codesesh 0.17.0 → 0.19.0

package/dist/index.js

@@ -2,23 +2,27 @@
 import {
   appLogger,
   logSearchIndexSync
-} from "./chunk-A4U2SMJJ.js";
+} from "./chunk-KD3DGWZY.js";
 import {
   FileSystemSessionSource,
   SessionAliasValidationError,
   StateStorageUnavailableError,
+  addCalendarDays,
   attachMissingProjectIdentities,
   attachProjectMetrics,
   buildAgentCacheMeta,
   buildDashboard,
   computeSessionDiff,
+  countCalendarDays,
   createProjectScopeMatcher,
   createRegisteredAgents,
   deleteBookmark,
   deleteSessionAlias,
   executeSessionSearch,
   filterSessionSearchCandidates,
+  filterSessionTreeByActivityWindow,
   formatSessionReference,
+  getAgentFullSyncCursor,
   getAgentInfoMap,
   getAgentLastFullSyncAt,
   getSessionActivityTime,
@@ -31,22 +35,30 @@ import {
   listFileActivity,
   listSessionAliases,
   loadCachedSessions,
+  markAgentCacheInitialized,
   markAgentFullSyncCompleted,
+  markAgentFullSyncProgress,
+  markAgentFullSyncStarted,
   matchesProjectIdentity,
   matchesProjectScope,
   materializeSessionDetailResponse,
   mergeSearchQueryOptions,
+  mergeSessionsUpdatedEvents,
   mergeSortedSessions,
   normalizeSessionReference,
   perf,
+  publishPendingPricing,
   refreshPricingCache,
+  saveCachedSessionChanges,
+  saveCachedSessions,
   scanSessions,
+  sessionRoutePath,
   sessionSignature,
   sortSessions,
-  startOfLocalDay,
+  startOfCalendarDay,
   upsertBookmark,
   upsertSessionAlias
-} from "./chunk-7APNDHQ6.js";
+} from "./chunk-G2BTNW3C.js";
 
 // src/index.ts
 import { defineCommand, runMain } from "citty";
@@ -58,6 +70,7 @@ import { compress } from "hono/compress";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { existsSync } from "fs";
+import { createServer as createHttpsServer } from "https";
 import { resolve, dirname } from "path";
 import { fileURLToPath } from "url";
 
@@ -65,7 +78,7 @@ import { fileURLToPath } from "url";
 import { Hono } from "hono";
 
 // src/time-window-resolution.ts
-var DAY_MS = 24 * 60 * 60 * 1e3;
+var ROLLING_DAY_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_DASHBOARD_DAYS = 30;
 function resolveTimeWindow(request) {
   return request.mode === "cli" ? resolveCliWindow(request) : resolveDashboardWindow(request);
@@ -78,7 +91,7 @@ function resolveCliWindow(request) {
   const days = parseDays(request.days);
   if (days === 0) return { to, days };
   if (days == null || days < 0) return { to };
-  const rollingFrom = now - days * DAY_MS;
+  const rollingFrom = now - days * ROLLING_DAY_MS;
   return Number.isFinite(rollingFrom) ? { from: rollingFrom, to, days } : { to };
 }
 function resolveDashboardWindow(request) {
@@ -90,19 +103,19 @@ function resolveDashboardWindow(request) {
   let days = parsedDays != null && parsedDays > 0 ? parsedDays : defaults.days;
   const queryFrom = parseOptionalDate(request.query.from);
   if (queryFrom != null) {
-    days ??= elapsedDays(queryFrom, to);
+    days ??= countCalendarDays(queryFrom, to);
     return { from: queryFrom, to, days };
   }
   if (parsedDays === 0 || !hasQueryDays && defaults.days === 0) {
     return { to, days: 0 };
   }
   if (defaults.from != null) {
-    days ??= elapsedDays(defaults.from, to);
+    days ??= countCalendarDays(defaults.from, to);
     return { from: defaults.from, to, days };
   }
   const resolvedDays = days != null && days > 0 ? days : DEFAULT_DASHBOARD_DAYS;
   return {
-    from: startOfLocalDay(to) - (resolvedDays - 1) * DAY_MS,
+    from: addCalendarDays(startOfCalendarDay(to), -(resolvedDays - 1)),
     to,
     days: resolvedDays
   };
@@ -121,10 +134,7 @@ function parseOptionalDate(value) {
 function parseDays(value) {
   if (value == null) return void 0;
   const days = Number.parseInt(value, 10);
-  return Number.isSafeInteger(days) && Number.isSafeInteger(days * DAY_MS) ? days : void 0;
-}
-function elapsedDays(from, to) {
-  return Math.max(1, Math.ceil((to - from) / DAY_MS));
+  return Number.isSafeInteger(days) && Number.isSafeInteger(days * ROLLING_DAY_MS) ? days : void 0;
 }
 
 // src/api/query-params.ts
@@ -203,13 +213,7 @@ function parseSearchOptions(c, defaults, projectIdentity) {
   };
 }
 function filterSessionsByActivityWindow(sessions, from, to) {
-  if (from == null && to == null) return sessions;
-  return sessions.filter((session) => {
-    const activity = getSessionActivityTime(session);
-    if (from != null && activity < from) return false;
-    if (to != null && activity > to) return false;
-    return true;
-  });
+  return filterSessionTreeByActivityWindow(sessions, from, to);
 }
 
 // src/api/session-aliases-view.ts
@@ -398,6 +402,7 @@ function getSessionHeadReference(session) {
     sessionId: session.id
   };
 }
+var SESSION_DETAIL_STREAM_BATCH_CHARS = 64 * 1024;
 function createSessionDetailJsonResponse(data, messages) {
   const encoder = new TextEncoder();
   const headerJson = JSON.stringify(data);
@@ -412,14 +417,24 @@ function createSessionDetailJsonResponse(data, messages) {
           wroteHeader = true;
           return;
         }
-        const next = iterator.next();
-        if (!next.done) {
-          controller.enqueue(encoder.encode(`${wroteMessage ? "," : ""}${next.value}`));
+        const batch = [];
+        let batchLength = 0;
+        let next = iterator.next();
+        while (!next.done) {
+          const prefix = wroteMessage ? "," : "";
+          batch.push(prefix, next.value);
+          batchLength += prefix.length + next.value.length;
           wroteMessage = true;
+          if (batchLength >= SESSION_DETAIL_STREAM_BATCH_CHARS) break;
+          next = iterator.next();
+        }
+        if (next.done) {
+          batch.push("]}");
+          controller.enqueue(encoder.encode(batch.join("")));
+          controller.close();
           return;
         }
-        controller.enqueue(encoder.encode("]}"));
-        controller.close();
+        controller.enqueue(encoder.encode(batch.join("")));
       },
       cancel() {
         iterator.return?.();
@@ -757,7 +772,7 @@ function handleGetDashboard(c, scanSource, defaults = {}) {
       scope.projectKind,
       scope.projectKey,
       from,
-      fixedTo ?? startOfLocalDay(to)
+      fixedTo ?? startOfCalendarDay(to)
     ],
     () => {
       const agentInfo = getAgentInfoMap({});
@@ -888,8 +903,48 @@ function createApiRoutes(scanSource, eventSource, options = {}) {
 
 // src/remote-access.ts
 import { randomBytes, timingSafeEqual } from "crypto";
+import { readFileSync } from "fs";
 import { isIP } from "net";
 var REMOTE_ACCESS_QUERY_PARAM = "access_token";
+var RemoteTransportError = class extends Error {
+};
+function resolveRemoteTransport(request) {
+  const hasCert = Boolean(request.tlsCertPath);
+  const hasKey = Boolean(request.tlsKeyPath);
+  if (hasCert !== hasKey) {
+    throw new RemoteTransportError("TLS requires both --tls-cert and --tls-key.");
+  }
+  if (hasCert && request.trustProxy) {
+    throw new RemoteTransportError(
+      "Use either --tls-cert/--tls-key or --trust-proxy, not both: only one of them terminates TLS."
+    );
+  }
+  if (hasCert) {
+    try {
+      return {
+        kind: "tls",
+        cert: readFileSync(request.tlsCertPath),
+        key: readFileSync(request.tlsKeyPath)
+      };
+    } catch (error) {
+      throw new RemoteTransportError(
+        `Unable to read the TLS certificate or key: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  if (request.trustProxy) return { kind: "trusted-proxy" };
+  return isLoopbackHostname(request.hostname) ? { kind: "loopback" } : { kind: "plaintext" };
+}
+var FORWARDED_PROTO_HEADER = "X-Forwarded-Proto";
+function requireProxyTls() {
+  return async (c, next) => {
+    const proto = c.req.header(FORWARDED_PROTO_HEADER)?.split(",")[0]?.trim().toLowerCase();
+    if (proto !== "https") {
+      return c.json({ error: "Requests must arrive over TLS through the trusted proxy" }, 403);
+    }
+    await next();
+  };
+}
 function createRemoteAccessToken() {
   return randomBytes(32).toString("base64url");
 }
@@ -969,6 +1024,7 @@ async function createServer(port, store, options = {}) {
   const app = new Hono2();
   const hostname = options.hostname ?? "127.0.0.1";
   const isLoopback = isLoopbackHostname(hostname);
+  const transport = options.transport ?? (isLoopback ? { kind: "loopback" } : { kind: "plaintext" });
   const remoteAccessToken = !isLoopback ? options.remoteAccessToken ?? (options.remoteAccess ? createRemoteAccessToken() : null) : null;
   if (!isLoopback && !remoteAccessToken) {
     throw new Error(
@@ -995,6 +1051,9 @@ async function createServer(port, store, options = {}) {
       });
     }
   });
+  if (transport.kind === "trusted-proxy") {
+    app.use("/api/*", requireProxyTls());
+  }
   if (remoteAccessToken) {
     app.use("/api/*", remoteAccessAuth(remoteAccessToken));
   }
@@ -1012,7 +1071,7 @@ async function createServer(port, store, options = {}) {
     defaultSessionDays: options.defaultSessionDays
   };
   app.route("/api", createApiRoutes(store, store, routeOptions));
-  const webDistPath = findWebDistPath();
+  const webDistPath = options.webDistPath ?? findWebDistPath();
   if (webDistPath) {
     app.use("/*", serveStatic({ root: webDistPath }));
     app.get("/*", serveStatic({ root: webDistPath, path: "index.html" }));
@@ -1022,7 +1081,15 @@ async function createServer(port, store, options = {}) {
   let actualPort = port;
   for (let offset = 0; offset < attempts; offset += 1) {
     const candidatePort = port + offset;
-    server = serve({ fetch: app.fetch, port: candidatePort, hostname });
+    server = serve({
+      fetch: app.fetch,
+      port: candidatePort,
+      hostname,
+      ...transport.kind === "tls" ? {
+        createServer: createHttpsServer,
+        serverOptions: { cert: transport.cert, key: transport.key }
+      } : {}
+    });
     try {
       await waitForListening(server);
       actualPort = getListeningPort(server, candidatePort);
@@ -1042,19 +1109,33 @@ async function createServer(port, store, options = {}) {
       throw new Error(getServerStartupErrorMessage(error, candidatePort));
     }
   }
-  const baseUrl = isLoopback ? `http://localhost:${actualPort}` : `http://${hostname}:${actualPort}`;
+  const scheme = transport.kind === "tls" ? "https" : "http";
+  const baseUrl = isLoopback ? `${scheme}://localhost:${actualPort}` : `${scheme}://${hostname}:${actualPort}`;
   const url = remoteAccessToken ? `${baseUrl}/?${REMOTE_ACCESS_QUERY_PARAM}=${encodeURIComponent(remoteAccessToken)}` : baseUrl;
   appLogger.info("server.listen", {
     port: actualPort,
     requested_port: port,
     hostname,
-    remote_access: Boolean(remoteAccessToken)
+    remote_access: Boolean(remoteAccessToken),
+    transport: transport.kind
   });
   if (!isLoopback) {
-    appLogger.warn("server.listen.remote_access", { hostname, port: actualPort });
+    appLogger.warn("server.listen.remote_access", {
+      hostname,
+      port: actualPort,
+      transport: transport.kind
+    });
     console.warn(`
 \u26A0 \u8FDC\u7A0B\u8BBF\u95EE\u5DF2\u542F\u7528\u3002\u4EFB\u4F55\u6301\u6709\u542F\u52A8 URL \u7684\u4EBA\u90FD\u53EF\u4EE5\u8BFB\u53D6\u4F60\u7684 AI \u4F1A\u8BDD\u8BB0\u5F55\u3002
 `);
+    if (transport.kind === "plaintext") {
+      appLogger.warn("server.listen.plaintext", { hostname, port: actualPort });
+      console.warn(
+        `\u26A0 \u4F20\u8F93\u672A\u52A0\u5BC6\u3002\u8BBF\u95EE\u4EE4\u724C\u4E0E\u5B8C\u6574\u4F1A\u8BDD\u5185\u5BB9\u4EE5\u660E\u6587\u7ECF\u8FC7\u7F51\u7EDC\uFF0CURL \u4E2D\u7684\u4EE4\u724C\u8FD8\u53EF\u80FD\u5199\u5165\u4EE3\u7406\u8BBF\u95EE\u65E5\u5FD7\u3002
+  \u4F7F\u7528 --tls-cert/--tls-key \u76F4\u63A5\u542F\u7528 TLS\uFF0C\u6216\u5728\u53D7\u4FE1\u53CD\u5411\u4EE3\u7406\u540E\u4F7F\u7528 --trust-proxy\u3002
+`
+      );
+    }
   }
   return {
     url,
@@ -1532,6 +1613,22 @@ var SearchIndexJobRunner = class {
         logSearchIndexSync(message.context, message.result);
         return;
       }
+      if (message.type === "persist-failed") {
+        appLogger.error("search_index.persist_failed", {
+          batch_id: batch.id,
+          context: message.context,
+          stage: message.stage,
+          agent: message.agentName,
+          sessions: message.sessions
+        });
+        this.settle(
+          batch,
+          new Error(
+            `Search index worker failed to persist ${message.stage} for ${message.agentName}`
+          )
+        );
+        return;
+      }
       if (message.type !== "done") return;
       appLogger.info(`${message.context}.done`, {
         duration_ms: Math.round(message.durationMs),
@@ -1588,6 +1685,17 @@ var ScanStatusModel = class {
     backfill: { active: false, pendingAgents: [], completedAgents: [], failedAgents: [] }
   };
   snapshot() {
+    const backfill = {
+      ...this.status.backfill,
+      pendingAgents: [...this.status.backfill.pendingAgents],
+      completedAgents: [...this.status.backfill.completedAgents],
+      failedAgents: [...this.status.backfill.failedAgents]
+    };
+    if (this.status.backfill.progress) {
+      backfill.progress = { ...this.status.backfill.progress };
+    } else {
+      delete backfill.progress;
+    }
     return {
       type: "scan-status",
       ...this.status,
@@ -1600,12 +1708,7 @@ var ScanStatusModel = class {
           { ...status }
         ])
       ),
-      backfill: {
-        ...this.status.backfill,
-        pendingAgents: [...this.status.backfill.pendingAgents],
-        completedAgents: [...this.status.backfill.completedAgents],
-        failedAgents: [...this.status.backfill.failedAgents]
-      }
+      backfill
     };
   }
   startBatch(agentNames, phase, sessionCounts) {
@@ -1675,26 +1778,34 @@ var ScanStatusModel = class {
   }
   updateAgent(agentName, progress) {
     const status = this.status.agentStatuses[agentName];
-    if (!status || status.status !== "scanning") return null;
+    if (!status || status.status === "pending" || status.status === "complete" || status.status === "indexing" && progress.phase !== "finalizing") {
+      return null;
+    }
     const now = Date.now();
+    const nextStatus = progress.phase === "finalizing" ? "finalizing" : "scanning";
+    const agentStatuses = {
+      ...this.status.agentStatuses,
+      [agentName]: {
+        ...status,
+        status: nextStatus,
+        total: progress.total ?? status.total,
+        processed: progress.processed ?? status.processed,
+        sessions: progress.sessions ?? status.sessions,
+        updatedAt: now
+      }
+    };
     return this.set({
       ...this.status,
-      agentStatuses: {
-        ...this.status.agentStatuses,
-        [agentName]: {
-          ...status,
-          total: progress.total ?? status.total,
-          processed: progress.processed ?? status.processed,
-          sessions: progress.sessions ?? status.sessions,
-          updatedAt: now
-        }
-      },
+      phase: this.activePhase(this.status.pendingAgents, this.status.scanningAgents, agentStatuses),
+      agentStatuses,
       updatedAt: now
     });
   }
   indexAgent(agentName) {
     const status = this.status.agentStatuses[agentName];
-    if (!this.status.active || !status || status.status !== "scanning") return null;
+    if (!this.status.active || !status || status.status !== "scanning" && status.status !== "finalizing") {
+      return null;
+    }
     const now = Date.now();
     const agentStatuses = {
       ...this.status.agentStatuses,
@@ -1766,7 +1877,10 @@ var ScanStatusModel = class {
     });
   }
   activePhase(pendingAgents, scanningAgents, agentStatuses) {
-    if (pendingAgents.length === 0 && scanningAgents.length > 0 && scanningAgents.every((agentName) => agentStatuses[agentName]?.status === "indexing")) {
+    if (pendingAgents.length === 0 && scanningAgents.length > 0 && scanningAgents.every((agentName) => {
+      const status = agentStatuses[agentName]?.status;
+      return status === "finalizing" || status === "indexing";
+    })) {
       return "indexing";
     }
     return this.status.phase === "initializing" ? "initializing" : "scanning";
@@ -1782,6 +1896,7 @@ var REFRESH_DEBOUNCE_MS = 200;
 var EMPTY_AGENT_REFRESH_DEBOUNCE_MS = 3e4;
 var SEARCH_INDEX_BULK_PENDING_PATH_THRESHOLD = 100;
 var BACKFILL_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var CACHE_TRUNCATION_COVERAGE = 0.5;
 function buildPersistenceDiff(previousSessions, nextSessions, candidateChangedIds = []) {
   const { changes, removedSessionIds } = computeSessionDiff(
     previousSessions,
@@ -1805,6 +1920,8 @@ var AgentSyncEngine = class {
   sessionIndex = new LiveSessionIndex();
   backfillQueue = [];
   currentBackfillAgent;
+  currentBackfillProgress;
+  cacheIntegrityCheckedAgents = /* @__PURE__ */ new Set();
   completedBackfillAgents = [];
   failedBackfillAgents = [];
   sessionsChangedListeners = /* @__PURE__ */ new Set();
@@ -1884,6 +2001,8 @@ var AgentSyncEngine = class {
     }
     this.backfillQueue.length = 0;
     this.currentBackfillAgent = void 0;
+    this.currentBackfillProgress = void 0;
+    this.cacheIntegrityCheckedAgents.clear();
     const searchIndexSnapshot = this.searchIndexJobs.snapshot();
     appLogger.info("search_index.shutdown.started", {
       active_batch_id: searchIndexSnapshot.activeBatchId,
@@ -1916,6 +2035,16 @@ var AgentSyncEngine = class {
     );
   }
   updateAgentScanProgress(agentName, progress) {
+    if (this.currentBackfillAgent === agentName) {
+      this.currentBackfillProgress = {
+        phase: progress.phase,
+        total: progress.total,
+        processed: progress.processed,
+        sessions: progress.sessions
+      };
+      this.publishBackfillStatus();
+      return;
+    }
     this.publishStatus(this.scanStatus.updateAgent(agentName, progress));
   }
   beginAgentIndexing(agentName) {
@@ -2040,14 +2169,30 @@ var AgentSyncEngine = class {
     });
     return "committed";
   }
+  /**
+   * An agent that cannot be reached was never scanned, so there is nothing to
+   * compare against. Publishing an empty result here would diff every known
+   * session into a removal — the same mistake as reading a failed query as an
+   * empty database.
+   */
   refreshUnavailableAgent(agentName) {
     this.lastRefreshAtByAgent.set(agentName, Date.now());
+    const previousSessions = this.sessionIndex.snapshot().byAgent[agentName] ?? [];
+    if (previousSessions.length > 0) {
+      appLogger.warn("scan.refresh.agent_unavailable", {
+        agent: agentName,
+        retained_sessions: previousSessions.length
+      });
+      return this.refreshStrategyResult(previousSessions, { status: "unchanged" });
+    }
     return this.refreshStrategyResult([]);
   }
   async initializeAgent(agent, previousSessions) {
     this.setScanPhase("initializing");
     const scanStartedAt = performance.now();
-    const result = await this.runWorker(agent, previousSessions, null, this.startupScanOptions());
+    const result = await this.runWorker(agent, previousSessions, null, this.startupScanOptions(), {
+      checkpoint: true
+    });
     agent.setSessionMetaMap(new Map(Object.entries(result.meta)));
     const sessions = attachMissingProjectIdentities(result.sessions);
     this.lastRefreshAtByAgent.set(agent.name, Date.now());
@@ -2092,7 +2237,7 @@ var AgentSyncEngine = class {
     const preciseChangedIds = checkResult.changedIds ?? null;
     const scanStartedAt = performance.now();
     if (preciseChangedIds === null) {
-      const result = await this.runWorker(agent, baseline, null, {});
+      const result = await this.runWorker(agent, baseline, null, {}, { checkpoint: true });
       agent.setSessionMetaMap(new Map(Object.entries(result.meta)));
       const sessions2 = attachMissingProjectIdentities(result.sessions);
       return this.refreshStrategyResult(sessions2, {
@@ -2113,7 +2258,7 @@ var AgentSyncEngine = class {
   }
   async scanAgentFully(agent, previousSessions) {
     const scanStartedAt = performance.now();
-    const result = await this.runWorker(agent, previousSessions, null, {});
+    const result = await this.runWorker(agent, previousSessions, null, {}, { checkpoint: true });
     agent.setSessionMetaMap(new Map(Object.entries(result.meta)));
     const sessions = attachMissingProjectIdentities(result.sessions);
     this.lastRefreshAtByAgent.set(agent.name, Date.now());
@@ -2140,8 +2285,63 @@ var AgentSyncEngine = class {
       changedIds,
       scanOptions,
       sourceSync: workerOptions.sourceSync,
+      backfill: workerOptions.backfill,
+      backfillCursor: workerOptions.backfillCursor,
+      checkpoint: workerOptions.checkpoint,
       meta: workerOptions.meta ?? buildAgentCacheMeta(agent),
-      onProgress: (progress) => this.updateAgentScanProgress(agent.name, progress)
+      onProgress: (progress) => this.updateAgentScanProgress(agent.name, progress),
+      onCheckpoint: (checkpoint) => this.handleWorkerCheckpoint(agent, checkpoint)
+    });
+  }
+  handleWorkerCheckpoint(agent, checkpoint) {
+    if (this.isShuttingDown) return;
+    if (checkpoint.stage === "scanned") {
+      let persisted2 = false;
+      try {
+        persisted2 = saveCachedSessions(agent.name, checkpoint.sessions, checkpoint.meta);
+        if (persisted2) markAgentCacheInitialized(agent.name);
+      } catch (error) {
+        appLogger.error("scan.checkpoint.failed", {
+          agent: agent.name,
+          stage: checkpoint.stage,
+          error
+        });
+      }
+      agent.setSessionMetaMap(new Map(Object.entries(checkpoint.meta)));
+      const event = this.sessionIndex.commitAgentSessions(agent.name, checkpoint.sessions);
+      this.emitSessionsChanged({
+        agentName: agent.name,
+        sessions: this.sessionIndex.snapshot().byAgent[agent.name] ?? [],
+        event
+      });
+      appLogger.info("scan.checkpoint.persisted", {
+        agent: agent.name,
+        stage: checkpoint.stage,
+        sessions: checkpoint.sessions.length,
+        persisted: persisted2
+      });
+      return;
+    }
+    let persisted = false;
+    try {
+      persisted = saveCachedSessionChanges(agent.name, checkpoint.changes, [], checkpoint.meta);
+    } catch (error) {
+      appLogger.error("scan.checkpoint.failed", {
+        agent: agent.name,
+        stage: checkpoint.stage,
+        sessions: checkpoint.changes.length,
+        error
+      });
+    }
+    if (persisted && checkpoint.backfillCursor) {
+      markAgentFullSyncProgress(agent.name, checkpoint.backfillCursor);
+    }
+    appLogger.debug("scan.checkpoint.persisted", {
+      agent: agent.name,
+      stage: checkpoint.stage,
+      sessions: checkpoint.changes.length,
+      backfill_cursor: checkpoint.backfillCursor,
+      persisted
     });
   }
   needsBackfill(agent) {
@@ -2149,7 +2349,23 @@ var AgentSyncEngine = class {
     if (startupScanOptions.from == null && startupScanOptions.to == null) return false;
     if (!agent.isAvailable()) return false;
     const lastSyncAt = getAgentLastFullSyncAt(agent.name);
-    return lastSyncAt == null || Date.now() - lastSyncAt > BACKFILL_INTERVAL_MS;
+    if (lastSyncAt == null || Date.now() - lastSyncAt > BACKFILL_INTERVAL_MS) return true;
+    if (!(agent instanceof FileSystemSessionSource)) return false;
+    if (this.cacheIntegrityCheckedAgents.has(agent.name)) return false;
+    const cached = loadCachedSessions(agent.name);
+    const sourceCount = agent.listSessionSources().length;
+    const cachedCount = cached?.sessions.length ?? 0;
+    this.cacheIntegrityCheckedAgents.add(agent.name);
+    if (sourceCount > 0 && cachedCount / sourceCount < CACHE_TRUNCATION_COVERAGE) {
+      appLogger.warn("scan.backfill.cache_truncated", {
+        agent: agent.name,
+        cached_sessions: cachedCount,
+        source_files: sourceCount,
+        last_sync_at: lastSyncAt
+      });
+      return true;
+    }
+    return false;
   }
   enqueueBackfill(agentName) {
     if (this.isShuttingDown || this.currentBackfillAgent === agentName || this.backfillQueue.includes(agentName)) {
@@ -2164,10 +2380,12 @@ var AgentSyncEngine = class {
     const agentName = this.backfillQueue.shift();
     if (!agentName) return;
     this.currentBackfillAgent = agentName;
+    this.currentBackfillProgress = void 0;
     this.publishBackfillStatus();
     void this.runBackfill(agentName).then((result) => {
       if (this.isShuttingDown) return;
       this.currentBackfillAgent = void 0;
+      this.currentBackfillProgress = void 0;
       if (result === "committed") {
         if (!this.completedBackfillAgents.includes(agentName)) {
           this.completedBackfillAgents.push(agentName);
@@ -2177,6 +2395,7 @@ var AgentSyncEngine = class {
         );
       } else if (!this.failedBackfillAgents.includes(agentName)) {
         this.failedBackfillAgents.push(agentName);
+        this.cacheIntegrityCheckedAgents.delete(agentName);
       }
       this.publishBackfillStatus();
       this.pumpBackfillQueue();
@@ -2193,8 +2412,10 @@ var AgentSyncEngine = class {
     const cached = loadCachedSessions(agentName);
     const baseline = cached?.sessions ?? snapshot.byAgent[agentName] ?? [];
     const meta = cached?.meta ?? buildAgentCacheMeta(agent);
+    const backfillCursor = getAgentFullSyncCursor(agentName);
     if (cached) restoreAgentCacheMeta(agent, cached);
     try {
+      markAgentFullSyncStarted(agentName);
       const result = await this.runWorker(
         agent,
         baseline,
@@ -2202,11 +2423,16 @@ var AgentSyncEngine = class {
         {},
         {
           sourceSync: agent instanceof FileSystemSessionSource,
-          meta
+          backfill: true,
+          backfillCursor,
+          meta,
+          checkpoint: true
         }
       );
       agent.setSessionMetaMap(new Map(Object.entries(result.meta)));
       const fullSessions = attachMissingProjectIdentities(result.sessions);
+      this.currentBackfillProgress = { phase: "indexing", sessions: fullSessions.length };
+      this.publishBackfillStatus();
       await this.commitSessionPublication({
         context: "scan.backfill",
         agentName,
@@ -2240,6 +2466,7 @@ var AgentSyncEngine = class {
       active: this.currentBackfillAgent != null || this.backfillQueue.length > 0,
       pendingAgents: [...this.backfillQueue],
       currentAgent: this.currentBackfillAgent,
+      progress: this.currentBackfillProgress,
       completedAgents: [...this.completedBackfillAgents],
       failedAgents: [...this.failedBackfillAgents]
     };
@@ -2377,8 +2604,12 @@ function isSameOrChildPath(parentPath, childPath) {
   const path = relative(parentPath, childPath);
   return path === "" || !path.startsWith("..") && !isAbsolute(path);
 }
+var SQLITE_SIDECAR_SUFFIXES = ["-wal", "-journal"];
+function isSqliteSidecarOf(changedPath, targetPath) {
+  return SQLITE_SIDECAR_SUFFIXES.some((suffix) => changedPath === `${targetPath}${suffix}`);
+}
 function isRelatedPath(changedPath, targetPath) {
-  return isSameOrChildPath(targetPath, changedPath) || isSameOrChildPath(changedPath, targetPath);
+  return isSameOrChildPath(targetPath, changedPath) || isSameOrChildPath(changedPath, targetPath) || isSqliteSidecarOf(changedPath, targetPath);
 }
 function mergeScopes(target, scopes) {
   for (const scope of scopes) {
@@ -2669,6 +2900,9 @@ var ThreadWorkerRunner = class {
       previousSessions: payload.previousSessions,
       changedIds: payload.changedIds,
       sourceSync: payload.sourceSync,
+      backfill: payload.backfill,
+      backfillCursor: payload.backfillCursor,
+      checkpoint: payload.checkpoint,
       scanOptions: payload.scanOptions,
       meta: payload.meta
     };
@@ -2687,7 +2921,8 @@ var ThreadWorkerRunner = class {
         resolve: resolve4,
         reject,
         payload,
-        onProgress: payload.onProgress
+        onProgress: payload.onProgress,
+        onCheckpoint: payload.onCheckpoint
       });
       if (!isNewWorker) {
         try {
@@ -2739,6 +2974,10 @@ var ThreadWorkerRunner = class {
       pending.onProgress?.(message.progress);
       return;
     }
+    if (message.type === "checkpoint") {
+      pending.onCheckpoint?.(message.checkpoint);
+      return;
+    }
     slot.pending.delete(message.requestId);
     if (message.type === "error") {
       pending.reject(new Error(message.error));
@@ -2772,36 +3011,6 @@ var ThreadWorkerRunner = class {
 
 // src/live-scan.ts
 var NEW_SESSION_EVENT_WINDOW_MS = 250;
-function mergeEvents(previous, next) {
-  const changedSessionHeads = /* @__PURE__ */ new Map();
-  const removedSessionRefs = /* @__PURE__ */ new Map();
-  const sessionKey = (agentName, sessionId) => `${agentName}\0${sessionId}`;
-  const addChanged = (item) => {
-    const key = sessionKey(item.reference.agentName, item.reference.sessionId);
-    removedSessionRefs.delete(key);
-    changedSessionHeads.set(key, item);
-  };
-  const addRemoved = (item) => {
-    const key = sessionKey(item.agentName, item.sessionId);
-    changedSessionHeads.delete(key);
-    removedSessionRefs.set(key, item);
-  };
-  for (const item of previous.changedSessionHeads) addChanged(item);
-  for (const item of previous.removedSessionRefs) addRemoved(item);
-  for (const item of next.changedSessionHeads) addChanged(item);
-  for (const item of next.removedSessionRefs) addRemoved(item);
-  return {
-    type: "sessions-updated",
-    changedAgents: Array.from(/* @__PURE__ */ new Set([...previous.changedAgents, ...next.changedAgents])),
-    newSessions: previous.newSessions + next.newSessions,
-    updatedSessions: previous.updatedSessions + next.updatedSessions,
-    removedSessions: previous.removedSessions + next.removedSessions,
-    totalSessions: next.totalSessions,
-    timestamp: next.timestamp,
-    changedSessionHeads: [...changedSessionHeads.values()],
-    removedSessionRefs: [...removedSessionRefs.values()]
-  };
-}
 var LiveScanStore = class {
   watchEnabled;
   scanOptions;
@@ -2854,7 +3063,11 @@ var LiveScanStore = class {
     });
     const snapshot = this.getSnapshot();
     const indexStartedAt = performance.now();
-    if (!this.deferInitialRefresh) await this.syncEngine.syncInitialIndex();
+    if (!this.deferInitialRefresh) {
+      await this.syncEngine.syncInitialIndex().catch((error) => {
+        appLogger.error("scan.initial.index_failed", { error });
+      });
+    }
     const indexDuration = performance.now() - indexStartedAt;
     appLogger.info("scan.initial.done", {
       duration_ms: Math.round(performance.now() - startedAt),
@@ -2928,7 +3141,7 @@ var LiveScanStore = class {
     for (const listener of this.listeners) listener(event);
   }
   queueEvent(event) {
-    this.pendingEvent = this.pendingEvent ? mergeEvents(this.pendingEvent, event) : event;
+    this.pendingEvent = this.pendingEvent ? mergeSessionsUpdatedEvents(this.pendingEvent, event) : event;
     if (this.pendingEventTimer) return;
     this.pendingEventTimer = setTimeout(() => {
       const pending = this.pendingEvent;
@@ -2952,11 +3165,11 @@ var LiveScanStore = class {
 import { consola } from "consola";
 
 // src/version.ts
-import { readFileSync } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve3, dirname as dirname3 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 var __dirname = dirname3(fileURLToPath4(import.meta.url));
-var pkg = JSON.parse(readFileSync(resolve3(__dirname, "../package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync2(resolve3(__dirname, "../package.json"), "utf-8"));
 var VERSION = pkg.version;
 
 // src/output.ts
@@ -2978,6 +3191,25 @@ function printScanResults(agents) {
   consola.log("");
 }
 
+// src/session-index-output.ts
+function buildSessionIndexOutput(snapshot, window = {}) {
+  const sessions = filterSessionTreeByActivityWindow(snapshot.sessions, window.from, window.to);
+  const agents = getAgentInfoMap(
+    Object.fromEntries(
+      Object.entries(snapshot.byAgent).map(([name, list]) => [
+        name,
+        filterSessionTreeByActivityWindow(list, window.from, window.to).length
+      ])
+    )
+  ).map(({ name, displayName, count }) => ({
+    name,
+    displayName,
+    count,
+    available: count > 0
+  }));
+  return { agents, sessions };
+}
+
 // src/runtime-plan.ts
 function parseSessionUri(uri) {
   const match = uri.match(/^([a-z]+):\/\/(.+)$/i);
@@ -3003,7 +3235,10 @@ function buildCliRuntimePlan(input, environment) {
 function resolveStartupUrl(startupUrl, targetSession) {
   if (!targetSession) return startupUrl;
   const url = new URL(startupUrl);
-  url.pathname = `/${targetSession.agent.toLowerCase()}/${targetSession.sessionId}`;
+  url.pathname = sessionRoutePath({
+    agentName: targetSession.agent,
+    sessionId: targetSession.sessionId
+  });
   return url.toString();
 }
 function redactStartupUrl(startupUrl) {
@@ -3028,6 +3263,27 @@ function hasExplicitPortArg(argv) {
   });
 }
 
+// src/pricing-refresh.ts
+var REFRESH_TIMEOUT_MS = 1e4;
+function startPricingRefresh(timeoutMs = REFRESH_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const completion = refreshPricingCache({ signal: controller.signal, timeoutMs }).catch(
+    (error) => {
+      appLogger.warn("pricing.refresh.error", { error });
+      return false;
+    }
+  );
+  return {
+    publish() {
+      if (publishPendingPricing()) appLogger.info("pricing.refresh.published", {});
+    },
+    async cancel() {
+      controller.abort();
+      await completion;
+    }
+  };
+}
+
 // src/index.ts
 var main = defineCommand({
   meta: {
@@ -3052,6 +3308,19 @@ var main = defineCommand({
       description: "Allow authenticated access when binding to a non-loopback address",
       default: false
     },
+    "tls-cert": {
+      type: "string",
+      description: "Path to a TLS certificate; serve remote access over HTTPS"
+    },
+    "tls-key": {
+      type: "string",
+      description: "Path to the TLS private key matching --tls-cert"
+    },
+    "trust-proxy": {
+      type: "boolean",
+      description: "A reverse proxy in front of CodeSesh terminates TLS",
+      default: false
+    },
     agent: {
       type: "string",
       alias: "a",
@@ -3124,6 +3393,18 @@ var main = defineCommand({
       );
       process.exit(1);
     }
+    let transport;
+    try {
+      transport = resolveRemoteTransport({
+        hostname,
+        tlsCertPath: args["tls-cert"],
+        tlsKeyPath: args["tls-key"],
+        trustProxy: args["trust-proxy"]
+      });
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
     if (trace) {
       perf.enable();
     }
@@ -3137,12 +3418,12 @@ var main = defineCommand({
       log_path: appLogger.getLogPath()
     });
     if (clearCache) {
-      const { clearCache: clear } = await import("./dist-KEPJFHOC.js");
+      const { clearCache: clear } = await import("./dist-ALXOBKV2.js");
       clear();
       appLogger.info("cache.clear");
       console.log("Cache cleared.");
     }
-    void refreshPricingCache();
+    const pricingRefresh = startPricingRefresh();
     let targetSession = null;
     if (args.session) {
       targetSession = parseSessionUri(args.session);
@@ -3186,26 +3467,10 @@ var main = defineCommand({
       console.log(perf.getReport());
     }
     if (jsonOnly) {
-      const windowed = result.sessions.filter((s) => {
-        const activity = s.time_updated ?? s.time_created;
-        if (listDefaultFrom != null && activity < listDefaultFrom) return false;
-        if (listDefaultTo != null && activity > listDefaultTo) return false;
-        return true;
-      });
-      const info = getAgentInfoMap(
-        Object.fromEntries(Object.entries(result.byAgent).map(([k, v]) => [k, v.length]))
-      );
-      const output = {
-        agents: info.map(({ name, displayName, count }) => ({
-          name,
-          displayName,
-          count,
-          available: count > 0
-        })),
-        sessions: windowed
-      };
+      await pricingRefresh.cancel();
+      const output = buildSessionIndexOutput(result, { from: listDefaultFrom, to: listDefaultTo });
       appLogger.info("cli.json_output", {
-        sessions: windowed.length,
+        sessions: output.sessions.length,
         duration_ms: Math.round(performance.now() - startedAt)
       });
       console.log(JSON.stringify(output, null, 2));
@@ -3221,7 +3486,8 @@ var main = defineCommand({
         defaultSessionDays: listDefaultDays,
         portFallbackAttempts: explicitPort ? 1 : DEFAULT_PORT_FALLBACK_ATTEMPTS,
         hostname,
-        remoteAccess
+        remoteAccess,
+        transport
       });
     } catch (error) {
       console.error(getServerStartupErrorMessage(error, port));
@@ -3229,6 +3495,7 @@ var main = defineCommand({
     }
     const { url } = app;
     if (!jsonOnly) {
+      pricingRefresh.publish();
       store.startBackgroundRefresh();
     }
     let shuttingDown = false;
@@ -3236,6 +3503,7 @@ var main = defineCommand({
       if (shuttingDown) return;
       shuttingDown = true;
       appLogger.info("cli.shutdown", { signal });
+      await pricingRefresh.cancel();
       await app.shutdown();
       process.exit(0);
     };