@phnx-labs/agents-cli 1.22.25 → 1.22.26

package/dist/lib/secrets/push.js

@@ -0,0 +1,145 @@
+/**
+ * Push one bundle's values to a remote host over SSH — the provisioning
+ * primitive behind `agents secrets export --host` and, from RUSH-1968, behind
+ * `agents fleet apply --provision-secrets`.
+ *
+ * This logic used to live inline in the `export --host` command action. It moved
+ * here because `lib/fleet/apply.ts` needs it and a lib MUST NOT import a command
+ * module — and because the absence of a callable primitive is part of why
+ * `fleet apply` never provisioned secrets at all, leaving an operator to
+ * hand-export the file store's master key across the fleet.
+ *
+ * Two rules shape the shape of this module:
+ *
+ * - **It never prints.** The lib layer stays `console.*`-free (SEC-14/SEC-16), so
+ *   every outcome is returned as data and the CALLER renders it. That is also
+ *   what lets `fleet apply` fold a push into its own per-device report instead of
+ *   interleaving stray lines into it.
+ * - **Resolve once, push N times.** `resolveBundleForPush` is separate because
+ *   reading a bundle can prompt (Touch ID); doing it per host would prompt per
+ *   host. `export --host a,b,c` resolves once and pushes three times.
+ */
+import { sshExec } from '../ssh-exec.js';
+import { remoteShellFor, buildWindowsStdinImportCommand } from '../hosts/remote-cmd.js';
+import { resolveRemoteOsSync } from '../hosts/remote-os.js';
+import { remoteSecretsRaw, verifyRemoteKeychainPush, keychainWriteFailureMessage, buildRemoteFileImportCommand, } from './remote.js';
+import { readAndResolveBundleEnv } from './bundles.js';
+/**
+ * Serialize a resolved env map to `.env` lines that round-trip losslessly through
+ * `parseDotenv` on the remote: `KEY="VALUE"`. parseDotenv strips exactly one outer
+ * quote pair and takes the inner bytes verbatim (no unescaping), so any single-line
+ * value survives unchanged with no escaping. Newlines would break its line-based
+ * parse, so multi-line values are rejected rather than silently corrupted.
+ */
+export function bundleEnvToDotenv(env) {
+    const lines = [];
+    for (const [k, v] of Object.entries(env)) {
+        if (/[\r\n]/.test(v)) {
+            throw new Error(`Key '${k}' has a multi-line value; the SSH .env transport can't carry newlines. ` +
+                `Set it directly on the remote with 'agents secrets add ${k} --value-stdin'.`);
+        }
+        lines.push(`${k}="${v}"`);
+    }
+    return lines.join('\n') + '\n';
+}
+/**
+ * Read and resolve a bundle once, for pushing to one or more hosts.
+ *
+ * `agentOnly` + `keyMode: 'storage'` match what `export --host` has always
+ * passed: storage-shaped values, and the headless guard that fails fast rather
+ * than popping Touch ID inside an automated run.
+ */
+export function resolveBundleForPush(bundle, caller) {
+    const { env } = readAndResolveBundleEnv(bundle, { caller, keyMode: 'storage', agentOnly: true });
+    return { env, dotenv: bundleEnvToDotenv(env), keyCount: Object.keys(env).length };
+}
+function isPowershellTarget(host) {
+    return remoteShellFor(resolveRemoteOsSync(host.split('@').pop() ?? host)) === 'powershell';
+}
+/** Choose the transport for one push. Pure: registry read in, plan out. */
+export function planPushTransport(resolved, bundle, host, opts) {
+    const powershell = isPowershellTarget(host);
+    if (opts.remoteBackend === 'file') {
+        // Both file-backend paths build a POSIX `bash -lc` command. Refuse a Windows
+        // target cleanly rather than emit broken PowerShell (fail loud at the
+        // boundary, never a silent wrong path).
+        if (powershell) {
+            return { kind: 'refuse', message: 'file backend export to a Windows target is not yet supported' };
+        }
+        const { remoteCmd, input } = buildRemoteFileImportCommand(bundle, resolved.dotenv, {
+            passphrase: opts.passphrase ?? '',
+            force: opts.force,
+        });
+        return { kind: 'ssh', remoteCmd, input };
+    }
+    if (powershell) {
+        // Keychain on a Windows target: the `agents.ps1` shim doesn't forward
+        // ssh-piped stdin to node, so `--from -` would hang. Bridge the piped .env
+        // through PowerShell into a temp file and import `--from <file>` (deleted
+        // afterwards). Same hardened ssh engine; the .env still only ever crosses
+        // the wire over ssh stdin.
+        return {
+            kind: 'ssh',
+            remoteCmd: buildWindowsStdinImportCommand(bundle, { force: opts.force }),
+            input: resolved.dotenv,
+        };
+    }
+    // Keychain on a POSIX target: OS-aware wrapping + the hardened ssh engine
+    // (BatchMode, ConnectTimeout, keepalive, control-socket reuse) via the same
+    // path the READ inverse (`remoteResolveEnv`) uses.
+    return {
+        kind: 'remote-secrets',
+        args: ['import', bundle, '--from', '-', ...(opts.force ? ['--force'] : [])],
+        input: resolved.dotenv,
+    };
+}
+/**
+ * Push an already-resolved bundle to ONE host.
+ *
+ * Drives the remote's own `agents secrets import --from -`, so the values land
+ * in the remote's chosen backend and the .env is read off ssh stdin rather than
+ * parsed by a remote shell. `import` auto-creates the bundle.
+ */
+export function pushResolvedBundleToHost(resolved, bundle, host, opts) {
+    const fail = (message) => ({ ok: false, host, bundle, keyCount: resolved.keyCount, message });
+    const plan = planPushTransport(resolved, bundle, host, opts);
+    if (plan.kind === 'refuse')
+        return fail(plan.message);
+    const res = plan.kind === 'ssh'
+        ? sshExec(host, plan.remoteCmd, { input: plan.input })
+        : remoteSecretsRaw(host, plan.args, { input: plan.input, osLookupName: host });
+    if (res.code === null) {
+        return fail(res.stderr.trim() || (res.timedOut ? 'ssh timed out' : 'ssh failed'));
+    }
+    if (res.code !== 0) {
+        const msg = (res.stderr || res.stdout || '').trim();
+        return fail(`remote import failed (exit ${res.code})${msg ? `: ${msg}` : ''}`);
+    }
+    // A keychain-backed push to a macOS remote over headless SSH can land the
+    // bundle metadata but no READABLE value items: the remote login keychain is
+    // locked in the non-interactive SSH context, so Security accepts the write but
+    // the biometry-ACL'd item is unreadable — and the remote `import` still exits
+    // 0. Read it back the way a release will and FAIL LOUDLY, rather than leave a
+    // metadata-only bundle that breaks later with "stored item not found". The
+    // file backend is headless-readable by construction, so it is skipped.
+    if (opts.remoteBackend === 'keychain') {
+        const verdict = verifyRemoteKeychainPush(host, bundle, Object.keys(resolved.env), { osLookupName: host });
+        if (!verdict.ok) {
+            return fail(verdict.kind === 'locked-keychain'
+                ? keychainWriteFailureMessage(host, bundle, verdict.reason)
+                : `pushed '${bundle}' but could not verify it on the remote: ${verdict.reason}`);
+        }
+    }
+    const remoteMsg = (res.stdout || '').trim().split('\n').map((l) => l.trim()).filter(Boolean).pop();
+    return {
+        ok: true,
+        host,
+        bundle,
+        keyCount: resolved.keyCount,
+        message: remoteMsg || `${resolved.keyCount} key(s) exported`,
+    };
+}
+/** Resolve and push in one call — for a single host. */
+export function pushBundleToHost(bundle, host, opts) {
+    return pushResolvedBundleToHost(resolveBundleForPush(bundle, opts.operation), bundle, host, opts);
+}

package/dist/lib/secrets/reaper.d.ts

@@ -27,7 +27,12 @@ export interface KeychainProcessSnapshot {
      * `null` means "could not capture" — the planner must fail closed.
      */
     startTime: string | null;
-    /** True when this process's executable path matches the installed helper. */
+    /**
+     * True when this process is a REAP-ELIGIBLE helper invocation — the installed
+     * helper binary running a short-lived keychain verb. False for a non-helper
+     * process AND for the long-lived `watch-lock` watcher (see
+     * {@link isReapableHelperCommand}), which must never be reaped.
+     */
     isHelper: boolean;
 }
 /**
@@ -78,6 +83,15 @@ export declare function planKeychainReap(snapshots: KeychainProcessSnapshot[], n
  * Returns null for an unparseable value so the caller drops the row.
  */
 export declare function parseEtimeToSeconds(raw: string): number | null;
+/**
+ * Whether a `ps` command line is a REAP-ELIGIBLE helper invocation: the installed
+ * helper binary running a short-lived keychain verb (get/has/list/set/delete/
+ * migrate-*) that a wedged `coreauthd` can hang. Returns false for a non-helper
+ * command AND for the deliberately long-lived `watch-lock` watcher — matching by
+ * the full argv (`ps … command=`), so a live-parent `watch-lock` child is never
+ * mistaken for a stuck read and killed. Pure; unit-tested.
+ */
+export declare function isReapableHelperCommand(command: string, helperPath: string): boolean;
 /** Test seam: reset the persisted candidate state. */
 export declare function resetKeychainReaperCandidatesForTest(): void;
 /**

package/dist/lib/secrets/reaper.js

@@ -134,6 +134,31 @@ function parsePsLine(line) {
         return null;
     return { pid, ppid, elapsedSec, command };
 }
+/**
+ * The one helper verb that is DELIBERATELY long-lived: the broker's auto-lock
+ * sleep/lock watcher (`spawn(getKeychainHelperPath(), ['watch-lock'], …)` in
+ * `agent.ts`). It lives for the broker's whole hold — potentially days — as a
+ * healthy child of the live broker/daemon, emitting LOCK/SLEEP lines that wipe
+ * the in-memory secret store on sleep. It is NOT a stuck keychain read, so the
+ * reaper must never target it: killing it silently disables auto-lock-on-sleep.
+ */
+const HELPER_WATCH_LOCK_VERB = 'watch-lock';
+/**
+ * Whether a `ps` command line is a REAP-ELIGIBLE helper invocation: the installed
+ * helper binary running a short-lived keychain verb (get/has/list/set/delete/
+ * migrate-*) that a wedged `coreauthd` can hang. Returns false for a non-helper
+ * command AND for the deliberately long-lived `watch-lock` watcher — matching by
+ * the full argv (`ps … command=`), so a live-parent `watch-lock` child is never
+ * mistaken for a stuck read and killed. Pure; unit-tested.
+ */
+export function isReapableHelperCommand(command, helperPath) {
+    if (command === helperPath)
+        return true; // bare exec, no verb — never watch-lock
+    if (!command.startsWith(`${helperPath} `))
+        return false; // not our helper
+    const firstArg = command.slice(helperPath.length + 1).trimStart().split(/\s+/)[0];
+    return firstArg !== HELPER_WATCH_LOCK_VERB;
+}
 /** Module-state for the two-sweep stuck-parent debounce. */
 let stuckParentCandidates = new Map();
 /** Test seam: reset the persisted candidate state. */
@@ -178,9 +203,11 @@ export function reapOrphanedKeychainProcesses() {
         if (!parsed)
             continue;
         const { pid, ppid, elapsedSec, command } = parsed;
-        // Exact path-match: the helper invocation's command line begins with the
-        // absolute helper path, followed by a space and its arguments (or nothing).
-        const isHelper = command === helperPath || command.startsWith(`${helperPath} `);
+        // Reap-eligible = the helper binary running a short-lived keychain verb. The
+        // full-argv match excludes the deliberately long-lived `watch-lock` watcher,
+        // whose live-parent child would otherwise be killed as if it were stuck
+        // (RUSH-2232 — that silently disabled auto-lock-on-sleep).
+        const isHelper = isReapableHelperCommand(command, helperPath);
         rows.push({ pid, ppid, elapsedSec, isHelper, startTime: null });
     }
     const rowByPid = new Map(rows.map((r) => [r.pid, r]));

package/dist/lib/session/db.d.ts

@@ -7,12 +7,12 @@
  * BM25 ranking, and label-first search for /rename'd sessions.
  */
 import Database from '../sqlite.js';
-import type { SessionAgentId, SessionMeta } from './types.js';
+import type { SessionAgentId, SessionEvent, SessionMeta } from './types.js';
 import { type IndexedToolCall } from './tool-calls.js';
 /** Current schema version; bumped when migrations are added. Exported so tests
  * assert against the constant instead of hardcoding a number that every bump
  * then has to chase (docs/05-sessions.md calls the constant the source of truth). */
-export declare const SCHEMA_VERSION = 34;
+export declare const SCHEMA_VERSION = 36;
 /**
  * Bump to force `agents sessions backfill resources` to re-derive every
  * session's skill/slash-command tallies on its next run (resource_scan_ledger
@@ -26,7 +26,7 @@ export declare const RESOURCE_INDEX_VERSION = 1;
  * re-derives on the next `agents insights` instead of silently reporting stale
  * numbers alongside fresh ones. Same role as RESOURCE_INDEX_VERSION.
  */
-export declare const INSIGHTS_EXTRACTOR_VERSION = 3;
+export declare const INSIGHTS_EXTRACTOR_VERSION = 4;
 /** Raw row shape returned from the sessions table. */
 export interface SessionRow {
     id: string;
@@ -149,6 +149,23 @@ export interface FtsOptimizeResult {
  * the DB file; run VACUUM (with the daemon stopped) to return it to the OS.
  */
 export declare function optimizeSessionSearchIndex(): FtsOptimizeResult[];
+/**
+ * Keep the FTS indexes from degrading on the normal scan path.
+ *
+ * `optimizeSessionSearchIndex` is the full, unbounded compaction behind
+ * `agents sessions optimize`. Leaving it as the ONLY compaction meant the index
+ * degraded until a human happened to run that command, which is how
+ * `tool_call_text_data` reached gigabytes for tens of MB of content. This is the
+ * automatic counterpart: bounded, threshold-gated, and safe to call after every
+ * batch of writes. Non-destructive — merging never changes what is searchable.
+ *
+ * Returns one result per table it actually merged (empty when every table is
+ * under the threshold, which is the common case on a warm index).
+ */
+export declare function maintainSessionSearchIndex(db?: Database.Database, options?: {
+    segmentThreshold?: number;
+    mergePages?: number;
+}): FtsOptimizeResult[];
 /**
  * Try to claim the right to run the incremental scan. Returns true if this
  * process should proceed with scanning, false if another live process is
@@ -245,6 +262,7 @@ export declare function upsertSessionsBatch(entries: Array<{
     scan?: ScanStamp;
     parserState?: string;
     contentText?: string;
+    events?: SessionEvent[];
     toolCalls?: IndexedToolCall[];
     toolScan?: ScanStamp;
     toolIndexMode?: 'replace' | 'append';

package/dist/lib/session/db.js

@@ -26,7 +26,7 @@ const DB_PATH = getSessionsDbPath();
 /** Current schema version; bumped when migrations are added. Exported so tests
  * assert against the constant instead of hardcoding a number that every bump
  * then has to chase (docs/05-sessions.md calls the constant the source of truth). */
-export const SCHEMA_VERSION = 34;
+export const SCHEMA_VERSION = 36;
 /**
  * Bump to force `agents sessions backfill resources` to re-derive every
  * session's skill/slash-command tallies on its next run (resource_scan_ledger
@@ -204,6 +204,12 @@ CREATE TABLE IF NOT EXISTS tool_program_occurrences (
 CREATE INDEX IF NOT EXISTS idx_tool_program_occurrences_program
   ON tool_program_occurrences(program, call_key);
 
+-- Derived search index over tool_calls. call_key is UNINDEXED -- it is carried
+-- for display, NOT for lookup: an FTS5 table has no index on an ordinary column,
+-- so DELETE ... WHERE call_key = ? scans the whole index once per call, which is
+-- quadratic in a session's call count. Every write here therefore addresses a
+-- row by rowid, mirroring the tool_calls.rowid of the call it describes, so a
+-- delete is a single rowid seek (tool-store.ts persistToolCalls/deleteSessionCalls).
 CREATE VIRTUAL TABLE IF NOT EXISTS tool_call_text USING fts5(
   call_key UNINDEXED,
   tool,
@@ -224,7 +230,15 @@ CREATE TABLE IF NOT EXISTS tool_scan_ledger (
   extractor_version INTEGER NOT NULL,
   indexed_at INTEGER NOT NULL,
   call_count INTEGER NOT NULL,
-  evidence_bytes INTEGER NOT NULL
+  evidence_bytes INTEGER NOT NULL,
+  -- Resume point for the incremental tool scan. parsed_offset is the byte
+  -- offset just past the last COMPLETE newline-terminated record consumed, and
+  -- parser_state is the serialized ToolCallCollector snapshot at that offset
+  -- (next ordinal + still-unresolved calls). Together they let the next scan of
+  -- a session that only grew read the appended bytes instead of the whole file.
+  -- NULL means "no resume point" — the next scan re-reads from byte 0.
+  parser_state TEXT,
+  parsed_offset INTEGER
 );
 
 -- Skill/slash-command usage per session (#12), computed from a session's
@@ -294,7 +308,7 @@ CREATE TABLE IF NOT EXISTS session_insights (
  * re-derives on the next `agents insights` instead of silently reporting stale
  * numbers alongside fresh ones. Same role as RESOURCE_INDEX_VERSION.
  */
-export const INSIGHTS_EXTRACTOR_VERSION = 3;
+export const INSIGHTS_EXTRACTOR_VERSION = 4;
 let dbInstance = null;
 /**
  * Apply schema migrations from `fromVersion` → SCHEMA_VERSION. The new
@@ -810,6 +824,57 @@ function migrateSchema(db, fromVersion) {
       );
     `);
     }
+    if (fromVersion < 35) {
+        // v34 -> v35: the default listing sort was `ORDER BY IFNULL(last_activity,
+        // timestamp) DESC` — wrapping the column in IFNULL() makes SQLite unable to
+        // satisfy it from idx_sessions_last_activity, so every list/resume query did
+        // a full table sort instead of an index walk (RUSH-2211). Every upsert path
+        // already writes a non-NULL last_activity (resolveLastActivity falls back to
+        // `timestamp`, itself NOT NULL) — the only rows that can still be NULL here
+        // are ones written before the v8 migration that somehow slipped the backfill,
+        // or seeded directly by a test. Backfill them so the column is unconditionally
+        // NOT NULL, then querySessions can sort on the bare column and use the index.
+        db.exec(`UPDATE sessions SET last_activity = timestamp WHERE last_activity IS NULL`);
+    }
+    if (fromVersion < 36) {
+        // v35 -> v36: make the tool index incremental, and stop paying a full FTS
+        // scan per deleted call.
+        //
+        // (a) tool_scan_ledger gains a resume point (parser_state + parsed_offset).
+        //     Existing rows get NULLs, which read as "no resume point": the next
+        //     scan of each session re-reads it once from byte 0 and records a resume
+        //     point, so every scan after that is incremental. No ledger is wiped.
+        //
+        // (b) tool_call_text is rebuilt so its rowid mirrors tool_calls.rowid. The
+        //     old rows were inserted with FTS5-assigned rowids and are only
+        //     addressable by the UNINDEXED call_key, i.e. a full index scan per
+        //     delete. There is no ALTER for that, and the rowids cannot be repaired
+        //     in place, so the table is dropped and repopulated from tool_calls --
+        //     the same non-destructive derived-table rebuild v27 did (the source of
+        //     truth is tool_calls, which is untouched). The rebuild also lands the
+        //     content as one merged segment, which is the compaction
+        //     optimizeSessionSearchIndex would otherwise have to do afterwards.
+        const ledgerCols = new Set(db.prepare(`PRAGMA table_info(tool_scan_ledger)`).all()
+            .map((column) => column.name));
+        if (!ledgerCols.has('parser_state'))
+            db.exec(`ALTER TABLE tool_scan_ledger ADD COLUMN parser_state TEXT`);
+        if (!ledgerCols.has('parsed_offset'))
+            db.exec(`ALTER TABLE tool_scan_ledger ADD COLUMN parsed_offset INTEGER`);
+        db.exec(`
+      DROP TABLE IF EXISTS tool_call_text;
+      CREATE VIRTUAL TABLE tool_call_text USING fts5(
+        call_key UNINDEXED,
+        tool,
+        input,
+        output,
+        error,
+        tokenize = 'trigram'
+      );
+      INSERT INTO tool_call_text (rowid, call_key, tool, input, output, error)
+      SELECT rowid, call_key, tool, input, coalesce(output, ''), coalesce(error, '')
+      FROM tool_calls;
+    `);
+    }
 }
 /**
  * Stamp `account_key` / `account_org` / `account` on every Claude row from its
@@ -988,6 +1053,49 @@ export function optimizeSessionSearchIndex() {
         return { table, segmentsBefore, segmentsAfter: segments(table) };
     });
 }
+/**
+ * Segment count above which a scan pays for a slice of merge work. Below it the
+ * index is small enough that querying it is not the bottleneck and merging is
+ * pure overhead on every scan.
+ */
+const FTS_MAINTENANCE_SEGMENT_THRESHOLD = 512;
+/**
+ * Page budget for one incremental merge. FTS5's `'merge'` command does at most
+ * this much work and returns — it is not `'optimize'`, which merges the whole
+ * index in one unbounded pass. That bound is why this can run on the scan path:
+ * the cost per scan is fixed, and repeated scans converge the index instead of
+ * one scan stalling on a multi-gigabyte compaction.
+ */
+const FTS_MAINTENANCE_MERGE_PAGES = 64;
+/**
+ * Keep the FTS indexes from degrading on the normal scan path.
+ *
+ * `optimizeSessionSearchIndex` is the full, unbounded compaction behind
+ * `agents sessions optimize`. Leaving it as the ONLY compaction meant the index
+ * degraded until a human happened to run that command, which is how
+ * `tool_call_text_data` reached gigabytes for tens of MB of content. This is the
+ * automatic counterpart: bounded, threshold-gated, and safe to call after every
+ * batch of writes. Non-destructive — merging never changes what is searchable.
+ *
+ * Returns one result per table it actually merged (empty when every table is
+ * under the threshold, which is the common case on a warm index).
+ */
+export function maintainSessionSearchIndex(db = getDB(), options = {}) {
+    const threshold = options.segmentThreshold ?? FTS_MAINTENANCE_SEGMENT_THRESHOLD;
+    const pages = options.mergePages ?? FTS_MAINTENANCE_MERGE_PAGES;
+    // Hardcoded literals — never interpolate caller input into an identifier.
+    const tables = ['tool_call_text', 'session_text'];
+    const segments = (table) => db.prepare(`SELECT count(*) AS n FROM ${table}_data`).get().n;
+    const results = [];
+    for (const table of tables) {
+        const segmentsBefore = segments(table);
+        if (segmentsBefore < threshold)
+            continue;
+        db.prepare(`INSERT INTO ${table}(${table}, rank) VALUES('merge', ?)`).run(pages);
+        results.push({ table, segmentsBefore, segmentsAfter: segments(table) });
+    }
+    return results;
+}
 // ---------------------------------------------------------------------------
 // Scan coordinator — prevents concurrent full scans across processes
 // ---------------------------------------------------------------------------
@@ -1627,9 +1735,10 @@ export function upsertSessionsBatch(entries) {
                     const stat = fs.statSync(toolSourcePath);
                     return { fileMtimeMs: stat.mtimeMs, fileSize: stat.size };
                 })();
-            // Non-resumable harnesses already parse here for todos/recent dirs. Derive
-            // the tool index from those same in-memory events: no second file read.
-            const events = parseSession(entry.meta.filePath, entry.meta.agent);
+            // Some non-resumable scanners already normalized the transcript while
+            // deriving metadata. Reuse those events; scanners that only read summary
+            // metadata fall back to exactly one normalized parse here.
+            const events = entry.events ?? parseSession(entry.meta.filePath, entry.meta.agent);
             writeResourceUsage(entry.meta.id, events, entry.meta.cwd);
             return {
                 ...entry,
@@ -1640,6 +1749,8 @@ export function upsertSessionsBatch(entries) {
                 },
                 toolCalls: toolCallsFromEvents(events),
                 toolScan,
+                // These are complete event arrays, not an appended tail. Append would
+                // duplicate existing evidence even when persistToolCalls supports it.
                 toolIndexMode: 'replace',
             };
         }
@@ -1773,12 +1884,18 @@ export function upsertSessionsBatch(entries) {
         if (!toolScan || !entry.toolCalls)
             continue;
         try {
-            persistToolCalls(db, entry.meta, entry.toolCalls, toolScan, entry.toolIndexMode ?? 'replace');
+            persistToolCalls(db, entry.meta, entry.toolCalls, toolScan, { mode: entry.toolIndexMode ?? 'replace' });
         }
         catch {
             // Boundary is intentionally retryable via tool_scan_ledger.
         }
     }
+    // Every batch appends FTS segments (session_text always, tool_call_text for the
+    // harnesses indexed above). Pay a bounded slice of the merge here so the
+    // scan path keeps its own index healthy instead of leaving all compaction to
+    // the manual `agents sessions optimize` (RUSH-2208). Threshold-gated, so a
+    // small index costs two counts and nothing else.
+    maintainSessionSearchIndex(db);
 }
 /**
  * Sync labels for a set of sessions. For each id in the map, if the stored
@@ -2118,6 +2235,51 @@ function buildSessionWhere(options) {
     const clause = where.length > 0 ? `WHERE ${where.join(' AND ')}` : '';
     return { clause, params };
 }
+/**
+ * Resolve which of the given file paths no longer exist, batching the check
+ * per directory instead of one `fs.existsSync` stat syscall per file.
+ * Transcript trees put many sessions in the same directory (one Claude
+ * `~/.claude/projects/<slug>/` holds every session for that project), so
+ * `readdirSync` once per directory and a Set membership test collapses what
+ * used to be N stat syscalls into (number of distinct directories) readdir
+ * syscalls — the same existence answer, far fewer syscalls on a large index
+ * (RUSH-2211). Falls back to per-file existsSync only when the directory
+ * itself can't be listed (permissions, race with a concurrent delete).
+ */
+function findMissingFilePaths(filePaths) {
+    const byDir = new Map();
+    for (const p of filePaths) {
+        const dir = path.dirname(p);
+        let basenames = byDir.get(dir);
+        if (!basenames) {
+            basenames = new Set();
+            byDir.set(dir, basenames);
+        }
+        basenames.add(path.basename(p));
+    }
+    const missing = new Set();
+    for (const [dir, basenames] of byDir) {
+        let entries;
+        try {
+            entries = new Set(fs.readdirSync(dir));
+        }
+        catch {
+            // Directory itself is gone (or unreadable) — every file in it is missing.
+            // Also covers the race where readdir loses to a concurrent delete: fall
+            // back to a direct stat rather than assuming existence.
+            for (const base of basenames) {
+                if (!fs.existsSync(path.join(dir, base)))
+                    missing.add(path.join(dir, base));
+            }
+            continue;
+        }
+        for (const base of basenames) {
+            if (!entries.has(base))
+                missing.add(path.join(dir, base));
+        }
+    }
+    return missing;
+}
 /** Query sessions from the database, applying filters and ordering by last-activity descending (default). */
 export function querySessions(options = {}) {
     const db = getDB();
@@ -2130,11 +2292,18 @@ export function querySessions(options = {}) {
         : '';
     // NULLs last so unpriced / duration-less rows never crowd out real data when
     // sorting by cost or duration. timestamp is never null (NOT NULL column).
+    // Default sort is the bare `last_activity` column, not `IFNULL(last_activity,
+    // timestamp)` — the v35 migration backfills every row so last_activity is
+    // never NULL, and every upsert path (resolveLastActivity) keeps it that way
+    // going forward. Wrapping the column in IFNULL() defeats
+    // idx_sessions_last_activity (SQLite can't use an index on an expression that
+    // isn't the bare column); the bare column lets the planner walk the index
+    // instead of sorting the whole result set (RUSH-2211).
     const orderClause = options.sortBy === 'cost'
         ? 'ORDER BY cost_usd IS NULL, cost_usd DESC, timestamp DESC'
         : options.sortBy === 'duration'
             ? 'ORDER BY duration_ms IS NULL, duration_ms DESC, timestamp DESC'
-            : 'ORDER BY IFNULL(last_activity, timestamp) DESC, timestamp DESC';
+            : 'ORDER BY last_activity DESC, timestamp DESC';
     const sql = `SELECT * FROM sessions ${clause} ${orderClause} ${limitClause}`;
     const rows = db.prepare(sql).all(...params);
     if (options.skipExistenceCheck) {
@@ -2147,7 +2316,8 @@ export function querySessions(options = {}) {
     // surfacing in the Factory UI if any code path forgets to rewrite (#136).
     // Synthetic rows (OpenClaw channels/cron — see scanOpenClawIncremental) carry
     // an empty file_path and are exempt; they're keyed by CLI output, not files.
-    const missing = rows.filter(r => r.file_path && !fs.existsSync(r.file_path));
+    const missingPaths = findMissingFilePaths(rows.map(r => r.file_path).filter((p) => !!p));
+    const missing = rows.filter(r => r.file_path && missingPaths.has(r.file_path));
     if (missing.length > 0) {
         const purge = db.transaction(() => {
             for (const row of missing)
@@ -2628,6 +2798,20 @@ export function buildFtsQuery(input) {
     const expr = terms.map(t => `${t}*`).join(' OR ');
     return { expr, terms };
 }
+/**
+ * Build a `label:(...)` FTS5 column-filter MATCH expression for the label
+ * tier. Unlike `buildFtsQuery` (2-char floor, tuned for full-content search),
+ * this allows 1-char terms: label search is the interactive type-ahead path —
+ * the query grows one keystroke at a time, so a single character has to be
+ * indexable too. Terms are filtered to `[a-z0-9]` before being embedded in the
+ * expression string, so there's no FTS5 syntax injection from user input.
+ */
+function buildLabelFtsQuery(input) {
+    const terms = input.toLowerCase().split(/[^a-z0-9]+/).filter(t => t.length >= 1);
+    if (terms.length === 0)
+        return '';
+    return `label:(${terms.map(t => `${t}*`).join(' OR ')})`;
+}
 /**
  * Label-first search. Sessions whose custom label substring-matches the query
  * always rank ahead of FTS5 hits — this gives predictable behavior when a user
@@ -2655,10 +2839,34 @@ export function ftsSearch(input, limit = 200) {
     // its `label` — set by an agent title / `/rename`, or seeded at launch from
     // `agents run --name`. Typing it resolves the session ahead of any FTS content
     // hit.
-    const labelRows = db.prepare(`
-    SELECT id, label FROM sessions
-    WHERE label IS NOT NULL AND LOWER(label) LIKE ?
-  `).all(`%${lower}%`);
+    //
+    // Candidates come from the FTS5 `label` column, not a raw `LOWER(label) LIKE
+    // '%q%'` scan of `sessions`: a leading wildcard can't use any index, so on a
+    // large session table that was a full-table scan on every keystroke of
+    // interactive search (RUSH-2211). `session_text.label` is kept 1:1 with
+    // `sessions.label` by every upsert path (storedFtsLabel), so this is the
+    // same data, indexed. Token-prefix matching seeks the FTS index instead of
+    // scanning every row, at the cost of only matching at token boundaries — a
+    // substring inside a single token (e.g. "ckf" inside "quickfix") no longer
+    // matches, since FTS5 only indexes prefixes of whole tokens, not arbitrary
+    // interior slices. (A slice spanning a token boundary, like "ix-b" inside
+    // "fix-bug", still matches: "ix-b" tokenizes to "ix" + "b", and "b" is a
+    // valid prefix of the "bug" token.) That's the accepted trade-off for an
+    // indexable interactive path; the exact/prefix/contains scoring below still
+    // runs in JS over the FTS candidate set, so ranking among real matches is
+    // unchanged. Only a query with no indexable token (rare — e.g.
+    // punctuation-only input) falls back to the direct scan rather than
+    // silently dropping the tier.
+    const labelMatchExpr = buildLabelFtsQuery(input);
+    const labelRows = labelMatchExpr
+        ? db.prepare(`
+        SELECT session_id AS id, label FROM session_text
+        WHERE session_text MATCH ?
+      `).all(labelMatchExpr)
+        : db.prepare(`
+        SELECT id, label FROM sessions
+        WHERE label IS NOT NULL AND LOWER(label) LIKE ?
+      `).all(`%${lower}%`);
     let hasExactLabelMatch = false;
     for (const row of labelRows) {
         // Score the label by match quality (exact > prefix > contains).

package/dist/lib/session/discover.d.ts

@@ -690,6 +690,7 @@ export declare function __resetCodexScanBranchCountsForTest(): void;
 export declare function readCursorMeta(filePath: string, currentVersion?: string): {
     meta: SessionMeta;
     content: string;
+    events: SessionEvent[];
 } | null;
 /** Parse a single Kimi session state.json file to extract session metadata. */
 export declare function readKimiMeta(filePath: string, priorRow?: {