chainlesschain 0.162.160 → 0.162.162

package/src/lib/event-seq-replay.js

@@ -0,0 +1,167 @@
+/**
+ * Event-stream gap-detection + replay primitives — the server→client (event)
+ * counterpart to the client→server RemoteCommandLedger (harness/
+ * remote-command-ledger.js). Both give a reconnecting peer an at-most-once,
+ * totally-ordered view over a lossy transport; the ledger orders *commands*,
+ * this orders *events*.
+ *
+ * A producer keeps a bounded buffer of recently emitted, seq-stamped frames
+ * (EventReplayBuffer); a reconnecting consumer reports its last-seen seq and
+ * gets the tail re-sent, or is told to full-resync when the missed range has
+ * already been evicted. A consumer detects holes with SeqGapTracker.
+ *
+ * Pure + deterministic: no I/O, no timers, no globals. The `seq` it stamps is
+ * the same additive protocol-v1 notion used on the stream-json surface
+ * (agent-sdk docs/PROTOCOL.md §1.2.1) — 1-based, monotonic, per producer
+ * instance; consumers MUST tolerate its absence and MUST NOT require gap-free
+ * numbering across a producer restart (a fresh instance rewinds to 1).
+ */
+
+const DEFAULT_MAX_EVENTS = 512;
+const DEFAULT_MAX_BYTES = 1 << 20; // 1 MiB — bound memory on a chatty session
+
+/** Best-effort byte size of a frame (overridable for deterministic tests). */
+function approxBytes(frame) {
+  try {
+    return Buffer.byteLength(JSON.stringify(frame));
+  } catch {
+    return 0; // circular / unserializable — don't let sizing throw
+  }
+}
+
+/**
+ * Producer-side bounded replay buffer. `record(frame)` stamps the next `seq`
+ * onto a shallow copy, retains it (evicting the oldest beyond count/byte
+ * bounds), and returns the stamped frame ready to send. `replaySince(cursor)`
+ * returns the frames a consumer with last-seen seq `cursor` still needs.
+ */
+export class EventReplayBuffer {
+  constructor({
+    maxEvents = DEFAULT_MAX_EVENTS,
+    maxBytes = DEFAULT_MAX_BYTES,
+    sizeOf,
+  } = {}) {
+    this._max = Math.max(1, Math.floor(maxEvents) || DEFAULT_MAX_EVENTS);
+    this._maxBytes = Math.max(0, Math.floor(maxBytes) || 0);
+    this._sizeOf = typeof sizeOf === "function" ? sizeOf : approxBytes;
+    this._buf = []; // [{ seq, frame, bytes }] oldest → newest
+    this._seq = 0;
+    this._bytes = 0;
+  }
+
+  /** Highest seq stamped so far (0 before anything is recorded). */
+  get latestSeq() {
+    return this._seq;
+  }
+
+  /** Oldest seq still retained (== latestSeq when the buffer is empty). */
+  get oldestSeq() {
+    return this._buf.length ? this._buf[0].seq : this._seq;
+  }
+
+  /** Number of frames currently retained. */
+  get size() {
+    return this._buf.length;
+  }
+
+  /**
+   * Stamp the next seq onto `frame` (shallow copy), retain it, evict overflow.
+   * @returns the stamped frame (`{ ...frame, seq }`) to hand straight to send.
+   */
+  record(frame) {
+    const seq = ++this._seq;
+    const stamped = { ...frame, seq };
+    const bytes = this._sizeOf(stamped) || 0;
+    this._buf.push({ seq, frame: stamped, bytes });
+    this._bytes += bytes;
+    this._evict();
+    return stamped;
+  }
+
+  _evict() {
+    // Always keep at least the newest frame even if it alone exceeds maxBytes.
+    while (
+      this._buf.length > this._max ||
+      (this._maxBytes > 0 &&
+        this._bytes > this._maxBytes &&
+        this._buf.length > 1)
+    ) {
+      const dropped = this._buf.shift();
+      this._bytes -= dropped.bytes;
+    }
+  }
+
+  /**
+   * Frames a consumer whose last-seen seq is `cursor` still needs.
+   *  - `cursor >= latestSeq` → nothing missed → `{ frames: [], truncated: false }`.
+   *  - `cursor` still within the retained window → the exact tail after it.
+   *  - `cursor` older than what's retained → the gap was evicted →
+   *    `truncated: true` (consumer MUST full-resync; the returned frames are
+   *    only the retained suffix, not the whole hole).
+   * @param {number} cursor last seq the consumer acknowledged (default 0 = all)
+   */
+  replaySince(cursor = 0) {
+    const c = Number.isFinite(cursor) ? cursor : 0;
+    if (c >= this._seq) {
+      return { frames: [], truncated: false, from: c, to: this._seq };
+    }
+    // The lowest cursor we can honor without a hole is (oldest retained − 1).
+    const floor = this._buf.length ? this._buf[0].seq - 1 : this._seq;
+    const truncated = c < floor;
+    const frames = this._buf.filter((e) => e.seq > c).map((e) => e.frame);
+    return { frames, truncated, from: c, to: this._seq };
+  }
+}
+
+const OK = Object.freeze({ status: "ok" });
+
+/**
+ * Consumer-side sequence tracker. Feed it each received frame's `seq`; it
+ * reports contiguity so the consumer can request a replay on a hole and drop
+ * duplicates a reconnect re-sent. One tracker per producer epoch — reset it
+ * when the transport hands you a fresh producer instance (e.g. a non-reattach
+ * bg-attach reply), since a fresh producer rewinds seq to 1.
+ */
+export class SeqGapTracker {
+  constructor() {
+    this._last = 0;
+    this._started = false;
+  }
+
+  /** Last contiguous seq accepted (0 before the first frame). */
+  get lastSeq() {
+    return this._last;
+  }
+
+  /**
+   * @param {number} seq the received frame's seq (absent/NaN on older
+   *   producers that don't stamp — treated as always-ok, never a gap).
+   * @returns {{status:"ok"}|{status:"duplicate"}|{status:"gap",from:number,to:number}}
+   *   - `ok`: contiguous (or the first frame, or an unstamped frame).
+   *   - `duplicate`: `seq <= lastSeq` — already seen; drop it.
+   *   - `gap`: `seq > lastSeq + 1` — frames `(from, to)` were missed; ask the
+   *     producer for `replaySince(from)`. The tracker adopts `to` as current.
+   */
+  observe(seq) {
+    if (!Number.isFinite(seq)) return OK; // unstamped producer — tolerate
+    if (!this._started) {
+      this._started = true;
+      this._last = seq;
+      return OK;
+    }
+    if (seq === this._last + 1) {
+      this._last = seq;
+      return OK;
+    }
+    if (seq <= this._last) return { status: "duplicate" };
+    const from = this._last;
+    this._last = seq; // adopt new position; caller replays the (from, to) hole
+    return { status: "gap", from, to: seq };
+  }
+
+  /** Forget all history (call when attaching to a fresh producer instance). */
+  reset() {
+    this._last = 0;
+    this._started = false;
+  }
+}

package/src/lib/goal-condition-engine.js

@@ -0,0 +1,369 @@
+/**
+ * Session-level completion-condition engine (P1 §"会话级完成条件引擎").
+ *
+ * Distinct from `cc goal` (long-term, cross-session OKR progress) and from
+ * `cc loop` (a timer that re-runs ONE command): this drives the agent's OUTER
+ * turns. After each outer turn an independent evaluator judges a completion
+ * CONDITION; if unmet, the runner starts the next outer turn — until the
+ * condition is met (`completed`) or a budget is exhausted (`exhausted`).
+ *
+ * The engine is a pure reducer over usage + per-turn evaluations, so it is
+ * deterministically testable without a model or the real agent loop. It:
+ *   - supports model-judged conditions AND deterministic checkers
+ *     (exit-zero / file-exists / contains / regex),
+ *   - enforces max_outer_turns and token / cost / time budgets,
+ *   - emits the SDK event taxonomy (goal_started / goal_evaluated /
+ *     goal_completed / goal_exhausted) with structured reason, evidence and
+ *     turn/token/cost/time, and
+ *   - snapshots/restores so a condition survives `--resume`.
+ *
+ * The clock is injected (`now`) and NEVER read implicitly, so snapshots replay
+ * identically and tests are deterministic.
+ */
+
+/** SDK event taxonomy for the completion-condition loop. */
+export const GOAL_EVENTS = Object.freeze({
+  STARTED: "goal_started",
+  EVALUATED: "goal_evaluated",
+  COMPLETED: "goal_completed",
+  EXHAUSTED: "goal_exhausted",
+});
+
+/** Terminal decisions the reducer can return alongside `continue`. */
+export const GOAL_DECISION = Object.freeze({
+  CONTINUE: "continue",
+  COMPLETE: "complete",
+  EXHAUSTED: "exhausted",
+});
+
+/** Default budget — a bounded outer-turn count; other axes unbounded (null). */
+export const DEFAULT_GOAL_BUDGET = Object.freeze({
+  maxOuterTurns: 10,
+  maxTokens: null,
+  maxCostUsd: null,
+  maxTimeMs: null,
+});
+
+// A hard ceiling so a misconfigured condition can never spin forever.
+const OUTER_TURN_HARD_CAP = 100;
+
+function positiveIntOrNull(value, cap) {
+  const n = Number(value);
+  if (!Number.isFinite(n) || n <= 0) return null;
+  const floored = Math.floor(n);
+  return cap ? Math.min(floored, cap) : floored;
+}
+
+function positiveNumOrNull(value) {
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? n : null;
+}
+
+/** Normalize a budget: sane defaults, positive values, hard outer-turn cap. */
+export function normalizeGoalBudget(input = {}) {
+  const maxOuterTurns =
+    positiveIntOrNull(input.maxOuterTurns, OUTER_TURN_HARD_CAP) ??
+    DEFAULT_GOAL_BUDGET.maxOuterTurns;
+  return {
+    maxOuterTurns,
+    maxTokens: positiveIntOrNull(input.maxTokens),
+    maxCostUsd: positiveNumOrNull(input.maxCostUsd),
+    maxTimeMs: positiveIntOrNull(input.maxTimeMs),
+  };
+}
+
+/**
+ * Parse a `--goal-condition` spec into a condition descriptor. A `kind:` prefix
+ * selects a deterministic checker; anything else (or an explicit `model:`) is
+ * model-judged natural language.
+ *
+ *   exit-zero:npm test        → run the command, met iff exit 0
+ *   file-exists:dist/app.js   → met iff the path exists
+ *   contains:ALL GREEN        → met iff the last output contains the text
+ *   regex:^BUILD OK$          → met iff the last output matches
+ *   model:the tests pass      → a model judges the transcript
+ *   the tests pass            → (bare) model-judged
+ */
+export function parseGoalCondition(spec) {
+  const raw = String(spec ?? "").trim();
+  if (!raw) throw new Error("goal condition is required");
+  const idx = raw.indexOf(":");
+  const prefix = idx === -1 ? "" : raw.slice(0, idx).trim().toLowerCase();
+  const rest = idx === -1 ? "" : raw.slice(idx + 1).trim();
+  switch (prefix) {
+    case "exit-zero":
+    case "exit0":
+      if (!rest) throw new Error("exit-zero condition needs a command");
+      return { kind: "exit-zero", command: rest, source: raw };
+    case "file-exists":
+    case "file":
+      if (!rest) throw new Error("file-exists condition needs a path");
+      return { kind: "file-exists", path: rest, source: raw };
+    case "contains":
+      if (!rest) throw new Error("contains condition needs text");
+      return { kind: "contains", text: rest, source: raw };
+    case "regex":
+      if (!rest) throw new Error("regex condition needs a pattern");
+      return { kind: "regex", pattern: rest, source: raw };
+    case "model":
+      if (!rest) throw new Error("model condition needs a description");
+      return { kind: "model", text: rest, source: raw };
+    default:
+      return { kind: "model", text: raw, source: raw };
+  }
+}
+
+/** True when a condition is a deterministic checker (not model-judged). */
+export function isDeterministicCondition(condition) {
+  return Boolean(condition) && condition.kind !== "model";
+}
+
+/**
+ * Evaluate a deterministic condition against gathered evidence — PURE.
+ * `evidence` supplies `output` (last turn text), `exitCode`, and a
+ * `fileExists(path) => boolean` predicate. Returns `{met, reason, evidence}`.
+ */
+export function checkDeterministicCondition(condition, evidence = {}) {
+  const output = String(evidence.output ?? "");
+  switch (condition?.kind) {
+    case "contains": {
+      const met = output.includes(condition.text);
+      return {
+        met,
+        reason: met
+          ? `output contains "${condition.text}"`
+          : `output does not contain "${condition.text}"`,
+        evidence: { kind: "contains", matched: met },
+      };
+    }
+    case "regex": {
+      let re;
+      try {
+        re = new RegExp(condition.pattern, condition.flags || "m");
+      } catch (err) {
+        return {
+          met: false,
+          reason: `invalid regex: ${err.message}`,
+          evidence: { kind: "regex", error: true },
+        };
+      }
+      const met = re.test(output);
+      return {
+        met,
+        reason: met
+          ? `output matches /${condition.pattern}/`
+          : `output does not match /${condition.pattern}/`,
+        evidence: { kind: "regex", matched: met },
+      };
+    }
+    case "exit-zero": {
+      const met = Number(evidence.exitCode) === 0;
+      return {
+        met,
+        reason: `\`${condition.command}\` exited ${evidence.exitCode}`,
+        evidence: { kind: "exit-zero", exitCode: evidence.exitCode ?? null },
+      };
+    }
+    case "file-exists": {
+      const fx = typeof evidence.fileExists === "function";
+      const met = fx ? evidence.fileExists(condition.path) === true : false;
+      return {
+        met,
+        reason: met
+          ? `${condition.path} exists`
+          : `${condition.path} does not exist`,
+        evidence: { kind: "file-exists", path: condition.path, met },
+      };
+    }
+    default:
+      return {
+        met: false,
+        reason: `not a deterministic condition (${condition?.kind})`,
+        evidence: { kind: condition?.kind ?? "unknown" },
+      };
+  }
+}
+
+/**
+ * Gather evidence and run a deterministic check. Deps (`spawnSync`,
+ * `existsSync`) are injected for tests; `lastOutput` feeds contains/regex.
+ */
+export function runDeterministicCheck(condition, deps = {}) {
+  const evidence = { output: deps.lastOutput ?? "" };
+  if (condition.kind === "exit-zero") {
+    const spawnSync = deps.spawnSync;
+    if (typeof spawnSync !== "function") {
+      return {
+        met: false,
+        reason: "no spawnSync available for exit-zero",
+        evidence: { kind: "exit-zero", error: true },
+      };
+    }
+    const res = spawnSync(condition.command, {
+      cwd: deps.cwd,
+      shell: true,
+      encoding: "utf8",
+      windowsHide: true,
+    });
+    evidence.exitCode = res?.status ?? (res?.error ? 1 : null);
+  } else if (condition.kind === "file-exists") {
+    const existsSync = deps.existsSync;
+    evidence.fileExists = (p) =>
+      typeof existsSync === "function" ? existsSync(p) === true : false;
+  }
+  return checkDeterministicCondition(condition, evidence);
+}
+
+function usageSnapshot(state, nowMs) {
+  return {
+    outerTurns: state.outerTurns,
+    tokens: state.tokens,
+    costUsd: state.costUsd,
+    elapsedMs: Math.max(0, nowMs - state.startedAtMs),
+  };
+}
+
+function whichLimitHit(state, budget, nowMs) {
+  if (budget.maxOuterTurns != null && state.outerTurns >= budget.maxOuterTurns)
+    return "max_outer_turns";
+  if (budget.maxTokens != null && state.tokens >= budget.maxTokens)
+    return "max_tokens";
+  if (budget.maxCostUsd != null && state.costUsd >= budget.maxCostUsd)
+    return "max_cost";
+  if (
+    budget.maxTimeMs != null &&
+    Math.max(0, nowMs - state.startedAtMs) >= budget.maxTimeMs
+  )
+    return "max_time";
+  return null;
+}
+
+/**
+ * The pure decision step. Given the accumulated `state`, this turn's
+ * `evaluation` ({met, reason, evidence}), the `budget`, and the current time,
+ * decide `complete | continue | exhausted` and produce events. Always emits a
+ * `goal_evaluated`; adds a terminal `goal_completed` / `goal_exhausted` when
+ * the loop stops. Does NOT mutate `state` — returns the next one.
+ */
+export function evaluateGoalStep(state, evaluation, budget, opts = {}) {
+  const nowMs = Number(opts.now ?? state.startedAtMs);
+  const next = {
+    ...state,
+    outerTurns: state.outerTurns + 1,
+  };
+  const usage = usageSnapshot(next, nowMs);
+  const met = evaluation?.met === true;
+  const evaluated = {
+    type: GOAL_EVENTS.EVALUATED,
+    met,
+    reason: evaluation?.reason ?? null,
+    evidence: evaluation?.evidence ?? null,
+    ...usage,
+  };
+  if (met) {
+    return {
+      state: { ...next, done: true, outcome: "completed" },
+      decision: GOAL_DECISION.COMPLETE,
+      events: [
+        evaluated,
+        {
+          type: GOAL_EVENTS.COMPLETED,
+          reason: evaluation?.reason ?? "condition met",
+          evidence: evaluation?.evidence ?? null,
+          ...usage,
+        },
+      ],
+    };
+  }
+  const limit = whichLimitHit(next, budget, nowMs);
+  if (limit) {
+    return {
+      state: { ...next, done: true, outcome: "exhausted", limit },
+      decision: GOAL_DECISION.EXHAUSTED,
+      events: [
+        evaluated,
+        {
+          type: GOAL_EVENTS.EXHAUSTED,
+          limit,
+          reason: `budget exhausted (${limit})`,
+          ...usage,
+        },
+      ],
+    };
+  }
+  return { state: next, decision: GOAL_DECISION.CONTINUE, events: [evaluated] };
+}
+
+/**
+ * Stateful wrapper over the reducer for the runner. Inject `now` (a `() => ms`
+ * clock) so behavior is deterministic and snapshot-replayable.
+ */
+export class GoalConditionEngine {
+  constructor({ condition, budget, now } = {}) {
+    this.condition =
+      typeof condition === "string" ? parseGoalCondition(condition) : condition;
+    this.budget = normalizeGoalBudget(budget);
+    this._now = typeof now === "function" ? now : () => 0;
+    this.state = {
+      outerTurns: 0,
+      tokens: 0,
+      costUsd: 0,
+      startedAtMs: this._now(),
+      done: false,
+      outcome: null,
+    };
+  }
+
+  /** Emit the opening event; call once before the first outer turn. */
+  start() {
+    return {
+      type: GOAL_EVENTS.STARTED,
+      condition: this.condition,
+      budget: this.budget,
+      startedAtMs: this.state.startedAtMs,
+    };
+  }
+
+  /** Accumulate a turn's usage before evaluating it. */
+  recordTurnUsage({ tokens = 0, costUsd = 0 } = {}) {
+    this.state = {
+      ...this.state,
+      tokens: this.state.tokens + (Number(tokens) || 0),
+      costUsd: this.state.costUsd + (Number(costUsd) || 0),
+    };
+    return this.state;
+  }
+
+  /** Evaluate this outer turn; returns `{decision, events}`. */
+  evaluate(evaluation) {
+    const result = evaluateGoalStep(this.state, evaluation, this.budget, {
+      now: this._now(),
+    });
+    this.state = result.state;
+    return { decision: result.decision, events: result.events };
+  }
+
+  get done() {
+    return this.state.done === true;
+  }
+
+  /** Serialize for `--resume`. startedAtMs is preserved so time keeps counting. */
+  snapshot() {
+    return {
+      condition: this.condition,
+      budget: this.budget,
+      state: { ...this.state },
+    };
+  }
+
+  /** Restore a prior run (same clock injection contract). */
+  static fromSnapshot(snap, { now } = {}) {
+    const engine = new GoalConditionEngine({
+      condition: snap.condition,
+      budget: snap.budget,
+      now,
+    });
+    engine.state = { ...snap.state };
+    return engine;
+  }
+}

package/src/lib/headless-manifest.js

@@ -16,6 +16,7 @@
 
 import crypto from "node:crypto";
 import { createRequire } from "node:module";
+import { PROTOCOL_MIN_VERSION } from "./capability-negotiation.js";
 
 export const STREAM_PROTOCOL_VERSION = 1;
 
@@ -137,6 +138,10 @@ export function buildAgentCapabilities() {
     name: "chainlesschain-cli",
     version,
     protocol_version: STREAM_PROTOCOL_VERSION,
+    // Oldest wire version this CLI can still negotiate down to (the N-1 in the
+    // capability handshake, agent-sdk docs/PROTOCOL.md §1.3). At v1 there is no
+    // older line shape, so min === current.
+    min_protocol_version: PROTOCOL_MIN_VERSION,
     agent_tools: contract.listCodingAgentToolNames(),
     permission_modes: [
       "default",
@@ -162,6 +167,14 @@ export function buildAgentCapabilities() {
       interactive_approvals: true,
       permission_prompt_tool: true,
       remote_control: true,
+      // Additive protocol-v1 stream fields (agent-sdk docs/PROTOCOL.md §1.2.1):
+      // every stream-json stdout line carries a monotonic `seq` and a
+      // run-scoped `trace_id`, and tool_use/tool_result lines carry a pairing
+      // `id` ("tu-<n>"). `trace_id` is caller-injectable (--trace-id /
+      // CC_TRACE_ID) for end-to-end IDE ↔ CLI correlation.
+      tool_use_id: true,
+      event_seq: true,
+      trace_id: true,
       mcp: {
         config_file: true,
         registry: true,

package/src/lib/ide-context.js

@@ -22,6 +22,7 @@ import {
   filterIdeFileEntry,
   redactSecretsInText,
 } from "./ide-context-redaction.js";
+import { normalizeIdePathForCli, detectWsl } from "./remote-path-mapping.js";
 
 /** Hard cap on the selected text we inline into the prompt. */
 const SELECTION_TEXT_CAP = 2000;
@@ -95,24 +96,55 @@ export function parseToolResultJson(result) {
 // through read_file), so credential files and secret-shaped text are filtered
 // HERE, at the collection boundary, before anything reaches the prompt.
 // CC_IDE_CONTEXT_REDACTION=0 disables (the filters below become pass-through).
+//
+// The same boundary also folds a remote file representation (a vscode-remote://
+// URI, a \\wsl.localhost\… UNC, or a Windows drive path while cc runs in WSL)
+// into the path THIS host can open (see [[remote-path-mapping.js]]) — otherwise
+// the agent, reading the inlined path, would target a file cc can't see. The
+// credential filter runs on the ORIGINAL value (basename is preserved by the
+// map, so the verdict is unchanged). CC_IDE_PATH_MAP=0 disables it.
+
+/** Env gate: CC_IDE_PATH_MAP=0|false|off disables remote path normalization. */
+export function idePathMapEnabled(env = process.env) {
+  const v = String(env?.CC_IDE_PATH_MAP ?? "").toLowerCase();
+  return !(v === "0" || v === "false" || v === "off");
+}
+
+/** Fold one IDE-reported file value into a path cc can open on this host. */
+function mapIdeFile(file, env) {
+  if (typeof file !== "string" || !idePathMapEnabled(env)) return file;
+  return normalizeIdePathForCli(file, {
+    platform: process.platform,
+    wsl: detectWsl(env || {}),
+  });
+}
 
 /** Drop the selection when it lives in a credential file; scrub its text. */
 function sanitizeIdeSelection(sel, env) {
   if (!sel) return sel;
   if (sel.file && filterIdeFileEntry(sel.file, { env }) === null) return null;
-  if (typeof sel.text === "string" && sel.text.length > 0) {
-    const scrubbed = redactSecretsInText(sel.text, { env });
-    if (scrubbed !== sel.text) return { ...sel, text: scrubbed };
+  let out = sel;
+  const mappedFile = mapIdeFile(sel.file, env);
+  if (mappedFile !== sel.file) out = { ...out, file: mappedFile };
+  if (typeof out.text === "string" && out.text.length > 0) {
+    const scrubbed = redactSecretsInText(out.text, { env });
+    if (scrubbed !== out.text) out = { ...out, text: scrubbed };
   }
-  return sel;
+  return out;
 }
 
-/** Drop open-editor entries whose file is a credential file. */
+/** Drop open-editor entries whose file is a credential file; map the rest. */
 function sanitizeIdeEditors(editors, env) {
   if (!Array.isArray(editors)) return editors;
-  return editors.filter(
-    (e) => !(e && e.file && filterIdeFileEntry(e.file, { env }) === null),
-  );
+  return editors
+    .filter(
+      (e) => !(e && e.file && filterIdeFileEntry(e.file, { env }) === null),
+    )
+    .map((e) => {
+      if (!e || typeof e.file !== "string") return e;
+      const mapped = mapIdeFile(e.file, env);
+      return mapped === e.file ? e : { ...e, file: mapped };
+    });
 }
 
 /** Scrub secret-shaped text out of terminal commands and their output. */
@@ -131,18 +163,25 @@ function sanitizeIdeTerminals(terms, env) {
   });
 }
 
-/** Drop diagnostics for credential files; scrub their message text. */
+/** Drop diagnostics for credential files; map their file + scrub message text. */
 function sanitizeIdeDiagnostics(diags, env) {
   if (!Array.isArray(diags)) return diags;
   return diags
     .filter(
       (d) => !(d && d.file && filterIdeFileEntry(d.file, { env }) === null),
     )
-    .map((d) =>
-      d && typeof d.message === "string"
-        ? { ...d, message: redactSecretsInText(d.message, { env }) }
-        : d,
-    );
+    .map((d) => {
+      if (!d) return d;
+      let out = d;
+      if (typeof d.file === "string") {
+        const mapped = mapIdeFile(d.file, env);
+        if (mapped !== d.file) out = { ...out, file: mapped };
+      }
+      if (typeof out.message === "string") {
+        out = { ...out, message: redactSecretsInText(out.message, { env }) };
+      }
+      return out;
+    });
 }
 
 /** Resolve to the promise's value, or null after `ms` / on rejection. */