@swestash/agent-lens 0.9.2 → 0.9.4

package/dist/agent-lens.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname7, join as join13 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname7, join as join11 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // ../../node_modules/.pnpm/cac@6.7.14/node_modules/cac/dist/index.mjs
@@ -971,10 +971,13 @@ var SECURITY_CATEGORIES = [
 ];
 
 // ../core/dist/secrets.js
+var EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/;
+var IPV4 = /\b\d{1,3}(?:\.\d{1,3}){3}\b/;
+var HOME_PATH_WITH_USER = /\/(?:home|Users)\/(?!user\b)[A-Za-z0-9._-]+/;
 var LEAK_PATTERNS = [
-  { name: "email", re: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/ },
-  { name: "home-path-with-user", re: /\/(?:home|Users)\/(?!user\b)[A-Za-z0-9._-]+/ },
-  { name: "ipv4", re: /\b\d{1,3}(?:\.\d{1,3}){3}\b/ },
+  { name: "email", re: EMAIL },
+  { name: "home-path-with-user", re: HOME_PATH_WITH_USER },
+  { name: "ipv4", re: IPV4 },
   { name: "url", re: /https?:\/\/[^\s"']+/ },
   { name: "aws-key", re: /AKIA[0-9A-Z]{16}/ },
   { name: "bearer/token", re: /\b(?:sk|pk|ghp|gho|xox[abp])[-_][A-Za-z0-9]{8,}/ }
@@ -1002,8 +1005,8 @@ function maskEnvAssignments(text) {
   return text.replace(ENV_ASSIGN, (_m, name, q) => `${name}=${q}[REDACTED]`);
 }
 var PII_PATTERNS = [
-  { re: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, label: "EMAIL" },
-  { re: /\b\d{1,3}(?:\.\d{1,3}){3}\b/g, label: "IP" }
+  { re: new RegExp(EMAIL.source, "g"), label: "EMAIL" },
+  { re: new RegExp(IPV4.source, "g"), label: "IP" }
 ];
 var HOME_USER = /\/(home|Users)\/[^/\s"'`]+/g;
 var ENCODED_HOME_USER = /(?<![A-Za-z0-9])(-(?:home|Users)-)[A-Za-z0-9._]+(?=-)/g;
@@ -1022,8 +1025,8 @@ function maskSecrets(text) {
 }
 var SHARE_LEAK = [
   ...SECRET_PATTERNS.map(({ re, label }) => ({ name: label, re: new RegExp(re.source) })),
-  { name: "email", re: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/ },
-  { name: "home-path-with-user", re: /\/(?:home|Users)\/(?!user\b)[A-Za-z0-9._-]+/ },
+  { name: "email", re: EMAIL },
+  { name: "home-path-with-user", re: HOME_PATH_WITH_USER },
   { name: "encoded-home-with-user", re: /(?<![A-Za-z0-9])-(?:home|Users)-(?!user-)[A-Za-z0-9._]+-/ },
   { name: "url-credentials", re: /:\/\/[^/\s:@"'`]+:[^/\s@"'`]+@/ }
 ];
@@ -1076,7 +1079,7 @@ function scrubUsernames(text, users) {
 import { createHash } from "crypto";
 
 // ../core/dist/markdown.js
-function fence(s) {
+function truncate(s) {
   return s.length > 2e3 ? s.slice(0, 2e3) + "\n\u2026 (truncated)" : s;
 }
 function sessionToMarkdown(s, events) {
@@ -1102,14 +1105,14 @@ function sessionToMarkdown(s, events) {
     if (e.thinking) {
       out.push(`### \u{1F9E0} thinking${ts}`);
       out.push("");
-      out.push(fence(e.thinking));
+      out.push(truncate(e.thinking));
       out.push("");
     }
     if (e.text) {
       const icon = who === "user" ? "\u{1F464}" : who === "assistant" ? "\u{1F916}" : "\u2699\uFE0F";
       out.push(`### ${icon} ${who}${ts}`);
       out.push("");
-      out.push(fence(e.text));
+      out.push(truncate(e.text));
       out.push("");
     }
     for (const tc of e.toolCalls) {
@@ -1118,7 +1121,7 @@ function sessionToMarkdown(s, events) {
       out.push(`> \u{1F527} **${label}**${status}`);
       if (tc.input_json && tc.input_json !== "{}") {
         out.push("```json");
-        out.push(fence(tc.input_json));
+        out.push(truncate(tc.input_json));
         out.push("```");
       }
       out.push("");
@@ -1217,25 +1220,25 @@ function errorKind(type) {
 }
 var PATTERNS = [
   // — Rejections / blocks: is_error, but the agent's tool didn't fail — a human or guardrail stopped it.
-  { re: /interrupted by user|tool use was rejected|does(?:n['’]| not)t want to proceed|\bCancelled:/i, type: "user-rejected", kind: "rejection" },
-  { re: /\bBlocked:/i, type: "guardrail-blocked", kind: "rejection" },
+  { re: /interrupted by user|tool use was rejected|does(?:n['’]| not)t want to proceed|\bCancelled:/i, type: "user-rejected" },
+  { re: /\bBlocked:/i, type: "guardrail-blocked" },
   // — Real tool failures.
-  { re: /String to replace not found/i, type: "string-not-found", kind: "failure" },
-  { re: /exceeds maximum allowed tokens/i, type: "token-limit", kind: "failure" },
+  { re: /String to replace not found/i, type: "string-not-found" },
+  { re: /exceeds maximum allowed tokens/i, type: "token-limit" },
   // A non-zero Bash exit code is a command failure regardless of what its stderr text mentions — check
   // it before the file-state fs-error patterns, since ENOENT/EISDIR also appear inside command stderr
   // (e.g. `Exit code 2 npm error ENOENT`). The file-state patterns then catch the Read/Write/Edit
   // tool_use_errors, which carry no exit code.
-  { re: /\bExit code\b/i, type: "command-failed", kind: "failure" },
-  { re: /has not been read yet|modified since (?:you |it was )?read|File (?:content )?does not exist|\bEISDIR\b|\bENOENT\b/i, type: "file-state", kind: "failure" }
+  { re: /\bExit code\b/i, type: "command-failed" },
+  { re: /has not been read yet|modified since (?:you |it was )?read|File (?:content )?does not exist|\bEISDIR\b|\bENOENT\b/i, type: "file-state" }
 ];
 function classifyToolError(resultSummary) {
   const s = resultSummary ?? "";
   for (const p of PATTERNS) {
     if (p.re.test(s))
-      return { type: p.type, kind: p.kind };
+      return { type: p.type, kind: errorKind(p.type) };
   }
-  return { type: "other", kind: "failure" };
+  return { type: "other", kind: errorKind("other") };
 }
 
 // ../core/dist/pricing.js
@@ -1694,7 +1697,7 @@ function collectAll(opts = {}) {
   const archiveBase = opts.archiveBase ?? resolveArchiveDir();
   const sources = opts.sources ?? loadSources();
   const excludedDirs = (opts.excludes ?? loadExcludes()).map(encodeProjectPath);
-  const runTs = opts.runTimestamp ?? collectTimestamp();
+  const runTs = collectTimestamp();
   ensureDir(archiveBase);
   const stats = { sources: 0, scanned: 0, copied: 0, appended: 0, diverged: 0, compacted: 0, snapshots: 0 };
   if (!sources.length)
@@ -2034,10 +2037,10 @@ function windowsUninstall(targets) {
 }
 function windowsStatus(targets) {
   if (targets.includes("collector")) {
-    sh("schtasks", ["/Query", "/FO", "LIST", "/TN", WINDOWS_COLLECTOR_PREFIX], true) || console.log("agent-lens service: no collector tasks found under " + WINDOWS_COLLECTOR_PREFIX);
+    sh("schtasks", ["/Query", "/FO", "LIST", "/TN", WINDOWS_COLLECTOR_PREFIX], false) || console.log("agent-lens service: no collector tasks found under " + WINDOWS_COLLECTOR_PREFIX);
   }
   if (targets.includes("server")) {
-    sh("schtasks", ["/Query", "/FO", "LIST", "/TN", WINDOWS_SERVER_TASK], true) || console.log("agent-lens service: no server task found (" + WINDOWS_SERVER_TASK + ")");
+    sh("schtasks", ["/Query", "/FO", "LIST", "/TN", WINDOWS_SERVER_TASK], false) || console.log("agent-lens service: no server task found (" + WINDOWS_SERVER_TASK + ")");
   }
 }
 function runService(action, params) {
@@ -2077,8 +2080,8 @@ function runService(action, params) {
 }
 
 // ../ingest/dist/run.js
-import { readFileSync as readFileSync7, statSync as statSync5, mkdirSync as mkdirSync4, existsSync as existsSync5 } from "fs";
-import { dirname as dirname5, join as join10 } from "path";
+import { readFileSync as readFileSync5, statSync as statSync3, mkdirSync as mkdirSync4, existsSync as existsSync5 } from "fs";
+import { dirname as dirname5, join as join8 } from "path";
 
 // ../ingest/dist/db.js
 import Database from "better-sqlite3";
@@ -2391,8 +2394,37 @@ var ClaudeCodeAdapter = class {
   }
 };
 
+// ../ingest/dist/dirtyset.js
+function createDirtySet(db, name, ids) {
+  db.exec(`DROP TABLE IF EXISTS ${name}`);
+  db.exec(`CREATE TEMP TABLE ${name} (id TEXT PRIMARY KEY)`);
+  const ins = db.prepare(`INSERT OR IGNORE INTO ${name} (id) VALUES (?)`);
+  db.transaction((xs) => {
+    for (const id of xs)
+      ins.run(id);
+  })(ids);
+}
+
+// ../ingest/dist/storedjson.js
+var malformed = 0;
+var reported = /* @__PURE__ */ new Set();
+function parseStored(json, where) {
+  if (!json)
+    return null;
+  try {
+    return JSON.parse(json);
+  } catch {
+    malformed++;
+    if (!reported.has(where)) {
+      reported.add(where);
+      console.warn(`agent-lens: malformed stored JSON in ${where} \u2014 the affected rows are skipped; re-ingest with --full to rebuild`);
+    }
+    return null;
+  }
+}
+
 // ../ingest/dist/classify.js
-var CLASSIFIER_VERSION = 2;
+var CLASSIFIER_VERSION = 3;
 var CATEGORIES = ["bugfix", "refactor", "docs", "ops", "review", "feature", "chore"];
 var BANDS = [
   { max: 22, band: "trivial" },
@@ -2408,7 +2440,7 @@ function categoryForSubagentRole(role) {
   return REVIEW_SUBAGENT_ROLES.has(role) ? "review" : null;
 }
 function countLines(s) {
-  if (!s)
+  if (typeof s !== "string" || s.length === 0)
     return 0;
   const trimmed = s.endsWith("\n") ? s.slice(0, -1) : s;
   return trimmed.length === 0 ? 0 : trimmed.split("\n").length;
@@ -2418,12 +2450,9 @@ var OPS_FILE = /(^|\/)(dockerfile|docker-compose|\.github\/|\.gitlab-ci|makefile
 function locDelta(toolName, inputJson) {
   if (!inputJson)
     return { added: 0, removed: 0, file: null };
-  let input;
-  try {
-    input = JSON.parse(inputJson);
-  } catch {
+  const input = parseStored(inputJson, "classify: tool_calls.input_json");
+  if (!input)
     return { added: 0, removed: 0, file: null };
-  }
   const file = typeof input?.file_path === "string" ? input.file_path : null;
   if (toolName === "Write")
     return { added: countLines(input?.content), removed: 0, file };
@@ -2438,18 +2467,27 @@ function band(score) {
   return "xl";
 }
 var clamp01 = (x) => x < 0 ? 0 : x > 1 ? 1 : x;
+var WORD_RE = /* @__PURE__ */ new Map();
+function wordRe(phrase) {
+  let re = WORD_RE.get(phrase);
+  if (!re) {
+    const escaped = phrase.trim().replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    re = new RegExp(`\\b${escaped}\\b`, "g");
+    WORD_RE.set(phrase, re);
+  }
+  return re;
+}
 function hits(text, words) {
   let n = 0;
   for (const w of words) {
-    let i = text.indexOf(w);
-    while (i !== -1) {
+    const re = wordRe(w);
+    re.lastIndex = 0;
+    while (re.exec(text) !== null)
       n++;
-      i = text.indexOf(w, i + w.length);
-    }
   }
   return n;
 }
-function scoreCategories(s, text) {
+function scoreCategories(s, text, files) {
   const t = text.toLowerCase();
   const editN = s.toolCounts["Edit"] ?? 0;
   const writeN = s.toolCounts["Write"] ?? 0;
@@ -2467,11 +2505,11 @@ function scoreCategories(s, text) {
   scores.bugfix += hits(t, ["bug", "fix", "broken", "crash", "regression", "traceback", "stack trace", "failing", "error", "exception", "not working"]) * 1;
   scores.refactor += hits(t, ["refactor", "clean up", "cleanup", "rename", "extract", "simplify", "dead code", "tidy", "reorganize", "restructure"]) * 1;
   scores.docs += hits(t, ["readme", "document", "documentation", "changelog", "docstring", "comment", "write docs", "usage guide"]) * 1;
-  scores.ops += hits(t, ["deploy", "docker", "pipeline", "ci/cd", "ci ", "systemd", "infra", "kubernetes", "terraform", "release", "rollback", "container"]) * 1;
+  scores.ops += hits(t, ["deploy", "docker", "pipeline", "ci/cd", "ci", "systemd", "infra", "kubernetes", "terraform", "release", "rollback", "container"]) * 1;
   scores.review += hits(t, ["review", "audit", "inspect", "look over", "feedback on"]) * 1;
-  scores.feature += hits(t, ["add ", "implement", "build ", "create ", "feature", "support for", "new feature"]) * 0.8;
-  const docFiles = s.loc.files > 0 ? countMatch(s, DOC_EXT) : 0;
-  const opsFiles = s.loc.files > 0 ? countMatch(s, OPS_FILE) : 0;
+  scores.feature += hits(t, ["add", "implement", "build", "create", "feature", "support for", "new feature"]) * 0.8;
+  const docFiles = s.loc.files > 0 ? countMatch(files, DOC_EXT) : 0;
+  const opsFiles = s.loc.files > 0 ? countMatch(files, OPS_FILE) : 0;
   if (s.loc.files > 0) {
     scores.docs += 3 * (docFiles / s.loc.files);
     scores.ops += 3 * (opsFiles / s.loc.files);
@@ -2489,8 +2527,7 @@ function scoreCategories(s, text) {
     scores[writes > 0 ? "feature" : "chore"] += 0.01;
   return scores;
 }
-function countMatch(s, re) {
-  const files = s._files ?? [];
+function countMatch(files, re) {
   let n = 0;
   for (const f of files)
     if (re.test(f))
@@ -2514,15 +2551,8 @@ function complexity(s) {
 }
 function classify(db, dirty) {
   const incremental = dirty != null;
-  if (incremental) {
-    db.exec("DROP TABLE IF EXISTS _dirty");
-    db.exec("CREATE TEMP TABLE _dirty (id TEXT PRIMARY KEY)");
-    const ins = db.prepare("INSERT OR IGNORE INTO _dirty (id) VALUES (?)");
-    db.transaction((ids) => {
-      for (const id of ids)
-        ins.run(id);
-    })(dirty);
-  }
+  if (dirty != null)
+    createDirtySet(db, "_dirty", dirty);
   const wSess = incremental ? " WHERE session_id IN (SELECT id FROM _dirty)" : "";
   const aSess = incremental ? " AND session_id IN (SELECT id FROM _dirty)" : "";
   const sessions = db.prepare(`SELECT id, is_sidechain, turn_count, event_count, duration_ms FROM sessions${incremental ? " WHERE id IN (SELECT id FROM _dirty)" : ""}`).all();
@@ -2587,10 +2617,9 @@ function classify(db, dirty) {
         cache_read_tokens: tok.cacheRead,
         duration_ms: sess.duration_ms ?? 0,
         subagent_count: subagentCount,
-        is_sidechain: sess.is_sidechain,
-        _files: filesArr
+        is_sidechain: sess.is_sidechain
       };
-      const catScores = scoreCategories(signals, promptText.get(sess.id) ?? "");
+      const catScores = scoreCategories(signals, promptText.get(sess.id) ?? "", filesArr);
       let category = "chore";
       let bestScore = -1;
       for (const c of CATEGORIES) {
@@ -2670,9 +2699,12 @@ var SQL_CLIENT = /\b(psql|pgcli|mysql|mysqladmin|mariadb|sqlite3?|sqlcmd|usql|mo
 var stripComments = (c) => c.replace(/(^|\s)#[^\n]*/g, "$1");
 var neutralizeEcho = (c) => c.replace(/((?:^|[;&|\n(])\s*)(?:echo|printf)\b(?:"(?:[^"\\]|\\.)*"|'[^']*'|[^;&|\n])*/gi, "$1echo");
 var blankHeredoc = (c) => c.replace(/<<-?\s*(['"]?)(\w+)\1[\s\S]*?\n\s*\2\b/g, "<<HEREDOC");
-var codeOf = (c) => neutralizeEcho(stripComments(blankHeredoc(c)));
 var blankQuoted = (c) => c.replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'[^']*'/g, "''");
-var bareOf = (c) => blankQuoted(codeOf(c));
+var codeOf = (c) => neutralizeEcho(stripComments(blankHeredoc(c)));
+function commandViews(raw) {
+  const code = codeOf(raw);
+  return { code, bare: blankQuoted(code) };
+}
 function execGeneratedScript(cmd) {
   const targets = /* @__PURE__ */ new Set();
   for (const m of cmd.matchAll(/(?:>>?|\btee\b\s+(?:-a\s+)?)\s*["']?([A-Za-z0-9._/~-]+)/g)) {
@@ -2741,6 +2773,19 @@ function netTargetScope(rawCommand) {
   }
   return scope;
 }
+function simpleCommandRule(spec) {
+  const { match, tools = ["Bash"], ...meta } = spec;
+  return {
+    ...meta,
+    tools,
+    test(ctx) {
+      const c = ctx.commandBare;
+      if (!c || !match.test(c))
+        return null;
+      return { evidence: evidence(ctx.command) };
+    }
+  };
+}
 var RULES = [
   // --- Destructive / data-loss (OWASP ASI02 Tool Misuse) -------------------
   {
@@ -2769,21 +2814,15 @@ var RULES = [
       return { evidence: evidence(ctx.command), severity, mods: { dangerous_target: dangerousTarget, temp_target: tempOnly } };
     }
   },
-  {
+  simpleCommandRule({
     id: "destructive.git_reset_hard",
     category: "destructive",
     framework_ref: "OWASP ASI02",
     title: "Discards local changes (git reset --hard)",
-    tools: ["Bash"],
     baseSeverity: "low",
     // routine dev op — only uncommitted working-tree changes are lost; commits survive in reflog
-    test(ctx) {
-      const c = ctx.commandBare;
-      if (!c || !/\bgit\s+reset\s+--hard\b/i.test(c))
-        return null;
-      return { evidence: evidence(ctx.command) };
-    }
-  },
+    match: /\bgit\s+reset\s+--hard\b/i
+  }),
   {
     id: "destructive.git_force_push",
     category: "destructive",
@@ -2817,20 +2856,14 @@ var RULES = [
       return null;
     }
   },
-  {
+  simpleCommandRule({
     id: "destructive.disk_wipe",
     category: "destructive",
     framework_ref: "OWASP ASI02",
     title: "Low-level disk write / wipe (dd, mkfs, shred)",
-    tools: ["Bash"],
     baseSeverity: "high",
-    test(ctx) {
-      const c = ctx.commandBare;
-      if (!c || !/(\bdd\s+if=|\bmkfs(\.\w+)?\b|\bshred\b)/i.test(c))
-        return null;
-      return { evidence: evidence(ctx.command) };
-    }
-  },
+    match: /(\bdd\s+if=|\bmkfs(\.\w+)?\b|\bshred\b)/i
+  }),
   {
     id: "destructive.overwrite_critical",
     category: "destructive",
@@ -2905,7 +2938,7 @@ var RULES = [
         return null;
       if (!/(\||<)\s*(sudo\s+)?(curl|wget|nc|ncat|netcat|ssh|scp)\b/i.test(c))
         return null;
-      if (!/\b(cat|tar|zip|gzip|base64|env|printenv|cat\s|<)\b/i.test(c))
+      if (!/(?:\b(?:cat|tar|zip|gzip|base64|env|printenv)\b|<)/i.test(c))
         return null;
       return { evidence: evidence(ctx.command) };
     }
@@ -2940,37 +2973,24 @@ var RULES = [
       };
     }
   },
-  {
+  simpleCommandRule({
     id: "exfil.reverse_shell",
     category: "exfiltration",
     framework_ref: "MITRE ATLAS AML.T0086",
     title: "Netcat / reverse-shell style connection",
-    tools: ["Bash"],
     baseSeverity: "critical",
-    test(ctx) {
-      const c = ctx.commandBare;
-      if (!c)
-        return null;
-      if (!/\b(nc|ncat|netcat)\b[^|;&\n]*(-e\b|-c\b|\d{2,5})|\/dev\/tcp\/|bash\s+-i\b/i.test(c))
-        return null;
-      return { evidence: evidence(ctx.command) };
-    }
-  },
+    match: /\b(nc|ncat|netcat)\b[^|;&\n]*(-e\b|-c\b|\d{2,5})|\/dev\/tcp\/|bash\s+-i\b/i
+  }),
   // --- Privilege escalation / guardrail bypass (OWASP LLM06 Excessive Agency)
-  {
+  simpleCommandRule({
     id: "privilege.skip_permissions",
     category: "privilege-bypass",
     framework_ref: "OWASP LLM06",
     title: "Bypasses the permission guardrail",
     tools: "*",
     baseSeverity: "high",
-    test(ctx) {
-      const c = ctx.commandBare;
-      if (!c || !/--dangerously-skip-permissions\b|--yolo\b|--dangerously-skip\b/i.test(c))
-        return null;
-      return { evidence: evidence(ctx.command) };
-    }
-  },
+    match: /--dangerously-skip-permissions\b|--yolo\b|--dangerously-skip\b/i
+  }),
   {
     id: "privilege.curl_pipe_shell",
     category: "privilege-bypass",
@@ -3020,21 +3040,17 @@ var RULES = [
       return { evidence: evidence(ctx.command), severity: sudo ? "critical" : "high", mods: { decoder: decoderName, interpreter: interp } };
     }
   },
-  {
+  simpleCommandRule({
     id: "privilege.sudo",
     category: "privilege-bypass",
     framework_ref: "OWASP LLM06",
     title: "Runs a command as root (sudo)",
-    tools: ["Bash"],
     baseSeverity: "high",
     // root escalation removes a real safety barrier — higher than an in-project op
-    test(ctx) {
-      const c = ctx.commandBare;
-      if (!c || !/(?:^|[\n;|&(])\s*sudo\b/i.test(c))
-        return null;
-      return { evidence: evidence(ctx.command) };
-    }
-  },
+    // sudo must be in *command position* — start of the command or right after a separator (; | && ( ).
+    // This ignores `sudo` as an argument (e.g. `apt install sudo`) and, via codeOf, inside echo/comments.
+    match: /(?:^|[\n;|&(])\s*sudo\b/i
+  }),
   {
     id: "privilege.exec_generated_script",
     category: "privilege-bypass",
@@ -3053,36 +3069,22 @@ var RULES = [
       return { evidence: evidence(raw), severity: critical ? "critical" : "high", mods: { script_file: file } };
     }
   },
-  {
+  simpleCommandRule({
     id: "privilege.chmod_777",
     category: "privilege-bypass",
     framework_ref: "OWASP LLM06",
     title: "Overly permissive permissions (chmod 777)",
-    tools: ["Bash"],
     baseSeverity: "medium",
-    test(ctx) {
-      const c = ctx.commandBare;
-      if (!c || !/\bchmod\s+(-[a-zA-Z]+\s+)*0?777\b/i.test(c))
-        return null;
-      return { evidence: evidence(ctx.command) };
-    }
-  },
-  {
+    match: /\bchmod\s+(-[a-zA-Z]+\s+)*0?777\b/i
+  }),
+  simpleCommandRule({
     id: "privilege.persistence",
     category: "privilege-bypass",
     framework_ref: "OWASP LLM06",
     title: "Installs a persistence mechanism",
-    tools: ["Bash"],
     baseSeverity: "high",
-    test(ctx) {
-      const c = ctx.commandBare;
-      if (!c)
-        return null;
-      if (!/\bcrontab\s+-|\bsystemctl\s+enable\b|\blaunchctl\s+load\b|>>\s*~\/\.(bashrc|zshrc|profile|bash_profile)\b|\/etc\/(cron|systemd|rc\.local)/i.test(c))
-        return null;
-      return { evidence: evidence(ctx.command) };
-    }
-  },
+    match: /\bcrontab\s+-|\bsystemctl\s+enable\b|\blaunchctl\s+load\b|>>\s*~\/\.(bashrc|zshrc|profile|bash_profile)\b|\/etc\/(cron|systemd|rc\.local)/i
+  }),
   {
     id: "privilege.write_outside_project",
     category: "privilege-bypass",
@@ -3110,29 +3112,18 @@ function appliesTo(rule, toolName) {
   return rule.tools === "*" || rule.tools.includes(toolName);
 }
 function buildContext(row, projectPath, ownedConfigDirs) {
-  let input = null;
-  try {
-    input = row.input_json ? JSON.parse(row.input_json) : null;
-  } catch {
-    input = null;
-  }
+  const input = parseStored(row.input_json, "detect: tool_calls.input_json");
   const command = typeof input?.command === "string" ? input.command : null;
-  const commandCode = command != null ? codeOf(command) : null;
-  const commandBare = command != null ? bareOf(command) : null;
+  const views = command != null ? commandViews(command) : null;
+  const commandCode = views?.code ?? null;
+  const commandBare = views?.bare ?? null;
   const filePath = typeof input?.file_path === "string" ? input.file_path : null;
   return { toolName: row.tool_name, command, commandCode, commandBare, filePath, input, resultSummary: row.result_summary, status: row.status, projectPath, ownedConfigDirs };
 }
 function detect(db, dirty) {
   const incremental = dirty != null;
-  if (incremental) {
-    db.exec("DROP TABLE IF EXISTS _dirty_sec");
-    db.exec("CREATE TEMP TABLE _dirty_sec (id TEXT PRIMARY KEY)");
-    const ins = db.prepare("INSERT OR IGNORE INTO _dirty_sec (id) VALUES (?)");
-    db.transaction((ids) => {
-      for (const id of ids)
-        ins.run(id);
-    })(dirty);
-  }
+  if (dirty != null)
+    createDirtySet(db, "_dirty_sec", dirty);
   const scope = incremental ? " WHERE tc.session_id IN (SELECT id FROM _dirty_sec)" : "";
   const ownedConfigDirs = db.prepare("SELECT config_dir FROM sources WHERE config_dir IS NOT NULL").all().map((r) => r.config_dir.replace(/\/$/, "")).filter(Boolean);
   const projPath = /* @__PURE__ */ new Map();
@@ -3201,15 +3192,8 @@ function detect(db, dirty) {
 function classifyErrors(db, dirty) {
   const incremental = dirty != null;
   const scope = incremental ? " AND session_id IN (SELECT id FROM _dirty_err)" : "";
-  if (incremental) {
-    db.exec("DROP TABLE IF EXISTS _dirty_err");
-    db.exec("CREATE TEMP TABLE _dirty_err (id TEXT PRIMARY KEY)");
-    const ins = db.prepare("INSERT OR IGNORE INTO _dirty_err (id) VALUES (?)");
-    db.transaction((ids) => {
-      for (const id of ids)
-        ins.run(id);
-    })(dirty);
-  }
+  if (dirty != null)
+    createDirtySet(db, "_dirty_err", dirty);
   const rows = db.prepare(`SELECT id, result_summary FROM tool_calls WHERE status = 'error'${scope}`).all();
   const update = db.prepare("UPDATE tool_calls SET error_type = ? WHERE id = ?");
   const tx = db.transaction(() => {
@@ -3459,14 +3443,8 @@ function pruneExcluded(db, excludedPaths) {
   const projIds = projects.filter((p) => excludedPaths.some((e) => p.path === e || p.path.startsWith(e + "/"))).map((p) => p.id);
   if (!projIds.length)
     return 0;
-  db.exec("DROP TABLE IF EXISTS _prune");
-  db.exec("CREATE TEMP TABLE _prune (id TEXT PRIMARY KEY)");
-  const insP = db.prepare("INSERT OR IGNORE INTO _prune (id) VALUES (?)");
   const seed = db.prepare(`SELECT id FROM sessions WHERE project_id IN (${projIds.map(() => "?").join(",")})`).all(...projIds);
-  db.transaction(() => {
-    for (const s of seed)
-      insP.run(s.id);
-  })();
+  createDirtySet(db, "_prune", seed.map((s) => s.id));
   const expand = db.prepare("INSERT OR IGNORE INTO _prune (id) SELECT id FROM sessions WHERE parent_session_id IN (SELECT id FROM _prune)");
   const cnt = db.prepare("SELECT COUNT(*) n FROM _prune");
   for (let prev = -1; ; ) {
@@ -3543,54 +3521,36 @@ function buildTurns(sessionId, rows) {
     t.duration_ms = durationMs(t.started_at, t.ended_at);
   return { turns, eventTurn };
 }
-function rebuildDerived(db, dirty) {
-  const incremental = dirty != null;
-  const bySession = incremental ? " WHERE session_id IN (SELECT id FROM _dirty)" : "";
-  const byId = incremental ? " WHERE id IN (SELECT id FROM _dirty)" : "";
-  const andId = incremental ? " AND id IN (SELECT id FROM _dirty)" : "";
-  const andSelfId = incremental ? " AND sessions.id IN (SELECT id FROM _dirty)" : "";
-  if (incremental) {
-    db.exec("DROP TABLE IF EXISTS _dirty");
-    db.exec("CREATE TEMP TABLE _dirty (id TEXT PRIMARY KEY)");
-    const ins = db.prepare("INSERT OR IGNORE INTO _dirty (id) VALUES (?)");
-    db.transaction((ids) => {
-      for (const id of ids)
-        ins.run(id);
-    })(dirty);
-    const expand = db.prepare(`
-      INSERT OR IGNORE INTO _dirty (id)
-        SELECT spawned_session_id FROM tool_calls
-          WHERE session_id IN (SELECT id FROM _dirty) AND spawned_session_id IS NOT NULL
-        UNION
-        SELECT session_id FROM tool_calls
-          WHERE spawned_session_id IN (SELECT id FROM _dirty)
-        UNION
-        -- structural (path-based) workflow linkage: a dirty parent pulls in its subagent children,
-        -- and a dirty child pulls in its structural parent, so the fallback link stays correct when
-        -- parent and child transcripts arrive in different runs (ADR-010).
-        SELECT id FROM sessions
-          WHERE spawn_parent_id IN (SELECT id FROM _dirty)
-        UNION
-        SELECT spawn_parent_id FROM sessions
-          WHERE id IN (SELECT id FROM _dirty) AND spawn_parent_id IS NOT NULL
-    `);
-    const count = db.prepare("SELECT COUNT(*) n FROM _dirty");
-    let prev = -1;
-    for (; ; ) {
-      const n = count.get().n;
-      if (n === prev)
-        break;
-      prev = n;
-      expand.run();
-    }
+function expandDirtyScope(db, dirty) {
+  createDirtySet(db, "_dirty", dirty);
+  const expand = db.prepare(`
+    INSERT OR IGNORE INTO _dirty (id)
+      SELECT spawned_session_id FROM tool_calls
+        WHERE session_id IN (SELECT id FROM _dirty) AND spawned_session_id IS NOT NULL
+      UNION
+      SELECT session_id FROM tool_calls
+        WHERE spawned_session_id IN (SELECT id FROM _dirty)
+      UNION
+      -- structural (path-based) workflow linkage: a dirty parent pulls in its subagent children,
+      -- and a dirty child pulls in its structural parent, so the fallback link stays correct when
+      -- parent and child transcripts arrive in different runs (ADR-010).
+      SELECT id FROM sessions
+        WHERE spawn_parent_id IN (SELECT id FROM _dirty)
+      UNION
+      SELECT spawn_parent_id FROM sessions
+        WHERE id IN (SELECT id FROM _dirty) AND spawn_parent_id IS NOT NULL
+  `);
+  const count = db.prepare("SELECT COUNT(*) n FROM _dirty");
+  let prev = -1;
+  for (; ; ) {
+    const n = count.get().n;
+    if (n === prev)
+      break;
+    prev = n;
+    expand.run();
   }
-  db.exec(`UPDATE events SET turn_id = NULL${bySession}`);
-  db.exec(`UPDATE token_usage SET turn_id = NULL${bySession}`);
-  db.exec(`UPDATE tool_calls SET turn_id = NULL${bySession}`);
-  db.exec(`UPDATE tool_calls SET skill_id = NULL${bySession}`);
-  db.exec(`UPDATE sessions SET parent_turn_id = NULL${byId}`);
-  db.exec(`DELETE FROM turns${bySession}`);
-  const sessionIds = db.prepare(`SELECT id FROM sessions${byId}`).all();
+}
+function rebuildTurns(db, scope, sessionIds) {
   const selEvents = db.prepare("SELECT uuid, type, is_sidechain, is_meta, timestamp, model, text FROM events WHERE session_id = ?");
   const insTurn = db.prepare(`INSERT INTO turns (id, session_id, seq, user_event_uuid, prompt_preview, model, started_at, ended_at, duration_ms)
      VALUES (@id, @session_id, @seq, @user_event_uuid, @prompt_preview, @model, @started_at, @ended_at, @duration_ms)`);
@@ -3606,123 +3566,152 @@ function rebuildDerived(db, dirty) {
     }
   });
   tx();
-  db.exec(`UPDATE token_usage SET turn_id = (SELECT turn_id FROM events WHERE events.uuid = token_usage.event_uuid)${bySession}`);
-  db.exec(`UPDATE tool_calls SET turn_id = (SELECT turn_id FROM events WHERE events.uuid = tool_calls.event_uuid)${bySession}`);
-  {
-    const selEventsOrdered = db.prepare("SELECT uuid, type, is_meta, timestamp, text FROM events WHERE session_id = ?");
-    const selSkillCalls = db.prepare("SELECT id, event_uuid, skill_name, input_json FROM tool_calls WHERE session_id = ? AND tool_name = 'Skill'");
-    const upsertSkill = db.prepare(`INSERT INTO skills (id, name, base_dir, body, summary, body_bytes, first_seen, last_seen)
-       VALUES (@id, @name, @base_dir, @body, @summary, @body_bytes, @ts, @ts)
-       ON CONFLICT(id) DO UPDATE SET
-         last_seen  = MAX(last_seen,  excluded.last_seen),
-         first_seen = MIN(first_seen, excluded.first_seen),
-         base_dir   = excluded.base_dir`);
-    const linkCall = db.prepare("UPDATE tool_calls SET skill_id = ? WHERE id = ?");
-    const linkTx = db.transaction(() => {
-      for (const { id: sid } of sessionIds) {
-        const calls = selSkillCalls.all(sid);
-        if (!calls.length)
+  db.exec(`UPDATE token_usage SET turn_id = (SELECT turn_id FROM events WHERE events.uuid = token_usage.event_uuid)${scope.bySession}`);
+  db.exec(`UPDATE tool_calls SET turn_id = (SELECT turn_id FROM events WHERE events.uuid = tool_calls.event_uuid)${scope.bySession}`);
+}
+function linkSkillVersions(db, sessionIds) {
+  const selEventsOrdered = db.prepare("SELECT uuid, type, is_meta, timestamp, text FROM events WHERE session_id = ?");
+  const selSkillCalls = db.prepare("SELECT id, event_uuid, skill_name, input_json FROM tool_calls WHERE session_id = ? AND tool_name = 'Skill'");
+  const upsertSkill = db.prepare(`INSERT INTO skills (id, name, base_dir, body, summary, body_bytes, first_seen, last_seen)
+     VALUES (@id, @name, @base_dir, @body, @summary, @body_bytes, @ts, @ts)
+     ON CONFLICT(id) DO UPDATE SET
+       last_seen  = MAX(last_seen,  excluded.last_seen),
+       first_seen = MIN(first_seen, excluded.first_seen),
+       base_dir   = excluded.base_dir`);
+  const linkCall = db.prepare("UPDATE tool_calls SET skill_id = ? WHERE id = ?");
+  const linkTx = db.transaction(() => {
+    for (const { id: sid } of sessionIds) {
+      const calls = selSkillCalls.all(sid);
+      if (!calls.length)
+        continue;
+      const events = selEventsOrdered.all(sid).sort((x, y) => (x.timestamp ?? "").localeCompare(y.timestamp ?? "") || x.uuid.localeCompare(y.uuid));
+      const callByEvent = /* @__PURE__ */ new Map();
+      for (const c of calls) {
+        if (!c.event_uuid)
           continue;
-        const events = selEventsOrdered.all(sid).sort((x, y) => (x.timestamp ?? "").localeCompare(y.timestamp ?? "") || x.uuid.localeCompare(y.uuid));
-        const callByEvent = /* @__PURE__ */ new Map();
-        for (const c of calls) {
-          if (!c.event_uuid)
-            continue;
-          const arr = callByEvent.get(c.event_uuid) ?? [];
-          arr.push(c);
-          callByEvent.set(c.event_uuid, arr);
-        }
-        const pending = /* @__PURE__ */ new Map();
-        for (const e of events) {
-          const here = callByEvent.get(e.uuid);
-          if (here) {
-            for (const c2 of here) {
-              if (!c2.skill_name)
-                continue;
-              const key = skillNameKey(c2.skill_name);
-              let args = null;
-              try {
-                args = c2.input_json ? JSON.parse(c2.input_json).args ?? null : null;
-                if (typeof args === "string")
-                  args = args.trim() || null;
-                else if (args != null)
-                  args = JSON.stringify(args);
-              } catch {
-              }
-              const arr = pending.get(key) ?? [];
-              arr.push({ id: c2.id, args });
-              pending.set(key, arr);
+        const arr = callByEvent.get(c.event_uuid) ?? [];
+        arr.push(c);
+        callByEvent.set(c.event_uuid, arr);
+      }
+      const pending = /* @__PURE__ */ new Map();
+      for (const e of events) {
+        const here = callByEvent.get(e.uuid);
+        if (here) {
+          for (const c2 of here) {
+            if (!c2.skill_name)
+              continue;
+            const key = skillNameKey(c2.skill_name);
+            let args = null;
+            try {
+              args = c2.input_json ? JSON.parse(c2.input_json).args ?? null : null;
+              if (typeof args === "string")
+                args = args.trim() || null;
+              else if (args != null)
+                args = JSON.stringify(args);
+            } catch {
             }
+            const arr = pending.get(key) ?? [];
+            arr.push({ id: c2.id, args });
+            pending.set(key, arr);
           }
-          if (e.is_meta !== 1 || e.type !== "user" || !e.text)
-            continue;
-          const inj = parseSkillInjection(e.text);
-          if (!inj)
-            continue;
-          const queue = pending.get(inj.nameKey);
-          if (!queue || !queue.length)
-            continue;
-          let idx = inj.args != null ? queue.findIndex((q) => q.args === inj.args) : -1;
-          if (idx < 0)
-            idx = 0;
-          const [match] = queue.splice(idx, 1);
-          const c = calls.find((x) => x.id === match.id);
-          const name = c.skill_name;
-          const vid = skillVersionId(name, inj.body);
-          upsertSkill.run({
-            id: vid,
-            name,
-            base_dir: inj.baseDir,
-            body: inj.body,
-            summary: skillSummary(inj.body),
-            body_bytes: Buffer.byteLength(inj.body, "utf8"),
-            ts: e.timestamp
-          });
-          linkCall.run(vid, match.id);
         }
+        if (e.is_meta !== 1 || e.type !== "user" || !e.text)
+          continue;
+        const inj = parseSkillInjection(e.text);
+        if (!inj)
+          continue;
+        const queue = pending.get(inj.nameKey);
+        if (!queue || !queue.length)
+          continue;
+        let idx = inj.args != null ? queue.findIndex((q) => q.args === inj.args) : -1;
+        if (idx < 0)
+          idx = 0;
+        const [match] = queue.splice(idx, 1);
+        const c = calls.find((x) => x.id === match.id);
+        const name = c.skill_name;
+        const vid = skillVersionId(name, inj.body);
+        upsertSkill.run({
+          id: vid,
+          name,
+          base_dir: inj.baseDir,
+          body: inj.body,
+          summary: skillSummary(inj.body),
+          body_bytes: Buffer.byteLength(inj.body, "utf8"),
+          ts: e.timestamp
+        });
+        linkCall.run(vid, match.id);
       }
-    });
-    linkTx();
-  }
+    }
+  });
+  linkTx();
+}
+function linkParents(db, scope) {
   db.exec(`
     UPDATE sessions SET
       parent_session_id = (SELECT tc.session_id FROM tool_calls tc WHERE tc.spawned_session_id = sessions.id),
       parent_turn_id    = (SELECT tc.turn_id    FROM tool_calls tc WHERE tc.spawned_session_id = sessions.id)
-    WHERE EXISTS (SELECT 1 FROM tool_calls tc WHERE tc.spawned_session_id = sessions.id)${andSelfId}
+    WHERE EXISTS (SELECT 1 FROM tool_calls tc WHERE tc.spawned_session_id = sessions.id)${scope.andSelfId}
   `);
   db.exec(`
     UPDATE sessions SET
       parent_session_id = COALESCE(parent_session_id, (SELECT tc.session_id FROM tool_calls tc WHERE tc.workflow_run_id = sessions.workflow_run_id LIMIT 1)),
       parent_turn_id    = COALESCE(parent_turn_id,    (SELECT tc.turn_id    FROM tool_calls tc WHERE tc.workflow_run_id = sessions.workflow_run_id LIMIT 1))
     WHERE sessions.workflow_run_id IS NOT NULL
-      AND EXISTS (SELECT 1 FROM tool_calls tc WHERE tc.workflow_run_id = sessions.workflow_run_id)${andSelfId}
+      AND EXISTS (SELECT 1 FROM tool_calls tc WHERE tc.workflow_run_id = sessions.workflow_run_id)${scope.andSelfId}
   `);
   db.exec(`
     UPDATE sessions SET parent_session_id = spawn_parent_id
     WHERE parent_session_id IS NULL
       AND spawn_parent_id IS NOT NULL
-      AND spawn_parent_id IN (SELECT id FROM sessions)${andSelfId}
+      AND spawn_parent_id IN (SELECT id FROM sessions)${scope.andSelfId}
   `);
+}
+function recomputeSessionAggregates(db, scope) {
   db.exec(`
     UPDATE sessions SET
       event_count = (SELECT COUNT(*) FROM events e WHERE e.session_id = sessions.id),
       started_at  = (SELECT MIN(timestamp) FROM events e WHERE e.session_id = sessions.id),
       ended_at    = (SELECT MAX(timestamp) FROM events e WHERE e.session_id = sessions.id),
       turn_count  = (SELECT COUNT(*) FROM turns t WHERE t.session_id = sessions.id),
-      is_sidechain = (SELECT CASE WHEN MIN(is_sidechain) = 1 THEN 1 ELSE 0 END FROM events e WHERE e.session_id = sessions.id)${byId}
+      is_sidechain = (SELECT CASE WHEN MIN(is_sidechain) = 1 THEN 1 ELSE 0 END FROM events e WHERE e.session_id = sessions.id)${scope.byId}
   `);
   db.exec(`
     UPDATE sessions SET duration_ms =
       CAST((julianday(ended_at) - julianday(started_at)) * 86400000 AS INTEGER)
-    WHERE started_at IS NOT NULL AND ended_at IS NOT NULL${andId}
+    WHERE started_at IS NOT NULL AND ended_at IS NOT NULL${scope.andId}
   `);
-  db.exec(`DELETE FROM sessions WHERE event_count = 0${andId}`);
+}
+function pruneOrphans(db, scope, incremental) {
+  db.exec(`DELETE FROM sessions WHERE event_count = 0${scope.andId}`);
   db.exec("DELETE FROM classifications WHERE scope = 'session' AND target_id NOT IN (SELECT id FROM sessions)");
   db.exec("DELETE FROM findings WHERE session_id NOT IN (SELECT id FROM sessions)");
   db.exec("DELETE FROM file_changes WHERE session_id NOT IN (SELECT id FROM sessions)");
   if (!incremental) {
     db.exec("DELETE FROM skills WHERE id NOT IN (SELECT skill_id FROM tool_calls WHERE skill_id IS NOT NULL)");
   }
+}
+function rebuildDerived(db, dirty) {
+  const incremental = dirty != null;
+  const scope = {
+    bySession: incremental ? " WHERE session_id IN (SELECT id FROM _dirty)" : "",
+    byId: incremental ? " WHERE id IN (SELECT id FROM _dirty)" : "",
+    andId: incremental ? " AND id IN (SELECT id FROM _dirty)" : "",
+    andSelfId: incremental ? " AND sessions.id IN (SELECT id FROM _dirty)" : ""
+  };
+  if (dirty != null)
+    expandDirtyScope(db, dirty);
+  db.exec(`UPDATE events SET turn_id = NULL${scope.bySession}`);
+  db.exec(`UPDATE token_usage SET turn_id = NULL${scope.bySession}`);
+  db.exec(`UPDATE tool_calls SET turn_id = NULL${scope.bySession}`);
+  db.exec(`UPDATE tool_calls SET skill_id = NULL${scope.bySession}`);
+  db.exec(`UPDATE sessions SET parent_turn_id = NULL${scope.byId}`);
+  db.exec(`DELETE FROM turns${scope.bySession}`);
+  const sessionIds = db.prepare(`SELECT id FROM sessions${scope.byId}`).all();
+  rebuildTurns(db, scope, sessionIds);
+  linkSkillVersions(db, sessionIds);
+  linkParents(db, scope);
+  recomputeSessionAggregates(db, scope);
+  pruneOrphans(db, scope, incremental);
   if (incremental) {
     const expanded = new Set(db.prepare("SELECT id FROM _dirty").all().map((r) => r.id));
     db.exec("DROP TABLE IF EXISTS _dirty");
@@ -3869,8 +3858,11 @@ function ingestFile(db, stmts, adapter, file, lines, meta, now2, stats) {
 }
 
 // ../ingest/dist/workflows.js
+import { basename as basename3 } from "path";
+
+// ../ingest/dist/sidecar.js
 import { readdirSync as readdirSync3, readFileSync as readFileSync4, statSync as statSync2 } from "fs";
-import { basename as basename3, join as join7 } from "path";
+import { join as join7 } from "path";
 
 // ../ingest/dist/redact.js
 import { createHash as createHash6, randomBytes } from "crypto";
@@ -3926,11 +3918,18 @@ function* streamLines(path3) {
   }
 }
 
-// ../ingest/dist/workflows.js
-function newWorkflowStats() {
+// ../ingest/dist/sidecar.js
+function newSidecarStats() {
   return { files: 0, upserted: 0, skipped: 0, malformed: 0 };
 }
-function walkSidecars(dir, inWorkflows, out) {
+var intOrNull = (v) => typeof v === "number" && Number.isFinite(v) ? Math.trunc(v) : null;
+var strOrNull = (v) => typeof v === "string" && v ? v : null;
+function sessionBefore(path3, subdir) {
+  const parts = path3.split("/");
+  const i = parts.indexOf(subdir);
+  return i > 0 ? parts[i - 1] : null;
+}
+function walk(dir, subdir, inSubdir, matchName, out) {
   let entries;
   try {
     entries = readdirSync3(dir, { withFileTypes: true });
@@ -3940,47 +3939,24 @@ function walkSidecars(dir, inWorkflows, out) {
   for (const e of entries) {
     const p = join7(dir, e.name);
     if (e.isDirectory())
-      walkSidecars(p, inWorkflows || e.name === "workflows", out);
-    else if (e.isFile() && inWorkflows && /^wf_.+\.json$/.test(e.name))
+      walk(p, subdir, inSubdir || e.name === subdir, matchName, out);
+    else if (e.isFile() && inSubdir && matchName(e.name))
       out.push(p);
   }
 }
-function discoverSidecars(sourceArchiveDir) {
+function discover(sourceArchiveDir, subdir, matchName) {
   const out = [];
-  walkSidecars(join7(sourceArchiveDir, "projects"), false, out);
+  walk(join7(sourceArchiveDir, "projects"), subdir, false, matchName, out);
   try {
     for (const ts of readdirSync3(join7(sourceArchiveDir, ".versions"), { withFileTypes: true }))
       if (ts.isDirectory())
-        walkSidecars(join7(sourceArchiveDir, ts.name, "projects"), false, out);
+        walk(join7(sourceArchiveDir, ts.name, "projects"), subdir, false, matchName, out);
   } catch {
   }
   return out;
 }
-function sessionFromPath(path3) {
-  const parts = path3.split("/");
-  const i = parts.indexOf("workflows");
-  return i > 0 ? parts[i - 1] : null;
-}
-function toIso(x) {
-  if (typeof x === "number" && Number.isFinite(x))
-    return new Date(x).toISOString();
-  if (typeof x === "string" && x) {
-    const t = Date.parse(x);
-    return Number.isNaN(t) ? null : new Date(t).toISOString();
-  }
-  return null;
-}
-var jsonOrNull = (v) => v == null ? null : JSON.stringify(v);
-var intOrNull = (v) => typeof v === "number" && Number.isFinite(v) ? Math.trunc(v) : null;
-var strOrNull = (v) => typeof v === "string" && v ? v : null;
-function cleanStr(v) {
-  const s = strOrNull(v);
-  if (!s)
-    return null;
-  return s.replace(/\x1b\[[0-9;]*[A-Za-z]/g, "").replace(/\[[0-9;]+m\]?/g, "").trim() || null;
-}
-function ingestWorkflowResults(db, sourceArchiveDir, sourceId, excludedDirs, now2, stats, full) {
-  let paths = discoverSidecars(sourceArchiveDir);
+function ingestSidecars(db, sourceArchiveDir, excludedDirs, now2, stats, full, cfg) {
+  let paths = discover(sourceArchiveDir, cfg.subdir, cfg.matchName);
   if (excludedDirs.length)
     paths = paths.filter((p) => !isExcludedArchivePath(p, excludedDirs));
   paths.sort((a, b) => Number(a.includes("/.versions/")) - Number(b.includes("/.versions/")) || (a < b ? -1 : 1));
@@ -3988,23 +3964,9 @@ function ingestWorkflowResults(db, sourceArchiveDir, sourceId, excludedDirs, now
   const setState = db.prepare(`INSERT INTO ingest_state (file_path, size, mtime_ms, sha256, events_ingested, ingested_at)
      VALUES (@file_path, @size, @mtime_ms, @sha256, 0, @ingested_at)
      ON CONFLICT(file_path) DO UPDATE SET size=excluded.size, mtime_ms=excluded.mtime_ms, sha256=excluded.sha256, ingested_at=excluded.ingested_at`);
-  const upsert = db.prepare(`INSERT INTO workflow_results
-       (run_id, source_id, session_id, task_id, workflow_name, status, summary, default_model,
-        result_json, phases_json, logs_json, progress_json,
-        agent_count, total_tokens, total_tool_calls, duration_ms, started_at, ended_at, ingested_at)
-     VALUES
-       (@run_id, @source_id, @session_id, @task_id, @workflow_name, @status, @summary, @default_model,
-        @result_json, @phases_json, @logs_json, @progress_json,
-        @agent_count, @total_tokens, @total_tool_calls, @duration_ms, @started_at, @ended_at, @ingested_at)
-     ON CONFLICT(run_id) DO UPDATE SET
-       source_id=excluded.source_id, session_id=excluded.session_id, task_id=excluded.task_id,
-       workflow_name=excluded.workflow_name, status=excluded.status, summary=excluded.summary,
-       default_model=excluded.default_model, result_json=excluded.result_json, phases_json=excluded.phases_json,
-       logs_json=excluded.logs_json, progress_json=excluded.progress_json, agent_count=excluded.agent_count,
-       total_tokens=excluded.total_tokens, total_tool_calls=excluded.total_tool_calls,
-       duration_ms=excluded.duration_ms, started_at=excluded.started_at, ended_at=excluded.ended_at,
-       ingested_at=excluded.ingested_at`);
   for (const path3 of paths) {
+    if (cfg.include && !cfg.include(path3))
+      continue;
     stats.files++;
     const st = statSync2(path3);
     const mtimeMs = Math.trunc(st.mtimeMs);
@@ -4026,232 +3988,160 @@ function ingestWorkflowResults(db, sourceArchiveDir, sourceId, excludedDirs, now
       stats.skipped++;
       continue;
     }
-    let d;
-    try {
-      d = JSON.parse(buf.toString("utf8"));
-    } catch {
-      stats.malformed++;
-      continue;
-    }
-    if (!d || typeof d !== "object") {
+    if (cfg.handle(path3, buf, st.size)) {
+      setState.run({ file_path: path3, size: st.size, mtime_ms: mtimeMs, sha256: hash2, ingested_at: now2 });
+      stats.upserted++;
+    } else {
       stats.malformed++;
-      continue;
     }
-    const runId = strOrNull(d.runId) ?? basename3(path3, ".json");
-    const startedAt = toIso(d.startTime) ?? toIso(d.timestamp);
-    const durationMs2 = intOrNull(d.durationMs);
-    const endedAt = startedAt && durationMs2 != null ? new Date(Date.parse(startedAt) + durationMs2).toISOString() : null;
-    upsert.run({
-      run_id: runId,
-      source_id: sourceId,
-      session_id: sessionFromPath(path3),
-      task_id: strOrNull(d.taskId),
-      workflow_name: strOrNull(d.workflowName),
-      status: strOrNull(d.status),
-      summary: strOrNull(d.summary),
-      default_model: cleanStr(d.defaultModel),
-      result_json: jsonOrNull(d.result),
-      phases_json: Array.isArray(d.phases) ? JSON.stringify(d.phases) : null,
-      logs_json: Array.isArray(d.logs) ? JSON.stringify(d.logs) : null,
-      progress_json: Array.isArray(d.workflowProgress) ? JSON.stringify(d.workflowProgress) : null,
-      agent_count: intOrNull(d.agentCount),
-      total_tokens: intOrNull(d.totalTokens),
-      total_tool_calls: intOrNull(d.totalToolCalls),
-      duration_ms: durationMs2,
-      started_at: startedAt,
-      ended_at: endedAt,
-      ingested_at: now2
-    });
-    setState.run({ file_path: path3, size: st.size, mtime_ms: mtimeMs, sha256: hash2, ingested_at: now2 });
-    stats.upserted++;
   }
 }
 
-// ../ingest/dist/meta.js
-import { readdirSync as readdirSync4, readFileSync as readFileSync5, statSync as statSync3 } from "fs";
-import { basename as basename4, join as join8 } from "path";
-function newMetaStats() {
-  return { files: 0, upserted: 0, skipped: 0, malformed: 0 };
-}
-function walkMeta(dir, inSubagents, out) {
-  let entries;
-  try {
-    entries = readdirSync4(dir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const e of entries) {
-    const p = join8(dir, e.name);
-    if (e.isDirectory())
-      walkMeta(p, inSubagents || e.name === "subagents", out);
-    else if (e.isFile() && inSubagents && /^agent-.+\.meta\.json$/.test(e.name))
-      out.push(p);
+// ../ingest/dist/workflows.js
+var newWorkflowStats = newSidecarStats;
+function toIso(x) {
+  if (typeof x === "number" && Number.isFinite(x))
+    return new Date(x).toISOString();
+  if (typeof x === "string" && x) {
+    const t = Date.parse(x);
+    return Number.isNaN(t) ? null : new Date(t).toISOString();
   }
+  return null;
 }
-function discoverMeta(sourceArchiveDir) {
-  const out = [];
-  walkMeta(join8(sourceArchiveDir, "projects"), false, out);
-  try {
-    for (const ts of readdirSync4(join8(sourceArchiveDir, ".versions"), { withFileTypes: true }))
-      if (ts.isDirectory())
-        walkMeta(join8(sourceArchiveDir, ts.name, "projects"), false, out);
-  } catch {
-  }
-  return out;
+var jsonOrNull = (v) => v == null ? null : JSON.stringify(v);
+function cleanStr(v) {
+  const s = strOrNull(v);
+  if (!s)
+    return null;
+  return s.replace(/\x1b\[[0-9;]*[A-Za-z]/g, "").replace(/\[[0-9;]+m\]?/g, "").trim() || null;
 }
-var intOrNull2 = (v) => typeof v === "number" && Number.isFinite(v) ? Math.trunc(v) : null;
-var strOrNull2 = (v) => typeof v === "string" && v ? v : null;
-function ingestSubagentMeta(db, sourceArchiveDir, sourceId, excludedDirs, now2, stats, full) {
-  let paths = discoverMeta(sourceArchiveDir);
-  if (excludedDirs.length)
-    paths = paths.filter((p) => !isExcludedArchivePath(p, excludedDirs));
-  paths.sort((a, b) => Number(a.includes("/.versions/")) - Number(b.includes("/.versions/")) || (a < b ? -1 : 1));
-  const getState = db.prepare("SELECT size, mtime_ms, sha256 FROM ingest_state WHERE file_path = ?");
-  const setState = db.prepare(`INSERT INTO ingest_state (file_path, size, mtime_ms, sha256, events_ingested, ingested_at)
-     VALUES (@file_path, @size, @mtime_ms, @sha256, 0, @ingested_at)
-     ON CONFLICT(file_path) DO UPDATE SET size=excluded.size, mtime_ms=excluded.mtime_ms, sha256=excluded.sha256, ingested_at=excluded.ingested_at`);
-  const upsert = db.prepare(`INSERT INTO session_meta
-       (session_id, source_id, agent_type, agent_description, spawn_depth, tool_use_id, ingested_at)
+function ingestWorkflowResults(db, sourceArchiveDir, sourceId, excludedDirs, now2, stats, full) {
+  const upsert = db.prepare(`INSERT INTO workflow_results
+       (run_id, source_id, session_id, task_id, workflow_name, status, summary, default_model,
+        result_json, phases_json, logs_json, progress_json,
+        agent_count, total_tokens, total_tool_calls, duration_ms, started_at, ended_at, ingested_at)
      VALUES
-       (@session_id, @source_id, @agent_type, @agent_description, @spawn_depth, @tool_use_id, @ingested_at)
+       (@run_id, @source_id, @session_id, @task_id, @workflow_name, @status, @summary, @default_model,
+        @result_json, @phases_json, @logs_json, @progress_json,
+        @agent_count, @total_tokens, @total_tool_calls, @duration_ms, @started_at, @ended_at, @ingested_at)
+     ON CONFLICT(run_id) DO UPDATE SET
+       source_id=excluded.source_id, session_id=excluded.session_id, task_id=excluded.task_id,
+       workflow_name=excluded.workflow_name, status=excluded.status, summary=excluded.summary,
+       default_model=excluded.default_model, result_json=excluded.result_json, phases_json=excluded.phases_json,
+       logs_json=excluded.logs_json, progress_json=excluded.progress_json, agent_count=excluded.agent_count,
+       total_tokens=excluded.total_tokens, total_tool_calls=excluded.total_tool_calls,
+       duration_ms=excluded.duration_ms, started_at=excluded.started_at, ended_at=excluded.ended_at,
+       ingested_at=excluded.ingested_at`);
+  ingestSidecars(db, sourceArchiveDir, excludedDirs, now2, stats, full, {
+    subdir: "workflows",
+    // Only the run's own result file (wf_<id>.json); agent-*.meta.json / scripts are handled elsewhere.
+    matchName: (name) => /^wf_.+\.json$/.test(name),
+    handle: (path3, buf) => {
+      let d;
+      try {
+        const parsed = JSON.parse(buf.toString("utf8"));
+        if (!parsed || typeof parsed !== "object")
+          return false;
+        d = parsed;
+      } catch {
+        return false;
+      }
+      const runId = strOrNull(d.runId) ?? basename3(path3, ".json");
+      const startedAt = toIso(d.startTime) ?? toIso(d.timestamp);
+      const durationMs2 = intOrNull(d.durationMs);
+      const endedAt = startedAt && durationMs2 != null ? new Date(Date.parse(startedAt) + durationMs2).toISOString() : null;
+      upsert.run({
+        run_id: runId,
+        source_id: sourceId,
+        session_id: sessionBefore(path3, "workflows"),
+        task_id: strOrNull(d.taskId),
+        workflow_name: strOrNull(d.workflowName),
+        status: strOrNull(d.status),
+        summary: strOrNull(d.summary),
+        default_model: cleanStr(d.defaultModel),
+        result_json: jsonOrNull(d.result),
+        phases_json: Array.isArray(d.phases) ? JSON.stringify(d.phases) : null,
+        logs_json: Array.isArray(d.logs) ? JSON.stringify(d.logs) : null,
+        progress_json: Array.isArray(d.workflowProgress) ? JSON.stringify(d.workflowProgress) : null,
+        agent_count: intOrNull(d.agentCount),
+        total_tokens: intOrNull(d.totalTokens),
+        total_tool_calls: intOrNull(d.totalToolCalls),
+        duration_ms: durationMs2,
+        started_at: startedAt,
+        ended_at: endedAt,
+        ingested_at: now2
+      });
+      return true;
+    }
+  });
+}
+
+// ../ingest/dist/meta.js
+import { basename as basename4 } from "path";
+var newMetaStats = newSidecarStats;
+function ingestSubagentMeta(db, sourceArchiveDir, sourceId, excludedDirs, now2, stats, full) {
+  const upsert = db.prepare(`INSERT INTO session_meta
+       (session_id, source_id, agent_type, agent_description, spawn_depth, tool_use_id, ingested_at)
+     VALUES
+       (@session_id, @source_id, @agent_type, @agent_description, @spawn_depth, @tool_use_id, @ingested_at)
      ON CONFLICT(session_id) DO UPDATE SET
        source_id=excluded.source_id, agent_type=excluded.agent_type,
        agent_description=excluded.agent_description, spawn_depth=excluded.spawn_depth,
        tool_use_id=excluded.tool_use_id, ingested_at=excluded.ingested_at`);
-  for (const path3 of paths) {
-    stats.files++;
-    const st = statSync3(path3);
-    const mtimeMs = Math.trunc(st.mtimeMs);
-    const prev = full ? void 0 : getState.get(path3);
-    if (prev && prev.size === st.size && prev.mtime_ms === mtimeMs) {
-      stats.skipped++;
-      continue;
-    }
-    let buf;
-    try {
-      buf = readFileSync5(path3);
-    } catch {
-      stats.malformed++;
-      continue;
-    }
-    const hash2 = sha256(buf);
-    if (prev && prev.sha256 === hash2) {
-      setState.run({ file_path: path3, size: st.size, mtime_ms: mtimeMs, sha256: hash2, ingested_at: now2 });
-      stats.skipped++;
-      continue;
-    }
-    let d;
-    try {
-      d = JSON.parse(buf.toString("utf8"));
-    } catch {
-      stats.malformed++;
-      continue;
-    }
-    if (!d || typeof d !== "object") {
-      stats.malformed++;
-      continue;
+  ingestSidecars(db, sourceArchiveDir, excludedDirs, now2, stats, full, {
+    subdir: "subagents",
+    matchName: (name) => /^agent-.+\.meta\.json$/.test(name),
+    handle: (path3, buf) => {
+      let d;
+      try {
+        const parsed = JSON.parse(buf.toString("utf8"));
+        if (!parsed || typeof parsed !== "object")
+          return false;
+        d = parsed;
+      } catch {
+        return false;
+      }
+      upsert.run({
+        session_id: basename4(path3, ".meta.json"),
+        source_id: sourceId,
+        agent_type: strOrNull(d.agentType),
+        agent_description: strOrNull(d.description),
+        spawn_depth: intOrNull(d.spawnDepth),
+        tool_use_id: strOrNull(d.toolUseId),
+        ingested_at: now2
+      });
+      return true;
     }
-    const sessionId = basename4(path3, ".meta.json");
-    upsert.run({
-      session_id: sessionId,
-      source_id: sourceId,
-      agent_type: strOrNull2(d.agentType),
-      agent_description: strOrNull2(d.description),
-      spawn_depth: intOrNull2(d.spawnDepth),
-      tool_use_id: strOrNull2(d.toolUseId),
-      ingested_at: now2
-    });
-    setState.run({ file_path: path3, size: st.size, mtime_ms: mtimeMs, sha256: hash2, ingested_at: now2 });
-    stats.upserted++;
-  }
+  });
 }
 
 // ../ingest/dist/toolResults.js
-import { readdirSync as readdirSync5, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
-import { basename as basename5, join as join9 } from "path";
-function newToolResultStats() {
-  return { files: 0, upserted: 0, skipped: 0, malformed: 0 };
-}
-function walkResults(dir, inResults, out) {
-  let entries;
-  try {
-    entries = readdirSync5(dir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const e of entries) {
-    const p = join9(dir, e.name);
-    if (e.isDirectory())
-      walkResults(p, inResults || e.name === "tool-results", out);
-    else if (e.isFile() && inResults && e.name.endsWith(".txt"))
-      out.push(p);
-  }
-}
-function discoverResults(sourceArchiveDir) {
-  const out = [];
-  walkResults(join9(sourceArchiveDir, "projects"), false, out);
-  try {
-    for (const ts of readdirSync5(join9(sourceArchiveDir, ".versions"), { withFileTypes: true }))
-      if (ts.isDirectory())
-        walkResults(join9(sourceArchiveDir, ts.name, "projects"), false, out);
-  } catch {
-  }
-  return out;
-}
-function sessionFromPath2(path3) {
-  const parts = path3.split("/");
-  const i = parts.indexOf("tool-results");
-  return i > 0 ? parts[i - 1] : null;
-}
+import { basename as basename5 } from "path";
+var newToolResultStats = newSidecarStats;
 function ingestToolResults(db, sourceArchiveDir, excludedDirs, now2, stats, full) {
-  let paths = discoverResults(sourceArchiveDir);
-  if (excludedDirs.length)
-    paths = paths.filter((p) => !isExcludedArchivePath(p, excludedDirs));
-  paths.sort((a, b) => Number(a.includes("/.versions/")) - Number(b.includes("/.versions/")) || (a < b ? -1 : 1));
-  const getState = db.prepare("SELECT size, mtime_ms, sha256 FROM ingest_state WHERE file_path = ?");
-  const setState = db.prepare(`INSERT INTO ingest_state (file_path, size, mtime_ms, sha256, events_ingested, ingested_at)
-     VALUES (@file_path, @size, @mtime_ms, @sha256, 0, @ingested_at)
-     ON CONFLICT(file_path) DO UPDATE SET size=excluded.size, mtime_ms=excluded.mtime_ms, sha256=excluded.sha256, ingested_at=excluded.ingested_at`);
   const upsert = db.prepare(`INSERT INTO tool_results (session_id, name, path, bytes, text, ingested_at)
      VALUES (@session_id, @name, @path, @bytes, @text, @ingested_at)
      ON CONFLICT(session_id, name) DO UPDATE SET
        path=excluded.path, bytes=excluded.bytes, text=excluded.text, ingested_at=excluded.ingested_at`);
-  for (const path3 of paths) {
-    const sessionId = sessionFromPath2(path3);
-    if (!sessionId)
-      continue;
-    stats.files++;
-    const st = statSync4(path3);
-    const mtimeMs = Math.trunc(st.mtimeMs);
-    const prev = full ? void 0 : getState.get(path3);
-    if (prev && prev.size === st.size && prev.mtime_ms === mtimeMs) {
-      stats.skipped++;
-      continue;
-    }
-    let buf;
-    try {
-      buf = readFileSync6(path3);
-    } catch {
-      stats.malformed++;
-      continue;
-    }
-    const hash2 = sha256(buf);
-    if (prev && prev.sha256 === hash2) {
-      setState.run({ file_path: path3, size: st.size, mtime_ms: mtimeMs, sha256: hash2, ingested_at: now2 });
-      stats.skipped++;
-      continue;
+  ingestSidecars(db, sourceArchiveDir, excludedDirs, now2, stats, full, {
+    subdir: "tool-results",
+    matchName: (name) => name.endsWith(".txt"),
+    // Skip a file outside the expected …/<sessionId>/tool-results/ layout (no files++, matching the
+    // original early-continue before statting).
+    include: (path3) => sessionBefore(path3, "tool-results") !== null,
+    handle: (path3, buf, size) => {
+      const sessionId = sessionBefore(path3, "tool-results");
+      upsert.run({
+        session_id: sessionId,
+        name: basename5(path3, ".txt"),
+        path: path3,
+        bytes: size,
+        text: buf.toString("utf8"),
+        ingested_at: now2
+      });
+      return true;
     }
-    upsert.run({
-      session_id: sessionId,
-      name: basename5(path3, ".txt"),
-      path: path3,
-      bytes: st.size,
-      text: buf.toString("utf8"),
-      ingested_at: now2
-    });
-    setState.run({ file_path: path3, size: st.size, mtime_ms: mtimeMs, sha256: hash2, ingested_at: now2 });
-    stats.upserted++;
-  }
+  });
 }
 
 // ../ingest/dist/run.js
@@ -4267,6 +4157,45 @@ function parseIngestArgs(argv) {
   }
   return a;
 }
+function shouldReingest(path3, size, mtimeMs, prev) {
+  if (prev && prev.size === size && prev.mtime_ms === mtimeMs)
+    return { action: "skip-stat" };
+  const small = size <= STREAM_THRESHOLD;
+  const buf = small ? readFileSync5(path3) : null;
+  const hash2 = small ? sha256(buf) : sha256File(path3);
+  if (prev && prev.sha256 === hash2)
+    return { action: "skip-hash", hash: hash2 };
+  return { action: "ingest", hash: hash2, buf };
+}
+function printIngestReport(db, dbPath, r) {
+  const count = (sql) => db.prepare(sql).get().n;
+  const sessions = count("SELECT COUNT(*) n FROM sessions");
+  const turns = count("SELECT COUNT(*) n FROM turns");
+  const events = count("SELECT COUNT(*) n FROM events");
+  const tools = count("SELECT COUNT(*) n FROM tool_calls");
+  const usageRows = db.prepare("SELECT model, input_tokens, output_tokens, cache_creation_input_tokens, cache_read_input_tokens FROM token_usage").all();
+  let cost = 0;
+  let totalTokens = 0;
+  for (const u of usageRows) {
+    cost += costForUsage(u.model, u);
+    totalTokens += u.input_tokens + u.output_tokens + u.cache_creation_input_tokens + u.cache_read_input_tokens;
+  }
+  const wfRuns = count("SELECT COUNT(*) n FROM workflow_results");
+  const metaRows = count("SELECT COUNT(*) n FROM session_meta");
+  const trRows = count("SELECT COUNT(*) n FROM tool_results");
+  const sevCounts = db.prepare("SELECT severity, COUNT(*) n FROM findings GROUP BY severity").all();
+  const sevMap = Object.fromEntries(sevCounts.map((s) => [s.severity, s.n]));
+  const sevLine = ["critical", "high", "medium", "low", "info"].map((s) => `${s}=${sevMap[s] ?? 0}`).join(" ");
+  db.close();
+  console.log(`agent-lens-ingest: files=${r.stats.files} skipped=${r.stats.skipped} new_events=${r.stats.newEvents} malformed=${r.stats.malformed}${r.pruned ? ` excluded_pruned=${r.pruned}` : ""}
+  sessions=${sessions} turns=${turns} events=${events} tool_calls=${tools} classified=${r.classified.count}
+  workflow_results=${wfRuns} (sidecar upserted=${r.wfStats.upserted} skipped=${r.wfStats.skipped} malformed=${r.wfStats.malformed})
+  session_meta=${metaRows} (upserted=${r.metaStats.upserted} skipped=${r.metaStats.skipped} malformed=${r.metaStats.malformed})
+  tool_results=${trRows} (upserted=${r.trStats.upserted} skipped=${r.trStats.skipped} malformed=${r.trStats.malformed})
+  findings=${r.detected.count} (${sevLine})
+  file_changes=${r.fileChanges.count}
+  tokens=${totalTokens.toLocaleString()} est_cost=$${cost.toFixed(2)} db=${dbPath}`);
+}
 function runIngest(argv = process.argv.slice(2)) {
   const args = parseIngestArgs(argv);
   const archiveRoot = args.archive || resolveArchiveDir();
@@ -4308,41 +4237,39 @@ function runIngest(argv = process.argv.slice(2)) {
     }
     stmts.insAgent.run(adapter.agentId, adapter.agentName);
     stmts.insSource.run({ id: source.label, label: source.label, agent_id: adapter.agentId, config_dir: source.configDir });
-    let files = adapter.discover(join10(archiveRoot, source.label), source.label);
+    let files = adapter.discover(join8(archiveRoot, source.label), source.label);
     if (excludedDirs.length)
       files = files.filter((f) => !isExcludedArchivePath(f.path, excludedDirs));
     files.sort((a, b) => Number(a.isVersion) - Number(b.isVersion));
     for (const file of files) {
       stats.files++;
-      const st = statSync5(file.path);
+      const st = statSync3(file.path);
       const mtimeMs = Math.trunc(st.mtimeMs);
       const prev = args.full ? void 0 : stmts.getState.get(file.path);
-      if (prev && prev.size === st.size && prev.mtime_ms === mtimeMs) {
+      const decision = shouldReingest(file.path, st.size, mtimeMs, prev);
+      if (decision.action === "skip-stat") {
         stats.skipped++;
         continue;
       }
-      const small = st.size <= STREAM_THRESHOLD;
-      const buf = small ? readFileSync7(file.path) : null;
-      const hash2 = small ? sha256(buf) : sha256File(file.path);
-      if (prev && prev.sha256 === hash2) {
+      if (decision.action === "skip-hash") {
         stmts.setState.run({
           file_path: file.path,
           size: st.size,
           mtime_ms: mtimeMs,
-          sha256: hash2,
+          sha256: decision.hash,
           events_ingested: prev.events_ingested,
           ingested_at: now2
         });
         stats.skipped++;
         continue;
       }
-      const lines = small ? buf.toString("utf8").split("\n") : streamLines(file.path);
-      ingestFile(db, stmts, adapter, file, lines, { size: st.size, mtimeMs, hash: hash2 }, now2, stats);
+      const lines = decision.buf ? decision.buf.toString("utf8").split("\n") : streamLines(file.path);
+      ingestFile(db, stmts, adapter, file, lines, { size: st.size, mtimeMs, hash: decision.hash }, now2, stats);
       dirty.add(file.sessionId);
     }
-    ingestWorkflowResults(db, join10(archiveRoot, source.label), source.label, excludedDirs, now2, wfStats, args.full);
-    ingestSubagentMeta(db, join10(archiveRoot, source.label), source.label, excludedDirs, now2, metaStats, args.full);
-    ingestToolResults(db, join10(archiveRoot, source.label), excludedDirs, now2, trStats, args.full);
+    ingestWorkflowResults(db, join8(archiveRoot, source.label), source.label, excludedDirs, now2, wfStats, args.full);
+    ingestSubagentMeta(db, join8(archiveRoot, source.label), source.label, excludedDirs, now2, metaStats, args.full);
+    ingestToolResults(db, join8(archiveRoot, source.label), excludedDirs, now2, trStats, args.full);
   }
   const expanded = rebuildDerived(db, args.full ? null : dirty);
   canonicalizeProjects(db);
@@ -4350,33 +4277,7 @@ function runIngest(argv = process.argv.slice(2)) {
   const detected = detect(db, args.full ? null : expanded);
   classifyErrors(db, args.full ? null : expanded);
   const fileChanges = deriveFileChanges(db, args.full ? null : expanded);
-  const count = (sql) => db.prepare(sql).get().n;
-  const sessions = count("SELECT COUNT(*) n FROM sessions");
-  const turns = count("SELECT COUNT(*) n FROM turns");
-  const events = count("SELECT COUNT(*) n FROM events");
-  const tools = count("SELECT COUNT(*) n FROM tool_calls");
-  const usageRows = db.prepare("SELECT model, input_tokens, output_tokens, cache_creation_input_tokens, cache_read_input_tokens FROM token_usage").all();
-  let cost = 0;
-  let totalTokens = 0;
-  for (const u of usageRows) {
-    cost += costForUsage(u.model, u);
-    totalTokens += u.input_tokens + u.output_tokens + u.cache_creation_input_tokens + u.cache_read_input_tokens;
-  }
-  const wfRuns = count("SELECT COUNT(*) n FROM workflow_results");
-  const metaRows = count("SELECT COUNT(*) n FROM session_meta");
-  const trRows = count("SELECT COUNT(*) n FROM tool_results");
-  const sevCounts = db.prepare("SELECT severity, COUNT(*) n FROM findings GROUP BY severity").all();
-  const sevMap = Object.fromEntries(sevCounts.map((r) => [r.severity, r.n]));
-  const sevLine = ["critical", "high", "medium", "low", "info"].map((s) => `${s}=${sevMap[s] ?? 0}`).join(" ");
-  db.close();
-  console.log(`agent-lens-ingest: files=${stats.files} skipped=${stats.skipped} new_events=${stats.newEvents} malformed=${stats.malformed}${pruned ? ` excluded_pruned=${pruned}` : ""}
-  sessions=${sessions} turns=${turns} events=${events} tool_calls=${tools} classified=${classified.count}
-  workflow_results=${wfRuns} (sidecar upserted=${wfStats.upserted} skipped=${wfStats.skipped} malformed=${wfStats.malformed})
-  session_meta=${metaRows} (upserted=${metaStats.upserted} skipped=${metaStats.skipped} malformed=${metaStats.malformed})
-  tool_results=${trRows} (upserted=${trStats.upserted} skipped=${trStats.skipped} malformed=${trStats.malformed})
-  findings=${detected.count} (${sevLine})
-  file_changes=${fileChanges.count}
-  tokens=${totalTokens.toLocaleString()} est_cost=$${cost.toFixed(2)} db=${dbPath}`);
+  printIngestReport(db, dbPath, { stats, pruned, classified, detected, fileChanges, wfStats, metaStats, trStats });
 }
 function runMetrics(argv = process.argv.slice(2)) {
   let dbArg = "";
@@ -4405,6 +4306,84 @@ import { fileURLToPath as fileURLToPath2 } from "url";
 
 // ../server/dist/db.js
 import Database2 from "better-sqlite3";
+
+// ../server/dist/sql-util.js
+function tableExists(db, name) {
+  return !!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name = ?").get(name);
+}
+function queryAll(db, sql, ...params) {
+  return db.prepare(sql).all(...params);
+}
+function pushDateRange(clauses, params, col, from, to) {
+  if (from) {
+    clauses.push(`date(${col}) >= date(?)`);
+    params.push(from);
+  }
+  if (to) {
+    clauses.push(`date(${col}) <= date(?)`);
+    params.push(to);
+  }
+}
+function metaJoin(hasMeta) {
+  return hasMeta ? "LEFT JOIN session_meta sm ON sm.session_id = s.id" : "";
+}
+function metaProjection(hasMeta) {
+  return hasMeta ? ", sm.agent_type, sm.agent_description, sm.spawn_depth" : ", NULL AS agent_type, NULL AS agent_description, NULL AS spawn_depth";
+}
+function orderBy(columns, sort, fallback, dir) {
+  const col = sort !== void 0 && Object.hasOwn(columns, sort) ? columns[sort] : columns[fallback];
+  return `${col} ${dir === "asc" ? "ASC" : "DESC"}`;
+}
+function pageLimit(raw, fallback, max) {
+  const n = Math.floor(Number(raw));
+  if (!Number.isFinite(n) || n < 1)
+    return Math.min(fallback, max);
+  return Math.min(n, max);
+}
+function pageOffset(raw) {
+  const n = Math.floor(Number(raw));
+  return Number.isFinite(n) && n > 0 ? n : 0;
+}
+function pushGrouped(map, key, value) {
+  const list = map.get(key);
+  if (list)
+    list.push(value);
+  else
+    map.set(key, [value]);
+}
+
+// ../server/dist/usage.js
+var USAGE_SUMS = "SUM(input_tokens) i, SUM(output_tokens) o, SUM(cache_creation_input_tokens) cw, SUM(cache_read_input_tokens) cr";
+function sessionUsage(db, sessionId) {
+  return queryAll(db, `SELECT model, ${USAGE_SUMS} FROM token_usage WHERE session_id = ? GROUP BY model`, sessionId);
+}
+function splitOf(rows) {
+  const split = { input: 0, output: 0, cache_creation: 0, cache_read: 0 };
+  for (const u of rows) {
+    split.input += u.i;
+    split.output += u.o;
+    split.cache_creation += u.cw;
+    split.cache_read += u.cr;
+  }
+  return split;
+}
+function tokensOf(split) {
+  return split.input + split.output + split.cache_creation + split.cache_read;
+}
+function costOf(rows) {
+  let cost = 0;
+  for (const u of rows) {
+    cost += costForUsage(u.model, {
+      input_tokens: u.i,
+      output_tokens: u.o,
+      cache_creation_input_tokens: u.cw,
+      cache_read_input_tokens: u.cr
+    });
+  }
+  return Number(cost.toFixed(4));
+}
+
+// ../server/dist/db.js
 function openReadonly(file) {
   const db = new Database2(file, { readonly: true, fileMustExist: true });
   db.pragma("query_only = ON");
@@ -4467,10 +4446,7 @@ function listSessions(db, f) {
     where.push("s.source_id = ?"), params.push(f.source);
   if (f.project)
     where.push("s.project_id = ?"), params.push(f.project);
-  if (f.from)
-    where.push("date(s.started_at) >= date(?)"), params.push(f.from);
-  if (f.to)
-    where.push("date(s.started_at) <= date(?)"), params.push(f.to);
+  pushDateRange(where, params, "s.started_at", f.from, f.to);
   if (f.kind === "main")
     where.push("s.is_sidechain = 0");
   if (f.kind === "subagent")
@@ -4514,7 +4490,6 @@ function listSessions(db, f) {
     duration: "s.duration_ms"
   };
   const sortKey = f.sort ?? "started";
-  const sqlDir = f.dir === "asc" ? "ASC" : "DESC";
   const JS_SORT = /* @__PURE__ */ new Set(["tokens", "cost", "errors", "security"]);
   let rows;
   if (JS_SORT.has(sortKey)) {
@@ -4542,55 +4517,35 @@ function listSessions(db, f) {
     });
     rows = all.slice(f.offset, f.offset + f.limit);
   } else {
-    const orderCol = NATIVE_ORDER[sortKey] ?? NATIVE_ORDER.started;
-    rows = db.prepare(`${baseSelect} ORDER BY ${orderCol} ${sqlDir}, s.id ASC LIMIT ? OFFSET ?`).all(...params, f.limit, f.offset);
+    rows = db.prepare(`${baseSelect} ORDER BY ${orderBy(NATIVE_ORDER, sortKey, "started", f.dir)}, s.id ASC LIMIT ? OFFSET ?`).all(...params, f.limit, f.offset);
     attachSessionCost(db, rows);
   }
   return { total, sessions: rows };
 }
 function attachSessionCost(db, rows) {
-  const costBySession = /* @__PURE__ */ new Map();
+  const usageBySession = /* @__PURE__ */ new Map();
   const ids = rows.map((r) => r.id);
   const CHUNK3 = 800;
   for (let i = 0; i < ids.length; i += CHUNK3) {
     const batch = ids.slice(i, i + CHUNK3);
     const ph = batch.map(() => "?").join(",");
-    const usage = db.prepare(`SELECT session_id, model,
-                SUM(input_tokens) i, SUM(output_tokens) o,
-                SUM(cache_creation_input_tokens) cw, SUM(cache_read_input_tokens) cr
-         FROM token_usage WHERE session_id IN (${ph}) GROUP BY session_id, model`).all(...batch);
+    const usage = queryAll(db, `SELECT session_id, model, ${USAGE_SUMS} FROM token_usage WHERE session_id IN (${ph}) GROUP BY session_id, model`, ...batch);
     for (const u of usage) {
-      const acc = costBySession.get(u.session_id) ?? { tokens: 0, cost: 0, split: { input: 0, output: 0, cache_creation: 0, cache_read: 0 } };
-      acc.tokens += u.i + u.o + u.cw + u.cr;
-      acc.split.input += u.i;
-      acc.split.output += u.o;
-      acc.split.cache_creation += u.cw;
-      acc.split.cache_read += u.cr;
-      acc.cost += costForUsage(u.model, {
-        input_tokens: u.i,
-        output_tokens: u.o,
-        cache_creation_input_tokens: u.cw,
-        cache_read_input_tokens: u.cr
-      });
-      costBySession.set(u.session_id, acc);
+      const list = usageBySession.get(u.session_id) ?? [];
+      list.push(u);
+      usageBySession.set(u.session_id, list);
     }
   }
   for (const r of rows) {
-    const c = costBySession.get(r.id);
-    r.tokens = c?.tokens ?? 0;
-    r.token_split = c?.split ?? { input: 0, output: 0, cache_creation: 0, cache_read: 0 };
-    r.cost = c ? Number(c.cost.toFixed(4)) : 0;
+    const u = usageBySession.get(r.id) ?? [];
+    const split = splitOf(u);
+    r.tokens = tokensOf(split);
+    r.token_split = split;
+    r.cost = costOf(u);
     r.title = r.ai_title || r.slug || null;
   }
 }
-function getSession(db, id) {
-  const session = db.prepare(`SELECT s.*, p.path AS project_path FROM sessions s
-       LEFT JOIN projects p ON p.id = s.project_id WHERE s.id = ?`).get(id);
-  if (!session)
-    return null;
-  const turns = db.prepare("SELECT * FROM turns WHERE session_id = ? ORDER BY seq").all(id);
-  const eventRows = db.prepare(`SELECT uuid, type, role, timestamp, model, is_sidechain, turn_id, raw_json
-       FROM events WHERE session_id = ? ORDER BY timestamp, seq`).all(id);
+function loadToolCalls(db, id) {
   const toolRows = db.prepare(`SELECT id, event_uuid, tool_name, skill_name, skill_id, agent_type, spawned_session_id,
               workflow_run_id, workflow_name, status, error_type,
               total_duration_ms, total_tokens, input_json, result_summary,
@@ -4607,40 +4562,48 @@ function getSession(db, id) {
         t.full_result = { text: full.text, bytes: full.bytes };
     }
   }
+  return toolRows;
+}
+function loadFindings(db, id, toolRows) {
+  if (!tableExists(db, "findings"))
+    return [];
   const sessionFindings = [];
-  if (tableExists(db, "findings")) {
-    const findingRows = db.prepare(`SELECT id, tool_call_id, event_uuid, turn_id, rule_id, category, framework_ref, severity, title, evidence, signals_json
-         FROM findings WHERE session_id = ?`).all(id);
-    const byToolCall = /* @__PURE__ */ new Map();
-    for (const fr of findingRows) {
-      const f = {
-        id: fr.id,
-        tool_call_id: fr.tool_call_id,
-        event_uuid: fr.event_uuid,
-        turn_id: fr.turn_id,
-        rule_id: fr.rule_id,
-        category: fr.category,
-        framework_ref: fr.framework_ref,
-        severity: fr.severity,
-        title: fr.title,
-        evidence: fr.evidence,
-        signals: safeJson(fr.signals_json)
-      };
-      sessionFindings.push(f);
-      if (fr.tool_call_id)
-        (byToolCall.get(fr.tool_call_id) ?? byToolCall.set(fr.tool_call_id, []).get(fr.tool_call_id)).push(f);
-    }
-    for (const t of toolRows)
-      t.findings = byToolCall.get(t.id) ?? [];
-    sessionFindings.sort((a, b) => severityRank(b.severity) - severityRank(a.severity));
+  const findingRows = db.prepare(`SELECT id, tool_call_id, event_uuid, turn_id, rule_id, category, framework_ref, severity, title, evidence, signals_json
+       FROM findings WHERE session_id = ?`).all(id);
+  const byToolCall = /* @__PURE__ */ new Map();
+  for (const fr of findingRows) {
+    const f = {
+      id: fr.id,
+      tool_call_id: fr.tool_call_id,
+      event_uuid: fr.event_uuid,
+      turn_id: fr.turn_id,
+      rule_id: fr.rule_id,
+      category: fr.category,
+      framework_ref: fr.framework_ref,
+      severity: fr.severity,
+      title: fr.title,
+      evidence: fr.evidence,
+      signals: safeJson(fr.signals_json)
+    };
+    sessionFindings.push(f);
+    if (fr.tool_call_id)
+      pushGrouped(byToolCall, fr.tool_call_id, f);
   }
+  for (const t of toolRows)
+    t.findings = byToolCall.get(t.id) ?? [];
+  sessionFindings.sort((a, b) => severityRank(b.severity) - severityRank(a.severity));
+  return sessionFindings;
+}
+function loadEvents(db, id, toolRows) {
+  const eventRows = db.prepare(`SELECT uuid, type, role, timestamp, model, is_sidechain, turn_id, raw_json
+       FROM events WHERE session_id = ? ORDER BY timestamp, seq`).all(id);
   const toolsByEvent = /* @__PURE__ */ new Map();
   for (const t of toolRows) {
     if (!t.event_uuid)
       continue;
-    (toolsByEvent.get(t.event_uuid) ?? toolsByEvent.set(t.event_uuid, []).get(t.event_uuid)).push(t);
+    pushGrouped(toolsByEvent, t.event_uuid, t);
   }
-  const events = eventRows.map((e) => {
+  return eventRows.map((e) => {
     const { text, thinking } = extractParts(e.raw_json);
     return {
       uuid: e.uuid,
@@ -4655,91 +4618,101 @@ function getSession(db, id) {
       toolCalls: toolsByEvent.get(e.uuid) ?? []
     };
   });
-  const usage = db.prepare(`SELECT model, SUM(input_tokens) i, SUM(output_tokens) o,
-              SUM(cache_creation_input_tokens) cw, SUM(cache_read_input_tokens) cr
-       FROM token_usage WHERE session_id = ? GROUP BY model`).all(id);
-  const split = { input: 0, output: 0, cache_creation: 0, cache_read: 0 };
-  let cost = 0;
-  for (const u of usage) {
-    split.input += u.i;
-    split.output += u.o;
-    split.cache_creation += u.cw;
-    split.cache_read += u.cr;
-    cost += costForUsage(u.model, {
-      input_tokens: u.i,
-      output_tokens: u.o,
-      cache_creation_input_tokens: u.cw,
-      cache_read_input_tokens: u.cr
-    });
-  }
-  session.tokens = split.input + split.output + split.cache_creation + split.cache_read;
-  session.token_split = split;
-  session.cost = Number(cost.toFixed(4));
-  session.title = session.ai_title || session.slug || null;
+}
+function loadClassification(db, id) {
   const cls = db.prepare(`SELECT category, complexity_score, complexity_band, signals_json, classifier_version
        FROM classifications WHERE scope = 'session' AND target_id = ?`).get(id);
-  let classification = null;
-  if (cls) {
-    let signals = null;
-    try {
-      signals = cls.signals_json ? JSON.parse(cls.signals_json) : null;
-    } catch {
-    }
-    classification = {
-      category: cls.category,
-      complexity_score: cls.complexity_score,
-      complexity_band: cls.complexity_band,
-      classifier_version: cls.classifier_version,
-      signals
-    };
-  }
-  let parent = null;
-  if (session.parent_session_id) {
-    const p = db.prepare(`SELECT ps.id, ps.ai_title, ps.slug, t.seq AS turn_seq
-         FROM sessions ps LEFT JOIN turns t ON t.id = ?
-         WHERE ps.id = ?`).get(session.parent_turn_id, session.parent_session_id);
-    if (p)
-      parent = { id: p.id, title: p.ai_title || p.slug || null, turn_seq: p.turn_seq ?? null };
+  if (!cls)
+    return null;
+  let signals = null;
+  try {
+    signals = cls.signals_json ? JSON.parse(cls.signals_json) : null;
+  } catch {
   }
+  return {
+    category: cls.category,
+    complexity_score: cls.complexity_score,
+    complexity_band: cls.complexity_band,
+    classifier_version: cls.classifier_version,
+    signals
+  };
+}
+function loadParent(db, session) {
+  if (!session.parent_session_id)
+    return null;
+  const p = db.prepare(`SELECT ps.id, ps.ai_title, ps.slug, t.seq AS turn_seq
+       FROM sessions ps LEFT JOIN turns t ON t.id = ?
+       WHERE ps.id = ?`).get(session.parent_turn_id, session.parent_session_id);
+  return p ? { id: p.id, title: p.ai_title || p.slug || null, turn_seq: p.turn_seq ?? null } : null;
+}
+function loadChildren(db, id) {
   const hasMeta = tableExists(db, "session_meta");
   const children = db.prepare(`SELECT s.id, s.ai_title, s.slug, s.turn_count, s.started_at, s.workflow_run_id,
               (SELECT GROUP_CONCAT(DISTINCT model) FROM token_usage t WHERE t.session_id = s.id) AS models
-              ${hasMeta ? ", sm.agent_type, sm.agent_description, sm.spawn_depth" : ", NULL AS agent_type, NULL AS agent_description, NULL AS spawn_depth"}
-       FROM sessions s ${hasMeta ? "LEFT JOIN session_meta sm ON sm.session_id = s.id" : ""}
+              ${metaProjection(hasMeta)}
+       FROM sessions s ${metaJoin(hasMeta)}
        WHERE s.parent_session_id = ? ORDER BY s.started_at`).all(id);
   for (const ch of children) {
     ch.title = ch.ai_title || ch.slug || null;
-    const u = db.prepare(`SELECT model, SUM(input_tokens) i, SUM(output_tokens) o,
-                SUM(cache_creation_input_tokens) cw, SUM(cache_read_input_tokens) cr
-         FROM token_usage WHERE session_id = ? GROUP BY model`).all(ch.id);
-    ch.tokens = u.reduce((a, r) => a + r.i + r.o + r.cw + r.cr, 0);
-    ch.cost = Number(u.reduce((a, r) => a + costForUsage(r.model, { input_tokens: r.i, output_tokens: r.o, cache_creation_input_tokens: r.cw, cache_read_input_tokens: r.cr }), 0).toFixed(4));
+    const u = sessionUsage(db, ch.id);
+    ch.tokens = tokensOf(splitOf(u));
+    ch.cost = costOf(u);
   }
+  return children;
+}
+function loadWorkflowRuns(db, id) {
   const hasWR = tableExists(db, "workflow_results");
-  const workflow_runs = db.prepare(`SELECT tc.workflow_run_id AS run_id, tc.workflow_name AS name, t.seq AS turn_seq,
+  return db.prepare(`SELECT tc.workflow_run_id AS run_id, tc.workflow_name AS name, t.seq AS turn_seq,
               (SELECT COUNT(*) FROM sessions s WHERE s.workflow_run_id = tc.workflow_run_id) AS agent_count
               ${hasWR ? ", (SELECT status FROM workflow_results wr WHERE wr.run_id = tc.workflow_run_id) AS status" : ", NULL AS status"}
        FROM tool_calls tc LEFT JOIN turns t ON t.id = tc.turn_id
        WHERE tc.session_id = ? AND tc.workflow_run_id IS NOT NULL
        ORDER BY t.seq`).all(id);
+}
+function loadFileChanges(db, id) {
+  if (!tableExists(db, "file_changes"))
+    return [];
+  return db.prepare(`SELECT fc.id, fc.tool_call_id, fc.turn_id, fc.event_uuid, fc.file_path, fc.tool_name,
+              fc.lines_added, fc.lines_removed, fc.timestamp
+       FROM file_changes fc WHERE fc.session_id = ? ORDER BY fc.timestamp`).all(id);
+}
+function attachSessionTotals(db, session, id, toolRows) {
+  const usage = sessionUsage(db, id);
+  const split = splitOf(usage);
+  session.tokens = tokensOf(split);
+  session.token_split = split;
+  session.cost = costOf(usage);
+  session.title = session.ai_title || session.slug || null;
   session.tool_call_count = toolRows.length;
   session.tool_error_count = toolRows.filter((t) => t.status === "error").length;
   session.tool_rejection_count = toolRows.filter((t) => t.status === "error" && t.error_type && errorKind(t.error_type) === "rejection").length;
   session.tool_failure_count = session.tool_error_count - session.tool_rejection_count;
-  let fileChanges = [];
-  if (tableExists(db, "file_changes")) {
-    fileChanges = db.prepare(`SELECT fc.id, fc.tool_call_id, fc.turn_id, fc.event_uuid, fc.file_path, fc.tool_name,
-                fc.lines_added, fc.lines_removed, fc.timestamp
-         FROM file_changes fc WHERE fc.session_id = ? ORDER BY fc.timestamp`).all(id);
-  }
-  return { session, turns, events, classification, parent, children, workflow_runs, findings: sessionFindings, file_changes: fileChanges };
+}
+function getSession(db, id) {
+  const session = db.prepare(`SELECT s.*, p.path AS project_path FROM sessions s
+       LEFT JOIN projects p ON p.id = s.project_id WHERE s.id = ?`).get(id);
+  if (!session)
+    return null;
+  const turns = db.prepare("SELECT * FROM turns WHERE session_id = ? ORDER BY seq").all(id);
+  const toolRows = loadToolCalls(db, id);
+  const findings = loadFindings(db, id, toolRows);
+  const events = loadEvents(db, id, toolRows);
+  attachSessionTotals(db, session, id, toolRows);
+  return {
+    session,
+    turns,
+    events,
+    classification: loadClassification(db, id),
+    parent: loadParent(db, session),
+    children: loadChildren(db, id),
+    workflow_runs: loadWorkflowRuns(db, id),
+    findings,
+    file_changes: loadFileChanges(db, id)
+  };
 }
 function xmlTag(text, tag) {
   return text.match(new RegExp(`<${tag}>([\\s\\S]*?)</${tag}>`))?.[1]?.trim() ?? null;
 }
-function tableExists(db, name) {
-  return !!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name = ?").get(name);
-}
 function safeJson(s) {
   if (!s)
     return null;
@@ -4749,24 +4722,12 @@ function safeJson(s) {
     return null;
   }
 }
-function getWorkflow(db, runId) {
-  const wf = db.prepare(`SELECT tc.id AS tool_use_id, tc.workflow_run_id AS run_id, tc.workflow_name AS name, tc.status, tc.result_summary,
-              tc.input_json AS input_json,
-              tc.session_id AS parent_session_id, t.seq AS turn_seq,
-              ps.ai_title AS parent_ai_title, ps.slug AS parent_slug
-       FROM tool_calls tc
-       LEFT JOIN turns t ON t.id = tc.turn_id
-       LEFT JOIN sessions ps ON ps.id = tc.session_id
-       WHERE tc.workflow_run_id = ? AND tc.tool_name = 'Workflow'
-       ORDER BY t.seq
-       LIMIT 1`).get(runId);
-  if (!wf)
-    return null;
+function loadAgents(db, runId) {
   const hasMeta = tableExists(db, "session_meta");
   const agents = db.prepare(`SELECT s.id, s.ai_title, s.slug, s.turn_count, s.started_at, s.ended_at, s.duration_ms,
               (SELECT GROUP_CONCAT(DISTINCT model) FROM token_usage t WHERE t.session_id = s.id) AS models
-              ${hasMeta ? ", sm.agent_type, sm.agent_description, sm.spawn_depth" : ", NULL AS agent_type, NULL AS agent_description, NULL AS spawn_depth"}
-       FROM sessions s ${hasMeta ? "LEFT JOIN session_meta sm ON sm.session_id = s.id" : ""}
+              ${metaProjection(hasMeta)}
+       FROM sessions s ${metaJoin(hasMeta)}
        WHERE s.workflow_run_id = ? ORDER BY s.started_at`).all(runId);
   let total_tokens = 0;
   let total_cost = 0;
@@ -4774,11 +4735,9 @@ function getWorkflow(db, runId) {
   let ended_at = null;
   for (const a of agents) {
     a.title = a.ai_title || a.slug || null;
-    const u = db.prepare(`SELECT model, SUM(input_tokens) i, SUM(output_tokens) o,
-                SUM(cache_creation_input_tokens) cw, SUM(cache_read_input_tokens) cr
-         FROM token_usage WHERE session_id = ? GROUP BY model`).all(a.id);
-    a.tokens = u.reduce((acc, r) => acc + r.i + r.o + r.cw + r.cr, 0);
-    a.cost = Number(u.reduce((acc, r) => acc + costForUsage(r.model, { input_tokens: r.i, output_tokens: r.o, cache_creation_input_tokens: r.cw, cache_read_input_tokens: r.cr }), 0).toFixed(4));
+    const u = sessionUsage(db, a.id);
+    a.tokens = tokensOf(splitOf(u));
+    a.cost = costOf(u);
     total_tokens += a.tokens;
     total_cost += a.cost;
     if (a.started_at && (!started_at || a.started_at < started_at))
@@ -4787,47 +4746,70 @@ function getWorkflow(db, runId) {
       ended_at = a.ended_at;
   }
   const duration_ms = started_at && ended_at ? new Date(ended_at).getTime() - new Date(started_at).getTime() : null;
-  let completion = null;
-  if (wf.tool_use_id && wf.parent_session_id) {
-    const ev = db.prepare(`SELECT raw_json FROM events
-         WHERE session_id = ? AND text LIKE '%<task-notification>%' AND text LIKE ?
-         ORDER BY timestamp DESC LIMIT 1`).get(wf.parent_session_id, `%${wf.tool_use_id}%`);
-    if (ev) {
-      const { text } = extractParts(ev.raw_json);
-      const t = text ?? "";
-      completion = { status: xmlTag(t, "status"), summary: xmlTag(t, "summary"), result: xmlTag(t, "result"), failures: xmlTag(t, "failures") };
-    }
-  }
+  return {
+    agents,
+    stats: { agent_count: agents.length, total_tokens, total_cost: Number(total_cost.toFixed(4)), started_at, ended_at, duration_ms }
+  };
+}
+function parseCompletion(db, wf) {
+  if (!wf.tool_use_id || !wf.parent_session_id)
+    return null;
+  const ev = db.prepare(`SELECT raw_json FROM events
+       WHERE session_id = ? AND text LIKE '%<task-notification>%' AND text LIKE ?
+       ORDER BY timestamp DESC LIMIT 1`).get(wf.parent_session_id, `%${wf.tool_use_id}%`);
+  if (!ev)
+    return null;
+  const { text } = extractParts(ev.raw_json);
+  const t = text ?? "";
+  return { status: xmlTag(t, "status"), summary: xmlTag(t, "summary"), result: xmlTag(t, "result"), failures: xmlTag(t, "failures") };
+}
+function loadRunSidecar(db, runId, completion) {
   const wr = tableExists(db, "workflow_results") ? db.prepare(`SELECT status, summary, default_model, result_json, phases_json, logs_json, progress_json,
                   agent_count, total_tokens, total_tool_calls, duration_ms, started_at, ended_at
-           FROM workflow_results WHERE run_id = ?`).get(wf.run_id) : null;
-  let run = null;
-  if (wr) {
-    run = {
-      status: wr.status ?? null,
-      summary: wr.summary ?? null,
-      default_model: wr.default_model ?? null,
-      agent_count: wr.agent_count ?? null,
-      total_tokens: wr.total_tokens ?? null,
-      total_tool_calls: wr.total_tool_calls ?? null,
-      duration_ms: wr.duration_ms ?? null,
-      started_at: wr.started_at ?? null,
-      ended_at: wr.ended_at ?? null,
-      phases: safeJson(wr.phases_json),
-      logs: safeJson(wr.logs_json),
-      // The per-phase/per-agent event timeline (workflowProgress) — lets the page render a phase graph
-      // with a per-phase descriptor (agent count, models). Absent on older/failed runs → UI falls back.
-      progress: safeJson(wr.progress_json)
+           FROM workflow_results WHERE run_id = ?`).get(runId) : null;
+  if (!wr)
+    return { wr: null, run: null, completion };
+  const run = {
+    status: wr.status ?? null,
+    summary: wr.summary ?? null,
+    default_model: wr.default_model ?? null,
+    agent_count: wr.agent_count ?? null,
+    total_tokens: wr.total_tokens ?? null,
+    total_tool_calls: wr.total_tool_calls ?? null,
+    duration_ms: wr.duration_ms ?? null,
+    started_at: wr.started_at ?? null,
+    ended_at: wr.ended_at ?? null,
+    phases: safeJson(wr.phases_json),
+    logs: safeJson(wr.logs_json),
+    // The per-phase/per-agent event timeline (workflowProgress) — lets the page render a phase graph
+    // with a per-phase descriptor (agent count, models). Absent on older/failed runs → UI falls back.
+    progress: safeJson(wr.progress_json)
+  };
+  if (wr.result_json != null || wr.status) {
+    completion = {
+      status: wr.status ?? completion?.status ?? null,
+      summary: wr.summary ?? completion?.summary ?? null,
+      result: wr.result_json ?? completion?.result ?? null,
+      failures: completion?.failures ?? null
     };
-    if (wr.result_json != null || wr.status) {
-      completion = {
-        status: wr.status ?? completion?.status ?? null,
-        summary: wr.summary ?? completion?.summary ?? null,
-        result: wr.result_json ?? completion?.result ?? null,
-        failures: completion?.failures ?? null
-      };
-    }
   }
+  return { wr, run, completion };
+}
+function getWorkflow(db, runId) {
+  const wf = db.prepare(`SELECT tc.id AS tool_use_id, tc.workflow_run_id AS run_id, tc.workflow_name AS name, tc.status, tc.result_summary,
+              tc.input_json AS input_json,
+              tc.session_id AS parent_session_id, t.seq AS turn_seq,
+              ps.ai_title AS parent_ai_title, ps.slug AS parent_slug
+       FROM tool_calls tc
+       LEFT JOIN turns t ON t.id = tc.turn_id
+       LEFT JOIN sessions ps ON ps.id = tc.session_id
+       WHERE tc.workflow_run_id = ? AND tc.tool_name = 'Workflow'
+       ORDER BY t.seq
+       LIMIT 1`).get(runId);
+  if (!wf)
+    return null;
+  const { agents, stats } = loadAgents(db, runId);
+  const { wr, run, completion } = loadRunSidecar(db, wf.run_id, parseCompletion(db, wf));
   return {
     run_id: wf.run_id,
     name: wf.name ?? null,
@@ -4838,7 +4820,7 @@ function getWorkflow(db, runId) {
     run,
     parent: { id: wf.parent_session_id, title: wf.parent_ai_title || wf.parent_slug || null, turn_seq: wf.turn_seq ?? null },
     agents,
-    stats: { agent_count: agents.length, total_tokens, total_cost: Number(total_cost.toFixed(4)), started_at, ended_at, duration_ms }
+    stats
   };
 }
 function listSkills(db, f = {}) {
@@ -4897,13 +4879,11 @@ function listFiles(db, f = {}) {
     sessions: "sessions",
     path: "file_path"
   };
-  const col = ORDER[f.sort ?? "last_ts"] ?? "last_ts";
-  const dir = f.dir === "asc" ? "ASC" : "DESC";
   const limit = Math.min(f.limit ?? 50, 200);
   const offset = f.offset ?? 0;
   const files = db.prepare(`SELECT g.*, p.path AS project_path FROM (${grouped}) g
        LEFT JOIN projects p ON p.id = g.project_id
-       ORDER BY ${col} ${dir}, g.file_path ASC LIMIT ? OFFSET ?`).all(...params, limit, offset);
+       ORDER BY ${orderBy(ORDER, f.sort, "last_ts", f.dir)}, g.file_path ASC LIMIT ? OFFSET ?`).all(...params, limit, offset);
   return { total, files };
 }
 function getFileTimeline(db, filePath, projectId2) {
@@ -5010,10 +4990,7 @@ function findingWhere(f) {
     sql.push("s.source_id = ?"), params.push(f.source);
   if (f.project)
     sql.push("s.project_id = ?"), params.push(f.project);
-  if (f.from)
-    sql.push("date(s.started_at) >= date(?)"), params.push(f.from);
-  if (f.to)
-    sql.push("date(s.started_at) <= date(?)"), params.push(f.to);
+  pushDateRange(sql, params, "s.started_at", f.from, f.to);
   return { sql, params };
 }
 function statusWhere(status, attached) {
@@ -5048,8 +5025,6 @@ function listFindings(db, f) {
     category: "f.category",
     time: "s.started_at"
   };
-  const orderCol = ORDER[f.sort ?? "severity"] ?? SEVERITY_RANK_SQL;
-  const dir = f.dir === "asc" ? "ASC" : "DESC";
   const findings = db.prepare(`SELECT f.id, f.session_id, f.tool_call_id, f.event_uuid, f.turn_id, f.rule_id, f.category,
               f.framework_ref, f.severity, f.title, f.evidence, tc.tool_name,
               COALESCE(s.ai_title, s.slug) AS session_title, s.source_id, s.is_sidechain,
@@ -5060,7 +5035,7 @@ function listFindings(db, f) {
        LEFT JOIN tool_calls tc ON tc.id = f.tool_call_id
        ${dismissJoin}
        ${whereSql}
-       ORDER BY ${orderCol} ${dir}, ${SEVERITY_RANK_SQL} DESC, f.id ASC
+       ORDER BY ${orderBy(ORDER, f.sort, "severity", f.dir)}, ${SEVERITY_RANK_SQL} DESC, f.id ASC
        LIMIT ? OFFSET ?`).all(...w.params, f.limit, f.offset);
   return { total, findings };
 }
@@ -5115,7 +5090,11 @@ function renderSessionExport(db, id, level) {
   }));
   const { markdown } = exportMarkdown({ id: s.id, title: s.title, source: s.source_id, project: s.project_path, model: null, started_at: s.started_at, ended_at: s.ended_at }, events, { level });
   const suffix = level === "off" ? "" : ".redacted";
-  return { markdown, filename: `session-${id.slice(0, 8)}${suffix}.md` };
+  return { markdown, filename: `session-${filenameSafe(id.slice(0, 8))}${suffix}.md` };
+}
+function filenameSafe(s) {
+  const cleaned = s.replace(/[^A-Za-z0-9._-]/g, "_");
+  return cleaned === "" ? "session" : cleaned;
 }
 
 // ../server/dist/dashboard.js
@@ -5124,10 +5103,7 @@ function sessionWhere(f) {
   const params = [];
   if (f.source)
     where.push("s.source_id = ?"), params.push(f.source);
-  if (f.from)
-    where.push("date(s.started_at) >= date(?)"), params.push(f.from);
-  if (f.to)
-    where.push("date(s.started_at) <= date(?)"), params.push(f.to);
+  pushDateRange(where, params, "s.started_at", f.from, f.to);
   return { sql: where.length ? `WHERE ${where.join(" AND ")}` : "", params };
 }
 var zeroSplit = () => ({ input: 0, output: 0, cache_creation: 0, cache_read: 0 });
@@ -5143,23 +5119,17 @@ function pct(sorted, p) {
   const rank = Math.ceil(p / 100 * sorted.length) - 1;
   return sorted[Math.min(Math.max(rank, 0), sorted.length - 1)];
 }
-function tableExists2(db, name) {
-  return !!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name = ?").get(name);
-}
 function workflowWhere(f) {
   const where = [];
   const params = [];
   if (f.source)
     where.push("source_id = ?"), params.push(f.source);
-  if (f.from)
-    where.push("date(started_at) >= date(?)"), params.push(f.from);
-  if (f.to)
-    where.push("date(started_at) <= date(?)"), params.push(f.to);
+  pushDateRange(where, params, "started_at", f.from, f.to);
   return { sql: where.length ? `WHERE ${where.join(" AND ")}` : "", params };
 }
 function workflowAgg(db, f) {
   const empty = { total: 0, by_status: [], completed: 0, failed: 0, success_rate: 0, total_tokens: 0, avg_duration_ms: 0 };
-  if (!tableExists2(db, "workflow_results"))
+  if (!tableExists(db, "workflow_results"))
     return empty;
   const ww = workflowWhere(f);
   const rows = db.prepare(`SELECT COALESCE(status, '(unknown)') status, COUNT(*) n,
@@ -5300,14 +5270,14 @@ function dashboardTimeseries(db, f, bucketParam) {
     r.cost = Number(r.cost.toFixed(4));
   return { bucket, series };
 }
-function dashboardBreakdowns(db, f) {
-  const w = sessionWhere(f);
+var andWhere = (w) => w.sql ? w.sql + " AND" : "WHERE";
+function modelBreakdown(db, w) {
   const modelRows = db.prepare(`SELECT t.model model, SUM(t.input_tokens) i, SUM(t.output_tokens) o,
               SUM(t.cache_creation_input_tokens) cw, SUM(t.cache_read_input_tokens) cr,
               COUNT(DISTINCT t.session_id) sessions
        FROM token_usage t JOIN sessions s ON s.id = t.session_id ${w.sql}
        GROUP BY t.model ORDER BY (SUM(t.input_tokens)+SUM(t.output_tokens)+SUM(t.cache_creation_input_tokens)+SUM(t.cache_read_input_tokens)) DESC`).all(...w.params);
-  const byModel = modelRows.map((u) => ({
+  return modelRows.map((u) => ({
     model: u.model,
     tokens: { input: u.i ?? 0, output: u.o ?? 0, cache_creation: u.cw ?? 0, cache_read: u.cr ?? 0 },
     total_tokens: (u.i ?? 0) + (u.o ?? 0) + (u.cw ?? 0) + (u.cr ?? 0),
@@ -5315,38 +5285,52 @@ function dashboardBreakdowns(db, f) {
     sessions: u.sessions ?? 0,
     priced: !!rateForModel(u.model)
   }));
-  const bySource = db.prepare(`SELECT COALESCE(s.source_id, '(none)') source, COUNT(*) sessions, SUM(s.turn_count) turns
+}
+function sourceBreakdown(db, w) {
+  return db.prepare(`SELECT COALESCE(s.source_id, '(none)') source, COUNT(*) sessions, SUM(s.turn_count) turns
        FROM sessions s ${w.sql} GROUP BY s.source_id ORDER BY sessions DESC`).all(...w.params);
+}
+function classificationBreakdowns(db, w) {
   const mainW = { sql: w.sql ? w.sql + " AND s.is_sidechain = 0" : "WHERE s.is_sidechain = 0", params: w.params };
   const byCategory = db.prepare(`SELECT c.category, COUNT(*) n FROM classifications c JOIN sessions s ON s.id = c.target_id
        ${mainW.sql} GROUP BY c.category ORDER BY n DESC`).all(...mainW.params);
   const byComplexity = db.prepare(`SELECT c.complexity_band band, COUNT(*) n FROM classifications c JOIN sessions s ON s.id = c.target_id
        ${mainW.sql} GROUP BY c.complexity_band ORDER BY n DESC`).all(...mainW.params);
-  const tools = db.prepare(`SELECT tc.tool_name name, COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
+  return { byCategory, byComplexity };
+}
+function toolBreakdown(db, w) {
+  return db.prepare(`SELECT tc.tool_name name, COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
        ${w.sql} GROUP BY tc.tool_name ORDER BY n DESC LIMIT 20`).all(...w.params);
+}
+function skillBreakdowns(db, w) {
   const skills = db.prepare(`SELECT tc.skill_name name, COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
-       ${w.sql ? w.sql + " AND" : "WHERE"} tc.skill_name IS NOT NULL GROUP BY tc.skill_name ORDER BY n DESC LIMIT 20`).all(...w.params);
+       ${andWhere(w)} tc.skill_name IS NOT NULL GROUP BY tc.skill_name ORDER BY n DESC LIMIT 20`).all(...w.params);
   const skillVersions = db.prepare(`SELECT tc.skill_name name, sk.id version_id, sk.summary, sk.last_seen, COUNT(*) n
        FROM tool_calls tc
        JOIN skills sk ON sk.id = tc.skill_id
        JOIN sessions s ON s.id = tc.session_id
-       ${w.sql ? w.sql + " AND" : "WHERE"} tc.skill_id IS NOT NULL
+       ${andWhere(w)} tc.skill_id IS NOT NULL
        GROUP BY tc.skill_name, sk.id ORDER BY name, n DESC`).all(...w.params);
+  return { skills, skillVersions };
+}
+function subagentFanoutBreakdown(db, w) {
   const subagentByType = db.prepare(`SELECT tc.agent_type type, COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
-       ${w.sql ? w.sql + " AND" : "WHERE"} tc.agent_type IS NOT NULL GROUP BY tc.agent_type ORDER BY n DESC`).all(...w.params);
+       ${andWhere(w)} tc.agent_type IS NOT NULL GROUP BY tc.agent_type ORDER BY n DESC`).all(...w.params);
   const perSession = db.prepare(`SELECT COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
-       ${w.sql ? w.sql + " AND" : "WHERE"} s.is_sidechain = 0 AND tc.tool_name IN ('Agent','Task')
+       ${andWhere(w)} s.is_sidechain = 0 AND tc.tool_name IN ('Agent','Task')
        GROUP BY tc.session_id`).all(...w.params);
   const counts = perSession.map((r) => r.n);
-  const subagentFanout = {
+  return {
     by_type: subagentByType,
     sessions_with_subagents: counts.length,
     total_spawns: counts.reduce((a, b) => a + b, 0),
     max_per_session: counts.length ? Math.max(...counts) : 0,
     avg_per_session: counts.length ? Number((counts.reduce((a, b) => a + b, 0) / counts.length).toFixed(2)) : 0
   };
+}
+function errorTypeBreakdown(db, w) {
   const errorRows = db.prepare(`SELECT COALESCE(tc.error_type, 'other') type, COUNT(*) n FROM tool_calls tc JOIN sessions s ON s.id = tc.session_id
-       ${w.sql ? w.sql + " AND" : "WHERE"} tc.status = 'error' GROUP BY tc.error_type ORDER BY n DESC`).all(...w.params);
+       ${andWhere(w)} tc.status = 'error' GROUP BY tc.error_type ORDER BY n DESC`).all(...w.params);
   let failures = 0;
   let rejections = 0;
   const byType = errorRows.map((r) => {
@@ -5357,19 +5341,34 @@ function dashboardBreakdowns(db, f) {
       failures += r.n;
     return { type: r.type, kind, n: r.n };
   });
-  const errorTypes = { by_type: byType, failures, rejections };
-  return { by_model: byModel, by_source: bySource, by_category: byCategory, by_complexity: byComplexity, tools, skills, skill_versions: skillVersions, subagent_fanout: subagentFanout, error_types: errorTypes };
+  return { by_type: byType, failures, rejections };
+}
+function dashboardBreakdowns(db, f) {
+  const w = sessionWhere(f);
+  const { byCategory, byComplexity } = classificationBreakdowns(db, w);
+  const { skills, skillVersions } = skillBreakdowns(db, w);
+  return {
+    by_model: modelBreakdown(db, w),
+    by_source: sourceBreakdown(db, w),
+    by_category: byCategory,
+    by_complexity: byComplexity,
+    tools: toolBreakdown(db, w),
+    skills,
+    skill_versions: skillVersions,
+    subagent_fanout: subagentFanoutBreakdown(db, w),
+    error_types: errorTypeBreakdown(db, w)
+  };
 }
 
 // ../server/dist/refresh.js
 import { existsSync as existsSync6, mkdirSync as mkdirSync5 } from "fs";
-import { join as join11 } from "path";
+import { join as join9 } from "path";
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
 function originAllowed(origin) {
   if (!origin)
     return true;
   try {
-    const h = new URL(origin).hostname;
-    return h === "127.0.0.1" || h === "localhost" || h === "::1";
+    return LOOPBACK_HOSTS.has(new URL(origin).hostname);
   } catch {
     return false;
   }
@@ -5384,7 +5383,7 @@ function writeBlocked(headers) {
 }
 function runRefresh() {
   const dataDir = resolveDataDir(findRepoRoot());
-  const lock = acquireLock(join11(dataDir, ".agent-lens.lock"));
+  const lock = acquireLock(join9(dataDir, ".agent-lens.lock"));
   if (!lock)
     return null;
   try {
@@ -5487,12 +5486,14 @@ function setPref(db, key, value) {
 }
 
 // ../server/dist/app.js
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
+function notFound(reply, message = "not found") {
+  return reply.code(404).send({ error: { code: "NOT_FOUND", message } });
+}
 async function createApp(db, opts = {}) {
   const app = Fastify({ logger: false });
   if (opts.enforceLoopbackHost !== false) {
     app.addHook("onRequest", async (req, reply) => {
-      const host = (req.headers.host ?? "").replace(/:\d+$/, "");
+      const host = (req.headers.host ?? "").replace(/:\d+$/, "").toLowerCase();
       if (!LOOPBACK_HOSTS.has(host)) {
         return reply.code(403).send({ error: { code: "FORBIDDEN_HOST", message: "non-loopback Host rejected" } });
       }
@@ -5564,7 +5565,7 @@ async function createApp(db, opts = {}) {
     if (!triageDb)
       return { value: null };
     const raw = getPref(triageDb, key);
-    return { value: raw == null ? null : JSON.parse(raw) };
+    return { value: safeJson(raw) };
   });
   app.put("/api/prefs/:key", async (req, reply) => {
     const { key } = req.params;
@@ -5590,22 +5591,22 @@ async function createApp(db, opts = {}) {
       errorType: q.error_type ? q.error_type.split(",").filter(Boolean) : void 0,
       sort: ["started", "title", "turns", "tokens", "cost", "duration", "errors", "security"].find((s) => s === q.sort),
       dir: q.dir === "asc" ? "asc" : q.dir === "desc" ? "desc" : void 0,
-      limit: Math.min(Number(q.limit) || 50, 200),
-      offset: Number(q.offset) || 0
+      limit: pageLimit(q.limit, 50, 200),
+      offset: pageOffset(q.offset)
     });
   });
   app.get("/api/sessions/:id", async (req, reply) => {
     const { id } = req.params;
     const result = getSession(db, id);
     if (!result)
-      return reply.code(404).send({ error: "not found" });
+      return notFound(reply);
     return result;
   });
   app.get("/api/workflows/:run_id", async (req, reply) => {
     const { run_id } = req.params;
     const result = getWorkflow(db, run_id);
     if (!result)
-      return reply.code(404).send({ error: "not found" });
+      return notFound(reply);
     return result;
   });
   app.get("/api/security/summary", async () => securitySummary(db));
@@ -5626,8 +5627,8 @@ async function createApp(db, opts = {}) {
       ...findingFilters(q),
       sort: ["severity", "session", "rule", "category", "time"].find((s) => s === q.sort),
       dir: q.dir === "asc" ? "asc" : q.dir === "desc" ? "desc" : void 0,
-      limit: Math.min(Number(q.limit) || 50, 5e3),
-      offset: Number(q.offset) || 0
+      limit: pageLimit(q.limit, 50, 5e3),
+      offset: pageOffset(q.offset)
     });
   });
   app.get("/api/security/mutes", async () => triageDb ? listMutes(triageDb) : []);
@@ -5680,9 +5681,15 @@ async function createApp(db, opts = {}) {
   });
   app.get("/api/skills/:name", async (req, reply) => {
     const { name } = req.params;
-    const result = getSkill(db, decodeURIComponent(name));
+    let decoded;
+    try {
+      decoded = decodeURIComponent(name);
+    } catch {
+      return reply.code(400).send({ error: { code: "BAD_NAME", message: "invalid skill name encoding" } });
+    }
+    const result = getSkill(db, decoded);
     if (!result)
-      return reply.code(404).send({ error: "not found" });
+      return notFound(reply);
     return result;
   });
   app.get("/api/files", async (req) => {
@@ -5694,17 +5701,17 @@ async function createApp(db, opts = {}) {
       project: q.project,
       sort,
       dir: q.dir === "asc" ? "asc" : "desc",
-      limit: Math.min(Number(q.limit) || 50, 200),
-      offset: Number(q.offset) || 0
+      limit: pageLimit(q.limit, 50, 200),
+      offset: pageOffset(q.offset)
     });
   });
   app.get("/api/file", async (req, reply) => {
     const q = req.query;
     if (!q.path)
-      return reply.code(400).send({ error: "missing path" });
+      return reply.code(400).send({ error: { code: "MISSING_PATH", message: "missing path" } });
     const result = getFileTimeline(db, q.path, q.project || void 0);
     if (!result)
-      return reply.code(404).send({ error: "not found" });
+      return notFound(reply);
     return result;
   });
   app.get("/api/sessions/:id/export.md", async (req, reply) => {
@@ -5712,14 +5719,14 @@ async function createApp(db, opts = {}) {
     const level = parseRedactionLevel(req.query.redact);
     const out = renderSessionExport(db, id, level);
     if (!out)
-      return reply.code(404).send({ error: "not found" });
+      return notFound(reply);
     reply.header("content-type", "text/markdown; charset=utf-8").header("content-disposition", `attachment; filename="${out.filename}"`).send(out.markdown);
   });
   if (opts.webDist && existsSync7(opts.webDist)) {
     await app.register(fastifyStatic, { root: opts.webDist });
     app.setNotFoundHandler((req, reply) => {
       if (req.url.startsWith("/api/"))
-        return reply.code(404).send({ error: "not found" });
+        return notFound(reply);
       return reply.sendFile("index.html");
     });
   }
@@ -5758,11 +5765,11 @@ async function startServer(overrides = {}) {
 
 // src/watch.ts
 import { existsSync as existsSync9 } from "fs";
-import { join as join12 } from "path";
+import { join as join10 } from "path";
 import chokidar from "chokidar";
 async function runWatch(opts = {}) {
   const sources = loadSources();
-  const lockPath = join12(resolveDataDir(findRepoRoot()), ".agent-lens.lock");
+  const lockPath = join10(resolveDataDir(findRepoRoot()), ".agent-lens.lock");
   let running = false;
   let pending = false;
   const cycle = () => {
@@ -5795,7 +5802,7 @@ async function runWatch(opts = {}) {
     }
   };
   cycle();
-  const watchPaths = sources.map((s) => join12(s.configDir, "projects")).filter((p) => existsSync9(p));
+  const watchPaths = sources.map((s) => join10(s.configDir, "projects")).filter((p) => existsSync9(p));
   if (watchPaths.length === 0) {
     console.error("agent-lens watch: no source 'projects' directories found \u2014 nothing to watch");
   }
@@ -5823,14 +5830,14 @@ async function runWatch(opts = {}) {
 // src/index.ts
 function version() {
   try {
-    const pkg = JSON.parse(readFileSync8(join13(dirname7(fileURLToPath3(import.meta.url)), "../package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync6(join11(dirname7(fileURLToPath3(import.meta.url)), "../package.json"), "utf8"));
     return pkg.version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }
 }
 function withLock(fn) {
-  const lockPath = join13(resolveDataDir(findRepoRoot()), ".agent-lens.lock");
+  const lockPath = join11(resolveDataDir(findRepoRoot()), ".agent-lens.lock");
   const lock = acquireLock(lockPath);
   if (!lock) {
     console.error("agent-lens: another collect/ingest run is in progress \u2014 skipping");