@indigoai-us/hq-cloud 6.12.5 → 6.13.1

package/src/journal.ts

@@ -26,6 +26,13 @@ export const TOMBSTONE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 /** Current journal schema version written by all v2-aware writers. */
 export const JOURNAL_VERSION_CURRENT = "2" as const;
 
+/**
+ * Retain bounded pull history per company. Scope-shrink logic only needs the
+ * newest record, but a small tail keeps diagnostics useful without letting
+ * long-running sync loops grow journals forever.
+ */
+export const MAX_PULLS_PER_COMPANY = 50;
+
 const JOURNAL_FILE_PREFIX = "sync-journal.";
 const JOURNAL_FILE_SUFFIX = ".json";
 const JOURNAL_LAST_GOOD_SUFFIX = ".last-good";
@@ -517,13 +524,41 @@ export function lastPullRecord(
   return best;
 }
 
-/** Append a `PullRecord` (mutates `journal.pulls`). */
+function trimPullRecords(journal: SyncJournal): void {
+  const pulls = journal.pulls;
+  if (!pulls || pulls.length === 0) return;
+
+  const byCompany = new Map<string, Array<{ record: PullRecord; index: number }>>();
+  pulls.forEach((record, index) => {
+    const entries = byCompany.get(record.companyUid);
+    if (entries) entries.push({ record, index });
+    else byCompany.set(record.companyUid, [{ record, index }]);
+  });
+
+  const keep = new Set<number>();
+  for (const entries of byCompany.values()) {
+    entries
+      .sort((a, b) => {
+        const byCompletedAt = b.record.completedAt.localeCompare(
+          a.record.completedAt,
+        );
+        return byCompletedAt === 0 ? b.index - a.index : byCompletedAt;
+      })
+      .slice(0, MAX_PULLS_PER_COMPANY)
+      .forEach((entry) => keep.add(entry.index));
+  }
+
+  journal.pulls = pulls.filter((_, index) => keep.has(index));
+}
+
+/** Append a `PullRecord` (mutates `journal.pulls`) and cap retained history. */
 export function appendPullRecord(
   journal: SyncJournal,
   record: PullRecord,
 ): void {
   migrateToV2(journal);
   journal.pulls!.push(record);
+  trimPullRecords(journal);
 }
 
 /**
@@ -537,7 +572,7 @@ export function appendPullRecord(
 export function tombstoneEntry(
   journal: SyncJournal,
   relativePath: string,
-  reason: "scope_shrink" | "narrow_apply" | "manual",
+  reason: "scope_shrink" | "narrow_apply" | "manual" | "local-delete",
   now: string = new Date().toISOString(),
 ): void {
   const entry = journal.files[relativePath];

package/src/skill-telemetry.test.ts

@@ -226,6 +226,30 @@ describe("extractCodexSkillToolEvents (Codex model-driven SKILL.md reads)", () =
     expect(ev.source).toBe("model");
   });
 
+  it("matches normal Codex skill paths without backtracking ambiguity", () => {
+    expect(
+      extractCodexSkillToolEvents(
+        execEnd("cat /home/u/.claude/skills/hq/land/SKILL.md"),
+        ctx,
+      )[0].skill,
+    ).toBe("land");
+    expect(
+      extractCodexSkillToolEvents(
+        execEnd("cat /home/u/.claude/skills/a/b/c/SKILL.md"),
+        ctx,
+      )[0].skill,
+    ).toBe("c");
+  });
+
+  it("returns quickly for pathological non-matching skills paths", () => {
+    const cmd = "/home/u/.claude/skills/" + "a/".repeat(2000) + "z z";
+    const started = Date.now();
+    const events = extractCodexSkillToolEvents(execEnd(cmd), ctx);
+    const elapsedMs = Date.now() - started;
+    expect(events).toEqual([]);
+    expect(elapsedMs).toBeLessThan(200);
+  });
+
   it("absolute and relative SKILL.md paths both resolve", () => {
     expect(
       extractCodexSkillToolEvents(execEnd("cat /abs/path/.agents/skills/quiz/SKILL.md"), ctx)[0].skill,

package/src/skill-telemetry.ts

@@ -342,10 +342,11 @@ export function extractCodexSkillEvents(
  *  may be nested arbitrarily deep (`.agents/skills/…`, `.codex/skills/hq/…`),
  *  and `<name>` is always the directory immediately above SKILL.md — captured
  *  as the last segment so the bridge's `skills/hq/<name>/` layout resolves to
- *  `<name>`, not `hq`. The leading `(?:…/)*` is non-greedy via the segment class
- *  so it stops at the final directory boundary. */
+ *  `<name>`, not `hq`. The segment classes deliberately exclude `/` so segment
+ *  boundaries are unambiguous and non-matching `skills/...` paths cannot
+ *  catastrophically backtrack. */
 const CODEX_SKILL_FILE =
-  /(?:^|\/)skills\/(?:[^\s'"]+\/)*?([^/\s'"]+)\/SKILL\.md\b/;
+  /(?:^|\/)skills\/(?:[^/\s'"]+\/)*?([^/\s'"]+)\/SKILL\.md\b/;
 
 /** Pull the shell command string out of a Codex `exec_command_end` `command`,
  *  which is `["/bin/zsh", "-lc", "<cmd>"]` (array) on the runtimes we see, but
@@ -488,6 +489,8 @@ export function extractCodexSkillToolEvents(
   const exec = codexExecParams(obj, payload, ctx);
   if (!exec) return [];
   const { cmd } = exec;
+  // Real exec commands are tiny; avoid running regexes over pathological rows.
+  if (cmd.length > 100_000) return [];
   const m = CODEX_SKILL_FILE.exec(cmd);
   if (!m) return [];
   // Confirm the exec is a read of the skill file, not a write to it. Codex's own

package/src/types.ts

@@ -71,7 +71,7 @@ export interface JournalEntry {
    * the same paths as orphans, then garbage-collected.
    */
   removedAt?: string;
-  removedReason?: "scope_shrink" | "narrow_apply" | "manual";
+  removedReason?: "scope_shrink" | "narrow_apply" | "manual" | "local-delete";
   /**
    * Durable automatic-pull retention marker. Set when a scope shrink keeps an
    * out-of-scope caller-authored or unknown-author entry on disk instead of
@@ -80,6 +80,16 @@ export interface JournalEntry {
    * the entry becomes in-scope again.
    */
   outOfScopeProtected?: boolean;
+  /**
+   * Journal-honesty marker. Set when a conflict was resolved by KEEPing a local
+   * copy that diverges from the remote: the entry still records the remote
+   * `remoteEtag` (so the conflict can't re-fire — the #137 invariant), but the
+   * local bytes never matched that remote. The currency-gated delete planner
+   * refuses to propagate a delete for such an entry — its currency would
+   * falsely "match" on HEAD, and deleting would destroy the divergent remote
+   * version. Cleared by any genuine download (which makes local == remote).
+   */
+  localDiverges?: boolean;
 }
 
 /**