@zaip-ai/cli 3.7.0 → 4.0.0

package/templates/.agents/dashboard/packages/local-runtime/src/active-codex-telemetry.test.ts

@@ -26,6 +26,37 @@ describe("active Codex telemetry capture", () => {
     });
   });
 
+  it("does not execute a CLI against historical running entries in a stale worktree", async () => {
+    const root = await runtimeFixture("process.exitCode = 8;\n");
+    await writeFile(
+      join(root, ".agents/records/lifecycle/active-work.json"),
+      JSON.stringify({
+        schema_version: 1,
+        items: [{ kind: "run", status: "running", updated_at: "2026-09-01T00:00:00Z" }],
+      }),
+    );
+    await expect(captureActiveCodexTelemetry(root)).resolves.toMatchObject({
+      skipped_reason: "no_recent_active_runs",
+      captured_runs: 0,
+    });
+  });
+  it("still captures a recently active worktree Run", async () => {
+    const root = await runtimeFixture(
+      "process.stdout.write(JSON.stringify({telemetry:{captured:[{captured:true}]}}));\n",
+    );
+    await writeFile(
+      join(root, ".agents/records/lifecycle/active-work.json"),
+      JSON.stringify({
+        schema_version: 1,
+        items: [{ kind: "run", status: "running", updated_at: new Date().toISOString() }],
+      }),
+    );
+    await expect(captureActiveCodexTelemetry(root)).resolves.toMatchObject({
+      captured_runs: 1,
+      skipped_reason: null,
+    });
+  });
+
   it("returns a typed manifest condition when the lifecycle has not been initialized", async () => {
     const root = await runtimeFixture(
       "process.stderr.write('Lifecycle manifest is not initialized'); process.exitCode = 1;\n",

package/templates/.agents/dashboard/packages/local-runtime/src/active-codex-telemetry.ts

@@ -1,8 +1,10 @@
 import { execFile } from "node:child_process";
-import { resolve } from "node:path";
+import { readFile, stat } from "node:fs/promises";
+import { join, resolve } from "node:path";
 import { promisify } from "node:util";
 import { WorkspaceFileSystem } from "@zaip-ai/core";
 import { lifecycleManifestState } from "./server-lifecycle-diagnostics.js";
+import { dashboardCanonicalSourceRoots } from "./sqlite-read-model-source-fingerprint.js";
 
 const execFileAsync = promisify(execFile);
 
@@ -15,6 +17,7 @@ export type ActiveCodexTelemetryCapture = {
     | "manifest_uninitialized"
     | "manifest_invalid"
     | "no_active_runs"
+    | "no_recent_active_runs"
     | "no_new_segments"
     | null;
   last_capture_at: string;
@@ -39,6 +42,16 @@ export async function captureActiveCodexTelemetry(
       skipped_reason: manifestState === "missing" ? "manifest_uninitialized" : "manifest_invalid",
       last_capture_at: new Date().toISOString(),
     };
+  const activeRuns = await recentActiveRuns(workspaceRoot);
+  if (activeRuns !== null && activeRuns.recent === 0) {
+    return {
+      captured_runs: 0,
+      captured_segments: 0,
+      manifest_state: "initialized",
+      skipped_reason: activeRuns.stale > 0 ? "no_recent_active_runs" : "no_active_runs",
+      last_capture_at: new Date().toISOString(),
+    };
+  }
   const cliPath = resolve(workspaceRoot, ".agents", "runtime", "bin", "zaip.mjs");
   try {
     const outcome = await execFileAsync(
@@ -79,6 +92,66 @@ export async function captureActiveCodexTelemetry(
   }
 }
 
+/** A stale lifecycle index is not proof of a live Codex invocation. */
+async function recentActiveRuns(
+  workspaceRoot: string,
+): Promise<{ recent: number; stale: number } | null> {
+  const path = join(workspaceRoot, ".agents", "records", "lifecycle", "active-work.json");
+  const metadata = await stat(path).catch((error: NodeJS.ErrnoException) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  });
+  if (metadata === null) return null;
+  if (metadata.size > 8 * 1024 * 1024) throw new Error("Active-work index exceeds capture limit");
+  const parsed: unknown = JSON.parse(await readFile(path, "utf8"));
+  if (
+    typeof parsed !== "object" ||
+    parsed === null ||
+    !Array.isArray((parsed as { items?: unknown }).items)
+  )
+    throw new Error("Invalid active-work index for telemetry capture");
+  const cutoff = Date.now() - 72 * 60 * 60 * 1_000;
+  const runs = (parsed as { items: unknown[] }).items.filter(
+    (item) =>
+      typeof item === "object" &&
+      item !== null &&
+      (item as { kind?: unknown }).kind === "run" &&
+      (item as { status?: unknown }).status === "running",
+  );
+  const recent = runs.filter((item) => {
+    const updated = (item as { updated_at?: unknown }).updated_at;
+    return (
+      typeof updated === "string" &&
+      Number.isFinite(Date.parse(updated)) &&
+      Date.parse(updated) >= cutoff
+    );
+  }).length;
+  return { recent, stale: runs.length - recent };
+}
+
+/** Capture each canonical checkout before refreshing the combined SQLite view. */
+export async function captureRepositoryActiveCodexTelemetry(
+  workspaceRoot: string,
+): Promise<ActiveCodexTelemetryCapture> {
+  const roots = await dashboardCanonicalSourceRoots(workspaceRoot);
+  const results = await Promise.all(roots.map((root) => captureActiveCodexTelemetry(root)));
+  const primary = results[0];
+  if (primary === undefined) throw new Error("No dashboard workspace was discovered");
+  const capturedRuns = results.reduce((count, result) => count + result.captured_runs, 0);
+  return {
+    captured_runs: capturedRuns,
+    captured_segments: capturedRuns === 0 ? 0 : null,
+    manifest_state: primary.manifest_state,
+    skipped_reason:
+      capturedRuns > 0
+        ? null
+        : results.some((result) => result.skipped_reason === "no_new_segments")
+          ? "no_new_segments"
+          : primary.skipped_reason,
+    last_capture_at: new Date().toISOString(),
+  };
+}
+
 function parseJsonResult(stdout: string): unknown {
   if (!stdout.trim()) throw new Error("Active telemetry capture returned no JSON result");
   try {

package/templates/.agents/dashboard/packages/local-runtime/src/agent-catalog-settings.test.ts

@@ -30,9 +30,9 @@ describe("agent catalog settings", () => {
     const settings = await readAgentCatalogSettings(new WorkspaceFileSystem(workspaceRoot));
 
     expect(settings).toMatchObject({
-      default_model: "gpt-5.6-terra",
+      default_model: "gpt-6-sol",
       default_reasoning_effort: "medium",
-      allowed_models: ["gpt-5.6-luna", "gpt-5.6-terra", "gpt-5.6-sol", "gpt-6-astra"],
+      allowed_models: ["gpt-6-luna", "gpt-6-sol", "gpt-6-astra"],
       allowed_reasoning_efforts: ["low", "medium", "high", "xhigh"],
     });
   });
@@ -47,17 +47,17 @@ describe("agent catalog settings", () => {
       ]),
     ).toEqual(
       expect.arrayContaining([
-        ["agent-orchestrator", "gpt-5.6-terra", "medium"],
-        ["agent-builder", "gpt-5.6-terra", "medium"],
-        ["agent-task-executor", "gpt-5.6-terra", "medium"],
-        ["agent-analyst", "gpt-5.6-sol", "medium"],
-        ["agent-finalizer", "gpt-5.6-terra", "medium"],
-        ["agent-reviewer", "gpt-5.6-terra", "medium"],
-        ["agent-integrator", "gpt-5.6-terra", "high"],
-        ["agent-auditor", "gpt-5.6-sol", "high"],
-        ["agent-text-summarizer", "gpt-5.6-terra", "medium"],
-        ["agent-data-analyst", "gpt-5.6-terra", "medium"],
-        ["agent-refactoring-specialist", "gpt-5.6-terra", "medium"],
+        ["agent-orchestrator", "gpt-6-sol", "medium"],
+        ["agent-builder", "gpt-6-sol", "medium"],
+        ["agent-task-executor", "gpt-6-sol", "medium"],
+        ["agent-analyst", "gpt-6-sol", "medium"],
+        ["agent-finalizer", "gpt-6-sol", "medium"],
+        ["agent-reviewer", "gpt-6-sol", "medium"],
+        ["agent-integrator", "gpt-6-sol", "high"],
+        ["agent-auditor", "gpt-6-sol", "high"],
+        ["agent-text-summarizer", "gpt-6-sol", "medium"],
+        ["agent-data-analyst", "gpt-6-sol", "medium"],
+        ["agent-refactoring-specialist", "gpt-6-sol", "medium"],
       ]),
     );
     expect(current.agents.some((agent) => agent.model.preferred[0] === "policy-selected")).toBe(
@@ -73,7 +73,7 @@ describe("agent catalog settings", () => {
             ...agent,
             model: {
               ...agent.model,
-              preferred: ["gpt-5.6-terra"],
+              preferred: ["gpt-6-sol"],
               reasoning_effort: "high" as const,
             },
           }
@@ -201,7 +201,7 @@ describe("agent catalog settings", () => {
     const target = current.agents[0];
     if (target === undefined) throw new Error("Catalog must contain an agent");
     const options = {
-      allowed_models: ["gpt-5.6-terra"],
+      allowed_models: ["gpt-6-sol"],
       allowed_reasoning_efforts: ["low", "medium", "high", "xhigh"],
     };
 

package/templates/.agents/dashboard/packages/local-runtime/src/project-settings.test.ts

@@ -269,10 +269,10 @@ describe("project settings persistence", () => {
       ...current,
       model_orchestration: {
         mode: "auto",
-        default_model: "gpt-5.6-terra",
+        default_model: "gpt-6-sol",
         default_effort: "medium",
         default_velocity: "standard",
-        allowed_models: ["gpt-5.6-luna", "gpt-5.6-terra", "gpt-5.6-sol"],
+        allowed_models: ["gpt-6-luna", "gpt-6-sol"],
         allowed_efforts: ["low", "medium", "high", "xhigh"],
         max_auto_effort: "xhigh",
         automatic_sources: ["spec", "prd"],

package/templates/.agents/dashboard/packages/local-runtime/src/project-settings.ts

@@ -545,7 +545,7 @@ export function renderSoftwareArchitecture(config: ProjectConfig): string {
     "",
   ]);
   const executionDetails =
-    config.execution && config.execution.runtime !== "manual"
+    config.execution && "autonomous" in config.execution
       ? [
           `- **Runtime:** ${config.execution.runtime}`,
           `- **Provider:** ${markdownCell(config.execution.autonomous.provider)}`,

package/templates/.agents/dashboard/packages/local-runtime/src/server-identity.test.ts

@@ -31,7 +31,7 @@ describe("dashboard identity endpoint", () => {
 
       expect(response.status, await response.clone().text()).toBe(200);
       await expect(response.json()).resolves.toEqual({
-        title: "Dashboard Zaip AIOS",
+        title: "Dashboard ZAIP AIOS",
         repository_name: "",
       });
       expect(refreshReadModel).not.toHaveBeenCalled();

package/templates/.agents/dashboard/packages/local-runtime/src/server-snapshot-synchronization.test.ts

@@ -1,12 +1,13 @@
 import { join } from "node:path";
 import { afterEach, describe, expect, it, vi } from "vitest";
 
-const watchers: Array<{ path: string; listener: () => void }> = [];
+const watchers: Array<{ path: string; listener: () => void; close: ReturnType<typeof vi.fn> }> = [];
 
 vi.mock("node:fs", () => ({
   watch: vi.fn((path: string, _options: unknown, listener: () => void) => {
-    watchers.push({ path, listener });
-    return { unref: vi.fn() };
+    const close = vi.fn();
+    watchers.push({ path, listener, close });
+    return { unref: vi.fn(), close };
   }),
 }));
 
@@ -19,6 +20,27 @@ afterEach(() => {
 });
 
 describe("snapshot source synchronization", () => {
+  it("observes newly registered checkout records and stops observing removed checkouts", async () => {
+    vi.useFakeTimers();
+    let roots = ["C:/main", "C:/codex/worktree"];
+    const refresh = vi.fn(async () => undefined);
+    startSnapshotSynchronization({
+      workspaceRoot: roots[0]!,
+      discoverSourceRoots: async () => roots,
+      staleSeed: false,
+      watchSources: true,
+      refresh,
+    });
+    await vi.advanceTimersByTimeAsync(1);
+    const sibling = watchers.find(({ path }) => path === join(roots[1]!, ".agents", "records"));
+    expect(sibling).toBeDefined();
+    sibling?.listener();
+    await vi.advanceTimersByTimeAsync(300);
+    expect(refresh).toHaveBeenCalled();
+    roots = [roots[0]!];
+    await vi.advanceTimersByTimeAsync(60_000);
+    expect(sibling?.close).toHaveBeenCalledOnce();
+  });
   it("reports capture failure separately while refreshing canonical data", async () => {
     vi.useFakeTimers();
     const error = new Error("capture timed out");

package/templates/.agents/dashboard/packages/local-runtime/src/server-snapshot-synchronization.ts

@@ -4,6 +4,8 @@ import type { ActiveCodexTelemetryCapture } from "./active-codex-telemetry.js";
 
 export function startSnapshotSynchronization(input: {
   workspaceRoot: string;
+  /** Same registered repository sources used by the SQLite fingerprint. */
+  discoverSourceRoots?: () => Promise<readonly string[]>;
   staleSeed: boolean;
   watchSources: boolean;
   refresh: () => Promise<void>;
@@ -27,25 +29,58 @@ export function startSnapshotSynchronization(input: {
     }, 300);
     pendingRefresh.unref();
   };
-  for (const sourceRoot of [
-    join(input.workspaceRoot, ".agents", "data"),
-    join(input.workspaceRoot, ".agents", "records"),
-    join(input.workspaceRoot, ".agents", "config"),
-  ]) {
+  const watchers = new Map<string, ReturnType<typeof watch>>();
+  const syncWatchers = (roots: readonly string[]) => {
+    const wanted = new Set(
+      roots.flatMap((root) =>
+        ["data", "records", "config"].map((kind) => join(root, ".agents", kind)),
+      ),
+    );
+    for (const [path, watcher] of watchers) {
+      if (!wanted.has(path)) {
+        watcher.close();
+        watchers.delete(path);
+        scheduleRefresh();
+      }
+    }
+    for (const path of wanted) {
+      if (watchers.has(path)) continue;
+      try {
+        const watcher = watch(path, { recursive: true }, scheduleRefresh);
+        watcher.unref();
+        watchers.set(path, watcher);
+      } catch {
+        // The periodic fingerprint remains the fallback on unsupported filesystems.
+      }
+    }
+  };
+  syncWatchers([input.workspaceRoot]);
+  const discover = async () => {
+    if (input.discoverSourceRoots === undefined) return;
     try {
-      const watcher = watch(sourceRoot, { recursive: true }, scheduleRefresh);
-      watcher.unref();
-    } catch {
-      // Reuse-triggered refresh remains the portable fallback.
+      syncWatchers(await input.discoverSourceRoots());
+    } catch (error) {
+      input.onRefreshFailure?.({ trigger: "source_change", error });
     }
-  }
+  };
+  void discover();
+  let captureInFlight = false;
   const captureAndRefresh = () => {
-    if (input.captureActiveTelemetry === undefined) return scheduleRefresh();
-    void input
-      .captureActiveTelemetry()
-      .then((result) => input.onCaptureSuccess?.(result))
-      .catch((error: unknown) => input.onCaptureFailure?.(error))
-      .finally(scheduleRefresh);
+    if (captureInFlight) return;
+    captureInFlight = true;
+    void (async () => {
+      try {
+        await discover();
+        if (input.captureActiveTelemetry !== undefined) {
+          input.onCaptureSuccess?.(await input.captureActiveTelemetry());
+        }
+      } catch (error) {
+        input.onCaptureFailure?.(error);
+      } finally {
+        scheduleRefresh();
+        captureInFlight = false;
+      }
+    })();
   };
   // Run at most once a minute. File watchers only project canonical changes;
   // they never launch telemetry or lifecycle work.

package/templates/.agents/dashboard/packages/local-runtime/src/server-snapshot.test.ts

@@ -514,7 +514,7 @@ describe("dashboard backend snapshot", () => {
       });
       await expect(response.json()).resolves.toMatchObject({
         dashboard: {
-          title: "Dashboard Zaip AIOS",
+          title: "Dashboard ZAIP AIOS",
           repository_name: "",
         },
         operations: { readonly: true, summary: { source_latest_at: "2026-07-14T00:00:05.000Z" } },

package/templates/.agents/dashboard/packages/local-runtime/src/server-ui-security.ts

@@ -0,0 +1,37 @@
+import { randomBytes } from "node:crypto";
+import type { Context } from "hono";
+
+export const DASHBOARD_LOOPBACK_HOST = "127.0.0.1";
+
+export function isAllowedOrigin(origin: string): boolean {
+  try {
+    const parsed = new URL(origin);
+    return (
+      parsed.protocol === "http:" &&
+      (parsed.hostname === DASHBOARD_LOOPBACK_HOST || parsed.hostname === "localhost")
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function isSafeUiPath(pathname: string): boolean {
+  try {
+    const decoded = decodeURIComponent(pathname).replaceAll("\\", "/");
+    return !decoded.includes("\0") && !decoded.split("/").some((segment) => segment === "..");
+  } catch {
+    return false;
+  }
+}
+
+export function defaultSessionToken(): string {
+  return process.env.ZAIP_UI_TOKEN ?? randomBytes(24).toString("base64url");
+}
+
+export function shouldBootstrapBrowserSession(context: Context): boolean {
+  if (context.req.method !== "GET" && context.req.method !== "HEAD") return false;
+  if (context.req.path !== "/" && context.req.path !== "/index.html") return false;
+  const origin = context.req.header("origin");
+  if (origin !== undefined && !isAllowedOrigin(origin)) return false;
+  return context.req.header("sec-fetch-site") !== "cross-site";
+}

package/templates/.agents/dashboard/packages/local-runtime/src/server-workspace.ts

@@ -11,7 +11,7 @@ export async function dashboardIdentity(
   filesystem: WorkspaceFileSystem,
   workspaceRoot: string,
 ): Promise<{ title: string; repository_name: string }> {
-  let title = process.env.ZAIP_DASHBOARD_TITLE?.trim() || "Dashboard Zaip AIOS";
+  let title = process.env.ZAIP_DASHBOARD_TITLE?.trim() || "Dashboard ZAIP AIOS";
   let repositorySetting = "auto";
   try {
     if (await filesystem.exists(DASHBOARD_CONFIG_PATH)) {

package/templates/.agents/dashboard/packages/local-runtime/src/server.ts

@@ -1,4 +1,3 @@
-import { randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { basename, resolve } from "node:path";
 import { serve } from "@hono/node-server";
@@ -9,7 +8,7 @@ import { type Context, Hono } from "hono";
 import { getCookie, setCookie } from "hono/cookie";
 import {
   type ActiveCodexTelemetryCapture,
-  captureActiveCodexTelemetry,
+  captureRepositoryActiveCodexTelemetry,
 } from "./active-codex-telemetry.js";
 import { runAgentAdapterSync } from "./agent-adapter-sync.js";
 import {
@@ -44,10 +43,18 @@ import { startSnapshotSynchronization } from "./server-snapshot-synchronization.
 import { writeReadModelStartup, writeStartupPhase } from "./server-startup.js";
 import { selectedCurrency } from "./server-summary-helpers.js";
 import { registerTraceRoutes } from "./server-trace-routes.js";
+import {
+  defaultSessionToken,
+  DASHBOARD_LOOPBACK_HOST as HOST,
+  isAllowedOrigin,
+  isSafeUiPath,
+  shouldBootstrapBrowserSession,
+} from "./server-ui-security.js";
 import {
   createWorkReconciliation,
   waitForWorkReconciliation,
 } from "./server-work-reconciliation.js";
+import { dashboardCanonicalSourceRoots } from "./sqlite-read-model-source-fingerprint.js";
 
 export { reconciliationNeedsRefresh } from "./server-work-reconciliation.js";
 
@@ -76,7 +83,6 @@ export {
   validateSqliteReadModelSchema,
 } from "./sqlite-read-model.js";
 
-const HOST = "127.0.0.1";
 const RUNTIME_KIND = "zaip-dashboard-sqlite-runtime";
 const SESSION_COOKIE = "zaip-dashboard-sqlite-session";
 
@@ -98,35 +104,6 @@ interface DashboardAppOptions {
   launcherOwned?: boolean;
 }
 
-function isAllowedOrigin(origin: string): boolean {
-  try {
-    const parsed = new URL(origin);
-    return (
-      parsed.protocol === "http:" && (parsed.hostname === HOST || parsed.hostname === "localhost")
-    );
-  } catch {
-    return false;
-  }
-}
-function isSafeUiPath(pathname: string): boolean {
-  try {
-    const decoded = decodeURIComponent(pathname).replaceAll("\\", "/");
-    return !decoded.includes("\0") && !decoded.split("/").some((segment) => segment === "..");
-  } catch {
-    return false;
-  }
-}
-function defaultSessionToken(): string {
-  return process.env.ZAIP_UI_TOKEN ?? randomBytes(24).toString("base64url");
-}
-function shouldBootstrapBrowserSession(context: Context): boolean {
-  if (context.req.method !== "GET" && context.req.method !== "HEAD") return false;
-  if (context.req.path !== "/" && context.req.path !== "/index.html") return false;
-  const origin = context.req.header("origin");
-  if (origin !== undefined && !isAllowedOrigin(origin)) return false;
-  return context.req.header("sec-fetch-site") !== "cross-site";
-}
-
 /**
  * Keep the entity/macro details on the snapshot filesystem, while making the
  * first-fold counters and token/cost facts come from SQL.
@@ -262,11 +239,12 @@ export function createDashboardApp(
   };
   startSnapshotSynchronization({
     workspaceRoot,
+    discoverSourceRoots: () => dashboardCanonicalSourceRoots(workspaceRoot),
     staleSeed: isSqliteSnapshot && snapshotState === "updating",
     watchSources: isSqliteSnapshot && options.watchSources === true,
     refresh: rebuildProjection,
     ...(isSqliteSnapshot && options.watchSources === true
-      ? { captureActiveTelemetry: () => captureActiveCodexTelemetry(workspaceRoot) }
+      ? { captureActiveTelemetry: () => captureRepositoryActiveCodexTelemetry(workspaceRoot) }
       : {}),
     onRefreshFailure: projectionRefreshDiagnostics.record,
     onCaptureSuccess: (result) => {

package/templates/.agents/dashboard/packages/local-runtime/src/sqlite-read-model-rebuild.ts

@@ -30,24 +30,27 @@ import {
   validateSqliteReadModelSchema,
 } from "./sqlite-read-model-schema.js";
 import { sourceFingerprint } from "./sqlite-read-model-source-fingerprint.js";
+import {
+  rebuildFingerprintOptions,
+  type SqliteRebuildOptions,
+} from "./sqlite-rebuild-fingerprint-options.js";
 import type { SqliteRebuildResult } from "./sqlite-rebuild-result.js";
 import { readSnapshotFileCount } from "./sqlite-snapshot-cache.js";
 import { deriveCanonicalWorkStages } from "./sqlite-work-stages.js";
 export async function rebuildSqliteReadModel(
   workspaceRoot: string,
-  options: { forceCanonical?: boolean; preferExisting?: boolean } = {},
+  options: SqliteRebuildOptions = {},
 ): Promise<SqliteRebuildResult> {
   const path = sqliteReadModelPath(workspaceRoot);
-  // A reusable snapshot still has to match its canonical fingerprint. This
-  // avoids advertising every launch as stale while preserving the stale seed
-  // path for a changed source or an incompatible database.
+  // Reuse only when schema and canonical fingerprint still match; otherwise rebuild.
   if (options.preferExisting && !options.forceCanonical) {
     try {
       validateSqliteReadModelSchema(path);
       const fingerprintStartedAt = performance.now();
-      const sourceSnapshot = await sourceFingerprint(workspaceRoot, {
-        previous: persistedSourceCheckpoint(path),
-      });
+      const sourceSnapshot = await sourceFingerprint(
+        workspaceRoot,
+        rebuildFingerprintOptions(path, options),
+      );
       const fingerprint = `${sourceSnapshot.fingerprint}\ncurrent_day=${saoPauloDay(new Date().toISOString())}`;
       const database = new DatabaseSync(path, { readOnly: true });
       try {
@@ -108,9 +111,7 @@ export async function rebuildSqliteReadModel(
   reportLaunchProgress("source_fingerprint_started", 8, "Inventariando fontes canônicas.");
   let sourceSnapshot = await sourceFingerprint(
     workspaceRoot,
-    options.forceCanonical
-      ? { verifyContent: true }
-      : { previous: persistedSourceCheckpoint(path) },
+    rebuildFingerprintOptions(path, options),
   );
   let refresh = {
     reused_sources: sourceSnapshot.reusedFiles,
@@ -157,9 +158,7 @@ export async function rebuildSqliteReadModel(
       // Capture canonical inputs only after acquiring exclusive writer ownership.
       sourceSnapshot = await sourceFingerprint(
         workspaceRoot,
-        options.forceCanonical
-          ? { verifyContent: true }
-          : { previous: persistedSourceCheckpoint(path) },
+        rebuildFingerprintOptions(path, options),
       );
       refresh = {
         reused_sources: sourceSnapshot.reusedFiles,

package/templates/.agents/dashboard/packages/local-runtime/src/sqlite-read-model-source-fingerprint.test.ts

@@ -1,7 +1,9 @@
+import { execFileSync } from "node:child_process";
 import { mkdir, mkdtemp, rename, rm, stat, utimes, writeFile } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { basename, join, resolve } from "node:path";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import {
+  isCodexManagedWorktreeRoot,
   type SqliteReadModelSourceCandidate,
   sourceFingerprint,
 } from "./sqlite-read-model-source-fingerprint.js";
@@ -26,6 +28,74 @@ afterEach(async () => {
 });
 
 describe("persistent source fingerprint checkpoints", () => {
+  it("includes direct Codex checkouts but not nested Task workspaces", () => {
+    expect(isCodexManagedWorktreeRoot("C:\\Users\\david\\.codex\\worktrees\\v38-readiness")).toBe(
+      true,
+    );
+    expect(isCodexManagedWorktreeRoot("/home/david/.codex/worktrees/v38-readiness")).toBe(true);
+    expect(isCodexManagedWorktreeRoot("C:\\Users\\david\\.codex\\worktrees\\v38\\zaip-aios")).toBe(
+      true,
+    );
+    expect(isCodexManagedWorktreeRoot("/home/david/.codex/worktrees/v38/zaip-aios")).toBe(true);
+    expect(
+      isCodexManagedWorktreeRoot(
+        "C:\\Users\\david\\.codex\\worktrees\\v38\\zaip-aios\\.local\\task-workspaces\\tree",
+      ),
+    ).toBe(false);
+  });
+  it("aggregates registered roots by canonical ID and chooses the newest record, not checkout mtime", async () => {
+    const { root, path } = await fixture();
+    const sibling = await mkdtemp(
+      join(resolve(import.meta.dirname, "../../../../..", ".local/sqlite/tests"), "worktree-"),
+    );
+    roots.push(sibling);
+    const siblingPath = join(sibling, ".agents/records/tasks/task.md");
+    await mkdir(join(sibling, ".agents/records/tasks"), { recursive: true });
+    await writeFile(path, "---\nid: TASK-1\nupdated_at: 2026-09-17T12:00:00Z\n---\nold\n");
+    await writeFile(siblingPath, "---\nid: TASK-1\nupdated_at: 2026-09-23T12:00:00Z\n---\nnew\n");
+    await utimes(path, new Date("2026-09-24"), new Date("2026-09-24"));
+    const snapshot = await sourceFingerprint(root, { sourceRoots: [root, sibling] });
+    expect(snapshot.candidates).toHaveLength(1);
+    expect(snapshot.candidates[0]?.path).toBe(siblingPath);
+    await writeFile(
+      join(sibling, ".agents/records/tasks/another.md"),
+      "---\nid: TASK-2\nupdated_at: 2026-09-23T12:00:00Z\n---\n",
+    );
+    const expanded = await sourceFingerprint(root, { sourceRoots: [root, sibling] });
+    expect(expanded.candidates.map((candidate) => candidate.source)).toEqual([
+      ".agents/records/tasks/another.md",
+      ".agents/records/tasks/task.md",
+    ]);
+  });
+
+  it("automatically discovers a registered Codex worktree and includes its canonical Task", async () => {
+    const { root } = await fixture();
+    execFileSync("git", ["init", "-q", root]);
+    execFileSync("git", ["-C", root, "add", ".agents/records/tasks/task.md"]);
+    execFileSync("git", [
+      "-C",
+      root,
+      "-c",
+      "user.name=Test",
+      "-c",
+      "user.email=test@example.invalid",
+      "commit",
+      "-qm",
+      "base",
+    ]);
+    const candidate = join(root, ".codex", "worktrees", "candidate", basename(root));
+    await mkdir(resolve(candidate, ".."), { recursive: true });
+    execFileSync("git", ["-C", root, "worktree", "add", "-q", "-b", "candidate", candidate]);
+    await writeFile(
+      join(candidate, ".agents/records/tasks/new.md"),
+      "---\nid: TASK-NEW\ncreated_at: 2026-09-23T12:00:00Z\n---\n",
+    );
+    const discovered = await sourceFingerprint(root);
+    expect(discovered.candidates.map((item) => item.source)).toContain(
+      ".agents/records/tasks/new.md",
+    );
+  });
+
   it("includes current data records, retains legacy records, and excludes generated projections", async () => {
     const { root } = await fixture();
     await mkdir(join(root, ".agents/data/runs/2026/09"), { recursive: true });