@indigoai-us/hq-cloud 6.14.2 → 6.14.3

package/src/cli/reindex.ts

@@ -2,8 +2,9 @@
  * hq reindex — surfaces namespaced skills as Claude Code skill wrappers under
  * .claude/skills/<ns>:<skill>/ (one symlink per source file), mirrors
  * personal/{knowledge,policies,workers,settings}/<entry> into core/<type>/,
- * prunes orphan wrappers + legacy command symlinks, and regenerates the
- * workers registry.
+ * prunes orphan wrappers + legacy command symlinks, captures this root's Claude
+ * Code session logs into workspace/.session-logs, and regenerates the workers
+ * registry.
  *
  * The logic historically lived in a bundled bash script (scripts/reindex.sh)
  * that this module exec'd via `bash`. It is now implemented natively in
@@ -16,6 +17,7 @@
  */
 import { spawnSync } from "child_process";
 import * as fs from "fs";
+import * as os from "os";
 import * as path from "path";
 import {
   acquireOperationLock,
@@ -197,6 +199,46 @@ function safeSymlink(target: string, linkPath: string, label: string): boolean {
   }
 }
 
+// Copy every file/folder under Claude Code's session-log directory for this HQ
+// root (`<claude-config>/projects/<encoded-root>`) into
+// `workspace/.session-logs`, so the raw session transcripts are captured inside
+// the HQ tree (where sync/search can see them) on each reindex.
+//
+// Contract (per the feature request):
+//   - copies ALL files and folders from the projects dir into the dest,
+//   - OVERWRITES existing dest files (force), and
+//   - NEVER deletes dest entries that lack a source counterpart — this is a
+//     one-way overlay, not a mirror, so anything already parked in
+//     workspace/.session-logs survives even after Claude Code rotates or prunes
+//     its own projects dir.
+//
+// Best-effort: any failure warns to stderr and is swallowed so it can never
+// fail the reindex. `<claude-config>` honors CLAUDE_CONFIG_DIR, else ~/.claude.
+function copySessionLogs(root: string): void {
+  // Claude Code names a project's log dir by replacing every non-alphanumeric
+  // character in the project's cwd with '-' (e.g. /home/ec2-user/hq ->
+  // -home-ec2-user-hq). Re-derive that slug so we target THIS root's logs.
+  const slug = root.replace(/[^a-zA-Z0-9]/g, "-");
+  const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude");
+  const src = path.join(claudeConfigDir, "projects", slug);
+  if (!isDir(src)) return; // no session logs for this root yet — nothing to do
+
+  const dest = path.join(root, "workspace", ".session-logs");
+  if (!safeMkdir(dest, "workspace/.session-logs directory")) return;
+
+  try {
+    // recursive: copy the whole tree; force: overwrite existing dest files.
+    // cpSync copies src INTO dest and never removes dest-only entries — exactly
+    // the "overwrite, but don't delete extras" contract we want.
+    fs.cpSync(src, dest, { recursive: true, force: true });
+  } catch (err) {
+    warn(
+      `reindex: could not copy session logs from '${src}' to '${dest}' ` +
+        `(${(err as NodeJS.ErrnoException).code ?? "error"}: ${(err as Error).message}); skipping.`,
+    );
+  }
+}
+
 // --- legacy `.claude/commands/<ns>/<skill>.md` symlink matcher --------------
 // Mirrors the bash `case` patterns; `*` matches any chars (including `/`).
 function isLegacyCommandTarget(t: string): boolean {
@@ -549,6 +591,11 @@ export function reindex(opts: ReindexOptions = {}): ReindexResult {
     }
   }
 
+  // --- Session-log capture --------------------------------------------------
+  // Overlay this root's Claude Code session logs into workspace/.session-logs
+  // (copy-all, overwrite, never-prune). Best-effort; never fails the reindex.
+  copySessionLogs(root);
+
   // --- Workers registry regeneration ----------------------------------------
   // Source of truth: each worker.yaml. The registry is a derived index — the
   // generator (when present in the operated-on tree) keeps it in sync.

package/src/index.ts

@@ -164,9 +164,11 @@ export {
   PERSONAL_VAULT_EXCLUDED_TOP_LEVEL,
   PERSONAL_VAULT_COMPANY_EXCLUDED_SLUGS,
   CONTINUITY_POINTER_REL,
+  SESSION_LOGS_SYNC_REL,
   computePersonalVaultPaths,
   computePersonalCompanySubdirs,
   computeContinuityPointerPaths,
+  computeSessionLogsSyncPaths,
 } from "./personal-vault.js";
 export type { PersonalVaultOptions } from "./personal-vault.js";
 

package/src/personal-vault.test.ts

@@ -25,6 +25,8 @@ import {
   CONTINUITY_POINTER_REL,
   computeAgencySyncPaths,
   AGENCY_SYNC_REL,
+  computeSessionLogsSyncPaths,
+  SESSION_LOGS_SYNC_REL,
   PERSONAL_VAULT_COMPANY_EXCLUDED_SLUGS,
   PERSONAL_VAULT_EXCLUDED_TOP_LEVEL,
 } from "./personal-vault.js";
@@ -628,3 +630,58 @@ describe("personal-vault: agency-workspace carve-out", () => {
     );
   });
 });
+
+// ─────────────────────────────────────────────────────────────────────────
+// Session-logs carve-out (workspace/.session-logs) — reindex-captured Claude
+// Code transcripts pierce the workspace/ exclusion and round-trip to the vault.
+// ─────────────────────────────────────────────────────────────────────────
+describe("personal-vault: session-logs carve-out", () => {
+  let hqRoot: string;
+  beforeEach(() => {
+    hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-sesslog-test-"));
+  });
+  afterEach(() => {
+    fs.rmSync(hqRoot, { recursive: true, force: true });
+  });
+  const relAll = (abs: string[]): string[] =>
+    abs.map((p) => path.relative(hqRoot, p)).sort();
+
+  it("constant: SESSION_LOGS_SYNC_REL is workspace/.session-logs", () => {
+    expect(SESSION_LOGS_SYNC_REL).toBe("workspace/.session-logs");
+  });
+
+  it("includes workspace/.session-logs when it exists", () => {
+    fs.mkdirSync(path.join(hqRoot, "workspace", ".session-logs", "tool-results"), {
+      recursive: true,
+    });
+    expect(relAll(computeSessionLogsSyncPaths(hqRoot))).toEqual([
+      path.join("workspace", ".session-logs"),
+    ]);
+  });
+
+  it("empty when workspace/.session-logs is absent (fail-soft)", () => {
+    fs.mkdirSync(path.join(hqRoot, "workspace"), { recursive: true });
+    expect(computeSessionLogsSyncPaths(hqRoot)).toEqual([]);
+  });
+
+  it("composes into computePersonalVaultPaths without broadening workspace/", () => {
+    fs.mkdirSync(path.join(hqRoot, "workspace", ".session-logs"), { recursive: true });
+    fs.writeFileSync(
+      path.join(hqRoot, "workspace", ".session-logs", "session.jsonl"),
+      "l\n",
+    );
+    // A sibling under workspace/ that must STAY local.
+    fs.mkdirSync(path.join(hqRoot, "workspace", "locks"), { recursive: true });
+    fs.writeFileSync(path.join(hqRoot, "workspace", "locks", "x.lock"), "1");
+    fs.mkdirSync(path.join(hqRoot, ".claude"), { recursive: true });
+
+    const out = relAll(computePersonalVaultPaths(hqRoot));
+    expect(out).toContain(path.join("workspace", ".session-logs"));
+    expect(out).toContain(".claude");
+    // The carve-out is exactly the .session-logs subtree — no other workspace/
+    // sibling is pulled in.
+    expect(out.some((p) => p.startsWith(path.join("workspace", "locks")))).toBe(
+      false,
+    );
+  });
+});

package/src/personal-vault.ts

@@ -26,7 +26,12 @@
  *     the routing source-of-truth.)
  *   - `repos/`, `workspace/`: per user directive — heavy local-only
  *     content (cloned remotes, session threads) that has no business in
- *     the personal vault.
+ *     the personal vault. Three explicit sub-paths pierce this exclusion and
+ *     DO round-trip: `workspace/threads/handoff.json` (+ its active thread) via
+ *     {@link computeContinuityPointerPaths}, `workspace/agency/` via
+ *     {@link computeAgencySyncPaths}, and `workspace/.session-logs/` (the
+ *     reindex-captured Claude Code transcripts) via
+ *     {@link computeSessionLogsSyncPaths}.
  *
  * Note: `core/`, `data/`, and `personal/` were previously excluded but are
  * INCLUDED as of user directive 2026-05-13. `core/` ships the hq-core
@@ -134,7 +139,15 @@ export function computePersonalVaultPaths(
   );
   const continuity = computeContinuityPointerPaths(hqRoot);
   const agency = computeAgencySyncPaths(hqRoot);
-  return [...topLevel, ...manifest, ...companySubdirs, ...continuity, ...agency];
+  const sessionLogs = computeSessionLogsSyncPaths(hqRoot);
+  return [
+    ...topLevel,
+    ...manifest,
+    ...companySubdirs,
+    ...continuity,
+    ...agency,
+    ...sessionLogs,
+  ];
 }
 
 /**
@@ -261,6 +274,39 @@ export function computeAgencySyncPaths(hqRoot: string): string[] {
   return [];
 }
 
+/**
+ * Fixed relative path (forward-slash, hq-root-relative) of the session-logs
+ * subtree. See {@link computeSessionLogsSyncPaths}.
+ */
+export const SESSION_LOGS_SYNC_REL = "workspace/.session-logs";
+
+/**
+ * Compute the absolute path of the session-logs carve-out:
+ * `workspace/.session-logs/` (the whole subtree).
+ *
+ * `hq reindex` copies this HQ root's Claude Code session transcripts here (see
+ * reindex's copySessionLogs). Like the agency carve-out above, this pierces the
+ * `workspace/` top-level exclusion for ONE specific subtree so those raw
+ * transcripts round-trip to the personal vault / S3 — the operator's explicit
+ * directive is that the session logs travel with the vault. The rest of
+ * `workspace/` (session scratch, locks, reports, worktrees) stays machine-local.
+ *
+ * Returns the directory path when it exists; share()'s per-file walk handles
+ * recursion, and the nested personal-vault exclusions still apply to files
+ * inside it. Fail-soft: a missing or unreadable `workspace/.session-logs/`
+ * returns []. Callers tolerate empty arrays — same contract as the manifest,
+ * continuity, and agency special-cases.
+ */
+export function computeSessionLogsSyncPaths(hqRoot: string): string[] {
+  const sessionLogsDir = path.join(hqRoot, "workspace", ".session-logs");
+  try {
+    if (fs.statSync(sessionLogsDir).isDirectory()) return [sessionLogsDir];
+  } catch {
+    // No session logs captured on this machine yet — nothing to carry.
+  }
+  return [];
+}
+
 /**
  * Discover `companies/{slug}/` subdirs that should sync to the personal
  * bucket as a fallback for companies the operator has not designated as

package/src/watcher.test.ts

@@ -371,6 +371,36 @@ describe("US-002: createWatchPathFilter — personal-vault exclusions", () => {
     expect(personal(path.join(ROOT, "workspace/worktrees/x/a.ts"))).toBe(false);
   });
 
+  // ── workspace/.session-logs subtree carve-out (personal mode) ────────────
+  // The personal push uploads workspace/.session-logs/** (reindex-captured
+  // Claude Code transcripts, computeSessionLogsSyncPaths), so the personal
+  // watcher must emit those changes event-driven. Mirrors the agency carve-out.
+  it("DOES emit for workspace/.session-logs files in personalMode (synced subtree)", () => {
+    expect(
+      personal(path.join(ROOT, "workspace/.session-logs/session.jsonl")),
+    ).toBe(true);
+    expect(
+      personal(path.join(ROOT, "workspace/.session-logs/tool-results/r.txt")),
+    ).toBe(true);
+    // The subtree root itself, as a file event, also emits.
+    expect(personal(path.join(ROOT, "workspace/.session-logs"))).toBe(true);
+  });
+
+  it("allows chokidar to DESCEND to workspace/.session-logs in personalMode (dir probes)", () => {
+    expect(personal(path.join(ROOT, "workspace"), true)).toBe(true);
+    expect(personal(path.join(ROOT, "workspace/.session-logs"), true)).toBe(true);
+    expect(
+      personal(path.join(ROOT, "workspace/.session-logs/tool-results"), true),
+    ).toBe(true);
+  });
+
+  it("session-logs carve-out is exact-segment (does NOT leak to a similarly-named sibling)", () => {
+    expect(
+      personal(path.join(ROOT, "workspace/.session-logs-old/foo.txt")),
+    ).toBe(false);
+    expect(personal(path.join(ROOT, "workspace/.session-logsX.md"))).toBe(false);
+  });
+
   it("does not apply the carve-out in non-personal mode", () => {
     // In non-personal mode the excluded-top-level layer never runs, so the
     // carve-out is irrelevant; handoff.json passes via the ordinary ignore

package/src/watcher.ts

@@ -16,6 +16,7 @@ import { isPersonalVaultExcluded } from "./personal-vault-exclusions.js";
 import {
   AGENCY_SYNC_REL,
   CONTINUITY_POINTER_REL,
+  SESSION_LOGS_SYNC_REL,
   PERSONAL_VAULT_EXCLUDED_TOP_LEVEL,
 } from "./personal-vault.js";
 import type { PushEvent } from "./sync/push-event.js";
@@ -466,6 +467,22 @@ export function createWatchPathFilter(
       }
       if (isDir && AGENCY_SYNC_REL.startsWith(rel + "/")) return true;
 
+      // Session-logs carve-out: `workspace/.session-logs/` (the whole subtree)
+      // IS synced via computeSessionLogsSyncPaths (mirrored on the push side),
+      // so it must re-include BEFORE the top-level `workspace/` rejection below
+      // — identical shape to the agency carve-out just above. Without this, a
+      // `--personal --watch` runner never emits reindex-captured session-log
+      // changes and they wait for the 60s poll. Paths at/under it emit; the
+      // subtree root and its ancestor dir (`workspace`) return true for the dir
+      // probe so chokidar descends to reach them instead of pruning `workspace/`.
+      if (
+        rel === SESSION_LOGS_SYNC_REL ||
+        rel.startsWith(SESSION_LOGS_SYNC_REL + "/")
+      ) {
+        return true;
+      }
+      if (isDir && SESSION_LOGS_SYNC_REL.startsWith(rel + "/")) return true;
+
       // Layer 3: excluded top-level buckets (.git/companies/repos/workspace).
       const topLevel = rel.split("/")[0];
       if (excludedTopLevel.has(topLevel)) return false;