@neta-art/cohub-cli 8.0.1 → 8.1.0

package/README.md

@@ -85,26 +85,21 @@ COHUB_SPACE_ID=<spaceId> cohub spaces prompt "message" --json
 Connect one local workspace to a Space and select Pi or Codex per turn.
 
 To keep using native terminals with ordinary Cohub Chats / Turns:
-使用原生终端，并同步到普通 Cohub Chat / Turn：
 
 ```bash
 cohub runtime up -d --harness pi --harness codex
-cohub runtime attach --harness pi --harness codex
-# Reload Pi / restart Codex and approve its hook trust prompt.
-# 重载 Pi / 重启 Codex，并审核 Hook 信任提示。
-cohub runtime detach --harness pi --harness codex # Pause; retain data / 暂停，保留数据
+# Answer the native sync consent (default yes), then reload Pi / restart Codex
+# and approve its hook trust prompt.
+cohub runtime detach --harness pi --harness codex # Pause; retain data
 ```
 
-`attach` explicitly authorizes this project's opened conversation history and raw native archives.
-The Runtime Supervisor is the single local Daemon: Pi / Codex integrations use its private IPC,
+`up` installs native sync by default after one explicit consent (default yes); declining or a
+capability failure keeps the Runtime running without it, and `up` is idempotent. The Runtime
+Supervisor is the single local Daemon: Pi / Codex integrations use its private IPC,
 while native Turn events use the existing Runtime WebSocket. Configuration is backed up, existing
 Runtime bindings are reused, and competing continuations fork at complete Turns without blocking native work. Requires Pi 0.85.1+ or Codex with stable
 Hooks enabled. User-level integrations remain inert outside opted-in directories. See
-[boundaries and privacy](../../docs/local-runtime.md#native-clients--原生客户端).
-
-`attach` 明确授权上传当前项目打开的对话历史与原生归档；复用现有绑定，配置修改前备份。
-冲突时按完整 Turn 分支，不阻塞本地执行。用户级集成在未授权目录中不会采集数据。
-
+[boundaries and privacy](../../docs/local-runtime.md#native-clients).
 
 ```bash
 cohub runtime up ./project --harness pi --harness codex
@@ -142,10 +137,6 @@ local process and remote component status. `down` retains all data and requires
 when executions remain unconfirmed. `logs --level warn --follow` shows sensitive events;
 foreground startup prints these automatically. Runtime commands never fall back to Home.
 
-普通使用只需 `cohub runtime up`，首次提示新建，后续优先复用。`-n` 是 `--new` 的简写，
-`--name` 单独指定名称。`-d` 后台运行并返回链接、PID 和日志位置；`down` 停止但保留所有数据。
-断网及临时凭证错误自动重试；断连不代表任务已停止，也不会自动重跑工具。
-
 ## Chats and prompts
 
 Use `spaces prompt` for immediate sends, delayed sends, one-time schedules, recurring schedules, new Chats, and existing Chats.

package/dist/commands/runtime.js

@@ -1,14 +1,15 @@
 import { setTimeout as delay } from "node:timers/promises";
-import { createInterface } from "node:readline/promises";
 import { createClient } from "../client.js";
 import { json as outJson, jsonRequested } from "../output.js";
 import { currentIdentityKey } from "../space.js";
 import { resolveRuntimeTarget, runtimeUp, parseRuntimeHarnesses } from "../runtime/launch.js";
 import { canonicalRuntimeRoot, getRuntimeSpaceBinding } from "../runtime/space-binding.js";
 import { installNativeSync } from "../runtime/native-install.js";
+import { discoverNativeImportCandidates, nativeRuntimeRoot, readNativeSyncConfig } from "../runtime/native-sync.js";
 import { listNativeSyncStores } from "../runtime/native-sync-store.js";
+import { requestNativeDaemon } from "../runtime/native-ipc.js";
 import { requestRuntimeInstance, runtimeInstanceDirectory } from "../runtime/instance.js";
-import { atLeastLevel, diagnosticLevels, formatDiagnostic, printRuntimeSummary } from "../runtime/presentation.js";
+import { atLeastLevel, diagnosticLevels, formatDiagnostic, formatNativeSync, printRuntimeSummary } from "../runtime/presentation.js";
 import { RuntimeSessionStore } from "../runtime/session-store.js";
 import { readRuntimeDiagnosticEvents, RuntimeDiagnosticReader, runtimeDiagnosticsDirectory, serializeDiagnosticError } from "../runtime/diagnostics.js";
 export { resolveLocalSpaceName, parseRuntimeHarnesses } from "../runtime/launch.js";
@@ -27,7 +28,7 @@ export function registerRuntime(program) {
         .option("--harness <name>", "Pi or Codex; repeatable", (value, previous) => [...previous, value], [])
         .option("--pi <path>", "Pi executable")
         .option("--codex <path>", "Codex executable")
-        .option("-y, --yes", "Accept defaults and authorize local execution")
+        .option("-y, --yes", "Accept defaults and authorize local execution and native sync")
         .option("--verbose", "Show diagnostic details")
         .option("--json", "JSON output")
         .action(async (dir, options) => {
@@ -38,57 +39,158 @@ export function registerRuntime(program) {
             reportFailure(cause);
         }
     });
-    for (const action of ["attach", "detach"])
-        runtime.command(action)
-            .description(action === "attach" ? "Sync native Pi / Codex Turns" : "Pause native sync; retain all receipts")
-            .option("-s, --space <id>", "Target Space")
-            .option("--harness <name>", "Pi or Codex; repeatable", (value, previous) => [...previous, value], [])
-            .option("--pi <path>", "Pi executable for capability checks")
-            .option("--codex <path>", "Codex executable for capability checks")
-            .option("-y, --yes", "Authorize project conversation and native archive uploads")
-            .option("--json", "JSON output")
-            .action(async (options) => {
-            try {
-                const spaceId = await resolveRuntimeTarget(program, options.space);
-                const identity = currentIdentityKey();
-                if (!identity)
-                    throw new Error("Sign in first");
-                const root = await canonicalRuntimeRoot(process.cwd());
-                if (action === "attach" && (await getRuntimeSpaceBinding(root, identity))?.spaceId !== spaceId)
-                    throw new Error("Bind this directory with runtime up --space first");
-                const instance = await requestRuntimeInstance(runtimeInstanceDirectory(identity, spaceId));
-                if (action === "attach" && (!instance || instance.root !== root))
-                    throw new Error("Start this directory's Runtime first: cohub runtime up -d");
-                if (action === "attach" && !instance?.nativeSync)
-                    throw new Error("Restart the Runtime with this CLI before attaching");
-                const harnesses = parseRuntimeHarnesses(options.harness.length ? options.harness : instance?.harnesses ?? ["pi", "codex"]);
-                if (action === "attach" && harnesses.some((harness) => !instance?.harnesses.includes(harness)))
-                    throw new Error("Enable these Harnesses with runtime up first");
-                if (action === "attach" && !options.yes) {
-                    if (!process.stdin.isTTY)
-                        throw new Error("Use --yes to authorize native sync");
-                    const rl = createInterface({ input: process.stdin, output: process.stderr });
-                    try {
-                        const answer = await rl.question(`Install user-level ${harnesses.join(" / ")} integration and upload this project's opened conversations, tool output and raw archives to this Space? History may contain secrets. [y/N] `);
-                        if (!/^y(es)?$/i.test(answer.trim()))
-                            return;
-                    }
-                    finally {
-                        rl.close();
-                    }
-                }
-                const result = await installNativeSync({ root, spaceId, identity, harnesses, disabled: action === "detach", executables: { pi: options.pi, codex: options.codex } });
+    runtime.command("detach")
+        .description("Pause native sync; retain all receipts")
+        .option("-s, --space <id>", "Target Space")
+        .option("--harness <name>", "Pi or Codex; repeatable", (value, previous) => [...previous, value], [])
+        .option("--json", "JSON output")
+        .action(async (options) => {
+        try {
+            const spaceId = await resolveRuntimeTarget(program, options.space);
+            const identity = currentIdentityKey();
+            if (!identity)
+                throw new Error("Sign in first");
+            const root = await canonicalRuntimeRoot(process.cwd());
+            if ((await getRuntimeSpaceBinding(root, identity))?.spaceId !== spaceId)
+                throw new Error("Bind this directory with runtime up first");
+            const instance = await requestRuntimeInstance(runtimeInstanceDirectory(identity, spaceId));
+            const harnesses = parseRuntimeHarnesses(options.harness.length ? options.harness : instance?.harnesses ?? ["pi", "codex"]);
+            const result = await installNativeSync({ root, spaceId, identity, harnesses, disabled: true });
+            if (jsonRequested(options))
+                outJson({ ...result, enabled: false });
+            else
+                process.stdout.write("Native sync paused; all local records retained\n");
+        }
+        catch (cause) {
+            reportFailure(cause);
+        }
+    });
+    runtime.command("import [dir]")
+        .description("Import local conversations")
+        .option("-s, --space <id>", "Target Space")
+        .option("--harness <name>", "Filter by harness; repeatable", (value, previous) => [...previous, value], [])
+        .option("--session <id>", "Filter by native session ID")
+        .option("--dry-run", "Preview without importing")
+        .option("-y, --yes", "Skip confirmation")
+        .option("--json", "Output as JSON")
+        .action(async (dir, options) => {
+        const controller = new AbortController();
+        const stop = () => controller.abort();
+        process.once("SIGINT", stop);
+        process.once("SIGTERM", stop);
+        try {
+            const identity = currentIdentityKey();
+            if (!identity)
+                throw new Error("Sign in first");
+            const root = await canonicalRuntimeRoot(dir ?? process.cwd());
+            const spaceId = await resolveRuntimeTarget(program, options.space);
+            const binding = await getRuntimeSpaceBinding(root, identity);
+            if (!binding || binding.spaceId !== spaceId)
+                throw new Error("Bind this directory with runtime up first");
+            const local = await requestRuntimeInstance(runtimeInstanceDirectory(identity, spaceId));
+            if (!local)
+                throw new Error("Local Runtime is not running");
+            const config = await readNativeSyncConfig(nativeRuntimeRoot(spaceId), identity);
+            if (!config || config.root !== root)
+                throw new Error("Native sync is not enabled for this directory");
+            const harnesses = parseRuntimeHarnesses(options.harness.length ? options.harness : config.harnesses);
+            let lastProgress = 0;
+            const discovered = await discoverNativeImportCandidates(root, harnesses, {
+                signal: controller.signal,
+                onProgress: ({ harness, scanned, candidates: found }) => {
+                    if (jsonRequested(options) || scanned - lastProgress < 25)
+                        return;
+                    lastProgress = scanned;
+                    process.stderr.write(`Scanned ${scanned} ${harness} transcript${scanned === 1 ? "" : "s"}; found ${found}\n`);
+                },
+            });
+            const candidates = discovered.candidates.filter((candidate) => !options.session || candidate.nativeSessionId === options.session);
+            const result = {
+                spaceId, root, harnesses, candidates, errors: discovered.errors,
+                imported: 0, failed: [], dryRun: Boolean(options.dryRun),
+                complete: discovered.errors.length === 0,
+            };
+            if (jsonRequested(options) && options.dryRun) {
+                result.complete = result.complete && result.failed.length === 0;
+                outJson(result);
+                if (!result.complete)
+                    process.exitCode = 1;
+                return;
+            }
+            if (!candidates.length) {
+                if (!result.complete)
+                    process.exitCode = 1;
                 if (jsonRequested(options))
                     outJson(result);
                 else
-                    process.stdout.write(action === "attach"
-                        ? `Native sync enabled. Reload Pi or restart Codex and review its hook trust prompt.\n${result.configPath}\n`
-                        : "Native sync paused; all local records retained\n");
+                    process.stdout.write("No existing native conversations found\n");
+                return;
+            }
+            if (options.dryRun) {
+                if (jsonRequested(options))
+                    outJson(result);
+                else {
+                    process.stdout.write(`Found ${candidates.length} native conversation${candidates.length === 1 ? "" : "s"}\n`);
+                    for (const candidate of candidates)
+                        process.stdout.write(`  ${candidate.harness} ${candidate.nativeSessionId} ${candidate.turnCount} Turn${candidate.turnCount === 1 ? "" : "s"} ${candidate.path}\n`);
+                    for (const error of discovered.errors)
+                        process.stdout.write(`Skipped ${error.path}: ${error.message}\n`);
+                }
+                if (!result.complete)
+                    process.exitCode = 1;
+                return;
+            }
+            if (!options.yes) {
+                if (!process.stdin.isTTY)
+                    throw new Error("Use --yes in non-interactive mode");
+                const { createInterface } = await import("node:readline/promises");
+                const rl = createInterface({ input: process.stdin, output: process.stderr });
+                try {
+                    const answer = await rl.question(`Import ${candidates.length} native conversation${candidates.length === 1 ? "" : "s"} to Space ${spaceId}? [Y/n] `);
+                    if (!/^(|y(es)?)$/i.test(answer.trim())) {
+                        if (jsonRequested(options))
+                            outJson({ ...result, cancelled: true });
+                        else
+                            process.stdout.write("Import cancelled\n");
+                        return;
+                    }
+                }
+                finally {
+                    rl.close();
+                }
+            }
+            for (const candidate of candidates) {
+                try {
+                    const response = await requestNativeDaemon({ harness: candidate.harness, cwd: root, path: candidate.path, nativeSessionId: candidate.nativeSessionId,
+                        sessionStartedAt: candidate.sessionStartedAt, origin: "local_import", settled: true });
+                    if (!response.ok)
+                        throw new Error(response.message);
+                    result.imported += 1;
+                }
+                catch (error) {
+                    result.failed.push({ path: candidate.path, message: error instanceof Error ? error.message : String(error) });
+                }
             }
-            catch (cause) {
-                reportFailure(cause);
+            result.complete = result.complete && result.failed.length === 0;
+            if (jsonRequested(options))
+                outJson(result);
+            else {
+                process.stdout.write(`Imported ${result.imported}/${candidates.length} native conversation${candidates.length === 1 ? "" : "s"}\n`);
+                for (const error of [...discovered.errors, ...result.failed])
+                    process.stdout.write(`Skipped ${error.path}: ${error.message}\n`);
+                process.stdout.write("Uploads continue in the local Runtime background\n");
             }
-        });
+            if (!result.complete)
+                process.exitCode = 1;
+        }
+        catch (cause) {
+            reportFailure(cause);
+        }
+        finally {
+            process.removeListener("SIGINT", stop);
+            process.removeListener("SIGTERM", stop);
+        }
+    });
     runtime.command("status").description("Local and server status")
         .option("-s, --space <id>", "Target Space")
         .option("--json", "JSON output")
@@ -105,7 +207,9 @@ export function registerRuntime(program) {
                 identity ? listNativeSyncStores(store.root, spaceId, identity) : [],
             ]);
             const nativeSessions = await Promise.all(nativeStores.map((native) => native.status()));
-            const result = { ...remote.value, spaceId, local, remote: remote.value, remoteError: remote.error, diagnosticsPath: runtimeDiagnosticsDirectory(store.root), pendingLocalArchives, failedLocalArchives, nativeSessions };
+            // A corrupt native sync config must never take down the whole status report.
+            const nativeSync = identity ? await readNativeSyncConfig(store.root, identity).then((config) => ({ config, error: null }), (error) => ({ config: null, error: serializeDiagnosticError(error).message })) : { config: null, error: null };
+            const result = { ...remote.value, spaceId, local, remote: remote.value, remoteError: remote.error, diagnosticsPath: runtimeDiagnosticsDirectory(store.root), pendingLocalArchives, failedLocalArchives, nativeSync: nativeSync.config, nativeSyncError: nativeSync.error, nativeSessions };
             if (jsonRequested(options))
                 outJson(result);
             else {
@@ -114,8 +218,7 @@ export function registerRuntime(program) {
                 else
                     process.stdout.write(`Local process  Not running\nSpace  ${spaceId}\nLogs  ${result.diagnosticsPath}\n`);
                 process.stdout.write(`Server  ${remote.error ? `Unknown — ${remote.error}` : remote.value?.online ? "Harness connected" : "Offline"}\nArchives  ${pendingLocalArchives} pending · ${failedLocalArchives} failed\n`);
-                if (nativeSessions.length)
-                    process.stdout.write(`Native chats  ${nativeSessions.length} · ${nativeSessions.reduce((sum, session) => sum + session.pendingTurns, 0)} Turns pending · ${nativeSessions.reduce((sum, session) => sum + session.pendingArchives, 0)} archives pending\n`);
+                process.stdout.write(formatNativeSync(nativeSync.config, nativeSessions, nativeSync.error));
             }
         }
         catch (cause) {

package/dist/commands/sandboxd-binary.d.ts

@@ -1,4 +1,4 @@
-export declare const SANDBOXD_VERSION = "v2.54.1";
+export declare const SANDBOXD_VERSION = "v2.55.0";
 export declare class SandboxdDownloadError extends Error {
     name: string;
 }

package/dist/commands/sandboxd-binary.js

@@ -25,9 +25,10 @@ import { Readable } from "node:stream";
 // v2.54.1 keeps the same wire protocol and adds relay diagnostics: data-channel
 // pairing outlives the runner's dial timeout, dial failures distinguish a
 // timeout from an explicit rejection, and teardown-time websocket write
-// failures log at debug instead of warn. No new capability is required, so this
-// pin is a diagnostics upgrade only.
-export const SANDBOXD_VERSION = "v2.54.1";
+// failures log at debug instead of warn. v2.55.0 republishes that compatible
+// runner alongside the matching platform release; no new runner capability is
+// required.
+export const SANDBOXD_VERSION = "v2.55.0";
 const BINARY_NAME = "cohub-sandboxd";
 // Public CDN prefix hosting the release archives (the repo is private, so the
 // GitHub Release assets are not publicly downloadable). Overridable for staging

package/dist/runtime/diagnostics.js

@@ -21,6 +21,12 @@ function isRecord(value) {
 function redactUrl(value) {
     try {
         const url = new URL(value);
+        // Redaction must not rewrite the string when there is nothing to hide;
+        // URL.toString() re-encodes (e.g. quotes from wrapped log lines) and
+        // makes healthy URLs look corrupted.
+        const sensitive = [...url.searchParams.keys()].some((key) => SENSITIVE_KEY.test(key));
+        if (!sensitive)
+            return value;
         for (const key of [...url.searchParams.keys()]) {
             if (SENSITIVE_KEY.test(key))
                 url.searchParams.set(key, "[REDACTED]");
@@ -37,7 +43,8 @@ export function redactDiagnosticString(value) {
         : value;
     return shortened
         .replace(/\bBearer\s+[^\s,;]+/gi, "Bearer [REDACTED]")
-        .replace(/\b(rediss?|https?|wss?):\/\/[^\s]+/gi, (url) => redactUrl(url))
+        // Trailing quotes/brackets from wrapped log lines are not part of the URL.
+        .replace(/\b(rediss?|https?|wss?):\/\/[^\s"'<>]+/gi, (url) => redactUrl(url))
         .replace(/\b(authorization|password|secret|token|access[_-]?key|refresh[_-]?token)([\s:=]+)([^\s,;]+)/gi, "$1$2[REDACTED]");
 }
 function redactValue(value, seen = new WeakSet(), depth = 0) {

package/dist/runtime/launch.js

@@ -10,6 +10,7 @@ import { createClient } from "../client.js";
 import { currentIdentityKey, explicitSpace } from "../space.js";
 import { canonicalRuntimeRoot, getRuntimeSpaceBinding, resolveRuntimeSpace } from "./space-binding.js";
 import { requestRuntimeInstance, runtimeInstanceDirectory } from "./instance.js";
+import { ensureNativeSync } from "./native-attach.js";
 import { createDiagnosticConsole, printRuntimeSummary, runtimeWebUrl } from "./presentation.js";
 import { runRuntime } from "./supervisor.js";
 export const resolveLocalSpaceName = (root, name) => name?.trim() || basename(root) || "local-space";
@@ -90,6 +91,9 @@ export async function runtimeUp(program, dir, options) {
             if (existing.root !== root || options.harness.length && [...existing.harnesses].sort().join() !== [...harnesses].sort().join() || options.pi || options.codex) {
                 throw new Error("Runtime is running with a different configuration. Use down first");
             }
+            // `up` is the single idempotent entry: a reused instance adopts its running
+            // Harnesses (unless explicitly overridden) and completes native sync setup.
+            await ensureNativeSync({ root, spaceId: existing.spaceId, identity, harnesses: options.harness.length ? harnesses : parseRuntimeHarnesses(existing.harnesses), yes: options.yes, executables: { pi: options.pi, codex: options.codex } });
             printRuntimeSummary(existing, options.json, true);
             return;
         }
@@ -122,8 +126,8 @@ export async function runtimeUp(program, dir, options) {
             if (!requested && (!binding || createNew))
                 name = (await rl.question(`Space name [${name}]: `)).trim() || name;
             process.stderr.write(`\nDirectory  ${root}\n${requested ? `Space  ${runtimeWebUrl(requested)}\n` : ""}`);
-            const answer = await rl.question("Collaborators can execute as your OS user, beyond this folder. Allow? [y/N] ");
-            if (!/^y(es)?$/i.test(answer.trim()))
+            const answer = await rl.question("Collaborators can execute as your OS user, beyond this folder. Allow? [Y/n] ");
+            if (/^n(o)?$/i.test(answer.trim()))
                 return;
         }
         finally {
@@ -148,6 +152,8 @@ export async function runtimeUp(program, dir, options) {
                 throw new Error("Space does not have a local Runtime");
         },
     });
+    // Consent (or --yes) precedes any user-level integration install; failure never blocks startup.
+    await ensureNativeSync({ root, spaceId, identity, harnesses, yes: options.yes, executables: { pi: options.pi, codex: options.codex } });
     const config = { spaceId, root, identity, harnesses, capabilities, executables: { pi: options.pi, codex: options.codex }, background: Boolean(options.detach), verbose: options.verbose };
     const existing = await requestRuntimeInstance(runtimeInstanceDirectory(identity, spaceId));
     if (existing) {

package/dist/runtime/native-attach.d.ts

@@ -0,0 +1,28 @@
+import { type NativeSyncConfig } from "./native-sync.js";
+type Harness = "pi" | "codex";
+export type NativeSyncReport = {
+    enabled: boolean;
+    harnesses: Harness[];
+    note?: string;
+};
+/** Already enabled for this exact directory and every requested Harness: installation is idempotent. */
+export declare function nativeSyncSatisfied(config: NativeSyncConfig | null, input: {
+    spaceId: string;
+    root: string;
+    harnesses: Harness[];
+}): boolean;
+/** One explicit consent prompt, defaulting to yes; native history may contain secrets. */
+export declare function askNativeSyncConsent(harnesses: Harness[], ask?: (question: string) => Promise<string>): Promise<boolean>;
+/** Enable native sync after consent; capability or write failures warn and never block the Runtime. */
+export declare function ensureNativeSync(input: {
+    root: string;
+    spaceId: string;
+    identity: string;
+    harnesses: Harness[];
+    yes?: boolean;
+    executables?: {
+        pi?: string;
+        codex?: string;
+    };
+}, log?: (line: string) => void): Promise<NativeSyncReport>;
+export {};

package/dist/runtime/native-attach.js

@@ -0,0 +1,47 @@
+import { createInterface } from "node:readline/promises";
+import { installNativeSync } from "./native-install.js";
+import { nativeRuntimeRoot, readNativeSyncConfig } from "./native-sync.js";
+import { serializeDiagnosticError } from "./diagnostics.js";
+/** Already enabled for this exact directory and every requested Harness: installation is idempotent. */
+export function nativeSyncSatisfied(config, input) {
+    return Boolean(config && config.spaceId === input.spaceId && config.root === input.root && input.harnesses.every((harness) => config.harnesses.includes(harness)));
+}
+/** One explicit consent prompt, defaulting to yes; native history may contain secrets. */
+export async function askNativeSyncConsent(harnesses, ask = defaultAsk) {
+    const answer = await ask(`Sync native ${harnesses.join(" / ")} chats in this folder and upload their history (may contain secrets) to this Space? [Y/n] `);
+    return /^(|y(es)?)$/i.test(answer.trim());
+}
+async function defaultAsk(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        return await rl.question(question);
+    }
+    finally {
+        rl.close();
+    }
+}
+/** Enable native sync after consent; capability or write failures warn and never block the Runtime. */
+export async function ensureNativeSync(input, log = (line) => process.stderr.write(line)) {
+    const config = await readNativeSyncConfig(nativeRuntimeRoot(input.spaceId), input.identity).catch(() => null);
+    if (nativeSyncSatisfied(config, input))
+        return { enabled: true, harnesses: config?.harnesses ?? [] };
+    if (!input.yes) {
+        // Non-interactive sessions cannot consent; they continue without sync instead of failing `up`.
+        if (!process.stdin.isTTY) {
+            log("Native sync off · rerun interactively or with --yes to enable\n");
+            return { enabled: false, harnesses: input.harnesses, note: "non-interactive" };
+        }
+        if (!await askNativeSyncConsent(input.harnesses))
+            return { enabled: false, harnesses: input.harnesses, note: "declined" };
+    }
+    try {
+        const result = await installNativeSync(input);
+        log(`Native sync enabled. Reload Pi or restart Codex and review its hook trust prompt.\n${result.configPath}`);
+        return { enabled: true, harnesses: result.harnesses };
+    }
+    catch (error) {
+        const message = serializeDiagnosticError(error).message;
+        log(`Native sync unavailable; Runtime continues without it — ${message}\n`);
+        return { enabled: false, harnesses: input.harnesses, note: message };
+    }
+}

package/dist/runtime/native-ipc.d.ts

@@ -7,6 +7,8 @@ type NativeIpcRequest = {
     nativeSessionId: string;
     settled?: boolean;
     leafId?: string | null;
+    sessionStartedAt?: string;
+    origin?: "local_import";
 };
 type NativeIpcResponse = {
     ok: true;

package/dist/runtime/native-ipc.js

@@ -9,7 +9,9 @@ const socketPath = (runtimeRoot) => join(runtimeRoot, "native", "daemon.sock");
 const parse = (raw) => {
     const value = JSON.parse(raw);
     if (value?.type !== "native.capture" || !["pi", "codex"].includes(value.harness)
-        || typeof value.cwd !== "string" || typeof value.path !== "string" || typeof value.nativeSessionId !== "string") {
+        || typeof value.cwd !== "string" || typeof value.path !== "string" || typeof value.nativeSessionId !== "string"
+        || value.origin !== undefined && value.origin !== "local_import"
+        || value.sessionStartedAt !== undefined && typeof value.sessionStartedAt !== "string") {
         throw new Error("Invalid native daemon request");
     }
     return value;

package/dist/runtime/native-sync-store.d.ts

@@ -32,6 +32,8 @@ export type NativeTurnReceipt = {
     endBytes: number;
     contentEndBytes?: number;
     result: NativeTurnComplete | null;
+    sessionStartedAt?: string;
+    origin?: "local_import";
     progress?: NativeTurnProgress;
 };
 export type NativeSyncTransport = ArchiveTransport & {
@@ -81,7 +83,10 @@ export declare class NativeSyncStore {
     private cloudBindingPath;
     binding(): Promise<NativeBinding>;
     private initialize;
-    capture(path: string, transcript: NativeTranscript): Promise<void>;
+    capture(path: string, transcript: NativeTranscript, context?: {
+        sessionStartedAt?: string;
+        origin?: "local_import";
+    }): Promise<void>;
     receipts(pendingOnly?: boolean): Promise<NativeTurnReceipt[]>;
     status(): Promise<{
         harness: "codex" | "pi";

package/dist/runtime/native-sync-store.js

@@ -112,7 +112,7 @@ export class NativeSyncStore {
         await atomicRuntimeJson(this.bindingPath(), binding);
         return binding;
     }
-    async capture(path, transcript) {
+    async capture(path, transcript, context = {}) {
         if (transcript.nativeSessionId !== this.options.nativeSessionId)
             throw new Error("Native session identity mismatch");
         await withRuntimeSpaceBindingsLock(async () => {
@@ -156,6 +156,8 @@ export class NativeSyncStore {
                 const result = turn.result ? nativeTurnCompleteSchema.parse(turn.result) : null;
                 const receipt = { version: 1, turnId, key: turn.key, parentKey, parentCloudTurnId: parentKey ? null : parentCloudTurnId,
                     userContent: turn.userContent, startedAt: turn.startedAt, endBytes: turn.endBytes, contentEndBytes: turn.contentEndBytes, result,
+                    ...(context.sessionStartedAt ? { sessionStartedAt: context.sessionStartedAt } : {}),
+                    ...(context.origin ? { origin: context.origin } : {}),
                     ...(!result ? { progress: nativeTurnProgressSchema.parse({ revision: turn.endBytes, messages: turn.messages }) } : {}) };
                 if (old && (JSON.stringify(old.userContent) !== JSON.stringify(receipt.userContent) || old.parentKey !== receipt.parentKey))
                     throw new Error("Native Turn changed; original receipt retained");
@@ -238,7 +240,8 @@ export class NativeSyncStore {
                 let request = await readJson(this.requestPath(receipt.turnId));
                 if (!request) {
                     request = nativeTurnStartSchema.parse({ turnId: receipt.turnId, sessionId: parent?.sessionId ?? binding.sessionId, parentTurnId: parent?.turnId ?? receipt.parentCloudTurnId,
-                        branchSessionId: nativeStableId(`${receipt.turnId}:branch`), harness: binding.harness, nativeSessionId: binding.nativeSessionId, userContent: receipt.userContent, startedAt: receipt.startedAt });
+                        branchSessionId: nativeStableId(`${receipt.turnId}:branch`), harness: binding.harness, nativeSessionId: binding.nativeSessionId, userContent: receipt.userContent, startedAt: receipt.startedAt,
+                        ...(receipt.sessionStartedAt ? { sessionStartedAt: receipt.sessionStartedAt } : {}), ...(receipt.origin ? { origin: receipt.origin } : {}) });
                     await atomicRuntimeJson(this.requestPath(receipt.turnId), request);
                 }
                 let remote = await readJson(this.cloudBindingPath(receipt.turnId));

package/dist/runtime/native-sync.d.ts

@@ -9,6 +9,29 @@ export type NativeSyncConfig = {
 };
 export declare const nativeRuntimeRoot: (spaceId: string) => string;
 export declare const nativeSyncConfigPath: (runtimeRoot: string, identity: string) => string;
+export type NativeImportCandidate = {
+    harness: "pi" | "codex";
+    path: string;
+    nativeSessionId: string;
+    turnCount: number;
+    sessionStartedAt: string | undefined;
+};
+/** Find existing native transcripts for exactly one bound project. */
+export declare function discoverNativeImportCandidates(root: string, harnesses: ("pi" | "codex")[], options?: {
+    signal?: AbortSignal;
+    onProgress?: (progress: {
+        harness: "pi" | "codex";
+        scanned: number;
+        candidates: number;
+    }) => void;
+}): Promise<{
+    candidates: NativeImportCandidate[];
+    errors: {
+        harness: "pi" | "codex";
+        path: string;
+        message: string;
+    }[];
+}>;
 export declare function nativeArchiveTransport(spaceId: string, identity: string): Pick<NativeSyncTransport, "prepareRuntimeArchive" | "commitRuntimeArchive" | "getRuntimeArchive">;
 export declare function readNativeSyncConfig(runtimeRoot: string, identity: string): Promise<NativeSyncConfig | null>;
 /** Local capture only. Neither Pi callbacks nor Codex hooks wait for Cohub's network. */
@@ -19,6 +42,8 @@ export declare function captureNativeSession(input: {
     nativeSessionId?: string;
     settled?: boolean;
     leafId?: string | null;
+    sessionStartedAt?: string;
+    origin?: "local_import";
 }): Promise<NativeSyncStore | null>;
 /** The existing Runtime supervisor retries receipts even after the original terminal has exited. */
 export declare function nativeWebSocketTransport(spaceId: string, identity: string, send: (event: NativeRuntimeEvent) => Promise<unknown>): NativeSyncTransport;

package/dist/runtime/native-sync.js

@@ -1,14 +1,95 @@
-import { readFile } from "node:fs/promises";
+import { readFile, readdir, stat } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { createClient } from "../client.js";
 import { currentIdentityKey } from "../space.js";
 import { canonicalRuntimeRoot, getRuntimeSpaceBinding } from "./space-binding.js";
-import { readNativeTranscript } from "./native-transcript.js";
+import { readNativeTranscript, readNativeTranscriptHeader } from "./native-transcript.js";
 import { findRuntimeNativeSession } from "./session-store.js";
 import { listNativeSyncStores, nativeIdentityHash, NativeSyncStore } from "./native-sync-store.js";
 export const nativeRuntimeRoot = (spaceId) => join(homedir(), ".local", "state", "cohub", "runtime", spaceId);
 export const nativeSyncConfigPath = (runtimeRoot, identity) => join(runtimeRoot, "native", nativeIdentityHash(identity), "config.json");
+const piSessionDirectory = (cwd) => {
+    const custom = process.env.PI_CODING_AGENT_SESSION_DIR?.trim();
+    if (custom)
+        return custom;
+    const agentDir = process.env.PI_CODING_AGENT_DIR?.trim() || join(homedir(), ".pi", "agent");
+    const safePath = `--${cwd.replace(/^[/\\\\]/, "").replace(/[/\\\\:]/g, "-")}--`;
+    return join(agentDir, "sessions", safePath);
+};
+const codexSessionDirectory = () => join(process.env.CODEX_HOME?.trim() || join(homedir(), ".codex"), "sessions");
+const LARGE_TRANSCRIPT_BYTES = 64 * 1024 * 1024;
+async function nativeTranscriptPaths(root, harness, signal) {
+    const pending = [harness === "pi" ? piSessionDirectory(root) : codexSessionDirectory()];
+    const paths = [];
+    const errors = [];
+    while (pending.length) {
+        signal?.throwIfAborted();
+        const directory = pending.pop();
+        if (!directory)
+            continue;
+        const entries = await readdir(directory, { withFileTypes: true }).catch((error) => {
+            if (error.code === "ENOENT")
+                return [];
+            errors.push({ harness, path: directory, message: error instanceof Error ? error.message : String(error) });
+            return [];
+        });
+        for (const entry of entries) {
+            const path = join(directory, entry.name);
+            if (entry.isDirectory())
+                pending.push(path);
+            else if (entry.isFile() && entry.name.endsWith(".jsonl"))
+                paths.push(path);
+        }
+    }
+    return { paths, errors };
+}
+/** Find existing native transcripts for exactly one bound project. */
+export async function discoverNativeImportCandidates(root, harnesses, options = {}) {
+    const candidates = [];
+    const errors = [];
+    for (const harness of harnesses) {
+        options.signal?.throwIfAborted();
+        const scanned = await nativeTranscriptPaths(root, harness, options.signal);
+        errors.push(...scanned.errors);
+        let start = 0;
+        while (start < scanned.paths.length) {
+            options.signal?.throwIfAborted();
+            const paths = scanned.paths.slice(start, start + 2);
+            const sizes = await Promise.all(paths.map((path) => stat(path).then((value) => value.size).catch(() => 0)));
+            const concurrency = sizes.some((size) => size > LARGE_TRANSCRIPT_BYTES) ? 1 : 2;
+            const batch = await Promise.all(paths.slice(0, concurrency).map(async (path) => {
+                try {
+                    const header = await readNativeTranscriptHeader(path, harness, options.signal);
+                    if (await canonicalRuntimeRoot(header.cwd) !== root)
+                        return null;
+                    const transcript = await readNativeTranscript(path, harness, { settled: true, signal: options.signal });
+                    if (transcript.turns.length === 0)
+                        return { error: { harness, path, message: "Transcript contains no importable Turns" } };
+                    return { harness, path, nativeSessionId: transcript.nativeSessionId, turnCount: transcript.turns.length,
+                        sessionStartedAt: transcript.turns.map((turn) => turn.startedAt).sort()[0] };
+                }
+                catch (error) {
+                    return { error: { harness, path, message: error instanceof Error ? error.message : String(error) } };
+                }
+            }));
+            for (const result of batch) {
+                options.signal?.throwIfAborted();
+                if (!result)
+                    continue;
+                if ("error" in result) {
+                    if (result.error)
+                        errors.push(result.error);
+                }
+                else
+                    candidates.push(result);
+                options.onProgress?.({ harness, scanned: start + batch.length, candidates: candidates.length });
+            }
+            start += concurrency;
+        }
+    }
+    return { candidates, errors };
+}
 export function nativeArchiveTransport(spaceId, identity) {
     const client = createClient().space(spaceId);
     const guard = async (task) => {
@@ -83,7 +164,7 @@ export async function captureNativeSession(input) {
             nativeStores.delete(nativeStores.keys().next().value ?? "");
         nativeStores.set(key, store);
     }
-    await store.capture(path, transcript);
+    await store.capture(path, transcript, { sessionStartedAt: input.sessionStartedAt, origin: input.origin });
     return store;
 }
 /** The existing Runtime supervisor retries receipts even after the original terminal has exited. */

package/dist/runtime/native-transcript.d.ts

@@ -20,8 +20,16 @@ export type NativeTranscript = {
     turns: NativeTranscriptTurn[];
     prefixes: ReadonlyMap<number, string>;
 };
+export declare const NATIVE_MAX_RECORD_BYTES: number;
+export declare const NATIVE_MAX_TRANSCRIPT_BYTES: number;
+/** Read only the session header before deciding whether a global Codex file belongs to this project. */
+export declare function readNativeTranscriptHeader(path: string, harness: "pi" | "codex", signal?: AbortSignal): Promise<{
+    nativeSessionId: string;
+    cwd: string;
+}>;
 /** Partial trailing records are retried, never parsed or acknowledged as complete. */
 export declare function readNativeTranscript(path: string, harness: "pi" | "codex", options?: {
     settled?: boolean;
     leafId?: string | null;
+    signal?: AbortSignal;
 }): Promise<NativeTranscript>;

package/dist/runtime/native-transcript.js

@@ -11,6 +11,35 @@ const iso = (value) => {
         throw new Error("Invalid native timestamp");
     return date.toISOString();
 };
+export const NATIVE_MAX_RECORD_BYTES = 256 * 1024 * 1024;
+export const NATIVE_MAX_TRANSCRIPT_BYTES = 1024 * 1024 * 1024;
+const NATIVE_HEADER_MAX_BYTES = 1024 * 1024;
+/** Read only the session header before deciding whether a global Codex file belongs to this project. */
+export async function readNativeTranscriptHeader(path, harness, signal) {
+    const stream = createReadStream(path, { signal });
+    let buffer = Buffer.alloc(0);
+    try {
+        for await (const chunk of stream) {
+            buffer = Buffer.concat([buffer, chunk]);
+            const newline = buffer.indexOf(10);
+            if (newline >= 0) {
+                const value = record(JSON.parse(buffer.subarray(0, newline).toString("utf8")));
+                const payload = record(value.payload);
+                const nativeSessionId = harness === "pi" ? text(value.id) : text(payload.id);
+                const cwd = harness === "pi" ? text(value.cwd) : text(payload.cwd);
+                if ((harness === "pi" && value.type !== "session") || (harness === "codex" && value.type !== "session_meta") || !nativeSessionId || !cwd)
+                    throw new Error("Invalid native session header");
+                return { nativeSessionId, cwd };
+            }
+            if (buffer.length > NATIVE_HEADER_MAX_BYTES)
+                throw new Error("Native session header is too large");
+        }
+        throw new Error("Native transcript is empty");
+    }
+    finally {
+        stream.destroy();
+    }
+}
 /** Partial trailing records are retried, never parsed or acknowledged as complete. */
 export async function readNativeTranscript(path, harness, options = {}) {
     const lines = [];
@@ -23,12 +52,12 @@ export async function readNativeTranscript(path, harness, options = {}) {
         fragments.push(bytes);
         pendingBytes += bytes.length;
         checksum.update(bytes);
-        if (pendingBytes > 32 * 1024 * 1024)
-            throw new Error("Native record is too large");
-        if (offset + pendingBytes > 128 * 1024 * 1024)
-            throw new Error("Native transcript exceeds the capture limit; original retained");
+        if (pendingBytes > NATIVE_MAX_RECORD_BYTES)
+            throw new Error("Native record exceeds the 256 MiB local parse limit; original retained");
+        if (offset + pendingBytes > NATIVE_MAX_TRANSCRIPT_BYTES)
+            throw new Error("Native transcript exceeds the 1 GiB local parse limit; original retained");
     };
-    for await (const chunk of createReadStream(path)) {
+    for await (const chunk of createReadStream(path, { signal: options.signal })) {
         let start = 0;
         for (let end = chunk.indexOf(10); end >= 0; end = chunk.indexOf(10, start)) {
             append(chunk.subarray(start, end + 1));

package/dist/runtime/presentation.d.ts

@@ -1,3 +1,4 @@
+import type { NativeSyncConfig } from "./native-sync.js";
 import type { RuntimeDiagnostic, RuntimeDiagnosticLevel } from "./diagnostics.js";
 export declare const diagnosticLevels: RuntimeDiagnosticLevel[];
 export declare const atLeastLevel: (level: RuntimeDiagnosticLevel, minimum: RuntimeDiagnosticLevel) => boolean;
@@ -16,6 +17,14 @@ export type RuntimeSummary = {
     workspaceConnected: boolean;
     diagnosticsPath: string;
     background: boolean;
-    nativeSync?: boolean;
 };
 export declare function printRuntimeSummary(summary: RuntimeSummary, json?: boolean, reused?: boolean): void;
+export type NativeSessionStatus = {
+    harness: "pi" | "codex";
+    nativeSessionId: string;
+    sessionId: string | null;
+    pendingTurns: number;
+    pendingArchives: number;
+};
+/** `runtime status` native sync block: installation state plus per-Harness pending work. */
+export declare function formatNativeSync(config: NativeSyncConfig | null, sessions: NativeSessionStatus[], error?: string | null): string;

package/dist/runtime/presentation.js

@@ -76,3 +76,19 @@ export function printRuntimeSummary(summary, json = false, reused = false) {
         process.stdout.write("  Ctrl+C to stop\n");
     process.stdout.write("\n");
 }
+/** `runtime status` native sync block: installation state plus per-Harness pending work. */
+export function formatNativeSync(config, sessions, error = null) {
+    if (error)
+        return `Native sync  unknown — ${error} · fix or remove the config, then runtime up\n`;
+    if (!config?.harnesses.length)
+        return "Native sync  off · run cohub runtime up to enable\n";
+    const lines = [`Native sync  enabled · ${config.harnesses.join(", ")}`];
+    for (const session of sessions) {
+        lines.push(`  ${session.harness.padEnd(5)} ${session.nativeSessionId.slice(0, 8)}  ${session.pendingTurns} Turns · ${session.pendingArchives} archives pending`);
+    }
+    if (!sessions.length)
+        lines.push("  No native chats captured yet");
+    else if (sessions.every((session) => !session.pendingTurns && !session.pendingArchives))
+        lines.push("  Up to date");
+    return `${lines.join("\n")}\n`;
+}

package/dist/runtime/supervisor.js

@@ -41,7 +41,6 @@ export async function runRuntime(config, onState, externalSignal, onDiagnostic)
         pid: process.pid, harnesses: config.harnesses, background: config.background,
         state: "starting", harnessConnected: false, workspaceConnected: false,
         diagnosticsPath: diagnostics.directory,
-        nativeSync: true,
     };
     let hasBeenReady = false;
     const update = (patch) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neta-art/cohub-cli",
-  "version": "8.0.1",
+  "version": "8.1.0",
   "description": "CLI for Cohub — spaces, sessions, and agent collaboration.",
   "type": "module",
   "engines": {
@@ -22,7 +22,7 @@
     "commander": "^15.0.0",
     "pixi.js": "^8.20.1",
     "sharp": "^0.35.4",
-    "@neta-art/cohub": "8.21.0"
+    "@neta-art/cohub": "8.21.1"
   },
   "publishConfig": {
     "access": "public"