@aiwg/cli 2026.10.1 → 2026.10.4

package/dist/src/sessions/workspace-discovery.js

@@ -1,143 +1,268 @@
-import { createReadStream } from 'node:fs';
-import { access, mkdir, readFile, realpath, rename, stat, writeFile, } from 'node:fs/promises';
+import { access, mkdir, readFile, readdir, realpath, rename, stat, writeFile, } from 'node:fs/promises';
 import { homedir, userInfo } from 'node:os';
 import { basename, dirname, join, resolve } from 'node:path';
-import { createInterface } from 'node:readline';
-import { ClaudeSessionAdapter } from './adapters/claude.js';
-import { CodexSessionAdapter } from './adapters/codex.js';
-import { CursorSessionAdapter } from './adapters/cursor.js';
-import { FactorySessionAdapter } from './adapters/factory.js';
-import { MuseSessionAdapter, museNativeSourceMatchesWorkspace } from './adapters/muse.js';
-import { OmpSessionAdapter, readOmpSessionHeader } from './adapters/omp.js';
+import { inspectMuseNativeWorkspace } from './adapters/muse.js';
+import { readOmpSessionHeader } from './adapters/omp.js';
+import { grokbotConversationIdFromLocator } from './adapters/grokbot-locator.js';
 import { resolveOmpPaths } from '../providers/omp-paths.mjs';
-import { PiSessionAdapter } from './adapters/pi.js';
-import { DeepSeekHarnessSessionAdapter } from './adapters/deepseek-harness.js';
-import { SESSION_PROVIDER_IDS, sha256, } from './contracts.js';
+import { SESSION_PROVIDER_IDS, SessionCoveragePreflightSchema, SessionContractError, sha256, } from './contracts.js';
 import { redactSourceLocator } from './discovery.js';
-import { fingerprintSourceFile } from './readers.js';
+import { createSessionAdapterRegistry } from './adapter-registry.js';
+import { coveragePreflight, expectedSessionProviders } from './coverage-preflight.js';
+import { fingerprintSourceFile, streamJsonLines } from './readers.js';
+import { matchSessionWorkspace } from './workspace-matching.js';
+import { matchImportExclusion, nativeSessionIdFromLocator, resolveImportExclusions } from './import-exclusions.js';
 export const DISCOVERY_MANIFEST_VERSION = '1.0.0';
 const MANUAL_EXPORT_PROVIDERS = new Set([
-    'copilot', 'hermes', 'opencode', 'openclaw', 'openhuman', 'grokbot', 'grok-build',
+    'copilot', 'hermes', 'opencode', 'openclaw', 'openhuman', 'grok-build',
     'warp', 'devin-desktop', 'generic',
 ]);
 export async function discoverWorkspaceHistories(options) {
+    const registry = options.registry ?? createSessionAdapterRegistry();
+    const exclusions = resolveImportExclusions(undefined, options.exclude);
+    const expectedProviders = expectedSessionProviders(options.expectedProviders ?? SESSION_PROVIDER_IDS);
+    const supportedProviders = new Set(registry.list().map((adapter) => adapter.provider));
     const workspacePath = await canonicalPath(options.workspace);
     const workspaceId = workspacePath;
+    const workspacePaths = [...new Set([workspacePath, resolve(options.workspace),
+            ...(options.workspaceAliases ?? []).map((alias) => resolve(alias))])];
+    for (const alias of workspacePaths) {
+        if (await canonicalPath(alias) !== workspacePath) {
+            throw new SessionContractError('INVALID_ARGUMENT', 'workspace alias resolves to a different workspace');
+        }
+    }
     const providerHomes = providerHomeCandidates(options.providerHome, options.operatorHome);
-    const keyWithLeadingDash = workspaceKey(workspacePath, true);
-    const keyWithoutLeadingDash = workspaceKey(workspacePath, false);
     const discoverable = [
-        { provider: 'deepseek-harness', adapter: new DeepSeekHarnessSessionAdapter(), roots: options.dshRoot
+        { provider: 'deepseek-harness', roots: options.dshRoot
                 ? [resolve(options.dshRoot)] : options.providerHome
                 ? [join(resolve(options.providerHome), '.dsh', 'sessions')] : [] },
-        { provider: 'omp', adapter: new OmpSessionAdapter(), roots: options.ompRoot
+        { provider: 'omp', roots: options.ompRoot
                 ? [resolve(options.ompRoot)] : options.providerHome
                 ? [resolveOmpPaths({ home: resolve(options.providerHome), cwd: workspacePath }).sessionsDir] : [] },
-        { provider: 'muse', adapter: new MuseSessionAdapter(), roots: options.museRoot
+        { provider: 'muse', roots: options.museRoot
                 ? [resolve(options.museRoot)] : [] },
+        // Grok Bot conversations carry no workspace/cwd field, so unlike
+        // claude/cursor/factory there is no per-workspace default path to derive
+        // from providerHome. Native discovery requires an explicit
+        // --grokbot-root (same shared-root authorization model as
+        // codex/omp/deepseek-harness/muse below), and every authorized
+        // conversation surfaces to whichever workspace runs discovery (same
+        // no-filtering behavior already used for `pi`/`deepseek-harness`).
+        { provider: 'grokbot', roots: options.grokbotRoot
+                ? [resolve(options.grokbotRoot)] : [] },
         {
             provider: 'claude',
-            adapter: new ClaudeSessionAdapter(),
-            roots: providerHomes.map((providerHome) => join(providerHome, '.claude', 'projects', keyWithLeadingDash)),
+            roots: providerHomes.flatMap((providerHome) => workspacePaths.map((workspace) => join(providerHome, '.claude', 'projects', claudeProjectKey(workspace)))),
         },
         {
             provider: 'codex',
-            adapter: new CodexSessionAdapter(),
-            roots: options.codexRoot
-                ? [resolve(options.codexRoot)]
-                : options.providerHome
-                    ? [join(resolve(options.providerHome), '.codex', 'sessions')]
-                    : [],
+            roots: options.authorizedRoots || !expectedProviders.includes('codex')
+                ? [] : await codexDiscoveryRoots(options),
         },
         {
             provider: 'cursor',
-            adapter: new CursorSessionAdapter(),
-            roots: providerHomes.map((providerHome) => join(providerHome, '.cursor', 'projects', keyWithoutLeadingDash, 'agent-transcripts')),
+            roots: providerHomes.flatMap((providerHome) => workspacePaths.map((workspace) => join(providerHome, '.cursor', 'projects', workspaceKey(workspace, false), 'agent-transcripts'))),
         },
         {
             provider: 'factory',
-            adapter: new FactorySessionAdapter(),
-            roots: providerHomes.flatMap((providerHome) => [
-                join(providerHome, '.factory', 'projects', keyWithLeadingDash),
-                join(providerHome, '.factory', 'sessions', keyWithLeadingDash),
-            ]),
+            roots: providerHomes.flatMap((providerHome) => workspacePaths.flatMap((workspace) => [
+                join(providerHome, '.factory', 'projects', workspaceKey(workspace, true)),
+                join(providerHome, '.factory', 'sessions', workspaceKey(workspace, true)),
+            ])),
         },
         {
+            // Pi stores every working directory's sessions in its own
+            // subdirectory of the sessions root, named `--<path>--` where
+            // `<path>` has its leading separator removed and `/`, `\`, and `:`
+            // replaced with `-` (https://pi.dev/docs/latest/session-format,
+            // "File Location", verified 2026-10-12) — the same transform
+            // `workspaceKey(path, false)` already applies for Cursor below.
+            // Scanning the whole sessions root (as before) would import every
+            // other workspace's history into this one's catalog (#2656).
             provider: 'pi',
-            adapter: new PiSessionAdapter(),
-            roots: options.providerHome
-                ? [process.env.PI_CODING_AGENT_SESSION_DIR
-                        ? resolve(process.env.PI_CODING_AGENT_SESSION_DIR)
-                        : join(resolve(options.providerHome), '.pi', 'agent', 'sessions')]
-                : [],
+            roots: (process.env.PI_CODING_AGENT_SESSION_DIR
+                ? [resolve(process.env.PI_CODING_AGENT_SESSION_DIR)]
+                : providerHomes.map((providerHome) => join(providerHome, '.pi', 'agent', 'sessions'))).flatMap((sessionsRoot) => workspacePaths.map((workspace) => join(sessionsRoot, `--${workspaceKey(workspace, false)}--`))),
         },
     ];
+    const authorizedRoots = { ...options.authorizedRoots };
     const reports = new Map();
     const candidates = [];
     const seen = new Set();
     for (const entry of discoverable) {
+        if (!expectedProviders.includes(entry.provider) || !supportedProviders.has(entry.provider))
+            continue;
+        const adapter = registry.get(entry.provider);
+        if (adapter.disposition === 'unsupported' || !adapter.supportedOperations.includes('discover'))
+            continue;
         const availableRoots = [];
-        for (const root of entry.roots) {
-            if (await pathExists(root))
-                availableRoots.push(await canonicalPath(root));
+        const rootCounts = new Map();
+        for (const root of options.authorizedRoots ? options.authorizedRoots[entry.provider] ?? [] : entry.roots) {
+            if (await pathExists(root)) {
+                const canonical = await canonicalPath(root);
+                if (options.authorizedRoots && canonical !== root) {
+                    throw new SessionContractError('INVALID_ARGUMENT', 'previously authorized provider root changed; rediscover with explicit authorization');
+                }
+                if (!availableRoots.includes(canonical)) {
+                    availableRoots.push(canonical);
+                    rootCounts.set(canonical, {
+                        root: redactSourceLocator(canonical), rootId: sha256(canonical),
+                        status: 'checked', sourceCount: 0, duplicateCount: 0,
+                    });
+                }
+            }
+            else {
+                rootCounts.set(root, {
+                    root: redactSourceLocator(root), rootId: sha256(root),
+                    status: 'unavailable', sourceCount: 0, duplicateCount: 0,
+                });
+            }
         }
         if (availableRoots.length === 0) {
             const codexNeedsAuthorization = (entry.provider === 'codex' || entry.provider === 'omp'
-                || entry.provider === 'deepseek-harness' || entry.provider === 'muse')
+                || entry.provider === 'deepseek-harness' || entry.provider === 'muse'
+                || entry.provider === 'grokbot')
                 && entry.roots.length === 0;
             reports.set(entry.provider, providerReport(entry.provider, codexNeedsAuthorization ? 'export-required' : 'unavailable', codexNeedsAuthorization ? 'manual-export' : 'discoverable', [], codexNeedsAuthorization
                 ? 'SHARED_ROOT_AUTHORIZATION_REQUIRED'
                 : 'PROVIDER_ROOT_UNAVAILABLE', codexNeedsAuthorization
-                ? `Pass --${entry.provider}-root with an explicitly authorized sessions root.`
+                ? `Pass --${entry.provider === 'deepseek-harness' ? 'dsh' : entry.provider}-root with an explicitly authorized sessions root.`
                 : `No authorized ${entry.provider} workspace history root was found.`));
+            if (entry.provider === 'codex')
+                reports.get(entry.provider).rootCounts = [...rootCounts.values()];
             continue;
         }
+        authorizedRoots[entry.provider] = availableRoots;
         const scope = {
             workspaceId,
             allowedRoots: availableRoots,
         };
         const providerSources = [];
-        for await (const descriptor of entry.adapter.discover(scope)) {
-            const locator = await canonicalPath(descriptor.locator);
-            if (entry.provider === 'codex'
-                && !await codexSourceMatchesWorkspace(locator, workspacePath))
+        let matchedBySubfolder = 0;
+        let matchedByWorktree = 0;
+        const museSourceInspections = [];
+        for await (const descriptor of adapter.discover(scope)) {
+            const known = options.knownSources?.find(source => source.provider === descriptor.provider && source.locator === descriptor.locator);
+            const nativeSessionId = known?.nativeSessionId ?? descriptor.nativeSessionId ?? nativeSessionIdFromLocator(descriptor);
+            const exclusion = matchImportExclusion({ ...descriptor, nativeSessionId }, exclusions);
+            if (exclusion) {
+                const locator = resolve(descriptor.locator);
+                const authorizedRoot = scope.allowedRoots.find(root => locator === root || locator.startsWith(`${root}/`));
+                if (!authorizedRoot)
+                    continue;
+                const key = `excluded\0${entry.provider}\0${locator}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                const source = {
+                    sourceId: known?.sourceId ?? sha256(key), provider: entry.provider,
+                    locator, redactedLocator: redactSourceLocator(locator), locatorClass: descriptor.locatorClass,
+                    authorizedRoot, modifiedAt: '', sizeBytes: 0, digest: '', nativeSessionId,
+                    status: 'excluded', exclusion,
+                };
+                rootCounts.get(authorizedRoot).sourceCount += 1;
+                providerSources.push(source);
+                candidates.push(source);
                 continue;
-            if (entry.provider === 'muse'
-                && !await museNativeSourceMatchesWorkspace({
+            }
+            let workspaceMatch = null;
+            if (entry.provider === 'muse') {
+                const inspection = await inspectMuseNativeWorkspace({
                     ...descriptor,
                     sourceId: 'discovery',
                     authorizedScope: scope,
-                }, workspacePath))
-                continue;
+                }, workspacePath);
+                museSourceInspections.push({
+                    sourceKey: sha256(['muse-workspace-inspection-v1', descriptor.locator].join('\0')),
+                    redactedLocator: redactSourceLocator(descriptor.locator),
+                    nativeSessionId: basename(dirname(descriptor.locator)),
+                    ...inspection,
+                });
+                if (inspection.outcome !== 'matched')
+                    continue;
+                workspaceMatch = inspection.matchKind ?? null;
+            }
+            const locator = await canonicalPath(descriptor.locator);
+            if (entry.provider === 'codex') {
+                workspaceMatch = await codexSourceWorkspaceMatch(locator, workspacePath);
+                if (!workspaceMatch)
+                    continue;
+            }
             const ompHeader = entry.provider === 'omp' ? await readOmpSessionHeader({ ...descriptor, sourceId: 'discovery', authorizedScope: scope }) : undefined;
-            if (ompHeader && resolve(ompHeader.cwd) !== workspacePath)
-                continue;
+            if (ompHeader) {
+                workspaceMatch = await matchSessionWorkspace(ompHeader.cwd, workspacePath);
+                if (!workspaceMatch)
+                    continue;
+            }
             const details = await stat(locator);
             const authorizedRoot = scope.allowedRoots.find((root) => locator === root || locator.startsWith(`${root}/`));
             if (!authorizedRoot)
                 continue;
+            if (entry.provider === 'claude'
+                && !await claudeSourceMatchesWorkspace(locator, workspacePath))
+                continue;
             const fingerprint = await fingerprintSourceFile({
                 selectedPath: locator,
                 allowedRoots: [authorizedRoot],
             });
-            const dedupeKey = `${entry.provider}\0${fingerprint.digest}\0${fingerprint.size}`;
-            if (seen.has(dedupeKey))
+            const rolloutId = entry.provider === 'codex' && descriptor.locatorClass === 'codex-rollout-jsonl'
+                ? await codexRolloutId(locator) : undefined;
+            const dedupeKey = rolloutId
+                ? `codex\0rollout\0${rolloutId}`
+                : `${entry.provider}\0${fingerprint.digest}\0${fingerprint.size}`;
+            const rootCount = rootCounts.get(authorizedRoot);
+            if (seen.has(dedupeKey)) {
+                rootCount.duplicateCount += 1;
                 continue;
+            }
             seen.add(dedupeKey);
+            if (workspaceMatch === 'subfolder')
+                matchedBySubfolder += 1;
+            if (workspaceMatch === 'worktree')
+                matchedByWorktree += 1;
+            rootCount.sourceCount += 1;
             const source = sourceFromDescriptor(descriptor, locator, authorizedRoot, details, fingerprint.digest);
+            source.nativeSessionId = rolloutId ?? ompHeader?.id ?? nativeSessionId;
             if (ompHeader)
                 source.sourceId = sha256(['omp-native-source-v1', workspaceId, ompHeader.id].join('\0'));
+            if (entry.provider === 'grokbot') {
+                // The replica is rewritten wholesale as its sliding window evicts
+                // old entries, so a content-digest sourceId (the default above)
+                // would churn every re-discovery and break checkpoint continuity.
+                // Key it on the conversation id instead, same rationale as the OMP
+                // override above.
+                const conversationId = grokbotConversationIdFromLocator(locator);
+                if (conversationId) {
+                    source.sourceId = sha256(['grokbot-native-source-v1', workspaceId, conversationId].join('\0'));
+                }
+            }
             providerSources.push(source);
             candidates.push(source);
         }
-        reports.set(entry.provider, providerReport(entry.provider, 'checked', 'discoverable', providerSources, providerSources.length === 0 ? 'NO_WORKSPACE_SOURCES' : null, providerSources.length === 0
-            ? `The ${entry.provider} root was checked, but no source matched the authorized workspace.`
-            : null));
+        const incompleteMuseInspection = museSourceInspections.some((inspection) => inspection.outcome === 'inconclusive');
+        const report = providerReport(entry.provider, incompleteMuseInspection ? 'not-checked' : 'checked', 'discoverable', providerSources, incompleteMuseInspection ? 'MUSE_SOURCE_INSPECTION_INCOMPLETE'
+            : providerSources.length === 0 ? 'NO_WORKSPACE_SOURCES' : null, incompleteMuseInspection
+            ? 'Review unattributed museSourceInspections and their limit name/value; authorize a supported Muse export for unresolved sources before claiming workspace coverage.'
+            : providerSources.length === 0
+                ? `The ${entry.provider} root was checked, but no source matched the authorized workspace.`
+                : null);
+        if (entry.provider === 'muse') {
+            report.museSourceInspections = museSourceInspections.sort((a, b) => a.sourceKey.localeCompare(b.sourceKey));
+        }
+        report.matchedBySubfolder = matchedBySubfolder;
+        report.matchedByWorktree = matchedByWorktree;
+        if (entry.provider === 'codex')
+            report.rootCounts = [...rootCounts.values()];
+        reports.set(entry.provider, report);
     }
-    for (const provider of SESSION_PROVIDER_IDS) {
+    for (const provider of expectedProviders) {
         if (reports.has(provider))
             continue;
         const manual = MANUAL_EXPORT_PROVIDERS.has(provider);
+        if (!supportedProviders.has(provider)) {
+            reports.set(provider, providerReport(provider, 'not-checked', 'unsupported', [], 'MISSING_ADAPTER', 'Deliberately select a compatible runtime or an authorized supported export.'));
+            continue;
+        }
         const grokBuild = provider === 'grok-build';
         reports.set(provider, providerReport(provider, manual ? 'export-required' : 'not-checked', manual ? 'manual-export' : 'unsupported', [], grokBuild ? 'CLI_EXPORT_REQUIRED'
             : manual ? 'EXPLICIT_EXPORT_REQUIRED' : 'PROVIDER_NOT_CHECKED', grokBuild
@@ -148,9 +273,15 @@ export async function discoverWorkspaceHistories(options) {
     }
     const sources = candidates.sort(compareSources);
     const providers = [...reports.values()].sort((a, b) => a.provider.localeCompare(b.provider));
+    const preflight = coveragePreflight({
+        expectedProviders, expectedProviderBasis: options.expectedProviders ? 'explicit' : 'declared-default',
+        registry, runtime: options.runtime, reports: providers,
+    });
     const identity = {
         schemaVersion: DISCOVERY_MANIFEST_VERSION,
         workspaceId,
+        preflight,
+        authorizedRoots,
         sources: sources.map((source) => ({
             sourceId: source.sourceId,
             provider: source.provider,
@@ -159,11 +290,17 @@ export async function discoverWorkspaceHistories(options) {
             modifiedAt: source.modifiedAt,
             sizeBytes: source.sizeBytes,
             digest: source.digest,
+            ...(source.nativeSessionId ? { nativeSessionId: source.nativeSessionId } : {}),
+            ...(source.status ? { status: source.status, exclusion: source.exclusion } : {}),
         })),
         providers: providers.map((provider) => ({
             provider: provider.provider,
             status: provider.status,
             reasonCode: provider.reasonCode,
+            ...(provider.matchedBySubfolder !== undefined ? { matchedBySubfolder: provider.matchedBySubfolder } : {}),
+            ...(provider.matchedByWorktree !== undefined ? { matchedByWorktree: provider.matchedByWorktree } : {}),
+            ...(provider.rootCounts ? { rootCounts: provider.rootCounts } : {}),
+            ...(provider.museSourceInspections ? { museSourceInspections: provider.museSourceInspections } : {}),
         })),
     };
     return {
@@ -172,6 +309,8 @@ export async function discoverWorkspaceHistories(options) {
         createdAt: options.createdAt ?? new Date().toISOString(),
         workspaceId,
         workspacePath,
+        preflight,
+        authorizedRoots,
         providers,
         sources,
     };
@@ -194,6 +333,11 @@ export async function readDiscoveryManifest(path) {
         || !Array.isArray(value.sources)) {
         throw new Error('session discovery manifest is malformed or unsupported');
     }
+    if (value.preflight) {
+        const parsed = SessionCoveragePreflightSchema.safeParse(value.preflight);
+        if (!parsed.success)
+            throw new SessionContractError('INVALID_ARGUMENT', 'invalid discovery coverage preflight');
+    }
     const expected = await rediscoverManifestIdentity(value);
     if (expected !== value.manifestId) {
         throw new Error('session discovery manifest identity does not match its contents');
@@ -207,11 +351,15 @@ export function publicDiscoveryManifest(manifest) {
         createdAt: manifest.createdAt,
         workspaceId: manifest.workspaceId,
         workspacePath: manifest.workspacePath,
+        preflight: manifest.preflight,
         providers: manifest.providers,
         sources: manifest.sources.map(({ locator: _locator, authorizedRoot: _root, ...source }) => source),
         totals: {
             providers: manifest.providers.length,
             sources: manifest.sources.length,
+            excluded: manifest.sources.filter(source => source.status === 'excluded').length,
+            matchedBySubfolder: manifest.providers.reduce((sum, provider) => sum + (provider.matchedBySubfolder ?? 0), 0),
+            matchedByWorktree: manifest.providers.reduce((sum, provider) => sum + (provider.matchedByWorktree ?? 0), 0),
         },
     };
 }
@@ -231,12 +379,14 @@ function sourceFromDescriptor(descriptor, locator, authorizedRoot, details, dige
     };
 }
 function providerReport(provider, status, disposition, sources, reasonCode, remediation) {
-    const timestamps = sources.map((source) => source.modifiedAt).sort();
+    const timestamps = sources.map((source) => source.modifiedAt).filter(Boolean).sort();
     return {
         provider,
         status,
         disposition,
         sourceCount: sources.length,
+        matchedBySubfolder: 0,
+        matchedByWorktree: 0,
         dateRange: {
             earliest: timestamps.at(0) ?? null,
             latest: timestamps.at(-1) ?? null,
@@ -250,6 +400,8 @@ async function rediscoverManifestIdentity(manifest) {
     const identity = {
         schemaVersion: manifest.schemaVersion,
         workspaceId: manifest.workspaceId,
+        ...(manifest.preflight ? { preflight: manifest.preflight } : {}),
+        ...(manifest.authorizedRoots ? { authorizedRoots: manifest.authorizedRoots } : {}),
         sources: manifest.sources.map((source) => ({
             sourceId: source.sourceId,
             provider: source.provider,
@@ -258,46 +410,84 @@ async function rediscoverManifestIdentity(manifest) {
             modifiedAt: source.modifiedAt,
             sizeBytes: source.sizeBytes,
             digest: source.digest,
+            ...(source.nativeSessionId ? { nativeSessionId: source.nativeSessionId } : {}),
+            ...(source.status ? { status: source.status, exclusion: source.exclusion } : {}),
         })),
         providers: manifest.providers.map((provider) => ({
             provider: provider.provider,
             status: provider.status,
             reasonCode: provider.reasonCode,
+            ...(provider.matchedBySubfolder !== undefined ? { matchedBySubfolder: provider.matchedBySubfolder } : {}),
+            ...(provider.matchedByWorktree !== undefined ? { matchedByWorktree: provider.matchedByWorktree } : {}),
+            ...(provider.rootCounts ? { rootCounts: provider.rootCounts } : {}),
+            ...(provider.museSourceInspections ? { museSourceInspections: provider.museSourceInspections } : {}),
         })),
     };
     return sha256(JSON.stringify(identity));
 }
-async function codexSourceMatchesWorkspace(locator, workspacePath) {
-    const input = createReadStream(locator, { encoding: 'utf8' });
-    const lines = createInterface({ input, crlfDelay: Infinity });
-    let count = 0;
+async function codexDiscoveryRoots(options) {
+    const explicit = [...(options.codexRoots ?? []), ...(options.codexRoot ? [options.codexRoot] : [])];
+    if (explicit.length > 0)
+        return [...new Set(explicit.map((root) => resolve(root)))];
+    // Shared stores require the same explicit provider-home authorization as the default root.
+    if (!options.providerHome)
+        return [];
+    const codexHome = join(resolve(options.providerHome), '.codex');
+    const roots = [join(codexHome, 'sessions')];
+    if (process.env.CODEX_HOME)
+        roots.push(resolve(process.env.CODEX_HOME, 'sessions'));
     try {
-        for await (const line of lines) {
-            if (++count > 50)
-                break;
-            let value;
-            try {
-                value = JSON.parse(line);
-            }
-            catch {
-                continue;
-            }
-            const cwd = codexWorkspaceField(value);
-            if (!cwd)
-                continue;
-            try {
-                return await canonicalPath(cwd) === workspacePath;
-            }
-            catch {
-                return resolve(cwd) === workspacePath;
+        const roles = await readdir(join(codexHome, 'roles-runtime'), { withFileTypes: true });
+        for (const role of roles.sort((a, b) => a.name.localeCompare(b.name))) {
+            if (role.isDirectory() || role.isSymbolicLink()) {
+                roots.push(join(codexHome, 'roles-runtime', role.name, '.codex', 'sessions'));
             }
         }
-        return false;
     }
-    finally {
-        lines.close();
-        input.destroy();
+    catch (error) {
+        if (!['ENOENT', 'ENOTDIR'].includes(error.code ?? ''))
+            throw error;
     }
+    return [...new Set(roots)];
+}
+async function codexRolloutId(locator) {
+    let count = 0;
+    for await (const { line } of streamJsonLines(locator)) {
+        if (++count > 50)
+            break;
+        let value;
+        try {
+            value = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const record = asObject(value);
+        const id = asObject(record.payload).id;
+        if (record.type === 'session_meta' && typeof id === 'string' && id.length > 0)
+            return id;
+    }
+    return /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/i
+        .exec(basename(locator))?.[1];
+}
+async function codexSourceWorkspaceMatch(locator, workspacePath) {
+    let count = 0;
+    for await (const { line } of streamJsonLines(locator)) {
+        if (++count > 50)
+            break;
+        let value;
+        try {
+            value = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const cwd = codexWorkspaceField(value);
+        if (!cwd)
+            continue;
+        return await matchSessionWorkspace(cwd, workspacePath);
+    }
+    return null;
 }
 function codexWorkspaceField(value) {
     const root = asObject(value);
@@ -322,6 +512,43 @@ function asObject(value) {
 async function canonicalPath(path) {
     return realpath(resolve(path));
 }
+async function claudeSourceMatchesWorkspace(locator, workspacePath) {
+    let count = 0;
+    for await (const { line } of streamJsonLines(locator, { end: 1024 * 1024 - 1 })) {
+        if (++count > 50)
+            break;
+        let value;
+        try {
+            value = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const cwd = asObject(value).cwd;
+        if (typeof cwd !== 'string' || cwd.length === 0)
+            continue;
+        try {
+            return await canonicalPath(cwd) === workspacePath;
+        }
+        catch {
+            return resolve(cwd) === workspacePath;
+        }
+    }
+    // Older transcripts without cwd still use the selected project folder.
+    return true;
+}
+export function claudeProjectKey(path) {
+    // Claude Code 2.1.302 replaces each character, then caps keys at 200
+    // characters with a base-36 suffix from the original path's 32-bit hash.
+    const key = path.replace(/[^A-Za-z0-9-]/g, '-');
+    if (key.length <= 200)
+        return key;
+    let hash = 0;
+    for (let index = 0; index < path.length; index += 1) {
+        hash = ((hash << 5) - hash + path.charCodeAt(index)) | 0;
+    }
+    return `${key.slice(0, 200)}-${Math.abs(hash).toString(36)}`;
+}
 function workspaceKey(path, retainLeadingSeparator) {
     const normalized = path.replace(/\\/g, '/');
     const input = retainLeadingSeparator ? normalized : normalized.replace(/^\/+/, '');