@wrongstack/core 0.296.4 → 0.298.0

package/dist/storage/index.js

@@ -2,67 +2,80 @@
 import * as fsp12 from "node:fs/promises";
 import * as path13 from "node:path";
 
+// src/security/file-permissions.ts
+var SECRET_FILE_MODE = 384;
+
 // src/security/secret-scrubber.ts
 var PATTERNS = [
   // Anchored at the start where possible so partial matches inside larger
   // strings don't trigger false positives.
   {
     type: "anthropic_key",
-    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g,
+    anchor: "sk-ant-"
   },
-  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g },
-  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g },
-  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g },
-  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g },
-  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g },
-  { type: "slack_token", regex: /(?<![A-Za-z0-9-])xox[abpos]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g },
+  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
+  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
+  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
+  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g, anchor: "AIza" },
+  { type: "slack_token", regex: /(?<![A-Za-z0-9-])xox[abpos]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g, anchor: "xox" },
   {
     type: "stripe_key",
-    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g,
+    anchor: "sk_"
   },
   {
     type: "twilio_sid",
-    regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g,
+    anchor: "AC"
   },
   {
     type: "telegram_bot_token",
     // Telegram tokens are of the form  bot<digits>:<alphanum>  in URL paths
-    regex: /\/bot\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+    regex: /\/bot\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "/bot"
   },
   {
     type: "jwt",
     // Anchored: look for literal "eyJ" which is unambiguous for JWT header
-    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g
+    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g,
+    anchor: "eyJ"
   },
   {
     type: "private_key",
     // Anchored: start must be BEGIN, end must be END with no extra dashes after END
-    regex: /(?:^|\n)-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----[\s\S]*?-----END[^-]*-----(?:\n|$)/g
+    regex: /(?:^|\n)-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----[\s\S]*?-----END[^-]*-----(?:\n|$)/g,
+    anchor: "-----BEGIN"
   },
-  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s"'`]+/g },
-  { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g },
-  { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g },
-  { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g },
+  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s"'`]+/g, anchor: "mongodb" },
+  { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g, anchor: "postgres" },
+  { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g, anchor: "mysql://" },
+  { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g, anchor: "redis://" },
   // AI/ML provider keys — modern LLM services with well-known prefixes
   {
     type: "huggingface_token",
     // HuggingFace tokens: hf_ followed by 34 alphanumeric chars
-    regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g,
+    anchor: "hf_"
   },
   {
     type: "replicate_token",
     // Replicate tokens: r8_ followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "r8_"
   },
   {
     type: "perplexity_key",
     // Perplexity API keys: pplx- followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "pplx-"
   },
   {
     type: "groq_key",
     // Groq API keys: gsk_ followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "gsk_"
   },
   {
     type: "bearer_token",
@@ -75,7 +88,8 @@ var PATTERNS = [
     // tokens sharing a single delimiter (`Bearer a… Bearer b…`) must both be
     // redacted. A consuming trailing delimiter would eat the separator the
     // next match needs for its leading anchor, leaking the second token.
-    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?=$|[^A-Za-z0-9_.~+/-])/g
+    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?=$|[^A-Za-z0-9_.~+/-])/g,
+    anchor: "Bearer"
   },
   {
     type: "high_entropy_env",
@@ -91,7 +105,89 @@ var PATTERNS = [
     // replacement so the separator between adjacent secrets is preserved
     // rather than collapsed. Capture groups are therefore: 1=leading
     // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
+  },
+  // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
+  // The plugin runtime carried 37 patterns while this scrubber — the one that
+  // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
+  // audit — carried 22. The plugin side already had a parity test; it just did
+  // not cover core. Most consequential: WrongStack mints `gho_` tokens itself
+  // in the Copilot OAuth flow, and `gh[ousr]_` was absent here.
+  {
+    type: "github_oauth_token",
+    regex: /(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g,
+    anchor: ["gho_", "ghu_", "ghs_", "ghr_"]
+  },
+  {
+    type: "gitlab_pat",
+    regex: /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "glpat-"
+  },
+  {
+    type: "gitlab_runner_token",
+    regex: /(?<![A-Za-z0-9])glrt-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "glrt-"
+  },
+  {
+    type: "npm_token",
+    regex: /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g,
+    anchor: "npm_"
+  },
+  {
+    type: "slack_app_token",
+    regex: /(?<![A-Za-z0-9-])xapp-\d-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g,
+    anchor: "xapp-"
+  },
+  {
+    type: "slack_webhook",
+    regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_-]+\/B[A-Za-z0-9_-]+\/[A-Za-z0-9]{16,}/g,
+    anchor: "hooks.slack.com"
+  },
+  {
+    type: "sendgrid_key",
+    regex: /(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "SG."
+  },
+  {
+    type: "digitalocean_token",
+    regex: /(?<![A-Za-z0-9])dop_v1_[a-f0-9]{64}(?![A-Za-z0-9])/g,
+    anchor: "dop_v1_"
+  },
+  {
+    type: "doppler_token",
+    regex: /(?<![A-Za-z0-9])dp\.(?:pt|st|sa|scim|audit)\.[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "dp."
+  },
+  {
+    type: "shopify_token",
+    regex: /(?<![A-Za-z0-9])shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}(?![A-Za-z0-9])/g,
+    anchor: "shp"
+  },
+  {
+    type: "docker_pat",
+    regex: /(?<![A-Za-z0-9])dckr_pat_[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "dckr_pat_"
+  },
+  {
+    type: "linear_key",
+    regex: /(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "lin_api_"
+  },
+  {
+    type: "atlassian_token",
+    regex: /(?<![A-Za-z0-9])ATATT3[A-Za-z0-9_\-=]{40,}(?![A-Za-z0-9_\-=])/g,
+    anchor: "ATATT3"
+  },
+  {
+    type: "square_token",
+    regex: /(?<![A-Za-z0-9])(?:sq0(?:atp|csp)-|EAAA)[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: ["sq0atp-", "sq0csp-", "EAAA"]
+  },
+  {
+    type: "google_oauth_client_secret",
+    regex: /(?<![A-Za-z0-9_-])GOCSPX-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "GOCSPX-"
   }
 ];
 var SIMPLE_PATTERNS = PATTERNS.filter((p) => p.type !== "high_entropy_env");
@@ -100,32 +196,32 @@ var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").reg
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
+var PATTERN_ANCHORS = [
+  ...new Set(
+    PATTERNS.flatMap(
+      (pattern) => typeof pattern.anchor === "string" ? [pattern.anchor] : [...pattern.anchor]
+    )
+  )
+];
+var JSON_KEY_ANCHORS = [
+  '"apiKey"',
+  '"api_key"',
+  '"token"',
+  '"secret"',
+  '"password"',
+  '"authorization"',
+  '"bearer"',
+  '"private_key"',
+  '"access_token"',
+  '"refresh_token"',
+  '"client_secret"'
+];
+var ALL_ANCHORS = [...PATTERN_ANCHORS, ...JSON_KEY_ANCHORS];
 function hasCredentialAnchors(text) {
-  return text.includes("-----BEGIN") || // Private keys (most unique → cheap reject)
-  text.includes("sk-") || // Anthropic + OpenAI keys
-  text.includes("sk_") || // Stripe live/test keys
-  text.includes("ghp_") || // GitHub PAT v1
-  text.includes("github_pat_") || // GitHub PAT v2
-  text.includes("eyJ") || // JWT
-  text.includes("AKIA") || // AWS access key
-  text.includes("AIza") || // GCP service key
-  text.includes("xox") || // Slack token (xoxa/xoxb/xoxp/xoxo/xoxs)
-  text.includes("Bearer ") || // Bearer token (space suffix reduces false positives)
-  text.includes("/bot") || // Telegram bot token (URL path pattern)
-  text.includes("hf_") || // HuggingFace token
-  text.includes("r8_") || // Replicate token
-  text.includes("pplx-") || // Perplexity API key
-  text.includes("gsk_") || // Groq API key
-  text.includes("_KEY=") || // High-entropy env vars: API_KEY=, SECRET_KEY=, ...
-  text.includes("_TOKEN=") || // ACCESS_TOKEN=, AUTH_TOKEN=, ...
-  text.includes("_SECRET=") || // API_SECRET=, CLIENT_SECRET=, ...
-  text.includes("_PASSWORD=") || // DB_PASSWORD=, ROOT_PASSWORD=, ...
-  text.includes("mongodb://") || text.includes("mongodb+srv://") || text.includes("postgres://") || text.includes("postgresql://") || text.includes("mysql://") || text.includes("redis://") || // JSON-style credential keys: tool outputs often serialise objects as
-  // raw JSON strings rather than parsed objects. The value may not start
-  // with a recognisable prefix (sk-, ghp_, etc.), so we anchor on common
-  // key names. The `"` prefix avoids matching prose that happens to mention
-  // these words — JSON serialisation always quotes string keys.
-  text.includes('"apiKey"') || text.includes('"api_key"') || text.includes('"token"') || text.includes('"secret"') || text.includes('"password"') || text.includes('"authorization"') || text.includes('"bearer"') || text.includes('"private_key"') || text.includes('"access_token"') || text.includes('"refresh_token"') || text.includes('"client_secret"');
+  for (const anchor of ALL_ANCHORS) {
+    if (text.includes(anchor)) return true;
+  }
+  return false;
 }
 var DefaultSecretScrubber = class {
   scrub(text) {
@@ -388,6 +484,11 @@ var SECRET_NAME_PARTS = [
   "SECRET",
   "PASSWORD",
   "PASSWD",
+  // WRONGSTACK_VAULT_PASSPHRASE is the vault KEK. Without this entry it matched
+  // no rule here and fell through to the `WRONGSTACK_` prefix allow-rule, so the
+  // key that protects the credential vault was forwarded to every child process
+  // — including the agent's own exec/bash tools and MCP stdio servers (WS-033).
+  "PASSPHRASE",
   "AUTH",
   "CRED",
   "BEARER",
@@ -558,6 +659,65 @@ async function backupConfigFile(filePath, paths) {
   }
 }
 
+// src/utils/deep-merge.ts
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
+function isPrimitiveArray(a) {
+  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
+}
+function deepMerge(base, patch, options = {}) {
+  const {
+    conflictResolution = "prefer-patch",
+    arrayMode = "replace",
+    protectProto = true,
+    onNonPrimitiveArrayReplace
+  } = options;
+  if (typeof base !== "object" || base === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (typeof patch !== "object" || patch === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) && Array.isArray(patch)) {
+    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
+      return [.../* @__PURE__ */ new Set([...base, ...patch])];
+    }
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) || Array.isArray(patch)) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  const baseObj = base;
+  const patchObj = patch;
+  const out = { ...baseObj };
+  for (const [k, v] of Object.entries(patchObj)) {
+    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
+    const existing = out[k];
+    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
+      out[k] = deepMerge(existing, v, options);
+    } else if (Array.isArray(v) && Array.isArray(existing)) {
+      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
+        onNonPrimitiveArrayReplace(k, existing.length, v.length);
+      }
+      out[k] = deepMerge(existing, v, options);
+    } else if (v !== void 0) {
+      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
+        const existingLen = Array.isArray(existing) ? existing.length : 0;
+        onNonPrimitiveArrayReplace(k, existingLen, v.length);
+      }
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
 // src/utils/expect-defined.ts
 function expectDefined(value, label) {
   if (value === null || value === void 0) {
@@ -677,68 +837,137 @@ function isEmptyMessage(msg) {
 // src/types/config/runtime.ts
 var DEFAULT_TUI_THINKING_WORD = "thinking";
 
-// src/utils/deep-merge.ts
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype",
-  "__defineGetter__",
-  "__defineSetter__",
-  "__lookupGetter__",
-  "__lookupSetter__"
-]);
-function isPrimitiveArray(a) {
-  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
-}
-function deepMerge(base, patch, options = {}) {
-  const {
-    conflictResolution = "prefer-patch",
-    arrayMode = "replace",
-    protectProto = true,
-    onNonPrimitiveArrayReplace
-  } = options;
-  if (typeof base !== "object" || base === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (typeof patch !== "object" || patch === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) && Array.isArray(patch)) {
-    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
-      return [.../* @__PURE__ */ new Set([...base, ...patch])];
-    }
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) || Array.isArray(patch)) {
-    return conflictResolution === "prefer-patch" ? patch : base;
+// src/utils/wstack-paths.ts
+import { createHash } from "node:crypto";
+import * as fs2 from "node:fs";
+import * as os from "node:os";
+import * as path2 from "node:path";
+function canonicalProjectRoot(absRoot) {
+  const checkoutRoot = path2.resolve(absRoot);
+  const dotGit = path2.join(checkoutRoot, ".git");
+  try {
+    if (!fs2.statSync(dotGit).isFile()) return checkoutRoot;
+    const gitDirLine = fs2.readFileSync(dotGit, "utf8").trim();
+    const match = /^gitdir:\s*(.+)$/i.exec(gitDirLine);
+    if (!match?.[1]) return checkoutRoot;
+    const gitDir = path2.resolve(checkoutRoot, match[1].trim());
+    const commonDirFile = path2.join(gitDir, "commondir");
+    if (!fs2.statSync(commonDirFile).isFile()) return checkoutRoot;
+    const commonDir = path2.resolve(gitDir, fs2.readFileSync(commonDirFile, "utf8").trim());
+    if (path2.basename(commonDir).toLowerCase() !== ".git") return checkoutRoot;
+    return path2.dirname(commonDir);
+  } catch {
+    return checkoutRoot;
   }
-  const baseObj = base;
-  const patchObj = patch;
-  const out = { ...baseObj };
-  for (const [k, v] of Object.entries(patchObj)) {
-    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
-    const existing = out[k];
-    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-      out[k] = deepMerge(existing, v, options);
-    } else if (Array.isArray(v) && Array.isArray(existing)) {
-      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
-        onNonPrimitiveArrayReplace(k, existing.length, v.length);
-      }
-      out[k] = deepMerge(existing, v, options);
-    } else if (v !== void 0) {
-      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
-        const existingLen = Array.isArray(existing) ? existing.length : 0;
-        onNonPrimitiveArrayReplace(k, existingLen, v.length);
-      }
-      out[k] = v;
-    }
+}
+function projectHash(absRoot) {
+  return createHash("sha256").update(canonicalProjectRoot(absRoot)).digest("hex").slice(0, 12);
+}
+function projectSlug(absRoot) {
+  const identityRoot = canonicalProjectRoot(absRoot);
+  const base = slugify(path2.basename(identityRoot));
+  const hash = createHash("sha256").update(identityRoot).digest("hex").slice(0, 6);
+  return `${base}-${hash}`;
+}
+function slugify(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
+}
+function safeProfileName(name) {
+  const safe = (name ?? "").replace(/[/\\:]/g, "_").replace(/\.\./g, "_").trim();
+  return safe || "default";
+}
+function activeProfileName(globalRoot) {
+  try {
+    const parsed = JSON.parse(fs2.readFileSync(path2.join(globalRoot, "config.json"), "utf8"));
+    return safeProfileName(typeof parsed.activeProfile === "string" ? parsed.activeProfile : void 0);
+  } catch {
+    return "default";
   }
-  return out;
+}
+function wstackGlobalRoot() {
+  const fromEnv = process.env["WRONGSTACK_HOME"];
+  if (fromEnv && fromEnv.trim().length > 0) return path2.resolve(fromEnv);
+  return path2.join(os.homedir(), ".wrongstack");
+}
+function resolveWstackPaths(opts) {
+  const globalRoot = opts.globalRoot ?? (opts.userHome ? path2.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
+  const homeDir = opts.userHome ?? os.homedir();
+  const profileName = safeProfileName(opts.profileName ?? activeProfileName(globalRoot));
+  const profileDir = path2.join(globalRoot, "profiles", profileName);
+  const hash = projectHash(opts.projectRoot);
+  const slug = projectSlug(opts.projectRoot);
+  const projectDir = path2.join(globalRoot, "projects", slug);
+  return {
+    globalRoot,
+    profileName,
+    profileDir,
+    projectRoot: opts.projectRoot,
+    homeDir,
+    configDir: profileDir,
+    globalConfig: path2.join(globalRoot, "config.json"),
+    profilesDir: path2.join(globalRoot, "profiles"),
+    profileConfig: (name) => {
+      return path2.join(globalRoot, "profiles", safeProfileName(name), "config.json");
+    },
+    profileStatuslineConfig: (name) => {
+      return path2.join(globalRoot, "profiles", safeProfileName(name), "statusline.json");
+    },
+    profileModeConfig: (name) => {
+      return path2.join(globalRoot, "profiles", safeProfileName(name), "mode.json");
+    },
+    profileProviderStatus: (name) => {
+      return path2.join(globalRoot, "profiles", safeProfileName(name), "provider-status.json");
+    },
+    profileUpdateCache: (name) => {
+      return path2.join(globalRoot, "profiles", safeProfileName(name), "update-cache.json");
+    },
+    secretsKey: path2.join(globalRoot, ".key"),
+    globalMemory: path2.join(profileDir, "memory.md"),
+    globalSkills: path2.join(profileDir, "skills"),
+    globalClaudeSkills: path2.join(homeDir, ".claude", "skills"),
+    globalDesignKits: path2.join(profileDir, "design-kits"),
+    globalPrompts: path2.join(profileDir, "prompts"),
+    globalInstructions: path2.join(profileDir, "instructions"),
+    promptUsage: path2.join(profileDir, "prompt-usage.json"),
+    cacheDir: path2.join(globalRoot, "cache"),
+    modelsCache: path2.join(globalRoot, "cache", "models.dev.json"),
+    modelsOverlayCache: path2.join(globalRoot, "cache", "models-overlay.json"),
+    historyFile: path2.join(profileDir, "history"),
+    logFile: path2.join(globalRoot, "logs", "wrongstack.log"),
+    projectDir,
+    projectCodebaseIndex: path2.join(projectDir, "codebase-index"),
+    projectMemory: path2.join(projectDir, "memory.md"),
+    projectSessions: path2.join(projectDir, "sessions"),
+    projectTrust: path2.join(projectDir, "trust.json"),
+    projectMeta: path2.join(projectDir, "meta.json"),
+    projectLocalConfig: path2.join(projectDir, "config.local.json"),
+    inProjectConfig: path2.join(opts.projectRoot, ".wrongstack", "config.json"),
+    inProjectAgentsFile: path2.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
+    inProjectSkills: path2.join(opts.projectRoot, ".wrongstack", "skills"),
+    inProjectClaudeSkills: path2.join(opts.projectRoot, ".claude", "skills"),
+    inProjectPrompts: path2.join(opts.projectRoot, ".wrongstack", "prompts"),
+    inProjectInstructions: path2.join(opts.projectRoot, ".wrongstack", "instructions"),
+    inProjectDesignKits: path2.join(opts.projectRoot, ".wrongstack", "design-kits"),
+    inProjectWorktrees: path2.join(opts.projectRoot, ".wrongstack", "worktrees"),
+    projectHash: hash,
+    projectSlug: slug,
+    projectGoal: path2.join(projectDir, "goal.json"),
+    projectInputHistory: path2.join(projectDir, "input-history.json"),
+    projectSpecs: path2.join(projectDir, "specs"),
+    projectTaskGraphs: path2.join(projectDir, "task-graphs"),
+    projectSddSession: path2.join(projectDir, "sdd-session.json"),
+    projectPlan: path2.join(projectDir, "plan.json"),
+    projectAutophase: path2.join(projectDir, "autophase"),
+    projectSddBoards: path2.join(projectDir, "sdd-boards"),
+    syncConfig: path2.join(profileDir, "sync.json"),
+    configHistoryDir: path2.join(globalRoot, "config-history"),
+    projectStatus: (projectHash2) => path2.join(globalRoot, "projects", projectHash2, "status.json")
+  };
 }
 
 // src/utils/instruction-file.ts
-import { readFileSync, statSync } from "node:fs";
-import * as path2 from "node:path";
+import { readFileSync as readFileSync2, statSync as statSync2 } from "node:fs";
+import * as path3 from "node:path";
 import { fileURLToPath } from "node:url";
 var textCache = /* @__PURE__ */ new Map();
 var rootCandidates;
@@ -748,7 +977,7 @@ function readBundledInstructionText(relativePath) {
   let resolved = "";
   for (const root of instructionRootCandidates()) {
     try {
-      resolved = readFileSync(path2.join(root, relativePath), "utf8").trimEnd();
+      resolved = readFileSync2(path3.join(root, relativePath), "utf8").trimEnd();
       break;
     } catch {
     }
@@ -764,18 +993,18 @@ function renderInstructionTemplate(template, values) {
 }
 function instructionRootCandidates() {
   if (rootCandidates !== void 0) return rootCandidates;
-  const here = path2.dirname(fileURLToPath(import.meta.url));
+  const here = path3.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    path2.resolve(here, "../../instructions"),
-    path2.resolve(here, "../instructions"),
-    path2.resolve(here, "instructions")
+    path3.resolve(here, "../../instructions"),
+    path3.resolve(here, "../instructions"),
+    path3.resolve(here, "instructions")
   ];
   rootCandidates = candidates.sort((a, b) => Number(!isDirectory(a)) - Number(!isDirectory(b)));
   return rootCandidates;
 }
 function isDirectory(candidate) {
   try {
-    return statSync(candidate).isDirectory();
+    return statSync2(candidate).isDirectory();
   } catch {
     return false;
   }
@@ -875,14 +1104,14 @@ function safeParse(input, maxBytes = 5e6) {
 }
 
 // src/utils/session-scoped-path.ts
-import * as path3 from "node:path";
+import * as path4 from "node:path";
 function sessionScopedPath(dir, sessionId, suffix) {
   if (!sessionId || sessionId.includes("\\") || sessionId.includes("..")) {
     throw invalid(sessionId);
   }
-  const resolved = path3.resolve(dir, `${sessionId}${suffix}`);
-  const rel = path3.relative(path3.resolve(dir), resolved);
-  if (rel.startsWith("..") || path3.isAbsolute(rel)) {
+  const resolved = path4.resolve(dir, `${sessionId}${suffix}`);
+  const rel = path4.relative(path4.resolve(dir), resolved);
+  if (rel.startsWith("..") || path4.isAbsolute(rel)) {
     throw invalid(sessionId);
   }
   return resolved;
@@ -897,144 +1126,33 @@ function invalid(sessionId) {
 }
 
 // src/utils/slug.ts
-function slugify(name, fallback = "prompt", maxLen = 64) {
+function slugify2(name, fallback = "prompt", maxLen = 64) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, maxLen).replace(/-+$/g, "") || fallback;
 }
 
-// src/utils/wstack-paths.ts
-import { createHash } from "node:crypto";
-import * as fs2 from "node:fs";
-import * as os from "node:os";
-import * as path4 from "node:path";
-function canonicalProjectRoot(absRoot) {
-  const checkoutRoot = path4.resolve(absRoot);
-  const dotGit = path4.join(checkoutRoot, ".git");
-  try {
-    if (!fs2.statSync(dotGit).isFile()) return checkoutRoot;
-    const gitDirLine = fs2.readFileSync(dotGit, "utf8").trim();
-    const match = /^gitdir:\s*(.+)$/i.exec(gitDirLine);
-    if (!match?.[1]) return checkoutRoot;
-    const gitDir = path4.resolve(checkoutRoot, match[1].trim());
-    const commonDirFile = path4.join(gitDir, "commondir");
-    if (!fs2.statSync(commonDirFile).isFile()) return checkoutRoot;
-    const commonDir = path4.resolve(gitDir, fs2.readFileSync(commonDirFile, "utf8").trim());
-    if (path4.basename(commonDir).toLowerCase() !== ".git") return checkoutRoot;
-    return path4.dirname(commonDir);
-  } catch {
-    return checkoutRoot;
+// src/storage/file-session-writer.ts
+import { closeSync, createReadStream, fsyncSync, openSync, writeSync } from "node:fs";
+import * as fsp2 from "node:fs/promises";
+import * as path5 from "node:path";
+import { createInterface } from "node:readline";
+
+// src/storage/session-workspace-checkpoints.ts
+function requiredCheckpointCas(checkpointCas, operation) {
+  if (!checkpointCas) {
+    throw new Error(`Workspace checkpoint ${operation} requires a projectRoot-aware session store`);
   }
+  return checkpointCas;
 }
-function projectHash(absRoot) {
-  return createHash("sha256").update(canonicalProjectRoot(absRoot)).digest("hex").slice(0, 12);
-}
-function projectSlug(absRoot) {
-  const identityRoot = canonicalProjectRoot(absRoot);
-  const base = slugify2(path4.basename(identityRoot));
-  const hash = createHash("sha256").update(identityRoot).digest("hex").slice(0, 6);
-  return `${base}-${hash}`;
-}
-function slugify2(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
+function captureCheckpoint(checkpointCas, sessionId, promptIndex) {
+  return requiredCheckpointCas(checkpointCas, "capture").capture(sessionId, promptIndex);
 }
-function safeProfileName(name) {
-  const safe = (name ?? "").replace(/[/\\:]/g, "_").replace(/\.\./g, "_").trim();
-  return safe || "default";
-}
-function activeProfileName(globalRoot) {
-  try {
-    const parsed = JSON.parse(fs2.readFileSync(path4.join(globalRoot, "config.json"), "utf8"));
-    return safeProfileName(typeof parsed.activeProfile === "string" ? parsed.activeProfile : void 0);
-  } catch {
-    return "default";
-  }
-}
-function wstackGlobalRoot() {
-  const fromEnv = process.env["WRONGSTACK_HOME"];
-  if (fromEnv && fromEnv.trim().length > 0) return path4.resolve(fromEnv);
-  return path4.join(os.homedir(), ".wrongstack");
-}
-function resolveWstackPaths(opts) {
-  const globalRoot = opts.globalRoot ?? (opts.userHome ? path4.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
-  const homeDir = opts.userHome ?? os.homedir();
-  const profileName = safeProfileName(opts.profileName ?? activeProfileName(globalRoot));
-  const profileDir = path4.join(globalRoot, "profiles", profileName);
-  const hash = projectHash(opts.projectRoot);
-  const slug = projectSlug(opts.projectRoot);
-  const projectDir = path4.join(globalRoot, "projects", slug);
-  return {
-    globalRoot,
-    profileName,
-    profileDir,
-    projectRoot: opts.projectRoot,
-    homeDir,
-    configDir: profileDir,
-    globalConfig: path4.join(globalRoot, "config.json"),
-    profilesDir: path4.join(globalRoot, "profiles"),
-    profileConfig: (name) => {
-      return path4.join(globalRoot, "profiles", safeProfileName(name), "config.json");
-    },
-    profileStatuslineConfig: (name) => {
-      return path4.join(globalRoot, "profiles", safeProfileName(name), "statusline.json");
-    },
-    profileModeConfig: (name) => {
-      return path4.join(globalRoot, "profiles", safeProfileName(name), "mode.json");
-    },
-    profileProviderStatus: (name) => {
-      return path4.join(globalRoot, "profiles", safeProfileName(name), "provider-status.json");
-    },
-    profileUpdateCache: (name) => {
-      return path4.join(globalRoot, "profiles", safeProfileName(name), "update-cache.json");
-    },
-    secretsKey: path4.join(globalRoot, ".key"),
-    globalMemory: path4.join(profileDir, "memory.md"),
-    globalSkills: path4.join(profileDir, "skills"),
-    globalClaudeSkills: path4.join(homeDir, ".claude", "skills"),
-    globalDesignKits: path4.join(profileDir, "design-kits"),
-    globalPrompts: path4.join(profileDir, "prompts"),
-    globalInstructions: path4.join(profileDir, "instructions"),
-    promptUsage: path4.join(profileDir, "prompt-usage.json"),
-    cacheDir: path4.join(globalRoot, "cache"),
-    modelsCache: path4.join(globalRoot, "cache", "models.dev.json"),
-    modelsOverlayCache: path4.join(globalRoot, "cache", "models-overlay.json"),
-    historyFile: path4.join(profileDir, "history"),
-    logFile: path4.join(globalRoot, "logs", "wrongstack.log"),
-    projectDir,
-    projectCodebaseIndex: path4.join(projectDir, "codebase-index"),
-    projectMemory: path4.join(projectDir, "memory.md"),
-    projectSessions: path4.join(projectDir, "sessions"),
-    projectTrust: path4.join(projectDir, "trust.json"),
-    projectMeta: path4.join(projectDir, "meta.json"),
-    projectLocalConfig: path4.join(projectDir, "config.local.json"),
-    inProjectConfig: path4.join(opts.projectRoot, ".wrongstack", "config.json"),
-    inProjectAgentsFile: path4.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
-    inProjectSkills: path4.join(opts.projectRoot, ".wrongstack", "skills"),
-    inProjectClaudeSkills: path4.join(opts.projectRoot, ".claude", "skills"),
-    inProjectPrompts: path4.join(opts.projectRoot, ".wrongstack", "prompts"),
-    inProjectInstructions: path4.join(opts.projectRoot, ".wrongstack", "instructions"),
-    inProjectDesignKits: path4.join(opts.projectRoot, ".wrongstack", "design-kits"),
-    inProjectWorktrees: path4.join(opts.projectRoot, ".wrongstack", "worktrees"),
-    projectHash: hash,
-    projectSlug: slug,
-    projectGoal: path4.join(projectDir, "goal.json"),
-    projectInputHistory: path4.join(projectDir, "input-history.json"),
-    projectSpecs: path4.join(projectDir, "specs"),
-    projectTaskGraphs: path4.join(projectDir, "task-graphs"),
-    projectSddSession: path4.join(projectDir, "sdd-session.json"),
-    projectPlan: path4.join(projectDir, "plan.json"),
-    projectAutophase: path4.join(projectDir, "autophase"),
-    projectSddBoards: path4.join(projectDir, "sdd-boards"),
-    syncConfig: path4.join(profileDir, "sync.json"),
-    configHistoryDir: path4.join(globalRoot, "config-history"),
-    projectStatus: (projectHash2) => path4.join(globalRoot, "projects", projectHash2, "status.json")
-  };
+function materializeCheckpoint(checkpointCas, checkpoint, targetRoot) {
+  return requiredCheckpointCas(checkpointCas, "materialization").materialize(
+    checkpoint,
+    targetRoot
+  );
 }
 
-// src/storage/file-session-writer.ts
-import { closeSync, createReadStream, fsyncSync, openSync, writeSync } from "node:fs";
-import * as fsp2 from "node:fs/promises";
-import * as path5 from "node:path";
-import { createInterface } from "node:readline";
-
 // src/storage/session-helpers.ts
 function consumeControlString(value, start) {
   let index = start;
@@ -1259,6 +1377,16 @@ function scrubSessionWriterEvent(event, secretScrubber) {
   if (event.type === "llm_response") {
     return { ...event, content: secretScrubber.scrubObject(event.content) };
   }
+  if (event.type === "file_snapshot") {
+    return {
+      ...event,
+      files: event.files.map((f) => ({
+        ...f,
+        before: f.before !== null ? secretScrubber.scrub(f.before) : null,
+        after: f.after !== null ? secretScrubber.scrub(f.after) : null
+      }))
+    };
+  }
   return event;
 }
 
@@ -1275,6 +1403,8 @@ var FileSessionWriter = class _FileSessionWriter {
     this.filePath = opts.filePath ?? "";
     this.secretScrubber = opts.secretScrubber;
     this.checkpointCas = opts.checkpointCas;
+    this._onAppend = opts.onAppend;
+    this._onAppendBatch = opts.onAppendBatch;
     this.onCloseCb = opts.onClose;
     this.resolveNameCb = opts.resolveName;
     this.summary = opts.initialSummary ? { ...opts.initialSummary, id } : {
@@ -1330,12 +1460,44 @@ var FileSessionWriter = class _FileSessionWriter {
   lastAppendWarnAt = 0;
   secretScrubber;
   checkpointCas;
+  /** Mutable slot for onAppend callback — constructor opts seed it, setOnAppend replaces it. */
+  _onAppend;
+  /** Implements SessionWriter.onAppend — public getter/setter for direct property access. */
+  get onAppend() {
+    return this._onAppend;
+  }
+  set onAppend(cb) {
+    this._onAppend = cb;
+  }
+  /** Mutable slot for onAppendBatch callback. */
+  _onAppendBatch;
+  /** Implements SessionWriter.onAppendBatch — public getter/setter for direct property access. */
+  get onAppendBatch() {
+    return this._onAppendBatch;
+  }
+  set onAppendBatch(cb) {
+    this._onAppendBatch = cb;
+  }
   onCloseCb;
   resolveNameCb;
   /** Implements SessionWriter.traceId — propagated from ContextInit.traceId. */
   traceId;
   // ── Write buffer — batches events to reduce per-event disk I/O ──────────────
   //
+  /**
+   * Set or replace the onAppend callback. Used by telemetry bridges that
+   * receive the writer as an already-constructed dependency.
+   */
+  setOnAppend(cb) {
+    this._onAppend = cb;
+  }
+  /**
+   * Set or replace the onAppendBatch callback.
+   */
+  setOnAppendBatch(cb) {
+    this._onAppendBatch = cb;
+  }
+  //
   // Every append() pushes the scrubbed event into an in-memory buffer instead
   // of calling handle.appendFile() synchronously. The buffer flushes to disk
   // when it reaches FLUSH_SIZE events OR after FLUSH_INTERVAL_MS of inactivity.
@@ -1442,7 +1604,12 @@ var FileSessionWriter = class _FileSessionWriter {
     if (this.closed) return;
     void this.ensureInit();
     this.observeForSummary(event);
-    this.pushWriteBuffer(event);
+    const appendEvent = event.type === "file_snapshot" ? scrubSessionWriterEvent(event, this.secretScrubber) : event;
+    try {
+      this._onAppend?.(appendEvent);
+    } catch {
+    }
+    this.pushWriteBuffer(appendEvent);
     if (this.writeBuffer.length >= _FileSessionWriter.FLUSH_SIZE) {
       if (this.flushTimer) {
         clearTimeout(this.flushTimer);
@@ -1524,6 +1691,10 @@ var FileSessionWriter = class _FileSessionWriter {
     await this.ensureInit();
     const scrubbed = scrubSessionWriterEvent(event, this.secretScrubber);
     this.observeForSummary(scrubbed);
+    try {
+      this._onAppend?.(scrubbed);
+    } catch {
+    }
     this.pushWriteBuffer(scrubbed);
     if (this.writeBuffer.length >= _FileSessionWriter.FLUSH_SIZE) {
       if (this.flushTimer) {
@@ -1539,11 +1710,22 @@ var FileSessionWriter = class _FileSessionWriter {
   async appendBatch(events) {
     if (this.closed || events.length === 0) return;
     await this.ensureInit();
+    const scrubbedBatch = [];
     for (const event of events) {
       const scrubbed = scrubSessionWriterEvent(event, this.secretScrubber);
       this.observeForSummary(scrubbed);
+      try {
+        this._onAppend?.(scrubbed);
+      } catch {
+      }
       this.pushWriteBuffer(scrubbed);
+      scrubbedBatch.push(scrubbed);
+    }
+    try {
+      this._onAppendBatch?.(scrubbedBatch);
+    } catch {
     }
+    ;
     if (this.writeBuffer.length >= _FileSessionWriter.FLUSH_SIZE) {
       if (this.flushTimer) {
         clearTimeout(this.flushTimer);
@@ -1946,7 +2128,8 @@ var FileSessionWriter = class _FileSessionWriter {
       promptIndex,
       promptPreview,
       ts: (/* @__PURE__ */ new Date()).toISOString(),
-      fileCount
+      fileCount,
+      ...workspaceCheckpoint ? { workspaceCheckpoint } : {}
     });
   }
   async writeFileSnapshot(promptIndex, files) {
@@ -2052,6 +2235,10 @@ var FileSessionWriter = class _FileSessionWriter {
     this.activePromptIndex = null;
     this.pendingFileSnapshots = [];
     this.pendingFileSnapshotBytes = 0;
+    this.appendFailCount = 0;
+    this.lastAppendWarnAt = 0;
+    this.bufferOverflowCount = 0;
+    this.lastBufferOverflowWarnAt = 0;
   }
   /**
    * Write an in-flight marker. The agent loop should call
@@ -2188,8 +2375,8 @@ var SessionCheckpointCas = class {
           return null;
         }
         try {
-          const stat16 = await fsp3.lstat(absolute);
-          if (stat16.isSymbolicLink()) {
+          const stat15 = await fsp3.lstat(absolute);
+          if (stat15.isSymbolicLink()) {
             const linkTarget = await fsp3.readlink(absolute);
             const resolvedLink = path6.resolve(path6.dirname(absolute), linkTarget);
             if (path6.isAbsolute(linkTarget) || !isInside(this.projectRoot, resolvedLink)) {
@@ -2201,29 +2388,29 @@ var SessionCheckpointCas = class {
             }
             return { path: relative8, state: "symlink", linkTarget };
           }
-          if (!stat16.isFile()) {
+          if (!stat15.isFile()) {
             unresolved.push({ path: relative8, reason: "changed path is not a regular file" });
             return null;
           }
-          if (stat16.size > MAX_BLOB_BYTES) {
+          if (stat15.size > MAX_BLOB_BYTES) {
             unresolved.push({
               path: relative8,
               reason: `file exceeds ${MAX_BLOB_BYTES}-byte checkpoint blob limit`
             });
             return null;
           }
-          if (scheduledBytes + stat16.size > MAX_CHECKPOINT_BYTES) {
+          if (scheduledBytes + stat15.size > MAX_CHECKPOINT_BYTES) {
             unresolved.push({
               path: relative8,
               reason: `checkpoint exceeds ${MAX_CHECKPOINT_BYTES}-byte aggregate blob limit`
             });
             return null;
           }
-          scheduledBytes += stat16.size;
+          scheduledBytes += stat15.size;
           const content = await fsp3.readFile(absolute);
           const blobHash = sha256(content);
           await this.putBlob(blobHash, content);
-          return { path: relative8, state: "file", blobHash, mode: stat16.mode & 511 };
+          return { path: relative8, state: "file", blobHash, mode: stat15.mode & 511 };
         } catch (err) {
           if (err.code === "ENOENT") {
             return { path: relative8, state: "absent" };
@@ -2612,11 +2799,11 @@ async function validateOne(observation, lexicalRoot, realRoot) {
     };
   }
   try {
-    const stat16 = await fsp4.stat(realFile);
-    if (!stat16.isFile()) {
+    const stat15 = await fsp4.stat(realFile);
+    if (!stat15.isFile()) {
       return { ...base, status: "unreadable", detail: "Path is no longer a regular file." };
     }
-    if (stat16.size > MAX_REVALIDATE_BYTES) {
+    if (stat15.size > MAX_REVALIDATE_BYTES) {
       return {
         ...base,
         status: "unreadable",
@@ -2674,57 +2861,82 @@ function formatInterruptedToolNotice(pendingToolUseCount) {
   ].join("\n");
 }
 
-// src/storage/session-store/index-reader.ts
+// src/storage/session-store/delete-session-artifacts.ts
 import * as fsp5 from "node:fs/promises";
-function applySessionIndexLines(raw, byId, deleted) {
-  for (const line of raw.split("\n")) {
-    if (!line.trim()) continue;
-    try {
-      const entry = JSON.parse(line);
-      if (entry.action === "delete" && entry.id) {
-        deleted.add(entry.id);
-        byId.delete(entry.id);
-        continue;
-      }
-      if (entry.id && !deleted.has(entry.id)) {
-        byId.set(entry.id, entry);
-      }
-    } catch {
+import * as path10 from "node:path";
+
+// src/storage/session-store/paths.ts
+import * as path9 from "node:path";
+function sessionPath(storeDir, id, ext) {
+  return sessionScopedPath(storeDir, id, ext);
+}
+function shardManifestPath(storeDir, shardKey) {
+  return shardKey ? path9.join(storeDir, shardKey, "_manifest.json") : path9.join(storeDir, "_manifest.json");
+}
+function shardKeyForSessionId(id) {
+  const dirName = path9.dirname(id);
+  return dirName === "." ? "" : dirName;
+}
+async function ensureShardDir(storeDir, id) {
+  const dirPath = path9.dirname(sessionScopedPath(storeDir, id, ""));
+  await ensureDir(dirPath);
+  return dirPath;
+}
+
+// src/storage/session-store/delete-session-artifacts.ts
+async function deleteSessionArtifacts({
+  rootDir,
+  id,
+  jsonlPath
+}) {
+  const shardDir = path10.dirname(jsonlPath);
+  const base = path10.basename(id);
+  const sessDir = path10.join(shardDir, base);
+  const deletions = [
+    fsp5.unlink(jsonlPath),
+    fsp5.unlink(sessionPath(rootDir, id, ".summary.json")),
+    fsp5.unlink(sessionPath(rootDir, id, ".plan.json")),
+    fsp5.unlink(sessionPath(rootDir, id, ".tasks.json")),
+    fsp5.unlink(sessionPath(rootDir, id, ".todos.json"))
+  ];
+  const results = await Promise.allSettled(deletions);
+  for (const result of results) {
+    if (result.status === "rejected") {
+      warnDeleteFailure(id, result.reason);
     }
   }
+  await fsp5.rm(sessDir, { recursive: true, force: true }).catch((err) => {
+    console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "session_store.rmdir_failed",
+        sessionId: id,
+        message: toErrorMessage(err),
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+  });
 }
-async function readFileRange(file, start, end) {
-  const length = end - start;
-  if (length <= 0) return { raw: "", end: start };
-  const buffer = Buffer.allocUnsafe(length);
-  let offset = 0;
-  let handle;
-  try {
-    handle = await fsp5.open(file, "r");
-    while (offset < length) {
-      const { bytesRead } = await handle.read(buffer, offset, length - offset, start + offset);
-      if (bytesRead === 0) return null;
-      offset += bytesRead;
-    }
-    let completeLength = buffer.length;
-    if (buffer.at(-1) !== 10) {
-      const lastNewline = buffer.lastIndexOf(10);
-      const trailing = buffer.subarray(lastNewline + 1).toString("utf8").trim();
-      try {
-        if (trailing) JSON.parse(trailing);
-        else completeLength = lastNewline + 1;
-      } catch {
-        completeLength = lastNewline + 1;
-      }
-    }
-    return {
-      raw: buffer.subarray(0, completeLength).toString("utf8"),
-      end: start + completeLength
-    };
-  } catch {
-    return null;
-  } finally {
-    await handle?.close().catch(() => void 0);
+function warnDeleteFailure(id, reason) {
+  const msg = reason instanceof Error ? reason.message : String(reason);
+  if (reason?.code === "ENOENT") return;
+  console.warn(
+    JSON.stringify({
+      level: "warn",
+      event: "session_store.delete_failed",
+      sessionId: id,
+      message: msg,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    })
+  );
+}
+
+// src/storage/session-store/delete-session-guards.ts
+async function assertSessionCanBeDeleted(sessionId, isSessionInUse) {
+  if (!isSessionInUse) return;
+  const reason = await isSessionInUse(sessionId);
+  if (reason) {
+    throw new Error(`Session ${sessionId} is in use (${reason}) and cannot be deleted.`);
   }
 }
 
@@ -2738,7 +2950,7 @@ function isSessionJsonlFileName(name) {
 
 // src/storage/session-store/directory-session-files.ts
 import * as fsp6 from "node:fs/promises";
-import * as path9 from "node:path";
+import * as path11 from "node:path";
 function sessionIdForFile(prefix, name) {
   const base = name.replace(/\.jsonl$/, "");
   return prefix ? `${prefix}/${base}` : base;
@@ -2760,12 +2972,12 @@ async function collectSessionFiles(dir, prefix = "", depth = 0) {
     if (entry.isDirectory()) {
       dirEntries.push(entry);
     } else if (entry.isFile() && isSessionJsonlFileName(entry.name)) {
-      files.push({ id: sessionIdForFile(prefix, entry.name), filePath: path9.join(dir, entry.name) });
+      files.push({ id: sessionIdForFile(prefix, entry.name), filePath: path11.join(dir, entry.name) });
     }
   }
   const childFileArrays = await Promise.all(
     dirEntries.map(
-      (entry) => collectSessionFiles(path9.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
+      (entry) => collectSessionFiles(path11.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
     )
   );
   return [...childFileArrays.flat(), ...files];
@@ -2789,230 +3001,55 @@ async function collectSessionIds(dir, prefix = "", depth = 0) {
   }
   const childIdArrays = await Promise.all(
     dirEntries.map(
-      (entry) => collectSessionIds(path9.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
+      (entry) => collectSessionIds(path11.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
     )
   );
   return [...childIdArrays.flat(), ...fileIds];
 }
 
-// src/storage/session-store/delete-session-artifacts.ts
-import * as fsp7 from "node:fs/promises";
-import * as path11 from "node:path";
-
-// src/storage/session-store/paths.ts
-import * as path10 from "node:path";
-function sessionPath(storeDir, id, ext) {
-  return sessionScopedPath(storeDir, id, ext);
-}
-function shardManifestPath(storeDir, shardKey) {
-  return shardKey ? path10.join(storeDir, shardKey, "_manifest.json") : path10.join(storeDir, "_manifest.json");
+// src/storage/session-store/events.ts
+function emitSessionStoreRead(events, sessionId, filePath, operation, outcome, durationMs, error) {
+  events?.emit("storage.read", {
+    sessionId,
+    store: "session",
+    filePath,
+    operation,
+    outcome,
+    durationMs,
+    ...error !== void 0 ? { error } : {}
+  });
 }
-function shardKeyForSessionId(id) {
-  const dirName = path10.dirname(id);
-  return dirName === "." ? "" : dirName;
+function emitSessionStoreWrite(events, sessionId, filePath, operation, outcome, durationMs, eventCount, error) {
+  events?.emit("storage.write", {
+    sessionId,
+    store: "session",
+    filePath,
+    operation,
+    outcome,
+    durationMs,
+    ...eventCount !== void 0 ? { eventCount } : {},
+    ...error !== void 0 ? { error } : {}
+  });
 }
-async function ensureShardDir(storeDir, id) {
-  const dirPath = path10.dirname(sessionScopedPath(storeDir, id, ""));
-  await ensureDir(dirPath);
-  return dirPath;
+function emitSessionStoreError(events, sessionId, filePath, operation, error, recoverable) {
+  events?.emit("storage.error", {
+    sessionId,
+    store: "session",
+    filePath,
+    operation,
+    error,
+    recoverable
+  });
 }
 
-// src/storage/session-store/delete-session-artifacts.ts
-async function deleteSessionArtifacts({
-  rootDir,
-  id,
-  jsonlPath
-}) {
-  const shardDir = path11.dirname(jsonlPath);
-  const base = path11.basename(id);
-  const sessDir = path11.join(shardDir, base);
-  const deletions = [
-    fsp7.unlink(jsonlPath),
-    fsp7.unlink(sessionPath(rootDir, id, ".summary.json")),
-    fsp7.unlink(sessionPath(rootDir, id, ".plan.json")),
-    fsp7.unlink(sessionPath(rootDir, id, ".tasks.json")),
-    fsp7.unlink(sessionPath(rootDir, id, ".todos.json"))
-  ];
-  const results = await Promise.allSettled(deletions);
-  for (const result of results) {
-    if (result.status === "rejected") {
-      warnDeleteFailure(id, result.reason);
-    }
-  }
-  await fsp7.rm(sessDir, { recursive: true, force: true }).catch((err) => {
-    console.warn(
-      JSON.stringify({
-        level: "warn",
-        event: "session_store.rmdir_failed",
-        sessionId: id,
-        message: toErrorMessage(err),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })
-    );
-  });
-}
-function warnDeleteFailure(id, reason) {
-  const msg = reason instanceof Error ? reason.message : String(reason);
-  if (reason?.code === "ENOENT") return;
-  console.warn(
-    JSON.stringify({
-      level: "warn",
-      event: "session_store.delete_failed",
-      sessionId: id,
-      message: msg,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    })
-  );
-}
-
-// src/storage/session-store/delete-session-guards.ts
-async function assertSessionCanBeDeleted(sessionId, isSessionInUse) {
-  if (!isSessionInUse) return;
-  const reason = await isSessionInUse(sessionId);
-  if (reason) {
-    throw new Error(`Session ${sessionId} is in use (${reason}) and cannot be deleted.`);
-  }
-}
-
-// src/storage/session-store/load-cache.ts
-var LOAD_CACHE_MAX_ENTRIES = 50;
-var LOAD_CACHE_MAX_BYTES = 64 * 1024 * 1024;
-var SessionLoadCache = class {
-  constructor(entries = /* @__PURE__ */ new Map()) {
-    this.entries = entries;
-  }
-  entries;
-  bytes = 0;
-  clear(sessionId) {
-    if (sessionId !== void 0) {
-      this.delete(sessionId);
-      return;
-    }
-    this.entries.clear();
-    this.bytes = 0;
-  }
-  getFresh(id, stat16, full) {
-    const cached = this.entries.get(id);
-    if (!cached || cached.mtimeMs !== stat16.mtimeMs || cached.size !== stat16.size) {
-      return null;
-    }
-    this.entries.delete(id);
-    this.entries.set(id, cached);
-    if (full) return cached.data;
-    return { ...cached.data, messages: [] };
-  }
-  set(id, stat16, data) {
-    this.delete(id);
-    while (stat16.size <= LOAD_CACHE_MAX_BYTES && (this.entries.size >= LOAD_CACHE_MAX_ENTRIES || this.bytes + stat16.size > LOAD_CACHE_MAX_BYTES)) {
-      const oldest = this.entries.keys().next().value;
-      if (oldest === void 0) break;
-      this.delete(oldest);
-    }
-    if (stat16.size <= LOAD_CACHE_MAX_BYTES) {
-      this.entries.set(id, { mtimeMs: stat16.mtimeMs, size: stat16.size, data });
-      this.bytes += stat16.size;
-    }
-  }
-  delete(sessionId) {
-    const cached = this.entries.get(sessionId);
-    if (cached) this.bytes = Math.max(0, this.bytes - cached.size);
-    this.entries.delete(sessionId);
-  }
-};
-
-// src/storage/session-store/prune-helpers.ts
-import * as fsp8 from "node:fs/promises";
-import * as path12 from "node:path";
-function isPrunableSessionJsonl(name) {
-  return name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
-}
-async function pruneSessionFiles(storeDir, maxAgeDays, deleteSession) {
-  const cutoff = Date.now() - maxAgeDays * 864e5;
-  let deleted = 0;
-  const pruneFile = async (dir, name, prefix) => {
-    const jsonlPath = path12.join(dir, name);
-    try {
-      const stat16 = await fsp8.stat(jsonlPath);
-      if (stat16.mtimeMs >= cutoff) return;
-    } catch {
-      return;
-    }
-    const base = name.replace(/\.jsonl$/, "");
-    const id = prefix ? `${prefix}/${base}` : base;
-    await deleteSession(id);
-    deleted++;
-  };
-  const entries = await fsp8.readdir(storeDir, { withFileTypes: true }).catch(() => []);
-  for (const entry of entries) {
-    if (entry.isFile()) {
-      if (isPrunableSessionJsonl(entry.name)) await pruneFile(storeDir, entry.name, "");
-      continue;
-    }
-    if (!entry.isDirectory()) continue;
-    const dateDir = path12.join(storeDir, entry.name);
-    const files = await fsp8.readdir(dateDir, { withFileTypes: true }).catch(() => []);
-    for (const file of files) {
-      if (!file.isFile() || !isPrunableSessionJsonl(file.name)) continue;
-      await pruneFile(dateDir, file.name, entry.name);
-    }
-  }
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const dateDir = path12.join(storeDir, entry.name);
-    try {
-      const remaining = await fsp8.readdir(dateDir);
-      if (remaining.length === 0) {
-        await fsp8.rmdir(dateDir).catch(() => void 0);
-      }
-    } catch {
-    }
-  }
-  return deleted;
-}
-
-// src/storage/session-store/events.ts
-function emitSessionStoreRead(events, sessionId, filePath, operation, outcome, durationMs, error) {
-  events?.emit("storage.read", {
-    sessionId,
-    store: "session",
-    filePath,
-    operation,
-    outcome,
-    durationMs,
-    ...error !== void 0 ? { error } : {}
-  });
-}
-function emitSessionStoreWrite(events, sessionId, filePath, operation, outcome, durationMs, eventCount, error) {
-  events?.emit("storage.write", {
-    sessionId,
-    store: "session",
-    filePath,
-    operation,
-    outcome,
-    durationMs,
-    ...eventCount !== void 0 ? { eventCount } : {},
-    ...error !== void 0 ? { error } : {}
-  });
-}
-function emitSessionStoreError(events, sessionId, filePath, operation, error, recoverable) {
-  events?.emit("storage.error", {
-    sessionId,
-    store: "session",
-    filePath,
-    operation,
-    error,
-    recoverable
-  });
-}
-
-// src/storage/session-store/fork-session.ts
-import { createHash as createHash4 } from "node:crypto";
-
-// src/storage/session-store/replay.ts
-function isReplayableMessage(value) {
-  if (!value || typeof value !== "object") return false;
-  const candidate = value;
-  return (candidate.role === "user" || candidate.role === "assistant" || candidate.role === "system") && (typeof candidate.content === "string" || Array.isArray(candidate.content));
+// src/storage/session-store/fork-session.ts
+import { createHash as createHash4 } from "node:crypto";
+
+// src/storage/session-store/replay.ts
+function isReplayableMessage(value) {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  return (candidate.role === "user" || candidate.role === "assistant" || candidate.role === "system") && (typeof candidate.content === "string" || Array.isArray(candidate.content));
 }
 function trackMessageToolState(message, openToolUses) {
   if (!Array.isArray(message.content)) return;
@@ -3119,6 +3156,106 @@ async function forkSession(host, id, opts = {}) {
   }
 }
 
+// src/storage/session-store/index-reader.ts
+import * as fsp7 from "node:fs/promises";
+function applySessionIndexLines(raw, byId, deleted) {
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const entry = JSON.parse(line);
+      if (entry.action === "delete" && entry.id) {
+        deleted.add(entry.id);
+        byId.delete(entry.id);
+        continue;
+      }
+      if (entry.id && !deleted.has(entry.id)) {
+        byId.set(entry.id, entry);
+      }
+    } catch {
+    }
+  }
+}
+async function readFileRange(file, start, end) {
+  const length = end - start;
+  if (length <= 0) return { raw: "", end: start };
+  const buffer = Buffer.allocUnsafe(length);
+  let offset = 0;
+  let handle;
+  try {
+    handle = await fsp7.open(file, "r");
+    while (offset < length) {
+      const { bytesRead } = await handle.read(buffer, offset, length - offset, start + offset);
+      if (bytesRead === 0) return null;
+      offset += bytesRead;
+    }
+    let completeLength = buffer.length;
+    if (buffer.at(-1) !== 10) {
+      const lastNewline = buffer.lastIndexOf(10);
+      const trailing = buffer.subarray(lastNewline + 1).toString("utf8").trim();
+      try {
+        if (trailing) JSON.parse(trailing);
+        else completeLength = lastNewline + 1;
+      } catch {
+        completeLength = lastNewline + 1;
+      }
+    }
+    return {
+      raw: buffer.subarray(0, completeLength).toString("utf8"),
+      end: start + completeLength
+    };
+  } catch {
+    return null;
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+
+// src/storage/session-store/load-cache.ts
+var LOAD_CACHE_MAX_ENTRIES = 50;
+var LOAD_CACHE_MAX_BYTES = 64 * 1024 * 1024;
+var SessionLoadCache = class {
+  constructor(entries = /* @__PURE__ */ new Map()) {
+    this.entries = entries;
+  }
+  entries;
+  bytes = 0;
+  clear(sessionId) {
+    if (sessionId !== void 0) {
+      this.delete(sessionId);
+      return;
+    }
+    this.entries.clear();
+    this.bytes = 0;
+  }
+  getFresh(id, stat15, full) {
+    const cached = this.entries.get(id);
+    if (!cached || cached.mtimeMs !== stat15.mtimeMs || cached.size !== stat15.size) {
+      return null;
+    }
+    this.entries.delete(id);
+    this.entries.set(id, cached);
+    if (full) return cached.data;
+    return { ...cached.data, messages: [] };
+  }
+  set(id, stat15, data) {
+    this.delete(id);
+    while (stat15.size <= LOAD_CACHE_MAX_BYTES && (this.entries.size >= LOAD_CACHE_MAX_ENTRIES || this.bytes + stat15.size > LOAD_CACHE_MAX_BYTES)) {
+      const oldest = this.entries.keys().next().value;
+      if (oldest === void 0) break;
+      this.delete(oldest);
+    }
+    if (stat15.size <= LOAD_CACHE_MAX_BYTES) {
+      this.entries.set(id, { mtimeMs: stat15.mtimeMs, size: stat15.size, data });
+      this.bytes += stat15.size;
+    }
+  }
+  delete(sessionId) {
+    const cached = this.entries.get(sessionId);
+    if (cached) this.bytes = Math.max(0, this.bytes - cached.size);
+    this.entries.delete(sessionId);
+  }
+};
+
 // src/storage/session-store/load-session-data.ts
 import { createReadStream as createReadStream2 } from "node:fs";
 import { createInterface as createInterface2 } from "node:readline";
@@ -3373,6 +3510,178 @@ function emitDamaged(params, detail) {
   });
 }
 
+// src/storage/session-store/prune-helpers.ts
+import * as fsp8 from "node:fs/promises";
+import * as path12 from "node:path";
+function isPrunableSessionJsonl(name) {
+  return name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
+}
+async function pruneSessionFiles(storeDir, maxAgeDays, deleteSession) {
+  const cutoff = Date.now() - maxAgeDays * 864e5;
+  let deleted = 0;
+  const pruneFile = async (dir, name, prefix) => {
+    const jsonlPath = path12.join(dir, name);
+    try {
+      const stat15 = await fsp8.stat(jsonlPath);
+      if (stat15.mtimeMs >= cutoff) return;
+    } catch {
+      return;
+    }
+    const base = name.replace(/\.jsonl$/, "");
+    const id = prefix ? `${prefix}/${base}` : base;
+    await deleteSession(id);
+    deleted++;
+  };
+  const entries = await fsp8.readdir(storeDir, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    if (entry.isFile()) {
+      if (isPrunableSessionJsonl(entry.name)) await pruneFile(storeDir, entry.name, "");
+      continue;
+    }
+    if (!entry.isDirectory()) continue;
+    const dateDir = path12.join(storeDir, entry.name);
+    const files = await fsp8.readdir(dateDir, { withFileTypes: true }).catch(() => []);
+    for (const file of files) {
+      if (!file.isFile() || !isPrunableSessionJsonl(file.name)) continue;
+      await pruneFile(dateDir, file.name, entry.name);
+    }
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const dateDir = path12.join(storeDir, entry.name);
+    try {
+      const remaining = await fsp8.readdir(dateDir);
+      if (remaining.length === 0) {
+        await fsp8.rmdir(dateDir).catch(() => void 0);
+      }
+    } catch {
+    }
+  }
+  return deleted;
+}
+
+// src/storage/session-store/search-events.ts
+import * as fsp9 from "node:fs/promises";
+async function searchSessionEvents(args) {
+  const { file, secretScrubber, predicate, limit, signal } = args;
+  const out = [];
+  let stat15;
+  try {
+    stat15 = await fsp9.stat(file);
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  if (stat15.size === 0) return [];
+  let fh;
+  try {
+    fh = await fsp9.open(file, "r");
+    const CHUNK = 64 * 1024;
+    const buf = Buffer.alloc(CHUNK);
+    let leftover = "";
+    let eventIndex = 0;
+    for (let position = 0; ; position += buf.byteLength) {
+      if (signal?.aborted) {
+        const reason = signal.reason ?? new DOMException("Aborted", "AbortError");
+        throw reason;
+      }
+      const { bytesRead } = await fh.read(buf, 0, CHUNK, position);
+      if (bytesRead === 0) break;
+      const text = leftover + buf.subarray(0, bytesRead).toString("utf8");
+      const parts = text.split("\n");
+      leftover = parts.pop() ?? "";
+      for (const line of parts) {
+        if (!line) continue;
+        const ev = parseSessionEventLine(line, secretScrubber);
+        if (!ev) continue;
+        if (predicate(ev, eventIndex, ev.ts)) {
+          out.push({ event: ev, eventIndex, ts: ev.ts });
+          if (limit !== void 0 && out.length >= limit) return out;
+        }
+        eventIndex++;
+      }
+    }
+    const trailing = parseSessionEventLine(leftover.trim() ? leftover : "", secretScrubber);
+    if (trailing && predicate(trailing, eventIndex, trailing.ts)) {
+      out.push({ event: trailing, eventIndex, ts: trailing.ts });
+    }
+    return out;
+  } finally {
+    if (fh) await fh.close().catch(() => void 0);
+  }
+}
+function parseSessionEventLine(line, secretScrubber) {
+  if (!line) return null;
+  try {
+    const parsed = JSON.parse(line);
+    if (parsed === null || typeof parsed !== "object" || typeof parsed.type !== "string" || typeof parsed.ts !== "string") {
+      return null;
+    }
+    return scrubPersistedSessionEvent(parsed, secretScrubber);
+  } catch {
+    return null;
+  }
+}
+
+// src/storage/session-store/shard-manifest.ts
+import * as fsp10 from "node:fs/promises";
+
+// src/storage/session-summary.ts
+function compareSessionSummaries(a, b) {
+  const aActivity = a.lastActivityAt ?? a.endedAt ?? a.startedAt;
+  const bActivity = b.lastActivityAt ?? b.endedAt ?? b.startedAt;
+  if (aActivity < bActivity) return 1;
+  if (aActivity > bActivity) return -1;
+  if (a.startedAt < b.startedAt) return 1;
+  if (a.startedAt > b.startedAt) return -1;
+  return a.id.localeCompare(b.id);
+}
+function matchesSessionFilter(summary, criteria) {
+  if (criteria.since && summary.startedAt < criteria.since) return false;
+  if (criteria.until && summary.startedAt > criteria.until) return false;
+  if (criteria.provider && summary.provider !== criteria.provider) return false;
+  if (criteria.model && summary.model !== criteria.model) return false;
+  if (criteria.minTokens !== void 0 && summary.tokenTotal < criteria.minTokens) return false;
+  if (criteria.titleContains) {
+    const needle = criteria.titleContains.toLocaleLowerCase();
+    if (!summary.title.toLocaleLowerCase().includes(needle)) return false;
+  }
+  return true;
+}
+
+// src/storage/session-store/shard-manifest.ts
+async function readOrBuildShardManifestEntry(opts) {
+  try {
+    const raw = await fsp10.readFile(opts.manifestPath, "utf8");
+    const parsed = JSON.parse(raw);
+    return {
+      summaries: Array.isArray(parsed.summaries) ? parsed.summaries : [],
+      ids: Array.isArray(parsed.ids) ? parsed.ids : []
+    };
+  } catch {
+  }
+  const refs = await opts.collectSessionFilesInShard(opts.shardKey);
+  const candidates = await mapWithConcurrency(
+    refs,
+    opts.concurrency,
+    async (ref) => {
+      const manifest = await opts.readSummaryManifest(ref.id);
+      if (manifest) return { summary: manifest, needsBackfill: false };
+      const summary = await opts.summaryHeaderFor(ref);
+      if (!summary) return null;
+      const hydrated = await opts.summaryFor(summary.id).catch(() => summary);
+      return { summary: hydrated, needsBackfill: false };
+    }
+  );
+  const summaries = candidates.filter((candidate) => candidate !== null).map((candidate) => candidate.summary);
+  summaries.sort(compareSessionSummaries);
+  const entry = { summaries, ids: summaries.map((summary) => summary.id) };
+  await atomicWrite(opts.manifestPath, JSON.stringify(entry), { mode: 384 }).catch(
+    () => void 0
+  );
+  return entry;
+}
+
 // src/storage/session-store/summary-builder.ts
 import { createReadStream as createReadStream3 } from "node:fs";
 import { createInterface as createInterface3 } from "node:readline";
@@ -3512,13 +3821,13 @@ async function* iterateSessionEvents(file, secretScrubber) {
 }
 
 // src/storage/session-store/summary-header.ts
-import * as fsp9 from "node:fs/promises";
+import * as fsp11 from "node:fs/promises";
 async function readSessionSummaryHeader(ref, secretScrubber) {
   let mtime = (/* @__PURE__ */ new Date(0)).toISOString();
   try {
-    const stat16 = await fsp9.stat(ref.filePath);
-    if (!stat16.isFile()) return damagedSummary(ref.id, stat16.mtime.toISOString());
-    mtime = stat16.mtime.toISOString();
+    const stat15 = await fsp11.stat(ref.filePath);
+    if (!stat15.isFile()) return damagedSummary(ref.id, stat15.mtime.toISOString());
+    mtime = stat15.mtime.toISOString();
   } catch {
     return null;
   }
@@ -3561,128 +3870,6 @@ function damagedSummary(id, startedAt) {
   };
 }
 
-// src/storage/session-store/shard-manifest.ts
-import * as fsp10 from "node:fs/promises";
-
-// src/storage/session-summary.ts
-function compareSessionSummaries(a, b) {
-  const aActivity = a.lastActivityAt ?? a.endedAt ?? a.startedAt;
-  const bActivity = b.lastActivityAt ?? b.endedAt ?? b.startedAt;
-  if (aActivity < bActivity) return 1;
-  if (aActivity > bActivity) return -1;
-  if (a.startedAt < b.startedAt) return 1;
-  if (a.startedAt > b.startedAt) return -1;
-  return a.id.localeCompare(b.id);
-}
-function matchesSessionFilter(summary, criteria) {
-  if (criteria.since && summary.startedAt < criteria.since) return false;
-  if (criteria.until && summary.startedAt > criteria.until) return false;
-  if (criteria.provider && summary.provider !== criteria.provider) return false;
-  if (criteria.model && summary.model !== criteria.model) return false;
-  if (criteria.minTokens !== void 0 && summary.tokenTotal < criteria.minTokens) return false;
-  if (criteria.titleContains) {
-    const needle = criteria.titleContains.toLocaleLowerCase();
-    if (!summary.title.toLocaleLowerCase().includes(needle)) return false;
-  }
-  return true;
-}
-
-// src/storage/session-store/shard-manifest.ts
-async function readOrBuildShardManifestEntry(opts) {
-  try {
-    const raw = await fsp10.readFile(opts.manifestPath, "utf8");
-    const parsed = JSON.parse(raw);
-    return {
-      summaries: Array.isArray(parsed.summaries) ? parsed.summaries : [],
-      ids: Array.isArray(parsed.ids) ? parsed.ids : []
-    };
-  } catch {
-  }
-  const refs = await opts.collectSessionFilesInShard(opts.shardKey);
-  const candidates = await mapWithConcurrency(
-    refs,
-    opts.concurrency,
-    async (ref) => {
-      const manifest = await opts.readSummaryManifest(ref.id);
-      if (manifest) return { summary: manifest, needsBackfill: false };
-      const summary = await opts.summaryHeaderFor(ref);
-      if (!summary) return null;
-      const hydrated = await opts.summaryFor(summary.id).catch(() => summary);
-      return { summary: hydrated, needsBackfill: false };
-    }
-  );
-  const summaries = candidates.filter((candidate) => candidate !== null).map((candidate) => candidate.summary);
-  summaries.sort(compareSessionSummaries);
-  const entry = { summaries, ids: summaries.map((summary) => summary.id) };
-  await atomicWrite(opts.manifestPath, JSON.stringify(entry), { mode: 384 }).catch(
-    () => void 0
-  );
-  return entry;
-}
-
-// src/storage/session-store/search-events.ts
-import * as fsp11 from "node:fs/promises";
-async function searchSessionEvents(args) {
-  const { file, secretScrubber, predicate, limit, signal } = args;
-  const out = [];
-  let stat16;
-  try {
-    stat16 = await fsp11.stat(file);
-  } catch (err) {
-    if (err.code === "ENOENT") return [];
-    throw err;
-  }
-  if (stat16.size === 0) return [];
-  let fh;
-  try {
-    fh = await fsp11.open(file, "r");
-    const CHUNK = 64 * 1024;
-    const buf = Buffer.alloc(CHUNK);
-    let leftover = "";
-    let eventIndex = 0;
-    for (let position = 0; ; position += buf.byteLength) {
-      if (signal?.aborted) {
-        const reason = signal.reason ?? new DOMException("Aborted", "AbortError");
-        throw reason;
-      }
-      const { bytesRead } = await fh.read(buf, 0, CHUNK, position);
-      if (bytesRead === 0) break;
-      const text = leftover + buf.subarray(0, bytesRead).toString("utf8");
-      const parts = text.split("\n");
-      leftover = parts.pop() ?? "";
-      for (const line of parts) {
-        if (!line) continue;
-        const ev = parseSessionEventLine(line, secretScrubber);
-        if (!ev) continue;
-        if (predicate(ev, eventIndex, ev.ts)) {
-          out.push({ event: ev, eventIndex, ts: ev.ts });
-          if (limit !== void 0 && out.length >= limit) return out;
-        }
-        eventIndex++;
-      }
-    }
-    const trailing = parseSessionEventLine(leftover.trim() ? leftover : "", secretScrubber);
-    if (trailing && predicate(trailing, eventIndex, trailing.ts)) {
-      out.push({ event: trailing, eventIndex, ts: trailing.ts });
-    }
-    return out;
-  } finally {
-    if (fh) await fh.close().catch(() => void 0);
-  }
-}
-function parseSessionEventLine(line, secretScrubber) {
-  if (!line) return null;
-  try {
-    const parsed = JSON.parse(line);
-    if (parsed === null || typeof parsed !== "object" || typeof parsed.type !== "string" || typeof parsed.ts !== "string") {
-      return null;
-    }
-    return scrubPersistedSessionEvent(parsed, secretScrubber);
-  } catch {
-    return null;
-  }
-}
-
 // src/storage/session-store.ts
 var DefaultSessionStore = class _DefaultSessionStore {
   dir;
@@ -3692,6 +3879,8 @@ var DefaultSessionStore = class _DefaultSessionStore {
   checkpointCas;
   isSessionInUse;
   logger;
+  onAppend;
+  onAppendBatch;
   /**
    * In-memory cache for load() results, keyed by session ID. The cache is
    * invalidated when the file's mtimeMs or size changes (indicating the
@@ -3718,6 +3907,8 @@ var DefaultSessionStore = class _DefaultSessionStore {
     this.secretScrubber = opts.secretScrubber ?? new DefaultSecretScrubber();
     this.isSessionInUse = opts.isSessionInUse;
     this.logger = opts.logger;
+    this.onAppend = opts.onAppend;
+    this.onAppendBatch = opts.onAppendBatch;
   }
   /**
    * Emit a structured warning. Uses the configured Logger when available;
@@ -3794,6 +3985,8 @@ var DefaultSessionStore = class _DefaultSessionStore {
         filePath: file,
         secretScrubber: this.secretScrubber,
         checkpointCas: this.checkpointCas,
+        onAppend: this.onAppend,
+        onAppendBatch: this.onAppendBatch,
         resolveName: async () => {
           const current = await this.readSummaryManifest(id);
           if (!current) return null;
@@ -3817,21 +4010,25 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async fork(id, opts = {}) {
     return forkSession(this, id, opts);
   }
+  /**
+   * Capture the deterministic post-tool workspace identity through the store-owned CAS.
+   */
+  async captureWorkspaceCheckpoint(sessionId, promptIndex) {
+    return captureCheckpoint(this.checkpointCas, sessionId, promptIndex);
+  }
+  /**
+   * Materialize a store-owned checkpoint into an already isolated workspace.
+   */
   async materializeWorkspaceCheckpoint(checkpoint, targetRoot) {
-    if (!this.checkpointCas) {
-      throw new Error(
-        "Workspace checkpoint materialization requires a projectRoot-aware session store"
-      );
-    }
-    return this.checkpointCas.materialize(checkpoint, targetRoot);
+    return materializeCheckpoint(this.checkpointCas, checkpoint, targetRoot);
   }
   async resolveId(query) {
     const normalized = query.trim();
     if (!normalized) throw new Error("Session not found: (empty query)");
     if (normalized) {
       try {
-        const stat16 = await fsp12.stat(this.sessionPath(normalized, ".jsonl"));
-        if (stat16.isFile()) return normalized;
+        const stat15 = await fsp12.stat(this.sessionPath(normalized, ".jsonl"));
+        if (stat15.isFile()) return normalized;
       } catch {
       }
     }
@@ -3908,9 +4105,12 @@ var DefaultSessionStore = class _DefaultSessionStore {
       handle = await fsp12.open(file, "a", 384);
     } catch (err) {
       emitSessionStoreError(this.events, canonicalId, file, "resume", toErrorMessage(err), false);
-      throw new Error(`Failed to open session "${canonicalId}" for append: ${toErrorMessage(err)}`, {
-        cause: err
-      });
+      throw new Error(
+        `Failed to open session "${canonicalId}" for append: ${toErrorMessage(err)}`,
+        {
+          cause: err
+        }
+      );
     }
     try {
       const writer = new FileSessionWriter(
@@ -3926,13 +4126,15 @@ var DefaultSessionStore = class _DefaultSessionStore {
         {
           resumed: true,
           initialSummary,
-          // Shard directory (sessions/<date>/) — must match create() so the
+          // Shard directory (sessions/<date>/) — must match create() so the
           // .summary.json sidecar lands next to the JSONL instead of the
           // sessions root (where summaryFor() would never find it).
           dir: path13.dirname(file),
           filePath: file,
           secretScrubber: this.secretScrubber,
           checkpointCas: this.checkpointCas,
+          onAppend: this.onAppend,
+          onAppendBatch: this.onAppendBatch,
           resolveName: async () => {
             const current = await this.readSummaryManifest(canonicalId);
             if (!current) return null;
@@ -3982,8 +4184,8 @@ var DefaultSessionStore = class _DefaultSessionStore {
     let cacheHit = false;
     try {
       const s = await fsp12.stat(file);
-      const stat16 = { mtimeMs: s.mtimeMs, size: s.size };
-      const cached = this.loadCache.getFresh(id, stat16, mode.full);
+      const stat15 = { mtimeMs: s.mtimeMs, size: s.size };
+      const cached = this.loadCache.getFresh(id, stat15, mode.full);
       if (cached) {
         cacheHit = true;
         return cached;
@@ -3996,7 +4198,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
         secretScrubber: this.secretScrubber
       });
       if (mode.full) {
-        this.loadCache.set(id, stat16, data);
+        this.loadCache.set(id, stat15, data);
       }
       return data;
     } catch (err) {
@@ -4105,7 +4307,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     await withFileLock(this.indexFile, async () => {
       await this.invalidateShardManifestBySessionId(summary.id);
       const line = JSON.stringify(summary) + "\n";
-      await fsp12.appendFile(this.indexFile, line, "utf8");
+      await fsp12.appendFile(this.indexFile, line, { encoding: "utf8", mode: SECRET_FILE_MODE });
       this._indexCache = null;
       this.indexAppendCount++;
       if (this.indexAppendCount >= _DefaultSessionStore.COMPACT_EVERY) {
@@ -4128,7 +4330,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
       await ensureDir(this.dir);
       await withFileLock(this.indexFile, async () => {
         const line = JSON.stringify({ action: "delete", id }) + "\n";
-        await fsp12.appendFile(this.indexFile, line, "utf8");
+        await fsp12.appendFile(this.indexFile, line, { encoding: "utf8", mode: SECRET_FILE_MODE });
         this._indexCache = null;
         await this.invalidateShardManifestBySessionId(id);
         this.indexAppendCount++;
@@ -4183,26 +4385,26 @@ var DefaultSessionStore = class _DefaultSessionStore {
    * Returns empty array when the index doesn't exist or is corrupt.
    */
   async readIndex() {
-    let stat16;
+    let stat15;
     try {
       const s = await fsp12.stat(this.indexFile);
-      stat16 = { mtimeMs: s.mtimeMs, size: s.size, ino: s.ino, birthtimeMs: s.birthtimeMs };
+      stat15 = { mtimeMs: s.mtimeMs, size: s.size, ino: s.ino, birthtimeMs: s.birthtimeMs };
     } catch {
       this._indexCache = null;
       return [];
     }
-    if (this._indexCache !== null && this._indexCache.mtimeMs === stat16.mtimeMs && this._indexCache.size === stat16.size && this._indexCache.ino === stat16.ino && this._indexCache.birthtimeMs === stat16.birthtimeMs) {
+    if (this._indexCache !== null && this._indexCache.mtimeMs === stat15.mtimeMs && this._indexCache.size === stat15.size && this._indexCache.ino === stat15.ino && this._indexCache.birthtimeMs === stat15.birthtimeMs) {
       return this._indexCache.summaries;
     }
     const cached = this._indexCache;
-    const sameFile = cached !== null && cached.ino === stat16.ino && cached.birthtimeMs === stat16.birthtimeMs;
-    if (cached && sameFile && stat16.size > cached.size) {
-      const appended = await readFileRange(this.indexFile, cached.size, stat16.size);
+    const sameFile = cached !== null && cached.ino === stat15.ino && cached.birthtimeMs === stat15.birthtimeMs;
+    if (cached && sameFile && stat15.size > cached.size) {
+      const appended = await readFileRange(this.indexFile, cached.size, stat15.size);
       if (appended !== null) {
         applySessionIndexLines(appended.raw, cached.byId, cached.deleted);
         const summaries2 = Array.from(cached.byId.values()).sort(compareSessionSummaries);
         this._indexCache = {
-          ...stat16,
+          ...stat15,
           size: appended.end,
           summaries: summaries2,
           byId: cached.byId,
@@ -4223,7 +4425,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     applySessionIndexLines(raw, byId, deleted);
     const summaries = Array.from(byId.values());
     summaries.sort(compareSessionSummaries);
-    this._indexCache = { ...stat16, summaries, byId, deleted };
+    this._indexCache = { ...stat15, summaries, byId, deleted };
     return summaries;
   }
   /**
@@ -4323,8 +4525,8 @@ var DefaultSessionStore = class _DefaultSessionStore {
     if (fromManifest) return fromManifest;
     try {
       const full = this.sessionPath(id, ".jsonl");
-      const stat16 = await fsp12.stat(full);
-      const summary = await this.summarize(id, stat16.mtime.toISOString());
+      const stat15 = await fsp12.stat(full);
+      const summary = await this.summarize(id, stat15.mtime.toISOString());
       await atomicWrite(manifest, JSON.stringify(summary), { mode: 384 }).catch((err) => {
         const msg = toErrorMessage(err);
         emitSessionStoreError(this.events, id, manifest, "summary_fallback", msg, true);
@@ -4336,12 +4538,28 @@ var DefaultSessionStore = class _DefaultSessionStore {
       });
       outcome = "failure";
       errorMsg = "summary fallback \xE2\u20AC\u201D manifest rebuilt";
-      emitSessionStoreRead(this.events, id, manifest, "summary", outcome, Date.now() - t0, errorMsg);
+      emitSessionStoreRead(
+        this.events,
+        id,
+        manifest,
+        "summary",
+        outcome,
+        Date.now() - t0,
+        errorMsg
+      );
       return summary;
     } catch (err) {
       outcome = "failure";
       errorMsg = toErrorMessage(err);
-      emitSessionStoreRead(this.events, id, manifest, "summary", outcome, Date.now() - t0, errorMsg);
+      emitSessionStoreRead(
+        this.events,
+        id,
+        manifest,
+        "summary",
+        outcome,
+        Date.now() - t0,
+        errorMsg
+      );
       return {
         id,
         title: "(damaged)",
@@ -4356,14 +4574,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const manifest = this.sessionPath(id, ".summary.json");
     try {
       const raw = await fsp12.readFile(manifest, "utf8");
-      emitSessionStoreRead(
-        this.events,
-        id,
-        manifest,
-        "summary",
-        "success",
-        Date.now() - startTime
-      );
+      emitSessionStoreRead(this.events, id, manifest, "summary", "success", Date.now() - startTime);
       return JSON.parse(raw);
     } catch {
       return null;
@@ -4578,12 +4789,12 @@ var QueueStore = class {
     const t0 = Date.now();
     let raw;
     try {
-      const stat16 = await fsp13.stat(this.file);
-      if (stat16.size > QUEUE_MAX_BYTES) {
+      const stat15 = await fsp13.stat(this.file);
+      if (stat15.size > QUEUE_MAX_BYTES) {
         this.logWarn("Queue file exceeds the safe read budget; ignoring it", {
           event: "queue_store.read_budget_exceeded",
           path: this.file,
-          bytes: stat16.size,
+          bytes: stat15.size,
           maxBytes: QUEUE_MAX_BYTES
         });
         this.events?.emit("storage.read", {
@@ -5034,8 +5245,8 @@ var FileMemoryBackend = class {
   }
   async getMtime(file) {
     try {
-      const stat16 = await fs3.stat(file);
-      return stat16.mtimeMs;
+      const stat15 = await fs3.stat(file);
+      return stat15.mtimeMs;
     } catch {
       return 0;
     }
@@ -5086,15 +5297,15 @@ var FileMemoryBackend = class {
     const line = `- [${entry.ts}] ${id}${meta} ${entry.text.replace(/\n/g, " ")}
 `;
     await withFileLock(file, async () => {
-      const handle = await fs3.open(file, "a+");
+      const handle = await fs3.open(file, "a+", SECRET_FILE_MODE);
       try {
-        const stat16 = await handle.stat();
+        const stat15 = await handle.stat();
         let prefix = "";
-        if (stat16.size === 0) {
+        if (stat15.size === 0) {
           prefix = "# Agent Memory\n\n";
         } else {
           const tail = Buffer.allocUnsafe(1);
-          const { bytesRead } = await handle.read(tail, 0, 1, stat16.size - 1);
+          const { bytesRead } = await handle.read(tail, 0, 1, stat15.size - 1);
           if (bytesRead === 1 && tail[0] !== 10) prefix = "\n";
         }
         await handle.appendFile(`${prefix}${line}`, "utf8");
@@ -6095,6 +6306,9 @@ async function readProviderSnapshot(configPath, vault, warn) {
   if (typeof decrypted.uiLocale === "string" && decrypted.uiLocale)
     snapshot.uiLocale = decrypted.uiLocale;
   if (Array.isArray(decrypted.fallbackModels)) snapshot.fallbackModels = decrypted.fallbackModels;
+  if (typeof decrypted.fallbackBridge === "string" && decrypted.fallbackBridge.trim()) {
+    snapshot.fallbackBridge = decrypted.fallbackBridge.trim();
+  }
   if (decrypted.fallbackProfiles) snapshot.fallbackProfiles = decrypted.fallbackProfiles;
   if (Array.isArray(decrypted.favoriteModels)) snapshot.favoriteModels = decrypted.favoriteModels;
   if (typeof decrypted.favoriteModelsOnly === "boolean")
@@ -6112,6 +6326,7 @@ function serializeSnapshot(s) {
     baseUrl: s.baseUrl ?? null,
     uiLocale: s.uiLocale ?? null,
     fallbackModels: s.fallbackModels ?? null,
+    fallbackBridge: s.fallbackBridge ?? null,
     fallbackProfiles: s.fallbackProfiles ?? null,
     favoriteModels: s.favoriteModels ?? null,
     favoriteModelsOnly: s.favoriteModelsOnly ?? null,
@@ -6326,7 +6541,13 @@ var CONFIG_BEHAVIOR_DEFAULTS = {
     // models still get cost savings without capability loss. Explicit tiers
     // are respected verbatim.
     tokenSavingMode: "auto",
-    allowOutsideProjectRoot: true
+    // Derived, never written by hand: this and `tools.restrictToProjectRoot`
+    // (line 41) are the two halves of one switch, and they used to be declared
+    // independently in this same object — one `true`, one `true` — with
+    // session.ts resolving the contradiction via `??` in favour of the
+    // permissive half. The confinement guard therefore shipped disabled on a
+    // fresh install even though the other half asked for it (WS-075).
+    allowOutsideProjectRoot: !DEFAULT_TOOLS_CONFIG.restrictToProjectRoot
   },
   Sage: {
     enabled: true,
@@ -6405,7 +6626,9 @@ var CONFIG_BEHAVIOR_DEFAULTS = {
     enhance: true,
     enhanceDelayMs: 6e4,
     enhanceLanguage: "original",
-    statuslineMode: "detailed",
+    // Product-wide statusline density default. Mirrored by the TUI's
+    // DEFAULT_STATUSLINE_MODE (packages/tui/src/components/settings-picker-model.ts).
+    statuslineMode: "minimum",
     thinkingWord: DEFAULT_TUI_THINKING_WORD,
     showAgentSwarmPanel: true
   },
@@ -6574,6 +6797,7 @@ var IN_PROJECT_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   "maxConcurrent",
   "uiLocale",
   "fallbackModels",
+  "fallbackBridge",
   "fallbackProfiles",
   "favoriteModels",
   "favoriteModelsOnly",
@@ -6636,6 +6860,7 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "tools",
   "mcpServers",
   "fallbackModels",
+  "fallbackBridge",
   "fallbackProfiles",
   "favoriteModels",
   "favoriteModelsOnly",
@@ -6670,6 +6895,75 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "brain",
   "git"
 ]);
+var IN_PROJECT_DENIED_PATHS = [
+  {
+    path: "tools.exec.allow",
+    reason: "Extends the exec allow-list; a repo could authorise its own binaries."
+  },
+  { path: "tools.exec.danger", reason: "Weakens the destructive-command banner." },
+  { path: "skills.extraDirs", reason: "Loads skill definitions from repo-chosen directories." },
+  { path: "skills.registryUrl", reason: "Redirects skill installs to a repo-chosen host." },
+  // Deliberately NOT denied: skills.mode and skills.eagerMaxChars. The audit
+  // suggested stripping both, but config-loader-extra.test.ts classifies `mode`
+  // as a safe preference with a stated rationale, and a repo can only use these
+  // to move injection volume in either direction — the trust problem was that
+  // repo-supplied skill bodies were indistinguishable from the user's own, which
+  // the provenance tag in system-prompt-skill-bodies.ts now fixes. Re-classifying
+  // them is a product call.
+  { path: "Sage.storage.directory", reason: "Redirects memory storage outside the profile." },
+  {
+    path: "autonomy.yolo",
+    reason: "Alias for the denied top-level `yolo`, and it wins over the user setting \u2014 a repo-committed config could disable every permission prompt."
+  },
+  {
+    path: "autonomy.defaultMode",
+    reason: "Sets the startup autonomy mode; autonomy is user-owned, never repo-owned."
+  },
+  // Deliberately NOT denied: autonomy.autoProceedDelayMs and
+  // autoProceedMaxIterations. They tune a mode the user has already switched on
+  // rather than granting it, and config-loader-extra.test.ts classifies the
+  // delay as a benign project preference. Re-classifying them is a product call.
+  {
+    path: "launch.autonomy",
+    reason: "Launch-time autonomy mode; same user-owned boundary as autonomy.defaultMode."
+  },
+  {
+    path: "features.allowOutsideProjectRoot",
+    reason: "Short-circuits both the project-root containment check and the symlink realpath check in the file tools."
+  },
+  {
+    path: "tools.restrictToProjectRoot",
+    reason: "The other half of the filesystem confinement switch."
+  }
+];
+function deleteNestedPath(target, path30) {
+  const segments = path30.split(".");
+  const last = segments[segments.length - 1];
+  if (last === void 0) return false;
+  let cursor = target;
+  const chain = [];
+  for (const segment of segments.slice(0, -1)) {
+    const next = cursor[segment];
+    if (!next || typeof next !== "object" || Array.isArray(next)) return false;
+    chain.push({ parent: cursor, key: segment });
+    cursor = next;
+  }
+  if (!(last in cursor)) return false;
+  const clonedLeaf = { ...cursor };
+  delete clonedLeaf[last];
+  let replacement = clonedLeaf;
+  for (let i = chain.length - 1; i >= 0; i--) {
+    const link2 = chain[i];
+    if (!link2) continue;
+    replacement = { ...link2.parent, [link2.key]: replacement };
+    if (i === 0) {
+      for (const [k, v] of Object.entries(replacement)) target[k] = v;
+      return true;
+    }
+  }
+  for (const [k, v] of Object.entries(replacement)) target[k] = v;
+  return true;
+}
 function assertInProjectAllowListComplete() {
   const missingFromBoth = [];
   for (const key of KNOWN_CONFIG_TOP_LEVEL_KEYS) {
@@ -6699,6 +6993,22 @@ function assertInProjectAllowListComplete() {
       `field(s) appear in BOTH IN_PROJECT_ALLOWED_KEYS and KNOWN_DENIED_IN_PROJECT: ` + duplicate.join(", ") + ". The allow-list wins at runtime; remove from one of the two."
     );
   }
+  const orphanedPaths = IN_PROJECT_DENIED_PATHS.filter(
+    ({ path: path30 }) => !IN_PROJECT_ALLOWED_KEYS.has(path30.split(".")[0] ?? "")
+  ).map(({ path: path30 }) => path30);
+  if (orphanedPaths.length > 0) {
+    problems.push(
+      `IN_PROJECT_DENIED_PATHS entr(ies) whose top-level parent is not allowed: ` + orphanedPaths.join(", ") + ". The parent is already stripped wholesale, so the nested denial is dead \u2014 remove it."
+    );
+  }
+  const malformedPaths = IN_PROJECT_DENIED_PATHS.filter(
+    ({ path: path30 }) => path30.split(".").length < 2 || path30.split(".").some((s) => s.length === 0)
+  ).map(({ path: path30 }) => path30);
+  if (malformedPaths.length > 0) {
+    problems.push(
+      `IN_PROJECT_DENIED_PATHS entr(ies) are not dotted nested paths: ` + malformedPaths.join(", ") + ". Top-level keys belong in KNOWN_DENIED_IN_PROJECT instead."
+    );
+  }
   if (problems.length > 0) {
     throw new Error(
       `stripUnsafeInProjectFields drift check failed:
@@ -6721,58 +7031,8 @@ function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => conso
     }
     stripped.push(k);
   }
-  const outTools = out["tools"];
-  if (outTools && typeof outTools === "object") {
-    const execCfg = outTools["exec"];
-    if (execCfg && typeof execCfg === "object") {
-      const hasAllow = "allow" in execCfg;
-      const hasDanger = "danger" in execCfg;
-      if (hasAllow || hasDanger) {
-        const clonedExec = { ...execCfg };
-        if (hasAllow) {
-          delete clonedExec["allow"];
-          stripped.push("tools.exec.allow");
-        }
-        if (hasDanger) {
-          delete clonedExec["danger"];
-          stripped.push("tools.exec.danger");
-        }
-        out["tools"] = {
-          ...outTools,
-          exec: clonedExec
-        };
-      }
-    }
-  }
-  const outSkills = out["skills"];
-  if (outSkills && typeof outSkills === "object") {
-    const skillsRec = outSkills;
-    const needsClone = "extraDirs" in skillsRec || "registryUrl" in skillsRec;
-    if (needsClone) {
-      const clonedSkills = { ...skillsRec };
-      if ("extraDirs" in clonedSkills) {
-        delete clonedSkills["extraDirs"];
-        stripped.push("skills.extraDirs");
-      }
-      if ("registryUrl" in clonedSkills) {
-        delete clonedSkills["registryUrl"];
-        stripped.push("skills.registryUrl");
-      }
-      out["skills"] = clonedSkills;
-    }
-  }
-  const outSage = out["Sage"];
-  if (outSage && typeof outSage === "object") {
-    const storage = outSage["storage"];
-    if (storage && typeof storage === "object" && "directory" in storage) {
-      const clonedStorage = { ...storage };
-      delete clonedStorage["directory"];
-      out["Sage"] = {
-        ...outSage,
-        storage: clonedStorage
-      };
-      stripped.push("Sage.storage.directory");
-    }
+  for (const { path: path30 } of IN_PROJECT_DENIED_PATHS) {
+    if (deleteNestedPath(out, path30)) stripped.push(path30);
   }
   if (stripped.length > 0) {
     warn(
@@ -7233,8 +7493,8 @@ var DefaultConfigLoader = class _DefaultConfigLoader {
     const t0 = Date.now();
     let mtimeMs = null;
     try {
-      const stat16 = await fs6.stat(file);
-      mtimeMs = stat16.mtimeMs;
+      const stat15 = await fs6.stat(file);
+      mtimeMs = stat15.mtimeMs;
       const cached = this.jsonCache.get(file);
       if (cached && cached.mtimeMs === mtimeMs) {
         return structuredClone(cached.value);
@@ -7572,72 +7832,15 @@ function isLockFile(v) {
 var defaultIsPidAlive = isPidAlive;
 
 // src/storage/session-reader.ts
-import * as fs7 from "node:fs/promises";
-var DefaultSessionReader = class _DefaultSessionReader {
+var DefaultSessionReader = class {
   store;
   secretScrubber;
-  eventCache = /* @__PURE__ */ new Map();
-  eventCacheMtimes = /* @__PURE__ */ new Map();
-  eventCacheSizes = /* @__PURE__ */ new Map();
-  eventCacheBytes = 0;
-  static EVENT_CACHE_MAX_ENTRIES = 32;
-  static EVENT_CACHE_MAX_BYTES = 32 * 1024 * 1024;
   constructor(opts) {
     this.store = opts.store;
     this.secretScrubber = opts.secretScrubber ?? new DefaultSecretScrubber();
   }
   async loadCachedSessionData(sessionId) {
-    const storeWithPath = this.store;
-    const rootDir = storeWithPath.dir;
-    if (!rootDir) {
-      return scrubPersistedSessionData(await this.store.load(sessionId), this.secretScrubber);
-    }
-    const sessionPath2 = sessionScopedPath(rootDir, sessionId, ".jsonl");
-    let mtimeMs = null;
-    let fileSize = 0;
-    try {
-      const stat16 = await fs7.stat(sessionPath2);
-      mtimeMs = stat16.mtimeMs;
-      fileSize = stat16.size;
-    } catch {
-      this.deleteEventCacheEntry(sessionId);
-      return scrubPersistedSessionData(await this.store.load(sessionId), this.secretScrubber);
-    }
-    const cachedMtime = this.eventCacheMtimes.get(sessionId);
-    const cachedData = this.eventCache.get(sessionId);
-    if (cachedData && cachedMtime === mtimeMs) {
-      this.eventCache.delete(sessionId);
-      this.eventCacheMtimes.delete(sessionId);
-      this.eventCacheSizes.delete(sessionId);
-      this.eventCache.set(sessionId, cachedData);
-      this.eventCacheMtimes.set(sessionId, mtimeMs);
-      this.eventCacheSizes.set(sessionId, fileSize);
-      return cachedData;
-    }
-    const data = scrubPersistedSessionData(await this.store.load(sessionId), this.secretScrubber);
-    this.deleteEventCacheEntry(sessionId);
-    if (fileSize <= _DefaultSessionReader.EVENT_CACHE_MAX_BYTES) {
-      while (this.eventCache.size >= _DefaultSessionReader.EVENT_CACHE_MAX_ENTRIES || this.eventCacheBytes + fileSize > _DefaultSessionReader.EVENT_CACHE_MAX_BYTES) {
-        const oldest = this.eventCache.keys().next().value;
-        if (oldest === void 0) break;
-        this.deleteEventCacheEntry(oldest);
-      }
-      this.eventCache.set(sessionId, data);
-      this.eventCacheMtimes.set(sessionId, mtimeMs);
-      this.eventCacheSizes.set(sessionId, fileSize);
-      this.eventCacheBytes += fileSize;
-    }
-    if (data.metadata.endedAt) {
-      storeWithPath.clearLoadCache?.(sessionId);
-    }
-    return data;
-  }
-  deleteEventCacheEntry(sessionId) {
-    const size = this.eventCacheSizes.get(sessionId) ?? 0;
-    this.eventCache.delete(sessionId);
-    this.eventCacheMtimes.delete(sessionId);
-    this.eventCacheSizes.delete(sessionId);
-    this.eventCacheBytes = Math.max(0, this.eventCacheBytes - size);
+    return scrubPersistedSessionData(await this.store.load(sessionId), this.secretScrubber);
   }
   async query(q = {}) {
     const storeWithFilter = this.store;
@@ -7727,11 +7930,12 @@ var DefaultSessionReader = class _DefaultSessionReader {
           id,
           (rawEvent, eventIndex) => {
             const ev = scrubPersistedSessionEvent(rawEvent, this.secretScrubber);
-            scrubbedByIndex.set(eventIndex, ev);
             if (allowedTypes && !allowedTypes.has(ev.type)) return false;
             const text = eventText(ev);
             if (text === null) return false;
-            return matcher(text) !== null;
+            const matched2 = matcher(text) !== null;
+            if (matched2) scrubbedByIndex.set(eventIndex, ev);
+            return matched2;
           },
           { limit: limit - hits.length }
         );
@@ -7979,7 +8183,7 @@ function renderPlainText(meta, events) {
 
 // src/storage/annotations-store.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import * as fs8 from "node:fs/promises";
+import * as fs7 from "node:fs/promises";
 var FILE_VERSION = 1;
 var MAX_TEXT_LENGTH = 2e3;
 var MAX_ANNOTATIONS = 1e3;
@@ -8206,7 +8410,7 @@ var AnnotationsStore = class {
     const fp = this.filePath(sessionId);
     let raw;
     try {
-      raw = await fs8.readFile(fp, "utf8");
+      raw = await fs7.readFile(fp, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw err;
@@ -8244,7 +8448,7 @@ var AnnotationsStore = class {
 };
 
 // src/storage/replay-log-store.ts
-import * as fs9 from "node:fs/promises";
+import * as fs8 from "node:fs/promises";
 import * as path21 from "node:path";
 
 // src/replay/hash.ts
@@ -8335,12 +8539,12 @@ var ReplayLogStore = class _ReplayLogStore {
             const line = JSON.stringify(entry) + "\n";
             let offset2 = 0;
             try {
-              const stat16 = await fs9.stat(fp);
-              offset2 = stat16.size;
+              const stat15 = await fs8.stat(fp);
+              offset2 = stat15.size;
             } catch (err) {
               if (err.code !== "ENOENT") throw err;
             }
-            await fs9.appendFile(fp, line, "utf8");
+            await fs8.appendFile(fp, line, { encoding: "utf8", mode: SECRET_FILE_MODE });
             cache.set(hash, { entry, offset: offset2, length: Buffer.byteLength(line, "utf8") });
             this.diskCount.set(input.sessionId, currentCount + 1);
             this.events?.emit("storage.write", {
@@ -8468,7 +8672,7 @@ var ReplayLogStore = class _ReplayLogStore {
     const scan = async (dir, prefix, depth) => {
       let entries;
       try {
-        entries = await fs9.readdir(dir, { withFileTypes: true });
+        entries = await fs8.readdir(dir, { withFileTypes: true });
       } catch (err) {
         if (depth === 0 && err.code !== "ENOENT") {
           console.warn(
@@ -8508,7 +8712,7 @@ var ReplayLogStore = class _ReplayLogStore {
     return sessionScopedPath(this.dir, sessionId, ".replay.jsonl");
   }
   async countEntries(filePath) {
-    const handle = await fs9.open(filePath, "r");
+    const handle = await fs8.open(filePath, "r");
     const buffer = Buffer.allocUnsafe(64 * 1024);
     let count = 0;
     let hasNonWhitespace2 = false;
@@ -8549,7 +8753,7 @@ var ReplayLogStore = class _ReplayLogStore {
   async readAll(sessionId) {
     const fp = this.filePath(sessionId);
     try {
-      const raw = await fs9.readFile(fp, "utf8");
+      const raw = await fs8.readFile(fp, "utf8");
       const out = [];
       for (const line of raw.split("\n")) {
         if (!line.trim()) continue;
@@ -8589,7 +8793,7 @@ var ReplayLogStore = class _ReplayLogStore {
     const fp = this.filePath(sessionId);
     cache = /* @__PURE__ */ new Map();
     try {
-      const handle = await fs9.open(fp, "r");
+      const handle = await fs8.open(fp, "r");
       const CHUNK = 64 * 1024;
       const buffer = Buffer.alloc(CHUNK);
       let leftover = "";
@@ -8675,7 +8879,7 @@ var ReplayLogStore = class _ReplayLogStore {
     const fp = this.filePath(sessionId);
     let handle;
     try {
-      handle = await fs9.open(fp, "r");
+      handle = await fs8.open(fp, "r");
     } catch {
       return null;
     }
@@ -8703,7 +8907,7 @@ var ReplayLogStore = class _ReplayLogStore {
 
 // src/storage/session-recovery.ts
 import { createReadStream as createReadStream4 } from "node:fs";
-import * as fs10 from "node:fs/promises";
+import * as fs9 from "node:fs/promises";
 import * as path22 from "node:path";
 import { createInterface as createInterface4 } from "node:readline";
 var SessionRecovery = class _SessionRecovery {
@@ -8741,16 +8945,16 @@ var SessionRecovery = class _SessionRecovery {
   }
   async detectStaleExact(sessionId) {
     const fp = this.filePath(sessionId);
-    let stat16;
+    let stat15;
     try {
-      stat16 = await fs10.stat(fp);
+      stat15 = await fs9.stat(fp);
     } catch (err) {
       if (err.code === "ENOENT") return null;
       return null;
     }
-    if (stat16.size === 0) return null;
+    if (stat15.size === 0) return null;
     try {
-      const scan = await scanLatestLifecycleBoundary(fp, stat16.size);
+      const scan = await scanLatestLifecycleBoundary(fp, stat15.size);
       if (scan?.boundary.type !== "in_flight_start") return null;
       return {
         sessionId,
@@ -8843,7 +9047,7 @@ var SessionRecovery = class _SessionRecovery {
     const collect = async (dir, prefix, depth) => {
       let entries;
       try {
-        entries = await fs10.readdir(dir, { withFileTypes: true });
+        entries = await fs9.readdir(dir, { withFileTypes: true });
       } catch {
         return;
       }
@@ -8894,7 +9098,7 @@ function hasNonWhitespace(line) {
 }
 async function scanLatestLifecycleBoundary(filePath, size) {
   const CHUNK_SIZE2 = 64 * 1024;
-  const handle = await fs10.open(filePath, "r");
+  const handle = await fs9.open(filePath, "r");
   let position = size;
   let laterLineFragment = Buffer.alloc(0);
   let latestBoundary = null;
@@ -8933,7 +9137,7 @@ async function scanLatestLifecycleBoundary(filePath, size) {
 
 // src/storage/tool-audit-log.ts
 import { createHash as createHash6, randomUUID as randomUUID4 } from "node:crypto";
-import * as fs11 from "node:fs/promises";
+import * as fs10 from "node:fs/promises";
 var GENESIS_PREV = "0".repeat(64);
 var DEFAULT_FSYNC_EVERY = 100;
 var ToolAuditLog = class {
@@ -9003,9 +9207,15 @@ var ToolAuditLog = class {
             isError: input.isError,
             index
           };
-          await fs11.appendFile(fp, JSON.stringify(entry) + "\n", "utf8");
+          await fs10.appendFile(fp, JSON.stringify(entry) + "\n", {
+            encoding: "utf8",
+            // WS-035: this file records raw tool INPUT and OUTPUT. Created
+            // without a mode it lands 0644 — world-readable — while its
+            // siblings under the same directory correctly use 0600.
+            mode: SECRET_FILE_MODE
+          });
           try {
-            const st = await fs11.stat(fp);
+            const st = await fs10.stat(fp);
             this.tailStat.set(input.sessionId, { mtimeMs: st.mtimeMs, size: st.size });
           } catch {
           }
@@ -9052,7 +9262,7 @@ var ToolAuditLog = class {
     const cachedStat = this.tailStat.get(sessionId);
     if (cachedHash !== void 0 && cachedIndex !== void 0 && cachedStat) {
       try {
-        const st = await fs11.stat(fp);
+        const st = await fs10.stat(fp);
         if (st.mtimeMs === cachedStat.mtimeMs && st.size === cachedStat.size) {
           return { prevHash: cachedHash, nextIndex: cachedIndex };
         }
@@ -9073,7 +9283,7 @@ var ToolAuditLog = class {
     this.tailHash.set(sessionId, prevHash);
     this.tailIndex.set(sessionId, nextIndex);
     try {
-      const st = await fs11.stat(fp);
+      const st = await fs10.stat(fp);
       this.tailStat.set(sessionId, { mtimeMs: st.mtimeMs, size: st.size });
     } catch {
     }
@@ -9194,7 +9404,7 @@ var ToolAuditLog = class {
   async readAll(sessionId) {
     const fp = this.filePath(sessionId);
     try {
-      const raw = await fs11.readFile(fp, "utf8");
+      const raw = await fs10.readFile(fp, "utf8");
       const out = [];
       for (const line of raw.split("\n")) {
         if (!line.trim()) continue;
@@ -9232,7 +9442,7 @@ var ToolAuditLog = class {
   }
   async sync(sessionId, fp) {
     try {
-      const fh = await fs11.open(fp, "r+");
+      const fh = await fs10.open(fp, "r+");
       try {
         await fh.sync();
       } finally {
@@ -9240,7 +9450,7 @@ var ToolAuditLog = class {
       }
     } catch {
     } finally {
-      this.unSyncedWrites.set(sessionId, 0);
+      this.unSyncedWrites.delete(sessionId);
     }
   }
   enqueue(sessionId, fn) {
@@ -9371,29 +9581,29 @@ var SessionAnalyzer = class {
 };
 
 // src/session-registry.ts
-import * as fs13 from "node:fs/promises";
+import * as fs12 from "node:fs/promises";
 import * as path24 from "node:path";
 
 // src/session-registry-atomic-file.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
-import * as fs12 from "node:fs/promises";
+import * as fs11 from "node:fs/promises";
 import * as path23 from "node:path";
 var STALE_LOCK_MS = 1e4;
 var STALE_TMP_MS = 6e4;
 var MAX_STALE_TMP_FILES = 20;
 async function breakStaleLock(lockPath) {
   try {
-    const [stat16, content] = await Promise.all([
-      fs12.stat(lockPath),
+    const [stat15, content] = await Promise.all([
+      fs11.stat(lockPath),
       /* v8 ignore start -- best-effort lock-content read; .catch only fires if the lock vanished */
-      fs12.readFile(lockPath, "utf8").catch(() => "")
+      fs11.readFile(lockPath, "utf8").catch(() => "")
       /* v8 ignore stop */
     ]);
-    const ageMs = Date.now() - stat16.mtimeMs;
+    const ageMs = Date.now() - stat15.mtimeMs;
     const ownerPid = Number.parseInt(content.trim(), 10);
     const ownerDead = Number.isInteger(ownerPid) && ownerPid > 0 && ownerPid !== process.pid && !isPidAlive(ownerPid);
     if (ownerDead || ageMs > STALE_LOCK_MS) {
-      await fs12.unlink(lockPath).catch(() => void 0);
+      await fs11.unlink(lockPath).catch(() => void 0);
       return true;
     }
     return false;
@@ -9408,7 +9618,7 @@ async function writeAtomicFile(filePath, registry) {
   );
   let tmpPersisted = false;
   try {
-    const handle = await fs12.open(tmp, "w");
+    const handle = await fs11.open(tmp, "w");
     try {
       await handle.writeFile(JSON.stringify(registry, null, 2), "utf8");
       await handle.sync().catch(() => void 0);
@@ -9417,14 +9627,14 @@ async function writeAtomicFile(filePath, registry) {
     }
     tmpPersisted = true;
     try {
-      await fs12.rename(tmp, filePath);
+      await fs11.rename(tmp, filePath);
       tmpPersisted = false;
     } catch (renameErr) {
       const code = renameErr?.code;
       if (code === "EPERM" || code === "EBUSY" || code === "EACCES") {
-        await fs12.copyFile(tmp, filePath);
+        await fs11.copyFile(tmp, filePath);
         try {
-          const destHandle = await fs12.open(filePath, "r+");
+          const destHandle = await fs11.open(filePath, "r+");
           try {
             await destHandle.sync().catch(() => void 0);
           } finally {
@@ -9432,14 +9642,14 @@ async function writeAtomicFile(filePath, registry) {
           }
         } catch {
         }
-        await fs12.unlink(tmp).catch(() => void 0);
+        await fs11.unlink(tmp).catch(() => void 0);
         tmpPersisted = false;
       } else {
         throw renameErr;
       }
     }
   } catch (err) {
-    if (tmpPersisted) await fs12.unlink(tmp).catch(() => void 0);
+    if (tmpPersisted) await fs11.unlink(tmp).catch(() => void 0);
     throw err;
   }
 }
@@ -9449,17 +9659,17 @@ async function pruneStaleTempFiles(filePath) {
     const base = path23.basename(filePath);
     const now = Date.now();
     const stale = [];
-    for (const name of await fs12.readdir(dir)) {
+    for (const name of await fs11.readdir(dir)) {
       const isTemp = (name.startsWith(`${base}.`) || name.startsWith(`.${base}.`)) && name.endsWith(".tmp");
       if (!isTemp) continue;
-      const stat16 = await fs12.stat(path23.join(dir, name)).catch(() => null);
-      if (!stat16) continue;
-      if (now - stat16.mtimeMs > STALE_TMP_MS) stale.push({ name, mtimeMs: stat16.mtimeMs });
+      const stat15 = await fs11.stat(path23.join(dir, name)).catch(() => null);
+      if (!stat15) continue;
+      if (now - stat15.mtimeMs > STALE_TMP_MS) stale.push({ name, mtimeMs: stat15.mtimeMs });
     }
     stale.sort((a, b) => b.mtimeMs - a.mtimeMs);
     await Promise.all(
       stale.slice(MAX_STALE_TMP_FILES).map(async ({ name }) => {
-        await fs12.unlink(path23.join(dir, name)).catch(() => void 0);
+        await fs11.unlink(path23.join(dir, name)).catch(() => void 0);
       })
     );
   } catch {
@@ -9762,7 +9972,7 @@ var SessionRegistry = class {
   }
   async readAndPrune() {
     try {
-      const raw = await fs13.readFile(this.filePath, "utf8");
+      const raw = await fs12.readFile(this.filePath, "utf8");
       const registry = parseRegistry(raw);
       const observed = new Map(
         Object.entries(registry).map(([id, entry]) => [
@@ -9833,7 +10043,7 @@ var SessionRegistry = class {
     const deadline = Date.now() + waitBudgetMs;
     let attempt = 0;
     try {
-      await fs13.mkdir(path24.dirname(this.filePath), { recursive: true });
+      await fs12.mkdir(path24.dirname(this.filePath), { recursive: true });
       await this.maybePruneStaleTempFiles();
     } catch (err) {
       if (required) {
@@ -9845,10 +10055,10 @@ var SessionRegistry = class {
     }
     while (true) {
       try {
-        let lockHandle = await fs13.open(lockPath, "wx").catch(() => null);
+        let lockHandle = await fs12.open(lockPath, "wx").catch(() => null);
         if (!lockHandle) {
           if (await breakStaleLock(lockPath)) {
-            lockHandle = await fs13.open(lockPath, "wx").catch(() => null);
+            lockHandle = await fs12.open(lockPath, "wx").catch(() => null);
           }
           if (!lockHandle) {
             const remainingMs = deadline - Date.now();
@@ -9863,14 +10073,14 @@ var SessionRegistry = class {
         }
         try {
           await lockHandle.writeFile(String(process.pid)).catch(() => void 0);
-          const raw = await fs13.readFile(this.filePath, "utf8").catch(() => "{}");
+          const raw = await fs12.readFile(this.filePath, "utf8").catch(() => "{}");
           const registry = parseRegistry(raw);
           fn(registry);
           await this.writeAtomicWithRetry(registry);
           return;
         } finally {
           await lockHandle.close();
-          await fs13.unlink(lockPath).catch(() => void 0);
+          await fs12.unlink(lockPath).catch(() => void 0);
         }
       } catch (err) {
         if (err instanceof SessionOwnershipConflictError) throw err;
@@ -10706,7 +10916,7 @@ var AgentStatusTracker = class _AgentStatusTracker {
 };
 
 // src/fleet-notifier.ts
-import * as fs14 from "node:fs/promises";
+import * as fs13 from "node:fs/promises";
 import * as path25 from "node:path";
 var INSTANCES_FILE = "webui-instances.json";
 var DISCOVERY_TTL_MS = 2500;
@@ -10766,7 +10976,7 @@ var FleetNotifier = class {
   }
   async discover() {
     try {
-      const raw = await fs14.readFile(path25.join(this.baseDir, INSTANCES_FILE), "utf8");
+      const raw = await fs13.readFile(path25.join(this.baseDir, INSTANCES_FILE), "utf8");
       const data = JSON.parse(raw);
       const list = Array.isArray(data?.instances) ? data.instances : [];
       return list.filter((i) => i && typeof i.httpPort === "number").filter((i) => i.pid !== this.selfPid).filter((i) => normRoot(i.projectRoot) === this.projectRoot).filter((i) => pidAlive2(i.pid)).map((i) => {
@@ -12322,6 +12532,11 @@ function applyGoalDeliverableCompletions(goal, completed) {
       (item, index) => completedIndices.has(index) && !isGoalDeliverableComplete(item) ? `\u2705 ${item}` : item
     )
   };
+  next = appendGoalDeliverableJournals(next, completed);
+  return recomputeGoalProgress(next);
+}
+function appendGoalDeliverableJournals(goal, completed) {
+  let next = goal;
   for (const item of completed) {
     next = appendJournal(next, {
       source: "deliverable",
@@ -12330,7 +12545,7 @@ function applyGoalDeliverableCompletions(goal, completed) {
       note: `[DONE: ${item.index + 1}]`
     });
   }
-  return recomputeGoalProgress(next);
+  return next;
 }
 function recomputeGoalProgress(goal) {
   const deliverables = goal.deliverables ?? [];
@@ -12343,10 +12558,19 @@ async function coordinateGoalIteration(options) {
   const current = await loadGoal(options.goalPath, options.events);
   if (!current) return null;
   const completed = parseCompletedGoalDeliverables(options.finalText, current.deliverables ?? []);
-  let goal = applyGoalDeliverableCompletions(current, completed);
-  await saveGoal(options.goalPath, goal, options.events);
-  const kanbanUpdatedTaskIds = await refreshGoalKanban(options.projectRoot, goal, completed);
-  goal = await recomputeGoalProgressFromKanban(options.projectRoot, goal);
+  const board = await resolveGoalBoard(options.projectRoot, current);
+  let kanbanUpdatedTaskIds = [];
+  let goal;
+  if (board) {
+    kanbanUpdatedTaskIds = await refreshGoalKanban(options.projectRoot, current, completed, board);
+    goal = await recomputeGoalProgressFromKanban(options.projectRoot, current);
+    const confirmed = completed.filter(
+      (item) => !isGoalDeliverableComplete(current.deliverables?.[item.index] ?? "") && isGoalDeliverableComplete(goal.deliverables?.[item.index] ?? "")
+    );
+    goal = appendGoalDeliverableJournals(goal, confirmed);
+  } else {
+    goal = applyGoalDeliverableCompletions(current, completed);
+  }
   let reached = false;
   const allComplete = (goal.deliverables?.length ?? 0) > 0 && goal.deliverables?.every(isGoalDeliverableComplete) === true;
   if (allComplete && options.brain) {
@@ -12411,9 +12635,9 @@ async function resolveGoalBoard(projectRoot, goal) {
   }
   return findGoalBoardByTag(projectRoot, goal);
 }
-async function refreshGoalKanban(projectRoot, goal, completed) {
+async function refreshGoalKanban(projectRoot, goal, completed, resolvedBoard) {
   if (completed.length === 0) return [];
-  const board = await resolveGoalBoard(projectRoot, goal);
+  const board = resolvedBoard ?? await resolveGoalBoard(projectRoot, goal);
   if (!board) return [];
   const doneColumn = board.columns.find((column) => column.title.toLowerCase() === "done");
   if (!doneColumn) return [];
@@ -12422,7 +12646,7 @@ async function refreshGoalKanban(projectRoot, goal, completed) {
   const updated = [];
   for (const task of board.tasks) {
     const originMatch = task.origin?.system === "goal" && task.origin?.taskId ? originKeys.has(task.origin.taskId) : false;
-    const titleMatch = completedTitles.has(normalizeTitle(task.title));
+    const titleMatch = !task.origin?.taskId && completedTitles.has(normalizeTitle(task.title));
     if (!originMatch && !titleMatch) continue;
     const result = await updateTask(
       projectRoot,
@@ -12441,12 +12665,17 @@ async function refreshGoalKanban(projectRoot, goal, completed) {
 async function recomputeGoalProgressFromKanban(projectRoot, goal) {
   const board = await resolveGoalBoard(projectRoot, goal);
   if (!board || !goal.deliverables?.length) return recomputeGoalProgress(goal);
-  const completedTitles = new Set(
-    board.tasks.filter((task) => task.status === "completed").map((task) => normalizeTitle(task.title))
+  const tasksByOrigin = new Map(
+    board.tasks.filter((task) => task.origin?.system === "goal" && task.origin.taskId).map((task) => [task.origin.taskId, task])
   );
-  const deliverables = goal.deliverables.map((item) => {
-    if (isGoalDeliverableComplete(item)) return item;
-    return completedTitles.has(normalizeTitle(item)) ? `\u2705 ${item}` : item;
+  const completedLegacyTitles = new Set(
+    board.tasks.filter((task) => !task.origin?.taskId && task.status === "completed").map((task) => normalizeTitle(task.title))
+  );
+  const deliverables = goal.deliverables.map((item, index) => {
+    const text = stripGoalDeliverableMarker(item);
+    const originTask = tasksByOrigin.get(`deliverable:${index}`);
+    const complete = originTask ? originTask.status === "completed" : completedLegacyTitles.has(normalizeTitle(text)) || isGoalDeliverableComplete(item);
+    return complete ? `\u2705 ${text}` : text;
   });
   return recomputeGoalProgress({ ...goal, deliverables });
 }
@@ -12456,7 +12685,7 @@ function normalizeTitle(value) {
 
 // src/storage/prompt-store.ts
 import { createHash as createHash7 } from "node:crypto";
-import * as fs15 from "node:fs/promises";
+import * as fs14 from "node:fs/promises";
 import * as path27 from "node:path";
 var SCHEMA_VERSION = 2;
 function promptChecksum(content) {
@@ -12472,7 +12701,7 @@ function migratePromptEntry(raw) {
   const tags = Array.isArray(r["tags"]) ? r["tags"].filter((t) => typeof t === "string") : [];
   return {
     id: r["id"],
-    slug: typeof r["slug"] === "string" && r["slug"].length > 0 ? r["slug"] : slugify(title),
+    slug: typeof r["slug"] === "string" && r["slug"].length > 0 ? r["slug"] : slugify2(title),
     title,
     description: typeof r["description"] === "string" ? r["description"] : "",
     content,
@@ -12521,12 +12750,12 @@ var DefaultPromptStore = class {
     await ensureDir(this.dir);
     const entries = [];
     try {
-      const files = await fs15.readdir(this.dir);
+      const files = await fs14.readdir(this.dir);
       for (const file of files) {
         if (!file.endsWith(".json")) continue;
         try {
           const raw = JSON.parse(
-            await fs15.readFile(path27.join(this.dir, file), "utf8")
+            await fs14.readFile(path27.join(this.dir, file), "utf8")
           );
           const migrated = migratePromptEntry(raw.entry);
           if (migrated) entries.push(migrated);
@@ -12542,7 +12771,7 @@ var DefaultPromptStore = class {
   async get(id) {
     const file = path27.join(this.dir, `${id}.json`);
     try {
-      const raw = JSON.parse(await fs15.readFile(file, "utf8"));
+      const raw = JSON.parse(await fs14.readFile(file, "utf8"));
       return migratePromptEntry(raw.entry);
     } catch {
       return null;
@@ -12557,7 +12786,7 @@ var DefaultPromptStore = class {
   async delete(id) {
     const file = path27.join(this.dir, `${id}.json`);
     try {
-      await fs15.unlink(file);
+      await fs14.unlink(file);
       return true;
     } catch {
       return false;
@@ -12575,7 +12804,7 @@ var DefaultPromptStore = class {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     return {
       id: ulid(),
-      slug: extra.slug && extra.slug.length > 0 ? extra.slug : slugify(title),
+      slug: extra.slug && extra.slug.length > 0 ? extra.slug : slugify2(title),
       title,
       description: extra.description ?? "",
       content,
@@ -12596,7 +12825,7 @@ var DefaultPromptStore = class {
 };
 
 // src/storage/prompt-usage-store.ts
-import * as fs16 from "node:fs/promises";
+import * as fs15 from "node:fs/promises";
 var PromptUsageStore = class {
   constructor(file) {
     this.file = file;
@@ -12616,7 +12845,7 @@ var PromptUsageStore = class {
       return this.cachedUsage;
     }
     try {
-      const raw = JSON.parse(await fs16.readFile(this.file, "utf8"));
+      const raw = JSON.parse(await fs15.readFile(this.file, "utf8"));
       if (raw && typeof raw === "object" && raw.usage && typeof raw.usage === "object") {
         this.cachedUsage = raw.usage;
         this.cachedSignature = signature;
@@ -12696,8 +12925,8 @@ var PromptUsageStore = class {
   }
   async fileSignature() {
     try {
-      const stat16 = await fs16.stat(this.file);
-      return { size: stat16.size, mtimeMs: stat16.mtimeMs, ctimeMs: stat16.ctimeMs };
+      const stat15 = await fs15.stat(this.file);
+      return { size: stat15.size, mtimeMs: stat15.mtimeMs, ctimeMs: stat15.ctimeMs };
     } catch {
       return null;
     }
@@ -12712,7 +12941,7 @@ function cloneUsage(usage) {
 }
 
 // src/storage/input-history-store.ts
-import * as fs17 from "node:fs/promises";
+import * as fs16 from "node:fs/promises";
 import * as path28 from "node:path";
 var INPUT_HISTORY_DEFAULT_MAX = 100;
 var InputHistoryStore = class {
@@ -12735,7 +12964,7 @@ var InputHistoryStore = class {
    */
   async load() {
     try {
-      const raw = JSON.parse(await fs17.readFile(this.file, "utf8"));
+      const raw = JSON.parse(await fs16.readFile(this.file, "utf8"));
       if (raw && typeof raw === "object" && Array.isArray(raw.entries) && raw.entries.every((e) => typeof e === "string")) {
         return raw.entries.slice(0, this.maxEntries);
       }
@@ -12792,7 +13021,7 @@ var InputHistoryStore = class {
 };
 
 // src/storage/cloud-sync.ts
-import * as fs18 from "node:fs/promises";
+import * as fs17 from "node:fs/promises";
 import * as path29 from "node:path";
 import { createHash as createHash8 } from "node:crypto";
 var ALL_SYNC_CATEGORIES = ["settings", "skills", "prompts", "memory", "history"];
@@ -12957,7 +13186,7 @@ var CloudSync = class {
   }
   async loadState() {
     try {
-      const raw = await fs18.readFile(this.statePath, "utf8");
+      const raw = await fs17.readFile(this.statePath, "utf8");
       this.state = JSON.parse(raw);
     } catch {
       this.state = null;
@@ -13082,18 +13311,18 @@ var CloudSync = class {
       const localPath = this.categoryToPath(cat);
       if (!localPath) continue;
       try {
-        const stat16 = await fs18.lstat(localPath);
-        if (stat16.isSymbolicLink()) continue;
-        if (stat16.isDirectory()) {
+        const stat15 = await fs17.lstat(localPath);
+        if (stat15.isSymbolicLink()) continue;
+        if (stat15.isDirectory()) {
           const files = await this.walkDir(localPath, localPath);
           for (const file of files) {
-            const content = await fs18.readFile(file, "utf8");
+            const content = await fs17.readFile(file, "utf8");
             const rel = path29.relative(localPath, file).replace(/\\/g, "/");
             entries.push({ path: `data/${cat}/${rel}`, content, mode: "100644" });
             hashes.push(`${cat}/${rel}\0${content}`);
           }
         } else {
-          const content = await fs18.readFile(localPath, "utf8");
+          const content = await fs17.readFile(localPath, "utf8");
           entries.push({ path: `data/${cat}`, content, mode: "100644" });
           hashes.push(`${cat}\0${content}`);
         }
@@ -13109,17 +13338,17 @@ var CloudSync = class {
       const localPath = this.categoryToPath(cat);
       if (!localPath) continue;
       try {
-        const stat16 = await fs18.lstat(localPath);
-        if (stat16.isSymbolicLink()) continue;
-        if (stat16.isDirectory()) {
+        const stat15 = await fs17.lstat(localPath);
+        if (stat15.isSymbolicLink()) continue;
+        if (stat15.isDirectory()) {
           const files = await this.walkDir(localPath, localPath);
           for (const file of files) {
-            const content = await fs18.readFile(file, "utf8");
+            const content = await fs17.readFile(file, "utf8");
             const rel = path29.relative(localPath, file).replace(/\\/g, "/");
             hashes.push(`${cat}/${rel}\0${content}`);
           }
         } else {
-          const content = await fs18.readFile(localPath, "utf8");
+          const content = await fs17.readFile(localPath, "utf8");
           hashes.push(`${cat}\0${content}`);
         }
       } catch {
@@ -13146,7 +13375,7 @@ var CloudSync = class {
   }
   async walkDir(dir, base) {
     const results = [];
-    const entries = await fs18.readdir(dir, { withFileTypes: true });
+    const entries = await fs17.readdir(dir, { withFileTypes: true });
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       const full = path29.join(dir, entry.name);
@@ -13173,18 +13402,18 @@ async function preparePulledDestination(cat, localPath, destPath, remotePath) {
     if (relativeParent) {
       for (const segment of relativeParent.split(path29.sep)) {
         cursor = path29.join(cursor, segment);
-        const stat16 = await lstatIfExists(cursor);
-        if (stat16?.isSymbolicLink()) throw unsafePulledSymlinkError(remotePath, cursor);
+        const stat15 = await lstatIfExists(cursor);
+        if (stat15?.isSymbolicLink()) throw unsafePulledSymlinkError(remotePath, cursor);
       }
     }
   }
   const destStat = await lstatIfExists(destPath);
   if (destStat?.isSymbolicLink()) throw unsafePulledSymlinkError(remotePath, destPath);
-  await fs18.mkdir(path29.dirname(destPath), { recursive: true });
+  await fs17.mkdir(path29.dirname(destPath), { recursive: true });
 }
 async function lstatIfExists(filePath) {
   try {
-    return await fs18.lstat(filePath);
+    return await fs17.lstat(filePath);
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
@@ -13335,6 +13564,9 @@ function createSessionEventBridge(writer, level = "standard", options = {}) {
     async append(event) {
       const target = resolveWriter();
       if (!target) return;
+      if (event.type === "tool_call_end") {
+        progressCounters.delete(event.id);
+      }
       if (!isAllowed(event.type, currentLevel)) return;
       if (!shouldSample(event)) return;
       try {
@@ -13345,6 +13577,9 @@ function createSessionEventBridge(writer, level = "standard", options = {}) {
     async appendBatch(events) {
       const target = resolveWriter();
       if (!target || events.length === 0) return;
+      for (const e of events) {
+        if (e.type === "tool_call_end") progressCounters.delete(e.id);
+      }
       const allowed = events.filter((e) => isAllowed(e.type, currentLevel) && shouldSample(e));
       if (allowed.length === 0) return;
       try {