@aiwg/cli 2026.10.3 → 2026.10.5

package/dist/src/sessions/workspace-discovery.js

@@ -1,17 +1,18 @@
-import { createReadStream } from 'node:fs';
-import { access, mkdir, readFile, realpath, rename, stat, writeFile, } from 'node:fs/promises';
+import { access, mkdir, readFile, readdir, realpath, rename, stat, writeFile, } from 'node:fs/promises';
 import { homedir, userInfo } from 'node:os';
 import { basename, dirname, join, resolve } from 'node:path';
-import { createInterface } from 'node:readline';
 import { inspectMuseNativeWorkspace } from './adapters/muse.js';
 import { readOmpSessionHeader } from './adapters/omp.js';
 import { grokbotConversationIdFromLocator } from './adapters/grokbot-locator.js';
 import { resolveOmpPaths } from '../providers/omp-paths.mjs';
-import { SESSION_PROVIDER_IDS, SessionCoveragePreflightSchema, SessionContractError, sha256, } from './contracts.js';
+import { readAiwgConfig } from '../config/aiwg-config.js';
+import { SessionCoveragePreflightSchema, SessionContractError, sha256, } from './contracts.js';
 import { redactSourceLocator } from './discovery.js';
 import { createSessionAdapterRegistry } from './adapter-registry.js';
-import { coveragePreflight, expectedSessionProviders } from './coverage-preflight.js';
-import { fingerprintSourceFile } from './readers.js';
+import { coveragePreflight, providerScopeWarnings, resolveSessionProviderScope } from './coverage-preflight.js';
+import { fingerprintSourceFile, streamJsonLines } from './readers.js';
+import { matchSessionWorkspace } from './workspace-matching.js';
+import { matchImportExclusion, nativeSessionIdFromLocator, resolveImportExclusions } from './import-exclusions.js';
 export const DISCOVERY_MANIFEST_VERSION = '1.0.0';
 const MANUAL_EXPORT_PROVIDERS = new Set([
     'copilot', 'hermes', 'opencode', 'openclaw', 'openhuman', 'grok-build',
@@ -19,13 +20,36 @@ const MANUAL_EXPORT_PROVIDERS = new Set([
 ]);
 export async function discoverWorkspaceHistories(options) {
     const registry = options.registry ?? createSessionAdapterRegistry();
-    const expectedProviders = expectedSessionProviders(options.expectedProviders ?? SESSION_PROVIDER_IDS);
+    const exclusions = resolveImportExclusions(undefined, options.exclude);
     const supportedProviders = new Set(registry.list().map((adapter) => adapter.provider));
     const workspacePath = await canonicalPath(options.workspace);
+    const config = await readAiwgConfig(workspacePath);
+    const configuredProviders = config?.providers ?? [];
+    const explicitlyRootedProviders = [
+        ...(options.codexRoot || options.codexRoots?.length || config?.sessions?.codex_roots?.length ? ['codex'] : []),
+        ...(options.ompRoot ? ['omp'] : []),
+        ...(options.museRoot ? ['muse'] : []),
+        ...(options.dshRoot ? ['deepseek-harness'] : []),
+        ...(options.grokbotRoot ? ['grokbot'] : []),
+    ];
+    const savedRoots = options.authorizedRoots ?? options.refreshFrom?.authorizedRoots;
+    const authorizedProviders = options.refreshFrom
+        ? Object.keys(savedRoots ?? {}).filter(provider => savedRoots?.[provider]?.length)
+        : configuredProviders.length ? explicitlyRootedProviders : undefined;
+    const providerScope = resolveSessionProviderScope(configuredProviders, options.expectedProviders, authorizedProviders);
+    if (options.refreshFrom) {
+        providerScope.scopeWarnings = providerScopeWarnings(configuredProviders, options.refreshFrom.preflight?.expectedProviders ?? []);
+    }
+    const { expectedProviders } = providerScope;
     const workspaceId = workspacePath;
+    const workspacePaths = [...new Set([workspacePath, resolve(options.workspace),
+            ...(options.workspaceAliases ?? []).map((alias) => resolve(alias))])];
+    for (const alias of workspacePaths) {
+        if (await canonicalPath(alias) !== workspacePath) {
+            throw new SessionContractError('INVALID_ARGUMENT', 'workspace alias resolves to a different workspace');
+        }
+    }
     const providerHomes = providerHomeCandidates(options.providerHome, options.operatorHome);
-    const keyWithLeadingDash = workspaceKey(workspacePath, true);
-    const keyWithoutLeadingDash = workspaceKey(workspacePath, false);
     const discoverable = [
         { provider: 'deepseek-harness', roots: options.dshRoot
                 ? [resolve(options.dshRoot)] : options.providerHome
@@ -46,26 +70,30 @@ export async function discoverWorkspaceHistories(options) {
                 ? [resolve(options.grokbotRoot)] : [] },
         {
             provider: 'claude',
-            roots: providerHomes.map((providerHome) => join(providerHome, '.claude', 'projects', keyWithLeadingDash)),
+            // Same scope rule as codex: configured providers keep their root grant
+            // even when a narrow discovery does not scan them (#3402).
+            roots: savedRoots || (!expectedProviders.includes('claude') && !providerScope.configuredProviders?.includes('claude'))
+                ? [] : await claudeDiscoveryRoots(providerHomes, workspacePaths, workspacePath, registry, exclusions),
         },
         {
             provider: 'codex',
-            roots: options.codexRoot
-                ? [resolve(options.codexRoot)]
-                : options.providerHome
-                    ? [join(resolve(options.providerHome), '.codex', 'sessions')]
-                    : [],
+            roots: savedRoots || (!expectedProviders.includes('codex') && !providerScope.configuredProviders?.includes('codex')
+                && !explicitlyRootedProviders.includes('codex'))
+                ? [] : await codexDiscoveryRoots({ ...options, codexRoots: [
+                    ...(config?.sessions?.codex_roots ?? []).map(root => resolve(workspacePath, root)),
+                    ...(options.codexRoots ?? []),
+                ] }),
         },
         {
             provider: 'cursor',
-            roots: providerHomes.map((providerHome) => join(providerHome, '.cursor', 'projects', keyWithoutLeadingDash, 'agent-transcripts')),
+            roots: providerHomes.flatMap((providerHome) => workspacePaths.map((workspace) => join(providerHome, '.cursor', 'projects', workspaceKey(workspace, false), 'agent-transcripts'))),
         },
         {
             provider: 'factory',
-            roots: providerHomes.flatMap((providerHome) => [
-                join(providerHome, '.factory', 'projects', keyWithLeadingDash),
-                join(providerHome, '.factory', 'sessions', keyWithLeadingDash),
-            ]),
+            roots: providerHomes.flatMap((providerHome) => workspacePaths.flatMap((workspace) => [
+                join(providerHome, '.factory', 'projects', workspaceKey(workspace, true)),
+                join(providerHome, '.factory', 'sessions', workspaceKey(workspace, true)),
+            ])),
         },
         {
             // Pi stores every working directory's sessions in its own
@@ -79,22 +107,52 @@ export async function discoverWorkspaceHistories(options) {
             provider: 'pi',
             roots: (process.env.PI_CODING_AGENT_SESSION_DIR
                 ? [resolve(process.env.PI_CODING_AGENT_SESSION_DIR)]
-                : providerHomes.map((providerHome) => join(providerHome, '.pi', 'agent', 'sessions'))).map((sessionsRoot) => join(sessionsRoot, `--${keyWithoutLeadingDash}--`)),
+                : providerHomes.map((providerHome) => join(providerHome, '.pi', 'agent', 'sessions'))).flatMap((sessionsRoot) => workspacePaths.map((workspace) => join(sessionsRoot, `--${workspaceKey(workspace, false)}--`))),
         },
     ];
+    const authorizedRoots = { ...savedRoots };
     const reports = new Map();
     const candidates = [];
     const seen = new Set();
     for (const entry of discoverable) {
+        // A hand-run narrow scope must not discard explicit root grants, including
+        // configured providers under an authorized home. Do not scan their histories.
+        if (!savedRoots && !expectedProviders.includes(entry.provider)
+            && (explicitlyRootedProviders.includes(entry.provider)
+                || (providerScope.configuredProviders?.includes(entry.provider) && options.providerHome))) {
+            const roots = [];
+            for (const root of entry.roots)
+                if (await pathExists(root))
+                    roots.push(await canonicalPath(root));
+            authorizedRoots[entry.provider] = [...new Set(roots)];
+        }
         if (!expectedProviders.includes(entry.provider) || !supportedProviders.has(entry.provider))
             continue;
         const adapter = registry.get(entry.provider);
         if (adapter.disposition === 'unsupported' || !adapter.supportedOperations.includes('discover'))
             continue;
         const availableRoots = [];
-        for (const root of entry.roots) {
-            if (await pathExists(root))
-                availableRoots.push(await canonicalPath(root));
+        const rootCounts = new Map();
+        for (const root of savedRoots ? savedRoots[entry.provider] ?? [] : entry.roots) {
+            if (await pathExists(root)) {
+                const canonical = await canonicalPath(root);
+                if (savedRoots && canonical !== root) {
+                    throw new SessionContractError('INVALID_ARGUMENT', 'previously authorized provider root changed; rediscover with explicit authorization');
+                }
+                if (!availableRoots.includes(canonical)) {
+                    availableRoots.push(canonical);
+                    rootCounts.set(canonical, {
+                        root: redactSourceLocator(canonical), rootId: sha256(canonical),
+                        status: 'checked', sourceCount: 0, duplicateCount: 0,
+                    });
+                }
+            }
+            else {
+                rootCounts.set(root, {
+                    root: redactSourceLocator(root), rootId: sha256(root),
+                    status: 'unavailable', sourceCount: 0, duplicateCount: 0,
+                });
+            }
         }
         if (availableRoots.length === 0) {
             const codexNeedsAuthorization = (entry.provider === 'codex' || entry.provider === 'omp'
@@ -106,15 +164,44 @@ export async function discoverWorkspaceHistories(options) {
                 : 'PROVIDER_ROOT_UNAVAILABLE', codexNeedsAuthorization
                 ? `Pass --${entry.provider === 'deepseek-harness' ? 'dsh' : entry.provider}-root with an explicitly authorized sessions root.`
                 : `No authorized ${entry.provider} workspace history root was found.`));
+            if (entry.provider === 'codex')
+                reports.get(entry.provider).rootCounts = [...rootCounts.values()];
             continue;
         }
+        authorizedRoots[entry.provider] = availableRoots;
         const scope = {
             workspaceId,
             allowedRoots: availableRoots,
         };
         const providerSources = [];
+        let matchedBySubfolder = 0;
+        let matchedByWorktree = 0;
         const museSourceInspections = [];
         for await (const descriptor of adapter.discover(scope)) {
+            const known = options.knownSources?.find(source => source.provider === descriptor.provider && source.locator === descriptor.locator);
+            const nativeSessionId = known?.nativeSessionId ?? descriptor.nativeSessionId ?? nativeSessionIdFromLocator(descriptor);
+            const exclusion = matchImportExclusion({ ...descriptor, nativeSessionId }, exclusions);
+            if (exclusion) {
+                const locator = resolve(descriptor.locator);
+                const authorizedRoot = scope.allowedRoots.find(root => locator === root || locator.startsWith(`${root}/`));
+                if (!authorizedRoot)
+                    continue;
+                const key = `excluded\0${entry.provider}\0${locator}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                const source = {
+                    sourceId: known?.sourceId ?? sha256(key), provider: entry.provider,
+                    locator, redactedLocator: redactSourceLocator(locator), locatorClass: descriptor.locatorClass,
+                    authorizedRoot, modifiedAt: '', sizeBytes: 0, digest: '', nativeSessionId,
+                    status: 'excluded', exclusion,
+                };
+                rootCounts.get(authorizedRoot).sourceCount += 1;
+                providerSources.push(source);
+                candidates.push(source);
+                continue;
+            }
+            let workspaceMatch = null;
             if (entry.provider === 'muse') {
                 const inspection = await inspectMuseNativeWorkspace({
                     ...descriptor,
@@ -124,31 +211,57 @@ export async function discoverWorkspaceHistories(options) {
                 museSourceInspections.push({
                     sourceKey: sha256(['muse-workspace-inspection-v1', descriptor.locator].join('\0')),
                     redactedLocator: redactSourceLocator(descriptor.locator),
+                    nativeSessionId: basename(dirname(descriptor.locator)),
                     ...inspection,
                 });
                 if (inspection.outcome !== 'matched')
                     continue;
+                workspaceMatch = inspection.matchKind ?? null;
             }
             const locator = await canonicalPath(descriptor.locator);
-            if (entry.provider === 'codex'
-                && !await codexSourceMatchesWorkspace(locator, workspacePath))
-                continue;
+            if (entry.provider === 'codex') {
+                workspaceMatch = await codexSourceWorkspaceMatch(locator, workspacePath);
+                if (!workspaceMatch)
+                    continue;
+            }
             const ompHeader = entry.provider === 'omp' ? await readOmpSessionHeader({ ...descriptor, sourceId: 'discovery', authorizedScope: scope }) : undefined;
-            if (ompHeader && resolve(ompHeader.cwd) !== workspacePath)
-                continue;
+            if (ompHeader) {
+                workspaceMatch = await matchSessionWorkspace(ompHeader.cwd, workspacePath);
+                if (!workspaceMatch)
+                    continue;
+            }
             const details = await stat(locator);
             const authorizedRoot = scope.allowedRoots.find((root) => locator === root || locator.startsWith(`${root}/`));
             if (!authorizedRoot)
                 continue;
+            if (entry.provider === 'claude') {
+                const exactProject = workspacePaths.some(path => basename(authorizedRoot) === claudeProjectKey(path));
+                workspaceMatch = await claudeSourceWorkspaceMatch(locator, workspacePath, exactProject);
+                if (!workspaceMatch)
+                    continue;
+            }
             const fingerprint = await fingerprintSourceFile({
                 selectedPath: locator,
                 allowedRoots: [authorizedRoot],
             });
-            const dedupeKey = `${entry.provider}\0${fingerprint.digest}\0${fingerprint.size}`;
-            if (seen.has(dedupeKey))
+            const rolloutId = entry.provider === 'codex' && descriptor.locatorClass === 'codex-rollout-jsonl'
+                ? await codexRolloutId(locator) : undefined;
+            const dedupeKey = rolloutId
+                ? `codex\0rollout\0${rolloutId}`
+                : `${entry.provider}\0${fingerprint.digest}\0${fingerprint.size}`;
+            const rootCount = rootCounts.get(authorizedRoot);
+            if (seen.has(dedupeKey)) {
+                rootCount.duplicateCount += 1;
                 continue;
+            }
             seen.add(dedupeKey);
+            if (workspaceMatch === 'subfolder')
+                matchedBySubfolder += 1;
+            if (workspaceMatch === 'worktree')
+                matchedByWorktree += 1;
+            rootCount.sourceCount += 1;
             const source = sourceFromDescriptor(descriptor, locator, authorizedRoot, details, fingerprint.digest);
+            source.nativeSessionId = rolloutId ?? ompHeader?.id ?? nativeSessionId;
             if (ompHeader)
                 source.sourceId = sha256(['omp-native-source-v1', workspaceId, ompHeader.id].join('\0'));
             if (entry.provider === 'grokbot') {
@@ -168,13 +281,17 @@ export async function discoverWorkspaceHistories(options) {
         const incompleteMuseInspection = museSourceInspections.some((inspection) => inspection.outcome === 'inconclusive');
         const report = providerReport(entry.provider, incompleteMuseInspection ? 'not-checked' : 'checked', 'discoverable', providerSources, incompleteMuseInspection ? 'MUSE_SOURCE_INSPECTION_INCOMPLETE'
             : providerSources.length === 0 ? 'NO_WORKSPACE_SOURCES' : null, incompleteMuseInspection
-            ? 'Review museSourceInspections; authorize a supported Muse export for unresolved sources before claiming workspace coverage.'
+            ? 'Review unattributed museSourceInspections and their limit name/value; authorize a supported Muse export for unresolved sources before claiming workspace coverage.'
             : providerSources.length === 0
                 ? `The ${entry.provider} root was checked, but no source matched the authorized workspace.`
                 : null);
         if (entry.provider === 'muse') {
             report.museSourceInspections = museSourceInspections.sort((a, b) => a.sourceKey.localeCompare(b.sourceKey));
         }
+        report.matchedBySubfolder = matchedBySubfolder;
+        report.matchedByWorktree = matchedByWorktree;
+        if (entry.provider === 'codex')
+            report.rootCounts = [...rootCounts.values()];
         reports.set(entry.provider, report);
     }
     for (const provider of expectedProviders) {
@@ -196,13 +313,14 @@ export async function discoverWorkspaceHistories(options) {
     const sources = candidates.sort(compareSources);
     const providers = [...reports.values()].sort((a, b) => a.provider.localeCompare(b.provider));
     const preflight = coveragePreflight({
-        expectedProviders, expectedProviderBasis: options.expectedProviders ? 'explicit' : 'declared-default',
+        ...providerScope,
         registry, runtime: options.runtime, reports: providers,
     });
     const identity = {
         schemaVersion: DISCOVERY_MANIFEST_VERSION,
         workspaceId,
         preflight,
+        authorizedRoots,
         sources: sources.map((source) => ({
             sourceId: source.sourceId,
             provider: source.provider,
@@ -211,11 +329,16 @@ export async function discoverWorkspaceHistories(options) {
             modifiedAt: source.modifiedAt,
             sizeBytes: source.sizeBytes,
             digest: source.digest,
+            ...(source.nativeSessionId ? { nativeSessionId: source.nativeSessionId } : {}),
+            ...(source.status ? { status: source.status, exclusion: source.exclusion } : {}),
         })),
         providers: providers.map((provider) => ({
             provider: provider.provider,
             status: provider.status,
             reasonCode: provider.reasonCode,
+            ...(provider.matchedBySubfolder !== undefined ? { matchedBySubfolder: provider.matchedBySubfolder } : {}),
+            ...(provider.matchedByWorktree !== undefined ? { matchedByWorktree: provider.matchedByWorktree } : {}),
+            ...(provider.rootCounts ? { rootCounts: provider.rootCounts } : {}),
             ...(provider.museSourceInspections ? { museSourceInspections: provider.museSourceInspections } : {}),
         })),
     };
@@ -226,6 +349,7 @@ export async function discoverWorkspaceHistories(options) {
         workspaceId,
         workspacePath,
         preflight,
+        authorizedRoots,
         providers,
         sources,
     };
@@ -272,6 +396,9 @@ export function publicDiscoveryManifest(manifest) {
         totals: {
             providers: manifest.providers.length,
             sources: manifest.sources.length,
+            excluded: manifest.sources.filter(source => source.status === 'excluded').length,
+            matchedBySubfolder: manifest.providers.reduce((sum, provider) => sum + (provider.matchedBySubfolder ?? 0), 0),
+            matchedByWorktree: manifest.providers.reduce((sum, provider) => sum + (provider.matchedByWorktree ?? 0), 0),
         },
     };
 }
@@ -291,12 +418,14 @@ function sourceFromDescriptor(descriptor, locator, authorizedRoot, details, dige
     };
 }
 function providerReport(provider, status, disposition, sources, reasonCode, remediation) {
-    const timestamps = sources.map((source) => source.modifiedAt).sort();
+    const timestamps = sources.map((source) => source.modifiedAt).filter(Boolean).sort();
     return {
         provider,
         status,
         disposition,
         sourceCount: sources.length,
+        matchedBySubfolder: 0,
+        matchedByWorktree: 0,
         dateRange: {
             earliest: timestamps.at(0) ?? null,
             latest: timestamps.at(-1) ?? null,
@@ -311,6 +440,7 @@ async function rediscoverManifestIdentity(manifest) {
         schemaVersion: manifest.schemaVersion,
         workspaceId: manifest.workspaceId,
         ...(manifest.preflight ? { preflight: manifest.preflight } : {}),
+        ...(manifest.authorizedRoots ? { authorizedRoots: manifest.authorizedRoots } : {}),
         sources: manifest.sources.map((source) => ({
             sourceId: source.sourceId,
             provider: source.provider,
@@ -319,47 +449,84 @@ async function rediscoverManifestIdentity(manifest) {
             modifiedAt: source.modifiedAt,
             sizeBytes: source.sizeBytes,
             digest: source.digest,
+            ...(source.nativeSessionId ? { nativeSessionId: source.nativeSessionId } : {}),
+            ...(source.status ? { status: source.status, exclusion: source.exclusion } : {}),
         })),
         providers: manifest.providers.map((provider) => ({
             provider: provider.provider,
             status: provider.status,
             reasonCode: provider.reasonCode,
+            ...(provider.matchedBySubfolder !== undefined ? { matchedBySubfolder: provider.matchedBySubfolder } : {}),
+            ...(provider.matchedByWorktree !== undefined ? { matchedByWorktree: provider.matchedByWorktree } : {}),
+            ...(provider.rootCounts ? { rootCounts: provider.rootCounts } : {}),
             ...(provider.museSourceInspections ? { museSourceInspections: provider.museSourceInspections } : {}),
         })),
     };
     return sha256(JSON.stringify(identity));
 }
-async function codexSourceMatchesWorkspace(locator, workspacePath) {
-    const input = createReadStream(locator, { encoding: 'utf8' });
-    const lines = createInterface({ input, crlfDelay: Infinity });
-    let count = 0;
+async function codexDiscoveryRoots(options) {
+    const explicit = [...(options.codexRoots ?? []), ...(options.codexRoot ? [options.codexRoot] : [])];
+    if (explicit.length > 0)
+        return [...new Set(explicit.map((root) => resolve(root)))];
+    // Shared stores require the same explicit provider-home authorization as the default root.
+    if (!options.providerHome)
+        return [];
+    const codexHome = join(resolve(options.providerHome), '.codex');
+    const roots = [join(codexHome, 'sessions')];
+    if (process.env.CODEX_HOME)
+        roots.push(resolve(process.env.CODEX_HOME, 'sessions'));
     try {
-        for await (const line of lines) {
-            if (++count > 50)
-                break;
-            let value;
-            try {
-                value = JSON.parse(line);
-            }
-            catch {
-                continue;
-            }
-            const cwd = codexWorkspaceField(value);
-            if (!cwd)
-                continue;
-            try {
-                return await canonicalPath(cwd) === workspacePath;
-            }
-            catch {
-                return resolve(cwd) === workspacePath;
+        const roles = await readdir(join(codexHome, 'roles-runtime'), { withFileTypes: true });
+        for (const role of roles.sort((a, b) => a.name.localeCompare(b.name))) {
+            if (role.isDirectory() || role.isSymbolicLink()) {
+                roots.push(join(codexHome, 'roles-runtime', role.name, '.codex', 'sessions'));
             }
         }
-        return false;
     }
-    finally {
-        lines.close();
-        input.destroy();
+    catch (error) {
+        if (!['ENOENT', 'ENOTDIR'].includes(error.code ?? ''))
+            throw error;
     }
+    return [...new Set(roots)];
+}
+async function codexRolloutId(locator) {
+    let count = 0;
+    for await (const { line } of streamJsonLines(locator)) {
+        if (++count > 50)
+            break;
+        let value;
+        try {
+            value = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const record = asObject(value);
+        const id = asObject(record.payload).id;
+        if (record.type === 'session_meta' && typeof id === 'string' && id.length > 0)
+            return id;
+    }
+    return /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/i
+        .exec(basename(locator))?.[1];
+}
+async function codexSourceWorkspaceMatch(locator, workspacePath) {
+    let count = 0;
+    for await (const { line } of streamJsonLines(locator)) {
+        if (++count > 50)
+            break;
+        let value;
+        try {
+            value = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const cwd = codexWorkspaceField(value);
+        if (!cwd)
+            continue;
+        return await matchSessionWorkspace(cwd, workspacePath);
+    }
+    return null;
 }
 function codexWorkspaceField(value) {
     const root = asObject(value);
@@ -384,6 +551,71 @@ function asObject(value) {
 async function canonicalPath(path) {
     return realpath(resolve(path));
 }
+/** Claude keys are lossy: use transcript cwd, never decode hyphens into paths. */
+async function claudeDiscoveryRoots(homes, paths, workspace, registry, exclusions) {
+    const roots = homes.flatMap(home => paths.map(path => join(home, '.claude', 'projects', claudeProjectKey(path))));
+    const adapter = registry.get('claude');
+    for (const home of homes) {
+        const projects = join(home, '.claude', 'projects');
+        let entries;
+        try {
+            entries = await readdir(projects, { withFileTypes: true });
+        }
+        catch (error) {
+            if (['ENOENT', 'ENOTDIR'].includes(error.code ?? ''))
+                continue;
+            throw error;
+        }
+        for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+            if (!entry.isDirectory())
+                continue;
+            const root = join(projects, entry.name);
+            if (roots.includes(root))
+                continue;
+            for await (const descriptor of adapter.discover({ workspaceId: workspace, allowedRoots: [root] })) {
+                if (matchImportExclusion(descriptor, exclusions))
+                    continue;
+                if (await claudeSourceWorkspaceMatch(descriptor.locator, workspace, false)) {
+                    roots.push(root);
+                    break;
+                }
+            }
+        }
+    }
+    return [...new Set(roots)];
+}
+async function claudeSourceWorkspaceMatch(locator, workspacePath, exactProject) {
+    let count = 0;
+    for await (const { line } of streamJsonLines(locator, { end: 1024 * 1024 - 1 })) {
+        if (++count > 50)
+            break;
+        let value;
+        try {
+            value = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const cwd = asObject(value).cwd;
+        if (typeof cwd !== 'string' || cwd.length === 0)
+            continue;
+        return matchSessionWorkspace(cwd, workspacePath);
+    }
+    // Only exact project keys can establish ownership without cwd.
+    return exactProject ? 'exact' : null;
+}
+export function claudeProjectKey(path) {
+    // Claude Code 2.1.302 replaces each character, then caps keys at 200
+    // characters with a base-36 suffix from the original path's 32-bit hash.
+    const key = path.replace(/[^A-Za-z0-9-]/g, '-');
+    if (key.length <= 200)
+        return key;
+    let hash = 0;
+    for (let index = 0; index < path.length; index += 1) {
+        hash = ((hash << 5) - hash + path.charCodeAt(index)) | 0;
+    }
+    return `${key.slice(0, 200)}-${Math.abs(hash).toString(36)}`;
+}
 function workspaceKey(path, retainLeadingSeparator) {
     const normalized = path.replace(/\\/g, '/');
     const input = retainLeadingSeparator ? normalized : normalized.replace(/^\/+/, '');

package/dist/src/sessions/workspace-matching.js

@@ -0,0 +1,107 @@
+import { lstat, readFile, realpath, stat } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+export const WORKSPACE_MATCH_KINDS = ['exact', 'subfolder', 'worktree'];
+/** A nested catalog owns its subtree, even when discovery runs one workspace at a time. */
+export async function matchSessionWorkspace(cwd, workspace) {
+    try {
+        const { path: candidate, missing } = await resolveCandidate(resolve(cwd));
+        const workspacePath = await realpath(resolve(workspace));
+        const direct = encloses(workspacePath, candidate);
+        if (missing && !direct)
+            return null;
+        const physicalCatalog = await nearestCatalogBetween(candidate, direct ? workspacePath : undefined);
+        if (physicalCatalog && !encloses(physicalCatalog, workspacePath))
+            return null;
+        const mainRepository = await worktreeMainRepository(candidate).catch(() => null);
+        // A worktree also belongs to a deeper catalog around its main repository,
+        // including when both paths sit beneath the workspace being discovered.
+        if (mainRepository && encloses(workspacePath, mainRepository)
+            && await nearestCatalogBetween(mainRepository, workspacePath))
+            return null;
+        if (direct)
+            return candidate === workspacePath ? 'exact' : 'subfolder';
+        if (!mainRepository || !encloses(workspacePath, mainRepository))
+            return null;
+        return 'worktree';
+    }
+    catch {
+        // Unresolved paths or Git metadata cannot establish workspace ownership.
+        return null;
+    }
+}
+async function resolveCandidate(path) {
+    let ancestor = path;
+    const suffix = [];
+    for (;;) {
+        try {
+            // Stop at symlinks too, so realpath rejects dangling links below.
+            await lstat(ancestor);
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            const parent = dirname(ancestor);
+            if (parent === ancestor)
+                throw error;
+            suffix.unshift(basename(ancestor));
+            ancestor = parent;
+        }
+    }
+    return { path: join(await realpath(ancestor), ...suffix), missing: suffix.length > 0 };
+}
+function encloses(parent, child) {
+    const suffix = relative(parent, child);
+    return suffix === '' || (!isAbsolute(suffix) && suffix !== '..' && !suffix.startsWith(`..${sep}`));
+}
+async function nearestCatalogBetween(candidate, stop) {
+    for (let directory = candidate; directory !== stop; directory = dirname(directory)) {
+        const catalog = await statIfPresent(join(directory, '.aiwg', 'sessions'));
+        if (catalog?.isDirectory())
+            return directory;
+        if (directory === dirname(directory))
+            break;
+    }
+    return null;
+}
+async function worktreeMainRepository(candidate) {
+    for (let directory = candidate;; directory = dirname(directory)) {
+        const marker = join(directory, '.git');
+        const details = await statIfPresent(marker);
+        if (details) {
+            // Stop at the nearest repository; a normal repository or submodule
+            // must not inherit an outer worktree's ownership.
+            if (!details.isFile())
+                return null;
+            const gitfile = /^gitdir: (.+)\s*$/.exec((await readFile(marker, 'utf8')).trim());
+            if (!gitfile)
+                return null;
+            const gitdir = await realpath(resolve(directory, gitfile[1].trim()));
+            const common = (await readFile(join(gitdir, 'commondir'), 'utf8')).trim();
+            if (!common)
+                return null;
+            const commonDir = await realpath(resolve(gitdir, common));
+            const backlink = (await readFile(join(gitdir, 'gitdir'), 'utf8')).trim();
+            if (!backlink || await realpath(resolve(gitdir, backlink)) !== await realpath(marker))
+                return null;
+            // Standard linked worktrees share the main repository's .git directory.
+            if (basename(commonDir) !== '.git' || commonDir === gitdir)
+                return null;
+            const mainRepository = dirname(commonDir);
+            return await realpath(join(mainRepository, '.git')) === commonDir ? mainRepository : null;
+        }
+        if (directory === dirname(directory))
+            return null;
+    }
+}
+async function statIfPresent(path) {
+    try {
+        return await stat(path);
+    }
+    catch (error) {
+        if (['ENOENT', 'ENOTDIR'].includes(error.code ?? ''))
+            return null;
+        throw error;
+    }
+}
+//# sourceMappingURL=workspace-matching.js.map

package/dist/src/skills/importer.js

@@ -178,6 +178,7 @@ function runGit(args, options = {}) {
         maxBuffer: options.maxBuffer ?? 16 * 1024 * 1024,
         stdio: ['ignore', 'pipe', 'pipe'],
         timeout: 120_000,
+        killSignal: 'SIGKILL',
     });
     if (result.error) {
         if (result.error.code === 'ETIMEDOUT') {