@openrig/cli 0.5.0 → 0.5.1

package/node_modules/@openrig/daemon/dist/domain/resume-metadata-refresher.js

@@ -0,0 +1,274 @@
+import os from "node:os";
+import nodePath from "node:path";
+import { execFileSync } from "node:child_process";
+import { defaultResolveHomeDirByPid, readCodexThreadIdFromCandidateHomes, } from "./codex-thread-id.js";
+import { assessNativeResumeProbe, buildNativeResumeCommand, isProbeShellReady, } from "./native-resume-probe.js";
+import { runSyncSite } from "./sync-site-wrap.js";
+export class ResumeMetadataRefresher {
+    sessionRegistry;
+    tmuxAdapter;
+    listProcesses;
+    readCodexThreadIdByPid;
+    probeClaudeResume;
+    resolveHomeDirByPid;
+    sleep;
+    homeDir;
+    contextUsageStore;
+    constructor(deps) {
+        this.sessionRegistry = deps.sessionRegistry;
+        this.tmuxAdapter = deps.tmuxAdapter;
+        this.listProcesses = deps.listProcesses ?? defaultListProcesses;
+        this.resolveHomeDirByPid = deps.resolveHomeDirByPid ?? defaultResolveHomeDirByPid;
+        this.readCodexThreadIdByPid = deps.readCodexThreadIdByPid ?? ((pid) => readCodexThreadIdFromLogs(pid, this.resolveHomeDirByPid, deps.homeDir ?? os.homedir()));
+        this.probeClaudeResume = deps.probeClaudeResume ?? ((sessionName, resumeToken, cwd) => this.defaultProbeClaudeResume(sessionName, resumeToken, cwd));
+        this.sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+        this.homeDir = deps.homeDir ?? os.homedir();
+        this.contextUsageStore = deps.contextUsageStore ?? null;
+    }
+    /**
+     * Refresh the live per-seat resume ledger.
+     *
+     * OPR.0.4.3.20 FR-4 (rev1 fix) — `opts.fillNullOnly` is the **snapshot-refresh**
+     * mode used by the RECURRING snapshot paths (periodic scheduler every ~5min +
+     * manual route). It does exactly two things, both LIGHTWEIGHT (file reads only,
+     * like FR-3's capture — Claude sidecar `readSidecar` + Codex `captureCodexThreadId`
+     * over pid-logs), and NOTHING heavy:
+     *   1. FILL-NULL ONLY — populate a null token from live state; NEVER clear an
+     *      already-present token (rev1-r2). A present-but-not-currently-resumable
+     *      Claude token SURVIVES the routine snapshot (stays in the ledger for FR-6 to
+     *      surface as `stale/unverified — re-verify`) instead of being nulled before
+     *      FR-6 exists. Invariant: **a snapshot refresh never clears a present token.**
+     *   2. NO heavyweight resumability PROBE — it never runs `probeClaudeResume`
+     *      (which spawns a real `claude --resume` tmux session per present Claude seat).
+     *      Spawning N probe processes every periodic tick, forever, against live seats
+     *      is unacceptable recurring blast radius (rev1-r1). Resumability VERIFICATION
+     *      is FR-6's on-demand job, not a recurring-snapshot op.
+     *
+     * Default (`fillNullOnly` falsy) preserves the legacy validate-and-probe-and-clear
+     * behavior for the non-snapshot / teardown auto-pre-down path (a one-time
+     * at-shutdown check — unchanged here; FR-6 §2.1b owns unifying the clear semantics
+     * across all callers).
+     */
+    async refresh(sessions, opts) {
+        const fillNullOnly = opts?.fillNullOnly === true;
+        for (const session of sessions) {
+            if (session.runtime === "codex") {
+                if (session.resumeToken) {
+                    // OPR.0.4.3.20 FR-6.1 — lightweight equal-value freshness RE-STAMP on the
+                    // periodic (fill-null) path so a present-and-still-valid token does not age
+                    // to a FALSE `stale — re-verify` after the FR-6 threshold. Re-derive via the
+                    // SAME pure-read helper FR-3 uses (getPanePid → pid-keyed logs; NO probe/spawn,
+                    // NO `claude --resume`, NO launch) and refresh freshness ONLY on an EXACT match.
+                    if (fillNullOnly) {
+                        const derived = await this.captureCodexThreadId(session.sessionName);
+                        if (derived && derived === session.resumeToken) {
+                            // Present + matching = genuine positive evidence; stamp freshness via the
+                            // FR-6 marker (never updateResumeToken → no token/provenance clobber).
+                            this.sessionRegistry.markResumeProbeResult(session.sessionId, "resumable");
+                        }
+                        // DIFFERENT / ABSENT (rolled or underivable) → no-op: no re-stamp, no clobber.
+                        // Left honest for FR-6 (stale — re-verify) + FR-7 restore-time rollback.
+                    }
+                    continue;
+                }
+                const threadId = await this.captureCodexThreadId(session.sessionName);
+                if (threadId) {
+                    this.sessionRegistry.updateResumeToken(session.sessionId, "codex_id", threadId, "scrape");
+                }
+                continue;
+            }
+            if (session.runtime === "claude-code") {
+                if (!session.resumeToken) {
+                    // OPR.0.4.3.20 FR-4 — null-fill from the Claude status-line sidecar
+                    // (best-effort; missing/parse-error/empty leaves null, never throws).
+                    // `scrape` provenance (rank 0) fills a null slot and never clobbers a
+                    // higher-trust adoption/hook/operator token (the FR-3 rank guard).
+                    const sidecar = this.contextUsageStore?.readSidecar(session.sessionName);
+                    if (sidecar?.ok) {
+                        const token = sidecar.data.session_id;
+                        if (typeof token === "string" && token.trim().length > 0) {
+                            this.sessionRegistry.updateResumeToken(session.sessionId, "claude_id", token.trim(), "scrape");
+                        }
+                    }
+                    continue;
+                }
+                // Present token.
+                // OPR.0.4.3.20 FR-4 (rev1 fix) — in snapshot-refresh (fill-null-only) mode,
+                // return BEFORE the probe: never spawn the heavyweight `claude --resume`
+                // probe on the recurring snapshot path (rev1-r1), and never clear a present
+                // token (rev1-r2). A present-but-not-resumable token stays in the ledger for
+                // FR-6 to surface as `stale/unverified — re-verify`. Only the legacy/teardown
+                // default path probes + clears (a one-time at-shutdown check).
+                if (fillNullOnly) {
+                    // OPR.0.4.3.20 FR-6.1 — equal-value freshness RE-STAMP on the periodic path
+                    // (NO probe; never spawns `claude --resume`). Re-derive via the pure-read
+                    // status-line sidecar and refresh freshness ONLY on an EXACT match to the
+                    // stored token. Different / absent / parse-error / unreadable → no-op: no
+                    // re-stamp and no token clobber (left honest for FR-6 + FR-7).
+                    const sidecar = this.contextUsageStore?.readSidecar(session.sessionName);
+                    if (sidecar?.ok) {
+                        const derived = sidecar.data.session_id;
+                        if (typeof derived === "string" && derived.trim().length > 0 && derived.trim() === session.resumeToken) {
+                            this.sessionRegistry.markResumeProbeResult(session.sessionId, "resumable");
+                        }
+                    }
+                    continue;
+                }
+                const probe = await this.probeClaudeResume(session.sessionName, session.resumeToken, session.cwd ?? null);
+                // OPR.0.4.3.20 FR-6 §2.1b — record the probe result WITHOUT clearing:
+                // `not_resumable`/`inconclusive` marks the present token stale (the plan
+                // surfaces it as `stale — re-verify`), `resumable` stamps freshness. The
+                // token stays put — a rolled-but-present token is no longer silently
+                // nulled; FR-7's rollback catches an actually-unresumable token at restore.
+                this.sessionRegistry.markResumeProbeResult(session.sessionId, probe);
+            }
+        }
+    }
+    /** Best-effort derive a Codex thread id from live pane state (getPanePid →
+     *  codex descendant pids → pid-keyed logs sqlite). Async, returns undefined
+     *  on timeout/absence. Public for reuse by adoption-boundary capture
+     *  (OPR.0.4.3.20 FR-3) — no behavior change to the teardown-path scrape. */
+    async captureCodexThreadId(sessionTarget) {
+        if (!this.tmuxAdapter.getPanePid)
+            return undefined;
+        for (let attempt = 0; attempt < 8; attempt++) {
+            const shellPid = await this.tmuxAdapter.getPanePid(sessionTarget);
+            if (shellPid) {
+                const codexPids = findCodexDescendantPids(this.listProcesses(), shellPid);
+                for (const codexPid of codexPids) {
+                    const threadId = this.readCodexThreadIdByPid(codexPid);
+                    if (threadId)
+                        return threadId;
+                }
+            }
+            await this.sleep(250);
+        }
+        return undefined;
+    }
+    async defaultProbeClaudeResume(sessionName, resumeToken, cwd) {
+        const command = buildNativeResumeCommand("claude-code", resumeToken, sessionName);
+        if (!command) {
+            return "not_resumable";
+        }
+        const probeSession = `rigged-refresh-${sanitizeTmuxName(sessionName)}-${Date.now().toString(36)}`;
+        const create = await this.tmuxAdapter.createSession(probeSession, resolveProbeCwd(cwd, this.homeDir));
+        if (!create.ok) {
+            return "inconclusive";
+        }
+        try {
+            const shellReady = await this.waitForProbeShellReady(probeSession);
+            if (!shellReady) {
+                return "inconclusive";
+            }
+            const send = await this.tmuxAdapter.sendText(probeSession, command);
+            if (!send.ok) {
+                return "inconclusive";
+            }
+            const enter = await this.tmuxAdapter.sendKeys(probeSession, ["Enter"]);
+            if (!enter.ok) {
+                return "inconclusive";
+            }
+            const attempts = 24;
+            for (let attempt = 0; attempt < attempts; attempt++) {
+                const paneCommand = await this.tmuxAdapter.getPaneCommand(probeSession);
+                const paneContent = (await this.tmuxAdapter.capturePaneContent(probeSession, 80)) ?? "";
+                const result = assessNativeResumeProbe({
+                    runtime: "claude-code",
+                    paneCommand,
+                    paneContent,
+                });
+                if (result.status === "resumed") {
+                    return "resumable";
+                }
+                if (result.status === "failed") {
+                    return "not_resumable";
+                }
+                if (attempt < attempts - 1) {
+                    await this.sleep(250);
+                }
+            }
+            return "inconclusive";
+        }
+        finally {
+            await this.tmuxAdapter.killSession(probeSession);
+        }
+    }
+    async waitForProbeShellReady(sessionName) {
+        const attempts = 16;
+        for (let attempt = 0; attempt < attempts; attempt++) {
+            const paneCommand = await this.tmuxAdapter.getPaneCommand(sessionName);
+            const paneContent = (await this.tmuxAdapter.capturePaneContent(sessionName, 20)) ?? "";
+            if (isProbeShellReady({ paneCommand, paneContent })) {
+                return true;
+            }
+            if (attempt < attempts - 1) {
+                await this.sleep(250);
+            }
+        }
+        return false;
+    }
+}
+function defaultListProcesses() {
+    try {
+        const output = runSyncSite("resume_metadata.list_processes", () => execFileSync("ps", ["-Ao", "pid,ppid,command"], { encoding: "utf-8" }));
+        return output
+            .split("\n")
+            .slice(1)
+            .map((line) => line.trim())
+            .filter(Boolean)
+            .map((line) => {
+            const match = line.match(/^(\d+)\s+(\d+)\s+(.*)$/);
+            if (!match)
+                return null;
+            return {
+                pid: Number(match[1]),
+                ppid: Number(match[2]),
+                command: match[3] ?? "",
+            };
+        })
+            .filter((row) => row !== null);
+    }
+    catch {
+        return [];
+    }
+}
+function findCodexDescendantPids(processes, parentPid) {
+    const childrenByParent = new Map();
+    for (const proc of processes) {
+        const siblings = childrenByParent.get(proc.ppid) ?? [];
+        siblings.push({ pid: proc.pid, command: proc.command });
+        childrenByParent.set(proc.ppid, siblings);
+    }
+    const matches = [];
+    const visit = (pid) => {
+        for (const child of childrenByParent.get(pid) ?? []) {
+            visit(child.pid);
+            if (commandLooksLikeCodex(child.command)) {
+                matches.push(child.pid);
+            }
+        }
+    };
+    visit(parentPid);
+    return matches;
+}
+function readCodexThreadIdFromLogs(pid, resolveHomeDirByPid, homeDir) {
+    return readCodexThreadIdFromCandidateHomes(pid, [resolveHomeDirByPid(pid), homeDir, os.homedir()]);
+}
+function commandLooksLikeCodex(command) {
+    const tokens = command.trim().split(/\s+/).filter(Boolean);
+    return tokens.some((token) => {
+        const unquoted = token.replace(/^['"]|['"]$/g, "");
+        const base = nodePath.basename(unquoted);
+        return base === "codex";
+    });
+}
+function sanitizeTmuxName(value) {
+    return value.replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function resolveProbeCwd(cwd, homeDir) {
+    if (!cwd || cwd === ".") {
+        return process.cwd();
+    }
+    return cwd;
+}
+//# sourceMappingURL=resume-metadata-refresher.js.map

package/node_modules/@openrig/daemon/dist/domain/resume-metadata-refresher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume-metadata-refresher.js","sourceRoot":"","sources":["../../src/domain/resume-metadata-refresher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,OAAO,EACL,0BAA0B,EAC1B,mCAAmC,GAEpC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AA6BlD,MAAM,OAAO,uBAAuB;IAC1B,eAAe,CAAkB;IACjC,WAAW,CAAc;IACzB,aAAa,CAA8D;IAC3E,sBAAsB,CAAsC;IAC5D,iBAAiB,CAA6H;IAC9I,mBAAmB,CAAsB;IACzC,KAAK,CAAgC;IACrC,OAAO,CAAS;IAChB,iBAAiB,CAA0D;IAEnF,YAAY,IAAiC;QAC3C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC5C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,oBAAoB,CAAC;QAChE,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,IAAI,0BAA0B,CAAC;QAClF,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,sBAAsB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,yBAAyB,CAC9F,GAAG,EACH,IAAI,CAAC,mBAAmB,EACxB,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAC7B,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QACrJ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;QAC5C,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,OAAO,CAAC,QAAgC,EAAE,IAAiC;QAC/E,MAAM,YAAY,GAAG,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;QACjD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAChC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;oBACxB,0EAA0E;oBAC1E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,gFAAgF;oBAChF,iFAAiF;oBACjF,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;wBACrE,IAAI,OAAO,IAAI,OAAO,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;4BAC/C,0EAA0E;4BAC1E,uEAAuE;4BACvE,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;wBAC7E,CAAC;wBACD,+EAA+E;wBAC/E,yEAAyE;oBAC3E,CAAC;oBACD,SAAS;gBACX,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBACtE,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC5F,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,OAAO,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;gBACtC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;oBACzB,oEAAoE;oBACpE,sEAAsE;oBACtE,sEAAsE;oBACtE,mEAAmE;oBACnE,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;oBACzE,IAAI,OAAO,EAAE,EAAE,EAAE,CAAC;wBAChB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;wBACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACzD,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;wBACjG,CAAC;oBACH,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,iBAAiB;gBACjB,4EAA4E;gBAC5E,yEAAyE;gBACzE,4EAA4E;gBAC5E,6EAA6E;gBAC7E,8EAA8E;gBAC9E,+DAA+D;gBAC/D,IAAI,YAAY,EAAE,CAAC;oBACjB,4EAA4E;oBAC5E,0EAA0E;oBAC1E,0EAA0E;oBAC1E,0EAA0E;oBAC1E,+DAA+D;oBAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;oBACzE,IAAI,OAAO,EAAE,EAAE,EAAE,CAAC;wBAChB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;wBACxC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;4BACvG,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;wBAC7E,CAAC;oBACH,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;gBAC1G,sEAAsE;gBACtE,yEAAyE;gBACzE,yEAAyE;gBACzE,qEAAqE;gBACrE,4EAA4E;gBAC5E,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;gFAG4E;IAC5E,KAAK,CAAC,oBAAoB,CAAC,aAAqB;QAC9C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAEnD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAClE,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAC1E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;oBACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;oBACvD,IAAI,QAAQ;wBAAE,OAAO,QAAQ,CAAC;gBAChC,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,WAAmB,EACnB,WAAmB,EACnB,GAAmB;QAEnB,MAAM,OAAO,GAAG,wBAAwB,CAAC,aAAa,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAClF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,MAAM,YAAY,GAAG,kBAAkB,gBAAgB,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;YACnE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,cAAc,CAAC;YACxB,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACpE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,cAAc,CAAC;YACxB,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,cAAc,CAAC;YACxB,CAAC;YAED,MAAM,QAAQ,GAAG,EAAE,CAAC;YACpB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;gBACpD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;gBACxE,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxF,MAAM,MAAM,GAAG,uBAAuB,CAAC;oBACrC,OAAO,EAAE,aAAa;oBACtB,WAAW;oBACX,WAAW;iBACZ,CAAC,CAAC;gBAEH,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAChC,OAAO,WAAW,CAAC;gBACrB,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,OAAO,eAAe,CAAC;gBACzB,CAAC;gBAED,IAAI,OAAO,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,OAAO,cAAc,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,WAAmB;QACtD,MAAM,QAAQ,GAAG,EAAE,CAAC;QAEpB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YACpD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YACvE,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACvF,IAAI,iBAAiB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;gBACpD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,OAAO,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,SAAS,oBAAoB;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,gCAAgC,EAAE,GAAG,EAAE,CAChE,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CACvE,CAAC;QACF,OAAO,MAAM;aACV,KAAK,CAAC,IAAI,CAAC;aACX,KAAK,CAAC,CAAC,CAAC;aACR,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,OAAO;gBACL,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACrB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;aACxB,CAAC;QACJ,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,GAAG,EAAyD,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,SAAgE,EAChE,SAAiB;IAEjB,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmD,CAAC;IACpF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,CAAC,GAAW,EAAQ,EAAE;QAClC,KAAK,MAAM,KAAK,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YACpD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjB,IAAI,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,CAAC,SAAS,CAAC,CAAC;IACjB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAChC,GAAW,EACX,mBAAwC,EACxC,OAAe;IAEf,OAAO,mCAAmC,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO,IAAI,KAAK,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,eAAe,CAAC,GAA8B,EAAE,OAAe;IACtE,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/resume-token-capture.d.ts

@@ -0,0 +1,63 @@
+import { type ResumeType } from "./resume-token-validation.js";
+export interface ResumeTokenCaptureDeps {
+    contextUsageStore?: {
+        readSidecar(sessionName: string): {
+            ok: true;
+            data: {
+                session_id?: string;
+            };
+        } | {
+            ok: false;
+            reason: string;
+        };
+    } | null;
+    resumeTokenCapturer?: {
+        captureCodexThreadId(sessionName: string): Promise<string | undefined>;
+    } | null;
+    /** OPR.0.4.6.PI1 FR-6 — reads the pi-runner's session-state sidecar (the
+     *  runner persists sessionFile/sessionId from RPC get_state; a file read,
+     *  same posture as the claude-code status-line sidecar). */
+    piRunnerStateStore?: {
+        readSessionFile(sessionName: string): {
+            ok: true;
+            sessionFile: string;
+        } | {
+            ok: false;
+            reason: string;
+        };
+    } | null;
+}
+export type ResumeTokenDeriveResult = 
+/** Runtime has no resume token (terminal / unknown) — not a failure, no event. */
+{
+    outcome: "exempt";
+}
+/** A required derive dependency is absent (older wiring / test) — silent no-op. */
+ | {
+    outcome: "noop";
+}
+/** A live token was derived + format-validated. The caller persists it. */
+ | {
+    outcome: "captured";
+    resumeType: ResumeType;
+    token: string;
+}
+/** Derivation ran but produced no usable token — the caller emits a skip event. */
+ | {
+    outcome: "skipped";
+    reason: "missing_sidecar" | "parse_error" | "probe_timeout" | "invalid_token";
+};
+/**
+ * Derive a runtime's resume token from live, read-only sources:
+ *   claude-code → the status-line sidecar's session_id (a file read)
+ *   codex       → the thread id derived from live pid-keyed logs
+ *   pi          → the pi-runner state sidecar's sessionFile (a file read)
+ * Returns a structured outcome; never throws for a missing/invalid token
+ * (those are honest skips). ANY unexpected throw from a dependency is the
+ * caller's to swallow (capture must never fail or block its lifecycle op).
+ */
+export declare function deriveResumeToken(input: {
+    runtime: string | null;
+    sessionName: string;
+}, deps: ResumeTokenCaptureDeps): Promise<ResumeTokenDeriveResult>;
+//# sourceMappingURL=resume-token-capture.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/resume-token-capture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume-token-capture.d.ts","sourceRoot":"","sources":["../../src/domain/resume-token-capture.ts"],"names":[],"mappings":"AAkBA,OAAO,EAA6C,KAAK,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE1G,MAAM,WAAW,sBAAsB;IACrC,iBAAiB,CAAC,EAAE;QAClB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG;YAAE,EAAE,EAAE,IAAI,CAAC;YAAC,IAAI,EAAE;gBAAE,UAAU,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,GAAG;YAAE,EAAE,EAAE,KAAK,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;KAC/G,GAAG,IAAI,CAAC;IACT,mBAAmB,CAAC,EAAE;QACpB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;KACxE,GAAG,IAAI,CAAC;IACT;;gEAE4D;IAC5D,kBAAkB,CAAC,EAAE;QACnB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG;YAAE,EAAE,EAAE,IAAI,CAAC;YAAC,WAAW,EAAE,MAAM,CAAA;SAAE,GAAG;YAAE,EAAE,EAAE,KAAK,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;KACzG,GAAG,IAAI,CAAC;CACV;AAED,MAAM,MAAM,uBAAuB;AACjC,kFAAkF;AAChF;IAAE,OAAO,EAAE,QAAQ,CAAA;CAAE;AACvB,mFAAmF;GACjF;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;AACrB,2EAA2E;GACzE;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAChE,mFAAmF;GACjF;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,iBAAiB,GAAG,aAAa,GAAG,eAAe,GAAG,eAAe,CAAA;CAAE,CAAC;AAE1G;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EACtD,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,uBAAuB,CAAC,CAsClC"}

package/node_modules/@openrig/daemon/dist/domain/resume-token-capture.js

@@ -0,0 +1,76 @@
+// OPR.0.4.3.04 B2 — the PURE, reusable resume-token DERIVE helper.
+//
+// This is the shared derivation core behind FR-3's adoption-boundary capture
+// (ClaimService.captureResumeTokenOnAdoption) AND the seat-handover discovered-
+// mode capture. It performs REUSE-ONLY, PURE READ derivation — no pane writes,
+// no launch, no persistence, no event emission. The CALLER owns persistence
+// (updateResumeToken) and event emission (captured / preserved / skipped), so
+// each caller keeps its own provenance + audit semantics.
+//
+// The derived token is credential-class: it is NEVER logged, echoed, or placed
+// in any returned message/error. Only the caller's redacted persistence path
+// ever touches it. Honest failure = a structured skip reason (no token), never
+// a fabricated value.
+//
+// FR-3's scope is UNCHANGED: this helper is derive-only and does not alter
+// which lifecycle ops adopt. It only removes the duplication between the two
+// derive sites the ruling asked us to share.
+import { resumeTypeForRuntime, validateResumeToken } from "./resume-token-validation.js";
+/**
+ * Derive a runtime's resume token from live, read-only sources:
+ *   claude-code → the status-line sidecar's session_id (a file read)
+ *   codex       → the thread id derived from live pid-keyed logs
+ *   pi          → the pi-runner state sidecar's sessionFile (a file read)
+ * Returns a structured outcome; never throws for a missing/invalid token
+ * (those are honest skips). ANY unexpected throw from a dependency is the
+ * caller's to swallow (capture must never fail or block its lifecycle op).
+ */
+export async function deriveResumeToken(input, deps) {
+    const resumeType = resumeTypeForRuntime(input.runtime);
+    if (!resumeType)
+        return { outcome: "exempt" }; // terminal / unknown — exempt, not a failure
+    const runtime = input.runtime; // non-null: resumeType is set only for claude-code / codex / pi
+    let token;
+    if (runtime === "claude-code") {
+        if (!deps.contextUsageStore)
+            return { outcome: "noop" }; // dep absent — silent no-op
+        const sidecar = deps.contextUsageStore.readSidecar(input.sessionName);
+        if (!sidecar.ok) {
+            return { outcome: "skipped", reason: sidecar.reason === "parse_error" ? "parse_error" : "missing_sidecar" };
+        }
+        const sid = sidecar.data.session_id;
+        if (typeof sid === "string" && sid.trim().length > 0)
+            token = sid.trim();
+        else
+            return { outcome: "skipped", reason: "missing_sidecar" };
+    }
+    else if (runtime === "codex") {
+        if (!deps.resumeTokenCapturer)
+            return { outcome: "noop" }; // dep absent — silent no-op
+        token = await deps.resumeTokenCapturer.captureCodexThreadId(input.sessionName);
+        if (!token)
+            return { outcome: "skipped", reason: "probe_timeout" };
+    }
+    else if (runtime === "pi") {
+        if (!deps.piRunnerStateStore)
+            return { outcome: "noop" }; // dep absent — silent no-op
+        const state = deps.piRunnerStateStore.readSessionFile(input.sessionName);
+        if (!state.ok) {
+            return { outcome: "skipped", reason: state.reason === "parse_error" ? "parse_error" : "missing_sidecar" };
+        }
+        if (state.sessionFile.trim().length > 0)
+            token = state.sessionFile.trim();
+        else
+            return { outcome: "skipped", reason: "missing_sidecar" };
+    }
+    else {
+        return { outcome: "noop" }; // resumeType set but runtime is not one we derive — defensive
+    }
+    // Defensive format validation before the caller persists — a malformed token
+    // is an honest skip, never a bad write (validity-before-rank).
+    const validation = validateResumeToken(runtime, token);
+    if (!validation.ok)
+        return { outcome: "skipped", reason: "invalid_token" };
+    return { outcome: "captured", resumeType: validation.resumeType, token: validation.token };
+}
+//# sourceMappingURL=resume-token-capture.js.map

package/node_modules/@openrig/daemon/dist/domain/resume-token-capture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume-token-capture.js","sourceRoot":"","sources":["../../src/domain/resume-token-capture.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,0DAA0D;AAC1D,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,sBAAsB;AACtB,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,6CAA6C;AAE7C,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAmB,MAAM,8BAA8B,CAAC;AA2B1G;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAsD,EACtD,IAA4B;IAE5B,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,6CAA6C;IAE5F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAiB,CAAC,CAAC,gEAAgE;IAEzG,IAAI,KAAyB,CAAC;IAC9B,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,iBAAiB;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,4BAA4B;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;QAC9G,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;;YACpE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAChE,CAAC;SAAM,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,mBAAmB;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,4BAA4B;QACvF,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACrE,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,4BAA4B;QACtF,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;QAC5G,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;;YACrE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,8DAA8D;IAC5F,CAAC;IAED,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAE3E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;AAC7F,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/resume-token-validation.d.ts

@@ -0,0 +1,17 @@
+export type ResumeType = "claude_id" | "codex_id" | "pi_session_file";
+export interface ResumeTokenValidationOk {
+    ok: true;
+    resumeType: ResumeType;
+    /** The trimmed token to persist. Internal value — never logged/echoed. */
+    token: string;
+}
+export interface ResumeTokenValidationErr {
+    ok: false;
+    /** Describes the FORMAT problem; NEVER contains the token value. */
+    error: string;
+}
+/** Resume-id type for a runtime, or null when the runtime has no resume token
+ *  (terminal / unknown). */
+export declare function resumeTypeForRuntime(runtime: string | null): ResumeType | null;
+export declare function validateResumeToken(runtime: string | null, rawToken: unknown): ResumeTokenValidationOk | ResumeTokenValidationErr;
+//# sourceMappingURL=resume-token-validation.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/resume-token-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume-token-validation.d.ts","sourceRoot":"","sources":["../../src/domain/resume-token-validation.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,iBAAiB,CAAC;AAEtE,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,IAAI,CAAC;IACT,UAAU,EAAE,UAAU,CAAC;IACvB,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;CACf;AACD,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,KAAK,CAAC;IACV,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;CACf;AAsBD;4BAC4B;AAC5B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,UAAU,GAAG,IAAI,CAK9E;AAqCD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,QAAQ,EAAE,OAAO,GAChB,uBAAuB,GAAG,wBAAwB,CAmBpD"}

package/node_modules/@openrig/daemon/dist/domain/resume-token-validation.js

@@ -0,0 +1,94 @@
+// OPR.0.4.0.22 FR-2 — per-runtime resume-token validation.
+// OPR.0.4.6.PI1 FR-6 — validation is PER-RESUME-TYPE: id-shaped tokens
+// (claude/codex) keep the original rules unchanged; pi_session_file is a
+// PATH-shaped token (an absolute session-file path) with its own floor.
+//
+// The floor is FORMAT validation: reject malformed input, never fabricate a
+// token, and NEVER quote the raw token in an error message (it is
+// credential-class — the redaction contract spans CLI output, route
+// responses, route errors, logs, and the audit event). A deep "does it
+// actually resume" probe is intentionally out of scope (heavy + must not
+// mutate live state); format validation is the safe, side-effect-free floor.
+const SAFE_TOKEN_RE = /^[A-Za-z0-9._-]+$/;
+const MAX_TOKEN_LEN = 200;
+// pi_session_file floor: absolute path, no ".." segment (checked on the raw
+// operand — normalization collapses "..", so a post-normalize check would be
+// dead code; same posture as the shipped `rig file` traversal guard), the
+// shell-inert path charset, a 1024 cap, and the Pi session-file suffix (one
+// constant if Pi ever renames its session format).
+//
+// "@" is in the set deliberately (a delta from the PRD's literal
+// [A-Za-z0-9._/-], caught by the VM hermetic run): the Pi seat state layout
+// keys on the CANONICAL session name (pod-member@rig), so every real Pi
+// session-file path contains "@". It is shell-inert here — the token is
+// always argv/shellQuote-passed, never a remote scp/rsync operand where
+// user@host parsing would matter (that ambiguity is why `rig file` excludes
+// it; this surface has no such parse).
+const PI_SESSION_FILE_CHARSET_RE = /^[A-Za-z0-9._/@-]+$/;
+const MAX_PI_SESSION_FILE_LEN = 1024;
+const PI_SESSION_FILE_SUFFIX = ".jsonl";
+/** Resume-id type for a runtime, or null when the runtime has no resume token
+ *  (terminal / unknown). */
+export function resumeTypeForRuntime(runtime) {
+    if (runtime === "claude-code")
+        return "claude_id";
+    if (runtime === "codex")
+        return "codex_id";
+    if (runtime === "pi")
+        return "pi_session_file";
+    return null;
+}
+function validateIdShapedToken(resumeType, token) {
+    if (token.length > MAX_TOKEN_LEN) {
+        return { ok: false, error: `Resume token is too long (max ${MAX_TOKEN_LEN} characters).` };
+    }
+    if (!SAFE_TOKEN_RE.test(token)) {
+        return {
+            ok: false,
+            error: "Resume token contains disallowed characters (allowed: letters, digits, '.', '_', '-').",
+        };
+    }
+    return { ok: true, resumeType, token };
+}
+function validatePiSessionFileToken(token) {
+    if (token.length > MAX_PI_SESSION_FILE_LEN) {
+        return { ok: false, error: `Pi session-file token is too long (max ${MAX_PI_SESSION_FILE_LEN} characters).` };
+    }
+    if (!token.startsWith("/")) {
+        return { ok: false, error: "Pi session-file token must be an absolute path (starting with '/')." };
+    }
+    if (token.split("/").includes("..")) {
+        return { ok: false, error: "Pi session-file token must not contain a '..' path segment." };
+    }
+    if (!PI_SESSION_FILE_CHARSET_RE.test(token)) {
+        return {
+            ok: false,
+            error: "Pi session-file token contains disallowed characters (allowed: letters, digits, '.', '_', '/', '@', '-').",
+        };
+    }
+    if (!token.endsWith(PI_SESSION_FILE_SUFFIX)) {
+        return { ok: false, error: `Pi session-file token must end with '${PI_SESSION_FILE_SUFFIX}'.` };
+    }
+    return { ok: true, resumeType: "pi_session_file", token };
+}
+export function validateResumeToken(runtime, rawToken) {
+    const resumeType = resumeTypeForRuntime(runtime);
+    if (!resumeType) {
+        return {
+            ok: false,
+            error: `set-resume-token is not supported for runtime "${runtime ?? "unknown"}" (only claude-code, codex, and pi have resume tokens).`,
+        };
+    }
+    if (typeof rawToken !== "string") {
+        return { ok: false, error: "Resume token is missing or not a string." };
+    }
+    const token = rawToken.trim();
+    if (token.length === 0) {
+        return { ok: false, error: "Resume token is empty." };
+    }
+    if (resumeType === "pi_session_file") {
+        return validatePiSessionFileToken(token);
+    }
+    return validateIdShapedToken(resumeType, token);
+}
+//# sourceMappingURL=resume-token-validation.js.map

package/node_modules/@openrig/daemon/dist/domain/resume-token-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume-token-validation.js","sourceRoot":"","sources":["../../src/domain/resume-token-validation.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,uEAAuE;AACvE,yEAAyE;AACzE,wEAAwE;AACxE,EAAE;AACF,4EAA4E;AAC5E,kEAAkE;AAClE,oEAAoE;AACpE,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAgB7E,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,mDAAmD;AACnD,EAAE;AACF,iEAAiE;AACjE,4EAA4E;AAC5E,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,4EAA4E;AAC5E,uCAAuC;AACvC,MAAM,0BAA0B,GAAG,qBAAqB,CAAC;AACzD,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,MAAM,sBAAsB,GAAG,QAAQ,CAAC;AAExC;4BAC4B;AAC5B,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,IAAI,OAAO,KAAK,aAAa;QAAE,OAAO,WAAW,CAAC;IAClD,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC;IAC3C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,iBAAiB,CAAC;IAC/C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAsB,EAAE,KAAa;IAClE,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,aAAa,eAAe,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wFAAwF;SAChG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa;IAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,uBAAuB,eAAe,EAAE,CAAC;IAChH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qEAAqE,EAAE,CAAC;IACrG,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6DAA6D,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,2GAA2G;SACnH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wCAAwC,sBAAsB,IAAI,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAsB,EACtB,QAAiB;IAEjB,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,kDAAkD,OAAO,IAAI,SAAS,yDAAyD;SACvI,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;QACrC,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAClD,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/review/brief-spine.d.ts

@@ -0,0 +1,19 @@
+import type { ComposedMissionReview } from "./types.js";
+export interface BriefSpine {
+    building: string;
+    progress: string;
+    proven: string;
+    needsYou: string;
+}
+/** The four generated section bodies — derived from the same composer
+ *  queries FR-7 renders (no second computation path). */
+export declare function renderBriefSpine(m: ComposedMissionReview): BriefSpine;
+/**
+ * Section-scoped application: replaces ONLY the four spine section bodies in
+ * an existing MISSION_BRIEF.md, preserving every other byte (hand-authored
+ * "What & why"/"Pointers", the H1, frontmatter, ordering). Returns null when
+ * the brief does not carry the pinned schema (never guess-rewrite a
+ * malformed brief — the audit owns that finding).
+ */
+export declare function applyBriefSpine(briefContent: string, spine: BriefSpine): string | null;
+//# sourceMappingURL=brief-spine.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/review/brief-spine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brief-spine.d.ts","sourceRoot":"","sources":["../../../src/domain/review/brief-spine.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAExD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;yDACyD;AACzD,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,qBAAqB,GAAG,UAAU,CA6BrE;AASD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAiCtF"}