@aiwg/cli 2026.10.10 → 2026.10.12

package/dist/src/cli/handlers/sessions.js

@@ -3,11 +3,13 @@ import { randomUUID } from 'node:crypto';
 import { basename, dirname, isAbsolute, join, resolve, } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { providerScopeWarnings } from '../../sessions/coverage-preflight.js';
-import { CLAUDE_ADAPTER_VERSION, ClaudeSessionAdapter, CODEX_ADAPTER_VERSION, CodexSessionAdapter, COPILOT_ADAPTER_VERSION, CopilotSessionAdapter, CURSOR_ADAPTER_VERSION, CursorSessionAdapter, FACTORY_ADAPTER_VERSION, FactorySessionAdapter, HERMES_ADAPTER_VERSION, HermesSessionAdapter, OPENCODE_ADAPTER_VERSION, OpenCodeSessionAdapter, OPENCLAW_ADAPTER_VERSION, OpenClawSessionAdapter, OPENHUMAN_ADAPTER_VERSION, OpenHumanSessionAdapter, GROKBOT_ADAPTER_VERSION, GROKBOT_NATIVE_REPLICA_LOCATOR_CLASS, GrokbotSessionAdapter, GROK_BUILD_ADAPTER_VERSION, GROK_BUILD_CLI_EXPORT_LOCATOR_CLASS, GrokBuildSessionAdapter, grokBuildList, grokBuildSearch, grokBuildExport, grokHeadlessSessionIdFromFile, MUSE_ADAPTER_VERSION, MuseSessionAdapter, PI_ADAPTER_VERSION, PiSessionAdapter, DEEPSEEK_HARNESS_ADAPTER_VERSION, DeepSeekHarnessSessionAdapter, OmpSessionAdapter, OMP_ADAPTER_VERSION, WARP_ADAPTER_VERSION, WarpSessionAdapter, DEVIN_DESKTOP_ADAPTER_VERSION, DevinDesktopSessionAdapter, CandidateExtractionService, GENERIC_ADAPTER_VERSION, GenericSessionInterchangeAdapter, IncrementalSessionImporter, ImportLeaseContentionError, FilesystemMemoryDestination, FilesystemPromotionDispositionCoordinator, MemoryPromotionGateway, SESSION_CONTRACT_VERSION, SessionContractError, SessionRepository, SessionSourceSchema, StructuralCandidateExtractor, resolveMemoryConsumerManifest, assertSessionProviderId, acquireImportLease, defaultDiscoveryManifestPath, discoverWorkspaceHistories, createSessionAdapterRegistry, coveragePreflight, expectedSessionProviders, deriveSessionTimeline, importDiscoveryManifest, previewDiscoveryImport, publicDiscoveryManifest, readDiscoveryManifest, redactSourceLocator, sha256, parseTimelineGap, writeDiscoveryManifest, buildSessionExportPlan, reverifySessionExportPlan, buildSessionAiwgFortemiIndexExport, recoverAiwgFortemiIndexFromFullV1Shard, embedAttachmentsInFullV1Shard, recoverEmbeddedAttachments, SESSION_EXPORT_PLAN_SCHEMA_VERSION, } from '../../sessions/index.js';
+import { CLAUDE_ADAPTER_VERSION, ClaudeSessionAdapter, CODEX_ADAPTER_VERSION, CodexSessionAdapter, COPILOT_ADAPTER_VERSION, CopilotSessionAdapter, CURSOR_ADAPTER_VERSION, CursorSessionAdapter, FACTORY_ADAPTER_VERSION, FactorySessionAdapter, HERMES_ADAPTER_VERSION, HermesSessionAdapter, OPENCODE_ADAPTER_VERSION, OpenCodeSessionAdapter, OPENCLAW_ADAPTER_VERSION, OpenClawSessionAdapter, OPENHUMAN_ADAPTER_VERSION, OpenHumanSessionAdapter, GROKBOT_ADAPTER_VERSION, GROKBOT_NATIVE_REPLICA_LOCATOR_CLASS, GrokbotSessionAdapter, GROK_BUILD_ADAPTER_VERSION, GROK_BUILD_CLI_EXPORT_LOCATOR_CLASS, GROK_BUILD_NATIVE_LOCATOR_CLASS, GrokBuildSessionAdapter, grokBuildList, grokBuildSearch, grokBuildExport, grokHeadlessSessionIdFromFile, MUSE_ADAPTER_VERSION, MuseSessionAdapter, PI_ADAPTER_VERSION, PiSessionAdapter, DEEPSEEK_HARNESS_ADAPTER_VERSION, DeepSeekHarnessSessionAdapter, OmpSessionAdapter, OMP_ADAPTER_VERSION, WARP_ADAPTER_VERSION, WarpSessionAdapter, DEVIN_DESKTOP_ADAPTER_VERSION, DevinDesktopSessionAdapter, CandidateExtractionService, GENERIC_ADAPTER_VERSION, GenericSessionInterchangeAdapter, IncrementalSessionImporter, ImportLeaseContentionError, FilesystemMemoryDestination, FilesystemPromotionDispositionCoordinator, MemoryPromotionGateway, SESSION_CONTRACT_VERSION, SessionContractError, SessionRepository, SessionSourceSchema, StructuralCandidateExtractor, resolveMemoryConsumerManifest, assertSessionProviderId, acquireImportLease, countUniqueSessionsAcrossCatalogs, defaultDiscoveryManifestPath, defaultHostCatalogPath, HOST_CATALOG_WORKSPACE_ID, indexIdentitiesBySessionId, manifestNeedsHostCatalog, mergeCrossCatalogRows, mergeSessionLists, resolveHostReferences, summarizeSessionAnalyticsFacts, discoverWorkspaceHistories, createSessionAdapterRegistry, providerDiscoveryCapability, coveragePreflight, expectedSessionProviders, deriveSessionTimeline, importDiscoveryManifest, previewDiscoveryImport, publicDiscoveryManifest, readDiscoveryManifest, redactSourceLocator, sha256, parseTimelineGap, writeDiscoveryManifest, buildSessionExportPlan, reverifySessionExportPlan, buildSessionAiwgFortemiIndexExport, recoverAiwgFortemiIndexFromFullV1Shard, embedAttachmentsInFullV1Shard, recoverEmbeddedAttachments, SESSION_EXPORT_PLAN_SCHEMA_VERSION, } from '../../sessions/index.js';
 import { resolveImportExclusions } from '../../sessions/import-exclusions.js';
 import { resolveImportLimits } from '../../sessions/import-limits.js';
 import { classifyGrokbotBlobName } from '../../sessions/adapters/grokbot-locator.js';
 import { readAiwgConfig } from '../../config/aiwg-config.js';
+import { importFromDir } from './sessions-intake.js';
+import { executeSessionsTail } from './sessions-tail.js';
 const JSON_CONTRACT_VERSION = '1.0.0';
 async function createLineMemoryPromotionDestination(projectRoot, manifestPath) {
     const modulePath = resolve(dirname(manifestPath), 'commands', 'line-memory.mjs');
@@ -38,9 +40,13 @@ Commands:
   grok-export <id> --workspace <path> --out <dir>  Export one CLI transcript
   grok-id <file> --format json|streaming-json  Read a headless session ID
   import <file> --source-id <id>  Import a supported provider JSONL source
+  import --from-dir <dir> [--source-id <prefix>]  Batch-import every recognised export in a directory
   list [--workspace <path-or-id>] [--limit N] [--cursor N]  List normalized sessions
   timeline [--workspace <path-or-id>] [--gap 30m]  Report chronological activity segments
   show <session-id> [--workspace <path-or-id>]  Show a session with events and tags
+  tail <session-id> | --provider <p> --latest [--workspace <path-or-id>] [--follow] [--json] [--import]
+                                  Read new native events; --follow polls every 500 ms
+                                  Read-only unless --import; --input <file> authorizes older direct imports
   search <query> [--workspace <path-or-id>]  Search authorized normalized content
   extract [session-id] --workspace <id> Extract structural candidates
   export plan --workspace <id> --out <file> <session-id...>  Select sessions into a reviewable plan
@@ -81,6 +87,9 @@ Options:
   --muse-root <path>  Explicitly authorize a Muse Code sessions root
   --dsh-root <path>  Explicitly authorize a DeepSeek Harness sessions root
   --grokbot-root <path>  Explicitly authorize a Grok Bot sand-client-persistence root
+  --grok-root <path>  Explicitly authorize a Grok Build sessions root (native chat_history.jsonl discovery)
+  --grok-active-sessions <path>  Explicitly authorize active_sessions.json for Grok Build live detection (read-only; requires --grok-root)
+  --hermes-root <path>  Explicitly authorize a Hermes home for a read-only state.db backup snapshot
   --grok-bin <path>  Absolute Grok Build CLI path for grok-list/grok-search/grok-export
                    (default: grok on PATH, then $GROK_HOME/bin/grok)
   --confirm, --yes  Confirm a persistent discovered batch import
@@ -92,6 +101,9 @@ Options:
   --inactivity-threshold <duration>  Historical inactivity threshold (default 24h)
   --min-coverage <0..1>  Fail list/report commands below a coverage ratio
   --provider <id> Filter list or select an import adapter
+  --from-dir <dir>  Batch-import every recognised export file in a directory (import only);
+                   --source-id becomes an optional per-file source-ID prefix;
+                   files already imported are skipped by content digest
   --consumer <id> Select a named memory consumer for promotion
   --tag <tag>, --limit <n>, --cursor <n>
   --page-size <n>  Extraction scan page size (default 250, maximum 500)
@@ -156,6 +168,8 @@ export const sessionsHandler = {
             const explicitHelp = parsed.flags.has('--help') || parsed.flags.has('-h');
             return printHelp(ctx, explicitHelp ? EXIT.ok : EXIT.usage);
         }
+        if (parsed.command === 'tail')
+            return executeSessionsTail(ctx, parsed, { databasePath, readAuthorizationContext });
         try {
             const result = await executeCommand(ctx, parsed);
             if (json)
@@ -179,7 +193,10 @@ async function executeCommand(ctx, args) {
     const command = args.command;
     if (command === 'sources') {
         const registry = createSessionAdapterRegistry();
-        const reports = registry.list().map((adapter) => providerDisposition(adapter.provider));
+        const reports = registry.list().map((adapter) => ({
+            ...providerDisposition(adapter.provider),
+            discovery: providerDiscoveryCapability(adapter.provider, adapter.supportedOperations),
+        }));
         const preflight = coveragePreflight({ expectedProviders: requestedProviders(args), registry });
         return ok(command, { providers: reports, count: reports.length, preflight });
     }
@@ -227,18 +244,35 @@ async function executeCommand(ctx, args) {
                     limit,
                     cursor,
                 });
+                // Account-scoped sessions live once in the host catalog; the
+                // workspace holds references (#3232). Read through them on the
+                // opening page so the workspace lists its referenced sessions.
+                // Cursor pages continue the local snapshot. Totals dedupe legacy
+                // copied rows against references, counting each session once.
+                const hostView = cursor
+                    ? null
+                    : readHostReferencedSessions(repository, { provider, tag: args.values.get('--tag') });
+                const items = hostView && hostView.sessions.length > 0
+                    ? mergeSessionLists(result.items, hostView.sessions).slice(0, limit)
+                    : result.items;
+                const total = hostView && hostView.references.length > 0
+                    ? countUniqueSessionsAcrossCatalogs([{
+                            identities: repository.listSessionIdentities(workspaceId),
+                            references: hostView.resolvedReferences,
+                        }])
+                    : result.total;
                 const coverage = {
                     ...repository.getCoverage(workspaceId),
                     catalogScope: catalogScope(ctx, args, repository, workspaceId),
                 };
                 const response = {
-                    items: result.items,
+                    items,
                     page: {
                         limit,
                         cursor: cursor ?? null,
                         nextCursor: result.nextCursor,
                         snapshotRowid: result.snapshotRowid,
-                        total: result.total,
+                        total,
                     },
                     coverage,
                 };
@@ -314,10 +348,15 @@ async function executeCommand(ctx, args) {
                 const session = matches[0];
                 if (!session)
                     throw new CliError('SESSION_NOT_FOUND', `session not found: ${id}${scope.hint ? `; ${scope.hint}` : ''}`, EXIT.unavailable, { catalogScope: scope });
+                // Image references resolve against the blob store: available blobs
+                // report their reference, missing ones an explicit unavailable
+                // state. Bytes stay out of the response; fetch by digest (#3265).
+                const events = repository.listEvents(session.sessionId, session.workspaceId)
+                    .map((event) => ({ ...event, images: repository.resolveEventImages(event) }));
                 return ok(command, {
                     session,
                     tags: repository.listTags(session.sessionId, session.workspaceId),
-                    events: repository.listEvents(session.sessionId, session.workspaceId),
+                    events,
                     catalogScope: catalogScope(ctx, args, repository, session.workspaceId),
                 });
             }
@@ -326,7 +365,8 @@ async function executeCommand(ctx, args) {
                 const { workspaceId } = readAuthorizationContext(ctx, args, command, repository);
                 const providerInput = args.values.get('--provider');
                 const provider = providerInput ? assertSessionProviderId(providerInput) : undefined;
-                const result = repository.search({
+                const limit = boundedInteger(args.values.get('--limit'), 50, 1, 500, '--limit');
+                const searchOptions = {
                     query,
                     workspaceId,
                     providers: provider ? [provider] : undefined,
@@ -341,13 +381,24 @@ async function executeCommand(ctx, args) {
                     sensitivity: args.values.get('--sensitivity'),
                     extractionState: args.values.get('--extraction-state'),
                     controlEvents: controlEventMode(args.values.get('--control-events')),
-                    limit: boundedInteger(args.values.get('--limit'), 50, 1, 500, '--limit'),
+                    limit,
                     cursor: args.values.get('--cursor'),
-                });
+                };
+                const result = repository.search(searchOptions);
+                // Read through host references on the opening page so workspace
+                // search finds referenced account-scoped sessions. Each session
+                // counts once: host hits for sessions already present locally
+                // (legacy copied rows) are dropped by provider + native session.
+                const hostRead = searchOptions.cursor
+                    ? null
+                    : searchHostReferencedSessions(repository, searchOptions, provider);
+                const items = hostRead && hostRead.hits.length > 0
+                    ? mergeCrossCatalogRows(result.items, hostRead.hits, indexIdentitiesBySessionId(repository.listSessionIdentities(workspaceId)), indexIdentitiesBySessionId(hostRead.hostIdentities), (hit) => [hit.provider, hit.eventId].join(' ')).slice(0, limit)
+                    : result.items;
                 return ok(command, {
-                    items: result.items,
+                    items,
                     catalogScope: catalogScope(ctx, args, repository, workspaceId),
-                    page: { limit: boundedInteger(args.values.get('--limit'), 50, 1, 500, '--limit'),
+                    page: { limit,
                         nextCursor: result.nextCursor },
                 });
             }
@@ -355,14 +406,22 @@ async function executeCommand(ctx, args) {
                 const view = requiredPositional(args, 0, 'analytics view');
                 const { workspaceId } = readAuthorizationContext(ctx, args, command, repository);
                 const query = analyticsQuery(args, workspaceId);
+                // Host references resolve to facts stored under the host catalog;
+                // each session counts once by provider + native session id. Without
+                // references the single-catalog path below is unchanged.
+                const mergedFacts = readWorkspaceAnalyticsFacts(repository, query);
                 if (view === 'summary') {
                     return ok(command, {
                         view,
-                        summary: repository.analyticsSummary(query),
+                        summary: mergedFacts
+                            ? summarizeSessionAnalyticsFacts(mergedFacts, workspaceId)
+                            : repository.analyticsSummary(query),
                     });
                 }
                 const categories = analyticsCategories(view);
-                const items = repository.listAnalyticsFacts({ ...query, categories });
+                const items = mergedFacts
+                    ? mergedFacts.filter((fact) => categories.includes(fact.category))
+                    : repository.listAnalyticsFacts({ ...query, categories });
                 return ok(command, {
                     analyticsVersion: '1.0.0',
                     view,
@@ -752,10 +811,7 @@ async function executeCommand(ctx, args) {
         repository.close();
     }
 }
-async function importSource(ctx, args) {
-    const limits = await configuredImportLimits(ctx, args);
-    const input = resolve(ctx.cwd, requiredPositional(args, 0, 'file'));
-    const providerInput = args.values.get('--provider') ?? 'generic';
+function assertSupportedImportProvider(providerInput) {
     const provider = assertSessionProviderId(providerInput);
     if (provider !== 'generic' && provider !== 'claude' && provider !== 'codex'
         && provider !== 'copilot' && provider !== 'cursor' && provider !== 'factory'
@@ -763,6 +819,57 @@ async function importSource(ctx, args) {
         && provider !== 'openhuman' && provider !== 'grokbot' && provider !== 'grok-build' && provider !== 'muse' && provider !== 'pi' && provider !== 'omp' && provider !== 'deepseek-harness' && provider !== 'warp' && provider !== 'devin-desktop') {
         throw new CliError('UNSUPPORTED_OPERATION', `session import is not implemented for ${provider}`, EXIT.unsupported);
     }
+    return provider;
+}
+function adapterVersionFor(provider) {
+    switch (provider) {
+        case 'claude': return CLAUDE_ADAPTER_VERSION;
+        case 'codex': return CODEX_ADAPTER_VERSION;
+        case 'copilot': return COPILOT_ADAPTER_VERSION;
+        case 'cursor': return CURSOR_ADAPTER_VERSION;
+        case 'factory': return FACTORY_ADAPTER_VERSION;
+        case 'hermes': return HERMES_ADAPTER_VERSION;
+        case 'opencode': return OPENCODE_ADAPTER_VERSION;
+        case 'openclaw': return OPENCLAW_ADAPTER_VERSION;
+        case 'openhuman': return OPENHUMAN_ADAPTER_VERSION;
+        case 'grokbot': return GROKBOT_ADAPTER_VERSION;
+        case 'grok-build': return GROK_BUILD_ADAPTER_VERSION;
+        case 'muse': return MUSE_ADAPTER_VERSION;
+        case 'pi': return PI_ADAPTER_VERSION;
+        case 'omp': return OMP_ADAPTER_VERSION;
+        case 'deepseek-harness': return DEEPSEEK_HARNESS_ADAPTER_VERSION;
+        case 'warp': return WARP_ADAPTER_VERSION;
+        case 'devin-desktop': return DEVIN_DESKTOP_ADAPTER_VERSION;
+        default: return GENERIC_ADAPTER_VERSION;
+    }
+}
+/**
+ * `aiwg sessions import --from-dir <dir>` (#3168). Batch-imports every
+ * recognised provider export file in one intake directory: one receipt per
+ * file plus a summary. Files already imported are skipped by content digest
+ * before any adapter work; unrecognised files are skipped with a reason.
+ * Each remaining file imports through the single-file path, so adapter
+ * selection, redaction, and idempotency semantics are identical.
+ */
+function importFailureReason(error) {
+    if (error instanceof CliError)
+        return `${error.code}: ${error.message}`;
+    if (error instanceof SessionContractError)
+        return `${error.code}: ${error.message}`;
+    return `IMPORT_INTERRUPTED: ${error instanceof Error ? error.message : String(error)}`;
+}
+async function importSource(ctx, args) {
+    const fromDir = args.values.get('--from-dir');
+    if (fromDir !== undefined) {
+        return importFromDir(ctx, args, resolve(ctx.cwd, fromDir), {
+            assertSupportedImportProvider, normalizeWorkspaceId, isDryRun, preview, ok,
+            openRepository, adapterVersionFor, importSource, importFailureReason,
+        });
+    }
+    const limits = await configuredImportLimits(ctx, args);
+    const input = resolve(ctx.cwd, requiredPositional(args, 0, 'file'));
+    const providerInput = args.values.get('--provider') ?? 'generic';
+    const provider = assertSupportedImportProvider(providerInput);
     const sourceId = requiredValue(args, '--source-id');
     const workspaceId = args.values.has('--workspace')
         ? normalizeWorkspaceId(ctx.cwd, args.values.get('--workspace'))
@@ -780,6 +887,8 @@ async function importSource(ctx, args) {
     const isGrokbotNative = isGrokbot
         && classifyGrokbotBlobName(basename(input))?.kind === 'transcript-replica';
     const isGrokBuild = provider === 'grok-build';
+    const isGrokBuildNative = isGrokBuild
+        && basename(input) === 'chat_history.jsonl';
     const isMuse = provider === 'muse';
     const isPi = provider === 'pi';
     const isOmp = provider === 'omp';
@@ -838,7 +947,7 @@ async function importSource(ctx, args) {
                                         : isGrokbot
                                             ? (isGrokbotNative ? GROKBOT_NATIVE_REPLICA_LOCATOR_CLASS : 'manual-export')
                                             : isGrokBuild
-                                                ? GROK_BUILD_CLI_EXPORT_LOCATOR_CLASS
+                                                ? (isGrokBuildNative ? GROK_BUILD_NATIVE_LOCATOR_CLASS : GROK_BUILD_CLI_EXPORT_LOCATOR_CLASS)
                                                 : isMuse
                                                     ? 'manual-export'
                                                     : isPi
@@ -877,7 +986,7 @@ async function importSource(ctx, args) {
                                             : isGrokbot
                                                 ? (isGrokbotNative ? 'grokbot-native-transcript-replica-v1' : 'manual-interchange')
                                                 : isGrokBuild
-                                                    ? 'documented-cli-markdown-export'
+                                                    ? (isGrokBuildNative ? 'grok-build-native-chat-history-v1' : 'documented-cli-markdown-export')
                                                     : isMuse
                                                         ? 'muse-export-trajectory-v1'
                                                         : isWarp
@@ -944,7 +1053,7 @@ async function importSource(ctx, args) {
                                             : isGrokbot
                                                 ? { 'native.grokbot': {} }
                                                 : isGrokBuild
-                                                    ? { 'native.grok-build': { acquisition: 'grok-cli-export-markdown' } }
+                                                    ? { 'native.grok-build': { acquisition: isGrokBuildNative ? GROK_BUILD_NATIVE_LOCATOR_CLASS : 'grok-cli-export-markdown' } }
                                                     : isMuse
                                                         ? { 'native.muse': {} }
                                                         : isWarp
@@ -1075,7 +1184,10 @@ async function exportBuild(ctx, args, repository, command) {
         ...output,
         bytesEmbedded: includeBytes && outputBytesByRegistrationId.has(output.registrationId),
     }));
-    const index = buildSessionAiwgFortemiIndexExport(plan.workspaceId, sessions, eventsBySessionId, outputs, catalogTagsBySessionId);
+    const index = buildSessionAiwgFortemiIndexExport(plan.workspaceId, sessions, eventsBySessionId, outputs, catalogTagsBySessionId, 
+    // Resolve image references against the live catalog: available blobs
+    // export as references, missing ones as explicit unavailable (#3265).
+    (event) => repository.resolveEventImages(event));
     // aiwgFortemiIndexToKnowledgeShardWithReport targets the declared
     // full-v1/2.0.0 archive contract and validates losslessness -- unlike the
     // plain aiwgFortemiIndexToKnowledgeShard (core-v1), which silently embeds
@@ -1290,6 +1402,12 @@ async function discoverWorkspace(ctx, args) {
             ? resolve(ctx.cwd, args.values.get('--dsh-root')) : undefined,
         grokbotRoot: args.values.has('--grokbot-root')
             ? resolve(ctx.cwd, args.values.get('--grokbot-root')) : undefined,
+        grokRoot: args.values.has('--grok-root')
+            ? resolve(ctx.cwd, args.values.get('--grok-root')) : undefined,
+        grokActiveSessions: args.values.has('--grok-active-sessions')
+            ? resolve(ctx.cwd, args.values.get('--grok-active-sessions')) : undefined,
+        hermesRoot: args.values.has('--hermes-root')
+            ? resolve(ctx.cwd, args.values.get('--hermes-root')) : undefined,
         codexRoots: [
             ...(config?.sessions?.codex_roots ?? []).map((root) => resolve(workspace, root)),
             ...args.codexRoots.map((root) => resolve(ctx.cwd, root)),
@@ -1355,18 +1473,33 @@ async function importDiscovered(ctx, args) {
             ...(carryPath ? { carryForward: redactSourceLocator(carryPath) } : {}),
         });
     }
-    const lease = await acquireImportLease(databasePath(ctx, args), sha256(['discovered-import', manifest.manifestId, manifest.workspaceId].join('\0')), {
-        waitMs: boundedInteger(args.values.get('--lock-wait-ms'), 5_000, 0, 300_000, '--lock-wait-ms'),
-    });
+    const waitMs = boundedInteger(args.values.get('--lock-wait-ms'), 5_000, 0, 300_000, '--lock-wait-ms');
+    const lease = await acquireImportLease(databasePath(ctx, args), sha256(['discovered-import', manifest.manifestId, manifest.workspaceId].join('\0')), { waitMs });
+    let hostLease;
     try {
         const previous = carryPath ? new SessionRepository(carryPath, { readonly: true }) : undefined;
         let repository;
+        let hostRepository;
         try {
             repository = openRepository(ctx, args);
+            // Account-scoped providers (Grok Bot) import once into the host
+            // catalog; the workspace catalog records a reference (#3232). The
+            // host catalog is only opened when the manifest actually holds an
+            // account-scoped source.
+            const hostCatalogPath = defaultHostCatalogPath();
+            if (manifestNeedsHostCatalog(manifest.sources)) {
+                mkdirSync(dirname(hostCatalogPath), { recursive: true, mode: 0o700 });
+                // The workspace lease does not cover the shared host catalog; serialize
+                // host writers the same way the hourly refresh does.
+                hostLease = await acquireImportLease(hostCatalogPath, `host-import-${process.pid}`, { waitMs });
+                hostRepository = new SessionRepository(hostCatalogPath);
+            }
             const interruptedRuns = repository.interruptRunningBatchImports();
             const receipt = await importDiscoveryManifest({
                 manifest,
                 repository,
+                hostRepository,
+                hostCatalogPath,
                 carryForward: previous,
                 limits,
                 exclude,
@@ -1388,10 +1521,12 @@ async function importDiscovered(ctx, args) {
         }
         finally {
             repository?.close();
+            hostRepository?.close();
             previous?.close();
         }
     }
     finally {
+        await hostLease?.release();
         await lease.release();
     }
 }
@@ -1470,10 +1605,10 @@ function providerDisposition(provider) {
     if (provider === 'hermes') {
         return {
             provider, disposition: 'implemented', operationalState: 'available',
-            supportedOperations: ['inspect', 'stream'],
+            supportedOperations: ['discover', 'inspect', 'stream'],
             acquisitionModes: ['jsonl', 'api', 'sqlite-snapshot'],
             reasonCode: null,
-            remediation: 'Use `hermes sessions export` or an explicitly verified sqlite3.backup() snapshot export.',
+            remediation: 'Pass --hermes-root with an explicitly authorized Hermes home for a read-only state.db backup snapshot; or use `hermes sessions export` and import the explicitly authorized JSONL file.',
             evidence: {
                 adapterVersion: HERMES_ADAPTER_VERSION,
                 verifiedAt: '2026-07-27',
@@ -1581,10 +1716,10 @@ function providerDisposition(provider) {
     if (provider === 'grok-build') {
         return {
             provider, disposition: 'implemented', operationalState: 'available',
-            supportedOperations: ['inspect', 'stream'],
-            acquisitionModes: ['manual-export'],
-            reasonCode: 'CLI_EXPORT_REQUIRED',
-            remediation: 'Run `grok sessions list`, then `grok export <session-id> <session-id>.md` and import the explicitly authorized Markdown file. `aiwg sessions grok-list` finds `grok` on PATH or in $GROK_HOME/bin; pass --grok-bin <absolute path> otherwise.',
+            supportedOperations: ['discover', 'inspect', 'stream'],
+            acquisitionModes: ['manual-export', 'jsonl'],
+            reasonCode: null,
+            remediation: 'Pass --grok-root with an explicitly authorized sessions root for native chat_history.jsonl discovery, optionally with --grok-active-sessions for live detection; or run `grok export <session-id> <session-id>.md` and import the explicitly authorized Markdown file.',
             evidence: {
                 adapterVersion: GROK_BUILD_ADAPTER_VERSION,
                 verifiedAt: '2026-09-21',
@@ -1718,6 +1853,127 @@ function catalogScope(ctx, args, repository, workspaceId) {
             : null,
     };
 }
+/**
+ * Host-catalog read-through for account-scoped sessions (#3232). The
+ * workspace catalog holds references instead of copies; each reference
+ * records its host catalog path. Every referenced catalog opens read-only
+ * and closes before returning. Unreadable catalogs contribute nothing, so
+ * local rows still list when the host catalog is missing.
+ */
+function eachReferencedHostCatalog(repository, provider, read) {
+    const references = repository.listHostSessionReferences()
+        .filter((reference) => !provider || reference.provider === provider);
+    if (references.length === 0)
+        return [];
+    const byCatalog = new Map();
+    for (const reference of references) {
+        const group = byCatalog.get(reference.hostCatalog);
+        if (group)
+            group.push(reference);
+        else
+            byCatalog.set(reference.hostCatalog, [reference]);
+    }
+    const reads = [];
+    for (const [catalogPath, group] of byCatalog) {
+        let host;
+        try {
+            host = new SessionRepository(catalogPath, { readonly: true });
+        }
+        catch {
+            continue;
+        }
+        try {
+            reads.push({ references: group, value: read(host, group) });
+        }
+        finally {
+            host.close();
+        }
+    }
+    return reads;
+}
+function readHostReferencedSessions(repository, filters) {
+    const reads = eachReferencedHostCatalog(repository, filters.provider, (host, group) => {
+        const page = host.listSessions({
+            provider: filters.provider,
+            workspaceId: HOST_CATALOG_WORKSPACE_ID,
+            limit: group.length,
+        });
+        const sessions = resolveHostReferences(group, page.items)
+            .filter((session) => !filters.tag || host.listTags(session.sessionId).includes(filters.tag));
+        const resolvedSourceIds = new Set(sessions.map((session) => session.sourceId));
+        return {
+            sessions,
+            resolvedReferences: group.filter((reference) => resolvedSourceIds.has(reference.sourceId)),
+        };
+    });
+    return {
+        references: reads.flatMap((read) => read.references),
+        resolvedReferences: reads.flatMap((read) => read.value.resolvedReferences),
+        sessions: reads.flatMap((read) => read.value.sessions),
+    };
+}
+function searchHostReferencedSessions(repository, searchOptions, provider) {
+    const reads = eachReferencedHostCatalog(repository, provider, (host) => {
+        const result = host.search({
+            ...searchOptions,
+            workspaceId: HOST_CATALOG_WORKSPACE_ID,
+            cursor: undefined,
+        });
+        return {
+            hits: result.items,
+            hostIdentities: host.listSessionIdentities(HOST_CATALOG_WORKSPACE_ID),
+        };
+    });
+    return {
+        hits: reads.flatMap((read) => read.value.hits),
+        hostIdentities: reads.flatMap((read) => read.value.hostIdentities),
+    };
+}
+function readHostReferencedAnalyticsFacts(repository, query) {
+    // query.sessionId is a workspace-local internal id; host rows carry host
+    // stable ids, so resolve it to a provider + native session key first.
+    let sessionKey = null;
+    if (query.sessionId) {
+        const session = repository.getSession(query.sessionId, query.workspaceId);
+        if (!session)
+            return { facts: [], hostIdentities: [] };
+        sessionKey = `${session.provider} ${session.nativeSessionId}`;
+    }
+    const reads = eachReferencedHostCatalog(repository, query.provider, (host, group) => {
+        const wanted = new Set(group.map((reference) => `${reference.provider} ${reference.nativeSessionId}`));
+        const identities = host.listSessionIdentities(HOST_CATALOG_WORKSPACE_ID);
+        const hostSessionIds = new Set(identities
+            .filter((identity) => wanted.has(`${identity.provider} ${identity.nativeSessionId}`))
+            .map((identity) => identity.sessionId));
+        const { sessionId: _localSessionId, ...hostQuery } = query;
+        const facts = host.listAnalyticsFacts({ ...hostQuery, workspaceId: HOST_CATALOG_WORKSPACE_ID })
+            .filter((fact) => hostSessionIds.has(fact.sessionId)
+            && (!sessionKey || `${fact.provider} ${hostSessionKey(fact.sessionId, identities)}` === sessionKey));
+        return { facts, identities };
+    });
+    return {
+        facts: reads.flatMap((read) => read.value.facts),
+        hostIdentities: reads.flatMap((read) => read.value.identities),
+    };
+}
+function hostSessionKey(sessionId, identities) {
+    return identities.find((identity) => identity.sessionId === sessionId)?.nativeSessionId ?? null;
+}
+/**
+ * Workspace analytics facts with host references resolved. Returns null
+ * when the workspace holds no references so callers keep the exact
+ * single-catalog query path (SQL limit/filter semantics unchanged).
+ */
+function readWorkspaceAnalyticsFacts(repository, query) {
+    const references = repository.listHostSessionReferences()
+        .filter((reference) => !query.provider || reference.provider === query.provider);
+    if (references.length === 0)
+        return null;
+    const hostRead = readHostReferencedAnalyticsFacts(repository, query);
+    if (hostRead.facts.length === 0)
+        return null;
+    return mergeCrossCatalogRows(repository.listAnalyticsFacts(query), hostRead.facts, indexIdentitiesBySessionId(repository.listSessionIdentities(query.workspaceId)), indexIdentitiesBySessionId(hostRead.hostIdentities), (fact) => `${fact.provider} ${fact.factId}`);
+}
 async function configuredImportLimits(ctx, args, workspace) {
     const selectedWorkspace = workspace ?? (args.values.has('--workspace')
         ? resolve(ctx.cwd, args.values.get('--workspace')) : ctx.cwd);
@@ -1739,12 +1995,12 @@ function parseArgs(argv) {
     const exclude = [];
     const positionals = [];
     const valueFlags = new Set([
-        '--db', '--provider', '--workspace', '--tag', '--limit', '--cursor', '--source-id',
+        '--db', '--provider', '--workspace', '--tag', '--limit', '--cursor', '--source-id', '--from-dir',
         '--date-from', '--date-to', '--participant', '--model', '--role', '--tool',
         '--entity', '--sensitivity', '--extraction-state', '--page-size', '--max-documents',
         '--state', '--reviewer', '--reason', '--policy-version', '--min-confidence',
         '--consumer', '--actor-class', '--reason-code', '--dependent-action', '--basis',
-        '--carry-forward', '--manifest', '--provider-home', '--codex-root', '--omp-root', '--muse-root', '--dsh-root', '--grokbot-root', '--lock-wait-ms', '--min-coverage', '--gap',
+        '--carry-forward', '--manifest', '--provider-home', '--codex-root', '--omp-root', '--muse-root', '--dsh-root', '--grokbot-root', '--grok-root', '--grok-active-sessions', '--hermes-root', '--lock-wait-ms', '--min-coverage', '--gap',
         '--inactivity-threshold', '--expected-providers', '--exclude', '--max-record-bytes', '--max-source-bytes',
         '--control-events',
         '--session', '--status', '--actor', '--group-by',

package/dist/src/cli/handlers/skill-lint.js

@@ -13,6 +13,8 @@ import * as fs from 'fs/promises';
 import * as path from 'path';
 import { validateSkillFrontmatter } from '../../extensions/validation.js';
 import { validateAgentSkillFile } from '../../skills/validator.js';
+import { CLAUDE_SKILL_FIELDS } from '../../skills/provider-extensions.js';
+import { projectClaudeSkillSurfaces } from '../../skills/claude-surface-projection.js';
 const THRESHOLDS = {
     strict: 80,
     standard: 60,
@@ -44,7 +46,10 @@ function scoreSchema(frontmatter, diagnostics) {
             : `${item.yamlPath}: ${item.message} [${item.code}]`));
         return scoreDimension(false, notes);
     }
-    const result = validateSkillFrontmatter(frontmatter);
+    // Native Claude fields belong to the provider layer, including string effort.
+    const portableAndAiwg = Object.fromEntries(Object.entries(frontmatter)
+        .filter(([key]) => !CLAUDE_SKILL_FIELDS.includes(key)));
+    const result = validateSkillFrontmatter(portableAndAiwg);
     if (result.success)
         return scoreDimension(true);
     const notes = result.errors.issues.map((e) => `${e.path.join('.') || '<root>'}: ${e.message}`);
@@ -211,6 +216,7 @@ export async function lintSkillFile(filePath, rubric = 'standard', profile = 'co
     return {
         file: filePath,
         score,
+        projections: projectClaudeSkillSurfaces(body),
         conformance: {
             profile,
             state: validation.state,
@@ -321,14 +327,15 @@ function parseArgs(args) {
 function renderTextReport(report) {
     const { files, threshold, rubric, profile, averageScore, failedCount } = report;
     for (const f of files) {
-        if (f.passes && f.conformance.diagnostics.length === 0)
-            continue;
         const mark = !f.passes
             ? '✗'
             : f.conformance.diagnostics.some((item) => item.severity === 'warning')
                 ? '⚠'
                 : '✓';
         console.log(`${mark} ${f.file} (${f.score}/100, conformance=${f.conformance.state})`);
+        for (const p of f.projections) {
+            console.log(`    ${p.provider}/${p.surface}: ${p.status}${p.shellInterpolation ? ` (shell: ${p.shellInterpolation})` : ''}; ${p.reasons.join(' ')}`);
+        }
         for (const item of f.conformance.diagnostics) {
             console.log(`    ${item.severity} ${item.code} ${item.yamlPath}: ${item.message}; `
                 + `fix: ${item.remediation}`);