@manyoars/oars 0.5.1 → 0.5.2

package/README.md

@@ -209,9 +209,9 @@ Replay is local and read-only on your transcripts; it writes `crossings.jsonl` a
 
 `oars pool` uses the Many Oars pool, `https://pool.manyoars.com`, which is live (deposits there are closed until its covenant is published), or a pool server you name with `--server <url>` or `OARS_POOL_URL`. Every other command works without it.
 
-- `oars pool login --provider github|google` asks the pool to start the provider's device flow, prints the user code and link, and polls the pool until you approve; with `--verbose`, every request prints before it is sent. The pool holds the OAuth client and its secret, so the CLI needs no client ID or secret, and the provider's tokens never reach this machine.
+- `oars pool login --provider github|google` asks the pool to start the provider's device flow, prints the user code and link, and polls the pool until you approve (a failed poll is retried with a longer wait until the code expires; the output names the exclusion-terms file when there is none, and the first `pool deposit` needs it); with `--verbose`, every request prints before it is sent. The pool holds the OAuth client and its secret, so the CLI needs no client ID or secret, and the provider's tokens never reach this machine.
 - `oars pool logout` revokes this machine's credential at the pool, then removes the local sign-in. If the pool cannot be reached it still removes the local sign-in and says the credential was not revoked there.
-- `oars pool deposit` writes a batch of session skeletons (a closed list of fields, each value redacted first; a host is hashed by the pool on arrival) to an outbox for each session that passes your folder allowlist and the exclusion check, and stops: no session data is sent. `--send <hash>` sends one batch that `outbox` printed and that is unchanged on disk, once this account has accepted the pool covenant (a person types the phrase the covenant screen states, at a terminal; `--accept-covenant <version>` only names the version expected and accepts nothing; the screen then asks "Are you in the EU, the EEA, or the UK? (yes/no)" and sends the answer, and `--in-eu-eea-uk <yes|no>` answers it without asking; while the pool is closed to those regions a yes, or a request from them, is refused with `region_closed` and nothing is accepted); before that it reads the covenant, sends no batch, and exits 3 with `covenant_not_accepted`. A hash that was never shown, or a batch that changed, is refused before any request. The detached sender is the other sender: after the pool says your account accepted its covenant, it sends new batches, and raw copies only if you said yes to the raw prompt (`oars pool raw --consent yes`, answered by typing the phrase `I consent to sending raw copies` at a terminal; a yes also tells the pool, and `--consent no` tells it to stop accepting raw copies, whatever a later request states (a machine that held a yes and is signed out exits nonzero: the pool was not told), and the pool's nightly job then erases the raw copies it already holds, starting that night; a large account can take more than one night). With no sign-in, no acceptance, or an unreachable server it sends nothing.
+- `oars pool deposit` writes a batch of session skeletons (a closed list of fields, each value redacted first; a host is hashed by the pool on arrival) to an outbox for each session that passes your folder allowlist and the exclusion check and whose last line is over 6 hours old, and stops: no session data is sent. `--send <hash>` sends one batch that `outbox` printed and that is unchanged on disk, once this account has accepted the pool covenant (a person types the phrase the covenant screen states, at a terminal; `--accept-covenant <version>` only names the version expected and accepts nothing; the screen then asks "Are you in the EU, the EEA, or the UK? (yes/no)" and sends the answer, and `--in-eu-eea-uk <yes|no>` answers it without asking; while the pool is closed to those regions a yes, or a request from them, is refused with `region_closed` and nothing is accepted); before that it reads the covenant, sends no batch, and exits 3 with `covenant_not_accepted`. A hash that was never shown, or a batch that changed, is refused before any request. The detached sender is the other sender: after the pool says your account accepted its covenant, it sends new batches, and raw copies only if you said yes to the raw prompt (`oars pool raw --consent yes`, answered by typing the phrase `I consent to sending raw copies` at a terminal; a yes also tells the pool, and `--consent no` tells it to stop accepting raw copies, whatever a later request states (a machine that held a yes and is signed out exits nonzero: the pool was not told), and the pool's nightly job then erases the raw copies it already holds, starting that night; a large account can take more than one night). With no sign-in, no acceptance, or an unreachable server it sends nothing.
 - `deposit`, `outbox`, `export`, and `fetch` need `oars pool login` first; without it they exit 3 and name the server.
 - `oars pool coverage [--org-size <band>] [--repo-visibility public|private|unknown]` sets the two coverage bands only you can state, read locally and never from the network; an unset band goes on the wire as `unknown`.
 - `oars pool export --out <folder> [--raw]` saves a copy of what the pool holds about your account (GDPR Articles 15(3) and 20), as JSON, one file a page, readable by you only. It covers your account row (with your raw consent record), when your sign-ins end (never the credential), your covenant acceptances, your machines (without their keys, with the day of each one's last deposit and its key days), your repository keys, your deposit hours, your deposits as they now read (with the machine, host class, and launcher each came from, and the host class and launcher the batch claimed), your raw ledger, your staged deposit parts, your erasure audit rows, and your telemetry days. `--raw` also saves each raw transcript you deposited that has not been erased, checked against its hash. It needs `oars pool login`, writes nothing to the pool, prints what it saved, and exits nonzero naming any page or object that failed; a rerun overwrites the same files. Totals the pool derives from many accounts are not yours to export and are not in it.

package/dist/cli.js

@@ -151,7 +151,7 @@ const buildProgram = (deps, observed) => {
         const period = flag(options, 'year') ? 'year' : flag(options, 'month') ? 'month' : 'week';
         emit(deps, flag(options, 'json'), await sessionsCard(sessionDeps(deps), { period, text: flag(options, 'text'), out: text(options, 'out'), noCost: options.cost === false }, deps.env));
     });
-    const sessions = program.command('sessions').description("deposit and recall your own coding-agent session logs, locally (these commands make no model call and no network call, except `gold arms`, which asks your own Claude subscription; telemetry is separate: oars telemetry)");
+    const sessions = program.command('sessions').description("deposit and recall your own coding-agent session logs, locally; try it on made-up sessions: oars sessions try (these commands make no model call and no network call, except `gold arms`, which asks your own Claude subscription; telemetry is separate: oars telemetry)");
     sessions
         .command('deposit')
         .description('read session logs into the local observation log, from every folder unless --allow names some or --deny keeps some out; idempotent. Subagent transcripts under each session (<project>/<session>/subagents/) are deposited with their parent, and each raw transcript is hard-linked or copied into the oars archive beside the store')

package/dist/sessions/empty-state.d.ts

@@ -1,7 +1,7 @@
 import type { Source } from './sources.js';
 import type { DepositResult, SessionsRuntime } from './store.js';
 /** `recall` over a store with no sessions in it. */
-export declare const EMPTY_RECALL = "Your store is empty, so there is nothing to recall. See it work on made-up sessions with `oars sessions try`, or fill it with `oars sessions deposit`, which reads this machine's coding-agent session logs into a local store and archives a copy of each transcript.";
+export declare const EMPTY_RECALL = "Your store is empty, so there is nothing to recall. See it work on made-up sessions with `oars sessions try`, or fill it with `oars sessions deposit`, which reads this machine's coding-agent session logs into a local store and archives a copy of each transcript. It reads your own session history, not made-up sessions.";
 /** `books` over a store with no sessions in it; `what` is "prompts" or "pulls". */
 export declare const emptyBooks: (what: string) => string;
 /**

package/dist/sessions/empty-state.js

@@ -1,7 +1,7 @@
 // What `deposit`, `recall`, and `books` say when there is nothing to show, so a first run reads as "nothing found here" and not as a broken tool.
 import { compileAllow, isDenial } from './allow.js';
 /** The two commands that get someone out of an empty store: watch it work on made-up sessions first with `sessions try`, or fill it from their own sessions with `sessions deposit`. */
-const WAYS_OUT = "See it work on made-up sessions with `oars sessions try`, or fill it with `oars sessions deposit`, which reads this machine's coding-agent session logs into a local store and archives a copy of each transcript.";
+const WAYS_OUT = "See it work on made-up sessions with `oars sessions try`, or fill it with `oars sessions deposit`, which reads this machine's coding-agent session logs into a local store and archives a copy of each transcript. It reads your own session history, not made-up sessions.";
 /** `recall` over a store with no sessions in it. */
 export const EMPTY_RECALL = `Your store is empty, so there is nothing to recall. ${WAYS_OUT}`;
 /** `books` over a store with no sessions in it; `what` is "prompts" or "pulls". */

package/dist/sessions/injected.js

@@ -76,6 +76,31 @@ const mapContent = (content, text, result, definition) => {
     });
     return items.some((item, at) => item !== content[at]) ? items : content;
 };
+// Harness text a request blob of the system role carries, by what it opens with or names. The whole block is marked, under the kind (and so the hash) its
+// attachment record gets, because it is the same text. First match wins. A system text with none of these forms is left to the other rules.
+const SYSTEM_FORMS = [
+    [/\bSessionStart(?::[\w-]+)? hook\b|\bhook additional context\b/, 'hook-additional-context'],
+    [/following skills are available for use with the Skill tool/i, 'skill-listing'],
+    [/Available agent types/i, 'agent-listing-delta'],
+    [/^\s*#{1,3} MCP Server Instructions\b|following MCP servers have provided instructions/m, 'mcp-instructions-delta'],
+    [/^\s*#{1,3} Environment\s*$|^\s*You have been invoked in the following environment/m, 'environment'],
+    [/Contents of [^\n]*?[\\/]\.claude[\\/]rules[\\/][^\n]*\.md\b|Contents of [^\n]*?(?:CLAUDE|AGENTS|MEMORY)(?:\.local)?\.md\b/, 'instructions'],
+];
+// A memory file: an instruction file, the memory index, a note under a `memory` folder, or a rules file.
+const MEMORY_PATH = /(?:^|[\\/])(?:CLAUDE|AGENTS|MEMORY)(?:\.local)?\.md$|[\\/]memory[\\/][^\\/]+\.md$|[\\/]\.claude[\\/]rules[\\/][^\\/]+\.md$/i;
+const MEMORY_MENTION = /(?:CLAUDE|AGENTS|MEMORY)(?:\.local)?\.md\b|[\\/]memory[\\/][^\s"'`\\/]+\.md\b/i;
+const CHANGED = /changed on disk|was modified/i;
+/** The kind of harness text a system-role string is, or undefined: one of the forms above, or a note that a memory file changed. */
+const systemKindOf = (text) => {
+    const form = SYSTEM_FORMS.find(([shape]) => shape.test(text));
+    if (form !== undefined)
+        return form[1];
+    return MEMORY_MENTION.test(text) && CHANGED.test(text) ? 'memory-file' : undefined;
+};
+const systemText = (key) => (text) => {
+    const kind = text.trim() === '' || MARKER.test(text.trim()) ? undefined : systemKindOf(text);
+    return kind === undefined ? text : markerOf(key, kind, text);
+};
 const messageRule = (key, position, known) => {
     const whole = (text) => (text.trim() === '' || MARKER.test(text.trim()) ? text : markerOf(key, 'meta', text));
     const leading = (text) => {
@@ -91,13 +116,25 @@ const messageRule = (key, position, known) => {
         return content === message['content'] || content === undefined ? message : { ...message, content };
     };
 };
-const withMessage = (line, field, rule) => {
+const withMessage = (line, field, rule, role = 'user') => {
     const message = line[field];
-    if (!isObject(message) || message['role'] !== 'user')
+    if (!isObject(message) || message['role'] !== role)
         return line;
     const next = rule(message);
     return next === message ? line : { ...line, [field]: next };
 };
+/** The rule for a request blob of the system role: the harness's own forms first, then the text other lines repeat. */
+const systemMessage = (key, known) => {
+    const mark = systemText(key);
+    const text = (value) => {
+        const next = mark(value);
+        return next !== value || !known.has(normalize(value)) ? next : markerOf(key, 'meta', value);
+    };
+    return (message) => {
+        const content = mapContent(message['content'], text, text, (tool) => tool);
+        return content === message['content'] || content === undefined ? message : { ...message, content };
+    };
+};
 const withField = (line, field, change) => {
     const value = line[field];
     if (value === undefined)
@@ -168,6 +205,8 @@ export const injectedRule = (key, known = new Set()) => {
     const userMessage = messageRule(key, 'typed', known);
     const metaMessage = messageRule(key, 'meta', known);
     const blobMessage = messageRule(key, 'blob', known);
+    const systemBlob = systemMessage(key, known);
+    const memory = blocksIn(key, 'memory-file');
     // A meta line's `origin` says where the injected text came from; its `body` and `handback` are that text again, while `kind` stays readable.
     const originText = (origin) => {
         if (!isObject(origin))
@@ -179,10 +218,16 @@ export const injectedRule = (key, known = new Set()) => {
             case 'user':
                 return line['isMeta'] === true ? withField(withMessage(line, 'message', metaMessage), 'origin', originText) : withMessage(line, 'message', userMessage);
             case 'api-request-blob':
-                return withMessage(line, 'message', blobMessage);
+                return withMessage(withMessage(line, 'message', blobMessage), 'message', systemBlob, 'system');
             case 'attachment': {
                 const attachment = line['attachment'];
                 const kind = isObject(attachment) ? attachment['type'] : undefined;
+                // A memory file the model edited or that changed on disk: the snippet (and the message it was shown in) is the file's text.
+                const file = isObject(attachment) ? attachment['filename'] : undefined;
+                if (kind === 'edited_text_file' && typeof file === 'string' && MEMORY_PATH.test(file)) {
+                    const snippet = (value) => (isObject(value) ? withField(value, 'snippet', (text) => mapStrings(text, 'snippet', memory)) : value);
+                    return withField(withField(line, 'attachment', snippet), 'rendered', (value) => mapStrings(value, 'rendered', memory));
+                }
                 if (typeof kind !== 'string' || !INJECTED_ATTACHMENTS.has(kind))
                     return line;
                 // The record repeats its text as the message the model was shown (`rendered`), so that is the same block again.
@@ -197,9 +242,12 @@ export const injectedRule = (key, known = new Set()) => {
                 });
             case 'system':
                 // The hook output a stop-hook summary carries: what a hook printed, its error text, and the command line it ran.
-                return line['subtype'] === 'stop_hook_summary'
-                    ? HOOK_SUMMARY_FIELDS.reduce((acc, name) => withField(acc, name, (value) => mapStrings(value, name, blocksIn(key, 'hook-summary'))), line)
-                    : line;
+                if (line['subtype'] === 'stop_hook_summary')
+                    return HOOK_SUMMARY_FIELDS.reduce((acc, name) => withField(acc, name, (value) => mapStrings(value, name, blocksIn(key, 'hook-summary'))), line);
+                // Any other system text is the harness speaking (a changed memory file, a notice), except the echo of a command the operator ran: that is operator output, not an instruction.
+                if (line['subtype'] === 'local_command')
+                    return line;
+                return withField(line, 'content', (value) => (typeof value === 'string' ? systemText(key)(value) : value));
             case 'session_meta':
             case 'turn_context':
                 return withField(line, 'payload', (payload) => (isObject(payload) ? codexFields(key, payload) : payload));

package/dist/sessions/pool-command.js

@@ -47,6 +47,8 @@ const DEFAULT_INTERVAL_SEC = 5;
 const DEFAULT_EXPIRY_SEC = 900;
 /** RFC 8628: a `slow_down` adds five seconds to every poll after it. */
 const SLOW_DOWN_MS = 5000;
+/** The longest wait between polls after failed ones. */
+const MAX_BACKOFF_MS = 60_000;
 export { isObject, loadSignIns, textIn };
 const usage = (message, step) => new CliError(message, ExitCode.USAGE, step);
 /** The Many Oars pool, used when neither `--server` nor `OARS_POOL_URL` names another. */
@@ -156,9 +158,30 @@ ${proofLines(account, provedAt)}`;
 /** Polls the pool until the person approves, and returns the pool's answer with the credential. Time is counted in the waits asked for, so a machine that slept through the code still gets one poll that says it expired. */
 const awaitCredential = async (deps, server, started, show) => {
     let { intervalMs } = started;
-    for (let waited = 0; waited < started.expiresMs; waited += intervalMs) {
-        await deps.sleep(intervalMs);
-        const reply = await ask(deps, LOGIN, server, '/v1/login/poll', { body: { handle: started.handle }, show });
+    let failures = 0;
+    let lastFailure;
+    for (let waited = 0; waited < started.expiresMs;) {
+        // A failed poll (a network error or a 5xx) is the provider or the network having a bad minute, not the person's answer: wait longer each time, up to the cap, and ask again until the code's own expiry.
+        const wait = Math.min(intervalMs * 2 ** failures, Math.max(intervalMs, MAX_BACKOFF_MS));
+        await deps.sleep(wait);
+        waited += wait;
+        // `ask` rejects only with the unreachable failure of `send`.
+        const [settled] = await Promise.allSettled([ask(deps, LOGIN, server, '/v1/login/poll', { body: { handle: started.handle }, show })]);
+        // A rejection that is not the unreachable failure is a bug, not a bad minute: it ends the login as itself.
+        if (settled.status === 'rejected') {
+            if (!(settled.reason instanceof CliError) || settled.reason.exitCode !== ExitCode.UNREACHABLE)
+                throw settled.reason;
+            lastFailure = settled.reason;
+        }
+        const reply = settled.status === 'fulfilled' ? settled.value : undefined;
+        if (reply !== undefined && reply.status >= 500)
+            lastFailure = refusal(LOGIN, reply);
+        if (reply === undefined || reply.status >= 500) {
+            failures += 1;
+            continue;
+        }
+        failures = 0;
+        lastFailure = undefined;
         if (reply.status !== 200 || !isObject(reply.body))
             throw closedProof(reply) ?? refusal(LOGIN, reply);
         const status = textIn(reply.body, 'status');
@@ -175,6 +198,9 @@ const awaitCredential = async (deps, server, started, show) => {
         else if (status !== 'pending')
             throw new CliError('The pool answered a sign-in poll with a state this client does not know.', ExitCode.UNEXPECTED, LOGIN);
     }
+    // Out of time with the last poll still failing: the failure is the truth (exit 8), not an expiry nobody saw.
+    if (lastFailure !== undefined)
+        throw lastFailure;
     const title = 'The sign-in code expired. Run oars pool login again.';
     throw new CliError(title, ExitCode.AUTH, LOGIN, { code: 'EXPIRED_TOKEN', title });
 };
@@ -223,7 +249,11 @@ export const poolLogin = async (deps, options) => {
     const pinned = { ...signIn, signingKeys: known === undefined ? signIn.signingKeys : held };
     await mkdirOwnerOnly(storeDir);
     await writeOwnerOnly(signInsFile(storeDir), `${JSON.stringify([...saved.filter((entry) => entry !== known), pinned])}\n`);
-    return { document: { ok: true, server, account: signIn.account, expiresAt: signIn.expiresAt }, text: `Signed in to ${server} as ${signIn.account}.` };
+    // The first deposit stops without a term file, so the login that precedes it says so.
+    const { terms: termsFile } = exclusionPaths(runtimeOf(deps).projectsRoot, deps.env);
+    const bare = (await loadTerms(termsFile)).length === 0;
+    return { document: { ok: true, server, account: signIn.account, expiresAt: signIn.expiresAt, ...(bare ? { termsFile } : {}) }, text: `Signed in to ${server} as ${signIn.account}.${bare ? `
+${termsHint(termsFile)}` : ''}` };
 };
 /** The pool is not answering: it could not be reached, or a gateway in front of it says so. */
 const poolDown = (status) => status === 502 || status === 503 || status === 504;
@@ -414,6 +444,8 @@ export const postRaw = async (deps, options) => {
 const rawNote = (consent) => consent === 'granted' ? '' : consent === 'declined' ? 'You answered no to the raw prompt; oars pool raw --consent yes changes it.' : 'None is queued until you answer the raw prompt with oars pool raw --consent yes.';
 /** The exclusion terms in force now, re-read from the term file each time it is asked: empty when the file is missing or unreadable. */
 export const currentTerms = (deps) => loadTerms(exclusionPaths(runtimeOf(deps).projectsRoot, deps.env).terms);
+/** The one line a person with no exclusion terms needs: where the file goes and what names another. The deposit stays fail-closed without it (the A38 exclusion rule), so the first run says so before the deposit has to. */
+const termsHint = (file) => `No exclusion terms file at ${file}: until it holds a term, one per line, every session stays out of the outbox. Create it there, or set OARS_EXCLUSION_TERMS to the file of your own.`;
 /** `deposit --send <hash>`: the send lock the detached sender (hook-bin.js nightly) takes too, then a skip for a hash already in `sent.log`, then the batch lock, then the covenant (accepted here or before, or nothing is sent), then the request. The body is read and hashed again just before the request. */
 const sendBatch = async (deps, options) => {
     const { outbox, server, token, hash } = options;
@@ -568,7 +600,7 @@ export const poolDeposit = async (deps, options) => {
             continue;
         }
         // The batch of a session is built once the session and its subagents have ended; a session still in progress waits, and an earlier batch of it is withdrawn. A machine's Stop is the end of a turn, not of a session: its VM may be reclaimed before the session ends, so it builds the open session as it stands.
-        if (machine === undefined && !hasEnded(records, deps.now(), await lastWritten(runtime, records.main.project, records.main.session))) {
+        if (machine === undefined && !hasEnded(records, deps.now(), await lastWritten(runtime, records.main.project, records.main.session), undefined, options.covenant !== undefined)) {
             counts.notEnded += 1;
             await withdraw(key);
             continue;
@@ -644,9 +676,10 @@ export const poolDeposit = async (deps, options) => {
         `Raw copies queued: ${String(counts.raw.copies)} (${String(counts.raw.bytes)} bytes, ${String(counts.raw.masked)} values masked). ${rawNote(saved.pool.rawConsent)}`.trim(),
         ...(rawStale(saved.pool, covenant) ? [`Your yes to the raw prompt was given under covenant ${saved.pool.rawConsentVersion ?? 'none'}, not ${covenant ?? ''}, so no raw copy is queued. Run oars pool raw --consent yes to answer for the covenant now in force.`] : []),
         ...(counts.off === 0 ? [] : [`${String(counts.off)} ${counts.off === 1 ? 'session' : 'sessions'} in a folder switched off: nothing of them is queued.`]),
+        ...(termList.length === 0 ? [termsHint(terms)] : []),
         'Run oars pool outbox to print exactly what would be sent.',
     ];
-    return { document: { ok: true, server, ...counts }, text: lines.join('\n') };
+    return { document: { ok: true, server, ...counts, ...(termList.length === 0 ? { termsFile: terms } : {}) }, text: lines.join('\n') };
 };
 /** Each field of a batch, at any depth, with its row. A field with no row fails the command rather than printing blank. */
 const explained = (bytes) => {

package/dist/sessions/pool-wire.d.ts

@@ -313,11 +313,12 @@ export declare const SESSION_IDLE_HOURS = 6;
 /** No session leaves this machine sooner than this after it ends, whatever `session_idle_hours` is: time for `oars sessions deposit --deny` or a delete to act on it first. Today the longer idle window governs; this is the floor under it. */
 export declare const HOLD_WINDOW_MS: number;
 /**
- * Whether a session's batch may be built at `now`: no transcript of it, main or subagent, has gained a line for `SESSION_IDLE_HOURS`. A transcript gains a line when capture sees it change, which
- * stamps a new `rev` in epoch milliseconds, but a transcript can grow after the last capture, so `written` (the newest write to any raw file of the session, 0 when none is known) counts too: the
- * session was last active at the later of the two. A subagent that died without an end marker holds its session back at most that long.
+ * Whether a session's batch may be built at `now`: no transcript of it, main or subagent, has gained a line for `SESSION_IDLE_HOURS`. A transcript was last active at its own last line (`tsLast`, the
+ * session's clock, not ours), or at its capture (`rev`, epoch milliseconds) when it has none, so a store captured a minute ago from days-old transcripts holds sessions that ended days ago. A transcript can
+ * also grow after the last capture, so `written` (the newest write to any raw file of the session, 0 when none is known) counts when it is later than every capture: a write at or before the capture is the
+ * file arriving, not the session going on. A last line later than the capture is a bad clock, and the capture caps it. A person's build (`sender` false) takes the ended session at once. The sender, which builds and sends in one run, also waits `HOLD_WINDOW_MS` after the newest capture, so a session oars is seeing for the first time (a days-old transcript of a new harness) leaves no sooner than an hour later, time for `--deny` or a delete. A subagent that died without an end marker holds its session back at most that long.
  */
-export declare const hasEnded: (records: SessionRecords, now: number, written: number, idleMs?: number) => boolean;
+export declare const hasEnded: (records: SessionRecords, now: number, written: number, idleMs?: number, sender?: boolean) => boolean;
 /** Every main session of a store, with its records. */
 export declare const sessionsOf: (store: {
     sessions: readonly SessionObservation[];

package/dist/sessions/pool-wire.js

@@ -89,11 +89,21 @@ const HOUR_MS = 60 * 60 * 1000;
 /** No session leaves this machine sooner than this after it ends, whatever `session_idle_hours` is: time for `oars sessions deposit --deny` or a delete to act on it first. Today the longer idle window governs; this is the floor under it. */
 export const HOLD_WINDOW_MS = HOUR_MS;
 /**
- * Whether a session's batch may be built at `now`: no transcript of it, main or subagent, has gained a line for `SESSION_IDLE_HOURS`. A transcript gains a line when capture sees it change, which
- * stamps a new `rev` in epoch milliseconds, but a transcript can grow after the last capture, so `written` (the newest write to any raw file of the session, 0 when none is known) counts too: the
- * session was last active at the later of the two. A subagent that died without an end marker holds its session back at most that long.
+ * Whether a session's batch may be built at `now`: no transcript of it, main or subagent, has gained a line for `SESSION_IDLE_HOURS`. A transcript was last active at its own last line (`tsLast`, the
+ * session's clock, not ours), or at its capture (`rev`, epoch milliseconds) when it has none, so a store captured a minute ago from days-old transcripts holds sessions that ended days ago. A transcript can
+ * also grow after the last capture, so `written` (the newest write to any raw file of the session, 0 when none is known) counts when it is later than every capture: a write at or before the capture is the
+ * file arriving, not the session going on. A last line later than the capture is a bad clock, and the capture caps it. A person's build (`sender` false) takes the ended session at once. The sender, which builds and sends in one run, also waits `HOLD_WINDOW_MS` after the newest capture, so a session oars is seeing for the first time (a days-old transcript of a new harness) leaves no sooner than an hour later, time for `--deny` or a delete. A subagent that died without an end marker holds its session back at most that long.
  */
-export const hasEnded = (records, now, written, idleMs = SESSION_IDLE_HOURS * HOUR_MS) => now - Math.max(written, ...records.transcripts.map(({ session }) => session.rev)) >= Math.max(idleMs, HOLD_WINDOW_MS);
+export const hasEnded = (records, now, written, idleMs = SESSION_IDLE_HOURS * HOUR_MS, sender = false) => {
+    const lastLines = records.transcripts.map(({ session }) => {
+        const ts = session.tsLast === null ? Number.NaN : Date.parse(session.tsLast);
+        return Number.isNaN(ts) ? session.rev : Math.min(ts, session.rev);
+    });
+    const captured = Math.max(...records.transcripts.map(({ session }) => session.rev));
+    if (sender && now - captured < HOLD_WINDOW_MS)
+        return false;
+    return now - Math.max(written > captured ? written : 0, ...lastLines) >= Math.max(idleMs, HOLD_WINDOW_MS);
+};
 const groupBy = (items, keyOf) => {
     const groups = new Map();
     for (const item of items) {

package/dist/sessions/read-interaction.js

@@ -1,6 +1,6 @@
 // Interaction (spec Section 6, order 2): a tool fails more on one tier than another, beyond how those two tiers differ on every other tool. The difference of differences is
 // what makes it an interaction: a tier that fails more on everything has a main effect, usually the harder work it is given. The axis is the tier assigned, not a model version
-// (ruling mrd5591-08: one version per model on this store), and comparisons hold the version bucket constant. Effort is not in a cell (rule 3), so nothing here holds it. Confounders it does not remove: task assignment by
+// (ruling owner-08: one version per model on this store), and comparisons hold the version bucket constant. Effort is not in a cell (rule 3), so nothing here holds it. Confounders it does not remove: task assignment by
 // tier, which is the operator's own choice and the largest of them, effort, prompt class, and a failure not being a misfit.
 import { UNKNOWN } from './cells.js';
 import { candidateOf, differenceOf, estimateOf, screen, TRIALS_FLOOR } from './read-order.js';

package/dist/sessions/read-lead-lag.js

@@ -1,5 +1,5 @@
 // Lead-lag (spec Section 6, order 3), the labeled experiment: does a tool's failure rate moving come before its share moving? Chosen over a model release moving tool choice
-// because each model has one version here with no release date (ruling mrd5591-08), and two version boundaries are too few to cut in time, while consecutive days over many tools
+// because each model has one version here with no release date (ruling owner-08), and two version boundaries are too few to cut in time, while consecutive days over many tools
 // can be cut. A search over pairs of tools was rejected: it manufactures the false patterns Section 6 warns about, and this is one question asked once.
 //
 // A pair shares no day between its sides. A failure move ending on day d is paired with the share move from d+1 to d+2, not d to d+1: a burst of failing calls on d lifts both the

package/dist/sessions/read-readable.js

@@ -1,4 +1,4 @@
-// What this store cannot read, stated rather than forced (ruling mrd5591-08). A family that finds nothing has made no claim about why, so a reader of an empty family could take
+// What this store cannot read, stated rather than forced (ruling owner-08). A family that finds nothing has made no claim about why, so a reader of an empty family could take
 // "no reads" for "nothing moved". These rows separate the two: a question the store cannot ask from one it asked and got no answer to.
 import { interactionCandidates } from './read-interaction.js';
 import { leadLagPairs, PAIRS_FLOOR } from './read-lead-lag.js';

package/dist/sessions/redact.d.ts

@@ -8,10 +8,19 @@ export declare const makeRedactor: (domains?: readonly string[]) => Redactor;
 export declare const placeholders: (text: string) => number;
 /** The names this machine's person goes by in a transcript: the account's and the home folder's. A name under three characters would mask ordinary words, so it is left to the path rules. */
 export declare const localNames: (home?: string, account?: () => string) => string[];
+/** What only a sample pack asks of the raw-copy rules (t1111). */
+export interface PackRules {
+    /** The accounts the operator's repositories live under (a GitHub user or organization): masked as `<owner>` where one stands as a path segment or after a `:` of a remote. */
+    handles?: readonly string[];
+    /** Rewrites a tool use id (`toolu_...`, `srvtoolu_...`) to the value the pack keys it to, so a call and its result still pair; without it the entropy rule masks each as `<secret>`. */
+    toolId?: (id: string) => string;
+    /** Keeps a public host the session itself fetched or searched (the URL or `allowed_domains` of a WebFetch or WebSearch input) in the clear in that call's result. */
+    fetchedHosts?: boolean;
+}
 /** A whole transcript body redacted for upload, and how many values were masked (placeholders added, a count and nothing else). `names` are the local usernames to mask wherever they stand as a whole word. */
-export declare const redactTranscript: (body: string, domains?: readonly string[], names?: readonly string[], injectedKey?: string) => {
+export declare const redactTranscript: (body: string, domains?: readonly string[], names?: readonly string[], injectedKey?: string, pack?: PackRules) => {
     text: string;
     masked: number;
 };
 /** The version of the rules above, stated to the pool with every raw part; a change to any rule of `redactTranscript` raises it. */
-export declare const REDACTION_VERSION = "3";
+export declare const REDACTION_VERSION = "4";

package/dist/sessions/redact.js

@@ -8,25 +8,30 @@ import { injectedRule, learnInjected } from './injected.js';
 export const PATTERNS = [
     [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, '<secret>'],
     [/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, '<secret>'],
-    [/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g, '<secret>'],
-    [/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, '<secret>'],
+    // A synthetic fixture quoted in a session is masked like a real token (a secret scanner flags the prefix, not the value), so the minimums are short and the
+    // left guard is a non-alphanumeric: `FAKE_ghp_...` still starts a token where `\b` would miss it.
+    [/(?<![A-Za-z0-9])gh[pousr]_[A-Za-z0-9]{8,}(?![A-Za-z0-9])/g, '<secret>'],
+    [/(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{8,}(?![A-Za-z0-9])/g, '<secret>'],
     [/\bsk-(?:ant-)?[A-Za-z0-9_-]{16,}\b/g, '<secret>'],
-    [/\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{10,}\b/g, '<secret>'],
-    [/\bwhsec_[A-Za-z0-9]{10,}\b/g, '<secret>'],
-    [/\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g, '<secret>'],
+    [/(?<![A-Za-z0-9])(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{6,}(?![A-Za-z0-9])/g, '<secret>'],
+    [/(?<![A-Za-z0-9])whsec_[A-Za-z0-9]{6,}(?![A-Za-z0-9])/g, '<secret>'],
+    [/(?<![A-Za-z0-9])xox[abprs]-[A-Za-z0-9-]{6,}(?![A-Za-z0-9])/g, '<secret>'],
     [/\bAIza[0-9A-Za-z_-]{30,}\b/g, '<secret>'],
     [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '<secret>'],
     [/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{12,}/gi, '$1 <secret>'],
     // user:password@host inside a URL
     [/(\b[a-z][a-z0-9+.-]*:\/\/)[^\s/:@]+:[^\s/@]+@/gi, '$1<secret>@'],
-    // NAME=value and "name": "value" where the name says it is a secret
-    [/\b([A-Za-z0-9_-]*(?:password|passwd|secret|token|api[_-]?key|private[_-]?key|credential)[A-Za-z0-9_-]*)(["']?\s*[=:]\s*)(["']?)[^\s"'&,;]{4,}\3/gi, '$1$2$3<secret>$3'],
+    // NAME=value and "name": "value" where the name says it is a secret. A vendor name before a colon (`1password: ...` in prose) is no key. A plural
+    // `tokens` name (`tokens`, `max_tokens`, `inputTokens`) is a count and keeps a bare number, as the JSON walk does; any other `token` name masks a number too.
+    [/\b(?!1password(?![A-Za-z0-9_-])["']?\s*:\s)([A-Za-z0-9_-]*(?:password|passwd|secret|api[_-]?key|private[_-]?key|credential)[A-Za-z0-9_-]*)(["']?\s*[=:]\s*)(["']?)[^\s"'&,;]{4,}\3/gi, '$1$2$3<secret>$3'],
+    [/\b((?![A-Za-z0-9_-]*tokens(?![A-Za-z0-9_-]))[A-Za-z0-9_-]*token[A-Za-z0-9_-]*)(["']?\s*[=:]\s*)(["']?)[^\s"'&,;]{4,}\3/gi, '$1$2$3<secret>$3'],
+    [/\b([A-Za-z0-9_-]*tokens)(["']?\s*[=:]\s*)(["']?)(?!\d+(?![^\s"'&,;]))[^\s"'&,;]{4,}\3/gi, '$1$2$3<secret>$3'],
 ];
 const EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+/g;
 // A pinned alias, `foo@npm:bar@1.0.0` or `jsr:@scope/bar@1.0.0`, ends in `bar@1.0.0`, which EMAIL reads as an address. Digits and dots after
 // the `@` are a version, never a domain, so that one shape right after `npm:` or `jsr:` (and an optional scope) is kept. An all-numeric four-part tail is an
 // IP address, a real host, so it stays masked (as in `extract.ts` `VERSIONED`); any other address stays masked too.
-const ALIAS_PREFIX = /(?<![A-Za-z0-9])(?:npm|jsr):(?:@[A-Za-z0-9._~-]+\/)?$/;
+const ALIAS_PREFIX = /(?<![A-Za-z0-9])(?:npm|jsr):(?:@[A-Za-z0-9._~-]+\/)?$|(?<![A-Za-z0-9._%+-])@[A-Za-z0-9._~-]+\/$/;
 const DOTTED_VERSION = /@(?!\d+\.\d+\.\d+\.\d+$)\d+(?:\.\d+)+$/;
 const TOKEN = /[A-Za-z0-9+_=-]{24,}/g;
 const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -71,7 +76,7 @@ const PROMPT = /(?:<user>|\b[A-Za-z0-9._-]+)@[A-Za-z0-9-]+(?=:[~/.])/g;
 // Full, compressed, and loopback forms. A clock time (`10:20:30`) has no `::`, so it is never one.
 const IPV6 = /(?<![0-9A-Za-z:])(?:(?:[0-9a-f]{1,4}:){7}[0-9a-f]{1,4}|(?:[0-9a-f]{1,4}:){1,7}:(?:[0-9a-f]{1,4}(?::[0-9a-f]{1,4}){0,6})?|::[0-9a-f]{1,4}(?::[0-9a-f]{1,4}){0,6})(?![0-9A-Za-z:])/gi;
 const MIN_NAME = 3;
-const PLACEHOLDER = /<(?:secret|email|org-domain|host|user|env)>/g;
+const PLACEHOLDER = /<(?:secret|email|org-domain|host|user|env|owner)>/g;
 // A `.env` line whose name is lower case (`mapbox=q8z7...`): only a whole line of that shape, so `--flag=value` and `?page=2` are left alone.
 const LOWER_ENVIRONMENT = /^([ \t]*(?:export[ \t]+)?[a-z][a-z0-9_]{2,}=)(?!<)(?:(["'])[^"'\n]*\2|[^\s"']+)[ \t]*$/gm;
 // Shapes `makeRedactor` does not know (t955, census S3). They run only on a raw copy, and before the shared rules, because the entropy rule would
@@ -112,7 +117,7 @@ const parseContainer = (text) => {
         return undefined;
     }
 };
-const redactDecoded = (body, redactText, injected) => {
+const redactDecoded = (body, redactText, injected, enter) => {
     // A name reaches the strings of an array under it (`"tokens": ["..."]`); an object's own keys name their values.
     const walk = (value, name) => {
         if (typeof value === 'string')
@@ -133,15 +138,27 @@ const redactDecoded = (body, redactText, injected) => {
     // The text as it was when nothing in it changed; otherwise the value written again, inside the whitespace (a `\r`, a newline) it had around it.
     // A transcript line is a top-level object: the harness's own blocks in it are marked first (their hash is of the text as written), then the rest is walked.
     const rewrite = (text, parsed, top) => {
+        if (top && !Array.isArray(parsed))
+            enter(parsed);
         const marked = top && !Array.isArray(parsed) ? injected(parsed) : parsed;
         const next = walk(marked, '');
         return next === parsed ? text : `${text.slice(0, text.length - text.trimStart().length)}${JSON.stringify(next)}${text.slice(text.trimEnd().length)}`;
     };
+    // A top-level plain-text run follows no tool result: a host a fetch named is kept in that result's line only (a string inside the line is not top level).
+    const redactPlain = (run, top) => {
+        if (top)
+            enter();
+        return redactText(run.join('\n'));
+    };
     // `text` is a whole document, or lines of which some are JSON: the JSON ones are walked, the runs between them take the plain-text path.
     const redactBlock = (text, top = false) => {
         const whole = parseContainer(text);
-        if (whole !== undefined)
+        // A top-level array line is no tool-result line: it keeps no fetched host.
+        if (whole !== undefined) {
+            if (top && Array.isArray(whole))
+                enter();
             return rewrite(text, whole, top);
+        }
         const out = [];
         let run = [];
         for (const line of text.split('\n')) {
@@ -151,12 +168,12 @@ const redactDecoded = (body, redactText, injected) => {
                 continue;
             }
             if (run.length > 0)
-                out.push(redactText(run.join('\n')));
+                out.push(redactPlain(run, top));
             run = [];
             out.push(rewrite(line, parsed, top));
         }
         if (run.length > 0)
-            out.push(redactText(run.join('\n')));
+            out.push(redactPlain(run, top));
         return out.join('\n');
     };
     return redactBlock(body, true);
@@ -183,15 +200,70 @@ const nameRule = (names) => {
     const forms = [...new Set(usable.flatMap((name) => [name, name.replace(/[^A-Za-z0-9]/g, '-')]))].sort((a, b) => b.length - a.length);
     return forms.length === 0 ? undefined : new RegExp(`(?<![A-Za-z0-9<])(?:${forms.map(escapeRegExp).join('|')})(?![A-Za-z0-9>])`, 'gi');
 };
+const TOOL_ID = /(?<![A-Za-z0-9])(?:srv)?tool(?:u|use)_(?:bdrk_|vrtx_)?[A-Za-z0-9_-]{8,}/g;
+const FETCH_TOOLS = new Set(['WebFetch', 'WebSearch']);
+const HOST_OF_URL = /^[a-z][a-z0-9+.-]*:\/\/([A-Za-z0-9.-]+)/i;
+const URLS = /\b[a-z][a-z0-9+.-]*:\/\/[^\s/@"'\\]*@?[A-Za-z0-9.-]+/gi;
+// Loopback, an IP literal, a bare name, and the internal suffixes of INTERNAL_NAME are never a public host.
+const INTERNAL_SUFFIX = /\.(?:internal|local|lan|corp|intranet|home|localdomain)$/;
+const publicHost = (host) => host.includes('.') && !/^[\d.]+$/.test(host) && !INTERNAL_SUFFIX.test(host) && host !== 'localhost';
+const hostsIn = (value, found, listed = false) => {
+    if (typeof value === 'string') {
+        for (const url of value.match(URLS) ?? [])
+            if (!url.includes('@'))
+                found.add((HOST_OF_URL.exec(url)?.[1] ?? '').toLowerCase());
+        // `allowed_domains` lists bare domains.
+        if (listed)
+            found.add(value.toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, '').replace(/[/:].*$/, ''));
+    }
+    else if (Array.isArray(value))
+        for (const item of value)
+            hostsIn(item, found, listed);
+    else if (typeof value === 'object' && value !== null)
+        for (const [key, item] of Object.entries(value))
+            hostsIn(item, found, key === 'allowed_domains');
+};
+/** The blocks of a transcript line's message content, when it has any. */
+const blocksOf = (line) => {
+    const message = line['message'];
+    const content = typeof message === 'object' && message !== null && !Array.isArray(message) ? message['content'] : undefined;
+    return Array.isArray(content) ? content.filter((block) => typeof block === 'object' && block !== null && !Array.isArray(block)) : [];
+};
+/** The public hosts each WebFetch or WebSearch call of a transcript named, by the call's tool use id. */
+const fetchedBy = (lines) => {
+    const byId = new Map();
+    for (const line of lines) {
+        for (const block of blocksOf(line)) {
+            const { type, id, name, input } = block;
+            if (type !== 'tool_use' || typeof id !== 'string' || typeof name !== 'string' || !FETCH_TOOLS.has(name) || input === undefined)
+                continue;
+            const found = new Set();
+            hostsIn(input, found);
+            byId.set(id, new Set([...found].filter(publicHost)));
+        }
+    }
+    return byId;
+};
+// A handle is a whole path segment (`/acme/app`, `\acme\app`, `git@host:acme/app.git`) or a hyphen-bounded word of an encoded project folder (`-repos-acme-app`).
+const handleRule = (handles) => {
+    const usable = [...new Set(handles.filter((handle) => handle.length >= MIN_NAME))].sort((a, b) => b.length - a.length);
+    return usable.length === 0 ? undefined : new RegExp(String.raw `(?<=[\\/:-])(?:${usable.map(escapeRegExp).join('|')})(?=[\\/.-]|["'\s]|$)`, 'gi');
+};
 /** A whole transcript body redacted for upload, and how many values were masked (placeholders added, a count and nothing else). `names` are the local usernames to mask wherever they stand as a whole word. */
-export const redactTranscript = (body, domains = [], names = [], injectedKey = randomBytes(16).toString('hex')) => {
+export const redactTranscript = (body, domains = [], names = [], injectedKey = randomBytes(16).toString('hex'), pack = {}) => {
     const named = nameRule(names);
+    const owner = handleRule(pack.handles ?? []);
     const known = makeRedactor(domains);
-    const redactText = (text) => {
+    // The hosts the line being redacted may keep: those its tool results' calls fetched.
+    let kept = new Set();
+    const keepHost = (match, scheme) => (!match.includes('@') && kept.has((HOST_OF_URL.exec(match)?.[1] ?? '').toLowerCase()) ? match : `${scheme}<host>`);
+    const redactText = (original) => {
+        const text = pack.toolId === undefined ? original : original.replace(TOOL_ID, pack.toolId);
         // The names go first: a hyphenated or spaced name must be masked whole before the path rules take its first word.
         const masked = known(rawRules(text));
-        return (named === undefined ? masked : masked.replace(named, '<user>'))
-            .replace(URL_HOST, '$1<host>')
+        const mine = named === undefined ? masked : masked.replace(named, '<user>');
+        return (owner === undefined ? mine : mine.replace(owner, '<owner>'))
+            .replace(URL_HOST, keepHost)
             .replace(INTERNAL_NAME, '<host>')
             .replace(IPV4, '<host>')
             .replace(IPV6, '<host>')
@@ -208,8 +280,12 @@ export const redactTranscript = (body, domains = [], names = [], injectedKey = r
     for (const parsed of whole !== undefined ? [whole] : body.split('\n').map(parseContainer))
         if (parsed !== undefined && !Array.isArray(parsed))
             learnInjected(parsed, repeated);
-    const redacted = redactDecoded(body, redactText, injectedRule(injectedKey, repeated));
+    const calls = pack.fetchedHosts === true ? fetchedBy([...(whole !== undefined ? [whole] : body.split('\n').map(parseContainer))].filter((parsed) => parsed !== undefined && !Array.isArray(parsed))) : new Map();
+    const enter = (line) => {
+        kept = new Set(line === undefined ? [] : blocksOf(line).flatMap((block) => (block['type'] === 'tool_result' && typeof block['tool_use_id'] === 'string' ? [...(calls.get(block['tool_use_id']) ?? [])] : [])));
+    };
+    const redacted = redactDecoded(body, redactText, injectedRule(injectedKey, repeated), enter);
     return { text: redacted, masked: Math.max(0, placeholders(redacted) - placeholders(body)) };
 };
 /** The version of the rules above, stated to the pool with every raw part; a change to any rule of `redactTranscript` raises it. */
-export const REDACTION_VERSION = '3';
+export const REDACTION_VERSION = '4';

package/dist/sessions/repo-root.d.ts

@@ -2,6 +2,13 @@
 export declare const makeRepoRoot: (exists?: (path: string) => boolean) => ((cwd: string) => string | null);
 /** `https://User:pw@GitHub.com/org/repo.git`, `git@github.com:org/repo.git`, and `ssh://git@github.com/org/repo/` all read `github.com/org/repo`. */
 export declare const normalizeRemote: (url: string) => string;
+/** The `url` of `[remote "origin"]` in a git `config`, or null. */
+export declare const originUrl: (config: string) => string | null;
+/**
+ * The git `config` text of a repository root, or null: `<root>/.git/config`, or for a linked worktree or submodule (`.git` is a file)
+ * the common directory's, reached through the file's `gitdir:` line and that directory's `commondir` file.
+ */
+export declare const configOf: (root: string, read?: (path: string) => string | null) => string | null;
 /**
  * A resolver from a repository root to its identity string: `origin:<normalized remote>` when the repository's `config` names an
  * `origin`, else `path:<root>`. The `config` is `<root>/.git/config`, or for a linked worktree (`.git` is a file) the common

package/dist/sessions/repo-root.js

@@ -46,7 +46,7 @@ export const normalizeRemote = (url) => {
     return slash < 0 ? bare.toLowerCase() : `${bare.slice(0, slash).toLowerCase()}${bare.slice(slash)}`;
 };
 /** The `url` of `[remote "origin"]` in a git `config`, or null. */
-const originUrl = (config) => {
+export const originUrl = (config) => {
     let inOrigin = false;
     for (const line of config.split(/\r?\n/)) {
         const section = /^\s*\[(.*)\]\s*$/.exec(line);
@@ -71,6 +71,21 @@ const readOrNull = (path) => {
         return null;
     }
 };
+/**
+ * The git `config` text of a repository root, or null: `<root>/.git/config`, or for a linked worktree or submodule (`.git` is a file)
+ * the common directory's, reached through the file's `gitdir:` line and that directory's `commondir` file.
+ */
+export const configOf = (root, read = readOrNull) => {
+    const direct = read(`${root}/.git/config`);
+    if (direct !== null)
+        return direct;
+    const pointer = /^gitdir:\s*(.+?)\s*$/m.exec(read(`${root}/.git`) ?? '')?.[1];
+    if (pointer === undefined)
+        return null;
+    const gitdir = resolveFrom(root, pointer);
+    const common = read(`${gitdir}/commondir`)?.trim();
+    return read(`${common === undefined || common === '' ? gitdir : resolveFrom(gitdir, common)}/config`);
+};
 /**
  * A resolver from a repository root to its identity string: `origin:<normalized remote>` when the repository's `config` names an
  * `origin`, else `path:<root>`. The `config` is `<root>/.git/config`, or for a linked worktree (`.git` is a file) the common
@@ -78,22 +93,11 @@ const readOrNull = (path) => {
  */
 export const makeRepoIdentity = (read = readOrNull) => {
     const cache = new Map();
-    const configOf = (root) => {
-        const direct = read(`${root}/.git/config`);
-        if (direct !== null)
-            return direct;
-        const pointer = /^gitdir:\s*(.+?)\s*$/m.exec(read(`${root}/.git`) ?? '')?.[1];
-        if (pointer === undefined)
-            return null;
-        const gitdir = resolveFrom(root, pointer);
-        const common = read(`${gitdir}/commondir`)?.trim();
-        return read(`${common === undefined || common === '' ? gitdir : resolveFrom(gitdir, common)}/config`);
-    };
     return (root) => {
         const known = cache.get(root);
         if (known !== undefined)
             return known;
-        const url = originUrl(configOf(root) ?? '');
+        const url = originUrl(configOf(root, read) ?? '');
         const identity = url === null ? `path:${root.toLowerCase()}` : `origin:${normalizeRemote(url)}`;
         cache.set(root, identity);
         return identity;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@manyoars/oars",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "mcpName": "io.github.manyoars/oars",
   "description": "A local, searchable record of your coding agent sessions. Reads Claude Code, Cursor, Codex, Copilot CLI, Gemini CLI, and more, and keeps the record on your machine.",
   "homepage": "https://manyoars.com/",
@@ -49,7 +49,7 @@
     "test:live": "vitest run --config vitest.live.config.ts"
   },
   "dependencies": {
-    "@manyoars/oars-client": "^0.1.1",
+    "@manyoars/oars-client": "^0.1.2",
     "commander": "^15.0.0",
     "openid-client": "^6.8.8"
   },