fix(sessions): address review — verbatim export text + redact the filename

Two review findings on #65:

- toMarkdown trimmed each turn's text, which changes Markdown semantics: a
  leading 4-space indent (indented code block) got de-indented and a trailing
  "  " (hard line break) was eaten. Turn text is now emitted verbatim aside from
  redaction — the `**role**` blank line already supplies the blank an indented
  block needs. Pinned by a new test (indented code + trailing hard-break survive).
- The default save-dialog filename was derived from the RAW entry.title, not the
  scrubbed copy toMarkdown makes — and the filesystem sanitiser only strips
  slashes/colons, so a credential's own characters survive it (ghp_ABC… →
  ghp-abc…). entry.title now goes through redactSecrets before the stem, so a
  token in a title can't leak into the save path. Pinned by a source invariant.

32 suites green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ndemianc

extensions/levelcode-ai/extension.js

@@ -939,10 +939,12 @@ async function exportSession(id) {
 		'Copied ' + turns + ' turn' + (turns === 1 ? '' : 's') + ' as Markdown.', 'Save as file…');
 	if (pick !== 'Save as file…') { return; }
 
-	// Derive a filename from the title so a folder of exports stays readable. The title has already
-	// been through redactSecrets above, but it is sanitised again here for the FILESYSTEM's sake —
-	// a slash or a colon in a title is a path, not a name.
-	const stem = String(entry.title || 'session').toLowerCase()
+	// Derive a filename from the title so a folder of exports stays readable. REDACT it first: the exported
+	// body was scrubbed, but `entry.title` here is the raw index title (toMarkdown redacts its own copy, not
+	// this variable), and the filesystem sanitiser below only strips slashes/colons — a credential's own
+	// characters survive it (`ghp_ABC…` → `ghp-abc…`), so a token in a title would leak into the save path.
+	const safeTitle = sessionMemory.redactSecrets(String(entry.title || 'session'));
+	const stem = safeTitle.toLowerCase()
 		.replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 60) || 'session';
 	const target = await vscode.window.showSaveDialog({
 		filters: { Markdown: ['md'] },

extensions/levelcode-ai/sessionEvents.js

@@ -166,7 +166,10 @@ function toMarkdown(meta, messages, opts) {
 
 	for (const t of turns) {
 		md += '\n---\n\n**' + (t.role === 'user' ? 'You' : 'LevelCode') + '**\n\n';
-		md += scrub(String(t.text)).trim() + '\n';
+		// Verbatim aside from redaction — NOT trimmed. Trimming changes Markdown semantics: it de-indents a
+		// leading 4-space (indented code block) and eats trailing "  " (a hard line break). The `**role**\n\n`
+		// above already supplies the blank line an indented block needs after it.
+		md += scrub(String(t.text)) + '\n';
 	}
 	// An empty session still exports — a file with a header and no turns is a truthful answer, and
 	// silently producing nothing would read as a broken button.

extensions/levelcode-ai/test/sessionEvents.test.js

@@ -138,6 +138,15 @@ test('EXPORT: roles are BOLD, never headings — a turn owns the heading levels'
 	assert.match(md, /^## Step one$/m, "the turn's own headings are untouched");
 });
 
+test('EXPORT: turn text is VERBATIM — indented code + a trailing hard-break survive (not trimmed)', () => {
+	// Trimming the turn would de-indent a leading 4-space (killing an indented code block) and eat the two
+	// trailing spaces of a Markdown hard line break. Export must preserve the text as written, save redaction.
+	const turn = '    indented = code()\n\nfinal line ends with a hard break  ';
+	const md = E.toMarkdown(META, [{ role: 'assistant', content: turn }]);
+	assert.match(md, /\*\*LevelCode\*\*\n\n {4}indented = code\(\)/, 'the leading 4-space indent survives (indented code block)');
+	assert.match(md, /hard break {2}\n/, 'the trailing two-space hard line break survives');
+});
+
 test('EXPORT: scrubs, because export is the first surface that SHARES a session', () => {
 	// chat-sessions-design §10: "anything that later shares a session must scrub — that is that
 	// feature's burden." A token pasted into chat must not ride into a pull request.

extensions/levelcode-ai/test/sessionsUi.test.js

@@ -258,4 +258,9 @@ test('NO-JUMP: line 2 swaps file·time ⇄ actions in a fixed min-height row (no
 	}
 });
 
+test('EXPORT: the body is scrubbed on the way out, and the save-dialog filename is redacted too', () => {
+	assert.match(ext, /toMarkdown\(entry, m\.transcript\(id\), \{ redact: sessionMemory\.redactSecrets \}\)/, 'the exported body is scrubbed');
+	assert.match(ext, /redactSecrets\(String\(entry\.title[\s\S]{0,140}stem/, 'and the default filename is redacted BEFORE the save path (a title token cannot leak into the dialog)');
+});
+
 console.log('sessionsUi: ' + n + ' tests passed');