hillclimb 0.9.3 → 0.9.5

package/dist/main.js

@@ -13,8 +13,8 @@ import {
 } from "./chunk-UPXMA7RC.js";
 
 // src/main.ts
-import fs27 from "fs";
-import path26 from "path";
+import fs28 from "fs";
+import path27 from "path";
 import * as p6 from "@clack/prompts";
 
 // src/commands/init.ts
@@ -2714,9 +2714,9 @@ async function runStatus(args = []) {
 // src/commands/upload.ts
 import { spawn as spawn3 } from "child_process";
 import crypto8 from "crypto";
-import fs20 from "fs";
+import fs21 from "fs";
 import os10 from "os";
-import path19 from "path";
+import path20 from "path";
 
 // src/agent-pending.ts
 import crypto4 from "crypto";
@@ -4733,6 +4733,25 @@ async function readFileContent(file) {
     return { kind: "error" };
   }
 }
+async function readFileBuffer(file) {
+  if (file.isBinary) {
+    return { kind: "binary" };
+  }
+  if (file.content) {
+    return { kind: "bytes", content: file.content };
+  }
+  if (await checkBinary(file.absolutePath)) {
+    return { kind: "binary" };
+  }
+  try {
+    return {
+      kind: "bytes",
+      content: await fs13.promises.readFile(file.absolutePath)
+    };
+  } catch {
+    return { kind: "error" };
+  }
+}
 
 // src/middleware/large-file.ts
 import { constants as bufferConstants } from "buffer";
@@ -4743,36 +4762,307 @@ function getLargeFileThreshold() {
 }
 var NEWLINE = 10;
 var OVERSIZED_LINE_PLACEHOLDER = '{"_hillclimb_omitted":"line exceeded max string length; dropped to allow redaction"}';
-function redactBufferByLine(buffer, redactLine, options = {}) {
+function scanBufferLines(buffer, redactLine, options = {}) {
   const maxLineBytes = options.maxLineBytes ?? MAX_STRINGIFIABLE_BYTES;
   const oversizedPlaceholder = options.oversizedPlaceholder ?? OVERSIZED_LINE_PLACEHOLDER;
-  const pieces = [];
-  const newlineBuf = Buffer.from([NEWLINE]);
+  const end = options.end ?? buffer.length;
+  const ownsFinalLine = end === buffer.length;
+  const edits = [];
   let totalCount = 0;
   let oversizedLines = 0;
-  let start = 0;
-  let first = true;
-  for (; ; ) {
+  let start = options.start ?? 0;
+  while (ownsFinalLine || start < end) {
     const nl = buffer.indexOf(NEWLINE, start);
-    const end = nl === -1 ? buffer.length : nl;
-    const slice = buffer.subarray(start, end);
-    if (!first) pieces.push(newlineBuf);
-    first = false;
-    if (slice.length > maxLineBytes) {
+    const lineEnd = nl === -1 ? buffer.length : nl;
+    if (lineEnd - start > maxLineBytes) {
       oversizedLines++;
-      pieces.push(Buffer.from(oversizedPlaceholder, "utf-8"));
+      edits.push({ start, end: lineEnd, value: oversizedPlaceholder });
     } else {
-      const { value, count } = redactLine(slice.toString("utf-8"));
-      totalCount += count;
-      pieces.push(Buffer.from(value, "utf-8"));
+      const { value, count } = redactLine(
+        buffer.toString("utf-8", start, lineEnd)
+      );
+      if (count > 0) {
+        totalCount += count;
+        edits.push({ start, end: lineEnd, value });
+      }
     }
     if (nl === -1) break;
     start = nl + 1;
   }
+  return { edits, count: totalCount, oversizedLines };
+}
+function applyLineEdits(buffer, edits) {
+  if (edits.length === 0) return buffer;
+  const pieces = [];
+  let copied = 0;
+  for (const edit of edits) {
+    pieces.push(buffer.subarray(copied, edit.start));
+    pieces.push(Buffer.from(edit.value, "utf-8"));
+    copied = edit.end;
+  }
+  pieces.push(buffer.subarray(copied));
+  return Buffer.concat(pieces);
+}
+function redactBufferByLine(buffer, redactLine, options = {}) {
+  const { edits, count, oversizedLines } = scanBufferLines(
+    buffer,
+    redactLine,
+    options
+  );
+  return { content: applyLineEdits(buffer, edits), count, oversizedLines };
+}
+
+// src/middleware/pattern-prefilter.ts
+var MIN_LITERAL = 3;
+function score(req) {
+  if (!req) return -1;
+  let min = Number.POSITIVE_INFINITY;
+  for (const s of req) min = Math.min(min, s.length);
+  return min * 1e3 - req.length;
+}
+function better(a, b) {
+  return score(b) > score(a) ? b : a;
+}
+function isAsciiLiteral(ch) {
+  const c = ch.charCodeAt(0);
+  return c >= 32 && c < 127;
+}
+var UNKNOWN = { literals: null, minLength: 0 };
+function analyzeRegex(source, flags = "") {
+  if (flags.includes("v")) return UNKNOWN;
+  let i = 0;
+  function skipPast(close) {
+    const at = source.indexOf(close, i);
+    if (at === -1) throw new Error("unterminated escape");
+    i = at + 1;
+  }
+  function flush(seq) {
+    if (seq.run.length > 0) {
+      seq.req = better(seq.req, [seq.run.toLowerCase()]);
+      seq.run = "";
+    }
+  }
+  function quantifier() {
+    const ch = source[i];
+    let min = null;
+    if (ch === "*" || ch === "?") {
+      min = 0;
+      i++;
+    } else if (ch === "+") {
+      min = 1;
+      i++;
+    } else if (ch === "{") {
+      const m = /^\{(\d+)(?:,\d*)?\}/.exec(source.slice(i));
+      if (m) {
+        min = Number(m[1]);
+        i += m[0].length;
+      }
+    }
+    if (min !== null && source[i] === "?") i++;
+    return min;
+  }
+  function skipClass() {
+    i++;
+    while (i < source.length && source[i] !== "]") {
+      if (source[i] === "\\") i++;
+      i++;
+    }
+    i++;
+  }
+  function alternation() {
+    const branches = [];
+    let seq = { req: null, run: "", min: 0 };
+    while (i < source.length && source[i] !== ")") {
+      const ch = source[i];
+      if (ch === "|") {
+        flush(seq);
+        branches.push(seq);
+        seq = { req: null, run: "", min: 0 };
+        i++;
+        continue;
+      }
+      if (ch === "(") {
+        i++;
+        let lookaround = false;
+        if (source[i] === "?") {
+          const m = /^\?(?:[:=!]|<[=!]|<[A-Za-z_$][\w$]*>)/.exec(
+            source.slice(i)
+          );
+          if (!m) throw new Error(`unsupported group at ${i}`);
+          lookaround = m[0] !== "?:" && !m[0].endsWith(">");
+          i += m[0].length;
+        }
+        const inner = alternation();
+        if (source[i] !== ")") throw new Error("unbalanced group");
+        i++;
+        const min3 = quantifier();
+        flush(seq);
+        if (!lookaround) {
+          seq.min += inner.min * (min3 ?? 1);
+          if (min3 === null || min3 >= 1) seq.req = better(seq.req, inner.req);
+        }
+        continue;
+      }
+      if (ch === "[" || ch === ".") {
+        if (ch === "[") skipClass();
+        else i++;
+        seq.min += quantifier() ?? 1;
+        flush(seq);
+        continue;
+      }
+      if (ch === "^" || ch === "$") {
+        i++;
+        quantifier();
+        flush(seq);
+        continue;
+      }
+      let lit;
+      let width = 1;
+      if (ch === "\\") {
+        const e = source[i + 1];
+        i += 2;
+        if (/[A-Za-z0-9]/.test(e)) {
+          if (!/[dDwWsS]/.test(e)) width = 0;
+          if (e === "x") i += 2;
+          else if (e === "u") {
+            if (source[i] === "{") skipPast("}");
+            else i += 4;
+          } else if (e === "c") i += 1;
+          else if (e === "k" && source[i] === "<") skipPast(">");
+          else if ((e === "p" || e === "P") && source[i] === "{") skipPast("}");
+          lit = null;
+        } else {
+          lit = e;
+        }
+      } else {
+        lit = ch;
+        i++;
+      }
+      const min2 = quantifier();
+      seq.min += width * (min2 ?? 1);
+      if (lit === null || !isAsciiLiteral(lit)) {
+        flush(seq);
+      } else if (min2 === null) {
+        seq.run += lit;
+      } else {
+        if (min2 >= 1) seq.run += lit;
+        flush(seq);
+      }
+    }
+    flush(seq);
+    branches.push(seq);
+    let min = Number.POSITIVE_INFINITY;
+    let all = [];
+    for (const b of branches) {
+      min = Math.min(min, b.min);
+      if (!b.req) all = null;
+      else all?.push(...b.req);
+    }
+    return { req: all ? [...new Set(all)] : null, min };
+  }
+  try {
+    const { req, min } = alternation();
+    if (i !== source.length) return UNKNOWN;
+    const foldsBeyondAscii = flags.includes("i") && flags.includes("u");
+    const usable = req && !foldsBeyondAscii && !req.some((s) => s.length < MIN_LITERAL);
+    return { literals: usable ? req : null, minLength: min };
+  } catch {
+    return UNKNOWN;
+  }
+}
+function isAscii(text2) {
+  for (let k = 0; k < text2.length; k++) {
+    if (text2.charCodeAt(k) >= 128) return false;
+  }
+  return true;
+}
+function buildPrefilter(literalsByRule) {
+  const alwaysRun = [];
+  const goto = [/* @__PURE__ */ new Map()];
+  const outs = [[]];
+  literalsByRule.forEach((given, rule) => {
+    const lits = given?.map((lit) => lit.toLowerCase());
+    if (!lits || lits.some((lit) => lit === "" || !isAscii(lit))) {
+      alwaysRun.push(rule);
+      return;
+    }
+    for (const lit of lits) {
+      let s = 0;
+      for (let k = 0; k < lit.length; k++) {
+        const c = lit.charCodeAt(k);
+        let n = goto[s].get(c);
+        if (n === void 0) {
+          n = goto.length;
+          goto.push(/* @__PURE__ */ new Map());
+          outs.push([]);
+          goto[s].set(c, n);
+        }
+        s = n;
+      }
+      outs[s].push(rule);
+    }
+  });
+  const nStates = goto.length;
+  const next = new Int32Array(nStates << 7);
+  const fail = new Int32Array(nStates);
+  const queue = [];
+  for (const [c, n] of goto[0]) {
+    next[c] = n;
+    queue.push(n);
+  }
+  for (let q = 0; q < queue.length; q++) {
+    const s = queue[q];
+    const f = fail[s];
+    if (outs[f].length) outs[s] = [.../* @__PURE__ */ new Set([...outs[s], ...outs[f]])];
+    const base = s << 7;
+    const fbase = f << 7;
+    for (let c = 0; c < 128; c++) next[base | c] = next[fbase | c];
+    for (const [c, n] of goto[s]) {
+      fail[n] = next[fbase | c];
+      next[base | c] = n;
+      queue.push(n);
+    }
+  }
+  for (let s = 0; s < nStates; s++) {
+    const base = s << 7;
+    for (let c = 65; c <= 90; c++) next[base | c] = next[base | c + 32];
+  }
+  const hasOut = new Uint8Array(nStates);
+  const outRules = outs.map((o, s) => {
+    if (o.length === 0) return null;
+    hasOut[s] = 1;
+    return o;
+  });
+  const ruleStamp = new Uint32Array(literalsByRule.length);
+  const stateStamp = new Uint32Array(nStates);
+  let stamp = 0;
   return {
-    content: Buffer.concat(pieces),
-    count: totalCount,
-    oversizedLines
+    alwaysRun,
+    candidates(value, out) {
+      stamp++;
+      if (stamp === 4294967295) {
+        ruleStamp.fill(0);
+        stateStamp.fill(0);
+        stamp = 1;
+      }
+      let s = 0;
+      let found = false;
+      for (let k = 0, n = value.length; k < n; k++) {
+        const c = value.charCodeAt(k);
+        s = c < 128 ? next[s << 7 | c] : 0;
+        if (hasOut[s] === 1 && stateStamp[s] !== stamp) {
+          stateStamp[s] = stamp;
+          for (const r of outRules[s]) {
+            if (ruleStamp[r] !== stamp) {
+              ruleStamp[r] = stamp;
+              out.push(r);
+              found = true;
+            }
+          }
+        }
+      }
+      if (found) out.sort((a, b) => a - b);
+    }
   };
 }
 
@@ -13258,11 +13548,12 @@ function applyPattern(content, regex, groupCount, validate, prefixRun) {
   result += content.slice(lastIndex);
   return { value: result, count };
 }
-function redactString(value, patterns, owningKey = null) {
+function redactStringSlow(value, patterns, owningKey = null, from = 0) {
   let result = value;
   let totalCount = 0;
   let lower = null;
-  for (const p7 of patterns) {
+  for (let idx = from; idx < patterns.length; idx++) {
+    const p7 = patterns[idx];
     if (p7.precheck) {
       if (lower === null) lower = result.toLowerCase();
       let hit = false;
@@ -13290,6 +13581,69 @@ function redactString(value, patterns, owningKey = null) {
   }
   return { value: result, count: totalCount };
 }
+var engines = /* @__PURE__ */ new WeakMap();
+var candidateScratch = [];
+function engineFor(patterns) {
+  let engine = engines.get(patterns);
+  if (!engine) {
+    const minLength = new Int32Array(patterns.length);
+    const literals = patterns.map((p7, idx) => {
+      const facts = analyzeRegex(p7.regex.source, p7.regex.flags);
+      minLength[idx] = facts.minLength;
+      return p7.precheck ?? facts.literals;
+    });
+    engine = { prefilter: buildPrefilter(literals), minLength };
+    engines.set(patterns, engine);
+  }
+  return engine;
+}
+function redactString(value, patterns, owningKey = null) {
+  const { prefilter, minLength } = engineFor(patterns);
+  const hits = candidateScratch;
+  hits.length = 0;
+  prefilter.candidates(value, hits);
+  const always = prefilter.alwaysRun;
+  let lower = null;
+  let h = 0;
+  let a = 0;
+  while (h < hits.length || a < always.length) {
+    const idx = a >= always.length || h < hits.length && hits[h] < always[a] ? hits[h++] : always[a++];
+    if (value.length < minLength[idx]) continue;
+    const p7 = patterns[idx];
+    if (p7.precheck) {
+      if (lower === null) lower = value.toLowerCase();
+      let hit = false;
+      for (const needle of p7.precheck) {
+        if (lower.includes(needle)) {
+          hit = true;
+          break;
+        }
+      }
+      if (!hit) continue;
+    }
+    if (p7.context) {
+      const keyHit = owningKey !== null && p7.context.test(owningKey);
+      if (!keyHit && (p7.keyOnlyContext || !p7.context.test(value))) continue;
+    }
+    const applied = applyPattern(
+      value,
+      p7.regex,
+      p7.groupCount,
+      p7.validate,
+      p7.prefixRun
+    );
+    if (applied.count > 0) {
+      const rest = redactStringSlow(
+        applied.value,
+        patterns,
+        owningKey,
+        idx + 1
+      );
+      return { value: rest.value, count: applied.count + rest.count };
+    }
+  }
+  return { value, count: 0 };
+}
 var keyMaskCaches = /* @__PURE__ */ new WeakMap();
 var memoStringUnits = /* @__PURE__ */ new WeakMap();
 var MAX_MEMO_STRING_UNITS = 8 * 1024 * 1024;
@@ -13354,6 +13708,16 @@ function walkAndRedactAll(value, patterns, memo, owningKey = null) {
   }
   return { value, count: 0 };
 }
+function redactJsonlLine(line, patterns, memo) {
+  if (!line.trim()) return { value: line, count: 0 };
+  try {
+    const parsed = JSON.parse(line);
+    const walked = walkAndRedactAll(parsed, patterns, memo);
+    return { value: JSON.stringify(walked.value), count: walked.count };
+  } catch {
+    return redactString(line, patterns);
+  }
+}
 function processFiles(files) {
   const patterns = compilePatterns();
   const results = [];
@@ -13363,19 +13727,10 @@ function processFiles(files) {
     if (isJsonl) {
       const memo = /* @__PURE__ */ new Map();
       let count = 0;
-      const lines = content.split("\n");
-      const processed = lines.map((line) => {
-        if (!line.trim()) return line;
-        try {
-          const parsed = JSON.parse(line);
-          const walked = walkAndRedactAll(parsed, patterns, memo);
-          count += walked.count;
-          return JSON.stringify(walked.value);
-        } catch {
-          const r = redactString(line, patterns);
-          count += r.count;
-          return r.value;
-        }
+      const processed = content.split("\n").map((line) => {
+        const r = redactJsonlLine(line, patterns, memo);
+        count += r.count;
+        return r.count > 0 ? r.value : line;
       });
       totalCount = count;
       output = processed.join("\n");
@@ -13388,21 +13743,25 @@ function processFiles(files) {
   }
   return results;
 }
+function processRanges(ranges) {
+  const patterns = compilePatterns();
+  return ranges.map(({ index, bytes, start, end }) => {
+    const memo = /* @__PURE__ */ new Map();
+    const buffer = Buffer.from(
+      bytes.buffer,
+      bytes.byteOffset,
+      bytes.byteLength
+    );
+    const scanned = scanBufferLines(
+      buffer,
+      (line) => redactJsonlLine(line, patterns, memo),
+      { start, end }
+    );
+    return { index, ...scanned };
+  });
+}
 
 // src/middleware/pattern-redact.ts
-function redactPatternLine(line, patterns, memo, isJsonl) {
-  if (isJsonl) {
-    if (!line.trim()) return { value: line, count: 0 };
-    try {
-      const parsed = JSON.parse(line);
-      const walked = walkAndRedactAll(parsed, patterns, memo);
-      return { value: JSON.stringify(walked.value), count: walked.count };
-    } catch {
-      return redactString(line, patterns);
-    }
-  }
-  return redactString(line, patterns);
-}
 var WORKER_COUNT = Math.min(
   os4.availableParallelism?.() ?? os4.cpus().length,
   4
@@ -13410,6 +13769,31 @@ var WORKER_COUNT = Math.min(
 var WORKER_THRESHOLD = 4;
 var WORKER_STRING_THRESHOLD = 128 * 1024;
 var WORKER_TIMEOUT_MS = 12e4;
+var RANGE_MIN_BYTES = 8 * 1024 * 1024;
+var NEWLINE2 = 10;
+function shareBytes(source) {
+  if (source.buffer instanceof SharedArrayBuffer) return source;
+  const shared = new Uint8Array(new SharedArrayBuffer(source.length));
+  shared.set(source);
+  return shared;
+}
+function splitRanges(index, bytes) {
+  const parts = Math.min(
+    WORKER_COUNT,
+    Math.floor(bytes.length / RANGE_MIN_BYTES)
+  );
+  const ranges = [];
+  let start = 0;
+  for (let part = 1; part < parts; part++) {
+    const target = Math.max(start, Math.floor(bytes.length / parts * part));
+    const nl = bytes.indexOf(NEWLINE2, target);
+    if (nl === -1 || nl + 1 >= bytes.length) break;
+    ranges.push({ index, bytes, start, end: nl + 1 });
+    start = nl + 1;
+  }
+  ranges.push({ index, bytes, start, end: bytes.length });
+  return ranges;
+}
 function resolveWorkerPath() {
   return fileURLToPath(
     new URL(
@@ -13418,7 +13802,7 @@ function resolveWorkerPath() {
     )
   );
 }
-function runWorker(workerPath, files, signal, timeoutMs = WORKER_TIMEOUT_MS) {
+function runWorker(workerPath, job, signal, timeoutMs = WORKER_TIMEOUT_MS) {
   return new Promise((resolve, reject) => {
     if (signal?.aborted) {
       reject(
@@ -13426,7 +13810,7 @@ function runWorker(workerPath, files, signal, timeoutMs = WORKER_TIMEOUT_MS) {
       );
       return;
     }
-    const worker = new Worker(workerPath, { workerData: files });
+    const worker = new Worker(workerPath, { workerData: job });
     let settled = false;
     const finish = (error, results) => {
       if (settled) return;
@@ -13480,11 +13864,25 @@ var PatternRedactMiddleware = class {
     }
     const tasks = [];
     const fileMap = /* @__PURE__ */ new Map();
-    const passThrough = [];
+    const passThrough = /* @__PURE__ */ new Map();
     const largeResults = /* @__PURE__ */ new Map();
+    const jsonl = /* @__PURE__ */ new Map();
     for (let i = 0; i < group.files.length; i++) {
       const file = group.files[i];
       this.stats.filesScanned++;
+      if (file.absolutePath.endsWith(".jsonl")) {
+        const read2 = await readFileBuffer(file);
+        if (read2.kind === "binary") {
+          this.stats.binaryFiles++;
+          passThrough.set(i, file);
+        } else if (read2.kind === "error") {
+          this.stats.filesSkipped++;
+        } else {
+          jsonl.set(i, read2.content);
+          fileMap.set(i, file);
+        }
+        continue;
+      }
       if (file.content && !file.isBinary && file.content.length > getLargeFileThreshold()) {
         largeResults.set(i, this.redactLargeFile(file));
         continue;
@@ -13492,45 +13890,67 @@ var PatternRedactMiddleware = class {
       const read = await readFileContent(file);
       if (read.kind === "binary") {
         this.stats.binaryFiles++;
-        passThrough.push({ index: i, file });
+        passThrough.set(i, file);
         continue;
       }
       if (read.kind === "error") {
         this.stats.filesSkipped++;
         continue;
       }
-      tasks.push({
-        index: i,
-        content: read.content,
-        isJsonl: file.absolutePath.endsWith(".jsonl")
-      });
+      tasks.push({ index: i, content: read.content, isJsonl: false });
       fileMap.set(i, file);
     }
-    let results;
-    if (tasks.length >= WORKER_THRESHOLD || tasks.some((task) => task.content.length >= WORKER_STRING_THRESHOLD)) {
-      results = await this.processWithWorkers(tasks);
+    const sources2 = [...jsonl.values()];
+    let output;
+    if (tasks.length + sources2.length >= WORKER_THRESHOLD || tasks.some((task) => task.content.length >= WORKER_STRING_THRESHOLD) || sources2.some((source) => source.length >= WORKER_STRING_THRESHOLD)) {
+      const ranges = [];
+      for (const [index, source] of jsonl) {
+        ranges.push(...splitRanges(index, shareBytes(source)));
+      }
+      output = await this.processWithWorkers(tasks, ranges);
     } else {
-      results = processFiles(tasks);
+      output = {
+        files: processFiles(tasks),
+        ranges: processRanges(
+          [...jsonl].map(([index, bytes]) => ({
+            index,
+            bytes,
+            start: 0,
+            end: bytes.length
+          }))
+        )
+      };
     }
     const outputMap = /* @__PURE__ */ new Map();
-    for (const r of results) {
-      outputMap.set(r.index, { content: r.content, count: r.count });
+    for (const r of output.files) outputMap.set(r.index, r);
+    const scans = /* @__PURE__ */ new Map();
+    for (const { index, edits, count, oversizedLines } of output.ranges) {
+      const scan = scans.get(index);
+      if (!scan) {
+        scans.set(index, { edits, count, oversizedLines });
+        continue;
+      }
+      for (const edit of edits) scan.edits.push(edit);
+      scan.count += count;
+      scan.oversizedLines += oversizedLines;
     }
     const newFiles = [];
     for (let i = 0; i < group.files.length; i++) {
-      const large = largeResults.get(i);
-      if (large) {
-        newFiles.push(large);
+      const unchanged = largeResults.get(i) ?? passThrough.get(i);
+      if (unchanged) {
+        newFiles.push(unchanged);
         continue;
       }
-      const pt = passThrough.find((p7) => p7.index === i);
-      if (pt) {
-        newFiles.push(pt.file);
+      const file = fileMap.get(i);
+      if (!file) continue;
+      const source = jsonl.get(i);
+      const scan = scans.get(i);
+      if (source && scan) {
+        newFiles.push(this.applyScan(file, source, scan));
         continue;
       }
       const result = outputMap.get(i);
-      const file = fileMap.get(i);
-      if (!result || !file) continue;
+      if (!result) continue;
       if (result.count > 0) {
         this.stats.filesRedacted++;
         this.stats.totalRedactions += result.count;
@@ -13544,17 +13964,31 @@ var PatternRedactMiddleware = class {
     }
     return { ...group, files: newFiles };
   }
-  // Stream-redact an oversized file straight from its buffer, one line at a time,
-  // so we never build a string larger than a single line. Single-threaded (no
-  // worker pool) — it trades parallelism for bounded memory on the one giant file.
+  applyScan(file, source, scan) {
+    if (scan.oversizedLines > 0) {
+      appendLog(
+        "warn",
+        `pattern-redact: dropped ${scan.oversizedLines} oversized line(s) in ${file.absolutePath} (exceeded max string length)`
+      );
+    }
+    if (scan.count > 0) {
+      this.stats.filesRedacted++;
+      this.stats.totalRedactions += scan.count;
+    }
+    if (scan.count === 0 && scan.oversizedLines === 0) return file;
+    scan.edits.sort((a, b) => a.start - b.start);
+    return { ...file, content: applyLineEdits(source, scan.edits) };
+  }
+  // Stream-redact an oversized non-JSONL file straight from its buffer, one line
+  // at a time, so we never build a string larger than a single line.
+  // Single-threaded (no worker pool) — it trades parallelism for bounded memory
+  // on the one giant file.
   redactLargeFile(file) {
     const buffer = file.content;
-    const isJsonl = file.absolutePath.endsWith(".jsonl");
     const patterns = compilePatterns();
-    const memo = /* @__PURE__ */ new Map();
     const { content, count, oversizedLines } = redactBufferByLine(
       buffer,
-      (line) => redactPatternLine(line, patterns, memo, isJsonl)
+      (line) => redactString(line, patterns)
     );
     if (oversizedLines > 0) {
       appendLog(
@@ -13571,25 +14005,32 @@ var PatternRedactMiddleware = class {
     }
     return file;
   }
-  async processWithWorkers(tasks) {
+  async processWithWorkers(tasks, ranges) {
     const workerPath = resolveWorkerPath();
     const controller = new AbortController();
     const onAbort = () => controller.abort();
     this.signal?.addEventListener("abort", onAbort, { once: true });
     if (this.signal?.aborted) controller.abort();
-    const sorted = [...tasks].sort(
-      (a, b) => b.content.length - a.content.length
-    );
-    const buckets = Array.from(
-      { length: WORKER_COUNT },
-      () => []
-    );
-    for (let i = 0; i < sorted.length; i++) {
-      buckets[i % WORKER_COUNT].push(sorted[i]);
-    }
-    const pending = buckets.filter((b) => b.length > 0).map((chunk) => runWorker(workerPath, chunk, controller.signal));
+    const units = [
+      ...tasks.map((task) => ({ task, size: task.content.length })),
+      ...ranges.map((range) => ({ range, size: range.end - range.start }))
+    ].sort((a, b) => b.size - a.size);
+    const jobs = Array.from({ length: WORKER_COUNT }, () => ({
+      files: [],
+      ranges: []
+    }));
+    units.forEach((unit, i) => {
+      const job = jobs[i % WORKER_COUNT];
+      if ("task" in unit) job.files.push(unit.task);
+      else job.ranges.push(unit.range);
+    });
+    const pending = jobs.filter((job) => job.files.length > 0 || job.ranges.length > 0).map((job) => runWorker(workerPath, job, controller.signal));
     try {
-      return (await Promise.all(pending)).flat();
+      const outputs2 = await Promise.all(pending);
+      return {
+        files: outputs2.flatMap((o) => o.files),
+        ranges: outputs2.flatMap((o) => o.ranges)
+      };
     } catch (error) {
       controller.abort();
       await Promise.allSettled(pending);
@@ -13661,8 +14102,20 @@ var RedactMiddleware = class {
     for (const file of group.files) {
       this.stats.filesScanned++;
       regex.lastIndex = 0;
+      if (file.absolutePath.endsWith(".jsonl")) {
+        const read2 = await readFileBuffer(file);
+        if (read2.kind === "binary") {
+          this.stats.binaryFiles++;
+          newFiles.push(file);
+        } else if (read2.kind === "error") {
+          this.stats.filesSkipped++;
+        } else {
+          newFiles.push(this.redactBuffer(file, read2.content, regex, true));
+        }
+        continue;
+      }
       if (file.content && !file.isBinary && file.content.length > getLargeFileThreshold()) {
-        newFiles.push(this.redactLargeFile(file, regex));
+        newFiles.push(this.redactBuffer(file, file.content, regex, false));
         continue;
       }
       const read = await readFileContent(file);
@@ -13675,18 +14128,7 @@ var RedactMiddleware = class {
         this.stats.filesSkipped++;
         continue;
       }
-      const content = read.content;
-      let result;
-      let count;
-      if (file.absolutePath.endsWith(".jsonl")) {
-        const processed = this.redactJsonl(content, regex);
-        result = processed.result;
-        count = processed.count;
-      } else {
-        const processed = this.redactString(content, regex);
-        result = processed.result;
-        count = processed.count;
-      }
+      const { result, count } = this.redactString(read.content, regex);
       if (count > 0) {
         this.stats.filesRedacted++;
         this.stats.totalRedactions += count;
@@ -13700,13 +14142,9 @@ var RedactMiddleware = class {
     }
     return { ...group, files: newFiles };
   }
-  // Stream-redact an oversized file straight from its buffer. Each line is
-  // redacted with the same JSON-aware (or raw) logic as redactJsonl, so the
-  // output matches the in-memory path exactly for files whose lines all fit in a
-  // string — which holds for real transcripts (largest line is a few MiB).
-  redactLargeFile(file, regex) {
-    const buffer = file.content;
-    const isJsonl = file.absolutePath.endsWith(".jsonl");
+  // Redact a file line by line straight from its buffer. A line with no hit
+  // keeps its exact bytes; a JSONL line with one is re-serialized.
+  redactBuffer(file, buffer, regex, isJsonl) {
     const { content, count, oversizedLines } = redactBufferByLine(
       buffer,
       (line) => this.redactLine(line, regex, isJsonl)
@@ -13741,24 +14179,6 @@ var RedactMiddleware = class {
     const { result, count } = this.redactString(line, regex);
     return { value: result, count };
   }
-  redactJsonl(content, regex) {
-    let totalCount = 0;
-    const lines = content.split("\n");
-    const processed = lines.map((line) => {
-      if (!line.trim()) return line;
-      try {
-        const parsed = JSON.parse(line);
-        const walked = walkAndRedact(parsed, regex);
-        totalCount += walked.count;
-        return JSON.stringify(walked.value);
-      } catch {
-        const { result, count } = this.redactString(line, regex);
-        totalCount += count;
-        return result;
-      }
-    });
-    return { result: processed.join("\n"), count: totalCount };
-  }
   redactString(content, regex) {
     let count = 0;
     const result = content.replace(regex, () => {
@@ -14758,16 +15178,144 @@ async function recordDebugLogCompletion(args) {
 // src/git-traces/pending-captures.ts
 import { AsyncLocalStorage } from "async_hooks";
 import crypto7 from "crypto";
-import fs19 from "fs";
+import fs20 from "fs";
 import os9 from "os";
-import path18 from "path";
+import path19 from "path";
 
 // src/git-traces/git-ops.ts
 import { execFileSync as execFileSync2, spawn as spawn2, spawnSync } from "child_process";
-import fs17 from "fs";
+import fs18 from "fs";
 import os7 from "os";
-import path16 from "path";
+import path17 from "path";
 import { createGzip } from "zlib";
+
+// src/git-traces/object-store-probe.ts
+import fs17 from "fs";
+import path16 from "path";
+var probedRepos = /* @__PURE__ */ new Set();
+var SAMPLE_FANOUT_DIRS = 8;
+var SAMPLE_READS = 20;
+var SAMPLE_READ_BYTES = 4096;
+var MAX_NAMED_OBJECTS = 3;
+function probeObjectStore(repoRoot, trigger, stderr) {
+  if (probedRepos.has(repoRoot)) return;
+  probedRepos.add(repoRoot);
+  const started = Date.now();
+  const fields = [`repo=${repoRoot}`, `trigger=${trigger}`];
+  try {
+    const objectsDir = resolveObjectsDir(repoRoot);
+    if (!objectsDir) {
+      fields.push("objectsDir=unresolved");
+      return;
+    }
+    fields.push(`objectsDir=${objectsDir}`);
+    if (typeof fs17.statfsSync === "function") {
+      const stats = fs17.statfsSync(objectsDir);
+      fields.push(
+        `fsType=${stats.type}`,
+        `freeBytes=${stats.bavail * stats.bsize}`
+      );
+    }
+    const { estimate, sample } = sampleLooseObjects(objectsDir);
+    fields.push(`looseEstimate=${estimate}`);
+    const packDir = path16.join(objectsDir, "pack");
+    const packFiles = fs17.existsSync(packDir) ? fs17.readdirSync(packDir) : [];
+    fields.push(
+      `packs=${packFiles.filter((name) => name.endsWith(".pack")).length}`,
+      `promisorPacks=${packFiles.filter((name) => name.endsWith(".promisor")).length}`,
+      `alternates=${fs17.existsSync(path16.join(objectsDir, "info", "alternates")) ? "yes" : "no"}`
+    );
+    fields.push(...timeSampleReads(sample));
+    for (const sha of namedObjects(stderr)) {
+      const loose = path16.join(objectsDir, sha.slice(0, 2), sha.slice(2));
+      const stats = fs17.statSync(loose, { throwIfNoEntry: false });
+      fields.push(
+        stats ? `named=${sha.slice(0, 8)}(size=${stats.size},blocks=${stats.blocks})` : `named=${sha.slice(0, 8)}(no loose file)`
+      );
+    }
+  } catch (err) {
+    fields.push(
+      `probeError=${err instanceof Error ? err.message : String(err)}`
+    );
+  } finally {
+    fields.push(`probeMs=${Date.now() - started}`);
+    appendLog("info", `git-traces: object store probe (${fields.join(", ")})`);
+  }
+}
+function resolveObjectsDir(repoRoot) {
+  let gitDir = path16.join(repoRoot, ".git");
+  const stats = fs17.statSync(gitDir, { throwIfNoEntry: false });
+  if (!stats) return null;
+  if (stats.isFile()) {
+    const match = /^gitdir:\s*(.+)$/m.exec(fs17.readFileSync(gitDir, "utf-8"));
+    if (!match) return null;
+    gitDir = path16.resolve(repoRoot, match[1].trim());
+  }
+  const commonDir = path16.join(gitDir, "commondir");
+  if (fs17.existsSync(commonDir)) {
+    gitDir = path16.resolve(gitDir, fs17.readFileSync(commonDir, "utf-8").trim());
+  }
+  return path16.join(gitDir, "objects");
+}
+function sampleLooseObjects(objectsDir) {
+  const fanout = fs17.readdirSync(objectsDir).filter((name) => /^[0-9a-f]{2}$/.test(name)).sort().slice(0, SAMPLE_FANOUT_DIRS);
+  let counted = 0;
+  const sample = [];
+  for (const dir of fanout) {
+    const files = fs17.readdirSync(path16.join(objectsDir, dir));
+    counted += files.length;
+    for (const file of files) {
+      if (sample.length >= SAMPLE_READS) break;
+      sample.push(path16.join(objectsDir, dir, file));
+    }
+  }
+  return {
+    estimate: fanout.length ? Math.round(counted / fanout.length * 256) : 0,
+    sample
+  };
+}
+function timeSampleReads(sample) {
+  let dataless = 0;
+  let readErrors = 0;
+  let firstReadError;
+  let totalMs = 0;
+  let maxMs = 0;
+  const buffer = Buffer.alloc(SAMPLE_READ_BYTES);
+  for (const file of sample) {
+    const readStarted = performance.now();
+    try {
+      const stats = fs17.statSync(file);
+      if (stats.size > 0 && stats.blocks === 0) dataless++;
+      const fd = fs17.openSync(file, "r");
+      try {
+        fs17.readSync(fd, buffer, 0, SAMPLE_READ_BYTES, 0);
+      } finally {
+        fs17.closeSync(fd);
+      }
+    } catch (err) {
+      readErrors++;
+      firstReadError ??= err instanceof Error ? err.message : String(err);
+    }
+    const elapsed = performance.now() - readStarted;
+    totalMs += elapsed;
+    maxMs = Math.max(maxMs, elapsed);
+  }
+  const fields = [
+    `sampled=${sample.length}`,
+    `dataless=${dataless}`,
+    `readMsMax=${maxMs.toFixed(1)}`,
+    `readMsTotal=${totalMs.toFixed(1)}`,
+    `readErrors=${readErrors}`
+  ];
+  if (firstReadError) fields.push(`firstReadError=${firstReadError}`);
+  return fields;
+}
+function namedObjects(stderr) {
+  const shas = new Set(stderr?.match(/\b[0-9a-f]{40}\b/g) ?? []);
+  return [...shas].slice(0, MAX_NAMED_OBJECTS);
+}
+
+// src/git-traces/git-ops.ts
 var DEFAULT_GIT_COMMAND_TIMEOUT_MS = 12e4;
 var DEFAULT_BUNDLE_TIMEOUT_MS = 3e5;
 var FULL_TREE_SCAN_TIMEOUT_MS = 3e5;
@@ -14958,8 +15506,8 @@ var EXCLUDED_SNAPSHOT_BASENAMES = /* @__PURE__ */ new Set([
 ]);
 var EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 function isExcludedSnapshotPath(filePath) {
-  if (EXCLUDED_SNAPSHOT_BASENAMES.has(path16.basename(filePath))) return true;
-  return EXCLUDED_SNAPSHOT_EXTENSIONS.has(path16.extname(filePath).toLowerCase());
+  if (EXCLUDED_SNAPSHOT_BASENAMES.has(path17.basename(filePath))) return true;
+  return EXCLUDED_SNAPSHOT_EXTENSIONS.has(path17.extname(filePath).toLowerCase());
 }
 function isBinaryBuffer(buffer) {
   return buffer.includes(0);
@@ -14980,16 +15528,16 @@ function readTreeBlobHead(repoRoot, sha) {
 function readWorkingFileHead(absPath) {
   let fd = null;
   try {
-    fd = fs17.openSync(absPath, "r");
+    fd = fs18.openSync(absPath, "r");
     const buffer = Buffer.alloc(BINARY_SNIFF_BYTES);
-    const bytesRead = fs17.readSync(fd, buffer, 0, BINARY_SNIFF_BYTES, 0);
+    const bytesRead = fs18.readSync(fd, buffer, 0, BINARY_SNIFF_BYTES, 0);
     return buffer.subarray(0, bytesRead);
   } catch {
     return null;
   } finally {
     if (fd !== null) {
       try {
-        fs17.closeSync(fd);
+        fs18.closeSync(fd);
       } catch {
       }
     }
@@ -15042,11 +15590,19 @@ function formatGitFailure(command, failure, err) {
   }
   return `${command} failed${details.length ? ` (${details.join("; ")})` : ""}`;
 }
-function createGitError(args, err, timeoutMs = GIT_COMMAND_TIMEOUT_MS) {
+function formatGitTimeout(command, failure, timeoutMs, elapsedMs) {
+  const details = [];
+  if (elapsedMs !== void 0) details.push(`elapsed=${elapsedMs}ms`);
+  if (failure.signal) details.push(`signal=${failure.signal}`);
+  const stderr = outputToString(failure.stderr);
+  if (stderr) details.push(`stderr=${truncateOutput(stderr)}`);
+  return `${command} timed out after ${timeoutMs}ms${details.length ? ` (${details.join("; ")})` : ""}`;
+}
+function createGitError(args, err, timeoutMs = GIT_COMMAND_TIMEOUT_MS, elapsedMs) {
   const failure = err;
   const command = formatGitCommand(args);
   const isTimeout = failure.code === "ETIMEDOUT";
-  const message = isTimeout ? `${command} timed out after ${timeoutMs}ms` : failure.code === "ENOBUFS" ? `${command} output exceeded the ${formatSize(failure.maxBufferBytes ?? EXEC_OPTS.maxBuffer)} limit` : formatGitFailure(command, failure, err);
+  const message = isTimeout ? formatGitTimeout(command, failure, timeoutMs, elapsedMs) : failure.code === "ENOBUFS" ? `${command} output exceeded the ${formatSize(failure.maxBufferBytes ?? EXEC_OPTS.maxBuffer)} limit` : formatGitFailure(command, failure, err);
   const wrapped = new Error(message);
   wrapped.isGitTimeout = isTimeout;
   wrapped.gitExitStatus = failure.code || failure.signal ? void 0 : failure.status;
@@ -15078,6 +15634,7 @@ function isGitTimeoutError(err) {
 }
 function gitBuffer(repoRoot, args, options = {}) {
   const timeout = options.timeoutMs ?? EXEC_OPTS.timeout;
+  const started = Date.now();
   try {
     return execFileSync2("git", args, {
       cwd: repoRoot,
@@ -15088,7 +15645,15 @@ function gitBuffer(repoRoot, args, options = {}) {
       timeout
     });
   } catch (err) {
-    throw createGitError(args, err, timeout);
+    const wrapped = createGitError(args, err, timeout, Date.now() - started);
+    if (wrapped.isGitTimeout || wrapped.isGitMissingObject) {
+      probeObjectStore(
+        repoRoot,
+        wrapped.isGitTimeout ? "timeout" : "missing-object",
+        wrapped.gitStderr
+      );
+    }
+    throw wrapped;
   }
 }
 function git(repoRoot, args) {
@@ -15126,23 +15691,23 @@ function withPrivateIndex(repoRoot, run) {
   let tmpDir = null;
   let copy = null;
   try {
-    const indexPath = path16.resolve(
+    const indexPath = path17.resolve(
       repoRoot,
       git(repoRoot, ["rev-parse", "--git-path", "index"])
     );
-    tmpDir = fs17.mkdtempSync(path16.join(os7.tmpdir(), "hillclimb-index-"));
-    copy = path16.join(tmpDir, "index");
-    const fd = fs17.openSync(indexPath, "r");
+    tmpDir = fs18.mkdtempSync(path17.join(os7.tmpdir(), "hillclimb-index-"));
+    copy = path17.join(tmpDir, "index");
+    const fd = fs18.openSync(indexPath, "r");
     let stat;
     let data;
     try {
-      stat = fs17.fstatSync(fd);
-      data = fs17.readFileSync(fd);
+      stat = fs18.fstatSync(fd);
+      data = fs18.readFileSync(fd);
     } finally {
-      fs17.closeSync(fd);
+      fs18.closeSync(fd);
     }
-    fs17.writeFileSync(copy, data);
-    fs17.utimesSync(copy, stat.atime, stat.mtime);
+    fs18.writeFileSync(copy, data);
+    fs18.utimesSync(copy, stat.atime, stat.mtime);
   } catch (err) {
     const missing = err.code === "ENOENT";
     appendLog(
@@ -15154,7 +15719,7 @@ function withPrivateIndex(repoRoot, run) {
   try {
     return run(copy ? privateIndexEnv(copy) : null);
   } finally {
-    if (tmpDir) fs17.rmSync(tmpDir, { recursive: true, force: true });
+    if (tmpDir) fs18.rmSync(tmpDir, { recursive: true, force: true });
   }
 }
 function privateIndexEnv(indexPath) {
@@ -15484,7 +16049,7 @@ function filterOmittedFilesFromTree(repoRoot, treeSha, options = {}) {
   options.omittedFiles?.push(...omittedFiles);
   return timeCaptureStage(repoRoot, "tracked-tree-filter", () => {
     if (omittedFiles.length === 0) return treeSha;
-    const tmpIndex = path16.join(
+    const tmpIndex = path17.join(
       os7.tmpdir(),
       `hillclimb-filter-${Date.now()}-${process.pid}`
     );
@@ -15499,7 +16064,7 @@ function filterOmittedFilesFromTree(repoRoot, treeSha, options = {}) {
       return gitWithEnv(repoRoot, ["write-tree"], env);
     } finally {
       try {
-        fs17.unlinkSync(tmpIndex);
+        fs18.unlinkSync(tmpIndex);
       } catch {
       }
     }
@@ -15524,8 +16089,8 @@ function buildUntrackedTree(repoRoot, options = {}, attempt = 1) {
       if (!relPath) continue;
       candidates++;
       try {
-        const absPath = path16.join(repoRoot, relPath);
-        const stat = fs17.lstatSync(absPath);
+        const absPath = path17.join(repoRoot, relPath);
+        const stat = fs18.lstatSync(absPath);
         const reason = classifyOmission(
           relPath,
           stat.size,
@@ -15556,11 +16121,11 @@ function buildUntrackedTree(repoRoot, options = {}, attempt = 1) {
     `git-traces: untracked inventory (repo=${repoRoot}, candidates=${candidates}, kept=${kept.length}, keptBytes=${keptBytes}, omitted=${omitted}, omittedBytes=${omittedBytes}, skipped=${skipped})`
   );
   if (kept.length === 0) return null;
-  const tmpDir = fs17.mkdtempSync(path16.join(os7.tmpdir(), "hillclimb-untracked-"));
+  const tmpDir = fs18.mkdtempSync(path17.join(os7.tmpdir(), "hillclimb-untracked-"));
   const env = {
     ...process.env,
     LC_ALL: "C",
-    GIT_INDEX_FILE: path16.join(tmpDir, "index")
+    GIT_INDEX_FILE: path17.join(tmpDir, "index")
   };
   try {
     timeCaptureStage(
@@ -15588,7 +16153,7 @@ function buildUntrackedTree(repoRoot, options = {}, attempt = 1) {
     return buildUntrackedTree(repoRoot, options, attempt + 1);
   } finally {
     try {
-      fs17.rmSync(tmpDir, { recursive: true, force: true });
+      fs18.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -15634,10 +16199,10 @@ function buildSnapshotTree(repoRoot, stashSha, options = {}) {
           `git-traces: tree assembly reused (repo=${repoRoot})`
         );
         return previous.snapshotTreeSha;
-      } catch {
+      } catch (err) {
         appendLog(
           "info",
-          `git-traces: tree assembly cache unavailable; rebuilding (repo=${repoRoot})`
+          `git-traces: tree assembly cache unavailable; rebuilding (repo=${repoRoot}): ${err instanceof Error ? err.message : String(err)}`
         );
       }
     }
@@ -15659,7 +16224,7 @@ function mergeSnapshotTrees(repoRoot, filteredTrackedTree, untrackedTree) {
   if (!untrackedTree || untrackedTree === EMPTY_TREE_SHA)
     return filteredTrackedTree;
   if (filteredTrackedTree === EMPTY_TREE_SHA) return untrackedTree;
-  const tmpIndex = path16.join(
+  const tmpIndex = path17.join(
     os7.tmpdir(),
     `hillclimb-index-${Date.now()}-${process.pid}`
   );
@@ -15688,7 +16253,7 @@ function mergeSnapshotTrees(repoRoot, filteredTrackedTree, untrackedTree) {
     );
   } finally {
     try {
-      fs17.unlinkSync(tmpIndex);
+      fs18.unlinkSync(tmpIndex);
     } catch {
     }
   }
@@ -15703,10 +16268,10 @@ function createBundleFromTree(repoRoot, treeSha, sessionId, label) {
   pinRef(repoRoot, orphanRef, orphanCommit);
   let tmpDir;
   try {
-    tmpDir = fs17.mkdtempSync(
-      path16.join(os7.tmpdir(), `hillclimb-bundle-${process.pid}-`)
+    tmpDir = fs18.mkdtempSync(
+      path17.join(os7.tmpdir(), `hillclimb-bundle-${process.pid}-`)
     );
-    const tmpFile = path16.join(tmpDir, "baseline.bundle");
+    const tmpFile = path17.join(tmpDir, "baseline.bundle");
     timeCaptureStage(
       repoRoot,
       "bundle-create",
@@ -15714,7 +16279,7 @@ function createBundleFromTree(repoRoot, treeSha, sessionId, label) {
         timeoutMs: resolveGitCommandTimeoutMs(DEFAULT_BUNDLE_TIMEOUT_MS)
       })
     );
-    const bundle = fs17.readFileSync(tmpFile);
+    const bundle = fs18.readFileSync(tmpFile);
     appendLog(
       "info",
       `git-traces: bundle inventory (repo=${repoRoot}, bytes=${bundle.length})`
@@ -15722,7 +16287,7 @@ function createBundleFromTree(repoRoot, treeSha, sessionId, label) {
     return bundle;
   } finally {
     try {
-      if (tmpDir) fs17.rmSync(tmpDir, { recursive: true, force: true });
+      if (tmpDir) fs18.rmSync(tmpDir, { recursive: true, force: true });
     } catch {
     }
     deleteRef(repoRoot, orphanRef);
@@ -15731,6 +16296,7 @@ function createBundleFromTree(repoRoot, treeSha, sessionId, label) {
 var MAX_PATCH_GZ_BYTES = 500 * 1024 * 1024;
 function gitGzipStream(repoRoot, args, maxGzBytes) {
   return new Promise((resolve, reject) => {
+    const started = Date.now();
     const child = spawn2("git", args, {
       cwd: repoRoot,
       stdio: ["ignore", "pipe", "pipe"],
@@ -15759,7 +16325,18 @@ function gitGzipStream(repoRoot, args, maxGzBytes) {
       settled = true;
       clearTimeout(timer);
       if (timedOut) {
-        reject(createGitError(args, { code: "ETIMEDOUT" }));
+        const wrapped = createGitError(
+          args,
+          {
+            code: "ETIMEDOUT",
+            signal: exitSignal,
+            stderr: Buffer.concat(stderrChunks)
+          },
+          GIT_COMMAND_TIMEOUT_MS,
+          Date.now() - started
+        );
+        probeObjectStore(repoRoot, "timeout", wrapped.gitStderr);
+        reject(wrapped);
       } else if (overflowed) {
         reject(
           createGitError(args, { code: "ENOBUFS", maxBufferBytes: maxGzBytes })
@@ -16021,9 +16598,9 @@ function parseCommitFiles(repoRoot, sha) {
         oldPath
       });
     } else {
-      const path27 = parts[parts.length - 1];
-      indexByPath.set(path27, files.length);
-      files.push({ path: path27, status, additions: 0, deletions: 0 });
+      const path28 = parts[parts.length - 1];
+      indexByPath.set(path28, files.length);
+      files.push({ path: path28, status, additions: 0, deletions: 0 });
     }
   }
   for (const line of numstat.split("\n")) {
@@ -16107,11 +16684,11 @@ function countScopedTurnTreeRefs(repoRoot, sessionId, epochPrefix3) {
 
 // src/git-traces/session-state.ts
 import crypto6 from "crypto";
-import fs18 from "fs";
+import fs19 from "fs";
 import os8 from "os";
-import path17 from "path";
+import path18 from "path";
 var CURRENT_SCHEMA_VERSION3 = 3;
-var DEFAULT_STATE_DIR2 = path17.join(os8.homedir(), ".hillclimb", "git-traces");
+var DEFAULT_STATE_DIR2 = path18.join(os8.homedir(), ".hillclimb", "git-traces");
 var LOCK_RETRIES2 = 120;
 var LOCK_RETRY_DELAY_MS2 = 500;
 var DEFAULT_LIVE_OWNER_MAX_WAIT_MS2 = 10 * 60 * 1e3;
@@ -16136,16 +16713,16 @@ function stateDir3() {
 }
 function stateFileForRepo(repoRoot, tool, sessionId) {
   const hash = crypto6.createHash("sha256").update(
-    sessionId ? `${path17.resolve(repoRoot)}\0${tool}\0${sessionId}` : `${path17.resolve(repoRoot)}\0${tool}`
+    sessionId ? `${path18.resolve(repoRoot)}\0${tool}\0${sessionId}` : `${path18.resolve(repoRoot)}\0${tool}`
   ).digest("hex").slice(0, 16);
-  return path17.join(stateDir3(), `${hash}.json`);
+  return path18.join(stateDir3(), `${hash}.json`);
 }
 function lockFileForRepo(repoRoot, tool, sessionId) {
   return `${stateFileForRepo(repoRoot, tool, sessionId)}.lock`;
 }
 async function readStateFile(file) {
   try {
-    const raw = await fs18.promises.readFile(file, "utf-8");
+    const raw = await fs19.promises.readFile(file, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed.schemaVersion !== CURRENT_SCHEMA_VERSION3) {
       return null;
@@ -16159,7 +16736,7 @@ async function readStoredStateFile(file) {
   const state = await readStateFile(file);
   if (!state) return null;
   try {
-    return { state, mtimeMs: (await fs18.promises.stat(file)).mtimeMs };
+    return { state, mtimeMs: (await fs19.promises.stat(file)).mtimeMs };
   } catch {
     return null;
   }
@@ -16167,26 +16744,26 @@ async function readStoredStateFile(file) {
 async function listScopedSessionStates(repoRoot, tool) {
   let entries;
   try {
-    entries = await fs18.promises.readdir(stateDir3(), { withFileTypes: true });
+    entries = await fs19.promises.readdir(stateDir3(), { withFileTypes: true });
   } catch {
     return [];
   }
   const states = [];
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-    const file = path17.join(stateDir3(), entry.name);
+    const file = path18.join(stateDir3(), entry.name);
     const state = await readStateFile(file);
     if (!state) continue;
     if (typeof state.repoRoot !== "string" || typeof state.sessionId !== "string") {
       continue;
     }
-    if (path17.resolve(state.repoRoot) !== path17.resolve(repoRoot)) continue;
-    if (path17.resolve(file) !== path17.resolve(stateFileForRepo(repoRoot, tool, state.sessionId))) {
+    if (path18.resolve(state.repoRoot) !== path18.resolve(repoRoot)) continue;
+    if (path18.resolve(file) !== path18.resolve(stateFileForRepo(repoRoot, tool, state.sessionId))) {
       continue;
     }
     let mtimeMs = 0;
     try {
-      mtimeMs = (await fs18.promises.stat(file)).mtimeMs;
+      mtimeMs = (await fs19.promises.stat(file)).mtimeMs;
     } catch {
       continue;
     }
@@ -16197,26 +16774,26 @@ async function listScopedSessionStates(repoRoot, tool) {
 async function listSessionStatesForSession(tool, sessionId) {
   let entries;
   try {
-    entries = await fs18.promises.readdir(stateDir3(), { withFileTypes: true });
+    entries = await fs19.promises.readdir(stateDir3(), { withFileTypes: true });
   } catch {
     return [];
   }
   const states = [];
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
-    const file = path17.join(stateDir3(), entry.name);
+    const file = path18.join(stateDir3(), entry.name);
     const state = await readStateFile(file);
     if (!state) continue;
     if (typeof state.repoRoot !== "string" || typeof state.sessionId !== "string") {
       continue;
     }
     if (state.sessionId !== sessionId) continue;
-    if (path17.resolve(file) !== path17.resolve(stateFileForRepo(state.repoRoot, tool, sessionId))) {
+    if (path18.resolve(file) !== path18.resolve(stateFileForRepo(state.repoRoot, tool, sessionId))) {
       continue;
     }
     let mtimeMs = 0;
     try {
-      mtimeMs = (await fs18.promises.stat(file)).mtimeMs;
+      mtimeMs = (await fs19.promises.stat(file)).mtimeMs;
     } catch {
       continue;
     }
@@ -16265,17 +16842,17 @@ async function writeLegacySessionState(state, tool) {
   );
 }
 async function writeStateFile(file, state) {
-  await fs18.promises.mkdir(stateDir3(), { recursive: true, mode: 448 });
+  await fs19.promises.mkdir(stateDir3(), { recursive: true, mode: 448 });
   const tmp = `${file}.tmp`;
-  await fs18.promises.writeFile(tmp, JSON.stringify(state, null, 2), {
+  await fs19.promises.writeFile(tmp, JSON.stringify(state, null, 2), {
     mode: 384
   });
-  await fs18.promises.rename(tmp, file);
+  await fs19.promises.rename(tmp, file);
 }
 async function touchSessionState(repoRoot, tool, sessionId) {
   const now = /* @__PURE__ */ new Date();
   try {
-    await fs18.promises.utimes(
+    await fs19.promises.utimes(
       stateFileForRepo(repoRoot, tool, sessionId),
       now,
       now
@@ -16285,7 +16862,7 @@ async function touchSessionState(repoRoot, tool, sessionId) {
 }
 async function statSessionStateMtime(repoRoot, tool, sessionId) {
   try {
-    const stat = await fs18.promises.stat(
+    const stat = await fs19.promises.stat(
       stateFileForRepo(repoRoot, tool, sessionId)
     );
     return stat.mtimeMs;
@@ -16295,7 +16872,7 @@ async function statSessionStateMtime(repoRoot, tool, sessionId) {
 }
 async function deleteStateFile(file) {
   try {
-    await fs18.promises.unlink(file);
+    await fs19.promises.unlink(file);
   } catch {
   }
 }
@@ -16334,7 +16911,7 @@ async function acquireLock3(repoRoot, tool, sessionId, retries, delayMs, options
 }
 async function acquireLockWithoutTiming(repoRoot, tool, sessionId, retries, delayMs, options = {}) {
   const lockPath = lockFileForRepo(repoRoot, tool, sessionId);
-  await fs18.promises.mkdir(stateDir3(), { recursive: true, mode: 448 });
+  await fs19.promises.mkdir(stateDir3(), { recursive: true, mode: 448 });
   const bounded = retries !== void 0 || delayMs !== void 0;
   const attempts = retries ?? LOCK_RETRIES2;
   const delay = delayMs ?? LOCK_RETRY_DELAY_MS2;
@@ -16344,9 +16921,9 @@ async function acquireLockWithoutTiming(repoRoot, tool, sessionId, retries, dela
   let extensionLogged = false;
   for (let i = 0; ; i++) {
     try {
-      const fd = await fs18.promises.open(
+      const fd = await fs19.promises.open(
         lockPath,
-        fs18.constants.O_CREAT | fs18.constants.O_EXCL | fs18.constants.O_WRONLY
+        fs19.constants.O_CREAT | fs19.constants.O_EXCL | fs19.constants.O_WRONLY
       );
       await fd.write(String(process.pid));
       await fd.close();
@@ -16355,7 +16932,7 @@ async function acquireLockWithoutTiming(repoRoot, tool, sessionId, retries, dela
       if (err.code !== "EEXIST") throw err;
       let regularLockFile = false;
       try {
-        regularLockFile = (await fs18.promises.lstat(lockPath)).isFile();
+        regularLockFile = (await fs19.promises.lstat(lockPath)).isFile();
       } catch (statErr) {
         if (statErr.code === "ENOENT") {
           i--;
@@ -16417,21 +16994,21 @@ async function acquireLockWithoutTiming(repoRoot, tool, sessionId, retries, dela
 }
 async function releaseLock3(repoRoot, tool, sessionId) {
   try {
-    await fs18.promises.unlink(lockFileForRepo(repoRoot, tool, sessionId));
+    await fs19.promises.unlink(lockFileForRepo(repoRoot, tool, sessionId));
   } catch {
   }
 }
 async function sweepStaleLockFiles(ttlMs = STALE_LOCK_TTL_MS3, now = Date.now()) {
   let entries;
   try {
-    entries = await fs18.promises.readdir(stateDir3(), { withFileTypes: true });
+    entries = await fs19.promises.readdir(stateDir3(), { withFileTypes: true });
   } catch {
     return 0;
   }
   let removed = 0;
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".lock")) continue;
-    const file = path17.join(stateDir3(), entry.name);
+    const file = path18.join(stateDir3(), entry.name);
     if (await reapLockIfStale(file, {
       maxAgeMs: ttlMs,
       preserveLiveOwner: true,
@@ -16486,12 +17063,12 @@ function withPendingCapture(record, work) {
   return activeCapture.run({ record, save: () => saveCapture(record) }, work);
 }
 function queueDirectory(repoRoot, tool, sessionId) {
-  const stateDir4 = process.env.HILLCLIMB_GIT_TRACES_STATE_DIR ?? path18.join(os9.homedir(), ".hillclimb", "git-traces");
-  const key = crypto7.createHash("sha256").update(`${path18.resolve(repoRoot)}\0${tool}\0${sessionId}`).digest("hex");
-  return path18.join(stateDir4, "pending-v1", key);
+  const stateDir4 = process.env.HILLCLIMB_GIT_TRACES_STATE_DIR ?? path19.join(os9.homedir(), ".hillclimb", "git-traces");
+  const key = crypto7.createHash("sha256").update(`${path19.resolve(repoRoot)}\0${tool}\0${sessionId}`).digest("hex");
+  return path19.join(stateDir4, "pending-v1", key);
 }
 function captureDirectory(record) {
-  return path18.join(
+  return path19.join(
     queueDirectory(record.repoRoot, record.tool, record.sessionId),
     record.id
   );
@@ -16499,20 +17076,20 @@ function captureDirectory(record) {
 function writeDurable(file, body) {
   const temporary = `${file}.${process.pid}.tmp`;
   try {
-    const descriptor = fs19.openSync(temporary, "w", 384);
+    const descriptor = fs20.openSync(temporary, "w", 384);
     try {
-      fs19.writeFileSync(descriptor, body);
-      fs19.fsyncSync(descriptor);
+      fs20.writeFileSync(descriptor, body);
+      fs20.fsyncSync(descriptor);
     } finally {
-      fs19.closeSync(descriptor);
+      fs20.closeSync(descriptor);
     }
-    fs19.renameSync(temporary, file);
+    fs20.renameSync(temporary, file);
     try {
-      const directory = fs19.openSync(path18.dirname(file), "r");
+      const directory = fs20.openSync(path19.dirname(file), "r");
       try {
-        fs19.fsyncSync(directory);
+        fs20.fsyncSync(directory);
       } finally {
-        fs19.closeSync(directory);
+        fs20.closeSync(directory);
       }
     } catch (err) {
       if (!["EINVAL", "ENOTSUP", "EBADF", "EPERM", "EISDIR"].includes(
@@ -16521,7 +17098,7 @@ function writeDurable(file, body) {
         throw err;
     }
   } finally {
-    if (fs19.existsSync(temporary)) fs19.unlinkSync(temporary);
+    if (fs20.existsSync(temporary)) fs20.unlinkSync(temporary);
   }
 }
 function saveCapture(record) {
@@ -16532,7 +17109,7 @@ function saveCapture(record) {
   let status = "failed";
   try {
     writeDurable(
-      path18.join(captureDirectory(record), "capture.json"),
+      path19.join(captureDirectory(record), "capture.json"),
       JSON.stringify(record)
     );
     status = "ok";
@@ -16544,7 +17121,7 @@ function listPendingCaptures2(repoRoot, tool, sessionId) {
   const directory = queueDirectory(repoRoot, tool, sessionId);
   let entries;
   try {
-    entries = fs19.readdirSync(directory, { withFileTypes: true });
+    entries = fs20.readdirSync(directory, { withFileTypes: true });
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
@@ -16552,10 +17129,10 @@ function listPendingCaptures2(repoRoot, tool, sessionId) {
   const records = [];
   for (const entry of entries) {
     if (!entry.isDirectory() || !/^[0-9a-f-]{36}$/.test(entry.name)) continue;
-    const file = path18.join(directory, entry.name, "capture.json");
-    if (!fs19.existsSync(file)) continue;
+    const file = path19.join(directory, entry.name, "capture.json");
+    if (!fs20.existsSync(file)) continue;
     const record = JSON.parse(
-      fs19.readFileSync(file, "utf-8")
+      fs20.readFileSync(file, "utf-8")
     );
     if (record.version !== 1 || record.id !== entry.name || record.repoRoot !== repoRoot || record.tool !== tool || record.sessionId !== sessionId) {
       throw new Error(`Invalid pending Git capture: ${file}`);
@@ -16568,13 +17145,13 @@ function hasPendingCaptures(repoRoot, tool, sessionId) {
   return listPendingCaptures2(repoRoot, tool, sessionId).length > 0;
 }
 function listPendingQueues() {
-  const root = path18.join(
-    process.env.HILLCLIMB_GIT_TRACES_STATE_DIR ?? path18.join(os9.homedir(), ".hillclimb", "git-traces"),
+  const root = path19.join(
+    process.env.HILLCLIMB_GIT_TRACES_STATE_DIR ?? path19.join(os9.homedir(), ".hillclimb", "git-traces"),
     "pending-v1"
   );
   let queueDirs;
   try {
-    queueDirs = fs19.readdirSync(root, { withFileTypes: true });
+    queueDirs = fs20.readdirSync(root, { withFileTypes: true });
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
@@ -16582,15 +17159,15 @@ function listPendingQueues() {
   const queues = [];
   for (const queueDir of queueDirs) {
     if (!queueDir.isDirectory()) continue;
-    const directory = path18.join(root, queueDir.name);
+    const directory = path19.join(root, queueDir.name);
     let identity = null;
     try {
-      for (const entry of fs19.readdirSync(directory, { withFileTypes: true })) {
+      for (const entry of fs20.readdirSync(directory, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
-        const file = path18.join(directory, entry.name, "capture.json");
-        if (!fs19.existsSync(file)) continue;
+        const file = path19.join(directory, entry.name, "capture.json");
+        if (!fs20.existsSync(file)) continue;
         identity = JSON.parse(
-          fs19.readFileSync(file, "utf-8")
+          fs20.readFileSync(file, "utf-8")
         );
         break;
       }
@@ -16623,15 +17200,15 @@ function noteReplayFailure(record, error, now = Date.now()) {
 }
 function queueDiskBytes(directory) {
   let diskBytes = 0;
-  if (fs19.existsSync(directory)) {
-    for (const entry of fs19.readdirSync(directory, { withFileTypes: true })) {
+  if (fs20.existsSync(directory)) {
+    for (const entry of fs20.readdirSync(directory, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
-      for (const file of fs19.readdirSync(path18.join(directory, entry.name), {
+      for (const file of fs20.readdirSync(path19.join(directory, entry.name), {
         withFileTypes: true
       })) {
         if (file.isFile())
-          diskBytes += fs19.statSync(
-            path18.join(directory, entry.name, file.name)
+          diskBytes += fs20.statSync(
+            path19.join(directory, entry.name, file.name)
           ).size;
       }
     }
@@ -16647,7 +17224,7 @@ function pendingBytes(records) {
   return queueDiskBytes(
     queueDirectory(first.repoRoot, first.tool, first.sessionId)
   ) + records.reduce(
-    (sum, record) => sum + chargedBytes(record) + (fs19.existsSync(path18.join(captureDirectory(record), "capture.json")) ? 0 : Buffer.byteLength(JSON.stringify(record))),
+    (sum, record) => sum + chargedBytes(record) + (fs20.existsSync(path19.join(captureDirectory(record), "capture.json")) ? 0 : Buffer.byteLength(JSON.stringify(record))),
     0
   );
 }
@@ -16740,7 +17317,7 @@ function storePendingCapture(params) {
       );
     }
     const directory = captureDirectory(record);
-    fs19.mkdirSync(directory, { recursive: true, mode: 448 });
+    fs20.mkdirSync(directory, { recursive: true, mode: 448 });
     const refRoot = `refs/hillclimb/pending-v1/${record.id}`;
     let published = false;
     try {
@@ -16783,7 +17360,7 @@ function storePendingCapture(params) {
       return record;
     } finally {
       if (!published) {
-        fs19.rmSync(directory, { recursive: true, force: true });
+        fs20.rmSync(directory, { recursive: true, force: true });
         for (const label of [
           "snapshot",
           "tree",
@@ -16814,7 +17391,7 @@ async function preparePendingUpload(context, contributionId, filename, buffer) {
       let status = "failed";
       try {
         if (saved) {
-          const bytes = fs19.readFileSync(path18.join(directory, saved.file));
+          const bytes = fs20.readFileSync(path19.join(directory, saved.file));
           if (bytes.length !== saved.bytes || crypto7.createHash("sha256").update(bytes).digest("hex") !== saved.sha256) {
             throw new Error(
               `Pending Git artifact is corrupt: ${saved.file}; capture retained`
@@ -16834,7 +17411,7 @@ async function preparePendingUpload(context, contributionId, filename, buffer) {
           );
         }
         const file = `${crypto7.createHash("sha256").update(key).digest("hex")}.artifact`;
-        writeDurable(path18.join(directory, file), buffer);
+        writeDurable(path19.join(directory, file), buffer);
         context.record.uploads[key] = {
           file,
           bytes: buffer.byteLength,
@@ -16844,7 +17421,7 @@ async function preparePendingUpload(context, contributionId, filename, buffer) {
           context.save();
         } catch (err) {
           delete context.record.uploads[key];
-          fs19.rmSync(path18.join(directory, file), { force: true });
+          fs20.rmSync(path19.join(directory, file), { force: true });
           throw err;
         }
         status = "ok";
@@ -16876,8 +17453,8 @@ function readPreparedCaptureArtifact(context, filename, input) {
       throw new Error(
         `Prepared Git artifact input changed: ${filename}; capture retained`
       );
-    const bytes = fs19.readFileSync(
-      path18.join(captureDirectory(context.record), saved.file)
+    const bytes = fs20.readFileSync(
+      path19.join(captureDirectory(context.record), saved.file)
     );
     if (bytes.length !== saved.bytes || crypto7.createHash("sha256").update(bytes).digest("hex") !== saved.sha256)
       throw new Error(
@@ -16896,7 +17473,7 @@ function completePendingCapture(record) {
 function removeCompletedCapture(record) {
   if (!record.completed)
     throw new Error("Cannot remove an unacknowledged Git capture");
-  fs19.rmSync(captureDirectory(record), { recursive: true, force: true });
+  fs20.rmSync(captureDirectory(record), { recursive: true, force: true });
   for (const label of ["snapshot", "tree", "head", "baseline", "previous"]) {
     deleteRef(
       record.repoRoot,
@@ -16969,7 +17546,7 @@ async function uploadArtifact(client, contributionId, filename, mimeType, buffer
 }
 
 // package.json
-var version = "0.9.3";
+var version = "0.9.5";
 
 // src/version.ts
 var CLI_VERSION = version;
@@ -16993,7 +17570,7 @@ function lineHasAssistant(line) {
   return line.includes('"type":"assistant"') || line.includes('"role":"assistant"') || line.includes('"type":"assistant.');
 }
 async function hasAssistantMessage(transcriptPath) {
-  const stream = fs20.createReadStream(transcriptPath, { encoding: "utf-8" });
+  const stream = fs21.createReadStream(transcriptPath, { encoding: "utf-8" });
   let buffer = "";
   try {
     for await (const chunk of stream) {
@@ -17080,7 +17657,7 @@ function resolveCursorTranscriptPath(payload) {
   const workspace = payload.workspace_roots?.[0];
   if (!id || !workspace) return void 0;
   const encoded = workspace.replace(/^\//, "").replace(/\//g, "-");
-  return path19.join(
+  return path20.join(
     os10.homedir(),
     ".cursor",
     "projects",
@@ -17136,14 +17713,14 @@ async function sweepClaudeSubagentTranscripts(payload) {
   const cwd = resolveHookCwd(payload);
   if (!parentSessionId || !cwd || !payload.transcript_path) return;
   try {
-    const directory = path19.join(
-      path19.dirname(path19.resolve(payload.transcript_path)),
+    const directory = path20.join(
+      path20.dirname(path20.resolve(payload.transcript_path)),
       parentSessionId,
       "subagents"
     );
     let names;
     try {
-      names = await fs20.promises.readdir(directory);
+      names = await fs21.promises.readdir(directory);
     } catch (err) {
       if (err.code === "ENOENT") return;
       throw err;
@@ -17152,12 +17729,12 @@ async function sweepClaudeSubagentTranscripts(payload) {
     for (const name of names) {
       const match = /^agent-([A-Za-z0-9_-]+)\.jsonl$/.exec(name);
       if (!match) continue;
-      const file = path19.join(directory, name);
+      const file = path20.join(directory, name);
       try {
         files.push({
           agentId: match[1],
           file,
-          modifiedMs: (await fs20.promises.stat(file)).mtimeMs
+          modifiedMs: (await fs21.promises.stat(file)).mtimeMs
         });
       } catch {
       }
@@ -17323,7 +17900,7 @@ async function sweepCodexForkTranscripts(payload) {
     const parent = await findProjectForCwd(cwd);
     if (!parent) return;
     const registeredRoots = Object.keys((await loadProjects()).projects).map(
-      (root) => path19.resolve(root)
+      (root) => path20.resolve(root)
     );
     const discovery = await discoverCodexForkThreads({
       parentThreadId: parentSessionId,
@@ -17464,9 +18041,9 @@ async function runUploadForSession(payload, options) {
     );
     return "skipped";
   }
-  const transcriptResolved = path19.resolve(transcriptPath);
+  const transcriptResolved = path20.resolve(transcriptPath);
   try {
-    const stat = await fs20.promises.stat(transcriptResolved);
+    const stat = await fs21.promises.stat(transcriptResolved);
     if (!stat.isFile()) {
       appendLog(
         "warn",
@@ -17522,7 +18099,7 @@ function makeTranscriptGroup(repoRoot, sourceTool, transcriptPath, content) {
   };
   return {
     repoPath: repoRoot,
-    label: path19.basename(repoRoot),
+    label: path20.basename(repoRoot),
     files: [sourceFile],
     sourceNames: [sourceTool],
     lastModified: /* @__PURE__ */ new Date()
@@ -17533,7 +18110,7 @@ async function buildRedactChain(repoRoot, capturedSecrets = []) {
     "secret-discovery",
     () => discoverEnvFiles(repoRoot)
   );
-  const envFilePaths = envFileNames.map((n) => path19.join(repoRoot, n));
+  const envFilePaths = envFileNames.map((n) => path20.join(repoRoot, n));
   const secretResult = await measureAgentStage(
     "secret-collection",
     () => collectSecrets(repoRoot, envFilePaths, [])
@@ -18187,7 +18764,7 @@ async function uploadSession(args) {
     try {
       raw = await measureAgentStage(
         "transcript-read",
-        () => captured ? Promise.resolve(captured.bytes) : fs20.promises.readFile(transcriptPath)
+        () => captured ? Promise.resolve(captured.bytes) : fs21.promises.readFile(transcriptPath)
       );
     } catch (err) {
       if (err.code === "ERR_FS_FILE_TOO_LARGE") {
@@ -18558,15 +19135,15 @@ import crypto9 from "crypto";
 
 // src/git-traces/handlers.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import fs21 from "fs";
-import path20 from "path";
+import fs22 from "fs";
+import path21 from "path";
 var GIT_TRACES_SLUG = "git-traces";
 var MAX_FORK_SWEEP_THREADS2 = 8;
 var MAX_UPLOAD_BYTES = 500 * 1024 * 1024;
 var STALE_SCOPED_STATE_TTL_MS = 24 * 60 * 60 * 1e3;
 var REBASELINE_AFTER_DIFF_FAILURES = 2;
 async function withRepoCaptureLock(repoRoot, capture) {
-  const canonicalRoot = fs21.realpathSync(repoRoot);
+  const canonicalRoot = fs22.realpathSync(repoRoot);
   await acquireLock3(canonicalRoot, "snapshot-index-v1", null);
   try {
     return capture();
@@ -18624,7 +19201,7 @@ var PendingQueueConflictError = class extends Error {
 async function loadConfiguredRepos() {
   const file = await loadProjects();
   return Object.entries(file.projects).map(([repoRoot, config]) => ({
-    repoRoot: path20.resolve(repoRoot),
+    repoRoot: path21.resolve(repoRoot),
     config
   })).sort((a, b) => a.repoRoot.localeCompare(b.repoRoot));
 }
@@ -18642,12 +19219,12 @@ async function configuredReposFor(trigger) {
   return repos;
 }
 async function propagateCodexHooks(parentRoot, worktreeRoot) {
-  const source = path20.join(parentRoot, ".codex", "hooks.json");
-  const target = path20.join(worktreeRoot, ".codex", "hooks.json");
-  if (fs21.existsSync(target) || !fs21.existsSync(source)) return;
+  const source = path21.join(parentRoot, ".codex", "hooks.json");
+  const target = path21.join(worktreeRoot, ".codex", "hooks.json");
+  if (fs22.existsSync(target) || !fs22.existsSync(source)) return;
   try {
-    fs21.mkdirSync(path20.dirname(target), { recursive: true });
-    fs21.copyFileSync(source, target, fs21.constants.COPYFILE_EXCL);
+    fs22.mkdirSync(path21.dirname(target), { recursive: true });
+    fs22.copyFileSync(source, target, fs22.constants.COPYFILE_EXCL);
   } catch (err) {
     appendLog(
       "warn",
@@ -18669,7 +19246,7 @@ async function propagateCodexHooks(parentRoot, worktreeRoot) {
   }
 }
 function repoLabel(repoRoot) {
-  return path20.basename(repoRoot) || repoRoot;
+  return path21.basename(repoRoot) || repoRoot;
 }
 function resolveCwd2(payload) {
   return resolveHookCwd(payload);
@@ -20886,7 +21463,7 @@ async function collectStopTargets(tool, sessionId, repos, repoByRoot) {
   let needsLineageCheck = false;
   const storedStates = await listSessionStatesForSession(tool, sessionId);
   for (const { state } of storedStates) {
-    const repo = repoByRoot.get(path20.resolve(state.repoRoot));
+    const repo = repoByRoot.get(path21.resolve(state.repoRoot));
     if (!repo) {
       missingConfig++;
       appendLog(
@@ -20918,7 +21495,7 @@ async function lateInitSkipReason(payload, tool) {
   const transcriptPath = payload.transcript_path;
   if (!transcriptPath) return tool === "codex" ? null : "no-transcript-path";
   try {
-    const stat = await fs21.promises.stat(path20.resolve(transcriptPath));
+    const stat = await fs22.promises.stat(path21.resolve(transcriptPath));
     return stat.isFile() ? null : "transcript-not-a-file";
   } catch {
     return "transcript-missing";
@@ -21127,9 +21704,9 @@ async function handleSessionEnd(payload, tool) {
   if (sessionId) {
     const states = await listSessionStatesForSession(tool, sessionId);
     for (const { state } of states) {
-      const repoRoot = path20.resolve(state.repoRoot);
+      const repoRoot = path21.resolve(state.repoRoot);
       repoRoots.add(repoRoot);
-      const canProcess = repoByRoot.has(repoRoot) || project && path20.resolve(project.repoRoot) === repoRoot;
+      const canProcess = repoByRoot.has(repoRoot) || project && path21.resolve(project.repoRoot) === repoRoot;
       if (canProcess && tool === "codex" && state.codexLineageChecked !== true) {
         needsLineageCheck = true;
       }
@@ -21166,7 +21743,7 @@ async function handleSessionEnd(payload, tool) {
   let rejected = 0;
   const finalCaptures = /* @__PURE__ */ new Map();
   for (const repoRoot of repoRoots) {
-    const repo = repoByRoot.get(path20.resolve(repoRoot)) ?? (project && path20.resolve(project.repoRoot) === path20.resolve(repoRoot) ? { repoRoot: project.repoRoot, config: project.config } : null);
+    const repo = repoByRoot.get(path21.resolve(repoRoot)) ?? (project && path21.resolve(project.repoRoot) === path21.resolve(repoRoot) ? { repoRoot: project.repoRoot, config: project.config } : null);
     if (repo)
       finalCaptures.set(
         repoRoot,
@@ -21174,7 +21751,7 @@ async function handleSessionEnd(payload, tool) {
       );
   }
   for (const repoRoot of repoRoots) {
-    const repo = repoByRoot.get(path20.resolve(repoRoot)) ?? (project && path20.resolve(project.repoRoot) === path20.resolve(repoRoot) ? { repoRoot: project.repoRoot, config: project.config } : null);
+    const repo = repoByRoot.get(path21.resolve(repoRoot)) ?? (project && path21.resolve(project.repoRoot) === path21.resolve(repoRoot) ? { repoRoot: project.repoRoot, config: project.config } : null);
     if (!repo) {
       skipped++;
       appendLog(
@@ -21553,15 +22130,15 @@ ${stack}` : ""}`
 }
 
 // src/outputs/zip.ts
-import fs23 from "fs";
-import path22 from "path";
+import fs24 from "fs";
+import path23 from "path";
 import archiver2 from "archiver";
 
 // src/outputs/downloads.ts
 import { execSync as execSync2 } from "child_process";
-import fs22 from "fs";
+import fs23 from "fs";
 import os11 from "os";
-import path21 from "path";
+import path22 from "path";
 function getDownloadsFolder() {
   const home = os11.homedir();
   if (process.platform === "linux") {
@@ -21570,12 +22147,12 @@ function getDownloadsFolder() {
         encoding: "utf-8",
         timeout: 3e3
       }).trim();
-      if (xdgDir && fs22.existsSync(xdgDir)) return xdgDir;
+      if (xdgDir && fs23.existsSync(xdgDir)) return xdgDir;
     } catch {
     }
   }
-  const downloads = path21.join(home, "Downloads");
-  if (fs22.existsSync(downloads)) return downloads;
+  const downloads = path22.join(home, "Downloads");
+  if (fs23.existsSync(downloads)) return downloads;
   return home;
 }
 
@@ -21584,11 +22161,11 @@ function sanitizeFilename(name) {
   return name.replace(/[^a-zA-Z0-9._-]/g, "_");
 }
 function getUniqueFilename(dir, base, ext) {
-  let candidate = path22.join(dir, `${base}${ext}`);
-  if (!fs23.existsSync(candidate)) return candidate;
+  let candidate = path23.join(dir, `${base}${ext}`);
+  if (!fs24.existsSync(candidate)) return candidate;
   let i = 1;
-  while (fs23.existsSync(candidate)) {
-    candidate = path22.join(dir, `${base}-${i}${ext}`);
+  while (fs24.existsSync(candidate)) {
+    candidate = path23.join(dir, `${base}-${i}${ext}`);
     i++;
   }
   return candidate;
@@ -21598,13 +22175,13 @@ var ZipOutput = class {
   label = "Save as .zip to Downloads";
   async emit(group, options) {
     const downloadsDir = getDownloadsFolder();
-    const repoName = sanitizeFilename(path22.basename(group.repoPath));
+    const repoName = sanitizeFilename(path23.basename(group.repoPath));
     const timeRange = options.timeRange;
     const rangePart = timeRange?.label ?? "all";
     const epochSeconds = Math.floor(Date.now() / 1e3);
     const baseName = `logs-${repoName}-${rangePart}-${epochSeconds}`;
     const outputPath = getUniqueFilename(downloadsDir, baseName, ".zip");
-    const output = fs23.createWriteStream(outputPath);
+    const output = fs24.createWriteStream(outputPath);
     const archive = archiver2("zip", { zlib: { level: 6 } });
     const done = new Promise((resolve, reject) => {
       output.on("close", resolve);
@@ -21798,15 +22375,15 @@ async function confirmExport(group, output) {
 }
 
 // src/sources/claude.ts
-import fs24 from "fs";
+import fs25 from "fs";
 import os12 from "os";
-import path23 from "path";
+import path24 from "path";
 import readline3 from "readline";
 var SKIP_DIRS = /* @__PURE__ */ new Set(["tool-results"]);
 async function resolveRepoPath(projectDir) {
-  const indexPath = path23.join(projectDir, "sessions-index.json");
+  const indexPath = path24.join(projectDir, "sessions-index.json");
   try {
-    const raw = await fs24.promises.readFile(indexPath, "utf-8");
+    const raw = await fs25.promises.readFile(indexPath, "utf-8");
     const data = JSON.parse(raw);
     if (data.originalPath && typeof data.originalPath === "string") {
       return data.originalPath;
@@ -21814,12 +22391,12 @@ async function resolveRepoPath(projectDir) {
   } catch {
   }
   const cwdCounts = /* @__PURE__ */ new Map();
-  const entries = await fs24.promises.readdir(projectDir, {
+  const entries = await fs25.promises.readdir(projectDir, {
     withFileTypes: true
   });
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(".jsonl")) continue;
-    const cwd = await extractCwdFromJsonl(path23.join(projectDir, entry.name));
+    const cwd = await extractCwdFromJsonl(path24.join(projectDir, entry.name));
     if (cwd) {
       cwdCounts.set(cwd, (cwdCounts.get(cwd) ?? 0) + 1);
     }
@@ -21838,7 +22415,7 @@ async function resolveRepoPath(projectDir) {
   return null;
 }
 async function extractCwdFromJsonl(filePath) {
-  const stream = fs24.createReadStream(filePath, { encoding: "utf-8" });
+  const stream = fs25.createReadStream(filePath, { encoding: "utf-8" });
   const rl = readline3.createInterface({ input: stream, crlfDelay: Infinity });
   try {
     for await (const line of rl) {
@@ -21860,12 +22437,12 @@ async function extractCwdFromJsonl(filePath) {
 async function collectFiles(dir, baseDir, sourceName, repoPath, results) {
   let entries;
   try {
-    entries = await fs24.promises.readdir(dir, { withFileTypes: true });
+    entries = await fs25.promises.readdir(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
-    const fullPath = path23.join(dir, entry.name);
+    const fullPath = path24.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (SKIP_DIRS.has(entry.name)) continue;
       await collectFiles(fullPath, baseDir, sourceName, repoPath, results);
@@ -21887,19 +22464,19 @@ function fallbackDecode(encodedName) {
 var ClaudeSource = class {
   name = "claude";
   async scan() {
-    const baseDir = path23.join(os12.homedir(), ".claude", "projects");
+    const baseDir = path24.join(os12.homedir(), ".claude", "projects");
     try {
-      await fs24.promises.access(baseDir);
+      await fs25.promises.access(baseDir);
     } catch {
       return [];
     }
-    const projectDirs = await fs24.promises.readdir(baseDir, {
+    const projectDirs = await fs25.promises.readdir(baseDir, {
       withFileTypes: true
     });
     const dirEntries = projectDirs.filter((d) => d.isDirectory());
     const resultArrays = await Promise.all(
       dirEntries.map(async (dir) => {
-        const projectPath = path23.join(baseDir, dir.name);
+        const projectPath = path24.join(baseDir, dir.name);
         const repoPath = await resolveRepoPath(projectPath) ?? fallbackDecode(dir.name);
         const files = [];
         await collectFiles(
@@ -21917,12 +22494,12 @@ var ClaudeSource = class {
 };
 
 // src/sources/codex.ts
-import fs25 from "fs";
+import fs26 from "fs";
 import os13 from "os";
-import path24 from "path";
+import path25 from "path";
 import readline4 from "readline";
 async function parseSessionMeta2(filePath) {
-  const stream = fs25.createReadStream(filePath, { encoding: "utf-8" });
+  const stream = fs26.createReadStream(filePath, { encoding: "utf-8" });
   const rl = readline4.createInterface({ input: stream, crlfDelay: Infinity });
   try {
     for await (const line of rl) {
@@ -21947,12 +22524,12 @@ async function findJsonlFiles(dir) {
   async function walk(d) {
     let entries;
     try {
-      entries = await fs25.promises.readdir(d, { withFileTypes: true });
+      entries = await fs26.promises.readdir(d, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const full = path24.join(d, entry.name);
+      const full = path25.join(d, entry.name);
       if (entry.isDirectory()) {
         await walk(full);
       } else if (entry.isFile() && entry.name.endsWith(".jsonl")) {
@@ -21966,11 +22543,11 @@ async function findJsonlFiles(dir) {
 async function loadHistory(historyPath) {
   const map = /* @__PURE__ */ new Map();
   try {
-    await fs25.promises.access(historyPath);
+    await fs26.promises.access(historyPath);
   } catch {
     return map;
   }
-  const stream = fs25.createReadStream(historyPath, { encoding: "utf-8" });
+  const stream = fs26.createReadStream(historyPath, { encoding: "utf-8" });
   const rl = readline4.createInterface({ input: stream, crlfDelay: Infinity });
   try {
     for await (const line of rl) {
@@ -21997,14 +22574,14 @@ async function loadHistory(historyPath) {
 var CodexSource = class {
   name = "codex";
   async scan() {
-    const codexDir = path24.join(os13.homedir(), ".codex");
-    const sessionsDir2 = path24.join(codexDir, "sessions");
+    const codexDir = path25.join(os13.homedir(), ".codex");
+    const sessionsDir2 = path25.join(codexDir, "sessions");
     try {
-      await fs25.promises.access(sessionsDir2);
+      await fs26.promises.access(sessionsDir2);
     } catch {
       return [];
     }
-    const historyPath = path24.join(codexDir, "history.jsonl");
+    const historyPath = path25.join(codexDir, "history.jsonl");
     const [jsonlFiles, historyMap] = await Promise.all([
       findJsonlFiles(sessionsDir2),
       loadHistory(historyPath)
@@ -22027,8 +22604,8 @@ var CodexSource = class {
       });
       const historyLines = historyMap.get(meta.sessionId);
       if (historyLines) {
-        const sessionDir = path24.relative(sessionsDir2, path24.dirname(filePath));
-        const historyAbsPath = path24.join(
+        const sessionDir = path25.relative(sessionsDir2, path25.dirname(filePath));
+        const historyAbsPath = path25.join(
           sessionsDir2,
           sessionDir,
           `history-${meta.sessionId}.jsonl`
@@ -22048,18 +22625,18 @@ var CodexSource = class {
 };
 
 // src/sources/copilotChat.ts
-import fs26 from "fs";
+import fs27 from "fs";
 import os14 from "os";
-import path25 from "path";
+import path26 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function vsCodeUserDirs() {
   const home = os14.homedir();
   const dirs = [
-    path25.join(home, "Library", "Application Support", "Code", "User"),
-    path25.join(home, ".config", "Code", "User")
+    path26.join(home, "Library", "Application Support", "Code", "User"),
+    path26.join(home, ".config", "Code", "User")
   ];
   if (process.env.APPDATA) {
-    dirs.push(path25.join(process.env.APPDATA, "Code", "User"));
+    dirs.push(path26.join(process.env.APPDATA, "Code", "User"));
   }
   return dirs;
 }
@@ -22074,7 +22651,7 @@ function uriToFsPath(uri) {
 async function readWorkspaceFolder(workspaceJsonPath) {
   let raw;
   try {
-    raw = await fs26.promises.readFile(workspaceJsonPath, "utf-8");
+    raw = await fs27.promises.readFile(workspaceJsonPath, "utf-8");
   } catch {
     return null;
   }
@@ -22096,10 +22673,10 @@ var CopilotChatSource = class {
   async scan() {
     const results = [];
     for (const userDir of vsCodeUserDirs()) {
-      const workspaceStorage = path25.join(userDir, "workspaceStorage");
+      const workspaceStorage = path26.join(userDir, "workspaceStorage");
       let hashDirs;
       try {
-        hashDirs = await fs26.promises.readdir(workspaceStorage, {
+        hashDirs = await fs27.promises.readdir(workspaceStorage, {
           withFileTypes: true
         });
       } catch {
@@ -22107,22 +22684,22 @@ var CopilotChatSource = class {
       }
       for (const hash of hashDirs) {
         if (!hash.isDirectory()) continue;
-        const wsRoot = path25.join(workspaceStorage, hash.name);
-        const transcriptsDir = path25.join(
+        const wsRoot = path26.join(workspaceStorage, hash.name);
+        const transcriptsDir = path26.join(
           wsRoot,
           "GitHub.copilot-chat",
           "transcripts"
         );
         let transcriptEntries;
         try {
-          transcriptEntries = await fs26.promises.readdir(transcriptsDir, {
+          transcriptEntries = await fs27.promises.readdir(transcriptsDir, {
             withFileTypes: true
           });
         } catch {
           continue;
         }
         const repoPath = await readWorkspaceFolder(
-          path25.join(wsRoot, "workspace.json")
+          path26.join(wsRoot, "workspace.json")
         );
         if (!repoPath) continue;
         for (const entry of transcriptEntries) {
@@ -22130,7 +22707,7 @@ var CopilotChatSource = class {
           const sessionId = entry.name.slice(0, -".jsonl".length);
           results.push({
             sourceName: this.name,
-            absolutePath: path25.join(transcriptsDir, entry.name),
+            absolutePath: path26.join(transcriptsDir, entry.name),
             repoPath,
             metadata: { sessionId }
           });
@@ -22170,7 +22747,7 @@ function reportRedactionStats(noun, stats) {
 async function filterByTimeRange(group, range) {
   const results = await Promise.all(
     group.files.map(
-      (f) => fs27.promises.stat(f.absolutePath).then((s) => ({ file: f, stat: s })).catch(() => null)
+      (f) => fs28.promises.stat(f.absolutePath).then((s) => ({ file: f, stat: s })).catch(() => null)
     )
   );
   const filtered = [];
@@ -22197,10 +22774,10 @@ async function runInteractive() {
   s.start(`Scanning ${source.name} logs...`);
   const allFiles = await source.scan();
   const allGroups = await mergeByRepo(allFiles);
-  const repoRoot = path26.resolve(repo.root);
+  const repoRoot = path27.resolve(repo.root);
   const matching = allGroups.filter((g) => {
-    const resolved = path26.resolve(g.repoPath);
-    return resolved === repoRoot || resolved.startsWith(repoRoot + path26.sep);
+    const resolved = path27.resolve(g.repoPath);
+    return resolved === repoRoot || resolved.startsWith(repoRoot + path27.sep);
   });
   if (matching.length === 0) {
     s.stop(`No ${source.name} logs found for ${repo.name}.`);
@@ -22231,7 +22808,7 @@ async function runInteractive() {
     }
   }
   const envFileNames = await discoverEnvFiles(repoRoot);
-  const envFilePaths = envFileNames.map((n) => path26.join(repoRoot, n));
+  const envFilePaths = envFileNames.map((n) => path27.join(repoRoot, n));
   const additionalFiles = await promptSecretFiles(envFileNames);
   const secretResult = await collectSecrets(
     repoRoot,