@aiwg/cli 2026.10.3 → 2026.10.5

package/dist/src/sessions/adapters/windsurf.js

@@ -1,7 +1,7 @@
 import { basename } from 'node:path';
 import { z } from 'zod';
-import { SessionContractError, assertSupportedSchemaMajor, } from '../contracts.js';
-import { readBoundedJsonLines, streamBoundedJsonLines, } from '../readers.js';
+import { schemaRejectionDetail, schemaIssueDetail, SessionContractError, assertSupportedSchemaMajor, } from '../contracts.js';
+import { streamBoundedJsonLines, } from '../readers.js';
 export const DEVIN_DESKTOP_ADAPTER_VERSION = '1.1.0';
 export const DEVIN_DESKTOP_TRANSCRIPT_SCHEMA_VERSION = '1.0.0';
 /** @deprecated Compatibility export. */
@@ -38,19 +38,14 @@ export class DevinDesktopSessionAdapter {
         // Deliberately empty: hook enablement and transcript selection are explicit user actions.
     }
     async inspect(source) {
-        const parsed = await this.readSource(source);
-        return {
-            sourceSchemaVersion: parsed.schemaVersion,
-            consistency: 'provisional',
-            operationalState: 'available',
-        };
+        const records = this.stream(source);
+        let result = await records.next();
+        while (!result.done)
+            result = await records.next();
+        return result.value;
     }
     async *stream(source, cursor) {
-        if (!isCurrentHookLocator(source.locatorClass)) {
-            // Preserve the precise unsupported-operation diagnostics.
-            await this.readSource(source);
-            return;
-        }
+        this.assertSupportedLocator(source);
         const start = parseCursor(cursor?.value);
         const input = await streamBoundedJsonLines({
             selectedPath: source.locator,
@@ -62,12 +57,12 @@ export class DevinDesktopSessionAdapter {
         for await (const line of input) {
             const parsed = StepSchema.safeParse(line.value);
             if (!parsed.success) {
-                throw new SessionContractError('MALFORMED_SOURCE', 'Windsurf transcript step is malformed');
+                throw new SessionContractError('MALFORMED_SOURCE', 'Windsurf transcript step is malformed', schemaRejectionDetail(parsed.error));
             }
             const step = parsed.data;
             const currentVersion = step.schema_version ?? DEVIN_DESKTOP_TRANSCRIPT_SCHEMA_VERSION;
             if (schemaVersion && schemaVersion !== currentVersion) {
-                throw new SessionContractError('SCHEMA_DRIFT', 'mixed Windsurf transcript schemas');
+                throw new SessionContractError('SCHEMA_DRIFT', 'mixed Windsurf transcript schemas', schemaIssueDetail('schema_version'));
             }
             schemaVersion = currentVersion;
             assertSupportedSchemaMajor(schemaVersion);
@@ -75,7 +70,7 @@ export class DevinDesktopSessionAdapter {
                 ?? nativeSessionId
                 ?? basename(source.locator, '.jsonl');
             if (step.trajectory_id && nativeSessionId && step.trajectory_id !== nativeSessionId) {
-                throw new SessionContractError('SCHEMA_DRIFT', 'mixed Windsurf trajectory identities');
+                throw new SessionContractError('SCHEMA_DRIFT', 'mixed Windsurf trajectory identities', schemaIssueDetail('trajectory_id'));
             }
             nativeSessionId = currentSession;
             if (seen++ < start)
@@ -83,45 +78,21 @@ export class DevinDesktopSessionAdapter {
             yield normalizeStep(step, currentSession, line.sequence, line.byteOffset, canonicalLocatorClass(source.locatorClass), schemaVersion);
         }
         if (seen === 0) {
-            throw new SessionContractError('MALFORMED_SOURCE', 'Windsurf transcript is empty or malformed');
+            throw new SessionContractError('MALFORMED_SOURCE', 'Windsurf transcript is empty or malformed', schemaIssueDetail('<root>'));
         }
+        return {
+            sourceSchemaVersion: schemaVersion,
+            consistency: 'provisional',
+            operationalState: 'available',
+        };
     }
-    async readSource(source) {
+    assertSupportedLocator(source) {
         if (isLegacyLocator(source.locatorClass)) {
             throw new SessionContractError('UNSUPPORTED_OPERATION', 'legacy Devin Desktop/Windsurf protobuf stores are unsupported; enable post_cascade_response_with_transcript and select its JSONL output');
         }
         if (!isCurrentHookLocator(source.locatorClass)) {
             throw new SessionContractError('UNSUPPORTED_OPERATION', 'Devin Desktop (Windsurf compatibility) requires an explicitly selected post_cascade_response_with_transcript JSONL file');
         }
-        const input = await readBoundedJsonLines({
-            selectedPath: source.locator,
-            allowedRoots: source.authorizedScope.allowedRoots,
-        }, { consistency: 'provisional', limits: this.limits });
-        if (input.records.length === 0) {
-            throw new SessionContractError('MALFORMED_SOURCE', 'Windsurf transcript is empty or malformed');
-        }
-        const steps = input.records.map((record) => {
-            const parsed = StepSchema.safeParse(record.value);
-            if (!parsed.success) {
-                throw new SessionContractError('MALFORMED_SOURCE', 'Windsurf transcript step is malformed');
-            }
-            return { ...record, value: parsed.data };
-        });
-        const versions = new Set(steps.map(({ value }) => value.schema_version ?? DEVIN_DESKTOP_TRANSCRIPT_SCHEMA_VERSION));
-        if (versions.size !== 1) {
-            throw new SessionContractError('SCHEMA_DRIFT', 'mixed Windsurf transcript schemas');
-        }
-        const schemaVersion = [...versions][0];
-        assertSupportedSchemaMajor(schemaVersion);
-        const trajectoryIds = new Set(steps.flatMap(({ value }) => value.trajectory_id ? [value.trajectory_id] : []));
-        if (trajectoryIds.size > 1) {
-            throw new SessionContractError('SCHEMA_DRIFT', 'mixed Windsurf trajectory identities');
-        }
-        const nativeSessionId = [...trajectoryIds][0] ?? basename(source.locator, '.jsonl');
-        return {
-            schemaVersion,
-            records: steps.map(({ value, sequence, byteOffset }) => normalizeStep(value, nativeSessionId, sequence, byteOffset, canonicalLocatorClass(source.locatorClass), schemaVersion)),
-        };
     }
 }
 /** @deprecated Use DevinDesktopSessionAdapter; retained through the alias window. */
@@ -206,7 +177,7 @@ function parseCursor(value) {
     if (!value)
         return 0;
     if (!/^\d+$/.test(value))
-        throw new SessionContractError('SCHEMA_DRIFT', 'invalid Windsurf cursor');
+        throw new SessionContractError('SCHEMA_DRIFT', 'invalid Windsurf cursor', schemaIssueDetail('cursor'));
     return Number(value);
 }
 //# sourceMappingURL=windsurf.js.map

package/dist/src/sessions/batch-contracts.js

@@ -1,6 +1,6 @@
 import { reconcileCoveragePreflight } from './coverage-preflight.js';
-export const BATCH_IMPORT_VERSION = '1.0.0';
-export const COVERAGE_VERSION = '1.0.0';
+export const BATCH_IMPORT_VERSION = '2.0.0';
+export const COVERAGE_VERSION = '2.0.0';
 export function coverageFromBatchRun(run, now = new Date(), staleAfterMs = 24 * 60 * 60 * 1_000) {
     if (!run)
         return unknownCoverage();
@@ -9,6 +9,7 @@ export function coverageFromBatchRun(run, now = new Date(), staleAfterMs = 24 *
     ]);
     const accepted = run.sources.filter((source) => source.status === 'committed').length;
     const rejected = run.sources.filter((source) => source.status === 'rejected').length;
+    const excluded = run.sources.filter(source => source.status === 'excluded').length;
     const skipped = run.sources.filter((source) => source.status === 'skipped').length;
     const duplicated = run.sources.filter((source) => source.status === 'duplicate').length;
     const previouslyCommitted = run.sources.filter((source) => source.status === 'previously-committed').length;
@@ -20,9 +21,12 @@ export function coverageFromBatchRun(run, now = new Date(), staleAfterMs = 24 *
     const manifestAgeMs = Math.max(0, now.getTime() - Date.parse(run.manifestCreatedAt));
     const isStale = manifestAgeMs > staleAfterMs;
     const preflight = run.preflight ? reconcileCoveragePreflight(run.preflight, run.sources) : undefined;
-    const incomplete = !preflight || preflight.status !== 'complete'
-        || unavailable.length > 0 || accepted + duplicated + previouslyCommitted === 0
-        || rejected > 0 || pending > 0 || skipped > 0
+    const unresolvedProviders = preflight?.unresolvedProviders
+        ?? [...new Set([...unavailable, ...exportRequired, ...notChecked])].sort();
+    const acquisitionIncomplete = rejected > 0 || pending > 0 || skipped > 0
+        || (preflight && ['explicit', 'workspace-config'].includes(preflight.expectedProviderBasis) && unresolvedProviders.length > 0);
+    const incomplete = acquisitionIncomplete || !preflight || preflight.status !== 'complete'
+        || unavailable.length > 0 || accepted + duplicated + previouslyCommitted + excluded === 0
         || exportRequired.length > 0 || notChecked.length > 0;
     const rejectionCounts = {};
     for (const source of run.sources) {
@@ -54,7 +58,8 @@ export function coverageFromBatchRun(run, now = new Date(), staleAfterMs = 24 *
     return {
         schemaVersion: COVERAGE_VERSION,
         status: isStale ? 'stale' : incomplete ? 'partial' : 'complete',
-        acquisitionStatus: incomplete ? 'partial' : 'complete',
+        acquisitionStatus: acquisitionIncomplete ? 'partial' : 'complete',
+        unresolvedProviders,
         preflight,
         semanticReview: 'not-assessed',
         workspaceId: run.workspaceId,
@@ -67,6 +72,7 @@ export function coverageFromBatchRun(run, now = new Date(), staleAfterMs = 24 *
             discovered: run.sources.length,
             accepted,
             rejected,
+            excluded,
             skipped,
             duplicated,
             previouslyCommitted,
@@ -74,9 +80,9 @@ export function coverageFromBatchRun(run, now = new Date(), staleAfterMs = 24 *
         },
         sessionsAccepted: run.sources.reduce((sum, source) => sum + source.sessionsAccepted, 0),
         eventsAccepted: run.sources.reduce((sum, source) => sum + source.eventsAccepted, 0),
-        coverageRatio: run.sources.length === 0
+        coverageRatio: run.sources.length === excluded
             ? null
-            : (accepted + duplicated + previouslyCommitted) / run.sources.length,
+            : (accepted + duplicated + previouslyCommitted) / (run.sources.length - excluded),
         rejectionCounts,
         sourceDateRange: {
             earliest: sourceTimestamps.at(0) ?? null,
@@ -100,6 +106,7 @@ function unknownCoverage() {
         schemaVersion: COVERAGE_VERSION,
         status: 'unknown',
         acquisitionStatus: 'unknown',
+        unresolvedProviders: [],
         semanticReview: 'not-assessed',
         workspaceId: '',
         manifestId: null,
@@ -116,6 +123,7 @@ function unknownCoverage() {
             discovered: 0,
             accepted: 0,
             rejected: 0,
+            excluded: 0,
             skipped: 0,
             duplicated: 0,
             previouslyCommitted: 0,

package/dist/src/sessions/batch-import.js

@@ -1,11 +1,25 @@
-import { stat } from 'node:fs/promises';
+import { mkdtemp, rm, stat } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { createSessionAdapterRegistry } from './adapter-registry.js';
 import { coveragePreflight, sessionRuntimeIdentity } from './coverage-preflight.js';
-import { SESSION_CONTRACT_VERSION, SessionContractError, SessionSourceSchema, sha256, } from './contracts.js';
+import { SESSION_CONTRACT_VERSION, SessionContractError, schemaIssueDetail, SessionSourceSchema, sha256, stableSessionId, stableEventId, } from './contracts.js';
 import { BATCH_IMPORT_VERSION, coverageFromBatchRun, } from './batch-contracts.js';
 import { IncrementalSessionImporter, SessionImportFailure } from './importer.js';
+import { matchImportExclusion, resolveImportExclusions } from './import-exclusions.js';
+import { resolveImportLimits } from './import-limits.js';
 import { fingerprintSourceFile } from './readers.js';
+import { SessionRepository } from './repository.js';
+import { redactSessionValue, sanitizeSessionEvent } from './policy.js';
+import { deriveSessionIntent } from './origin.js';
+import { recoverCodexRolloutIdentity } from './adapters/codex.js';
 export async function importDiscoveryManifest(options) {
+    if (options.carryForward)
+        return rebuildFromCatalog(options);
+    const exclusions = resolveImportExclusions(undefined, options.exclude);
+    const limits = { ...resolveImportLimits(undefined, {
+            maxRecordBytes: options.limits?.maxRecordBytes, maxSourceBytes: options.limits?.maxTotalBytes,
+        }), ...options.limits };
     const now = options.now ?? (() => new Date());
     const runId = sha256([
         'workspace-import-v1',
@@ -17,7 +31,10 @@ export async function importDiscoveryManifest(options) {
     if (run.runId !== runId) {
         throw new SessionContractError('IMPORT_CONFLICT', 'discovery manifest is already associated with a different batch run');
     }
+    run.schemaVersion = BATCH_IMPORT_VERSION;
     run.preflight = coveragePreflight({
+        configuredProviders: options.manifest.preflight?.configuredProviders,
+        scopeWarnings: options.manifest.preflight?.scopeWarnings,
         expectedProviders: options.manifest.preflight?.expectedProviders,
         expectedProviderBasis: options.manifest.preflight?.expectedProviderBasis ?? 'legacy',
         runtime: options.runtime ?? sessionRuntimeIdentity(),
@@ -33,6 +50,12 @@ export async function importDiscoveryManifest(options) {
         if (!disposition) {
             throw new SessionContractError('IMPORT_CONFLICT', `batch run is missing discovered source ${manifestSource.sourceId}`);
         }
+        const exclusion = matchImportExclusion(manifestSource, exclusions) ?? manifestSource.exclusion;
+        if (exclusion) {
+            excludeSource(disposition, exclusion, now());
+            continue;
+        }
+        delete disposition.exclusion;
         if (isAccepted(disposition.status)) {
             disposition.status = 'previously-committed';
             disposition.updatedAt = now().toISOString();
@@ -48,6 +71,7 @@ export async function importDiscoveryManifest(options) {
         disposition.attempts += 1;
         disposition.errorCode = null;
         disposition.diagnostic = null;
+        disposition.detail = null;
         disposition.updatedAt = now().toISOString();
         persistProgress(options.repository, run, now());
         try {
@@ -62,7 +86,7 @@ export async function importDiscoveryManifest(options) {
                     allowedRoots: [manifestSource.authorizedRoot],
                 },
             };
-            const adapter = adapterFor(manifestSource.provider);
+            const adapter = adapterFor(manifestSource.provider, limits);
             const source = await sessionSource(selectedSource, adapter);
             const receipts = await new IncrementalSessionImporter(options.repository).import({
                 source,
@@ -74,6 +98,7 @@ export async function importDiscoveryManifest(options) {
                 publish: false,
                 signal: options.signal,
                 inactivityThresholdMs: options.inactivityThresholdMs,
+                limits,
             });
             await assertManifestSourceUnchanged(manifestSource);
             const totals = options.repository.sourceImportTotals(manifestSource.sourceId, run.runId);
@@ -89,10 +114,12 @@ export async function importDiscoveryManifest(options) {
         catch (error) {
             disposition.status = 'rejected';
             disposition.errorCode = importErrorCode(error);
+            disposition.detail = error instanceof SessionContractError ? error.detail ?? null : null;
             disposition.diagnostic = [
                 `provider=${manifestSource.provider}`,
                 `source=${manifestSource.sourceId}`,
                 `code=${disposition.errorCode}`,
+                ...(disposition.detail ? [`detail=${JSON.stringify(disposition.detail)}`] : []),
             ].join(' ');
         }
         disposition.updatedAt = now().toISOString();
@@ -101,14 +128,14 @@ export async function importDiscoveryManifest(options) {
     }
     const rejected = run.sources.some((source) => source.status === 'rejected');
     const pending = run.sources.some((source) => source.status === 'pending' || source.status === 'running');
-    const providerGap = coverageFromBatchRun(run, now()).acquisitionStatus !== 'complete';
+    const acquisitionIncomplete = coverageFromBatchRun(run, now()).acquisitionStatus !== 'complete';
     const publishable = run.sources
         .filter((source) => isAccepted(source.status))
         .map((source) => source.sourceId);
     injectFault(options, run, 'before-publication');
     options.repository.commitStagedBatch(run.runId, publishable);
     injectFault(options, run, 'after-publication');
-    run.status = pending ? 'interrupted' : rejected || providerGap ? 'partial' : 'complete';
+    run.status = pending ? 'interrupted' : rejected || acquisitionIncomplete ? 'partial' : 'complete';
     run.updatedAt = now().toISOString();
     run.completedAt = pending ? null : run.updatedAt;
     options.repository.saveBatchImportRun(run);
@@ -128,11 +155,23 @@ function injectFault(options, run, boundary, sourceId) {
         throw error;
     }
 }
-export function previewDiscoveryImport(manifest, existing, now = new Date()) {
+export function previewDiscoveryImport(manifest, existing, now = new Date(), exclude = []) {
     const run = existing ?? newBatchRun(manifest, sha256(['workspace-import-v1', manifest.manifestId, manifest.workspaceId].join('\0')), now);
+    const exclusions = resolveImportExclusions(undefined, exclude);
     return receiptFor({
         ...run,
+        sources: run.sources.map(source => {
+            const manifestSource = manifest.sources.find(candidate => candidate.sourceId === source.sourceId);
+            const exclusion = matchImportExclusion(manifestSource, exclusions) ?? manifestSource.exclusion;
+            if (!exclusion)
+                return source;
+            const disposition = { ...source };
+            excludeSource(disposition, exclusion, now);
+            return disposition;
+        }),
         preflight: coveragePreflight({
+            configuredProviders: manifest.preflight?.configuredProviders,
+            scopeWarnings: manifest.preflight?.scopeWarnings,
             expectedProviders: manifest.preflight?.expectedProviders,
             expectedProviderBasis: manifest.preflight?.expectedProviderBasis ?? 'legacy',
             reports: manifest.providers,
@@ -157,7 +196,8 @@ function newBatchRun(manifest, runId, now) {
         sources: manifest.sources.map((source) => ({
             sourceId: source.sourceId,
             provider: source.provider,
-            status: 'pending',
+            status: source.status ?? 'pending',
+            ...(source.exclusion ? { exclusion: source.exclusion } : {}),
             attempts: 0,
             sessionsAccepted: 0,
             eventsAccepted: 0,
@@ -173,10 +213,13 @@ function receiptFor(run, now) {
         schemaVersion: BATCH_IMPORT_VERSION,
         run,
         coverage,
+        interruptedRuns: [],
+        ...(run.carryForward ? { carryForward: run.carryForward } : {}),
         totals: {
             discovered: coverage.sources.discovered,
             accepted: coverage.sources.accepted,
             rejected: coverage.sources.rejected,
+            excluded: coverage.sources.excluded,
             skipped: coverage.sources.skipped,
             duplicated: coverage.sources.duplicated,
             previouslyCommitted: coverage.sources.previouslyCommitted,
@@ -186,6 +229,16 @@ function receiptFor(run, now) {
         },
     };
 }
+function excludeSource(source, exclusion, now) {
+    source.status = 'excluded';
+    source.exclusion = exclusion;
+    source.errorCode = null;
+    source.diagnostic = null;
+    source.detail = null;
+    source.sessionsAccepted = 0;
+    source.eventsAccepted = 0;
+    source.updatedAt = now.toISOString();
+}
 function persistProgress(repository, run, now) {
     run.updatedAt = now.toISOString();
     repository.saveBatchImportRun(run);
@@ -196,21 +249,21 @@ async function assertManifestSourceUnchanged(source) {
         details = await stat(source.locator);
     }
     catch {
-        throw new SessionContractError('SCHEMA_DRIFT', 'discovered source is no longer available; run discovery again');
+        throw new SessionContractError('SCHEMA_DRIFT', 'discovered source is no longer available; run discovery again', schemaIssueDetail('locator'));
     }
     if (details.size !== source.sizeBytes || details.mtime.toISOString() !== source.modifiedAt) {
-        throw new SessionContractError('SCHEMA_DRIFT', 'discovered source changed after manifest creation; run discovery again');
+        throw new SessionContractError('SCHEMA_DRIFT', 'discovered source changed after manifest creation; run discovery again', schemaIssueDetail(details.size !== source.sizeBytes ? 'sizeBytes' : 'modifiedAt'));
     }
     const fingerprint = await fingerprintSourceFile({
         selectedPath: source.locator,
         allowedRoots: [source.authorizedRoot],
     });
     if (fingerprint.digest !== source.digest || fingerprint.size !== source.sizeBytes) {
-        throw new SessionContractError('SCHEMA_DRIFT', 'discovered source content changed after manifest creation; run discovery again');
+        throw new SessionContractError('SCHEMA_DRIFT', 'discovered source content changed after manifest creation; run discovery again', schemaIssueDetail('digest'));
     }
 }
-function adapterFor(provider) {
-    return createSessionAdapterRegistry().get(provider);
+function adapterFor(provider, limits) {
+    return createSessionAdapterRegistry(limits).get(provider);
 }
 async function sessionSource(selected, adapter) {
     const probe = await adapter.inspect(selected);
@@ -264,4 +317,191 @@ function isAccepted(status) {
         || status === 'duplicate'
         || status === 'previously-committed';
 }
+/** Reuse source import and normalized repository gates, without copying FTS/analytics. */
+async function rebuildFromCatalog(options) {
+    const previous = options.carryForward;
+    if (previous === options.repository) {
+        throw new SessionContractError('INVALID_ARGUMENT', 'carry-forward requires a separate destination catalog');
+    }
+    const workspaceId = options.manifest.workspaceId;
+    const exclusions = resolveImportExclusions(undefined, options.exclude);
+    const byProvider = {};
+    const counts = (provider) => byProvider[provider] ??= {
+        reimported: 0, carried: 0, droppedAsDuplicate: 0, excluded: 0,
+    };
+    const oldSessions = catalogSessions(previous, workspaceId);
+    const available = [];
+    const present = new Set();
+    const excludedSources = new Set();
+    for (const source of options.manifest.sources) {
+        if (matchImportExclusion(source, exclusions) ?? source.exclusion) {
+            excludedSources.add(source.sourceId);
+            continue;
+        }
+        let details;
+        try {
+            details = await stat(source.locator);
+        }
+        catch (error) {
+            if (['ENOENT', 'ENOTDIR'].includes(error.code ?? ''))
+                continue;
+            throw error;
+        }
+        // Refresh the snapshot, but retain the explicitly saved authorization and source identity.
+        const fingerprint = await fingerprintSourceFile({ selectedPath: source.locator,
+            allowedRoots: [source.authorizedRoot] });
+        available.push({ ...source, sizeBytes: details.size, modifiedAt: details.mtime.toISOString(),
+            digest: fingerprint.digest });
+        present.add(source.sourceId);
+    }
+    const manifest = { ...options.manifest, sources: available,
+        manifestId: sha256(JSON.stringify(['carry-forward-v1', options.manifest.manifestId, available])) };
+    const stagingDirectory = await mkdtemp(join(tmpdir(), 'aiwg-session-rebuild-'));
+    let staged;
+    try {
+        staged = new SessionRepository(join(stagingDirectory, 'staging.sqlite'));
+        const receipt = await importDiscoveryManifest({ ...options, manifest, repository: staged,
+            carryForward: undefined, fault: undefined });
+        const identities = new Set();
+        const destinationCodex = new Map(catalogSessions(options.repository, workspaceId)
+            .filter(session => session.provider === 'codex').map(session => [session.nativeSessionId, session.sourceId]));
+        const transfer = (repository, sessions, category) => {
+            // A legacy Codex rollout may have split replayed parent events into phantom rows.
+            // Recover the first session_meta ID for the whole source before grouping events.
+            const sourceGroups = new Map();
+            for (const session of sessions) {
+                const group = sourceGroups.get(session.sourceId) ?? [];
+                group.push(session);
+                sourceGroups.set(session.sourceId, group);
+            }
+            for (const [sourceId, group] of sourceGroups) {
+                if (options.signal?.aborted)
+                    throw new SessionContractError('IMPORT_INTERRUPTED', 'catalog rebuild interrupted');
+                const source = repository.getSource(sourceId, workspaceId);
+                if (!source)
+                    throw new SessionContractError('IMPORT_CONFLICT', 'catalog session has no authorized source');
+                const allEvents = group.flatMap(session => repository.listEvents(session.sessionId, workspaceId))
+                    .sort((a, b) => a.sequence - b.sequence || a.eventId.localeCompare(b.eventId));
+                const rollout = source.provider === 'codex' ? recoverCodexRolloutIdentity(allEvents) : undefined;
+                const childId = rollout?.nativeSessionId;
+                // Prefer the child's aggregate when the legacy source also has phantom parent aggregates.
+                group.sort((a, b) => Number(b.nativeSessionId === childId) - Number(a.nativeSessionId === childId));
+                const canonical = new Map();
+                for (const session of group) {
+                    const nativeId = childId ?? session.nativeSessionId;
+                    const locator = options.manifest.sources.find(item => item.sourceId === sourceId)?.locator
+                        ?? source.redactedLocator;
+                    if (excludedSources.has(sourceId) || matchImportExclusion({ provider: session.provider,
+                        locator, locatorClass: source.locatorClass, nativeSessionId: nativeId }, exclusions)) {
+                        counts(session.provider).excluded++;
+                        continue;
+                    }
+                    const key = session.provider === 'codex' ? `${session.provider}\0${nativeId}` : session.sessionId;
+                    if (identities.has(key)) {
+                        counts(session.provider).droppedAsDuplicate++;
+                        continue;
+                    }
+                    const existing = canonical.get(key);
+                    if (existing) {
+                        counts(session.provider).droppedAsDuplicate++;
+                        existing.events.push(...repository.listEvents(session.sessionId, workspaceId));
+                    }
+                    else
+                        canonical.set(key, { session: { ...session, nativeSessionId: nativeId },
+                            events: repository.listEvents(session.sessionId, workspaceId) });
+                }
+                for (const [key, entry] of canonical) {
+                    if (source.provider === 'codex' && destinationCodex.has(entry.session.nativeSessionId)
+                        && destinationCodex.get(entry.session.nativeSessionId) !== sourceId) {
+                        throw new SessionContractError('IMPORT_CONFLICT', 'destination has a different source for this Codex identity; select a fresh catalog');
+                    }
+                    const session = redactSessionValue({ ...entry.session,
+                        sessionId: stableSessionId(source.provider, sourceId, entry.session.nativeSessionId),
+                    }).value;
+                    // Hash only sanitized content; receipts and IDs must never retain old plaintext.
+                    const sanitized = entry.events.map(sanitizeSessionEvent);
+                    const runId = sha256(JSON.stringify(['catalog-carry-v1', session.sessionId, sanitized]));
+                    const events = sanitized.map(event => {
+                        const digest = event.digest;
+                        return { ...event, sessionId: session.sessionId, importRunId: runId, digest,
+                            eventId: stableEventId(source.provider, sourceId, {
+                                nativeSessionId: session.nativeSessionId, nativeEventId: event.nativeId ?? event.eventId,
+                                sequence: event.sequence, kind: event.kind, text: event.searchableText,
+                                rawReference: event.rawReference,
+                            }, digest) };
+                    });
+                    if (rollout && Object.keys(rollout.lineage).length > 0) {
+                        session.extensions['native.codex'] = { lineage: rollout.lineage };
+                    }
+                    session.intent = deriveSessionIntent(events);
+                    const checkpoint = repository.getCheckpoint(sourceId, source.adapterVersion)
+                        ?? { cursor: '', recordsRead: events.length, bytesRead: Buffer.byteLength(JSON.stringify(events)) };
+                    options.repository.applyImport({ source, sessions: [session], events,
+                        run: { contractVersion: SESSION_CONTRACT_VERSION, importRunId: runId, sourceId,
+                            parserVersion: source.adapterVersion, policyVersion: '1.0.0',
+                            sourceSchemaVersion: source.sourceSchemaVersion, consistency: source.consistency,
+                            status: 'running', checkpoint, startedAt: (options.now?.() ?? new Date()).toISOString(),
+                            completedAt: null, errorCode: null } }, checkpoint);
+                    for (const old of group.filter(item => (childId ?? item.nativeSessionId) === entry.session.nativeSessionId)) {
+                        for (const tag of repository.listTags(old.sessionId, workspaceId)) {
+                            options.repository.tagSession(session.sessionId, tag, workspaceId);
+                        }
+                    }
+                    identities.add(key);
+                    counts(source.provider)[category]++;
+                }
+            }
+        };
+        const reimported = catalogSessions(staged, workspaceId);
+        transfer(staged, reimported, 'reimported');
+        for (const sourceId of present) {
+            const old = oldSessions.filter(session => session.sourceId === sourceId && session.provider === 'codex');
+            const imported = reimported.filter(session => session.sourceId === sourceId);
+            // Account for phantom rows eliminated by current source parsing, separately from copied duplicates.
+            if (imported.length > 0 && old.length > imported.length) {
+                counts('codex').droppedAsDuplicate += old.length - imported.length;
+            }
+        }
+        transfer(previous, oldSessions.filter(session => !present.has(session.sourceId)), 'carried');
+        options.repository.reindex(workspaceId);
+        const finalSessions = catalogSessions(options.repository, workspaceId);
+        const sourceIds = new Set([...receipt.run.sources.map(item => item.sourceId),
+            ...oldSessions.map(session => session.sourceId)]);
+        for (const sourceId of sourceIds) {
+            const accepted = finalSessions.filter(session => session.sourceId === sourceId);
+            let disposition = receipt.run.sources.find(item => item.sourceId === sourceId);
+            if (!disposition) {
+                const old = oldSessions.find(session => session.sourceId === sourceId);
+                const excluded = excludedSources.has(sourceId) || matchImportExclusion({
+                    provider: old.provider, nativeSessionId: old.nativeSessionId,
+                    locator: previous.getSource(sourceId, workspaceId)?.redactedLocator ?? '', locatorClass: 'catalog',
+                }, exclusions);
+                disposition = { sourceId, provider: old.provider,
+                    status: excluded ? 'excluded' : accepted.length > 0 ? 'committed' : 'duplicate',
+                    attempts: 1, sessionsAccepted: 0, eventsAccepted: 0,
+                    errorCode: null, diagnostic: null, updatedAt: receipt.run.updatedAt };
+                receipt.run.sources.push(disposition);
+            }
+            disposition.sessionsAccepted = accepted.length;
+            disposition.eventsAccepted = accepted.reduce((sum, session) => sum + options.repository.listEvents(session.sessionId, workspaceId).length, 0);
+        }
+        receipt.run.carryForward = { byProvider };
+        options.repository.saveBatchImportRun(receipt.run);
+        return redactSessionValue(receiptFor(receipt.run, options.now?.() ?? new Date())).value;
+    }
+    finally {
+        staged?.close();
+        await rm(stagingDirectory, { recursive: true, force: true });
+    }
+}
+function catalogSessions(repository, workspaceId) {
+    const sessions = [];
+    let cursor;
+    do {
+        const page = repository.listSessions({ workspaceId, limit: 500, cursor });
+        sessions.push(...page.items);
+        cursor = page.nextCursor ?? undefined;
+    } while (cursor);
+    return sessions;
+}
 //# sourceMappingURL=batch-import.js.map

package/dist/src/sessions/contracts.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { z } from 'zod';
+import { redactSessionText, redactSessionValue } from './policy.js';
 export const SESSION_CONTRACT_VERSION = '1.0.0';
 export const SESSION_PROVIDER_IDS = [
     'claude', 'codex', 'copilot', 'cursor', 'factory', 'hermes',
@@ -19,9 +20,18 @@ export const SessionRuntimeIdentitySchema = z.object({
     canonicalRoot: z.string().nullable(),
     diagnostics: z.array(z.string()),
 });
+export const SessionProviderScopeWarningSchema = z.object({
+    code: z.literal('CONFIGURED_PROVIDERS_OUTSIDE_SCOPE'),
+    configuredProviders: z.array(ExpectedSessionProviderSchema),
+    expectedProviders: z.array(ExpectedSessionProviderSchema),
+    missingProviders: z.array(ExpectedSessionProviderSchema),
+    message: z.string(),
+});
 export const SessionCoveragePreflightSchema = z.object({
     expectedProviders: z.array(ExpectedSessionProviderSchema).min(1),
-    expectedProviderBasis: z.enum(['explicit', 'declared-default', 'legacy']),
+    expectedProviderBasis: z.enum(['explicit', 'workspace-config', 'declared-default', 'legacy']),
+    configuredProviders: z.array(ExpectedSessionProviderSchema).optional(),
+    scopeWarnings: z.array(SessionProviderScopeWarningSchema).optional(),
     supportedProviders: z.array(ExpectedSessionProviderSchema),
     runtime: SessionRuntimeIdentitySchema,
     status: z.enum(['partial', 'complete']),
@@ -362,11 +372,48 @@ export function sha256(value) {
 function stableId(prefix, ...parts) {
     return `${prefix}_${createHash('sha256').update(parts.join('\0')).digest('hex')}`;
 }
+export const SessionRejectionDetailSchema = z.union([
+    z.object({ limit: z.string(), configured: z.number(), observed: z.number(),
+        setting: z.string().optional(), origin: z.enum(['flag', 'env', 'config', 'default']).optional() }),
+    z.object({ issues: z.array(z.object({ path: z.string(), code: z.string() })) }),
+]);
+export function schemaIssueDetail(path, code = 'custom') {
+    return { issues: [{ path, code }] };
+}
+export function assertSessionResourceLimit(limit, configured, observed) {
+    if (observed > configured) {
+        throw new SessionContractError('RESOURCE_LIMIT_EXCEEDED', 'session resource limit exceeded', {
+            limit, configured, observed,
+        });
+    }
+}
+/** Extract schema locations and validator codes without messages or input values. */
+export function schemaRejectionDetail(error) {
+    const issues = [];
+    const visit = (entries) => {
+        for (const issue of entries) {
+            if (issues.length >= 20)
+                return;
+            if (issue.code === 'invalid_union') {
+                for (const branch of issue.unionErrors)
+                    visit(branch.issues);
+            }
+            else {
+                issues.push({ path: issue.path.join('.') || '<root>', code: issue.code });
+            }
+        }
+    };
+    visit(error.issues);
+    return redactSessionValue({ issues }).value;
+}
 export class SessionContractError extends Error {
     code;
-    constructor(code, message) {
-        super(message);
+    detail;
+    constructor(code, message, detail) {
+        super(redactSessionText(message).text);
         this.code = code;
+        this.detail = detail;
+        this.detail = redactSessionValue(detail).value;
         this.name = 'SessionContractError';
     }
 }