cc-viewer 1.9.1 → 1.9.2

package/server/pty-manager.js

@@ -1060,8 +1060,13 @@ export function killPty() {
  * same dead-state a natural exit produces). Records whose process already
  * exited are never re-anchor targets.
  *
+ * The killed record's persistent `cwd` is captured BEFORE the kill and
+ * returned so the close route can tell "the BOUND project was closed" apart
+ * from "a parallel project was closed" by exact-cwd comparison against
+ * CCV_PROJECT_DIR (never by basename — same-name twins would false-hit).
+ *
  * @returns {{ ok:boolean, key?:string, killedActive?:boolean,
- *            reattachedTo?:string|null, reason?:string }}
+ *            reattachedTo?:string|null, cwd?:string, reason?:string }}
  */
 export function killPtyFor({ cwd, project, instanceKey } = {}) {
   // Multi-instance forced disambiguation (2026-10-06): a project-name-only close that matches
@@ -1076,6 +1081,10 @@ export function killPtyFor({ cwd, project, instanceKey } = {}) {
   if (!key) return { ok: false, reason: 'not-found' };
   const s = ptys.get(key);
   if (!s) return { ok: false, reason: 'not-found' };
+  // Capture the record's ORIGINAL spawn cwd before the kill (never realpath'd —
+  // both sides of the comparison stay in the same path space; a realpath would
+  // split /tmp vs /private/tmp and miss the bound-cwd match).
+  const killedCwd = s.cwd || s.currentWorkspacePath || s.lastWorkspacePath || '';
   _killPtyRecord(s);
   const killedActive = key === activePtyKey;
   let reattachedTo = null;
@@ -1085,7 +1094,7 @@ export function killPtyFor({ cwd, project, instanceKey } = {}) {
     }
     if (reattachedTo) activePtyKey = reattachedTo;
   }
-  return { ok: true, key, killedActive, reattachedTo };
+  return { ok: true, key, killedActive, reattachedTo, cwd: killedCwd };
 }
 
 // Kill EVERY main PTY across all projects (workspaces stop / process teardown). The no-arg

package/server/routes/resume.js

@@ -17,7 +17,12 @@
 //   POST /api/live-processes/close  { project }
 //       Kill that project's main PTY (the web header tab's × button). Admin-only
 //       (loopback or authenticated remote admin); 403 otherwise, 404 when the
-//       project has no record. The record is kept for a later re-launch.
+//       project has no record. The record is kept for a later re-launch. When the
+//       killed project WAS the bound one and a survivor is still live, the server
+//       re-binds its workspace identity (_projectName + CCV_PROJECT_DIR) to that
+//       survivor (a same-name/same-cwd twin degrades this to a dir-only rebind),
+//       broadcasts workspace_started(rebound:true) so every client lands on the
+//       survivor, and the response carries `rebound: { project, cwd }`.
 //
 //   POST /api/resume-session  { sessionUuid, project?, instanceKey? }
 //       TRUE /resume (2026-10-06): inject `/resume <uuid>` into the target
@@ -34,11 +39,18 @@
 // this handler is a thin HTTP wrapper.
 
 import { LOG_DIR } from '../../findcc.js';
-import { _projectName, _v2Writer } from '../interceptor.js';
+import { _projectName, _v2Writer, initForWorkspace } from '../interceptor.js';
+// Static import (not the route-local dynamic import) so the close-rebind helper
+// can call listLivePtys synchronously — a static import keeps the single shared
+// module instance, and module state is shared either way.
+import { listLivePtys } from '../pty-manager.js';
 import { listResumeSessions } from '../lib/v2/resume-list.js';
 import { projectKeyForCwd } from '../lib/system-prompt-snapshots.js';
+import { readClaudeProjectModel } from '../lib/context-watcher.js';
+import { bumpWorkspacesVersion } from '../lib/file-access-policy.js';
 import { isAdminReq } from '../lib/is-admin.js';
 import { isSameOriginBrowserRequest } from '../lib/same-origin.js';
+import { sseWrite } from '../lib/wire-compress.js';
 import { reportSwallowed } from '@ccv/core/error-report';
 
 function sendJson(res, code, obj) {
@@ -166,8 +178,11 @@ function postLiveProcessAttachHandler(req, res, parsedUrl, isLocal, deps) {
 // possible with a mere view token). 404 when the project has no record. When
 // the killed PTY was the terminal's active attachment, the server re-anchors
 // the attachment to another live record internally (killedActive in the
-// response); the client decides its own view repair from the remaining tab
-// list (it does not need the re-anchor target).
+// response). When the killed project WAS the bound one and a survivor is still
+// live, the server ALSO re-binds its workspace identity (_projectName +
+// CCV_PROJECT_DIR) to that survivor and broadcasts workspace_started(rebound:true)
+// so every client lands on the survivor (the "当前项目" label would otherwise
+// stay on the just-closed project); the response then carries `rebound`.
 function postLiveProcessCloseHandler(req, res, parsedUrl, isLocal, deps) {
   // Two gates, both required: admin identity (loopback or authenticated remote
   // admin) AND same-origin browser context. The server intentionally answers
@@ -210,7 +225,18 @@ function postLiveProcessCloseHandler(req, res, parsedUrl, isLocal, deps) {
         sendJson(res, 404, { ok: false, reason: r.reason || 'not-found' });
         return;
       }
-      sendJson(res, 200, { ok: true, project, instanceKey: r.key || instanceKey || null, killedActive: r.killedActive === true });
+      // Bound-project rebound (2026-10): when the closed PTY WAS the server's bound
+      // project, the binding (projectName / CCV_PROJECT_DIR / log dir) would otherwise
+      // keep pointing at a dead project — the "当前项目" label stays on the just-closed
+      // name while the survivor is left as a mere chip. Rebind to a survivor and
+      // broadcast workspace_started so every client (including the closing tab) lands
+      // on the survivor. Judgment is by the killed record's ORIGINAL cwd vs
+      // CCV_PROJECT_DIR — never by basename, or a same-name twin close would false-hit.
+      let rebound = null;
+      try {
+        rebound = _maybeRebindAfterClose(r, deps);
+      } catch (err) { reportSwallowed('resume-route.close-rebind', err); }
+      sendJson(res, 200, { ok: true, project, instanceKey: r.key || instanceKey || null, killedActive: r.killedActive === true, rebound });
     } catch (err) {
       reportSwallowed('resume-route.close', err);
       sendJson(res, 500, { ok: false, reason: 'close-failed' });
@@ -218,6 +244,135 @@ function postLiveProcessCloseHandler(req, res, parsedUrl, isLocal, deps) {
   });
 }
 
+// Bound-project rebound helper (2026-10). After killPtyFor removed the BOUND
+// project's PTY, pick a surviving live claude record and re-bind the server's
+// workspace identity to it. A full rebind additionally broadcasts
+// workspace_started (with `rebound:true` / `reboundFrom`) so the affected SSE
+// clients re-scope to the survivor; a DIR-ONLY rebind (a same-name twin owns
+// the name's session space) moves CCV_PROJECT_DIR without broadcasting.
+// Returns { project, cwd } when a rebind happened, else null (closed project
+// was not the bound one / no survivor / a same-cwd twin still lives / Electron
+// multi-tab).
+// May throw only BEFORE the rebind is applied (a pre-state-change failure →
+// the caller wraps it into a 200 with rebound:null, which is accurate then);
+// after the state change it never throws (the restart side-effects are each
+// wrapped), so a returned rebound always matches reality.
+//
+// ORDERING INVARIANT: the broadcast (full rebind only) is emitted BEFORE the
+// best-effort feed/timer restarts, and the whole kill→rebind→broadcast block
+// is synchronous (no await) — under Node's single thread no interleaved
+// request can observe a half-applied rebind, and a throwing side-effect can no
+// longer strand the "binding moved but nobody was told" state (the broadcast
+// has already gone out by then).
+function _maybeRebindAfterClose(killResult, deps) {
+  // Electron multi-tab: the manager process does NOT own log init (the tab
+  // workers do); mirroring workspaces.js:56, skip rebind entirely there.
+  if (process.env.CCV_ELECTRON_MULTITAB === '1') return null;
+  const killedCwd = typeof killResult.cwd === 'string' ? killResult.cwd : '';
+  const boundCwd = process.env.CCV_PROJECT_DIR || process.cwd();
+  // Exact-cwd equality, no realpath — both sides stay in the same path space
+  // (a realpath would split /tmp vs /private/tmp and miss the hit).
+  if (!killedCwd || killedCwd !== boundCwd) return null;
+
+  // Pick the survivor: a still-live CLAUDE record (listLivePtys also returns
+  // 'shell' scratch PTYs, which /api/live-processes itself filters out of its
+  // own processes[]), preferring the record killPtyFor just re-anchored the
+  // terminal attachment to (reattachedTo), then the terminal's live attachment
+  // (isActive — preserves the launch-time invariant bound == attached), else
+  // the first live claude record in Map order.
+  const live = listLivePtys().filter((p) => p && p.cwd && (!p.ptyKind || p.ptyKind === 'claude'));
+  if (!live.length) return null;
+  // A same-cwd TWIN of the closed bound project still lives → the bound
+  // identity (same project name, same log dir) is already correct for it;
+  // rebinding away would only wipe that twin's session bindings for nothing.
+  if (live.some((p) => p.cwd === killedCwd)) return null;
+  const survivor = live.find((p) => p.key === killResult.reattachedTo)
+    || live.find((p) => p.isActive)
+    || live[0];
+  if (!survivor || !survivor.cwd) return null;
+
+  const killedName = projectKeyForCwd(killedCwd);
+  const survivorProject = projectKeyForCwd(survivor.cwd);
+  // initForWorkspace's scoped resetSessions keys on the SANITIZED project name
+  // (v2-writer.js). So any time the CLOSED project's name still has a live
+  // record (a same-name twin in another dir, or the survivor itself is a
+  // same-name twin), running initForWorkspace would wipe that LIVE project's
+  // session bindings. In every such case the project NAME (and thus the log
+  // dir) does not change — so do a DIR-ONLY rebind instead: point
+  // CCV_PROJECT_DIR at the survivor (file-tree/git/skills/allowlist roots follow
+  // the live project) while skipping initForWorkspace entirely.
+  const closedNameStillLive = live.some((p) => projectKeyForCwd(p.cwd) === killedName);
+  const survivorIsSameName = survivorProject === killedName;
+  const dirOnly = closedNameStillLive || survivorIsSameName;
+
+  let result;
+  if (dirOnly) {
+    // _projectName / _logDir stay (same sanitized name — already correct);
+    // only the bound ROOT moves to the surviving twin's directory. No broadcast
+    // either (see below): the name — and with it every client's SSE scope stamp
+    // — is unchanged, so there is nothing to re-scope.
+    result = { projectName: killedName };
+  } else {
+    result = initForWorkspace(survivor.cwd);
+  }
+  process.env.CCV_PROJECT_DIR = survivor.cwd;
+  // The file-access allowlist caches its roots (including the bound project
+  // dir) and is only invalidated on register/remove or LOG_DIR change — none of
+  // which fire on a close-rebind. Bump it so the survivor's dir is an allowed
+  // root even when it never went through this server's registerWorkspace.
+  try { bumpWorkspacesVersion(); } catch (err) { reportSwallowed('resume-route.close-rebind.roots', err); }
+
+  // Broadcast workspace_started to EVERY SSE client (same fan-out as launch,
+  // workspaces.js:101-107) BEFORE the throwable side-effects below, so a
+  // failure there can't leave "binding moved but clients untold" — but ONLY for
+  // a full rebind. A dir-only rebind keeps the project NAME — and with it every
+  // client's SSE scope stamp — moving only the bound ROOT to the survivor's dir,
+  // so there is nothing for any client to re-scope: a broadcast would needlessly
+  // hard-reset every same-name viewer mid-stream for a root-only change.
+  // Deliberately NO load_start/load_chunk/load_end replay: those handlers have
+  // no project guard on the client (AppBase.jsx:1990-2148) and would pour the
+  // survivor's transcript into a tab that is viewing a THIRD project. Each
+  // AFFECTED client re-scopes and cold-loads its own view on receipt (the
+  // `rebound:true` marker + its own local view state decide; see the
+  // workspace_started handler in AppBase.jsx).
+  if (!dirOnly) {
+    const payload = `event: workspace_started\ndata: ${JSON.stringify({
+      projectName: result.projectName,
+      path: survivor.cwd,
+      claudeProjectModel: readClaudeProjectModel(survivor.cwd),
+      rebound: true,
+      // The project name this client's SSE scope was stamped with before the
+      // rebind. Clients whose SSE (or an attach/parallel view) is still pinned
+      // to it are the affected domain and must reset + reconnect; a tab viewing
+      // an unrelated project must keep its view and its live feed.
+      reboundFrom: killedName,
+    })}\n\n`;
+    const clients = (deps && deps.clients) || [];
+    clients.forEach((client) => {
+      try { sseWrite(client, payload); } catch (err) { reportSwallowed('resume-route.close-rebind.write', err); }
+    });
+  }
+
+  // Best-effort feed/timer restarts for the new bound project. Without
+  // startLogWatch the survivor's writer activity hits "no feed → drop" and the
+  // real-time pane never updates until a manual refresh; statsWorker/
+  // streamingStatusTimer mirror workspaces.js:71-75. All deps.* are
+  // optional-chained so unit tests need only stub what they assert on. Each is
+  // individually wrapped AND runs AFTER the broadcast: if one throws it is
+  // reported and swallowed, never turning the (already-applied) rebind into a
+  // misleading rebound:null on the 200 response.
+  if (deps && typeof deps.startLogWatch === 'function') {
+    try { deps.startLogWatch(); } catch (err) { reportSwallowed('resume-route.close-rebind.logwatch', err); }
+  }
+  if (deps && !deps.statsWorker && typeof deps.startStatsWorker === 'function') {
+    try { deps.startStatsWorker(); } catch (err) { reportSwallowed('resume-route.close-rebind.stats', err); }
+  }
+  if (deps && typeof deps.startStreamingStatusTimer === 'function') {
+    try { deps.startStreamingStatusTimer(); } catch (err) { reportSwallowed('resume-route.close-rebind.stream', err); }
+  }
+  return { project: result.projectName, cwd: survivor.cwd };
+}
+
 const RESUME_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
 // POST /api/resume-session { sessionUuid, project?, instanceKey? } — TRUE /resume:

package/server/routes/workspaces.js

@@ -21,9 +21,15 @@ import { sseWrite } from '../lib/wire-compress.js';
 
 function workspacesList(req, res, parsedUrl, isLocal, deps) {
   import('../workspace-registry.js').then(async ({ getWorkspaces }) => {
-    const workspaces = await getWorkspaces();
+    // ?limit=N(2026-10-08):parsedUrl 是 WHATWG URL,只有 .searchParams 没有 .query。
+    // 先排序后富化,只算前 N 个的 dirSize/isDiscardable。默认 0(全部),上限 50
+    // 与 resume.js 的对齐。total 是富化前总数,预留给将来「按需加载」的前端。
+    const rawLimit = parsedUrl?.searchParams?.get('limit');
+    const parsedLimit = rawLimit != null ? Number(rawLimit) : 0;
+    const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(Math.floor(parsedLimit), 50) : 0;
+    const { workspaces, total } = await getWorkspaces({ limit });
     res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ workspaces, workspaceMode: deps.isWorkspaceMode && !deps.workspaceLaunched }));
+    res.end(JSON.stringify({ workspaces, total, workspaceMode: deps.isWorkspaceMode && !deps.workspaceLaunched }));
   }).catch(err => {
     res.writeHead(500, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ error: err.message }));

package/server/workspace-registry.js

@@ -1,13 +1,19 @@
 // Workspace Registry - 工作区持久化管理
-import { readdir, stat } from 'node:fs/promises';
+import { readdir, stat, readFile } from 'node:fs/promises';
 import { statSync } from 'node:fs';
 import { mutateJson, readJsonSafe, writeJsonAtomic } from './lib/json-store.js';
-import { dirSizeSync } from './lib/v2/layout.js';
+import { dirSizeAsync } from './lib/v2/layout.js';
 import { isDiscardableSession } from './lib/v2/session-select.js';
 import { join, basename, resolve, dirname } from 'node:path';
 import { randomBytes } from 'node:crypto';
 import { LOG_DIR } from '../findcc.js';
 
+// 与 stats-worker.js 的磁盘缓存对齐(2026-10-08):getWorkspaces 富化时优先读
+// LOG_DIR/<project>/<project>.json 的 files["sessions/<sid>"],以 journalSize+lastModified
+// 作新鲜度 key;命中即跳过 dirSizeSync。版本不一致或 key 缺失则回退到实时遍历。
+// 版本号必须与 stats-worker.js 的 STATS_VERSION 保持一致,否则旧缓存被错误信任。
+const STATS_CACHE_VERSION = 12;
+
 // 动态获取（LOG_DIR 可能在运行时被 setLogDir 修改）
 function getWorkspacesFile() { return join(LOG_DIR, 'workspaces.json'); }
 
@@ -97,45 +103,108 @@ export function saveWorkspaces(list) {
   }
 }
 
-export async function getWorkspaces() {
+export async function getWorkspaces(opts = {}) {
+  const limit = Number.isFinite(opts.limit) && opts.limit > 0 ? Math.floor(opts.limit) : null;
   const list = loadWorkspaces();
-  const enriched = await Promise.all(list.map(async (w) => {
-    // wire-v2 (1.7.0): logs live in per-session dirs under sessions/. The v1
-    // *.jsonl glob is kept as unmigratedV1Count — the combined logCount must
-    // stay non-zero for a declined-migration workspace, because the launcher's
-    // `logCount > 0 → auto -c` heuristic hangs off it (WorkspaceList.jsx).
-    let sessionCount = 0;
-    let unmigratedV1Count = 0;
-    let totalSize = 0;
-    const logDir = join(LOG_DIR, w.projectName);
-    try {
-      const files = await readdir(logDir);
-      for (const f of files) {
-        if (f.endsWith('.jsonl') && !f.endsWith('_temp.jsonl')) {
-          unmigratedV1Count++;
-          try { totalSize += (await stat(join(logDir, f))).size; } catch { }
-        }
+  // 先按 lastUsed 降序(几乎免费,只是 8.5 KB JSON 的内存排序),再切片、再富化。
+  // 不调换顺序的话:全量富化 40 个工作区 ≈ 3.3s;先切片后富化,limit=5 ≈ 200ms。
+  const sorted = list.slice().sort((a, b) => new Date(b.lastUsed) - new Date(a.lastUsed));
+  const total = sorted.length;
+  const toEnrich = limit ? sorted.slice(0, limit) : sorted;
+  // 一次性读出涉及项目的 stats 磁盘缓存(每个项目一次读盘,富化期全部命中内存)。
+  // Map + Promise.all 的 has/set 不防重:同一 projectName 的多个 entry 在 await 之前都通过 has 检查,
+  // 导致重复读盘。先 Set 去重再读。
+  const uniqueProjects = [...new Set(toEnrich.map((w) => w.projectName))];
+  const cacheByProject = new Map();
+  await Promise.all(uniqueProjects.map(async (projectName) => {
+    cacheByProject.set(projectName, await _readStatsCache(projectName));
+  }));
+  const enriched = await Promise.all(toEnrich.map((w) => _enrichWorkspace(w, cacheByProject.get(w.projectName))));
+  return { workspaces: enriched, total };
+}
+
+/**
+ * 读一个工作区的 stats 磁盘缓存(若存在且版本匹配)。
+ * 缓存 schema:LOG_DIR/<project>/<project>.json 的 files["sessions/<sid>"] = {
+ *   size, journalSize, lastModified, ...
+ * },以 (journalSize, lastModified) 作新鲜度 key —— session 文件一变动,journal.jsonl
+ * 的 size/mtime 就变,缓存自然 miss 走实时遍历。
+ * 返回 files 对象;失败/版本不匹配返回 null(调用方整体回退到实时遍历)。
+ */
+async function _readStatsCache(projectName) {
+  // 防御:projectName 来自 workspaces.json(用户可手改),registerWorkspace 写入时只保证
+  // basename 级别消毒。若 workspaces.json 被改成包含 '/' / '\\' / '..' 的 projectName,
+  // 这里的 join 会越出 LOG_DIR。命中即拒,回退到实时遍历(性能降级但安全)。
+  if (typeof projectName !== 'string'
+      || projectName.includes('/')
+      || projectName.includes('\\')
+      || projectName.includes('..')) {
+    return null;
+  }
+  try {
+    const statsFile = join(LOG_DIR, projectName, `${projectName}.json`);
+    const raw = await readFile(statsFile, 'utf-8');
+    const parsed = JSON.parse(raw);
+    if (!parsed || parsed._v !== STATS_CACHE_VERSION || !parsed.files || typeof parsed.files !== 'object') return null;
+    return parsed.files;
+  } catch {
+    return null; // 缓存不存在/损坏都算 miss,调用方走实时路径
+  }
+}
+
+/**
+ * 富化单个工作区的日志统计。命中 stats 缓存的 session 直接用缓存的 size;
+ * 未命中的 session 用 dirSizeAsync 异步递归(不阻塞事件循环,SSE/PTY 不再被冻结)。
+ * isDiscardableSession 仍是同步调用 —— 它只读 meta.json + 扫 journal 头几行,
+ * 远比 dirSizeSync 便宜;完全异步化留作后续。
+ */
+async function _enrichWorkspace(w, statsCache) {
+  // wire-v2 (1.7.0): logs live in per-session dirs under sessions/. The v1
+  // *.jsonl glob is kept as unmigratedV1Count — the combined logCount must
+  // stay non-zero for a declined-migration workspace, because the launcher's
+  // `logCount > 0 → auto -c` heuristic hangs off it (WorkspaceList.jsx).
+  let sessionCount = 0;
+  let unmigratedV1Count = 0;
+  let totalSize = 0;
+  const logDir = join(LOG_DIR, w.projectName);
+  try {
+    const files = await readdir(logDir);
+    for (const f of files) {
+      if (f.endsWith('.jsonl') && !f.endsWith('_temp.jsonl')) {
+        unmigratedV1Count++;
+        try { totalSize += (await stat(join(logDir, f))).size; } catch { }
       }
-    } catch { }
-    try {
-      const sids = await readdir(join(logDir, 'sessions'), { withFileTypes: true });
-      for (const e of sids) {
-        if (!e.isDirectory()) continue;
-        const sessionDir = join(logDir, 'sessions', e.name);
-        try {
-          await stat(join(sessionDir, 'journal.jsonl'));
-          // Quota-probe orphans must not count: logCount>0 drives the
-          // auto -c heuristic, and a probe-only workspace would auto-continue
-          // into a conversation that does not exist (2026-07-16).
-          if (isDiscardableSession(sessionDir)) continue;
-          // Folder size, not journal size — conv/blob/response files carry
-          // most of a session's bytes (journal alone undercounts ~12x).
-          totalSize += dirSizeSync(sessionDir);
+    }
+  } catch { }
+  try {
+    const sids = await readdir(join(logDir, 'sessions'), { withFileTypes: true });
+    for (const e of sids) {
+      if (!e.isDirectory()) continue;
+      const sessionDir = join(logDir, 'sessions', e.name);
+      const unitKey = `sessions/${e.name}`;
+      try {
+        const journalStat = await stat(join(sessionDir, 'journal.jsonl'));
+        // 缓存命中条件与 stats-worker 相同:journalSize + lastModified 双 key。
+        // 命中即非 discardable(stats-worker v11+ 的缓存条目写入前已过滤 probe-only session),
+        // 所以命中路径可以跳过 isDiscardableSession 的同步读 —— 省 ~200ms(实测 1787 session 的
+        // 热路径成本)。未命中再走原顺序:先判 probe,再递归 dirSizeAsync。
+        const cached = statsCache?.[unitKey];
+        const lastModified = journalStat.mtime.toISOString();
+        if (cached && cached.journalSize === journalStat.size && cached.lastModified === lastModified && typeof cached.size === 'number') {
+          totalSize += cached.size;
           sessionCount++;
-        } catch { /* dir without a journal is not a session yet */ }
-      }
-    } catch { }
-    return { ...w, logCount: sessionCount + unmigratedV1Count, sessionCount, unmigratedV1Count, totalSize };
-  }));
-  return enriched.sort((a, b) => new Date(b.lastUsed) - new Date(a.lastUsed));
+          continue;
+        }
+        // Quota-probe orphans must not count: logCount>0 drives the
+        // auto -c heuristic, and a probe-only workspace would auto-continue
+        // into a conversation that does not exist (2026-07-16).
+        if (isDiscardableSession(sessionDir)) continue;
+        // Folder size, not journal size — conv/blob/response files carry
+        // most of a session's bytes (journal alone undercounts ~12x).
+        totalSize += await dirSizeAsync(sessionDir);
+        sessionCount++;
+      } catch { /* dir without a journal is not a session yet */ }
+    }
+  } catch { }
+  return { ...w, logCount: sessionCount + unmigratedV1Count, sessionCount, unmigratedV1Count, totalSize };
 }