agentwrangler 0.1.1-next.b96c996 → 0.1.1-next.bdce596

package/README.md

@@ -84,9 +84,11 @@ five hooks; **Copy install prompt** prepares instructions for three. Copying alo
 ## Privacy and limits
 
 - The daemon binds to **127.0.0.1**. There is no telemetry or hosted product backend.
-- SQLite contains aggregates and structural data, and can also contain local command text
-  and filesystem paths. Treat it as sensitive. The optional PreCompact hook makes separate
-  raw transcript copies on your machine.
+- SQLite contains aggregates and structural data, plus filesystem paths. Command rows keep
+  only `/compact`, `/clear`, or an unclassified marker — other commands and arguments are
+  discarded, though databases or backups from before the upgrade can still hold raw command
+  text (sanitation is logical, not physical erasure). Treat it as sensitive. The optional
+  PreCompact hook makes separate raw transcript copies on your machine.
 - Usage refresh can contact Anthropic using your existing Claude Code sign-in. GitHub
   outcomes sync requires a configured token. [Privacy details](https://github.com/Doogit/AgentWrangler/blob/main/docs/privacy.md).
 - Claude Code format changes can require parser updates. This is a single-user tool.

package/dist/daemon/http.js

@@ -27,53 +27,178 @@ import * as http from "node:http";
 import { isReady } from "./readiness.js";
 import { handleApiRequest } from "./router.js";
 import { createStaticHandler } from "./static.js";
-/** Inline loading page served while the daemon's initial back-scan is running. */
+/**
+ * Inline loading page served while the daemon's initial back-scan is running
+ * (BOOT-2, Option E): docked terminal panel streaming boot_scan_events on top,
+ * three live counters + a determinate progress bar below, fade into the app on
+ * ready (no white-flash hard reload). Self-contained by design — the SPA's
+ * assets are not servable pre-ready, so design-token VALUES are copied from
+ * src/ui/styles.css (dark theme) with that file as the source of truth.
+ * Falls back to the plain "Scanning transcripts — N of M files" line when the
+ * BOOT-1 fields are absent (older daemon mid-upgrade).
+ */
 const LOADING_HTML = `<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="color-scheme" content="dark">
 <title>AgentWrangler — Starting up</title>
 <style>
+/* Token values copied from src/ui/styles.css (dark theme) — keep in sync. */
+:root{
+  --bg:#0b0f1a;--panel:#111827;--panel2:#1a2233;--line:rgba(255,255,255,.07);
+  --text:#e2e8f0;--text2:#94a3b8;--muted:#9aa9bd;
+  --cyan:#22d3ee;--violet:#a78bfa;--green:#34d399;
+  --sans:system-ui,-apple-system,"Segoe UI",sans-serif;
+  --mono:ui-monospace,Consolas,Menlo,monospace;
+}
 *{box-sizing:border-box;margin:0;padding:0}
-body{background:#0b0f17;color:#c9d1d9;font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;text-align:center}
-.wrap{padding:2rem}
-h1{font-size:1.5rem;font-weight:700;color:#f0f6fc;letter-spacing:.05em}
-h2{font-size:1rem;font-weight:400;color:#38bdf8;margin:.75rem 0 .5rem}
-p{font-size:.875rem;color:#8b949e;max-width:36ch;margin:0 auto 2rem}
-.spinner{width:40px;height:40px;border:3px solid #1e293b;border-top-color:#38bdf8;border-radius:50%;animation:spin 1s linear infinite;margin:0 auto}
-.count{font-variant-numeric:tabular-nums;color:#8b949e;font-size:.875rem;margin:1.25rem auto 0;min-height:1.2em}
-@keyframes spin{to{transform:rotate(360deg)}}
+html{background:var(--bg)}
+body{
+  background:var(--bg);
+  color:var(--text);font-family:var(--sans);min-height:100vh;
+  display:grid;place-content:center;gap:28px;padding:24px 0;
+}
+body.leaving .log,body.leaving .hero{opacity:0}
+.log,.hero{opacity:1;transition:opacity .4s ease}
+.log{
+  background:#0a0e16;margin:0 auto;width:min(480px,calc(100vw - 36px));
+  border:1px solid var(--line);border-radius:8px;overflow:hidden;
+  display:grid;grid-template-rows:26px 1fr;height:158px;
+}
+.log-head{
+  display:flex;align-items:center;gap:8px;padding:0 12px;
+  background:var(--panel);border-bottom:1px solid var(--line);
+  font-family:var(--mono);font-size:10px;color:var(--muted);
+  letter-spacing:.08em;text-transform:uppercase;
+}
+.log-head .dot{width:7px;height:7px;border-radius:50%;background:var(--green)}
+.log-body{
+  padding:8px 12px;font-family:var(--mono);font-size:10.5px;line-height:1.7;
+  color:var(--text2);overflow:hidden;display:flex;flex-direction:column;justify-content:flex-end;
+}
+.log-body .ln{white-space:nowrap;overflow:hidden;text-overflow:ellipsis}
+.log-body .ok{color:var(--green)}
+.log-body .hl{color:var(--cyan)}
+.hero{display:grid;place-content:center;gap:16px;text-align:center;padding:0 16px}
+.headline{font-size:15px;font-weight:600}
+.headline span{color:var(--cyan)}
+.counters{display:flex;gap:34px;justify-content:center;flex-wrap:wrap}
+.counter .cv{font-family:var(--mono);font-size:30px;font-weight:600;font-variant-numeric:tabular-nums;letter-spacing:-.01em}
+.counter:nth-child(1) .cv{color:var(--cyan)}
+.counter:nth-child(2) .cv{color:var(--violet)}
+.counter:nth-child(3) .cv{color:var(--green)}
+.counter .cl{font-size:10.5px;color:var(--muted);text-transform:uppercase;letter-spacing:.1em;margin-top:2px}
+.pbar{width:300px;max-width:80vw;height:6px;background:var(--panel2);border-radius:99px;overflow:hidden;margin:0 auto}
+.pbar i{display:block;height:100%;width:0;background:linear-gradient(90deg,var(--cyan),var(--violet));border-radius:99px;transition:width .25s ease-out}
+.status{font-family:var(--mono);font-size:11.5px;color:var(--muted);min-height:1.2em;font-variant-numeric:tabular-nums}
+@media (prefers-reduced-motion:reduce){
+  .log,.hero,.pbar i{transition:none}
+}
 </style>
 </head>
 <body>
-<div class="wrap">
-  <h1>AgentWrangler</h1>
-  <h2>Starting up…</h2>
-  <p>Scanning your Claude Code transcripts — this can take a few minutes on first run; later loads are instant.</p>
-  <div class="spinner"></div>
-  <p class="count" id="count" aria-live="polite"></p>
+<div class="log" id="log" hidden>
+  <div class="log-head"><span class="dot"></span>boot scan · <span id="rate">— files/s</span></div>
+  <div class="log-body" id="logbody"></div>
+</div>
+<div class="hero">
+  <div class="headline">Preparing your <span>Claude Code</span> data…</div>
+  <div class="counters">
+    <div class="counter"><div class="cv" id="c-files">0</div><div class="cl">files scanned</div></div>
+    <div class="counter"><div class="cv" id="c-sess">0</div><div class="cl">sessions found</div></div>
+    <div class="counter"><div class="cv" id="c-tok">0</div><div class="cl">tokens counted</div></div>
+  </div>
+  <div class="pbar"><i id="fill"></i></div>
+  <div class="status" id="status" aria-live="polite">Scanning transcript roots…</div>
 </div>
 <script>
-(function poll(){
-  fetch('/api/ready')
-    .then(function(r){return r.json();})
-    .then(function(d){
-      if(d.ready){location.reload();return;}
-      // Reuse the first-run onboarding counter so a large first scan shows live
-      // progress instead of a bare spinner. Cadence unchanged (1s).
-      fetch('/api/status')
-        .then(function(r){return r.json();})
-        .then(function(s){
-          if(s&&typeof s.files_seen==='number'&&s.files_seen>0){
-            document.getElementById('count').textContent=
-              'Scanning transcripts — '+s.files_parsed+' of '+s.files_seen+' files';
-          }
-        })
-        .catch(function(){})
-        .then(function(){setTimeout(poll,1000);});
-    })
-    .catch(function(){setTimeout(poll,1000);});
+(function(){
+  var reduced=false;
+  try{reduced=matchMedia('(prefers-reduced-motion: reduce)').matches;}catch(e){}
+  var lastSeq=0,prevFiles=null,prevT=null,rateEma=null,leaving=false;
+  function $(id){return document.getElementById(id);}
+  function fmt(n){return Number(n||0).toLocaleString('en-US');}
+  function fmtTok(n){
+    n=Number(n||0);
+    if(n>=1e9)return (n/1e9).toFixed(1)+'B';
+    if(n>=1e6)return (n/1e6).toFixed(1)+'M';
+    if(n>=1e3)return (n/1e3).toFixed(1)+'K';
+    return String(n);
+  }
+  function finish(){
+    if(leaving)return;
+    leaving=true;
+    // Fade out, then swap to the app behind the transition — no white flash.
+    document.body.className='leaving';
+    setTimeout(function(){location.reload();},reduced?0:450);
+  }
+  function renderLog(events){
+    var body=$('logbody');
+    for(var i=0;i<events.length;i++){
+      var ev=events[i];
+      if(!ev||typeof ev.seq!=='number'||ev.seq<=lastSeq)continue;
+      lastSeq=ev.seq;
+      var el=document.createElement('div');
+      el.className='ln'+(ev.kind==='stage'?' hl':ev.kind==='root'?' ok':'');
+      el.textContent=String(ev.text||'');
+      body.appendChild(el);
+      while(body.children.length>6)body.removeChild(body.firstChild);
+    }
+  }
+  function render(s){
+    if(!s)return;
+    var files=typeof s.files_parsed==='number'?s.files_parsed:0;
+    var seen=typeof s.files_seen==='number'?s.files_seen:0;
+    var hasBoot=Array.isArray(s.boot_scan_events);
+    // Progress denominator: discovery's up-front total. files_seen only counts
+    // files visited so far, which would pin a determinate bar at ~100%.
+    var total=hasBoot&&typeof s.boot_files_total==='number'&&s.boot_files_total>0?s.boot_files_total:seen;
+    $('c-files').textContent=fmt(files);
+    $('c-sess').textContent=fmt(typeof s.boot_sessions_found==='number'?s.boot_sessions_found:(s.sessions||0));
+    $('c-tok').textContent=hasBoot?fmtTok(s.boot_tokens_counted):'—';
+    var pct=total>0?Math.min(100,Math.round(100*files/total)):0;
+    $('fill').style.width=pct+'%';
+    // Client-side ETA from the parse-rate delta between polls (EMA-smoothed).
+    var now=Date.now();
+    if(prevFiles!==null&&now>prevT){
+      var r=(files-prevFiles)/((now-prevT)/1000);
+      if(r>0)rateEma=rateEma===null?r:(rateEma*0.7+r*0.3);
+    }
+    prevFiles=files;prevT=now;
+    if(hasBoot){
+      $('log').hidden=false;
+      renderLog(s.boot_scan_events);
+      var rr=typeof s.boot_files_per_sec==='number'?s.boot_files_per_sec:0;
+      $('rate').textContent=(rr>0?rr:'—')+' files/s';
+      if(total===0){
+        $('status').textContent='Scanning transcript roots…';
+      }else if(pct<100){
+        var eta=rateEma&&rateEma>0?Math.max(1,Math.round((total-files)/rateEma)):null;
+        $('status').textContent='Parsing sessions'+(eta!==null?' — '+eta+'s remaining':'…');
+      }else{
+        $('status').textContent='Opening your dashboard…';
+      }
+    }else if(seen>0){
+      // Fallback for an older daemon without BOOT-1 fields: keep the plain
+      // first-run counter line ("N of M files"), never a blank page.
+      $('status').textContent='Scanning transcripts — '+files+' of '+seen+' files';
+    }
+  }
+  (function poll(){
+    fetch('/api/ready')
+      .then(function(r){return r.json();})
+      .then(function(d){
+        if(d.ready){finish();return;}
+        fetch('/api/status')
+          .then(function(r){return r.json();})
+          .then(render)
+          .catch(function(){})
+          .then(function(){setTimeout(poll,1000);});
+      })
+      .catch(function(){setTimeout(poll,1000);});
+  })();
 })();
 </script>
 </body>
@@ -132,6 +257,14 @@ function requiresSessionToken(pathname) {
     if (pathname === "/api/recommendations/adopt" || pathname === "/api/recommendations/dismiss") {
         return true;
     }
+    if (pathname === "/api/recommendations/feedback")
+        return true;
+    if (pathname === "/api/recommendations/feedback/undo")
+        return true;
+    if (pathname === "/api/recommendations/goal")
+        return true;
+    if (pathname === "/api/recommendations/goal/reset")
+        return true;
     if (/^\/api\/recommendations\/[^/]+\/apply$/.test(pathname))
         return true;
     if (/^\/api\/recommendations\/[^/]+\/open-terminal$/.test(pathname))

package/dist/daemon/index.js

@@ -23,6 +23,7 @@ import { configGet as bptConfigGet, calibrateBytesPerToken } from "../detector/c
 import { runContextProbe } from "../detector/context-probe.js";
 import { runDetectors } from "../detector/index.js";
 import { installHook, uninstallHook } from "../hook/install.js";
+import { getBootProgress, pushBootEvent } from "../ingest/boot-progress.js";
 import { collectSessionChurn } from "../ingest/churn-collector.js";
 import { runPostProbeHook, setPostIngestHook, setPostProbeHook } from "../ingest/detector-hook.js";
 import { Ingestor } from "../ingest/index.js";
@@ -224,6 +225,7 @@ async function runBootScan() {
         setHealthInstance(ingestor.health);
         handle = await ingestor.startTailBatched();
         setScanState("complete");
+        pushBootEvent("stage", `parse complete — ${getBootProgress().boot_sessions_found} sessions found`);
         setRuntimeResetHook(() => ingestor.clearRuntimeState());
         console.log(`Ingestion: initial scan complete — health ${JSON.stringify(ingestor.healthSnapshot())}`);
     }
@@ -236,6 +238,7 @@ async function runBootScan() {
     // boot probe ran before any workspace existed and could only size the global sources.
     // Then re-evaluate detectors so D1 surfaces its per-source context recs on the first run
     // instead of waiting for the next 10-minute poll.
+    pushBootEvent("stage", "building aggregates…");
     runProbePass("post-scan");
     try {
         runDetectors(db, { now: new Date() });
@@ -245,6 +248,7 @@ async function runBootScan() {
     }
     // Signal readiness BEFORE the outcomes pass — outcomes is a slow ~97s I/O
     // pass that yields on `gh` subprocess I/O; the loading page must not wait on it.
+    pushBootEvent("stage", "ready — opening dashboard");
     setReady();
     // Outcomes bootstrap — deferred until after the back-scan so the event loop
     // is free and readGithubToken() execFile (10 s timeout) cannot be starved.

package/dist/daemon/router.js

@@ -1,5 +1,6 @@
 import { getReportedWork } from "../query/api/reported-work.js";
 import { getPractices } from "../detector/practice-registry.js";
+import { getBootProgress } from "../ingest/boot-progress.js";
 import { getOAuthStatus } from "../oauth/credentials.js";
 import { getGithubTokenStatus } from "../outcomes/github/credential.js";
 import { manualLink, manualUnlink } from "../outcomes/linker.js";
@@ -11,9 +12,10 @@ import { EffectRequestError, listEffectEvidence, mutateEffectCycle, trackComplet
 import { getClosureProxy } from "../query/api/effectiveness.js";
 import { getEfficiencyHeadroom } from "../query/api/efficiency-headroom.js";
 import { getEsfObservations, getSessionEsfObservations } from "../query/api/esf-observations.js";
+import { FeedbackError, deleteFeedbackRoute, getGoalRoute, listFeedbackRoute, resetGoalRoute, setFeedbackRoute, setGoalRoute, undoFeedbackRoute, } from "../query/api/feedback-store.js";
 import { getHeadroomTrend } from "../query/api/headroom-trend.js";
 import { getHotSessions } from "../query/api/hot-sessions.js";
-import { adoptRecommendation, calibrateBytesPerToken, calibrateLimit, confirmApplyJob, dismissRecommendation, getApplyJob, getContextBudget, getContextComposition, getGlobalOverview, getHookConfig, getIdleSessions, getLinkageRate, getLoopGuard, getSession, getSessionDrivers, getSettings, getSuccessRate, getTurnTimeline, getWorkspaceOutcomeDetail, installHookRoute, listLedger, listLiveSessions, listRecommendations, listSessions, listWorkspaceOutcomes, listWorkspaces, openTerminalForRec, resetDatabase, rollbackApplyJob, startApplyJob, uninstallHookRoute, updateHookConfig, updateSettings, } from "../query/api/index.js";
+import { adoptRecommendation, calibrateBytesPerToken, calibrateLimit, confirmApplyJob, dismissRecommendation, getApplyJob, getContextBudget, getContextComposition, getGlobalOverview, getHookConfig, getIdleSessions, getLinkageRate, getLoopGuard, getSession, getSessionDrivers, getSettings, getSuccessRate, getTurnTimeline, getWorkspaceOutcomeDetail, installHookRoute, listLedger, listLiveSessions, listRecommendations, listSessions, listWorkspaceNames, listWorkspaceOutcomes, listWorkspaces, openTerminalForRec, resetDatabase, rollbackApplyJob, startApplyJob, uninstallHookRoute, updateHookConfig, updateSettings, } from "../query/api/index.js";
 import { getOffloadShare } from "../query/api/offload-share.js";
 import { getReport, listReports } from "../query/api/reports.js";
 import { getSelfChurn } from "../query/api/self-churn.js";
@@ -31,6 +33,39 @@ function sendJson(res, status, body) {
     });
     res.end(payload);
 }
+function sendFeedbackError(res, error) {
+    if (error instanceof FeedbackError) {
+        sendJson(res, error.status, { error: error.message, code: error.code });
+        return;
+    }
+    // Oversized body (readBody) rejects with EffectRequestError(400, …).
+    if (error instanceof EffectRequestError) {
+        sendJson(res, error.status, { error: error.message, code: "INVALID_REQUEST" });
+        return;
+    }
+    sendJson(res, 500, { error: "Internal error" });
+}
+/** Read + JSON-parse a write body, then run `run` and send its enveloped result. */
+function withJsonBody(req, res, run) {
+    readBody(req, 4096)
+        .then((raw) => {
+        let body;
+        try {
+            body = JSON.parse(raw);
+        }
+        catch {
+            sendJson(res, 400, { error: "Invalid JSON body", code: "INVALID_REQUEST" });
+            return;
+        }
+        try {
+            sendJson(res, 200, run(body));
+        }
+        catch (error) {
+            sendFeedbackError(res, error);
+        }
+    })
+        .catch((error) => sendFeedbackError(res, error));
+}
 function readBody(req, maxBytes) {
     return new Promise((resolve, reject) => {
         const chunks = [];
@@ -133,6 +168,18 @@ function workRecordId(pathname) {
     const match = pathname.match(/^\/api\/work-records\/([^/]+)$/);
     return match?.[1] === undefined ? null : decodeURIComponent(match[1]);
 }
+function listSavedCostReports(db, workspaceId) {
+    return db
+        .prepare(`SELECT r.allocation_revision_id, r.created_at, r.cohort_from, r.cohort_to,
+      SUM(CASE WHEN a.disposition = 'OWNED' THEN 1 ELSE 0 END) AS allocated_session_count,
+      COUNT(a.session_id) AS eligible_session_count
+    FROM work_allocation_revisions r
+    LEFT JOIN work_session_allocations a ON a.allocation_revision_id = r.allocation_revision_id
+    WHERE r.workspace_id = ?
+    GROUP BY r.allocation_revision_id
+    ORDER BY r.created_at DESC, r.allocation_revision_id DESC`)
+        .all(workspaceId);
+}
 function workRecordAction(pathname) {
     const match = pathname.match(/^\/api\/work-records\/([^/]+)\/(edit|closeout|archive|reopen|sessions|contexts|delete)(?:\/([^/]+)\/detach)?$/);
     if (match?.[1] === undefined || match[2] === undefined)
@@ -264,6 +311,16 @@ export function handleApiRequest(_db, req, res, method, url) {
             sendJson(res, 200, workRecordResponse(records, { n: records.length, workspaceId }));
             return;
         }
+        if (method === "GET" && pathname === "/api/work-records/allocations") {
+            const workspaceId = new URLSearchParams(url.split("?")[1] ?? "").get("workspace_id");
+            if (workspaceId === null || workspaceId.length === 0) {
+                sendJson(res, 400, { error: "workspace_id is required" });
+                return;
+            }
+            const reports = listSavedCostReports(_db, workspaceId);
+            sendJson(res, 200, workRecordResponse(reports, { n: reports.length, workspaceId }));
+            return;
+        }
         if (method === "GET" && pathname.startsWith("/api/work-records/allocations/")) {
             const allocationId = pathname.slice("/api/work-records/allocations/".length);
             if (allocationId.length === 0 || allocationId.includes("/")) {
@@ -500,6 +557,11 @@ export function handleApiRequest(_db, req, res, method, url) {
             sendJson(res, 200, listWorkspaces(parseWindowFilter(url)));
             return;
         }
+        // GET /api/workspace-names  (unwindowed naming metadata for all workspaces — UIR-8)
+        if (method === "GET" && pathname === "/api/workspace-names") {
+            sendJson(res, 200, listWorkspaceNames());
+            return;
+        }
         // GET /api/delivery (delivery proxy metrics across all workspaces)
         if (method === "GET" && pathname === "/api/delivery") {
             const { from, to } = resolveWindow(parseWindowFilter(url));
@@ -799,6 +861,46 @@ export function handleApiRequest(_db, req, res, method, url) {
                 .catch(() => sendJson(res, 500, { error: "Internal error reading request body" }));
             return;
         }
+        // ── RIQ3 relevance feedback + goal preference (migration 021) ──────────
+        // Local, enum-only, SEC-101. Writes are CSRF + session-token gated in http.ts.
+        if (method === "GET" && pathname === "/api/recommendations/feedback") {
+            const scopeKey = new URLSearchParams(url.split("?")[1] ?? "").get("scope_key");
+            if (!scopeKey) {
+                sendJson(res, 400, { error: "scope_key is required", code: "INVALID_REQUEST" });
+                return;
+            }
+            sendJson(res, 200, listFeedbackRoute(_db, scopeKey));
+            return;
+        }
+        if (method === "POST" && pathname === "/api/recommendations/feedback") {
+            withJsonBody(req, res, (body) => setFeedbackRoute(_db, body));
+            return;
+        }
+        if (method === "POST" && pathname === "/api/recommendations/feedback/undo") {
+            withJsonBody(req, res, (body) => undoFeedbackRoute(_db, body));
+            return;
+        }
+        if (method === "DELETE" && pathname === "/api/recommendations/feedback") {
+            withJsonBody(req, res, (body) => deleteFeedbackRoute(_db, body));
+            return;
+        }
+        if (method === "GET" && pathname === "/api/recommendations/goal") {
+            const scopeKey = new URLSearchParams(url.split("?")[1] ?? "").get("scope_key");
+            if (!scopeKey) {
+                sendJson(res, 400, { error: "scope_key is required", code: "INVALID_REQUEST" });
+                return;
+            }
+            sendJson(res, 200, getGoalRoute(_db, scopeKey));
+            return;
+        }
+        if (method === "POST" && pathname === "/api/recommendations/goal") {
+            withJsonBody(req, res, (body) => setGoalRoute(_db, body));
+            return;
+        }
+        if (method === "POST" && pathname === "/api/recommendations/goal/reset") {
+            withJsonBody(req, res, (body) => resetGoalRoute(_db, body));
+            return;
+        }
         // GET /api/settings
         if (method === "GET" && pathname === "/api/settings") {
             sendJson(res, 200, getSettings());
@@ -1021,6 +1123,9 @@ export function handleApiRequest(_db, req, res, method, url) {
                 files_parsed: parser_health.files_parsed,
                 lines_quarantined: parser_health.lines_quarantined,
                 ...getScanStatus(),
+                // BOOT-1: boot-progress fields exist ONLY pre-ready; the steady-state
+                // /api/status shape is unchanged (UI fixtures must not require them).
+                ...(isReady() ? {} : getBootProgress()),
             });
             return;
         }

package/dist/db/migrations/020_local_command_retention.sql

@@ -0,0 +1,50 @@
+-- 020_local_command_retention.sql — SEC-4 local command retention.
+-- Spec: docs/plans/spec-local-command-retention.md §"Persistence invariant and legacy migration".
+--
+-- Legacy marker namespace M(row): tool_name = 'local_command' AND event_id is
+-- 'cmd-' + 20 lowercase hex (length 24). Valid input_hash inside M is SQL NULL
+-- or exact binary TEXT '/compact' or '/clear'; everything else is command
+-- content and is removed. Genuine tool-use events named 'local_command' with
+-- IDs outside M keep their SHA-256 hashes.
+--
+-- Logical retention reduction only: no physical erasure of WAL frames, free
+-- pages, backups, or source transcripts is promised.
+
+-- 1. Data change: NULL every invalid M input_hash in place. No row deletion,
+--    no rekeying, no other column touched.
+UPDATE tool_events
+SET input_hash = NULL
+WHERE tool_name = 'local_command'
+  AND length(event_id) = 24
+  AND substr(event_id, 1, 4) = 'cmd-'
+  AND substr(event_id, 5) NOT GLOB '*[^0-9a-f]*'
+  AND input_hash IS NOT NULL
+  AND NOT (typeof(input_hash) = 'text' AND input_hash IN ('/compact', '/clear'));
+
+-- 2. Schema change: BEFORE INSERT/UPDATE guards so an older writer cannot
+--    restore raw command values. Fixed error text; never interpolate values.
+--    The UPDATE guard checks every update (including name/ID changes into M),
+--    not just UPDATE OF input_hash.
+CREATE TRIGGER trg_sec4_command_marker_guard_insert
+BEFORE INSERT ON tool_events
+BEGIN
+  SELECT CASE WHEN NEW.tool_name = 'local_command'
+      AND length(NEW.event_id) = 24
+      AND substr(NEW.event_id, 1, 4) = 'cmd-'
+      AND substr(NEW.event_id, 5) NOT GLOB '*[^0-9a-f]*'
+      AND NEW.input_hash IS NOT NULL
+      AND NOT (typeof(NEW.input_hash) = 'text' AND NEW.input_hash IN ('/compact', '/clear'))
+    THEN RAISE(ABORT, 'SEC4_COMMAND_MARKER_INVALID') END;
+END;
+
+CREATE TRIGGER trg_sec4_command_marker_guard_update
+BEFORE UPDATE ON tool_events
+BEGIN
+  SELECT CASE WHEN NEW.tool_name = 'local_command'
+      AND length(NEW.event_id) = 24
+      AND substr(NEW.event_id, 1, 4) = 'cmd-'
+      AND substr(NEW.event_id, 5) NOT GLOB '*[^0-9a-f]*'
+      AND NEW.input_hash IS NOT NULL
+      AND NOT (typeof(NEW.input_hash) = 'text' AND NEW.input_hash IN ('/compact', '/clear'))
+    THEN RAISE(ABORT, 'SEC4_COMMAND_MARKER_INVALID') END;
+END;

package/dist/db/migrations/021_recommendation_feedback.sql

@@ -0,0 +1,25 @@
+-- 021_recommendation_feedback.sql — RIQ3 additive relevance-feedback + goal-preference storage.
+-- SEC-101: enums, ids, scope keys, counts and timestamps only. No free-text, no raw content.
+
+CREATE TABLE recommendation_feedback (
+  feedback_id TEXT PRIMARY KEY,
+  scope_key TEXT NOT NULL,
+  rec_identity TEXT NOT NULL,
+  feedback TEXT NOT NULL CHECK (feedback IN
+    ('NOT_APPLICABLE', 'ALREADY_DONE', 'ACCEPTED_TRADEOFF', 'NOT_USEFUL')),
+  cooldown_until TEXT,
+  dismissed_materiality_band TEXT CHECK (dismissed_materiality_band IS NULL
+    OR dismissed_materiality_band IN ('SMALL', 'MODERATE', 'LARGE', 'UNKNOWN')),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  deleted_at TEXT
+);
+CREATE UNIQUE INDEX idx_rec_feedback_active
+  ON recommendation_feedback(scope_key, rec_identity) WHERE deleted_at IS NULL;
+
+CREATE TABLE recommendation_goal_preference (
+  scope_key TEXT PRIMARY KEY,
+  goal TEXT NOT NULL CHECK (goal IN
+    ('PRESERVE_QUALITY', 'REDUCE_RESOURCE_USE', 'INVESTIGATE_FRICTION')),
+  updated_at TEXT NOT NULL
+);

package/dist/ingest/boot-progress.js

@@ -0,0 +1,76 @@
+/**
+ * src/ingest/boot-progress.ts — in-memory boot-scan progress for the loading page (BOOT-1).
+ *
+ * Running counters + a small event ring buffer published by the initial
+ * back-scan and surfaced on /api/status ONLY while the daemon is not ready
+ * (the router gates on isReady()). Everything here is process-memory; no DB,
+ * no filesystem access (readiness.ts already stat-loops roots per poll —
+ * this module must never add per-event fs work).
+ *
+ * SEC-101: event text carries workspace ids/slugs and counts only — callers
+ * must never pass file paths or transcript content.
+ */
+const MAX_EVENTS = 50;
+const RATE_WINDOW_MS = 5_000;
+const state = {
+    sessionsFound: 0,
+    tokensCounted: 0,
+    filesTotal: 0,
+    nextSeq: 1,
+    events: [],
+    /** Epoch-ms timestamps of recent fileParsed calls (pruned to the rate window). */
+    parseTicks: [],
+};
+function pruneTicks(nowMs) {
+    const cutoff = nowMs - RATE_WINDOW_MS;
+    let drop = 0;
+    while (drop < state.parseTicks.length && state.parseTicks[drop] < cutoff)
+        drop++;
+    if (drop > 0)
+        state.parseTicks.splice(0, drop);
+}
+/** A session row was inserted for the first time during the scan. */
+export function bootSessionFound() {
+    state.sessionsFound++;
+}
+/** Tokens attributed by a newly ingested turn (all token classes summed). */
+export function bootTokensCounted(tokens) {
+    if (Number.isFinite(tokens) && tokens > 0)
+        state.tokensCounted += tokens;
+}
+/** Total files discovered at boot-scan start (the progress denominator). */
+export function bootFilesTotal(total) {
+    if (Number.isFinite(total) && total >= 0)
+        state.filesTotal = Math.floor(total);
+}
+/** A file finished parsing; feeds the derived files/s rate. */
+export function bootFileParsed(nowMs = Date.now()) {
+    pruneTicks(nowMs);
+    state.parseTicks.push(nowMs);
+}
+/** Append a scan event to the ring buffer (oldest entries drop past 50). */
+export function pushBootEvent(kind, text, ts = new Date().toISOString()) {
+    state.events.push({ seq: state.nextSeq++, ts, kind, text });
+    if (state.events.length > MAX_EVENTS)
+        state.events.splice(0, state.events.length - MAX_EVENTS);
+}
+/** Snapshot for the pre-ready /api/status surface. */
+export function getBootProgress(nowMs = Date.now()) {
+    pruneTicks(nowMs);
+    return {
+        boot_sessions_found: state.sessionsFound,
+        boot_tokens_counted: state.tokensCounted,
+        boot_files_per_sec: Math.round((state.parseTicks.length / (RATE_WINDOW_MS / 1000)) * 10) / 10,
+        boot_files_total: state.filesTotal,
+        boot_scan_events: [...state.events],
+    };
+}
+/** Test-only reset. */
+export function resetBootProgress() {
+    state.sessionsFound = 0;
+    state.tokensCounted = 0;
+    state.filesTotal = 0;
+    state.nextSeq = 1;
+    state.events = [];
+    state.parseTicks = [];
+}