cctally 1.87.2 → 1.88.1

package/CHANGELOG.md

@@ -5,6 +5,20 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.88.1] - 2026-07-31
+
+### Fixed
+- Session names no longer disappear from the Recent Sessions card while cctally is pruning old transcripts. The prune held the transcript store's maintenance lock exclusively for its entire pass, and the Sessions card's name lookup is deliberately built to give up instantly rather than wait on that lock, so every Claude session rendered a blank name until the prune finished — minutes on a large store, and for most installs on the v1.88.0 upgrade in particular, whose one-off transcript re-read is followed by an unthrottled sweep. The prune still claims the lock exclusively, which is what keeps it serialized against a second prune or a `cctally db vacuum`, but now holds it shared for the pass itself so read-only lookups are no longer locked out. What gets pruned, and when, is unchanged.
+
+### Security
+- Update the build-time `postcss` dependency to 8.5.25, clearing a path-traversal advisory (GHSA-r28c-9q8g-f849) in its source-map auto-loading. It is a development dependency used only when building the dashboard bundle from source, so it is absent from npm, Homebrew, and every other install, and the shipped dashboard is byte-for-byte unchanged.
+
+## [1.88.0] - 2026-07-31
+
+### Fixed
+- The Codex hero's Snapshot chip no longer reports stale evidence while the dashboard's own freshness state for the same quota window reads fresh. One `/api/data` response could carry two different capture timestamps for a single quota window, and the chip aged off the older one: the initial build stamped the active row with the timestamp of the last reading whose VALUE changed, while that same row's freshness came from the last reading actually received — and because OpenAI repeats an unchanged percentage while you are idle, the two drift apart in exactly the common case. `active[].captured_at` now always means evidence recency, the same observation behind the row's freshness, and the percentage it reports is unchanged. The idle clock additionally refreshes every per-account view rather than only the merged one, so a focused account no longer reads freshness frozen at page load, and the hero's own copy of the quota summary is re-derived on each tick instead of keeping its build-time value. Retained quota windows and their live rows are now capped together, so an install tracking more than 250 windows can no longer publish a live row whose history was dropped or a summary percentage belonging to a window that was. The source envelope's `source_schema_version` moves to 2, because a published value changed meaning and a dashboard tab left open across an in-place upgrade does meet the new server over its existing event stream. That tab keeps working either way — nothing reads the version yet — so the bump is a correctness signal for future readers rather than the thing that preserves compatibility. (#429)
+- Codex sessions started outside the Desktop app — through the Codex MCP server, the CLI, `exec`, subagents, and older Desktop builds — now appear in the Conversation Viewer and resolve their project in Recent Sessions. Codex is part-way through rolling out the field cctally used to identify a conversation, and until now a session whose log omitted it was given no identity at all: its transcript was never indexed, and the sessions card could only report that project metadata was unavailable. cctally now infers the missing value, so those sessions are ordinary sessions with no visible difference from any other. On upgrade, existing history is re-read once in the background to repair it; a session's spend stays attributed to the account it was always attributed to, and a session whose log carries no usable identifier at all is left alone rather than guessed at. Because the repair re-reads the session logs themselves, totals are unchanged for every session still on disk — but a session whose log Codex has since deleted is no longer counted, so long-run totals can fall slightly. Sessions with no working directory recorded still appear, and still honestly report their project as unavailable. One visible consequence of that re-read: it briefly restores transcripts older than your configured retention window, so the ordinary retention sweep runs straight afterwards and those older conversations leave the Conversation Viewer on upgrade instead of lingering past their window.
+
 ## [1.87.2] - 2026-07-30
 
 ### Fixed

package/bin/_cctally_cache.py

@@ -511,6 +511,38 @@ _codex_conversation_fts_full_clear = _cctally_db_sib._codex_conversation_fts_ful
 # writes (#179) so the ON CONFLICT idiom lives in one place. Caller commits.
 _set_cache_meta = _cctally_db_sib._set_cache_meta
 
+# Byte-zero Codex replay markers (spec
+# docs/superpowers/specs/2026-07-30-codex-thread-source-inference-design.md
+# §4.3). Cache migration 035 / conversations migration 002 write them and clear
+# NO table; the sync functions consume them, because only the sync owns the
+# replay semantics that keep the repair safe:
+#
+#   * `sync_codex_cache` ORs the cache-side marker into its own `rebuild`, so
+#     the rebuild path captures `rebuild_known_identities` before clearing. A
+#     migration clearing `codex_session_files` directly would leave the next
+#     ordinary sync with an empty snapshot, sending every re-read rollout to the
+#     live-`auth.json` branch and re-attributing historical spend (§4.1).
+#   * `sync_codex_conversations` defers on the CONVERSATIONS marker until the
+#     cache-side one has cleared, because `_recompute_codex_rollups` reads the
+#     thread row from cache.db and a missing one stamps a materialized
+#     "(unassigned)" project the read path then prefers permanently (§4.2).
+#
+# The conversations key is deliberately DISTINCT from
+# `conversation_rebuild_codex_pending`: `_ensure_codex_conversation_contract`
+# consumes that one by replaying normalization over already-retained events —
+# which preserves their NULL conversation keys — and then deletes it, silently
+# discarding the repair.
+#
+# The keys themselves are defined in the pure kernel `_lib_codex_conversation`
+# and re-exported here, so the read-side authority probe and the doctor shell
+# bind the same names instead of repeating a SQL string literal.
+CODEX_REPLAY_FROM_ZERO_KEY = (
+    _lib_codex_conversation.CODEX_REPLAY_FROM_ZERO_KEY)
+CODEX_CONVERSATION_REPLAY_FROM_ZERO_KEY = (
+    _lib_codex_conversation.CODEX_CONVERSATION_REPLAY_FROM_ZERO_KEY)
+CODEX_REPLAY_BLOCKED_KEY = (
+    _lib_codex_conversation.CODEX_REPLAY_BLOCKED_KEY)
+
 
 # cache.db WAL hardening (#297). See
 # docs/superpowers/specs/2026-07-13-cache-db-wal-hardening-design.md.
@@ -4903,6 +4935,24 @@ def sync_codex_cache(
         # and bypasses every whole-tree operation (orphan prune, root prune,
         # global quota reconcile) — see the guards threaded through below.
         targeted = only_paths is not None
+
+        # A pending byte-zero replay is consumed HERE, not by the migration that
+        # armed it, so the rebuild path below captures `rebuild_known_identities`
+        # before clearing. A migration that cleared `codex_session_files`
+        # directly would leave the next ordinary sync with an empty snapshot,
+        # sending every re-read rollout to the live-auth branch and
+        # re-attributing historical spend to whoever is authenticated now.
+        replay_pending = conn.execute(
+            "SELECT 1 FROM cache_meta WHERE key=?",
+            (CODEX_REPLAY_FROM_ZERO_KEY,),
+        ).fetchone() is not None
+        if replay_pending and targeted:
+            # A live-tail tick must DEFER, never raise through the
+            # `targeted and rebuild` guard below.
+            stats.deferred_reason = "replay_pending"
+            return stats
+        rebuild = rebuild or replay_pending
+
         if targeted and rebuild:
             raise ValueError(
                 "sync_codex_cache: only_paths is incompatible with rebuild")
@@ -5742,6 +5792,35 @@ def sync_codex_cache(
             else:
                 conn.execute("DELETE FROM cache_meta WHERE key = ?",
                              ("codex_torn_auth_deferred",))
+            # Consume the byte-zero replay marker only after a clean full walk,
+            # and only when THIS call observed it. A contended call returned
+            # long before here, and a walk that failed or deferred a file leaves
+            # the marker standing — a surviving marker is what makes the repair
+            # retry on the next sync, and it is also what keeps
+            # `sync_codex_conversations` deferred until the cache side genuinely
+            # holds the replayed thread rows (§4.2). The `replay_pending` guard
+            # is defense in depth: `open_cache_db` and this walk share an
+            # exclusive lock today, so nothing can arm the marker in between —
+            # but the conversations side has no such exclusion, and the two
+            # clears must keep the same shape.
+            if stats.files_failed == 0 and stats.files_deferred_torn == 0:
+                if replay_pending:
+                    conn.execute("DELETE FROM cache_meta WHERE key = ?",
+                                 (CODEX_REPLAY_FROM_ZERO_KEY,))
+                conn.execute("DELETE FROM cache_meta WHERE key = ?",
+                             (CODEX_REPLAY_BLOCKED_KEY,))
+            elif replay_pending:
+                # A full walk ran and could NOT consume the marker, so the
+                # replay — and with it every Codex transcript ingest, which
+                # defers behind this marker — is stalled rather than merely
+                # not-yet-run. `doctor` reads this; the deferral itself stays,
+                # because running ahead is what stamps "(unassigned)" (§4.2).
+                _set_cache_meta(conn, CODEX_REPLAY_BLOCKED_KEY, json.dumps({
+                    "at": dt.datetime.now(dt.timezone.utc).isoformat(
+                        timespec="seconds").replace("+00:00", "Z"),
+                    "files_failed": stats.files_failed,
+                    "files_deferred_torn": stats.files_deferred_torn,
+                }, sort_keys=True))
             conn.commit()
         # Window-scoped spend adoption (spec
         # docs/superpowers/specs/2026-07-30-codex-window-scoped-spend-adoption.md).
@@ -7747,6 +7826,15 @@ def _ensure_codex_conversation_contract(conn: sqlite3.Connection) -> bool:
     JSONL. They still must remain usable after an upgrade, so replay only the
     already-retained physical events under the provider-local conversation lock.
     Empty stores keep their existing rebuild marker for the next real sync.
+
+    This must NEVER consume ``CODEX_CONVERSATION_REPLAY_FROM_ZERO_KEY`` (§4.3).
+    Do not merge the two keys during a tidy-up: this replay runs over
+    already-retained events, which preserves their NULL conversation keys, and
+    then deletes the flag it consumed — so a ``dashboard --no-sync`` or qualified
+    CLI read landing between the migration and the next real sync would silently
+    discard the byte-zero repair. Only a re-read from offset zero can mint the
+    missing identities, which is why that marker belongs to
+    ``sync_codex_conversations`` alone.
     """
     current = _lib_codex_conversation.CODEX_CONVERSATION_CONTRACT_VERSION
 
@@ -8145,6 +8233,24 @@ def sync_claude_conversations(
     return stats
 
 
+def _cache_side_replay_pending(conn: sqlite3.Connection) -> bool:
+    """Whether cache.db still has a byte-zero Codex replay pending (§4.3).
+
+    Read through the ``cache_db`` attachment conversation connections already
+    carry, and qualified: ``cache_meta`` exists in BOTH stores, so an unqualified
+    name would resolve to conversations.db's own table and never see the
+    cache-side marker. A bare or legacy connection without the attachment
+    reports False rather than raising, so it cannot wedge the conversations sync.
+    """
+    try:
+        return conn.execute(
+            "SELECT 1 FROM cache_db.cache_meta WHERE key=?",
+            (CODEX_REPLAY_FROM_ZERO_KEY,),
+        ).fetchone() is not None
+    except sqlite3.OperationalError:
+        return False
+
+
 def _clear_codex_conversation_store(conn: sqlite3.Connection) -> None:
     """Clear only the re-derivable Codex transcript families."""
     conn.execute("DELETE FROM codex_conversation_events")
@@ -8191,10 +8297,25 @@ def sync_codex_conversations(
                 != _lib_codex_conversation.CODEX_CONVERSATION_CONTRACT_VERSION
             )
         )
-        if (pending_rebuild or contract_rebuild) and targeted:
+        codex_replay_pending = conn.execute(
+            "SELECT 1 FROM cache_meta WHERE key=?",
+            (CODEX_CONVERSATION_REPLAY_FROM_ZERO_KEY,),
+        ).fetchone() is not None
+        # Ordering (§4.2): the cache replay must finish first.
+        # `_recompute_codex_rollups` reads `codex_conversation_threads` from
+        # cache.db, and a missing thread row does not yield NULL — it stamps a
+        # materialized "(unassigned)" project that the read path then PREFERS,
+        # permanently, for any conversation with no later activity. The two
+        # stores are synced by independent paths (the dashboard runs conversation
+        # sync in its own worker), so nothing else orders them.
+        if _cache_side_replay_pending(conn):
+            stats.deferred_reason = "cache_replay_pending"
+            return stats
+        if (pending_rebuild or contract_rebuild or codex_replay_pending) and targeted:
             stats.deferred_reason = "rebuild_pending"
             return stats
-        rebuild = rebuild or pending_rebuild or contract_rebuild
+        rebuild = (
+            rebuild or pending_rebuild or contract_rebuild or codex_replay_pending)
         if rebuild:
             conn.execute(
                 "INSERT OR REPLACE INTO cache_meta(key,value) VALUES(?,?)",
@@ -8494,6 +8615,17 @@ def sync_codex_conversations(
                 "DELETE FROM cache_meta "
                 "WHERE key='conversation_rebuild_codex_pending'"
             )
+            # Clear ONLY the marker this call observed. The dispatcher that
+            # arms it holds `CONVERSATIONS_LOCK_MAINTENANCE_PATH` shared while
+            # this walk serializes on `CONVERSATIONS_LOCK_CODEX_PATH`, so a
+            # marker armed after the read above belongs to a replay this walk
+            # never performed — and deleting it would strand the repair for
+            # good, since the migration is stamped and never re-arms.
+            if codex_replay_pending:
+                conn.execute(
+                    "DELETE FROM cache_meta WHERE key=?",
+                    (CODEX_CONVERSATION_REPLAY_FROM_ZERO_KEY,),
+                )
             conn.commit()
         _report_conversation_progress(progress, "checkpoint", stats)
         _harden_conversation_sidecars()

package/bin/_cctally_dashboard_envelope.py

@@ -53,6 +53,7 @@ from _cctally_core import (
     _get_budget_config,
 )
 from _lib_dashboard_sources import (
+    SOURCE_SCHEMA_VERSION,
     dashboard_resource_key as _dashboard_resource_key,
 )
 from _lib_display_tz import _compute_display_block, format_display_dt
@@ -720,7 +721,7 @@ def _source_bundle_to_envelope(bundle: object | None) -> dict:
     unavailable = {source: _unavailable_source_wire() for source in ("claude", "codex", "all")}
     if bundle is None:
         return {
-            "source_schema_version": 1,
+            "source_schema_version": SOURCE_SCHEMA_VERSION,
             "default_source": "claude",
             "source_order": ["claude", "codex", "all"],
             "sources": unavailable,
@@ -741,7 +742,7 @@ def _source_bundle_to_envelope(bundle: object | None) -> dict:
         }
     except Exception:  # Never turn an unexpected snapshot shape into request-thread I/O.
         return {
-            "source_schema_version": 1,
+            "source_schema_version": SOURCE_SCHEMA_VERSION,
             "default_source": "claude",
             "source_order": ["claude", "codex", "all"],
             "sources": unavailable,