@surething/cockpit 1.0.238 → 1.0.240

package/dist/{chunk-GFI4IHYM.mjs → chunk-44DBCDDK.mjs}

@@ -28785,10 +28785,10 @@ var LoggerLivePretty = Layer_exports.mergeAll(
   Logger_exports.minimumLogLevel(parseLevel(process.env.COCKPIT_LOG_LEVEL))
 );
 var appendLogFile = async (line, filePath) => {
-  const { appendFile, mkdir: mkdir2 } = await import("fs/promises");
+  const { appendFile, mkdir: mkdir3 } = await import("fs/promises");
   const { dirname } = await import("path");
   try {
-    await mkdir2(dirname(filePath), { recursive: true });
+    await mkdir3(dirname(filePath), { recursive: true });
     await appendFile(filePath, line + "\n", "utf-8");
   } catch {
   }
@@ -28999,6 +28999,15 @@ var noOpenConfig = Config_exports.boolean("COCKPIT_NO_OPEN").pipe(
 var logLevelConfig = Config_exports.string("COCKPIT_LOG_LEVEL").pipe(
   Config_exports.withDefault("info")
 );
+var snapshotKeepDaysConfig = Config_exports.integer("COCKPIT_SNAPSHOT_KEEP_DAYS").pipe(
+  Config_exports.withDefault(7)
+);
+var snapshotRepoTtlDaysConfig = Config_exports.integer(
+  "COCKPIT_SNAPSHOT_REPO_TTL_DAYS"
+).pipe(Config_exports.withDefault(30));
+var snapshotMaxFileKbConfig = Config_exports.integer(
+  "COCKPIT_SNAPSHOT_MAX_FILE_KB"
+).pipe(Config_exports.withDefault(2048));
 var CockpitConfig = Effect_exports.gen(
   function* () {
     const env = yield* envConfig;
@@ -29007,6 +29016,9 @@ var CockpitConfig = Effect_exports.gen(
     const openProject = yield* openProjectConfig;
     const noOpen = yield* noOpenConfig;
     const logLevel3 = yield* logLevelConfig;
+    const snapshotKeepDays = yield* snapshotKeepDaysConfig;
+    const snapshotRepoTtlDays = yield* snapshotRepoTtlDaysConfig;
+    const snapshotMaxFileKb = yield* snapshotMaxFileKbConfig;
     const cockpitDir = yield* Effect_exports.sync(() => {
       const env2 = typeof process !== "undefined" ? process.env : void 0;
       const home = env2?.HOME || env2?.USERPROFILE || ".";
@@ -29024,7 +29036,10 @@ var CockpitConfig = Effect_exports.gen(
       openProject,
       openBrowser: !noOpen,
       logLevel: logLevel3,
-      logFile
+      logFile,
+      snapshotKeepDays,
+      snapshotRepoTtlDays,
+      snapshotMaxFileKb
     };
   }
 ).pipe(Effect_exports.orDie);
@@ -29078,6 +29093,11 @@ var AgentService = Context_exports.GenericTag("@cockpit/AgentService");
 // packages/shared/effect-services/src/scheduler.ts
 var Scheduler = Context_exports.GenericTag("@cockpit/Scheduler");
 
+// packages/shared/effect-services/src/snapshot.ts
+var SnapshotService = Context_exports.GenericTag(
+  "@cockpit/SnapshotService"
+);
+
 // packages/feature/console/src/effect/pgLive.ts
 var { Pool } = pg;
 var handleAsync = (op, f) => Effect_exports.tryPromise({
@@ -29864,6 +29884,592 @@ var AgentServiceLive = Layer_exports.succeed(
   })
 );
 
+// packages/feature/agent/src/effect/snapshotLive.ts
+import { execFile } from "child_process";
+import { createHash } from "crypto";
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, readdir, rm, stat, rename } from "fs/promises";
+import { basename, join as join5, isAbsolute, relative } from "path";
+var BUILTIN_EXCLUDES = [
+  ".git/",
+  "node_modules/",
+  ".next/",
+  "dist/",
+  "build/",
+  "out/",
+  "coverage/",
+  ".turbo/",
+  ".cache/",
+  "__pycache__/",
+  ".venv/",
+  "venv/",
+  "target/",
+  "*.log",
+  ".DS_Store",
+  // Common secrets — must never be copied into the shadow repo, even for
+  // projects without a .gitignore (snapshots live outside the project dir
+  // and are retained for up to 30 days).
+  ".env",
+  ".env.*",
+  "*.pem",
+  "*.p12",
+  "id_rsa*",
+  "id_ed25519*"
+];
+var MAX_CHANGED_FILES = 5e4;
+var MAX_TOTAL_BYTES = 1024 * 1024 * 1024;
+var GUARD_BACKOFF_MS = 6 * 3600 * 1e3;
+var MAX_DIFF_CONTENT_BYTES = 500 * 1024;
+var MAX_DIFF_FILES = 200;
+var EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+var sanitizeName = (name) => name.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 32) || "project";
+var snapshotRepoDirName = (cwd, full = false) => {
+  const hex = createHash("sha256").update(cwd, "utf8").digest("hex");
+  return `${sanitizeName(basename(cwd))}-${full ? hex : hex.slice(0, 12)}`;
+};
+var localDay = (d) => {
+  const y = d.getFullYear();
+  const m = String(d.getMonth() + 1).padStart(2, "0");
+  const day = String(d.getDate()).padStart(2, "0");
+  return `${y}-${m}-${day}`;
+};
+var toRelative = (cwd, p) => {
+  if (!isAbsolute(p)) return p;
+  const rel = relative(cwd, p);
+  return rel && !rel.startsWith("..") ? rel : p;
+};
+var parseTrailers = (body) => {
+  const out = {};
+  for (const line of body.split("\n")) {
+    const m = /^Cockpit-([A-Za-z-]+):\s*(.*)$/.exec(line);
+    if (m) out[m[1]] = m[2];
+  }
+  return out;
+};
+var commitFromLogRecord = (record) => {
+  const [hash2, parents, ts, ...bodyParts] = record.split("");
+  if (!hash2) return null;
+  const body = bodyParts.join("");
+  const trailers = parseTrailers(body);
+  let toolFiles = [];
+  if (trailers["Tool-Files"]) {
+    try {
+      const parsed = JSON.parse(trailers["Tool-Files"]);
+      if (Array.isArray(parsed)) toolFiles = parsed.filter((x) => typeof x === "string");
+    } catch {
+      toolFiles = [];
+    }
+  }
+  return {
+    hash: hash2,
+    parent: parents ? parents.split(" ")[0] : null,
+    timestamp: Number(ts) || 0,
+    subject: body.split("\n")[0] ?? "",
+    sessionKey: trailers["Session"] ?? null,
+    toolId: trailers["Tool-Id"] ?? null,
+    toolName: trailers["Tool"] ?? null,
+    toolFiles,
+    provider: trailers["Provider"] ?? null,
+    baseline: trailers["Kind"] === "baseline"
+  };
+};
+var runGit = (repoDir, workTree, args2, input) => Effect_exports.tryPromise({
+  try: () => new Promise((resolve2) => {
+    const child = execFile(
+      "git",
+      args2,
+      {
+        env: {
+          ...process.env,
+          GIT_DIR: repoDir,
+          ...workTree ? { GIT_WORK_TREE: workTree } : {},
+          GIT_TERMINAL_PROMPT: "0",
+          // Error-message matching ("nothing to commit") relies on English output.
+          LC_ALL: "C",
+          // The shadow repo must not inherit the user's global index tweaks.
+          GIT_INDEX_FILE: join5(repoDir, "index")
+        },
+        cwd: workTree ?? repoDir,
+        maxBuffer: 64 * 1024 * 1024
+      },
+      (error, stdout, stderr) => {
+        const raw = error?.code;
+        const code = error ? typeof raw === "number" ? raw : 1 : 0;
+        resolve2({ code, stdout: String(stdout), stderr: String(stderr) });
+      }
+    );
+    if (input !== void 0) child.stdin?.end(input);
+  }),
+  catch: (cause3) => new AppError({ message: `git ${args2[0]} spawn failed`, cause: cause3 })
+});
+var runGitOk = (repoDir, workTree, args2, input) => runGit(repoDir, workTree, args2, input).pipe(
+  Effect_exports.filterOrFail(
+    (r) => r.code === 0,
+    (r) => new AppError({
+      message: `git ${args2.join(" ")} exited ${r.code}: ${r.stderr.slice(0, 400)}`
+    })
+  )
+);
+var gSem = globalThis;
+var semaphores = gSem.__cockpitSnapshotSemaphores ?? (gSem.__cockpitSnapshotSemaphores = /* @__PURE__ */ new Map());
+var withRepoLock = (repoDir, effect4) => {
+  let sem = semaphores.get(repoDir);
+  if (!sem) {
+    sem = Effect_exports.unsafeMakeSemaphore(1);
+    semaphores.set(repoDir, sem);
+  }
+  return sem.withPermits(1)(effect4);
+};
+var fsTry = (op, fn2) => Effect_exports.tryPromise({
+  try: fn2,
+  catch: (cause3) => new AppError({ message: `snapshot fs ${op} failed`, cause: cause3 })
+});
+var readMetaState = (repoDir) => Effect_exports.tryPromise({
+  try: async () => {
+    let raw;
+    try {
+      raw = await readFile2(join5(repoDir, "meta.json"), "utf8");
+    } catch {
+      return { state: "missing", meta: null };
+    }
+    try {
+      return { state: "ok", meta: JSON.parse(raw) };
+    } catch {
+      return { state: "corrupt", meta: null };
+    }
+  },
+  catch: () => new AppError({ message: "unreachable" })
+}).pipe(Effect_exports.orElseSucceed(() => ({ state: "missing", meta: null })));
+var readMeta = (repoDir) => readMetaState(repoDir).pipe(Effect_exports.map((s) => s.meta));
+var writeMeta = (repoDir, meta) => fsTry("write meta", async () => {
+  const tmp = join5(repoDir, "meta.json.tmp");
+  await writeFile2(tmp, JSON.stringify(meta, null, 2), "utf8");
+  await rename(tmp, join5(repoDir, "meta.json"));
+});
+var gPending = globalThis;
+var pendingRecords = gPending.__cockpitSnapshotPendingRecords ?? (gPending.__cockpitSnapshotPendingRecords = /* @__PURE__ */ new Map());
+var notePendingRecord = (cwd) => {
+  pendingRecords.set(cwd, (pendingRecords.get(cwd) ?? 0) + 1);
+};
+var settlePendingRecord = (cwd) => {
+  const n = (pendingRecords.get(cwd) ?? 1) - 1;
+  if (n <= 0) pendingRecords.delete(cwd);
+  else pendingRecords.set(cwd, n);
+};
+var pendingRecordCount = (cwd) => pendingRecords.get(cwd) ?? 0;
+var resolveRepoDir = (snapshotsRoot, cwd) => Effect_exports.gen(function* () {
+  const short = join5(snapshotsRoot, snapshotRepoDirName(cwd));
+  const meta = yield* readMeta(short);
+  if (meta && meta.cwd !== cwd) {
+    yield* Effect_exports.logWarning(
+      `snapshot repo hash collision: ${short} belongs to ${meta.cwd}; using full-hash dir for ${cwd}`
+    );
+    return join5(snapshotsRoot, snapshotRepoDirName(cwd, true));
+  }
+  return short;
+});
+var ensureRepo = (repoDir, cwd) => Effect_exports.gen(function* () {
+  const headExists = yield* fsTry(
+    "stat HEAD",
+    () => stat(join5(repoDir, "HEAD")).then(() => true)
+  ).pipe(Effect_exports.orElseSucceed(() => false));
+  if (headExists) return;
+  yield* fsTry("mkdir", () => mkdir2(repoDir, { recursive: true }));
+  yield* runGitOk(repoDir, null, ["init", "--quiet", "--bare", repoDir]);
+  const configs = [
+    ["core.bare", "false"],
+    ["core.logAllRefUpdates", "false"],
+    ["gc.auto", "0"],
+    ["user.name", "cockpit-snapshot"],
+    ["user.email", "snapshot@cockpit.local"],
+    ["commit.gpgsign", "false"]
+  ];
+  for (const [k, v] of configs) {
+    yield* runGitOk(repoDir, null, ["config", k, v]);
+  }
+  yield* fsTry(
+    "write exclude",
+    () => writeFile2(join5(repoDir, "info", "exclude"), BUILTIN_EXCLUDES.join("\n") + "\n", "utf8")
+  );
+  const now = Date.now();
+  yield* writeMeta(repoDir, { cwd, createdAt: now, lastSnapshotAt: now });
+});
+var ensureDayBranch = (repoDir, cwd, day) => Effect_exports.gen(function* () {
+  const branch = `refs/heads/snap/${day}`;
+  const exists5 = yield* runGit(repoDir, cwd, ["rev-parse", "--quiet", "--verify", branch]);
+  if (exists5.code !== 0) {
+    const branches = yield* runGitOk(repoDir, cwd, [
+      "for-each-ref",
+      "--sort=refname",
+      "--format=%(refname:short)",
+      "refs/heads/snap/"
+    ]);
+    const latest = branches.stdout.trim().split("\n").filter(Boolean).pop();
+    if (latest) {
+      const root = yield* runGitOk(repoDir, cwd, [
+        "commit-tree",
+        `${latest}^{tree}`,
+        "-m",
+        `baseline (rollover from ${latest})
+
+Cockpit-Kind: baseline`
+      ]);
+      yield* runGitOk(repoDir, cwd, ["branch", `snap/${day}`, root.stdout.trim()]);
+    }
+  }
+  yield* runGitOk(repoDir, cwd, ["symbolic-ref", "HEAD", branch]);
+});
+var sanitizeSubject = (s) => s.replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim().slice(0, 80);
+var buildCommitMessage = (trigger, relFiles, kind) => {
+  const detail = relFiles.length > 0 ? relFiles.length === 1 ? relFiles[0] : `${relFiles[0]} +${relFiles.length - 1}` : trigger.toolDetail ?? "";
+  const subject = kind === "baseline" ? "baseline" : sanitizeSubject(`[${trigger.toolName ?? "tool"}] ${detail}`);
+  const trailers = [
+    `Cockpit-Kind: ${kind}`,
+    `Cockpit-Session: ${trigger.sessionKey}`,
+    `Cockpit-Provider: ${trigger.provider}`,
+    ...trigger.toolId ? [`Cockpit-Tool-Id: ${trigger.toolId}`] : [],
+    ...trigger.toolName ? [`Cockpit-Tool: ${trigger.toolName}`] : [],
+    ...relFiles.length ? [`Cockpit-Tool-Files: ${JSON.stringify(relFiles)}`] : []
+  ];
+  return `${subject}
+
+${trailers.join("\n")}`;
+};
+var snapshotOnce = (snapshotsRoot, maxFileBytes, trigger, kind) => Effect_exports.gen(function* () {
+  const cwd = trigger.cwd;
+  const repoDir = yield* resolveRepoDir(snapshotsRoot, cwd);
+  const skip = { committed: false };
+  if (kind === "baseline" && pendingRecordCount(cwd) > 0) return skip;
+  const tripGuard = (reason) => Effect_exports.gen(function* () {
+    yield* Effect_exports.logWarning(`snapshot suspended for ${GUARD_BACKOFF_MS / 36e5}h: ${reason} \u2014 check .gitignore of ${cwd}`);
+    const meta = yield* readMeta(repoDir);
+    yield* writeMeta(repoDir, {
+      cwd,
+      createdAt: meta?.createdAt ?? Date.now(),
+      lastSnapshotAt: meta?.lastSnapshotAt ?? Date.now(),
+      guardTrippedAt: Date.now()
+    });
+    return skip;
+  });
+  const stageOnce = Effect_exports.gen(function* () {
+    const status3 = yield* runGitOk(repoDir, cwd, [
+      "status",
+      "--porcelain",
+      "-z",
+      "-uall",
+      "--no-renames"
+    ]);
+    const entries2 = status3.stdout.split("\0").filter(Boolean);
+    if (entries2.length === 0) return { staged: false };
+    if (entries2.length > MAX_CHANGED_FILES) {
+      yield* tripGuard(`${entries2.length} changed files exceeds ${MAX_CHANGED_FILES}`);
+      return { staged: false };
+    }
+    const changedPaths = entries2.map((e) => e.slice(3)).filter(Boolean);
+    const sizes = yield* Effect_exports.all(
+      changedPaths.map(
+        (p) => fsTry("stat", () => stat(join5(cwd, p)).then((s) => s.isFile() ? s.size : 0)).pipe(
+          // Deleted files fail the stat → size 0 (they must stay included).
+          Effect_exports.orElseSucceed(() => 0)
+        )
+      ),
+      { concurrency: 16 }
+    );
+    const included = [];
+    let totalBytes = 0;
+    for (let i = 0; i < changedPaths.length; i++) {
+      if (sizes[i] > maxFileBytes) continue;
+      included.push(changedPaths[i]);
+      totalBytes += sizes[i];
+    }
+    if (totalBytes > MAX_TOTAL_BYTES) {
+      yield* tripGuard(`${Math.round(totalBytes / 1048576)}MB of changes exceeds ${Math.round(MAX_TOTAL_BYTES / 1048576)}MB`);
+      return { staged: false };
+    }
+    if (included.length === 0) return { staged: false };
+    const pathspec = included.map((p) => `:(literal)${p}`).join("\0");
+    yield* runGitOk(
+      repoDir,
+      cwd,
+      ["add", "-A", "--pathspec-from-file=-", "--pathspec-file-nul"],
+      pathspec
+    );
+    return { staged: true };
+  });
+  return yield* withRepoLock(
+    repoDir,
+    Effect_exports.gen(function* () {
+      if (kind === "baseline" && pendingRecordCount(cwd) > 0) {
+        return skip;
+      }
+      yield* ensureRepo(repoDir, cwd);
+      const metaBefore = yield* readMeta(repoDir);
+      if (metaBefore?.guardTrippedAt && Date.now() - metaBefore.guardTrippedAt < GUARD_BACKOFF_MS) {
+        return skip;
+      }
+      yield* ensureDayBranch(repoDir, cwd, localDay(/* @__PURE__ */ new Date()));
+      const stage = yield* stageOnce.pipe(Effect_exports.retry({ times: 1 }));
+      if (!stage.staged) return skip;
+      const relFiles = (trigger.toolFiles ?? []).map((f) => toRelative(cwd, f));
+      const msg = buildCommitMessage(trigger, relFiles, kind);
+      const commit3 = yield* runGit(repoDir, cwd, ["commit", "--quiet", "--no-verify", "-m", msg]);
+      if (commit3.code !== 0) {
+        const benign = /nothing to commit|nothing added to commit/.test(commit3.stdout + commit3.stderr);
+        if (!benign) {
+          return yield* Effect_exports.fail(
+            new AppError({ message: `git commit failed: ${(commit3.stderr || commit3.stdout).slice(0, 400)}` })
+          );
+        }
+        return skip;
+      }
+      const head6 = yield* runGitOk(repoDir, cwd, ["rev-parse", "HEAD"]);
+      const meta = yield* readMeta(repoDir);
+      yield* writeMeta(repoDir, {
+        cwd,
+        createdAt: meta?.createdAt ?? Date.now(),
+        lastSnapshotAt: Date.now()
+      });
+      return { committed: true, hash: head6.stdout.trim() };
+    })
+  );
+}).pipe(
+  Effect_exports.withSpan("snapshot.record", {
+    attributes: { cwd: trigger.cwd, tool: trigger.toolName ?? kind }
+  })
+);
+var listByToolIdsImpl = (snapshotsRoot, cwd, toolIds) => Effect_exports.gen(function* () {
+  if (toolIds.length === 0) return [];
+  const repoDir = yield* resolveRepoDir(snapshotsRoot, cwd);
+  const headExists = yield* fsTry(
+    "stat HEAD",
+    () => stat(join5(repoDir, "HEAD")).then(() => true)
+  ).pipe(Effect_exports.orElseSucceed(() => false));
+  if (!headExists) return [];
+  const log3 = yield* runGit(repoDir, cwd, [
+    "log",
+    "--all",
+    "--date-order",
+    "--reverse",
+    "--format=%x1e%H%x1f%P%x1f%ct%x1f%B"
+  ]);
+  if (log3.code !== 0) return [];
+  const wanted = new Set(toolIds);
+  return log3.stdout.split("").filter(Boolean).map(commitFromLogRecord).filter((c) => !!c && !!c.toolId && wanted.has(c.toolId));
+}).pipe(Effect_exports.withSpan("snapshot.listByToolIds", { attributes: { cwd } }));
+var showFile = (repoDir, cwd, rev, path) => runGit(repoDir, cwd, ["show", `${rev}:${path}`]).pipe(
+  Effect_exports.map((r) => r.code === 0 ? r.stdout : null),
+  Effect_exports.orElseSucceed(() => null)
+);
+var diffImpl = (snapshotsRoot, cwd, commitHash) => Effect_exports.gen(function* () {
+  if (!/^[0-9a-f]{6,40}$/i.test(commitHash)) {
+    return yield* Effect_exports.fail(new ValidationError({ field: "commit", reason: "invalid commit hash" }));
+  }
+  const repoDir = yield* resolveRepoDir(snapshotsRoot, cwd);
+  const repoExists = yield* fsTry(
+    "stat HEAD",
+    () => stat(join5(repoDir, "HEAD")).then(() => true)
+  ).pipe(Effect_exports.orElseSucceed(() => false));
+  if (!repoExists) {
+    return yield* Effect_exports.fail(new NotFoundError({ resource: "snapshot-repo", id: cwd }));
+  }
+  const log3 = yield* runGitOk(repoDir, cwd, [
+    "log",
+    "-1",
+    "--format=%x1e%H%x1f%P%x1f%ct%x1f%B",
+    commitHash
+  ]);
+  const commit3 = commitFromLogRecord(log3.stdout.split("").filter(Boolean)[0] ?? "");
+  if (!commit3) {
+    return yield* Effect_exports.fail(new ValidationError({ field: "commit", reason: "commit not found" }));
+  }
+  const base = commit3.parent ?? EMPTY_TREE;
+  const nameStatus = yield* runGitOk(repoDir, cwd, [
+    "diff-tree",
+    "-r",
+    "-z",
+    "--no-renames",
+    "--name-status",
+    base,
+    commit3.hash
+  ]);
+  const numstat = yield* runGitOk(repoDir, cwd, [
+    "diff-tree",
+    "-r",
+    "-z",
+    "--no-renames",
+    "--numstat",
+    base,
+    commit3.hash
+  ]);
+  const binarySet = /* @__PURE__ */ new Set();
+  const lineStats = /* @__PURE__ */ new Map();
+  {
+    const parts2 = numstat.stdout.split("\0").filter(Boolean);
+    for (const row of parts2) {
+      const m = /^(\S+)\t(\S+)\t([^]*)$/.exec(row);
+      if (!m) continue;
+      if (m[1] === "-" || m[2] === "-") binarySet.add(m[3]);
+      else lineStats.set(m[3], { additions: Number(m[1]) || 0, deletions: Number(m[2]) || 0 });
+    }
+  }
+  const tokens = nameStatus.stdout.split("\0").filter(Boolean);
+  const files = [];
+  for (let i = 0; i + 1 < tokens.length && files.length < MAX_DIFF_FILES; i += 2) {
+    const st = tokens[i];
+    const path = tokens[i + 1];
+    const status3 = st === "A" ? "added" : st === "D" ? "deleted" : "modified";
+    const binary = binarySet.has(path);
+    let oldContent = null;
+    let newContent = null;
+    if (!binary) {
+      if (status3 !== "added") oldContent = yield* showFile(repoDir, cwd, base, path);
+      if (status3 !== "deleted") newContent = yield* showFile(repoDir, cwd, commit3.hash, path);
+      if ((oldContent?.length ?? 0) > MAX_DIFF_CONTENT_BYTES || (newContent?.length ?? 0) > MAX_DIFF_CONTENT_BYTES) {
+        oldContent = null;
+        newContent = null;
+      }
+    }
+    const stats = lineStats.get(path);
+    files.push({
+      path,
+      status: status3,
+      binary,
+      additions: stats?.additions ?? 0,
+      deletions: stats?.deletions ?? 0,
+      oldContent,
+      newContent
+    });
+  }
+  const truncated = tokens.length / 2 > files.length;
+  return { commit: commit3, files, truncated };
+}).pipe(Effect_exports.withSpan("snapshot.diff", { attributes: { cwd, commit: commitHash } }));
+var cleanupImpl = (snapshotsRoot, keepDays, repoTtlDays) => Effect_exports.gen(function* () {
+  const dirs = yield* fsTry("readdir", () => readdir(snapshotsRoot)).pipe(
+    Effect_exports.orElseSucceed(() => [])
+  );
+  const now = Date.now();
+  const dayCutoff = localDay(new Date(now - (keepDays - 1) * 24 * 3600 * 1e3));
+  const isStale = (repoDir) => Effect_exports.gen(function* () {
+    const { state, meta } = yield* readMetaState(repoDir);
+    if (state === "corrupt") return "corrupt";
+    if (state === "missing") {
+      const mtime = yield* fsTry("stat dir", () => stat(repoDir).then((s) => s.mtimeMs)).pipe(
+        Effect_exports.orElseSucceed(() => now)
+      );
+      return mtime < now - repoTtlDays * 24 * 3600 * 1e3 ? "stale" : "keep";
+    }
+    const m = meta;
+    const cwdGone = !(yield* fsTry(
+      "stat cwd",
+      () => stat(m.cwd).then((s) => s.isDirectory())
+    ).pipe(Effect_exports.orElseSucceed(() => false)));
+    return m.lastSnapshotAt < now - repoTtlDays * 24 * 3600 * 1e3 || cwdGone ? "stale" : "keep";
+  });
+  const headExists = (repoDir) => fsTry("stat HEAD", () => stat(join5(repoDir, "HEAD")).then(() => true)).pipe(
+    Effect_exports.orElseSucceed(() => false)
+  );
+  for (const name of dirs) {
+    const repoDir = join5(snapshotsRoot, name);
+    const isDir = yield* fsTry("stat dir", () => stat(repoDir).then((s) => s.isDirectory())).pipe(
+      Effect_exports.orElseSucceed(() => false)
+    );
+    if (!isDir) continue;
+    if (!(yield* headExists(repoDir))) {
+      yield* withRepoLock(
+        repoDir,
+        Effect_exports.gen(function* () {
+          if (yield* headExists(repoDir)) return;
+          yield* Effect_exports.logInfo(`snapshot cleanup: removing debris dir ${name}`);
+          yield* fsTry("rm debris", () => rm(repoDir, { recursive: true, force: true })).pipe(
+            Effect_exports.orElseSucceed(() => void 0)
+          );
+        })
+      );
+      continue;
+    }
+    const verdict = yield* isStale(repoDir);
+    if (verdict === "corrupt") {
+      yield* Effect_exports.logWarning(
+        `snapshot cleanup: ${name} has an unreadable meta.json \u2014 keeping repo (refusing to delete on corrupt metadata)`
+      );
+      continue;
+    }
+    if (verdict === "stale") {
+      yield* withRepoLock(
+        repoDir,
+        Effect_exports.gen(function* () {
+          if ((yield* isStale(repoDir)) !== "stale") return;
+          yield* Effect_exports.logInfo(`snapshot cleanup: removing repo ${name} (stale or cwd gone)`);
+          yield* fsTry("rm repo", () => rm(repoDir, { recursive: true, force: true })).pipe(
+            Effect_exports.orElseSucceed(() => void 0)
+          );
+        })
+      );
+      continue;
+    }
+    const branches = yield* runGit(repoDir, null, [
+      "for-each-ref",
+      "--format=%(refname:short)",
+      "refs/heads/snap/"
+    ]).pipe(Effect_exports.map((r) => r.code === 0 ? r.stdout.trim().split("\n").filter(Boolean) : []));
+    const expired = branches.filter((b) => {
+      const day = b.slice("snap/".length);
+      return /^\d{4}-\d{2}-\d{2}$/.test(day) && day < dayCutoff;
+    });
+    if (expired.length > 0) {
+      const dropped = yield* withRepoLock(
+        repoDir,
+        Effect_exports.gen(function* () {
+          yield* runGitOk(repoDir, null, [
+            "symbolic-ref",
+            "HEAD",
+            `refs/heads/snap/${localDay(/* @__PURE__ */ new Date())}`
+          ]);
+          let ok = 0;
+          for (const b of expired) {
+            const r = yield* runGit(repoDir, null, ["branch", "-D", b]);
+            if (r.code === 0) ok++;
+            else {
+              yield* Effect_exports.logWarning(
+                `snapshot cleanup: failed to delete ${b} in ${name}: ${r.stderr.slice(0, 200)}`
+              );
+            }
+          }
+          if (ok > 0) {
+            yield* runGit(repoDir, null, ["reflog", "expire", "--expire=now", "--all"]);
+            yield* runGit(repoDir, null, ["gc", "--prune=now", "--quiet"]);
+          }
+          return ok;
+        })
+      );
+      yield* Effect_exports.logInfo(
+        `snapshot cleanup: ${name} dropped ${dropped}/${expired.length} day branch(es) older than ${dayCutoff}`
+      );
+    }
+  }
+}).pipe(Effect_exports.withSpan("snapshot.cleanup"));
+var SnapshotServiceLive = Layer_exports.scoped(
+  SnapshotService,
+  Effect_exports.gen(function* () {
+    const cfg = yield* CockpitConfig;
+    const snapshotsRoot = join5(cfg.cockpitDir, "snapshots");
+    const maxFileBytes = cfg.snapshotMaxFileKb * 1024;
+    const cleanup = cleanupImpl(snapshotsRoot, cfg.snapshotKeepDays, cfg.snapshotRepoTtlDays);
+    yield* Effect_exports.forkScoped(
+      cleanup.pipe(
+        Effect_exports.catchAll((e) => Effect_exports.logWarning(`snapshot cleanup failed: ${e.message}`)),
+        Effect_exports.repeat(Schedule_exports.spaced("24 hours"))
+      )
+    );
+    return SnapshotService.of({
+      record: (trigger) => snapshotOnce(snapshotsRoot, maxFileBytes, trigger, "tool"),
+      baseline: (cwd, sessionKey, provider) => snapshotOnce(snapshotsRoot, maxFileBytes, { cwd, sessionKey, provider }, "baseline"),
+      listByToolIds: (cwd, toolIds) => listByToolIdsImpl(snapshotsRoot, cwd, toolIds),
+      diff: (cwd, commitHash) => diffImpl(snapshotsRoot, cwd, commitHash),
+      cleanup
+    });
+  })
+);
+
 // packages/shared/effect-runtime/src/server/runtime.ts
 var isDev = process.env.COCKPIT_ENV === "dev";
 var ServerBaseLayer = Layer_exports.unwrapEffect(
@@ -29885,7 +30491,9 @@ var AppLayer = Layer_exports.mergeAll(
   // Scheduler
   SchedulerLive,
   // Agent
-  AgentServiceLive
+  AgentServiceLive,
+  // Tool-call snapshots (shadow git)
+  SnapshotServiceLive
 );
 var AppRuntime = ManagedRuntime_exports.make(AppLayer);
 
@@ -29905,6 +30513,7 @@ export {
   ValidationError,
   NotFoundError,
   errorToStatus,
+  SnapshotService,
   createNeo4jDriver,
   runCypherWithDriver,
   serializeValue,
@@ -29934,5 +30543,7 @@ export {
   withFileLock,
   mutateJsonFile,
   createOllamaModel,
+  notePendingRecord,
+  settlePendingRecord,
   AppRuntime
 };