@pentoshi/clai 2.0.61 → 3.0.0

package/dist/store/history.d.ts

@@ -23,6 +23,27 @@ export interface ToolCallRecord {
     exitCode?: number | undefined;
     output: string;
 }
+/** Keep the newest version of each session id. */
+export declare function dedupeHistoryById(records: readonly HistoryRecord[]): HistoryRecord[];
+export declare function sortHistoryByUpdatedDesc(records: readonly HistoryRecord[]): HistoryRecord[];
+/**
+ * Apply retention by *recency* (not file order). Pruned sessions are returned
+ * separately so callers can archive them — never silently destroy history.
+ * limit <= 0 means unlimited (keep everything).
+ */
+export declare function partitionByRetention(records: readonly HistoryRecord[], limit: number): {
+    kept: HistoryRecord[];
+    pruned: HistoryRecord[];
+};
+/**
+ * Scan leftover write temps + the archive for sessions missing from the
+ * active file and merge them back. Fixes history that was pruned by the old
+ * slice(-200) retention or left in .tmp after a crashed rename.
+ */
+export declare function recoverOrphanedHistory(): Promise<{
+    recovered: number;
+    sources: string[];
+}>;
 export declare function saveSession(messages: ChatMessage[], name?: string | undefined, transcript?: TranscriptItem[] | undefined): Promise<HistoryRecord>;
 export declare function upsertSession(id: string, messages: ChatMessage[], name?: string | undefined, transcript?: TranscriptItem[] | undefined): Promise<HistoryRecord>;
 export declare function saveToolCall(sessionId: string, call: ToolCall, result: ToolResult): Promise<ToolCallRecord>;
@@ -30,11 +51,14 @@ export declare function listSessions(limit?: number): Promise<HistoryRecord[]>;
 export declare function getSession(sessionId: string): Promise<HistoryRecord | undefined>;
 export declare function getHistoryPath(): string;
 /**
- * Clear all stored history. Returns whether the operation succeeded.
- * Used by the /privacy slash command and `clai privacy clear-history`.
+ * Clear active history after archiving a full snapshot. Never unrecoverably
+ * destroys chats — a timestamped copy is written under history-backups/ and
+ * the previous active file is moved into history-archive.jsonl.
  */
 export declare function clearAllHistory(): Promise<{
     cleared: boolean;
     detail: string;
 }>;
 export declare function getJsonlHistoryPath(): string;
+export declare function getHistoryArchivePath(): string;
+export declare function getHistoryBackupDir(): string;

package/dist/store/history.js

@@ -1,13 +1,30 @@
-import { mkdir, readFile, rm, writeFile, rename } from "node:fs/promises";
+import { appendFile, copyFile, mkdir, readdir, readFile, rm, writeFile, rename, } from "node:fs/promises";
 import { join } from "node:path";
-import { homedir } from "node:os";
 import { redactSecrets } from "../llm/provider.js";
 import { getConfig } from "./config.js";
 import { safeCwd } from "../os/cwd.js";
 import { fixOwner, fixOwnerSync, handlePermissionError, safeExists } from "../os/permissions.js";
-const historyDir = join(homedir(), ".clai");
-const dbFile = join(historyDir, "history.db");
-const jsonlFile = join(historyDir, "history.jsonl");
+import { getHistoryDir } from "./paths.js";
+/** Live paths so CLAI_DATA_DIR / CLAI_HISTORY_DIR always apply (and tests work). */
+function historyDirPath() {
+    return getHistoryDir();
+}
+function dbFilePath() {
+    return join(historyDirPath(), "history.db");
+}
+function jsonlFilePath() {
+    return join(historyDirPath(), "history.jsonl");
+}
+/** Sessions pruned by retention land here — never hard-deleted on autosave. */
+function archiveFilePath() {
+    return join(historyDirPath(), "history-archive.jsonl");
+}
+/** Rolling pre-write snapshots of the active history file. */
+function backupDirPath() {
+    return join(historyDirPath(), "history-backups");
+}
+/** Max rolling backups kept under history-backups/. */
+const MAX_HISTORY_BACKUPS = 12;
 // We keep this string here (not as a literal) so the bundler doesn't try
 // to statically resolve a module that may not be installed. If a user has
 // `better-sqlite3` available (eg they explicitly added it for a richer
@@ -25,12 +42,12 @@ async function loadDatabase() {
     if (sqliteUnavailable)
         return undefined;
     try {
-        await mkdir(historyDir, { recursive: true });
-        await fixOwner(historyDir);
+        await mkdir(historyDirPath(), { recursive: true });
+        await fixOwner(historyDirPath());
         const imported = (await import(sqliteModuleName));
         const Ctor = imported.default ?? imported;
-        cachedDb = new Ctor(dbFile);
-        fixOwnerSync(dbFile);
+        cachedDb = new Ctor(dbFilePath());
+        fixOwnerSync(dbFilePath());
         cachedDb.exec(`
       CREATE TABLE IF NOT EXISTS sessions (
         id TEXT PRIMARY KEY,
@@ -123,10 +140,13 @@ async function appendJsonl(record) {
  * file and then persist back only its own record, wiping every other session.
  */
 let jsonlWriteChain = Promise.resolve();
+/** Ensures orphan .tmp / archive recovery runs at most once per process. */
+let recoveryAttempted = false;
 function mutateJsonl(update) {
     const run = jsonlWriteChain.then(async () => {
         try {
-            const current = await readJsonlRecords();
+            await ensureHistoryRecovered();
+            const current = await readJsonlRecordsFrom(jsonlFilePath());
             const next = update(current);
             await writeJsonlAtomic(next);
         }
@@ -138,49 +158,276 @@ function mutateJsonl(update) {
     jsonlWriteChain = run.then(() => undefined, () => undefined);
     return run;
 }
-/** Read and parse all valid JSONL records, silently skipping malformed lines. */
-async function readJsonlRecords() {
-    if (!(await safeExists(jsonlFile)))
+function updatedAtMs(record) {
+    const t = Date.parse(record.updatedAt || record.createdAt || "");
+    return Number.isFinite(t) ? t : 0;
+}
+/** Keep the newest version of each session id. */
+export function dedupeHistoryById(records) {
+    const byId = new Map();
+    for (const record of records) {
+        if (!record?.id)
+            continue;
+        const prev = byId.get(record.id);
+        if (!prev || updatedAtMs(record) >= updatedAtMs(prev)) {
+            byId.set(record.id, record);
+        }
+    }
+    return [...byId.values()];
+}
+export function sortHistoryByUpdatedDesc(records) {
+    return [...records].sort((a, b) => updatedAtMs(b) - updatedAtMs(a));
+}
+/**
+ * Apply retention by *recency* (not file order). Pruned sessions are returned
+ * separately so callers can archive them — never silently destroy history.
+ * limit <= 0 means unlimited (keep everything).
+ */
+export function partitionByRetention(records, limit) {
+    const unique = sortHistoryByUpdatedDesc(dedupeHistoryById(records));
+    if (!limit || limit <= 0 || unique.length <= limit) {
+        return { kept: unique, pruned: [] };
+    }
+    return {
+        kept: unique.slice(0, limit),
+        pruned: unique.slice(limit),
+    };
+}
+/** Read and parse all valid JSONL records from any path. */
+async function readJsonlRecordsFrom(path) {
+    if (!(await safeExists(path)))
         return [];
-    const raw = await readFile(jsonlFile, "utf8");
-    return raw
-        .split("\n")
-        .filter(Boolean)
-        .map((line) => {
-        try {
-            return JSON.parse(line);
+    try {
+        const raw = await readFile(path, "utf8");
+        return raw
+            .split("\n")
+            .filter(Boolean)
+            .map((line) => {
+            try {
+                return JSON.parse(line);
+            }
+            catch {
+                return null;
+            }
+        })
+            .filter((record) => record !== null);
+    }
+    catch (err) {
+        if (err && err.code === "EACCES")
+            handlePermissionError(err);
+        return [];
+    }
+}
+async function appendRecordsToFile(path, records) {
+    if (records.length === 0)
+        return;
+    await mkdir(historyDirPath(), { recursive: true });
+    await fixOwner(historyDirPath());
+    const chunk = `${records.map((r) => JSON.stringify(r)).join("\n")}\n`;
+    // Append is best-effort durable; archive growth is unbounded by design so
+    // retention never permanently loses a conversation.
+    await appendFile(path, chunk, { mode: 0o600 });
+    await fixOwner(path).catch(() => undefined);
+}
+async function backupActiveHistory() {
+    if (!(await safeExists(jsonlFilePath())))
+        return;
+    try {
+        await mkdir(backupDirPath(), { recursive: true });
+        await fixOwner(backupDirPath());
+        const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+        const dest = join(backupDirPath(), `history-${stamp}.jsonl`);
+        await copyFile(jsonlFilePath(), dest);
+        await fixOwner(dest).catch(() => undefined);
+        // Keep only the newest N backups.
+        const names = (await readdir(backupDirPath()))
+            .filter((n) => n.startsWith("history-") && n.endsWith(".jsonl"))
+            .sort()
+            .reverse();
+        for (const old of names.slice(MAX_HISTORY_BACKUPS)) {
+            await rm(join(backupDirPath(), old), { force: true }).catch(() => undefined);
         }
-        catch {
-            return null;
+    }
+    catch {
+        // Backup is best-effort; never block the autosave path.
+    }
+}
+/**
+ * Scan leftover write temps + the archive for sessions missing from the
+ * active file and merge them back. Fixes history that was pruned by the old
+ * slice(-200) retention or left in .tmp after a crashed rename.
+ */
+export async function recoverOrphanedHistory() {
+    const sources = [];
+    const extras = [];
+    try {
+        const names = await readdir(historyDirPath());
+        for (const name of names) {
+            // Live write temps: history.jsonl.<pid>.<stamp>.tmp
+            if (name.startsWith("history.jsonl.") &&
+                name.endsWith(".tmp")) {
+                const path = join(historyDirPath(), name);
+                const rows = await readJsonlRecordsFrom(path);
+                if (rows.length === 0) {
+                    // Empty crash leftovers — safe to remove.
+                    await rm(path, { force: true }).catch(() => undefined);
+                    continue;
+                }
+                extras.push(...rows);
+                sources.push(name);
+            }
+        }
+    }
+    catch {
+        /* dir may not exist yet */
+    }
+    // Also fold in archive (sessions previously pruned).
+    if (await safeExists(archiveFilePath())) {
+        const archived = await readJsonlRecordsFrom(archiveFilePath());
+        if (archived.length > 0) {
+            extras.push(...archived);
+            sources.push("history-archive.jsonl");
+        }
+    }
+    // Rolling backups (last-resort recovery of wiped active files).
+    try {
+        if (await safeExists(backupDirPath())) {
+            const backups = (await readdir(backupDirPath()))
+                .filter((n) => n.startsWith("history-") && n.endsWith(".jsonl"))
+                .sort()
+                .reverse()
+                .slice(0, 3);
+            for (const name of backups) {
+                const rows = await readJsonlRecordsFrom(join(backupDirPath(), name));
+                if (rows.length > 0) {
+                    extras.push(...rows);
+                    sources.push(`history-backups/${name}`);
+                }
+            }
         }
-    })
-        .filter((record) => record !== null);
+    }
+    catch {
+        /* ignore */
+    }
+    if (extras.length === 0)
+        return { recovered: 0, sources: [] };
+    const active = await readJsonlRecordsFrom(jsonlFilePath());
+    const beforeIds = new Set(active.map((r) => r.id));
+    const merged = dedupeHistoryById([...active, ...extras]);
+    const newCount = merged.filter((r) => !beforeIds.has(r.id)).length;
+    if (newCount === 0 && merged.length <= active.length) {
+        return { recovered: 0, sources };
+    }
+    // Write WITHOUT applying retention so recovery cannot re-prune.
+    await mkdir(historyDirPath(), { recursive: true });
+    await fixOwner(historyDirPath());
+    if (await safeExists(jsonlFilePath()))
+        await backupActiveHistory();
+    const sorted = sortHistoryByUpdatedDesc(merged);
+    // Stable chronological file order (oldest first) for append-friendly diffs.
+    sorted.reverse();
+    const body = sorted.length
+        ? `${sorted.map((item) => JSON.stringify(item)).join("\n")}\n`
+        : "";
+    const tmpFile = `${jsonlFilePath()}.recover.${process.pid}.${Date.now().toString(36)}.tmp`;
+    await writeFile(tmpFile, body, { mode: 0o600 });
+    try {
+        await rename(tmpFile, jsonlFilePath());
+    }
+    catch (err) {
+        await rm(tmpFile, { force: true }).catch(() => undefined);
+        throw err;
+    }
+    await fixOwner(jsonlFilePath());
+    // Successful recovery: drop non-empty orphan temps we already merged.
+    for (const name of sources) {
+        if (name.startsWith("history.jsonl.") && name.endsWith(".tmp")) {
+            await rm(join(historyDirPath(), name), { force: true }).catch(() => undefined);
+        }
+    }
+    return { recovered: newCount, sources };
+}
+async function ensureHistoryRecovered() {
+    if (recoveryAttempted)
+        return;
+    recoveryAttempted = true;
+    try {
+        await recoverOrphanedHistory();
+    }
+    catch {
+        // Never block history reads/writes on recovery failure.
+    }
 }
 /**
- * Apply retention and write the whole file atomically: write a temp file and
- * rename it over the target. `rename` is atomic on the same filesystem, so a
- * concurrent reader sees either the old file or the new one — never a partial.
+ * Apply retention (archive pruned sessions) and write the active file
+ * atomically. Never hard-deletes pruned chats — they go to history-archive.jsonl.
  */
 async function writeJsonlAtomic(records) {
-    await mkdir(historyDir, { recursive: true });
-    await fixOwner(historyDir);
+    await mkdir(historyDirPath(), { recursive: true });
+    await fixOwner(historyDirPath());
     const limit = getConfig().historyRetentionLimit;
-    const kept = limit && limit > 0 ? records.slice(-limit) : records;
-    const body = kept.length
-        ? `${kept.map((item) => JSON.stringify(item)).join("\n")}\n`
+    const { kept, pruned } = partitionByRetention(records, limit);
+    if (pruned.length > 0) {
+        // Durable archive before the active file shrinks.
+        await appendRecordsToFile(archiveFilePath(), pruned);
+    }
+    // If we would shrink (or replace) the on-disk set, snapshot first.
+    if (await safeExists(jsonlFilePath())) {
+        const existing = await readJsonlRecordsFrom(jsonlFilePath());
+        if (kept.length < existing.length || pruned.length > 0) {
+            await backupActiveHistory();
+        }
+    }
+    // Refuse to write an empty file over a non-empty one unless the caller
+    // intentionally has zero records (e.g. clear after archiving).
+    if (kept.length === 0 && (await safeExists(jsonlFilePath()))) {
+        const existing = await readJsonlRecordsFrom(jsonlFilePath());
+        if (existing.length > 0 && records.length > 0) {
+            // Something went wrong in partitioning — keep the safer set.
+            const safe = sortHistoryByUpdatedDesc(dedupeHistoryById(existing));
+            safe.reverse();
+            const body = `${safe.map((item) => JSON.stringify(item)).join("\n")}\n`;
+            const tmpFile = `${jsonlFilePath()}.${process.pid}.${Date.now().toString(36)}.tmp`;
+            await writeFile(tmpFile, body, { mode: 0o600 });
+            try {
+                await rename(tmpFile, jsonlFilePath());
+            }
+            catch (err) {
+                await rm(tmpFile, { force: true }).catch(() => undefined);
+                throw err;
+            }
+            await fixOwner(jsonlFilePath());
+            return;
+        }
+    }
+    // File order: oldest → newest (matches classic append style).
+    const ordered = sortHistoryByUpdatedDesc(kept);
+    ordered.reverse();
+    const body = ordered.length
+        ? `${ordered.map((item) => JSON.stringify(item)).join("\n")}\n`
         : "";
-    const tmpFile = `${jsonlFile}.${process.pid}.${Date.now().toString(36)}.${Math.random()
+    const tmpFile = `${jsonlFilePath()}.${process.pid}.${Date.now().toString(36)}.${Math.random()
         .toString(36)
         .slice(2, 8)}.tmp`;
     await writeFile(tmpFile, body, { mode: 0o600 });
     try {
-        await rename(tmpFile, jsonlFile);
+        await rename(tmpFile, jsonlFilePath());
     }
     catch (err) {
-        await rm(tmpFile, { force: true }).catch(() => undefined);
+        // Keep the temp file on rename failure so recovery can pick it up —
+        // only remove empty temps.
+        try {
+            const st = await readFile(tmpFile).catch(() => null);
+            if (!st || st.length === 0) {
+                await rm(tmpFile, { force: true }).catch(() => undefined);
+            }
+        }
+        catch {
+            /* ignore */
+        }
         throw err;
     }
-    await fixOwner(jsonlFile);
+    await fixOwner(jsonlFilePath());
 }
 export async function saveSession(messages, name, transcript) {
     // Auto-derive a readable name from the first user message if none provided
@@ -248,6 +495,20 @@ async function enforceSqliteRetention(db) {
     const limit = getConfig().historyRetentionLimit;
     if (!limit || limit <= 0)
         return;
+    // Archive rows about to be deleted, then delete — never hard-drop without
+    // a JSONL archive copy.
+    try {
+        const doomed = db
+            .prepare(`SELECT id, name, created_at, updated_at, cwd, messages_json FROM sessions
+         WHERE id NOT IN (SELECT id FROM sessions ORDER BY updated_at DESC LIMIT ?)`)
+            .all(Math.floor(limit));
+        const records = doomed.map(rowToSession);
+        if (records.length > 0)
+            await appendRecordsToFile(archiveFilePath(), records);
+    }
+    catch {
+        /* archive best-effort */
+    }
     db.exec(`DELETE FROM sessions WHERE id NOT IN (SELECT id FROM sessions ORDER BY updated_at DESC LIMIT ${Math.floor(limit)});`);
 }
 async function upsertJsonl(record) {
@@ -292,24 +553,12 @@ function rowToSession(row) {
     };
 }
 async function listJsonlSessions(limit) {
-    if (!(await safeExists(jsonlFile)))
-        return [];
+    await ensureHistoryRecovered();
     try {
-        const raw = await readFile(jsonlFile, "utf8");
-        return raw
-            .split("\n")
-            .filter(Boolean)
-            .map((line) => {
-            try {
-                return JSON.parse(line);
-            }
-            catch {
-                return null;
-            }
-        })
-            .filter((record) => record !== null)
-            .slice(-limit)
-            .reverse();
+        const records = sortHistoryByUpdatedDesc(dedupeHistoryById(await readJsonlRecordsFrom(jsonlFilePath())));
+        if (!limit || limit <= 0)
+            return records;
+        return records.slice(0, limit);
     }
     catch (err) {
         if (err && err.code === "EACCES") {
@@ -318,34 +567,85 @@ async function listJsonlSessions(limit) {
         return [];
     }
 }
+/**
+ * Merge SQLite + JSONL sources so enabling better-sqlite3 never hides an
+ * existing JSONL history (or vice versa). Prefer the newer updatedAt per id.
+ */
+function mergeSessionLists(...lists) {
+    return sortHistoryByUpdatedDesc(dedupeHistoryById(lists.flat()));
+}
 export async function listSessions(limit = 20) {
+    await ensureHistoryRecovered();
+    const fromJsonl = await listJsonlSessions(0); // full set, already sorted
     const db = await loadDatabase();
-    if (!db)
-        return listJsonlSessions(limit);
-    const rows = db
-        .prepare("SELECT id, name, created_at, updated_at, cwd, messages_json FROM sessions ORDER BY updated_at DESC LIMIT ?")
-        .all(limit);
-    return rows.map(rowToSession);
+    let fromDb = [];
+    if (db) {
+        try {
+            const rows = db
+                .prepare("SELECT id, name, created_at, updated_at, cwd, messages_json FROM sessions ORDER BY updated_at DESC")
+                .all();
+            fromDb = rows.map(rowToSession);
+        }
+        catch {
+            fromDb = [];
+        }
+    }
+    // Active + SQLite only. Archive/pruned sessions are merged back into the
+    // active file by recoverOrphanedHistory() (called on /history open), so
+    // they reappear there rather than staying invisible forever.
+    const merged = mergeSessionLists(fromJsonl, fromDb);
+    if (!limit || limit <= 0)
+        return merged;
+    return merged.slice(0, limit);
 }
 export async function getSession(sessionId) {
+    await ensureHistoryRecovered();
     const db = await loadDatabase();
-    if (!db) {
-        return (await listJsonlSessions(Number.MAX_SAFE_INTEGER)).find((session) => session.id === sessionId);
+    let fromDb;
+    if (db) {
+        const row = db
+            .prepare("SELECT id, name, created_at, updated_at, cwd, messages_json FROM sessions WHERE id = ?")
+            .get(sessionId);
+        if (row)
+            fromDb = rowToSession(row);
     }
-    const row = db
-        .prepare("SELECT id, name, created_at, updated_at, cwd, messages_json FROM sessions WHERE id = ?")
-        .get(sessionId);
-    return row ? rowToSession(row) : undefined;
+    const fromJsonl = (await readJsonlRecordsFrom(jsonlFilePath())).find((session) => session.id === sessionId);
+    // Also check archive for sessions pruned from the active set.
+    const fromArchive = fromJsonl
+        ? undefined
+        : (await readJsonlRecordsFrom(archiveFilePath())).find((s) => s.id === sessionId);
+    const candidates = [fromDb, fromJsonl, fromArchive].filter((r) => Boolean(r));
+    if (candidates.length === 0)
+        return undefined;
+    return sortHistoryByUpdatedDesc(candidates)[0];
 }
 export function getHistoryPath() {
-    return sqliteUnavailable ? jsonlFile : dbFile;
+    // Prefer JSONL as the durable path users can inspect/backup; SQLite is
+    // optional acceleration when better-sqlite3 is installed.
+    return jsonlFilePath();
 }
 /**
- * Clear all stored history. Returns whether the operation succeeded.
- * Used by the /privacy slash command and `clai privacy clear-history`.
+ * Clear active history after archiving a full snapshot. Never unrecoverably
+ * destroys chats — a timestamped copy is written under history-backups/ and
+ * the previous active file is moved into history-archive.jsonl.
  */
 export async function clearAllHistory() {
     let detail = "";
+    await ensureHistoryRecovered();
+    // Snapshot + move aside. Do NOT write into history-archive.jsonl here —
+    // that file is auto-reimported by recoverOrphanedHistory, which would
+    // immediately undo a clear. Intentional clears go to history-cleared-*.jsonl
+    // (and rolling backups) only.
+    try {
+        const snapshot = await readJsonlRecordsFrom(jsonlFilePath());
+        if (snapshot.length > 0) {
+            await backupActiveHistory();
+            detail += `backed up ${snapshot.length} session(s); `;
+        }
+    }
+    catch (error) {
+        detail += `backup error: ${error instanceof Error ? error.message : String(error)}; `;
+    }
     try {
         const db = await loadDatabase();
         if (db) {
@@ -356,10 +656,15 @@ export async function clearAllHistory() {
     catch (error) {
         detail += `sqlite error: ${error instanceof Error ? error.message : String(error)}; `;
     }
-    if (await safeExists(jsonlFile)) {
+    if (await safeExists(jsonlFilePath())) {
         try {
-            await rm(jsonlFile, { force: true });
-            detail += "jsonl removed";
+            // Move aside rather than unlink so crash mid-clear still leaves a file.
+            const clearedCopy = join(historyDirPath(), `history-cleared-${new Date().toISOString().replace(/[:.]/g, "-")}.jsonl`);
+            await rename(jsonlFilePath(), clearedCopy).catch(async () => {
+                await copyFile(jsonlFilePath(), clearedCopy).catch(() => undefined);
+                await rm(jsonlFilePath(), { force: true });
+            });
+            detail += `jsonl moved to ${clearedCopy} (recoverable)`;
         }
         catch (error) {
             detail += `jsonl error: ${error instanceof Error ? error.message : String(error)}`;
@@ -378,6 +683,12 @@ export async function clearAllHistory() {
     return { cleared: true, detail: detail.trim() };
 }
 export function getJsonlHistoryPath() {
-    return jsonlFile;
+    return jsonlFilePath();
+}
+export function getHistoryArchivePath() {
+    return archiveFilePath();
+}
+export function getHistoryBackupDir() {
+    return backupDirPath();
 }
 //# sourceMappingURL=history.js.map