cctally 1.91.0 → 1.92.0

package/bin/_lib_conversation_dispatch.py

@@ -306,14 +306,43 @@ def _map_claude_item(session_id: str, it: dict) -> dict:
     """One Claude assembled item → the neutral detail item shape (§5.6). Claude's
     kinds/blocks pass through untranslated (both vocabularies are provider-truthful
     values of the same required field)."""
+    own_uuid = it["anchor"]["uuid"]
     return {
-        "item_key": _claude_item_key(session_id, it["anchor"]["uuid"]),
+        "item_key": _claude_item_key(session_id, own_uuid),
         "kind": it["kind"],
         "timestamp_utc": it.get("ts"),
         "model": it.get("model"),
         "blocks": it.get("blocks", []),
         "cost_usd": it.get("cost_usd"),
         "tokens": _claude_tokens_union(it.get("tokens")),
+        "member_item_keys": [
+            _claude_item_key(session_id, uuid)
+            for uuid in it.get("member_uuids", []) if uuid != own_uuid
+        ],
+        "subagent_key": it.get("subagent_key"),
+        "parent_item_key": (
+            _claude_item_key(session_id, it["parent_uuid"])
+            if it.get("parent_uuid") is not None else None
+        ),
+        "is_sidechain": bool(it.get("is_sidechain")),
+        "meta_kind": it.get("meta_kind"),
+        "skill_name": it.get("skill_name"),
+        "command_name": it.get("command_name"),
+        "cache_failure": it.get("cache_failure"),
+    }
+
+
+def _map_claude_subagent_meta(session_id: str, values: dict | None) -> dict:
+    """Translate the one identity-bearing field in legacy subagent metadata."""
+    return {
+        key: ({
+            **meta,
+            "spawn_uuid": (
+                _claude_item_key(session_id, meta["spawn_uuid"])
+                if meta.get("spawn_uuid") is not None else None
+            ),
+        } if isinstance(meta, dict) else meta)
+        for key, meta in (values or {}).items()
     }
 
 
@@ -386,6 +415,8 @@ def _claude_detail(
         "title": res["title"],
         "items": neutral_items,
         "page": page,
+        "subagent_meta": _map_claude_subagent_meta(
+            session_id, res.get("subagent_meta")),
         "children": [],
         "parent": None,
         "total_cost_usd": res["cost_usd"],
@@ -399,33 +430,98 @@ def _claude_detail(
 def _claude_outline(
     conn: sqlite3.Connection, session_id: str, conversation_key: str,
 ) -> dict:
-    """Claude outline envelope (§5.6). Reuses the existing kernel outline for
-    ``stats``/``files``; the per-turn ``item_key`` + block-kind counts are built
-    from the SAME assembled items the detail pages, so outline and detail item
-    keys align exactly. ``children`` is empty (no native threading)."""
+    """Claude outline envelope (§5.6), without weakening the native outline.
+
+    The legacy kernel is the authority for navigation: it already derives tool
+    failures, subagent topology, cache rebuilds, files, task completion, and the
+    complete turn skeleton from the same assembled items as detail.  This
+    adapter changes only identity-bearing fields from native UUIDs to neutral
+    item keys and names the provider-neutral file fields.  Re-deriving a smaller
+    outline from assembled blocks here previously stripped precisely the facts
+    the qualified reader needs (#491).
+    """
     o = lcq.get_conversation_outline(conn, session_id)
     if o is None:
         return {"status": "not_found", "conversation_key": conversation_key}
-    asm = lcq._assemble_session_memoized(conn, session_id)
+
+    def item_key(uuid):
+        return _claude_item_key(session_id, uuid) if uuid is not None else None
+
     turns = []
-    for it in asm["items"]:
-        kinds: dict[str, int] = {}
-        for b in it.get("blocks", []):
-            bk = b.get("kind")
-            if bk:
-                kinds[bk] = kinds.get(bk, 0) + 1
-        turns.append({
-            "item_key": _claude_item_key(session_id, it["anchor"]["uuid"]),
-            "label": lcq._outline_label(it.get("text", "")),
-            "timestamp_utc": it.get("ts"),
-            "kinds": kinds,
+    for turn in o["turns"]:
+        own_key = item_key(turn["uuid"])
+        neutral = {
+            "item_key": own_key,
+            "kind": turn["kind"],
+            "label": turn["label"],
+            "timestamp_utc": turn.get("ts"),
+            "kinds": {turn["kind"]: 1},
+            "member_item_keys": [
+                item_key(uuid) for uuid in turn.get("member_uuids", [])
+                if uuid != turn["uuid"]
+            ],
+            "subagent_key": turn.get("subagent_key"),
+            "parent_item_key": item_key(turn.get("parent_uuid")),
+            "is_sidechain": bool(turn.get("is_sidechain")),
+        }
+        for field in (
+                "tools", "thinking", "model", "tokens", "meta_kind",
+                "skill_name", "cache_failure"):
+            if field in turn:
+                neutral[field] = turn[field]
+        turns.append(neutral)
+
+    stats = dict(o["stats"])
+    cache_failures = stats.get("cache_failures")
+    if isinstance(cache_failures, dict):
+        cache_failures = dict(cache_failures)
+        cache_failures["rebuilds"] = [
+            {**row, "uuid": item_key(row.get("uuid"))}
+            for row in cache_failures.get("rebuilds", [])
+        ]
+        stats["cache_failures"] = cache_failures
+
+    files = []
+    for file in o.get("files", []):
+        touches = [{
+            "item_key": item_key(touch.get("uuid")),
+            "timestamp_utc": None,
+            "tool_use_id": touch.get("tool_use_id"),
+            "op": touch.get("op"),
+            "added": touch.get("add"),
+            "removed": touch.get("del"),
+        } for touch in file.get("touches", [])]
+        tools = list(dict.fromkeys(
+            touch["op"] for touch in touches if touch.get("op")))
+        files.append({
+            "file_path": file.get("path"),
+            # The count-only neutral file shape requires a tool label.  Rich
+            # Claude entries retain every native operation instead of claiming
+            # that Write/MultiEdit touches were Edit calls.
+            "tool": ",".join(tools),
+            "count": len(touches),
+            "added": file.get("add"),
+            "removed": file.get("del"),
+            "touches": touches,
         })
+
+    subagent_meta = _map_claude_subagent_meta(
+        session_id, o.get("subagent_meta"))
+    task_completion = o.get("task_completion")
+    if isinstance(task_completion, dict):
+        task_completion = {
+            **task_completion,
+            "anchor_uuid": item_key(task_completion.get("anchor_uuid")),
+        }
     return {
         "status": "ok",
         "conversation_key": conversation_key,
         "turns": turns,
-        "stats": o["stats"],
-        "files": o["files"],
+        "subagent_meta": subagent_meta,
+        "subagent_costs": o.get("subagent_costs", {}),
+        "stats": stats,
+        "files": files,
+        "task_completion": task_completion,
         "children": [],
     }
 
@@ -531,6 +627,25 @@ def neutral_browse(
     raise ValueError(f"unknown source: {source!r}")
 
 
+def neutral_facets(
+    conn: sqlite3.Connection, *, source: str, effective_speed: str | None = None,
+) -> dict:
+    """Facet-only collection envelope for one source.
+
+    Codex has a dedicated rollup projection so the facets request never builds
+    or prices a browse page that its transport discards.  Claude retains its
+    established browse-derived facet contract.
+    """
+    speed = effective_speed or _DEFAULT_SPEED
+    if source == "codex":
+        return q.list_codex_conversation_facets(conn)
+    if source == "claude":
+        env = _claude_browse(conn, effective_speed=speed)
+        return {"status": env.get("status"), "facets": env.get("facets") or {
+            "projects": [], "models": []}}
+    raise ValueError(f"unknown source: {source!r}")
+
+
 def neutral_detail(
     conn: sqlite3.Connection, ref: str, *, effective_speed: str | None = None,
     after: str | None = None, before: str | None = None,
@@ -725,6 +840,8 @@ def _claude_export(
 def neutral_find(
     conn: sqlite3.Connection, ref: str, query: str, *, kind: str = "all",
     regex: bool = False, case: bool = False, effective_speed: str | None = None,
+    limit: int = 100, cursor: str | None = None, direction: str = "next",
+    around: str | None = None,
 ) -> dict:
     """In-conversation find for a neutral reference (§3.1). An unknown ``kind``
     raises ``ValueError`` (route → 400); an unknown/garbage ref → ``not_found``.
@@ -736,8 +853,23 @@ def neutral_find(
     if cref is None:
         return {"status": "not_found", "conversation_key": ref}
     if cref.source == "codex":
-        return q.find_in_codex_conversation(
-            conn, cref.conversation_key, query, kind=kind, regex=regex, case=case)
+        try:
+            return q.find_occurrences_in_codex_conversation(
+                conn,
+                cref.conversation_key,
+                query,
+                kind=kind,
+                regex=regex,
+                case_sensitive=case,
+                limit=limit,
+                cursor=cursor,
+                direction=direction,
+                around=around,
+            )
+        except q.InvalidFindCursor:
+            return {"status": "invalid_find_cursor"}
+        except q.StaleFindCursor:
+            return {"status": "stale_find_cursor"}
     return _claude_find(
         conn, cref.native_key, cref.conversation_key, query,
         kind=kind, regex=regex, case=case)

package/bin/_lib_conversation_watch.py

@@ -51,7 +51,9 @@ def watch_step(files, seen, *, stat_fn=file_sig, ingest_fn, committed_sig_fn=Non
     cursor, in session_files, lags the new disk size). committed_sig_fn defaults
     to stat_fn for pure unit tests with no cache. A contended/declined/failed
     ingest leaves `seen` untouched so the next cycle retries (the 5s backstop is
-    the floor)."""
+    the floor). Account-scoped callers may additionally expose
+    ``stats.targeted_visible``: the clean ingest still advances ``seen``, but a
+    false value suppresses the tail frame when only another account changed."""
     committed_sig_fn = committed_sig_fn or stat_fn
     changed = changed_paths(files, seen, stat_fn)
     if not changed:
@@ -64,4 +66,4 @@ def watch_step(files, seen, *, stat_fn=file_sig, ingest_fn, committed_sig_fn=Non
         sig = committed_sig_fn(p)
         if sig is not None:
             new_seen[p] = sig
-    return new_seen, True
+    return new_seen, bool(getattr(stats, "targeted_visible", True))

package/bin/_lib_doctor.py

@@ -210,6 +210,11 @@ class DoctorState:
     # walk, so `files_failed`/`files_deferred_torn` are both zero, no `blocked`
     # record is ever written, and the ingest-backlog leg reads a drained store.
     codex_replay_deferred: Optional[dict] = None
+    # #485: privacy-safe durable records written when cache.db and/or
+    # conversations.db refused to treat an invalid Codex root as deletion
+    # evidence. None is the normal state; each record contains counts/reasons
+    # but never configured paths or provider identifiers.
+    codex_prune_refusals: Optional[list[dict]] = None
     # #279 S2 (F5b): PRAGMA quick_check(1) results, gathered ONLY under
     # doctor_gather_state(deep=True) (CLI cmd_doctor) — the dashboard
     # rebuild loop calls the gather every rebuild and quick_check on a
@@ -1236,6 +1241,64 @@ def _check_data_codex_replay(s: DoctorState) -> CheckResult:
     )
 
 
+def _check_data_codex_prune_safety(s: DoctorState) -> CheckResult:
+    """Surface a fail-closed orphan-prune decision instead of silent loss."""
+    records = [
+        record for record in (s.codex_prune_refusals or [])
+        if isinstance(record, dict)
+    ]
+    if not records:
+        return CheckResult(
+            id="data.codex_prune_safety",
+            title="Codex orphan pruning",
+            severity="ok",
+            summary="no refused prune",
+            remediation=None,
+            details={"refusalCount": 0, "stores": []},
+        )
+    stores = sorted({
+        str(record.get("store"))
+        for record in records
+        if record.get("store") in {"cache", "conversations"}
+    })
+    preserved_files = max(
+        (int(record.get("preservedFileCount") or 0) for record in records),
+        default=0,
+    )
+    since_values = sorted({
+        str(record["since"])
+        for record in records
+        if isinstance(record.get("since"), str) and record["since"]
+    })
+    reasons = sorted({
+        str(reason)
+        for record in records
+        for reason in (
+            record.get("reasons") if isinstance(record.get("reasons"), list) else []
+        )
+        if isinstance(reason, str)
+    })
+    return CheckResult(
+        id="data.codex_prune_safety",
+        title="Codex orphan pruning",
+        severity="warn",
+        summary=(
+            f"refused unsafe prune; preserved {preserved_files} tracked file(s)"
+        ),
+        remediation=(
+            "Check that every $CODEX_HOME root is mounted and contains Codex "
+            "rollout JSONL, then run `cctally cache-sync --source codex`"
+        ),
+        details={
+            "refusalCount": len(records),
+            "stores": stores,
+            "since": since_values[0] if since_values else None,
+            "reasons": reasons,
+            "preservedFileCount": preserved_files,
+        },
+    )
+
+
 def _check_data_codex_quota_verification(s: DoctorState) -> CheckResult:
     """WARN when the detached Codex quota verification is not landing.
 
@@ -2935,6 +2998,7 @@ _CATEGORY_DEFINITIONS: tuple[tuple[str, str, tuple[tuple[str, str], ...]], ...]
         # tests/test_doctor_codex_project_metadata.py), so the replay leg goes
         # after the pair rather than between them.
         ("data.codex_project_metadata", "_check_data_codex_project_metadata"),
+        ("data.codex_prune_safety", "_check_data_codex_prune_safety"),
         ("data.codex_replay", "_check_data_codex_replay"),
         ("data.codex_ingest_backlog", "_check_data_codex_ingest_backlog"),
         ("data.codex_quota", "_check_data_codex_quota"),

package/bin/_lib_quota_alert_axes.py

@@ -23,9 +23,10 @@ in ``quota_window_snapshots`` moving at all:
    and becomes eligible when wall time passes it with no mutation to observe.
    Persisting that boundary and treating ``now >= boundary`` as dirty is what
    closes it. Unlike axes 2 and 3 this one fires on WALL CLOCK rather than on a
-   configuration change, which is why the hook path defers it
-   (``defer_scheduled``) instead of paying an unannounced whole-history pass on
-   a blocking tick.
+   configuration change. An ownership schedule lets the hook evaluate only the
+   complete roots whose deadlines matured; scalar-only legacy state still
+   defers rather than paying an unannounced whole-history pass on a blocking
+   tick.
 5. **Durable lifecycle state** — the existing arming rows and terminal events,
    unchanged. Represented here only as the fingerprints axis 2 compares.
 
@@ -80,6 +81,7 @@ def alert_dirty_scope(
     gate_after: bool,
     now: dt.datetime,
     next_evaluation_at: "dt.datetime | None",
+    scheduled_roots: "Iterable[str] | None" = None,
     defer_scheduled: bool = False,
 ) -> AlertDirtyScope:
     """Resolve the five axes into one decision.
@@ -89,14 +91,11 @@ def alert_dirty_scope(
     observed_slot, window_minutes)``; the ROOT is element 1, which is what an
     exact-rule change is scoped to.
 
-    ``defer_scheduled`` is the hook path's (``full_pass="defer"``). Axes 2 and 3
-    are driven by a configuration change the user just made, so widening for
-    them is bounded and expected; axis 4 is driven by WALL CLOCK, which makes it
-    the one route into a whole-history pass that can land on a blocking hook
-    tick with nothing to have predicted it. Under this flag it is recorded as
-    ``REASON_SCHEDULED_DEFERRED`` and does NOT strengthen the scope — and the
-    caller owes the stored boundary a carry-through, because a deferral that
-    lets the boundary be recomputed is a silent drop.
+    ``scheduled_roots`` is the validated ownership retained with axis 4. When
+    present, a matured instant scopes to those roots even on the hook path.
+    ``None`` is the legacy/unavailable-ownership shape; only that shape needs
+    ``defer_scheduled`` to avoid an unannounced whole-history hook pass, and the
+    caller then owes the scalar boundary a carry-through.
     """
     reasons: list[str] = []
     if not gate_after:
@@ -132,11 +131,19 @@ def alert_dirty_scope(
         reasons.append("rule_changed")
 
     if next_evaluation_at is not None and now >= next_evaluation_at:
-        # A future-clocked observation just became eligible. Which identity it
-        # belongs to is not recorded — only the instant — so the honest scope is
-        # everything, and on the hook path "everything" is precisely what may
-        # not run.
-        if defer_scheduled:
+        # Epoch 1007 records the roots owning each scheduled instant. A complete
+        # semantic pass over those roots is bounded enough for the hook path and
+        # is all axis 4 needs. ``None`` means legacy/unavailable ownership, where
+        # the only honest scope remains everything (and therefore deferral on a
+        # hook tick). An empty known set means the owning roots are not lifecycle
+        # eligible on this tick; the stored axis remains due for a later tick.
+        if scheduled_roots is not None:
+            due_roots = {str(root) for root in scheduled_roots if str(root)}
+            if due_roots:
+                scope = _strongest(scope, SCOPE_ROOTS)
+                roots |= due_roots
+                reasons.append("scheduled")
+        elif defer_scheduled:
             reasons.append(REASON_SCHEDULED_DEFERRED)
         else:
             scope = _strongest(scope, SCOPE_ALL)
@@ -154,12 +161,12 @@ def next_evaluation_boundary(
 ) -> "dt.datetime | None":
     """The earliest still-future capture the projector must come back for.
 
-    A bounded pass only sees the dirty windows, so the STORED boundary is
+    This is the legacy scalar helper. A bounded pass only sees dirty windows, so
+    the STORED boundary is
     retained whenever it is still in the future: dropping it would forget a
     future-clocked observation sitting in a window this pass never loaded. Once
-    wall time passes it the axis fires, the pass widens to everything, and the
-    boundary is recomputed from complete evidence — so a retained value can only
-    ever cost one extra pass, never a missed one.
+    wall time passes it the axis fires and the caller decides whether it has
+    enough ownership to scope the pass.
 
     ``retain_due`` keeps a boundary that is ALREADY due, which is the case where
     "recomputed from complete evidence" is a lie: a reporting-only pass never
@@ -167,20 +174,10 @@ def next_evaluation_boundary(
     the widening deliberately did not look. Either would otherwise retire the
     axis on behalf of an evaluation nobody performed.
 
-    A due value sorts before every future candidate, so it stays until a pass
-    that genuinely looked at everything retires it — in practice a hook tick
-    that widened to whole-history for axis 2 or 3, since carrying alert
-    eligibility is what separates such a pass from a reporting-only one and the
-    hook is the only production caller that carries it.
-
-    It does NOT stay "until a pass that can act on it does", and that gap is
-    open rather than closed: on a hook-only install with a steady enabled gate,
-    unchanged rules and a quiet ledger, no qualifying pass ever runs and the
-    instant is retained indefinitely. The cost is bounded — the tick stays
-    bounded and fast, and the window is re-evaluated as soon as it goes
-    ledger-dirty again, which for a live window is continuous — so the exposure
-    is a future-clocked capture in a window that then goes permanently quiet
-    never qualifying a threshold. Under-alerting, never a stall or a burst.
+    Epoch 1007's per-root map is maintained by the projector rather than this
+    helper. It closes the quiet-window gap by letting a hook tick replace only
+    the roots it evaluated; scalar-only legacy state still uses ``retain_due``
+    and the conservative full/deferred path.
     """
     candidates = [value for value in capture_times if value > now]
     if stored is not None and (retain_due or stored > now):