@indigoai-us/hq-cloud 6.14.3 → 6.14.4

package/src/cli/reindex.ts

@@ -2,9 +2,9 @@
  * hq reindex — surfaces namespaced skills as Claude Code skill wrappers under
  * .claude/skills/<ns>:<skill>/ (one symlink per source file), mirrors
  * personal/{knowledge,policies,workers,settings}/<entry> into core/<type>/,
- * prunes orphan wrappers + legacy command symlinks, captures this root's Claude
- * Code session logs into workspace/.session-logs, and regenerates the workers
- * registry.
+ * prunes orphan wrappers + legacy command symlinks, captures this HQ tree's
+ * coding-harness session logs (Claude Code / Codex / Grok) into
+ * workspace/.session-logs/<harness>/, and regenerates the workers registry.
  *
  * The logic historically lived in a bundled bash script (scripts/reindex.sh)
  * that this module exec'd via `bash`. It is now implemented natively in
@@ -199,46 +199,216 @@ function safeSymlink(target: string, linkPath: string, label: string): boolean {
   }
 }
 
-// Copy every file/folder under Claude Code's session-log directory for this HQ
-// root (`<claude-config>/projects/<encoded-root>`) into
-// `workspace/.session-logs`, so the raw session transcripts are captured inside
+// Capture the raw session transcripts of every supported coding harness for
+// this HQ tree into `workspace/.session-logs/<harness>/`, so they live inside
 // the HQ tree (where sync/search can see them) on each reindex.
 //
-// Contract (per the feature request):
-//   - copies ALL files and folders from the projects dir into the dest,
-//   - OVERWRITES existing dest files (force), and
-//   - NEVER deletes dest entries that lack a source counterpart — this is a
-//     one-way overlay, not a mirror, so anything already parked in
-//     workspace/.session-logs survives even after Claude Code rotates or prunes
-//     its own projects dir.
+// Scope — "this HQ tree" = the HQ root cwd OR any working directory UNDER it
+// (worktrees, repo subdirs). Harnesses key their logs by cwd differently, so
+// each helper re-derives the same scope in its own encoding.
 //
-// Best-effort: any failure warns to stderr and is swallowed so it can never
-// fail the reindex. `<claude-config>` honors CLAUDE_CONFIG_DIR, else ~/.claude.
+// Contract (per the feature request), applied by every helper:
+//   - copies ALL matching files/folders into `.session-logs/<harness>/…`,
+//   - OVERWRITES existing dest files, and
+//   - NEVER deletes dest entries that lack a source counterpart — a one-way
+//     overlay, not a mirror, so anything already parked in `.session-logs`
+//     survives even after a harness rotates or prunes its own store.
+//
+// Best-effort throughout: any failure warns to stderr and is swallowed so it
+// can never fail the reindex. Each harness is independent — one failing must
+// not stop the others. Home dirs honor CLAUDE_CONFIG_DIR / CODEX_HOME /
+// GROK_HOME, else ~/.claude, ~/.codex, ~/.grok.
 function copySessionLogs(root: string): void {
-  // Claude Code names a project's log dir by replacing every non-alphanumeric
-  // character in the project's cwd with '-' (e.g. /home/ec2-user/hq ->
-  // -home-ec2-user-hq). Re-derive that slug so we target THIS root's logs.
-  const slug = root.replace(/[^a-zA-Z0-9]/g, "-");
-  const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude");
-  const src = path.join(claudeConfigDir, "projects", slug);
-  if (!isDir(src)) return; // no session logs for this root yet — nothing to do
+  const destBase = path.join(root, "workspace", ".session-logs");
+  for (const capture of [
+    copyClaudeSessionLogs,
+    copyCodexSessionLogs,
+    copyGrokSessionLogs,
+  ]) {
+    try {
+      capture(root, destBase);
+    } catch (err) {
+      warn(`reindex: session-log capture step failed (${(err as Error).message}); skipping.`);
+    }
+  }
+}
 
-  const dest = path.join(root, "workspace", ".session-logs");
-  if (!safeMkdir(dest, "workspace/.session-logs directory")) return;
+/** `fs.statSync` without throwing (follows symlinks; null when missing). */
+function statOrNull(p: string): fs.Stats | null {
+  try {
+    return fs.statSync(p);
+  } catch {
+    return null;
+  }
+}
 
+// Overlay-copy a whole directory tree: mkdir dest, then recursive+force cpSync
+// (overwrite existing, never prune dest-only entries). Best-effort — warns and
+// returns on any failure. Shared by the Claude + Grok per-cwd-folder captures.
+function copyTreeOverlay(src: string, dest: string, label: string): void {
+  if (!safeMkdir(dest, `${label} directory`)) return;
   try {
-    // recursive: copy the whole tree; force: overwrite existing dest files.
-    // cpSync copies src INTO dest and never removes dest-only entries — exactly
-    // the "overwrite, but don't delete extras" contract we want.
     fs.cpSync(src, dest, { recursive: true, force: true });
   } catch (err) {
     warn(
-      `reindex: could not copy session logs from '${src}' to '${dest}' ` +
+      `reindex: could not copy ${label} from '${src}' to '${dest}' ` +
         `(${(err as NodeJS.ErrnoException).code ?? "error"}: ${(err as Error).message}); skipping.`,
     );
   }
 }
 
+// Claude Code: `<claude-config>/projects/<encoded-cwd>/…`, where the cwd is
+// encoded by replacing every non-alphanumeric char with '-'. Because that map
+// is per-character, a descendant cwd's dir name is exactly the root's encoded
+// name + '-' + <encoded-subpath> — so "this HQ tree" is the exact-root dir OR
+// any dir whose name starts with `<slug>-`. Copy each into `.session-logs/claude/`.
+function copyClaudeSessionLogs(root: string, destBase: string): void {
+  const configDir = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), ".claude");
+  const projectsDir = path.join(configDir, "projects");
+  if (!isDir(projectsDir)) return;
+
+  const slug = root.replace(/[^a-zA-Z0-9]/g, "-");
+  for (const entry of globEntries(projectsDir)) {
+    if (entry !== slug && !entry.startsWith(`${slug}-`)) continue;
+    const src = path.join(projectsDir, entry);
+    if (!isDir(src)) continue;
+    copyTreeOverlay(src, path.join(destBase, "claude", entry), "claude session logs");
+  }
+}
+
+// Grok: `<grok-home>/sessions/<url-encoded-cwd>/<session-uuid>/…`, where the cwd
+// is URL-encoded (encodeURIComponent: '/' -> '%2F'). A descendant cwd's key is
+// the root's key + '%2F' + <encoded-subpath>, so match the exact-root key OR
+// that prefix. Copy each matching cwd folder into `.session-logs/grok/`.
+function copyGrokSessionLogs(root: string, destBase: string): void {
+  const grokHome = process.env.GROK_HOME || path.join(os.homedir(), ".grok");
+  const sessionsDir = path.join(grokHome, "sessions");
+  if (!isDir(sessionsDir)) return;
+
+  const key = encodeURIComponent(root);
+  for (const entry of globEntries(sessionsDir)) {
+    if (entry !== key && !entry.startsWith(`${key}%2F`)) continue;
+    const src = path.join(sessionsDir, entry);
+    if (!isDir(src)) continue;
+    copyTreeOverlay(src, path.join(destBase, "grok", entry), "grok session logs");
+  }
+}
+
+// Codex: `<codex-home>/sessions/YYYY/MM/DD/rollout-*.jsonl` — a DATE tree, not
+// per-project. The working dir is only recorded inside each rollout's first
+// line (`session_meta`, at `payload.cwd`). Walk the tree and capture a rollout
+// iff its recorded cwd is the HQ root or under it, mirroring the date-relative
+// path under `.session-logs/codex/`. A rollout already copied and unchanged is
+// skipped by mtime, so a steady-state reindex only classifies newly-written
+// rollouts — the full-tree cwd scan is a one-time first-run cost.
+function copyCodexSessionLogs(root: string, destBase: string): void {
+  const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), ".codex");
+  const sessionsDir = path.join(codexHome, "sessions");
+  if (!isDir(sessionsDir)) return;
+
+  const destDir = path.join(destBase, "codex");
+  const rootPrefix = root.endsWith(path.sep) ? root : root + path.sep;
+
+  for (const abs of walkFiles(sessionsDir)) {
+    if (!abs.endsWith(".jsonl")) continue;
+    const srcStat = statOrNull(abs);
+    if (!srcStat) continue;
+
+    const dest = path.join(destDir, path.relative(sessionsDir, abs));
+    // Cheap skip: already captured and unchanged since (dest mtime is the copy
+    // time, so it stays >= src mtime until the rollout is appended to again).
+    const destStat = statOrNull(dest);
+    if (destStat && destStat.mtimeMs >= srcStat.mtimeMs) continue;
+
+    const cwd = readCodexRolloutCwd(abs);
+    if (cwd === null) continue;
+    if (cwd !== root && !cwd.startsWith(rootPrefix)) continue;
+
+    if (!safeMkdir(path.dirname(dest), "codex session-log dir")) continue;
+    try {
+      fs.copyFileSync(abs, dest);
+    } catch (err) {
+      warn(
+        `reindex: could not copy codex session log '${abs}' -> '${dest}' ` +
+          `(${(err as NodeJS.ErrnoException).code ?? "error"}: ${(err as Error).message}); skipping.`,
+      );
+    }
+  }
+}
+
+// Recursively collect every regular file under `dir` (absolute paths). Symlinks
+// are not followed (lstat gate) so a stray link can't escape the tree or loop.
+// Missing/unreadable dirs yield []. Best-effort — mirrors globEntries' tolerance.
+function walkFiles(dir: string): string[] {
+  const out: string[] = [];
+  let names: string[];
+  try {
+    names = fs.readdirSync(dir);
+  } catch {
+    return out;
+  }
+  for (const name of names) {
+    const abs = path.join(dir, name);
+    const st = lstatOrNull(abs);
+    if (!st) continue;
+    if (st.isDirectory()) out.push(...walkFiles(abs));
+    else if (st.isFile()) out.push(abs);
+  }
+  return out;
+}
+
+// Extract `payload.cwd` (Codex ≥ the session_meta format; falls back to a
+// top-level `cwd`) from a rollout's first line, reading only that line. Codex
+// records cwd early, before the large `base_instructions` blob, but the line
+// can still be tens of KB — so read up to a generous cap and stop at the first
+// newline. Returns null on any parse/read failure (the rollout is then skipped).
+function readCodexRolloutCwd(file: string): string | null {
+  const line = readFirstLine(file, 4 * 1024 * 1024);
+  if (line === null) return null;
+  try {
+    const obj = JSON.parse(line) as { cwd?: unknown; payload?: { cwd?: unknown } };
+    const cwd = obj?.payload?.cwd ?? obj?.cwd;
+    return typeof cwd === "string" ? cwd : null;
+  } catch {
+    return null;
+  }
+}
+
+// Read the first line of `file` (up to `capBytes`), returning it WITHOUT the
+// trailing newline, or null on error / empty. Byte-accumulates and decodes once
+// so a multibyte char split across a read boundary can't corrupt the result.
+function readFirstLine(file: string, capBytes: number): string | null {
+  let fd: number | null = null;
+  try {
+    fd = fs.openSync(file, "r");
+    const chunks: Buffer[] = [];
+    const chunk = Buffer.allocUnsafe(65536);
+    let total = 0;
+    while (total < capBytes) {
+      const n = fs.readSync(fd, chunk, 0, chunk.length, total);
+      if (n <= 0) break;
+      const nl = chunk.indexOf(0x0a, 0);
+      if (nl !== -1 && nl < n) {
+        chunks.push(Buffer.from(chunk.subarray(0, nl)));
+        return Buffer.concat(chunks).toString("utf8");
+      }
+      chunks.push(Buffer.from(chunk.subarray(0, n)));
+      total += n;
+    }
+    return chunks.length ? Buffer.concat(chunks).toString("utf8") : null;
+  } catch {
+    return null;
+  } finally {
+    if (fd !== null) {
+      try {
+        fs.closeSync(fd);
+      } catch {
+        /* best-effort */
+      }
+    }
+  }
+}
+
 // --- legacy `.claude/commands/<ns>/<skill>.md` symlink matcher --------------
 // Mirrors the bash `case` patterns; `*` matches any chars (including `/`).
 function isLegacyCommandTarget(t: string): boolean {

package/src/cli/sync.test.ts

@@ -3518,6 +3518,17 @@ describe("reportNewFilesToNotify chunking (server cap = 1000 files/report)", ()
     (fetchMock.mock.calls as Array<[string, RequestInit?]>)
       .filter(([u]) => String(u).includes("/v1/notify/file-added"))
       .map(([, init]) => JSON.parse(String(init!.body)).files.length);
+  const notificationTelemetryEvents = (
+    fetchMock: ReturnType<typeof vi.fn>,
+  ): Array<{ eventName: string; properties?: Record<string, unknown> }> =>
+    (fetchMock.mock.calls as Array<[string, RequestInit?]>)
+      .filter(([u]) => String(u).includes("/v1/telemetry/events"))
+      .flatMap(([, init]) =>
+        JSON.parse(String(init!.body)).events as Array<{
+          eventName: string;
+          properties?: Record<string, unknown>;
+        }>,
+      );
 
   afterEach(() => {
     vi.unstubAllGlobals();
@@ -3580,6 +3591,85 @@ describe("reportNewFilesToNotify chunking (server cap = 1000 files/report)", ()
     expect(notifyBatchSizes(fetchMock)).toEqual([1000, 1000, 1]);
   });
 
+  it("does not emit notification telemetry after a successful report", async () => {
+    const fetchMock = vi.fn().mockImplementation(async (url: string) => {
+      if (url.includes("/v1/notify/file-added")) {
+        return { ok: true, status: 200, text: async () => "" };
+      }
+      return {
+        ok: true,
+        status: 200,
+        text: async () => JSON.stringify({ ok: true, written: 1, skipped: [] }),
+      };
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    await reportNewFilesToNotify(cfg, "cmp_X", "acme", mkFiles(1));
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    expect(notificationTelemetryEvents(fetchMock)).toEqual([]);
+  });
+
+  it("emits failure telemetry for a non-successful notification response", async () => {
+    const fetchMock = vi.fn().mockImplementation(async (url: string) => {
+      if (url.includes("/v1/notify/file-added")) {
+        return { ok: false, status: 503, text: async () => "unavailable" };
+      }
+      return {
+        ok: true,
+        status: 200,
+        text: async () => JSON.stringify({ ok: true, written: 1, skipped: [] }),
+      };
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    await reportNewFilesToNotify(cfg, "cmp_X", "acme", mkFiles(1));
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    expect(notificationTelemetryEvents(fetchMock)).toEqual([
+      expect.objectContaining({
+        eventName: "new_files_notification_reported",
+        properties: {
+          status: "failure",
+          fileCount: 1,
+          batchIndex: 1,
+          batchCount: 1,
+          statusCode: 503,
+        },
+      }),
+    ]);
+  });
+
+  it("emits error-class telemetry when notification reporting throws", async () => {
+    const fetchMock = vi.fn().mockImplementation(async (url: string) => {
+      if (url.includes("/v1/notify/file-added")) {
+        throw new TypeError("network down");
+      }
+      return {
+        ok: true,
+        status: 200,
+        text: async () => JSON.stringify({ ok: true, written: 1, skipped: [] }),
+      };
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    await reportNewFilesToNotify(cfg, "cmp_X", "acme", mkFiles(1));
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    expect(notificationTelemetryEvents(fetchMock)).toEqual([
+      expect.objectContaining({
+        eventName: "new_files_notification_reported",
+        properties: {
+          status: "failure",
+          fileCount: 1,
+          batchIndex: 1,
+          batchCount: 1,
+          errorClass: "TypeError",
+        },
+      }),
+    ]);
+  });
+
   it("no request at all when there are no new files", async () => {
     const fetchMock = vi.fn().mockResolvedValue({ ok: true, status: 200, text: async () => "" });
     vi.stubGlobal("fetch", fetchMock);

package/src/cli/sync.ts

@@ -722,18 +722,20 @@ export async function reportNewFilesToNotify(
         }),
         signal: controller.signal,
       });
-      void emitCloudTelemetry(telemetryClient, {
-        eventName: "new_files_notification_reported",
-        source: "hq-sync",
-        companyUid,
-        properties: {
-          result: response.ok ? "success" : "failure",
-          fileCount: batch.length,
-          batchIndex,
-          batchCount,
-          statusCode: response.status,
-        },
-      }, { claims: telemetryClaims });
+      if (!response.ok) {
+        void emitCloudTelemetry(telemetryClient, {
+          eventName: "new_files_notification_reported",
+          source: "hq-sync",
+          companyUid,
+          properties: {
+            status: "failure",
+            fileCount: batch.length,
+            batchIndex,
+            batchCount,
+            statusCode: response.status,
+          },
+        }, { claims: telemetryClaims });
+      }
     } catch (err) {
       // Best-effort per chunk: never let notification reporting affect the sync
       // result, and a failed chunk must not abort the remaining chunks.
@@ -743,11 +745,11 @@ export async function reportNewFilesToNotify(
         source: "hq-sync",
         companyUid,
         properties: {
-          result: "failure",
+          status: "failure",
           fileCount: batch.length,
           batchIndex,
           batchCount,
-          errorCode: safeErrorName(err),
+          errorClass: safeErrorName(err),
         },
       }, { claims: telemetryClaims });
     } finally {

package/src/watcher.test.ts

@@ -12,6 +12,7 @@ import {
 import { StaticFlagProvider } from "./sync/feature-flags.js";
 import type { PushEvent } from "./sync/push-event.js";
 import type { PushTransport } from "./sync/push-transport.js";
+import type { TelemetryEventsBatch } from "./vault-client.js";
 
 /**
  * US-001 — Phase 1 test harness: watch-triggered push seam + latency assertion.
@@ -736,4 +737,62 @@ describe("PushEventEmitter — directory and delete tombstone handling", () => {
     expect(published[0]).not.toHaveProperty("contentHash");
     expect(published[0]).not.toHaveProperty("mtime");
   });
+
+  it("emits push telemetry only when publication fails", async () => {
+    const posts: TelemetryEventsBatch[] = [];
+    const telemetryClient = {
+      postTelemetryEvents: vi.fn(async (batch: TelemetryEventsBatch) => {
+        posts.push(batch);
+        return { ok: true, written: batch.events.length, skipped: [] };
+      }),
+    };
+    const changed = path.join(dir, "changed.md");
+    fs.writeFileSync(changed, "changed");
+    const success = new PushEventEmitter({
+      originTenantId: "tenant-indigo",
+      originDeviceId: "device-a",
+      transport: {
+        start: async () => {},
+        dispose: async () => {},
+        connected: true,
+        publish: async () => {},
+      },
+      flagProvider: new StaticFlagProvider(["tenant-indigo"]),
+      telemetryClient,
+    });
+
+    await success.emitForBatch({ paths: new Map([[changed, "changed.md"]]) });
+    await flushImmediate();
+    expect(posts).toEqual([]);
+
+    const failed = new PushEventEmitter({
+      originTenantId: "tenant-indigo",
+      originDeviceId: "device-a",
+      transport: {
+        start: async () => {},
+        dispose: async () => {},
+        connected: true,
+        publish: async () => {
+          throw new Error("network down");
+        },
+      },
+      flagProvider: new StaticFlagProvider(["tenant-indigo"]),
+      telemetryClient,
+      onError: vi.fn(),
+    });
+
+    await failed.emitForBatch({ paths: new Map([[changed, "changed.md"]]) });
+    await flushImmediate();
+    expect(posts.flatMap((post) => post.events)).toEqual([
+      expect.objectContaining({
+        eventName: "push_event_failed",
+        properties: {
+          kind: "upsert",
+          count: 1,
+          status: "failure",
+          stage: "publish",
+        },
+      }),
+    ]);
+  });
 });

package/src/watcher.ts

@@ -989,7 +989,7 @@ export class PushEventEmitter {
         this.onError(err instanceof Error ? err : new Error(String(err)), {
           relativePath,
         });
-        this.emitPublishTelemetry("push_event_failed", "unknown", "capture");
+        this.emitPublishFailureTelemetry("unknown", "capture");
         return;
       }
 
@@ -1025,31 +1025,29 @@ export class PushEventEmitter {
 
     try {
       await this.transport.publish(event);
-      this.emitPublishTelemetry("push_event_published", event.kind, "publish");
     } catch (err) {
       // Push failure (network / non-2xx / timeout). The cadence poll is the
       // safety net — log + continue, never throw.
       this.onError(err instanceof Error ? err : new Error(String(err)), {
         relativePath,
       });
-      this.emitPublishTelemetry("push_event_failed", event.kind, "publish");
+      this.emitPublishFailureTelemetry(event.kind, "publish");
     }
   }
 
-  private emitPublishTelemetry(
-    eventName: "push_event_published" | "push_event_failed",
+  private emitPublishFailureTelemetry(
     kind: string,
-    stage: string,
+    stage: "capture" | "publish",
   ): void {
     void emitCloudTelemetry(
       this.telemetryClient,
       {
-        eventName,
+        eventName: "push_event_failed",
         source: "watcher",
         properties: {
           kind,
           count: 1,
-          result: eventName === "push_event_published" ? "success" : "failure",
+          status: "failure",
           stage,
         },
       },