Risky behavior now covered

• Projected transcript items: blank/unknown item types and invalid tool/error enums fail closed. Empty completed reasoning is dropped. Optimistic user bubbles upsert on clientMessageId. A later non-terminal tool start cannot unwind a completed tool. Agent/reasoning deltas append only onto matching kinds.
• MCP tool identity: server/tool names normalize consistently, and blank names collide on one mcp______ identity used by tool routing and profile allowlists.
• Provider catalog gates: custom model IDs stay off codex-cli/lmstudio; model preferences include codex-cli only. Untrimmed/non-string provider names fail closed.
• Custom model IDs: blank, control-character, and >2048-char ids are rejected before they hit the store.
• Telemetry redaction: PEM keys, Bearer/Basic tokens, assignment secrets, credential URLs, GitHub/Slack/AWS/Google tokens, JWTs, emails, prompt bodies, and JSON payloads are stripped; short/benign strings stay intact.
• MCP credential documents: extras, wrong versions, blank server names, and invalid timestamps fail closed.
• Skill improvement: plugin-owned and non-writable user/project skills cannot be rewritten; built-in copies remain eligible for shadowing.

Test files added/updated

• test/shared/projected-items.test.ts
• test/mcp.names.test.ts
• test/shared/provider-allowlists.test.ts
• test/providers/custom-model-id.test.ts
• test/diagnostics.sensitive-text.test.ts
• test/mcp.credentials-doc.test.ts
• test/skillImprovement.write-restriction.test.ts

Why these tests materially reduce regression risk

These helpers sit on transcript persistence, tool-policy matching, model-catalog writes, crash/telemetry scrubbing, MCP credential import, and skill mutation. A silent change can leak secrets, admit unsupported providers, collide MCP tools, or rewrite a completed tool/user bubble. The new tests lock the fail-closed contracts without changing production behavior.

Main is still e2d5f95e. This run does not duplicate open coverage PRs #331–#340.

Validation

• Targeted 28 tests + platform-boundary: green
• bun run check and bun run typecheck: clean
• Isolated targeted files are the evidence (full suite historically truncates late on this host)