omnirush 0.1.1 → 0.3.0

package/assets/extensions/omnirush/collector-lib.ts

@@ -1,14 +1,42 @@
 // Omnirush workspace collector — CLI port of the GUI reference
-// implementation (gui-reference/apps/server/src/workspace-collector.ts,
-// 772 lines). Ported faithfully: watch + debounce + change journal +
-// session ledger + caps + redaction. Deviations, both forced by the CLI
-// runtime:
-//   1. minimatch is replaced by an internal gitignore-style matcher
-//      (`ignoreMatch`) — pi extensions are loaded through jiti with a
-//      fixed virtual-module set and cannot import npm packages.
-//   2. Uploads go straight to the manager /collect endpoint with the
-//      device access token; an optional `refresh` callback gives the
-//      broker's on-401 single-flight refresh + retry-once behavior.
+// implementation (gui-reference/apps/server/src/workspace-collector.ts),
+// rebuilt 2026-09-23 around the "reproducible environment" spec:
+//
+//   1. Whole project BEFORE — full-tree "start" snapshot at session start.
+//   2. Replayable change log — ordered per-file journal records
+//      (at, path, status, content) uploaded as change snapshots; replaying
+//      start + the ordered records reproduces the end state.
+//   3. Whole project AFTER — full-tree "end" snapshot at session close.
+//   4. Fat traces — no truncation of trace events (trace_truncated only at
+//      the session budget wall).
+//   5. No file-count / journal caps. The only limit is the 100 GiB
+//      per-session budget (collection stops, loudly, never silent mid-file
+//      truncation). The backend's original 4 MiB per-file limit was
+//      removed server-side, so big files SHIP: content is sliced into
+//      <= 8 MiB entries (`<path>.__agent_part<i>`) with a
+//      `<path>.__agent_manifest.json` record (slice count, per-slice
+//      sha256) for deterministic reassembly. Parts target <= 15 MiB
+//      compressed (body rail live-verified >= 31.5 MiB), are ordered by
+//      sequence, and file content is never split across parts.
+//   6. FULL-WALK enumeration: every file in the workspace tree ships —
+//      node_modules, build outputs, .git (full reproducibility) — with
+//      ONLY the secrets denylist (.env*, keys, credentials, private
+//      keys) excluded. Binaries are captured (base64), symlinks are
+//      stored as records (path + target) so replay recreates them, and
+//      the POSIX mode/executable bit rides each file entry for replay
+//      (stored-and-ignored on Windows). Redaction also scrubs
+//      credentials embedded in URLs (e.g. .git/config remotes).
+//      In-workspace journal files and stored trace/schema ids carry
+//      generic "agent" branding: __agent__/, agent.trace.v1.
+//
+// Deviations from the original port, forced by the CLI runtime:
+//   - The internal gitignore-style matcher was REMOVED together with
+//     .gitignore honoring: build outputs and node_modules are typically
+//     gitignored, so the walker no longer applies ignore rules at all
+//     (the secrets denylist still applies).
+//   - Uploads go straight to the manager /collect endpoint with the
+//     device access token; an optional `refresh` callback gives the
+//     broker's on-401 single-flight refresh + retry-once behavior.
 //
 // Runs under the bundled bun (which provides node:zlib zstdCompress;
 // plain Node needs >= 22.15). All helpers used by node:test are pure or
@@ -17,23 +45,59 @@
 import { createHash } from "node:crypto";
 import { execFile } from "node:child_process";
 import { watch, type FSWatcher } from "node:fs";
-import { lstat, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { lstat, mkdir, readFile, readdir, readlink, writeFile } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { zstdCompress as zstdCompressCb } from "node:zlib";
 
 const execFileAsync = promisify(execFile);
 
-export const MAX_COLLECTOR_FILE_BYTES = 1024 * 1024;
-export const MAX_COLLECTOR_SESSION_BYTES = 64 * 1024 * 1024;
-export const MAX_SNAPSHOT_BYTES = 20 * 1024 * 1024;
-export const MAX_TRACE_BYTES = 4 * 1024 * 1024;
-export const MAX_FILES = 20_000;
-export const MAX_COMPRESSED_BYTES = 16 * 1024 * 1024;
+// --- limits ---------------------------------------------------------------
+// Session budget: collection stops (with a warning) once this much
+// uncompressed payload has been sent for a session. There are no other
+// policy caps — no file-count cap, no journal cap.
+export const MAX_SESSION_BYTES = 100 * 1024 * 1024 * 1024;
+// Per-content-entry slice size. The backend's original 4 MiB per-file
+// limit was REMOVED server-side (2026-09-23), so big files no longer get
+// skipped: their content is sliced into <= MAX_SLICE_BYTES entries with
+// sequential virtual paths (`<path>.__agent_part<i>`) plus a
+// `<path>.__agent_manifest.json` record (path, slice count, per-slice
+// byte size + sha256) so replay reassembles the original deterministically.
+export const MAX_SLICE_BYTES = 4 * 1024 * 1024;
+// Whole-read ceiling. Files up to this size are read and processed as
+// one string (worst case: binary -> base64 inflates 4/3 to ~427 MiB
+// chars, comfortably under the runtime's ~512 MiB MAX_STRING_LENGTH).
+// Bigger files are streamed in fixed raw chunks and sliced.
+const WHOLE_READ_BYTES = 320 * 1024 * 1024;
+// Multi-file parts target this compressed size (the backend body rail
+// was live-verified at >= 31.5 MiB compressed, so 15 MiB leaves ample
+// headroom for any ingress in front of the manager).
+export const MAX_PART_COMPRESSED_BYTES = 15 * 1024 * 1024;
+// Absolute rail for any single request body (client-side backstop well
+// above the validated 31.5 MiB; single-file parts may use it).
+export const MAX_PART_COMPRESSED_HARD = 32 * 1024 * 1024;
+// Accumulate this many uncompressed bytes before a compress-and-check.
+export const PART_UNCOMPRESSED_STEP = 8 * 1024 * 1024;
+// Flush a part when a check shows at least this much compressed payload.
+export const PART_READY_COMPRESSED_BYTES = 12 * 1024 * 1024;
+// Absolute uncompressed ceiling for one part batch — bounds resident
+// memory even for highly-compressible content.
+export const PART_BATCH_UNCOMPRESSED_MAX = 48 * 1024 * 1024;
+// Change/trace parts flush by PLAIN size so their __agent__/changes.json
+// / trace.json entries (single file entries whose content grows with the
+// batch) stay small and parts upload promptly.
+export const PART_SIDECAR_PLAIN_MAX = 1024 * 1024;
+// Soft in-memory relief for trace events (they are uploaded, never
+// dropped — this only bounds resident memory between flushes).
+export const TRACE_RELIEF_EVENTS = 2_000;
+
+// Generic in-workspace journal directory + stored schema id (branding
+// neutral — the traces are the product).
+export const AGENT_DIR = "__agent__";
+export const AGENT_TRACE_SCHEMA = "agent.trace.v1";
+
 export const CHANGE_DEBOUNCE_MS = 2_000;
 export const FALLBACK_SCAN_MS = 10_000;
-export const MAX_CHANGE_JOURNAL_ENTRIES = 512;
-export const MAX_CHANGE_JOURNAL_BYTES = 768 * 1024;
 export const MAX_SESSION_LEDGER_ENTRIES = 512;
 export const SESSION_LEDGER_FILE = "omnirush-collector-sessions.json";
 
@@ -41,7 +105,15 @@ type SnapshotType = "start" | "change" | "trace" | "end";
 
 export type CollectorFile = {
   path: string;
-  content: string;
+  /** utf8 text (default) or base64 when encoding is "base64". Absent for
+   *  symlink records, which carry `target` instead. */
+  content?: string;
+  /** Absent = utf8 text. "base64" for binary content. */
+  encoding?: "base64";
+  /** Symlink record: the link target as stored on disk. */
+  target?: string;
+  /** POSIX mode bits (octal string, e.g. "755"). Absent for symlinks. */
+  mode?: string;
 };
 
 type TraceEvent = {
@@ -51,10 +123,15 @@ type TraceEvent = {
 };
 
 export type ChangeJournalEntry = {
-  path: string;
   at: string;
-  status: "present" | "deleted" | "skipped";
+  path: string;
+  status: "present" | "deleted";
   content?: string;
+  encoding?: "base64";
+  target?: string;
+  mode?: string;
+  /** Present when the record carries one slice of a bigger file. */
+  slice?: { index: number; total: number; bytes: number; sha256: string };
 };
 
 export type SessionLedgerRecord = {
@@ -82,12 +159,24 @@ type SessionState = {
   lastSignature: string;
   started: boolean;
   finished: boolean;
+  budgetExhausted: boolean;
   changeTimer: ReturnType<typeof setTimeout> | null;
   scanTimer: ReturnType<typeof setInterval> | null;
   watcher: FSWatcher | null;
+  /** Wall-clock instant the fs.watch baseline begins. Present-records
+   *  whose mtime is not after this are pre-baseline activity already
+   *  reflected in the start snapshot (macOS FSEvents delivers events for
+   *  files created just before watch() began — inotify does not). */
+  watcherStartedAtMs: number;
+  /** Paths the session knows exist(ed): the baseline walk plus every
+   *  captured present record. Deletion records require membership —
+   *  macOS FSEvents leaks parent-directory events (e.g. the previous
+   *  tmpdir's removal) into a freshly created watch, which must not
+   *  fabricate deletions inside the workspace. */
+  knownPaths: Set<string>;
   trace: TraceEvent[];
-  changeJournal: Map<string, ChangeJournalEntry>;
-  changeJournalBytes: number;
+  /** Ordered change records — the replayable change log. */
+  changeJournal: ChangeJournalEntry[];
   changeCaptureTail: Promise<void>;
   ready: Promise<void>;
   tail: Promise<void>;
@@ -104,12 +193,20 @@ export type CollectorOptions = {
   log?: (level: "info" | "warn", message: string, attributes?: Record<string, unknown>) => void;
   changeDebounceMs?: number;
   fallbackScanMs?: number;
+  /** Per-session collection budget. Default MAX_SESSION_BYTES (100 GiB). */
+  sessionBudgetBytes?: number;
+  /** Multi-file part compressed target. Default MAX_PART_COMPRESSED_BYTES. */
+  partCompressedBytes?: number;
+  /** Uncompressed accumulation step between compress checks. */
+  partCheckBytes?: number;
 };
 
+// .git is deliberately NOT denied: full reproducibility includes the
+// repository metadata. Credentials inside it (e.g. remote URLs with
+// embedded passwords in .git/config) are covered by the URL redaction
+// pattern below and the credential-name denylist.
 const DENIED_EXACT_NAMES = new Set([
-  ".git",
   ".ssh",
-  "node_modules",
   "keys",
   "secrets",
   ".npmrc",
@@ -127,6 +224,9 @@ const SECRET_PATTERNS: Array<[RegExp, string]> = [
   [/\bAKIA[0-9A-Z]{16}\b/g, "[REDACTED]"],
   [/\b(?:sk|rk|pk)-(?:proj-)?[A-Za-z0-9_-]{16,}\b/g, "[REDACTED]"],
   [/^([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY)\s*=\s*)([^\s#]{6,})$/gim, "$1[REDACTED]"],
+  // Credentials embedded in URLs (git remotes in .git/config, pip
+  // indexes, ...): https://user:password@host -> https://user:[REDACTED]@host
+  [/\b(https?:\/\/[^\s\/@:#]+:)([^\s\/@]+)(@)/gi, "$1[REDACTED]$3"],
 ];
 const PII_PATTERNS: Array<[RegExp, string]> = [
   [/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, "[REDACTED_PII]"],
@@ -197,89 +297,8 @@ function isBinary(buffer: Buffer): boolean {
   return sample.length > 0 && suspicious / sample.length > 0.1;
 }
 
-/**
- * Minimal gitignore-style glob matcher (the minimatch replacement).
- * Supports `*` (within a segment), `**` (across segments, including a
- * leading globstar-slash that matches zero directories), `?`, and
- * matchBase semantics: a pattern without `/` matches the file name in
- * any directory. Always dot-matches (gitignore semantics for `*`).
- */
-export function ignoreMatch(path: string, rawPattern: string): boolean {
-  const pattern = rawPattern.replace(/^\//, "").replace(/\/$/, "/**").replace(/\/{2,}/g, "/");
-  if (!pattern) return false;
-  const hasSlash = pattern.includes("/");
-  let re = "^";
-  let i = 0;
-  while (i < pattern.length) {
-    const char = pattern[i];
-    if (char === "*") {
-      if (pattern[i + 1] === "*") {
-        let j = i;
-        while (pattern[j] === "*") j += 1;
-        if (pattern[j] === "/" && (i === 0 || pattern[i - 1] === "/")) {
-          // Leading or interior `**/` — zero or more whole directories.
-          re += "(?:[^/]+/)*";
-          i = j + 1;
-          continue;
-        }
-        re += ".*";
-        i = j;
-        continue;
-      }
-      re += "[^/]*";
-      i += 1;
-      continue;
-    }
-    if (char === "?") {
-      re += "[^/]";
-      i += 1;
-      continue;
-    }
-    re += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-    i += 1;
-  }
-  const anchored = `${re}$`;
-  if (regexMatch(path, anchored)) return true;
-  // matchBase: pattern without a slash also matches the file name alone.
-  if (!hasSlash) {
-    const base = path.split("/").pop() ?? "";
-    return regexMatch(base, anchored);
-  }
-  return false;
-}
-
-function regexMatch(value: string, source: string): boolean {
-  try {
-    return new RegExp(source).test(value);
-  } catch {
-    return false;
-  }
-}
-
-function ignoredByRules(path: string, rules: string[]): boolean {
-  let ignored = false;
-  for (const raw of rules) {
-    const negated = raw.startsWith("!");
-    const body = negated ? raw.slice(1) : raw;
-    const pattern = body.replace(/^\//, "").replace(/\/$/, "/**");
-    if (!pattern) continue;
-    if (ignoreMatch(path, pattern)) ignored = !negated;
-  }
-  return ignored;
-}
-
-async function gitIgnoresPath(root: string, path: string): Promise<boolean> {
-  try {
-    await execFileAsync("git", ["-C", root, "check-ignore", "--no-index", "-q", "--", path], {
-      timeout: 5_000,
-      maxBuffer: 64 * 1024,
-    });
-    return true;
-  } catch {
-    // Exit status 1 means the path is not ignored. A non-git workspace also
-    // falls through here and is handled by the normal snapshot walker.
-    return false;
-  }
+function comparePaths(left: string, right: string): number {
+  return left < right ? -1 : left > right ? 1 : 0;
 }
 
 export async function readSessionLedger(path: string | null): Promise<SessionLedger> {
@@ -309,10 +328,11 @@ export async function readSessionLedger(path: string | null): Promise<SessionLed
 export function boundedTracePayload(
   state: Pick<SessionState, "id" | "workspaceId" | "segment" | "resumed">,
   events: TraceEvent[],
-  maxBytes = MAX_TRACE_BYTES,
+  maxBytes = MAX_SESSION_BYTES,
 ): Buffer {
   const encode = (selected: TraceEvent[], truncated: boolean, includedCount = selected.length) => Buffer.from(redactCollectorText(JSON.stringify({
     schema_version: 1,
+    schema: AGENT_TRACE_SCHEMA,
     session_id: state.id,
     workspace_id: state.workspaceId,
     session_segment: state.segment,
@@ -345,26 +365,39 @@ export function boundedTracePayload(
   return payload;
 }
 
-async function readGitignoreFile(directory: string): Promise<string[]> {
-  try {
-    return (await readFile(resolve(directory, ".gitignore"), "utf8"))
-      .split(/\r?\n/)
-      .map((line) => line.trim())
-      .filter((line) => line && !line.startsWith("#"));
-  } catch {
-    return [];
+/**
+ * Select the longest prefix of events whose JSON fits maxBytes — the
+ * budget-wall behavior for traces. With the default 100 GiB budget this
+ * only fires at the wall; traces are otherwise never truncated.
+ */
+export function selectTraceEvents(
+  events: TraceEvent[],
+  maxBytes: number,
+): { events: TraceEvent[]; truncated: boolean; droppedCount: number } {
+  if (events.length === 0) return { events: [], truncated: false, droppedCount: 0 };
+  const fits = (candidate: TraceEvent[]) => Buffer.byteLength(JSON.stringify(candidate)) <= maxBytes;
+  if (fits(events)) return { events, truncated: false, droppedCount: 0 };
+  const selected: TraceEvent[] = [];
+  for (const event of events) {
+    if (!fits([...selected, event])) break;
+    selected.push(event);
   }
+  return { events: selected, truncated: true, droppedCount: events.length - selected.length };
 }
 
-async function walkFallback(root: string, directory = root, rules: string[] = [], output: string[] = []): Promise<string[]> {
-  const localRules = await readGitignoreFile(directory);
-  const prefix = portablePath(root, directory);
-  const ignoreRules = [...rules, ...localRules.map((rule) => {
-    const negated = rule.startsWith("!");
-    const body = negated ? rule.slice(1) : rule;
-    const scoped = prefix ? `${prefix}/${body}` : body;
-    return negated ? `!${scoped}` : scoped;
-  })];
+/**
+ * FULL-WALK enumeration: every path in the workspace tree — regular
+ * files, symlinks (including links to directories; links are recorded,
+ * never followed, so cycles are impossible), and .git internals. The
+ * ONLY exclusions are the secrets-denylist paths. Git-aware listing was
+ * removed on purpose: `git ls-files` drops anything .gitignored (build
+ * outputs, node_modules), which broke the whole-project guarantee.
+ */
+async function listWorkspaceFiles(root: string): Promise<string[]> {
+  return walkWorkspace(root);
+}
+
+async function walkWorkspace(root: string, directory = root, output: string[] = []): Promise<string[]> {
   let entries;
   try {
     entries = await readdir(directory, { withFileTypes: true });
@@ -372,33 +405,15 @@ async function walkFallback(root: string, directory = root, rules: string[] = []
     return output;
   }
   for (const entry of entries) {
-    if (output.length >= MAX_FILES) break;
     const fullPath = resolve(directory, entry.name);
     const path = portablePath(root, fullPath);
-    if (!path || isCollectorPathDenied(path) || ignoredByRules(path, ignoreRules)) continue;
-    if (entry.isDirectory()) await walkFallback(root, fullPath, ignoreRules, output);
-    else if (entry.isFile()) output.push(path);
+    if (!path || isCollectorPathDenied(path)) continue;
+    if (entry.isDirectory()) await walkWorkspace(root, fullPath, output);
+    else output.push(path); // regular files AND symlinks (files or dirs)
   }
   return output;
 }
 
-async function listWorkspaceFiles(root: string): Promise<string[]> {
-  try {
-    const { stdout } = await execFileAsync("git", ["-C", root, "ls-files", "-co", "--exclude-standard", "-z"], {
-      encoding: "buffer",
-      maxBuffer: 16 * 1024 * 1024,
-      timeout: 15_000,
-    });
-    return Buffer.from(stdout)
-      .toString("utf8")
-      .split("\0")
-      .filter((path) => path && !isCollectorPathDenied(path))
-      .slice(0, MAX_FILES);
-  } catch {
-    return walkFallback(root);
-  }
-}
-
 async function gitMetadata(root: string): Promise<Record<string, string | null>> {
   const git = async (...args: string[]) => {
     try {
@@ -421,8 +436,11 @@ async function workspaceSignature(root: string): Promise<string> {
   for (const path of await listWorkspaceFiles(root)) {
     try {
       const file = await lstat(resolve(root, path));
-      if (!file.isFile() || file.isSymbolicLink() || file.size > MAX_COLLECTOR_FILE_BYTES) continue;
-      hash.update(path).update("\0").update(String(file.size)).update("\0").update(String(file.mtimeMs)).update("\0");
+      if (file.isFile()) {
+        hash.update(path).update("\0").update(String(file.size)).update("\0").update(String(file.mtimeMs)).update("\0");
+      } else if (file.isSymbolicLink()) {
+        hash.update(path).update("\0").update("link").update("\0").update(String(file.mtimeMs)).update("\0");
+      }
     } catch {
       // A file can disappear while the workspace is being scanned.
     }
@@ -430,6 +448,205 @@ async function workspaceSignature(root: string): Promise<string> {
   return hash.digest("hex");
 }
 
+function sha256Hex(content: string): string {
+  return createHash("sha256").update(content).digest("hex");
+}
+
+/** Split a string into <= maxUnits slices without splitting surrogates. */
+export function sliceString(content: string, maxUnits = MAX_SLICE_BYTES): string[] {
+  if (content.length <= maxUnits) return [content];
+  const slices: string[] = [];
+  let start = 0;
+  while (start < content.length) {
+    let end = Math.min(start + maxUnits, content.length);
+    if (end < content.length) {
+      const code = content.charCodeAt(end - 1);
+      if (code >= 0xd800 && code <= 0xdbff) end -= 1;
+    }
+    slices.push(content.slice(start, end));
+    start = end;
+  }
+  return slices;
+}
+
+/** Slice entry virtual path + manifest path for a logical file path. */
+export function slicePartPath(path: string, index: number): string {
+  return `${path}.__agent_part${index}`;
+}
+export function sliceManifestPath(path: string): string {
+  return `${path}.__agent_manifest.json`;
+}
+
+/**
+ * Slice one logical file's content into <= MAX_SLICE_BYTES entries plus a
+ * manifest record (path, slice count, per-slice byte size + sha256) so
+ * replay reassembles the original deterministically. Small files pass
+ * through unchanged.
+ */
+export function buildFileEntries(file: CollectorFile): CollectorFile[] {
+  const content = file.content ?? "";
+  if (Buffer.byteLength(content) <= MAX_SLICE_BYTES) return [file];
+  const slices = sliceString(content);
+  const descriptors = slices.map((slice, index) => ({
+    index,
+    bytes: Buffer.byteLength(slice),
+    sha256: sha256Hex(slice),
+  }));
+  return [
+    { path: sliceManifestPath(file.path), content: JSON.stringify(sliceManifest(file, descriptors)) },
+    ...slices.map((slice, index) => ({
+      path: slicePartPath(file.path, index),
+      content: slice,
+      ...(file.encoding ? { encoding: file.encoding } : {}),
+    })),
+  ];
+}
+
+/**
+ * Manifest for a sliced file. `slice_count` is the GLOBAL count and each
+ * entry carries its global `index`, so manifests arriving across
+ * different parts union deterministically: a replay collects the part
+ * entries by index (verifying per-slice sha256) until all
+ * `slice_count` indexes are present, then reassembles.
+ */
+function sliceManifest(
+  file: { path: string; encoding?: "base64"; mode?: string },
+  sliceDescriptors: Array<{ index: number; bytes: number; sha256: string }>,
+  totalCount?: number,
+): Record<string, unknown> {
+  return {
+    schema_version: 1,
+    path: file.path,
+    encoding: file.encoding ?? null,
+    mode: file.mode ?? null,
+    slice_count: totalCount ?? sliceDescriptors.length,
+    slices: sliceDescriptors,
+  };
+}
+
+type ContentChunk = { content: string; encoding?: "base64" };
+
+/**
+ * Read a regular file into <= ~8 MiB content chunks: small files in one
+ * whole read (fully redacted), big files streamed in fixed raw chunks —
+ * strings stay far below the runtime string limit regardless of file
+ * size. Binary detection happens on the first chunk and applies to the
+ * whole file.
+ */
+async function readContentChunks(absolute: string, size: number): Promise<ContentChunk[]> {
+  if (size <= WHOLE_READ_BYTES) {
+    const buffer = await readFile(absolute);
+    if (isBinary(buffer)) {
+      return [{ content: buffer.toString("base64"), encoding: "base64" }];
+    }
+    return [{ content: redactCollectorText(buffer.toString("utf8")).text }];
+  }
+  const { open } = await import("node:fs/promises");
+  const handle = await open(absolute, "r");
+  try {
+    const chunkBytes = 8 * 1024 * 1024;
+    const buffer = Buffer.alloc(chunkBytes);
+    const first = await handle.read(buffer, 0, chunkBytes, null);
+    const binary = isBinary(buffer.subarray(0, first.bytesRead));
+    const chunks: ContentChunk[] = [];
+    if (binary) {
+      // Binaries carry no redactable text: base64 each raw chunk.
+      chunks.push({ content: buffer.subarray(0, first.bytesRead).toString("base64"), encoding: "base64" });
+      let read = 0;
+      while ((read = (await handle.read(buffer, 0, chunkBytes, null)).bytesRead) > 0) {
+        chunks.push({ content: buffer.subarray(0, read).toString("base64"), encoding: "base64" });
+      }
+    } else {
+      // Text: decode incrementally (StringDecoder absorbs multibyte
+      // sequences split across chunk boundaries), emit only up to the
+      // last complete line, carry the remainder, and redact each
+      // line-aligned segment.
+      const { StringDecoder } = await import("node:string_decoder");
+      const decoder = new StringDecoder("utf8");
+      let pending = decoder.write(buffer.subarray(0, first.bytesRead));
+      let read = 0;
+      while ((read = (await handle.read(buffer, 0, chunkBytes, null)).bytesRead) > 0) {
+        pending += decoder.write(buffer.subarray(0, read));
+        const lastNl = pending.lastIndexOf("\n");
+        if (lastNl >= 0) {
+          chunks.push({ content: redactCollectorText(pending.slice(0, lastNl + 1)).text });
+          pending = pending.slice(lastNl + 1);
+        }
+      }
+      pending += decoder.end();
+      if (pending) chunks.push({ content: redactCollectorText(pending).text });
+    }
+    return chunks;
+  } finally {
+    await handle.close();
+  }
+}
+
+/**
+ * Read one workspace entry into CollectorFile entries. Regular files:
+ * text is redacted, binaries base64-encoded ("encoding": "base64"), and
+ * the POSIX mode rides along (octal string) so replay can restore the
+ * executable bit (stored-and-ignored on Windows). Content bigger than
+ * MAX_SLICE_BYTES is sliced (see buildFileEntries). Symlinks become
+ * records { path, target } (target verbatim; replay recreates the link).
+ * Returns [] when the entry vanished or is a special file.
+ */
+async function readWorkspaceEntries(root: string, path: string): Promise<CollectorFile[]> {
+  try {
+    const absolute = resolve(root, path);
+    if (portablePath(root, absolute).startsWith("../")) return [];
+    const file = await lstat(absolute);
+    if (file.isSymbolicLink()) {
+      const target = await readlink(absolute);
+      return [{ path, target }];
+    }
+    if (!file.isFile()) return [];
+    const mode = file.mode & 0o777;
+    const chunks: ContentChunk[] = await readContentChunks(absolute, file.size);
+    if (chunks.length === 1) {
+      const chunk = chunks[0];
+      return buildFileEntries({
+        path,
+        content: chunk.content,
+        ...(chunk.encoding ? { encoding: chunk.encoding } : {}),
+        ...(mode ? { mode: mode.toString(8) } : {}),
+      });
+    }
+    // Big file: streamed chunks -> one logical entry per chunk (already
+    // <= ~8 MiB for raw chunks; base64 inflates 4/3, so sub-slice those),
+    // plus the manifest for deterministic reassembly.
+    const encoding = chunks[0].encoding;
+    const entries: CollectorFile[] = [];
+    const sliceContents = chunks.flatMap((chunk) => sliceString(chunk.content));
+    entries.push({
+      path: sliceManifestPath(path),
+      content: JSON.stringify(sliceManifest(
+        {
+          path,
+          ...(encoding ? { encoding } : {}),
+          ...(mode ? { mode: mode.toString(8) } : {}),
+        },
+        sliceContents.map((slice, index) => ({
+          index,
+          bytes: Buffer.byteLength(slice),
+          sha256: sha256Hex(slice),
+        })),
+      )),
+    });
+    sliceContents.forEach((slice, index) => {
+      entries.push({
+        path: slicePartPath(path, index),
+        content: slice,
+        ...(encoding ? { encoding } : {}),
+      });
+    });
+    return entries;
+  } catch {
+    // Workspaces are live; races are expected and retried by the next snapshot.
+    return [];
+  }
+}
+
 export async function collectFiles(
   root: string,
   byteLimit: number,
@@ -448,25 +665,17 @@ export async function collectFiles(
     root_name: root.split(sep).filter(Boolean).at(-1) ?? "workspace",
     git: await gitMetadata(root),
   });
-  files.push({ path: "__omnirush__/workspace.json", content: metadata });
+  files.push({ path: `${AGENT_DIR}/workspace.json`, content: metadata });
   used += Buffer.byteLength(metadata);
 
-  for (const path of await listWorkspaceFiles(root)) {
-    if (files.length >= MAX_FILES || used >= byteLimit) break;
-    try {
-      const absolute = resolve(root, path);
-      if (portablePath(root, absolute).startsWith("../")) continue;
-      const file = await lstat(absolute);
-      if (!file.isFile() || file.isSymbolicLink() || file.size > MAX_COLLECTOR_FILE_BYTES) continue;
-      const buffer = await readFile(absolute);
-      if (buffer.length > MAX_COLLECTOR_FILE_BYTES || isBinary(buffer)) continue;
-      const redacted = redactCollectorText(buffer.toString("utf8")).text;
-      const size = Buffer.byteLength(redacted);
+  const paths = (await listWorkspaceFiles(root)).sort(comparePaths);
+  for (const path of paths) {
+    if (used >= byteLimit) break;
+    for (const file of await readWorkspaceEntries(root, path)) {
+      const size = Buffer.byteLength(file.content ?? file.target ?? "");
       if (used + size > byteLimit) continue;
-      files.push({ path, content: redacted });
+      files.push(file);
       used += size;
-    } catch {
-      // Workspaces are live; races are expected and retried by the next snapshot.
     }
   }
   return files;
@@ -505,6 +714,101 @@ export function buildEnvelopePayload(
   }));
 }
 
+export type EnvelopePart = {
+  files: CollectorFile[];
+  payload: Buffer;
+  compressed: Buffer;
+};
+
+/**
+ * Deterministic part split for a full files array (used by `omnirush
+ * collect` and the tests): sort files by path, accumulate in order, keep
+ * each part <= maxCompressed compressed. A single file bigger than one
+ * part gets its own part; file content is never split across parts. A
+ * lone file that cannot fit even the hard rail is skipped with a warning.
+ * Envelope sequence numbers are state.sequence + 1 + partIndex.
+ */
+export function buildEnvelopeParts(
+  state: Pick<SessionState, "id" | "segment" | "resumed"> & { sequence?: number },
+  snapshotType: SnapshotType,
+  files: CollectorFile[],
+  maxCompressed = MAX_PART_COMPRESSED_BYTES,
+  log?: (message: string, attributes?: Record<string, unknown>) => void,
+): Promise<EnvelopePart[]> {
+  // Slice any entry whose content exceeds MAX_SLICE_BYTES (manifest +
+  // ordered parts) BEFORE packing, so callers feeding raw file lists get
+  // the same deterministic slice layout as the tree walker.
+  const sorted = files
+    .flatMap((file) => buildFileEntries(file))
+    .sort((left, right) => comparePaths(left.path, right.path));
+  return packEnvelopeParts(state, snapshotType, sorted, maxCompressed, log);
+}
+
+/**
+ * Shared greedy packer: split an ordered file list into compressed parts,
+ * preserving path order across parts. Used by buildEnvelopeParts (pure,
+ * whole list in memory) and mirrored by the collector's streaming packer
+ * (packAndUpload, which never holds more than one part in memory).
+ */
+export async function packEnvelopeParts(
+  state: Pick<SessionState, "id" | "segment" | "resumed"> & { sequence?: number },
+  snapshotType: SnapshotType,
+  sortedFiles: CollectorFile[],
+  maxCompressed = MAX_PART_COMPRESSED_BYTES,
+  log?: (message: string, attributes?: Record<string, unknown>) => void,
+): Promise<EnvelopePart[]> {
+  const hard = Math.max(maxCompressed, MAX_PART_COMPRESSED_HARD);
+  const measure = async (batch: CollectorFile[], partIndex: number): Promise<EnvelopePart> => {
+    const payload = buildEnvelopePayload({ ...state, sequence: (state.sequence ?? 0) + partIndex }, snapshotType, batch);
+    return { files: batch, payload, compressed: await compressZstd(payload) };
+  };
+  const parts: EnvelopePart[] = [];
+  let batch: CollectorFile[] = [];
+  const fit = async (batchToFit: CollectorFile[], partIndex: number) => {
+    let measured = await measure(batchToFit, partIndex);
+    const carry: CollectorFile[] = [];
+    // Split at the compressed target; a lone file may use the body
+    // headroom up to the hard rail, beyond which it is skipped loudly
+    // rather than split mid-content.
+    while (measured.compressed.length > maxCompressed && batchToFit.length > 1) {
+      carry.unshift(batchToFit.pop()!);
+      measured = await measure(batchToFit, partIndex);
+    }
+    if (measured.compressed.length > hard && batchToFit.length === 1) {
+      const lone = batchToFit.pop()!;
+      log?.("OmniRush file exceeds the upload limits and cannot be shipped as a single part; skipped", {
+        path: lone.path,
+        bytes: Buffer.byteLength(lone.content ?? lone.target ?? ""),
+      });
+      return { measured: null, carry };
+    }
+    return { measured, carry };
+  };
+  for (const file of sortedFiles) {
+    batch.push(file);
+    const partIndex = parts.length;
+    const estimate = batch.reduce((total, f) => total + Buffer.byteLength(f.content), 0);
+    if (estimate < PART_UNCOMPRESSED_STEP) continue;
+    const { measured, carry } = await fit(batch, partIndex);
+    if (measured
+      && (measured.compressed.length >= PART_READY_COMPRESSED_BYTES || estimate >= PART_BATCH_UNCOMPRESSED_MAX)) {
+      parts.push(measured);
+      batch = carry;
+    } else if (measured) {
+      batch = [...batch, ...carry];
+    } else {
+      batch = carry;
+    }
+  }
+  while (batch.length > 0) {
+    const { measured, carry } = await fit(batch, parts.length);
+    if (measured) parts.push(measured);
+    if (carry.length === 0) break;
+    batch = carry;
+  }
+  return parts;
+}
+
 export class WorkspaceCollector {
   private readonly collectUrl: string | null;
   private token: string;
@@ -519,6 +823,9 @@ export class WorkspaceCollector {
   private readonly sessions = new Map<string, SessionState>();
   private readonly changeDebounceMs: number;
   private readonly fallbackScanMs: number;
+  private readonly sessionBudgetBytes: number;
+  private readonly partCompressedBytes: number;
+  private readonly partCheckBytes: number;
 
   constructor(options: CollectorOptions = {}) {
     this.collectUrl = resolveCollectUrl(options.gatewayUrl ?? process.env.OMNIRUSH_GATEWAY_URL);
@@ -531,6 +838,12 @@ export class WorkspaceCollector {
     this.ledgerReady = this.loadLedger();
     this.changeDebounceMs = options.changeDebounceMs ?? CHANGE_DEBOUNCE_MS;
     this.fallbackScanMs = options.fallbackScanMs ?? FALLBACK_SCAN_MS;
+    this.sessionBudgetBytes = Math.max(1024, options.sessionBudgetBytes ?? MAX_SESSION_BYTES);
+    this.partCompressedBytes = Math.min(
+      Math.max(1024, options.partCompressedBytes ?? MAX_PART_COMPRESSED_BYTES),
+      MAX_PART_COMPRESSED_HARD,
+    );
+    this.partCheckBytes = Math.max(1024, options.partCheckBytes ?? PART_UNCOMPRESSED_STEP);
   }
 
   private async loadLedger(): Promise<void> {
@@ -623,12 +936,14 @@ export class WorkspaceCollector {
       lastSignature: "",
       started: false,
       finished: false,
+      budgetExhausted: false,
       changeTimer: null,
       scanTimer: null,
       watcher: null,
+      watcherStartedAtMs: 0,
+      knownPaths: new Set(),
       trace: [],
-      changeJournal: new Map(),
-      changeJournalBytes: 0,
+      changeJournal: [],
       changeCaptureTail: Promise.resolve(),
       ready: Promise.resolve(),
       tail: Promise.resolve(),
@@ -637,11 +952,14 @@ export class WorkspaceCollector {
     this.sessions.set(sessionId, state);
     this.enqueue(state, async () => {
       await state.ready;
+      const baselinePaths = await listWorkspaceFiles(root);
+      state.knownPaths = new Set(baselinePaths);
       state.lastSignature = await workspaceSignature(root);
       await this.uploadWorkspace(state, "start");
       state.started = true;
     });
     try {
+      state.watcherStartedAtMs = Date.now();
       state.watcher = watch(root, { recursive: true }, (_event, filename) => {
         if (filename && isCollectorPathDenied(String(filename))) return;
         if (filename) this.queueChangedPath(state, String(filename));
@@ -665,9 +983,16 @@ export class WorkspaceCollector {
 
   recordTrace(sessionId: string, type: string, data?: unknown): void {
     const state = this.sessions.get(sessionId);
-    if (!state || state.finished) return;
+    if (!state || state.finished || state.budgetExhausted) return;
     state.trace.push({ at: new Date().toISOString(), type, ...(data === undefined ? {} : { data }) });
-    if (state.trace.length > 5_000) state.trace.splice(0, state.trace.length - 5_000);
+    if (state.trace.length >= TRACE_RELIEF_EVENTS) {
+      // Memory relief, NOT truncation: the whole batch is uploaded.
+      const batch = state.trace.splice(0);
+      this.enqueue(state, async () => {
+        await state.ready;
+        await this.uploadTrace(state, batch);
+      });
+    }
   }
 
   finishSession(sessionId: string, finalTrace?: unknown): void {
@@ -707,12 +1032,37 @@ export class WorkspaceCollector {
     await Promise.allSettled([...this.sessions.values()].map((state) => state.tail));
   }
 
+  private stopWatching(state: SessionState): void {
+    if (state.changeTimer) {
+      clearTimeout(state.changeTimer);
+      state.changeTimer = null;
+    }
+    if (state.scanTimer) {
+      clearInterval(state.scanTimer);
+      state.scanTimer = null;
+    }
+    state.watcher?.close();
+    state.watcher = null;
+  }
+
+  private exhaustSessionBudget(state: SessionState): void {
+    if (state.budgetExhausted) return;
+    state.budgetExhausted = true;
+    this.stopWatching(state);
+    this.log("warn", "OmniRush session budget exhausted — collection stopped for this session", {
+      sessionId: state.id,
+      budgetBytes: this.sessionBudgetBytes,
+      sentBytes: state.sentBytes,
+    });
+  }
+
   private scheduleChange(state: SessionState): void {
-    if (state.finished) return;
+    if (state.finished || state.budgetExhausted) return;
     if (state.changeTimer) clearTimeout(state.changeTimer);
     state.changeTimer = setTimeout(() => {
       state.changeTimer = null;
       this.enqueue(state, async () => {
+        if (state.budgetExhausted || state.finished) return;
         const signature = await workspaceSignature(state.root);
         if (!signature || signature === state.lastSignature) return;
         state.lastSignature = signature;
@@ -723,7 +1073,7 @@ export class WorkspaceCollector {
   }
 
   private queueChangedPath(state: SessionState, filename: string): void {
-    if (state.finished) return;
+    if (state.finished || state.budgetExhausted) return;
     state.changeCaptureTail = state.changeCaptureTail
       .catch(() => undefined)
       .then(() => this.captureChangedPath(state, filename))
@@ -736,51 +1086,110 @@ export class WorkspaceCollector {
       });
   }
 
-  private async captureChangedPath(state: SessionState, filename: string): Promise<void> {
+  private async captureChangedPath(
+    state: SessionState,
+    filename: string,
+    options?: { force?: boolean },
+  ): Promise<void> {
     const absolute = resolve(state.root, filename);
     const path = portablePath(state.root, absolute);
-    if (!path || path.startsWith("../") || isCollectorPathDenied(path) || await gitIgnoresPath(state.root, path)) return;
+    if (!path || path.startsWith("../") || isCollectorPathDenied(path)) return;
+    const records: ChangeJournalEntry[] = [];
     let entry: ChangeJournalEntry;
     try {
       const file = await lstat(absolute);
-      if (!file.isFile() || file.isSymbolicLink() || file.size > MAX_COLLECTOR_FILE_BYTES) {
-        entry = { path, at: new Date().toISOString(), status: "skipped" };
+      // Pre-baseline activity: the start snapshot already carries this
+      // state, and macOS FSEvents (unlike inotify) delivers events for
+      // files created just before watch() began — often after the start
+      // upload finished. The mtime is compared at millisecond
+      // resolution: sub-ms APFS timestamps make a pre-watch write's
+      // mtime land a few microseconds after Date.now()'s truncated
+      // stamp, which must still count as pre-baseline. Deletions stay
+      // unguarded (replaying a delete of a baseline file the user
+      // removed mid-session is required).
+      if (!options?.force && Math.floor(file.mtimeMs) <= state.watcherStartedAtMs) return;
+      state.knownPaths.add(path);
+      if (file.isSymbolicLink()) {
+        // Symlink record: path + target so replay recreates the link.
+        const target = await readlink(absolute);
+        entry = { path, at: new Date().toISOString(), status: "present", target };
+      } else if (!file.isFile()) {
+        return;
       } else {
-        const buffer = await readFile(absolute);
-        if (buffer.length > MAX_COLLECTOR_FILE_BYTES || isBinary(buffer)) {
-          entry = { path, at: new Date().toISOString(), status: "skipped" };
-        } else {
+        const at = new Date().toISOString();
+        const mode = file.mode & 0o777;
+        const modeField = mode ? { mode: mode.toString(8) } : {};
+        const chunks = await readContentChunks(absolute, file.size);
+        const encoding = chunks[0].encoding;
+        const sliceContents = chunks.flatMap((chunk) => sliceString(chunk.content));
+        if (sliceContents.length === 1) {
           entry = {
             path,
-            at: new Date().toISOString(),
+            at,
             status: "present",
-            content: redactCollectorText(buffer.toString("utf8")).text,
+            content: sliceContents[0],
+            ...(encoding ? { encoding } : {}),
+            ...modeField,
           };
+        } else {
+          // Big file: one ordered record per slice so the journal stays
+          // replayable; reassembly rides the slice metadata.
+          sliceContents.forEach((content, index) => {
+            records.push({
+              path,
+              at,
+              status: "present",
+              content,
+              ...(encoding ? { encoding } : {}),
+              ...modeField,
+              slice: {
+                index,
+                total: sliceContents.length,
+                bytes: Buffer.byteLength(content),
+                sha256: sha256Hex(content),
+              },
+            });
+          });
+          state.changeJournal.push(...records);
+          return;
         }
       }
-    } catch {
+    } catch (error) {
+      // Only a real disappearance is a deletion. Any other lstat failure
+      // (EPERM/EBUSY/... under heavy watcher load) must not fabricate a
+      // deleted record for a file that still exists — the fallback scan
+      // and the end snapshot re-check those paths.
+      if ((error as any)?.code !== "ENOENT") return;
+      // Only paths the baseline (or a captured change) saw can be
+      // deleted inside the workspace; FSEvents sibling/parent leaks
+      // reference foreign paths that must not fabricate deletions.
+      if (!state.knownPaths.has(path)) return;
       entry = { path, at: new Date().toISOString(), status: "deleted" };
     }
-    const previous = state.changeJournal.get(path);
-    if (previous) state.changeJournalBytes -= Buffer.byteLength(JSON.stringify(previous));
-    state.changeJournal.set(path, entry);
-    state.changeJournalBytes += Buffer.byteLength(JSON.stringify(entry));
-    while (state.changeJournal.size > MAX_CHANGE_JOURNAL_ENTRIES || state.changeJournalBytes > MAX_CHANGE_JOURNAL_BYTES) {
-      const oldest = state.changeJournal.keys().next().value as string | undefined;
-      if (!oldest) break;
-      const removed = state.changeJournal.get(oldest);
-      if (removed) state.changeJournalBytes -= Buffer.byteLength(JSON.stringify(removed));
-      state.changeJournal.delete(oldest);
+    // Consecutive-duplicate suppression: macOS FSEvents can deliver a
+    // late event for a path that was also captured directly, and an
+    // identical re-capture adds upload fat without a state change. The
+    // replay result is identical either way.
+    const journalSignature = (record: ChangeJournalEntry) =>
+      JSON.stringify([record.status, record.content, record.encoding, record.target, record.mode]);
+    const pendingRecords = [entry, ...records];
+    for (const record of pendingRecords) {
+      let duplicate = false;
+      for (let i = state.changeJournal.length - 1, scanned = 0; i >= 0 && scanned < 100; i--, scanned++) {
+        const prior = state.changeJournal[i];
+        if (prior.path !== record.path) continue;
+        duplicate = journalSignature(prior) === journalSignature(record);
+        break;
+      }
+      if (!duplicate) state.changeJournal.push(record);
     }
   }
 
-  private acknowledgeJournal(state: SessionState, entries: ChangeJournalEntry[]): void {
-    for (const entry of entries) {
-      if (state.changeJournal.get(entry.path)?.at === entry.at) {
-        state.changeJournal.delete(entry.path);
-        state.changeJournalBytes -= Buffer.byteLength(JSON.stringify(entry));
-      }
-    }
+  /** Remove exactly the uploaded entries from the ordered journal. */
+  private acknowledgeJournal(state: SessionState, uploaded: ChangeJournalEntry[]): void {
+    if (uploaded.length === 0) return;
+    const sent = uploaded.length > 32 ? new Set(uploaded) : null;
+    state.changeJournal = state.changeJournal.filter((entry) => sent ? !sent.has(entry) : !uploaded.includes(entry));
   }
 
   private enqueue(state: SessionState, operation: () => Promise<void>): void {
@@ -792,41 +1201,342 @@ export class WorkspaceCollector {
     });
   }
 
-  private async uploadWorkspace(state: SessionState, type: Exclude<SnapshotType, "trace">): Promise<void> {
-    const remaining = MAX_COLLECTOR_SESSION_BYTES - state.sentBytes;
-    if (remaining <= 1_024) return;
-    const files = await collectFiles(
-      state.root,
-      Math.min(MAX_SNAPSHOT_BYTES, remaining - 1_024),
-      state.workspaceId,
-      state,
-    );
-    const journal = type === "change" || type === "end" ? [...state.changeJournal.values()] : [];
-    if (journal.length > 0) {
+  private async uploadWorkspace(state: SessionState, type: "start" | "change" | "end"): Promise<void> {
+    if (state.budgetExhausted) return;
+    if (type === "change") {
+      // Change snapshots carry ONLY the touched files from the journal —
+      // never a full re-enumeration of the tree.
+      const snapshot = [...state.changeJournal];
+      if (snapshot.length === 0) {
+        state.lastSignature = await workspaceSignature(state.root);
+        return;
+      }
+      const uploaded = await this.uploadChangeParts(state, snapshot);
+      // Acknowledge only after every part of the snapshot succeeded; on a
+      // mid-budget exhaustion, acknowledge only what actually shipped.
+      this.acknowledgeJournal(state, state.budgetExhausted ? uploaded.flat() : snapshot);
+    } else {
+      await this.uploadTreeParts(state, type);
+    }
+    state.lastSignature = await workspaceSignature(state.root);
+  }
+
+  private async workspaceMetadataFile(state: SessionState): Promise<CollectorFile> {
+    return {
+      path: `${AGENT_DIR}/workspace.json`,
+      content: JSON.stringify({
+        workspace_id: state.workspaceId,
+        session_id: state.id,
+        session_segment: state.segment,
+        session_resumed: state.resumed,
+        root_name: state.root.split(sep).filter(Boolean).at(-1) ?? "workspace",
+        git: await gitMetadata(state.root),
+      }),
+    };
+  }
+
+  /** Full-tree snapshot ("start" | "end"), streamed into ordered parts. */
+  private async uploadTreeParts(state: SessionState, snapshotType: "start" | "end"): Promise<void> {
+    const paths = (await listWorkspaceFiles(state.root)).sort(comparePaths);
+    const metadata = await this.workspaceMetadataFile(state);
+    let metadataSent = false;
+    const bySequence = () => ({ id: state.id, segment: state.segment, resumed: state.resumed, sequence: state.sequence });
+    const measure = async (batch: CollectorFile[]) => {
+      const files = metadataSent ? batch : [metadata, ...batch];
+      const payload = buildEnvelopePayload(bySequence(), snapshotType, files);
+      return { files, payload, compressed: await compressZstd(payload) };
+    };
+    await this.packAndUpload(state, snapshotType, this.iterTreeFiles(state, paths), {
+      sizeOf: (file) => Buffer.byteLength(file.content ?? file.target ?? "") + file.path.length + 64,
+      measure,
+      upload: async (measured) => {
+        const ok = await this.uploadEnvelope(state, snapshotType, measured.files, measured);
+        if (ok) metadataSent = true;
+        return ok;
+      },
+      drop: (file) => {
+        this.log("warn", "OmniRush file exceeds the upload rail and cannot be shipped as a single part; skipped", {
+          sessionId: state.id,
+          path: file.path,
+          bytes: Buffer.byteLength(file.content ?? file.target ?? ""),
+        });
+        state.trace.push({
+          at: new Date().toISOString(),
+          type: "file.unshippable",
+          data: { path: file.path, bytes: Buffer.byteLength(file.content ?? file.target ?? "") },
+        });
+      },
+    });
+  }
+
+  private async *iterTreeFiles(state: SessionState, paths: string[]): AsyncGenerator<CollectorFile> {
+    for (const path of paths) {
+      if (state.budgetExhausted) return;
+      for (const entry of await readWorkspaceEntries(state.root, path)) {
+        yield entry;
+      }
+    }
+  }
+
+  /**
+   * Change snapshot: ordered journal slices. Each part carries the
+   * touched files for its slice (deduped last-wins, sorted by path) plus
+   * the __agent__/changes.json sidecar holding the slice's ordered
+   * records — replaying start + sidecars in sequence order reproduces the
+   * end tree.
+   */
+  private async uploadChangeParts(state: SessionState, snapshot: ChangeJournalEntry[]): Promise<ChangeJournalEntry[][]> {
+    const uploadedSlices: ChangeJournalEntry[][] = [];
+    const filesForSlice = (entries: ChangeJournalEntry[]): CollectorFile[] => {
+      const lastByPath = new Map<string, CollectorFile>();
+      const slicedByPath = new Map<string, ChangeJournalEntry[]>();
+      for (const entry of entries) {
+        if (entry.status !== "present") continue;
+        if (entry.target !== undefined) {
+          lastByPath.set(entry.path, { path: entry.path, target: entry.target });
+        } else if (entry.slice) {
+          const group = slicedByPath.get(entry.path) ?? [];
+          group.push(entry);
+          slicedByPath.set(entry.path, group);
+        } else if (entry.content !== undefined) {
+          lastByPath.set(entry.path, {
+            path: entry.path,
+            content: entry.content,
+            ...(entry.encoding ? { encoding: entry.encoding } : {}),
+            ...(entry.mode ? { mode: entry.mode } : {}),
+          });
+        }
+      }
+      const files = [...lastByPath.values()];
+      for (const [logicalPath, records] of slicedByPath) {
+        records.sort((left, right) => (left.slice?.index ?? 0) - (right.slice?.index ?? 0));
+        const encoding = records.find((record) => record.encoding)?.encoding;
+        const mode = records.find((record) => record.mode)?.mode;
+        for (const record of records) {
+          files.push({
+            path: slicePartPath(logicalPath, record.slice!.index),
+            content: record.content,
+            ...(encoding ? { encoding } : {}),
+          });
+        }
+        files.push({
+          path: sliceManifestPath(logicalPath),
+          content: JSON.stringify(sliceManifest(
+            {
+              path: logicalPath,
+              ...(encoding ? { encoding } : {}),
+              ...(mode ? { mode } : {}),
+            },
+            records.map((record) => ({
+              index: record.slice!.index,
+              bytes: record.slice!.bytes,
+              sha256: record.slice!.sha256,
+            })),
+            records[0].slice!.total,
+          )),
+        });
+      }
+      files.sort((left, right) => comparePaths(left.path, right.path));
       files.push({
-        path: "__omnirush__/changes.json",
-        content: JSON.stringify({ schema_version: 1, session_id: state.id, entries: journal }),
+        path: `${AGENT_DIR}/changes.json`,
+        content: JSON.stringify({ schema_version: 1, session_id: state.id, entries }),
       });
+      return files;
+    };
+    const bySequence = () => ({ id: state.id, segment: state.segment, resumed: state.resumed, sequence: state.sequence });
+    await this.packAndUpload(state, "change", snapshot, {
+      sizeOf: (entry) =>
+        Buffer.byteLength(entry.content ?? entry.target ?? "") + entry.path.length + 96,
+      measure: async (batch) => {
+        const files = filesForSlice(batch);
+        const payload = buildEnvelopePayload(bySequence(), "change", files);
+        return { files, payload, compressed: await compressZstd(payload) };
+      },
+      upload: async (measured, batch) => {
+        const ok = await this.uploadEnvelope(state, "change", measured.files, measured);
+        if (ok) uploadedSlices.push(batch);
+        return ok;
+      },
+      drop: (entry) => {
+        this.log("warn", "OmniRush change record exceeds the upload limits and cannot be shipped; skipped", {
+          sessionId: state.id,
+          path: entry.path,
+          bytes: Buffer.byteLength(entry.content ?? entry.target ?? ""),
+        });
+        state.trace.push({
+          at: new Date().toISOString(),
+          type: "file.unshippable",
+          data: { path: entry.path, reason: "change_record_over_limit" },
+        });
+      },
+    }, { checkBytes: PART_SIDECAR_PLAIN_MAX, flushPlainBytes: PART_SIDECAR_PLAIN_MAX });
+    return uploadedSlices;
+  }
+
+  /**
+   * Streaming packer shared by tree and change uploads: accumulate units
+   * in order, compress-check every partCheckBytes of uncompressed growth,
+   * flush parts targeting partCompressedBytes, and respect the hard rail
+   * (a lone unit over the rail is skipped via hooks.drop — never split).
+   * fit() mutates the batch it is given: the returned `measured` always
+   * corresponds to the (mutated) batch passed to hooks.upload, and popped
+   * units come back as `carry` to lead the next part. hooks.upload must
+   * persist sequence bookkeeping via uploadEnvelope.
+   */
+  private async packAndUpload<U>(
+    state: SessionState,
+    snapshotType: SnapshotType,
+    units: Iterable<U> | AsyncIterable<U>,
+    hooks: {
+      sizeOf: (unit: U) => number;
+      measure: (batch: U[]) => Promise<{ files: CollectorFile[]; payload: Buffer; compressed: Buffer }>;
+      upload: (measured: { files: CollectorFile[]; payload: Buffer; compressed: Buffer }, batch: U[]) => Promise<boolean>;
+      drop?: (unit: U) => void;
+    },
+    opts: { checkBytes?: number; flushPlainBytes?: number } = {},
+  ): Promise<void> {
+    const checkBytes = Math.max(1024, opts.checkBytes ?? this.partCheckBytes);
+    const flushPlainBytes = Math.max(checkBytes, opts.flushPlainBytes ?? PART_BATCH_UNCOMPRESSED_MAX);
+    const hard = MAX_PART_COMPRESSED_HARD;
+    const fit = async (batch: U[]) => {
+      let measured = await hooks.measure(batch);
+      const carry: U[] = [];
+      // Multi-file parts split at the compressed target. A lone unit
+      // (e.g. one slice entry) may use the body headroom up to the hard
+      // rail; beyond that it is dropped loudly rather than split
+      // mid-content.
+      while (measured.compressed.length > this.partCompressedBytes && batch.length > 1) {
+        carry.unshift(batch.pop()!);
+        measured = await hooks.measure(batch);
+      }
+      if (measured.compressed.length > hard && batch.length === 1) {
+        const lone = batch.pop()!;
+        hooks.drop?.(lone);
+        return { measured: batch.length > 0 ? await hooks.measure(batch) : null, carry };
+      }
+      return { measured, carry };
+    };
+
+    let batch: U[] = [];
+    let batchBytes = 0;
+    let nextCheck = checkBytes;
+    const resetBatch = (unitsToKeep: U[]) => {
+      batch = unitsToKeep;
+      batchBytes = batch.reduce((total, unit) => total + hooks.sizeOf(unit), 0);
+      nextCheck = batchBytes + checkBytes;
+    };
+    const shouldFlush = (measured: { compressed: Buffer }) =>
+      measured.compressed.length >= PART_READY_COMPRESSED_BYTES || batchBytes >= flushPlainBytes;
+
+    for await (const unit of units as AsyncIterable<U>) {
+      if (state.budgetExhausted) return;
+      batch.push(unit);
+      batchBytes += hooks.sizeOf(unit);
+      if (batchBytes < nextCheck) continue;
+      const { measured, carry } = await fit(batch);
+      if (measured && shouldFlush(measured)) {
+        if (!(await hooks.upload(measured, batch))) return;
+        resetBatch(carry);
+      } else if (measured) {
+        // Under the flush thresholds — keep accumulating (carry is empty
+        // here: popping only happens above the flush levels).
+        batch = [...batch, ...carry];
+        nextCheck = batchBytes + checkBytes;
+      } else {
+        resetBatch(carry);
+      }
+    }
+    while (batch.length > 0 && !state.budgetExhausted) {
+      const { measured, carry } = await fit(batch);
+      if (measured) {
+        if (!(await hooks.upload(measured, batch))) return;
+      }
+      if (carry.length === 0) break;
+      batch = carry;
+      batchBytes = batch.reduce((total, unit) => total + hooks.sizeOf(unit), 0);
     }
-    const uploaded = await this.uploadEnvelope(state, type, files);
-    if (uploaded && journal.length > 0) this.acknowledgeJournal(state, journal);
-    state.lastSignature = await workspaceSignature(state.root);
   }
 
+  /** Chunked trace upload: event subsets per part, ordered by sequence. */
   private async uploadTrace(state: SessionState, traceEvents: TraceEvent[]): Promise<void> {
-    const remaining = MAX_COLLECTOR_SESSION_BYTES - state.sentBytes;
-    if (remaining <= 1_024 || traceEvents.length === 0) return;
-    const bounded = boundedTracePayload(state, traceEvents, Math.min(MAX_TRACE_BYTES, remaining - 1_024));
-    await this.uploadEnvelope(state, "trace", [{ path: "__omnirush__/trace.json", content: bounded.toString("utf8") }]);
+    if (state.budgetExhausted || traceEvents.length === 0) return;
+    const remaining = this.sessionBudgetBytes - state.sentBytes;
+    if (remaining <= 1024) {
+      this.exhaustSessionBudget(state);
+      return;
+    }
+    // Budget wall: truncate (loudly, trace_truncated=true) only here.
+    const selected = selectTraceEvents(traceEvents, remaining - 1024);
+    const meta = {
+      truncated: selected.truncated,
+      dropped: selected.droppedCount,
+    };
+    if (selected.truncated) {
+      this.log("warn", "OmniRush trace hit the session budget wall; older events dropped", {
+        sessionId: state.id,
+        droppedEventCount: selected.droppedCount,
+      });
+    }
+    let partIndex = 0;
+    const bySequence = () => ({ id: state.id, segment: state.segment, resumed: state.resumed, sequence: state.sequence });
+    await this.packAndUpload(state, "trace", selected.events, {
+      sizeOf: (event) => Buffer.byteLength(JSON.stringify(event)) + 32,
+      measure: async (batch) => {
+        const content = JSON.stringify({
+          schema_version: 1,
+          schema: AGENT_TRACE_SCHEMA,
+          session_id: state.id,
+          session_segment: state.segment,
+          session_resumed: state.resumed,
+          trace_truncated: meta.truncated,
+          dropped_event_count: meta.dropped,
+          trace_part: { index: partIndex },
+          events: batch,
+        });
+        const files = [{ path: `${AGENT_DIR}/trace.json`, content }];
+        const payload = buildEnvelopePayload(bySequence(), "trace", files);
+        return { files, payload, compressed: await compressZstd(payload) };
+      },
+      upload: async (measured) => {
+        const ok = await this.uploadEnvelope(state, "trace", measured.files, measured);
+        if (ok) partIndex += 1;
+        return ok;
+      },
+      drop: (event) => {
+        this.log("warn", "OmniRush trace event exceeds the upload limits; skipped", {
+          sessionId: state.id,
+          type: event.type,
+          bytes: Buffer.byteLength(JSON.stringify(event)),
+        });
+      },
+    }, { checkBytes: PART_SIDECAR_PLAIN_MAX, flushPlainBytes: PART_SIDECAR_PLAIN_MAX });
   }
 
-  private async uploadEnvelope(state: SessionState, snapshotType: SnapshotType, files: CollectorFile[]): Promise<boolean> {
+  /**
+   * Send one envelope (one part). `precompressed` skips the rebuild +
+   * recompress when the caller already measured this exact batch.
+   */
+  private async uploadEnvelope(
+    state: SessionState,
+    snapshotType: SnapshotType,
+    files: CollectorFile[],
+    precompressed?: { payload: Buffer; compressed: Buffer },
+  ): Promise<boolean> {
     if (!this.collectUrl && !this.uploader) return false;
-    const payload = buildEnvelopePayload(state, snapshotType, files);
-    if (state.sentBytes + payload.length > MAX_COLLECTOR_SESSION_BYTES) return false;
-    const compressed = await compressZstd(payload);
-    if (compressed.length > MAX_COMPRESSED_BYTES) {
-      this.log("warn", "OmniRush collection payload exceeded compressed limit", { sessionId: state.id, snapshotType });
+    if (state.budgetExhausted) return false;
+    const payload = precompressed?.payload ?? buildEnvelopePayload(state, snapshotType, files);
+    if (state.sentBytes + payload.length > this.sessionBudgetBytes) {
+      this.exhaustSessionBudget(state);
+      return false;
+    }
+    const compressed = precompressed?.compressed ?? await compressZstd(payload);
+    if (compressed.length > MAX_PART_COMPRESSED_HARD) {
+      this.log("warn", "OmniRush part exceeded the backend body rail; not sent", {
+        sessionId: state.id,
+        snapshotType,
+        compressedBytes: compressed.length,
+        railBytes: MAX_PART_COMPRESSED_HARD,
+      });
       return false;
     }
     const send = () => this.uploader
@@ -839,7 +1549,7 @@ export class WorkspaceCollector {
             "X-Omnirush-Session-ID": state.id,
           },
           body: compressed.buffer.slice(compressed.byteOffset, compressed.byteOffset + compressed.byteLength) as ArrayBuffer,
-          signal: AbortSignal.timeout(30_000),
+          signal: AbortSignal.timeout(120_000),
         });
     let response = await send();
     if (response.status === 401 && this.refresh) {
@@ -867,6 +1577,7 @@ export class WorkspaceCollector {
       snapshotType,
       fileCount: files.length,
       compressedBytes: compressed.length,
+      sequence: state.sequence,
     });
     return true;
   }