25180,7 +25867,7 @@ var SddBoardStore = class {
   /** Append a control command (used by readers to steer a CLI-owned run). */
   async appendControl(runId, command) {
     await ensureDir(this.baseDir);
-    await fsp2.appendFile(this.controlPath(runId), `${JSON.stringify(command)}
+    await fsp3.appendFile(this.controlPath(runId), `${JSON.stringify(command)}
 `, { mode: 384 });
   }
   /** Read + truncate the control queue (the run drains it). Returns parsed commands. */
@@ -25188,12 +25875,12 @@ var SddBoardStore = class {
     const p = this.controlPath(runId);
     let raw;
     try {
-      raw = await fsp2.readFile(p, "utf8");
+      raw = await fsp3.readFile(p, "utf8");
     } catch {
       return [];
     }
     try {
-      await fsp2.writeFile(p, "", { mode: 384 });
+      await fsp3.writeFile(p, "", { mode: 384 });
     } catch {
     }
     return raw.split("\n").filter((l) => l.trim()).map((l) => {
@@ -25206,9 +25893,9 @@ var SddBoardStore = class {
   }
   async delete(runId) {
     await Promise.allSettled([
-      fsp2.unlink(this.snapshotPath(runId)),
-      fsp2.unlink(this.eventsPath(runId)),
-      fsp2.unlink(this.controlPath(runId))
+      fsp3.unlink(this.snapshotPath(runId)),
+      fsp3.unlink(this.eventsPath(runId)),
+      fsp3.unlink(this.controlPath(runId))
     ]);
     await this.removeFromIndex(runId);
   }
@@ -25218,7 +25905,7 @@ var SddBoardStore = class {
   }
   async readIndex() {
     try {
-      const raw = await fsp2.readFile(this.indexPath, "utf8");
+      const raw = await fsp3.readFile(this.indexPath, "utf8");
       const parsed = JSON.parse(raw);
       if (parsed?.version === 1) return parsed;
     } catch {
@@ -25654,6 +26341,7 @@ var SddInterviewDriver = class {
       sessionId: s.id,
       phase: s.phase,
       title: s.title,
+      goal: s.userIntent || s.title,
       questionCount: s.questionCount,
       minQuestions: this.minQuestions,
       maxQuestions: this.maxQuestions,
@@ -26348,14 +27036,14 @@ async function destroySddProject(opts) {
   const deleted = [];
   const rmDir = async (dir, label) => {
     try {
-      await fsp2.rm(dir, { recursive: true, force: true });
+      await fsp3.rm(dir, { recursive: true, force: true });
       deleted.push(label);
     } catch {
     }
   };
   const rmFile = async (file, label) => {
     try {
-      await fsp2.unlink(file);
+      await fsp3.unlink(file);
       deleted.push(label);
     } catch {
     }
@@ -26711,7 +27399,7 @@ async function startMetricsServer(opts) {
   const tls = opts.tls;
   const useHttps = !!(tls?.cert && tls?.key);
   const host = opts.host ?? "127.0.0.1";
-  const path23 = opts.path ?? "/metrics";
+  const path25 = opts.path ?? "/metrics";
   const healthPath = opts.healthPath ?? "/healthz";
   const healthRegistry = opts.healthRegistry;
   const listener = (req, res) => {
@@ -26721,7 +27409,7 @@ async function startMetricsServer(opts) {
       return;
     }
     const url = req.url.split("?")[0];
-    if (url === path23) {
+    if (url === path25) {
       let body;
       try {
         body = renderPrometheus(opts.sink.snapshot());
@@ -26785,7 +27473,7 @@ async function startMetricsServer(opts) {
   const protocol = useHttps ? "https" : "http";
   return {
     port: boundPort,
-    url: `${protocol}://${host}:${boundPort}${path23}`,
+    url: `${protocol}://${host}:${boundPort}${path25}`,
     close: () => new Promise((resolve8, reject) => {
       server.close((err) => err ? reject(err) : resolve8());
     })
@@ -27459,6 +28147,6 @@ var allServers = () => ({
   ssh: { ...sshManagerServer(), enabled: false }
 });
 
-export { AGENTS_BY_PHASE, AGENT_CATALOG, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, ConfigMigrationError, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPermissionPolicy, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, Director, DirectorStateCheckpoint, DoneConditionChecker, EternalAutonomyEngine, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FleetBus, FleetSpawnBudgetError, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, LLMSelector, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, ParallelEternalEngine, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, SddBoardProjector, SddBoardStore, SddInterviewDriver, SddParallelRun, SddRunRegistry, SddSupervisor, SddTaskDecomposer, SelectiveCompactor, SessionAnalyzer, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, SubagentBudget, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, ToolExecutor, addPlanItem, allServers, analyzeCriticalPath, applyRosterBudget, attachAutoExtend, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildBoardSnapshot, buildBoardTasks, buildGoalPreamble, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, cleanupSddWorktrees, clearPlan, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createAutoExecutor, createContextManagerTool, createDelegateTool, createMessage, createSessionEventBridge, createStrategyCompactor, decryptConfigSecrets, deriveTodosFromPlanItem, describeCatalogModel, destroySddProject, dispatchAgent, emptyPlan, encryptConfigSecrets, everArtServer, extractVerificationCommand, filesystemServer, formatPlan, formatPlanTemplates, getAgentDefinition, getPlanTemplate, getTemplate, githubServer, googleMapsServer, hasConflictMarkers, isExplanatoryText, listPlanTemplates, listTemplates, loadDirectorState, loadPlan, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeCommandVerifier, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetHealthTool, makeFleetSessionTool, makeFleetStatusTool, makeFleetUsageTool, makeLLMClassifier, makeLlmConflictResolver, makeLlmSubtaskGenerator, makePreferSideConflictResolver, makeRollUpTool, makeSpawnTool, makeTerminateTool, migratePlaintextSecrets, miniMaxVisionServer, playwrightServer, removePlanItem, renderProgress, renderPrometheus, renderSpecAnalysis, renderTaskGraph, renderTaskList, resolveAuditLevel, resolveConflictText, resolveProviderModelList, resolveSessionLoggingConfig, rewriteConfigEncrypted, rollbackSddRunFromDisk, rosterSummaryFromConfigs, runConfigMigrations, savePlan, saveTodosCheckpoint, scoreAgents, sentinelServer, setPlanItemStatus, shortIdMap, slackServer, sshManagerServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, startSddRun, templateToMarkdown, wireMetricsToEvents, zaiVisionServer };
+export { AGENTS_BY_PHASE, AGENT_CATALOG, AISpecBuilder, ALL_AGENT_DEFINITIONS, ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AutoApprovePermissionPolicy, AutoCompactionMiddleware, AutoExecutor, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, CODEX_MODELS, ConfigMigrationError, DEFAULT_AUTONOMY_CONFIG, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_CONTEXT_CONFIG, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_DISPATCH_ROLE, DEFAULT_SUBAGENT_BASELINE, DEFAULT_TOOLS_CONFIG, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPermissionPolicy, DefaultProviderRunner, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, Director, DirectorStateCheckpoint, DoneConditionChecker, EternalAutonomyEngine, FLEET_ROSTER, FLEET_ROSTER_BUDGETS, FleetBus, FleetSpawnBudgetError, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, LLMSelector, NULL_FLEET_BUS, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, ParallelEternalEngine, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, SECURITY_SCANNER_AGENT, SPEC_TEMPLATES, SddBoardProjector, SddBoardStore, SddInterviewDriver, SddParallelRun, SddRunRegistry, SddSupervisor, SddTaskDecomposer, SelectiveCompactor, SessionAnalyzer, SpecDrivenDev, SpecParser, SpecStore, SpecVersioning, SubagentBudget, TaskFlow, TaskGenerator, TaskGraphStore, TaskTracker, ToolExecutor, addPlanItem, allServers, analyzeCriticalPath, applyRosterBudget, attachAutoExtend, attachPlanCheckpoint, attachTodosCheckpoint, awsServer, blockServer, braveSearchServer, buildBoardSnapshot, buildBoardTasks, buildGoalPreamble, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, cleanupSddWorktrees, clearPlan, codexModelMeta, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createAutoExecutor, createContextManagerTool, createDelegateTool, createMessage, createSessionEventBridge, createStrategyCompactor, decryptConfigSecrets, deriveTodosFromPlanItem, describeCatalogModel, destroySddProject, dispatchAgent, emptyPlan, encryptConfigSecrets, everArtServer, extractVerificationCommand, filesystemServer, formatPlan, formatPlanTemplates, getAgentDefinition, getPlanTemplate, getTemplate, githubServer, googleMapsServer, hasConflictMarkers, isExplanatoryText, listPlanTemplates, listTemplates, loadDirectorState, loadPlan, loadProjectModes, loadTodosCheckpoint, loadUserModes, makeAgentSubagentRunner, makeAskTool, makeAssignTool, makeAutonomyPromptContributor, makeAwaitTasksTool, makeCollabDebugTool, makeCommandVerifier, makeDirectorSessionFactory, makeFleetEmitTool, makeFleetHealthTool, makeFleetSessionTool, makeFleetStatusTool, makeFleetUsageTool, makeLLMClassifier, makeLlmConflictResolver, makeLlmSubtaskGenerator, makePreferSideConflictResolver, makeRollUpTool, makeSpawnTool, makeTerminateTool, migratePlaintextSecrets, miniMaxVisionServer, playwrightServer, removePlanItem, renderProgress, renderPrometheus, renderSpecAnalysis, renderTaskGraph, renderTaskList, resolveAuditLevel, resolveConflictText, resolveProviderModelList, resolveSessionLoggingConfig, rewriteConfigEncrypted, rollbackSddRunFromDisk, rosterSummaryFromConfigs, runConfigMigrations, savePlan, saveTodosCheckpoint, scoreAgents, sentinelServer, setPlanItemStatus, shortIdMap, slackServer, sshManagerServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, startSddRun, templateToMarkdown, wireMetricsToEvents, zaiVisionServer };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map