memoir-cli 3.11.1 → 3.11.3

package/README.md

@@ -15,15 +15,17 @@
 npx memoir-cli
 ```
 
-One command. No install, no config, no API keys. Claude Code on your Mac, Cursor on your laptop, Copilot at the office — **one memory follows you** across every tool and every machine, encrypted with a key only you hold. memoir's servers literally can't read it.
+One command. No install, no config, no API keys. Claude Code on your Mac, Cursor on your laptop, Copilot at the office — **one memory follows you** across every tool and every machine. Cloud sync is end-to-end encrypted with a key only you hold — memoir's servers can't read what you sync.
 
 ---
 
 ## What it does
 
-Your coding tools are starting to remember you — Claude Code, Cursor, and Copilot all ship built-in memory now. But that memory is **trapped: one tool, one machine, stored in plaintext.** Switch from Cursor to Claude Code, or open a different laptop, and your AI is a stranger again.
+Your coding tools are starting to remember you — Claude Code, Cursor, and Copilot all ship built-in memory now. But that memory is **trapped: one tool, one machine, one vendor's format.** Switch from Cursor to Claude Code, or open a different laptop, and your AI is a stranger again.
 
-memoir is the [MCP memory server](https://modelcontextprotocol.io) that breaks it out. **One memory, shared across every tool and synced to every machine — encrypted client-side, so even memoir's servers can't read it.** Your AI searches, saves, and recalls context automatically, everywhere you work.
+memoir is the [MCP memory server](https://modelcontextprotocol.io) that breaks it out. **One memory, shared across every tool and synced to every machine — E2E-encrypted in the cloud, plain readable markdown on your disk.** Your AI searches, saves, and recalls context automatically, everywhere you work.
+
+It's built on an **open, published format** — [the memoir format, v0.1](docs/SPEC.md) — so your AI's accumulated context is never trapped in this tool either. Six entry types, normative merge semantics, JSON Schemas, and a validator (`npx memoir-cli validate`). Any tool can implement it; [critique welcome](https://github.com/camgitt/memoir/issues).
 
 ```
 you: how does auth work in this project?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memoir-cli",
-  "version": "3.11.1",
+  "version": "3.11.3",
   "mcpName": "io.github.camgitt/memoir",
   "description": "Private, portable AI memory: synced across every coding tool and machine, end-to-end encrypted, free. One memory for Claude Code, Cursor, Copilot, Gemini + more — MCP-native, zero-knowledge, open source.",
   "main": "src/index.js",

package/src/commands/push.js

@@ -10,6 +10,7 @@ import { getConfig, autoSetup } from '../config.js';
 import { extractMemories, adapters } from '../adapters/index.js';
 import { syncToLocal, syncToGit } from '../providers/index.js';
 import inquirer from 'inquirer';
+import { appendEvent } from '../events/log.js';
 import { findClaudeSessions, parseSession, generateContextHandoff, shouldIgnoreProject, persistDecisions, isQuality } from '../context/capture.js';
 import { scanForSecrets, printSecurityReport } from '../security/scanner.js';
 import { encryptDirectory, createVerifyToken } from '../security/encryption.js';
@@ -25,42 +26,59 @@ import { injectInto, detectAvailableTargets } from '../session/inject.js';
 // Best-effort fetch of the CURRENT remote session.json, so push.js can merge
 // before overwrite instead of blindly clobbering it (see below). Returns the
 // remote session state (already migrated to SCHEMA_VERSION) or null if the
-// remote is unreachable, this is the very first push (nothing there yet), or
-// the remote backup is encrypted (best-effort only — we deliberately don't
-// force an extra decrypt passphrase prompt mid-push; falls back to
-// local-only in that case, exactly like an unreachable remote).
+// Tri-state, because the difference is destructive: 'none' means nothing is
+// there (safe to write ours), 'ok' carries the remote session for merging,
+// and 'unreadable' means A REMOTE EXISTS BUT WE CANNOT READ IT — encrypted,
+// slow clone, corrupt JSON. On 'unreadable' the caller MUST NOT stage
+// session.json at all, so the remote copy survives the mirror sweep.
+// The old boolean version returned null for 'unreadable', which collapsed
+// to merged = local and silently clobbered the other machine's state —
+// worst on encrypted remotes, where the "protection" was a complete no-op.
 async function fetchRemoteSessionBestEffort(config) {
   try {
     if (config.provider === 'local' || config.provider?.includes?.('local')) {
       const resolvedDest = (config.localPath || '').replace(/^~/, os.homedir());
-      if (!resolvedDest) return null;
-      if (await fs.pathExists(path.join(resolvedDest, 'manifest.enc'))) return null; // encrypted
+      if (!resolvedDest) return { status: 'none', session: null };
+      if (await fs.pathExists(path.join(resolvedDest, 'manifest.enc'))) return { status: 'unreadable', session: null }; // encrypted
       const remotePath = path.join(resolvedDest, 'session.json');
-      if (!(await fs.pathExists(remotePath))) return null;
-      const raw = JSON.parse(await fs.readFile(remotePath, 'utf8'));
-      const { state } = migrateSessionData(raw);
-      return state;
+      if (!(await fs.pathExists(remotePath))) return { status: 'none', session: null };
+      try {
+        const raw = JSON.parse(await fs.readFile(remotePath, 'utf8'));
+        const { state } = migrateSessionData(raw);
+        return { status: 'ok', session: state };
+      } catch {
+        return { status: 'unreadable', session: null }; // exists but corrupt
+      }
     }
 
     if (config.provider === 'git' || config.provider?.includes?.('git')) {
       const repoUrl = config.gitRepo;
-      if (!repoUrl) return null;
+      if (!repoUrl) return { status: 'none', session: null };
       const peekDir = path.join(os.tmpdir(), `memoir-push-peek-${Date.now()}`);
       await fs.ensureDir(peekDir);
       try {
         try {
-          execFileSync('git', ['clone', '--depth', '1', repoUrl, '.'], { cwd: peekDir, stdio: 'ignore', timeout: 30000 });
+          // Same budget as the real sync clone — the old 30s peek against a
+          // 60s sync meant a 35-second clone failed the peek but succeeded
+          // the mirror, deterministically wiping the remote session.
+          execFileSync('git', ['clone', '--depth', '1', repoUrl, '.'], { cwd: peekDir, stdio: 'ignore', timeout: 120000 });
         } catch {
-          // Unreachable, or this is the very first push (repo doesn't exist
-          // yet / is empty) — fall back to local-only.
-          return null;
+          // Unreachable or first push. If the LATER sync clone succeeds
+          // where this one failed, treating it as 'none' would clobber —
+          // but with equal timeouts that window is a genuine remote flap,
+          // and 'unreadable' here would wedge first-time pushes forever.
+          return { status: 'none', session: null };
         }
-        if (await fs.pathExists(path.join(peekDir, 'manifest.enc'))) return null; // encrypted
+        if (await fs.pathExists(path.join(peekDir, 'manifest.enc'))) return { status: 'unreadable', session: null }; // encrypted
         const remotePath = path.join(peekDir, 'session.json');
-        if (!(await fs.pathExists(remotePath))) return null;
-        const raw = JSON.parse(await fs.readFile(remotePath, 'utf8'));
-        const { state } = migrateSessionData(raw);
-        return state;
+        if (!(await fs.pathExists(remotePath))) return { status: 'none', session: null };
+        try {
+          const raw = JSON.parse(await fs.readFile(remotePath, 'utf8'));
+          const { state } = migrateSessionData(raw);
+          return { status: 'ok', session: state };
+        } catch {
+          return { status: 'unreadable', session: null };
+        }
       } finally {
         await fs.remove(peekDir).catch(() => {});
       }
@@ -68,7 +86,7 @@ async function fetchRemoteSessionBestEffort(config) {
   } catch {
     // Never let a merge-fetch failure block the push.
   }
-  return null;
+  return { status: 'none', session: null };
 }
 
 // Recursively scan every staged file (the REAL tool memory/config files about
@@ -193,7 +211,17 @@ export async function pushCommand(options = {}) {
           // received the raw unfiltered list while only the session.json sink
           // below filtered, so junk could reach session-decisions.md even after
           // being rejected from session.json. Both sinks now agree on what's junk.
-          const qualityDecisions = parsed.decisions.filter(d => isQuality(String(d.value || '').trim()));
+          // Gate on the string each sink actually PERSISTS, not on d.value.
+          // For rename/tech captures d.value is a single whitespace-free
+          // token, so isQuality's words>=3 rule rejected 100% of them —
+          // two of the three advertised capture categories were dead code
+          // while persistDecisions would have written the clean d.context.
+          const decisionText = (d) => {
+            const v = String(d.value || '').trim();
+            const c = String(d.context || '').trim();
+            return (d.type === 'rename' || d.type === 'tech') && c ? c : v;
+          };
+          const qualityDecisions = parsed.decisions.filter(d => isQuality(decisionText(d)));
 
           // Persist decisions to Claude's memory so they survive across sessions
           let decisionCount = 0;
@@ -212,7 +240,7 @@ export async function pushCommand(options = {}) {
               current.current.decisions.map(d => (d.text || '').trim().toLowerCase())
             );
             for (const d of qualityDecisions.slice(0, 10)) {
-              const text = String(d.value || '').trim();
+              const text = decisionText(d);
               if (existingTexts.has(text.toLowerCase())) continue;
               await addNote(text, { why: d.context ? `auto-captured: ${d.context.slice(0, 80)}` : undefined });
             }
@@ -290,20 +318,32 @@ export async function pushCommand(options = {}) {
     // session.json (so this machine also gains whatever the remote had that
     // it didn't) — symmetric with restore.js instead of a blind overwrite.
     let sessionIncluded = false;
+    let preserveRemoteSession = false;
     try {
       if (await fs.pathExists(sessionPaths.session)) {
-        const remote = await fetchRemoteSessionBestEffort(config);
-        const local = await readSession();
-        const merged = remote ? mergeSessions(local, remote) : local;
-        if (remote) {
-          // Persist the merge locally too, inside the same lock every other
-          // session.json read-modify-write cycle uses.
+        const { status, session: remote } = await fetchRemoteSessionBestEffort(config);
+        if (status === 'unreadable') {
+          // A remote session exists and we could not read it (encrypted,
+          // slow, corrupt). Staging ours anyway would mirror-overwrite the
+          // one copy we couldn't merge — the exact clobber this guard
+          // exists to prevent. Leave session.json out of the staging dir
+          // and tell the sync to leave the remote copy alone.
+          preserveRemoteSession = true;
+          try { appendEvent('sync_degraded', { reason: 'remote_session_unreadable' }); } catch {}
+        } else {
+          // Read AND merge AND write inside one lock. Reading outside it and
+          // locking only the write is a check-then-act: a concurrent MCP
+          // memoir_note in that window is silently dropped. This is the most
+          // reachable instance of that bug — it sits on the autopush path.
+          let merged;
           await withSessionLock(sessionPaths.sessionLock, async () => {
-            await writeSession(merged);
+            const local = await readSession();
+            merged = remote ? mergeSessions(local, remote) : local;
+            if (remote) await writeSession(merged);
           });
+          await fs.writeFile(path.join(stagingDir, 'session.json'), JSON.stringify(merged, null, 2));
+          sessionIncluded = true;
         }
-        await fs.writeFile(path.join(stagingDir, 'session.json'), JSON.stringify(merged, null, 2));
-        sessionIncluded = true;
       }
     } catch {
       // Best-effort — don't fail the push over this
@@ -448,7 +488,7 @@ export async function pushCommand(options = {}) {
     if (config.provider === 'local' || config.provider.includes('local')) {
       await syncToLocal(config, uploadDir, spinner);
     } else if (config.provider === 'git' || config.provider.includes('git')) {
-      await syncToGit(config, uploadDir, spinner);
+      await syncToGit(config, uploadDir, spinner, preserveRemoteSession ? { preserve: ['session.json'] } : {});
     } else {
       spinner.fail(chalk.red(`Unknown provider: ${config.provider}`));
       return;

package/src/commands/restore.js

@@ -15,6 +15,7 @@ import { getSession } from '../cloud/auth.js';
 import { unbundleToDir } from '../cloud/storage.js';
 import { SUPABASE_URL, SUPABASE_ANON_KEY, STORAGE_BUCKET } from '../cloud/constants.js';
 import { readSession, writeSession, mergeSessions, paths as sessionPaths } from '../session/state.js';
+import { withSessionLock } from '../session/lock.js';
 import { migrateSessionData } from '../session/migrations.js';
 import { renderSession } from '../session/render.js';
 import { injectInto, detectAvailableTargets } from '../session/inject.js';
@@ -136,10 +137,17 @@ export async function restoreCommand(options = {}) {
         // ever touches it. Symmetric with the push-side fix in push.js.
         const rawRemote = JSON.parse(await fs.readFile(remoteSessionPath, 'utf8'));
         const { state: remote } = migrateSessionData(rawRemote);
-        const local = await readSession();
-        const beforeMachines = Object.keys(local.machines || {}).length;
-        const merged = mergeSessions(local, remote);
-        await writeSession(merged);
+        // Read+merge+write inside ONE lock, like every state.js mutator.
+        // Reading outside the lock and locking only the write is a
+        // check-then-act: a concurrent MCP memoir_note landing in the window
+        // is silently discarded by our merge of the stale copy.
+        let merged, beforeMachines;
+        await withSessionLock(sessionPaths.sessionLock, async () => {
+          const local = await readSession();
+          beforeMachines = Object.keys(local.machines || {}).length;
+          merged = mergeSessions(local, remote);
+          await writeSession(merged);
+        });
         // Re-render + inject into every detected tool so the pinned block
         // reflects the merged state right away across Claude/Cursor/Windsurf/Gemini
         try {

package/src/commands/session.js

@@ -24,6 +24,7 @@ import {
   getMachineId,
   paths,
 } from '../session/state.js';
+import { withSessionLock } from '../session/lock.js';
 import { renderSession } from '../session/render.js';
 import { injectInto, detectAvailableTargets } from '../session/inject.js';
 
@@ -180,9 +181,13 @@ export async function sessionShowCommand() {
 }
 
 export async function sessionClearCommand() {
-  const state = await readSession();
-  state.current = { goals: [], next_actions: [], open_questions: [], decisions: [] };
-  await writeSession(state);
+  // Took no lock at all — a concurrent MCP write between the read and the
+  // write was silently lost, and worse, could resurrect what was cleared.
+  await withSessionLock(paths.sessionLock, async () => {
+    const state = await readSession();
+    state.current = { goals: [], next_actions: [], open_questions: [], decisions: [] };
+    await writeSession(state);
+  });
   await refreshPinned();
   console.log('\n' + chalk.green('  ✓ Current session cleared.') + chalk.gray(' History retained.\n'));
 }

package/src/context/capture.js

@@ -101,7 +101,10 @@ function parseLines(lines) {
       for (const block of obj.message.content) {
         if (block.type === 'text' && block.text) {
           // Capture assistant text for decision extraction (limit size)
-          if (block.text.length < 2000) assistantTexts.push(block.text);
+          // Redacted like every other untrusted input (user :95, bash :125,
+          // errors :138) — captured decisions flow into session.json, CLAUDE.md
+          // and the git backup, none of which get a later secret scan.
+          if (block.text.length < 2000) assistantTexts.push(redactSecrets(block.text));
           continue;
         }
         if (block.type !== 'tool_use') continue;
@@ -222,7 +225,11 @@ function extractDecisions(userMessages, assistantTexts) {
     { regex: /(?:switch|migrate|move)\s+(?:from\s+\S+\s+)?to\s+([A-Z][a-zA-Z0-9_./-]+)/gi, type: 'tech' },
     // Architecture / design — require an explicit decision verb and a capitalized
     // target. Bare "pick/choose" caught conversational fragments as decisions.
-    { regex: /(?:decided|settled|going|chose|chosen)\s+(?:to\s+(?:go\s+with|use)|with|on)\s+([A-Z][\w .\/+-]{3,50}?)(?:\.|$|,|\n)/g, type: 'design' },
+    // 'going' dropped from the bare alternation: "going on Monday to the
+    // office" minted a decision (live proof: "going on PostDash" in the real
+    // store). "going to go with/use" is still covered by the to-clause.
+    { regex: /(?:decided|settled|chose|chosen)\s+(?:to\s+(?:go\s+with|use)|with|on)\s+([A-Z][\w .\/+-]{3,50}?)(?:\.|$|,|\n)/g, type: 'design' },
+    { regex: /going\s+to\s+(?:go\s+with|use)\s+([A-Z][\w .\/+-]{3,50}?)(?:\.|$|,|\n)/g, type: 'design' },
     // Stack choices — require a capitalized, tech-looking value, not a prose
     // fragment ("backend is just throwing it away" used to leak through).
     { regex: /(?:stack|framework|database|backend|frontend|hosting|infra)\s+(?:is|will be|should be)\s+([A-Z][\w .\/+-]{2,40}?)(?:\.|$|,|\n)/g, type: 'stack' },

package/src/mcp.js

@@ -283,9 +283,23 @@ server.tool(
         return { content: [{ type: 'text', text: `Project directory not found: ${projectDir}` }] };
       }
 
-      // Default to CLAUDE.md for project-level memories
-      const targetFile = filename || 'CLAUDE.md';
-      const targetPath = path.join(projectDir, targetFile);
+      // Default to CLAUDE.md for project-level memories.
+      // Guards mirror the global branch below and memoir_read above:
+      // model-supplied filename must be a bare markdown name — no
+      // separators, no traversal — and must resolve inside the project
+      // dir. Without this, filename:".zshrc" appends to a shell rc
+      // (code execution on next shell) and "package.json" corrupts
+      // real files.
+      let targetFile = filename || 'CLAUDE.md';
+      if (!targetFile.endsWith('.md')) targetFile += '.md';
+      if (targetFile.includes('/') || targetFile.includes('\\') || targetFile.includes('..')) {
+        return { content: [{ type: 'text', text: `Invalid filename: ${filename} (must be a bare .md name)` }] };
+      }
+      const projBase = path.resolve(projectDir);
+      const targetPath = path.resolve(projBase, targetFile);
+      if (!targetPath.startsWith(projBase + path.sep)) {
+        return { content: [{ type: 'text', text: `Invalid filename: ${filename}` }] };
+      }
 
       // Append to existing file or create new
       if (await fs.pathExists(targetPath)) {
@@ -394,7 +408,14 @@ server.tool(
       return { content: [{ type: 'text', text: `Unknown tool: ${tool}. Available: ${adapters.map(a => a.name).join(', ')}` }] };
     }
 
-    const fullPath = path.join(adapter.source, filepath);
+    // Containment: filepath comes from the model, and the model reads
+    // attacker-influenceable text all day. Without this, "../.ssh/id_rsa"
+    // resolves outside the adapter dir and the file is returned verbatim.
+    const base = path.resolve(adapter.source);
+    const fullPath = path.resolve(base, filepath);
+    if (fullPath !== base && !fullPath.startsWith(base + path.sep)) {
+      return { content: [{ type: 'text', text: `Invalid path: ${filepath} (must stay inside ${adapter.name}'s directory)` }] };
+    }
 
     if (!(await fs.pathExists(fullPath))) {
       return { content: [{ type: 'text', text: `File not found: ${filepath} in ${adapter.name}` }] };

package/src/providers/index.js

@@ -23,11 +23,32 @@ export async function syncToLocal(config, stagingDir, spinner) {
   await fs.ensureDir(resolvedDest);
 
   await fs.copy(stagingDir, resolvedDest);
+
+  // Prune orphaned encrypted blobs. Each encrypted push derives a fresh salt
+  // and therefore fresh HMAC filenames, so without this every push leaves the
+  // previous push's data/*.enc behind forever and localPath grows without
+  // bound. Only runs for a full encrypted sync (manifest.enc present in what
+  // we just wrote) — `memoir snapshot` also calls syncToLocal with a staging
+  // dir of a single handoff file, and blanket-emptying the destination there
+  // would delete the user's backup.
+  try {
+    const stagedManifest = path.join(stagingDir, 'manifest.enc');
+    const destData = path.join(resolvedDest, 'data');
+    if (await fs.pathExists(stagedManifest) && await fs.pathExists(destData)) {
+      const keep = new Set(await fs.readdir(path.join(stagingDir, 'data')).catch(() => []));
+      for (const f of await fs.readdir(destData)) {
+        if (!keep.has(f)) await fs.remove(path.join(destData, f)).catch(() => {});
+      }
+    }
+  } catch {
+    // Pruning is housekeeping — never fail a completed backup over it.
+  }
+
   spinner.succeed(chalk.green('Sync complete! ') + chalk.gray(`(Saved to ${resolvedDest})`));
   await appendEvent('sync_pushed', { provider: 'local' });
 }
 
-export async function syncToGit(config, stagingDir, spinner) {
+export async function syncToGit(config, stagingDir, spinner, options = {}) {
   const repoUrl = sanitizeUrl(config.gitRepo);
   if (!repoUrl) throw new Error('Git repository is not configured.');
 
@@ -39,9 +60,13 @@ export async function syncToGit(config, stagingDir, spinner) {
   try {
     try {
       execFileSync('git', ['clone', '--depth', '1', repoUrl, '.'], { cwd: gitDir, stdio: 'ignore', timeout: 60000 });
+      const preserve = new Set(options.preserve || []);
       const files = await fs.readdir(gitDir);
       for (const f of files) {
-        if (f !== '.git') await fs.remove(path.join(gitDir, f));
+        // preserve: files the caller knows exist remotely but could not
+        // merge (unreadable session.json) — deleting them here would be
+        // the mirror-clobber the push guard just declined to commit.
+        if (f !== '.git' && !preserve.has(f)) await fs.remove(path.join(gitDir, f));
       }
     } catch {
       execFileSync('git', ['init'], { cwd: gitDir, stdio: 'ignore' });
@@ -63,7 +88,10 @@ export async function syncToGit(config, stagingDir, spinner) {
     }
 
     spinner.text = `Pushing data to ${chalk.cyan(repoUrl)}...`;
-    execFileSync('git', ['push', repoUrl, 'main'], { cwd: gitDir, stdio: 'ignore', timeout: 120000 });
+    // HEAD:main pushes whatever branch the clone checked out (a master-
+    // default remote used to make `push main` fail silently under autopush
+    // with a misleading credentials error, while doctor reported green).
+    execFileSync('git', ['push', repoUrl, 'HEAD:main'], { cwd: gitDir, stdio: 'ignore', timeout: 120000 });
 
     spinner.succeed(chalk.green('Sync complete! ') + chalk.gray('(Uploaded securely to GitHub)'));
     await appendEvent('sync_pushed', { provider: 'git' });

package/src/security/scanner.js

@@ -31,7 +31,7 @@ const SECRET_PATTERNS = [
 
   // Generic secrets in env/config patterns
   { regex: /(?:^|[\s;])(?:export\s+)?(?:API_KEY|SECRET_KEY|AUTH_TOKEN|ACCESS_TOKEN|PRIVATE_KEY|DB_PASSWORD|DATABASE_URL|JWT_SECRET|ENCRYPTION_KEY|MASTER_KEY)\s*=\s*["']?([^\s'"]{8,})/gmi, label: 'Environment variable secret' },
-  { regex: /(?:password|passwd|pwd)\s*[:=]\s*["']?([^\s'"]{6,})/gi, label: 'Password' },
+  { regex: /(?:password|passwd|pwd)\s*[:=]\s*["']?([^\s'"]{6,})/gi, label: 'Password', minLength: 6 },
 
   // Private keys
   { regex: /(-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----)/g, label: 'Private key' },
@@ -55,10 +55,18 @@ export function scanForSecrets(text) {
     let match;
     while ((match = pattern.regex.exec(text)) !== null) {
       const secret = match[1] || match[0];
-      // Skip very short matches (likely false positives)
-      if (secret.length < 8) continue;
+      // Per-pattern floor. A global 8 threw away 6-7 char matches that the
+      // Password pattern ({6,}) was written to catch: `password: s3cr3t`
+      // survived verbatim into the handoff and the backup while the scan
+      // reported "no secrets detected" — a silent miss is worse than a
+      // false positive in a tool that promises redaction.
+      if (secret.length < (pattern.minLength ?? 8)) continue;
 
-      const redacted = secret.slice(0, 4) + '****' + secret.slice(-4);
+      // For short secrets, slice(0,4)+slice(-4) can reproduce the whole
+      // thing (a 6-char secret would show 4+4 of 6 characters).
+      const redacted = secret.length >= 12
+        ? secret.slice(0, 4) + '****' + secret.slice(-4)
+        : secret.slice(0, 2) + '****';
       findings.push({
         label: pattern.label,
         match: secret,

package/src/session/lock.js

@@ -68,7 +68,29 @@ export async function withSessionLock(lockPath, fn) {
       try {
         const stat = fs.statSync(lockPath);
         if (Date.now() - stat.mtimeMs > STALE_MS) {
-          try { fs.unlinkSync(lockPath); } catch {}
+          // Steal by rename, not unlink: two processes racing an unlink can
+          // both "win" and both proceed. rename() is atomic, so exactly one
+          // wins and the loser simply retries.
+          let stolen = false;
+          try {
+            const graveyard = `${lockPath}.stale-${process.pid}-${Date.now()}`;
+            fs.renameSync(lockPath, graveyard);
+            stolen = true;
+            // The rename is only there to make the steal atomic; the file
+            // itself is debris. Remove it immediately — best-effort, and
+            // harmless to leave behind if this fails.
+            try { fs.unlinkSync(graveyard); } catch {}
+          } catch {}
+          if (stolen) {
+            continue; // we removed it; retry the acquire immediately
+          }
+          // Could not remove it (read-only dir, permissions). Fall through
+          // to the deadline + backoff below instead of spinning forever.
+          if (Date.now() - start > MAX_WAIT_MS) {
+            fd = null;
+            break;
+          }
+          await sleep(RETRY_DELAY_MS);
           continue;
         }
       } catch {
@@ -95,8 +117,20 @@ export async function withSessionLock(lockPath, fn) {
     return await fn();
   } finally {
     if (fd !== null) {
+      // Only unlink if the file at lockPath is still OURS. If our lock was
+      // stolen as stale and another process now holds a NEW file at the same
+      // path, unlinking by path would delete the current holder's lock and
+      // let a third process in. Compare inode via the fd we still hold.
+      let ours = false;
+      try {
+        const byFd = fs.fstatSync(fd);
+        const byPath = fs.statSync(lockPath);
+        ours = byFd.ino === byPath.ino && byFd.dev === byPath.dev;
+      } catch {
+        ours = false; // path gone or unreadable — nothing safe to remove
+      }
       try { fs.closeSync(fd); } catch {}
-      try { fs.unlinkSync(lockPath); } catch {}
+      if (ours) { try { fs.unlinkSync(lockPath); } catch {} }
     }
   }
 }

package/src/session/state.js

@@ -389,9 +389,16 @@ function unionByText(a = [], b = [], dateField, cap) {
     }
   }
 
-  return Array.from(byText.values())
-    .sort((x, y) => new Date(y[dateField] || 0) - new Date(x[dateField] || 0))
-    .slice(0, cap);
+  // Partition before capping. Tombstones keep their original (recent) date,
+  // so a plain sort+slice let them win cap slots and silently evict real
+  // entries on merge. They must SURVIVE the merge (removing them
+  // reintroduces the resurrection the sticky-tombstone rule fixed) but must
+  // not count against the visible budget.
+  const all = Array.from(byText.values())
+    .sort((x, y) => new Date(y[dateField] || 0) - new Date(x[dateField] || 0));
+  const visible = all.filter((i) => !i.hidden).slice(0, cap);
+  const tombstones = all.filter((i) => i.hidden).slice(0, cap);
+  return [...visible, ...tombstones];
 }
 
 function unionTombstones(a = [], b = []) {