brainclaw 1.26.0 → 1.26.1

package/dist/commands/session-start.js

@@ -2,9 +2,9 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { execSync } from 'node:child_process';
-import { isSessionSnapshotRecordFilename, memoryExists, resolveEntityDir, sessionSnapshotRecordPaths } from '../core/io.js';
+import { assertSafeSessionId, isSessionSnapshotRecordFilename, memoryExists, resolveEntityDir, sessionSnapshotRecordPaths } from '../core/io.js';
 import { loadVersionedJsonFile, saveVersionedJsonFile } from '../core/migration.js';
-import { buildOperationalIdentity, loadAllSessions, saveCurrentSession } from '../core/identity.js';
+import { buildOperationalIdentity, describeIgnoredSessionIdEnv, loadAllSessions, saveCurrentSession } from '../core/identity.js';
 import { requireMinimumTrustLevel, resolveCurrentModel, resolveOrAutoRegisterAgentIdentity } from '../core/agent-registry.js';
 import { buildContext, renderContextPromptTemplate } from '../core/context.js';
 import { writeContextMarker } from '../core/freshness.js';
@@ -35,8 +35,39 @@ function sessionSnapshotWriteDir(cwd) {
     return resolveEntityDir('sessions', cwd ?? process.cwd(), 'write');
 }
 function sessionSnapshotPath(sessionId, cwd) {
+    // pln#672 review P1 — THE SECOND WRITER. This builder was unguarded while
+    // sessionFilePathIn / sessionSnapshotRecordPaths were hardened, so an
+    // env-controlled traversal still escaped the store HERE, before the
+    // current_session write refused it (reproduced by the reviewer:
+    // `ESCAPED.snapshot.json` landed outside, and the later throw did not undo
+    // the escaped write). A guard on some builders is not a guard.
+    assertSafeSessionId(sessionId);
     return path.join(sessionSnapshotWriteDir(cwd), `${sessionId}.snapshot.json`);
 }
+/**
+ * pln#672 review P2 — the snapshot write needs the same positive proof the
+ * current_session write already has. On a case-insensitive filesystem
+ * `CaseSnapshot` and `casesnapshot` name the SAME file, so a second session
+ * silently overwrote the first one's snapshot. Refuse to replace a record
+ * that names a different session; identical-id rewrites (heartbeat, restart)
+ * stay allowed.
+ */
+function assertSnapshotSlotFree(filepath, sessionId) {
+    if (!fs.existsSync(filepath))
+        return;
+    try {
+        const raw = JSON.parse(fs.readFileSync(filepath, 'utf-8'));
+        if (typeof raw.session_id === 'string' && raw.session_id !== sessionId) {
+            throw new Error(`Refusing to overwrite the session_snapshot of '${raw.session_id}' at '${filepath}' with '${sessionId}' — the two ids resolve to the same filename on this filesystem`);
+        }
+    }
+    catch (err) {
+        // A deliberate refusal propagates; an unreadable record does not block a
+        // fresh write (it is not proof that another session owns the slot).
+        if (err instanceof Error && err.message.startsWith('Refusing to overwrite'))
+            throw err;
+    }
+}
 /**
  * pln#670 — lazy migration of pre-split snapshot records: rename `<id>.json` to
  * `<id>.snapshot.json` in the CANONICAL sessions directory only. The legacy
@@ -145,6 +176,11 @@ export async function runSessionStart(options = {}) {
         if (snapshot.stale_surfaces) {
             console.warn(`⚠ ${snapshot.stale_surfaces.message}`);
         }
+        // pln#672 — a dropped env session id must reach the human too: the whole
+        // point of the warning is that the session identity is NOT the one asked for.
+        if (snapshot.invalid_session_id_ignored) {
+            console.warn(`⚠ ${snapshot.invalid_session_id_ignored.message}`);
+        }
         // Fifth instance of the computed-then-dropped class, caught by the new seam
         // guard on its first run: built since the shared-checkout detection landed,
         // read by nothing. Two agents editing one checkout is precisely what a human
@@ -202,7 +238,9 @@ export async function startSession(options = {}) {
     const dir = sessionSnapshotWriteDir(options.cwd);
     if (!fs.existsSync(dir))
         fs.mkdirSync(dir, { recursive: true });
-    saveVersionedJsonFile('session_snapshot', sessionSnapshotPath(snapshot.session_id, options.cwd), SessionSnapshotSchema.parse(snapshot));
+    const snapshotPath = sessionSnapshotPath(snapshot.session_id, options.cwd);
+    assertSnapshotSlotFree(snapshotPath, snapshot.session_id);
+    saveVersionedJsonFile('session_snapshot', snapshotPath, SessionSnapshotSchema.parse(snapshot));
     // Resolve git branch and worktree for session tracking
     let currentBranch;
     let currentWorktreePath;
@@ -371,6 +409,18 @@ export async function startSession(options = {}) {
         staleSurfaces = staleSurfaceWarning(freshness, currentVersion);
     }
     catch { /* non-fatal */ }
+    // pln#672 — report a DROPPED env session id. Never echo the raw value: it is
+    // attacker-influenced and would land straight in logs; the variable name and
+    // its length are enough to diagnose.
+    let invalidSessionIdIgnored;
+    const droppedSessionEnv = describeIgnoredSessionIdEnv();
+    if (droppedSessionEnv) {
+        invalidSessionIdIgnored = {
+            code: 'invalid_session_id_ignored',
+            message: `${droppedSessionEnv.variable} carries a session id that cannot be a record filename (${droppedSessionEnv.length} chars) — it was ignored and this session runs under '${snapshot.session_id}'. Unset or fix the variable to resume the intended session.`,
+            data: { variable: droppedSessionEnv.variable, length: droppedSessionEnv.length, effective_session_id: snapshot.session_id },
+        };
+    }
     // Materialize incoming federation signals from linked projects (Phase 0 — local)
     if (maintenanceMode === 'full') {
         try {
@@ -406,6 +456,7 @@ export async function startSession(options = {}) {
         ...(staleClaimsReleased ? { stale_claims_released: staleClaimsReleased } : {}),
         ...(memoryPressure ? { memory_pressure: memoryPressure } : {}),
         ...(staleSurfaces ? { stale_surfaces: toWarningDetail(staleSurfaces) } : {}),
+        ...(invalidSessionIdIgnored ? { invalid_session_id_ignored: toWarningDetail(invalidSessionIdIgnored) } : {}),
         ...(autoRegistered ? { auto_registered: true } : {}),
     };
 }

package/dist/core/identity.js

@@ -6,18 +6,19 @@ import { detectAiAgent } from './ai-agent-detection.js';
 import { requireRegisteredAgentIdentity } from './agent-registry.js';
 import { loadConfig } from './config.js';
 import { resolveCurrentHostId } from './host.js';
-import { isSessionSnapshotRecordFilename, memoryDir } from './io.js';
+import { assertSafeSessionId, findSessionAnchorRoot, isSafeSessionId, isSessionSnapshotRecordFilename, memoryDir } from './io.js';
 import { loadVersionedJsonFile, saveVersionedJsonFile } from './migration.js';
 import { CurrentSessionStateSchema } from './schema.js';
 const SESSIONS_DIR = 'sessions';
 const LEGACY_SESSION_FILE = '.current-session';
 // --- Public API ---
 export function resolveCurrentSessionId(env = process.env, cwd, options = {}) {
-    const value = env.BRAINCLAW_SESSION_ID?.trim()
-        || env.OPENCLAW_SESSION_ID?.trim()
-        || env.CLAUDE_SESSION_ID?.trim()
-        || env.COPILOT_SESSION_ID?.trim();
-    if (value && value.length > 0) {
+    // pln#672 review P1: ONE validated resolution for the env session id. This
+    // used to re-read the variables raw, so an unsafe value bypassed the
+    // boundary here and reached startSession's snapshot write — the traversal
+    // stayed exploitable through a second writer (reproduced by the reviewer).
+    const value = resolveExplicitSessionId(env);
+    if (value) {
         return value;
     }
     const agentName = options.agentName?.trim();
@@ -73,7 +74,6 @@ export function resolveEventSessionId(event) {
  * Checks sessions/ directory first, falls back to legacy .current-session.
  */
 export function loadCurrentSession(cwd) {
-    const dir = sessionsDir(cwd);
     const currentUser = resolveCurrentUser();
     const currentAgent = resolveCurrentAgentName();
     const explicitSessionId = resolveExplicitSessionId();
@@ -83,34 +83,52 @@ export function loadCurrentSession(cwd) {
         const explicit = loadSessionById(explicitSessionId, cwd);
         return explicit && isSessionAlive(explicit, ttlMs, now) ? explicit : undefined;
     }
-    // 1. Look in sessions/ directory for the session owned by this process.
-    // Multiple parallel agents can have the same agent name/user in one repo;
-    // a live different PID is a different agent instance, not our session.
-    if (fs.existsSync(dir) && currentAgent) {
-        const files = listCurrentSessionFiles(dir);
-        const legacyPidlessCandidates = [];
-        for (const file of files) {
-            try {
-                const session = loadSessionFile(path.join(dir, file));
-                // Strict match: agent name must match, user must match (when both are known)
-                if (session.agent !== currentAgent)
-                    continue;
-                const userMatch = !session.user || !currentUser || session.user === currentUser;
-                if (!userMatch || !isSessionAlive(session, ttlMs, now))
-                    continue;
-                if (session.pid === process.pid) {
-                    return session;
+    // 1. Look in the sessions read-chain (workspace anchor first, then the
+    // pre-anchor legacy location — pln#648) for the session owned by this
+    // process. Multiple parallel agents can have the same agent name/user in
+    // one repo; a live different PID is a different agent instance, not our
+    // session. Pidless legacy candidates are deduped by id: during relocation a
+    // record can transiently exist in both locations, and a duplicate must not
+    // inflate the candidate count.
+    if (currentAgent) {
+        const currentHostId = resolveCurrentHostId();
+        const legacyPidlessCandidates = new Map();
+        for (const dir of sessionsDirs(cwd)) {
+            if (!fs.existsSync(dir))
+                continue;
+            for (const file of listCurrentSessionFiles(dir)) {
+                try {
+                    const session = loadSessionFile(path.join(dir, file));
+                    // Strict match: agent name must match, user must match (when both are known)
+                    if (session.agent !== currentAgent)
+                        continue;
+                    const userMatch = !session.user || !currentUser || session.user === currentUser;
+                    if (!userMatch || !isSessionAlive(session, ttlMs, now))
+                        continue;
+                    if (session.pid === process.pid) {
+                        return session;
+                    }
+                    // Legacy pidless adoption, HOST-GUARDED (pln#648 anchoring follow-up):
+                    // anchoring parks every session of the workspace at one directory, so
+                    // the historical weak adoption — agent name + user only — would now
+                    // see records it never saw before, including another instance's
+                    // stale intent (the exact hijack the P1-1/P1-2 review pins forbid on
+                    // the resolver's added probes). A pidless record is only adoptable
+                    // when it was written by THIS host; foreign-instance records need
+                    // strong identity (named id or pid) everywhere.
+                    if (session.pid === undefined
+                        && (!session.host_id || session.host_id === currentHostId)
+                        && !legacyPidlessCandidates.has(session.session_id)) {
+                        legacyPidlessCandidates.set(session.session_id, session);
+                    }
                 }
-                if (session.pid === undefined) {
-                    legacyPidlessCandidates.push(session);
+                catch {
+                    // skip invalid session files
                 }
             }
-            catch {
-                // skip invalid session files
-            }
         }
-        if (legacyPidlessCandidates.length === 1) {
-            return legacyPidlessCandidates[0];
+        if (legacyPidlessCandidates.size === 1) {
+            return [...legacyPidlessCandidates.values()][0];
         }
     }
     // 2. Legacy fallback: .current-session
@@ -133,49 +151,61 @@ export function loadCurrentSession(cwd) {
  * Load a specific session by ID.
  */
 export function loadSessionById(sessionId, cwd) {
-    let filepath;
-    try {
-        filepath = sessionFilePath(sessionId, cwd);
-    }
-    catch {
-        // Reserved '.snapshot' alias id — such a current_session record can never exist.
-        return undefined;
-    }
-    if (!fs.existsSync(filepath))
-        return undefined;
-    try {
-        const migration = loadVersionedJsonFile('current_session', filepath);
-        const session = {
-            ...CurrentSessionStateSchema.parse(migration.document),
-            schema_version: migration.metadata.currentVersion,
-        };
-        // The filename is only an index, never an identity (codex review): do not
-        // adopt a record whose payload names a different session.
-        return session.session_id === sessionId ? session : undefined;
-    }
-    catch {
+    // A READ answers "no such record" rather than throwing: an unsafe id
+    // (traversal — pln#672) or the reserved '.snapshot' alias (pln#670) simply
+    // cannot name a current_session record. The throwing guard stays in
+    // sessionFilePathIn for the write paths.
+    if (!isSafeSessionId(sessionId) || !isCurrentSessionFilename(sessionId))
         return undefined;
+    // pln#648 read-chain: anchor first, then the pre-anchor legacy location. A
+    // bad record in one location must not mask a good one in the other.
+    for (const dir of sessionsDirs(cwd)) {
+        const filepath = sessionFilePathIn(dir, sessionId);
+        if (!fs.existsSync(filepath))
+            continue;
+        try {
+            const migration = loadVersionedJsonFile('current_session', filepath);
+            const session = {
+                ...CurrentSessionStateSchema.parse(migration.document),
+                schema_version: migration.metadata.currentVersion,
+            };
+            // The filename is only an index, never an identity (codex review): do not
+            // adopt a record whose payload names a different session.
+            if (session.session_id === sessionId)
+                return session;
+        }
+        catch {
+            // fall through to the next location
+        }
     }
+    return undefined;
 }
 /**
  * Load ALL sessions (active + stale) from the sessions/ directory.
  */
 export function loadAllSessions(cwd) {
-    const dir = sessionsDir(cwd);
-    if (!fs.existsSync(dir))
-        return [];
-    const files = listCurrentSessionFiles(dir);
+    // pln#648 read-chain: anchored records win over a transient pre-anchor copy
+    // of the same session (dedup by id, anchor scanned first).
+    const seen = new Set();
     const sessions = [];
-    for (const file of files) {
-        try {
-            const migration = loadVersionedJsonFile('current_session', path.join(dir, file));
-            sessions.push({
-                ...CurrentSessionStateSchema.parse(migration.document),
-                schema_version: migration.metadata.currentVersion,
-            });
-        }
-        catch {
-            // skip invalid
+    for (const dir of sessionsDirs(cwd)) {
+        if (!fs.existsSync(dir))
+            continue;
+        for (const file of listCurrentSessionFiles(dir)) {
+            try {
+                const migration = loadVersionedJsonFile('current_session', path.join(dir, file));
+                const session = {
+                    ...CurrentSessionStateSchema.parse(migration.document),
+                    schema_version: migration.metadata.currentVersion,
+                };
+                if (seen.has(session.session_id))
+                    continue;
+                seen.add(session.session_id);
+                sessions.push(session);
+            }
+            catch {
+                // skip invalid
+            }
         }
     }
     return sessions.sort((a, b) => b.last_seen_at.localeCompare(a.last_seen_at));
@@ -191,40 +221,62 @@ export function saveCurrentSession(session, cwd) {
     // sessionFilePath throws on a '.snapshot' alias id — a write must never
     // construct a snapshot filename (codex review P1).
     const filepath = sessionFilePath(session.session_id, cwd);
-    // A plain legacy `<id>.json` can still hold a pre-split snapshot (the old
-    // 'read'-mode write bug parked snapshots in this directory). Only overwrite
-    // a record that PROVES it is this exact current_session entry (codex review).
-    if (fs.existsSync(filepath) && !loadSessionById(session.session_id, cwd)) {
+    // A plain `<id>.json` can still hold a pre-split snapshot (the old
+    // 'read'-mode write bug parked snapshots in session directories). Only
+    // overwrite THIS path when its record proves to be this exact
+    // current_session entry (codex review, made path-local by pln#648: the
+    // proof must be about the file being replaced, not about any location).
+    if (fs.existsSync(filepath) && !isProvenCurrentSessionAt(filepath, session.session_id)) {
         throw new Error(`Refusing to overwrite non-current_session record at '${filepath}'`);
     }
     saveVersionedJsonFile('current_session', filepath, CurrentSessionStateSchema.parse(session));
+    // pln#648 relocation: a pre-anchor copy of the SAME session under the
+    // effective cwd would linger until TTL decay — remove it once the anchored
+    // write has landed, on positive proof only. Best effort: the read-chain and
+    // the GC cover any leftover. legacySessionsDir normalizes exactly like the
+    // anchor (codex review P1): a relative cwd must never make the SAME
+    // directory compare unequal — the unlink below would delete the record
+    // this function just wrote.
+    const legacyDir = legacySessionsDir(cwd);
+    if (legacyDir !== dir) {
+        try {
+            const legacyPath = sessionFilePathIn(legacyDir, session.session_id);
+            if (fs.existsSync(legacyPath) && isProvenCurrentSessionAt(legacyPath, session.session_id)) {
+                fs.unlinkSync(legacyPath);
+            }
+        }
+        catch { /* best effort */ }
+    }
 }
 /**
  * Clear a session. If sessionId is provided, only clear that specific session.
  */
 export function clearCurrentSession(cwd, sessionId) {
-    if (sessionId) {
-        // Remove specific session file. A filename is never enough authority to
-        // delete a record (codex review P1): the '.snapshot' alias id throws in
-        // sessionFilePath (caught → no-op), and an existing file is only unlinked
-        // when loadSessionById PROVES it is this exact current_session record —
-        // never a pre-split snapshot parked under a plain `<id>.json`.
-        try {
-            if (loadSessionById(sessionId, cwd)) {
-                fs.unlinkSync(sessionFilePath(sessionId, cwd));
+    // A filename is never enough authority to delete a record (codex review P1):
+    // the '.snapshot' alias id throws in sessionFilePathIn (caught → no-op), and
+    // a file is only unlinked when it PROVES to be this exact current_session
+    // record — never a pre-split snapshot parked under a plain `<id>.json`.
+    // pln#648: the record can live at the anchor OR at the pre-anchor legacy
+    // location — clear wherever it proves.
+    const unlinkProven = (id) => {
+        for (const dir of sessionsDirs(cwd)) {
+            try {
+                const filepath = sessionFilePathIn(dir, id);
+                if (fs.existsSync(filepath) && isProvenCurrentSessionAt(filepath, id)) {
+                    fs.unlinkSync(filepath);
+                }
             }
+            catch { /* ignore */ }
         }
-        catch { /* ignore */ }
+    };
+    if (sessionId) {
+        unlinkProven(sessionId);
         return;
     }
     // Clear the session for the current agent+user
     const session = loadCurrentSession(cwd);
     if (session) {
-        const filepath = sessionFilePath(session.session_id, cwd);
-        try {
-            fs.unlinkSync(filepath);
-        }
-        catch { /* ignore */ }
+        unlinkProven(session.session_id);
     }
     // Also clean legacy file
     const legacyPath = path.join(memoryDir(cwd), LEGACY_SESSION_FILE);
@@ -238,43 +290,95 @@ export function clearCurrentSession(cwd, sessionId) {
  * Returns the number of sessions removed.
  */
 export function gcStaleSessions(cwd, ttlOverride) {
-    const dir = sessionsDir(cwd);
-    if (!fs.existsSync(dir))
-        return 0;
     const ttlMs = parseDurationToMs(ttlOverride ?? loadConfigSafe(cwd)?.implicit_session_ttl ?? '4h');
     const now = Date.now();
     let removed = 0;
-    const files = listCurrentSessionFiles(dir);
-    for (const file of files) {
-        const filepath = path.join(dir, file);
-        try {
-            // POSITIVE proof before deletion (codex review): a bare `<id>.json` in
-            // this directory can still be a pre-split snapshot (old 'read'-mode
-            // write bug). Only a record carrying the current_session discriminant
-            // may be collected; anything unidentifiable is preserved, never deleted.
-            const raw = JSON.parse(fs.readFileSync(filepath, 'utf-8'));
-            if (typeof raw.last_seen_at !== 'string')
-                continue;
-            const migration = loadVersionedJsonFile('current_session', filepath);
-            const session = {
-                ...CurrentSessionStateSchema.parse(migration.document),
-                schema_version: migration.metadata.currentVersion,
-            };
-            if (now - Date.parse(session.last_seen_at) > ttlMs) {
-                fs.unlinkSync(filepath);
-                removed++;
+    // pln#648: sweep the whole read-chain — pre-anchor legacy records are
+    // exactly what this GC must decay.
+    for (const dir of sessionsDirs(cwd)) {
+        if (!fs.existsSync(dir))
+            continue;
+        for (const file of listCurrentSessionFiles(dir)) {
+            const filepath = path.join(dir, file);
+            try {
+                // POSITIVE proof before deletion (codex review): a bare `<id>.json` in
+                // this directory can still be a pre-split snapshot (old 'read'-mode
+                // write bug). Only a record carrying the current_session discriminant
+                // may be collected; anything unidentifiable is preserved, never deleted.
+                const raw = JSON.parse(fs.readFileSync(filepath, 'utf-8'));
+                if (typeof raw.last_seen_at !== 'string')
+                    continue;
+                const migration = loadVersionedJsonFile('current_session', filepath);
+                const session = {
+                    ...CurrentSessionStateSchema.parse(migration.document),
+                    schema_version: migration.metadata.currentVersion,
+                };
+                if (now - Date.parse(session.last_seen_at) > ttlMs) {
+                    fs.unlinkSync(filepath);
+                    removed++;
+                }
+            }
+            catch {
+                // An unidentifiable record is not proven stale current_session state —
+                // preserving it beats risking the deletion of a legacy snapshot.
             }
-        }
-        catch {
-            // An unidentifiable record is not proven stale current_session state —
-            // preserving it beats risking the deletion of a legacy snapshot.
         }
     }
     return removed;
 }
 // --- Internal helpers ---
+/**
+ * pln#648 (a) — the session record must live at a STABLE, workspace-unique
+ * location. Anchored on the effective cwd, the record landed under the store
+ * of the project being LEFT at session-start, and every switch moved the
+ * truth out of the resolver's reach (the reproduced P0: status said api,
+ * writes went to web). The anchor is the outermost .brainclaw/ above cwd —
+ * a pure filesystem answer, independent of active-project state, so every
+ * probe of the same workspace derives the SAME directory.
+ */
+function sessionAnchorCwd(cwd) {
+    // path.resolve BEFORE anchoring (codex review P1): the anchor and the legacy
+    // location below are compared for equality — a relative cwd ('.') must not
+    // make the SAME directory look like two, or the relocation would unlink the
+    // record it just wrote. Role-aware walk: the nearest declared workspace wins,
+    // so sibling workspaces under a parent store stay isolated (review P1 #2).
+    const base = path.resolve(cwd ?? process.cwd());
+    return findSessionAnchorRoot(base) ?? base;
+}
+/** The write + primary read location for current_session records. */
 function sessionsDir(cwd) {
-    return path.join(memoryDir(cwd), SESSIONS_DIR);
+    return path.join(memoryDir(sessionAnchorCwd(cwd)), SESSIONS_DIR);
+}
+/** The pre-anchor legacy location, NORMALIZED the same way as the anchor. */
+function legacySessionsDir(cwd) {
+    return path.join(memoryDir(path.resolve(cwd ?? process.cwd())), SESSIONS_DIR);
+}
+/**
+ * Read-chain (pln#648 migration): anchor first, then the pre-anchor location
+ * under the effective cwd where existing records still live. Sessions expire
+ * within the implicit TTL (4h), so the legacy probe decays naturally — no
+ * rewrite migration; saveCurrentSession relocates its own record on the next
+ * heartbeat and the GC sweeps both. Deduped when both resolve to the same
+ * directory (single-project stores — the common case).
+ */
+function sessionsDirs(cwd) {
+    const anchored = sessionsDir(cwd);
+    const legacy = legacySessionsDir(cwd);
+    return anchored === legacy ? [anchored] : [anchored, legacy];
+}
+/**
+ * Positive proof that the file at `filepath` is THE current_session record for
+ * `sessionId` (pln#670 discipline: a filename is never authority to delete or
+ * overwrite — a plain `<id>.json` can be a pre-split snapshot).
+ */
+function isProvenCurrentSessionAt(filepath, sessionId) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(filepath, 'utf-8'));
+        return typeof raw.last_seen_at === 'string' && raw.session_id === sessionId;
+    }
+    catch {
+        return false;
+    }
 }
 /**
  * pln#670 — current_session scanners must be type-strict: session_snapshot
@@ -294,7 +398,11 @@ function listCurrentSessionFiles(dir) {
 function isCurrentSessionFilename(sessionId) {
     return !isSessionSnapshotRecordFilename(`${sessionId}.json`);
 }
-function sessionFilePath(sessionId, cwd) {
+function sessionFilePathIn(dir, sessionId) {
+    // pln#672 — PATH SAFETY first: the id is env-controlled and becomes a
+    // filename, so a traversal ('../../evil') must never build a path. This is
+    // the choke point for save / load / clear alike.
+    assertSafeSessionId(sessionId);
     // pln#670 review fix (codex P1): a session id ending in ".snapshot" would
     // produce `<base>.snapshot.json` — the snapshot filename of session <base>
     // in a shared directory. Refuse the alias instead of silently colliding
@@ -302,7 +410,10 @@ function sessionFilePath(sessionId, cwd) {
     if (!isCurrentSessionFilename(sessionId)) {
         throw new Error(`session id '${sessionId}' is reserved for session_snapshot records — the '.snapshot' suffix would collide across record types`);
     }
-    return path.join(sessionsDir(cwd), `${sessionId}.json`);
+    return path.join(dir, `${sessionId}.json`);
+}
+function sessionFilePath(sessionId, cwd) {
+    return sessionFilePathIn(sessionsDir(cwd), sessionId);
 }
 function resolveCurrentUser() {
     return process.env.USER || process.env.USERNAME || os.userInfo().username || undefined;
@@ -321,11 +432,41 @@ function resolveCurrentAgentName() {
  * resolution from a store the agent never named.
  */
 export function resolveExplicitSessionId(env = process.env) {
-    return env.BRAINCLAW_SESSION_ID?.trim()
+    const named = env.BRAINCLAW_SESSION_ID?.trim()
         || env.OPENCLAW_SESSION_ID?.trim()
         || env.CLAUDE_SESSION_ID?.trim()
         || env.COPILOT_SESSION_ID?.trim()
         || undefined;
+    // pln#672 — this value becomes a FILENAME (`<id>.json`). An id that cannot
+    // safely do so is IGNORED, not honoured: falling back to the implicit
+    // session is safe, while using it walks out of the store (reproduced on
+    // disk with '../../../ESCAPED'). Refusing to run at all would be worse —
+    // a stale exported variable would break every command in the shell — so
+    // the boundary drops the value here and the filename builders below refuse
+    // loudly for any other caller. The drop is NOT silent: session
+    // establishment surfaces it (see describeIgnoredSessionIdEnv).
+    return named && isSafeSessionId(named) ? named : undefined;
+}
+/**
+ * Name the env variable whose session id was DROPPED as unsafe, if any
+ * (pln#672 review — the availability-first fallback must not silently change
+ * the agent's identity: continuing under an implicit session while the caller
+ * believes it resumed the supplied one is exactly the kind of silent
+ * divergence this project refuses).
+ *
+ * Returns the VARIABLE NAME and a non-sensitive reason only — never the raw
+ * value, which is attacker-influenced and would land in logs.
+ */
+export function describeIgnoredSessionIdEnv(env = process.env) {
+    for (const variable of ['BRAINCLAW_SESSION_ID', 'OPENCLAW_SESSION_ID', 'CLAUDE_SESSION_ID', 'COPILOT_SESSION_ID']) {
+        const raw = env[variable]?.trim();
+        if (!raw)
+            continue;
+        // The first variable that carries a value decides — same precedence as
+        // resolveExplicitSessionId, so the report names the one actually used.
+        return isSafeSessionId(raw) ? undefined : { variable, length: raw.length };
+    }
+    return undefined;
 }
 function loadSessionFile(filepath) {
     const migration = loadVersionedJsonFile('current_session', filepath);

package/dist/core/io.js

@@ -1,4 +1,6 @@
+import crypto from 'node:crypto';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { withLock, cleanStaleLocks } from './lock.js';
 export { mutate } from './mutation-pipeline.js';
@@ -121,6 +123,90 @@ export function entityRecordDirs(subdir, cwd = process.cwd(), preferredDirName)
 export function entityRecordPaths(subdir, id, cwd, preferredDirName) {
     return entityRecordDirs(subdir, cwd ?? process.cwd(), preferredDirName).map((d) => path.join(d, `${id}.json`));
 }
+/**
+ * The id grammar every session record filename is built from (pln#672).
+ *
+ * A session id arrives from the ENVIRONMENT (BRAINCLAW_SESSION_ID and the
+ * per-agent variants read by resolveExplicitSessionId) and is interpolated
+ * straight into a filename: `<id>.json` / `<id>.snapshot.json`. Unvalidated,
+ * `../../../ESCAPED` walks out of the store — reproduced on disk on
+ * 2026-08-18: saveCurrentSession wrote outside the store root, and the same
+ * path feeds loadSessionById (read) and clearCurrentSession (unlink).
+ *
+ * Allowed: a leading alphanumeric, then alphanumerics, `.`, `_`, `-`, up to
+ * 128 chars — covers brainclaw's own `sess_<hex>` and the UUID-shaped ids
+ * some agents export. Refused by construction: path separators, `..`, drive
+ * letters and absolute paths, empty ids, and any id starting with a dot.
+ * The `.snapshot` suffix stays separately refused for current_session ids
+ * (pln#670) — that is a type-collision rule, not a path-safety one.
+ */
+const SAFE_SESSION_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+/**
+ * Win32 device namespace (pln#672 review P2, reproduced on a Windows host):
+ * `CON`, `NUL`, `COM1`… are not directory entries — `CON.json` opens the
+ * console device, `stat` reports a file, and the sessions directory stays
+ * empty. A record "written" there is silently lost. The reservation applies
+ * to the basename BEFORE the first dot, case-insensitively, so `con.json`
+ * and `Con.anything` are covered too. Refused on every platform: the grammar
+ * is shared, and an id must mean the same thing on all of them.
+ */
+const WIN32_RESERVED_BASENAME_RE = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
+export function isSafeSessionId(sessionId) {
+    if (!SAFE_SESSION_ID_RE.test(sessionId))
+        return false;
+    return !WIN32_RESERVED_BASENAME_RE.test(sessionId.split('.')[0]);
+}
+/** Throwing variant for the filename builders — a traversal must be loud, never silent. */
+export function assertSafeSessionId(sessionId) {
+    if (!isSafeSessionId(sessionId)) {
+        throw new Error(`session id '${sessionId}' is not a valid record identifier: only [A-Za-z0-9._-] (starting with an alphanumeric, max 128 chars) may become a session filename`);
+    }
+}
+/**
+ * Normalize an agent name into ONE filesystem path segment (pln#673).
+ *
+ * The agent name arrives from the environment (BRAINCLAW_AGENT_NAME, read by
+ * resolveCurrentAgentName) and became a DIRECTORY name unvalidated: proved on
+ * disk on 2026-08-18 that `'../../../../outside/PWNED'` made saveRuntimeNote
+ * create the directory and write the note ENTIRELY OUTSIDE the store.
+ *
+ * This is deliberately the SAME normalization the inbox has always used
+ * (`agentInboxDir`, messaging.ts) rather than a new convention: lower-case,
+ * then every character outside [a-z0-9_-] becomes `_`. Separators and dots
+ * cannot survive it, so no traversal can. When that replacement (or a length
+ * cap) would collapse distinct raw names, a stable hash suffix keeps their
+ * runtime directories separate. It remains IDENTITY for every normal agent
+ * name brainclaw produces (claude-code, codex, github-copilot, …) — verified
+ * against the real store — so existing normal directories do not move.
+ * Readers still probe a contained raw legacy name as a fallback (see
+ * runtime.ts) so a non-canonical legacy directory never becomes invisible.
+ *
+ * Alias resolution is deliberately NOT applied here: mapping `copilot` to
+ * `github-copilot` would relocate notes, which is a product decision, not a
+ * path-safety one.
+ */
+const AGENT_SEGMENT_UNSAFE_RE = /[^a-z0-9_-]/g;
+const WIN32_RESERVED_BASENAME_FOR_SEGMENT_RE = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
+// 128 leaves ample room for the record id and works below the 255-byte
+// component limit even when an agent name contains non-BMP characters (which
+// normalize to ASCII underscores). The hash makes truncation collision-safe.
+const MAX_AGENT_PATH_SEGMENT_LENGTH = 128;
+export function sanitizeAgentPathSegment(agent) {
+    const source = agent.trim().toLowerCase();
+    let normalized = source.replace(AGENT_SEGMENT_UNSAFE_RE, '_');
+    if (normalized.length === 0)
+        return 'unknown-agent';
+    // A Win32 device name is not a usable directory either (mkdir CON fails).
+    if (WIN32_RESERVED_BASENAME_FOR_SEGMENT_RE.test(normalized))
+        normalized = `${normalized}_`;
+    // A replacement would otherwise merge distinct identities (`a.b` and `a_b`)
+    // into one runtime directory. Preserve safe canonical names exactly, but add
+    // a deterministic discriminator to every lossy or length-capped segment.
+    if (source === normalized && normalized.length <= MAX_AGENT_PATH_SEGMENT_LENGTH)
+        return normalized;
+    const suffix = crypto.createHash('sha256').update(source).digest('hex').slice(0, 16);
+    return `${normalized.slice(0, MAX_AGENT_PATH_SEGMENT_LENGTH - suffix.length - 1)}_${suffix}`;
+}
 export const SESSION_SNAPSHOT_FILENAME_SUFFIX = '.snapshot.json';
 /**
  * Filesystem type discriminator for session snapshots (codex review, pln#670).
@@ -142,6 +228,9 @@ export function isSessionSnapshotRecordFilename(filename) {
  * before the split; readers must schema-validate every candidate.
  */
 export function sessionSnapshotRecordPaths(sessionId, cwd, preferredDirName) {
+    // pln#672 — the id becomes a filename here too: refuse a traversal loudly
+    // rather than build a path that escapes the store.
+    assertSafeSessionId(sessionId);
     const dirs = entityRecordDirs('sessions', cwd ?? process.cwd(), preferredDirName);
     return [
         ...dirs.map((d) => path.join(d, `${sessionId}.snapshot.json`)),
@@ -151,6 +240,82 @@ export function sessionSnapshotRecordPaths(sessionId, cwd, preferredDirName) {
 export function memoryDir(cwd = process.cwd(), preferredDirName) {
     return path.join(cwd, preferredDirName ?? MEMORY_DIR);
 }
+/**
+ * Walk UP from a directory and return the outermost .brainclaw/ root found.
+ * Bypasses resolveEffectiveCwd / active project entirely — the answer depends
+ * only on the filesystem, which is what makes it safe for identity-level state
+ * that must NOT follow the active project (pln#648: a session record anchored
+ * on the effective cwd moved with every switch, out of the resolver's reach).
+ *
+ * Lives HERE, in a leaf module: identity.ts needs it, and store-resolution.ts
+ * imports identity.ts — the import cycle that blocked pln#648's first attempt.
+ * store-resolution re-exports it for its existing callers.
+ *
+ * Stops at the filesystem root, at $HOME (a user-level store is never a
+ * workspace root), and never climbs ABOVE BRAINCLAW_STORE_BOUNDARY when set —
+ * the containment contract tests and agent shells rely on (a leaked parent
+ * store must not widen the walk into the host machine).
+ */
+export function findOutermostBrainclawRoot(startDir) {
+    let dir = path.resolve(startDir);
+    const root = path.parse(dir).root;
+    const home = os.homedir();
+    const boundaryRaw = process.env.BRAINCLAW_STORE_BOUNDARY?.trim();
+    const boundary = boundaryRaw ? path.resolve(boundaryRaw) : undefined;
+    let outermost;
+    while (dir !== root && dir !== home) {
+        if (fs.existsSync(path.join(dir, MEMORY_DIR, 'config.yaml'))) {
+            outermost = dir;
+        }
+        if (boundary && dir === boundary)
+            break;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return outermost;
+}
+/**
+ * The workspace anchor for identity-level state (pln#648 review P1): walking
+ * UP, the NEAREST store declaring `store_type: workspace` wins; only when no
+ * workspace is declared does the outermost store answer. Without the role
+ * check, two sibling declared workspaces under a common parent store would
+ * anchor to that parent and see each other's sessions — breaking exactly the
+ * isolation `resolveWorkspaceRoot` (chain-based, role-aware) guarantees.
+ * The role is read from the raw YAML — the same convention the store-chain
+ * walk uses (`store_type` is not part of the typed Config surface) — so this
+ * stays a leaf-module fs answer with no config.ts dependency.
+ * Same stops as the outermost walk: filesystem root, $HOME, and never above
+ * BRAINCLAW_STORE_BOUNDARY.
+ */
+export function findSessionAnchorRoot(startDir) {
+    let dir = path.resolve(startDir);
+    const root = path.parse(dir).root;
+    const home = os.homedir();
+    const boundaryRaw = process.env.BRAINCLAW_STORE_BOUNDARY?.trim();
+    const boundary = boundaryRaw ? path.resolve(boundaryRaw) : undefined;
+    let outermost;
+    while (dir !== root && dir !== home) {
+        const configPath = path.join(dir, MEMORY_DIR, 'config.yaml');
+        if (fs.existsSync(configPath)) {
+            outermost = dir;
+            try {
+                if (/^store_type:\s*workspace\b/m.test(fs.readFileSync(configPath, 'utf-8'))) {
+                    return dir;
+                }
+            }
+            catch { /* unreadable config — treat as a plain store */ }
+        }
+        if (boundary && dir === boundary)
+            break;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return outermost;
+}
 export function memoryPath(filename, cwd, preferredDirName) {
     return path.join(memoryDir(cwd, preferredDirName), filename);
 }

package/dist/core/runtime.js

@@ -2,7 +2,7 @@ import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { resolveCurrentHostId, sanitizeHostId } from './host.js';
-import { resolveEntityDir } from './io.js';
+import { resolveEntityDir, sanitizeAgentPathSegment } from './io.js';
 import { mutate } from './mutation-pipeline.js';
 import { loadVersionedJsonFile, saveVersionedJsonFile } from './migration.js';
 import { RuntimeNoteSchema } from './schema.js';
@@ -19,14 +19,60 @@ function privateRuntimeDir(cwd, mode = 'read') {
     return resolveEntityDir('runtime-private', cwd ?? process.cwd(), mode);
 }
 function sharedAgentDir(agent, cwd, mode = 'read') {
-    return path.join(sharedRuntimeDir(cwd, mode), agent);
+    // pln#673 — the agent name is env-controlled and becomes a path segment:
+    // normalize it so a traversal cannot be expressed at all.
+    return path.join(sharedRuntimeDir(cwd, mode), sanitizeAgentPathSegment(agent));
+}
+/**
+ * Return a pre-normalization directory only when it is provably one direct
+ * child of `baseDir`. Compatibility reads must not reintroduce the traversal
+ * the normalized write path closes: the agent name is still env-controlled.
+ *
+ * Dots inside a segment are retained for existing names such as
+ * `Legacy.Agent`; separators, Win32 aliases (including trailing dots/spaces),
+ * and platform-invalid components are not legacy data we can safely probe.
+ */
+const UNSAFE_LEGACY_AGENT_SEGMENT_RE = /[<>:"/\\|?*\u0000-\u001F]/;
+const WIN32_RESERVED_LEGACY_AGENT_BASENAME_RE = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i;
+function legacyAgentDir(baseDir, agent) {
+    if (agent.length === 0
+        || agent !== agent.trim()
+        || agent.endsWith('.')
+        || UNSAFE_LEGACY_AGENT_SEGMENT_RE.test(agent)
+        || WIN32_RESERVED_LEGACY_AGENT_BASENAME_RE.test(agent.split('.')[0]))
+        return undefined;
+    const base = path.resolve(baseDir);
+    const candidate = path.resolve(path.join(base, agent));
+    return path.dirname(candidate) === base ? candidate : undefined;
+}
+/**
+ * Both directories an agent's notes can occupy, canonical first (pln#673).
+ * Writes always use the normalized segment; reads also probe the RAW name so
+ * notes written before the normalization stay visible — the dual-read pattern
+ * pln#648/pln#670 already use for relocated records. Deduped when the name is
+ * already canonical, which is the case for every agent brainclaw produces.
+ */
+function agentDirCandidates(baseDir, agent) {
+    const canonical = path.join(baseDir, sanitizeAgentPathSegment(agent));
+    const raw = legacyAgentDir(baseDir, agent);
+    return raw && canonical !== raw ? [canonical, raw] : [canonical];
 }
 function hostRootDir(visibility, hostId, cwd, mode = 'read') {
     const baseDir = visibility === 'machine' ? machineRuntimeDir(cwd, mode) : privateRuntimeDir(cwd, mode);
     return path.join(baseDir, sanitizeHostId(hostId));
 }
 function hostAgentDir(visibility, hostId, agent, cwd, mode = 'read') {
-    return path.join(hostRootDir(visibility, hostId, cwd, mode), agent);
+    // pln#673 — same normalization as the shared tree; the host segment was
+    // already sanitized (sanitizeHostId), the agent segment was not.
+    return path.join(hostRootDir(visibility, hostId, cwd, mode), sanitizeAgentPathSegment(agent));
+}
+/** A contained raw path that can be retired after an update reaches its canonical location. */
+function legacyRuntimeNotePath(note, visibility, hostId, cwd) {
+    const base = visibility === 'shared'
+        ? sharedRuntimeDir(cwd, 'write')
+        : hostRootDir(visibility, hostId, cwd, 'write');
+    const legacyDir = legacyAgentDir(base, note.agent);
+    return legacyDir ? path.join(legacyDir, `${note.id}.json`) : undefined;
 }
 export function ensureRuntimeDir(agent, cwd, visibility = 'shared', hostId) {
     const dir = visibility === 'shared'
@@ -57,6 +103,13 @@ export function saveRuntimeNote(note, cwd) {
             registryFaultPoint('after_registry_journal');
         }
         saveVersionedJsonFile('runtime_note', filepath, parsed);
+        // An update to a pre-normalization record must not leave two physical
+        // copies with the same id. Retire only the verified-contained raw path,
+        // and only after the canonical write succeeds.
+        const legacyPath = legacyRuntimeNotePath(note, visibility, hostId, cwd);
+        if (legacyPath && legacyPath !== filepath && fs.existsSync(legacyPath)) {
+            fs.unlinkSync(legacyPath);
+        }
         appendEvent({ action: 'create', item_type: 'runtime_note', item_id: note.id, agent: note.agent, agent_id: note.agent_id }, cwd);
         commitMemoryChange(`runtime note: ${note.note_type ?? 'note'} (${note.agent})`, cwd);
     });
@@ -64,9 +117,16 @@ export function saveRuntimeNote(note, cwd) {
 export function runtimeNotePath(note, cwd) {
     const visibility = note.visibility ?? 'shared';
     const hostId = sanitizeHostId(note.host_id ?? resolveCurrentHostId());
-    return visibility === 'shared'
-        ? path.join(sharedAgentDir(note.agent, cwd), `${note.id}.json`)
-        : path.join(hostAgentDir(visibility, hostId, note.agent, cwd), `${note.id}.json`);
+    // pln#673 — the canonical (normalized) location, plus the RAW-name fallback
+    // for notes written before the normalization: this function answers "where is
+    // THIS note", and a record must not become invisible (nor undeletable)
+    // because its directory predates the fix. Canonical first; the raw candidate
+    // only wins when it actually holds the file.
+    const base = visibility === 'shared'
+        ? sharedRuntimeDir(cwd)
+        : hostRootDir(visibility, hostId, cwd);
+    const candidates = agentDirCandidates(base, note.agent).map((dir) => path.join(dir, `${note.id}.json`));
+    return candidates.find((candidate) => fs.existsSync(candidate)) ?? candidates[0];
 }
 /**
  * Park one runtime note's raw record under `.brainclaw/gc-backups/` — the same
@@ -141,12 +201,17 @@ export function listSharedJournaledRuntimeNotes(cwd) {
 function readAgentNotes(dir, agent) {
     if (!fs.existsSync(dir))
         return [];
-    const agents = agent
-        ? [agent]
-        : fs.readdirSync(dir).filter((entry) => fs.statSync(path.join(dir, entry)).isDirectory());
+    // pln#673 — a filtered read probes BOTH the normalized directory and the raw
+    // name (a pre-normalization directory must stay readable); an unfiltered read
+    // enumerates whatever is on disk, which covers both by construction. The
+    // candidates are absolute, so the join below must not prepend `dir` again.
+    const agentDirectories = agent
+        ? agentDirCandidates(dir, agent)
+        : fs.readdirSync(dir)
+            .filter((entry) => fs.statSync(path.join(dir, entry)).isDirectory())
+            .map((entry) => path.join(dir, entry));
     const notes = [];
-    for (const a of agents) {
-        const agentDirectory = path.join(dir, a);
+    for (const agentDirectory of agentDirectories) {
         if (!fs.existsSync(agentDirectory))
             continue;
         const files = fs.readdirSync(agentDirectory).filter((file) => file.endsWith('.json'));

package/dist/core/store-resolution.js

@@ -4,7 +4,11 @@ import path from 'node:path';
 import { loadActiveProject } from './active-project.js';
 import { loadConfig } from './config.js';
 import { loadCurrentSession, loadSessionById, resolveExplicitSessionId } from './identity.js';
-import { MEMORY_DIR } from './io.js';
+import { findOutermostBrainclawRoot, MEMORY_DIR } from './io.js';
+// pln#648 — the walk moved to io.ts (leaf) so identity.ts can anchor session
+// records on it without importing this module (which imports identity.ts).
+// Re-exported here to keep the existing API surface.
+export { findOutermostBrainclawRoot } from './io.js';
 import { summarizeWorkspaceProjects } from './workspace-projects.js';
 /**
  * Walk up the filesystem from `cwd`, collecting every `.brainclaw/` directory
@@ -423,26 +427,6 @@ export function resolveProjectRef(ref, cwd = process.cwd(), storeChainOptions) {
     }
     return undefined;
 }
-/**
- * Walk UP from a directory and return the outermost .brainclaw/ root found.
- * This bypasses resolveEffectiveCwd / active project to find the true workspace root.
- */
-export function findOutermostBrainclawRoot(startDir) {
-    let dir = path.resolve(startDir);
-    const root = path.parse(dir).root;
-    const home = os.homedir();
-    let outermost;
-    while (dir !== root && dir !== home) {
-        if (fs.existsSync(path.join(dir, MEMORY_DIR, 'config.yaml'))) {
-            outermost = dir;
-        }
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    return outermost;
-}
 /**
  * Resolve the most specific child store that should answer a context request.
  *

package/dist/facts.js

@@ -1,8 +1,8 @@
 // Generated by scripts/emit-site-facts.mjs at build time. Do not edit manually.
-// Source: brainclaw v1.26.0 on 2026-08-16T20:27:49.404Z
+// Source: brainclaw v1.26.1 on 2026-08-18T15:32:22.089Z
 export const FACTS = {
-  "version": "1.26.0",
-  "generated_at": "2026-08-16T20:27:49.404Z",
+  "version": "1.26.1",
+  "generated_at": "2026-08-18T15:32:22.089Z",
   "tools": {
     "count": 70,
     "published_count": 68,
@@ -477,7 +477,7 @@ export const FACTS = {
   },
   "bench": {
     "schema": "brainclaw.bench.v1",
-    "generated_at": "2026-08-16T20:27:47.271Z",
+    "generated_at": "2026-08-18T15:32:19.941Z",
     "node_version": "v24.19.0",
     "platform": "linux-x64",
     "repeats": 3,
@@ -486,7 +486,7 @@ export const FACTS = {
         "name": "cold_onboard",
         "volume": "empty",
         "description": "fresh machine → init → first useful context. Baseline for time-to-first-value.",
-        "duration_ms_median": 75,
+        "duration_ms_median": 86,
         "payload_chars_median": 1640,
         "payload_tokens_est_median": 410
       },
@@ -494,7 +494,7 @@ export const FACTS = {
         "name": "warm_work",
         "volume": "medium",
         "description": "bclaw_work consult over a real-shaped store (~200 plans / 500 handoffs / 450 claims).",
-        "duration_ms_median": 132,
+        "duration_ms_median": 128,
         "payload_chars_median": 2626,
         "payload_tokens_est_median": 657
       },

package/dist/facts.json

@@ -1,6 +1,6 @@
 {
-  "version": "1.26.0",
-  "generated_at": "2026-08-16T20:27:49.404Z",
+  "version": "1.26.1",
+  "generated_at": "2026-08-18T15:32:22.089Z",
   "tools": {
     "count": 70,
     "published_count": 68,
@@ -475,7 +475,7 @@
   },
   "bench": {
     "schema": "brainclaw.bench.v1",
-    "generated_at": "2026-08-16T20:27:47.271Z",
+    "generated_at": "2026-08-18T15:32:19.941Z",
     "node_version": "v24.19.0",
     "platform": "linux-x64",
     "repeats": 3,
@@ -484,7 +484,7 @@
         "name": "cold_onboard",
         "volume": "empty",
         "description": "fresh machine → init → first useful context. Baseline for time-to-first-value.",
-        "duration_ms_median": 75,
+        "duration_ms_median": 86,
         "payload_chars_median": 1640,
         "payload_tokens_est_median": 410
       },
@@ -492,7 +492,7 @@
         "name": "warm_work",
         "volume": "medium",
         "description": "bclaw_work consult over a real-shaped store (~200 plans / 500 handoffs / 450 claims).",
-        "duration_ms_median": 132,
+        "duration_ms_median": 128,
         "payload_chars_median": 2626,
         "payload_tokens_est_median": 657
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brainclaw",
-  "version": "1.26.0",
+  "version": "1.26.1",
   "description": "Shared project memory for humans and coding agents.",
   "type": "module",
   "repository": {