@aiwg/cli 2026.10.11 → 2026.10.12

package/dist/src/sessions/adapters/hermes.js

@@ -1,7 +1,10 @@
+import { lstat } from 'node:fs/promises';
+import { join } from 'node:path';
 import { z } from 'zod';
 import { number } from '../../schema/zod-validation.mjs';
 import { schemaRejectionDetail, schemaIssueDetail, SessionContractError, assertSupportedSchemaMajor, } from '../contracts.js';
 import { streamBoundedJsonLines, } from '../readers.js';
+import { HERMES_SNAPSHOT_LOCATOR_CLASS, HERMES_STATE_DB_FILENAME, hermesSnapshotStagingDir, snapshotHermesStateDb, } from './hermes-state-db.js';
 export const HERMES_ADAPTER_VERSION = '1.0.0';
 export const HERMES_EXPORT_SCHEMA_VERSION = '1.0.0';
 export const HERMES_NATIVE_SCHEMA_VERSION = '23.0.0';
@@ -64,14 +67,42 @@ export class HermesSessionAdapter {
     provider = 'hermes';
     adapterVersion = HERMES_ADAPTER_VERSION;
     disposition = 'implemented';
-    supportedOperations = ['inspect', 'stream'];
+    supportedOperations = ['discover', 'inspect', 'stream'];
     acquisitionModes = ['jsonl', 'api', 'sqlite-snapshot'];
     constructor(limits, localApi) {
         this.limits = limits;
         this.localApi = localApi;
     }
-    async *discover(_scope) {
-        // Native exports and consistent snapshots require explicit selection.
+    /**
+     * Discover through a consistent `sqlite3.backup()` snapshot of the
+     * explicitly authorized `<root>/state.db`. The live database is never
+     * opened for writing and never streamed directly; matching sessions are
+     * projected to an owned staging snapshot the existing consistent-snapshot
+     * path already validates.
+     */
+    async *discover(scope) {
+        if (scope.allowedRoots.length === 0) {
+            throw new SessionContractError('SOURCE_NOT_AUTHORIZED', 'Hermes discovery requires an explicitly authorized Hermes home; pass --hermes-root.');
+        }
+        const staging = hermesSnapshotStagingDir(scope.workspaceId);
+        for (const root of [...scope.allowedRoots].sort()) {
+            if (!(await isStateDbFile(join(root, HERMES_STATE_DB_FILENAME))))
+                continue;
+            const snapshot = await snapshotHermesStateDb({
+                hermesRoot: root,
+                stagingDir: staging,
+                allowedRoots: scope.allowedRoots,
+                workspaceId: scope.workspaceId,
+                limits: this.limits,
+            });
+            if (!snapshot)
+                continue;
+            yield {
+                provider: 'hermes',
+                locator: snapshot.projectionPath,
+                locatorClass: HERMES_SNAPSHOT_LOCATOR_CLASS,
+            };
+        }
     }
     async inspect(source) {
         if (source.locatorClass === 'hermes-export-jsonl'
@@ -284,6 +315,14 @@ function normalizeMessage(sessionId, message, index, line, locatorClass, common)
     }));
     return records;
 }
+async function isStateDbFile(path) {
+    try {
+        return (await lstat(path)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
 function ended(value) {
     return Boolean(value.ended_at || value.provider_deleted_at || value.archived || value.inactive);
 }

package/dist/src/sessions/adapters/warp.js

@@ -50,7 +50,7 @@ export class WarpSessionAdapter {
         if (blocks.length === 0) {
             throw new SessionContractError('MALFORMED_SOURCE', 'Warp Markdown export contains no recognized user or assistant conversation blocks', schemaIssueDetail('headings'));
         }
-        const stableSessionId = `manual:${createHash('sha256').update(value).digest('hex').slice(0, 32)}`;
+        const stableSessionId = source.nativeSessionId ?? `manual:${createHash('sha256').update(value).digest('hex').slice(0, 32)}`;
         const lifecycleEvidence = /<!--\s*warp-lifecycle:\s*complete\s*-->/i.test(value)
             ? 'completed-at-import' : 'unknown-at-import';
         const title = /^#\s+(.+)$/m.exec(value)?.[1]?.trim();

package/dist/src/sessions/batch-import.js

@@ -327,6 +327,16 @@ function providerProfile(provider, locatorClass) {
         return 'muse-native-session-log-v1';
     if (provider === 'grokbot')
         return 'grokbot-native-transcript-replica-v1';
+    if (provider === 'grok-build') {
+        return locatorClass === 'grok-build-native-chat-history'
+            ? 'grok-build-native-chat-history-v1'
+            : 'documented-cli-markdown-export';
+    }
+    if (provider === 'hermes') {
+        return locatorClass === 'hermes-consistent-snapshot-jsonl'
+            ? 'native-state-db-backup-snapshot-v1'
+            : 'native-schema-23-export';
+    }
     return 'manual-interchange';
 }
 function importErrorCode(error) {

package/dist/src/sessions/contracts.js

@@ -76,7 +76,7 @@ export const SessionErrorCodeSchema = z.enum([
     'OPERATION_NOT_AUTHORIZED',
     'IMPORT_CONFLICT', 'IMPORT_INTERRUPTED', 'MALFORMED_SOURCE',
     'DUPLICATE_NATIVE_ID', 'AMBIGUOUS_TIMESTAMP', 'TRUNCATED_SOURCE',
-    'UNSUPPORTED_OPERATION',
+    'UNSUPPORTED_OPERATION', 'UNSUPPORTED_PROVIDER',
     'INVALID_SEARCH_QUERY', 'INVALID_ARGUMENT',
 ]);
 const VersionSchema = z.string().regex(/^\d+\.\d+\.\d+(?:[-+].+)?$/);

package/dist/src/sessions/discovery-capability.js

@@ -0,0 +1,38 @@
+const REQUIRED_FLAGS = {
+    claude: [],
+    codex: ['--codex-root'],
+    cursor: [],
+    factory: [],
+    pi: [],
+    omp: ['--omp-root'],
+    'deepseek-harness': ['--dsh-root'],
+    muse: ['--muse-root'],
+    grokbot: ['--grokbot-root'],
+    'grok-build': ['--grok-root'],
+    hermes: ['--hermes-root'],
+};
+const LIVE_DETECTION = {
+    'grok-build': 'supported',
+};
+/**
+ * `discoverable` requires a wired `discover` operation on the loaded adapter,
+ * not merely an implemented ingest path; otherwise the provider stays
+ * `manual-export` (or `unsupported` when it has no ingest path at all).
+ */
+export function providerDiscoveryCapability(provider, supportedOperations) {
+    if (supportedOperations.includes('discover')) {
+        return {
+            disposition: 'discoverable',
+            authorization: 'explicit-root',
+            requiredFlags: REQUIRED_FLAGS[provider] ?? [],
+            liveDetection: LIVE_DETECTION[provider] ?? 'unsupported',
+        };
+    }
+    return {
+        disposition: 'manual-export',
+        authorization: 'none',
+        requiredFlags: [],
+        liveDetection: 'unsupported',
+    };
+}
+//# sourceMappingURL=discovery-capability.js.map

package/dist/src/sessions/importer.js

@@ -1,10 +1,8 @@
-import { SESSION_CONTRACT_VERSION, SessionEventSchema, SessionSchema, assertSupportedSchemaMajor, sha256, stableEventId, stableSessionId, SessionContractError, schemaIssueDetail, assertSessionResourceLimit, } from './contracts.js';
+import { SESSION_CONTRACT_VERSION, assertSupportedSchemaMajor, sha256, SessionContractError, schemaIssueDetail, assertSessionResourceLimit, } from './contracts.js';
 import { assertImportByteLimit, DEFAULT_IMPORT_BYTE_LIMITS, resolveImportLimits } from './import-limits.js';
-import { redactSessionValue, sanitizeSessionEvent, sanitizeNativeExtensions } from './policy.js';
-import { extractEventImages } from './image-blobs.js';
+import { redactSessionValue, sanitizeNativeExtensions } from './policy.js';
 import { fingerprintSourcePrefix } from './readers.js';
-import { DEFAULT_INACTIVITY_THRESHOLD_MS } from './lifecycle.js';
-import { classifySessionEventOrigin, deriveSessionIntent, } from './origin.js';
+import { normalizeSessionBatch, sourceGenerationDigest } from './normalization.js';
 export const DEFAULT_IMPORT_LIMITS = {
     maxRecords: 1_000_000,
     ...DEFAULT_IMPORT_BYTE_LIMITS,
@@ -100,7 +98,7 @@ export class IncrementalSessionImporter {
                 batchStart, checkpoint.recordsRead,
                 ...batchDigests,
             ].join('\0'));
-            const normalized = normalizeBatch(request, batch, batchDigests, runId, sourceObservedAt);
+            const normalized = normalizeSessionBatch(request, batch, batchDigests, runId, sourceObservedAt);
             const run = {
                 contractVersion: SESSION_CONTRACT_VERSION,
                 importRunId: runId,
@@ -178,7 +176,10 @@ export class IncrementalSessionImporter {
                 }
                 else {
                     checkpoint.bytesRead += bytes;
-                    checkpoint.cursor = String(checkpoint.recordsRead);
+                    // Older Pi adapters exposed bare byte counts without a byte: tag;
+                    // those checkpoints historically counted records instead.
+                    checkpoint.cursor = request.adapter.provider === 'pi' ? String(checkpoint.recordsRead)
+                        : record.sourceCursor ?? String(checkpoint.recordsRead);
                 }
                 if (batch.length >= limits.batchSize)
                     flush();
@@ -232,250 +233,6 @@ function recordIdentity(record) {
     const serialized = JSON.stringify(record);
     return { bytes: Buffer.byteLength(serialized), digest: sha256(serialized) };
 }
-function normalizeBatch(request, records, digests, importRunId, sourceObservedAt) {
-    const sessions = new Map();
-    // Extract inline images before sanitization: provider image blocks in
-    // extensions are redacted to markers below, so bytes must be lifted out
-    // first while the raw record is still intact (#3265).
-    const imageBlobs = new Map();
-    const events = records.map((record, index) => {
-        const sessionId = stableSessionId(request.source.provider, request.source.sourceId, record.nativeSessionId);
-        const native = sanitizeNativeExtensions(record.extensions ?? {});
-        const lineage = request.source.provider === 'codex' && native.value.lineage
-            ? { lineage: native.value.lineage } : {};
-        const images = extractEventImages({
-            searchableText: record.text,
-            extensions: record.extensions,
-            rawReference: record.rawReference,
-        });
-        for (const image of images.images) {
-            if (!imageBlobs.has(image.digest))
-                imageBlobs.set(image.digest, image);
-        }
-        const digest = digests[index];
-        const origin = classifySessionEventOrigin(request.source.provider, record);
-        const lifecycle = sessionLifecycle(request, record, sourceObservedAt);
-        const lifecycleEvidence = sessionLifecycleEvidence(request, record, sourceObservedAt);
-        const extensions = {
-            [`native.${request.source.provider}`]: images.extensions,
-        };
-        const event = sanitizeSessionEvent(SessionEventSchema.parse({
-            contractVersion: SESSION_CONTRACT_VERSION,
-            eventId: stableEventId(request.source.provider, request.source.sourceId, record, digest),
-            sessionId, sourceId: request.source.sourceId, importRunId,
-            nativeId: record.nativeEventId ?? null, sequence: record.sequence,
-            kind: record.kind, role: record.role ?? null, occurredAt: record.occurredAt ?? null,
-            activityBoundary: record.activityBoundary ?? null,
-            activityBoundaryBasis: record.activityBoundaryBasis ?? null,
-            activityBoundaryConfidence: record.activityBoundaryConfidence ?? null,
-            origin: origin.origin,
-            originRule: origin.rule,
-            originClassifierVersion: origin.classifierVersion,
-            participant: record.participant ?? null,
-            toolName: record.toolName ?? null,
-            toolCallId: record.toolCallId ?? null,
-            model: record.model ?? null,
-            entities: record.entities ?? [],
-            extractionState: record.extractionState ?? null,
-            searchableText: images.searchableText, imageRefs: images.imageRefs,
-            digest, rawReference: record.rawReference,
-            adapterVersion: request.adapter.adapterVersion,
-            consistency: request.source.consistency,
-            sensitivity: { classification: 'none', classes: [] },
-            opaque: !isKnownEventKind(record.kind),
-            extensions,
-        }));
-        if (!sessions.has(sessionId)) {
-            sessions.set(sessionId, SessionSchema.parse({
-                contractVersion: SESSION_CONTRACT_VERSION,
-                sessionId, sourceId: request.source.sourceId, provider: request.source.provider,
-                nativeSessionId: record.nativeSessionId, workspaceId: request.workspaceId,
-                startedAt: record.occurredAt ?? null, updatedAt: record.occurredAt ?? null,
-                consistency: request.source.consistency,
-                lifecycle,
-                sourceDigest: sha256(`${sourceGenerationDigest(request)}\0${record.nativeSessionId}`),
-                extensions: {
-                    [`native.${request.source.provider}`]: {
-                        ...lineage,
-                        lifecycleEvidence,
-                    },
-                },
-            }));
-        }
-        else {
-            const session = sessions.get(sessionId);
-            session.startedAt = earlierTimestamp(session.startedAt, record.occurredAt ?? null);
-            session.updatedAt = laterTimestamp(session.updatedAt, record.occurredAt ?? null);
-            session.consistency = strongerConsistency(session.consistency, request.source.consistency);
-            const nativeKey = `native.${request.source.provider}`;
-            const nativeEnvelope = session.extensions[nativeKey];
-            const nativeRecord = nativeEnvelope && typeof nativeEnvelope === 'object' && !Array.isArray(nativeEnvelope)
-                ? nativeEnvelope
-                : {};
-            const selected = selectLifecycleTransition(session.lifecycle, nativeRecord.lifecycleEvidence, lifecycle, lifecycleEvidence);
-            session.lifecycle = selected.lifecycle;
-            session.extensions[nativeKey] = {
-                ...nativeRecord,
-                ...lineage,
-                lifecycleEvidence: selected.evidence,
-            };
-        }
-        return event;
-    });
-    for (const session of sessions.values()) {
-        session.intent = deriveSessionIntent(events.filter((event) => event.sessionId === session.sessionId));
-    }
-    return {
-        sessions: redactSessionValue([...sessions.values()]).value,
-        events,
-        imageBlobs: [...imageBlobs.values()],
-    };
-}
-const KNOWN_EVENT_KINDS = new Set(['message', 'tool-call', 'tool-result', 'artifact', 'attachment', 'summary']);
-function isKnownEventKind(kind) {
-    const normalized = kind.toLowerCase();
-    return KNOWN_EVENT_KINDS.has(normalized)
-        || /^(?:tool-call|tool-result)(?:[._-]|$)/.test(normalized)
-        || /^(?:sandbox|permission|approval|hitl|human|lifecycle)(?:[._-]|$)/.test(normalized);
-}
-function earlierTimestamp(left, right) {
-    if (!left)
-        return right;
-    if (!right)
-        return left;
-    return Date.parse(left) <= Date.parse(right) ? left : right;
-}
-function laterTimestamp(left, right) {
-    if (!left)
-        return right;
-    if (!right)
-        return left;
-    return Date.parse(left) >= Date.parse(right) ? left : right;
-}
-function strongerConsistency(left, right) {
-    const rank = {
-        provisional: 0,
-        'consistent-snapshot': 1,
-        complete: 2,
-    };
-    return rank[left] >= rank[right] ? left : right;
-}
-function sessionLifecycle(request, record, sourceObservedAt) {
-    const explicit = nativeLifecycle(record.extensions);
-    if (explicit)
-        return explicit;
-    if (request.source.consistency === 'complete')
-        return 'complete';
-    const observedAt = record.occurredAt ?? sourceObservedAt;
-    if (observedAt && isStaleHistoricalTimestamp(observedAt, inactivityThresholdMs(request)))
-        return 'inactive';
-    return 'active';
-}
-function sessionLifecycleEvidence(request, record, sourceObservedAt) {
-    const observedAt = record.occurredAt ?? sourceObservedAt;
-    const explicit = nativeLifecycle(record.extensions);
-    if (explicit) {
-        return {
-            basis: 'provider-explicit-event',
-            state: explicit,
-            observedAt: observedAt ?? request.source.authorizedAt,
-            confidence: 'high',
-        };
-    }
-    if (request.source.consistency === 'complete') {
-        return {
-            basis: 'complete-source',
-            state: 'complete',
-            observedAt: observedAt ?? request.source.authorizedAt,
-            confidence: 'high',
-        };
-    }
-    const thresholdMs = inactivityThresholdMs(request);
-    if (observedAt && isStaleHistoricalTimestamp(observedAt, thresholdMs)) {
-        return {
-            basis: 'inactivity-threshold',
-            state: 'inactive',
-            observedAt,
-            confidence: 'medium',
-            thresholdMs,
-        };
-    }
-    return {
-        basis: 'open-provisional-source',
-        state: 'active',
-        observedAt: observedAt ?? request.source.authorizedAt,
-        confidence: 'provisional',
-        thresholdMs,
-    };
-}
-function nativeLifecycle(extensions) {
-    const raw = typeof extensions?.lifecycle === 'string' ? extensions.lifecycle : undefined;
-    if (!raw)
-        return null;
-    const normalized = {
-        active: 'active',
-        inactive: 'inactive',
-        paused: 'paused',
-        complete: 'complete',
-        completed: 'complete',
-        archived: 'archived',
-        deleted: 'tombstoned',
-        cancelled: 'interrupted',
-        canceled: 'interrupted',
-        failed: 'interrupted',
-        interrupted: 'interrupted',
-        unknown: 'unknown',
-        'unknown-at-import': 'unknown',
-        'completed-at-import': 'complete',
-    };
-    return normalized[raw] ?? null;
-}
-function selectLifecycleTransition(leftLifecycle, left, rightLifecycle, right) {
-    const leftEvidence = asLifecycleEvidence(left);
-    if (leftLifecycle === 'tombstoned') {
-        return { lifecycle: leftLifecycle, evidence: leftEvidence ?? right };
-    }
-    if (!leftEvidence)
-        return { lifecycle: rightLifecycle, evidence: right };
-    const rank = {
-        'open-provisional-source': 1,
-        'inactivity-threshold': 1,
-        'complete-source': 2,
-        'provider-explicit-event': 3,
-    };
-    const leftRank = rank[String(leftEvidence.basis)] ?? 0;
-    const rightRank = rank[String(right.basis)] ?? 0;
-    const rightIsNewer = evidenceTimestamp(right) > evidenceTimestamp(leftEvidence);
-    return rightRank > leftRank || (rightRank === leftRank && rightIsNewer)
-        ? { lifecycle: rightLifecycle, evidence: right }
-        : { lifecycle: leftLifecycle, evidence: leftEvidence };
-}
-function asLifecycleEvidence(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : null;
-}
-function evidenceTimestamp(value) {
-    const parsed = Date.parse(String(value.observedAt ?? ''));
-    return Number.isFinite(parsed) ? parsed : Number.NEGATIVE_INFINITY;
-}
-function inactivityThresholdMs(request) {
-    return request.inactivityThresholdMs ?? DEFAULT_INACTIVITY_THRESHOLD_MS;
-}
-function isStaleHistoricalTimestamp(value, thresholdMs) {
-    const timestamp = Date.parse(value);
-    return Number.isFinite(timestamp)
-        && Date.now() - timestamp > thresholdMs;
-}
-function sourceGenerationDigest(request) {
-    return sha256([
-        request.source.sourceId,
-        request.source.provider,
-        request.selectedSource.locatorClass,
-        request.source.sourceSchemaVersion,
-        request.adapter.adapterVersion,
-    ].join('\0'));
-}
 async function sourceContinuity(request, previous) {
     if (request.selectedSource.authorizedScope.allowedRoots.length === 0
         || /^[a-z][a-z0-9+.-]*:\/\//i.test(request.selectedSource.locator)

package/dist/src/sessions/index.js

@@ -20,6 +20,7 @@ export * from './importer.js';
 export * from './import-lease.js';
 export * from './batch-contracts.js';
 export * from './batch-import.js';
+export * from './intake-dir.js';
 export * from './host-catalog.js';
 export * from './workspace-discovery.js';
 export * from './timeline.js';
@@ -32,11 +33,13 @@ export * from './adapters/copilot.js';
 export * from './adapters/cursor.js';
 export * from './adapters/factory.js';
 export * from './adapters/hermes.js';
+export * from './adapters/hermes-state-db.js';
 export * from './adapters/opencode.js';
 export * from './adapters/openclaw.js';
 export * from './adapters/openhuman.js';
 export * from './adapters/grokbot.js';
 export * from './adapters/grok-build.js';
+export * from './adapters/grok-build-native.js';
 export * from './grok-build-cli.js';
 export * from './adapters/pi.js';
 export * from './adapters/deepseek-harness.js';
@@ -46,4 +49,5 @@ export * from './adapters/muse.js';
 export * from './adapters/omp.js';
 export * from './adapter-registry.js';
 export * from './coverage-preflight.js';
+export * from './discovery-capability.js';
 //# sourceMappingURL=index.js.map

package/dist/src/sessions/intake-dir.js

@@ -0,0 +1,71 @@
+// Intake-directory batch import for `sessions import --from-dir` (#3168).
+import { readdir } from 'node:fs/promises';
+import { SessionContractError } from './contracts.js';
+export const INTAKE_DIR_SCHEMA_VERSION = '1.0.0';
+/** Recognised intake files are provider export payloads, never control files. */
+export function isRecognisedIntakeFile(provider, filename) {
+    if (filename.startsWith('.')) {
+        return { recognised: false, reason: `skipped dotfile ${JSON.stringify(filename)}` };
+    }
+    if (provider === 'claude') {
+        if (filename.endsWith('.json') || filename.endsWith('.jsonl'))
+            return { recognised: true };
+        return {
+            recognised: false,
+            reason: 'unrecognised extension for provider claude:'
+                + ` expected .json (web/account export) or .jsonl (transcript/hook), got ${JSON.stringify(filename)}`,
+        };
+    }
+    if (filename.endsWith('.json') || filename.endsWith('.jsonl'))
+        return { recognised: true };
+    return {
+        recognised: false,
+        reason: `unrecognised extension for provider ${provider}:`
+            + ` expected .json or .jsonl, got ${JSON.stringify(filename)}`,
+    };
+}
+/** Stable per-file source identity: an optional prefix plus the file basename. */
+export function intakeSourceId(prefix, filename) {
+    const base = filename.replace(/[^A-Za-z0-9._-]+/g, '_');
+    return prefix ? `${prefix}/${base}` : base;
+}
+/** Sorted basenames of regular files directly inside the intake directory. */
+export async function listIntakeDirFiles(dir) {
+    let entries;
+    try {
+        entries = await readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        throw new SessionContractError('INVALID_ARGUMENT', `intake directory is not readable: ${dir}`);
+    }
+    return entries
+        .filter((entry) => entry.isFile())
+        .map((entry) => entry.name)
+        .sort();
+}
+/** Content-free roll-up over one receipt per intake file. */
+export function summarizeIntakeReceipts(files) {
+    const summary = {
+        total: files.length,
+        imported: 0,
+        alreadyImported: 0,
+        skipped: 0,
+        rejected: 0,
+        sessionsInserted: 0,
+        eventsInserted: 0,
+    };
+    for (const file of files) {
+        if (file.status === 'imported')
+            summary.imported += 1;
+        else if (file.status === 'already-imported')
+            summary.alreadyImported += 1;
+        else if (file.status === 'skipped')
+            summary.skipped += 1;
+        else
+            summary.rejected += 1;
+        summary.sessionsInserted += file.sessionsInserted;
+        summary.eventsInserted += file.eventsInserted;
+    }
+    return summary;
+}
+//# sourceMappingURL=intake-dir.js.map