@nessielabs/daemon 0.1.0

package/README.md

@@ -0,0 +1,50 @@
+# Nessie Daemon
+
+Headless Linux ingestion daemon for Nessie agent traces.
+
+## Install
+
+```bash
+npm install -g @nessielabs/daemon
+nessie-daemon setup
+```
+
+`setup` authenticates the device, detects local Codex and Claude Code history directories, lets you choose which sources to ingest, and can install the user `systemd` service.
+
+Use non-production endpoints with:
+
+```bash
+nessie-daemon setup --api-url https://sync.example --auth-api-url https://auth.example
+```
+
+## Commands
+
+```bash
+nessie-daemon setup
+nessie-daemon run --once
+nessie-daemon start
+nessie-daemon stop
+nessie-daemon status
+```
+
+The daemon registers selected local resources through sync preflight and pushes local agent traces. It does not pull cloud data.
+
+Config is stored at `~/.config/nessie-daemon/config.json`; sync state is stored at `~/.local/state/nessie-daemon/state.json`.
+
+Re-running `setup` rewrites the source selection and resets sync cursors, which can trigger a full re-scan and idempotent re-push of local history.
+
+The first implementation uses file `mtime` and `size` cursors. When a JSONL file changes, the daemon reparses that file and relies on stable node IDs for idempotent pushes.
+
+## systemd
+
+`setup` can install a user service at:
+
+```bash
+~/.config/systemd/user/nessie-daemon.service
+```
+
+On long-running headless VMs, enable user services to survive logout:
+
+```bash
+sudo loginctl enable-linger "$USER"
+```

package/dist/api/http.js

@@ -0,0 +1,25 @@
+export class ApiError extends Error {
+    status;
+    body;
+    constructor(message, status, body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+    }
+}
+export async function postJson(baseUrl, path, body, options = {}) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const response = await fetchImpl(new URL(path, baseUrl), {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            ...(options.token ? { authorization: `Bearer ${options.token}` } : {}),
+        },
+        body: JSON.stringify(body),
+    });
+    const text = await response.text();
+    if (!response.ok) {
+        throw new ApiError(`HTTP status ${response.status}: ${text || response.statusText}`, response.status, text);
+    }
+    return (text ? JSON.parse(text) : {});
+}

package/dist/auth/deviceFlow.js

@@ -0,0 +1,35 @@
+import { setTimeout as sleep } from "node:timers/promises";
+import { postJson } from "../api/http.js";
+export async function runDeviceAuth(input) {
+    const log = input.log ?? console;
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const sleepMs = input.sleepMs ?? sleep;
+    const start = await postJson(input.authApiUrl, "/auth/device/start", {
+        device_name: input.deviceName,
+        platform: "linux",
+    }, { fetchImpl });
+    log.log(`Open ${start.verification_uri_complete ?? start.verification_uri ?? "Nessie"} and enter code ${start.user_code}.`);
+    const intervalMs = Math.max(1, start.interval ?? 5) * 1000;
+    const expiresAt = Date.now() + Math.max(60, start.expires_in ?? 600) * 1000;
+    while (Date.now() < expiresAt) {
+        await sleepMs(intervalMs);
+        const poll = await postJson(input.authApiUrl, "/auth/device/poll", {
+            device_code: start.device_code,
+        }, { fetchImpl });
+        if (poll.status === "pending")
+            continue;
+        if (poll.status === "approved" && poll.access_token && poll.device_id) {
+            return {
+                accessToken: poll.access_token,
+                refreshToken: poll.refresh_token ?? null,
+                deviceId: poll.device_id,
+            };
+        }
+        if (poll.status === "approved") {
+            throw new Error("Auth approved but server response missing access_token or device_id.");
+        }
+        if (poll.status === "expired")
+            break;
+    }
+    throw new Error("Device auth expired before approval.");
+}

package/dist/auth/tokens.js

@@ -0,0 +1,29 @@
+import { ApiError, postJson } from "../api/http.js";
+export class AuthRefreshError extends Error {
+}
+export async function refreshAccessToken(config, options = {}) {
+    if (!config.refreshToken) {
+        throw new AuthRefreshError("Access token expired and no refresh token is configured.");
+    }
+    try {
+        const response = await postJson(config.authApiUrl, "/auth/refresh", {
+            refresh_token: config.refreshToken,
+        }, { fetchImpl: options.fetchImpl });
+        if (!response.access_token) {
+            throw new AuthRefreshError("Token refresh response missing access_token.");
+        }
+        return {
+            ...config,
+            accessToken: response.access_token,
+            refreshToken: response.refresh_token ?? config.refreshToken,
+        };
+    }
+    catch (error) {
+        if (error instanceof AuthRefreshError)
+            throw error;
+        if (error instanceof ApiError && error.status === 401) {
+            throw new AuthRefreshError("Refresh token is invalid or expired.");
+        }
+        throw error;
+    }
+}

package/dist/cli.js

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+import { Command } from "commander";
+import { runDaemon } from "./commands/run.js";
+import { runServiceCommand } from "./commands/service.js";
+import { runSetup } from "./commands/setup.js";
+const program = new Command();
+program
+    .name("nessie-daemon")
+    .description("Headless Nessie ingestion daemon for Linux agent machines.")
+    .version("0.1.0");
+program
+    .command("setup")
+    .description("Authenticate, select local sources, and optionally install the user systemd service.")
+    .option("--api-url <url>", "Nessie sync API URL")
+    .option("--auth-api-url <url>", "Nessie auth API URL")
+    .action(runSetup);
+program
+    .command("run")
+    .description("Run the daemon sync loop.")
+    .option("--once", "Run one sync pass and exit.")
+    .option("--interval-seconds <seconds>", "Seconds between sync passes.", "60")
+    .action(runDaemon);
+for (const commandName of ["start", "stop", "status"]) {
+    program
+        .command(commandName)
+        .description(`${commandName[0]?.toUpperCase()}${commandName.slice(1)} the user systemd service.`)
+        .action(() => runServiceCommand(commandName));
+}
+await program.parseAsync();

package/dist/commands/run.js

@@ -0,0 +1,10 @@
+import { runSyncLoop, runSyncOnce } from "../sync/loop.js";
+export async function runDaemon(options) {
+    if (options.once) {
+        const result = await runSyncOnce();
+        console.log(`Synced ${result.nodes} nodes and ${result.edges} edges.`);
+        return;
+    }
+    const intervalSeconds = Number.parseInt(options.intervalSeconds ?? "60", 10);
+    await runSyncLoop(Number.isFinite(intervalSeconds) ? intervalSeconds : 60);
+}

package/dist/commands/service.js

@@ -0,0 +1,6 @@
+import { systemctl } from "../service/systemd.js";
+export async function runServiceCommand(command) {
+    const output = await systemctl(command, "nessie-daemon.service");
+    if (output.trim())
+        console.log(output.trim());
+}

package/dist/commands/setup.js

@@ -0,0 +1,43 @@
+import { checkbox, confirm } from "@inquirer/prompts";
+import { hostname } from "node:os";
+import { runDeviceAuth } from "../auth/deviceFlow.js";
+import { getDaemonPaths } from "../config/paths.js";
+import { createConfig, createInitialState, defaultApiUrl, defaultAuthApiUrl, writeConfig, writeState } from "../config/store.js";
+import { installUserService } from "../service/systemd.js";
+import { detectSources } from "../sources/detect.js";
+export async function runSetup(options) {
+    const apiUrl = options.apiUrl ?? defaultApiUrl;
+    const authApiUrl = options.authApiUrl ?? defaultAuthApiUrl;
+    const deviceName = hostname();
+    const auth = await runDeviceAuth({ authApiUrl, deviceName });
+    const detectedSources = await detectSources();
+    if (detectedSources.length === 0) {
+        throw new Error("No supported Codex or Claude Code history directories were found.");
+    }
+    const selectedSources = await checkbox({
+        message: "Select sources for this daemon to ingest",
+        choices: detectedSources.map((source) => ({
+            name: `${source.displayName} (${source.basePath})`,
+            value: source,
+            checked: true,
+        })),
+        required: true,
+    });
+    const paths = getDaemonPaths();
+    const config = createConfig({
+        accessToken: auth.accessToken,
+        refreshToken: auth.refreshToken,
+        deviceId: auth.deviceId,
+        deviceName,
+        apiUrl,
+        authApiUrl,
+        selectedSources,
+    });
+    await writeConfig(config, paths);
+    await writeState(createInitialState(), paths);
+    console.log(`Saved config to ${paths.configFile}`);
+    if (await confirm({ message: "Install and start the user systemd service?", default: true })) {
+        await installUserService(paths);
+        console.log("Installed and started nessie-daemon.service");
+    }
+}

package/dist/config/paths.js

@@ -0,0 +1,17 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+export function getDaemonPaths(env = process.env, home = homedir()) {
+    const configHome = env.XDG_CONFIG_HOME ?? join(home, ".config");
+    const stateHome = env.XDG_STATE_HOME ?? join(home, ".local", "state");
+    const configDir = join(configHome, "nessie-daemon");
+    const stateDir = join(stateHome, "nessie-daemon");
+    const systemdUserDir = join(configHome, "systemd", "user");
+    return {
+        configDir,
+        stateDir,
+        configFile: join(configDir, "config.json"),
+        stateFile: join(stateDir, "state.json"),
+        systemdUserDir,
+        systemdServiceFile: join(systemdUserDir, "nessie-daemon.service"),
+    };
+}

package/dist/config/store.js

@@ -0,0 +1,59 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { hostname } from "node:os";
+import { dirname } from "node:path";
+import { getDaemonPaths } from "./paths.js";
+export const defaultApiUrl = "https://nessie-codebase-843813578359.us-west1.run.app";
+export const defaultAuthApiUrl = "https://nessie-notes-go-843813578359.us-west1.run.app";
+export function createConfig(input) {
+    const deviceId = input.deviceId ?? randomUUID();
+    return {
+        apiUrl: input.apiUrl ?? defaultApiUrl,
+        authApiUrl: input.authApiUrl ?? defaultAuthApiUrl,
+        deviceId,
+        deviceName: input.deviceName ?? hostname(),
+        accessToken: input.accessToken,
+        refreshToken: input.refreshToken ?? null,
+        selectedSources: input.selectedSources.map((source) => ({
+            ...source,
+            localId: randomUUID(),
+            stableKey: `device:${deviceId}`,
+        })),
+    };
+}
+export function createInitialState() {
+    return {
+        files: {},
+        pushedSourceRootIds: [],
+        lastSyncAt: null,
+    };
+}
+export async function readConfig(paths = getDaemonPaths()) {
+    return JSON.parse(await readFile(paths.configFile, "utf8"));
+}
+export async function writeConfig(config, paths = getDaemonPaths()) {
+    await mkdir(dirname(paths.configFile), { recursive: true });
+    await writeFile(paths.configFile, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+}
+export async function readState(paths = getDaemonPaths()) {
+    try {
+        const parsed = JSON.parse(await readFile(paths.stateFile, "utf8"));
+        return {
+            files: parsed.files ?? {},
+            pushedSourceRootIds: parsed.pushedSourceRootIds ?? [],
+            lastSyncAt: parsed.lastSyncAt ?? null,
+        };
+    }
+    catch (error) {
+        if (isMissingFileError(error))
+            return createInitialState();
+        throw error;
+    }
+}
+export async function writeState(state, paths = getDaemonPaths()) {
+    await mkdir(dirname(paths.stateFile), { recursive: true });
+    await writeFile(paths.stateFile, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+}
+function isMissingFileError(error) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}

package/dist/parser/claudeCode.js

@@ -0,0 +1,75 @@
+import { basename } from "node:path";
+import { redactSecrets } from "../redact/secrets.js";
+import { asRecord, readJsonl, stringValue } from "./jsonl.js";
+export async function parseClaudeCodeSession(path) {
+    const records = await readJsonl(path);
+    const messages = [];
+    let sessionId = basename(path, ".jsonl");
+    let title = null;
+    let createdAt = null;
+    let updatedAt = null;
+    for (const value of records) {
+        const record = asRecord(value);
+        if (!record)
+            continue;
+        if (record.isSidechain === true)
+            continue;
+        sessionId = stringValue(record.sessionId) ?? stringValue(record.session_id) ?? sessionId;
+        const timestamp = stringValue(record.timestamp);
+        if (timestamp) {
+            createdAt ??= timestamp;
+            updatedAt = timestamp;
+        }
+        const role = normalizeRole(stringValue(record.type) ?? stringValue(record.role));
+        if (!role)
+            continue;
+        const text = extractClaudeText(record);
+        if (!text || shouldDropScaffolding(text))
+            continue;
+        messages.push({ role, content: text, timestamp });
+        if (!title && role === "user")
+            title = redactSecrets(firstLine(text));
+    }
+    if (messages.length === 0)
+        return null;
+    const now = new Date().toISOString();
+    return {
+        id: sessionId,
+        sourceKind: "claude_code",
+        sourceId: path,
+        title: title ?? "Claude Code conversation",
+        createdAt: createdAt ?? now,
+        updatedAt: updatedAt ?? createdAt ?? now,
+        messages,
+    };
+}
+function normalizeRole(role) {
+    if (role === "user" || role === "assistant" || role === "system" || role === "tool")
+        return role;
+    return null;
+}
+function extractClaudeText(record) {
+    const direct = stringValue(record.message);
+    if (direct)
+        return direct;
+    const message = asRecord(record.message);
+    if (!message)
+        return null;
+    const content = message.content;
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return null;
+    const parts = content.flatMap((item) => {
+        const part = asRecord(item);
+        const text = part ? stringValue(part.text) : null;
+        return text ? [text] : [];
+    });
+    return parts.length > 0 ? parts.join("\n\n") : null;
+}
+function shouldDropScaffolding(text) {
+    return text.startsWith("<command-name>") || text.startsWith("<local-command-stdout>");
+}
+function firstLine(text) {
+    return text.split(/\r?\n/, 1)[0]?.slice(0, 80) || "Claude Code conversation";
+}

package/dist/parser/codex.js

@@ -0,0 +1,82 @@
+import { basename } from "node:path";
+import { redactSecrets } from "../redact/secrets.js";
+import { asRecord, readJsonl, stringValue } from "./jsonl.js";
+export async function parseCodexSession(path) {
+    const records = await readJsonl(path);
+    const messages = [];
+    let sessionId = basename(path, ".jsonl");
+    let title = null;
+    let createdAt = null;
+    let updatedAt = null;
+    for (const value of records) {
+        const record = asRecord(value);
+        if (!record)
+            continue;
+        const type = stringValue(record.type);
+        const timestamp = stringValue(record.timestamp) ?? stringValue(record.created_at);
+        if (timestamp) {
+            createdAt ??= timestamp;
+            updatedAt = timestamp;
+        }
+        if (type === "session_meta") {
+            sessionId = stringValue(record.id) ?? stringValue(record.session_id) ?? sessionId;
+            title = redactTitle(stringValue(record.title)) ?? title;
+            continue;
+        }
+        if (type !== "event_msg")
+            continue;
+        const payload = asRecord(record.payload) ?? record;
+        const messageType = stringValue(payload.type) ?? stringValue(payload.kind);
+        const text = extractText(payload);
+        if (!text)
+            continue;
+        const role = roleForCodexMessage(messageType, payload);
+        messages.push({ role, content: text, timestamp });
+        if (!title && role === "user")
+            title = redactTitle(firstLine(text));
+    }
+    if (messages.length === 0)
+        return null;
+    const now = new Date().toISOString();
+    return {
+        id: sessionId,
+        sourceKind: "codex",
+        sourceId: path,
+        title: title ?? "Codex conversation",
+        createdAt: createdAt ?? now,
+        updatedAt: updatedAt ?? createdAt ?? now,
+        messages,
+    };
+}
+function roleForCodexMessage(messageType, payload) {
+    const role = stringValue(payload.role);
+    if (role === "user" || role === "assistant" || role === "system" || role === "tool")
+        return role;
+    if (messageType?.includes("user"))
+        return "user";
+    if (messageType?.includes("agent") || messageType?.includes("assistant"))
+        return "assistant";
+    if (messageType?.includes("tool"))
+        return "tool";
+    return "assistant";
+}
+function extractText(payload) {
+    for (const key of ["message", "text", "content", "delta"]) {
+        const direct = stringValue(payload[key]);
+        if (direct)
+            return direct;
+    }
+    const message = asRecord(payload.message);
+    if (message) {
+        const content = stringValue(message.content);
+        if (content)
+            return content;
+    }
+    return null;
+}
+function firstLine(text) {
+    return text.split(/\r?\n/, 1)[0]?.slice(0, 80) || "Codex conversation";
+}
+function redactTitle(title) {
+    return title ? redactSecrets(title) : null;
+}

package/dist/parser/jsonl.js

@@ -0,0 +1,24 @@
+import { readFile } from "node:fs/promises";
+export async function readJsonl(path) {
+    const content = await readFile(path, "utf8");
+    const records = [];
+    for (const line of content.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            records.push(JSON.parse(trimmed));
+        }
+        catch {
+            // Agent history files are written while active. A trailing partial JSONL
+            // record should not prevent earlier complete records from syncing.
+        }
+    }
+    return records;
+}
+export function asRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+export function stringValue(value) {
+    return typeof value === "string" && value.trim().length > 0 ? value : null;
+}

package/dist/parser/types.js

@@ -0,0 +1 @@
+export {};

package/dist/redact/secrets.js

@@ -0,0 +1,38 @@
+export const secretReplacement = "[REDACTED]";
+const literalIndicators = [
+    "ghp_",
+    "github_pat_",
+    "sk-",
+];
+const caseInsensitiveIndicators = [
+    "bearer ",
+    "begin private key",
+    "begin rsa private key",
+    "begin ec private key",
+    "begin openssh private key",
+    "token=",
+    "key=",
+    "api_key=",
+    "password=",
+    "secret=",
+];
+const fullReplacementPatterns = [
+    /\bghp_[A-Za-z0-9_]{20,}\b/g,
+    /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
+    /\bsk-[A-Za-z0-9_-]{16,}\b/g,
+    /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}\b/gi,
+    /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY-----/gi,
+];
+const assignmentPattern = /\b([A-Za-z0-9_]*(?:token|api_key|password|secret)|key)\s*=\s*([^\s&;,'"`]+)/gi;
+export function redactSecrets(text) {
+    if (!mightContainSecret(text))
+        return text;
+    const withoutWholeSecrets = fullReplacementPatterns.reduce((result, pattern) => result.replace(pattern, secretReplacement), text);
+    return withoutWholeSecrets.replace(assignmentPattern, (_match, key) => `${key}=${secretReplacement}`);
+}
+export function mightContainSecret(text) {
+    if (literalIndicators.some((indicator) => text.includes(indicator)))
+        return true;
+    const lowered = text.toLowerCase();
+    return caseInsensitiveIndicators.some((indicator) => lowered.includes(indicator));
+}

package/dist/service/systemd.js

@@ -0,0 +1,38 @@
+import { execFile } from "node:child_process";
+import { mkdir, writeFile } from "node:fs/promises";
+import { promisify } from "node:util";
+import { getDaemonPaths } from "../config/paths.js";
+const execFileAsync = promisify(execFile);
+export async function installUserService(paths = getDaemonPaths()) {
+    await mkdir(paths.systemdUserDir, { recursive: true });
+    const service = buildUserServiceFile(process.execPath, process.argv[1] ?? "nessie-daemon");
+    await writeFile(paths.systemdServiceFile, service);
+    await systemctl("daemon-reload");
+    await systemctl("enable", "nessie-daemon.service");
+    await systemctl("start", "nessie-daemon.service");
+}
+export function buildUserServiceFile(nodePath, cliPath) {
+    return [
+        "[Unit]",
+        "Description=Nessie daemon",
+        "Wants=network-online.target",
+        "After=network-online.target",
+        "",
+        "[Service]",
+        "Type=simple",
+        `ExecStart=${systemdQuote(nodePath)} ${systemdQuote(cliPath)} run`,
+        "Restart=always",
+        "RestartSec=30",
+        "",
+        "[Install]",
+        "WantedBy=default.target",
+        "",
+    ].join("\n");
+}
+export async function systemctl(...args) {
+    const { stdout, stderr } = await execFileAsync("systemctl", ["--user", ...args]);
+    return stdout || stderr;
+}
+function systemdQuote(value) {
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}

package/dist/sources/detect.js

@@ -0,0 +1,43 @@
+import { access } from "node:fs/promises";
+import { homedir, hostname } from "node:os";
+import { join } from "node:path";
+export async function detectSources() {
+    return detectSourcesInHome(homedir(), hostname());
+}
+export async function detectSourcesInHome(home, host) {
+    const candidates = [
+        {
+            kind: "claude_code",
+            displayName: `Claude Code on ${host}`,
+            basePath: join(home, ".claude"),
+        },
+        {
+            kind: "codex",
+            displayName: `Codex on ${host}`,
+            basePath: join(home, ".codex"),
+        },
+    ];
+    const detected = [];
+    for (const candidate of candidates) {
+        if (await exists(sourceProbePath(candidate)))
+            detected.push(candidate);
+    }
+    return detected;
+}
+function sourceProbePath(source) {
+    switch (source.kind) {
+        case "claude_code":
+            return join(source.basePath, "projects");
+        case "codex":
+            return join(source.basePath, "sessions");
+    }
+}
+async function exists(path) {
+    try {
+        await access(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/sync/client.js

@@ -0,0 +1,37 @@
+import { ApiError, postJson } from "../api/http.js";
+import { refreshAccessToken } from "../auth/tokens.js";
+import { writeConfig } from "../config/store.js";
+export async function runPreflightV3(config, options = {}) {
+    return postJsonWithRefresh(config, "/sync/v3/preflight", {
+        device: {
+            id: config.deviceId,
+            displayName: config.deviceName,
+        },
+        resources: config.selectedSources.map((source) => ({
+            kind: source.kind,
+            localId: source.localId,
+            stableKey: source.stableKey,
+            displayName: source.displayName,
+        })),
+    }, options);
+}
+export async function pushSyncPayload(config, payload, options = {}) {
+    return postJsonWithRefresh(config, "/sync/v2/push", {
+        deviceId: config.deviceId,
+        ...payload,
+    }, options);
+}
+async function postJsonWithRefresh(config, path, body, options) {
+    try {
+        await postJson(config.apiUrl, path, body, { token: config.accessToken, fetchImpl: options.fetchImpl });
+        return config;
+    }
+    catch (error) {
+        if (!(error instanceof ApiError) || error.status !== 401)
+            throw error;
+    }
+    const refreshed = await refreshAccessToken(config, { fetchImpl: options.fetchImpl });
+    await (options.persistConfig ?? writeConfig)(refreshed);
+    await postJson(refreshed.apiUrl, path, body, { token: refreshed.accessToken, fetchImpl: options.fetchImpl });
+    return refreshed;
+}

package/dist/sync/ids.js

@@ -0,0 +1,11 @@
+import { createHash } from "node:crypto";
+export function stableUuidFromString(input) {
+    const bytes = createHash("sha256").update(input).digest().subarray(0, 16);
+    bytes[6] = (bytes[6] & 0x0f) | 0x80;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    const hex = bytes.toString("hex");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+export function contentHash(content) {
+    return createHash("sha256").update(content).digest("hex");
+}

package/dist/sync/loop.js

@@ -0,0 +1,48 @@
+import { setTimeout as sleep } from "node:timers/promises";
+import { AuthRefreshError } from "../auth/tokens.js";
+import { readConfig, readState, writeState } from "../config/store.js";
+import { runPreflightV3, pushSyncPayload } from "./client.js";
+import { mapSessionsToPushItems } from "./map.js";
+import { scanSelectedSources } from "./scan.js";
+export async function runSyncOnce() {
+    let config = await readConfig();
+    const state = await readState();
+    config = await runPreflightV3(config);
+    const scan = await scanSelectedSources(config.selectedSources, state);
+    const nodes = [];
+    const edges = [];
+    const previouslyPushedRoots = new Set(state.pushedSourceRootIds);
+    const pushedSourceRootIds = new Set(previouslyPushedRoots);
+    for (const source of config.selectedSources) {
+        const sessions = scan.sessionsBySourceId.get(source.localId) ?? [];
+        const includeRoot = !previouslyPushedRoots.has(source.localId);
+        const mapped = mapSessionsToPushItems(source, sessions, { includeRoot });
+        nodes.push(...mapped.nodes);
+        edges.push(...mapped.edges);
+        if (includeRoot)
+            pushedSourceRootIds.add(source.localId);
+    }
+    if (nodes.length > 0 || edges.length > 0) {
+        config = await pushSyncPayload(config, { nodes, edges });
+    }
+    await writeState({
+        ...scan.nextState,
+        pushedSourceRootIds: [...pushedSourceRootIds].sort(),
+        lastSyncAt: new Date().toISOString(),
+    });
+    return { nodes: nodes.length, edges: edges.length };
+}
+export async function runSyncLoop(intervalSeconds) {
+    while (true) {
+        try {
+            const result = await runSyncOnce();
+            console.log(`Synced ${result.nodes} nodes and ${result.edges} edges.`);
+        }
+        catch (error) {
+            console.error(error instanceof Error ? error.message : String(error));
+            if (error instanceof AuthRefreshError)
+                throw error;
+        }
+        await sleep(Math.max(5, intervalSeconds) * 1000);
+    }
+}

package/dist/sync/map.js

@@ -0,0 +1,88 @@
+import { redactSecrets } from "../redact/secrets.js";
+import { contentHash, stableUuidFromString } from "./ids.js";
+export function mapSessionsToPushItems(source, sessions, options = { includeRoot: true }) {
+    const nodes = options.includeRoot ? [mapRootNode(source)] : [];
+    const edges = [];
+    for (const session of sessions) {
+        const conversationId = stableUuidFromString(`${source.localId}:session:${session.id}`);
+        nodes.push({
+            node: {
+                id: conversationId,
+                integrationId: source.localId,
+                sourceId: session.sourceId,
+                name: redactSecrets(session.title),
+                kind: session.sourceKind === "codex" ? "codex_chat" : "claude_code_chat",
+                originalCreatedAt: session.createdAt,
+                originalUpdatedAt: session.updatedAt,
+            },
+            baseCloudUpdatedAt: null,
+            slices: [],
+            aiChatMessage: null,
+            nessieChatMessage: null,
+        });
+        edges.push(mapEdge(source.localId, conversationId, "source_of", 0));
+        const pushableMessages = session.messages.filter((message) => message.role !== "system");
+        pushableMessages.forEach((message, index) => {
+            const messageId = stableUuidFromString(`${conversationId}:message:${index}`);
+            const content = redactSecrets(message.content);
+            const timestamp = message.timestamp ?? session.updatedAt;
+            nodes.push({
+                node: {
+                    id: messageId,
+                    integrationId: source.localId,
+                    sourceId: `${session.sourceId}#${index}`,
+                    name: content.slice(0, 80) || message.role,
+                    kind: session.sourceKind === "codex" ? "codex_chat_message" : "claude_code_chat_message",
+                    originalCreatedAt: timestamp,
+                    originalUpdatedAt: timestamp,
+                },
+                baseCloudUpdatedAt: null,
+                slices: [{
+                        id: stableUuidFromString(`${messageId}:slice:0`),
+                        nodeId: messageId,
+                        index: 0,
+                        content,
+                        contentHash: contentHash(content),
+                    }],
+                aiChatMessage: {
+                    nodeId: messageId,
+                    role: message.role,
+                    author: null,
+                },
+                nessieChatMessage: null,
+            });
+            edges.push(mapEdge(conversationId, messageId, "contains", index));
+        });
+    }
+    return { nodes, edges };
+}
+function mapRootNode(source) {
+    const now = new Date().toISOString();
+    return {
+        node: {
+            id: source.localId,
+            integrationId: source.localId,
+            sourceId: source.basePath,
+            name: redactSecrets(source.displayName),
+            kind: "integration_root",
+            originalCreatedAt: now,
+            originalUpdatedAt: now,
+        },
+        baseCloudUpdatedAt: null,
+        slices: [],
+        aiChatMessage: null,
+        nessieChatMessage: null,
+    };
+}
+function mapEdge(fromNodeId, toNodeId, type, sortIndex) {
+    return {
+        edge: {
+            id: stableUuidFromString(`${fromNodeId}:${type}:${toNodeId}`),
+            fromNodeId,
+            toNodeId,
+            type,
+            sortIndex,
+        },
+        baseCloudUpdatedAt: null,
+    };
+}

package/dist/sync/scan.js

@@ -0,0 +1,58 @@
+import { readdir, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { parseClaudeCodeSession } from "../parser/claudeCode.js";
+import { parseCodexSession } from "../parser/codex.js";
+export async function scanSelectedSources(sources, state) {
+    const nextState = {
+        files: { ...state.files },
+        pushedSourceRootIds: [...state.pushedSourceRootIds],
+        lastSyncAt: state.lastSyncAt,
+    };
+    const sessionsBySourceId = new Map();
+    for (const source of sources) {
+        const files = await sessionFilesForSource(source);
+        const sessions = [];
+        for (const file of files) {
+            const cursor = await cursorForFile(file);
+            if (isUnchanged(state.files[file], cursor))
+                continue;
+            const session = source.kind === "codex" ? await parseCodexSession(file) : await parseClaudeCodeSession(file);
+            nextState.files[file] = cursor;
+            if (session)
+                sessions.push(session);
+        }
+        sessionsBySourceId.set(source.localId, sessions);
+    }
+    return { sessionsBySourceId, nextState };
+}
+async function sessionFilesForSource(source) {
+    const root = source.kind === "codex" ? join(source.basePath, "sessions") : join(source.basePath, "projects");
+    return walkJsonl(root);
+}
+async function walkJsonl(root) {
+    try {
+        const entries = await readdir(root, { withFileTypes: true });
+        const nested = await Promise.all(entries.map(async (entry) => {
+            const path = join(root, entry.name);
+            if (entry.isDirectory())
+                return walkJsonl(path);
+            return entry.isFile() && entry.name.endsWith(".jsonl") ? [path] : [];
+        }));
+        return nested.flat().sort();
+    }
+    catch (error) {
+        if (typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+async function cursorForFile(file) {
+    const stats = await stat(file);
+    return {
+        mtimeMs: stats.mtimeMs,
+        size: stats.size,
+    };
+}
+function isUnchanged(previous, next) {
+    return previous?.mtimeMs === next.mtimeMs && previous.size === next.size;
+}

package/dist/sync/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@nessielabs/daemon",
+  "version": "0.1.0",
+  "description": "Headless Linux ingestion daemon for Nessie agent traces.",
+  "license": "UNLICENSED",
+  "type": "module",
+  "bin": {
+    "nessie-daemon": "./dist/cli.js"
+  },
+  "files": [
+    "dist/**/*.js",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "dev": "tsx src/cli.ts",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@inquirer/prompts": "^7.8.0",
+    "commander": "^14.0.2"
+  },
+  "devDependencies": {
+    "@types/node": "^24.10.1",
+    "tsx": "^4.20.6",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.14"
+  }
+}