@mnemonik/scanner 5.137.0 → 5.151.2

package/src/daemon.ts

@@ -1,679 +0,0 @@
-import { createHash } from 'crypto';
-import { readFile } from 'fs/promises';
-import { join } from 'path';
-import { CodeScanner, scrubSecrets, type CodeChunk } from '@mnemonik/shared';
-
-/** Maximum raw content bytes accepted by the server's scanFileSchema. */
-const MAX_PUSH_CONTENT_BYTES = 5_000_000;
-import { MnemonikClient, type ScanPushCommit, type ScanPushFile } from './client.js';
-import { FileWatcher } from './watcher.js';
-import { ProjectDiscovery, type DiscoveredProject } from './discovery.js';
-import { probeGit, fetchCommits } from './git.js';
-
-export interface DaemonConfig {
-  serverUrl: string;
-  apiKey: string;
-  roots: string[];
-  refreshIntervalMs?: number;
-  maxConcurrentScans?: number;
-}
-
-interface WatchedProject {
-  projectId: string;
-  path: string;
-  name?: string;
-  watcher: FileWatcher;
-  pendingRetries: Set<string>;
-  retryTimer: ReturnType<typeof setInterval> | null;
-  // git-mining state cached across scans. `isGitRepo` is set once at
-  // project add time (false for non-git projects, skips git calls entirely).
-  // `gitMiningEnabled` reflects server-side Pro+ tier + feature flag +
-  // per-project opt-out. `lastMinedCommit` bounds `git log` from below.
-  isGitRepo: boolean;
-  gitMiningEnabled: boolean;
-  lastMinedCommit: string | null;
-  fullRescanInProgress: boolean;
-  // Snapshot of file paths observed during the most recent full scan
-  // (initial + periodic refresh). Used as the "before" side of the local
-  // diff that computes removedFiles each scan tick. Empty on first call
-  // for a project; the daemon-restart bootstrap is handled by seeding
-  // from `client.getStatus()` (the server's known-paths set) before the
-  // first scan completes.
-  lastInventory: Set<string>;
-  // Server's authoritative file_path -> content hash, as last known to this
-  // daemon (seeded from getStatus, overlaid with files this daemon pushed).
-  // Lets handleChanges skip re-pushing a file whose content is unchanged from
-  // what the server already has — fs.watch fires on no-op events (editor flush,
-  // chmod, mtime touch) that would otherwise re-chunk + re-push + re-ingest an
-  // identical file. Reset on a full rescan so server-side hash invalidation
-  // can never leave a stale "already pushed" entry.
-  cachedFileHashes: Map<string, string>;
-}
-
-export class ScannerDaemon {
-  private client: MnemonikClient;
-  private scanner: CodeScanner;
-  private projects = new Map<string, WatchedProject>();
-  private refreshTimer: ReturnType<typeof setInterval> | null = null;
-  private heartbeatTimer: ReturnType<typeof setInterval> | null = null;
-  private discovery: ProjectDiscovery;
-  private refreshIntervalMs: number;
-  private maxConcurrentScans: number;
-  private scannerVersion: string | null | undefined;
-
-  constructor(private config: DaemonConfig) {
-    this.client = new MnemonikClient(config.serverUrl, config.apiKey);
-    this.scanner = new CodeScanner();
-    this.discovery = new ProjectDiscovery(config.roots);
-    this.refreshIntervalMs = config.refreshIntervalMs ?? 300_000; // 5 min
-    this.maxConcurrentScans = config.maxConcurrentScans ?? 5;
-  }
-
-  async start(): Promise<void> {
-    console.log(`[scanner] Starting daemon`);
-    console.log(`[scanner] Server: ${this.config.serverUrl}`);
-    console.log(`[scanner] Roots: ${this.config.roots.join(', ')}`);
-
-    await this.waitForServer();
-    await this.refreshProjects();
-
-    this.refreshTimer = setInterval(() => {
-      this.refreshProjects().catch((err) => {
-        console.warn('[scanner] Refresh failed:', (err as Error).message);
-      });
-    }, this.refreshIntervalMs);
-    this.refreshTimer.unref();
-
-    // Send heartbeat immediately, then every 60s so session_bootstrap
-    // can reliably detect daemon liveness without waiting for a file scan.
-    await this.sendHeartbeats();
-    this.heartbeatTimer = setInterval(() => {
-      this.sendHeartbeats().catch((err) => {
-        console.warn('[scanner] Heartbeat failed:', (err as Error).message);
-      });
-    }, 60_000);
-    this.heartbeatTimer.unref();
-
-    console.log('[scanner] Watching for changes.');
-  }
-
-  async stop(): Promise<void> {
-    if (this.refreshTimer) {
-      clearInterval(this.refreshTimer);
-      this.refreshTimer = null;
-    }
-    if (this.heartbeatTimer) {
-      clearInterval(this.heartbeatTimer);
-      this.heartbeatTimer = null;
-    }
-
-    for (const project of this.projects.values()) {
-      project.watcher.stop();
-      if (project.retryTimer) clearInterval(project.retryTimer);
-    }
-    this.projects.clear();
-    console.log('[scanner] Daemon stopped');
-  }
-
-  private async sendHeartbeats(): Promise<void> {
-    const version = await this.getScannerVersion();
-    for (const { projectId } of this.projects.values()) {
-      await this.client
-        .sendHeartbeat(projectId, {
-          scope: 'global',
-          ...(version && { version }),
-        })
-        .catch((err) => {
-          console.warn(`[scanner] Heartbeat failed for ${projectId}:`, (err as Error).message);
-        });
-    }
-  }
-
-  private async getScannerVersion(): Promise<string | undefined> {
-    if (this.scannerVersion !== undefined) {
-      return this.scannerVersion ?? undefined;
-    }
-    this.scannerVersion = await readScannerPackageVersion();
-    return this.scannerVersion ?? undefined;
-  }
-
-  getWatchedProjects(): Array<{ projectId: string; path: string; name?: string }> {
-    return Array.from(this.projects.values()).map((p) => ({
-      projectId: p.projectId,
-      path: p.path,
-      name: p.name,
-    }));
-  }
-
-  /**
-   * Discover projects from configured roots and reconcile with current watch list.
-   */
-  async refreshProjects(): Promise<void> {
-    const discovered = await this.discovery.discover();
-    const discoveredMap = new Map(discovered.map((d) => [d.projectId, d]));
-
-    // Remove projects no longer discovered
-    for (const [projectId, project] of this.projects) {
-      if (!discoveredMap.has(projectId)) {
-        console.log(`[scanner] Project removed: ${project.name ?? projectId} (${project.path})`);
-        project.watcher.stop();
-        if (project.retryTimer) clearInterval(project.retryTimer);
-        this.projects.delete(projectId);
-      }
-    }
-
-    // Add new projects or handle path changes
-    for (const discovered_project of discoveredMap.values()) {
-      const existing = this.projects.get(discovered_project.projectId);
-
-      if (!existing) {
-        // New project
-        await this.addProject(discovered_project);
-      } else if (existing.path !== discovered_project.path) {
-        // Path changed (folder renamed/moved)
-        console.log(
-          `[scanner] Project moved: ${existing.name ?? existing.projectId} ` +
-            `${existing.path} → ${discovered_project.path}`
-        );
-        existing.watcher.stop();
-        if (existing.retryTimer) clearInterval(existing.retryTimer);
-        this.projects.delete(discovered_project.projectId);
-        await this.addProject(discovered_project);
-      }
-    }
-
-    // Periodic removed-files diff for already-watched projects. Cheap
-    // path-only walk (no chunking, no file reads), compare against the
-    // in-memory snapshot from last tick, send only the disappeared paths.
-    // Picks up deletions that fs.watch delivered as unlink events but
-    // that handleChanges couldn't push (it only knows how to push
-    // chunked content, not "this file no longer exists").
-    for (const project of this.projects.values()) {
-      try {
-        const status = await this.client.getStatus(project.projectId);
-        if (hasInvalidatedHashes(status.fileHashes)) {
-          if (project.fullRescanInProgress) {
-            console.log(
-              `[scanner] [${project.projectId.slice(0, 8)}] full rescan already running; skipping refresh tick`
-            );
-            continue;
-          }
-
-          console.log(
-            `[scanner] [${project.projectId.slice(0, 8)}] server hashes invalidated; running full rescan`
-          );
-          project.fullRescanInProgress = true;
-          try {
-            const scanResult = await this.initialScan(project.projectId, project.path);
-            project.isGitRepo = scanResult.isGitRepo;
-            project.gitMiningEnabled = scanResult.gitMiningEnabled;
-            project.lastMinedCommit = scanResult.lastMinedCommit;
-            project.lastInventory = new Set(scanResult.currentPaths);
-            // Re-seed from the post-rescan authoritative view so an invalidated
-            // hash never leaves a stale "already pushed" entry behind.
-            project.cachedFileHashes = new Map(scanResult.fileHashes);
-          } finally {
-            project.fullRescanInProgress = false;
-          }
-          continue;
-        }
-
-        const scanned = await this.scanner.listFilesWithStatus(project.path);
-        // I1: include authority file paths so they are never treated as removed
-        const authority = await this.scanner.collectAuthorityFilesWithStatus(project.path);
-        // A partial walk (fs error swallowed mid-traversal) reads as mass
-        // deletion: files that still exist on disk vanish from currentSet
-        // and would be deprecated server-side. Withhold the diff AND keep
-        // lastInventory untouched so the next clean tick diffs against the
-        // trusted baseline.
-        if (!scanned.complete || !authority.complete) {
-          console.warn(
-            `[scanner] [${project.projectId.slice(0, 8)}] incomplete file walk; withholding removed-files diff this tick`
-          );
-          continue;
-        }
-        const currentSet = new Set([...scanned.paths, ...authority.files.map((a) => a.path)]);
-        const removedFiles = [...project.lastInventory].filter((p) => !currentSet.has(p));
-        await this.sendRemovedFiles(project.projectId, removedFiles);
-        project.lastInventory = currentSet;
-      } catch (err) {
-        console.warn(
-          `[scanner] [${project.projectId.slice(0, 8)}] periodic removed-files report failed: ${(err as Error).message}`
-        );
-      }
-    }
-
-    console.log(`[scanner] Watching ${this.projects.size} project(s)`);
-  }
-
-  private async addProject(discovered: DiscoveredProject): Promise<void> {
-    const label = discovered.projectName ?? discovered.projectId.slice(0, 8);
-    console.log(`[scanner] Adding project: ${label} (${discovered.path})`);
-
-    let scanResult: {
-      isGitRepo: boolean;
-      gitMiningEnabled: boolean;
-      lastMinedCommit: string | null;
-      currentPaths: string[];
-      fileHashes: Map<string, string>;
-    } = {
-      isGitRepo: false,
-      gitMiningEnabled: false,
-      lastMinedCommit: null,
-      currentPaths: [],
-      fileHashes: new Map(),
-    };
-    try {
-      scanResult = await this.initialScan(discovered.projectId, discovered.path);
-    } catch (err) {
-      console.warn(`[scanner] Initial scan failed for ${label}:`, (err as Error).message);
-    }
-
-    const watcher = new FileWatcher(
-      discovered.path,
-      (changedFiles) => this.handleChanges(discovered.projectId, discovered.path, changedFiles),
-      500,
-      (err) => {
-        console.warn(
-          `[scanner] Root watcher error for ${label}: ${err.message}. Removing project.`
-        );
-        const project = this.projects.get(discovered.projectId);
-        if (project) {
-          project.watcher.stop();
-          if (project.retryTimer) clearInterval(project.retryTimer);
-          this.projects.delete(discovered.projectId);
-        }
-      }
-    );
-
-    try {
-      await watcher.start();
-    } catch (err) {
-      console.warn(`[scanner] Failed to start watcher for ${label}:`, (err as Error).message);
-      return;
-    }
-
-    this.projects.set(discovered.projectId, {
-      projectId: discovered.projectId,
-      path: discovered.path,
-      name: discovered.projectName,
-      watcher,
-      pendingRetries: new Set(),
-      retryTimer: null,
-      isGitRepo: scanResult.isGitRepo,
-      gitMiningEnabled: scanResult.gitMiningEnabled,
-      lastMinedCommit: scanResult.lastMinedCommit,
-      fullRescanInProgress: false,
-      lastInventory: new Set(scanResult.currentPaths),
-      cachedFileHashes: new Map(scanResult.fileHashes),
-    });
-  }
-
-  private async waitForServer(): Promise<void> {
-    let logged = false;
-    let delay = 3000;
-    const maxDelay = 30000;
-    const maxRetries = 20;
-
-    for (let attempt = 0; attempt < maxRetries; attempt++) {
-      if (await this.client.healthCheck()) {
-        if (logged) console.log('[scanner] Server is back');
-        else console.log('[scanner] Server health check passed');
-        return;
-      }
-      if (!logged) {
-        console.log('[scanner] Server unreachable, waiting...');
-        logged = true;
-      }
-      const jitter = delay * (0.5 + Math.random());
-      await new Promise((r) => setTimeout(r, jitter));
-      delay = Math.min(delay * 1.5, maxDelay);
-    }
-
-    throw new Error(`Server unreachable after ${maxRetries} attempts`);
-  }
-
-  private async initialScan(
-    projectId: string,
-    projectRoot: string
-  ): Promise<{
-    isGitRepo: boolean;
-    gitMiningEnabled: boolean;
-    lastMinedCommit: string | null;
-    currentPaths: string[];
-    fileHashes: Map<string, string>;
-  }> {
-    const startTime = Date.now();
-
-    const scan = await this.scanner.scanDirectoryWithStatus(projectRoot);
-    const chunks = scan.chunks;
-    const status = await this.client.getStatus(projectId);
-
-    const files = await this.groupChunksByFile(chunks, projectRoot);
-    const authority = await this.collectAuthorityPushFiles(projectRoot);
-    // C1: dedupe — chunk-scanned entries win over authority duplicates
-    // (e.g. setup.py matches both .py includeExtensions and AUTHORITY_FILE_MATCHERS)
-    const seen = new Set(files.map((f) => f.path));
-    const allFiles = [...files, ...authority.files.filter((a) => !seen.has(a.path))];
-    const filesToPush = allFiles.filter((f) => {
-      const serverHash = status.fileHashes.get(f.path);
-      return !serverHash || serverHash !== f.hash;
-    });
-
-    // collect new commits since last mine when this is a git repo and
-    // the server has mining enabled for this project (Pro+ tier + not opted out).
-    const isGitRepo = await probeGit(projectRoot);
-    const commits =
-      isGitRepo && status.gitMining.enabled
-        ? await this.collectCommits(projectRoot, status.gitMining.lastMinedCommit)
-        : [];
-
-    // push when there's anything to send — file changes OR new
-    // commits. Previously a stable repo with new commits never pushed,
-    // silently losing those commits forever.
-    let watermark = status.gitMining.lastMinedCommit;
-    let pushOk = false;
-    if (filesToPush.length > 0 || commits.length > 0) {
-      console.log(
-        `[scanner] Pushing ${filesToPush.length} changed files + ${commits.length} commits for ${projectId.slice(0, 8)}...`
-      );
-      try {
-        await this.client.pushFiles(projectId, filesToPush, commits);
-        pushOk = true;
-        // Only advance the watermark after a successful push that actually
-        // carried the commits.
-        if (commits.length > 0) {
-          watermark = commits[0]?.sha ?? watermark;
-        }
-      } catch (err) {
-        console.warn(
-          `[scanner] Initial push failed for ${projectId.slice(0, 8)}: ${(err as Error).message}`
-        );
-      }
-    }
-
-    // Initial-scan removed-files diff: bootstrap "before" from the
-    // server's known-paths set (status.fileHashes is what the server
-    // currently has for this project). Anything the server knows that
-    // the daemon doesn't see on disk now = removed. Closes the
-    // daemon-was-offline case and the newly-added-ignore-pattern case.
-    // Gated on walk completeness: adds/changes above are not
-    // completeness-sensitive (a missing file just isn't pushed this
-    // pass), but deriving removals from a partial walk deprecates
-    // memories for files that still exist. Skip the diff entirely when
-    // either walk was truncated.
-    const currentPaths = allFiles.map((f) => f.path);
-    const currentPathSet = new Set(currentPaths);
-    let removedFiles: string[] = [];
-    if (scan.complete && authority.complete) {
-      removedFiles = [...status.fileHashes.keys()].filter((p) => !currentPathSet.has(p));
-      await this.sendRemovedFiles(projectId, removedFiles).catch((err) => {
-        console.warn(
-          `[scanner] [${projectId.slice(0, 8)}] removedFiles report failed (non-blocking): ${(err as Error).message}`
-        );
-      });
-    } else {
-      console.warn(
-        `[scanner] [${projectId.slice(0, 8)}] incomplete file walk; withholding removed-files diff for this scan`
-      );
-    }
-
-    const duration = ((Date.now() - startTime) / 1000).toFixed(1);
-    console.log(
-      `[scanner] Scan complete for ${projectId.slice(0, 8)}: ` +
-        `${chunks.length} chunks, ${filesToPush.length} pushed, ${commits.length} commits (${duration}s)`
-    );
-
-    // Build the server's authoritative file_path -> hash view after this scan:
-    // the server's pre-scan set, overlaid with the files we just pushed (only
-    // if the push succeeded), minus the files we just reported removed.
-    const fileHashes = new Map(status.fileHashes);
-    if (pushOk) {
-      for (const f of filesToPush) fileHashes.set(f.path, f.hash);
-    }
-    for (const p of removedFiles) fileHashes.delete(p);
-
-    return {
-      isGitRepo,
-      gitMiningEnabled: status.gitMining.enabled,
-      lastMinedCommit: watermark,
-      currentPaths,
-      fileHashes,
-    };
-  }
-
-  /**
-   * Send the explicit list of paths that vanished since the previous scan.
-   * Empty lists short-circuit so we don't pay an HTTP round-trip when
-   * nothing was removed this tick.
-   */
-  private async sendRemovedFiles(projectId: string, removedFiles: string[]): Promise<void> {
-    if (removedFiles.length === 0) return;
-    const result = await this.client.reportRemovedFiles(projectId, removedFiles);
-    if (result.deprecated > 0 || result.couplingsRemoved > 0) {
-      console.log(
-        `[scanner] [${projectId.slice(0, 8)}] Removed: ` +
-          `${removedFiles.length} paths sent, ${result.deprecated} memories deprecated, ` +
-          `${result.couplingsRemoved} couplings removed`
-      );
-    }
-  }
-
-  /**
-   * Fetch commits since the last mine. Swallows errors — a git failure must
-   * not block the file scan push.
-   */
-  private async collectCommits(
-    projectRoot: string,
-    lastMinedCommit: string | null
-  ): Promise<ScanPushCommit[]> {
-    try {
-      const commits = await fetchCommits(projectRoot, lastMinedCommit);
-      return commits;
-    } catch (err) {
-      console.warn(`[scanner] git log failed in ${projectRoot}:`, (err as Error).message);
-      return [];
-    }
-  }
-
-  private async handleChanges(
-    projectId: string,
-    projectRoot: string,
-    changedFiles: string[]
-  ): Promise<void> {
-    const project = this.projects.get(projectId);
-    if (!project) return;
-
-    try {
-      const absPaths = changedFiles.map((rel) => join(projectRoot, rel));
-      const chunks = await this.scanner.scanFiles(absPaths, projectRoot);
-
-      if (chunks.length === 0) return;
-
-      const files = await this.groupChunksByFile(chunks, projectRoot);
-      const authority = await this.collectAuthorityPushFiles(projectRoot);
-      // C1: dedupe — chunk-scanned entries win over authority duplicates
-      const seen = new Set(files.map((f) => f.path));
-      const allFiles = [...files, ...authority.files.filter((a) => !seen.has(a.path))];
-
-      // Skip files whose content hash matches what the server already has —
-      // fs.watch fires on no-op events (editor flush, chmod, mtime touch) that
-      // would otherwise re-chunk, re-push, and re-ingest an identical file
-      // (and re-trigger the server's doc-truth diff pipeline). Files this
-      // daemon has never confirmed-pushed have no cache entry and are always
-      // pushed; the cache is updated only on a successful push and reset on a
-      // full rescan, so a needed push is never dropped.
-      const toPush = allFiles.filter((f) => project.cachedFileHashes.get(f.path) !== f.hash);
-      const skipped = allFiles.length - toPush.length;
-      if (skipped > 0) {
-        console.log(`[scanner] [${projectId.slice(0, 8)}] Skipped ${skipped} unchanged file(s)`);
-      }
-
-      // attach any new commits since our cached watermark. Only the
-      // first push carries them (idempotent jobId on the server collapses
-      // duplicates anyway, but one payload saves bandwidth).
-      const commits =
-        project.isGitRepo && project.gitMiningEnabled
-          ? await this.collectCommits(projectRoot, project.lastMinedCommit)
-          : [];
-
-      const batchSize = 25;
-      const succeededPaths = new Set<string>();
-      let hadFailure = false;
-      let firstBatchSucceeded = false;
-
-      if (toPush.length > 0) {
-        for (let i = 0; i < toPush.length; i += batchSize) {
-          const batch = toPush.slice(i, i + batchSize);
-          try {
-            // Only attach commits to the first batch.
-            await this.client.pushFiles(projectId, batch, i === 0 ? commits : undefined);
-            for (const f of batch) {
-              succeededPaths.add(f.path);
-              project.cachedFileHashes.set(f.path, f.hash);
-            }
-            if (i === 0) firstBatchSucceeded = true;
-          } catch {
-            hadFailure = true;
-            for (const f of batch) project.pendingRetries.add(f.path);
-          }
-        }
-      } else if (commits.length > 0) {
-        // No file changes but new commits exist — fire a commit-only push so
-        // they reach the server. 1 schema allows files=[].
-        try {
-          await this.client.pushFiles(projectId, [], commits);
-          firstBatchSucceeded = true;
-        } catch (err) {
-          hadFailure = true;
-          console.warn(
-            `[scanner] [${projectId.slice(0, 8)}] Commit-only push failed: ${(err as Error).message}`
-          );
-        }
-      }
-
-      // Advance the watermark only if commits actually made it to the server.
-      if (commits.length > 0 && firstBatchSucceeded) {
-        project.lastMinedCommit = commits[0]?.sha ?? project.lastMinedCommit;
-      }
-
-      if (succeededPaths.size > 0) {
-        console.log(
-          `[scanner] [${projectId.slice(0, 8)}] Pushed ${succeededPaths.size} file(s): ${[...succeededPaths].join(', ')}`
-        );
-      }
-      if (hadFailure) {
-        console.warn(
-          `[scanner] [${projectId.slice(0, 8)}] ${project.pendingRetries.size} file(s) failed, queued for retry`
-        );
-        this.startRetryLoop(project);
-      }
-    } catch (err) {
-      console.error(`[scanner] [${projectId.slice(0, 8)}] Error handling changes:`, err);
-    }
-  }
-
-  private startRetryLoop(project: WatchedProject): void {
-    if (project.retryTimer) return;
-    project.retryTimer = setInterval(async () => {
-      if (project.pendingRetries.size === 0) {
-        if (project.retryTimer) clearInterval(project.retryTimer);
-        project.retryTimer = null;
-        return;
-      }
-      const files = [...project.pendingRetries];
-      project.pendingRetries.clear();
-      await this.handleChanges(project.projectId, project.path, files);
-    }, 10_000);
-    project.retryTimer.unref();
-  }
-
-  private async collectAuthorityPushFiles(
-    projectRoot: string
-  ): Promise<{ files: ScanPushFile[]; complete: boolean }> {
-    const authority = await this.scanner.collectAuthorityFilesWithStatus(projectRoot);
-    return {
-      // Whole-file `content` must honor the same daemon-side redaction
-      // invariant as chunk content: no credential leaves this process.
-      // `hash` stays computed over the RAW bytes so change detection
-      // against the server's known-hash map is unaffected; the server
-      // recomputes its own stored content_hash from what arrives.
-      files: authority.files.map((f) => ({
-        path: f.path,
-        hash: f.hash,
-        chunks: [],
-        content: f.content === undefined ? undefined : scrubSecrets(f.content),
-      })),
-      complete: authority.complete,
-    };
-  }
-
-  private async groupChunksByFile(
-    chunks: CodeChunk[],
-    projectRoot: string
-  ): Promise<ScanPushFile[]> {
-    const fileMap = new Map<string, ScanPushFile>();
-
-    for (const chunk of chunks) {
-      const key = chunk.filePath;
-      if (!fileMap.has(key)) {
-        fileMap.set(key, { path: key, hash: '', chunks: [] });
-      }
-      const file = fileMap.get(key)!;
-      file.chunks.push({
-        content: chunk.content,
-        startLine: chunk.startLine,
-        endLine: chunk.endLine,
-        chunkType: chunk.chunkType,
-        language: chunk.language,
-        contentHash: chunk.contentHash,
-        metadata: chunk.metadata,
-      });
-    }
-
-    for (const file of fileMap.values()) {
-      try {
-        const absPath = join(projectRoot, file.path);
-        const raw = await readFile(absPath, 'utf-8');
-        // Hash the RAW bytes (change detection against the server's
-        // known-hash map keys on what's on disk), but never ship them:
-        // whole-file `content` honors the same daemon-side redaction
-        // invariant as chunk content. The server recomputes its stored
-        // content_hash from the scrubbed bytes it receives.
-        file.hash = createHash('sha256').update(raw).digest('hex');
-        // C2: drop content if it would exceed the server schema cap (5MB)
-        file.content = raw.length <= MAX_PUSH_CONTENT_BYTES ? scrubSecrets(raw) : undefined;
-      } catch (err) {
-        console.warn(`[scanner] Cannot read ${file.path} for hashing, using chunk-based fallback`, {
-          error: err instanceof Error ? err.message : String(err),
-        });
-        // Chunk content is already scrubbed by CodeScanner; scrubSecrets is
-        // idempotent so re-applying keeps the invariant explicit.
-        const allContent = file.chunks.map((c) => c.content).join('\n');
-        file.hash = createHash('sha256').update(allContent).digest('hex');
-        // C2: drop content if it would exceed the server schema cap (5MB)
-        file.content =
-          allContent.length <= MAX_PUSH_CONTENT_BYTES ? scrubSecrets(allContent) : undefined;
-      }
-    }
-
-    return Array.from(fileMap.values());
-  }
-}
-
-function hasInvalidatedHashes(fileHashes: Map<string, string>): boolean {
-  for (const hash of fileHashes.values()) {
-    if (hash === '') return true;
-  }
-  return false;
-}
-
-async function readScannerPackageVersion(): Promise<string | null> {
-  try {
-    const raw = await readFile(new URL('../package.json', import.meta.url), 'utf-8');
-    const parsed = JSON.parse(raw) as { version?: unknown };
-    return typeof parsed.version === 'string' ? parsed.version : null;
-  } catch {
-    return null;
-  }
-}