space-architect 5.3.0 → 5.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: de2f5d7d6f80acc7b6a7bd16c9ec3dbaf23ef9c2d425c8b1e532f5c24822533a
-  data.tar.gz: b39f07d1d24b1288d54e37a08624322ad0fc4f5a664459d6bdcbe12acf4d0438
+  metadata.gz: 20aaf646a8056b8d5975cb789f55a49f9f9c0ca5deca38f9866a0e3e220e8904
+  data.tar.gz: a89104abc977aaeae263c09f922800252867df448050262c557d6f60780275f0
 SHA512:
-  metadata.gz: 5086b34800652f32d243dce10163543a6ee182096b2a42e6938c303de99cf3fa9212591cadba7494491f04f505e16a2c569388c2434c2bbca59585ece77671a9
-  data.tar.gz: 5824a84007e85b84a19ce50c0af0ed6318315b3060caceb5ab4e560416da098d980155bbe74833560a1f7b35330bafb2e73a25e3154f28dc08cf6f53c2ed14e8
+  metadata.gz: f0a104ab6b75ec7170e5c4bc7a57c4406f002e167ba13b3d913d21a97f3c020a13d3912d2f2fada42edcd0ffeac876a8fdff2fe0c38ad163f617700927767493
+  data.tar.gz: ea287608ae6cb4a560d3b38e51e4d8b0c3d4dc04985e429046fe83b1588c8f7dd34608a7ede28ed45457ff8e0456226d4130ddfb6b9541dde875cc3976898a1b

data/CHANGELOG.md

@@ -5,6 +5,35 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.4.0] - 2026-07-21
+
+### Changed
+
+- **`architect sessions agent install` resolves an `op://` token at install
+  time** — the ref is resolved once via `op read` and the raw value is written
+  to the plist's `EnvironmentVariables` dict (`SPACE_ARCHITECT_INGEST_TOKEN`),
+  with the plist written mode 0600 and ProgramArguments carrying no token
+  material. Interval runs no longer invoke `op` at all, so a locked 1Password
+  can no longer fail the sync (previously the ref rode argv and every fire ran
+  `op read`). Reinstall existing agents to migrate; a non-`op://` token passes
+  through to the env dict unresolved.
+
+### Added
+
+- **`architect sessions sync` env-token fallback** — `--token` is now
+  optional: when absent, the token is read from `SPACE_ARCHITECT_INGEST_TOKEN`.
+  An explicit `--token` always wins; with neither present, the error names
+  both sources.
+- **Server: conversation session links** — importers preserve a session file's
+  own `session_id` and record a differing content-derived id as
+  `parent_session_id`; conversations resolve `parent`/`children` links
+  (owner-scoped) and Conversations/Show renders "part of" / "Subagent
+  transcripts" navigation between them.
+- **Server: denormalized `turns_count` on conversations** — the conversations
+  index reads a counter column recomputed at import instead of loading every
+  conversation's messages, fixing index-page timeouts (502s) at
+  thousand-conversation scale.
+
 ## [5.3.0] - 2026-07-20
 
 ### Added

data/lib/space_architect/cli/architect.rb

@@ -950,13 +950,13 @@ module Space::Architect
         # explicitly rather than relying on dry-cli's `required:` option flag.
         def self.require_credentials!(host, token)
           raise Space::Core::Error, "--host is required" unless host
-          raise Space::Core::Error, "--token is required" unless token
+          raise Space::Core::Error, "--token or #{SessionSync::TOKEN_ENV} is required" unless token
         end
 
         class Sync < BaseCommand
           desc "Scan pi/claude session files and upload new/grown conversations to a space-server"
           option :host,        required: true, desc: "Base URL of the space-server"
-          option :token,       required: true, desc: "Bearer token for authorization (an op:// ref is resolved once via `op read`)"
+          option :token,       default: nil,   desc: "Bearer token for authorization (defaults to $#{SessionSync::TOKEN_ENV}; an explicit --token wins; an op:// ref is resolved once via `op read`)"
           option :state_file,  default: nil,   desc: "Cursor YAML path (default: $XDG_STATE_HOME/space-architect/session-sync.yaml)"
           option :pi_root,     default: nil,   desc: "Override the pi sessions root (default: ~/.pi/agent/sessions)"
           option :claude_root, default: nil,   desc: "Override the claude projects root (default: ~/.claude/projects)"
@@ -965,9 +965,10 @@ module Space::Architect
           def call(host: nil, token: nil, state_file: nil, pi_root: nil, claude_root: nil, dry_run: false, **opts)
             setup_terminal(**opts.slice(:color, :colors))
             handle_errors do
-              Sessions.require_credentials!(host, token)
+              resolved_token = token || ENV[SessionSync::TOKEN_ENV]
+              Sessions.require_credentials!(host, resolved_token)
               runner = SessionSync::Runner.new(
-                client: ConversationsClient.new(host, token),
+                client: ConversationsClient.new(host, resolved_token),
                 state_path: state_file || SessionSync.default_state_file,
                 pi_root: pi_root || SessionSync.default_pi_root,
                 claude_root: claude_root || SessionSync.default_claude_root,
@@ -997,13 +998,14 @@ module Space::Architect
             include Helpers
             desc "Install the launchd agent that periodically runs `architect sessions sync`"
             option :host,     required: true, desc: "Base URL of the space-server"
-            option :token,    required: true, desc: "Bearer token for authorization (an op:// ref is stored as-is in the plist)"
+            option :token,    required: true, desc: "Bearer token for authorization (an op:// ref is resolved once at install time; the raw value is stored in the plist's EnvironmentVariables, not argv)"
             option :interval, default: "900", desc: "StartInterval in seconds (default 900)"
 
             def call(host: nil, token: nil, interval: "900", **opts)
               setup_terminal(**opts.slice(:color, :colors))
               handle_errors do
                 Sessions.require_credentials!(host, token)
+                resolved_token = token.start_with?("op://") ? SessionSync.resolve_token(token) : token
                 pp = plist_path
                 xml = SessionSync::Plist.call(
                   label: SessionSync::LABEL,
@@ -1011,10 +1013,11 @@ module Space::Architect
                   log_dir: SessionSync.log_dir,
                   bin_path: SessionSync::BinPath.detect,
                   host: host,
-                  token: token
+                  env: {SessionSync::TOKEN_ENV => resolved_token}
                 )
                 FileUtils.mkdir_p(File.dirname(pp))
                 File.write(pp, xml)
+                File.chmod(0o600, pp)
 
                 result = Space::Src::Launchd::Agent.new(label: SessionSync::LABEL).install(pp)
                 raise Space::Core::Error, "bootstrap failed: #{format_failure(result.failure)}" if result.failure?

data/lib/space_architect/conversations_client.rb

@@ -16,7 +16,7 @@ module Space::Architect
       @host = host.chomp("/")
       @token = token
       @client = client
-      @op_resolver = op_resolver || method(:op_read)
+      @op_resolver = op_resolver || SessionSync.method(:resolve_token)
       @resolved_token = nil
     end
 
@@ -62,13 +62,6 @@ module Space::Architect
       @resolved_token ||= @token.start_with?("op://") ? @op_resolver.call(@token) : @token
     end
 
-    def op_read(ref)
-      value = IO.popen(["op", "read", ref], &:read)
-      raise Space::Core::Error, "op read failed for #{ref}" unless $?.success?
-
-      value.chomp
-    end
-
     def build_multipart(boundary, path, session_id)
       crlf = "\r\n"
       filename = File.basename(path)

data/lib/space_architect/session_sync/plist.rb

@@ -23,10 +23,11 @@ module Space::Architect
         # @param log_dir [String]          Absolute directory for stdout/stderr logs.
         # @param bin_path [String]         Absolute path to the architect bin script.
         # @param host [String]             --host value passed to `sessions sync`.
-        # @param token [String]            --token value passed to `sessions sync` (an op:// ref
-        #                                  is passed through verbatim — never resolved here).
+        # @param env [Hash]                EnvironmentVariables dict; must contain a non-empty
+        #                                  SessionSync::TOKEN_ENV value (resolved by the caller —
+        #                                  never resolved here).
         # @return [String] the full plist XML.
-        def call(label:, refresh_interval:, log_dir:, bin_path:, host:, token:)
+        def call(label:, refresh_interval:, log_dir:, bin_path:, host:, env:)
           raise ArgumentError, "label is required" if label.to_s.empty?
           raise ArgumentError, "refresh_interval must be > 0" unless refresh_interval.is_a?(Integer) && refresh_interval > 0
           %w[log_dir bin_path].each do |k|
@@ -34,7 +35,7 @@ module Space::Architect
             raise ArgumentError, "#{k} must be absolute (got #{v.inspect})" unless v.is_a?(String) && File.absolute_path?(v)
           end
           raise ArgumentError, "host is required" if host.to_s.empty?
-          raise ArgumentError, "token is required" if token.to_s.empty?
+          raise ArgumentError, "env[#{SessionSync::TOKEN_ENV}] is required" if env.to_h[SessionSync::TOKEN_ENV].to_s.empty?
 
           out_log = File.join(log_dir, "#{label}.out.log")
           err_log = File.join(log_dir, "#{label}.err.log")
@@ -45,9 +46,9 @@ module Space::Architect
             bin_path,
             "sessions",
             "sync",
-            "--host", host,
-            "--token", token
+            "--host", host
           ])
+          body << key("EnvironmentVariables") << "\n" << dict(env)
           body << key("StartInterval") << integer(refresh_interval) << "\n"
           body << key("RunAtLoad") << boolean(true) << "\n"
           body << key("ProcessType") << string("Background") << "\n"
@@ -89,6 +90,15 @@ module Space::Architect
           items.each { |arg| out << "    <string>#{escape(arg)}</string>\n" }
           out << "  </array>"
         end
+
+        def dict(hash)
+          out = +"  <dict>\n"
+          hash.each do |k, v|
+            out << "    <key>#{escape(k)}</key>\n"
+            out << "    <string>#{escape(v)}</string>\n"
+          end
+          out << "  </dict>"
+        end
       end
     end
   end

data/lib/space_architect/session_sync.rb

@@ -15,9 +15,20 @@ module Space::Architect
   module SessionSync
     LABEL = "io.github.jetpks.space-architect.session-sync"
     APP_NAME = "space-architect"
+    TOKEN_ENV = "SPACE_ARCHITECT_INGEST_TOKEN"
 
     module_function
 
+    # The one op-read seam under lib/: resolves an op:// ref via `op read`.
+    # Shared by ConversationsClient's default op_resolver and
+    # Sessions::Agent::Install (both test-injectable around this call).
+    def resolve_token(ref)
+      value = IO.popen(["op", "read", ref], &:read)
+      raise Space::Core::Error, "op read failed for #{ref}" unless $?.success?
+
+      value.chomp
+    end
+
     def state_dir(env: ENV)
       File.join(Space::Core::XDG.state_home(env: env).to_s, APP_NAME)
     end

data/lib/space_core/version.rb

@@ -2,6 +2,6 @@
 
 module Space
   module Core
-    VERSION = "5.3.0"
+    VERSION = "5.4.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: space-architect
 version: !ruby/object:Gem::Version
-  version: 5.3.0
+  version: 5.4.0
 platform: ruby
 authors:
 - Eric Jacobs