[vintagedave]

We released CodeBot, which is an AI agent specifically for Delphi, yesterday.[0] So not widely applicable (yet) for most readers. However, we've been pretty open with its data. I hadn't realised reading this how many problematic practices are common which we have not done.

The full session data is streamed to the client. This is intended to re-populate a session if it's discarded by the server, but 'full' means full: it has the copies of tool calls, etc.

Rewritten text -- which the article notes as encrypted reasoning -- is plaintext for us. We view the rewriting as making the content more readable for the user, not as hiding it.

Compactions, subagent calls, subagent prompts, etc are all preserved, including pre-compaction memory items. A session is the reflection of the current state, not of the history how it got there, but what is required by the server is by definition present.

Sessions are signed, which is to prevent modification when sending back to the server to recreate a dropped session (we need to treat anything from the client as untrusted.) But the contents are cleartext.

[0] https://blogs.remobjects.com/2026/07/30/codebot-the-story/