backthread 0.1.1 → 0.1.3

package/README.md

@@ -14,7 +14,7 @@ sessions, so you can ask *"how does X work?"* and stay oriented without
 spelunking through PRs. The decisions become a live **"How it works"** diagram
 and changelog at [backthread.dev](https://backthread.dev).
 
-## Your code never leaves your machine
+## Your source code never leaves your machine
 
 Backthread reads your agent **transcripts**, not your repo. Before anything is
 sent, the CLI redacts every transcript **locally**:
@@ -23,9 +23,18 @@ sent, the CLI redacts every transcript **locally**:
 - **Keeps** only natural-language prompts and the agent's reasoning.
 - **Redacts** any fenced code block to `[code redacted]`.
 
-Only the derived, natural-language *decisions* ever leave your machine. The
-redaction fence is open source ([`@backthread/redact`](https://www.npmjs.com/package/@backthread/redact))
-so you can verify it — read more at [backthread.dev/security](https://backthread.dev/security).
+So no source code and no tool I/O ever leave your machine. Because the default
+path runs inference on our servers, what *does* leave is the **redacted
+transcript** — natural-language prose only. The Worker re-runs the fenced-code
+scrub server-side as a fail-closed backstop, derives the **decisions**, and
+discards the transcript right after — processed in memory, never stored. Only
+the decisions are persisted.
+
+That's a weaker claim than the bring-your-own-key path — where nothing but the
+derived decisions ever leaves your machine — which is designed and coming. We'd
+rather say so than paper over it. The redaction fence is open source
+([`@backthread/redact`](https://www.npmjs.com/package/@backthread/redact)) so you
+can verify it — read more at [backthread.dev/security](https://backthread.dev/security).
 
 ## Quick start
 

package/dist-bundle/backthread.js

@@ -7380,6 +7380,89 @@ function sessionTimestamp(records) {
   }
   return latestIso;
 }
+function stripLeadingSlashes(p) {
+  let i = 0;
+  while (i < p.length && p[i] === "/") i += 1;
+  return p.slice(i);
+}
+function isAbsolute(p) {
+  return p.startsWith("/");
+}
+function isForeignRelativePath(p) {
+  if (p.startsWith("~")) return true;
+  if (p.startsWith("\\")) return true;
+  if (/^[A-Za-z]:[\\/]/.test(p)) return true;
+  const stripped = p.replace(/^(?:\.[\\/])+/, "");
+  return /^\.\.(?:[\\/]|$)/.test(stripped);
+}
+function relativizeUnder(abs, root) {
+  const trimmedRoot = root.replace(/\/+$/, "");
+  if (trimmedRoot.length === 0) return null;
+  if (abs === trimmedRoot) return "";
+  const prefix = trimmedRoot + "/";
+  if (!abs.startsWith(prefix)) return null;
+  return stripLeadingSlashes(abs.slice(trimmedRoot.length));
+}
+function pathsFromRecord(rec) {
+  if (!rec || typeof rec !== "object") return [];
+  const out = [];
+  const r = rec;
+  const pushFromInput = (input) => {
+    if (!input || typeof input !== "object") return;
+    const i = input;
+    for (const v of [i.file_path, i.path, i.notebook_path, i.cwd]) {
+      if (typeof v === "string" && v.trim().length > 0) out.push(v.trim());
+    }
+  };
+  const content = r.message?.content;
+  if (Array.isArray(content)) {
+    for (const raw of content) {
+      if (!raw || typeof raw !== "object") continue;
+      const block = raw;
+      if (block.type === "tool_use") pushFromInput(block.input);
+    }
+  }
+  if (r.payload && typeof r.payload === "object" && r.payload.type === "function_call") {
+    const args = r.payload.arguments;
+    if (typeof args === "string") {
+      try {
+        pushFromInput(JSON.parse(args));
+      } catch {
+      }
+    } else {
+      pushFromInput(args);
+    }
+  }
+  return out;
+}
+function codexSessionCwd(records) {
+  for (const raw of records) {
+    if (!raw || typeof raw !== "object") continue;
+    const rec = raw;
+    if (rec.type !== "session_meta") continue;
+    const cwd = rec.payload?.cwd;
+    if (typeof cwd === "string" && cwd.trim().length > 0) return cwd.trim();
+  }
+  return null;
+}
+function sessionPaths(records, repoRoot) {
+  const root = (repoRoot && repoRoot.trim().length > 0 ? repoRoot.trim() : codexSessionCwd(records)) ?? null;
+  const seen = /* @__PURE__ */ new Set();
+  for (const rec of records) {
+    for (const p of pathsFromRecord(rec)) {
+      if (isAbsolute(p)) {
+        if (root === null) continue;
+        const rel = relativizeUnder(p, root);
+        if (rel === null || rel.length === 0) continue;
+        seen.add(rel);
+      } else if (!isForeignRelativePath(p)) {
+        const rel = p.replace(/^(?:\.\/)+/, "");
+        if (rel.length > 0) seen.add(rel);
+      }
+    }
+  }
+  return Array.from(seen).sort();
+}
 
 // src/repo.ts
 import { execFileSync } from "node:child_process";
@@ -7459,6 +7542,7 @@ async function serverInfer(transcript, config2, opts = {}) {
     body.persist = true;
     body.repo = { owner: opts.repo.owner, name: opts.repo.name };
     if (opts.decidedAt) body.decidedAt = opts.decidedAt;
+    if (opts.filePaths && opts.filePaths.length > 0) body.filePaths = opts.filePaths;
   }
   let res;
   try {
@@ -8263,6 +8347,7 @@ async function runCapture(input, deps = {}) {
     const records = parseJsonl(rawTranscript);
     const redacted = redactTranscript(records);
     const decidedAt = sessionTimestamp(records) ?? void 0;
+    const filePaths = sessionPaths(records, input.cwd);
     const sessionId = redacted.sessionId ?? input.session_id ?? null;
     if (redacted.turns.length === 0) {
       return {
@@ -8281,6 +8366,7 @@ async function runCapture(input, deps = {}) {
       env,
       fetchImpl: deps.fetchImpl,
       decidedAt,
+      filePaths,
       ...repo ? { persist: true, repo } : {}
     });
     if (!result.ok) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "backthread",
-  "version": "0.1.1",
-  "description": "Backthread CLI — capture the *why* of your AI-coded changes from your Claude Code sessions, and query your codebase's architectural memory without leaving the terminal. Source code and tool I/O are redacted locally before anything leaves your machine.",
+  "version": "0.1.3",
+  "description": "Backthread CLI — capture the why behind your AI-coded changes from your Claude Code sessions, and ask how your codebase works without leaving the terminal. Source code and tool I/O are redacted locally before anything leaves your machine.",
   "license": "MIT",
   "author": "Backthread",
   "homepage": "https://backthread.dev",