mixdog 1.3.4 → 1.4.0

package/src/runtime/agent/orchestrator/session/sensitive-projection.mjs

@@ -0,0 +1,100 @@
+// The stored form of a message once its session has sensitive values
+// (sensitive-values.mjs): only what a message carries as text changes —
+//   - its content's text (media-normalization.mjs mapContentText: a string,
+//     text parts, a part's string content; media and attachment references
+//     stay as they are), tool results included;
+//   - its tool calls' argument values (the arguments object, or the JSON text
+//     a provider sends them as, parsed and written again).
+// Ids, roles, timestamps and every other field stay as they are. Text that is
+// a JSON document stays one: its string values are redacted inside it, a
+// number that spells a value becomes the marker string, and its keys are kept.
+// A message that changes, or whose provider replay state holds a value, is
+// stored without that state (manager/provider-replay.mjs): the state belongs
+// to the exact message the provider produced, and a provider would check it
+// against what it sent — as after a route change, the text and tool calls stay.
+import { mapContentText } from '../providers/media-normalization.mjs';
+import { providerReplayState, stripProviderReplayMessage } from './manager/provider-replay.mjs';
+import { MARKER, containsSensitive, redactSensitiveText, sensitiveValuesVersion } from './sensitive-values.mjs';
+
+function redactJsonValue(sessionId, value) {
+  if (typeof value === 'string') return redactTextOrJson(sessionId, value);
+  if (typeof value === 'number') return containsSensitive(sessionId, String(value)) ? MARKER : value;
+  if (!value || typeof value !== 'object') return value;
+  const list = Array.isArray(value);
+  const out = list ? [] : {};
+  let changed = false;
+  for (const [key, item] of Object.entries(value)) {
+    const next = redactJsonValue(sessionId, item);
+    if (next !== item) changed = true;
+    out[key] = next;
+  }
+  return changed ? out : value;
+}
+
+/** Text redacted as text, or — when it is a JSON object, array or string (RFC 8259) —
+ *  as the JSON document it is, so it still parses afterwards. */
+function redactTextOrJson(sessionId, text) {
+  // A JSON document is judged by its decoded values, never its raw text: an
+  // escape (`\u0036…`) spells a value the raw text does not contain.
+  const head = text.trimStart()[0];
+  if (head === '{' || head === '[' || head === '"') {
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      parsed = undefined;
+    }
+    if ((parsed && typeof parsed === 'object') || typeof parsed === 'string') {
+      const redacted = redactJsonValue(sessionId, parsed);
+      return redacted === parsed ? text : JSON.stringify(redacted);
+    }
+  }
+  return redactSensitiveText(sessionId, text);
+}
+
+/** Message content with the session's values redacted in its text. */
+export function redactSensitiveContent(sessionId, content) {
+  if (!sensitiveValuesVersion(sessionId)) return content;
+  return mapContentText(content, (text) => redactTextOrJson(sessionId, text));
+}
+
+/** A tool call with the session's values redacted in its argument values. */
+export function redactSensitiveToolCall(sessionId, call) {
+  if (!sensitiveValuesVersion(sessionId) || !call || typeof call !== 'object' || !('arguments' in call)) return call;
+  const args = redactJsonValue(sessionId, call.arguments);
+  return args === call.arguments ? call : { ...call, arguments: args };
+}
+
+/** `message` as it is stored for `sessionId`; the same object when unchanged. */
+export function redactSensitiveMessage(sessionId, message) {
+  if (!sensitiveValuesVersion(sessionId) || !message || typeof message !== 'object') return message;
+  const out = { ...message };
+  let changed = false;
+  if ('content' in message) {
+    out.content = redactSensitiveContent(sessionId, message.content);
+    changed = out.content !== message.content;
+  }
+  if (Array.isArray(message.toolCalls)) {
+    const calls = message.toolCalls.map((call) => redactSensitiveToolCall(sessionId, call));
+    if (calls.some((call, index) => call !== message.toolCalls[index])) {
+      out.toolCalls = calls;
+      changed = true;
+    }
+  }
+  const replay = providerReplayState(message);
+  const replayHolds = replay !== null && containsSensitive(sessionId, JSON.stringify(replay));
+  if (!changed && !replayHolds) return message;
+  return replay === null ? out : stripProviderReplayMessage(out);
+}
+
+/** Messages as they are stored for `sessionId`; the same array when unchanged. */
+export function redactSensitiveMessages(sessionId, messages) {
+  if (!sensitiveValuesVersion(sessionId) || !Array.isArray(messages)) return messages;
+  let changed = false;
+  const out = messages.map((message) => {
+    const next = redactSensitiveMessage(sessionId, message);
+    if (next !== message) changed = true;
+    return next;
+  });
+  return changed ? out : messages;
+}

package/src/runtime/agent/orchestrator/session/sensitive-values.mjs

@@ -0,0 +1,257 @@
+// Values a tool call marked sensitive — a browser `fill` with sensitive:true,
+// such as a verification code read from a mail — remembered per session and
+// replaced by a marker wherever the session's transcript is stored: the
+// session file (store/serialize.mjs), the crash-recovery checkpoint
+// (manager/turn-checkpoint-journal.mjs) and the search copy
+// (session-search/session-search-ingest.mjs), earlier records that carried
+// the value included: marking one notifies the running turn, which rewrites
+// them (manager/ask-turn-state.mjs). The live transcript the provider sees is
+// left as sent (its prefix must not change); the desktop redacts the value in
+// its own replies (browser/actions/forms.ts).
+//
+// A value stays known for the life of the process — as long as any plaintext
+// copy of it (the loaded session) can still be written — and is never
+// evicted. In text, replacement is the exact substring, longest spelling
+// first, so a shorter value never splits a longer one. Which parts of a
+// message are text is sensitive-projection.mjs's business.
+//
+// A marker is opaque to every redaction (the one written here, and the one the
+// desktop writes for a saved login, which reaches the transcript in replies):
+// a value is matched whole against the text and replaced unless that
+// occurrence lies entirely inside markers already there, so redacting twice
+// is redacting once and a value such as `e` never rewrites a marker's letters,
+// while a value that contains or spans marker text is still replaced.
+export const MARKER = '[redacted]';
+/** What the desktop writes for a Computer Use saved-login password
+ *  (apps/desktop/src/main/secret-markers.ts). */
+export const SAVED_LOGIN_MARKER = '[saved login]';
+/** Every marker a redactor writes. */
+const MARKERS = [MARKER, SAVED_LOGIN_MARKER];
+/** sessionId → { version, values: Set(value), spellings: string[] (longest first) } */
+const bySession = new Map();
+/** sessionId → Set(listener) notified synchronously when the session gains a value. */
+const listeners = new Map();
+
+function fillValues(call) {
+  let args = call?.arguments;
+  if (typeof args === 'string') {
+    try {
+      args = JSON.parse(args);
+    } catch {
+      return [];
+    }
+  }
+  if (call?.name !== 'browser' || args?.action !== 'fill') return [];
+  const input = args.input && typeof args.input === 'object' ? args.input : args;
+  if (input.sensitive !== true) return [];
+  const fields = Array.isArray(input.fields) ? input.fields : [];
+  return [input.text, ...fields.flatMap((field) => [field?.text, field?.value])].filter(
+    (value) => typeof value === 'string' && value.length > 0
+  );
+}
+
+/** Remembers the sensitive values of execution calls `calls` for `sessionId`
+ *  and, when one is new, tells the session's listeners before returning (so
+ *  before the call runs). True when the session gained a value. */
+export function rememberSensitiveValues(sessionId, calls) {
+  const values = (Array.isArray(calls) ? calls : []).flatMap(fillValues);
+  if (!sessionId || !values.length) return false;
+  const known = bySession.get(sessionId) ?? { version: 0, values: new Set(), spellings: [] };
+  const fresh = values.filter((value) => !known.values.has(value));
+  if (!fresh.length) return false;
+  const spellings = new Set(known.spellings);
+  for (const value of fresh) {
+    known.values.add(value);
+    // As typed, and as a JSON string spells it (an echo may keep arguments as JSON text).
+    spellings.add(value).add(JSON.stringify(value).slice(1, -1));
+  }
+  known.spellings = [...spellings].sort((a, b) => b.length - a.length);
+  known.version += 1;
+  bySession.set(sessionId, known);
+  for (const listener of [...(listeners.get(sessionId) || [])]) {
+    try {
+      listener(known.version);
+    } catch (error) {
+      try {
+        process.stderr.write(`[sensitive-values] listener failed session=${sessionId}: ${error?.message || error}\n`);
+      } catch {
+        // stderr may be closed; the listener failure is only reported
+      }
+    }
+  }
+  return true;
+}
+
+/** Calls `listener` whenever `sessionId` gains a sensitive value; returns the
+ *  function that stops it. */
+export function onSensitiveValuesMarked(sessionId, listener) {
+  if (!sessionId || typeof listener !== 'function') return () => {};
+  const set = listeners.get(sessionId) ?? new Set();
+  set.add(listener);
+  listeners.set(sessionId, set);
+  return () => {
+    set.delete(listener);
+    if (!set.size && listeners.get(sessionId) === set) listeners.delete(sessionId);
+  };
+}
+
+/** Changes whenever `sessionId` gains a value, so a stored copy made before
+ *  is written again in full (store/save-delta.mjs, the turn checkpoint, the
+ *  search rows). */
+export function sensitiveValuesVersion(sessionId) {
+  return bySession.get(sessionId)?.version || 0;
+}
+
+/** [start, end) of every marker in `text`, in order. */
+function markerSpans(text) {
+  const spans = [];
+  for (const marker of MARKERS) {
+    for (let at = text.indexOf(marker); at >= 0; at = text.indexOf(marker, at + marker.length)) {
+      spans.push([at, at + marker.length]);
+    }
+  }
+  return spans.sort((a, b) => a[0] - b[0]);
+}
+
+/** `text` with each occurrence of `spelling` replaced by MARKER, except one
+ *  lying entirely inside markers. An occurrence that partly overlaps a marker
+ *  replaces that marker whole, so no marker is left broken. */
+function redactSpelling(text, spelling) {
+  const spans = markerSpans(text);
+  let next = '';
+  let copied = 0;
+  for (let at = text.indexOf(spelling); at >= 0; ) {
+    const end = at + spelling.length;
+    const touched = spans.filter(([from, to]) => from < end && at < to);
+    let reach = at;
+    for (const [from, to] of touched) {
+      if (from > reach) break;
+      reach = Math.max(reach, to);
+    }
+    if (reach >= end) {
+      at = text.indexOf(spelling, at + 1);
+      continue;
+    }
+    const from = Math.min(at, touched[0]?.[0] ?? at);
+    const to = Math.max(end, touched.at(-1)?.[1] ?? end);
+    next += text.slice(copied, from) + MARKER;
+    copied = to;
+    at = text.indexOf(spelling, to);
+  }
+  return next + text.slice(copied);
+}
+
+/** `text` with every spelling (longest first) replaced by MARKER, passes
+ *  repeated until no spelling occurs outside the markers: a replacement can
+ *  join a spelling that holds marker text (`a[redacted]`) to the text before
+ *  it, so one pass is not enough. The repetition ends without a bound: every
+ *  replacement covers at least one character outside the markers and takes in
+ *  whole every marker it touches (writing one marker, which adds no character
+ *  outside), so each replacement lowers the number of characters outside the
+ *  markers and a pass that changes nothing comes after at most that many.
+ *  The result is stable: redacting it again changes nothing, and a later,
+ *  shorter spelling cannot match inside a marker an earlier one wrote. */
+function redactText(text, spellings) {
+  let out = text;
+  let before;
+  do {
+    before = out;
+    for (const spelling of spellings) out = redactSpelling(out, spelling);
+  } while (out !== before);
+  return out;
+}
+
+/** Text `text` with the session's sensitive values replaced; `text` itself
+ *  when none occurs (or it is no string). */
+export function redactSensitiveText(sessionId, text) {
+  const known = bySession.get(sessionId);
+  return known?.spellings.length && typeof text === 'string' ? redactText(text, known.spellings) : text;
+}
+
+/** Whether text `text` holds one of the session's sensitive values. */
+export function containsSensitive(sessionId, text) {
+  const known = bySession.get(sessionId);
+  return Boolean(known && typeof text === 'string' && known.spellings.some((spelling) => text.includes(spelling)));
+}
+
+/** Where the longest tail of `text` that is a proper prefix of one of
+ *  `strings` starts; the end of `text` when there is none. */
+function pendingStart(text, strings) {
+  let start = text.length;
+  for (const string of strings) {
+    for (let length = Math.min(string.length - 1, text.length); length > text.length - start; length -= 1) {
+      if (text.endsWith(string.slice(0, length))) {
+        start = text.length - length;
+        break;
+      }
+    }
+  }
+  return start;
+}
+
+/** `start`, moved left to the start of every one of `strings` that lies
+ *  across it, until none does. */
+function coverStart(text, start, strings) {
+  for (let moved = true; moved; ) {
+    moved = false;
+    for (const string of strings) {
+      for (let at = text.indexOf(string); at >= 0 && at < start; at = text.indexOf(string, at + 1)) {
+        if (start < at + string.length) {
+          start = at;
+          moved = true;
+        }
+      }
+    }
+  }
+  return start;
+}
+
+/** How much of the redacted text `out` no later text can change: the start of
+ *  the held part, `out.length` when nothing is held. Held is every part that
+ *  may still be taken into a replacement:
+ *   - the tail that starts a value (or a marker) and may yet complete it;
+ *   - the marker such a tail starts inside, which a replacement takes in whole;
+ *   - the text before the held part that would join it, once it is replaced by
+ *     a marker, into a value holding marker text, as `a` before the held part
+ *     does for `a[redacted]`; this repeats, as the joined part is held too. */
+function settledEnd(out, spellings) {
+  const spans = markerSpans(out);
+  const longest = spellings[0].length;
+  let end = pendingStart(out, [...spellings, ...MARKERS]);
+  for (let moved = true; moved; ) {
+    moved = false;
+    const marker = spans.find(([start, stop]) => start < end && end < stop);
+    if (marker) {
+      end = marker[0];
+      moved = true;
+    }
+    for (let start = Math.max(0, end - longest + 1); start < end; start += 1) {
+      const part = out.slice(start, end);
+      const joins = (spelling) =>
+        spelling.length > part.length &&
+        MARKERS.some((m) => spelling.startsWith(part + m) || (part + m).startsWith(spelling));
+      if (spellings.some(joins)) {
+        end = start;
+        moved = true;
+        break;
+      }
+    }
+  }
+  return end;
+}
+
+/** Text that is still streaming, redacted, without the part that later text
+ *  can still change: what of `text` can be journaled now
+ *  (manager/turn-checkpoint-journal.mjs). As the text grows each result starts
+ *  the next, and none shows what the finished text's redaction hides. The tail
+ *  of `text` that starts a value or a marker is cut off before redacting (a
+ *  replacement inside a half-written marker is undone when it is completed),
+ *  with every value or marker lying across the cut; settledEnd then holds
+ *  back what of the redacted rest a replacement can still reach. */
+export function redactSettledText(sessionId, text) {
+  const known = bySession.get(sessionId);
+  if (!known?.spellings.length || typeof text !== 'string') return text;
+  const pending = [...known.spellings, ...MARKERS];
+  const out = redactText(text.slice(0, coverStart(text, pendingStart(text, pending), pending)), known.spellings);
+  return out.slice(0, settledEnd(out, known.spellings));
+}

package/src/runtime/agent/orchestrator/session/side-question-store.mjs

@@ -3,6 +3,7 @@
 // side question or a compaction summary forks) and the side question in flight. It holds live
 // provider/tool objects, so it never reaches the session record or disk.
 import { isAgentOwner } from '../agent-owner.mjs';
+import { armCacheWarm, cancelCacheWarm, forgetCacheWarm, noteCacheWarmActivity } from './cache-warm.mjs';
 
 // sessionId -> { provider, model, messages, tools, opts, response }
 const requests = new Map();
@@ -42,21 +43,27 @@ export function sideQuestionRequestSnapshot({ provider, model, messages, tools,
 
 /**
  * Record a provider request the main loop is sending as the session's latest
- * one. Agent sessions record nothing (/btw is a Lead command). The handle
- * attaches the reply once the send proceeds, or puts the previous request
- * back when this one fails, so only a successfully sent request is kept.
+ * one. Agent sessions keep nothing here (/btw is a Lead command); their
+ * request only reaches the cache warmer. The handle attaches the reply once
+ * the send proceeds, or puts the previous request back when this one fails,
+ * so only a successfully sent request is kept.
  */
 export function captureSideQuestionRequest({ sessionId, sessionRef, provider, model, messages, tools, opts }) {
-  if (!sessionId || !provider || isAgentOwner(sessionRef)) return null;
+  if (!sessionId || !provider) return null;
+  const kept = !isAgentOwner(sessionRef);
   const previous = requests.get(sessionId);
   const request = sideQuestionRequestSnapshot({ provider, model, messages, tools, opts });
-  requests.set(sessionId, request);
+  if (kept) requests.set(sessionId, request);
+  // A real request is session activity: it closes the session's idle gap and
+  // replaces any cache warm (cache-warm.mjs); a settled one arms the next.
+  noteCacheWarmActivity(sessionId, request);
   return {
     settle(response) {
       request.response = response || null;
+      armCacheWarm(sessionId, request, response);
     },
     discard() {
-      if (requests.get(sessionId) !== request) return;
+      if (!kept || requests.get(sessionId) !== request) return;
       if (previous) requests.set(sessionId, previous);
       else requests.delete(sessionId);
     },
@@ -80,6 +87,7 @@ export function compactionForkRequest(sessionId) {
 export function retireCompactionFork(sessionId) {
   const request = sideQuestionRequest(sessionId);
   if (request) request.compacted = true;
+  forgetCacheWarm(sessionId);
 }
 
 /** Start the session's side question, aborting the one still in flight. */
@@ -109,5 +117,10 @@ export function cancelSideQuestion(sessionId) {
 export function forgetSideQuestion(sessionId, { cancel = false } = {}) {
   if (!sessionId) return;
   requests.delete(sessionId);
-  if (cancel) cancelSideQuestion(sessionId);
+  // Clear / rewind drop the cached prefix; a close or runtime unload (daemon
+  // shutdown) keeps its durable touch for the restart re-arm.
+  if (cancel) {
+    cancelCacheWarm(sessionId);
+    cancelSideQuestion(sessionId);
+  } else forgetCacheWarm(sessionId);
 }

package/src/runtime/agent/orchestrator/session/side-question.mjs

@@ -98,6 +98,24 @@ function nextMainRequest(sessionId) {
   });
 }
 
+/**
+ * The session's last provider request as its next turn would rebuild it from
+ * the record (a runtime restart lost the in-memory one): the next request
+ * without the reply that last request produced, stamped with the session's
+ * last send time. Null when the transcript does not end in that reply or the
+ * session has no rebuildable request (nextMainRequest).
+ */
+export function lastSentMainRequest(sessionId) {
+  const request = nextMainRequest(sessionId);
+  if (!request) return null;
+  let end = request.messages.length;
+  while (end > 0 && request.messages[end - 1]?.role === 'assistant') end -= 1;
+  if (end === 0 || end === request.messages.length) return null;
+  const sentAt = Number(request.opts.session?.lastProviderSendAt);
+  if (!(sentAt > 0)) return null;
+  return { ...request, messages: request.messages.slice(0, end), sentAt };
+}
+
 function answerText(response) {
   if (response?.toolCalls?.length) return SIDE_QUESTION_TOOL_ATTEMPT;
   const text = typeof response?.content === 'string' ? response.content.trim() : '';

package/src/runtime/agent/orchestrator/session/skill-update-notice.mjs

@@ -0,0 +1,60 @@
+// A thread can live for days while its loaded skills change underneath it (an
+// app update ships a new SKILL.md, the user edits or switches one off). Compact
+// restores every skill from its current source; between Compacts, each turn
+// tells the model once that a skill it holds instructions for changed, as a
+// new runtime message after the history, never by rewriting what was sent.
+import { createHash } from 'node:crypto';
+import { loadConfig } from '../config.mjs';
+import { collectSkillsCached, currentSkillDelivery } from '../context/collect.mjs';
+import { latestSkillBodies, skillMessageText } from '../context/skill-state.mjs';
+
+export const SKILL_UPDATE_SOURCE = 'skill-update-notice';
+
+const UNAVAILABLE = 'unavailable';
+// The loaded body is what the Skill tool delivers again (after an
+// unavailable notice): its instructions are back in force.
+const CURRENT = 'current';
+
+function skillUpdateNotice(name, version) {
+  let text = `[mixdog-runtime] Skill "${name}" was updated since it was loaded. Reload it with the Skill tool before relying on it.`;
+  if (version === UNAVAILABLE) {
+    text = `[mixdog-runtime] Skill "${name}" is no longer available in this session (switched off, removed, or outside this project's scope). Do not rely on its instructions.`;
+  } else if (version === CURRENT) {
+    text = `[mixdog-runtime] Skill "${name}" is available again, unchanged; its loaded instructions apply again.`;
+  }
+  return { role: 'user', content: text, meta: { source: SKILL_UPDATE_SOURCE, synthetic: true, skill: name, version } };
+}
+
+/**
+ * For every skill whose latest body is in `messages`, compare it with what the
+ * Skill tool would deliver at `cwd` now. Its state — the loaded body still
+ * current, a changed version, or unavailable — is announced whenever it
+ * differs from the last state told after that body (none told: current).
+ * So each transition notifies once: changed, switched off, and back again
+ * unchanged. A reload replaces the body and starts over. Returns the
+ * appended notices.
+ */
+export function appendSkillUpdateNotices(messages, cwd) {
+  const bodies = latestSkillBodies(messages);
+  if (!bodies.length) return [];
+  const config = loadConfig({ secrets: false });
+  const skills = collectSkillsCached(cwd);
+  const notices = [];
+  for (const { name, message } of bodies) {
+    const delivery = currentSkillDelivery(name, cwd, config, skills);
+    let version = UNAVAILABLE;
+    if (delivery) {
+      version =
+        skillMessageText(message.content).trimStart() === delivery.body
+          ? CURRENT
+          : createHash('sha256').update(delivery.body).digest('hex').slice(0, 16);
+    }
+    const told =
+      messages
+        .slice(messages.lastIndexOf(message) + 1)
+        .findLast((m) => m?.meta?.source === SKILL_UPDATE_SOURCE && m.meta.skill === name)?.meta.version || CURRENT;
+    if (told !== version) notices.push(skillUpdateNotice(name, version));
+  }
+  messages.push(...notices);
+  return notices;
+}

package/src/runtime/agent/orchestrator/session/store/live-state.mjs

@@ -1,4 +1,5 @@
 import { contentCarriesLiveMedia } from '../../providers/media-normalization.mjs';
+import { publishSessionPersistence } from './session-persistence-events.mjs';
 
 const _lastSaveError = new Map(); // id -> { message, at }
 
@@ -287,9 +288,11 @@ export function _recordSaveDrop(id, epoch = null) {
 export function _clearSaveStateIfCurrent(id, epoch = null) {
   if (!id) return false;
   const marked = _failureEpochs.get(id);
-  if (marked !== undefined && Number.isFinite(epoch) && epoch < marked) return false;
-  _clearSessionSaveState(id);
-  return true;
+  const cleared = !(marked !== undefined && Number.isFinite(epoch) && epoch < marked);
+  if (cleared) _clearSessionSaveState(id);
+  // A landed write put the record on disk whether or not it clears the markers.
+  publishSessionPersistence(id, 'landed');
+  return cleared;
 }
 
 /** True while this process's last save attempt for `id` failed. */

package/src/runtime/agent/orchestrator/session/store/save-delta.mjs

@@ -1,5 +1,6 @@
 import { hash } from 'node:crypto';
 import { _messagesForDisk, _sessionForDisk } from './serialize.mjs';
+import { sensitiveValuesVersion } from '../sensitive-values.mjs';
 
 // ── Delta handoff to the save worker ─────────────────────────────────────────
 // Worker.postMessage structured-clones on the CALLER's thread, so a full-
@@ -93,7 +94,7 @@ function _attemptRecord(header, refs, prints) {
  */
 export function _attemptEvidence(attempt) {
   if (!attempt) return null;
-  const messages = _messagesForDisk(attempt.refs);
+  const messages = _messagesForDisk(attempt.refs, attempt.header.id);
   for (let index = 0; index < messages.length; index += 1) {
     const print = attempt.prints[index];
     if (print === null || _messagePrint(messages[index]) !== print) return null;
@@ -112,14 +113,17 @@ function _isPureAppend(refs, live) {
 export function _buildWirePayload(id, session, forceFull = false) {
   const live = Array.isArray(session.messages) ? session.messages : [];
   const base = forceFull ? null : _deltaBaseline.get(id);
-  const resyncDue = !base || base.deltasSinceFull >= DELTA_FULL_RESYNC_EVERY;
+  // A value marked sensitive since the baseline was sent must leave the
+  // messages the worker already holds too: write the whole transcript again.
+  const sensitive = sensitiveValuesVersion(id);
+  const resyncDue = !base || base.deltasSinceFull >= DELTA_FULL_RESYNC_EVERY || base.sensitive !== sensitive;
   if (!resyncDue && _isPureAppend(base.refs, live)) {
     // Header: full disk projection with an empty message list (strips
     // transient aliases); tail: per-message projection of the appended
     // suffix only. Both use the same idempotent per-message projection
     // as a full send, so worker-side reconstruction is byte-identical.
     const header = _sessionForDisk({ ...session, messages: [] });
-    const tailMessages = _messagesForDisk(live.slice(base.refs.length));
+    const tailMessages = _messagesForDisk(live.slice(base.refs.length), id);
     // The EXACT payload the worker will reconstruct and write is the sent
     // baseline + this delta. Its evidence is fingerprint-checked against
     // what was sent, never a fresh projection of the mutable live session
@@ -127,7 +131,7 @@ export function _buildWirePayload(id, session, forceFull = false) {
     // reference-identity delta). Only the tail is fingerprinted.
     const prints = base.prints ? base.prints.concat(tailMessages.map(_messagePrint)) : null;
     const refs = live.slice();
-    _deltaBaseline.set(id, { refs, deltasSinceFull: base.deltasSinceFull + 1, prints });
+    _deltaBaseline.set(id, { refs, deltasSinceFull: base.deltasSinceFull + 1, prints, sensitive });
     return {
       delta: { baseCount: base.refs.length, header, tailMessages },
       attempt: _attemptRecord(header, refs, prints),
@@ -142,7 +146,7 @@ export function _buildWirePayload(id, session, forceFull = false) {
   // DELTA_FULL_RESYNC_EVERY saves.
   const refs = live.slice();
   const prints = _printMessages(live, diskMessages, resyncDue ? null : base);
-  _deltaBaseline.set(id, { refs, deltasSinceFull: 0, prints });
+  _deltaBaseline.set(id, { refs, deltasSinceFull: 0, prints, sensitive });
   // (saveSessionAsync normalizes `messages` to an array before any post.)
   return { session: full, attempt: _attemptRecord(full, refs, prints) };
 }

package/src/runtime/agent/orchestrator/session/store/serialize.mjs

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { renameWithRetrySync } from '../../../../shared/atomic-file.mjs';
 import { sanitizeContentForStoredHistory } from '../../providers/media-normalization.mjs';
 import { readTopLevelLifecycleRecord, isLifecycleUnreadable } from '../lifecycle-scan.mjs';
+import { redactSensitiveMessage } from '../sensitive-projection.mjs';
 
 // Inline base64 images (tool screenshots included) are written as
 // content-addressed refs, like prompt media, so session JSON stays small while
@@ -13,17 +14,17 @@ import { readTopLevelLifecycleRecord, isLifecycleUnreadable } from '../lifecycle
 // Per-message disk projection shared by _sessionForDisk and the save-worker
 // delta path (tail-only projection). Returns the SAME array reference when no
 // message changed. Idempotent: already-sanitized content passes through
-// unchanged, so projecting a projected message is a no-op.
-export function _messagesForDisk(messages) {
+// unchanged, so projecting a projected message is a no-op. A value session
+// `sessionId` marked sensitive (sensitive-values.mjs) is stored as a marker in
+// the message's text (sensitive-projection.mjs).
+export function _messagesForDisk(messages, sessionId) {
   let changed = false;
   const out = messages.map((m) => {
     if (!m || typeof m !== 'object') return m;
     const content = sanitizeContentForStoredHistory(m.content);
-    if (content !== m.content) {
-      changed = true;
-      return { ...m, content };
-    }
-    return m;
+    const projected = redactSensitiveMessage(sessionId, content === m.content ? m : { ...m, content });
+    if (projected !== m) changed = true;
+    return projected;
   });
   return changed ? out : messages;
 }
@@ -46,7 +47,7 @@ export function _sessionForDisk(session) {
       Object.hasOwn(session, 'toolApprovalHook') ||
       Object.hasOwn(session, '_providerPrefixGuardState'));
   const messages = Array.isArray(session?.messages) ? session.messages : null;
-  const out = messages?.length ? _messagesForDisk(messages) : messages;
+  const out = messages?.length ? _messagesForDisk(messages, session.id) : messages;
   if (out === messages) {
     if (!hasTransient) return session;
     return _withMidTurnContextAnchor(_withoutTransientFields(session), session);

package/src/runtime/agent/orchestrator/session/store/session-persistence-events.mjs

@@ -0,0 +1,29 @@
+/**
+ * Read-only notifications about a session's persistence lifecycle, for owners
+ * of derived sidecars (the compaction archive) that must wait for the session
+ * record instead of polling for it. A pure registry: it persists nothing and
+ * imports no write path.
+ *
+ *   'landed' — a save of the session reached disk (its record exists);
+ *   'closed' — the session was closed (no further save is to be expected).
+ *
+ * A hard delete is announced through the existing purge hooks
+ * (session-observers.mjs registerSessionPurgeHook).
+ */
+const listeners = new Set();
+
+export function subscribeSessionPersistence(listener) {
+  if (typeof listener !== 'function') return () => {};
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+
+export function publishSessionPersistence(id, event) {
+  for (const listener of [...listeners]) {
+    try {
+      listener(id, event);
+    } catch {
+      /* observers never affect persistence */
+    }
+  }
+}