Two correctness/security items surfaced by the #528 capability audit. Both were verified against the actual code — and notably, both turned out to be latent rather than live, which the fixes reflect honestly.

1. isSensitivePath secret-filter — drift guard (not a live bug)

snapshot.zig and watcher.zig keep duplicate copies of the secret/credential exclusion filter (snapshot persistence vs live indexing). The audit flagged "divergent logic causing coverage gaps" — but tracing every input class shows they're functionally equivalent today (watcher's first-char fast-path gate {'.','c','s','i'} covers every sensitive name; both have the .env boundary check from issue-409).

So there's no live coverage gap — but it is a real future-leak hazard in security code (edit one copy, not the other → a secret silently slips into one path). Fix: make snapshot.isSensitivePath pub and add a parity test over a ~40-path battery (.env, id_rsa, .ssh/known_hosts, keystore.jks, … and the non-secret .envoy.json/.environment edge cases) that fails CI on any drift. No runtime behavior change.

2. codedb_edit agent_id = 1 — per-session edit-lock owner (forward-looking)

handleEdit hardcoded EditRequest.agent_id = 1 (the startup __filesystem__ agent). The advisory lock is re-entrant per agent id, so multiple MCP connections sharing one process would both "win" the same file's lock and miss a concurrent edit.

On inspection this is latent, not live: stdio MCP is one connection per process, and server.zig (HTTP serve) already takes a per-client agent id from the request. So it'd only bite if a multi-connection MCP transport is added. The fix threads a distinct per-session id (Session.edit_agent_id, registered at session start) through handleCall → dispatch → handleEdit (+ the bundle recursion), removing the documented TODO. Behavior-preserving for today's single-connection path (the single client just owns a distinct registered id instead of the shared 1).

Tests / validation

• test_snapshot.zig: isSensitivePath parity battery (snapshot ≡ watcher) + explicit secret/non-secret anchors.
• test_core.zig: distinct session ids register non-1 and mutually exclude on a path (the registry's contention semantics were already covered).
• zig build and zig build test are green.

This came out of a multi-agent capability audit of codedb; the larger roadmap (callpath+PageRank from the already-computed edges, token-budget context packing, format=json, prefix/kind symbol search, git-churn ranking) is tracked separately.

🤖 Generated with Claude Code