@usepowerplant/cli 0.3.2 → 0.4.0

package/dist/cli.js

@@ -50833,6 +50833,17 @@ function capturedSessionEvents(turns, anchor) {
   return events;
 }
 
+// ../core/src/workspaceClaims.ts
+function workspaceClaimsRepo(repoFullName, policy) {
+  const repo = repoFullName.toLowerCase();
+  if (policy.repos !== null) return policy.repos.includes(repo);
+  const owner = repo.split("/")[0] ?? "";
+  return policy.owners.length > 0 && policy.owners.includes(owner);
+}
+function workspaceClaimsAnyRepo(policy) {
+  return policy.repos !== null ? policy.repos.length > 0 : policy.owners.length > 0;
+}
+
 // ../core/src/transcriptImages.ts
 var IMAGE_DATA_URI_RE = /^data:(image\/[\w.+-]+);base64,([A-Za-z0-9+/=_-]*)$/;
 function isImageDataUri(value) {
@@ -51693,6 +51704,8 @@ var SESSION_SOURCES = [
   "cursor-cloud",
   "github-pr"
 ];
+var SESSION_SPEED_MODES = ["standard", "fast"];
+var SESSION_SPEED_OBSERVATIONS = [...SESSION_SPEED_MODES, "unknown"];
 function isSessionSource(source) {
   return typeof source === "string" && SESSION_SOURCES.includes(source);
 }
@@ -78558,6 +78571,23 @@ var storedCredentialsSchema = external_exports.object({
    * alongside the owners. Absent = the org has no list — the owner check
    * decides (and pre-list enrollments read the same way). */
   allowedRepos: external_exports.array(external_exports.string()).optional(),
+  /** org-repos mode: per-workspace claim policies across every workspace
+   * the member belongs to (home first), refreshed every sync — the union
+   * an offline pass still filters with. Absent = cached before routing;
+   * the flat fields above are the whole boundary. */
+  workspacePolicies: external_exports.array(
+    external_exports.object({
+      orgId: external_exports.string().min(1),
+      name: external_exports.string(),
+      owners: external_exports.array(external_exports.string()),
+      repos: external_exports.array(external_exports.string()).nullable(),
+      /** This entry's claims were UNRESOLVED when cached (a linked
+       * installation whose account failed to resolve, nothing usable to
+       * stand in) — unknown, never "claims nothing". A pass reading only
+       * the cache must not stamp a deep sweep done over it. */
+      unresolved: external_exports.literal(true).optional()
+    })
+  ).optional(),
   /** Folders this member explicitly chose. Under scope mode they are the
    * whole boundary (never empty — enrollment requires at least one); under
    * org-repos they are additions on top of the org policy
@@ -78652,7 +78682,7 @@ import os6 from "node:os";
 // ../../apps/collector/src/http.ts
 var import_undici = __toESM(require_undici(), 1);
 var CLI_VERSION_HEADER = "x-powerplant-cli-version";
-var cliVersion = true ? "0.3.2" : "0.0.0-checkout";
+var cliVersion = true ? "0.4.0" : "0.0.0-checkout";
 function cliVersionHeaders() {
   return { [CLI_VERSION_HEADER]: cliVersion, "user-agent": `powerplant-cli/${cliVersion}` };
 }
@@ -78917,9 +78947,10 @@ function captureDecision(cwd, policy) {
       }
       const repoFullName = policy.repoOf(cwd);
       if (repoFullName === null) return { capture: false, reason: "no-github-repo" };
-      const repo = repoFullName.toLowerCase();
-      const admitted = policy.allowedRepos !== null ? policy.allowedRepos.includes(repo) : policy.allowedOwners.length > 0 && policy.allowedOwners.includes(ownerOfRepo(repo));
-      return admitted ? { capture: true, via: "org-policy", repoFullName } : { capture: false, reason: "outside-policy" };
+      const claims = policy.workspaceClaims ?? [
+        { owners: policy.allowedOwners, repos: policy.allowedRepos }
+      ];
+      return claims.some((workspace) => workspaceClaimsRepo(repoFullName, workspace)) ? { capture: true, via: "org-policy", repoFullName } : { capture: false, reason: "outside-policy" };
     }
   }
 }
@@ -78931,9 +78962,6 @@ function memberChoice(cwd, policy) {
     ...repoFullName !== null && { repoFullName }
   };
 }
-function ownerOfRepo(repoFullName) {
-  return repoFullName.split("/")[0] ?? "";
-}
 function listSome(values, max = 6) {
   return values.length <= max ? values.join(", ") : `${values.slice(0, max).join(", ")} and ${values.length - max} more`;
 }
@@ -78943,7 +78971,10 @@ function describeCapturePolicy(policy) {
       return `sessions under ${policy.scopePaths.join(", ")}`;
     case "org-repos": {
       const repoPart = policy.allowedRepos !== null ? policy.allowedRepos.length > 0 ? `sessions in the org's allowlisted repos: ${listSome(policy.allowedRepos)}` : "the org's repo allowlist is empty \u2014 no repo-based uploads" : policy.allowedOwners.length > 0 ? `sessions in GitHub repos owned by ${policy.allowedOwners.join(", ")}` : "org-owned GitHub repos \u2014 but the org has no GitHub integration, so nothing uploads";
-      return policy.memberFolders.length > 0 ? `${repoPart}, plus folders you added: ${policy.memberFolders.join(", ")}` : repoPart;
+      const claiming = (policy.workspaceClaims ?? []).filter(workspaceClaimsAnyRepo);
+      const severalWorkspaces = (policy.workspaceClaims?.length ?? 0) > 1;
+      const withOthers = severalWorkspaces && claiming.length > 0 ? `${repoPart}, routing each repo to the workspace that syncs it (${listSome(claiming.map((workspace) => workspace.name))})` : repoPart;
+      return policy.memberFolders.length > 0 ? `${withOthers}, plus folders you added: ${policy.memberFolders.join(", ")}` : withOthers;
     }
   }
 }
@@ -78959,6 +78990,9 @@ function describeStoredCapture(credentials) {
     mode: "org-repos",
     allowedOwners: credentials.allowedOwners ?? [],
     allowedRepos: credentials.allowedRepos ?? null,
+    ...credentials.workspacePolicies !== void 0 && {
+      workspaceClaims: credentials.workspacePolicies
+    },
     memberFolders: credentials.scopePaths ?? [],
     repoOf: () => null
   });
@@ -79083,7 +79117,16 @@ async function fetchCapturePolicy(apiUrl, machineToken) {
       data: external_exports.object({
         owners: external_exports.array(external_exports.string()),
         repos: external_exports.array(external_exports.string()).nullable(),
-        integration: external_exports.enum(["none", "linked"])
+        integration: external_exports.enum(["none", "linked"]),
+        workspaces: external_exports.array(
+          external_exports.object({
+            orgId: external_exports.string().min(1),
+            name: external_exports.string(),
+            owners: external_exports.array(external_exports.string()),
+            repos: external_exports.array(external_exports.string()).nullable(),
+            integration: external_exports.enum(["none", "linked"])
+          })
+        ).optional()
       })
     }),
     await response.json().catch(() => null),
@@ -79095,6 +79138,7 @@ async function uploadSessions(apiUrl, machineToken, items) {
   let upserted = 0;
   let unchanged = 0;
   let outOfPolicy = 0;
+  let deferred = 0;
   for (let offset = 0; offset < items.length; offset += MAX_INGEST_BATCH) {
     const batch = items.slice(offset, offset + MAX_INGEST_BATCH);
     const response = await fetchWithRetry("uploading session metadata", `${apiUrl}/api/ingest/sessions`, {
@@ -79113,7 +79157,8 @@ async function uploadSessions(apiUrl, machineToken, items) {
         data: external_exports.object({
           upserted: external_exports.number(),
           unchanged: external_exports.number(),
-          outOfPolicy: external_exports.number()
+          outOfPolicy: external_exports.number(),
+          deferred: external_exports.number().optional()
         })
       }),
       await response.json().catch(() => null),
@@ -79122,8 +79167,9 @@ async function uploadSessions(apiUrl, machineToken, items) {
     upserted += result.data.upserted;
     unchanged += result.data.unchanged;
     outOfPolicy += result.data.outOfPolicy;
+    deferred += result.data.deferred ?? 0;
   }
-  return { upserted, unchanged, outOfPolicy };
+  return { upserted, unchanged, outOfPolicy, deferred };
 }
 async function uploadBranchFacts(apiUrl, machineToken, facts) {
   let recorded = 0;
@@ -79173,6 +79219,7 @@ async function uploadRawSessions(apiUrl, machineToken, collected, readTranscript
     uploaded: 0,
     skippedTooLarge: 0,
     skippedUnchanged: 0,
+    missingMetadata: 0,
     failed: [],
     unconfigured: false
   };
@@ -79205,6 +79252,10 @@ async function uploadRawSessions(apiUrl, machineToken, collected, readTranscript
         summary.unconfigured = true;
         return summary;
       }
+      if (response.status === 404) {
+        summary.missingMetadata += 1;
+        continue;
+      }
       if (!response.ok) {
         throw new Error(`${response.status}: ${await errorDetail(response)}`);
       }
@@ -79288,7 +79339,8 @@ async function runEnrollment(config2, options) {
     log: log3
   });
   let orgPolicy = captureMode === "org-repos" ? await fetchCapturePolicy(config2.apiUrl, result.token) : void 0;
-  if (orgPolicy !== void 0 && orgPolicy.owners.length === 0 && orgPolicy.repos === null) {
+  const anyWorkspaceClaims = (orgPolicy?.workspaces ?? []).some(workspaceClaimsAnyRepo);
+  if (orgPolicy !== void 0 && orgPolicy.owners.length === 0 && orgPolicy.repos === null && !anyWorkspaceClaims) {
     if (config2.appEnv === "development") {
       const home = normalizeScopePath(os6.homedir());
       log3(
@@ -79320,10 +79372,20 @@ async function runEnrollment(config2, options) {
       );
     }
   }
+  const workspacePolicies = orgPolicy?.workspaces?.map((workspace) => ({
+    orgId: workspace.orgId,
+    name: workspace.name,
+    owners: workspace.owners,
+    repos: workspace.repos,
+    // Cached unknownness survives enrollment: an unresolved workspace's
+    // claims are unknown, and the first sweep must not stamp over them.
+    ...workspace.integration === "linked" && workspace.owners.length === 0 && workspace.repos === null && { unresolved: true }
+  }));
   const policy = captureMode === "org-repos" ? {
     mode: "org-repos",
     allowedOwners: orgPolicy?.owners ?? [],
     allowedRepos: orgPolicy?.repos ?? null,
+    ...workspacePolicies !== void 0 && { workspaceClaims: workspacePolicies },
     memberFolders: [],
     repoOf: () => null
   } : { mode: "scope", scopePaths, repoOf: () => null };
@@ -79338,6 +79400,7 @@ async function runEnrollment(config2, options) {
     captureMode,
     ...orgPolicy && { allowedOwners: orgPolicy.owners },
     ...orgPolicy?.repos != null && { allowedRepos: orgPolicy.repos },
+    ...captureMode === "org-repos" && workspacePolicies !== void 0 && { workspacePolicies },
     scopePaths
   };
   const location = saveCredentials(config2.appEnv, credentials);
@@ -79705,6 +79768,7 @@ function parseClaudeCodeTranscript(text) {
   let cwd;
   let gitBranch;
   let anonCounter = 0;
+  let speedMode;
   for (const record2 of parseJsonl(text)) {
     if (record2.type === "custom-title" && typeof record2.customTitle === "string") {
       title = record2.customTitle;
@@ -79723,25 +79787,42 @@ function parseClaudeCodeTranscript(text) {
     const message = record2.message;
     if (!message || message.model === "<synthetic>") continue;
     const id = message.id ?? (typeof record2.requestId === "string" ? record2.requestId : void 0) ?? (typeof record2.uuid === "string" ? record2.uuid : void 0) ?? `anon-${anonCounter++}`;
-    const isNewMessage = !usageByMessage.has(id);
-    if (message.usage) usageByMessage.set(id, toUsage(message.usage));
-    else if (isNewMessage) usageByMessage.set(id, { input: 0, cacheRead: 0, cacheCreation: 0, output: 0 });
+    const previousMessage = usageByMessage.get(id);
+    const isNewMessage = previousMessage === void 0;
+    const speedValue = message.usage?.speed;
+    const observedSpeed = speedModeOf(speedValue);
+    const messageSpeed = observedSpeed ?? previousMessage?.speedMode;
+    if (speedValue !== void 0) speedMode = observedSpeed ?? "unknown";
+    if (message.usage) {
+      usageByMessage.set(id, {
+        usage: toUsage(message.usage),
+        ...messageSpeed && { speedMode: messageSpeed }
+      });
+    } else if (isNewMessage) {
+      usageByMessage.set(id, {
+        usage: { input: 0, cacheRead: 0, cacheCreation: 0, output: 0 }
+      });
+    }
     if (isNewMessage && typeof message.model === "string") {
       modelCounts.set(message.model, (modelCounts.get(message.model) ?? 0) + 1);
     }
   }
   if (usageByMessage.size === 0 && timestamps.length === 0) return null;
-  const summed = [...usageByMessage.values()].reduce(addUsage, {
+  const summed = [...usageByMessage.values()].map((entry) => entry.usage).reduce(addUsage, {
     input: 0,
     cacheRead: 0,
     cacheCreation: 0,
     output: 0
   });
+  const speedFullyMeasured = usageByMessage.size > 0 && [...usageByMessage.values()].every((entry) => entry.speedMode !== void 0);
+  const fastUsage = speedFullyMeasured ? [...usageByMessage.values()].filter((entry) => entry.speedMode === "fast").map((entry) => entry.usage).reduce(addUsage, { input: 0, cacheRead: 0, cacheCreation: 0, output: 0 }) : null;
   return {
     startedAt: timestamps[0],
     endedAt: timestamps[timestamps.length - 1],
     model: dominantModel(modelCounts),
     usage: usageByMessage.size > 0 ? summed : null,
+    fastUsage,
+    ...speedMode && { speedMode },
     title,
     turnCount: usageByMessage.size,
     cwd,
@@ -79752,9 +79833,13 @@ async function collectClaudeCodeSessions(options = {}) {
   const claudeDir = options.claudeDir ?? path5.join(os7.homedir(), ".claude");
   const now = options.now ?? Date.now();
   const capture = options.capture ?? captureEverythingUnresolved;
+  const maxBytes = options.maxTranscriptBytes ?? MAX_TRANSCRIPT_FILE_BYTES;
   const projectsDir = path5.join(claudeDir, "projects");
   const items = [];
   const skips = { skippedOutOfScope: 0, skippedNoRepo: 0 };
+  const candidates = [];
+  const unreadable = [];
+  let skippedTooLarge = 0;
   const home = path5.dirname(claudeDir);
   const lifecycle = options.lifecycle ?? readLifecycleJournal(home);
   for (const projectDir of listDirs(projectsDir)) {
@@ -79764,39 +79849,76 @@ async function collectClaudeCodeSessions(options = {}) {
       const stat = statIfExists(transcriptPath);
       if (!stat) continue;
       if (options.sinceMs !== void 0 && stat.mtimeMs < options.sinceMs) continue;
+      if (stat.size > maxBytes) {
+        skippedTooLarge += 1;
+        continue;
+      }
       const sessionId = path5.basename(entry, ".jsonl");
       const endObservedAt = observedSessionEnd(lifecycle.get(sessionId), stat.mtimeMs);
       const status = endObservedAt === null && now - stat.mtimeMs < ACTIVE_GRACE_MS ? "active" : "inactive";
-      if (options.locationsOnly) {
+      try {
         const cwd = transcriptCwd(transcriptPath);
-        const decision2 = captureDecision(cwd, capture);
-        if (!decision2.capture) {
-          countCaptureSkip(skips, decision2.reason);
+        const decision = captureDecision(cwd, capture);
+        if (!decision.capture) {
+          countCaptureSkip(skips, decision.reason);
           continue;
         }
-        items.push({
-          mtimeMs: stat.mtimeMs,
+        if (options.locationsOnly) {
+          items.push({
+            mtimeMs: stat.mtimeMs,
+            transcriptPath,
+            ...cwd && { cwd },
+            item: { source: "claude-code", externalId: sessionId, status, capturedVia: decision.via }
+          });
+          continue;
+        }
+        candidates.push({
           transcriptPath,
+          projectDir,
+          sessionId,
+          mtimeMs: stat.mtimeMs,
+          status,
+          endObservedAt,
           ...cwd && { cwd },
-          item: { source: "claude-code", externalId: sessionId, status, capturedVia: decision2.via }
+          decision
         });
-        continue;
+      } catch (error52) {
+        unreadable.push(`${sessionId}: ${describeReadError(error52)}`);
       }
+    }
+  }
+  if (options.locationsOnly) {
+    return {
+      sessions: items.sort((a, b2) => b2.mtimeMs - a.mtimeMs),
+      ...skips,
+      skippedTooLarge,
+      unreadable,
+      heldBack: 0
+    };
+  }
+  candidates.sort((a, b2) => b2.mtimeMs - a.mtimeMs);
+  const chosen = options.maxSessions === void 0 ? candidates : candidates.slice(0, options.maxSessions);
+  for (const candidate of chosen) {
+    await yieldToEventLoop();
+    const { transcriptPath, projectDir, sessionId, mtimeMs, status, endObservedAt, cwd, decision } = candidate;
+    try {
       const text = readIfExists2(transcriptPath);
       if (text === null) continue;
       const summary = parseClaudeCodeTranscript(text);
       if (!summary) continue;
-      const decision = captureDecision(summary.cwd, capture);
-      if (!decision.capture) {
-        countCaptureSkip(skips, decision.reason);
-        continue;
-      }
-      const usage = addSubagentUsage(summary.usage, path5.join(projectDir, sessionId, "subagents"));
+      const usage = addSubagentUsage(
+        summary.usage,
+        summary.fastUsage,
+        path5.join(projectDir, sessionId, "subagents"),
+        { maxBytes, sessionId }
+      );
+      skippedTooLarge += usage.skippedTooLarge;
+      unreadable.push(...usage.unreadable);
       const endedAt = endObservedAt ?? summary.endedAt;
       items.push({
-        mtimeMs: stat.mtimeMs,
+        mtimeMs,
         transcriptPath,
-        ...summary.cwd && { cwd: summary.cwd },
+        ...cwd && { cwd },
         item: {
           source: "claude-code",
           externalId: sessionId,
@@ -79804,28 +79926,42 @@ async function collectClaudeCodeSessions(options = {}) {
           ...summary.startedAt && { startedAt: summary.startedAt },
           ...endedAt && { endedAt },
           ...summary.model && { model: summary.model },
+          ...summary.speedMode && { speedMode: summary.speedMode },
           // Total input-class tokens the source reported (uncached + cache
           // reads + cache writes) — a real reported total, not an estimate.
           // The cache breakdown rides along: pricing bills reads at 0.1×
           // and writes at 1.25×, so collapsing it would inflate estimates.
-          ...usage && { inputTokens: usage.input + usage.cacheRead + usage.cacheCreation },
-          ...usage && { outputTokens: usage.output },
-          ...usage && { cacheReadTokens: usage.cacheRead },
-          ...usage && { cacheWriteTokens: usage.cacheCreation },
+          ...usage.total && {
+            inputTokens: usage.total.input + usage.total.cacheRead + usage.total.cacheCreation
+          },
+          ...usage.total && { outputTokens: usage.total.output },
+          ...usage.total && { cacheReadTokens: usage.total.cacheRead },
+          ...usage.total && { cacheWriteTokens: usage.total.cacheCreation },
+          ...usage.fast && {
+            fastInputTokens: usage.fast.input + usage.fast.cacheRead + usage.fast.cacheCreation,
+            fastOutputTokens: usage.fast.output,
+            fastCacheReadTokens: usage.fast.cacheRead,
+            fastCacheWriteTokens: usage.fast.cacheCreation
+          },
           ...summary.title && { title: redactText(summary.title).slice(0, 500) },
           // The PR-join coordinates: the checkout's directory name (bare
           // repo, not the local path) and the branch the work started on.
-          ...summary.cwd && { repoDir: path5.basename(summary.cwd) },
+          ...cwd && { repoDir: path5.basename(cwd) },
           ...summary.gitBranch && { gitBranch: summary.gitBranch },
           ...decision.repoFullName && { repoFullName: decision.repoFullName },
           capturedVia: decision.via
         }
       });
+    } catch (error52) {
+      unreadable.push(`${sessionId}: ${describeReadError(error52)}`);
     }
   }
   return {
     sessions: items.sort((a, b2) => b2.mtimeMs - a.mtimeMs),
-    ...skips
+    ...skips,
+    skippedTooLarge,
+    unreadable,
+    heldBack: candidates.length - chosen.length
   };
 }
 function transcriptCwd(transcriptPath) {
@@ -79844,6 +79980,9 @@ function toUsage(u) {
     output: n(u.output_tokens)
   };
 }
+function speedModeOf(value) {
+  return value === "fast" || value === "standard" ? value : void 0;
+}
 function addUsage(a, b2) {
   return {
     input: a.input + b2.input,
@@ -79852,15 +79991,36 @@ function addUsage(a, b2) {
     output: a.output + b2.output
   };
 }
-function addSubagentUsage(main2, subagentsDir) {
-  let usage = main2;
+function addSubagentUsage(main2, mainFast, subagentsDir, bounds) {
+  let total = main2;
+  let fast = mainFast;
+  let fastCoverageComplete = main2 === null || mainFast !== null;
+  let skippedTooLarge = 0;
+  const unreadable = [];
   for (const entry of listFiles(subagentsDir, ".jsonl")) {
-    const text = readIfExists2(path5.join(subagentsDir, entry));
-    if (text === null) continue;
-    const summary = parseClaudeCodeTranscript(text);
-    if (summary?.usage) usage = addUsage(usage ?? { input: 0, cacheRead: 0, cacheCreation: 0, output: 0 }, summary.usage);
+    const sidecarPath = path5.join(subagentsDir, entry);
+    try {
+      const stat = statIfExists(sidecarPath);
+      if (stat === null) continue;
+      if (stat.size > bounds.maxBytes) {
+        skippedTooLarge += 1;
+        continue;
+      }
+      const text = readIfExists2(sidecarPath);
+      if (text === null) continue;
+      const summary = parseClaudeCodeTranscript(text);
+      if (summary?.usage) {
+        total = addUsage(total ?? { input: 0, cacheRead: 0, cacheCreation: 0, output: 0 }, summary.usage);
+        if (summary.fastUsage === null) fastCoverageComplete = false;
+      }
+      if (summary?.fastUsage) {
+        fast = addUsage(fast ?? { input: 0, cacheRead: 0, cacheCreation: 0, output: 0 }, summary.fastUsage);
+      }
+    } catch (error52) {
+      unreadable.push(`${bounds.sessionId} (subagent ${entry}): ${describeReadError(error52)}`);
+    }
   }
-  return usage;
+  return { total, fast: fastCoverageComplete ? fast : null, skippedTooLarge, unreadable };
 }
 function dominantModel(counts) {
   let best;
@@ -79879,6 +80039,10 @@ function parseCodexRollout(text) {
   let meta3 = null;
   let model;
   let totals = null;
+  let fastTotals = { input: 0, cached: 0, output: 0 };
+  let speedMode;
+  let fastCoverageComplete = true;
+  let classifiedUsage = false;
   const timestamps = [];
   for (const line of parseJsonl(text)) {
     if (typeof line.timestamp === "string") timestamps.push(line.timestamp);
@@ -79889,15 +80053,38 @@ function parseCodexRollout(text) {
       meta3 ??= record2;
     } else if (line.type === "turn_context" && typeof record2.model === "string") {
       model = record2.model;
+    } else if (line.type === "event_msg" && record2.type === "thread_settings_applied") {
+      const settings = record2.thread_settings;
+      if (settings && typeof settings === "object" && !Array.isArray(settings)) {
+        const tier = settings.service_tier;
+        if (tier !== void 0) speedMode = codexSpeedMode(tier) ?? "unknown";
+      }
     } else if (line.type === "event_msg" && record2.type === "token_count") {
       const info = record2.info;
       const usage = info?.total_token_usage;
       if (usage) {
         const n = (value) => typeof value === "number" ? value : 0;
-        totals ??= { input: 0, cached: 0, output: 0 };
-        totals.input = Math.max(totals.input, n(usage.input_tokens));
-        totals.cached = Math.max(totals.cached, n(usage.cached_input_tokens));
-        totals.output = Math.max(totals.output, n(usage.output_tokens));
+        const next = {
+          input: n(usage.input_tokens),
+          cached: n(usage.cached_input_tokens),
+          output: n(usage.output_tokens)
+        };
+        const previous = totals ?? { input: 0, cached: 0, output: 0 };
+        const delta = {
+          input: Math.max(0, next.input - previous.input),
+          cached: Math.max(0, next.cached - previous.cached),
+          output: Math.max(0, next.output - previous.output)
+        };
+        if (delta.input > 0 || delta.cached > 0 || delta.output > 0) {
+          if (speedMode === "fast" || speedMode === "standard") classifiedUsage = true;
+          else fastCoverageComplete = false;
+          if (speedMode === "fast") fastTotals = addCodexTotals(fastTotals, delta);
+        }
+        totals = {
+          input: Math.max(previous.input, next.input),
+          cached: Math.max(previous.cached, next.cached),
+          output: Math.max(previous.output, next.output)
+        };
       }
     }
   }
@@ -79911,6 +80098,8 @@ function parseCodexRollout(text) {
     endedAt: timestamps[timestamps.length - 1],
     ...model && { model },
     totals,
+    fastTotals: fastCoverageComplete && classifiedUsage ? fastTotals : null,
+    ...speedMode && { speedMode },
     ...typeof meta3?.cwd === "string" && meta3.cwd !== "" && { cwd: meta3.cwd },
     ...typeof git?.branch === "string" && git.branch !== "" && { gitBranch: git.branch },
     ...repoNameFromUrl(git?.repository_url) ?? {},
@@ -79924,14 +80113,23 @@ function parseRolloutFile(rolloutPath) {
 function rolloutLocation(rolloutPath) {
   const record2 = readFirstRecord(rolloutPath, (candidate) => candidate.type === "session_meta");
   const meta3 = record2?.payload;
-  if (!meta3 || typeof meta3 !== "object" || Array.isArray(meta3)) return { kind: "session", totals: null };
+  if (!meta3 || typeof meta3 !== "object" || Array.isArray(meta3)) return { kind: "session", totals: null, fastTotals: null };
   const { thread_source: threadSource, cwd } = meta3;
   return {
     kind: threadSource === "subagent" ? "subagent" : "session",
     totals: null,
+    fastTotals: null,
     ...typeof cwd === "string" && cwd !== "" && { cwd }
   };
 }
+function codexSpeedMode(value) {
+  if (value === "priority" || value === "fast") return "fast";
+  if (value === "default") return "standard";
+  return void 0;
+}
+function addCodexTotals(a, b2) {
+  return { input: a.input + b2.input, cached: a.cached + b2.cached, output: a.output + b2.output };
+}
 function repoFullNameFrom(url2) {
   const fullName = parseGithubRepo(url2);
   return fullName ? { repoFullName: fullName } : {};
@@ -80062,6 +80260,7 @@ async function collectCodexSessions(options = {}) {
           ...summary.startedAt && { startedAt: summary.startedAt },
           ...summary.endedAt && { endedAt: summary.endedAt },
           ...summary.model && { model: summary.model },
+          ...summary.speedMode && { speedMode: summary.speedMode },
           ...title && { title: redactText(title).slice(0, 500) },
           // input_tokens already includes the cached subset — it IS the
           // all-in input-class total. No cache-write figure exists, so
@@ -80069,6 +80268,12 @@ async function collectCodexSessions(options = {}) {
           ...summary.totals && { inputTokens: summary.totals.input },
           ...summary.totals && { outputTokens: summary.totals.output },
           ...summary.totals && { cacheReadTokens: summary.totals.cached },
+          ...summary.fastTotals && { fastInputTokens: summary.fastTotals.input },
+          ...summary.fastTotals && { fastOutputTokens: summary.fastTotals.output },
+          ...summary.fastTotals && { fastCacheReadTokens: summary.fastTotals.cached },
+          // OpenAI prompt-cache writes have no separate price in the current
+          // session cost model; zero is measured here, not an invented count.
+          ...summary.fastTotals && { fastCacheWriteTokens: 0 },
           ...repoDir && { repoDir },
           ...summary.gitBranch && { gitBranch: summary.gitBranch },
           ...repoFullName && { repoFullName },
@@ -80117,6 +80322,8 @@ var emptyResult = () => ({
   skippedSubagentComposers: 0,
   skippedNonLocalComposers: 0,
   skippedUnreadable: 0,
+  skippedTooLarge: 0,
+  truncatedTranscripts: 0,
   unavailable: null
 });
 var SQLITE_EXPERIMENTAL_WARNING = "SQLite is an experimental feature and might change at any time";
@@ -80144,9 +80351,6 @@ async function openCursorDatabase(dbPath) {
   const sqlite = await loadSqlite();
   return new sqlite.DatabaseSync(dbPath, { readOnly: true });
 }
-function describeError(error52) {
-  return error52 instanceof Error ? error52.message : String(error52);
-}
 function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -80221,6 +80425,8 @@ function toolFilePathOf(args) {
   }
   return void 0;
 }
+var SPOOL_META_RESERVE_BYTES = 64 * 1024;
+var lineBytes = (line) => Buffer.byteLength(JSON.stringify(line)) + 1;
 function bubbleLines(bubble) {
   const lines = [];
   const createdAt = typeof bubble.createdAt === "string" ? { createdAt: bubble.createdAt } : {};
@@ -80260,43 +80466,50 @@ function bubbleLines(bubble) {
   }
   return lines;
 }
-function extractTranscript(db, composerId) {
+function extractTranscript(db, composerId, maxBytes) {
   const valueByKey = db.prepare("select value from cursorDiskKV where key = ?");
   const dataRow = valueByKey.get(`composerData:${composerId}`);
   const dataText = isRecord3(dataRow) && typeof dataRow.value === "string" ? dataRow.value : null;
   const data = dataText === null ? null : safeJsonRecord2(dataText);
   const spine = Array.isArray(data?.fullConversationHeadersOnly) ? data.fullConversationHeadersOnly : [];
   if (spine.length === 0) return null;
+  const budget = maxBytes - SPOOL_META_RESERVE_BYTES;
   const lines = [];
   const modelCounts = /* @__PURE__ */ new Map();
+  let bytes = 0;
   let bubbleCount = 0;
-  for (const entry of spine) {
+  let bubblesOmitted = 0;
+  for (const [index, entry] of spine.entries()) {
     if (!isRecord3(entry) || typeof entry.bubbleId !== "string") continue;
     const row = valueByKey.get(`bubbleId:${composerId}:${entry.bubbleId}`);
     const text = isRecord3(row) && typeof row.value === "string" ? row.value : null;
     const bubble = text === null ? null : safeJsonRecord2(text);
     if (bubble === null) continue;
+    const bubbleLinesOut = bubbleLines(bubble);
+    const bubbleBytes = bubbleLinesOut.reduce((sum2, line) => sum2 + lineBytes(line), 0);
+    if (bytes + bubbleBytes > budget) {
+      bubblesOmitted = spine.length - index;
+      break;
+    }
+    bytes += bubbleBytes;
     bubbleCount += 1;
-    for (const line of bubbleLines(bubble)) {
+    for (const line of bubbleLinesOut) {
       lines.push(line);
       if (line.type === "agent" && line.model !== void 0) {
         modelCounts.set(line.model, (modelCounts.get(line.model) ?? 0) + 1);
       }
     }
   }
-  if (bubbleCount === 0) return null;
+  if (bubbleCount === 0 && bubblesOmitted === 0) return null;
   let model;
   let best = 0;
   for (const [name, count] of modelCounts) {
     if (count > best) [model, best] = [name, count];
   }
-  return { lines, ...model && { model }, bubbleCount };
+  return { lines, ...model && { model }, bubbleCount, bubblesOmitted };
 }
 function readSpoolModel(spoolPath) {
-  const text = readIfExists2(spoolPath);
-  if (text === null) return void 0;
-  const newline = text.indexOf("\n");
-  const record2 = safeJsonRecord2(newline === -1 ? text : text.slice(0, newline));
+  const record2 = readFirstRecord(spoolPath, () => true);
   if (record2 === null || record2.type !== "meta" || record2.format !== "cursor-local-transcript") {
     return void 0;
   }
@@ -80309,20 +80522,20 @@ async function collectCursorSessions(options = {}) {
   try {
     if (statIfExists(dbPath) === null) return result;
   } catch (error52) {
-    result.unavailable = `Cursor's session store isn't readable (${describeError(error52)})`;
+    result.unavailable = `Cursor's session store isn't readable (${describeReadError(error52)})`;
     return result;
   }
   let db;
   try {
     db = await openCursorDatabase(dbPath);
   } catch (error52) {
-    result.unavailable = `Cursor's session store couldn't be opened (${describeError(error52)})`;
+    result.unavailable = `Cursor's session store couldn't be opened (${describeReadError(error52)})`;
     return result;
   }
   try {
     collectFromStore(db, userDir, options, result);
   } catch (error52) {
-    result.unavailable = `reading Cursor's session store failed (${describeError(error52)})`;
+    result.unavailable = `reading Cursor's session store failed (${describeReadError(error52)})`;
   } finally {
     try {
       db.close();
@@ -80336,6 +80549,7 @@ function collectFromStore(db, userDir, options, result) {
   const now = options.now ?? Date.now();
   const capture = options.capture ?? captureEverythingUnresolved;
   const spoolDir = options.spoolDir ?? cursorSpoolDir(os9.homedir());
+  const maxBytes = options.maxTranscriptBytes ?? MAX_TRANSCRIPT_FILE_BYTES;
   let spoolDirReady = false;
   const headerRows = db.prepare(
     "select composerId, workspaceId, createdAt, lastUpdatedAt, isArchived, isSubagent, value from composerHeaders where lastUpdatedAt >= ? order by lastUpdatedAt desc"
@@ -80385,10 +80599,15 @@ function collectFromStore(db, userDir, options, result) {
       const spoolStat = statIfExists(spoolPath);
       let model;
       if (spoolStat !== null && Math.abs(spoolStat.mtimeMs - lastUpdatedAt) < 1) {
+        if (spoolStat.size > maxBytes) {
+          result.skippedTooLarge += 1;
+          continue;
+        }
         model = readSpoolModel(spoolPath);
       } else {
-        const transcript = extractTranscript(db, raw.composerId);
+        const transcript = extractTranscript(db, raw.composerId, maxBytes);
         if (transcript === null) continue;
+        if (transcript.bubblesOmitted > 0) result.truncatedTranscripts += 1;
         model = transcript.model;
         const meta3 = {
           type: "meta",
@@ -80400,7 +80619,8 @@ function collectFromStore(db, userDir, options, result) {
           ...model && { model },
           ...typeof raw.createdAt === "number" && { createdAt: raw.createdAt },
           lastUpdatedAt,
-          ...cwd && { workspacePath: cwd }
+          ...cwd && { workspacePath: cwd },
+          ...transcript.bubblesOmitted > 0 && { bubblesOmitted: transcript.bubblesOmitted }
         };
         if (!spoolDirReady) {
           mkdirSync2(spoolDir, { recursive: true });
@@ -81093,12 +81313,33 @@ async function resolveCapturePolicy(config2, credentials, log3, deps = defaultPo
   }
   let owners = credentials.allowedOwners ?? [];
   let repos = credentials.allowedRepos ?? null;
+  let workspacePolicies = credentials.workspacePolicies;
   let ownersUnresolved = false;
+  let claimsUnresolved = false;
   try {
     const fresh = await deps.fetchPolicy(credentials.apiUrl, credentials.token);
     ownersUnresolved = fresh.integration === "linked" && fresh.owners.length === 0;
     const nextOwners = ownersUnresolved ? owners : fresh.owners;
-    const changed = nextOwners.join(",") !== owners.join(",") || (fresh.repos?.join(",") ?? null) !== (repos?.join(",") ?? null);
+    const nextWorkspaces = fresh.workspaces?.map((workspace) => {
+      const unresolved = workspace.integration === "linked" && workspace.owners.length === 0 && workspace.repos === null;
+      const cached3 = workspacePolicies?.find((entry) => entry.orgId === workspace.orgId) ?? (credentials.orgId !== void 0 && workspace.orgId === credentials.orgId ? { orgId: workspace.orgId, name: workspace.name, owners, repos } : void 0);
+      const usableCache = cached3 !== void 0 && workspaceClaimsAnyRepo(cached3);
+      const effective = unresolved && usableCache ? cached3 : unresolved ? {
+        orgId: workspace.orgId,
+        name: workspace.name,
+        owners: workspace.owners,
+        repos: workspace.repos,
+        unresolved: true
+      } : {
+        orgId: workspace.orgId,
+        name: workspace.name,
+        owners: workspace.owners,
+        repos: workspace.repos
+      };
+      if (effective.unresolved) claimsUnresolved = true;
+      return effective;
+    });
+    const changed = nextOwners.join(",") !== owners.join(",") || (fresh.repos?.join(",") ?? null) !== (repos?.join(",") ?? null) || JSON.stringify(nextWorkspaces ?? null) !== JSON.stringify(workspacePolicies ?? null);
     if (changed) {
       const next = {
         ...credentials,
@@ -81106,34 +81347,48 @@ async function resolveCapturePolicy(config2, credentials, log3, deps = defaultPo
       };
       if (fresh.repos !== null) next.allowedRepos = fresh.repos;
       else delete next.allowedRepos;
+      if (nextWorkspaces !== void 0) next.workspacePolicies = nextWorkspaces;
+      else delete next.workspacePolicies;
       deps.persist(config2.appEnv, next);
     }
     owners = nextOwners;
     repos = fresh.repos;
+    workspacePolicies = nextWorkspaces;
   } catch (cause) {
+    const cachedCoversSomething = owners.length > 0 || repos !== null || (workspacePolicies ?? []).some((entry) => workspaceClaimsAnyRepo(entry));
+    if (!cachedCoversSomething || (workspacePolicies ?? []).some((entry) => entry.unresolved === true)) {
+      claimsUnresolved = true;
+    }
     log3(
-      `\u26A0 Couldn't refresh the org's repo sync policy (${describeSyncError(cause)}) \u2014 ` + (owners.length > 0 || repos !== null ? "using the cached policy." : "nothing will upload this pass.")
+      `\u26A0 Couldn't refresh the org's repo sync policy (${describeSyncError(cause)}) \u2014 ` + (cachedCoversSomething ? "using the cached policy." : "nothing will upload this pass.")
     );
   }
   const memberFolders = credentials.scopePaths ?? [];
+  if (ownersUnresolved && owners.length === 0 && repos === null) claimsUnresolved = true;
   if (ownersUnresolved) {
     log3(
       "\u26A0 The org's GitHub is connected, but its account couldn't be resolved just now \u2014 " + (owners.length > 0 ? `using the cached owner list: ${owners.join(", ")}.` : "no owner-based uploads this pass. This is usually temporary; syncing resumes when it resolves.")
     );
   }
+  const homeOrgId = credentials.orgId ?? workspacePolicies?.[0]?.orgId;
+  const foreignClaims = (workspacePolicies ?? []).filter(
+    (entry) => entry.orgId !== homeOrgId && workspaceClaimsAnyRepo(entry)
+  );
   if (repos !== null && repos.length === 0) {
     log3(
-      "\u26A0 The org's repo allowlist is empty \u2014 no repo-based uploads" + (memberFolders.length > 0 ? "; only folders you added upload." : ".")
+      "\u26A0 The org's repo allowlist is empty \u2014 no repo-based uploads for it" + (foreignClaims.length > 0 ? `; repos synced by ${foreignClaims.map((entry) => entry.name).join(", ")} still upload.` : memberFolders.length > 0 ? "; only folders you added upload." : ".")
     );
   } else if (repos === null && owners.length === 0 && !ownersUnresolved) {
     log3(
-      "\u26A0 Syncing is gated on org-owned GitHub repos, but the org has no GitHub integration \u2014 nothing uploads. Connect GitHub in Settings, or add folders with `powerplant folders add`."
+      foreignClaims.length > 0 ? `Your home workspace has no GitHub integration \u2014 syncing repos for ${foreignClaims.map((entry) => entry.name).join(", ")}.` : "\u26A0 Syncing is gated on org-owned GitHub repos, but the org has no GitHub integration \u2014 nothing uploads. Connect GitHub in Settings, or add folders with `powerplant folders add`."
     );
   }
   return {
     mode: "org-repos",
     allowedOwners: owners,
     allowedRepos: repos,
+    ...workspacePolicies !== void 0 && { workspaceClaims: workspacePolicies },
+    ...claimsUnresolved && { claimsUnresolved },
     memberFolders,
     repoOf,
     environment
@@ -81156,7 +81411,7 @@ async function runSyncPass(config2, options = {}) {
   const capture = await resolveCapturePolicy(config2, credentials, log3);
   const sinceMs = resolveScanFloor(window2, Date.now(), options.narrowSinceMs);
   const maxSessions = window2.deepSweep ? DEEP_FIRST_SYNC_MAX_SESSIONS : void 0;
-  const claude = await collectClaudeCodeSessions({ sinceMs, capture });
+  const claude = await collectClaudeCodeSessions({ sinceMs, capture, maxSessions });
   const codex = await collectCodexSessions({ sinceMs, capture, maxSessions });
   const cursor = await collectCursorSessions({ sinceMs, capture });
   if (cursor.unavailable !== null) {
@@ -81166,14 +81421,16 @@ async function runSyncPass(config2, options = {}) {
     (a, b2) => b2.mtimeMs - a.mtimeMs
   );
   const collected = maxSessions === void 0 ? inWindow : inWindow.slice(0, maxSessions);
-  const heldBack = inWindow.length - collected.length + codex.heldBack;
+  const heldBack = inWindow.length - collected.length + claude.heldBack + codex.heldBack;
   const skippedOutOfScope = claude.skippedOutOfScope + codex.skippedOutOfScope + cursor.skippedOutOfScope;
   const skippedNoRepo = claude.skippedNoRepo + codex.skippedNoRepo + cursor.skippedNoRepo;
   const items = collected.map((c) => c.item);
   const active = items.filter((s) => s.status === "active").length;
+  const tooLarge = (count, what) => count > 0 ? ` \xB7 ${count} ${what} skipped (over ${MAX_TRANSCRIPT_FILE_BYTES / (1024 * 1024)}MB \u2014 too large to read)` : "";
   log3(
-    `Found ${inWindow.length} local session(s) (${claude.sessions.length} claude, ${codex.sessions.length} codex, ${cursor.sessions.length} cursor) ` + describeScanReach(window2, options.narrowSinceMs) + (active > 0 ? ` (${active} still active)` : "") + (skippedOutOfScope > 0 ? ` \xB7 ${skippedOutOfScope} ${describeSkipReason(capture)}` : "") + (skippedNoRepo > 0 ? ` \xB7 ${skippedNoRepo} ${describeNoRepoSkipReason(capture)}` : "") + (codex.skippedSubagentThreads > 0 ? ` \xB7 ${codex.skippedSubagentThreads} codex subagent thread(s) skipped (spend unmeasured)` : "") + (cursor.skippedSubagentComposers > 0 ? ` \xB7 ${cursor.skippedSubagentComposers} cursor subagent thread(s) skipped` : "") + (cursor.skippedNonLocalComposers > 0 ? ` \xB7 ${cursor.skippedNonLocalComposers} cursor session(s) skipped (not local to this machine)` : "") + (cursor.skippedUnreadable > 0 ? ` \xB7 ${cursor.skippedUnreadable} cursor session(s) unreadable, skipped` : "") + (codex.skippedTooLarge > 0 ? ` \xB7 ${codex.skippedTooLarge} codex rollout(s) skipped (over ${MAX_TRANSCRIPT_FILE_BYTES / (1024 * 1024)}MB \u2014 too large to read)` : "") + (codex.unreadable.length > 0 ? ` \xB7 ${codex.unreadable.length} codex rollout(s) unreadable, skipped` : "") + (heldBack > 0 ? ` \xB7 ${heldBack} older session(s) held back \u2014 the first sync backfills the ${DEEP_FIRST_SYNC_MAX_SESSIONS} most recently active` : "") + "."
+    `Found ${inWindow.length} local session(s) (${claude.sessions.length} claude, ${codex.sessions.length} codex, ${cursor.sessions.length} cursor) ` + describeScanReach(window2, options.narrowSinceMs) + (active > 0 ? ` (${active} still active)` : "") + (skippedOutOfScope > 0 ? ` \xB7 ${skippedOutOfScope} ${describeSkipReason(capture)}` : "") + (skippedNoRepo > 0 ? ` \xB7 ${skippedNoRepo} ${describeNoRepoSkipReason(capture)}` : "") + (codex.skippedSubagentThreads > 0 ? ` \xB7 ${codex.skippedSubagentThreads} codex subagent thread(s) skipped (spend unmeasured)` : "") + (cursor.skippedSubagentComposers > 0 ? ` \xB7 ${cursor.skippedSubagentComposers} cursor subagent thread(s) skipped` : "") + (cursor.skippedNonLocalComposers > 0 ? ` \xB7 ${cursor.skippedNonLocalComposers} cursor session(s) skipped (not local to this machine)` : "") + (cursor.skippedUnreadable > 0 ? ` \xB7 ${cursor.skippedUnreadable} cursor session(s) unreadable, skipped` : "") + tooLarge(claude.skippedTooLarge, "claude transcript(s)") + (claude.unreadable.length > 0 ? ` \xB7 ${claude.unreadable.length} claude transcript(s) unreadable, skipped` : "") + tooLarge(codex.skippedTooLarge, "codex rollout(s)") + (codex.unreadable.length > 0 ? ` \xB7 ${codex.unreadable.length} codex rollout(s) unreadable, skipped` : "") + tooLarge(cursor.skippedTooLarge, "cursor transcript(s)") + (cursor.truncatedTranscripts > 0 ? ` \xB7 ${cursor.truncatedTranscripts} cursor transcript(s) cut at ${MAX_TRANSCRIPT_FILE_BYTES / (1024 * 1024)}MB (the rest of the conversation stays local)` : "") + (heldBack > 0 ? ` \xB7 ${heldBack} older session(s) held back \u2014 the first sync backfills the ${DEEP_FIRST_SYNC_MAX_SESSIONS} most recently active` : "") + "."
   );
+  for (const failure of claude.unreadable) log3(`  claude transcript skipped \u2014 ${failure}`);
   for (const failure of codex.unreadable) log3(`  codex rollout skipped \u2014 ${failure}`);
   if (options.dryRun) {
     for (const s of items.slice(0, 10)) {
@@ -81199,11 +81456,18 @@ async function runSyncPass(config2, options = {}) {
     saveCredentials(config2.appEnv, { ...current, deepSyncedAt: (/* @__PURE__ */ new Date()).toISOString() });
     log3(`Deep sync complete \u2014 future syncs cover the last ${STEADY_SYNC_WINDOW_DAYS} days.`);
   };
+  const claimsUnresolved = capture.mode === "org-repos" && capture.claimsUnresolved === true;
   if (items.length === 0) {
-    markDeepSynced();
+    if (claimsUnresolved) {
+      if (window2.deepSweep) {
+        log3("Deep sync not stamped \u2014 a workspace's claims are unresolved; the sweep re-runs next pass.");
+      }
+    } else {
+      markDeepSynced();
+    }
     return { sessions: collected, upserted: 0 };
   }
-  const { upserted, unchanged, outOfPolicy } = await uploadSessions(
+  const { upserted, unchanged, outOfPolicy, deferred } = await uploadSessions(
     credentials.apiUrl,
     credentials.token,
     items
@@ -81211,6 +81475,11 @@ async function runSyncPass(config2, options = {}) {
   log3(
     `Uploaded: ${upserted} session(s) upserted` + (unchanged > 0 ? `, ${unchanged} unchanged (no writes issued)` : "") + "."
   );
+  if (deferred > 0) {
+    log3(
+      `\u26A0 ${deferred} session(s) deferred \u2014 a workspace's GitHub owners couldn't be resolved just now, so routing waited rather than guessing a workspace. They upload on a later pass.`
+    );
+  }
   if (outOfPolicy > 0) {
     log3(
       `\u26A0 ${outOfPolicy} session(s) refused by the org's repo sync policy \u2014 they stayed out of Powerplant. The next pass refreshes the policy and stops offering them.`
@@ -81266,11 +81535,24 @@ async function runSyncPass(config2, options = {}) {
     if (raw.failed.length > 0) parts.push(`${raw.failed.length} failed`);
     log3(`Raw content: ${parts.join(", ")}.`);
     for (const failure of raw.failed) log3(`  raw upload failed \u2014 ${failure}`);
-    const nothingElseAccountedFor = raw.skippedUnchanged === 0 && raw.skippedTooLarge === 0 && rawWindowSkipped === 0;
+    if (raw.missingMetadata > 0) {
+      log3(
+        `${raw.missingMetadata} raw transcript(s) waiting on their session metadata \u2014 they re-send once it lands.`
+      );
+    }
+    const nothingElseAccountedFor = raw.skippedUnchanged === 0 && raw.skippedTooLarge === 0 && rawWindowSkipped === 0 && raw.missingMetadata === 0;
     if (raw.uploaded === 0 && (raw.failed.length > 1 || raw.failed.length === 1 && nothingElseAccountedFor)) {
       throw new Error(`all ${raw.failed.length} raw upload(s) failed this pass \u2014 ${raw.failed[0]}`);
     }
-    markDeepSynced();
+    if (deferred > 0 || claimsUnresolved) {
+      if (window2.deepSweep) {
+        log3(
+          deferred > 0 ? "Deep sync not stamped \u2014 deferred sessions still owe their upload; the sweep re-runs next pass." : "Deep sync not stamped \u2014 a workspace's claims are unresolved; the sweep re-runs next pass."
+        );
+      }
+    } else {
+      markDeepSynced();
+    }
   }
   return { sessions: collected, upserted };
 }
@@ -81324,14 +81606,11 @@ function findClaudeTranscript(homeDir, externalId) {
     const transcript = path13.join(projectDir, `${externalId}.jsonl`);
     const stat = statIfExists(transcript);
     if (stat === null) continue;
-    const text = readIfExists2(transcript);
-    if (text === null) continue;
-    for (const record2 of parseJsonl(text)) {
-      if (typeof record2.cwd === "string" && record2.cwd !== "") {
-        return { cwd: record2.cwd, mtimeMs: stat.mtimeMs };
-      }
-    }
-    return null;
+    const record2 = readFirstRecord(
+      transcript,
+      (candidate) => typeof candidate.cwd === "string" && candidate.cwd !== ""
+    );
+    return typeof record2?.cwd === "string" ? { cwd: record2.cwd, mtimeMs: stat.mtimeMs } : null;
   }
   return null;
 }
@@ -81356,7 +81635,7 @@ function createWakePoller(deps) {
       try {
         for (const target of await deps.listPending()) {
           if (inFlight.has(target.externalId)) continue;
-          const home = deps.inspect(target);
+          const home = inspectTarget(deps, target);
           if (home === null) continue;
           if (deps.now() - home.mtimeMs < WAKE_QUIET_MS) continue;
           const messages = await deps.claim(target);
@@ -81366,13 +81645,13 @@ function createWakePoller(deps) {
             `waking session ${target.externalId} with ${messages.length} message(s) in ${home.cwd}`
           );
           void deps.runClaude(target, formatWakePrompt(messages), home.cwd).then(() => deps.log(`wake finished for session ${target.externalId}`)).catch(
-            (error52) => reportFailedWake(deps, target, messages, describeError2(error52))
+            (error52) => reportFailedWake(deps, target, messages, describeError(error52))
           ).finally(() => inFlight.delete(target.externalId));
         }
         consecutivePollFailures = 0;
       } catch (error52) {
         consecutivePollFailures += 1;
-        deps.log(`\u26A0 wake poll failed (${describeError2(error52)}) \u2014 next poll retries`);
+        deps.log(`\u26A0 wake poll failed (${describeError(error52)}) \u2014 next poll retries`);
         if (consecutivePollFailures === REPORT_AFTER_CONSECUTIVE_FAILURES) {
           deps.reportError?.(error52, "wake-poll", { consecutivePollFailures });
         }
@@ -81382,6 +81661,16 @@ function createWakePoller(deps) {
     }
   };
 }
+function inspectTarget(deps, target) {
+  try {
+    return deps.inspect(target);
+  } catch (error52) {
+    deps.log(
+      `\u26A0 wake skipped for session ${target.externalId} \u2014 its transcript could not be read (${describeError(error52)}); next poll retries`
+    );
+    return null;
+  }
+}
 async function reportFailedWake(deps, target, messages, reason) {
   deps.log(
     `\u26A0 wake failed for session ${target.externalId} AFTER its messages were claimed (${reason})`
@@ -81394,7 +81683,7 @@ async function reportFailedWake(deps, target, messages, reason) {
     );
   } catch (reportError) {
     deps.log(
-      `\u26A0 wake failure report for session ${target.externalId} ALSO failed \u2014 its messages read Delivered but no agent ran (${describeError2(reportError)})`
+      `\u26A0 wake failure report for session ${target.externalId} ALSO failed \u2014 its messages read Delivered but no agent ran (${describeError(reportError)})`
     );
     deps.reportError?.(reportError, "wake-failure-report", {
       externalId: target.externalId,
@@ -81446,7 +81735,7 @@ function preflightClaudeVersion(claudeBin, readVersionOutput = execClaudeVersion
   try {
     output = readVersionOutput(claudeBin);
   } catch (error52) {
-    return { ok: false, problem: `\`${claudeBin} --version\` failed (${describeError2(error52)})` };
+    return { ok: false, problem: `\`${claudeBin} --version\` failed (${describeError(error52)})` };
   }
   const version2 = /\d+\.\d+\.\d+/.exec(output)?.[0] ?? null;
   if (version2 === null) {
@@ -81591,7 +81880,7 @@ function startWakeService(config2, homeDir, log3) {
   log3(`wake-on-message armed: polling every ${WAKE_POLL_MS / 1e3}s (${config2.appEnv})`);
   return () => clearInterval(timer);
 }
-function describeError2(error52) {
+function describeError(error52) {
   return error52 instanceof Error ? error52.message : String(error52);
 }
 
@@ -81631,6 +81920,8 @@ var SAFETY_NET_INTERVAL_MS = 60 * 60 * 1e3;
 var NARROW_OVERLAP_MS = 6e4;
 var WATCHER_RETRY_MS = 6e4;
 var FAILED_PASS_RETRY_MS = 6e4;
+var FAILED_PASS_BACKOFF_CAP_MS = 15 * 6e4;
+var STREAK_REREPORT_INTERVAL_MS = 60 * 6e4;
 var VERSION_NOTICE_INTERVAL_MS = 60 * 6e4;
 var COMPLETION_SLACK_MS = 3e4;
 function createWatchLoop(deps) {
@@ -81643,6 +81934,10 @@ function createWatchLoop(deps) {
   let completionTimer = null;
   let running = false;
   let consecutiveFailures = 0;
+  let streakSignature = null;
+  let streakCount = 0;
+  let streakStartedAt = 0;
+  let streakReportedAt = 0;
   let pausedLogged = false;
   let queued = null;
   let retryNotBefore = 0;
@@ -81669,7 +81964,7 @@ function createWatchLoop(deps) {
     if (stopped) return;
     try {
       closeWatcher = deps.watch(onEvent, (error52) => {
-        deps.log(`watcher lost (${describeError3(error52)}) \u2014 re-arming and re-scanning`);
+        deps.log(`watcher lost (${describeError2(error52)}) \u2014 re-arming and re-scanning`);
         closeWatcher?.();
         closeWatcher = null;
         arm();
@@ -81677,7 +81972,7 @@ function createWatchLoop(deps) {
       });
     } catch (error52) {
       deps.log(
-        `cannot watch yet (${describeError3(error52)}) \u2014 retrying in ${WATCHER_RETRY_MS / 1e3}s`
+        `cannot watch yet (${describeError2(error52)}) \u2014 retrying in ${WATCHER_RETRY_MS / 1e3}s`
       );
       watcherRetry = setTimeout(arm, WATCHER_RETRY_MS);
     }
@@ -81734,6 +82029,8 @@ function createWatchLoop(deps) {
         }
       }
       consecutiveFailures = 0;
+      streakSignature = null;
+      streakCount = 0;
       deps.onPassResult?.({
         kind,
         at: startedAt,
@@ -81743,17 +82040,33 @@ function createWatchLoop(deps) {
       });
     } catch (error52) {
       consecutiveFailures += 1;
-      retryNotBefore = now() + Math.max(FAILED_PASS_RETRY_MS, retryAfterMs(error52) ?? 0);
+      const signature = errorSignature(error52);
+      if (signature === streakSignature) {
+        streakCount += 1;
+      } else {
+        streakSignature = signature;
+        streakCount = 1;
+        streakStartedAt = startedAt;
+        streakReportedAt = 0;
+      }
+      const holdMs = Math.max(
+        Math.min(FAILED_PASS_RETRY_MS * 2 ** (streakCount - 1), FAILED_PASS_BACKOFF_CAP_MS),
+        retryAfterMs(error52) ?? 0
+      );
+      retryNotBefore = now() + holdMs;
       lifecycleChanged ||= consultLifecycle;
       deps.onPassResult?.({
         kind,
         at: startedAt,
         ok: false,
-        error: describeError3(error52),
+        error: describeError2(error52),
         sessions: 0,
         upserted: 0
       });
-      deps.log(`${kind} pass failed (${describeError3(error52)}) \u2014 next pass re-covers this window`);
+      const failLine = `${kind} pass failed (${describeError2(error52)})`;
+      deps.log(
+        streakCount > 1 ? `${failLine}: same failure ${streakCount} times in a row, next attempt in ${describeDelay(holdMs)}` : `${failLine}, next attempt in ${describeDelay(holdMs)} re-covers this window`
+      );
       if (error52 instanceof Error && !(error52 instanceof ExpectedCliError) && error52.stack) {
         deps.log(error52.stack);
       }
@@ -81764,10 +82077,13 @@ function createWatchLoop(deps) {
         );
         return;
       }
-      if (consecutiveFailures >= REPORT_AFTER_CONSECUTIVE_FAILURES) {
+      if (consecutiveFailures >= REPORT_AFTER_CONSECUTIVE_FAILURES && (streakReportedAt === 0 || now() - streakReportedAt >= STREAK_REREPORT_INTERVAL_MS)) {
+        streakReportedAt = now();
         const report2 = error52 instanceof ExpectedCliError ? new Error(`${consecutiveFailures} consecutive failed passes: ${error52.message}`) : error52;
         deps.reportError?.(report2, `watch-pass-${kind}`, {
           consecutiveFailures,
+          sameFailureCount: streakCount,
+          streakMinutes: Math.round((now() - streakStartedAt) / 6e4),
           pendingCompletions: pendingCompletions.size
         });
       }
@@ -81855,7 +82171,7 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
     try {
       return loadCredentials(config2.appEnv);
     } catch (error52) {
-      log3(`\u26A0 credential store unreadable (${describeError3(error52)}) \u2014 identity omitted from status`);
+      log3(`\u26A0 credential store unreadable (${describeError2(error52)}) \u2014 identity omitted from status`);
       return null;
     }
   })();
@@ -81869,14 +82185,14 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
     );
   } catch (error52) {
     log3(
-      `\u26A0 Claude Code hook install failed (${describeError3(error52)}) \u2014 syncing continues without them`
+      `\u26A0 Claude Code hook install failed (${describeError2(error52)}) \u2014 syncing continues without them`
     );
     reportCollectorError(error52, "watch-hook-install");
   }
   try {
     startWakeService(config2, home, log3);
   } catch (error52) {
-    log3(`\u26A0 wake-on-message failed to start (${describeError3(error52)}) \u2014 syncing continues`);
+    log3(`\u26A0 wake-on-message failed to start (${describeError2(error52)}) \u2014 syncing continues`);
     reportCollectorError(error52, "watch-wake-start");
   }
   const presentRoots = storeRoots.filter(({ dir }) => existsSync4(dir)).map(({ dir }) => dir);
@@ -81907,7 +82223,7 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
       statusWriteFailed = false;
     } catch (error52) {
       if (!statusWriteFailed) {
-        log3(`\u26A0 status file write failed (${describeError3(error52)}) \u2014 syncing continues`);
+        log3(`\u26A0 status file write failed (${describeError2(error52)}) \u2014 syncing continues`);
         reportCollectorError(error52, "watch-status-write");
       }
       statusWriteFailed = true;
@@ -82005,9 +82321,21 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
   return new Promise(() => {
   });
 }
-function describeError3(error52) {
+function describeError2(error52) {
   return error52 instanceof Error ? error52.message : String(error52);
 }
+function errorSignature(error52) {
+  const parts = [];
+  for (let cause = error52; cause instanceof Error; cause = cause.cause) {
+    parts.push(`${cause.name}: ${cause.message}`);
+  }
+  if (parts.length === 0) parts.push(String(error52));
+  return parts.join(" | ").replace(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, "#").replace(/[0-9a-f]{8,}/gi, "#").replace(/\d+/g, "#");
+}
+function describeDelay(ms) {
+  const seconds = Math.round(ms / 1e3);
+  return seconds < 120 ? `${seconds}s` : `${Math.round(seconds / 60)} minutes`;
+}
 
 // src/connect.ts
 import { execFileSync as execFileSync5, spawnSync } from "node:child_process";
@@ -84284,7 +84612,7 @@ ${RESTART_NOTE}`;
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "0.3.2" : "0.0.0-checkout";
+var CLI_VERSION = true ? "0.4.0" : "0.0.0-checkout";
 var CLI_PACKAGE_NAME = "@usepowerplant/cli";
 
 // src/workspace.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usepowerplant/cli",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "publishConfig": {
     "access": "public"
   },