@nessielabs/daemon 0.2.2 → 0.3.0

package/dist/config/store.js

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { hostname } from "node:os";
 import { dirname } from "node:path";
+import { PARSER_VERSION } from "../parser/types.js";
 import { getDaemonPaths } from "./paths.js";
 export function createConfig(input) {
     const deviceId = input.deviceId ?? randomUUID();
@@ -23,6 +24,7 @@ export function createInitialState() {
         files: {},
         pushedSourceRootIds: [],
         pushedSessions: {},
+        parserVersion: PARSER_VERSION,
         lastSyncAt: null,
     };
 }
@@ -40,6 +42,9 @@ export async function readState(paths = getDaemonPaths()) {
             files: parsed.files ?? {},
             pushedSourceRootIds: parsed.pushedSourceRootIds ?? [],
             pushedSessions: parsed.pushedSessions ?? {},
+            // State written before parser versioning existed predates every
+            // versioned parser change, so it always needs the backfill pass.
+            parserVersion: parsed.parserVersion ?? 0,
             lastSyncAt: parsed.lastSyncAt ?? null,
         };
     }

package/dist/git/repoResolver.js

@@ -0,0 +1,215 @@
+import { readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+/** Directory levels to walk up looking for `.git` before giving up. */
+const MAX_PARENT_TRAVERSAL = 64;
+/**
+ * Resolves the git repository identity for a working directory by reading
+ * `.git` metadata from disk, without invoking the `git` binary.
+ *
+ * Resolution is best-effort by design: paths that are not inside a git
+ * repository, repositories without remotes, and repositories deleted since
+ * the session simply resolve to null.
+ */
+export class GitRepoResolver {
+    /**
+     * Memoized results per workspace path: conversations in the same directory
+     * repeat heavily within one sync run.
+     */
+    cache = new Map();
+    resolve(workspacePath) {
+        const standardized = resolve(expandTilde(workspacePath));
+        const cached = this.cache.get(standardized);
+        if (cached !== undefined)
+            return cached;
+        const resolved = resolveUncached(standardized);
+        this.cache.set(standardized, resolved);
+        return resolved;
+    }
+}
+function expandTilde(path) {
+    if (path === "~")
+        return homedir();
+    if (path.startsWith("~/"))
+        return join(homedir(), path.slice(2));
+    return path;
+}
+function resolveUncached(workspacePath) {
+    let directory = workspacePath;
+    for (let level = 0; level < MAX_PARENT_TRAVERSAL; level += 1) {
+        const configPath = gitConfigPath(join(directory, ".git"));
+        if (configPath) {
+            const config = readTextFile(configPath);
+            const remoteUrl = config !== null ? remoteUrlFromGitConfig(config) : null;
+            if (remoteUrl) {
+                return { remoteUrl, repoKey: normalizedRepoKey(remoteUrl) };
+            }
+            // A repo without a remote keeps the walk going so a nested remoteless
+            // checkout attributes to its enclosing repo. Matches NessieCore's
+            // GitRepoResolver.resolveUncached, the source of truth for repo
+            // identity; both implementations must group conversations identically.
+        }
+        const parent = dirname(directory);
+        if (parent === directory)
+            return null;
+        directory = parent;
+    }
+    return null;
+}
+/**
+ * Locate the `config` file for a `.git` entry, which is a directory for
+ * normal checkouts and a `gitdir:` pointer file for worktrees and submodules.
+ */
+function gitConfigPath(gitEntry) {
+    const stats = statSync(gitEntry, { throwIfNoEntry: false });
+    if (!stats)
+        return null;
+    if (stats.isDirectory()) {
+        return existingFile(join(gitEntry, "config"));
+    }
+    const pointer = readTextFile(gitEntry);
+    const gitDir = pointer !== null ? gitDirPath(pointer) : null;
+    if (!gitDir)
+        return null;
+    const resolvedGitDir = absolutePath(gitDir, dirname(gitEntry));
+    // Worktree gitdirs keep shared state (including `config`) in the main
+    // repository's git directory, referenced by a `commondir` file.
+    const commonDir = readTextFile(join(resolvedGitDir, "commondir"))?.trim();
+    if (commonDir) {
+        return existingFile(join(absolutePath(commonDir, resolvedGitDir), "config"));
+    }
+    return existingFile(join(resolvedGitDir, "config"));
+}
+function existingFile(path) {
+    return statSync(path, { throwIfNoEntry: false })?.isFile() ? path : null;
+}
+function readTextFile(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+export function gitDirPath(pointerContents) {
+    for (const line of pointerContents.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("gitdir:"))
+            continue;
+        const path = trimmed.slice("gitdir:".length).trim();
+        return path.length > 0 ? path : null;
+    }
+    return null;
+}
+function absolutePath(path, base) {
+    return isAbsolute(path) ? resolve(path) : resolve(base, path);
+}
+/**
+ * Extract a remote URL from raw `.git/config` contents, preferring `origin`
+ * and falling back to the first remote with a URL.
+ */
+export function remoteUrlFromGitConfig(contents) {
+    let currentRemote = null;
+    let originUrl = null;
+    let firstUrl = null;
+    for (const line of contents.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("[")) {
+            currentRemote = remoteNameFromSectionHeader(trimmed);
+            continue;
+        }
+        if (!currentRemote)
+            continue;
+        const url = configValue(trimmed, "url");
+        if (!url)
+            continue;
+        if (currentRemote === "origin" && originUrl === null) {
+            originUrl = url;
+        }
+        if (firstUrl === null) {
+            firstUrl = url;
+        }
+    }
+    return originUrl ?? firstUrl;
+}
+function remoteNameFromSectionHeader(header) {
+    // [remote "origin"]
+    if (!header.startsWith("[remote "))
+        return null;
+    const openQuote = header.indexOf('"');
+    const closeQuote = header.lastIndexOf('"');
+    if (openQuote === -1 || closeQuote <= openQuote)
+        return null;
+    return header.slice(openQuote + 1, closeQuote);
+}
+function configValue(line, key) {
+    const equals = line.indexOf("=");
+    if (equals === -1)
+        return null;
+    if (line.slice(0, equals).trim() !== key)
+        return null;
+    const value = line.slice(equals + 1).trim();
+    return value.length > 0 ? value : null;
+}
+/**
+ * Normalize a configured remote URL to a stable `host/path` identity so the
+ * same repository matches across protocols, credentials, machines, and
+ * clones: `git@github.com:Org/Repo.git` and `https://github.com/org/repo`
+ * both become `github.com/org/repo`.
+ */
+export function normalizedRepoKey(remoteUrl) {
+    let rest = remoteUrl.trim();
+    if (rest.length === 0)
+        return null;
+    const schemeEnd = rest.indexOf("://");
+    if (schemeEnd !== -1) {
+        const scheme = rest.slice(0, schemeEnd).toLowerCase();
+        // Local remotes have no cross-machine identity.
+        if (scheme === "file")
+            return null;
+        rest = rest.slice(schemeEnd + "://".length);
+    }
+    else if (rest.includes(":") && (rest.includes("@") || !rest.startsWith("/"))) {
+        // scp-like syntax: [user@]host:path
+        const colon = rest.indexOf(":");
+        const hostPart = rest.slice(0, colon);
+        const path = rest.slice(colon + 1);
+        if (hostPart.length === 0 || path.length === 0 || hostPart.includes("/"))
+            return null;
+        rest = `${hostPart}/${path}`;
+    }
+    else {
+        // Bare filesystem path remote.
+        return null;
+    }
+    // Strip userinfo.
+    const lastAt = rest.lastIndexOf("@");
+    const firstSlash = rest.indexOf("/");
+    if (lastAt !== -1 && firstSlash !== -1 && lastAt < firstSlash) {
+        rest = rest.slice(lastAt + 1);
+    }
+    else if (rest.includes("@") && !rest.includes("/")) {
+        rest = rest.slice(rest.indexOf("@") + 1);
+    }
+    const components = rest.split("/").filter((component) => component.length > 0);
+    if (components.length < 2)
+        return null;
+    // Lowercase the host and drop any port; path case is preserved except for
+    // trailing `.git`.
+    let host = components[0].toLowerCase();
+    const portColon = host.indexOf(":");
+    if (portColon !== -1) {
+        host = host.slice(0, portColon);
+    }
+    if (!host.includes(".") && host !== "localhost")
+        return null;
+    components[0] = host;
+    let last = components[components.length - 1];
+    if (last.toLowerCase().endsWith(".git")) {
+        last = last.slice(0, -4);
+    }
+    if (last.length === 0)
+        return null;
+    components[components.length - 1] = last;
+    return components.join("/");
+}

package/dist/parser/claudeCode.js

@@ -8,10 +8,15 @@ export async function parseClaudeCodeSession(path) {
     let title = null;
     let createdAt = null;
     let updatedAt = null;
+    let cwd = null;
     for (const value of records) {
         const record = asRecord(value);
         if (!record)
             continue;
+        // Every transcript line stamps cwd, including sidechain lines, so capture
+        // it before any filtering. The path-encoded project directory name is
+        // lossy (dashes vs. path separators), so this is the only reliable source.
+        cwd ??= stringValue(record.cwd);
         if (record.isSidechain === true)
             continue;
         sessionId = stringValue(record.sessionId) ?? stringValue(record.session_id) ?? sessionId;
@@ -40,6 +45,7 @@ export async function parseClaudeCodeSession(path) {
         title: title ?? "Claude Code conversation",
         createdAt: createdAt ?? now,
         updatedAt: updatedAt ?? createdAt ?? now,
+        cwd,
         messages,
     };
 }

package/dist/parser/codex.js

@@ -8,6 +8,7 @@ export async function parseCodexSession(path) {
     let title = null;
     let createdAt = null;
     let updatedAt = null;
+    let cwd = null;
     for (const value of records) {
         const record = asRecord(value);
         if (!record)
@@ -21,6 +22,8 @@ export async function parseCodexSession(path) {
         if (type === "session_meta") {
             sessionId = stringValue(record.id) ?? stringValue(record.session_id) ?? sessionId;
             title = redactTitle(stringValue(record.title)) ?? title;
+            const meta = asRecord(record.payload) ?? record;
+            cwd ??= stringValue(meta.cwd);
             continue;
         }
         if (type !== "event_msg")
@@ -45,6 +48,7 @@ export async function parseCodexSession(path) {
         title: title ?? "Codex conversation",
         createdAt: createdAt ?? now,
         updatedAt: updatedAt ?? createdAt ?? now,
+        cwd,
         messages,
     };
 }

package/dist/parser/types.js

@@ -1 +1,9 @@
-export {};
+/**
+ * Version of the daemon's transcript parsing + enrichment semantics. Bumping
+ * it makes the next sync reparse every session file and re-push conversation
+ * headers as field-masked merges, so previously synced conversations pick up
+ * newly extracted metadata. Messages are append-only and are never re-pushed.
+ *
+ * 1: workspace/repo metadata (cwd, git remote, repo key) on conversations.
+ */
+export const PARSER_VERSION = 1;

package/dist/redact/secrets.js

@@ -2,6 +2,8 @@ export const secretReplacement = "[REDACTED]";
 const literalIndicators = [
     "ghp_",
     "github_pat_",
+    "napi_",
+    "npg_",
     "sk-",
 ];
 const caseInsensitiveIndicators = [
@@ -13,22 +15,42 @@ const caseInsensitiveIndicators = [
     "token=",
     "key=",
     "api_key=",
+    "connection_string=",
+    "database_url=",
+    "db_url=",
     "password=",
+    "postgres_url=",
+    "postgresql_url=",
+    "postgres://",
+    "postgresql://",
     "secret=",
+    "supabase",
 ];
 const fullReplacementPatterns = [
     /\bghp_[A-Za-z0-9_]{20,}\b/g,
     /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,
+    /\bnapi_[A-Za-z0-9_-]{16,}\b/g,
+    /\bnpg_[A-Za-z0-9_-]{16,}\b/g,
     /\bsk-[A-Za-z0-9_-]{16,}\b/g,
+    /\bsb_(?:publishable|secret)_[A-Za-z0-9_-]{16,}\b/g,
+    /\bsbp_[A-Za-z0-9_-]{16,}\b/g,
+    /\bpostgres(?:ql)?:\/\/[^\s'"`<>]+/gi,
     /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}\b/gi,
     /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY-----/gi,
 ];
-const assignmentPattern = /\b([A-Za-z0-9_]*(?:token|api_key|password|secret)|key)\s*=\s*([^\s&;,'"`]+)/gi;
+const uuidPattern = /\b[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}\b/gi;
+const sensitiveKeyNamePattern = String.raw `[A-Za-z0-9_]*(?:token|api[_-]?key|apikey|password|secret|[_-]key|connection[_-]?string|database[_-]?url|db[_-]?url|postgres(?:ql)?[_-]?url)|key`;
+const unquotedAssignmentValuePattern = "[^\\s&;,'\"`}\\[\\]]+";
+const assignmentPattern = new RegExp(String.raw `\b(${sensitiveKeyNamePattern})\b(\s*=\s*)(["']?)(${unquotedAssignmentValuePattern})\3?`, "gi");
+const quotedAssignmentPattern = new RegExp(String.raw `(["'])(${sensitiveKeyNamePattern})\1(\s*:\s*)(["'])([^"']+)\4`, "gi");
 export function redactSecrets(text) {
-    if (!mightContainSecret(text))
-        return text;
-    const withoutWholeSecrets = fullReplacementPatterns.reduce((result, pattern) => result.replace(pattern, secretReplacement), text);
-    return withoutWholeSecrets.replace(assignmentPattern, (_match, key) => `${key}=${secretReplacement}`);
+    const withoutUuids = text.replace(uuidPattern, secretReplacement);
+    if (!mightContainSecret(withoutUuids))
+        return withoutUuids;
+    const withoutWholeSecrets = fullReplacementPatterns.reduce((result, pattern) => result.replace(pattern, secretReplacement), withoutUuids);
+    return withoutWholeSecrets
+        .replace(quotedAssignmentPattern, (_match, keyQuote, key, separator, valueQuote) => `${keyQuote}${key}${keyQuote}${separator}${valueQuote}${secretReplacement}${valueQuote}`)
+        .replace(assignmentPattern, (_match, key, separator, valueQuote) => `${key}${separator}${valueQuote}${secretReplacement}${valueQuote}`);
 }
 export function mightContainSecret(text) {
     if (literalIndicators.some((indicator) => text.includes(indicator)))

package/dist/sync/loop.js

@@ -1,6 +1,8 @@
 import { setTimeout as sleep } from "node:timers/promises";
 import { AuthRefreshError } from "../auth/tokens.js";
 import { readConfig, readState, writeState } from "../config/store.js";
+import { GitRepoResolver } from "../git/repoResolver.js";
+import { PARSER_VERSION } from "../parser/types.js";
 import { runPreflightV3, pushSyncPayload } from "./client.js";
 import { mapSessionsToPushItems } from "./map.js";
 import { scanSelectedSources } from "./scan.js";
@@ -8,7 +10,15 @@ export async function runSyncOnce() {
     let config = await readConfig();
     const state = await readState();
     config = await runPreflightV3(config);
-    const scan = await scanSelectedSources(config.selectedSources, state);
+    // A parser version bump reparses everything once and re-pushes conversation
+    // headers as field-masked merges so existing conversations pick up newly
+    // extracted metadata. The state only records the new version after a
+    // successful push, so a failed backfill retries on the next run.
+    const backfillParserChanges = state.parserVersion < PARSER_VERSION;
+    const scan = await scanSelectedSources(config.selectedSources, state, {
+        forceReparse: backfillParserChanges,
+    });
+    const repoResolver = new GitRepoResolver();
     const nodes = [];
     const edges = [];
     const previouslyPushedRoots = new Set(state.pushedSourceRootIds);
@@ -20,6 +30,8 @@ export async function runSyncOnce() {
         const mapped = mapSessionsToPushItems(source, sessions, {
             includeRoot,
             pushedSessions: state.pushedSessions,
+            repushHeaders: backfillParserChanges,
+            resolveRepo: (workspacePath) => repoResolver.resolve(workspacePath),
         });
         nodes.push(...mapped.nodes);
         edges.push(...mapped.edges);
@@ -34,6 +46,7 @@ export async function runSyncOnce() {
         ...scan.nextState,
         pushedSourceRootIds: [...pushedSourceRootIds].sort(),
         pushedSessions,
+        parserVersion: PARSER_VERSION,
         lastSyncAt: new Date().toISOString(),
     });
     return { nodes: nodes.length, edges: edges.length };

package/dist/sync/map.js

@@ -12,7 +12,11 @@ export function mapSessionsToPushItems(source, sessions, options = { includeRoot
             conversationPushed: false,
             pushedMessageCount: 0,
         };
-        if (!sessionCursor.conversationPushed) {
+        if (!sessionCursor.conversationPushed || options.repushHeaders === true) {
+            const repoInfo = session.cwd !== null ? options.resolveRepo?.(session.cwd) ?? null : null;
+            // Headers always push as a field-masked merge: new conversations insert
+            // normally, and re-pushed headers only touch the workspace metadata
+            // columns, never fields other clients own (name, labels, deletion).
             nodes.push({
                 node: {
                     id: conversationId,
@@ -20,6 +24,9 @@ export function mapSessionsToPushItems(source, sessions, options = { includeRoot
                     sourceId: session.sourceId,
                     name: redactSecrets(session.title),
                     kind: session.sourceKind === "codex" ? "codex_chat" : "claude_code_chat",
+                    workspacePath: session.cwd,
+                    repoRemoteUrl: repoInfo?.remoteUrl ?? null,
+                    repoKey: repoInfo?.repoKey ?? null,
                     originalCreatedAt: session.createdAt,
                     originalUpdatedAt: session.updatedAt,
                 },
@@ -27,7 +34,10 @@ export function mapSessionsToPushItems(source, sessions, options = { includeRoot
                 slices: [],
                 aiChatMessage: null,
                 nessieChatMessage: null,
+                mergeFields: ["workspacePath", "repoRemoteUrl", "repoKey"],
             });
+        }
+        if (!sessionCursor.conversationPushed) {
             edges.push(mapEdge(source.localId, conversationId, "source_of", 0));
         }
         const pushableMessages = session.messages.filter((message) => message.role !== "system");

package/dist/sync/scan.js

@@ -2,11 +2,12 @@ import { readdir, stat } from "node:fs/promises";
 import { join } from "node:path";
 import { parseClaudeCodeSession } from "../parser/claudeCode.js";
 import { parseCodexSession } from "../parser/codex.js";
-export async function scanSelectedSources(sources, state) {
+export async function scanSelectedSources(sources, state, options = {}) {
     const nextState = {
         files: { ...state.files },
         pushedSourceRootIds: [...state.pushedSourceRootIds],
         pushedSessions: { ...state.pushedSessions },
+        parserVersion: state.parserVersion,
         lastSyncAt: state.lastSyncAt,
     };
     const sessionsBySourceId = new Map();
@@ -15,7 +16,7 @@ export async function scanSelectedSources(sources, state) {
         const sessions = [];
         for (const file of files) {
             const cursor = await cursorForFile(file);
-            if (isUnchanged(state.files[file], cursor))
+            if (options.forceReparse !== true && isUnchanged(state.files[file], cursor))
                 continue;
             const session = source.kind === "codex" ? await parseCodexSession(file) : await parseClaudeCodeSession(file);
             nextState.files[file] = cursor;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nessielabs/daemon",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Headless Linux ingestion daemon for Nessie agent traces.",
   "license": "UNLICENSED",
   "type": "module",