@spool-lab/core 0.4.12 → 0.4.20

package/dist/security/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/security/scan.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,EAAE;AACF,mEAAmE;AACnE,2DAA2D;AAC3D,iEAAiE;AACjE,4DAA4D;AAC5D,EAAE;AACF,kEAAkE;AAClE,kEAAkE;AAClE,mEAAmE;AACnE,4DAA4D;AAC5D,kEAAkE;AAElE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAGrC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAC7D,OAAO,EACL,yBAAyB,EACzB,cAAc,EACd,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,EACb,aAAa,GAEd,MAAM,WAAW,CAAA;AAGlB,MAAM,OAAO,SAAU,SAAQ,IAAI,CAAC,WAAW,CAAC,WAAW,CAIzD;CAAG;AAwCL;;2CAE2C;AAC3C,MAAM,UAAU,WAAW,CACzB,SAAiB,EACjB,IAAqB;IAErB,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACjC,GAAG,EAAE,GAAG,EAAE,CACR,IAAI,CAAC,EAAE,CAAC,OAAO,CACb;;;6BAGmB,CACpB,CAAC,GAAG,CAAC,SAAS,CAAiB;YAClC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;SAC3E,CAAC,CAAA;QAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,8DAA8D;YAC9D,2DAA2D;YAC3D,yCAAyC;YACzC,KAAK,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAClC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAA;YAC7D,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,CAAA;QACjE,CAAC;QAED,6DAA6D;QAC7D,gEAAgE;QAChE,8BAA8B;QAC9B,MAAM,UAAU,GAAkD,EAAE,CAAA;QACpE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE;oBAAE,SAAQ;gBACnC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAA8B;oBACpE,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;oBAC7C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;iBACjF,CAAC,CAAA;gBACF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,6CAA6C;QAC7C,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;QAEvC,4CAA4C;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC9B,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC;YAC5C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;SAC3E,CAAC,CAAA;QAEF,MAAM,MAAM,GAAmB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChD,SAAS;YACT,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,WAAW,EAAE,CAAC,CAAC,KAAK;YACpB,SAAS,EAAE,CAAC,CAAC,GAAG;YAChB,KAAK,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;gBACnF,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,QAAQ;SACb,CAAC,CAAC,CAAA;QAEH,uBAAuB;QACvB,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAChB,GAAG,EAAE,GAAG,EAAE;gBACR,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;oBACvB,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;oBACjE,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;oBAC/B,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;oBACxF,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;gBACzC,CAAC,CAAC,EAAE,CAAA;YACN,CAAC;YACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;SAC3E,CAAC,CAAA;QAEF,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAA;QAE7D,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,CAAA;IAC7E,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,SAAiB,EAAE,IAAqB;IAC1D,OAAO,MAAM,CAAC,GAAG,CAAC;QAChB,GAAG,EAAE,GAAG,EAAE;YACR,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBACvB,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;gBACjE,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;gBACxF,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;YACzC,CAAC,CAAC,EAAE,CAAA;QACN,CAAC;QACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;KAC3E,CAAC,CAAA;AACJ,CAAC;AAID;;qEAEqE;AACrE,SAAS,YAAY,CACnB,OAA8D;IAE9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,yBAAyB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;QACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;YACpD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;AACnC,CAAC"}

package/dist/security/types.d.ts

@@ -0,0 +1,128 @@
+import type { SensitiveKind, Severity } from '@spool-lab/redact';
+/** A finding's lifecycle state.
+ *
+ *   active     — surfaced in Security page and session strip
+ *   dismissed  — user opted to ignore; suppressed from default views
+ *   purged     — raw value rewritten with a mask in
+ *                messages.content_text; row remains as an audit record
+ */
+export type FindingState = 'active' | 'dismissed' | 'purged';
+/** One row of the `findings` table, mapped to camelCase for the
+ *  renderer. The raw sensitive value is NEVER part of this payload —
+ *  consumers that need to render the original text fetch it via
+ *  `getFindingValue(findingId)`, which reads
+ *  `messages.content_text[startOffset..endOffset]` at request time. */
+export interface FindingRow {
+    id: number;
+    sessionId: number;
+    messageId: number | null;
+    kind: SensitiveKind;
+    valueHash: string;
+    confidence: number;
+    provider: string;
+    startOffset: number;
+    endOffset: number;
+    state: FindingState;
+    detectedAt: string;
+    stateChangedAt: string | null;
+}
+/** A session row joined with its denormalised scan counts. Used by
+ *  the Security page list and the Library row badge. */
+export interface SessionWithFindingCounts {
+    id: number;
+    sessionUuid: string;
+    title: string | null;
+    startedAt: string;
+    /** Active findings of any severity. */
+    findingCount: number;
+    /** Active findings whose kind is in `HIGH_SEVERITY_KINDS`. */
+    highCount: number;
+    /** Lifetime count of purged findings on this session. Combined with
+     *  scan_completed_at + a zero findingCount, lets the Library row
+     *  show an "all-resolved" check rather than a stale red badge. */
+    purgedCount: number;
+    scanCompletedAt: string | null;
+    /** Sources name ('claude' / 'codex' / 'gemini'). */
+    source: string;
+    /** Number of non-sidechain messages in the session. */
+    messageCount: number;
+    /** Model identifier as captured at sync time. May be null for
+     *  sessions where the parser couldn't infer it. */
+    model: string | null;
+    /** Working directory captured when the session started; used to
+     *  build the resume-CLI command and the "Copy terminal command"
+     *  menu action. Null when the parser couldn't infer it. */
+    cwd: string | null;
+    /** Human-readable project name, e.g. "spool". Surfaced at the head
+     *  of the session card's meta row so users can locate the session
+     *  in the Library at a glance. */
+    projectDisplayName: string | null;
+}
+/** Row in the Security page's Risk-by-category panel. One per kind
+ *  that has ≥ 1 active finding; categories with zero counts are not
+ *  emitted. */
+export interface RiskByCategoryRow {
+    kind: SensitiveKind;
+    severity: Severity;
+    count: number;
+    /** Distinct sessions containing ≥ 1 active finding of this kind. */
+    sessions: number;
+}
+/** Scope of a Dismiss action.
+ *   session — add to allowlist_session for this finding's session
+ *   global  — add to allowlist_global; all matching findings across
+ *             every session auto-dismiss on next scan */
+export interface DismissScope {
+    scope: 'session' | 'global';
+    /** Required when scope === 'session'. */
+    sessionId?: number;
+}
+/** Change events emitted on the worker's PubSub stream and forwarded
+ *  to renderers via IPC. Consumers should treat unknown `type` values
+ *  as no-ops (forward-compat). */
+export type FindingsChange = {
+    type: 'inserted';
+    sessionId: number;
+} | {
+    type: 'state-changed';
+    sessionId: number;
+    findingId: number;
+    state: FindingState;
+} | {
+    type: 'session-rescanned';
+    sessionId: number;
+};
+/** Snapshot of the scan worker's transient state. The DB stores
+ *  scan_profile / scan_completed_at; queued and scanning are
+ *  worker-memory only — they reset on restart. */
+export interface ScanStatus {
+    /** Sessions waiting for a slot in the worker queue. */
+    queued: number;
+    /** Session currently being scanned, or null when idle. */
+    scanning: number | null;
+    /** When in backfill mode, sessions still to process; 0 otherwise. */
+    backfillRemaining: number;
+    /** High-water mark for the active scan burst — the total session
+     *  count this burst has set out to scan. Held until the worker
+     *  goes fully idle (queued + scanning + backfillRemaining all 0),
+     *  then resets to 0. Lets the renderer's progress bar survive
+     *  navigation away from + back to the Security page mid-scan
+     *  without "restarting" at the remaining-now count. */
+    backfillTotal: number;
+    /** True for the lifetime of a user-initiated `Rescan all` burst
+     *  (set by `worker.rescanAll()`; cleared automatically when the
+     *  worker goes fully idle). The renderer reads this directly
+     *  instead of tracking the click locally — a renderer-side flag
+     *  would race against any auto sync-driven enqueue that completed
+     *  between the click and the IPC reaching the worker, causing
+     *  the manual ACK banner to be hijacked + cleared by the auto
+     *  burst's idle edge. Tying it to the worker keeps a single
+     *  source of truth. */
+    manualBurstInFlight: boolean;
+    /** Composite identifier for the active provider set, e.g.
+     *  'regex@3' or 'regex@3,pf@1.5b-q4'. Persisted on
+     *  sessions.scan_profile to detect rescan candidates after
+     *  provider configuration changes. */
+    currentProfile: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/security/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE5D;;;;uEAIuE;AACvE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,aAAa,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,YAAY,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED;wDACwD;AACxD,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,YAAY,EAAE,MAAM,CAAA;IACpB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAA;IACjB;;sEAEkE;IAClE,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAA;IACpB;uDACmD;IACnD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;+DAE2D;IAC3D,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB;;sCAEkC;IAClC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;eAEe;AACf,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,CAAA;IACnB,QAAQ,EAAE,QAAQ,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;yDAGyD;AACzD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAA;IAC3B,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;kCAEkC;AAClC,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GACpF;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpD;;kDAEkD;AAClD,MAAM,WAAW,UAAU;IACzB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,qEAAqE;IACrE,iBAAiB,EAAE,MAAM,CAAA;IACzB;;;;;2DAKuD;IACvD,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;;;;2BAQuB;IACvB,mBAAmB,EAAE,OAAO,CAAA;IAC5B;;;0CAGsC;IACtC,cAAc,EAAE,MAAM,CAAA;CACvB"}

package/dist/security/types.js

@@ -0,0 +1,10 @@
+// Shared types for the Security Scan subsystem.
+//
+// These are the cross-boundary payloads — worker → IPC → renderer.
+// They live in one module so:
+//   1. The worker (main process), IPC adapters, and renderer hooks
+//      can import a single source of truth.
+//   2. Promoting them to `Schema.Struct` later (for a Scope-B Effect
+//      RPC migration) is a local refactor, not a consumer rewrite.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/security/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,mEAAmE;AACnE,8BAA8B;AAC9B,mEAAmE;AACnE,4CAA4C;AAC5C,qEAAqE;AACrE,mEAAmE"}

package/dist/security/worker.d.ts

@@ -0,0 +1,53 @@
+import { Effect, Fiber, Stream, Scope } from 'effect';
+import type Database from 'better-sqlite3';
+import type { RedactProvider } from '@spool-lab/redact';
+import type { FindingsChange, ScanStatus } from './types.js';
+export interface WorkerConfig {
+    db: Database.Database;
+    providers: readonly RedactProvider[];
+    /** Profile string for `providers`. The worker rejects mismatched
+     *  pairs (you can't claim profile = 'regex@3,pf@1.5b' with only
+     *  regexProvider in `providers`).
+     *
+     *  Pass either a static string (test fixtures) or a thunk (prod —
+     *  lets the profile track pref changes like `kindAllowlist` so
+     *  toggling a kind triggers backfill via `listSessionsNeedingScan`
+     *  on the next call). The worker resolves the thunk on every read
+     *  rather than caching, so a pref save → SET_PREFS handler can
+     *  invalidate sessions and immediately see them as stale. */
+    currentProfile: string | (() => string);
+    /** Names of providers active in this profile. */
+    providerNames: readonly string[];
+    /** Live accessor for the kind-level allowlist. Read on every scan
+     *  (cheap — a Set lookup per match), so changing the preference
+     *  takes effect on the next rescan without restarting the worker. */
+    getKindAllowlist?: () => ReadonlySet<string>;
+}
+export interface ScanWorker {
+    /** Drop a session at the back of the queue. */
+    enqueue: (sessionId: number) => Effect.Effect<void>;
+    /** Set every session's profile to NULL and enqueue them — used by
+     *  "Rescan all" and by provider-set changes. */
+    rescanAll: () => Effect.Effect<number>;
+    /** Enqueue every session whose scan_profile != currentProfile.
+     *  Called once on boot. */
+    backfill: () => Effect.Effect<number>;
+    /** Stream of finding change events. Translator in main process
+     *  subscribes and forwards over IPC. */
+    changes: Stream.Stream<FindingsChange>;
+    /** Stream of status updates — emitted on every queued / scanning /
+     *  backfillRemaining mutation. Lets the UI replace polling with a
+     *  push subscription. */
+    statusChanges: Stream.Stream<ScanStatus>;
+    /** Current snapshot. UI uses this for the first read; subsequent
+     *  updates land via `statusChanges`. */
+    getStatus: Effect.Effect<ScanStatus>;
+}
+/** Build a worker as a Scoped effect: when the scope closes, the
+ *  draining fiber is interrupted cleanly and the PubSub shuts down. */
+export declare function makeScanWorker(config: WorkerConfig): Effect.Effect<ScanWorker, never, Scope.Scope>;
+/** Helper for tests / callers that want a complete drain promise
+ *  (e.g. wait for the queue to empty after a backfill). */
+export declare function waitForIdle(worker: ScanWorker): Effect.Effect<void>;
+export { Fiber };
+//# sourceMappingURL=worker.d.ts.map

package/dist/security/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/security/worker.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAsB,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AACzE,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAGvD,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAA;IACrB,SAAS,EAAE,SAAS,cAAc,EAAE,CAAA;IACpC;;;;;;;;;iEAS6D;IAC7D,cAAc,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAA;IACvC,iDAAiD;IACjD,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC;;yEAEqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;CAC7C;AAQD,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnD;oDACgD;IAChD,SAAS,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtC;+BAC2B;IAC3B,QAAQ,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACrC;4CACwC;IACxC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IACtC;;6BAEyB;IACzB,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACxC;4CACwC;IACxC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;CACrC;AAED;uEACuE;AACvE,wBAAgB,cAAc,CAC5B,MAAM,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAiL/C;AAED;2DAC2D;AAC3D,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAQnE;AAGD,OAAO,EAAE,KAAK,EAAE,CAAA"}

package/dist/security/worker.js

@@ -0,0 +1,180 @@
+// Scan worker — the long-lived coordinator that drains a session
+// queue, runs `scanSession` per item, and publishes change events.
+//
+// Implementation: Effect Scope A. Inside this module is Effect-shaped
+// (Queue, Stream, PubSub, Ref, Scope). The boundary — IPC handlers
+// in `packages/app/src/main/ipc/security.ts` — wraps `runFiber` /
+// `runPromise` so renderers see plain Promise-shaped channels.
+//
+// Single-fiber by design (`concurrency: 1` on the queue stream).
+// Better-sqlite3 is synchronous, so multiple parallel fibers compete
+// for the DB lock and gain nothing. Backfill UX surfaces "session N
+// of M" progress for the user.
+import { Effect, Fiber, PubSub, Queue, Ref, Stream } from 'effect';
+import { scanSession } from './scan.js';
+import { listSessionsNeedingScan } from './repo.js';
+function resolveProfile(config) {
+    return typeof config.currentProfile === 'function'
+        ? config.currentProfile()
+        : config.currentProfile;
+}
+/** Build a worker as a Scoped effect: when the scope closes, the
+ *  draining fiber is interrupted cleanly and the PubSub shuts down. */
+export function makeScanWorker(config) {
+    return Effect.gen(function* () {
+        const queue = yield* Queue.unbounded();
+        const events = yield* PubSub.unbounded();
+        const statusEvents = yield* PubSub.unbounded();
+        const statusRef = yield* Ref.make({
+            queued: 0,
+            scanning: null,
+            backfillRemaining: 0,
+            backfillTotal: 0,
+            manualBurstInFlight: false,
+            currentProfile: resolveProfile(config),
+        });
+        const publish = (c) => PubSub.publish(events, c).pipe(Effect.asVoid);
+        // Update statusRef AND publish the new snapshot so subscribers get
+        // a push event for every mutation. One helper at the seam avoids
+        // forgetting to publish from a future Ref.update site.
+        //
+        // `backfillTotal` is derived here so individual mutation sites
+        // (enqueue / rescanAll / backfill / scanOne) don't have to
+        // remember to bump it. The renderer's progress bar reads
+        // `backfillRemaining + (scanning ? 1 : 0)` as the active count;
+        // we track the high-water mark of that quantity since the last
+        // full-idle state, and reset to 0 once everything drains. Survives
+        // navigation: a user who switches tabs mid-burst and comes back
+        // gets the true original total via `getStatus`, not the
+        // remaining-at-remount-time approximation.
+        const updateStatus = (f) => Ref.update(statusRef, (prev) => {
+            const after = f(prev);
+            // High-water mark of *backfillRemaining alone*. Including the
+            // scanning slot (br + 1 when scanning != null) bumped the
+            // total by one every time a scanOne started, and dropped it
+            // again when scanning went back to null between sessions —
+            // turning the renderer's `(total - remaining)/total` into a
+            // non-monotonic value that visibly rewound the progress bar
+            // on every cross-session tick. backfillRemaining itself is
+            // strictly monotonic (only decrements at scanOne end), so
+            // anchoring the total to it makes the progress bar strictly
+            // forward.
+            const fullyIdle = after.backfillRemaining === 0 &&
+                after.queued === 0 &&
+                after.scanning === null;
+            const backfillTotal = fullyIdle
+                ? 0
+                : Math.max(prev.backfillTotal, after.backfillRemaining);
+            // `manualBurstInFlight` rides along with the burst. The
+            // worker.rescanAll() mutation flips it on; this wrapper
+            // flips it off the instant the worker drains, so the
+            // renderer's "your manual scan finished" detection never
+            // sees a stale truth across burst boundaries.
+            const manualBurstInFlight = fullyIdle ? false : after.manualBurstInFlight;
+            return { ...after, backfillTotal, manualBurstInFlight };
+        }).pipe(Effect.zipRight(Ref.get(statusRef)), Effect.flatMap((s) => PubSub.publish(statusEvents, s)), Effect.asVoid);
+        const scanOne = (sessionId) => Effect.gen(function* () {
+            yield* updateStatus((s) => ({
+                ...s,
+                scanning: sessionId,
+                queued: Math.max(0, s.queued - 1),
+            }));
+            const result = yield* scanSession(sessionId, {
+                db: config.db,
+                providers: config.providers,
+                currentProfile: resolveProfile(config),
+                providerNames: config.providerNames,
+                publish,
+                ...(config.getKindAllowlist ? { kindAllowlist: config.getKindAllowlist() } : {}),
+            }).pipe(Effect.catchAll((err) => Effect.logError(`scanSession failed for ${sessionId}: ${err.reason}`, err).pipe(Effect.as(null))));
+            yield* updateStatus((s) => ({
+                ...s,
+                scanning: null,
+                backfillRemaining: Math.max(0, s.backfillRemaining - 1),
+            }));
+            return result;
+        });
+        // The drain fiber runs for the worker's lifetime; Scope.addFinalizer
+        // interrupts it when the runtime tears down.
+        //
+        // Throttle: yield 50ms between scans. better-sqlite3 is synchronous
+        // so the DB lock is held for the full scanOne duration (~50-100ms
+        // per session). Without a yield, a backfill of N sessions becomes
+        // ~N*scanTime of uninterrupted lock contention — foreground reads
+        // (listSessions, FTS search) get queued behind every scan. The
+        // sleep gives the event loop a window to flush foreground IPC
+        // handlers before grabbing the next session. Doubles backfill
+        // duration but keeps the app responsive.
+        const drain = Stream.fromQueue(queue).pipe(Stream.mapEffect((sessionId) => scanOne(sessionId).pipe(Effect.tap(() => Effect.sleep('50 millis'))), { concurrency: 1 }), Stream.runDrain);
+        yield* Effect.forkScoped(drain);
+        const enqueue = (sessionId) => Effect.gen(function* () {
+            yield* Queue.offer(queue, sessionId);
+            yield* updateStatus((s) => ({ ...s, queued: s.queued + 1 }));
+        });
+        const rescanAll = () => Effect.gen(function* () {
+            // SELECT and UPDATE share one transaction so a concurrent sync
+            // that inserts a new session can't slip between them — the
+            // new row would otherwise miss the profile NULL pass AND be
+            // omitted from `all`, leaving it silently skipped by the
+            // drain fiber even though the user pressed "Rescan all". With
+            // a transaction the worker either sees every session present
+            // at the moment of the click, or sees the post-insert state
+            // (in which case the new session participates).
+            const all = yield* Effect.sync(() => config.db.transaction(() => {
+                const rows = config.db
+                    .prepare('SELECT id FROM sessions ORDER BY started_at DESC')
+                    .all();
+                config.db.prepare('UPDATE sessions SET scan_profile = NULL').run();
+                return rows;
+            })());
+            yield* updateStatus((s) => ({
+                ...s,
+                backfillRemaining: all.length,
+                // Flag this as a user-initiated burst — the renderer
+                // hangs its result-banner ACK off this field instead of
+                // a click-local flag.
+                manualBurstInFlight: true,
+            }));
+            for (const r of all) {
+                yield* enqueue(r.id);
+            }
+            return all.length;
+        });
+        const backfill = () => Effect.gen(function* () {
+            // Re-resolve the profile each call so a SET_PREFS handler that
+            // changed kindAllowlist sees the updated hash before invoking
+            // backfill. Keep the per-call status snapshot in sync too.
+            const profile = resolveProfile(config);
+            yield* updateStatus((s) => ({ ...s, currentProfile: profile }));
+            const stale = yield* Effect.sync(() => listSessionsNeedingScan(config.db, profile));
+            yield* updateStatus((s) => ({ ...s, backfillRemaining: stale.length }));
+            for (const id of stale) {
+                yield* enqueue(id);
+            }
+            return stale.length;
+        });
+        return {
+            enqueue,
+            rescanAll,
+            backfill,
+            changes: Stream.fromPubSub(events),
+            statusChanges: Stream.fromPubSub(statusEvents),
+            getStatus: Ref.get(statusRef),
+        };
+    });
+}
+/** Helper for tests / callers that want a complete drain promise
+ *  (e.g. wait for the queue to empty after a backfill). */
+export function waitForIdle(worker) {
+    return Effect.gen(function* () {
+        while (true) {
+            const s = yield* worker.getStatus;
+            if (s.queued === 0 && s.scanning === null && s.backfillRemaining === 0)
+                return;
+            yield* Effect.sleep('25 millis');
+        }
+    });
+}
+// Re-export Fiber for callers that want to manage runtime lifecycle.
+export { Fiber };
+//# sourceMappingURL=worker.js.map

package/dist/security/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../src/security/worker.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,mEAAmE;AACnE,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,kEAAkE;AAClE,+DAA+D;AAC/D,EAAE;AACF,iEAAiE;AACjE,qEAAqE;AACrE,oEAAoE;AACpE,+BAA+B;AAE/B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAS,MAAM,QAAQ,CAAA;AAGzE,OAAO,EAAE,WAAW,EAAmB,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAA;AAyBnD,SAAS,cAAc,CAAC,MAAoB;IAC1C,OAAO,OAAO,MAAM,CAAC,cAAc,KAAK,UAAU;QAChD,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE;QACzB,CAAC,CAAC,MAAM,CAAC,cAAc,CAAA;AAC3B,CAAC;AAuBD;uEACuE;AACvE,MAAM,UAAU,cAAc,CAC5B,MAAoB;IAEpB,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,EAAU,CAAA;QAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,EAAkB,CAAA;QACxD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,EAAc,CAAA;QAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAa;YAC5C,MAAM,EAAE,CAAC;YACT,QAAQ,EAAE,IAAI;YACd,iBAAiB,EAAE,CAAC;YACpB,aAAa,EAAE,CAAC;YAChB,mBAAmB,EAAE,KAAK;YAC1B,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC;SACvC,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,CAAC,CAAiB,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAEpF,mEAAmE;QACnE,iEAAiE;QACjE,uDAAuD;QACvD,EAAE;QACF,+DAA+D;QAC/D,2DAA2D;QAC3D,yDAAyD;QACzD,gEAAgE;QAChE,+DAA+D;QAC/D,mEAAmE;QACnE,gEAAgE;QAChE,wDAAwD;QACxD,2CAA2C;QAC3C,MAAM,YAAY,GAAG,CAAC,CAAgC,EAAE,EAAE,CACxD,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAA;YACrB,8DAA8D;YAC9D,0DAA0D;YAC1D,4DAA4D;YAC5D,2DAA2D;YAC3D,4DAA4D;YAC5D,4DAA4D;YAC5D,2DAA2D;YAC3D,0DAA0D;YAC1D,4DAA4D;YAC5D,WAAW;YACX,MAAM,SAAS,GACb,KAAK,CAAC,iBAAiB,KAAK,CAAC;gBAC7B,KAAK,CAAC,MAAM,KAAK,CAAC;gBAClB,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAA;YACzB,MAAM,aAAa,GAAG,SAAS;gBAC7B,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAA;YACzD,wDAAwD;YACxD,wDAAwD;YACxD,qDAAqD;YACrD,yDAAyD;YACzD,8CAA8C;YAC9C,MAAM,mBAAmB,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAA;YACzE,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAA;QACzD,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EACnC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EACtD,MAAM,CAAC,MAAM,CACd,CAAA;QAEH,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,EAAE,CACpC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1B,GAAG,CAAC;gBACJ,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;aAClC,CAAC,CAAC,CAAA;YACH,MAAM,MAAM,GAAsB,KAAK,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE;gBAC9D,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC;gBACtC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,OAAO;gBACP,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE,CACtB,MAAM,CAAC,QAAQ,CAAC,0BAA0B,SAAS,KAAK,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,CAC7E,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAChB,CACF,CACF,CAAA;YACD,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1B,GAAG,CAAC;gBACJ,QAAQ,EAAE,IAAI;gBACd,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,iBAAiB,GAAG,CAAC,CAAC;aACxD,CAAC,CAAC,CAAA;YACH,OAAO,MAAM,CAAA;QACf,CAAC,CAAC,CAAA;QAEJ,qEAAqE;QACrE,6CAA6C;QAC7C,EAAE;QACF,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,+DAA+D;QAC/D,8DAA8D;QAC9D,8DAA8D;QAC9D,yCAAyC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CACxC,MAAM,CAAC,SAAS,CACd,CAAC,SAAiB,EAAE,EAAE,CACpB,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EACtE,EAAE,WAAW,EAAE,CAAC,EAAE,CACnB,EACD,MAAM,CAAC,QAAQ,CAChB,CAAA;QACD,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAE/B,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAE,EAAE,CACpC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;YACpC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QAC9D,CAAC,CAAC,CAAA;QAEJ,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,+DAA+D;YAC/D,2DAA2D;YAC3D,4DAA4D;YAC5D,yDAAyD;YACzD,8DAA8D;YAC9D,6DAA6D;YAC7D,4DAA4D;YAC5D,gDAAgD;YAChD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAClC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBACzB,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE;qBACnB,OAAO,CAAC,kDAAkD,CAAC;qBAC3D,GAAG,EAA2B,CAAA;gBACjC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAAE,CAAA;gBAClE,OAAO,IAAI,CAAA;YACb,CAAC,CAAC,EAAE,CACL,CAAA;YACD,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1B,GAAG,CAAC;gBACJ,iBAAiB,EAAE,GAAG,CAAC,MAAM;gBAC7B,qDAAqD;gBACrD,wDAAwD;gBACxD,sBAAsB;gBACtB,mBAAmB,EAAE,IAAI;aAC1B,CAAC,CAAC,CAAA;YACH,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;gBACpB,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACtB,CAAC;YACD,OAAO,GAAG,CAAC,MAAM,CAAA;QACnB,CAAC,CAAC,CAAA;QAEJ,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,+DAA+D;YAC/D,8DAA8D;YAC9D,2DAA2D;YAC3D,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;YACtC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;YAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CACpC,uBAAuB,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAC5C,CAAA;YACD,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YACvE,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YACpB,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAA;QACrB,CAAC,CAAC,CAAA;QAEJ,OAAO;YACL,OAAO;YACP,SAAS;YACT,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAClC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC;YAC9C,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;SACT,CAAA;IACxB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;2DAC2D;AAC3D,MAAM,UAAU,WAAW,CAAC,MAAkB;IAC5C,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAA;YACjC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,iBAAiB,KAAK,CAAC;gBAAE,OAAM;YAC9E,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QAClC,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,qEAAqE;AACrE,OAAO,EAAE,KAAK,EAAE,CAAA"}

package/dist/sync/source-paths.d.ts

@@ -2,4 +2,5 @@ import type { SessionSource } from '../types.js';
 export declare function getSessionRoots(source: SessionSource): string[];
 export declare function detectSessionSource(filePath: string, sourceRoots?: Record<SessionSource, string[]>): SessionSource | undefined;
 export declare function getSessionWatchPatterns(source: SessionSource, roots?: string[]): string[];
+export declare function isSessionFileForSource(source: SessionSource, filePath: string, root: string): boolean;
 //# sourceMappingURL=source-paths.d.ts.map

package/dist/sync/source-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source-paths.d.ts","sourceRoot":"","sources":["../../src/sync/source-paths.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAuBhD,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,EAAE,CA4B/D;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,WAAW,GAAE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,CAI1C,GACA,aAAa,GAAG,SAAS,CAO3B;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,aAAa,EACrB,KAAK,WAA0B,GAC9B,MAAM,EAAE,CAGV"}
+{"version":3,"file":"source-paths.d.ts","sourceRoot":"","sources":["../../src/sync/source-paths.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAuBhD,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,EAAE,CA4B/D;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,WAAW,GAAE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,CAI1C,GACA,aAAa,GAAG,SAAS,CAO3B;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,aAAa,EACrB,KAAK,WAA0B,GAC9B,MAAM,EAAE,CAGV;AA8CD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAiBrG"}

package/dist/sync/source-paths.js

@@ -1,6 +1,6 @@
 import { existsSync, readdirSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { basename, delimiter, isAbsolute, join, relative, resolve } from 'node:path';
+import { basename, delimiter, isAbsolute, join, relative, resolve, sep } from 'node:path';
 const SOURCE_DIR_NAMES = {
     claude: 'projects',
     codex: 'sessions',
@@ -100,7 +100,7 @@ function getGeminiBaseDir() {
         ? join(resolve(expandHome(geminiCliHome)), '.gemini')
         : join(homedir(), '.gemini');
 }
-function isSessionFileForSource(source, filePath, root) {
+export function isSessionFileForSource(source, filePath, root) {
     if (!isWithinRoot(filePath, root))
         return false;
     if (source === 'gemini') {
@@ -108,7 +108,17 @@ function isSessionFileForSource(source, filePath, root) {
             && basename(filePath).startsWith('session-')
             && /(?:^|\/)chats\//.test(filePath);
     }
-    return filePath.endsWith('.jsonl');
+    if (!filePath.endsWith('.jsonl'))
+        return false;
+    if (source === 'claude') {
+        // Claude sessions live at <root>/<slug>/<uuid>.jsonl — exactly two segments
+        // relative to root. Nested files (e.g. <slug>/<uuid>/subagents/agent-*.jsonl)
+        // are subagent scratchpads that share the parent's sessionId; indexing them
+        // clobbers the parent row via UNIQUE(session_uuid) and zeros message_count.
+        const rel = relative(root, filePath);
+        return rel.length > 0 && rel.split(sep).length === 2;
+    }
+    return true;
 }
 function isWithinRoot(filePath, root) {
     const resolvedFile = resolve(filePath);

package/dist/sync/source-paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"source-paths.js","sourceRoot":"","sources":["../../src/sync/source-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGpF,MAAM,gBAAgB,GAAqD;IACzE,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,UAAU;CAClB,CAAA;AAED,MAAM,eAAe,GAAkC;IACrD,MAAM,EAAE,kBAAkB;IAC1B,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,kBAAkB;CAC3B,CAAA;AAED,MAAM,oBAAoB,GAAqD;IAC7E,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,QAAQ;CAChB,CAAA;AAED,MAAM,oBAAoB,GAAqD;IAC7E,MAAM,EAAE,kBAAkB;IAC1B,KAAK,EAAE,iBAAiB;CACzB,CAAA;AAED,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAA;IACvD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACrG,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,WAAW,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACtF,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;IACtB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;IAClE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAA;IAE7D,IAAI,OAAO,GAAuC,EAAE,CAAA;IACpD,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAChE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,OAAO,WAAW,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,cAA+C;IAC7C,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC;IACjC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC;IAC/B,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC;CAClC;IAED,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAU,EAAE,CAAC;QAC5D,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,sBAAsB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACrF,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAqB,EACrB,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC;IAE/B,MAAM,OAAO,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAA;IAClE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;AACrD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK;SACT,KAAK,CAAC,OAAO,CAAC;SACd,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;SACtC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SACxB,MAAM,CAAC,OAAO,CAAC,CAAA;AACpB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAqB,EAAE,QAAgB;IAClE,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;IAClD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;QAC7C,CAAC;QACD,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAA;IAE5D,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;IAC/C,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAA;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAA;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACxE,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IAClC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAA;IAC5D,OAAO,aAAa;QAClB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC;QACrD,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAqB,EAAE,QAAgB,EAAE,IAAY;IACnF,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/C,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;eAC5B,QAAQ,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;eACzC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,IAAY;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACtC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IAChD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;AAClE,CAAC"}
+{"version":3,"file":"source-paths.js","sourceRoot":"","sources":["../../src/sync/source-paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAGzF,MAAM,gBAAgB,GAAqD;IACzE,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,UAAU;CAClB,CAAA;AAED,MAAM,eAAe,GAAkC;IACrD,MAAM,EAAE,kBAAkB;IAC1B,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,kBAAkB;CAC3B,CAAA;AAED,MAAM,oBAAoB,GAAqD;IAC7E,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,QAAQ;CAChB,CAAA;AAED,MAAM,oBAAoB,GAAqD;IAC7E,MAAM,EAAE,kBAAkB;IAC1B,KAAK,EAAE,iBAAiB;CACzB,CAAA;AAED,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAA;IACvD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACrG,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,WAAW,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACtF,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,EAAE,CAAA;IACtB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;IAClE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAA;IAE7D,IAAI,OAAO,GAAuC,EAAE,CAAA;IACpD,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAChE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,OAAO,WAAW,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,cAA+C;IAC7C,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC;IACjC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC;IAC/B,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC;CAClC;IAED,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAU,EAAE,CAAC;QAC5D,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,sBAAsB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACrF,OAAO,MAAM,CAAA;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAqB,EACrB,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC;IAE/B,MAAM,OAAO,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAA;IAClE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;AACrD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK;SACT,KAAK,CAAC,OAAO,CAAC;SACd,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;SACtC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SACxB,MAAM,CAAC,OAAO,CAAC,CAAA;AACpB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAqB,EAAE,QAAgB;IAClE,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;IAClD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;QAC7C,CAAC;QACD,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAA;IAE5D,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;IAC/C,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAA;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAA;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACxE,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IAClC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1E,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAA;IAC5D,OAAO,aAAa;QAClB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC;QACrD,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;AAChC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAqB,EAAE,QAAgB,EAAE,IAAY;IAC1F,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/C,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;eAC5B,QAAQ,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;eACzC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACvC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9C,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,4EAA4E;QAC5E,8EAA8E;QAC9E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACpC,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,IAAY;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACtC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IAChD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;AAClE,CAAC"}

package/dist/sync/syncer.d.ts

@@ -7,11 +7,18 @@ export interface SyncProgressEvent {
     total: number;
 }
 export type SyncEventCallback = (event: SyncProgressEvent) => void;
+/** Fired after `syncFile` commits a session's messages. Consumers
+ *  (the scan worker hookup in main process) invalidate the session's
+ *  scan_profile and re-enqueue it — necessary because offsets in
+ *  the findings table point into the now-mutated `messages.content_text`.
+ *  Receives the sessions.id, NOT the session_uuid. */
+export type SessionChangedCallback = (sessionId: number) => void;
 export declare class Syncer {
     private db;
     private onProgress;
+    private onSessionChanged;
     private codexTitleIndex;
-    constructor(db: Database.Database, onProgress?: SyncEventCallback);
+    constructor(db: Database.Database, onProgress?: SyncEventCallback, onSessionChanged?: SessionChangedCallback);
     syncAll(): SyncResult;
     private applyCodexTitles;
     syncFile(filePath: string, source: SessionSource, knownMtimes?: Map<string, string>, precomputedMtime?: string): 'added' | 'updated' | 'skipped' | 'error';

package/dist/sync/syncer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"syncer.d.ts","sourceRoot":"","sources":["../../src/sync/syncer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAI1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAYhD,OAAO,KAAK,EAAiB,UAAU,EAAE,MAAM,aAAa,CAAA;AAI5D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAA;IACnD,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAA;AAElE,qBAAa,MAAM;IACjB,OAAO,CAAC,EAAE,CAAmB;IAC7B,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,eAAe,CAAiC;gBAE5C,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,iBAAiB;IAKjE,OAAO,IAAI,UAAU;IAsFrB,OAAO,CAAC,gBAAgB;IAaxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO;CA8F3J"}
+{"version":3,"file":"syncer.d.ts","sourceRoot":"","sources":["../../src/sync/syncer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAI1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAYhD,OAAO,KAAK,EAAiB,UAAU,EAAE,MAAM,aAAa,CAAA;AAI5D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAA;IACnD,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAA;AAElE;;;;sDAIsD;AACtD,MAAM,MAAM,sBAAsB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAA;AAEhE,qBAAa,MAAM;IACjB,OAAO,CAAC,EAAE,CAAmB;IAC7B,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,gBAAgB,CAAoC;IAC5D,OAAO,CAAC,eAAe,CAAiC;gBAGtD,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,UAAU,CAAC,EAAE,iBAAiB,EAC9B,gBAAgB,CAAC,EAAE,sBAAsB;IAO3C,OAAO,IAAI,UAAU;IAsFrB,OAAO,CAAC,gBAAgB;IAaxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO;CA4G3J"}

package/dist/sync/syncer.js

@@ -4,17 +4,19 @@ import { homedir } from 'node:os';
 import { loadClaudeSession, decodeProjectSlug } from '../parsers/claude.js';
 import { loadCodexSession, CODEX_INDEX_VERSION } from '../parsers/codex.js';
 import { loadGeminiSession } from '../parsers/gemini.js';
-import { getSessionRoots } from './source-paths.js';
+import { getSessionRoots, isSessionFileForSource } from './source-paths.js';
 import { deleteSessionByFilePath, getSourceId, getOrCreateProject, getSessionMtime, getAllSessionMtimes, upsertSession, upsertSessionSearch, insertMessages, } from '../db/queries.js';
 import { computeIdentity } from '../projects/identity.js';
 import { realFs } from '../projects/fs.js';
 export class Syncer {
     db;
     onProgress;
+    onSessionChanged;
     codexTitleIndex = new Map();
-    constructor(db, onProgress) {
+    constructor(db, onProgress, onSessionChanged) {
         this.db = db;
         this.onProgress = onProgress;
+        this.onSessionChanged = onSessionChanged;
     }
     syncAll() {
         const seenPaths = new Set();
@@ -151,6 +153,7 @@ export class Syncer {
             const projectId = getOrCreateProject(this.db, sourceId, slug, identity.displayPath ?? displayPath, identity.displayName || displayName, { identityKind: identity.kind, identityKey: identity.key });
             const isNew = existingMtime === null;
             const hasToolUse = parsed.messages.some(m => m.toolNames.length > 0);
+            let committedSessionId = null;
             this.db.transaction(() => {
                 const sessionId = upsertSession(this.db, {
                     projectId,
@@ -173,11 +176,23 @@ export class Syncer {
                     userText: buildSessionSearchText(parsed.messages, 'user'),
                     assistantText: buildSessionSearchText(parsed.messages, 'assistant'),
                 });
+                // Security Scan cascade: messages.content_text changed, so any
+                // existing findings now have stale offsets. Drop scan_profile
+                // inside the same transaction so a crash between here and the
+                // worker re-enqueue still leaves the session in "needs scan".
+                this.db.prepare(`UPDATE sessions SET scan_profile = NULL, scan_completed_at = NULL WHERE id = ?`).run(sessionId);
                 this.db.prepare(`
           INSERT INTO sync_log (source_id, file_path, status)
           VALUES (?, ?, 'ok')
         `).run(sourceId, filePath);
+                committedSessionId = sessionId;
             })();
+            if (committedSessionId !== null && this.onSessionChanged) {
+                try {
+                    this.onSessionChanged(committedSessionId);
+                }
+                catch { /* swallow callback errors */ }
+            }
             return isNew ? 'added' : 'updated';
         }
         catch (err) {
@@ -220,10 +235,10 @@ function getIndexVersion(source) {
 }
 function collectSessionFiles(dir, source) {
     const results = [];
-    walkDir(dir, results, source);
+    walkDir(dir, dir, results, source);
     return results;
 }
-function walkDir(dir, results, source) {
+function walkDir(dir, root, results, source) {
     let entries;
     try {
         entries = readdirSync(dir, { withFileTypes: true, encoding: 'utf8' });
@@ -236,9 +251,14 @@ function walkDir(dir, results, source) {
         if (entry.isDirectory()) {
             if (source === 'gemini' && !shouldTraverseGeminiDir(dir, fullPath, entry.name))
                 continue;
-            walkDir(fullPath, results, source);
+            // For claude, session files only live at <root>/<slug>/<uuid>.jsonl. Anything
+            // deeper is subagent / future-nested scratch data that hijacks the parent
+            // sessionId — see isSessionFileForSource for the matching read-side check.
+            if (source === 'claude' && dirname(fullPath) !== root)
+                continue;
+            walkDir(fullPath, root, results, source);
         }
-        else if (entry.isFile() && isSessionFilePath(fullPath, source)) {
+        else if (entry.isFile() && isSessionFileForSource(source, fullPath, root)) {
             results.push({ path: fullPath, source });
         }
     }
@@ -252,14 +272,6 @@ function shouldTraverseGeminiDir(parentDir, fullPath, entryName) {
         return true;
     return existsSync(join(fullPath, 'chats'));
 }
-function isSessionFilePath(filePath, source) {
-    if (source === 'gemini') {
-        return filePath.endsWith('.json')
-            && basename(filePath).startsWith('session-')
-            && /(?:^|\/)chats\//.test(filePath);
-    }
-    return filePath.endsWith('.jsonl');
-}
 function loadCodexSessionIndex() {
     const titles = new Map();
     try {