chat-recall 0.5.16 → 0.5.18

package/dist/cli.js

@@ -4549,6 +4549,37 @@ var init_paths = __esm({
   }
 });
 
+// ../engine/dist/core/project-path-match.js
+function canonicalProjectPath(p) {
+  return (p || "").trim().replace(/\\/g, "/").replace(/[-_]/g, "/").replace(/\/{2,}/g, "/").replace(/\/+$/, "").toLowerCase();
+}
+function projectPathIncludes(candidate, rule) {
+  if (!candidate || !rule)
+    return false;
+  if (candidate.includes(rule))
+    return true;
+  const c = canonicalProjectPath(candidate);
+  const r = canonicalProjectPath(rule);
+  return !!r && c.includes(r);
+}
+function projectPathAtOrUnder(candidate, rule) {
+  if (!candidate || !rule)
+    return false;
+  const strip = (s) => s.replace(/\/+$/, "");
+  const cRaw = strip(candidate);
+  const rRaw = strip(rule);
+  if (cRaw === rRaw || cRaw.startsWith(`${rRaw}/`))
+    return true;
+  const c = canonicalProjectPath(candidate);
+  const r = canonicalProjectPath(rule);
+  return !!r && (c === r || c.startsWith(`${r}/`));
+}
+var init_project_path_match = __esm({
+  "../engine/dist/core/project-path-match.js"() {
+    "use strict";
+  }
+});
+
 // ../engine/dist/core/settings.js
 var settings_exports = {};
 __export(settings_exports, {
@@ -4602,7 +4633,7 @@ function isProjectSyncable(projectId, projectPath, cfg) {
   if (projectId && cfg.syncOnly.has(projectId))
     return true;
   for (const x of cfg.syncOnly)
-    if (x && projectPath.includes(x))
+    if (projectPathIncludes(projectPath, x))
       return true;
   return false;
 }
@@ -5015,6 +5046,7 @@ var CLI_DETECTION_ORDER, SCHEMA_VERSION, PERSONAL_DIR_NAMES, PERSONAL_DIR_PATTER
 var init_settings = __esm({
   "../engine/dist/core/settings.js"() {
     "use strict";
+    init_project_path_match();
     init_paths();
     CLI_DETECTION_ORDER = [
       { preset: "gemini", bin: "gemini", cmd: 'gemini -p " "' },
@@ -15386,7 +15418,7 @@ function matchesProjectList(projectPath, patterns) {
       const tail = projectPath.slice(parent.length + 1);
       if (projectPath.startsWith(parent + "/") && !tail.includes("/"))
         return true;
-    } else if (projectPath === p || projectPath.startsWith(p + "/")) {
+    } else if (projectPathAtOrUnder(projectPath, p)) {
       return true;
     }
   }
@@ -15412,6 +15444,7 @@ var cache2, TOOLS;
 var init_source_policy = __esm({
   "../engine/dist/core/source-policy.js"() {
     "use strict";
+    init_project_path_match();
     init_settings();
     cache2 = null;
     TOOLS = ["claude", "gemini", "opencode", "codex", "agy", "cursor"];
@@ -19694,7 +19727,7 @@ var init_http = __esm({
       CLI_VERSION = JSON.parse(readFileSync33(new URL("../package.json", import.meta.url), "utf-8")).version || CLI_VERSION;
     } catch {
       try {
-        if (true) CLI_VERSION = "0.5.16";
+        if (true) CLI_VERSION = "0.5.18";
       } catch {
       }
     }
@@ -20191,8 +20224,8 @@ async function flush() {
 }
 function hashHost() {
   try {
-    const { createHash: createHash19 } = __require("node:crypto");
-    return createHash19("sha256").update(hostname()).digest("hex").slice(0, 12);
+    const { createHash: createHash20 } = __require("node:crypto");
+    return createHash20("sha256").update(hostname()).digest("hex").slice(0, 12);
   } catch {
     return "";
   }
@@ -20206,7 +20239,7 @@ var init_telemetry = __esm({
     init_sync_client();
     cliVersion2 = () => {
       try {
-        return true ? "0.5.16" : "dev";
+        return true ? "0.5.18" : "dev";
       } catch {
         return "dev";
       }
@@ -20500,6 +20533,7 @@ var sync_client_exports = {};
 __export(sync_client_exports, {
   BATCH_SCAN_MAX_BYTES: () => BATCH_SCAN_MAX_BYTES,
   FULL_BUILD_MAX_BYTES: () => FULL_BUILD_MAX_BYTES,
+  _fetchTenantSyncConfigForTests: () => _fetchTenantSyncConfigForTests,
   _resetCapsCacheForTests: () => _resetCapsCacheForTests,
   _resetTenantSecurityConfigCache: () => _resetTenantSecurityConfigCache,
   _resetTenantSyncConfigCache: () => _resetTenantSyncConfigCache,
@@ -20622,6 +20656,25 @@ async function fetchTenantSecurityConfig(cred) {
 function _resetTenantSecurityConfigCache() {
   _securityConfigCache.clear();
 }
+function syncConfigCachePath() {
+  return join44(getDataDir(), "sync-config-cache.json");
+}
+function readPersistedSyncConfigs() {
+  try {
+    return JSON.parse(readFileSync36(syncConfigCachePath(), "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function persistSyncConfig(base2, config2) {
+  try {
+    const all = readPersistedSyncConfigs();
+    all[base2] = { fetchedAt: Date.now(), config: config2 };
+    mkdirSync9(dirname18(syncConfigCachePath()), { recursive: true });
+    writeFileSync9(syncConfigCachePath(), JSON.stringify(all, null, 2));
+  } catch {
+  }
+}
 async function fetchTenantSyncConfig(cred) {
   const base2 = cred.serverUrl.replace(/\/+$/, "");
   const cached = _syncConfigCache.get(base2);
@@ -20641,7 +20694,11 @@ async function fetchTenantSyncConfig(cred) {
     } catch {
     }
     const res = await fetchWithTimeout(`${base2}/api/sync-config`, { headers });
-    if (!res.ok) return { excludeTools: [], excludeProjects: [], excludeSources: [], approveSources: [] };
+    if (res.status === 404) {
+      _syncConfigCache.set(base2, { fetchedAt: Date.now(), config: EMPTY_SYNC_CONFIG });
+      return EMPTY_SYNC_CONFIG;
+    }
+    if (!res.ok) return lastKnownSyncConfig(base2, `HTTP ${res.status}`);
     const body = await res.json().catch(() => ({}));
     const config2 = {
       excludeTools: Array.isArray(body.excludeTools) ? body.excludeTools.filter((t) => typeof t === "string") : [],
@@ -20679,10 +20736,21 @@ async function fetchTenantSyncConfig(cred) {
     } catch {
     }
     _syncConfigCache.set(base2, { fetchedAt: Date.now(), config: config2 });
+    persistSyncConfig(base2, config2);
     return config2;
-  } catch {
-    return { excludeTools: [], excludeProjects: [], excludeSources: [], approveSources: [] };
+  } catch (err) {
+    return lastKnownSyncConfig(base2, err instanceof Error ? err.message : "request failed");
+  }
+}
+function lastKnownSyncConfig(base2, reason) {
+  const remembered = _syncConfigCache.get(base2) ?? readPersistedSyncConfigs()[base2];
+  if (remembered) {
+    console.error(`[sync] could not read server-side sync rules (${reason}) \u2014 applying the last known set from ${new Date(remembered.fetchedAt).toISOString()}`);
+    return remembered.config;
   }
+  throw new Error(
+    `Cannot read the server-side sync rules from ${base2} (${reason}), and this machine has never successfully read them. Refusing to sync: uploading without knowing your exclusions could ship a project you told the dashboard to hold back. Fix the server or retry.`
+  );
 }
 function deviceLabel() {
   try {
@@ -20973,7 +21041,7 @@ async function syncToTargetInScope(cred, opts = {}) {
   };
   const cleartext = opts.cleartextPaths ?? sync?.pathsCleartext === true;
   const mapPath = (p) => cleartext ? p : hashPath(p);
-  const excluded = (projectPath) => excludeProjects.some((x) => x && projectPath.includes(x));
+  const excluded = (projectPath) => excludeProjects.some((x) => projectPathIncludes(projectPath, x));
   const syncOnly2 = /* @__PURE__ */ new Set([...sync?.syncOnlyProjects ?? [], ...serverCfg.syncOnlyProjects ?? []]);
   const includedProject = (projectPath) => {
     if ((sync?.syncMode ?? "all") !== "only") return true;
@@ -21933,7 +22001,7 @@ async function syncIncremental(opts = {}) {
     lock.release();
   }
 }
-var ownVersion, walkProgressForUpload, lastServerPackSpec, credPath, _securityConfigCache, SECURITY_CONFIG_TTL_MS, _syncConfigCache, hashPath, MAX_DERIVED_ROW_BYTES, isLocalHost, CAPS_TTL_MS, capsOk, advertisedIngestConc, advertisedGzipBody, FULL_BUILD_MAX_BYTES, FULL_BUILD_TAIL_BYTES, BATCH_SCAN_MAX_BYTES;
+var ownVersion, walkProgressForUpload, lastServerPackSpec, credPath, _securityConfigCache, SECURITY_CONFIG_TTL_MS, _syncConfigCache, EMPTY_SYNC_CONFIG, _fetchTenantSyncConfigForTests, hashPath, MAX_DERIVED_ROW_BYTES, isLocalHost, CAPS_TTL_MS, capsOk, advertisedIngestConc, advertisedGzipBody, FULL_BUILD_MAX_BYTES, FULL_BUILD_TAIL_BYTES, BATCH_SCAN_MAX_BYTES;
 var init_sync_client = __esm({
   "src/sync-client.ts"() {
     "use strict";
@@ -21955,6 +22023,7 @@ var init_sync_client = __esm({
     init_tool_backend();
     init_session();
     init_project_resolver();
+    init_project_path_match();
     init_entity_extractor();
     init_all_sources();
     init_sync_ledger();
@@ -21978,7 +22047,7 @@ var init_sync_client = __esm({
       ownVersion = JSON.parse(readFileSync36(join44(dir, "../package.json"), "utf-8")).version || ownVersion;
     } catch {
       try {
-        if (true) ownVersion = "0.5.16";
+        if (true) ownVersion = "0.5.18";
       } catch {
       }
     }
@@ -21988,6 +22057,8 @@ var init_sync_client = __esm({
     _securityConfigCache = /* @__PURE__ */ new Map();
     SECURITY_CONFIG_TTL_MS = 5 * 60 * 1e3;
     _syncConfigCache = /* @__PURE__ */ new Map();
+    EMPTY_SYNC_CONFIG = { excludeTools: [], excludeProjects: [], excludeSources: [], approveSources: [] };
+    _fetchTenantSyncConfigForTests = fetchTenantSyncConfig;
     hashPath = (p) => p ? "p_" + createHash13("sha256").update(p).digest("hex").slice(0, 12) : "";
     MAX_DERIVED_ROW_BYTES = 2 * 1024 * 1024;
     isLocalHost = isPrivateHost;
@@ -22147,6 +22218,75 @@ var init_which = __esm({
   }
 });
 
+// ../engine/dist/core/sync-scope.js
+var sync_scope_exports = {};
+__export(sync_scope_exports, {
+  summariseSyncScope: () => summariseSyncScope
+});
+function summariseSyncScope(sinceMs = 0) {
+  const sync = loadSettings().sync;
+  const excludeProjects = sync?.excludeProjects ?? [];
+  const excludeTools = new Set(sync?.excludeTools ?? []);
+  const allowlistMode = (sync?.syncMode ?? "all") === "only";
+  const syncOnly2 = new Set(sync?.syncOnlyProjects ?? []);
+  const perProject = /* @__PURE__ */ new Map();
+  const perTool = /* @__PURE__ */ new Map();
+  for (const backend of listAvailableBackends()) {
+    let refs = [];
+    try {
+      refs = backend.listSessions({ sinceMs });
+    } catch {
+      continue;
+    }
+    for (const ref of refs) {
+      const projectPath = ref.projectPath || "";
+      const toolId = ref.toolId || backend.id;
+      let heldBackBy = null;
+      if (excludeTools.has(toolId))
+        heldBackBy = "excluded-tool";
+      else if (excludeProjects.some((x) => projectPathIncludes(projectPath, x)))
+        heldBackBy = "excluded-project";
+      else if (!isProjectSyncable(idOf(projectPath), projectPath, { syncMode: sync?.syncMode, syncOnly: syncOnly2 })) {
+        heldBackBy = "not-in-allowlist";
+      }
+      const id = idOf(projectPath);
+      const key2 = `${id}\0${projectPath}`;
+      const row = perProject.get(key2) ?? { id, projectPath, sessions: 0, heldBackBy };
+      row.sessions++;
+      row.heldBackBy = row.heldBackBy ?? heldBackBy;
+      perProject.set(key2, row);
+      if (!heldBackBy)
+        perTool.set(toolId, (perTool.get(toolId) ?? 0) + 1);
+    }
+  }
+  const projects = [...perProject.values()].sort((a, b) => b.sessions - a.sessions);
+  const noPathSessions = projects.filter((p) => !p.projectPath && !p.heldBackBy).reduce((n, p) => n + p.sessions, 0);
+  return {
+    included: projects.filter((p) => !p.heldBackBy).reduce((n, p) => n + p.sessions, 0),
+    heldBack: projects.filter((p) => p.heldBackBy).reduce((n, p) => n + p.sessions, 0),
+    byTool: [...perTool.entries()].map(([tool, sessions]) => ({ tool, sessions })).sort((a, b) => b.sessions - a.sessions),
+    projects,
+    allowlistMode,
+    noPathSessions
+  };
+}
+function idOf(projectPath) {
+  if (!projectPath)
+    return "";
+  const r = resolveProjectId(projectPath);
+  return r.source === "ignored" ? "" : r.id;
+}
+var init_sync_scope = __esm({
+  "../engine/dist/core/sync-scope.js"() {
+    "use strict";
+    init_tool_backend();
+    init_backends();
+    init_project_resolver();
+    init_settings();
+    init_project_path_match();
+  }
+});
+
 // ../engine/dist/core/mcp-clients.js
 var mcp_clients_exports = {};
 __export(mcp_clients_exports, {
@@ -24231,6 +24371,49 @@ var init_verify_repair = __esm({
   }
 });
 
+// ../engine/dist/types/code-intel.js
+import { createHash as createHash17 } from "crypto";
+function shortHash(s) {
+  return createHash17("sha256").update(s).digest("hex").slice(0, 16);
+}
+function snippetKey(snippet) {
+  return (snippet ?? "").replace(/\s+/g, " ").trim().slice(0, 200);
+}
+function codeFindingIds(projectId, findings) {
+  const groups = /* @__PURE__ */ new Map();
+  findings.forEach((f, i) => {
+    const key2 = [f.category, f.file, f.rule, identityTitle(f.title ?? ""), snippetKey(f.snippet)].join("|");
+    const g = groups.get(key2);
+    if (g)
+      g.push(i);
+    else
+      groups.set(key2, [i]);
+  });
+  const lineOf = (i) => findings[i].line ?? -1;
+  const ids = new Array(findings.length);
+  for (const [key2, idxs] of groups) {
+    idxs.sort((a, b) => lineOf(a) - lineOf(b));
+    let ordinal = -1;
+    let prevLine = Number.NaN;
+    for (const idx of idxs) {
+      if (lineOf(idx) !== prevLine) {
+        ordinal++;
+        prevLine = lineOf(idx);
+      }
+      ids[idx] = "cf_" + shortHash([projectId, key2, ordinal].join("|"));
+    }
+  }
+  return ids;
+}
+function identityTitle(title) {
+  return title.replace(/\d+/g, "#");
+}
+var init_code_intel = __esm({
+  "../engine/dist/types/code-intel.js"() {
+    "use strict";
+  }
+});
+
 // ../engine/dist/core/code/prompts.js
 function secFix(rule) {
   return SEC_FIX[rule] ?? "Review and remediate.";
@@ -24578,6 +24761,11 @@ async function collectCode(opts) {
     }
   }
   const findings = [];
+  const coveredBySecurityRule = /* @__PURE__ */ new Map();
+  const coveredByCloneGroup = /* @__PURE__ */ new Map();
+  const coveredByDupCluster = /* @__PURE__ */ new Map();
+  const coveredByGodModule = /* @__PURE__ */ new Map();
+  const coveredByCycle = /* @__PURE__ */ new Map();
   const sevFromLiteral = (cat) => cat === "secret_suspect" ? "medium" : cat === "todo_marker" ? "info" : "low";
   const securityRows = [];
   const heuristicSec = [];
@@ -24627,7 +24815,7 @@ async function collectCode(opts) {
     log6(`security: repo secret scan unavailable (${e instanceof Error ? e.message : e}) \u2014 install gitleaks/trufflehog for secret coverage`);
   }
   for (const f of [...securityRows, ...heuristicSec]) {
-    findings.push({
+    const finding = {
       category: "security",
       severity: f.severity,
       file: f.file,
@@ -24637,7 +24825,13 @@ async function collectCode(opts) {
       snippet: f.snippet,
       why: FINDING_WHY.security,
       agentPrompt: securityPrompt(f.rule, f.severity, f.file, f.line)
-    });
+    };
+    findings.push(finding);
+    const byRuleList = coveredBySecurityRule.get(f.rule);
+    if (byRuleList)
+      byRuleList.push(finding);
+    else
+      coveredBySecurityRule.set(f.rule, [finding]);
   }
   for (const f of (lit?.findings ?? []).slice(0, 150)) {
     const file = rel(f.file);
@@ -24659,7 +24853,7 @@ async function collectCode(opts) {
     const names = [...new Set(fns.map((x) => x.name))];
     const fileList = fns.map((x) => rel(x.file)).slice(0, 6);
     const heavy = (g.lines ?? 0) * (g.count ?? 0) >= 150;
-    findings.push({
+    const finding = {
       category: "clone",
       severity: heavy ? "high" : "medium",
       file: fileList[0] ?? "",
@@ -24669,10 +24863,12 @@ async function collectCode(opts) {
       snippet: `${g.lines} lines, ${g.count} copies`,
       why: FINDING_WHY.clone,
       agentPrompt: clonePrompt(names, g.lines ?? 0, g.count ?? 0, fileList)
-    });
+    };
+    findings.push(finding);
+    coveredByCloneGroup.set(g, finding);
   }
   for (const c of (dup?.clusters ?? []).slice(0, 40)) {
-    findings.push({
+    const finding = {
       category: "duplication",
       severity: "low",
       file: c.name ?? "",
@@ -24682,7 +24878,9 @@ async function collectCode(opts) {
       snippet: `${c.kind}, ${c.count} files`,
       why: FINDING_WHY.duplication,
       agentPrompt: duplicationPrompt(c.name, c.kind ?? "", c.count ?? 0)
-    });
+    };
+    findings.push(finding);
+    coveredByDupCluster.set(c, finding);
   }
   for (const s of (dead?.symbols ?? []).slice(0, 120)) {
     const file = rel(s.file);
@@ -24700,7 +24898,7 @@ async function collectCode(opts) {
   }
   for (const m of (coup?.god_modules ?? []).slice(0, 15)) {
     const file = rel(m.file);
-    findings.push({
+    const finding = {
       category: "coupling",
       severity: "medium",
       file,
@@ -24710,11 +24908,13 @@ async function collectCode(opts) {
       snippet: `fan-in ${m.fan_in}, fan-out ${m.fan_out}`,
       why: FINDING_WHY.coupling,
       agentPrompt: couplingPrompt(file, m.fan_in ?? 0, m.fan_out ?? 0, Math.round((m.instability ?? 0) * 100) / 100)
-    });
+    };
+    findings.push(finding);
+    coveredByGodModule.set(file, finding);
   }
   for (const c of (cyc?.cycles ?? []).slice(0, 25)) {
     const chain = (c.files ?? []).map(rel);
-    findings.push({
+    const finding = {
       category: "cycle",
       severity: "medium",
       file: chain[0] ?? "",
@@ -24724,7 +24924,9 @@ async function collectCode(opts) {
       snippet: chain.slice(0, 4).join(" \u2192 "),
       why: FINDING_WHY.cycle,
       agentPrompt: cyclePrompt(chain.slice(0, 6))
-    });
+    };
+    findings.push(finding);
+    coveredByCycle.set(c, finding);
   }
   for (const f of (unwrap?.findings ?? []).slice(0, 150)) {
     const file = rel(f.file);
@@ -24953,7 +25155,13 @@ async function collectCode(opts) {
   }
   log6("synthesising action plan \u2026");
   const actions = [];
-  const pushAction = (pri, category, title, fix, loc, agentPrompt) => actions.push({ pri, category, title, fix, loc, agentPrompt });
+  const findingIdOf = /* @__PURE__ */ new Map();
+  {
+    const ids = codeFindingIds(projectId, findings);
+    findings.forEach((f, i) => findingIdOf.set(f, ids[i]));
+  }
+  const coversOf = (fs) => [...new Set(fs.map((f) => f ? findingIdOf.get(f) : void 0).filter((id) => !!id))];
+  const pushAction = (pri, category, title, fix, loc, agentPrompt, covers = []) => actions.push({ pri, category, title, fix, loc, agentPrompt, covers });
   const byRule = /* @__PURE__ */ new Map();
   for (const f of securityRows) {
     if (isTestOrExampleFile(f.file))
@@ -24965,7 +25173,17 @@ async function collectCode(opts) {
   for (const [rule, hits] of byRule) {
     const sev = hits.some((h) => h.sev === "critical") ? "critical" : hits.some((h) => h.sev === "high") ? "high" : "medium";
     const pri = sev === "critical" ? 0 : sev === "high" ? 1 : 2;
-    pushAction(pri, "security", `${rule} \u2014 ${hits.length} occurrence(s)`, secFix(rule), hits.slice(0, 4).map((h) => ({ file: h.file, line: h.line })), securityPrompt(rule, sev, hits[0].file, hits[0].line));
+    pushAction(
+      pri,
+      "security",
+      `${rule} \u2014 ${hits.length} occurrence(s)`,
+      secFix(rule),
+      hits.slice(0, 4).map((h) => ({ file: h.file, line: h.line })),
+      securityPrompt(rule, sev, hits[0].file, hits[0].line),
+      // Every security finding on this rule. The card IS the roll-up, so the
+      // members must not each file one of their own.
+      coversOf(coveredBySecurityRule.get(rule) ?? [])
+    );
   }
   for (const g of clones?.groups ?? []) {
     if ((g.count ?? 0) >= 3 || (g.lines ?? 0) >= 12) {
@@ -24974,7 +25192,7 @@ async function collectCode(opts) {
         continue;
       const names = [...new Set(fns.map((x) => x.name))];
       const locs = fns.map((x) => rel(x.file)).slice(0, 5);
-      pushAction((g.lines ?? 0) * (g.count ?? 0) >= 150 ? 1 : 2, "duplication", `${names.join(", ")} copy-pasted ${g.count}\xD7 (${g.lines} lines each)`, "Extract one shared implementation and replace the copies.", locs.map((f) => ({ file: f })), clonePrompt(names, g.lines ?? 0, g.count ?? 0, locs));
+      pushAction((g.lines ?? 0) * (g.count ?? 0) >= 150 ? 1 : 2, "duplication", `${names.join(", ")} copy-pasted ${g.count}\xD7 (${g.lines} lines each)`, "Extract one shared implementation and replace the copies.", locs.map((f) => ({ file: f })), clonePrompt(names, g.lines ?? 0, g.count ?? 0, locs), coversOf([coveredByCloneGroup.get(g)]));
     }
   }
   for (const c of (dup?.clusters ?? []).slice(0, 12)) {
@@ -24986,19 +25204,19 @@ async function collectCode(opts) {
       continue;
     if (kind === "type_alias" || kind === "interface" || kind === "enum" || kind === "type")
       continue;
-    pushAction(2, "reuse", `${nm} (${c.kind}) reimplemented in ${c.count} files`, "Consolidate into a single shared utility/module.", [], duplicationPrompt(nm, c.kind ?? "", c.count));
+    pushAction(2, "reuse", `${nm} (${c.kind}) reimplemented in ${c.count} files`, "Consolidate into a single shared utility/module.", [], duplicationPrompt(nm, c.kind ?? "", c.count), coversOf([coveredByDupCluster.get(c)]));
   }
   for (const m of (coup?.god_modules ?? []).slice(0, 5)) {
     const file = rel(m.file);
     if (isGenerated(file))
       continue;
-    pushAction(2, "modularity", `God module ${file} (fan-in ${m.fan_in}, fan-out ${m.fan_out})`, "Split into cohesive sub-modules; introduce interfaces to cut fan-out.", [{ file }], couplingPrompt(file, m.fan_in ?? 0, m.fan_out ?? 0, Math.round((m.instability ?? 0) * 100) / 100));
+    pushAction(2, "modularity", `God module ${file} (fan-in ${m.fan_in}, fan-out ${m.fan_out})`, "Split into cohesive sub-modules; introduce interfaces to cut fan-out.", [{ file }], couplingPrompt(file, m.fan_in ?? 0, m.fan_out ?? 0, Math.round((m.instability ?? 0) * 100) / 100), coversOf([coveredByGodModule.get(file)]));
   }
   for (const c of (cyc?.cycles ?? []).slice(0, 5)) {
     const chain = (c.files ?? []).map(rel).filter((f) => !isGenerated(f));
     if (chain.length < 2)
       continue;
-    pushAction(2, "architecture", `Circular dependency (${chain.length} files)`, "Break the cycle: extract the shared type/interface into a separate module.", chain.slice(0, 4).map((f) => ({ file: f })), cyclePrompt(chain.slice(0, 6)));
+    pushAction(2, "architecture", `Circular dependency (${chain.length} files)`, "Break the cycle: extract the shared type/interface into a separate module.", chain.slice(0, 4).map((f) => ({ file: f })), cyclePrompt(chain.slice(0, 6)), coversOf([coveredByCycle.get(c)]));
   }
   for (const h of hotspotsAll.slice(0, 5)) {
     pushAction(2, "stability", `Hotspot ${h.file} (${h.churn}\xD7 changes, complexity ${h.complexity})`, "Add regression tests and refactor into smaller functions before the next change.", [{ file: h.file }], hotspotPrompt(h.file, h.churn, h.complexity, h.suggestion));
@@ -25111,11 +25329,12 @@ var init_collector = __esm({
   "../engine/dist/core/code/collector.js"() {
     "use strict";
     init_project_resolver();
+    init_code_intel();
     init_companions();
     init_secret_redactor();
     init_secret_scanner();
     init_prompts();
-    COLLECTOR_VERSION = 2;
+    COLLECTOR_VERSION = 3;
     ANALYSES = [
       "health",
       "security",
@@ -25624,7 +25843,7 @@ var init_intent_drain = __esm({
       ownVersion2 = JSON.parse(readFileSync45(join55(dir, "../package.json"), "utf-8")).version || ownVersion2;
     } catch {
       try {
-        if (true) ownVersion2 = "0.5.16";
+        if (true) ownVersion2 = "0.5.18";
       } catch {
       }
     }
@@ -25827,7 +26046,7 @@ __export(team_merge_exports, {
 });
 import { existsSync as existsSync52, mkdirSync as mkdirSync17, readFileSync as readFileSync46, rmSync as rmSync7, writeFileSync as writeFileSync18, statSync as statSync44 } from "fs";
 import { dirname as dirname24, join as join56 } from "path";
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 function installPathFor(art, tool) {
   switch (art.type) {
     case "skill":
@@ -25907,14 +26126,14 @@ async function mergePullResult(opts) {
       continue;
     }
     const body = Buffer.from(a.bodyB64, "base64");
-    const sha = createHash17("sha256").update(body).digest("hex");
+    const sha = createHash18("sha256").update(body).digest("hex");
     for (const tool of targets) {
       const path = installPathFor(a, tool);
       if (!path)
         continue;
       try {
         const existing = readFileIfExists(path);
-        if (existing && createHash17("sha256").update(existing).digest("hex") === sha) {
+        if (existing && createHash18("sha256").update(existing).digest("hex") === sha) {
           report.skipped.push({ artifactId: a.id, path, reason: "unchanged" });
           pending.push({ artifactId: a.id, tool, artifactType: a.type, artifactName: a.name, sha256: sha, installedAt: Date.now() });
           continue;
@@ -26898,7 +27117,7 @@ __export(device_auth_exports, {
   betterAuthDeviceLogin: () => betterAuthDeviceLogin,
   deviceLogin: () => deviceLogin
 });
-import { createHash as createHash18, randomBytes } from "node:crypto";
+import { createHash as createHash19, randomBytes } from "node:crypto";
 async function deviceLogin(opts, onPrompt) {
   const issuer = (opts.issuer || DEFAULT_ISSUER).replace(/\/+$/, "");
   if (!issuer) {
@@ -26909,7 +27128,7 @@ async function deviceLogin(opts, onPrompt) {
   const clientId = opts.clientId || DEFAULT_CLIENT_ID;
   const scope = opts.scope || "openid email profile";
   const codeVerifier = b64url(randomBytes(32));
-  const codeChallenge = b64url(createHash18("sha256").update(codeVerifier).digest());
+  const codeChallenge = b64url(createHash19("sha256").update(codeVerifier).digest());
   const startRes = await fetch(`${issuer}/protocol/openid-connect/auth/device`, {
     method: "POST",
     headers: { "content-type": "application/x-www-form-urlencoded" },
@@ -27139,6 +27358,55 @@ function firstTarget() {
   if (!cred) return null;
   return { base: cred.serverUrl.replace(/\/+$/, ""), token: cred.token };
 }
+async function confirmFirstSyncScope(skipPause) {
+  const { summariseSyncScope: summariseSyncScope2 } = await Promise.resolve().then(() => (init_sync_scope(), sync_scope_exports));
+  let scope;
+  try {
+    scope = summariseSyncScope2();
+  } catch {
+    console.log(chalk.dim("   (could not summarise local scope \u2014 proceeding)"));
+    return true;
+  }
+  console.log(chalk.bold("6. What would leave this machine"));
+  if (scope.included === 0 && scope.heldBack === 0) {
+    console.log(chalk.dim("   No local sessions found yet \u2014 nothing to ship."));
+    return true;
+  }
+  const tools = scope.byTool.map((t) => `${t.tool} ${t.sessions}`).join(", ");
+  console.log(`   ${chalk.bold(String(scope.included))} session(s) would upload${tools ? chalk.dim(`  (${tools})`) : ""}`);
+  if (scope.heldBack > 0) {
+    console.log(`   ${chalk.green(String(scope.heldBack))} held back by your existing rules`);
+  }
+  if (scope.allowlistMode) {
+    console.log(chalk.yellow("   Allowlist mode is on \u2014 only the projects you listed would ship."));
+  }
+  if (scope.noPathSessions > 0) {
+    console.log(`   ${chalk.yellow(String(scope.noPathSessions))} of those carry no project path \u2014 only \`exclude tool\` can hold those back`);
+  }
+  const shown = scope.projects.filter((p) => !p.heldBackBy).slice(0, 8);
+  for (const p of shown) {
+    console.log(`     ${chalk.cyan(p.projectPath || p.id)} ${chalk.dim(`\xB7 ${p.sessions}`)}`);
+  }
+  const more = scope.projects.filter((p) => !p.heldBackBy).length - shown.length;
+  if (more > 0) console.log(chalk.dim(`     \u2026and ${more} more project(s)`));
+  console.log(chalk.dim("   Secrets are masked on this machine before anything uploads."));
+  console.log(chalk.dim("   Hold one back:  chat-recall exclude project <path>"));
+  console.log(chalk.dim("   Or invert it:   chat-recall sync-only add <project>"));
+  if (skipPause || !process.stdin.isTTY) {
+    console.log();
+    return true;
+  }
+  const { createInterface: createInterface3 } = await import("node:readline/promises");
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+  const answer = (await rl.question("   Upload these now? [Y/n] ")).trim().toLowerCase();
+  rl.close();
+  if (answer === "n" || answer === "no") {
+    console.log(chalk.dim("   Skipped. Set your rules, then run `chat-recall sync`."));
+    return false;
+  }
+  console.log();
+  return true;
+}
 function requireTarget() {
   const t = firstTarget();
   if (!t) {
@@ -27271,7 +27539,7 @@ var DEFAULT_ALLOW = [
 var SELF_HOST_DOCS = "https://github.com/munhq/chat-recall/blob/main/docs/SELF_HOSTING.md";
 var program = new Command();
 program.name("chat-recall").description("Semantic search for Claude Code sessions - recall and resume past conversations").version(pkgVersion);
-program.command("init").description("Set up chat-recall: connect to your server, configure MCP, ship your local sessions").option("--server <url>", "chat-recall server URL to connect this machine to").option("--token <token>", "Self-host device token (skips the interactive OIDC login)").option("--skip-mcp", "Skip MCP server configuration").option("--skip-sync", "Skip the first session sync").option("--with-codeindex", "Force-download the codeindex binary during init. Default behavior is to detect an already-installed codeindex on PATH and register it as an MCP server.").option("--skip-codeindex", "Skip the codeindex companion entirely (no detection, no registration).").option("--skip-service", "Skip installing the per-user background sync service (Linux/macOS/Windows). By default init installs it so new conversations ship automatically.").action(async (options) => {
+program.command("init").description("Set up chat-recall: connect to your server, configure MCP, ship your local sessions").option("--server <url>", "chat-recall server URL to connect this machine to").option("--token <token>", "Self-host device token (skips the interactive OIDC login)").option("--skip-mcp", "Skip MCP server configuration").option("--skip-sync", "Skip the first session sync").option("--with-codeindex", "Force-download the codeindex binary during init. Default behavior is to detect an already-installed codeindex on PATH and register it as an MCP server.").option("--skip-codeindex", "Skip the codeindex companion entirely (no detection, no registration).").option("--skip-service", "Skip installing the per-user background sync service (Linux/macOS/Windows). By default init installs it so new conversations ship automatically.").option("--yes", "Do not pause before the first upload. The scope summary still prints.", false).option("--prompt-json", "Print the device prompt as one JSON line on stdout, then continue", false).action(async (options) => {
   try {
     console.log(chalk.bold("chat-recall init"));
     console.log();
@@ -27299,13 +27567,13 @@ program.command("init").description("Set up chat-recall: connect to your server,
     console.log(chalk.bold("2. Connecting to your server..."));
     let target = firstTarget();
     if (options.server) {
-      await runLogin(options.server, { token: options.token });
+      await runLogin(options.server, { token: options.token, fromInit: true, promptJson: options.promptJson });
       target = firstTarget();
     } else if (!target) {
       console.log(`   Connecting to ${chalk.bold(DEFAULT_SERVER)} \u2014 sign in to approve this machine.`);
       console.log(`   ${chalk.dim(`Prefer your own server? ${chalk.bold("--server <url>")}. Self-hosting is free: ${SELF_HOST_DOCS}`)}`);
       try {
-        await runLogin(DEFAULT_SERVER, { token: options.token });
+        await runLogin(DEFAULT_SERVER, { token: options.token, fromInit: true, promptJson: options.promptJson });
         target = firstTarget();
       } catch (e) {
         console.log(`   ${chalk.yellow("Not connected.")} ${e instanceof Error ? e.message : e}`);
@@ -27452,14 +27720,19 @@ program.command("init").description("Set up chat-recall: connect to your server,
       console.log();
     }
     if (!options.skipSync && firstTarget()) {
-      console.log(chalk.bold("6. Shipping local sessions to your server..."));
-      try {
-        const { syncSessions: syncSessions2 } = await Promise.resolve().then(() => (init_sync_client(), sync_client_exports));
-        const r = await syncSessions2();
-        console.log(`   ${chalk.green(`Synced ${r.uploaded} session(s), ${r.items} item(s)`)} ${chalk.dim(`\u2014 ${r.links} links, ${r.derived} derived rows, ${r.kgTriples} KG triples, ${r.skipped} skipped, ${r.redactions} secrets redacted, ${r.findings} secret findings${r.scanned ? ` (scanned ${r.scanned} in ${r.scanMs}ms)` : ""}`)}`);
-      } catch (err) {
-        console.log(`   ${chalk.yellow("Sync failed")} \u2014 ${err instanceof Error ? err.message : err}`);
-        console.log(`   ${chalk.dim("Re-run `chat-recall sync` once your server is reachable.")}`);
+      const shipped = await confirmFirstSyncScope(!!options.yes);
+      if (!shipped) {
+        console.log();
+      } else {
+        console.log(chalk.dim("   Shipping..."));
+        try {
+          const { syncSessions: syncSessions2 } = await Promise.resolve().then(() => (init_sync_client(), sync_client_exports));
+          const r = await syncSessions2();
+          console.log(`   ${chalk.green(`Synced ${r.uploaded} session(s), ${r.items} item(s)`)} ${chalk.dim(`\u2014 ${r.links} links, ${r.derived} derived rows, ${r.kgTriples} KG triples, ${r.skipped} skipped, ${r.redactions} secrets redacted, ${r.findings} secret findings${r.scanned ? ` (scanned ${r.scanned} in ${r.scanMs}ms)` : ""}`)}`);
+        } catch (err) {
+          console.log(`   ${chalk.yellow("Sync failed")} \u2014 ${err instanceof Error ? err.message : err}`);
+          console.log(`   ${chalk.dim("Re-run `chat-recall sync` once your server is reachable.")}`);
+        }
       }
     } else if (!options.skipSync) {
       console.log(chalk.bold("6. Skipping first sync (not logged in)"));
@@ -29364,6 +29637,10 @@ async function runLogin(serverUrl, opts) {
       }
     }
     const onPrompt = (p) => {
+      if (opts.promptJson) {
+        console.log(JSON.stringify({ prompt: p }));
+        return;
+      }
       console.log();
       console.log(chalk.bold("To log in, open:"));
       console.log("  " + chalk.cyan(p.url));
@@ -29400,7 +29677,9 @@ async function runLogin(serverUrl, opts) {
     const { token } = await mint.json();
     saveCredentials2({ serverUrl, token });
     console.log(chalk.green(`\u2713 Logged in to ${chalk.bold(slug)}`) + chalk.dim(`  (device: ${deviceId})  server: ${serverUrl}`));
-    console.log(chalk.dim("Run `chat-recall sync` to push redacted conversations."));
+    if (!opts.fromInit) {
+      console.log(chalk.dim("Run `chat-recall sync` to push redacted conversations."));
+    }
   } catch (err) {
     console.error(chalk.red("login failed:"), err instanceof Error ? err.message : err);
     process.exit(1);
@@ -29463,6 +29742,66 @@ include.command("remove <path>").description("Undo an opt-in (personal folder go
   saveSettings2(s);
   console.log(chalk.green(`\u2713 Removed ${path}`) + chalk.dim(" \u2014 back to skipped."));
 });
+var retention = program.command("retention").description("How long the server keeps your synced sessions. Bare `retention` shows the current window.");
+retention.command("show", { isDefault: true }).description("Show the window and how many sessions it would delete").action(async () => {
+  const t = requireTarget();
+  const r = await serverGet("/api/data/retention");
+  console.log(chalk.bold("Retention") + chalk.dim(`  (server: ${t.base})`));
+  if (!r.days) {
+    console.log(`  window: ${chalk.green("none")} \u2014 the server keeps everything you sync`);
+  } else {
+    console.log(`  window: ${chalk.yellow(`${r.days} days`)}`);
+    console.log(`  sessions currently outside it: ${r.wouldDelete}`);
+  }
+  console.log(chalk.dim(`  Set one: chat-recall retention set <${r.min}-${r.max}>   \xB7   clear it: chat-recall retention set 0`));
+});
+retention.command("set <days>").description("Set the window in days, or 0 to keep everything. Prints what it would delete and asks first.").option("--yes", "Skip the confirmation (for scripts). The warning still prints.", false).action(async (daysArg, opts) => {
+  requireTarget();
+  const days = Number(daysArg);
+  if (!Number.isInteger(days) || days < 0) {
+    console.error(chalk.red(`'${daysArg}' is not a whole number of days.`));
+    process.exit(1);
+  }
+  const preview = await serverGet(
+    `/api/data/retention?days=${days}`
+  );
+  if (days === 0) {
+    await serverPost("/api/data/retention", { days: 0 });
+    console.log(chalk.green("\u2713 Window cleared") + chalk.dim(" \u2014 the server keeps everything you sync."));
+    return;
+  }
+  if (preview.wouldDelete > 0) {
+    console.log();
+    console.log(chalk.yellow(`This deletes ${preview.wouldDelete} session(s) from the server, and keeps deleting`));
+    console.log(chalk.yellow(`anything older than ${days} days from now on.`));
+    console.log();
+    console.log(chalk.dim("  Re-syncing can restore a session ONLY if its transcript is still on a"));
+    console.log(chalk.dim("  machine you have. For a laptop you no longer own, history your AI tool"));
+    console.log(chalk.dim("  has rotated, or files you deleted, our copy is the only copy."));
+    console.log(chalk.dim("  Take one first if you want it:  chat-recall export"));
+    console.log();
+    if (!opts.yes) {
+      if (!process.stdin.isTTY) {
+        console.error(chalk.red("Refusing: this would delete data and there is no terminal to confirm at."));
+        console.error(chalk.dim("Pass --yes if you mean it."));
+        process.exit(1);
+      }
+      const { createInterface: createInterface3 } = await import("node:readline/promises");
+      const rl = createInterface3({ input: process.stdin, output: process.stdout });
+      const answer = (await rl.question(`Type ${preview.wouldDelete} to confirm: `)).trim();
+      rl.close();
+      if (answer !== String(preview.wouldDelete)) {
+        console.log(chalk.dim("Cancelled \u2014 nothing changed."));
+        return;
+      }
+    }
+  }
+  const res = await serverPost(
+    "/api/data/retention",
+    { days, acknowledge: true }
+  );
+  console.log(chalk.green(`\u2713 Window set to ${res.days} days`) + chalk.dim(` \u2014 ${res.wouldDelete} session(s) will be removed on the next sweep.`));
+});
 var syncOnly = program.command("sync-only").description("Opt-in sync: ship ONLY chosen projects. Bare `sync-only` shows the mode + allowlist.");
 syncOnly.command("list", { isDefault: true }).description("Show the sync mode and allowlisted projects").action(async () => {
   const { loadSettings: loadSettings2 } = await Promise.resolve().then(() => (init_settings(), settings_exports));
@@ -29575,7 +29914,7 @@ exclude.command("remove <value>").description("Remove an exclusion (tool name or
   saveSettings2(s);
   console.log(chalk.green(`\u2713 Removed ${value}`));
 });
-program.command("login <server-url>").description("Log in via Keycloak (device flow) and mint a sync device token \u2192 ~/.chat-recall/credentials.json (0600)").option("--token <token>", "Self-host: skip OIDC and save this device token directly").option("--check", "Report-only: exit 0 if a working credential for this server exists, 1 otherwise (never interactive)").option("--issuer <url>", "OIDC issuer URL (default: learned from the server via /api/capabilities)").option("--client-id <id>", "OIDC client id (default: chat-recall-web)").option("--team <slug>", "Team to mint the device token for (default: your only team)").option("--device-id <id>", "Device id for this machine (default: hostname)").action((serverUrl, opts) => runLogin(serverUrl, opts));
+program.command("login [server-url]").description(`Log in (device flow) and mint a sync device token \u2192 ~/.chat-recall/credentials.json (0600). Defaults to ${DEFAULT_SERVER}.`).option("--token <token>", "Self-host: skip OIDC and save this device token directly").option("--check", "Report-only: exit 0 if a working credential for this server exists, 1 otherwise (never interactive)").option("--issuer <url>", "OIDC issuer URL (default: learned from the server via /api/capabilities)").option("--client-id <id>", "OIDC client id (default: chat-recall-web)").option("--team <slug>", "Team to mint the device token for (default: your only team)").option("--device-id <id>", "Device id for this machine (default: hostname)").option("--prompt-json", "Print the device prompt as one JSON line on stdout, then wait for approval", false).action((serverUrl, opts) => runLogin(serverUrl || DEFAULT_SERVER, opts));
 program.command("logout <server-url>").description("Remove one sync target (other targets keep syncing)").action(async (serverUrl) => {
   const { removeCredentials: removeCredentials2, loadAllCredentials: loadAllCredentials2 } = await Promise.resolve().then(() => (init_sync_client(), sync_client_exports));
   if (removeCredentials2(serverUrl)) {