@clauderecallhq/cli 0.0.1 → 0.11.0

package/dist/utils/secret-scanner.js

@@ -0,0 +1,166 @@
+/**
+ * Secret scanner. Used in two places:
+ *
+ *   1. `recall paste` — pre-archive gate. Refuses (by default) to store content
+ *      that matches a known high-severity pattern unless --force is passed.
+ *   2. UI warnings — Notes editor can call this client-side to show a
+ *      "this note looks like it contains a secret" banner before save.
+ *
+ * Patterns are deliberately conservative: we'd rather let through a fake secret
+ * than mask a real one. Users can always override with --force if they really
+ * want to archive something that matches a pattern (e.g. a sample key in docs).
+ */
+const PATTERNS = [
+    // --- Well-known provider keys ---
+    { name: 'Anthropic API key', regex: /sk-ant-[a-zA-Z0-9_\-]{40,}/g, severity: 'high' },
+    { name: 'OpenAI API key', regex: /sk-(?:proj-)?[a-zA-Z0-9]{32,}/g, severity: 'high' },
+    { name: 'AWS access key ID', regex: /AKIA[0-9A-Z]{16}/g, severity: 'high' },
+    { name: 'GitHub PAT', regex: /gh[pousr]_[A-Za-z0-9]{20,}/g, severity: 'high' },
+    { name: 'Stripe live/test key', regex: /(?:sk|rk|pk)_(?:live|test)_[a-zA-Z0-9]{24,}/g, severity: 'high' },
+    { name: 'Slack token', regex: /xox[abprs]-[A-Za-z0-9\-]{10,}/g, severity: 'high' },
+    { name: 'Google API key', regex: /AIza[0-9A-Za-z_\-]{35}/g, severity: 'high' },
+    { name: 'Private key block', regex: /-----BEGIN (?:RSA |DSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----/g, severity: 'high' },
+    // --- Other named providers ---
+    { name: 'Apify token', regex: /apify_api_[A-Za-z0-9]{20,}/g, severity: 'high' },
+    { name: 'Notion integration', regex: /(?:secret_|ntn_)[A-Za-z0-9]{40,}/g, severity: 'high' },
+    { name: 'Vercel token', regex: /vercel_[A-Za-z0-9]{24,}/g, severity: 'high' },
+    { name: 'Supabase service key', regex: /sbp_[A-Za-z0-9]{40,}/g, severity: 'high' },
+    { name: 'SendGrid key', regex: /SG\.[A-Za-z0-9_\-]{20,}\.[A-Za-z0-9_\-]{20,}/g, severity: 'high' },
+    { name: 'Mailgun key', regex: /key-[a-f0-9]{32}/g, severity: 'high' },
+    { name: 'Twilio SID', regex: /AC[a-f0-9]{32}/g, severity: 'high' },
+    { name: 'Discord bot token', regex: /[MN][A-Za-z\d]{23}\.[\w-]{6}\.[\w-]{27,38}/g, severity: 'high' },
+    { name: 'npm token', regex: /npm_[A-Za-z0-9]{36}/g, severity: 'high' },
+    { name: 'HuggingFace token', regex: /hf_[A-Za-z0-9]{30,}/g, severity: 'high' },
+    { name: 'Replicate token', regex: /r8_[A-Za-z0-9]{32,}/g, severity: 'high' },
+    { name: 'Figma token', regex: /figd_[A-Za-z0-9_\-]{30,}/g, severity: 'high' },
+    { name: 'Linear key', regex: /lin_api_[A-Za-z0-9]{30,}/g, severity: 'high' },
+    { name: 'DigitalOcean token', regex: /dop_v1_[a-f0-9]{64}/g, severity: 'high' },
+    // --- Generic catch-alls (broad; run last so named matches win dedup) ---
+    //
+    // Provider-prefixed tokens follow an observable pattern:
+    //   <lowercase-provider>_(api|pat|token|sk|pk|key|auth)_<high-entropy-blob>
+    // The 20+ char blob filters out common english words and short IDs.
+    // Requires at least one digit in the blob to avoid matching labels like
+    // `stripe_api_key_configuration`.
+    { name: 'Generic provider token', regex: /\b[a-z][a-z0-9]{2,20}_(?:api|pat|token|sk|pk|key|auth)_(?=[A-Za-z0-9_\-]*\d)[A-Za-z0-9_\-]{20,}\b/g, severity: 'high' },
+    // Bearer tokens in Authorization headers.
+    { name: 'Bearer token', regex: /\b[Bb]earer\s+[A-Za-z0-9_\-\.=]{24,}\b/g, severity: 'medium' },
+    // --- Webhook URLs that embed a token in the path ---
+    // These URLs are themselves credentials — anyone with the URL can post
+    // to the channel, so leaking one is identical to leaking a key.
+    { name: 'Slack webhook URL',
+        regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]{20,}/g,
+        severity: 'high' },
+    { name: 'Discord webhook URL',
+        regex: /https:\/\/(?:ptb\.|canary\.)?discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_\-]{40,}/g,
+        severity: 'high' },
+    { name: 'Teams webhook URL',
+        regex: /https:\/\/[a-zA-Z0-9.\-]+\.webhook\.office\.com\/webhookb2\/[A-Za-z0-9@_\-\/]{30,}/g,
+        severity: 'high' },
+    // High-entropy blob immediately following a secret-y keyword. Catches the
+    // markdown-doc leak case where the secret is on its own line in a code
+    // fence, e.g.:
+    //
+    //   **Webhook signing secret** (copy exactly):
+    //   ```
+    //   b02233572afa9fe5ce33083a5984f1b2c23986c337a9d3a3422daa02de61867e
+    //   ```
+    //
+    // The keyword and value can be separated by up to 200 chars of glue
+    // (whitespace, fence markers, parenthetical notes). The 32-char minimum
+    // on the blob avoids false-positives on short hashes / IDs while still
+    // catching 64-char hex (32-byte) and 40-char hex (20-byte) secrets.
+    { name: 'Secret near keyword',
+        regex: /\b(?:webhook[_\s\-]?secret|signing[_\s\-]?secret|webhook[_\s\-]?signing[_\s\-]?secret|api[_\s\-]?secret|client[_\s\-]?secret|private[_\s\-]?key|access[_\s\-]?token|auth[_\s\-]?token|api[_\s\-]?key)\b[\s\S]{0,200}?\b(?:[a-fA-F0-9]{32,}|[A-Za-z0-9+/_\-]{20,}(?:\.[A-Za-z0-9+/_\-]{10,}){1,2}|[A-Za-z0-9+/_\-]{40,}={0,2})\b/gi,
+        severity: 'high' },
+    // --- Formats, not providers ---
+    { name: 'JWT', regex: /eyJ[a-zA-Z0-9_\-]{10,}\.[a-zA-Z0-9_\-]{10,}\.[a-zA-Z0-9_\-]{10,}/g, severity: 'medium' },
+    { name: 'URL with password', regex: /https?:\/\/[^:\s/@]+:[^@\s]{6,}@[^\s/]+/g, severity: 'high' },
+    // Password / secret / token / api-key assignments. The lookbehind blocks
+    // matches inside camelCase identifiers (e.g. `mySecretLogger`) but allows
+    // env-var style names where the keyword is preceded by `_` (e.g.
+    // `WEBHOOK_SECRET=`, `LEMONSQUEEZY_WEBHOOK_SECRET=`, `STRIPE_API_KEY=`).
+    // The 16+ char value charset deliberately excludes `.` and `:` so that
+    // `secret = process.env.X` and `apiKey: args.resendApiKey` (code, not
+    // values) do not get redacted.
+    { name: 'Password assignment',
+        regex: /(?<![A-Za-z])(?:password|passwd|pwd|secret|token|api[_\-]?key|access[_\-]?key|auth[_\-]?token|webhook[_\-]?secret|client[_\-]?secret|private[_\-]?key)\b\s*[:=]\s*["']?[A-Za-z0-9_\-+/=]{16,}/gi,
+        severity: 'high' },
+];
+function mask(s) {
+    if (s.length <= 8)
+        return s.slice(0, 2) + '•'.repeat(Math.max(0, s.length - 4)) + s.slice(-2);
+    const head = s.slice(0, Math.min(6, Math.floor(s.length / 3)));
+    const tail = s.slice(-Math.min(4, Math.floor(s.length / 4)));
+    return `${head}${'•'.repeat(Math.max(3, s.length - head.length - tail.length))}${tail}`;
+}
+export function scanForSecrets(text) {
+    if (!text)
+        return [];
+    // The raw secret is held in this local scope only — dedup key is hashed
+    // (cheap non-cryptographic hash is fine; we just need uniqueness, not
+    // unpredictability) and the plaintext never escapes the function.
+    const seen = new Set();
+    const out = [];
+    for (const p of PATTERNS) {
+        p.regex.lastIndex = 0;
+        for (const m of text.matchAll(p.regex)) {
+            const raw = m[0];
+            const key = `${p.name}::${fingerprint(raw)}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            out.push({
+                pattern: p.name,
+                maskedPreview: mask(raw),
+                offset: m.index ?? 0,
+                severity: p.severity,
+            });
+        }
+    }
+    return out;
+}
+/** Small non-cryptographic hash (djb2). Dedup only — never reversed. */
+function fingerprint(s) {
+    let h = 5381;
+    for (let i = 0; i < s.length; i++)
+        h = ((h << 5) + h + s.charCodeAt(i)) | 0;
+    return (h >>> 0).toString(36);
+}
+export function hasHighSeveritySecret(text) {
+    return scanForSecrets(text).some((m) => m.severity === 'high');
+}
+/**
+ * Redact every detected secret in-place with a masked preview. Used on the
+ * indexing hot path so secrets that appear in raw session JSONL never make
+ * it into ~/.recall/db.sqlite (or the FTS index, the plain-text mirrors,
+ * or the exported context markdown).
+ *
+ * The original JSONL at ~/.claude/projects/ is NEVER modified — that's the
+ * durability invariant. The redaction only affects our derived store, so a
+ * user who really needs the cleartext can still recover it from source.
+ *
+ * Returns the redacted string and the count of unique secrets redacted.
+ * `count` is useful for telemetry / UI badges ("3 secrets auto-redacted
+ * in this session").
+ */
+export function redactSecrets(text) {
+    if (!text)
+        return { redacted: text, count: 0 };
+    let redacted = text;
+    let count = 0;
+    const seen = new Set();
+    for (const p of PATTERNS) {
+        p.regex.lastIndex = 0;
+        redacted = redacted.replace(p.regex, (m) => {
+            const key = `${p.name}::${fingerprint(m)}`;
+            if (!seen.has(key)) {
+                seen.add(key);
+                count += 1;
+            }
+            return `[REDACTED ${p.name}: ${mask(m)}]`;
+        });
+    }
+    return { redacted, count };
+}
+//# sourceMappingURL=secret-scanner.js.map

package/dist/utils/secret-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scanner.js","sourceRoot":"","sources":["../../src/utils/secret-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAyBH,MAAM,QAAQ,GAAiB;IAC7B,mCAAmC;IACnC,EAAE,IAAI,EAAE,mBAAmB,EAAK,KAAK,EAAE,6BAA6B,EAAsB,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,gBAAgB,EAAQ,KAAK,EAAE,gCAAgC,EAAmB,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,mBAAmB,EAAK,KAAK,EAAE,mBAAmB,EAAgC,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,YAAY,EAAY,KAAK,EAAE,6BAA6B,EAAsB,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,8CAA8C,EAAK,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,aAAa,EAAW,KAAK,EAAE,gCAAgC,EAAmB,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,gBAAgB,EAAQ,KAAK,EAAE,yBAAyB,EAA0B,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,mBAAmB,EAAK,KAAK,EAAE,oEAAoE,EAAE,QAAQ,EAAE,MAAM,EAAE;IAE/H,gCAAgC;IAChC,EAAE,IAAI,EAAE,aAAa,EAAW,KAAK,EAAE,6BAA6B,EAAsB,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,oBAAoB,EAAI,KAAK,EAAE,mCAAmC,EAAgB,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,cAAc,EAAU,KAAK,EAAE,0BAA0B,EAAyB,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,uBAAuB,EAA4B,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,cAAc,EAAU,KAAK,EAAE,+CAA+C,EAAI,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,aAAa,EAAW,KAAK,EAAE,mBAAmB,EAAgC,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,YAAY,EAAY,KAAK,EAAE,iBAAiB,EAAkC,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,mBAAmB,EAAK,KAAK,EAAE,6CAA6C,EAAM,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,WAAW,EAAa,KAAK,EAAE,sBAAsB,EAA6B,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,mBAAmB,EAAK,KAAK,EAAE,sBAAsB,EAA6B,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,iBAAiB,EAAO,KAAK,EAAE,sBAAsB,EAA6B,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,aAAa,EAAW,KAAK,EAAE,2BAA2B,EAAwB,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,YAAY,EAAY,KAAK,EAAE,2BAA2B,EAAwB,QAAQ,EAAE,MAAM,EAAE;IAC5G,EAAE,IAAI,EAAE,oBAAoB,EAAI,KAAK,EAAE,sBAAsB,EAA6B,QAAQ,EAAE,MAAM,EAAE;IAE5G,0EAA0E;IAC1E,EAAE;IACF,yDAAyD;IACzD,4EAA4E;IAC5E,oEAAoE;IACpE,wEAAwE;IACxE,kCAAkC;IAClC,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,oGAAoG,EAAE,QAAQ,EAAE,MAAM,EAAE;IACjK,0CAA0C;IAC1C,EAAE,IAAI,EAAE,cAAc,EAAU,KAAK,EAAE,yCAAyC,EAAU,QAAQ,EAAE,QAAQ,EAAE;IAE9G,sDAAsD;IACtD,uEAAuE;IACvE,gEAAgE;IAChE,EAAE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,kFAAkF;QACzF,QAAQ,EAAE,MAAM,EAAE;IACpB,EAAE,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,6FAA6F;QACpG,QAAQ,EAAE,MAAM,EAAE;IACpB,EAAE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,qFAAqF;QAC5F,QAAQ,EAAE,MAAM,EAAE;IAEpB,0EAA0E;IAC1E,uEAAuE;IACvE,eAAe;IACf,EAAE;IACF,+CAA+C;IAC/C,QAAQ;IACR,qEAAqE;IACrE,QAAQ;IACR,EAAE;IACF,oEAAoE;IACpE,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,EAAE,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,mUAAmU;QAC1U,QAAQ,EAAE,MAAM,EAAE;IAEpB,iCAAiC;IACjC,EAAE,IAAI,EAAE,KAAK,EAAmB,KAAK,EAAE,mEAAmE,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAChI,EAAE,IAAI,EAAE,mBAAmB,EAAK,KAAK,EAAE,0CAA0C,EAAS,QAAQ,EAAE,MAAM,EAAE;IAC5G,yEAAyE;IACzE,0EAA0E;IAC1E,iEAAiE;IACjE,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,+BAA+B;IAC/B,EAAE,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,iMAAiM;QACxM,QAAQ,EAAE,MAAM,EAAE;CACrB,CAAC;AAEF,SAAS,IAAI,CAAC,CAAS;IACrB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,GAAG,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,wEAAwE;IACxE,sEAAsE;IACtE,kEAAkE;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC;gBACxB,MAAM,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC/C,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE;YACzC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,OAAO,aAAa,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist/utils/sessionLabel.js

@@ -0,0 +1,64 @@
+/**
+ * Session label resolution. Implements the standard fallback chain used
+ * everywhere a session needs a human-readable name.
+ *
+ * Precedence (mirrors AliasEditor + SessionsPane):
+ *   1. Agent ✨ auto_title wins unconditionally — clicking ✨ is a deliberate
+ *      request to display THIS title.
+ *   2. Manual alias beats heuristic-only auto_title.
+ *   3. Heuristic auto_title beats correlator-set ('auto') alias — fixes
+ *      child sessions that inherited a noisy terminal-tab name like "claude"
+ *      or "test test" from a wrongly-linked terminal.
+ *   4. Otherwise: alias → auto_title → first_user_message → id.slice(0,8).
+ *
+ * Callers without `aliasSource` / `autoTitleSource` collapse to the simpler
+ * legacy chain (alias → auto_title → first_user_message → id) — kept for
+ * backward compatibility with consumers that don't yet plumb source fields.
+ *
+ * Pure function with no DB access. Tests live at `test/sessionLabel.test.mjs`.
+ */
+const FIRST_MESSAGE_MAX_LEN = 60;
+function nonEmpty(value) {
+    if (value == null)
+        return null;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+function truncateFirstMessage(raw) {
+    const firstLine = raw.split('\n', 1)[0].trim();
+    if (!firstLine)
+        return null;
+    return firstLine.length > FIRST_MESSAGE_MAX_LEN
+        ? firstLine.slice(0, FIRST_MESSAGE_MAX_LEN)
+        : firstLine;
+}
+export function resolveSessionLabel(input) {
+    const alias = nonEmpty(input.alias);
+    const autoTitle = nonEmpty(input.autoTitle);
+    const firstMessage = nonEmpty(input.firstUserMessage);
+    const aliasSource = input.aliasSource ?? null;
+    const autoTitleSource = input.autoTitleSource ?? null;
+    // 1. Agent title always wins.
+    if (autoTitle && autoTitleSource === 'agent')
+        return autoTitle;
+    // 2. Manual alias beats a heuristic auto_title.
+    if (alias && aliasSource === 'manual')
+        return alias;
+    // 3. Any auto_title beats an auto-set alias (terminal-tab inheritance fix).
+    //    Also covers the legacy callers (no source fields): if both exist with
+    //    no source info, prefer alias unless we explicitly know it's auto.
+    if (autoTitle && (aliasSource === 'auto' || alias === null))
+        return autoTitle;
+    // 4. Fall through to the legacy chain.
+    if (alias)
+        return alias;
+    if (autoTitle)
+        return autoTitle;
+    if (firstMessage) {
+        const truncated = truncateFirstMessage(firstMessage);
+        if (truncated)
+            return truncated;
+    }
+    return input.sessionId.slice(0, 8);
+}
+//# sourceMappingURL=sessionLabel.js.map

package/dist/utils/sessionLabel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionLabel.js","sourceRoot":"","sources":["../../src/utils/sessionLabel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAajC,SAAS,QAAQ,CAAC,KAAgC;IAChD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,SAAS,CAAC,MAAM,GAAG,qBAAqB;QAC7C,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC;QAC3C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAwB;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;IAC9C,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC;IAEtD,8BAA8B;IAC9B,IAAI,SAAS,IAAI,eAAe,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/D,gDAAgD;IAChD,IAAI,KAAK,IAAI,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEpD,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,SAAS,IAAI,CAAC,WAAW,KAAK,MAAM,IAAI,KAAK,KAAK,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9E,uCAAuC;IACvC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACrC,CAAC"}

package/dist/utils/tags.js

@@ -0,0 +1,97 @@
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { getDb } from '../db/client.js';
+import { RECALL_HOME, ensureRecallHome } from './paths.js';
+/**
+ * Tags for sessions. Three durability layers, same pattern as aliases + notes:
+ *
+ *   1. session_tags   — the current (session_id, tag) many-to-many state.
+ *   2. tag_events     — append-only audit log of every add/remove. Never trimmed.
+ *   3. ~/.recall/tags.json — plain-text mirror on disk, rewritten after every
+ *      mutation. Contains both current state AND the full event log, so tags
+ *      can be reconstructed end-to-end from this file alone.
+ */
+export const TAGS_BACKUP_FILE = join(RECALL_HOME, 'tags.json');
+/** Normalize user input into a canonical tag token. */
+export function normalizeTag(raw) {
+    return raw
+        .trim()
+        .toLowerCase()
+        .replace(/^#+/, '')
+        .replace(/[\s/\\]+/g, '-')
+        .replace(/[^a-z0-9\-._]/g, '')
+        .slice(0, 40);
+}
+export function addTag(sessionId, rawTag) {
+    const tag = normalizeTag(rawTag);
+    if (!tag)
+        throw new Error('tag must contain at least one alphanumeric character');
+    const db = getDb();
+    const now = new Date().toISOString();
+    const exists = db
+        .prepare('SELECT 1 FROM session_tags WHERE session_id = ? AND tag = ?')
+        .get(sessionId, tag);
+    if (exists) {
+        return { tag, added: false };
+    }
+    const txn = db.transaction(() => {
+        db.prepare('INSERT INTO session_tags (session_id, tag, created_at) VALUES (?, ?, ?)').run(sessionId, tag, now);
+        db.prepare("INSERT INTO tag_events (session_id, tag, action, at) VALUES (?, ?, 'add', ?)").run(sessionId, tag, now);
+    });
+    txn();
+    backupTags();
+    return { tag, added: true };
+}
+export function removeTag(sessionId, rawTag) {
+    const tag = normalizeTag(rawTag);
+    if (!tag)
+        return { tag: '', removed: false };
+    const db = getDb();
+    const now = new Date().toISOString();
+    const existed = db
+        .prepare('SELECT 1 FROM session_tags WHERE session_id = ? AND tag = ?')
+        .get(sessionId, tag);
+    if (!existed)
+        return { tag, removed: false };
+    const txn = db.transaction(() => {
+        db.prepare('DELETE FROM session_tags WHERE session_id = ? AND tag = ?').run(sessionId, tag);
+        db.prepare("INSERT INTO tag_events (session_id, tag, action, at) VALUES (?, ?, 'remove', ?)").run(sessionId, tag, now);
+    });
+    txn();
+    backupTags();
+    return { tag, removed: true };
+}
+export function tagsForSession(sessionId) {
+    return getDb()
+        .prepare('SELECT tag FROM session_tags WHERE session_id = ? ORDER BY tag')
+        .all(sessionId).map((r) => r.tag);
+}
+export function allTagsWithCounts() {
+    return getDb()
+        .prepare(`SELECT tag, COUNT(*) AS count FROM session_tags
+       GROUP BY tag ORDER BY count DESC, tag ASC`)
+        .all();
+}
+export function backupTags() {
+    try {
+        ensureRecallHome();
+        const db = getDb();
+        const currentTags = db
+            .prepare('SELECT session_id, tag, created_at FROM session_tags ORDER BY session_id, tag')
+            .all();
+        const events = db
+            .prepare('SELECT id, session_id, tag, action, at FROM tag_events ORDER BY at ASC, id ASC')
+            .all();
+        const payload = {
+            schema: 'claude-recall.tags.v1',
+            backed_up_at: new Date().toISOString(),
+            current: currentTags,
+            events,
+        };
+        writeFileSync(TAGS_BACKUP_FILE, JSON.stringify(payload, null, 2));
+    }
+    catch (err) {
+        console.error('[tags] backup failed:', err);
+    }
+}
+//# sourceMappingURL=tags.js.map

package/dist/utils/tags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tags.js","sourceRoot":"","sources":["../../src/utils/tags.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAgB/D,uDAAuD;AACvD,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,GAAG;SACP,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;SACzB,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,SAAiB,EAAE,MAAc;IACtD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAElF,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,MAAM,MAAM,GAAG,EAAE;SACd,OAAO,CAAC,6DAA6D,CAAC;SACtE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAEvB,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAC9B,EAAE,CAAC,OAAO,CACR,yEAAyE,CAC1E,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,EAAE,CAAC,OAAO,CACR,8EAA8E,CAC/E,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,GAAG,EAAE,CAAC;IAEN,UAAU,EAAE,CAAC;IACb,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,MAAc;IACzD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE7C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAErC,MAAM,OAAO,GAAG,EAAE;SACf,OAAO,CAAC,6DAA6D,CAAC;SACtE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAEvB,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE7C,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAC9B,EAAE,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAC,GAAG,CACzE,SAAS,EACT,GAAG,CACJ,CAAC;QACF,EAAE,CAAC,OAAO,CACR,iFAAiF,CAClF,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,GAAG,EAAE,CAAC;IAEN,UAAU,EAAE,CAAC;IACb,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OACE,KAAK,EAAE;SACJ,OAAO,CAAC,gEAAgE,CAAC;SACzE,GAAG,CAAC,SAAS,CACjB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,EAAE;SACX,OAAO,CACN;iDAC2C,CAC5C;SACA,GAAG,EAA2C,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,gBAAgB,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QACnB,MAAM,WAAW,GAAG,EAAE;aACnB,OAAO,CAAC,+EAA+E,CAAC;aACxF,GAAG,EAAc,CAAC;QACrB,MAAM,MAAM,GAAG,EAAE;aACd,OAAO,CACN,gFAAgF,CACjF;aACA,GAAG,EAAmB,CAAC;QAC1B,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,uBAAuB;YAC/B,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,OAAO,EAAE,WAAW;YACpB,MAAM;SACP,CAAC;QACF,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}

package/dist/utils/thread-context.js

@@ -0,0 +1,129 @@
+import { getDb } from '../db/client.js';
+/**
+ * v0.15b prep — thread-context resolver for agent-tier auto-title generation.
+ *
+ * When the user clicks "Generate title" on a session that already lives inside
+ * a thread, the LLM should know who the parent and siblings are so it can
+ * mint a title that reflects the session's role in the hierarchy
+ * ("Phase A: API design") instead of a generic single-session summary.
+ *
+ * This module is read-only against the existing `threads` and `thread_edges`
+ * tables. It does not mutate state, does not write mirrors, and never throws
+ * on a missing edge — callers in `autoTitle.ts` fall back to the no-context
+ * prompt when this returns null.
+ *
+ * Multi-thread tie-break: if a session belongs to multiple threads, we pick
+ * the thread the session was added to most recently (by `thread_edges.added_at`
+ * for that session's edge). Rationale: the user's last action is the strongest
+ * signal of which thread they consider "current." A generated title that
+ * reflects an older, possibly archived thread would feel stale.
+ *
+ * Title fallback chain (consumers should rely on this helper rather than
+ * re-implementing it): `alias → auto_title → first_user_message → id.slice(0,8)`.
+ * Same chain used by `displayTitleFor` in autoCollections.ts and the web UI.
+ */
+const DISPLAY_TITLE_MAX = 80;
+/**
+ * Display title with the canonical fallback chain. Trims, takes the first
+ * line, caps at 80 chars with an ellipsis. Returns the 8-char id slice when
+ * nothing else is available so the prompt always has *something* to refer to.
+ */
+function displayTitleFor(row) {
+    if (row.alias && row.alias.trim())
+        return row.alias.trim();
+    if (row.auto_title && row.auto_title.trim())
+        return row.auto_title.trim();
+    const msg = (row.first_user_message ?? '').trim();
+    if (!msg)
+        return row.id.slice(0, 8);
+    const firstLine = msg.split('\n')[0].trim();
+    return firstLine.length > DISPLAY_TITLE_MAX
+        ? firstLine.slice(0, DISPLAY_TITLE_MAX) + '…'
+        : firstLine;
+}
+function loadDisplayRow(sessionId) {
+    const db = getDb();
+    const row = db
+        .prepare(`SELECT s.id          AS id,
+              sa.alias       AS alias,
+              s.auto_title   AS auto_title,
+              s.first_user_message AS first_user_message
+         FROM sessions s
+         LEFT JOIN session_aliases sa ON sa.session_id = s.id
+        WHERE s.id = ?`)
+        .get(sessionId);
+    return row ?? null;
+}
+function loadDisplayTitle(sessionId) {
+    const row = loadDisplayRow(sessionId);
+    if (!row)
+        return sessionId.slice(0, 8);
+    return displayTitleFor(row);
+}
+/**
+ * Resolve the most-relevant thread context for a session.
+ *
+ * Returns null when:
+ *   - the session does not exist, OR
+ *   - the session has no rows in `thread_edges`, OR
+ *   - the only matching threads are archived.
+ */
+export function getThreadContextForSession(sessionId) {
+    if (!sessionId)
+        return null;
+    const db = getDb();
+    // Pick the most-recently-added edge for this session across non-archived
+    // threads. ORDER BY added_at DESC ensures the user's last action wins;
+    // LIMIT 1 collapses ties deterministically (by primary key tie-break SQLite
+    // applies — stable enough for our purposes since we only need ONE thread).
+    const edge = db
+        .prepare(`SELECT e.thread_id           AS thread_id,
+              t.name                AS thread_name,
+              e.parent_session_id   AS parent_session_id,
+              e.added_at            AS added_at
+         FROM thread_edges e
+         JOIN threads t ON t.id = e.thread_id
+        WHERE e.session_id = ?
+          AND t.archived = 0
+        ORDER BY e.added_at DESC
+        LIMIT 1`)
+        .get(sessionId);
+    if (!edge)
+        return null;
+    const parent_session = edge.parent_session_id
+        ? {
+            id: edge.parent_session_id,
+            title: loadDisplayTitle(edge.parent_session_id),
+        }
+        : null;
+    const excludeIds = edge.parent_session_id
+        ? [sessionId, edge.parent_session_id]
+        : [sessionId];
+    const placeholders = excludeIds.map(() => '?').join(', ');
+    const siblingRows = db
+        .prepare(`SELECT e.session_id          AS session_id,
+              s.id                  AS id,
+              sa.alias              AS alias,
+              s.auto_title          AS auto_title,
+              s.first_user_message  AS first_user_message
+         FROM thread_edges e
+         LEFT JOIN sessions s        ON s.id = e.session_id
+         LEFT JOIN session_aliases sa ON sa.session_id = e.session_id
+        WHERE e.thread_id = ?
+          AND e.session_id NOT IN (${placeholders})
+        ORDER BY e.added_at ASC`)
+        .all(edge.thread_id, ...excludeIds);
+    const siblings = siblingRows.map((r) => ({
+        id: r.session_id,
+        // If the sibling row's session is missing (foreign-key gap, shouldn't
+        // happen but defensive), fall back to its id slice.
+        title: r.id ? displayTitleFor(r) : r.session_id.slice(0, 8),
+    }));
+    return {
+        thread_id: edge.thread_id,
+        thread_name: edge.thread_name,
+        parent_session,
+        siblings,
+    };
+}
+//# sourceMappingURL=thread-context.js.map

package/dist/utils/thread-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"thread-context.js","sourceRoot":"","sources":["../../src/utils/thread-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAqB7B;;;;GAIG;AACH,SAAS,eAAe,CAAC,GAAsB;IAC7C,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3D,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC1E,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,SAAS,CAAC,MAAM,GAAG,iBAAiB;QACzC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG,GAAG;QAC7C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CACN;;;;;;uBAMiB,CAClB;SACA,GAAG,CAAC,SAAS,CAAkC,CAAC;IACnD,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,MAAM,GAAG,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAiB;IAEjB,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,yEAAyE;IACzE,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN;;;;;;;;;gBASU,CACX;SACA,GAAG,CAAC,SAAS,CAAiC,CAAC;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,cAAc,GAAmC,IAAI,CAAC,iBAAiB;QAC3E,CAAC,CAAC;YACE,EAAE,EAAE,IAAI,CAAC,iBAAiB;YAC1B,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,iBAAiB,CAAC;SAChD;QACH,CAAC,CAAC,IAAI,CAAC;IAQT,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB;QACvC,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,iBAAiB,CAAC;QACrC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChB,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,EAAE;SACnB,OAAO,CACN;;;;;;;;;qCAS+B,YAAY;gCACjB,CAC3B;SACA,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,UAAU,CAAiB,CAAC;IAEtD,MAAM,QAAQ,GAA8B,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,EAAE,EAAE,CAAC,CAAC,UAAU;QAChB,sEAAsE;QACtE,oDAAoD;QACpD,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;KAC5D,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc;QACd,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/utils/threadFilter.js

@@ -0,0 +1,18 @@
+/**
+ * Thread name typeahead filter. Pure helper used by the SessionThreadsRow
+ * "+ Add to thread" picker (v0.15a Bucket 1 fix 5).
+ *
+ * Case-insensitive substring match against `thread.name`. Empty query returns
+ * the input unchanged so the caller can show the full list before any typing.
+ * Whitespace-only queries are treated as empty.
+ *
+ * Stays in `src/utils/` (instead of `src/web/`) so unit tests under `test/`
+ * can import it directly from the compiled `dist/`.
+ */
+export function filterThreadsByName(threads, query) {
+    const norm = query.trim().toLowerCase();
+    if (!norm)
+        return [...threads];
+    return threads.filter((t) => t.name.toLowerCase().includes(norm));
+}
+//# sourceMappingURL=threadFilter.js.map

package/dist/utils/threadFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threadFilter.js","sourceRoot":"","sources":["../../src/utils/threadFilter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,MAAM,UAAU,mBAAmB,CACjC,OAAqB,EACrB,KAAa;IAEb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACpE,CAAC"}