@remnic/core 9.3.649 → 9.3.651

package/dist/{chunk-6GIKAUTN.js.map → chunk-MMJANTJX.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/coding/git-context.ts","../src/coding/coding-namespace.ts","../src/procedural/reinforcement-core.ts"],"sourcesContent":["/**\n * GitContextResolver — pure module for detecting the git project + branch\n * a session is operating in.\n *\n * Introduced by issue #569 (coding-agent project/branch-scoped namespaces).\n *\n * This module is deliberately pure:\n *   - no orchestrator references\n *   - no config side-effects\n *   - no namespace wiring\n *\n * Downstream slices (PR 2+ of #569) wire `resolveGitContext` into the\n * `NamespaceResolver` / `Orchestrator` so that memories are scoped to a\n * detected project / branch without leaking across repos.\n *\n * CLAUDE.md rule 17 (expand `~`): the `rootPath` returned here is always an\n * absolute, tilde-expanded path. Callers must not re-expand.\n *\n * CLAUDE.md rule 51 (reject invalid input): `cwd` must be an absolute path\n * and must exist. `resolveGitContext` returns `null` — rather than throwing —\n * when the directory is not inside a git worktree, because being outside a\n * repo is a normal runtime state (e.g. agent opened in a scratch dir).\n */\nimport path from \"node:path\";\n\nimport { expandTildePath } from \"../utils/path.js\";\nimport { launchProcessSync } from \"../runtime/child-process.js\";\n\n// Re-export so existing callers / tests that imported `expandTildePath` from\n// this module keep working. CLAUDE.md #17 requires consistent `~` expansion\n// across every user-facing path input; the canonical implementation now\n// lives in `utils/path.ts`.\nexport { expandTildePath };\n\n// ──────────────────────────────────────────────────────────────────────────\n// Public types\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface GitContext {\n  /**\n   * Stable identifier for the project. Derived from `git remote get-url origin`\n   * when an origin remote is configured, otherwise from the repo root path.\n   *\n   * Formatted as `origin:<hex>` or `root:<hex>` so that the source is visible\n   * to operators (see `remnic doctor`, issue #569 acceptance criteria).\n   */\n  projectId: string;\n  /**\n   * Current branch, e.g. `main`, `feat/foo`. `null` only in detached-HEAD\n   * state (e.g. rebase in progress). Callers should treat `null` as \"no\n   * branch-scope overlay applies\" without erroring.\n   */\n  branch: string | null;\n  /**\n   * Absolute path to the repository root (the directory containing `.git`).\n   * Tilde-expanded per CLAUDE.md #17.\n   */\n  rootPath: string;\n  /**\n   * Best-effort default branch (usually `main` or `master`). Derived from the\n   * `refs/remotes/origin/HEAD` symbolic ref. `null` when not available (e.g.\n   * fresh clone without a default branch symref, or no origin remote).\n   */\n  defaultBranch: string | null;\n}\n\n/**\n * Injectable git-invocation surface. Only the commands `resolveGitContext`\n * actually needs are exposed. Tests inject a mock implementation to avoid\n * spawning a real git process.\n */\nexport interface GitInvoker {\n  /**\n   * Run `git <args>` with `cwd` as the working directory. Must return\n   * `{ stdout, exitCode }` with `stdout` trimmed by the caller as needed.\n   * Implementations should NOT throw for non-zero exit codes — they should\n   * return the exit code so the resolver can decide how to recover.\n   */\n  (cwd: string, args: string[]): { stdout: string; exitCode: number };\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Default git invoker — spawns real `git` via the shared child-process helper\n// ──────────────────────────────────────────────────────────────────────────\n\nconst DEFAULT_GIT_TIMEOUT_MS = 2_000;\n\nexport function defaultGitInvoker(): GitInvoker {\n  return (cwd: string, args: string[]) => {\n    const result = launchProcessSync(\"git\", args, {\n      cwd,\n      encoding: \"utf-8\",\n      timeout: DEFAULT_GIT_TIMEOUT_MS,\n      shell: false,\n    });\n    if (result.error) {\n      // Spawn failure (git not on PATH, timeout, etc.). Surface as non-zero.\n      return { stdout: \"\", exitCode: 127 };\n    }\n    return {\n      stdout: typeof result.stdout === \"string\" ? result.stdout : \"\",\n      exitCode: typeof result.status === \"number\" ? result.status : 1,\n    };\n  };\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Stable hashing\n// ──────────────────────────────────────────────────────────────────────────\n\n/**\n * Non-cryptographic stable hash. Used only to derive a deterministic\n * `projectId` from either the origin URL or the root path. The hash does not\n * need to be collision-resistant against adversarial input — it is purely a\n * namespace discriminator.\n *\n * Uses FNV-1a 32-bit so we don't pull in `node:crypto` for a simple bucket\n * key. Output is lowercase hex, zero-padded to 8 characters.\n */\nexport function stableHash(input: string): string {\n  let hash = 0x811c9dc5;\n  for (let i = 0; i < input.length; i++) {\n    hash ^= input.charCodeAt(i);\n    hash = Math.imul(hash, 0x01000193) >>> 0;\n  }\n  return hash.toString(16).padStart(8, \"0\");\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Origin URL normalization\n// ──────────────────────────────────────────────────────────────────────────\n\n/**\n * Normalize a git remote URL so that equivalent SSH / HTTPS forms of the\n * same repo produce the same `projectId`. Handles:\n *   - `git@github.com:foo/bar.git`  → `github.com/foo/bar`\n *   - `https://github.com/foo/bar`  → `github.com/foo/bar`\n *   - `https://github.com/foo/bar.git` → `github.com/foo/bar`\n *   - `ssh://git@github.com/foo/bar` → `github.com/foo/bar`\n *   - `ssh://git@github.com:2222/foo/bar` → `github.com/foo/bar` (port stripped)\n *\n * Case-insensitive (remote hostnames and most repo paths on major forges are\n * case-insensitive in practice).\n */\nexport function normalizeOriginUrl(rawUrl: string): string {\n  let url = rawUrl.trim();\n  if (!url) return \"\";\n\n  // Strip trailing `.git` case-insensitively — the whole result is\n  // lowercased at the end, so `.GIT` / `.Git` must be treated the same as\n  // `.git`. Previously the `.endsWith(\".git\")` check let `.GIT` leak\n  // through and appear in the output.\n  if (/\\.git$/i.test(url)) url = url.slice(0, -4);\n\n  // Windows drive-letter local path (e.g. `C:/repos/app`): detect here\n  // so the scp matcher below can accept single-character SSH host aliases\n  // (`h:foo/bar` from `.ssh/config`). A drive letter is exactly one ASCII\n  // letter followed by `:/` or `:\\`; SSH aliases never have a slash\n  // immediately after the colon.\n  if (/^[A-Za-z]:[\\\\/]/.test(url)) {\n    return url.toLowerCase();\n  }\n\n  // Protocol-prefixed: ssh://, https://, http://, git://, file://\n  // Must be tried FIRST so that scp-style detection below doesn't\n  // incorrectly swallow an ssh:// URL that happens to contain `:port/`.\n  //\n  // Matches:\n  //   1: host — bracketed IPv6 `[2001:db8::1]`, plain host with no `:` / `/`,\n  //      OR empty (for `file:///path` which has no host component).\n  //   2: port (optional) — preserved in the output so two repos on the same\n  //      host under different ports get distinct project namespaces.\n  //      Losing the port risked false-coalescing separate repos on custom\n  //      SSH mesh setups.\n  //   3: path (optional)\n  const protoMatch =\n    /^[a-z][a-z0-9+.-]*:\\/\\/(?:[^@/]+@)?(\\[[^\\]]+\\]|[^/:]*)(?::(\\d+))?(\\/.*)?$/i.exec(url);\n  if (protoMatch) {\n    let host = protoMatch[1] ?? \"\";\n    // Detect IPv6 via the bracketed input form BEFORE stripping brackets,\n    // so that when we later re-attach a port we can preserve the\n    // `[host]:port` boundary. Without the brackets, `host:2222` is\n    // ambiguous with a longer bare IPv6 address like `2001:db8::1:2222`.\n    const wasBracketed =\n      host.startsWith(\"[\") && host.endsWith(\"]\");\n    if (wasBracketed) host = host.slice(1, -1);\n    const port = protoMatch[2];\n    const repoPath = (protoMatch[3] ?? \"\").replace(/^\\/+/, \"\");\n    const hostPort = port\n      ? wasBracketed\n        ? `[${host}]:${port}`\n        : `${host}:${port}`\n      : host;\n    // For protocols without a host component (file:///path), fall back to\n    // a stable prefix so distinct local paths don't collapse to \"/path\".\n    const prefix = hostPort.length > 0 ? hostPort : \"localhost\";\n    return `${prefix}/${repoPath}`.toLowerCase();\n  }\n\n  // scp-like syntax: [user@]host:path. Protocol-prefixed URLs (`scheme://`)\n  // are handled above, so the scp branch below guards against them: a\n  // matched `host` of `scheme` followed by a path starting with `//` is\n  // a protocol URL that fell through and must NOT be parsed here.\n  // `user@` is optional — git also accepts userless scp forms like\n  // `host:org/repo`. Valid scp paths may start with digits (e.g.\n  // `git@host:123/repo.git`), so no numeric guard is needed: port-bearing\n  // URLs have the `://` prefix and match the protocol branch above before\n  // reaching here.\n  //\n  // Windows drive letters were filtered above, so single-character SSH\n  // host aliases (`h:foo/bar`) are accepted here.\n  //\n  // Bracketed IPv6 (`[2001:db8::1]`) is supported: the host alternative\n  // matches the bracketed literal up to `]` without splitting on internal\n  // `:`. Brackets are stripped in the normalised form so the scp and\n  // `ssh://` forms of the same IPv6 remote produce identical projectIds.\n  const scpMatch =\n    /^(?:([^@\\s/]+)@)?(\\[[^\\]]+\\]|[^:@\\s/]+):(.+)$/.exec(url);\n  if (scpMatch) {\n    let host = scpMatch[2] ?? \"\";\n    if (host.startsWith(\"[\") && host.endsWith(\"]\")) host = host.slice(1, -1);\n    const repoPath = scpMatch[3] ?? \"\";\n    // Reject protocol-like leftovers (e.g. `file:///path` where the scp\n    // regex greedily matched `file` as host and `///path` as path).\n    if (repoPath.startsWith(\"//\")) {\n      return url.toLowerCase();\n    }\n    return `${host}/${repoPath.replace(/^\\/+/, \"\")}`.toLowerCase();\n  }\n\n  // Fallback: use raw lowercased\n  return url.toLowerCase();\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Resolver\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface ResolveGitContextOptions {\n  /** Inject a git invoker (tests). Defaults to spawning real `git`. */\n  invoker?: GitInvoker;\n}\n\n/**\n * Detect the git project + branch for `cwd`.\n *\n * Returns `null` when:\n *   - `cwd` is not an absolute path (invalid input, CLAUDE.md #51)\n *   - `cwd` is not inside a git worktree\n *   - `git` is not available on PATH\n *\n * Never throws.\n */\nexport async function resolveGitContext(\n  cwd: string,\n  options: ResolveGitContextOptions = {},\n): Promise<GitContext | null> {\n  // Wrap the whole body so the documented \"Never throws\" contract is\n  // enforced. Possible throw sites include:\n  //   - `expandTildePath` → `resolveHomeDir()` → `os.homedir()` when HOME\n  //     is unset (e.g. minimal containers)\n  //   - a custom `options.invoker` that raises instead of returning a\n  //     non-zero exitCode\n  //   - any future helper added to this chain\n  // All of those map to \"not in a repo\" / `null`.\n  try {\n    // Validate input: must be a non-empty string.\n    if (typeof cwd !== \"string\" || cwd.length === 0) return null;\n\n    // Expand `~` per CLAUDE.md #17, then require absolute path.\n    const expanded = expandTildePath(cwd);\n    if (!path.isAbsolute(expanded)) return null;\n\n    const invoker = options.invoker ?? defaultGitInvoker();\n\n    // 1. Locate the repo root.\n    const topLevel = invoker(expanded, [\"rev-parse\", \"--show-toplevel\"]);\n    if (topLevel.exitCode !== 0) return null;\n    const rootPath = topLevel.stdout.trim();\n    if (!rootPath) return null;\n\n    // 2. Current branch. `--abbrev-ref HEAD` returns `HEAD` in detached\n    //    state, which we normalize to `null`. On a fresh `git init` the\n    //    HEAD ref is unborn and `--abbrev-ref HEAD` fails, but\n    //    `symbolic-ref HEAD` still returns the target branch. Fall back\n    //    so newly-initialized repos get a sensible branch name.\n    const branchResult = invoker(rootPath, [\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n    let branch: string | null = null;\n    if (branchResult.exitCode === 0) {\n      const raw = branchResult.stdout.trim();\n      branch = raw && raw !== \"HEAD\" ? raw : null;\n    } else {\n      const unbornRef = invoker(rootPath, [\"symbolic-ref\", \"--quiet\", \"HEAD\"]);\n      if (unbornRef.exitCode === 0) {\n        const raw = unbornRef.stdout.trim();\n        const prefix = \"refs/heads/\";\n        if (raw.startsWith(prefix)) {\n          const candidate = raw.slice(prefix.length);\n          if (candidate) branch = candidate;\n        }\n      }\n    }\n\n    // 3. Origin URL — optional. Used to derive a stable `projectId`.\n    const originResult = invoker(rootPath, [\"remote\", \"get-url\", \"origin\"]);\n    let projectId: string;\n    if (originResult.exitCode === 0) {\n      const normalized = normalizeOriginUrl(originResult.stdout);\n      projectId = normalized ? `origin:${stableHash(normalized)}` : `root:${stableHash(rootPath)}`;\n    } else {\n      projectId = `root:${stableHash(rootPath)}`;\n    }\n\n    // 4. Default branch — best effort.\n    const headRef = invoker(rootPath, [\"symbolic-ref\", \"--quiet\", \"refs/remotes/origin/HEAD\"]);\n    let defaultBranch: string | null = null;\n    if (headRef.exitCode === 0) {\n      const raw = headRef.stdout.trim();\n      const prefix = \"refs/remotes/origin/\";\n      if (raw.startsWith(prefix)) {\n        const candidate = raw.slice(prefix.length);\n        if (candidate) defaultBranch = candidate;\n      }\n    }\n\n    return {\n      projectId,\n      branch,\n      rootPath,\n      defaultBranch,\n    };\n  } catch {\n    // Never throws — any unexpected error falls back to \"not in a repo\".\n    return null;\n  }\n}\n","/**\n * Coding-agent namespace overlay (issue #569 PR 2 + PR 3).\n *\n * Given a `CodingContext` (from `resolveGitContext`) and a `CodingModeConfig`,\n * returns the namespace that recall + write paths should use — or `null` when\n * no overlay should apply (coding mode disabled, no context supplied, or\n * feature flags off).\n *\n * PR 2 ships the project overlay. PR 3 will add the branch overlay; the\n * function here already handles both flags so the schema / types / plumbing\n * don't have to change a second time when branch-scope lands.\n *\n * Pure function — no orchestrator, no config side-effects. Callers keep rule\n * 42 (read + write through same namespace layer) by consulting the same\n * function on both paths.\n */\n\nimport type { CodingContext, CodingModeConfig } from \"../types.js\";\nimport { stableHash } from \"./git-context.js\";\n\nexport interface CodingNamespaceOverlay {\n  /**\n   * Effective namespace to use for this session's memory operations. When\n   * `branchScope` is on, takes the form `project:<id>/branch:<b>`; otherwise\n   * `project:<id>`.\n   */\n  namespace: string;\n  /**\n   * Read fallbacks — additional namespaces a caller should include in recall\n   * so that, for example, a branch-scoped session still sees project-level\n   * memories that were written before the branch scope was enabled.\n   *\n   * Writes MUST go to `namespace` only; these are read-side only.\n   *\n   * Introduced to carry PR 3's branch→project fallback; PR 2 returns an empty\n   * array here.\n   */\n  readFallbacks: string[];\n  /**\n   * `\"project\"` when only project scope applies, `\"branch\"` when branch scope\n   * is also layered on. Used for diagnostics (`remnic doctor`) and logging.\n   */\n  scope: \"project\" | \"branch\";\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Sanitization\n// ──────────────────────────────────────────────────────────────────────────\n\n/**\n * Normalize a projectId / branch fragment so the resulting namespace passes\n * the router's `isSafeRouteNamespace` check (`[A-Za-z0-9._-]{1,64}`).\n *\n * Namespaces are used as filesystem directory names and must not contain\n * path separators (`/`, `\\`) or colons — so both `:` and `/` collapse to `-`.\n * The project-id format `origin:<8hex>` and branch names like `feat/x` both\n * flow through this helper before hitting the storage layer.\n *\n * NOT a security boundary — projectIds come from `resolveGitContext` (known\n * hex), and branch names come from local git. This defends against corrupt\n * input only.\n */\n/**\n * Single-pass sanitization — each input character is visited exactly once.\n * Rewriting as an explicit loop (instead of chained `replace()` calls with\n * greedy quantifiers) closes the polynomial-backtracking surface that\n * CodeQL flagged on patterns like `-+` and `^-+|-+$`.\n */\nfunction sanitizeFragment(input: string): string {\n  if (typeof input !== \"string\") return \"\";\n  const trimmed = input.trim().toLowerCase();\n  let out = \"\";\n  let prevIsDash = true; // suppress leading dashes\n  for (let i = 0; i < trimmed.length; i += 1) {\n    const c = trimmed[i]!;\n    const cc = trimmed.charCodeAt(i);\n    const isSafe =\n      (cc >= 48 && cc <= 57) /* 0-9 */ ||\n      (cc >= 97 && cc <= 122) /* a-z */ ||\n      cc === 46 /* . */ ||\n      cc === 95 /* _ */;\n    if (isSafe) {\n      out += c;\n      prevIsDash = false;\n    } else if (!prevIsDash) {\n      out += \"-\";\n      prevIsDash = true;\n    }\n  }\n  // Strip a single trailing dash introduced by the final run of unsafe chars.\n  if (out.endsWith(\"-\")) out = out.slice(0, -1);\n  return out;\n}\n\n/**\n * Cap to the router's per-namespace upper bound.\n *\n * Raw truncation alone would collapse distinct long inputs that differ near\n * the end (e.g. two `feat/...` branches with different suffixes) into the\n * same namespace — silently mixing recall/write state across branches or\n * projects. When truncation is needed, we append a short deterministic\n * hash suffix (`-<8hex>`) derived from the FULL pre-truncated value so\n * collisions only happen under true hash collisions, not simple prefix\n * overlap.\n *\n * The tail is trimmed to leave room for the separator and 8-char hash and\n * any trailing `-` introduced by the slice is stripped so the final\n * character before `-<hash>` is always alphanumeric or `.`/`_`.\n */\nconst MAX_NAMESPACE_LEN = 64;\nconst HASH_SUFFIX_LEN = 9; // \"-\" + 8 hex chars\n\nfunction capLength(value: string): string {\n  if (value.length <= MAX_NAMESPACE_LEN) return value;\n  // Reuse the FNV-1a 32-bit hash from git-context — one canonical\n  // implementation, one set of edge-case fixes. Uses Math.imul for\n  // correct 32-bit wrap-around, which plain `*` would not guarantee\n  // for the largest intermediate products.\n  const hash = stableHash(value);\n  // Trim trailing '-' with a linear, non-backtracking loop. A regex\n  // like `-+$` is linear too, but an explicit loop keeps CodeQL happy\n  // about polynomial backtracking warnings when several `\\-+` patterns\n  // appear in the same module.\n  let end = MAX_NAMESPACE_LEN - HASH_SUFFIX_LEN;\n  while (end > 0 && value.charCodeAt(end - 1) === 45 /* '-' */) end -= 1;\n  return `${value.slice(0, end)}-${hash}`;\n}\n\n/**\n * Produce the project-scope namespace name. Exported for tests and for\n * `remnic doctor` to render. Guaranteed to satisfy `isSafeRouteNamespace`:\n * no `/`, no `:`, lowercase only, length-capped to 64 chars.\n */\nexport function projectNamespaceName(projectId: string): string {\n  const frag = sanitizeFragment(projectId);\n  return capLength(`project-${frag || \"unknown\"}`);\n}\n\nexport function projectTagProjectId(projectTag: string): string {\n  const trimmed = projectTag.trim();\n  const frag = sanitizeFragment(trimmed);\n  const disambig = trimmed.length > 0 && frag !== trimmed;\n  const suffix = disambig ? `-${stableHash(trimmed)}` : \"\";\n  return `tag:${frag || \"unknown\"}${suffix}`;\n}\n\n/**\n * Preserve case when sanitizing a principal-derived base namespace. The\n * router's `isSafeRouteNamespace` check accepts `[A-Za-z0-9._-]{1,64}`, so\n * upper-case characters in the principal name are safe and MUST be kept to\n * avoid colliding two otherwise-distinct principals (e.g. `Alice` vs\n * `alice`) into the same combined namespace.\n *\n * Otherwise identical to `sanitizeFragment`: single-pass, linear, no\n * polynomial-backtracking quantifiers, unsafe chars collapse to `-` with\n * leading/trailing dashes suppressed.\n */\nfunction sanitizeBaseFragment(input: string): string {\n  if (typeof input !== \"string\") return \"\";\n  const trimmed = input.trim();\n  let out = \"\";\n  let prevIsDash = true;\n  for (let i = 0; i < trimmed.length; i += 1) {\n    const c = trimmed[i]!;\n    const cc = trimmed.charCodeAt(i);\n    const isSafe =\n      (cc >= 48 && cc <= 57) /* 0-9 */ ||\n      (cc >= 65 && cc <= 90) /* A-Z */ ||\n      (cc >= 97 && cc <= 122) /* a-z */ ||\n      cc === 46 /* . */ ||\n      cc === 95 /* _ */;\n    if (isSafe) {\n      out += c;\n      prevIsDash = false;\n    } else if (!prevIsDash) {\n      out += \"-\";\n      prevIsDash = true;\n    }\n  }\n  if (out.endsWith(\"-\")) out = out.slice(0, -1);\n  return out;\n}\n\n/**\n * Combine a principal-derived base namespace (e.g. `default`, `alice`) with a\n * coding-agent overlay namespace (e.g. `project-origin-abcd1234`). The result\n * is a single safe-route token that preserves principal isolation (CLAUDE.md\n * rule 42: read + write must resolve through the same namespace layer — and\n * here, through the same principal-scoped prefix) while layering project or\n * project/branch scope on top.\n *\n * Multiple principals working in the same repo thus get distinct namespaces:\n *\n *   alice + project-origin-ab12  →  alice-project-origin-ab12\n *   bob   + project-origin-ab12  →  bob-project-origin-ab12\n *   Alice + project-origin-ab12  →  Alice-project-origin-ab12 (distinct)\n *\n * The base fragment preserves case so `Alice` and `alice` remain distinct;\n * the overlay fragment is still lowercase-sanitized because it derives from\n * deterministic, pre-lowercased git hashes.\n *\n * Output is re-capped through `capLength` so a very long base + overlay\n * combination still fits inside `isSafeRouteNamespace` (≤ 64 chars). The\n * deterministic hash suffix on truncation keeps distinct inputs distinct.\n */\nexport function combineNamespaces(base: string, overlay: string): string {\n  const baseFrag = sanitizeBaseFragment(base);\n  const overlayFrag = sanitizeFragment(overlay);\n  if (!baseFrag) return capLength(overlayFrag || \"unknown\");\n  if (!overlayFrag) return capLength(baseFrag);\n  return capLength(`${baseFrag}-${overlayFrag}`);\n}\n\n/**\n * Produce the branch-scope namespace name. Format:\n * `project-<id>-branch-<name>[-<hash>]`. Uses `-` as the structural separator\n * rather than `/` or `:` so the result is a single safe route-namespace\n * token that can be used directly as a filesystem directory.\n *\n * Two failure modes must not collapse distinct branches to one namespace:\n *\n *   1. Sanitization is lossy (`feat/x` and `feat-x` both sanitize to\n *      `feat-x`; `Feature` and `feature` both sanitize to `feature`). When\n *      sanitization rewrote any character, we append a short hash of the\n *      RAW branch so distinct inputs stay distinct.\n *   2. Truncation is applied when the total exceeds 64 chars. In that\n *      mode `capLength` appends its own hash of the full pre-truncated\n *      value.\n *\n * Long branches that also sanitize may receive both kinds of hashes — that\n * is acceptable: the router only requires the result be unique and\n * deterministic, and the two hashes derive from different domains so they\n * don't conflict.\n */\nexport function branchNamespaceName(projectId: string, branch: string): string {\n  const projectFrag = sanitizeFragment(projectId);\n  const trimmedBranch = branch.trim();\n  const branchFrag = sanitizeFragment(trimmedBranch);\n  // Lossy-sanitization disambiguator: append hash of the raw (trimmed)\n  // branch when sanitization actually changed the string. Preserves\n  // distinctness across `feat/x` vs `feat-x` and `Feature` vs `feature`.\n  // The comparison uses the raw trimmed value (NOT `.toLowerCase()`) so\n  // case-only variants are treated as lossy and receive their own hash.\n  // Empty / already-safe-lowercase inputs get no hash so the common case\n  // stays readable.\n  const disambig = trimmedBranch.length > 0 && branchFrag !== trimmedBranch;\n  const base = `project-${projectFrag || \"unknown\"}-branch-${branchFrag || \"unknown\"}`;\n  const suffixed = disambig ? `${base}-${stableHash(trimmedBranch)}` : base;\n  return capLength(suffixed);\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Overlay resolver\n// ──────────────────────────────────────────────────────────────────────────\n\n/**\n * Compute the namespace overlay for a session.\n *\n * Returns `null` when no overlay applies — callers should then use their\n * existing `defaultNamespaceForPrincipal(...)` result unchanged. This keeps\n * CLAUDE.md #30 (escape hatch): setting `codingMode.projectScope: false`\n * exactly restores pre-#569 behaviour at every call site.\n *\n * @param codingContext — git context from the connector\n * @param config — coding mode flags (projectScope, branchScope, globalFallback)\n * @param defaultNamespace — retained for call-site compatibility; no longer\n *   used. The global fallback is expressed as an empty-string sentinel in\n *   `readFallbacks`, which `combineNamespaces(principal, \"\")` resolves to the\n *   principal's own namespace at the call site.\n */\nexport function resolveCodingNamespaceOverlay(\n  codingContext: CodingContext | null | undefined,\n  config: Pick<CodingModeConfig, \"projectScope\" | \"branchScope\" | \"globalFallback\">,\n  defaultNamespace?: string,\n): CodingNamespaceOverlay | null {\n  // No context supplied (session isn't in a git repo, or connector didn't\n  // attach one) → no overlay.\n  if (!codingContext) return null;\n\n  // Project scope disabled → no overlay at all. Branch scope depends on\n  // project scope being on; there is no branch-only mode.\n  if (!config.projectScope) return null;\n\n  // Require a non-empty projectId — defensive.\n  const projectId = typeof codingContext.projectId === \"string\" ? codingContext.projectId.trim() : \"\";\n  if (!projectId) return null;\n\n  const projectNs = projectNamespaceName(projectId);\n\n  // Root/global namespace fallback: when `globalFallback` is true, include\n  // the principal's self namespace in readFallbacks so cross-project knowledge\n  // remains visible. CLAUDE.md #30: the gate is `globalFallback` — set to\n  // false for strict project isolation.\n  //\n  // The fallback value is \"\" (empty string), NOT the defaultNamespace name.\n  // The orchestrator passes each fallback through combineNamespaces(principal, fallback),\n  // and combineNamespaces(base, \"\") returns base unchanged — yielding the\n  // principal's own namespace. Using the actual namespace name (e.g., \"default\")\n  // would produce \"default-default\" after combination, missing the target.\n  const includeRoot = config.globalFallback === true;\n\n  // Branch-scope layering (PR 3):\n  //   - only when config.branchScope is explicitly true\n  //   - only when we actually have a branch (null in detached HEAD)\n  //   - project namespace becomes a read fallback so project-level memories\n  //     remain visible from any branch (deliberate asymmetry — branch writes\n  //     don't leak up, but project reads leak down).\n  //   - when globalFallback is on, the root namespace is also appended so\n  //     globally useful memories surface in every branch.\n  if (config.branchScope && typeof codingContext.branch === \"string\" && codingContext.branch.length > 0) {\n    const branchNs = branchNamespaceName(projectId, codingContext.branch);\n    const fallbacks = [projectNs];\n    if (includeRoot) fallbacks.push(\"\");\n    return {\n      namespace: branchNs,\n      readFallbacks: fallbacks,\n      scope: \"branch\",\n    };\n  }\n\n  return {\n    namespace: projectNs,\n    readFallbacks: includeRoot ? [\"\"] : [],\n    scope: \"project\",\n  };\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Diagnostics (issue #569 PR 3 + PR 8)\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface CodingScopeDescription {\n  /** \"none\" when no overlay is active; otherwise the resolved scope level. */\n  scope: \"none\" | \"project\" | \"branch\";\n  /** Project id (raw, not sanitized) when a context is attached. */\n  projectId: string | null;\n  /** Branch name (raw, not sanitized) when available. */\n  branch: string | null;\n  /** Effective namespace writes route to. `null` when no overlay applies. */\n  effectiveNamespace: string | null;\n  /** Read fallbacks included in recall (non-empty only when branch-scope is on). */\n  readFallbacks: string[];\n  /**\n   * Why no overlay applies, when `scope === \"none\"`. One of:\n   *   - `\"no-context\"`  — connector didn't attach a CodingContext\n   *   - `\"disabled\"`   — codingMode.projectScope is false\n   *   - `\"empty-project\"` — codingContext.projectId was empty/whitespace\n   */\n  disabledReason: \"no-context\" | \"disabled\" | \"empty-project\" | null;\n}\n\n/**\n * Human-readable description of the coding-agent scope that currently applies\n * for a session. Consumed by `remnic doctor` (PR 8) and by logs to surface\n * why recall routes where it does.\n *\n * Pure — callers pass the coding context + config they already have.\n */\nexport function describeCodingScope(\n  codingContext: CodingContext | null | undefined,\n  config: Pick<CodingModeConfig, \"projectScope\" | \"branchScope\" | \"globalFallback\">,\n  defaultNamespace?: string,\n): CodingScopeDescription {\n  const projectId = codingContext?.projectId ?? null;\n  const branch = codingContext?.branch ?? null;\n\n  if (!codingContext) {\n    return {\n      scope: \"none\",\n      projectId: null,\n      branch: null,\n      effectiveNamespace: null,\n      readFallbacks: [],\n      disabledReason: \"no-context\",\n    };\n  }\n  if (!config.projectScope) {\n    return {\n      scope: \"none\",\n      projectId,\n      branch,\n      effectiveNamespace: null,\n      readFallbacks: [],\n      disabledReason: \"disabled\",\n    };\n  }\n  const trimmedId = typeof projectId === \"string\" ? projectId.trim() : \"\";\n  if (!trimmedId) {\n    return {\n      scope: \"none\",\n      projectId,\n      branch,\n      effectiveNamespace: null,\n      readFallbacks: [],\n      disabledReason: \"empty-project\",\n    };\n  }\n\n  const overlay = resolveCodingNamespaceOverlay(codingContext, config, defaultNamespace);\n  // Unreachable in practice given the guards above, but keep the return\n  // shape consistent if the resolver grows new null branches later.\n  if (!overlay) {\n    return {\n      scope: \"none\",\n      projectId,\n      branch,\n      effectiveNamespace: null,\n      readFallbacks: [],\n      disabledReason: \"disabled\",\n    };\n  }\n  return {\n    scope: overlay.scope,\n    projectId,\n    branch,\n    effectiveNamespace: overlay.namespace,\n    readFallbacks: overlay.readFallbacks,\n    disabledReason: null,\n  };\n}\n","/**\n * Generic reinforcement-core primitives extracted from `procedure-miner.ts`\n * (issue #687 PR 1/4). Procedure-specific scoring (success rate, step\n * normalization) intentionally stays in the miner — this module only\n * exposes category-agnostic clustering and cluster summarization helpers\n * so future PRs can run reinforcement across non-procedural categories.\n *\n * Pure refactor — no behavior change.\n */\n\n/**\n * Group `items` into clusters keyed by `keyFn(item)`.\n *\n * - Preserves the original input order within each cluster's array.\n * - The returned `Map` insertion order matches first-seen key order, so\n *   downstream iteration is deterministic for a given input.\n * - Throws `TypeError` if `keyFn` returns a non-string (e.g. `undefined`,\n *   `null`, or a number). Callers must produce a stable string key.\n */\nexport function clusterByKey<T>(items: readonly T[], keyFn: (item: T) => string): Map<string, T[]> {\n  const clusters = new Map<string, T[]>();\n  for (const item of items) {\n    const key = keyFn(item);\n    if (typeof key !== \"string\") {\n      throw new TypeError(\n        `clusterByKey: keyFn must return a string, got ${key === null ? \"null\" : typeof key}`,\n      );\n    }\n    const existing = clusters.get(key);\n    if (existing) {\n      existing.push(item);\n    } else {\n      clusters.set(key, [item]);\n    }\n  }\n  return clusters;\n}\n\nexport interface ClusterSummary {\n  /** Number of items in the cluster. */\n  count: number;\n  /** Earliest timestamp seen in the cluster (string min via `localeCompare`). */\n  firstSeen: string;\n  /** Latest timestamp seen in the cluster (string max via `localeCompare`). */\n  lastSeen: string;\n}\n\n/**\n * Summarize a cluster by counting items and tracking earliest/latest\n * timestamps. Timestamp comparison uses `String#localeCompare`, which is\n * correct for ISO-8601 strings (lexicographic order matches chronological\n * order).\n *\n * - Throws `RangeError` on empty clusters — `firstSeen`/`lastSeen` are not\n *   meaningful without at least one item.\n * - When all timestamps are equal, `firstSeen === lastSeen`.\n */\nexport function summarizeCluster<T>(\n  cluster: readonly T[],\n  extractTimestamp: (item: T) => string,\n): ClusterSummary {\n  if (cluster.length === 0) {\n    throw new RangeError(\"summarizeCluster: cluster must contain at least one item\");\n  }\n  let firstSeen = extractTimestamp(cluster[0]);\n  let lastSeen = firstSeen;\n  for (let i = 1; i < cluster.length; i += 1) {\n    const ts = extractTimestamp(cluster[i]);\n    if (ts.localeCompare(firstSeen) < 0) firstSeen = ts;\n    if (ts.localeCompare(lastSeen) > 0) lastSeen = ts;\n  }\n  return { count: cluster.length, firstSeen, lastSeen };\n}\n"],"mappings":";;;;;;;;AAuBA,OAAO,UAAU;AA8DjB,IAAM,yBAAyB;AAExB,SAAS,oBAAgC;AAC9C,SAAO,CAAC,KAAa,SAAmB;AACtC,UAAM,SAAS,kBAAkB,OAAO,MAAM;AAAA,MAC5C;AAAA,MACA,UAAU;AAAA,MACV,SAAS;AAAA,MACT,OAAO;AAAA,IACT,CAAC;AACD,QAAI,OAAO,OAAO;AAEhB,aAAO,EAAE,QAAQ,IAAI,UAAU,IAAI;AAAA,IACrC;AACA,WAAO;AAAA,MACL,QAAQ,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AAAA,MAC5D,UAAU,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AAAA,IAChE;AAAA,EACF;AACF;AAeO,SAAS,WAAW,OAAuB;AAChD,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,YAAQ,MAAM,WAAW,CAAC;AAC1B,WAAO,KAAK,KAAK,MAAM,QAAU,MAAM;AAAA,EACzC;AACA,SAAO,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC1C;AAkBO,SAAS,mBAAmB,QAAwB;AACzD,MAAI,MAAM,OAAO,KAAK;AACtB,MAAI,CAAC,IAAK,QAAO;AAMjB,MAAI,UAAU,KAAK,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE;AAO9C,MAAI,kBAAkB,KAAK,GAAG,GAAG;AAC/B,WAAO,IAAI,YAAY;AAAA,EACzB;AAcA,QAAM,aACJ,6EAA6E,KAAK,GAAG;AACvF,MAAI,YAAY;AACd,QAAI,OAAO,WAAW,CAAC,KAAK;AAK5B,UAAM,eACJ,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG;AAC3C,QAAI,aAAc,QAAO,KAAK,MAAM,GAAG,EAAE;AACzC,UAAM,OAAO,WAAW,CAAC;AACzB,UAAM,YAAY,WAAW,CAAC,KAAK,IAAI,QAAQ,QAAQ,EAAE;AACzD,UAAM,WAAW,OACb,eACE,IAAI,IAAI,KAAK,IAAI,KACjB,GAAG,IAAI,IAAI,IAAI,KACjB;AAGJ,UAAM,SAAS,SAAS,SAAS,IAAI,WAAW;AAChD,WAAO,GAAG,MAAM,IAAI,QAAQ,GAAG,YAAY;AAAA,EAC7C;AAmBA,QAAM,WACJ,gDAAgD,KAAK,GAAG;AAC1D,MAAI,UAAU;AACZ,QAAI,OAAO,SAAS,CAAC,KAAK;AAC1B,QAAI,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,EAAG,QAAO,KAAK,MAAM,GAAG,EAAE;AACvE,UAAM,WAAW,SAAS,CAAC,KAAK;AAGhC,QAAI,SAAS,WAAW,IAAI,GAAG;AAC7B,aAAO,IAAI,YAAY;AAAA,IACzB;AACA,WAAO,GAAG,IAAI,IAAI,SAAS,QAAQ,QAAQ,EAAE,CAAC,GAAG,YAAY;AAAA,EAC/D;AAGA,SAAO,IAAI,YAAY;AACzB;AAqBA,eAAsB,kBACpB,KACA,UAAoC,CAAC,GACT;AAS5B,MAAI;AAEF,QAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,EAAG,QAAO;AAGxD,UAAM,WAAW,gBAAgB,GAAG;AACpC,QAAI,CAAC,KAAK,WAAW,QAAQ,EAAG,QAAO;AAEvC,UAAM,UAAU,QAAQ,WAAW,kBAAkB;AAGrD,UAAM,WAAW,QAAQ,UAAU,CAAC,aAAa,iBAAiB,CAAC;AACnE,QAAI,SAAS,aAAa,EAAG,QAAO;AACpC,UAAM,WAAW,SAAS,OAAO,KAAK;AACtC,QAAI,CAAC,SAAU,QAAO;AAOtB,UAAM,eAAe,QAAQ,UAAU,CAAC,aAAa,gBAAgB,MAAM,CAAC;AAC5E,QAAI,SAAwB;AAC5B,QAAI,aAAa,aAAa,GAAG;AAC/B,YAAM,MAAM,aAAa,OAAO,KAAK;AACrC,eAAS,OAAO,QAAQ,SAAS,MAAM;AAAA,IACzC,OAAO;AACL,YAAM,YAAY,QAAQ,UAAU,CAAC,gBAAgB,WAAW,MAAM,CAAC;AACvE,UAAI,UAAU,aAAa,GAAG;AAC5B,cAAM,MAAM,UAAU,OAAO,KAAK;AAClC,cAAM,SAAS;AACf,YAAI,IAAI,WAAW,MAAM,GAAG;AAC1B,gBAAM,YAAY,IAAI,MAAM,OAAO,MAAM;AACzC,cAAI,UAAW,UAAS;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAGA,UAAM,eAAe,QAAQ,UAAU,CAAC,UAAU,WAAW,QAAQ,CAAC;AACtE,QAAI;AACJ,QAAI,aAAa,aAAa,GAAG;AAC/B,YAAM,aAAa,mBAAmB,aAAa,MAAM;AACzD,kBAAY,aAAa,UAAU,WAAW,UAAU,CAAC,KAAK,QAAQ,WAAW,QAAQ,CAAC;AAAA,IAC5F,OAAO;AACL,kBAAY,QAAQ,WAAW,QAAQ,CAAC;AAAA,IAC1C;AAGA,UAAM,UAAU,QAAQ,UAAU,CAAC,gBAAgB,WAAW,0BAA0B,CAAC;AACzF,QAAI,gBAA+B;AACnC,QAAI,QAAQ,aAAa,GAAG;AAC1B,YAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,YAAM,SAAS;AACf,UAAI,IAAI,WAAW,MAAM,GAAG;AAC1B,cAAM,YAAY,IAAI,MAAM,OAAO,MAAM;AACzC,YAAI,UAAW,iBAAgB;AAAA,MACjC;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;;;AC3QA,SAAS,iBAAiB,OAAuB;AAC/C,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,MAAI,MAAM;AACV,MAAI,aAAa;AACjB,WAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK,GAAG;AAC1C,UAAM,IAAI,QAAQ,CAAC;AACnB,UAAM,KAAK,QAAQ,WAAW,CAAC;AAC/B,UAAM,SACH,MAAM,MAAM,MAAM,MAClB,MAAM,MAAM,MAAM,OACnB,OAAO,MACP,OAAO;AACT,QAAI,QAAQ;AACV,aAAO;AACP,mBAAa;AAAA,IACf,WAAW,CAAC,YAAY;AACtB,aAAO;AACP,mBAAa;AAAA,IACf;AAAA,EACF;AAEA,MAAI,IAAI,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE;AAC5C,SAAO;AACT;AAiBA,IAAM,oBAAoB;AAC1B,IAAM,kBAAkB;AAExB,SAAS,UAAU,OAAuB;AACxC,MAAI,MAAM,UAAU,kBAAmB,QAAO;AAK9C,QAAM,OAAO,WAAW,KAAK;AAK7B,MAAI,MAAM,oBAAoB;AAC9B,SAAO,MAAM,KAAK,MAAM,WAAW,MAAM,CAAC,MAAM,GAAc,QAAO;AACrE,SAAO,GAAG,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI;AACvC;AAOO,SAAS,qBAAqB,WAA2B;AAC9D,QAAM,OAAO,iBAAiB,SAAS;AACvC,SAAO,UAAU,WAAW,QAAQ,SAAS,EAAE;AACjD;AAEO,SAAS,oBAAoB,YAA4B;AAC9D,QAAM,UAAU,WAAW,KAAK;AAChC,QAAM,OAAO,iBAAiB,OAAO;AACrC,QAAM,WAAW,QAAQ,SAAS,KAAK,SAAS;AAChD,QAAM,SAAS,WAAW,IAAI,WAAW,OAAO,CAAC,KAAK;AACtD,SAAO,OAAO,QAAQ,SAAS,GAAG,MAAM;AAC1C;AAaA,SAAS,qBAAqB,OAAuB;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,MAAM;AACV,MAAI,aAAa;AACjB,WAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK,GAAG;AAC1C,UAAM,IAAI,QAAQ,CAAC;AACnB,UAAM,KAAK,QAAQ,WAAW,CAAC;AAC/B,UAAM,SACH,MAAM,MAAM,MAAM,MAClB,MAAM,MAAM,MAAM,MAClB,MAAM,MAAM,MAAM,OACnB,OAAO,MACP,OAAO;AACT,QAAI,QAAQ;AACV,aAAO;AACP,mBAAa;AAAA,IACf,WAAW,CAAC,YAAY;AACtB,aAAO;AACP,mBAAa;AAAA,IACf;AAAA,EACF;AACA,MAAI,IAAI,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE;AAC5C,SAAO;AACT;AAwBO,SAAS,kBAAkB,MAAc,SAAyB;AACvE,QAAM,WAAW,qBAAqB,IAAI;AAC1C,QAAM,cAAc,iBAAiB,OAAO;AAC5C,MAAI,CAAC,SAAU,QAAO,UAAU,eAAe,SAAS;AACxD,MAAI,CAAC,YAAa,QAAO,UAAU,QAAQ;AAC3C,SAAO,UAAU,GAAG,QAAQ,IAAI,WAAW,EAAE;AAC/C;AAuBO,SAAS,oBAAoB,WAAmB,QAAwB;AAC7E,QAAM,cAAc,iBAAiB,SAAS;AAC9C,QAAM,gBAAgB,OAAO,KAAK;AAClC,QAAM,aAAa,iBAAiB,aAAa;AAQjD,QAAM,WAAW,cAAc,SAAS,KAAK,eAAe;AAC5D,QAAM,OAAO,WAAW,eAAe,SAAS,WAAW,cAAc,SAAS;AAClF,QAAM,WAAW,WAAW,GAAG,IAAI,IAAI,WAAW,aAAa,CAAC,KAAK;AACrE,SAAO,UAAU,QAAQ;AAC3B;AAqBO,SAAS,8BACd,eACA,QACA,kBAC+B;AAG/B,MAAI,CAAC,cAAe,QAAO;AAI3B,MAAI,CAAC,OAAO,aAAc,QAAO;AAGjC,QAAM,YAAY,OAAO,cAAc,cAAc,WAAW,cAAc,UAAU,KAAK,IAAI;AACjG,MAAI,CAAC,UAAW,QAAO;AAEvB,QAAM,YAAY,qBAAqB,SAAS;AAYhD,QAAM,cAAc,OAAO,mBAAmB;AAU9C,MAAI,OAAO,eAAe,OAAO,cAAc,WAAW,YAAY,cAAc,OAAO,SAAS,GAAG;AACrG,UAAM,WAAW,oBAAoB,WAAW,cAAc,MAAM;AACpE,UAAM,YAAY,CAAC,SAAS;AAC5B,QAAI,YAAa,WAAU,KAAK,EAAE;AAClC,WAAO;AAAA,MACL,WAAW;AAAA,MACX,eAAe;AAAA,MACf,OAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,cAAc,CAAC,EAAE,IAAI,CAAC;AAAA,IACrC,OAAO;AAAA,EACT;AACF;AAiCO,SAAS,oBACd,eACA,QACA,kBACwB;AACxB,QAAM,YAAY,eAAe,aAAa;AAC9C,QAAM,SAAS,eAAe,UAAU;AAExC,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,MACL,OAAO;AAAA,MACP,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,oBAAoB;AAAA,MACpB,eAAe,CAAC;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,MAAI,CAAC,OAAO,cAAc;AACxB,WAAO;AAAA,MACL,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA,oBAAoB;AAAA,MACpB,eAAe,CAAC;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,QAAM,YAAY,OAAO,cAAc,WAAW,UAAU,KAAK,IAAI;AACrE,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA,oBAAoB;AAAA,MACpB,eAAe,CAAC;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,UAAU,8BAA8B,eAAe,QAAQ,gBAAgB;AAGrF,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,MACL,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA,oBAAoB;AAAA,MACpB,eAAe,CAAC;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,SAAO;AAAA,IACL,OAAO,QAAQ;AAAA,IACf;AAAA,IACA;AAAA,IACA,oBAAoB,QAAQ;AAAA,IAC5B,eAAe,QAAQ;AAAA,IACvB,gBAAgB;AAAA,EAClB;AACF;;;AChZO,SAAS,aAAgB,OAAqB,OAA8C;AACjG,QAAM,WAAW,oBAAI,IAAiB;AACtC,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM,MAAM,IAAI;AACtB,QAAI,OAAO,QAAQ,UAAU;AAC3B,YAAM,IAAI;AAAA,QACR,iDAAiD,QAAQ,OAAO,SAAS,OAAO,GAAG;AAAA,MACrF;AAAA,IACF;AACA,UAAM,WAAW,SAAS,IAAI,GAAG;AACjC,QAAI,UAAU;AACZ,eAAS,KAAK,IAAI;AAAA,IACpB,OAAO;AACL,eAAS,IAAI,KAAK,CAAC,IAAI,CAAC;AAAA,IAC1B;AAAA,EACF;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/coding/git-context.ts","../src/coding/coding-namespace.ts","../src/procedural/reinforcement-core.ts"],"sourcesContent":["/**\n * GitContextResolver — pure module for detecting the git project + branch\n * a session is operating in.\n *\n * Introduced by issue #569 (coding-agent project/branch-scoped namespaces).\n *\n * This module is deliberately pure:\n *   - no orchestrator references\n *   - no config side-effects\n *   - no namespace wiring\n *\n * Downstream slices (PR 2+ of #569) wire `resolveGitContext` into the\n * `NamespaceResolver` / `Orchestrator` so that memories are scoped to a\n * detected project / branch without leaking across repos.\n *\n * CLAUDE.md rule 17 (expand `~`): the `rootPath` returned here is always an\n * absolute, tilde-expanded path. Callers must not re-expand.\n *\n * CLAUDE.md rule 51 (reject invalid input): `cwd` must be an absolute path\n * and must exist. `resolveGitContext` returns `null` — rather than throwing —\n * when the directory is not inside a git worktree, because being outside a\n * repo is a normal runtime state (e.g. agent opened in a scratch dir).\n */\nimport path from \"node:path\";\n\nimport { expandTildePath } from \"../utils/path.js\";\nimport { launchProcessSync } from \"../runtime/child-process.js\";\n\n// Re-export so existing callers / tests that imported `expandTildePath` from\n// this module keep working. CLAUDE.md #17 requires consistent `~` expansion\n// across every user-facing path input; the canonical implementation now\n// lives in `utils/path.ts`.\nexport { expandTildePath };\n\n// ──────────────────────────────────────────────────────────────────────────\n// Public types\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface GitContext {\n  /**\n   * Stable identifier for the project. Derived from `git remote get-url origin`\n   * when an origin remote is configured, otherwise from the repo root path.\n   *\n   * Formatted as `origin:<hex>` or `root:<hex>` so that the source is visible\n   * to operators (see `remnic doctor`, issue #569 acceptance criteria).\n   */\n  projectId: string;\n  /**\n   * Current branch, e.g. `main`, `feat/foo`. `null` only in detached-HEAD\n   * state (e.g. rebase in progress). Callers should treat `null` as \"no\n   * branch-scope overlay applies\" without erroring.\n   */\n  branch: string | null;\n  /**\n   * Absolute path to the repository root (the directory containing `.git`).\n   * Tilde-expanded per CLAUDE.md #17.\n   */\n  rootPath: string;\n  /**\n   * Best-effort default branch (usually `main` or `master`). Derived from the\n   * `refs/remotes/origin/HEAD` symbolic ref. `null` when not available (e.g.\n   * fresh clone without a default branch symref, or no origin remote).\n   */\n  defaultBranch: string | null;\n}\n\n/**\n * Injectable git-invocation surface. Only the commands `resolveGitContext`\n * actually needs are exposed. Tests inject a mock implementation to avoid\n * spawning a real git process.\n */\nexport interface GitInvoker {\n  /**\n   * Run `git <args>` with `cwd` as the working directory. Must return\n   * `{ stdout, exitCode }` with `stdout` trimmed by the caller as needed.\n   * Implementations should NOT throw for non-zero exit codes — they should\n   * return the exit code so the resolver can decide how to recover.\n   */\n  (cwd: string, args: string[]): { stdout: string; exitCode: number };\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Default git invoker — spawns real `git` via the shared child-process helper\n// ──────────────────────────────────────────────────────────────────────────\n\nconst DEFAULT_GIT_TIMEOUT_MS = 2_000;\n\nexport function defaultGitInvoker(): GitInvoker {\n  return (cwd: string, args: string[]) => {\n    const result = launchProcessSync(\"git\", args, {\n      cwd,\n      encoding: \"utf-8\",\n      timeout: DEFAULT_GIT_TIMEOUT_MS,\n      shell: false,\n    });\n    if (result.error) {\n      // Spawn failure (git not on PATH, timeout, etc.). Surface as non-zero.\n      return { stdout: \"\", exitCode: 127 };\n    }\n    return {\n      stdout: typeof result.stdout === \"string\" ? result.stdout : \"\",\n      exitCode: typeof result.status === \"number\" ? result.status : 1,\n    };\n  };\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Stable hashing\n// ──────────────────────────────────────────────────────────────────────────\n\n/**\n * Non-cryptographic stable hash. Used only to derive a deterministic\n * `projectId` from either the origin URL or the root path. The hash does not\n * need to be collision-resistant against adversarial input — it is purely a\n * namespace discriminator.\n *\n * Uses FNV-1a 32-bit so we don't pull in `node:crypto` for a simple bucket\n * key. Output is lowercase hex, zero-padded to 8 characters.\n */\nexport function stableHash(input: string): string {\n  let hash = 0x811c9dc5;\n  for (let i = 0; i < input.length; i++) {\n    hash ^= input.charCodeAt(i);\n    hash = Math.imul(hash, 0x01000193) >>> 0;\n  }\n  return hash.toString(16).padStart(8, \"0\");\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Origin URL normalization\n// ──────────────────────────────────────────────────────────────────────────\n\n/**\n * Normalize a git remote URL so that equivalent SSH / HTTPS forms of the\n * same repo produce the same `projectId`. Handles:\n *   - `git@github.com:foo/bar.git`  → `github.com/foo/bar`\n *   - `https://github.com/foo/bar`  → `github.com/foo/bar`\n *   - `https://github.com/foo/bar.git` → `github.com/foo/bar`\n *   - `ssh://git@github.com/foo/bar` → `github.com/foo/bar`\n *   - `ssh://git@github.com:2222/foo/bar` → `github.com/foo/bar` (port stripped)\n *\n * Case-insensitive (remote hostnames and most repo paths on major forges are\n * case-insensitive in practice).\n */\nexport function normalizeOriginUrl(rawUrl: string): string {\n  let url = rawUrl.trim();\n  if (!url) return \"\";\n\n  // Strip trailing `.git` case-insensitively — the whole result is\n  // lowercased at the end, so `.GIT` / `.Git` must be treated the same as\n  // `.git`. Previously the `.endsWith(\".git\")` check let `.GIT` leak\n  // through and appear in the output.\n  if (/\\.git$/i.test(url)) url = url.slice(0, -4);\n\n  // Windows drive-letter local path (e.g. `C:/repos/app`): detect here\n  // so the scp matcher below can accept single-character SSH host aliases\n  // (`h:foo/bar` from `.ssh/config`). A drive letter is exactly one ASCII\n  // letter followed by `:/` or `:\\`; SSH aliases never have a slash\n  // immediately after the colon.\n  if (/^[A-Za-z]:[\\\\/]/.test(url)) {\n    return url.toLowerCase();\n  }\n\n  // Protocol-prefixed: ssh://, https://, http://, git://, file://\n  // Must be tried FIRST so that scp-style detection below doesn't\n  // incorrectly swallow an ssh:// URL that happens to contain `:port/`.\n  //\n  // Matches:\n  //   1: host — bracketed IPv6 `[2001:db8::1]`, plain host with no `:` / `/`,\n  //      OR empty (for `file:///path` which has no host component).\n  //   2: port (optional) — preserved in the output so two repos on the same\n  //      host under different ports get distinct project namespaces.\n  //      Losing the port risked false-coalescing separate repos on custom\n  //      SSH mesh setups.\n  //   3: path (optional)\n  const protoMatch =\n    /^[a-z][a-z0-9+.-]*:\\/\\/(?:[^@/]+@)?(\\[[^\\]]+\\]|[^/:]*)(?::(\\d+))?(\\/.*)?$/i.exec(url);\n  if (protoMatch) {\n    let host = protoMatch[1] ?? \"\";\n    // Detect IPv6 via the bracketed input form BEFORE stripping brackets,\n    // so that when we later re-attach a port we can preserve the\n    // `[host]:port` boundary. Without the brackets, `host:2222` is\n    // ambiguous with a longer bare IPv6 address like `2001:db8::1:2222`.\n    const wasBracketed =\n      host.startsWith(\"[\") && host.endsWith(\"]\");\n    if (wasBracketed) host = host.slice(1, -1);\n    const port = protoMatch[2];\n    const repoPath = (protoMatch[3] ?? \"\").replace(/^\\/+/, \"\");\n    const hostPort = port\n      ? wasBracketed\n        ? `[${host}]:${port}`\n        : `${host}:${port}`\n      : host;\n    // For protocols without a host component (file:///path), fall back to\n    // a stable prefix so distinct local paths don't collapse to \"/path\".\n    const prefix = hostPort.length > 0 ? hostPort : \"localhost\";\n    return `${prefix}/${repoPath}`.toLowerCase();\n  }\n\n  // scp-like syntax: [user@]host:path. Protocol-prefixed URLs (`scheme://`)\n  // are handled above, so the scp branch below guards against them: a\n  // matched `host` of `scheme` followed by a path starting with `//` is\n  // a protocol URL that fell through and must NOT be parsed here.\n  // `user@` is optional — git also accepts userless scp forms like\n  // `host:org/repo`. Valid scp paths may start with digits (e.g.\n  // `git@host:123/repo.git`), so no numeric guard is needed: port-bearing\n  // URLs have the `://` prefix and match the protocol branch above before\n  // reaching here.\n  //\n  // Windows drive letters were filtered above, so single-character SSH\n  // host aliases (`h:foo/bar`) are accepted here.\n  //\n  // Bracketed IPv6 (`[2001:db8::1]`) is supported: the host alternative\n  // matches the bracketed literal up to `]` without splitting on internal\n  // `:`. Brackets are stripped in the normalised form so the scp and\n  // `ssh://` forms of the same IPv6 remote produce identical projectIds.\n  const scpMatch =\n    /^(?:([^@\\s/]+)@)?(\\[[^\\]]+\\]|[^:@\\s/]+):(.+)$/.exec(url);\n  if (scpMatch) {\n    let host = scpMatch[2] ?? \"\";\n    if (host.startsWith(\"[\") && host.endsWith(\"]\")) host = host.slice(1, -1);\n    const repoPath = scpMatch[3] ?? \"\";\n    // Reject protocol-like leftovers (e.g. `file:///path` where the scp\n    // regex greedily matched `file` as host and `///path` as path).\n    if (repoPath.startsWith(\"//\")) {\n      return url.toLowerCase();\n    }\n    return `${host}/${repoPath.replace(/^\\/+/, \"\")}`.toLowerCase();\n  }\n\n  // Fallback: use raw lowercased\n  return url.toLowerCase();\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Resolver\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface ResolveGitContextOptions {\n  /** Inject a git invoker (tests). Defaults to spawning real `git`. */\n  invoker?: GitInvoker;\n}\n\n/**\n * Detect the git project + branch for `cwd`.\n *\n * Returns `null` when:\n *   - `cwd` is not an absolute path (invalid input, CLAUDE.md #51)\n *   - `cwd` is not inside a git worktree\n *   - `git` is not available on PATH\n *\n * Never throws.\n */\nexport async function resolveGitContext(\n  cwd: string,\n  options: ResolveGitContextOptions = {},\n): Promise<GitContext | null> {\n  // Wrap the whole body so the documented \"Never throws\" contract is\n  // enforced. Possible throw sites include:\n  //   - `expandTildePath` → `resolveHomeDir()` → `os.homedir()` when HOME\n  //     is unset (e.g. minimal containers)\n  //   - a custom `options.invoker` that raises instead of returning a\n  //     non-zero exitCode\n  //   - any future helper added to this chain\n  // All of those map to \"not in a repo\" / `null`.\n  try {\n    // Validate input: must be a non-empty string.\n    if (typeof cwd !== \"string\" || cwd.length === 0) return null;\n\n    // Expand `~` per CLAUDE.md #17, then require absolute path.\n    const expanded = expandTildePath(cwd);\n    if (!path.isAbsolute(expanded)) return null;\n\n    const invoker = options.invoker ?? defaultGitInvoker();\n\n    // 1. Locate the repo root.\n    const topLevel = invoker(expanded, [\"rev-parse\", \"--show-toplevel\"]);\n    if (topLevel.exitCode !== 0) return null;\n    const rootPath = topLevel.stdout.trim();\n    if (!rootPath) return null;\n\n    // 2. Current branch. `--abbrev-ref HEAD` returns `HEAD` in detached\n    //    state, which we normalize to `null`. On a fresh `git init` the\n    //    HEAD ref is unborn and `--abbrev-ref HEAD` fails, but\n    //    `symbolic-ref HEAD` still returns the target branch. Fall back\n    //    so newly-initialized repos get a sensible branch name.\n    const branchResult = invoker(rootPath, [\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n    let branch: string | null = null;\n    if (branchResult.exitCode === 0) {\n      const raw = branchResult.stdout.trim();\n      branch = raw && raw !== \"HEAD\" ? raw : null;\n    } else {\n      const unbornRef = invoker(rootPath, [\"symbolic-ref\", \"--quiet\", \"HEAD\"]);\n      if (unbornRef.exitCode === 0) {\n        const raw = unbornRef.stdout.trim();\n        const prefix = \"refs/heads/\";\n        if (raw.startsWith(prefix)) {\n          const candidate = raw.slice(prefix.length);\n          if (candidate) branch = candidate;\n        }\n      }\n    }\n\n    // 3. Origin URL — optional. Used to derive a stable `projectId`.\n    const originResult = invoker(rootPath, [\"remote\", \"get-url\", \"origin\"]);\n    let projectId: string;\n    if (originResult.exitCode === 0) {\n      const normalized = normalizeOriginUrl(originResult.stdout);\n      projectId = normalized ? `origin:${stableHash(normalized)}` : `root:${stableHash(rootPath)}`;\n    } else {\n      projectId = `root:${stableHash(rootPath)}`;\n    }\n\n    // 4. Default branch — best effort.\n    const headRef = invoker(rootPath, [\"symbolic-ref\", \"--quiet\", \"refs/remotes/origin/HEAD\"]);\n    let defaultBranch: string | null = null;\n    if (headRef.exitCode === 0) {\n      const raw = headRef.stdout.trim();\n      const prefix = \"refs/remotes/origin/\";\n      if (raw.startsWith(prefix)) {\n        const candidate = raw.slice(prefix.length);\n        if (candidate) defaultBranch = candidate;\n      }\n    }\n\n    return {\n      projectId,\n      branch,\n      rootPath,\n      defaultBranch,\n    };\n  } catch {\n    // Never throws — any unexpected error falls back to \"not in a repo\".\n    return null;\n  }\n}\n","/**\n * Coding-agent namespace overlay (issue #569 PR 2 + PR 3).\n *\n * Given a `CodingContext` (from `resolveGitContext`) and a `CodingModeConfig`,\n * returns the namespace that recall + write paths should use — or `null` when\n * no overlay should apply (coding mode disabled, no context supplied, or\n * feature flags off).\n *\n * PR 2 ships the project overlay. PR 3 will add the branch overlay; the\n * function here already handles both flags so the schema / types / plumbing\n * don't have to change a second time when branch-scope lands.\n *\n * Pure function — no orchestrator, no config side-effects. Callers keep rule\n * 42 (read + write through same namespace layer) by consulting the same\n * function on both paths.\n */\n\nimport type { CodingContext, CodingModeConfig } from \"../types.js\";\nimport { stableHash } from \"./git-context.js\";\n\nexport interface CodingNamespaceOverlay {\n  /**\n   * Effective namespace to use for this session's memory operations. When\n   * `branchScope` is on, takes the form `project:<id>/branch:<b>`; otherwise\n   * `project:<id>`.\n   */\n  namespace: string;\n  /**\n   * Read fallbacks — additional namespaces a caller should include in recall\n   * so that, for example, a branch-scoped session still sees project-level\n   * memories that were written before the branch scope was enabled.\n   *\n   * Writes MUST go to `namespace` only; these are read-side only.\n   *\n   * Introduced to carry PR 3's branch→project fallback; PR 2 returns an empty\n   * array here.\n   */\n  readFallbacks: string[];\n  /**\n   * `\"project\"` when only project scope applies, `\"branch\"` when branch scope\n   * is also layered on. Used for diagnostics (`remnic doctor`) and logging.\n   */\n  scope: \"project\" | \"branch\";\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Sanitization\n// ──────────────────────────────────────────────────────────────────────────\n\n/**\n * Normalize a projectId / branch fragment so the resulting namespace passes\n * the router's `isSafeRouteNamespace` check (`[A-Za-z0-9._-]{1,64}`).\n *\n * Namespaces are used as filesystem directory names and must not contain\n * path separators (`/`, `\\`) or colons — so both `:` and `/` collapse to `-`.\n * The project-id format `origin:<8hex>` and branch names like `feat/x` both\n * flow through this helper before hitting the storage layer.\n *\n * NOT a security boundary — projectIds come from `resolveGitContext` (known\n * hex), and branch names come from local git. This defends against corrupt\n * input only.\n */\n/**\n * Single-pass sanitization — each input character is visited exactly once.\n * Rewriting as an explicit loop (instead of chained `replace()` calls with\n * greedy quantifiers) closes the polynomial-backtracking surface that\n * CodeQL flagged on patterns like `-+` and `^-+|-+$`.\n */\nfunction sanitizeFragment(input: string): string {\n  if (typeof input !== \"string\") return \"\";\n  const trimmed = input.trim().toLowerCase();\n  let out = \"\";\n  let prevIsDash = true; // suppress leading dashes\n  for (let i = 0; i < trimmed.length; i += 1) {\n    const c = trimmed[i]!;\n    const cc = trimmed.charCodeAt(i);\n    const isSafe =\n      (cc >= 48 && cc <= 57) /* 0-9 */ ||\n      (cc >= 97 && cc <= 122) /* a-z */ ||\n      cc === 46 /* . */ ||\n      cc === 95 /* _ */;\n    if (isSafe) {\n      out += c;\n      prevIsDash = false;\n    } else if (!prevIsDash) {\n      out += \"-\";\n      prevIsDash = true;\n    }\n  }\n  // Strip a single trailing dash introduced by the final run of unsafe chars.\n  if (out.endsWith(\"-\")) out = out.slice(0, -1);\n  return out;\n}\n\n/**\n * Cap to the router's per-namespace upper bound.\n *\n * Raw truncation alone would collapse distinct long inputs that differ near\n * the end (e.g. two `feat/...` branches with different suffixes) into the\n * same namespace — silently mixing recall/write state across branches or\n * projects. When truncation is needed, we append a short deterministic\n * hash suffix (`-<8hex>`) derived from the FULL pre-truncated value so\n * collisions only happen under true hash collisions, not simple prefix\n * overlap.\n *\n * The tail is trimmed to leave room for the separator and 8-char hash and\n * any trailing `-` introduced by the slice is stripped so the final\n * character before `-<hash>` is always alphanumeric or `.`/`_`.\n */\nconst MAX_NAMESPACE_LEN = 64;\nconst HASH_SUFFIX_LEN = 9; // \"-\" + 8 hex chars\n\nfunction capLength(value: string): string {\n  if (value.length <= MAX_NAMESPACE_LEN) return value;\n  // Reuse the FNV-1a 32-bit hash from git-context — one canonical\n  // implementation, one set of edge-case fixes. Uses Math.imul for\n  // correct 32-bit wrap-around, which plain `*` would not guarantee\n  // for the largest intermediate products.\n  const hash = stableHash(value);\n  // Trim trailing '-' with a linear, non-backtracking loop. A regex\n  // like `-+$` is linear too, but an explicit loop keeps CodeQL happy\n  // about polynomial backtracking warnings when several `\\-+` patterns\n  // appear in the same module.\n  let end = MAX_NAMESPACE_LEN - HASH_SUFFIX_LEN;\n  while (end > 0 && value.charCodeAt(end - 1) === 45 /* '-' */) end -= 1;\n  return `${value.slice(0, end)}-${hash}`;\n}\n\n/**\n * Produce the project-scope namespace name. Exported for tests and for\n * `remnic doctor` to render. Guaranteed to satisfy `isSafeRouteNamespace`:\n * no `/`, no `:`, lowercase only, length-capped to 64 chars.\n */\nexport function projectNamespaceName(projectId: string): string {\n  const frag = sanitizeFragment(projectId);\n  return capLength(`project-${frag || \"unknown\"}`);\n}\n\nexport function projectTagProjectId(projectTag: string): string {\n  const trimmed = projectTag.trim();\n  const frag = sanitizeFragment(trimmed);\n  const disambig = trimmed.length > 0 && frag !== trimmed;\n  const suffix = disambig ? `-${stableHash(trimmed)}` : \"\";\n  return `tag:${frag || \"unknown\"}${suffix}`;\n}\n\n/**\n * Preserve case when sanitizing a principal-derived base namespace. The\n * router's `isSafeRouteNamespace` check accepts `[A-Za-z0-9._-]{1,64}`, so\n * upper-case characters in the principal name are safe and MUST be kept to\n * avoid colliding two otherwise-distinct principals (e.g. `Alice` vs\n * `alice`) into the same combined namespace.\n *\n * Otherwise identical to `sanitizeFragment`: single-pass, linear, no\n * polynomial-backtracking quantifiers, unsafe chars collapse to `-` with\n * leading/trailing dashes suppressed.\n */\nfunction sanitizeBaseFragment(input: string): string {\n  if (typeof input !== \"string\") return \"\";\n  const trimmed = input.trim();\n  let out = \"\";\n  let prevIsDash = true;\n  for (let i = 0; i < trimmed.length; i += 1) {\n    const c = trimmed[i]!;\n    const cc = trimmed.charCodeAt(i);\n    const isSafe =\n      (cc >= 48 && cc <= 57) /* 0-9 */ ||\n      (cc >= 65 && cc <= 90) /* A-Z */ ||\n      (cc >= 97 && cc <= 122) /* a-z */ ||\n      cc === 46 /* . */ ||\n      cc === 95 /* _ */;\n    if (isSafe) {\n      out += c;\n      prevIsDash = false;\n    } else if (!prevIsDash) {\n      out += \"-\";\n      prevIsDash = true;\n    }\n  }\n  if (out.endsWith(\"-\")) out = out.slice(0, -1);\n  return out;\n}\n\n/**\n * Combine a principal-derived base namespace (e.g. `default`, `alice`) with a\n * coding-agent overlay namespace (e.g. `project-origin-abcd1234`). The result\n * is a single safe-route token that preserves principal isolation (CLAUDE.md\n * rule 42: read + write must resolve through the same namespace layer — and\n * here, through the same principal-scoped prefix) while layering project or\n * project/branch scope on top.\n *\n * Multiple principals working in the same repo thus get distinct namespaces:\n *\n *   alice + project-origin-ab12  →  alice-project-origin-ab12\n *   bob   + project-origin-ab12  →  bob-project-origin-ab12\n *   Alice + project-origin-ab12  →  Alice-project-origin-ab12 (distinct)\n *\n * The base fragment preserves case so `Alice` and `alice` remain distinct;\n * the overlay fragment is still lowercase-sanitized because it derives from\n * deterministic, pre-lowercased git hashes.\n *\n * Output is re-capped through `capLength` so a very long base + overlay\n * combination still fits inside `isSafeRouteNamespace` (≤ 64 chars). The\n * deterministic hash suffix on truncation keeps distinct inputs distinct.\n */\nexport function combineNamespaces(base: string, overlay: string): string {\n  const baseFrag = sanitizeBaseFragment(base);\n  const overlayFrag = sanitizeFragment(overlay);\n  if (!baseFrag) return capLength(overlayFrag || \"unknown\");\n  if (!overlayFrag) return capLength(baseFrag);\n  return capLength(`${baseFrag}-${overlayFrag}`);\n}\n\n/**\n * Produce the branch-scope namespace name. Format:\n * `project-<id>-branch-<name>[-<hash>]`. Uses `-` as the structural separator\n * rather than `/` or `:` so the result is a single safe route-namespace\n * token that can be used directly as a filesystem directory.\n *\n * Two failure modes must not collapse distinct branches to one namespace:\n *\n *   1. Sanitization is lossy (`feat/x` and `feat-x` both sanitize to\n *      `feat-x`; `Feature` and `feature` both sanitize to `feature`). When\n *      sanitization rewrote any character, we append a short hash of the\n *      RAW branch so distinct inputs stay distinct.\n *   2. Truncation is applied when the total exceeds 64 chars. In that\n *      mode `capLength` appends its own hash of the full pre-truncated\n *      value.\n *\n * Long branches that also sanitize may receive both kinds of hashes — that\n * is acceptable: the router only requires the result be unique and\n * deterministic, and the two hashes derive from different domains so they\n * don't conflict.\n */\nexport function branchNamespaceName(projectId: string, branch: string): string {\n  const projectFrag = sanitizeFragment(projectId);\n  const trimmedBranch = branch.trim();\n  const branchFrag = sanitizeFragment(trimmedBranch);\n  // Lossy-sanitization disambiguator: append hash of the raw (trimmed)\n  // branch when sanitization actually changed the string. Preserves\n  // distinctness across `feat/x` vs `feat-x` and `Feature` vs `feature`.\n  // The comparison uses the raw trimmed value (NOT `.toLowerCase()`) so\n  // case-only variants are treated as lossy and receive their own hash.\n  // Empty / already-safe-lowercase inputs get no hash so the common case\n  // stays readable.\n  const disambig = trimmedBranch.length > 0 && branchFrag !== trimmedBranch;\n  const base = `project-${projectFrag || \"unknown\"}-branch-${branchFrag || \"unknown\"}`;\n  const suffixed = disambig ? `${base}-${stableHash(trimmedBranch)}` : base;\n  return capLength(suffixed);\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Overlay resolver\n// ──────────────────────────────────────────────────────────────────────────\n\n/**\n * Compute the namespace overlay for a session.\n *\n * Returns `null` when no overlay applies — callers should then use their\n * existing `defaultNamespaceForPrincipal(...)` result unchanged. This keeps\n * CLAUDE.md #30 (escape hatch): setting `codingMode.projectScope: false`\n * exactly restores pre-#569 behaviour at every call site.\n *\n * @param codingContext — git context from the connector\n * @param config — coding mode flags (projectScope, branchScope, globalFallback)\n * @param defaultNamespace — retained for call-site compatibility; no longer\n *   used. The global fallback is expressed as an empty-string sentinel in\n *   `readFallbacks`, which `combineNamespaces(principal, \"\")` resolves to the\n *   principal's own namespace at the call site.\n */\nexport function resolveCodingNamespaceOverlay(\n  codingContext: CodingContext | null | undefined,\n  config: Pick<CodingModeConfig, \"projectScope\" | \"branchScope\" | \"globalFallback\">,\n  defaultNamespace?: string,\n): CodingNamespaceOverlay | null {\n  // No context supplied (session isn't in a git repo, or connector didn't\n  // attach one) → no overlay.\n  if (!codingContext) return null;\n\n  // Project scope disabled → no overlay at all. Branch scope depends on\n  // project scope being on; there is no branch-only mode.\n  if (!config.projectScope) return null;\n\n  // Require a non-empty projectId — defensive.\n  const projectId = typeof codingContext.projectId === \"string\" ? codingContext.projectId.trim() : \"\";\n  if (!projectId) return null;\n\n  const projectNs = projectNamespaceName(projectId);\n\n  // Root/global namespace fallback: when `globalFallback` is true, include\n  // the principal's self namespace in readFallbacks so cross-project knowledge\n  // remains visible. CLAUDE.md #30: the gate is `globalFallback` — set to\n  // false for strict project isolation.\n  //\n  // The fallback value is \"\" (empty string), NOT the defaultNamespace name.\n  // The orchestrator passes each fallback through combineNamespaces(principal, fallback),\n  // and combineNamespaces(base, \"\") returns base unchanged — yielding the\n  // principal's own namespace. Using the actual namespace name (e.g., \"default\")\n  // would produce \"default-default\" after combination, missing the target.\n  const includeRoot = config.globalFallback === true;\n\n  // Branch-scope layering (PR 3):\n  //   - only when config.branchScope is explicitly true\n  //   - only when we actually have a branch (null in detached HEAD)\n  //   - project namespace becomes a read fallback so project-level memories\n  //     remain visible from any branch (deliberate asymmetry — branch writes\n  //     don't leak up, but project reads leak down).\n  //   - when globalFallback is on, the root namespace is also appended so\n  //     globally useful memories surface in every branch.\n  if (config.branchScope && typeof codingContext.branch === \"string\" && codingContext.branch.length > 0) {\n    const branchNs = branchNamespaceName(projectId, codingContext.branch);\n    const fallbacks = [projectNs];\n    if (includeRoot) fallbacks.push(\"\");\n    return {\n      namespace: branchNs,\n      readFallbacks: fallbacks,\n      scope: \"branch\",\n    };\n  }\n\n  return {\n    namespace: projectNs,\n    readFallbacks: includeRoot ? [\"\"] : [],\n    scope: \"project\",\n  };\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// Diagnostics (issue #569 PR 3 + PR 8)\n// ──────────────────────────────────────────────────────────────────────────\n\nexport interface CodingScopeDescription {\n  /** \"none\" when no overlay is active; otherwise the resolved scope level. */\n  scope: \"none\" | \"project\" | \"branch\";\n  /** Project id (raw, not sanitized) when a context is attached. */\n  projectId: string | null;\n  /** Branch name (raw, not sanitized) when available. */\n  branch: string | null;\n  /** Effective namespace writes route to. `null` when no overlay applies. */\n  effectiveNamespace: string | null;\n  /** Read fallbacks included in recall (non-empty only when branch-scope is on). */\n  readFallbacks: string[];\n  /**\n   * Why no overlay applies, when `scope === \"none\"`. One of:\n   *   - `\"no-context\"`  — connector didn't attach a CodingContext\n   *   - `\"disabled\"`   — codingMode.projectScope is false\n   *   - `\"empty-project\"` — codingContext.projectId was empty/whitespace\n   */\n  disabledReason: \"no-context\" | \"disabled\" | \"empty-project\" | null;\n}\n\n/**\n * Human-readable description of the coding-agent scope that currently applies\n * for a session. Consumed by `remnic doctor` (PR 8) and by logs to surface\n * why recall routes where it does.\n *\n * Pure — callers pass the coding context + config they already have.\n */\nexport function describeCodingScope(\n  codingContext: CodingContext | null | undefined,\n  config: Pick<CodingModeConfig, \"projectScope\" | \"branchScope\" | \"globalFallback\">,\n  defaultNamespace?: string,\n): CodingScopeDescription {\n  const projectId = codingContext?.projectId ?? null;\n  const branch = codingContext?.branch ?? null;\n\n  if (!codingContext) {\n    return {\n      scope: \"none\",\n      projectId: null,\n      branch: null,\n      effectiveNamespace: null,\n      readFallbacks: [],\n      disabledReason: \"no-context\",\n    };\n  }\n  if (!config.projectScope) {\n    return {\n      scope: \"none\",\n      projectId,\n      branch,\n      effectiveNamespace: null,\n      readFallbacks: [],\n      disabledReason: \"disabled\",\n    };\n  }\n  const trimmedId = typeof projectId === \"string\" ? projectId.trim() : \"\";\n  if (!trimmedId) {\n    return {\n      scope: \"none\",\n      projectId,\n      branch,\n      effectiveNamespace: null,\n      readFallbacks: [],\n      disabledReason: \"empty-project\",\n    };\n  }\n\n  const overlay = resolveCodingNamespaceOverlay(codingContext, config, defaultNamespace);\n  // Unreachable in practice given the guards above, but keep the return\n  // shape consistent if the resolver grows new null branches later.\n  if (!overlay) {\n    return {\n      scope: \"none\",\n      projectId,\n      branch,\n      effectiveNamespace: null,\n      readFallbacks: [],\n      disabledReason: \"disabled\",\n    };\n  }\n  return {\n    scope: overlay.scope,\n    projectId,\n    branch,\n    effectiveNamespace: overlay.namespace,\n    readFallbacks: overlay.readFallbacks,\n    disabledReason: null,\n  };\n}\n\n// ──────────────────────────────────────────────────────────────────────────\n// LCM session-key namespacing (#1495)\n// ──────────────────────────────────────────────────────────────────────────\n\n/**\n * Reserved structural sentinel for the namespaced LCM `session_id` encoding\n * (#1495 P1). U+001F (UNIT SEPARATOR) is a C0 control character that CANNOT\n * occur in a route namespace (`isSafeRouteNamespace` ⇒ `[A-Za-z0-9._-]{1,64}`,\n * see routing/engine.ts) and does not occur in any legitimate session key, so\n * it is an unforgeable structural marker for the namespace boundary.\n *\n * SECURITY — why this is unforgeable (the #1495 P1 fix):\n * The LCM archive is keyed by the `session_id` STRING (exact `session_id = ?`\n * and prefix `session_id LIKE '<prefix>%'`), NOT physically partitioned by\n * namespace. The previous encoding `${namespace}:${sessionKey}` shared the SAME\n * string space as a raw default-store key, so a caller authorized for the\n * `default` store could pass a raw `sessionKey` equal to another namespace's\n * encoded key (`\"<overlay-ns>:<victim-session>\"`) and exact-match the victim's\n * rows — a cross-tenant read leak.\n *\n * The new encoding makes the namespaced and default key-spaces PROVABLY\n * DISJOINT:\n *   - Overlay key  = `\\x1f<namespace>\\x1f<sessionKey>` — always begins with\n *     `\\x1f` followed by a NON-`\\x1f` character (the namespace is non-empty and\n *     `\\x1f`-free). The leading `\\x1f<namespace>\\x1f` is an unambiguous,\n *     injective frame: the namespace cannot contain `\\x1f`, so the second `\\x1f`\n *     terminates it without any escaping of the (raw) session key.\n *   - Default key  = the raw `sessionKey`, UNLESS it already begins with the\n *     sentinel, in which case it is escaped to begin with `\\x1f\\x1f` (see\n *     `escapeDefaultLcmKey`). A default key therefore NEVER matches the overlay\n *     frame `\\x1f<non-\\x1f>…`.\n * Hence no caller-controlled raw `sessionKey` (default path) can reproduce an\n * overlay key, closing the forgery for BOTH the exact-`session_id` match and the\n * `sessionPrefix` LIKE match (an overlay prefix `\\x1f<ns>\\x1f<rawPrefix>` stays a\n * valid LIKE-prefix of the overlay full keys, and a default prefix can only\n * LIKE-match default keys).\n *\n * Existing default-store rows need NO migration: legitimate session keys never\n * contain `\\x1f`, so `escapeDefaultLcmKey` is a no-op for them and they remain\n * byte-for-byte their raw form. The namespaced encoding is NEW in this\n * unreleased PR, so changing its shape costs nothing.\n */\nconst LCM_NS_SENTINEL = \"\\u001f\";\n\n/**\n * Make a default-store (raw) LCM key disjoint from the namespaced key-space.\n *\n * Namespaced overlay keys always begin with `\\x1f` followed by a non-`\\x1f`\n * namespace character. A raw default key collides with that frame ONLY if it\n * begins with `\\x1f`. Legitimate session keys never contain `\\x1f`, so this is a\n * pure no-op for them; a forged key that begins with `\\x1f` is escaped to begin\n * with `\\x1f\\x1f`, which can never equal an overlay key (whose second character\n * is a `[A-Za-z0-9._-]` namespace char, never `\\x1f`).\n */\nfunction escapeDefaultLcmKey(sessionKey: string): string {\n  return sessionKey.startsWith(LCM_NS_SENTINEL)\n    ? `${LCM_NS_SENTINEL}${sessionKey}`\n    : sessionKey;\n}\n\n/**\n * Build the LCM/structured-history `session_id` that a write-producing surface\n * archives under, and that a same-session reader must search under, so reads\n * and writes never drift (#1495, CLAUDE.md rule 42).\n *\n * The LCM archive filters strictly by the `session_id` string, so the writer's\n * archival key and the reader's lookup key MUST agree byte-for-byte. The\n * encoding frames the namespace with the reserved {@link LCM_NS_SENTINEL}\n * (`\\x1f<namespace>\\x1f<sessionKey>`) whenever that namespace diverges from the\n * single-store default; otherwise it passes the (escaped) raw `sessionKey` so\n * single-user / no-overlay deployments keep pre-#1495 behavior exactly. The two\n * key-spaces are provably disjoint, so a caller-controlled raw `sessionKey`\n * cannot forge another namespace's encoded id (see the {@link LCM_NS_SENTINEL}\n * doc comment for the full security rationale).\n *\n * `observe`, compaction flush/record, and the orchestrator recall readers all\n * route through this one helper so a project-scoped (cwd/projectTag) or\n * explicit-namespace session reads its own compressed-history / structured /\n * targeted-fact evidence instead of missing it.\n */\nexport function lcmSessionKeyForNamespace(\n  namespace: string | undefined,\n  sessionKey: string | undefined,\n  defaultNamespace: string,\n): string | undefined {\n  if (typeof sessionKey !== \"string\" || sessionKey.length === 0) return sessionKey;\n  if (\n    typeof namespace === \"string\" &&\n    namespace.length > 0 &&\n    namespace !== defaultNamespace\n  ) {\n    // Namespaced (overlay / explicit) key: frame the namespace with the reserved\n    // sentinel so the boundary is unambiguous AND unforgeable from the default\n    // key-space. The namespace is guaranteed `\\x1f`-free by `isSafeRouteNamespace`.\n    return `${LCM_NS_SENTINEL}${namespace}${LCM_NS_SENTINEL}${sessionKey}`;\n  }\n  // Default store: raw sessionKey, escaped only if it would otherwise intrude on\n  // the namespaced key-space (no-op for every legitimate key).\n  return escapeDefaultLcmKey(sessionKey);\n}\n\n/**\n * Map an ORDERED, read-authorized namespace set (the SAME set normal QMD/file\n * recall searches) to the ordered set of LCM `session_id`s a same-session reader\n * must query (#1505 thread \"Include coding fallback namespaces in LCM reads\").\n *\n * The LCM archive filters strictly by `session_id`, and `observe` archives each\n * turn under `${effectiveNamespace}:${sessionKey}` for the namespace that was\n * effective when it was written. A branch-scoped session that overlays\n * `${base-project-*-branch-*}` only sees rows written under THAT namespace if it\n * reads a single overlay key — but normal recall ALSO searches the\n * `codingOverlay.readFallbacks` (project / root) namespaces, so rows archived at\n * project/root scope are surfaced by QMD/file recall yet MISSED by a single-key\n * LCM read. Deriving the LCM read keys from the SAME `recallNamespaces` set keeps\n * the LCM read path from diverging: every namespace recall is authorized to read\n * (read-auth gate already applied upstream in `recallNamespaces`) contributes one\n * LCM key, ordered primary-overlay-first then fallbacks. Unreadable namespaces\n * are never in `recallNamespaces`, so they are never searched here either (no\n * cross-tenant read leak).\n *\n * Single-user / no-overlay recall passes a single-namespace set that collapses to\n * the raw `sessionKey`, so the result is `[sessionKey]` — byte-for-byte the\n * pre-#1505 single-key behavior.\n *\n * SESSIONLESS recall (`sessionKey === undefined`): returns `[undefined]` so the\n * caller issues ONE archive-wide LCM read with no exact `session_id` filter —\n * byte-for-byte the pre-#1505 sessionless behavior. It must NOT substitute the\n * literal `\"default\"` session id (codex P2 \"Preserve unscoped LCM searches\n * without a session key\"): that would filter to a session literally named\n * `default`, silently dropping the explicit-cue / targeted / focused / response /\n * event LCM sections for every recall that omits a session key.\n *\n * The result is deduped while preserving first-seen order so the caller can query\n * keys in priority order and short-circuit on the first hit without re-querying an\n * identical key (e.g. when two namespaces both collapse to the default store).\n */\nexport function lcmReadSessionIdsForNamespaces(\n  namespaces: readonly string[],\n  sessionKey: string | undefined,\n  defaultNamespace: string,\n): Array<string | undefined> {\n  // Sessionless ⇒ a single archive-wide read (no `session_id` filter). NEVER the\n  // literal \"default\" session id (codex P2).\n  if (typeof sessionKey !== \"string\" || sessionKey.length === 0) {\n    return [undefined];\n  }\n  const out: string[] = [];\n  const seen = new Set<string>();\n  for (const namespace of namespaces) {\n    const key =\n      lcmSessionKeyForNamespace(namespace, sessionKey, defaultNamespace) ??\n      sessionKey;\n    if (!seen.has(key)) {\n      seen.add(key);\n      out.push(key);\n    }\n  }\n  if (out.length === 0) {\n    out.push(sessionKey);\n  }\n  return out;\n}\n","/**\n * Generic reinforcement-core primitives extracted from `procedure-miner.ts`\n * (issue #687 PR 1/4). Procedure-specific scoring (success rate, step\n * normalization) intentionally stays in the miner — this module only\n * exposes category-agnostic clustering and cluster summarization helpers\n * so future PRs can run reinforcement across non-procedural categories.\n *\n * Pure refactor — no behavior change.\n */\n\n/**\n * Group `items` into clusters keyed by `keyFn(item)`.\n *\n * - Preserves the original input order within each cluster's array.\n * - The returned `Map` insertion order matches first-seen key order, so\n *   downstream iteration is deterministic for a given input.\n * - Throws `TypeError` if `keyFn` returns a non-string (e.g. `undefined`,\n *   `null`, or a number). Callers must produce a stable string key.\n */\nexport function clusterByKey<T>(items: readonly T[], keyFn: (item: T) => string): Map<string, T[]> {\n  const clusters = new Map<string, T[]>();\n  for (const item of items) {\n    const key = keyFn(item);\n    if (typeof key !== \"string\") {\n      throw new TypeError(\n        `clusterByKey: keyFn must return a string, got ${key === null ? \"null\" : typeof key}`,\n      );\n    }\n    const existing = clusters.get(key);\n    if (existing) {\n      existing.push(item);\n    } else {\n      clusters.set(key, [item]);\n    }\n  }\n  return clusters;\n}\n\nexport interface ClusterSummary {\n  /** Number of items in the cluster. */\n  count: number;\n  /** Earliest timestamp seen in the cluster (string min via `localeCompare`). */\n  firstSeen: string;\n  /** Latest timestamp seen in the cluster (string max via `localeCompare`). */\n  lastSeen: string;\n}\n\n/**\n * Summarize a cluster by counting items and tracking earliest/latest\n * timestamps. Timestamp comparison uses `String#localeCompare`, which is\n * correct for ISO-8601 strings (lexicographic order matches chronological\n * order).\n *\n * - Throws `RangeError` on empty clusters — `firstSeen`/`lastSeen` are not\n *   meaningful without at least one item.\n * - When all timestamps are equal, `firstSeen === lastSeen`.\n */\nexport function summarizeCluster<T>(\n  cluster: readonly T[],\n  extractTimestamp: (item: T) => string,\n): ClusterSummary {\n  if (cluster.length === 0) {\n    throw new RangeError(\"summarizeCluster: cluster must contain at least one item\");\n  }\n  let firstSeen = extractTimestamp(cluster[0]);\n  let lastSeen = firstSeen;\n  for (let i = 1; i < cluster.length; i += 1) {\n    const ts = extractTimestamp(cluster[i]);\n    if (ts.localeCompare(firstSeen) < 0) firstSeen = ts;\n    if (ts.localeCompare(lastSeen) > 0) lastSeen = ts;\n  }\n  return { count: cluster.length, firstSeen, lastSeen };\n}\n"],"mappings":";;;;;;;;AAuBA,OAAO,UAAU;AA8DjB,IAAM,yBAAyB;AAExB,SAAS,oBAAgC;AAC9C,SAAO,CAAC,KAAa,SAAmB;AACtC,UAAM,SAAS,kBAAkB,OAAO,MAAM;AAAA,MAC5C;AAAA,MACA,UAAU;AAAA,MACV,SAAS;AAAA,MACT,OAAO;AAAA,IACT,CAAC;AACD,QAAI,OAAO,OAAO;AAEhB,aAAO,EAAE,QAAQ,IAAI,UAAU,IAAI;AAAA,IACrC;AACA,WAAO;AAAA,MACL,QAAQ,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AAAA,MAC5D,UAAU,OAAO,OAAO,WAAW,WAAW,OAAO,SAAS;AAAA,IAChE;AAAA,EACF;AACF;AAeO,SAAS,WAAW,OAAuB;AAChD,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,YAAQ,MAAM,WAAW,CAAC;AAC1B,WAAO,KAAK,KAAK,MAAM,QAAU,MAAM;AAAA,EACzC;AACA,SAAO,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAC1C;AAkBO,SAAS,mBAAmB,QAAwB;AACzD,MAAI,MAAM,OAAO,KAAK;AACtB,MAAI,CAAC,IAAK,QAAO;AAMjB,MAAI,UAAU,KAAK,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE;AAO9C,MAAI,kBAAkB,KAAK,GAAG,GAAG;AAC/B,WAAO,IAAI,YAAY;AAAA,EACzB;AAcA,QAAM,aACJ,6EAA6E,KAAK,GAAG;AACvF,MAAI,YAAY;AACd,QAAI,OAAO,WAAW,CAAC,KAAK;AAK5B,UAAM,eACJ,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG;AAC3C,QAAI,aAAc,QAAO,KAAK,MAAM,GAAG,EAAE;AACzC,UAAM,OAAO,WAAW,CAAC;AACzB,UAAM,YAAY,WAAW,CAAC,KAAK,IAAI,QAAQ,QAAQ,EAAE;AACzD,UAAM,WAAW,OACb,eACE,IAAI,IAAI,KAAK,IAAI,KACjB,GAAG,IAAI,IAAI,IAAI,KACjB;AAGJ,UAAM,SAAS,SAAS,SAAS,IAAI,WAAW;AAChD,WAAO,GAAG,MAAM,IAAI,QAAQ,GAAG,YAAY;AAAA,EAC7C;AAmBA,QAAM,WACJ,gDAAgD,KAAK,GAAG;AAC1D,MAAI,UAAU;AACZ,QAAI,OAAO,SAAS,CAAC,KAAK;AAC1B,QAAI,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,EAAG,QAAO,KAAK,MAAM,GAAG,EAAE;AACvE,UAAM,WAAW,SAAS,CAAC,KAAK;AAGhC,QAAI,SAAS,WAAW,IAAI,GAAG;AAC7B,aAAO,IAAI,YAAY;AAAA,IACzB;AACA,WAAO,GAAG,IAAI,IAAI,SAAS,QAAQ,QAAQ,EAAE,CAAC,GAAG,YAAY;AAAA,EAC/D;AAGA,SAAO,IAAI,YAAY;AACzB;AAqBA,eAAsB,kBACpB,KACA,UAAoC,CAAC,GACT;AAS5B,MAAI;AAEF,QAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,EAAG,QAAO;AAGxD,UAAM,WAAW,gBAAgB,GAAG;AACpC,QAAI,CAAC,KAAK,WAAW,QAAQ,EAAG,QAAO;AAEvC,UAAM,UAAU,QAAQ,WAAW,kBAAkB;AAGrD,UAAM,WAAW,QAAQ,UAAU,CAAC,aAAa,iBAAiB,CAAC;AACnE,QAAI,SAAS,aAAa,EAAG,QAAO;AACpC,UAAM,WAAW,SAAS,OAAO,KAAK;AACtC,QAAI,CAAC,SAAU,QAAO;AAOtB,UAAM,eAAe,QAAQ,UAAU,CAAC,aAAa,gBAAgB,MAAM,CAAC;AAC5E,QAAI,SAAwB;AAC5B,QAAI,aAAa,aAAa,GAAG;AAC/B,YAAM,MAAM,aAAa,OAAO,KAAK;AACrC,eAAS,OAAO,QAAQ,SAAS,MAAM;AAAA,IACzC,OAAO;AACL,YAAM,YAAY,QAAQ,UAAU,CAAC,gBAAgB,WAAW,MAAM,CAAC;AACvE,UAAI,UAAU,aAAa,GAAG;AAC5B,cAAM,MAAM,UAAU,OAAO,KAAK;AAClC,cAAM,SAAS;AACf,YAAI,IAAI,WAAW,MAAM,GAAG;AAC1B,gBAAM,YAAY,IAAI,MAAM,OAAO,MAAM;AACzC,cAAI,UAAW,UAAS;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAGA,UAAM,eAAe,QAAQ,UAAU,CAAC,UAAU,WAAW,QAAQ,CAAC;AACtE,QAAI;AACJ,QAAI,aAAa,aAAa,GAAG;AAC/B,YAAM,aAAa,mBAAmB,aAAa,MAAM;AACzD,kBAAY,aAAa,UAAU,WAAW,UAAU,CAAC,KAAK,QAAQ,WAAW,QAAQ,CAAC;AAAA,IAC5F,OAAO;AACL,kBAAY,QAAQ,WAAW,QAAQ,CAAC;AAAA,IAC1C;AAGA,UAAM,UAAU,QAAQ,UAAU,CAAC,gBAAgB,WAAW,0BAA0B,CAAC;AACzF,QAAI,gBAA+B;AACnC,QAAI,QAAQ,aAAa,GAAG;AAC1B,YAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,YAAM,SAAS;AACf,UAAI,IAAI,WAAW,MAAM,GAAG;AAC1B,cAAM,YAAY,IAAI,MAAM,OAAO,MAAM;AACzC,YAAI,UAAW,iBAAgB;AAAA,MACjC;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;;;AC3QA,SAAS,iBAAiB,OAAuB;AAC/C,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,MAAI,MAAM;AACV,MAAI,aAAa;AACjB,WAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK,GAAG;AAC1C,UAAM,IAAI,QAAQ,CAAC;AACnB,UAAM,KAAK,QAAQ,WAAW,CAAC;AAC/B,UAAM,SACH,MAAM,MAAM,MAAM,MAClB,MAAM,MAAM,MAAM,OACnB,OAAO,MACP,OAAO;AACT,QAAI,QAAQ;AACV,aAAO;AACP,mBAAa;AAAA,IACf,WAAW,CAAC,YAAY;AACtB,aAAO;AACP,mBAAa;AAAA,IACf;AAAA,EACF;AAEA,MAAI,IAAI,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE;AAC5C,SAAO;AACT;AAiBA,IAAM,oBAAoB;AAC1B,IAAM,kBAAkB;AAExB,SAAS,UAAU,OAAuB;AACxC,MAAI,MAAM,UAAU,kBAAmB,QAAO;AAK9C,QAAM,OAAO,WAAW,KAAK;AAK7B,MAAI,MAAM,oBAAoB;AAC9B,SAAO,MAAM,KAAK,MAAM,WAAW,MAAM,CAAC,MAAM,GAAc,QAAO;AACrE,SAAO,GAAG,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI;AACvC;AAOO,SAAS,qBAAqB,WAA2B;AAC9D,QAAM,OAAO,iBAAiB,SAAS;AACvC,SAAO,UAAU,WAAW,QAAQ,SAAS,EAAE;AACjD;AAEO,SAAS,oBAAoB,YAA4B;AAC9D,QAAM,UAAU,WAAW,KAAK;AAChC,QAAM,OAAO,iBAAiB,OAAO;AACrC,QAAM,WAAW,QAAQ,SAAS,KAAK,SAAS;AAChD,QAAM,SAAS,WAAW,IAAI,WAAW,OAAO,CAAC,KAAK;AACtD,SAAO,OAAO,QAAQ,SAAS,GAAG,MAAM;AAC1C;AAaA,SAAS,qBAAqB,OAAuB;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,MAAM;AACV,MAAI,aAAa;AACjB,WAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK,GAAG;AAC1C,UAAM,IAAI,QAAQ,CAAC;AACnB,UAAM,KAAK,QAAQ,WAAW,CAAC;AAC/B,UAAM,SACH,MAAM,MAAM,MAAM,MAClB,MAAM,MAAM,MAAM,MAClB,MAAM,MAAM,MAAM,OACnB,OAAO,MACP,OAAO;AACT,QAAI,QAAQ;AACV,aAAO;AACP,mBAAa;AAAA,IACf,WAAW,CAAC,YAAY;AACtB,aAAO;AACP,mBAAa;AAAA,IACf;AAAA,EACF;AACA,MAAI,IAAI,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,EAAE;AAC5C,SAAO;AACT;AAwBO,SAAS,kBAAkB,MAAc,SAAyB;AACvE,QAAM,WAAW,qBAAqB,IAAI;AAC1C,QAAM,cAAc,iBAAiB,OAAO;AAC5C,MAAI,CAAC,SAAU,QAAO,UAAU,eAAe,SAAS;AACxD,MAAI,CAAC,YAAa,QAAO,UAAU,QAAQ;AAC3C,SAAO,UAAU,GAAG,QAAQ,IAAI,WAAW,EAAE;AAC/C;AAuBO,SAAS,oBAAoB,WAAmB,QAAwB;AAC7E,QAAM,cAAc,iBAAiB,SAAS;AAC9C,QAAM,gBAAgB,OAAO,KAAK;AAClC,QAAM,aAAa,iBAAiB,aAAa;AAQjD,QAAM,WAAW,cAAc,SAAS,KAAK,eAAe;AAC5D,QAAM,OAAO,WAAW,eAAe,SAAS,WAAW,cAAc,SAAS;AAClF,QAAM,WAAW,WAAW,GAAG,IAAI,IAAI,WAAW,aAAa,CAAC,KAAK;AACrE,SAAO,UAAU,QAAQ;AAC3B;AAqBO,SAAS,8BACd,eACA,QACA,kBAC+B;AAG/B,MAAI,CAAC,cAAe,QAAO;AAI3B,MAAI,CAAC,OAAO,aAAc,QAAO;AAGjC,QAAM,YAAY,OAAO,cAAc,cAAc,WAAW,cAAc,UAAU,KAAK,IAAI;AACjG,MAAI,CAAC,UAAW,QAAO;AAEvB,QAAM,YAAY,qBAAqB,SAAS;AAYhD,QAAM,cAAc,OAAO,mBAAmB;AAU9C,MAAI,OAAO,eAAe,OAAO,cAAc,WAAW,YAAY,cAAc,OAAO,SAAS,GAAG;AACrG,UAAM,WAAW,oBAAoB,WAAW,cAAc,MAAM;AACpE,UAAM,YAAY,CAAC,SAAS;AAC5B,QAAI,YAAa,WAAU,KAAK,EAAE;AAClC,WAAO;AAAA,MACL,WAAW;AAAA,MACX,eAAe;AAAA,MACf,OAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,eAAe,cAAc,CAAC,EAAE,IAAI,CAAC;AAAA,IACrC,OAAO;AAAA,EACT;AACF;AAiCO,SAAS,oBACd,eACA,QACA,kBACwB;AACxB,QAAM,YAAY,eAAe,aAAa;AAC9C,QAAM,SAAS,eAAe,UAAU;AAExC,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,MACL,OAAO;AAAA,MACP,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,oBAAoB;AAAA,MACpB,eAAe,CAAC;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,MAAI,CAAC,OAAO,cAAc;AACxB,WAAO;AAAA,MACL,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA,oBAAoB;AAAA,MACpB,eAAe,CAAC;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,QAAM,YAAY,OAAO,cAAc,WAAW,UAAU,KAAK,IAAI;AACrE,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA,oBAAoB;AAAA,MACpB,eAAe,CAAC;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,UAAU,8BAA8B,eAAe,QAAQ,gBAAgB;AAGrF,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,MACL,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA,oBAAoB;AAAA,MACpB,eAAe,CAAC;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,EACF;AACA,SAAO;AAAA,IACL,OAAO,QAAQ;AAAA,IACf;AAAA,IACA;AAAA,IACA,oBAAoB,QAAQ;AAAA,IAC5B,eAAe,QAAQ;AAAA,IACvB,gBAAgB;AAAA,EAClB;AACF;AA4CA,IAAM,kBAAkB;AAYxB,SAAS,oBAAoB,YAA4B;AACvD,SAAO,WAAW,WAAW,eAAe,IACxC,GAAG,eAAe,GAAG,UAAU,KAC/B;AACN;AAsBO,SAAS,0BACd,WACA,YACA,kBACoB;AACpB,MAAI,OAAO,eAAe,YAAY,WAAW,WAAW,EAAG,QAAO;AACtE,MACE,OAAO,cAAc,YACrB,UAAU,SAAS,KACnB,cAAc,kBACd;AAIA,WAAO,GAAG,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,UAAU;AAAA,EACtE;AAGA,SAAO,oBAAoB,UAAU;AACvC;AAqCO,SAAS,+BACd,YACA,YACA,kBAC2B;AAG3B,MAAI,OAAO,eAAe,YAAY,WAAW,WAAW,GAAG;AAC7D,WAAO,CAAC,MAAS;AAAA,EACnB;AACA,QAAM,MAAgB,CAAC;AACvB,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,aAAa,YAAY;AAClC,UAAM,MACJ,0BAA0B,WAAW,YAAY,gBAAgB,KACjE;AACF,QAAI,CAAC,KAAK,IAAI,GAAG,GAAG;AAClB,WAAK,IAAI,GAAG;AACZ,UAAI,KAAK,GAAG;AAAA,IACd;AAAA,EACF;AACA,MAAI,IAAI,WAAW,GAAG;AACpB,QAAI,KAAK,UAAU;AAAA,EACrB;AACA,SAAO;AACT;;;ACnjBO,SAAS,aAAgB,OAAqB,OAA8C;AACjG,QAAM,WAAW,oBAAI,IAAiB;AACtC,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM,MAAM,IAAI;AACtB,QAAI,OAAO,QAAQ,UAAU;AAC3B,YAAM,IAAI;AAAA,QACR,iDAAiD,QAAQ,OAAO,SAAS,OAAO,GAAG;AAAA,MACrF;AAAA,IACF;AACA,UAAM,WAAW,SAAS,IAAI,GAAG;AACjC,QAAI,UAAU;AACZ,eAAS,KAAK,IAAI;AAAA,IACpB,OAAO;AACL,eAAS,IAAI,KAAK,CAAC,IAAI,CAAC;AAAA,IAC1B;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-D6WVJIS3.js → chunk-ORGWWNJG.js}

@@ -5,7 +5,7 @@ import {
 import {
   ALL_CATEGORY_DIRS,
   StorageManager
-} from "./chunk-A4BTPHIN.js";
+} from "./chunk-Y7NWBBHV.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
@@ -128,4 +128,4 @@ var NamespaceStorageRouter = class {
 export {
   NamespaceStorageRouter
 };
-//# sourceMappingURL=chunk-D6WVJIS3.js.map
+//# sourceMappingURL=chunk-ORGWWNJG.js.map

package/dist/{chunk-Z3PZRDLW.js → chunk-PRQXUSQV.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-DRD2Q7HQ.js";
 import {
   StorageManager
-} from "./chunk-A4BTPHIN.js";
+} from "./chunk-Y7NWBBHV.js";
 import {
   parseContinuityImprovementLoops
 } from "./chunk-LDXUBPMO.js";
@@ -1261,4 +1261,4 @@ export {
   defaultTierMigrationCycleBudget,
   CompoundingEngine
 };
-//# sourceMappingURL=chunk-Z3PZRDLW.js.map
+//# sourceMappingURL=chunk-PRQXUSQV.js.map

package/dist/{chunk-VWT3F4IV.js → chunk-PS3SYNHP.js}

@@ -1,3 +1,7 @@
+import {
+  gatherAcrossReadSessions,
+  resolveLcmReadSessionIds
+} from "./chunk-5FOCXX5E.js";
 import {
   buildEvidencePack,
   insertAfterEvidenceHeading
@@ -21,10 +25,14 @@ async function buildTargetedFactRecallSection(options) {
   if (maxResults <= 0) {
     return "";
   }
-  const searchItems = await collectTargetedFactSearchItems(options);
-  const scannedItems = await collectTargetedFactScanItems(options);
+  const collected = [];
+  await gatherAcrossReadSessions(resolveLcmReadSessionIds(options), async (sessionId) => {
+    const scoped = { ...options, sessionId };
+    collected.push(...await collectTargetedFactSearchItems(scoped));
+    collected.push(...await collectTargetedFactScanItems(scoped));
+  });
   const ranked = rankAndDedupeTargetedFactItems(
-    [...searchItems, ...scannedItems],
+    collected,
     options.query
   ).slice(0, maxResults);
   const title = options.title ?? "Targeted fact evidence";
@@ -2158,4 +2166,4 @@ export {
   shouldRecallTargetedFactEvidence,
   buildTargetedFactRecallSection
 };
-//# sourceMappingURL=chunk-VWT3F4IV.js.map
+//# sourceMappingURL=chunk-PS3SYNHP.js.map