fix(security): keep no-session descendants ephemeral

[sethkarten]

Summary

• keep child and grandchild runs in memory when their ancestor was started with --no-session
• prevent daemon/runtime paths from silently creating persisted sessions beneath an ephemeral parent
• document the actual autonomous-run trust boundary and practical OS/container isolation guidance

Fixes #1120.

Risk

Low to medium. The behavioral change is limited to descendants of explicitly ephemeral sessions. Normal persisted sessions continue to create persisted descendants.

Provenance

Extracted directly onto current main from #1159. Commits retain cherry picked from trailers for 4c7cdc4b6f6a7ee96e2307e0a42c3db3fe82a68f, 6446bafa5fe57421cc1660ce195fd302d9643a89, and d07e5a80db1ee704d67d029c838264699f6b4793. No MCP/provider changes are included.

Validation

• npm run check
• npm run test -- test/agent-session-recursion.test.ts — 97 passed
• npm run test -- test/suite/agent-session-runtime.test.ts — 24 passed
• npm run test -- test/daemon-mode.test.ts — 191 passed
• focused Biome check on all changed TypeScript files
• parsed docs.json
• git diff --check origin/main...HEAD

Independent review found and fixed descendant depth initialization across inline, hosted-runtime, and daemon paths; the added assertions cover child/grandchild depth while confirming no session file is created.

Review focus

Please verify the ephemeral-session inheritance across inline, runtime, and daemon paths, and that the documentation accurately distinguishes application behavior from OS-level isolation.

Note

Keep RLM descendant sessions ephemeral when parent runs with --no-session

• Previously, RLM subagent sessions could write to disk even when the root session was started with --no-session; this fix propagates non-persistence down to all descendants.
• SessionManager gains allowsPersistence() (replacing isPersisted()), an in-memory open path (openInMemoryAsync), and writeCheckpointFile() to snapshot state without changing persistence policy.
• Both inline and daemon-spawned RLM subagents now check the parent's allowsPersistence() and create an in-memory SessionManager when the parent is non-persisted.
• Update-restart (daemon) checkpoints in-memory sessions with a persistence: "memory" marker so they can be transferred and restored without ever writing a permanent session file.
• Documentation is updated to clarify that --no-session suppresses transcript/artifact persistence but is not a security sandbox.

Changes since #1251 opened

• Modified SessionManager.writeCheckpointFile to write the manager's current sessionId in the checkpoint JSONL header instead of the generated file-target sessionId, and added AgentDaemon.removeMemoryRestartCheckpoints private helper that removes session files for sessions with persistence set to memory by iterating over sessions in a DaemonUpdateRestartManifest and calling rmSync with force: true [e55871f]
• Modified AgentDaemon.cancelPreparedUpdateRestart to invoke removeMemoryRestartCheckpoints on the transaction manifest before clearing updateRestart and restoring deferred client environments when cancelling a prepared update-restart outside of the publishing phase [e55871f]
• Updated regression tests in 4257-update-restart-resume.test to call beginUpdateRestartTransaction and runUpdateRestartPreparation instead of prepareUpdateRestart, assert that checkpoint header id equals the session's id, and verify that cancelPreparedUpdateRestart removes the memory checkpoint file [e55871f]
• Added tracking and cleanup of ephemeral session checkpoint files created during update-restart preparation for non-persistent sessions [b9ab6c0]
• Added session entry migration step during in-memory session loading [b9ab6c0]
• Updated test data structures to include memory checkpoint file tracking [b9ab6c0]

^{Macroscope summarized bd7ce89.}

---

Note

Medium Risk
Behavior changes for --no-session and daemon update-restart paths; mistaken persistence inheritance could still leak transcripts, but scope is limited to explicitly ephemeral roots and is covered by new tests.

Overview
Fixes a gap where RLM child/grandchild runs could still write session JSONL and artifacts even when the root was started with --no-session. Inline, runtime-hosted, and daemon subagent creation now follow the parent’s allowsPersistence() (replacing isPersisted()) and use in-memory SessionManager instances when the ancestor is non-persisted.

SessionManager gains openInMemoryAsync, writeCheckpointFile() for one-off snapshots without flipping persistence, and constructor support for preloaded in-memory entries. Daemon update-restart writes temporary checkpoints for busy in-memory sessions, tags them with persistence: "memory", restores via noSession, and deletes those files on restore or cancel so ephemeral runs are not permanently materialized.

Docs and CLI help clarify that --no-session only skips root/RLM transcript and artifact persistence (not a sandbox), and add security.md with unattended-run isolation guidance; autonomous budgets/gates are called out as execution controls, not security boundaries.

^{Reviewed by Cursor Bugbot for commit b9ab6c0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Apocrathia]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e6da654721

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jonaowen]

The implementation propagates the parent manager’s persistence mode across all three descendant runtime paths and still initializes explicit depth for in-memory lineage. The regression gates child and grandchild managers plus absence of JSONL in both artifact directories; the documentation carefully limits the claim and discloses remaining temp/global state rather than calling --no-session a sandbox. I found no blocker at exact head e6da654721402f88c35506537f1a1d96ab5f649d.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bd7ce89. Configure here.}

[sethkarten]

@Apocrathia ready for review at b9ab6c0.