@deepseek-harness-tui/dsh-tui 0.7.1 → 0.7.2

package/lib/types/dsh-adapter/sessions/digest.js

@@ -0,0 +1,224 @@
+/**
+ * What a bounded read can learn about a session log.
+ *
+ * Two windows, one at each end, and never anything in between:
+ *
+ * - The HEAD holds the session envelope, the boot policy events, and the
+ *   opening prompt. Measured across a real corpus, the first user prompt lands
+ *   within 8,107 bytes of the start (524 in its `agent/inbox/spliced` form),
+ *   so a 64 KB window carries an eightfold margin.
+ * - The TAIL holds whatever was appended most recently: the current title
+ *   (titles are re-emitted, and the last one wins), the model of the last
+ *   request, and the last exchanges for the preview.
+ *
+ * Titles carry their own provenance, so this module does not have to guess.
+ * A title written by a provider records `source.kind: 'provider'`; the TUI's
+ * own rename paths append `{ title }` with no source at all. That difference
+ * is the evidence behind {@link SessionTitle.source}, which is why the picker
+ * can dim a fallback and explain a name instead of merely displaying one.
+ *
+ * @module @deepseek-harness-tui/dsh-tui/sessions/digest
+ */
+import { basename } from 'node:path';
+import { decodeFrames, decodeTail, readWindow, walkFrames } from './frames.js';
+/** Head window budget. Eight times the measured worst-case prompt offset. */
+export const HEAD_WINDOW_BYTES = 64 * 1024;
+/** Head frame ceiling — a cost bound independent of how the bytes compress. */
+export const HEAD_MAX_FRAMES = 128;
+/** Tail window budget. Wider than the head: trailing frames carry payloads. */
+export const TAIL_WINDOW_BYTES = 128 * 1024;
+/** Longest preview excerpt kept per message, in characters. */
+const PREVIEW_CHARS = 400;
+/** The first text block of a message `content` payload. */
+function textOfContent(content) {
+    if (typeof content === 'string')
+        return content.trim() || undefined;
+    if (!Array.isArray(content))
+        return undefined;
+    for (const block of content) {
+        if (block === null || typeof block !== 'object')
+            continue;
+        const record = block;
+        if (record['type'] !== 'text')
+            continue;
+        const value = record['text'];
+        if (typeof value === 'string' && value.trim().length > 0)
+            return value.trim();
+    }
+    return undefined;
+}
+/**
+ * Whether a message's `source` marks it as typed by the person at the
+ * keyboard. Plugin injections, instruction snapshots, skill catalogues and
+ * sub-agent reports all arrive as user-role messages too, and counting them
+ * would report a conversation where none happened.
+ */
+function isHumanSource(source) {
+    if (source === undefined || source === null)
+        return true;
+    if (typeof source !== 'object')
+        return false;
+    return source['kind'] === 'user';
+}
+/** The human prompt carried by one log line, in either of its two forms. */
+function humanPrompt(line) {
+    const data = line['data'];
+    if (data === null || typeof data !== 'object')
+        return undefined;
+    const record = data;
+    if (line['type'] === 'user/message') {
+        return isHumanSource(record['source']) ? textOfContent(record['content']) : undefined;
+    }
+    // The inbox splice precedes the durable user/message and reaches the log
+    // several frames earlier, which is what keeps the head window small.
+    if (line['type'] === 'agent/inbox/spliced') {
+        const inserted = record['inserted'];
+        if (!Array.isArray(inserted))
+            return undefined;
+        for (const message of inserted) {
+            if (message === null || typeof message !== 'object')
+                continue;
+            const entry = message;
+            if (entry['role'] !== 'user' || !isHumanSource(entry['source']))
+                continue;
+            const text = textOfContent(entry['content']);
+            if (text !== undefined)
+                return text;
+        }
+    }
+    return undefined;
+}
+/** A `session/title` payload, with the provenance that classifies it. */
+function titleOf(line) {
+    if (line['type'] !== 'session/title')
+        return undefined;
+    const data = line['data'];
+    if (data === null || typeof data !== 'object')
+        return undefined;
+    const record = data;
+    const text = record['title'];
+    if (typeof text !== 'string' || text.trim().length === 0)
+        return undefined;
+    const source = record['source'];
+    const byProvider = source !== null &&
+        typeof source === 'object' &&
+        source['kind'] === 'provider';
+    return { text: text.trim(), source: byProvider ? 'auto' : 'renamed' };
+}
+/** The route recorded by a `request/context` event. */
+function modelOf(line) {
+    if (line['type'] !== 'request/context')
+        return undefined;
+    const data = line['data'];
+    if (data === null || typeof data !== 'object')
+        return undefined;
+    const model = data['model'];
+    return typeof model === 'string' && model.length > 0 ? model : undefined;
+}
+/** The label a delegated run was started under. */
+function labelOf(line) {
+    if (line['type'] !== 'subagent/descriptor')
+        return undefined;
+    const data = line['data'];
+    if (data === null || typeof data !== 'object')
+        return undefined;
+    const label = data['label'];
+    return typeof label === 'string' && label.trim().length > 0 ? label.trim() : undefined;
+}
+/** Epoch-ms of a log line, when it carries one. */
+function timeOf(line) {
+    const time = line['time'];
+    return typeof time === 'number' && Number.isFinite(time) ? time : undefined;
+}
+/**
+ * Read both windows of one session log.
+ *
+ * @param path - Absolute artifact path.
+ * @param cwd - Working directory, for the last-resort title.
+ * @returns The digest. An unreadable log still yields a usable record: the
+ *   title falls back to the directory basename and says so through its source.
+ */
+export function digestSession(path, cwd) {
+    const head = readWindow(path, HEAD_WINDOW_BYTES);
+    if (head === undefined) {
+        return { title: undefined, hasPrompt: false, model: undefined, label: undefined };
+    }
+    const headLines = decodeFrames(head.buffer, walkFrames(head.buffer, 0, HEAD_MAX_FRAMES));
+    let prompt;
+    let headTitle;
+    let label;
+    for (const line of headLines) {
+        prompt ??= humanPrompt(line);
+        headTitle ??= titleOf(line);
+        label ??= labelOf(line);
+    }
+    // Absence of a prompt only means "empty" when the window actually saw the
+    // whole log. A log too large for the window has a conversation in it by
+    // construction, and erring toward listing it is the safe direction: hiding
+    // a real session is a defect, showing a boot artifact is a nuisance.
+    const hasPrompt = prompt !== undefined || !head.whole;
+    // A head window that already covered the whole log IS the tail.
+    const tail = head.whole ? undefined : readWindow(path, TAIL_WINDOW_BYTES, true);
+    const tailLines = tail === undefined ? headLines : decodeTail(tail);
+    let tailTitle;
+    let model;
+    for (const line of tailLines) {
+        const title = titleOf(line);
+        if (title !== undefined)
+            tailTitle = title;
+        const route = modelOf(line);
+        if (route !== undefined)
+            model = route;
+    }
+    const resolved = tailTitle ??
+        headTitle ??
+        (prompt === undefined ? undefined : { text: prompt, source: 'prompt' });
+    return {
+        title: resolved ?? { text: basename(cwd), source: 'fallback' },
+        hasPrompt,
+        model,
+        label,
+    };
+}
+/**
+ * The last exchanges of a session, for the browser's preview pane.
+ *
+ * Bounded like everything else here: the preview shows the end of the
+ * conversation because that is what the tail window holds, and because the end
+ * is what tells you whether this is the session you meant.
+ *
+ * @param path - Absolute artifact path.
+ * @param limit - How many entries to keep, newest last.
+ * @returns Entries in log order.
+ */
+export function previewSession(path, limit) {
+    const window = readWindow(path, TAIL_WINDOW_BYTES, true);
+    if (window === undefined)
+        return [];
+    const lines = decodeTail(window);
+    const entries = [];
+    for (const line of lines) {
+        const data = line['data'];
+        if (data === null || typeof data !== 'object')
+            continue;
+        const record = data;
+        if (line['type'] === 'user/message') {
+            if (!isHumanSource(record['source']))
+                continue;
+            const text = textOfContent(record['content']);
+            if (text !== undefined)
+                entries.push({ role: 'user', text: text.slice(0, PREVIEW_CHARS), at: timeOf(line) });
+            continue;
+        }
+        if (line['type'] === 'assistant/message') {
+            const message = record['message'];
+            if (message === null || typeof message !== 'object')
+                continue;
+            const text = textOfContent(message['content']);
+            if (text !== undefined) {
+                entries.push({ role: 'assistant', text: text.slice(0, PREVIEW_CHARS), at: timeOf(line) });
+            }
+        }
+    }
+    return entries.slice(-limit);
+}

package/lib/types/dsh-adapter/sessions/frames.d.ts

@@ -0,0 +1,100 @@
+/** Byte range of one structurally complete frame; `end` is exclusive. */
+export interface FrameRange {
+    readonly start: number;
+    readonly end: number;
+}
+/**
+ * Locate the end of the frame starting at `start`, without decompressing it.
+ *
+ * The walk reads the Frame_Header (descriptor, optional window/dictionary/
+ * content-size fields) and then each Block_Header in turn — a 3-byte
+ * little-endian word carrying `last_block` (1 bit), `block_type` (2 bits) and
+ * `block_size` (21 bits) — until the block marked last. A `Reserved` block
+ * type means these bytes are not a frame at all, which is how a coincidental
+ * magic gets rejected.
+ *
+ * @param buffer - Bytes available to the reader (may end mid-frame).
+ * @param start - Offset of the candidate frame's magic.
+ * @returns The frame's exclusive end offset, or -1 when the bytes at `start`
+ *   are not a structurally complete frame within `buffer`.
+ */
+export declare function frameEnd(buffer: Buffer, start: number): number;
+/**
+ * Walk complete frames forward from `from`.
+ *
+ * @param buffer - Bytes to walk.
+ * @param from - Offset to start at (must be a frame boundary).
+ * @param maxFrames - Stop after this many frames; the reader's cost ceiling.
+ * @returns Complete frames in file order. A window that ends mid-frame simply
+ *   yields one fewer frame — the partial tail is never reported as complete.
+ */
+export declare function walkFrames(buffer: Buffer, from?: number, maxFrames?: number): FrameRange[];
+/**
+ * Re-synchronize on a frame boundary inside a window that starts mid-frame.
+ *
+ * A tail window has no boundary to start from, so the only anchor is the one
+ * structural fact we know about the whole file: its last frame ends exactly at
+ * EOF. Every magic candidate is tried in file order, and the first one whose
+ * frame chain lands precisely on the window's end is the true boundary — a
+ * coincidental magic would have to spell a valid block chain of exactly the
+ * right total length to be mistaken for one.
+ *
+ * @param buffer - A window whose last byte is the file's last byte.
+ * @returns Frames from the earliest recoverable boundary, or [] when the
+ *   window holds no complete frame.
+ */
+export declare function resyncFrames(buffer: Buffer): FrameRange[];
+/** One decoded log line, still untyped — the caller owns interpretation. */
+export type LogLine = Record<string, unknown>;
+/**
+ * Decode frames to JSON log lines, tolerantly.
+ *
+ * A frame that fails to decompress or a line that fails to parse is skipped
+ * rather than thrown: a log being appended to right now can hold a frame
+ * flushed without its final checksum, and a torn tail is the backend's own
+ * documented recovery case. A picker label is read-only UI state — degrading
+ * to a fallback title beats refusing to list the session.
+ *
+ * @param buffer - Bytes the frames index into.
+ * @param frames - Complete frame ranges within `buffer`.
+ * @returns Parsed envelopes in log order.
+ */
+export declare function decodeFrames(buffer: Buffer, frames: readonly FrameRange[]): LogLine[];
+/** A file's size and last-write time, read once for both. */
+export interface FileFacts {
+    readonly bytes: number;
+    readonly modifiedAt: number;
+}
+/**
+ * Size and mtime of a log, or undefined when it is gone.
+ * @param path - Absolute artifact path.
+ */
+export declare function fileFacts(path: string): FileFacts | undefined;
+/**
+ * Read a window from one end of a file without loading the whole thing.
+ *
+ * @param path - Absolute artifact path.
+ * @param bytes - Window budget; the whole file is read when it is smaller.
+ * @param end - Read the last `bytes` instead of the first.
+ * @returns The window, plus whether it covers the entire file (which tells a
+ *   head reader that its last frame cannot be truncated).
+ */
+export declare function readWindow(path: string, bytes: number, end?: boolean): {
+    buffer: Buffer;
+    whole: boolean;
+} | undefined;
+/**
+ * Decode a window read from the END of a file.
+ *
+ * A tail window has no frame boundary to start from unless it happens to
+ * cover the whole file, so it re-synchronizes; a whole-file window is simply
+ * walked.
+ *
+ * @param window - A window whose last byte is the file's last byte.
+ * @returns Log lines from the trailing frames, oldest first.
+ */
+export declare function decodeTail(window: {
+    buffer: Buffer;
+    whole: boolean;
+}): LogLine[];
+//# sourceMappingURL=frames.d.ts.map

package/lib/types/dsh-adapter/sessions/frames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frames.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/sessions/frames.ts"],"names":[],"mappings":"AAuCA,yEAAyE;AACzE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAsC9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,IAAI,SAAI,EACR,SAAS,SAA2B,GACnC,UAAU,EAAE,CAUd;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,CAQzD;AAED,4EAA4E;AAC5E,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE7C;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,EAAE,CAsBrF;AAED,6DAA6D;AAC7D,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAO7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,GAAG,UAAQ,GACV;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAwBhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,EAAE,CAKhF"}

package/lib/types/dsh-adapter/sessions/frames.js

@@ -0,0 +1,246 @@
+/**
+ * Bounded reads over the JSONL backend's concatenated-Zstandard session logs.
+ *
+ * The backend stores one session as a chain of independently decodable zstd
+ * frames — one per durable append batch — so a log grows by concatenation and
+ * never rewrites committed bytes. That container is what makes a *bounded*
+ * read possible at all: the first few frames hold the session header and its
+ * opening prompt, the last few hold whatever was appended most recently, and
+ * nothing in between has to be touched to learn either.
+ *
+ * Why this module walks frames structurally instead of scanning for the frame
+ * magic: a magic scan is a heuristic (any four bytes of compressed payload can
+ * spell `FD2FB528`), it costs a comparison per byte, and it cannot answer the
+ * one question a bounded reader must ask — "is the frame at the end of my
+ * window complete, or did I cut it in half?". Walking the frame header and its
+ * block chain, as RFC 8878 §3.1.1 defines them, answers that exactly and jumps
+ * frame-to-frame instead of byte-to-byte. Measured over a real 31 MB corpus of
+ * 49 logs and 75,263 frames: identical frame set to a magic scan, zero false
+ * positives, and 4× faster (51 ms vs 215 ms).
+ *
+ * Why not the backend's own `scanZstdFrames`: it exists, but the package's
+ * `exports` map publishes only the service class, so reaching it would mean
+ * importing through `lib/` past the export map — coupling to a private path
+ * that upstream is free to move. The frame container is a published format
+ * (RFC 8878), so re-deriving the walk against the spec is the stable choice.
+ *
+ * Why not Node's own zstd APIs: both `zstdDecompressSync` and
+ * `createZstdDecompress` stop at the end of the FIRST frame — a 4.2 MB,
+ * 14k-event log decodes to exactly one line through either. They decode a
+ * frame; they do not traverse a chain.
+ *
+ * @module @deepseek-harness-tui/dsh-tui/sessions/frames
+ */
+import { closeSync, openSync, readSync, statSync } from 'node:fs';
+import { zstdDecompressSync } from 'node:zlib';
+/** Zstandard frame magic, little-endian (RFC 8878 §3.1.1.1). */
+const ZSTD_MAGIC = 0xfd2fb528;
+/**
+ * Locate the end of the frame starting at `start`, without decompressing it.
+ *
+ * The walk reads the Frame_Header (descriptor, optional window/dictionary/
+ * content-size fields) and then each Block_Header in turn — a 3-byte
+ * little-endian word carrying `last_block` (1 bit), `block_type` (2 bits) and
+ * `block_size` (21 bits) — until the block marked last. A `Reserved` block
+ * type means these bytes are not a frame at all, which is how a coincidental
+ * magic gets rejected.
+ *
+ * @param buffer - Bytes available to the reader (may end mid-frame).
+ * @param start - Offset of the candidate frame's magic.
+ * @returns The frame's exclusive end offset, or -1 when the bytes at `start`
+ *   are not a structurally complete frame within `buffer`.
+ */
+export function frameEnd(buffer, start) {
+    let at = start;
+    if (at < 0 || at + 5 > buffer.length)
+        return -1;
+    if (buffer.readUInt32LE(at) !== ZSTD_MAGIC)
+        return -1;
+    at += 4;
+    const descriptor = buffer[at];
+    at += 1;
+    const contentSizeFlag = descriptor >> 6;
+    const singleSegment = (descriptor >> 5) & 1;
+    const hasChecksum = (descriptor >> 2) & 1;
+    const dictionaryIdFlag = descriptor & 3;
+    // Window_Descriptor is present only when the frame is not single-segment.
+    if (singleSegment === 0)
+        at += 1;
+    at += [0, 1, 2, 4][dictionaryIdFlag];
+    // Frame_Content_Size: absent (0) unless single-segment, where it is 1 byte.
+    at += contentSizeFlag === 0 ? singleSegment : [0, 2, 4, 8][contentSizeFlag];
+    if (at > buffer.length)
+        return -1;
+    for (;;) {
+        if (at + 3 > buffer.length)
+            return -1;
+        const header = buffer[at] | (buffer[at + 1] << 8) | (buffer[at + 2] << 16);
+        at += 3;
+        const isLast = header & 1;
+        const blockType = (header >> 1) & 3;
+        const blockSize = header >>> 3;
+        // 3 = Reserved. Never emitted by an encoder, so this is not a frame.
+        if (blockType === 3)
+            return -1;
+        // An RLE block stores one byte and repeats it `blockSize` times; Raw and
+        // Compressed blocks store `blockSize` bytes verbatim.
+        at += blockType === 1 ? 1 : blockSize;
+        if (at > buffer.length)
+            return -1;
+        if (isLast === 1)
+            break;
+    }
+    if (hasChecksum === 1)
+        at += 4;
+    return at <= buffer.length ? at : -1;
+}
+/**
+ * Walk complete frames forward from `from`.
+ *
+ * @param buffer - Bytes to walk.
+ * @param from - Offset to start at (must be a frame boundary).
+ * @param maxFrames - Stop after this many frames; the reader's cost ceiling.
+ * @returns Complete frames in file order. A window that ends mid-frame simply
+ *   yields one fewer frame — the partial tail is never reported as complete.
+ */
+export function walkFrames(buffer, from = 0, maxFrames = Number.POSITIVE_INFINITY) {
+    const frames = [];
+    let at = from;
+    while (at < buffer.length && frames.length < maxFrames) {
+        const end = frameEnd(buffer, at);
+        if (end < 0)
+            break;
+        frames.push({ start: at, end });
+        at = end;
+    }
+    return frames;
+}
+/**
+ * Re-synchronize on a frame boundary inside a window that starts mid-frame.
+ *
+ * A tail window has no boundary to start from, so the only anchor is the one
+ * structural fact we know about the whole file: its last frame ends exactly at
+ * EOF. Every magic candidate is tried in file order, and the first one whose
+ * frame chain lands precisely on the window's end is the true boundary — a
+ * coincidental magic would have to spell a valid block chain of exactly the
+ * right total length to be mistaken for one.
+ *
+ * @param buffer - A window whose last byte is the file's last byte.
+ * @returns Frames from the earliest recoverable boundary, or [] when the
+ *   window holds no complete frame.
+ */
+export function resyncFrames(buffer) {
+    for (let at = 0; at + 4 <= buffer.length; at++) {
+        if (buffer.readUInt32LE(at) !== ZSTD_MAGIC)
+            continue;
+        const frames = walkFrames(buffer, at);
+        const last = frames[frames.length - 1];
+        if (last !== undefined && last.end === buffer.length)
+            return frames;
+    }
+    return [];
+}
+/**
+ * Decode frames to JSON log lines, tolerantly.
+ *
+ * A frame that fails to decompress or a line that fails to parse is skipped
+ * rather than thrown: a log being appended to right now can hold a frame
+ * flushed without its final checksum, and a torn tail is the backend's own
+ * documented recovery case. A picker label is read-only UI state — degrading
+ * to a fallback title beats refusing to list the session.
+ *
+ * @param buffer - Bytes the frames index into.
+ * @param frames - Complete frame ranges within `buffer`.
+ * @returns Parsed envelopes in log order.
+ */
+export function decodeFrames(buffer, frames) {
+    const lines = [];
+    for (const frame of frames) {
+        let text;
+        try {
+            text = zstdDecompressSync(buffer.subarray(frame.start, frame.end)).toString('utf8');
+        }
+        catch {
+            continue; // incomplete flush or torn frame — the rest of the log stands
+        }
+        for (const line of text.split('\n')) {
+            if (line.length === 0)
+                continue;
+            try {
+                const parsed = JSON.parse(line);
+                if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                    lines.push(parsed);
+                }
+            }
+            catch {
+                // A half-written line at the tail; earlier lines remain valid.
+            }
+        }
+    }
+    return lines;
+}
+/**
+ * Size and mtime of a log, or undefined when it is gone.
+ * @param path - Absolute artifact path.
+ */
+export function fileFacts(path) {
+    try {
+        const stats = statSync(path);
+        return { bytes: stats.size, modifiedAt: stats.mtimeMs };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Read a window from one end of a file without loading the whole thing.
+ *
+ * @param path - Absolute artifact path.
+ * @param bytes - Window budget; the whole file is read when it is smaller.
+ * @param end - Read the last `bytes` instead of the first.
+ * @returns The window, plus whether it covers the entire file (which tells a
+ *   head reader that its last frame cannot be truncated).
+ */
+export function readWindow(path, bytes, end = false) {
+    const facts = fileFacts(path);
+    if (facts === undefined)
+        return undefined;
+    const length = Math.min(bytes, facts.bytes);
+    if (length === 0)
+        return { buffer: Buffer.alloc(0), whole: true };
+    const buffer = Buffer.alloc(length);
+    let handle;
+    try {
+        handle = openSync(path, 'r');
+    }
+    catch {
+        return undefined;
+    }
+    let read;
+    try {
+        read = readSync(handle, buffer, 0, length, end ? facts.bytes - length : 0);
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        closeSync(handle);
+    }
+    // A short read is not an error: the frame walk simply sees fewer bytes and
+    // reports one fewer complete frame. Reporting `whole` honestly is what
+    // matters — a tail reader must know whether it may assume a boundary.
+    return { buffer: read === length ? buffer : buffer.subarray(0, read), whole: read === facts.bytes };
+}
+/**
+ * Decode a window read from the END of a file.
+ *
+ * A tail window has no frame boundary to start from unless it happens to
+ * cover the whole file, so it re-synchronizes; a whole-file window is simply
+ * walked.
+ *
+ * @param window - A window whose last byte is the file's last byte.
+ * @returns Log lines from the trailing frames, oldest first.
+ */
+export function decodeTail(window) {
+    return decodeFrames(window.buffer, window.whole ? walkFrames(window.buffer) : resyncFrames(window.buffer));
+}

package/lib/types/dsh-adapter/sessions/header.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Reading the persistence header — total functions over foreign data.
+ *
+ * `sessionPersistence.list()` is a service resolved from the running context,
+ * so its results are foreign values that happen to be typed. Every accessor
+ * here therefore narrows structurally and returns a fallback rather than
+ * throwing: one malformed header must cost that session its metadata, never
+ * the whole listing. This mirrors the discipline the trajectory guards already
+ * apply to session events.
+ *
+ * @module @deepseek-harness-tui/dsh-tui/sessions/header
+ */
+import type { SessionKind } from './types.js';
+/** The header fields this feature reads, all optional at runtime. */
+export interface RawSessionHeader {
+    readonly id: string;
+    readonly cwd: string | undefined;
+    readonly createdAt: number | undefined;
+    readonly parentSession: string | undefined;
+    readonly origin: string | undefined;
+    readonly delegationDepth: number | undefined;
+    readonly seedLength: number | undefined;
+    readonly agentPreset: string | undefined;
+}
+/**
+ * Narrow one listed header.
+ *
+ * @param value - A header as the persistence service returned it.
+ * @returns The fields this feature uses, or undefined when the value carries
+ *   no usable session id — the one field nothing can substitute for.
+ */
+export declare function readHeader(value: unknown): RawSessionHeader | undefined;
+/**
+ * Decide what a session is, from its header alone.
+ *
+ * Precedence is `origin` first, lineage second, and that order is the whole
+ * correctness argument: a `/rewind` fork records `parentSession` exactly like
+ * a delegated run does, and only `origin` separates them. Upstream documents
+ * `origin` as "coarse product classification for a session created as a
+ * subagent child … presentation metadata", which is precisely this decision.
+ *
+ * `delegationDepth` is optional upstream, so a sub-agent whose header omits it
+ * is reported at depth 1: it is a delegated child by `origin`, and 1 is the
+ * shallowest depth that can be.
+ *
+ * @param header - A narrowed header.
+ * @returns The session's kind.
+ */
+export declare function classify(header: RawSessionHeader): SessionKind;
+//# sourceMappingURL=header.d.ts.map

package/lib/types/dsh-adapter/sessions/header.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"header.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/sessions/header.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;CACzC;AAYD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAevE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,CAY9D"}