@phnx-labs/agents-cli 1.22.68 → 1.22.70

package/dist/lib/secrets/filestore.d.ts

@@ -207,6 +207,10 @@ export declare function _resetFileStoreForTest(opts?: {
     passphraseDir?: string | null;
     passphrase?: string | null;
 }): void;
+/** Test-only: flush the in-memory metadata cache to disk now. Production flushes
+ *  once at process exit; a test needs the on-disk copy mid-run to simulate the
+ *  next `agents` process reading it. */
+export declare function _flushMetaCacheForTest(): void;
 /** Test-only: shorten the store-lock acquire timeout so a contended-lock assertion
  *  fails fast instead of waiting out the 30s production budget. */
 export declare function _setFileStoreLockTimeoutForTest(ms: number | null): void;

package/dist/lib/secrets/filestore.js

@@ -21,7 +21,7 @@
  * item and its keychain twin carry identical names:
  *   `agents-cli.bundles.<name>` and `agents-cli.secrets.<bundle>.<key>`.
  */
-import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'crypto';
+import { createCipheriv, createDecipheriv, createHash, randomBytes, scryptSync } from 'crypto';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -210,6 +210,128 @@ export function decryptForFallback(enc, passphrase) {
     const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
     return plaintext.toString('utf8');
 }
+// ---------- bundle-metadata plaintext cache (PHNX-3585) ----------
+//
+// Enumerating file-backed bundles — `agents secrets list`, and the
+// account-rotation `readAccountRegistry` on the `agents run` hot path — decrypts
+// EVERY bundle's metadata item, and each decrypt runs a fresh scrypt KDF (~12ms)
+// because every `.enc` file carries its own random salt. On a box with dozens of
+// bundles that is hundreds of ms of pure KDF before the harness even starts (the
+// ~0.55s New-Claude boot cost in PHNX-3585).
+//
+// Bundle METADATA is non-secret by contract (secrets/bundles.ts `writeBundle`:
+// "Metadata is non-sensitive by contract", stored no-ACL so `secrets list`
+// enumerates without Touch ID) — the vars hold `keychain:`/`env:`/literal REFS,
+// never the secret bytes, which live in separate `agents-cli.secrets.<bundle>.*`
+// value items. So its decrypted JSON is safe to cache in cleartext, at the SAME
+// 0600 protection as the ciphertext beside it.
+//
+// The cache keys each entry on the `.enc` file's (mtimeMs,size) plus a
+// passphrase fingerprint, so ANY bundle write (new mtime/size) or passphrase
+// change (new fingerprint; rotation also re-writes every file) misses and
+// re-derives — no staleness, self-healing on any miss. It is scoped to the
+// metadata namespace ONLY (`agents-cli.bundles.`); secret VALUE items are never
+// read through it, so no secret is ever written to the cache.
+const META_ITEM_PREFIX = 'agents-cli.bundles.';
+function isMetaItem(item) {
+    return item.startsWith(META_ITEM_PREFIX);
+}
+let metaCache = null;
+let metaCacheDirty = false;
+let metaCacheFlushRegistered = false;
+function metaCachePath() {
+    // A SIBLING of the store dir, never inside it — the same rule the store lock
+    // above follows, so a rotation's store-dir rename / `.rotate-*` sweep never
+    // moves or reaps it. Under `~/.agents/.cache/`, so it is machine-local and
+    // never enters `agents repo push/pull`.
+    return `${fileDir()}.meta-cache.json`;
+}
+function passphraseFingerprint() {
+    // Non-reversible tag, never the passphrase itself — so a passphrase change
+    // invalidates the cache without the key ever landing on disk in the clear.
+    return createHash('sha256').update(getPassphrase()).digest('hex').slice(0, 16);
+}
+function loadMetaCache() {
+    if (metaCache)
+        return metaCache;
+    const keyFp = passphraseFingerprint();
+    try {
+        const doc = JSON.parse(fs.readFileSync(metaCachePath(), 'utf8'));
+        if (doc && doc.v === 1 && doc.keyFp === keyFp && doc.entries && typeof doc.entries === 'object') {
+            metaCache = doc;
+            return metaCache;
+        }
+    }
+    catch {
+        /* absent or corrupt — rebuild from scratch */
+    }
+    metaCache = { v: 1, keyFp, entries: {} };
+    return metaCache;
+}
+/** Decrypted metadata for `item` if the cache holds a fresh entry, else null. */
+function metaCacheGet(item, fp) {
+    let st;
+    try {
+        st = fs.statSync(fp);
+    }
+    catch {
+        return null;
+    }
+    const e = loadMetaCache().entries[item];
+    return e && e.mtimeMs === st.mtimeMs && e.size === st.size ? e.plain : null;
+}
+/** Record freshly-decrypted metadata for `item`, flushed once at process exit.
+ *  `snapshot` is the pre-readFileSync stat — the identity of the bytes just
+ *  decrypted. Skip the put if a post-decrypt stat does not match: a concurrent
+ *  writer during scrypt must not pin that plaintext to the new file identity. */
+function metaCachePut(item, fp, plain, snapshot) {
+    try {
+        const now = fs.statSync(fp);
+        if (now.mtimeMs !== snapshot.mtimeMs || now.size !== snapshot.size)
+            return;
+    }
+    catch {
+        return;
+    }
+    loadMetaCache().entries[item] = { mtimeMs: snapshot.mtimeMs, size: snapshot.size, plain };
+    metaCacheDirty = true;
+    if (!metaCacheFlushRegistered) {
+        metaCacheFlushRegistered = true;
+        process.on('exit', flushMetaCache);
+    }
+}
+/** Drop a cached entry the moment its file is rewritten or removed, so a
+ *  same-process write→read never returns pre-write metadata (mtime/size alone
+ *  can collide within a millisecond on an unchanged-length rewrite). */
+function metaCacheEvict(item) {
+    if (!isMetaItem(item))
+        return;
+    const cache = metaCache;
+    if (cache && cache.entries[item]) {
+        delete cache.entries[item];
+        metaCacheDirty = true;
+    }
+}
+function flushMetaCache() {
+    if (!metaCacheDirty || !metaCache)
+        return;
+    metaCacheDirty = false;
+    // Prune entries whose `.enc` file is gone so churn can't grow the cache without
+    // bound; a surviving stale entry would re-validate against mtime/size anyway.
+    for (const item of Object.keys(metaCache.entries)) {
+        if (!fs.existsSync(fileFor(item)))
+            delete metaCache.entries[item];
+    }
+    try {
+        ensureFileDir();
+        const tmp = `${metaCachePath()}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, JSON.stringify(metaCache), { mode: 0o600 });
+        fs.renameSync(tmp, metaCachePath());
+    }
+    catch {
+        /* the cache is advisory — a write failure just re-derives next run */
+    }
+}
 // ---------- file backend ----------
 function fileFor(item) {
     return path.join(fileDir(), `${item}.enc`);
@@ -226,6 +348,26 @@ function fileGet(item) {
     if (!fs.existsSync(fp)) {
         throw new Error(`Secret '${item}' not found in encrypted store.`);
     }
+    // Non-secret metadata short-circuits the scrypt decrypt when the file is
+    // unchanged (see the cache block above). Secret VALUE items skip the cache
+    // entirely, so they always decrypt fresh and never touch cleartext storage.
+    const metaItem = isMetaItem(item);
+    if (metaItem) {
+        const hit = metaCacheGet(item, fp);
+        if (hit !== null)
+            return hit;
+    }
+    // Identity of the bytes we are about to decrypt. A post-decrypt stat would
+    // attribute this plaintext to a concurrent writer's new file.
+    let snapshot;
+    if (metaItem) {
+        try {
+            snapshot = fs.statSync(fp);
+        }
+        catch {
+            snapshot = undefined;
+        }
+    }
     const raw = fs.readFileSync(fp, 'utf8');
     let parsed;
     try {
@@ -234,12 +376,16 @@ function fileGet(item) {
     catch {
         throw new Error(`Encrypted secret file ${fp} is corrupt (not valid JSON).`);
     }
+    let plain;
     try {
-        return decryptForFallback(parsed, getPassphrase());
+        plain = decryptForFallback(parsed, getPassphrase());
     }
     catch {
         throw new Error(`Failed to decrypt '${item}'. Wrong AGENTS_SECRETS_PASSPHRASE or tampered file.`);
     }
+    if (metaItem && snapshot)
+        metaCachePut(item, fp, plain, snapshot);
+    return plain;
 }
 function fileGetBatch(items) {
     const out = new Map();
@@ -262,12 +408,13 @@ function fileSet(item, value) {
         const enc = encryptForFallback(value, getPassphrase());
         fs.writeFileSync(fileFor(item), JSON.stringify(enc), { mode: 0o600 });
     });
+    metaCacheEvict(item);
 }
 function fileDelete(item) {
     const fp = fileFor(item);
     if (!fs.existsSync(fp))
         return true; // idempotent, matches secret-tool clear
-    return withStoreLock(() => {
+    const deleted = withStoreLock(() => {
         // Re-check under the lock — a rotation may have swapped the dir since the
         // pre-lock existence probe above.
         if (!fs.existsSync(fp))
@@ -275,6 +422,8 @@ function fileDelete(item) {
         fs.unlinkSync(fp);
         return true;
     });
+    metaCacheEvict(item);
+    return deleted;
 }
 function fileList(prefix) {
     const dir = fileDir();
@@ -921,6 +1070,18 @@ export function _resetFileStoreForTest(opts = {}) {
     warnedAutoPassphrase = false;
     lockAcquireTimeoutMsOverride = null;
     lockStaleMsOverride = null;
+    // Drop the in-memory metadata cache so a test that repoints the store dir or
+    // passphrase never reads another fixture's cached plaintext (the on-disk cache
+    // is per-dir and keyed by the passphrase fingerprint, so it self-invalidates
+    // too, but the process-level map must be cleared explicitly).
+    metaCache = null;
+    metaCacheDirty = false;
+}
+/** Test-only: flush the in-memory metadata cache to disk now. Production flushes
+ *  once at process exit; a test needs the on-disk copy mid-run to simulate the
+ *  next `agents` process reading it. */
+export function _flushMetaCacheForTest() {
+    flushMetaCache();
 }
 /** Test-only: shorten the store-lock acquire timeout so a contended-lock assertion
  *  fails fast instead of waiting out the 30s production budget. */

package/dist/lib/session/active.d.ts

@@ -410,6 +410,16 @@ export interface ActiveSession {
      * once a session id resolves (the id is the identity then).
      */
     paneId?: string;
+    /**
+     * The `ag-<agent>-<shortid>` tmux session name this row was discovered under,
+     * when it came from the tmux source. Kept even when the full session id could
+     * NOT be resolved (the row's `sessionId` is then absent), because the name's
+     * `<shortid>` suffix is the only stable selector such a row exposes — it is
+     * what `agents sessions --active` prints as the tmux target and what
+     * `agents sessions inject <shortid>` matches on to nudge an id-less remote
+     * session (PHNX-3688). Absent for non-tmux rows.
+     */
+    tmuxName?: string;
 }
 export declare function activeStatusFromCloudStatus(status: CloudTaskStatus): ActiveStatus;
 interface ActiveQueryOptions {

package/dist/lib/session/active.js

@@ -1777,6 +1777,9 @@ export async function listTmuxAgentSessions() {
             // An id-less pane keys its dedupe on the unique pane, so two anonymous
             // co-located panes stay two rows instead of folding into one.
             paneId: id.sessionId ?? sessionIdFromFile(sessionFile) ? undefined : pane,
+            // The tmux session name is the one selector an id-less row still exposes —
+            // its `<shortid>` suffix is what `sessions inject` matches on (PHNX-3688).
+            tmuxName: sessName,
         }, state, sessionFile, pidAlive));
     }
     return out;

package/dist/lib/session/cloud.js

@@ -15,6 +15,7 @@ import * as os from 'os';
 import * as yaml from 'yaml';
 import { deriveShortId } from '../text/short-id.js';
 import { getCacheDir } from '../state.js';
+import { isRushSessionExpired } from '../rush-session.js';
 const PROXY_BASE = process.env.RUSH_PROXY_BASE ?? 'https://api.prix.dev';
 const USER_YAML = path.join(os.homedir(), '.rush', 'user.yaml');
 const CLOUD_CACHE_DIR = path.join(getCacheDir(), 'cloud-runs');
@@ -30,7 +31,7 @@ function readToken() {
         throw new Error('No session token in ~/.rush/user.yaml. Run `rush login` first.');
     }
     const expiresAt = data.session?.expires_at;
-    if (typeof expiresAt === 'number' && expiresAt <= Date.now() / 1000) {
+    if (isRushSessionExpired(expiresAt)) {
         const expiredAt = new Date(expiresAt * 1000).toISOString();
         throw new Error(`Rush session expired at ${expiredAt}. Run \`rush login\` to refresh.`);
     }

package/dist/lib/session/db.d.ts

@@ -27,8 +27,10 @@ export declare const SCHEMA_VERSION = 45;
  *
  * v3 (PHNX-3621) invalidates OpenCode rows that merged v2 stamped before its
  * genuine first-user-turn extractor was added.
+ * v4 (PHNX-3621 leftover) invalidates Grok rows stamped before the bounded
+ * chat_history.jsonl prefix read filled firstUserMessage.
  */
-export declare const CONTENT_INDEX_VERSION = 3;
+export declare const CONTENT_INDEX_VERSION = 4;
 /**
  * Bumping this invalidates every cached facet row without touching the schema
  * version, so a change to the extraction logic (a new metric, a corrected bucket)
@@ -623,6 +625,15 @@ export declare function findSessionMachinesByIds(ids: string[]): Map<string, str
 export declare function getSessionById(id: string): SessionMeta | null;
 /** Exact ids win over prefixes; the normal existence check preserves archived content but excludes phantoms. */
 export declare function findSessionsById(idQuery: string, scope?: Pick<QueryOptions, 'agent' | 'version' | 'cwd' | 'project'>): SessionMeta[];
+/**
+ * Upgrade a session-id crumb to the full indexed id. The 8-char hex `short_id`
+ * a "Sent from …" footer shows would 404 as a `…/console/sessions/<id>` URL, so
+ * an owner ping resolves it through the index first (PHNX-3698). A value that is
+ * already a full id (or any non-crumb shape, e.g. a native `ses_…` id), or a
+ * crumb the index cannot resolve, is returned unchanged — the caller keeps
+ * exactly what it had rather than getting a fabricated id.
+ */
+export declare function resolveFullSessionId(idOrCrumb: string | undefined): string | undefined;
 /** Batch-resolve pane short ids; on collision the most recently active session wins. */
 export declare function findSessionsByShortIds(shortIds: string[]): Map<string, SessionMeta>;
 /** A single full-text search result with ranking score. */

package/dist/lib/session/db.js

@@ -42,8 +42,10 @@ export const SCHEMA_VERSION = 45;
  *
  * v3 (PHNX-3621) invalidates OpenCode rows that merged v2 stamped before its
  * genuine first-user-turn extractor was added.
+ * v4 (PHNX-3621 leftover) invalidates Grok rows stamped before the bounded
+ * chat_history.jsonl prefix read filled firstUserMessage.
  */
-export const CONTENT_INDEX_VERSION = 3;
+export const CONTENT_INDEX_VERSION = 4;
 /**
  * Bump to force `agents sessions backfill resources` to re-derive every
  * session's skill/slash-command tallies on its next run (resource_scan_ledger
@@ -3711,6 +3713,23 @@ export function findSessionsById(idQuery, scope = {}) {
         return exact;
     return querySessions({ ...scope, idPrefix: q });
 }
+/**
+ * Upgrade a session-id crumb to the full indexed id. The 8-char hex `short_id`
+ * a "Sent from …" footer shows would 404 as a `…/console/sessions/<id>` URL, so
+ * an owner ping resolves it through the index first (PHNX-3698). A value that is
+ * already a full id (or any non-crumb shape, e.g. a native `ses_…` id), or a
+ * crumb the index cannot resolve, is returned unchanged — the caller keeps
+ * exactly what it had rather than getting a fabricated id.
+ */
+export function resolveFullSessionId(idOrCrumb) {
+    const id = idOrCrumb?.trim();
+    if (!id)
+        return undefined;
+    if (!/^[0-9a-f]{8}$/i.test(id))
+        return id; // already a full id (or non-hex shape) — nothing to resolve
+    const hit = findSessionsByShortIds([id]).get(id.toLowerCase());
+    return hit?.id ?? id;
+}
 /** Batch-resolve pane short ids; on collision the most recently active session wins. */
 export function findSessionsByShortIds(shortIds) {
     const out = new Map();

package/dist/lib/session/discover.js

@@ -2050,6 +2050,7 @@ async function scanOpenCodeIncremental(onProgress) {
         fileSize: stat.size,
     };
     const prev = getScanStampByPath(OPENCODE_DB);
+    const extractorUpgrade = prev != null && prev.extractorVersion !== CONTENT_INDEX_VERSION;
     // OpenCode has a shared database rather than one transcript file per session,
     // so this container-level gate must honor extractor-version invalidation too.
     if (prev &&
@@ -2132,7 +2133,7 @@ async function scanOpenCodeIncremental(onProgress) {
       ) stats ON stats.session_id = s.id
       WHERE s.parent_id IS NULL
       ORDER BY time_created DESC
-      LIMIT 1000;
+      ${extractorUpgrade ? '' : 'LIMIT 1000'};
     `.replace(/\n/g, ' ');
         const account = getOpenCodeAccount();
         const rows = db.prepare(query).all();
@@ -4871,6 +4872,84 @@ async function scanGrokIncremental(onProgress) {
     upsertSessionsBatch(scanEntries);
     recordScans(touched);
 }
+/**
+ * Bounded read of a Grok `chat_history.jsonl` for the genuine full first user
+ * turn (PHNX-3621 leftover from #3359). Grok's cheap scan reads only
+ * `summary.json` (a LARGE-transcript harness whose full message log is
+ * deliberately not parsed on the hot tick), but the first turn is at the START
+ * of the log, so a bounded prefix read recovers it without paying the full-file
+ * cost. Production logs lead with a `type:system` record, then a huge
+ * `<user_info>` user dump (no `synthetic_reason`), then a `synthetic_reason`
+ * reminder, then the originating turn at `prompt_index: 0` wrapped in
+ * `<user_query>`. Skip that scaffolding and prefer `prompt_index` when present.
+ * Returns undefined when no genuine user turn appears within the budget.
+ */
+function readGrokFirstUserMessage(sessionDir, maxBytes = 262_144) {
+    const historyPath = path.join(sessionDir, 'chat_history.jsonl');
+    let fd;
+    try {
+        const stat = safeStatSync(historyPath);
+        if (!stat)
+            return undefined;
+        const bytesToRead = Math.min(maxBytes, stat.size);
+        if (bytesToRead <= 0)
+            return undefined;
+        const buf = Buffer.allocUnsafe(bytesToRead);
+        fd = fs.openSync(historyPath, 'r');
+        let read = 0;
+        while (read < bytesToRead) {
+            const n = fs.readSync(fd, buf, read, bytesToRead - read, read);
+            if (n <= 0)
+                break;
+            read += n;
+        }
+        const chunk = buf.subarray(0, read).toString('utf-8');
+        // Drop a trailing partial line so we never parse half a JSON record.
+        const lastNl = chunk.lastIndexOf('\n');
+        const complete = lastNl === -1 ? chunk : chunk.slice(0, lastNl);
+        let firstGenuine;
+        for (const line of complete.split('\n')) {
+            if (!line.trim())
+                continue;
+            let msg;
+            try {
+                msg = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (msg?.type !== 'user')
+                continue;
+            if (msg.synthetic_reason)
+                continue;
+            const raw = msg.content;
+            const text = typeof raw === 'string'
+                ? raw
+                : Array.isArray(raw)
+                    ? raw.map((p) => (typeof p?.text === 'string' ? p.text : '')).join('')
+                    : '';
+            const genuine = cleanFirstUserMessage(text);
+            if (!genuine)
+                continue;
+            if (msg.prompt_index != null)
+                return genuine;
+            if (!firstGenuine)
+                firstGenuine = genuine;
+        }
+        return firstGenuine;
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch { /* already closed / gone */ }
+        }
+    }
+}
 /** Parse a single Grok session summary.json into session metadata. */
 export function readGrokMeta(filePath, currentVersion) {
     let summary;
@@ -4923,6 +5002,7 @@ export function readGrokMeta(filePath, currentVersion) {
         filePath,
         version: resolveSessionVersion('grok', filePath, embeddedVersion, currentVersion),
         topic,
+        firstUserMessage: readGrokFirstUserMessage(sessionDir),
         messageCount,
     };
     return { meta, content: topic || '' };

package/dist/lib/session/linear.d.ts

@@ -1,3 +1,16 @@
+/**
+ * Team prefixes that match the key shape but are not trackers — unit strings and
+ * common acronyms. Canonical here (the Linear module) so both the URL linkifier
+ * and the session-transcript ticket detector (`detectTicket` in `state.ts`) agree
+ * on what is a real key rather than each keeping its own copy.
+ */
+export declare const LINEAR_KEY_DENYLIST: ReadonlySet<string>;
+/**
+ * Every distinct real Linear key mentioned in free text, in first-seen order.
+ * Honours {@link LINEAR_KEY_DENYLIST} so `UTF-8` / `X86-64` never count. Used to
+ * linkify ticket ids an owner ping only names in prose (no `session.ticketId`).
+ */
+export declare function linearIssueKeys(text: string | undefined): string[];
 /** The configured Linear workspace slug, or undefined when unknown. Cached per process. */
 export declare function linearWorkspace(): string | undefined;
 /** Canonical Linear issue URL for a tracker key, or undefined if unresolvable. */

package/dist/lib/session/linear.js

@@ -16,6 +16,50 @@ import os from 'node:os';
 import path from 'node:path';
 /** A Linear tracker key: `TEAM-N`, e.g. `RUSH-1234`. Mirrors the detector's shape. */
 const LINEAR_KEY_RE = /^[A-Z]{2,6}-\d{1,6}$/;
+/**
+ * The same key, matched inside free text on word boundaries. Uppercase-only team
+ * key (2–6 letters) so a lowercase `utf-8` can't masquerade as a ticket. Global
+ * so {@link linearIssueKeys} can pull every mention out of a body.
+ */
+const LINEAR_KEY_IN_TEXT_RE = /\b([A-Z]{2,6}-\d{1,6})\b/g;
+/**
+ * Team prefixes that match the key shape but are not trackers — unit strings and
+ * common acronyms. Canonical here (the Linear module) so both the URL linkifier
+ * and the session-transcript ticket detector (`detectTicket` in `state.ts`) agree
+ * on what is a real key rather than each keeping its own copy.
+ */
+export const LINEAR_KEY_DENYLIST = new Set([
+    'UTF',
+    'SHA',
+    'ISO',
+    'RFC',
+    'IPV',
+    'X86',
+    'ARM',
+    'MP',
+    'H',
+]);
+/**
+ * Every distinct real Linear key mentioned in free text, in first-seen order.
+ * Honours {@link LINEAR_KEY_DENYLIST} so `UTF-8` / `X86-64` never count. Used to
+ * linkify ticket ids an owner ping only names in prose (no `session.ticketId`).
+ */
+export function linearIssueKeys(text) {
+    if (!text)
+        return [];
+    const seen = new Set();
+    const keys = [];
+    for (const m of text.matchAll(LINEAR_KEY_IN_TEXT_RE)) {
+        const key = m[1];
+        if (LINEAR_KEY_DENYLIST.has(key.split('-')[0]))
+            continue;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        keys.push(key);
+    }
+    return keys;
+}
 // `undefined` = not yet resolved; `null` = resolved-but-unknown (skip re-reading).
 let workspaceCache;
 /** The configured Linear workspace slug, or undefined when unknown. Cached per process. */

package/dist/lib/session/live-metadata.js

@@ -49,6 +49,7 @@ export function activeSessionToSessionMeta(active, self, nowMs) {
         project: active.project ?? undefined,
         label: active.label,
         topic: active.topic,
+        firstUserMessage: active.firstUserMessage,
         version: active.version,
         messageCount: undefined,
         machine: active.machine ?? self,

package/dist/lib/session/parse.js

@@ -10,7 +10,7 @@ import { truncate } from '../format.js';
 import { sanitizeForTerminal } from '../redact.js';
 import * as path from 'path';
 import Database from '../sqlite.js';
-import { isSyntheticUserMessage, extractSlashCommandName, extractSlashCommandFromToolInput } from './prompt.js';
+import { isSyntheticUserMessage, extractSlashCommandName, extractSlashCommandFromToolInput, unwrapUserQuery } from './prompt.js';
 import { structuredToolResult, commandsFromCodexExec } from './tool-calls.js';
 /**
  * Largest session file we will load into memory. Above this we throw a clean
@@ -1989,9 +1989,8 @@ export function parseCursor(filePath) {
  * differs from the one that wrote the transcript.
  */
 function parseCursorUserText(text) {
-    const query = text.match(/<user_query>\s*([\s\S]*?)\s*<\/user_query>/);
     const stamp = text.match(/<timestamp>\s*([\s\S]*?)\s*<\/timestamp>/)?.[1]?.trim();
-    return { text: (query?.[1] ?? text).trim(), timestamp: parseCursorTimestamp(stamp) };
+    return { text: unwrapUserQuery(text), timestamp: parseCursorTimestamp(stamp) };
 }
 function parseCursorTimestamp(stamp) {
     if (!stamp)

package/dist/lib/session/prompt.d.ts

@@ -13,12 +13,18 @@ import type { SessionEvent } from './types.js';
  * own scaffolding at parse time simply never reach here.
  */
 export declare function isSyntheticUserMessage(raw: string | undefined): boolean;
+/**
+ * Inner text of a `<user_query>` wrapper, or the original string if none.
+ * Same extraction Cursor already applies in `parseCursorUserText`.
+ */
+export declare function unwrapUserQuery(text: string): string;
 /**
  * Return one genuine user turn in full.
  * Synthetic scaffolding is rejected as a whole so an injected Apps/AGENTS
  * preamble can never become the session's displayed request. Unlike the topic
  * cleaner, this intentionally preserves internal whitespace and every line of
- * the user's actual request.
+ * the user's actual request. A Grok/Cursor `<user_query>` wrapper is unwrapped
+ * so the stored turn is the originating request, not the harness tags.
  */
 export declare function cleanFirstUserMessage(raw: string | undefined): string | undefined;
 /** First genuine user message from an already-normalized event stream. */

package/dist/lib/session/prompt.js

@@ -49,6 +49,7 @@ const SYNTHETIC_USER_MESSAGE_PATTERNS = [
     /^\s*<(?:apps|plugins|skills)_instructions>/i,
     /^\s*<recommended_plugins>/i,
     /^\s*<(?:multi_agent_mode|environment_context)>/i,
+    /^\s*<user_info>/i,
     /^\s*## (?:In-flight in this repo|Host & Fleet)/i,
     /^\s*Your current session id is\b/i,
     /^\s*Linear context skipped:/i,
@@ -69,17 +70,26 @@ export function isSyntheticUserMessage(raw) {
         return false;
     return SYNTHETIC_USER_MESSAGE_PATTERNS.some(pattern => pattern.test(raw));
 }
+/**
+ * Inner text of a `<user_query>` wrapper, or the original string if none.
+ * Same extraction Cursor already applies in `parseCursorUserText`.
+ */
+export function unwrapUserQuery(text) {
+    const query = text.match(/<user_query>\s*([\s\S]*?)\s*<\/user_query>/);
+    return (query?.[1] ?? text).trim();
+}
 /**
  * Return one genuine user turn in full.
  * Synthetic scaffolding is rejected as a whole so an injected Apps/AGENTS
  * preamble can never become the session's displayed request. Unlike the topic
  * cleaner, this intentionally preserves internal whitespace and every line of
- * the user's actual request.
+ * the user's actual request. A Grok/Cursor `<user_query>` wrapper is unwrapped
+ * so the stored turn is the originating request, not the harness tags.
  */
 export function cleanFirstUserMessage(raw) {
     if (!raw || isSyntheticUserMessage(raw))
         return undefined;
-    const clean = raw.trim();
+    const clean = unwrapUserQuery(raw);
     return clean || undefined;
 }
 /** First genuine user message from an already-normalized event stream. */