sessionmem 1.2.0 → 1.4.0

package/dist/cli/index.js

@@ -30,7 +30,7 @@ import { browseCommand } from "./commands/browse.js";
 // "../../package.json" specifier resolves to the package root.
 const pkg = createRequire(import.meta.url)("../../package.json");
 const program = new Command();
-program.name("sessionmem").version(pkg.version);
+program.name("sessionmem").description("Local-first memory for MCP coding agents").version(pkg.version);
 program
     .command("run")
     .description("Start the sessionmem MCP server")
@@ -74,15 +74,15 @@ program
 program
     .command("search <query>")
     .description("Search memories by semantic query")
-    .option("--limit <n>", "Maximum number of results", "10")
+    .option("--limit <n>", "Maximum number of results (1-100)", "10")
     .action((query, options) => searchCommand(query, options));
 program
     .command("list")
-    .description("List all memories for the current project")
+    .description("List up to 200 recent memories for the current project")
     .action(() => listCommand());
 program
     .command("show <id>")
-    .description("Show full details of a memory by ID")
+    .description("Show memory details by ID (content capped at 2000 characters)")
     .action((id) => showCommand(id));
 program
     .command("forget <id>")
@@ -96,7 +96,7 @@ program
 program
     .command("import <path>")
     .description("Import memories from a JSON file")
-    .option("--merge", "Overwrite existing memories with imported data")
+    .option("--merge", "Merge new records; existing IDs are preserved")
     .action((path, options) => importCommand(path, options));
 program
     .command("stats")
@@ -126,8 +126,6 @@ retention
     .option("--days <n>", "Override the retention window in days")
     .action((options) => retentionPruneCommand(options));
 // config command group — generic get/set over ~/.sessionmem/config.json.
-// config get/set are synchronous and take no CliContext, so the arrow-wrap here
-// only drops commander's trailing Command argument.
 const config = program
     .command("config")
     .description("Read and write sessionmem policy config");
@@ -140,10 +138,6 @@ config
     .description("Persist a config key to ~/.sessionmem/config.json")
     .action((key, value) => configSetCommand(key, value));
 // team command group — turn shared-memory mode on/off and inspect it.
-// enable/status take no CliContext (config-only), so their arrow-wraps just drop
-// commander's trailing Command argument. disable accepts an optional CliContext
-// seam for the --remove-team-memories DB delete; the arrow-wrap forwards only
-// options so production falls through to createCliContext() (NOTE above).
 const team = program
     .command("team")
     .description("Manage shared-path team memory mode");
@@ -161,15 +155,12 @@ team
     .description("Show team mode state and shared-path availability")
     .action(() => teamStatusCommand());
 // re-embed — bulk-update stale embeddings to the current version.
-// reEmbedCommand declares a trailing `ctx?` test seam, so arrow-wrap to drop
-// commander's trailing Command argument (NOTE above).
 program
     .command("re-embed")
     .description("Re-embed all memories with stale embedding versions")
     .action(() => reEmbedCommand());
-// sync — push a local snapshot to the shared path and pull every
-// teammate snapshot back. syncCommand declares a trailing `ctx?` test seam, so
-// arrow-wrap to drop commander's trailing Command argument (NOTE above).
+// sync — push a local snapshot to the shared path and pull every teammate
+// snapshot back.
 program
     .command("sync")
     .description("Push local memories and pull teammate memories via the shared path")
@@ -180,7 +171,7 @@ program
     .command("dedupe")
     .description("Find and optionally remove near-duplicate memories")
     .option("--apply", "Delete the lower-importance duplicate in each pair (default: dry-run)")
-    .option("--threshold <n>", "Cosine similarity threshold 0-1 (default: 0.85)")
+    .option("--threshold <n>", "Cosine similarity threshold >0 to 1 (default: 0.85)")
     .action((options) => dedupeCommand({ dry: !options.apply, threshold: options.threshold }));
 // browse — cross-project memory viewer.
 program

package/dist/cli/projectId.js

@@ -1,4 +1,43 @@
 import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+/** Safety bound on the upward walk in {@link findProjectRoot}. */
+const MAX_PARENT_WALK = 64;
+/**
+ * Walk up from `startDir` to the nearest directory containing `.git`, and
+ * return it. Returns null when there is no repository above `startDir`.
+ *
+ * Memory is keyed by project, and a project is the repository — not whichever
+ * directory a command happened to run in. Hashing the raw cwd meant every
+ * subdirectory got its OWN bucket: the Claude Code hooks fire at the repo root
+ * and write there, then `sessionmem stats` run from `src/` reported an empty
+ * store, because it was reading a different project entirely.
+ *
+ * `.git` is matched as a path entry rather than a directory so linked worktrees
+ * and submodules (where `.git` is a FILE pointing at the real gitdir) anchor
+ * correctly too.
+ */
+export function findProjectRoot(startDir) {
+    let current = resolve(startDir);
+    for (let depth = 0; depth < MAX_PARENT_WALK; depth += 1) {
+        try {
+            // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
+            if (existsSync(join(current, ".git"))) {
+                return current;
+            }
+        }
+        catch {
+            // Unreadable directory (permissions, race): stop rather than throw — the
+            // caller falls back to the cwd-derived id.
+            return null;
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            break; // filesystem root
+        current = parent;
+    }
+    return null;
+}
 /**
  * Sanitize a raw token to the filename-safe character set used across
  * sessionmem (mirrors localUsername). Any character outside [A-Za-z0-9._-]
@@ -45,7 +84,13 @@ export function projectIdFromCwd(cwd) {
 /**
  * Resolve the effective project id: the `SESSIONMEM_PROJECT_ID` env override
  * (operator-controlled test/migration seam; also lets a user pin a legacy
- * basename-only id) wins, otherwise derive from `process.cwd()`.
+ * basename-only id) wins, otherwise derive from the enclosing repository root,
+ * falling back to `process.cwd()` when the cwd is not inside a repository.
+ *
+ * Anchoring to the repository keeps every command — hooks firing at the root,
+ * a `sessionmem stats` typed three directories down — on the same memory
+ * bucket. The id is unchanged for anyone already running at the repo root,
+ * since the root IS the cwd in that case.
  */
 export function deriveProjectId() {
     const envProjectId = process.env.SESSIONMEM_PROJECT_ID;
@@ -65,5 +110,6 @@ export function deriveProjectId() {
             return sanitized;
         }
     }
-    return projectIdFromCwd(process.cwd());
+    const cwd = process.cwd();
+    return projectIdFromCwd(findProjectRoot(cwd) ?? cwd);
 }

package/dist/core/api/contracts.js

@@ -65,7 +65,12 @@ export const memorySchema = z.object({
 });
 export const ingestSessionEventSchema = z.object({
     id: z.string().min(1).max(200),
-    eventIndex: z.number().int().nonnegative(),
+    // Optional: callers that already track an ordering key (batch ingestion of a
+    // transcript) supply it; callers that fire one event at a time from separate
+    // processes (the PostToolUse hook) omit it and the service assigns the next
+    // free index per session. See nextSessionEventIndex for why inventing a
+    // wall-clock index silently loses events.
+    eventIndex: z.number().int().nonnegative().optional(),
     eventType: z.string().min(1).max(100),
     payloadJson: z
         .string()

package/dist/core/api/memoryCoreService.js

@@ -8,7 +8,7 @@ import { applyRedaction } from "../summarize/redaction.js";
 import { countAllMemoriesByProject, countMemoriesBySession, countMemoriesOlderThan, deleteMemoriesOlderThan, deleteMemoryById, getMemoryOwnerProjectId, getMemoryRecordById, incrementAccessCounts, insertMemory, listMemoriesByProject, resetAccessCounts, updateMemoryContent, upsertImportedMemory, upsertPulledMemory, upsertSessionSummaryMemory, } from "../storage/memoryRepo.js";
 import { SESSION_WRITE_SOFT_LIMIT, configFilePath, DEEP_MODE_RETRIEVAL_CAP, readPolicyConfig, resolvePolicySettings, } from "../config/policyConfig.js";
 import { insertMemoryFeedbackEvent } from "../storage/memoryFeedbackRepo.js";
-import { countAllSessionEvents, insertSessionEvent } from "../storage/sessionEventsRepo.js";
+import { countAllSessionEvents, insertSessionEvent, nextSessionEventIndex, } from "../storage/sessionEventsRepo.js";
 import { batchStoreMemoryItemSchema, batchStoreMemoryRequestSchema, exportMemoriesRequestSchema, forgetMemoryRequestSchema, getMemoryRequestSchema, handleSessionEndRequestSchema, importMemoriesRequestSchema, pullMemoriesRequestSchema, ingestSessionEventsRequestSchema, LIST_MEMORIES_DEFAULT_LIMIT, listMemoriesRequestSchema, pruneMemoriesRequestSchema, redactExistingRequestSchema, resetAccessCountsRequestSchema, retrieveMemoriesRequestSchema, statsRequestSchema, storeMemoryRequestSchema, summarizeSessionToMemoryRequestSchema, } from "./contracts.js";
 import { DomainError, toErrorEnvelope } from "./errors.js";
 import { assertLocalOnlyPolicy, } from "./localOnlyPolicy.js";
@@ -186,15 +186,25 @@ export function createMemoryCoreService(deps) {
             const redactionEnabled = resolveRedactionEnabled(undefined);
             const ingest = db.transaction(() => {
                 let written = 0;
+                // Events that omit eventIndex are appended after the session's current
+                // maximum. Read it once inside the transaction and increment locally so
+                // a multi-event batch stays contiguous.
+                let nextIndex;
                 for (const event of parsed.events) {
                     const redactedPayload = applyRedaction(event.payloadJson, {
                         redactionEnabled,
                     }).text;
+                    let eventIndex = event.eventIndex;
+                    if (eventIndex === undefined) {
+                        nextIndex ??= nextSessionEventIndex(db, parsed.projectId, parsed.sessionId);
+                        eventIndex = nextIndex;
+                        nextIndex += 1;
+                    }
                     written += insertSessionEvent(db, {
                         id: event.id,
                         project_id: parsed.projectId,
                         session_id: parsed.sessionId,
-                        event_index: event.eventIndex,
+                        event_index: eventIndex,
                         event_type: event.eventType,
                         payload_json: redactedPayload,
                         created_at: event.createdAt,
@@ -202,7 +212,11 @@ export function createMemoryCoreService(deps) {
                 }
                 return written;
             });
-            const ingested = ingest();
+            // `immediate` takes the write lock up front so two concurrent hook
+            // processes cannot both read the same next index and have one insert
+            // silently ignored. busy_timeout (db.ts) makes the loser wait rather
+            // than fail.
+            const ingested = ingest.immediate();
             return {
                 ok: true,
                 ingested,

package/dist/core/config/policyConfig.js

@@ -88,7 +88,11 @@ export function readPolicyConfig(filePath) {
     let obj;
     try {
         raw = readFileSync(filePath, "utf8");
-        obj = JSON.parse(raw);
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            return { ...DEFAULT_POLICY_CONFIG };
+        }
+        obj = parsed;
     }
     catch {
         return { ...DEFAULT_POLICY_CONFIG };

package/dist/core/injection/tokenBudget.js

@@ -10,8 +10,16 @@ export function capTokens(text, cap) {
     if (tokens.length <= cap) {
         return text;
     }
-    const trimmed = encoding.decode(tokens.slice(0, cap)).trimEnd();
-    return `${trimmed} ...`;
+    // Reserve room for the truncation marker, then verify the re-encoded text:
+    // token boundaries can change when a decoded prefix and suffix are joined.
+    const suffix = " ...";
+    for (let keep = Math.max(0, Math.floor(cap) - countTokens(suffix)); keep >= 0; keep--) {
+        const trimmed = encoding.decode(tokens.slice(0, keep)).trimEnd();
+        const result = trimmed ? `${trimmed}${suffix}` : suffix.trim();
+        if (countTokens(result) <= cap)
+            return result;
+    }
+    return "";
 }
 export function trimLowestPriorityContent(included, options = {}) {
     const minContentTokens = options.minContentTokens ?? DEFAULT_MIN_CONTENT_TOKENS;

package/dist/core/retrieve/retrieveMemories.js

@@ -43,7 +43,7 @@ export function retrieveMemories(input) {
     const now = input.now ?? new Date();
     // Use FTS5 pre-filtering to limit cosine similarity computation to ~50 candidates.
     // queryText is guaranteed non-empty by the Zod schema (z.string().min(1)) upstream.
-    const candidates = searchMemoryCandidatesFTS(input.db, input.projectId, queryText);
+    const candidates = searchMemoryCandidatesFTS(input.db, input.projectId, queryText, now);
     const decayedCandidates = decayOldBoosts(candidates, now);
     const dimension = resolveEmbeddingDimension(candidates);
     const queryVector = deterministicEmbed(queryText, dimension).vector;

package/dist/core/schema/runMigrations.js

@@ -57,18 +57,19 @@ export function runMigrations(db, migrationsDir = DEFAULT_MIGRATIONS_DIR) {
     const hasMigrationStmt = db.prepare("SELECT name FROM _migrations WHERE name = ? LIMIT 1");
     const insertMigrationStmt = db.prepare("INSERT INTO _migrations(name) VALUES (?)");
     const runMigration = db.transaction((fileName) => {
+        if (hasMigrationStmt.get(fileName))
+            return;
         const filePath = path.join(migrationsDir, fileName);
         const sql = fs.readFileSync(filePath, "utf8");
         db.exec(sql);
         insertMigrationStmt.run(fileName);
     });
     for (const fileName of files) {
-        const existing = hasMigrationStmt.get(fileName);
-        if (existing) {
+        if (hasMigrationStmt.get(fileName))
             continue;
-        }
         try {
-            runMigration(fileName);
+            // Serialize the check and apply across processes opening the same DB.
+            runMigration.immediate(fileName);
         }
         catch (err) {
             // Idempotency guard for ALTER TABLE ADD COLUMN migrations (005/006).
@@ -90,7 +91,10 @@ export function runMigrations(db, migrationsDir = DEFAULT_MIGRATIONS_DIR) {
                 const filePath = path.join(migrationsDir, fileName);
                 const sql = fs.readFileSync(filePath, "utf8");
                 if (allAddedColumnsExist(db, sql)) {
-                    insertMigrationStmt.run(fileName);
+                    db.transaction(() => {
+                        if (!hasMigrationStmt.get(fileName))
+                            insertMigrationStmt.run(fileName);
+                    }).immediate();
                     continue;
                 }
             }

package/dist/core/storage/db.js

@@ -2,13 +2,35 @@ import BetterSqlite3 from "better-sqlite3";
 import { runMigrations } from "../schema/runMigrations.js";
 export function openDb(options = {}) {
     const db = new BetterSqlite3(options.dbPath ?? ":memory:");
-    // Performance pragmas — WAL enables concurrent reads during writes;
-    // busy_timeout prevents SQLITE_BUSY under concurrent MCP tool calls.
-    db.pragma("journal_mode = WAL");
-    db.pragma("synchronous = NORMAL");
-    db.pragma("foreign_keys = ON");
-    db.pragma("busy_timeout = 5000");
-    db.pragma("cache_size = -32000");
-    runMigrations(db, options.migrationsDir);
-    return db;
+    try {
+        // Performance pragmas — WAL enables concurrent reads during writes;
+        // busy_timeout prevents SQLITE_BUSY under concurrent MCP tool calls.
+        // Concurrent first opens can race while switching to WAL. SQLite may
+        // bypass the busy handler for this lock upgrade, so retry within the same
+        // five-second budget used for normal writes.
+        const deadline = Date.now() + 5000;
+        const pause = new Int32Array(new SharedArrayBuffer(4));
+        for (;;) {
+            try {
+                db.pragma("journal_mode = WAL");
+                break;
+            }
+            catch (err) {
+                if (!(err instanceof Error) || !("code" in err) || err.code !== "SQLITE_BUSY" || Date.now() >= deadline) {
+                    throw err;
+                }
+                Atomics.wait(pause, 0, 0, 10);
+            }
+        }
+        db.pragma("synchronous = NORMAL");
+        db.pragma("foreign_keys = ON");
+        db.pragma("busy_timeout = 5000");
+        db.pragma("cache_size = -32000");
+        runMigrations(db, options.migrationsDir);
+        return db;
+    }
+    catch (err) {
+        db.close();
+        throw err;
+    }
 }

package/dist/core/storage/memoryRepo.js

@@ -107,7 +107,7 @@ function getStatements(db) {
     FROM memories
     WHERE project_id = ?
       AND (expires_at IS NULL OR expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
-    ORDER BY updated_at DESC
+    ORDER BY updated_at DESC, id ASC
   `),
         // Lightweight projection for token-savings accounting: only `content` is
         // needed to count tokens, so we deliberately avoid pulling the (potentially

package/dist/core/storage/memorySearchRepo.js

@@ -1,23 +1,36 @@
 import { EMBEDDING_VERSION } from "../embed/embeddingVersion.js";
 const FTS_CANDIDATE_LIMIT = 50;
 const FTS_FALLBACK_THRESHOLD = 5;
+/** Recency window for the fallback candidate scan. */
+const FALLBACK_RECENCY_DAYS = 90;
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+/** Storage timestamp format: ISO-8601 UTC with millisecond precision. */
+function toStorageTimestamp(date) {
+    return date.toISOString();
+}
 const searchStmtCache = new WeakMap();
 function getSearchStatements(db) {
     let stmts = searchStmtCache.get(db);
     if (stmts)
         return stmts;
     stmts = {
+        // `now` and the recency cutoff are bound parameters rather than
+        // strftime('now') so the caller's clock drives both filters. With SQL's own
+        // clock, a caller that passes an explicit `now` (retrieveMemories, and every
+        // test that pins a date) silently got a different window than it asked for,
+        // and fixed-date fixtures aged out of the 90-day band over real calendar
+        // time — turning deterministic tests into time bombs.
         searchCandidates: db.prepare(`
     SELECT
       id, project_id, session_id, source_adapter, kind, content, normalized_content,
       importance, author, origin_project_id, access_count, created_at, updated_at,
       embedding, embedding_dim, embedding_version
     FROM memories
-    WHERE project_id = ?
-      AND (expires_at IS NULL OR expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+    WHERE project_id = @projectId
+      AND (expires_at IS NULL OR expires_at > @now)
       AND (
         importance >= 8
-        OR updated_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-90 days')
+        OR updated_at > @recencyCutoff
       )
   `),
         searchCandidatesFTS: db.prepare(`
@@ -28,11 +41,11 @@ function getSearchStatements(db) {
       m.embedding, m.embedding_dim, m.embedding_version
     FROM memories_fts
     JOIN memories m ON m.rowid = memories_fts.rowid
-    WHERE memories_fts MATCH ?
-      AND m.project_id = ?
-      AND (m.expires_at IS NULL OR m.expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+    WHERE memories_fts MATCH @match
+      AND m.project_id = @projectId
+      AND (m.expires_at IS NULL OR m.expires_at > @now)
     ORDER BY rank
-    LIMIT ?
+    LIMIT @limit
   `),
     };
     searchStmtCache.set(db, stmts);
@@ -74,8 +87,12 @@ function mapRows(rows) {
         };
     });
 }
-export function searchMemoryCandidates(db, projectId) {
-    const rows = getSearchStatements(db).searchCandidates.all(projectId);
+export function searchMemoryCandidates(db, projectId, now = new Date()) {
+    const rows = getSearchStatements(db).searchCandidates.all({
+        projectId,
+        now: toStorageTimestamp(now),
+        recencyCutoff: toStorageTimestamp(new Date(now.getTime() - FALLBACK_RECENCY_DAYS * MS_PER_DAY)),
+    });
     return mapRows(rows);
 }
 /**
@@ -107,23 +124,28 @@ function sanitizeFtsQuery(queryText) {
  * (<8) — exactly the rows the fallback's filter excludes — returning zero
  * candidates for a query that matched only such rows.
  */
-export function searchMemoryCandidatesFTS(db, projectId, queryText) {
+export function searchMemoryCandidatesFTS(db, projectId, queryText, now = new Date()) {
     const sanitized = sanitizeFtsQuery(queryText);
     if (!sanitized) {
-        return searchMemoryCandidates(db, projectId);
+        return searchMemoryCandidates(db, projectId, now);
     }
     let rows;
     try {
-        rows = getSearchStatements(db).searchCandidatesFTS.all(sanitized, projectId, FTS_CANDIDATE_LIMIT);
+        rows = getSearchStatements(db).searchCandidatesFTS.all({
+            match: sanitized,
+            projectId,
+            now: toStorageTimestamp(now),
+            limit: FTS_CANDIDATE_LIMIT,
+        });
     }
     catch {
         // FTS5 MATCH can throw on malformed queries — fall back to full scan
-        return searchMemoryCandidates(db, projectId);
+        return searchMemoryCandidates(db, projectId, now);
     }
     if (rows.length >= FTS_FALLBACK_THRESHOLD) {
         return dedupById(mapRows(rows));
     }
-    const fallback = searchMemoryCandidates(db, projectId);
+    const fallback = searchMemoryCandidates(db, projectId, now);
     if (rows.length === 0) {
         return fallback;
     }

package/dist/core/storage/sessionEventsRepo.js

@@ -22,6 +22,11 @@ function getSessionEventsStatements(db) {
     ORDER BY event_index ASC
   `),
         countAll: db.prepare("SELECT COUNT(*) AS count FROM session_events WHERE project_id = ?"),
+        nextEventIndex: db.prepare(`
+    SELECT COALESCE(MAX(event_index), -1) + 1 AS next
+    FROM session_events
+    WHERE project_id = ? AND session_id = ?
+  `),
     };
     sessionEventsStmtCache.set(db, stmts);
     return stmts;
@@ -34,6 +39,22 @@ function getSessionEventsStatements(db) {
 export function insertSessionEvent(db, input) {
     return getSessionEventsStatements(db).insertEvent.run(input).changes;
 }
+/**
+ * Next free `event_index` for a session (max + 1, or 0 when the session has no
+ * events yet).
+ *
+ * Callers that have no natural ordering key of their own (the PostToolUse hook
+ * fires once per tool use, in separate processes) use this instead of inventing
+ * one. A wall-clock index collides whenever two tool uses land in the same
+ * millisecond — which parallel tool calls routinely do — and the UNIQUE index
+ * on (project_id, session_id, event_index) then makes `INSERT OR IGNORE` drop
+ * the loser silently. Must be called inside the same immediate transaction as
+ * the insert so concurrent writers cannot read the same value.
+ */
+export function nextSessionEventIndex(db, projectId, sessionId) {
+    const row = getSessionEventsStatements(db).nextEventIndex.get(projectId, sessionId);
+    return row.next;
+}
 export function countAllSessionEvents(db, projectId) {
     const row = getSessionEventsStatements(db).countAll.get(projectId);
     return row.count;

package/dist/core/summarize/cloudSummarizer.js

@@ -1,4 +1,5 @@
 import Anthropic from "@anthropic-ai/sdk";
+import { capTokens } from "../injection/tokenBudget.js";
 import { summarizeLocalSessionEvents } from "./localSummarizer.js";
 import { DEFAULT_SUMMARIZER_MODEL } from "../config/policyConfig.js";
 const CLOUD_SYSTEM_PROMPT = "You are a memory compressor for AI coding sessions. Given this session transcript summary, produce a compact, high-signal list of facts, decisions, and context that should be remembered. Be extremely concise.";
@@ -26,7 +27,7 @@ export async function summarizeWithCloud(input) {
         messages: [{ role: "user", content: localResult.summary }],
     });
     // Extract text from response content blocks
-    let text = response.content
+    const text = response.content
         .filter((block) => block.type === "text")
         .map((block) => block.text)
         .join("\n");
@@ -35,14 +36,8 @@ export async function summarizeWithCloud(input) {
     if (!text || text.trim().length === 0) {
         throw new Error("Cloud summarizer returned empty response");
     }
-    // Cap cloud output to summaryTokenCap (rough token→char ratio) for parity
-    // with the local summarizer, so a verbose cloud response cannot blow past the
-    // configured budget.
-    if (input.summaryTokenCap && text.length > input.summaryTokenCap * 4) {
-        text = text.slice(0, input.summaryTokenCap * 4);
-    }
     return {
-        summary: text,
+        summary: capTokens(text, input.summaryTokenCap),
         warningCodes: localResult.warningCodes,
     };
 }

package/dist/core/summarize/redaction.js

@@ -9,6 +9,43 @@
 // applyRedaction invocation — a measurable saving in batch/import/pull loops.
 // The regex literals carry no `lastIndex` state because every pattern is used
 // with String.prototype.replace (not stateful .test()/.exec() on a shared regex).
+/**
+ * Key names that mark an assignment's value as a secret. Matched
+ * case-insensitively and allowed to carry bounded affixes on either side, so
+ * `AWS_SECRET_ACCESS_KEY` and `SECRET_TOKEN_VALUE` match as readily as `secret`.
+ */
+const SECRET_KEY_NAMES = [
+    "password",
+    "passwd",
+    "pwd",
+    "secret",
+    "api[_-]?key",
+    "apikey",
+    "access[_-]?token",
+    "refresh[_-]?token",
+    "auth[_-]?token",
+    "client[_-]?secret",
+    "private[_-]?key",
+    "credentials?",
+    "token",
+].join("|");
+/**
+ * `<key><separator><value>` where the key names a secret. Capture groups are
+ * (key, separator, value) so the replacement can keep the key and separator
+ * verbatim and swap only the value.
+ *
+ * Both `:` and `=` are accepted (YAML, JSON, `.env`, query strings, log lines),
+ * and the value may be backslash-escaped-quoted, double-quoted, single-quoted,
+ * or bare. Every quantifier is bounded, so the pattern is ReDoS-safe.
+ *
+ * The escaped-quote branch comes first and the bare branch excludes `\`, which
+ * together keep a JSON payload parseable after redaction. Session events store
+ * JSON, so a secret inside a stringified field arrives as `password=\"a b\"`;
+ * letting the bare branch match the lone backslash replaced it with
+ * `[REDACTED]` and left the rest of the quoted run stranded, producing
+ * unparseable JSON.
+ */
+const SECRET_ASSIGNMENT_PATTERN = new RegExp(String.raw `\b([A-Za-z0-9_.-]{0,40}(?:${SECRET_KEY_NAMES})[A-Za-z0-9_.-]{0,40}\\?"?)(\s*[:=]\s*)(\\"(?:\\.|[^"\\]){0,4096}\\"|"[^"\n]{1,4096}"|'[^'\n]{1,4096}'|[^\s"'\\,;&}]{1,4096})`, "gi");
 const DEFAULT_RULES = createDefaultRules();
 function createDefaultRules() {
     return [
@@ -49,16 +86,39 @@ function createDefaultRules() {
         (input) => input.replace(/\bsk-(?:[a-zA-Z0-9]{1,32}-){0,4}[a-zA-Z0-9]{12,200}\b/g, "[REDACTED_API_KEY]"),
         // Bearer token header value: "Bearer <token>" (case-insensitive), token redacted.
         (input) => input.replace(/\bBearer\s+[A-Za-z0-9._~+/-]{8,}=*/gi, "Bearer [REDACTED_BEARER_TOKEN]"),
-        // Config/connection-string assignments: key=value where key is a known
-        // secret-bearing name. The key is kept and the value redacted. Covers
-        // password/secret plus api_key/apikey/token/access_token/pwd in URL query
-        // strings and config files. The `=` separator may carry surrounding spaces.
-        (input) => input.replace(/\b(password|passwd|pwd|secret|api[_-]?key|access[_-]?token|token)\s*=\s*([^\s"'&;]+)/gi, "$1=[REDACTED]"),
-        // JSON-form secret assignments: "key": "value" for known secret-bearing
-        // keys. Complements the key=value rule above so secrets embedded in JSON
-        // payloads (config files, logged request bodies) are redacted too. The key
-        // is preserved; the quoted value is collapsed.
-        (input) => input.replace(/"(password|secret|api_key|token|access_token|auth_token|client_secret|private_key|pwd|passwd)"\s*:\s*"[^"]{4,}"/gi, '"$1": "[REDACTED]"'),
+        // HTTP Basic auth header: the base64 blob encodes user:password verbatim.
+        (input) => input.replace(/\bBasic\s+[A-Za-z0-9+/]{12,}={0,2}/g, "Basic [REDACTED_BASIC_AUTH]"),
+        // Slack incoming-webhook URLs — the path IS the credential, so the whole
+        // path is collapsed rather than a token-shaped substring of it.
+        (input) => input.replace(/https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/_-]{10,200}/g, "https://hooks.slack.com/services/[REDACTED_SLACK_WEBHOOK]"),
+        // Secret-bearing assignments: `<key><sep><value>` for a known secret-ish key
+        // name, covering config files, .env exports, YAML, JSON bodies, log lines
+        // and URL query strings in one rule.
+        //
+        // Three things the narrower predecessors missed, each a real leak:
+        //  - `:` as a separator (YAML, JSON, `Header: value` log lines). Only `=`
+        //    was handled, so `aws_secret_access_key: wJalr…` passed through.
+        //  - Affixed key names. The keyword had to sit on a \b boundary, and `_` is
+        //    a word character, so `AWS_SECRET_ACCESS_KEY` and `SECRET_TOKEN_VALUE`
+        //    never matched. Allow bounded affixes on both sides.
+        //  - Quoted values. The value class excluded quotes, so `password="a b c"`
+        //    matched nothing at all.
+        //
+        // Quoted values keep their delimiters so a redacted JSON payload stays
+        // parseable. All quantifiers are bounded and the alternation is
+        // non-backtracking on failure, so the rule stays ReDoS-safe.
+        (input) => input.replace(SECRET_ASSIGNMENT_PATTERN, (_match, key, separator, value) => {
+            // Preserve the value's quote style so a redacted JSON payload stays
+            // parseable and a redacted YAML line stays well-formed.
+            const quote = value.startsWith('\\"')
+                ? '\\"'
+                : value.startsWith('"')
+                    ? '"'
+                    : value.startsWith("'")
+                        ? "'"
+                        : "";
+            return `${key}${separator}${quote}[REDACTED]${quote}`;
+        }),
     ];
 }
 export function applyRedaction(input, options) {