@nessielabs/daemon 0.2.1 → 0.3.0

package/dist/cli.js

@@ -7,7 +7,7 @@ const program = new Command();
 program
     .name("nessie-daemon")
     .description("Headless Nessie ingestion daemon for Linux agent machines.")
-    .version("0.2.1");
+    .version("0.2.2");
 program
     .command("setup")
     .description("Authenticate, select local sources, and optionally install the user systemd service.")

package/dist/config/store.js

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { hostname } from "node:os";
 import { dirname } from "node:path";
+import { PARSER_VERSION } from "../parser/types.js";
 import { getDaemonPaths } from "./paths.js";
 export function createConfig(input) {
     const deviceId = input.deviceId ?? randomUUID();
@@ -22,6 +23,8 @@ export function createInitialState() {
     return {
         files: {},
         pushedSourceRootIds: [],
+        pushedSessions: {},
+        parserVersion: PARSER_VERSION,
         lastSyncAt: null,
     };
 }
@@ -38,6 +41,10 @@ export async function readState(paths = getDaemonPaths()) {
         return {
             files: parsed.files ?? {},
             pushedSourceRootIds: parsed.pushedSourceRootIds ?? [],
+            pushedSessions: parsed.pushedSessions ?? {},
+            // State written before parser versioning existed predates every
+            // versioned parser change, so it always needs the backfill pass.
+            parserVersion: parsed.parserVersion ?? 0,
             lastSyncAt: parsed.lastSyncAt ?? null,
         };
     }

package/dist/git/repoResolver.js

@@ -0,0 +1,215 @@
+import { readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+/** Directory levels to walk up looking for `.git` before giving up. */
+const MAX_PARENT_TRAVERSAL = 64;
+/**
+ * Resolves the git repository identity for a working directory by reading
+ * `.git` metadata from disk, without invoking the `git` binary.
+ *
+ * Resolution is best-effort by design: paths that are not inside a git
+ * repository, repositories without remotes, and repositories deleted since
+ * the session simply resolve to null.
+ */
+export class GitRepoResolver {
+    /**
+     * Memoized results per workspace path: conversations in the same directory
+     * repeat heavily within one sync run.
+     */
+    cache = new Map();
+    resolve(workspacePath) {
+        const standardized = resolve(expandTilde(workspacePath));
+        const cached = this.cache.get(standardized);
+        if (cached !== undefined)
+            return cached;
+        const resolved = resolveUncached(standardized);
+        this.cache.set(standardized, resolved);
+        return resolved;
+    }
+}
+function expandTilde(path) {
+    if (path === "~")
+        return homedir();
+    if (path.startsWith("~/"))
+        return join(homedir(), path.slice(2));
+    return path;
+}
+function resolveUncached(workspacePath) {
+    let directory = workspacePath;
+    for (let level = 0; level < MAX_PARENT_TRAVERSAL; level += 1) {
+        const configPath = gitConfigPath(join(directory, ".git"));
+        if (configPath) {
+            const config = readTextFile(configPath);
+            const remoteUrl = config !== null ? remoteUrlFromGitConfig(config) : null;
+            if (remoteUrl) {
+                return { remoteUrl, repoKey: normalizedRepoKey(remoteUrl) };
+            }
+            // A repo without a remote keeps the walk going so a nested remoteless
+            // checkout attributes to its enclosing repo. Matches NessieCore's
+            // GitRepoResolver.resolveUncached, the source of truth for repo
+            // identity; both implementations must group conversations identically.
+        }
+        const parent = dirname(directory);
+        if (parent === directory)
+            return null;
+        directory = parent;
+    }
+    return null;
+}
+/**
+ * Locate the `config` file for a `.git` entry, which is a directory for
+ * normal checkouts and a `gitdir:` pointer file for worktrees and submodules.
+ */
+function gitConfigPath(gitEntry) {
+    const stats = statSync(gitEntry, { throwIfNoEntry: false });
+    if (!stats)
+        return null;
+    if (stats.isDirectory()) {
+        return existingFile(join(gitEntry, "config"));
+    }
+    const pointer = readTextFile(gitEntry);
+    const gitDir = pointer !== null ? gitDirPath(pointer) : null;
+    if (!gitDir)
+        return null;
+    const resolvedGitDir = absolutePath(gitDir, dirname(gitEntry));
+    // Worktree gitdirs keep shared state (including `config`) in the main
+    // repository's git directory, referenced by a `commondir` file.
+    const commonDir = readTextFile(join(resolvedGitDir, "commondir"))?.trim();
+    if (commonDir) {
+        return existingFile(join(absolutePath(commonDir, resolvedGitDir), "config"));
+    }
+    return existingFile(join(resolvedGitDir, "config"));
+}
+function existingFile(path) {
+    return statSync(path, { throwIfNoEntry: false })?.isFile() ? path : null;
+}
+function readTextFile(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+export function gitDirPath(pointerContents) {
+    for (const line of pointerContents.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("gitdir:"))
+            continue;
+        const path = trimmed.slice("gitdir:".length).trim();
+        return path.length > 0 ? path : null;
+    }
+    return null;
+}
+function absolutePath(path, base) {
+    return isAbsolute(path) ? resolve(path) : resolve(base, path);
+}
+/**
+ * Extract a remote URL from raw `.git/config` contents, preferring `origin`
+ * and falling back to the first remote with a URL.
+ */
+export function remoteUrlFromGitConfig(contents) {
+    let currentRemote = null;
+    let originUrl = null;
+    let firstUrl = null;
+    for (const line of contents.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("[")) {
+            currentRemote = remoteNameFromSectionHeader(trimmed);
+            continue;
+        }
+        if (!currentRemote)
+            continue;
+        const url = configValue(trimmed, "url");
+        if (!url)
+            continue;
+        if (currentRemote === "origin" && originUrl === null) {
+            originUrl = url;
+        }
+        if (firstUrl === null) {
+            firstUrl = url;
+        }
+    }
+    return originUrl ?? firstUrl;
+}
+function remoteNameFromSectionHeader(header) {
+    // [remote "origin"]
+    if (!header.startsWith("[remote "))
+        return null;
+    const openQuote = header.indexOf('"');
+    const closeQuote = header.lastIndexOf('"');
+    if (openQuote === -1 || closeQuote <= openQuote)
+        return null;
+    return header.slice(openQuote + 1, closeQuote);
+}
+function configValue(line, key) {
+    const equals = line.indexOf("=");
+    if (equals === -1)
+        return null;
+    if (line.slice(0, equals).trim() !== key)
+        return null;
+    const value = line.slice(equals + 1).trim();
+    return value.length > 0 ? value : null;
+}
+/**
+ * Normalize a configured remote URL to a stable `host/path` identity so the
+ * same repository matches across protocols, credentials, machines, and
+ * clones: `git@github.com:Org/Repo.git` and `https://github.com/org/repo`
+ * both become `github.com/org/repo`.
+ */
+export function normalizedRepoKey(remoteUrl) {
+    let rest = remoteUrl.trim();
+    if (rest.length === 0)
+        return null;
+    const schemeEnd = rest.indexOf("://");
+    if (schemeEnd !== -1) {
+        const scheme = rest.slice(0, schemeEnd).toLowerCase();
+        // Local remotes have no cross-machine identity.
+        if (scheme === "file")
+            return null;
+        rest = rest.slice(schemeEnd + "://".length);
+    }
+    else if (rest.includes(":") && (rest.includes("@") || !rest.startsWith("/"))) {
+        // scp-like syntax: [user@]host:path
+        const colon = rest.indexOf(":");
+        const hostPart = rest.slice(0, colon);
+        const path = rest.slice(colon + 1);
+        if (hostPart.length === 0 || path.length === 0 || hostPart.includes("/"))
+            return null;
+        rest = `${hostPart}/${path}`;
+    }
+    else {
+        // Bare filesystem path remote.
+        return null;
+    }
+    // Strip userinfo.
+    const lastAt = rest.lastIndexOf("@");
+    const firstSlash = rest.indexOf("/");
+    if (lastAt !== -1 && firstSlash !== -1 && lastAt < firstSlash) {
+        rest = rest.slice(lastAt + 1);
+    }
+    else if (rest.includes("@") && !rest.includes("/")) {
+        rest = rest.slice(rest.indexOf("@") + 1);
+    }
+    const components = rest.split("/").filter((component) => component.length > 0);
+    if (components.length < 2)
+        return null;
+    // Lowercase the host and drop any port; path case is preserved except for
+    // trailing `.git`.
+    let host = components[0].toLowerCase();
+    const portColon = host.indexOf(":");
+    if (portColon !== -1) {
+        host = host.slice(0, portColon);
+    }
+    if (!host.includes(".") && host !== "localhost")
+        return null;
+    components[0] = host;
+    let last = components[components.length - 1];
+    if (last.toLowerCase().endsWith(".git")) {
+        last = last.slice(0, -4);
+    }
+    if (last.length === 0)
+        return null;
+    components[components.length - 1] = last;
+    return components.join("/");
+}

package/dist/parser/claudeCode.js

@@ -8,10 +8,15 @@ export async function parseClaudeCodeSession(path) {
     let title = null;
     let createdAt = null;
     let updatedAt = null;
+    let cwd = null;
     for (const value of records) {
         const record = asRecord(value);
         if (!record)
             continue;
+        // Every transcript line stamps cwd, including sidechain lines, so capture
+        // it before any filtering. The path-encoded project directory name is
+        // lossy (dashes vs. path separators), so this is the only reliable source.
+        cwd ??= stringValue(record.cwd);
         if (record.isSidechain === true)
             continue;
         sessionId = stringValue(record.sessionId) ?? stringValue(record.session_id) ?? sessionId;
@@ -40,6 +45,7 @@ export async function parseClaudeCodeSession(path) {
         title: title ?? "Claude Code conversation",
         createdAt: createdAt ?? now,
         updatedAt: updatedAt ?? createdAt ?? now,
+        cwd,
         messages,
     };
 }

package/dist/parser/codex.js

@@ -8,6 +8,7 @@ export async function parseCodexSession(path) {
     let title = null;
     let createdAt = null;
     let updatedAt = null;
+    let cwd = null;
     for (const value of records) {
         const record = asRecord(value);
         if (!record)
@@ -21,6 +22,8 @@ export async function parseCodexSession(path) {
         if (type === "session_meta") {
             sessionId = stringValue(record.id) ?? stringValue(record.session_id) ?? sessionId;
             title = redactTitle(stringValue(record.title)) ?? title;
+            const meta = asRecord(record.payload) ?? record;
+            cwd ??= stringValue(meta.cwd);
             continue;
         }
         if (type !== "event_msg")
@@ -45,6 +48,7 @@ export async function parseCodexSession(path) {
         title: title ?? "Codex conversation",
         createdAt: createdAt ?? now,
         updatedAt: updatedAt ?? createdAt ?? now,
+        cwd,
         messages,
     };
 }

package/dist/parser/types.js

@@ -1 +1,9 @@
-export {};
+/**
+ * Version of the daemon's transcript parsing + enrichment semantics. Bumping
+ * it makes the next sync reparse every session file and re-push conversation
+ * headers as field-masked merges, so previously synced conversations pick up
+ * newly extracted metadata. Messages are append-only and are never re-pushed.
+ *
+ * 1: workspace/repo metadata (cwd, git remote, repo key) on conversations.
+ */
+export const PARSER_VERSION = 1;

package/dist/redact/secrets.js

@@ -2,6 +2,8 @@ export const secretReplacement = "[REDACTED]";
 const literalIndicators = [
     "ghp_",
     "github_pat_",
+    "napi_",
+    "npg_",
     "sk-",
 ];
 const caseInsensitiveIndicators = [
@@ -13,22 +15,42 @@ const caseInsensitiveIndicators = [
     "token=",
     "key=",
     "api_key=",
+    "connection_string=",
+    "database_url=",
+    "db_url=",
     "password=",
+    "postgres_url=",
+    "postgresql_url=",
+    "postgres://",
+    "postgresql://",
     "secret=",
+    "supabase",
 ];
 const fullReplacementPatterns = [
     /\bghp_[A-Za-z0-9_]{20,}\b/g,
     /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
+    /\bnapi_[A-Za-z0-9_-]{16,}\b/g,
+    /\bnpg_[A-Za-z0-9_-]{16,}\b/g,
     /\bsk-[A-Za-z0-9_-]{16,}\b/g,
+    /\bsb_(?:publishable|secret)_[A-Za-z0-9_-]{16,}\b/g,
+    /\bsbp_[A-Za-z0-9_-]{16,}\b/g,
+    /\bpostgres(?:ql)?:\/\/[^\s'"`<>]+/gi,
     /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}\b/gi,
     /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY-----/gi,
 ];
-const assignmentPattern = /\b([A-Za-z0-9_]*(?:token|api_key|password|secret)|key)\s*=\s*([^\s&;,'"`]+)/gi;
+const uuidPattern = /\b[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}\b/gi;
+const sensitiveKeyNamePattern = String.raw `[A-Za-z0-9_]*(?:token|api[_-]?key|apikey|password|secret|[_-]key|connection[_-]?string|database[_-]?url|db[_-]?url|postgres(?:ql)?[_-]?url)|key`;
+const unquotedAssignmentValuePattern = "[^\\s&;,'\"`}\\[\\]]+";
+const assignmentPattern = new RegExp(String.raw `\b(${sensitiveKeyNamePattern})\b(\s*=\s*)(["']?)(${unquotedAssignmentValuePattern})\3?`, "gi");
+const quotedAssignmentPattern = new RegExp(String.raw `(["'])(${sensitiveKeyNamePattern})\1(\s*:\s*)(["'])([^"']+)\4`, "gi");
 export function redactSecrets(text) {
-    if (!mightContainSecret(text))
-        return text;
-    const withoutWholeSecrets = fullReplacementPatterns.reduce((result, pattern) => result.replace(pattern, secretReplacement), text);
-    return withoutWholeSecrets.replace(assignmentPattern, (_match, key) => `${key}=${secretReplacement}`);
+    const withoutUuids = text.replace(uuidPattern, secretReplacement);
+    if (!mightContainSecret(withoutUuids))
+        return withoutUuids;
+    const withoutWholeSecrets = fullReplacementPatterns.reduce((result, pattern) => result.replace(pattern, secretReplacement), withoutUuids);
+    return withoutWholeSecrets
+        .replace(quotedAssignmentPattern, (_match, keyQuote, key, separator, valueQuote) => `${keyQuote}${key}${keyQuote}${separator}${valueQuote}${secretReplacement}${valueQuote}`)
+        .replace(assignmentPattern, (_match, key, separator, valueQuote) => `${key}${separator}${valueQuote}${secretReplacement}${valueQuote}`);
 }
 export function mightContainSecret(text) {
     if (literalIndicators.some((indicator) => text.includes(indicator)))

package/dist/sync/loop.js

@@ -1,6 +1,8 @@
 import { setTimeout as sleep } from "node:timers/promises";
 import { AuthRefreshError } from "../auth/tokens.js";
 import { readConfig, readState, writeState } from "../config/store.js";
+import { GitRepoResolver } from "../git/repoResolver.js";
+import { PARSER_VERSION } from "../parser/types.js";
 import { runPreflightV3, pushSyncPayload } from "./client.js";
 import { mapSessionsToPushItems } from "./map.js";
 import { scanSelectedSources } from "./scan.js";
@@ -8,19 +10,34 @@ export async function runSyncOnce() {
     let config = await readConfig();
     const state = await readState();
     config = await runPreflightV3(config);
-    const scan = await scanSelectedSources(config.selectedSources, state);
+    // A parser version bump reparses everything once and re-pushes conversation
+    // headers as field-masked merges so existing conversations pick up newly
+    // extracted metadata. The state only records the new version after a
+    // successful push, so a failed backfill retries on the next run.
+    const backfillParserChanges = state.parserVersion < PARSER_VERSION;
+    const scan = await scanSelectedSources(config.selectedSources, state, {
+        forceReparse: backfillParserChanges,
+    });
+    const repoResolver = new GitRepoResolver();
     const nodes = [];
     const edges = [];
     const previouslyPushedRoots = new Set(state.pushedSourceRootIds);
     const pushedSourceRootIds = new Set(previouslyPushedRoots);
+    const pushedSessions = { ...state.pushedSessions };
     for (const source of config.selectedSources) {
         const sessions = scan.sessionsBySourceId.get(source.localId) ?? [];
         const includeRoot = !previouslyPushedRoots.has(source.localId);
-        const mapped = mapSessionsToPushItems(source, sessions, { includeRoot });
+        const mapped = mapSessionsToPushItems(source, sessions, {
+            includeRoot,
+            pushedSessions: state.pushedSessions,
+            repushHeaders: backfillParserChanges,
+            resolveRepo: (workspacePath) => repoResolver.resolve(workspacePath),
+        });
         nodes.push(...mapped.nodes);
         edges.push(...mapped.edges);
         if (includeRoot)
             pushedSourceRootIds.add(source.localId);
+        Object.assign(pushedSessions, mapped.pushedSessions);
     }
     if (nodes.length > 0 || edges.length > 0) {
         config = await pushSyncPayload(config, { nodes, edges });
@@ -28,6 +45,8 @@ export async function runSyncOnce() {
     await writeState({
         ...scan.nextState,
         pushedSourceRootIds: [...pushedSourceRootIds].sort(),
+        pushedSessions,
+        parserVersion: PARSER_VERSION,
         lastSyncAt: new Date().toISOString(),
     });
     return { nodes: nodes.length, edges: edges.length };

package/dist/sync/map.js

@@ -1,28 +1,52 @@
 import { redactSecrets } from "../redact/secrets.js";
 import { contentHash, stableUuidFromString } from "./ids.js";
 export function mapSessionsToPushItems(source, sessions, options = { includeRoot: true }) {
+    const pushedSessions = options.pushedSessions ?? {};
+    const nextPushedSessions = {};
     const nodes = options.includeRoot ? [mapRootNode(source)] : [];
     const edges = [];
     for (const session of sessions) {
         const conversationId = stableUuidFromString(`${source.localId}:session:${session.id}`);
-        nodes.push({
-            node: {
-                id: conversationId,
-                integrationId: source.localId,
-                sourceId: session.sourceId,
-                name: redactSecrets(session.title),
-                kind: session.sourceKind === "codex" ? "codex_chat" : "claude_code_chat",
-                originalCreatedAt: session.createdAt,
-                originalUpdatedAt: session.updatedAt,
-            },
-            baseCloudUpdatedAt: null,
-            slices: [],
-            aiChatMessage: null,
-            nessieChatMessage: null,
-        });
-        edges.push(mapEdge(source.localId, conversationId, "source_of", 0));
+        const stateKey = sessionStateKey(source, session);
+        const sessionCursor = pushedSessions[stateKey] ?? {
+            conversationPushed: false,
+            pushedMessageCount: 0,
+        };
+        if (!sessionCursor.conversationPushed || options.repushHeaders === true) {
+            const repoInfo = session.cwd !== null ? options.resolveRepo?.(session.cwd) ?? null : null;
+            // Headers always push as a field-masked merge: new conversations insert
+            // normally, and re-pushed headers only touch the workspace metadata
+            // columns, never fields other clients own (name, labels, deletion).
+            nodes.push({
+                node: {
+                    id: conversationId,
+                    integrationId: source.localId,
+                    sourceId: session.sourceId,
+                    name: redactSecrets(session.title),
+                    kind: session.sourceKind === "codex" ? "codex_chat" : "claude_code_chat",
+                    workspacePath: session.cwd,
+                    repoRemoteUrl: repoInfo?.remoteUrl ?? null,
+                    repoKey: repoInfo?.repoKey ?? null,
+                    originalCreatedAt: session.createdAt,
+                    originalUpdatedAt: session.updatedAt,
+                },
+                baseCloudUpdatedAt: null,
+                slices: [],
+                aiChatMessage: null,
+                nessieChatMessage: null,
+                mergeFields: ["workspacePath", "repoRemoteUrl", "repoKey"],
+            });
+        }
+        if (!sessionCursor.conversationPushed) {
+            edges.push(mapEdge(source.localId, conversationId, "source_of", 0));
+        }
         const pushableMessages = session.messages.filter((message) => message.role !== "system");
-        pushableMessages.forEach((message, index) => {
+        nextPushedSessions[stateKey] = {
+            conversationPushed: true,
+            pushedMessageCount: pushableMessages.length,
+        };
+        pushableMessages.slice(sessionCursor.pushedMessageCount).forEach((message, offset) => {
+            const index = sessionCursor.pushedMessageCount + offset;
             const messageId = stableUuidFromString(`${conversationId}:message:${index}`);
             const content = redactSecrets(message.content);
             const timestamp = message.timestamp ?? session.updatedAt;
@@ -54,7 +78,10 @@ export function mapSessionsToPushItems(source, sessions, options = { includeRoot
             edges.push(mapEdge(conversationId, messageId, "contains", index));
         });
     }
-    return { nodes, edges };
+    return { nodes, edges, pushedSessions: nextPushedSessions };
+}
+export function sessionStateKey(source, session) {
+    return `${source.localId}:session:${session.id}`;
 }
 function mapRootNode(source) {
     const now = new Date().toISOString();
@@ -75,9 +102,10 @@ function mapRootNode(source) {
     };
 }
 function mapEdge(fromNodeId, toNodeId, type, sortIndex) {
+    const id = stableUuidFromString(`${fromNodeId}:${type}:${toNodeId}`);
     return {
         edge: {
-            id: stableUuidFromString(`${fromNodeId}:${type}:${toNodeId}`),
+            id,
             fromNodeId,
             toNodeId,
             type,

package/dist/sync/scan.js

@@ -2,10 +2,12 @@ import { readdir, stat } from "node:fs/promises";
 import { join } from "node:path";
 import { parseClaudeCodeSession } from "../parser/claudeCode.js";
 import { parseCodexSession } from "../parser/codex.js";
-export async function scanSelectedSources(sources, state) {
+export async function scanSelectedSources(sources, state, options = {}) {
     const nextState = {
         files: { ...state.files },
         pushedSourceRootIds: [...state.pushedSourceRootIds],
+        pushedSessions: { ...state.pushedSessions },
+        parserVersion: state.parserVersion,
         lastSyncAt: state.lastSyncAt,
     };
     const sessionsBySourceId = new Map();
@@ -14,7 +16,7 @@ export async function scanSelectedSources(sources, state) {
         const sessions = [];
         for (const file of files) {
             const cursor = await cursorForFile(file);
-            if (isUnchanged(state.files[file], cursor))
+            if (options.forceReparse !== true && isUnchanged(state.files[file], cursor))
                 continue;
             const session = source.kind === "codex" ? await parseCodexSession(file) : await parseClaudeCodeSession(file);
             nextState.files[file] = cursor;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nessielabs/daemon",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Headless Linux ingestion daemon for Nessie agent traces.",
   "license": "UNLICENSED",
   "type": "module",
@@ -18,7 +18,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.json",
+    "build": "rm -rf dist && tsc -p tsconfig.json && chmod +x dist/cli.js",
     "check": "tsc -p tsconfig.json --noEmit",
     "dev": "tsx src/cli.ts",
     "test": "vitest run"