@wrongstack/core 0.297.0 → 0.298.1

package/dist/storage/index.js

@@ -2,67 +2,80 @@
 import * as fsp12 from "node:fs/promises";
 import * as path13 from "node:path";
 
+// src/security/file-permissions.ts
+var SECRET_FILE_MODE = 384;
+
 // src/security/secret-scrubber.ts
 var PATTERNS = [
   // Anchored at the start where possible so partial matches inside larger
   // strings don't trigger false positives.
   {
     type: "anthropic_key",
-    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g,
+    anchor: "sk-ant-"
   },
-  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g },
-  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g },
-  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g },
-  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g },
-  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g },
-  { type: "slack_token", regex: /(?<![A-Za-z0-9-])xox[abpos]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g },
+  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
+  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
+  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
+  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g, anchor: "AIza" },
+  { type: "slack_token", regex: /(?<![A-Za-z0-9-])xox[abpos]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g, anchor: "xox" },
   {
     type: "stripe_key",
-    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g,
+    anchor: "sk_"
   },
   {
     type: "twilio_sid",
-    regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g,
+    anchor: "AC"
   },
   {
     type: "telegram_bot_token",
     // Telegram tokens are of the form  bot<digits>:<alphanum>  in URL paths
-    regex: /\/bot\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g
+    regex: /\/bot\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "/bot"
   },
   {
     type: "jwt",
     // Anchored: look for literal "eyJ" which is unambiguous for JWT header
-    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g
+    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g,
+    anchor: "eyJ"
   },
   {
     type: "private_key",
     // Anchored: start must be BEGIN, end must be END with no extra dashes after END
-    regex: /(?:^|\n)-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----[\s\S]*?-----END[^-]*-----(?:\n|$)/g
+    regex: /(?:^|\n)-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----[\s\S]*?-----END[^-]*-----(?:\n|$)/g,
+    anchor: "-----BEGIN"
   },
-  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s"'`]+/g },
-  { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g },
-  { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g },
-  { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g },
+  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s"'`]+/g, anchor: "mongodb" },
+  { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g, anchor: "postgres" },
+  { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g, anchor: "mysql://" },
+  { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g, anchor: "redis://" },
   // AI/ML provider keys — modern LLM services with well-known prefixes
   {
     type: "huggingface_token",
     // HuggingFace tokens: hf_ followed by 34 alphanumeric chars
-    regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g,
+    anchor: "hf_"
   },
   {
     type: "replicate_token",
     // Replicate tokens: r8_ followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "r8_"
   },
   {
     type: "perplexity_key",
     // Perplexity API keys: pplx- followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "pplx-"
   },
   {
     type: "groq_key",
     // Groq API keys: gsk_ followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+    regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "gsk_"
   },
   {
     type: "bearer_token",
@@ -75,7 +88,8 @@ var PATTERNS = [
     // tokens sharing a single delimiter (`Bearer a… Bearer b…`) must both be
     // redacted. A consuming trailing delimiter would eat the separator the
     // next match needs for its leading anchor, leaking the second token.
-    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?=$|[^A-Za-z0-9_.~+/-])/g
+    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?=$|[^A-Za-z0-9_.~+/-])/g,
+    anchor: "Bearer"
   },
   {
     type: "high_entropy_env",
@@ -91,7 +105,89 @@ var PATTERNS = [
     // replacement so the separator between adjacent secrets is preserved
     // rather than collapsed. Capture groups are therefore: 1=leading
     // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
+  },
+  // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
+  // The plugin runtime carried 37 patterns while this scrubber — the one that
+  // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
+  // audit — carried 22. The plugin side already had a parity test; it just did
+  // not cover core. Most consequential: WrongStack mints `gho_` tokens itself
+  // in the Copilot OAuth flow, and `gh[ousr]_` was absent here.
+  {
+    type: "github_oauth_token",
+    regex: /(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g,
+    anchor: ["gho_", "ghu_", "ghs_", "ghr_"]
+  },
+  {
+    type: "gitlab_pat",
+    regex: /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "glpat-"
+  },
+  {
+    type: "gitlab_runner_token",
+    regex: /(?<![A-Za-z0-9])glrt-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "glrt-"
+  },
+  {
+    type: "npm_token",
+    regex: /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g,
+    anchor: "npm_"
+  },
+  {
+    type: "slack_app_token",
+    regex: /(?<![A-Za-z0-9-])xapp-\d-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g,
+    anchor: "xapp-"
+  },
+  {
+    type: "slack_webhook",
+    regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_-]+\/B[A-Za-z0-9_-]+\/[A-Za-z0-9]{16,}/g,
+    anchor: "hooks.slack.com"
+  },
+  {
+    type: "sendgrid_key",
+    regex: /(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "SG."
+  },
+  {
+    type: "digitalocean_token",
+    regex: /(?<![A-Za-z0-9])dop_v1_[a-f0-9]{64}(?![A-Za-z0-9])/g,
+    anchor: "dop_v1_"
+  },
+  {
+    type: "doppler_token",
+    regex: /(?<![A-Za-z0-9])dp\.(?:pt|st|sa|scim|audit)\.[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "dp."
+  },
+  {
+    type: "shopify_token",
+    regex: /(?<![A-Za-z0-9])shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}(?![A-Za-z0-9])/g,
+    anchor: "shp"
+  },
+  {
+    type: "docker_pat",
+    regex: /(?<![A-Za-z0-9])dckr_pat_[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "dckr_pat_"
+  },
+  {
+    type: "linear_key",
+    regex: /(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "lin_api_"
+  },
+  {
+    type: "atlassian_token",
+    regex: /(?<![A-Za-z0-9])ATATT3[A-Za-z0-9_\-=]{40,}(?![A-Za-z0-9_\-=])/g,
+    anchor: "ATATT3"
+  },
+  {
+    type: "square_token",
+    regex: /(?<![A-Za-z0-9])(?:sq0(?:atp|csp)-|EAAA)[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: ["sq0atp-", "sq0csp-", "EAAA"]
+  },
+  {
+    type: "google_oauth_client_secret",
+    regex: /(?<![A-Za-z0-9_-])GOCSPX-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "GOCSPX-"
   }
 ];
 var SIMPLE_PATTERNS = PATTERNS.filter((p) => p.type !== "high_entropy_env");
@@ -100,32 +196,32 @@ var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").reg
 var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
 var SCRUB_CHUNK_BYTES = 64 * 1024;
 var SCRUB_OVERLAP_BYTES = 1024;
+var PATTERN_ANCHORS = [
+  ...new Set(
+    PATTERNS.flatMap(
+      (pattern) => typeof pattern.anchor === "string" ? [pattern.anchor] : [...pattern.anchor]
+    )
+  )
+];
+var JSON_KEY_ANCHORS = [
+  '"apiKey"',
+  '"api_key"',
+  '"token"',
+  '"secret"',
+  '"password"',
+  '"authorization"',
+  '"bearer"',
+  '"private_key"',
+  '"access_token"',
+  '"refresh_token"',
+  '"client_secret"'
+];
+var ALL_ANCHORS = [...PATTERN_ANCHORS, ...JSON_KEY_ANCHORS];
 function hasCredentialAnchors(text) {
-  return text.includes("-----BEGIN") || // Private keys (most unique → cheap reject)
-  text.includes("sk-") || // Anthropic + OpenAI keys
-  text.includes("sk_") || // Stripe live/test keys
-  text.includes("ghp_") || // GitHub PAT v1
-  text.includes("github_pat_") || // GitHub PAT v2
-  text.includes("eyJ") || // JWT
-  text.includes("AKIA") || // AWS access key
-  text.includes("AIza") || // GCP service key
-  text.includes("xox") || // Slack token (xoxa/xoxb/xoxp/xoxo/xoxs)
-  text.includes("Bearer ") || // Bearer token (space suffix reduces false positives)
-  text.includes("/bot") || // Telegram bot token (URL path pattern)
-  text.includes("hf_") || // HuggingFace token
-  text.includes("r8_") || // Replicate token
-  text.includes("pplx-") || // Perplexity API key
-  text.includes("gsk_") || // Groq API key
-  text.includes("_KEY=") || // High-entropy env vars: API_KEY=, SECRET_KEY=, ...
-  text.includes("_TOKEN=") || // ACCESS_TOKEN=, AUTH_TOKEN=, ...
-  text.includes("_SECRET=") || // API_SECRET=, CLIENT_SECRET=, ...
-  text.includes("_PASSWORD=") || // DB_PASSWORD=, ROOT_PASSWORD=, ...
-  text.includes("mongodb://") || text.includes("mongodb+srv://") || text.includes("postgres://") || text.includes("postgresql://") || text.includes("mysql://") || text.includes("redis://") || // JSON-style credential keys: tool outputs often serialise objects as
-  // raw JSON strings rather than parsed objects. The value may not start
-  // with a recognisable prefix (sk-, ghp_, etc.), so we anchor on common
-  // key names. The `"` prefix avoids matching prose that happens to mention
-  // these words — JSON serialisation always quotes string keys.
-  text.includes('"apiKey"') || text.includes('"api_key"') || text.includes('"token"') || text.includes('"secret"') || text.includes('"password"') || text.includes('"authorization"') || text.includes('"bearer"') || text.includes('"private_key"') || text.includes('"access_token"') || text.includes('"refresh_token"') || text.includes('"client_secret"');
+  for (const anchor of ALL_ANCHORS) {
+    if (text.includes(anchor)) return true;
+  }
+  return false;
 }
 var DefaultSecretScrubber = class {
   scrub(text) {
@@ -388,6 +484,11 @@ var SECRET_NAME_PARTS = [
   "SECRET",
   "PASSWORD",
   "PASSWD",
+  // WRONGSTACK_VAULT_PASSPHRASE is the vault KEK. Without this entry it matched
+  // no rule here and fell through to the `WRONGSTACK_` prefix allow-rule, so the
+  // key that protects the credential vault was forwarded to every child process
+  // — including the agent's own exec/bash tools and MCP stdio servers (WS-033).
+  "PASSPHRASE",
   "AUTH",
   "CRED",
   "BEARER",
@@ -558,6 +659,65 @@ async function backupConfigFile(filePath, paths) {
   }
 }
 
+// src/utils/deep-merge.ts
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
+function isPrimitiveArray(a) {
+  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
+}
+function deepMerge(base, patch, options = {}) {
+  const {
+    conflictResolution = "prefer-patch",
+    arrayMode = "replace",
+    protectProto = true,
+    onNonPrimitiveArrayReplace
+  } = options;
+  if (typeof base !== "object" || base === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (typeof patch !== "object" || patch === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) && Array.isArray(patch)) {
+    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
+      return [.../* @__PURE__ */ new Set([...base, ...patch])];
+    }
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) || Array.isArray(patch)) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  const baseObj = base;
+  const patchObj = patch;
+  const out = { ...baseObj };
+  for (const [k, v] of Object.entries(patchObj)) {
+    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
+    const existing = out[k];
+    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
+      out[k] = deepMerge(existing, v, options);
+    } else if (Array.isArray(v) && Array.isArray(existing)) {
+      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
+        onNonPrimitiveArrayReplace(k, existing.length, v.length);
+      }
+      out[k] = deepMerge(existing, v, options);
+    } else if (v !== void 0) {
+      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
+        const existingLen = Array.isArray(existing) ? existing.length : 0;
+        onNonPrimitiveArrayReplace(k, existingLen, v.length);
+      }
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
 // src/utils/expect-defined.ts
 function expectDefined(value, label) {
   if (value === null || value === void 0) {
@@ -677,68 +837,137 @@ function isEmptyMessage(msg) {
 // src/types/config/runtime.ts
 var DEFAULT_TUI_THINKING_WORD = "thinking";
 
-// src/utils/deep-merge.ts
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype",
-  "__defineGetter__",
-  "__defineSetter__",
-  "__lookupGetter__",
-  "__lookupSetter__"
-]);
-function isPrimitiveArray(a) {
-  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
-}
-function deepMerge(base, patch, options = {}) {
-  const {
-    conflictResolution = "prefer-patch",
-    arrayMode = "replace",
-    protectProto = true,
-    onNonPrimitiveArrayReplace
-  } = options;
-  if (typeof base !== "object" || base === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (typeof patch !== "object" || patch === null) {
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) && Array.isArray(patch)) {
-    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
-      return [.../* @__PURE__ */ new Set([...base, ...patch])];
-    }
-    return conflictResolution === "prefer-patch" ? patch : base;
-  }
-  if (Array.isArray(base) || Array.isArray(patch)) {
-    return conflictResolution === "prefer-patch" ? patch : base;
+// src/utils/wstack-paths.ts
+import { createHash } from "node:crypto";
+import * as fs2 from "node:fs";
+import * as os from "node:os";
+import * as path2 from "node:path";
+function canonicalProjectRoot(absRoot) {
+  const checkoutRoot = path2.resolve(absRoot);
+  const dotGit = path2.join(checkoutRoot, ".git");
+  try {
+    if (!fs2.statSync(dotGit).isFile()) return checkoutRoot;
+    const gitDirLine = fs2.readFileSync(dotGit, "utf8").trim();
+    const match = /^gitdir:\s*(.+)$/i.exec(gitDirLine);
+    if (!match?.[1]) return checkoutRoot;
+    const gitDir = path2.resolve(checkoutRoot, match[1].trim());
+    const commonDirFile = path2.join(gitDir, "commondir");
+    if (!fs2.statSync(commonDirFile).isFile()) return checkoutRoot;
+    const commonDir = path2.resolve(gitDir, fs2.readFileSync(commonDirFile, "utf8").trim());
+    if (path2.basename(commonDir).toLowerCase() !== ".git") return checkoutRoot;
+    return path2.dirname(commonDir);
+  } catch {
+    return checkoutRoot;
   }
-  const baseObj = base;
-  const patchObj = patch;
-  const out = { ...baseObj };
-  for (const [k, v] of Object.entries(patchObj)) {
-    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
-    const existing = out[k];
-    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-      out[k] = deepMerge(existing, v, options);
-    } else if (Array.isArray(v) && Array.isArray(existing)) {
-      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
-        onNonPrimitiveArrayReplace(k, existing.length, v.length);
-      }
-      out[k] = deepMerge(existing, v, options);
-    } else if (v !== void 0) {
-      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
-        const existingLen = Array.isArray(existing) ? existing.length : 0;
-        onNonPrimitiveArrayReplace(k, existingLen, v.length);
-      }
-      out[k] = v;
-    }
+}
+function projectHash(absRoot) {
+  return createHash("sha256").update(canonicalProjectRoot(absRoot)).digest("hex").slice(0, 12);
+}
+function projectSlug(absRoot) {
+  const identityRoot = canonicalProjectRoot(absRoot);
+  const base = slugify(path2.basename(identityRoot));
+  const hash = createHash("sha256").update(identityRoot).digest("hex").slice(0, 6);
+  return `${base}-${hash}`;
+}
+function slugify(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
+}
+function safeProfileName(name) {
+  const safe = (name ?? "").replace(/[/\\:]/g, "_").replace(/\.\./g, "_").trim();
+  return safe || "default";
+}
+function activeProfileName(globalRoot) {
+  try {
+    const parsed = JSON.parse(fs2.readFileSync(path2.join(globalRoot, "config.json"), "utf8"));
+    return safeProfileName(typeof parsed.activeProfile === "string" ? parsed.activeProfile : void 0);
+  } catch {
+    return "default";
   }
-  return out;
+}
+function wstackGlobalRoot() {
+  const fromEnv = process.env["WRONGSTACK_HOME"];
+  if (fromEnv && fromEnv.trim().length > 0) return path2.resolve(fromEnv);
+  return path2.join(os.homedir(), ".wrongstack");
+}
+function resolveWstackPaths(opts) {
+  const globalRoot = opts.globalRoot ?? (opts.userHome ? path2.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
+  const homeDir = opts.userHome ?? os.homedir();
+  const profileName = safeProfileName(opts.profileName ?? activeProfileName(globalRoot));
+  const profileDir = path2.join(globalRoot, "profiles", profileName);
+  const hash = projectHash(opts.projectRoot);
+  const slug = projectSlug(opts.projectRoot);
+  const projectDir = path2.join(globalRoot, "projects", slug);
+  return {
+    globalRoot,
+    profileName,
+    profileDir,
+    projectRoot: opts.projectRoot,
+    homeDir,
+    configDir: profileDir,
+    globalConfig: path2.join(globalRoot, "config.json"),
+    profilesDir: path2.join(globalRoot, "profiles"),
+    profileConfig: (name) => {
+      return path2.join(globalRoot, "profiles", safeProfileName(name), "config.json");
+    },
+    profileStatuslineConfig: (name) => {
+      return path2.join(globalRoot, "profiles", safeProfileName(name), "statusline.json");
+    },
+    profileModeConfig: (name) => {
+      return path2.join(globalRoot, "profiles", safeProfileName(name), "mode.json");
+    },
+    profileProviderStatus: (name) => {
+      return path2.join(globalRoot, "profiles", safeProfileName(name), "provider-status.json");
+    },
+    profileUpdateCache: (name) => {
+      return path2.join(globalRoot, "profiles", safeProfileName(name), "update-cache.json");
+    },
+    secretsKey: path2.join(globalRoot, ".key"),
+    globalMemory: path2.join(profileDir, "memory.md"),
+    globalSkills: path2.join(profileDir, "skills"),
+    globalClaudeSkills: path2.join(homeDir, ".claude", "skills"),
+    globalDesignKits: path2.join(profileDir, "design-kits"),
+    globalPrompts: path2.join(profileDir, "prompts"),
+    globalInstructions: path2.join(profileDir, "instructions"),
+    promptUsage: path2.join(profileDir, "prompt-usage.json"),
+    cacheDir: path2.join(globalRoot, "cache"),
+    modelsCache: path2.join(globalRoot, "cache", "models.dev.json"),
+    modelsOverlayCache: path2.join(globalRoot, "cache", "models-overlay.json"),
+    historyFile: path2.join(profileDir, "history"),
+    logFile: path2.join(globalRoot, "logs", "wrongstack.log"),
+    projectDir,
+    projectCodebaseIndex: path2.join(projectDir, "codebase-index"),
+    projectMemory: path2.join(projectDir, "memory.md"),
+    projectSessions: path2.join(projectDir, "sessions"),
+    projectTrust: path2.join(projectDir, "trust.json"),
+    projectMeta: path2.join(projectDir, "meta.json"),
+    projectLocalConfig: path2.join(projectDir, "config.local.json"),
+    inProjectConfig: path2.join(opts.projectRoot, ".wrongstack", "config.json"),
+    inProjectAgentsFile: path2.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
+    inProjectSkills: path2.join(opts.projectRoot, ".wrongstack", "skills"),
+    inProjectClaudeSkills: path2.join(opts.projectRoot, ".claude", "skills"),
+    inProjectPrompts: path2.join(opts.projectRoot, ".wrongstack", "prompts"),
+    inProjectInstructions: path2.join(opts.projectRoot, ".wrongstack", "instructions"),
+    inProjectDesignKits: path2.join(opts.projectRoot, ".wrongstack", "design-kits"),
+    inProjectWorktrees: path2.join(opts.projectRoot, ".wrongstack", "worktrees"),
+    projectHash: hash,
+    projectSlug: slug,
+    projectGoal: path2.join(projectDir, "goal.json"),
+    projectInputHistory: path2.join(projectDir, "input-history.json"),
+    projectSpecs: path2.join(projectDir, "specs"),
+    projectTaskGraphs: path2.join(projectDir, "task-graphs"),
+    projectSddSession: path2.join(projectDir, "sdd-session.json"),
+    projectPlan: path2.join(projectDir, "plan.json"),
+    projectAutophase: path2.join(projectDir, "autophase"),
+    projectSddBoards: path2.join(projectDir, "sdd-boards"),
+    syncConfig: path2.join(profileDir, "sync.json"),
+    configHistoryDir: path2.join(globalRoot, "config-history"),
+    projectStatus: (projectHash2) => path2.join(globalRoot, "projects", projectHash2, "status.json")
+  };
 }
 
 // src/utils/instruction-file.ts
-import { readFileSync, statSync } from "node:fs";
-import * as path2 from "node:path";
+import { readFileSync as readFileSync2, statSync as statSync2 } from "node:fs";
+import * as path3 from "node:path";
 import { fileURLToPath } from "node:url";
 var textCache = /* @__PURE__ */ new Map();
 var rootCandidates;
@@ -748,7 +977,7 @@ function readBundledInstructionText(relativePath) {
   let resolved = "";
   for (const root of instructionRootCandidates()) {
     try {
-      resolved = readFileSync(path2.join(root, relativePath), "utf8").trimEnd();
+      resolved = readFileSync2(path3.join(root, relativePath), "utf8").trimEnd();
       break;
     } catch {
     }
@@ -764,18 +993,18 @@ function renderInstructionTemplate(template, values) {
 }
 function instructionRootCandidates() {
   if (rootCandidates !== void 0) return rootCandidates;
-  const here = path2.dirname(fileURLToPath(import.meta.url));
+  const here = path3.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    path2.resolve(here, "../../instructions"),
-    path2.resolve(here, "../instructions"),
-    path2.resolve(here, "instructions")
+    path3.resolve(here, "../../instructions"),
+    path3.resolve(here, "../instructions"),
+    path3.resolve(here, "instructions")
   ];
   rootCandidates = candidates.sort((a, b) => Number(!isDirectory(a)) - Number(!isDirectory(b)));
   return rootCandidates;
 }
 function isDirectory(candidate) {
   try {
-    return statSync(candidate).isDirectory();
+    return statSync2(candidate).isDirectory();
   } catch {
     return false;
   }
@@ -875,14 +1104,14 @@ function safeParse(input, maxBytes = 5e6) {
 }
 
 // src/utils/session-scoped-path.ts
-import * as path3 from "node:path";
+import * as path4 from "node:path";
 function sessionScopedPath(dir, sessionId, suffix) {
   if (!sessionId || sessionId.includes("\\") || sessionId.includes("..")) {
     throw invalid(sessionId);
   }
-  const resolved = path3.resolve(dir, `${sessionId}${suffix}`);
-  const rel = path3.relative(path3.resolve(dir), resolved);
-  if (rel.startsWith("..") || path3.isAbsolute(rel)) {
+  const resolved = path4.resolve(dir, `${sessionId}${suffix}`);
+  const rel = path4.relative(path4.resolve(dir), resolved);
+  if (rel.startsWith("..") || path4.isAbsolute(rel)) {
     throw invalid(sessionId);
   }
   return resolved;
@@ -897,144 +1126,33 @@ function invalid(sessionId) {
 }
 
 // src/utils/slug.ts
-function slugify(name, fallback = "prompt", maxLen = 64) {
+function slugify2(name, fallback = "prompt", maxLen = 64) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, maxLen).replace(/-+$/g, "") || fallback;
 }
 
-// src/utils/wstack-paths.ts
-import { createHash } from "node:crypto";
-import * as fs2 from "node:fs";
-import * as os from "node:os";
-import * as path4 from "node:path";
-function canonicalProjectRoot(absRoot) {
-  const checkoutRoot = path4.resolve(absRoot);
-  const dotGit = path4.join(checkoutRoot, ".git");
-  try {
-    if (!fs2.statSync(dotGit).isFile()) return checkoutRoot;
-    const gitDirLine = fs2.readFileSync(dotGit, "utf8").trim();
-    const match = /^gitdir:\s*(.+)$/i.exec(gitDirLine);
-    if (!match?.[1]) return checkoutRoot;
-    const gitDir = path4.resolve(checkoutRoot, match[1].trim());
-    const commonDirFile = path4.join(gitDir, "commondir");
-    if (!fs2.statSync(commonDirFile).isFile()) return checkoutRoot;
-    const commonDir = path4.resolve(gitDir, fs2.readFileSync(commonDirFile, "utf8").trim());
-    if (path4.basename(commonDir).toLowerCase() !== ".git") return checkoutRoot;
-    return path4.dirname(commonDir);
-  } catch {
-    return checkoutRoot;
+// src/storage/file-session-writer.ts
+import { closeSync, createReadStream, fsyncSync, openSync, writeSync } from "node:fs";
+import * as fsp2 from "node:fs/promises";
+import * as path5 from "node:path";
+import { createInterface } from "node:readline";
+
+// src/storage/session-workspace-checkpoints.ts
+function requiredCheckpointCas(checkpointCas, operation) {
+  if (!checkpointCas) {
+    throw new Error(`Workspace checkpoint ${operation} requires a projectRoot-aware session store`);
   }
+  return checkpointCas;
 }
-function projectHash(absRoot) {
-  return createHash("sha256").update(canonicalProjectRoot(absRoot)).digest("hex").slice(0, 12);
-}
-function projectSlug(absRoot) {
-  const identityRoot = canonicalProjectRoot(absRoot);
-  const base = slugify2(path4.basename(identityRoot));
-  const hash = createHash("sha256").update(identityRoot).digest("hex").slice(0, 6);
-  return `${base}-${hash}`;
-}
-function slugify2(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "project";
+function captureCheckpoint(checkpointCas, sessionId, promptIndex) {
+  return requiredCheckpointCas(checkpointCas, "capture").capture(sessionId, promptIndex);
 }
-function safeProfileName(name) {
-  const safe = (name ?? "").replace(/[/\\:]/g, "_").replace(/\.\./g, "_").trim();
-  return safe || "default";
-}
-function activeProfileName(globalRoot) {
-  try {
-    const parsed = JSON.parse(fs2.readFileSync(path4.join(globalRoot, "config.json"), "utf8"));
-    return safeProfileName(typeof parsed.activeProfile === "string" ? parsed.activeProfile : void 0);
-  } catch {
-    return "default";
-  }
-}
-function wstackGlobalRoot() {
-  const fromEnv = process.env["WRONGSTACK_HOME"];
-  if (fromEnv && fromEnv.trim().length > 0) return path4.resolve(fromEnv);
-  return path4.join(os.homedir(), ".wrongstack");
-}
-function resolveWstackPaths(opts) {
-  const globalRoot = opts.globalRoot ?? (opts.userHome ? path4.join(opts.userHome, ".wrongstack") : wstackGlobalRoot());
-  const homeDir = opts.userHome ?? os.homedir();
-  const profileName = safeProfileName(opts.profileName ?? activeProfileName(globalRoot));
-  const profileDir = path4.join(globalRoot, "profiles", profileName);
-  const hash = projectHash(opts.projectRoot);
-  const slug = projectSlug(opts.projectRoot);
-  const projectDir = path4.join(globalRoot, "projects", slug);
-  return {
-    globalRoot,
-    profileName,
-    profileDir,
-    projectRoot: opts.projectRoot,
-    homeDir,
-    configDir: profileDir,
-    globalConfig: path4.join(globalRoot, "config.json"),
-    profilesDir: path4.join(globalRoot, "profiles"),
-    profileConfig: (name) => {
-      return path4.join(globalRoot, "profiles", safeProfileName(name), "config.json");
-    },
-    profileStatuslineConfig: (name) => {
-      return path4.join(globalRoot, "profiles", safeProfileName(name), "statusline.json");
-    },
-    profileModeConfig: (name) => {
-      return path4.join(globalRoot, "profiles", safeProfileName(name), "mode.json");
-    },
-    profileProviderStatus: (name) => {
-      return path4.join(globalRoot, "profiles", safeProfileName(name), "provider-status.json");
-    },
-    profileUpdateCache: (name) => {
-      return path4.join(globalRoot, "profiles", safeProfileName(name), "update-cache.json");
-    },
-    secretsKey: path4.join(globalRoot, ".key"),
-    globalMemory: path4.join(profileDir, "memory.md"),
-    globalSkills: path4.join(profileDir, "skills"),
-    globalClaudeSkills: path4.join(homeDir, ".claude", "skills"),
-    globalDesignKits: path4.join(profileDir, "design-kits"),
-    globalPrompts: path4.join(profileDir, "prompts"),
-    globalInstructions: path4.join(profileDir, "instructions"),
-    promptUsage: path4.join(profileDir, "prompt-usage.json"),
-    cacheDir: path4.join(globalRoot, "cache"),
-    modelsCache: path4.join(globalRoot, "cache", "models.dev.json"),
-    modelsOverlayCache: path4.join(globalRoot, "cache", "models-overlay.json"),
-    historyFile: path4.join(profileDir, "history"),
-    logFile: path4.join(globalRoot, "logs", "wrongstack.log"),
-    projectDir,
-    projectCodebaseIndex: path4.join(projectDir, "codebase-index"),
-    projectMemory: path4.join(projectDir, "memory.md"),
-    projectSessions: path4.join(projectDir, "sessions"),
-    projectTrust: path4.join(projectDir, "trust.json"),
-    projectMeta: path4.join(projectDir, "meta.json"),
-    projectLocalConfig: path4.join(projectDir, "config.local.json"),
-    inProjectConfig: path4.join(opts.projectRoot, ".wrongstack", "config.json"),
-    inProjectAgentsFile: path4.join(opts.projectRoot, ".wrongstack", "AGENTS.md"),
-    inProjectSkills: path4.join(opts.projectRoot, ".wrongstack", "skills"),
-    inProjectClaudeSkills: path4.join(opts.projectRoot, ".claude", "skills"),
-    inProjectPrompts: path4.join(opts.projectRoot, ".wrongstack", "prompts"),
-    inProjectInstructions: path4.join(opts.projectRoot, ".wrongstack", "instructions"),
-    inProjectDesignKits: path4.join(opts.projectRoot, ".wrongstack", "design-kits"),
-    inProjectWorktrees: path4.join(opts.projectRoot, ".wrongstack", "worktrees"),
-    projectHash: hash,
-    projectSlug: slug,
-    projectGoal: path4.join(projectDir, "goal.json"),
-    projectInputHistory: path4.join(projectDir, "input-history.json"),
-    projectSpecs: path4.join(projectDir, "specs"),
-    projectTaskGraphs: path4.join(projectDir, "task-graphs"),
-    projectSddSession: path4.join(projectDir, "sdd-session.json"),
-    projectPlan: path4.join(projectDir, "plan.json"),
-    projectAutophase: path4.join(projectDir, "autophase"),
-    projectSddBoards: path4.join(projectDir, "sdd-boards"),
-    syncConfig: path4.join(profileDir, "sync.json"),
-    configHistoryDir: path4.join(globalRoot, "config-history"),
-    projectStatus: (projectHash2) => path4.join(globalRoot, "projects", projectHash2, "status.json")
-  };
+function materializeCheckpoint(checkpointCas, checkpoint, targetRoot) {
+  return requiredCheckpointCas(checkpointCas, "materialization").materialize(
+    checkpoint,
+    targetRoot
+  );
 }
 
-// src/storage/file-session-writer.ts
-import { closeSync, createReadStream, fsyncSync, openSync, writeSync } from "node:fs";
-import * as fsp2 from "node:fs/promises";
-import * as path5 from "node:path";
-import { createInterface } from "node:readline";
-
 // src/storage/session-helpers.ts
 function consumeControlString(value, start) {
   let index = start;
@@ -2010,7 +2128,8 @@ var FileSessionWriter = class _FileSessionWriter {
       promptIndex,
       promptPreview,
       ts: (/* @__PURE__ */ new Date()).toISOString(),
-      fileCount
+      fileCount,
+      ...workspaceCheckpoint ? { workspaceCheckpoint } : {}
     });
   }
   async writeFileSnapshot(promptIndex, files) {
@@ -2742,57 +2861,82 @@ function formatInterruptedToolNotice(pendingToolUseCount) {
   ].join("\n");
 }
 
-// src/storage/session-store/index-reader.ts
+// src/storage/session-store/delete-session-artifacts.ts
 import * as fsp5 from "node:fs/promises";
-function applySessionIndexLines(raw, byId, deleted) {
-  for (const line of raw.split("\n")) {
-    if (!line.trim()) continue;
-    try {
-      const entry = JSON.parse(line);
-      if (entry.action === "delete" && entry.id) {
-        deleted.add(entry.id);
-        byId.delete(entry.id);
-        continue;
-      }
-      if (entry.id && !deleted.has(entry.id)) {
-        byId.set(entry.id, entry);
-      }
-    } catch {
+import * as path10 from "node:path";
+
+// src/storage/session-store/paths.ts
+import * as path9 from "node:path";
+function sessionPath(storeDir, id, ext) {
+  return sessionScopedPath(storeDir, id, ext);
+}
+function shardManifestPath(storeDir, shardKey) {
+  return shardKey ? path9.join(storeDir, shardKey, "_manifest.json") : path9.join(storeDir, "_manifest.json");
+}
+function shardKeyForSessionId(id) {
+  const dirName = path9.dirname(id);
+  return dirName === "." ? "" : dirName;
+}
+async function ensureShardDir(storeDir, id) {
+  const dirPath = path9.dirname(sessionScopedPath(storeDir, id, ""));
+  await ensureDir(dirPath);
+  return dirPath;
+}
+
+// src/storage/session-store/delete-session-artifacts.ts
+async function deleteSessionArtifacts({
+  rootDir,
+  id,
+  jsonlPath
+}) {
+  const shardDir = path10.dirname(jsonlPath);
+  const base = path10.basename(id);
+  const sessDir = path10.join(shardDir, base);
+  const deletions = [
+    fsp5.unlink(jsonlPath),
+    fsp5.unlink(sessionPath(rootDir, id, ".summary.json")),
+    fsp5.unlink(sessionPath(rootDir, id, ".plan.json")),
+    fsp5.unlink(sessionPath(rootDir, id, ".tasks.json")),
+    fsp5.unlink(sessionPath(rootDir, id, ".todos.json"))
+  ];
+  const results = await Promise.allSettled(deletions);
+  for (const result of results) {
+    if (result.status === "rejected") {
+      warnDeleteFailure(id, result.reason);
     }
   }
+  await fsp5.rm(sessDir, { recursive: true, force: true }).catch((err) => {
+    console.warn(
+      JSON.stringify({
+        level: "warn",
+        event: "session_store.rmdir_failed",
+        sessionId: id,
+        message: toErrorMessage(err),
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      })
+    );
+  });
 }
-async function readFileRange(file, start, end) {
-  const length = end - start;
-  if (length <= 0) return { raw: "", end: start };
-  const buffer = Buffer.allocUnsafe(length);
-  let offset = 0;
-  let handle;
-  try {
-    handle = await fsp5.open(file, "r");
-    while (offset < length) {
-      const { bytesRead } = await handle.read(buffer, offset, length - offset, start + offset);
-      if (bytesRead === 0) return null;
-      offset += bytesRead;
-    }
-    let completeLength = buffer.length;
-    if (buffer.at(-1) !== 10) {
-      const lastNewline = buffer.lastIndexOf(10);
-      const trailing = buffer.subarray(lastNewline + 1).toString("utf8").trim();
-      try {
-        if (trailing) JSON.parse(trailing);
-        else completeLength = lastNewline + 1;
-      } catch {
-        completeLength = lastNewline + 1;
-      }
-    }
-    return {
-      raw: buffer.subarray(0, completeLength).toString("utf8"),
-      end: start + completeLength
-    };
-  } catch {
-    return null;
-  } finally {
-    await handle?.close().catch(() => void 0);
+function warnDeleteFailure(id, reason) {
+  const msg = reason instanceof Error ? reason.message : String(reason);
+  if (reason?.code === "ENOENT") return;
+  console.warn(
+    JSON.stringify({
+      level: "warn",
+      event: "session_store.delete_failed",
+      sessionId: id,
+      message: msg,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    })
+  );
+}
+
+// src/storage/session-store/delete-session-guards.ts
+async function assertSessionCanBeDeleted(sessionId, isSessionInUse) {
+  if (!isSessionInUse) return;
+  const reason = await isSessionInUse(sessionId);
+  if (reason) {
+    throw new Error(`Session ${sessionId} is in use (${reason}) and cannot be deleted.`);
   }
 }
 
@@ -2806,7 +2950,7 @@ function isSessionJsonlFileName(name) {
 
 // src/storage/session-store/directory-session-files.ts
 import * as fsp6 from "node:fs/promises";
-import * as path9 from "node:path";
+import * as path11 from "node:path";
 function sessionIdForFile(prefix, name) {
   const base = name.replace(/\.jsonl$/, "");
   return prefix ? `${prefix}/${base}` : base;
@@ -2828,12 +2972,12 @@ async function collectSessionFiles(dir, prefix = "", depth = 0) {
     if (entry.isDirectory()) {
       dirEntries.push(entry);
     } else if (entry.isFile() && isSessionJsonlFileName(entry.name)) {
-      files.push({ id: sessionIdForFile(prefix, entry.name), filePath: path9.join(dir, entry.name) });
+      files.push({ id: sessionIdForFile(prefix, entry.name), filePath: path11.join(dir, entry.name) });
     }
   }
   const childFileArrays = await Promise.all(
     dirEntries.map(
-      (entry) => collectSessionFiles(path9.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
+      (entry) => collectSessionFiles(path11.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
     )
   );
   return [...childFileArrays.flat(), ...files];
@@ -2857,236 +3001,61 @@ async function collectSessionIds(dir, prefix = "", depth = 0) {
   }
   const childIdArrays = await Promise.all(
     dirEntries.map(
-      (entry) => collectSessionIds(path9.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
+      (entry) => collectSessionIds(path11.join(dir, entry.name), childPrefixFor(entry, prefix, depth), depth + 1)
     )
   );
   return [...childIdArrays.flat(), ...fileIds];
 }
 
-// src/storage/session-store/delete-session-artifacts.ts
-import * as fsp7 from "node:fs/promises";
-import * as path11 from "node:path";
-
-// src/storage/session-store/paths.ts
-import * as path10 from "node:path";
-function sessionPath(storeDir, id, ext) {
-  return sessionScopedPath(storeDir, id, ext);
-}
-function shardManifestPath(storeDir, shardKey) {
-  return shardKey ? path10.join(storeDir, shardKey, "_manifest.json") : path10.join(storeDir, "_manifest.json");
-}
-function shardKeyForSessionId(id) {
-  const dirName = path10.dirname(id);
-  return dirName === "." ? "" : dirName;
-}
-async function ensureShardDir(storeDir, id) {
-  const dirPath = path10.dirname(sessionScopedPath(storeDir, id, ""));
-  await ensureDir(dirPath);
-  return dirPath;
+// src/storage/session-store/events.ts
+function emitSessionStoreRead(events, sessionId, filePath, operation, outcome, durationMs, error) {
+  events?.emit("storage.read", {
+    sessionId,
+    store: "session",
+    filePath,
+    operation,
+    outcome,
+    durationMs,
+    ...error !== void 0 ? { error } : {}
+  });
 }
-
-// src/storage/session-store/delete-session-artifacts.ts
-async function deleteSessionArtifacts({
-  rootDir,
-  id,
-  jsonlPath
-}) {
-  const shardDir = path11.dirname(jsonlPath);
-  const base = path11.basename(id);
-  const sessDir = path11.join(shardDir, base);
-  const deletions = [
-    fsp7.unlink(jsonlPath),
-    fsp7.unlink(sessionPath(rootDir, id, ".summary.json")),
-    fsp7.unlink(sessionPath(rootDir, id, ".plan.json")),
-    fsp7.unlink(sessionPath(rootDir, id, ".tasks.json")),
-    fsp7.unlink(sessionPath(rootDir, id, ".todos.json"))
-  ];
-  const results = await Promise.allSettled(deletions);
-  for (const result of results) {
-    if (result.status === "rejected") {
-      warnDeleteFailure(id, result.reason);
-    }
-  }
-  await fsp7.rm(sessDir, { recursive: true, force: true }).catch((err) => {
-    console.warn(
-      JSON.stringify({
-        level: "warn",
-        event: "session_store.rmdir_failed",
-        sessionId: id,
-        message: toErrorMessage(err),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })
-    );
+function emitSessionStoreWrite(events, sessionId, filePath, operation, outcome, durationMs, eventCount, error) {
+  events?.emit("storage.write", {
+    sessionId,
+    store: "session",
+    filePath,
+    operation,
+    outcome,
+    durationMs,
+    ...eventCount !== void 0 ? { eventCount } : {},
+    ...error !== void 0 ? { error } : {}
   });
 }
-function warnDeleteFailure(id, reason) {
-  const msg = reason instanceof Error ? reason.message : String(reason);
-  if (reason?.code === "ENOENT") return;
-  console.warn(
-    JSON.stringify({
-      level: "warn",
-      event: "session_store.delete_failed",
-      sessionId: id,
-      message: msg,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    })
-  );
+function emitSessionStoreError(events, sessionId, filePath, operation, error, recoverable) {
+  events?.emit("storage.error", {
+    sessionId,
+    store: "session",
+    filePath,
+    operation,
+    error,
+    recoverable
+  });
 }
 
-// src/storage/session-store/delete-session-guards.ts
-async function assertSessionCanBeDeleted(sessionId, isSessionInUse) {
-  if (!isSessionInUse) return;
-  const reason = await isSessionInUse(sessionId);
-  if (reason) {
-    throw new Error(`Session ${sessionId} is in use (${reason}) and cannot be deleted.`);
-  }
-}
-
-// src/storage/session-store/load-cache.ts
-var LOAD_CACHE_MAX_ENTRIES = 50;
-var LOAD_CACHE_MAX_BYTES = 64 * 1024 * 1024;
-var SessionLoadCache = class {
-  constructor(entries = /* @__PURE__ */ new Map()) {
-    this.entries = entries;
-  }
-  entries;
-  bytes = 0;
-  clear(sessionId) {
-    if (sessionId !== void 0) {
-      this.delete(sessionId);
-      return;
-    }
-    this.entries.clear();
-    this.bytes = 0;
-  }
-  getFresh(id, stat15, full) {
-    const cached = this.entries.get(id);
-    if (!cached || cached.mtimeMs !== stat15.mtimeMs || cached.size !== stat15.size) {
-      return null;
-    }
-    this.entries.delete(id);
-    this.entries.set(id, cached);
-    if (full) return cached.data;
-    return { ...cached.data, messages: [] };
-  }
-  set(id, stat15, data) {
-    this.delete(id);
-    while (stat15.size <= LOAD_CACHE_MAX_BYTES && (this.entries.size >= LOAD_CACHE_MAX_ENTRIES || this.bytes + stat15.size > LOAD_CACHE_MAX_BYTES)) {
-      const oldest = this.entries.keys().next().value;
-      if (oldest === void 0) break;
-      this.delete(oldest);
-    }
-    if (stat15.size <= LOAD_CACHE_MAX_BYTES) {
-      this.entries.set(id, { mtimeMs: stat15.mtimeMs, size: stat15.size, data });
-      this.bytes += stat15.size;
-    }
-  }
-  delete(sessionId) {
-    const cached = this.entries.get(sessionId);
-    if (cached) this.bytes = Math.max(0, this.bytes - cached.size);
-    this.entries.delete(sessionId);
-  }
-};
-
-// src/storage/session-store/prune-helpers.ts
-import * as fsp8 from "node:fs/promises";
-import * as path12 from "node:path";
-function isPrunableSessionJsonl(name) {
-  return name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
-}
-async function pruneSessionFiles(storeDir, maxAgeDays, deleteSession) {
-  const cutoff = Date.now() - maxAgeDays * 864e5;
-  let deleted = 0;
-  const pruneFile = async (dir, name, prefix) => {
-    const jsonlPath = path12.join(dir, name);
-    try {
-      const stat15 = await fsp8.stat(jsonlPath);
-      if (stat15.mtimeMs >= cutoff) return;
-    } catch {
-      return;
-    }
-    const base = name.replace(/\.jsonl$/, "");
-    const id = prefix ? `${prefix}/${base}` : base;
-    await deleteSession(id);
-    deleted++;
-  };
-  const entries = await fsp8.readdir(storeDir, { withFileTypes: true }).catch(() => []);
-  for (const entry of entries) {
-    if (entry.isFile()) {
-      if (isPrunableSessionJsonl(entry.name)) await pruneFile(storeDir, entry.name, "");
-      continue;
-    }
-    if (!entry.isDirectory()) continue;
-    const dateDir = path12.join(storeDir, entry.name);
-    const files = await fsp8.readdir(dateDir, { withFileTypes: true }).catch(() => []);
-    for (const file of files) {
-      if (!file.isFile() || !isPrunableSessionJsonl(file.name)) continue;
-      await pruneFile(dateDir, file.name, entry.name);
-    }
-  }
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const dateDir = path12.join(storeDir, entry.name);
-    try {
-      const remaining = await fsp8.readdir(dateDir);
-      if (remaining.length === 0) {
-        await fsp8.rmdir(dateDir).catch(() => void 0);
-      }
-    } catch {
-    }
-  }
-  return deleted;
-}
-
-// src/storage/session-store/events.ts
-function emitSessionStoreRead(events, sessionId, filePath, operation, outcome, durationMs, error) {
-  events?.emit("storage.read", {
-    sessionId,
-    store: "session",
-    filePath,
-    operation,
-    outcome,
-    durationMs,
-    ...error !== void 0 ? { error } : {}
-  });
-}
-function emitSessionStoreWrite(events, sessionId, filePath, operation, outcome, durationMs, eventCount, error) {
-  events?.emit("storage.write", {
-    sessionId,
-    store: "session",
-    filePath,
-    operation,
-    outcome,
-    durationMs,
-    ...eventCount !== void 0 ? { eventCount } : {},
-    ...error !== void 0 ? { error } : {}
-  });
-}
-function emitSessionStoreError(events, sessionId, filePath, operation, error, recoverable) {
-  events?.emit("storage.error", {
-    sessionId,
-    store: "session",
-    filePath,
-    operation,
-    error,
-    recoverable
-  });
-}
-
-// src/storage/session-store/fork-session.ts
-import { createHash as createHash4 } from "node:crypto";
-
-// src/storage/session-store/replay.ts
-function isReplayableMessage(value) {
-  if (!value || typeof value !== "object") return false;
-  const candidate = value;
-  return (candidate.role === "user" || candidate.role === "assistant" || candidate.role === "system") && (typeof candidate.content === "string" || Array.isArray(candidate.content));
-}
-function trackMessageToolState(message, openToolUses) {
-  if (!Array.isArray(message.content)) return;
-  for (const block of message.content) {
-    if (block.type === "tool_use") openToolUses.add(block.id);
-    else if (block.type === "tool_result") openToolUses.delete(block.tool_use_id);
+// src/storage/session-store/fork-session.ts
+import { createHash as createHash4 } from "node:crypto";
+
+// src/storage/session-store/replay.ts
+function isReplayableMessage(value) {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  return (candidate.role === "user" || candidate.role === "assistant" || candidate.role === "system") && (typeof candidate.content === "string" || Array.isArray(candidate.content));
+}
+function trackMessageToolState(message, openToolUses) {
+  if (!Array.isArray(message.content)) return;
+  for (const block of message.content) {
+    if (block.type === "tool_use") openToolUses.add(block.id);
+    else if (block.type === "tool_result") openToolUses.delete(block.tool_use_id);
   }
 }
 function replayableMessage(value, fallbackTs) {
@@ -3187,6 +3156,106 @@ async function forkSession(host, id, opts = {}) {
   }
 }
 
+// src/storage/session-store/index-reader.ts
+import * as fsp7 from "node:fs/promises";
+function applySessionIndexLines(raw, byId, deleted) {
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const entry = JSON.parse(line);
+      if (entry.action === "delete" && entry.id) {
+        deleted.add(entry.id);
+        byId.delete(entry.id);
+        continue;
+      }
+      if (entry.id && !deleted.has(entry.id)) {
+        byId.set(entry.id, entry);
+      }
+    } catch {
+    }
+  }
+}
+async function readFileRange(file, start, end) {
+  const length = end - start;
+  if (length <= 0) return { raw: "", end: start };
+  const buffer = Buffer.allocUnsafe(length);
+  let offset = 0;
+  let handle;
+  try {
+    handle = await fsp7.open(file, "r");
+    while (offset < length) {
+      const { bytesRead } = await handle.read(buffer, offset, length - offset, start + offset);
+      if (bytesRead === 0) return null;
+      offset += bytesRead;
+    }
+    let completeLength = buffer.length;
+    if (buffer.at(-1) !== 10) {
+      const lastNewline = buffer.lastIndexOf(10);
+      const trailing = buffer.subarray(lastNewline + 1).toString("utf8").trim();
+      try {
+        if (trailing) JSON.parse(trailing);
+        else completeLength = lastNewline + 1;
+      } catch {
+        completeLength = lastNewline + 1;
+      }
+    }
+    return {
+      raw: buffer.subarray(0, completeLength).toString("utf8"),
+      end: start + completeLength
+    };
+  } catch {
+    return null;
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+
+// src/storage/session-store/load-cache.ts
+var LOAD_CACHE_MAX_ENTRIES = 50;
+var LOAD_CACHE_MAX_BYTES = 64 * 1024 * 1024;
+var SessionLoadCache = class {
+  constructor(entries = /* @__PURE__ */ new Map()) {
+    this.entries = entries;
+  }
+  entries;
+  bytes = 0;
+  clear(sessionId) {
+    if (sessionId !== void 0) {
+      this.delete(sessionId);
+      return;
+    }
+    this.entries.clear();
+    this.bytes = 0;
+  }
+  getFresh(id, stat15, full) {
+    const cached = this.entries.get(id);
+    if (!cached || cached.mtimeMs !== stat15.mtimeMs || cached.size !== stat15.size) {
+      return null;
+    }
+    this.entries.delete(id);
+    this.entries.set(id, cached);
+    if (full) return cached.data;
+    return { ...cached.data, messages: [] };
+  }
+  set(id, stat15, data) {
+    this.delete(id);
+    while (stat15.size <= LOAD_CACHE_MAX_BYTES && (this.entries.size >= LOAD_CACHE_MAX_ENTRIES || this.bytes + stat15.size > LOAD_CACHE_MAX_BYTES)) {
+      const oldest = this.entries.keys().next().value;
+      if (oldest === void 0) break;
+      this.delete(oldest);
+    }
+    if (stat15.size <= LOAD_CACHE_MAX_BYTES) {
+      this.entries.set(id, { mtimeMs: stat15.mtimeMs, size: stat15.size, data });
+      this.bytes += stat15.size;
+    }
+  }
+  delete(sessionId) {
+    const cached = this.entries.get(sessionId);
+    if (cached) this.bytes = Math.max(0, this.bytes - cached.size);
+    this.entries.delete(sessionId);
+  }
+};
+
 // src/storage/session-store/load-session-data.ts
 import { createReadStream as createReadStream2 } from "node:fs";
 import { createInterface as createInterface2 } from "node:readline";
@@ -3426,19 +3495,191 @@ function replaySessionEvent(params) {
   }
   return { exactJournalActive };
 }
-function accumulateUsage(usage, ev) {
-  return {
-    input: usage.input + (ev.usage.input ?? 0),
-    output: usage.output + (ev.usage.output ?? 0),
-    cacheRead: (usage.cacheRead ?? 0) + (ev.usage.cacheRead ?? 0),
-    cacheWrite: (usage.cacheWrite ?? 0) + (ev.usage.cacheWrite ?? 0)
-  };
+function accumulateUsage(usage, ev) {
+  return {
+    input: usage.input + (ev.usage.input ?? 0),
+    output: usage.output + (ev.usage.output ?? 0),
+    cacheRead: (usage.cacheRead ?? 0) + (ev.usage.cacheRead ?? 0),
+    cacheWrite: (usage.cacheWrite ?? 0) + (ev.usage.cacheWrite ?? 0)
+  };
+}
+function emitDamaged(params, detail) {
+  params.events?.emit("session.damaged", {
+    sessionId: params.id,
+    detail
+  });
+}
+
+// src/storage/session-store/prune-helpers.ts
+import * as fsp8 from "node:fs/promises";
+import * as path12 from "node:path";
+function isPrunableSessionJsonl(name) {
+  return name.endsWith(".jsonl") && name !== "_index.jsonl" && name !== "_mailbox.jsonl" && !name.endsWith(".replay.jsonl") && !name.endsWith(".audit.jsonl");
+}
+async function pruneSessionFiles(storeDir, maxAgeDays, deleteSession) {
+  const cutoff = Date.now() - maxAgeDays * 864e5;
+  let deleted = 0;
+  const pruneFile = async (dir, name, prefix) => {
+    const jsonlPath = path12.join(dir, name);
+    try {
+      const stat15 = await fsp8.stat(jsonlPath);
+      if (stat15.mtimeMs >= cutoff) return;
+    } catch {
+      return;
+    }
+    const base = name.replace(/\.jsonl$/, "");
+    const id = prefix ? `${prefix}/${base}` : base;
+    await deleteSession(id);
+    deleted++;
+  };
+  const entries = await fsp8.readdir(storeDir, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    if (entry.isFile()) {
+      if (isPrunableSessionJsonl(entry.name)) await pruneFile(storeDir, entry.name, "");
+      continue;
+    }
+    if (!entry.isDirectory()) continue;
+    const dateDir = path12.join(storeDir, entry.name);
+    const files = await fsp8.readdir(dateDir, { withFileTypes: true }).catch(() => []);
+    for (const file of files) {
+      if (!file.isFile() || !isPrunableSessionJsonl(file.name)) continue;
+      await pruneFile(dateDir, file.name, entry.name);
+    }
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const dateDir = path12.join(storeDir, entry.name);
+    try {
+      const remaining = await fsp8.readdir(dateDir);
+      if (remaining.length === 0) {
+        await fsp8.rmdir(dateDir).catch(() => void 0);
+      }
+    } catch {
+    }
+  }
+  return deleted;
+}
+
+// src/storage/session-store/search-events.ts
+import * as fsp9 from "node:fs/promises";
+async function searchSessionEvents(args) {
+  const { file, secretScrubber, predicate, limit, signal } = args;
+  const out = [];
+  let stat15;
+  try {
+    stat15 = await fsp9.stat(file);
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  if (stat15.size === 0) return [];
+  let fh;
+  try {
+    fh = await fsp9.open(file, "r");
+    const CHUNK = 64 * 1024;
+    const buf = Buffer.alloc(CHUNK);
+    let leftover = "";
+    let eventIndex = 0;
+    for (let position = 0; ; position += buf.byteLength) {
+      if (signal?.aborted) {
+        const reason = signal.reason ?? new DOMException("Aborted", "AbortError");
+        throw reason;
+      }
+      const { bytesRead } = await fh.read(buf, 0, CHUNK, position);
+      if (bytesRead === 0) break;
+      const text = leftover + buf.subarray(0, bytesRead).toString("utf8");
+      const parts = text.split("\n");
+      leftover = parts.pop() ?? "";
+      for (const line of parts) {
+        if (!line) continue;
+        const ev = parseSessionEventLine(line, secretScrubber);
+        if (!ev) continue;
+        if (predicate(ev, eventIndex, ev.ts)) {
+          out.push({ event: ev, eventIndex, ts: ev.ts });
+          if (limit !== void 0 && out.length >= limit) return out;
+        }
+        eventIndex++;
+      }
+    }
+    const trailing = parseSessionEventLine(leftover.trim() ? leftover : "", secretScrubber);
+    if (trailing && predicate(trailing, eventIndex, trailing.ts)) {
+      out.push({ event: trailing, eventIndex, ts: trailing.ts });
+    }
+    return out;
+  } finally {
+    if (fh) await fh.close().catch(() => void 0);
+  }
+}
+function parseSessionEventLine(line, secretScrubber) {
+  if (!line) return null;
+  try {
+    const parsed = JSON.parse(line);
+    if (parsed === null || typeof parsed !== "object" || typeof parsed.type !== "string" || typeof parsed.ts !== "string") {
+      return null;
+    }
+    return scrubPersistedSessionEvent(parsed, secretScrubber);
+  } catch {
+    return null;
+  }
+}
+
+// src/storage/session-store/shard-manifest.ts
+import * as fsp10 from "node:fs/promises";
+
+// src/storage/session-summary.ts
+function compareSessionSummaries(a, b) {
+  const aActivity = a.lastActivityAt ?? a.endedAt ?? a.startedAt;
+  const bActivity = b.lastActivityAt ?? b.endedAt ?? b.startedAt;
+  if (aActivity < bActivity) return 1;
+  if (aActivity > bActivity) return -1;
+  if (a.startedAt < b.startedAt) return 1;
+  if (a.startedAt > b.startedAt) return -1;
+  return a.id.localeCompare(b.id);
+}
+function matchesSessionFilter(summary, criteria) {
+  if (criteria.since && summary.startedAt < criteria.since) return false;
+  if (criteria.until && summary.startedAt > criteria.until) return false;
+  if (criteria.provider && summary.provider !== criteria.provider) return false;
+  if (criteria.model && summary.model !== criteria.model) return false;
+  if (criteria.minTokens !== void 0 && summary.tokenTotal < criteria.minTokens) return false;
+  if (criteria.titleContains) {
+    const needle = criteria.titleContains.toLocaleLowerCase();
+    if (!summary.title.toLocaleLowerCase().includes(needle)) return false;
+  }
+  return true;
 }
-function emitDamaged(params, detail) {
-  params.events?.emit("session.damaged", {
-    sessionId: params.id,
-    detail
-  });
+
+// src/storage/session-store/shard-manifest.ts
+async function readOrBuildShardManifestEntry(opts) {
+  try {
+    const raw = await fsp10.readFile(opts.manifestPath, "utf8");
+    const parsed = JSON.parse(raw);
+    return {
+      summaries: Array.isArray(parsed.summaries) ? parsed.summaries : [],
+      ids: Array.isArray(parsed.ids) ? parsed.ids : []
+    };
+  } catch {
+  }
+  const refs = await opts.collectSessionFilesInShard(opts.shardKey);
+  const candidates = await mapWithConcurrency(
+    refs,
+    opts.concurrency,
+    async (ref) => {
+      const manifest = await opts.readSummaryManifest(ref.id);
+      if (manifest) return { summary: manifest, needsBackfill: false };
+      const summary = await opts.summaryHeaderFor(ref);
+      if (!summary) return null;
+      const hydrated = await opts.summaryFor(summary.id).catch(() => summary);
+      return { summary: hydrated, needsBackfill: false };
+    }
+  );
+  const summaries = candidates.filter((candidate) => candidate !== null).map((candidate) => candidate.summary);
+  summaries.sort(compareSessionSummaries);
+  const entry = { summaries, ids: summaries.map((summary) => summary.id) };
+  await atomicWrite(opts.manifestPath, JSON.stringify(entry), { mode: 384 }).catch(
+    () => void 0
+  );
+  return entry;
 }
 
 // src/storage/session-store/summary-builder.ts
@@ -3580,11 +3821,11 @@ async function* iterateSessionEvents(file, secretScrubber) {
 }
 
 // src/storage/session-store/summary-header.ts
-import * as fsp9 from "node:fs/promises";
+import * as fsp11 from "node:fs/promises";
 async function readSessionSummaryHeader(ref, secretScrubber) {
   let mtime = (/* @__PURE__ */ new Date(0)).toISOString();
   try {
-    const stat15 = await fsp9.stat(ref.filePath);
+    const stat15 = await fsp11.stat(ref.filePath);
     if (!stat15.isFile()) return damagedSummary(ref.id, stat15.mtime.toISOString());
     mtime = stat15.mtime.toISOString();
   } catch {
@@ -3629,128 +3870,6 @@ function damagedSummary(id, startedAt) {
   };
 }
 
-// src/storage/session-store/shard-manifest.ts
-import * as fsp10 from "node:fs/promises";
-
-// src/storage/session-summary.ts
-function compareSessionSummaries(a, b) {
-  const aActivity = a.lastActivityAt ?? a.endedAt ?? a.startedAt;
-  const bActivity = b.lastActivityAt ?? b.endedAt ?? b.startedAt;
-  if (aActivity < bActivity) return 1;
-  if (aActivity > bActivity) return -1;
-  if (a.startedAt < b.startedAt) return 1;
-  if (a.startedAt > b.startedAt) return -1;
-  return a.id.localeCompare(b.id);
-}
-function matchesSessionFilter(summary, criteria) {
-  if (criteria.since && summary.startedAt < criteria.since) return false;
-  if (criteria.until && summary.startedAt > criteria.until) return false;
-  if (criteria.provider && summary.provider !== criteria.provider) return false;
-  if (criteria.model && summary.model !== criteria.model) return false;
-  if (criteria.minTokens !== void 0 && summary.tokenTotal < criteria.minTokens) return false;
-  if (criteria.titleContains) {
-    const needle = criteria.titleContains.toLocaleLowerCase();
-    if (!summary.title.toLocaleLowerCase().includes(needle)) return false;
-  }
-  return true;
-}
-
-// src/storage/session-store/shard-manifest.ts
-async function readOrBuildShardManifestEntry(opts) {
-  try {
-    const raw = await fsp10.readFile(opts.manifestPath, "utf8");
-    const parsed = JSON.parse(raw);
-    return {
-      summaries: Array.isArray(parsed.summaries) ? parsed.summaries : [],
-      ids: Array.isArray(parsed.ids) ? parsed.ids : []
-    };
-  } catch {
-  }
-  const refs = await opts.collectSessionFilesInShard(opts.shardKey);
-  const candidates = await mapWithConcurrency(
-    refs,
-    opts.concurrency,
-    async (ref) => {
-      const manifest = await opts.readSummaryManifest(ref.id);
-      if (manifest) return { summary: manifest, needsBackfill: false };
-      const summary = await opts.summaryHeaderFor(ref);
-      if (!summary) return null;
-      const hydrated = await opts.summaryFor(summary.id).catch(() => summary);
-      return { summary: hydrated, needsBackfill: false };
-    }
-  );
-  const summaries = candidates.filter((candidate) => candidate !== null).map((candidate) => candidate.summary);
-  summaries.sort(compareSessionSummaries);
-  const entry = { summaries, ids: summaries.map((summary) => summary.id) };
-  await atomicWrite(opts.manifestPath, JSON.stringify(entry), { mode: 384 }).catch(
-    () => void 0
-  );
-  return entry;
-}
-
-// src/storage/session-store/search-events.ts
-import * as fsp11 from "node:fs/promises";
-async function searchSessionEvents(args) {
-  const { file, secretScrubber, predicate, limit, signal } = args;
-  const out = [];
-  let stat15;
-  try {
-    stat15 = await fsp11.stat(file);
-  } catch (err) {
-    if (err.code === "ENOENT") return [];
-    throw err;
-  }
-  if (stat15.size === 0) return [];
-  let fh;
-  try {
-    fh = await fsp11.open(file, "r");
-    const CHUNK = 64 * 1024;
-    const buf = Buffer.alloc(CHUNK);
-    let leftover = "";
-    let eventIndex = 0;
-    for (let position = 0; ; position += buf.byteLength) {
-      if (signal?.aborted) {
-        const reason = signal.reason ?? new DOMException("Aborted", "AbortError");
-        throw reason;
-      }
-      const { bytesRead } = await fh.read(buf, 0, CHUNK, position);
-      if (bytesRead === 0) break;
-      const text = leftover + buf.subarray(0, bytesRead).toString("utf8");
-      const parts = text.split("\n");
-      leftover = parts.pop() ?? "";
-      for (const line of parts) {
-        if (!line) continue;
-        const ev = parseSessionEventLine(line, secretScrubber);
-        if (!ev) continue;
-        if (predicate(ev, eventIndex, ev.ts)) {
-          out.push({ event: ev, eventIndex, ts: ev.ts });
-          if (limit !== void 0 && out.length >= limit) return out;
-        }
-        eventIndex++;
-      }
-    }
-    const trailing = parseSessionEventLine(leftover.trim() ? leftover : "", secretScrubber);
-    if (trailing && predicate(trailing, eventIndex, trailing.ts)) {
-      out.push({ event: trailing, eventIndex, ts: trailing.ts });
-    }
-    return out;
-  } finally {
-    if (fh) await fh.close().catch(() => void 0);
-  }
-}
-function parseSessionEventLine(line, secretScrubber) {
-  if (!line) return null;
-  try {
-    const parsed = JSON.parse(line);
-    if (parsed === null || typeof parsed !== "object" || typeof parsed.type !== "string" || typeof parsed.ts !== "string") {
-      return null;
-    }
-    return scrubPersistedSessionEvent(parsed, secretScrubber);
-  } catch {
-    return null;
-  }
-}
-
 // src/storage/session-store.ts
 var DefaultSessionStore = class _DefaultSessionStore {
   dir;
@@ -3891,13 +4010,17 @@ var DefaultSessionStore = class _DefaultSessionStore {
   async fork(id, opts = {}) {
     return forkSession(this, id, opts);
   }
+  /**
+   * Capture the deterministic post-tool workspace identity through the store-owned CAS.
+   */
+  async captureWorkspaceCheckpoint(sessionId, promptIndex) {
+    return captureCheckpoint(this.checkpointCas, sessionId, promptIndex);
+  }
+  /**
+   * Materialize a store-owned checkpoint into an already isolated workspace.
+   */
   async materializeWorkspaceCheckpoint(checkpoint, targetRoot) {
-    if (!this.checkpointCas) {
-      throw new Error(
-        "Workspace checkpoint materialization requires a projectRoot-aware session store"
-      );
-    }
-    return this.checkpointCas.materialize(checkpoint, targetRoot);
+    return materializeCheckpoint(this.checkpointCas, checkpoint, targetRoot);
   }
   async resolveId(query) {
     const normalized = query.trim();
@@ -3982,9 +4105,12 @@ var DefaultSessionStore = class _DefaultSessionStore {
       handle = await fsp12.open(file, "a", 384);
     } catch (err) {
       emitSessionStoreError(this.events, canonicalId, file, "resume", toErrorMessage(err), false);
-      throw new Error(`Failed to open session "${canonicalId}" for append: ${toErrorMessage(err)}`, {
-        cause: err
-      });
+      throw new Error(
+        `Failed to open session "${canonicalId}" for append: ${toErrorMessage(err)}`,
+        {
+          cause: err
+        }
+      );
     }
     try {
       const writer = new FileSessionWriter(
@@ -4181,7 +4307,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     await withFileLock(this.indexFile, async () => {
       await this.invalidateShardManifestBySessionId(summary.id);
       const line = JSON.stringify(summary) + "\n";
-      await fsp12.appendFile(this.indexFile, line, "utf8");
+      await fsp12.appendFile(this.indexFile, line, { encoding: "utf8", mode: SECRET_FILE_MODE });
       this._indexCache = null;
       this.indexAppendCount++;
       if (this.indexAppendCount >= _DefaultSessionStore.COMPACT_EVERY) {
@@ -4204,7 +4330,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
       await ensureDir(this.dir);
       await withFileLock(this.indexFile, async () => {
         const line = JSON.stringify({ action: "delete", id }) + "\n";
-        await fsp12.appendFile(this.indexFile, line, "utf8");
+        await fsp12.appendFile(this.indexFile, line, { encoding: "utf8", mode: SECRET_FILE_MODE });
         this._indexCache = null;
         await this.invalidateShardManifestBySessionId(id);
         this.indexAppendCount++;
@@ -4412,12 +4538,28 @@ var DefaultSessionStore = class _DefaultSessionStore {
       });
       outcome = "failure";
       errorMsg = "summary fallback \xE2\u20AC\u201D manifest rebuilt";
-      emitSessionStoreRead(this.events, id, manifest, "summary", outcome, Date.now() - t0, errorMsg);
+      emitSessionStoreRead(
+        this.events,
+        id,
+        manifest,
+        "summary",
+        outcome,
+        Date.now() - t0,
+        errorMsg
+      );
       return summary;
     } catch (err) {
       outcome = "failure";
       errorMsg = toErrorMessage(err);
-      emitSessionStoreRead(this.events, id, manifest, "summary", outcome, Date.now() - t0, errorMsg);
+      emitSessionStoreRead(
+        this.events,
+        id,
+        manifest,
+        "summary",
+        outcome,
+        Date.now() - t0,
+        errorMsg
+      );
       return {
         id,
         title: "(damaged)",
@@ -4432,14 +4574,7 @@ var DefaultSessionStore = class _DefaultSessionStore {
     const manifest = this.sessionPath(id, ".summary.json");
     try {
       const raw = await fsp12.readFile(manifest, "utf8");
-      emitSessionStoreRead(
-        this.events,
-        id,
-        manifest,
-        "summary",
-        "success",
-        Date.now() - startTime
-      );
+      emitSessionStoreRead(this.events, id, manifest, "summary", "success", Date.now() - startTime);
       return JSON.parse(raw);
     } catch {
       return null;
@@ -5162,7 +5297,7 @@ var FileMemoryBackend = class {
     const line = `- [${entry.ts}] ${id}${meta} ${entry.text.replace(/\n/g, " ")}
 `;
     await withFileLock(file, async () => {
-      const handle = await fs3.open(file, "a+");
+      const handle = await fs3.open(file, "a+", SECRET_FILE_MODE);
       try {
         const stat15 = await handle.stat();
         let prefix = "";
@@ -6171,6 +6306,9 @@ async function readProviderSnapshot(configPath, vault, warn) {
   if (typeof decrypted.uiLocale === "string" && decrypted.uiLocale)
     snapshot.uiLocale = decrypted.uiLocale;
   if (Array.isArray(decrypted.fallbackModels)) snapshot.fallbackModels = decrypted.fallbackModels;
+  if (typeof decrypted.fallbackBridge === "string" && decrypted.fallbackBridge.trim()) {
+    snapshot.fallbackBridge = decrypted.fallbackBridge.trim();
+  }
   if (decrypted.fallbackProfiles) snapshot.fallbackProfiles = decrypted.fallbackProfiles;
   if (Array.isArray(decrypted.favoriteModels)) snapshot.favoriteModels = decrypted.favoriteModels;
   if (typeof decrypted.favoriteModelsOnly === "boolean")
@@ -6188,6 +6326,7 @@ function serializeSnapshot(s) {
     baseUrl: s.baseUrl ?? null,
     uiLocale: s.uiLocale ?? null,
     fallbackModels: s.fallbackModels ?? null,
+    fallbackBridge: s.fallbackBridge ?? null,
     fallbackProfiles: s.fallbackProfiles ?? null,
     favoriteModels: s.favoriteModels ?? null,
     favoriteModelsOnly: s.favoriteModelsOnly ?? null,
@@ -6402,7 +6541,13 @@ var CONFIG_BEHAVIOR_DEFAULTS = {
     // models still get cost savings without capability loss. Explicit tiers
     // are respected verbatim.
     tokenSavingMode: "auto",
-    allowOutsideProjectRoot: true
+    // Derived, never written by hand: this and `tools.restrictToProjectRoot`
+    // (line 41) are the two halves of one switch, and they used to be declared
+    // independently in this same object — one `true`, one `true` — with
+    // session.ts resolving the contradiction via `??` in favour of the
+    // permissive half. The confinement guard therefore shipped disabled on a
+    // fresh install even though the other half asked for it (WS-075).
+    allowOutsideProjectRoot: !DEFAULT_TOOLS_CONFIG.restrictToProjectRoot
   },
   Sage: {
     enabled: true,
@@ -6481,9 +6626,11 @@ var CONFIG_BEHAVIOR_DEFAULTS = {
     enhance: true,
     enhanceDelayMs: 6e4,
     enhanceLanguage: "original",
-    statuslineMode: "detailed",
+    // Product-wide statusline density default. Mirrored by the TUI's
+    // DEFAULT_STATUSLINE_MODE (packages/tui/src/components/settings-picker-model.ts).
+    statuslineMode: "minimum",
     thinkingWord: DEFAULT_TUI_THINKING_WORD,
-    showAgentSwarmPanel: true
+    showAgentSwarmPanel: "bottom"
   },
   circuitBreaker: { ...DEFAULT_CIRCUIT_BREAKER_CONFIG },
   modelRuntime: {
@@ -6650,6 +6797,7 @@ var IN_PROJECT_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   "maxConcurrent",
   "uiLocale",
   "fallbackModels",
+  "fallbackBridge",
   "fallbackProfiles",
   "favoriteModels",
   "favoriteModelsOnly",
@@ -6712,6 +6860,7 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "tools",
   "mcpServers",
   "fallbackModels",
+  "fallbackBridge",
   "fallbackProfiles",
   "favoriteModels",
   "favoriteModelsOnly",
@@ -6746,6 +6895,75 @@ var KNOWN_CONFIG_TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
   "brain",
   "git"
 ]);
+var IN_PROJECT_DENIED_PATHS = [
+  {
+    path: "tools.exec.allow",
+    reason: "Extends the exec allow-list; a repo could authorise its own binaries."
+  },
+  { path: "tools.exec.danger", reason: "Weakens the destructive-command banner." },
+  { path: "skills.extraDirs", reason: "Loads skill definitions from repo-chosen directories." },
+  { path: "skills.registryUrl", reason: "Redirects skill installs to a repo-chosen host." },
+  // Deliberately NOT denied: skills.mode and skills.eagerMaxChars. The audit
+  // suggested stripping both, but config-loader-extra.test.ts classifies `mode`
+  // as a safe preference with a stated rationale, and a repo can only use these
+  // to move injection volume in either direction — the trust problem was that
+  // repo-supplied skill bodies were indistinguishable from the user's own, which
+  // the provenance tag in system-prompt-skill-bodies.ts now fixes. Re-classifying
+  // them is a product call.
+  { path: "Sage.storage.directory", reason: "Redirects memory storage outside the profile." },
+  {
+    path: "autonomy.yolo",
+    reason: "Alias for the denied top-level `yolo`, and it wins over the user setting \u2014 a repo-committed config could disable every permission prompt."
+  },
+  {
+    path: "autonomy.defaultMode",
+    reason: "Sets the startup autonomy mode; autonomy is user-owned, never repo-owned."
+  },
+  // Deliberately NOT denied: autonomy.autoProceedDelayMs and
+  // autoProceedMaxIterations. They tune a mode the user has already switched on
+  // rather than granting it, and config-loader-extra.test.ts classifies the
+  // delay as a benign project preference. Re-classifying them is a product call.
+  {
+    path: "launch.autonomy",
+    reason: "Launch-time autonomy mode; same user-owned boundary as autonomy.defaultMode."
+  },
+  {
+    path: "features.allowOutsideProjectRoot",
+    reason: "Short-circuits both the project-root containment check and the symlink realpath check in the file tools."
+  },
+  {
+    path: "tools.restrictToProjectRoot",
+    reason: "The other half of the filesystem confinement switch."
+  }
+];
+function deleteNestedPath(target, path30) {
+  const segments = path30.split(".");
+  const last = segments[segments.length - 1];
+  if (last === void 0) return false;
+  let cursor = target;
+  const chain = [];
+  for (const segment of segments.slice(0, -1)) {
+    const next = cursor[segment];
+    if (!next || typeof next !== "object" || Array.isArray(next)) return false;
+    chain.push({ parent: cursor, key: segment });
+    cursor = next;
+  }
+  if (!(last in cursor)) return false;
+  const clonedLeaf = { ...cursor };
+  delete clonedLeaf[last];
+  let replacement = clonedLeaf;
+  for (let i = chain.length - 1; i >= 0; i--) {
+    const link2 = chain[i];
+    if (!link2) continue;
+    replacement = { ...link2.parent, [link2.key]: replacement };
+    if (i === 0) {
+      for (const [k, v] of Object.entries(replacement)) target[k] = v;
+      return true;
+    }
+  }
+  for (const [k, v] of Object.entries(replacement)) target[k] = v;
+  return true;
+}
 function assertInProjectAllowListComplete() {
   const missingFromBoth = [];
   for (const key of KNOWN_CONFIG_TOP_LEVEL_KEYS) {
@@ -6775,6 +6993,22 @@ function assertInProjectAllowListComplete() {
       `field(s) appear in BOTH IN_PROJECT_ALLOWED_KEYS and KNOWN_DENIED_IN_PROJECT: ` + duplicate.join(", ") + ". The allow-list wins at runtime; remove from one of the two."
     );
   }
+  const orphanedPaths = IN_PROJECT_DENIED_PATHS.filter(
+    ({ path: path30 }) => !IN_PROJECT_ALLOWED_KEYS.has(path30.split(".")[0] ?? "")
+  ).map(({ path: path30 }) => path30);
+  if (orphanedPaths.length > 0) {
+    problems.push(
+      `IN_PROJECT_DENIED_PATHS entr(ies) whose top-level parent is not allowed: ` + orphanedPaths.join(", ") + ". The parent is already stripped wholesale, so the nested denial is dead \u2014 remove it."
+    );
+  }
+  const malformedPaths = IN_PROJECT_DENIED_PATHS.filter(
+    ({ path: path30 }) => path30.split(".").length < 2 || path30.split(".").some((s) => s.length === 0)
+  ).map(({ path: path30 }) => path30);
+  if (malformedPaths.length > 0) {
+    problems.push(
+      `IN_PROJECT_DENIED_PATHS entr(ies) are not dotted nested paths: ` + malformedPaths.join(", ") + ". Top-level keys belong in KNOWN_DENIED_IN_PROJECT instead."
+    );
+  }
   if (problems.length > 0) {
     throw new Error(
       `stripUnsafeInProjectFields drift check failed:
@@ -6797,58 +7031,8 @@ function stripUnsafeInProjectFields(inProject, sourcePath, warn = (msg) => conso
     }
     stripped.push(k);
   }
-  const outTools = out["tools"];
-  if (outTools && typeof outTools === "object") {
-    const execCfg = outTools["exec"];
-    if (execCfg && typeof execCfg === "object") {
-      const hasAllow = "allow" in execCfg;
-      const hasDanger = "danger" in execCfg;
-      if (hasAllow || hasDanger) {
-        const clonedExec = { ...execCfg };
-        if (hasAllow) {
-          delete clonedExec["allow"];
-          stripped.push("tools.exec.allow");
-        }
-        if (hasDanger) {
-          delete clonedExec["danger"];
-          stripped.push("tools.exec.danger");
-        }
-        out["tools"] = {
-          ...outTools,
-          exec: clonedExec
-        };
-      }
-    }
-  }
-  const outSkills = out["skills"];
-  if (outSkills && typeof outSkills === "object") {
-    const skillsRec = outSkills;
-    const needsClone = "extraDirs" in skillsRec || "registryUrl" in skillsRec;
-    if (needsClone) {
-      const clonedSkills = { ...skillsRec };
-      if ("extraDirs" in clonedSkills) {
-        delete clonedSkills["extraDirs"];
-        stripped.push("skills.extraDirs");
-      }
-      if ("registryUrl" in clonedSkills) {
-        delete clonedSkills["registryUrl"];
-        stripped.push("skills.registryUrl");
-      }
-      out["skills"] = clonedSkills;
-    }
-  }
-  const outSage = out["Sage"];
-  if (outSage && typeof outSage === "object") {
-    const storage = outSage["storage"];
-    if (storage && typeof storage === "object" && "directory" in storage) {
-      const clonedStorage = { ...storage };
-      delete clonedStorage["directory"];
-      out["Sage"] = {
-        ...outSage,
-        storage: clonedStorage
-      };
-      stripped.push("Sage.storage.directory");
-    }
+  for (const { path: path30 } of IN_PROJECT_DENIED_PATHS) {
+    if (deleteNestedPath(out, path30)) stripped.push(path30);
   }
   if (stripped.length > 0) {
     warn(
@@ -8360,7 +8544,7 @@ var ReplayLogStore = class _ReplayLogStore {
             } catch (err) {
               if (err.code !== "ENOENT") throw err;
             }
-            await fs8.appendFile(fp, line, "utf8");
+            await fs8.appendFile(fp, line, { encoding: "utf8", mode: SECRET_FILE_MODE });
             cache.set(hash, { entry, offset: offset2, length: Buffer.byteLength(line, "utf8") });
             this.diskCount.set(input.sessionId, currentCount + 1);
             this.events?.emit("storage.write", {
@@ -9023,7 +9207,13 @@ var ToolAuditLog = class {
             isError: input.isError,
             index
           };
-          await fs10.appendFile(fp, JSON.stringify(entry) + "\n", "utf8");
+          await fs10.appendFile(fp, JSON.stringify(entry) + "\n", {
+            encoding: "utf8",
+            // WS-035: this file records raw tool INPUT and OUTPUT. Created
+            // without a mode it lands 0644 — world-readable — while its
+            // siblings under the same directory correctly use 0600.
+            mode: SECRET_FILE_MODE
+          });
           try {
             const st = await fs10.stat(fp);
             this.tailStat.set(input.sessionId, { mtimeMs: st.mtimeMs, size: st.size });
@@ -9260,7 +9450,7 @@ var ToolAuditLog = class {
       }
     } catch {
     } finally {
-      this.unSyncedWrites.set(sessionId, 0);
+      this.unSyncedWrites.delete(sessionId);
     }
   }
   enqueue(sessionId, fn) {
@@ -12511,7 +12701,7 @@ function migratePromptEntry(raw) {
   const tags = Array.isArray(r["tags"]) ? r["tags"].filter((t) => typeof t === "string") : [];
   return {
     id: r["id"],
-    slug: typeof r["slug"] === "string" && r["slug"].length > 0 ? r["slug"] : slugify(title),
+    slug: typeof r["slug"] === "string" && r["slug"].length > 0 ? r["slug"] : slugify2(title),
     title,
     description: typeof r["description"] === "string" ? r["description"] : "",
     content,
@@ -12614,7 +12804,7 @@ var DefaultPromptStore = class {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     return {
       id: ulid(),
-      slug: extra.slug && extra.slug.length > 0 ? extra.slug : slugify(title),
+      slug: extra.slug && extra.slug.length > 0 ? extra.slug : slugify2(title),
       title,
       description: extra.description ?? "",
       content,
@@ -13374,6 +13564,9 @@ function createSessionEventBridge(writer, level = "standard", options = {}) {
     async append(event) {
       const target = resolveWriter();
       if (!target) return;
+      if (event.type === "tool_call_end") {
+        progressCounters.delete(event.id);
+      }
       if (!isAllowed(event.type, currentLevel)) return;
       if (!shouldSample(event)) return;
       try {
@@ -13384,6 +13577,9 @@ function createSessionEventBridge(writer, level = "standard", options = {}) {
     async appendBatch(events) {
       const target = resolveWriter();
       if (!target || events.length === 0) return;
+      for (const e of events) {
+        if (e.type === "tool_call_end") progressCounters.delete(e.id);
+      }
       const allowed = events.filter((e) => isAllowed(e.type, currentLevel) && shouldSample(e));
       if (allowed.length === 0) return;
       try {