codesesh 1.0.3 → 1.0.5

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center"><strong>One place to see every AI coding session you've ever had.</strong></p>
 
-CodeSesh scans your local machine, finds every AI agent session (Claude Code, Cursor, Kimi, Kimi-Code, Codex, Grok, Pi, OpenCode, ZCode, DSH), and surfaces them in a unified, beautiful Web UI.
+CodeSesh scans your local machine, finds sessions from supported AI coding agents, and surfaces them in a unified Web UI.
 
 ## Quick Start
 
@@ -41,11 +41,13 @@ Your browser will open at `http://localhost:4521` with all your sessions ready t
 
 ## Supported Agents
 
+<!-- repo-fact:agents:start -->
+
 | Agent       | Status       |
 | ----------- | ------------ |
 | Claude Code | ✅ Supported |
 | Cursor      | ✅ Supported |
-| Kimi        | ✅ Supported |
+| Kimi-Cli    | ✅ Supported |
 | Kimi-Code   | ✅ Supported |
 | Codex       | ✅ Supported |
 | Grok        | ✅ Supported |
@@ -54,6 +56,8 @@ Your browser will open at `http://localhost:4521` with all your sessions ready t
 | ZCode       | ✅ Supported |
 | DSH         | ✅ Supported |
 
+<!-- repo-fact:agents:end -->
+
 ## Usage
 
 ```bash
@@ -63,7 +67,7 @@ npx codesesh
 # Choose a custom starting port
 npx codesesh --port 8080
 
-# Only show sessions active in the last 3 days
+# Only show sessions active in the last 3 local calendar days
 npx codesesh --days 3
 
 # Jump directly to a session
@@ -88,15 +92,16 @@ npx codesesh --trace
 | ----------- | ----- | ------- | ----------------------------------------------------------- |
 | `--port`    | `-p`  | `4521`  | HTTP server starting port; falls back to the next available port if busy |
 | `--host`    | —     | `127.0.0.1` | HTTP server bind address; non-loopback values require `--remote-access` |
-| `--remote-access` | — | `false` | Enable token-protected access for any remotely exposed transport     |
+| `--remote-access` | — | `false` | Allow network or reverse-proxy exposure; every API mode uses a token |
 | `--tls-cert` | — | — | Path to a TLS certificate; serves remote access over HTTPS            |
 | `--tls-key` | — | — | Path to the private key matching `--tls-cert`                          |
 | `--trust-proxy` | — | `false` | A reverse proxy in front of CodeSesh terminates TLS                    |
-| `--days`    | `-d`  | `7`     | Only include sessions active in the last N days (`0` = all time) |
+| `--public-url` | — | — | Public HTTPS origin used with `--trust-proxy` for startup links       |
+| `--days`    | `-d`  | `7`     | Only include sessions active in the last N local calendar days (`0` = all time) |
 | `--cwd`     | —     | —       | Filter to sessions from a project directory                 |
 | `--agent`   | `-a`  | all     | Filter to specific agent(s), comma-separated                |
-| `--from`    | —     | —       | Sessions active after this date `YYYY-MM-DD`                |
-| `--to`      | —     | —       | Sessions active before this date `YYYY-MM-DD`               |
+| `--from`    | —     | —       | Sessions active on or after this date `YYYY-MM-DD`          |
+| `--to`      | —     | —       | Sessions active on or before this date `YYYY-MM-DD`         |
 | `--session` | `-s`  | —       | Directly open a session (`agent://session-id`)              |
 | `--json`    | `-j`  | `false` | Print the session index as JSON and exit (metadata only)    |
 | `--no-open` | —     | `false` | Don't auto-open the browser                                 |
@@ -105,10 +110,11 @@ npx codesesh --trace
 | `--clear-cache` | — | `false` | Clear scan cache before starting                            |
 | `-v`        | —     | —       | Print version number                                        |
 
-Non-loopback binding and `--trust-proxy` both require `--remote-access`. This includes the common
-setup where CodeSesh listens on `127.0.0.1` and a same-machine reverse proxy exposes it publicly.
-CodeSesh prints a startup URL containing a fresh access token. Anyone with that URL can read the
-indexed AI session history, so treat it as a password and do not share or persist it.
+Every CodeSesh server process protects its API with a fresh access token, including the default
+loopback listener, and prints that token in the startup URL. Non-loopback binding requires
+`--remote-access`. A trusted proxy also requires `--remote-access`, a loopback `--host`, and an
+HTTPS `--public-url`. Anyone with the startup URL can read the indexed AI session history, so treat
+it as a password and do not share or persist it.
 
 A token authenticates the requester but does not encrypt traffic. Without TLS, the token and full
 session content travel over the network in plaintext, and URL tokens may be recorded in proxy logs.
@@ -119,11 +125,13 @@ Use one of these protected transports:
 npx codesesh --host 0.0.0.0 --remote-access --tls-cert ./cert.pem --tls-key ./key.pem
 
 # A reverse proxy terminates TLS; CodeSesh stays bound to loopback
-npx codesesh --host 127.0.0.1 --remote-access --trust-proxy
+npx codesesh --host 127.0.0.1 --remote-access --trust-proxy \
+  --public-url https://codesesh.example.com
 ```
 
-`--trust-proxy` requires `X-Forwarded-Proto: https` on every API request. The listener must remain
-unreachable except through that trusted proxy.
+`--trust-proxy` requires `X-Forwarded-Proto: https` on every API request. That header validates the
+proxy configuration but cannot identify its sender, so CodeSesh enforces a loopback backend rather
+than trusting the header as a network boundary. Startup links use the configured `--public-url`.
 
 ## Requirements