@caddis/cli 0.3.0 → 0.4.1

package/dist/cli.js

@@ -3764,8 +3764,11 @@ function packageInfo() {
   cached = { root, name: parsed.name, version: parsed.version };
   return cached;
 }
-function bundlePath(name) {
+function bundlePath(name, options = {}) {
+  const { requireManifest = true } = options;
   const dir = path.join(packageInfo().root, "bundles", name);
+  if (!existsSync(dir)) return null;
+  if (!requireManifest) return dir;
   return existsSync(path.join(dir, "plugin.json")) ? dir : null;
 }
 function bundleManifest() {
@@ -4605,14 +4608,14 @@ async function checkCliUpdate(currentVersion) {
   if (!latest || latest === currentVersion) return null;
   return { current: currentVersion, latest };
 }
-function classify(adapter, detection, status4, poolVersion) {
+function classify(adapter, detection, status5, poolVersion) {
   if (!detection.present) return "absent";
   if (!adapter.supported) return "unsupported";
-  if (!status4.installed) return "missing";
-  if (!status4.version) return "unknown";
+  if (!status5.installed) return "missing";
+  if (!status5.version) return "unknown";
   if (poolVersion === "unknown") return "unknown";
-  const order = compareVersions(status4.version, poolVersion);
-  if (order === null) return status4.version === poolVersion ? "current" : "stale";
+  const order = compareVersions(status5.version, poolVersion);
+  if (order === null) return status5.version === poolVersion ? "current" : "stale";
   if (order === 0) return "current";
   return order > 0 ? "ahead" : "stale";
 }
@@ -4625,13 +4628,13 @@ async function gather(adapters, options = {}) {
     Promise.all(
       adapters.map(async (adapter) => {
         const detection = await adapter.detect();
-        const status4 = detection.present ? await adapter.status() : { installed: false, note: "agent not installed" };
+        const status5 = detection.present ? await adapter.status() : { installed: false, note: "agent not installed" };
         return {
           adapter,
           detection,
-          status: status4,
-          drift: classify(adapter, detection, status4, poolVersion),
-          extrasDrift: classifyExtras(adapter, detection, status4, extrasVersion)
+          status: status5,
+          drift: classify(adapter, detection, status5, poolVersion),
+          extrasDrift: classifyExtras(adapter, detection, status5, extrasVersion)
         };
       })
     ),
@@ -4639,14 +4642,14 @@ async function gather(adapters, options = {}) {
   ]);
   return { cliVersion, poolVersion, extrasVersion, agents, cliUpdate: cliUpdate ?? void 0 };
 }
-function classifyExtras(adapter, detection, status4, extrasVersion) {
-  if (!status4.extras) return void 0;
+function classifyExtras(adapter, detection, status5, extrasVersion) {
+  if (!status5.extras) return void 0;
   if (!detection.present) return "absent";
   if (!adapter.supported) return "unsupported";
-  if (!status4.extras.installed) return "missing";
-  if (!status4.extras.version || !extrasVersion) return "unknown";
-  const order = compareVersions(status4.extras.version, extrasVersion);
-  if (order === null) return status4.extras.version === extrasVersion ? "current" : "stale";
+  if (!status5.extras.installed) return "missing";
+  if (!status5.extras.version || !extrasVersion) return "unknown";
+  const order = compareVersions(status5.extras.version, extrasVersion);
+  if (order === null) return status5.extras.version === extrasVersion ? "current" : "stale";
   if (order === 0) return "current";
   return order > 0 ? "ahead" : "stale";
 }
@@ -4734,7 +4737,7 @@ var init_init = __esm({
 });
 
 // src/providers/resolve.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { homedir } from "os";
 import { isAbsolute, join } from "path";
 function expandHome(p2) {
@@ -4750,7 +4753,7 @@ function keysFilePath(env) {
 function parseKeysFile(path5) {
   let text;
   try {
-    text = readFileSync3(path5, "utf8");
+    text = readFileSync4(path5, "utf8");
   } catch {
     return {};
   }
@@ -4779,12 +4782,12 @@ var init_resolve = __esm({
     PROVIDERS = {
       deepseek: {
         baseUrl: "https://api.deepseek.com/anthropic",
-        model: "deepseek-v4-flash",
+        model: "deepseek-v4-flash[1m]",
         keyEnv: "DEEPSEEK_API_KEY"
       },
       glm: {
         baseUrl: "https://api.z.ai/api/anthropic",
-        model: "glm-5.2",
+        model: "glm-5.3[1m]",
         keyEnv: "GLM_API_KEY"
       },
       // OpenRouter has no Anthropic-protocol endpoint. It works only through an
@@ -4808,7 +4811,7 @@ __export(keys_exports, {
   probeKey: () => probeKey,
   upsertKeyLines: () => upsertKeyLines
 });
-import { chmodSync, mkdirSync, readFileSync as readFileSync4, writeFileSync } from "fs";
+import { chmodSync, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
 import { dirname } from "path";
 async function probeKey(baseUrl, model, apiKey) {
   if (!baseUrl) return { ok: false, rejected: false, detail: "no endpoint for this provider" };
@@ -4969,12 +4972,12 @@ async function keys(options = {}) {
   }
   let existing = "";
   try {
-    existing = readFileSync4(path5, "utf8");
+    existing = readFileSync5(path5, "utf8");
   } catch {
     existing = "";
   }
-  mkdirSync(dirname(path5), { recursive: true });
-  writeFileSync(path5, upsertKeyLines(existing, collected), { encoding: "utf8" });
+  mkdirSync2(dirname(path5), { recursive: true });
+  writeFileSync2(path5, upsertKeyLines(existing, collected), { encoding: "utf8" });
   const permWarning = restrictPermissions(path5);
   process.stdout.write(`
   wrote ${Object.keys(collected).join(", ")} to ${path5}
@@ -5104,13 +5107,13 @@ function renderEnvironment(report, problems) {
 function renderAgents(report, problems) {
   heading("Agents");
   for (const entry of report.agents) {
-    const { adapter, detection, status: status4 } = entry;
+    const { adapter, detection, status: status5 } = entry;
     item(markFor(entry.drift), `${color.bold(adapter.name)} \u2014 ${describe(entry, report.poolVersion)}`);
     if (detection.path) detail(detection.path);
     if (detection.agentVersion) detail(`agent version ${detection.agentVersion}`);
-    if (status4.source) detail(`read from ${status4.source}`);
-    if (status4.note) detail(status4.note);
-    if (detection.note && detection.note !== status4.note) detail(detection.note);
+    if (status5.source) detail(`read from ${status5.source}`);
+    if (status5.note) detail(status5.note);
+    if (detection.note && detection.note !== status5.note) detail(detection.note);
     if (entry.extrasDrift) detail(describeExtras(entry, report.extrasVersion));
     const problem = problemFor(entry, report.poolVersion);
     if (problem) {
@@ -5322,9 +5325,9 @@ var init_table = __esm({
 // src/commands/status.ts
 var status_exports = {};
 __export(status_exports, {
-  status: () => status3
+  status: () => status4
 });
-async function status3(options) {
+async function status4(options) {
   const report = await gather(options.adapters);
   if (options.json) {
     line(JSON.stringify(toJson2(report), null, 2));
@@ -5457,8 +5460,8 @@ function parsePluginList(stdout, plugin = PLUGIN) {
       if (version?.[1] && entry.version === void 0) {
         entry.version = version[1] === "unknown" ? void 0 : version[1];
       }
-      const status4 = line2.match(/^\s*Status\s*:\s*(.+?)\s*$/i);
-      if (status4?.[1]) entry.disabled = /disabled/i.test(status4[1]);
+      const status5 = line2.match(/^\s*Status\s*:\s*(.+?)\s*$/i);
+      if (status5?.[1]) entry.disabled = /disabled/i.test(status5[1]);
     }
     return entry;
   }
@@ -5735,32 +5738,170 @@ var agyAdapter = {
 };
 
 // src/agents/codex.ts
+init_exec();
+import { cpSync as cpSync2, existsSync as existsSync3, mkdirSync, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync } from "fs";
 import os2 from "os";
 import path3 from "path";
+init_pkg();
+var BIN3 = "codex";
+var BUNDLE2 = "codex";
+function caddisSkillsDir(home = os2.homedir()) {
+  return path3.join(home, ".codex", "skills", "caddis");
+}
+function versionFile(home = os2.homedir()) {
+  return path3.join(caddisSkillsDir(home), ".caddis-version");
+}
+async function detect3() {
+  const binPath = await findBin(BIN3);
+  if (!binPath) {
+    const configDir = path3.join(os2.homedir(), ".codex");
+    if (existsSync3(configDir)) {
+      return { present: false, path: configDir, note: "no `codex` binary on PATH, but ~/.codex exists" };
+    }
+    return { present: false, note: "no `codex` binary on PATH" };
+  }
+  const version = await run(BIN3, ["--version"], { timeout: 2e4 });
+  return {
+    present: true,
+    path: binPath,
+    // `codex --version` prints "codex-cli 0.150.1"; take the trailing token.
+    agentVersion: version.ok ? version.stdout.trim().split(/\s+/).pop() || void 0 : void 0,
+    note: version.ok ? void 0 : "binary found but `codex --version` failed"
+  };
+}
+function shortenHome2(target) {
+  const home = os2.homedir();
+  return target.startsWith(home) ? path3.join("~", target.slice(home.length)) : target;
+}
+function statusFromHome2(home) {
+  const marker = versionFile(home);
+  const dir = caddisSkillsDir(home);
+  if (existsSync3(marker)) {
+    try {
+      const version = readFileSync3(marker, "utf8").trim();
+      if (version) return { installed: true, version, source: shortenHome2(marker) };
+    } catch {
+    }
+    return { installed: true, source: shortenHome2(marker), note: "version marker present but unreadable" };
+  }
+  if (existsSync3(dir)) {
+    return {
+      installed: true,
+      source: shortenHome2(dir),
+      note: "skills present but no version marker \u2014 installed by hand, or by a caddis older than this one"
+    };
+  }
+  return { installed: false, source: shortenHome2(dir), note: "caddis skills not installed into codex" };
+}
+async function status3() {
+  const detected = await detect3();
+  if (!detected.present) return { installed: false, note: "agent not installed" };
+  return statusFromHome2(os2.homedir());
+}
+async function drive3(action, options) {
+  const detected = await detect3();
+  if (!detected.present) {
+    return { ok: true, skipped: true, steps: [], message: "codex not installed \u2014 skipped" };
+  }
+  const bundle = bundlePath(BUNDLE2, { requireManifest: false });
+  if (!bundle) {
+    return {
+      ok: false,
+      skipped: false,
+      steps: [],
+      message: `the ${BUNDLE2} bundle is missing from this package \u2014 reinstall @caddis/cli`
+    };
+  }
+  const source = path3.join(bundle, ".codex", "skills");
+  if (!existsSync3(source)) {
+    return {
+      ok: false,
+      skipped: false,
+      steps: [],
+      message: `the ${BUNDLE2} bundle has no .codex/skills directory \u2014 the export shape changed`
+    };
+  }
+  const home = os2.homedir();
+  const dest = caddisSkillsDir(home);
+  const version = bundleManifest().poolVersion || "unknown";
+  const label = `copy ${BUNDLE2} skills -> ${shortenHome2(dest)}`;
+  const steps2 = [];
+  if (options.dryRun) {
+    return {
+      ok: true,
+      skipped: true,
+      steps: [{ command: label, ok: true, code: 0 }],
+      message: `dry run \u2014 would ${action} caddis ${version} into ${shortenHome2(dest)}`
+    };
+  }
+  try {
+    if (existsSync3(dest)) rmSync2(dest, { recursive: true, force: true });
+    mkdirSync(path3.dirname(dest), { recursive: true });
+    cpSync2(source, dest, { recursive: true });
+    writeFileSync(versionFile(home), `${version}
+`, "utf8");
+    steps2.push({ command: label, ok: true, code: 0 });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    steps2.push({ command: label, ok: false, code: null, output: message });
+    return { ok: false, skipped: false, steps: steps2, message: `could not install into codex: ${message}` };
+  }
+  const notes = [];
+  for (const asset of ["AGENTS.md", path3.join(".codex", "config.toml.example")]) {
+    const from = path3.join(bundle, asset);
+    if (!existsSync3(from)) continue;
+    const to = path3.join(dest, `caddis-${path3.basename(asset)}`);
+    try {
+      cpSync2(from, to);
+      notes.push(path3.basename(to));
+    } catch {
+    }
+  }
+  const extrasNote = options.extras ? " (--extras has no codex bundle yet; core only)" : "";
+  const referenceNote = notes.length ? ` Reference copies beside it: ${notes.join(", ")} \u2014 config.toml is NEVER merged for you.` : "";
+  return {
+    ok: true,
+    skipped: false,
+    steps: steps2,
+    message: `caddis ${version} ${action === "install" ? "installed" : "updated"} in ${shortenHome2(dest)}.${referenceNote}${extrasNote}`
+  };
+}
+var codexAdapter = {
+  id: "codex",
+  name: "Codex",
+  supported: true,
+  summary: "copy the caddis skill pool into ~/.codex/skills/caddis/ (config.toml never merged)",
+  detect: detect3,
+  drive: drive3,
+  status: status3
+};
+
+// src/agents/copilot.ts
+import path4 from "path";
 
 // src/agents/stub.ts
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync4 } from "fs";
 var NOT_YET_SUPPORTED = "not yet supported (v0.2)";
 function createStubAdapter(spec) {
-  async function detect3() {
+  async function detect4() {
     for (const bin of spec.bins) {
       const found = await findBin(bin);
       if (found) return { present: true, path: found, note: NOT_YET_SUPPORTED };
     }
     for (const configPath of spec.configPaths) {
-      if (existsSync3(configPath)) return { present: true, path: configPath, note: NOT_YET_SUPPORTED };
+      if (existsSync4(configPath)) return { present: true, path: configPath, note: NOT_YET_SUPPORTED };
     }
     return { present: false, note: `no ${spec.bins.map((b3) => `\`${b3}\``).join(" / ")} binary or config found` };
   }
-  async function status4() {
-    const detected = await detect3();
+  async function status5() {
+    const detected = await detect4();
     return {
       installed: false,
       note: detected.present ? NOT_YET_SUPPORTED : "agent not installed"
     };
   }
-  async function drive3(_action, _options) {
-    const detected = await detect3();
+  async function drive4(_action, _options) {
+    const detected = await detect4();
     return {
       ok: true,
       skipped: true,
@@ -5773,23 +5914,13 @@ function createStubAdapter(spec) {
     name: spec.name,
     supported: false,
     summary: spec.summary,
-    detect: detect3,
-    drive: drive3,
-    status: status4
+    detect: detect4,
+    drive: drive4,
+    status: status5
   };
 }
 
-// src/agents/codex.ts
-var codexAdapter = createStubAdapter({
-  id: "codex",
-  name: "Codex",
-  bins: ["codex"],
-  configPaths: [path3.join(os2.homedir(), ".codex")],
-  summary: "merge the caddis pool into ~/.codex + AGENTS.md (v0.2)"
-});
-
 // src/agents/copilot.ts
-import path4 from "path";
 var copilotAdapter = createStubAdapter({
   id: "copilot",
   name: "GitHub Copilot",
@@ -5872,8 +6003,8 @@ withGlobalFlags(program2.command("doctor")).description("full health report: eve
 });
 withGlobalFlags(program2.command("status")).description("compact table: cli version, pool version, per-agent version, drift").option("--json", "machine-readable output", false).action(async (options) => {
   const flags = mergeFlags(options);
-  const { status: status4 } = await Promise.resolve().then(() => (init_status(), status_exports));
-  finish(await status4({ adapters: resolveAdapters(flags), json: options.json }));
+  const { status: status5 } = await Promise.resolve().then(() => (init_status(), status_exports));
+  finish(await status5({ adapters: resolveAdapters(flags), json: options.json }));
 });
 program2.addHelpText(
   "after",
@@ -5919,8 +6050,8 @@ async function maybeNotify(enabled) {
 }
 async function main() {
   if (process.argv.slice(2).length === 0) {
-    const { status: status4 } = await Promise.resolve().then(() => (init_status(), status_exports));
-    finish(await status4({ adapters: selectAdapters() }));
+    const { status: status5 } = await Promise.resolve().then(() => (init_status(), status_exports));
+    finish(await status5({ adapters: selectAdapters() }));
     await maybeNotify(true);
     return;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caddis/cli",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Install, update and diagnose the caddis dev harness across every coding agent you use (Claude Code, agy/Antigravity, and more).",
   "keywords": [
     "caddis",

package/bundles/antigravity-plugin/scripts/dream_capture.py

@@ -1,249 +0,0 @@
-"""Deterministic Dream Memory capture from a Stop transcript (fann Phase 5b).
-
-Pure, filesystem-free extraction of *high-confidence* fact candidates from a parsed transcript,
-plus privacy redaction. The hook (``session_end.py``) does the I/O — read the transcript, call
-:func:`extract_facts`, then consolidate via ``dream_memory`` and rewrite the store. Keeping the
-logic here (dicts in → dicts out) makes it unit-testable without a tree, mirroring the engine.
-
-Two kinds are captured (the only ones inferable *without an LLM* — the rich kinds come from the
-knowledge-transfer agent in 5d):
-  • **failure-mode** — a ``Bash`` tool call whose result is an error (``is_error``). One candidate
-    per distinct command per session; cross-session recurrence is what reinforces it.
-  • **workflow-success** — a *build/test* command that succeeded after the same command failed
-    earlier in the same session (the red→green signal).
-
-PRIVACY (hard constraint, see the design doc): a fact must be safe to print at SessionStart and
-(eventually) to commit. So we (1) **skip entirely** any command that touches a secret file
-(``.env``, ``**/secrets/**``, ``*.pem``/``*.key``, credential files — guard.py's secret sense),
-and (2) **redact** inline secrets (``KEY=…``, ``--token …``, ``Bearer …``, URLs with credentials,
-known token shapes, long high-entropy blobs) from both the command head and the error line. The
-dedup key derives from the *redacted* command, so a token can never leak into the store's key.
-"""
-
-from __future__ import annotations
-
-import hashlib
-import re
-
-from dream_memory import make_fact, normalize_key  # sibling module in scripts/
-
-# --------------------------------------------------------------------------- #
-# Limits — keep the store lean and a single Stop's append bounded.
-# --------------------------------------------------------------------------- #
-MAX_FACTS_PER_RUN = 15      # cap candidates emitted from one transcript
-_HEAD_LEN = 80              # command head kept (we store heads, not full args)
-_ERR_LEN = 120             # first error line kept
-_SUMMARY_LEN = 200          # final clamp on a summary
-
-
-# --------------------------------------------------------------------------- #
-# Privacy — redaction + secret-path skip. Mirrors guard.py's secret sense but
-# operates on inline text (value-level scrubbing), not just file-path classing.
-# --------------------------------------------------------------------------- #
-_URL_CRED = re.compile(r"(\w[\w+.\-]*://)[^/\s:@]+:[^/\s@]+@")
-_SENSITIVE_KEY = re.compile(
-    r"\b([A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|CREDENTIAL|CREDENTIALS|AUTH|APIKEY|PRIVATE)[A-Za-z0-9_]*)"
-    r"(\s*[=:]\s*)(\"[^\"]*\"|'[^']*'|\S+)",
-    re.I,
-)
-_SENSITIVE_FLAG = re.compile(
-    r"(--?(?:password|passwd|pwd|token|secret|api[-_]?key|access[-_]?key|auth)\b)(\s+|=)(\"[^\"]*\"|'[^']*'|\S+)",
-    re.I,
-)
-# MySQL/MariaDB attached-password flag: `-pVALUE` glued to the flag (no separator).
-# Scoped to mysql-family commands so `cp -pr`, `mkdir -p`, `docker -p 8080:80`,
-# `ssh -p22` are never touched. Value may be quoted (`-p"my pass"`).
-_MYSQL_PW = re.compile(
-    r"(\b(?:mysql|mysqldump|mariadb|mysqladmin)\b[^\n]*?\s-p)(\"[^\"]*\"|'[^']*'|\S+)",
-    re.I,
-)
-# curl basic-auth: `-u user:pass` / `--user user:pass` (value may be glued to -u).
-# Scoped to curl so `python -u`, `sort -u`, `docker run -u 1000:1000` survive.
-_CURL_USERPASS = re.compile(
-    r"(\bcurl\b[^\n]*?\s(?:--user|-u)\s*)(\"[^\"]*\"|'[^']*'|\S+)",
-    re.I,
-)
-# AWS credential keys given WHITESPACE-separated (e.g. `aws configure set
-# aws_secret_access_key <k>`); the `=`/`:` form is already caught by _SENSITIVE_KEY.
-_AWS_CRED = re.compile(
-    r"\b(aws_secret_access_key|aws_access_key_id|aws_session_token)\b"
-    r"(\s+|\s*[=:]\s*)(\"[^\"]*\"|'[^']*'|\S+)",
-    re.I,
-)
-_AUTH_HEADER = re.compile(r"\b(authorization|x-api-key)\b(\s*:\s*|\s+)(?:bearer\s+)?\S+", re.I)
-_BEARER = re.compile(r"\bbearer\s+[A-Za-z0-9._\-]+", re.I)
-_TOKEN_PREFIX = re.compile(
-    r"\b(?:gh[posru]_[A-Za-z0-9]{6,}|sk-[A-Za-z0-9]{6,}|xox[baprs]-[A-Za-z0-9-]{6,}|AKIA[0-9A-Z]{12,})"
-)
-# Long high-entropy blob (a letter AND a digit, ≥40 chars). Excludes '/' so file paths survive.
-_LONG_TOKEN = re.compile(r"\b(?=[A-Za-z0-9+=_\-]*[A-Za-z])(?=[A-Za-z0-9+=_\-]*[0-9])[A-Za-z0-9+=_\-]{40,}\b")
-
-_SECRET_PATH = re.compile(
-    r"(?:^|[\s=:'\"/\\])\.env(?:\.|$|[\s'\"/\\])"
-    r"|[/\\]\.?secrets?[/\\]"
-    r"|\b(?:id_rsa|id_dsa|id_ecdsa|id_ed25519|credentials|\.npmrc|\.pypirc|\.netrc|\.pgpass|\.htpasswd)\b"
-    r"|\.(?:pem|key|p12|pfx|keystore|jks)\b",
-    re.I,
-)
-
-
-def redact(text: str) -> str:
-    """Scrub inline secrets from ``text`` so it's safe to store, surface, and commit.
-
-    Order matters: credentialed URLs first, then whole-value header/bearer forms (these must run
-    before the generic ``KEY=…`` rule, else "Authorization" matches as a key and only eats the
-    word "Bearer", leaking the token), then explicit ``KEY=…`` / ``--token …`` assignments, then
-    known token prefixes, then a catch-all for long high-entropy blobs. Conservative on file paths
-    (the blob rule excludes ``/``) so an error line stays useful.
-    """
-    if not text:
-        return ""
-    t = str(text)
-    t = _URL_CRED.sub(r"\1***:***@", t)
-    t = _AUTH_HEADER.sub(r"\1: ***", t)
-    t = _BEARER.sub("bearer ***", t)
-    t = _SENSITIVE_KEY.sub(r"\1=***", t)
-    t = _AWS_CRED.sub(r"\1 ***", t)
-    t = _SENSITIVE_FLAG.sub(r"\1 ***", t)
-    t = _CURL_USERPASS.sub(r"\1***", t)
-    t = _MYSQL_PW.sub(r"\1***", t)
-    t = _TOKEN_PREFIX.sub("***", t)
-    t = _LONG_TOKEN.sub("***", t)
-    return t
-
-
-def touches_secret(command: str) -> bool:
-    """True if ``command`` references a secret file/path — such a fact is never stored at all."""
-    return bool(_SECRET_PATH.search(command or ""))
-
-
-# --------------------------------------------------------------------------- #
-# Text shaping
-# --------------------------------------------------------------------------- #
-def command_head(command: str, max_len: int = _HEAD_LEN) -> str:
-    """Whitespace-collapsed, length-capped command head — we store heads, not full arg lists."""
-    c = " ".join((command or "").split())
-    return c[:max_len].rstrip()
-
-
-def command_fp(command: str) -> str:
-    """Stable dedup fingerprint of the FULL command (whitespace-collapsed, lowercased), hashed so two
-    distinct commands that share a truncated 80-char head don't merge into one inflated fact. Kept
-    separate from the display head on purpose. Pass the ALREADY-REDACTED command so no secret is hashed."""
-    norm = " ".join((command or "").split()).lower()
-    return hashlib.sha1(norm.encode("utf-8")).hexdigest()[:16]
-
-
-def first_error_line(output: str, max_len: int = _ERR_LEN) -> str:
-    """First non-empty line of tool output, length-capped — the error's gist, not the whole dump."""
-    for line in (output or "").splitlines():
-        s = line.strip()
-        if s:
-            return s[:max_len]
-    return ""
-
-
-# Commands whose non-zero exit is routine control flow / a search miss — not a durable lesson.
-_NOISE_FIRST_TOKEN = frozenset({
-    "grep", "rg", "test", "[", "find", "ls", "cat", "which", "type", "head", "tail", "diff",
-})
-
-# Build/test commands — only these qualify for the red→green workflow-success signal.
-_BUILD_TEST = re.compile(
-    r"\b(?:pytest|tox|nox|unittest|jest|vitest|mocha|"
-    r"npm\s+(?:run\s+\S+|test|ci)|yarn\s+\S+|pnpm\s+\S+|"
-    r"vite(?:\s+build)?|tsc\b|go\s+(?:test|build)|cargo\s+(?:test|build)|"
-    r"make\b|gradle\b|mvn\b|dotnet\s+(?:test|build)|rspec|phpunit)\b",
-    re.I,
-)
-
-
-def _is_noise_failure(command: str) -> bool:
-    toks = (command or "").strip().split()
-    return bool(toks) and toks[0] in _NOISE_FIRST_TOKEN
-
-
-# --------------------------------------------------------------------------- #
-# Transcript walking
-# --------------------------------------------------------------------------- #
-def _content_blocks(record: dict) -> list[dict]:
-    """The list of content blocks in a transcript record (handles the nested ``message`` shape)."""
-    if not isinstance(record, dict):
-        return []
-    msg = record.get("message") if isinstance(record.get("message"), dict) else record
-    content = msg.get("content") if isinstance(msg, dict) else None
-    if isinstance(content, list):
-        return [b for b in content if isinstance(b, dict)]
-    return []
-
-
-def _result_text(block: dict) -> str:
-    """Flatten a tool_result's content (string or list-of-{text}) to plain text."""
-    c = block.get("content")
-    if isinstance(c, str):
-        return c
-    if isinstance(c, list):
-        parts = [item["text"] for item in c if isinstance(item, dict) and isinstance(item.get("text"), str)]
-        return "\n".join(parts)
-    return ""
-
-
-def extract_facts(records: list[dict], observed_at: str) -> list[dict]:
-    """Mine deterministic fact candidates from parsed transcript ``records`` (in order).
-
-    Returns at most :data:`MAX_FACTS_PER_RUN` ``make_fact`` dicts. Pure: no I/O, no mutation of
-    inputs. Secret-touching commands are skipped wholesale; all stored text is redacted.
-    """
-    # Pass 1: map Bash tool_use id → command.
-    uses: dict[str, str] = {}
-    for rec in records:
-        for b in _content_blocks(rec):
-            if b.get("type") == "tool_use" and b.get("name") == "Bash":
-                tid = b.get("id")
-                inp = b.get("input") if isinstance(b.get("input"), dict) else {}
-                cmd = inp.get("command")
-                if tid and isinstance(cmd, str) and cmd.strip():
-                    uses[tid] = cmd
-
-    # Pass 2: walk results in order — failures first feed the red→green check for later successes.
-    facts: list[dict] = []
-    failed_keys: set[str] = set()
-    emitted: set[str] = set()
-
-    for rec in records:
-        for b in _content_blocks(rec):
-            if b.get("type") != "tool_result":
-                continue
-            cmd = uses.get(b.get("tool_use_id"))
-            if not cmd or touches_secret(cmd):
-                continue  # unknown tool, or a secret-touching command we refuse to record
-
-            red = redact(cmd)
-            head = command_head(red)
-            key = normalize_key(head)
-            if not key:
-                continue
-            fp = command_fp(red)  # full-command dedup identity (the display key stays the 80-char head)
-
-            if bool(b.get("is_error")):
-                if _is_noise_failure(cmd):
-                    continue
-                failed_keys.add(fp)
-                if fp in emitted:
-                    continue  # one failure candidate per distinct command per session
-                emitted.add(fp)
-                errline = redact(first_error_line(_result_text(b)))
-                summary = (f"`{head}` failed: {errline}" if errline else f"`{head}` failed")[:_SUMMARY_LEN]
-                facts.append(make_fact("failure-mode", key, summary, observed_at, source="auto", fp=fp))
-            else:
-                # Success → only a fact if a build/test command recovered from an earlier failure.
-                ok_key = "ok:" + fp
-                if _BUILD_TEST.search(cmd) and fp in failed_keys and ok_key not in emitted:
-                    emitted.add(ok_key)
-                    summary = (f"`{head}` passes now — was failing earlier this session")[:_SUMMARY_LEN]
-                    facts.append(make_fact("workflow-success", key, summary, observed_at, source="auto", fp=fp))
-
-            if len(facts) >= MAX_FACTS_PER_RUN:
-                return facts
-
-    return facts