…directPath)

Allow upstream hooks (e.g. security/provenance plugins) to control
session memory behavior:
- blockSessionSave: prevent session from being persisted to memory
- sessionSaveRedirectPath: redirect session save to alternate path
- sessionSaveContent: override the saved content

[claude, human developer oversight]

When sessionSaveRedirectPath is set, write to the full redirect path
(mkdir -p + appendFile) instead of path.basename() under memoryDir.
Fixes the quarantine use case where redirected saves silently landed
in the default memory directory.

Use fs.open with mode 0o600 (owner-only) and mkdir with 0o700 for
redirect paths, matching writeFileWithinRoot's confidentiality
guarantees. Prevents session data exposure on shared hosts.

Instead of bypassing writeFileWithinRoot for redirected session saves,
shift the rootDir to the redirect target's parent directory. This
preserves path traversal protection while honoring the redirect.

writeFileWithinRoot requires rootDir to be realpath-resolvable.
When redirecting to a fresh quarantine path, the parent directory
may not exist yet. Create it before calling writeFileWithinRoot.

- Resolve relative redirect paths against workspaceDir
- Reject paths outside workspace with log warning, fall back to normal memory dir
- 2 new tests: relative path resolution + workspace escape rejection
- Total: 21 tests (16 existing + 5 new)

…t check

path.normalize() doesn't resolve symlinks — a symlink inside workspace
could point outside it. Now uses fs.realpath() on the parent directory
to get the true filesystem path before checking containment.

… custom content

1. Two-pass validation: textual containment check BEFORE mkdir,
   then symlink resolution after. Prevents creating directories
   outside workspace on invalid redirect paths.

2. Skip transcript loading and LLM slug generation when
   sessionSaveContent is set. Prevents leaking raw session
   text to the model provider in redaction workflows.

Stop doing manual path validation (normalize, realpath, startsWith).
Instead, use writeFileWithinRoot with workspaceDir as root for ALL
writes. It handles path traversal, symlink resolution, containment,
and mkdir internally. Invalid redirect paths fall back to memory dir.

This is the canonical pattern used throughout the codebase (fs-safe.ts)
and handles all edge cases: symlinks, relative paths, path alias
escapes, and workspace-as-symlink.

…rors only

Operational I/O failures (ENOSPC, EACCES on a valid quarantine path) now
fail closed instead of silently falling back to the default memory dir,
which could bypass security policy intent in deployments using
sessionSaveRedirectPath.

…verride

An empty string is a valid redaction signal — hooks may intentionally set
sessionSaveContent to '' to persist a blank marker while avoiding transcript
retention. Previously this was treated as unset due to the length > 0 check.