From bd165f50fd1730dac15b94c4583e94bd40cc8af0 Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 07:56:34 +0000
Subject: [PATCH 01/18] feat(sessionTapes): serve session tapes to the desktop
 app in a read-only replay mode

XUM_REPLAY_TAPES maps workspace ids to tapes; onChat for a mapped workspace is
served from the tape (desktop only, after the renderer egress block), and the
whole process refuses sends, history changes and provider model creation.
Includes the #5587 read-side fixes and the Start Here refusal dialog.

Signed-off-by: Thomas Kosiewski <tk@coder.com>
---
 .../StartHereModal/StartHereModal.tsx         |  15 +-
 .../features/Messages/StreamErrorMessage.tsx  |  14 ++
 src/browser/hooks/useStartHere.ts             |   6 +-
 src/browser/stores/WorkspaceStore.ts          |  37 +++-
 .../applyWorkspaceChatEventToAggregator.ts    |  11 +-
 src/common/orpc/schemas/errors.ts             |   1 +
 src/common/types/global.d.ts                  |   3 +
 src/common/utils/messages/retryEligibility.ts |   4 +-
 .../utils/sessionTapes/sessionTapeLoader.ts   |  10 +-
 .../utils/sessionTapes/sessionTapeReplay.ts   |  46 ++++-
 src/desktop/main.ts                           |  34 +++-
 src/desktop/preload.ts                        |   2 +
 src/desktop/sessionTapeReplayEgress.ts        |  86 +++++++++
 src/desktop/terminalWindowManager.ts          |   2 +
 src/node/orpc/routerSubscriptions.ts          |  14 ++
 src/node/services/evaluationModelFactory.ts   |   8 +
 src/node/services/providerModelFactory.ts     |  16 ++
 .../services/sessionTapes/sessionTapeFile.ts  |  18 +-
 .../sessionTapes/sessionTapeRecorder.ts       |  25 ++-
 .../sessionTapes/sessionTapeReplaySource.ts   | 180 ++++++++++++++++++
 src/node/services/workspaceService.ts         |  33 ++++
 tests/ui/chat/startHere.test.ts               |  76 +++++++-
 22 files changed, 609 insertions(+), 32 deletions(-)
 create mode 100644 src/desktop/sessionTapeReplayEgress.ts
 create mode 100644 src/node/services/sessionTapes/sessionTapeReplaySource.ts

diff --git a/src/browser/components/StartHereModal/StartHereModal.tsx b/src/browser/components/StartHereModal/StartHereModal.tsx
index 69f565ed222..f4ebc41733a 100644
--- a/src/browser/components/StartHereModal/StartHereModal.tsx
+++ b/src/browser/components/StartHereModal/StartHereModal.tsx
@@ -10,6 +10,7 @@ import {
 import { Button } from "@/browser/components/Button/Button";
 import { stopKeyboardPropagation } from "@/browser/utils/events";
 import { isEditableElement, KEYBINDS, matchesKeybind } from "@/browser/utils/ui/keybinds";
+import { getErrorMessage } from "@/common/utils/errors";
 
 interface StartHereModalProps {
   isOpen: boolean;
@@ -30,9 +31,12 @@ export const StartHereModal: React.FC<StartHereModalProps> = ({
   confirmDisabled = false,
 }) => {
   const [isExecuting, setIsExecuting] = useState(false);
+  // Why the last confirmation was refused; shown until the next attempt or cancel.
+  const [error, setError] = useState<string | undefined>(undefined);
 
   const handleCancel = useCallback(() => {
     if (!isExecuting) {
+      setError(undefined);
       onClose();
     }
   }, [isExecuting, onClose]);
@@ -40,11 +44,13 @@ export const StartHereModal: React.FC<StartHereModalProps> = ({
   const handleConfirm = useCallback(async () => {
     if (isExecuting || confirmDisabled) return;
     setIsExecuting(true);
+    setError(undefined);
     try {
       await onConfirm();
       onClose();
-    } catch (error) {
-      console.error("Start Here error:", error);
+    } catch (confirmError) {
+      setError(getErrorMessage(confirmError));
+    } finally {
       setIsExecuting(false);
     }
   }, [isExecuting, confirmDisabled, onConfirm, onClose]);
@@ -88,6 +94,11 @@ export const StartHereModal: React.FC<StartHereModalProps> = ({
             This will start a new context from this message and preserve earlier chat history.
           </DialogDescription>
         </DialogHeader>
+        {error && (
+          <div role="alert" className="bg-error-bg text-error rounded p-2 px-3 text-[13px]">
+            {error}
+          </div>
+        )}
         <DialogFooter className="justify-center">
           <Button variant="secondary" onClick={handleCancel} disabled={isExecuting}>
             Cancel
diff --git a/src/browser/features/Messages/StreamErrorMessage.tsx b/src/browser/features/Messages/StreamErrorMessage.tsx
index 15840ff8227..ab1f8ea86b2 100644
--- a/src/browser/features/Messages/StreamErrorMessage.tsx
+++ b/src/browser/features/Messages/StreamErrorMessage.tsx
@@ -57,6 +57,20 @@ const StreamErrorMessageBase: React.FC<StreamErrorMessageBaseProps> = (props) =>
     </Tooltip>
   );
 
+  // Perf harness (XUM_REPLAY_TAPES): the backend refused to replay this workspace's tape. No
+  // model or stream was involved, so no error pill and no LLM request debug action.
+  if (message.errorType === "session_tape_replay") {
+    return (
+      <div className={cn("bg-error-bg border border-error rounded px-5 py-4 my-3", className)}>
+        <div className="font-primary text-error mb-2 flex items-center gap-2 text-[13px] font-semibold">
+          <AlertTriangle aria-hidden="true" className="h-4 w-4" />
+          <span>Session tape replay refused</span>
+        </div>
+        <div className="text-foreground/80 text-[13px] leading-relaxed">{message.error}</div>
+      </div>
+    );
+  }
+
   // Runtime unavailable gets a distinct, friendlier presentation.
   // This is a permanent failure (container/runtime doesn't exist), not a transient stream error.
   // The backend sends "Container unavailable..." for Docker or "Runtime unavailable..." for others.
diff --git a/src/browser/hooks/useStartHere.ts b/src/browser/hooks/useStartHere.ts
index c696650271e..d7df41d19c5 100644
--- a/src/browser/hooks/useStartHere.ts
+++ b/src/browser/hooks/useStartHere.ts
@@ -76,11 +76,11 @@ export function useStartHere(
         deletePlanFile: options?.deletePlanFile,
       });
 
+      // Thrown, not logged: the modal keeps itself open and shows the reason (for example a
+      // workspace replaying a session tape refuses history changes).
       if (!result.success) {
-        console.error("Failed to start here:", result.error);
+        throw new Error(String(result.error));
       }
-    } catch (err) {
-      console.error("Start here error:", err);
     } finally {
       setIsStartingHere(false);
     }
diff --git a/src/browser/stores/WorkspaceStore.ts b/src/browser/stores/WorkspaceStore.ts
index fbc90ad49c0..9e1a75c318f 100644
--- a/src/browser/stores/WorkspaceStore.ts
+++ b/src/browser/stores/WorkspaceStore.ts
@@ -21,7 +21,10 @@ import type { TodoItem } from "@/common/types/tools";
 import type { AssistedReviewHunk } from "@/common/types/review";
 import type { WorkflowRunRecord } from "@/common/types/workflow";
 import type { TimelineEvent, TimelineSubscriptionEvent } from "@/common/orpc/schemas/timeline";
-import { applyWorkspaceChatEventToAggregator } from "@/browser/utils/messages/applyWorkspaceChatEventToAggregator";
+import {
+  applyWorkspaceChatEventToAggregator,
+  isSessionTapeReplayRenderer,
+} from "@/browser/utils/messages/applyWorkspaceChatEventToAggregator";
 import {
   StreamingMessageAggregator,
   type LoadedSkill,
@@ -37,6 +40,7 @@ import {
   type ResponseCompleteHandler,
 } from "@/browser/utils/messages/responseCompletionMetadata";
 import { isAbortError } from "@/browser/utils/isAbortError";
+import { isSessionTapeReplayRefusal } from "@/common/utils/sessionTapes/sessionTapeReplay";
 import {
   SUBSCRIPTION_RETRY_BASE_MS,
   calculateSubscriptionBackoffMs,
@@ -1176,8 +1180,10 @@ export class WorkspaceStore {
       this.consumerManager.scheduleCalculation(workspaceId, aggregator);
 
       // Track file-modifying tools for ReviewPanel diff refresh.
+      // Not for a replayed session tape (perf harness): its tools never ran here.
       const shouldTriggerReviewPanelRefresh =
-        toolCallEnd.toolName.startsWith("file_edit_") || toolCallEnd.toolName === "bash";
+        (toolCallEnd.toolName.startsWith("file_edit_") || toolCallEnd.toolName === "bash") &&
+        !isSessionTapeReplayRenderer();
 
       if (shouldTriggerReviewPanelRefresh) {
         this.fileModifyingToolMs.set(workspaceId, Date.now());
@@ -4465,6 +4471,12 @@ export class WorkspaceStore {
             console.warn(
               "[WorkspaceStore] onChat subscription aborted for " + workspaceId + "; retrying..."
             );
+        } else if (isSessionTapeReplayRefusal(error)) {
+          // Perf harness (XUM_REPLAY_TAPES): this workspace is mapped to a tape the backend
+          // cannot serve. Retrying cannot help and there is no live fallback: show the refusal
+          // and stop the loop.
+          this.showSessionTapeReplayRefusal(workspaceId, error.message);
+          return true;
         } else if (isIteratorValidationFailed(error)) {
           if (!this.isWorkspaceRegistered(workspaceId)) return true;
           console.error(
@@ -4518,6 +4530,27 @@ export class WorkspaceStore {
     }
   }
 
+  /**
+   * End hydration for a workspace whose session tape replay was refused and show the reason as
+   * an error row. The onChat loop stops (no attempt-finished hook runs), so this also clears the
+   * attempt's buffers and opens the replay gate. History stays unverified, so the send barrier
+   * stays closed.
+   */
+  private showSessionTapeReplayRefusal(workspaceId: string, message: string): void {
+    if (!this.isWorkspaceRegistered(workspaceId)) return;
+    this.clearReplayBuffers(workspaceId);
+    this.chatReplayPendingWorkspaces.delete(workspaceId);
+    const transient = this.chatTransientState.get(workspaceId);
+    if (transient) transient.isHydratingTranscript = false;
+    this.assertGet(workspaceId).handleStreamError({
+      type: "stream-error",
+      messageId: "session-tape-replay-refused",
+      error: message,
+      errorType: "session_tape_replay",
+    });
+    this.states.bump(workspaceId);
+  }
+
   /**
    * Register a workspace and initialize local state.
    */
diff --git a/src/browser/utils/messages/applyWorkspaceChatEventToAggregator.ts b/src/browser/utils/messages/applyWorkspaceChatEventToAggregator.ts
index c659926419b..47f943b678e 100644
--- a/src/browser/utils/messages/applyWorkspaceChatEventToAggregator.ts
+++ b/src/browser/utils/messages/applyWorkspaceChatEventToAggregator.ts
@@ -91,6 +91,15 @@ export interface WorkspaceChatEventAggregator {
   clearTokenState(messageId: string): void;
 }
 
+/**
+ * Desktop perf harness (XUM_REPLAY_TAPES, exposed by preload): chat events come from a recorded
+ * session tape, so they must not trigger app side effects (gateway dialogs, skill refreshes,
+ * child-goal toasts, git/review refreshes).
+ */
+export function isSessionTapeReplayRenderer(): boolean {
+  return typeof window !== "undefined" && window.api?.isSessionTapeReplay === true;
+}
+
 function dispatchSkillsRefreshRequested(): void {
   if (typeof window === "undefined") return;
   window.dispatchEvent(new CustomEvent(CUSTOM_EVENTS.SKILLS_REFRESH_REQUESTED));
@@ -120,7 +129,7 @@ export function applyWorkspaceChatEventToAggregator(
     "applyWorkspaceChatEventToAggregator requires event object"
   );
 
-  const allowSideEffects = options?.allowSideEffects !== false;
+  const allowSideEffects = options?.allowSideEffects !== false && !isSessionTapeReplayRenderer();
 
   if (isStreamStart(event)) {
     aggregator.handleStreamStart(event);
diff --git a/src/common/orpc/schemas/errors.ts b/src/common/orpc/schemas/errors.ts
index 8a44009982b..b2009b338d2 100644
--- a/src/common/orpc/schemas/errors.ts
+++ b/src/common/orpc/schemas/errors.ts
@@ -79,6 +79,7 @@ export const StreamErrorTypeSchema = z.enum([
   "model_refusal", // Provider declined to answer (refusal/content-filter); retrying the same request will refuse again
   "agent_resolution", // Strict explicit-agent contract failure (agent missing/hidden/disabled/provenance changed); deterministic, retrying reproduces it
   "reasoning_rejected", // Provider rejected replayed reasoning (OpenAI rs_ item / encrypted_content, Anthropic thinking signature) after the in-stream repair; deterministic
+  "session_tape_replay", // Perf harness (XUM_REPLAY_TAPES) refused to replay this workspace's tape; renderer-only, no model involved
   "unknown", // Catch-all
 ]);
 
diff --git a/src/common/types/global.d.ts b/src/common/types/global.d.ts
index 56e05418cf5..ed0d874e58d 100644
--- a/src/common/types/global.d.ts
+++ b/src/common/types/global.d.ts
@@ -17,6 +17,9 @@ declare global {
     enableTelemetryInDev?: boolean;
     // E2E test mode flag - used to adjust UI behavior (e.g., longer toast durations)
     isE2E?: boolean;
+    // Session tape replay mode (XUM_REPLAY_TAPES, perf harness): chat events are recorded, so
+    // the renderer suppresses their side effects.
+    isSessionTapeReplay?: boolean;
     // Enables in-app React render capture for dev profiling and automated perf tests.
     enableReactPerfProfile?: boolean;
     // Sandbox launchers default tutorials off unless explicitly re-enabled by env.
diff --git a/src/common/utils/messages/retryEligibility.ts b/src/common/utils/messages/retryEligibility.ts
index 3f9a70df5fb..d7f16344e45 100644
--- a/src/common/utils/messages/retryEligibility.ts
+++ b/src/common/utils/messages/retryEligibility.ts
@@ -56,6 +56,7 @@ const NON_RETRYABLE_STREAM_ERRORS = [
   "model_refusal", // Provider declined to answer - retrying the same request will refuse again
   "agent_resolution", // Strict explicit-agent contract failure - deterministic, retrying reproduces it
   "reasoning_rejected", // In-stream repair failed or was unsafe; repeating the same input cannot recover
+  "session_tape_replay", // The tape cannot be served; a retry is refused again
 ] as const satisfies readonly StreamErrorType[];
 
 const NON_RETRYABLE_STREAM_ERROR_SET = new Set<string>(NON_RETRYABLE_STREAM_ERRORS);
@@ -258,7 +259,8 @@ function computeHasInterruptedStream(
   if (
     lastMessage.type === "stream-error" &&
     (lastMessage.errorType === "runtime_not_ready" ||
-      lastMessage.errorType === "context_budget_blocked")
+      lastMessage.errorType === "context_budget_blocked" ||
+      lastMessage.errorType === "session_tape_replay")
   ) {
     return false;
   }
diff --git a/src/common/utils/sessionTapes/sessionTapeLoader.ts b/src/common/utils/sessionTapes/sessionTapeLoader.ts
index 2fdd7a52b88..e6d752894c2 100644
--- a/src/common/utils/sessionTapes/sessionTapeLoader.ts
+++ b/src/common/utils/sessionTapes/sessionTapeLoader.ts
@@ -189,7 +189,15 @@ function loadBodyOrThrow(
       trailer = parsed.data;
       break;
     }
-    const decoded = decodeEvent(lines[index], raw, line);
+    let decoded: SessionTapeEvent;
+    try {
+      decoded = decodeEvent(lines[index], raw, line);
+    } catch (error) {
+      // Validation and re-encoding recurse into the event: a deeply nested event can overflow
+      // the stack (RangeError). Bad tape content rejects the tape; it never throws to callers.
+      if (error instanceof TapeRejection) throw error;
+      throw new TapeRejection("event could not be validated", line);
+    }
     // Offsets are taken in delivery order, so a decreasing one means a corrupt or edited tape.
     if (decoded.t < lastT) throw new TapeRejection("event offset goes backwards", line);
     lastT = decoded.t;
diff --git a/src/common/utils/sessionTapes/sessionTapeReplay.ts b/src/common/utils/sessionTapes/sessionTapeReplay.ts
index 977f967b073..fee5c3b0c83 100644
--- a/src/common/utils/sessionTapes/sessionTapeReplay.ts
+++ b/src/common/utils/sessionTapes/sessionTapeReplay.ts
@@ -8,13 +8,44 @@
  * - `fast`: no intentional delay; order is kept.
  *
  * Finite and pure: it ends after the last event, adds nothing that is not on the tape, and
- * only yields event data. It never executes tools, contacts providers or recorded URLs, and does
- * not deliver events to a renderer or session; that integration (with network isolation) is
- * T3's. An aborted signal ends playback (also during a wait) without an error.
+ * never executes tools or contacts providers. Keeping a subscription open after playback is the
+ * caller's job (the desktop replay source). An aborted signal ends playback (also during a wait)
+ * without an error.
  */
+import { resolveXumEnvironmentValue, type XumEnvironment } from "@/common/compat/xumEnv";
 import type { WorkspaceChatMessage } from "@/common/orpc/types";
 import type { LoadedSessionTape } from "./sessionTapeLoader";
 
+/**
+ * Whether `XUM_REPLAY_TAPES` (legacy `MUX_REPLAY_TAPES`) is set: the process is in session tape
+ * replay mode (perf harness). Any non-blank value counts, even an unparseable one, so a typo
+ * never leaves a harness run live. Shared by the backend, desktop main and preload.
+ */
+export function isSessionTapeReplayConfigured(env: XumEnvironment): boolean {
+  return (resolveXumEnvironmentValue("REPLAY_TAPES", env) ?? "").trim() !== "";
+}
+
+/**
+ * `data` of the error that refuses onChat for a workspace mapped to a session tape
+ * (XUM_REPLAY_TAPES) that cannot be served. It survives the oRPC transport (an ORPCError's
+ * `data` is serialized with it), so the renderer can tell this terminal refusal apart from a
+ * transient subscription failure: retrying cannot help, and there is no live fallback.
+ */
+export const SESSION_TAPE_REPLAY_REFUSAL_DATA = { sessionTapeReplayRefused: true } as const;
+
+export function isSessionTapeReplayRefusal(error: unknown): error is Error {
+  if (!(error instanceof Error)) return false;
+  const data = (error as { data?: unknown }).data;
+  return (
+    data !== null &&
+    typeof data === "object" &&
+    (data as { sessionTapeReplayRefused?: unknown }).sessionTapeReplayRefused === true
+  );
+}
+
+/** setTimeout fires at once for delays above this (2^31-1 ms, about 24.8 days). */
+const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+
 export type SessionTapeReplayPacing = "recorded" | "fast";
 
 export interface SessionTapeReplayOptions {
@@ -52,9 +83,12 @@ export async function* replaySessionTape(
   for (const { t, event } of tape.events) {
     if (signal?.aborted) return;
     if (pacing === "recorded") {
-      const waitMs = startMs + t - performance.now();
-      if (waitMs > 0) await sleepUntilAborted(waitMs, signal);
-      if (signal?.aborted) return;
+      // Wait in chunks against the absolute deadline: a longer single delay would fire at once.
+      for (let waitMs = startMs + t - performance.now(); waitMs > 0; ) {
+        await sleepUntilAborted(Math.min(waitMs, MAX_TIMER_DELAY_MS), signal);
+        if (signal?.aborted) return;
+        waitMs = startMs + t - performance.now();
+      }
     }
     yield event;
   }
diff --git a/src/desktop/main.ts b/src/desktop/main.ts
index 60eba2f9118..4909abdd059 100644
--- a/src/desktop/main.ts
+++ b/src/desktop/main.ts
@@ -73,6 +73,7 @@ import {
   nativeTheme,
   powerSaveBlocker,
   screen,
+  session as electronSession,
   shell,
 } from "electron";
 
@@ -195,6 +196,11 @@ import { log } from "@/node/services/log";
 import { createHangTracker, JS_CALL_STACKS_FEATURE, mergeEnableFeatures } from "./perf/hangStacks";
 import { createRendererCpuProfiler, RendererTargetRegistry } from "./perf/rendererCpuProfiler";
 import { type AppPage, installAppDocumentPolicy } from "./perf/appDocumentPolicy";
+import {
+  installSessionTapeReplayEgressBlock,
+  refuseSessionTapeReplayExternalOpen,
+} from "./sessionTapeReplayEgress";
+import { isSessionTapeReplayMode } from "@/node/services/sessionTapes/sessionTapeReplaySource";
 
 // Lets the main process read a hung renderer's JS stack (see ./perf/hangStacks). Merge into
 // any --enable-features value from the launch command line instead of replacing it.
@@ -460,6 +466,7 @@ function initializeRemoteConnections(): void {
       if (returnItem) returnItem.enabled = state.status !== "disconnected";
     },
     openExternal: (url) => {
+      if (refuseSessionTapeReplayExternalOpen(url)) return;
       shell.openExternal(url).catch(() => {
         log.warn("Cannot open the remote server link in the browser.");
       });
@@ -1118,14 +1125,21 @@ function installHangStackDocumentPolicy(session: Session, appPage: AppPage): voi
   }
 }
 
+function shouldUseDevServer(): boolean {
+  return (isE2ETest && !forceDistLoad) || (!app.isPackaged && !forceDistLoad);
+}
+
+function getDevServerUrl(): string {
+  return `http://${getXumEnv("DEVSERVER_HOST") ?? "127.0.0.1"}:${devServerPort}`;
+}
+
 function createWindow() {
   assert(services, "Services must be loaded before creating window");
 
   mainWindowFinishedLoading = false;
 
-  const useDevServer = (isE2ETest && !forceDistLoad) || (!app.isPackaged && !forceDistLoad);
-  const devHost = getXumEnv("DEVSERVER_HOST") ?? "127.0.0.1";
-  const devServerUrl = `http://${devHost}:${devServerPort}`;
+  const useDevServer = shouldUseDevServer();
+  const devServerUrl = getDevServerUrl();
   let devServerRetryTimeout: ReturnType<typeof setTimeout> | null = null;
   let devServerRetryAttempt = 0;
 
@@ -1277,6 +1291,7 @@ function createWindow() {
   });
 
   const openExternalUrl = (url: string): void => {
+    if (refuseSessionTapeReplayExternalOpen(url)) return;
     const externalUrl = normalizeAndValidateExternalUrl({
       url,
       localhostProxyTemplate,
@@ -1489,6 +1504,16 @@ async function startDesktopAfterStorage(): Promise<void> {
     try {
       console.log("App ready, creating window...");
 
+      // Perf harness (XUM_REPLAY_TAPES): block renderer egress before any window (splash
+      // included) loads; the backend serves tapes only after this. A failure must not leave
+      // replay mode with network access, so it fails startup.
+      if (isSessionTapeReplayMode()) {
+        installSessionTapeReplayEgressBlock(
+          electronSession.defaultSession,
+          shouldUseDevServer() ? getDevServerUrl() : undefined
+        );
+      }
+
       if (await maybeRunAttachFileSmokeTest()) {
         return;
       }
@@ -1499,7 +1524,8 @@ async function startDesktopAfterStorage(): Promise<void> {
       // especially perf profiling) must match packaged builds, which never
       // install the extension: its installHook.js measurably distorts CPU and
       // layout profiles. Skipping it also removes a network download from tests.
-      if (!app.isPackaged && !isE2ETest) {
+      // Not in replay mode either: the extension download is network egress.
+      if (!app.isPackaged && !isE2ETest && !isSessionTapeReplayMode()) {
         try {
           const { default: installExtension, REACT_DEVELOPER_TOOLS } =
             // eslint-disable-next-line no-restricted-syntax -- dev-only dependency, intentionally lazy-loaded
diff --git a/src/desktop/preload.ts b/src/desktop/preload.ts
index 75ac57d4266..a2fa8f21600 100644
--- a/src/desktop/preload.ts
+++ b/src/desktop/preload.ts
@@ -20,6 +20,7 @@ import { contextBridge, ipcRenderer } from "electron";
 import type { DeepLinkPayload } from "@/common/types/deepLink";
 import type { RemoteConnectionApi, RemoteConnectionState } from "@/common/types/remoteConnection";
 import { REMOTE_CONNECTION_CHANNELS } from "@/common/constants/remoteConnection";
+import { isSessionTapeReplayConfigured } from "@/common/utils/sessionTapes/sessionTapeReplay";
 
 const getXumEnv = (suffix: string): string | undefined =>
   resolveXumEnvironmentValue(suffix, process.env);
@@ -86,6 +87,7 @@ contextBridge.exposeInMainWorld("api", {
     electron: process.versions.electron,
   },
   isE2E: getXumEnv("E2E") === "1",
+  isSessionTapeReplay: isSessionTapeReplayConfigured(process.env),
   enableReactPerfProfile: getXumEnv("PROFILE_REACT") === "1",
   enableTelemetryInDev: getXumEnv("ENABLE_TELEMETRY_IN_DEV") === "1",
   enableTutorialsInSandbox: getEnableTutorialsInSandbox(),
diff --git a/src/desktop/sessionTapeReplayEgress.ts b/src/desktop/sessionTapeReplayEgress.ts
new file mode 100644
index 00000000000..f432e59f259
--- /dev/null
+++ b/src/desktop/sessionTapeReplayEgress.ts
@@ -0,0 +1,86 @@
+/**
+ * Renderer network egress block for session tape replay mode (XUM_REPLAY_TAPES, perf harness).
+ * Replayed transcripts hold recorded content (markdown images, links, ...) whose URLs must never
+ * be contacted. Desktop main installs the block on the default session at app ready, before any
+ * window loads (the main, desktop.html and terminal windows all use that session), and only then
+ * lets the backend serve tapes (`markSessionTapeReplayEgressBlocked`).
+ *
+ * Type-only Electron imports keep this module loadable under bun tests.
+ */
+import type { Session } from "electron";
+import { log } from "@/node/services/log";
+import {
+  isSessionTapeReplayMode,
+  markSessionTapeReplayEgressBlocked,
+} from "@/node/services/sessionTapes/sessionTapeReplaySource";
+
+/** Local schemes that never leave the machine. */
+const ALLOWED_PROTOCOLS = new Set(["file:", "data:", "blob:", "devtools:"]);
+
+/**
+ * Whether the renderer may load `url` in replay mode. Everything not local is refused, loopback
+ * included (recorded content can point at local services). `devServerOrigin` (dev-server mode
+ * only, e.g. `http://127.0.0.1:5173`) also allows that exact origin over http and ws (HMR).
+ */
+export function isSessionTapeReplayAllowedUrl(
+  url: string,
+  devServerOrigin: string | undefined
+): boolean {
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (ALLOWED_PROTOCOLS.has(parsed.protocol)) return true;
+  if (devServerOrigin === undefined) return false;
+  const dev = new URL(devServerOrigin);
+  if (dev.protocol !== "http:") return false;
+  if (parsed.protocol !== "http:" && parsed.protocol !== "ws:") return false;
+  // `host` includes the port only when it is not the scheme default, and http and ws share
+  // default port 80, so comparing `host` matches the exact host and port for both schemes.
+  return parsed.host === dev.host;
+}
+
+/** Origin (or scheme) of a refused URL: logs never carry recorded paths or queries. */
+function describeOrigin(url: string): string {
+  try {
+    const parsed = new URL(url);
+    return parsed.origin === "null" ? parsed.protocol : parsed.origin;
+  } catch {
+    return "invalid URL";
+  }
+}
+
+/**
+ * Cancel every default-session request that `isSessionTapeReplayAllowedUrl` refuses (the
+ * renderer sees net::ERR_BLOCKED_BY_CLIENT), then let the backend serve tapes.
+ */
+export function installSessionTapeReplayEgressBlock(
+  session: Session,
+  devServerOrigin: string | undefined
+): void {
+  let blockedCount = 0;
+  session.webRequest.onBeforeRequest({ urls: ["<all_urls>"] }, (details, callback) => {
+    const allowed = isSessionTapeReplayAllowedUrl(details.url, devServerOrigin);
+    if (!allowed) {
+      blockedCount += 1;
+      log.info("Session tape replay blocked a renderer request", {
+        origin: describeOrigin(details.url),
+        blockedCount,
+      });
+    }
+    callback({ cancel: !allowed });
+  });
+  markSessionTapeReplayEgressBlocked();
+}
+
+/**
+ * External-open guard for replay mode: returns true (and logs) when `url` must not be opened
+ * in the user's browser. Callers deny the open.
+ */
+export function refuseSessionTapeReplayExternalOpen(url: string): boolean {
+  if (!isSessionTapeReplayMode()) return false;
+  log.info("Session tape replay refused to open an external URL", { origin: describeOrigin(url) });
+  return true;
+}
diff --git a/src/desktop/terminalWindowManager.ts b/src/desktop/terminalWindowManager.ts
index 588138589ac..77b5d85ca0d 100644
--- a/src/desktop/terminalWindowManager.ts
+++ b/src/desktop/terminalWindowManager.ts
@@ -9,6 +9,7 @@ import { app, BrowserWindow, shell, type BrowserWindowConstructorOptions } from
 import * as path from "path";
 import { resolveXumEnvironmentValue } from "@/common/compat/legacyMux";
 import { normalizeAndValidateExternalUrl } from "@/desktop/utils/normalizeAndValidateExternalUrl";
+import { refuseSessionTapeReplayExternalOpen } from "@/desktop/sessionTapeReplayEgress";
 import { log } from "@/node/services/log";
 import type { Config } from "@/node/config";
 
@@ -73,6 +74,7 @@ export class TerminalWindowManager {
     });
 
     const openExternalUrl = (url: string): void => {
+      if (refuseSessionTapeReplayExternalOpen(url)) return;
       const externalUrl = normalizeAndValidateExternalUrl({
         url,
         localhostProxyTemplate,
diff --git a/src/node/orpc/routerSubscriptions.ts b/src/node/orpc/routerSubscriptions.ts
index 15dd0e99d8e..9badae4ff9b 100644
--- a/src/node/orpc/routerSubscriptions.ts
+++ b/src/node/orpc/routerSubscriptions.ts
@@ -29,6 +29,7 @@ import { getRpcPath } from "./inFlightProcedures";
 import { subscriptionIterable, type SubscriptionStreamOptions } from "./streamBridge";
 import { createReplayBufferedStreamMessageRelay } from "@/node/services/replayBufferedStreamMessageRelay";
 import { maybeRecordWorkspaceChat } from "@/node/services/sessionTapes/sessionTapeRecorder";
+import { getSessionTapeReplay } from "@/node/services/sessionTapes/sessionTapeReplaySource";
 import { TIMELINE_DEFAULT_PAGE_LIMIT } from "@/node/services/timelineService";
 import type { LogEntry } from "@/node/services/logBuffer";
 import { subscribeLogFeed } from "@/node/services/logBuffer";
@@ -401,6 +402,19 @@ export function subscribeWorkspaceChat(
    */
   options?: { validateOutput?: boolean }
 ): AsyncGenerator<WorkspaceChatMessage> {
+  // Perf harness (XUM_REPLAY_TAPES, desktop only): a mapped workspace is served from its tape
+  // before any session access, so no agent, tool or provider code runs. Not recorded again.
+  const tapeReplay = getSessionTapeReplay(input);
+  if (tapeReplay) {
+    return runtimeSubscription<WorkspaceChatMessage>(context, {
+      signal,
+      // Keeps the client's stall watchdog fed while a large tape loads and after playback.
+      heartbeat: { value: { type: "heartbeat" as const } },
+      progressiveInitialize: true,
+      subscribe: () => () => undefined,
+      initialize: (emit) => tapeReplay.play(emit.push, signal),
+    });
+  }
   const session = context.workspaceService.getOrCreateSession(input.workspaceId);
   if (typeof input.legacyAutoRetryEnabled === "boolean") {
     session.setLegacyAutoRetryEnabledHint(input.legacyAutoRetryEnabled);
diff --git a/src/node/services/evaluationModelFactory.ts b/src/node/services/evaluationModelFactory.ts
index e66dd58e3fc..0fdcb564eb7 100644
--- a/src/node/services/evaluationModelFactory.ts
+++ b/src/node/services/evaluationModelFactory.ts
@@ -15,6 +15,10 @@ import {
   type AutoModelRoutingEvaluationProvider,
 } from "@/constants/autoModelRouting";
 import type { ProvidersConfigStore } from "@/node/config/providersConfigStore";
+import {
+  isSessionTapeReplayMode,
+  SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE,
+} from "@/node/services/sessionTapes/sessionTapeReplaySource";
 import {
   buildAIProviderRequestHeaders,
   normalizeAnthropicBaseURL,
@@ -138,6 +142,10 @@ export function createEvaluationModel(
   deps: EvaluationModelFactoryDeps
 ): Effect.Effect<Result<Experimental_EvaluationModelV4, EvaluationModelFailure>> {
   return Effect.gen(function* () {
+    // Perf harness replay mode (XUM_REPLAY_TAPES): no provider call, by construction.
+    if (isSessionTapeReplayMode()) {
+      return Err({ code: "provider_disabled", message: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE });
+    }
     const target = resolveEvaluationModelTarget(modelString, deps);
     if (!target.success) return target;
     const { provider, modelId, settings, organization } = target.data;
diff --git a/src/node/services/providerModelFactory.ts b/src/node/services/providerModelFactory.ts
index 0d0acd7faec..49d2f658788 100644
--- a/src/node/services/providerModelFactory.ts
+++ b/src/node/services/providerModelFactory.ts
@@ -105,6 +105,10 @@ import {
 } from "@/node/services/languageModelCleanup";
 import { createOpenAIWebSocketTransportFetch } from "@/node/services/openAIWebSocketTransportFetch";
 import { log } from "@/node/services/log";
+import {
+  isSessionTapeReplayMode,
+  SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE,
+} from "@/node/services/sessionTapes/sessionTapeReplaySource";
 import { resolveProviderOptionsNamespaceKey } from "@/common/utils/ai/providerOptions";
 import { resolveRoute, type RouteContext } from "@/common/routing";
 import {
@@ -1459,6 +1463,12 @@ export class ProviderModelFactory {
     // eslint-disable-next-line @typescript-eslint/no-this-alias -- Effect.gen generator bodies do not inherit `this`
     const self = this;
     return Effect.gen(function* () {
+      // Perf harness replay mode (XUM_REPLAY_TAPES): no provider call, by construction. Every
+      // chat, status, title, compaction, refine, memory, advisor and intuition model is created
+      // through here, so no per-service gate is needed.
+      if (isSessionTapeReplayMode()) {
+        return Err<SendMessageError>({ type: "unknown", raw: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE });
+      }
       const result = yield* self.createModelCoreEffect(modelString, muxProviderOptions, opts);
       if (!result.success) {
         return result;
@@ -2884,6 +2894,12 @@ export class ProviderModelFactory {
     // eslint-disable-next-line @typescript-eslint/no-this-alias -- Effect.gen generator bodies do not inherit `this`
     const self = this;
     return Effect.gen(function* () {
+      // Perf harness replay mode (XUM_REPLAY_TAPES): see createModelEffect. The typed error has
+      // no free text, so the reason is logged.
+      if (isSessionTapeReplayMode()) {
+        log.warn("Evaluation model refused", { error: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE });
+        return Err<EvaluationResolveError>({ reason: "unsupported-route" });
+      }
       // ONE providers.jsonc read for the shadow check, routing, credentials and
       // construction (same single-snapshot rule as resolveAndCreateModelEffect).
       const providersConfig = self.providersConfigStore.loadProvidersConfig() ?? {};
diff --git a/src/node/services/sessionTapes/sessionTapeFile.ts b/src/node/services/sessionTapes/sessionTapeFile.ts
index fd538fbaf0a..bf860d53b34 100644
--- a/src/node/services/sessionTapes/sessionTapeFile.ts
+++ b/src/node/services/sessionTapes/sessionTapeFile.ts
@@ -1,7 +1,7 @@
 /**
  * Read a session tape file (experiment `sessionTapes`) and validate it with the pure loader.
- * Only reads and validates: nothing here delivers tape events to a renderer, a session or a
- * provider.
+ * Only reads and validates; the desktop replay source (sessionTapeReplaySource.ts) serves the
+ * result to a renderer.
  */
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
@@ -12,6 +12,7 @@ import {
   type SessionTapeLoadOptions,
   type SessionTapeLoadResult,
 } from "@/common/utils/sessionTapes/sessionTapeLoader";
+import { SESSION_TAPE_CAP_BYTES } from "./sessionTapeRecorder";
 
 /** Read and validate a tape file. Names not ending in `.jsonl` (temp files) are rejected unread. */
 export async function readSessionTapeFile(
@@ -21,9 +22,20 @@ export async function readSessionTapeFile(
   if (!isFinalizedSessionTapeFileName(path.basename(filePath))) {
     return { status: "rejected", reason: "not a finalized tape (the name must end in .jsonl)" };
   }
+  const tooLarge = `larger than the recorder's ${SESSION_TAPE_CAP_BYTES}-byte tape cap`;
   let text: string;
   try {
-    text = await fs.readFile(filePath, "utf-8");
+    // Stat before reading: a FIFO or device would block or never end, and the recorder never
+    // writes more than its cap, so a larger file is not a tape (and would only waste memory).
+    const stat = await fs.stat(filePath);
+    if (!stat.isFile()) return { status: "rejected", reason: "not a regular file" };
+    if (stat.size > SESSION_TAPE_CAP_BYTES) return { status: "rejected", reason: tooLarge };
+    const bytes = await fs.readFile(filePath);
+    // The file can grow between stat and read.
+    if (bytes.length > SESSION_TAPE_CAP_BYTES) return { status: "rejected", reason: tooLarge };
+    // Fatal decoding: the recorder writes valid UTF-8, so replacement characters would mean
+    // the bytes were changed after recording.
+    text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
   } catch (error) {
     return { status: "rejected", reason: `unreadable: ${getErrorMessage(error)}` };
   }
diff --git a/src/node/services/sessionTapes/sessionTapeRecorder.ts b/src/node/services/sessionTapes/sessionTapeRecorder.ts
index c6cd4ac398a..6a17f7ec395 100644
--- a/src/node/services/sessionTapes/sessionTapeRecorder.ts
+++ b/src/node/services/sessionTapes/sessionTapeRecorder.ts
@@ -55,8 +55,11 @@ import { VERSION } from "@/version";
 
 /** Largest single stored event JSON line; a larger one truncates the tape. */
 const EVENT_CAP_BYTES = 4 * 1024 * 1024;
-/** Largest tape (all lines); the first event that would pass it truncates the tape. */
-const TAPE_CAP_BYTES = 32 * 1024 * 1024;
+/**
+ * Largest tape (all lines); the first event that would pass it truncates the tape. Readers
+ * refuse larger files (readSessionTapeFile).
+ */
+export const SESSION_TAPE_CAP_BYTES = 32 * 1024 * 1024;
 /** Serialized lines held by all captures of this process, until their tapes are written. */
 const GLOBAL_CAP_BYTES = 64 * 1024 * 1024;
 /** Room kept under every cap so a truncated tape can still end with its trailer. */
@@ -73,11 +76,20 @@ const TAPE_FILE_SUFFIX = ".jsonl";
 /** writeFileAtomic's temp files: `<target>.<12 hex>`. */
 const TEMP_FILE_PATTERN = /\.jsonl\.[0-9a-f]{12}$/;
 /**
- * A temp file older than this is a crash leftover: a write of at most TAPE_CAP_BYTES finishes
+ * A temp file older than this is a crash leftover: a write of at most SESSION_TAPE_CAP_BYTES finishes
  * in seconds, and writeFileAtomic removes its temp file on failure and on normal exit.
  */
 const TEMP_LEFTOVER_AGE_MS = 10 * 60 * 1000;
 
+/**
+ * Header `workspaceIdHash`: 16 hex chars of sha256 of the TRIMMED workspace id, the id the
+ * session layer resolves (WorkspaceService trims it), so a padded subscription id records and
+ * replays under the same hash.
+ */
+export function hashSessionTapeWorkspaceId(workspaceId: string): string {
+  return createHash("sha256").update(workspaceId.trim()).digest("hex").slice(0, 16);
+}
+
 export interface SessionTapeDeps {
   aiService: Pick<AIService, "isExperimentEnabled">;
   config: Pick<Config, "rootDir">;
@@ -213,10 +225,7 @@ class TapeCapture {
   ) {
     const tapeId = randomUUID();
     const startedAt = new Date().toISOString();
-    const workspaceIdHash = createHash("sha256")
-      .update(input.workspaceId)
-      .digest("hex")
-      .slice(0, 16);
+    const workspaceIdHash = hashSessionTapeWorkspaceId(input.workspaceId);
     this.header = {
       tape: SESSION_TAPE_VERSION,
       xumVersion: VERSION.git_describe,
@@ -264,7 +273,7 @@ class TapeCapture {
       const lineBytes = prefix.length + bytes + Buffer.byteLength(metaJson) + 2;
       if (
         lineBytes > EVENT_CAP_BYTES ||
-        this.retainedBytes + lineBytes > TAPE_CAP_BYTES - TRAILER_RESERVE_BYTES ||
+        this.retainedBytes + lineBytes > SESSION_TAPE_CAP_BYTES - TRAILER_RESERVE_BYTES ||
         globalRetainedBytes + lineBytes > GLOBAL_CAP_BYTES - TRAILER_RESERVE_BYTES
       ) {
         // Truncate at the first event that does not fit (no gaps): everything after is dropped.
diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
new file mode 100644
index 00000000000..5b21393cfca
--- /dev/null
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
@@ -0,0 +1,180 @@
+/**
+ * Desktop replay source for session tapes (perf harness `perf.tapeReplay`): serves a recorded
+ * tape as a workspace's `workspace.onChat` stream instead of the live session, so the real
+ * transport and the real renderer path (WorkspaceStore -> aggregator -> React) see the recorded
+ * events.
+ *
+ * Configuration: `XUM_REPLAY_TAPES` (legacy `MUX_REPLAY_TAPES`) is a JSON object mapping
+ * workspace ids to absolute tape paths. Unset or blank: nothing here does any work. Set (even
+ * unparseable): the whole process is in replay mode, which is read-only:
+ * - Sends, resumes and history changes refuse with SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE for
+ *   every workspace (WorkspaceService funnels).
+ * - Provider model creation refuses (ProviderModelFactory, evaluationModelFactory), so no
+ *   background service (status, title, compaction, memory, ...) can reach a provider.
+ *
+ * Contract for a mapped workspace (the router branches here before touching the session):
+ * - No AgentSession, tool or provider code runs; events come only from the tape.
+ * - Served only after desktop main blocked the renderer's network egress
+ *   (`markSessionTapeReplayEgressBlocked`), so recorded URLs (images in markdown, ...) are never
+ *   fetched. `xum server` and browser mode always refuse.
+ * - Only fresh full subscriptions, each with the whole tape (no resumable replay). `since` and
+ *   `live` are refused: their client keeps rows a delta would not reset. Reload to replay again.
+ * - Only complete (`closed`) tapes recorded for the mapped workspace (header `workspaceIdHash`).
+ *   Rejected, truncated and stopped tapes are refused; the offline tools still describe them.
+ * - Refusals are terminal (`SESSION_TAPE_REPLAY_REFUSAL_DATA`): the renderer shows them instead
+ *   of retrying. There is never a fallback to the live session.
+ * - Events play at their recorded offsets; the subscription then stays open until the client
+ *   aborts, so the renderer does not resubscribe and replay the tape again.
+ * Unmapped workspaces take the normal path. An unparseable map cannot tell which workspaces are
+ * mapped, so it treats every workspace as mapped (and refused) rather than silently going live.
+ * An invalid entry refuses only its own workspace.
+ */
+import * as path from "node:path";
+import { ORPCError } from "@orpc/server";
+import { resolveXumEnvironmentValue } from "@/common/compat/xumEnv";
+import type { OnChatMode, WorkspaceChatMessage } from "@/common/orpc/types";
+import {
+  isSessionTapeReplayConfigured,
+  replaySessionTape,
+  SESSION_TAPE_REPLAY_REFUSAL_DATA,
+} from "@/common/utils/sessionTapes/sessionTapeReplay";
+import { log } from "@/node/services/log";
+import { readSessionTapeFile } from "./sessionTapeFile";
+import { hashSessionTapeWorkspaceId } from "./sessionTapeRecorder";
+
+/** Refusal of sends, resumes, history changes and provider model creation in replay mode. */
+export const SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE =
+  "Session tape replay mode (XUM_REPLAY_TAPES) is read-only: sending, history changes and model calls are disabled.";
+
+/** Whether this process is in session tape replay mode (any non-blank XUM_REPLAY_TAPES). */
+export function isSessionTapeReplayMode(): boolean {
+  return isSessionTapeReplayConfigured(process.env);
+}
+
+let egressBlocked = false;
+
+/**
+ * Called by desktop main once the renderer egress block is installed on the default session
+ * (src/desktop/sessionTapeReplayEgress.ts). Until then no tape is served.
+ */
+export function markSessionTapeReplayEgressBlocked(): void {
+  egressBlocked = true;
+}
+
+/** Workspace id -> absolute tape path, or why that entry cannot be used. */
+type ReplayTapeMap = ReadonlyMap<string, string | Error>;
+
+/** Parsed once per distinct env value (in practice once per process). */
+let cachedConfig: { raw: string; map: ReplayTapeMap | Error } | undefined;
+
+function parseReplayTapeMap(raw: string): ReplayTapeMap | Error {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return new Error("XUM_REPLAY_TAPES is not valid JSON");
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return new Error("XUM_REPLAY_TAPES must be a JSON object of workspace id -> tape path");
+  }
+  const map = new Map<string, string | Error>();
+  for (const [rawWorkspaceId, tapePath] of Object.entries(parsed)) {
+    // Keys and lookups use the trimmed id the session layer resolves, so a padded id cannot
+    // miss its mapping and reach the workspace's live session.
+    const workspaceId = rawWorkspaceId.trim();
+    // A bad entry still names its workspace: refuse only that one, not the whole map.
+    map.set(
+      workspaceId,
+      typeof tapePath === "string" && path.isAbsolute(tapePath)
+        ? tapePath
+        : new Error(`XUM_REPLAY_TAPES: the tape path for ${workspaceId} must be absolute`)
+    );
+  }
+  return map;
+}
+
+function readReplayTapeMap(): ReplayTapeMap | Error | undefined {
+  if (!isSessionTapeReplayMode()) return undefined;
+  const raw = resolveXumEnvironmentValue("REPLAY_TAPES", process.env) ?? "";
+  if (cachedConfig?.raw !== raw) cachedConfig = { raw, map: parseReplayTapeMap(raw) };
+  return cachedConfig.map;
+}
+
+export interface SessionTapeReplay {
+  /**
+   * Validate the whole tape, then push its events at their recorded offsets and wait for the
+   * abort. Rejects with an ORPCError carrying `SESSION_TAPE_REPLAY_REFUSAL_DATA` (message shown
+   * by the client) when the replay cannot be served.
+   */
+  play(push: (event: WorkspaceChatMessage) => void, signal?: AbortSignal): Promise<void>;
+}
+
+function waitForAbort(signal: AbortSignal | undefined): Promise<void> {
+  // Without a signal nothing could end the wait (the router always passes one).
+  if (signal === undefined || signal.aborted) return Promise.resolve();
+  return new Promise((resolve) =>
+    signal.addEventListener("abort", () => resolve(), { once: true })
+  );
+}
+
+function refuseReplay(workspaceId: string, message: string): never {
+  log.warn("Session tape replay refused", { workspaceId, error: message });
+  throw new ORPCError("PRECONDITION_FAILED", { message, data: SESSION_TAPE_REPLAY_REFUSAL_DATA });
+}
+
+/** Why this subscription cannot be served before reading the tape, if anything. */
+function getUpfrontRefusal(entry: string | Error, mode: OnChatMode | undefined): string | undefined {
+  if (entry instanceof Error) return entry.message;
+  if (!egressBlocked) return "session tape replay requires the desktop app's egress block";
+  if (mode !== undefined && mode.type !== "full") {
+    return `Session tape replay serves only fresh full subscriptions (got "${mode.type}"); reload to replay the tape again`;
+  }
+  return undefined;
+}
+
+/**
+ * The tape replay for this onChat subscription, or undefined when the workspace is not mapped
+ * (normal live subscription). Never touches the workspace's session.
+ */
+export function getSessionTapeReplay(input: {
+  workspaceId: string;
+  mode?: OnChatMode;
+}): SessionTapeReplay | undefined {
+  const map = readReplayTapeMap();
+  if (map === undefined) return undefined;
+  const workspaceId = input.workspaceId.trim();
+  const entry = map instanceof Error ? map : map.get(workspaceId);
+  if (entry === undefined) return undefined;
+
+  return {
+    play: async (push, signal) => {
+      // Checked when playback starts, so the error surfaces from the subscription's iterator.
+      const refusal = getUpfrontRefusal(entry, input.mode);
+      if (refusal !== undefined || entry instanceof Error) {
+        refuseReplay(workspaceId, refusal ?? "no tape mapped");
+      }
+      // Truncated tapes load (flagged) so the refusal can say why replay will not serve them.
+      const result = await readSessionTapeFile(entry, { allowTruncated: true });
+      if (result.status === "rejected") {
+        const where = result.line === undefined ? "" : ` (line ${result.line})`;
+        refuseReplay(workspaceId, `Session tape ${entry} rejected: ${result.reason}${where}`);
+      }
+      if (result.status !== "ok") {
+        refuseReplay(
+          workspaceId,
+          `Session tape ${entry} is ${result.status}: replay serves only complete (closed) tapes`
+        );
+      }
+      // A path mix-up would otherwise render another session's transcript (history rows do
+      // not carry a workspace id).
+      if (result.header.workspaceIdHash !== hashSessionTapeWorkspaceId(workspaceId)) {
+        refuseReplay(workspaceId, `Session tape ${entry} was recorded for another workspace`);
+      }
+      for await (const event of replaySessionTape(result, { pacing: "recorded", signal })) {
+        push(event);
+      }
+      // Stay open until the client aborts, so the renderer does not resubscribe and replay.
+      await waitForAbort(signal);
+    },
+  };
+}
diff --git a/src/node/services/workspaceService.ts b/src/node/services/workspaceService.ts
index c3f55acbd9e..7bbcfb927d7 100644
--- a/src/node/services/workspaceService.ts
+++ b/src/node/services/workspaceService.ts
@@ -55,6 +55,10 @@ import { Ok, Err } from "@/common/types/result";
 import { askUserQuestionManager } from "@/node/services/askUserQuestionManager";
 import { delegatedToolCallManager } from "@/node/services/delegatedToolCallManager";
 import { log } from "@/node/services/log";
+import {
+  isSessionTapeReplayMode,
+  SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE,
+} from "@/node/services/sessionTapes/sessionTapeReplaySource";
 import { eventSpine } from "@/node/services/events/eventSpine";
 import { agentPluginHookService } from "@/node/services/agentPlugins/hookService";
 import { sandboxHostService } from "@/node/services/sandbox/sandboxHostService";
@@ -15201,6 +15205,11 @@ export class WorkspaceService
       (internal?.acceptanceOrigin ?? "manual") === "manual" && internal?.agentInitiated !== true
         ? aiSelectionIntent
         : undefined;
+    // Perf harness replay mode (XUM_REPLAY_TAPES): transcripts come from tapes, so no live turn
+    // may run, append history or reach providers, in any workspace. Every send enters here.
+    if (isSessionTapeReplayMode()) {
+      return Err({ type: "unknown", raw: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE });
+    }
     // Plan-review rows may only come from the dedicated endpoints, which validate them first.
     // Every generic send (oRPC/UI, CLI, ACP prompts, workflow continuations) enters here, and so
     // does anything it later queues or defers behind compaction; refuse before any side effect.
@@ -16135,6 +16144,11 @@ export class WorkspaceService
       [Symbol.dispose]: () => taskTurnAdmission?.onDisposed(resumeRefused ? "refused" : "no-work"),
     };
     try {
+      // Perf harness replay mode (XUM_REPLAY_TAPES): see sendMessageWithIds.
+      if (isSessionTapeReplayMode()) {
+        return Err({ type: "unknown", raw: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE });
+      }
+
       // Block streaming while workspace is being renamed to prevent path conflicts
       if (this.renamingWorkspaces.has(workspaceId)) {
         log.debug("resumeStream blocked: workspace is being renamed", { workspaceId });
@@ -16769,6 +16783,11 @@ export class WorkspaceService
     toolCallId: string,
     answers: Record<string, string>
   ): Promise<Result<void>> {
+    // Perf harness replay mode (XUM_REPLAY_TAPES): see truncateHistory. The fallback below
+    // writes the answer into history.
+    if (isSessionTapeReplayMode()) {
+      return Err(SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE);
+    }
     try {
       // Fast path: normal in-memory execution (stream still running, tool is awaiting input).
       askUserQuestionManager.answer(workspaceId, toolCallId, answers);
@@ -17558,6 +17577,11 @@ export class WorkspaceService
   }
 
   async truncateHistory(workspaceId: string, percentage?: number): Promise<Result<void>> {
+    // Perf harness replay mode (XUM_REPLAY_TAPES): real chat history stays untouched. Checked
+    // before any session or history work (clear, truncate).
+    if (isSessionTapeReplayMode()) {
+      return Err(SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE);
+    }
     const effectivePercentage = percentage ?? 1.0;
     // The admission guard is acquired BEFORE the scope preflight and held across every await
     // below: a turn admitted during any of them could snapshot the pre-truncation transcript
@@ -17812,6 +17836,10 @@ export class WorkspaceService
   }
 
   async resetContext(workspaceId: string): Promise<Result<"reset" | "noop">> {
+    // Perf harness replay mode (XUM_REPLAY_TAPES): see truncateHistory.
+    if (isSessionTapeReplayMode()) {
+      return Err(SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE);
+    }
     // Admission guard (r40): rejects duplicate mutations and new sends at the
     // door, blocks turn admission inside the session, and verifies idleness —
     // held across the refine drain/lock awaits below so a send admitted
@@ -17988,6 +18016,11 @@ export class WorkspaceService
       admitsAppend?: () => boolean;
     }
   ): Promise<Result<void>> {
+    // Perf harness replay mode (XUM_REPLAY_TAPES): see truncateHistory. Checked first: compaction
+    // replaces (Start Here) skip the admission guard below.
+    if (isSessionTapeReplayMode()) {
+      return Err(SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE);
+    }
     // The row is client-supplied (workspace.replaceChatHistory). Plan-review rows may only come
     // from the dedicated endpoints; with a matching envelope this row would otherwise persist an
     // authentic record that skipped their validation, directly or as a compaction summary's
diff --git a/tests/ui/chat/startHere.test.ts b/tests/ui/chat/startHere.test.ts
index a60cb51a928..e707ea512e6 100644
--- a/tests/ui/chat/startHere.test.ts
+++ b/tests/ui/chat/startHere.test.ts
@@ -12,7 +12,39 @@ import { fireEvent, waitFor } from "@testing-library/react";
 
 import { preloadTestModules } from "../../ipc/setup";
 
-import { createAppHarness } from "../harness";
+import { createAppHarness, type AppHarness } from "../harness";
+
+async function clickStartHere(app: AppHarness): Promise<void> {
+  const startHereButton = await waitFor(
+    () => {
+      const buttons = Array.from(
+        app.view.container.querySelectorAll<HTMLButtonElement>('button[aria-label="Start Here"]')
+      );
+      const enabled = buttons.find((b) => !b.disabled);
+      if (!enabled) {
+        throw new Error("Start Here button not found or disabled");
+      }
+      return enabled;
+    },
+    { timeout: 10_000 }
+  );
+  fireEvent.click(startHereButton);
+}
+
+/** The OK button of the StartHereModal dialog (Radix portals it to document.body). */
+async function findEnabledOkButton(): Promise<HTMLButtonElement> {
+  return waitFor(
+    () => {
+      const buttons = Array.from(document.querySelectorAll("button"));
+      const ok = buttons.find((b) => b.textContent?.trim().startsWith("OK") && !b.disabled);
+      if (!ok) {
+        throw new Error("OK button not found in Start Here modal");
+      }
+      return ok;
+    },
+    { timeout: 5_000 }
+  );
+}
 
 describe("Start Here (mock AI router)", () => {
   beforeAll(async () => {
@@ -72,4 +104,46 @@ describe("Start Here (mock AI router)", () => {
       await app.dispose();
     }
   }, 60_000);
+
+  test("shows a refused Start Here in the dialog and keeps it open until a retry succeeds", async () => {
+    const app = await createAppHarness({ branchPrefix: "start-here-refused" });
+    const savedReplayTapes = process.env.XUM_REPLAY_TAPES;
+
+    try {
+      const seedMessage = "Seed conversation for refused start-here test";
+      await app.chat.send(seedMessage);
+      await app.chat.expectTranscriptContains(`Mock response: ${seedMessage}`);
+
+      // The in-process backend is now in session tape replay mode and refuses history changes.
+      // The already open transcript subscription is unaffected.
+      process.env.XUM_REPLAY_TAPES = JSON.stringify({ [app.workspaceId]: "/nonexistent.jsonl" });
+      await clickStartHere(app);
+      fireEvent.click(await findEnabledOkButton());
+
+      const alert = await waitFor(
+        () => {
+          const node = document.querySelector('[role="alert"]');
+          if (!node?.textContent?.includes("XUM_REPLAY_TAPES")) {
+            throw new Error("refusal not shown in the Start Here dialog");
+          }
+          return node;
+        },
+        { timeout: 5_000 }
+      );
+      expect(alert.textContent).toContain("read-only");
+
+      // The dialog stayed open; once the backend accepts, the same OK succeeds and closes it.
+      if (savedReplayTapes === undefined) delete process.env.XUM_REPLAY_TAPES;
+      else process.env.XUM_REPLAY_TAPES = savedReplayTapes;
+      fireEvent.click(await findEnabledOkButton());
+      await app.chat.expectTranscriptContains("Compaction boundary", 10_000);
+      await waitFor(() => {
+        if (document.querySelector('[role="alert"]')) throw new Error("refusal still shown");
+      });
+    } finally {
+      if (savedReplayTapes === undefined) delete process.env.XUM_REPLAY_TAPES;
+      else process.env.XUM_REPLAY_TAPES = savedReplayTapes;
+      await app.dispose();
+    }
+  }, 60_000);
 });

From f7b5af6742f51719a9a19332b9ed37c20b72909f Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 08:00:20 +0000
Subject: [PATCH 02/18] test(e2e): add the perf.tapeReplay scenario, its
 synthetic tape fixture and make perf-tape-replay

Signed-off-by: Thomas Kosiewski <tk@coder.com>
---
 Makefile                                      |   6 +-
 scripts/perf/generateTapeReplayFixture.ts     |  23 +++
 .../sessionTapes/sessionTapes.testFixtures.ts |   9 +-
 .../sessionTapes/perf-tape-replay.jsonl       |  12 ++
 .../sessionTapes/tapeReplayFixture.ts         | 145 +++++++++++++++
 tests/e2e/scenarios/perf.tapeReplay.spec.ts   | 175 ++++++++++++++++++
 tests/e2e/utils/perfProfile.ts                |  16 ++
 7 files changed, 384 insertions(+), 2 deletions(-)
 create mode 100644 scripts/perf/generateTapeReplayFixture.ts
 create mode 100644 tests/e2e/fixtures/sessionTapes/perf-tape-replay.jsonl
 create mode 100644 tests/e2e/fixtures/sessionTapes/tapeReplayFixture.ts
 create mode 100644 tests/e2e/scenarios/perf.tapeReplay.spec.ts

diff --git a/Makefile b/Makefile
index a4af236f865..ecc1dff2ec9 100644
--- a/Makefile
+++ b/Makefile
@@ -88,7 +88,7 @@ include fmt.mk
 .PHONY: all build dev start clean help
 .PHONY: build-renderer version build-icons build-static build-docker-runtime verify-docker-runtime-artifacts
 .PHONY: lint lint-fix typecheck static-check static-check-full
-.PHONY: test test-unit test-unit-ci test-integration test-watch test-coverage test-e2e test-e2e-perf smoke-test
+.PHONY: test test-unit test-unit-ci test-integration test-watch test-coverage test-e2e test-e2e-perf perf-tape-replay smoke-test
 .PHONY: dist dist-mac dist-win dist-linux install-mac-arm64 ensure-mac-sharp-runtime-deps check-appimage-icons check-mac-attach-file-runtime
 .PHONY: vscode-ext vscode-ext-install
 .PHONY: docs-server check-docs-links
@@ -549,6 +549,10 @@ test-e2e-perf: ## Run automated performance profiling scenarios
 	@# One worker: parallel Electron apps contend on CPU, so a scenario measures its neighbours' startup (#5209).
 	@XUM_E2E_RUN_PERF=1 XUM_PROFILE_REACT=1 XUM_E2E_LOAD_DIST=1 XUM_E2E_SKIP_BUILD=1 PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 bun x playwright test --project=electron tests/e2e/scenarios/perf*.spec.ts --workers 1 $(PLAYWRIGHT_ARGS)
 
+perf-tape-replay: ## Replay a synthetic session tape through the desktop app (perf.tapeReplay)
+	@$(MAKE) build
+	@XUM_E2E_RUN_PERF=1 XUM_PROFILE_REACT=1 XUM_E2E_LOAD_DIST=1 XUM_E2E_SKIP_BUILD=1 PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 bun x playwright test --project=electron tests/e2e/scenarios/perf.tapeReplay.spec.ts --workers 1 $(PLAYWRIGHT_ARGS)
+
 ## Distribution
 dist: build ## Build distributable packages
 	@bun x electron-builder --publish never
diff --git a/scripts/perf/generateTapeReplayFixture.ts b/scripts/perf/generateTapeReplayFixture.ts
new file mode 100644
index 00000000000..32e1a4de884
--- /dev/null
+++ b/scripts/perf/generateTapeReplayFixture.ts
@@ -0,0 +1,23 @@
+/**
+ * Regenerate the synthetic session tape fixture of the `perf.tapeReplay` e2e scenario:
+ *   bun scripts/perf/generateTapeReplayFixture.ts
+ */
+import { writeFileSync } from "node:fs";
+import * as path from "node:path";
+import {
+  buildTapeReplayFixtureTape,
+  TAPE_REPLAY_FIXTURE_FILE_NAME,
+} from "../../tests/e2e/fixtures/sessionTapes/tapeReplayFixture";
+
+const target = path.join(
+  import.meta.dir,
+  "..",
+  "..",
+  "tests",
+  "e2e",
+  "fixtures",
+  "sessionTapes",
+  TAPE_REPLAY_FIXTURE_FILE_NAME
+);
+writeFileSync(target, buildTapeReplayFixtureTape());
+console.log(`Wrote ${path.relative(process.cwd(), target)}`);
diff --git a/src/node/services/sessionTapes/sessionTapes.testFixtures.ts b/src/node/services/sessionTapes/sessionTapes.testFixtures.ts
index 4e62a4ee07b..b96d77a1e10 100644
--- a/src/node/services/sessionTapes/sessionTapes.testFixtures.ts
+++ b/src/node/services/sessionTapes/sessionTapes.testFixtures.ts
@@ -14,6 +14,7 @@ import {
   type SessionTapeHeader,
   type SessionTapeTrailer,
 } from "@/common/types/sessionTape";
+import { hashSessionTapeWorkspaceId } from "./sessionTapeRecorder";
 
 const createdAt = new Date("2026-05-29T00:00:00.000Z");
 const usage = { inputTokens: 10, outputTokens: 5, totalTokens: 15 };
@@ -397,6 +398,8 @@ export interface SyntheticSessionTapeOptions {
   offsetMs?: (index: number) => number;
   /** Trailer `end` fields; default a complete `closed` tape. */
   end?: Partial<SessionTapeTrailer["end"]>;
+  /** Workspace the tape claims to be recorded for (header hash); default a fixed opaque hash. */
+  workspaceId?: string;
 }
 
 /**
@@ -414,7 +417,11 @@ export function buildSyntheticSessionTape(
     xumVersion: "synthetic",
     tapeId: "synthetic-tape",
     // The loader reads the hash as an opaque label: a fixed 16-hex value of the recorder's shape.
-    workspaceIdHash: "0123456789abcdef",
+    // Replay (sessionTapeReplaySource) checks it against the mapped workspace.
+    workspaceIdHash:
+      options.workspaceId === undefined
+        ? "0123456789abcdef"
+        : hashSessionTapeWorkspaceId(options.workspaceId),
     startedAt: "2026-05-29T00:00:00.000Z",
     masking: SESSION_TAPE_MASKING,
     subscription: { batchReplay: true, replayWindow: true, validateOutput: true },
diff --git a/tests/e2e/fixtures/sessionTapes/perf-tape-replay.jsonl b/tests/e2e/fixtures/sessionTapes/perf-tape-replay.jsonl
new file mode 100644
index 00000000000..bc2b0bc9db2
--- /dev/null
+++ b/tests/e2e/fixtures/sessionTapes/perf-tape-replay.jsonl
@@ -0,0 +1,12 @@
+{"tape":3,"xumVersion":"synthetic","tapeId":"synthetic-tape","workspaceIdHash":"907ad07f9eb1fd43","startedAt":"2026-05-29T00:00:00.000Z","masking":"none","subscription":{"batchReplay":true,"replayWindow":true,"validateOutput":true}}
+{"t":0,"bytes":846,"event":{"type":"message-batch","messages":[{"id":"msg-replay-user-1","role":"user","parts":[{"type":"text","text":"Replay fixture: how do I list the files in this repo?"}],"createdAt":"2026-10-01T00:00:00.000Z","metadata":{"historySequence":1,"timestamp":1},"type":"message"},{"id":"msg-replay-assistant-1","role":"assistant","parts":[{"type":"text","text":"Replay fixture: run git ls-files from the repository root."}],"createdAt":"2026-10-01T00:00:00.000Z","metadata":{"historySequence":2,"timestamp":2,"model":"anthropic:claude-opus-5-5","usage":{"inputTokens":120,"outputTokens":40,"totalTokens":160}},"type":"message"},{"id":"msg-replay-user-2","role":"user","parts":[{"type":"text","text":"Replay fixture: check the marker command please."}],"createdAt":"2026-10-01T00:00:00.000Z","metadata":{"historySequence":3,"timestamp":3},"type":"message"}]},"meta":[["date","messages",0,"createdAt"],["date","messages",1,"createdAt"],["date","messages",2,"createdAt"]]}
+{"t":40,"bytes":69,"event":{"type":"caught-up","replay":"full","historyReplayStatus":"complete"}}
+{"t":80,"bytes":150,"event":{"type":"stream-start","workspaceId":"7a9e0c3d51","messageId":"msg-replay-live","model":"anthropic:claude-opus-5-5","historySequence":4,"startTime":4}}
+{"t":120,"bytes":136,"event":{"type":"reasoning-delta","workspaceId":"7a9e0c3d51","messageId":"msg-replay-live","delta":"Check the marker.","tokens":4,"timestamp":5}}
+{"t":160,"bytes":81,"event":{"type":"reasoning-end","workspaceId":"7a9e0c3d51","messageId":"msg-replay-live"}}
+{"t":200,"bytes":148,"event":{"type":"stream-delta","workspaceId":"7a9e0c3d51","messageId":"msg-replay-live","delta":"Running the marker command now. ","tokens":6,"timestamp":6}}
+{"t":240,"bytes":211,"event":{"type":"tool-call-start","workspaceId":"7a9e0c3d51","messageId":"msg-replay-live","toolCallId":"call-replay-marker","toolName":"bash","args":{"script":"xum-tape-replay-marker --check"},"tokens":8,"timestamp":7}}
+{"t":280,"bytes":207,"event":{"type":"tool-call-end","workspaceId":"7a9e0c3d51","messageId":"msg-replay-live","toolCallId":"call-replay-marker","toolName":"bash","result":{"success":true,"output":"marker ok","exitCode":0},"timestamp":8}}
+{"t":320,"bytes":322,"event":{"type":"stream-delta","workspaceId":"7a9e0c3d51","messageId":"msg-replay-live","delta":"Replay fixture final reply: the marker command finished.\n\n![remote probe](https://replay-egress-probe.invalid/replay-egress-probe.png)\n\n![loopback probe](http://127.0.0.1:47999/replay-egress-probe.png)","tokens":20,"timestamp":9}}
+{"t":360,"bytes":773,"event":{"type":"stream-end","workspaceId":"7a9e0c3d51","messageId":"msg-replay-live","metadata":{"model":"anthropic:claude-opus-5-5","usage":{"inputTokens":120,"outputTokens":40,"totalTokens":160},"historySequence":4},"parts":[{"type":"reasoning","text":"Check the marker."},{"type":"text","text":"Running the marker command now. "},{"type":"dynamic-tool","toolCallId":"call-replay-marker","toolName":"bash","input":{"script":"xum-tape-replay-marker --check"},"state":"output-available","output":{"success":true,"output":"marker ok","exitCode":0}},{"type":"text","text":"Replay fixture final reply: the marker command finished.\n\n![remote probe](https://replay-egress-probe.invalid/replay-egress-probe.png)\n\n![loopback probe](http://127.0.0.1:47999/replay-egress-probe.png)"}]}}
+{"t":361,"end":{"reason":"closed","truncated":false,"droppedEvents":0}}
diff --git a/tests/e2e/fixtures/sessionTapes/tapeReplayFixture.ts b/tests/e2e/fixtures/sessionTapes/tapeReplayFixture.ts
new file mode 100644
index 00000000000..65e49d73c23
--- /dev/null
+++ b/tests/e2e/fixtures/sessionTapes/tapeReplayFixture.ts
@@ -0,0 +1,145 @@
+/**
+ * Synthetic session tape for the `perf.tapeReplay` scenario. The committed
+ * `perf-tape-replay.jsonl` next to this file is `buildTapeReplayFixtureTape()`'s output
+ * (regenerate with `bun scripts/perf/generateTapeReplayFixture.ts`; a unit test guards drift).
+ * Synthetic only: real tapes hold full chat content and must never become fixtures.
+ *
+ * Content: a history batch, caught-up, then one streamed turn with reasoning, a tool call and a
+ * final reply whose markdown embeds two probe images (one remote, one loopback). The scenario
+ * proves the renderer egress block cancels both. The tool call's command is a marker that is not
+ * a shell builtin, so a process trace would show it if replay ever executed a tool.
+ */
+import { WorkspaceChatMessageSchema } from "@/common/orpc/schemas";
+import type { WorkspaceChatMessage } from "@/common/orpc/types";
+import { buildSyntheticSessionTape } from "@/node/services/sessionTapes/sessionTapes.testFixtures";
+
+/** Stable-format (10 hex) id the scenario registers its workspace under. */
+export const TAPE_REPLAY_FIXTURE_WORKSPACE_ID = "7a9e0c3d51";
+export const TAPE_REPLAY_FIXTURE_FILE_NAME = "perf-tape-replay.jsonl";
+
+export const TAPE_REPLAY_PROBE_URLS = [
+  "https://replay-egress-probe.invalid/replay-egress-probe.png",
+  "http://127.0.0.1:47999/replay-egress-probe.png",
+] as const;
+
+export const TAPE_REPLAY_TEXTS = {
+  historyUser: "Replay fixture: how do I list the files in this repo?",
+  historyAssistant: "Replay fixture: run git ls-files from the repository root.",
+  liveUser: "Replay fixture: check the marker command please.",
+  liveText: "Running the marker command now. ",
+  markerCommand: "xum-tape-replay-marker --check",
+  finalReply: "Replay fixture final reply: the marker command finished.",
+} as const;
+
+/** Recorded offset of event `index`: 40 ms apart, like a brisk live stream. */
+const EVENT_SPACING_MS = 40;
+
+function buildTapeReplayFixtureEvents(): WorkspaceChatMessage[] {
+  const workspaceId = TAPE_REPLAY_FIXTURE_WORKSPACE_ID;
+  const createdAt = new Date("2026-10-01T00:00:00.000Z");
+  const model = "anthropic:claude-opus-5-5";
+  const usage = { inputTokens: 120, outputTokens: 40, totalTokens: 160 };
+  const messageId = "msg-replay-live";
+  const toolCallId = "call-replay-marker";
+  const toolInput = { script: TAPE_REPLAY_TEXTS.markerCommand };
+  const toolOutput = { success: true, output: "marker ok", exitCode: 0 };
+  const finalMarkdown = [
+    TAPE_REPLAY_TEXTS.finalReply,
+    "",
+    `![remote probe](${TAPE_REPLAY_PROBE_URLS[0]})`,
+    "",
+    `![loopback probe](${TAPE_REPLAY_PROBE_URLS[1]})`,
+  ].join("\n");
+  const userRow = (id: string, text: string, historySequence: number) => ({
+    type: "message",
+    id,
+    role: "user",
+    createdAt,
+    parts: [{ type: "text", text }],
+    metadata: { historySequence, timestamp: historySequence },
+  });
+  const raw: unknown[] = [
+    {
+      type: "message-batch",
+      messages: [
+        userRow("msg-replay-user-1", TAPE_REPLAY_TEXTS.historyUser, 1),
+        {
+          type: "message",
+          id: "msg-replay-assistant-1",
+          role: "assistant",
+          createdAt,
+          parts: [{ type: "text", text: TAPE_REPLAY_TEXTS.historyAssistant }],
+          metadata: { historySequence: 2, timestamp: 2, model, usage },
+        },
+        userRow("msg-replay-user-2", TAPE_REPLAY_TEXTS.liveUser, 3),
+      ],
+    },
+    { type: "caught-up", replay: "full", historyReplayStatus: "complete" },
+    { type: "stream-start", workspaceId, messageId, model, historySequence: 4, startTime: 4 },
+    {
+      type: "reasoning-delta",
+      workspaceId,
+      messageId,
+      delta: "Check the marker.",
+      tokens: 4,
+      timestamp: 5,
+    },
+    { type: "reasoning-end", workspaceId, messageId },
+    {
+      type: "stream-delta",
+      workspaceId,
+      messageId,
+      delta: TAPE_REPLAY_TEXTS.liveText,
+      tokens: 6,
+      timestamp: 6,
+    },
+    {
+      type: "tool-call-start",
+      workspaceId,
+      messageId,
+      toolCallId,
+      toolName: "bash",
+      args: toolInput,
+      tokens: 8,
+      timestamp: 7,
+    },
+    {
+      type: "tool-call-end",
+      workspaceId,
+      messageId,
+      toolCallId,
+      toolName: "bash",
+      result: toolOutput,
+      timestamp: 8,
+    },
+    { type: "stream-delta", workspaceId, messageId, delta: finalMarkdown, tokens: 20, timestamp: 9 },
+    {
+      type: "stream-end",
+      workspaceId,
+      messageId,
+      metadata: { model, usage, historySequence: 4 },
+      parts: [
+        { type: "reasoning", text: "Check the marker." },
+        { type: "text", text: TAPE_REPLAY_TEXTS.liveText },
+        {
+          type: "dynamic-tool",
+          toolCallId,
+          toolName: "bash",
+          state: "output-available",
+          input: toolInput,
+          output: toolOutput,
+        },
+        { type: "text", text: finalMarkdown },
+      ],
+    },
+  ];
+  return raw.map((event) => WorkspaceChatMessageSchema.parse(event));
+}
+
+/** The committed fixture's exact text. */
+export function buildTapeReplayFixtureTape(): string {
+  return buildSyntheticSessionTape(buildTapeReplayFixtureEvents(), {
+    workspaceId: TAPE_REPLAY_FIXTURE_WORKSPACE_ID,
+    offsetMs: (index) => index * EVENT_SPACING_MS,
+  });
+}
diff --git a/tests/e2e/scenarios/perf.tapeReplay.spec.ts b/tests/e2e/scenarios/perf.tapeReplay.spec.ts
new file mode 100644
index 00000000000..e1148fc9ded
--- /dev/null
+++ b/tests/e2e/scenarios/perf.tapeReplay.spec.ts
@@ -0,0 +1,175 @@
+/**
+ * perf.tapeReplay: replay a committed synthetic session tape through the real desktop app
+ * (backend onChat replay source -> MessagePort oRPC -> WorkspaceStore -> React) and time it.
+ *
+ * The app runs in session tape replay mode (XUM_REPLAY_TAPES): the demo workspace is registered
+ * under the fixture's workspace id, its onChat stream comes from the tape, the renderer cannot
+ * reach the network, and sends are refused. Inherited provider credentials are stripped from the
+ * launch environment, so even a bug in the read-only gates could not reach a provider.
+ */
+import fs from "fs";
+import path from "path";
+import type { Request } from "@playwright/test";
+import { loadSessionTape, summarizeSessionTape } from "@/common/utils/sessionTapes/sessionTapeLoader";
+import { electronTest, electronExpect as expect } from "../electronTest";
+import { getXumE2EEnv } from "../env";
+import {
+  TAPE_REPLAY_FIXTURE_FILE_NAME,
+  TAPE_REPLAY_FIXTURE_WORKSPACE_ID,
+  TAPE_REPLAY_PROBE_URLS,
+  TAPE_REPLAY_TEXTS,
+} from "../fixtures/sessionTapes/tapeReplayFixture";
+import type { DemoProjectConfig } from "../utils/demoProject";
+import {
+  readPageMilestones,
+  startPageMilestones,
+  type PageMilestones,
+} from "../utils/pageMilestones";
+import {
+  readReactProfileSnapshot,
+  resetReactProfileSamples,
+  withChromeProfiles,
+  writePerfArtifacts,
+} from "../utils/perfProfile";
+
+const shouldRunPerfScenarios = getXumE2EEnv("E2E_RUN_PERF") === "1";
+const FIXTURE_PATH = path.resolve(
+  __dirname,
+  "..",
+  "fixtures",
+  "sessionTapes",
+  TAPE_REPLAY_FIXTURE_FILE_NAME
+);
+/** Generic credential shapes (provider keys, gateway tokens, endpoint overrides). */
+const CREDENTIAL_ENV_PATTERN = /_API_KEY$|_AUTH_TOKEN$|_BASE_URL$/;
+
+/**
+ * Give the demo workspace the fixture's id: the replay source refuses a tape whose header hash
+ * does not match the mapped workspace. Config entries with an id and a name are read as-is.
+ */
+function registerFixtureWorkspace(demoProject: DemoProjectConfig): void {
+  const config = JSON.parse(fs.readFileSync(demoProject.configPath, "utf-8")) as {
+    projects: Array<[string, { workspaces: Array<{ path: string; id?: string; name?: string }> }]>;
+  };
+  const entry = config.projects.find(([projectPath]) => projectPath === demoProject.projectPath);
+  const workspace = entry?.[1].workspaces.find((ws) => ws.path === demoProject.workspacePath);
+  if (!workspace) throw new Error("Demo workspace is missing from config.json");
+  workspace.id = TAPE_REPLAY_FIXTURE_WORKSPACE_ID;
+  workspace.name = path.basename(demoProject.workspacePath);
+  fs.writeFileSync(demoProject.configPath, JSON.stringify(config, null, 2));
+  fs.mkdirSync(path.join(demoProject.sessionsDir, TAPE_REPLAY_FIXTURE_WORKSPACE_ID), {
+    recursive: true,
+  });
+}
+
+const test = electronTest.extend({
+  workspace: async ({ workspace }, use) => {
+    registerFixtureWorkspace(workspace.demoProject);
+    // The app fixture copies process.env into the Electron environment at launch.
+    const savedEnv = new Map<string, string | undefined>();
+    const setEnv = (key: string, value: string | undefined) => {
+      if (!savedEnv.has(key)) savedEnv.set(key, process.env[key]);
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    };
+    for (const key of Object.keys(process.env)) {
+      if (CREDENTIAL_ENV_PATTERN.test(key)) setEnv(key, undefined);
+    }
+    setEnv("MUX_REPLAY_TAPES", undefined);
+    setEnv(
+      "XUM_REPLAY_TAPES",
+      JSON.stringify({ [TAPE_REPLAY_FIXTURE_WORKSPACE_ID]: FIXTURE_PATH })
+    );
+    try {
+      await use(workspace);
+    } finally {
+      for (const [key, value] of savedEnv) {
+        if (value === undefined) delete process.env[key];
+        else process.env[key] = value;
+      }
+    }
+  },
+});
+
+test.skip(
+  ({ browserName }) => browserName !== "chromium",
+  "Electron scenario runs on chromium only"
+);
+
+test.describe("session tape replay performance profiling", () => {
+  test.skip(!shouldRunPerfScenarios, "Set XUM_E2E_RUN_PERF=1 to run perf profiling scenarios");
+
+  test("perf: replay a synthetic session tape", async ({ page, ui }, testInfo) => {
+    const tape = loadSessionTape(fs.readFileSync(FIXTURE_PATH, "utf-8"));
+    if (tape.status !== "ok") throw new Error(`Fixture tape is not ok: ${tape.status}`);
+    const tapeSummary = summarizeSessionTape(tape);
+
+    // Every probe image request must fail at the egress block; none may finish.
+    const isProbe = (request: Request) =>
+      (TAPE_REPLAY_PROBE_URLS as readonly string[]).includes(request.url());
+    const probeFailures: Array<{ url: string; errorText: string }> = [];
+    const probesFinished: string[] = [];
+    page.on("requestfailed", (request) => {
+      if (isProbe(request)) {
+        probeFailures.push({ url: request.url(), errorText: request.failure()?.errorText ?? "" });
+      }
+    });
+    page.on("requestfinished", (request) => {
+      if (isProbe(request)) probesFinished.push(request.url());
+    });
+
+    await resetReactProfileSamples(page);
+    const transcript = page.getByRole("log", { name: "Conversation transcript" });
+    const runLabel = "tape-replay";
+    let milestones: PageMilestones | undefined;
+    let firstRowMs = 0;
+    let lastRowMs = 0;
+    const chromeProfile = await withChromeProfiles(page, { label: runLabel }, async () => {
+      await startPageMilestones(page);
+      const startedAt = performance.now();
+      await ui.projects.openFirstWorkspace();
+      await expect(transcript).toContainText(TAPE_REPLAY_TEXTS.historyUser, { timeout: 20_000 });
+      firstRowMs = performance.now() - startedAt;
+      await expect(transcript).toContainText(TAPE_REPLAY_TEXTS.finalReply, { timeout: 20_000 });
+      lastRowMs = performance.now() - startedAt;
+      milestones = await readPageMilestones(page);
+    });
+    if (!milestones) throw new Error("Page milestones were not captured");
+
+    await expect(transcript).toContainText(TAPE_REPLAY_TEXTS.historyAssistant);
+    await expect(transcript).toContainText(TAPE_REPLAY_TEXTS.liveText.trim());
+    await expect(transcript).toContainText(TAPE_REPLAY_TEXTS.markerCommand);
+
+    await expect
+      .poll(() => probeFailures.map((failure) => failure.url).sort(), { timeout: 10_000 })
+      .toEqual([...TAPE_REPLAY_PROBE_URLS].sort());
+    for (const failure of probeFailures) {
+      expect(failure.errorText).toContain("ERR_BLOCKED_BY_CLIENT");
+    }
+    expect(probesFinished).toEqual([]);
+
+    // Replay mode is read-only: a send is refused with the backend's message.
+    await ui.chat.sendMessage("Replay fixture: this send must be refused.");
+    await expect(page.getByText(/read-only/).first()).toBeVisible({ timeout: 10_000 });
+
+    const reactProfileSnapshot = await readReactProfileSnapshot(page);
+    if (!reactProfileSnapshot) throw new Error("React profile snapshot was not captured");
+    const artifactDirectory = await writePerfArtifacts({
+      testInfo,
+      runLabel,
+      chromeProfile,
+      reactProfile: reactProfileSnapshot,
+      historyProfile: null,
+      milestones,
+      tapeReplay: {
+        eventCount: tapeSummary.eventCount,
+        durationMs: tapeSummary.durationMs,
+        firstRowMs,
+        lastRowMs,
+        blockedRequests: probeFailures.length,
+      },
+    });
+    expect(chromeProfile.wallTimeMs).toBeGreaterThan(0);
+    testInfo.annotations.push({ type: "perf-artifact", description: artifactDirectory });
+  });
+});
diff --git a/tests/e2e/utils/perfProfile.ts b/tests/e2e/utils/perfProfile.ts
index 3cec1a5788f..387a850a2ff 100644
--- a/tests/e2e/utils/perfProfile.ts
+++ b/tests/e2e/utils/perfProfile.ts
@@ -270,6 +270,19 @@ export async function readReactProfileSnapshot(
   });
 }
 
+export interface TapeReplayPerfSummary {
+  /** Events on the replayed tape. */
+  eventCount: number;
+  /** The tape's recorded duration (trailer offset). */
+  durationMs: number;
+  /** From the workspace click until the first history row rendered. */
+  firstRowMs: number;
+  /** From the workspace click until the streamed turn's final text rendered. */
+  lastRowMs: number;
+  /** Probe image requests the renderer egress block cancelled. */
+  blockedRequests: number;
+}
+
 async function writeJsonFile(filePath: string, payload: unknown): Promise<void> {
   await fsPromises.writeFile(filePath, JSON.stringify(payload, null, 2), "utf-8");
 }
@@ -284,6 +297,8 @@ export async function writePerfArtifacts(args: {
   milestones?: PageMilestones;
   /** Per-switch chat-switch timings and medians (perf.chatSwitch.spec.ts, #4504). */
   chatSwitch?: ChatSwitchPerfSummary;
+  /** Session tape replay timings (perf.tapeReplay.spec.ts). */
+  tapeReplay?: TapeReplayPerfSummary;
 }): Promise<string> {
   const timestamp = new Date().toISOString().replace(/[.:]/g, "-");
   const runDirName = `${sanitizeForPath(args.runLabel)}-${timestamp}`;
@@ -318,6 +333,7 @@ export async function writePerfArtifacts(args: {
     // Additive field: schemaVersion stays 1 because existing readers ignore unknown keys.
     ...(args.milestones ? { milestones: args.milestones } : {}),
     ...(args.chatSwitch ? { chatSwitch: args.chatSwitch } : {}),
+    ...(args.tapeReplay ? { tapeReplay: args.tapeReplay } : {}),
     chromeProfile: {
       label: args.chromeProfile.label,
       startedAt: args.chromeProfile.startedAt,

From 06bb189ddfc27b66876b3a9179a38562850d5c46 Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 08:02:32 +0000
Subject: [PATCH 03/18] test(sessionTapes): cover the read-side hardening
 (#5587)

Signed-off-by: Thomas Kosiewski <tk@coder.com>
---
 .../sessionTapes/sessionTapeReplay.test.ts    | 134 +++++++++++++++++-
 1 file changed, 133 insertions(+), 1 deletion(-)

diff --git a/src/node/services/sessionTapes/sessionTapeReplay.test.ts b/src/node/services/sessionTapes/sessionTapeReplay.test.ts
index 66308a2b523..db865cae7c1 100644
--- a/src/node/services/sessionTapes/sessionTapeReplay.test.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplay.test.ts
@@ -10,6 +10,7 @@ import * as http from "node:http";
 import * as https from "node:https";
 import * as net from "node:net";
 import * as path from "node:path";
+import { spawnSync } from "node:child_process";
 import { StreamingMessageAggregator } from "@/browser/utils/messages/StreamingMessageAggregator";
 import { applyWorkspaceChatEventToAggregator } from "@/browser/utils/messages/applyWorkspaceChatEventToAggregator";
 import { MUX_GATEWAY_SESSION_EXPIRED_MESSAGE } from "@/common/constants/muxGatewayOAuth";
@@ -22,7 +23,12 @@ import {
 } from "@/common/utils/sessionTapes/sessionTapeLoader";
 import { replaySessionTape } from "@/common/utils/sessionTapes/sessionTapeReplay";
 import { DisposableTempDir } from "@/node/services/tempDir";
-import { flushSessionTapes, maybeRecordWorkspaceChat } from "./sessionTapeRecorder";
+import {
+  flushSessionTapes,
+  hashSessionTapeWorkspaceId,
+  maybeRecordWorkspaceChat,
+  SESSION_TAPE_CAP_BYTES,
+} from "./sessionTapeRecorder";
 import { readSessionTapeFile } from "./sessionTapeFile";
 import {
   buildSyntheticSessionTape,
@@ -188,6 +194,19 @@ describe("loadSessionTape", () => {
       3,
       true,
     ],
+    [
+      // Parses, but validating or re-encoding it overflows the stack (RangeError), which must
+      // reject the tape instead of throwing to the caller.
+      "an event nested too deep to validate",
+      (lines) => {
+        const depth = 200_000;
+        const deep = "[".repeat(depth) + "]".repeat(depth);
+        lines[2] = `{"t":20,"bytes":1,"event":{"type":"stream-delta","nested":${deep}}}`;
+      },
+      "event could not be validated",
+      3,
+      true,
+    ],
     [
       "offset going backwards",
       (lines) => patchLine(lines, 3, (line) => (line.t = 0)),
@@ -210,6 +229,81 @@ describe("loadSessionTape", () => {
     expect(result.header?.tapeId).toBe(headerKept ? loadedHeader.tapeId : undefined);
   });
 
+  test("the recorder hashes the trimmed workspace id, as replay looks it up", async () => {
+    using root = new DisposableTempDir("session-tape-padded-id");
+    async function* source() {
+      await Promise.resolve();
+      yield events[0];
+    }
+    const recorded = maybeRecordWorkspaceChat(
+      { aiService: { isExperimentEnabled: () => true }, config: { rootDir: root.path } },
+      { workspaceId: "  ws-1\n", validateOutput: true },
+      source()
+    );
+    for await (const _event of recorded) {
+      // drain
+    }
+    await flushSessionTapes();
+    const dir = path.join(root.path, "perf", "tapes");
+    const [name] = await fs.readdir(dir);
+    const result = expectLoaded(await readSessionTapeFile(path.join(dir, name)));
+    expect(result.header.workspaceIdHash).toBe(
+      createHash("sha256").update("ws-1").digest("hex").slice(0, 16)
+    );
+    expect(hashSessionTapeWorkspaceId(" ws-1 ")).toBe(result.header.workspaceIdHash);
+  });
+
+  test("the file reader refuses a FIFO without blocking on it", async () => {
+    using dir = new DisposableTempDir("session-tape-fifo");
+    const fifoPath = path.join(dir.path, "tape.jsonl");
+    // Reading a FIFO with no writer blocks forever; the reader must stat first.
+    expect(spawnSync("mkfifo", [fifoPath]).status).toBe(0);
+    expect(await readSessionTapeFile(fifoPath)).toMatchObject({
+      status: "rejected",
+      reason: "not a regular file",
+    });
+  });
+
+  test("the file reader refuses files larger than the recorder's tape cap unread", async () => {
+    using dir = new DisposableTempDir("session-tape-oversized");
+    const bigPath = path.join(dir.path, "tape.jsonl");
+    await fs.writeFile(bigPath, tape);
+    // Sparse: grows the file past the cap without writing the bytes.
+    await fs.truncate(bigPath, SESSION_TAPE_CAP_BYTES + 1);
+    const readSpy = spyOn(fs, "readFile");
+    try {
+      const result = await readSessionTapeFile(bigPath);
+      expect(result).toMatchObject({ status: "rejected" });
+      expect(result.status === "rejected" && result.reason).toContain("tape cap");
+      expect(readSpy.mock.calls.some(([file]) => file === bigPath)).toBe(false);
+    } finally {
+      readSpy.mockRestore();
+    }
+  });
+
+  test("the file reader refuses malformed UTF-8 instead of decoding it to replacement characters", async () => {
+    using dir = new DisposableTempDir("session-tape-utf8");
+    const delta = WorkspaceChatMessageSchema.parse({
+      type: "stream-delta",
+      workspaceId: "ws-1",
+      messageId: "msg-1",
+      delta: "a\uFFFDb",
+      tokens: 1,
+      timestamp: 1,
+    });
+    const bytes = Buffer.from(buildSyntheticSessionTape([delta]));
+    // U+FFFD (EF BF BD) -> a truncated 4-byte sequence (F0 9F 98): a lenient decoder turns it
+    // back into exactly one U+FFFD, so the edited file would load as the original tape.
+    const at = bytes.indexOf(Buffer.from([0xef, 0xbf, 0xbd]));
+    expect(at).toBeGreaterThan(0);
+    bytes.set([0xf0, 0x9f, 0x98], at);
+    const filePath = path.join(dir.path, "tape.jsonl");
+    await fs.writeFile(filePath, bytes);
+    const result = await readSessionTapeFile(filePath);
+    expect(result).toMatchObject({ status: "rejected" });
+    expect(result.status === "rejected" && result.reason).toContain("unreadable");
+  });
+
   test("the file reader refuses unfinished temp files even when their content is valid", async () => {
     using dir = new DisposableTempDir("session-tape-temp-name");
     const tempPath = path.join(dir.path, "tape.jsonl.0123456789ab");
@@ -261,6 +355,44 @@ describe("replaySessionTape", () => {
     expect((await replay.next()).done).toBe(true);
   });
 
+  test("recorded pacing waits longer than the timer limit in chunks, against the deadline", async () => {
+    // setTimeout fires at once for delays above 2^31-1 ms (about 24.8 days).
+    const maxDelayMs = 2 ** 31 - 1;
+    const farOffsetMs = maxDelayMs + 5_000;
+    const farTape = expectLoaded(
+      loadSessionTape(
+        buildSyntheticSessionTape(events.slice(0, 2), {
+          offsetMs: (index) => (index === 0 ? 0 : farOffsetMs),
+        })
+      )
+    );
+    jest.useFakeTimers();
+    const delays: number[] = [];
+    const realSetTimeout = globalThis.setTimeout;
+    const timeoutSpy = spyOn(globalThis, "setTimeout").mockImplementation(((
+      handler: () => void,
+      ms?: number
+    ) => {
+      delays.push(ms ?? 0);
+      return realSetTimeout(handler, ms);
+    }) as typeof setTimeout);
+    try {
+      const replay = replaySessionTape(farTape, { pacing: "recorded" });
+      await replay.next();
+      const far = replay.next();
+      expect(await settles(far)).toBe(false);
+      fakeTimers.advanceTimersByTime(maxDelayMs);
+      expect(await settles(far)).toBe(false);
+      fakeTimers.advanceTimersByTime(5_000);
+      expect(await settles(far)).toBe(true);
+      expect((await far).value).toEqual(events[1]);
+      expect(delays.length).toBeGreaterThan(1);
+      expect(delays.every((ms) => ms <= maxDelayMs)).toBe(true);
+    } finally {
+      timeoutSpy.mockRestore();
+    }
+  });
+
   test("fast pacing yields every event in order without waiting", async () => {
     // Fake timers never advance here, so any wait leaves a pull pending. Checking each pull with
     // `settles` makes that a failure: awaiting it would hang the whole run (bun's test timeout

From 3e6b8604cd226c6009baa789f87d35db409828ce Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 08:05:31 +0000
Subject: [PATCH 04/18] test(sessionTapes): cover the replay source and the
 read-only replay mode

Signed-off-by: Thomas Kosiewski <tk@coder.com>
---
 .../sessionTapeReplaySource.test.ts           | 353 ++++++++++++++++++
 1 file changed, 353 insertions(+)
 create mode 100644 src/node/services/sessionTapes/sessionTapeReplaySource.test.ts

diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
new file mode 100644
index 00000000000..3f42bfa6b29
--- /dev/null
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
@@ -0,0 +1,353 @@
+/**
+ * Session tape replay mode (XUM_REPLAY_TAPES): the onChat replay source behind the real router
+ * entry point, and the process-wide read-only gates (WorkspaceService write funnels, provider
+ * model creation). Synthetic tapes only.
+ */
+import { afterEach, beforeAll, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { randomUUID } from "node:crypto";
+import { Effect } from "effect";
+import { TestClock } from "effect/testing";
+import { createMuxMessage } from "@/common/types/message";
+import type { WorkspaceChatMessage } from "@/common/orpc/types";
+import { loadSessionTape } from "@/common/utils/sessionTapes/sessionTapeLoader";
+import {
+  isSessionTapeReplayRefusal,
+  SESSION_TAPE_REPLAY_REFUSAL_DATA,
+} from "@/common/utils/sessionTapes/sessionTapeReplay";
+import type { ORPCContext } from "@/node/orpc/context";
+import { subscribeWorkspaceChat } from "@/node/orpc/routerSubscriptions";
+import { Config } from "@/node/config";
+import { ProvidersConfigStore } from "@/node/config/providersConfigStore";
+import { disposeAppRuntime, makeAppRuntime } from "@/node/services/di/appRuntime";
+import { createEvaluationModel } from "@/node/services/evaluationModelFactory";
+import { ProviderModelFactory } from "@/node/services/providerModelFactory";
+import { ProviderService } from "@/node/services/providerService";
+import { DisposableTempDir } from "@/node/services/tempDir";
+import { createTestHistoryService } from "@/node/services/testHistoryService";
+import { createWorkspaceServiceForTest } from "@/node/services/workspaceService.testHarness";
+import {
+  markSessionTapeReplayEgressBlocked,
+  SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE,
+} from "./sessionTapeReplaySource";
+import { buildSyntheticSessionTape, syntheticReplayTranscript } from "./sessionTapes.testFixtures";
+
+const ENV_KEYS = ["XUM_REPLAY_TAPES", "MUX_REPLAY_TAPES"] as const;
+const savedEnv = new Map<string, string | undefined>();
+
+function setReplayTapes(value: string | undefined): void {
+  if (value === undefined) delete process.env.XUM_REPLAY_TAPES;
+  else process.env.XUM_REPLAY_TAPES = value;
+}
+
+beforeEach(() => {
+  for (const key of ENV_KEYS) {
+    savedEnv.set(key, process.env[key]);
+    delete process.env[key];
+  }
+});
+
+afterEach(() => {
+  for (const [key, value] of savedEnv) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+});
+
+/** A router context with no services: replay must never reach the workspace's session. */
+function createContext(app: ReturnType<typeof makeAppRuntime>) {
+  const sessionRequests: string[] = [];
+  const context = {
+    "effect/context": app.context,
+    workspaceService: {
+      getOrCreateSession: (workspaceId: string) => {
+        sessionRequests.push(workspaceId);
+        throw new Error("live session requested");
+      },
+    },
+  } as unknown as ORPCContext;
+  return { context, sessionRequests };
+}
+
+/** Whether `promise` settles within `ms` of real time. */
+async function settlesWithin(promise: Promise<unknown>, ms: number): Promise<boolean> {
+  let settled = false;
+  void promise.then(
+    () => (settled = true),
+    () => (settled = true)
+  );
+  await new Promise((resolve) => setTimeout(resolve, ms));
+  return settled;
+}
+
+describe("onChat replay source", () => {
+  const workspaceId = "ws-replay";
+  const events = syntheticReplayTranscript(workspaceId);
+  let app: ReturnType<typeof makeAppRuntime>;
+
+  beforeAll(() => {
+    // Desktop main does this after installing the renderer egress block.
+    markSessionTapeReplayEgressBlocked();
+  });
+  beforeEach(() => {
+    // A TestClock keeps the transport heartbeat out of the delivered sequence.
+    app = makeAppRuntime(TestClock.layer());
+  });
+  afterEach(async () => {
+    await disposeAppRuntime(app.managed);
+  });
+
+  async function writeTape(dir: DisposableTempDir, text: string): Promise<string> {
+    const tapePath = path.join(dir.path, `${randomUUID()}.jsonl`);
+    await fs.writeFile(tapePath, text);
+    return tapePath;
+  }
+
+  test("plays a mapped workspace's tape in recorded order without the session, then stays open", async () => {
+    using dir = new DisposableTempDir("session-tape-replay-source");
+    const tapePath = await writeTape(
+      dir,
+      buildSyntheticSessionTape(events, { workspaceId, offsetMs: (index) => index * 5 })
+    );
+    setReplayTapes(JSON.stringify({ [workspaceId]: tapePath }));
+    const { context, sessionRequests } = createContext(app);
+    const controller = new AbortController();
+    // A padded id resolves to the same workspace, as the session layer would.
+    const iterator = subscribeWorkspaceChat(
+      context,
+      { workspaceId: ` ${workspaceId} `, mode: { type: "full" } },
+      controller.signal,
+      { validateOutput: true }
+    );
+    try {
+      const delivered: WorkspaceChatMessage[] = [];
+      while (delivered.length < events.length) {
+        const next = await iterator.next();
+        if (next.done) throw new Error("replay ended before the last event");
+        delivered.push(next.value);
+      }
+      const loaded = loadSessionTape(await fs.readFile(tapePath, "utf-8"));
+      if (loaded.status !== "ok") throw new Error(`fixture tape is ${loaded.status}`);
+      expect(delivered).toEqual(loaded.events.map((entry) => entry.event));
+      // Still open after the last event: the renderer must not resubscribe and replay again.
+      const after = iterator.next();
+      expect(await settlesWithin(after, 50)).toBe(false);
+      controller.abort();
+      expect((await after).done).toBe(true);
+      expect(sessionRequests).toEqual([]);
+    } finally {
+      controller.abort();
+      await iterator.return(undefined);
+    }
+  });
+
+  const tapeFor = (id: string, options: Parameters<typeof buildSyntheticSessionTape>[1] = {}) =>
+    buildSyntheticSessionTape(syntheticReplayTranscript(id), { workspaceId: id, ...options });
+
+  test.each<
+    [
+      string,
+      (dir: DisposableTempDir) => Promise<{ map: string; mode?: "since" | "live" }>,
+      RegExp,
+    ]
+  >([
+    ["an unparseable map", () => Promise.resolve({ map: "{not json" }), /not valid JSON/],
+    [
+      "a relative tape path",
+      () => Promise.resolve({ map: JSON.stringify({ [workspaceId]: "tape.jsonl" }) }),
+      /must be absolute/,
+    ],
+    [
+      "a tape recorded for another workspace",
+      async (dir) => ({
+        map: JSON.stringify({ [workspaceId]: await writeTape(dir, tapeFor("ws-other")) }),
+      }),
+      /recorded for another workspace/,
+    ],
+    [
+      "a truncated tape",
+      async (dir) => ({
+        map: JSON.stringify({
+          [workspaceId]: await writeTape(
+            dir,
+            tapeFor(workspaceId, { end: { reason: "closed", truncated: true, droppedEvents: 1 } })
+          ),
+        }),
+      }),
+      /is truncated/,
+    ],
+    [
+      "a stopped tape",
+      async (dir) => ({
+        map: JSON.stringify({
+          [workspaceId]: await writeTape(dir, tapeFor(workspaceId, { end: { reason: "stopped" } })),
+        }),
+      }),
+      /is stopped/,
+    ],
+    [
+      "a since subscription",
+      async (dir) => ({
+        map: JSON.stringify({ [workspaceId]: await writeTape(dir, tapeFor(workspaceId)) }),
+        mode: "since",
+      }),
+      /reload to replay/,
+    ],
+    [
+      "a live subscription",
+      async (dir) => ({
+        map: JSON.stringify({ [workspaceId]: await writeTape(dir, tapeFor(workspaceId)) }),
+        mode: "live",
+      }),
+      /reload to replay/,
+    ],
+  ])("refuses %s with a terminal refusal, never the live session", async (_name, setup, message) => {
+    using dir = new DisposableTempDir("session-tape-replay-refusal");
+    const { map, mode } = await setup(dir);
+    setReplayTapes(map);
+    const { context, sessionRequests } = createContext(app);
+    const controller = new AbortController();
+    const iterator = subscribeWorkspaceChat(
+      context,
+      {
+        workspaceId,
+        mode:
+          mode === "since"
+            ? { type: "since", cursor: { history: { messageId: "m", historySequence: 1 } } }
+            : mode === "live"
+              ? { type: "live" }
+              : undefined,
+      },
+      controller.signal,
+      { validateOutput: true }
+    );
+    try {
+      const error: unknown = await iterator.next().then(
+        () => undefined,
+        (rejection: unknown) => rejection
+      );
+      expect(isSessionTapeReplayRefusal(error)).toBe(true);
+      expect((error as { data?: unknown }).data).toEqual(SESSION_TAPE_REPLAY_REFUSAL_DATA);
+      expect((error as Error).message).toMatch(message);
+      expect(sessionRequests).toEqual([]);
+    } finally {
+      controller.abort();
+      await iterator.return(undefined).catch(() => undefined);
+    }
+  });
+
+  test("refuses to serve a tape before desktop main blocked renderer egress", async () => {
+    using dir = new DisposableTempDir("session-tape-replay-no-egress-block");
+    setReplayTapes(JSON.stringify({ [workspaceId]: await writeTape(dir, tapeFor(workspaceId)) }));
+    // A fresh module instance: no egress block was installed in it (as in `xum server`).
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const fresh = require(`./sessionTapeReplaySource?fresh=${randomUUID()}`) as typeof import("./sessionTapeReplaySource");
+    const replay = fresh.getSessionTapeReplay({ workspaceId });
+    if (!replay) throw new Error("the mapped workspace must get a replay");
+    const pushed: WorkspaceChatMessage[] = [];
+    const error: unknown = await replay.play((event) => pushed.push(event)).then(
+      () => undefined,
+      (rejection: unknown) => rejection
+    );
+    expect(isSessionTapeReplayRefusal(error)).toBe(true);
+    expect((error as Error).message).toMatch(/egress block/);
+    expect(pushed).toEqual([]);
+  });
+
+  test.each<[string, string | undefined]>([
+    ["XUM_REPLAY_TAPES is unset", undefined],
+    ["XUM_REPLAY_TAPES is blank", "  "],
+    ["the workspace is not mapped", JSON.stringify({ "ws-other": "/tapes/other.jsonl" })],
+  ])("takes the live session path when %s", (_name, value) => {
+    setReplayTapes(value);
+    const { context, sessionRequests } = createContext(app);
+    expect(() => subscribeWorkspaceChat(context, { workspaceId }, undefined)).toThrow(
+      "live session requested"
+    );
+    expect(sessionRequests).toEqual([workspaceId]);
+  });
+});
+
+describe("replay mode is read-only", () => {
+  test("every WorkspaceService write funnel refuses and history stays untouched", async () => {
+    const { config, historyService, cleanup } = await createTestHistoryService();
+    const workspaceId = "replay-read-only";
+    try {
+      await historyService.appendToHistory(
+        workspaceId,
+        createMuxMessage("u1", "user", "kept", { historySequence: 0, timestamp: 1 })
+      );
+      const service = createWorkspaceServiceForTest({ config, historyService });
+      // Any non-blank value, even for other workspaces, puts the whole process in replay mode.
+      setReplayTapes(JSON.stringify({ "ws-other": "/tapes/other.jsonl" }));
+      const raw = { type: "unknown", raw: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE };
+      const results = {
+        send: await service.sendMessage(workspaceId, "hello", { model: "anthropic:claude-haiku-4-5" }),
+        resume: await service.resumeStream(workspaceId, { model: "anthropic:claude-haiku-4-5" }),
+        truncate: await service.truncateHistory(workspaceId),
+        reset: await service.resetContext(workspaceId),
+        replace: await service.replaceHistory(
+          workspaceId,
+          createMuxMessage("s1", "assistant", "summary", { compacted: "user" })
+        ),
+        answer: await service.answerAskUserQuestion(workspaceId, "tool-1", { q: "a" }),
+      };
+      expect(results).toEqual({
+        send: { success: false, error: raw },
+        resume: { success: false, error: raw },
+        truncate: { success: false, error: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE },
+        reset: { success: false, error: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE },
+        replace: { success: false, error: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE },
+        answer: { success: false, error: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE },
+      });
+      const history = await historyService.getHistoryFromLatestBoundary(workspaceId);
+      expect(history.success && history.data.map((message) => message.id)).toEqual(["u1"]);
+    } finally {
+      await cleanup();
+    }
+  });
+
+  test("provider model creation refuses in replay mode, in both factories", async () => {
+    using root = new DisposableTempDir("session-tape-replay-models");
+    const providersConfigStore = new ProvidersConfigStore(root.path);
+    providersConfigStore.saveProvidersConfig({
+      anthropic: { apiKey: "sk-test" },
+    } as Parameters<ProvidersConfigStore["saveProvidersConfig"]>[0]);
+    const config = new Config(root.path);
+    const factory = new ProviderModelFactory(
+      config,
+      new ProviderService(config, providersConfigStore),
+      {},
+      undefined,
+      providersConfigStore
+    );
+    const evaluationDeps = { providersConfigStore, env: {} };
+    const model = "anthropic:claude-haiku-4-5";
+    // Control: the same configuration creates models outside replay mode.
+    expect((await factory.createModel(model)).success).toBe(true);
+    expect((await Effect.runPromise(createEvaluationModel(model, evaluationDeps))).success).toBe(
+      true
+    );
+
+    setReplayTapes(JSON.stringify({ "ws-other": "/tapes/other.jsonl" }));
+    expect(await factory.createModel(model)).toEqual({
+      success: false,
+      error: { type: "unknown", raw: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE },
+    });
+    expect(await Effect.runPromise(createEvaluationModel(model, evaluationDeps))).toEqual({
+      success: false,
+      error: { code: "provider_disabled", message: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE },
+    });
+    const configReads = spyOn(providersConfigStore, "loadProvidersConfig");
+    try {
+      expect(await factory.createEvaluationModel(model)).toEqual({
+        success: false,
+        error: { reason: "unsupported-route" },
+      });
+      expect(configReads).not.toHaveBeenCalled();
+    } finally {
+      configReads.mockRestore();
+    }
+  });
+});

From 00248d0e0331d09755e8be39480a610ca103d167 Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 08:06:32 +0000
Subject: [PATCH 05/18] test: cover the session tape egress allowlist, fixture
 drift and the renderer replay paths

Signed-off-by: Thomas Kosiewski <tk@coder.com>
---
 scripts/perf/tapeReplayFixture.test.ts      | 37 ++++++++
 src/browser/stores/WorkspaceStore.test.ts   | 94 +++++++++++++++++++++
 src/desktop/sessionTapeReplayEgress.test.ts | 26 ++++++
 3 files changed, 157 insertions(+)
 create mode 100644 scripts/perf/tapeReplayFixture.test.ts
 create mode 100644 src/desktop/sessionTapeReplayEgress.test.ts

diff --git a/scripts/perf/tapeReplayFixture.test.ts b/scripts/perf/tapeReplayFixture.test.ts
new file mode 100644
index 00000000000..fe64032325d
--- /dev/null
+++ b/scripts/perf/tapeReplayFixture.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import * as path from "node:path";
+import { hashSessionTapeWorkspaceId } from "@/node/services/sessionTapes/sessionTapeRecorder";
+import { readSessionTapeFile } from "@/node/services/sessionTapes/sessionTapeFile";
+import {
+  buildTapeReplayFixtureTape,
+  TAPE_REPLAY_FIXTURE_FILE_NAME,
+  TAPE_REPLAY_FIXTURE_WORKSPACE_ID,
+} from "../../tests/e2e/fixtures/sessionTapes/tapeReplayFixture";
+
+const FIXTURE_PATH = path.join(
+  import.meta.dir,
+  "..",
+  "..",
+  "tests",
+  "e2e",
+  "fixtures",
+  "sessionTapes",
+  TAPE_REPLAY_FIXTURE_FILE_NAME
+);
+
+describe("perf.tapeReplay fixture tape", () => {
+  test("loads as a complete tape recorded for the scenario's workspace id", async () => {
+    const result = await readSessionTapeFile(FIXTURE_PATH);
+    expect(result.status).toBe("ok");
+    if (result.status !== "ok") return;
+    // The replay source refuses a tape whose hash does not match the mapped workspace.
+    expect(result.header.workspaceIdHash).toBe(
+      hashSessionTapeWorkspaceId(TAPE_REPLAY_FIXTURE_WORKSPACE_ID)
+    );
+  });
+
+  test("matches its generator (run bun scripts/perf/generateTapeReplayFixture.ts after edits)", () => {
+    expect(readFileSync(FIXTURE_PATH, "utf-8")).toBe(buildTapeReplayFixtureTape());
+  });
+});
diff --git a/src/browser/stores/WorkspaceStore.test.ts b/src/browser/stores/WorkspaceStore.test.ts
index 8c4fac89336..8312cae70f2 100644
--- a/src/browser/stores/WorkspaceStore.test.ts
+++ b/src/browser/stores/WorkspaceStore.test.ts
@@ -6,7 +6,12 @@ import { createAgentSessionHarness } from "@/node/services/agentSession.testHarn
 import { createWorkspaceServiceForTest } from "@/node/services/workspaceService.testHarness";
 // eslint-disable-next-line local/no-cross-boundary-imports -- exercise the actual IPC replay boundary in this store fixture
 import { subscribeWorkspaceChat } from "@/node/orpc/routerSubscriptions";
+// eslint-disable-next-line local/no-cross-boundary-imports -- the backend's replay mode gate (desktop main sets it)
+import { markSessionTapeReplayEgressBlocked } from "@/node/services/sessionTapes/sessionTapeReplaySource";
 import type { ORPCContext } from "@/node/orpc/context";
+import { CUSTOM_EVENTS } from "@/common/constants/events";
+import { MUX_GATEWAY_SESSION_EXPIRED_MESSAGE } from "@/common/constants/muxGatewayOAuth";
+import { getInterruptionContext } from "@/common/utils/messages/retryEligibility";
 import type { TurnCoordinator, OperationId } from "@/node/services/turnCoordinator";
 import { Ok } from "@/common/types/result";
 import { GlobalWindow } from "happy-dom";
@@ -879,6 +884,95 @@ describe("WorkspaceStore", () => {
     store.dispose();
   });
 
+  it("shows a refused session tape replay as an error and does not retry it", async () => {
+    // A mapped tape the backend refuses (here: missing) must end the skeleton with a visible
+    // reason, keep sends closed and not resubscribe: a retry can only be refused again. Served
+    // by the backend's real onChat entry point, with no services behind it.
+    const workspaceId = "tape-refused-workspace";
+    const savedReplayTapes = process.env.XUM_REPLAY_TAPES;
+    process.env.XUM_REPLAY_TAPES = JSON.stringify({ [workspaceId]: "/nonexistent/missing.jsonl" });
+    markSessionTapeReplayEgressBlocked();
+    const context = {} as unknown as ORPCContext;
+    mockOnChat.mockImplementation(async function* (input, options) {
+      yield* subscribeWorkspaceChat(
+        context,
+        { workspaceId: input!.workspaceId },
+        options?.signal,
+        { validateOutput: true }
+      );
+    });
+    try {
+      createAndAddWorkspace(store, workspaceId);
+      const showsRefusal = () =>
+        store
+          .getWorkspaceState(workspaceId)
+          .messages.some(
+            (message) => message.type === "stream-error" && message.error.includes("unreadable")
+          );
+      expect(await waitUntil(showsRefusal)).toBe(true);
+      // Past the first retry backoff (SUBSCRIPTION_RETRY_BASE_MS): a retry would subscribe again.
+      await tick(400);
+      expect(mockOnChat).toHaveBeenCalledTimes(1);
+      const state = store.getWorkspaceState(workspaceId);
+      expect(state.isHydratingTranscript).toBe(false);
+      expect(state.loading).toBe(false);
+      expect(state.isTranscriptCaughtUp).toBe(false);
+      // Not a model stream failure: no "Stream interrupted" barrier and no Retry/auto-retry.
+      expect(state.messages.at(-1)).toMatchObject({ errorType: "session_tape_replay" });
+      const interruption = getInterruptionContext(state.messages);
+      expect(interruption.hasInterruptedStream).toBe(false);
+      expect(interruption.isEligibleForAutoRetry).toBe(false);
+    } finally {
+      if (savedReplayTapes === undefined) delete process.env.XUM_REPLAY_TAPES;
+      else process.env.XUM_REPLAY_TAPES = savedReplayTapes;
+    }
+  });
+
+  it.each([false, true])(
+    "suppresses recorded side effects when the renderer replays a session tape (%p)",
+    async (replaying) => {
+      // A replayed tape's events never ran here: no gateway dialog, no git/review refresh.
+      const workspaceId = `tape-side-effects-${String(replaying)}`;
+      const api = global.window.api as { isSessionTapeReplay?: boolean };
+      api.isSessionTapeReplay = replaying;
+      const dispatchEvent = global.window.dispatchEvent as Mock<(event: Event) => boolean>;
+      dispatchEvent.mockClear();
+      try {
+        const send = openChat(workspaceId);
+        createAndAddWorkspace(store, workspaceId);
+        const messageId = "tape-stream";
+        await send(
+          caughtUpEvent(),
+          {
+            type: "stream-start",
+            workspaceId,
+            messageId,
+            historySequence: 1,
+            model: TEST_MODEL,
+            startTime: 1,
+          },
+          toolCallEndEvent(workspaceId, "tool-1", "bash", { output: "ok" }, { messageId }),
+          {
+            type: "stream-error",
+            messageId,
+            error: MUX_GATEWAY_SESSION_EXPIRED_MESSAGE,
+            errorType: "authentication",
+          }
+        );
+        expect(await waitUntil(() => store.getWorkspaceState(workspaceId).messages.length > 0)).toBe(
+          true
+        );
+        const gatewayDialogs = dispatchEvent.mock.calls.filter(
+          ([event]) => event.type === CUSTOM_EVENTS.MUX_GATEWAY_SESSION_EXPIRED
+        );
+        expect(gatewayDialogs.length).toBe(replaying ? 0 : 1);
+        expect(store.getFileModifyingToolMs(workspaceId) === undefined).toBe(replaying);
+      } finally {
+        delete api.isSessionTapeReplay;
+      }
+    }
+  );
+
   it.each([
     ["stream-abort", "full"],
     ["error", "full"],
diff --git a/src/desktop/sessionTapeReplayEgress.test.ts b/src/desktop/sessionTapeReplayEgress.test.ts
new file mode 100644
index 00000000000..dafdd6cf70d
--- /dev/null
+++ b/src/desktop/sessionTapeReplayEgress.test.ts
@@ -0,0 +1,26 @@
+import { describe, expect, test } from "bun:test";
+import { isSessionTapeReplayAllowedUrl } from "./sessionTapeReplayEgress";
+
+describe("isSessionTapeReplayAllowedUrl", () => {
+  const devOrigin = "http://127.0.0.1:5173";
+
+  test.each<[string, string, string | undefined, boolean]>([
+    ["the dist app page", "file:///opt/xum/dist/index.html", undefined, true],
+    ["inline data", "data:image/png;base64,AAAA", undefined, true],
+    ["blob URLs", "blob:file:///0b6c1f2e-1234", undefined, true],
+    ["devtools", "devtools://devtools/bundled/inspector.html", undefined, true],
+    ["a recorded remote image", "https://replay-egress-probe.invalid/a.png", undefined, false],
+    ["a recorded loopback image", "http://127.0.0.1:47999/a.png", undefined, false],
+    ["localhost", "http://localhost:5173/", undefined, false],
+    ["a websocket", "wss://example.com/socket", undefined, false],
+    ["an unparseable URL", "not a url", undefined, false],
+    ["the dev server page", "http://127.0.0.1:5173/src/main.tsx", devOrigin, true],
+    ["the dev server's HMR socket", "ws://127.0.0.1:5173/?token=x", devOrigin, true],
+    ["the dev server origin over https", "https://127.0.0.1:5173/", devOrigin, false],
+    ["the dev server host on another port", "http://127.0.0.1:47999/a.png", devOrigin, false],
+    ["another loopback name for the dev server", "http://localhost:5173/", devOrigin, false],
+    ["a remote host in dev mode", "https://replay-egress-probe.invalid/a.png", devOrigin, false],
+  ])("%s: %s", (_name, url, devServerOrigin, allowed) => {
+    expect(isSessionTapeReplayAllowedUrl(url, devServerOrigin)).toBe(allowed);
+  });
+});

From 0bd484da6fc9e6887ffade6df49ea9e3339424c1 Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 08:11:12 +0000
Subject: [PATCH 06/18] fix(sessionTapes): keep the replay source off the
 desktop pre-splash import path

Signed-off-by: Thomas Kosiewski <tk@coder.com>
---
 src/browser/stores/WorkspaceStore.test.ts     |  15 +--
 src/desktop/main.ts                           |  10 +-
 src/desktop/sessionTapeReplayEgress.ts        |  13 +--
 src/node/services/providerModelFactory.ts     |   5 +-
 .../sessionTapeReplaySource.test.ts           | 104 +++++++++---------
 .../sessionTapes/sessionTapeReplaySource.ts   |   5 +-
 .../sessionTapes/tapeReplayFixture.ts         |   9 +-
 tests/e2e/scenarios/perf.tapeReplay.spec.ts   |   9 +-
 8 files changed, 95 insertions(+), 75 deletions(-)

diff --git a/src/browser/stores/WorkspaceStore.test.ts b/src/browser/stores/WorkspaceStore.test.ts
index 8312cae70f2..8f8230a8644 100644
--- a/src/browser/stores/WorkspaceStore.test.ts
+++ b/src/browser/stores/WorkspaceStore.test.ts
@@ -894,12 +894,9 @@ describe("WorkspaceStore", () => {
     markSessionTapeReplayEgressBlocked();
     const context = {} as unknown as ORPCContext;
     mockOnChat.mockImplementation(async function* (input, options) {
-      yield* subscribeWorkspaceChat(
-        context,
-        { workspaceId: input!.workspaceId },
-        options?.signal,
-        { validateOutput: true }
-      );
+      yield* subscribeWorkspaceChat(context, { workspaceId: input!.workspaceId }, options?.signal, {
+        validateOutput: true,
+      });
     });
     try {
       createAndAddWorkspace(store, workspaceId);
@@ -959,9 +956,9 @@ describe("WorkspaceStore", () => {
             errorType: "authentication",
           }
         );
-        expect(await waitUntil(() => store.getWorkspaceState(workspaceId).messages.length > 0)).toBe(
-          true
-        );
+        expect(
+          await waitUntil(() => store.getWorkspaceState(workspaceId).messages.length > 0)
+        ).toBe(true);
         const gatewayDialogs = dispatchEvent.mock.calls.filter(
           ([event]) => event.type === CUSTOM_EVENTS.MUX_GATEWAY_SESSION_EXPIRED
         );
diff --git a/src/desktop/main.ts b/src/desktop/main.ts
index 4909abdd059..3de1b5000c1 100644
--- a/src/desktop/main.ts
+++ b/src/desktop/main.ts
@@ -200,7 +200,7 @@ import {
   installSessionTapeReplayEgressBlock,
   refuseSessionTapeReplayExternalOpen,
 } from "./sessionTapeReplayEgress";
-import { isSessionTapeReplayMode } from "@/node/services/sessionTapes/sessionTapeReplaySource";
+import { isSessionTapeReplayConfigured } from "@/common/utils/sessionTapes/sessionTapeReplay";
 
 // Lets the main process read a hung renderer's JS stack (see ./perf/hangStacks). Merge into
 // any --enable-features value from the launch command line instead of replacing it.
@@ -1507,11 +1507,15 @@ async function startDesktopAfterStorage(): Promise<void> {
       // Perf harness (XUM_REPLAY_TAPES): block renderer egress before any window (splash
       // included) loads; the backend serves tapes only after this. A failure must not leave
       // replay mode with network access, so it fails startup.
-      if (isSessionTapeReplayMode()) {
+      if (isSessionTapeReplayConfigured(process.env)) {
         installSessionTapeReplayEgressBlock(
           electronSession.defaultSession,
           shouldUseDevServer() ? getDevServerUrl() : undefined
         );
+        const { markSessionTapeReplayEgressBlocked } =
+          // eslint-disable-next-line no-restricted-syntax -- keeps zod off the pre-splash path (#4423)
+          await import("../node/services/sessionTapes/sessionTapeReplaySource");
+        markSessionTapeReplayEgressBlocked();
       }
 
       if (await maybeRunAttachFileSmokeTest()) {
@@ -1525,7 +1529,7 @@ async function startDesktopAfterStorage(): Promise<void> {
       // install the extension: its installHook.js measurably distorts CPU and
       // layout profiles. Skipping it also removes a network download from tests.
       // Not in replay mode either: the extension download is network egress.
-      if (!app.isPackaged && !isE2ETest && !isSessionTapeReplayMode()) {
+      if (!app.isPackaged && !isE2ETest && !isSessionTapeReplayConfigured(process.env)) {
         try {
           const { default: installExtension, REACT_DEVELOPER_TOOLS } =
             // eslint-disable-next-line no-restricted-syntax -- dev-only dependency, intentionally lazy-loaded
diff --git a/src/desktop/sessionTapeReplayEgress.ts b/src/desktop/sessionTapeReplayEgress.ts
index f432e59f259..bf13342089c 100644
--- a/src/desktop/sessionTapeReplayEgress.ts
+++ b/src/desktop/sessionTapeReplayEgress.ts
@@ -3,16 +3,14 @@
  * Replayed transcripts hold recorded content (markdown images, links, ...) whose URLs must never
  * be contacted. Desktop main installs the block on the default session at app ready, before any
  * window loads (the main, desktop.html and terminal windows all use that session), and only then
- * lets the backend serve tapes (`markSessionTapeReplayEgressBlocked`).
+ * lets the backend serve tapes (`markSessionTapeReplayEgressBlocked`). Imports stay light: this
+ * module is on the pre-splash startup path.
  *
  * Type-only Electron imports keep this module loadable under bun tests.
  */
 import type { Session } from "electron";
 import { log } from "@/node/services/log";
-import {
-  isSessionTapeReplayMode,
-  markSessionTapeReplayEgressBlocked,
-} from "@/node/services/sessionTapes/sessionTapeReplaySource";
+import { isSessionTapeReplayConfigured } from "@/common/utils/sessionTapes/sessionTapeReplay";
 
 /** Local schemes that never leave the machine. */
 const ALLOWED_PROTOCOLS = new Set(["file:", "data:", "blob:", "devtools:"]);
@@ -54,7 +52,7 @@ function describeOrigin(url: string): string {
 
 /**
  * Cancel every default-session request that `isSessionTapeReplayAllowedUrl` refuses (the
- * renderer sees net::ERR_BLOCKED_BY_CLIENT), then let the backend serve tapes.
+ * renderer sees net::ERR_BLOCKED_BY_CLIENT).
  */
 export function installSessionTapeReplayEgressBlock(
   session: Session,
@@ -72,7 +70,6 @@ export function installSessionTapeReplayEgressBlock(
     }
     callback({ cancel: !allowed });
   });
-  markSessionTapeReplayEgressBlocked();
 }
 
 /**
@@ -80,7 +77,7 @@ export function installSessionTapeReplayEgressBlock(
  * in the user's browser. Callers deny the open.
  */
 export function refuseSessionTapeReplayExternalOpen(url: string): boolean {
-  if (!isSessionTapeReplayMode()) return false;
+  if (!isSessionTapeReplayConfigured(process.env)) return false;
   log.info("Session tape replay refused to open an external URL", { origin: describeOrigin(url) });
   return true;
 }
diff --git a/src/node/services/providerModelFactory.ts b/src/node/services/providerModelFactory.ts
index 49d2f658788..827e95e0941 100644
--- a/src/node/services/providerModelFactory.ts
+++ b/src/node/services/providerModelFactory.ts
@@ -1467,7 +1467,10 @@ export class ProviderModelFactory {
       // chat, status, title, compaction, refine, memory, advisor and intuition model is created
       // through here, so no per-service gate is needed.
       if (isSessionTapeReplayMode()) {
-        return Err<SendMessageError>({ type: "unknown", raw: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE });
+        return Err<SendMessageError>({
+          type: "unknown",
+          raw: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE,
+        });
       }
       const result = yield* self.createModelCoreEffect(modelString, muxProviderOptions, opts);
       if (!result.success) {
diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
index 3f42bfa6b29..019dab5d2be 100644
--- a/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
@@ -31,6 +31,7 @@ import {
   markSessionTapeReplayEgressBlocked,
   SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE,
 } from "./sessionTapeReplaySource";
+import type * as ReplaySourceModule from "./sessionTapeReplaySource";
 import { buildSyntheticSessionTape, syntheticReplayTranscript } from "./sessionTapes.testFixtures";
 
 const ENV_KEYS = ["XUM_REPLAY_TAPES", "MUX_REPLAY_TAPES"] as const;
@@ -56,7 +57,7 @@ afterEach(() => {
 });
 
 /** A router context with no services: replay must never reach the workspace's session. */
-function createContext(app: ReturnType<typeof makeAppRuntime>) {
+function createContext(app: { context: unknown }) {
   const sessionRequests: string[] = [];
   const context = {
     "effect/context": app.context,
@@ -84,15 +85,16 @@ async function settlesWithin(promise: Promise<unknown>, ms: number): Promise<boo
 describe("onChat replay source", () => {
   const workspaceId = "ws-replay";
   const events = syntheticReplayTranscript(workspaceId);
-  let app: ReturnType<typeof makeAppRuntime>;
+  // A TestClock keeps the transport heartbeat out of the delivered sequence.
+  const createApp = () => makeAppRuntime(TestClock.layer());
+  let app: ReturnType<typeof createApp>;
 
   beforeAll(() => {
     // Desktop main does this after installing the renderer egress block.
     markSessionTapeReplayEgressBlocked();
   });
   beforeEach(() => {
-    // A TestClock keeps the transport heartbeat out of the delivered sequence.
-    app = makeAppRuntime(TestClock.layer());
+    app = createApp();
   });
   afterEach(async () => {
     await disposeAppRuntime(app.managed);
@@ -146,11 +148,7 @@ describe("onChat replay source", () => {
     buildSyntheticSessionTape(syntheticReplayTranscript(id), { workspaceId: id, ...options });
 
   test.each<
-    [
-      string,
-      (dir: DisposableTempDir) => Promise<{ map: string; mode?: "since" | "live" }>,
-      RegExp,
-    ]
+    [string, (dir: DisposableTempDir) => Promise<{ map: string; mode?: "since" | "live" }>, RegExp]
   >([
     ["an unparseable map", () => Promise.resolve({ map: "{not json" }), /not valid JSON/],
     [
@@ -202,54 +200,61 @@ describe("onChat replay source", () => {
       }),
       /reload to replay/,
     ],
-  ])("refuses %s with a terminal refusal, never the live session", async (_name, setup, message) => {
-    using dir = new DisposableTempDir("session-tape-replay-refusal");
-    const { map, mode } = await setup(dir);
-    setReplayTapes(map);
-    const { context, sessionRequests } = createContext(app);
-    const controller = new AbortController();
-    const iterator = subscribeWorkspaceChat(
-      context,
-      {
-        workspaceId,
-        mode:
-          mode === "since"
-            ? { type: "since", cursor: { history: { messageId: "m", historySequence: 1 } } }
-            : mode === "live"
-              ? { type: "live" }
-              : undefined,
-      },
-      controller.signal,
-      { validateOutput: true }
-    );
-    try {
-      const error: unknown = await iterator.next().then(
-        () => undefined,
-        (rejection: unknown) => rejection
+  ])(
+    "refuses %s with a terminal refusal, never the live session",
+    async (_name, setup, message) => {
+      using dir = new DisposableTempDir("session-tape-replay-refusal");
+      const { map, mode } = await setup(dir);
+      setReplayTapes(map);
+      const { context, sessionRequests } = createContext(app);
+      const controller = new AbortController();
+      const iterator = subscribeWorkspaceChat(
+        context,
+        {
+          workspaceId,
+          mode:
+            mode === "since"
+              ? { type: "since", cursor: { history: { messageId: "m", historySequence: 1 } } }
+              : mode === "live"
+                ? { type: "live" }
+                : undefined,
+        },
+        controller.signal,
+        { validateOutput: true }
       );
-      expect(isSessionTapeReplayRefusal(error)).toBe(true);
-      expect((error as { data?: unknown }).data).toEqual(SESSION_TAPE_REPLAY_REFUSAL_DATA);
-      expect((error as Error).message).toMatch(message);
-      expect(sessionRequests).toEqual([]);
-    } finally {
-      controller.abort();
-      await iterator.return(undefined).catch(() => undefined);
+      try {
+        const error: unknown = await iterator.next().then(
+          () => undefined,
+          (rejection: unknown) => rejection
+        );
+        expect(isSessionTapeReplayRefusal(error)).toBe(true);
+        expect((error as { data?: unknown }).data).toEqual(SESSION_TAPE_REPLAY_REFUSAL_DATA);
+        expect((error as Error).message).toMatch(message);
+        expect(sessionRequests).toEqual([]);
+      } finally {
+        controller.abort();
+        await iterator.return(undefined).catch(() => undefined);
+      }
     }
-  });
+  );
 
   test("refuses to serve a tape before desktop main blocked renderer egress", async () => {
     using dir = new DisposableTempDir("session-tape-replay-no-egress-block");
     setReplayTapes(JSON.stringify({ [workspaceId]: await writeTape(dir, tapeFor(workspaceId)) }));
     // A fresh module instance: no egress block was installed in it (as in `xum server`).
     // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const fresh = require(`./sessionTapeReplaySource?fresh=${randomUUID()}`) as typeof import("./sessionTapeReplaySource");
+    const fresh = require(
+      `./sessionTapeReplaySource?fresh=${randomUUID()}`
+    ) as typeof ReplaySourceModule;
     const replay = fresh.getSessionTapeReplay({ workspaceId });
     if (!replay) throw new Error("the mapped workspace must get a replay");
     const pushed: WorkspaceChatMessage[] = [];
-    const error: unknown = await replay.play((event) => pushed.push(event)).then(
-      () => undefined,
-      (rejection: unknown) => rejection
-    );
+    const error: unknown = await replay
+      .play((event) => pushed.push(event))
+      .then(
+        () => undefined,
+        (rejection: unknown) => rejection
+      );
     expect(isSessionTapeReplayRefusal(error)).toBe(true);
     expect((error as Error).message).toMatch(/egress block/);
     expect(pushed).toEqual([]);
@@ -281,10 +286,11 @@ describe("replay mode is read-only", () => {
       const service = createWorkspaceServiceForTest({ config, historyService });
       // Any non-blank value, even for other workspaces, puts the whole process in replay mode.
       setReplayTapes(JSON.stringify({ "ws-other": "/tapes/other.jsonl" }));
-      const raw = { type: "unknown", raw: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE };
+      const raw = { type: "unknown", raw: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE } as const;
+      const sendOptions = { model: "anthropic:claude-haiku-4-5", agentId: "exec" };
       const results = {
-        send: await service.sendMessage(workspaceId, "hello", { model: "anthropic:claude-haiku-4-5" }),
-        resume: await service.resumeStream(workspaceId, { model: "anthropic:claude-haiku-4-5" }),
+        send: await service.sendMessage(workspaceId, "hello", sendOptions),
+        resume: await service.resumeStream(workspaceId, sendOptions),
         truncate: await service.truncateHistory(workspaceId),
         reset: await service.resetContext(workspaceId),
         replace: await service.replaceHistory(
diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
index 5b21393cfca..da10243f3e6 100644
--- a/src/node/services/sessionTapes/sessionTapeReplaySource.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
@@ -123,7 +123,10 @@ function refuseReplay(workspaceId: string, message: string): never {
 }
 
 /** Why this subscription cannot be served before reading the tape, if anything. */
-function getUpfrontRefusal(entry: string | Error, mode: OnChatMode | undefined): string | undefined {
+function getUpfrontRefusal(
+  entry: string | Error,
+  mode: OnChatMode | undefined
+): string | undefined {
   if (entry instanceof Error) return entry.message;
   if (!egressBlocked) return "session tape replay requires the desktop app's egress block";
   if (mode !== undefined && mode.type !== "full") {
diff --git a/tests/e2e/fixtures/sessionTapes/tapeReplayFixture.ts b/tests/e2e/fixtures/sessionTapes/tapeReplayFixture.ts
index 65e49d73c23..36086df19a6 100644
--- a/tests/e2e/fixtures/sessionTapes/tapeReplayFixture.ts
+++ b/tests/e2e/fixtures/sessionTapes/tapeReplayFixture.ts
@@ -112,7 +112,14 @@ function buildTapeReplayFixtureEvents(): WorkspaceChatMessage[] {
       result: toolOutput,
       timestamp: 8,
     },
-    { type: "stream-delta", workspaceId, messageId, delta: finalMarkdown, tokens: 20, timestamp: 9 },
+    {
+      type: "stream-delta",
+      workspaceId,
+      messageId,
+      delta: finalMarkdown,
+      tokens: 20,
+      timestamp: 9,
+    },
     {
       type: "stream-end",
       workspaceId,
diff --git a/tests/e2e/scenarios/perf.tapeReplay.spec.ts b/tests/e2e/scenarios/perf.tapeReplay.spec.ts
index e1148fc9ded..938bb43c8c9 100644
--- a/tests/e2e/scenarios/perf.tapeReplay.spec.ts
+++ b/tests/e2e/scenarios/perf.tapeReplay.spec.ts
@@ -10,7 +10,10 @@
 import fs from "fs";
 import path from "path";
 import type { Request } from "@playwright/test";
-import { loadSessionTape, summarizeSessionTape } from "@/common/utils/sessionTapes/sessionTapeLoader";
+import {
+  loadSessionTape,
+  summarizeSessionTape,
+} from "@/common/utils/sessionTapes/sessionTapeLoader";
 import { electronTest, electronExpect as expect } from "../electronTest";
 import { getXumE2EEnv } from "../env";
 import {
@@ -49,7 +52,7 @@ const CREDENTIAL_ENV_PATTERN = /_API_KEY$|_AUTH_TOKEN$|_BASE_URL$/;
  */
 function registerFixtureWorkspace(demoProject: DemoProjectConfig): void {
   const config = JSON.parse(fs.readFileSync(demoProject.configPath, "utf-8")) as {
-    projects: Array<[string, { workspaces: Array<{ path: string; id?: string; name?: string }> }]>;
+    projects: [string, { workspaces: { path: string; id?: string; name?: string }[] }][];
   };
   const entry = config.projects.find(([projectPath]) => projectPath === demoProject.projectPath);
   const workspace = entry?.[1].workspaces.find((ws) => ws.path === demoProject.workspacePath);
@@ -107,7 +110,7 @@ test.describe("session tape replay performance profiling", () => {
     // Every probe image request must fail at the egress block; none may finish.
     const isProbe = (request: Request) =>
       (TAPE_REPLAY_PROBE_URLS as readonly string[]).includes(request.url());
-    const probeFailures: Array<{ url: string; errorText: string }> = [];
+    const probeFailures: { url: string; errorText: string }[] = [];
     const probesFinished: string[] = [];
     page.on("requestfailed", (request) => {
       if (isProbe(request)) {

From cc23f1e30a64b46951304071372d42d8141b22fe Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 08:13:36 +0000
Subject: [PATCH 07/18] test(e2e): compare distinct blocked probe URLs in
 perf.tapeReplay

Signed-off-by: Thomas Kosiewski <tk@coder.com>
---
 tests/e2e/scenarios/perf.tapeReplay.spec.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tests/e2e/scenarios/perf.tapeReplay.spec.ts b/tests/e2e/scenarios/perf.tapeReplay.spec.ts
index 938bb43c8c9..ea0e6941909 100644
--- a/tests/e2e/scenarios/perf.tapeReplay.spec.ts
+++ b/tests/e2e/scenarios/perf.tapeReplay.spec.ts
@@ -143,8 +143,11 @@ test.describe("session tape replay performance profiling", () => {
     await expect(transcript).toContainText(TAPE_REPLAY_TEXTS.liveText.trim());
     await expect(transcript).toContainText(TAPE_REPLAY_TEXTS.markerCommand);
 
+    // Streaming and final renders can each request an image, so compare distinct URLs.
     await expect
-      .poll(() => probeFailures.map((failure) => failure.url).sort(), { timeout: 10_000 })
+      .poll(() => [...new Set(probeFailures.map((failure) => failure.url))].sort(), {
+        timeout: 10_000,
+      })
       .toEqual([...TAPE_REPLAY_PROBE_URLS].sort());
     for (const failure of probeFailures) {
       expect(failure.errorText).toContain("ERR_BLOCKED_BY_CLIENT");

From 9c1ebe5026ea93aefb2ea3d75b601a44df2437b2 Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 08:20:43 +0000
Subject: [PATCH 08/18] test(e2e): expand the replayed bash card before
 checking its script

---
 tests/e2e/scenarios/perf.tapeReplay.spec.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/e2e/scenarios/perf.tapeReplay.spec.ts b/tests/e2e/scenarios/perf.tapeReplay.spec.ts
index ea0e6941909..1164ebc175b 100644
--- a/tests/e2e/scenarios/perf.tapeReplay.spec.ts
+++ b/tests/e2e/scenarios/perf.tapeReplay.spec.ts
@@ -141,6 +141,8 @@ test.describe("session tape replay performance profiling", () => {
 
     await expect(transcript).toContainText(TAPE_REPLAY_TEXTS.historyAssistant);
     await expect(transcript).toContainText(TAPE_REPLAY_TEXTS.liveText.trim());
+    // Tool cards render collapsed: expand the replayed bash call to check its recorded script.
+    await transcript.getByText("bash", { exact: true }).first().click();
     await expect(transcript).toContainText(TAPE_REPLAY_TEXTS.markerCommand);
 
     // Streaming and final renders can each request an image, so compare distinct URLs.

From fa486ae3ddf2ca76f9dce04b23c1daa5caa10d24 Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 08:27:31 +0000
Subject: [PATCH 09/18] fix(sessionTapes): resolve no host names in replay mode
 and stub the Coder CLI probe in perf.tapeReplay

strace of the scenario showed Chromium's spellcheck dictionary download (browser-internal,
outside webRequest) and the backend's coder whoami probe reaching the network.
---
 src/desktop/main.ts                         | 7 +++++++
 tests/e2e/scenarios/perf.tapeReplay.spec.ts | 6 ++++++
 2 files changed, 13 insertions(+)

diff --git a/src/desktop/main.ts b/src/desktop/main.ts
index 3de1b5000c1..e292ae55191 100644
--- a/src/desktop/main.ts
+++ b/src/desktop/main.ts
@@ -210,6 +210,13 @@ app.commandLine.appendSwitch(
   mergeEnableFeatures(app.commandLine.getSwitchValue("enable-features"), JS_CALL_STACKS_FEATURE)
 );
 
+// Perf harness (XUM_REPLAY_TAPES): Chromium's browser-internal fetches (e.g. spellcheck
+// dictionary downloads) bypass webRequest, so in replay mode no host name resolves except
+// localhost. Requests to literal IPs still meet the webRequest block. Before app.whenReady().
+if (isSessionTapeReplayConfigured(process.env)) {
+  app.commandLine.appendSwitch("host-resolver-rules", "MAP * ~NOTFOUND, EXCLUDE localhost");
+}
+
 // React DevTools for development profiling
 // Using dynamic import() to avoid loading electron-devtools-installer at module init time
 
diff --git a/tests/e2e/scenarios/perf.tapeReplay.spec.ts b/tests/e2e/scenarios/perf.tapeReplay.spec.ts
index 1164ebc175b..228820794ef 100644
--- a/tests/e2e/scenarios/perf.tapeReplay.spec.ts
+++ b/tests/e2e/scenarios/perf.tapeReplay.spec.ts
@@ -78,6 +78,12 @@ const test = electronTest.extend({
     for (const key of Object.keys(process.env)) {
       if (CREDENTIAL_ENV_PATTERN.test(key)) setEnv(key, undefined);
     }
+    // The backend probes the Coder CLI (`coder whoami`, which contacts the deployment) at
+    // startup. A failing stub keeps that probe local so the run makes no network connection.
+    const stubBinDir = path.join(workspace.configRoot, "stub-bin");
+    fs.mkdirSync(stubBinDir, { recursive: true });
+    fs.writeFileSync(path.join(stubBinDir, "coder"), "#!/bin/sh\nexit 1\n", { mode: 0o755 });
+    setEnv("PATH", `${stubBinDir}${path.delimiter}${process.env.PATH ?? ""}`);
     setEnv("MUX_REPLAY_TAPES", undefined);
     setEnv(
       "XUM_REPLAY_TAPES",

From 4de6de0566966b5c76468726b7ffe263e4bfcb17 Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 08:33:47 +0000
Subject: [PATCH 10/18] test(startHere): reuse the Start Here click helpers in
 the original test

The refused-Start-Here test added clickStartHere/findEnabledOkButton but left
the original test with an inline copy of the same lookups. Use the helpers in
both tests; behavior is unchanged.

Signed-off-by: Thomas Kosiewski <tk@coder.com>
---
 tests/ui/chat/startHere.test.ts | 39 +++++----------------------------
 1 file changed, 5 insertions(+), 34 deletions(-)

diff --git a/tests/ui/chat/startHere.test.ts b/tests/ui/chat/startHere.test.ts
index e707ea512e6..bfe15a0935e 100644
--- a/tests/ui/chat/startHere.test.ts
+++ b/tests/ui/chat/startHere.test.ts
@@ -35,6 +35,8 @@ async function clickStartHere(app: AppHarness): Promise<void> {
 async function findEnabledOkButton(): Promise<HTMLButtonElement> {
   return waitFor(
     () => {
+      // In happy-dom, Radix portals are unreliable, but the modal's OK button
+      // uses the text "OK" and lives somewhere in the document.
       const buttons = Array.from(document.querySelectorAll("button"));
       const ok = buttons.find((b) => b.textContent?.trim().startsWith("OK") && !b.disabled);
       if (!ok) {
@@ -59,40 +61,9 @@ describe("Start Here (mock AI router)", () => {
       await app.chat.send(seedMessage);
       await app.chat.expectTranscriptContains(`Mock response: ${seedMessage}`);
 
-      // Find the Start Here button on the assistant message and click it.
-      const startHereButton = await waitFor(
-        () => {
-          const buttons = Array.from(
-            app.view.container.querySelectorAll<HTMLButtonElement>(
-              'button[aria-label="Start Here"]'
-            )
-          );
-          const enabled = buttons.find((b) => !b.disabled);
-          if (!enabled) {
-            throw new Error("Start Here button not found or disabled");
-          }
-          return enabled;
-        },
-        { timeout: 10_000 }
-      );
-      fireEvent.click(startHereButton);
-
-      // Confirm the modal (the OK button inside the StartHereModal dialog).
-      const okButton = await waitFor(
-        () => {
-          // StartHereModal renders via Radix Dialog which portals to document.body.
-          // In happy-dom, Radix portals are unreliable, but the modal's OK button
-          // uses the text "OK" and lives somewhere in the document.
-          const buttons = Array.from(document.querySelectorAll("button"));
-          const ok = buttons.find((b) => b.textContent?.trim().startsWith("OK") && !b.disabled);
-          if (!ok) {
-            throw new Error("OK button not found in Start Here modal");
-          }
-          return ok;
-        },
-        { timeout: 5_000 }
-      );
-      fireEvent.click(okButton);
+      // Click Start Here on the assistant message, then confirm the modal.
+      await clickStartHere(app);
+      fireEvent.click(await findEnabledOkButton());
 
       // A compaction boundary row should appear in the transcript.
       await app.chat.expectTranscriptContains("Compaction boundary", 10_000);

From 51e70a96d2a762e227d947d9b329ed8c44fbb9ee Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 08:53:56 +0000
Subject: [PATCH 11/18] fix(sessionTapes): address Codex round 1 (telemetry,
 pagination, dev host DNS, non-retryable refusal)

---
 src/browser/stores/WorkspaceStore.ts          |  3 ++
 src/common/orpc/schemas/errors.ts             |  2 ++
 src/common/utils/errors/formatSendError.ts    |  1 +
 src/common/utils/messages/retryEligibility.ts |  1 +
 src/desktop/main.ts                           |  9 +++--
 src/node/services/providerModelFactory.ts     |  4 +--
 .../sessionTapeReplaySource.test.ts           | 33 +++++++++++++++----
 .../sessionTapes/sessionTapeReplaySource.ts   |  9 +++--
 src/node/services/utils/sendMessageError.ts   |  2 ++
 src/node/services/workspaceService.ts         |  4 +--
 10 files changed, 53 insertions(+), 15 deletions(-)

diff --git a/src/browser/stores/WorkspaceStore.ts b/src/browser/stores/WorkspaceStore.ts
index 9e1a75c318f..2c4d7ffcf88 100644
--- a/src/browser/stores/WorkspaceStore.ts
+++ b/src/browser/stores/WorkspaceStore.ts
@@ -2207,6 +2207,9 @@ export class WorkspaceStore {
     },
     wasInterrupted: boolean
   ): void {
+    // Session tape replay (perf harness): replayed completions are recordings, not real
+    // streams, and telemetry would be network egress from a replay run.
+    if (isSessionTapeReplayRenderer()) return;
     const { metadata } = data;
     const durationSecs = metadata.duration ? metadata.duration / 1000 : 0;
     const outputTokens = metadata.usage?.outputTokens ?? 0;
diff --git a/src/common/orpc/schemas/errors.ts b/src/common/orpc/schemas/errors.ts
index b2009b338d2..5bd24d1648b 100644
--- a/src/common/orpc/schemas/errors.ts
+++ b/src/common/orpc/schemas/errors.ts
@@ -34,6 +34,8 @@ export const SendMessageErrorSchema = z.discriminatedUnion("type", [
   z.object({ type: z.literal("history-changed") }),
   /** A direct edit targeted authentic plan-review feedback; nothing was changed. */
   z.object({ type: z.literal("plan_review_feedback_edit_blocked"), message: z.string() }),
+  // Session tape replay mode (XUM_REPLAY_TAPES) refuses turns and model creation; deterministic
+  z.object({ type: z.literal("session_tape_replay"), message: z.string() }),
   z.object({ type: z.literal("unknown"), raw: z.string() }),
 ]);
 
diff --git a/src/common/utils/errors/formatSendError.ts b/src/common/utils/errors/formatSendError.ts
index 3cd2a50b763..17e57d6d454 100644
--- a/src/common/utils/errors/formatSendError.ts
+++ b/src/common/utils/errors/formatSendError.ts
@@ -98,6 +98,7 @@ export function formatSendMessageError(error: SendMessageError): FormattedError
       return { message: EDIT_HISTORY_CHANGED_MESSAGE };
 
     case "plan_review_feedback_edit_blocked":
+    case "session_tape_replay":
       return { message: error.message };
 
     case "unknown": {
diff --git a/src/common/utils/messages/retryEligibility.ts b/src/common/utils/messages/retryEligibility.ts
index d7f16344e45..914033c543a 100644
--- a/src/common/utils/messages/retryEligibility.ts
+++ b/src/common/utils/messages/retryEligibility.ts
@@ -92,6 +92,7 @@ export function isNonRetryableSendError(error: { type: string }): boolean {
     case "context_budget_exceeded": // Parent may roll over explicitly; never retry the oversized request
     case "context_budget_blocked":
     case "plan_review_feedback_edit_blocked": // Feedback rows never become editable
+    case "session_tape_replay": // Replay mode refuses every turn until the process restarts
       return true;
     case "runtime_start_failed": // Runtime is starting - transient, worth retrying
     case "unknown":
diff --git a/src/desktop/main.ts b/src/desktop/main.ts
index e292ae55191..f41a20c69ba 100644
--- a/src/desktop/main.ts
+++ b/src/desktop/main.ts
@@ -212,9 +212,14 @@ app.commandLine.appendSwitch(
 
 // Perf harness (XUM_REPLAY_TAPES): Chromium's browser-internal fetches (e.g. spellcheck
 // dictionary downloads) bypass webRequest, so in replay mode no host name resolves except
-// localhost. Requests to literal IPs still meet the webRequest block. Before app.whenReady().
+// localhost and the configured dev-server host (dev-server mode). Requests to literal IPs still
+// meet the webRequest block. Before app.whenReady().
 if (isSessionTapeReplayConfigured(process.env)) {
-  app.commandLine.appendSwitch("host-resolver-rules", "MAP * ~NOTFOUND, EXCLUDE localhost");
+  const devHost = shouldUseDevServer() ? getXumEnv("DEVSERVER_HOST") : undefined;
+  app.commandLine.appendSwitch(
+    "host-resolver-rules",
+    `MAP * ~NOTFOUND, EXCLUDE localhost${devHost ? `, EXCLUDE ${devHost}` : ""}`
+  );
 }
 
 // React DevTools for development profiling
diff --git a/src/node/services/providerModelFactory.ts b/src/node/services/providerModelFactory.ts
index 827e95e0941..1ebd25a2e77 100644
--- a/src/node/services/providerModelFactory.ts
+++ b/src/node/services/providerModelFactory.ts
@@ -1468,8 +1468,8 @@ export class ProviderModelFactory {
       // through here, so no per-service gate is needed.
       if (isSessionTapeReplayMode()) {
         return Err<SendMessageError>({
-          type: "unknown",
-          raw: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE,
+          type: "session_tape_replay",
+          message: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE,
         });
       }
       const result = yield* self.createModelCoreEffect(modelString, muxProviderOptions, opts);
diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
index 019dab5d2be..c29650b622c 100644
--- a/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
@@ -10,6 +10,7 @@ import { randomUUID } from "node:crypto";
 import { Effect } from "effect";
 import { TestClock } from "effect/testing";
 import { createMuxMessage } from "@/common/types/message";
+import { isNonRetryableSendError } from "@/common/utils/messages/retryEligibility";
 import type { WorkspaceChatMessage } from "@/common/orpc/types";
 import { loadSessionTape } from "@/common/utils/sessionTapes/sessionTapeLoader";
 import {
@@ -108,9 +109,13 @@ describe("onChat replay source", () => {
 
   test("plays a mapped workspace's tape in recorded order without the session, then stays open", async () => {
     using dir = new DisposableTempDir("session-tape-replay-source");
+    // A windowed recording: its caught-up says older history exists.
+    const windowed = events.map((event) =>
+      event.type === "caught-up" ? { ...event, hasOlderHistory: true } : event
+    );
     const tapePath = await writeTape(
       dir,
-      buildSyntheticSessionTape(events, { workspaceId, offsetMs: (index) => index * 5 })
+      buildSyntheticSessionTape(windowed, { workspaceId, offsetMs: (index) => index * 5 })
     );
     setReplayTapes(JSON.stringify({ [workspaceId]: tapePath }));
     const { context, sessionRequests } = createContext(app);
@@ -131,7 +136,14 @@ describe("onChat replay source", () => {
       }
       const loaded = loadSessionTape(await fs.readFile(tapePath, "utf-8"));
       if (loaded.status !== "ok") throw new Error(`fixture tape is ${loaded.status}`);
-      expect(delivered).toEqual(loaded.events.map((entry) => entry.event));
+      // Recorded events verbatim, except that paging older rows in (from the live history,
+      // not the tape) is turned off.
+      expect(delivered).toEqual(
+        loaded.events.map(({ event }) =>
+          event.type === "caught-up" ? { ...event, hasOlderHistory: false } : event
+        )
+      );
+      expect(delivered.some((event) => event.type === "caught-up")).toBe(true);
       // Still open after the last event: the renderer must not resubscribe and replay again.
       const after = iterator.next();
       expect(await settlesWithin(after, 50)).toBe(false);
@@ -286,7 +298,10 @@ describe("replay mode is read-only", () => {
       const service = createWorkspaceServiceForTest({ config, historyService });
       // Any non-blank value, even for other workspaces, puts the whole process in replay mode.
       setReplayTapes(JSON.stringify({ "ws-other": "/tapes/other.jsonl" }));
-      const raw = { type: "unknown", raw: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE } as const;
+      const refusal = {
+        type: "session_tape_replay",
+        message: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE,
+      } as const;
       const sendOptions = { model: "anthropic:claude-haiku-4-5", agentId: "exec" };
       const results = {
         send: await service.sendMessage(workspaceId, "hello", sendOptions),
@@ -300,8 +315,8 @@ describe("replay mode is read-only", () => {
         answer: await service.answerAskUserQuestion(workspaceId, "tool-1", { q: "a" }),
       };
       expect(results).toEqual({
-        send: { success: false, error: raw },
-        resume: { success: false, error: raw },
+        send: { success: false, error: refusal },
+        resume: { success: false, error: refusal },
         truncate: { success: false, error: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE },
         reset: { success: false, error: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE },
         replace: { success: false, error: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE },
@@ -337,10 +352,14 @@ describe("replay mode is read-only", () => {
     );
 
     setReplayTapes(JSON.stringify({ "ws-other": "/tapes/other.jsonl" }));
-    expect(await factory.createModel(model)).toEqual({
+    const refused = await factory.createModel(model);
+    expect(refused).toEqual({
       success: false,
-      error: { type: "unknown", raw: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE },
+      error: { type: "session_tape_replay", message: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE },
     });
+    // Background retries (startup recovery, RetryManager) must not loop on this refusal.
+    if (refused.success) throw new Error("expected a refusal");
+    expect(isNonRetryableSendError(refused.error)).toBe(true);
     expect(await Effect.runPromise(createEvaluationModel(model, evaluationDeps))).toEqual({
       success: false,
       error: { code: "provider_disabled", message: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE },
diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
index da10243f3e6..068a0fa9a20 100644
--- a/src/node/services/sessionTapes/sessionTapeReplaySource.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
@@ -24,7 +24,9 @@
  * - Refusals are terminal (`SESSION_TAPE_REPLAY_REFUSAL_DATA`): the renderer shows them instead
  *   of retrying. There is never a fallback to the live session.
  * - Events play at their recorded offsets; the subscription then stays open until the client
- *   aborts, so the renderer does not resubscribe and replay the tape again.
+ *   aborts, so the renderer does not resubscribe and replay the tape again. The only change to a
+ *   recorded event: `caught-up.hasOlderHistory` is set to false, so the renderer never pages older
+ *   rows in from the live workspace history.
  * Unmapped workspaces take the normal path. An unparseable map cannot tell which workspaces are
  * mapped, so it treats every workspace as mapped (and refused) rather than silently going live.
  * An invalid entry refuses only its own workspace.
@@ -174,7 +176,10 @@ export function getSessionTapeReplay(input: {
         refuseReplay(workspaceId, `Session tape ${entry} was recorded for another workspace`);
       }
       for await (const event of replaySessionTape(result, { pacing: "recorded", signal })) {
-        push(event);
+        // Windowed recordings can say (or, when the flag is absent, let the client infer) that
+        // older history exists; paging it in would load the live workspace's chat.jsonl, not
+        // the tape. An explicit false keeps the replay to the recorded window.
+        push(event.type === "caught-up" ? { ...event, hasOlderHistory: false } : event);
       }
       // Stay open until the client aborts, so the renderer does not resubscribe and replay.
       await waitForAbort(signal);
diff --git a/src/node/services/utils/sendMessageError.ts b/src/node/services/utils/sendMessageError.ts
index 802ff34257b..3700e89b0aa 100644
--- a/src/node/services/utils/sendMessageError.ts
+++ b/src/node/services/utils/sendMessageError.ts
@@ -133,6 +133,8 @@ export const formatSendMessageError = (
       return { message: EDIT_HISTORY_CHANGED_MESSAGE, errorType: "unknown" };
     case "plan_review_feedback_edit_blocked":
       return { message: error.message, errorType: "unknown" };
+    case "session_tape_replay":
+      return { message: error.message, errorType: "session_tape_replay" };
   }
 };
 
diff --git a/src/node/services/workspaceService.ts b/src/node/services/workspaceService.ts
index 7bbcfb927d7..009b194af1c 100644
--- a/src/node/services/workspaceService.ts
+++ b/src/node/services/workspaceService.ts
@@ -15208,7 +15208,7 @@ export class WorkspaceService
     // Perf harness replay mode (XUM_REPLAY_TAPES): transcripts come from tapes, so no live turn
     // may run, append history or reach providers, in any workspace. Every send enters here.
     if (isSessionTapeReplayMode()) {
-      return Err({ type: "unknown", raw: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE });
+      return Err({ type: "session_tape_replay", message: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE });
     }
     // Plan-review rows may only come from the dedicated endpoints, which validate them first.
     // Every generic send (oRPC/UI, CLI, ACP prompts, workflow continuations) enters here, and so
@@ -16146,7 +16146,7 @@ export class WorkspaceService
     try {
       // Perf harness replay mode (XUM_REPLAY_TAPES): see sendMessageWithIds.
       if (isSessionTapeReplayMode()) {
-        return Err({ type: "unknown", raw: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE });
+        return Err({ type: "session_tape_replay", message: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE });
       }
 
       // Block streaming while workspace is being renamed to prevent path conflicts

From 79b7f2749718ff8c961cc4707de1ede446589883 Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 09:04:19 +0000
Subject: [PATCH 12/18] fix(sessionTapes): run no API server in replay mode;
 isolate gh, coder and git remotes in perf.tapeReplay

Codex security round 1: browser/CLI clients of the API server would render tapes outside the
desktop egress block. UAT round 1: the app's background git remote queries and gh calls reached
the network; the scenario now shadows coder/gh with failing logged stubs and wraps git with
GIT_ALLOW_PROTOCOL=file.
---
 src/node/services/serverService.test.ts       | 26 +++++++++++++++++++
 src/node/services/serverService.ts            |  7 +++++
 .../sessionTapes/sessionTapeReplaySource.ts   |  4 +++
 tests/e2e/scenarios/perf.tapeReplay.spec.ts   | 25 +++++++++++++++---
 4 files changed, 59 insertions(+), 3 deletions(-)

diff --git a/src/node/services/serverService.test.ts b/src/node/services/serverService.test.ts
index 48ead9831b2..463711c7fb3 100644
--- a/src/node/services/serverService.test.ts
+++ b/src/node/services/serverService.test.ts
@@ -84,6 +84,32 @@ describe("ServerService.startServer", () => {
     });
   }
 
+  test("refuses to start in session tape replay mode, which serves only desktop windows", async () => {
+    const service = new ServerService();
+    const saved = process.env.XUM_REPLAY_TAPES;
+    process.env.XUM_REPLAY_TAPES = JSON.stringify({ ws: "/tapes/ws.jsonl" });
+    try {
+      let thrownError: unknown = null;
+      try {
+        await service.startServer({
+          xumHome: tempDir,
+          context: stubContext,
+          authToken: "test-token",
+          port: 0,
+        });
+      } catch (err) {
+        thrownError = err;
+      }
+      expect((thrownError as Error | null)?.message).toMatch(/replay mode/);
+      expect(service.isServerRunning()).toBe(false);
+      // No lockfile either: nothing may advertise a server that does not exist.
+      expect(await fs.stat(path.join(tempDir, "server.lock")).catch(() => null)).toBeNull();
+    } finally {
+      if (saved === undefined) delete process.env.XUM_REPLAY_TAPES;
+      else process.env.XUM_REPLAY_TAPES = saved;
+    }
+  });
+
   test("cleans up server when lockfile acquisition fails", async () => {
     const service = new ServerService();
 
diff --git a/src/node/services/serverService.ts b/src/node/services/serverService.ts
index a76895c0cab..994b6608646 100644
--- a/src/node/services/serverService.ts
+++ b/src/node/services/serverService.ts
@@ -10,6 +10,7 @@ import * as childProcess from "node:child_process";
 import { VERSION } from "@/version";
 import { buildMuxMdnsServiceOptions, MdnsAdvertiserService } from "./mdnsAdvertiserService";
 import type { AppRouter } from "@/node/orpc/router";
+import { isSessionTapeReplayMode } from "@/node/services/sessionTapes/sessionTapeReplaySource";
 
 export interface ServerInfo {
   /** Base URL that is always connectable from the local machine (loopback for wildcard binds). */
@@ -363,6 +364,12 @@ export class ServerService {
     if (this.server) {
       throw new Error("Server already running in this process");
     }
+    // Session tape replay mode (perf harness) serves tapes only to desktop windows, whose
+    // network egress desktop main blocks. A browser or CLI client of this server would render
+    // recorded content (remote images) outside that block, so replay mode runs no API server.
+    if (isSessionTapeReplayMode()) {
+      throw new Error("The API server is disabled in session tape replay mode (XUM_REPLAY_TAPES)");
+    }
 
     // Create lockfile instance for checking - don't store yet
     const lockfile = new ServerLockfile(options.xumHome);
diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
index 068a0fa9a20..e4ef8ba5081 100644
--- a/src/node/services/sessionTapes/sessionTapeReplaySource.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
@@ -12,6 +12,10 @@
  * - Provider model creation refuses (ProviderModelFactory, evaluationModelFactory), so no
  *   background service (status, title, compaction, memory, ...) can reach a provider.
  *
+ * Replay mode does not take the app's other background network offline (git remote queries,
+ * `gh`, Coder CLI probes): the harness does that (`make perf-tape-replay`, see
+ * tests/e2e/scenarios/perf.tapeReplay.spec.ts).
+ *
  * Contract for a mapped workspace (the router branches here before touching the session):
  * - No AgentSession, tool or provider code runs; events come only from the tape.
  * - Served only after desktop main blocked the renderer's network egress
diff --git a/tests/e2e/scenarios/perf.tapeReplay.spec.ts b/tests/e2e/scenarios/perf.tapeReplay.spec.ts
index 228820794ef..d98615f9c48 100644
--- a/tests/e2e/scenarios/perf.tapeReplay.spec.ts
+++ b/tests/e2e/scenarios/perf.tapeReplay.spec.ts
@@ -7,6 +7,7 @@
  * reach the network, and sends are refused. Inherited provider credentials are stripped from the
  * launch environment, so even a bug in the read-only gates could not reach a provider.
  */
+import { execFileSync } from "child_process";
 import fs from "fs";
 import path from "path";
 import type { Request } from "@playwright/test";
@@ -78,11 +79,29 @@ const test = electronTest.extend({
     for (const key of Object.keys(process.env)) {
       if (CREDENTIAL_ENV_PATTERN.test(key)) setEnv(key, undefined);
     }
-    // The backend probes the Coder CLI (`coder whoami`, which contacts the deployment) at
-    // startup. A failing stub keeps that probe local so the run makes no network connection.
+    // Replay mode keeps providers, recorded tools and recorded URLs offline. The app's other
+    // background network is this harness's job: the backend probes the Coder CLI (`coder
+    // version`, `coder whoami`), the git status and PR stores run `gh` and query the
+    // workspace's git remotes. Failing stubs (logged to stub-calls.log for UAT evidence) shadow
+    // `coder` and `gh`. A `git` wrapper allows only the file transport: the app's own git env
+    // sets GIT_ALLOW_PROTOCOL for network transports, so the launch env alone cannot.
     const stubBinDir = path.join(workspace.configRoot, "stub-bin");
+    const stubLog = path.join(workspace.configRoot, "stub-calls.log");
     fs.mkdirSync(stubBinDir, { recursive: true });
-    fs.writeFileSync(path.join(stubBinDir, "coder"), "#!/bin/sh\nexit 1\n", { mode: 0o755 });
+    for (const name of ["coder", "gh"]) {
+      fs.writeFileSync(
+        path.join(stubBinDir, name),
+        `#!/bin/sh\necho "${name} $*" >> '${stubLog}'\nexit 1\n`,
+        { mode: 0o755 }
+      );
+    }
+    const realGit = execFileSync("sh", ["-c", "command -v git"], { encoding: "utf-8" }).trim();
+    if (!path.isAbsolute(realGit)) throw new Error(`git not found on PATH: ${realGit}`);
+    fs.writeFileSync(
+      path.join(stubBinDir, "git"),
+      `#!/bin/sh\nGIT_ALLOW_PROTOCOL=file exec '${realGit}' "$@"\n`,
+      { mode: 0o755 }
+    );
     setEnv("PATH", `${stubBinDir}${path.delimiter}${process.env.PATH ?? ""}`);
     setEnv("MUX_REPLAY_TAPES", undefined);
     setEnv(

From c9fc75d848ec29ce33de8134ee8194c288ffd4b3 Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 09:13:34 +0000
Subject: [PATCH 13/18] fix(sessionTapes): address Codex round 2 (telemetry
 off, stopped tapes play, task admission disposed)

---
 src/browser/stores/WorkspaceStore.ts          |  3 --
 .../sessionTapeReplaySource.test.ts           | 53 +++++++++++++++----
 .../sessionTapes/sessionTapeReplaySource.ts   | 10 ++--
 src/node/services/telemetryService.test.ts    | 10 ++++
 src/node/services/telemetryService.ts         |  4 ++
 src/node/services/workspaceService.ts         | 11 ++--
 6 files changed, 70 insertions(+), 21 deletions(-)

diff --git a/src/browser/stores/WorkspaceStore.ts b/src/browser/stores/WorkspaceStore.ts
index 2c4d7ffcf88..9e1a75c318f 100644
--- a/src/browser/stores/WorkspaceStore.ts
+++ b/src/browser/stores/WorkspaceStore.ts
@@ -2207,9 +2207,6 @@ export class WorkspaceStore {
     },
     wasInterrupted: boolean
   ): void {
-    // Session tape replay (perf harness): replayed completions are recordings, not real
-    // streams, and telemetry would be network egress from a replay run.
-    if (isSessionTapeReplayRenderer()) return;
     const { metadata } = data;
     const durationSecs = metadata.duration ? metadata.duration / 1000 : 0;
     const outputTokens = metadata.usage?.outputTokens ?? 0;
diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
index c29650b622c..6c3f8505550 100644
--- a/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
@@ -32,6 +32,7 @@ import {
   markSessionTapeReplayEgressBlocked,
   SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE,
 } from "./sessionTapeReplaySource";
+import type { TurnAdmissionToken } from "@/node/services/taskWorkspaceSeam";
 import type * as ReplaySourceModule from "./sessionTapeReplaySource";
 import { buildSyntheticSessionTape, syntheticReplayTranscript } from "./sessionTapes.testFixtures";
 
@@ -187,15 +188,6 @@ describe("onChat replay source", () => {
       }),
       /is truncated/,
     ],
-    [
-      "a stopped tape",
-      async (dir) => ({
-        map: JSON.stringify({
-          [workspaceId]: await writeTape(dir, tapeFor(workspaceId, { end: { reason: "stopped" } })),
-        }),
-      }),
-      /is stopped/,
-    ],
     [
       "a since subscription",
       async (dir) => ({
@@ -250,6 +242,33 @@ describe("onChat replay source", () => {
     }
   );
 
+  test("plays a stopped tape (save command, quit) up to its stop point", async () => {
+    using dir = new DisposableTempDir("session-tape-replay-stopped");
+    const tapePath = await writeTape(dir, tapeFor(workspaceId, { end: { reason: "stopped" } }));
+    setReplayTapes(JSON.stringify({ [workspaceId]: tapePath }));
+    const { context, sessionRequests } = createContext(app);
+    const controller = new AbortController();
+    const iterator = subscribeWorkspaceChat(
+      context,
+      { workspaceId, mode: { type: "full" } },
+      controller.signal,
+      { validateOutput: true }
+    );
+    try {
+      const delivered: WorkspaceChatMessage[] = [];
+      while (delivered.length < events.length) {
+        const next = await iterator.next();
+        if (next.done) throw new Error("replay ended before the last event");
+        delivered.push(next.value);
+      }
+      expect(delivered.map((event) => event.type)).toEqual(events.map((event) => event.type));
+      expect(sessionRequests).toEqual([]);
+    } finally {
+      controller.abort();
+      await iterator.return(undefined);
+    }
+  });
+
   test("refuses to serve a tape before desktop main blocked renderer egress", async () => {
     using dir = new DisposableTempDir("session-tape-replay-no-egress-block");
     setReplayTapes(JSON.stringify({ [workspaceId]: await writeTape(dir, tapeFor(workspaceId)) }));
@@ -322,6 +341,22 @@ describe("replay mode is read-only", () => {
         replace: { success: false, error: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE },
         answer: { success: false, error: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE },
       });
+      // A task continuation's admission token is disposed, not leaked: its Stop latch must
+      // not wait on a turn that replay mode will never start.
+      const dispositions: string[] = [];
+      const token: TurnAdmissionToken = {
+        admissionStale: () => false,
+        onEnqueued: () => dispositions.push("enqueued"),
+        onAdmitted: () => dispositions.push("admitted"),
+        onDisposed: (kind) => dispositions.push(kind),
+      };
+      expect(
+        await service.sendMessage(workspaceId, "continue", sendOptions, {
+          acceptanceOrigin: "automatic",
+          turnAdmission: token,
+        })
+      ).toEqual({ success: false, error: refusal });
+      expect(dispositions).toEqual(["refused"]);
       const history = await historyService.getHistoryFromLatestBoundary(workspaceId);
       expect(history.success && history.data.map((message) => message.id)).toEqual(["u1"]);
     } finally {
diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
index e4ef8ba5081..cc471835d84 100644
--- a/src/node/services/sessionTapes/sessionTapeReplaySource.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
@@ -23,8 +23,10 @@
  *   fetched. `xum server` and browser mode always refuse.
  * - Only fresh full subscriptions, each with the whole tape (no resumable replay). `since` and
  *   `live` are refused: their client keeps rows a delta would not reset. Reload to replay again.
- * - Only complete (`closed`) tapes recorded for the mapped workspace (header `workspaceIdHash`).
- *   Rejected, truncated and stopped tapes are refused; the offline tools still describe them.
+ * - Only gap-free tapes recorded for the mapped workspace (header `workspaceIdHash`): `closed`
+ *   tapes, and `stopped` ones (finalized by the save command or at quit; complete up to the stop,
+ *   so a turn in progress at the stop stays in progress). Rejected and truncated tapes are
+ *   refused; the offline tools still describe them.
  * - Refusals are terminal (`SESSION_TAPE_REPLAY_REFUSAL_DATA`): the renderer shows them instead
  *   of retrying. There is never a fallback to the live session.
  * - Events play at their recorded offsets; the subscription then stays open until the client
@@ -168,10 +170,10 @@ export function getSessionTapeReplay(input: {
         const where = result.line === undefined ? "" : ` (line ${result.line})`;
         refuseReplay(workspaceId, `Session tape ${entry} rejected: ${result.reason}${where}`);
       }
-      if (result.status !== "ok") {
+      if (result.status === "truncated") {
         refuseReplay(
           workspaceId,
-          `Session tape ${entry} is ${result.status}: replay serves only complete (closed) tapes`
+          `Session tape ${entry} is truncated (size cap hit): replay serves only gap-free tapes`
         );
       }
       // A path mix-up would otherwise render another session's transcript (history rows do
diff --git a/src/node/services/telemetryService.test.ts b/src/node/services/telemetryService.test.ts
index e4d3bf0bdd9..5dc0cfe5955 100644
--- a/src/node/services/telemetryService.test.ts
+++ b/src/node/services/telemetryService.test.ts
@@ -23,6 +23,16 @@ describe("TelemetryService enablement", () => {
     expect(enabled).toBe(false);
   });
 
+  test("disables telemetry in session tape replay mode, even for a packaged app", () => {
+    const context = { isElectron: true, isPackaged: true };
+    expect(shouldEnableTelemetry(createContext({ ...context, env: {} }))).toBe(true);
+    expect(
+      shouldEnableTelemetry(
+        createContext({ ...context, env: { XUM_REPLAY_TAPES: '{"ws":"/tapes/ws.jsonl"}' } })
+      )
+    ).toBe(false);
+  });
+
   test("treats leftover MUX_DISABLE_TELEMETRY as an explicit opt-out", () => {
     const enabled = shouldEnableTelemetry(
       createContext({
diff --git a/src/node/services/telemetryService.ts b/src/node/services/telemetryService.ts
index 50b7d284e00..249e54d9abe 100644
--- a/src/node/services/telemetryService.ts
+++ b/src/node/services/telemetryService.ts
@@ -12,6 +12,7 @@
  * Uses posthog-node which batches events and flushes asynchronously.
  */
 
+import { isSessionTapeReplayConfigured } from "@/common/utils/sessionTapes/sessionTapeReplay";
 import { resolveXumEnvironmentValue } from "@/common/compat/legacyMux";
 import assert from "@/common/utils/assert";
 import { PostHog } from "posthog-node";
@@ -76,6 +77,9 @@ function isTelemetryDisabledByEnv(env: NodeJS.ProcessEnv): boolean {
   return (
     resolveXumEnvironmentValue("DISABLE_TELEMETRY", env) === "1" ||
     resolveXumEnvironmentValue("E2E", env) === "1" ||
+    // Session tape replay (perf harness): replayed activity is not real usage, and the PostHog
+    // client would be network egress from a replay run.
+    isSessionTapeReplayConfigured(env) ||
     env.NODE_ENV === "test" ||
     env.JEST_WORKER_ID !== undefined ||
     env.VITEST !== undefined ||
diff --git a/src/node/services/workspaceService.ts b/src/node/services/workspaceService.ts
index 009b194af1c..07ccd5ca8fa 100644
--- a/src/node/services/workspaceService.ts
+++ b/src/node/services/workspaceService.ts
@@ -15205,11 +15205,6 @@ export class WorkspaceService
       (internal?.acceptanceOrigin ?? "manual") === "manual" && internal?.agentInitiated !== true
         ? aiSelectionIntent
         : undefined;
-    // Perf harness replay mode (XUM_REPLAY_TAPES): transcripts come from tapes, so no live turn
-    // may run, append history or reach providers, in any workspace. Every send enters here.
-    if (isSessionTapeReplayMode()) {
-      return Err({ type: "session_tape_replay", message: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE });
-    }
     // Plan-review rows may only come from the dedicated endpoints, which validate them first.
     // Every generic send (oRPC/UI, CLI, ACP prompts, workflow continuations) enters here, and so
     // does anything it later queues or defers behind compaction; refuse before any side effect.
@@ -15241,6 +15236,12 @@ export class WorkspaceService
         if (!taskTurnHandedToQueue) taskTurnAdmission?.onDisposed("refused");
       },
     };
+    // Perf harness replay mode (XUM_REPLAY_TAPES): transcripts come from tapes, so no live turn
+    // may run, append history or reach providers, in any workspace. Every send enters here.
+    // Refused after the admission scope above, so a caller's task token is disposed.
+    if (isSessionTapeReplayMode()) {
+      return Err({ type: "session_tape_replay", message: SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE });
+    }
     let taskTurnAdmissionComposed = false;
     // `expectedAttemptId`: the attempt this send's own reawaken committed (see below).
     const admitTaskTurn = (expectedAttemptId?: string): Result<void, SendMessageError> => {

From c0f38ebc7b52c2bdccb8c8f5a47e773f61473c7d Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 09:25:57 +0000
Subject: [PATCH 14/18] fix(sessionTapes): address Codex round 3 (deep header
 rejection, terminal dev origin)

---
 .../utils/sessionTapes/sessionTapeLoader.ts   |  5 +++
 src/desktop/main.ts                           |  3 +-
 src/desktop/sessionTapeReplayEgress.test.ts   | 42 +++++++++++--------
 src/desktop/sessionTapeReplayEgress.ts        | 19 +++++----
 src/desktop/terminalDevServerOrigin.ts        |  5 +++
 src/desktop/terminalWindowManager.ts          |  5 ++-
 .../sessionTapes/sessionTapeReplay.test.ts    | 10 +++++
 7 files changed, 60 insertions(+), 29 deletions(-)
 create mode 100644 src/desktop/terminalDevServerOrigin.ts

diff --git a/src/common/utils/sessionTapes/sessionTapeLoader.ts b/src/common/utils/sessionTapes/sessionTapeLoader.ts
index e6d752894c2..33319936d74 100644
--- a/src/common/utils/sessionTapes/sessionTapeLoader.ts
+++ b/src/common/utils/sessionTapes/sessionTapeLoader.ts
@@ -240,6 +240,11 @@ export function loadSessionTape(
         ...(error.header !== undefined && { header: error.header }),
       };
     }
+    // Any line nested deeply enough (header and trailer included) can overflow the stack while
+    // it is formatted or validated. That is bad tape content too: reject, never throw.
+    if (error instanceof RangeError) {
+      return { status: "rejected", reason: "tape is nested too deeply to validate" };
+    }
     throw error;
   }
 }
diff --git a/src/desktop/main.ts b/src/desktop/main.ts
index f41a20c69ba..6ef5ee26435 100644
--- a/src/desktop/main.ts
+++ b/src/desktop/main.ts
@@ -200,6 +200,7 @@ import {
   installSessionTapeReplayEgressBlock,
   refuseSessionTapeReplayExternalOpen,
 } from "./sessionTapeReplayEgress";
+import { TERMINAL_DEV_SERVER_ORIGIN } from "./terminalDevServerOrigin";
 import { isSessionTapeReplayConfigured } from "@/common/utils/sessionTapes/sessionTapeReplay";
 
 // Lets the main process read a hung renderer's JS stack (see ./perf/hangStacks). Merge into
@@ -1522,7 +1523,7 @@ async function startDesktopAfterStorage(): Promise<void> {
       if (isSessionTapeReplayConfigured(process.env)) {
         installSessionTapeReplayEgressBlock(
           electronSession.defaultSession,
-          shouldUseDevServer() ? getDevServerUrl() : undefined
+          shouldUseDevServer() ? [getDevServerUrl(), TERMINAL_DEV_SERVER_ORIGIN] : []
         );
         const { markSessionTapeReplayEgressBlocked } =
           // eslint-disable-next-line no-restricted-syntax -- keeps zod off the pre-splash path (#4423)
diff --git a/src/desktop/sessionTapeReplayEgress.test.ts b/src/desktop/sessionTapeReplayEgress.test.ts
index dafdd6cf70d..51a92f763e6 100644
--- a/src/desktop/sessionTapeReplayEgress.test.ts
+++ b/src/desktop/sessionTapeReplayEgress.test.ts
@@ -4,23 +4,29 @@ import { isSessionTapeReplayAllowedUrl } from "./sessionTapeReplayEgress";
 describe("isSessionTapeReplayAllowedUrl", () => {
   const devOrigin = "http://127.0.0.1:5173";
 
-  test.each<[string, string, string | undefined, boolean]>([
-    ["the dist app page", "file:///opt/xum/dist/index.html", undefined, true],
-    ["inline data", "data:image/png;base64,AAAA", undefined, true],
-    ["blob URLs", "blob:file:///0b6c1f2e-1234", undefined, true],
-    ["devtools", "devtools://devtools/bundled/inspector.html", undefined, true],
-    ["a recorded remote image", "https://replay-egress-probe.invalid/a.png", undefined, false],
-    ["a recorded loopback image", "http://127.0.0.1:47999/a.png", undefined, false],
-    ["localhost", "http://localhost:5173/", undefined, false],
-    ["a websocket", "wss://example.com/socket", undefined, false],
-    ["an unparseable URL", "not a url", undefined, false],
-    ["the dev server page", "http://127.0.0.1:5173/src/main.tsx", devOrigin, true],
-    ["the dev server's HMR socket", "ws://127.0.0.1:5173/?token=x", devOrigin, true],
-    ["the dev server origin over https", "https://127.0.0.1:5173/", devOrigin, false],
-    ["the dev server host on another port", "http://127.0.0.1:47999/a.png", devOrigin, false],
-    ["another loopback name for the dev server", "http://localhost:5173/", devOrigin, false],
-    ["a remote host in dev mode", "https://replay-egress-probe.invalid/a.png", devOrigin, false],
-  ])("%s: %s", (_name, url, devServerOrigin, allowed) => {
-    expect(isSessionTapeReplayAllowedUrl(url, devServerOrigin)).toBe(allowed);
+  test.each<[string, string, readonly string[], boolean]>([
+    ["the dist app page", "file:///opt/xum/dist/index.html", [], true],
+    ["inline data", "data:image/png;base64,AAAA", [], true],
+    ["blob URLs", "blob:file:///0b6c1f2e-1234", [], true],
+    ["devtools", "devtools://devtools/bundled/inspector.html", [], true],
+    ["a recorded remote image", "https://replay-egress-probe.invalid/a.png", [], false],
+    ["a recorded loopback image", "http://127.0.0.1:47999/a.png", [], false],
+    ["localhost", "http://localhost:5173/", [], false],
+    ["a websocket", "wss://example.com/socket", [], false],
+    ["an unparseable URL", "not a url", [], false],
+    ["the dev server page", "http://127.0.0.1:5173/src/main.tsx", [devOrigin], true],
+    ["the dev server's HMR socket", "ws://127.0.0.1:5173/?token=x", [devOrigin], true],
+    ["the dev server origin over https", "https://127.0.0.1:5173/", [devOrigin], false],
+    ["the dev server host on another port", "http://127.0.0.1:47999/a.png", [devOrigin], false],
+    ["another loopback name for the dev server", "http://localhost:5173/", [devOrigin], false],
+    [
+      "the terminal page origin",
+      "http://localhost:5173/terminal.html?workspaceId=w",
+      [devOrigin, "http://localhost:5173"],
+      true,
+    ],
+    ["a remote host in dev mode", "https://replay-egress-probe.invalid/a.png", [devOrigin], false],
+  ])("%s: %s", (_name, url, devServerOrigins, allowed) => {
+    expect(isSessionTapeReplayAllowedUrl(url, devServerOrigins)).toBe(allowed);
   });
 });
diff --git a/src/desktop/sessionTapeReplayEgress.ts b/src/desktop/sessionTapeReplayEgress.ts
index bf13342089c..0a7cd060f4d 100644
--- a/src/desktop/sessionTapeReplayEgress.ts
+++ b/src/desktop/sessionTapeReplayEgress.ts
@@ -17,12 +17,13 @@ const ALLOWED_PROTOCOLS = new Set(["file:", "data:", "blob:", "devtools:"]);
 
 /**
  * Whether the renderer may load `url` in replay mode. Everything not local is refused, loopback
- * included (recorded content can point at local services). `devServerOrigin` (dev-server mode
- * only, e.g. `http://127.0.0.1:5173`) also allows that exact origin over http and ws (HMR).
+ * included (recorded content can point at local services). `devServerOrigins` (dev-server mode
+ * only: the app page's, e.g. `http://127.0.0.1:5173`, and the terminal page's) also allows those
+ * exact origins over http and ws (HMR).
  */
 export function isSessionTapeReplayAllowedUrl(
   url: string,
-  devServerOrigin: string | undefined
+  devServerOrigins: readonly string[]
 ): boolean {
   let parsed: URL;
   try {
@@ -31,13 +32,13 @@ export function isSessionTapeReplayAllowedUrl(
     return false;
   }
   if (ALLOWED_PROTOCOLS.has(parsed.protocol)) return true;
-  if (devServerOrigin === undefined) return false;
-  const dev = new URL(devServerOrigin);
-  if (dev.protocol !== "http:") return false;
   if (parsed.protocol !== "http:" && parsed.protocol !== "ws:") return false;
   // `host` includes the port only when it is not the scheme default, and http and ws share
   // default port 80, so comparing `host` matches the exact host and port for both schemes.
-  return parsed.host === dev.host;
+  return devServerOrigins.some((origin) => {
+    const dev = new URL(origin);
+    return dev.protocol === "http:" && parsed.host === dev.host;
+  });
 }
 
 /** Origin (or scheme) of a refused URL: logs never carry recorded paths or queries. */
@@ -56,11 +57,11 @@ function describeOrigin(url: string): string {
  */
 export function installSessionTapeReplayEgressBlock(
   session: Session,
-  devServerOrigin: string | undefined
+  devServerOrigins: readonly string[]
 ): void {
   let blockedCount = 0;
   session.webRequest.onBeforeRequest({ urls: ["<all_urls>"] }, (details, callback) => {
-    const allowed = isSessionTapeReplayAllowedUrl(details.url, devServerOrigin);
+    const allowed = isSessionTapeReplayAllowedUrl(details.url, devServerOrigins);
     if (!allowed) {
       blockedCount += 1;
       log.info("Session tape replay blocked a renderer request", {
diff --git a/src/desktop/terminalDevServerOrigin.ts b/src/desktop/terminalDevServerOrigin.ts
new file mode 100644
index 00000000000..e750f46f530
--- /dev/null
+++ b/src/desktop/terminalDevServerOrigin.ts
@@ -0,0 +1,5 @@
+/**
+ * Dev-server origin of pop-out terminal pages (dev mode only). Its own module so desktop main can
+ * read it without loading terminalWindowManager on the startup path.
+ */
+export const TERMINAL_DEV_SERVER_ORIGIN = "http://localhost:5173";
diff --git a/src/desktop/terminalWindowManager.ts b/src/desktop/terminalWindowManager.ts
index 77b5d85ca0d..eb2f90b814c 100644
--- a/src/desktop/terminalWindowManager.ts
+++ b/src/desktop/terminalWindowManager.ts
@@ -10,6 +10,7 @@ import * as path from "path";
 import { resolveXumEnvironmentValue } from "@/common/compat/legacyMux";
 import { normalizeAndValidateExternalUrl } from "@/desktop/utils/normalizeAndValidateExternalUrl";
 import { refuseSessionTapeReplayExternalOpen } from "@/desktop/sessionTapeReplayEgress";
+import { TERMINAL_DEV_SERVER_ORIGIN } from "@/desktop/terminalDevServerOrigin";
 import { log } from "@/node/services/log";
 import type { Config } from "@/node/config";
 
@@ -135,7 +136,9 @@ export class TerminalWindowManager {
     if (useDevServer) {
       // Development mode - load from Vite dev server
       const params = new URLSearchParams(queryParams);
-      await terminalWindow.loadURL(`http://localhost:5173/terminal.html?${params.toString()}`);
+      await terminalWindow.loadURL(
+        `${TERMINAL_DEV_SERVER_ORIGIN}/terminal.html?${params.toString()}`
+      );
       terminalWindow.webContents.openDevTools();
     } else {
       // Production mode (or E2E dist mode) - load from built files
diff --git a/src/node/services/sessionTapes/sessionTapeReplay.test.ts b/src/node/services/sessionTapes/sessionTapeReplay.test.ts
index db865cae7c1..f161fe90ffa 100644
--- a/src/node/services/sessionTapes/sessionTapeReplay.test.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplay.test.ts
@@ -207,6 +207,16 @@ describe("loadSessionTape", () => {
       3,
       true,
     ],
+    [
+      "a header nested too deep to validate",
+      (lines) => {
+        const depth = 200_000;
+        lines[0] = `{"tape":${"[".repeat(depth) + "]".repeat(depth)}}`;
+      },
+      "tape is nested too deeply to validate",
+      undefined,
+      false,
+    ],
     [
       "offset going backwards",
       (lines) => patchLine(lines, 3, (line) => (line.t = 0)),

From ad52106e6aee9a8e3f9915cc23044b133b994bb9 Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 09:43:18 +0000
Subject: [PATCH 15/18] fix(sessionTapes): address Codex round 4 (static egress
 latch, local-only file URLs, documented read-only funnels)

---
 src/browser/stores/WorkspaceStore.test.ts     |  3 +-
 .../utils/sessionTapes/sessionTapeReplay.ts   | 15 +++++++
 src/desktop/main.ts                           |  4 --
 src/desktop/sessionTapeReplayEgress.test.ts   | 35 ++++++++++++++-
 src/desktop/sessionTapeReplayEgress.ts        | 12 ++++-
 .../sessionTapeReplaySource.test.ts           | 45 +++++++++----------
 .../sessionTapes/sessionTapeReplaySource.ts   | 21 ++++-----
 7 files changed, 90 insertions(+), 45 deletions(-)

diff --git a/src/browser/stores/WorkspaceStore.test.ts b/src/browser/stores/WorkspaceStore.test.ts
index 8f8230a8644..aaac96ab513 100644
--- a/src/browser/stores/WorkspaceStore.test.ts
+++ b/src/browser/stores/WorkspaceStore.test.ts
@@ -6,8 +6,7 @@ import { createAgentSessionHarness } from "@/node/services/agentSession.testHarn
 import { createWorkspaceServiceForTest } from "@/node/services/workspaceService.testHarness";
 // eslint-disable-next-line local/no-cross-boundary-imports -- exercise the actual IPC replay boundary in this store fixture
 import { subscribeWorkspaceChat } from "@/node/orpc/routerSubscriptions";
-// eslint-disable-next-line local/no-cross-boundary-imports -- the backend's replay mode gate (desktop main sets it)
-import { markSessionTapeReplayEgressBlocked } from "@/node/services/sessionTapes/sessionTapeReplaySource";
+import { markSessionTapeReplayEgressBlocked } from "@/common/utils/sessionTapes/sessionTapeReplay";
 import type { ORPCContext } from "@/node/orpc/context";
 import { CUSTOM_EVENTS } from "@/common/constants/events";
 import { MUX_GATEWAY_SESSION_EXPIRED_MESSAGE } from "@/common/constants/muxGatewayOAuth";
diff --git a/src/common/utils/sessionTapes/sessionTapeReplay.ts b/src/common/utils/sessionTapes/sessionTapeReplay.ts
index fee5c3b0c83..3d7eeaf070c 100644
--- a/src/common/utils/sessionTapes/sessionTapeReplay.ts
+++ b/src/common/utils/sessionTapes/sessionTapeReplay.ts
@@ -25,6 +25,21 @@ export function isSessionTapeReplayConfigured(env: XumEnvironment): boolean {
   return (resolveXumEnvironmentValue("REPLAY_TAPES", env) ?? "").trim() !== "";
 }
 
+let egressBlocked = false;
+
+/**
+ * Set by desktop main's renderer egress block (src/desktop/sessionTapeReplayEgress.ts) once it is
+ * installed on the default session. Until then the backend serves no tape, so `xum server` and
+ * browser mode never do. Lives here (no heavy imports) so desktop main can import it statically.
+ */
+export function markSessionTapeReplayEgressBlocked(): void {
+  egressBlocked = true;
+}
+
+export function isSessionTapeReplayEgressBlocked(): boolean {
+  return egressBlocked;
+}
+
 /**
  * `data` of the error that refuses onChat for a workspace mapped to a session tape
  * (XUM_REPLAY_TAPES) that cannot be served. It survives the oRPC transport (an ORPCError's
diff --git a/src/desktop/main.ts b/src/desktop/main.ts
index 6ef5ee26435..512580af813 100644
--- a/src/desktop/main.ts
+++ b/src/desktop/main.ts
@@ -1525,10 +1525,6 @@ async function startDesktopAfterStorage(): Promise<void> {
           electronSession.defaultSession,
           shouldUseDevServer() ? [getDevServerUrl(), TERMINAL_DEV_SERVER_ORIGIN] : []
         );
-        const { markSessionTapeReplayEgressBlocked } =
-          // eslint-disable-next-line no-restricted-syntax -- keeps zod off the pre-splash path (#4423)
-          await import("../node/services/sessionTapes/sessionTapeReplaySource");
-        markSessionTapeReplayEgressBlocked();
       }
 
       if (await maybeRunAttachFileSmokeTest()) {
diff --git a/src/desktop/sessionTapeReplayEgress.test.ts b/src/desktop/sessionTapeReplayEgress.test.ts
index 51a92f763e6..b6f10d5a678 100644
--- a/src/desktop/sessionTapeReplayEgress.test.ts
+++ b/src/desktop/sessionTapeReplayEgress.test.ts
@@ -1,11 +1,18 @@
 import { describe, expect, test } from "bun:test";
-import { isSessionTapeReplayAllowedUrl } from "./sessionTapeReplayEgress";
+import type { Session } from "electron";
+import { isSessionTapeReplayEgressBlocked } from "@/common/utils/sessionTapes/sessionTapeReplay";
+import {
+  installSessionTapeReplayEgressBlock,
+  isSessionTapeReplayAllowedUrl,
+} from "./sessionTapeReplayEgress";
 
 describe("isSessionTapeReplayAllowedUrl", () => {
   const devOrigin = "http://127.0.0.1:5173";
 
   test.each<[string, string, readonly string[], boolean]>([
     ["the dist app page", "file:///opt/xum/dist/index.html", [], true],
+    ["a remote file share (UNC authority)", "file://192.168.1.1/share/probe.png", [], false],
+    ["a remote file share (UNC path)", "file:////192.168.1.1/share/probe.png", [], false],
     ["inline data", "data:image/png;base64,AAAA", [], true],
     ["blob URLs", "blob:file:///0b6c1f2e-1234", [], true],
     ["devtools", "devtools://devtools/bundled/inspector.html", [], true],
@@ -30,3 +37,29 @@ describe("isSessionTapeReplayAllowedUrl", () => {
     expect(isSessionTapeReplayAllowedUrl(url, devServerOrigins)).toBe(allowed);
   });
 });
+
+describe("installSessionTapeReplayEgressBlock", () => {
+  test("cancels refused requests, and only then lets the backend serve tapes", () => {
+    let listener:
+      | ((details: { url: string }, callback: (response: { cancel: boolean }) => void) => void)
+      | undefined;
+    const session = {
+      webRequest: {
+        onBeforeRequest: (_filter: unknown, handler: NonNullable<typeof listener>) => {
+          // The latch must not be set before the block exists.
+          expect(isSessionTapeReplayEgressBlocked()).toBe(false);
+          listener = handler;
+        },
+      },
+    } as unknown as Session;
+    installSessionTapeReplayEgressBlock(session, []);
+    expect(isSessionTapeReplayEgressBlocked()).toBe(true);
+    const decide = (url: string) => {
+      let cancel: boolean | undefined;
+      listener?.({ url }, (response) => (cancel = response.cancel));
+      return cancel;
+    };
+    expect(decide("https://replay-egress-probe.invalid/a.png")).toBe(true);
+    expect(decide("file:///opt/xum/dist/index.html")).toBe(false);
+  });
+});
diff --git a/src/desktop/sessionTapeReplayEgress.ts b/src/desktop/sessionTapeReplayEgress.ts
index 0a7cd060f4d..f065b16ea3e 100644
--- a/src/desktop/sessionTapeReplayEgress.ts
+++ b/src/desktop/sessionTapeReplayEgress.ts
@@ -10,10 +10,13 @@
  */
 import type { Session } from "electron";
 import { log } from "@/node/services/log";
-import { isSessionTapeReplayConfigured } from "@/common/utils/sessionTapes/sessionTapeReplay";
+import {
+  isSessionTapeReplayConfigured,
+  markSessionTapeReplayEgressBlocked,
+} from "@/common/utils/sessionTapes/sessionTapeReplay";
 
 /** Local schemes that never leave the machine. */
-const ALLOWED_PROTOCOLS = new Set(["file:", "data:", "blob:", "devtools:"]);
+const ALLOWED_PROTOCOLS = new Set(["data:", "blob:", "devtools:"]);
 
 /**
  * Whether the renderer may load `url` in replay mode. Everything not local is refused, loopback
@@ -31,6 +34,9 @@ export function isSessionTapeReplayAllowedUrl(
   } catch {
     return false;
   }
+  // A file URL with an authority (`file://host/share`) or a UNC-style path is a network share
+  // on Windows (SMB egress, and possibly the user's credentials): only local files pass.
+  if (parsed.protocol === "file:") return parsed.host === "" && !parsed.pathname.startsWith("//");
   if (ALLOWED_PROTOCOLS.has(parsed.protocol)) return true;
   if (parsed.protocol !== "http:" && parsed.protocol !== "ws:") return false;
   // `host` includes the port only when it is not the scheme default, and http and ws share
@@ -71,6 +77,8 @@ export function installSessionTapeReplayEgressBlock(
     }
     callback({ cancel: !allowed });
   });
+  // Only now may the backend serve tapes.
+  markSessionTapeReplayEgressBlocked();
 }
 
 /**
diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
index 6c3f8505550..aa25338781c 100644
--- a/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
@@ -15,6 +15,7 @@ import type { WorkspaceChatMessage } from "@/common/orpc/types";
 import { loadSessionTape } from "@/common/utils/sessionTapes/sessionTapeLoader";
 import {
   isSessionTapeReplayRefusal,
+  markSessionTapeReplayEgressBlocked,
   SESSION_TAPE_REPLAY_REFUSAL_DATA,
 } from "@/common/utils/sessionTapes/sessionTapeReplay";
 import type { ORPCContext } from "@/node/orpc/context";
@@ -28,12 +29,8 @@ import { ProviderService } from "@/node/services/providerService";
 import { DisposableTempDir } from "@/node/services/tempDir";
 import { createTestHistoryService } from "@/node/services/testHistoryService";
 import { createWorkspaceServiceForTest } from "@/node/services/workspaceService.testHarness";
-import {
-  markSessionTapeReplayEgressBlocked,
-  SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE,
-} from "./sessionTapeReplaySource";
+import { SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE } from "./sessionTapeReplaySource";
 import type { TurnAdmissionToken } from "@/node/services/taskWorkspaceSeam";
-import type * as ReplaySourceModule from "./sessionTapeReplaySource";
 import { buildSyntheticSessionTape, syntheticReplayTranscript } from "./sessionTapes.testFixtures";
 
 const ENV_KEYS = ["XUM_REPLAY_TAPES", "MUX_REPLAY_TAPES"] as const;
@@ -271,24 +268,26 @@ describe("onChat replay source", () => {
 
   test("refuses to serve a tape before desktop main blocked renderer egress", async () => {
     using dir = new DisposableTempDir("session-tape-replay-no-egress-block");
-    setReplayTapes(JSON.stringify({ [workspaceId]: await writeTape(dir, tapeFor(workspaceId)) }));
-    // A fresh module instance: no egress block was installed in it (as in `xum server`).
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const fresh = require(
-      `./sessionTapeReplaySource?fresh=${randomUUID()}`
-    ) as typeof ReplaySourceModule;
-    const replay = fresh.getSessionTapeReplay({ workspaceId });
-    if (!replay) throw new Error("the mapped workspace must get a replay");
-    const pushed: WorkspaceChatMessage[] = [];
-    const error: unknown = await replay
-      .play((event) => pushed.push(event))
-      .then(
-        () => undefined,
-        (rejection: unknown) => rejection
-      );
-    expect(isSessionTapeReplayRefusal(error)).toBe(true);
-    expect((error as Error).message).toMatch(/egress block/);
-    expect(pushed).toEqual([]);
+    const tapePath = await writeTape(dir, tapeFor(workspaceId));
+    // A fresh process installs no egress block, as in `xum server` (this one already has).
+    const script = `
+      const { getSessionTapeReplay } = await import(${JSON.stringify(require.resolve("./sessionTapeReplaySource"))});
+      const { isSessionTapeReplayRefusal } = await import(${JSON.stringify(require.resolve("@/common/utils/sessionTapes/sessionTapeReplay"))});
+      const pushed = [];
+      const error = await getSessionTapeReplay({ workspaceId: ${JSON.stringify(workspaceId)} })
+        .play((event) => pushed.push(event))
+        .then(() => undefined, (rejection) => rejection);
+      console.log(JSON.stringify({ refused: isSessionTapeReplayRefusal(error), message: error?.message, pushed: pushed.length }));
+    `;
+    const child = Bun.spawnSync([process.execPath, "-e", script], {
+      env: { ...process.env, XUM_REPLAY_TAPES: JSON.stringify({ [workspaceId]: tapePath }) },
+    });
+    const output = child.stdout.toString().trim().split("\n").at(-1) ?? "";
+    expect(JSON.parse(output)).toEqual({
+      refused: true,
+      message: "session tape replay requires the desktop app's egress block",
+      pushed: 0,
+    });
   });
 
   test.each<[string, string | undefined]>([
diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
index cc471835d84..159d97e8dcf 100644
--- a/src/node/services/sessionTapes/sessionTapeReplaySource.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
@@ -7,8 +7,11 @@
  * Configuration: `XUM_REPLAY_TAPES` (legacy `MUX_REPLAY_TAPES`) is a JSON object mapping
  * workspace ids to absolute tape paths. Unset or blank: nothing here does any work. Set (even
  * unparseable): the whole process is in replay mode, which is read-only:
- * - Sends, resumes and history changes refuse with SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE for
- *   every workspace (WorkspaceService funnels).
+ * - The WorkspaceService funnels that start turns or rewrite history refuse with
+ *   SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE for every workspace: send, resume, truncate/clear,
+ *   reset, replace (Start Here) and ask-user answers. Other writes (plan-review snapshots and
+ *   thread state, ...) are not guarded: they touch the workspace's own chat.jsonl, never the
+ *   tape. Map only scratch workspaces (the perf harness uses a fresh root).
  * - Provider model creation refuses (ProviderModelFactory, evaluationModelFactory), so no
  *   background service (status, title, compaction, memory, ...) can reach a provider.
  *
@@ -43,6 +46,7 @@ import { resolveXumEnvironmentValue } from "@/common/compat/xumEnv";
 import type { OnChatMode, WorkspaceChatMessage } from "@/common/orpc/types";
 import {
   isSessionTapeReplayConfigured,
+  isSessionTapeReplayEgressBlocked,
   replaySessionTape,
   SESSION_TAPE_REPLAY_REFUSAL_DATA,
 } from "@/common/utils/sessionTapes/sessionTapeReplay";
@@ -59,16 +63,6 @@ export function isSessionTapeReplayMode(): boolean {
   return isSessionTapeReplayConfigured(process.env);
 }
 
-let egressBlocked = false;
-
-/**
- * Called by desktop main once the renderer egress block is installed on the default session
- * (src/desktop/sessionTapeReplayEgress.ts). Until then no tape is served.
- */
-export function markSessionTapeReplayEgressBlocked(): void {
-  egressBlocked = true;
-}
-
 /** Workspace id -> absolute tape path, or why that entry cannot be used. */
 type ReplayTapeMap = ReadonlyMap<string, string | Error>;
 
@@ -136,7 +130,8 @@ function getUpfrontRefusal(
   mode: OnChatMode | undefined
 ): string | undefined {
   if (entry instanceof Error) return entry.message;
-  if (!egressBlocked) return "session tape replay requires the desktop app's egress block";
+  if (!isSessionTapeReplayEgressBlocked())
+    return "session tape replay requires the desktop app's egress block";
   if (mode !== undefined && mode.type !== "full") {
     return `Session tape replay serves only fresh full subscriptions (got "${mode.type}"); reload to replay the tape again`;
   }

From e8289e2817f87d46eb7ef61326f0443a522654a1 Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 09:53:39 +0000
Subject: [PATCH 16/18] fix(sessionTapes): refuse tapes without one successful
 caught-up (Codex round 5)

---
 .../sessionTapeReplaySource.test.ts           | 34 +++++++++++++++++++
 .../sessionTapes/sessionTapeReplaySource.ts   | 15 ++++++++
 2 files changed, 49 insertions(+)

diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
index aa25338781c..7471c6bee0f 100644
--- a/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
@@ -185,6 +185,40 @@ describe("onChat replay source", () => {
       }),
       /is truncated/,
     ],
+    [
+      "a tape that ended before its caught-up",
+      async (dir) => ({
+        map: JSON.stringify({
+          [workspaceId]: await writeTape(
+            dir,
+            buildSyntheticSessionTape(
+              syntheticReplayTranscript(workspaceId).filter((event) => event.type !== "caught-up"),
+              { workspaceId }
+            )
+          ),
+        }),
+      }),
+      /no single successful caught-up/,
+    ],
+    [
+      "a tape whose history replay failed",
+      async (dir) => ({
+        map: JSON.stringify({
+          [workspaceId]: await writeTape(
+            dir,
+            buildSyntheticSessionTape(
+              syntheticReplayTranscript(workspaceId).map((event) =>
+                event.type === "caught-up"
+                  ? { ...event, historyReplayStatus: "failed" as const }
+                  : event
+              ),
+              { workspaceId }
+            )
+          ),
+        }),
+      }),
+      /no single successful caught-up/,
+    ],
     [
       "a since subscription",
       async (dir) => ({
diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
index 159d97e8dcf..20fd1e844cc 100644
--- a/src/node/services/sessionTapes/sessionTapeReplaySource.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
@@ -26,6 +26,7 @@
  *   fetched. `xum server` and browser mode always refuse.
  * - Only fresh full subscriptions, each with the whole tape (no resumable replay). `since` and
  *   `live` are refused: their client keeps rows a delta would not reset. Reload to replay again.
+ * - Only tapes with exactly one successful `caught-up` (a recorded, complete history replay).
  * - Only gap-free tapes recorded for the mapped workspace (header `workspaceIdHash`): `closed`
  *   tapes, and `stopped` ones (finalized by the save command or at quit; complete up to the stop,
  *   so a turn in progress at the stop stays in progress). Rejected and truncated tapes are
@@ -176,6 +177,20 @@ export function getSessionTapeReplay(input: {
       if (result.header.workspaceIdHash !== hashSessionTapeWorkspaceId(workspaceId)) {
         refuseReplay(workspaceId, `Session tape ${entry} was recorded for another workspace`);
       }
+      // A full replay hydrates on its one caught-up. A tape finalized before it (switched away
+      // or saved while history was loading) would leave the renderer hydrating forever, and a
+      // failed history read makes the renderer retry the same tape without end.
+      const caughtUp = result.events.filter(({ event }) => event.type === "caught-up");
+      if (
+        caughtUp.length !== 1 ||
+        caughtUp[0].event.type !== "caught-up" ||
+        caughtUp[0].event.historyReplayStatus !== "complete"
+      ) {
+        refuseReplay(
+          workspaceId,
+          `Session tape ${entry} has no single successful caught-up: it did not record a complete history replay`
+        );
+      }
       for await (const event of replaySessionTape(result, { pacing: "recorded", signal })) {
         // Windowed recordings can say (or, when the flag is absent, let the client infer) that
         // older history exists; paging it in would load the live workspace's chat.jsonl, not

From d8baf20e7469186a9edd4b089dc350fb65b48d48 Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 10:15:13 +0000
Subject: [PATCH 17/18] fix(sessionTapes): address Codex round 6 (UNC tape
 paths, static imports in the child test, shared timer limit, drop fixture
 copy test)

---
 scripts/perf/tapeReplayFixture.test.ts             |  6 ------
 src/common/utils/sessionTapes/sessionTapeReplay.ts |  4 +---
 src/constants/timers.ts                            |  5 +++++
 .../sessionTapes/sessionTapeReplay.test.ts         |  5 +++--
 .../sessionTapes/sessionTapeReplaySource.test.ts   | 12 +++++++++---
 .../sessionTapes/sessionTapeReplaySource.ts        | 14 ++++++++++++--
 6 files changed, 30 insertions(+), 16 deletions(-)
 create mode 100644 src/constants/timers.ts

diff --git a/scripts/perf/tapeReplayFixture.test.ts b/scripts/perf/tapeReplayFixture.test.ts
index fe64032325d..cb6bdf9abde 100644
--- a/scripts/perf/tapeReplayFixture.test.ts
+++ b/scripts/perf/tapeReplayFixture.test.ts
@@ -1,10 +1,8 @@
 import { describe, expect, test } from "bun:test";
-import { readFileSync } from "node:fs";
 import * as path from "node:path";
 import { hashSessionTapeWorkspaceId } from "@/node/services/sessionTapes/sessionTapeRecorder";
 import { readSessionTapeFile } from "@/node/services/sessionTapes/sessionTapeFile";
 import {
-  buildTapeReplayFixtureTape,
   TAPE_REPLAY_FIXTURE_FILE_NAME,
   TAPE_REPLAY_FIXTURE_WORKSPACE_ID,
 } from "../../tests/e2e/fixtures/sessionTapes/tapeReplayFixture";
@@ -30,8 +28,4 @@ describe("perf.tapeReplay fixture tape", () => {
       hashSessionTapeWorkspaceId(TAPE_REPLAY_FIXTURE_WORKSPACE_ID)
     );
   });
-
-  test("matches its generator (run bun scripts/perf/generateTapeReplayFixture.ts after edits)", () => {
-    expect(readFileSync(FIXTURE_PATH, "utf-8")).toBe(buildTapeReplayFixtureTape());
-  });
 });
diff --git a/src/common/utils/sessionTapes/sessionTapeReplay.ts b/src/common/utils/sessionTapes/sessionTapeReplay.ts
index 3d7eeaf070c..1c3c15e7b0c 100644
--- a/src/common/utils/sessionTapes/sessionTapeReplay.ts
+++ b/src/common/utils/sessionTapes/sessionTapeReplay.ts
@@ -14,6 +14,7 @@
  */
 import { resolveXumEnvironmentValue, type XumEnvironment } from "@/common/compat/xumEnv";
 import type { WorkspaceChatMessage } from "@/common/orpc/types";
+import { MAX_TIMER_DELAY_MS } from "@/constants/timers";
 import type { LoadedSessionTape } from "./sessionTapeLoader";
 
 /**
@@ -58,9 +59,6 @@ export function isSessionTapeReplayRefusal(error: unknown): error is Error {
   );
 }
 
-/** setTimeout fires at once for delays above this (2^31-1 ms, about 24.8 days). */
-const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
-
 export type SessionTapeReplayPacing = "recorded" | "fast";
 
 export interface SessionTapeReplayOptions {
diff --git a/src/constants/timers.ts b/src/constants/timers.ts
new file mode 100644
index 00000000000..5ffdd3cf21a
--- /dev/null
+++ b/src/constants/timers.ts
@@ -0,0 +1,5 @@
+/**
+ * Longest delay `setTimeout` honors (the signed 32-bit millisecond maximum, about 24.8 days).
+ * Longer delays fire at once, so waits beyond it must be chunked.
+ */
+export const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
diff --git a/src/node/services/sessionTapes/sessionTapeReplay.test.ts b/src/node/services/sessionTapes/sessionTapeReplay.test.ts
index f161fe90ffa..ec53969b535 100644
--- a/src/node/services/sessionTapes/sessionTapeReplay.test.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplay.test.ts
@@ -3,6 +3,7 @@
  * driver's pacing, transcript equivalence through the real reducer, and that replayed content
  * stays data. Synthetic tapes only.
  */
+import { MAX_TIMER_DELAY_MS } from "@/constants/timers";
 import { afterEach, describe, expect, jest, spyOn, test } from "bun:test";
 import { createHash } from "node:crypto";
 import * as fs from "node:fs/promises";
@@ -366,8 +367,8 @@ describe("replaySessionTape", () => {
   });
 
   test("recorded pacing waits longer than the timer limit in chunks, against the deadline", async () => {
-    // setTimeout fires at once for delays above 2^31-1 ms (about 24.8 days).
-    const maxDelayMs = 2 ** 31 - 1;
+    // setTimeout fires at once for delays above MAX_TIMER_DELAY_MS.
+    const maxDelayMs = MAX_TIMER_DELAY_MS;
     const farOffsetMs = maxDelayMs + 5_000;
     const farTape = expectLoaded(
       loadSessionTape(
diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
index 7471c6bee0f..bd2b0d8c8fb 100644
--- a/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
@@ -164,7 +164,13 @@ describe("onChat replay source", () => {
     [
       "a relative tape path",
       () => Promise.resolve({ map: JSON.stringify({ [workspaceId]: "tape.jsonl" }) }),
-      /must be absolute/,
+      /must be an absolute local path/,
+    ],
+    [
+      "a network share tape path (UNC)",
+      () =>
+        Promise.resolve({ map: JSON.stringify({ [workspaceId]: "//server/share/tape.jsonl" }) }),
+      /must be an absolute local path/,
     ],
     [
       "a tape recorded for another workspace",
@@ -305,8 +311,8 @@ describe("onChat replay source", () => {
     const tapePath = await writeTape(dir, tapeFor(workspaceId));
     // A fresh process installs no egress block, as in `xum server` (this one already has).
     const script = `
-      const { getSessionTapeReplay } = await import(${JSON.stringify(require.resolve("./sessionTapeReplaySource"))});
-      const { isSessionTapeReplayRefusal } = await import(${JSON.stringify(require.resolve("@/common/utils/sessionTapes/sessionTapeReplay"))});
+      import { getSessionTapeReplay } from ${JSON.stringify(require.resolve("./sessionTapeReplaySource"))};
+      import { isSessionTapeReplayRefusal } from ${JSON.stringify(require.resolve("@/common/utils/sessionTapes/sessionTapeReplay"))};
       const pushed = [];
       const error = await getSessionTapeReplay({ workspaceId: ${JSON.stringify(workspaceId)} })
         .play((event) => pushed.push(event))
diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
index 20fd1e844cc..15322f983fc 100644
--- a/src/node/services/sessionTapes/sessionTapeReplaySource.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
@@ -70,6 +70,14 @@ type ReplayTapeMap = ReadonlyMap<string, string | Error>;
 /** Parsed once per distinct env value (in practice once per process). */
 let cachedConfig: { raw: string; map: ReplayTapeMap | Error } | undefined;
 
+/**
+ * UNC and device paths (`\\server\share`, `//server/share`, `\\?\UNC\...`) open network
+ * shares on Windows: stat/read would be SMB egress (and could send the user's credentials).
+ */
+function isNetworkPath(tapePath: string): boolean {
+  return /^[\\/]{2}/.test(tapePath);
+}
+
 function parseReplayTapeMap(raw: string): ReplayTapeMap | Error {
   let parsed: unknown;
   try {
@@ -88,9 +96,11 @@ function parseReplayTapeMap(raw: string): ReplayTapeMap | Error {
     // A bad entry still names its workspace: refuse only that one, not the whole map.
     map.set(
       workspaceId,
-      typeof tapePath === "string" && path.isAbsolute(tapePath)
+      typeof tapePath === "string" && path.isAbsolute(tapePath) && !isNetworkPath(tapePath)
         ? tapePath
-        : new Error(`XUM_REPLAY_TAPES: the tape path for ${workspaceId} must be absolute`)
+        : new Error(
+            `XUM_REPLAY_TAPES: the tape path for ${workspaceId} must be an absolute local path`
+          )
     );
   }
   return map;

From 62c186ebe1a5b7bd9dfb681aa75e6c16c8a1bc4e Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 4 Oct 2026 14:50:38 +0000
Subject: [PATCH 18/18] fix(sessionTapes): allowlist local tape paths and serve
 tapes only inside the perf harness (round 7)

---
 src/browser/stores/WorkspaceStore.test.ts     | 15 +++-
 .../sessionTapeReplaySource.test.ts           | 73 +++++++++++++++++--
 .../sessionTapes/sessionTapeReplaySource.ts   | 28 +++++--
 tests/e2e/scenarios/perf.tapeReplay.spec.ts   |  2 +
 4 files changed, 102 insertions(+), 16 deletions(-)

diff --git a/src/browser/stores/WorkspaceStore.test.ts b/src/browser/stores/WorkspaceStore.test.ts
index aaac96ab513..54179361e28 100644
--- a/src/browser/stores/WorkspaceStore.test.ts
+++ b/src/browser/stores/WorkspaceStore.test.ts
@@ -888,8 +888,15 @@ describe("WorkspaceStore", () => {
     // reason, keep sends closed and not resubscribe: a retry can only be refused again. Served
     // by the backend's real onChat entry point, with no services behind it.
     const workspaceId = "tape-refused-workspace";
-    const savedReplayTapes = process.env.XUM_REPLAY_TAPES;
+    const savedEnv = {
+      XUM_REPLAY_TAPES: process.env.XUM_REPLAY_TAPES,
+      XUM_E2E: process.env.XUM_E2E,
+      XUM_REPLAY_HARNESS: process.env.XUM_REPLAY_HARNESS,
+    };
     process.env.XUM_REPLAY_TAPES = JSON.stringify({ [workspaceId]: "/nonexistent/missing.jsonl" });
+    // The perf harness markers: outside them the backend refuses before reading the tape.
+    process.env.XUM_E2E = "1";
+    process.env.XUM_REPLAY_HARNESS = "1";
     markSessionTapeReplayEgressBlocked();
     const context = {} as unknown as ORPCContext;
     mockOnChat.mockImplementation(async function* (input, options) {
@@ -919,8 +926,10 @@ describe("WorkspaceStore", () => {
       expect(interruption.hasInterruptedStream).toBe(false);
       expect(interruption.isEligibleForAutoRetry).toBe(false);
     } finally {
-      if (savedReplayTapes === undefined) delete process.env.XUM_REPLAY_TAPES;
-      else process.env.XUM_REPLAY_TAPES = savedReplayTapes;
+      for (const [key, value] of Object.entries(savedEnv)) {
+        if (value === undefined) delete process.env[key];
+        else process.env[key] = value;
+      }
     }
   });
 
diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
index bd2b0d8c8fb..5f2ff63c030 100644
--- a/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.test.ts
@@ -29,11 +29,22 @@ import { ProviderService } from "@/node/services/providerService";
 import { DisposableTempDir } from "@/node/services/tempDir";
 import { createTestHistoryService } from "@/node/services/testHistoryService";
 import { createWorkspaceServiceForTest } from "@/node/services/workspaceService.testHarness";
-import { SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE } from "./sessionTapeReplaySource";
+import {
+  getSessionTapeReplay,
+  isSessionTapeReplayMode,
+  SESSION_TAPE_REPLAY_READ_ONLY_MESSAGE,
+} from "./sessionTapeReplaySource";
 import type { TurnAdmissionToken } from "@/node/services/taskWorkspaceSeam";
 import { buildSyntheticSessionTape, syntheticReplayTranscript } from "./sessionTapes.testFixtures";
 
-const ENV_KEYS = ["XUM_REPLAY_TAPES", "MUX_REPLAY_TAPES"] as const;
+const ENV_KEYS = [
+  "XUM_REPLAY_TAPES",
+  "MUX_REPLAY_TAPES",
+  "XUM_E2E",
+  "MUX_E2E",
+  "XUM_REPLAY_HARNESS",
+  "MUX_REPLAY_HARNESS",
+] as const;
 const savedEnv = new Map<string, string | undefined>();
 
 function setReplayTapes(value: string | undefined): void {
@@ -46,6 +57,9 @@ beforeEach(() => {
     savedEnv.set(key, process.env[key]);
     delete process.env[key];
   }
+  // The perf harness markers (make perf-tape-replay); one test removes them.
+  process.env.XUM_E2E = "1";
+  process.env.XUM_REPLAY_HARNESS = "1";
 });
 
 afterEach(() => {
@@ -166,12 +180,6 @@ describe("onChat replay source", () => {
       () => Promise.resolve({ map: JSON.stringify({ [workspaceId]: "tape.jsonl" }) }),
       /must be an absolute local path/,
     ],
-    [
-      "a network share tape path (UNC)",
-      () =>
-        Promise.resolve({ map: JSON.stringify({ [workspaceId]: "//server/share/tape.jsonl" }) }),
-      /must be an absolute local path/,
-    ],
     [
       "a tape recorded for another workspace",
       async (dir) => ({
@@ -306,6 +314,55 @@ describe("onChat replay source", () => {
     }
   });
 
+  // Each form names a tape that exists and would play from its absolute path: only the path's
+  // form is refused, before anything is read.
+  test.each<[string, (absolute: string) => string]>([
+    ["a relative path", (absolute) => path.relative(process.cwd(), absolute)],
+    ["a file: URL", (absolute) => `file://${absolute}`],
+    ["an https URL", () => "https://replay-egress-probe.invalid/tape.jsonl"],
+    ["a POSIX-style UNC share", () => "//server/share/tape.jsonl"],
+    ["a Windows UNC share", () => "\\\\server\\share\\tape.jsonl"],
+    ["a \\\\?\\ long-path prefix", (absolute) => `\\\\?\\${absolute}`],
+    ["a \\\\.\\ device prefix", (absolute) => `\\\\.\\${absolute}`],
+    ["a doubled leading slash", (absolute) => `/${absolute}`],
+  ])("refuses %s as the tape path and reads nothing", async (_name, form) => {
+    using dir = new DisposableTempDir("session-tape-replay-path-form");
+    const absolute = await writeTape(dir, tapeFor(workspaceId));
+    setReplayTapes(JSON.stringify({ [workspaceId]: form(absolute) }));
+    const replay = getSessionTapeReplay({ workspaceId });
+    if (!replay) throw new Error("the mapped workspace must get a replay");
+    const pushed: WorkspaceChatMessage[] = [];
+    const error: unknown = await replay
+      .play((event) => pushed.push(event))
+      .then(
+        () => undefined,
+        (rejection: unknown) => rejection
+      );
+    expect(isSessionTapeReplayRefusal(error)).toBe(true);
+    expect((error as Error).message).toMatch(/must be an absolute local path/);
+    expect(pushed).toEqual([]);
+  });
+
+  test("refuses a tape outside the perf harness (no XUM_REPLAY_HARNESS marker)", async () => {
+    using dir = new DisposableTempDir("session-tape-replay-no-harness");
+    setReplayTapes(JSON.stringify({ [workspaceId]: await writeTape(dir, tapeFor(workspaceId)) }));
+    delete process.env.XUM_REPLAY_HARNESS;
+    const replay = getSessionTapeReplay({ workspaceId });
+    if (!replay) throw new Error("the mapped workspace must get a replay");
+    const pushed: WorkspaceChatMessage[] = [];
+    const error: unknown = await replay
+      .play((event) => pushed.push(event))
+      .then(
+        () => undefined,
+        (rejection: unknown) => rejection
+      );
+    expect(isSessionTapeReplayRefusal(error)).toBe(true);
+    expect((error as Error).message).toMatch(/only inside the perf harness/);
+    expect(pushed).toEqual([]);
+    // Replay mode itself stays on: the process is still read-only.
+    expect(isSessionTapeReplayMode()).toBe(true);
+  });
+
   test("refuses to serve a tape before desktop main blocked renderer egress", async () => {
     using dir = new DisposableTempDir("session-tape-replay-no-egress-block");
     const tapePath = await writeTape(dir, tapeFor(workspaceId));
diff --git a/src/node/services/sessionTapes/sessionTapeReplaySource.ts b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
index 15322f983fc..80944cef5fb 100644
--- a/src/node/services/sessionTapes/sessionTapeReplaySource.ts
+++ b/src/node/services/sessionTapes/sessionTapeReplaySource.ts
@@ -64,6 +64,13 @@ export function isSessionTapeReplayMode(): boolean {
   return isSessionTapeReplayConfigured(process.env);
 }
 
+function isSessionTapeReplayHarness(): boolean {
+  return (
+    resolveXumEnvironmentValue("E2E", process.env) === "1" &&
+    resolveXumEnvironmentValue("REPLAY_HARNESS", process.env) === "1"
+  );
+}
+
 /** Workspace id -> absolute tape path, or why that entry cannot be used. */
 type ReplayTapeMap = ReadonlyMap<string, string | Error>;
 
@@ -71,11 +78,15 @@ type ReplayTapeMap = ReadonlyMap<string, string | Error>;
 let cachedConfig: { raw: string; map: ReplayTapeMap | Error } | undefined;
 
 /**
- * UNC and device paths (`\\server\share`, `//server/share`, `\\?\UNC\...`) open network
- * shares on Windows: stat/read would be SMB egress (and could send the user's credentials).
+ * Allowlist for tape paths, checked before any stat or read: a POSIX absolute path (`/...`) or a
+ * Windows drive path (`C:\...`). Everything else is refused, notably UNC shares
+ * (`\\server\share`, `//server/share`) and `\\?\` / `\\.\` device prefixes (SMB egress on
+ * Windows, possibly with the user's credentials), `file:` and other URLs, and relative paths.
  */
-function isNetworkPath(tapePath: string): boolean {
-  return /^[\\/]{2}/.test(tapePath);
+function isAbsoluteLocalFilePath(tapePath: string): boolean {
+  const posixRooted = /^\/(?![\\/])/.test(tapePath);
+  const windowsDrive = /^[A-Za-z]:[\\/]/.test(tapePath);
+  return path.isAbsolute(tapePath) && (posixRooted || windowsDrive);
 }
 
 function parseReplayTapeMap(raw: string): ReplayTapeMap | Error {
@@ -96,7 +107,7 @@ function parseReplayTapeMap(raw: string): ReplayTapeMap | Error {
     // A bad entry still names its workspace: refuse only that one, not the whole map.
     map.set(
       workspaceId,
-      typeof tapePath === "string" && path.isAbsolute(tapePath) && !isNetworkPath(tapePath)
+      typeof tapePath === "string" && isAbsoluteLocalFilePath(tapePath)
         ? tapePath
         : new Error(
             `XUM_REPLAY_TAPES: the tape path for ${workspaceId} must be an absolute local path`
@@ -141,6 +152,13 @@ function getUpfrontRefusal(
   mode: OnChatMode | undefined
 ): string | undefined {
   if (entry instanceof Error) return entry.message;
+  // Harness-only: replay mode keeps providers, recorded tools and recorded URLs offline, but the
+  // app's other background network (git remote queries, gh, Coder CLI probes) is isolated only
+  // by the perf harness (`make perf-tape-replay`, tests/e2e/scenarios/perf.tapeReplay.spec.ts).
+  // So replay is supported only inside it, which sets XUM_E2E=1 and XUM_REPLAY_HARNESS=1.
+  if (!isSessionTapeReplayHarness()) {
+    return "session tape replay runs only inside the perf harness (make perf-tape-replay sets XUM_E2E=1 and XUM_REPLAY_HARNESS=1)";
+  }
   if (!isSessionTapeReplayEgressBlocked())
     return "session tape replay requires the desktop app's egress block";
   if (mode !== undefined && mode.type !== "full") {
diff --git a/tests/e2e/scenarios/perf.tapeReplay.spec.ts b/tests/e2e/scenarios/perf.tapeReplay.spec.ts
index d98615f9c48..65a4e3115b4 100644
--- a/tests/e2e/scenarios/perf.tapeReplay.spec.ts
+++ b/tests/e2e/scenarios/perf.tapeReplay.spec.ts
@@ -103,6 +103,8 @@ const test = electronTest.extend({
       { mode: 0o755 }
     );
     setEnv("PATH", `${stubBinDir}${path.delimiter}${process.env.PATH ?? ""}`);
+    // The app serves tapes only inside this harness (electronTest also sets XUM_E2E=1).
+    setEnv("XUM_REPLAY_HARNESS", "1");
     setEnv("MUX_REPLAY_TAPES", undefined);
     setEnv(
       "XUM_REPLAY_TAPES",