chat-recall 0.0.1 → 0.4.8

package/dist/device-auth.js

@@ -0,0 +1,161 @@
+/**
+ * Device Authorization Grant (RFC 8628) for `chat-recall login` — two flavors,
+ * picked by the target server's /api/capabilities `authProvider`:
+ *
+ *   better-auth  (betterAuthDeviceLogin) — the flow runs against the SERVER
+ *                ITSELF (/api/auth/device/*). The token it returns is a
+ *                better-auth session token; the server accepts it as a Bearer
+ *                at /api/me, /api/teams* via its bearer plugin.
+ *   keycloak     (deviceLogin, legacy) — the flow runs against the realm the
+ *                server advertises as `oidcIssuer`. Returns a realm access
+ *                token, verified server-side via JWKS.
+ *
+ * Either way the CLI can't host a redirect URI, so: mint a user_code, tell the
+ * human to approve it in a browser, poll the token endpoint until they do.
+ * There is NO baked-in issuer or server: everything is discovered from the
+ * server being logged into. Self-host with AUTH_PROVIDER=none skips this flow
+ * entirely (token / no-auth login).
+ *
+ * The Keycloak chat-recall-web client enforces PKCE (S256), so that flavor
+ * carries a code_challenge on init and the matching code_verifier on the poll.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+const b64url = (b) => b.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+/** Optional env fallback for the OIDC issuer. No hardcoded default — the value
+ *  comes from the target server's /api/capabilities, `--issuer`, or this var. */
+export const DEFAULT_ISSUER = process.env.CHAT_RECALL_OIDC_ISSUER || '';
+export const DEFAULT_CLIENT_ID = 'chat-recall-web';
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/**
+ * Run the full device flow. `onPrompt` receives the human-facing instructions
+ * (verification URL + code) so the caller controls presentation.
+ */
+export async function deviceLogin(opts, onPrompt) {
+    const issuer = (opts.issuer || DEFAULT_ISSUER).replace(/\/+$/, '');
+    if (!issuer) {
+        throw new Error('No OIDC issuer configured for SSO login. Pass --issuer <url>, set '
+            + 'CHAT_RECALL_OIDC_ISSUER, or log in with a token instead: '
+            + '`chat-recall login <server-url> --token <token>` '
+            + '(self-host with AUTH_PROVIDER=none needs no token at all).');
+    }
+    const clientId = opts.clientId || DEFAULT_CLIENT_ID;
+    const scope = opts.scope || 'openid email profile';
+    // PKCE: the client requires S256. Verifier is held until the token poll.
+    const codeVerifier = b64url(randomBytes(32));
+    const codeChallenge = b64url(createHash('sha256').update(codeVerifier).digest());
+    const startRes = await fetch(`${issuer}/protocol/openid-connect/auth/device`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({ client_id: clientId, scope, code_challenge: codeChallenge, code_challenge_method: 'S256' }),
+    });
+    if (!startRes.ok) {
+        throw new Error(`device-auth init failed: HTTP ${startRes.status} ${await startRes.text().catch(() => '')}`);
+    }
+    const start = (await startRes.json());
+    onPrompt({
+        url: start.verification_uri_complete || start.verification_uri,
+        userCode: start.user_code,
+        verificationUri: start.verification_uri,
+    });
+    const tokenUrl = `${issuer}/protocol/openid-connect/token`;
+    const deadline = Date.now() + start.expires_in * 1000;
+    let interval = (start.interval ?? 5) * 1000;
+    while (Date.now() < deadline) {
+        await sleep(interval);
+        const res = await fetch(tokenUrl, {
+            method: 'POST',
+            headers: { 'content-type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                // RFC 8628 §3.4 — the exact URN matters: 'grant-type' is part of it.
+                // The truncated 'urn:ietf:params:oauth:device_code' made Keycloak
+                // reject every poll with unsupported_grant_type (found by the first
+                // real new-user onboarding test, 2026-07-03).
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                device_code: start.device_code,
+                client_id: clientId,
+                code_verifier: codeVerifier,
+            }),
+        });
+        const body = (await res.json().catch(() => ({})));
+        if (res.ok && typeof body.access_token === 'string') {
+            return {
+                accessToken: body.access_token,
+                refreshToken: typeof body.refresh_token === 'string' ? body.refresh_token : undefined,
+                expiresIn: typeof body.expires_in === 'number' ? body.expires_in : 0,
+            };
+        }
+        // RFC 8628 §3.5: keep polling on these, back off on slow_down, fail otherwise.
+        const err = body.error;
+        if (err === 'authorization_pending')
+            continue;
+        if (err === 'slow_down') {
+            interval += 5000;
+            continue;
+        }
+        if (err === 'expired_token')
+            break;
+        throw new Error(`device-auth failed: ${String(err || `HTTP ${res.status}`)}`);
+    }
+    throw new Error('device-auth timed out — the code expired before approval.');
+}
+/** Client id the CLI presents to the server's embedded provider. A public
+ *  identifier (not a secret) — the server pins it via validateClient. */
+export const BETTER_AUTH_CLI_CLIENT_ID = 'chat-recall-cli';
+/**
+ * Device flow against the server's EMBEDDED better-auth provider
+ * (AUTH_PROVIDER=better-auth): POST /api/auth/device/code, send the human to
+ * the server's own /device page, poll /api/auth/device/token. Same RFC 8628
+ * poll semantics as the Keycloak flavor; JSON bodies instead of form-encoded.
+ */
+export async function betterAuthDeviceLogin(serverUrl, onPrompt) {
+    const base = serverUrl.replace(/\/+$/, '');
+    const startRes = await fetch(`${base}/api/auth/device/code`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ client_id: BETTER_AUTH_CLI_CLIENT_ID }),
+    });
+    if (!startRes.ok) {
+        throw new Error(`device-auth init failed: HTTP ${startRes.status} ${await startRes.text().catch(() => '')}`);
+    }
+    const start = (await startRes.json());
+    onPrompt({
+        url: start.verification_uri_complete || start.verification_uri,
+        userCode: start.user_code,
+        verificationUri: start.verification_uri,
+    });
+    const deadline = Date.now() + start.expires_in * 1000;
+    let interval = (start.interval ?? 5) * 1000;
+    while (Date.now() < deadline) {
+        await sleep(interval);
+        const res = await fetch(`${base}/api/auth/device/token`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                device_code: start.device_code,
+                client_id: BETTER_AUTH_CLI_CLIENT_ID,
+            }),
+        });
+        const body = (await res.json().catch(() => ({})));
+        if (res.ok && typeof body.access_token === 'string') {
+            return {
+                accessToken: body.access_token,
+                expiresIn: typeof body.expires_in === 'number' ? body.expires_in : 0,
+            };
+        }
+        // RFC 8628 §3.5 — same contract as the Keycloak flavor.
+        const err = body.error;
+        if (err === 'authorization_pending')
+            continue;
+        if (err === 'slow_down') {
+            interval += 5000;
+            continue;
+        }
+        if (err === 'expired_token' || err === 'access_denied') {
+            throw new Error(err === 'access_denied' ? 'device-auth denied in the browser.' : 'device-auth timed out — the code expired before approval.');
+        }
+        throw new Error(`device-auth failed: ${String(err || `HTTP ${res.status}`)}`);
+    }
+    throw new Error('device-auth timed out — the code expired before approval.');
+}
+//# sourceMappingURL=device-auth.js.map

package/dist/device-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-auth.js","sourceRoot":"","sources":["../src/device-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAE9G;iFACiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAiBnD,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAA4D,EAC5D,QAAiF;IAEjF,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,oEAAoE;cAClE,2DAA2D;cAC3D,mDAAmD;cACnD,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,sBAAsB,CAAC;IAEnD,yEAAyE;IACzE,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,sCAAsC,EAAE;QAC5E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;KACxH,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;IAE5D,QAAQ,CAAC;QACP,GAAG,EAAE,KAAK,CAAC,yBAAyB,IAAI,KAAK,CAAC,gBAAgB;QAC9D,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,eAAe,EAAE,KAAK,CAAC,gBAAgB;KACxC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,GAAG,MAAM,gCAAgC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;IACtD,IAAI,QAAQ,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAE5C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,qEAAqE;gBACrE,kEAAkE;gBAClE,oEAAoE;gBACpE,8CAA8C;gBAC9C,UAAU,EAAE,8CAA8C;gBAC1D,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,YAAY;aAC5B,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,IAAI,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,YAAY,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;gBACrF,SAAS,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;aACrE,CAAC;QACJ,CAAC;QACD,+EAA+E;QAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,GAAG,KAAK,uBAAuB;YAAE,SAAS;QAC9C,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAAC,QAAQ,IAAI,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QACxD,IAAI,GAAG,KAAK,eAAe;YAAE,MAAM;QACnC,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,CAAC,GAAG,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;AAC/E,CAAC;AAED;yEACyE;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,QAAiF;IAEjF,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uBAAuB,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC;KAC/D,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;IAE5D,QAAQ,CAAC;QACP,GAAG,EAAE,KAAK,CAAC,yBAAyB,IAAI,KAAK,CAAC,gBAAgB;QAC9D,QAAQ,EAAE,KAAK,CAAC,SAAS;QACzB,eAAe,EAAE,KAAK,CAAC,gBAAgB;KACxC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;IACtD,IAAI,QAAQ,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAE5C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,wBAAwB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,8CAA8C;gBAC1D,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,yBAAyB;aACrC,CAAC;SACH,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,IAAI,GAAG,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,SAAS,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;aACrE,CAAC;QACJ,CAAC;QACD,wDAAwD;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,GAAG,KAAK,uBAAuB;YAAE,SAAS;QAC9C,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAAC,QAAQ,IAAI,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QACxD,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC;QAChJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,CAAC,GAAG,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;AAC/E,CAAC"}

package/dist/escalate.d.ts

@@ -0,0 +1,99 @@
+/**
+ * `chat-recall escalate` — the WRITE half of the Context Engineering loop.
+ *
+ * The read half already exists: `chat-recall memory wake-up` (SessionStart
+ * hook) injects prior knowledge into a new session. This module closes the
+ * loop at the other end: at SessionEnd it extracts a finished session's
+ * learnings and asserts them into the temporal knowledge graph, so the NEXT
+ * wake-up already knows them. Three kinds of learning, three predicates:
+ *
+ *   - decisions the agent announced  → <project> → decided        → <text>
+ *   - corrections the user gave      → <project> → user_corrected → <text>
+ *   - how the session ended          → <project> → session_outcome → <status: reason>
+ *
+ * Sources: decisions + outcome come from the server's own outcome analyzer
+ * (`GET /api/conversations/:id/outcome` — the same data recall_summary shows);
+ * corrections are extracted client-side from the synced transcript
+ * (`GET /api/conversations/:id?limit=0`) with the marker heuristics below.
+ * Writes go through `POST /api/kg/add` — the same endpoint recall_kg_add and
+ * recall_decision_record use — with `supersede: false` (learnings are
+ * multi-valued: a project accumulates many decisions) and `origin: 'asserted'`
+ * stamped server-side.
+ *
+ * Hook safety: this runs from a SessionEnd hook, so every "cannot proceed"
+ * condition (not logged in, server down, session not synced yet) is a dim
+ * note + a clean return — the CLI command exits 0. A hook must never break
+ * session end.
+ */
+export interface ConvoMessage {
+    line?: number;
+    role: string;
+    content: string;
+}
+export interface SessionOutcome {
+    status?: string;
+    reason?: string;
+    decisions?: Array<{
+        text: string;
+    }>;
+}
+export interface Learning {
+    kind: 'decision' | 'correction' | 'outcome';
+    subject: string;
+    predicate: string;
+    object: string;
+    confidence: number;
+}
+/** Minimal server access the runner needs — cli.ts passes its own helpers. */
+export interface EscalateDeps {
+    get<T>(path: string): Promise<T>;
+    getSoft<T>(path: string): Promise<{
+        status: number;
+        data: T | null;
+        message?: string;
+    }>;
+    post<T>(path: string, body: unknown): Promise<T>;
+    /** Informational output (goes to stdout via the CLI's own styling). */
+    log(line: string): void;
+}
+export interface EscalateOptions {
+    /** Explicit session id; wins over `latest`. */
+    sessionId?: string;
+    /** Resolve the most recent synced session of the cwd's project. */
+    latest?: boolean;
+    /** KG entity name for the facts. Default: basename of the session's project path, then of cwd. */
+    project?: string;
+    /** Extract and print without writing. */
+    dryRun?: boolean;
+    cwd: string;
+}
+/** Collapse whitespace and cut at a word boundary. */
+export declare function clip(text: string, max?: number): string;
+/**
+ * Corrections the user gave, in transcript order. The FIRST user message is
+ * skipped (the task statement cannot correct anything), noise carriers are
+ * skipped, and the result is deduplicated and capped.
+ */
+export declare function extractCorrections(messages: ConvoMessage[], cap?: number): string[];
+/**
+ * Assemble the full learning set for one session. Confidence 0.8 marks these
+ * as auto-extracted — below a deliberate recall_decision_record (1.0), above
+ * the KG's auto-mined guesses (0.5).
+ */
+export declare function extractLearnings(input: {
+    project: string;
+    messages: ConvoMessage[];
+    outcome: SessionOutcome | null;
+}): Learning[];
+export interface EscalateResult {
+    sessionId: string;
+    written: number;
+    skippedExisting: number;
+    dryRun: boolean;
+}
+/**
+ * Resolve → extract → dedup → write. Returns null when there is nothing to do
+ * (not synced, no learnings) — the caller exits 0 either way.
+ */
+export declare function runEscalate(deps: EscalateDeps, opts: EscalateOptions): Promise<EscalateResult | null>;
+//# sourceMappingURL=escalate.d.ts.map

package/dist/escalate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escalate.d.ts","sourceRoot":"","sources":["../src/escalate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAMH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,CAAC;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxF,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD,uEAAuE;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kGAAkG;IAClG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAyCD,sDAAsD;AACtD,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAM,GAAG,MAAM,CAMpD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,GAAG,SAAI,GAAG,MAAM,EAAE,CAsB9E;AAKD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;CAChC,GAAG,QAAQ,EAAE,CAqBb;AAgBD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAoF3G"}

package/dist/escalate.js

@@ -0,0 +1,219 @@
+/**
+ * `chat-recall escalate` — the WRITE half of the Context Engineering loop.
+ *
+ * The read half already exists: `chat-recall memory wake-up` (SessionStart
+ * hook) injects prior knowledge into a new session. This module closes the
+ * loop at the other end: at SessionEnd it extracts a finished session's
+ * learnings and asserts them into the temporal knowledge graph, so the NEXT
+ * wake-up already knows them. Three kinds of learning, three predicates:
+ *
+ *   - decisions the agent announced  → <project> → decided        → <text>
+ *   - corrections the user gave      → <project> → user_corrected → <text>
+ *   - how the session ended          → <project> → session_outcome → <status: reason>
+ *
+ * Sources: decisions + outcome come from the server's own outcome analyzer
+ * (`GET /api/conversations/:id/outcome` — the same data recall_summary shows);
+ * corrections are extracted client-side from the synced transcript
+ * (`GET /api/conversations/:id?limit=0`) with the marker heuristics below.
+ * Writes go through `POST /api/kg/add` — the same endpoint recall_kg_add and
+ * recall_decision_record use — with `supersede: false` (learnings are
+ * multi-valued: a project accumulates many decisions) and `origin: 'asserted'`
+ * stamped server-side.
+ *
+ * Hook safety: this runs from a SessionEnd hook, so every "cannot proceed"
+ * condition (not logged in, server down, session not synced yet) is a dim
+ * note + a clean return — the CLI command exits 0. A hook must never break
+ * session end.
+ */
+import { basename } from 'node:path';
+// ── Extraction heuristics ────────────────────────────────────────────────────
+/**
+ * A user message counts as a correction when it opens with a rejection /
+ * redirection marker, or contains an explicit "you got it wrong" phrase.
+ * Anchored-at-start patterns keep false positives low ("no" mid-sentence is
+ * usually not a correction; "No, use the pooler" is).
+ */
+const CORRECTION_STARTS = [
+    /^no+\b[,.! ]/i,
+    /^(nope|wrong|incorrect|not quite|not right)\b/i,
+    /^that'?s (wrong|not right|not it|not what)/i,
+    /^(don'?t|do not|stop|undo|revert)\b/i,
+    /^(actually|instead)[, ]/i,
+    /^(why did you|you didn'?t|you did not|you forgot|you missed|you broke)\b/i,
+];
+const CORRECTION_CONTAINS = [
+    /\bthat'?s not what i (asked|meant|wanted|said)\b/i,
+    /\byou (misunderstood|misread|ignored my|shouldn'?t have)\b/i,
+    /\bi (said|asked for|told you)\b.*\bnot\b/i,
+];
+/**
+ * Transcript noise that must never be mined for corrections: slash-command
+ * carriers, caveat banners, interrupt markers, and giant pastes.
+ */
+function isNoiseUserMessage(content) {
+    const c = content.trimStart();
+    return (c.length === 0 ||
+        c.length > 4000 ||
+        c.startsWith('Caveat:') ||
+        c.startsWith('[Request interrupted') ||
+        c.includes('<command-name>') ||
+        c.includes('<local-command') ||
+        c.startsWith('<system-reminder>'));
+}
+/** Collapse whitespace and cut at a word boundary. */
+export function clip(text, max = 200) {
+    const flat = text.replace(/\s+/g, ' ').trim();
+    if (flat.length <= max)
+        return flat;
+    const cut = flat.slice(0, max);
+    const lastSpace = cut.lastIndexOf(' ');
+    return (lastSpace > max * 0.6 ? cut.slice(0, lastSpace) : cut) + '…';
+}
+/**
+ * Corrections the user gave, in transcript order. The FIRST user message is
+ * skipped (the task statement cannot correct anything), noise carriers are
+ * skipped, and the result is deduplicated and capped.
+ */
+export function extractCorrections(messages, cap = 5) {
+    const out = [];
+    const seen = new Set();
+    let userTurns = 0;
+    for (const msg of messages) {
+        if (msg.role !== 'user')
+            continue;
+        userTurns++;
+        if (userTurns === 1)
+            continue; // the initial prompt is the task, not feedback
+        if (isNoiseUserMessage(msg.content))
+            continue;
+        const text = msg.content.trim();
+        const hit = CORRECTION_STARTS.some((re) => re.test(text)) ||
+            CORRECTION_CONTAINS.some((re) => re.test(text));
+        if (!hit)
+            continue;
+        const clipped = clip(text);
+        const key = clipped.toLowerCase();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(clipped);
+        if (out.length >= cap)
+            break;
+    }
+    return out;
+}
+/** Outcome statuses worth remembering. Transient/unknown states are not learnings. */
+const TERMINAL_STATUSES = new Set(['shipped', 'interrupted', 'abandoned']);
+/**
+ * Assemble the full learning set for one session. Confidence 0.8 marks these
+ * as auto-extracted — below a deliberate recall_decision_record (1.0), above
+ * the KG's auto-mined guesses (0.5).
+ */
+export function extractLearnings(input) {
+    const learnings = [];
+    const subject = input.project;
+    for (const d of (input.outcome?.decisions ?? []).slice(0, 8)) {
+        const text = clip(d.text);
+        if (!text)
+            continue;
+        learnings.push({ kind: 'decision', subject, predicate: 'decided', object: text, confidence: 0.8 });
+    }
+    for (const c of extractCorrections(input.messages)) {
+        learnings.push({ kind: 'correction', subject, predicate: 'user_corrected', object: c, confidence: 0.8 });
+    }
+    const status = input.outcome?.status;
+    if (status && TERMINAL_STATUSES.has(status)) {
+        const reason = input.outcome?.reason ? `: ${clip(input.outcome.reason, 140)}` : '';
+        learnings.push({ kind: 'outcome', subject, predicate: 'session_outcome', object: `${status}${reason}`, confidence: 0.8 });
+    }
+    return learnings;
+}
+/**
+ * Resolve → extract → dedup → write. Returns null when there is nothing to do
+ * (not synced, no learnings) — the caller exits 0 either way.
+ */
+export async function runEscalate(deps, opts) {
+    // 1. Resolve the session id (+ the project entity name).
+    let sessionId = opts.sessionId;
+    let projectName = opts.project;
+    if (!sessionId && opts.latest) {
+        // The recent endpoint filters by LOGICAL project id (git:… / ws:…), the
+        // same resolution every other cwd-scoped command uses.
+        const { resolveProjectId } = await import('@chat-recall/engine/core/project-resolver.js');
+        const resolved = resolveProjectId(opts.cwd);
+        const pid = resolved && resolved.source !== 'ignored' ? resolved.id : '';
+        const qs = new URLSearchParams({ limit: '1' });
+        if (pid)
+            qs.set('project', pid);
+        const recent = await deps.get(`/api/conversations/recent?${qs.toString()}`);
+        const row = recent.sessions?.[0];
+        if (!row) {
+            deps.log(`escalate: no synced session found for this project${pid ? ` (${pid})` : ''} — nothing to do.`);
+            return null;
+        }
+        sessionId = row.sessionId;
+        if (!projectName && row.projectPath)
+            projectName = basename(row.projectPath);
+    }
+    if (!sessionId)
+        throw new Error('pass a session id or --latest');
+    if (!projectName)
+        projectName = basename(opts.cwd);
+    // 2. Fetch the transcript + the server-side outcome analysis.
+    const convo = await deps.getSoft(`/api/conversations/${encodeURIComponent(sessionId)}?limit=0`);
+    if (!convo.data || convo.data.messages.length === 0) {
+        deps.log(`escalate: session ${sessionId} not synced yet${convo.message ? ` (${convo.message})` : ''} — nothing to do.`);
+        return null;
+    }
+    const outcomeSoft = await deps.getSoft(`/api/conversations/${encodeURIComponent(sessionId)}/outcome`);
+    const outcome = outcomeSoft.data;
+    // 3. Extract.
+    const learnings = extractLearnings({ project: projectName, messages: convo.data.messages, outcome });
+    if (learnings.length === 0) {
+        deps.log(`escalate: no learnings found in session ${sessionId.slice(0, 8)}… — nothing to escalate.`);
+        return null;
+    }
+    // 4. Dedup against facts already in the graph, so a re-run (or a hook firing
+    //    twice) does not double-write. The timeline lookup is best-effort: if it
+    //    fails we still write (supersede:false tolerates rare duplicates).
+    const existing = new Set();
+    try {
+        const tl = await deps.get(`/api/kg/timeline?entity=${encodeURIComponent(projectName)}&limit=500`);
+        for (const e of tl.entries ?? []) {
+            if (e.current)
+                existing.add(`${e.predicate}${e.object}`.toLowerCase());
+        }
+    }
+    catch { /* best-effort */ }
+    const fresh = learnings.filter((l) => !existing.has(`${l.predicate}${l.object}`.toLowerCase()));
+    const skippedExisting = learnings.length - fresh.length;
+    // 5. Print (and in dry-run: stop here).
+    for (const l of fresh) {
+        deps.log(`  [${l.kind}] ${l.subject} → ${l.predicate} → ${l.object}`);
+    }
+    if (skippedExisting > 0)
+        deps.log(`  (${skippedExisting} already in the knowledge graph — skipped)`);
+    if (opts.dryRun) {
+        deps.log(`escalate (dry-run): ${fresh.length} learning(s) extracted from ${sessionId.slice(0, 8)}… — nothing written.`);
+        return { sessionId, written: 0, skippedExisting, dryRun: true };
+    }
+    // 6. Write each fresh learning as an asserted, session-attributed triple.
+    let written = 0;
+    for (const l of fresh) {
+        await deps.post('/api/kg/add', {
+            subject: l.subject,
+            predicate: l.predicate,
+            object: l.object,
+            confidence: l.confidence,
+            source_session: sessionId,
+            // Learnings are multi-valued: a project accumulates decisions and
+            // corrections. Without this, each write would supersede the previous
+            // fact with the same (subject, predicate).
+            supersede: false,
+        });
+        written++;
+    }
+    deps.log(`escalate: wrote ${written} learning(s) from session ${sessionId.slice(0, 8)}… to the knowledge graph.`);
+    return { sessionId, written, skippedExisting, dryRun: false };
+}
+//# sourceMappingURL=escalate.js.map

package/dist/escalate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"escalate.js","sourceRoot":"","sources":["../src/escalate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AA6CrC,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG;IACxB,eAAe;IACf,gDAAgD;IAChD,6CAA6C;IAC7C,sCAAsC;IACtC,0BAA0B;IAC1B,2EAA2E;CAC5E,CAAC;AACF,MAAM,mBAAmB,GAAG;IAC1B,mDAAmD;IACnD,6DAA6D;IAC7D,2CAA2C;CAC5C,CAAC;AAEF;;;GAGG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAC9B,OAAO,CACL,CAAC,CAAC,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,MAAM,GAAG,IAAI;QACf,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;QACvB,CAAC,CAAC,UAAU,CAAC,sBAAsB,CAAC;QACpC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC5B,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC5B,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,GAAG,GAAG,GAAG;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,CAAC,SAAS,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAwB,EAAE,GAAG,GAAG,CAAC;IAClE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QAClC,SAAS,EAAE,CAAC;QACZ,IAAI,SAAS,KAAK,CAAC;YAAE,SAAS,CAAC,+CAA+C;QAC9E,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GACP,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7C,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;YAAE,MAAM;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAE3E;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAIhC;IACC,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE9B,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;IACrC,IAAI,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAuBD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAkB,EAAE,IAAqB;IACzE,yDAAyD;IACzD,IAAI,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAC/B,IAAI,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;IAE/B,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,8CAA8C,CAAC,CAAC;QAC1F,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/C,IAAI,GAAG;YAAE,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAiB,6BAA6B,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5F,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,GAAG,CAAC,qDAAqD,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;YACzG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAC1B,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW;YAAE,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACjE,IAAI,CAAC,WAAW;QAAE,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEnD,8DAA8D;IAC9D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAgB,sBAAsB,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/G,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,qBAAqB,SAAS,kBAAkB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACxH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAiB,sBAAsB,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACtH,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC;IAEjC,cAAc;IACd,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACrG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,2CAA2C,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,0BAA0B,CAAC,CAAC;QACrG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAmB,2BAA2B,kBAAkB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACpH,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,OAAO;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE7B,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjG,MAAM,eAAe,GAAG,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAExD,wCAAwC;IACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,eAAe,GAAG,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,MAAM,eAAe,4CAA4C,CAAC,CAAC;IAErG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,GAAG,CAAC,uBAAuB,KAAK,CAAC,MAAM,+BAA+B,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,sBAAsB,CAAC,CAAC;QACxH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,0EAA0E;IAC1E,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,CAAC,IAAI,CAAiB,aAAa,EAAE;YAC7C,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,cAAc,EAAE,SAAS;YACzB,kEAAkE;YAClE,qEAAqE;YACrE,2CAA2C;YAC3C,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,mBAAmB,OAAO,6BAA6B,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,2BAA2B,CAAC,CAAC;IAClH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAChE,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,14 @@
+/** This CLI's own version — the one the server compares against. */
+export declare function cliVersion(): string;
+/**
+ * Identity headers on every request this CLI makes to its server.
+ *
+ * The server stamps them onto the device row (see the auth middleware's device
+ * heartbeat), which is what makes "this machine last synced 6 days ago and runs
+ * 0.3.1" answerable at all. Before this the server knew a device token existed
+ * and nothing else — so a machine on a CLI too old to self-update stayed stale
+ * indefinitely and no UI could say so. Two short, non-identifying values.
+ */
+export declare function clientHeaders(): Record<string, string>;
+export declare function fetchWithTimeout(url: string, init?: RequestInit, ms?: number): Promise<Response>;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAwBA,oEAAoE;AACpE,wBAAgB,UAAU,IAAI,MAAM,CAAwB;AAE5D;;;;;;;;GAQG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKtD;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,WAAgB,EACtB,EAAE,SAAS,GACV,OAAO,CAAC,QAAQ,CAAC,CAMnB"}

package/dist/http.js

@@ -0,0 +1,49 @@
+/**
+ * fetch() with a hard timeout.
+ *
+ * Node's global `fetch` (undici) has NO caller-facing default timeout — a
+ * connected-but-silent peer (half-open TCP, a hung reverse proxy, a wedged
+ * server) makes the promise hang for undici's internal ~300s, or effectively
+ * forever from the caller's view. The collector's upload path already guards
+ * against this with an AbortController; every OTHER request the daemon makes
+ * (capabilities handshake, tenant-config pulls, intent drain, code-index push,
+ * auto-update checks) must too — otherwise ONE stalled endpoint wedges the whole
+ * serialized sync tick. This is the single helper they all use.
+ */
+import { readFileSync } from 'node:fs';
+let CLI_VERSION = '0.0.0';
+try {
+    CLI_VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf-8')).version || CLI_VERSION;
+}
+catch {
+    try {
+        if (typeof __CLI_VERSION__ === 'string')
+            CLI_VERSION = __CLI_VERSION__;
+    }
+    catch { /* keep default */ }
+}
+/** This CLI's own version — the one the server compares against. */
+export function cliVersion() { return CLI_VERSION; }
+/**
+ * Identity headers on every request this CLI makes to its server.
+ *
+ * The server stamps them onto the device row (see the auth middleware's device
+ * heartbeat), which is what makes "this machine last synced 6 days ago and runs
+ * 0.3.1" answerable at all. Before this the server knew a device token existed
+ * and nothing else — so a machine on a CLI too old to self-update stayed stale
+ * indefinitely and no UI could say so. Two short, non-identifying values.
+ */
+export function clientHeaders() {
+    return {
+        'x-chat-recall-cli': CLI_VERSION,
+        'x-chat-recall-os': `${process.platform}-${process.arch}`,
+    };
+}
+export function fetchWithTimeout(url, init = {}, ms = 15_000) {
+    // Headers first so an explicit caller value always wins.
+    const headers = new Headers(clientHeaders());
+    new Headers(init.headers ?? {}).forEach((v, k) => headers.set(k, v));
+    // Respect an explicit caller signal if given; otherwise arm a timeout.
+    return fetch(url, { ...init, headers, signal: init.signal ?? AbortSignal.timeout(ms) });
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAKvC,IAAI,WAAW,GAAG,OAAO,CAAC;AAC1B,IAAI,CAAC;IACH,WAAW,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAA0B,CAAC,OAAO,IAAI,WAAW,CAAC;AAChJ,CAAC;AAAC,MAAM,CAAC;IACP,IAAI,CAAC;QAAC,IAAI,OAAO,eAAe,KAAK,QAAQ;YAAE,WAAW,GAAG,eAAe,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAC9G,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,UAAU,KAAa,OAAO,WAAW,CAAC,CAAC,CAAC;AAE5D;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,mBAAmB,EAAE,WAAW;QAChC,kBAAkB,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,OAAoB,EAAE,EACtB,EAAE,GAAG,MAAM;IAEX,yDAAyD;IACzD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,uEAAuE;IACvE,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC"}

package/dist/install-skills.d.ts

@@ -0,0 +1,51 @@
+/** Bundled skills source dir: <package-root>/skills (dist/install-skills.js → ..). */
+export declare function skillsSourceDir(): string;
+/** The skill directory names we ship (any dir under skills/ containing SKILL.md). */
+export declare function bundledSkillNames(): string[];
+export interface SkillTarget {
+    id: string;
+    label: string;
+    dir: string;
+    available: boolean;
+}
+/** Per-tool skills dir. agy keeps its own (~/.gemini/antigravity-cli/skills) AND
+ *  we also cover ~/.agents/skills (tool-neutral) so any future consumer sees them. */
+export declare function skillTargets(): SkillTarget[];
+export interface InstallResult {
+    version: string;
+    perTarget: Array<{
+        id: string;
+        label: string;
+        dir: string;
+        installed: string[];
+        skippedUserOwned: string[];
+        available: boolean;
+    }>;
+}
+/** Install (or update) the bundled skills into every target tool.
+ *  @param onlyAvailable install only to tools detected on this machine (default true). */
+export declare function installSkills(opts?: {
+    onlyAvailable?: boolean;
+}): InstallResult;
+export interface UninstallResult {
+    perTarget: Array<{
+        id: string;
+        label: string;
+        removed: string[];
+    }>;
+}
+/** Remove only chat-recall-managed skills (identified by the marker). */
+export declare function uninstallSkills(): UninstallResult;
+/** True if any AVAILABLE tool is missing a bundled skill or has an out-of-date
+ *  version. The MCP boot uses this to refresh only when needed (cheap: stat a
+ *  marker per skill), so it doesn't churn the disk on every tool launch. */
+export declare function skillsNeedRefresh(): boolean;
+/** For `doctor`: which tools have the current skill version installed. */
+export declare function skillStatus(): Array<{
+    id: string;
+    label: string;
+    available: boolean;
+    installed: number;
+    version: string | null;
+}>;
+//# sourceMappingURL=install-skills.d.ts.map

package/dist/install-skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-skills.d.ts","sourceRoot":"","sources":["../src/install-skills.ts"],"names":[],"mappings":"AA6BA,sFAAsF;AACtF,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAQD,qFAAqF;AACrF,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAO5C;AAED,MAAM,WAAW,WAAW;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;CAAE;AA+C5F;sFACsF;AACtF,wBAAgB,YAAY,IAAI,WAAW,EAAE,CAa5C;AAOD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACnI;AAED;0FAC0F;AAC1F,wBAAgB,aAAa,CAAC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,aAAa,CAwBnF;AAED,MAAM,WAAW,eAAe;IAAG,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAAE;AAExG,yEAAyE;AACzE,wBAAgB,eAAe,IAAI,eAAe,CAkBjD;AAED;;4EAE4E;AAC5E,wBAAgB,iBAAiB,IAAI,OAAO,CAa3C;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,IAAI,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAcjI"}