@dashclaw/cli 0.7.4 → 0.8.0

package/lib/codex/install.js

@@ -59,12 +59,10 @@ const HOOK_FILES = [
   'dashclaw_pretool.py',
   'dashclaw_posttool.py',
   'dashclaw_stop.py',
-  // dashclaw_stop.py imports this for Code Sessions ingest; without it the
-  // import fails inside a try/except and ingest silently no-ops (v2.7 fix).
-  'dashclaw_code_session_reporter.py',
-  // SessionStart digest (v3.7 item 6) — wired once codex-cli 0.139.0's
-  // SessionStart hook event was confirmed to fire (see PLUGIN_PARITY.md).
-  'dashclaw_session_digest.py',
+  // SessionStart enforcement-liveness probe (v8.2) — the SessionStart hook
+  // (wired once codex-cli 0.139.0's SessionStart event was confirmed to fire;
+  // see PLUGIN_PARITY.md). Replaced the retired session-digest hook.
+  'enforcement_liveness_probe.py',
 ];
 const HOOK_INTEL_DIR = 'dashclaw_agent_intel';
 
@@ -192,7 +190,7 @@ export function buildConfigTomlBlock({
   const pre = join(hooksDir, 'dashclaw_pretool.py');
   const post = join(hooksDir, 'dashclaw_posttool.py');
   const stop = join(hooksDir, 'dashclaw_stop.py');
-  const sessionStart = join(hooksDir, 'dashclaw_session_digest.py');
+  const sessionStart = join(hooksDir, 'enforcement_liveness_probe.py');
 
   const lines = [
     MANAGED_START,
@@ -244,11 +242,14 @@ export function buildConfigTomlBlock({
     '',
     // Codex CLI 0.139.0's hook-event enum contains SessionStart alongside
     // Pre/Post/Stop; wired once that lifecycle was verified to fire
-    // (roadmap v3.7 item 6 — see PLUGIN_PARITY.md).
+    // (roadmap v3.7 item 6 — see PLUGIN_PARITY.md). Runs the enforcement-
+    // liveness probe (v8.2): `--source session-start` throttles it to once/12h
+    // and detaches, so session start is never delayed. No --agent-id — the
+    // probe forces its own synthetic identity internally.
     '[[hooks.SessionStart]]',
     '[[hooks.SessionStart.hooks]]',
     'type = "command"',
-    `command = ${tomlString(`${py} ${sessionStart} --agent-id codex`)}`,
+    `command = ${tomlString(`${py} ${sessionStart} --source session-start`)}`,
     MANAGED_END,
   );
 

package/lib/up/db.js

@@ -125,6 +125,19 @@ export function embeddedFailureMessage(err) {
   return `${base}. Retry with --db docker or --db url.`;
 }
 
+/**
+ * Extra embedded-postgres options when running as root on POSIX (the fresh
+ * root-VPS case, caught live by the first `drill:fresh-linux --as-root` run):
+ * postgres refuses to run as root, and embedded-postgres's escape hatch is
+ * `createPostgresUser: true` (it provisions a `postgres` system user and runs
+ * the cluster as that user). No-op everywhere else — including Windows, where
+ * the elevated-token case is handled by the pg_ctl lifecycle instead.
+ */
+export function rootPostgresOptions({ platform = process.platform, getuid = process.getuid } = {}) {
+  if (platform === 'win32' || typeof getuid !== 'function') return {};
+  return getuid() === 0 ? { createPostgresUser: true } : {};
+}
+
 export const DEFAULT_DB_PORT = 5433;
 // Scan window when the preferred port is taken: preferred+1 .. preferred+10.
 const PORT_SCAN_SPAN = 10;
@@ -409,6 +422,7 @@ export async function provisionDatabase({
     port,
     persistent: true,
     initdbFlags: INITDB_FLAGS,
+    ...rootPostgresOptions(),
   });
   try {
     // initdb refuses a non-empty data dir, so only initialise a cluster that

package/package.json

@@ -1,37 +1,37 @@
-{
-  "name": "@dashclaw/cli",
-  "version": "0.7.4",
-  "description": "DashClaw terminal client — approve agent actions and diagnose your instance",
-  "type": "module",
-  "keywords": [
-    "dashclaw",
-    "cli",
-    "claude-code",
-    "ai-governance",
-    "agent-governance"
-  ],
-  "bin": {
-    "dashclaw": "./bin/dashclaw.js"
-  },
-  "files": [
-    "bin/",
-    "lib/",
-    "README.md"
-  ],
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "scripts": {
-    "test": "node --test test/**/*.test.js"
-  },
-  "dependencies": {
-    "dashclaw": "^2.2.1",
-    "embedded-postgres": "18.4.0-beta.17",
-    "pg": "^8.22.0",
-    "tar": "^7.4.0"
-  },
-  "license": "MIT",
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "@dashclaw/cli",
+  "version": "0.8.0",
+  "description": "DashClaw terminal client — approve agent actions and diagnose your instance",
+  "type": "module",
+  "keywords": [
+    "dashclaw",
+    "cli",
+    "claude-code",
+    "ai-governance",
+    "agent-governance"
+  ],
+  "bin": {
+    "dashclaw": "./bin/dashclaw.js"
+  },
+  "files": [
+    "bin/",
+    "lib/",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "test": "node --test test/**/*.test.js"
+  },
+  "dependencies": {
+    "dashclaw": "^2.2.1",
+    "embedded-postgres": "18.4.0-beta.17",
+    "pg": "^8.22.0",
+    "tar": "^7.4.0"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/lib/code/apply.js

@@ -1,164 +0,0 @@
-// `dashclaw code apply <manifestId>` — fetch a write plan from the server
-// and apply it locally. The server emits the manifest (Phase 6) with a
-// 24h TTL. This module is the only place the CLI writes to disk for the
-// Optimal Files feature.
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { _ensureInsideProject, applyMerge } from './vendored.js';
-
-const SECRET_PATTERNS = [
-  { name: 'stripe_test', re: /sk_test_[A-Za-z0-9]{8,}/g },
-  { name: 'stripe_live', re: /sk_live_[A-Za-z0-9]{8,}/g },
-  { name: 'stripe_webhook', re: /whsec_[A-Za-z0-9]{8,}/g },
-  { name: 'openai_key', re: /sk-[A-Za-z0-9]{20,}/g },
-  { name: 'anthropic_key', re: /sk-ant-[A-Za-z0-9_\-]{20,}/g },
-  { name: 'github_pat', re: /(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g },
-  { name: 'aws_access', re: /AKIA[0-9A-Z]{16}/g },
-  { name: 'jwt', re: /eyJ[A-Za-z0-9_\-]{20,}\.[A-Za-z0-9_\-]{20,}\.[A-Za-z0-9_\-]{20,}/g },
-  { name: 'private_key', re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g },
-  { name: 'env_assign', re: /\b([A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASS|PWD|CRED|AUTH))\s*=\s*['"]?[^\s'"\n]+/g },
-];
-
-function scanForSecrets(content) {
-  let redactions = 0;
-  let out = String(content == null ? '' : content);
-  for (const p of SECRET_PATTERNS) {
-    out = out.replace(p.re, (_match, captured) => {
-      redactions++;
-      if (p.name === 'env_assign' && captured) return `${captured}=<REDACTED:${p.name}>`;
-      return `<REDACTED:${p.name}>`;
-    });
-  }
-  return { status: redactions === 0 ? 'passed' : 'redacted', redactions, redacted: out };
-}
-
-async function fetchManifest(baseUrl, apiKey, manifestId, { fetchImpl = fetch }) {
-  const url = baseUrl.replace(/\/+$/, '') + '/api/code-sessions/manifests/' + encodeURIComponent(manifestId);
-  const res = await fetchImpl(url, {
-    headers: { 'x-api-key': apiKey },
-  });
-  let body = null;
-  try { body = await res.json(); } catch { /* null */ }
-  return { status: res.status, ok: res.ok, body };
-}
-
-export async function runApply({
-  baseUrl,
-  apiKey,
-  manifestId,
-  dest,
-  yes = false,
-  allowRedactions = false,
-  allowOverwriteSideBySide = false,
-  fetchImpl = fetch,
-  logger = console,
-}) {
-  if (!manifestId) throw new Error('runApply: manifestId is required');
-  if (!dest) throw new Error('runApply: --dest=<dir> is required');
-  if (!baseUrl || !apiKey) throw new Error('runApply: baseUrl and apiKey are required');
-
-  const destAbs = path.resolve(dest);
-  try { fs.mkdirSync(destAbs, { recursive: true }); }
-  catch (err) { throw new Error('Could not create destination ' + destAbs + ': ' + err.message); }
-
-  const { status, ok, body } = await fetchManifest(baseUrl, apiKey, manifestId, { fetchImpl });
-  if (!ok) throw new Error('Failed to load manifest: HTTP ' + status + (body?.error ? ' — ' + body.error : ''));
-  const plan = Array.isArray(body?.plan) ? body.plan : Array.isArray(body?.plan?.results) ? body.plan.results : null;
-  if (!plan) throw new Error('Manifest payload missing plan');
-
-  const results = [];
-  for (const entry of plan) {
-    const target = entry.path;
-    if (!target) {
-      results.push({ path: '(unknown)', status: 'invalid_entry' });
-      continue;
-    }
-    const abs = _ensureInsideProject(destAbs, target);
-    if (!abs) {
-      results.push({ path: target, status: 'unsafe_path' });
-      logger.warn(`  ${target} -> unsafe_path (refused)`);
-      continue;
-    }
-    const content = entry.content;
-    if (typeof content !== 'string') {
-      results.push({ path: target, status: 'no_content' });
-      continue;
-    }
-    const scan = scanForSecrets(content);
-    if (scan.status === 'redacted' && !allowRedactions) {
-      results.push({ path: target, status: 'redacted', redactions: scan.redactions });
-      logger.warn(`  ${target} -> ${scan.redactions} secret pattern(s) detected, refused (use --allow-redactions)`);
-      continue;
-    }
-    const mode = entry.mode || 'create';
-
-    try {
-      if (mode === 'merge') {
-        if (!fs.existsSync(abs)) {
-          fs.mkdirSync(path.dirname(abs), { recursive: true });
-          fs.writeFileSync(abs, scan.redacted, 'utf8');
-          results.push({ path: target, status: 'created', bytes: Buffer.byteLength(scan.redacted, 'utf8') });
-          logger.info(`  ${target} -> created`);
-          continue;
-        }
-        const existing = fs.readFileSync(abs, 'utf8');
-        const merged = applyMerge(existing, scan.redacted, {
-          acceptedHeadings: entry.acceptedHeadings || [],
-          acceptedBullets: entry.acceptedBullets || [],
-        });
-        fs.writeFileSync(abs, merged.merged, 'utf8');
-        results.push({ path: target, status: 'merged', additions: merged.additions });
-        logger.info(`  ${target} -> merged`);
-      } else if (mode === 'side_by_side') {
-        const sideAbs = entry.absolutePath
-          ? path.resolve(entry.absolutePath)
-          : sideBySidePath(abs);
-        const guardedSide = _ensureInsideProject(destAbs, path.relative(destAbs, sideAbs));
-        if (!guardedSide) {
-          results.push({ path: target, status: 'unsafe_path' });
-          continue;
-        }
-        fs.mkdirSync(path.dirname(guardedSide), { recursive: true });
-        if (fs.existsSync(guardedSide) && !allowOverwriteSideBySide) {
-          results.push({ path: target, status: 'side_by_side_conflict' });
-          logger.warn(`  ${target} -> side_by_side_conflict (pass --overwrite to replace)`);
-          continue;
-        }
-        fs.writeFileSync(guardedSide, scan.redacted, 'utf8');
-        results.push({ path: target, status: 'side_by_side', bytes: Buffer.byteLength(scan.redacted, 'utf8') });
-        logger.info(`  ${target} -> side_by_side`);
-      } else if (mode === 'skip') {
-        results.push({ path: target, status: 'skipped' });
-      } else {
-        // 'create' or 'overwrite'
-        fs.mkdirSync(path.dirname(abs), { recursive: true });
-        const existed = fs.existsSync(abs);
-        if (existed && mode !== 'overwrite' && !yes) {
-          results.push({ path: target, status: 'refused_overwrite_without_yes' });
-          logger.warn(`  ${target} -> exists; pass --yes or rebuild manifest with mode='overwrite'`);
-          continue;
-        }
-        fs.writeFileSync(abs, scan.redacted, 'utf8');
-        results.push({ path: target, status: existed ? 'overwritten' : 'created' });
-        logger.info(`  ${target} -> ${existed ? 'overwritten' : 'created'}`);
-      }
-    } catch (err) {
-      results.push({ path: target, status: 'error', error: err.message });
-      logger.warn(`  ${target} -> error: ${err.message}`);
-    }
-  }
-  return results;
-}
-
-function sideBySidePath(abs) {
-  const dir = path.dirname(abs);
-  const base = path.basename(abs);
-  const ext = path.extname(base);
-  if (!ext) return path.join(dir, base + '.NEW');
-  return path.join(dir, base.slice(0, -ext.length) + '.NEW' + ext);
-}
-
-// Exported for the sync script + tests that want to assert the scan layer
-// stays in lock-step with app/lib/claude-code/optimal-files/secret-scan.js.
-export { scanForSecrets };

package/lib/code/codex-parser.vendored.js

@@ -1,360 +0,0 @@
-// VENDORED from app/lib/codex/parser.ts — GENERATED, do not edit by hand.
-// The CLI runs as raw Node ESM and is published without app/, so it cannot import
-// the app TypeScript source. Regenerate by compiling app/lib/codex/parser.ts.
-// See cli/lib/code/vendored.js for the same sibling-package rationale.
-
-// app/lib/codex/parser.js
-//
-// Codex CLI session JSONL parser.
-//
-// Codex writes session rollouts to `~/.codex/sessions/rollout-<ts>-<uuid>.jsonl`.
-// Each line has the shape:
-//
-//   { "timestamp": "...", "type": "session_meta"|"response_item"|...,
-//     "payload": { ... } }
-//
-// We normalize the rollout into a session object that's intentionally
-// parallel to the Claude Code parser output (app/lib/claude-code/parser.js)
-// so downstream insights, alerts, and rules engines can be reused with
-// minimal branching. The shape differs only where Codex's data model
-// fundamentally diverges from Claude's (token semantics, reasoning tokens).
-//
-// Token mapping (Codex → normalized):
-//   input_tokens            → input_tokens
-//   output_tokens           → output_tokens (excludes reasoning)
-//   cached_input_tokens     → cache_read_tokens
-//   reasoning_output_tokens → reasoning_tokens (Codex-only field)
-//   total_tokens            → recomputed at the request level for safety
-//
-// There is no Codex equivalent to Claude's `cache_creation_tokens`. We emit
-// 0 for that field on Codex sessions to keep the schema compatible.
-//
-// This parser is deliberately tolerant: malformed lines are counted in
-// `skippedLines` and never throw. It returns a partial session even when
-// the rollout was truncated mid-write.
-import fs from 'node:fs';
-import readline from 'node:readline';
-export const CODEX_PARSER_VERSION = 1;
-function safeParse(line) {
-    try {
-        return JSON.parse(line);
-    }
-    catch {
-        return null;
-    }
-}
-function previewText(value, max = 200) {
-    if (typeof value !== 'string')
-        return '';
-    return value.slice(0, max);
-}
-// Best-effort agent-kind tag for downstream branching. Always 'codex' here.
-export const CODEX_AGENT_KIND = 'codex';
-function _initState({ sourceFile, sourceMtime }) {
-    return {
-        session: {
-            agentKind: CODEX_AGENT_KIND,
-            sourceFile: sourceFile || null,
-            sourceMtime: sourceMtime || null,
-            sessionUuid: null,
-            projectSlug: null,
-            cwd: null,
-            gitBranch: null,
-            gitCommit: null,
-            gitRepoUrl: null,
-            cliVersion: null,
-            originator: null,
-            modelProvider: null,
-            modelPrimary: null,
-            startedAt: null,
-            endedAt: null,
-            parserVersion: CODEX_PARSER_VERSION,
-            // counters
-            jsonlRecords: 0,
-            responseItems: 0,
-            eventMessages: 0,
-            compactedItems: 0,
-            skippedLines: 0,
-            turnCount: 0,
-            toolCallCount: 0,
-            // token totals
-            totals: {
-                input_tokens: 0,
-                output_tokens: 0,
-                cache_read_tokens: 0,
-                cache_creation_tokens: 0, // always 0 for Codex; kept for schema parity
-                reasoning_tokens: 0,
-            },
-            // per-turn token snapshots, in arrival order
-            turns: [], // { turnId, inputTokens, outputTokens, cachedInputTokens, reasoningTokens, total, at }
-            // canonical message timeline (user + assistant + reasoning + tool_call + tool_result)
-            messages: [],
-            // tool uses across the session
-            toolUses: [],
-        },
-        seenTurnIds: new Set(),
-    };
-}
-function _handleSessionMeta(state, payload, ts) {
-    const s = state.session;
-    if (!s.sessionUuid && payload?.id)
-        s.sessionUuid = payload.id;
-    if (!s.cwd && payload?.cwd)
-        s.cwd = payload.cwd;
-    if (!s.cliVersion && payload?.cli_version)
-        s.cliVersion = payload.cli_version;
-    if (!s.originator && payload?.originator)
-        s.originator = payload.originator;
-    if (!s.modelProvider && payload?.model_provider)
-        s.modelProvider = payload.model_provider;
-    if (!s.startedAt)
-        s.startedAt = ts || payload?.timestamp || null;
-    if (payload?.git && typeof payload.git === 'object') {
-        const git = payload.git;
-        if (!s.gitBranch && git.branch)
-            s.gitBranch = git.branch;
-        if (!s.gitCommit && git.commit_hash)
-            s.gitCommit = git.commit_hash;
-        if (!s.gitRepoUrl && git.repository_url)
-            s.gitRepoUrl = git.repository_url;
-    }
-}
-function _handleResponseItem(state, payload, ts) {
-    const s = state.session;
-    s.responseItems += 1;
-    if (!payload || typeof payload !== 'object')
-        return;
-    const role = payload.role;
-    // Response items can be of several shapes:
-    //   - { role: 'user'|'assistant'|'system', content: [...] }
-    //   - { type: 'function_call', name, arguments, call_id }
-    //   - { type: 'function_call_output', call_id, output }
-    //   - { type: 'reasoning', summary: [...] }
-    if (payload.type === 'function_call' || (payload.name && payload.call_id)) {
-        s.toolCallCount += 1;
-        s.toolUses.push({
-            name: payload.name || 'unknown',
-            tool_use_id: payload.call_id || payload.id || null,
-            arguments_preview: previewText(payload.arguments, 240),
-            target: safeToolTarget(payload),
-            at: ts,
-        });
-        s.messages.push({
-            role: 'tool_call',
-            name: payload.name,
-            tool_use_id: payload.call_id || null,
-            preview: previewText(payload.arguments, 240),
-            at: ts,
-        });
-        return;
-    }
-    if (payload.type === 'function_call_output') {
-        s.messages.push({
-            role: 'tool_result',
-            tool_use_id: payload.call_id || null,
-            preview: previewText(typeof payload.output === 'string' ? payload.output : JSON.stringify(payload.output ?? ''), 240),
-            at: ts,
-        });
-        return;
-    }
-    if (payload.type === 'reasoning') {
-        // Reasoning items are first-class in Codex — we keep a stub on the
-        // timeline so downstream tools can correlate cost with thinking.
-        s.messages.push({ role: 'reasoning', preview: '(reasoning)', at: ts });
-        return;
-    }
-    if (role && Array.isArray(payload.content)) {
-        s.messages.push({
-            role,
-            preview: extractTextPreview(payload.content),
-            at: ts,
-        });
-    }
-}
-function extractTextPreview(content) {
-    for (const c of content) {
-        if (!c)
-            continue;
-        if (typeof c === 'string')
-            return previewText(c);
-        const part = c;
-        if (part.type === 'input_text' && typeof part.text === 'string')
-            return previewText(part.text);
-        if (part.type === 'output_text' && typeof part.text === 'string')
-            return previewText(part.text);
-        if (part.type === 'text' && typeof part.text === 'string')
-            return previewText(part.text);
-    }
-    return '';
-}
-function safeToolTarget(p) {
-    // Codex tools include `local_shell` (command exec) and a generic `apply_patch`
-    // among many MCP tools. We try to extract a SHORT non-secret identifier.
-    try {
-        const args = typeof p.arguments === 'string'
-            ? JSON.parse(p.arguments)
-            : p.arguments;
-        if (!args || typeof args !== 'object')
-            return null;
-        if (p.name === 'local_shell' || p.name === 'shell') {
-            const cmd = typeof args.command === 'string'
-                ? args.command
-                : Array.isArray(args.command) ? args.command.join(' ') : '';
-            const head = cmd.trim().split(/\s+/)[0] || '';
-            return head ? head.slice(0, 60) : null;
-        }
-        if (typeof args.file_path === 'string')
-            return args.file_path.slice(0, 160);
-        if (typeof args.path === 'string')
-            return args.path.slice(0, 160);
-        if (typeof args.url === 'string') {
-            try {
-                return new URL(args.url).host;
-            }
-            catch {
-                return null;
-            }
-        }
-    }
-    catch { /* fall through */ }
-    return null;
-}
-function _handleEventMsg(state, payload, ts) {
-    const s = state.session;
-    s.eventMessages += 1;
-    if (!payload || typeof payload !== 'object')
-        return;
-    const type = payload.type;
-    if (type === 'token_count') {
-        // Payload shape: { type: 'token_count', info: { total_token_usage, last_token_usage, model_context_window } }
-        const last = payload.info?.last_token_usage;
-        if (last) {
-            const input = Number(last.input_tokens) || 0;
-            const output = Number(last.output_tokens) || 0;
-            const cachedInput = Number(last.cached_input_tokens) || 0;
-            const reasoning = Number(last.reasoning_output_tokens) || 0;
-            const total = Number(last.total_tokens) || (input + output + cachedInput + reasoning);
-            s.totals.input_tokens += input;
-            s.totals.output_tokens += output;
-            s.totals.cache_read_tokens += cachedInput;
-            s.totals.reasoning_tokens += reasoning;
-            // Turn snapshot — Codex emits one token_count per model turn. We use
-            // the event ordinal as a synthetic turn id since the payload doesn't
-            // carry one. The token-count event always corresponds to one turn.
-            const turnId = `t${s.turns.length + 1}`;
-            s.turns.push({
-                turnId,
-                inputTokens: input,
-                outputTokens: output,
-                cachedInputTokens: cachedInput,
-                reasoningTokens: reasoning,
-                total,
-                at: ts,
-            });
-            s.turnCount = s.turns.length;
-        }
-        return;
-    }
-    if (type === 'session_configured') {
-        if (!s.modelPrimary && payload.model)
-            s.modelPrimary = payload.model;
-        return;
-    }
-    if (type === 'agent_message') {
-        if (typeof payload.message === 'string') {
-            s.messages.push({ role: 'assistant', preview: previewText(payload.message), at: ts });
-        }
-        return;
-    }
-    if (type === 'user_message') {
-        if (typeof payload.message === 'string') {
-            s.messages.push({ role: 'user', preview: previewText(payload.message), at: ts });
-        }
-        return;
-    }
-}
-function _handleCompacted(state, payload, ts) {
-    const s = state.session;
-    s.compactedItems += 1;
-    s.messages.push({
-        role: 'system',
-        preview: '(compacted) ' + previewText(payload?.message || '', 180),
-        at: ts,
-    });
-}
-function _processLine(state, line, lineNo) {
-    if (!line || !line.trim())
-        return;
-    const rec = safeParse(line);
-    const s = state.session;
-    if (!rec || typeof rec !== 'object') {
-        s.skippedLines += 1;
-        return;
-    }
-    s.jsonlRecords += 1;
-    const ts = typeof rec.timestamp === 'string' ? rec.timestamp : null;
-    if (ts) {
-        if (!s.startedAt || ts < s.startedAt)
-            s.startedAt = ts;
-        if (!s.endedAt || ts > s.endedAt)
-            s.endedAt = ts;
-    }
-    // RolloutLine flattens `type` to the top level (serde flatten).
-    const type = rec.type;
-    const payload = rec.payload;
-    switch (type) {
-        case 'session_meta':
-            _handleSessionMeta(state, payload, ts);
-            break;
-        case 'response_item':
-            _handleResponseItem(state, payload, ts);
-            break;
-        case 'event_msg':
-            _handleEventMsg(state, payload, ts);
-            break;
-        case 'compacted':
-            _handleCompacted(state, payload, ts);
-            break;
-        case 'turn_context':
-            // No-op for now; turn_context carries the per-turn model + tool list
-            // but we don't yet use it for normalization.
-            break;
-        default:
-            // Unknown line type — counted in jsonlRecords but no further action.
-            break;
-    }
-}
-/**
- * Parse an array of raw JSONL lines (in-memory). Returns the normalized
- * session object. The server uses this so it never touches the filesystem.
- */
-export function parseCodexSessionLines(lines, { sourceFile = null, sourceMtime = null } = {}) {
-    if (!Array.isArray(lines)) {
-        throw new TypeError('parseCodexSessionLines: lines must be an array of strings');
-    }
-    const state = _initState({ sourceFile, sourceMtime });
-    for (let i = 0; i < lines.length; i++) {
-        _processLine(state, lines[i], i + 1);
-    }
-    return state.session;
-}
-/**
- * Stream-parse a Codex JSONL file from disk. Used by the CLI ingest path.
- */
-export async function parseCodexSessionFile(filePath, { mtime } = {}) {
-    const stream = fs.createReadStream(filePath, { encoding: 'utf8' });
-    const rl = readline.createInterface({ input: stream, crlfDelay: Infinity });
-    let actualMtime = mtime;
-    if (!actualMtime) {
-        try {
-            actualMtime = fs.statSync(filePath).mtime.toISOString();
-        }
-        catch { /* keep null */ }
-    }
-    const state = _initState({ sourceFile: filePath, sourceMtime: actualMtime });
-    let lineNo = 0;
-    for await (const line of rl) {
-        _processLine(state, line, ++lineNo);
-    }
-    return state.session;
-}