amicus 1.5.1 → 1.6.1

package/src/sidecar/interactive.js

@@ -13,6 +13,7 @@ const { logger } = require('../utils/logger');
 const { getCompatEnv } = require('../utils/env-compat');
 const { startInteractiveMirror } = require('./interactive-mirror');
 const { getSessionDir } = require('../session-manager');
+const { canonicalProjectPath } = require('../utils/project-path');
 
 /** Get the Electron binary path via require('electron').
  *  Works in all install contexts (global, local, npx hoisted).
@@ -32,7 +33,7 @@ function checkElectronAvailable() {
 
 /** Build environment variables for Electron process */
 function buildElectronEnv(taskId, model, project, nodeModulesBin, existingPath, options = {}) {
-  const { agent, isResume, conversation, mcp, client, windowPosition } = options;
+  const { agent, isResume, conversation, mcp, client, windowPosition, sessionDirectory } = options;
   const env = {
     ...process.env,
     PATH: `${nodeModulesBin}${path.delimiter}${existingPath}`,
@@ -43,6 +44,10 @@ function buildElectronEnv(taskId, model, project, nodeModulesBin, existingPath,
 
   if (client) { env.AMICUS_CLIENT = client; }
   if (windowPosition) { env.AMICUS_WINDOW_POSITION = windowPosition; }
+  // The directory the OpenCode session is scoped to (#45). Electron builds the
+  // Web-UI route from THIS, not a fresh base64url(CWD) guess, so follow-up
+  // prompts resolve the session when process cwd != --cwd.
+  if (sessionDirectory) { env.AMICUS_SESSION_DIRECTORY = sessionDirectory; }
 
   if (agent) {
     const agentConfig = mapAgentToOpenCode(agent);
@@ -100,6 +105,14 @@ async function runInteractive(model, systemPrompt, userMessage, taskId, project,
 
   const { agent, isResume, conversation, mcp, reasoning, opencodeSessionId, client } = options;
 
+  // Scope the OpenCode session to the project/--cwd (#45). The SDK Session
+  // object echoes a `directory`, but createSession() returns only the id, so we
+  // use the canonicalized --cwd CONSISTENTLY for BOTH the create scope and the
+  // Web-UI route — the documented fallback that keeps them matching even when
+  // the amicus process cwd != --cwd. undefined when project is falsy → calls
+  // stay byte-for-byte identical to before.
+  const sessionDirectory = canonicalProjectPath(project);
+
   // Start OpenCode server with system prompt baked into agent config.
   // Agent config prompts are hidden from the UI, unlike promptAsync's system field.
   const agentConfig = mapAgentToOpenCode(agent);
@@ -126,14 +139,15 @@ async function runInteractive(model, systemPrompt, userMessage, taskId, project,
       sessionId = opencodeSessionId;
       logger.info('Reconnecting to existing session', { sessionId });
     } else {
-      // New session: create and send initial prompt
-      sessionId = await createSession(ocClient);
+      // New session: create and send initial prompt, scoped to --cwd (#45).
+      sessionId = await createSession(ocClient, sessionDirectory);
 
       // System prompt is set on agent config (hidden from UI).
       // Do NOT pass system here — promptAsync's system field is visible in the UI.
       const promptOptions = {
         model,
-        parts: [{ type: 'text', text: userMessage }]
+        parts: [{ type: 'text', text: userMessage }],
+        directory: sessionDirectory
       };
 
       // Always set agent — defaults to 'chat' when not specified
@@ -171,13 +185,13 @@ async function runInteractive(model, systemPrompt, userMessage, taskId, project,
   // Keep the idle clock from killing an actively-working session: poll OpenCode
   // session status and touch the watchdog on any non-idle (busy/retry) state.
   const activityPoller = createActivityPoller({
-    getStatus: () => getSessionStatus(ocClient, sessionId),
+    getStatus: () => getSessionStatus(ocClient, sessionId, sessionDirectory),
     onActivity: () => watchdog.touch(),
   });
 
   const sessionDir = getSessionDir(project, taskId);
   const mirror = startInteractiveMirror({
-    getMessages: () => getMessages(ocClient, sessionId),
+    getMessages: () => getMessages(ocClient, sessionId, sessionDirectory),
     sessionDir,
     onActivity: () => watchdog.touch(),
   });
@@ -190,7 +204,7 @@ async function runInteractive(model, systemPrompt, userMessage, taskId, project,
     const existingPath = process.env.PATH || '';
     const env = buildElectronEnv(
       taskId, model, project, nodeModulesBin, existingPath,
-      { agent, isResume, conversation, mcp, client }
+      { agent, isResume, conversation, mcp, client, sessionDirectory }
     );
     env.AMICUS_OPENCODE_PORT = serverPort;
     env.AMICUS_SESSION_ID = sessionId;

package/src/sidecar/resume.js

@@ -202,8 +202,10 @@ async function resumeSidecar(options) {
     // Output summary
     outputSummary(summary);
 
-    // Finalize session (use updatedMetadata which has resumedAt)
-    finalizeSession(sessionDir, summary, project, updatedMetadata);
+    // Finalize session (use updatedMetadata which has resumedAt). Pass status
+    // explicitly to preserve the pre-#36 default ('complete') and stay out of
+    // the empty-summary guard — interactive resume legitimately has no summary.
+    finalizeSession(sessionDir, summary, project, updatedMetadata, { status: 'complete' });
   } finally {
     if (heartbeat) { heartbeat.stop(); }
     releaseLock(sessionDir);

package/src/sidecar/session-finalize.js

@@ -23,4 +23,44 @@ function resolveTerminalState(result, signal) {
   return { status: 'error', exitCode: 1 };
 }
 
-module.exports = { resolveTerminalState };
+/**
+ * Finalize a headless run by routing through resolveTerminalState — the single
+ * source of truth shared with the CLI start.js path. An errored run writes
+ * status='error' + reason (and an EXISTING 0-byte summary.md so amicus_read hits
+ * its file-exists branch); every other state persists the (possibly partial)
+ * summary with the correct terminal status. Never defaults a failed run to
+ * 'complete'. Used by the shared-server MCP .then handler (#36).
+ *
+ * @param {string} sessionDir
+ * @param {{completed?:boolean,timedOut?:boolean,aborted?:boolean,error?:any,summary?:string}|null} result
+ * @param {string} project
+ * @param {object} metadata - mutated + persisted to metadata.json
+ */
+function finalizeHeadlessResult(sessionDir, result, project, metadata) {
+  // Lazy require to avoid a circular dependency (session-utils requires nothing
+  // here, but keep symmetry with start.js which also lazy-requires).
+  const fs = require('fs');
+  const path = require('path');
+  const { finalizeSession, SessionPaths } = require('./session-utils');
+
+  const terminal = resolveTerminalState(result);
+  if (terminal.status === 'error') {
+    // Write an existing (0-byte) summary so amicus_read hits the file-exists
+    // branch and surfaces metadata.reason rather than "No summary available".
+    fs.writeFileSync(SessionPaths.summaryFile(sessionDir), result && result.summary ? result.summary : '', { mode: 0o600 });
+    metadata.status = 'error';
+    metadata.reason = (result && result.error) ? String(result.error) : 'Incomplete';
+    metadata.completedAt = new Date().toISOString();
+    fs.writeFileSync(
+      path.join(sessionDir, 'metadata.json'),
+      JSON.stringify(metadata, null, 2),
+      { mode: 0o600 }
+    );
+    return;
+  }
+  // complete / timed-out / aborted: persist the (possibly partial) summary with
+  // the resolved status. Explicit status means the #36 guard won't re-classify.
+  finalizeSession(sessionDir, (result && result.summary) || '', project, metadata, { status: terminal.status });
+}
+
+module.exports = { resolveTerminalState, finalizeHeadlessResult };

package/src/sidecar/session-utils.js

@@ -90,8 +90,14 @@ function finalizeSession(sessionDir, summary, project, metadata, opts = {}) {
   // Save summary
   fs.writeFileSync(SessionPaths.summaryFile(sessionDir), summary, { mode: 0o600 });
 
-  // Update metadata to the resolved terminal status (default complete).
-  metadata.status = opts.status || 'complete';
+  // Update metadata to the resolved terminal status. Callers that know the
+  // terminal state (CLI start.js, shared-server finalizeHeadlessResult) pass it
+  // explicitly via opts.status — that always wins, so they are never
+  // re-classified. Defense-in-depth (#36): when NO status is supplied, an empty
+  // summary must never silently default to 'complete' — that hid errored/empty
+  // shared-server runs behind a 0-byte summary and a false success.
+  const hasSummary = typeof summary === 'string' && summary.trim().length > 0;
+  metadata.status = opts.status || (hasSummary ? 'complete' : 'error');
   metadata.completedAt = new Date().toISOString();
   fs.writeFileSync(metaPath, JSON.stringify(metadata, null, 2), { mode: 0o600 });
 

package/src/sidecar/setup.js

@@ -70,6 +70,31 @@ function detectApiKeys() {
   return readApiKeys();
 }
 
+/**
+ * #38 — Non-blocking OpenRouter credit warning. Reads the OpenRouter key
+ * value, calls checkOpenRouterCredit, and prints a WARNING (never blocks) when
+ * the key is zero-credit or free tier. Any failure is swallowed silently — a
+ * credit probe must never stop setup from completing.
+ */
+/* eslint-disable no-console -- CLI wizard requires direct console output */
+async function warnOnLowOpenRouterCredit() {
+  try {
+    const { readApiKeyValues } = require('../utils/api-key-store');
+    const { checkOpenRouterCredit } = require('../utils/api-key-validation');
+    const values = readApiKeyValues();
+    const key = values && values.openrouter;
+    if (!key) { return; }
+    const { warning } = await checkOpenRouterCredit(key);
+    if (warning) {
+      console.log(`Warning: ${warning}`);
+      console.log('');
+    }
+  } catch (err) {
+    logger.debug('OpenRouter credit check skipped', { error: err.message });
+  }
+}
+/* eslint-enable no-console */
+
 /**
  * Prompt the user with a question via readline
  * @param {readline.Interface} rl - Readline interface
@@ -246,6 +271,12 @@ async function runReadlineSetup() {
     }
     console.log('');
 
+    // #38 — non-blocking zero-credit / free-tier OpenRouter warning. Never
+    // blocks: free-tier councils against free models are legitimate.
+    if (keys.openrouter) {
+      await warnOnLowOpenRouterCredit();
+    }
+
     const mode = await askQuestion(rl,
       'Setup mode — 1) Standard (pick a default model)  2) Free OpenRouter council: ');
     if (mode === '2') {
@@ -410,4 +441,5 @@ module.exports = {
   runApiKeySetup,
   seedCatalog,
   seedFreeCouncil,
+  warnOnLowOpenRouterCredit,
 };

package/src/utils/api-key-validation.js

@@ -87,11 +87,83 @@ function validateApiKey(provider, key) {
   });
 }
 
+/** Warning string for a zero-credit OpenRouter key (paid models will 402). */
+const OPENROUTER_NO_CREDIT_WARNING =
+  'OpenRouter key has no remaining credit — paid models will fail (402). ' +
+  'Add credit at openrouter.ai/credits, or build a free council (amicus setup → option 2).';
+
+/** Warning string for a free-tier OpenRouter key. */
+const OPENROUTER_FREE_TIER_WARNING =
+  'OpenRouter key is free tier — only :free models will route; paid models will fail (402). ' +
+  'Add credit at openrouter.ai/credits to use paid models.';
+
+/**
+ * Non-blocking credit/limit check for an OpenRouter key.
+ *
+ * Hits GET https://openrouter.ai/api/v1/key (returns limit, usage,
+ * is_free_tier, limit_remaining) and produces a WARNING — never an error —
+ * when is_free_tier is true or limit_remaining <= 0. Any failure (non-200,
+ * network error, malformed body) resolves with warning:null so setup is
+ * never blocked. Free-tier councils against free models are legitimate.
+ *
+ * @param {string} key OpenRouter API key
+ * @returns {Promise<{warning: string|null, isFreeTier: boolean,
+ *   limitRemaining: number|null, limit: number|null, usage: number|null}>}
+ */
+function checkOpenRouterCredit(key) {
+  const none = {
+    warning: null, isFreeTier: false, limitRemaining: null, limit: null, usage: null
+  };
+  if (!key || key.trim().length === 0) {
+    return Promise.resolve(none);
+  }
+
+  const headers = { 'Authorization': `Bearer ${key.trim()}` };
+
+  return new Promise((resolve) => {
+    const req = https.get('https://openrouter.ai/api/v1/key', { headers }, (res) => {
+      let body = '';
+      res.on('data', (chunk) => { body += chunk; });
+      res.on('end', () => {
+        if (res.statusCode !== 200) { resolve(none); return; }
+        let data;
+        try {
+          data = (JSON.parse(body) || {}).data || {};
+        } catch (_e) {
+          resolve(none);
+          return;
+        }
+        const isFreeTier = data.is_free_tier === true;
+        const limitRemaining = (typeof data.limit_remaining === 'number')
+          ? data.limit_remaining : null;
+        const limit = (typeof data.limit === 'number') ? data.limit : null;
+        const usage = (typeof data.usage === 'number') ? data.usage : null;
+
+        let warning = null;
+        if (limitRemaining !== null && limitRemaining <= 0) {
+          warning = OPENROUTER_NO_CREDIT_WARNING;
+        } else if (isFreeTier) {
+          warning = OPENROUTER_FREE_TIER_WARNING;
+        }
+        resolve({ warning, isFreeTier, limitRemaining, limit, usage });
+      });
+    });
+    req.setTimeout(10000, () => {
+      req.destroy();
+      resolve(none);
+    });
+    req.on('error', () => { resolve(none); });
+  });
+}
+
 // Backwards compat alias
 const validateOpenRouterKey = validateApiKey;
 
 module.exports = {
   validateApiKey,
   validateOpenRouterKey,
+  checkOpenRouterCredit,
+  OPENROUTER_NO_CREDIT_WARNING,
+  OPENROUTER_FREE_TIER_WARNING,
   VALIDATION_ENDPOINTS
 };

package/src/utils/project-path.js

@@ -0,0 +1,61 @@
+/**
+ * Canonical project-path helper.
+ *
+ * A project/cwd path can be written many incidental ways that all refer to the
+ * SAME logical directory. If a path used to CREATE a session differs (by any of
+ * these) from the path used to LOOK IT UP or build a route, the two won't match
+ * and the session/route is lost. This module collapses those incidental
+ * differences to ONE canonical string.
+ *
+ * Canonical form (documented contract):
+ *   - forward slashes ('/'), never backslashes
+ *   - duplicate/mixed separators collapsed to a single '/'
+ *   - a leading UNC double-slash is preserved ('\\\\server\\share' -> '//server/share')
+ *     so a network share never collapses into (and collides with) a local path
+ *   - Windows drive letter upper-cased (c: -> C:)
+ *   - no trailing slash, EXCEPT a bare root is preserved ('C:/' and '/')
+ *
+ * Pure function: no fs, no network, no process state. Safe to call anywhere.
+ */
+
+/**
+ * Normalize a project/cwd path to its canonical string form.
+ *
+ * @param {string} p - A filesystem path (Windows or POSIX style).
+ * @returns {string} The canonical path, or the input unchanged when falsy.
+ */
+function canonicalProjectPath(p) {
+  // Preserve falsy input (''/undefined/null) so callers can pass through an
+  // absent directory without special-casing.
+  if (!p) {
+    return p;
+  }
+
+  // 1. Backslashes -> forward slashes.
+  let out = p.replace(/\\/g, '/');
+  // A leading UNC double-slash (\\server\share) must survive the separator
+  // collapse below — flattening it to a single '/' would turn a network share
+  // into a local-looking path that could collide with one. Remember it, collapse
+  // duplicate/mixed separators, then restore the UNC prefix.
+  const isUnc = out.startsWith('//');
+  out = out.replace(/\/+/g, '/');
+  if (isUnc) {
+    out = `/${out}`;
+  }
+
+  // 2. Upper-case a leading Windows drive letter (c: -> C:).
+  out = out.replace(/^([a-z]):/, (_m, d) => `${d.toUpperCase()}:`);
+
+  // 3. Strip a trailing slash, but keep a bare root ('C:/' or '/').
+  if (out.length > 1 && out.endsWith('/')) {
+    const withoutSlash = out.slice(0, -1);
+    // 'C:/' -> withoutSlash is 'C:' (a bare drive); keep the root slash.
+    if (!/^[A-Z]:$/.test(withoutSlash)) {
+      out = withoutSlash;
+    }
+  }
+
+  return out;
+}
+
+module.exports = { canonicalProjectPath };

package/src/utils/result-schema.js

@@ -267,6 +267,7 @@ function buildDoctorDoc({ version, timestamp, checks }) {
 module.exports = {
   SCHEMA_VERSION,
   TERMINAL_STATUSES,
+  durationBetween,
   statusFromResult,
   buildRunResult,
   buildWaveResult,

package/src/utils/session-index.js

@@ -0,0 +1,98 @@
+/**
+ * Global session index (issue #40).
+ *
+ * The on-disk session store is PROJECT-scoped:
+ *   <project>/.claude/amicus_sessions/<taskId>/
+ * but the project a lookup resolves to can differ from the one a session was
+ * created under (a stdio MCP server defaults to its install-dir cwd, MCP roots
+ * may be absent, etc.). When that happens a perfectly valid session reads back
+ * as "not found".
+ *
+ * This module maintains ONE global index, under the config dir, mapping
+ *   taskId -> canonicalProjectPath(project)
+ * written at session START and consulted ONLY on a per-project miss. It is a
+ * navigation aid, never authoritative: a corrupt/partial index must NEVER crash
+ * a lookup, so every read is guarded and degrades to "no entry".
+ *
+ * Concurrency: parallel fan-out/council runs write here at once. Writes are
+ * atomic via write-temp + rename (rename is atomic on a single filesystem), and
+ * a unique temp name per write avoids two writers colliding on the temp file.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { getConfigDir } = require('./config');
+const { canonicalProjectPath } = require('./project-path');
+
+/** Index filename under the config dir. */
+const INDEX_FILENAME = 'sessions-index.json';
+
+/** @returns {string} Absolute path to the index file. */
+function indexPath() {
+  return path.join(getConfigDir(), INDEX_FILENAME);
+}
+
+/**
+ * Read the index, returning a plain object. Never throws: a missing,
+ * unreadable, or corrupt file yields an empty map.
+ * @returns {Record<string, string>}
+ */
+function readIndex() {
+  try {
+    const raw = fs.readFileSync(indexPath(), 'utf-8');
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
+    // Missing / unreadable / corrupt — fall through to a fresh map.
+  }
+  return {};
+}
+
+/**
+ * Record taskId -> canonical project path at session START.
+ *
+ * Best-effort and crash-safe: a failure here must never block starting a
+ * session, and a pre-existing corrupt index is recovered to a fresh map rather
+ * than propagated. The write is atomic (temp file + rename).
+ *
+ * @param {string} taskId
+ * @param {string} project - any spelling of the project dir; canonicalized here.
+ */
+function recordSession(taskId, project) {
+  if (!taskId || !project) { return; }
+  const canonical = canonicalProjectPath(project);
+  try {
+    const dir = getConfigDir();
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const index = readIndex(); // already guarded; corrupt -> {}
+    index[taskId] = canonical;
+    const target = path.join(dir, INDEX_FILENAME);
+    // Unique temp name so concurrent writers never clobber the same temp file.
+    const tmp = path.join(dir, `.${INDEX_FILENAME}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`);
+    fs.writeFileSync(tmp, JSON.stringify(index, null, 2), { mode: 0o600 });
+    fs.renameSync(tmp, target); // atomic on a single filesystem
+  } catch {
+    // Index is a navigation aid; never let its failure break a session start.
+  }
+}
+
+/**
+ * Look up the canonical project path a taskId was created under.
+ * @param {string} taskId
+ * @returns {string|null} canonical project path, or null if unknown.
+ */
+function lookupSessionProject(taskId) {
+  if (!taskId) { return null; }
+  const index = readIndex(); // guarded; never throws
+  const project = index[taskId];
+  return (typeof project === 'string' && project) ? project : null;
+}
+
+module.exports = {
+  INDEX_FILENAME,
+  recordSession,
+  lookupSessionProject,
+};

package/src/utils/session-path.js

@@ -0,0 +1,68 @@
+/**
+ * Session path resolution.
+ *
+ * Resolves the on-disk directory for a session taskId under a project, with the
+ * path-traversal guard, the legacy sidecar_sessions shim, and (issue #40) a
+ * cross-project fallback via the global session index when the session is not
+ * found under the project this lookup defaulted to.
+ *
+ * Extracted from validators.js to keep that module under the size gate.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { SESSIONS_DIR, LEGACY_SESSIONS_DIR } = require('../session-manager');
+const { lookupSessionProject } = require('./session-index');
+const { canonicalProjectPath } = require('./project-path');
+
+/** Resolve a session path under a single root, throwing on path traversal. */
+function safeSessionDirUnder(project, root, taskId) {
+  // Resolve so both sides share the same drive/separator form; on Windows path.join
+  // yields a driveless root (\tmp\...) while path.resolve(taskId) adds the drive.
+  const sessionsDir = path.resolve(path.join(project, '.claude', root));
+  const resolved = path.resolve(sessionsDir, taskId);
+  if (!resolved.startsWith(sessionsDir + path.sep)) {
+    throw new Error('Invalid task ID: path traversal detected');
+  }
+  return resolved;
+}
+
+/** Probe both roots (canonical, then legacy) under one project; null if neither exists. */
+function existingDirUnderProject(project, taskId) {
+  const canonical = safeSessionDirUnder(project, SESSIONS_DIR, taskId);
+  if (fs.existsSync(canonical)) { return canonical; }
+  const legacy = safeSessionDirUnder(project, LEGACY_SESSIONS_DIR, taskId);
+  if (fs.existsSync(legacy)) { return legacy; }
+  return null;
+}
+
+/**
+ * Resolve an EXISTING session path: prefer canonical amicus, fall back to the
+ * legacy sidecar_sessions dir (shim). The traversal guard runs against BOTH
+ * roots, so a malicious taskId is rejected regardless of root.
+ *
+ * On a per-project MISS (#40), consult the global index for the project the
+ * taskId was actually recorded under and probe there — so a session created
+ * under project A is still found when the lookup defaulted to project B. The
+ * index read is guarded (corrupt index → null), the indexed project is
+ * re-validated through the same traversal guard, and an index hit is only
+ * returned when the dir actually exists; otherwise fall back to the canonical
+ * (writeable) path under the given project.
+ *
+ * @throws {Error} If resolved path escapes the sessions directory
+ */
+function safeSessionDir(project, taskId) {
+  const local = existingDirUnderProject(project, taskId);
+  if (local) { return local; }
+
+  const indexedProject = lookupSessionProject(taskId);
+  if (indexedProject && canonicalProjectPath(indexedProject) !== canonicalProjectPath(project)) {
+    const indexed = existingDirUnderProject(indexedProject, taskId);
+    if (indexed) { return indexed; }
+  }
+
+  // Default to the canonical (writeable) path under the given project.
+  return safeSessionDirUnder(project, SESSIONS_DIR, taskId);
+}
+
+module.exports = { safeSessionDir, safeSessionDirUnder };

package/src/utils/validators.js

@@ -45,33 +45,9 @@ function validateTaskId(taskId) {
   return { valid: true };
 }
 
-const { SESSIONS_DIR, LEGACY_SESSIONS_DIR } = require('../session-manager');
-
-/** Resolve a session path under a single root, throwing on path traversal. */
-function safeSessionDirUnder(project, root, taskId) {
-  // Resolve so both sides share the same drive/separator form; on Windows path.join
-  // yields a driveless root (\tmp\...) while path.resolve(taskId) adds the drive.
-  const sessionsDir = path.resolve(path.join(project, '.claude', root));
-  const resolved = path.resolve(sessionsDir, taskId);
-  if (!resolved.startsWith(sessionsDir + path.sep)) {
-    throw new Error('Invalid task ID: path traversal detected');
-  }
-  return resolved;
-}
-
-/**
- * Resolve an EXISTING session path: prefer canonical amicus, fall back to the
- * legacy sidecar_sessions dir (shim). The traversal guard runs against BOTH
- * roots, so a malicious taskId is rejected regardless of root.
- * @throws {Error} If resolved path escapes the sessions directory
- */
-function safeSessionDir(project, taskId) {
-  const canonical = safeSessionDirUnder(project, SESSIONS_DIR, taskId);
-  if (fs.existsSync(canonical)) { return canonical; }
-  const legacy = safeSessionDirUnder(project, LEGACY_SESSIONS_DIR, taskId);
-  if (fs.existsSync(legacy)) { return legacy; }
-  return canonical;
-}
+// Session path resolution (incl. #40 cross-project index fallback) lives in its
+// own module to keep this file under the size gate; re-exported below.
+const { safeSessionDir } = require('./session-path');
 
 /**
  * Validate prompt content is not empty or whitespace-only