chainlesschain 0.162.197 → 0.162.200

package/src/harness/session-index.js

@@ -21,8 +21,8 @@ import { existsSync, readdirSync, statSync } from "node:fs";
 import { join, basename } from "node:path";
 import { createRequire } from "node:module";
 import { getHomeDir } from "../lib/paths.js";
-import { iterateFileLinesSync } from "../lib/file-lines.js";
 import { ensurePrivateDirectory, ensurePrivateFile } from "../lib/secure-fs.js";
+import { readVerifiedProjection } from "./jsonl-session-store.js";
 
 const requireCjs = createRequire(import.meta.url);
 
@@ -98,84 +98,74 @@ function toIsoSafe(value) {
   return Number.isNaN(date.getTime()) ? "" : date.toISOString();
 }
 
-function summarizeSessionFile(id, filePath) {
-  let startEvent = null;
-  let lastEvent = null;
-  let renamedTitle = null;
-  let messageCount = 0;
-  let eventCount = 0;
-  let chainHash = "";
-  const parts = [];
-  let used = 0;
-  for (const { line } of iterateFileLinesSync(filePath)) {
-    let event;
-    try {
-      event = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    eventCount += 1;
-    lastEvent = event;
-    if (!startEvent && event.type === "session_start") startEvent = event;
-    if (event.type === "session_rename" && event.data?.title) {
-      renamedTitle = String(event.data.title);
-    }
-    if (event.type === "user_message" || event.type === "assistant_message") {
-      messageCount += 1;
-      if (used < CONTENT_CAP) {
-        const content = event.data?.content;
-        const text =
-          typeof content === "string"
-            ? content
-            : content == null
-              ? ""
-              : JSON.stringify(content);
-        if (text) {
-          const bounded = text.slice(0, CONTENT_CAP - used);
-          parts.push(bounded);
-          used += bounded.length;
+function summarizeVerifiedSession(id) {
+  return readVerifiedProjection(id, () => {
+    let startEvent = null;
+    let lastEvent = null;
+    let renamedTitle = null;
+    let messageCount = 0;
+    let eventCount = 0;
+    let chainHash = "";
+    const parts = [];
+    let used = 0;
+    const acceptContent = (content) => {
+      if (used >= CONTENT_CAP) return;
+      const text =
+        typeof content === "string"
+          ? content
+          : content == null
+            ? ""
+            : JSON.stringify(content);
+      if (!text) return;
+      const bounded = text.slice(0, CONTENT_CAP - used);
+      parts.push(bounded);
+      used += bounded.length;
+    };
+    return {
+      accept(event) {
+        eventCount += 1;
+        lastEvent = event;
+        if (!startEvent && event.type === "session_start") startEvent = event;
+        if (event.type === "session_rename" && event.data?.title) {
+          renamedTitle = String(event.data.title);
         }
-      }
-    } else if (
-      event.type === "ws_turn" &&
-      event.data?.schemaVersion === 1 &&
-      event.data?.outcome === "completed" &&
-      event.data?.user?.role === "user" &&
-      event.data?.assistant?.role === "assistant"
-    ) {
-      messageCount += 2;
-      for (const message of [event.data?.user, event.data?.assistant]) {
-        if (used >= CONTENT_CAP) break;
-        const content = message?.content;
-        const text =
-          typeof content === "string"
-            ? content
-            : content == null
-              ? ""
-              : JSON.stringify(content);
-        if (text) {
-          const bounded = text.slice(0, CONTENT_CAP - used);
-          parts.push(bounded);
-          used += bounded.length;
+        if (
+          event.type === "user_message" ||
+          event.type === "assistant_message"
+        ) {
+          messageCount += 1;
+          acceptContent(event.data?.content);
+        } else if (
+          event.type === "ws_turn" &&
+          event.data?.schemaVersion === 1 &&
+          event.data?.outcome === "completed" &&
+          event.data?.user?.role === "user" &&
+          event.data?.assistant?.role === "assistant"
+        ) {
+          messageCount += 2;
+          acceptContent(event.data.user.content);
+          acceptContent(event.data.assistant.content);
         }
-      }
-    }
-    if (typeof event.hash === "string") chainHash = event.hash;
-  }
-  if (!lastEvent) return null;
-  return {
-    id,
-    title: renamedTitle || startEvent?.data?.title || "Untitled",
-    provider: startEvent?.data?.provider || "",
-    model: startEvent?.data?.model || "",
-    message_count: messageCount,
-    event_count: eventCount,
-    created_at: toIsoSafe(startEvent?.timestamp),
-    updated_at: toIsoSafe(lastEvent?.timestamp),
-    last_ts: lastEvent?.timestamp || 0,
-    content: parts.join("\n").slice(0, CONTENT_CAP),
-    chain_hash: chainHash,
-  };
+        if (typeof event.hash === "string") chainHash = event.hash;
+      },
+      finish() {
+        if (!lastEvent) return null;
+        return {
+          id,
+          title: renamedTitle || startEvent?.data?.title || "Untitled",
+          provider: startEvent?.data?.provider || "",
+          model: startEvent?.data?.model || "",
+          message_count: messageCount,
+          event_count: eventCount,
+          created_at: toIsoSafe(startEvent?.timestamp),
+          updated_at: toIsoSafe(lastEvent?.timestamp),
+          last_ts: lastEvent?.timestamp || 0,
+          content: parts.join("\n").slice(0, CONTENT_CAP),
+          chain_hash: chainHash,
+        };
+      },
+    };
+  });
 }
 
 const UPSERT_SESSION = `
@@ -195,7 +185,7 @@ ON CONFLICT(id) DO UPDATE SET
 export function indexOneSession(db, id, { mtimeMs = 0, sizeBytes = 0 } = {}) {
   const filePath = join(sessionsDir(), `${id}.jsonl`);
   if (!existsSync(filePath)) return false;
-  const s = summarizeSessionFile(id, filePath);
+  const s = summarizeVerifiedSession(id);
   if (!s) return false;
   db.prepare(UPSERT_SESSION).run({
     id: s.id,
@@ -228,6 +218,7 @@ export function syncIndex(db, { force = false } = {}) {
   let scanned = 0;
   let updated = 0;
   let removed = 0;
+  let rejected = 0;
   const seen = new Set();
 
   if (existsSync(dir)) {
@@ -251,7 +242,16 @@ export function syncIndex(db, { force = false } = {}) {
         ) {
           continue; // unchanged
         }
-        if (indexOneSession(db, id, { mtimeMs, sizeBytes: size })) updated++;
+        try {
+          if (indexOneSession(db, id, { mtimeMs, sizeBytes: size })) updated++;
+        } catch {
+          // The index is disposable. A damaged canonical source invalidates any
+          // older cached content immediately and is reported without exposing
+          // transcript text or local paths.
+          db.prepare("DELETE FROM sessions WHERE id=?").run(id);
+          db.prepare("DELETE FROM session_content WHERE id=?").run(id);
+          rejected++;
+        }
       }
     });
     const entries = [];
@@ -278,7 +278,7 @@ export function syncIndex(db, { force = false } = {}) {
   }
 
   const total = db.prepare("SELECT COUNT(*) c FROM sessions").get().c;
-  return { scanned, updated, removed, total };
+  return { scanned, updated, removed, rejected, total };
 }
 
 const LIST_COLUMNS =

package/src/harness/session-list-index.js

@@ -11,6 +11,7 @@ import {
   appendFileSync,
   existsSync,
   readFileSync,
+  rmSync,
   writeFileSync,
 } from "node:fs";
 import { join } from "node:path";
@@ -19,6 +20,12 @@ import { ensurePrivateFile } from "../lib/secure-fs.js";
 
 export const SESSION_INDEX_SCHEMA = 2;
 export const SESSION_INDEX_FILE = ".sessions-index-v2.ndjson";
+export const SESSION_TOMBSTONE_MARKER_SUFFIX = ".tombstone";
+export const SESSION_TOMBSTONE_MARKER_SCHEMA =
+  "chainlesschain.session-tombstone/v1";
+export const SESSION_GENERATION_AUTHORITY_FIELD = "_sessionGeneration";
+export const SESSION_GENERATION_AUTHORITY_SCHEMA =
+  "chainlesschain.session-generation-authority/v1";
 
 // Used only by an opted-in child in the independent session-scale crash gate.
 // Keeping the injection immediately around the production sidecar/journal
@@ -41,6 +48,10 @@ export function sessionIndexPath(dir) {
   return join(dir, SESSION_INDEX_FILE);
 }
 
+export function sessionTombstoneMarkerPath(dir, sessionId) {
+  return join(dir, `${sessionId}${SESSION_TOMBSTONE_MARKER_SUFFIX}`);
+}
+
 export function emptySessionMeta(sessionId) {
   return {
     schema: SESSION_INDEX_SCHEMA,
@@ -53,10 +64,67 @@ export function emptySessionMeta(sessionId) {
     created_at_ms: 0,
     updated_at_ms: 0,
     last_hash: null,
+    transcript: null,
+    generation: null,
+    deleted_at_ms: null,
     deleted: false,
   };
 }
 
+export function normalizeSessionGenerationAuthority(value) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    value.schema !== SESSION_GENERATION_AUTHORITY_SCHEMA ||
+    typeof value.sessionId !== "string" ||
+    value.sessionId.length === 0 ||
+    typeof value.generationId !== "string" ||
+    !/^generation-[0-9a-f-]{32,36}$/.test(value.generationId) ||
+    !Number.isSafeInteger(value.ordinal) ||
+    value.ordinal < 1
+  ) {
+    return null;
+  }
+  let predecessor = null;
+  if (value.predecessor !== null) {
+    const previous = value.predecessor;
+    if (
+      !previous ||
+      typeof previous !== "object" ||
+      Array.isArray(previous) ||
+      !["tombstone", "legacy-tombstone"].includes(previous.kind) ||
+      (previous.generationId !== null &&
+        (typeof previous.generationId !== "string" ||
+          !/^generation-[0-9a-f-]{32,36}$/.test(previous.generationId))) ||
+      (previous.headHash !== null &&
+        (typeof previous.headHash !== "string" ||
+          !/^[0-9a-f]{64}$/.test(previous.headHash))) ||
+      !Number.isSafeInteger(previous.eventCount) ||
+      previous.eventCount < 0 ||
+      (previous.tombstonedAtMs !== null &&
+        (!Number.isSafeInteger(previous.tombstonedAtMs) ||
+          previous.tombstonedAtMs < 0))
+    ) {
+      return null;
+    }
+    predecessor = {
+      kind: previous.kind,
+      generationId: previous.generationId,
+      headHash: previous.headHash,
+      eventCount: previous.eventCount,
+      tombstonedAtMs: previous.tombstonedAtMs,
+    };
+  }
+  return {
+    schema: SESSION_GENERATION_AUTHORITY_SCHEMA,
+    sessionId: value.sessionId,
+    generationId: value.generationId,
+    ordinal: value.ordinal,
+    predecessor,
+  };
+}
+
 export function readSessionMeta(dir, sessionId) {
   const filePath = sessionMetaPath(dir, sessionId);
   if (!existsSync(filePath)) return null;
@@ -102,12 +170,48 @@ export function applyEventToSessionMeta(meta, event, lastHash) {
   ) {
     next.message_count = Math.max(0, Number(next.message_count) || 0) + 2;
   }
+  const generation = normalizeSessionGenerationAuthority(
+    event?.data?.[SESSION_GENERATION_AUTHORITY_FIELD],
+  );
+  if (generation?.sessionId === next.id) next.generation = generation;
+  next.deleted_at_ms = null;
   next.last_hash = typeof lastHash === "string" ? lastHash : null;
   return next;
 }
 
 function writeMetaSnapshot(dir, meta) {
   const filePath = sessionMetaPath(dir, meta.id);
+  const tombstoneMarker = sessionTombstoneMarkerPath(dir, meta.id);
+  // The marker is the durable per-session namespace witness that makes a
+  // tombstoned identity discoverable without reading every live sidecar on
+  // `--continue`; the meta snapshot remains the content/status authority.
+  // Publish the marker before the tombstone snapshot, and fail the delete if
+  // that publication fails. Remove it only after a live generation snapshot
+  // commits, so crashes can cause an extra candidate read but never hide a
+  // successfully committed tombstone.
+  if (meta.deleted === true) {
+    const generation = normalizeSessionGenerationAuthority(meta.generation);
+    const marker = {
+      schema: SESSION_TOMBSTONE_MARKER_SCHEMA,
+      id: meta.id,
+      generation: generation?.sessionId === meta.id ? generation : null,
+      last_hash:
+        typeof meta.last_hash === "string" &&
+        /^[0-9a-f]{64}$/.test(meta.last_hash)
+          ? meta.last_hash
+          : null,
+      event_count: Math.max(0, Number(meta.event_count) || 0),
+      deleted_at_ms: Math.max(
+        0,
+        Number(meta.deleted_at_ms || meta.updated_at_ms) || 0,
+      ),
+    };
+    writeFileSync(tombstoneMarker, `${JSON.stringify(marker)}\n`, {
+      encoding: "utf8",
+      mode: 0o600,
+    });
+    ensurePrivateFile(tombstoneMarker);
+  }
   // The owning transcript lock serializes this derived snapshot. It need not
   // use a second temp+rename protocol: interruption can only corrupt a cache,
   // which readSessionMeta rejects and rebuildSessionMeta regenerates.
@@ -116,6 +220,40 @@ function writeMetaSnapshot(dir, meta) {
     mode: 0o600,
   });
   ensurePrivateFile(filePath);
+  if (meta.deleted !== true) rmSync(tombstoneMarker, { force: true });
+}
+
+/**
+ * Read the durable namespace marker. Legacy empty/invalid markers still count
+ * as deletion evidence, but deliberately expose no predecessor authority.
+ */
+export function readSessionTombstoneMarker(dir, sessionId) {
+  const filePath = sessionTombstoneMarkerPath(dir, sessionId);
+  if (!existsSync(filePath)) return null;
+  try {
+    const value = JSON.parse(readFileSync(filePath, "utf8"));
+    if (
+      value?.schema !== SESSION_TOMBSTONE_MARKER_SCHEMA ||
+      value?.id !== sessionId
+    ) {
+      return { id: sessionId, legacy: true };
+    }
+    const generation = normalizeSessionGenerationAuthority(value.generation);
+    return {
+      schema: SESSION_TOMBSTONE_MARKER_SCHEMA,
+      id: sessionId,
+      generation: generation?.sessionId === sessionId ? generation : null,
+      last_hash:
+        typeof value.last_hash === "string" &&
+        /^[0-9a-f]{64}$/.test(value.last_hash)
+          ? value.last_hash
+          : null,
+      event_count: Math.max(0, Number(value.event_count) || 0),
+      deleted_at_ms: Math.max(0, Number(value.deleted_at_ms) || 0),
+    };
+  } catch {
+    return { id: sessionId, legacy: true };
+  }
 }
 
 function appendActivity(dir, meta) {
@@ -135,11 +273,46 @@ function appendActivity(dir, meta) {
 }
 
 /** Called while the owning transcript lock is held. */
-export function recordSessionEvent(dir, sessionId, event, lastHash) {
-  const current =
-    readSessionMeta(dir, sessionId) || emptySessionMeta(sessionId);
+export function recordSessionEvent(
+  dir,
+  sessionId,
+  event,
+  lastHash,
+  { resetGeneration = false, transcriptState = null } = {},
+) {
+  const existing = readSessionMeta(dir, sessionId);
+  // Only the transcript writer may authorize a new generation after checking
+  // the tombstone and physical file under its lock. The index cannot infer
+  // that authority from an attacker-controlled genesis-shaped event alone.
+  const current = resetGeneration
+    ? emptySessionMeta(sessionId)
+    : existing || emptySessionMeta(sessionId);
   current.id = sessionId;
   const next = applyEventToSessionMeta(current, event, lastHash);
+  next.transcript = transcriptState
+    ? {
+        dev: String(transcriptState.dev),
+        ino: String(transcriptState.ino),
+        size: Number(transcriptState.size),
+        mtimeMs: Number(transcriptState.mtimeMs),
+        ctimeMs: Number(transcriptState.ctimeMs),
+        ...(transcriptState.devExact != null
+          ? { devExact: String(transcriptState.devExact) }
+          : {}),
+        ...(transcriptState.inoExact != null
+          ? { inoExact: String(transcriptState.inoExact) }
+          : {}),
+        ...(transcriptState.sizeExact != null
+          ? { sizeExact: String(transcriptState.sizeExact) }
+          : {}),
+        ...(transcriptState.mtimeNs != null
+          ? { mtimeNs: String(transcriptState.mtimeNs) }
+          : {}),
+        ...(transcriptState.ctimeNs != null
+          ? { ctimeNs: String(transcriptState.ctimeNs) }
+          : {}),
+      }
+    : null;
   writeMetaSnapshot(dir, next);
   runSessionScaleFaultHook("afterMetaSnapshot", {
     dir,
@@ -171,7 +344,9 @@ export function recordSessionDeleted(dir, sessionId, timestamp = Date.now()) {
   const tombstone = {
     ...current,
     updated_at_ms: timestamp,
+    deleted_at_ms: timestamp,
     deleted: true,
+    transcript: null,
   };
   writeMetaSnapshot(dir, tombstone);
   appendActivity(dir, tombstone);
@@ -224,13 +399,29 @@ export function publicSessionMeta(meta) {
  */
 export function listIndexedSessions(
   dir,
-  { limit = 20, hasSession = () => true } = {},
+  {
+    limit = 20,
+    hasSession = () => true,
+    includeDeleted = () => false,
+    onScanComplete = null,
+  } = {},
 ) {
   const filePath = sessionIndexPath(dir);
-  if (!existsSync(filePath)) return [];
+  if (!existsSync(filePath)) {
+    if (typeof onScanComplete === "function") {
+      onScanComplete({
+        exhausted: true,
+        seenSessionIds: new Set(),
+        latestBySessionId: new Map(),
+      });
+    }
+    return [];
+  }
   const wanted = Math.max(0, Number(limit) || 0);
   const seen = new Set();
+  const latestBySessionId = new Map();
   const result = [];
+  let exhausted = true;
   for (const { line } of iterateFileLinesReverseSync(filePath)) {
     let meta;
     try {
@@ -246,9 +437,21 @@ export function listIndexedSessions(
       continue;
     }
     seen.add(meta.id);
-    if (meta.deleted || !hasSession(meta.id)) continue;
+    latestBySessionId.set(meta.id, meta);
+    if (
+      (meta.deleted && !includeDeleted(meta.id, meta)) ||
+      !hasSession(meta.id)
+    ) {
+      continue;
+    }
     result.push(publicSessionMeta(meta));
-    if (wanted > 0 && result.length >= wanted) break;
+    if (wanted > 0 && result.length >= wanted) {
+      exhausted = false;
+      break;
+    }
+  }
+  if (typeof onScanComplete === "function") {
+    onScanComplete({ exhausted, seenSessionIds: seen, latestBySessionId });
   }
   return result;
 }

package/src/lazy-dispatch.js

@@ -337,6 +337,43 @@ export function resolveCommandLifecycleInvocation(
   };
 }
 
+/**
+ * Build the bounded, content-free lifecycle usage dimensions for a migrated
+ * command. The original argv is inspected only to distinguish the retained
+ * top-level spelling from its virtual namespace replacement; arguments and
+ * nested command names are never copied into telemetry.
+ */
+export function resolveCommandLifecycleTelemetry(
+  argv,
+  manifestData = manifest,
+) {
+  const invocation = resolveCommandLifecycleInvocation(argv, manifestData);
+  let entry = null;
+  let route = null;
+  if (invocation.kind === "namespace-rewrite") {
+    entry = invocation.entry;
+    route = "replacement";
+  } else if (invocation.kind === "passthrough") {
+    const commandName = resolveCommandToken(argv);
+    entry = findManifestEntry(commandName, manifestData);
+    route = "legacy";
+  }
+  if (
+    entry?.lifecycle?.state !== "deprecated" ||
+    typeof entry.name !== "string" ||
+    !entry.replacement
+  ) {
+    return null;
+  }
+  return Object.freeze({
+    command: entry.name,
+    route,
+    version: packageMetadata.version,
+    deprecatedSince: entry.lifecycle.deprecatedSince,
+    removalNotBefore: entry.lifecycle.removalNotBefore,
+  });
+}
+
 export function formatCommandDeprecationWarning(entry, invokedName) {
   const lifecycle = entry?.lifecycle;
   if (lifecycle?.state !== "deprecated" || !entry.replacement) return null;
@@ -691,7 +728,7 @@ export async function dispatchCli(
   { manifestData = manifest, ...dispatchOptions } = {},
 ) {
   const commandName = resolveCommandToken(argv);
-  const entry = findManifestEntry(commandName, manifestData);
+  let entry = findManifestEntry(commandName, manifestData);
   if (!entry) {
     const program = await (
       dispatchOptions.loadFullProgram || defaultLoadFullProgram
@@ -699,20 +736,35 @@ export async function dispatchCli(
     await program.parseAsync(argv);
     return;
   }
+  const commandLocation = findCommandTokenLocation(argv);
+  if (entry.name === "session" && argv[commandLocation?.index + 1] === "show") {
+    entry = {
+      ...entry,
+      module: "./commands/session-show.js",
+      register: "registerSessionShowCommand",
+    };
+  }
   await dispatchManifestEntry(argv, entry, dispatchOptions);
 }
 
 export function isFastReadOnlyInvocation(argv, env = process.env) {
   const args = argv.slice(2);
-  return (
+  const explicitOtlp =
+    args.includes("--otlp-endpoint") ||
+    args.some((token) => token.startsWith("--otlp-endpoint=")) ||
+    env.OTEL_EXPORTER_OTLP_ENDPOINT ||
+    env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ||
+    env.OTEL_EXPORTER_OTLP_METRICS_ENDPOINT;
+  const quickStatus =
     resolveCommandToken(argv) === "status" &&
     !args.includes("--deep") &&
-    !args.includes("--otlp-endpoint") &&
-    !args.some((token) => token.startsWith("--otlp-endpoint=")) &&
-    !env.OTEL_EXPORTER_OTLP_ENDPOINT &&
-    !env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT &&
-    !env.OTEL_EXPORTER_OTLP_METRICS_ENDPOINT
-  );
+    !explicitOtlp;
+  const commandLocation = findCommandTokenLocation(argv);
+  const sessionShow =
+    commandLocation?.token === "session" &&
+    argv[commandLocation.index + 1] === "show" &&
+    !explicitOtlp;
+  return quickStatus || sessionShow;
 }
 
 let processHandlersInstalled = false;
@@ -767,6 +819,10 @@ async function withInvocationOutputContext(argv, task) {
 }
 
 export async function runCli(argv, options = {}) {
+  const lifecycleTelemetry = resolveCommandLifecycleTelemetry(
+    argv,
+    options.manifestData || manifest,
+  );
   const prepared = await prepareInvocation(argv, options);
   if (prepared.handled) {
     if (prepared.exitCode) {
@@ -799,12 +855,24 @@ export async function runCli(argv, options = {}) {
     }
 
     const observability = await initializeCommandRuntime(dispatchArgv);
+    const lifecycleStartedAt = performance.now();
+    let lifecycleOutcome = "completed";
     try {
       return await withDefaultEventRuntimeLifecycle(
         () => dispatchCli(dispatchArgv, options),
         options,
       );
+    } catch (error) {
+      lifecycleOutcome = "error";
+      throw error;
     } finally {
+      if (lifecycleTelemetry) {
+        observability.exportCommandLifecycleInvocation({
+          ...lifecycleTelemetry,
+          outcome: lifecycleOutcome,
+          durationMs: performance.now() - lifecycleStartedAt,
+        });
+      }
       await observability.shutdown().catch(() => {});
     }
   });