@productbrain/cli 0.1.0-beta.1016 → 0.1.0-beta.10165

package/dist/lib/runner.js

@@ -2,7 +2,7 @@
  * runCliCommand — shared command runner for the Product Brain CLI.
  *
  * Owns:
- *   (a) TTY detection via process.stdout.isTTY
+ *   (a) auto-mode JSON opt-in via PB_JSON=1 (piping alone does NOT switch modes — WP-744 / 1e-B)
  *   (b) JSON vs human output branching
  *   (c) stripConvexInternals() application in JSON mode
  *   (d) --json and --pretty explicit overrides that take precedence over auto-detection
@@ -14,7 +14,7 @@ import { stripConvexInternals } from './strip.js';
 import { CLIError } from './errors.js';
 /**
  * Global output mode — set by the CLI entry point when --json or --pretty flags are parsed.
- * 'auto' = detect via TTY; 'json' = force JSON; 'pretty' = force human.
+ * 'auto' = card unless PB_JSON=1; 'json' = force JSON; 'pretty' = force human.
  */
 let outputMode = 'auto';
 export function setOutputMode(mode) {
@@ -29,8 +29,11 @@ export function isJsonMode() {
         return true;
     if (outputMode === 'pretty')
         return false;
-    // auto: non-TTY (piped) → JSON, TTY → human
-    return !process.stdout.isTTY;
+    // auto: only an explicit PB_JSON=1 opts into JSON. Piping alone does NOT — the card is the
+    // default in every shell, TTY or not; `--json` (or PB_JSON=1) is the only way to ask for the
+    // warehouse (WP-744 / 1e-B). Formerly `!process.stdout.isTTY`, which made piped output
+    // indistinguishable from `--json` and left the card unreachable from a pipe.
+    return process.env.PB_JSON === '1';
 }
 /**
  * Quiet mode — suppresses non-essential output (banners, hints, progress).
@@ -41,12 +44,35 @@ let quietMode = false;
 export function setQuietMode(quiet) {
     quietMode = quiet;
 }
+/**
+ * The RAW quiet flag, independent of JSON mode. isQuietMode() conflates JSON mode,
+ * so read this when you need the literal quiet state (e.g. to assert that a window
+ * left quiet — and therefore the interactive-prompt gate — untouched).
+ */
+export function getQuietMode() {
+    return quietMode;
+}
 export function isQuietMode() {
     // JSON mode is inherently quiet — no decorative output needed
     if (isJsonMode())
         return true;
     return quietMode;
 }
+/**
+ * Spinner suppression — independent of quiet/json mode. Silences withSpinner()
+ * output WITHOUT making the CLI "quiet" (quiet also gates interactive prompts via
+ * prompts.ts/assertInteractive). `pb connect` flips this to hide the raw per-kernelCall
+ * spinner labels ("Loading chain getVocabulary", …) while still letting the handshake's
+ * adopt/revert prompts for PB-managed tampered files run (TEN-2561 / WP-2: legible
+ * output must never silence a prompt the user needs to answer).
+ */
+let spinnersSilenced = false;
+export function setSpinnersSilenced(silenced) {
+    spinnersSilenced = silenced;
+}
+export function areSpinnersSilenced() {
+    return spinnersSilenced;
+}
 /**
  * Execute a CLI command with unified output handling.
  *

package/dist/lib/runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/lib/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC;;;GAGG;AACH,IAAI,UAAU,GAA+B,MAAM,CAAC;AAEpD,MAAM,UAAU,aAAa,CAAC,IAAgC;IAC5D,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,UAAU;IACxB,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,4CAA4C;IAC5C,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,8DAA8D;IAC9D,IAAI,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,SAAS,CAAC;AACnB,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAI,OAAgC;IACrE,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,CAAC;QAEhC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,+DAA+D;QAC/D,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAChD,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/lib/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC;;;GAGG;AACH,IAAI,UAAU,GAA+B,MAAM,CAAC;AAEpD,MAAM,UAAU,aAAa,CAAC,IAAgC;IAC5D,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,UAAU;IACxB,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,2FAA2F;IAC3F,6FAA6F;IAC7F,uFAAuF;IACvF,6EAA6E;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,8DAA8D;IAC9D,IAAI,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B,MAAM,UAAU,mBAAmB,CAAC,QAAiB;IACnD,gBAAgB,GAAG,QAAQ,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAI,OAAgC;IACrE,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,CAAC;QAEhC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,+DAA+D;QAC/D,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAChD,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/lib/seatSentence.d.ts

@@ -0,0 +1,42 @@
+/**
+ * TASK-633 S3c (WP-808, DEC-1954): the one sentence a seat or unseat reply reads as, on the CLI
+ * (`pb role seat` / `pb role unseat`) and the MCP `role` tool alike. Both doors call the same
+ * kernel routes (`organisation.seatInRole` / `organisation.unseatFromRole`) and render this
+ * sentence from the result, so the two replies cannot drift (RULE-657: one place decides it).
+ * The invite reply (`pb people invite`, the MCP people tool's `invite`; TASK-637) lives here too: one organisation
+ * reply file, one generated copy per connector.
+ *
+ * Pure, no I/O, zero imports: copied into each connector by scripts/generate-mcp-embedded-copies.mjs.
+ * Field sanitization is the caller's (each connector's own `sanitizeSingleLineField`), passed in
+ * as `clean`, the same split ownerLine.ts uses.
+ *
+ * A seat names the person's id after their name: a placeholder has no email, and the id is the
+ * handle `pb role unseat --person` and the MCP `unseat` take (PR #1549 review; TASK-636, DEC-1810).
+ */
+export interface SeatReply {
+    outcome: 'applied' | 'refused';
+    created?: boolean;
+    removed?: boolean;
+    person?: string;
+    personId?: string;
+    personStatus?: string;
+    role?: string;
+    roleName?: string;
+    teamName?: string;
+    refusal?: {
+        code: string;
+        reason: string;
+        requiredAction?: string;
+    };
+}
+export declare function formatSeatSentence(action: 'seat' | 'unseat', reply: SeatReply, clean: (value: string) => string): string;
+/** TASK-637 (DEC-1953): the one sentence `pb people invite` and the MCP people tool's `invite` reply with.
+ *  `inPlace` is a placeholder that became invited on its own row, so it keeps the roles it holds. */
+export interface InviteReply {
+    person: string;
+    personId: string;
+    email: string;
+    inPlace: boolean;
+}
+export declare function formatInviteSentence(reply: InviteReply, clean: (value: string) => string): string;
+//# sourceMappingURL=seatSentence.d.ts.map

package/dist/lib/seatSentence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seatSentence.d.ts","sourceRoot":"","sources":["../../src/lib/seatSentence.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,SAAS;IACzB,OAAO,EAAE,SAAS,GAAG,SAAS,CAAC;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACpE;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,CAcxH;AAED;qGACqG;AACrG,MAAM,WAAW,WAAW;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM,CAKjG"}

package/dist/lib/seatSentence.js

@@ -0,0 +1,25 @@
+// GENERATED by scripts/generate-mcp-embedded-copies.mjs from kernel/organisationalAuthority/seatSentence.ts.
+// DO NOT EDIT. Run `npm run mcp:embedded-copies` to regenerate.
+// Local runtime copy for the isolated connector build.
+export function formatSeatSentence(action, reply, clean) {
+    if (reply.outcome === 'refused') {
+        return `Refused: ${reply.refusal?.reason ?? reply.refusal?.code ?? 'not allowed'}${reply.refusal?.requiredAction ? ` ${reply.refusal.requiredAction}` : ''}`;
+    }
+    const who = `${clean(reply.person ?? '')}${reply.personStatus && reply.personStatus !== 'active' ? ` (${clean(reply.personStatus)})` : ''}`;
+    const roleLabel = `${clean(reply.roleName ?? '')} (${reply.role ?? ''})`;
+    const teamLabel = clean(reply.teamName ?? '');
+    if (action === 'seat') {
+        const id = reply.personId ? ` [${reply.personId}]` : '';
+        return `${reply.created ? 'Seated' : 'Confirmed'} ${who}${id} as ${roleLabel} in ${teamLabel}.`;
+    }
+    return reply.removed
+        ? `Unseated ${who} from ${roleLabel} in ${teamLabel}.`
+        : `${who} did not hold ${roleLabel} in ${teamLabel}; nothing changed.`;
+}
+export function formatInviteSentence(reply, clean) {
+    const who = `${clean(reply.person)} [${reply.personId}]`;
+    return reply.inPlace
+        ? `Invited ${who} at ${clean(reply.email)}; they keep every role they already hold.`
+        : `Invited ${who} at ${clean(reply.email)} as a new person.`;
+}
+//# sourceMappingURL=seatSentence.js.map

package/dist/lib/seatSentence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seatSentence.js","sourceRoot":"","sources":["../../src/lib/seatSentence.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,gEAAgE;AAChE,uDAAuD;AA8BvD,MAAM,UAAU,kBAAkB,CAAC,MAAyB,EAAE,KAAgB,EAAE,KAAgC;IAC/G,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,YAAY,KAAK,CAAC,OAAO,EAAE,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,IAAI,aAAa,GAAG,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9J,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5I,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,EAAE,GAAG,CAAC;IACzE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,IAAI,GAAG,GAAG,EAAE,OAAO,SAAS,OAAO,SAAS,GAAG,CAAC;IACjG,CAAC;IACD,OAAO,KAAK,CAAC,OAAO;QACnB,CAAC,CAAC,YAAY,GAAG,SAAS,SAAS,OAAO,SAAS,GAAG;QACtD,CAAC,CAAC,GAAG,GAAG,iBAAiB,SAAS,OAAO,SAAS,oBAAoB,CAAC;AACzE,CAAC;AAWD,MAAM,UAAU,oBAAoB,CAAC,KAAkB,EAAE,KAAgC;IACxF,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,QAAQ,GAAG,CAAC;IACzD,OAAO,KAAK,CAAC,OAAO;QACnB,CAAC,CAAC,WAAW,GAAG,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,2CAA2C;QACpF,CAAC,CAAC,WAAW,GAAG,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC;AAC/D,CAAC"}

package/dist/lib/session.d.ts

@@ -5,6 +5,17 @@
  *
  * WP-322 S2: session.json also serves as a closed marker (closedAt present)
  * for auto-resume logic when the last session closed <2h ago.
+ *
+ * WP-479 E2 (client half): when a conversation identity resolves (see ./conversation.ts —
+ * PB_CONVERSATION_ID / CLAUDE_CODE_SESSION_ID / CURSOR_CONVERSATION_ID / hashed
+ * CODEX_TUI_SESSION_LOG_PATH), the marker moves to `.productbrain/sessions/<conversationId>.json`
+ * so concurrent harness conversations sharing a worktree don't collide on one marker. Every
+ * function below resolves the conversation id ONCE (via resolveConversationId) and derives its
+ * path from that single value. With no identity signal present, resolveConversationId() returns
+ * null and every function falls back to the exact legacy `.productbrain/session.json` path and
+ * behavior — byte-identical, zero-config invariant. An explicit `conversationIdOverride` (only
+ * threaded from the CLI's `--conversation` flag on `pb session start`) takes priority over env
+ * detection; every other call site across the CLI calls these with no argument.
  */
 export interface SessionState {
     sessionId: string;
@@ -16,16 +27,37 @@ export interface SessionState {
     closedAt?: string;
     /** Effective profile name at session start — backstop for detecting a profile switch. */
     profile?: string;
+    /**
+     * Fingerprint of the CREDENTIAL this session was started under (TEN-3240).
+     *
+     * `profile` alone cannot see a raw exported `PRODUCTBRAIN_API_KEY`: it names profiles, and an
+     * exported key supplies no profile name. Swap that key for another workspace's between two
+     * invocations and the name is unchanged, so the name-only backstop reports the OLD workspace's
+     * session as still active. This is derived from the resolved key + gateway, so it moves
+     * whenever the binding does — profile switch, preview flip, or bare key swap alike.
+     *
+     * Optional: sessions written before this field existed carry only `profile`, and the backstop
+     * still honours that. Never the key itself — a one-way digest, and only its head is kept.
+     */
+    bindingFingerprint?: string;
+    /** WP-479 E2: the conversation identity this marker is scoped to, when one resolved. */
+    conversationId?: string;
 }
+/** 2-hour window for auto-resume (WP-322 E1) — also the GC threshold for closed conversation
+ *  markers (WP-479 E2): a closed marker past this window will never be auto-resumed, so it's
+ *  garbage. Exported so commands/session.ts's resume logic uses the exact same constant. */
+export declare const RESUME_WINDOW_MS: number;
 /** Shape returned by readClosedMarker when a closed marker is present. */
 export interface ClosedMarker {
     sessionId: string;
     closedAt: string;
     workspaceId: string;
     workspaceName: string;
+    /** WP-479 E2: the conversation identity this marker was scoped to, when one resolved. */
+    conversationId?: string;
 }
-export declare function readSession(): SessionState | null;
-export declare function writeSession(state: SessionState): void;
+export declare function readSession(conversationIdOverride?: string): SessionState | null;
+export declare function writeSession(state: SessionState, conversationIdOverride?: string): void;
 /**
  * Writes a closed marker instead of deleting the file.
  * If the file is already a closed marker (closedAt present), deletes it outright
@@ -33,20 +65,62 @@ export declare function writeSession(state: SessionState): void;
  * Uses atomic write (tmp → rename) to prevent partial writes on active sessions.
  * WP-322 S2 — enables auto-resume within 2h window.
  */
-export declare function clearSession(): void;
+export declare function clearSession(conversationIdOverride?: string): void;
+/**
+ * Delete the CURRENT conversation's marker outright — NO closed marker. Use when discarding a
+ * single conversation's session (clearSession writes a resume marker; that is only correct for
+ * session close).
+ */
+export declare function discardSession(conversationIdOverride?: string): void;
+/**
+ * Delete EVERY session marker in this project — the legacy `session.json` AND every per-conversation
+ * marker under `.productbrain/sessions/`. Use on a WORKSPACE change (profile switch / connect
+ * redirect) so the 2h auto-resume can't re-pin the old workspace from ANY marker.
+ *
+ * Review fix (Codex): `discardSession()` resolves only the CURRENT conversation's marker, so a
+ * workspace-switch caller with no conversation env would leave other conversations' active markers
+ * behind — later reusable against the NEW workspace. A workspace change invalidates ALL of them, so
+ * this clears the whole set rather than one marker.
+ */
+export declare function discardAllSessions(): void;
+/** True if a session marker file exists at all — active session OR closed marker. */
+export declare function sessionFileExists(conversationIdOverride?: string): boolean;
 /**
- * Delete session.json outright — NO closed marker. Use on a workspace change
- * (profile switch / connect redirect) so the 2h auto-resume can't re-pin the old
- * workspace. (clearSession writes a resume marker; that is only correct for session close.)
+ * True if ANY session marker exists — the legacy `session.json` OR any per-conversation marker under
+ * `.productbrain/sessions/`. Used by `pb session reset` so a hard reset (and the binding-flip recovery
+ * it backs) can detect + clear a sibling conversation's marker it has no env to resolve (Codex
+ * re-review — the flip guard refuses on ANY active marker, so reset must see them ALL).
+ */
+export declare function hasAnySessionMarker(): boolean;
+/**
+ * True if ANY marker — legacy `session.json` OR any per-conversation marker — represents an ACTIVE
+ * session (no `closedAt`). Used by `pb session reset` so its confirmation/`--force` guard fires when
+ * a SIBLING conversation's session is active, not only the current one (Codex re-review: an
+ * all-marker reset must not silently strand an active sibling server session). Closed markers are
+ * inert and don't require a prompt.
+ */
+export declare function hasAnyActiveSession(): boolean;
+/**
+ * Find the ACTIVE marker carrying `sessionId`, across both storage shapes, or null.
+ *
+ * TEN-3315: the write-binding guard compares the bound credential against a marker's fingerprint,
+ * but a command can select a DIFFERENT conversation's session and pass its id explicitly (e.g.
+ * `pb rework report --conversation A`). Judging the ambient marker there would judge the wrong
+ * session, so the guard used to skip — blind exactly where the caller was most deliberate about
+ * which session it meant. This lets it judge the marker the call actually uses.
+ *
+ * Enumerates the same two places `hasAnyActiveSession()` does — the legacy `session.json` and the
+ * per-conversation directory — because a session id says nothing about which conversation owns it.
+ * Closed markers are not sessions, so they never match; a malformed one is skipped rather than
+ * throwing, since this sits in front of every session-attributed write.
  */
-export declare function discardSession(): void;
-/** True if a session.json file exists at all — active session OR closed marker. */
-export declare function sessionFileExists(): boolean;
+export declare function readSessionBySessionId(sessionId: string): SessionState | null;
 /**
- * Reads the closed marker from session.json.
+ * Reads the closed marker from the resolved conversation's marker file (or the legacy
+ * session.json when no conversation identity resolves).
  * Returns the marker if closedAt is present, otherwise null.
  * WP-322 S2 — used by runSessionStart to detect recent closed sessions.
  */
-export declare function readClosedMarker(): ClosedMarker | null;
-export declare function addCapturedEntry(entryId: string): void;
+export declare function readClosedMarker(conversationIdOverride?: string): ClosedMarker | null;
+export declare function addCapturedEntry(entryId: string, conversationIdOverride?: string): void;
 //# sourceMappingURL=session.d.ts.map

package/dist/lib/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/lib/session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAcD,wBAAgB,WAAW,IAAI,YAAY,GAAG,IAAI,CAWjD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAItD;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,IAAI,CA0BnC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAGrC;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,GAAG,IAAI,CAetD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAKtD"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/lib/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;4FAE4F;AAC5F,eAAO,MAAM,gBAAgB,QAAqB,CAAC;AAEnD,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAiFD,wBAAgB,WAAW,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAahF;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAUvF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CA6BlE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAIpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAmBzC;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,OAAO,CAG1E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAS7C;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAkB7C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CA0B7E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAkBrF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAKvF"}

package/dist/lib/session.js

@@ -5,11 +5,38 @@
  *
  * WP-322 S2: session.json also serves as a closed marker (closedAt present)
  * for auto-resume logic when the last session closed <2h ago.
+ *
+ * WP-479 E2 (client half): when a conversation identity resolves (see ./conversation.ts —
+ * PB_CONVERSATION_ID / CLAUDE_CODE_SESSION_ID / CURSOR_CONVERSATION_ID / hashed
+ * CODEX_TUI_SESSION_LOG_PATH), the marker moves to `.productbrain/sessions/<conversationId>.json`
+ * so concurrent harness conversations sharing a worktree don't collide on one marker. Every
+ * function below resolves the conversation id ONCE (via resolveConversationId) and derives its
+ * path from that single value. With no identity signal present, resolveConversationId() returns
+ * null and every function falls back to the exact legacy `.productbrain/session.json` path and
+ * behavior — byte-identical, zero-config invariant. An explicit `conversationIdOverride` (only
+ * threaded from the CLI's `--conversation` flag on `pb session start`) takes priority over env
+ * detection; every other call site across the CLI calls these with no argument.
  */
-import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, unlinkSync } from 'fs';
+import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync, unlinkSync, readdirSync } from 'fs';
 import { join } from 'path';
+import { findProjectRoot } from './config.js';
+import { resolveConversationId } from './conversation.js';
+/** 2-hour window for auto-resume (WP-322 E1) — also the GC threshold for closed conversation
+ *  markers (WP-479 E2): a closed marker past this window will never be auto-resumed, so it's
+ *  garbage. Exported so commands/session.ts's resume logic uses the exact same constant. */
+export const RESUME_WINDOW_MS = 2 * 60 * 60 * 1000;
+/**
+ * Resolve the `.productbrain/` session directory off the CLI project root — the SAME
+ * walked-up root config.ts resolves credentials against (findProjectRoot), which is also the
+ * repo-root that scripts/pb-binding.mjs targets. Anchoring all three to one root means the
+ * binding-flip guard (hasActiveSession in pb-binding.mjs) inspects the exact session.json the
+ * CLI writes, even when a command runs from a subdirectory such as packages/cli — a cwd-relative
+ * dir would put the session under packages/cli/.productbrain and the guard would miss it
+ * (codex PR #145 review). Falls back to cwd when no config-bearing root is found (fresh worktree
+ * before any config has landed).
+ */
 function getSessionDir() {
-    return join(process.cwd(), '.productbrain');
+    return join(findProjectRoot(process.cwd()) ?? process.cwd(), '.productbrain');
 }
 function getSessionPath() {
     return join(getSessionDir(), 'session.json');
@@ -17,8 +44,65 @@ function getSessionPath() {
 function getTmpSessionPath() {
     return join(getSessionDir(), 'session.json.tmp');
 }
-export function readSession() {
-    const p = getSessionPath();
+/** WP-479 E2: directory holding one marker file per resolved conversation id. */
+function getSessionsDir() {
+    return join(getSessionDir(), 'sessions');
+}
+function getConversationMarkerPath(conversationId) {
+    return join(getSessionsDir(), `${conversationId}.json`);
+}
+function getConversationTmpMarkerPath(conversationId) {
+    return join(getSessionsDir(), `${conversationId}.json.tmp`);
+}
+/**
+ * Resolve the marker path for a given (already-resolved) conversation id: the conversation-scoped
+ * path under `.productbrain/sessions/` when non-null, else the legacy shared path — the single
+ * fork point every function below routes through.
+ */
+function markerPath(conversationId) {
+    return conversationId ? getConversationMarkerPath(conversationId) : getSessionPath();
+}
+function tmpMarkerPath(conversationId) {
+    return conversationId ? getConversationTmpMarkerPath(conversationId) : getTmpSessionPath();
+}
+/**
+ * WP-479 E2 GC: delete closed conversation markers whose `closedAt` is older than the 2h resume
+ * window — a closed marker outside that window will never be auto-resumed, so it's inert litter.
+ * Best-effort, and cheap (no-ops when the sessions dir doesn't exist yet). Scoped to the
+ * conversation-marker directory only — the single legacy `session.json` is never GC'd here (its
+ * own clearSession/discardSession lifecycle is unchanged).
+ */
+function gcExpiredConversationMarkers() {
+    const dir = getSessionsDir();
+    if (!existsSync(dir))
+        return;
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    const now = Date.now();
+    for (const entry of entries) {
+        if (!entry.endsWith('.json'))
+            continue;
+        const full = join(dir, entry);
+        try {
+            const raw = JSON.parse(readFileSync(full, 'utf8'));
+            if (raw.closedAt && now - new Date(raw.closedAt).getTime() > RESUME_WINDOW_MS) {
+                unlinkSync(full);
+            }
+        }
+        catch {
+            // Malformed or concurrently-removed marker — ignore, non-blocking.
+        }
+    }
+}
+export function readSession(conversationIdOverride) {
+    gcExpiredConversationMarkers();
+    const conversationId = resolveConversationId(conversationIdOverride);
+    const p = markerPath(conversationId);
     if (!existsSync(p))
         return null;
     try {
@@ -32,11 +116,17 @@ export function readSession() {
         return null;
     }
 }
-export function writeSession(state) {
-    const dir = getSessionDir();
+export function writeSession(state, conversationIdOverride) {
+    const conversationId = resolveConversationId(conversationIdOverride);
+    // Stamp the resolved conversation id onto the state itself (WP-479 E2: "store the
+    // conversationId in it") so a later bare readSession() round-trips it, and so the marker file's
+    // own contents self-identify which conversation it belongs to.
+    state.conversationId = conversationId ?? undefined;
+    const dir = conversationId ? getSessionsDir() : getSessionDir();
     if (!existsSync(dir))
         mkdirSync(dir, { recursive: true });
-    writeFileSync(getSessionPath(), JSON.stringify(state, null, 2));
+    writeFileSync(markerPath(conversationId), JSON.stringify(state, null, 2));
+    gcExpiredConversationMarkers();
 }
 /**
  * Writes a closed marker instead of deleting the file.
@@ -45,8 +135,9 @@ export function writeSession(state) {
  * Uses atomic write (tmp → rename) to prevent partial writes on active sessions.
  * WP-322 S2 — enables auto-resume within 2h window.
  */
-export function clearSession() {
-    const p = getSessionPath();
+export function clearSession(conversationIdOverride) {
+    const conversationId = resolveConversationId(conversationIdOverride);
+    const p = markerPath(conversationId);
     if (!existsSync(p))
         return;
     try {
@@ -63,39 +154,177 @@ export function clearSession() {
             startedAt: existing.startedAt,
             entriesCaptured: [],
             closedAt: new Date().toISOString(),
+            conversationId: conversationId ?? undefined,
         };
-        const dir = getSessionDir();
+        const dir = conversationId ? getSessionsDir() : getSessionDir();
         if (!existsSync(dir))
             mkdirSync(dir, { recursive: true });
-        const tmp = getTmpSessionPath();
+        const tmp = tmpMarkerPath(conversationId);
         writeFileSync(tmp, JSON.stringify(marker, null, 2));
         renameSync(tmp, p);
     }
     catch {
         // If we can't write the marker, the file stays as-is (non-blocking).
     }
+    gcExpiredConversationMarkers();
 }
 /**
- * Delete session.json outright — NO closed marker. Use on a workspace change
- * (profile switch / connect redirect) so the 2h auto-resume can't re-pin the old
- * workspace. (clearSession writes a resume marker; that is only correct for session close.)
+ * Delete the CURRENT conversation's marker outright — NO closed marker. Use when discarding a
+ * single conversation's session (clearSession writes a resume marker; that is only correct for
+ * session close).
  */
-export function discardSession() {
-    const p = getSessionPath();
+export function discardSession(conversationIdOverride) {
+    const conversationId = resolveConversationId(conversationIdOverride);
+    const p = markerPath(conversationId);
     if (existsSync(p))
         unlinkSync(p);
 }
-/** True if a session.json file exists at all — active session OR closed marker. */
-export function sessionFileExists() {
-    return existsSync(getSessionPath());
+/**
+ * Delete EVERY session marker in this project — the legacy `session.json` AND every per-conversation
+ * marker under `.productbrain/sessions/`. Use on a WORKSPACE change (profile switch / connect
+ * redirect) so the 2h auto-resume can't re-pin the old workspace from ANY marker.
+ *
+ * Review fix (Codex): `discardSession()` resolves only the CURRENT conversation's marker, so a
+ * workspace-switch caller with no conversation env would leave other conversations' active markers
+ * behind — later reusable against the NEW workspace. A workspace change invalidates ALL of them, so
+ * this clears the whole set rather than one marker.
+ */
+export function discardAllSessions() {
+    const legacy = getSessionPath();
+    if (existsSync(legacy))
+        unlinkSync(legacy);
+    const dir = getSessionsDir();
+    if (!existsSync(dir))
+        return;
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (!entry.endsWith('.json'))
+            continue;
+        try {
+            unlinkSync(join(dir, entry));
+        }
+        catch {
+            // concurrently removed — ignore, non-blocking.
+        }
+    }
+}
+/** True if a session marker file exists at all — active session OR closed marker. */
+export function sessionFileExists(conversationIdOverride) {
+    const conversationId = resolveConversationId(conversationIdOverride);
+    return existsSync(markerPath(conversationId));
+}
+/**
+ * True if ANY session marker exists — the legacy `session.json` OR any per-conversation marker under
+ * `.productbrain/sessions/`. Used by `pb session reset` so a hard reset (and the binding-flip recovery
+ * it backs) can detect + clear a sibling conversation's marker it has no env to resolve (Codex
+ * re-review — the flip guard refuses on ANY active marker, so reset must see them ALL).
+ */
+export function hasAnySessionMarker() {
+    if (existsSync(getSessionPath()))
+        return true;
+    const dir = getSessionsDir();
+    if (!existsSync(dir))
+        return false;
+    try {
+        return readdirSync(dir).some((f) => f.endsWith('.json'));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * True if ANY marker — legacy `session.json` OR any per-conversation marker — represents an ACTIVE
+ * session (no `closedAt`). Used by `pb session reset` so its confirmation/`--force` guard fires when
+ * a SIBLING conversation's session is active, not only the current one (Codex re-review: an
+ * all-marker reset must not silently strand an active sibling server session). Closed markers are
+ * inert and don't require a prompt.
+ */
+export function hasAnyActiveSession() {
+    const isActive = (p) => {
+        try {
+            const raw = JSON.parse(readFileSync(p, 'utf8'));
+            return !raw.closedAt;
+        }
+        catch {
+            return false; // malformed/unreadable — treat as not-active (inert)
+        }
+    };
+    const legacy = getSessionPath();
+    if (existsSync(legacy) && isActive(legacy))
+        return true;
+    const dir = getSessionsDir();
+    if (!existsSync(dir))
+        return false;
+    try {
+        return readdirSync(dir).some((f) => f.endsWith('.json') && isActive(join(dir, f)));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Find the ACTIVE marker carrying `sessionId`, across both storage shapes, or null.
+ *
+ * TEN-3315: the write-binding guard compares the bound credential against a marker's fingerprint,
+ * but a command can select a DIFFERENT conversation's session and pass its id explicitly (e.g.
+ * `pb rework report --conversation A`). Judging the ambient marker there would judge the wrong
+ * session, so the guard used to skip — blind exactly where the caller was most deliberate about
+ * which session it meant. This lets it judge the marker the call actually uses.
+ *
+ * Enumerates the same two places `hasAnyActiveSession()` does — the legacy `session.json` and the
+ * per-conversation directory — because a session id says nothing about which conversation owns it.
+ * Closed markers are not sessions, so they never match; a malformed one is skipped rather than
+ * throwing, since this sits in front of every session-attributed write.
+ */
+export function readSessionBySessionId(sessionId) {
+    const match = (p) => {
+        try {
+            const raw = JSON.parse(readFileSync(p, 'utf8'));
+            return !raw.closedAt && raw.sessionId === sessionId ? raw : null;
+        }
+        catch {
+            return null; // malformed/unreadable — skip, never throw in front of a write
+        }
+    };
+    const legacy = getSessionPath();
+    if (existsSync(legacy)) {
+        const found = match(legacy);
+        if (found)
+            return found;
+    }
+    const dir = getSessionsDir();
+    if (!existsSync(dir))
+        return null;
+    try {
+        for (const f of readdirSync(dir)) {
+            if (!f.endsWith('.json'))
+                continue;
+            const found = match(join(dir, f));
+            if (found)
+                return found;
+        }
+    }
+    catch {
+        // Directory vanished mid-scan — nothing to validate against.
+    }
+    return null;
 }
 /**
- * Reads the closed marker from session.json.
+ * Reads the closed marker from the resolved conversation's marker file (or the legacy
+ * session.json when no conversation identity resolves).
  * Returns the marker if closedAt is present, otherwise null.
  * WP-322 S2 — used by runSessionStart to detect recent closed sessions.
  */
-export function readClosedMarker() {
-    const p = getSessionPath();
+export function readClosedMarker(conversationIdOverride) {
+    gcExpiredConversationMarkers();
+    const conversationId = resolveConversationId(conversationIdOverride);
+    const p = markerPath(conversationId);
     if (!existsSync(p))
         return null;
     try {
@@ -107,17 +336,18 @@ export function readClosedMarker() {
             closedAt: raw.closedAt,
             workspaceId: raw.workspaceId,
             workspaceName: raw.workspaceName,
+            conversationId: raw.conversationId,
         };
     }
     catch {
         return null;
     }
 }
-export function addCapturedEntry(entryId) {
-    const session = readSession();
+export function addCapturedEntry(entryId, conversationIdOverride) {
+    const session = readSession(conversationIdOverride);
     if (!session)
         return;
     session.entriesCaptured.push(entryId);
-    writeSession(session);
+    writeSession(session, conversationIdOverride);
 }
 //# sourceMappingURL=session.js.map