create-walle 0.9.31 → 0.9.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-walle",
-  "version": "0.9.31",
+  "version": "0.9.33",
   "description": "CTM + Wall-E — AI coding dashboard and personal digital twin agent. Multi-agent terminal for Claude Code, Codex, Gemini, Aider, OpenCode, and more, plus prompt editor, task queue, remote phone and tablet access, code/doc review, and an agent that learns from Slack, email & calendar.",
   "bin": {
     "create-walle": "bin/create-walle.js"

package/template/claude-task-manager/api-prompts.js

@@ -61,6 +61,23 @@ const CONVERSATION_IMPORT_EVENT_DRIVEN_MIN_INTERVAL_MS = Math.max(0, Number(
   process.env.CTM_CONVERSATION_IMPORT_EVENT_DRIVEN_MIN_INTERVAL_MS ?? 250));
 const _lastConversationFullRebuildAt = new Map(); // sessionId → Date.now() of last FULL rebuild
 
+// Giant-session RESTART-freeze guard. When a chunked-route session's deferred per-message rows are
+// still backfilling, the O(Δ) append fast-path refuses ('rows-not-appendable') and the caller would
+// fall through to a multi-second full-rebuild blob re-parse — the giant-session restore freeze. We
+// SKIP that rebuild while the rows backfill (the next tick's cheap append succeeds), but bound the
+// deferral with a time window so a stuck/disabled backfill still eventually imports the tail.
+const _fullRebuildDeferSince = new Map(); // sessionId → Date.now() of the FIRST deferred tick
+function _fullRebuildDeferMaxMs() {
+  const raw = Number(process.env.CTM_IMPORT_FULL_REBUILD_DEFER_MAX_MS);
+  return Number.isFinite(raw) && raw >= 0 ? raw : 120000; // 2 min: covers a normal backfill drain
+}
+function _noteFullRebuildDefer(id, now = Date.now()) { if (id && !_fullRebuildDeferSince.has(id)) _fullRebuildDeferSince.set(id, now); }
+function _clearFullRebuildDefer(id) { if (id) _fullRebuildDeferSince.delete(id); }
+function _fullRebuildDeferExpired(id, now = Date.now()) {
+  const t = _fullRebuildDeferSince.get(id);
+  return t != null && (now - t) >= _fullRebuildDeferMaxMs();
+}
+
 // Pure decision: the debounce floor for a hot session's small-growth (append-eligible) re-import.
 // Extracted so the rebuild-thrash guard is unit-testable without the import machinery.
 function _conversationImportFloorMs({ eventDriven, baseFloorMs, eventFloorMs, lastRebuildAt, now }) {
@@ -1595,6 +1612,62 @@ async function _importCompactPair(parsed, jsonlPath, bakPath, jsonlSize, bakSize
   // Skip re-import if total size unchanged AND model already populated
   if (existing && existing.file_size === totalSize && existing.model_provider) return false;
 
+  // INCREMENTAL FAST PATH (giant compacted-session import freeze): the .bak is byte-stable between
+  // compactions, so once the pair is imported a later .jsonl-only growth is a pure append. Re-reading
+  // + re-parsing the (100MB+) .bak and re-stitching the whole 16k-msg conversation every tick is the
+  // freeze (sliceMs 12-17s, coop-ceiling breach, write-lock starvation on restart). When the prior
+  // stitch recorded the SAME .bak size (proving the bak is unchanged ⇒ the prior .jsonl offset is
+  // exact) and the row base is complete, append ONLY the new .jsonl tail [priorJsonlSize, EOF) and
+  // never touch the .bak. Any mismatch (a re-compaction changed the bak, rows not ready, or the append
+  // guard refuses on a prefix/gap) falls through to the safe full re-stitch below.
+  if (existing && coopSchedulerEnabled()
+      && Number(existing.compact_bak_size) > 0
+      && Number(existing.compact_bak_size) === bakSize) {
+    const priorJsonlSize = Number(existing.file_size) - bakSize; // bak unchanged ⇒ exact prior .jsonl size
+    if (priorJsonlSize >= 0 && jsonlSize > priorJsonlSize) {
+      if (typeof db.sessionRowsBackfillPending === 'function' && db.sessionRowsBackfillPending(parsed.sessionId)) {
+        // Rows still backfilling → defer rather than fall through to the full re-stitch slab (time-boxed).
+        _noteFullRebuildDefer(parsed.sessionId);
+        if (!_fullRebuildDeferExpired(parsed.sessionId)) return false;
+        // window expired (stuck/disabled backfill) → fall through to the full re-stitch so the tail still imports
+      } else if (typeof db.sessionContentRowsAvailable === 'function' && db.sessionContentRowsAvailable(parsed.sessionId)) {
+        let tail = '';
+        let fullyRead = false;
+        const fh = await fsp.open(jsonlPath, 'r');
+        try {
+          const len = jsonlSize - priorJsonlSize;
+          const buf = Buffer.alloc(len);
+          // fileHandle.read() may return fewer bytes than requested (the .jsonl is mid-write, or it
+          // was truncated between the stat and this read). A short read would null-pad the tail and
+          // could advance file_size past un-parsed bytes → a permanent message gap. So only take the
+          // fast path on a FULL read; a short read falls through to the always-correct full re-stitch.
+          const { bytesRead } = await fh.read(buf, 0, len, priorJsonlSize);
+          if (bytesRead === len) { tail = buf.toString('utf8'); fullyRead = true; }
+        } finally { await fh.close(); }
+        const tailParsed = fullyRead ? await _parseConversationContent(tail, { fileSessionId: claudeFileSessionId(jsonlPath), fileDir: path.dirname(jsonlPath) }) : null;
+        if (tailParsed && tailParsed.messages && tailParsed.messages.length > 0) {
+          const appended = db.appendSessionConversation({
+            session_id: parsed.sessionId,
+            new_messages: tailParsed.messages,
+            model_id: parsed.modelId || (existing && existing.model_id) || '',
+            model_provider: parsed.modelProvider || (existing && existing.model_provider) || CLAUDE_MODEL_PROVIDER,
+            file_size: totalSize,
+            last_user_content: tailParsed.lastUserContent || '',
+            project_path: parsed.cwd || parsed.project || '',
+            git_branch: parsed.gitBranch || '',
+            title: parsed.title || '',
+            hostname: parsed.hostname || '',
+            rename_name: tailParsed.renameName || '',
+            import_parser_version: DEFAULT_CONVERSATION_IMPORT_PARSER_VERSION,
+          });
+          if (appended && appended.ok) { _clearFullRebuildDefer(parsed.sessionId); return true; }
+        }
+        // no new messages in the tail, or the append guard refused → fall through to the full re-stitch
+      }
+    }
+  }
+  _clearFullRebuildDefer(parsed.sessionId);
+
   const [bakContent, jsonlContent] = await Promise.all([
     fsp.readFile(bakPath, 'utf8').catch(() => ''),
     fsp.readFile(jsonlPath, 'utf8').catch(() => ''),
@@ -1645,6 +1718,9 @@ async function _importCompactPair(parsed, jsonlPath, bakPath, jsonlSize, bakSize
     model_provider: parsed.modelProvider || (existing && existing.model_provider) || CLAUDE_MODEL_PROVIDER,
     model_id: parsed.modelId || (existing && existing.model_id) || '',
     import_parser_version: DEFAULT_CONVERSATION_IMPORT_PARSER_VERSION,
+    // Record the .bak size so a later .jsonl-only growth takes the incremental fast-path above
+    // (append the new tail) instead of re-stitching the whole pair.
+    compact_bak_size: bakSize,
     // Chunked-import route (cold/large): defer rows to content-rows-backfill, keep the real blob.
     ..._chunkedImportFlags(parsed.sessionId, allMessages, totalSize, 'compact-pair'),
   });
@@ -1851,6 +1927,42 @@ function _readResetChunkedRouteStats() {
   return s;
 }
 
+// OBSERVE-ONLY Codex prompt-provenance telemetry (step 1 of docs/codex-prompt-provenance-spec.md).
+// Accumulates the per-import audit summary the Codex parser returns (composer coverage + kept prompts
+// that still look injected) so the eventual provenance flip is gated on real-corpus data, and new
+// injected-context leak shapes surface as a METRIC instead of waiting for someone to spot them in the
+// UI. Cumulative since boot; read via getCodexPromptAuditStats(). No behavior change.
+const _codexPromptAuditStats = {
+  imports: 0, keptUserPrompts: 0, composerCovered: 0, injectedLookingKept: 0,
+  sessionsWithUncovered: 0, sessionsWithInjectedLooking: 0,
+};
+function getCodexPromptAuditStats() {
+  const s = _codexPromptAuditStats;
+  const coverage = s.keptUserPrompts > 0 ? s.composerCovered / s.keptUserPrompts : null;
+  return { ...s, composerCoverage: coverage };
+}
+let _lastCodexAuditLogAt = 0;
+function _recordCodexPromptAudit(sessionId, audit) {
+  if (!audit) return;
+  const kept = Number(audit.keptUserPrompts) || 0;
+  const covered = Number(audit.composerCovered) || 0;
+  const injected = Number(audit.injectedLookingKept) || 0;
+  if (kept === 0 && injected === 0) return; // tail had no user prompts (incremental import) — skip noise
+  const s = _codexPromptAuditStats;
+  s.imports += 1; s.keptUserPrompts += kept; s.composerCovered += covered; s.injectedLookingKept += injected;
+  if (kept > covered) s.sessionsWithUncovered += 1;
+  if (injected > 0) s.sessionsWithInjectedLooking += 1;
+  // Throttled, gated log: always on for a leaked-looking prompt (the actionable signal); otherwise
+  // at most once/30s. CTM_CODEX_PROMPT_AUDIT=0 silences entirely.
+  if (process.env.CTM_CODEX_PROMPT_AUDIT === '0') return;
+  const now = Date.now();
+  if (injected > 0 || now - _lastCodexAuditLogAt > 30000) {
+    _lastCodexAuditLogAt = now;
+    const cov = kept > 0 ? (100 * covered / kept).toFixed(0) + '%' : 'n/a';
+    console.log(`[codex-prompt-audit] sid=${String(sessionId || '').slice(0, 8)} kept=${kept} composerCovered=${covered} (${cov}) injectedLooking=${injected}`);
+  }
+}
+
 function _chunkedImportFlags(sessionId, messages, fileSize, reason) {
   // Gated on the coop scheduler: deferring rows only helps when the cooperative scheduler is driving
   // bounded slices (and the content-rows-backfill coop/legacy job fills the deferred rows). The feature
@@ -1960,6 +2072,10 @@ async function _importCodexSessionFile(parsed, filePath, options = {}) {
 
   const importedFileSize = _codexImportedFileSize(parsed.fileSize, prevFileSize, parsedTail);
 
+  // Observe-only prompt-provenance telemetry (no behavior change). parsedTail.audit summarizes the
+  // newly-parsed tail (incremental import); cumulative stats gate the eventual provenance flip.
+  try { _recordCodexPromptAudit(sessionId, parsedTail && parsedTail.audit); } catch { /* telemetry must never break import */ }
+
   const fileMeta = readCodexRolloutMetadata(filePath) || {};
   const meta = parsedTail.sessionMeta || fileMeta || {};
   const firstUser = userMessages[0]?.text || userMessages[0]?.content || '';
@@ -1986,6 +2102,10 @@ async function _importCodexSessionFile(parsed, filePath, options = {}) {
     rename_name: existing?.rename_name || '',
     git_branch: meta.git_branch || parsed.gitBranch || '',
     file_size: importedFileSize,
+    // file_size above is the consumed-bytes resume HWM (drives cacheBehind); parse_size_bytes is the
+    // TRUE on-disk size used only for the over-cap decision, so a multi-GB rollout whose importedFileSize
+    // under-reports can't slip under the parse cap and throw at JSON.stringify.
+    parse_size_bytes: parsed.fileSize,
     session_created_at: meta.timestamp || parsed.timestamp || '',
     hostname: parsed.hostname,
     model_provider: modelProvider,
@@ -2063,6 +2183,30 @@ const _ingestCooldown = _ingestCooldownBaseMs > 0
   })
   : null;
 
+// Per-file FAILURE backoff for the whole-conversation importer (runIncrementalConversationImport):
+// a file whose importSessionFile() THROWS (e.g. a transiently unreadable file, or — historically — an
+// over-cap rollout that tripped a >512MB stringify) must not be retried every scan tick. A throw earns
+// an exponential cooldown; a clean import (no throw) resets it. Same module/pattern as _ingestCooldown
+// above, but a SEPARATE instance — the two track different concerns on possibly the same path and must
+// not cross-suppress. Disable via CTM_CONVERSATION_IMPORT_FAILURE_COOLDOWN_MS=0.
+const _importFailureCooldownBaseMs = Number(process.env.CTM_CONVERSATION_IMPORT_FAILURE_COOLDOWN_MS ?? 30000);
+const _importFailureCooldown = _importFailureCooldownBaseMs > 0
+  ? createIngestCooldown({
+    baseMs: _importFailureCooldownBaseMs,
+    maxMs: Number(process.env.CTM_CONVERSATION_IMPORT_FAILURE_COOLDOWN_MAX_MS) || undefined,
+  })
+  : null;
+// Map import outcomes onto the cooldown module's {inserted,bytesRead} contract: a throw is a strike
+// (bytesRead>0, inserted=0 → exponential cooldown); a clean run resets (inserted>0).
+function _markImportFailure(filePath) {
+  if (!_importFailureCooldown || !filePath) return null;
+  return _importFailureCooldown.recordResult(filePath, { inserted: 0, bytesRead: 1 });
+}
+function _markImportSuccess(filePath) {
+  if (!_importFailureCooldown || !filePath) return;
+  _importFailureCooldown.recordResult(filePath, { inserted: 1 });
+}
+
 function _ingestTranscriptStoreForParsedFile(filePath, parsed, options = {}) {
   // Claude Desktop sessions use a virtual path (`…#ctm-claude-desktop=<uuid>`) that is never a
   // real file on disk — fs.statSync / ingestJsonlFile always throw ENOENT on it. Their
@@ -2279,8 +2423,27 @@ async function importSessionFile(filePath, projectPath, projectEntry, options =
       // Cheap O(Δ) append succeeded — clear any rebuild backoff so event-driven mode
       // tracks this session's live tail at the fast cadence.
       _lastConversationFullRebuildAt.delete(parsed.sessionId);
+      _clearFullRebuildDefer(parsed.sessionId);
       return true;
     }
+    // RESTART-freeze guard: the append refused ONLY because this chunked-route session's deferred
+    // rows are still backfilling. Do NOT fall through to the multi-second full-rebuild blob re-parse
+    // (the giant-session restore freeze that holds the write lock and starves other writers). Skip
+    // this tick — content-rows-backfill completes the rows, then the next tick's O(Δ) append
+    // succeeds. The existing blob keeps serving reads; the tail lands a tick later. A time-boxed
+    // escape (_fullRebuildDeferExpired) ensures a stuck/disabled backfill still imports the tail.
+    if (appended && appended.reason === 'rows-not-appendable'
+        && coopSchedulerEnabled()
+        && typeof db.sessionRowsBackfillPending === 'function'
+        && db.sessionRowsBackfillPending(parsed.sessionId)) {
+      _noteFullRebuildDefer(parsed.sessionId); // stamp the first deferred tick, then measure the window from it
+      if (!_fullRebuildDeferExpired(parsed.sessionId)) {
+        return false; // within the defer window → skip the full-rebuild slab; re-picked next tick (file_size
+                      // unchanged → cacheBehind), debounced by the import floor, after backfill advances
+      }
+      // defer window expired (stuck/disabled backfill) → fall through to the full rebuild so the tail still imports
+    }
+    _clearFullRebuildDefer(parsed.sessionId);
   }
 
   // Full rebuild: cold import, file shrank/rotated, or the append guard refused. Load the base
@@ -2408,6 +2571,10 @@ async function runIncrementalConversationImport(opts = {}) {
     // synchronous SQLite upsert/JSON.stringify at the end, so do not stack
     // several imports in the same event-loop turn.
     for (const { filePath, projectPath, projectEntry, sessionId: candidateSessionId, error } of candidates) {
+      // A file that threw recently is cooling down — skip it WITHOUT counting toward scanned/limits
+      // (so it doesn't starve healthy files) and WITHOUT stamping the per-session debounce. It will be
+      // re-attempted once its time-windowed cooldown elapses (candidate selection re-runs each tick).
+      if (_importFailureCooldown && filePath && _importFailureCooldown.shouldSkip(filePath)) continue;
       try {
         if (error) throw error;
         scanned++;
@@ -2415,6 +2582,8 @@ async function runIncrementalConversationImport(opts = {}) {
           cooperative: true,
           transcriptMaxBytes: _backgroundTranscriptImportMaxBytes(),
         })) imported++;
+        // A clean run (no throw) clears any prior failure strike for this file.
+        _markImportSuccess(filePath);
         // Stamp the debounce clock for this session (whether or not a row was written) so a hot
         // session's rapid small appends coalesce instead of re-importing the whole conversation
         // every tick. Best-effort — keyed by the candidate's resolved session id.
@@ -2437,6 +2606,11 @@ async function runIncrementalConversationImport(opts = {}) {
         // Log individual failures so they're visible (previously swallowed silently).
         // One bad file shouldn't stall the whole job — we continue with others.
         console.error(`[auto-import] Failed to import ${filePath.split('/').pop()}: ${e.message}`);
+        // Earn an exponential cooldown so a file that throws every time stops being retried each tick.
+        const _cd = _markImportFailure(filePath);
+        if (_cd && _cd.cooling && _cd.strikes === 1) {
+          console.warn(`[auto-import] cooling down ${filePath.split('/').pop()} after import failure (cooldown=${_cd.cooldownMs}ms)`);
+        }
       }
     }
 
@@ -2468,6 +2642,78 @@ async function runIncrementalConversationImport(opts = {}) {
   }
 }
 
+async function importConversationSources(opts = {}) {
+  const requested = Array.isArray(opts.sourceIds) ? opts.sourceIds : [opts.sourceId || opts.sessionId];
+  const sourceIds = [...new Set(requested.map(v => String(v || '').trim()).filter(Boolean))];
+  const maxSources = Math.max(1, Math.min(20, Number(opts.maxSources) || sourceIds.length || 1));
+  const results = [];
+  const seenAgents = new Set();
+  let scanned = 0;
+  let imported = 0;
+  let failed = 0;
+  let missing = 0;
+
+  for (const sourceId of sourceIds.slice(0, maxSources)) {
+    let identity = null;
+    try { identity = db.getSessionIdentity(sourceId); } catch {}
+    let rows = Array.isArray(identity?.agents) ? identity.agents : [];
+    if (identity?.requested_is_agent) {
+      rows = rows.filter(r => r && r.agent_session_id === sourceId);
+    }
+    if (rows.length === 0) {
+      missing++;
+      results.push({ sourceId, imported: false, reason: 'no-agent-session' });
+      continue;
+    }
+
+    for (const row of rows) {
+      const agentId = String(row?.agent_session_id || '').trim();
+      if (!agentId || seenAgents.has(agentId)) continue;
+      seenAgents.add(agentId);
+
+      const configuredPath = String(row?.jsonl_path || '').trim();
+      if (!configuredPath) {
+        missing++;
+        results.push({ sourceId, agentId, imported: false, reason: 'no-jsonl-path' });
+        continue;
+      }
+
+      let importPath = configuredPath;
+      try {
+        if (!fs.existsSync(importPath) && fs.existsSync(`${configuredPath}.bak`)) {
+          importPath = `${configuredPath}.bak`;
+        }
+        if (!fs.existsSync(importPath)) {
+          missing++;
+          results.push({ sourceId, agentId, imported: false, reason: 'missing-file' });
+          continue;
+        }
+      } catch (e) {
+        failed++;
+        results.push({ sourceId, agentId, imported: false, error: e.message });
+        continue;
+      }
+
+      const projectPath = row.project_path || identity?.ctm?.project_path || path.dirname(configuredPath);
+      const projectEntry = path.basename(path.dirname(importPath.replace(/\.bak$/, '')));
+      try {
+        scanned++;
+        const ok = await importSessionFile(importPath, projectPath, projectEntry, {
+          cooperative: true,
+          transcriptMaxBytes: _backgroundTranscriptImportMaxBytes(),
+        });
+        if (ok) imported++;
+        results.push({ sourceId, agentId, imported: !!ok, file: path.basename(importPath) });
+      } catch (e) {
+        failed++;
+        results.push({ sourceId, agentId, imported: false, error: e.message });
+      }
+    }
+  }
+
+  return { imported, scanned, failed, missing, sourceIds: sourceIds.slice(0, maxSources), results };
+}
+
 // --- Cursor conversation import ----------------------------------------------
 // Cursor stores conversations as a content-addressed blob graph in its own SQLite
 // store (~/.cursor/chats/<ws>/<agent>/store.db), NOT a JSONL append log. Reconstructing
@@ -2572,6 +2818,165 @@ async function runCursorConversationImport({ cursorHome } = {}) {
   }
 }
 
+const OPENCODE_IMPORT_PARSER_VERSION = 1; // bump to force a full opencode re-import on shape change
+const _opencodeImportSignatures = new Map();   // ctm_session_id → last-imported per-session signature
+const _opencodeDbStatSignature = { value: '' }; // whole-DB freshness gate (skip the sweep when idle)
+
+// Resolve which OpenCode session (ses_…) belongs to a CTM session. OpenCode never surfaces its id
+// to CTM, so: (1) prefer an already-pinned agent_sessions link (confident exact id), else (2) match
+// opencode.db `session.directory` to the CTM cwd, nearest time_created ≥ created_at, and PIN that id
+// into agent_sessions so every later import is an exact-id read. Mirrors cursor's cwd+time fallback.
+function _resolveOpencodeSessionId(opencodeStore, dbPath, cwd, createdAt, agentSessionIds) {
+  for (const id of agentSessionIds) {
+    if (String(id || '').startsWith('ses_')) return { sessionId: id, pinned: true };
+  }
+  const candidates = opencodeStore.listOpencodeSessionsForCwd(dbPath, cwd);
+  if (!candidates.length) return null;
+  const targetMs = Date.parse(createdAt) || 0;
+  let best = candidates[0]; // newest-first; default to most recent
+  if (targetMs) {
+    const atOrAfter = candidates
+      .filter(c => Number(c.time_created) >= targetMs - 60000)
+      .sort((a, b) => Number(a.time_created) - Number(b.time_created));
+    if (atOrAfter.length) best = atOrAfter[0];
+  }
+  return { sessionId: String(best.id), pinned: false };
+}
+
+// Eagerly pin the OpenCode session id (ses_…) for ONE CTM session, synchronously, at restore/resume
+// time. The full conversation sweep (runOpencodeConversationImport) runs async and may not have pinned
+// the id yet when a tab is restored — without a pinned ses_ row, restart-restore has nothing to resume
+// (orderedAgentRows requires a non-empty agent_session_id) and would relaunch the fresh `opencode` splash.
+// This factors out the importer's resolve+pin step (no message import) so the agent_sessions link exists
+// before selectRestoreAgentSession runs. Best-effort: any failure (db missing/locked) falls through and
+// resume degrades to `opencode --continue`. Returns { sessionId, pinned } or null when nothing resolves.
+function ensureOpencodeSessionPinned(ctmSessionId, { opencodeHome } = {}) {
+  const ctmId = String(ctmSessionId || '').trim();
+  if (!ctmId) return null;
+  let opencodeStore;
+  try {
+    opencodeStore = require('./lib/opencode-conversation-store');
+  } catch {
+    return null;
+  }
+  try {
+    const s = db.getDb().prepare(
+      "SELECT cwd, project_path, created_at FROM ctm_sessions WHERE id = ? AND provider = 'opencode'"
+    ).get(ctmId);
+    if (!s) return null;
+    const cwd = String(s.cwd || s.project_path || '').trim();
+    if (!cwd) return null;
+    const agentRows = db.getDb().prepare(
+      "SELECT agent_session_id FROM agent_sessions WHERE ctm_session_id = ? AND agent_session_id IS NOT NULL AND agent_session_id != ''"
+    ).all(ctmId);
+    const agentSessionIds = agentRows.map(r => String(r.agent_session_id)).filter(Boolean);
+
+    const dbPath = opencodeStore.OPENCODE_DB_PATH(opencodeHome);
+    const resolved = _resolveOpencodeSessionId(opencodeStore, dbPath, cwd, s.created_at, agentSessionIds);
+    if (!resolved) return null;
+    if (resolved.pinned) return resolved; // a ses_… is already linked; nothing to do
+    try {
+      const store = opencodeStore.loadOpencodeSession(dbPath, resolved.sessionId);
+      db.upsertAgentSessionIdentity(resolved.sessionId, {
+        ctmSessionId: ctmId,
+        provider: 'opencode',
+        projectPath: (store && store.directory) || cwd,
+        model: (store && store.model_id) || '',
+      });
+    } catch { /* link is best-effort; cwd+time still resolves on the next pass */ }
+    return resolved;
+  } catch {
+    return null;
+  }
+}
+
+// Import OpenCode conversations into session_conversations. OpenCode keeps every session in one
+// SQLite DB (~/.local/share/opencode/opencode.db) rather than per-session JSONL, so — like cursor —
+// it uses this dedicated DB-reader path, not the file-stat importer. Runs on the db-owner worker.
+async function runOpencodeConversationImport({ opencodeHome } = {}) {
+  let imported = 0, scanned = 0, skipped = 0, failed = 0, total = 0;
+  let opencodeStore;
+  try {
+    opencodeStore = require('./lib/opencode-conversation-store');
+  } catch (e) {
+    return { imported, scanned, skipped, failed, total, error: `opencode store unavailable: ${e.message}` };
+  }
+  const dbPath = opencodeStore.OPENCODE_DB_PATH(opencodeHome);
+  // Whole-DB freshness gate: nothing in opencode.db changed since the last sweep → skip entirely.
+  const dbSig = opencodeStore.statSignature(dbPath);
+  if (dbSig && dbSig === _opencodeDbStatSignature.value) {
+    return { imported, scanned, skipped, failed, total, skippedAll: true };
+  }
+  try {
+    const sessions = db.getDb().prepare(
+      "SELECT id, cwd, project_path, created_at, updated_at FROM ctm_sessions WHERE provider = 'opencode'"
+    ).all();
+    total = sessions.length;
+    for (const s of sessions) {
+      try {
+        scanned += 1;
+        const ctmId = String(s.id);
+        const cwd = String(s.cwd || s.project_path || '').trim();
+        if (!cwd) continue;
+        const agentRows = db.getDb().prepare(
+          "SELECT agent_session_id FROM agent_sessions WHERE ctm_session_id = ? AND agent_session_id IS NOT NULL AND agent_session_id != ''"
+        ).all(ctmId);
+        const agentSessionIds = agentRows.map(r => String(r.agent_session_id)).filter(Boolean);
+
+        const resolved = _resolveOpencodeSessionId(opencodeStore, dbPath, cwd, s.created_at, agentSessionIds);
+        if (!resolved) continue;
+        const ocId = resolved.sessionId;
+
+        // Cheap per-session signature gate — skip when this session is unchanged since last import.
+        const sig = opencodeStore.sessionSignature(dbPath, ocId);
+        if (sig && _opencodeImportSignatures.get(ctmId) === sig) { skipped += 1; continue; }
+
+        const store = opencodeStore.loadOpencodeSession(dbPath, ocId);
+        if (!store || !Array.isArray(store.messages) || store.messages.length === 0) continue;
+        const fields = opencodeStore.opencodeSessionToConversationFields(store);
+        if (fields.user_msg_count === 0) continue;
+
+        // Pin the resolved id so future imports are confident exact-id reads (user-selected capture).
+        if (!resolved.pinned) {
+          try {
+            db.upsertAgentSessionIdentity(ocId, {
+              ctmSessionId: ctmId, provider: 'opencode', projectPath: store.directory || cwd,
+              model: store.model_id || '', firstMessage: fields.first_message || '',
+            });
+          } catch { /* link is best-effort; cwd+time still resolves next pass */ }
+        }
+
+        db.importSessionConversation({
+          session_id: ctmId,
+          ...fields,
+          title: store.title || '',
+          git_branch: '',
+          file_size: 0, // opencode has no single jsonl footprint; freshness is gated by `sig`
+          session_created_at: fields.session_created_at || s.created_at || '',
+          hostname: '',
+          import_parser_version: OPENCODE_IMPORT_PARSER_VERSION,
+          rename_name: '',
+          ..._chunkedImportFlags(ctmId, fields.messages, 0, 'opencode'),
+        });
+        if (sig) _opencodeImportSignatures.set(ctmId, sig);
+        imported += 1;
+        await new Promise((resolve) => setImmediate(resolve));
+      } catch (e) {
+        failed += 1;
+        console.error(`[opencode-import] ${String(s.id).slice(0, 8)}: ${e.message}`);
+      }
+    }
+    if (imported || failed) {
+      console.log(`[opencode-import] imported ${imported}, skipped ${skipped}, failed ${failed} (scanned ${scanned}/${total})`);
+    }
+    _opencodeDbStatSignature.value = dbSig;
+    return { imported, scanned, skipped, failed, total };
+  } catch (e) {
+    console.error('[opencode-import] Top-level error:', e.message);
+    return { imported, scanned, skipped, failed, total, error: e.message };
+  }
+}
+
 function handleGetConversation(req, res, url) {
   const sessionId = url.pathname.split('/').pop();
   const conv = db.getSessionConversation(sessionId);
@@ -5323,4 +5728,4 @@ function safeParse(json, fallback) {
   try { return JSON.parse(json); } catch { return fallback; }
 }
 
-module.exports = { handlePromptApi, handleConvertDesktopSession, handleListDesktopForks, queueEngine, runIncrementalConversationImport, runCursorConversationImport, importSessionFile, _chunkedImportFlags, setUiPrefsBroadcaster, setPromptExecutionsOffThread, setDbMaintenanceRunner, setImageSaveRunner, ensureHotkeyDaemon, hotkeyEnsureAction, screenshotResponsibleContext, screenshotNodeCandidates, probeScreenshotNodeGranted, _ingestPathFromInput, _ingestSourceAllowed, _conversationImportCandidates, _ingestTranscriptStoreForParsedFile, _learnSignatureRules, _appendBlocklistExceptions, _finalizePermIntent, _denyHinted, _lastConversationImportAt, _conversationImportFloorMs, _lastConversationFullRebuildAt };
+module.exports = { handlePromptApi, handleConvertDesktopSession, handleListDesktopForks, queueEngine, runIncrementalConversationImport, importConversationSources, runCursorConversationImport, runOpencodeConversationImport, ensureOpencodeSessionPinned, importSessionFile, _chunkedImportFlags, setUiPrefsBroadcaster, setPromptExecutionsOffThread, setDbMaintenanceRunner, setImageSaveRunner, ensureHotkeyDaemon, hotkeyEnsureAction, screenshotResponsibleContext, screenshotNodeCandidates, probeScreenshotNodeGranted, _ingestPathFromInput, _ingestSourceAllowed, _conversationImportCandidates, _ingestTranscriptStoreForParsedFile, _learnSignatureRules, _appendBlocklistExceptions, _finalizePermIntent, _denyHinted, _lastConversationImportAt, _conversationImportFloorMs, _lastConversationFullRebuildAt, getCodexPromptAuditStats };