@lazyingart/agintiflow 0.20.45 → 0.20.47

package/docs/housekeeping.md

@@ -0,0 +1,39 @@
+# AgInTiFlow Housekeeping
+
+AgInTiFlow keeps full private session history in `~/.agintiflow/sessions/<session-id>/`.
+That history can include user prompts, model text, tool arguments, file diffs, and artifacts, so it is local-only and should not be committed.
+
+Housekeeping is a lighter background layer for reusable learning:
+
+- It listens to session events without blocking the main agent loop.
+- It writes sanitized cross-session records to `~/.agintiflow/housekeeping/events.jsonl`.
+- It maintains aggregate model, tool, and skill usage in `~/.agintiflow/housekeeping/capabilities.json`.
+- It redacts common token/key/password patterns and replaces local project/home paths with placeholders.
+- It stores previews, hashes, counts, model/tool names, selected skill ids, and touched skill files rather than a full second transcript.
+
+Use:
+
+```bash
+aginti housekeeping
+aginti housekeeping --json
+```
+
+Disable local housekeeping for a run:
+
+```bash
+AGINTIFLOW_HOUSEKEEPING=0 aginti
+```
+
+Project session pointers live in `.aginti-sessions/`, and old `.sessions/` folders may still exist after migration.
+AgInTiFlow adds both to `.gitignore` during `aginti init` and when session storage is prepared, because these folders can contain private local metadata.
+
+## Sharing Without A Center Server
+
+Without a central server, the safe sharing path is:
+
+1. Keep raw sessions and artifacts local.
+2. Aggregate local learning into sanitized housekeeping capability data.
+3. Promote reviewed reusable knowledge into Markdown skills, task profiles, command policy, or docs.
+4. Ship those reviewed files through the npm package.
+
+This avoids uploading private transcripts while still letting users receive better skills and tools when they upgrade `@lazyingart/agintiflow`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazyingart/agintiflow",
-  "version": "0.20.45",
+  "version": "0.20.47",
   "type": "module",
   "description": "AgInTiFlow is a web-first coding agent and CLI with DeepSeek routing, sandboxed tools, model providers, canvas artifacts, and optional wrappers.",
   "license": "Apache-2.0",

package/scripts/smoke-cli-chat.js

@@ -11,9 +11,11 @@ import {
   buildPromptRenderSequence,
   canonicalSlashPromptBuffer,
   classifyEscapeAction,
+  formatElapsedDuration,
   formatWorkspaceChange,
   stripMarkdown,
 } from "../src/interactive-cli.js";
+import { dockerPolicyTimeoutMs, dockerUserCommand } from "../src/docker-sandbox.js";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-cli-chat-"));
@@ -135,6 +137,24 @@ try {
   if (!launchHeader.includes("█████") || !launchHeader.includes("v0.0.0") || launchHeader.split("\n").length < 9) {
     throw new Error("large launch header did not render a centered multi-line title");
   }
+  if (
+    formatElapsedDuration(0) !== "00:00" ||
+    formatElapsedDuration(65_000) !== "01:05" ||
+    formatElapsedDuration(3_665_000) !== "1:01:05"
+  ) {
+    throw new Error("elapsed duration formatter returned an unexpected value");
+  }
+  const wrappedDockerCommand = dockerUserCommand("node --test 2>&1 | tail -30", {
+    category: "general-shell",
+    needsNetwork: false,
+  });
+  if (
+    dockerPolicyTimeoutMs({ needsNetwork: true }) !== 120000 ||
+    !wrappedDockerCommand.includes("timeout -k 5s 15s bash -lc") ||
+    !wrappedDockerCommand.includes("'node --test 2>&1 | tail -30'")
+  ) {
+    throw new Error("docker sandbox command wrapper did not add a bounded inner timeout");
+  }
 
   const promptLayout = buildPromptLayout(`${"x".repeat(180)}\nsecond line`, 95, 80, 24);
   const promptText = promptLayout.renderedRows

package/scripts/smoke-inbox.js

@@ -10,6 +10,7 @@ import {
   sessionStoreOptions,
 } from "../src/project.js";
 import { SessionStore } from "../src/session-store.js";
+import { flushHousekeeping, readHousekeepingSummary } from "../src/housekeeping.js";
 
 const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "agintiflow-inbox-"));
 process.env.AGINTIFLOW_HOME = path.join(tempRoot, ".agintiflow-home");
@@ -53,6 +54,8 @@ try {
   );
   await fs.writeFile(path.join(legacyDir, "events.jsonl"), "", "utf8");
   const paths = await ensureProjectSessionStorage(legacyProject);
+  const gitignore = await fs.readFile(path.join(legacyProject, ".gitignore"), "utf8");
+  assert(gitignore.includes(".aginti-sessions/") && gitignore.includes(".sessions/"), "session folders were not protected by .gitignore");
   const migrated = await listProjectSessions(legacyProject, 10);
   assert(migrated.some((session) => session.sessionId === legacySession), "legacy session was not discoverable after migration");
   assert(
@@ -125,6 +128,28 @@ try {
     "empty session project pointer was not removed"
   );
 
+  const housekeepingStore = new SessionStore(paths.globalSessionsDir, "housekeeping-smoke", sessionStoreOptions(legacyProject, "housekeeping-smoke"));
+  await housekeepingStore.appendEvent("skills.selected", {
+    taskProfile: "website",
+    skills: ["website-app", "code-review"],
+    goal: "build a small website with token=secret-value",
+  });
+  await housekeepingStore.appendEvent("model.responded", {
+    step: 1,
+    content: "Use the local project at /tmp/private-project and avoid api_key=abc123456789.",
+    toolCalls: [{ id: "call-secret", name: "run_command", arguments: "{\"command\":\"echo hi\"}" }],
+  });
+  await housekeepingStore.appendEvent("tool.started", {
+    toolName: "run_command",
+    args: { command: "echo token=secret-value" },
+  });
+  await flushHousekeeping();
+  const housekeeping = await readHousekeepingSummary();
+  assert(housekeeping.capabilities?.totals?.skillSelections >= 1, "housekeeping did not aggregate selected skills");
+  assert(housekeeping.capabilities?.tools?.run_command?.count >= 1, "housekeeping did not aggregate tool usage");
+  const housekeepingEvents = await fs.readFile(housekeeping.paths.eventsPath, "utf8");
+  assert(!housekeepingEvents.includes("secret-value") && !housekeepingEvents.includes("abc123456789"), "housekeeping leaked raw secret text");
+
   console.log(
     JSON.stringify(
       {
@@ -139,6 +164,8 @@ try {
           "all-sessions-list",
           "empty-session-detection",
           "empty-session-removal",
+          "session-gitignore-protection",
+          "housekeeping-redacted-learning-log",
         ],
       },
       null,

package/src/agent-runner.js

@@ -26,6 +26,7 @@ import { formatSkillsForPrompt, selectSkillsForGoal } from "./skill-library.js";
 import { hostShellOption, platformInfo, platformLabel } from "./platform.js";
 import { captureTmuxPane, listTmuxSessions, sendTmuxKeys, startTmuxSession } from "./tmux-tools.js";
 import { languageInstruction } from "./i18n.js";
+import { flushHousekeeping } from "./housekeeping.js";
 
 const exec = promisify(execCallback);
 const BROWSER_TOOLS = new Set(["open_url", "open_workspace_file", "preview_workspace", "click", "type", "scroll", "press", "back"]);
@@ -1256,6 +1257,7 @@ export async function runAgent(config) {
   const sessionId = config.resume || config.sessionId || `web-agent-${crypto.randomUUID()}`;
   const store = new SessionStore(config.sessionsDir, sessionId, {
     projectRoot: config.baseDir,
+    commandCwd: config.commandCwd,
     projectSessionsDir: config.projectSessionsDir,
   });
   const client = createClient(config);
@@ -1283,6 +1285,11 @@ export async function runAgent(config) {
       routeReason: config.routeReason,
       goal: config.goal,
     });
+    await store.appendEvent("skills.selected", {
+      taskProfile: config.taskProfile,
+      skills: state.meta.selectedSkills || [],
+      goal: config.goal,
+    });
     await store.saveState(state);
   } else {
     await store.appendEvent("session.resumed", { sessionId });
@@ -1650,5 +1657,6 @@ export async function runAgent(config) {
     };
   } finally {
     await closeBrowser(browserState, store);
+    await flushHousekeeping();
   }
 }

package/src/cli.js

@@ -32,6 +32,7 @@ import { normalizeAuthProvider, promptHidden, runAuthWizard, shouldPromptForDeep
 import { listSkills, selectSkillsForGoal } from "./skill-library.js";
 import { languageLabel, resolveLanguage } from "./i18n.js";
 import { maybeAutoUpdate } from "./auto-update.js";
+import { readHousekeepingSummary } from "./housekeeping.js";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -381,7 +382,7 @@ export function parseArgs(argv) {
 
 function printUsage() {
   console.log(
-    'Usage: aginti [chat] OR aginti web [--port 3210] OR aginti update OR aginti models OR aginti skills [query] OR aginti auth [deepseek|openai|qwen|venice|grsai] OR aginti resume [--all-sessions] [latest|<session-id>] ["prompt"] OR aginti --remove-empty-sessions OR aginti --remove-sessions OR aginti queue <session-id> "message" OR aginti [--no-auto-update] [--language en|ja|zh-Hans|zh-Hant|ko|fr|es|ar|vi|de|ru] [--image] [--latex] [--routing smart|fast|complex|manual] [--provider deepseek|openai|qwen|venice|mock] [--model MODEL] [--route-model MODEL] [--main-model MODEL] [--spare-model MODEL --spare-reasoning medium] [--aux-provider grsai|venice --aux-model MODEL] [--sandbox-mode host|docker-readonly|docker-workspace] [--package-install-policy block|prompt|allow] [--approve-package-installs] [--allow-shell|--no-shell] [--allow-file-tools|--no-file-tools] [--web-search|--no-web-search] [--parallel-scouts|--no-parallel-scouts --scout-count 1..10] [--allow-auxiliary-tools|--no-auxiliary-tools] [--allow-wrappers --wrapper codex --wrapper-model gpt-5.5] [--list-models|--list-routes] "your task"'
+    'Usage: aginti [chat] OR aginti web [--port 3210] OR aginti update OR aginti models OR aginti skills [query] OR aginti housekeeping [--json] OR aginti auth [deepseek|openai|qwen|venice|grsai] OR aginti resume [--all-sessions] [latest|<session-id>] ["prompt"] OR aginti --remove-empty-sessions OR aginti --remove-sessions OR aginti queue <session-id> "message" OR aginti [--no-auto-update] [--language en|ja|zh-Hans|zh-Hant|ko|fr|es|ar|vi|de|ru] [--image] [--latex] [--routing smart|fast|complex|manual] [--provider deepseek|openai|qwen|venice|mock] [--model MODEL] [--route-model MODEL] [--main-model MODEL] [--spare-model MODEL --spare-reasoning medium] [--aux-provider grsai|venice --aux-model MODEL] [--sandbox-mode host|docker-readonly|docker-workspace] [--package-install-policy block|prompt|allow] [--approve-package-installs] [--allow-shell|--no-shell] [--allow-file-tools|--no-file-tools] [--web-search|--no-web-search] [--parallel-scouts|--no-parallel-scouts --scout-count 1..10] [--allow-auxiliary-tools|--no-auxiliary-tools] [--allow-wrappers --wrapper codex --wrapper-model gpt-5.5] [--list-models|--list-routes] "your task"'
   );
   console.log(`Languages: ${["en", "ja", "zh-Hans", "zh-Hant", "ko", "fr", "es", "ar", "vi", "de", "ru"].map((code) => `${code}=${languageLabel(code)}`).join(", ")}`);
 }
@@ -499,6 +500,35 @@ function printSkills(query = "") {
   }
 }
 
+async function printHousekeeping(argv = []) {
+  const summary = await readHousekeepingSummary();
+  if (argv.includes("--json")) {
+    console.log(JSON.stringify(summary, null, 2));
+    return;
+  }
+  const totals = summary.capabilities?.totals || {};
+  console.log("AgInTiFlow housekeeping");
+  console.log(`root=${summary.paths.root}`);
+  console.log(`events=${summary.paths.eventsPath}`);
+  console.log(`capabilities=${summary.paths.capabilitiesPath}`);
+  console.log(
+    `totals events=${totals.events || 0} modelRequests=${totals.modelRequests || 0} toolEvents=${totals.toolEvents || 0} skillSelections=${totals.skillSelections || 0}`
+  );
+  const tools = Object.entries(summary.capabilities?.tools || {})
+    .sort((a, b) => (b[1].count || 0) - (a[1].count || 0))
+    .slice(0, 8)
+    .map(([name, item]) => `${name}:${item.count || 0}`)
+    .join(" ");
+  const skills = Object.entries(summary.capabilities?.skills || {})
+    .sort((a, b) => (b[1].count || 0) - (a[1].count || 0))
+    .slice(0, 8)
+    .map(([name, item]) => `${name}:${item.count || 0}`)
+    .join(" ");
+  if (tools) console.log(`topTools ${tools}`);
+  if (skills) console.log(`topSkills ${skills}`);
+  console.log("Set AGINTIFLOW_HOUSEKEEPING=0 to disable local sanitized housekeeping logs.");
+}
+
 function printInitResult(result) {
   console.log(`AgInTiFlow project initialized: ${result.projectRoot}`);
   console.log(`instructions=${result.instructionsPath}`);
@@ -1056,6 +1086,11 @@ export async function main(argv = process.argv.slice(2)) {
     return;
   }
 
+  if (argv[0] === "housekeeping" || argv[0] === "housekeeper") {
+    await printHousekeeping(argv.slice(1));
+    return;
+  }
+
   if (argv[0] === "keys/status") {
     await handleKeyCommand(["status"]);
     return;

package/src/docker-sandbox.js

@@ -29,6 +29,28 @@ function shellEscape(value) {
   return `'${String(value).replace(/'/g, `'\"'\"'`)}'`;
 }
 
+export function dockerPolicyTimeoutMs(policy = {}) {
+  if (policy.needsNetwork) return 120000;
+  if (policy.category === "toolchain") return 90000;
+  return 15000;
+}
+
+function dockerExecTimeoutMs(policy = {}) {
+  return dockerPolicyTimeoutMs(policy) + 5000;
+}
+
+export function dockerUserCommand(command, policy = {}) {
+  const seconds = Math.max(1, Math.ceil(dockerPolicyTimeoutMs(policy) / 1000));
+  const escapedCommand = shellEscape(String(command || ""));
+  return [
+    `if command -v timeout >/dev/null 2>&1; then`,
+    `  timeout -k 5s ${seconds}s bash -lc ${escapedCommand}`,
+    `else`,
+    `  bash -lc ${escapedCommand}`,
+    `fi`,
+  ].join("\n");
+}
+
 function buildDockerInvocation(args) {
   return ["docker", ...args].map(shellEscape).join(" ");
 }
@@ -232,7 +254,7 @@ function dockerCommand(command, policy) {
     );
   }
 
-  return [...envLines, String(command)].join("\n");
+  return [...envLines, dockerUserCommand(command, policy)].join("\n");
 }
 
 function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command, config), persistentDirs = persistentDockerDirs(config)) {
@@ -289,7 +311,7 @@ function dockerRunArgs(command, config, policy = evaluateCommandPolicy(command,
 export async function runDockerSandboxCommand(command, config, policy = evaluateCommandPolicy(command, config), options = {}) {
   const persistentDirs = await ensurePersistentDockerDirs(config);
   const result = await execDocker(dockerRunArgs(command, config, policy, persistentDirs), {
-    timeout: policy.needsNetwork ? 120000 : policy.category === "toolchain" ? 90000 : 15000,
+    timeout: dockerExecTimeoutMs(policy),
     maxBuffer: 300 * 1024,
     signal: options.signal,
   });
@@ -366,7 +388,7 @@ export async function runDockerPreflight(config, options = {}) {
     ]) {
       try {
         const result = await execDocker(dockerRunArgs(command, config, { needsNetwork: false, category: "preflight" }, persistentDirs), {
-          timeout: 15000,
+          timeout: dockerExecTimeoutMs({ needsNetwork: false, category: "preflight" }),
           maxBuffer: 100 * 1024,
         });
         results.push({ command, ok: true, stdout: result.stdout.trim(), stderr: result.stderr.trim() });

package/src/housekeeping.js

@@ -0,0 +1,337 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { agintiflowHome } from "./session-index.js";
+import { redactSensitiveText, redactValue } from "./redaction.js";
+
+const MAX_PREVIEW_CHARS = 360;
+const MAX_EVENTS_FILE_BYTES = 8 * 1024 * 1024;
+let queue = Promise.resolve();
+
+function enabled() {
+  return String(process.env.AGINTIFLOW_HOUSEKEEPING || "1").toLowerCase() !== "0";
+}
+
+export function housekeepingPaths(home = agintiflowHome()) {
+  const root = path.join(home, "housekeeping");
+  return {
+    root,
+    eventsPath: path.join(root, "events.jsonl"),
+    capabilitiesPath: path.join(root, "capabilities.json"),
+    readmePath: path.join(root, "README.md"),
+  };
+}
+
+function hashText(value = "") {
+  return crypto.createHash("sha256").update(String(value || "")).digest("hex").slice(0, 16);
+}
+
+function redactContextText(value = "", context = {}) {
+  let text = redactSensitiveText(value);
+  const replacements = [
+    [context.projectRoot, "$PROJECT"],
+    [context.commandCwd, "$CWD"],
+    [os.homedir(), "~"],
+  ].filter(([needle]) => needle && typeof needle === "string");
+  for (const [needle, replacement] of replacements) {
+    text = text.split(needle).join(replacement);
+  }
+  return text;
+}
+
+function previewText(value = "", context = {}, limit = MAX_PREVIEW_CHARS) {
+  const text = redactContextText(String(value ?? ""), context).replace(/\s+/g, " ").trim();
+  return text.length <= limit ? text : `${text.slice(0, Math.max(limit - 1, 1))}...`;
+}
+
+function sanitizePath(value = "", context = {}) {
+  const text = redactContextText(String(value || ""), context);
+  if (!text) return "";
+  if (text.startsWith("$PROJECT/") || text.startsWith("$CWD/") || text.startsWith("~/")) return text;
+  if (path.isAbsolute(text)) return path.basename(text);
+  return text;
+}
+
+function safeArray(value) {
+  return Array.isArray(value) ? value.filter(Boolean) : [];
+}
+
+function safeProjectName(projectRoot = "") {
+  return projectRoot ? path.basename(projectRoot) : "";
+}
+
+function sanitizeToolCalls(toolCalls = [], context = {}) {
+  return safeArray(toolCalls).slice(0, 20).map((call) => {
+    const name = call.name || call.function?.name || "";
+    const args = call.arguments || call.function?.arguments || "";
+    return {
+      id: call.id ? hashText(call.id) : "",
+      name,
+      argumentsPreview: previewText(args, context, 260),
+      argumentsHash: args ? hashText(args) : "",
+    };
+  });
+}
+
+function sanitizeEvent(type, data = {}, context = {}) {
+  const redacted = redactValue(data || {});
+  const base = {
+    type,
+    sessionId: context.sessionId || "",
+    projectHash: context.projectRoot ? hashText(path.resolve(context.projectRoot)) : "",
+    projectName: safeProjectName(context.projectRoot),
+  };
+
+  if (type === "session.created" || type === "session.resumed" || type === "session.finished" || type === "session.stopped") {
+    return {
+      ...base,
+      provider: redacted.provider || "",
+      model: redacted.model || "",
+      routingMode: redacted.routingMode || "",
+      routeReason: redacted.routeReason || "",
+      reason: redacted.reason || "",
+      mode: redacted.mode || "",
+      goalPreview: previewText(redacted.goal || "", context),
+      goalHash: redacted.goal ? hashText(redacted.goal) : "",
+      resultPreview: previewText(redacted.result || "", context),
+      resultHash: redacted.result ? hashText(redacted.result) : "",
+    };
+  }
+
+  if (type === "skills.selected") {
+    return {
+      ...base,
+      taskProfile: redacted.taskProfile || "",
+      skills: safeArray(redacted.skills).map(String).slice(0, 30),
+      goalHash: redacted.goal ? hashText(redacted.goal) : "",
+    };
+  }
+
+  if (type === "model.requested") {
+    return {
+      ...base,
+      step: redacted.step || 0,
+      provider: redacted.provider || "",
+      model: redacted.model || "",
+    };
+  }
+
+  if (type === "model.responded") {
+    const content = String(redacted.content || "");
+    return {
+      ...base,
+      step: redacted.step || 0,
+      contentPreview: previewText(content, context),
+      contentHash: content ? hashText(content) : "",
+      contentChars: content.length,
+      toolCalls: sanitizeToolCalls(redacted.toolCalls, context),
+    };
+  }
+
+  if (type.startsWith("tool.")) {
+    return {
+      ...base,
+      toolName: redacted.toolName || "",
+      ok: redacted.ok,
+      blocked: Boolean(redacted.blocked),
+      category: redacted.commandPolicy?.category || redacted.category || "",
+      commandPreview: previewText(redacted.args?.command || redacted.command || "", context, 260),
+      path: sanitizePath(redacted.path || redacted.args?.path || "", context),
+      stdoutPreview: previewText(redacted.stdout || "", context, 220),
+      stderrPreview: previewText(redacted.stderr || redacted.error || redacted.reason || "", context, 220),
+    };
+  }
+
+  if (type === "file.changed") {
+    const diff = String(redacted.diff || "");
+    return {
+      ...base,
+      toolName: redacted.toolName || "",
+      path: sanitizePath(redacted.path || "", context),
+      beforeHash: redacted.beforeHash || "",
+      afterHash: redacted.afterHash || "",
+      diffPreview: previewText(diff, context, 260),
+      diffHash: diff ? hashText(diff) : "",
+      skillTouched: /^skills\/[^/]+\/SKILL\.md$/.test(String(redacted.path || "")),
+    };
+  }
+
+  if (type === "plan.created") {
+    const plan = String(redacted.plan || "");
+    return {
+      ...base,
+      planPreview: previewText(plan, context),
+      planHash: plan ? hashText(plan) : "",
+    };
+  }
+
+  if (type === "parallel_scouts.completed") {
+    return {
+      ...base,
+      model: redacted.model || "",
+      requested: redacted.requested || 0,
+      completed: redacted.completed || 0,
+      scoutNames: safeArray(redacted.scouts).map((scout) => scout.name || "").filter(Boolean).slice(0, 20),
+      synthesisHash: redacted.synthesis ? hashText(redacted.synthesis) : "",
+    };
+  }
+
+  if (type.startsWith("canvas.") || type === "image.generated") {
+    return {
+      ...base,
+      kind: redacted.kind || "",
+      title: previewText(redacted.title || "", context, 160),
+      path: sanitizePath(redacted.path || redacted.outputPath || redacted.artifactPath || "", context),
+      notePreview: previewText(redacted.note || redacted.preview || "", context, 220),
+    };
+  }
+
+  return {
+    ...base,
+    dataPreview: previewText(JSON.stringify(redacted), context),
+    dataHash: hashText(JSON.stringify(redacted)),
+  };
+}
+
+function emptyCapabilities() {
+  return {
+    version: 1,
+    updatedAt: "",
+    totals: {
+      events: 0,
+      sessions: 0,
+      modelRequests: 0,
+      modelResponses: 0,
+      toolEvents: 0,
+      skillSelections: 0,
+      skillFileChanges: 0,
+    },
+    models: {},
+    tools: {},
+    skills: {},
+    sessions: {},
+    projects: {},
+  };
+}
+
+async function readCapabilities(paths) {
+  try {
+    return JSON.parse(await fs.readFile(paths.capabilitiesPath, "utf8"));
+  } catch {
+    return emptyCapabilities();
+  }
+}
+
+function bumpCounter(map, key, patch = {}) {
+  if (!key) return;
+  const current = map[key] || { count: 0 };
+  map[key] = {
+    ...current,
+    ...patch,
+    count: (current.count || 0) + 1,
+    lastSeenAt: patch.lastSeenAt || new Date().toISOString(),
+  };
+}
+
+async function maybeRotateEvents(paths) {
+  const stat = await fs.stat(paths.eventsPath).catch(() => null);
+  if (!stat || stat.size < MAX_EVENTS_FILE_BYTES) return;
+  const rotated = path.join(paths.root, `events-${new Date().toISOString().replace(/[:.]/g, "-")}.jsonl`);
+  await fs.rename(paths.eventsPath, rotated).catch(() => {});
+}
+
+async function ensureReadme(paths) {
+  await fs.writeFile(
+    paths.readmePath,
+    [
+      "# AgInTiFlow Housekeeping",
+      "",
+      "This folder stores local, redacted learning logs derived from session events.",
+      "",
+      "- `events.jsonl` is a sanitized cross-session event feed.",
+      "- `capabilities.json` aggregates models, tools, selected skills, and touched skill files.",
+      "- Full session history remains in `~/.agintiflow/sessions/<session-id>/` and should not be committed.",
+      "",
+      "The housekeeping files are local by default. Share only reviewed, sanitized capability packs.",
+      "",
+    ].join("\n"),
+    "utf8"
+  ).catch(() => {});
+}
+
+async function recordEvent(record) {
+  const paths = housekeepingPaths();
+  await fs.mkdir(paths.root, { recursive: true });
+  await ensureReadme(paths);
+  await maybeRotateEvents(paths);
+  const timestamp = record.timestamp || new Date().toISOString();
+  await fs.appendFile(paths.eventsPath, `${JSON.stringify({ timestamp, ...record })}\n`, "utf8");
+
+  const capabilities = await readCapabilities(paths);
+  capabilities.updatedAt = timestamp;
+  capabilities.totals.events = (capabilities.totals.events || 0) + 1;
+  bumpCounter(capabilities.projects, record.projectHash || "unknown", {
+    name: record.projectName || "",
+    lastSeenAt: timestamp,
+  });
+
+  capabilities.sessions ||= {};
+  if (record.sessionId) {
+    capabilities.sessions[record.sessionId] = {
+      projectHash: record.projectHash || "",
+      lastSeenAt: timestamp,
+    };
+    capabilities.totals.sessions = Object.keys(capabilities.sessions).length;
+  }
+  if (record.type === "model.requested") {
+    capabilities.totals.modelRequests = (capabilities.totals.modelRequests || 0) + 1;
+    bumpCounter(capabilities.models, `${record.provider}/${record.model}`, { lastSeenAt: timestamp });
+  }
+  if (record.type === "model.responded") {
+    capabilities.totals.modelResponses = (capabilities.totals.modelResponses || 0) + 1;
+  }
+  if (record.type?.startsWith("tool.")) {
+    capabilities.totals.toolEvents = (capabilities.totals.toolEvents || 0) + 1;
+    bumpCounter(capabilities.tools, record.toolName || "unknown", {
+      category: record.category || "",
+      lastSeenAt: timestamp,
+    });
+  }
+  if (record.type === "skills.selected") {
+    capabilities.totals.skillSelections = (capabilities.totals.skillSelections || 0) + 1;
+    for (const skill of record.skills || []) {
+      bumpCounter(capabilities.skills, skill, { source: "selected", lastSeenAt: timestamp });
+    }
+  }
+  if (record.type === "file.changed" && record.skillTouched) {
+    capabilities.totals.skillFileChanges = (capabilities.totals.skillFileChanges || 0) + 1;
+    const skillId = String(record.path || "").split("/")[1] || "unknown";
+    bumpCounter(capabilities.skills, skillId, { source: "skill-file-change", lastSeenAt: timestamp });
+  }
+
+  await fs.writeFile(paths.capabilitiesPath, `${JSON.stringify(capabilities, null, 2)}\n`, "utf8");
+}
+
+export function enqueueHousekeepingEvent({ sessionId = "", projectRoot = "", commandCwd = "", event = {} } = {}) {
+  if (!enabled()) return;
+  const timestamp = event.timestamp || new Date().toISOString();
+  const context = { sessionId, projectRoot, commandCwd };
+  const record = {
+    timestamp,
+    ...sanitizeEvent(event.type || "event", event.data || {}, context),
+  };
+  queue = queue.then(() => recordEvent(record)).catch(() => {});
+}
+
+export async function flushHousekeeping() {
+  await queue.catch(() => {});
+}
+
+export async function readHousekeepingSummary() {
+  const paths = housekeepingPaths();
+  return {
+    paths,
+    capabilities: await readCapabilities(paths),
+  };
+}

package/src/interactive-cli.js

@@ -236,6 +236,15 @@ function compactLine(value = "", limit = 96) {
   return text.length <= limit ? text : `${text.slice(0, Math.max(limit - 1, 1))}…`;
 }
 
+export function formatElapsedDuration(ms = 0) {
+  const totalSeconds = Math.max(0, Math.floor((Number(ms) || 0) / 1000));
+  const seconds = totalSeconds % 60;
+  const minutes = Math.floor(totalSeconds / 60) % 60;
+  const hours = Math.floor(totalSeconds / 3600);
+  const two = (value) => String(value).padStart(2, "0");
+  return hours > 0 ? `${hours}:${two(minutes)}:${two(seconds)}` : `${two(minutes)}:${two(seconds)}`;
+}
+
 function wrapTextLine(value = "", width = 72) {
   const text = stripAnsi(String(value || ""));
   if (text.length <= width) return [text];
@@ -1254,6 +1263,8 @@ class LiveRunInput {
     this.pendingAsap = [];
     this.pendingQueued = [];
     this.statusLine = "";
+    this.statusStartedAt = 0;
+    this.statusTimer = null;
     this.wasRaw = Boolean(input.isRaw);
     this.started = false;
     this.handler = this.handleKey.bind(this);
@@ -1270,6 +1281,11 @@ class LiveRunInput {
     input.setRawMode(true);
     input.on("keypress", this.handler);
     activeRunInput = this;
+    this.statusStartedAt = Date.now();
+    this.statusTimer = setInterval(() => {
+      if (this.started && this.statusLine) this.renderNow();
+    }, 1000);
+    this.statusTimer.unref?.();
     this.started = true;
     this.renderNow();
     return true;
@@ -1281,6 +1297,10 @@ class LiveRunInput {
       clearImmediate(this.redrawHandle);
       this.redrawHandle = null;
     }
+    if (this.statusTimer) {
+      clearInterval(this.statusTimer);
+      this.statusTimer = null;
+    }
     input.off("keypress", this.handler);
     if (typeof input.setRawMode === "function") input.setRawMode(this.wasRaw);
     this.clearForExternalOutput();
@@ -1312,6 +1332,12 @@ class LiveRunInput {
     output.write(ansi.cursorShow);
   }
 
+  currentStatusLine() {
+    if (!this.statusLine) return "";
+    const elapsed = formatElapsedDuration(Date.now() - (this.statusStartedAt || Date.now()));
+    return compactLine(`${elapsed} · ${this.statusLine}`, Math.max(terminalWidth() - 16, 36));
+  }
+
   renderNow() {
     if (this.redrawHandle) {
       clearImmediate(this.redrawHandle);
@@ -1320,7 +1346,7 @@ class LiveRunInput {
     this.rendered = renderPromptBuffer(this.buffer, this.cursor, this.rendered, {
       commandCwd: this.commandCwd,
       language: this.state.language || cliLanguage,
-      statusLine: this.statusLine,
+      statusLine: this.currentStatusLine(),
       pendingAsap: this.pendingAsap,
       pendingQueued: this.pendingQueued,
     });
@@ -1352,7 +1378,7 @@ class LiveRunInput {
     const layout = buildPromptLayout(this.buffer, this.cursor, terminalWidth(), terminalHeight(), {
       commandCwd: this.commandCwd,
       language: this.state.language || cliLanguage,
-      statusLine: this.statusLine,
+      statusLine: this.currentStatusLine(),
       pendingAsap: this.pendingAsap,
       pendingQueued: this.pendingQueued,
     });
@@ -2469,7 +2495,7 @@ function buildReviewPrompt(focus = "") {
     "3. Use `inspect_project`, `search_files`, and targeted `read_file`; avoid full-tree dumps. Prefer precise symbol/error searches over opening many files.",
     "4. Exclude generated, vendored, binary, cache, and large artifact paths: .git, node_modules, vendor, dist, build, out, target, coverage, .next, .turbo, .venv, __pycache__, .pytest_cache, .aginti-sessions, .sessions, artifacts, images/videos/PDFs unless directly relevant.",
     "5. Context budget: at most two discovery passes; at most 12 primary files read initially; expand only when a concrete risk requires neighboring code.",
-    "6. Check likely validation commands from manifests, but run only focused non-destructive checks when useful. Do not install packages or run long broad suites unless clearly justified.",
+    "6. Check likely validation commands from manifests, but run only focused non-destructive checks when useful. Bound shell checks with `timeout 30s ...` when available, avoid broad watch/dev commands, and do not install packages or run long broad suites unless clearly justified.",
     "7. Stop when you have enough evidence. Do not keep scanning just because more files exist.",
     "",
     "Final answer format:",
@@ -2990,6 +3016,7 @@ async function runPrompt(prompt, state, packageDir) {
 
   const store = new SessionStore(config.sessionsDir, state.sessionId, {
     projectRoot: config.baseDir,
+    commandCwd: config.commandCwd,
     projectSessionsDir: config.projectSessionsDir,
   });
   const liveInput = new LiveRunInput({ state, store, controller });

package/src/project.js

@@ -82,6 +82,7 @@ export function sessionStoreOptions(projectRoot = process.cwd(), sessionId = "")
   const paths = projectPaths(projectRoot);
   return {
     projectRoot: paths.root,
+    commandCwd: paths.root,
     projectSessionsDir: paths.sessionsDir,
     legacySessionDir: sessionId ? path.join(paths.legacySessionsDir, sessionId) : "",
   };
@@ -91,6 +92,10 @@ export async function ensureProjectSessionStorage(projectRoot = process.cwd()) {
   const paths = projectPaths(projectRoot);
   await fsp.mkdir(paths.sessionsDir, { recursive: true });
   await fsp.mkdir(paths.globalSessionsDir, { recursive: true });
+  await ensureLine(paths.gitignorePath, [
+    ".aginti-sessions/",
+    ".sessions/",
+  ]).catch(() => {});
 
   const legacyEntries = await fsp.readdir(paths.legacySessionsDir, { withFileTypes: true }).catch(() => []);
   if (legacyEntries.length > 0) {

package/src/session-store.js

@@ -2,6 +2,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import crypto from "node:crypto";
 import { deleteSessionIndex, globalSessionPaths, isSafeSessionId, upsertSessionIndex } from "./session-index.js";
+import { enqueueHousekeepingEvent } from "./housekeeping.js";
 
 export class SessionStore {
   constructor(baseDir, sessionId, options = {}) {
@@ -9,6 +10,7 @@ export class SessionStore {
     this.sessionId = sessionId;
     const globalPaths = globalSessionPaths(sessionId);
     this.projectRoot = options.projectRoot ? path.resolve(options.projectRoot) : "";
+    this.commandCwd = options.commandCwd ? path.resolve(options.commandCwd) : this.projectRoot;
     this.projectSessionsDir = options.projectSessionsDir ? path.resolve(options.projectSessionsDir) : "";
     this.legacySessionDir = options.legacySessionDir ? path.resolve(options.legacySessionDir) : "";
     this.sessionDir = path.resolve(options.sessionDir || (baseDir ? path.join(this.baseDir, sessionId) : globalPaths.sessionDir));
@@ -99,12 +101,19 @@ export class SessionStore {
 
   async appendEvent(type, data = {}) {
     await this.ensure();
-    const line = JSON.stringify({
+    const event = {
       timestamp: new Date().toISOString(),
       type,
       data,
-    });
+    };
+    const line = JSON.stringify(event);
     await fs.appendFile(this.eventsPath, `${line}\n`, "utf8");
+    enqueueHousekeepingEvent({
+      sessionId: this.sessionId,
+      projectRoot: this.projectRoot,
+      commandCwd: this.commandCwd,
+      event,
+    });
   }
 
   async loadEvents() {