@lossless-claude/lcm 0.5.0 → 0.7.0

package/dist/src/daemon/routes/restore.js

@@ -9,6 +9,8 @@ import { sendJson } from "../server.js";
 import { runLcmMigrations } from "../../db/migration.js";
 import { PromotedStore } from "../../db/promoted.js";
 import { justCompactedMap, JUST_COMPACTED_TTL_MS } from "./compact.js";
+import { fenceContent } from "../content-fence.js";
+import { validateCwd } from "../validate-cwd.js";
 function readClaudeMdFiles(cwd) {
     const paths = [
         { label: "~/.claude/CLAUDE.md", path: join(homedir(), ".claude", "CLAUDE.md") },
@@ -29,92 +31,138 @@ function readClaudeMdFiles(cwd) {
 }
 export function createRestoreHandler(config) {
     return async (_req, res, body) => {
-        const input = JSON.parse(body || "{}");
-        const { session_id, cwd, source } = input;
-        const orientation = buildOrientationPrompt();
-        // Post-compaction detection
-        const isPostCompact = source === "compact" ||
-            (justCompactedMap.has(session_id) && Date.now() - justCompactedMap.get(session_id) < JUST_COMPACTED_TTL_MS);
-        // Query session_instructions for compact/resume paths
-        let instructionsContext = "";
-        if (cwd) {
-            const dbPath = projectDbPath(cwd);
-            if (existsSync(dbPath)) {
+        try {
+            const input = JSON.parse(body || "{}");
+            const { session_id, source } = input;
+            let cwd;
+            if (input.cwd) {
                 try {
-                    const db = new DatabaseSync(dbPath);
+                    cwd = validateCwd(input.cwd);
+                }
+                catch (err) {
+                    sendJson(res, 400, { error: err instanceof Error ? err.message : "invalid cwd" });
+                    return;
+                }
+            }
+            const orientation = buildOrientationPrompt();
+            // Post-compaction detection
+            const isPostCompact = source === "compact" ||
+                (justCompactedMap.has(session_id) && Date.now() - justCompactedMap.get(session_id) < JUST_COMPACTED_TTL_MS);
+            // Query session_instructions for compact/resume paths
+            let instructionsContext = "";
+            if (cwd) {
+                const dbPath = projectDbPath(cwd);
+                if (existsSync(dbPath)) {
                     try {
-                        runLcmMigrations(db);
-                        const row = db
-                            .prepare(`SELECT content, content_hash, updated_at FROM session_instructions WHERE id = 1`)
-                            .get();
-                        if (row) {
-                            instructionsContext = `<project-instructions>\n${row.content}\n</project-instructions>`;
+                        const db = new DatabaseSync(dbPath);
+                        try {
+                            runLcmMigrations(db);
+                            const row = db
+                                .prepare(`SELECT content, content_hash, updated_at FROM session_instructions WHERE id = 1`)
+                                .get();
+                            if (row) {
+                                instructionsContext = `<project-instructions>\n${row.content}\n</project-instructions>`;
+                            }
+                        }
+                        finally {
+                            db.close();
                         }
                     }
-                    finally {
-                        db.close();
-                    }
+                    catch { /* non-fatal */ }
                 }
-                catch { /* non-fatal */ }
             }
-        }
-        if (isPostCompact) {
-            const context = [orientation, instructionsContext].filter(Boolean).join("\n\n");
-            sendJson(res, 200, { context });
-            return;
-        }
-        let episodicContext = "";
-        let promotedContext = "";
-        // Episodic: query recent summaries from project SQLite DB
-        // Also capture CLAUDE.md files on startup
-        if (cwd) {
-            const dbPath = projectDbPath(cwd);
-            mkdirSync(dirname(dbPath), { recursive: true });
-            const db = new DatabaseSync(dbPath);
-            try {
-                runLcmMigrations(db);
-                const rows = db.prepare(`SELECT s.content FROM summaries s
-           JOIN conversations c ON s.conversation_id = c.conversation_id
-           WHERE c.session_id = ?
-           ORDER BY s.depth DESC, s.created_at DESC
-           LIMIT ?`).all(session_id, config.restoration.recentSummaries);
-                if (rows.length > 0) {
-                    episodicContext = `<recent-session-context>\n${rows.map((r) => r.content).join("\n\n")}\n</recent-session-context>`;
-                }
-                // Promoted: cross-session knowledge from SQLite
+            if (isPostCompact) {
+                const context = [orientation, instructionsContext].filter(Boolean).join("\n\n");
+                sendJson(res, 200, { context });
+                return;
+            }
+            let episodicContext = "";
+            let promotedContext = "";
+            // Episodic: query recent summaries from project SQLite DB
+            // Also capture CLAUDE.md files on startup
+            if (cwd) {
+                const dbPath = projectDbPath(cwd);
+                mkdirSync(dirname(dbPath), { recursive: true });
+                const db = new DatabaseSync(dbPath);
                 try {
-                    const promotedStore = new PromotedStore(db);
-                    const results = promotedStore.search(`project context ${cwd}`, 5);
-                    if (results.length > 0) {
-                        promotedContext = `<project-knowledge>\n${results.map((r) => r.content).join("\n\n")}\n</project-knowledge>`;
+                    runLcmMigrations(db);
+                    const rows = db.prepare(`SELECT s.content FROM summaries s
+             JOIN conversations c ON s.conversation_id = c.conversation_id
+             WHERE c.session_id = ?
+             ORDER BY s.depth DESC, s.created_at DESC
+             LIMIT ?`).all(session_id, config.restoration.recentSummaries);
+                    if (rows.length > 0) {
+                        episodicContext = fenceContent(rows.map((r) => r.content).join("\n\n"), "recent-session-context");
                     }
+                    // Promoted: cross-session knowledge from SQLite
+                    try {
+                        const promotedStore = new PromotedStore(db);
+                        const results = promotedStore.search(`project context ${cwd}`, 5);
+                        if (results.length > 0) {
+                            promotedContext = fenceContent(results.map((r) => r.content).join("\n\n"), "project-knowledge");
+                        }
+                    }
+                    catch { /* non-fatal */ }
+                    // Capture CLAUDE.md files and upsert into session_instructions if changed
+                    try {
+                        const claudeMdContent = readClaudeMdFiles(cwd);
+                        if (claudeMdContent) {
+                            const hash = createHash("sha256").update(claudeMdContent).digest("hex");
+                            const existing = db
+                                .prepare(`SELECT content_hash FROM session_instructions WHERE id = 1`)
+                                .get();
+                            if (!existing || existing.content_hash !== hash) {
+                                db.prepare(`INSERT INTO session_instructions (id, content, content_hash, updated_at)
+                   VALUES (1, ?, ?, datetime('now'))
+                   ON CONFLICT(id) DO UPDATE SET
+                     content = excluded.content,
+                     content_hash = excluded.content_hash,
+                     updated_at = excluded.updated_at`).run(claudeMdContent, hash);
+                            }
+                        }
+                    }
+                    catch { /* non-fatal */ }
+                    db.close();
                 }
                 catch { /* non-fatal */ }
-                // Capture CLAUDE.md files and upsert into session_instructions if changed
+            }
+            // Query passive-capture insights from promoted store
+            let insights = [];
+            if (cwd) {
                 try {
-                    const claudeMdContent = readClaudeMdFiles(cwd);
-                    if (claudeMdContent) {
-                        const hash = createHash("sha256").update(claudeMdContent).digest("hex");
-                        const existing = db
-                            .prepare(`SELECT content_hash FROM session_instructions WHERE id = 1`)
-                            .get();
-                        if (!existing || existing.content_hash !== hash) {
-                            db.prepare(`INSERT INTO session_instructions (id, content, content_hash, updated_at)
-                 VALUES (1, ?, ?, datetime('now'))
-                 ON CONFLICT(id) DO UPDATE SET
-                   content = excluded.content,
-                   content_hash = excluded.content_hash,
-                   updated_at = excluded.updated_at`).run(claudeMdContent, hash);
+                    const dbPath = projectDbPath(cwd);
+                    if (existsSync(dbPath)) {
+                        const insightsDb = new DatabaseSync(dbPath);
+                        try {
+                            runLcmMigrations(insightsDb);
+                            const insightsStore = new PromotedStore(insightsDb);
+                            const thresholds = config.compaction.promotionThresholds;
+                            const minConfidence = thresholds.eventConfidence?.pattern ?? 0.3;
+                            const maxAgeDays = thresholds.insightsMaxAgeDays ?? 90;
+                            const cutoffMs = Date.now() - maxAgeDays * 24 * 60 * 60 * 1000;
+                            insights = insightsStore
+                                .search("source passive capture", 10, ["source:passive-capture"])
+                                .filter((r) => r.confidence >= minConfidence && (!r.createdAt || Date.parse(r.createdAt) >= cutoffMs))
+                                .slice(0, 5)
+                                .map((r) => ({ content: r.content, confidence: r.confidence, tags: r.tags }));
+                        }
+                        finally {
+                            insightsDb.close();
                         }
                     }
                 }
                 catch { /* non-fatal */ }
-                db.close();
             }
-            catch { /* non-fatal */ }
+            const context = [orientation, episodicContext, promotedContext, instructionsContext].filter(Boolean).join("\n\n");
+            const responseBody = { context };
+            if (insights.length > 0) {
+                responseBody.insights = insights;
+            }
+            sendJson(res, 200, responseBody);
+        }
+        catch (err) {
+            sendJson(res, 500, { error: err instanceof Error ? err.message : "restore failed" });
         }
-        const context = [orientation, episodicContext, promotedContext, instructionsContext].filter(Boolean).join("\n\n");
-        sendJson(res, 200, { context });
     };
 }
 //# sourceMappingURL=restore.js.map

package/dist/src/daemon/routes/restore.js.map

@@ -1 +1 @@
-{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../../../src/daemon/routes/restore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAQvE,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG;QACZ,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE;QAC/E,EAAE,KAAK,EAAE,GAAG,GAAG,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE;QAC3D,EAAE,KAAK,EAAE,GAAG,GAAG,oBAAoB,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE;KAC/E,CAAC;IAEF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAC1C,MAAM,WAAW,GAAG,sBAAsB,EAAE,CAAC;QAE7C,4BAA4B;QAC5B,MAAM,aAAa,GACjB,MAAM,KAAK,SAAS;YACpB,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAE,GAAG,qBAAqB,CAAC,CAAC;QAE/G,sDAAsD;QACtD,IAAI,mBAAmB,GAAG,EAAE,CAAC;QAC7B,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;oBACpC,IAAI,CAAC;wBACH,gBAAgB,CAAC,EAAE,CAAC,CAAC;wBACrB,MAAM,GAAG,GAAG,EAAE;6BACX,OAAO,CAAC,iFAAiF,CAAC;6BAC1F,GAAG,EAAwC,CAAC;wBAC/C,IAAI,GAAG,EAAE,CAAC;4BACR,mBAAmB,GAAG,2BAA2B,GAAG,CAAC,OAAO,2BAA2B,CAAC;wBAC1F,CAAC;oBACH,CAAC;4BAAS,CAAC;wBACT,EAAE,CAAC,KAAK,EAAE,CAAC;oBACb,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAChF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,IAAI,eAAe,GAAG,EAAE,CAAC;QACzB,IAAI,eAAe,GAAG,EAAE,CAAC;QAEzB,0DAA0D;QAC1D,0CAA0C;QAC1C,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAClC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,CAAC;gBACH,gBAAgB,CAAC,EAAE,CAAC,CAAC;gBAErB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;;;mBAIS,CACV,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,eAAe,CAA+B,CAAC;gBAEpF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpB,eAAe,GAAG,6BAA6B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAAC;gBACtH,CAAC;gBAED,gDAAgD;gBAChD,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;oBAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,mBAAmB,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;oBAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,eAAe,GAAG,wBAAwB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;oBAC/G,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;gBAE3B,0EAA0E;gBAC1E,IAAI,CAAC;oBACH,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;oBAC/C,IAAI,eAAe,EAAE,CAAC;wBACpB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBACxE,MAAM,QAAQ,GAAG,EAAE;6BAChB,OAAO,CAAC,4DAA4D,CAAC;6BACrE,GAAG,EAA0C,CAAC;wBAEjD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;4BAChD,EAAE,CAAC,OAAO,CACR;;;;;oDAKoC,CACrC,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;wBAC/B,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;gBAE3B,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC;YAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"restore.js","sourceRoot":"","sources":["../../../../src/daemon/routes/restore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAQjD,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG;QACZ,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE;QAC/E,EAAE,KAAK,EAAE,GAAG,GAAG,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE;QAC3D,EAAE,KAAK,EAAE,GAAG,GAAG,oBAAoB,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE;KAC/E,CAAC;IAEF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;YACvC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;YACrC,IAAI,GAAuB,CAAC;YAC5B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;oBAClF,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,WAAW,GAAG,sBAAsB,EAAE,CAAC;YAE7C,4BAA4B;YAC5B,MAAM,aAAa,GACjB,MAAM,KAAK,SAAS;gBACpB,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAE,GAAG,qBAAqB,CAAC,CAAC;YAE/G,sDAAsD;YACtD,IAAI,mBAAmB,GAAG,EAAE,CAAC;YAC7B,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvB,IAAI,CAAC;wBACH,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;wBACpC,IAAI,CAAC;4BACH,gBAAgB,CAAC,EAAE,CAAC,CAAC;4BACrB,MAAM,GAAG,GAAG,EAAE;iCACX,OAAO,CAAC,iFAAiF,CAAC;iCAC1F,GAAG,EAAwC,CAAC;4BAC/C,IAAI,GAAG,EAAE,CAAC;gCACR,mBAAmB,GAAG,2BAA2B,GAAG,CAAC,OAAO,2BAA2B,CAAC;4BAC1F,CAAC;wBACH,CAAC;gCAAS,CAAC;4BACT,EAAE,CAAC,KAAK,EAAE,CAAC;wBACb,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChF,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YAED,IAAI,eAAe,GAAG,EAAE,CAAC;YACzB,IAAI,eAAe,GAAG,EAAE,CAAC;YAEzB,0DAA0D;YAC1D,0CAA0C;YAC1C,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;gBAClC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC;oBACH,gBAAgB,CAAC,EAAE,CAAC,CAAC;oBAErB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB;;;;qBAIS,CACV,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,eAAe,CAA+B,CAAC;oBAEpF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACpB,eAAe,GAAG,YAAY,CAC5B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EACvC,wBAAwB,CACzB,CAAC;oBACJ,CAAC;oBAED,gDAAgD;oBAChD,IAAI,CAAC;wBACH,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;wBAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,mBAAmB,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;wBAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACvB,eAAe,GAAG,YAAY,CAC5B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAC1C,mBAAmB,CACpB,CAAC;wBACJ,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;oBAE3B,0EAA0E;oBAC1E,IAAI,CAAC;wBACH,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;wBAC/C,IAAI,eAAe,EAAE,CAAC;4BACpB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;4BACxE,MAAM,QAAQ,GAAG,EAAE;iCAChB,OAAO,CAAC,4DAA4D,CAAC;iCACrE,GAAG,EAA0C,CAAC;4BAEjD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;gCAChD,EAAE,CAAC,OAAO,CACR;;;;;sDAKoC,CACrC,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;4BAC/B,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;oBAE3B,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,CAAC;gBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;YAC7B,CAAC;YAED,qDAAqD;YACrD,IAAI,QAAQ,GAAmE,EAAE,CAAC;YAClF,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;oBAClC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;wBACvB,MAAM,UAAU,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;wBAC5C,IAAI,CAAC;4BACH,gBAAgB,CAAC,UAAU,CAAC,CAAC;4BAC7B,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC;4BACpD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;4BACzD,MAAM,aAAa,GAAG,UAAU,CAAC,eAAe,EAAE,OAAO,IAAI,GAAG,CAAC;4BACjE,MAAM,UAAU,GAAG,UAAU,CAAC,kBAAkB,IAAI,EAAE,CAAC;4BACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;4BAC/D,QAAQ,GAAG,aAAa;iCACrB,MAAM,CAAC,wBAAwB,EAAE,EAAE,EAAE,CAAC,wBAAwB,CAAC,CAAC;iCAChE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,CAAC;iCACrG,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iCACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;wBAClF,CAAC;gCAAS,CAAC;4BACT,UAAU,CAAC,KAAK,EAAE,CAAC;wBACrB,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;YAC7B,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClH,MAAM,YAAY,GAAmG,EAAE,OAAO,EAAE,CAAC;YACjI,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,YAAY,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACnC,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/daemon/routes/search.js

@@ -8,16 +8,27 @@ import { ConversationStore } from "../../store/conversation-store.js";
 import { SummaryStore } from "../../store/summary-store.js";
 import { RetrievalEngine } from "../../retrieval.js";
 import { PromotedStore } from "../../db/promoted.js";
+import { validateCwd } from "../validate-cwd.js";
 export function createSearchHandler() {
     return async (_req, res, body) => {
         const input = JSON.parse(body || "{}");
-        const { query, limit = 5, layers, tags, cwd } = input;
+        const { query, limit = 5, layers, tags } = input;
         const activeLayers = layers ?? ["episodic", "promoted"];
         const filterTags = Array.isArray(tags) && tags.length > 0 ? tags : undefined;
         if (!query) {
             sendJson(res, 400, { error: "query is required" });
             return;
         }
+        let cwd;
+        if (input.cwd) {
+            try {
+                cwd = validateCwd(input.cwd);
+            }
+            catch (err) {
+                sendJson(res, 400, { error: err instanceof Error ? err.message : "invalid cwd" });
+                return;
+            }
+        }
         let episodic = [];
         let promoted = [];
         if (cwd) {

package/dist/src/daemon/routes/search.js.map

@@ -1 +1 @@
-{"version":3,"file":"search.js","sourceRoot":"","sources":["../../../../src/daemon/routes/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,UAAU,mBAAmB;IACjC,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;QACtD,MAAM,YAAY,GAAa,MAAM,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAClE,MAAM,UAAU,GAAyB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,GAAc,EAAE,CAAC;QAC7B,IAAI,QAAQ,GAAc,EAAE,CAAC;QAE7B,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC;oBACH,gBAAgB,CAAC,EAAE,CAAC,CAAC;oBAErB,oDAAoD;oBACpD,IAAI,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBACtC,IAAI,CAAC;4BACH,MAAM,SAAS,GAAG,IAAI,iBAAiB,CAAC,EAAE,CAAC,CAAC;4BAC5C,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;4BACvC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;4BACzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;4BAC9E,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;4BAC7D,MAAM,eAAe,GAAG,UAAU;gCAChC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;oCACtB,MAAM,CAAC,GAAI,CAA6B,CAAC,IAAI,CAAC;oCAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;gCACpE,CAAC,CAAC;gCACJ,CAAC,CAAC,UAAU,CAAC;4BACf,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;wBAC7C,CAAC;wBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;oBAC7B,CAAC;oBAED,iDAAiD;oBACjD,IAAI,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBACtC,IAAI,CAAC;4BACH,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;4BAC5C,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;wBAC5D,CAAC;wBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;oBAC7B,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;wBACnB,CAAC;oBACP,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"search.js","sourceRoot":"","sources":["../../../../src/daemon/routes/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,UAAU,mBAAmB;IACjC,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QACjD,MAAM,YAAY,GAAa,MAAM,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAClE,MAAM,UAAU,GAAyB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,GAAuB,CAAC;QAC5B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;gBAClF,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,GAAc,EAAE,CAAC;QAC7B,IAAI,QAAQ,GAAc,EAAE,CAAC;QAE7B,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC;oBACH,gBAAgB,CAAC,EAAE,CAAC,CAAC;oBAErB,oDAAoD;oBACpD,IAAI,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBACtC,IAAI,CAAC;4BACH,MAAM,SAAS,GAAG,IAAI,iBAAiB,CAAC,EAAE,CAAC,CAAC;4BAC5C,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;4BACvC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;4BACzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;4BAC9E,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;4BAC7D,MAAM,eAAe,GAAG,UAAU;gCAChC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;oCACtB,MAAM,CAAC,GAAI,CAA6B,CAAC,IAAI,CAAC;oCAC9C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;gCACpE,CAAC,CAAC;gCACJ,CAAC,CAAC,UAAU,CAAC;4BACf,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;wBAC7C,CAAC;wBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;oBAC7B,CAAC;oBAED,iDAAiD;oBACjD,IAAI,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBACtC,IAAI,CAAC;4BACH,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;4BAC5C,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;wBAC5D,CAAC;wBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;oBAC7B,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;wBACnB,CAAC;oBACP,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/daemon/routes/session-complete.d.ts

@@ -0,0 +1,2 @@
+import type { RouteHandler } from "../server.js";
+export declare function createSessionCompleteHandler(): RouteHandler;

package/dist/src/daemon/routes/session-complete.js

@@ -0,0 +1,36 @@
+import { DatabaseSync } from "node:sqlite";
+import { projectDbPath, ensureProjectDir } from "../project.js";
+import { sendJson } from "../server.js";
+import { runLcmMigrations } from "../../db/migration.js";
+import { validateCwd } from "../validate-cwd.js";
+export function createSessionCompleteHandler() {
+    return async (_req, res, body) => {
+        const input = JSON.parse(body || "{}");
+        const { session_id, message_count } = input;
+        if (!session_id || !input.cwd) {
+            sendJson(res, 400, { error: "session_id and cwd required" });
+            return;
+        }
+        let cwd;
+        try {
+            cwd = validateCwd(input.cwd);
+        }
+        catch (err) {
+            sendJson(res, 400, { error: err instanceof Error ? err.message : "invalid cwd" });
+            return;
+        }
+        ensureProjectDir(cwd);
+        const db = new DatabaseSync(projectDbPath(cwd));
+        try {
+            db.exec("PRAGMA busy_timeout = 5000");
+            runLcmMigrations(db);
+            db.prepare("INSERT INTO session_ingest_log (session_id, message_count) VALUES (?, ?) " +
+                "ON CONFLICT(session_id) DO UPDATE SET message_count = excluded.message_count").run(session_id, message_count ?? 0);
+            sendJson(res, 200, { recorded: true });
+        }
+        finally {
+            db.close();
+        }
+    };
+}
+//# sourceMappingURL=session-complete.js.map

package/dist/src/daemon/routes/session-complete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-complete.js","sourceRoot":"","sources":["../../../../src/daemon/routes/session-complete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,UAAU,4BAA4B;IAC1C,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;QAC5C,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAC9B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YACtC,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACrB,EAAE,CAAC,OAAO,CACR,2EAA2E;gBACzE,8EAA8E,CACjF,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,IAAI,CAAC,CAAC,CAAC;YACtC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/daemon/routes/status.js

@@ -3,78 +3,91 @@ import { DatabaseSync } from "node:sqlite";
 import { projectDbPath, projectMetaPath } from "../project.js";
 import { sendJson } from "../server.js";
 import { PKG_VERSION } from "../server.js";
+import { validateCwd } from "../validate-cwd.js";
 export function createStatusHandler(config, startTime, actualPort) {
     return async (_req, res, body) => {
-        const input = JSON.parse(body || "{}");
-        const { cwd } = input;
-        if (!cwd) {
-            sendJson(res, 400, { error: "cwd is required" });
-            return;
-        }
-        // Calculate daemon uptime in seconds
-        const uptime = Math.floor((Date.now() - startTime) / 1000);
-        // Use actual port if provided, otherwise fall back to config port
-        const port = actualPort ?? config.daemon.port;
-        // Query project database for stats
-        let messageCount = 0;
-        let summaryCount = 0;
-        let promotedCount = 0;
-        const dbPath = projectDbPath(cwd);
-        if (existsSync(dbPath)) {
-            const db = new DatabaseSync(dbPath);
-            try {
-                db.exec("PRAGMA busy_timeout = 5000");
-                // Count messages
-                const msgResult = db.prepare("SELECT COUNT(*) as count FROM messages").get();
-                messageCount = msgResult?.count ?? 0;
-                // Count summaries
-                const sumResult = db.prepare("SELECT COUNT(*) as count FROM summaries").get();
-                summaryCount = sumResult?.count ?? 0;
-                // Count promoted
-                const promResult = db.prepare("SELECT COUNT(*) as count FROM promoted").get();
-                promotedCount = promResult?.count ?? 0;
+        try {
+            const input = JSON.parse(body || "{}");
+            if (!input.cwd) {
+                sendJson(res, 400, { error: "cwd is required" });
+                return;
             }
-            catch {
-                // If database query fails, return zeros
-                messageCount = 0;
-                summaryCount = 0;
-                promotedCount = 0;
+            let cwd;
+            try {
+                cwd = validateCwd(input.cwd);
             }
-            finally {
-                db.close();
+            catch (err) {
+                sendJson(res, 400, { error: err instanceof Error ? err.message : "invalid cwd" });
+                return;
             }
-        }
-        // Read meta.json for timestamps
-        let lastIngest = null;
-        let lastCompact = null;
-        let lastPromote = null;
-        const metaPath = projectMetaPath(cwd);
-        if (existsSync(metaPath)) {
-            try {
-                const meta = JSON.parse(readFileSync(metaPath, "utf-8"));
-                lastIngest = meta.lastIngest ?? null;
-                lastCompact = meta.lastCompact ?? null;
-                lastPromote = meta.lastPromote ?? null;
+            // Calculate daemon uptime in seconds
+            const uptime = Math.floor((Date.now() - startTime) / 1000);
+            // Use actual port if provided, otherwise fall back to config port
+            const port = actualPort ?? config.daemon.port;
+            // Query project database for stats
+            let messageCount = 0;
+            let summaryCount = 0;
+            let promotedCount = 0;
+            const dbPath = projectDbPath(cwd);
+            if (existsSync(dbPath)) {
+                const db = new DatabaseSync(dbPath);
+                try {
+                    db.exec("PRAGMA busy_timeout = 5000");
+                    // Count messages
+                    const msgResult = db.prepare("SELECT COUNT(*) as count FROM messages").get();
+                    messageCount = msgResult?.count ?? 0;
+                    // Count summaries
+                    const sumResult = db.prepare("SELECT COUNT(*) as count FROM summaries").get();
+                    summaryCount = sumResult?.count ?? 0;
+                    // Count promoted
+                    const promResult = db.prepare("SELECT COUNT(*) as count FROM promoted").get();
+                    promotedCount = promResult?.count ?? 0;
+                }
+                catch {
+                    // If database query fails, return zeros
+                    messageCount = 0;
+                    summaryCount = 0;
+                    promotedCount = 0;
+                }
+                finally {
+                    db.close();
+                }
             }
-            catch {
-                // If meta.json parse fails, keep timestamps as null
+            // Read meta.json for timestamps
+            let lastIngest = null;
+            let lastCompact = null;
+            let lastPromote = null;
+            const metaPath = projectMetaPath(cwd);
+            if (existsSync(metaPath)) {
+                try {
+                    const meta = JSON.parse(readFileSync(metaPath, "utf-8"));
+                    lastIngest = meta.lastIngest ?? null;
+                    lastCompact = meta.lastCompact ?? null;
+                    lastPromote = meta.lastPromote ?? null;
+                }
+                catch {
+                    // If meta.json parse fails, keep timestamps as null
+                }
             }
+            sendJson(res, 200, {
+                daemon: {
+                    version: PKG_VERSION,
+                    uptime,
+                    port,
+                },
+                project: {
+                    messageCount,
+                    summaryCount,
+                    promotedCount,
+                    lastIngest,
+                    lastCompact,
+                    lastPromote,
+                },
+            });
+        }
+        catch (err) {
+            sendJson(res, 500, { error: err instanceof Error ? err.message : "status failed" });
         }
-        sendJson(res, 200, {
-            daemon: {
-                version: PKG_VERSION,
-                uptime,
-                port,
-            },
-            project: {
-                messageCount,
-                summaryCount,
-                promotedCount,
-                lastIngest,
-                lastCompact,
-                lastPromote,
-            },
-        });
     };
 }
 //# sourceMappingURL=status.js.map

package/dist/src/daemon/routes/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../../src/daemon/routes/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,SAAiB,EAAE,UAAmB;IAC9F,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;QAEtB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,qCAAqC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;QAE3D,kEAAkE;QAClE,MAAM,IAAI,GAAG,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAE9C,mCAAmC;QACnC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,aAAa,GAAG,CAAC,CAAC;QAEtB,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;gBAEtC,iBAAiB;gBACjB,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,EAAuB,CAAC;gBAClG,YAAY,GAAG,SAAS,EAAE,KAAK,IAAI,CAAC,CAAC;gBAErC,kBAAkB;gBAClB,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAAuB,CAAC;gBACnG,YAAY,GAAG,SAAS,EAAE,KAAK,IAAI,CAAC,CAAC;gBAErC,iBAAiB;gBACjB,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,EAAuB,CAAC;gBACnG,aAAa,GAAG,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,wCAAwC;gBACxC,YAAY,GAAG,CAAC,CAAC;gBACjB,YAAY,GAAG,CAAC,CAAC;gBACjB,aAAa,GAAG,CAAC,CAAC;YACpB,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,WAAW,GAAkB,IAAI,CAAC;QAEtC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBACzD,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;gBACrC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;gBACvC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,oDAAoD;YACtD,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,MAAM,EAAE;gBACN,OAAO,EAAE,WAAW;gBACpB,MAAM;gBACN,IAAI;aACL;YACD,OAAO,EAAE;gBACP,YAAY;gBACZ,YAAY;gBACZ,aAAa;gBACb,UAAU;gBACV,WAAW;gBACX,WAAW;aACZ;SACF,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../../src/daemon/routes/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,SAAiB,EAAE,UAAmB;IAC9F,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;YAEvC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBACf,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACjD,OAAO;YACT,CAAC;YAED,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;gBAClF,OAAO;YACT,CAAC;YAED,qCAAqC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;YAE3D,kEAAkE;YAClE,MAAM,IAAI,GAAG,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YAE9C,mCAAmC;YACnC,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,aAAa,GAAG,CAAC,CAAC;YAEtB,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC;oBACH,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAEtC,iBAAiB;oBACjB,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,EAAuB,CAAC;oBAClG,YAAY,GAAG,SAAS,EAAE,KAAK,IAAI,CAAC,CAAC;oBAErC,kBAAkB;oBAClB,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAAuB,CAAC;oBACnG,YAAY,GAAG,SAAS,EAAE,KAAK,IAAI,CAAC,CAAC;oBAErC,iBAAiB;oBACjB,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,EAAuB,CAAC;oBACnG,aAAa,GAAG,UAAU,EAAE,KAAK,IAAI,CAAC,CAAC;gBACzC,CAAC;gBAAC,MAAM,CAAC;oBACP,wCAAwC;oBACxC,YAAY,GAAG,CAAC,CAAC;oBACjB,YAAY,GAAG,CAAC,CAAC;oBACjB,aAAa,GAAG,CAAC,CAAC;gBACpB,CAAC;wBAAS,CAAC;oBACT,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,CAAC;YACH,CAAC;YAED,gCAAgC;YAChC,IAAI,UAAU,GAAkB,IAAI,CAAC;YACrC,IAAI,WAAW,GAAkB,IAAI,CAAC;YACtC,IAAI,WAAW,GAAkB,IAAI,CAAC;YAEtC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;oBACzD,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;oBACrC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;oBACvC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;gBACzC,CAAC;gBAAC,MAAM,CAAC;oBACP,oDAAoD;gBACtD,CAAC;YACH,CAAC;YAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,MAAM,EAAE;oBACN,OAAO,EAAE,WAAW;oBACpB,MAAM;oBACN,IAAI;iBACL;gBACD,OAAO,EAAE;oBACP,YAAY;oBACZ,YAAY;oBACZ,aAAa;oBACb,UAAU;oBACV,WAAW;oBACX,WAAW;iBACZ;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/daemon/routes/store.d.ts

@@ -1,2 +1,3 @@
 import type { RouteHandler } from "../server.js";
-export declare function createStoreHandler(): RouteHandler;
+import type { DaemonConfig } from "../config.js";
+export declare function createStoreHandler(config: DaemonConfig): RouteHandler;

package/dist/src/daemon/routes/store.js

@@ -1,32 +1,66 @@
-import { mkdirSync } from "node:fs";
+import { mkdirSync, statSync } from "node:fs";
 import { dirname } from "node:path";
 import { DatabaseSync } from "node:sqlite";
-import { projectDbPath } from "../project.js";
+import { projectDbPath, projectDir } from "../project.js";
 import { sendJson } from "../server.js";
+import { sanitizeError } from "../safe-error.js";
 import { runLcmMigrations } from "../../db/migration.js";
 import { PromotedStore } from "../../db/promoted.js";
-export function createStoreHandler() {
+import { ScrubEngine } from "../../scrub.js";
+import { validateCwd } from "../validate-cwd.js";
+const SCRUB_CACHE_MAX = 100;
+const scrubCache = new Map();
+async function getScrubEngine(config, projDir) {
+    const patternsFile = `${projDir}/sensitive-patterns.txt`;
+    let mtime = 0;
+    try {
+        mtime = statSync(patternsFile).mtimeMs;
+    }
+    catch { /* file absent — mtime stays 0 */ }
+    const cached = scrubCache.get(projDir);
+    if (cached && cached.mtime === mtime)
+        return cached.engine;
+    const engine = await ScrubEngine.forProject(config.security?.sensitivePatterns ?? [], projDir);
+    // Evict oldest entry when at capacity (simple LRU via insertion-order Map)
+    if (scrubCache.size >= SCRUB_CACHE_MAX) {
+        scrubCache.delete(scrubCache.keys().next().value);
+    }
+    scrubCache.set(projDir, { engine, mtime });
+    return engine;
+}
+export function createStoreHandler(config) {
     return async (_req, res, body) => {
         const input = JSON.parse(body || "{}");
-        const { text, tags = [], metadata = {}, cwd } = input;
+        const { text, tags = [], metadata = {} } = input;
         if (!text) {
             sendJson(res, 400, { error: "text is required" });
             return;
         }
-        const projectPath = cwd || metadata.projectPath || "";
-        if (!projectPath) {
+        const rawProjectPath = input.cwd || metadata.projectPath || "";
+        if (!rawProjectPath) {
             sendJson(res, 400, { error: "cwd or metadata.projectPath is required" });
             return;
         }
+        let projectPath;
+        try {
+            projectPath = validateCwd(rawProjectPath);
+        }
+        catch (err) {
+            sendJson(res, 400, { error: err instanceof Error ? err.message : "invalid cwd" });
+            return;
+        }
+        const scrubber = await getScrubEngine(config, projectDir(projectPath));
+        const scrubbedText = scrubber.scrub(text);
         const dbPath = projectDbPath(projectPath);
         mkdirSync(dirname(dbPath), { recursive: true });
         const db = new DatabaseSync(dbPath);
         try {
             // Core: write to SQLite promoted table
+            db.exec("PRAGMA busy_timeout = 5000");
             runLcmMigrations(db);
             const store = new PromotedStore(db);
             const id = store.insert({
-                content: text,
+                content: scrubbedText,
                 tags,
                 projectId: metadata.projectId ?? "manual",
                 sessionId: metadata.sessionId ?? "manual",
@@ -36,7 +70,7 @@ export function createStoreHandler() {
             sendJson(res, 200, { stored: true, id });
         }
         catch (err) {
-            sendJson(res, 500, { error: err instanceof Error ? err.message : "store failed" });
+            sendJson(res, 500, { error: sanitizeError(err instanceof Error ? err.message : "store failed") });
         }
         finally {
             db.close();

package/dist/src/daemon/routes/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../../src/daemon/routes/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,UAAU,kBAAkB;IAChC,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;QAEtD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;QACtD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC1C,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,uCAAuC;YACvC,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;YAEpC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;gBACtB,OAAO,EAAE,IAAI;gBACb,IAAI;gBACJ,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,QAAQ;gBACzC,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,QAAQ;gBACzC,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC;gBAC1B,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;YAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../../src/daemon/routes/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AASjD,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEtD,KAAK,UAAU,cAAc,CAAC,MAAoB,EAAE,OAAe;IACjE,MAAM,YAAY,GAAG,GAAG,OAAO,yBAAyB,CAAC;IACzD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QAAC,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,iCAAiC,CAAC,CAAC;IAE3F,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IAE3D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/F,2EAA2E;IAC3E,IAAI,UAAU,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;QACvC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;IAC9D,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC;QAEjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;QAC/D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,WAAW,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC1C,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,uCAAuC;YACvC,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YACtC,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;YAEpC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;gBACtB,OAAO,EAAE,YAAY;gBACrB,IAAI;gBACJ,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,QAAQ;gBACzC,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,QAAQ;gBACzC,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC;gBAC1B,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;YAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/daemon/safe-error.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Sanitizes error messages for HTTP responses to prevent leaking
+ * internal file paths, stack traces, or database schema details.
+ */
+export declare function sanitizeError(message: string): string;