codehere 0.8.0 → 1.0.1

package/dist/infrastructure/storage/atomic-write.js

@@ -0,0 +1,86 @@
+/**
+ * Write a file so a reader never sees it half-written.
+ *
+ * Why (measured 2026-08-08, not assumed): `writeFileSync` is open(O_TRUNC) then
+ * write. SIGKILL landing between the two leaves a truncated, unparseable file.
+ * Induced deliberately — 40 attempts at a ~290KB payload, **15 came back torn**.
+ * The window shrinks with file size but never closes, and codehere's state files
+ * only grow.
+ *
+ * The failure this prevents is not "the write was lost" — losing the write is
+ * survivable, the caller can write again. It is "the file that survived is
+ * garbage": a corrupt permissions list, an unreadable budget ceiling, an OAuth
+ * store that no longer parses. `rename(2)` is atomic on POSIX, so a reader sees
+ * either the whole old file or the whole new one, never a splice of both.
+ *
+ * NOT what this gives you: durability across power loss. That needs fsync on the
+ * file AND its directory, which costs a real syscall on every write. The failure
+ * mode there is different and much less bad — you lose the write, you do not get
+ * a corrupt file — so it is deliberately not paid for here. Say so rather than
+ * implying this makes writes crash-proof.
+ *
+ * Appends are NOT routed through this and do not need to be. `appendFileSync`
+ * opens O_APPEND, and each write is atomic with respect to the file offset:
+ * measured with 6 concurrent writers × 300 records, and again at 90KB records,
+ * with zero interleaving or loss both times. The JSONL chain and session logs
+ * were never at risk from this, and an earlier audit that counted appends
+ * alongside whole-file writes overstated the problem.
+ */
+import { writeFileSync, renameSync, unlinkSync, readdirSync, statSync } from 'node:fs';
+import { dirname, basename, join } from 'node:path';
+/** A temp older than this was orphaned by a crash, not left by a live write. */
+const STALE_TEMP_MS = 60_000;
+/**
+ * Sweep temps this file's own writes orphaned. SIGKILL cannot run a catch block,
+ * so a hard crash mid-write always leaves one behind — measured at 16 after 40
+ * kills. Without this, trading a corrupt file for permanent litter in the user's
+ * state dir just moves the problem: a stray `.tmp` next to `permissions.yaml`
+ * reads as corruption to anyone opening the directory.
+ *
+ * Scoped to the target's own basename so it can never touch another file's
+ * in-flight temp, and age-gated so it can never race a concurrent writer.
+ */
+function sweepStaleTemps(path) {
+    const dir = dirname(path);
+    const prefix = `${basename(path)}.`;
+    try {
+        for (const name of readdirSync(dir)) {
+            if (!name.startsWith(prefix) || !name.endsWith('.tmp'))
+                continue;
+            const p = join(dir, name);
+            try {
+                if (Date.now() - statSync(p).mtimeMs > STALE_TEMP_MS)
+                    unlinkSync(p);
+            }
+            catch {
+                /* vanished under us, or not ours to remove — either way, leave it */
+            }
+        }
+    }
+    catch {
+        /* unreadable dir · sweeping is hygiene, never a reason to fail the write */
+    }
+}
+export function writeFileAtomic(path, data, opts) {
+    // pid + time keeps two concurrent writers of the SAME path from clobbering
+    // each other's temp file; the rename still decides who wins, and either whole
+    // file is valid.
+    const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+    try {
+        writeFileSync(tmp, data, opts?.mode !== undefined ? { mode: opts.mode } : undefined);
+        renameSync(tmp, path);
+        sweepStaleTemps(path);
+    }
+    catch (err) {
+        // Never leave the temp behind on a failed write — it would accumulate in the
+        // user's state dir forever and look like corruption to anyone reading it.
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            /* the temp never existed, or is already gone */
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=atomic-write.js.map

package/dist/infrastructure/storage/project-thread-mirror.js

@@ -31,6 +31,8 @@ import { existsSync, mkdirSync, appendFileSync, readFileSync } from 'fs';
 import { homedir } from 'os';
 import { join } from 'path';
 import { createHash } from 'crypto';
+import { execFileSync } from 'child_process';
+import { normalizeRemote } from './project-thread-reader.js';
 const PROJECTS_DIR = join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'projects');
 /** Match migration module's defaults. Same regex set kept in sync. */
 const TEMP_DIR_PATTERNS = [/^\/tmp\//, /^\/var\/folders\//, /^\/private\/var\/folders\//, /^\/private\/tmp\//];
@@ -44,6 +46,27 @@ function slugForCwd(cwd) {
         return 'unknown';
     return createHash('sha1').update(cwd).digest('hex').slice(0, 12);
 }
+/**
+ * Detect the git remote for a cwd → normalized `host/org/repo` (project
+ * identity). Best-effort + fast: a short-timeout `git remote get-url origin`,
+ * silent on not-a-repo / no-remote / git-missing. Called at most once per
+ * project (write-time seed + the daemon-start backfill), never on a read poll.
+ */
+function detectRemote(cwd) {
+    if (!cwd)
+        return null;
+    try {
+        const out = execFileSync('git', ['-C', cwd, 'remote', 'get-url', 'origin'], {
+            encoding: 'utf-8',
+            timeout: 2000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return normalizeRemote(out.trim());
+    }
+    catch {
+        return null;
+    }
+}
 function ensureProjectDir(slug) {
     const dir = join(PROJECTS_DIR, slug);
     if (!existsSync(dir))
@@ -224,7 +247,7 @@ export async function backfillProjectTitles() {
             if (ok) {
                 rewritten++;
                 if (process.env.CODEHERE_DEBUG === '1') {
-                    console.error(`[backfill] ${slug}: "${latestTitle.slice(0, 40)}" → "${fallback}"`);
+                    console.error(`[backfill] ${slug}: "${latestTitle.slice(0, 40)}" › "${fallback}"`);
                 }
             }
         }
@@ -234,6 +257,79 @@ export async function backfillProjectTitles() {
     }
     return { scanned, rewritten };
 }
+/**
+ * One-time backfill of the git remote into _meta for projects that predate
+ * write-time detection (or whose seed-time detection found none). Idempotent:
+ * any project carrying a non-null remote OR a `_remoteChecked` marker is
+ * skipped, so this runs the git probe at most once per project across the
+ * daemon's lifetime. Best-effort; per-project failures continue.
+ *
+ * Wired at daemon start alongside backfillProjectTitles. Returns the count of
+ * projects for which a real remote was detected.
+ */
+export async function backfillProjectRemotes() {
+    let scanned = 0;
+    let detected = 0;
+    if (!existsSync(PROJECTS_DIR))
+        return { scanned, detected };
+    let entries;
+    try {
+        const { readdirSync } = await import('fs');
+        entries = readdirSync(PROJECTS_DIR);
+    }
+    catch {
+        return { scanned, detected };
+    }
+    for (const slug of entries) {
+        if (!/^[a-f0-9]{12}$|^unknown$/.test(slug))
+            continue;
+        scanned++;
+        try {
+            const file = join(PROJECTS_DIR, slug, 'thread.jsonl');
+            if (!existsSync(file))
+                continue;
+            const content = readFileSync(file, 'utf-8');
+            const lines = content.split('\n').filter((l) => l.trim());
+            let alreadyChecked = false;
+            let haveRemote = false;
+            let latestCwd = null;
+            for (const line of lines) {
+                try {
+                    const rec = JSON.parse(line);
+                    if (rec._meta === 'project' || rec._meta === 'project-update') {
+                        if (rec._remoteChecked === true)
+                            alreadyChecked = true;
+                        if (typeof rec.remote === 'string' && rec.remote)
+                            haveRemote = true;
+                        if (typeof rec.cwd === 'string' && rec.cwd && !latestCwd)
+                            latestCwd = rec.cwd;
+                    }
+                    if (rec.type === 'task' && typeof rec.cwd === 'string' && rec.cwd)
+                        latestCwd = rec.cwd;
+                }
+                catch {
+                    /* skip malformed line */
+                }
+            }
+            if (alreadyChecked || haveRemote)
+                continue; // idempotent — already settled
+            const remote = detectRemote(latestCwd);
+            // Stamp _remoteChecked even on a null result so we never re-probe a
+            // remote-less project. The reader ignores a null remote (keeps it null).
+            const ok = appendMetaUpdate(slug, { remote: remote ?? null, _remoteChecked: true });
+            if (ok && remote) {
+                detected++;
+                if (process.env.CODEHERE_DEBUG === '1') {
+                    console.error(`[backfill-remote] ${slug}: ${remote}`);
+                }
+            }
+        }
+        catch {
+            /* per-project failure → continue */
+        }
+    }
+    return { scanned, detected };
+}
 /**
  * One-shot reconciliation for stale-running tasks (Bug: project-thread.jsonl
  * entries can stay in `status: 'running'` forever when the daemon dies
@@ -330,7 +426,7 @@ export async function reconcileStaleProjectTasks(options) {
                 reconciled++;
                 if (process.env.CODEHERE_DEBUG === '1') {
                     const ageMin = Math.round((now - state.startedAt) / 60000);
-                    console.error(`[reconcile] ${slug}/${state.sessionId.slice(0, 8)} stale running for ${ageMin}m → crashed`);
+                    console.error(`[reconcile] ${slug}/${state.sessionId.slice(0, 8)} stale running for ${ageMin}m › crashed`);
                 }
             }
         }
@@ -404,6 +500,29 @@ export function renameProject(slug, newTitle) {
     }
     return { ok: true };
 }
+/**
+ * Archive (soft-delete) or restore a task. Append-only and audit-safe: writes an
+ * `{_meta:'archived', sessionId, archived}` event to the thread (latest wins).
+ * The task record is NEVER deleted — the proof stays; the room just hides it from
+ * the active list. Restore = the same event with archived:false.
+ */
+export function setTaskArchived(slug, sessionId, archived) {
+    if (!/^([a-f0-9]{12}|unknown)$/.test(slug))
+        return { ok: false, error: 'Invalid project slug' };
+    if (!sessionId || typeof sessionId !== 'string' || sessionId.length > 200 || /[\n\r]/.test(sessionId)) {
+        return { ok: false, error: 'Invalid sessionId' };
+    }
+    const file = join(PROJECTS_DIR, slug, 'thread.jsonl');
+    if (!existsSync(file))
+        return { ok: false, error: 'Project not found' };
+    try {
+        appendFileSync(file, JSON.stringify({ _meta: 'archived', slug, sessionId, archived: !!archived, updatedAt: Date.now() }) + '\n', 'utf-8');
+        return { ok: true };
+    }
+    catch {
+        return { ok: false, error: 'Write failed' };
+    }
+}
 /**
  * Mirror a spawn event to the project thread. Skips temp-dir cwds (matches
  * migration defaults) so test-artifact dirs don't pollute the project list.
@@ -426,6 +545,8 @@ export function mirrorSpawnedToThread(rec) {
         cwd: rec.cwd,
         startedAt: rec.startedAt,
         status: 'running',
+        ...(rec.batchId ? { batchId: rec.batchId } : {}),
+        ...(rec.parentSessionId ? { parentSessionId: rec.parentSessionId } : {}),
     });
     if (seeded) {
         // Seed an immediate cwd-derived title so the sidebar never shows a blank
@@ -436,6 +557,13 @@ export function mirrorSpawnedToThread(rec) {
             const fallback = titleFromCwd(rec.cwd);
             appendMetaUpdate(slug, { title: fallback, cwd: rec.cwd });
         }
+        // Detect + cache the git remote ONCE at project creation. Project identity
+        // (and clone-collapse in listProjects) reads this from _meta — no git
+        // shell-out on the hot read path. Only written when a remote is found;
+        // remote-less / non-repo projects are settled by the daemon-start backfill.
+        const remote = detectRemote(rec.cwd);
+        if (remote)
+            appendMetaUpdate(slug, { remote, _remoteChecked: true });
         if (process.env.CODEHERE_DISABLE_TITLE_AGENT !== '1') {
             // Fire Title agent in background; do not block the spawn path. Lazy-import
             // to avoid loading the LLM module on every spawn when not needed.
@@ -478,6 +606,25 @@ export function mirrorCompletedToThread(rec) {
         artifacts: rec.artifacts,
     });
 }
+/**
+ * Persist a generated Final Report summary to the project thread. The report is
+ * produced ASYNC after the session exits, so mirrorCompletedToThread already ran
+ * without it — this second append fills finalReport in. The reader merges task
+ * records by sessionId field-by-field, so this partial entry layers onto the
+ * existing completion record. Without it the summary lives only in the in-memory
+ * cache + sessions.jsonl: the conversation view loses it on a daemon restart, and
+ * a cross-agent hand-off reads "(no summary recorded)" instead of the real work.
+ */
+export function mirrorFinalReportToThread(rec) {
+    if (isTempDir(rec.cwd))
+        return;
+    const slug = slugForCwd(rec.cwd);
+    appendThreadEntry(slug, {
+        type: 'task',
+        sessionId: rec.sessionId,
+        finalReport: { summary: rec.summary, ...(rec.source ? { source: rec.source } : {}) },
+    });
+}
 /** Label map for raw error codes → user-facing text. */
 const FAILOVER_LABELS = {
     rate_limit: 'hit a rate limit',
@@ -496,7 +643,7 @@ export function mirrorFailoverToThread(rec) {
         type: 'task',
         sessionId: rec.sessionId,
         agent: 'system',
-        prompt: `↻ Switched from ${fromLabel} to ${toLabel} (${reasonLabel})`,
+        prompt: `Switched from ${fromLabel} to ${toLabel} (${reasonLabel}) — warm restart with context, not a state transfer`,
         status: 'completed',
         startedAt: Date.now(),
         completedAt: Date.now(),

package/dist/infrastructure/storage/project-thread-reader.js

@@ -21,7 +21,123 @@
 import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
+import { estimateCostUsd } from '../cost/spend-aggregator.js';
 const DEFAULT_PROJECTS_DIR = join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'projects');
+/**
+ * Normalize a git remote URL to a stable identity key `host/org/repo`:
+ *   - strips scheme (https/http/ssh/git) + any user@ info
+ *   - handles scp-like `git@host:org/repo`
+ *   - drops a trailing `.git` and trailing slashes
+ *   - lowercases the host (path case preserved)
+ * Returns null for empty/garbage input. Shared by the reader (identity grouping)
+ * and the forward-mirror (write-time detection) so both compute the same id.
+ */
+export function normalizeRemote(url) {
+    if (!url)
+        return null;
+    let s = String(url).trim();
+    if (!s)
+        return null;
+    const scp = s.match(/^[^@/]+@([^:/]+):(.+)$/); // git@host:org/repo(.git)
+    if (scp) {
+        s = scp[1] + '/' + scp[2];
+    }
+    else {
+        s = s.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, ''); // scheme://
+        s = s.replace(/^[^@/]+@/, ''); // user@ (ssh://user@host/…)
+    }
+    s = s.replace(/\.git$/i, '').replace(/\/+$/, '');
+    if (!s)
+        return null;
+    const slash = s.indexOf('/');
+    if (slash === -1)
+        return s.toLowerCase();
+    return s.slice(0, slash).toLowerCase() + s.slice(slash);
+}
+/** True for hosts a clone must never reach — loopback, link-local (incl. cloud
+ *  metadata 169.254.169.254), and RFC-1918 private ranges. `host` is the
+ *  `host[:port]` segment from a normalized remote. */
+function isBlockedCloneHost(host) {
+    const h = String(host ?? '')
+        .split(':')[0]
+        .toLowerCase();
+    if (!h)
+        return true;
+    if (h === 'localhost' || h === '::1' || h === '0.0.0.0' || h.endsWith('.localhost'))
+        return true;
+    if (/^127\./.test(h))
+        return true; // loopback
+    if (/^169\.254\./.test(h))
+        return true; // link-local + cloud metadata
+    if (/^10\./.test(h))
+        return true; // RFC-1918
+    if (/^192\.168\./.test(h))
+        return true; // RFC-1918
+    if (/^172\.(1[6-9]|2\d|3[01])\./.test(h))
+        return true; // RFC-1918
+    if (/^0\./.test(h))
+        return true; // "this" network
+    return false;
+}
+/**
+ * Parse a user-pasted GitHub (or any git) URL into a cloneable URL + a
+ * predictable local target directory. Pure (no IO) so the clone route can be
+ * tested without a network or filesystem. Accepts the forms a developer
+ * actually pastes: full https, ssh (git@host:org/repo), bare host/org/repo,
+ * and the `org/repo` GitHub shorthand. Rejects anything without a real
+ * host/org/repo shape (or with whitespace — a git URL never has any).
+ *
+ * The target dir is `<baseDir>/<repo>` — visible + predictable, NOT buried in
+ * a hidden dir, so the user can `cd` to it. The caller decides what to do when
+ * the dir already exists (we open it rather than re-clone — see the route).
+ */
+export function parseGitHubCloneTarget(rawUrl, baseDir) {
+    const raw = String(rawUrl ?? '').trim();
+    if (!raw)
+        return { ok: false, error: 'url_required' };
+    if (/\s/.test(raw))
+        return { ok: false, error: 'invalid_url' };
+    let cloneUrl;
+    if (/^[^@/]+@[^:/]+:.+/.test(raw)) {
+        cloneUrl = raw; // git@host:org/repo(.git)
+    }
+    else if (/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(raw)) {
+        cloneUrl = raw; // already has a scheme (https://, ssh://, …)
+    }
+    else if (/^[\w.-]+\.[\w.-]+\/.+/.test(raw)) {
+        cloneUrl = 'https://' + raw; // host.tld/org/repo (no scheme)
+    }
+    else if (/^[\w.-]+\/[\w.-]+$/.test(raw)) {
+        cloneUrl = 'https://github.com/' + raw; // org/repo GitHub shorthand
+    }
+    else {
+        return { ok: false, error: 'invalid_url' };
+    }
+    // Scheme allowlist — only https + ssh reach `git clone`. Rejects file:// (local
+    // file read), http:// (plaintext + the cloud-metadata / localhost SSRF vector),
+    // and every other transport. The scp form (git@host:…) carries no scheme and is
+    // allowed. This is the SSRF/file:// surface a pre-push review flagged.
+    const scheme = cloneUrl.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\/\//);
+    if (scheme && !['https', 'ssh'].includes(scheme[1].toLowerCase()))
+        return { ok: false, error: 'invalid_url' };
+    const norm = normalizeRemote(cloneUrl); // host/org/repo, lowercased host
+    if (!norm)
+        return { ok: false, error: 'invalid_url' };
+    const parts = norm.split('/');
+    if (parts.length < 3)
+        return { ok: false, error: 'invalid_url' }; // need host + org + repo
+    // Internal-host denylist — don't let a clone target loopback / link-local /
+    // RFC-1918 (the rest of the SSRF surface: metadata endpoints, internal probing).
+    if (isBlockedCloneHost(parts[0]))
+        return { ok: false, error: 'invalid_url' };
+    const repo = (parts[parts.length - 1] || '').replace(/[^\w.-]/g, '');
+    // Reject '.'/'..'/empty — '.' and '..' survive the char-class strip and would
+    // traverse out of baseDir (join(baseDir, '..') = its parent). The clone dir
+    // must be a fresh leaf inside baseDir, nothing else.
+    if (!repo || repo === '.' || repo === '..')
+        return { ok: false, error: 'invalid_url' };
+    return { ok: true, cloneUrl, repo, dir: join(baseDir, repo) };
+}
 /** List all known projects with summary stats. Cheap; no full task content. */
 export function listProjects(options) {
     const root = options?.projectsDir ?? DEFAULT_PROJECTS_DIR;
@@ -45,23 +161,59 @@ export function listProjects(options) {
             return false;
         }
     });
-    const summaries = [];
+    const perSlug = [];
     for (const slug of slugs) {
         // Pattern 4 — sidebar presence dots need agent attribution per project.
-        // Pull the full task list (lightweight — agent + startedAt only) so we
-        // can compute lastAgent + recentAgents (multi-agent stack). taskLimit:0
-        // would drop the data we need; fetch unbounded but discard the heavy
-        // fields (steps + artifacts) below.
+        // Pull the full task list so we can compute agents + per-project cost.
         const thread = readProjectThread(slug, { projectsDir: root });
-        if (thread) {
-            const agentChrono = thread.tasks
-                .filter((t) => typeof t.agent === 'string' && t.agent)
-                .sort((a, b) => b.startedAt - a.startedAt) // most-recent first
-                .map((t) => t.agent);
-            const lastAgent = agentChrono.length > 0 ? agentChrono[0] : null;
-            const seen = new Set();
-            const recentAgents = [];
-            for (const a of agentChrono) {
+        if (!thread)
+            continue;
+        const agentChrono = thread.tasks
+            .filter((t) => typeof t.agent === 'string' && t.agent)
+            .sort((a, b) => b.startedAt - a.startedAt) // most-recent first
+            .map((t) => t.agent);
+        // Per-project spend — same estimator the per-task /api/tasks cost uses.
+        let totalCostCents = 0;
+        for (const t of thread.tasks) {
+            const u = t.artifacts?.usage;
+            if (!u)
+                continue;
+            totalCostCents += estimateCostUsd(t.agent, u) * 100;
+        }
+        perSlug.push({
+            slug: thread.slug,
+            id: normalizeRemote(thread.remote) ?? 'local:' + thread.slug,
+            remote: thread.remote,
+            cwd: thread.cwd,
+            title: thread.title,
+            taskCount: thread.taskCount,
+            totalCostCents,
+            lastActivityAt: thread.lastActivityAt,
+            agentChrono,
+        });
+    }
+    // Second pass — merge slugs that resolve to the same project id (clones of
+    // one git remote). Local-only projects have a unique `local:<slug>` id and
+    // never merge. The most-recently-active member is canonical (its slug + title
+    // win, so rename / room links keep working).
+    const byId = new Map();
+    for (const s of perSlug) {
+        const g = byId.get(s.id);
+        if (g)
+            g.push(s);
+        else
+            byId.set(s.id, [s]);
+    }
+    const summaries = [];
+    for (const [id, members] of byId) {
+        members.sort((a, b) => (b.lastActivityAt ?? 0) - (a.lastActivityAt ?? 0));
+        const head = members[0];
+        const localPaths = [...new Set(members.map((m) => m.cwd).filter((c) => !!c))];
+        // Recency-ordered agent stack across all members (head first).
+        const recentAgents = [];
+        const seen = new Set();
+        for (const m of members) {
+            for (const a of m.agentChrono) {
                 if (seen.has(a))
                     continue;
                 seen.add(a);
@@ -69,16 +221,22 @@ export function listProjects(options) {
                 if (recentAgents.length >= 3)
                     break;
             }
-            summaries.push({
-                slug: thread.slug,
-                cwd: thread.cwd,
-                title: thread.title,
-                taskCount: thread.taskCount,
-                lastActivityAt: thread.lastActivityAt,
-                lastAgent,
-                recentAgents,
-            });
+            if (recentAgents.length >= 3)
+                break;
         }
+        summaries.push({
+            id,
+            remote: head.remote,
+            slug: head.slug,
+            cwd: head.cwd,
+            localPaths,
+            title: head.title,
+            taskCount: members.reduce((n, m) => n + m.taskCount, 0),
+            totalCostCents: Math.round(members.reduce((n, m) => n + m.totalCostCents, 0) * 100) / 100,
+            lastActivityAt: members.reduce((acc, m) => (m.lastActivityAt && (acc === null || m.lastActivityAt > acc) ? m.lastActivityAt : acc), null),
+            lastAgent: recentAgents[0] ?? null,
+            recentAgents,
+        });
     }
     // Sort by recency (most recent first)
     summaries.sort((a, b) => (b.lastActivityAt ?? 0) - (a.lastActivityAt ?? 0));
@@ -99,7 +257,9 @@ export function readProjectThread(slug, options) {
     }
     let cwd = null;
     let title = null;
+    let remote = null;
     const tasksById = new Map();
+    const archivedState = new Map(); // sessionId -> archived (latest event wins)
     for (const line of content.split('\n')) {
         const trimmed = line.trim();
         if (!trimmed)
@@ -116,12 +276,21 @@ export function readProjectThread(slug, options) {
                 cwd = rec.cwd;
             if (typeof rec.title === 'string')
                 title = rec.title;
+            if (typeof rec.remote === 'string')
+                remote = rec.remote;
         }
         else if (rec._meta === 'project-update') {
             if (typeof rec.title === 'string')
                 title = rec.title;
             if (typeof rec.cwd === 'string' && cwd === null)
                 cwd = rec.cwd;
+            // Latest non-empty remote wins; an explicit null (checked, none found)
+            // leaves the prior value alone — we only ever upgrade toward a real remote.
+            if (typeof rec.remote === 'string' && rec.remote)
+                remote = rec.remote;
+        }
+        else if (rec._meta === 'archived' && typeof rec.sessionId === 'string') {
+            archivedState.set(rec.sessionId, rec.archived === true);
         }
         else if (rec.type === 'task' && typeof rec.sessionId === 'string') {
             const existing = tasksById.get(rec.sessionId) ?? {
@@ -143,6 +312,8 @@ export function readProjectThread(slug, options) {
                 'completedAt',
                 'steps',
                 'artifacts',
+                'parentSessionId',
+                'finalReport',
             ]) {
                 if (rec[k] !== undefined) {
                     existing[k] = rec[k];
@@ -151,6 +322,12 @@ export function readProjectThread(slug, options) {
             tasksById.set(rec.sessionId, existing);
         }
     }
+    // Stamp the archived flag (soft-delete) from the latest archived event per task.
+    for (const t of tasksById.values()) {
+        const a = archivedState.get(t.sessionId);
+        if (a !== undefined)
+            t.archived = a;
+    }
     const tasks = [...tasksById.values()].sort((a, b) => a.startedAt - b.startedAt);
     const lastActivityAt = tasks.reduce((acc, t) => {
         const ts = t.completedAt ?? t.startedAt;
@@ -164,9 +341,69 @@ export function readProjectThread(slug, options) {
         slug,
         cwd,
         title,
-        taskCount: tasks.length,
+        remote,
+        // Count only what the UI actually shows: the sidebar tree + room list both
+        // hide archived + demo/seed tasks, so counting them inflated the badge
+        // (a project read "420" while showing a handful).
+        taskCount: countVisibleTasks(tasks),
         tasks: cappedTasks,
         lastActivityAt,
     };
 }
+/** The honest THREAD count: distinct top-level conversations a user started.
+ *  Excludes soft-deleted (archived) and demo/seed tasks, and — the big one —
+ *  tasks with a parentSessionId, which are reply turns + auto cross-vendor
+ *  reviewers (continuations of a thread, not new threads). Counting those made a
+ *  project read "400+" while showing a handful of real threads. */
+function countVisibleTasks(tasks) {
+    return tasks.filter((t) => {
+        if (t.archived || t.parentSessionId)
+            return false;
+        if (/^demo-/.test(t.sessionId || ''))
+            return false;
+        // Failover-lineage marker ("↻ Switched from X to Y (hit a rate limit)") — a
+        // continuation edge, not a thread the user started. Matches the sidebar tree.
+        const p = t.prompt || '';
+        if (p.includes('Switched from') && p.includes('rate limit'))
+            return false;
+        return true;
+    }).length;
+}
+/**
+ * Like readProjectThread, but merges every clone of the same repo (slugs that share
+ * a git remote) into ONE thread — so a project room shows the repo's FULL history,
+ * not just the single slug the UI happened to open. A local-only project (no remote)
+ * has no clones to merge and is returned unchanged. Tasks are deduped by sessionId.
+ */
+export function readMergedProjectThread(slug, options) {
+    const root = options?.projectsDir ?? DEFAULT_PROJECTS_DIR;
+    const head = readProjectThread(slug, { projectsDir: root });
+    if (!head || !head.remote)
+        return head;
+    const id = normalizeRemote(head.remote);
+    let entries;
+    try {
+        entries = readdirSync(root).filter((e) => /^[a-f0-9]{12}$/.test(e) && e !== slug);
+    }
+    catch {
+        return head;
+    }
+    const byId = new Map();
+    for (const t of head.tasks)
+        byId.set(t.sessionId, t);
+    for (const e of entries) {
+        const sib = readProjectThread(e, { projectsDir: root });
+        if (!sib || normalizeRemote(sib.remote) !== id)
+            continue;
+        for (const t of sib.tasks)
+            if (!byId.has(t.sessionId))
+                byId.set(t.sessionId, t);
+    }
+    const tasks = [...byId.values()].sort((a, b) => a.startedAt - b.startedAt);
+    const lastActivityAt = tasks.reduce((acc, t) => {
+        const ts = t.completedAt ?? t.startedAt;
+        return ts && (acc === null || ts > acc) ? ts : acc;
+    }, null);
+    return { ...head, tasks, taskCount: countVisibleTasks(tasks), lastActivityAt };
+}
 //# sourceMappingURL=project-thread-reader.js.map

package/dist/monitoring.js

@@ -201,10 +201,10 @@ export function getMetrics() {
  * Format health status for display
  */
 export function formatHealthStatus(health) {
-    const statusIcon = health.status === 'healthy' ? '✓' : health.status === 'degraded' ? '⚠' : '✗';
+    const statusIcon = health.status === 'healthy' ? '✓' : health.status === 'degraded' ? '!' : '✕';
     let output = `  ${statusIcon} ${health.status.toUpperCase()}\n\n`;
     for (const [component, check] of Object.entries(health.checks)) {
-        const icon = check.status === 'ok' ? '✓' : check.status === 'warning' ? '⚠' : '✗';
+        const icon = check.status === 'ok' ? '✓' : check.status === 'warning' ? '!' : '✕';
         output += `  ${icon} ${component.padEnd(12)} ${check.message}\n`;
     }
     return output;