@saadnvd1/agent-os 0.3.505 → 0.3.507

package/README.md

@@ -1111,11 +1111,27 @@ or code spans, so it can't add headings or links to the document, and
 credential-shaped strings are redacted.
 
 The database is the record: `session_logs`, one row per task, never deleted.
-Each log is also written to
-`~/.agent-os/session-logs/<workspace>/<project>/YYYY-MM-DD-<task>.md`. A
-project's settings have a **Session log folder** (an absolute or `~` path) to
-put its files elsewhere; a folder inside the project's repository is refused,
-because repositories can be public, and the files are never written into one.
+Each log is also written to a file, `YYYY-MM-DD-<task>.md`, in the first of:
+
+1. the project's **Session log folder** (project settings; an absolute or `~`
+   path),
+2. the workspace's **HQ folder** (workspace settings):
+   `<hq>/docs/sessions/<project>/`,
+3. `~/.agent-os/session-logs/<workspace>/<project>/`.
+
+A folder inside the project's repository is refused, because repositories can
+be public, and the files are never written into one.
+
+The HQ folder is a git repo. Saving it checks that it is a repository, that it
+isn't inside or equal to any of the workspace's project repos, and (with one
+`gh repo view --json visibility`) that its GitHub remote isn't public; the
+result is stored. When a log lands in the HQ it is committed there as
+`session log: <task name>`, only that file, whatever else is changed in the
+tree, and pushed to the current branch's upstream only if the repo is
+private. A failed commit or push is logged and never reaches the merge; the
+next push carries the earlier commit. Commits to one HQ run one at a time.
+The database row is the record either way.
+
 The same dialog lists the project's logs, newest first, and a merged task's
 view has a **Log** tab. The orchestrator reads them with its `logs` tool: the
 latest headers of a workspace or project, or one log in full. It only reads.
@@ -1126,10 +1142,14 @@ failure is logged and never reaches the merge. For tasks that merged before
 this existed:
 
 ```bash
-npx tsx scripts/backfill-session-logs.ts --db <path to agent-os.db> [--no-gh] [--dry]
+npx tsx scripts/backfill-session-logs.ts --db <path to agent-os.db> [--no-gh] [--dry] [--reexport]
 ```
 
-Their plan files are gone, so those logs say "plan not kept".
+Their plan files are gone, so those logs say "plan not kept". Files go to the
+same destinations as above; into an HQ the backfill commits once at the end.
+`--reexport` writes no new logs: it rewrites the files of logs already in the
+database to where they'd go now, from the stored markdown (no rebuild, no
+model), leaves the old files in place, and does nothing on a second run.
 
 ### Orchestrator
 

package/app/api/workspaces/[id]/session-logs/route.ts

@@ -0,0 +1,35 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getHq, setHq } from "@/lib/session-logs";
+import { getWorkspace } from "@/lib/workspaces";
+import { requireLocalTrust } from "@/lib/security/route-guard";
+
+type RouteParams = { params: Promise<{ id: string }> };
+
+const state = (id: string) => ({ hq: getHq(id) });
+
+// GET/PUT /api/workspaces/:id/session-logs {folder} - the workspace's HQ
+// folder, where session logs are written and committed.
+export async function GET(_request: NextRequest, { params }: RouteParams) {
+  const { id } = await params;
+  if (!getWorkspace(id))
+    return NextResponse.json({ error: "Workspace not found" }, { status: 404 });
+  return NextResponse.json(state(id));
+}
+
+// Saving checks the folder and asks GitHub about it, so only from this
+// machine or the tailnet.
+export async function PUT(request: NextRequest, { params }: RouteParams) {
+  const refused = requireLocalTrust(request);
+  if (refused) return refused;
+  const { id } = await params;
+  if (!getWorkspace(id))
+    return NextResponse.json({ error: "Workspace not found" }, { status: 404 });
+  try {
+    const { folder } = await request.json();
+    await setHq(id, typeof folder === "string" ? folder : null);
+    return NextResponse.json(state(id));
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+}

package/components/Workspaces/HqFolderForm.tsx

@@ -0,0 +1,71 @@
+"use client";
+
+import { useState } from "react";
+import { toast } from "sonner";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { useSetWorkspaceHq, useWorkspaceHqQuery } from "@/data/session-logs";
+
+// The git repo this workspace's session logs are written into and
+// committed to. Blank keeps them in AgentOS's own folder.
+export function HqFolderForm({ workspaceId }: { workspaceId: string }) {
+  const { data, isPending, isError, error } = useWorkspaceHqQuery(workspaceId);
+  const save = useSetWorkspaceHq(workspaceId);
+  const [draft, setDraft] = useState<string | null>(null);
+  const saved = data?.hq?.folder ?? "";
+  const folder = draft ?? saved;
+  const id = `hq-folder-${workspaceId}`;
+
+  if (isPending)
+    return <div className="bg-muted/60 h-11 animate-pulse rounded-md" />;
+  if (isError)
+    return <p className="text-destructive text-xs">{error.message}</p>;
+
+  return (
+    <form
+      onSubmit={(e) => {
+        e.preventDefault();
+        save.mutate(folder, {
+          onSuccess: () => {
+            setDraft(null);
+            toast.success(
+              folder.trim() ? "HQ folder saved" : "HQ folder cleared"
+            );
+          },
+          onError: (err) => toast.error(err.message),
+        });
+      }}
+      className="space-y-1.5"
+    >
+      <label htmlFor={id} className="text-sm">
+        HQ folder
+      </label>
+      <div className="flex gap-2">
+        <Input
+          id={id}
+          value={folder}
+          onChange={(e) => setDraft(e.target.value)}
+          placeholder="~/path/to/a/private/git/repo"
+          className="h-11 flex-1 text-base md:h-9 md:text-sm"
+        />
+        <Button
+          type="submit"
+          size="sm"
+          className="h-11 sm:h-9"
+          disabled={folder === saved || save.isPending}
+        >
+          Save
+        </Button>
+      </div>
+      <p className="text-muted-foreground text-xs">
+        Session logs go to docs/sessions/&lt;project&gt;/ in this repo and are
+        committed there, one file per commit.{" "}
+        {data.hq?.visibility === "private"
+          ? "The repo is private, so each commit is pushed."
+          : data.hq
+            ? "Commits stay local: the repo isn't a private GitHub repository."
+            : "It must be a private git repo outside the workspace's projects."}
+      </p>
+    </form>
+  );
+}

package/components/Workspaces/WorkspaceSettings.tsx

@@ -6,6 +6,7 @@ import { TaskLimitForm } from "./TaskLimitForm";
 import { RulesForm } from "./RulesForm";
 import { FreshStartForm } from "./FreshStartForm";
 import { McpServersForm } from "./McpServersForm";
+import { HqFolderForm } from "./HqFolderForm";
 import { StallForm } from "./StallForm";
 import { WorkspaceModelsForm } from "./WorkspaceModelsForm";
 import { AwayWindowForm } from "@/components/Away/AwayWindowForm";
@@ -47,6 +48,7 @@ export function WorkspaceSettings() {
           <RulesForm workspaceId={w.id} />
           <WorkspaceModelsForm workspaceId={w.id} />
           <McpServersForm workspace={w} />
+          <HqFolderForm workspaceId={w.id} />
           <SettingToggle
             title="Wake tasks on CI failures and reviews"
             detail="A task's agent is messaged once when a check fails on its PR's head, with the log's tail, and when someone reviews or comments on it."

package/data/session-logs/index.ts

@@ -71,3 +71,40 @@ export function useSetLogFolder(projectId: string) {
       queryClient.setQueryData(sessionLogKeys.project(projectId), data),
   });
 }
+
+export interface WorkspaceHq {
+  hq: { folder: string; visibility: "private" | "internal" | "none" } | null;
+}
+
+const hqKey = (workspaceId: string) =>
+  [...sessionLogKeys.all, "hq", workspaceId] as const;
+
+async function hqState(res: Response): Promise<WorkspaceHq> {
+  const data = await res.json();
+  if (!res.ok) throw new Error(data.error || "Request failed");
+  return data;
+}
+
+export function useWorkspaceHqQuery(workspaceId: string) {
+  return useQuery({
+    queryKey: hqKey(workspaceId),
+    queryFn: async () =>
+      hqState(await fetch(`/api/workspaces/${workspaceId}/session-logs`)),
+    staleTime: 30_000,
+  });
+}
+
+export function useSetWorkspaceHq(workspaceId: string) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async (folder: string) =>
+      hqState(
+        await fetch(`/api/workspaces/${workspaceId}/session-logs`, {
+          method: "PUT",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ folder }),
+        })
+      ),
+    onSuccess: (data) => queryClient.setQueryData(hqKey(workspaceId), data),
+  });
+}

package/lib/session-logs/build.ts

@@ -123,11 +123,17 @@ const usd = (x: number, floor: boolean) =>
 const url = (u: string) =>
   /^https?:\/\/[^\s<>()[\]`]+$/.test(u) ? `<${u}>` : codeSpan(u);
 
+// A commit hash is not a secret, so it skips redact(): only a plain hash
+// (or one the log labels as the PR head) is printed, anything else is not.
+const SHA = /^[0-9a-f]{7,40}( \(PR head\))?$/;
+export const commitText = (sha: string | null): string =>
+  sha && SHA.test(sha) ? `\`${sha}\`` : "unknown";
+
 function header(d: LogData): string {
   const start = sqliteMs(d.startedAt);
   const end = sqliteMs(d.mergedAt);
   const duration =
-    start !== null && end !== null ? formatDuration(end - start) : "unknown";
+    start !== null && end !== null ? formatDuration(end - start) : null;
   const rows: [string, string][] = [
     ["Task", `${codeSpan(d.name)} (${codeSpan(d.id)})`],
     ["Workspace", d.workspace ? codeSpan(d.workspace) : "none"],
@@ -139,10 +145,10 @@ function header(d: LogData): string {
         ? `#${d.prNumber}${d.prUrl ? ` ${url(d.prUrl)}` : ""}`
         : "none recorded",
     ],
-    ["Merge commit", d.mergeCommit ? codeSpan(d.mergeCommit) : "not recorded"],
+    ["Merge commit", commitText(d.mergeCommit)],
     ["Started", when(d.startedAt)],
-    ["Merged", when(d.mergedAt)],
-    ["Duration", duration],
+    ["Merged", d.mergedAt ? when(d.mergedAt) : "unknown"],
+    ...(duration ? [["Duration", duration] as [string, string]] : []),
   ];
   return rows.map(([k, v]) => `- **${k}:** ${v}`).join("\n");
 }

package/lib/session-logs/folder.ts

@@ -1,8 +1,9 @@
 /**
- * Where a log's markdown file goes. By default
- * ~/.agent-os/session-logs/<workspace>/<project>/YYYY-MM-DD-<task>.md; a
- * project can name its own folder. Never inside the project's repository:
- * repositories can be public, and a log holds briefs and reviews.
+ * Where a log's markdown file goes, first match wins: the project's own
+ * folder, then the workspace's HQ repo (<hq>/docs/sessions/<project>/), then
+ * ~/.agent-os/session-logs/<workspace>/<project>/. All as
+ * YYYY-MM-DD-<task>.md. Never inside the project's repository: repositories
+ * can be public, and a log holds briefs and reviews.
  */
 
 import fs from "fs";
@@ -10,7 +11,9 @@ import os from "os";
 import path from "path";
 import { db } from "../db";
 import { slugify } from "../git";
-import { getProject, getProjectRepositories } from "../projects";
+import { getProject } from "../projects";
+import { usableHq, type Visibility } from "./hq";
+import { expand, repoPaths, resolved, within } from "./paths";
 
 // AGENTOS_SESSION_LOGS_DIR moves the default (tests keep it off the real one).
 export const DEFAULT_ROOT = () =>
@@ -19,39 +22,6 @@ export const DEFAULT_ROOT = () =>
 
 const key = (projectId: string) => `session-logs.folder.${projectId}`;
 
-const expand = (p: string) =>
-  p === "~" ? os.homedir() : p.replace(/^~(?=\/)/, os.homedir());
-
-// The path with symlinks resolved as far as it exists, so a link into a
-// repository is seen for what it is.
-function resolved(p: string): string {
-  let cur = path.resolve(p);
-  const rest: string[] = [];
-  while (!fs.existsSync(cur)) {
-    const up = path.dirname(cur);
-    if (up === cur) break;
-    rest.unshift(path.basename(cur));
-    cur = up;
-  }
-  return path.join(fs.realpathSync(cur), ...rest);
-}
-
-const within = (child: string, parent: string) => {
-  const rel = path.relative(parent, child);
-  return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
-};
-
-function repoPaths(projectId: string): string[] {
-  const project = getProject(projectId);
-  if (!project) return [];
-  return [
-    project.working_directory,
-    ...getProjectRepositories(projectId).map((r) => r.path),
-  ]
-    .filter(Boolean)
-    .map((p) => resolved(expand(p)));
-}
-
 // Throws a plain message when `dir` is inside one of the project's repos.
 export function assertOutsideRepos(projectId: string, dir: string): void {
   const target = resolved(dir);
@@ -91,6 +61,7 @@ export function setLogFolder(projectId: string, value: string | null): void {
 
 export interface FileTarget {
   workspace: string | null;
+  workspaceId?: string | null;
   project: string | null;
   projectId: string | null;
   name: string;
@@ -99,33 +70,56 @@ export interface FileTarget {
   day: string;
 }
 
+export interface Destination {
+  dir: string;
+  // The HQ repo the folder belongs to, when the log goes into one.
+  hq: { dir: string; visibility: Visibility } | null;
+}
+
 // The folder this task's log goes into: the project's override when it
-// still passes the repository check, else the default.
-export function targetDir(t: FileTarget): string {
+// still passes the repository check, else the workspace's HQ, else the
+// default.
+export function destination(t: FileTarget): Destination {
+  const projectSlug = slugify(t.project ?? "") || "no-project";
   const custom = t.projectId ? logFolder(t.projectId) : null;
   if (custom && t.projectId) {
     try {
       const dir = expand(custom);
       assertOutsideRepos(t.projectId, dir);
-      return dir;
+      return { dir, hq: null };
     } catch (error) {
       console.error(
         `[session-logs] ignoring the project's log folder: ${error instanceof Error ? error.message : error}`
       );
     }
   }
-  return path.join(
-    DEFAULT_ROOT(),
-    slugify(t.workspace ?? "") || "no-workspace",
-    slugify(t.project ?? "") || "no-project"
-  );
+  const workspaceId =
+    t.workspaceId ??
+    (t.projectId ? getProject(t.projectId)?.workspace_id : null) ??
+    null;
+  const hq = workspaceId ? usableHq(workspaceId) : null;
+  if (hq)
+    return { dir: path.join(hq.dir, "docs", "sessions", projectSlug), hq };
+  return {
+    dir: path.join(
+      DEFAULT_ROOT(),
+      slugify(t.workspace ?? "") || "no-workspace",
+      projectSlug
+    ),
+    hq: null,
+  };
 }
 
+export const targetDir = (t: FileTarget): string => destination(t).dir;
+
 // Writes the log once and returns its path. A file that's already there
 // (another task, same name, same day) is never overwritten.
-export function writeLogFile(t: FileTarget, markdown: string): string {
-  const dir = targetDir(t);
-  if (t.projectId && !logFolder(t.projectId))
+export function writeLogFileTo(
+  t: FileTarget,
+  markdown: string
+): { file: string; hq: Destination["hq"] } {
+  const { dir, hq } = destination(t);
+  if (t.projectId && !logFolder(t.projectId) && !hq)
     assertOutsideRepos(t.projectId, dir);
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
   const slug = slugify(t.name) || t.id.slice(0, 8);
@@ -136,10 +130,18 @@ export function writeLogFile(t: FileTarget, markdown: string): string {
     const full = path.join(dir, file);
     try {
       fs.writeFileSync(full, markdown, { flag: "wx", mode: 0o600 });
-      return full;
+      return { file: full, hq };
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
     }
   }
   throw new Error(`a log file for ${t.name} already exists in ${dir}`);
 }
+
+export const writeLogFile = (t: FileTarget, markdown: string): string =>
+  writeLogFileTo(t, markdown).file;
+
+// Rewrites a log's own file in place (never creates one, never moves it).
+export function overwriteLogFile(file: string, markdown: string): void {
+  if (fs.existsSync(file)) fs.writeFileSync(file, markdown, { mode: 0o600 });
+}

package/lib/session-logs/hq.ts

@@ -0,0 +1,201 @@
+/**
+ * A workspace's HQ folder: a git repo that session logs are written into
+ * (<hq>/docs/sessions/<project>/) and committed to. Logs hold private task
+ * details, so a repo whose remote is public is refused when it's saved, and
+ * nothing is pushed unless the stored visibility says private.
+ */
+
+import fs from "fs";
+import path from "path";
+import { db } from "../db";
+import { git } from "../git-exec";
+import { run } from "../tasks/gh";
+import { getWorkspace } from "../workspaces";
+import { expand, repoPaths, resolved, within } from "./paths";
+
+export type Visibility = "private" | "internal" | "none";
+
+export interface Hq {
+  folder: string;
+  // "none": the repo has no remote, so its logs stay local.
+  visibility: Visibility;
+}
+
+const key = (workspaceId: string) => `session-logs.hq.${workspaceId}`;
+
+export function getHq(workspaceId: string): Hq | null {
+  const row = db
+    .prepare(`SELECT value FROM settings WHERE key = ?`)
+    .get(key(workspaceId)) as { value: string } | undefined;
+  if (!row) return null;
+  try {
+    const hq = JSON.parse(row.value) as Hq;
+    return hq.folder ? hq : null;
+  } catch {
+    return null;
+  }
+}
+
+function projectRepos(workspaceId: string): string[] {
+  const ids = db
+    .prepare(`SELECT id FROM projects WHERE workspace_id = ?`)
+    .all(workspaceId) as { id: string }[];
+  return ids.flatMap((p) => repoPaths(p.id));
+}
+
+const insideRepo = (hq: string, workspaceId: string) =>
+  projectRepos(workspaceId).find((r) => within(hq, r));
+
+// The HQ when logs can still go into it: it's there, it's a git
+// repo and no project's repository has swallowed it since it was saved.
+export function usableHq(
+  workspaceId: string
+): { dir: string; visibility: Visibility } | null {
+  const hq = getHq(workspaceId);
+  if (!hq) return null;
+  try {
+    const dir = resolved(expand(hq.folder));
+    if (!fs.existsSync(path.join(dir, ".git")) || insideRepo(dir, workspaceId))
+      throw new Error("not usable");
+    return { dir, visibility: hq.visibility };
+  } catch {
+    console.error(
+      `[session-logs] the HQ folder ${hq.folder} can't be used; logs go to the default`
+    );
+    return null;
+  }
+}
+
+export interface HqDeps {
+  // gh's answer for the repo at `dir`: PUBLIC, PRIVATE or INTERNAL.
+  visibility: (dir: string) => Promise<string>;
+}
+
+const ghVisibility = async (dir: string) =>
+  (
+    await run(
+      "gh",
+      ["repo", "view", "--json", "visibility", "-q", ".visibility"],
+      dir,
+      20_000
+    )
+  ).trim();
+
+// Saves the HQ folder, or throws a plain message saying why not. An empty
+// value clears it.
+export async function setHq(
+  workspaceId: string,
+  value: string | null,
+  deps: HqDeps = { visibility: ghVisibility }
+): Promise<void> {
+  if (!getWorkspace(workspaceId)) throw new Error("Workspace not found");
+  const folder = value?.trim() ?? "";
+  if (!folder) {
+    db.prepare(`DELETE FROM settings WHERE key = ?`).run(key(workspaceId));
+    return;
+  }
+  if (!(folder === "~" || folder.startsWith("~/") || path.isAbsolute(folder)))
+    throw new Error(
+      `"${folder}" isn't an absolute path. Use a full path or one starting with ~/.`
+    );
+  const dir = resolved(expand(folder));
+  if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory())
+    throw new Error(`${folder} isn't a folder.`);
+  let top: string;
+  try {
+    top = resolved((await git(dir, ["rev-parse", "--show-toplevel"])).trim());
+  } catch {
+    throw new Error(`${folder} isn't a git repository.`);
+  }
+  if (top !== dir)
+    throw new Error(
+      `${folder} is inside the git repository at ${top}. Give the repository's top folder.`
+    );
+  const repo = insideRepo(dir, workspaceId);
+  if (repo)
+    throw new Error(
+      `${folder} is inside a project's repository (${repo}). Repositories can be public, so logs are never written into one.`
+    );
+  let visibility: Visibility = "none";
+  if ((await git(dir, ["remote"])).trim()) {
+    let seen: string;
+    try {
+      seen = (await deps.visibility(dir)).toUpperCase();
+    } catch (error) {
+      throw new Error(
+        `Couldn't check whether ${folder}'s GitHub repository is private: ${error instanceof Error ? error.message : error}`
+      );
+    }
+    if (seen === "PUBLIC")
+      throw new Error(
+        `${folder}'s GitHub repository is public. Logs hold private task details, so use a private repository.`
+      );
+    if (seen !== "PRIVATE" && seen !== "INTERNAL")
+      throw new Error(`Unexpected repository visibility "${seen}".`);
+    visibility = seen === "PRIVATE" ? "private" : "internal";
+  }
+  db.prepare(
+    `INSERT INTO settings (key, value) VALUES (?, ?)
+     ON CONFLICT(key) DO UPDATE SET value = excluded.value`
+  ).run(key(workspaceId), JSON.stringify({ folder, visibility }));
+}
+
+// One commit at a time per HQ: two merges at once would race on its index.
+const queues = new Map<string, Promise<unknown>>();
+
+function serialized<T>(hq: string, job: () => Promise<T>): Promise<T> {
+  const next = (queues.get(hq) ?? Promise.resolve()).then(job, job);
+  const tail = next.catch(() => {});
+  queues.set(hq, tail);
+  void tail.then(() => {
+    if (queues.get(hq) === tail) queues.delete(hq);
+  });
+  return next;
+}
+
+async function push(hq: string): Promise<void> {
+  const branch = (await git(hq, ["rev-parse", "--abbrev-ref", "HEAD"])).trim();
+  const [remote, ref] = (
+    await git(hq, [
+      "for-each-ref",
+      "--format=%(upstream:remotename) %(upstream)",
+      `refs/heads/${branch}`,
+    ])
+  )
+    .trim()
+    .split(" ");
+  // The upstream's remote branch is "refs/remotes/<remote>/<name>".
+  const name = ref?.replace(/^refs\/remotes\/[^/]+\//, "");
+  if (!remote || !name) return;
+  await git(hq, ["push", remote, `HEAD:refs/heads/${name}`], {
+    timeout: 120_000,
+  });
+}
+
+// Commits exactly these files (nothing else in the tree) and pushes when the
+// stored visibility is private. Never throws: a failure is logged, and the
+// next call's push carries the commit along.
+export function commitLogs(
+  hq: string,
+  files: string[],
+  message: string,
+  visibility: Visibility
+): Promise<void> {
+  return serialized(hq, async () => {
+    const rel = files.map((f) => path.relative(hq, f));
+    try {
+      const opts = { literalPathspecs: true };
+      await git(hq, ["add", "--", ...rel], opts);
+      await git(hq, ["commit", "-m", message, "--only", "--", ...rel], opts);
+    } catch (error) {
+      console.error(`[session-logs] commit in ${hq}:`, error);
+      return;
+    }
+    if (visibility !== "private") return;
+    try {
+      await push(hq);
+    } catch (error) {
+      console.error(`[session-logs] push from ${hq} failed (kept):`, error);
+    }
+  });
+}

package/lib/session-logs/index.ts

@@ -14,13 +14,27 @@ import { db, type Session } from "../db";
 import { getProject } from "../projects";
 import { run } from "../tasks/gh";
 import { buildLogMarkdown, sqliteMs } from "./build";
-import { writeLogFile } from "./folder";
+import {
+  overwriteLogFile,
+  destination,
+  writeLogFileTo,
+  type Destination,
+} from "./folder";
+import { commitLogs } from "./hq";
 import { gatherLogData, readPlanFile } from "./gather";
-import { hasLog, insertLog, setFilePath } from "./store";
+import {
+  getLog,
+  hasLog,
+  headerOf,
+  insertLog,
+  setFilePath,
+  updateLog,
+} from "./store";
 
 export * from "./store";
 export { buildLogMarkdown } from "./build";
 export { logFolder, setLogFolder } from "./folder";
+export { getHq, setHq } from "./hq";
 
 const inFlight = new Map<string, Promise<void>>();
 // Tasks known to have a log, so a poll that sees a merged PR again asks
@@ -38,6 +52,13 @@ export interface CaptureOpts {
   planKept?: boolean;
   // Skip asking GitHub for the merge commit (a batch of old tasks).
   noGh?: boolean;
+  // Given, the file is handed over instead of committed: a batch commits
+  // once at its end.
+  onFile?: (file: string, hq: NonNullable<Destination["hq"]>) => void;
+  // Regenerate a log that exists: update its row and file in place.
+  rewrite?: boolean;
+  // With rewrite: report whether the log would change, write nothing.
+  dryRun?: boolean;
 }
 
 function eligible(s: Session | undefined): s is Session {
@@ -50,31 +71,51 @@ function eligible(s: Session | undefined): s is Session {
   );
 }
 
-async function mergeCommitOf(s: Session): Promise<string | null> {
+// GitHub's ISO time as SQLite's UTC "YYYY-MM-DD HH:MM:SS"; null when absent.
+export function ghTimeToSqlite(iso: unknown): string | null {
+  if (typeof iso !== "string") return null;
+  const ms = Date.parse(iso);
+  return Number.isNaN(ms)
+    ? null
+    : new Date(ms).toISOString().replace("T", " ").slice(0, 19);
+}
+
+async function mergeInfoOf(
+  s: Session
+): Promise<{ commit: string | null; mergedAt: string | null }> {
+  const none = { commit: null, mergedAt: null };
   const project = s.project_id ? getProject(s.project_id) : undefined;
   if (!project || !s.pr_number || process.env.AGENTOS_SESSION_LOGS_NO_GH)
-    return null;
+    return none;
   try {
     const out = await run(
       "gh",
-      [
-        "pr",
-        "view",
-        String(s.pr_number),
-        "--json",
-        "mergeCommit",
-        "-q",
-        ".mergeCommit.oid",
-      ],
+      ["pr", "view", String(s.pr_number), "--json", "mergeCommit,mergedAt"],
       project.working_directory.replace(/^~/, os.homedir()),
       15_000
     );
-    return out.trim() || null;
+    const j = JSON.parse(out) as {
+      mergeCommit?: { oid?: string } | null;
+      mergedAt?: string | null;
+    };
+    return {
+      commit: j.mergeCommit?.oid?.trim() || null,
+      mergedAt: ghTimeToSqlite(j.mergedAt),
+    };
   } catch {
-    return null;
+    return none;
   }
 }
 
+const planSection = (md: string) =>
+  /^## Plan\n[\s\S]*?(?=\n## Timeline\n)/m.exec(md)?.[0] ?? null;
+
+function keepPlan(fresh: string, old: string): string {
+  const was = planSection(old);
+  const now = planSection(fresh);
+  return was && now ? fresh.replace(now, () => was) : fresh;
+}
+
 export async function writeLog(
   id: string,
   opts: CaptureOpts & { plan?: string | null } = {}
@@ -82,23 +123,81 @@ export async function writeLog(
   const row = db.prepare(`SELECT * FROM sessions WHERE id = ?`).get(id) as
     | Session
     | undefined;
-  if (!eligible(row) || hasLog(id)) return false;
-  const s = { ...row, merged_at: row.merged_at ?? sqliteNow() };
-  const mergeCommit = opts.noGh ? null : await mergeCommitOf(s);
+  const existing = getLog(id);
+  if (!eligible(row) || (existing && !opts.rewrite)) return false;
+  const info = opts.noGh
+    ? { commit: null, mergedAt: null }
+    : await mergeInfoOf(row);
+  const mergeCommit = info.commit;
+  const s = { ...row, merged_at: row.merged_at ?? info.mergedAt };
+  const kept = existing ? headerOf(existing) : null;
   const data = gatherLogData(s, {
     plan: opts.plan ?? null,
-    planKept: opts.planKept ?? true,
+    planKept: kept ? kept.planKept : (opts.planKept ?? true),
     head: opts.head ?? null,
     mergeCommit: mergeCommit ?? (opts.head ? `${opts.head} (PR head)` : null),
   });
-  const markdown = buildLogMarkdown(data);
+  let markdown = buildLogMarkdown(data);
+  // The plan file went with the worktree: keep the plan the log has.
+  if (existing && kept?.hasPlan)
+    markdown = keepPlan(markdown, existing.markdown);
   const start = sqliteMs(data.startedAt);
   const end = sqliteMs(data.mergedAt);
+  const workspaceId =
+    s.workspace_id ?? getProject(s.project_id ?? "")?.workspace_id ?? null;
+  if (existing) {
+    const changed = existing.markdown !== markdown;
+    if (opts.dryRun || !changed) return changed;
+    // Only the generated text changes; the row, its id and its file stay.
+    updateLog(id, markdown, {
+      id,
+      name: data.name,
+      workspace: data.workspace,
+      project: data.project,
+      branch: data.branch,
+      prNumber: data.prNumber,
+      prUrl: data.prUrl,
+      mergeCommit: data.mergeCommit,
+      startedAt: data.startedAt,
+      mergedAt: data.mergedAt,
+      durationMs: start !== null && end !== null ? end - start : null,
+      costUsd: data.usage.reduce((t, u) => t + u.costUsd, 0),
+      planKept: data.planKept,
+      hasPlan: kept?.hasPlan ?? data.plan !== null,
+    });
+    if (existing.file_path) {
+      try {
+        overwriteLogFile(existing.file_path, markdown);
+        const { hq } = destination({
+          workspace: data.workspace,
+          workspaceId,
+          project: data.project,
+          projectId: s.project_id,
+          name: data.name,
+          id,
+          day: "",
+        });
+        if (hq && existing.file_path.startsWith(hq.dir)) {
+          if (opts.onFile) opts.onFile(existing.file_path, hq);
+          else
+            await commitLogs(
+              hq.dir,
+              [existing.file_path],
+              `session log rewritten: ${data.name.replace(/\s+/g, " ").trim().slice(0, 100)}`,
+              hq.visibility
+            );
+        }
+      } catch (error) {
+        console.error(`[session-logs] file for ${id}:`, error);
+      }
+    }
+    return true;
+  }
+  if (opts.dryRun) return true;
   const stored = insertLog({
     sessionId: id,
     projectId: s.project_id,
-    workspaceId:
-      s.workspace_id ?? getProject(s.project_id ?? "")?.workspace_id ?? null,
+    workspaceId,
     markdown,
     header: {
       id,
@@ -120,9 +219,10 @@ export async function writeLog(
   });
   if (!stored) return false;
   try {
-    const file = writeLogFile(
+    const { file, hq } = writeLogFileTo(
       {
         workspace: data.workspace,
+        workspaceId,
         project: data.project,
         projectId: s.project_id,
         name: data.name,
@@ -132,6 +232,14 @@ export async function writeLog(
       markdown
     );
     setFilePath(id, file);
+    if (hq && opts.onFile) opts.onFile(file, hq);
+    else if (hq)
+      await commitLogs(
+        hq.dir,
+        [file],
+        `session log: ${data.name.replace(/\s+/g, " ").trim().slice(0, 100)}`,
+        hq.visibility
+      );
   } catch (error) {
     // The database holds the log; the file is a copy.
     console.error(`[session-logs] file for ${id}:`, error);

package/lib/session-logs/paths.ts

@@ -0,0 +1,37 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { getProject, getProjectRepositories } from "../projects";
+
+export const expand = (p: string) =>
+  p === "~" ? os.homedir() : p.replace(/^~(?=\/)/, os.homedir());
+
+// The path with symlinks resolved as far as it exists, so a link into a
+// repository is seen for what it is.
+export function resolved(p: string): string {
+  let cur = path.resolve(p);
+  const rest: string[] = [];
+  while (!fs.existsSync(cur)) {
+    const up = path.dirname(cur);
+    if (up === cur) break;
+    rest.unshift(path.basename(cur));
+    cur = up;
+  }
+  return path.join(fs.realpathSync(cur), ...rest);
+}
+
+export const within = (child: string, parent: string) => {
+  const rel = path.relative(parent, child);
+  return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel));
+};
+
+export function repoPaths(projectId: string): string[] {
+  const project = getProject(projectId);
+  if (!project) return [];
+  return [
+    project.working_directory,
+    ...getProjectRepositories(projectId).map((r) => r.path),
+  ]
+    .filter(Boolean)
+    .map((p) => resolved(expand(p)));
+}

package/lib/session-logs/reexport.ts

@@ -0,0 +1,90 @@
+/**
+ * Rewrites the files of logs already in the database to where they'd go
+ * now, from the stored markdown: no rebuild, no model. The old files are
+ * left alone. A log whose file is already in its destination is skipped, so
+ * a second run changes nothing.
+ */
+
+import path from "path";
+import { db } from "../db";
+import { destination, writeLogFileTo } from "./folder";
+import { commitLogs } from "./hq";
+import { headerOf, setFilePath, type LogRow } from "./store";
+
+export interface ReexportResult {
+  moved: number;
+  unchanged: number;
+  failed: number;
+  committed: number;
+}
+
+export async function reexportLogs(
+  opts: { dry?: boolean; log?: (line: string) => void } = {}
+): Promise<ReexportResult> {
+  const log = opts.log ?? (() => {});
+  const rows = db
+    .prepare(
+      `SELECT * FROM session_logs
+       ORDER BY json_extract(data, '$.mergedAt'), created_at`
+    )
+    .all() as LogRow[];
+  const result: ReexportResult = {
+    moved: 0,
+    unchanged: 0,
+    failed: 0,
+    committed: 0,
+  };
+  const byHq = new Map<
+    string,
+    { files: string[]; visibility: "private" | "internal" | "none" }
+  >();
+  for (const row of rows) {
+    const h = headerOf(row);
+    const target = {
+      workspace: h.workspace,
+      workspaceId: row.workspace_id,
+      project: h.project,
+      projectId: row.project_id,
+      name: h.name,
+      id: row.session_id,
+      day: (h.mergedAt ?? row.created_at).slice(0, 10),
+    };
+    try {
+      const dest = destination(target);
+      if (row.file_path && path.dirname(row.file_path) === dest.dir) {
+        result.unchanged++;
+        continue;
+      }
+      if (opts.dry) {
+        log(`  would move ${h.name} to ${dest.dir}`);
+        result.moved++;
+        continue;
+      }
+      const { file, hq } = writeLogFileTo(target, row.markdown);
+      setFilePath(row.session_id, file);
+      if (hq) {
+        const entry = byHq.get(hq.dir) ?? {
+          files: [],
+          visibility: hq.visibility,
+        };
+        entry.files.push(file);
+        byHq.set(hq.dir, entry);
+      }
+      result.moved++;
+      log(`  wrote ${file}`);
+    } catch (error) {
+      result.failed++;
+      log(`  FAILED ${h.name} (${row.session_id.slice(0, 8)}): ${error}`);
+    }
+  }
+  for (const [hq, { files, visibility }] of byHq) {
+    await commitLogs(
+      hq,
+      files,
+      `session logs: ${files.length} moved in`,
+      visibility
+    );
+    result.committed += files.length;
+  }
+  return result;
+}

package/lib/session-logs/store.ts

@@ -70,6 +70,17 @@ export function insertLog(row: {
   );
 }
 
+// Replaces the text and header of a log that exists; the row stays.
+export function updateLog(
+  sessionId: string,
+  markdown: string,
+  header: Omit<LogHeader, "createdAt" | "filePath">
+): void {
+  db.prepare(
+    `UPDATE session_logs SET markdown = ?, data = ? WHERE session_id = ?`
+  ).run(markdown, JSON.stringify(header), sessionId);
+}
+
 export function setFilePath(sessionId: string, filePath: string): void {
   db.prepare(`UPDATE session_logs SET file_path = ? WHERE session_id = ?`).run(
     filePath,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.505",
+  "version": "0.3.507",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"

package/scripts/backfill-session-logs.ts

@@ -1,14 +1,21 @@
 /**
  * Writes session logs for tasks that merged before logs existed, from what
  * the database still holds. Their plan files went with their worktrees, so
- * each says "plan not kept". Idempotent: a task with a log is skipped.
+ * each says "plan not kept". Idempotent: a task with a log is skipped, unless --rewrite.
  *
- *   npx tsx scripts/backfill-session-logs.ts --db <path to agent-os.db> [--no-gh] [--dry]
+ *   npx tsx scripts/backfill-session-logs.ts --db <path to agent-os.db> [--no-gh] [--dry] [--dry-run] [--rewrite] [--reexport]
  *
  * --db is required so a run never lands on a database by accident. Files go
- * where new logs go (~/.agent-os/session-logs, or a project's folder); run
+ * where new logs go: a project's folder, else the workspace's HQ repo (one
+ * commit per HQ at the end of the run), else ~/.agent-os/session-logs; run
  * with HOME set elsewhere to keep a trial away from the real folder.
- * --no-gh skips asking GitHub for each merge commit.
+ * --no-gh skips asking GitHub for each merge commit and time.
+ * --reexport writes the files of logs already in the database to where they
+ * go now, from the stored markdown (no rebuild, no model), and writes no new
+ * logs. Old files are left in place.
+ * --rewrite regenerates logs that exist (row and file updated in place, a
+ * kept plan stays); no model is called, only the one gh call per PR.
+ * --dry-run prints how many logs would be written or change, and writes none.
  */
 
 const args = process.argv.slice(2);
@@ -17,16 +24,27 @@ const dbPath = args[args.indexOf("--db") + 1];
 
 if (!flag("--db") || !dbPath || dbPath.startsWith("--")) {
   console.error(
-    "usage: backfill-session-logs.ts --db <path> [--no-gh] [--dry]"
+    "usage: backfill-session-logs.ts --db <path> [--no-gh] [--dry] [--dry-run] [--rewrite] [--reexport]"
   );
   process.exit(2);
 }
 process.env.DB_PATH = dbPath;
 
+type Visibility = "private" | "internal" | "none";
+
 async function main() {
+  if (flag("--reexport")) {
+    const { reexportLogs } = await import("../lib/session-logs/reexport");
+    const r = await reexportLogs({ dry: flag("--dry"), log: console.log });
+    console.log(
+      `${r.moved} ${flag("--dry") ? "to move" : "moved"}, ${r.unchanged} already in place, ${r.failed} failed, ${r.committed} committed`
+    );
+    return;
+  }
   const { db } = await import("../lib/db");
   const { writeLog } = await import("../lib/session-logs");
   const { hasLog } = await import("../lib/session-logs/store");
+  const { commitLogs } = await import("../lib/session-logs/hq");
   const rows = db
     .prepare(
       `SELECT id, name FROM sessions
@@ -35,30 +53,48 @@ async function main() {
        ORDER BY COALESCE(merged_at, updated_at)`
     )
     .all() as { id: string; name: string }[];
-  const todo = rows.filter((r) => !hasLog(r.id));
+  const rewrite = flag("--rewrite");
+  const dry = flag("--dry") || flag("--dry-run");
+  const todo = rewrite ? rows : rows.filter((r) => !hasLog(r.id));
   console.log(
-    `${rows.length} merged tasks, ${rows.length - todo.length} already logged, ${todo.length} to write${flag("--dry") ? " (dry run)" : ""}`
+    `${rows.length} merged tasks, ${rows.length - rows.filter((r) => !hasLog(r.id)).length} already logged, ${todo.length} to ${rewrite ? "regenerate" : "write"}${dry ? " (dry run)" : ""}`
   );
   let written = 0;
+  const byHq = new Map<string, { files: string[]; visibility: Visibility }>();
   for (const r of todo) {
-    if (flag("--dry")) {
-      console.log(`  would log ${r.name} (${r.id.slice(0, 8)})`);
-      continue;
-    }
     try {
       const ok = await writeLog(r.id, {
         planKept: false,
         noGh: flag("--no-gh"),
+        onFile: (file, hq) => {
+          const e = byHq.get(hq.dir) ?? {
+            files: [],
+            visibility: hq.visibility,
+          };
+          e.files.push(file);
+          byHq.set(hq.dir, e);
+        },
+        rewrite,
+        dryRun: dry,
       });
       if (ok) written++;
       console.log(
-        `  ${ok ? "logged" : "skipped"} ${r.name} (${r.id.slice(0, 8)})`
+        `  ${ok ? (dry ? "would change" : rewrite ? "rewrote" : "logged") : "skipped"} ${r.name} (${r.id.slice(0, 8)})`
       );
     } catch (error) {
       console.error(`  FAILED ${r.name} (${r.id.slice(0, 8)}):`, error);
     }
   }
-  console.log(`wrote ${written} logs`);
+  for (const [dir, { files, visibility }] of byHq)
+    await commitLogs(
+      dir,
+      files,
+      `session logs: ${files.length} backfilled`,
+      visibility
+    );
+  console.log(
+    `${dry ? `${written} logs would change` : `wrote ${written} logs`}`
+  );
 }
 
 main().then(