elepha 0.1.0

package/dist/storage/rollup-store.js

@@ -0,0 +1,246 @@
+// Persistence for session-level rollups.
+//
+// The hard problem here is idempotency. `memories` is protected by
+// UNIQUE(session_id, turn_index): re-processing a turn is a no-op. A rollup is
+// a MUTABLE AGGREGATE with no such guard - applying the same new turns twice
+// would double-count decisions, resurrect resolved pending_items, and inflate
+// turn_count. And re-processing is not hypothetical: "closed" is a heuristic
+// (file idle), and Codex Desktop reopens sessions days later and appends to the
+// original rollout, so final -> live -> final can repeat indefinitely.
+//
+// Two independent guards, either of which alone would be sufficient:
+//
+//  1. WATERMARK, enforced in SQL. rolled_up_through_turn_index advances in the
+//     SAME transaction that writes the content it accounts for, and the write
+//     is conditional on the watermark still being where the caller read it
+//     (`WHERE rolled_up_through_turn_index = :expected`). A duplicate or
+//     concurrent apply finds the watermark moved and writes nothing. A crash
+//     between the LLM call and the commit costs one wasted call and changes
+//     nothing on disk.
+//  2. SET SEMANTICS in the merge itself. decisions dedupe by `what`,
+//     pending_items and files_touched by value. Applying the same merge twice
+//     yields the same arrays.
+import { dedupePaths } from '../config/paths.js';
+import { escapeShellSyntax, stripShellSyntax } from '../security/sanitize.js';
+/**
+ * Every rollup from the old schema is stale, for three independent reasons
+ * that all landed together so the corpus is rebuilt once rather than three
+ * times:
+ *
+ *  - the prompt builder end-truncated its input, so on large sessions the
+ *    newest turns never reached the model (measured: 83% of all lost decisions);
+ *  - decisions now carry `turnIndex`/`at` provenance, assigned in code;
+ *  - `why` is now captured at the turn, where the transcript is still in the
+ *    prompt, instead of being inferred afterwards from the decision text.
+ *
+ * `elepha rollup --rebuild` is what actually reaches them: the default sweep
+ * skips `final` rollups.
+ */
+export const ROLLUP_VERSION = 2;
+/**
+ * Newest-first by provenance. Decisions with no `turnIndex` (pre-provenance
+ * rows) sort oldest, which is both true and the safe direction: they are never
+ * preferred over a decision we can actually place in time.
+ */
+export function sortDecisionsByTurn(decisions) {
+    return [...decisions].sort((a, b) => (b.turnIndex ?? -1) - (a.turnIndex ?? -1));
+}
+/**
+ * The newest K decisions, in turn order. This is the selection the brief and
+ * the carried-rollup budget both need, and it lives HERE, in code, rather than
+ * in a prompt instruction - the merge model demonstrably drops new decisions
+ * when asked politely not to, and a selection rule that the model can violate
+ * is not a selection rule.
+ */
+export function newestDecisions(decisions, k) {
+    return sortDecisionsByTurn(decisions)
+        .slice(0, k)
+        .sort((a, b) => (a.turnIndex ?? -1) - (b.turnIndex ?? -1));
+}
+function hydrate(row) {
+    if (!row) {
+        return undefined;
+    }
+    return {
+        ...row,
+        decisions: JSON.parse(row.decisions),
+        pending_items: JSON.parse(row.pending_items),
+        files_touched: JSON.parse(row.files_touched),
+    };
+}
+/** Merges two rollup halves with set semantics, so applying the same merge twice is a no-op. */
+export function mergeRollupContent(previous, incoming) {
+    const byWhat = new Map();
+    for (const d of [...previous.decisions, ...incoming.decisions]) {
+        // Sanitize-normalized key. `previous` was read back from the store and
+        // is therefore already escaped (Rule 3 runs in write() below), while
+        // `incoming` is raw summarizer output. Keying on the raw text would
+        // make the same decision hash two different ways across the sanitize
+        // boundary and defeat the dedupe that makes this merge idempotent.
+        const key = escapeShellSyntax(d.what).trim().toLowerCase();
+        const seen = byWhat.get(key);
+        if (!seen) {
+            byWhat.set(key, d);
+            continue;
+        }
+        // Same decision seen twice: keep the EARLIEST turn_index, because the
+        // first occurrence is when the choice was actually made - a later
+        // restatement is the model repeating itself, not a new decision. But
+        // prefer any provenance over none, so a pre-provenance row does not
+        // block a placed one.
+        if (seen.turnIndex === undefined && d.turnIndex !== undefined) {
+            byWhat.set(key, { ...seen, turnIndex: d.turnIndex, at: d.at });
+        }
+        else if (seen.turnIndex !== undefined && d.turnIndex !== undefined && d.turnIndex < seen.turnIndex) {
+            byWhat.set(key, { ...seen, turnIndex: d.turnIndex, at: d.at });
+        }
+    }
+    // pending_items come from the merge model, which is told to drop resolved
+    // ones - so incoming REPLACES rather than unions, otherwise a resolved item
+    // could never leave the list.
+    const pendingItems = [...new Set(incoming.pendingItems.map((p) => p.trim()).filter(Boolean))];
+    return {
+        // Stored in turn order, oldest first, so array position carries meaning
+        // and "the newest K" is a slice rather than a search.
+        decisions: [...byWhat.values()].sort((a, b) => (a.turnIndex ?? -1) - (b.turnIndex ?? -1)),
+        pendingItems,
+        filesTouched: dedupePaths([...previous.filesTouched, ...incoming.filesTouched]),
+    };
+}
+export class RollupStore {
+    db;
+    stmts;
+    constructor(db) {
+        this.db = db;
+        this.stmts = {
+            get: db.prepare('SELECT * FROM session_rollups WHERE session_id = ?'),
+            // Upsert, not a plain insert: this path serves both the first
+            // rollup and a rollup_version rebuild, where a row already exists
+            // and must be replaced wholesale rather than merged onto.
+            insert: db.prepare(`INSERT INTO session_rollups
+           (session_id, project_id, tool, title, summary, decisions, pending_items, files_touched,
+            turn_count, started_at, ended_at, kind, parent_session_id, summarizer_status,
+            rollup_state, rolled_up_through_turn_index, computed_at, rollup_version)
+         VALUES (@session_id, @project_id, @tool, @title, @summary, @decisions, @pending_items, @files_touched,
+            @turn_count, @started_at, @ended_at, @kind, @parent_session_id, @summarizer_status,
+            @rollup_state, @through, @now, @version)
+         ON CONFLICT (session_id) DO UPDATE SET
+           title = excluded.title, summary = excluded.summary, decisions = excluded.decisions,
+           pending_items = excluded.pending_items, files_touched = excluded.files_touched,
+           turn_count = excluded.turn_count, started_at = excluded.started_at, ended_at = excluded.ended_at,
+           kind = excluded.kind, parent_session_id = excluded.parent_session_id,
+           summarizer_status = excluded.summarizer_status,
+           rollup_state = excluded.rollup_state,
+           rolled_up_through_turn_index = excluded.rolled_up_through_turn_index,
+           computed_at = excluded.computed_at, rollup_version = excluded.rollup_version`),
+            // Conditional on the watermark the caller observed: a second apply
+            // of the same turns finds it already advanced and changes nothing.
+            updateIfWatermark: db.prepare(`UPDATE session_rollups SET
+           title = @title, summary = @summary, decisions = @decisions,
+           pending_items = @pending_items, files_touched = @files_touched,
+           turn_count = @turn_count, ended_at = @ended_at,
+           summarizer_status = @summarizer_status,
+           rollup_state = @rollup_state, rolled_up_through_turn_index = @through,
+           computed_at = @now, rollup_version = @version
+         WHERE session_id = @session_id AND rolled_up_through_turn_index = @expected`),
+            markLive: db.prepare(`UPDATE session_rollups SET rollup_state = 'live' WHERE session_id = ? AND rollup_state = 'final'`),
+            listByProject: db.prepare('SELECT * FROM session_rollups WHERE project_id = ? ORDER BY ended_at DESC'),
+        };
+    }
+    get(sessionId) {
+        return hydrate(this.stmts.get.get(sessionId));
+    }
+    /**
+     * Writes a rollup. `expectedThroughTurnIndex` is the watermark the caller
+     * read before computing; the update only lands if it hasn't moved since.
+     * Returns false when the write was rejected as already-applied - that is a
+     * normal outcome, not an error.
+     */
+    write(w, expectedThroughTurnIndex) {
+        // Security Rule 3 CHOKE POINT, not caller discipline: a caller can
+        // forget, a store cannot. Display strings are stripped (the
+        // metacharacter carries nothing there); decisions are escaped, because
+        // a decision may legitimately need to name the syntax it ruled out.
+        const params = {
+            session_id: w.sessionId,
+            project_id: w.projectId,
+            tool: w.tool,
+            title: stripShellSyntax(w.title),
+            summary: stripShellSyntax(w.summary),
+            decisions: JSON.stringify(w.decisions.map((d) => ({
+                what: escapeShellSyntax(d.what),
+                why: escapeShellSyntax(d.why),
+                ...(d.turnIndex !== undefined ? { turnIndex: d.turnIndex } : {}),
+                ...(d.at !== undefined ? { at: d.at } : {}),
+            }))),
+            pending_items: JSON.stringify(w.pendingItems.map(stripShellSyntax)),
+            files_touched: JSON.stringify(dedupePaths(w.filesTouched)),
+            turn_count: w.turnCount,
+            started_at: w.startedAt,
+            ended_at: w.endedAt,
+            kind: w.kind,
+            parent_session_id: w.parentSessionId,
+            summarizer_status: w.summarizerStatus,
+            rollup_state: w.state,
+            through: w.throughTurnIndex,
+            now: new Date().toISOString(),
+            version: w.rollupVersion ?? ROLLUP_VERSION,
+        };
+        const run = this.db.transaction(() => {
+            if (expectedThroughTurnIndex === undefined) {
+                this.stmts.insert.run(params);
+                return true;
+            }
+            return this.stmts.updateIfWatermark.run({ ...params, expected: expectedThroughTurnIndex }).changes > 0;
+        });
+        return run();
+    }
+    /** Reopened session: a final rollup returns to live so the next close recomputes it incrementally. */
+    markLive(sessionId) {
+        this.stmts.markLive.run(sessionId);
+    }
+    listByProject(projectId) {
+        return this.stmts.listByProject.all(projectId).map((r) => hydrate(r));
+    }
+    /**
+     * The listing view: top-level sessions with their sub-agent work attached,
+     * rather than sub-agents competing for space as peers. Sub-agents are 36% of
+     * Claude Code sessions locally (16 of 44) at a median of one turn each, so
+     * listing them flat buries the real sessions.
+     *
+     * Nothing is deleted from storage, and every child stays reachable through
+     * its parent. The served read model computes substance, so this
+     * legacy rollup listing no longer reads the inert stored column.
+     */
+    listSessions(projectId, options = {}) {
+        const all = this.listByProject(projectId);
+        const childrenByParent = new Map();
+        for (const r of all) {
+            if (r.parent_session_id == null) {
+                continue;
+            }
+            const bucket = childrenByParent.get(r.parent_session_id);
+            if (bucket) {
+                bucket.push(r);
+            }
+            else {
+                childrenByParent.set(r.parent_session_id, [r]);
+            }
+        }
+        const entries = [];
+        for (const rollup of all) {
+            const isChild = rollup.parent_session_id != null;
+            // A child whose parent is present in this project is surfaced under
+            // the parent. An orphaned child (parent never ingested, or in
+            // another project) is still listed on its own - hiding it would
+            // lose it entirely.
+            const parentPresent = isChild && all.some((r) => r.session_id === rollup.parent_session_id);
+            if (parentPresent && !options.includeAll) {
+                continue;
+            }
+            entries.push({ rollup, children: childrenByParent.get(rollup.session_id) ?? [] });
+        }
+        return entries;
+    }
+}
+//# sourceMappingURL=rollup-store.js.map

package/dist/storage/rollup-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollup-store.js","sourceRoot":"","sources":["../../src/storage/rollup-store.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,mEAAmE;AACnE,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,gFAAgF;AAChF,uEAAuE;AACvE,EAAE;AACF,qEAAqE;AACrE,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,uBAAuB;AACvB,qEAAqE;AACrE,8EAA8E;AAC9E,8BAA8B;AAG9B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAmBhC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAA2B;IAC3D,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,SAA2B,EAAE,CAAS;IAClE,OAAO,mBAAmB,CAAC,SAAS,CAAC;SAChC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAwDD,SAAS,OAAO,CAAC,GAA6B;IAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO;QACH,GAAG,GAAG;QACN,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QACpC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;QAC5C,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;KAC/C,CAAC;AACN,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,kBAAkB,CAC9B,QAAyF,EACzF,QAAyF;IAEzF,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACnB,SAAS;QACb,CAAC;QACD,sEAAsE;QACtE,kEAAkE;QAClE,qEAAqE;QACrE,oEAAoE;QACpE,sBAAsB;QACtB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC;aAAM,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YACnG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC;IACL,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,8BAA8B;IAC9B,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9F,OAAO;QACH,wEAAwE;QACxE,sDAAsD;QACtD,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC;QACzF,YAAY;QACZ,YAAY,EAAE,WAAW,CAAC,CAAC,GAAG,QAAQ,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;KAClF,CAAC;AACN,CAAC;AAED,MAAM,OAAO,WAAW;IACH,EAAE,CAAW;IACb,KAAK,CAMpB;IAEF,YAAY,EAAY;QACpB,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,KAAK,GAAG;YACT,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC;YACrE,8DAA8D;YAC9D,kEAAkE;YAClE,0DAA0D;YAC1D,MAAM,EAAE,EAAE,CAAC,OAAO,CACd;;;;;;;;;;;;;;;wFAewE,CAC3E;YACD,mEAAmE;YACnE,mEAAmE;YACnE,iBAAiB,EAAE,EAAE,CAAC,OAAO,CACzB;;;;;;;qFAOqE,CACxE;YACD,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,kGAAkG,CAAC;YACxH,aAAa,EAAE,EAAE,CAAC,OAAO,CAAC,2EAA2E,CAAC;SACzG,CAAC;IACN,CAAC;IAED,GAAG,CAAC,SAAiB;QACjB,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAA6B,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,CAAc,EAAE,wBAA4C;QAC9D,mEAAmE;QACnE,4DAA4D;QAC5D,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,MAAM,GAAG;YACX,UAAU,EAAE,CAAC,CAAC,SAAS;YACvB,UAAU,EAAE,CAAC,CAAC,SAAS;YACvB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC;YAChC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,SAAS,CACrB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpB,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC/B,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC7B,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9C,CAAC,CAAC,CACN;YACD,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACnE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAC1D,UAAU,EAAE,CAAC,CAAC,SAAS;YACvB,UAAU,EAAE,CAAC,CAAC,SAAS;YACvB,QAAQ,EAAE,CAAC,CAAC,OAAO;YACnB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,iBAAiB,EAAE,CAAC,CAAC,eAAe;YACpC,iBAAiB,EAAE,CAAC,CAAC,gBAAgB;YACrC,YAAY,EAAE,CAAC,CAAC,KAAK;YACrB,OAAO,EAAE,CAAC,CAAC,gBAAgB;YAC3B,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC7B,OAAO,EAAE,CAAC,CAAC,aAAa,IAAI,cAAc;SAC7C,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACjC,IAAI,wBAAwB,KAAK,SAAS,EAAE,CAAC;gBACzC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC9B,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;QAC3G,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,CAAC;IACjB,CAAC;IAED,sGAAsG;IACtG,QAAQ,CAAC,SAAiB;QACtB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,aAAa,CAAC,SAAiB;QAC3B,OAAQ,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAqB,CAAC,CAAC;IAClH,CAAC;IAED;;;;;;;;;OASG;IACH,YAAY,CAAC,SAAiB,EAAE,OAAO,GAA6B,EAAE;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA8B,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;gBAC9B,SAAS;YACb,CAAC;YACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;YACzD,IAAI,MAAM,EAAE,CAAC;gBACT,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACJ,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,KAAK,MAAM,MAAM,IAAI,GAAG,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC;YACjD,oEAAoE;YACpE,8DAA8D;YAC9D,gEAAgE;YAChE,oBAAoB;YACpB,MAAM,aAAa,GAAG,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC5F,IAAI,aAAa,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvC,SAAS;YACb,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;CACJ"}

package/dist/storage/root-commit-backfill.js

@@ -0,0 +1,32 @@
+/** Reports legacy project rows whose current repository identity can be recovered without writing. */
+export function planRootCommitBackfill(db, resolveGitRoot, resolveGitRootCommit) {
+    const projects = db.prepare('SELECT id, path, git_root FROM projects WHERE git_root_commit IS NULL ORDER BY id').all();
+    const changes = [];
+    let projectsUnresolvable = 0;
+    for (const project of projects) {
+        const gitRoot = project.git_root || resolveGitRoot(project.path);
+        const gitRootCommit = gitRoot ? resolveGitRootCommit(gitRoot) : null;
+        if (gitRootCommit === null) {
+            projectsUnresolvable++;
+            continue;
+        }
+        changes.push({ projectId: project.id, path: project.path, gitRootCommit });
+    }
+    return { changes, projectsScanned: projects.length, projectsUnresolvable, projectsSkippedConcurrent: 0 };
+}
+/** Fills only project rows that still need the identity captured by the fresh plan. */
+export function applyRootCommitBackfill(db, resolveGitRoot, resolveGitRootCommit) {
+    const plan = planRootCommitBackfill(db, resolveGitRoot, resolveGitRootCommit);
+    const apply = db.transaction((changes) => {
+        let projectsSkippedConcurrent = 0;
+        const update = db.prepare('UPDATE projects SET git_root_commit = ? WHERE id = ? AND git_root_commit IS NULL');
+        for (const change of changes) {
+            if (update.run(change.gitRootCommit, change.projectId).changes === 0) {
+                projectsSkippedConcurrent++;
+            }
+        }
+        return projectsSkippedConcurrent;
+    });
+    return { ...plan, projectsSkippedConcurrent: apply(plan.changes) };
+}
+//# sourceMappingURL=root-commit-backfill.js.map

package/dist/storage/root-commit-backfill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-commit-backfill.js","sourceRoot":"","sources":["../../src/storage/root-commit-backfill.ts"],"names":[],"mappings":"AAwBA,sGAAsG;AACtG,MAAM,UAAU,sBAAsB,CAClC,EAAY,EACZ,cAA8B,EAC9B,oBAA0C;IAE1C,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,mFAAmF,CAAC,CAAC,GAAG,EAAmB,CAAC;IACxI,MAAM,OAAO,GAA+B,EAAE,CAAC;IAC/C,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAE7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YACzB,oBAAoB,EAAE,CAAC;YACvB,SAAS;QACb,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,MAAM,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,uBAAuB,CACnC,EAAY,EACZ,cAA8B,EAC9B,oBAA0C;IAE1C,MAAM,IAAI,GAAG,sBAAsB,CAAC,EAAE,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,OAAmC,EAAE,EAAE;QACjE,IAAI,yBAAyB,GAAG,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,kFAAkF,CAAC,CAAC;QAC9G,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBACnE,yBAAyB,EAAE,CAAC;YAChC,CAAC;QACL,CAAC;QACD,OAAO,yBAAyB,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,IAAI,EAAE,yBAAyB,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;AACvE,CAAC"}

package/dist/storage/sanitize-backfill.js

@@ -0,0 +1,184 @@
+// Security Rule 3 backfill. The choke points in RollupStore.write() and
+// MemoryStore.recordTurn/reingestTurn() clean everything written from now on;
+// this cleans what the store already holds.
+//
+// Rule 3 debt is real, not hypothetical - the live corpus has rollup rows and
+// memory rows carrying backticks and `$(`. Benign today (markdown-ish quoting
+// of config keys), which is exactly the point: the store holds shell-active
+// syntax and until now nothing checked it.
+//
+// Destructive-operation shape: preview the affected rows with
+// before/after text (the list, not just a count - aggregates hide
+// misclassification), back up, run in one transaction, then re-run the
+// detector store-wide and fail loudly if anything survives.
+//
+// files_touched is deliberately NOT sanitized. Those paths are computed
+// deterministically from tool-call arguments, not emitted by the summarizer,
+// and escaping a metacharacter that is genuinely part of a filename would
+// corrupt the path rather than protect anything. A pathological filename is
+// caught instead by the read-time assertion when it reaches an assembled
+// brief.
+import { detectShellSyntax, escapeShellSyntax, stripShellSyntax } from '../security/sanitize.js';
+function mapJsonField(raw, mapper) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        // A field that does not parse cannot be field-mapped, but it is still
+        // stored text served to a model - sanitize the whole blob as a display
+        // string rather than leaving it alone. Silently skipping is the
+        // failure mode this codebase already paid for.
+        return stripShellSyntax(raw);
+    }
+    return JSON.stringify(mapper(parsed));
+}
+const sanitizeDecisionsJson = (parsed) => {
+    if (!Array.isArray(parsed)) {
+        return parsed;
+    }
+    // memories holds string[]; session_rollups holds {what, why}[]. Both are
+    // the escape policy - a decision may need to name the syntax it ruled out.
+    return parsed.map((d) => {
+        if (typeof d === 'string') {
+            return escapeShellSyntax(d);
+        }
+        if (d && typeof d === 'object' && 'what' in d) {
+            const rec = d;
+            return {
+                ...d,
+                what: typeof rec.what === 'string' ? escapeShellSyntax(rec.what) : rec.what,
+                why: typeof rec.why === 'string' ? escapeShellSyntax(rec.why) : rec.why,
+            };
+        }
+        return d;
+    });
+};
+const sanitizeStringsJson = (parsed) => Array.isArray(parsed) ? parsed.map((s) => (typeof s === 'string' ? stripShellSyntax(s) : s)) : parsed;
+export function sanitizeRollupDisplayField(raw) {
+    return stripShellSyntax(raw);
+}
+export function sanitizeRollupDecisionsField(raw) {
+    return mapJsonField(raw, sanitizeDecisionsJson);
+}
+export function sanitizeRollupPendingItemsField(raw) {
+    return mapJsonField(raw, sanitizeStringsJson);
+}
+const ROLLUP_FIELDS = [
+    { field: 'title', json: false, transform: sanitizeRollupDisplayField },
+    { field: 'summary', json: false, transform: sanitizeRollupDisplayField },
+    { field: 'decisions', json: true, transform: sanitizeRollupDecisionsField },
+    { field: 'pending_items', json: true, transform: sanitizeRollupPendingItemsField },
+];
+const MEMORY_FIELDS = [
+    { field: 'decisions', json: true, transform: (raw) => mapJsonField(raw, sanitizeDecisionsJson) },
+    { field: 'pending_items', json: true, transform: (raw) => mapJsonField(raw, sanitizeStringsJson) },
+];
+function collect(db, table, idColumn, fields) {
+    const columns = fields.map((f) => f.field).join(', ');
+    const rows = db.prepare(`SELECT ${idColumn} AS __id, ${columns} FROM ${table}`).all();
+    const changes = [];
+    for (const row of rows) {
+        for (const spec of fields) {
+            const before = row[spec.field];
+            if (typeof before !== 'string') {
+                continue;
+            }
+            const after = spec.transform(before);
+            if (after !== before) {
+                changes.push({ table, rowId: Number(row.__id), field: spec.field, before, after });
+            }
+        }
+    }
+    return changes;
+}
+/** What the backfill would change, without changing anything. */
+export function planSanitize(db) {
+    const changes = [...collect(db, 'session_rollups', 'session_id', ROLLUP_FIELDS), ...collect(db, 'memories', 'id', MEMORY_FIELDS)];
+    return {
+        changes,
+        rollupRows: new Set(changes.filter((c) => c.table === 'session_rollups').map((c) => c.rowId)).size,
+        memoryRows: new Set(changes.filter((c) => c.table === 'memories').map((c) => c.rowId)).size,
+    };
+}
+/** Applies planSanitize's plan in a single transaction. Returns the plan that was applied, for reporting. */
+export function applySanitize(db) {
+    const plan = planSanitize(db);
+    const apply = db.transaction(() => {
+        for (const c of plan.changes) {
+            const idColumn = c.table === 'session_rollups' ? 'session_id' : 'id';
+            db.prepare(`UPDATE ${c.table} SET ${c.field} = ? WHERE ${idColumn} = ?`).run(c.after, c.rowId);
+        }
+    });
+    apply();
+    return plan;
+}
+/**
+ * Post-backfill verification: re-run the detector over every sanitized field
+ * in the store. This is the check that turns "the store never holds executable
+ * syntax" from a comment into an invariant, so it re-reads from SQL rather
+ * than trusting the plan it just applied.
+ */
+export function verifySanitize(db) {
+    const residue = [];
+    const check = (table, idColumn, fields) => {
+        const columns = fields.map((f) => f.field).join(', ');
+        const rows = db.prepare(`SELECT ${idColumn} AS __id, ${columns} FROM ${table}`).all();
+        for (const row of rows) {
+            for (const spec of fields) {
+                const raw = row[spec.field];
+                if (typeof raw !== 'string') {
+                    continue;
+                }
+                for (const value of leafStrings(raw, spec.json)) {
+                    if (detectShellSyntax(value)) {
+                        residue.push({ table, rowId: Number(row.__id), field: spec.field, text: value });
+                    }
+                }
+            }
+        }
+    };
+    check('session_rollups', 'session_id', ROLLUP_FIELDS);
+    check('memories', 'id', MEMORY_FIELDS);
+    return residue;
+}
+/**
+ * The stored strings inside a field, JSON-decoded where the field is JSON.
+ *
+ * Running the detector on the raw column text instead would report false
+ * positives: JSON escapes a backslash as `\\`, so a correctly escaped
+ * `` \` `` is stored as `` \\` ``, whose backslash parity reads as
+ * "unescaped backtick" to the detector. The invariant is about the values the
+ * store hands out, not their transport encoding.
+ */
+function leafStrings(raw, isJson) {
+    if (!isJson) {
+        return [raw];
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [raw]; // unparseable JSON is still stored text; check it as-is
+    }
+    const out = [];
+    const walk = (node) => {
+        if (typeof node === 'string') {
+            out.push(node);
+        }
+        else if (Array.isArray(node)) {
+            for (const child of node) {
+                walk(child);
+            }
+        }
+        else if (node && typeof node === 'object') {
+            for (const child of Object.values(node)) {
+                walk(child);
+            }
+        }
+    };
+    walk(parsed);
+    return out;
+}
+//# sourceMappingURL=sanitize-backfill.js.map

package/dist/storage/sanitize-backfill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-backfill.js","sourceRoot":"","sources":["../../src/storage/sanitize-backfill.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,8EAA8E;AAC9E,4CAA4C;AAC5C,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,2CAA2C;AAC3C,EAAE;AACF,8DAA8D;AAC9D,kEAAkE;AAClE,uEAAuE;AACvE,4DAA4D;AAC5D,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,yEAAyE;AACzE,SAAS;AAGT,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAmBjG,SAAS,YAAY,CAAC,GAAW,EAAE,MAAkB;IACjD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,sEAAsE;QACtE,uEAAuE;QACvE,gEAAgE;QAChE,+CAA+C;QAC/C,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,qBAAqB,GAAe,CAAC,MAAM,EAAE,EAAE;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,CAAoC,CAAC;YACjD,OAAO;gBACH,GAAG,CAAC;gBACJ,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI;gBAC3E,GAAG,EAAE,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG;aAC1E,CAAC;QACN,CAAC;QACD,OAAO,CAAC,CAAC;IACb,CAAC,CAAC,CAAC;AACP,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAe,CAAC,MAAM,EAAE,EAAE,CAC/C,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAE1G,MAAM,UAAU,0BAA0B,CAAC,GAAW;IAClD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACpD,OAAO,YAAY,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,GAAW;IACvD,OAAO,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;AAClD,CAAC;AASD,MAAM,aAAa,GAAgB;IAC/B,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,0BAA0B,EAAE;IACtE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,0BAA0B,EAAE;IACxE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,4BAA4B,EAAE;IAC3E,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,+BAA+B,EAAE;CACrF,CAAC;AAEF,MAAM,aAAa,GAAgB;IAC/B,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,qBAAqB,CAAC,EAAE;IAChG,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,mBAAmB,CAAC,EAAE;CACrG,CAAC;AAEF,SAAS,OAAO,CAAC,EAAY,EAAE,KAAqC,EAAE,QAAgB,EAAE,MAAmB;IACvG,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,QAAQ,aAAa,OAAO,SAAS,KAAK,EAAE,CAAC,CAAC,GAAG,EAA4C,CAAC;IAEhI,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC7B,SAAS;YACb,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACvF,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,EAAY;IACrC,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,EAAE,EAAE,iBAAiB,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAClI,OAAO;QACH,OAAO;QACP,UAAU,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QAClG,UAAU,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;KAC9F,CAAC;AACN,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,aAAa,CAAC,EAAY;IACtC,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,KAAK,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YACrE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,KAAK,cAAc,QAAQ,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACnG,CAAC;IACL,CAAC,CAAC,CAAC;IACH,KAAK,EAAE,CAAC;IACR,OAAO,IAAI,CAAC;AAChB,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,EAAY;IACvC,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,KAAqC,EAAE,QAAgB,EAAE,MAAmB,EAAE,EAAE;QAC3F,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,QAAQ,aAAa,OAAO,SAAS,KAAK,EAAE,CAAC,CAAC,GAAG,EAA4C,CAAC;QAChI,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC1B,SAAS;gBACb,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9C,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC3B,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBACrF,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC,CAAC;IACF,KAAK,CAAC,iBAAiB,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;IACtD,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACvC,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,GAAW,EAAE,MAAe;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,wDAAwD;IAC1E,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,IAAa,EAAQ,EAAE;QACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;QACL,CAAC;aAAM,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;QACL,CAAC;IACL,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,CAAC;IACb,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/storage/segmentation.js

@@ -0,0 +1,87 @@
+// Segmentation boundary evaluator. Pure decision function - no I/O, no DB
+// access. Callers assemble SegmentBoundaryInput from denormalized
+// trailing_branch/trailing_files columns (see MemoryStore.updateTrailingState)
+// plus the resuming turn's gitBranch/files_touched/resumeMarkerBefore, keeping
+// the decision to one row read per closed turn.
+//
+//   - gap >= 7 days -> cut unconditionally; overlap is diagnostically unavailable.
+//   - below 7 days, files_touched overlap >= 0.5 vetoes a cut.
+//   - otherwise, gap >= 4h AND discontinuity evidence -> cut. Evidence: branch
+//     differs, OR files_touched overlap below threshold, OR a Codex resume
+//     marker (<environment_context>) immediately preceded the
+//     resuming turn. Known-equal branches suppress file overlap when it is the
+//     only evidence.
+//   - gap >= 4h with no evidence -> no cut (resume-tomorrow guard).
+//   - gap < 4h -> never cut, regardless of evidence. The marker does not
+//     override this - a 36-second restart to change --model is a real
+//     process reattachment inside one episode, not an episode boundary.
+import { SEGMENT_FILE_CONTINUITY_THRESHOLD, SEGMENT_FILE_OVERLAP_THRESHOLD, SEGMENT_MIN_GAP_HOURS, SEGMENT_UNCONDITIONAL_GAP_HOURS, } from '../config/constants.js';
+/**
+ * Jaccard overlap (intersection / union) of the two file sets. Returns null
+ * when either side is empty - that is "unavailable", never "differs". With
+ * nothing on one side there is nothing to compare; treating the arithmetic
+ * zero as maximum divergence would turn missing file data into cut evidence,
+ * especially for Codex where most turns carry no paths.
+ */
+export function fileOverlapRatio(trailingFiles, resumingFiles) {
+    if (trailingFiles.length === 0 || resumingFiles.length === 0) {
+        return null;
+    }
+    const trailing = new Set(trailingFiles);
+    const resuming = new Set(resumingFiles);
+    let intersection = 0;
+    for (const f of trailing) {
+        if (resuming.has(f)) {
+            intersection++;
+        }
+    }
+    const union = new Set([...trailing, ...resuming]).size;
+    return union === 0 ? null : intersection / union;
+}
+/**
+ * True if branch is known on both sides and they differ. An unknown branch on
+ * either side is never treated as "differs" - Codex has no per-turn branch
+ * capture (see corpus-discriminators), and the Codex fallback rule ("no cut
+ * below 7 days when no evidence exists") depends on that absence not being
+ * misread as a positive discontinuity signal.
+ */
+function branchDiffers(trailingBranch, resumingBranch) {
+    return trailingBranch !== null && resumingBranch !== null && trailingBranch !== resumingBranch;
+}
+/**
+ * Diagnostic companion to evaluateSegmentBoundary(). Migration previews need
+ * to show why each proposed cut fired, not only the aggregate count. The
+ * evaluator delegates to this function so preview evidence cannot drift from
+ * the live decision rule.
+ */
+export function assessSegmentBoundary(input) {
+    if (input.gapHours >= SEGMENT_UNCONDITIONAL_GAP_HOURS) {
+        return { cut: true, evidence: ['seven-day-gap'], fileOverlap: null };
+    }
+    const overlap = fileOverlapRatio(input.trailingFiles, input.resumingFiles);
+    if (input.gapHours < SEGMENT_MIN_GAP_HOURS) {
+        return { cut: false, evidence: [], fileOverlap: overlap };
+    }
+    if (overlap !== null && overlap >= SEGMENT_FILE_CONTINUITY_THRESHOLD) {
+        return { cut: false, evidence: [], fileOverlap: overlap };
+    }
+    const evidence = [];
+    if (branchDiffers(input.trailingBranch, input.resumingBranch)) {
+        evidence.push('branch-change');
+    }
+    if (overlap !== null && overlap < SEGMENT_FILE_OVERLAP_THRESHOLD) {
+        evidence.push('file-overlap');
+    }
+    if (input.resumeMarkerBefore) {
+        evidence.push('resume-marker');
+    }
+    const branchesMatch = input.trailingBranch !== null && input.resumingBranch !== null && input.trailingBranch === input.resumingBranch;
+    if (branchesMatch && evidence.length === 1 && evidence[0] === 'file-overlap') {
+        return { cut: false, evidence: [], fileOverlap: overlap };
+    }
+    return { cut: evidence.length > 0, evidence, fileOverlap: overlap };
+}
+export function evaluateSegmentBoundary(input) {
+    return assessSegmentBoundary(input).cut;
+}
+//# sourceMappingURL=segmentation.js.map

package/dist/storage/segmentation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"segmentation.js","sourceRoot":"","sources":["../../src/storage/segmentation.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,kEAAkE;AAClE,+EAA+E;AAC/E,+EAA+E;AAC/E,gDAAgD;AAChD,EAAE;AACF,mFAAmF;AACnF,+DAA+D;AAC/D,+EAA+E;AAC/E,2EAA2E;AAC3E,8DAA8D;AAC9D,+EAA+E;AAC/E,qBAAqB;AACrB,oEAAoE;AACpE,yEAAyE;AACzE,sEAAsE;AACtE,wEAAwE;AAExE,OAAO,EACH,iCAAiC,EACjC,8BAA8B,EAC9B,qBAAqB,EACrB,+BAA+B,GAClC,MAAM,wBAAwB,CAAC;AAmChC;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,aAAuB,EAAE,aAAuB;IAC7E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACvB,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,YAAY,EAAE,CAAC;QACnB,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,GAAG,KAAK,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,cAA6B,EAAE,cAA6B;IAC/E,OAAO,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,cAAc,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA2B;IAC7D,IAAI,KAAK,CAAC,QAAQ,IAAI,+BAA+B,EAAE,CAAC;QACpD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC3E,IAAI,KAAK,CAAC,QAAQ,GAAG,qBAAqB,EAAE,CAAC;QACzC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,IAAI,iCAAiC,EAAE,CAAC;QACnE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,IAAI,aAAa,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,GAAG,8BAA8B,EAAE,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,cAAc,KAAK,IAAI,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,CAAC;IACtI,IAAI,aAAa,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;QAC3E,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAA2B;IAC/D,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;AAC5C,CAAC"}