@usepowerplant/cli 0.3.1 → 0.3.2

package/dist/cli.js

@@ -36252,7 +36252,7 @@ ${captureLines}` : capture.stack;
 });
 
 // src/cli.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 import { existsSync as existsSync7, realpathSync as realpathSync2 } from "node:fs";
 import { parseArgs } from "node:util";
 
@@ -78652,7 +78652,7 @@ import os6 from "node:os";
 // ../../apps/collector/src/http.ts
 var import_undici = __toESM(require_undici(), 1);
 var CLI_VERSION_HEADER = "x-powerplant-cli-version";
-var cliVersion = true ? "0.3.1" : "0.0.0-checkout";
+var cliVersion = true ? "0.3.2" : "0.0.0-checkout";
 function cliVersionHeaders() {
   return { [CLI_VERSION_HEADER]: cliVersion, "user-agent": `powerplant-cli/${cliVersion}` };
 }
@@ -78729,30 +78729,78 @@ import os5 from "node:os";
 import path3 from "node:path";
 
 // ../../apps/collector/src/gitOwner.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
 import { readFileSync as readFileSync3, statSync } from "node:fs";
 import os4 from "node:os";
 import path2 from "node:path";
-function parseGithubRepo(remoteUrl) {
+var GITHUB_HOSTS = /* @__PURE__ */ new Set(["github.com", "ssh.github.com"]);
+function parseRemoteUrl(remoteUrl) {
   const trimmed = remoteUrl.trim();
-  const separator = trimmed.indexOf(":");
-  if (separator > 0) {
-    const authority = trimmed.slice(0, separator).split("@").at(-1)?.toLowerCase();
-    const [owner, rawRepo, extra] = trimmed.slice(separator + 1).split("/");
-    if (authority === "github.com" && owner && rawRepo && extra === void 0) {
-      const repo = rawRepo.toLowerCase().endsWith(".git") ? rawRepo.slice(0, -4) : rawRepo;
-      return `${owner.toLowerCase()}/${repo}`;
-    }
+  const colon = trimmed.indexOf(":");
+  if (!trimmed.includes("://") && colon > 0 && !trimmed.slice(0, colon).includes("/")) {
+    const host = trimmed.slice(0, colon).split("@").at(-1) ?? "";
+    return { host: host.toLowerCase(), path: trimmed.slice(colon + 1), overSsh: true };
   }
   try {
     const url2 = new URL(trimmed);
-    if (url2.hostname.toLowerCase() !== "github.com") return null;
-    const [owner, repo] = url2.pathname.split("/").filter(Boolean);
-    if (!owner || !repo) return null;
-    return `${owner.toLowerCase()}/${repo.replace(/\.git$/i, "")}`;
+    if (!url2.hostname) return null;
+    const scheme = url2.protocol.slice(0, -1).toLowerCase();
+    return {
+      host: url2.hostname.toLowerCase(),
+      path: url2.pathname,
+      overSsh: scheme === "ssh" || scheme === "git+ssh"
+    };
   } catch {
     return null;
   }
 }
+function parseGithubRepo(remoteUrl, sshHostnameOf = sshEffectiveHostname) {
+  const remote = parseRemoteUrl(remoteUrl);
+  if (!remote) return null;
+  const host = remote.overSsh && !GITHUB_HOSTS.has(remote.host) ? sshHostnameOf(remote.host)?.toLowerCase() : remote.host;
+  if (!host || !GITHUB_HOSTS.has(host)) return null;
+  const [owner, rawRepo, extra] = remote.path.split("/").filter(Boolean);
+  if (!owner || !rawRepo || extra !== void 0) return null;
+  return `${owner.toLowerCase()}/${rawRepo.replace(/\.git$/i, "")}`;
+}
+var SSH_PROBE_TIMEOUT_MS = 2e3;
+var SSH_PROBE_CACHE_TTL_MS = 5 * 6e4;
+var SSH_HOST_PATTERN = /^[a-z0-9][a-z0-9._-]*$/i;
+var sshProbeCache = /* @__PURE__ */ new Map();
+function sshEffectiveHostname(host, options = {}) {
+  if (!SSH_HOST_PATTERN.test(host)) return null;
+  const key = `${options.configFile ?? ""}\0${host}`;
+  const cached3 = sshProbeCache.get(key);
+  const now = Date.now();
+  if (cached3 && cached3.expiresAt > now) return cached3.hostname;
+  const hostname4 = probeSshHostname(host, options);
+  sshProbeCache.set(key, { hostname: hostname4, expiresAt: now + SSH_PROBE_CACHE_TTL_MS });
+  return hostname4;
+}
+function probeSshHostname(host, options) {
+  try {
+    const dump = execFileSync2(
+      "ssh",
+      ["-G", ...options.configFile ? ["-F", options.configFile] : [], host],
+      {
+        encoding: "utf8",
+        timeout: options.timeoutMs ?? SSH_PROBE_TIMEOUT_MS,
+        stdio: ["ignore", "pipe", "ignore"],
+        windowsHide: true
+      }
+    );
+    return hostnameFromSshConfigDump(dump);
+  } catch {
+    return null;
+  }
+}
+function hostnameFromSshConfigDump(dump) {
+  for (const line of dump.split("\n")) {
+    const match = /^hostname\s+(\S+)$/i.exec(line.trim());
+    if (match?.[1]) return match[1];
+  }
+  return null;
+}
 function parseOriginUrl(configText) {
   let inOrigin = false;
   for (const raw of configText.split("\n")) {
@@ -78818,17 +78866,17 @@ function findGitConfigPath(cwd, environment = {}) {
   const dirs = resolveGitDirs(cwd, environment);
   return dirs ? path2.join(dirs.commonDir, "config") : null;
 }
-function resolveGithubRepo(cwd, environment = {}) {
+function resolveGithubRepo(cwd, environment = {}, sshHostnameOf = sshEffectiveHostname) {
   const configPath = findGitConfigPath(cwd, environment);
   const configText = configPath ? readIfExists(configPath) : null;
   const remoteUrl = configText ? parseOriginUrl(configText) : null;
-  return remoteUrl ? parseGithubRepo(remoteUrl) : null;
+  return remoteUrl ? parseGithubRepo(remoteUrl, sshHostnameOf) : null;
 }
-function repoResolver(environment = {}) {
+function repoResolver(environment = {}, sshHostnameOf = sshEffectiveHostname) {
   const cache = /* @__PURE__ */ new Map();
   return (cwd) => {
     const key = path2.resolve(cwd);
-    if (!cache.has(key)) cache.set(key, resolveGithubRepo(key, environment));
+    if (!cache.has(key)) cache.set(key, resolveGithubRepo(key, environment, sshHostnameOf));
     return cache.get(key);
   };
 }
@@ -78860,17 +78908,18 @@ var captureEverythingUnresolved = {
 function captureDecision(cwd, policy) {
   switch (policy.mode) {
     case "scope":
-      return cwd !== void 0 && isWithinScope(cwd, policy.scopePaths, policy.environment) ? memberChoice(cwd, policy) : { capture: false };
+      if (cwd === void 0) return { capture: false, reason: "no-cwd" };
+      return isWithinScope(cwd, policy.scopePaths, policy.environment) ? memberChoice(cwd, policy) : { capture: false, reason: "outside-policy" };
     case "org-repos": {
-      if (cwd === void 0) return { capture: false };
+      if (cwd === void 0) return { capture: false, reason: "no-cwd" };
       if (policy.memberFolders.length > 0 && isWithinScope(cwd, policy.memberFolders, policy.environment)) {
         return memberChoice(cwd, policy);
       }
       const repoFullName = policy.repoOf(cwd);
-      if (repoFullName === null) return { capture: false };
+      if (repoFullName === null) return { capture: false, reason: "no-github-repo" };
       const repo = repoFullName.toLowerCase();
       const admitted = policy.allowedRepos !== null ? policy.allowedRepos.includes(repo) : policy.allowedOwners.length > 0 && policy.allowedOwners.includes(ownerOfRepo(repo));
-      return admitted ? { capture: true, via: "org-policy", repoFullName } : { capture: false };
+      return admitted ? { capture: true, via: "org-policy", repoFullName } : { capture: false, reason: "outside-policy" };
     }
   }
 }
@@ -78893,7 +78942,7 @@ function describeCapturePolicy(policy) {
     case "scope":
       return `sessions under ${policy.scopePaths.join(", ")}`;
     case "org-repos": {
-      const repoPart = policy.allowedRepos !== null ? policy.allowedRepos.length > 0 ? `sessions in the org's synced repos: ${listSome(policy.allowedRepos)}` : "the org's synced repo list is empty \u2014 no repo-based uploads" : policy.allowedOwners.length > 0 ? `sessions in GitHub repos owned by ${policy.allowedOwners.join(", ")}` : "org-owned GitHub repos \u2014 but the org has no GitHub integration, so nothing uploads";
+      const repoPart = policy.allowedRepos !== null ? policy.allowedRepos.length > 0 ? `sessions in the org's allowlisted repos: ${listSome(policy.allowedRepos)}` : "the org's repo allowlist is empty \u2014 no repo-based uploads" : policy.allowedOwners.length > 0 ? `sessions in GitHub repos owned by ${policy.allowedOwners.join(", ")}` : "org-owned GitHub repos \u2014 but the org has no GitHub integration, so nothing uploads";
       return policy.memberFolders.length > 0 ? `${repoPart}, plus folders you added: ${policy.memberFolders.join(", ")}` : repoPart;
     }
   }
@@ -78914,10 +78963,17 @@ function describeStoredCapture(credentials) {
     repoOf: () => null
   });
 }
-function describeSkipReason(policy, platform2 = process.platform) {
+function countCaptureSkip(skips, reason) {
+  if (reason === "outside-policy") skips.skippedOutOfScope += 1;
+  else skips.skippedNoRepo += 1;
+}
+function describeSkipReason(policy) {
   if (policy.mode !== "org-repos") return "outside the sync boundary, stayed local";
-  const boundary = policy.allowedRepos !== null ? "outside the org's synced repos" : "not in org-owned repos";
-  return platform2 === "darwin" ? `${boundary} or in macOS-protected folders, stayed local (run \`powerplant init\` to review Git repository scanning)` : `${boundary}, stayed local`;
+  return policy.allowedRepos !== null ? "outside the org's allowlisted repos, stayed local" : "not in org-owned repos, stayed local";
+}
+function describeNoRepoSkipReason(policy, platform2 = process.platform) {
+  if (policy.mode !== "org-repos") return "with no working directory recorded, stayed local";
+  return platform2 === "darwin" ? "with no readable GitHub repo or in macOS-protected folders, stayed local (run `powerplant init` to review Git repository scanning)" : "with no readable GitHub repo, stayed local";
 }
 function normalizeScopePath(raw) {
   const expanded = raw === "~" || raw.startsWith("~/") ? path3.join(os5.homedir(), raw.slice(1)) : raw;
@@ -78939,6 +78995,37 @@ function isPathWithinScopes(resolved, scopePaths) {
   );
 }
 
+// ../../apps/collector/src/syncWindow.ts
+var STEADY_SYNC_WINDOW_DAYS = 3;
+var DEEP_FIRST_SYNC_DAYS = 90;
+var DEEP_FIRST_SYNC_MAX_SESSIONS = 100;
+function resolveSyncWindow(explicitSince, deepSyncedAt) {
+  if (explicitSince !== void 0) {
+    const days = Number(explicitSince);
+    if (!Number.isFinite(days) || days <= 0) {
+      throw new ExpectedCliError(`--since must be a positive number of days, got "${explicitSince}"`);
+    }
+    return { days, deepSweep: false };
+  }
+  if (deepSyncedAt === void 0) return { days: DEEP_FIRST_SYNC_DAYS, deepSweep: true };
+  return { days: STEADY_SYNC_WINDOW_DAYS, deepSweep: false };
+}
+var DAY_MS = 24 * 60 * 60 * 1e3;
+function resolveScanFloor(window2, nowMs, narrowSinceMs) {
+  if (window2.deepSweep || narrowSinceMs === void 0) return nowMs - window2.days * DAY_MS;
+  return narrowSinceMs;
+}
+function rawShipFloorMs(appEnv, nowMs, explicitSince) {
+  if (appEnv !== "development" || explicitSince !== void 0) return null;
+  return nowMs - STEADY_SYNC_WINDOW_DAYS * DAY_MS;
+}
+function describeScanReach(window2, narrowSinceMs) {
+  if (window2.deepSweep || narrowSinceMs === void 0) {
+    return `from the last ${window2.days} day(s)`;
+  }
+  return `changed since ${new Date(narrowSinceMs).toISOString()}`;
+}
+
 // ../../apps/collector/src/upload.ts
 import { readFileSync as readFileSync4 } from "node:fs";
 import { gzipSync } from "node:zlib";
@@ -79257,6 +79344,9 @@ async function runEnrollment(config2, options) {
   log3(`Enrolled "${result.machine.name}" (${result.machine.id}) into org "${result.org.name}".`);
   log3(`Machine token stored in ${location}.`);
   log3(`Syncing: ${describeCapturePolicy(policy)}.`);
+  log3(
+    `First sync backfills up to the ${DEEP_FIRST_SYNC_MAX_SESSIONS} most recently active of those sessions from the last ${DEEP_FIRST_SYNC_DAYS} days; later syncs cover the last ${STEADY_SYNC_WINDOW_DAYS} days.`
+  );
   return credentials;
 }
 async function enroll(config2, options, createAuthClient = gotrueAuthClient) {
@@ -79453,7 +79543,7 @@ function addFolder(config2, rawPath, enrollCommand, log3, deps = defaultDeps) {
   });
   const org = credentials.orgName ?? "your org";
   log3(
-    credentials.captureMode === "org-repos" ? `Sessions under ${folder} will now upload to ${org} \u2014 even outside the org's synced repos.` : `Added ${folder} to this machine's sync boundary.`
+    credentials.captureMode === "org-repos" ? `Sessions under ${folder} will now upload to ${org} \u2014 even outside the org's allowlisted repos.` : `Added ${folder} to this machine's sync boundary.`
   );
   log3("Takes effect on the next sync pass; run the sync command to apply now.");
 }
@@ -79570,6 +79660,10 @@ function readIfExists2(file2) {
     throw error52;
   }
 }
+var MAX_TRANSCRIPT_FILE_BYTES = 256 * 1024 * 1024;
+function describeReadError(error52) {
+  return error52 instanceof Error ? error52.message : String(error52);
+}
 
 // ../../apps/collector/src/lifecycleJournal.ts
 var LIFECYCLE_JOURNAL_FILENAME = "session-lifecycle.jsonl";
@@ -79660,7 +79754,7 @@ async function collectClaudeCodeSessions(options = {}) {
   const capture = options.capture ?? captureEverythingUnresolved;
   const projectsDir = path5.join(claudeDir, "projects");
   const items = [];
-  let skippedOutOfScope = 0;
+  const skips = { skippedOutOfScope: 0, skippedNoRepo: 0 };
   const home = path5.dirname(claudeDir);
   const lifecycle = options.lifecycle ?? readLifecycleJournal(home);
   for (const projectDir of listDirs(projectsDir)) {
@@ -79677,7 +79771,7 @@ async function collectClaudeCodeSessions(options = {}) {
         const cwd = transcriptCwd(transcriptPath);
         const decision2 = captureDecision(cwd, capture);
         if (!decision2.capture) {
-          skippedOutOfScope += 1;
+          countCaptureSkip(skips, decision2.reason);
           continue;
         }
         items.push({
@@ -79694,7 +79788,7 @@ async function collectClaudeCodeSessions(options = {}) {
       if (!summary) continue;
       const decision = captureDecision(summary.cwd, capture);
       if (!decision.capture) {
-        skippedOutOfScope += 1;
+        countCaptureSkip(skips, decision.reason);
         continue;
       }
       const usage = addSubagentUsage(summary.usage, path5.join(projectDir, sessionId, "subagents"));
@@ -79731,7 +79825,7 @@ async function collectClaudeCodeSessions(options = {}) {
   }
   return {
     sessions: items.sort((a, b2) => b2.mtimeMs - a.mtimeMs),
-    skippedOutOfScope
+    ...skips
   };
 }
 function transcriptCwd(transcriptPath) {
@@ -79875,54 +79969,95 @@ async function collectCodexSessions(options = {}) {
   const sessionsDir = options.codexDir ?? path6.join(os8.homedir(), ".codex", "sessions");
   const now = options.now ?? Date.now();
   const capture = options.capture ?? captureEverythingUnresolved;
-  const threadNames = options.locationsOnly ? /* @__PURE__ */ new Map() : loadThreadNames(sessionsDir);
+  const maxBytes = options.maxTranscriptBytes ?? MAX_TRANSCRIPT_FILE_BYTES;
   const items = [];
-  let skippedOutOfScope = 0;
+  const candidates = [];
+  const unreadable = [];
+  const skips = { skippedOutOfScope: 0, skippedNoRepo: 0 };
   let skippedSubagentThreads = 0;
-  const collectFrom = async (rootDir, archived) => {
+  let skippedTooLarge = 0;
+  const externalIdOf = (rolloutPath) => path6.basename(rolloutPath, ".jsonl");
+  const admitFrom = async (rootDir, archived) => {
     for (const rolloutPath of rolloutFiles(rootDir)) {
       await yieldToEventLoop2();
       const stat = statIfExists(rolloutPath);
       if (!stat) continue;
       if (options.sinceMs !== void 0 && Math.max(stat.mtimeMs, stat.ctimeMs) < options.sinceMs)
         continue;
-      const summary = options.locationsOnly ? rolloutLocation(rolloutPath) : parseRolloutFile(rolloutPath);
-      if (!summary) continue;
-      if (summary.kind === "subagent") {
-        skippedSubagentThreads += 1;
-        continue;
-      }
-      const decision = captureDecision(summary.cwd, capture);
-      if (!decision.capture) {
-        skippedOutOfScope += 1;
+      if (stat.size > maxBytes) {
+        skippedTooLarge += 1;
         continue;
       }
-      if (options.locationsOnly) {
-        items.push({
+      try {
+        const location = rolloutLocation(rolloutPath);
+        if (location.kind === "subagent") {
+          skippedSubagentThreads += 1;
+          continue;
+        }
+        const decision = captureDecision(location.cwd, capture);
+        if (!decision.capture) {
+          countCaptureSkip(skips, decision.reason);
+          continue;
+        }
+        if (options.locationsOnly) {
+          items.push({
+            mtimeMs: stat.mtimeMs,
+            transcriptPath: rolloutPath,
+            ...location.cwd && { cwd: location.cwd },
+            item: {
+              source: "codex",
+              externalId: externalIdOf(rolloutPath),
+              status: now - stat.mtimeMs < ACTIVE_GRACE_MS ? "active" : "inactive",
+              archived,
+              capturedVia: decision.via
+            }
+          });
+          continue;
+        }
+        candidates.push({
+          rolloutPath,
+          archived,
           mtimeMs: stat.mtimeMs,
-          transcriptPath: rolloutPath,
-          ...summary.cwd && { cwd: summary.cwd },
-          item: {
-            source: "codex",
-            externalId: path6.basename(rolloutPath, ".jsonl"),
-            status: now - stat.mtimeMs < ACTIVE_GRACE_MS ? "active" : "inactive",
-            archived,
-            capturedVia: decision.via
-          }
+          ...location.cwd && { cwd: location.cwd },
+          decision
         });
-        continue;
+      } catch (error52) {
+        unreadable.push(`${externalIdOf(rolloutPath)}: ${describeReadError(error52)}`);
       }
-      const repoDir = summary.repoName ?? (summary.cwd ? path6.basename(summary.cwd) : void 0);
+    }
+  };
+  await admitFrom(sessionsDir, false);
+  await admitFrom(codexArchivedSessionsDir(sessionsDir), true);
+  if (options.locationsOnly) {
+    return {
+      sessions: items.sort((a, b2) => b2.mtimeMs - a.mtimeMs),
+      ...skips,
+      skippedSubagentThreads,
+      skippedTooLarge,
+      unreadable,
+      heldBack: 0
+    };
+  }
+  candidates.sort((a, b2) => b2.mtimeMs - a.mtimeMs);
+  const chosen = options.maxSessions === void 0 ? candidates : candidates.slice(0, options.maxSessions);
+  const threadNames = chosen.length > 0 ? loadThreadNames(sessionsDir) : /* @__PURE__ */ new Map();
+  for (const candidate of chosen) {
+    await yieldToEventLoop2();
+    const { rolloutPath, archived, mtimeMs, cwd, decision } = candidate;
+    try {
+      const summary = parseRolloutFile(rolloutPath);
+      if (!summary) continue;
+      const repoDir = summary.repoName ?? (cwd ? path6.basename(cwd) : void 0);
       const repoFullName = decision.repoFullName ?? summary.repoFullName;
       const title = summary.sessionId ? threadNames.get(summary.sessionId) : void 0;
       items.push({
-        mtimeMs: stat.mtimeMs,
+        mtimeMs,
         transcriptPath: rolloutPath,
-        ...summary.cwd && { cwd: summary.cwd },
+        ...cwd && { cwd },
         item: {
           source: "codex",
-          externalId: path6.basename(rolloutPath, ".jsonl"),
-          status: now - stat.mtimeMs < ACTIVE_GRACE_MS ? "active" : "inactive",
+          externalId: externalIdOf(rolloutPath),
+          status: now - mtimeMs < ACTIVE_GRACE_MS ? "active" : "inactive",
           archived,
           ...summary.startedAt && { startedAt: summary.startedAt },
           ...summary.endedAt && { endedAt: summary.endedAt },
@@ -79940,14 +80075,17 @@ async function collectCodexSessions(options = {}) {
           capturedVia: decision.via
         }
       });
+    } catch (error52) {
+      unreadable.push(`${externalIdOf(rolloutPath)}: ${describeReadError(error52)}`);
     }
-  };
-  await collectFrom(sessionsDir, false);
-  await collectFrom(codexArchivedSessionsDir(sessionsDir), true);
+  }
   return {
     sessions: items.sort((a, b2) => b2.mtimeMs - a.mtimeMs),
-    skippedOutOfScope,
-    skippedSubagentThreads
+    ...skips,
+    skippedSubagentThreads,
+    skippedTooLarge,
+    unreadable,
+    heldBack: candidates.length - chosen.length
   };
 }
 
@@ -79975,6 +80113,7 @@ function cursorSpoolDir(home) {
 var emptyResult = () => ({
   sessions: [],
   skippedOutOfScope: 0,
+  skippedNoRepo: 0,
   skippedSubagentComposers: 0,
   skippedNonLocalComposers: 0,
   skippedUnreadable: 0,
@@ -80225,7 +80364,7 @@ function collectFromStore(db, userDir, options, result) {
       const cwd = facts.workspacePath ?? workspaceFolderOf(userDir, workspaceId);
       const decision = captureDecision(cwd, capture);
       if (!decision.capture) {
-        result.skippedOutOfScope += 1;
+        countCaptureSkip(result, decision.reason);
         continue;
       }
       if (options.locationsOnly) {
@@ -80306,36 +80445,6 @@ function collectFromStore(db, userDir, options, result) {
   }
 }
 
-// ../../apps/collector/src/syncWindow.ts
-var STEADY_SYNC_WINDOW_DAYS = 3;
-var DEEP_FIRST_SYNC_DAYS = 90;
-function resolveSyncWindow(explicitSince, deepSyncedAt) {
-  if (explicitSince !== void 0) {
-    const days = Number(explicitSince);
-    if (!Number.isFinite(days) || days <= 0) {
-      throw new ExpectedCliError(`--since must be a positive number of days, got "${explicitSince}"`);
-    }
-    return { days, deepSweep: false };
-  }
-  if (deepSyncedAt === void 0) return { days: DEEP_FIRST_SYNC_DAYS, deepSweep: true };
-  return { days: STEADY_SYNC_WINDOW_DAYS, deepSweep: false };
-}
-var DAY_MS = 24 * 60 * 60 * 1e3;
-function resolveScanFloor(window2, nowMs, narrowSinceMs) {
-  if (window2.deepSweep || narrowSinceMs === void 0) return nowMs - window2.days * DAY_MS;
-  return narrowSinceMs;
-}
-function rawShipFloorMs(appEnv, nowMs, explicitSince) {
-  if (appEnv !== "development" || explicitSince !== void 0) return null;
-  return nowMs - STEADY_SYNC_WINDOW_DAYS * DAY_MS;
-}
-function describeScanReach(window2, narrowSinceMs) {
-  if (window2.deepSweep || narrowSinceMs === void 0) {
-    return `from the last ${window2.days} day(s)`;
-  }
-  return `changed since ${new Date(narrowSinceMs).toISOString()}`;
-}
-
 // ../../apps/collector/src/protectedRepoDiscovery.ts
 var defaultDiscoveryDeps = {
   collectClaude: collectClaudeCodeSessions,
@@ -80512,7 +80621,7 @@ function installCollectorHooks(homeDir = os11.homedir()) {
 }
 
 // ../../apps/collector/src/service.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 import { chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync7, rmSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "node:fs";
 import os12 from "node:os";
 import path10 from "node:path";
@@ -80660,7 +80769,7 @@ function restartService(config2) {
 }
 function runLaunchctl(args) {
   try {
-    execFileSync2("launchctl", args, { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
+    execFileSync3("launchctl", args, { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
   } catch (cause) {
     throw new Error(launchctlFailureMessage(args[0] ?? "", cause), { cause });
   }
@@ -80675,7 +80784,7 @@ function launchctlFailureMessage(subcommand, cause) {
 }
 function isLoaded(appEnv) {
   try {
-    execFileSync2("launchctl", ["print", `gui/${uid()}/${label(appEnv)}`], { stdio: "ignore" });
+    execFileSync3("launchctl", ["print", `gui/${uid()}/${label(appEnv)}`], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -80683,7 +80792,7 @@ function isLoaded(appEnv) {
 }
 function bootout(appEnv) {
   try {
-    execFileSync2("launchctl", ["bootout", `gui/${uid()}/${label(appEnv)}`], { stdio: "ignore" });
+    execFileSync3("launchctl", ["bootout", `gui/${uid()}/${label(appEnv)}`], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -81014,7 +81123,7 @@ async function resolveCapturePolicy(config2, credentials, log3, deps = defaultPo
   }
   if (repos !== null && repos.length === 0) {
     log3(
-      "\u26A0 The org's synced repo list is empty \u2014 no repo-based uploads" + (memberFolders.length > 0 ? "; only folders you added upload." : ".")
+      "\u26A0 The org's repo allowlist is empty \u2014 no repo-based uploads" + (memberFolders.length > 0 ? "; only folders you added upload." : ".")
     );
   } else if (repos === null && owners.length === 0 && !ownersUnresolved) {
     log3(
@@ -81041,26 +81150,31 @@ async function runSyncPass(config2, options = {}) {
   const window2 = resolveSyncWindow(options.explicitSince, credentials.deepSyncedAt);
   if (window2.deepSweep) {
     log3(
-      `First sync for this enrollment \u2014 sweeping the last ${window2.days} days to backfill transcripts already on this machine (later syncs cover ${STEADY_SYNC_WINDOW_DAYS}).`
+      `First sync for this enrollment \u2014 sweeping the last ${window2.days} days and backfilling up to the ${DEEP_FIRST_SYNC_MAX_SESSIONS} most recently active sessions already on this machine (later syncs cover ${STEADY_SYNC_WINDOW_DAYS} days).`
     );
   }
   const capture = await resolveCapturePolicy(config2, credentials, log3);
   const sinceMs = resolveScanFloor(window2, Date.now(), options.narrowSinceMs);
+  const maxSessions = window2.deepSweep ? DEEP_FIRST_SYNC_MAX_SESSIONS : void 0;
   const claude = await collectClaudeCodeSessions({ sinceMs, capture });
-  const codex = await collectCodexSessions({ sinceMs, capture });
+  const codex = await collectCodexSessions({ sinceMs, capture, maxSessions });
   const cursor = await collectCursorSessions({ sinceMs, capture });
   if (cursor.unavailable !== null) {
     log3(`\u26A0 Cursor sessions skipped this pass \u2014 ${cursor.unavailable}. Other syncing is unaffected.`);
   }
-  const collected = [...claude.sessions, ...codex.sessions, ...cursor.sessions].sort(
+  const inWindow = [...claude.sessions, ...codex.sessions, ...cursor.sessions].sort(
     (a, b2) => b2.mtimeMs - a.mtimeMs
   );
+  const collected = maxSessions === void 0 ? inWindow : inWindow.slice(0, maxSessions);
+  const heldBack = inWindow.length - collected.length + codex.heldBack;
   const skippedOutOfScope = claude.skippedOutOfScope + codex.skippedOutOfScope + cursor.skippedOutOfScope;
+  const skippedNoRepo = claude.skippedNoRepo + codex.skippedNoRepo + cursor.skippedNoRepo;
   const items = collected.map((c) => c.item);
   const active = items.filter((s) => s.status === "active").length;
   log3(
-    `Found ${items.length} local session(s) (${claude.sessions.length} claude, ${codex.sessions.length} codex, ${cursor.sessions.length} cursor) ` + describeScanReach(window2, options.narrowSinceMs) + (active > 0 ? ` (${active} still active)` : "") + (skippedOutOfScope > 0 ? ` \xB7 ${skippedOutOfScope} ${describeSkipReason(capture)}` : "") + (codex.skippedSubagentThreads > 0 ? ` \xB7 ${codex.skippedSubagentThreads} codex subagent thread(s) skipped (spend unmeasured)` : "") + (cursor.skippedSubagentComposers > 0 ? ` \xB7 ${cursor.skippedSubagentComposers} cursor subagent thread(s) skipped` : "") + (cursor.skippedNonLocalComposers > 0 ? ` \xB7 ${cursor.skippedNonLocalComposers} cursor session(s) skipped (not local to this machine)` : "") + (cursor.skippedUnreadable > 0 ? ` \xB7 ${cursor.skippedUnreadable} cursor session(s) unreadable, skipped` : "") + "."
+    `Found ${inWindow.length} local session(s) (${claude.sessions.length} claude, ${codex.sessions.length} codex, ${cursor.sessions.length} cursor) ` + describeScanReach(window2, options.narrowSinceMs) + (active > 0 ? ` (${active} still active)` : "") + (skippedOutOfScope > 0 ? ` \xB7 ${skippedOutOfScope} ${describeSkipReason(capture)}` : "") + (skippedNoRepo > 0 ? ` \xB7 ${skippedNoRepo} ${describeNoRepoSkipReason(capture)}` : "") + (codex.skippedSubagentThreads > 0 ? ` \xB7 ${codex.skippedSubagentThreads} codex subagent thread(s) skipped (spend unmeasured)` : "") + (cursor.skippedSubagentComposers > 0 ? ` \xB7 ${cursor.skippedSubagentComposers} cursor subagent thread(s) skipped` : "") + (cursor.skippedNonLocalComposers > 0 ? ` \xB7 ${cursor.skippedNonLocalComposers} cursor session(s) skipped (not local to this machine)` : "") + (cursor.skippedUnreadable > 0 ? ` \xB7 ${cursor.skippedUnreadable} cursor session(s) unreadable, skipped` : "") + (codex.skippedTooLarge > 0 ? ` \xB7 ${codex.skippedTooLarge} codex rollout(s) skipped (over ${MAX_TRANSCRIPT_FILE_BYTES / (1024 * 1024)}MB \u2014 too large to read)` : "") + (codex.unreadable.length > 0 ? ` \xB7 ${codex.unreadable.length} codex rollout(s) unreadable, skipped` : "") + (heldBack > 0 ? ` \xB7 ${heldBack} older session(s) held back \u2014 the first sync backfills the ${DEEP_FIRST_SYNC_MAX_SESSIONS} most recently active` : "") + "."
   );
+  for (const failure of codex.unreadable) log3(`  codex rollout skipped \u2014 ${failure}`);
   if (options.dryRun) {
     for (const s of items.slice(0, 10)) {
       log3(`  ${s.externalId}  ${s.model ?? "model unmeasured"}  ${s.title ?? "(untitled)"}`);
@@ -81198,7 +81312,7 @@ import os14 from "node:os";
 import path14 from "node:path";
 
 // ../../apps/collector/src/wake.ts
-import { execFile as execFile2, execFileSync as execFileSync3 } from "node:child_process";
+import { execFile as execFile2, execFileSync as execFileSync4 } from "node:child_process";
 import { existsSync as existsSync3 } from "node:fs";
 import path13 from "node:path";
 var WAKE_POLL_MS = 5e3;
@@ -81300,7 +81414,7 @@ function resolveClaudeBin(homeDir, env = process.env) {
   const found = candidates.find((candidate) => existsSync3(candidate));
   if (found) return found;
   try {
-    const fromPath = execFileSync3("which", ["claude"], { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+    const fromPath = execFileSync4("which", ["claude"], { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
     return fromPath === "" ? null : fromPath;
   } catch {
     return null;
@@ -81322,7 +81436,7 @@ function versionAtLeast(version2, floor) {
   return true;
 }
 function execClaudeVersion(claudeBin) {
-  return execFileSync3(claudeBin, ["--version"], {
+  return execFileSync4(claudeBin, ["--version"], {
     stdio: ["ignore", "pipe", "ignore"],
     timeout: VERSION_TIMEOUT_MS
   }).toString();
@@ -81896,7 +82010,7 @@ function describeError3(error52) {
 }
 
 // src/connect.ts
-import { execFileSync as execFileSync4, spawnSync } from "node:child_process";
+import { execFileSync as execFileSync5, spawnSync } from "node:child_process";
 import {
   existsSync as existsSync5,
   mkdirSync as mkdirSync6,
@@ -82122,7 +82236,7 @@ function desktopClaudeBinaries(homeDir) {
 }
 function defaultWhichAll(name) {
   try {
-    return execFileSync4("which", ["-a", name], { encoding: "utf8" }).split("\n").map((line) => line.trim()).filter(Boolean);
+    return execFileSync5("which", ["-a", name], { encoding: "utf8" }).split("\n").map((line) => line.trim()).filter(Boolean);
   } catch {
     return [];
   }
@@ -82915,7 +83029,7 @@ function realRunInteractive(bin, args, env) {
 }
 
 // src/connections.ts
-import { execFileSync as execFileSync5, spawnSync as spawnSync2 } from "node:child_process";
+import { execFileSync as execFileSync6, spawnSync as spawnSync2 } from "node:child_process";
 import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "node:fs";
 import path16 from "node:path";
 function probeConnections(clients, deps) {
@@ -83118,7 +83232,7 @@ function runWithPath(pathValue, budget = UNLIMITED_TIME_BUDGET) {
 function whichAllWith(pathValue) {
   return (name) => {
     try {
-      return execFileSync5("which", ["-a", name], {
+      return execFileSync6("which", ["-a", name], {
         encoding: "utf8",
         env: { ...process.env, PATH: pathValue }
       }).split("\n").map((line) => line.trim()).filter(Boolean);
@@ -83136,7 +83250,7 @@ function renderStatus(i) {
   const lines = [];
   lines.push(`Environment: ${i.config.appEnv} (API ${i.config.apiUrl})`);
   lines.push(
-    `CLI: powerplant ${i.cliVersion}` + (i.latestVersion !== null && i.latestVersion !== i.cliVersion ? ` \u2014 ${i.latestVersion} is available: npm install -g @usepowerplant/cli (the service restarts itself onto it)` : "")
+    `CLI: powerplant ${i.cliVersion}` + (i.latestVersion !== null && i.latestVersion !== i.cliVersion ? ` \u2014 ${i.latestVersion} is available: powerplant update` : "")
   );
   const unsupported = unsupportedVersionNotice(i.cliVersion, i.oldestSupportedVersion);
   if (unsupported !== null) lines.push(unsupported);
@@ -83607,7 +83721,7 @@ async function realPromptLine(question) {
 }
 
 // src/memberSessions.ts
-import { execFileSync as execFileSync6 } from "node:child_process";
+import { execFileSync as execFileSync7 } from "node:child_process";
 import { existsSync as existsSync6 } from "node:fs";
 import os16 from "node:os";
 import path17 from "node:path";
@@ -83682,7 +83796,7 @@ function detectCodexDesktop(probe = { exists: existsSync6, readUrlSchemes: realR
 function realReadUrlSchemes(bundlePath) {
   if (process.platform !== "darwin") return [];
   try {
-    const json2 = execFileSync6(
+    const json2 = execFileSync7(
       "plutil",
       ["-extract", "CFBundleURLTypes", "json", "-o", "-", path17.join(bundlePath, "Contents", "Info.plist")],
       { stdio: ["ignore", "pipe", "ignore"] }
@@ -84139,8 +84253,38 @@ function createTerminalOutput(options) {
   return { log: log3, activity };
 }
 
+// src/update.ts
+import { spawnSync as spawnSync4 } from "node:child_process";
+var npmLsSchema = external_exports.object({
+  dependencies: external_exports.record(external_exports.string(), external_exports.object({ version: external_exports.string().min(1) })).optional()
+});
+function runCapturing(command, args) {
+  const result = spawnSync4(command, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  return { stdout: result.stdout ?? "" };
+}
+function installedGlobalVersion(packageName, run = runCapturing) {
+  const { stdout } = run("npm", ["ls", "-g", packageName, "--json"]);
+  try {
+    const parsed = npmLsSchema.safeParse(JSON.parse(stdout));
+    return parsed.success ? parsed.data.dependencies?.[packageName]?.version ?? null : null;
+  } catch {
+    return null;
+  }
+}
+var RESTART_NOTE = "Sync service will restart within minutes. (You can do this now with powerplant restart.)";
+function updatedMessage(version2) {
+  if (version2 === null) {
+    return `Updated, but could not read the installed version from npm. Check with: powerplant status
+${RESTART_NOTE}`;
+  }
+  return `Updated to v${version2}. ${RESTART_NOTE}`;
+}
+
 // src/version.ts
-var CLI_VERSION = true ? "0.3.1" : "0.0.0-checkout";
+var CLI_VERSION = true ? "0.3.2" : "0.0.0-checkout";
 var CLI_PACKAGE_NAME = "@usepowerplant/cli";
 
 // src/workspace.ts
@@ -84261,7 +84405,7 @@ Commands:
   sync        Run one sync pass in the foreground [--since <days>] [--dry-run].
   folders     The folders you explicitly sync on this machine:
               powerplant folders [add <path> | remove <path>]. Additions on
-              top of your org's synced repos \u2014 no re-enroll needed.
+              top of your org's allowlisted repos \u2014 no re-enroll needed.
   workspace   Your workspaces, and which one Powerplant and your connected
               agents use: powerplant workspace [<name>] switches to <name>.
   resume-session  Reopen a synced session in its own CLI, right here in
@@ -84573,7 +84717,7 @@ The access you granted these agents stays on your Powerplant account until you r
     }
     case "update": {
       console.log(`Updating ${CLI_PACKAGE_NAME} via npm\u2026`);
-      const npm = spawnSync4("npm", ["install", "-g", CLI_PACKAGE_NAME], { stdio: "inherit" });
+      const npm = spawnSync5("npm", ["install", "-g", CLI_PACKAGE_NAME], { stdio: "inherit" });
       if (npm.error) {
         throw new ExpectedCliError(
           `Could not run npm (${npm.error.message}) \u2014 update by hand: npm install -g ${CLI_PACKAGE_NAME}`
@@ -84582,9 +84726,7 @@ The access you granted these agents stays on your Powerplant account until you r
       if (npm.status !== 0) {
         throw new ExpectedCliError("npm install failed \u2014 see the output above.");
       }
-      console.log(
-        "Updated. The background service restarts itself onto the new version within minutes (or now: powerplant restart)."
-      );
+      console.log(updatedMessage(installedGlobalVersion(CLI_PACKAGE_NAME)));
       return;
     }
     case "restart": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usepowerplant/cli",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "publishConfig": {
     "access": "public"
   },