@deksden-com/dd-flow-cli 0.4.2 → 0.6.0

package/dist/services/hooks.js

@@ -8,10 +8,9 @@ import { parseJsonObject } from "../shared/json.js";
 import { ensureDir, resolveProjectRoot } from "../storage/paths.js";
 import { appendAudit } from "./audit.js";
 import { requireProjectByRoot } from "./projects.js";
-import { activeFlowSessionsForProject, confirmPendingFlowSessionBinding, flowSessionById, flowSessionPayloadFromRegisterCommand, recordPendingFlowSessionBinding, updateFlowSessionContinuation } from "./sessions.js";
+import { activeFlowSessionsForProject, bindObservedFlowSession, flowSessionPayloadFromRegisterCommand, recordFlowSessionObservation } from "./sessions.js";
 const defaultProfileName = "default";
 const maxSanitizedSummaryLength = 1600;
-const stopLoopLimit = 3;
 const sharedEntries = [
     "auth.json",
     "auth.bk",
@@ -197,7 +196,7 @@ export function getCodexHooksStatus(context, input) {
         };
     }
     const status = hookFileStatus(location.hooksPath, project.root);
-    const recorded = hookInstallation(context, project.id, installationScope(target, location.profile));
+    const recorded = hookInstallation(context, project.id, installationScope(target, location.profile, location.hooksPath));
     const driftStatus = status.installed ? "none" : recorded?.installed === 1 ? "drifted" : status.drift_status;
     return {
         ok: true,
@@ -225,7 +224,7 @@ export function installCodexHooks(context, input) {
     const nextConfig = mergeHooksConfig(existing, project.root);
     ensureDir(path.dirname(location.hooksPath));
     writeJsonFile(location.hooksPath, nextConfig);
-    recordHookInstallation(context, project.id, installationScope(target, location.profile), location.hooksPath, true, "none");
+    recordHookInstallation(context, project.id, installationScope(target, location.profile, location.hooksPath), location.hooksPath, true, "none");
     appendAudit(context, {
         projectId: project.id,
         eventType: "codex_hooks.installed",
@@ -257,7 +256,7 @@ export function removeCodexHooks(context, input) {
     const nextConfig = removeManagedHooks(existing, project.root);
     ensureDir(path.dirname(location.hooksPath));
     writeJsonFile(location.hooksPath, nextConfig);
-    recordHookInstallation(context, project.id, installationScope(target, location.profile), location.hooksPath, false, "not_installed");
+    recordHookInstallation(context, project.id, installationScope(target, location.profile, location.hooksPath), location.hooksPath, false, "not_installed");
     appendAudit(context, {
         projectId: project.id,
         eventType: "codex_hooks.removed",
@@ -266,49 +265,75 @@ export function removeCodexHooks(context, input) {
     return { ok: true, installed: false, target, profile: location.profile, hooks_path: location.hooksPath, backup, had_managed: hadManaged };
 }
 export function handleCodexHook(context, input) {
-    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     const payload = parseJsonObject(input.stdin || "{}", "codex hook stdin");
     const eventName = input.event || stringValue(payload.hook_event_name) || "Unknown";
+    if (eventName !== "PreToolUse") {
+        return { ok: true, observed: false, reason: "event_not_participating", event: eventName };
+    }
     const sessionId = stringValue(payload.session_id);
     const turnId = stringValue(payload.turn_id);
     const toolName = stringValue(payload.tool_name) ?? toolNameFromPayload(payload);
     const command = commandFromPayload(payload);
+    if (!command)
+        return { ok: true, observed: false, reason: "non_bash_tool" };
+    const flowPayload = flowSessionPayloadFromRegisterCommand(command);
+    const bootstrapStageStart = /\bdd-flow\s+stage\s+start\b/.test(command) && /(?:^|\s)--bootstrap(?:\s|$)/.test(command);
+    if (!flowPayload && !bootstrapStageStart)
+        return { ok: true, observed: false, reason: "event_not_participating", event: eventName };
+    const project = projectForHook(context, input.projectRoot, stringValue(payload.cwd));
+    if (!project)
+        return { ok: true, observed: false, reason: "unrelated_cwd" };
     const binding = sessionId ? upsertSessionBindingFromPayload(context, project, sessionId, payload) : undefined;
-    const preToolUseDecision = eventName === "PreToolUse" && command
-        ? preToolUseGuard(context, project, sessionId ?? null, payload, command)
-        : undefined;
-    if (eventName === "PreToolUse" && sessionId && command) {
-        recordPendingFlowSessionBinding(context, project, {
-            sessionId,
-            command,
-            cwd: stringValue(payload.cwd),
-            transcriptPath: stringValue(payload.transcript_path),
-            turnId: turnId ?? undefined
-        });
-    }
-    const confirmedFlowSession = eventName === "PostToolUse" && sessionId && toolSucceeded(payload)
-        ? confirmPendingFlowSessionBinding(context, project, { sessionId })
+    const observedSession = flowPayload
+        ? bindObservedFlowSession(context, project, flowPayload, sessionId ?? flowPayload.session_id ?? undefined)
         : undefined;
-    const existingFlowSession = sessionId ? flowSessionById(context, project.id, sessionId) : undefined;
-    const boundProtocol = eventName === "PostToolUse" && sessionId ? bindProtocolFromToolEvent(context, project, sessionId, payload) : binding;
-    const protocolId = confirmedFlowSession?.protocol_id ?? existingFlowSession?.protocol_id ?? boundProtocol?.protocol_id ?? binding?.protocol_id ?? null;
-    recordHookEvent(context, {
+    const effectiveSessionId = observedSession?.session_id ?? sessionId ?? null;
+    const protocolId = observedSession?.protocol_id ?? binding?.protocol_id ?? null;
+    const eventKey = hookEventKey(payload, eventName, toolName, command);
+    const inserted = recordHookEvent(context, {
         projectId: project.id,
         protocolId,
-        sessionId: sessionId ?? null,
+        sessionId: effectiveSessionId,
         turnId: turnId ?? null,
         eventName,
         toolName: toolName ?? null,
         status: "observed",
-        payload
+        payload,
+        eventKey
     });
-    if (eventName === "Stop") {
-        return stopDecision(context, project, sessionId ?? null);
-    }
-    if (preToolUseDecision) {
-        return preToolUseDecision;
+    if (effectiveSessionId) {
+        recordFlowSessionObservation(context, {
+            projectId: project.id,
+            sessionId: effectiveSessionId,
+            runId: observedSession?.run_id ?? null,
+            protocolId,
+            cwd: stringValue(payload.cwd) ?? null,
+            toolName: toolName ?? null,
+            eventKey
+        });
     }
-    return hookContinue(eventName, protocolId);
+    return {
+        ok: true,
+        observed: inserted,
+        duplicate: !inserted,
+        event_key: eventKey,
+        session_id: effectiveSessionId,
+        protocol_id: protocolId,
+        ...(sessionId
+            ? {
+                hookSpecificOutput: {
+                    hookEventName: "PreToolUse",
+                    permissionDecision: "allow",
+                    updatedInput: { command: commandWithSessionId(command, sessionId) }
+                }
+            }
+            : {})
+    };
+}
+function commandWithSessionId(command, sessionId) {
+    if (/(?:^|\s)--session-id(?:=|\s)/.test(command))
+        return command;
+    return `${command} --session-id ${JSON.stringify(sessionId)}`;
 }
 export function hookStatusForProject(context, projectId) {
     return context.db.all(`SELECT scope, config_path, content_hash, installed, drift_status, updated_at
@@ -438,13 +463,10 @@ function sharedEntryStatus(sourceHome, targetHome) {
         };
     });
 }
-function expectedHooksConfig(projectRoot) {
+function expectedHooksConfig(_projectRoot) {
     return {
         hooks: {
-            SessionStart: [hookEntry("startup|resume", hookCommand("SessionStart", projectRoot), "dd-flow session binding")],
-            PreToolUse: [hookEntry("Bash", hookCommand("PreToolUse", projectRoot), "dd-flow command guard")],
-            PostToolUse: [hookEntry("Bash", hookCommand("PostToolUse", projectRoot), "dd-flow command observer")],
-            Stop: [{ hooks: [commandHook(hookCommand("Stop", projectRoot), "dd-flow continuation guard")] }]
+            PreToolUse: [hookEntry("Bash", hookCommand("PreToolUse"), "dd-flow runtime observation")]
         }
     };
 }
@@ -454,8 +476,8 @@ function hookEntry(matcher, command, statusMessage) {
 function commandHook(command, statusMessage) {
     return { type: "command", command, timeout: 5, statusMessage };
 }
-function hookCommand(event, projectRoot) {
-    return `dd-flow codex hook handle --event ${event} --project-root ${JSON.stringify(projectRoot)} --json`;
+function hookCommand(event) {
+    return `PATH="\${HOME}/Library/pnpm:/opt/homebrew/bin:/usr/local/bin:\${PATH}" dd-flow codex hook handle --event ${event} --json`;
 }
 function resolveHookTarget(target) {
     if (!target || target === "isolated") {
@@ -493,7 +515,7 @@ function requireHookLocation(context, project, target, profile) {
 }
 function hookFileStatus(hooksPath, projectRoot) {
     const existing = readJsonIfExists(hooksPath);
-    const installed = existing ? hasExpectedHooks(existing, projectRoot) : false;
+    const installed = existing ? hasExpectedHooks(existing) : false;
     const managed = existing ? hasManagedHooks(existing, projectRoot) : false;
     return {
         installed,
@@ -537,20 +559,20 @@ function removeManagedHooks(existing, projectRoot) {
     }
     return { ...existing, hooks: nextHooks };
 }
-function hasExpectedHooks(existing, projectRoot) {
+function hasExpectedHooks(existing) {
     const commands = collectHookCommands(existing);
-    return expectedCommands(projectRoot).every((command) => commands.includes(command));
+    return expectedCommands().every((command) => commands.includes(command));
 }
 function hasManagedHooks(existing, projectRoot) {
     return collectHookCommands(existing).some((command) => command.includes("dd-flow codex hook handle") &&
-        (command.includes(`--project-root ${JSON.stringify(projectRoot)}`) || command.includes(projectRoot)));
+        (command.includes("--event PreToolUse") || command.includes(`--project-root ${JSON.stringify(projectRoot)}`) || command.includes(projectRoot)));
 }
-function expectedCommands(projectRoot) {
-    return ["SessionStart", "PreToolUse", "PostToolUse", "Stop"].map((event) => hookCommand(event, projectRoot));
+function expectedCommands() {
+    return [hookCommand("PreToolUse")];
 }
 function entryHasManagedCommand(entry, projectRoot) {
     return collectHookCommands(entry).some((command) => command.includes("dd-flow codex hook handle") &&
-        (command.includes(`--project-root ${JSON.stringify(projectRoot)}`) || command.includes(projectRoot)));
+        (command.includes("--event PreToolUse") || command.includes(`--project-root ${JSON.stringify(projectRoot)}`) || command.includes(projectRoot)));
 }
 function collectHookCommands(value) {
     if (Array.isArray(value)) {
@@ -627,8 +649,8 @@ function recordHookInstallation(context, projectId, scope, configPath, installed
        drift_status = excluded.drift_status,
        updated_at = excluded.updated_at`, [projectId, scope, configPath, hashObject(readJsonIfExists(configPath) ?? {}), installed ? 1 : 0, driftStatus, now, now]);
 }
-function installationScope(target, profile) {
-    return target === "isolated" ? `isolated:${profile}` : "default";
+function installationScope(target, profile, hooksPath) {
+    return target === "isolated" ? `isolated:${profile}` : `default:${path.dirname(hooksPath)}`;
 }
 function upsertSessionBindingFromPayload(context, project, sessionId, payload) {
     const existing = sessionBinding(context, project.id, sessionId);
@@ -645,213 +667,54 @@ function upsertSessionBindingFromPayload(context, project, sessionId, payload) {
        updated_at = excluded.updated_at`, [sessionId, project.id, cwd, transcriptPath, now, now]);
     return sessionBinding(context, project.id, sessionId);
 }
-function bindProtocolFromToolEvent(context, project, sessionId, payload) {
-    if (!toolSucceeded(payload)) {
-        return sessionBinding(context, project.id, sessionId);
-    }
-    const command = commandFromPayload(payload);
-    const handshakeId = command ? handshakeFromCommand(command) : null;
-    if (!handshakeId) {
-        return sessionBinding(context, project.id, sessionId);
-    }
-    const protocol = context.db.get("SELECT id, handshake_id FROM protocols WHERE project_id = ? AND (handshake_id = ? OR id = ?) ORDER BY updated_at DESC LIMIT 1", [project.id, handshakeId, handshakeId.startsWith("PRT-") ? handshakeId : `PRT-${handshakeId}`]);
-    if (!protocol) {
-        return sessionBinding(context, project.id, sessionId);
-    }
-    context.db.run(`UPDATE codex_session_bindings
-     SET protocol_id = ?, handshake_id = ?, status = 'active', updated_at = ?
-     WHERE project_id = ? AND session_id = ?`, [protocol.id, protocol.handshake_id, context.now(), project.id, sessionId]);
-    appendAudit(context, {
-        protocolId: protocol.id,
-        projectId: project.id,
-        eventType: "codex_session.bound",
-        payload: { project_id: project.id, protocol_id: protocol.id, handshake_id: protocol.handshake_id, session_id: sessionId }
-    });
-    return sessionBinding(context, project.id, sessionId);
-}
 function sessionBinding(context, projectId, sessionId) {
     return context.db.get("SELECT * FROM codex_session_bindings WHERE project_id = ? AND session_id = ?", [projectId, sessionId]);
 }
 function recordHookEvent(context, input) {
+    const existing = context.db.get("SELECT id FROM codex_hook_events WHERE project_id = ? AND event_key = ?", [input.projectId, input.eventKey]);
+    if (existing)
+        return false;
     context.db.run(`INSERT INTO codex_hook_events
-      (project_id, protocol_id, session_id, turn_id, event_name, tool_name, status, sanitized_summary, created_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+      (project_id, protocol_id, session_id, turn_id, event_key, event_name, tool_name, status, sanitized_summary, created_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
         input.projectId,
         input.protocolId,
         input.sessionId,
         input.turnId,
+        input.eventKey,
         input.eventName,
         input.toolName,
         input.status,
         sanitizedSummary(input.payload),
         context.now()
     ]);
+    return true;
 }
-function stopDecision(context, project, sessionId) {
-    if (!sessionId) {
-        return {};
-    }
-    const session = flowSessionById(context, project.id, sessionId);
-    if (!session || ["waiting_user", "blocked", "stopping", "stopped", "closed"].includes(session.status)) {
-        return {};
-    }
-    if (session.protocol_id && protocolAllowsStop(context, project.id, session.protocol_id)) {
-        return {};
-    }
-    if (session.flow_kind === "merge_worker" && session.continuation_policy === "merge_queue") {
-        return stopContinuationDecision(context, project.id, sessionId, `merge-worker:${session.worker_id ?? session.session_id}:${session.next_action ?? "wait-next"}`, `Continue dd-flow merge worker ${session.worker_id ?? session.session_id}: run .memory-bank/dd-flow/merge-start.md and continue dd-flow merge-queue wait-next from the registered merge workspace. Use dd-flow session stop-worker to stop this worker.`, { limit: null });
-    }
-    if (session.flow_kind === "merge_job" && session.continuation_policy === "merge_job") {
-        return stopContinuationDecision(context, project.id, sessionId, `merge-job:${session.protocol_id ?? session.session_id}:${session.next_action ?? "none"}`, `Continue dd-flow merge job ${session.protocol_id ?? ""}: complete merge work, close the protocol, and report terminal state.`);
-    }
-    const nextAction = session.next_action ?? nextActionFromProtocol(context, project.id, session.protocol_id);
-    if (!nextAction || nextAction === "none" || session.continuation_policy === "none") {
-        return {};
-    }
-    return stopContinuationDecision(context, project.id, sessionId, `${session.flow_kind}:${session.protocol_id ?? session.session_id}:${nextAction}`, `Continue dd-flow ${session.flow_kind}${session.protocol_id ? ` ${session.protocol_id}` : ""}: ${nextAction}`);
-}
-function nextActionFromProtocol(context, projectId, protocolId) {
-    if (!protocolId) {
-        return null;
-    }
-    const protocol = context.db.get("SELECT id, status, stage, next_action FROM protocols WHERE project_id = ? AND id = ?", [projectId, protocolId]);
-    if (!protocol) {
-        return null;
-    }
-    if (["waiting_for_user", "blocked", "closed", "cancelled"].includes(protocol.stage) || ["waiting_for_user", "blocked", "closed", "cancelled"].includes(protocol.status)) {
-        return null;
-    }
-    return protocol.next_action;
-}
-function protocolAllowsStop(context, projectId, protocolId) {
-    const protocol = context.db.get("SELECT status, stage FROM protocols WHERE project_id = ? AND id = ?", [projectId, protocolId]);
-    return Boolean(protocol && (["closed", "cancelled"].includes(protocol.status) || ["closed", "cancelled"].includes(protocol.stage)));
-}
-function stopContinuationDecision(context, projectId, sessionId, actionKey, reason, options = {}) {
-    const nextCount = updateFlowSessionContinuation(context, projectId, sessionId, actionKey);
-    const limit = options.limit === undefined ? stopLoopLimit : options.limit;
-    if (limit !== null && nextCount > limit) {
-        return {};
-    }
-    return { decision: "block", reason };
-}
-function preToolUseGuard(context, project, sessionId, payload, command) {
-    const cwd = stringValue(payload.cwd);
-    const blockedTarget = cwd ? selfWorktreeRemovalTarget(command, cwd) : null;
-    if (!blockedTarget) {
-        const roleDecision = mergeRoleGuard(context, project, sessionId, command);
-        if (roleDecision) {
-            return roleDecision;
-        }
+function projectForHook(context, explicitRoot, cwd) {
+    if (explicitRoot)
+        return requireProjectByRoot(context, resolveProjectRoot(explicitRoot));
+    if (!cwd)
         return undefined;
-    }
-    return {
-        decision: "block",
-        reason: `Refusing to remove the current Codex session worktree (${blockedTarget}). Restart or run cleanup from the stable project root or a separate cleanup session.`
-    };
-}
-function mergeRoleGuard(context, project, sessionId, command) {
-    const session = sessionId ? flowSessionById(context, project.id, sessionId) : undefined;
-    const mergeSessionKinds = ["merge_worker", "merge_job"];
-    const isMergeRole = session ? mergeSessionKinds.includes(session.flow_kind) : false;
-    const registerPayload = safeFlowSessionPayloadFromCommand(command);
-    if (registerPayload && mergeSessionKinds.includes(registerPayload.flow_kind)) {
-        if (session && !mergeSessionKinds.includes(session.flow_kind)) {
-            return blockMergeRole("A non-merge Codex session cannot re-register itself as a merge worker/job.");
-        }
-        if (registerPayload.flow_kind === "merge_job" && !claimedMergeJobMatches(context, project.id, registerPayload.protocol_id, registerPayload.worker_id)) {
-            return blockMergeRole("A merge_job session requires an already claimed merge queue job for the same protocol and worker_id.");
-        }
-    }
-    const mergeQueueAction = mergeQueueMutation(command);
-    if (mergeQueueAction) {
-        if (mergeQueueAction === "next" || mergeQueueAction === "wait-next") {
-            return session?.flow_kind === "merge_worker" ? undefined : blockMergeRole("Only a registered merge_worker session may claim or wait for merge queue jobs.");
-        }
-        return session?.flow_kind === "merge_job" ? undefined : blockMergeRole("Only a registered merge_job session may complete or fail a claimed merge queue job.");
-    }
-    if (mergeLaneLockMutation(command)) {
-        return isMergeRole ? undefined : blockMergeRole("Only registered merge sessions may mutate the merge lane lock.");
-    }
-    if (/\bgit\s+merge\b/.test(command)) {
-        return session?.flow_kind === "merge_job" ? undefined : blockMergeRole("Only a registered merge_job session may run git merge.");
-    }
-    return undefined;
-}
-function blockMergeRole(reason) {
-    return { decision: "block", reason };
-}
-function safeFlowSessionPayloadFromCommand(command) {
-    try {
-        return flowSessionPayloadFromRegisterCommand(command);
-    }
-    catch {
-        return undefined;
-    }
-}
-function claimedMergeJobMatches(context, projectId, protocolId, workerId) {
-    if (!protocolId || !workerId) {
-        return false;
-    }
-    const job = context.db.get("SELECT status, claimed_by_session_id FROM merge_queue WHERE project_id = ? AND protocol_id = ?", [projectId, protocolId]);
-    return job?.status === "claimed" && job.claimed_by_session_id === workerId;
-}
-function mergeQueueMutation(command) {
-    const match = command.match(/\bdd-flow\s+merge-queue\s+(next|wait-next|complete|fail)\b/);
-    return match?.[1] ?? null;
-}
-function mergeLaneLockMutation(command) {
-    return /\bdd-flow\s+lane\s+lock\s+(acquire|heartbeat|release|wait|wait-acquire)\b/.test(command) && /(?:--lane(?:\s+|=)(?:"merge"|'merge'|merge)\b)/.test(command);
-}
-function selfWorktreeRemovalTarget(command, cwd) {
-    if (!/\bgit\s+worktree\s+remove\b/.test(command)) {
-        return null;
-    }
-    const cwdPath = normalizePathForGuard(cwd, cwd);
-    for (const target of gitWorktreeRemoveTargets(command)) {
-        const targetPath = normalizePathForGuard(target, cwd);
-        if (cwdPath === targetPath || cwdPath.startsWith(`${targetPath}${path.sep}`)) {
-            return targetPath;
-        }
-    }
-    return null;
-}
-function gitWorktreeRemoveTargets(command) {
-    const targets = [];
-    const pattern = /\bgit\s+worktree\s+remove\b([^;&|]*)/g;
-    for (const match of command.matchAll(pattern)) {
-        const args = shellishTokens(match[1] ?? "");
-        for (const arg of args) {
-            if (arg.startsWith("-")) {
-                continue;
-            }
-            targets.push(arg);
-            break;
-        }
-    }
-    return targets;
-}
-function shellishTokens(input) {
-    const tokens = [];
-    const pattern = /"([^"]*)"|'([^']*)'|(\S+)/g;
-    for (const match of input.matchAll(pattern)) {
-        tokens.push(match[1] ?? match[2] ?? match[3] ?? "");
-    }
-    return tokens.filter((token) => token.length > 0);
-}
-function normalizePathForGuard(value, cwd) {
-    const absolute = path.isAbsolute(value) ? value : path.resolve(cwd, value);
-    try {
-        return fs.realpathSync(absolute);
-    }
-    catch {
-        return path.resolve(absolute);
-    }
-}
-function hookContinue(eventName, protocolId) {
-    void eventName;
-    void protocolId;
-    return {};
+    const candidate = fs.existsSync(cwd) ? fs.realpathSync(cwd) : path.resolve(cwd);
+    const projects = context.db.all("SELECT * FROM projects WHERE status = 'active'");
+    return projects
+        .filter((project) => {
+        const relative = path.relative(project.root, candidate);
+        return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
+    })
+        .sort((left, right) => right.root.length - left.root.length)[0];
+}
+function hookEventKey(payload, eventName, toolName, command) {
+    const explicit = stringValue(payload.tool_use_id) ?? stringValue(payload.event_id) ?? stringValue(payload.delivery_id) ?? stringValue(payload.id);
+    if (explicit)
+        return explicit;
+    return crypto.createHash("sha256").update(JSON.stringify({
+        event: eventName,
+        session: stringValue(payload.session_id),
+        turn: stringValue(payload.turn_id),
+        tool: toolName ?? null,
+        command
+    })).digest("hex");
 }
 function commandFromPayload(payload) {
     const direct = stringValue(payload.command);
@@ -865,18 +728,6 @@ function toolNameFromPayload(payload) {
     const toolInput = objectRecord(payload.tool_input);
     return stringValue(toolInput.name);
 }
-function toolSucceeded(payload) {
-    const response = objectRecord(payload.tool_response);
-    const status = stringValue(payload.status) ?? stringValue(response.status);
-    if (!status) {
-        return true;
-    }
-    return ["success", "succeeded", "ok", "0"].includes(status.toLowerCase());
-}
-function handshakeFromCommand(command) {
-    const match = command.match(/\bdd-flow\s+protocol\s+register\s+([^\s]+)/);
-    return match?.[1] ?? null;
-}
 function sanitizedSummary(payload) {
     const summary = JSON.stringify(sanitizeValue(payload));
     return summary.length > maxSanitizedSummaryLength ? `${summary.slice(0, maxSanitizedSummaryLength)}...` : summary;